Snap for 4733232 from f95e4bd59474b14b76ef1b1fc9c3531791e40054 to nyc-iot-releaseandroid-n-iot-release-smart-display-r2android-n-iot-release-smart-displayandroid-n-iot-release-polk-at1android-n-iot-release-lg-thinq-wk7

Change-Id: I6bd9db2e29bdb258688e5117de85fa5783f69f19

339 files changed, 61967 insertions, 18914 deletions

diff --git a/drivers/platform/msm/avtimer.c b/drivers/platform/msm/avtimer.c
index a2ef12fa840..36864e13788 100644
--- a/drivers/platform/msm/avtimer.c
+++ b/drivers/platform/msm/avtimer.c
@@ -313,6 +313,43 @@ int avcs_core_query_timer(uint64_t *avtimer_tick)
 }
 EXPORT_SYMBOL(avcs_core_query_timer);
 
+/* This function will return the offset between system clock & avtimer clock
+   which can then be used to map timestamps coming from avtimer in system time
+   context. Also adsp state doesn't needed to be checked in this function as it
+   would be made sure in caller context */
+
+int avcs_core_query_timer_offset(int64_t *av_offset)
+{
+	uint32_t avtimer_msw = 0, avtimer_lsw = 0;
+	uint32_t res = 0;
+	uint64_t avtimer_tick_temp, sys_time = 0;
+	struct timespec ts = {0};
+
+	mutex_lock(&avtimer.avtimer_lock);
+	if ((avtimer.p_avtimer_lsw == NULL)||(avtimer.p_avtimer_msw == NULL))
+	{
+		mutex_unlock(&avtimer.avtimer_lock);
+		return -EINVAL;
+	}
+
+	avtimer_lsw = ioread32(avtimer.p_avtimer_lsw);
+	avtimer_msw = ioread32(avtimer.p_avtimer_msw);
+
+	ktime_get_ts(&ts);
+	mutex_unlock(&avtimer.avtimer_lock);
+
+	sys_time = ts.tv_sec * 1000000LL + div64_u64(ts.tv_nsec, 1000);
+	avtimer_tick_temp = (uint64_t)((uint64_t)avtimer_msw << 32) | avtimer_lsw;
+
+	res = do_div(avtimer_tick_temp, avtimer.clk_div);
+	*av_offset = sys_time - avtimer_tick_temp;
+	pr_debug_ratelimited("%s:Avtimer: sys_time: %llu, avtime %llu offset %lld\n",
+			__func__,
+			sys_time, avtimer_tick_temp, *av_offset);
+	return 0;
+}
+EXPORT_SYMBOL(avcs_core_query_timer_offset);
+
 static int avtimer_open(struct inode *inode, struct file *file)
 {
 	return avcs_core_disable_power_collapse(1);
diff --git a/drivers/staging/qcacld-2.0/Android.mk b/drivers/staging/qcacld-2.0/Android.mk
index d0655d70c0f..9ad22f0a3b2 100644
--- a/drivers/staging/qcacld-2.0/Android.mk
+++ b/drivers/staging/qcacld-2.0/Android.mk
@@ -128,15 +128,24 @@ LOCAL_MODULE              := $(WLAN_CHIPSET)_wlan.ko
 LOCAL_MODULE_KBUILD_NAME  := wlan.ko
 LOCAL_MODULE_TAGS         := debug
 LOCAL_MODULE_DEBUG_ENABLE := true
+ifeq ($(PRODUCT_VENDOR_MOVE_ENABLED), true)
+LOCAL_MODULE_PATH         := $(TARGET_OUT_VENDOR)/lib/modules/$(WLAN_CHIPSET)
+else
 LOCAL_MODULE_PATH         := $(TARGET_OUT)/lib/modules/$(WLAN_CHIPSET)
+endif # PRODUCT_VENDOR_MOVE_ENABLED
 include $(DLKM_DIR)/AndroidKernelModule.mk
 ###########################################################
 
 #Create symbolic link
+ifeq ($(PRODUCT_VENDOR_MOVE_ENABLED), true)
+$(shell mkdir -p $(TARGET_OUT_VENDOR)/lib/modules; \
+    ln -sf /$(TARGET_COPY_OUT_VENDOR)/lib/modules/$(WLAN_CHIPSET)/$(WLAN_CHIPSET)_wlan.ko \
+           $(TARGET_OUT_VENDOR)/lib/modules/wlan.ko)
+else
 $(shell mkdir -p $(TARGET_OUT)/lib/modules; \
-        ln -sf /system/lib/modules/$(WLAN_CHIPSET)/$(WLAN_CHIPSET)_wlan.ko \
-               $(TARGET_OUT)/lib/modules/wlan.ko)
-
+    ln -sf /system/lib/modules/$(WLAN_CHIPSET)/$(WLAN_CHIPSET)_wlan.ko \
+           $(TARGET_OUT)/lib/modules/wlan.ko)
+endif # PRODUCT_VENDOR_MOVE_ENABLED
 endif # DLKM check
 
 endif # supported target check
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt.c
index 40fadc4e91d..3e91ceb2d59 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -389,9 +389,17 @@ htt_attach_target(htt_pdev_handle pdev)
     return status;
 }
 
+void htt_htc_detach(struct htt_pdev_t *pdev)
+{
+    htc_disconnect_service(pdev->htc_endpoint);
+    return;
+}
+
+
 void
 htt_detach(htt_pdev_handle pdev)
 {
+    htt_htc_detach(pdev);
     htt_rx_detach(pdev);
     htt_tx_detach(pdev);
     htt_htc_pkt_pool_free(pdev);
@@ -453,7 +461,8 @@ htt_htc_attach(struct htt_pdev_t *pdev)
      * TODO:Conditional disabling will be removed once firmware
      * with reduced tx completion is pushed into release builds.
      */
-    if (!pdev->cfg.default_tx_comp_req) {
+    if ((!pdev->cfg.default_tx_comp_req) ||
+            ol_cfg_is_ptp_enabled(pdev->ctrl_pdev)) {
        connect.ConnectionFlags |= HTC_CONNECT_FLAGS_DISABLE_CREDIT_FLOW_CTRL;
     }
 #else
@@ -527,12 +536,12 @@ htt_display(htt_pdev_handle pdev, int indent)
         indent+4, " ",
         pdev->rx_ring.size,
         pdev->rx_ring.fill_level);
-    adf_os_print("%*sat %p (%#x paddr)\n", indent+8, " ",
+    adf_os_print("%*sat %pK (%#x paddr)\n", indent+8, " ",
         pdev->rx_ring.buf.paddrs_ring,
         pdev->rx_ring.base_paddr);
-    adf_os_print("%*snetbuf ring @ %p\n", indent+8, " ",
+    adf_os_print("%*snetbuf ring @ %pK\n", indent+8, " ",
         pdev->rx_ring.buf.netbufs_ring);
-    adf_os_print("%*sFW_IDX shadow register: vaddr = %p, paddr = %#x\n",
+    adf_os_print("%*sFW_IDX shadow register: vaddr = %pK, paddr = %#x\n",
         indent+8, " ",
         pdev->rx_ring.alloc_idx.vaddr,
         pdev->rx_ring.alloc_idx.paddr);
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt.h
index c608cf59413..59c5864b0fc 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -4068,6 +4068,7 @@ enum htt_t2h_msg_type {
     HTT_T2H_MSG_TYPE_FLOW_POOL_MAP            = 0x18,
     HTT_T2H_MSG_TYPE_FLOW_POOL_UNMAP          = 0x19,
     HTT_T2H_MSG_TYPE_SRING_SETUP_DONE         = 0x1a,
+    HTT_T2H_MSG_TYPE_MONITOR_MAC_HEADER_IND   = 0x20,
 
     HTT_T2H_MSG_TYPE_TEST,
     /* keep this last */
@@ -4487,7 +4488,8 @@ PREPACK struct htt_rx_ind_hdr_suffix_t
 {
     A_UINT32 /* word 0 */
         fw_rx_desc_bytes: 16,
-        reserved0: 16;
+        noise_floor_chain0: 8,
+        noise_floor_chain1: 8;
 } POSTPACK;
 
 #define HTT_RX_IND_HDR_SUFFIX_BYTES (sizeof(struct htt_rx_ind_hdr_suffix_t))
@@ -4593,7 +4595,7 @@ A_COMPILE_TIME_ASSERT(HTT_RX_IND_hdr_size_quantum,
  * |--------------------------------------------------------------------------|
  * |    service     |                    HT-SIG / VHT-SIG-A2                  |
  * |==========================================================================|
- * |             reserved               |          FW rx desc bytes           |
+ * |     chain1 NF  |   chain0 NF       |          FW rx desc bytes           |
  * |--------------------------------------------------------------------------|
  * |     MSDU Rx    |      MSDU Rx      |        MSDU Rx      |    MSDU Rx    |
  * |     desc B3    |      desc B2      |        desc B1      |    desc B0    |
@@ -4896,6 +4898,12 @@ A_COMPILE_TIME_ASSERT(HTT_RX_IND_hdr_size_quantum,
  *     Bits 15:0
  *     Purpose: Indicate how many bytes in the Rx indication are used for
  *         FW Rx descriptors
+ *   - chain0 noise floor
+ *     Bits 23:16
+ *     Purpose: Indicate chain0 noise floor to host
+ *   - chain1 noise floor
+ *     Bits 31:24
+ *     Purpose: Indicate chain1 noise floor to host
  *
  * Payload fields:
  *   - MPDU_COUNT
@@ -4974,6 +4982,11 @@ A_COMPILE_TIME_ASSERT(HTT_RX_IND_hdr_size_quantum,
 #define HTT_RX_IND_FW_RX_DESC_BYTES_M   0xffff
 #define HTT_RX_IND_FW_RX_DESC_BYTES_S   0
 
+#define HTT_RX_IND_NOISE_FLOOR_CHAIN0_M   0x00ff0000
+#define HTT_RX_IND_NOISE_FLOOR_CHAIN0_S   16
+#define HTT_RX_IND_NOISE_FLOOR_CHAIN1_M   0xff000000
+#define HTT_RX_IND_NOISE_FLOOR_CHAIN1_S   24
+
 /* payload fields */
 #define HTT_RX_IND_MPDU_COUNT_M    0xff
 #define HTT_RX_IND_MPDU_COUNT_S    0
@@ -5022,6 +5035,11 @@ A_COMPILE_TIME_ASSERT(HTT_RX_IND_hdr_size_quantum,
 #define HTT_RX_IND_FW_RX_DESC_BYTES_GET(word) \
     (((word) & HTT_RX_IND_FW_RX_DESC_BYTES_M) >> HTT_RX_IND_FW_RX_DESC_BYTES_S)
 
+#define HTT_RX_IND_NOISE_FLOOR_CHAIN0_GET(word) \
+    (((word) & HTT_RX_IND_NOISE_FLOOR_CHAIN0_M) >> HTT_RX_IND_NOISE_FLOOR_CHAIN0_S)
+#define HTT_RX_IND_NOISE_FLOOR_CHAIN1_GET(word) \
+    (((word) & HTT_RX_IND_NOISE_FLOOR_CHAIN1_M) >> HTT_RX_IND_NOISE_FLOOR_CHAIN1_S)
+
 
 #define HTT_RX_IND_FLUSH_SEQ_NUM_START_SET(word, value)              \
     do {                                                             \
@@ -6220,15 +6238,19 @@ PREPACK struct htt_txq_group {
  * The following diagram shows the format of the TX completion indication sent
  * from the target to the host
  *
- *          |31      25|    24|23        16| 15 |14 11|10   8|7          0|
+ *          |31      27|26|25|24|23     16| 15 |14 11|10    8|7          0|
  *          |-------------------------------------------------------------|
- * header:  | reserved |append|     num    | t_i| tid |status|  msg_type  |
+ * header:  | reserved |a2|a1|a0|   num   | t_i| tid |status |  msg_type  |
  *          |-------------------------------------------------------------|
  * payload: |            MSDU1 ID          |         MSDU0 ID             |
  *          |-------------------------------------------------------------|
  *          :            MSDU3 ID          :         MSDU2 ID             :
  *          |-------------------------------------------------------------|
  *          |          struct htt_tx_compl_ind_append_retries             |
+ *          |-------------------------------------------------------------|
+ *          |          struct htt_tx_compl_ind_append_txtstamp            |
+ *          |-------------------------------------------------------------|
+ *          |          struct htt_tx_compl_ind_append_txpower             |
  *          - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  *
  * The following field definitions describe the format of the TX completion
@@ -6255,10 +6277,21 @@ PREPACK struct htt_txq_group {
  *   Bits 23:16
  *   Purpose: the number of payload in this indication
  *   Value: 1 to 255
- * - append
+ * - a0 - append0
  *   Bits 24:24
  *   Purpose: append the struct htt_tx_compl_ind_append_retries which contains
- *            the number of tx retries for one MSDU at the end of this message
+ *            the number of tx retries for one MSDU after MSDU ID.
+ *   Value: 0 indicates no appending; 1 indicates appending
+ * - a1 - append1
+ *   Bits 25:25
+ *   Purpose: append the struct htt_tx_compl_ind_append_txtstamp which contains
+ *            the timestamp info for each TX msdu id in payload after append0.
+ *   Value: 0 indicates no appending; 1 indicates appending
+ * - a2 - append2
+ *   Bits 26:26
+ *   Purpose: append the struct htt_tx_compl_ind_append_txpower which contains
+ *            one or more tx power of each MSDUs after append1.
+ *            The start of tx power(s) must be 4-bytes-word aligned.
  *   Value: 0 indicates no appending; 1 indicates appending
  * Payload fields:
  * - hmsdu_id
@@ -6277,6 +6310,10 @@ PREPACK struct htt_txq_group {
 #define HTT_TX_COMPL_IND_NUM_M         0x00ff0000
 #define HTT_TX_COMPL_IND_APPEND_S      24
 #define HTT_TX_COMPL_IND_APPEND_M      0x01000000
+#define HTT_TX_COMPL_IND_APPEND1_S     25
+#define HTT_TX_COMPL_IND_APPEND1_M     0x02000000
+#define HTT_TX_COMPL_IND_APPEND2_S     26
+#define HTT_TX_COMPL_IND_APPEND2_M     0x04000000
 
 #define HTT_TX_COMPL_IND_STATUS_SET(_info, _val)                        \
     do {                                                                \
@@ -6314,6 +6351,23 @@ PREPACK struct htt_txq_group {
     } while (0)
 #define HTT_TX_COMPL_IND_APPEND_GET(_info)                             \
     (((_info) & HTT_TX_COMPL_IND_APPEND_M) >> HTT_TX_COMPL_IND_APPEND_S)
+#define HTT_TX_COMPL_IND_APPEND1_SET(_info, _val)                           \
+    do {                                                            \
+        HTT_CHECK_SET_VAL(HTT_TX_COMPL_IND_APPEND1, _val);          \
+        ((_info) |= ((_val) << HTT_TX_COMPL_IND_APPEND1_S));        \
+    } while (0)
+#define HTT_TX_COMPL_IND_APPEND1_GET(_info)                             \
+    (((_info) & HTT_TX_COMPL_IND_APPEND1_M) >> HTT_TX_COMPL_IND_APPEND1_S)
+#define HTT_TX_COMPL_IND_APPEND2_SET(_info, _val)                        \
+    do {                                                           \
+        HTT_CHECK_SET_VAL(HTT_TX_COMPL_IND_APPEND2, _val);           \
+        ((_info) |= ((_val) << HTT_TX_COMPL_IND_APPEND2_S));         \
+    } while (0)
+#define HTT_TX_COMPL_IND_APPEND2_GET(_info)                              \
+    (((_info) & HTT_TX_COMPL_IND_APPEND2_M) >> HTT_TX_COMPL_IND_APPEND2_S)
+
+#define HTT_TX_COMPL_HEAD_SZ                4
+#define HTT_TX_COMPL_BYTES_PER_MSDU_ID      2
 
 #define HTT_TX_COMPL_CTXT_SZ                sizeof(A_UINT16)
 #define HTT_TX_COMPL_CTXT_NUM(_bytes)       ((_bytes) >> 1)
@@ -6332,6 +6386,10 @@ PREPACK struct htt_txq_group {
  */
 #define HTT_TX_COMPL_IND_STAT_PEER_DEL    4
 
+#if defined(CONFIG_HL_SUPPORT)
+/* The FAIL_NOTIFY status is used for regular frms in HL cases */
+#define HTT_TX_COMPL_IND_STAT_FAIL_NOTIFY   5
+#endif
 
 #define HTT_TX_COMPL_IND_APPEND_SET_MORE_RETRY(f)  ((f) |= 0x1)
 #define HTT_TX_COMPL_IND_APPEND_CLR_MORE_RETRY(f)  ((f) &= (~0x1))
@@ -6348,6 +6406,14 @@ PREPACK struct htt_tx_compl_ind_append_retries {
                              0: this is the last append_retries struct */
 } POSTPACK;
 
+PREPACK struct htt_tx_compl_ind_append_txtstamp {
+    A_UINT32 timestamp[1/*or more*/];
+} POSTPACK;
+
+PREPACK struct htt_tx_compl_ind_append_txpower {
+    A_UINT16 tx_power[1/*or more*/];
+} POSTPACK;
+
 /**
  * @brief target -> host rate-control update indication message
  *
@@ -8123,4 +8189,76 @@ enum htt_ring_setup_status {
         ((_var) |= ((_val) << HTT_SRING_SETUP_DONE_STATUS_S)); \
     } while (0)
 
+/**
+ * @brief target -> host monitor mac header indication message
+ *
+ * @details
+ * The following diagram shows the format of the monitor mac header message
+ * sent from the target to the host, while enable rx filter promiscuous.
+ *
+ *          |31          24|23           16|15            8|7            0|
+ *          |-------------------------------------------------------------|
+ *          |            peer_id           |    reserved0  |    msg_type  |
+ *          |-------------------------------------------------------------|
+ *          |            reserved1         |           num_mpdu           |
+ *          |-------------------------------------------------------------|
+ *          |                       struct hw_rx_desc                     |
+ *          |                      (see wal_rx_desc.h)                    |
+ *          |-------------------------------------------------------------|
+ *          |                   struct ieee80211_frame_addr4              |
+ *          |                      (see ieee80211_defs.h)                 |
+ *          |                            ......                           |
+ *          |-------------------------------------------------------------|
+ *
+ * Header fields:
+ *  - msg_type
+ *    Bits 7:0
+ *    Purpose: Identifies this is a monitor mac header indication
+ *             message.
+ *    Value: 0x20
+ *   - reserved0
+ *     Bits 15:8
+ *     Purpose:
+ *     value:
+ *  - peer_id
+ *    Bits 31:16
+ *    Purpose: Software peer id given by host during association,
+               in this case it should be set to invalid(0xFF)
+ *    Value:
+ *  - num_mpdu
+ *    Bits 15:0
+ *    Purpose: numbers of mpdu mac header (struct ieee80211_frame_addr4) per rx ppdu
+ *             the maximum num_mpdu is limited to 32.
+ *    Value:
+ *   - reserved1
+ *     Bits 31:16
+ *     Purpose:
+ *     value:
+ */
+#define HTT_T2H_MONITOR_MAC_HEADER_IND_HDR_SIZE       8
+
+#define HTT_T2H_MONITOR_MAC_HEADER_PEER_ID_M          0xFFFF0000
+#define HTT_T2H_MONITOR_MAC_HEADER_PEER_ID_S          16
+
+#define HTT_T2H_MONITOR_MAC_HEADER_NUM_MPDU_M         0x0000FFFF
+#define HTT_T2H_MONITOR_MAC_HEADER_NUM_MPDU_S         0
+
+#define HTT_T2H_MONITOR_MAC_HEADER_PEER_ID_SET(word, value)             \
+    do {                                                         \
+        HTT_CHECK_SET_VAL(HTT_T2H_MONITOR_MAC_HEADER_PEER_ID, value);   \
+        (word) |= (value)  << HTT_T2H_MONITOR_MAC_HEADER_PEER_ID_S;     \
+    } while (0)
+#define HTT_T2H_MONITOR_MAC_HEADER_PEER_ID_GET(word) \
+    (((word) & HTT_T2H_MONITOR_MAC_HEADER_PEER_ID_M) >> \
+    HTT_T2H_MONITOR_MAC_HEADER_PEER_ID_S)
+
+#define HTT_T2H_MONITOR_MAC_HEADER_NUM_MPDU_SET(word, value)             \
+    do {                                                         \
+        HTT_CHECK_SET_VAL(HTT_T2H_MONITOR_MAC_HEADER_NUM_MPDU, value);   \
+        (word) |= (value)  << HTT_T2H_MONITOR_MAC_HEADER_NUM_MPDU_S;     \
+    } while (0)
+#define HTT_T2H_MONITOR_MAC_HEADER_NUM_MPDU_GET(word) \
+    (((word) & HTT_T2H_MONITOR_MAC_HEADER_NUM_MPDU_M) >> \
+    HTT_T2H_MONITOR_MAC_HEADER_NUM_MPDU_S)
+
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_h2t.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_h2t.c
index 541dec2a86d..073d45f509e 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_h2t.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_h2t.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -132,9 +132,21 @@ htt_h2t_ver_req_msg(struct htt_pdev_t *pdev)
     u_int32_t *msg_word;
     u_int32_t msg_size;
     u_int32_t max_tx_group;
+    int tx_credit_availablity = A_EINVAL;
+
+    if ((pdev->cfg.is_high_latency) &&
+        (!pdev->cfg.default_tx_comp_req)) {
+        tx_credit_availablity = ol_tx_target_credit_dec(pdev->txrx_pdev, 1);
+        if(tx_credit_availablity == A_ERROR) {
+            return A_ERROR; /* failure */
+        }
+    }
 
     pkt = htt_htc_pkt_alloc(pdev);
     if (!pkt) {
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
         return A_ERROR; /* failure */
     }
 
@@ -158,6 +170,9 @@ htt_h2t_ver_req_msg(struct htt_pdev_t *pdev)
         HTC_HEADER_LEN + HTC_HDR_ALIGNMENT_PADDING, 4, TRUE);
     if (!msg) {
         htt_htc_pkt_free(pdev, pkt);
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
         return A_ERROR; /* failure */
     }
 
@@ -206,10 +221,6 @@ htt_h2t_ver_req_msg(struct htt_pdev_t *pdev)
 #else
     HTCSendPkt(pdev->htc_pdev, &pkt->htc_pkt);
 #endif
-    if ((pdev->cfg.is_high_latency) &&
-        (!pdev->cfg.default_tx_comp_req)) {
-        ol_tx_target_credit_update(pdev->txrx_pdev, -1);
-    }
     return A_OK;
 }
 
@@ -405,9 +416,20 @@ htt_h2t_rx_ring_cfg_msg_hl(struct htt_pdev_t *pdev)
     struct htt_htc_pkt *pkt;
     adf_nbuf_t msg;
     u_int32_t *msg_word;
+    int tx_credit_availablity = A_EINVAL;
+
+    if (!pdev->cfg.default_tx_comp_req) {
+        tx_credit_availablity = ol_tx_target_credit_dec(pdev->txrx_pdev, 1);
+        if(tx_credit_availablity == A_ERROR) {
+            return A_ERROR; /* failure */
+        }
+    }
 
     pkt = htt_htc_pkt_alloc(pdev);
     if (!pkt) {
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
         return A_ERROR; /* failure */
     }
 
@@ -422,6 +444,9 @@ htt_h2t_rx_ring_cfg_msg_hl(struct htt_pdev_t *pdev)
         HTC_HEADER_LEN + HTC_HDR_ALIGNMENT_PADDING, 4, TRUE);
     if (!msg) {
         htt_htc_pkt_free(pdev, pkt);
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
         return A_ERROR; /* failure */
     }
     /*
@@ -532,9 +557,6 @@ htt_h2t_rx_ring_cfg_msg_hl(struct htt_pdev_t *pdev)
 #else
     HTCSendPkt(pdev->htc_pdev, &pkt->htc_pkt);
 #endif
-    if (!pdev->cfg.default_tx_comp_req) {
-        ol_tx_target_credit_update(pdev->txrx_pdev, -1);
-    }
     return A_OK;
 }
 
@@ -551,10 +573,22 @@ htt_h2t_dbg_stats_get(
     adf_nbuf_t msg;
     u_int32_t *msg_word;
     uint16_t htc_tag = 1;
+    int tx_credit_availablity = A_EINVAL;
+
+    if ((pdev->cfg.is_high_latency) &&
+        (!pdev->cfg.default_tx_comp_req)) {
+        tx_credit_availablity = ol_tx_target_credit_dec(pdev->txrx_pdev, 1);
+        if(tx_credit_availablity == A_ERROR) {
+            return A_ERROR; /* failure */
+        }
+    }
 
     pkt = htt_htc_pkt_alloc(pdev);
     if (!pkt) {
-        return -1; /* failure */
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
+        return A_ERROR; /* failure */
     }
 
     if (stats_type_upload_mask >= 1 << HTT_DBG_NUM_STATS ||
@@ -564,7 +598,10 @@ htt_h2t_dbg_stats_get(
         adf_os_print("%#x %#x stats not supported\n",
             stats_type_upload_mask, stats_type_reset_mask);
         htt_htc_pkt_free(pdev, pkt);
-        return -1; /* failure */
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
+        return A_ERROR; /* failure */
     }
 
     if (stats_type_reset_mask)
@@ -581,7 +618,10 @@ htt_h2t_dbg_stats_get(
         HTC_HEADER_LEN + HTC_HDR_ALIGNMENT_PADDING, 4, FALSE);
     if (!msg) {
         htt_htc_pkt_free(pdev, pkt);
-        return -1; /* failure */
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
+        return A_ERROR; /* failure */
     }
     /* set the length of the message */
     adf_nbuf_put_tail(msg, HTT_H2T_STATS_REQ_MSG_SZ);
@@ -630,10 +670,6 @@ htt_h2t_dbg_stats_get(
 #else
     HTCSendPkt(pdev->htc_pdev, &pkt->htc_pkt);
 #endif
-    if ((pdev->cfg.is_high_latency) &&
-        (!pdev->cfg.default_tx_comp_req)) {
-        ol_tx_target_credit_update(pdev->txrx_pdev, -1);
-    }
     return 0;
 }
 
@@ -643,9 +679,21 @@ htt_h2t_sync_msg(struct htt_pdev_t *pdev, u_int8_t sync_cnt)
     struct htt_htc_pkt *pkt;
     adf_nbuf_t msg;
     u_int32_t *msg_word;
+    int tx_credit_availablity = A_EINVAL;
+
+    if ((pdev->cfg.is_high_latency) &&
+        (!pdev->cfg.default_tx_comp_req)) {
+        tx_credit_availablity = ol_tx_target_credit_dec(pdev->txrx_pdev, 1);
+        if(tx_credit_availablity == A_ERROR) {
+            return A_ERROR; /* failure */
+        }
+    }
 
     pkt = htt_htc_pkt_alloc(pdev);
     if (!pkt) {
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
         return A_NO_MEMORY;
     }
 
@@ -691,10 +739,6 @@ htt_h2t_sync_msg(struct htt_pdev_t *pdev, u_int8_t sync_cnt)
 #else
     HTCSendPkt(pdev->htc_pdev, &pkt->htc_pkt);
 #endif
-    if ((pdev->cfg.is_high_latency) &&
-        (!pdev->cfg.default_tx_comp_req)) {
-        ol_tx_target_credit_update(pdev->txrx_pdev, -1);
-    }
     return A_OK;
 }
 
@@ -706,10 +750,22 @@ htt_h2t_aggr_cfg_msg(struct htt_pdev_t *pdev,
     struct htt_htc_pkt *pkt;
     adf_nbuf_t msg;
     u_int32_t *msg_word;
+    int tx_credit_availablity = A_EINVAL;
+
+    if ((pdev->cfg.is_high_latency) &&
+        (!pdev->cfg.default_tx_comp_req)) {
+        tx_credit_availablity = ol_tx_target_credit_dec(pdev->txrx_pdev, 1);
+        if(tx_credit_availablity == A_ERROR) {
+            return A_ERROR; /* failure */
+        }
+    }
 
     pkt = htt_htc_pkt_alloc(pdev);
     if (!pkt) {
-        return -1; /* failure */
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
+        return A_ERROR; /* failure */
     }
 
     /* show that this is not a tx frame download (not required, but helpful) */
@@ -723,7 +779,10 @@ htt_h2t_aggr_cfg_msg(struct htt_pdev_t *pdev,
         HTC_HEADER_LEN + HTC_HDR_ALIGNMENT_PADDING, 4, FALSE);
     if (!msg) {
         htt_htc_pkt_free(pdev, pkt);
-        return -1; /* failure */
+        if (tx_credit_availablity == A_OK) {
+            ol_tx_target_credit_update(pdev->txrx_pdev, 1);
+        }
+        return A_ERROR; /* failure */
     }
     /* set the length of the message */
     adf_nbuf_put_tail(msg, HTT_AGGR_CFG_MSG_SZ);
@@ -761,10 +820,6 @@ htt_h2t_aggr_cfg_msg(struct htt_pdev_t *pdev,
 #else
     HTCSendPkt(pdev->htc_pdev, &pkt->htc_pkt);
 #endif
-    if ((pdev->cfg.is_high_latency) &&
-        (!pdev->cfg.default_tx_comp_req)) {
-        ol_tx_target_credit_update(pdev->txrx_pdev, -1);
-    }
     return 0;
 }
 
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_internal.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_internal.h
index 2bff7e4bc93..667bf4f677a 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_internal.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016, 2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -51,6 +51,21 @@
 #include <rx_desc.h>
 #include <wal_rx_desc.h> /* struct rx_attention, etc */
 
+/*
+ * Define the HW descriptor information used by host,
+ * which is copied by FW into HTT msg.
+ */
+struct htt_hw_rx_desc_base {
+    struct rx_attention  attention;
+    struct rx_frag_info  frag_info;
+    struct rx_mpdu_start mpdu_start;
+    struct rx_msdu_start msdu_start;
+    struct rx_msdu_end   msdu_end;
+    struct rx_mpdu_end   mpdu_end;
+    struct rx_ppdu_start ppdu_start;
+    struct rx_ppdu_end   ppdu_end;
+};
+
 struct htt_host_fw_desc_base {
     union {
         struct fw_rx_desc_base val;
@@ -341,9 +356,9 @@ htt_print_rx_desc(struct htt_host_rx_desc_base *rx_desc)
 #endif
 
 #ifdef ATH_11AC_TXCOMPACT
- #define HTT_TX_SCHED htt_tx_sched
+#define HTT_TX_SCHED htt_tx_sched
 #else
- #define HTT_TX_SCHED(pdev) /* no-op */
+#define HTT_TX_SCHED(pdev) /* no-op */
 #endif
 
 int
@@ -361,6 +376,16 @@ htt_rx_detach(struct htt_pdev_t *pdev);
 int
 htt_htc_attach(struct htt_pdev_t *pdev);
 
+/**
+ * htt_htc_detach() - Detach htc service from htt
+ * @pdev: htt pdev handle
+ *
+ *
+ * Return: None
+ */
+void
+htt_htc_detach(struct htt_pdev_t *pdev);
+
 void
 htt_t2h_msg_handler(void *context, HTC_PACKET *pkt);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_rx.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_rx.c
index 6dc8dc55327..53c82ad2fa8 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_rx.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -312,6 +312,13 @@ htt_rx_ring_fill_n(struct htt_pdev_t *pdev, int num)
     }
 
 fail:
+    /*
+     * Make sure alloc index write is reflected correctly before FW polls
+     * remote ring write index as compiler can reorder the instructions
+     * based on optimizations.
+     */
+
+    adf_os_mb();
     *(pdev->rx_ring.alloc_idx.vaddr) = idx;
     return;
 }
@@ -1284,6 +1291,13 @@ htt_rx_frag_pop_hl(
 }
 
 int
+htt_rx_offload_msdu_cnt_ll(
+    htt_pdev_handle pdev)
+{
+    return htt_rx_ring_elems(pdev);
+}
+
+int
 htt_rx_offload_msdu_pop_ll(
     htt_pdev_handle pdev,
     adf_nbuf_t offload_deliver_msg,
@@ -1744,6 +1758,270 @@ htt_rx_mon_amsdu_rx_in_order_pop_ll(htt_pdev_handle pdev, adf_nbuf_t rx_ind_msg,
 
 	return 1;
 }
+
+/**
+ * get_ht_vht_info() - get ht/vht information
+ * @rx_desc: pointer to htt_host_rx_desc_base.
+ * @rx_status: pointer to mon_rx_status.
+ *
+ * This function retrieve MCS/VHT info by parsing preamble,
+ * vht_sig_a1 and vht_sig_a2, which follows ieee80211 spec.
+ * Since high latency path doesn't config PPDU/MPDU start/end,
+ * it only uses the info which htt_rx_ppdu_desc_t has.
+ *
+ * Return: None.
+ */
+static void get_ht_vht_info_hl(struct htt_rx_ppdu_desc_t *rx_desc,
+			       struct mon_rx_status *rx_status)
+{
+	uint8_t preamble_type =
+		(uint8_t)rx_desc->preamble_type;
+
+	switch (preamble_type) {
+	case 8:
+	case 9:
+		rx_status->mcs_info.valid = 1;
+		rx_status->vht_info.valid = 0;
+		rx_status->mcs_info.mcs = rx_desc->vht_sig_a1 & 0x7f;
+		rx_status->nr_ant = rx_status->mcs_info.mcs >> 3;
+		rx_status->mcs_info.bw = (rx_desc->vht_sig_a1 >> 7) & 0x1;
+		rx_status->mcs_info.smoothing = rx_desc->vht_sig_a2 & 0x1;
+		rx_status->mcs_info.not_sounding =
+			(rx_desc->vht_sig_a2 >> 1) & 0x1;
+		rx_status->mcs_info.aggregation =
+			(rx_desc->vht_sig_a2 >> 3) & 0x1;
+		rx_status->mcs_info.stbc = (rx_desc->vht_sig_a2 >> 4) & 0x3;
+		rx_status->mcs_info.fec = (rx_desc->vht_sig_a2 >> 6) & 0x1;
+		rx_status->mcs_info.sgi = (rx_desc->vht_sig_a2 >> 7) & 0x1;
+		rx_status->mcs_info.ness = (rx_desc->vht_sig_a2 >> 8) & 0x3;
+		break;
+	case 0x0c: /* VHT w/o TxBF */
+	case 0x0d: /* VHT w/ TxBF */
+		rx_status->vht_info.valid = 1;
+		rx_status->mcs_info.valid = 0;
+		rx_status->vht_info.bw = rx_desc->vht_sig_a1 & 0x3;
+		rx_status->vht_info.stbc = (rx_desc->vht_sig_a1 >> 3) & 0x1;
+		/* Currently only handle SU case */
+		rx_status->vht_info.gid = (rx_desc->vht_sig_a1 >> 4) & 0x3f;
+		rx_status->vht_info.nss = (rx_desc->vht_sig_a1 >> 10) & 0x7;
+		rx_status->nr_ant = (rx_desc->vht_sig_a1 >> 10) & 0x7;
+		rx_status->vht_info.paid = (rx_desc->vht_sig_a1 >> 13) & 0x1ff;
+		rx_status->vht_info.txps_forbidden =
+			(rx_desc->vht_sig_a1 >> 22) & 0x1;
+		rx_status->vht_info.sgi = rx_desc->vht_sig_a2 & 0x1;
+		rx_status->vht_info.sgi_disambiguation =
+			(rx_desc->vht_sig_a2 >> 1) & 0x1;
+		rx_status->vht_info.coding = (rx_desc->vht_sig_a2 >> 2) & 0x1;
+		rx_status->vht_info.ldpc_extra_symbol =
+			(rx_desc->vht_sig_a2 >> 3) & 0x1;
+		rx_status->vht_info.mcs = (rx_desc->vht_sig_a2
+					>> 4) & 0xf;
+		rx_status->vht_info.beamformed = (rx_desc->vht_sig_a2
+					>> 8) & 0x1;
+		break;
+	default:
+		rx_status->mcs_info.valid = 0;
+		rx_status->vht_info.valid = 0;
+		rx_status->nr_ant = 1;
+		break;
+	}
+}
+
+/**
+ * htt_get_radiotap_rx_status_hl() - Update information about the
+ * rx status, which is used later for radiotap update.
+ * @rx_desc: Pointer to struct htt_rx_ppdu_desc_t
+ * @rx_status: Return variable updated with rx_status
+ *
+ * Return: None
+ */
+void htt_get_radiotap_rx_status_hl(struct htt_rx_ppdu_desc_t *rx_desc,
+	struct mon_rx_status *rx_status)
+{
+	uint16_t channel_flags = 0;
+
+	rx_status->tsft = (u_int64_t)rx_desc->tsf32;
+	/* IEEE80211_RADIOTAP_F_FCS */
+	rx_status->flags |= 0x10;
+	rx_status->rate = get_rate(rx_desc->legacy_rate_sel,
+				   rx_desc->legacy_rate);
+	channel_flags |= rx_desc->legacy_rate_sel ?
+		IEEE80211_CHAN_CCK : IEEE80211_CHAN_OFDM;
+	if (rx_status->chan)
+		channel_flags |=
+			(vos_chan_to_band(vos_freq_to_chan(rx_status->chan))
+			== VOS_BAND_2GHZ ?
+			IEEE80211_CHAN_2GHZ : IEEE80211_CHAN_5GHZ);
+	rx_status->chan_flags = channel_flags;
+	rx_status->ant_signal_db = rx_desc->rssi_cmb;
+	get_ht_vht_info_hl(rx_desc, rx_status);
+}
+
+/**
+ * htt_rx_mon_amsdu_pop_hl() - pop amsdu in HL monitor mode
+ * @pdev: Pointer to struct htt_pdev_handle
+ * @rx_ind_msg: htt rx indication message
+ * @head_msdu: head msdu
+ * @tail_msdu: tail msdu
+ *
+ * Return: 0 - success, others - failure
+ */
+int
+htt_rx_mon_amsdu_pop_hl(
+		htt_pdev_handle pdev,
+		adf_nbuf_t rx_ind_msg,
+		adf_nbuf_t *head_msdu,
+		adf_nbuf_t *tail_msdu)
+{
+	struct htt_rx_ppdu_desc_t *rx_ppdu_desc;
+	void *rx_desc, *rx_mpdu_desc;
+	struct mon_rx_status rx_status = {0};
+	int rtap_len = 0;
+	uint16_t center_freq;
+	uint16_t chan1;
+	uint16_t chan2;
+	uint8_t phymode;
+	a_bool_t ret;
+
+	pdev->rx_desc_size_hl =
+		(adf_nbuf_data(rx_ind_msg))
+		[HTT_ENDIAN_BYTE_IDX_SWAP(
+				HTT_RX_IND_HL_RX_DESC_LEN_OFFSET)];
+
+	adf_nbuf_pull_head(rx_ind_msg,
+			sizeof(struct hl_htt_rx_ind_base));
+
+	*head_msdu = *tail_msdu = rx_ind_msg;
+
+	rx_desc = htt_rx_msdu_desc_retrieve(pdev, *head_msdu);
+	rx_ppdu_desc = (struct htt_rx_ppdu_desc_t *)((uint8_t *)(rx_desc) -
+			HTT_RX_IND_HL_BYTES + HTT_RX_IND_HDR_PREFIX_BYTES);
+
+	rx_mpdu_desc =
+		htt_rx_mpdu_desc_list_next(pdev, rx_ind_msg);
+	ret = htt_rx_msdu_center_freq(pdev, NULL, rx_mpdu_desc,
+				      &center_freq, &chan1, &chan2, &phymode);
+
+	if (ret == A_TRUE)
+		rx_status.chan = center_freq;
+	else
+		rx_status.chan = 0;
+
+	htt_get_radiotap_rx_status_hl(rx_ppdu_desc, &rx_status);
+	/*
+	 * set headroom size to 0 to append to tail of skb. For HL path,
+	 * rx desc size is variable and will be used later in ol_rx_deliver
+	 * function to reset adf_nbuf to payload. So, to avoid overwriting
+	 * the rx desc, radiotap header is added to the tail of adf_nbuf
+	 * at first and move to head before indicating to OS.
+	 */
+	rtap_len = adf_nbuf_update_radiotap(&rx_status, *head_msdu, 0);
+
+	adf_nbuf_set_next(*tail_msdu, NULL);
+	return 0;
+}
+
+int
+htt_rx_mac_header_mon_process(
+		htt_pdev_handle pdev,
+		adf_nbuf_t rx_ind_msg,
+		adf_nbuf_t *head_msdu,
+		adf_nbuf_t *tail_msdu)
+{
+	struct htt_hw_rx_desc_base *hw_desc;
+	struct ieee80211_frame_addr4 *mac_array;
+	uint8_t rtap_buf[sizeof(struct ieee80211_radiotap_header) + 100] = {0};
+	uint16_t rtap_len;
+	uint32_t *msg_word;
+	uint8_t *rx_ind_data;
+	adf_nbuf_t msdu = NULL;
+
+	/* num of mac header in rx_ind_msg */
+	int num_elems;
+	int elem;
+	uint32_t tsf;
+	uint32_t rssi_comb;
+
+	rx_ind_data = adf_nbuf_data(rx_ind_msg);
+	msg_word = (uint32_t *)rx_ind_data;
+	msg_word++;
+	num_elems = HTT_T2H_MONITOR_MAC_HEADER_NUM_MPDU_GET(*msg_word);
+
+	/* what's the num_elem max value? */
+	if (num_elems <= 0)
+		return 0;
+
+	/* get htt_hw_rx_desc_base_rx_desc pointer */
+	hw_desc = (struct htt_hw_rx_desc_base *)
+			(rx_ind_data + HTT_T2H_MONITOR_MAC_HEADER_IND_HDR_SIZE);
+
+	rssi_comb = hw_desc->ppdu_start.rssi_comb;
+	tsf = hw_desc->ppdu_end.tsf_timestamp;
+
+	/* construct one radiotap header */
+	rtap_len = adf_nbuf_construct_radiotap(
+					rtap_buf,
+					tsf,
+					rssi_comb);
+
+	/* get ieee80211_frame_addr4 array pointer*/
+	mac_array = (struct ieee80211_frame_addr4 *)
+			(rx_ind_data + HTT_T2H_MONITOR_MAC_HEADER_IND_HDR_SIZE +
+			 sizeof(struct htt_hw_rx_desc_base));
+
+	for (elem = 0; elem < num_elems; elem++) {
+		uint8_t *dest = NULL;
+		/*
+		 * copy each mac header +
+		 * radiotap header into single msdu buff
+		 */
+		msdu = adf_nbuf_alloc(
+			pdev->osdev,
+			rtap_len + sizeof(struct ieee80211_frame_addr4),
+			0, 4, TRUE);
+		if (!msdu)
+			return A_NO_MEMORY;
+
+		dest = adf_nbuf_put_tail(msdu, rtap_len);
+		if (!dest) {
+			adf_os_print("%s: No buffer to save radiotap len %d\n",
+				     __func__, rtap_len);
+			return	A_NO_MEMORY;
+		}
+		adf_os_mem_copy(dest, rtap_buf, rtap_len);
+
+		dest = adf_nbuf_put_tail(msdu,
+					 sizeof(struct ieee80211_frame_addr4));
+		if (!dest) {
+			adf_os_print("%s: No buffer for mac header %u\n",
+				     __func__,
+				     (unsigned int)
+				     sizeof(struct ieee80211_frame_addr4));
+			return	A_NO_MEMORY;
+		}
+		adf_os_mem_copy(dest, &mac_array[elem],
+				sizeof(struct ieee80211_frame_addr4));
+
+		adf_nbuf_set_next(msdu, NULL);
+		if (*head_msdu == NULL) {
+			*head_msdu = msdu;
+			*tail_msdu = msdu;
+		} else {
+			adf_nbuf_set_next(*tail_msdu, msdu);
+			*tail_msdu = msdu;
+		}
+	}
+
+	return 0;
+}
+
+int
+htt_rx_offload_msdu_cnt_hl(
+    htt_pdev_handle pdev)
+{
+    return 1;
+}
+
 /* Return values: 1 - success, 0 - failure */
 int
 htt_rx_offload_msdu_pop_hl(
@@ -1857,10 +2135,6 @@ htt_rx_amsdu_rx_in_order_pop_ll(
     HTT_RX_CHECK_MSDU_COUNT(msdu_count);
     peer_id = HTT_RX_IN_ORD_PADDR_IND_PEER_ID_GET(
                                  *(u_int32_t *)rx_ind_data);
-    peer = ol_txrx_peer_find_by_id(pdev->txrx_pdev, peer_id);
-    if (!peer)
-        adf_os_print("%s: invalid peer id %d and msdu count %d\n", __func__,
-                     peer_id, msdu_count);
 
     msg_word = (u_int32_t *)(rx_ind_data + HTT_RX_IN_ORD_PADDR_IND_HDR_BYTES);
     if (offload_ind) {
@@ -1870,6 +2144,11 @@ htt_rx_amsdu_rx_in_order_pop_ll(
         return 0;
     }
 
+    peer = ol_txrx_peer_find_by_id(pdev->txrx_pdev, peer_id);
+    if (!peer)
+        adf_os_print(KERN_DEBUG "%s: invalid peer id %d and msdu count %d\n",
+                     __func__, peer_id, msdu_count);
+
     (*head_msdu) = msdu =
         htt_rx_in_order_netbuf_pop(pdev,
                                   HTT_RX_IN_ORD_PADDR_IND_PADDR_GET(*msg_word));
@@ -1903,7 +2182,7 @@ htt_rx_amsdu_rx_in_order_pop_ll(
         adf_nbuf_pull_head(msdu, HTT_RX_STD_DESC_RESERVATION);
 
         adf_dp_trace_set_track(msdu, ADF_RX);
-        ADF_NBUF_CB_RX_PACKET_TRACE(msdu) = NBUF_TX_PKT_DATA_TRACK;
+        NBUF_SET_PACKET_TRACK(msdu, NBUF_TX_PKT_DATA_TRACK);
         ol_rx_log_packet(pdev, peer_id, msdu);
         DPTRACE(adf_dp_trace(msdu,
                 ADF_DP_TRACE_RX_HTT_PACKET_PTR_RECORD,
@@ -2406,6 +2685,10 @@ int (*htt_rx_frag_pop)(
     adf_nbuf_t *tail_msdu);
 
 int
+(*htt_rx_offload_msdu_cnt)(
+    htt_pdev_handle pdev);
+
+int
 (*htt_rx_offload_msdu_pop)(
     htt_pdev_handle pdev,
     adf_nbuf_t offload_deliver_msg,
@@ -2913,7 +3196,7 @@ htt_rx_hash_list_insert(struct htt_pdev_t *pdev, u_int32_t paddr,
     htt_list_add_tail(&pdev->rx_ring.hash_table[i]->listhead,
                        &hash_element->listnode);
 
-    RX_HASH_LOG(adf_os_print("rx hash: %s: paddr 0x%x netbuf %p bucket %d\n",
+    RX_HASH_LOG(adf_os_print("rx hash: %s: paddr 0x%x netbuf %pK bucket %d\n",
                              __FUNCTION__, paddr, netbuf,(int)i));
 
     HTT_RX_HASH_COUNT_INCR(pdev->rx_ring.hash_table[i]);
@@ -2970,7 +3253,7 @@ htt_rx_hash_list_lookup(struct htt_pdev_t *pdev, u_int32_t paddr)
         }
     }
 
-    RX_HASH_LOG(adf_os_print("rx hash: %s: paddr 0x%x, netbuf %p, bucket %d\n",
+    RX_HASH_LOG(adf_os_print("rx hash: %s: paddr 0x%x, netbuf %pK, bucket %d\n",
                               __FUNCTION__, paddr, netbuf,(int)i));
     HTT_RX_HASH_COUNT_PRINT(pdev->rx_ring.hash_table[i]);
 
@@ -3108,7 +3391,7 @@ htt_rx_hash_dump_table(struct htt_pdev_t *pdev)
             hash_entry =
                  (struct htt_rx_hash_entry *)((char *)list_iter -
                                                pdev->rx_ring.listnode_offset);
-            adf_os_print("hash_table[%d]: netbuf %p paddr 0x%x\n",
+            adf_os_print("hash_table[%d]: netbuf %pK paddr 0x%x\n",
                           i, hash_entry->netbuf, hash_entry->paddr);
         }
     }
@@ -3233,6 +3516,7 @@ htt_rx_attach(struct htt_pdev_t *pdev)
         if (VOS_MONITOR_MODE == vos_get_conparam())
             htt_rx_amsdu_pop = htt_rx_mon_amsdu_rx_in_order_pop_ll;
 
+        htt_rx_offload_msdu_cnt = htt_rx_offload_msdu_cnt_ll;
         htt_rx_offload_msdu_pop = htt_rx_offload_msdu_pop_ll;
         htt_rx_mpdu_desc_retry = htt_rx_mpdu_desc_retry_ll;
         htt_rx_mpdu_desc_seq_num = htt_rx_mpdu_desc_seq_num_ll;
@@ -3256,7 +3540,10 @@ htt_rx_attach(struct htt_pdev_t *pdev)
         /* host can force ring base address if it wish to do so */
         pdev->rx_ring.base_paddr = 0;
         htt_rx_amsdu_pop = htt_rx_amsdu_pop_hl;
+        if (VOS_MONITOR_MODE == vos_get_conparam())
+            htt_rx_amsdu_pop = htt_rx_mon_amsdu_pop_hl;
         htt_rx_frag_pop = htt_rx_frag_pop_hl;
+        htt_rx_offload_msdu_cnt = htt_rx_offload_msdu_cnt_hl;
         htt_rx_offload_msdu_pop = htt_rx_offload_msdu_pop_hl;
         htt_rx_mpdu_desc_list_next = htt_rx_mpdu_desc_list_next_hl;
         htt_rx_mpdu_desc_retry = htt_rx_mpdu_desc_retry_hl;
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_t2h.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_t2h.c
index b736a970c57..78c7c4e722b 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_t2h.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_t2h.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -90,6 +90,8 @@ htt_t2h_mac_addr_deswizzle(u_int8_t *tgt_mac_addr, u_int8_t *buffer)
 
 #if defined(CONFIG_HL_SUPPORT)
 #define HTT_RX_FRAG_SET_LAST_MSDU(pdev, msg) /* no-op */
+#define HTT_FAIL_NOTIFY_BREAK_CHECK(status) \
+	((status) == htt_tx_status_fail_notify)
 #else
 static void HTT_RX_FRAG_SET_LAST_MSDU(
     struct htt_pdev_t *pdev, adf_nbuf_t msg)
@@ -135,8 +137,12 @@ static void HTT_RX_FRAG_SET_LAST_MSDU(
     rx_desc->msdu_end.last_msdu = 1;
     adf_nbuf_map(pdev->osdev, msdu, ADF_OS_DMA_FROM_DEVICE);
 }
+
+#define HTT_FAIL_NOTIFY_BREAK_CHECK(status)  0
 #endif /* CONFIG_HL_SUPPORT */
 
+#define MAX_TARGET_TX_CREDIT    204800
+
 /* Target to host Msg/event  handler  for low priority messages*/
 void
 htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg )
@@ -172,7 +178,7 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg )
         {
             u_int16_t peer_id;
             u_int8_t tid;
-            int seq_num_start, seq_num_end;
+            u_int16_t seq_num_start, seq_num_end;
             enum htt_rx_flush_action action;
 
             peer_id = HTT_RX_FLUSH_PEER_ID_GET(*msg_word);
@@ -192,7 +198,7 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg )
         }
     case  HTT_T2H_MSG_TYPE_RX_OFFLOAD_DELIVER_IND:
         {
-            int msdu_cnt;
+            u_int16_t msdu_cnt;
             msdu_cnt = HTT_RX_OFFLOAD_DELIVER_IND_MSDU_CNT_GET(*msg_word);
             ol_rx_offload_deliver_ind_handler(
                 pdev->txrx_pdev,
@@ -297,6 +303,14 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg )
             peer_mac_addr = htt_t2h_mac_addr_deswizzle(
                 (u_int8_t *) (msg_word+1), &mac_addr_deswizzle_buf[0]);
 
+            if (peer_id > ol_cfg_max_peer_id(pdev->ctrl_pdev)) {
+                adf_os_print("%s: HTT_T2H_MSG_TYPE_PEER_MAP,"
+                            "invalid peer_id, %u\n",
+                            __FUNCTION__,
+                            peer_id);
+                break;
+            }
+
             ol_rx_peer_map_handler(
                 pdev->txrx_pdev, peer_id, vdev_id, peer_mac_addr, 1/*can tx*/);
             break;
@@ -306,6 +320,14 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg )
             u_int16_t peer_id;
             peer_id = HTT_RX_PEER_UNMAP_PEER_ID_GET(*msg_word);
 
+            if (peer_id > ol_cfg_max_peer_id(pdev->ctrl_pdev)) {
+                adf_os_print("%s: HTT_T2H_MSG_TYPE_PEER_UNMAP,"
+                            "invalid peer_id, %u\n",
+                            __FUNCTION__,
+                            peer_id);
+                break;
+            }
+
             ol_rx_peer_unmap_handler(pdev->txrx_pdev, peer_id);
             break;
         }
@@ -394,12 +416,23 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg )
     {
         u_int32_t htt_credit_delta_abs;
         int32_t htt_credit_delta;
-        int sign;
+        int sign, old_credit;
 
         htt_credit_delta_abs = HTT_TX_CREDIT_DELTA_ABS_GET(*msg_word);
         sign = HTT_TX_CREDIT_SIGN_BIT_GET(*msg_word) ? -1 : 1;
         htt_credit_delta = sign * htt_credit_delta_abs;
 
+        old_credit = adf_os_atomic_read(&pdev->htt_tx_credit.target_delta);
+        if (((old_credit + htt_credit_delta) > MAX_TARGET_TX_CREDIT) ||
+            ((old_credit + htt_credit_delta) < -MAX_TARGET_TX_CREDIT)) {
+            adf_os_print("%s: invalid credit update,old_credit=%d,"
+                        "htt_credit_delta=%d\n",
+                        __FUNCTION__,
+                        old_credit,
+                        htt_credit_delta);
+            break;
+        }
+
         if (pdev->cfg.is_high_latency &&
             !pdev->cfg.default_tx_comp_req) {
             HTT_TX_MUTEX_ACQUIRE(&pdev->credit_mutex);
@@ -495,12 +528,14 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg )
                 break;
             }
         }
+        break;
     }
     case HTT_T2H_MSG_TYPE_RATE_REPORT:
         {
             u_int16_t peer_cnt = HTT_PEER_RATE_REPORT_MSG_PEER_COUNT_GET(*msg_word);
             u_int16_t i;
             struct rate_report_t *report, *each;
+            int max_peers;
 
             /* Param sanity check */
             if (peer_cnt == 0) {
@@ -508,6 +543,13 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg )
                 break;
             }
 
+            max_peers = ol_cfg_max_peer_id(pdev->ctrl_pdev) + 1;
+            if (peer_cnt > max_peers) {
+                adf_os_print("RATE REPORT msg peer_cnt is larger than %d\n",
+                    max_peers);
+                break;
+            }
+
             /* At least one peer and no limit apply to peer_cnt here */
             report = adf_os_mem_alloc(NULL,
                 sizeof(struct rate_report_t) * peer_cnt);
@@ -614,9 +656,14 @@ if (adf_os_unlikely(pdev->rx_ring.rx_reset)) {
                  * TODO: remove copy after stopping reuse skb on HIF layer
                  * because SDIO HIF may reuse skb before upper layer release it
                  */
-                ol_rx_indication_handler(
-                    pdev->txrx_pdev, htt_t2h_msg, peer_id, tid,
-                    num_mpdu_ranges);
+                if (VOS_MONITOR_MODE == vos_get_conparam())
+                    ol_rx_mon_indication_handler(
+                            pdev->txrx_pdev, htt_t2h_msg, peer_id, tid,
+                            num_mpdu_ranges);
+                else
+                    ol_rx_indication_handler(
+                            pdev->txrx_pdev, htt_t2h_msg, peer_id, tid,
+                            num_mpdu_ranges);
 
                 return;
             } else {
@@ -628,12 +675,29 @@ if (adf_os_unlikely(pdev->rx_ring.rx_reset)) {
         }
     case HTT_T2H_MSG_TYPE_TX_COMPL_IND:
         {
+            int old_credit;
             int num_msdus;
             enum htt_tx_status status;
+            int msg_len = adf_nbuf_len(htt_t2h_msg);
 
             /* status - no enum translation needed */
             status = HTT_TX_COMPL_IND_STATUS_GET(*msg_word);
             num_msdus = HTT_TX_COMPL_IND_NUM_GET(*msg_word);
+
+            /*
+             * each desc id will occupy 2 bytes.
+             * the 4 is for htt msg header
+             */
+            if ((num_msdus * HTT_TX_COMPL_BYTES_PER_MSDU_ID +
+                HTT_TX_COMPL_HEAD_SZ) > msg_len) {
+                adf_os_print("%s: num_msdus(%d) is invalid,"
+                            "adf_nbuf_len = %d\n",
+                            __FUNCTION__,
+                            num_msdus,
+                            msg_len);
+                break;
+            }
+
             if (num_msdus & 0x1) {
                 struct htt_tx_compl_ind_base *compl = (void *)msg_word;
 
@@ -650,24 +714,53 @@ if (adf_os_unlikely(pdev->rx_ring.rx_reset)) {
                 }
             }
 
+            /* Indicate failure status to user space */
+            ol_tx_failure_indication(pdev->txrx_pdev,
+                                     HTT_TX_COMPL_IND_TID_GET(*msg_word),
+                                     num_msdus, status);
+
             if (pdev->cfg.is_high_latency) {
-                if (!pdev->cfg.default_tx_comp_req) {
-                    int credit_delta;
-                    HTT_TX_MUTEX_ACQUIRE(&pdev->credit_mutex);
-                    adf_os_atomic_add(num_msdus,
-                        &pdev->htt_tx_credit.target_delta);
-                    credit_delta = htt_tx_credit_update(pdev);
-                    HTT_TX_MUTEX_RELEASE(&pdev->credit_mutex);
-                    if (credit_delta) {
+                /*
+                 * For regular frms in HL case, frms have already been
+                 * freed and tx credit has been updated. FW indicates
+                 * special message for failure MSDUs with status type
+                 * htt_tx_status_fail_notify. Once such message was
+                 * received, just break here.
+                 */
+                if (ol_cfg_tx_free_at_download(pdev->ctrl_pdev) &&
+                    HTT_FAIL_NOTIFY_BREAK_CHECK(status)) {
+                    adf_os_print("HTT TX COMPL for failed data frm.\n");
+                    break;
+                }
+
+                old_credit = adf_os_atomic_read(&pdev->htt_tx_credit.target_delta);
+                if (((old_credit + num_msdus) > MAX_TARGET_TX_CREDIT) ||
+                    ((old_credit + num_msdus) < -MAX_TARGET_TX_CREDIT)) {
+                    adf_os_print("%s: invalid credit update,old_credit=%d,"
+                                "num_msdus=%d\n",
+                                __FUNCTION__,
+                                old_credit,
+                                num_msdus);
+                } else {
+                    if (!pdev->cfg.default_tx_comp_req) {
+                        int credit_delta;
+                        HTT_TX_MUTEX_ACQUIRE(&pdev->credit_mutex);
+                        adf_os_atomic_add(num_msdus,
+                            &pdev->htt_tx_credit.target_delta);
+                        credit_delta = htt_tx_credit_update(pdev);
+                        HTT_TX_MUTEX_RELEASE(&pdev->credit_mutex);
+                        if (credit_delta) {
+                            ol_tx_target_credit_update(pdev->txrx_pdev,
+                                                       credit_delta);
+                        }
+                    } else {
                         ol_tx_target_credit_update(pdev->txrx_pdev,
-                                                   credit_delta);
+                                                   num_msdus);
                     }
-                } else {
-                    ol_tx_target_credit_update(pdev->txrx_pdev, num_msdus);
                 }
             }
             ol_tx_completion_handler(
-                pdev->txrx_pdev, num_msdus, status, msg_word + 1);
+                pdev->txrx_pdev, num_msdus, status, msg_word);
             HTT_TX_SCHED(pdev);
             break;
         }
@@ -675,7 +768,7 @@ if (adf_os_unlikely(pdev->rx_ring.rx_reset)) {
         {
             u_int16_t peer_id;
             u_int8_t tid, pn_ie_cnt, *pn_ie=NULL;
-            int seq_num_start, seq_num_end;
+            u_int16_t seq_num_start, seq_num_end;
 
             /*First dword */
             peer_id = HTT_RX_PN_IND_PEER_ID_GET(*msg_word);
@@ -702,8 +795,23 @@ if (adf_os_unlikely(pdev->rx_ring.rx_reset)) {
     case HTT_T2H_MSG_TYPE_TX_INSPECT_IND:
         {
             int num_msdus;
+            int msg_len = adf_nbuf_len(htt_t2h_msg);
 
             num_msdus = HTT_TX_COMPL_IND_NUM_GET(*msg_word);
+            /*
+             * each desc id will occupy 2 bytes.
+             * the 4 is for htt msg header
+             */
+            if ((num_msdus * HTT_TX_COMPL_BYTES_PER_MSDU_ID +
+                HTT_TX_COMPL_HEAD_SZ) > msg_len) {
+                adf_os_print("%s: num_msdus(%d) is invalid,"
+                            "adf_nbuf_len = %d,inspect\n",
+                            __FUNCTION__,
+                            num_msdus,
+                            msg_len);
+                break;
+            }
+
             if (num_msdus & 0x1) {
                 struct htt_tx_compl_ind_base *compl = (void *)msg_word;
 
@@ -756,6 +864,11 @@ if (adf_os_unlikely(pdev->rx_ring.rx_reset)) {
                                                peer_id, tid, offload_ind);
             break;
      }
+    case HTT_T2H_MSG_TYPE_MONITOR_MAC_HEADER_IND:
+        {
+            ol_rx_mon_mac_header_handler(pdev->txrx_pdev, htt_t2h_msg);
+            break;
+        }
 
     default:
         htt_t2h_lp_msg_handler(context, htt_t2h_msg);
@@ -929,6 +1042,49 @@ htt_rx_ind_rssi_dbm_chain(htt_pdev_handle pdev, adf_nbuf_t rx_ind_msg,
 }
 
 /**
+ * htt_rx_ind_noise_floor_chain() - Return the nosie floor for a chain
+ *              provided in a rx indication message.
+ * @pdev:       the HTT instance the rx data was received on
+ * @rx_ind_msg: the netbuf containing the rx indication message
+ * @chain:      the index of the chain (0-1) for DSRC
+ *
+ * Return the noise floor for a chain from an rx indication message.
+ *
+ * Return: noise floor, or HTT_NOISE_FLOOR_INVALID
+ */
+int8_t
+htt_rx_ind_noise_floor_chain(htt_pdev_handle pdev, adf_nbuf_t rx_ind_msg,
+			     int8_t chain)
+{
+	int8_t noise_floor;
+	u_int32_t *msg_word;
+
+	/* only chain0/1 used with 11p DSRC */
+	if (chain < 0 || chain > 1) {
+		return HTT_NOISE_FLOOR_INVALID;
+	}
+
+	msg_word = (u_int32_t *)
+		(adf_nbuf_data(rx_ind_msg) +
+		 HTT_RX_IND_FW_RX_PPDU_DESC_BYTE_OFFSET);
+
+	/* check if the RX_IND message contains valid rx PPDU start info */
+	if (!HTT_RX_IND_START_VALID_GET(*msg_word)) {
+		return HTT_NOISE_FLOOR_INVALID;
+	}
+
+	msg_word = (u_int32_t *)
+		(adf_nbuf_data(rx_ind_msg) + HTT_RX_IND_HDR_SUFFIX_BYTE_OFFSET);
+
+	if (chain == 0)
+		noise_floor = HTT_RX_IND_NOISE_FLOOR_CHAIN0_GET(*msg_word);
+	else if (chain == 1)
+		noise_floor = HTT_RX_IND_NOISE_FLOOR_CHAIN1_GET(*msg_word);
+
+	return noise_floor;
+}
+
+/**
  * htt_rx_ind_legacy_rate() - Return the data rate
  * @pdev:        the HTT instance the rx data was received on
  * @rx_ind_msg:  the netbuf containing the rx indication message
@@ -1077,8 +1233,8 @@ void
 htt_rx_frag_ind_flush_seq_num_range(
     htt_pdev_handle pdev,
     adf_nbuf_t rx_frag_ind_msg,
-    int *seq_num_start,
-    int *seq_num_end)
+    u_int16_t *seq_num_start,
+    u_int16_t *seq_num_end)
 {
     u_int32_t *msg_word;
 
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_tx.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_tx.c
index 35ad99ac86d..d70f10f8f9b 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_tx.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_tx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -734,7 +734,7 @@ htt_tx_desc_display(void *tx_desc)
     htt_tx_desc = (struct htt_tx_msdu_desc_t *) tx_desc;
 
     /* only works for little-endian */
-    adf_os_print("HTT tx desc (@ %p):\n", htt_tx_desc);
+    adf_os_print("HTT tx desc (@ %pK):\n", htt_tx_desc);
     adf_os_print("  msg type = %d\n", htt_tx_desc->msg_type);
     adf_os_print("  pkt subtype = %d\n", htt_tx_desc->pkt_subtype);
     adf_os_print("  pkt type = %d\n", htt_tx_desc->pkt_type);
@@ -881,12 +881,6 @@ int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
        }
    }
 
-   if (tx_buffer_count_pwr2 < 0) {
-       adf_os_print("%s: Failed to round down Tx buffer count %d",
-                   __func__, tx_buffer_count_pwr2);
-       goto free_tx_comp_base;
-   }
-
    pdev->ipa_uc_tx_rsc.alloc_tx_buf_cnt = tx_buffer_count_pwr2;
 
    return 0;
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_types.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_types.h
index 50dd6fed8a7..94e5a8b8558 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_types.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/HTT/htt_types.h
@@ -376,7 +376,6 @@ struct htt_pdev_t {
 
     /* callback function for packetdump */
     tp_rx_pkt_dump_cb rx_pkt_dump_cb;
-
 };
 
 #endif /* _HTT_TYPES__H_ */
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TLSHIM/tl_shim.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TLSHIM/tl_shim.c
index 32125d41baf..0f77c98a2da 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TLSHIM/tl_shim.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TLSHIM/tl_shim.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -501,7 +501,7 @@ static bool tlshim_is_pkt_drop_candidate(tp_wma_handle wma_handle,
 
 	peer = ol_txrx_find_peer_by_addr(pdev_ctx, peer_addr, &peer_id);
 	if (!peer) {
-		if (SIR_MAC_MGMT_ASSOC_REQ != subtype) {
+		if (IEEE80211_FC0_SUBTYPE_ASSOC_REQ != subtype) {
 			TLSHIM_LOGE(FL("Received mgmt frame: %0x from unknow peer: %pM"),
 				subtype, peer_addr);
 			should_drop = TRUE;
@@ -510,7 +510,7 @@ static bool tlshim_is_pkt_drop_candidate(tp_wma_handle wma_handle,
 	}
 
 	switch (subtype) {
-	case SIR_MAC_MGMT_ASSOC_REQ:
+	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
 		if (peer->last_assoc_rcvd) {
 			if (adf_os_gettimestamp() - peer->last_assoc_rcvd <
 			    TLSHIM_MGMT_FRAME_DETECT_DOS_TIMER) {
@@ -520,7 +520,7 @@ static bool tlshim_is_pkt_drop_candidate(tp_wma_handle wma_handle,
 		}
 		peer->last_assoc_rcvd = adf_os_gettimestamp();
 		break;
-	case SIR_MAC_MGMT_DISASSOC:
+	case IEEE80211_FC0_SUBTYPE_DISASSOC:
 		if (peer->last_disassoc_rcvd) {
 			if (adf_os_gettimestamp() -
 			    peer->last_disassoc_rcvd <
@@ -531,7 +531,7 @@ static bool tlshim_is_pkt_drop_candidate(tp_wma_handle wma_handle,
 		}
 		peer->last_disassoc_rcvd = adf_os_gettimestamp();
 		break;
-	case SIR_MAC_MGMT_DEAUTH:
+	case IEEE80211_FC0_SUBTYPE_DEAUTH:
 		if (peer->last_deauth_rcvd) {
 			if (adf_os_gettimestamp() -
 			    peer->last_deauth_rcvd <
@@ -596,9 +596,11 @@ static int tlshim_mgmt_rx_process(void *context, u_int8_t *data,
 		return 0;
 	}
 
-	if (hdr->buf_len < sizeof(struct ieee80211_frame)) {
+	if (hdr->buf_len < sizeof(struct ieee80211_frame) ||
+	   (!saved_beacon && hdr->buf_len > data_len)) {
 		adf_os_spin_unlock_bh(&tl_shim->mgmt_lock);
-		TLSHIM_LOGE("Invalid rx mgmt packet");
+		TLSHIM_LOGE("Invalid rx mgmt packet, saved_beacon %d, data_len %u, hdr->buf_len %u",
+				saved_beacon, data_len, hdr->buf_len);
 		return 0;
 	}
 
@@ -640,6 +642,17 @@ static int tlshim_mgmt_rx_process(void *context, u_int8_t *data,
 	rx_pkt->pkt_meta.mpdu_data_len = hdr->buf_len -
 					 rx_pkt->pkt_meta.mpdu_hdr_len;
 
+	/*
+	 * If the mpdu_data_len is greater than Max (2k), drop the frame
+	 */
+	if (rx_pkt->pkt_meta.mpdu_data_len > WMA_MAX_MGMT_MPDU_LEN) {
+		adf_os_spin_unlock_bh(&tl_shim->mgmt_lock);
+		TLSHIM_LOGE("Data Len %d greater than max, dropping frame",
+			 rx_pkt->pkt_meta.mpdu_data_len);
+		vos_mem_free(rx_pkt);
+		return 0;
+	}
+
     /*
      * saved_beacon means this beacon is a duplicate of one
      * sent earlier. roamCandidateInd flag is used to indicate to
@@ -1173,6 +1186,29 @@ static void tl_shim_cache_flush_work(struct work_struct *work)
 	}
 }
 
+/*
+ * TLSHIM virtual monitor mode RX callback,
+ * registered for OL data indication.
+ */
+
+static void tl_shim_vir_mon_rx(adf_nbuf_t rx_buf_list)
+{
+	struct txrx_tl_shim_ctx *tl_shim;
+	void *vos_ctx = vos_get_global_context(VOS_MODULE_ID_TL, NULL);
+
+	tl_shim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
+
+	if (!tl_shim) {
+		TLSHIM_LOGE("%s: Failed to get TLSHIM context", __func__);
+		return;
+	}
+
+	if (tl_shim->rx_monitor_cb)
+		tl_shim->rx_monitor_cb(vos_ctx, rx_buf_list, 0);
+	else
+		TLSHIM_LOGE("%s: tl_shim->rx_monitor_cb is NULL", __func__);
+}
+
 /*************************/
 /*	TL APIs		 */
 /*************************/
@@ -1236,12 +1272,18 @@ void *tlshim_peer_validity(void *vos_ctx, uint8_t sta_id)
 {
 	struct txrx_tl_shim_ctx *tl_shim = vos_get_context(VOS_MODULE_ID_TL,
 							vos_ctx);
+	struct ol_txrx_pdev_t *pdev = vos_get_context(VOS_MODULE_ID_TXRX,
+							vos_ctx);
 	struct ol_txrx_peer_t *peer;
 
 	if (!tl_shim) {
 		TLSHIM_LOGE("tl_shim is NULL");
 		return NULL;
 	}
+	if (!pdev) {
+		TLSHIM_LOGE("pdev is NULL");
+		return NULL;
+	}
 
 	if (sta_id >= WLAN_MAX_STA_COUNT) {
 		TLSHIM_LOGE("Invalid sta id for data tx");
@@ -1253,9 +1295,7 @@ void *tlshim_peer_validity(void *vos_ctx, uint8_t sta_id)
 		return NULL;
 	}
 
-	peer = ol_txrx_peer_find_by_local_id(
-			((pVosContextType) vos_ctx)->pdev_txrx_ctx,
-			sta_id);
+	peer = ol_txrx_peer_find_by_local_id(pdev, sta_id);
 	if (!peer) {
 		TLSHIM_LOGW("Invalid peer");
 		return NULL;
@@ -1265,6 +1305,32 @@ void *tlshim_peer_validity(void *vos_ctx, uint8_t sta_id)
 }
 
 /**
+ * tlshim_selfpeer_vdev() - get the vdev of self peer
+ * @vos_ctx: vos context
+ *
+ * Return: on success return vdev, NULL when self peer is invalid/NULL
+ */
+void *tlshim_selfpeer_vdev(void *vos_ctx)
+{
+	struct ol_txrx_pdev_t *pdev = vos_get_context(VOS_MODULE_ID_TXRX,
+							   vos_ctx);
+	struct ol_txrx_peer_t *peer;
+
+	if (!pdev) {
+		TLSHIM_LOGE("Txrx pdev is NULL");
+		return NULL;
+	}
+
+	peer = pdev->self_peer;
+	if (!peer) {
+		TLSHIM_LOGW("Invalid peer");
+		return NULL;
+	} else {
+		return peer->vdev;
+	}
+}
+
+/**
  * WLANTL_SendSTA_DataFrame() - transmit frame from upper layers
  * @vos_ctx: pointer to vos context
  * @vdev: vdev
@@ -1805,6 +1871,30 @@ VOS_STATUS WLANTL_ClearSTAClient(void *vos_ctx, u_int8_t sta_id)
 	return VOS_STATUS_SUCCESS;
 }
 
+void tl_shim_flush_cache_rx_queue(void)
+{
+    void *vos_ctx = vos_get_global_context(VOS_MODULE_ID_TL, NULL);
+    struct txrx_tl_shim_ctx *tl_shim;
+    u_int8_t sta_id;
+
+    if (!vos_ctx) {
+        TLSHIM_LOGE("%s, Global VOS context is Null\n", __func__);
+        return;
+    }
+
+    tl_shim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
+    if (!tl_shim) {
+        TLSHIM_LOGE("%s, tl_shim is NULL\n", __func__);
+        return;
+    }
+
+    TLSHIM_LOGD("%s: called to flush cache rx queue.\n", __func__);
+    for (sta_id = 0; sta_id < WLAN_MAX_STA_COUNT; sta_id++)
+        tl_shim_flush_rx_frames(vos_ctx, tl_shim, sta_id, 1);
+
+    return;
+}
+
 /*
  * Register a station for data service. This API gives flexibility
  * to register different callbacks for different client though it is
@@ -1872,6 +1962,57 @@ VOS_STATUS WLANTL_RegisterSTAClient(void *vos_ctx,
 	return VOS_STATUS_SUCCESS;
 }
 
+VOS_STATUS tl_register_vir_mon_cb(void *vos_ctx,
+				  WLANTL_STARxCBType rxcb)
+{
+	struct txrx_tl_shim_ctx *tl_shim;
+	ol_txrx_pdev_handle pdev;
+
+	tl_shim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
+	if (!tl_shim) {
+		TLSHIM_LOGE("tl_shim is NULL");
+		return VOS_STATUS_E_FAULT;
+	}
+
+	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_ctx);
+	if (!pdev) {
+		TLSHIM_LOGE("%s: Failed to find pdev", __func__);
+		return VOS_STATUS_E_FAULT;
+	}
+
+	tl_shim->rx_monitor_cb = rxcb;
+
+	/* register TLSHIM RX montior callback to OL */
+	ol_txrx_osif_pdev_mon_register_cbk(pdev, tl_shim_vir_mon_rx);
+
+	return VOS_STATUS_SUCCESS;
+}
+
+VOS_STATUS tl_deregister_vir_mon_cb(void *vos_ctx)
+{
+	struct txrx_tl_shim_ctx *tl_shim;
+	ol_txrx_pdev_handle pdev;
+
+	tl_shim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
+	if (!tl_shim) {
+		TLSHIM_LOGE("tl_shim is NULL");
+		return VOS_STATUS_E_FAULT;
+	}
+
+	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_ctx);
+	if (!pdev) {
+		TLSHIM_LOGE("%s: Failed to find pdev", __func__);
+		return VOS_STATUS_E_FAULT;
+	}
+
+	tl_shim->rx_monitor_cb = NULL;
+
+	/* register TLSHIM RX montior callback to OL */
+	ol_txrx_osif_pdev_mon_register_cbk(pdev, NULL);
+
+	return VOS_STATUS_SUCCESS;
+}
+
 VOS_STATUS WLANTL_Stop(void *vos_ctx)
 {
 	/* Nothing to do really */
@@ -1962,6 +2103,7 @@ VOS_STATUS WLANTL_Close(void *vos_ctx)
 VOS_STATUS WLANTL_Open(void *vos_ctx, WLANTL_ConfigInfoType *tl_cfg)
 {
 	struct txrx_tl_shim_ctx *tl_shim;
+	ol_txrx_pdev_handle txrx_pdev;
 	VOS_STATUS status;
 	u_int8_t i;
 	int max_vdev;
@@ -1972,7 +2114,7 @@ VOS_STATUS WLANTL_Open(void *vos_ctx, WLANTL_ConfigInfoType *tl_cfg)
 	if (status != VOS_STATUS_SUCCESS)
 		return status;
 
-	((pVosContextType) vos_ctx)->pdev_txrx_ctx =
+	txrx_pdev = ((pVosContextType) vos_ctx)->pdev_txrx_ctx =
 				wdi_in_pdev_attach(
 					((pVosContextType) vos_ctx)->cfg_ctx,
 					((pVosContextType) vos_ctx)->htc_ctx,
@@ -1983,6 +2125,8 @@ VOS_STATUS WLANTL_Open(void *vos_ctx, WLANTL_ConfigInfoType *tl_cfg)
 		return VOS_STATUS_E_NOMEM;
 	}
 
+	ol_tx_failure_cb_set(txrx_pdev, wma_tx_failure_cb);
+
 	adf_os_spinlock_init(&tl_shim->bufq_lock);
 	adf_os_spinlock_init(&tl_shim->mgmt_lock);
 
@@ -2078,6 +2222,42 @@ VOS_STATUS tl_shim_get_vdevid(struct ol_txrx_peer_t *peer, u_int8_t *vdev_id)
 	return VOS_STATUS_SUCCESS;
 }
 
+#ifdef QCA_SUPPORT_TXRX_LOCAL_PEER_ID
+/**
+ * tl_shim_get_sta_id_by_addr() - get peer local id given the MAC address.
+ * @vos_context: pointer to vos context
+ * @mac_addr: pointer to mac address
+ *
+ * Return: local id of the peer given the MAC address.
+ */
+uint16_t tl_shim_get_sta_id_by_addr(void *vos_context, uint8_t *mac_addr)
+{
+	struct ol_txrx_peer_t *peer;
+	ol_txrx_pdev_handle pdev;
+	uint8_t peer_id;
+
+	if (vos_context == NULL || mac_addr == NULL) {
+		TLSHIM_LOGE("Invalid argument %pK, %pK", vos_context, mac_addr);
+		return 0;
+	}
+
+	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_context);
+	if (!pdev) {
+		TLSHIM_LOGE("PDEV [%pM] not found", mac_addr);
+		return 0;
+	}
+
+	peer = ol_txrx_find_peer_by_addr(pdev, mac_addr, &peer_id);
+
+	if (!peer) {
+		TLSHIM_LOGW("PEER [%pM] not found", mac_addr);
+		return 0;
+	}
+
+	return peer->local_id;
+}
+#endif
+
 /*
  * Function to get vdev(tl_context) given the MAC address.
  */
@@ -2088,7 +2268,7 @@ void *tl_shim_get_vdev_by_addr(void *vos_context, uint8_t *mac_addr)
 	uint8_t peer_id;
 
 	if (vos_context == NULL || mac_addr == NULL) {
-		TLSHIM_LOGE("Invalid argument %p, %p", vos_context, mac_addr);
+		TLSHIM_LOGE("Invalid argument %pK, %pK", vos_context, mac_addr);
 		return NULL;
 	}
 
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TLSHIM/tl_shim.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TLSHIM/tl_shim.h
index 6a93553dfc5..57ef2e88389 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TLSHIM/tl_shim.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TLSHIM/tl_shim.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014,2016-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -112,6 +112,7 @@ struct deferred_iapp_work iapp_work;
 	ipa_uc_fw_op_cb fw_op_cb;
 	void *usr_ctxt;
 #endif /* IPA_UC_OFFLOAD */
+	WLANTL_STARxCBType rx_monitor_cb;
 };
 
 /*
@@ -165,4 +166,55 @@ static inline void tlshim_reset_bundle_require(void)
 
 	ol_tx_pdev_reset_bundle_require(pdev);
 }
+
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+static inline
+void tlshim_set_driver_del_ack_enable(uint8_t vdev_id, unsigned long rx_packets,
+			uint32_t time_in_ms, uint32_t high_th, uint32_t low_th)
+{
+	ol_tx_vdev_set_driver_del_ack_enable(vdev_id, rx_packets,
+				 time_in_ms, high_th, low_th);
+}
+
+static inline void tlshim_driver_del_ack_disable(void)
+{
+	void *vos_ctx = vos_get_global_context(VOS_MODULE_ID_TL, NULL);
+	void *pdev;
+
+	if (!vos_ctx)
+		return;
+
+	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_ctx);
+	if (!pdev)
+		return;
+
+	ol_tx_pdev_reset_driver_del_ack(pdev);
+}
+#else
+static inline
+void tlshim_set_driver_del_ack_enable(uint8_t vdev_id, unsigned long rx_packets,
+			uint32_t time_in_ms, uint32_t high_th, uint32_t low_th)
+{
+}
+
+static inline void tlshim_driver_del_ack_disable(void)
+{
+}
+#endif
+
+static inline void *tlshim_get_rxmon_cbk(void)
+{
+	void *vos_ctx = vos_get_global_context(VOS_MODULE_ID_TL, NULL);
+	struct txrx_tl_shim_ctx *tlshim;
+
+	if (!vos_ctx)
+		return NULL;
+
+	tlshim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
+	if (tlshim)
+		return (void *)tlshim->rx_monitor_cb;
+
+	return NULL;
+}
+
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_cfg.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_cfg.c
index 84466ce7454..0b07f2c5afa 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_cfg.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_cfg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014,2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -27,11 +27,31 @@
 
 #include <ol_cfg.h>
 #include <ol_if_athvar.h>
+#include <vos_types.h>
+#include <vos_getBin.h>
 
 unsigned int vow_config = 0;
 module_param(vow_config, uint, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
 MODULE_PARM_DESC(vow_config, "Do VoW Configuration");
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+/**
+ * ol_cfg_update_del_ack_params() - update delayed ack params
+ *
+ * @cfg_ctx: cfg context
+ * @cfg_param: parameters
+ *
+ * Return: none
+ */
+void ol_cfg_update_del_ack_params(struct txrx_pdev_cfg_t *cfg_ctx,
+				struct txrx_pdev_cfg_param_t cfg_param)
+{
+	cfg_ctx->del_ack_enable = cfg_param.del_ack_enable;
+	cfg_ctx->del_ack_timer_value = cfg_param.del_ack_timer_value;
+	cfg_ctx->del_ack_pkt_count = cfg_param.del_ack_pkt_count;
+}
+#endif
+
 #ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
 /**
  * ol_cfg_update_bundle_params() - update tx bundle params
@@ -94,7 +114,10 @@ ol_pdev_handle ol_pdev_cfg_attach(adf_os_device_t osdev,
 	cfg_ctx->max_peer_id = 511;
 	cfg_ctx->max_vdev = CFG_TGT_NUM_VDEV;
 	cfg_ctx->pn_rx_fwd_check = 1;
-	cfg_ctx->frame_type = wlan_frm_fmt_802_3;
+	if (VOS_MONITOR_MODE == vos_get_conparam())
+		cfg_ctx->frame_type = wlan_frm_fmt_raw;
+	else
+		cfg_ctx->frame_type = wlan_frm_fmt_802_3;
 	cfg_ctx->max_thruput_mbps = 800;
 	cfg_ctx->max_nbuf_frags = 1;
 	cfg_ctx->vow_config = vow_config;
@@ -106,6 +129,9 @@ ol_pdev_handle ol_pdev_cfg_attach(adf_os_device_t osdev,
 	cfg_ctx->dutycycle_level[3] = THROTTLE_DUTY_CYCLE_LEVEL3;
 	cfg_ctx->rx_fwd_disabled = 0;
 	cfg_ctx->is_packet_log_enabled = 0;
+#ifdef WLAN_FEATURE_TSF_PLUS
+	cfg_ctx->is_ptp_rx_opt_enabled = 0;
+#endif
 	cfg_ctx->is_full_reorder_offload = cfg_param.is_full_reorder_offload;
 #ifdef IPA_UC_OFFLOAD
 	cfg_ctx->ipa_uc_rsc.uc_offload_enabled = cfg_param.is_uc_offload_enabled;
@@ -116,6 +142,8 @@ ol_pdev_handle ol_pdev_cfg_attach(adf_os_device_t osdev,
 #endif /* IPA_UC_OFFLOAD */
 
 	ol_cfg_update_bundle_params(cfg_ctx, cfg_param);
+	ol_cfg_update_del_ack_params(cfg_ctx, cfg_param);
+	ol_cfg_update_ptp_params(cfg_ctx, cfg_param);
 
 	for (i = 0; i < OL_TX_NUM_WMM_AC; i++) {
 		cfg_ctx->ac_specs[i].wrr_skip_weight =
@@ -133,6 +161,47 @@ ol_pdev_handle ol_pdev_cfg_attach(adf_os_device_t osdev,
 	return (ol_pdev_handle) cfg_ctx;
 }
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+/**
+ * ol_cfg_get_del_ack_timer_value() - get delayed ack timer value
+ * @pdev: pdev handle
+ *
+ * Return: timer value
+ */
+int ol_cfg_get_del_ack_timer_value(ol_pdev_handle pdev)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+
+	return cfg->del_ack_timer_value;
+}
+
+/**
+ * ol_cfg_get_del_ack_enable_value() - get delayed ack enable value
+ * @pdev: pdev handle
+ *
+ * Return: enable/disable
+ */
+int ol_cfg_get_del_ack_enable_value(ol_pdev_handle pdev)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+
+	return cfg->del_ack_enable;
+}
+
+/**
+ * ol_cfg_get_del_ack_count_value() - get delayed ack count value
+ * @pdev: pdev handle
+ *
+ * Return: count value
+ */
+int ol_cfg_get_del_ack_count_value(ol_pdev_handle pdev)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+
+	return cfg->del_ack_pkt_count;
+}
+#endif
+
 #ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
 /**
  * ol_cfg_get_bundle_timer_value() - get bundle timer value
@@ -211,6 +280,46 @@ u_int8_t ol_cfg_is_packet_log_enabled(ol_pdev_handle pdev)
 	return cfg->is_packet_log_enabled;
 }
 
+#ifdef WLAN_FEATURE_TSF_PLUS
+void ol_set_cfg_ptp_rx_opt_enabled(ol_pdev_handle pdev, u_int8_t val)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+
+	cfg->is_ptp_rx_opt_enabled = val;
+}
+
+u_int8_t ol_cfg_is_ptp_rx_opt_enabled(ol_pdev_handle pdev)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+
+	return cfg->is_ptp_rx_opt_enabled;
+}
+/**
+ * ol_cfg_is_ptp_enabled() - check if ptp feature is enabled
+ * @pdev: cfg handle to PDEV
+ *
+ * Return: is_ptp_enabled
+ */
+a_bool_t ol_cfg_is_ptp_enabled(ol_pdev_handle pdev)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+
+	return cfg->is_ptp_enabled;
+}
+/**
+ * ol_cfg_update_ptp_params() - update ptp params
+ * @cfg_ctx: cfg context
+ * @cfg_param: parameters
+ *
+ * Return: none
+ */
+void ol_cfg_update_ptp_params(struct txrx_pdev_cfg_t *cfg_ctx,
+				struct txrx_pdev_cfg_param_t cfg_param)
+{
+	cfg_ctx->is_ptp_enabled = cfg_param.is_ptp_enabled;
+}
+#endif
+
 int ol_cfg_rx_fwd_disabled(ol_pdev_handle pdev)
 {
 #if defined(ATHR_WIN_NWF)
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_ctrl_txrx_api.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_ctrl_txrx_api.h
index 30e8d1d54f7..e0e5151e2f0 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_ctrl_txrx_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_ctrl_txrx_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -131,6 +131,9 @@ ol_rx_err(
     u_int64_t *pn,
     u_int8_t key_id);
 
+#ifdef HL_RX_AGGREGATION_HOLE_DETCTION
+void ol_rx_aggregation_hole(uint32_t hole_info);
+#endif
 
 enum ol_rx_notify_type {
     OL_RX_NOTIFY_IPV4_IGMP,
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx.c
index 87a680af218..a44a4b065b7 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,6 +38,7 @@
 #include <ol_htt_rx_api.h>     /* htt_rx_peer_id, etc. */
 
 /* internal API header files */
+#include <ol_txrx.h>           /* ol_txrx_peer_unref_delete */
 #include <ol_txrx_types.h>     /* ol_txrx_vdev_t, etc. */
 #include <ol_txrx_peer_find.h> /* ol_txrx_peer_find_by_id */
 #include <ol_rx_reorder.h>     /* ol_rx_reorder_store, etc. */
@@ -103,7 +104,7 @@ void ol_rx_trigger_restore(htt_pdev_handle htt_pdev, adf_nbuf_t head_msdu,
     while (head_msdu) {
         next = adf_nbuf_next(head_msdu);
         VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-            "freeing %p\n", head_msdu);
+            "freeing %pK\n", head_msdu);
         adf_nbuf_free(head_msdu);
         head_msdu = next;
     }
@@ -225,6 +226,118 @@ OL_RX_MPDU_RSSI_UPDATE(
 #define OL_RX_MPDU_RSSI_UPDATE(peer, rx_mpdu_desc) /* no-op */
 #endif /* QCA_SUPPORT_PEER_DATA_RX_RSSI */
 
+/**
+ * ol_rx_mon_indication_handler() - htt rx indication message handler
+ * for HL monitor mode.
+ * @pdev: pointer to struct ol_txrx_pdev_handle
+ * @rx_ind_msg:      htt rx indication message
+ * @peer_id:         peer id
+ * @tid:             tid
+ * @num_mpdu_ranges: number of mpdu ranges
+ *
+ * This function pops amsdu from rx indication message and directly
+ * deliver to upper layer.
+ */
+void
+ol_rx_mon_indication_handler(
+	ol_txrx_pdev_handle pdev,
+	adf_nbuf_t rx_ind_msg,
+	u_int16_t peer_id,
+	u_int8_t tid,
+	int num_mpdu_ranges)
+{
+	int mpdu_range;
+	struct ol_txrx_peer_t *peer;
+	htt_pdev_handle htt_pdev;
+	struct ol_txrx_vdev_t *vdev = NULL;
+
+	htt_pdev = pdev->htt_pdev;
+
+	adf_os_spin_lock_bh(&pdev->peer_ref_mutex);
+	peer = pdev->self_peer;
+	if (peer) {
+		adf_os_atomic_inc(&peer->ref_cnt);
+		vdev = peer->vdev;
+	}
+	adf_os_spin_unlock_bh(&pdev->peer_ref_mutex);
+
+	for (mpdu_range = 0; mpdu_range < num_mpdu_ranges; mpdu_range++) {
+		enum htt_rx_status status;
+		int i, num_mpdus;
+		adf_nbuf_t head_msdu, tail_msdu;
+
+		htt_rx_ind_mpdu_range_info(
+			pdev->htt_pdev,
+			rx_ind_msg,
+			mpdu_range,
+			&status,
+			&num_mpdus);
+
+		TXRX_STATS_ADD(pdev, priv.rx.normal.mpdus, num_mpdus);
+
+		for (i = 0; i < num_mpdus; i++) {
+			htt_rx_amsdu_pop(
+				htt_pdev, rx_ind_msg, &head_msdu, &tail_msdu);
+			if (peer && vdev) {
+				peer->rx_opt_proc(vdev, peer, tid, head_msdu);
+			} else {
+				while (1) {
+					adf_nbuf_t next;
+					next = adf_nbuf_next(head_msdu);
+					htt_rx_desc_frame_free(
+						htt_pdev,
+						head_msdu);
+					if (head_msdu == tail_msdu)
+						break;
+					head_msdu = next;
+				}
+			}
+		}
+	}
+
+	if (peer)
+		ol_txrx_peer_unref_delete(peer);
+}
+
+/*
+ * ol_rx_mon_mac_header_handler() - htt rx mac header msg handler
+ * @pdev: pointer to struct ol_txrx_pdev_handle
+ * @rx_ind_msg: htt rx indication message
+ */
+void
+ol_rx_mon_mac_header_handler(
+	ol_txrx_pdev_handle pdev,
+	adf_nbuf_t rx_ind_msg)
+{
+	adf_nbuf_t head_msdu = NULL;
+	adf_nbuf_t tail_msdu = NULL;
+	adf_nbuf_t next;
+	htt_pdev_handle htt_pdev;
+
+	htt_pdev = pdev->htt_pdev;
+
+	/* only if the rx callback is ready */
+	if (NULL == pdev->osif_rx_mon_cb)
+	    return;
+
+	htt_rx_mac_header_mon_process(htt_pdev,
+				      rx_ind_msg,
+				      &head_msdu,
+				      &tail_msdu);
+
+	if (head_msdu) {
+	   if (pdev->osif_rx_mon_cb) {
+	       pdev->osif_rx_mon_cb(head_msdu);
+	   } else {
+	      while (head_msdu) {
+		next = adf_nbuf_next(head_msdu);
+		adf_nbuf_free(head_msdu);
+		head_msdu = next;
+		}
+	   }
+	}
+}
+
 void
 ol_rx_indication_handler(
     ol_txrx_pdev_handle pdev,
@@ -267,6 +380,9 @@ ol_rx_indication_handler(
             for (i = 0; i < 4; i++)
                 peer->last_pkt_rssi[i] = htt_rx_ind_rssi_dbm_chain(
                     pdev->htt_pdev, rx_ind_msg, i);
+            for (i = 0; i < 4; i++)
+                peer->last_pkt_noise_floor[i] = htt_rx_ind_noise_floor_chain(
+                    pdev->htt_pdev, rx_ind_msg, i);
             htt_rx_ind_timestamp(pdev->htt_pdev, rx_ind_msg,
                                  &peer->last_pkt_timestamp_microsec,
                                  &peer->last_pkt_timestamp_submicrosec);
@@ -577,7 +693,7 @@ ol_rx_sec_ind_handler(
         return;
     }
     TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-        "sec spec for peer %p (%02x:%02x:%02x:%02x:%02x:%02x): "
+        "sec spec for peer %pK (%02x:%02x:%02x:%02x:%02x:%02x): "
         "%s key of type %d\n",
         peer,
         peer->mac_addr.raw[0], peer->mac_addr.raw[1], peer->mac_addr.raw[2],
@@ -738,7 +854,7 @@ void
 ol_rx_offload_deliver_ind_handler(
     ol_txrx_pdev_handle pdev,
     adf_nbuf_t msg,
-    int msdu_cnt)
+    u_int16_t msdu_cnt)
 {
     int vdev_id, peer_id, tid;
     adf_nbuf_t head_buf, tail_buf, buf;
@@ -747,6 +863,17 @@ ol_rx_offload_deliver_ind_handler(
     u_int8_t fw_desc;
     htt_pdev_handle htt_pdev = pdev->htt_pdev;
 
+    if (msdu_cnt > htt_rx_offload_msdu_cnt(htt_pdev)) {
+        TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+            "%s: invalid msdu_cnt=%u\n",
+            __func__,
+            msdu_cnt);
+        if (pdev->cfg.is_high_latency)
+            htt_rx_desc_frame_free(htt_pdev, msg);
+
+        return;
+    }
+
     while (msdu_cnt) {
         if (!htt_rx_offload_msdu_pop(
             htt_pdev, msg, &vdev_id, &peer_id,
@@ -911,6 +1038,71 @@ ol_rx_filter(
     return FILTER_STATUS_REJECT;
 }
 
+#ifdef WLAN_FEATURE_TSF_PLUS
+static inline void ol_rx_timestamp(ol_pdev_handle pdev,
+				   void *rx_desc, adf_nbuf_t msdu)
+{
+	struct htt_rx_ppdu_desc_t *rx_ppdu_desc;
+
+	if (!ol_cfg_is_ptp_rx_opt_enabled(pdev))
+		return;
+
+	if (!rx_desc || !msdu)
+		return;
+
+	rx_ppdu_desc = (struct htt_rx_ppdu_desc_t *)((uint8_t *)(rx_desc) -
+			HTT_RX_IND_HL_BYTES + HTT_RX_IND_HDR_PREFIX_BYTES);
+	msdu->tstamp = ns_to_ktime((u_int64_t)rx_ppdu_desc->tsf32 *
+				   NSEC_PER_USEC);
+}
+#else
+static inline void ol_rx_timestamp(ol_pdev_handle pdev,
+				   void *rx_desc, adf_nbuf_t msdu)
+{
+}
+#endif
+
+/**
+ * ol_convert_ieee80211_to_8023() - handle data header transition.
+ * @msdu - Received packet.
+ *
+ * This function try to convert the IEEE80211 data frame to 802.3 frame.
+ * When DSRC OCB interface works in RAW mode, driver received data frame
+ * started with IEEE802.11 header, before this packet is delivered to
+ * network stack, it is needed to do transition. But for QCOM specific
+ * frame, this function do nothing change.
+ */
+static A_STATUS ol_convert_ieee80211_to_8023(adf_nbuf_t msdu)
+{
+	int hdr_size;
+	uint16_t epd_hdr_type;
+	struct ether_header eth_hdr;
+	struct ieee80211_frame *wh;
+
+	wh = (struct ieee80211_frame *)adf_nbuf_data(msdu);
+	if (!IEEE80211_IS_DATA(wh))
+		return A_ERROR;
+
+	hdr_size = ol_txrx_ieee80211_hdrsize(wh);
+	if (adf_nbuf_len(msdu) < (hdr_size + sizeof(epd_hdr_type)))
+		return A_ERROR;
+
+	epd_hdr_type = *(uint16_t *)(adf_nbuf_data(msdu) + hdr_size);
+	if (epd_hdr_type == adf_os_htons(ETHERTYPE_WSMP))
+		return A_ENOTSUP;
+
+	adf_os_mem_zero(&eth_hdr, sizeof(struct ether_header));
+	adf_os_mem_copy(eth_hdr.ether_dhost, wh->i_addr1, IEEE80211_ADDR_LEN);
+	adf_os_mem_copy(eth_hdr.ether_shost, wh->i_addr2, IEEE80211_ADDR_LEN);
+	eth_hdr.ether_type = epd_hdr_type;
+
+	adf_nbuf_pull_head(msdu, hdr_size + sizeof(epd_hdr_type));
+	adf_nbuf_push_head(msdu, sizeof(eth_hdr));
+	adf_os_mem_copy(adf_nbuf_data(msdu), &eth_hdr, sizeof(eth_hdr));
+
+	return A_OK;
+}
+
 void
 ol_rx_deliver(
     struct ol_txrx_vdev_t *vdev,
@@ -954,7 +1146,7 @@ ol_rx_deliver(
         if (OL_RX_DECAP(vdev, peer, msdu, &info) != A_OK) {
             discard = 1;
             TXRX_PRINT(TXRX_PRINT_LEVEL_WARN,
-                "decap error %p from peer %p "
+                "decap error %pK from peer %pK "
                 "(%02x:%02x:%02x:%02x:%02x:%02x) len %d\n",
                  msdu, peer,
                  peer->mac_addr.raw[0], peer->mac_addr.raw[1],
@@ -999,13 +1191,31 @@ DONE:
                 int i;
                 struct ol_txrx_ocb_chan_info *chan_info = 0;
                 int packet_freq = peer->last_pkt_center_freq;
+                bool need_rx_stats_hdr = false;
+
                 for (i = 0; i < vdev->ocb_channel_count; i++) {
                     if (vdev->ocb_channel_info[i].chan_freq == packet_freq) {
                         chan_info = &vdev->ocb_channel_info[i];
                         break;
                     }
                 }
-                if (!chan_info || !chan_info->disable_rx_stats_hdr) {
+
+                if (NULL != chan_info)
+                    need_rx_stats_hdr = !chan_info->disable_rx_stats_hdr;
+
+                if (vdev->ocb_config_flags & OCB_CONFIG_FLAG_80211_FRAME_MODE) {
+                    /*
+                     * When DSRC OCB interface works in raw mode,
+                     * and received packets started with 802.11 data header,
+                     * it is required to driver convert the header to
+                     * 802.3 header, except specific WSMP data frame.
+                     */
+                    A_STATUS status = ol_convert_ieee80211_to_8023(msdu);
+                    if (A_SUCCESS(status))
+                        need_rx_stats_hdr = false;
+                }
+
+                if (need_rx_stats_hdr) {
                     struct ether_header eth_header = { {0} };
                     struct ocb_rx_stats_hdr_t rx_header = {0};
 
@@ -1019,6 +1229,9 @@ DONE:
                     rx_header.rssi_cmb = peer->last_pkt_rssi_cmb;
                     adf_os_mem_copy(rx_header.rssi, peer->last_pkt_rssi,
                                     sizeof(rx_header.rssi));
+                    adf_os_mem_copy(rx_header.noise_floor,
+                                    peer->last_pkt_noise_floor,
+                                    sizeof(rx_header.noise_floor));
                     if (peer->last_pkt_legacy_rate_sel == 0) {
                         switch (peer->last_pkt_legacy_rate) {
                         case 0x8:
@@ -1077,6 +1290,8 @@ DONE:
             OL_RX_ERR_STATISTICS_1(pdev, vdev, peer, rx_desc, OL_RX_ERR_NONE);
             TXRX_STATS_MSDU_INCR(vdev->pdev, rx.delivered, msdu);
 
+            ol_rx_timestamp(pdev->ctrl_pdev, rx_desc, msdu);
+
             OL_TXRX_LIST_APPEND(deliver_list_head, deliver_list_tail, msdu);
         }
         msdu = next;
@@ -1118,7 +1333,7 @@ ol_rx_discard(
 
         msdu_list = adf_nbuf_next(msdu_list);
         TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-            "discard rx %p from partly-deleted peer %p "
+            "discard rx %pK from partly-deleted peer %pK "
             "(%02x:%02x:%02x:%02x:%02x:%02x)\n",
             msdu, peer,
             peer->mac_addr.raw[0], peer->mac_addr.raw[1],
@@ -1137,6 +1352,8 @@ ol_rx_peer_init(struct ol_txrx_pdev_t *pdev, struct ol_txrx_peer_t *peer)
 
         /* invalid sequence number */
         peer->tids_last_seq[tid] = IEEE80211_SEQ_MAX;
+        /* invalid reorder index number */
+        peer->tids_next_rel_idx[tid] = INVALID_REORDER_INDEX;
     }
     /*
      * Set security defaults: no PN check, no security.
@@ -1372,6 +1589,7 @@ ol_rx_offload_paddr_deliver_ind_handler(
         peer = ol_txrx_peer_find_by_id(htt_pdev->txrx_pdev, peer_id);
         if (peer && peer->vdev) {
             adf_dp_trace_set_track(head_buf, ADF_RX);
+            NBUF_SET_PACKET_TRACK(head_buf, NBUF_TX_PKT_DATA_TRACK);
             adf_dp_trace_log_pkt(peer->vdev->vdev_id,
                                  head_buf, ADF_RX);
             DPTRACE(adf_dp_trace(head_buf,
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c
index 358d6d660c3..a51eb75b79e 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -192,12 +192,20 @@ ol_rx_frag_indication_handler(
     u_int8_t tid)
 {
     u_int16_t seq_num;
-    int seq_num_start, seq_num_end;
+    u_int16_t seq_num_start, seq_num_end;
     struct ol_txrx_peer_t *peer;
     htt_pdev_handle htt_pdev;
     adf_nbuf_t head_msdu, tail_msdu;
     void *rx_mpdu_desc;
 
+    if (tid >= OL_TXRX_NUM_EXT_TIDS) {
+        TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+                    "%s:  invalid tid, %u\n",
+                    __FUNCTION__,
+                    tid);
+        return;
+    }
+
     htt_pdev = pdev->htt_pdev;
     peer = ol_txrx_peer_find_by_id(pdev, peer_id);
 
@@ -245,7 +253,7 @@ ol_rx_reorder_flush_frag(
     htt_pdev_handle htt_pdev,
     struct ol_txrx_peer_t *peer,
     unsigned tid,
-    int seq_num)
+    u_int16_t seq_num)
 {
     struct ol_rx_reorder_array_elem_t *rx_reorder_array_elem;
     int seq;
@@ -1047,6 +1055,7 @@ ol_rx_defrag_decap_recombine(
     adf_nbuf_set_next(rx_nbuf, NULL);
     while (msdu) {
         htt_rx_msdu_desc_free(htt_pdev, msdu);
+        adf_net_buf_debug_release_skb(msdu);
         tmp = adf_nbuf_next(msdu);
         adf_nbuf_set_next(msdu, NULL);
         OL_RX_FRAG_PULL_HDR(htt_pdev, msdu, hdrsize);
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_defrag.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_defrag.h
index 737c2998730..7750f2456fd 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_defrag.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_defrag.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -165,7 +165,7 @@ ol_rx_reorder_flush_frag(
     htt_pdev_handle htt_pdev,
     struct ol_txrx_peer_t *peer,
     unsigned tid,
-    int seq_num);
+    u_int16_t seq_num);
 
 static inline void
 xor_block(
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_fwd.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_fwd.c
index ead13c7e1eb..70555dc5692 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_fwd.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_fwd.c
@@ -154,7 +154,7 @@ ol_rx_fwd_to_tx(struct ol_txrx_vdev_t *vdev, adf_nbuf_t msdu)
          * We could store the frame and try again later,
          * but the simplest solution is to discard the frames.
          */
-        adf_nbuf_free(msdu);
+        adf_nbuf_tx_free(msdu, ADF_NBUF_PKT_ERROR);
     }
 }
 
@@ -231,6 +231,7 @@ ol_rx_fwd_check(
             if (!do_not_fwd) {
                 if (htt_rx_msdu_discard(pdev->htt_pdev, rx_desc)) {
                         htt_rx_msdu_desc_free(pdev->htt_pdev, msdu);
+                        adf_net_buf_debug_release_skb(msdu);
                         ol_rx_fwd_to_tx(tx_vdev, msdu);
                         msdu = NULL; /* already handled this MSDU */
                         tx_vdev->fwd_tx_packets++;
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_pn.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
index aae18f8b002..b3f4106395d 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2015, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -190,7 +190,7 @@ ol_rx_pn_check_base(
             }
 
             TXRX_PRINT(log_level,
-                "PN check failed - TID %d, peer %p "
+                "PN check failed - TID %d, peer %pK "
                 "(%02x:%02x:%02x:%02x:%02x:%02x) %s\n"
                 "    old PN (u64 x2)= 0x%08llx %08llx (LSBs = %lld)\n"
                 "    new PN (u64 x2)= 0x%08llx %08llx (LSBs = %lld)\n"
@@ -365,7 +365,7 @@ ol_rx_pn_trace_display(ol_txrx_pdev_handle pdev, int just_once)
         "   count  idx    peer   tid uni  num    LSBs\n");
     do {
         VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-            "  %6lld %4d  %p %2d   %d %4d %8d\n",
+            "  %6lld %4d  %pK %2d   %d %4d %8d\n",
             cnt, i,
             pdev->rx_pn_trace.data[i].peer,
             pdev->rx_pn_trace.data[i].tid,
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c
index e1ffff092a9..c7bffde0e46 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -473,6 +473,61 @@ ol_rx_reorder_first_hole(
     *idx_end = tmp_idx;
 }
 
+#ifdef HL_RX_AGGREGATION_HOLE_DETCTION
+
+/**
+ * ol_rx_reorder_detect_hole - ol rx reorder detect hole
+ * @peer: ol_txrx_peer_t
+ * @tid: tid
+ * @idx_start: idx_start
+ *
+ * Return: void
+ */
+static void ol_rx_reorder_detect_hole(struct ol_txrx_peer_t *peer,
+					uint32_t tid,
+					uint32_t idx_start)
+{
+	uint32_t win_sz_mask, next_rel_idx, hole_size;
+
+	if (peer->tids_next_rel_idx[tid] == INVALID_REORDER_INDEX)
+		return;
+
+	win_sz_mask = peer->tids_rx_reorder[tid].win_sz_mask;
+	/* Return directly if block-ack not enable */
+	if (win_sz_mask == 0)
+		return;
+
+	idx_start &= win_sz_mask;
+	next_rel_idx = peer->tids_next_rel_idx[tid] & win_sz_mask;
+
+	if (idx_start != next_rel_idx) {
+		hole_size = ((int)idx_start - (int)next_rel_idx) & win_sz_mask;
+
+		ol_rx_aggregation_hole(hole_size);
+	}
+
+	return;
+}
+
+#else
+
+/**
+ * ol_rx_reorder_detect_hole - ol rx reorder detect hole
+ * @peer: ol_txrx_peer_t
+ * @tid: tid
+ * @idx_start: idx_start
+ *
+ * Return: void
+ */
+static void ol_rx_reorder_detect_hole(struct ol_txrx_peer_t *peer,
+					uint32_t tid,
+					uint32_t idx_start)
+{
+	/* no-op */
+}
+
+#endif
+
 void
 ol_rx_reorder_peer_cleanup(
     struct ol_txrx_vdev_t *vdev, struct ol_txrx_peer_t *peer)
@@ -545,7 +600,7 @@ ol_rx_delba_handler(
     if (peer == NULL) {
         return;
     }
-    peer->tids_next_rel_idx[tid] = 0xffff; /* invalid value */
+    peer->tids_next_rel_idx[tid] = INVALID_REORDER_INDEX; /* invalid value */
     rx_reorder = &peer->tids_rx_reorder[tid];
 
     /* check that there really was a block ack agreement */
@@ -583,6 +638,14 @@ ol_rx_flush_handler(
     struct ol_rx_reorder_array_elem_t *rx_reorder_array_elem;
     htt_pdev_handle htt_pdev = pdev->htt_pdev;
 
+    if (tid >= OL_TXRX_NUM_EXT_TIDS) {
+        TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+                    "%s:  invalid tid, %u\n",
+                    __FUNCTION__,
+                    tid);
+        return;
+    }
+
     peer = ol_txrx_peer_find_by_id(pdev, peer_id);
     if (peer) {
         vdev = peer->vdev;
@@ -607,6 +670,10 @@ ol_rx_flush_handler(
             return;
         }
     }
+
+    if (action == htt_rx_flush_release)
+        ol_rx_reorder_detect_hole(peer, tid, idx_start);
+
     ol_rx_reorder_flush(
         vdev, peer, tid, idx_start, idx_end, action);
     /*
@@ -622,8 +689,8 @@ ol_rx_pn_ind_handler(
     ol_txrx_pdev_handle pdev,
     u_int16_t peer_id,
     u_int8_t tid,
-    int seq_num_start,
-    int seq_num_end,
+    u_int16_t seq_num_start,
+    u_int16_t seq_num_end,
     u_int8_t pn_ie_cnt,
     u_int8_t *pn_ie)
 {
@@ -635,7 +702,8 @@ ol_rx_pn_ind_handler(
     adf_nbuf_t head_msdu = NULL;
     adf_nbuf_t tail_msdu = NULL;
     htt_pdev_handle htt_pdev = pdev->htt_pdev;
-    int seq_num, i=0;
+    u_int16_t seq_num;
+    int i=0;
 
     peer = ol_txrx_peer_find_by_id(pdev, peer_id);
 
@@ -693,7 +761,7 @@ ol_rx_pn_ind_handler(
                     log_level = TXRX_PRINT_LEVEL_INFO2;
                 }
                 TXRX_PRINT(log_level,
-                    "Tgt PN check failed - TID %d, peer %p "
+                    "Tgt PN check failed - TID %d, peer %pK "
                     "(%02x:%02x:%02x:%02x:%02x:%02x)\n"
                     "    PN (u64 x2)= 0x%08llx %08llx (LSBs = %lld)\n"
                     "    new seq num = %d\n",
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx.c
index 890303999a8..b8169c0537b 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -53,6 +53,344 @@
 #include <ol_txrx_encap.h>    /* OL_TX_ENCAP, etc */
 #include "vos_lock.h"
 
+#ifdef WLAN_FEATURE_DSRC
+#include "ol_tx.h"
+#include "wlan_hdd_main.h"
+#include "wlan_hdd_ocb.h"
+#include "adf_os_lock.h"
+#include "adf_os_util.h"
+#include "queue.h"
+
+/**
+ * struct ol_tx_stats_ring_item - the item of a packet tx stats in the ring
+ * @list: list for all tx stats item in the ring
+ * @stats: a packet tx stats including fields from host and FW respectively
+ * @msdu_id: msdu ID used to match stats fields respectively from host and FW
+ * into a complete tx stats item
+ * @reserved: reserved to align to 4 bytes
+ */
+struct ol_tx_stats_ring_item {
+	TAILQ_ENTRY(ol_tx_stats_ring_item) list;
+	struct ol_tx_per_pkt_stats stats;
+	uint16_t msdu_id;
+	uint8_t reserved[2];
+};
+
+/**
+ * struct ol_tx_stats_ring_head - the ring head of all tx stats
+ * @mutex: mutex to access it exclusively
+ * @free_list: list of free tx stats ring items
+ * @host_list: list of tx stats items only containing tx stats fields from host
+ * @comp_list: list of tx stats items containing complete tx stats fields
+ * from host and FW, items in this list can be dequeued to user
+ * @num_free: number of free tx stats items
+ * @num_host_stat: number of tx stats items only containing tx stats fields
+ * from host
+ * @num_comp_stat: number of tx stats items containing complete tx stats fields
+ */
+struct ol_tx_stats_ring_head {
+	adf_os_spinlock_t mutex;
+	TAILQ_HEAD(free_list, ol_tx_stats_ring_item) free_list;
+	TAILQ_HEAD(host_list, ol_tx_stats_ring_item) host_list;
+	TAILQ_HEAD(comp_list, ol_tx_stats_ring_item) comp_list;
+	uint8_t num_free;
+	uint8_t num_host_stat;
+	uint8_t num_comp_stat;
+};
+
+#define TX_STATS_RING_SZ 32
+#define INVALID_TX_MSDU_ID (-1)
+
+static struct ol_tx_stats_ring_head *tx_stats_ring_head;
+static struct ol_tx_stats_ring_item *tx_stats_ring;
+static bool __ol_per_pkt_tx_stats_enabled = false;
+
+static int ol_tx_stats_ring_init(void)
+{
+	struct ol_tx_stats_ring_head *head;
+	struct ol_tx_stats_ring_item *ring;
+	int i;
+
+	TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1, "%s()\n", __func__);
+	head = vos_mem_malloc(sizeof(*head));
+	if (!head)
+		return -ENOMEM;
+	ring = vos_mem_malloc(sizeof(*ring) * TX_STATS_RING_SZ);
+	if (!ring) {
+		vos_mem_free(head);
+		return -ENOMEM;
+	}
+	tx_stats_ring_head = head;
+	tx_stats_ring = ring;
+
+	vos_mem_zero(head, sizeof(*head));
+	vos_mem_zero(ring, sizeof(*ring) * TX_STATS_RING_SZ);
+
+	TAILQ_INIT(&head->free_list);
+	TAILQ_INIT(&head->host_list);
+	TAILQ_INIT(&head->comp_list);
+
+	for (i = 0; i < TX_STATS_RING_SZ; i++) {
+		ring[i].msdu_id = INVALID_TX_MSDU_ID;
+		TAILQ_INSERT_HEAD(&head->free_list, &ring[i], list);
+	}
+	head->num_free = TX_STATS_RING_SZ;
+
+	adf_os_spinlock_init(&head->mutex);
+
+	return 0;
+}
+
+static void ol_tx_stats_ring_deinit(void)
+{
+	TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1, "%s()\n", __func__);
+	if (tx_stats_ring_head) {
+		vos_mem_free(tx_stats_ring_head);
+		tx_stats_ring_head = NULL;
+	}
+	if (tx_stats_ring) {
+		vos_mem_free(tx_stats_ring);
+		tx_stats_ring = NULL;
+	}
+}
+
+void ol_per_pkt_tx_stats_enable(bool enable)
+{
+	int ret = 0;
+
+	if (!vos_is_ocb_tx_per_pkt_stats_enabled())
+		return;
+
+	if (__ol_per_pkt_tx_stats_enabled == enable)
+		return;
+
+	if (enable)
+		ret = ol_tx_stats_ring_init();
+	else
+		ol_tx_stats_ring_deinit();
+
+	if (!ret)
+		__ol_per_pkt_tx_stats_enabled = enable;
+	else
+		__ol_per_pkt_tx_stats_enabled = false;
+
+	adf_os_mb();
+}
+
+bool ol_per_pkt_tx_stats_enabled(void)
+{
+	return __ol_per_pkt_tx_stats_enabled;
+}
+
+static inline int __free_list_empty(void)
+{
+	return TAILQ_EMPTY(&tx_stats_ring_head->free_list);
+}
+
+static inline int __host_list_empty(void)
+{
+	return TAILQ_EMPTY(&tx_stats_ring_head->host_list);
+}
+
+static inline int __comp_list_empty(void)
+{
+	return TAILQ_EMPTY(&tx_stats_ring_head->comp_list);
+}
+
+static inline struct ol_tx_stats_ring_item *__get_ring_item(void)
+{
+	struct ol_tx_stats_ring_head *h = tx_stats_ring_head;
+	struct ol_tx_stats_ring_item *item = NULL;
+
+	if (!__free_list_empty()) {
+		item = TAILQ_FIRST(&h->free_list);
+		TAILQ_REMOVE(&h->free_list, item, list);
+		h->num_free--;
+	} else if (!__comp_list_empty()) {
+		/* Discard the oldest one. */
+		item = TAILQ_LAST(&h->comp_list, comp_list);
+		TAILQ_REMOVE(&h->comp_list, item, list);
+		h->num_comp_stat--;
+	} else if (!__host_list_empty()) {
+		item = TAILQ_LAST(&h->host_list, host_list);
+		TAILQ_REMOVE(&h->host_list, item, list);
+		h->num_host_stat--;
+	}
+
+	return item;
+}
+
+static inline struct ol_tx_stats_ring_item *
+__get_ring_item_host(uint32_t msdu_id)
+{
+	struct ol_tx_stats_ring_head *h = tx_stats_ring_head;
+	struct ol_tx_stats_ring_item *item = NULL;
+	struct ol_tx_stats_ring_item *temp = NULL;
+
+	if (__host_list_empty())
+		goto exit;
+
+	TAILQ_FOREACH_REVERSE(temp, &h->host_list, host_list, list) {
+		if (temp && (temp->msdu_id == msdu_id)) {
+			item = temp;
+			TAILQ_REMOVE(&h->host_list, item, list);
+			h->num_host_stat--;
+			goto exit;
+		}
+	}
+
+exit:
+	return item;
+}
+
+static inline struct ol_tx_stats_ring_item *__get_ring_item_comp(void)
+{
+	struct ol_tx_stats_ring_head *h = tx_stats_ring_head;
+	struct ol_tx_stats_ring_item *item = NULL;
+
+	if (__comp_list_empty())
+		goto exit;
+
+	item = TAILQ_LAST(&h->comp_list, comp_list);
+	TAILQ_REMOVE(&h->comp_list, item, list);
+	h->num_comp_stat--;
+
+exit:
+	return item;
+}
+
+static inline void __put_ring_item_host(struct ol_tx_stats_ring_item *item)
+{
+	struct ol_tx_stats_ring_head *h = tx_stats_ring_head;
+
+	TAILQ_INSERT_HEAD(&h->host_list, item, list);
+	h->num_host_stat++;
+}
+
+static inline void __put_ring_item_comp(struct ol_tx_stats_ring_item *item)
+{
+	struct ol_tx_stats_ring_head *h = tx_stats_ring_head;
+
+	TAILQ_INSERT_HEAD(&h->comp_list, item, list);
+	h->num_comp_stat++;
+}
+
+static inline void __free_ring_item(struct ol_tx_stats_ring_item *item)
+{
+	struct ol_tx_stats_ring_head *h = tx_stats_ring_head;
+
+	TAILQ_INSERT_HEAD(&h->free_list, item, list);
+	h->num_free++;
+}
+
+/**
+ * ol_tx_stats_ring_enque_host() - enqueue the tx stats fields of a packet
+ * collected from tx path of host driver
+ * @msdu_id: ol_tx_desc_id
+ * @chan_freq: channel freqency
+ * @bandwidth: channel bandwith like 10 or 20MHz
+ * @mac_address: mac address used
+ * @datarate: data rate used
+ *
+ * This interface is for caller from TXRX layer in interrupt context.
+ */
+void ol_tx_stats_ring_enque_host(uint32_t msdu_id, uint32_t chan_freq,
+				uint32_t bandwidth, uint8_t *mac_address,
+				uint8_t datarate)
+{
+	struct ol_tx_stats_ring_head *h = tx_stats_ring_head;
+	struct ol_tx_stats_ring_item *item;
+	static uint32_t seq_no = 0;
+
+	if (!h)
+		return;
+
+	adf_os_spin_lock(&h->mutex);
+
+	item = __get_ring_item();
+	if (!item)
+		goto exit;
+
+	item->msdu_id = msdu_id;
+	item->stats.seq_no = seq_no++;
+	item->stats.chan_freq = chan_freq;
+	item->stats.bandwidth = bandwidth;
+	vos_mem_copy(item->stats.mac_address, mac_address, 6);
+	item->stats.datarate = datarate;
+
+	__put_ring_item_host(item);
+
+exit:
+	adf_os_spin_unlock(&h->mutex);
+}
+
+/**
+ * ol_tx_stats_ring_enque_comp() - enqueue the tx power of a packet from FW
+ * to form a complete tx stats item, which can be delivered to user
+ * @msdu_id: ol_tx_desc_id
+ * @tx_power: tx power used from FW
+ *
+ * This interface is for caller from WMA layer context.
+ */
+void ol_tx_stats_ring_enque_comp(uint32_t msdu_id, uint32_t tx_power)
+{
+	struct ol_tx_stats_ring_head *h = tx_stats_ring_head;
+	struct ol_tx_stats_ring_item *item;
+
+	if (!h)
+		return;
+
+	adf_os_spin_lock(&h->mutex);
+
+	item = __get_ring_item_host(msdu_id);
+	if (!item)
+		goto exit;
+
+	item->stats.tx_power = (uint8_t)tx_power;
+	__put_ring_item_comp(item);
+
+exit:
+	adf_os_spin_unlock(&h->mutex);
+}
+
+/**
+ * ol_tx_stats_ring_deque() - dequeue a complete tx stats item to user
+ * @stats: tx per packet stats
+ *
+ * This interface is for caller from user space process context.
+ *
+ * Return: 1 if get a tx stats, 0 for no stats got
+ */
+int ol_tx_stats_ring_deque(struct ol_tx_per_pkt_stats *stats)
+{
+	struct ol_tx_stats_ring_head *h = tx_stats_ring_head;
+	struct ol_tx_stats_ring_item *item;
+	int ret = 0;
+
+	if (!h)
+		return ret;
+
+	adf_os_spin_lock(&h->mutex);
+
+	item = __get_ring_item_comp();
+	if (!item)
+		goto exit;
+
+	__free_ring_item(item);
+
+	vos_mem_copy(stats, &item->stats, sizeof(*stats));
+	item->msdu_id = INVALID_TX_MSDU_ID;
+	ret = 1;
+
+exit:
+	adf_os_spin_unlock(&h->mutex);
+	return ret;
+}
+#endif /* WLAN_FEATURE_DSRC */
+
+adf_nbuf_t
+ol_tx_hl_vdev_queue_tcp_ack_send_all(struct ol_txrx_vdev_t *vdev);
+
 #define ol_tx_prepare_ll(tx_desc, vdev, msdu, msdu_info) \
     do {                                                                      \
         struct ol_txrx_pdev_t *pdev = vdev->pdev;                             \
@@ -102,8 +440,10 @@ ol_tx_ll(ol_txrx_vdev_handle vdev, adf_nbuf_t msdu_list)
         msdu_info.htt.info.ext_tid = adf_nbuf_get_tid(msdu);
         msdu_info.peer = NULL;
 
-        adf_nbuf_map_single(adf_ctx, msdu,
+        if (!adf_nbuf_is_ipa_nbuf(msdu)) {
+            adf_nbuf_map_single(adf_ctx, msdu,
                              ADF_OS_DMA_TO_DEVICE);
+        }
         ol_tx_prepare_ll(tx_desc, vdev, msdu, &msdu_info);
 
         /*
@@ -208,7 +548,7 @@ ol_tx_vdev_ll_pause_queue_send_base(struct ol_txrx_vdev_t *vdev)
              */
             if (tx_msdu) {
                 adf_nbuf_unmap(vdev->pdev->osdev, tx_msdu, ADF_OS_DMA_TO_DEVICE);
-                adf_nbuf_tx_free(tx_msdu, 1 /* error */);
+                adf_nbuf_tx_free(tx_msdu, ADF_NBUF_PKT_ERROR);
             }
         }
     }
@@ -395,7 +735,7 @@ ol_tx_pdev_ll_pause_queue_send_all(struct ol_txrx_pdev_t *pdev)
                  */
                 if (tx_msdu) {
                     adf_nbuf_unmap(pdev->osdev, tx_msdu, ADF_OS_DMA_TO_DEVICE);
-                    adf_nbuf_tx_free(tx_msdu, 1 /* error */);
+                    adf_nbuf_tx_free(tx_msdu, ADF_NBUF_PKT_ERROR);
                 }
             }
             /*check if there are more msdus to transmit*/
@@ -598,11 +938,28 @@ static bool parse_ocb_tx_header(adf_nbuf_t msdu,
  * equivalent parameter in def_ctrl_hdr will be copied to tx_ctrl.
  */
 static void merge_ocb_tx_ctrl_hdr(struct ocb_tx_ctrl_hdr_t *tx_ctrl,
-				  struct ocb_tx_ctrl_hdr_t *def_ctrl_hdr)
+				  struct ocb_tx_ctrl_hdr_t *def_ctrl_hdr,
+				  uint32_t ocb_channel_count)
 {
-	if (!tx_ctrl || !def_ctrl_hdr)
+	int i;
+	struct ocb_tx_ctrl_hdr_t *temp;
+
+	if (!tx_ctrl || !def_ctrl_hdr || !ocb_channel_count)
 		return;
 
+	/*
+	 * Find default TX ctrl parameters based on channel frequence.
+	 * Up to two different channels are supported. Default TX ctrl
+	 * parameters are configured from ocb set configure command.
+	 */
+	temp = def_ctrl_hdr;
+	for (i = 0; i < ocb_channel_count; i++, temp++) {
+		if (temp->channel_freq == tx_ctrl->channel_freq) {
+			def_ctrl_hdr = temp;
+			break;
+		}
+	}
+
 	if (!tx_ctrl->channel_freq && def_ctrl_hdr->channel_freq)
 		tx_ctrl->channel_freq = def_ctrl_hdr->channel_freq;
 	if (!tx_ctrl->valid_pwr && def_ctrl_hdr->valid_pwr) {
@@ -632,6 +989,192 @@ static void merge_ocb_tx_ctrl_hdr(struct ocb_tx_ctrl_hdr_t *tx_ctrl,
 	}
 }
 
+#ifdef WLAN_FEATURE_DSRC
+/**
+ * dsrc_update_broadcast_frame_sa() - update source address of DSRC broadcast
+ * frame
+ * @vdev: virtual device handle corresponding to wlanocb0.
+ * @tx_ctrl: default TX control header.
+ * @msdu: MAC service data unit.
+ *
+ * For each channel of DSRC has its MAC address, which may be different from
+ * the MAC address of interface wlanocb0, so we need to update the source MAC
+ * address per channel.
+ */
+static void dsrc_update_broadcast_frame_sa(ol_txrx_vdev_handle vdev,
+					   struct ocb_tx_ctrl_hdr_t *tx_ctrl,
+					   adf_nbuf_t msdu)
+{
+	int i;
+	uint8_t *da;
+	uint8_t *sa;
+	struct ieee80211_frame *wh;
+	struct ether_header *eh;
+	struct ol_txrx_ocb_chan_info *chan_info;
+
+	chan_info = &vdev->ocb_channel_info[0];
+	for (i = 0; i < vdev->ocb_channel_count; i++) {
+		if (tx_ctrl->channel_freq ==
+		    vdev->ocb_channel_info[i].chan_freq) {
+			chan_info = &vdev->ocb_channel_info[i];
+			break;
+		}
+	}
+
+	if (tx_ctrl->valid_eth_mode) {
+		eh = (struct ether_header *)adf_nbuf_data(msdu);
+		da = eh->ether_dhost;
+		sa = eh->ether_shost;
+	} else {
+		wh = (struct ieee80211_frame *)adf_nbuf_data(msdu);
+		da = wh->i_addr1;
+		sa = wh->i_addr2;
+	}
+
+	if (vos_is_macaddr_broadcast((v_MACADDR_t *)da)) {
+		vos_mem_copy(sa, chan_info->mac_address,
+			     sizeof(chan_info->mac_address));
+	}
+}
+
+/* If the vdev is in OCB mode, collect per packet tx stats. */
+static inline void
+ol_collect_per_pkt_tx_stats(ol_txrx_vdev_handle vdev,
+			    struct ocb_tx_ctrl_hdr_t *tx_ctrl, uint32_t msdu_id)
+{
+	struct ol_txrx_ocb_chan_info *chan_info;
+	int i;
+
+	if (!ol_per_pkt_tx_stats_enabled())
+		return;
+
+	chan_info = &vdev->ocb_channel_info[0];
+	for (i = 0; i < vdev->ocb_channel_count; i++) {
+		if (tx_ctrl->channel_freq ==
+		    vdev->ocb_channel_info[i].chan_freq) {
+			chan_info = &vdev->ocb_channel_info[i];
+			break;
+		}
+	}
+
+	ol_tx_stats_ring_enque_host(msdu_id, tx_ctrl->channel_freq,
+				   chan_info->bandwidth, chan_info->mac_address,
+				   tx_ctrl->datarate);
+}
+
+static inline bool
+ol_tx_select_sch_for_ip_pkt(ol_txrx_vdev_handle vdev,
+			    struct ocb_tx_ctrl_hdr_t *tx_ctrl)
+{
+	struct ol_txrx_ocb_chan_info *chan_info = vdev->ocb_channel_info;
+	int i;
+
+	for (i = 0; i < vdev->ocb_channel_count; i++) {
+		if (chan_info[i].chan_freq != DOT11P_CONTROL_CHANNEL) {
+			tx_ctrl->channel_freq = chan_info[i].chan_freq;
+			return true;
+		}
+	}
+
+	return false;
+}
+#else
+static void dsrc_update_broadcast_frame_sa(ol_txrx_vdev_handle vdev,
+					   struct ocb_tx_ctrl_hdr_t *tx_ctrl,
+					   adf_nbuf_t msdu)
+{
+}
+
+static inline void
+ol_collect_per_pkt_tx_stats(ol_txrx_vdev_handle vdev,
+			    struct ocb_tx_ctrl_hdr_t *tx_ctrl, uint32_t msdu_id)
+{
+}
+
+static inline bool
+ol_tx_select_sch_for_ip_pkt(ol_txrx_vdev_handle vdev,
+			    struct ocb_tx_ctrl_hdr_t *tx_ctrl)
+{
+	return false;
+}
+#endif /* WLAN_FEATURE_DSRC */
+
+static void
+ol_tx_drop_list_add(adf_nbuf_t *list, adf_nbuf_t msdu, adf_nbuf_t *tail)
+{
+	adf_nbuf_set_next(msdu, NULL);
+	if (!*list)
+		*list = msdu;
+	else
+		adf_nbuf_set_next(*tail, msdu);
+
+	*tail = msdu;
+}
+
+/**
+ * ol_build_ieee80211_header() - Build IEEE80211 DATA header from 802.3
+ * @msdu: the msdu buffer to be transmitted.
+ *
+ * This function is used to convert MSDU packet from 802.3 Header to
+ * IEEE802.11 Header + EPD Header. Only used in 802.11p DSRC OCB RAW mode.
+ * EPD header is 2 bytes, indicates the ether_type, larger than 0x600.
+ * OCB configuration Command has already indicated current working mode.
+ */
+static A_STATUS ol_build_ieee80211_header(adf_nbuf_t msdu)
+{
+	int need_hdr_len;
+	uint16_t epd_hdr_type;
+	static uint16_t seq_num = 0;
+	struct ether_header *eth_hdr_p;
+	struct ieee80211_qosframe hdr;
+
+	eth_hdr_p = (struct ether_header *)adf_nbuf_data(msdu);
+	epd_hdr_type = eth_hdr_p->ether_type;
+
+	adf_os_mem_zero(&hdr, sizeof(struct ieee80211_qosframe));
+	hdr.i_fc[0] |= IEEE80211_FC0_VERSION_0 |
+		       IEEE80211_FC0_TYPE_DATA |
+		       IEEE80211_FC0_SUBTYPE_QOS;
+	adf_os_mem_copy(hdr.i_addr1, eth_hdr_p->ether_dhost,
+			IEEE80211_ADDR_LEN);
+	adf_os_mem_copy(hdr.i_addr2, eth_hdr_p->ether_shost,
+			IEEE80211_ADDR_LEN);
+	adf_os_mem_set(hdr.i_addr3, 0xff, IEEE80211_ADDR_LEN);
+
+	*(uint16_t *)hdr.i_seq = htole16(seq_num << IEEE80211_SEQ_SEQ_SHIFT);
+	seq_num++;
+
+	hdr.i_qos[0] |= adf_nbuf_get_tid(msdu);
+	if (IEEE80211_IS_MULTICAST(hdr.i_addr1))
+		hdr.i_qos[0] |= 1 << IEEE80211_QOS_ACKPOLICY_S;
+
+	need_hdr_len = sizeof(hdr) + sizeof(epd_hdr_type) -
+		       ETHER_HDR_LEN - adf_nbuf_headroom(msdu);
+
+	/*
+	 * So we need to modify the skb buffer header and hence need
+	 * a copy of that. For OCB data packets from network stack,
+	 * it is impossible happened here, in case of headroom is not
+	 * enough.
+	 */
+	if (need_hdr_len > 0 || adf_nbuf_is_cloned(msdu)) {
+		need_hdr_len += adf_nbuf_headroom(msdu);
+		if (adf_nbuf_expand(msdu, need_hdr_len, 0) == NULL) {
+			TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+				   "%s: buf expand fail\n", __func__);
+			return A_ERROR;
+		}
+	}
+
+	adf_nbuf_pull_head(msdu, ETHER_HDR_LEN);
+	adf_os_mem_copy(adf_nbuf_push_head(msdu, sizeof(epd_hdr_type)),
+			&epd_hdr_type, sizeof(epd_hdr_type));
+	adf_os_mem_copy(adf_nbuf_push_head(msdu, sizeof(hdr)),
+			&hdr, sizeof(hdr));
+
+	return A_OK;
+}
+
 static inline adf_nbuf_t
 ol_tx_hl_base(
     ol_txrx_vdev_handle vdev,
@@ -641,10 +1184,14 @@ ol_tx_hl_base(
 {
     struct ol_txrx_pdev_t *pdev = vdev->pdev;
     adf_nbuf_t msdu = msdu_list;
+    adf_nbuf_t msdu_drop_list = NULL;
+    adf_nbuf_t drop_tail = NULL;
     struct ol_txrx_msdu_info_t tx_msdu_info;
     struct ocb_tx_ctrl_hdr_t tx_ctrl;
 
     htt_pdev_handle htt_pdev = pdev->htt_pdev;
+    uint8_t rtap[MAX_RADIOTAP_LEN] = {0};
+    uint8_t rtap_len = 0;
     tx_msdu_info.peer = NULL;
 
     /*
@@ -659,7 +1206,7 @@ ol_tx_hl_base(
         struct ol_tx_desc_t *tx_desc = NULL;
 
         adf_os_mem_zero(&tx_ctrl, sizeof(tx_ctrl));
-
+        tx_msdu_info.peer = NULL;
         /*
          * The netbuf will get stored into a (peer-TID) tx queue list
          * inside the ol_tx_classify_store function or else dropped,
@@ -667,6 +1214,25 @@ ol_tx_hl_base(
          */
         next = adf_nbuf_next(msdu);
 
+        /*
+         * copy radiotap header out first.
+         */
+        if (VOS_MONITOR_MODE == vos_get_conparam()) {
+            struct ieee80211_radiotap_header *rthdr;
+            rthdr = (struct ieee80211_radiotap_header *)(adf_nbuf_data(msdu));
+            rtap_len = rthdr->it_len;
+            if (rtap_len > MAX_RADIOTAP_LEN) {
+                TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+                           "radiotap length exceeds %d, drop it!\n",
+                           MAX_RADIOTAP_LEN);
+                ol_tx_drop_list_add(&msdu_drop_list, msdu, &drop_tail);
+                msdu = next;
+                continue;
+            }
+            adf_os_mem_copy(rtap, rthdr, rtap_len);
+            adf_nbuf_pull_head(msdu, rtap_len);
+        }
+
 #if defined(CONFIG_TX_DESC_HI_PRIO_RESERVE)
         if (adf_os_atomic_read(&pdev->tx_queue.rsrc_cnt) >
                                         TXRX_HL_TX_DESC_HI_PRIO_RESERVED) {
@@ -685,9 +1251,16 @@ ol_tx_hl_base(
              * tx descs for the remaining MSDUs.
              */
             TXRX_STATS_MSDU_LIST_INCR(pdev, tx.dropped.host_reject, msdu);
-            return msdu; /* the list of unaccepted MSDUs */
+            if (!msdu_drop_list)
+                msdu_drop_list = msdu;
+            else
+                adf_nbuf_set_next(drop_tail, msdu);
+            return msdu_drop_list; /* the list of unaccepted MSDUs */
         }
 
+        tx_desc->rtap_len = rtap_len;
+        adf_os_mem_copy(tx_desc->rtap, rtap, rtap_len);
+
 //        OL_TXRX_PROT_AN_LOG(pdev->prot_an_tx_sent, msdu);
 
         if (tx_spec != ol_tx_spec_std) {
@@ -722,14 +1295,54 @@ ol_tx_hl_base(
 
             if (!parse_ocb_tx_header(msdu, &tx_ctrl, &tx_ctrl_header_found)) {
                 /* There was an error parsing the header. Skip this packet. */
-                goto MSDU_LOOP_BOTTOM;
+                ol_tx_drop_list_add(&msdu_drop_list, msdu, &drop_tail);
+                goto free_tx_desc;
+            }
+            /*
+             * For dsrc tx frame, the TX control header MUST be provided by
+             * dsrc app, merge the saved defaults into it.
+             * The non-dsrc(like IPv6 frames etc.) tx frame has no tx_ctrl_hdr,
+             * and we distingush dsrc and non-dsrc tx frame only by whether
+             * tx_ctrl_hdr is found in the frame.
+             * So, if there has no tx_ctrl_hdr from dsrc app, then there will
+             * has no tx_ctrl_hdr added to send down to FW.
+             */
+            if (tx_ctrl_header_found && vdev->ocb_def_tx_param)
+                merge_ocb_tx_ctrl_hdr(&tx_ctrl, vdev->ocb_def_tx_param,
+                                      vdev->ocb_channel_count);
+
+            /*
+             * Check OCB Broadcast frame Source address.
+             * Per OCB channel, it includes a default MAC address
+             * for broadcast DSRC frame in this channel.
+             */
+            if (tx_ctrl_header_found) {
+                dsrc_update_broadcast_frame_sa(vdev, &tx_ctrl, msdu);
+
+                /* only collect dsrc tx packet stats.*/
+                ol_collect_per_pkt_tx_stats(vdev, &tx_ctrl, tx_desc->id);
+            } else {
+                /*
+                 * TX ctrl header is filled by specific operation.
+                 * Packets from network stack have no ctrl header.
+                 * Only convert the packet from network stack.
+                 */
+                 if (vdev->ocb_config_flags & OCB_CONFIG_FLAG_80211_FRAME_MODE) {
+                     A_STATUS status = ol_build_ieee80211_header(msdu);
+                     if (A_FAILED(status))
+                         goto free_tx_desc;
+                 }
+
+                /*
+                 * IEEE 1609.4-2016 5.3.4 mandates that IP datagrams can
+                 * transmit only on SCH (Service Channel) and can't goes on CCH.
+                 * If SCH not exists, then drop the IP datagram.
+                 */
+                if (!ol_tx_select_sch_for_ip_pkt(vdev, &tx_ctrl)) {
+                    ol_tx_drop_list_add(&msdu_drop_list, msdu, &drop_tail);
+                    goto free_tx_desc;
+                }
             }
-            /* If the TX control header was not found, just use the defaults */
-            if (!tx_ctrl_header_found && vdev->ocb_def_tx_param)
-                vos_mem_copy(&tx_ctrl, vdev->ocb_def_tx_param, sizeof(tx_ctrl));
-            /* If the TX control header was found, merge the defaults into it */
-            else if (tx_ctrl_header_found && vdev->ocb_def_tx_param)
-                merge_ocb_tx_ctrl_hdr(&tx_ctrl, vdev->ocb_def_tx_param);
         }
 
         txq = ol_tx_classify(vdev, tx_desc, msdu, &tx_msdu_info);
@@ -743,7 +1356,8 @@ ol_tx_hl_base(
                 /* remove the peer reference added above */
                 ol_txrx_peer_unref_delete(tx_msdu_info.peer);
             }
-            goto MSDU_LOOP_BOTTOM;
+            msdu = next;
+            continue;
         }
 
         if(tx_msdu_info.peer) {
@@ -796,20 +1410,35 @@ ol_tx_hl_base(
          */
         htt_tx_desc_display(tx_desc->htt_tx_desc);
 
+        /* push radiotap as extra frag */
+        if (VOS_MONITOR_MODE == vos_get_conparam()) {
+            adf_nbuf_frag_push_head(
+                    msdu,
+                    tx_desc->rtap_len,
+                    (uint8_t *)tx_desc->rtap, /* virtual addr */
+                    0, 0 /* phys addr MSBs - n/a */);
+                    adf_nbuf_set_frag_is_wordstream(msdu, 1, 1);
+        }
+
         ol_tx_enqueue(pdev, txq, tx_desc, &tx_msdu_info);
         if (tx_msdu_info.peer) {
             OL_TX_PEER_STATS_UPDATE(tx_msdu_info.peer, msdu);
             /* remove the peer reference added above */
             ol_txrx_peer_unref_delete(tx_msdu_info.peer);
         }
-MSDU_LOOP_BOTTOM:
+        msdu = next;
+        continue;
+
+free_tx_desc:
+        adf_os_atomic_inc(&pdev->tx_queue.rsrc_cnt);
+        ol_tx_desc_free(pdev, tx_desc);
         msdu = next;
     }
 
     if (call_sched == true)
         ol_tx_sched(pdev);
 
-    return NULL; /* all MSDUs were accepted */
+    return msdu_drop_list; /* all MSDUs were accepted */
 }
 
 /**
@@ -837,6 +1466,470 @@ ol_txrx_vdev_handle ol_txrx_get_vdev_from_vdev_id(uint8_t vdev_id)
 	return vdev;
 }
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+
+/**
+ * ol_tx_pdev_reset_driver_del_ack() - reset driver delayed ack enabled flag
+ * @pdev_handle: pdev handle
+ *
+ * Return: none
+ */
+void
+ol_tx_pdev_reset_driver_del_ack(void *pdev_handle)
+{
+	struct ol_txrx_pdev_t *pdev = (struct ol_txrx_pdev_t *)pdev_handle;
+	struct ol_txrx_vdev_t *vdev;
+
+	TAILQ_FOREACH(vdev, &pdev->vdev_list, vdev_list_elem) {
+		vdev->driver_del_ack_enabled = false;
+		TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
+			"vdev_id %d driver_del_ack_enabled %d\n",
+			vdev->vdev_id, vdev->driver_del_ack_enabled);
+	}
+}
+
+/**
+ * ol_tx_vdev_set_driver_del_ack_enable() - set driver delayed ack enabled flag
+ * @vdev_id: vdev id
+ * @rx_packets: number of rx packets
+ * @time_in_ms: time in ms
+ * @high_th: high threashold
+ * @low_th: low threashold
+ *
+ * Return: none
+ */
+void
+ol_tx_vdev_set_driver_del_ack_enable(uint8_t vdev_id, unsigned long rx_packets,
+			uint32_t time_in_ms, uint32_t high_th, uint32_t low_th)
+{
+	struct ol_txrx_vdev_t *vdev = ol_txrx_get_vdev_from_vdev_id(vdev_id);
+	bool old_driver_del_ack_enabled;
+
+	if ((!vdev) || (low_th > high_th))
+		return;
+
+	old_driver_del_ack_enabled = vdev->driver_del_ack_enabled;
+	if (rx_packets > high_th)
+		vdev->driver_del_ack_enabled = true;
+	else if (rx_packets < low_th)
+		vdev->driver_del_ack_enabled = false;
+
+	if (old_driver_del_ack_enabled != vdev->driver_del_ack_enabled) {
+		TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
+			"vdev_id %d driver_del_ack_enabled %d rx_packets %ld"
+			" time_in_ms %d high_th %d low_th %d\n",
+			vdev->vdev_id, vdev->driver_del_ack_enabled,
+			rx_packets, time_in_ms, high_th, low_th);
+	}
+}
+
+/**
+ * ol_tx_hl_send_all_tcp_ack() - send all queued tcp ack packets
+ * @vdev: vdev handle
+ *
+ * Return: none
+ */
+void ol_tx_hl_send_all_tcp_ack(struct ol_txrx_vdev_t *vdev)
+{
+	int i = 0;
+	struct tcp_stream_node *tcp_node_list = NULL;
+	struct tcp_stream_node *temp = NULL;
+
+	for (i = 0; i < OL_TX_HL_DEL_ACK_HASH_SIZE; i++) {
+		tcp_node_list = NULL;
+		adf_os_spin_lock_bh(&vdev->tcp_ack_hash.node[i].hash_node_lock);
+		if (vdev->tcp_ack_hash.node[i].no_of_entries)
+			tcp_node_list = vdev->tcp_ack_hash.node[i].head;
+
+		vdev->tcp_ack_hash.node[i].no_of_entries = 0;
+		vdev->tcp_ack_hash.node[i].head = NULL;
+		adf_os_spin_unlock_bh(&vdev->tcp_ack_hash.node[i].hash_node_lock);
+
+		/* Send all packets */
+		while (tcp_node_list) {
+			int tx_comp_req = vdev->pdev->cfg.default_tx_comp_req;
+			adf_nbuf_t msdu_list = NULL;
+
+			temp = tcp_node_list;
+			tcp_node_list = temp->next;
+
+			msdu_list = ol_tx_hl_base(vdev, ol_tx_spec_std,
+					temp->head, tx_comp_req, false);
+			if (msdu_list)
+				adf_nbuf_tx_free(msdu_list, 1/*error*/);
+			ol_txrx_vdev_free_tcp_node(vdev, temp);
+		}
+	}
+	ol_tx_sched(vdev->pdev);
+}
+
+/**
+ * tcp_del_ack_tasklet() - tasklet function to send ack packets
+ * @data: vdev handle
+ *
+ * Return: none
+ */
+void tcp_del_ack_tasklet(unsigned long data)
+{
+	struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)data;
+
+	ol_tx_hl_send_all_tcp_ack(vdev);
+}
+
+/**
+ * ol_tx_get_stream_id() - get stream_id from packet info
+ * @info: packet info
+ *
+ * Return: stream_id
+ */
+uint16_t ol_tx_get_stream_id(struct packet_info *info)
+{
+	return ((info->dst_port + info->dst_ip + info->src_port + info->src_ip)
+					 & (OL_TX_HL_DEL_ACK_HASH_SIZE - 1));
+}
+
+/**
+ * ol_tx_get_packet_info() - update packet info for passed msdu
+ * @msdu: packet
+ * @info: packet info
+ *
+ * Return: none
+ */
+void ol_tx_get_packet_info(adf_nbuf_t msdu, struct packet_info *info)
+{
+	uint16_t ether_type;
+	uint8_t  protocol;
+	uint8_t  flag, header_len;
+	uint32_t seg_len;
+	uint8_t  *skb_data;
+	uint32_t skb_len;
+
+	info->type = NO_TCP_PKT;
+
+	adf_nbuf_peek_header(msdu, &skb_data, &skb_len);
+	if (skb_len < ADF_NBUF_TRAC_TCP_FLAGS_OFFSET)
+		return;
+
+	ether_type = (v_U16_t)(*(v_U16_t *)
+			(skb_data + ADF_NBUF_TRAC_ETH_TYPE_OFFSET));
+	protocol = (v_U16_t)(*(v_U16_t *)
+			(skb_data + ADF_NBUF_TRAC_IPV4_PROTO_TYPE_OFFSET));
+
+	if ((ADF_NBUF_TRAC_IPV4_ETH_TYPE == VOS_SWAP_U16(ether_type)) &&
+		(protocol == ADF_NBUF_TRAC_TCP_TYPE)) {
+		header_len = ((v_U8_t)(*(v_U8_t *)
+			(skb_data + ADF_NBUF_TRAC_TCP_HEADER_LEN_OFFSET))) >> 2;
+		seg_len = skb_len - header_len - 34;
+		flag = (v_U8_t)(*(v_U8_t *)
+			(skb_data + ADF_NBUF_TRAC_TCP_FLAGS_OFFSET));
+
+		info->src_ip = VOS_SWAP_U32((v_U32_t)(*(v_U32_t *)
+			(skb_data + ADF_NBUF_TRAC_IPV4_SRC_ADDR_OFFSET)));
+		info->dst_ip = VOS_SWAP_U32((v_U32_t)(*(v_U32_t *)
+			(skb_data + ADF_NBUF_TRAC_IPV4_DEST_ADDR_OFFSET)));
+		info->src_port = VOS_SWAP_U16((v_U16_t)(*(v_U16_t *)
+				(skb_data + ADF_NBUF_TRAC_TCP_SPORT_OFFSET)));
+		info->dst_port = VOS_SWAP_U16((v_U16_t)(*(v_U16_t *)
+				(skb_data + ADF_NBUF_TRAC_TCP_DPORT_OFFSET)));
+		info->stream_id = ol_tx_get_stream_id(info);
+
+		if ((flag == ADF_NBUF_TRAC_TCP_ACK_MASK) && (seg_len == 0)) {
+			info->type = TCP_PKT_ACK;
+			info->ack_number = (v_U32_t)(*(v_U32_t *)
+				(skb_data + ADF_NBUF_TRAC_TCP_ACK_OFFSET));
+			info->ack_number = VOS_SWAP_U32(info->ack_number);
+		} else {
+			info->type = TCP_PKT_NO_ACK;
+		}
+	}
+
+}
+
+/**
+ * ol_tx_hl_find_and_send_tcp_stream() - find and send tcp stream for passed
+ *                                       stream info
+ * @vdev: vdev handle
+ * @info: packet info
+ *
+ * Return: none
+ */
+void ol_tx_hl_find_and_send_tcp_stream(struct ol_txrx_vdev_t *vdev,
+			struct packet_info *info)
+{
+	uint8_t no_of_entries;
+	struct tcp_stream_node *node_to_be_remove = NULL;
+
+	/* remove tcp node from hash */
+	adf_os_spin_lock_bh(&vdev->tcp_ack_hash.node[info->stream_id].hash_node_lock);
+
+	no_of_entries = vdev->tcp_ack_hash.node[info->stream_id].no_of_entries;
+	if (no_of_entries > 1) {
+		/* collision case */
+		struct tcp_stream_node *head =
+			vdev->tcp_ack_hash.node[info->stream_id].head;
+		struct tcp_stream_node *temp;
+
+		if ((head->dst_ip == info->dst_ip) &&
+		    (head->src_ip == info->src_ip) &&
+		    (head->src_port == info->src_port) &&
+		    (head->dst_port == info->dst_port)) {
+			node_to_be_remove = head;
+			vdev->tcp_ack_hash.node[info->stream_id].head = head->next;
+			vdev->tcp_ack_hash.node[info->stream_id].no_of_entries--;
+		} else {
+			temp = head;
+			while (temp->next) {
+				if ((temp->next->dst_ip == info->dst_ip) &&
+				    (temp->next->src_ip == info->src_ip) &&
+				    (temp->next->src_port == info->src_port) &&
+				    (temp->next->dst_port == info->dst_port)) {
+					node_to_be_remove = temp->next;
+					temp->next = temp->next->next;
+					vdev->tcp_ack_hash.node[info->stream_id].no_of_entries--;
+					break;
+				}
+				temp = temp->next;
+			}
+		}
+	} else if (no_of_entries == 1) {
+		/* Only one tcp_node */
+		node_to_be_remove =
+			 vdev->tcp_ack_hash.node[info->stream_id].head;
+		vdev->tcp_ack_hash.node[info->stream_id].head = NULL;
+		vdev->tcp_ack_hash.node[info->stream_id].no_of_entries = 0;
+	}
+	adf_os_spin_unlock_bh(&vdev->tcp_ack_hash.node[info->stream_id].hash_node_lock);
+
+	/* send packets */
+	if (node_to_be_remove) {
+		int tx_comp_req = vdev->pdev->cfg.default_tx_comp_req;
+		adf_nbuf_t msdu_list = NULL;
+
+		msdu_list = ol_tx_hl_base(vdev, ol_tx_spec_std,
+			node_to_be_remove->head, tx_comp_req, true);
+		if (msdu_list)
+			adf_nbuf_tx_free(msdu_list, 1/*error*/);
+		ol_txrx_vdev_free_tcp_node(vdev, node_to_be_remove);
+	}
+}
+
+static struct tcp_stream_node *
+ol_tx_hl_replace_tcp_ack(struct ol_txrx_vdev_t *vdev, adf_nbuf_t msdu,
+			 struct packet_info *info, uint8_t *is_found,
+			 uint8_t *start_timer)
+{
+	struct tcp_stream_node *node_to_be_remove = NULL;
+	struct tcp_stream_node *head =
+		 vdev->tcp_ack_hash.node[info->stream_id].head;
+	struct tcp_stream_node *temp;
+
+	if ((head->dst_ip == info->dst_ip) &&
+	    (head->src_ip == info->src_ip) &&
+	    (head->src_port == info->src_port) &&
+	    (head->dst_port == info->dst_port)) {
+
+		*is_found = 1;
+		if ((head->ack_number < info->ack_number) &&
+		    (head->no_of_ack_replaced <
+		    ol_cfg_get_del_ack_count_value(vdev->pdev->ctrl_pdev))) {
+			/* replace ack packet */
+			adf_nbuf_tx_free(head->head, 1);
+			head->head = msdu;
+			head->ack_number = info->ack_number;
+			head->no_of_ack_replaced++;
+			*start_timer = 1;
+			if (head->no_of_ack_replaced ==
+			    ol_cfg_get_del_ack_count_value(vdev->pdev->ctrl_pdev)) {
+				node_to_be_remove = head;
+				vdev->tcp_ack_hash.node[info->stream_id].head = head->next;
+				vdev->tcp_ack_hash.node[info->stream_id].no_of_entries--;
+			}
+		} else {
+			/* append and send packets */
+			head->head->next = msdu;
+			node_to_be_remove = head;
+			vdev->tcp_ack_hash.node[info->stream_id].head = head->next;
+			vdev->tcp_ack_hash.node[info->stream_id].no_of_entries--;
+		}
+	} else {
+		temp = head;
+		while (temp->next) {
+			if ((temp->next->dst_ip == info->dst_ip) &&
+			    (temp->next->src_ip == info->src_ip) &&
+			    (temp->next->src_port == info->src_port) &&
+			    (temp->next->dst_port == info->dst_port)) {
+
+				*is_found = 1;
+				if ((temp->next->ack_number <
+					info->ack_number) &&
+				    (temp->next->no_of_ack_replaced <
+					 ol_cfg_get_del_ack_count_value(vdev->pdev->ctrl_pdev))) {
+					/* replace ack packet */
+					adf_nbuf_tx_free(temp->next->head, 1);
+					temp->next->head  = msdu;
+					temp->next->ack_number = info->ack_number;
+					temp->next->no_of_ack_replaced++;
+					*start_timer = 1;
+					if (temp->next->no_of_ack_replaced ==
+					   ol_cfg_get_del_ack_count_value(vdev->pdev->ctrl_pdev)) {
+						node_to_be_remove = temp->next;
+						temp->next = temp->next->next;
+						vdev->tcp_ack_hash.node[info->stream_id].no_of_entries--;
+					}
+				} else {
+					/* append and send packets */
+					temp->next->head->next = msdu;
+					node_to_be_remove = temp->next;
+					temp->next = temp->next->next;
+					vdev->tcp_ack_hash.node[info->stream_id].no_of_entries--;
+				}
+				break;
+			}
+			temp = temp->next;
+		}
+	}
+	return node_to_be_remove;
+}
+
+/**
+ * ol_tx_hl_find_and_replace_tcp_ack() - find and replace tcp ack packet for
+ *                                       passed packet info
+ * @vdev: vdev handle
+ * @msdu: packet
+ * @info: packet info
+ *
+ * Return: none
+ */
+void ol_tx_hl_find_and_replace_tcp_ack(struct ol_txrx_vdev_t *vdev,
+					adf_nbuf_t msdu,
+					struct packet_info *info)
+{
+	uint8_t no_of_entries;
+	struct tcp_stream_node *node_to_be_remove = NULL;
+	uint8_t is_found = 0, start_timer = 0;
+
+	/* replace ack if required or send packets */
+	adf_os_spin_lock_bh(&vdev->tcp_ack_hash.node[info->stream_id].hash_node_lock);
+
+	no_of_entries = vdev->tcp_ack_hash.node[info->stream_id].no_of_entries;
+	if (no_of_entries > 0) {
+		node_to_be_remove = ol_tx_hl_replace_tcp_ack(vdev, msdu, info,
+					&is_found, &start_timer);
+	}
+
+	if (no_of_entries == 0 || is_found == 0) {
+		/* Alloc new tcp node */
+		struct tcp_stream_node *new_node;
+
+		new_node = ol_txrx_vdev_alloc_tcp_node(vdev);
+		if (!new_node) {
+			adf_os_spin_unlock_bh(&vdev->tcp_ack_hash.node[info->stream_id].hash_node_lock);
+			TXRX_PRINT(TXRX_PRINT_LEVEL_FATAL_ERR, "Malloc failed");
+			return;
+		}
+		new_node->stream_id = info->stream_id;
+		new_node->dst_ip = info->dst_ip;
+		new_node->src_ip = info->src_ip;
+		new_node->dst_port = info->dst_port;
+		new_node->src_port = info->src_port;
+		new_node->ack_number = info->ack_number;
+		new_node->head = msdu;
+		new_node->next = NULL;
+		new_node->no_of_ack_replaced = 0;
+
+		start_timer = 1;
+		/* insert new_node */
+		if (!vdev->tcp_ack_hash.node[info->stream_id].head) {
+			vdev->tcp_ack_hash.node[info->stream_id].head = new_node;
+			vdev->tcp_ack_hash.node[info->stream_id].no_of_entries = 1;
+		} else {
+			struct tcp_stream_node *temp =
+				 vdev->tcp_ack_hash.node[info->stream_id].head;
+			while (temp->next) {
+				temp = temp->next;
+			}
+			temp->next = new_node;
+			vdev->tcp_ack_hash.node[info->stream_id].no_of_entries++;
+		}
+	}
+	adf_os_spin_unlock_bh(&vdev->tcp_ack_hash.node[info->stream_id].hash_node_lock);
+
+	/* start timer */
+	if (start_timer &&
+	    (!adf_os_atomic_read(&vdev->tcp_ack_hash.is_timer_running))) {
+		adf_os_hrtimer_start(&vdev->tcp_ack_hash.timer,
+			(ol_cfg_get_del_ack_timer_value(vdev->pdev->ctrl_pdev)*1000000));
+		adf_os_atomic_set(&vdev->tcp_ack_hash.is_timer_running, 1);
+	}
+
+	/* send packets */
+	if (node_to_be_remove) {
+		int tx_comp_req = vdev->pdev->cfg.default_tx_comp_req;
+		adf_nbuf_t msdu_list = NULL;
+
+		msdu_list = ol_tx_hl_base(vdev, ol_tx_spec_std,
+			node_to_be_remove->head, tx_comp_req, true);
+		if (msdu_list)
+			adf_nbuf_tx_free(msdu_list, 1/*error*/);
+		ol_txrx_vdev_free_tcp_node(vdev, node_to_be_remove);
+	}
+}
+
+/**
+ * ol_tx_hl_vdev_tcp_del_ack_timer() - delayed ack timer function
+ * @timer: timer handle
+ *
+ * Return: enum
+ */
+adf_os_enum_hrtimer_t
+ol_tx_hl_vdev_tcp_del_ack_timer(adf_os_hrtimer_t *timer)
+{
+	struct ol_txrx_vdev_t *vdev = container_of(timer, struct ol_txrx_vdev_t,
+							tcp_ack_hash.timer);
+
+	adf_os_enum_hrtimer_t ret = ADF_OS_HRTIMER_NORESTART;
+	adf_os_sched_bh(vdev->pdev->osdev, &vdev->tcp_ack_hash.tcp_del_ack_tq);
+	adf_os_atomic_set(&vdev->tcp_ack_hash.is_timer_running, 0);
+	return ret;
+}
+
+/**
+ * ol_tx_hl_del_ack_queue_flush_all() - drop all queued packets
+ * @vdev: vdev handle
+ *
+ * Return: none
+ */
+void ol_tx_hl_del_ack_queue_flush_all(struct ol_txrx_vdev_t *vdev)
+{
+	int i = 0;
+	struct tcp_stream_node *tcp_node_list = NULL;
+	struct tcp_stream_node *temp = NULL;
+
+	adf_os_hrtimer_cancel(&vdev->tcp_ack_hash.timer);
+	for (i = 0; i < OL_TX_HL_DEL_ACK_HASH_SIZE; i++) {
+		tcp_node_list = NULL;
+		adf_os_spin_lock_bh(&vdev->tcp_ack_hash.node[i].hash_node_lock);
+
+		if (vdev->tcp_ack_hash.node[i].no_of_entries)
+			tcp_node_list = vdev->tcp_ack_hash.node[i].head;
+
+		vdev->tcp_ack_hash.node[i].no_of_entries = 0;
+		vdev->tcp_ack_hash.node[i].head = NULL;
+		adf_os_spin_unlock_bh(&vdev->tcp_ack_hash.node[i].hash_node_lock);
+
+		/* free all packets */
+		while (tcp_node_list) {
+			temp = tcp_node_list;
+			tcp_node_list = temp->next;
+
+			adf_nbuf_tx_free(temp->head, 1/*error*/);
+			ol_txrx_vdev_free_tcp_node(vdev, temp);
+		}
+	}
+	ol_txrx_vdev_deinit_tcp_del_ack(vdev);
+}
+#endif
+
 #ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
 /**
  * ol_tx_pdev_reset_bundle_require() - reset bundle require flag
@@ -1025,6 +2118,48 @@ ol_tx_hl_vdev_bundle_timer(void *vdev)
  *
  * Return: NULL for success/drop msdu list
  */
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+adf_nbuf_t
+ol_tx_hl_queue(struct ol_txrx_vdev_t *vdev, adf_nbuf_t msdu_list)
+{
+	struct ol_txrx_pdev_t *pdev = vdev->pdev;
+	int tx_comp_req = pdev->cfg.default_tx_comp_req;
+	struct packet_info pkt_info;
+
+	/* TCP ACK packet*/
+	if (ol_cfg_get_del_ack_enable_value(vdev->pdev->ctrl_pdev) &&
+		vdev->driver_del_ack_enabled) {
+
+		ol_tx_get_packet_info(msdu_list, &pkt_info);
+		if (pkt_info.type == TCP_PKT_ACK) {
+			ol_tx_hl_find_and_replace_tcp_ack(vdev, msdu_list, &pkt_info);
+			return NULL;
+		}
+	} else {
+		if (adf_os_atomic_read(&vdev->tcp_ack_hash.tcp_node_in_use_count))
+			ol_tx_hl_send_all_tcp_ack(vdev);
+	}
+
+	if (vdev->bundling_reqired == true &&
+		(ol_cfg_get_bundle_size(vdev->pdev->ctrl_pdev) > 1)) {
+		ol_tx_hl_vdev_queue_append(vdev, msdu_list);
+		if (pdev->total_bundle_queue_length >=
+			ol_cfg_get_bundle_size(vdev->pdev->ctrl_pdev)) {
+			return ol_tx_hl_pdev_queue_send_all(pdev);
+		}
+	} else {
+		if (vdev->bundle_queue.txq.depth != 0) {
+			ol_tx_hl_vdev_queue_append(vdev, msdu_list);
+			return ol_tx_hl_vdev_queue_send_all(vdev, true);
+		} else {
+			return ol_tx_hl_base(vdev, ol_tx_spec_std, msdu_list,
+							 tx_comp_req, true);
+		}
+	}
+
+	return NULL; /* all msdus were accepted */
+}
+#else
 adf_nbuf_t
 ol_tx_hl_queue(struct ol_txrx_vdev_t* vdev, adf_nbuf_t msdu_list)
 {
@@ -1050,17 +2185,57 @@ ol_tx_hl_queue(struct ol_txrx_vdev_t* vdev, adf_nbuf_t msdu_list)
 
 	return NULL; /* all msdus were accepted */
 }
+#endif
 
 #endif
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
 adf_nbuf_t
 ol_tx_hl(ol_txrx_vdev_handle vdev, adf_nbuf_t msdu_list)
 {
-    struct ol_txrx_pdev_t *pdev = vdev->pdev;
-    int tx_comp_req = pdev->cfg.default_tx_comp_req;
+	struct ol_txrx_pdev_t *pdev = vdev->pdev;
+	int tx_comp_req = pdev->cfg.default_tx_comp_req;
+	struct packet_info pkt_info;
+	adf_nbuf_t temp;
+
+	/* check Enable through ini */
+	if (!ol_cfg_get_del_ack_enable_value(vdev->pdev->ctrl_pdev)
+		|| (!vdev->driver_del_ack_enabled)) {
+
+		if (adf_os_atomic_read(&vdev->tcp_ack_hash.tcp_node_in_use_count))
+			ol_tx_hl_send_all_tcp_ack(vdev);
 
-    return ol_tx_hl_base(vdev, ol_tx_spec_std, msdu_list, tx_comp_req, true);
+		return ol_tx_hl_base(vdev, ol_tx_spec_std, msdu_list,
+							 tx_comp_req, true);
+	}
+
+	ol_tx_get_packet_info(msdu_list, &pkt_info);
+
+	if (pkt_info.type == TCP_PKT_NO_ACK) {
+		ol_tx_hl_find_and_send_tcp_stream(vdev, &pkt_info);
+		temp = ol_tx_hl_base(vdev, ol_tx_spec_std, msdu_list,
+							 tx_comp_req, true);
+		return temp;
+	} else if (pkt_info.type == TCP_PKT_ACK) {
+		ol_tx_hl_find_and_replace_tcp_ack(vdev, msdu_list, &pkt_info);
+		return NULL;
+	} else {
+		temp = ol_tx_hl_base(vdev, ol_tx_spec_std, msdu_list,
+							 tx_comp_req, true);
+		return temp;
+	}
 }
+#else
+adf_nbuf_t
+ol_tx_hl(ol_txrx_vdev_handle vdev, adf_nbuf_t msdu_list)
+{
+	struct ol_txrx_pdev_t *pdev = vdev->pdev;
+	int tx_comp_req = pdev->cfg.default_tx_comp_req;
+
+	return ol_tx_hl_base(vdev, ol_tx_spec_std, msdu_list,
+						 tx_comp_req, true);
+}
+#endif
 
 adf_nbuf_t
 ol_tx_non_std_hl(
@@ -1284,3 +2459,35 @@ adf_nbuf_t ol_tx_reinject(
 
     return NULL;
 }
+
+#ifdef MAC_NOTIFICATION_FEATURE
+/**
+ * ol_tx_failure_cb_set() - add TX failure callback
+ * @pdev: PDEV TXRX handle
+ * @tx_failure_cb: TX failure callback
+ */
+void
+ol_tx_failure_cb_set(struct ol_txrx_pdev_t *pdev,
+		     void (*tx_failure_cb)(void *ctx,
+					   unsigned int num_msdu,
+					   unsigned char tid,
+					   unsigned int status))
+{
+	pdev->tx_failure_cb = tx_failure_cb;
+}
+
+/**
+ * ol_tx_failure_indication() - indicate TX failure to user layer
+ * @pdev: Pdev TXRX handle
+ * @tid: TID
+ * @msdu_num: number of MSDUs with the same failure status
+ * @status: failure status
+ */
+void
+ol_tx_failure_indication(struct ol_txrx_pdev_t *pdev, uint8_t tid,
+			 uint32_t msdu_num, uint32_t status)
+{
+	if (pdev->tx_failure_cb && (status != htt_tx_status_ok))
+		pdev->tx_failure_cb(pdev, msdu_num, tid, status);
+}
+#endif
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx.h
index 4b0280cfcfb..986efea00ba 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014,2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -37,16 +37,98 @@
 #include <ol_txrx_api.h> /* ol_txrx_vdev_handle */
 #include <ol_txrx_types.h>  /* ol_tx_desc_t, ol_txrx_msdu_info_t */
 
+/**
+ * struct ol_tx_per_pkt_stats - tx stats info of each packet sent out
+ * @seq_no: sequential number
+ * @chan_freq: channel freqency that this packet used
+ * @bandwidth: channel bandwidth
+ * @datarate: data rate
+ * @tx_power: tx power
+ * @mac_address: source MAC address that this packet used
+ */
+struct ol_tx_per_pkt_stats {
+	uint32_t seq_no;
+	uint32_t chan_freq;
+	uint32_t bandwidth;
+	uint8_t datarate;
+	uint8_t tx_power;
+	uint8_t mac_address[6];
+};
+
+#ifdef WLAN_FEATURE_DSRC
+void
+ol_per_pkt_tx_stats_enable(bool enable);
+
+bool
+ol_per_pkt_tx_stats_enabled(void);
+
+void
+ol_tx_stats_ring_enque_host(uint32_t msdu_id, uint32_t chan_freq,
+			   uint32_t bandwidth, uint8_t *mac_address,
+			   uint8_t datarate);
+
+void
+ol_tx_stats_ring_enque_comp(uint32_t msdu_id, uint32_t tx_power);
+
+int
+ol_tx_stats_ring_deque(struct ol_tx_per_pkt_stats *stats);
+#else
+static inline void
+ol_per_pkt_tx_stats_enable(bool enable)
+{
+}
+
+static inline bool
+ol_per_pkt_tx_stats_enabled(void)
+{
+	return false;
+}
+
+static inline void
+ol_tx_stats_ring_enque_host(uint32_t msdu_id, uint32_t chan_freq,
+			   uint32_t bandwidth, uint8_t *mac_address,
+			   uint8_t datarate)
+{
+}
+
+static inline void
+ol_tx_stats_ring_enque_comp(uint32_t msdu_id, uint32_t tx_power)
+{
+}
+
+static inline int
+ol_tx_stats_ring_deque(struct ol_tx_per_pkt_stats *stats)
+{
+	return 0;
+}
+#endif /* WLAN_FEATURE_DSRC */
+
 adf_nbuf_t
 ol_tx_ll(ol_txrx_vdev_handle vdev, adf_nbuf_t msdu_list);
 
 adf_nbuf_t
 ol_tx_ll_queue(ol_txrx_vdev_handle vdev, adf_nbuf_t msdu_list);
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+adf_os_enum_hrtimer_t
+ol_tx_hl_vdev_tcp_del_ack_timer(adf_os_hrtimer_t *timer);
+
+void tcp_del_ack_tasklet(unsigned long data);
+
+void ol_tx_hl_del_ack_queue_flush_all(struct ol_txrx_vdev_t *vdev);
+#else
+static inline
+void ol_tx_hl_del_ack_queue_flush_all(struct ol_txrx_vdev_t *vdev)
+{
+	return;
+}
+#endif
+
 #ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
 void
 ol_tx_hl_vdev_bundle_timer(void *vdev);
 
+
 void
 ol_tx_hl_queue_flush_all(struct ol_txrx_vdev_t* vdev);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_classify.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_classify.c
index a67082d290d..bb769c84a2d 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_classify.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_classify.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -366,7 +366,7 @@ ol_tx_classify(
             peer = ol_txrx_assoc_peer_find(vdev);
             if (!peer) {
                 VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
-                    "Error: STA %p (%02x:%02x:%02x:%02x:%02x:%02x) "
+                    "Error: STA %pK (%02x:%02x:%02x:%02x:%02x:%02x) "
                     "trying to send bcast DA tx data frame "
                     "w/o association\n",
                     vdev,
@@ -376,7 +376,7 @@ ol_tx_classify(
                 return NULL; /* error */
             } else if ((peer->security[OL_TXRX_PEER_SECURITY_MULTICAST].sec_type
                               != htt_sec_type_wapi) &&
-                              (A_STATUS_OK == adf_nbuf_is_dhcp_pkt(tx_nbuf))) {
+                              adf_nbuf_is_dhcp_pkt(tx_nbuf)) {
                 /* DHCP frame to go with voice priority */
                 txq = &peer->txqs[TX_DHCP_TID];
                 tx_msdu_info->htt.info.ext_tid = TX_DHCP_TID;
@@ -400,7 +400,7 @@ ol_tx_classify(
             peer = ol_txrx_peer_find_hash_find(pdev, vdev->mac_addr.raw, 0, 1);
             if (!peer) {
                 VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
-                    "Error: vdev %p (%02x:%02x:%02x:%02x:%02x:%02x) "
+                    "Error: vdev %pK (%02x:%02x:%02x:%02x:%02x:%02x) "
                     "trying to send bcast/mcast, but no self-peer found\n",
                     vdev,
                     vdev->mac_addr.raw[0], vdev->mac_addr.raw[1],
@@ -489,7 +489,7 @@ ol_tx_classify(
              * to send it to.
              */
             VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-                "Error: vdev %p (%02x:%02x:%02x:%02x:%02x:%02x) "
+                "Error: vdev %pK (%02x:%02x:%02x:%02x:%02x:%02x) "
                 "trying to send unicast tx data frame to an unknown peer\n",
                 vdev,
                 vdev->mac_addr.raw[0], vdev->mac_addr.raw[1],
@@ -503,7 +503,7 @@ ol_tx_classify(
             tid = OL_TX_NON_QOS_TID;
         } else if ((peer->security[OL_TXRX_PEER_SECURITY_UNICAST].sec_type
                           != htt_sec_type_wapi) &&
-                          (A_STATUS_OK == adf_nbuf_is_dhcp_pkt(tx_nbuf))) {
+                          adf_nbuf_is_dhcp_pkt(tx_nbuf)) {
             /* DHCP frame to go with voice priority */
             tid = TX_DHCP_TID;
         }
@@ -532,7 +532,7 @@ ol_tx_classify(
         if (tx_msdu_info->htt.info.peer_id == HTT_INVALID_PEER_ID) {
             if (peer) {
                 TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
-                      "%s: remove the peer for invalid peer_id %p\n",
+                      "%s: remove the peer for invalid peer_id %pK\n",
                       __func__, peer);
                 /* remove the peer reference added above */
                 ol_txrx_peer_unref_delete(peer);
@@ -556,7 +556,7 @@ ol_tx_classify(
         tx_msdu_info->peer != NULL) {
 
         TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-                      "%s: remove the peer reference %p\n", __func__, peer);
+                      "%s: remove the peer reference %pK\n", __func__, peer);
         /* remove the peer reference added above */
         ol_txrx_peer_unref_delete(tx_msdu_info->peer);
         /* Making peer NULL in case if multicast non STA mode */
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_desc.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_desc.c
index 793ef8baf1a..1689ac3d5c1 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_desc.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_desc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -72,7 +72,7 @@ ol_tx_desc_alloc(struct ol_txrx_pdev_t *pdev, struct ol_txrx_vdev_t *vdev)
 #endif
            ) {
             TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
-                       "%s Potential tx_desc corruption pkt_type:0x%x pdev:0x%p",
+                       "%s Potential tx_desc corruption pkt_type:0x%x pdev:0x%pK",
                          __func__, tx_desc->pkt_type, pdev);
 #ifdef QCA_COMPUTE_TX_DELAY
             TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, "%s Timestamp:0x%x\n",
@@ -111,6 +111,30 @@ ol_tx_desc_alloc_hl(struct ol_txrx_pdev_t *pdev, struct ol_txrx_vdev_t *vdev)
     return tx_desc;
 }
 
+#ifdef WLAN_FEATURE_DSRC
+static inline void
+__ol_tx_desc_free(struct ol_txrx_pdev_t *pdev, struct ol_tx_desc_t *tx_desc)
+{
+	((union ol_tx_desc_list_elem_t *)tx_desc)->next = NULL;
+	if (pdev->tx_desc.freelist) {
+		pdev->tx_desc.last->next =
+			(union ol_tx_desc_list_elem_t *)tx_desc;
+	} else {
+		pdev->tx_desc.freelist =
+			(union ol_tx_desc_list_elem_t *)tx_desc;
+	}
+	pdev->tx_desc.last = (union ol_tx_desc_list_elem_t *)tx_desc;
+}
+#else
+static inline void
+__ol_tx_desc_free(struct ol_txrx_pdev_t *pdev, struct ol_tx_desc_t *tx_desc)
+{
+	((union ol_tx_desc_list_elem_t *)tx_desc)->next =
+		pdev->tx_desc.freelist;
+	pdev->tx_desc.freelist = (union ol_tx_desc_list_elem_t *)tx_desc;
+}
+#endif /* WLAN_FEATURE_DSRC */
+
 void
 ol_tx_desc_free(struct ol_txrx_pdev_t *pdev, struct ol_tx_desc_t *tx_desc)
 {
@@ -121,9 +145,8 @@ ol_tx_desc_free(struct ol_txrx_pdev_t *pdev, struct ol_tx_desc_t *tx_desc)
     tx_desc->entry_timestamp_ticks = 0xffffffff;
 #endif
 #endif
-    ((union ol_tx_desc_list_elem_t *)tx_desc)->next =
-        pdev->tx_desc.freelist;
-    pdev->tx_desc.freelist = (union ol_tx_desc_list_elem_t *) tx_desc;
+
+    __ol_tx_desc_free(pdev, tx_desc);
     pdev->tx_desc.num_free++;
 
 #if defined(CONFIG_PER_VDEV_TX_DESC_POOL)
@@ -141,7 +164,7 @@ ol_tx_desc_free(struct ol_txrx_pdev_t *pdev, struct ol_tx_desc_t *tx_desc)
         adf_os_atomic_dec(&tx_desc->vdev->tx_desc_count);
     } else {
         TXRX_PRINT(TXRX_PRINT_LEVEL_INFO2,
-               "%s warning: the vdev is referred by tx_desc (%p) "
+               "%s warning: the vdev is referred by tx_desc (%pK) "
                "has been detached.\n",
                  __func__, tx_desc);
     }
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_desc.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_desc.h
index 47259469441..7a6f055102d 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_desc.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_desc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -119,6 +119,9 @@ ol_tx_desc_find_check(struct ol_txrx_pdev_t *pdev, u_int16_t tx_desc_id)
 {
     struct ol_tx_desc_t *tx_desc;
 
+    if (tx_desc_id >= pdev->tx_desc.pool_size)
+        return NULL;
+
     tx_desc = ol_tx_desc_find(pdev, tx_desc_id);
 
     if (tx_desc->pkt_type == ol_tx_frm_freed) {
@@ -133,7 +136,18 @@ ol_tx_desc_find_check(struct ol_txrx_pdev_t *pdev, u_int16_t tx_desc_id)
 static inline struct ol_tx_desc_t *
 ol_tx_desc_find_check(struct ol_txrx_pdev_t *pdev, u_int16_t tx_desc_id)
 {
-    return ol_tx_desc_find(pdev, tx_desc_id);
+    struct ol_tx_desc_t *tx_desc;
+
+    if (tx_desc_id >= pdev->tx_desc.pool_size)
+        return NULL;
+
+    tx_desc = ol_tx_desc_find(pdev, tx_desc_id);
+
+    /* check against invalid tx_desc_id */
+    if (ol_cfg_is_high_latency(pdev->ctrl_pdev) && !tx_desc->vdev)
+        return NULL;
+
+    return tx_desc;
 }
 #endif
 
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_queue.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_queue.c
index b54fa26963e..571295f990b 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_queue.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_queue.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -110,6 +110,9 @@ ol_tx_queue_vdev_flush(struct ol_txrx_pdev_t *pdev, struct ol_txrx_vdev_t *vdev)
     /* flush bundling queue */
     ol_tx_hl_queue_flush_all(vdev);
 
+    /* flush del_ack queue */
+    ol_tx_hl_del_ack_queue_flush_all(vdev);
+
     /* flush VDEV TX queues */
     for (i = 0; i < OL_TX_VDEV_NUM_QUEUES; i++) {
         txq = &vdev->txqs[i];
@@ -154,7 +157,7 @@ ol_tx_queue_vdev_flush(struct ol_txrx_pdev_t *pdev, struct ol_txrx_vdev_t *vdev)
                 }
             }
             TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
-                      "%s: Delete Peer %p\n", __func__, peer);
+                      "%s: Delete Peer %pK\n", __func__, peer);
             ol_txrx_peer_unref_delete(peers[i]);
         }
     } while (peer_count >= PEER_ARRAY_COUNT);
@@ -291,9 +294,15 @@ ol_tx_dequeue(
     u_int16_t num_frames;
     int bytes_sum;
     unsigned credit_sum;
+    u_int16_t temp_frms;
+    u_int32_t temp_bytes;
+    bool flush_all = false;
+    struct ol_tx_desc_t *tx_flush_desc;
 
     TXRX_ASSERT2(txq->flag != ol_tx_queue_paused);
     TX_SCHED_DEBUG_PRINT("Enter %s\n", __func__);
+    temp_frms = txq->frms;
+    temp_bytes = txq->bytes;
 
     if (txq->frms < max_frames) {
         max_frames = txq->frms;
@@ -304,6 +313,13 @@ ol_tx_dequeue(
         unsigned frame_credit;
         struct ol_tx_desc_t *tx_desc;
         tx_desc = TAILQ_FIRST(&txq->head);
+        if(!tx_desc) {
+           flush_all = true;
+           TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+                      "%s: flush frames: num_frames = %d, max_frames = %d\n",
+                       __func__, num_frames, max_frames);
+           break;
+        }
 
         frame_credit = htt_tx_msdu_credit(tx_desc->netbuf);
         if (credit_sum + frame_credit > *credit) {
@@ -323,8 +339,22 @@ ol_tx_dequeue(
     OL_TX_QUEUE_LOG_DEQUEUE(pdev, txq, num_frames, bytes_sum);
     TX_SCHED_DEBUG_PRINT("Leave %s\n", __func__);
 
-    *bytes = bytes_sum;
-    *credit = credit_sum;
+    if (flush_all && bytes_sum) {
+        *bytes = temp_bytes;
+        *credit = 0;
+        txq->frms = 0;
+        txq->bytes = 0;
+        while (num_frames) {
+            tx_flush_desc = TAILQ_FIRST(head);
+            TAILQ_REMOVE(head, tx_flush_desc, tx_desc_list_elem);
+            ol_tx_desc_frame_free_nonstd(pdev, tx_flush_desc, 0);
+            num_frames--;
+        }
+
+    } else {
+        *bytes = bytes_sum;
+        *credit = credit_sum;
+    }
     return num_frames;
 }
 
@@ -1136,7 +1166,7 @@ ol_txrx_vdev_flush(ol_txrx_vdev_handle vdev)
             adf_nbuf_set_next(vdev->ll_pause.txq.head, NULL);
             adf_nbuf_unmap(vdev->pdev->osdev, vdev->ll_pause.txq.head,
                            ADF_OS_DMA_TO_DEVICE);
-            adf_nbuf_tx_free(vdev->ll_pause.txq.head, 1 /* error */);
+            adf_nbuf_tx_free(vdev->ll_pause.txq.head, ADF_NBUF_PKT_ERROR);
             vdev->ll_pause.txq.head = next;
         }
         vdev->ll_pause.txq.tail = NULL;
@@ -1161,8 +1191,6 @@ void ol_tx_pdev_throttle_phase_timer(void *context)
     int ms = 0;
     throttle_level cur_level;
     throttle_phase cur_phase;
-    extern uint8_t thermal_band;
-    int (*throttle_time_ms)[THROTTLE_PHASE_MAX];
 
     /* update the phase */
     pdev->tx_throttle.current_throttle_phase++;
@@ -1171,11 +1199,6 @@ void ol_tx_pdev_throttle_phase_timer(void *context)
         pdev->tx_throttle.current_throttle_phase = THROTTLE_PHASE_OFF;
     }
 
-    if (thermal_band == 2)
-        throttle_time_ms = pdev->tx_throttle.throttle_time_ms_2g;
-    else
-        throttle_time_ms = pdev->tx_throttle.throttle_time_ms_5g;
-
     if (pdev->tx_throttle.current_throttle_phase == THROTTLE_PHASE_OFF) {
         if (ol_tx_pdev_is_target_empty(/*pdev*/)) {
             TXRX_PRINT(TXRX_PRINT_LEVEL_WARN, "throttle phase --> OFF\n");
@@ -1185,11 +1208,11 @@ void ol_tx_pdev_throttle_phase_timer(void *context)
 
             cur_level = pdev->tx_throttle.current_throttle_level;
             cur_phase = pdev->tx_throttle.current_throttle_phase;
-            ms = throttle_time_ms[cur_level][cur_phase];
+            ms = pdev->tx_throttle.throttle_time_ms[cur_level][cur_phase];
             if (pdev->tx_throttle.current_throttle_level !=
                 THROTTLE_LEVEL_0) {
                 TXRX_PRINT(TXRX_PRINT_LEVEL_WARN, "start timer %d ms\n", ms);
-                adf_os_timer_start(&pdev->tx_throttle.phase_timer, ms);
+                adf_os_timer_mod(&pdev->tx_throttle.phase_timer, ms);
             }
         }
     }
@@ -1206,10 +1229,10 @@ void ol_tx_pdev_throttle_phase_timer(void *context)
 
         cur_level = pdev->tx_throttle.current_throttle_level;
         cur_phase = pdev->tx_throttle.current_throttle_phase;
-        ms = throttle_time_ms[cur_level][cur_phase];
+        ms = pdev->tx_throttle.throttle_time_ms[cur_level][cur_phase];
         if (pdev->tx_throttle.current_throttle_level != THROTTLE_LEVEL_0) {
             TXRX_PRINT(TXRX_PRINT_LEVEL_WARN, "start timer %d ms\n", ms);
-            adf_os_timer_start(&pdev->tx_throttle.phase_timer, ms);
+            adf_os_timer_mod(&pdev->tx_throttle.phase_timer, ms);
         }
     }
 }
@@ -1225,8 +1248,6 @@ void ol_tx_pdev_throttle_tx_timer(void *context)
 void ol_tx_throttle_set_level(struct ol_txrx_pdev_t *pdev, int level)
 {
     int ms = 0;
-    extern uint8_t thermal_band;
-    int (*throttle_time_ms)[THROTTLE_PHASE_MAX];
 
     if (level >= THROTTLE_LEVEL_MAX) {
         TXRX_PRINT(TXRX_PRINT_LEVEL_WARN,
@@ -1240,15 +1261,6 @@ void ol_tx_throttle_set_level(struct ol_txrx_pdev_t *pdev, int level)
     /* Set the current throttle level */
     pdev->tx_throttle.current_throttle_level = (throttle_level)level;
 
-    if (thermal_band == 2)
-        throttle_time_ms = pdev->tx_throttle.throttle_time_ms_2g;
-    else
-        throttle_time_ms = pdev->tx_throttle.throttle_time_ms_5g;
-
-    VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-              "thermal band %d time %d",
-               thermal_band, throttle_time_ms[level][THROTTLE_PHASE_OFF]);
-
     if (pdev->cfg.is_high_latency) {
 
         adf_os_timer_cancel(&pdev->tx_throttle.phase_timer);
@@ -1256,13 +1268,13 @@ void ol_tx_throttle_set_level(struct ol_txrx_pdev_t *pdev, int level)
         /* Set the phase */
         if (level != THROTTLE_LEVEL_0) {
             pdev->tx_throttle.current_throttle_phase = THROTTLE_PHASE_OFF;
-            ms = throttle_time_ms[level][THROTTLE_PHASE_OFF];
+            ms = pdev->tx_throttle.throttle_time_ms[level][THROTTLE_PHASE_OFF];
             /* pause all */
             ol_txrx_throttle_pause(pdev);
-            adf_os_timer_start(&pdev->tx_throttle.phase_timer, ms);
+            adf_os_timer_mod(&pdev->tx_throttle.phase_timer, ms);
         } else {
             pdev->tx_throttle.current_throttle_phase = THROTTLE_PHASE_ON;
-            ms = throttle_time_ms[level][THROTTLE_PHASE_ON];
+            ms = pdev->tx_throttle.throttle_time_ms[level][THROTTLE_PHASE_ON];
             /* unpause all */
             ol_txrx_throttle_unpause(pdev);
         }
@@ -1271,15 +1283,15 @@ void ol_tx_throttle_set_level(struct ol_txrx_pdev_t *pdev, int level)
         pdev->tx_throttle.current_throttle_phase = THROTTLE_PHASE_OFF;
 
         /* Start with the new time */
-        ms = throttle_time_ms[level][THROTTLE_PHASE_OFF];
+        ms = pdev->tx_throttle.throttle_time_ms[level][THROTTLE_PHASE_OFF];
 
         adf_os_timer_cancel(&pdev->tx_throttle.phase_timer);
-        adf_os_timer_start(&pdev->tx_throttle.phase_timer, ms);
+        adf_os_timer_mod(&pdev->tx_throttle.phase_timer, ms);
     }
 }
 
 void ol_tx_throttle_init_period(struct ol_txrx_pdev_t *pdev, int period,
-    u_int8_t *dutycycle_level_2g, u_int8_t *dutycycle_level_5g)
+    u_int8_t *dutycycle_level)
 {
     int i;
 
@@ -1288,26 +1300,16 @@ void ol_tx_throttle_init_period(struct ol_txrx_pdev_t *pdev, int period,
 
     TXRX_PRINT(TXRX_PRINT_LEVEL_WARN, "level  OFF  ON\n");
     for (i = 0; i < THROTTLE_LEVEL_MAX; i++) {
-        pdev->tx_throttle.throttle_time_ms_2g[i][THROTTLE_PHASE_ON] =
-            pdev->tx_throttle.throttle_period_ms -
-                ((dutycycle_level_2g[i] * pdev->tx_throttle.throttle_period_ms)
-                 /100);
-	pdev->tx_throttle.throttle_time_ms_5g[i][THROTTLE_PHASE_ON] =
+        pdev->tx_throttle.throttle_time_ms[i][THROTTLE_PHASE_ON] =
             pdev->tx_throttle.throttle_period_ms -
-                ((dutycycle_level_5g[i] * pdev->tx_throttle.throttle_period_ms)
+                ((dutycycle_level[i] * pdev->tx_throttle.throttle_period_ms)
                  /100);
-        pdev->tx_throttle.throttle_time_ms_2g[i][THROTTLE_PHASE_OFF] =
-            pdev->tx_throttle.throttle_period_ms -
-            pdev->tx_throttle.throttle_time_ms_2g[i][THROTTLE_PHASE_ON];
-	pdev->tx_throttle.throttle_time_ms_5g[i][THROTTLE_PHASE_OFF] =
+        pdev->tx_throttle.throttle_time_ms[i][THROTTLE_PHASE_OFF] =
             pdev->tx_throttle.throttle_period_ms -
-            pdev->tx_throttle.throttle_time_ms_5g[i][THROTTLE_PHASE_ON];
-        VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-                  "%d  2g %d %d  5g %d %d\n", i,
-                  pdev->tx_throttle.throttle_time_ms_2g[i][THROTTLE_PHASE_OFF],
-                  pdev->tx_throttle.throttle_time_ms_2g[i][THROTTLE_PHASE_ON],
-                  pdev->tx_throttle.throttle_time_ms_5g[i][THROTTLE_PHASE_OFF],
-                  pdev->tx_throttle.throttle_time_ms_5g[i][THROTTLE_PHASE_ON]);
+            pdev->tx_throttle.throttle_time_ms[i][THROTTLE_PHASE_ON];
+        TXRX_PRINT(TXRX_PRINT_LEVEL_WARN, "%d      %d    %d\n", i,
+                   pdev->tx_throttle.throttle_time_ms[i][THROTTLE_PHASE_OFF],
+                   pdev->tx_throttle.throttle_time_ms[i][THROTTLE_PHASE_ON]);
     }
 }
 
@@ -1327,8 +1329,7 @@ void ol_tx_throttle_init(struct ol_txrx_pdev_t *pdev)
         dutycycle_level[i] = ol_cfg_throttle_duty_cycle_level(pdev->ctrl_pdev,
                                                               i);
 
-    ol_tx_throttle_init_period(pdev, throttle_period,
-                               &dutycycle_level[0], &dutycycle_level[0]);
+    ol_tx_throttle_init_period(pdev, throttle_period, &dutycycle_level[0]);
 
     adf_os_timer_init(
             pdev->osdev,
@@ -1381,7 +1382,7 @@ ol_tx_queue_log_entry_type_info(
             struct ol_tx_log_queue_state_var_sz_t *record;
 
             align_pad =
-                (*align - ((((u_int32_t) type) + 1))) & (*align - 1);
+               (*align - (uint32_t)(((unsigned long) type) + 1)) & (*align - 1);
             record = (struct ol_tx_log_queue_state_var_sz_t *)
                 (type + 1 + align_pad);
             *size += record->num_cats_active *
@@ -1686,6 +1687,9 @@ ol_tx_queue_log_display(struct ol_txrx_pdev_t *pdev)
      * don't bother.
      */
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
+        "Current target credit: %d",
+        adf_os_atomic_read(&pdev->target_tx_credit));
+    VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
         "Tx queue log:");
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
         "      : Frames  Bytes  TID  PEER");
@@ -1853,7 +1857,7 @@ ol_tx_queue_display(struct ol_tx_frms_queue_t *txq, int indent)
 
     state = (txq->flag == ol_tx_queue_active) ? "active" : "paused";
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-        "%*stxq %p (%s): %d frms, %d bytes\n",
+        "%*stxq %pK (%s): %d frms, %d bytes\n",
         indent, " ", txq, state, txq->frms, txq->bytes);
 }
 
@@ -1863,7 +1867,7 @@ ol_tx_queues_display(struct ol_txrx_pdev_t *pdev)
     struct ol_txrx_vdev_t *vdev;
 
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-        "pdev %p tx queues:\n", pdev);
+        "pdev %pK tx queues:\n", pdev);
     TAILQ_FOREACH(vdev, &pdev->vdev_list, vdev_list_elem) {
         struct ol_txrx_peer_t *peer;
         int i;
@@ -1872,7 +1876,7 @@ ol_tx_queues_display(struct ol_txrx_pdev_t *pdev)
                 continue;
             }
             VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-                "  vdev %d (%p), txq %d\n", vdev->vdev_id, vdev, i);
+                "  vdev %d (%pK), txq %d\n", vdev->vdev_id, vdev, i);
             ol_tx_queue_display(&vdev->txqs[i], 4);
         }
         TAILQ_FOREACH(peer, &vdev->peer_list, peer_list_elem) {
@@ -1881,7 +1885,7 @@ ol_tx_queues_display(struct ol_txrx_pdev_t *pdev)
                     continue;
                 }
                 VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-                    "    peer %d (%p), txq %d\n",
+                    "    peer %d (%pK), txq %d\n",
                     peer->peer_ids[0], vdev, i);
                 ol_tx_queue_display(&peer->txqs[i], 6);
             }
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_send.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_send.c
index d19266ef465..dd5cff498af 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_send.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_tx_send.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -392,6 +392,20 @@ ol_tx_target_credit_update(struct ol_txrx_pdev_t *pdev, int credit_delta)
     adf_os_atomic_add(credit_delta, &pdev->target_tx_credit);
 }
 
+int
+ol_tx_target_credit_dec(struct ol_txrx_pdev_t *pdev, int credit)
+{
+    adf_os_spin_lock_bh(&pdev->tx_queue_spinlock);
+    if(adf_os_atomic_read(&pdev->target_tx_credit) < credit) {
+        /* Lack of tx credits, return */
+        adf_os_spin_unlock_bh(&pdev->tx_queue_spinlock);
+        return A_ERROR;
+    }
+    ol_tx_target_credit_update(pdev, -credit);
+    adf_os_spin_unlock_bh(&pdev->tx_queue_spinlock);
+    return A_OK;
+}
+
 #ifdef QCA_COMPUTE_TX_DELAY
 
 static void
@@ -534,6 +548,121 @@ ol_tx_credit_completion_handler(ol_txrx_pdev_handle pdev, int credits)
     OL_TX_FLOW_CT_UNPAUSE_OS_Q(pdev);
 }
 
+static inline int
+ol_tx_get_retries_size(u_int32_t *msg_word, int num_msdus)
+{
+	struct htt_tx_compl_ind_append_retries *list = NULL;
+	int offset;
+	int i = 0;
+
+	if (!HTT_TX_COMPL_IND_APPEND_GET(*msg_word))
+		return 0;
+
+	/* offset in 32 bits word */
+	offset = 1 + ((num_msdus + 1) >> 1);
+	list = (struct htt_tx_compl_ind_append_retries *)(msg_word + offset);
+	while (list[i].flag && (i < num_msdus)) {
+		i++;
+	}
+
+	return (i * sizeof(struct htt_tx_compl_ind_append_retries)) >> 2;
+}
+
+static inline int
+ol_tx_get_txtstamps_size(u_int32_t *msg_word, int num_msdus)
+{
+	if (!HTT_TX_COMPL_IND_APPEND1_GET(*msg_word))
+		return 0;
+
+	return (num_msdus * sizeof(struct htt_tx_compl_ind_append_txtstamp))
+		>> 2;
+}
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+static inline struct htt_tx_compl_ind_append_txtstamp *
+ol_tx_get_txtstamps(u_int32_t *msg_word, int num_msdus)
+{
+	u_int32_t has_tx_tsf;
+	struct htt_tx_compl_ind_append_txtstamp *txtstamp_list = NULL;
+	int offset_dwords;
+
+	has_tx_tsf = HTT_TX_COMPL_IND_APPEND1_GET(*msg_word);
+	if (num_msdus <= 0 || !has_tx_tsf)
+		return NULL;
+
+	offset_dwords = 1 + ((num_msdus + 1) >> 1);
+	offset_dwords += ol_tx_get_retries_size(msg_word, num_msdus);
+	txtstamp_list = (struct htt_tx_compl_ind_append_txtstamp *)
+		(msg_word + offset_dwords);
+
+	return txtstamp_list;
+}
+
+static inline void
+ol_tx_timestamp(ol_txrx_pdev_handle pdev, adf_nbuf_t netbuf, u_int64_t ts)
+{
+	if (!netbuf)
+		return;
+
+	if (pdev->ol_tx_timestamp_cb)
+		pdev->ol_tx_timestamp_cb(netbuf, ts);
+}
+#else
+static inline struct htt_tx_compl_ind_append_txtstamp *
+ol_tx_get_txtstamps(u_int32_t *msg_word, int num_msdus)
+{
+	return NULL;
+}
+
+static inline void
+ol_tx_timestamp(ol_txrx_pdev_handle pdev, adf_nbuf_t netbuf, u_int64_t ts)
+{
+}
+#endif /* WLAN_FEATURE_TSF_PLUS */
+
+#ifdef WLAN_FEATURE_DSRC
+#define DSRC_INVALID_TX_POWER 0xffff
+
+static inline struct htt_tx_compl_ind_append_txpower *
+ol_tx_get_txpowers(u_int32_t *msg_word, int num_msdus)
+{
+	struct htt_tx_compl_ind_append_txpower *txpower_list = NULL;
+	int offset_dwords;
+
+	/* Check if tx power exists. */
+	if (!HTT_TX_COMPL_IND_APPEND2_GET(*msg_word))
+		return NULL;
+
+	offset_dwords = 1 + ((num_msdus + 1) >> 1);
+	offset_dwords += ol_tx_get_retries_size(msg_word, num_msdus);
+	offset_dwords += ol_tx_get_txtstamps_size(msg_word, num_msdus);
+	txpower_list = (struct htt_tx_compl_ind_append_txpower *)
+		(msg_word + offset_dwords);
+
+	return txpower_list;
+}
+
+static inline void
+ol_tx_power_handler(u_int16_t desc_id, u_int16_t tx_power)
+{
+	if (DSRC_INVALID_TX_POWER == tx_power)
+		return;
+
+	ol_tx_stats_ring_enque_comp(desc_id, tx_power);
+}
+#else
+static inline struct htt_tx_compl_ind_append_txpower *
+ol_tx_get_txpowers(u_int32_t *msg_word, int num_msdus)
+{
+	return NULL;
+}
+
+static inline void
+ol_tx_power_handler(u_int16_t desc_id, u_int16_t tx_power)
+{
+}
+#endif /* WLAN_FEATURE_DSRC */
+
 /* WARNING: ol_tx_inspect_handler()'s bahavior is similar to that of ol_tx_completion_handler().
  * any change in ol_tx_completion_handler() must be mirrored in ol_tx_inspect_handler().
  */
@@ -542,10 +671,9 @@ ol_tx_completion_handler(
     ol_txrx_pdev_handle pdev,
     int num_msdus,
     enum htt_tx_status status,
-    void *tx_desc_id_iterator)
+    void *msg)
 {
     int i;
-    u_int16_t *desc_ids = (u_int16_t *)tx_desc_id_iterator;
     u_int16_t tx_desc_id;
     struct ol_tx_desc_t *tx_desc;
     char *trace_str;
@@ -557,10 +685,27 @@ ol_tx_completion_handler(
     union ol_tx_desc_list_elem_t *tx_desc_last = NULL;
     ol_tx_desc_list tx_descs;
     uint32_t is_tx_desc_freed = 0;
+    struct htt_tx_compl_ind_append_txtstamp *txtstamp_list = NULL;
+    struct htt_tx_compl_ind_append_txpower *txpower_list = NULL;
+
+    u_int32_t *msg_word = (u_int32_t *)msg;
+    u_int16_t *desc_ids = (u_int16_t *)(msg_word + 1);
 
     TAILQ_INIT(&tx_descs);
 
+    if (pdev->cfg.is_high_latency) {
+        /*
+         * For some performance sensitive platform, the ol_tx_sched
+         * must be triggered as soon as possible to reduce latency
+         */
+        ol_tx_sched(pdev);
+    }
+
     OL_TX_DELAY_COMPUTE(pdev, status, desc_ids, num_msdus);
+    if (status == htt_tx_status_ok) {
+        txtstamp_list = ol_tx_get_txtstamps(msg_word, num_msdus);
+        txpower_list = ol_tx_get_txpowers(msg_word, num_msdus);
+    }
 
     trace_str = (status) ? "OT:C:F:" : "OT:C:S:";
     for (i = 0; i < num_msdus; i++) {
@@ -568,6 +713,14 @@ ol_tx_completion_handler(
         tx_desc = ol_tx_desc_find(pdev, tx_desc_id);
         tx_desc->status = status;
         netbuf = tx_desc->netbuf;
+
+        if (txtstamp_list)
+            ol_tx_timestamp(pdev, netbuf,
+                    (u_int64_t)txtstamp_list->timestamp[i]);
+
+        if (txpower_list)
+            ol_tx_power_handler(tx_desc_id, txpower_list->tx_power[i]);
+
         NBUF_UPDATE_TX_PKT_COUNT(netbuf, NBUF_TX_PKT_FREE);
         DPTRACE(adf_dp_trace_ptr(netbuf,
                                  ADF_DP_TRACE_FREE_PACKET_PTR_RECORD,
@@ -621,6 +774,8 @@ ol_tx_completion_handler(
          * but update the number of available tx descriptors,
          * then invoke the scheduler, since new credit is probably
          * available now.
+         * For those performance sensitive platform, the ol_tx_sched
+         * now is triggered again
          */
         adf_os_atomic_add(num_msdus, &pdev->tx_queue.rsrc_cnt);
         ol_tx_sched(pdev);
@@ -1250,3 +1405,39 @@ void ol_deregister_packetdump_callback(void)
 	pdev->ol_tx_packetdump_cb = NULL;
 	pdev->ol_rx_packetdump_cb = NULL;
 }
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+void ol_register_timestamp_callback(tp_ol_timestamp_cb ol_tx_timestamp_cb)
+{
+	v_CONTEXT_t vos_context;
+	ol_txrx_pdev_handle pdev;
+
+	vos_context = vos_get_global_context(VOS_MODULE_ID_TXRX,
+						NULL);
+	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_context);
+
+	if (!pdev) {
+		TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+				"%s: pdev is NULL", __func__);
+		return;
+	}
+	pdev->ol_tx_timestamp_cb = ol_tx_timestamp_cb;
+}
+
+void ol_deregister_timestamp_callback(void)
+{
+	v_CONTEXT_t vos_context;
+	ol_txrx_pdev_handle pdev;
+
+	vos_context = vos_get_global_context(VOS_MODULE_ID_TXRX,
+						NULL);
+	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_context);
+
+	if (!pdev) {
+		TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+				"%s: pdev is NULL", __func__);
+		return;
+	}
+	pdev->ol_tx_timestamp_cb = NULL;
+}
+#endif
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx.c
index c1f06642ab5..b137cdffcad 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -376,6 +376,9 @@ ol_txrx_pdev_attach(
     TXRX_STATS_INIT(pdev);
 
     TAILQ_INIT(&pdev->vdev_list);
+    TAILQ_INIT(&pdev->req_list);
+    pdev->req_list_depth = 0;
+    adf_os_spinlock_init(&pdev->req_list_spinlock);
 
     /* do initial set up of the peer ID -> peer object lookup map */
     if (ol_txrx_peer_find_attach(pdev)) {
@@ -496,12 +499,13 @@ ol_txrx_pdev_attach(
         void *htt_tx_desc;
         u_int32_t paddr_lo;
 
-        if (i == (desc_pool_size - 1))
+        if (i == (desc_pool_size - 1)) {
             c_element->next = NULL;
-        else
+            pdev->tx_desc.last = c_element;
+        } else {
             c_element->next = (union ol_tx_desc_list_elem_t *)
                 ol_tx_desc_find(pdev, i + 1);
-
+        }
         htt_tx_desc = htt_tx_desc_alloc(pdev->htt_pdev, &paddr_lo);
         if (! htt_tx_desc) {
             VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_FATAL,
@@ -528,7 +532,7 @@ ol_txrx_pdev_attach(
     /* link SW tx descs into a freelist */
     pdev->tx_desc.num_free = desc_pool_size;
     TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-               "%s first tx_desc:0x%p Last tx desc:0x%p\n", __func__,
+               "%s first tx_desc:0x%pK Last tx desc:0x%pK\n", __func__,
                (u_int32_t *) pdev->tx_desc.freelist,
                (u_int32_t *) (pdev->tx_desc.freelist + desc_pool_size));
 
@@ -538,6 +542,8 @@ ol_txrx_pdev_attach(
         pdev->htt_pkt_type = htt_pkt_type_native_wifi;
     } else if (pdev->frame_format == wlan_frm_fmt_802_3) {
         pdev->htt_pkt_type = htt_pkt_type_ethernet;
+    } else if (pdev->frame_format == wlan_frm_fmt_raw) {
+        pdev->htt_pkt_type = htt_pkt_type_raw;
     } else {
         VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
             "%s Invalid standard frame type: %d\n",
@@ -632,7 +638,9 @@ ol_txrx_pdev_attach(
             pdev->rx_opt_proc = ol_rx_fwd_check;
         }
     } else {
-        if (ol_cfg_rx_pn_check(pdev->ctrl_pdev)) {
+        if (VOS_MONITOR_MODE == vos_get_conparam()) {
+            pdev->rx_opt_proc = ol_rx_deliver;
+        } else if (ol_cfg_rx_pn_check(pdev->ctrl_pdev)) {
             if (ol_cfg_rx_fwd_disabled(pdev->ctrl_pdev)) {
                 /*
                  * PN check done on host, rx->tx forwarding not done at all.
@@ -723,7 +731,7 @@ ol_txrx_pdev_attach(
 
     OL_RX_REORDER_TIMEOUT_INIT(pdev);
 
-    TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1, "Created pdev %p\n", pdev);
+    TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1, "Created pdev %pK\n", pdev);
 
     #if defined(CONFIG_HL_SUPPORT) && defined(DEBUG_HL_LOGGING)
     adf_os_spinlock_init(&pdev->txq_log_spinlock);
@@ -826,7 +834,6 @@ ol_txrx_pdev_attach(
         OL_TX_SCHED_WRR_ADV_CAT_MCAST_DATA;
     pdev->tid_to_ac[OL_TX_NUM_TIDS + OL_TX_VDEV_DEFAULT_MGMT] =
         OL_TX_SCHED_WRR_ADV_CAT_MCAST_MGMT;
-
     return pdev; /* success */
 
 pn_trace_attach_fail:
@@ -886,7 +893,8 @@ A_STATUS ol_txrx_pdev_attach_target(ol_txrx_pdev_handle pdev)
 void
 ol_txrx_pdev_detach(ol_txrx_pdev_handle pdev, int force)
 {
-    int i;
+    int i = 0;
+    struct ol_txrx_stats_req_internal *req;
 
     /*checking to ensure txrx pdev structure is not NULL */
     if (!pdev) {
@@ -899,8 +907,34 @@ ol_txrx_pdev_detach(ol_txrx_pdev_handle pdev, int force)
     /* check that the pdev has no vdevs allocated */
     TXRX_ASSERT1(TAILQ_EMPTY(&pdev->vdev_list));
 
+    adf_os_spin_lock_bh(&pdev->req_list_spinlock);
+    if (pdev->req_list_depth > 0)
+        TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+            "Warning: the txrx req list is not empty, depth=%d\n",
+            pdev->req_list_depth
+            );
+    TAILQ_FOREACH(req, &pdev->req_list, req_list_elem) {
+        TAILQ_REMOVE(&pdev->req_list, req, req_list_elem);
+        pdev->req_list_depth--;
+        TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+            "%d: %p,verbose(%d), concise(%d), up_m(0x%x), reset_m(0x%x)\n",
+            i++,
+            req,
+            req->base.print.verbose,
+            req->base.print.concise,
+            req->base.stats_type_upload_mask,
+            req->base.stats_type_reset_mask
+            );
+        adf_os_mem_free(req);
+    }
+    adf_os_spin_unlock_bh(&pdev->req_list_spinlock);
+
+    adf_os_spinlock_destroy(&pdev->req_list_spinlock);
+
     OL_RX_REORDER_TIMEOUT_CLEANUP(pdev);
 
+    ol_per_pkt_tx_stats_enable(0);
+
     if (ol_cfg_is_high_latency(pdev->ctrl_pdev)) {
         ol_tx_sched_detach(pdev);
     }
@@ -926,7 +960,7 @@ ol_txrx_pdev_detach(ol_txrx_pdev_handle pdev, int force)
          * As a side effect, this will complete the deletion of any vdevs
          * that are waiting for their peers to finish deletion.
          */
-        TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1, "Force delete for pdev %p\n", pdev);
+        TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1, "Force delete for pdev %pK\n", pdev);
         ol_txrx_peer_find_hash_erase(pdev);
     }
 
@@ -1012,10 +1046,120 @@ ol_txrx_pdev_detach(ol_txrx_pdev_handle pdev, int force)
 #ifdef QCA_COMPUTE_TX_DELAY
     adf_os_spinlock_destroy(&pdev->tx_delay.mutex);
 #endif
-
     adf_os_mem_free(pdev);
 }
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+
+/**
+ * ol_txrx_vdev_init_tcp_del_ack() - initialize tcp delayed ack structure
+ * @vdev: vdev handle
+ *
+ * Return: none
+ */
+void ol_txrx_vdev_init_tcp_del_ack(struct ol_txrx_vdev_t *vdev)
+{
+	int i = 0;
+
+	vdev->driver_del_ack_enabled = false;
+	adf_os_hrtimer_init(vdev->pdev->osdev,
+		&vdev->tcp_ack_hash.timer, ol_tx_hl_vdev_tcp_del_ack_timer);
+	adf_os_create_bh(vdev->pdev->osdev, &vdev->tcp_ack_hash.tcp_del_ack_tq,
+		 tcp_del_ack_tasklet, (unsigned long)vdev);
+	adf_os_atomic_init(&vdev->tcp_ack_hash.is_timer_running);
+	adf_os_atomic_init(&vdev->tcp_ack_hash.tcp_node_in_use_count);
+	adf_os_spinlock_init(&vdev->tcp_ack_hash.tcp_free_list_lock);
+	vdev->tcp_ack_hash.tcp_free_list = NULL;
+	for (i = 0; i < OL_TX_HL_DEL_ACK_HASH_SIZE; i++) {
+		adf_os_spinlock_init(&vdev->tcp_ack_hash.node[i].hash_node_lock);
+		vdev->tcp_ack_hash.node[i].no_of_entries = 0;
+		vdev->tcp_ack_hash.node[i].head = NULL;
+	}
+}
+
+/**
+ * ol_txrx_vdev_deinit_tcp_del_ack() - deinitialize tcp delayed ack structure
+ * @vdev: vdev handle
+ *
+ * Return: none
+ */
+void ol_txrx_vdev_deinit_tcp_del_ack(struct ol_txrx_vdev_t *vdev)
+{
+	struct tcp_stream_node *temp = NULL;
+
+	adf_os_destroy_bh(vdev->pdev->osdev, &vdev->tcp_ack_hash.tcp_del_ack_tq);
+
+	adf_os_spin_lock_bh(&vdev->tcp_ack_hash.tcp_free_list_lock);
+	while (vdev->tcp_ack_hash.tcp_free_list) {
+		temp = vdev->tcp_ack_hash.tcp_free_list;
+		vdev->tcp_ack_hash.tcp_free_list = temp->next;
+		adf_os_mem_free(temp);
+	}
+	adf_os_spin_unlock_bh(&vdev->tcp_ack_hash.tcp_free_list_lock);
+}
+
+/**
+ * ol_txrx_vdev_free_tcp_node() - add tcp node in free list
+ * @vdev: vdev handle
+ * @node: tcp stream node
+ *
+ * Return: none
+ */
+void ol_txrx_vdev_free_tcp_node(struct ol_txrx_vdev_t *vdev,
+				struct tcp_stream_node *node)
+{
+	adf_os_atomic_dec(&vdev->tcp_ack_hash.tcp_node_in_use_count);
+
+	adf_os_spin_lock_bh(&vdev->tcp_ack_hash.tcp_free_list_lock);
+	if (vdev->tcp_ack_hash.tcp_free_list) {
+		node->next = vdev->tcp_ack_hash.tcp_free_list;
+		vdev->tcp_ack_hash.tcp_free_list = node;
+	} else {
+		vdev->tcp_ack_hash.tcp_free_list = node;
+		node->next = NULL;
+	}
+	adf_os_spin_unlock_bh(&vdev->tcp_ack_hash.tcp_free_list_lock);
+}
+
+/**
+ * ol_txrx_vdev_alloc_tcp_node() - allocate tcp node
+ * @vdev: vdev handle
+ *
+ * Return: tcp stream node
+ */
+struct tcp_stream_node *ol_txrx_vdev_alloc_tcp_node(struct ol_txrx_vdev_t *vdev)
+{
+	struct tcp_stream_node *node = NULL;
+
+	adf_os_spin_lock_bh(&vdev->tcp_ack_hash.tcp_free_list_lock);
+	if (vdev->tcp_ack_hash.tcp_free_list) {
+		node = vdev->tcp_ack_hash.tcp_free_list;
+		vdev->tcp_ack_hash.tcp_free_list = node->next;
+	}
+	adf_os_spin_unlock_bh(&vdev->tcp_ack_hash.tcp_free_list_lock);
+
+	if (!node) {
+		node = adf_os_mem_alloc(vdev->pdev->osdev,
+				 sizeof(struct ol_txrx_vdev_t));
+		if (!node) {
+			TXRX_PRINT(TXRX_PRINT_LEVEL_FATAL_ERR, "Malloc failed");
+			return NULL;
+		}
+	}
+	adf_os_atomic_inc(&vdev->tcp_ack_hash.tcp_node_in_use_count);
+	return node;
+}
+#else
+static inline
+void ol_txrx_vdev_init_tcp_del_ack(struct ol_txrx_vdev_t *vdev)
+{
+}
+static inline
+void ol_txrx_vdev_deinit_tcp_del_ack(struct ol_txrx_vdev_t *vdev)
+{
+}
+#endif
+
 ol_txrx_vdev_handle
 ol_txrx_vdev_attach(
     ol_txrx_pdev_handle pdev,
@@ -1118,11 +1262,13 @@ ol_txrx_vdev_attach(
             ol_tx_hl_vdev_bundle_timer,
             vdev, ADF_DEFERRABLE_TIMER);
 
+    ol_txrx_vdev_init_tcp_del_ack(vdev);
+
     /* add this vdev into the pdev's list */
     TAILQ_INSERT_TAIL(&pdev->vdev_list, vdev, vdev_list_elem);
 
     TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-        "Created vdev %p (%02x:%02x:%02x:%02x:%02x:%02x)\n",
+        "Created vdev %pK (%02x:%02x:%02x:%02x:%02x:%02x)\n",
         vdev,
         vdev->mac_addr.raw[0], vdev->mac_addr.raw[1], vdev->mac_addr.raw[2],
         vdev->mac_addr.raw[3], vdev->mac_addr.raw[4], vdev->mac_addr.raw[5]);
@@ -1155,6 +1301,25 @@ void ol_txrx_osif_vdev_register(ol_txrx_vdev_handle vdev,
     #endif /* QCA_LL_TX_FLOW_CT */
 }
 
+/**
+ * ol_txrx_osif_pdev_mon_register_cbk() - register monitor rx callback
+ * @txrx_pdev: pdev handle
+ * @cbk: monitor rx callback function
+ *
+ * Return: none
+ */
+void ol_txrx_osif_pdev_mon_register_cbk(
+	ol_txrx_pdev_handle txrx_pdev,
+	ol_txrx_vir_mon_rx_fp cbk)
+{
+	TXRX_ASSERT2(txrx_pdev);
+
+	if (NULL == txrx_pdev)
+	    return;
+
+	txrx_pdev->osif_rx_mon_cb = cbk;
+}
+
 void
 ol_txrx_set_curchan(
     ol_txrx_pdev_handle pdev,
@@ -1224,7 +1389,7 @@ ol_txrx_vdev_detach(
         adf_nbuf_set_next(vdev->ll_pause.txq.head, NULL);
         adf_nbuf_unmap(pdev->osdev, vdev->ll_pause.txq.head,
                        ADF_OS_DMA_TO_DEVICE);
-        adf_nbuf_tx_free(vdev->ll_pause.txq.head, 1 /* error */);
+        adf_nbuf_tx_free(vdev->ll_pause.txq.head, ADF_NBUF_PKT_ERROR);
         vdev->ll_pause.txq.head = next;
     }
     adf_os_spin_unlock_bh(&vdev->ll_pause.mutex);
@@ -1242,7 +1407,7 @@ ol_txrx_vdev_detach(
     if (!TAILQ_EMPTY(&vdev->peer_list)) {
         /* debug print - will be removed later */
         TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-            "%s: not deleting vdev object %p (%02x:%02x:%02x:%02x:%02x:%02x)"
+            "%s: not deleting vdev object %pK (%02x:%02x:%02x:%02x:%02x:%02x)"
             "until deletion finishes for all its peers\n",
             __func__, vdev,
             vdev->mac_addr.raw[0], vdev->mac_addr.raw[1],
@@ -1258,7 +1423,7 @@ ol_txrx_vdev_detach(
     adf_os_spin_unlock_bh(&pdev->peer_ref_mutex);
 
     TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-        "%s: deleting vdev object %p (%02x:%02x:%02x:%02x:%02x:%02x)\n",
+        "%s: deleting vdev object %pK (%02x:%02x:%02x:%02x:%02x:%02x)\n",
         __func__, vdev,
         vdev->mac_addr.raw[0], vdev->mac_addr.raw[1], vdev->mac_addr.raw[2],
         vdev->mac_addr.raw[3], vdev->mac_addr.raw[4], vdev->mac_addr.raw[5]);
@@ -1418,7 +1583,7 @@ ol_txrx_peer_attach(
     ol_txrx_peer_find_hash_add(pdev, peer);
 
     TXRX_PRINT(TXRX_PRINT_LEVEL_INFO2,
-        "vdev %p created peer %p (%02x:%02x:%02x:%02x:%02x:%02x)\n",
+        "vdev %pK created peer %pK (%02x:%02x:%02x:%02x:%02x:%02x)\n",
         vdev, peer,
         peer->mac_addr.raw[0], peer->mac_addr.raw[1], peer->mac_addr.raw[2],
         peer->mac_addr.raw[3], peer->mac_addr.raw[4], peer->mac_addr.raw[5]);
@@ -1726,13 +1891,18 @@ ol_txrx_peer_unref_delete(ol_txrx_peer_handle peer)
     if (adf_os_atomic_dec_and_test(&peer->ref_cnt)) {
         u_int16_t peer_id;
 
-        TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
-            "Deleting peer %p (%02x:%02x:%02x:%02x:%02x:%02x)\n",
+        TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
+            "Deleting peer %pK (%02x:%02x:%02x:%02x:%02x:%02x)\n",
             peer,
             peer->mac_addr.raw[0], peer->mac_addr.raw[1],
             peer->mac_addr.raw[2], peer->mac_addr.raw[3],
             peer->mac_addr.raw[4], peer->mac_addr.raw[5]);
 
+        /* set self_peer to null, otherwise may crash when unload driver */
+        if (peer == pdev->self_peer &&
+            VOS_MONITOR_MODE == vos_get_conparam())
+            pdev->self_peer = NULL;
+
         peer_id = peer->local_id;
         /* remove the reference to the peer from the hash table */
         ol_txrx_peer_find_hash_remove(pdev, peer);
@@ -1790,7 +1960,7 @@ ol_txrx_peer_unref_delete(ol_txrx_peer_handle peer)
                 adf_os_spin_unlock_bh(&pdev->tx_mutex);
 
                 TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-                    "%s: deleting vdev object %p "
+                    "%s: deleting vdev object %pK "
                     "(%02x:%02x:%02x:%02x:%02x:%02x)"
                     " - its last peer is done\n",
                     __func__, vdev,
@@ -1858,8 +2028,8 @@ ol_txrx_peer_detach(ol_txrx_peer_handle peer)
     /* debug print to dump rx reorder state */
     //htt_rx_reorder_log_print(vdev->pdev->htt_pdev);
 
-    TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
-        "%s:peer %p (%02x:%02x:%02x:%02x:%02x:%02x)\n",
+    TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
+        "%s:peer %pK (%02x:%02x:%02x:%02x:%02x:%02x)\n",
           __func__, peer,
           peer->mac_addr.raw[0], peer->mac_addr.raw[1],
           peer->mac_addr.raw[2], peer->mac_addr.raw[3],
@@ -1895,7 +2065,7 @@ ol_txrx_peer_find_by_addr(struct ol_txrx_pdev_t *pdev, u_int8_t *peer_mac_addr)
     peer = ol_txrx_peer_find_hash_find(pdev, peer_mac_addr, 0, 0);
     if (peer) {
         TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
-                  "%s: Delete extra reference %p\n", __func__, peer);
+                  "%s: Delete extra reference %pK\n", __func__, peer);
         /* release the extra reference */
         ol_txrx_peer_unref_delete(peer);
     }
@@ -2000,12 +2170,6 @@ void ol_txrx_print_level_set(unsigned level)
 #endif
 }
 
-struct ol_txrx_stats_req_internal {
-    struct ol_txrx_stats_req base;
-    int serviced; /* state of this request */
-    int offset;
-};
-
 static inline
 u_int64_t OL_TXRX_STATS_PTR_TO_U64(struct ol_txrx_stats_req_internal *req)
 {
@@ -2038,7 +2202,8 @@ ol_txrx_fw_stats_cfg(
 A_STATUS
 ol_txrx_fw_stats_get(
     ol_txrx_vdev_handle vdev,
-    struct ol_txrx_stats_req *req)
+    struct ol_txrx_stats_req *req,
+    bool response_expected)
 {
     struct ol_txrx_pdev_t *pdev = vdev->pdev;
     u_int64_t cookie;
@@ -2067,6 +2232,13 @@ ol_txrx_fw_stats_get(
     /* use the non-volatile request object's address as the cookie */
     cookie = OL_TXRX_STATS_PTR_TO_U64(non_volatile_req);
 
+    if (response_expected) {
+        adf_os_spin_lock_bh(&pdev->req_list_spinlock);
+        TAILQ_INSERT_TAIL(&pdev->req_list, non_volatile_req, req_list_elem);
+        pdev->req_list_depth++;
+        adf_os_spin_unlock_bh(&pdev->req_list_spinlock);
+    }
+
     if (htt_h2t_dbg_stats_get(
             pdev->htt_pdev,
             req->stats_type_upload_mask,
@@ -2074,13 +2246,19 @@ ol_txrx_fw_stats_get(
             HTT_H2T_STATS_REQ_CFG_STAT_TYPE_INVALID, 0,
             cookie))
     {
+        if (response_expected) {
+            adf_os_spin_lock_bh(&pdev->req_list_spinlock);
+            TAILQ_REMOVE(&pdev->req_list, non_volatile_req, req_list_elem);
+            pdev->req_list_depth--;
+            adf_os_spin_unlock_bh(&pdev->req_list_spinlock);
+        }
+
         adf_os_mem_free(non_volatile_req);
         return A_ERROR;
     }
 
-    if (req->wait.blocking) {
-        while (adf_os_mutex_acquire(pdev->osdev, req->wait.sem_ptr)) {}
-    }
+    if (response_expected == false)
+        adf_os_mem_free(non_volatile_req);
 
     return A_OK;
 }
@@ -2095,11 +2273,27 @@ ol_txrx_fw_stats_handler(
     enum htt_dbg_stats_status status;
     int length;
     u_int8_t *stats_data;
-    struct ol_txrx_stats_req_internal *req;
+    struct ol_txrx_stats_req_internal *req, *tmp;
     int more = 0;
+    int found = 0;
 
     req = OL_TXRX_U64_TO_STATS_PTR(cookie);
 
+    adf_os_spin_lock_bh(&pdev->req_list_spinlock);
+    TAILQ_FOREACH(tmp, &pdev->req_list, req_list_elem) {
+        if (req == tmp) {
+            found = 1;
+            break;
+        }
+    }
+    adf_os_spin_unlock_bh(&pdev->req_list_spinlock);
+
+    if (!found) {
+        TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+            "req(%p) from firmware can't be found in the list\n", req);
+        return;
+    }
+
     do {
         htt_t2h_dbg_stats_hdr_parse(
             stats_info_list, &type, &status, &length, &stats_data);
@@ -2223,10 +2417,16 @@ ol_txrx_fw_stats_handler(
     } while (1);
 
     if (! more) {
-        if (req->base.wait.blocking) {
-            adf_os_mutex_release(pdev->osdev, req->base.wait.sem_ptr);
+        adf_os_spin_lock_bh(&pdev->req_list_spinlock);
+        TAILQ_FOREACH(tmp, &pdev->req_list, req_list_elem) {
+            if (req == tmp) {
+                TAILQ_REMOVE(&pdev->req_list, req, req_list_elem);
+                pdev->req_list_depth--;
+                adf_os_mem_free(req);
+                break;
+            }
         }
-        adf_os_mem_free(req);
+        adf_os_spin_unlock_bh(&pdev->req_list_spinlock);
     }
 }
 
@@ -2294,7 +2494,7 @@ ol_txrx_pdev_display(ol_txrx_pdev_handle pdev, int indent)
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
         "%*s%s:\n", indent, " ", "txrx pdev");
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-        "%*spdev object: %p\n", indent+4, " ", pdev);
+        "%*spdev object: %pK\n", indent+4, " ", pdev);
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
         "%*svdev list:\n", indent+4, " ");
     TAILQ_FOREACH(vdev, &pdev->vdev_list, vdev_list_elem) {
@@ -2302,7 +2502,7 @@ ol_txrx_pdev_display(ol_txrx_pdev_handle pdev, int indent)
     }
     ol_txrx_peer_find_display(pdev, indent+4);
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-        "%*stx desc pool: %d elems @ %p\n", indent+4, " ",
+        "%*stx desc pool: %d elems @ %pK\n", indent+4, " ",
         pdev->tx_desc.pool_size, pdev->tx_desc.desc_pages);
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW, "\n");
     htt_display(pdev->htt_pdev, indent);
@@ -2314,7 +2514,7 @@ ol_txrx_vdev_display(ol_txrx_vdev_handle vdev, int indent)
     struct ol_txrx_peer_t *peer;
 
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-        "%*stxrx vdev: %p\n", indent, " ", vdev);
+        "%*stxrx vdev: %pK\n", indent, " ", vdev);
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
         "%*sID: %d\n", indent+4, " ", vdev->vdev_id);
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
@@ -2335,7 +2535,7 @@ ol_txrx_peer_display(ol_txrx_peer_handle peer, int indent)
     int i;
 
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-    "%*stxrx peer: %p\n", indent, " ", peer);
+    "%*stxrx peer: %pK\n", indent, " ", peer);
     for (i = 0; i < MAX_NUM_PEER_ID_PER_PEER; i++) {
         if (peer->peer_ids[i] != HTT_INVALID_PEER) {
             VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
@@ -2621,21 +2821,37 @@ exit:
 bool ol_txrx_set_ocb_def_tx_param(ol_txrx_vdev_handle vdev,
 	void *_def_tx_param, uint32_t def_tx_param_size)
 {
+	int count, channel_nums = def_tx_param_size /
+		sizeof(struct ocb_tx_ctrl_hdr_t);
 	struct ocb_tx_ctrl_hdr_t *def_tx_param =
 		(struct ocb_tx_ctrl_hdr_t *)_def_tx_param;
 
-	if (def_tx_param) {
+	if (def_tx_param == NULL) {
 		/*
-		 * Default TX parameters are provided.
-		 * Validate the contents and
-		 * save them in the vdev.
+		 * Default TX parameters are not provided.
+		 * Delete the old defaults.
 		 */
-		if (def_tx_param_size != sizeof(struct ocb_tx_ctrl_hdr_t)) {
-			VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
-			    "Invalid size of OCB default TX params");
-			return false;
+		if (vdev->ocb_def_tx_param) {
+			vos_mem_free(vdev->ocb_def_tx_param);
+			vdev->ocb_def_tx_param = NULL;
 		}
+		return true;
+	}
+
+	/*
+	 * Default TX parameters are provided.
+	 * Validate the contents and
+	 * save them in the vdev.
+	 * Support up to two channel TX ctrl parameters.
+	 */
+	if (def_tx_param_size != channel_nums *
+		sizeof(struct ocb_tx_ctrl_hdr_t)) {
+		VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
+			  "Invalid size of OCB default TX params");
+		return false;
+	}
 
+	for (count = 0; count < channel_nums; count++, def_tx_param++) {
 		if (def_tx_param->version != OCB_HEADER_VERSION) {
 			VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
 				  "Invalid version of OCB default TX params");
@@ -2657,35 +2873,37 @@ bool ol_txrx_set_ocb_def_tx_param(ol_txrx_vdev_handle vdev,
 			}
 		}
 
-		if (def_tx_param->valid_datarate &&
-			    def_tx_param->datarate > MAX_DATARATE) {
+		/* Default data rate is always valid set by dsrc_config app. */
+		if (!def_tx_param->valid_datarate ||
+			def_tx_param->datarate > MAX_DATARATE) {
 			VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
 				  "Invalid default datarate");
 			return false;
 		}
 
+		/* Default tx power is always valid set by dsrc_config. */
+		if (!def_tx_param->valid_pwr) {
+			VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
+				  "Invalid default tx power");
+			return false;
+		}
+
 		if (def_tx_param->valid_tid &&
-			    def_tx_param->ext_tid > MAX_TID) {
+			def_tx_param->ext_tid > MAX_TID) {
 			VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
 				  "Invalid default TID");
 			return false;
 		}
+	}
 
-		if (vdev->ocb_def_tx_param == NULL)
-			vdev->ocb_def_tx_param =
-				vos_mem_malloc(sizeof(*vdev->ocb_def_tx_param));
-		vos_mem_copy(vdev->ocb_def_tx_param, def_tx_param,
-			     sizeof(*vdev->ocb_def_tx_param));
-	} else {
-		/*
-		 * Default TX parameters are not provided.
-		 * Delete the old defaults.
-		 */
-		if (vdev->ocb_def_tx_param) {
-			vos_mem_free(vdev->ocb_def_tx_param);
-			vdev->ocb_def_tx_param = NULL;
-		}
+	if (vdev->ocb_def_tx_param) {
+		vos_mem_free(vdev->ocb_def_tx_param);
+		vdev->ocb_def_tx_param = NULL;
 	}
+	vdev->ocb_def_tx_param = vos_mem_malloc(def_tx_param_size);
+	if (!vdev->ocb_def_tx_param)
+		return false;
+	vos_mem_copy(vdev->ocb_def_tx_param, _def_tx_param, def_tx_param_size);
 
 	return true;
 }
@@ -2749,6 +2967,8 @@ ol_txrx_ipa_uc_op_response(
 {
    if (pdev->ipa_uc_op_cb) {
       pdev->ipa_uc_op_cb(op_msg, pdev->osif_dev);
+   } else {
+      adf_os_mem_free(op_msg);
    }
 }
 
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx.h
index 2c45b8879ab..08c1e1757d5 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014,2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,6 +38,12 @@ ol_txrx_peer_unref_delete(struct ol_txrx_peer_t *peer);
 u_int16_t
 ol_tx_desc_pool_size_hl(ol_pdev_handle ctrl_pdev);
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+struct tcp_stream_node *ol_txrx_vdev_alloc_tcp_node(struct ol_txrx_vdev_t *vdev);
+void ol_txrx_vdev_free_tcp_node(struct ol_txrx_vdev_t *vdev,
+				struct tcp_stream_node *node);
+void ol_txrx_vdev_deinit_tcp_del_ack(struct ol_txrx_vdev_t *vdev);
+#endif
 
 #ifndef OL_TX_AVG_FRM_BYTES
 #define OL_TX_AVG_FRM_BYTES 1000
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_internal.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_internal.h
index f09db5ce990..16f91862310 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_internal.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -487,7 +487,7 @@ OL_TXRX_FRMS_DUMP(
                 tcp_offset = l2_hdr_size + IPV6_HDR_LEN;
             } else {
                 VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-                    "frame %p non-IP ethertype (%x)\n", frm, ethertype);
+                    "frame %pK non-IP ethertype (%x)\n", frm, ethertype);
                 goto NOT_IP_TCP;
             }
             if (ip_prot == IP_PROTOCOL_TCP) {
@@ -501,10 +501,10 @@ OL_TXRX_FRMS_DUMP(
                     (tcp_hdr->seq_num[1] <<  8) |
                     (tcp_hdr->seq_num[1] <<  0);
                 VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-                    "frame %p: TCP seq num = %d\n", frm, tcp_seq_num);
+                    "frame %pK: TCP seq num = %d\n", frm, tcp_seq_num);
 #else
                 VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-                     "frame %p: TCP seq num = %d\n", frm,
+                     "frame %pK: TCP seq num = %d\n", frm,
                     ((*(p + tcp_offset + 4)) << 24) |
                     ((*(p + tcp_offset + 5)) << 16) |
                     ((*(p + tcp_offset + 6)) <<  8) |
@@ -512,7 +512,7 @@ OL_TXRX_FRMS_DUMP(
 #endif
             } else {
                 VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-                    "frame %p non-TCP IP protocol (%x)\n", frm, ip_prot);
+                    "frame %pK non-TCP IP protocol (%x)\n", frm, ip_prot);
             }
         }
 NOT_IP_TCP:
@@ -547,7 +547,7 @@ NOT_IP_TCP:
             }
 
             VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-                "frame %p data (%p), hex dump of bytes 0-%d of %d:\n",
+                "frame %pK data (%pK), hex dump of bytes 0-%d of %d:\n",
                 frm, p, len_lim-1, (int) adf_nbuf_len(frm));
             p = local_buf;
             while (len_lim > 16) {
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_peer_find.c b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_peer_find.c
index 5196bc36946..90ddaa2951e 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_peer_find.c
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_peer_find.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -305,7 +305,7 @@ ol_txrx_peer_find_hash_erase(struct ol_txrx_pdev_t *pdev)
                  */
                 adf_os_atomic_init(&peer->ref_cnt); /* set to zero */
                 adf_os_atomic_inc(&peer->ref_cnt);  /* incr to one */
-                TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, "%s: Delete Peer %p\n", __func__, peer);
+                TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, "%s: Delete Peer %pK\n", __func__, peer);
                 ol_txrx_peer_unref_delete(peer);
             }
         }
@@ -356,7 +356,7 @@ ol_txrx_peer_find_add_id(
     /* check if there's already a peer object with this MAC address */
     peer = ol_txrx_peer_find_hash_find(pdev, peer_mac_addr, 1 /* is aligned */, 0);
     TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-        "%s: peer %p ID %d\n", __func__, peer, peer_id);
+        "%s: peer %pK ID %d\n", __func__, peer, peer_id);
     if (peer) {
         /* peer's ref count was already incremented by peer_find_hash_find */
         pdev->peer_id_to_obj_map[peer_id] = peer;
@@ -475,7 +475,7 @@ ol_rx_peer_unmap_handler(
     peer = (peer_id == HTT_INVALID_PEER) ? NULL :
         pdev->peer_id_to_obj_map[peer_id];
     TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
-        "%s: peer %p with ID %d to be unmapped.\n", __func__, peer, peer_id);
+        "%s: peer %pK with ID %d to be unmapped.\n", __func__, peer, peer_id);
     pdev->peer_id_to_obj_map[peer_id] = NULL;
     /*
      * Currently peer IDs are assigned for vdevs as well as peers.
@@ -487,8 +487,8 @@ ol_rx_peer_unmap_handler(
      * Remove a reference to the peer.
      * If there are no more references, delete the peer object.
      */
-    TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
-        "%s: Remove the ID %d reference to peer %p\n",
+    TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
+        "%s: Remove the ID %d reference to peer %pK\n",
         __func__, peer_id, peer);
     ol_txrx_peer_unref_delete(peer);
 }
@@ -528,7 +528,7 @@ ol_txrx_peer_find_display(ol_txrx_pdev_handle pdev, int indent)
     for (i = 0; i < max_peers; i++) {
         if (pdev->peer_id_to_obj_map[i]) {
             VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-                "%*sid %d -> %p\n",
+                "%*sid %d -> %pK\n",
                 indent+4, " ", i, pdev->peer_id_to_obj_map[i]);
         }
     }
@@ -539,7 +539,7 @@ ol_txrx_peer_find_display(ol_txrx_pdev_handle pdev, int indent)
             struct ol_txrx_peer_t *peer;
             TAILQ_FOREACH(peer, &pdev->peer_hash.bins[i], hash_list_elem) {
                 VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-                    "%*shash idx %d -> %p (%02x:%02x:%02x:%02x:%02x:%02x)\n",
+                    "%*shash idx %d -> %pK (%02x:%02x:%02x:%02x:%02x:%02x)\n",
                     indent+4, " ", i, peer,
                     peer->mac_addr.raw[0], peer->mac_addr.raw[1],
                     peer->mac_addr.raw[2], peer->mac_addr.raw[3],
diff --git a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_types.h b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
index a660e305f84..cb3404d4203 100644
--- a/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
+++ b/drivers/staging/qcacld-2.0/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -48,7 +48,6 @@
 #include "ol_htt_rx_api.h"
 #include "wlan_qct_tl.h"
 #include <ol_txrx_ctrl_api.h>
-
 /*
  * The target may allocate multiple IDs for a peer.
  * In particular, the target may allocate one ID to represent the
@@ -87,6 +86,8 @@
 
 #define OL_TXRX_INVALID_VDEV_ID		(-1)
 
+#define INVALID_REORDER_INDEX 0xFFFF
+
 struct ol_txrx_pdev_t;
 struct ol_txrx_vdev_t;
 struct ol_txrx_peer_t;
@@ -165,6 +166,8 @@ typedef struct _tx_peer_threshold{
 } tx_peer_threshold;
 #endif
 
+#define MAX_RADIOTAP_LEN 64
+
 struct ol_tx_desc_t {
 	adf_nbuf_t netbuf;
 	void *htt_tx_desc;
@@ -200,6 +203,8 @@ struct ol_tx_desc_t {
 	struct ol_txrx_vdev_t* vdev;
 
 	void *txq;
+	uint8_t rtap[MAX_RADIOTAP_LEN];
+	uint8_t rtap_len;
 };
 
 typedef TAILQ_HEAD(, ol_tx_desc_t) ol_tx_desc_list;
@@ -363,13 +368,20 @@ struct ol_tx_sched_t;
 typedef struct ol_tx_sched_t *ol_tx_sched_handle;
 
 #ifndef OL_TXRX_NUM_LOCAL_PEER_IDS
-
+#ifdef WLAN_4SAP_CONCURRENCY
+/*
+ * Each AP will occupy one ID, so it will occupy 4 IDs for 4 SAP mode.
+ * And the remainder IDs will be assigned to other 32 clients.
+ */
+#define OL_TXRX_NUM_LOCAL_PEER_IDS (4 + 32)
+#else
 /*
  * Each AP will occupy one ID, so it will occupy two IDs for AP-AP mode.
  * And the remainder IDs will be assigned to other 32 clients.
  */
 #define OL_TXRX_NUM_LOCAL_PEER_IDS (2 + 32)
 #endif
+#endif
 
 #ifndef ol_txrx_local_peer_id_t
 #define ol_txrx_local_peer_id_t u_int8_t /* default */
@@ -548,6 +560,10 @@ struct ol_txrx_pdev_t {
 	/* ol_txrx_vdev list */
 	TAILQ_HEAD(, ol_txrx_vdev_t) vdev_list;
 
+	TAILQ_HEAD(, ol_txrx_stats_req_internal) req_list;
+	int req_list_depth;
+	adf_os_spinlock_t req_list_spinlock;
+
 	/* peer ID to peer object map (array of pointers to peer objects) */
 	struct ol_txrx_peer_t **peer_id_to_obj_map;
 
@@ -600,11 +616,19 @@ struct ol_txrx_pdev_t {
 	tp_ol_packetdump_cb ol_tx_packetdump_cb;
 	tp_ol_packetdump_cb ol_rx_packetdump_cb;
 
+	/* virtual montior callback functions */
+	ol_txrx_vir_mon_rx_fp osif_rx_mon_cb;
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+	tp_ol_timestamp_cb ol_tx_timestamp_cb;
+#endif
+
 	/* tx descriptor pool */
 	struct {
 		u_int16_t pool_size;
 		u_int16_t num_free;
 		union ol_tx_desc_list_elem_t *freelist;
+		union ol_tx_desc_list_elem_t *last;
 		uint32_t page_size;
 		uint16_t desc_reserved_size;
 		uint8_t page_divider;
@@ -807,8 +831,7 @@ struct ol_txrx_pdev_t {
 		/* Maximum number of frames to send to the target at one time */
 		u_int32_t tx_threshold;
 		/* stores time in ms of on and off phase for each throttle level*/
-		int throttle_time_ms_2g[THROTTLE_LEVEL_MAX][THROTTLE_PHASE_MAX];
-		int throttle_time_ms_5g[THROTTLE_LEVEL_MAX][THROTTLE_PHASE_MAX];
+		int throttle_time_ms[THROTTLE_LEVEL_MAX][THROTTLE_PHASE_MAX];
 		/* mark as true if traffic is paused due to thermal throttling */
 		a_bool_t is_paused;
 	} tx_throttle;
@@ -850,11 +873,56 @@ struct ol_txrx_pdev_t {
 
 	struct ol_txrx_peer_t *self_peer;
 	uint32_t total_bundle_queue_length;
+	struct tasklet_struct tcp_ack_tq;
+
+#ifdef MAC_NOTIFICATION_FEATURE
+	/* Callback to indicate failure to user space */
+	void (*tx_failure_cb)(void *ctx, unsigned int num_msdu,
+			      unsigned char tid, unsigned int status);
+#endif
 };
 
 struct ol_txrx_ocb_chan_info {
 	uint32_t chan_freq;
+	uint32_t bandwidth;
 	uint16_t disable_rx_stats_hdr:1;
+	uint8_t mac_address[6];
+};
+
+#define OL_TX_HL_DEL_ACK_HASH_SIZE    256
+
+enum ol_tx_hl_packet_type {
+	TCP_PKT_ACK,
+	TCP_PKT_NO_ACK,
+	NO_TCP_PKT
+};
+
+struct packet_info {
+	enum ol_tx_hl_packet_type type;
+	uint16_t stream_id;
+	uint32_t ack_number;
+	uint32_t dst_ip;
+	uint32_t src_ip;
+	uint16_t dst_port;
+	uint16_t src_port;
+};
+
+struct tcp_stream_node {
+	struct tcp_stream_node *next;
+	uint8_t no_of_ack_replaced;
+	uint16_t stream_id;
+	uint32_t dst_ip;
+	uint32_t src_ip;
+	uint16_t dst_port;
+	uint16_t src_port;
+	uint32_t ack_number;
+	adf_nbuf_t head;
+};
+
+struct tcp_del_ack_hash_node {
+	adf_os_spinlock_t hash_node_lock;
+	uint8_t no_of_entries;
+	struct tcp_stream_node *head;
 };
 
 struct ol_txrx_vdev_t {
@@ -955,6 +1023,19 @@ struct ol_txrx_vdev_t {
 		adf_os_timer_t timer;
 	} bundle_queue;
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+	bool driver_del_ack_enabled;
+	struct {
+		struct tcp_del_ack_hash_node node[OL_TX_HL_DEL_ACK_HASH_SIZE];
+		adf_os_hrtimer_t timer;
+		adf_os_atomic_t is_timer_running;
+		adf_os_atomic_t tcp_node_in_use_count;
+		adf_os_bh_t tcp_del_ack_tq;
+		struct tcp_stream_node *tcp_free_list;
+		adf_os_spinlock_t tcp_free_list_lock;
+	} tcp_ack_hash;
+#endif
+
 #if defined(CONFIG_HL_SUPPORT) && defined(FEATURE_WLAN_TDLS)
         union ol_txrx_align_mac_addr_t hl_tdls_ap_mac_addr;
         bool hlTdlsFlag;
@@ -978,6 +1059,9 @@ struct ol_txrx_vdev_t {
 	struct ol_txrx_ocb_chan_info *ocb_channel_info;
 	uint32_t ocb_channel_count;
 
+	/* OCB Configuration flags */
+	uint16_t ocb_config_flags;
+
 	/* Default OCB TX parameter */
 	struct ocb_tx_ctrl_hdr_t *ocb_def_tx_param;
 
@@ -1131,9 +1215,10 @@ struct ol_txrx_peer_t {
 	u_int8_t last_rmf_pn_valid;
 #endif
 
-        /* Properties of the last received PPDU */
+	/* Properties of the last received PPDU */
 	int16_t last_pkt_rssi_cmb;
 	int16_t last_pkt_rssi[4];
+	int8_t last_pkt_noise_floor[4];
 	uint8_t last_pkt_legacy_rate;
 	uint8_t last_pkt_legacy_rate_sel;
 	uint32_t last_pkt_timestamp_microsec;
diff --git a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_helper.c b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_helper.c
index 52e14f28ae7..2bf95d5c4f5 100644
--- a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_helper.c
+++ b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_helper.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -236,7 +236,7 @@ static int epping_tx_thread_fn(void *data)
     int i;
    epping_poll_t *epping_poll = data;
 
-   EPPING_LOG(VOS_TRACE_LEVEL_FATAL, "%s: arg = %p", __func__, data);
+   EPPING_LOG(VOS_TRACE_LEVEL_FATAL, "%s: arg = %pK", __func__, data);
    while (!epping_poll->done) {
       down(&epping_poll->sem);
       adf_os_atomic_dec(&epping_poll->atm);
@@ -258,7 +258,7 @@ void epping_register_tx_copier(HTC_ENDPOINT_ID eid, epping_context_t *pEpping_ct
    epping_poll->eid = eid;
    epping_poll->arg = pEpping_ctx->epping_adapter;
    epping_poll->done = false;
-   EPPING_LOG(VOS_TRACE_LEVEL_FATAL, "%s: eid = %d, arg = %p",
+   EPPING_LOG(VOS_TRACE_LEVEL_FATAL, "%s: eid = %d, arg = %pK",
               __func__, eid, pEpping_ctx->epping_adapter);
    sema_init(&epping_poll->sem, 0);
    adf_os_atomic_init(&epping_poll->atm);
diff --git a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_main.c b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_main.c
index ccf58813387..04c6f20e5f8 100644
--- a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_main.c
+++ b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_main.c
@@ -114,6 +114,7 @@ int epping_driver_init(int con_mode, vos_wake_lock_t *g_wake_lock,
 #endif
 #ifdef MEMORY_DEBUG
    vos_mem_init();
+   adf_net_buf_debug_init();
 #endif
 
    pEpping_ctx = vos_mem_malloc(sizeof(epping_context_t));
@@ -169,6 +170,7 @@ int epping_driver_init(int con_mode, vos_wake_lock_t *g_wake_lock,
       vos_mem_free(pEpping_ctx);
 
 #ifdef MEMORY_DEBUG
+      adf_net_buf_debug_exit();
       vos_mem_exit();
 #endif
 #ifdef TIMER_MANAGER
@@ -186,6 +188,7 @@ error1:
       pEpping_ctx = NULL;
    }
 #ifdef MEMORY_DEBUG
+   adf_net_buf_debug_exit();
    vos_mem_exit();
 #endif
 #ifdef TIMER_MANAGER
@@ -255,6 +258,7 @@ void epping_driver_exit(v_CONTEXT_t pVosContext)
    vos_mem_free(pEpping_ctx);
    vos_preClose( &pVosContext );
 #ifdef MEMORY_DEBUG
+   adf_net_buf_debug_exit();
    vos_mem_exit();
 #endif
 #ifdef TIMER_MANAGER
diff --git a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_rx.c b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_rx.c
index c6f2d1eb9c1..978ad462707 100644
--- a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_rx.c
+++ b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -126,7 +126,7 @@ void epping_rx(void *ctx, HTC_PACKET *pPacket)
    struct sk_buff *pktSkb = (struct sk_buff *)pPacket->pPktContext;
 
    EPPING_LOG(VOS_TRACE_LEVEL_INFO,
-      "%s: pAdapter = 0x%p eid=%d, skb=0x%p, data=0x%p, len=0x%x status:%d",
+      "%s: pAdapter = 0x%pK eid=%d, skb=0x%pK, data=0x%pK, len=0x%x status:%d",
       __func__, pAdapter, eid, pktSkb, pPacket->pBuffer,
       pPacket->ActualLength, status);
 
@@ -163,6 +163,7 @@ void epping_rx(void *ctx, HTC_PACKET *pPacket)
                    &pEpping_ctx->kperf_num_rx_recv[eid],
                    sizeof(unsigned int));
                epping_set_kperf_flag(pAdapter, eid, false);
+               adf_net_buf_debug_release_skb(pktSkb);
                netif_rx_ni(pktSkb);
                break;
             case 0: /* RXPERF hard code 0 in FW */
@@ -175,9 +176,11 @@ void epping_rx(void *ctx, HTC_PACKET *pPacket)
                break;
             case EPPING_CMD_CAPTURE_RECV_CNT:
                epping_set_kperf_flag(pAdapter, eid, false);
+               adf_net_buf_debug_release_skb(pktSkb);
                netif_rx_ni(pktSkb);
                break;
             default:
+               adf_net_buf_debug_release_skb(pktSkb);
                netif_rx_ni(pktSkb);
                pEpping_ctx->kperf_num_rx_recv[eid]++;
                if ((pAdapter->stats.rx_packets % EPPING_STATS_LOG_COUNT) == 0) {
@@ -187,6 +190,7 @@ void epping_rx(void *ctx, HTC_PACKET *pPacket)
                break;
             }
          } else {
+            adf_net_buf_debug_release_skb(pktSkb);
             netif_rx_ni(pktSkb);
             if ((pAdapter->stats.rx_packets % EPPING_STATS_LOG_COUNT) == 0) {
                EPPING_LOG(VOS_TRACE_LEVEL_FATAL, "%s: total_rx_pkts = %lu",
diff --git a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_tx.c b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_tx.c
index 6d4e838325b..40a5a3489ba 100644
--- a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_tx.c
+++ b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_tx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -205,14 +205,14 @@ void epping_tx_timer_expire(epping_adapter_t *pAdapter)
       HTCSetNodropPkt(pAdapter->pEpping_ctx->HTCHandle, TRUE);
       if (epping_tx_send_int(nodrop_skb, pAdapter)) {
          EPPING_LOG(VOS_TRACE_LEVEL_FATAL,
-            "%s: nodrop: %p xmit fail in timer\n", __func__, nodrop_skb);
+            "%s: nodrop: %pK xmit fail in timer\n", __func__, nodrop_skb);
          /* fail to xmit so put the nodrop packet to the nodrop queue */
          adf_nbuf_queue_insert_head(&pAdapter->nodrop_queue, nodrop_skb);
          break;
       } else {
          HTCSetNodropPkt(pAdapter->pEpping_ctx->HTCHandle, FALSE);
          EPPING_LOG(VOS_TRACE_LEVEL_INFO,
-            "%s: nodrop: %p xmit ok in timer\n", __func__, nodrop_skb);
+            "%s: nodrop: %pK xmit ok in timer\n", __func__, nodrop_skb);
       }
    }
 
@@ -272,7 +272,7 @@ int epping_tx_send(adf_nbuf_t skb, epping_adapter_t *pAdapter)
       HTCSetNodropPkt(pAdapter->pEpping_ctx->HTCHandle, TRUE);
       if (epping_tx_send_int(nodrop_skb, pAdapter)) {
          EPPING_LOG(VOS_TRACE_LEVEL_FATAL,
-            "%s: nodrop: %p xmit fail\n", __func__, nodrop_skb);
+            "%s: nodrop: %pK xmit fail\n", __func__, nodrop_skb);
          /* fail to xmit so put the nodrop packet to the nodrop queue */
          adf_nbuf_queue_insert_head(&pAdapter->nodrop_queue, nodrop_skb);
          /* no cookie so free the current skb */
@@ -280,7 +280,7 @@ int epping_tx_send(adf_nbuf_t skb, epping_adapter_t *pAdapter)
       } else {
          HTCSetNodropPkt(pAdapter->pEpping_ctx->HTCHandle, FALSE);
          EPPING_LOG(VOS_TRACE_LEVEL_INFO,
-            "%s: nodrop: %p xmit ok\n", __func__, nodrop_skb);
+            "%s: nodrop: %pK xmit ok\n", __func__, nodrop_skb);
       }
    }
 
@@ -296,12 +296,12 @@ tx_fail:
       adf_nbuf_free(skb);
       ++pAdapter->stats.tx_dropped;
       EPPING_LOG(VOS_TRACE_LEVEL_FATAL,
-         "%s: Tx skb %p dropped, stats.tx_dropped = %ld\n",
+         "%s: Tx skb %pK dropped, stats.tx_dropped = %ld\n",
          __func__, skb, pAdapter->stats.tx_dropped);
       return -ENOMEM;
    } else {
       EPPING_LOG(VOS_TRACE_LEVEL_FATAL,
-                 "%s: nodrop: %p queued\n", __func__, skb);
+                 "%s: nodrop: %pK queued\n", __func__, skb);
       adf_nbuf_queue_add(&pAdapter->nodrop_queue, skb);
       adf_os_spin_lock_bh(&pAdapter->data_lock);
       if (pAdapter->epping_timer_state != EPPING_TX_TIMER_RUNNING) {
@@ -375,7 +375,7 @@ void epping_tx_complete_multiple(void *ctx,
       }
 
       EPPING_LOG(VOS_TRACE_LEVEL_INFO,
-         "%s skb=%p data=%p len=0x%x eid=%d ",
+         "%s skb=%pK data=%pK len=0x%x eid=%d ",
          __func__, pktSkb, htc_pkt->pBuffer,
          htc_pkt->ActualLength, eid);
 
@@ -404,7 +404,7 @@ void epping_tx_complete_multiple(void *ctx,
       pktSkb = adf_nbuf_queue_remove(&skb_queue);
       if (pktSkb == NULL)
          break;
-      adf_nbuf_free(pktSkb);
+      adf_nbuf_tx_free(pktSkb, ADF_NBUF_PKT_ERROR);
       pEpping_ctx->total_tx_acks++;
    }
 
diff --git a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_txrx.c b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_txrx.c
index b2f90395b1c..5fdad1ec1d4 100644
--- a/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_txrx.c
+++ b/drivers/staging/qcacld-2.0/CORE/EPPING/src/epping_txrx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -270,7 +270,7 @@ static int epping_start_adapter(epping_adapter_t *pAdapter)
       pAdapter->started = true;
    } else {
       EPPING_LOG(VOS_TRACE_LEVEL_WARN,
-         "%s: pAdapter %p already started\n", __func__, pAdapter);
+         "%s: pAdapter %pK already started\n", __func__, pAdapter);
    }
    return 0;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/qc_sap_ioctl.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/qc_sap_ioctl.h
index 1e52ac92609..bc21021e993 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/qc_sap_ioctl.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/qc_sap_ioctl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -268,6 +268,10 @@ enum {
     QCASAP_PARAM_RX_STBC,
     QCASAP_SET_RADAR_DBG,
     QCSAP_PARAM_CHAN_WIDTH,
+    QCSAP_SET_DEFAULT_AMPDU,
+    QCSAP_ENABLE_RTS_BURSTING,
+    QCSAP_ENABLE_DYNAMIC_BW,
+    QCSAP_GET_DYNAMIC_BW,
 };
 
 int iw_get_channel_list(struct net_device *dev,
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_assoc.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_assoc.h
index 0c6e0f3f3ce..3a73e5ef169 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_assoc.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_assoc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -29,6 +29,7 @@
 #define WLAN_HDD_ASSOC_H__
 #include <wlan_hdd_mib.h>
 #include <sme_Api.h>
+#include <linux/ieee80211.h>
 
 #define HDD_MAX_NUM_IBSS_STA          ( 32 )
 #ifdef FEATURE_WLAN_TDLS
@@ -76,6 +77,75 @@ typedef enum {
    eConnectionState_NdiConnected,
 }eConnectionState;
 
+/**
+ * struct hdd_conn_flag - connection flags
+ * @ht_present: ht element present or not
+ * @vht_present: vht element present or not
+ * @hs20_present: hs20 element present or not
+ * @ht_op_present: ht operation present or not
+ * @vht_op_present: vht operation present or not
+ */
+struct hdd_conn_flag {
+	uint8_t ht_present:1;
+	uint8_t vht_present:1;
+	uint8_t hs20_present:1;
+	uint8_t ht_op_present:1;
+	uint8_t vht_op_present:1;
+	uint8_t reserved:3;
+};
+
+/*defines for tx_BF_cap_info */
+#define TX_BF_CAP_INFO_TX_BF			0x00000001
+#define TX_BF_CAP_INFO_RX_STAG_RED_SOUNDING	0x00000002
+#define TX_BF_CAP_INFO_TX_STAG_RED_SOUNDING	0x00000004
+#define TX_BF_CAP_INFO_RX_ZFL			0x00000008
+#define TX_BF_CAP_INFO_TX_ZFL			0x00000010
+#define TX_BF_CAP_INFO_IMP_TX_BF		0x00000020
+#define TX_BF_CAP_INFO_CALIBRATION		0x000000c0
+#define TX_BF_CAP_INFO_CALIBRATION_SHIFT	6
+#define TX_BF_CAP_INFO_EXP_CSIT_BF		0x00000100
+#define TX_BF_CAP_INFO_EXP_UNCOMP_STEER_MAT	0x00000200
+#define TX_BF_CAP_INFO_EXP_BF_CSI_FB		0x00001c00
+#define TX_BF_CAP_INFO_EXP_BF_CSI_FB_SHIFT	10
+#define TX_BF_CAP_INFO_EXP_UNCMP_STEER_MAT	0x0000e000
+#define TX_BF_CAP_INFO_EXP_UNCMP_STEER_MAT_SHIFT 13
+#define TX_BF_CAP_INFO_EXP_CMP_STEER_MAT_FB	0x00070000
+#define TX_BF_CAP_INFO_EXP_CMP_STEER_MAT_FB_SHIFT 16
+#define TX_BF_CAP_INFO_CSI_NUM_BF_ANT		0x00180000
+#define TX_BF_CAP_INFO_CSI_NUM_BF_ANT_SHIFT	18
+#define TX_BF_CAP_INFO_UNCOMP_STEER_MAT_BF_ANT	0x00600000
+#define TX_BF_CAP_INFO_UNCOMP_STEER_MAT_BF_ANT_SHIFT 20
+#define TX_BF_CAP_INFO_COMP_STEER_MAT_BF_ANT	0x01800000
+#define TX_BF_CAP_INFO_COMP_STEER_MAT_BF_ANT_SHIFT 22
+#define TX_BF_CAP_INFO_RSVD			0xfe000000
+
+/* defines for antenna selection info */
+#define ANTENNA_SEL_INFO			0x01
+#define ANTENNA_SEL_INFO_EXP_CSI_FB_TX		0x02
+#define ANTENNA_SEL_INFO_ANT_ID_FB_TX		0x04
+#define ANTENNA_SEL_INFO_EXP_CSI_FB		0x08
+#define ANTENNA_SEL_INFO_ANT_ID_FB		0x10
+#define ANTENNA_SEL_INFO_RX_AS			0x20
+#define ANTENNA_SEL_INFO_TX_SOUNDING_PPDU	0x40
+#define ANTENNA_SEL_INFO_RSVD			0x80
+
+/**
+ * struct rate_info - bitrate information
+ *
+ * Information about a receiving or transmitting bitrate
+ *
+ * @flags: bitflag of flags from &enum rate_info_flags
+ * @mcs: mcs index if struct describes a 802.11n bitrate
+ * @legacy: bitrate in 100kbit/s for 802.11abg
+ * @nss: number of streams (VHT only)
+ */
+struct rate_info_ex {
+	uint8_t flags;
+	uint8_t mcs;
+	uint16_t legacy;
+	uint8_t nss;
+};
+
 /**This structure stores the connection information */
 typedef struct connection_info_s
 {
@@ -124,6 +194,48 @@ typedef struct connection_info_s
    uint8_t   nss;
    uint32_t  rate_flags;
 
+   /** Channel frequency */
+   uint32_t freq;
+
+   /** txrate structure holds nss & datarate info */
+   struct rate_info_ex txrate;
+
+   /** holds noise information */
+   int8_t noise;
+
+   /** holds ht capabilities info */
+   struct ieee80211_ht_cap ht_caps;
+
+   /** holds vht capabilities info */
+   struct ieee80211_vht_cap vht_caps;
+
+   /** flag conn info params is present or not */
+   struct hdd_conn_flag conn_flag;
+
+   /** holds passpoint/hs20 info */
+   tDot11fIEhs20vendor_ie hs20vendor_ie;
+
+   /** HT operation info */
+   struct ieee80211_ht_operation ht_operation;
+
+   /** VHT operation info */
+   struct ieee80211_vht_operation vht_operation;
+
+   /** roaming counter */
+   uint32_t roam_count;
+
+   /** holds rssi info */
+   int8_t signal;
+
+   /** holds assoc fail reason */
+   int32_t assoc_status_code;
+
+   /** holds last SSID info */
+   tCsrSSIDInfo last_ssid;
+
+   /** holds last auth type */
+   eCsrAuthType last_auth_type;
+
    /* ptk installed state */
    bool ptk_installed;
 
@@ -180,7 +292,5 @@ void hdd_delete_peer(hdd_station_ctx_t *sta_ctx, uint8_t sta_id);
 
 int hdd_get_peer_idx(hdd_station_ctx_t *sta_ctx, v_MACADDR_t *addr);
 VOS_STATUS hdd_roamDeregisterSTA(hdd_adapter_t *adapter, uint8_t sta_id);
-void hdd_get_band(uint8_t channel, uint8_t *band);
-uint8_t hdd_is_mcc_in_2_band(hdd_context_t *hdd_ctx);
 
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_cfg.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_cfg.h
index f3847aa90f3..a4dc09df44a 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -58,6 +58,8 @@
 
 //Number of items that can be configured
 #define MAX_CFG_INI_ITEMS   1024
+#define MAX_PRB_REQ_VENDOR_OUI_INI_LEN 160
+#define VENDOR_SPECIFIC_IE_BITMAP 0x20000000
 
 #ifdef SAP_AUTH_OFFLOAD
 /* 802.11 pre-share key length */
@@ -300,6 +302,11 @@ enum
 #define CFG_CHANNEL_BONDING_MODE_MAX           WNI_CFG_CHANNEL_BONDING_MODE_STAMAX
 #define CFG_CHANNEL_BONDING_MODE_DEFAULT       WNI_CFG_CHANNEL_BONDING_MODE_STADEF
 
+#define CFG_OVERRIDE_HT40_20_24GHZ_NAME    "override_ht20_40_24g"
+#define CFG_OVERRIDE_HT40_20_24GHZ_MIN           0
+#define CFG_OVERRIDE_HT40_20_24GHZ_MAX           1
+#define CFG_OVERRIDE_HT40_20_24GHZ_DEFAULT       0
+
 #define CFG_CHANNEL_BONDING_MODE_5GHZ_NAME     "gChannelBondingMode5GHz"
 #define CFG_CHANNEL_BONDING_MODE_MIN           WNI_CFG_CHANNEL_BONDING_MODE_STAMIN
 #define CFG_CHANNEL_BONDING_MODE_MAX           WNI_CFG_CHANNEL_BONDING_MODE_STAMAX
@@ -460,9 +467,24 @@ enum
 
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
 #define CFG_WLAN_MCC_TO_SCC_SWITCH_MODE          "gWlanMccToSccSwitchMode"
-#define CFG_WLAN_MCC_TO_SCC_SWITCH_MODE_MIN      ( VOS_MCC_TO_SCC_SWITCH_DISABLE)
-#define CFG_WLAN_MCC_TO_SCC_SWITCH_MODE_MAX      ( VOS_MCC_TO_SCC_SWITCH_FORCE )
-#define CFG_WLAN_MCC_TO_SCC_SWITCH_MODE_DEFAULT  (VOS_MCC_TO_SCC_SWITCH_DISABLE)
+#define CFG_WLAN_MCC_TO_SCC_SWITCH_MODE_MIN      VOS_MCC_TO_SCC_SWITCH_DISABLE
+#define CFG_WLAN_MCC_TO_SCC_SWITCH_MODE_MAX      VOS_MCC_TO_SCC_SWITCH_FORCE
+#define CFG_WLAN_MCC_TO_SCC_SWITCH_MODE_DEFAULT  VOS_MCC_TO_SCC_SWITCH_DISABLE
+
+#define CFG_WLAN_BAND_SWITCH_ENABLE              "gWlanBandSwitchEnable"
+#define CFG_WLAN_BAND_SWITCH_ENABLE_MIN          ( 0 )
+#define CFG_WLAN_BAND_SWITCH_ENABLE_MAX          ( 1 )
+#define CFG_WLAN_BAND_SWITCH_ENABLE_DEFAULT      ( 0 )
+
+#define CFG_WLAN_AP_P2PGO_CONC_ENABLE            "gWlanApP2pGOConcurrencyEnable"
+#define CFG_WLAN_AP_P2PGO_CONC_ENABLE_MIN        ( 0 )
+#define CFG_WLAN_AP_P2PGO_CONC_ENABLE_MAX        ( 1 )
+#define CFG_WLAN_AP_P2PGO_CONC_ENABLE_DEFAULT    ( 0 )
+
+#define CFG_WLAN_AP_P2PGC_CONC_ENABLE            "gWlanApP2pClientConcurEnable"
+#define CFG_WLAN_AP_P2PGC_CONC_ENABLE_MIN        ( 0 )
+#define CFG_WLAN_AP_P2PGC_CONC_ENABLE_MAX        ( 1 )
+#define CFG_WLAN_AP_P2PGC_CONC_ENABLE_DEFAULT    ( 0 )
 #endif
 
 
@@ -615,16 +637,6 @@ enum
 #define CFG_IDLE_TIME_MIN                           ( 0 )
 #define CFG_IDLE_TIME_MAX                           ( 25 )
 #define CFG_IDLE_TIME_DEFAULT                       ( 25 )
-
-#define CFG_NUM_STA_CHAN_COMBINED_CONC_NAME             "gNumStaChanCombinedConc"
-#define CFG_NUM_STA_CHAN_COMBINED_CONC_MIN              ( 1 )
-#define CFG_NUM_STA_CHAN_COMBINED_CONC_MAX              ( 255 )
-#define CFG_NUM_STA_CHAN_COMBINED_CONC_DEFAULT          ( 3 )
-
-#define CFG_NUM_P2P_CHAN_COMBINED_CONC_NAME             "gNumP2PChanCombinedConc"
-#define CFG_NUM_P2P_CHAN_COMBINED_CONC_MIN              ( 1 )
-#define CFG_NUM_P2P_CHAN_COMBINED_CONC_MAX              ( 255 )
-#define CFG_NUM_P2P_CHAN_COMBINED_CONC_DEFAULT          ( 1 )
 #endif
 
 #define CFG_MAX_PS_POLL_NAME                   "gMaxPsPoll"
@@ -720,7 +732,7 @@ enum
 #define CFG_INFRA_STA_KEEP_ALIVE_PERIOD_NAME          "gStaKeepAlivePeriod"
 #define CFG_INFRA_STA_KEEP_ALIVE_PERIOD_MIN           ( 0 )
 #define CFG_INFRA_STA_KEEP_ALIVE_PERIOD_MAX           ( 65535)
-#define CFG_INFRA_STA_KEEP_ALIVE_PERIOD_DEFAULT       ( 0 )
+#define CFG_INFRA_STA_KEEP_ALIVE_PERIOD_DEFAULT       ( 30 )
 
 //WMM configuration
 #define CFG_QOS_WMM_MODE_NAME                             "WmmIsEnabled"
@@ -728,6 +740,11 @@ enum
 #define CFG_QOS_WMM_MODE_MAX                               (2) //HDD_WMM_NO_QOS
 #define CFG_QOS_WMM_MODE_DEFAULT                           (0) //HDD_WMM_AUTO
 
+#define CFG_STA_LOCAL_EDCA_FOR_ETSI_NAME                "gStaLocalEDCAForETSI"
+#define CFG_STA_LOCAL_EDCA_FOR_ETSI_MIN                 (0)
+#define CFG_STA_LOCAL_EDCA_FOR_ETSI_MAX                 (1)
+#define CFG_STA_LOCAL_EDCA_FOR_ETSI_DEFAULT             (0)
+
 #define CFG_QOS_WMM_80211E_ENABLED_NAME                   "80211eIsEnabled"
 #define CFG_QOS_WMM_80211E_ENABLED_MIN                     (0)
 #define CFG_QOS_WMM_80211E_ENABLED_MAX                     (1)
@@ -1252,7 +1269,7 @@ enum
 #define CFG_ENABLE_HOST_ARPOFFLOAD_NAME         "hostArpOffload"
 #define CFG_ENABLE_HOST_ARPOFFLOAD_MIN          ( 0 )
 #define CFG_ENABLE_HOST_ARPOFFLOAD_MAX          ( 1 )
-#define CFG_ENABLE_HOST_ARPOFFLOAD_DEFAULT      ( 0 )
+#define CFG_ENABLE_HOST_ARPOFFLOAD_DEFAULT      ( 1 )
 
 #define CFG_ENABLE_HOST_SSDP_NAME              "ssdp"
 #define CFG_ENABLE_HOST_SSDP_MIN               ( 0 )
@@ -1281,7 +1298,7 @@ enum
 #define CFG_ENABLE_HOST_NSOFFLOAD_NAME         "hostNSOffload"
 #define CFG_ENABLE_HOST_NSOFFLOAD_MIN          ( 0 )
 #define CFG_ENABLE_HOST_NSOFFLOAD_MAX          ( 1 )
-#define CFG_ENABLE_HOST_NSOFFLOAD_DEFAULT      ( 0 )
+#define CFG_ENABLE_HOST_NSOFFLOAD_DEFAULT      ( 1 )
 
 
 #define CFG_BAND_CAPABILITY_NAME          "BandCapability"
@@ -1294,11 +1311,6 @@ enum
 #define CFG_ENABLE_BEACON_EARLY_TERMINATION_MAX           ( 1 )
 #define CFG_ENABLE_BEACON_EARLY_TERMINATION_DEFAULT       ( 0 )
 
-#define CFG_ENABLE_CLOSE_LOOP_NAME                 "gEnableCloseLoop"
-#define CFG_ENABLE_CLOSE_LOOP_MIN                  WNI_CFG_FIXED_RATE_STAMIN
-#define CFG_ENABLE_CLOSE_LOOP_MAX                  WNI_CFG_FIXED_RATE_STAMAX
-#define CFG_ENABLE_CLOSE_LOOP_DEFAULT              WNI_CFG_FIXED_RATE_STADEF
-
 #define CFG_ENABLE_BYPASS_11D_NAME                 "gEnableBypass11d"
 #define CFG_ENABLE_BYPASS_11D_MIN                  ( 0 )
 #define CFG_ENABLE_BYPASS_11D_MAX                  ( 1 )
@@ -1319,6 +1331,25 @@ enum
 #define CFG_ENABLE_RAMDUMP_COLLECTION_MAX          ( 1 )
 #define CFG_ENABLE_RAMDUMP_COLLECTION_DEFAULT      ( 1 )
 
+/*
+ * gStaAuthRetriesForCode17
+ * It is for an IOT issue.
+ * When DUT receives MAX_ASSOC_STA_REACHED_STATUS as
+ * response for Auth frame this ini decides how many
+ * times DUT has to retry.
+ *
+ * This is mainly for an AP where it wants to force
+ * the Station to connect to its 5G profile session
+ * (Dual band AP) by rejecting the Auth on 2.4G band.
+ * But if a station is only 2.4G capable it can try
+ * 3 times where third time AP will allow the
+ * station to connect to this AP.
+ */
+#define CFG_STA_AUTH_RETRIES_FOR_CODE17_NAME      "gStaAuthRetriesForCode17"
+#define CFG_STA_AUTH_RETRIES_FOR_CODE17_MIN       ( 0 )
+#define CFG_STA_AUTH_RETRIES_FOR_CODE17_MAX       ( 5 )
+#define CFG_STA_AUTH_RETRIES_FOR_CODE17_DEFAULT   ( 0 )
+
 typedef enum
 {
     eHDD_LINK_SPEED_REPORT_ACTUAL = 0,
@@ -1362,20 +1393,62 @@ typedef enum
 #define CFG_ENABLE_VHT_DYNAMIC_STA_CHAINMASK_DEFAULT (0)
 
 /*
+ * gChainMask_2g: to set RX chainmask for 2.4GH if
+ * per band chainmask is supported
+ *
+ * Valid chain mask values.
+ * 01 - enables chain0
+ * 02 - enables chain1
+ * 03 - enables both chain 0 and chain 1
+ */
+#define CFG_RX_CHAIN_MASK_2G         "gChainMask_2g"
+#define CFG_RX_CHAIN_MASK_2G_MIN     (1)
+#define CFG_RX_CHAIN_MASK_2G_MAX     (3)
+#define CFG_RX_CHAIN_MASK_2G_DEFAULT (3)
+
+/*
+ * gChainMask_5g: to set RX chainmask for 5GH if
+ * per band chainmask is supported
+ *
+ * Valid chain mask values.
+ * 01 - enables chain0
+ * 02 - enables chain1
+ * 03 - enables both chain 0 and chain 1
+ */
+#define CFG_RX_CHAIN_MASK_5G         "gChainMask_5g"
+#define CFG_RX_CHAIN_MASK_5G_MIN     (1)
+#define CFG_RX_CHAIN_MASK_5G_MAX     (3)
+#define CFG_RX_CHAIN_MASK_5G_DEFAULT (3)
+
+/*
+ * gChainMask_2g_tx: to set TX chainmask for 2.4GH if
+ * per band chainmask is supported
+ *
  * Valid chain mask values.
  * 01 - enables chain0
  * 02 - enables chain1
  * 03 - enables both chain 0 and chain 1
  */
-#define CFG_CHAIN_MASK_2G         "gChainMask_2g"
-#define CFG_CHAIN_MASK_2G_MIN     ( 1 )
-#define CFG_CHAIN_MASK_2G_MAX     ( 3 )
-#define CFG_CHAIN_MASK_2G_DEFAULT ( 3 )
+#define CFG_TX_CHAIN_MASK_2G         "gChainMask_2g_tx"
+#define CFG_TX_CHAIN_MASK_2G_MIN     (1)
+#define CFG_TX_CHAIN_MASK_2G_MAX     (3)
+#define CFG_TX_CHAIN_MASK_2G_DEFAULT (3)
+
+/*
+ * gChainMask_5g_tx: to set TX chainmask for 5GH if
+ * per band chainmask is supported
+ *
+ * Valid chain mask values.
+ * 01 - enables chain0
+ * 02 - enables chain1
+ * 03 - enables both chain 0 and chain 1
+ */
+#define CFG_TX_CHAIN_MASK_5G         "gChainMask_5g_tx"
+#define CFG_TX_CHAIN_MASK_5G_MIN     (1)
+#define CFG_TX_CHAIN_MASK_5G_MAX     (3)
+#define CFG_TX_CHAIN_MASK_5G_DEFAULT (3)
+
 
-#define CFG_CHAIN_MASK_5G         "gChainMask_5g"
-#define CFG_CHAIN_MASK_5G_MIN     ( 1 )
-#define CFG_CHAIN_MASK_5G_MAX     ( 3 )
-#define CFG_CHAIN_MASK_5G_DEFAULT ( 3 )
 /*
  * NSS cfg bit definition.
  * STA          BIT[0:1]
@@ -1443,6 +1516,11 @@ typedef enum
 #define CFG_DISABLE_DFS_CH_SWITCH_MAX             ( 1 )
 #define CFG_DISABLE_DFS_CH_SWITCH_DEFAULT         ( 0 )
 
+#define CFG_ENABLE_RADAR_WAR                 "gEnableRadarAssocWar"
+#define CFG_ENABLE_RADAR_WAR_MIN             ( 0 )
+#define CFG_ENABLE_RADAR_WAR_MAX             ( 1 )
+#define CFG_ENABLE_RADAR_WAR_DEFAULT         ( 1 )
+
 #define CFG_ENABLE_DFS_MASTER_CAPABILITY               "gEnableDFSMasterCap"
 #define CFG_ENABLE_DFS_MASTER_CAPABILITY_MIN           ( 0 )
 #define CFG_ENABLE_DFS_MASTER_CAPABILITY_MAX           ( 1 )
@@ -1476,6 +1554,135 @@ typedef enum
 #define CFG_REPORT_MAX_LINK_SPEED_MAX              ( eHDD_LINK_SPEED_REPORT_MAX_SCALED )
 #define CFG_REPORT_MAX_LINK_SPEED_DEFAULT          ( eHDD_LINK_SPEED_REPORT_MAX_SCALED )
 
+#define CFG_SET_RTS_FOR_SIFS_BURSTING           "gSetRTSForSIFSBursting"
+#define CFG_SET_RTS_FOR_SIFS_BURSTING_MIN       (0)
+#define CFG_SET_RTS_FOR_SIFS_BURSTING_MAX       (1)
+#define CFG_SET_RTS_FOR_SIFS_BURSTING_DEFAULT   (0)
+
+#define CFG_MAX_MPDUS_IN_AMPDU                  "gMaxMPDUsInAMPDU"
+#define CFG_MAX_MPDUS_IN_AMPDU_MIN              (0)
+#define CFG_MAX_MPDUS_IN_AMPDU_MAX              (64)
+#define CFG_MAX_MPDUS_IN_AMPDU_DEFAULT          (0)
+
+/*
+ * <ini>
+ * gMaxHTMCSForTxData - max HT mcs for TX
+ * @Min: 0
+ * @Max: 383
+ * @Default: 0
+ *
+ * This ini is used to configure the max HT mcs
+ * for tx data.
+ *
+ * Usage: External
+ *
+ * bits 0-15:  max HT mcs
+ * bits 16-31: zero to disable, otherwise enable.
+ *
+ * </ini>
+ */
+#define CFG_MAX_HT_MCS_FOR_TX_DATA                 "gMaxHTMCSForTxData"
+#define CFG_MAX_HT_MCS_FOR_TX_DATA_MIN             (WNI_CFG_MAX_HT_MCS_TX_DATA_STAMIN)
+#define CFG_MAX_HT_MCS_FOR_TX_DATA_MAX             (WNI_CFG_MAX_HT_MCS_TX_DATA_STAMAX)
+#define CFG_MAX_HT_MCS_FOR_TX_DATA_DEFAULT         (WNI_CFG_MAX_HT_MCS_TX_DATA_STADEF)
+
+/*
+ * <ini>
+ * gSapGetPeerInfo - Enable/Disable remote peer info query support
+ * @Min: 0 - Disable remote peer info query support
+ * @Max: 1 - Enable remote peer info query support
+ * @Default: 0
+ *
+ * This ini is used to enable/disable remote peer info query support
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_SAP_GET_PEER_INFO                      "gSapGetPeerInfo"
+#define CFG_SAP_GET_PEER_INFO_MIN                   (0)
+#define CFG_SAP_GET_PEER_INFO_MAX                   (1)
+#define CFG_SAP_GET_PEER_INFO_DEFAULT               (0)
+
+/*
+ * <ini>
+ * gDisableABGRateForTxData - disable abg rate for tx data
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * This ini is used to disable abg rate for tx data.
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_DISABLE_ABG_RATE_FOR_TX_DATA                 "gDisableABGRateForTxData"
+#define CFG_DISABLE_ABG_RATE_FOR_TX_DATA_MIN             (WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STAMIN)
+#define CFG_DISABLE_ABG_RATE_FOR_TX_DATA_MAX             (WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STAMAX)
+#define CFG_DISABLE_ABG_RATE_FOR_TX_DATA_DEFAULT         (WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STADEF)
+
+/*
+ * <ini>
+ * gRateForTxMgmt - rate for tx mgmt frame
+ * @Min: 0x0
+ * @Max: 0xFF
+ * @Default: 0xFF
+ *
+ * This ini is used to configure the rate for tx
+ * mgmt frame. Default 0xFF means disable.
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_RATE_FOR_TX_MGMT                  "gRateForTxMgmt"
+#define CFG_RATE_FOR_TX_MGMT_MIN              (WNI_CFG_RATE_FOR_TX_MGMT_STAMIN)
+#define CFG_RATE_FOR_TX_MGMT_MAX              (WNI_CFG_RATE_FOR_TX_MGMT_STAMAX)
+#define CFG_RATE_FOR_TX_MGMT_DEFAULT          (WNI_CFG_RATE_FOR_TX_MGMT_STADEF)
+
+/*
+ * <ini>
+ * gRateForTxMgmt2G - rate for tx mgmt frame on 2G
+ * @Min: 0x0
+ * @Max: 0xFF
+ * @Default: 0xFF
+ *
+ * This ini is used to configure the rate for tx
+ * mgmt frame on 2G Band. Default 0xFF means disable.
+ * It has higher priority and will overwrite gRateForTxMgmt
+ * setting.
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_RATE_FOR_TX_MGMT_2G            "gRateForTxMgmt2G"
+#define CFG_RATE_FOR_TX_MGMT_2G_MIN        (WNI_CFG_RATE_FOR_TX_MGMT_2G_STAMIN)
+#define CFG_RATE_FOR_TX_MGMT_2G_MAX        (WNI_CFG_RATE_FOR_TX_MGMT_2G_STAMAX)
+#define CFG_RATE_FOR_TX_MGMT_2G_DEFAULT    (WNI_CFG_RATE_FOR_TX_MGMT_2G_STADEF)
+
+/*
+ * <ini>
+ * gRateForTxMgmt5G - rate for tx mgmt frame on 5G
+ * @Min: 0x0
+ * @Max: 0xFF
+ * @Default: 0xFF
+ *
+ * This ini is used to configure the rate for tx
+ * mgmt frame on 5G Band. Default 0xFF means disable.
+ * It has higher priority and will overwrite gRateForTxMgmt
+ * setting.
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_RATE_FOR_TX_MGMT_5G            "gRateForTxMgmt5G"
+#define CFG_RATE_FOR_TX_MGMT_5G_MIN        (WNI_CFG_RATE_FOR_TX_MGMT_5G_STAMIN)
+#define CFG_RATE_FOR_TX_MGMT_5G_MAX        (WNI_CFG_RATE_FOR_TX_MGMT_5G_STAMAX)
+#define CFG_RATE_FOR_TX_MGMT_5G_DEFAULT    (WNI_CFG_RATE_FOR_TX_MGMT_5G_STADEF)
+
 /*
  * RSSI Thresholds
  * Used when eHDD_LINK_SPEED_REPORT_SCALED is selected
@@ -1744,7 +1951,6 @@ typedef enum
 #define CFG_AUTO_CHANNEL_SELECT_WEIGHT_MAX        (0xFFFFFFFF)
 #define CFG_AUTO_CHANNEL_SELECT_WEIGHT_DEFAULT    (0x000000FF)
 
-
 #define CFG_ACS_BAND_SWITCH_THRESHOLD             "gACSBandSwitchThreshold"
 #define CFG_ACS_BAND_SWITCH_THRESHOLD_MIN         (0)
 #define CFG_ACS_BAND_SWITCH_THRESHOLD_MAX         (26664)
@@ -1807,11 +2013,6 @@ typedef enum
 #define CFG_IGNORE_DYNAMIC_DTIM_IN_P2P_MODE_DEFAULT    ( 0 )
 
 
-#define CFG_ENABLE_AUTOMATIC_TX_POWER_CONTROL_NAME  "gEnableAutomaticTxPowerControl"
-#define CFG_ENABLE_AUTOMATIC_TX_POWER_CONTROL_MIN        ( 0 )
-#define CFG_ENABLE_AUTOMATIC_TX_POWER_CONTROL_MAX        ( 1 )
-#define CFG_ENABLE_AUTOMATIC_TX_POWER_CONTROL_DEFAULT    ( 1 )
-
 #define CFG_SHORT_GI_40MHZ_NAME                "gShortGI40Mhz"
 #define CFG_SHORT_GI_40MHZ_MIN                 0
 #define CFG_SHORT_GI_40MHZ_MAX                 1
@@ -1999,45 +2200,25 @@ typedef enum
  * then throtling level will get increased by one level and
  * will reduce TX duty by the given percentage
  */
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_2G_NAME    "g2gThrottleDutyCycleLevel0"
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_2G_MIN     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_2G_MAX     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_2G_DEFAULT ( 0 )
-
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_2G_NAME    "g2gThrottleDutyCycleLevel1"
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_2G_MIN     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_2G_MAX     ( 100 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_2G_DEFAULT ( 50 )
-
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_2G_NAME    "g2gThrottleDutyCycleLevel2"
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_2G_MIN     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_2G_MAX     ( 100 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_2G_DEFAULT ( 75 )
-
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_2G_NAME    "g2gThrottleDutyCycleLevel3"
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_2G_MIN     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_2G_MAX     ( 100 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_2G_DEFAULT ( 94 )
-
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_5G_NAME    "g5gThrottleDutyCycleLevel0"
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_5G_MIN     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_5G_MAX     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_5G_DEFAULT ( 0 )
-
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_5G_NAME    "g5gThrottleDutyCycleLevel1"
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_5G_MIN     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_5G_MAX     ( 100 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_5G_DEFAULT ( 50 )
-
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_5G_NAME    "g5gThrottleDutyCycleLevel2"
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_5G_MIN     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_5G_MAX     ( 100 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_5G_DEFAULT ( 75 )
-
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_5G_NAME    "g5gThrottleDutyCycleLevel3"
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_5G_MIN     ( 0 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_5G_MAX     ( 100 )
-#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_5G_DEFAULT ( 94 )
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_NAME    "gThrottleDutyCycleLevel0"
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_MIN     ( 0 )
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_MAX     ( 0 )
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_DEFAULT ( 0 )
+
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_NAME    "gThrottleDutyCycleLevel1"
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_MIN     ( 0 )
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_MAX     ( 100 )
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_DEFAULT ( 50 )
+
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_NAME    "gThrottleDutyCycleLevel2"
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_MIN     ( 0 )
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_MAX     ( 100 )
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_DEFAULT ( 75 )
+
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_NAME    "gThrottleDutyCycleLevel3"
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_MIN     ( 0 )
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_MAX     ( 100 )
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_DEFAULT ( 94 )
 
 #define CFG_THERMAL_TEMP_MIN_LEVEL0_NAME      "gThermalTempMinLevel0"
 #define CFG_THERMAL_TEMP_MIN_LEVEL0_MIN       ( 0 )
@@ -2079,6 +2260,139 @@ typedef enum
 #define CFG_THERMAL_TEMP_MAX_LEVEL3_MAX       ( 1000 )
 #define CFG_THERMAL_TEMP_MAX_LEVEL3_DEFAULT   ( 0 )
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+/*
+ * <ini>
+ * gThermalShutdownEnable - Enable/Disable Thermal Shutdown feature to protect
+                            IC too hot and die
+ * @Min: 0
+ * @Max: 1
+ * @Default: 1
+ *
+ * This ini is used to enable/disable Thermal Shutdown feature
+ *
+ *
+ * Supported Feature: Thermal Shutdown
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+
+#define CFG_THERMAL_SHUTDOWN_ENABLE_NAME      "gThermalShutdownEnable"
+#define CFG_THERMAL_SHUTDOWN_ENABLE_MIN       ( 0 )
+#define CFG_THERMAL_SHUTDOWN_ENABLE_MAX       ( 1 )
+#define CFG_THERMAL_SHUTDOWN_ENABLE_DEFAULT   ( 1 )
+
+/*
+ * <ini>
+ * gThermalShutdownAutoEnable - Enable/Disable Automatic Thermal Shutdown
+ * @Min: 0
+ * @Max: 1
+ * @Default: 1
+ *
+ * In Automatic mode, host driver send the suspend command if the condition is
+ * meet, or else the command is send by host app.
+ *
+ * Supported Feature: Thermal Shutdown
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+
+#define CFG_THERMAL_SHUTDOWN_AUTO_ENABLE_NAME      "gThermalShutdownAutoEnable"
+#define CFG_THERMAL_SHUTDOWN_AUTO_ENABLE_MIN       ( 0 )
+#define CFG_THERMAL_SHUTDOWN_AUTO_ENABLE_MAX       ( 1 )
+#define CFG_THERMAL_SHUTDOWN_AUTO_ENABLE_DEFAULT   ( 1 )
+
+/*
+ * <ini>
+ * gThermalShutdownTempSuspend - Temperature threshold of suspend
+ * @Min: 0
+ * @Max: 1000
+ * @Default: 117
+ *
+ * If the reported temperature from firmware is higher than this threshold,
+ * the suspend command will be sent to shutdown the target.
+ *
+ * Supported Feature: Thermal Shutdown
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+
+#define CFG_THERMAL_SHUTDOWN_TEMP_SUSPEND_NAME      "gThermalShutdownTempSuspend"
+#define CFG_THERMAL_SHUTDOWN_TEMP_SUSPEND_MIN       ( 0 )
+#define CFG_THERMAL_SHUTDOWN_TEMP_SUSPEND_MAX       ( 1000 )
+#define CFG_THERMAL_SHUTDOWN_TEMP_SUSPEND_DEFAULT   ( 117 )
+
+/*
+ * <ini>
+ * gThermalShutdownTempWarning - Temperature threshold of warning.
+ * @Min: 0
+ * @Max: 1000
+ * @Default: 115
+ *
+ * Firmware report temperature to host as indication if the temperature is
+ * higher than this threshold.
+ *
+ * Supported Feature: Thermal Shutdown
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+
+#define CFG_THERMAL_SHUTDOWN_TEMP_WARNING_NAME      "gThermalShutdownTempWarning"
+#define CFG_THERMAL_SHUTDOWN_TEMP_WARNING_MIN       ( 0 )
+#define CFG_THERMAL_SHUTDOWN_TEMP_WARNING_MAX       ( 1000 )
+#define CFG_THERMAL_SHUTDOWN_TEMP_WARNING_DEFAULT   ( 115 )
+
+/*
+ * <ini>
+ * gThermalShutdownTempResume - Temperature threshold of resume
+ * @Min: 0
+ * @Max: 1000
+ * @Default: 113
+ *
+ * If the reported temperature from firmware is lower than this threshold,
+ * the resume command will be sent to shutdown the target.
+ *
+ * Supported Feature: Thermal Shutdown
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+
+#define CFG_THERMAL_SHUTDOWN_TEMP_RESUME_NAME      "gThermalShutdownTempResume"
+#define CFG_THERMAL_SHUTDOWN_TEMP_RESUME_MIN       ( 0 )
+#define CFG_THERMAL_SHUTDOWN_TEMP_RESUME_MAX       ( 1000 )
+#define CFG_THERMAL_SHUTDOWN_TEMP_RESUME_DEFAULT   ( 113 )
+
+/*
+ * <ini>
+ * gThermalSampleRate - The sample rate of temperature for firmware
+ * @Min: 1000
+ * @Max: 10000
+ * @Default: 5000
+ *
+ * Thermal Sample Rate (in milliseconds) used by FW to sample temperature of IC
+ *
+ *
+ * Supported Feature: Thermal Shutdown
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_THERMAL_SAMPLE_RATE_NAME      "gThermalSampleRate"
+#define CFG_THERMAL_SAMPLE_RATE_MIN       ( 1000 )
+#define CFG_THERMAL_SAMPLE_RATE_MAX       ( 10000 )
+#define CFG_THERMAL_SAMPLE_RATE_DEFAULT   ( 5000 )
+#endif /* FEATURE_WLAN_THERMAL_SHUTDOWN */
 
 /*
  * Enable/Disable Modulated DTIM feature
@@ -2239,7 +2553,7 @@ typedef enum
 #define CFG_TDLS_EXTERNAL_CONTROL                   "gTDLSExternalControl"
 #define CFG_TDLS_EXTERNAL_CONTROL_MIN               (0)
 #define CFG_TDLS_EXTERNAL_CONTROL_MAX               (1)
-#define CFG_TDLS_EXTERNAL_CONTROL_DEFAULT           (0)
+#define CFG_TDLS_EXTERNAL_CONTROL_DEFAULT           (1)
 
 #define CFG_TDLS_OFF_CHANNEL_SUPPORT_ENABLE          "gEnableTDLSOffChannel"
 #define CFG_TDLS_OFF_CHANNEL_SUPPORT_ENABLE_MIN      (0)
@@ -2300,6 +2614,12 @@ typedef enum
 
 #endif
 
+/* Timer to defer for enabling TDLS on P2P listen (Value in milliseconds) */
+#define CFG_TDLS_ENABLE_DEFER_TIMER                "gTDLSEnableDeferTime"
+#define CFG_TDLS_ENABLE_DEFER_TIMER_MIN            (2000)
+#define CFG_TDLS_ENABLE_DEFER_TIMER_MAX            (6000)
+#define CFG_TDLS_ENABLE_DEFER_TIMER_DEFAULT        (5000)
+
 #ifdef WLAN_ACTIVEMODE_OFFLOAD_FEATURE
 #define CFG_ACTIVEMODE_OFFLOAD_ENABLE         "gEnableActiveModeOffload"
 #define CFG_ACTIVEMODE_OFFLOAD_ENABLE_MIN     ( 0 )
@@ -2726,12 +3046,16 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
  * 0x1 - Enable mgmt pkt logs (no probe req/rsp).
  * 0x2 - Enable EAPOL pkt logs.
  * 0x4 - Enable DHCP pkt logs.
+ * 0x8 - Enable mgmt. action pkt logs.
+ * 0x10 - Enable ARP packet logs.
+ * 0x20 - Enable ICMPv6 NS packet logs.
+ * 0x40 - Enable ICMPv6 NA packet logs.
  * 0x0 - Disable all the above connection related logs.
  */
 #define CFG_ENABLE_DEBUG_CONNECT_ISSUE             "gEnableDebugLog"
 #define CFG_ENABLE_DEBUG_CONNECT_ISSUE_MIN         (0)
 #define CFG_ENABLE_DEBUG_CONNECT_ISSUE_MAX         (0xFF)
-#define CFG_ENABLE_DEBUG_CONNECT_ISSUE_DEFAULT     (6)
+#define CFG_ENABLE_DEBUG_CONNECT_ISSUE_DEFAULT     (0x76)
 
 /*
  * RX packet handling options
@@ -3007,6 +3331,36 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
 
 #endif /* QCA_SUPPORT_TXRX_HL_BUNDLE */
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+
+#define CFG_DEL_ACK_THRESHOLD_HIGH              "gDriverDelAckHighThreshold"
+#define CFG_DEL_ACK_THRESHOLD_HIGH_DEFAULT      (300)
+#define CFG_DEL_ACK_THRESHOLD_HIGH_MIN          (0)
+#define CFG_DEL_ACK_THRESHOLD_HIGH_MAX          (70000)
+
+#define CFG_DEL_ACK_THRESHOLD_LOW               "gDriverDelAckLowThreshold"
+#define CFG_DEL_ACK_THRESHOLD_LOW_DEFAULT       (100)
+#define CFG_DEL_ACK_THRESHOLD_LOW_MIN           (0)
+#define CFG_DEL_ACK_THRESHOLD_LOW_MAX           (70000)
+
+#define CFG_DEL_ACK_TIMER_IN_MS                 "gDriverDelAckTimerValue"
+#define CFG_DEL_ACK_TIMER_IN_MS_DEFAULT         (3)
+#define CFG_DEL_ACK_TIMER_IN_MS_MIN             (1)
+#define CFG_DEL_ACK_TIMER_IN_MS_MAX             (15)
+
+#define CFG_DEL_ACK_PKT_COUNT                   "gDriverDelAckPktCount"
+#define CFG_DEL_ACK_PKT_COUNT_DEFAULT           (20)
+#define CFG_DEL_ACK_PKT_COUNT_MIN               (0)
+#define CFG_DEL_ACK_PKT_COUNT_MAX               (50)
+
+#define CFG_DEL_ACK_ENABLE                      "gDriverDelAckEnable"
+#define CFG_DEL_ACK_ENABLE_DEFAULT              (1)
+#define CFG_DEL_ACK_ENABLE_MIN                  (0)
+#define CFG_DEL_ACK_ENABLE_MAX                  (1)
+
+#endif /* QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK */
+
+
 #ifdef WLAN_FEATURE_11W
 #define CFG_PMF_SA_QUERY_MAX_RETRIES_NAME          "pmfSaQueryMaxRetries"
 #define CFG_PMF_SA_QUERY_MAX_RETRIES_DEFAULT       ( 5 )
@@ -3020,7 +3374,11 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
 #endif
 
 #define CFG_MAX_CONCURRENT_CONNECTIONS_NAME        "gMaxConcurrentActiveSessions"
+#ifdef WLAN_4SAP_CONCURRENCY
+#define CFG_MAX_CONCURRENT_CONNECTIONS_DEFAULT     ( 4 )
+#else
 #define CFG_MAX_CONCURRENT_CONNECTIONS_DEFAULT     ( 2 )
+#endif
 #define CFG_MAX_CONCURRENT_CONNECTIONS_MIN         ( 1 )
 #define CFG_MAX_CONCURRENT_CONNECTIONS_MAX         ( 4 )
 
@@ -3043,6 +3401,27 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
 #define CFG_REORDER_OFFLOAD_SUPPORT_MAX     ( 1 )
 #define CFG_REORDER_OFFLOAD_SUPPORT_DEFAULT ( 0 )
 
+/*
+ * <ini>
+ * gEnableHostapdEdca - Use hostapd EDCA local params
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * This ini is used to enable using hostapd
+ * EDCA local params.
+ *
+ * Supported Feature: EDCA
+ *
+ * Usage: Internal/External
+ *
+ * </ini>
+ */
+#define CFG_EDCA_FROM_HOSTAPD                      "gEnableHostapdEdcaLocal"
+#define CFG_EDCA_FROM_HOSTAPD_MIN                  ( 0 )
+#define CFG_EDCA_FROM_HOSTAPD_MAX                  ( 1 )
+#define CFG_EDCA_FROM_HOSTAPD_DEFAULT              ( 0 )
+
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 #define CFG_ROAMING_OFFLOAD_NAME                "gRoamOffloadEnabled"
 #define CFG_ROAMING_OFFLOAD_MIN                 (0)
@@ -3127,6 +3506,32 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
 #define CFG_ENABLE_NAN_SUPPORT_MAX                      (1)
 #endif
 
+/*
+ * <ini>
+ * gEnableAcTxqOptimize
+ * @Min: 0
+ * @Max: 0x13
+ * @Default: 0
+ *
+ * This ini is used to enable one AC tx queue optimize
+ *
+ * Usage: Internal/External
+ *
+ * bits 0-1:   WMM_AC_BE 0
+ *             WMM_AC_BK 1
+ *             WMM_AC_VI 2
+ *             WMM_AC_VO 3
+ * bits 2-3:   reserved
+ * bits 4:     Enalbe
+ * bits 5-7:   reserved
+ *
+ * </ini>
+ */
+#define CFG_ENABLE_AC_TXQ_OPTIMIZE                 "gEnableAcTxqOptimize"
+#define CFG_ENABLE_AC_TXQ_OPTIMIZE_MIN             ( 0x0 )
+#define CFG_ENABLE_AC_TXQ_OPTIMIZE_MAX             ( 0x13 )
+#define CFG_ENABLE_AC_TXQ_OPTIMIZE_DEFAULT         ( 0x0 )
+
 #define CFG_ENABLE_SELF_RECOVERY                   "gEnableSelfRecovery"
 #define CFG_ENABLE_SELF_RECOVERY_MIN               ( 0 )
 #define CFG_ENABLE_SELF_RECOVERY_MAX               ( 1 )
@@ -3492,6 +3897,101 @@ enum dot11p_mode {
 #define CFG_BTC_ANTENNA_ISOLATION_MAX       (100)
 #define CFG_BTC_ANTENNA_ISOLATION_DEFAULT   (0)
 
+/**
+* For P2P + STA + BT Paging
+* gBTIntervalPageP2PSTA/gWLIntervalPageP2PSTA intervals length (in ms) during
+* intervals length (in ms) during WLAN P2P + STA (multi vdev) + BT Paging,
+* min 20ms, max 200ms
+* Customer could change these parameters' value to improve P2P throughput
+* during BT Page
+* gBTIntervalPageP2PSTA=80
+* gWLIntervalPageP2PSTA=30
+*/
+#define CFG_BTC_BT_INTERVAL_PAGE_P2P_STA           "gBTIntervalPageP2PSTA"
+#define CFG_BTC_BT_INTERVAL_PAGE_P2P_STA_MIN       (20)
+#define CFG_BTC_BT_INTERVAL_PAGE_P2P_STA_MAX       (200)
+#define CFG_BTC_BT_INTERVAL_PAGE_P2P_STA_DEFAULT   (80)
+
+#define CFG_BTC_WLAN_INTERVAL_PAGE_P2P_STA           "gWLIntervalPageP2PSTA"
+#define CFG_BTC_WLAN_INTERVAL_PAGE_P2P_STA_MIN       (20)
+#define CFG_BTC_WLAN_INTERVAL_PAGE_P2P_STA_MAX       (200)
+#define CFG_BTC_WLAN_INTERVAL_PAGE_P2P_STA_DEFAULT   (30)
+
+/**
+FG_BTC_BT_INTERVAL_PAGE_P2P_STA_DEFAULT
+* intervals length (in ms) during WLAN STA (single vdev) + BT Inquiry,
+* min 20ms, max 200ms
+* Customer could change these parameters' value to improve STA throughput
+* during BT Inquiry
+* gBTIntervalInquirySTA=120
+* gWLIntervalInquirySTA=30
+*/
+#define CFG_BTC_BT_INTERVAL_INQ_STA           "gBTIntervalInquirySTA"
+#define CFG_BTC_BT_INTERVAL_INQ_STA_MIN       (20)
+#define CFG_BTC_BT_INTERVAL_INQ_STA_MAX       (200)
+#define CFG_BTC_BT_INTERVAL_INQ_STA_DEFAULT   (120)
+
+#define CFG_BTC_WLAN_INTERVAL_INQ_STA           "gWLIntervalInquirySTA"
+#define CFG_BTC_WLAN_INTERVAL_INQ_STA_MIN       (20)
+#define CFG_BTC_WLAN_INTERVAL_INQ_STA_MAX       (200)
+#define CFG_BTC_WLAN_INTERVAL_INQ_STA_DEFAULT   (30)
+
+/**
+* For SAP + BT Inquiry
+* intervals length (in ms) during WLAN SAP (single vdev) + BT Inquiry,
+* min 20ms, max 200ms
+* Customer could change these parameters' value to improve SAP throughput
+* during BT Inquiry
+* gBTIntervalInquirySAP=120
+* gWLIntervalInquirySAP=30
+*/
+#define CFG_BTC_BT_INTERVAL_INQ_SAP           "gBTIntervalInquirySAP"
+#define CFG_BTC_BT_INTERVAL_INQ_SAP_MIN       (20)
+#define CFG_BTC_BT_INTERVAL_INQ_SAP_MAX       (200)
+#define CFG_BTC_BT_INTERVAL_INQ_SAP_DEFAULT   (120)
+
+#define CFG_BTC_WLAN_INTERVAL_INQ_SAP           "gWLIntervalInquirySAP"
+#define CFG_BTC_WLAN_INTERVAL_INQ_SAP_MIN       (20)
+#define CFG_BTC_WLAN_INTERVAL_INQ_SAP_MAX       (200)
+#define CFG_BTC_WLAN_INTERVAL_INQ_SAP_DEFAULT   (30)
+
+/**
+* For P2P + BT Inquiry
+* intervals length (in ms) during WLAN P2P (single vdev) + BT Inquiry,
+* min 20ms, max 200ms
+* Customer could change these parameters' value to improve P2P throughput
+* during BT Inquiry
+* gBTIntervalInquiryP2P=120
+* gWLIntervalInquiryP2P=30
+*/
+#define CFG_BTC_BT_INTERVAL_INQ_P2P           "gBTIntervalInquiryP2P"
+#define CFG_BTC_BT_INTERVAL_INQ_P2P_MIN       (20)
+#define CFG_BTC_BT_INTERVAL_INQ_P2P_MAX       (200)
+#define CFG_BTC_BT_INTERVAL_INQ_P2P_DEFAULT   (120)
+
+#define CFG_BTC_WLAN_INTERVAL_INQ_P2P           "gWLIntervalInquiryP2P"
+#define CFG_BTC_WLAN_INTERVAL_INQ_P2P_MIN       (20)
+#define CFG_BTC_WLAN_INTERVAL_INQ_P2P_MAX       (200)
+#define CFG_BTC_WLAN_INTERVAL_INQ_P2P_DEFAULT   (30)
+
+/**
+* For P2P + STA + BT Inquiry
+* intervals length (in ms) during WLAN P2P + STA (multi vdev) + BT Inquiry,
+* min 20ms, max 200ms
+* Customer could change these parameters' value to improve P2P throughput
+* during BT Inquiry
+* gBTIntervalInquiryP2PSTA=80
+* gWLIntervalInquiryP2PSTA=30
+*/
+#define CFG_BTC_BT_INTERVAL_INQ_P2P_STA           "gBTIntervalInquiryP2PSTA"
+#define CFG_BTC_BT_INTERVAL_INQ_P2P_STA_MIN       (20)
+#define CFG_BTC_BT_INTERVAL_INQ_P2P_STA_MAX       (200)
+#define CFG_BTC_BT_INTERVAL_INQ_P2P_STA_DEFAULT   (80)
+
+#define CFG_BTC_WLAN_INTERVAL_INQ_P2P_STA           "gWLIntervalInquiryP2PSTA"
+#define CFG_BTC_WLAN_INTERVAL_INQ_P2P_STA_MIN       (20)
+#define CFG_BTC_WLAN_INTERVAL_INQ_P2P_STA_MAX       (200)
+#define CFG_BTC_WLAN_INTERVAL_INQ_P2P_STA_DEFAULT   (30)
 
 /**
  * Config to set WLAN/BT coex tx power
@@ -3503,19 +4003,6 @@ enum dot11p_mode {
 #define CFG_BTC_WLAN_COEX_TX_POWER_MAX       (63)
 #define CFG_BTC_WLAN_COEX_TX_POWER_DEFAULT   (63)
 
-/* Config to set WLAN on the uplink periodically pauses and unpauses its data queues */
-#ifdef WMI_COEX_BTC_DUTYCYCLE
-#define CFG_COEX_PAUSE_NAME             "gCoexWLANPauseDuration"
-#define CFG_COEX_PAUSE_MIN                                     (0)
-#define CFG_COEX_PAUSE_MAX                                     (100)
-#define CFG_COEX_PAUSE_DEFAULT                                (30)
-
-#define CFG_COEX_UNPAUSE_NAME           "gCoexWLANUnpauseDuration"
-#define CFG_COEX_UNPAUSE_MIN                                   (0)
-#define CFG_COEX_UNPAUSE_MAX                                   (100)
-#define CFG_COEX_UNPAUSE_DEFAULT                               (30)
-#endif
-
 /* Parameters for roaming scans performed at high RSSI */
 
 /* Maximum number of scans after RSSI change */
@@ -3558,6 +4045,18 @@ enum dot11p_mode {
 #define TSF_GPIO_PIN_INVALID                       (255)
 #define CFG_SET_TSF_GPIO_PIN_DEFAULT               (TSF_GPIO_PIN_INVALID)
 
+#ifdef WLAN_FEATURE_TSF_PLUS
+/* PTP options */
+#define CFG_SET_TSF_PTP_OPT_NAME                  "gtsf_ptp_options"
+#define CFG_SET_TSF_PTP_OPT_MIN                   (0)
+#define CFG_SET_TSF_PTP_OPT_MAX                   (0xff)
+#define CFG_SET_TSF_PTP_OPT_RX                    (0x1)
+#define CFG_SET_TSF_PTP_OPT_TX                    (0x2)
+#define CFG_SET_TSF_PTP_OPT_RAW                   (0x4)
+#define CFG_SET_TSF_DBG_FS                        (0x8)
+#define CFG_SET_TSF_PTP_OPT_DEFAULT               (0xf)
+#endif
+
 #define CFG_MULTICAST_HOST_FW_MSGS          "gMulticastHostFwMsgs"
 #define CFG_MULTICAST_HOST_FW_MSGS_MIN      (0)
 #define CFG_MULTICAST_HOST_FW_MSGS_MAX      (1)
@@ -3573,6 +4072,11 @@ enum dot11p_mode {
 #define CFG_TX_CHAIN_MASK_1SS_MAX      (3)
 #define CFG_TX_CHAIN_MASK_1SS_DEFAULT  (1)
 
+#define CFG_TX_SCH_DELAY            "gTxSchDelay"
+#define CFG_TX_SCH_DELAY_MIN           (0)
+#define CFG_TX_SCH_DELAY_MAX           (1)
+#define CFG_TX_SCH_DELAY_DEFAULT       (1)
+
 #define CFG_SELF_GEN_FRM_PWR        "gSelfGenFrmPwr"
 #define CFG_SELF_GEN_FRM_PWR_MIN      (0)
 #define CFG_SELF_GEN_FRM_PWR_MAX      (0xffff)
@@ -3991,10 +4495,10 @@ enum dot11p_mode {
 #define CFG_TGT_GTX_USR_CFG_MAX       (32)
 #define CFG_TGT_GTX_USR_CFG_DEFAULT   (32)
 
-#define CFG_CH_AVOID_SAP_RESTART_NAME    "sap_ch_avoid_restart"
-#define CFG_CH_AVOID_SAP_RESTART_MIN     (0)
-#define CFG_CH_AVOID_SAP_RESTART_MAX     (1)
-#define CFG_CH_AVOID_SAP_RESTART_DEFAULT (0)
+#define CFG_SAP_INTERNAL_RESTART_NAME    "gEnableSapInternalRestart"
+#define CFG_SAP_INTERNAL_RESTART_MIN     (0)
+#define CFG_SAP_INTERNAL_RESTART_MAX     (1)
+#define CFG_SAP_INTERNAL_RESTART_DEFAULT (1)
 
 /*
  * This parameter will help to debug ssr reinit failure issues
@@ -4056,6 +4560,15 @@ enum dot11p_mode {
 #define CFG_SIFS_BURST_DURATION_DEFAULT  (8)
 
 /*
+ * 0: Disable BPF packet filter
+ * 1: Enable BPF packet filter
+ */
+#define CFG_BPF_PACKET_FILTER_OFFLOAD           "gBpfFilterEnable"
+#define CFG_BPF_PACKET_FILTER_OFFLOAD_MIN       (0)
+#define CFG_BPF_PACKET_FILTER_OFFLOAD_MAX       (1)
+#define CFG_BPF_PACKET_FILTER_OFFLOAD_DEFAULT   (1)
+
+/*
  * GPIO num used to wakeup host, 0xFF disable wakeup.
  * Default value is 0xFF
  */
@@ -4099,6 +4612,455 @@ enum dot11p_mode {
 #define CFG_TARGET_WAKEUP_TYPE_MAX        (4)
 #define CFG_TARGET_WAKEUP_TYPE_DEFAULT    (1)
 
+/*
+ * maximum interval (in seconds) for a
+ * single scan plan supported by the device.
+ */
+#define CFG_MAX_SCHED_SCAN_PLAN_INT_NAME       "g_max_sched_scan_plan_int"
+#define CFG_MAX_SCHED_SCAN_PLAN_INT_MIN        (1)
+#define CFG_MAX_SCHED_SCAN_PLAN_INT_MAX        (7200)
+#define CFG_MAX_SCHED_SCAN_PLAN_INT_DEFAULT    (3600)
+
+/*
+ * maximum number of iterations for a single
+ * scan plan supported by the device.
+ */
+#define CFG_MAX_SCHED_SCAN_PLAN_ITRNS_NAME       "g_max_sched_scan_plan_itrns"
+#define CFG_MAX_SCHED_SCAN_PLAN_ITRNS_MIN        (1)
+#define CFG_MAX_SCHED_SCAN_PLAN_ITRNS_MAX        (100)
+#define CFG_MAX_SCHED_SCAN_PLAN_ITRNS_DEFAULT    (10)
+/*
+ * g_sub20_channel_width=0: Indicates do not use Sub 20 MHz bandwidth
+ * g_sub20_channel_width=1: Bring up SAP/STA in 5 MHz bandwidth
+ * g_sub20_channel_width=2: Bring up SAP/STA in 10 MHz bandwidth
+ * g_sub20_channel_width=3: Switch between 5 and 20 MHz bandwidth dynamically
+ * g_sub20_channel_width=4: Switch between 10 and 20 MHz bandwidth dynamically
+ * g_sub20_channel_width=5: Switch between 5/10 and 20 MHz bandwidth dynamically
+ * g_sub20_channel_width=6: Switch between 5/10 and 20 MHz bandwidth manually
+ * Default : Disable
+ */
+#define CFG_SUB_20_CHANNEL_WIDTH_NAME      "g_sub20_channel_width"
+#define CFG_SUB_20_CHANNEL_WIDTH_DISABLE         (0)
+#define CFG_SUB_20_CHANNEL_WIDTH_5MHZ            (1)
+#define CFG_SUB_20_CHANNEL_WIDTH_10MHZ           (2)
+#define CFG_SUB_20_CHANNEL_WIDTH_DYN_5MHZ        (3)
+#define CFG_SUB_20_CHANNEL_WIDTH_DYN_10MHZ       (4)
+#define CFG_SUB_20_CHANNEL_WIDTH_DYN_ALL         (5)
+#define CFG_SUB_20_CHANNEL_WIDTH_MANUAL          (6)
+
+#define CFG_SUB_20_CHANNEL_WIDTH_MIN             (0)
+#define CFG_SUB_20_CHANNEL_WIDTH_MAX             (6)
+#define CFG_SUB_20_CHANNEL_WIDTH_DEFAULT         (0)
+
+#define CFG_STA_CHANGE_COUNTRYCODE_DYN_NAME     "g_sta_change_cc_via_beacon"
+#define CFG_STA_CHANGE_COUNTRYCODE_DYN_ENABLE   (1)
+#define CFG_STA_CHANGE_COUNTRYCODE_DYN_DISABLE  (0)
+#define CFG_STA_CHANGE_COUNTRYCODE_DYN_DEFAULT  (0)
+
+/*
+ * 5G preference parameters for boosting RSSI
+ * enable_band_specific_pref: Enable preference for 5G from INI.
+ * raise_rssi_thresh_5g: A_band_boost_threshold above which 5 GHz is favored.
+ * raise_factor_5g : Factor by which 5GHz RSSI is boosted.
+ * max_raise_rssi_5g: Maximum boost that can be applied to 5GHz RSSI.
+ */
+
+#define CFG_ENABLE_5G_BAND_PREF_NAME             "enable_5g_band_pref"
+#define CFG_ENABLE_5G_BAND_PREF_MIN              (0)
+#define CFG_ENABLE_5G_BAND_PREF_MAX              (1)
+#define CFG_ENABLE_5G_BAND_PREF_DEFAULT          (0)
+
+#define CFG_5G_RSSI_BOOST_THRESHOLD_NAME         "5g_rssi_boost_threshold"
+#define CFG_5G_RSSI_BOOST_THRESHOLD_MIN          (-55)
+#define CFG_5G_RSSI_BOOST_THRESHOLD_MAX          (-70)
+#define CFG_5G_RSSI_BOOST_THRESHOLD_DEFAULT      (-60)
+
+#define CFG_5G_RSSI_BOOST_FACTOR_NAME            "5g_rssi_boost_factor"
+#define CFG_5G_RSSI_BOOST_FACTOR_MIN             (0)
+#define CFG_5G_RSSI_BOOST_FACTOR_MAX             (2)
+#define CFG_5G_RSSI_BOOST_FACTOR_DEFAULT         (1)
+
+#define CFG_5G_MAX_RSSI_BOOST_NAME               "5g_max_rssi_boost"
+#define CFG_5G_MAX_RSSI_BOOST_MIN                (0)
+#define CFG_5G_MAX_RSSI_BOOST_MAX                (20)
+#define CFG_5G_MAX_RSSI_BOOST_DEFAULT            (10)
+
+/*
+ * 5G preference parameters for penalizing RSSI
+ * drop_rssi_thresh_5g: threshold below which 5 GHz is not favored.
+ * drop_factor_5g : Factor by which a weak 5GHz RSSI is penalized.
+ * max_drop_rssi_5g: Maximum penalty that can be applied to 5GHz RSSI.
+ */
+
+#define CFG_5G_RSSI_PENALIZE_THRESHOLD_NAME      "5g_rssi_penalize_threshold"
+#define CFG_5G_RSSI_PENALIZE_THRESHOLD_MIN       (-65)
+#define CFG_5G_RSSI_PENALIZE_THRESHOLD_MAX       (-80)
+#define CFG_5G_RSSI_PENALIZE_THRESHOLD_DEFAULT   (-70)
+
+#define CFG_5G_RSSI_PENALIZE_FACTOR_NAME         "5g_rssi_penalize_factor"
+#define CFG_5G_RSSI_PENALIZE_FACTOR_MIN          (0)
+#define CFG_5G_RSSI_PENALIZE_FACTOR_MAX          (2)
+#define CFG_5G_RSSI_PENALIZE_FACTOR_DEFAULT      (1)
+
+#define CFG_5G_MAX_RSSI_PENALIZE_NAME            "5g_max_rssi_penalize"
+#define CFG_5G_MAX_RSSI_PENALIZE_MIN             (0)
+#define CFG_5G_MAX_RSSI_PENALIZE_MAX             (20)
+#define CFG_5G_MAX_RSSI_PENALIZE_DEFAULT         (10)
+
+/* enable/disable probe request whiltelist IE feature */
+#define CFG_PRB_REQ_IE_WHITELIST_NAME    "g_enable_probereq_whitelist_ies"
+#define CFG_PRB_REQ_IE_WHITELIST_MIN     (0)
+#define CFG_PRB_REQ_IE_WHITELIST_MAX     (1)
+#define CFG_PRB_REQ_IE_WHITELIST_DEFAULT (0)
+/*
+ * For IE white listing in Probe Req, following ini parameters from
+ * g_probe_req_ie_bitmap_0 to g_probe_req_ie_bitmap_7 are used. User needs to
+ * input this values in hexa decimal format, when bit is set, corresponding ie
+ * needs to be included in probe request.
+ */
+#define CFG_PRB_REQ_IE_BIT_MAP0_NAME    "g_probe_req_ie_bitmap_0"
+#define CFG_PRB_REQ_IE_BIT_MAP0_MIN     (0x00000000)
+#define CFG_PRB_REQ_IE_BIT_MAP0_MAX     (0xFFFFFFFF)
+#define CFG_PRB_REQ_IE_BIT_MAP0_DEFAULT (0x00000000)
+
+#define CFG_PRB_REQ_IE_BIT_MAP1_NAME    "g_probe_req_ie_bitmap_1"
+#define CFG_PRB_REQ_IE_BIT_MAP1_MIN     (0x00000000)
+#define CFG_PRB_REQ_IE_BIT_MAP1_MAX     (0xFFFFFFFF)
+#define CFG_PRB_REQ_IE_BIT_MAP1_DEFAULT (0x00000000)
+
+#define CFG_PRB_REQ_IE_BIT_MAP2_NAME    "g_probe_req_ie_bitmap_2"
+#define CFG_PRB_REQ_IE_BIT_MAP2_MIN     (0x00000000)
+#define CFG_PRB_REQ_IE_BIT_MAP2_MAX     (0xFFFFFFFF)
+#define CFG_PRB_REQ_IE_BIT_MAP2_DEFAULT (0x00000000)
+
+#define CFG_PRB_REQ_IE_BIT_MAP3_NAME    "g_probe_req_ie_bitmap_3"
+#define CFG_PRB_REQ_IE_BIT_MAP3_MIN     (0x00000000)
+#define CFG_PRB_REQ_IE_BIT_MAP3_MAX     (0xFFFFFFFF)
+#define CFG_PRB_REQ_IE_BIT_MAP3_DEFAULT (0x00000000)
+
+#define CFG_PRB_REQ_IE_BIT_MAP4_NAME    "g_probe_req_ie_bitmap_4"
+#define CFG_PRB_REQ_IE_BIT_MAP4_MIN     (0x00000000)
+#define CFG_PRB_REQ_IE_BIT_MAP4_MAX     (0xFFFFFFFF)
+#define CFG_PRB_REQ_IE_BIT_MAP4_DEFAULT (0x00000000)
+
+#define CFG_PRB_REQ_IE_BIT_MAP5_NAME    "g_probe_req_ie_bitmap_5"
+#define CFG_PRB_REQ_IE_BIT_MAP5_MIN     (0x00000000)
+#define CFG_PRB_REQ_IE_BIT_MAP5_MAX     (0xFFFFFFFF)
+#define CFG_PRB_REQ_IE_BIT_MAP5_DEFAULT (0x00000000)
+
+#define CFG_PRB_REQ_IE_BIT_MAP6_NAME    "g_probe_req_ie_bitmap_6"
+#define CFG_PRB_REQ_IE_BIT_MAP6_MIN     (0x00000000)
+#define CFG_PRB_REQ_IE_BIT_MAP6_MAX     (0xFFFFFFFF)
+#define CFG_PRB_REQ_IE_BIT_MAP6_DEFAULT (0x00000000)
+
+#define CFG_PRB_REQ_IE_BIT_MAP7_NAME    "g_probe_req_ie_bitmap_7"
+#define CFG_PRB_REQ_IE_BIT_MAP7_MIN     (0x00000000)
+#define CFG_PRB_REQ_IE_BIT_MAP7_MAX     (0xFFFFFFFF)
+#define CFG_PRB_REQ_IE_BIT_MAP7_DEFAULT (0x00000000)
+
+/*
+ * For vendor specific IE, Probe Req OUI types and sub types which are
+ * to be white listed are specifed in gProbeReqOUIs in the following
+ * example format - gProbeReqOUIs=AABBCCDD EEFF1122
+ */
+#define CFG_PROBE_REQ_OUI_NAME    "gProbeReqOUIs"
+#define CFG_PROBE_REQ_OUI_DEFAULT ""
+
+#define CFG_RX_WAKELOCK_TIMEOUT_NAME         "rx_wakelock_timeout"
+#define CFG_RX_WAKELOCK_TIMEOUT_DEFAULT      (50)
+#define CFG_RX_WAKELOCK_TIMEOUT_MIN          (0)
+#define CFG_RX_WAKELOCK_TIMEOUT_MAX          (100)
+
+/*
+ * <ini>
+ * g_sap_chanswitch_beacon_cnt - channel switch beacon count
+ * @Min: 1
+ * @Max: 5
+ * @Default: 5
+ *
+ * This ini is used to configure channel switch beacon count
+ *
+ * Related: none
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_SAP_CH_SWITCH_BEACON_CNT         "g_sap_chanswitch_beacon_cnt"
+#define CFG_SAP_CH_SWITCH_BEACON_CNT_MIN     (1)
+#define CFG_SAP_CH_SWITCH_BEACON_CNT_MAX     (5)
+#define CFG_SAP_CH_SWITCH_BEACON_CNT_DEFAULT (5)
+
+/*
+ * <ini>
+ * g_sap_chanswitch_mode - channel switch mode
+ * @Min: 0
+ * @Max: 1
+ * @Default: 1
+ *
+ * This ini is used to configure channel switch mode
+ *
+ * Related: none
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_SAP_CH_SWITCH_MODE         "g_sap_chanswitch_mode"
+#define CFG_SAP_CH_SWITCH_MODE_MIN     (0)
+#define CFG_SAP_CH_SWITCH_MODE_MAX     (1)
+#define CFG_SAP_CH_SWITCH_MODE_DEFAULT (1)
+
+/*
+ * <ini>
+ * gDfsBeaconTxEnhanced - beacon tx enhanced
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * This ini is used to enhance dfs beacon tx
+ *
+ * Related: none
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_DFS_BEACON_TX_ENHANCED         "gDfsBeaconTxEnhanced"
+#define CFG_DFS_BEACON_TX_ENHANCED_MIN     (0)
+#define CFG_DFS_BEACON_TX_ENHANCED_MAX     (1)
+#define CFG_DFS_BEACON_TX_ENHANCED_DEFAULT (0)
+
+/*
+ * <ini>
+ * gReducedBeaconInterval - beacon interval reduced
+ * @Min: 0
+ * @Max: 100
+ * @Default: 0
+ *
+ * This ini is used to reduce beacon interval when val
+ * great than 0, or the feature is disabled.
+ *
+ * Related: none
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_REDUCED_BEACON_INTERVAL         "gReducedBeaconInterval"
+#define CFG_REDUCED_BEACON_INTERVAL_MIN     (0)
+#define CFG_REDUCED_BEACON_INTERVAL_MAX     (100)
+#define CFG_REDUCED_BEACON_INTERVAL_DEFAULT (0)
+
+#define CFG_NO_ACK_ENABLE         "gEnableNoAck"
+#define CFG_NO_ACK_MIN     (0)
+#define CFG_NO_ACK_MAX     (1)
+#define CFG_NO_ACK_DEFAULT (0)
+
+#ifdef FEATURE_COEX_PTA_CONFIG_ENABLE
+/*
+ * <ini>
+ * gCoexPtaConfigEnable - enable pta coex
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * This ini is used to enable the coexistence between QCA wifi and External BT.
+ * when val is 1, or the feature is disabled.
+ *
+ * Related: none
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+
+#define CFG_COEX_PTA_CONFIG_ENABLE         "gCoexPtaConfigEnable"
+#define CFG_COEX_PTA_CONFIG_ENABLE_MIN     (0)
+#define CFG_COEX_PTA_CONFIG_ENABLE_MAX     (2)
+#define CFG_COEX_PTA_CONFIG_ENABLE_DEFAULT (0)
+
+/*
+ * <ini>
+ * gCoexPtaConfigEnable - configure pta coex param
+ * @Min: 0x00000000
+ * @Max: 0xFFFFFFFF
+ * @Default: 0x00000000
+ *
+ * This ini is used to configure the coexistence param between QCA wifi and External BT.
+ *
+ * Related: none
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+
+#define CFG_COEX_PTA_CONFIG_PARAM         "gCoexPtaConfigParam"
+#define CFG_COEX_PTA_CONFIG_PARAM_MIN     (0x00000000)
+#define CFG_COEX_PTA_CONFIG_PARAM_MAX     (0xFFFFFFFF)
+#define CFG_COEX_PTA_CONFIG_PARAM_DEFAULT (0x00000000)
+#endif
+
+/*
+ * <ini>
+ * arp_ac_category - ARP access category
+ * @Min: 0
+ * @Max: 3
+ * @Default: 3
+ *
+ * Firmware by default categorizes ARP packets with VOICE TID.
+ * This ini shall be used to override the default configuration.
+ * Access category enums are referenced in ieee80211_common.h
+ * WME_AC_BE = 0 (Best effort)
+ * WME_AC_BK = 1 (Background)
+ * WME_AC_VI = 2 (Video)
+ * WME_AC_VO = 3 (Voice)
+ *
+ * Related: none
+ *
+ * Usage: Internal/External
+ *
+ * </ini>
+ */
+#define CFG_ARP_AC_CATEGORY                "arp_ac_category"
+#define CFG_ARP_AC_CATEGORY_MIN            (0)
+#define CFG_ARP_AC_CATEGORY_MAX            (3)
+#define CFG_ARP_AC_CATEGORY_DEFAULT        (3)
+
+/*
+ * gSapProbeRespOffload: when set in sap, offloads the
+ * probe response transmission to firmware
+ */
+#define CFG_SAP_PROBE_RESP_OFFLOAD_NAME    "gSapProbeRespOffload"
+#define CFG_SAP_PROBE_RESP_OFFLOAD_MIN     (0)
+#define CFG_SAP_PROBE_RESP_OFFLOAD_MAX     (1)
+#define CFG_SAP_PROBE_RESP_OFFLOAD_DEFAULT (1)
+
+/*
+ * <ini>
+ * gSkipMacConfig - skip mac config
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * This ini is used to avoid loading mac_wlan.bin if needed
+ * during startup to save time.
+ *
+ * Related: none
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_SKIP_MAC_CONFIG         "gSkipMacConfig"
+#define CFG_SKIP_MAC_CONFIG_MIN     (0)
+#define CFG_SKIP_MAC_CONFIG_MAX     (1)
+#define CFG_SKIP_MAC_CONFIG_DEFAULT (0)
+
+#ifdef WLAN_FEATURE_DSRC
+ /*
+ * <ini>
+ * gOcbTxPerPktStatsEnable - enable/disable OCB/DSRC tx per packet stats
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * This ini is used to avoid KPI throughput regression by disabling tx
+ * per packet stats that would degrade throughput.
+ *
+ * Related: HI_ACS_FLAGS_SDIO_REDUCE_TX_COMPL_SET
+ *
+ * Usage: Internal/External
+ *
+ * </ini>
+ */
+#define CFG_OCB_TX_PER_PKT_STATS_ENABLE_NAME    "gOcbTxPerPktStatsEnable"
+#define CFG_OCB_TX_PER_PKT_STATS_ENABLE_MIN     ( 0 )
+#define CFG_OCB_TX_PER_PKT_STATS_ENABLE_MAX     ( 1 )
+#define CFG_OCB_TX_PER_PKT_STATS_ENABLE_DEFAULT ( 0 )
+#endif /* WLAN_FEATURE_DSRC */
+
+/*
+ * <ini>
+ * gCCAThresholdEnable - enable/disable CCA threshold setting
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * This ini is used to overide CCA threshold for ESTI Adaptivity.
+ *
+ * Related: NOne
+ *
+ * Usage: Internal/External
+ *
+ * </ini>
+ */
+#define CFG_CCA_THRESHOLD_ENABLE_NAME    "gCCAThresholdEnable"
+#define CFG_CCA_THRESHOLD_ENABLE_MIN     (0)
+#define CFG_CCA_THRESHOLD_ENABLE_MAX     (1)
+#define CFG_CCA_THRESHOLD_ENABLE_DEFAULT (0)
+
+/*
+ * <ini>
+ * gCCAThreshold2G - CCA threshold for 2G band
+ * @Min: 10
+ * @Max: 127
+ * @Default: 28
+ *
+ * Once CCA threshold is enabled, this is threshold for 2G band.
+ *
+ * Related: None
+ *
+ * Usage: Internal/External
+ *
+ * </ini>
+ */
+#define CFG_CCA_THRESHOLD_2G_NAME    "gCCAThreshold2G"
+#define CFG_CCA_THRESHOLD_2G_MIN     (10)
+#define CFG_CCA_THRESHOLD_2G_MAX     (127)
+#define CFG_CCA_THRESHOLD_2G_DEFAULT (28)
+
+/*
+ * <ini>
+ * gCCAThreshold5G - CCA threshold for 5G band
+ * @Min: 10
+ * @Max: 127
+ * @Default: 28
+ *
+ * Once CCA threshold is enabled, this is threshold for 5G band.
+ *
+ * Related: None
+ *
+ * Usage: Internal/External
+ *
+ * </ini>
+ */
+#define CFG_CCA_THRESHOLD_5G_NAME    "gCCAThreshold5G"
+#define CFG_CCA_THRESHOLD_5G_MIN     (10)
+#define CFG_CCA_THRESHOLD_5G_MAX     (127)
+#define CFG_CCA_THRESHOLD_5G_DEFAULT (28)
+
+/*
+ * <ini>
+ * gEnableMonOnSta - extend the monitor capability for STA
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * this is used to control monitor feature for STA.
+ *
+ * Related: none
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_ENABLE_MONITOR_ON_STA	  "gEnableMonOnSta"
+#define CFG_ENABLE_MONITOR_ON_STA_MIN     (0)
+#define CFG_ENABLE_MONITOR_ON_STA_MAX     (1)
+#define CFG_ENABLE_MONITOR_ON_STA_DEFAULT (0)
+
 /*---------------------------------------------------------------------------
   Type declarations
   -------------------------------------------------------------------------*/
@@ -4137,6 +5099,7 @@ struct hdd_config {
    v_U32_t       nAutoBmpsTimerValue;
    eHddDot11Mode dot11Mode;
    v_U32_t       nChannelBondingMode24GHz;
+   bool          override_ht20_40_24g;
    v_U32_t       nChannelBondingMode5GHz;
    v_U32_t       MaxRxAmpduFactor;
    v_U16_t       TxRate;
@@ -4236,10 +5199,6 @@ struct hdd_config {
    /* In units of milliseconds */
    uint32_t       idle_time_conc;
 
-   v_U8_t         nNumStaChanCombinedConc;   //number of channels combined for
-                                             //STA in each split scan operation
-   v_U8_t         nNumP2PChanCombinedConc;   //number of channels combined for
-                                             //P2P in each split scan operation
 #endif
 
    v_U8_t         nMaxPsPoll;
@@ -4259,6 +5218,7 @@ struct hdd_config {
 
    //WMM QoS Configuration
    hdd_wmm_user_mode_t          WmmMode;
+   v_U8_t                       gStaLocalEDCAEnable;
    v_BOOL_t                     b80211eIsEnabled;
    v_U8_t                       UapsdMask;    // what ACs to setup U-APSD for at assoc
    v_U32_t                      InfraUapsdVoSrvIntv;
@@ -4390,12 +5350,10 @@ struct hdd_config {
    v_U16_t                     nTeleBcnTransLiNumIdleBeacons;
    v_U16_t                     nTeleBcnMaxLiNumIdleBeacons;
    v_U8_t                      bcnEarlyTermWakeInterval;
-   v_U32_t                     enableCloseLoop;
    v_U8_t                      enableBypass11d;
    v_U8_t                      enableDFSChnlScan;
    v_U8_t                      enable_dfs_pno_chnl_scan;
    v_U8_t                      enableDynamicDTIM;
-   v_U8_t                      enableAutomaticTxPowerControl;
    v_U8_t                      ShortGI40MhzEnable;
    eHddLinkSpeedReportType     reportMaxLinkSpeed;
    v_S31_t                     linkSpeedRssiHigh;
@@ -4412,14 +5370,10 @@ struct hdd_config {
    v_BOOL_t                    isP2pDeviceAddrAdministrated;
    v_U8_t                      thermalMitigationEnable;
    v_U32_t                     throttlePeriod;
-   uint32_t                    throttle_dutycycle_level0_2g;
-   uint32_t                    throttle_dutycycle_level1_2g;
-   uint32_t                    throttle_dutycycle_level2_2g;
-   uint32_t                    throttle_dutycycle_level3_2g;
-   uint32_t                    throttle_dutycycle_level0_5g;
-   uint32_t                    throttle_dutycycle_level1_5g;
-   uint32_t                    throttle_dutycycle_level2_5g;
-   uint32_t                    throttle_dutycycle_level3_5g;
+   uint32_t                    throttle_dutycycle_level0;
+   uint32_t                    throttle_dutycycle_level1;
+   uint32_t                    throttle_dutycycle_level2;
+   uint32_t                    throttle_dutycycle_level3;
 #if defined(CONFIG_HL_SUPPORT) && defined(QCA_BAD_PEER_TX_FLOW_CL)
    bool                        bad_peer_txctl_enable;
    uint32_t                    bad_peer_txctl_prd;
@@ -4455,8 +5409,10 @@ struct hdd_config {
    v_U8_t                      vhtRxMCS2x2;
    v_U8_t                      vhtTxMCS2x2;
    v_BOOL_t                    enable2x2;
-   uint8_t                     chain_mask_2g;
-   uint8_t                     chain_mask_5g;
+   uint8_t                     chain_mask_2g_rx;
+   uint8_t                     chain_mask_5g_rx;
+   uint8_t                     chain_mask_2g_tx;
+   uint8_t                     chain_mask_5g_tx;
    uint32_t                    vdev_type_nss_2g;
    uint32_t                    vdev_type_nss_5g;
    v_BOOL_t                    txchainmask1x1;
@@ -4579,6 +5535,9 @@ struct hdd_config {
 #endif
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
    v_U32_t                     WlanMccToSccSwitchMode;
+   bool                        wlan_band_switch_enable;
+   bool                        wlan_ap_p2pgo_conc_enable;
+   bool                        wlan_ap_p2pclient_conc_enable;
 #endif
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
    v_U32_t                     WlanAutoShutdown;
@@ -4588,6 +5547,7 @@ struct hdd_config {
    v_U8_t                      max_sap_peers;
    v_U8_t                      max_go_peers;
    v_U8_t                      disableDFSChSwitch;
+   v_U8_t                      enable_radar_war;
    v_U8_t                      enableDFSMasterCap;
    v_U16_t                     thermalTempMinLevel0;
    v_U16_t                     thermalTempMaxLevel0;
@@ -4597,9 +5557,21 @@ struct hdd_config {
    v_U16_t                     thermalTempMaxLevel2;
    v_U16_t                     thermalTempMinLevel3;
    v_U16_t                     thermalTempMaxLevel3;
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+   /* Thermal Shutdown feature is enabled or not. */
+   bool                    thermal_shutdown_enabled;
+   /* Thermal Shutdown is autonomous in driver or requested by user app. */
+   bool                    thermal_shutdown_auto_enabled;
+   uint16_t                     thermal_resume_threshold;
+   uint16_t                     thermal_warning_threshold;
+   uint16_t                     thermal_suspend_threshold;
+   uint16_t                     thermal_sample_rate;
+#endif
+
    v_U32_t                     TxPower2g;
    v_U32_t                     TxPower5g;
    v_U32_t                     gEnableDebugLog;
+   uint8_t                     enable_ac_txq_optimize;
    v_U8_t                      rxhandle;
    uint8_t                     cpu_map_list[CFG_RPS_RX_QUEUE_CPU_MAP_LIST_LEN];
    v_BOOL_t                    fDfsPhyerrFilterOffload;
@@ -4609,6 +5581,14 @@ struct hdd_config {
    v_BOOL_t                    fRegChangeDefCountry;
    v_U8_t                      acsScanBandPreference;
    uint32_t                    auto_channel_select_weight;
+   uint8_t                     enable_rts_sifsbursting;
+   uint8_t                     max_mpdus_inampdu;
+   uint16_t                    max_ht_mcs_txdata;
+   bool                        sap_get_peer_info;
+   bool                        disable_abg_rate_txdata;
+   uint8_t                     rate_for_tx_mgmt;
+   uint8_t                     rate_for_tx_mgmt_2g;
+   uint8_t                     rate_for_tx_mgmt_5g;
 #ifdef QCA_LL_TX_FLOW_CT
    v_U32_t                     TxFlowLowWaterMark;
    v_U32_t                     TxFlowHighWaterMarkOffset;
@@ -4653,6 +5633,15 @@ struct hdd_config {
    uint16_t                    pkt_bundle_timer_value;
    uint16_t                    pkt_bundle_size;
 #endif
+
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+   uint8_t                     del_ack_enable;
+   uint32_t                    del_ack_threshold_high;
+   uint32_t                    del_ack_threshold_low;
+   uint16_t                    del_ack_timer_value;
+   uint16_t                    del_ack_pkt_count;
+#endif
+
    /* FW debug log parameters */
    v_U32_t     enableFwLogType;
    v_U32_t     enableFwLogLevel;
@@ -4682,6 +5671,7 @@ struct hdd_config {
    bool                        crash_inject_enabled;
    v_S31_t                     dfsRadarPriMultiplier;
    v_U8_t                      reorderOffloadSupport;
+   uint8_t                     enable_hostapd_edca_local;
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
    v_BOOL_t                    isRoamOffloadEnabled;
@@ -4797,16 +5787,36 @@ struct hdd_config {
    uint32_t                    dynamic_wlan_bt_coex;
    uint32_t                    antenna_isolation;
 
+   uint32_t                    coex_page_p2p_sta_bt_interval;
+   uint32_t                    coex_page_p2p_sta_wlan_interval;
+
+   uint32_t                    coex_inquiry_sta_bt_interval;
+   uint32_t                    coex_inquiry_sta_wlan_interval;
+
+   uint32_t                    coex_inquiry_sap_bt_interval;
+   uint32_t                    coex_inquiry_sap_wlan_interval;
+
+   uint32_t                    coex_inquiry_p2p_bt_interval;
+   uint32_t                    coex_inquiry_p2p_wlan_interval;
+
+   uint32_t                    coex_inquiry_p2p_sta_bt_interval;
+   uint32_t                    coex_inquiry_p2p_sta_wlan_interval;
    uint32_t                    coex_tx_power;
 
-#ifdef WMI_COEX_BTC_DUTYCYCLE
-   uint32_t               coex_btc_PauseDuration;
-   uint32_t               coex_btc_UnPauseDuration;
+   v_BOOL_t                    gEnableNoAck;
+
+#ifdef FEATURE_COEX_PTA_CONFIG_ENABLE
+   uint8_t                     coex_pta_config_enable;
+   uint32_t                    coex_pta_config_param;
 #endif
 
    uint8_t                     inform_bss_rssi_raw;
 #ifdef WLAN_FEATURE_TSF
    uint32_t                    tsf_gpio_pin;
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+   uint8_t                     tsf_ptp_options;
+#endif /* WLAN_FEATURE_TSF_PLUS */
 #endif
    uint8_t                     multicast_host_fw_msgs;
    uint32_t                    fine_time_meas_cap;
@@ -4818,6 +5828,7 @@ struct hdd_config {
    uint16_t                    pkt_err_disconn_th;
    bool                        tx_chain_mask_cck;
    uint8_t                     tx_chain_mask_1ss;
+   uint8_t                     tx_sch_delay;
    uint16_t                    self_gen_frm_pwr;
 
 #ifdef FEATURE_WLAN_EXTSCAN
@@ -4884,7 +5895,7 @@ struct hdd_config {
 
    /* parameter to control GTX */
    uint32_t                    tgt_gtx_usr_cfg;
-   bool                        sap_restrt_ch_avoid;
+   bool                        sap_internal_restart;
    bool                        bug_on_reinit_failure;
    /* parameter to force sap into 11n */
    bool                        sap_force_11n_for_11ac;
@@ -4892,10 +5903,60 @@ struct hdd_config {
    bool                        active_mode_offload;
    /* parameter for indicating sifs burst duration to fw */
    uint8_t                     sifs_burst_duration;
+
+   bool                        bpf_packet_filter_enable;
+   /* parameter for defer timer for enabling TDLS on p2p listen */
+   uint16_t                    tdls_enable_defer_time;
    uint32_t                    host_wakeup_gpio;
    uint32_t                    host_wakeup_type;
    uint32_t                    target_wakeup_gpio;
    uint32_t                    target_wakeup_type;
+   uint32_t                    max_sched_scan_plan_interval;
+   uint32_t                    max_sched_scan_plan_iterations;
+   /* 5G preference parameters for boosting RSSI */
+   bool                        enable_5g_band_pref;
+   int8_t                      rssi_boost_threshold_5g;
+   uint8_t                     rssi_boost_factor_5g;
+   uint8_t                     max_rssi_boost_5g;
+  /* 5G preference parameters for dropping RSSI*/
+   int8_t                      rssi_penalize_threshold_5g;
+   uint8_t                     rssi_penalize_factor_5g;
+   uint8_t                     max_rssi_penalize_5g;
+
+   bool probe_req_ie_whitelist;
+   /* probe request bit map ies */
+   uint32_t probe_req_ie_bitmap_0;
+   uint32_t probe_req_ie_bitmap_1;
+   uint32_t probe_req_ie_bitmap_2;
+   uint32_t probe_req_ie_bitmap_3;
+   uint32_t probe_req_ie_bitmap_4;
+   uint32_t probe_req_ie_bitmap_5;
+   uint32_t probe_req_ie_bitmap_6;
+   uint32_t probe_req_ie_bitmap_7;
+
+   /* Probe Request multiple vendor OUIs */
+   uint8_t probe_req_ouis[MAX_PRB_REQ_VENDOR_OUI_INI_LEN];
+   /* parameter for indicating sub20 channel width */
+   uint8_t                     sub_20_channel_width;
+   bool                        sta_change_cc_via_beacon;
+   uint32_t                    rx_wakelock_timeout;
+   /* beacon count before channel switch */
+   uint8_t                     sap_chanswitch_beacon_cnt;
+   uint8_t                     sap_chanswitch_mode;
+   uint8_t                     dfs_beacon_tx_enhanced;
+   uint16_t                    reduced_beacon_interval;
+   uint32_t                    arp_ac_category;
+   /* parameter to control probe resp offloads */
+   bool                        sap_probe_resp_offload;
+   uint32_t                    sta_auth_retries_for_code17;
+   uint8_t                     skip_mac_config;
+#ifdef WLAN_FEATURE_DSRC
+   bool                        ocb_tx_per_pkt_stats_enabled;
+#endif
+   bool      cca_threshold_enable;
+   uint32_t  cca_threshold_2g;
+   uint32_t  cca_threshold_5g;
+   uint8_t                     mon_on_sta_enable;
 };
 
 typedef struct hdd_config hdd_config_t;
@@ -5013,6 +6074,9 @@ static __inline unsigned long utilMin( unsigned long a, unsigned long b )
   Function declarations and documentation
   -------------------------------------------------------------------------*/
 VOS_STATUS hdd_parse_config_ini(hdd_context_t *pHddCtx);
+uint32_t hdd_validate_prb_req_ie_bitmap(hdd_context_t* pHddCtx);
+VOS_STATUS hdd_parse_probe_req_ouis(hdd_context_t* pHddCtx);
+void hdd_free_probe_req_ouis(hdd_context_t* pHddCtx);
 VOS_STATUS hdd_update_mac_config(hdd_context_t *pHddCtx);
 VOS_STATUS hdd_set_sme_config( hdd_context_t *pHddCtx );
 VOS_STATUS hdd_set_sme_chan_list(hdd_context_t *hdd_ctx);
@@ -5034,6 +6098,14 @@ tANI_BOOLEAN hdd_is_okc_mode_enabled(hdd_context_t *pHddCtx);
 VOS_STATUS hdd_set_idle_ps_config(hdd_context_t *pHddCtx, v_U32_t val);
 
 void hdd_update_tgt_cfg(void *context, void *param);
+/**
+ * hdd_update_dfs_cac_block_tx_flag() - to set dfs_cac_block_tx flag
+ * @context: Pointer to hdd contex
+ * @cac_block_tx: value to be set
+ *
+ * Return: none
+ */
+void hdd_update_dfs_cac_block_tx_flag(void *context, bool cac_block_tx);
 bool hdd_dfs_indicate_radar(void *context, void *param);
 
 VOS_STATUS hdd_string_to_u8_array( char *str, tANI_U8 *intArray, tANI_U8 *len,
@@ -5060,4 +6132,69 @@ void print_hdd_cfg(hdd_context_t *pHddCtx);
 void hdd_set_btc_bt_wlan_interval(hdd_context_t *pHddCtx);
 
 VOS_STATUS hdd_update_nss(hdd_context_t *hdd_ctx, uint8_t nss);
+/**
+ * hdd_set_dfs_regdomain() - During SSR, restore DFS regulatory domain
+ * with valid value
+ * @phddctx: context for hdd
+ * @restore: valure to verify the state
+ *
+ * Return: None
+ */
+void hdd_set_dfs_regdomain(hdd_context_t *phddctx, bool restore);
+
+/**
+ * hdd_cfg_is_ptp_opt_enable - check if PTP Option is enabled
+ *
+ * @hdd_ctx_ptr: context for hdd
+ *
+ * This function returns true if PTP option is enabled, returns
+ * false if PTP option is disabled
+ */
+#ifdef WLAN_FEATURE_TSF_PLUS
+bool hdd_cfg_is_ptp_opt_enable(hdd_context_t *hdd_ctx_ptr);
+#else
+static inline
+bool hdd_cfg_is_ptp_opt_enable(hdd_context_t *hdd_ctx_ptr)
+{
+	return 0;
+}
+#endif
+
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+uint8_t hdd_cfg_get_sub20_dyn_capabilities(hdd_context_t *hdd_ctx_ptr);
+uint8_t hdd_cfg_get_static_sub20_channel_width(hdd_context_t *hdd_ctx_ptr);
+bool hdd_cfg_is_sub20_channel_width_enabled(hdd_context_t *hdd_ctx_ptr);
+bool hdd_cfg_is_static_sub20_channel_width_enabled(hdd_context_t *hdd_ctx_ptr);
+uint8_t hdd_cfg_get_sub20_channel_config(hdd_context_t *hdd_ctx_ptr);
+#else
+static inline
+uint8_t hdd_cfg_get_sub20_dyn_capabilities(hdd_context_t *hdd_ctx_ptr)
+{
+	return SUB20_MODE_NONE;
+}
+
+static inline
+uint8_t hdd_cfg_get_static_sub20_channel_width(hdd_context_t *hdd_ctx_ptr)
+{
+	return SUB20_MODE_NONE;
+}
+
+static inline
+bool hdd_cfg_is_sub20_channel_width_enabled(hdd_context_t *hdd_ctx_ptr)
+{
+	return false;
+}
+
+static inline
+bool hdd_cfg_is_static_sub20_channel_width_enabled(hdd_context_t *hdd_ctx_ptr)
+{
+	return false;
+}
+
+static inline
+uint8_t hdd_cfg_get_sub20_channel_config(hdd_context_t *hdd_ctx_ptr)
+{
+	return 0;
+}
+#endif
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_cfg80211.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_cfg80211.h
index efdf2b39c25..6b84e98c192 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_cfg80211.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_cfg80211.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -111,6 +111,9 @@
 
 #define MAX_CHANNEL (NUM_2_4GHZ_CHANNELS + NUM_5GHZ_CHANNELS)
 
+#define IS_CHANNEL_VALID(channel) ((channel >= 0 && channel < 15) \
+                     || (channel >= 36 && channel <= 184))
+
 typedef struct {
    u8 element_id;
    u8 len;
@@ -123,6 +126,28 @@ typedef struct {
 }__attribute__((packed)) qcom_ie_age ;
 #endif
 
+#ifndef NL80211_AUTHTYPE_FILS_SK
+#define NL80211_AUTHTYPE_FILS_SK 5
+#endif
+#ifndef NL80211_AUTHTYPE_FILS_SK_PFS
+#define NL80211_AUTHTYPE_FILS_SK_PFS 6
+#endif
+#ifndef NL80211_AUTHTYPE_FILS_PK
+#define NL80211_AUTHTYPE_FILS_PK 7
+#endif
+#ifndef WLAN_AKM_SUITE_FILS_SHA256
+#define WLAN_AKM_SUITE_FILS_SHA256 0x000FAC0E
+#endif
+#ifndef WLAN_AKM_SUITE_FILS_SHA384
+#define WLAN_AKM_SUITE_FILS_SHA384 0x000FAC0F
+#endif
+#ifndef WLAN_AKM_SUITE_FT_FILS_SHA256
+#define WLAN_AKM_SUITE_FT_FILS_SHA256 0x000FAC10
+#endif
+#ifndef WLAN_AKM_SUITE_FT_FILS_SHA384
+#define WLAN_AKM_SUITE_FT_FILS_SHA384 0x000FAC11
+#endif
+
 /* Vendor id to be used in vendor specific command and events
  * to user space.
  * NOTE: The authoritative place for definition of QCA_NL80211_VENDOR_ID,
@@ -216,13 +241,16 @@ enum qca_nl80211_vendor_subcmds {
     QCA_NL80211_VENDOR_SUBCMD_GET_WIFI_INFO = 61,
     /* Start Wifi Logger */
     QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_START = 62,
-    /* Start Wifi Memory Dump */
-    QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP = 63,
+
+    /* FW Memory Dump feature is deprecated */
+
     QCA_NL80211_VENDOR_SUBCMD_ROAM = 64,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST = 65,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SSID_HOTLIST = 66,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND = 67,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST = 68,
+
+    /*
+     * APIs corresponding to the sub commands 65-68 are deprecated.
+     * These sub commands are reserved and not supposed to be used
+     * for any other purpose
+     */
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_LIST = 69,
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST = 70,
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_RESET_PASSPOINT_LIST = 71,
@@ -269,6 +297,79 @@ enum qca_nl80211_vendor_subcmds {
 	QCA_NL80211_VENDOR_SUBCMD_ACS_POLICY = 116,
 	QCA_NL80211_VENDOR_SUBCMD_STA_CONNECT_ROAM_POLICY = 117,
 	QCA_NL80211_VENDOR_SUBCMD_SET_SAP_CONFIG  = 118,
+	QCA_NL80211_VENDOR_SUBCMD_GET_STATION = 121,
+
+	/* subcommand for link layer statistics extension */
+	QCA_NL80211_VENDOR_SUBCMD_LL_STATS_EXT = 127,
+	/* subcommand to get chain rssi value */
+	QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI = 138,
+	QCA_NL80211_VENDOR_SUBCMD_CHIP_PWRSAVE_FAILURE = 148,
+	/* subcommand to flush peer tids */
+	QCA_NL80211_VENDOR_SUBCMD_PEER_FLUSH_PENDING  = 162,
+
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+	/* Thermal Shutdown cmds to protect chip */
+	QCA_NL80211_VENDOR_SUBCMD_THERMAL_CMD = 165,
+	QCA_NL80211_VENDOR_SUBCMD_TEMPERATURE_EVENT = 166,
+	QCA_NL80211_VENDOR_SUBCMD_RESUME_COMP_EVENT = 167,
+#endif
+};
+
+/**
+ * enum qca_wlan_802_11_mode - dot11 mode
+ * @QCA_WLAN_802_11_MODE_INVALID: Invalid dot11 mode
+ * @QCA_WLAN_802_11_MODE_11A: mode A
+ * @QCA_WLAN_802_11_MODE_11B: mode B
+ * @QCA_WLAN_802_11_MODE_11G: mode G
+ * @QCA_WLAN_802_11_MODE_11N: mode N
+ * @QCA_WLAN_802_11_MODE_11AC: mode AC
+ */
+enum qca_wlan_802_11_mode {
+	QCA_WLAN_802_11_MODE_INVALID,
+	QCA_WLAN_802_11_MODE_11A,
+	QCA_WLAN_802_11_MODE_11B,
+	QCA_WLAN_802_11_MODE_11G,
+	QCA_WLAN_802_11_MODE_11N,
+	QCA_WLAN_802_11_MODE_11AC,
+};
+
+/**
+ * enum qca_wlan_auth_type - Authentication key management type
+ * @QCA_WLAN_AUTH_TYPE_INVALID: Invalid key management type
+ * @QCA_WLAN_AUTH_TYPE_OPEN: Open key
+ * @QCA_WLAN_AUTH_TYPE_SHARED: shared key
+ * @QCA_WLAN_AUTH_TYPE_WPA: wpa key
+ * @QCA_WLAN_AUTH_TYPE_WPA_PSK: wpa psk key
+ * @QCA_WLAN_AUTH_TYPE_WPA_NONE: wpa none key
+ * @QCA_WLAN_AUTH_TYPE_RSN: rsn key
+ * @QCA_WLAN_AUTH_TYPE_RSN_PSK: rsn psk key
+ * @QCA_WLAN_AUTH_TYPE_FT: ft key
+ * @QCA_WLAN_AUTH_TYPE_FT_PSK: ft psk key
+ * @QCA_WLAN_AUTH_TYPE_SHA256: shared 256 key
+ * @QCA_WLAN_AUTH_TYPE_SHA256_PSK: shared 256 psk
+ * @QCA_WLAN_AUTH_TYPE_WAI: wai key
+ * @QCA_WLAN_AUTH_TYPE_WAI_PSK wai psk key
+ * @QCA_WLAN_AUTH_TYPE_CCKM_WPA: cckm wpa key
+ * @QCA_WLAN_AUTH_TYPE_CCKM_RSN: cckm rsn key
+ */
+enum qca_wlan_auth_type {
+	QCA_WLAN_AUTH_TYPE_INVALID,
+	QCA_WLAN_AUTH_TYPE_OPEN,
+	QCA_WLAN_AUTH_TYPE_SHARED,
+	QCA_WLAN_AUTH_TYPE_WPA,
+	QCA_WLAN_AUTH_TYPE_WPA_PSK,
+	QCA_WLAN_AUTH_TYPE_WPA_NONE,
+	QCA_WLAN_AUTH_TYPE_RSN,
+	QCA_WLAN_AUTH_TYPE_RSN_PSK,
+	QCA_WLAN_AUTH_TYPE_FT,
+	QCA_WLAN_AUTH_TYPE_FT_PSK,
+	QCA_WLAN_AUTH_TYPE_SHA256,
+	QCA_WLAN_AUTH_TYPE_SHA256_PSK,
+	QCA_WLAN_AUTH_TYPE_WAI,
+	QCA_WLAN_AUTH_TYPE_WAI_PSK,
+	QCA_WLAN_AUTH_TYPE_CCKM_WPA,
+	QCA_WLAN_AUTH_TYPE_CCKM_RSN,
+	QCA_WLAN_AUTH_TYPE_AUTOSWITCH,
 };
 
 enum qca_nl80211_vendor_subcmds_index {
@@ -307,6 +408,7 @@ enum qca_nl80211_vendor_subcmds_index {
     QCA_NL80211_VENDOR_SUBCMD_LL_RADIO_STATS_INDEX,
     QCA_NL80211_VENDOR_SUBCMD_LL_IFACE_STATS_INDEX,
     QCA_NL80211_VENDOR_SUBCMD_LL_PEER_INFO_STATS_INDEX,
+    QCA_NL80211_VENDOR_SUBCMD_LL_STATS_EXT_INDEX,
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
     /* EXT TDLS */
     QCA_NL80211_VENDOR_SUBCMD_TDLS_STATE_CHANGE_INDEX,
@@ -327,21 +429,18 @@ enum qca_nl80211_vendor_subcmds_index {
     QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_PASSPOINT_NETWORK_FOUND_INDEX,
 #endif /* FEATURE_WLAN_EXTSCAN */
 
-#ifdef FEATURE_WLAN_EXTSCAN
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST_INDEX,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SSID_HOTLIST_INDEX,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND_INDEX,
-    QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST_INDEX,
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+    QCA_NL80211_VENDOR_SUBCMD_TEMPERATURE_EVENT_INDEX,
+    QCA_NL80211_VENDOR_SUBCMD_RESUME_COMP_EVENT_INDEX,
 #endif
+
     /* OCB events */
     QCA_NL80211_VENDOR_SUBCMD_DCC_STATS_EVENT_INDEX,
-#ifdef WLAN_FEATURE_MEMDUMP
-    QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP_INDEX,
-#endif /* WLAN_FEATURE_MEMDUMP */
     QCA_NL80211_VENDOR_SUBCMD_MONITOR_RSSI_INDEX,
 #ifdef WLAN_FEATURE_NAN_DATAPATH
     QCA_NL80211_VENDOR_SUBCMD_NDP_INDEX,
 #endif /* WLAN_FEATURE_NAN_DATAPATH */
+    QCA_NL80211_VENDOR_SUBCMD_PWR_SAVE_FAIL_DETECTED_INDEX,
 };
 
 /* EXT TDLS */
@@ -433,6 +532,21 @@ enum qca_wlan_vendor_attr {
     /* Unsigned 32-bit value from enum qca_set_band */
     QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE = 12,
 
+    /* used by QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI */
+    QCA_WLAN_VENDOR_ATTR_CHAIN_INDEX = 26,
+    QCA_WLAN_VENDOR_ATTR_CHAIN_RSSI = 27,
+
+    /* Used in QCA_NL80211_VENDOR_SUBCMD_STATS_EXT command
+     * to report frame aggregation statistics to userspace.
+     */
+    QCA_WLAN_VENDOR_ATTR_RX_AGGREGATION_STATS_HOLES_NUM = 34,
+    QCA_WLAN_VENDOR_ATTR_RX_AGGREGATION_STATS_HOLES_INFO = 35,
+
+    /* Used in QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI command
+     * to report the corresponding antenna index to the chain rssi value
+     */
+    QCA_WLAN_VENDOR_ATTR_ANTENNA_INFO = 40,
+
     /* keep last */
     QCA_WLAN_VENDOR_ATTR_AFTER_LAST,
     QCA_WLAN_VENDOR_ATTR_MAX =
@@ -786,10 +900,6 @@ enum qca_wlan_vendor_attr_extscan_results
     /* Unsigned 32bit value; a EXTSCAN Capabilities attribute. */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_NUM_WHITELISTED_SSID,
 
-    /* EXTSCAN attributes for
-     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND sub-command &
-     * QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST sub-command
-     */
     /* Use attr QCA_WLAN_VENDOR_ATTR_EXTSCAN_NUM_RESULTS_AVAILABLE
      * to indicate number of results.
      */
@@ -800,7 +910,14 @@ enum qca_wlan_vendor_attr_extscan_results
      */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_BUCKETS_SCANNED,
 
-
+    /*
+     * Unsigned 32bit value; a EXTSCAN Capabilities attribute to send maximum
+     * number of blacklist bssid's that firmware can support.
+     */
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_MAX_NUM_BLACKLISTED_BSSID,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+    QCA_WLAN_VENDOR_ATTR_EXTSCAN_PAD,
+#endif
     /* keep last */
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_AFTER_LAST,
     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_MAX =
@@ -1122,6 +1239,18 @@ enum qca_wlan_vendor_attr_ll_stats_results
      */
     QCA_WLAN_VENDOR_ATTR_LL_STATS_RADIO_TX_TIME_PER_LEVEL,
 
+    /* Unsigned 32bit value */
+    QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_RTS_SUCC_CNT,
+    /* Unsigned 32bit value */
+    QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_RTS_FAIL_CNT,
+    /* Unsigned 32bit value */
+    QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_PPDU_SUCC_CNT,
+    /* Unsigned 32bit value */
+    QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_PPDU_FAIL_CNT,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+    QCA_WLAN_VENDOR_ATTR_LL_STATS_PAD,
+#endif
+    QCA_WLAN_VENDOR_ATTR_LL_STATS_WMM_AC_PENDING_MSDU = 83,
     /* keep last */
     QCA_WLAN_VENDOR_ATTR_LL_STATS_AFTER_LAST,
     QCA_WLAN_VENDOR_ATTR_LL_STATS_MAX =
@@ -1301,6 +1430,8 @@ enum qca_wlan_vendor_attr_pno_config_params {
 	 */
 	QCA_WLAN_VENDOR_ATTR_EPNO_BAND5GHZ_BONUS = 22,
 
+        /* Unsigned 32-bit value, representing the PNO Request ID */
+        QCA_WLAN_VENDOR_ATTR_PNO_CONFIG_REQUEST_ID = 23,
 
 	/* keep last */
 	QCA_WLAN_VENDOR_ATTR_PNO_AFTER_LAST,
@@ -1448,6 +1579,54 @@ enum qca_wlan_vendor_attr_nd_offload {
 		QCA_WLAN_VENDOR_ATTR_ND_OFFLOAD_AFTER_LAST - 1,
 };
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+/**
+ * enum qca_wlan_vendor_attr_get_temperature_rsp - vendor subcmd to get chip
+ *	temperature
+ *
+ * @QCA_WLAN_VENDOR_ATTR_GET_TEMP_RSP_INVALID: invalid
+ * @QCA_WLAN_VENDOR_ATTR_GET_TEMP_RSP_TEMPERATURE: 32 bits temperature
+ *
+ * enum values are used for NL attributes for data used by
+ * QCA_NL80211_VENDOR_SUBCMD_GET_TEMPERATURE sub command.
+ */
+enum qca_wlan_vendor_attr_get_temperature_rsp {
+	QCA_WLAN_VENDOR_ATTR_GET_TEMP_RSP_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_GET_TEMP_RSP_TEMPERATURE,
+	QCA_WLAN_VENDOR_ATTR_GET_TEMP_RSP_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_GET_TEMP_RSP_MAX =
+		QCA_WLAN_VENDOR_ATTR_GET_TEMP_RSP_AFTER_LAST - 1,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_get_thermal_params_rsp - vendor subcmd to get
+ *	parameters of thermal shutdown feature
+ *
+ * @QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_INVALID: invalid
+ * @QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SHUTDOWN_EN: 8 bits flag
+ * @QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SHUTDOWN_AUTO_EN: 8 bits flag
+ * @QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_RESUME_THRESH: 16 bits threshold
+ * @QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_WARNING_THRESH: 16 bits threshold
+ * @QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SUSPEND_THRESH: 16 bits threshold
+ * @QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SAMPLE_RATE: 16 bits sample rate
+ *
+ * enum values are used for NL attributes for data used by
+ * QCA_NL80211_VENDOR_SUBCMD_GET_THERMAL_PARAMS sub command.
+ */
+enum qca_wlan_vendor_attr_get_thermal_params_rsp {
+	QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SHUTDOWN_EN,
+	QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SHUTDOWN_AUTO_EN,
+	QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_RESUME_THRESH,
+	QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_WARNING_THRESH,
+	QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SUSPEND_THRESH,
+	QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SAMPLE_RATE,
+	QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_MAX =
+		QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_AFTER_LAST - 1,
+};
+#endif
+
 /**
  * enum qca_wlan_vendor_features - vendor device/driver features
  * @QCA_WLAN_VENDOR_FEATURE_KEY_MGMT_OFFLOAD: Device supports key
@@ -1461,6 +1640,27 @@ enum qca_wlan_vendor_features {
         NUM_QCA_WLAN_VENDOR_FEATURES
 };
 
+/**
+ * enum qca_wlan_vendor_attr_flush_pending - Attributes for
+ * flush pending traffic in firmware.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_PEER_ADDR: Configure peer mac address.
+ * @QCA_WLAN_VENDOR_ATTR_AC: Configure access category the pending
+ *  packets using. It is u8 value with bit0~3 represent AC_BE, AC_BK,
+ *  AC_VI, AC_VO respectively. Set the corresponding bit to 1 to flush
+ *  packets with access category.
+ */
+enum qca_wlan_vendor_attr_flush_pending{
+	QCA_WLAN_VENDOR_ATTR_FLUSH_PENDING_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_PEER_ADDR = 1,
+	QCA_WLAN_VENDOR_ATTR_AC = 2,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_FLUSH_PENDING_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_FLUSH_PENDING_MAX =
+	QCA_WLAN_VENDOR_ATTR_FLUSH_PENDING_AFTER_LAST - 1,
+};
+
 /* Feature defines */
 #define WIFI_FEATURE_INFRA              0x0001   /* Basic infrastructure mode */
 #define WIFI_FEATURE_INFRA_5G           0x0002   /* Support for 5 GHz Band */
@@ -1489,6 +1689,10 @@ enum qca_wlan_vendor_features {
 #define WIFI_FEATURE_MKEEP_ALIVE        0x100000  /* WiFi mkeep_alive */
 #define WIFI_FEATURE_CONFIG_NDO         0x200000  /* ND offload configure */
 #define WIFI_FEATURE_TX_TRANSMIT_POWER  0x400000  /* Tx transmit power levels */
+#define WIFI_FEATURE_CONTROL_ROAMING    0x800000  /* Enable/Disable roaming */
+#define WIFI_FEATURE_IE_WHITELIST       0x1000000 /* Support Probe IE white listing */
+#define WIFI_FEATURE_SCAN_RAND          0x2000000 /* Support MAC & Probe Sequence Number randomization */
+
 
 /* Add more features here */
 #define WIFI_TDLS_SUPPORT			BIT(0)
@@ -1497,7 +1701,6 @@ enum qca_wlan_vendor_features {
 
 /**
  * enum wifi_logger_supported_features - values for supported logger features
- * @WIFI_LOGGER_MEMORY_DUMP_SUPPORTED - Memory dump of FW
  * @WIFI_LOGGER_PER_PACKET_TX_RX_STATUS_SUPPORTED - Per packet statistics
  * @WIFI_LOGGER_CONNECT_EVENT_SUPPORTED - Logging of Connectivity events
  * @WIFI_LOGGER_POWER_EVENT_SUPPORTED - Power of driver
@@ -1505,7 +1708,6 @@ enum qca_wlan_vendor_features {
  * @WIFI_LOGGER_WATCHDOG_TIMER_SUPPORTED - monitor FW health
  */
 enum wifi_logger_supported_features {
-	WIFI_LOGGER_MEMORY_DUMP_SUPPORTED = (1 << (0)),
 	WIFI_LOGGER_PER_PACKET_TX_RX_STATUS_SUPPORTED = (1 << (1)),
 	WIFI_LOGGER_CONNECT_EVENT_SUPPORTED = (1 << (2)),
 	WIFI_LOGGER_POWER_EVENT_SUPPORTED = (1 << (3)),
@@ -1555,6 +1757,33 @@ enum qca_wlan_vendor_acs_hw_mode {
         QCA_ACS_MODE_IEEE80211AD,
 };
 
+#define CFG_NON_AGG_RETRY_MAX                  (31)
+#define CFG_AGG_RETRY_MAX                      (31)
+#define CFG_MGMT_RETRY_MAX                     (31)
+#define CFG_CTRL_RETRY_MAX                     (31)
+#define CFG_PROPAGATION_DELAY_MAX              (63)
+#define CFG_PROPAGATION_DELAY_BASE             (64)
+#define CFG_AGG_RETRY_MIN                      (5)
+
+/**
+ * enum qca_access_policy - access control policy
+ *
+ * Access control policy is applied on the configured IE
+ * (QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY_IE).
+ * To be set with QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY.
+ *
+ * @QCA_ACCESS_POLICY_ACCEPT_UNLESS_LISTED: Deny Wi-Fi Connections which match
+ *	with the specific configuration (IE) set, i.e. allow all the
+ *	connections which do not match the configuration.
+ * @QCA_ACCESS_POLICY_DENY_UNLESS_LISTED: Accept Wi-Fi Connections which match
+ *	with the specific configuration (IE) set, i.e. deny all the
+ *	connections which do not match the configuration.
+ */
+enum qca_access_policy {
+	QCA_ACCESS_POLICY_ACCEPT_UNLESS_LISTED,
+	QCA_ACCESS_POLICY_DENY_UNLESS_LISTED,
+};
+
 /**
  * enum qca_wlan_vendor_config: wifi config attr
  *
@@ -1573,10 +1802,44 @@ enum qca_wlan_vendor_acs_hw_mode {
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_MGMT_RETRY: management frame sw retry threshold
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_CTRL_RETRY: control frame sw retry threshold
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_DELAY:
- *			     propagtion delay for 2G/5G band(Units in ms)
+ *			     propagation delay for 2G/5G band(Units in us)
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_TX_FAIL_COUNT: Unsigned 32-bit value to
  * configure the number of unicast TX fail packet count.
  * The peer is disconnected once this threshold is reached.
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES: Update the default scan IEs
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_COMMAND:
+ *                         Unsigned 32-bit value attribute for generic commands
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_VALUE:
+ *                  Unsigned 32-bit data attribute for generic command response
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_DATA:
+ *                  Unsigned 32-bit data attribute for generic command response
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_LENGTH:
+ *                                     Unsigned 32-bit length attribute for
+ *                                     QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_DATA
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_FLAGS:
+ * Unsigned 32-bit flags attribute for QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_DATA
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY: Vendor IE access policy
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY_IE_LIST: Vendor IE to be used
+ *                                                     with access policy
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_IFINDEX: interface index for vdev specific
+ *                                       parameters
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_QPOWER: Unsigned 8bit length attribute to update
+ *                                      power save config to turn off/on qpower
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VOICE:
+ *                  32-bit unsigned value to set reorder timeout for AC_VO
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VIDEO:
+ *                  32-bit unsigned value to set reorder timeout for AC_VI
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BESTEFFORT:
+ *                  32-bit unsigned value to set reorder timeout for AC_BE
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BACKGROUND:
+ *                  32-bit unsigned value to set reorder timeout for AC_BK
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_PEER_MAC:
+ *                  6-byte MAC address to point out the specific peer
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_WINLIMIT:
+ *                  32-bit unsigned value to set window size for specific peer
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_ABS_DELAY:
+ *                  32-bit unsigned value to configure the propagation absolute
+ *                  delay for 2G/5G band (units in us)
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_LAST: last config
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_MAX: max config
  */
@@ -1597,11 +1860,85 @@ enum qca_wlan_vendor_config {
 	QCA_WLAN_VENDOR_ATTR_CONFIG_CTRL_RETRY,
 	QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_DELAY,
 	QCA_WLAN_VENDOR_ATTR_CONFIG_TX_FAIL_COUNT,
+	/* Attribute used to set scan default IEs to the driver.
+	 *
+	 * These IEs can be used by scan operations that will be initiated by
+	 * the driver/firmware.
+	 *
+	 * For further scan requests coming to the driver, these IEs should be
+	 * merged with the IEs received along with scan request coming to the
+	 * driver. If a particular IE is present in the scan default IEs but not
+	 * present in the scan request, then that IE should be added to the IEs
+	 * sent in the Probe Request frames for that scan request. */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES,
+	/* Unsigned 32-bit attribute for generic commands */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_COMMAND,
+	/* Unsigned 32-bit value attribute for generic commands */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_VALUE,
+	/* Unsigned 32-bit data attribute for generic command response */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_DATA,
+	/* Unsigned 32-bit length attribute for
+	 * QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_DATA */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_LENGTH,
+	/* Unsigned 32-bit flags attribute for
+	 * QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_DATA */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_GENERIC_FLAGS,
+	/* Unsigned 32-bit, defining the access policy.
+	 * See enum qca_access_policy. Used with
+	 * QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY_IE_LIST. */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY,
+	/* Sets the list of full set of IEs for which a specific access policy
+	 * has to be applied. Used along with
+	 * QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY to control the access.
+	 * Zero length payload can be used to clear this access constraint. */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY_IE_LIST,
+	/* Unsigned 32-bit, specifies the interface index (netdev) for which the
+	 * corresponding configurations are applied. If the interface index is
+	 * not specified, the configurations are attributed to the respective
+	 * wiphy. */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_IFINDEX,
+	/* Unsigned 8-bit, for setting qpower dynamically */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_QPOWER,
+
+	/* 32-bit unsigned value to trigger antenna diversity features:
+	 * 1-Enable, 0-Disable */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_ENA = 27,
+	/* 32-bit unsigned value to configure specific chain antenna */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_CHAIN = 28,
+	/* 32-bit unsigned value to trigger cycle selftest
+	 * 1-Enable, 0-Disable */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SELFTEST = 29,
+	/* 32-bit unsigned to configure the cycle time of selftest
+	 * the unit is micro-second */
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SELFTEST_INTVL = 30,
+
+	QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VOICE = 31,
+	QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VIDEO = 32,
+	QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BESTEFFORT = 33,
+	QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BACKGROUND = 34,
+	QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_PEER_MAC = 35,
+	QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_WINLIMIT = 36,
+	QCA_WLAN_VENDOR_ATTR_CONFIG_SUB20_CHAN_WIDTH = 39,
+	QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_ABS_DELAY = 40,
+	/* 32-bit unsigned value to set probe period*/
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_PROBE_PERIOD = 41,
+	/* 32-bit unsigned value to set stay period*/
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_STAY_PERIOD = 42,
+	/* 32-bit unsigned value to set snr diff*/
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SNR_DIFF = 43,
+	/* 32-bit unsigned value to set probe dewll time*/
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_PROBE_DWELL_TIME = 44,
+	/* 32-bit unsigned value to set mgmt snr weight*/
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_MGMT_SNR_WEIGHT = 45,
+	/* 32-bit unsigned value to set data snr weight*/
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_DATA_SNR_WEIGHT = 46,
+	/* 32-bit unsigned value to set ack snr weight*/
+	QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_ACK_SNR_WEIGHT = 47,
 
 	/* keep last */
 	QCA_WLAN_VENDOR_ATTR_CONFIG_LAST,
 	QCA_WLAN_VENDOR_ATTR_CONFIG_MAX =
-	QCA_WLAN_VENDOR_ATTR_CONFIG_LAST - 1
+		QCA_WLAN_VENDOR_ATTR_CONFIG_LAST - 1
 };
 
 /**
@@ -1725,6 +2062,39 @@ enum qca_wlan_vendor_attr_rssi_monitoring {
 };
 
 /**
+ * qca_chip_power_save_failure_reason: Power save failure reason
+ * @QCA_CHIP_POWER_SAVE_FAILURE_REASON_PROTOCOL: Indicates power save failure
+ * due to protocol/module.
+ * @QCA_CHIP_POWER_SAVE_FAILURE_REASON_HARDWARE: power save failure
+ * due to hardware
+ */
+enum qca_chip_power_save_failure_reason {
+        QCA_CHIP_POWER_SAVE_FAILURE_REASON_PROTOCOL = 0,
+        QCA_CHIP_POWER_SAVE_FAILURE_REASON_HARDWARE = 1,
+};
+
+/**
+ * qca_attr_chip_power_save_failure: attributes to vendor subcmd
+ * @QCA_NL80211_VENDOR_SUBCMD_CHIP_PWRSAVE_FAILURE. This carry the requisite
+ * information leading to the power save failure.
+ * @QCA_ATTR_CHIP_POWER_SAVE_FAILURE_INVALID : invalid
+ * @QCA_ATTR_CHIP_POWER_SAVE_FAILURE_REASON : power save failure reason
+ * represented by enum qca_chip_power_save_failure_reason
+ * @QCA_ATTR_CHIP_POWER_SAVE_FAILURE_LAST : Last
+ * @QCA_ATTR_CHIP_POWER_SAVE_FAILURE_MAX : Max value
+ */
+enum qca_attr_chip_power_save_failure {
+	QCA_ATTR_CHIP_POWER_SAVE_FAILURE_INVALID = 0,
+
+	QCA_ATTR_CHIP_POWER_SAVE_FAILURE_REASON = 1,
+
+	/* keep last */
+	QCA_ATTR_CHIP_POWER_SAVE_FAILURE_LAST,
+	QCA_ATTR_CHIP_POWER_SAVE_FAILURE_MAX =
+		QCA_ATTR_CHIP_POWER_SAVE_FAILURE_LAST - 1,
+};
+
+/**
  * enum set_reset_packet_filter - set packet filter control commands
  * @QCA_WLAN_SET_PACKET_FILTER: Set Packet Filter
  * @QCA_WLAN_GET_PACKET_FILTER: Get Packet filter
@@ -1808,6 +2178,16 @@ enum qca_wlan_vendor_drv_info {
  * Rx wake packet count due to ipv6 multicast
  * @QCA_WLAN_VENDOR_ATTR_OTHER_RX_MULTICAST_CNT:
  * Rx wake packet count due to non-ipv4 and non-ipv6 packets
+ * @QCA_WLAN_VENDOR_ATTR_RSSI_BREACH_CNT:
+ * wake rssi breach packet count
+ * @QCA_WLAN_VENDOR_ATTR_LOW_RSSI_CNT:
+ * wake low rssi packet count
+ * @QCA_WLAN_VENDOR_ATTR_GSCAN_CNT:
+ * wake gscan packet count
+ * @QCA_WLAN_VENDOR_ATTR_PNO_COMPLETE_CNT:
+ * wake pno complete packet count
+ * @QCA_WLAN_VENDOR_ATTR_PNO_MATCH_CNT:
+ * wake pno match packet count
  */
 enum qca_wlan_vendor_attr_wake_stats {
 	QCA_WLAN_VENDOR_ATTR_GET_WAKE_STATS_INVALID = 0,
@@ -1829,6 +2209,11 @@ enum qca_wlan_vendor_attr_wake_stats {
 	QCA_WLAN_VENDOR_ATTR_ICMP4_RX_MULTICAST_CNT,
 	QCA_WLAN_VENDOR_ATTR_ICMP6_RX_MULTICAST_CNT,
 	QCA_WLAN_VENDOR_ATTR_OTHER_RX_MULTICAST_CNT,
+	QCA_WLAN_VENDOR_ATTR_RSSI_BREACH_CNT,
+	QCA_WLAN_VENDOR_ATTR_LOW_RSSI_CNT,
+	QCA_WLAN_VENDOR_ATTR_GSCAN_CNT,
+	QCA_WLAN_VENDOR_ATTR_PNO_COMPLETE_CNT,
+	QCA_WLAN_VENDOR_ATTR_PNO_MATCH_CNT,
 	/* keep last */
 	QCA_WLAN_VENDOR_GET_WAKE_STATS_AFTER_LAST,
 	QCA_WLAN_VENDOR_GET_WAKE_STATS_MAX =
@@ -1904,6 +2289,143 @@ enum qca_wlan_vendor_attr_sap_config {
 		QCA_WLAN_VENDOR_ATTR_SAP_CONFIG_AFTER_LAST - 1,
 };
 
+/**
+ * enum qca_wlan_vendor_attr_get_station - Sub commands used by
+ * QCA_NL80211_VENDOR_SUBCMD_GET_STATION to get the corresponding
+ * station information. The information obtained through these
+ * commands signify the current info in connected state and
+ * latest cached information during the connected state , if queried
+ * when in disconnected state.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INVALID: Invalid attribute
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO: bss info
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_ASSOC_FAIL_REASON: assoc fail reason
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_REMOTE: remote peer info
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_AFTER_LAST: After last
+ */
+enum qca_wlan_vendor_attr_get_station {
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO = 1,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_ASSOC_FAIL_REASON = 2,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_REMOTE = 3,
+
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_MAX =
+		QCA_WLAN_VENDOR_ATTR_GET_STATION_AFTER_LAST - 1,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_get_station_info - Station Info queried
+ * through QCA_NL80211_VENDOR_SUBCMD_GET_STATION.
+ *
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_INVALID: Invalid Attribute
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_LINK_STANDARD_NL80211_ATTR:
+ *  Get the standard NL attributes Nested with this attribute.
+ *  Ex : Query BW , BITRATE32 , NSS , Signal , Noise of the Link -
+ *  NL80211_ATTR_SSID / NL80211_ATTR_SURVEY_INFO (Connected Channel) /
+ *  NL80211_ATTR_STA_INFO
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AP_STANDARD_NL80211_ATTR:
+ *  Get the standard NL attributes Nested with this attribute.
+ *  Ex : Query HT/VHT Capability advertized by the AP.
+ *  NL80211_ATTR_VHT_CAPABILITY / NL80211_ATTR_HT_CAPABILITY
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_ROAM_COUNT:
+ *  Number of successful Roam attempts before a
+ *  disconnect, Unsigned 32 bit value
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AKM:
+ *  Authentication Key Management Type used for the connected session.
+ *  Signified by enum qca_wlan_auth_type
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_802_11_MODE: 802.11 Mode of the
+ *  connected Session, signified by enum qca_wlan_802_11_mode
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AP_HS20_INDICATION:
+ *  HS20 Indication Element
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_ASSOC_FAIL_REASON:
+ *  Status Code Corresponding to the Association Failure.
+ *  Unsigned 32 bit value.
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_MAX_PHY_RATE:
+ *  max phy rate for remote peer
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_TX_PACKETS:
+ *  tx packets for remote peer (interface layer)
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_TX_BYTES:
+ *  tx bytes for remote peer (interface layer)
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_RX_PACKETS:
+ *  rx packets for remote peer (interface layer)
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_RX_BYTES:
+ *  rx bytes for remote peer (interface layer)
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_LAST_TX_RATE:
+ *  last tx rate for remote peer (in kbps)
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_LAST_RX_RATE:
+ *  last rx rate for remote peer (in kbps)
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_WMM:
+ *  wmm for remote peer
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_SUPPORTED_MODE:
+ *  supported mode for remote peer
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_AMPDU:
+ *  ampdu for remote peer
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_TX_STBC:
+ *  tx stbc for remote peer
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_RX_STBC:
+ *  rx stbc for remote peer
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_CH_WIDTH:
+ *  ch widht for remote peer
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_SGI_ENABLE:
+ *  sgi enable for remote peer
+ * @QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AFTER_LAST: After last
+ */
+enum qca_wlan_vendor_attr_get_station_info {
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_LINK_STANDARD_NL80211_ATTR,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AP_STANDARD_NL80211_ATTR,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_ROAM_COUNT,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AKM,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_802_11_MODE,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AP_HS20_INDICATION,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_HT_OPERATION,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_VHT_OPERATION,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_ASSOC_FAIL_REASON,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_MAX_PHY_RATE,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_TX_PACKETS,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_TX_BYTES,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_RX_PACKETS,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_RX_BYTES,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_LAST_TX_RATE,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_LAST_RX_RATE,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_WMM,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_SUPPORTED_MODE,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_AMPDU,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_TX_STBC,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_RX_STBC,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_CH_WIDTH,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_SGI_ENABLE,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_PAD,
+#endif
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_MAX =
+		QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AFTER_LAST - 1,
+};
+
+/* define short names for get station info attributes */
+#define LINK_INFO_STANDARD_NL80211_ATTR \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_LINK_STANDARD_NL80211_ATTR
+#define AP_INFO_STANDARD_NL80211_ATTR \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AP_STANDARD_NL80211_ATTR
+#define INFO_ROAM_COUNT \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_ROAM_COUNT
+#define INFO_AKM \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AKM
+#define WLAN802_11_MODE \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_802_11_MODE
+#define AP_INFO_HS20_INDICATION \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AP_HS20_INDICATION
+#define HT_OPERATION \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_HT_OPERATION
+#define VHT_OPERATION \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_VHT_OPERATION
+#define INFO_ASSOC_FAIL_REASON \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_ASSOC_FAIL_REASON
+
 /** enum qca_vendor_attr_txpower_scale - vendor sub commands index
  * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_INVALID: invalid value
  * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE: scaling value
@@ -1937,6 +2459,316 @@ enum qca_vendor_attr_txpower_scale_decr_db {
 		QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_AFTER_LAST - 1
 };
 
+/**
+ * enum qca_wlan_vendor_attr_ll_stats_ext - Attributes for MAC layer monitoring
+ *    offload which is an extension for LL_STATS.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_PERIOD: Monitoring period. Unit in ms.
+ *    If MAC counters do not exceed the threshold, FW will report monitored
+ *    link layer counters periodically as this setting. The first report is
+ *    always triggered by this timer.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_THRESHOLD: It is a percentage (1-99).
+ *    For each MAC layer counter, FW holds two copies. One is the current value.
+ *    The other is the last report. Once a current counter's increment is larger
+ *    than the threshold, FW will indicate that counter to host even if the
+ *    monitoring timer does not expire.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_CHG: Peer STA power state change
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TID: TID of MSDU
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_NUM_MSDU: Count of MSDU with the same
+ *    failure code.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_STATUS: TX failure code
+ *    1: TX packet discarded
+ *    2: No ACK
+ *    3: Postpone
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_MAC_ADDRESS: peer MAC address
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_STATE: Peer STA current state
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_GLOBAL: Global threshold.
+ *    Threshold for all monitored parameters. If per counter dedicated threshold
+ *    is not enabled, this threshold will take effect.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_EVENT_MODE: Indicate what triggers this
+ *    event, PERORID_TIMEOUT == 1, THRESH_EXCEED == 0.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IFACE_ID: interface ID
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_ID: peer ID
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BITMAP: bitmap for TX counters
+ *    Bit0: TX counter unit in MSDU
+ *    Bit1: TX counter unit in MPDU
+ *    Bit2: TX counter unit in PPDU
+ *    Bit3: TX counter unit in byte
+ *    Bit4: Dropped MSDUs
+ *    Bit5: Dropped Bytes
+ *    Bit6: MPDU retry counter
+ *    Bit7: MPDU failure counter
+ *    Bit8: PPDU failure counter
+ *    Bit9: MPDU aggregation counter
+ *    Bit10: MCS counter for ACKed MPDUs
+ *    Bit11: MCS counter for Failed MPDUs
+ *    Bit12: TX Delay counter
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BITMAP: bitmap for RX counters
+ *    Bit0: MAC RX counter unit in MPDU
+ *    Bit1: MAC RX counter unit in byte
+ *    Bit2: PHY RX counter unit in PPDU
+ *    Bit3: PHY RX counter unit in byte
+ *    Bit4: Disorder counter
+ *    Bit5: Retry counter
+ *    Bit6: Duplication counter
+ *    Bit7: Discard counter
+ *    Bit8: MPDU aggregation size counter
+ *    Bit9: MCS counter
+ *    Bit10: Peer STA power state change (wake to sleep) counter
+ *    Bit11: Peer STA power save counter, total time in PS mode
+ *    Bit12: Probe request counter
+ *    Bit13: Other management frames counter
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CCA_BSS_BITMAP: bitmap for CCA
+ *    Bit0: Idle time
+ *    Bit1: TX time
+ *    Bit2: time RX in current bss
+ *    Bit3: Out of current bss time
+ *    Bit4: Wireless medium busy time
+ *    Bit5: RX in bad condition time
+ *    Bit6: TX in bad condition time
+ *    Bit7: time wlan card not availbe
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_SIGNAL_BITMAP: bitmap for signal
+ *    Bit0: Per channel SNR counter
+ *    Bit1: Per channel noise floor counter
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_NUM: number of peers
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CHANNEL_NUM: number of channels
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_AC_RX_NUM: number of RX stats
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CCA_BSS: per channel BSS CCA stats
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER: container for per PEER stats
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MSDU: Number of total TX MSDUs
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MPDU: Number of total TX MPDUs
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_PPDU: Number of total TX PPDUs
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BYTES: bytes of TX data
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP: Number of dropped TX packets
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP_BYTES: Bytes dropped
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_RETRY: waiting time without an ACK
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_ACK: number of MPDU not-ACKed
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_BACK: number of PPDU not-ACKed
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_AGGR_NUM:
+ *    aggregation stats buffer length
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_SUCC_MCS_NUM: length of mcs stats
+ *    buffer for ACKed MPDUs.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_FAIL_MCS_NUM: length of mcs stats
+ *    buffer for failed MPDUs.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_DELAY_ARRAY_SIZE:
+ *    length of delay stats array.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_AGGR: TX aggregation stats
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_SUCC_MCS: MCS stats for ACKed MPDUs
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_FAIL_MCS: MCS stats for failed MPDUs
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DELAY: tx delay stats
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU: MPDUs received
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_BYTES: bytes received
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU: PPDU received
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU_BYTES: PPDU bytes received
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_LOST: packets lost
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_RETRY: number of RX packets
+ *    flagged as retransmissions
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DUP: number of RX packets
+ *    flagged as duplicated
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DISCARD: number of RX
+ *    packets discarded
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_AGGR_NUM: length of RX aggregation
+ *    stats buffer.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MCS_NUM: length of RX mcs
+ *    stats buffer.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MCS: RX mcs stats buffer
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_AGGR: aggregation stats buffer
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_TIMES: times STAs go to sleep
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_DURATION: STAS' total sleep time
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PROBE_REQ: number of probe
+ *    requests received
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MGMT: number of other mgmt
+ *    frames received
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IDLE_TIME: Percentage of idle time
+ *    there is no TX, nor RX, nor interference.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_TIME: percentage of time
+ *    transmitting packets.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_TIME: percentage of time
+ *    for receiving.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BUSY: percentage of time
+ *    interference detected.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BAD: percentage of time
+ *    receiving packets with errors.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BAD: percentage of time
+ *    TX no-ACK.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_NO_AVAIL: percentage of time
+ *    the chip is unable to work in normal conditions.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IN_BSS_TIME: percentage of time
+ *    receiving packets in current BSS.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_OUT_BSS_TIME: percentage of time
+ *    receiving packets not in current BSS.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_ANT_NUM: number of antennas
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_SIGNAL:
+ *    This is a container for per antenna signal stats.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_SNR: per antenna SNR value
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_NF: per antenna NF value
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IFACE_RSSI_BEACON: RSSI of beacon
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IFACE_SNR_BEACON: SNR of beacon
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_REPORT_TIME: u64
+ *    Absolute timestamp from 1970/1/1, unit in ms. After receiving the
+ *    message, user layer APP could call gettimeofday to get another
+ *    timestamp and calculate transfer delay for the message.
+ * @QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_MEASUREMENT_TIME: u32
+ *    Real period for this measurement, unit in us.
+ */
+enum qca_wlan_vendor_attr_ll_stats_ext {
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_INVALID = 0,
+
+	/* Attributes for configurations */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_PERIOD,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_THRESHOLD,
+
+	/* Peer STA power state change */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_CHG,
+
+	/* TX failure event */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TID,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_NUM_MSDU,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_STATUS,
+
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_STATE,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_MAC_ADDRESS,
+
+	/* MAC counters */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_GLOBAL,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_EVENT_MODE,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IFACE_ID,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_ID,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BITMAP,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BITMAP,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CCA_BSS_BITMAP,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_SIGNAL_BITMAP,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_NUM,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CHANNEL_NUM,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CCA_BSS,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER,
+
+	/* Sub-attribute for PEER_AC_TX */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MSDU,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MPDU,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_PPDU,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BYTES,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP_BYTES,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_RETRY,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_ACK,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_BACK,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_AGGR_NUM,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_SUCC_MCS_NUM,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_FAIL_MCS_NUM,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_AGGR,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_SUCC_MCS,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_FAIL_MCS,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_DELAY_ARRAY_SIZE,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DELAY,
+
+	/* sub-attribute for PEER_AC_RX */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_BYTES,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU_BYTES,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_LOST,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_RETRY,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DUP,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DISCARD,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_AGGR_NUM,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MCS_NUM,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MCS,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_AGGR,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_TIMES,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_DURATION,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PROBE_REQ,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MGMT,
+
+	/* sub-attribute for CCA_BSS */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IDLE_TIME,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_TIME,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_TIME,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BUSY,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BAD,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BAD,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_NO_AVAIL,
+
+	/* sub-attribtue for BSS_RX_TIME */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IN_BSS_TIME,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_OUT_BSS_TIME,
+
+	/* sub-attribute for PEER_SIGNAL */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_ANT_NUM,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_SIGNAL,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_SNR,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_NF,
+
+	/* sub-attribute for IFACE_BSS */
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IFACE_RSSI_BEACON,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IFACE_SNR_BEACON,
+
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_REPORT_TIME,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_MEASUREMENT_TIME,
+
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_LAST,
+	QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_MAX =
+		QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_LAST - 1,
+};
+
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+/**
+ * enum wlan_ts_cmds - thermal commands.
+ *
+ * @WLAN_TS_CMD_GET_PARAMS:
+ * Get the configuration parameters for thermal shutdown for user.
+ * @WLAN_TS_CMD_GET_TEMP:
+ * Get the temperature from FW and send it to user.
+ * @WLAN_TS_CMD_SUSPEND:
+ * Execute the suspend command issued from user.
+ * @WLAN_TS_CMD_RESUME:
+ * Execute the resume command issued from user.
+ */
+enum wlan_ts_cmds {
+	WLAN_TS_CMD_NONE,
+	WLAN_TS_CMD_GET_PARAMS,
+	WLAN_TS_CMD_GET_TEMP,
+	WLAN_TS_CMD_SUSPEND,
+	WLAN_TS_CMD_RESUME,
+};
+
+/**
+ * enum qca_wlan_vendor_attr_thermal_drv_cmd - thermal command value for vendor
+ * sub-command QCA_NL80211_VENDOR_SUBCMD_THERMAL_CMD
+ * @QCA_WLAN_VENDOR_ATTR_THM_CMD_VALUE:
+ * The value of command, driver will implement different operations according
+ * to this value.
+ */
+enum qca_wlan_vendor_attr_thermal_drv_cmd {
+	QCA_WLAN_VENDOR_ATTR_THM_CMD_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_THM_CMD_VALUE,
+	QCA_WLAN_VENDOR_ATTR_THM_CMD_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_THM_CMD_MAX =
+		QCA_WLAN_VENDOR_ATTR_THM_CMD_AFTER_LAST - 1,
+};
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0))
+/**
+ * enum ieee80211_band - supported frequency bands
+ *
+ * The bands are assigned this way because the supported
+ * bitrates differ in these bands.
+ *
+ * @IEEE80211_BAND_2GHZ: 2.4GHz ISM band
+ * @IEEE80211_BAND_5GHZ: around 5GHz band (4.9-5.7)
+ * @IEEE80211_BAND_60GHZ: around 60 GHz band (58.32 - 64.80 GHz)
+ * @IEEE80211_NUM_BANDS: number of defined bands
+ */
+enum ieee80211_band {
+	IEEE80211_BAND_2GHZ = NL80211_BAND_2GHZ,
+	IEEE80211_BAND_5GHZ = NL80211_BAND_5GHZ,
+	IEEE80211_BAND_60GHZ = NL80211_BAND_60GHZ,
+
+	/* keep last */
+	IEEE80211_NUM_BANDS
+};
+#endif
+
 struct cfg80211_bss* wlan_hdd_cfg80211_update_bss_db( hdd_adapter_t *pAdapter,
                                       tCsrRoamInfo *pRoamInfo
                                       );
@@ -2008,6 +2840,8 @@ extern void wlan_hdd_cfg80211_update_replayCounterCallback(void *callbackContext
 void* wlan_hdd_change_country_code_cb(void *pAdapter);
 void hdd_select_cbmode(hdd_adapter_t *pAdapter, v_U8_t operationChannel,
                 uint16_t *ch_width);
+void hdd_select_mon_cbmode(hdd_adapter_t *adapter, v_U8_t operation_channel,
+                           uint16_t *ch_width);
 
 v_U8_t* wlan_hdd_cfg80211_get_ie_ptr(const v_U8_t *pIes,
                                      int length,
@@ -2035,8 +2869,8 @@ void wlan_hdd_testmode_rx_event(void *buf, size_t buf_len);
 #endif
 
 void hdd_suspend_wlan(void (*callback)(void *callbackContext, boolean suspended),
-                      void *callbackContext);
-void hdd_resume_wlan(void);
+                      void *callbackContext, bool thermal);
+void hdd_resume_wlan(bool thermal);
 
 #if defined(FEATURE_WLAN_CH_AVOID) || defined(FEATURE_WLAN_FORCE_SAP_SCC)
 int wlan_hdd_send_avoid_freq_event(hdd_context_t *pHddCtx,
@@ -2049,14 +2883,24 @@ void wlan_hdd_cfg80211_extscan_callback(void *ctx,
                                       void *pMsg);
 #endif /* FEATURE_WLAN_EXTSCAN */
 
+void wlan_hdd_cfg80211_chainrssi_callback(void *ctx, void *pmsg);
+
 void hdd_rssi_threshold_breached(void *hddctx,
 				 struct rssi_breach_event *data);
 
 struct cfg80211_bss* wlan_hdd_cfg80211_update_bss_list(
    hdd_adapter_t *pAdapter, tSirMacAddr bssid);
+int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
+                                   struct cfg80211_wowlan *wow, bool thermal);
 
 int wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
                                    struct cfg80211_wowlan *wow);
+int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy, bool thermal);
+int wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy);
+
+bool hdd_system_suspend_state_set(hdd_context_t *hdd_ctx, bool state);
+int hdd_thermal_suspend_state(hdd_context_t *hdd_ctx);
+
 void wlan_hdd_cfg80211_acs_ch_select_evt(hdd_adapter_t *adapter);
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 int wlan_hdd_send_roam_auth_event(hdd_context_t *hdd_ctx_ptr, uint8_t *bssid,
@@ -2124,4 +2968,29 @@ static inline void wlan_hdd_cfg80211_indicate_disconnect(struct net_device *dev,
 				GFP_KERNEL);
 }
 #endif
+
+/**
+ * enum wlan_hdd_scan_type_for_randomization - type of scan
+ * @WLAN_HDD_HOST_SCAN: refers to scan request from cfg80211_ops "scan"
+ * @WLAN_HDD_PNO_SCAN: refers to scan request is from "sched_scan_start"
+ *
+ * driver uses this enum to identify source of scan
+ *
+ */
+enum wlan_hdd_scan_type_for_randomization {
+	WLAN_HDD_HOST_SCAN,
+	WLAN_HDD_PNO_SCAN,
+};
+
+int wlan_hdd_try_disconnect(hdd_adapter_t *pAdapter);
+
+/**
+ * wlan_hdd_cfg80211_scan_block_cb() - scan block work handler
+ * @work: Pointer to work
+ *
+ * This function is used to do scan block work handler
+ *
+ * Return: None
+ */
+void wlan_hdd_cfg80211_scan_block_cb(struct work_struct *work);
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_debugfs.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_debugfs.h
index 40415fd154e..37fc5709fcf 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_debugfs.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_debugfs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -29,15 +29,24 @@
 #define _WLAN_HDD_DEBUGFS_H
 
 #ifdef WLAN_OPEN_SOURCE
+#define MAX_USER_COMMAND_SIZE_FRAME 4096
+
 VOS_STATUS hdd_debugfs_init(hdd_adapter_t *pAdapter);
 void hdd_debugfs_exit(hdd_context_t *pHddCtx);
+int wlan_hdd_debugfs_open(struct inode *inode, struct file *file);
 #else
-inline VOS_STATUS hdd_debugfs_init(hdd_adapter_t *pAdapter)
+static inline VOS_STATUS hdd_debugfs_init(hdd_adapter_t *pAdapter)
 {
-    return VOS_STATUS_SUCCESS;
+	return VOS_STATUS_SUCCESS;
 }
-inline void hdd_debugfs_exit(hdd_context_t *pHddCtx)
+
+static inline void hdd_debugfs_exit(hdd_context_t *pHddCtx)
+{
+}
+
+static inline int wlan_hdd_debugfs_open(struct inode *inode, struct file *file)
 {
+	return 0;
 }
 #endif /* #ifdef WLAN_OPEN_SOURCE */
 #endif /* #ifndef _WLAN_HDD_DEBUGFS_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_debugfs_ocb.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_debugfs_ocb.h
new file mode 100644
index 00000000000..2536de387d5
--- /dev/null
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_debugfs_ocb.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WLAN_HDD_DEBUGFS_OCB_H
+#define _WLAN_HDD_DEBUGFS_OCB_H
+
+#ifdef WLAN_FEATURE_DSRC
+int
+wlan_hdd_create_dsrc_chan_stats_file(hdd_adapter_t *adapter,
+				     hdd_context_t *hdd_ctx);
+int
+wlan_hdd_create_dsrc_tx_stats_file(hdd_adapter_t *adapter,
+				   hdd_context_t *hdd_ctx);
+#else
+static inline int
+wlan_hdd_create_dsrc_chan_stats_file(hdd_adapter_t *adapter,
+				     hdd_context_t *hdd_ctx)
+{
+	return 0;
+}
+
+static inline int
+wlan_hdd_create_dsrc_tx_stats_file(hdd_adapter_t *adapter,
+				   hdd_context_t *hdd_ctx)
+{
+	return 0;
+}
+#endif /* #ifdef WLAN_FEATURE_DSRC */
+#endif /* #ifndef _WLAN_HDD_DEBUGFS_OCB_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_ftm.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_ftm.h
index a0260a78f64..ef167568648 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_ftm.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_ftm.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -60,6 +60,12 @@ int wlan_hdd_ftm_close(hdd_context_t *pHddCtx);
 #if  defined(QCA_WIFI_FTM)
 VOS_STATUS wlan_hdd_ftm_testmode_cmd(void *data, int len, boolean from_qcmbr);
 int wlan_hdd_qcmbr_unified_ioctl(hdd_adapter_t *pAdapter, struct ifreq *ifr);
+VOS_STATUS hdd_ftm_start(hdd_context_t *pHddCtx);
+#else
+static inline VOS_STATUS hdd_ftm_start(hdd_context_t *pHddCtx)
+{
+	return VOS_STATUS_SUCCESS;
+}
 #endif
 
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_hostapd.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_hostapd.h
index 574bb75b8b6..2a08dc9b031 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_hostapd.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_hostapd.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -92,11 +92,13 @@ int hdd_softap_unpackIE( tHalHandle halHandle,
                 u_int8_t *gen_ie );
 
 VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCallback);
-VOS_STATUS hdd_init_ap_mode( hdd_adapter_t *pAdapter );
+VOS_STATUS hdd_init_ap_mode( hdd_adapter_t *pAdapter, bool reinit);
 void hdd_set_ap_ops( struct net_device *pWlanHostapdDev );
 int hdd_hostapd_stop (struct net_device *dev);
 void hdd_hostapd_channel_wakelock_init(hdd_context_t *pHddCtx);
 void hdd_hostapd_channel_wakelock_deinit(hdd_context_t *pHddCtx);
+void hdd_sap_indicate_disconnect_for_sta(hdd_adapter_t *adapter);
+void hdd_sap_destroy_events(hdd_adapter_t *adapter);
 #ifdef FEATURE_WLAN_FORCE_SAP_SCC
 void hdd_restart_softap (hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter);
 #endif /* FEATURE_WLAN_FORCE_SAP_SCC */
@@ -221,4 +223,39 @@ hdd_change_ch_avoidance_status(hdd_context_t *hdd_ctx,
     hddLog(LOG1, FL("is_ch_avoid_in_progress %d"), value);
 }
 
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+bool hdd_hostapd_sub20_channelwidth_can_switch(
+	hdd_adapter_t *adapter, uint32_t *sub20_channel_width);
+bool hdd_hostapd_sub20_channelwidth_can_restore(
+	hdd_adapter_t *adapter);
+bool hdd_sub20_channelwidth_can_set(
+	hdd_adapter_t *adapter, uint32_t sub20_channel_width);
+int hdd_softap_set_channel_sub20_chanwidth_change(
+	struct net_device *dev, uint32_t chan_width);
+#else
+static inline bool hdd_hostapd_sub20_channelwidth_can_switch(
+	hdd_adapter_t *adapter, uint32_t *sub20_channel_width)
+{
+	return false;
+}
+
+static inline bool hdd_hostapd_sub20_channelwidth_can_restore(
+	hdd_adapter_t *adapter)
+{
+	return false;
+}
+
+static inline bool hdd_sub20_channelwidth_can_set(
+	hdd_adapter_t *adapter, uint32_t sub20_channel_width)
+{
+	return false;
+}
+
+static inline
+int hdd_softap_set_channel_sub20_chanwidth_change(
+	struct net_device *dev, uint32_t chan_width)
+{
+	return -ENOTSUPP;
+}
+#endif
 #endif    // end #if !defined( WLAN_HDD_HOSTAPD_H )
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_ipa.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_ipa.h
index 19809be3648..17a88412fae 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_ipa.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_ipa.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -63,6 +63,8 @@ int hdd_ipa_set_perf_level(hdd_context_t *hdd_ctx, uint64_t tx_packets,
 int hdd_ipa_suspend(hdd_context_t *hdd_ctx);
 int hdd_ipa_resume(hdd_context_t *hdd_ctx);
 void hdd_ipa_ready_cb(hdd_context_t *hdd_ctx);
+bool hdd_ipa_is_present(hdd_context_t *hdd_ctx);
+void hdd_ipa_reset_ipaconfig(hdd_context_t *hdd_ctx, v_U32_t ipaconfig);
 
 #ifdef IPA_UC_STA_OFFLOAD
 int hdd_ipa_send_mcc_scc_msg(hdd_context_t *hdd_ctx, bool mcc_mode);
@@ -70,7 +72,7 @@ int hdd_ipa_send_mcc_scc_msg(hdd_context_t *hdd_ctx, bool mcc_mode);
 
 #ifdef IPA_UC_OFFLOAD
 void hdd_ipa_uc_force_pipe_shutdown(hdd_context_t *hdd_ctx);
-int hdd_ipa_uc_ssr_reinit(void);
+int hdd_ipa_uc_ssr_reinit(hdd_context_t *hdd_ctx);
 int hdd_ipa_uc_ssr_deinit(void);
 void hdd_ipa_uc_stat_query(hdd_context_t *pHddCtx,
 	uint32_t *ipa_tx_diff, uint32_t *ipa_rx_diff);
@@ -78,6 +80,33 @@ void hdd_ipa_uc_stat_request( hdd_adapter_t *adapter, uint8_t reason);
 void hdd_ipa_uc_rt_debug_host_dump(hdd_context_t *hdd_ctx);
 void hdd_ipa_dump_info(hdd_context_t *hdd_ctx);
 #endif /* IPA_UC_OFFLOAD */
+#else /* IPA_OFFLOAD */
+#define hdd_ipa_set_perf_level(hdd_ctx, tx_p, rx_p) /* no-op */
+/**
+ * hdd_ipa_is_present() - get IPA hw status
+ * @hdd_ctx: pointer to hdd context
+ *
+ * Return: true - ipa hw present
+ *         false - ipa hw not present
+ */
+static inline
+bool hdd_ipa_is_present(hdd_context_t *hdd_ctx)
+{
+	return false;
+}
+
+/**
+ * hdd_ipa_reset_ipaconfig() - reset IpaConfig
+ * @hdd_ctx: pointer to hdd context
+ * @ipaconfig: new value for IpaConfig
+ *
+ * Return: none
+ */
+static inline
+void hdd_ipa_reset_ipaconfig(hdd_context_t *hdd_ctx, v_U32_t ipaconfig)
+{
+	return;
+}
 #endif /* IPA_OFFLOAD */
 
 #if !defined(IPA_OFFLOAD) || !defined(IPA_UC_OFFLOAD)
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_main.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_main.h
index f2e4b46e50a..2f9e90e8c76 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_main.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_main.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -102,6 +102,7 @@
 #define DEVICE_IFACE_OPENED    (5)
 #define TDLS_INIT_DONE         (6)
 #define ACS_PENDING            (7)
+#define SOFTAP_INIT_DONE       (8)
 
 /* HDD global event flags */
 #define ACS_IN_PROGRESS        (0)
@@ -119,6 +120,7 @@
 #define WLAN_WAIT_TIME_ABORTSCAN  2000
 #define WLAN_WAIT_TIME_EXTSCAN  1000
 #define WLAN_WAIT_TIME_LL_STATS 800
+#define WLAN_WAIT_TIME_POWER_STATS 800
 
 #define WLAN_WAIT_SMPS_FORCE_MODE  500
 
@@ -149,6 +151,10 @@
 
 #define WLAN_WAIT_TIME_BPF     1000
 
+#define WLAN_WAIT_TIME_CHAIN_RSSI  1000
+
+#define WLAN_WAIT_TIME_SET_RND 100
+
 #define MAX_NUMBER_OF_ADAPTERS 4
 
 #define MAX_CFG_STRING_LEN  255
@@ -199,9 +205,6 @@
 
 #define WLAN_HDD_PUBLIC_ACTION_TDLS_DISC_RESP 14
 #define WLAN_HDD_TDLS_ACTION_FRAME 12
-#ifdef WLAN_FEATURE_HOLD_RX_WAKELOCK
-#define HDD_WAKE_LOCK_DURATION 50 //in msecs
-#endif
 
 #define WLAN_HDD_QOS_ACTION_FRAME 1
 #define WLAN_HDD_QOS_MAP_CONFIGURE 4
@@ -215,7 +218,11 @@
 
 /* Maximum number of interfaces allowed(STA, P2P Device, P2P Interfaces) */
 #ifndef WLAN_OPEN_P2P_INTERFACE
+#ifdef WLAN_4SAP_CONCURRENCY
+#define WLAN_MAX_INTERFACES 4
+#else
 #define WLAN_MAX_INTERFACES 3
+#endif
 #else
 #define WLAN_MAX_INTERFACES 4
 #endif
@@ -257,6 +264,36 @@
 
 typedef v_U8_t tWlanHddMacAddr[HDD_MAC_ADDR_LEN];
 
+#define HDD_BW_GET_DIFF(_x, _y) (unsigned long)((ULONG_MAX - (_y)) + (_x) + 1)
+
+#define MAX_PROBE_REQ_OUIS 16
+
+#define SCAN_REJECT_THRESHOLD_TIME 300000 /* Time is in msec, equal to 5 mins */
+#define SCAN_REJECT_THRESHOLD 15
+
+
+/*
+ * @eHDD_SCAN_REJECT_DEFAULT: default value
+ * @eHDD_CONNECTION_IN_PROGRESS: connection is in progress
+ * @eHDD_REASSOC_IN_PROGRESS: reassociation is in progress
+ * @eHDD_EAPOL_IN_PROGRESS: STA/P2P-CLI is in middle of EAPOL/WPS exchange
+ * @eHDD_SAP_EAPOL_IN_PROGRESS: SAP/P2P-GO is in middle of EAPOL/WPS exchange
+ */
+typedef enum
+{
+   eHDD_SCAN_REJECT_DEFAULT = 0,
+   eHDD_CONNECTION_IN_PROGRESS,
+   eHDD_REASSOC_IN_PROGRESS,
+   eHDD_EAPOL_IN_PROGRESS,
+   eHDD_SAP_EAPOL_IN_PROGRESS,
+} scan_reject_states;
+
+/*
+ * Maximum no.of random mac addresses supported by firmware
+ * for transmitting management action frames
+ */
+#define MAX_RANDOM_MAC_ADDRS 16
+
 /*
  * Generic asynchronous request/response support
  *
@@ -305,17 +342,34 @@ struct linkspeedContext
    unsigned int magic;
 };
 
+/**
+ * struct random_mac_context - Context used with hdd_random_mac_callback
+ * @random_mac_completion: Event on which hdd_set_random_mac will wait
+ * @adapter: Pointer to adapter
+ * @magic: For valid context this is set to ACTION_FRAME_RANDOM_CONTEXT_MAGIC
+ * @set_random_addr: Status of random filter set
+ */
+struct random_mac_context {
+	struct completion random_mac_completion;
+	hdd_adapter_t *adapter;
+	unsigned int magic;
+	bool set_random_addr;
+};
+
 extern spinlock_t hdd_context_lock;
 
 #define STATS_CONTEXT_MAGIC 0x53544154   //STAT
-#define RSSI_CONTEXT_MAGIC  0x52535349   //RSSI
+#define PEER_INFO_CONTEXT_MAGIC  0x52535349   /* PEER_INFO */
 #define POWER_CONTEXT_MAGIC 0x504F5752   //POWR
 #define SNR_CONTEXT_MAGIC   0x534E5200   //SNR
 #define LINK_CONTEXT_MAGIC  0x4C494E4B   //LINKSPEED
 #define LINK_STATUS_MAGIC   0x4C4B5354   //LINKSTATUS(LNST)
 #define TEMP_CONTEXT_MAGIC 0x74656d70   // TEMP (temperature)
 #define FW_STATUS_MAGIC 0x46575354 /* FWSTATUS(FWST) */
+#define POWER_STATS_MAGIC 0x14111990
 #define BPF_CONTEXT_MAGIC 0x4575354    /* BPF */
+#define ACTION_FRAME_RANDOM_CONTEXT_MAGIC 0x87878787
+#define ISOLATION_CONTEXT_MAGIC 0x48575354 //Antenna Isolation
 
 #ifdef QCA_LL_TX_FLOW_CT
 /* MAX OS Q block time value in msec
@@ -581,6 +635,8 @@ typedef enum device_mode
    WLAN_HDD_NDI
 } device_mode_t;
 
+#define WLAN_HDD_VDEV_STA_MAX 2
+
 typedef enum rem_on_channel_request_type
 {
    REMAIN_ON_CHANNEL_REQUEST,
@@ -669,6 +725,7 @@ typedef enum {
     WLAN_HDD_DEV_DIS_RESP,
     WLAN_HDD_PROV_DIS_REQ,
     WLAN_HDD_PROV_DIS_RESP,
+    WLAN_HDD_ACTION_FRM_TYPE_MAX = 255,
 }tActionFrmType;
 
 typedef struct hdd_cfg80211_state_s
@@ -708,6 +765,28 @@ struct hdd_mon_set_ch_info {
 	eCsrPhyMode phy_mode;
 };
 
+/**
+ * struct action_frame_cookie - Action frame cookie item in cookie list
+ * @cookie_node: List item
+ * @cookie: Cookie value
+ */
+struct action_frame_cookie {
+	struct list_head cookie_node;
+	uint64_t cookie;
+};
+
+/**
+ * struct action_frame_random_mac - Action Frame random mac addr & related attrs
+ * @in_use: Checks whether random mac is in use
+ * @addr: Contains random mac addr
+ * @cookie_list: List of cookies tied with random mac
+ */
+struct action_frame_random_mac {
+	bool in_use;
+	uint8_t addr[VOS_MAC_ADDR_SIZE];
+	struct list_head cookie_list;
+};
+
 struct hdd_station_ctx
 {
   /** Handle to the Wireless Extension State */
@@ -749,6 +828,8 @@ struct hdd_station_ctx
 #ifdef WLAN_FEATURE_NAN_DATAPATH
    struct nan_datapath_ctx ndp_ctx;
 #endif
+
+   uint8_t broadcast_staid;
 };
 
 #define BSS_STOP    0
@@ -758,11 +839,26 @@ typedef struct hdd_hostapd_state_s
     int bssState;
     vos_event_t vosEvent;
     vos_event_t stop_bss_event;
+    vos_event_t sta_disassoc_event;
     VOS_STATUS vosStatus;
     v_BOOL_t bCommit;
 
 } hdd_hostapd_state_t;
 
+/**
+ * enum bss_stop_reason - reasons why a BSS is stopped.
+ * @BSS_STOP_REASON_INVALID: no reason specified explicitly.
+ * @BSS_STOP_DUE_TO_MCC_SCC_SWITCH: BSS stopped due to host
+ *  driver is trying to switch AP role to a different channel
+ *  to maintain SCC mode with the STA role on the same card.
+ *  this usually happens when STA is connected to an external
+ *  AP that runs on a different channel
+ */
+enum bss_stop_reason
+{
+	BSS_STOP_REASON_INVALID = 0,
+	BSS_STOP_DUE_TO_MCC_SCC_SWITCH = 1,
+};
 
 /*
  * Per station structure kept in HDD for multiple station support for SoftAP
@@ -805,8 +901,118 @@ typedef struct {
 
    /** Rate Flags for this connection */
    uint32_t  rate_flags;
+
+   /** SUB 20 Bandwidth Flags */
+   uint8_t   sub20_dynamic_channelwidth;
+   /** Extended CSA capabilities */
+   uint8_t   ecsa_capable;
+
+   /** Max phy rate */
+   uint32_t max_phy_rate;
+
+   /** Tx packets */
+   uint32_t tx_packets;
+
+   /** Tx bytes */
+   uint64_t tx_bytes;
+
+   /** Rx packets */
+   uint32_t rx_packets;
+
+   /** Rx bytes */
+   uint64_t rx_bytes;
+
+   /** Last tx/rx timestamp */
+   adf_os_time_t last_tx_rx_ts;
+
+   /** Assoc timestamp */
+   adf_os_time_t assoc_ts;
+
+   /** Tx Rate */
+   uint32_t tx_rate;
+
+   /** Rx Rate */
+   uint32_t rx_rate;
+
+   /** Ampdu */
+   bool ampdu;
+
+   /** Short GI */
+   bool sgi_enable;
+
+   /** Tx stbc */
+   bool tx_stbc;
+
+   /** Rx stbc */
+   bool rx_stbc;
+
+   /** Channel Width */
+   uint8_t ch_width;
+
+   /** Mode */
+   uint8_t mode;
+
+   /** Max supported idx */
+   uint8_t max_supp_idx;
+
+   /** Max extended idx */
+   uint8_t max_ext_idx;
+
+   /** HT max mcs idx */
+   uint8_t max_mcs_idx;
+
+   /** VHT rx mcs map */
+   uint8_t rx_mcs_map;
+
+   /** VHT tx mcs map */
+   uint8_t tx_mcs_map;
 } hdd_station_info_t;
 
+/**
+ * struct hdd_rate_info - rate_info in HDD
+ * @rate: tx/rx rate (kbps)
+ * @mode: 0->11abg legacy, 1->HT, 2->VHT (refer to sir_sme_phy_mode)
+ * @nss: number of streams
+ * @mcs: mcs index for HT/VHT mode
+ * @rate_flags: rate flags for last tx/rx
+ *
+ * rate info in HDD
+ */
+struct hdd_rate_info {
+	uint32_t rate;
+	uint8_t mode;
+	uint8_t nss;
+	uint8_t mcs;
+	uint8_t rate_flags;
+};
+
+/**
+ * struct hdd_fw_txrx_stats - fw txrx status in HDD
+ *                            (refer to station_info struct in Kernel)
+ * @tx_packets: packets transmitted to this station
+ * @tx_bytes: bytes transmitted to this station
+ * @rx_packets: packets received from this station
+ * @rx_bytes: bytes received from this station
+ * @rx_retries: cumulative retry counts
+ * @tx_failed: number of failed transmissions
+ * @rssi: The signal strength (dbm)
+ * @tx_rate: last used tx rate info
+ * @rx_rate: last used rx rate info
+ *
+ * fw txrx status in HDD
+ */
+struct hdd_fw_txrx_stats {
+	uint32_t tx_packets;
+	uint64_t tx_bytes;
+	uint32_t rx_packets;
+	uint64_t rx_bytes;
+	uint32_t tx_retries;
+	uint32_t tx_failed;
+	int8_t rssi;
+	struct hdd_rate_info tx_rate;
+	struct hdd_rate_info rx_rate;
+};
+
 struct hdd_ap_ctx_s
 {
    hdd_hostapd_state_t HostapdState;
@@ -857,6 +1063,9 @@ struct hdd_ap_ctx_s
    v_PVOID_t sapContext;
 #endif
    v_BOOL_t dfs_cac_block_tx;
+   enum bss_stop_reason bss_stop_reason;
+   /* Fw txrx stats info */
+   struct hdd_fw_txrx_stats txrx_stats;
 };
 
 typedef struct hdd_scaninfo_s
@@ -1028,6 +1237,9 @@ struct hdd_adapter_s
    sHddMib_t  hdd_mib;
 
    tANI_U8 sessionId;
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+   bool netif_carrier_on;
+#endif
 
    /* Completion variable for session close */
    struct completion session_close_comp_var;
@@ -1131,10 +1343,20 @@ struct hdd_adapter_s
 
 #ifdef WLAN_FEATURE_TSF
    /* tsf value get from firmware */
-   uint32_t tsf_low;
-   uint32_t tsf_high;
-   /* current in capture tsf state or not */
-   enum hdd_tsf_capture_state tsf_state;
+   uint64_t cur_target_time;
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+   /* spin lock for read/write timestamps */
+   spinlock_t host_target_sync_lock;
+   vos_timer_t host_target_sync_timer;
+   uint64_t cur_host_time;
+   uint64_t last_host_time;
+   uint64_t last_target_time;
+   /* to store the count of continuous invalid tstamp-pair */
+   int continuous_error_count;
+   /* to indicate whether tsf_sync has been initialized */
+   adf_os_atomic_t tsf_sync_ready_flag;
+#endif /* WLAN_FEATURE_TSF_PLUS */
 #endif
 
    hdd_cfg80211_state_t cfg80211State;
@@ -1211,10 +1433,12 @@ struct hdd_adapter_s
     struct sir_ocb_get_tsf_timer_response ocb_get_tsf_timer_resp;
     struct sir_dcc_get_stats_response *dcc_get_stats_resp;
     struct sir_dcc_update_ndl_response dcc_update_ndl_resp;
-
+    struct dsrc_radio_chan_stats_ctxt dsrc_chan_stats;
+#ifdef WLAN_FEATURE_DSRC
     /* MAC addresses used for OCB interfaces */
     tSirMacAddr ocb_mac_address[VOS_MAX_CONCURRENCY_PERSONA];
     int ocb_mac_addr_count;
+#endif
     struct hdd_adapter_pm_context runtime_context;
     struct mib_stats_metrics mib_stats;
 
@@ -1231,6 +1455,11 @@ struct hdd_adapter_s
     struct hdd_netif_queue_history
             queue_oper_history[WLAN_HDD_MAX_HISTORY_ENTRY];
     struct hdd_netif_queue_stats queue_oper_stats[WLAN_REASON_TYPE_MAX];
+    struct power_stats_response *chip_power_stats;
+
+    /* random address management for management action frames */
+    spinlock_t random_mac_lock;
+    struct action_frame_random_mac random_mac[MAX_RANDOM_MAC_ADDRS];
 };
 
 #define WLAN_HDD_GET_STATION_CTX_PTR(pAdapter) (&(pAdapter)->sessionCtx.station)
@@ -1422,6 +1651,18 @@ struct hdd_ll_stats_context {
 };
 #endif /* End of WLAN_FEATURE_LINK_LAYER_STATS */
 
+/**
+ * struct hdd_chain_rssi_context - hdd chain rssi context
+ * @response_event: chain rssi request wait event
+ * @ignore_result: Flag to ignore the result or not
+ * @chain_rssi: chain rssi array
+ */
+struct hdd_chain_rssi_context {
+	struct completion response_event;
+	bool ignore_result;
+	struct chain_rssi_result result;
+};
+
 #ifdef WLAN_FEATURE_OFFLOAD_PACKETS
 /**
  * struct hdd_offloaded_packets - request id to pattern id mapping
@@ -1562,6 +1803,13 @@ struct hdd_context_s
    v_BOOL_t isLoadInProgress;
 
    v_BOOL_t isUnloadInProgress;
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+   bool system_suspended;
+   volatile int thermal_suspend_state;
+   spinlock_t thermal_suspend_lock;
+   struct workqueue_struct *thermal_suspend_wq;
+   struct delayed_work thermal_suspend_work;
+#endif
 
    /**Track whether driver has been suspended.*/
    hdd_ps_state_t hdd_ps_state;
@@ -1617,9 +1865,7 @@ struct hdd_context_s
    /* Thermal mitigation information */
    hdd_thermal_mitigation_info_t tmInfo;
 
-#ifdef WLAN_FEATURE_HOLD_RX_WAKELOCK
    vos_wake_lock_t rx_wake_lock;
-#endif
 
    /*
     * Framework initiated driver restarting
@@ -1690,6 +1936,11 @@ struct hdd_context_s
     /* debugfs entry */
     struct dentry *debugfs_phy;
 
+#ifdef WLAN_POWER_DEBUGFS
+    /* mutex lock to block concurrent access */
+    struct mutex power_stats_lock;
+#endif
+
     /* Use below lock to protect access to isSchedScanUpdatePending
      * since it will be accessed in two different contexts.
      */
@@ -1803,14 +2054,9 @@ struct hdd_context_s
     struct hdd_ll_stats_context ll_stats_context;
 #endif /* End of WLAN_FEATURE_LINK_LAYER_STATS */
 
-#ifdef WLAN_FEATURE_MEMDUMP
-    uint8_t *fw_dump_loc;
-    uint32_t dump_loc_paddr;
-    vos_timer_t memdump_cleanup_timer;
+    struct hdd_chain_rssi_context chain_rssi_context;
+
     struct mutex memdump_lock;
-    bool memdump_in_progress;
-    bool memdump_init_done;
-#endif /* WLAN_FEATURE_MEMDUMP */
     uint16_t driver_dump_size;
     uint8_t *driver_dump_mem;
 
@@ -1868,7 +2114,24 @@ struct hdd_context_s
     vos_timer_t tdls_source_timer;
     struct hdd_scan_chan_info *chan_info;
     struct mutex chan_info_lock;
-    uint8_t thermal_level;
+
+    uint32_t no_of_probe_req_ouis;
+    struct vendor_oui *probe_req_voui;
+    v_U8_t last_scan_reject_session_id;
+    scan_reject_states last_scan_reject_reason;
+    v_TIME_t last_scan_reject_timestamp;
+    uint8_t scan_reject_cnt;
+    uint8_t hdd_dfs_regdomain;
+#ifdef WLAN_FEATURE_TSF
+    /* indicate whether tsf has been initialized */
+    adf_os_atomic_t tsf_ready_flag;
+    /* indicate whether it's now capturing tsf(updating tstamp-pair) */
+    adf_os_atomic_t cap_tsf_flag;
+    /* the context that is capturing tsf */
+    hdd_adapter_t *cap_tsf_context;
+#endif
+    /* flag to show whether moniotr mode is enabled */
+    bool is_mon_enable;
 };
 
 /*---------------------------------------------------------------------------
@@ -1899,6 +2162,16 @@ VOS_STATUS hdd_add_adapter_back( hdd_context_t *pHddCtx,
 VOS_STATUS hdd_add_adapter_front( hdd_context_t *pHddCtx,
                                   hdd_adapter_list_node_t* pAdapterNode);
 
+/**
+ * hdd_get_current_vdev_sta_count() - get currnet vdev sta count
+ * @hdd_ctx: hdd context
+ *
+ * Traverse the adapter list to get the vdev sta count
+ *
+ * Return: vdev sta count
+ */
+uint32_t hdd_get_current_vdev_sta_count(hdd_context_t *hdd_ctx);
+
 hdd_adapter_t* hdd_open_adapter( hdd_context_t *pHddCtx, tANI_U8 session_type,
                                  const char* name, tSirMacAddr macAddr,
                                  unsigned char name_assign_type,
@@ -1914,6 +2187,20 @@ hdd_adapter_t * hdd_get_adapter_by_name( hdd_context_t *pHddCtx, tANI_U8 *name )
 hdd_adapter_t * hdd_get_adapter_by_vdev( hdd_context_t *pHddCtx,
                                          tANI_U32 vdev_id );
 hdd_adapter_t * hdd_get_adapter_by_macaddr( hdd_context_t *pHddCtx, tSirMacAddr macAddr );
+
+/**
+ * hdd_get_adapter_by_rand_macaddr() - Get adapter using random DA of MA frms
+ * @hdd_ctx: Pointer to hdd context
+ * @mac_addr: random mac address
+ *
+ * This function is used to get adapter from randomized destination mac
+ * address present in management action frames
+ *
+ * Return: If randomized addr is present then return pointer to adapter
+ *         else NULL
+ */
+hdd_adapter_t * hdd_get_adapter_by_rand_macaddr(hdd_context_t *hdd_ctx, tSirMacAddr mac_addr);
+
 VOS_STATUS hdd_init_station_mode( hdd_adapter_t *pAdapter );
 hdd_adapter_t * hdd_get_adapter( hdd_context_t *pHddCtx, device_mode_t mode );
 void hdd_deinit_adapter(hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter,
@@ -1959,6 +2246,17 @@ void hdd_set_ssr_required(e_hdd_ssr_required value);
 VOS_STATUS hdd_enable_bmps_imps(hdd_context_t *pHddCtx);
 VOS_STATUS hdd_disable_bmps_imps(hdd_context_t *pHddCtx, tANI_U8 session_type);
 
+/**
+ * hdd_thermal_suspend_queue_work() - Queue a thermal suspend work
+ * @hdd_ctx:     Pointer to hdd_context_t
+ * @ms: Delay time in milliseconds to execute the work
+ *
+ * Queue thermal suspend work on the workqueue after delay
+ *
+ * Return: false if work was already on a queue, true otherwise.
+ */
+bool hdd_thermal_suspend_queue_work(hdd_context_t *hdd_ctx, unsigned long ms);
+
 void wlan_hdd_cfg80211_update_wiphy_caps(struct wiphy *wiphy);
 VOS_STATUS hdd_setIbssPowerSaveParams(hdd_adapter_t *pAdapter);
 VOS_STATUS wlan_hdd_restart_driver(hdd_context_t *pHddCtx);
@@ -1969,7 +2267,8 @@ int wlan_hdd_validate_context(hdd_context_t *pHddCtx);
 v_BOOL_t hdd_is_valid_mac_address(const tANI_U8* pMacAddr);
 VOS_STATUS hdd_issta_p2p_clientconnected(hdd_context_t *pHddCtx);
 void hdd_ipv4_notifier_work_queue(struct work_struct *work);
-bool hdd_isConnectionInProgress(hdd_context_t *pHddCtx);
+bool hdd_isConnectionInProgress(hdd_context_t *pHddCtx, v_U8_t *session_id,
+				scan_reject_states *reason);
 #ifdef WLAN_FEATURE_PACKET_FILTERING
 int wlan_hdd_setIPv6Filter(hdd_context_t *pHddCtx, tANI_U8 filterType, tANI_U8 sessionId);
 #endif
@@ -2041,6 +2340,7 @@ void hdd_wlan_green_ap_start_bss(hdd_context_t *hdd_ctx);
 void hdd_wlan_green_ap_stop_bss(struct hdd_context_s *hdd_ctx);
 void hdd_wlan_green_ap_add_sta(struct hdd_context_s *hdd_ctx);
 void hdd_wlan_green_ap_del_sta(struct hdd_context_s *hdd_ctx);
+int hdd_wlan_enable_egap(struct hdd_context_s *hdd_ctx);
 #else
 static inline void hdd_wlan_green_ap_init(struct hdd_context_s *hdd_ctx) {}
 static inline void hdd_wlan_green_ap_deinit(struct hdd_context_s *hdd_ctx) {}
@@ -2048,16 +2348,15 @@ static inline void hdd_wlan_green_ap_start_bss(hdd_context_t *hdd_ctx) {}
 static inline void hdd_wlan_green_ap_stop_bss(struct hdd_context_s *hdd_ctx) {}
 static inline void hdd_wlan_green_ap_add_sta(struct hdd_context_s *hdd_ctx) {}
 static inline void hdd_wlan_green_ap_del_sta(struct hdd_context_s *hdd_ctx) {}
+static inline int hdd_wlan_enable_egap(struct hdd_context_s *hdd_ctx) {
+    return -EINVAL;
+}
 #endif
 
 #ifdef WLAN_FEATURE_STATS_EXT
 void wlan_hdd_cfg80211_stats_ext_init(hdd_context_t *pHddCtx);
 #endif
 
-#ifdef WLAN_FEATURE_LINK_LAYER_STATS
-void wlan_hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx);
-#endif
-
 void hdd_update_macaddr(hdd_config_t *cfg_ini, v_MACADDR_t hw_macaddr);
 #if defined(FEATURE_WLAN_LFR) && defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD)
 void wlan_hdd_disable_roaming(hdd_adapter_t *pAdapter);
@@ -2071,10 +2370,10 @@ VOS_STATUS wlan_hdd_check_custom_con_channel_rules(hdd_adapter_t *sta_adapter,
                                               bool *concurrent_chnl_same);
 #ifdef WLAN_FEATURE_MBSSID
 void wlan_hdd_stop_sap(hdd_adapter_t *ap_adapter);
-void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter);
+void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter, bool reinit);
 #else
 static inline void wlan_hdd_stop_sap(hdd_adapter_t *ap_adapter) {}
-static inline void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter) {}
+static inline void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter, bool reinit) {}
 #endif
 int wlan_hdd_get_link_speed(hdd_adapter_t *sta_adapter, uint32_t *link_speed);
 int hdd_wlan_go_set_mcc_p2p_quota(hdd_adapter_t *hostapd_adapter,
@@ -2104,23 +2403,82 @@ static inline void hdd_init_ll_stats_ctx(hdd_context_t *hdd_ctx)
 
 	return;
 }
+
+/**
+ * wlan_hdd_cfg80211_link_layer_stats_init() - Initialize llstats callbacks
+ * @pHddCtx: HDD context
+ *
+ * Return: none
+ */
+void wlan_hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx);
+
 #else
 static inline bool hdd_link_layer_stats_supported(void)
 {
 	return false;
 }
+
 static inline void hdd_init_ll_stats_ctx(hdd_context_t *hdd_ctx)
 {
 	return;
 }
+
+void wlan_hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx)
+{
+	return;
+}
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
 
+#ifdef FEATURE_WLAN_LFR
+static inline bool hdd_driver_roaming_supported(hdd_context_t *hdd_ctx)
+{
+	return hdd_ctx->cfg_ini->isFastRoamIniFeatureEnabled;
+}
+#else
+static inline bool hdd_driver_roaming_supported(hdd_context_t *hdd_ctx)
+{
+	return false;
+}
+#endif
+
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+static inline bool hdd_firmware_roaming_supported(hdd_context_t *hdd_ctx)
+{
+	return hdd_ctx->cfg_ini->isRoamOffloadScanEnabled;
+}
+#else
+static inline bool hdd_firmware_roaming_supported(hdd_context_t *hdd_ctx)
+{
+	return false;
+}
+#endif
+
+static inline bool hdd_roaming_supported(hdd_context_t *hdd_ctx)
+{
+	bool val;
+
+	val = hdd_driver_roaming_supported(hdd_ctx) ||
+		hdd_firmware_roaming_supported(hdd_ctx);
+
+	return val;
+}
+
+#ifdef CFG80211_SCAN_RANDOM_MAC_ADDR
+static inline bool hdd_scan_random_mac_addr_supported(void)
+{
+	return true;
+}
+#else
+static inline bool hdd_scan_random_mac_addr_supported(void)
+{
+	return false;
+}
+#endif
+
 void hdd_get_fw_version(hdd_context_t *hdd_ctx,
 			uint32_t *major_spid, uint32_t *minor_spid,
 			uint32_t *siid, uint32_t *crmid);
 
-bool hdd_is_memdump_supported(void);
-
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28))
 static inline void
 hdd_set_needed_headroom(struct net_device *wlan_dev, uint16_t len)
@@ -2160,10 +2518,17 @@ wlan_hdd_clean_tx_flow_control_timer(hdd_context_t *hddctx,
 }
 #endif
 
+struct cfg80211_bss *hdd_cfg80211_get_bss(struct wiphy *wiphy,
+	struct ieee80211_channel *channel,
+	const u8 *bssid,
+	const u8 *ssid, size_t ssid_len);
+
 void hdd_connect_result(struct net_device *dev, const u8 *bssid,
 			tCsrRoamInfo *roam_info, const u8 *req_ie,
 			size_t req_ie_len, const u8 * resp_ie,
-			size_t resp_ie_len, u16 status, gfp_t gfp);
+			size_t resp_ie_len, u16 status, gfp_t gfp,
+			bool connect_timeout,
+			tSirResultCodes timeout_reason);
 
 int wlan_hdd_init_tx_rx_histogram(hdd_context_t *pHddCtx);
 void wlan_hdd_deinit_tx_rx_histogram(hdd_context_t *pHddCtx);
@@ -2267,13 +2632,62 @@ static inline void wlan_hdd_restart_sap(hdd_adapter_t *ap_adapter)
 }
 #endif
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+static inline
+void hdd_set_driver_del_ack_enable(uint16_t session_id, hdd_context_t *hdd_ctx,
+				   uint64_t rx_packets)
+{
+	tlshim_set_driver_del_ack_enable(session_id, rx_packets,
+		hdd_ctx->cfg_ini->busBandwidthComputeInterval,
+		hdd_ctx->cfg_ini->del_ack_threshold_high,
+		hdd_ctx->cfg_ini->del_ack_threshold_low);
+
+}
+#else
+static inline
+void hdd_set_driver_del_ack_enable(uint16_t session_id, hdd_context_t *hdd_ctx,
+				   uint64_t rx_packets)
+{
+}
+#endif
+
+
+
 int hdd_reassoc(hdd_adapter_t *pAdapter, const tANI_U8 *bssid,
 		const tANI_U8 channel, const handoff_src src);
 
 void hdd_sap_restart_handle(struct work_struct *work);
 
 void hdd_set_rps_cpu_mask(hdd_context_t *hdd_ctx);
-
+void hdd_initialize_adapter_common(hdd_adapter_t *adapter);
+void hdd_svc_fw_shutdown_ind(struct device *dev);
+void wlan_hdd_stop_enter_lowpower(hdd_context_t *hdd_ctx);
 void wlan_hdd_init_chan_info(hdd_context_t *hdd_ctx);
 void wlan_hdd_deinit_chan_info(hdd_context_t *hdd_ctx);
+
+void hdd_chip_pwr_save_fail_detected_cb(void *hddctx,
+				struct chip_pwr_save_fail_detected_params
+				*data);
+
+/**
+ * hdd_drv_cmd_validate() - Validates for space in hdd driver command
+ * @command: pointer to input data (its a NULL terminated string)
+ * @len: length of command name
+ *
+ * This function checks for space after command name and if no space
+ * is found returns error.
+ *
+ * Return: 0 for success non-zero for failure
+ */
+int hdd_drv_cmd_validate(tANI_U8 *command, int len);
+
+/**
+ * wlan_hdd_monitor_mode_enable() - function to enable/disable monitor mode
+ * @hdd_ctx: pointer to HDD context
+ * @enable: 0 - disable, 1 - enable
+ *
+ * Return: 0 for success and error number for failure
+ */
+int wlan_hdd_monitor_mode_enable(hdd_context_t *hdd_ctx, bool enable);
+
 #endif    // end #if !defined( WLAN_HDD_MAIN_H )
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_memdump.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_memdump.h
index 72143efe315..8f7c0639bd4 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_memdump.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_memdump.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,65 +40,7 @@
 /* Assigned size of driver memory dump is 4096 bytes */
 #define DRIVER_MEM_DUMP_SIZE    4096
 
-#ifdef WLAN_FEATURE_MEMDUMP
-/**
- * enum qca_wlan_vendor_attr_memory_dump - values for memory dump attributes
- * @QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_INVALID - Invalid
- * @QCA_WLAN_VENDOR_ATTR_REQUEST_ID - Indicate request ID
- * @QCA_WLAN_VENDOR_ATTR_MEMDUMP_SIZE - Indicate size of the memory dump
- * @QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_AFTER_LAST - To keep track of the last enum
- * @QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_MAX - max value possible for this type
- *
- * enum values are used for NL attributes for data used by
- * QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP sub command.
- */
-enum qca_wlan_vendor_attr_memory_dump {
-	QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_INVALID = 0,
-	QCA_WLAN_VENDOR_ATTR_REQUEST_ID = 1,
-	QCA_WLAN_VENDOR_ATTR_MEMDUMP_SIZE = 2,
-
-	QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_AFTER_LAST,
-	QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_MAX =
-		QCA_WLAN_VENDOR_ATTR_MEMORY_DUMP_AFTER_LAST - 1,
-};
-
-/* Size of fw memory dump is estimated to be 327680 bytes */
-#define FW_MEM_DUMP_SIZE    327680
-#define FW_DRAM_LOCATION    0x00400000
-#define FW_MEM_DUMP_REQ_ID  1
-#define FW_MEM_DUMP_NUM_SEG 1
-#define MEMDUMP_COMPLETION_TIME_MS 800
-
-int memdump_init(void);
-void memdump_deinit(void);
-int wlan_hdd_cfg80211_get_fw_mem_dump(struct wiphy *wiphy,
-				      struct wireless_dev *wdev,
-				      const void *data, int data_len);
 int hdd_driver_memdump_init(void);
 void hdd_driver_memdump_deinit(void);
-#else
-static inline int memdump_init(void)
-{
-	return -ENOTSUPP;
-}
-
-static inline void memdump_deinit(void)
-{
-}
 
-static inline int wlan_hdd_cfg80211_get_fw_mem_dump(struct wiphy *wiphy,
-					struct wireless_dev *wdev,
-					const void *data, int data_len)
-{
-	return -ENOTSUPP;
-}
-static inline int hdd_driver_memdump_init(void)
-{
-		return -EINVAL;
-}
-static inline void hdd_driver_memdump_deinit(void)
-{
-		return;
-}
-#endif
 #endif /* if !defined(WLAN_HDD_MEMDUMP_H)*/
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_p2p.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_p2p.h
index 67810b9cae5..55236875ff2 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_p2p.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_p2p.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -47,12 +47,16 @@
 #define WLAN_HDD_GET_TYPE_FRM_FC(__fc__)         (((__fc__) & 0x0F) >> 2)
 #define WLAN_HDD_GET_SUBTYPE_FRM_FC(__fc__)      (((__fc__) & 0xF0) >> 4)
 #define WLAN_HDD_80211_FRM_DA_OFFSET             4
+#define WLAN_HDD_80211_FRM_SA_OFFSET             10
 #define P2P_WILDCARD_SSID_LEN                    7
 #define P2P_WILDCARD_SSID                        "DIRECT-"
 
 #define P2P_ROC_DURATION_MULTIPLIER_GO_PRESENT   2
 #define P2P_ROC_DURATION_MULTIPLIER_GO_ABSENT    5
 
+#define ACTION_FRAME_RSP_WAIT 500
+#define ACTION_FRAME_ACK_WAIT 300
+
 #ifdef WLAN_FEATURE_11W
 #define WLAN_HDD_SET_WEP_FRM_FC(__fc__)     ( (__fc__) = ((__fc__) | 0x40))
 #endif //WLAN_FEATURE_11W
@@ -206,4 +210,17 @@ void wlan_hdd_cleanup_remain_on_channel_ctx(hdd_adapter_t *pAdapter);
 #define MAX_ROC_REQ_QUEUE_ENTRY 10
 
 void wlan_hdd_roc_request_dequeue(struct work_struct *work);
+
+/**
+ * hdd_check_random_mac() - Whether addr is present in random_mac array
+ * @adapter: Pointer to adapter
+ * @mac_addr: random mac address
+ *
+ * This function is used to check whether given mac addr is present in list of
+ * random_mac structures in specified adapter
+ *
+ * Return: If random addr is present return true else false
+ */
+bool hdd_check_random_mac(hdd_adapter_t *adapter, uint8_t *random_mac_addr);
+
 #endif // __P2P_H
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_packet_filtering.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_packet_filtering.h
index ad7f76587e8..56569477726 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_packet_filtering.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_packet_filtering.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -54,7 +54,7 @@
 #define HDD_IPV6_CMP_DATA_1               0xDD
 
 #define HDD_WLAN_MAC_ADDR_LEN             6
-#define HDD_MAX_NUM_MULTICAST_ADDRESS     10
+#define HDD_MAX_NUM_MULTICAST_ADDRESS     16
 
 typedef enum
 {
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_power.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_power.h
index c1f4bf6aa8a..2daea992756 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_power.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_power.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012, 2014, 2016-2018 The Linux Foundation.  All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -88,6 +88,16 @@ enum suspend_resume_state {
 	 HDD_WLAN_RESUME
 };
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+enum thermal_suspend_state {
+	HDD_WLAN_THERMAL_ACTIVE,
+	HDD_WLAN_THERMAL_SUSPENDING,
+	HDD_WLAN_THERMAL_SUSPENDED,
+	HDD_WLAN_THERMAL_RESUMING,
+	HDD_WLAN_THERMAL_DEINIT
+};
+#endif
+
 /*-------------------------------------------------------------------------
  * Function declarations and documentation
  * ------------------------------------------------------------------------*/
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tdls.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tdls.h
index eebec6bfd18..7f094ab2cc9 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tdls.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tdls.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -34,6 +34,25 @@
 \brief       Linux HDD TDLS include file
 ==========================================================================*/
 
+/**
+ * eTDLSSupportMode - TDLS support modes
+ * @eTDLS_SUPPORT_NOT_ENABLED: TDLS support not enabled
+ * @eTDLS_SUPPORT_DISABLED: suppress implicit trigger and not respond
+ *     to the peer
+ * @eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY: suppress implicit trigger,
+ *     but respond to the peer
+ * @eTDLS_SUPPORT_ENABLED: implicit trigger
+ * @eTDLS_SUPPORT_EXTERNAL_CONTROL: implicit trigger but only to a
+ *     peer mac configured by user space.
+ */
+typedef enum {
+    eTDLS_SUPPORT_NOT_ENABLED = 0,
+    eTDLS_SUPPORT_DISABLED,
+    eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY,
+    eTDLS_SUPPORT_ENABLED,
+    eTDLS_SUPPORT_EXTERNAL_CONTROL
+} eTDLSSupportMode;
+
 #ifdef FEATURE_WLAN_TDLS
 
 #define MAX_NUM_TDLS_PEER           3
@@ -79,6 +98,25 @@ should not be more than 2000 */
 
 #define TDLS_PEER_LIST_SIZE   256
 
+#define MAX_TDLS_DISCOVERY_CYCLE_RETRIES      2
+#define MIN_TDLS_DISCOVERY_CYCLE_RETRY_TIME  (5 * 60 * 1000)    /* 5 minutes */
+
+/**
+ * enum tdls_disable_source - TDLS disable sources
+ * @HDD_SET_TDLS_MODE_SOURCE_USER: disable from user
+ * @HDD_SET_TDLS_MODE_SOURCE_SCAN: disable during scan
+ * @HDD_SET_TDLS_MODE_SOURCE_OFFCHANNEL: disable during offchannel
+ * @HDD_SET_TDLS_MODE_SOURCE_BTC: disable during bluetooth
+ * @HDD_SET_TDLS_MODE_SOURCE_P2P: disable during p2p
+ */
+enum tdls_disable_source {
+    HDD_SET_TDLS_MODE_SOURCE_USER = 0,
+    HDD_SET_TDLS_MODE_SOURCE_SCAN,
+    HDD_SET_TDLS_MODE_SOURCE_OFFCHANNEL,
+    HDD_SET_TDLS_MODE_SOURCE_BTC,
+    HDD_SET_TDLS_MODE_SOURCE_P2P,
+};
+
 typedef struct
 {
     tANI_U32    tdls;
@@ -107,17 +145,6 @@ typedef struct
     struct delayed_work tdls_scan_work;
 } tdls_scan_context_t;
 
-typedef enum {
-    eTDLS_SUPPORT_NOT_ENABLED = 0,
-    eTDLS_SUPPORT_DISABLED, /* suppress implicit trigger and not respond to the peer */
-    eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY, /* suppress implicit trigger, but respond to the peer */
-    eTDLS_SUPPORT_ENABLED, /* implicit trigger */
-    /* External control means implicit trigger
-     * but only to a peer mac configured by user space.
-     */
-    eTDLS_SUPPORT_EXTERNAL_CONTROL
-} eTDLSSupportMode;
-
 enum tdls_spatial_streams {
     TDLS_NSS_1x1_MODE = 0,
     TDLS_NSS_2x2_MODE = 0xff,
@@ -240,6 +267,7 @@ typedef struct {
     tANI_U32        discovery_sent_cnt;
     tANI_S8         ap_rssi;
     struct _hddTdlsPeer_t  *curr_candidate;
+    bool is_tdls_disabled_bmps;
     v_U32_t            magic;
 } tdlsCtx_t;
 
@@ -274,6 +302,8 @@ typedef struct _hddTdlsPeer_t {
     /* EXT TDLS */
     tTDLSLinkReason reason;
     cfg80211_exttdls_callback state_change_notification;
+    uint8_t     discovery_cycles_retry_cnt;
+    uint64_t    last_discovery_req_cycle_ts;
 } hddTdlsPeer_t;
 
 typedef struct {
@@ -325,14 +355,16 @@ hddTdlsPeer_t *wlan_hdd_tdls_find_all_peer(hdd_context_t *pHddCtx,
 int wlan_hdd_tdls_get_link_establish_params(hdd_adapter_t *pAdapter,
                                             const u8 *mac,
                                             tCsrTdlsLinkEstablishParams* tdlsLinkEstablishParams);
-hddTdlsPeer_t *wlan_hdd_tdls_get_peer(hdd_adapter_t *pAdapter, const u8 *mac);
+hddTdlsPeer_t *wlan_hdd_tdls_get_peer(hdd_adapter_t *pAdapter, const u8 *mac,
+                                      bool need_lock);
 
 int wlan_hdd_tdls_set_cap(hdd_adapter_t *pAdapter, const u8* mac,
                           tTDLSCapType cap);
 
 void wlan_hdd_tdls_set_peer_link_status(hddTdlsPeer_t *curr_peer,
                                         tTDLSLinkStatus status,
-                                        tTDLSLinkReason reason);
+                                        tTDLSLinkReason reason,
+                                        bool need_lock);
 void wlan_hdd_tdls_set_link_status(hdd_adapter_t *pAdapter,
                                    const u8* mac,
                                    tTDLSLinkStatus linkStatus,
@@ -378,7 +410,7 @@ void wlan_hdd_tdls_check_bmps(hdd_adapter_t *pAdapter);
 
 hddTdlsPeer_t *wlan_hdd_tdls_is_progress(hdd_context_t *pHddCtx,
                                          const u8* mac,
-                                         u8 skip_self);
+                                         u8 skip_self, bool need_lock);
 
 int wlan_hdd_tdls_copy_scan_context(hdd_context_t *pHddCtx,
                             struct wiphy *wiphy,
@@ -481,7 +513,9 @@ int hdd_set_tdls_scan_type(hdd_context_t *hdd_ctx, int val);
 int wlan_hdd_tdls_antenna_switch(hdd_context_t *hdd_ctx,
 					hdd_adapter_t *adapter,
 					uint32_t mode);
-
+void wlan_hdd_change_tdls_mode(void *hdd_ctx);
+void wlan_hdd_start_stop_tdls_source_timer(hdd_context_t *pHddCtx,
+				eTDLSSupportMode tdls_mode);
 
 #else
 static inline void hdd_tdls_notify_mode_change(hdd_adapter_t *pAdapter,
@@ -505,6 +539,16 @@ static inline int wlan_hdd_tdls_antenna_switch(hdd_context_t *hdd_ctx,
 {
 	return 0;
 }
+static inline void
+wlan_hdd_change_tdls_mode(void *hdd_ctx)
+{
+}
+static inline void
+wlan_hdd_start_stop_tdls_source_timer(hdd_context_t *pHddCtx,
+				eTDLSSupportMode tdls_mode)
+{
+}
+
 #endif
 
 #endif // __HDD_TDSL_H
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tgt_cfg.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tgt_cfg.h
index 15948d32e8d..bcacb5f0eb6 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tgt_cfg.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tgt_cfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -58,6 +58,7 @@ struct hdd_tgt_services {
 #ifdef SAP_AUTH_OFFLOAD
         bool sap_auth_offload_service;
 #endif
+        bool get_peer_info_enabled;
 };
 
 struct hdd_tgt_ht_cap {
@@ -110,11 +111,15 @@ struct hdd_tgt_cfg {
 #endif
         uint32_t fine_time_measurement_cap;
         bool bpf_enabled;
+#ifdef FEATURE_WLAN_RA_FILTERING
+        bool is_ra_rate_limit_enabled;
+#endif
         uint16_t wmi_max_len;
 #ifdef WLAN_FEATURE_NAN_DATAPATH
         bool nan_datapath_enabled;
 #endif
         uint8_t max_mc_addr_list;
+        bool sub_20_support;
 };
 
 struct hdd_dfs_radar_ind {
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tsf.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tsf.h
index c3da0cf8f62..6cabf3b9024 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tsf.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tsf.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015,2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -32,6 +32,7 @@
   Include files
   -------------------------------------------------------------------------*/
 #include <wlan_hdd_includes.h>
+#include "wlan_hdd_cfg.h"
 
 /*---------------------------------------------------------------------------
   Preprocessor definitions and constants
@@ -42,18 +43,66 @@
   -------------------------------------------------------------------------*/
 
 #ifdef WLAN_FEATURE_TSF
+
+/**
+ * wlan_hdd_tsf_init() - set gpio and callbacks for
+ *     capturing tsf and init tsf_plus
+ * @hdd_ctx: pointer to the hdd_context_t
+ *
+ * This function set the callback to sme module, the callback will be
+ * called when a tsf event is reported by firmware; set gpio number
+ * to FW, FW will toggle this gpio when received a CAP_TSF command;
+ * do tsf_plus init
+ *
+ * Return: nothing
+ */
 void wlan_hdd_tsf_init(hdd_context_t *hdd_ctx);
+
+/**
+ * wlan_hdd_tsf_deinit() - reset callbacks for capturing tsf, deinit tsf_plus
+ * @hdd_ctx: pointer to the hdd_context_t
+ *
+ * This function reset the callback to sme module, and deinit tsf_plus
+ *
+ * Return: nothing
+ */
+void wlan_hdd_tsf_deinit(hdd_context_t *hdd_ctx);
+
+/**
+ * hdd_capture_tsf() - capture tsf
+ * @adapter: pointer to adapter
+ * @buf: pointer to uplayer buf
+ * @len : the length of buf
+ *
+ * This function returns tsf value to uplayer.
+ *
+ * Return: Describe the execute result of this routine
+ */
 int hdd_capture_tsf(hdd_adapter_t *adapter, uint32_t *buf, int len);
+
+/**
+ * hdd_indicate_tsf() - return tsf to uplayer
+ * @adapter: pointer to adapter
+ * @buf: pointer to uplayer buf
+ * @len : the length of buf
+ *
+ * This function returns tsf value to uplayer.
+ *
+ * Return: Describe the execute result of this routine
+ */
 int hdd_indicate_tsf(hdd_adapter_t *adapter, uint32_t *buf, int len);
 #else
 static inline void
 wlan_hdd_tsf_init(hdd_context_t *hdd_ctx)
 {
-	return;
 }
 
-static inline int
-hdd_indicate_tsf(hdd_adapter_t *adapter, uint32_t *buf, int len)
+static inline void wlan_hdd_tsf_deinit(hdd_context_t *hdd_ctx)
+{
+}
+
+static inline int hdd_indicate_tsf(hdd_adapter_t *adapter,
+	uint32_t *buf, int len)
 {
 	return -ENOTSUPP;
 }
@@ -65,4 +114,139 @@ hdd_capture_tsf(hdd_adapter_t *adapter, uint32_t *buf, int len)
 }
 #endif
 
+#if defined(WLAN_FEATURE_TSF_PLUS) && defined(WLAN_FEATURE_TSF)
+#define HDD_TSF_IS_PTP_ENABLED(hdd_ctx) \
+	((hdd_ctx) && (hdd_ctx)->cfg_ini && \
+	((hdd_ctx)->cfg_ini->tsf_ptp_options))
+
+#define HDD_TSF_IS_TX_SET(hdd_ctx) \
+	((hdd_ctx) && (hdd_ctx)->cfg_ini && \
+	(((hdd_ctx)->cfg_ini->tsf_ptp_options & CFG_SET_TSF_PTP_OPT_TX) == \
+	CFG_SET_TSF_PTP_OPT_TX))
+
+#define HDD_TSF_IS_RX_SET(hdd_ctx) \
+	((hdd_ctx) && (hdd_ctx)->cfg_ini && \
+	(((hdd_ctx)->cfg_ini->tsf_ptp_options & CFG_SET_TSF_PTP_OPT_RX) == \
+	CFG_SET_TSF_PTP_OPT_RX))
+
+#define HDD_TSF_IS_RAW_SET(hdd_ctx) \
+	((hdd_ctx) && (hdd_ctx)->cfg_ini && \
+	(((hdd_ctx)->cfg_ini->tsf_ptp_options & CFG_SET_TSF_PTP_OPT_RAW) == \
+	CFG_SET_TSF_PTP_OPT_RAW))
+
+#define HDD_TSF_IS_DBG_FS_SET(hdd_ctx) \
+	((hdd_ctx) && (hdd_ctx)->cfg_ini && \
+	(((hdd_ctx)->cfg_ini->tsf_ptp_options & CFG_SET_TSF_DBG_FS) == \
+	CFG_SET_TSF_DBG_FS))
+
+/**
+ * hdd_start_tsf_sync() - start tsf sync
+ * @adapter: pointer to adapter
+ *
+ * This function initialize and start TSF synchronization
+ *
+ * Return: Describe the execute result of this routine
+ */
+int hdd_start_tsf_sync(hdd_adapter_t *adapter);
+
+/**
+ * hdd_stop_tsf_sync() - stop tsf sync
+ * @adapter: pointer to adapter
+ *
+ * This function stop and de-initialize TSF synchronization
+ *
+ * Return: Describe the execute result of this routine
+ */
+int hdd_stop_tsf_sync(hdd_adapter_t *adapter);
+
+/**
+ * hdd_tsf_notify_wlan_state_change() -
+ *     notify tsf module of wlan connection state
+ * @old_state: old wlan state
+ * @new_state: new wlan state
+ *
+ * This function check the old and new connection state, determine whether
+ * to start or stop tsf sync
+ *
+ * Return: nothing
+ */
+void hdd_tsf_notify_wlan_state_change(hdd_adapter_t *adapter,
+	eConnectionState old_state,
+	eConnectionState new_state);
+
+/**
+ * hdd_tx_timestamp() - time stamp TX netbuf
+ *
+ * @netbuf: pointer to a TX netbuf
+ * @target_time: TX time for the netbuf
+ *
+ * This function  get corresponding host time from target time,
+ * and time stamp the TX netbuf with this time
+ *
+ * Return: Describe the execute result of this routine
+ */
+int hdd_tx_timestamp(adf_nbuf_t netbuf, uint64_t target_time);
+
+/**
+ * hdd_rx_timestamp() - time stamp RX netbuf
+ *
+ * @netbuf: pointer to a RX netbuf
+ * @target_time: RX time for the netbuf
+ *
+ * This function get corresponding host time from target time,
+ * and time stamp the RX netbuf with this time
+ *
+ * Return: Describe the execute result of this routine
+ */
+int hdd_rx_timestamp(adf_nbuf_t netbuf, uint64_t target_time);
+
+/**
+ * hdd_tsf_record_sk_for_skb() - save sk for skb
+ *
+ * @hdd_ctx: pointer to hdd context
+ * @nbuf: pointer to a TX netbuf
+ *
+ * This function record netbuf->sk in netbuf->tstamp,
+ * in case netbuf->sk will be set to NULL.
+ *
+ * Return: nothing
+ */
+void
+hdd_tsf_record_sk_for_skb(hdd_context_t *hdd_ctx, adf_nbuf_t nbuf);
+#else
+static inline int hdd_start_tsf_sync(hdd_adapter_t *adapter)
+{
+	return -ENOTSUPP;
+}
+
+static inline int hdd_stop_tsf_sync(hdd_adapter_t *adapter)
+{
+	return -ENOTSUPP;
+}
+
+static inline
+void hdd_tsf_notify_wlan_state_change(hdd_adapter_t *adapter,
+	eConnectionState old_state,
+	eConnectionState new_state)
+{
+}
+
+static inline
+int hdd_tx_timestamp(adf_nbuf_t netbuf, uint64_t target_time)
+{
+	return -ENOTSUPP;
+}
+
+static inline
+int hdd_rx_timestamp(adf_nbuf_t netbuf, uint64_t target_time)
+{
+	return -ENOTSUPP;
+}
+
+static inline void
+hdd_tsf_record_sk_for_skb(hdd_context_t *hdd_ctx, adf_nbuf_t nbuf)
+{
+}
+#endif
+
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tx_rx.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tx_rx.h
index df434b1da0b..2fd820c5886 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tx_rx.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_tx_rx.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -268,12 +268,27 @@ void hdd_rst_tcp_delack(hdd_context_t *hdd_ctx);
 VOS_STATUS hdd_mon_rx_packet_cbk(v_VOID_t *vos_ctx, adf_nbuf_t rx_buf,
 				 uint8_t sta_id);
 
+/**
+ * hdd_vir_mon_rx_cbk() - Monitor callback registered to TLSHIM.
+ * @vosContext: [in] pointer to VOS context
+ * @rxBuf:      [in] pointer to rx adf_nbuf
+ * @staId:      [in] Station Id
+ *
+ * TL will call this to notify the HDD when one or more packets were
+ * received for a registered HDD adapter.
+ * Return: VOS_STATUS_E_FAILURE if any errors encountered, VOS_STATUS_SUCCESS
+ * otherwise
+ */
+VOS_STATUS hdd_vir_mon_rx_cbk(v_VOID_t *vos_ctx, adf_nbuf_t rx_buf,
+			      uint8_t sta_id);
+
 void wlan_display_tx_timeout_stats(hdd_adapter_t *adapter);
 
 const char *hdd_reason_type_to_string(enum netif_reason_type reason);
 const char *hdd_action_type_to_string(enum netif_action_type action);
 void wlan_hdd_netif_queue_control(hdd_adapter_t *adapter,
 		enum netif_action_type action, enum netif_reason_type reason);
+void wlan_hdd_classify_pkt(struct sk_buff *skb);
 
 #ifdef QCA_PKT_PROTO_TRACE
 void hdd_dhcp_pkt_trace_buf_update(struct sk_buff *skb, int is_transmission,
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_wext.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_wext.h
index e18f7f25b66..6a47ede7e6e 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_wext.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_wext.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -257,6 +257,8 @@ typedef enum
  * TSF_GET_FAIL:                 get fail
  * TSF_RESET_GPIO_FAIL:          GPIO reset fail
  * TSF_SAP_NOT_STARTED_NO_TSF    SAP not started
+ * TSF_NOT_READY: TSF module is not initialized or init failed
+ * TSF_DISABLED_BY_TSFPLUS: cap_tsf/get_tsf are disabled due to TSF_PLUS
  */
 enum hdd_tsf_get_state {
 	TSF_RETURN = 0,
@@ -266,7 +268,9 @@ enum hdd_tsf_get_state {
 	TSF_CAPTURE_FAIL,
 	TSF_GET_FAIL,
 	TSF_RESET_GPIO_FAIL,
-	TSF_SAP_NOT_STARTED_NO_TSF
+	TSF_SAP_NOT_STARTED_NO_TSF,
+	TSF_NOT_READY,
+	TSF_DISABLED_BY_TSFPLUS
 };
 
 /**
@@ -334,8 +338,6 @@ typedef struct hdd_wext_state_s
    v_BOOL_t isESEConnection;
    eCsrAuthType collectedAuthType; /* Collected from ALL SIOCSIWAUTH Ioctls. Will be negotiatedAuthType - in tCsrProfile */
 #endif
-   /* Wireless statistics */
-   struct iw_statistics iw_stats;
 }hdd_wext_state_t;
 
 typedef struct ccp_freq_chan_map_s{
@@ -462,7 +464,7 @@ VOS_STATUS iw_set_tdls_params(struct net_device *dev, struct iw_request_info *in
 #endif
 
 #ifdef WLAN_FEATURE_PACKET_FILTERING
-void wlan_hdd_set_mc_addr_list(hdd_adapter_t *pAdapter, v_U8_t set);
+int wlan_hdd_set_mc_addr_list(hdd_adapter_t *pAdapter, v_U8_t set);
 #endif
 void* wlan_hdd_change_country_code_callback(void *pAdapter);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_wmm.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_wmm.h
index 5e992866b94..1634157cf5a 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_wmm.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_wmm.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2012,2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2012,2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -113,9 +113,8 @@ typedef enum
    HDD_WMM_USER_MODE_AUTO = 0,
    //SME will add the extra logic to make sure STA associates with a QAP only
    HDD_WMM_USER_MODE_QBSS_ONLY = 1,
-   //SME will not join a QoS AP, unless the phy mode setting says "Auto". In
-   // that case, STA is free to join 11n AP. Although from HDD point of view,
-   // it will not be doing any packet classifications
+
+   /* Join any AP, but uapsd is disabled */
    HDD_WMM_USER_MODE_NO_QOS = 2,
 
 } hdd_wmm_user_mode_t;
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_assoc.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_assoc.c
index da2953402b6..d2166d0f180 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_assoc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -71,8 +71,9 @@
 #include <wlan_logging_sock_svc.h>
 #include "tl_shim.h"
 #include "wlan_hdd_oemdata.h"
+#include "wlan_hdd_tsf.h"
 
-uint8_t thermal_band = 2;
+#include "adf_trace.h"
 
 struct ether_addr
 {
@@ -105,6 +106,13 @@ v_U8_t ccpRSNOui07[ HDD_RSN_OUI_SIZE ] = { 0x00, 0x0F, 0xAC, 0x06 }; // RSN-PSK-
 v_U8_t ccpRSNOui08[ HDD_RSN_OUI_SIZE ] = { 0x00, 0x0F, 0xAC, 0x05 };
 #endif
 
+#ifdef WLAN_FEATURE_FILS_SK
+uint8_t ccp_rsn_oui_0e[HDD_RSN_OUI_SIZE] = {0x00, 0x0F, 0xAC, 0x0E};
+uint8_t ccp_rsn_oui_0f[HDD_RSN_OUI_SIZE] = {0x00, 0x0F, 0xAC, 0x0F};
+uint8_t ccp_rsn_oui_10[HDD_RSN_OUI_SIZE] = {0x00, 0x0F, 0xAC, 0x10};
+uint8_t ccp_rsn_oui_11[HDD_RSN_OUI_SIZE] = {0x00, 0x0F, 0xAC, 0x11};
+#endif
+
 #if defined(WLAN_FEATURE_VOWIFI_11R)
 // Offset where the EID-Len-IE, start.
 #define FT_ASSOC_RSP_IES_OFFSET 6 /* Capability(2) + AID(2) + Status Code(2)*/
@@ -119,11 +127,7 @@ static const int beacon_filter_table[] = {
 	SIR_MAC_ERP_INFO_EID,
 	SIR_MAC_EDCA_PARAM_SET_EID,
 	SIR_MAC_QOS_CAPABILITY_EID,
-	SIR_MAC_CHNL_SWITCH_ANN_EID,
 	SIR_MAC_HT_INFO_EID,
-#if defined WLAN_FEATURE_VOWIFI
-	SIR_MAC_PWR_CONSTRAINT_EID,
-#endif
 #ifdef WLAN_FEATURE_11AC
 	SIR_MAC_VHT_OPMODE_EID,
 	SIR_MAC_VHT_OPERATION_EID,
@@ -161,6 +165,9 @@ v_VOID_t hdd_connSetConnectionState( hdd_adapter_t *pAdapter,
    hddLog(LOG1, FL("%pS Changed connectionState from oldState:%d to State:%d"),
                     (void *)_RET_IP_,
                     pHddStaCtx->conn_info.connState, connState);
+
+   hdd_tsf_notify_wlan_state_change(pAdapter,
+		   pHddStaCtx->conn_info.connState, connState);
    pHddStaCtx->conn_info.connState = connState;
 
    /* Check is pending ROC request or not when connection state changed */
@@ -306,11 +313,18 @@ static int hdd_set_beacon_filter(hdd_adapter_t *adapter)
 	int i;
 	uint32_t ie_map[8] = {0};
 	VOS_STATUS vos_status = VOS_STATUS_E_FAILURE;
+	tHalHandle hal_ptr = WLAN_HDD_GET_HAL_CTX(adapter);
+	tpAniSirGlobal mac_ptr = PMAC_STRUCT(hal_ptr);
 
-	for (i = 0; i < ARRAY_SIZE(beacon_filter_table); i++) {
-		__set_bit((beacon_filter_table[i] - 1),
+	for (i = 0; i < ARRAY_SIZE(beacon_filter_table); i++)
+		__set_bit(beacon_filter_table[i],
 			  (unsigned long int *)ie_map);
-	}
+
+
+	if (TRUE == mac_ptr->sta_change_cc_via_beacon &&
+	    adapter->device_mode == WLAN_HDD_INFRA_STATION)
+		__set_bit(SIR_MAC_COUNTRY_EID, (unsigned long int *)ie_map);
+
 	vos_status = sme_set_beacon_filter(adapter->sessionId, ie_map);
 	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
 		hddLog(LOGE, "%s: failed to set beacon filter",
@@ -320,6 +334,485 @@ static int hdd_set_beacon_filter(hdd_adapter_t *adapter)
 	return 0;
 }
 
+/**
+ * hdd_copy_vht_caps()- copy vht caps info from roam info to
+ *  hdd station context.
+ * @hdd_sta_ctx: pointer to hdd station context
+ * @roam_info: pointer to roam info
+ *
+ * Return: None
+ */
+static void hdd_copy_ht_caps(hdd_station_ctx_t *hdd_sta_ctx,
+				     tCsrRoamInfo *roam_info)
+{
+	tDot11fIEHTCaps *roam_ht_cap = &roam_info->ht_caps;
+	struct ieee80211_ht_cap *hdd_ht_cap = &hdd_sta_ctx->conn_info.ht_caps;
+	uint32_t i, temp_ht_cap;
+
+	adf_os_mem_zero(hdd_ht_cap, sizeof(struct ieee80211_ht_cap));
+
+	if (roam_ht_cap->advCodingCap)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_LDPC_CODING;
+	if (roam_ht_cap->supportedChannelWidthSet)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+	temp_ht_cap = roam_ht_cap->mimoPowerSave &
+	    (IEEE80211_HT_CAP_SM_PS >> IEEE80211_HT_CAP_SM_PS_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->cap_info |=
+			temp_ht_cap << IEEE80211_HT_CAP_SM_PS_SHIFT;
+	if (roam_ht_cap->greenField)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_GRN_FLD;
+	if (roam_ht_cap->shortGI20MHz)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_SGI_20;
+	if (roam_ht_cap->shortGI40MHz)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_SGI_40;
+	if (roam_ht_cap->txSTBC)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_TX_STBC;
+	temp_ht_cap = roam_ht_cap->rxSTBC & (IEEE80211_HT_CAP_RX_STBC >>
+	    IEEE80211_HT_CAP_RX_STBC_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->cap_info |=
+			temp_ht_cap << IEEE80211_HT_CAP_RX_STBC_SHIFT;
+	if (roam_ht_cap->delayedBA)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_DELAY_BA;
+	if (roam_ht_cap->maximalAMSDUsize)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_MAX_AMSDU;
+	if (roam_ht_cap->dsssCckMode40MHz)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_DSSSCCK40;
+	if (roam_ht_cap->psmp)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_RESERVED;
+	if (roam_ht_cap->stbcControlFrame)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_40MHZ_INTOLERANT;
+	if (roam_ht_cap->lsigTXOPProtection)
+		hdd_ht_cap->cap_info |= IEEE80211_HT_CAP_LSIG_TXOP_PROT;
+
+	/* 802.11n HT capability AMPDU settings (for ampdu_params_info) */
+	if (roam_ht_cap->maxRxAMPDUFactor)
+		hdd_ht_cap->ampdu_params_info |=
+			IEEE80211_HT_AMPDU_PARM_FACTOR;
+	temp_ht_cap = roam_ht_cap->mpduDensity &
+	    (IEEE80211_HT_AMPDU_PARM_DENSITY >>
+	     IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->ampdu_params_info |=
+		temp_ht_cap << IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT;
+
+	/* 802.11n HT extended capabilities masks */
+	if (roam_ht_cap->pco)
+		hdd_ht_cap->extended_ht_cap_info |=
+			IEEE80211_HT_EXT_CAP_PCO;
+	temp_ht_cap = roam_ht_cap->transitionTime &
+	    (IEEE80211_HT_EXT_CAP_PCO_TIME >>
+	    IEEE80211_HT_EXT_CAP_PCO_TIME_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->extended_ht_cap_info |=
+			temp_ht_cap << IEEE80211_HT_EXT_CAP_PCO_TIME_SHIFT;
+	temp_ht_cap = roam_ht_cap->mcsFeedback &
+	    (IEEE80211_HT_EXT_CAP_MCS_FB >> IEEE80211_HT_EXT_CAP_MCS_FB_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->extended_ht_cap_info |=
+			temp_ht_cap << IEEE80211_HT_EXT_CAP_MCS_FB_SHIFT;
+
+	/* tx_bf_cap_info capabilities */
+	if (roam_ht_cap->txBF)
+		hdd_ht_cap->tx_BF_cap_info |= TX_BF_CAP_INFO_TX_BF;
+	if (roam_ht_cap->rxStaggeredSounding)
+		hdd_ht_cap->tx_BF_cap_info |=
+			TX_BF_CAP_INFO_RX_STAG_RED_SOUNDING;
+	if (roam_ht_cap->txStaggeredSounding)
+		hdd_ht_cap->tx_BF_cap_info |=
+			TX_BF_CAP_INFO_TX_STAG_RED_SOUNDING;
+	if (roam_ht_cap->rxZLF)
+		hdd_ht_cap->tx_BF_cap_info |= TX_BF_CAP_INFO_RX_ZFL;
+	if (roam_ht_cap->txZLF)
+		hdd_ht_cap->tx_BF_cap_info |= TX_BF_CAP_INFO_TX_ZFL;
+	if (roam_ht_cap->implicitTxBF)
+		hdd_ht_cap->tx_BF_cap_info |= TX_BF_CAP_INFO_IMP_TX_BF;
+	temp_ht_cap = roam_ht_cap->calibration &
+	    (TX_BF_CAP_INFO_CALIBRATION >> TX_BF_CAP_INFO_CALIBRATION_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->tx_BF_cap_info |=
+			temp_ht_cap << TX_BF_CAP_INFO_CALIBRATION_SHIFT;
+	if (roam_ht_cap->explicitCSITxBF)
+		hdd_ht_cap->tx_BF_cap_info |= TX_BF_CAP_INFO_EXP_CSIT_BF;
+	if (roam_ht_cap->explicitUncompressedSteeringMatrix)
+		hdd_ht_cap->tx_BF_cap_info |=
+			TX_BF_CAP_INFO_EXP_UNCOMP_STEER_MAT;
+	temp_ht_cap = roam_ht_cap->explicitBFCSIFeedback &
+	    (TX_BF_CAP_INFO_EXP_BF_CSI_FB >>
+	     TX_BF_CAP_INFO_EXP_BF_CSI_FB_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->tx_BF_cap_info |=
+			temp_ht_cap << TX_BF_CAP_INFO_EXP_BF_CSI_FB_SHIFT;
+	temp_ht_cap =
+	    roam_ht_cap->explicitUncompressedSteeringMatrixFeedback &
+	    (TX_BF_CAP_INFO_EXP_UNCMP_STEER_MAT >>
+	     TX_BF_CAP_INFO_EXP_UNCMP_STEER_MAT_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->tx_BF_cap_info |=
+			temp_ht_cap <<
+			TX_BF_CAP_INFO_EXP_UNCMP_STEER_MAT_SHIFT;
+	temp_ht_cap =
+	    roam_ht_cap->explicitCompressedSteeringMatrixFeedback &
+	    (TX_BF_CAP_INFO_EXP_CMP_STEER_MAT_FB >>
+	     TX_BF_CAP_INFO_EXP_CMP_STEER_MAT_FB_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->tx_BF_cap_info |=
+			temp_ht_cap <<
+				TX_BF_CAP_INFO_EXP_CMP_STEER_MAT_FB_SHIFT;
+	temp_ht_cap = roam_ht_cap->csiNumBFAntennae &
+	    (TX_BF_CAP_INFO_CSI_NUM_BF_ANT >>
+	     TX_BF_CAP_INFO_CSI_NUM_BF_ANT_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->tx_BF_cap_info |=
+			temp_ht_cap << TX_BF_CAP_INFO_CSI_NUM_BF_ANT_SHIFT;
+	temp_ht_cap = roam_ht_cap->uncompressedSteeringMatrixBFAntennae &
+	    (TX_BF_CAP_INFO_UNCOMP_STEER_MAT_BF_ANT >>
+	     TX_BF_CAP_INFO_UNCOMP_STEER_MAT_BF_ANT_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->tx_BF_cap_info |=
+			temp_ht_cap <<
+				TX_BF_CAP_INFO_UNCOMP_STEER_MAT_BF_ANT_SHIFT;
+	temp_ht_cap = roam_ht_cap->compressedSteeringMatrixBFAntennae &
+	    (TX_BF_CAP_INFO_COMP_STEER_MAT_BF_ANT >>
+	     TX_BF_CAP_INFO_COMP_STEER_MAT_BF_ANT_SHIFT);
+	if (temp_ht_cap)
+		hdd_ht_cap->tx_BF_cap_info |=
+			temp_ht_cap <<
+				TX_BF_CAP_INFO_COMP_STEER_MAT_BF_ANT_SHIFT;
+
+	/* antenna selection */
+	if (roam_ht_cap->antennaSelection)
+		hdd_ht_cap->antenna_selection_info |= ANTENNA_SEL_INFO;
+	if (roam_ht_cap->explicitCSIFeedbackTx)
+		hdd_ht_cap->antenna_selection_info |=
+			ANTENNA_SEL_INFO_EXP_CSI_FB_TX;
+	if (roam_ht_cap->antennaIndicesFeedbackTx)
+		hdd_ht_cap->antenna_selection_info |=
+			ANTENNA_SEL_INFO_ANT_ID_FB_TX;
+	if (roam_ht_cap->explicitCSIFeedback)
+		hdd_ht_cap->antenna_selection_info |=
+			ANTENNA_SEL_INFO_EXP_CSI_FB;
+	if (roam_ht_cap->antennaIndicesFeedback)
+		hdd_ht_cap->antenna_selection_info |=
+			ANTENNA_SEL_INFO_ANT_ID_FB;
+	if (roam_ht_cap->rxAS)
+		hdd_ht_cap->antenna_selection_info |=
+			ANTENNA_SEL_INFO_RX_AS;
+	if (roam_ht_cap->txSoundingPPDUs)
+		hdd_ht_cap->antenna_selection_info |=
+			ANTENNA_SEL_INFO_TX_SOUNDING_PPDU;
+
+	/* mcs data rate */
+	for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; ++i)
+		hdd_ht_cap->mcs.rx_mask[i] =
+			roam_ht_cap->supportedMCSSet[i];
+	hdd_ht_cap->mcs.rx_highest =
+			((short) (roam_ht_cap->supportedMCSSet[11]) << 8) |
+			((short) (roam_ht_cap->supportedMCSSet[10]));
+	hdd_ht_cap->mcs.tx_params =
+			roam_ht_cap->supportedMCSSet[12];
+}
+
+#define VHT_CAP_MAX_MPDU_LENGTH_MASK 0x00000003
+#define VHT_CAP_SUPP_CHAN_WIDTH_MASK_SHIFT 2
+#define VHT_CAP_RXSTBC_MASK_SHIFT 8
+#define VHT_CAP_BEAMFORMEE_STS_SHIFT 13
+#define VHT_CAP_BEAMFORMEE_STS_MASK \
+	(0x0000e000 >> VHT_CAP_BEAMFORMEE_STS_SHIFT)
+#define VHT_CAP_SOUNDING_DIMENSIONS_SHIFT 16
+#define VHT_CAP_SOUNDING_DIMENSIONS_MASK \
+	(0x00070000 >> VHT_CAP_SOUNDING_DIMENSIONS_SHIFT)
+#define VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK_SHIFT 23
+#define VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK \
+	(0x03800000 >> VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK_SHIFT)
+#define VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB_SHIFT 26
+
+/**
+ * hdd_copy_ht_caps()- copy ht caps info from roam info to
+ *  hdd station context.
+ * @hdd_sta_ctx: pointer to hdd station context
+ * @roam_info: pointer to roam info
+ *
+ * Return: None
+ */
+static void hdd_copy_vht_caps(hdd_station_ctx_t *hdd_sta_ctx,
+				     tCsrRoamInfo *roam_info)
+{
+	tDot11fIEVHTCaps *roam_vht_cap = &roam_info->vht_caps;
+	struct ieee80211_vht_cap *hdd_vht_cap =
+		&hdd_sta_ctx->conn_info.vht_caps;
+	uint32_t temp_vht_cap;
+
+	adf_os_mem_zero(hdd_vht_cap, sizeof(struct ieee80211_vht_cap));
+
+	temp_vht_cap = roam_vht_cap->maxMPDULen & VHT_CAP_MAX_MPDU_LENGTH_MASK;
+	hdd_vht_cap->vht_cap_info |= temp_vht_cap;
+	temp_vht_cap = roam_vht_cap->supportedChannelWidthSet &
+		(IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK >>
+			VHT_CAP_SUPP_CHAN_WIDTH_MASK_SHIFT);
+	if (temp_vht_cap) {
+		if (roam_vht_cap->supportedChannelWidthSet &
+		    (IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ >>
+			VHT_CAP_SUPP_CHAN_WIDTH_MASK_SHIFT))
+			hdd_vht_cap->vht_cap_info |=
+				temp_vht_cap <<
+				IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+		if (roam_vht_cap->supportedChannelWidthSet &
+		    (IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ >>
+			VHT_CAP_SUPP_CHAN_WIDTH_MASK_SHIFT))
+			hdd_vht_cap->vht_cap_info |=
+			temp_vht_cap <<
+			IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
+	}
+	if (roam_vht_cap->ldpcCodingCap)
+		hdd_vht_cap->vht_cap_info |= IEEE80211_VHT_CAP_RXLDPC;
+	if (roam_vht_cap->shortGI80MHz)
+		hdd_vht_cap->vht_cap_info |= IEEE80211_VHT_CAP_SHORT_GI_80;
+	if (roam_vht_cap->shortGI160and80plus80MHz)
+		hdd_vht_cap->vht_cap_info |= IEEE80211_VHT_CAP_SHORT_GI_160;
+	if (roam_vht_cap->txSTBC)
+		hdd_vht_cap->vht_cap_info |= IEEE80211_VHT_CAP_TXSTBC;
+	temp_vht_cap = roam_vht_cap->rxSTBC & (IEEE80211_VHT_CAP_RXSTBC_MASK >>
+		VHT_CAP_RXSTBC_MASK_SHIFT);
+	if (temp_vht_cap)
+		hdd_vht_cap->vht_cap_info |=
+			temp_vht_cap << VHT_CAP_RXSTBC_MASK_SHIFT;
+	if (roam_vht_cap->suBeamFormerCap)
+		hdd_vht_cap->vht_cap_info |=
+			IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
+	if (roam_vht_cap->suBeamformeeCap)
+		hdd_vht_cap->vht_cap_info |=
+			IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+	temp_vht_cap = roam_vht_cap->csnofBeamformerAntSup &
+			(VHT_CAP_BEAMFORMEE_STS_MASK);
+	if (temp_vht_cap)
+		hdd_vht_cap->vht_cap_info |=
+			temp_vht_cap << VHT_CAP_BEAMFORMEE_STS_SHIFT;
+	temp_vht_cap = roam_vht_cap->numSoundingDim &
+			(VHT_CAP_SOUNDING_DIMENSIONS_MASK);
+	if (temp_vht_cap)
+		hdd_vht_cap->vht_cap_info |=
+			temp_vht_cap << VHT_CAP_SOUNDING_DIMENSIONS_SHIFT;
+	if (roam_vht_cap->muBeamformerCap)
+		hdd_vht_cap->vht_cap_info |=
+			IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
+	if (roam_vht_cap->muBeamformeeCap)
+		hdd_vht_cap->vht_cap_info |=
+			IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
+	if (roam_vht_cap->vhtTXOPPS)
+		hdd_vht_cap->vht_cap_info |=
+			IEEE80211_VHT_CAP_VHT_TXOP_PS;
+	if (roam_vht_cap->htcVHTCap)
+		hdd_vht_cap->vht_cap_info |=
+			IEEE80211_VHT_CAP_HTC_VHT;
+	temp_vht_cap = roam_vht_cap->maxAMPDULenExp &
+			(VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
+	if (temp_vht_cap)
+		hdd_vht_cap->vht_cap_info |=
+			temp_vht_cap <<
+			VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK_SHIFT;
+	temp_vht_cap = roam_vht_cap->vhtLinkAdaptCap &
+		(IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB >>
+		 VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB_SHIFT);
+	if (temp_vht_cap)
+		hdd_vht_cap->vht_cap_info |= temp_vht_cap <<
+			VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB_SHIFT;
+	if (roam_vht_cap->rxAntPattern)
+		hdd_vht_cap->vht_cap_info |=
+			IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
+	if (roam_vht_cap->txAntPattern)
+		hdd_vht_cap->vht_cap_info |=
+			IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
+	hdd_vht_cap->supp_mcs.rx_mcs_map = roam_vht_cap->rxMCSMap;
+	hdd_vht_cap->supp_mcs.rx_highest =
+		((uint16_t)roam_vht_cap->rxHighSupDataRate);
+	hdd_vht_cap->supp_mcs.tx_mcs_map = roam_vht_cap->txMCSMap;
+	hdd_vht_cap->supp_mcs.tx_highest =
+		((uint16_t)roam_vht_cap->txSupDataRate);
+}
+
+/* ht param */
+#define HT_PARAM_CONTROLLED_ACCESS_ONLY 0x10
+#define HT_PARAM_SERVICE_INT_GRAN 0xe0
+#define HT_PARAM_SERVICE_INT_GRAN_SHIFT 5
+
+/* operatinon mode */
+#define HT_OP_MODE_TX_BURST_LIMIT 0x0008
+
+/* stbc_param */
+#define HT_STBC_PARAM_MCS 0x007f
+
+/**
+ * hdd_copy_ht_operation()- copy HT operation element from roam info to
+ *  hdd station context.
+ * @hdd_sta_ctx: pointer to hdd station context
+ * @roam_info: pointer to roam info
+ *
+ * Return: None
+ */
+static void hdd_copy_ht_operation(hdd_station_ctx_t *hdd_sta_ctx,
+					    tCsrRoamInfo *roam_info)
+{
+	tDot11fIEHTInfo *roam_ht_ops = &roam_info->ht_operation;
+	struct ieee80211_ht_operation *hdd_ht_ops =
+		&hdd_sta_ctx->conn_info.ht_operation;
+	uint32_t i, temp_ht_ops;
+
+	adf_os_mem_zero(hdd_ht_ops, sizeof(struct ieee80211_ht_operation));
+
+	hdd_ht_ops->primary_chan = roam_ht_ops->primaryChannel;
+
+	/* HT_PARAMS */
+	temp_ht_ops = roam_ht_ops->secondaryChannelOffset &
+		IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
+	if (temp_ht_ops)
+		hdd_ht_ops->ht_param |= temp_ht_ops;
+	else
+		hdd_ht_ops->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+	if (roam_ht_ops->recommendedTxWidthSet)
+		hdd_ht_ops->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
+	if (roam_ht_ops->rifsMode)
+		hdd_ht_ops->ht_param |= IEEE80211_HT_PARAM_RIFS_MODE;
+	if (roam_ht_ops->controlledAccessOnly)
+		hdd_ht_ops->ht_param |= HT_PARAM_CONTROLLED_ACCESS_ONLY;
+	temp_ht_ops = roam_ht_ops->serviceIntervalGranularity &
+		(HT_PARAM_SERVICE_INT_GRAN >> HT_PARAM_SERVICE_INT_GRAN_SHIFT);
+	if (temp_ht_ops)
+		hdd_ht_ops->ht_param |= temp_ht_ops <<
+			HT_PARAM_SERVICE_INT_GRAN_SHIFT;
+
+	/* operation mode */
+	temp_ht_ops = roam_ht_ops->opMode &
+			IEEE80211_HT_OP_MODE_PROTECTION;
+	switch (temp_ht_ops) {
+	case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
+		hdd_ht_ops->operation_mode |=
+			IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER;
+		break;
+	case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+		hdd_ht_ops->operation_mode |=
+			IEEE80211_HT_OP_MODE_PROTECTION_20MHZ;
+		break;
+	case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+		hdd_ht_ops->operation_mode |=
+			IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED;
+		break;
+	case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
+	default:
+		hdd_ht_ops->operation_mode |=
+			IEEE80211_HT_OP_MODE_PROTECTION_NONE;
+	}
+	if (roam_ht_ops->nonGFDevicesPresent)
+		hdd_ht_ops->operation_mode |=
+			IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT;
+	if (roam_ht_ops->transmitBurstLimit)
+		hdd_ht_ops->operation_mode |=
+			HT_OP_MODE_TX_BURST_LIMIT;
+	if (roam_ht_ops->obssNonHTStaPresent)
+		hdd_ht_ops->operation_mode |=
+			IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
+
+	/* stbc_param */
+	temp_ht_ops = roam_ht_ops->basicSTBCMCS &
+			HT_STBC_PARAM_MCS;
+	if (temp_ht_ops)
+		hdd_ht_ops->stbc_param |= temp_ht_ops;
+	if (roam_ht_ops->dualCTSProtection)
+		hdd_ht_ops->stbc_param |=
+			IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT;
+	if (roam_ht_ops->secondaryBeacon)
+		hdd_ht_ops->stbc_param |=
+			IEEE80211_HT_STBC_PARAM_STBC_BEACON;
+	if (roam_ht_ops->lsigTXOPProtectionFullSupport)
+		hdd_ht_ops->stbc_param |=
+			IEEE80211_HT_STBC_PARAM_LSIG_TXOP_FULLPROT;
+	if (roam_ht_ops->pcoActive)
+		hdd_ht_ops->stbc_param |=
+			IEEE80211_HT_STBC_PARAM_PCO_ACTIVE;
+	if (roam_ht_ops->pcoPhase)
+		hdd_ht_ops->stbc_param |=
+			IEEE80211_HT_STBC_PARAM_PCO_PHASE;
+
+	/* basic MCs set */
+	for (i = 0; i < 16; ++i)
+		hdd_ht_ops->basic_set[i] =
+			roam_ht_ops->basicMCSSet[i];
+}
+
+/**
+ * hdd_copy_vht_operation()- copy VHT operations element from roam info to
+ *  hdd station context.
+ * @hdd_sta_ctx: pointer to hdd station context
+ * @roam_info: pointer to roam info
+ *
+ * Return: None
+ */
+static void hdd_copy_vht_operation(hdd_station_ctx_t *hdd_sta_ctx,
+					      tCsrRoamInfo *roam_info)
+{
+	tDot11fIEVHTOperation *roam_vht_ops = &roam_info->vht_operation;
+	struct ieee80211_vht_operation *hdd_vht_ops =
+		&hdd_sta_ctx->conn_info.vht_operation;
+
+	adf_os_mem_zero(hdd_vht_ops, sizeof(struct ieee80211_vht_operation));
+
+	hdd_vht_ops->chan_width = roam_vht_ops->chanWidth;
+	hdd_vht_ops->center_freq_seg1_idx = roam_vht_ops->chanCenterFreqSeg1;
+	hdd_vht_ops->center_freq_seg2_idx = roam_vht_ops->chanCenterFreqSeg2;
+	hdd_vht_ops->basic_mcs_set = roam_vht_ops->basicMCSSet;
+}
+
+/**
+ * hdd_save_bss_info() - save connection info in hdd sta ctx
+ * @adapter: Pointer to adapter
+ * @roam_info: pointer to roam info
+ *
+ * Return: None
+ */
+static void hdd_save_bss_info(hdd_adapter_t *adapter,
+						tCsrRoamInfo *roam_info)
+{
+	hdd_station_ctx_t *hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+
+	hdd_sta_ctx->conn_info.freq = vos_chan_to_freq(
+		hdd_sta_ctx->conn_info.operationChannel);
+	if (roam_info->vht_caps.present) {
+		hdd_sta_ctx->conn_info.conn_flag.vht_present = true;
+		hdd_copy_vht_caps(hdd_sta_ctx, roam_info);
+	} else {
+		hdd_sta_ctx->conn_info.conn_flag.vht_present = false;
+	}
+	if (roam_info->ht_caps.present) {
+		hdd_sta_ctx->conn_info.conn_flag.ht_present = true;
+		hdd_copy_ht_caps(hdd_sta_ctx, roam_info);
+	} else {
+		hdd_sta_ctx->conn_info.conn_flag.ht_present = false;
+	}
+	if (roam_info->reassoc)
+		hdd_sta_ctx->conn_info.roam_count++;
+	if (roam_info->hs20vendor_ie.present) {
+		hdd_sta_ctx->conn_info.conn_flag.hs20_present = true;
+		adf_os_mem_copy(&hdd_sta_ctx->conn_info.hs20vendor_ie,
+			     &roam_info->hs20vendor_ie,
+			     sizeof(roam_info->hs20vendor_ie));
+	} else {
+		hdd_sta_ctx->conn_info.conn_flag.hs20_present = false;
+	}
+	if (roam_info->ht_operation.present) {
+		hdd_sta_ctx->conn_info.conn_flag.ht_op_present = true;
+		hdd_copy_ht_operation(hdd_sta_ctx, roam_info);
+	} else {
+		hdd_sta_ctx->conn_info.conn_flag.ht_op_present = false;
+	}
+	if (roam_info->vht_operation.present) {
+		hdd_sta_ctx->conn_info.conn_flag.vht_op_present = true;
+		hdd_copy_vht_operation(hdd_sta_ctx, roam_info);
+	} else {
+		hdd_sta_ctx->conn_info.conn_flag.vht_op_present = false;
+	}
+}
+
 static void
 hdd_connSaveConnectInfo(hdd_adapter_t *pAdapter, tCsrRoamInfo *pRoamInfo,
                         eCsrRoamBssType eBssType)
@@ -374,11 +867,15 @@ hdd_connSaveConnectInfo(hdd_adapter_t *pAdapter, tCsrRoamInfo *pRoamInfo,
           pHddStaCtx->conn_info.ucEncryptionType = encryptType;
 
           pHddStaCtx->conn_info.authType =  pRoamInfo->u.pConnectedProfile->AuthType;
+          pHddStaCtx->conn_info.last_auth_type = pHddStaCtx->conn_info.authType;
 
           pHddStaCtx->conn_info.operationChannel = pRoamInfo->u.pConnectedProfile->operationChannel;
 
           // Save the ssid for the connection
           vos_mem_copy( &pHddStaCtx->conn_info.SSID.SSID, &pRoamInfo->u.pConnectedProfile->SSID, sizeof( tSirMacSSid ) );
+          vos_mem_copy(&pHddStaCtx->conn_info.last_ssid.SSID,
+                       &pRoamInfo->u.pConnectedProfile->SSID,
+                       sizeof(tSirMacSSid));
 
           // Save  dot11mode in which STA associated to AP
           pHddStaCtx->conn_info.dot11Mode = pRoamInfo->u.pConnectedProfile->dot11Mode;
@@ -387,6 +884,7 @@ hdd_connSaveConnectInfo(hdd_adapter_t *pAdapter, tCsrRoamInfo *pRoamInfo,
           pHddStaCtx->conn_info.nss        = pRoamInfo->chan_info.nss;
           pHddStaCtx->conn_info.rate_flags = pRoamInfo->chan_info.rate_flags;
       }
+      hdd_save_bss_info(pAdapter, pRoamInfo);
    }
 
    // save the connected BssType
@@ -597,7 +1095,7 @@ static void hdd_SendNewAPChannelInfo(struct net_device *dev, hdd_adapter_t *pAda
     if (descriptor == NULL)
     {
         hddLog(LOGE,
-            "%s: pCsrRoamInfo->pBssDesc=%p",
+            "%s: pCsrRoamInfo->pBssDesc=%pK",
             __func__, descriptor);
         return;
     }
@@ -689,6 +1187,7 @@ static void hdd_SendAssociationEvent(struct net_device *dev,tCsrRoamInfo *pCsrRo
     int type = -1;
     v_MACADDR_t peerMacAddr;
 
+    hdd_adapter_t *mon_adapter = NULL;
 #if defined (WLAN_FEATURE_VOWIFI_11R)
     // Added to find the auth type on the fly at run time
     // rather than with cfg to see if FT is enabled
@@ -805,6 +1304,16 @@ static void hdd_SendAssociationEvent(struct net_device *dev,tCsrRoamInfo *pCsrRo
         spin_unlock_bh(&pHddCtx->bus_bw_lock);
         hdd_start_bus_bw_compute_timer(pAdapter);
 #endif
+        if (pHddCtx->cfg_ini->mon_on_sta_enable &&
+            (pAdapter->device_mode == WLAN_HDD_INFRA_STATION)) {
+            /* monitor mode interface should be ready */
+            mon_adapter = hdd_get_adapter(pHddCtx, WLAN_HDD_MONITOR);
+
+            if (mon_adapter && (WLAN_HDD_ADAPTER_MAGIC == mon_adapter->magic) &&
+                tlshim_get_rxmon_cbk()) {
+               wlan_hdd_monitor_mode_enable(pHddCtx, true);
+           }
+        }
     }
     else if (eConnectionState_IbssConnected == pHddStaCtx->conn_info.connState) // IBss Associated
     {
@@ -860,6 +1369,11 @@ static void hdd_SendAssociationEvent(struct net_device *dev,tCsrRoamInfo *pCsrRo
         spin_unlock_bh(&pHddCtx->bus_bw_lock);
         hdd_stop_bus_bw_compute_timer(pAdapter);
 #endif
+        if (pHddCtx->cfg_ini->mon_on_sta_enable &&
+            (pAdapter->device_mode == WLAN_HDD_INFRA_STATION) &&
+            (true == pHddCtx->is_mon_enable)) {
+            wlan_hdd_monitor_mode_enable(pHddCtx, false);
+        }
     }
     hdd_dump_concurrency_info(pHddCtx);
 
@@ -947,6 +1461,52 @@ VOS_STATUS hdd_roamDeregisterSTA(hdd_adapter_t *pAdapter, tANI_U8 staId)
     return( vosStatus );
 }
 
+/**
+ * hdd_print_bss_info() - print bss info
+ * @hdd_sta_ctx: pointer to hdd station context
+ *
+ * Return: None
+ */
+static void hdd_print_bss_info(hdd_station_ctx_t *hdd_sta_ctx)
+{
+	uint32_t *cap_info;
+
+	hddLog(VOS_TRACE_LEVEL_INFO, "WIFI DATA LOGGER");
+	hddLog(VOS_TRACE_LEVEL_INFO, "channel: %d",
+	       hdd_sta_ctx->conn_info.freq);
+	hddLog(VOS_TRACE_LEVEL_INFO, "dot11mode: %d",
+	       hdd_sta_ctx->conn_info.dot11Mode);
+	hddLog(VOS_TRACE_LEVEL_INFO, "AKM: %d",
+	       hdd_sta_ctx->conn_info.last_auth_type);
+	hddLog(VOS_TRACE_LEVEL_INFO, "ssid: %.*s",
+	       hdd_sta_ctx->conn_info.last_ssid.SSID.length,
+	       hdd_sta_ctx->conn_info.last_ssid.SSID.ssId);
+	hddLog(VOS_TRACE_LEVEL_INFO, "roam count: %d",
+	       hdd_sta_ctx->conn_info.roam_count);
+	hddLog(VOS_TRACE_LEVEL_INFO, "ant_info: %d",
+	       hdd_sta_ctx->conn_info.txrate.nss);
+	hddLog(VOS_TRACE_LEVEL_INFO, "datarate legacy %d",
+	       hdd_sta_ctx->conn_info.txrate.legacy);
+	hddLog(VOS_TRACE_LEVEL_INFO, "datarate mcs: %d",
+	       hdd_sta_ctx->conn_info.txrate.mcs);
+	if (hdd_sta_ctx->conn_info.conn_flag.ht_present) {
+		cap_info = (uint32_t *)&hdd_sta_ctx->conn_info.ht_caps;
+		hddLog(VOS_TRACE_LEVEL_INFO, "ht caps: %x", *cap_info);
+	}
+	if (hdd_sta_ctx->conn_info.conn_flag.vht_present) {
+		cap_info = (uint32_t *)&hdd_sta_ctx->conn_info.vht_caps;
+		hddLog(VOS_TRACE_LEVEL_INFO, "vht caps: %x", *cap_info);
+	}
+	if (hdd_sta_ctx->conn_info.conn_flag.hs20_present)
+		hddLog(VOS_TRACE_LEVEL_INFO, "hs20 info: %x",
+		       hdd_sta_ctx->conn_info.hs20vendor_ie.release_num);
+	hddLog(VOS_TRACE_LEVEL_INFO, "signal: %d",
+	       hdd_sta_ctx->conn_info.signal);
+	hddLog(VOS_TRACE_LEVEL_INFO, "noise: %d",
+	       hdd_sta_ctx->conn_info.noise);
+	hddLog(VOS_TRACE_LEVEL_INFO, "assoc_reject.status: %d",
+	       hdd_sta_ctx->conn_info.assoc_status_code);
+}
 
 static eHalStatus hdd_DisConnectHandler( hdd_adapter_t *pAdapter, tCsrRoamInfo *pRoamInfo,
                                             tANI_U32 roamId, eRoamCmdStatus roamStatus,
@@ -990,6 +1550,10 @@ static eHalStatus hdd_DisConnectHandler( hdd_adapter_t *pAdapter, tCsrRoamInfo *
      }
 #endif /* QCA_PKT_PROTO_TRACE */
 
+    DPTRACE(adf_dp_trace_mgmt_pkt(ADF_DP_TRACE_MGMT_PACKET_RECORD,
+                   pAdapter->sessionId,
+                   ADF_PROTO_TYPE_MGMT, ADF_PROTO_MGMT_DISASSOC));
+
     /* HDD has initiated disconnect, do not send disconnect indication
      * to kernel. Sending disconnected event to kernel for userspace
      * initiated disconnect will be handled by diconnect handler call
@@ -1217,8 +1781,10 @@ static eHalStatus hdd_DisConnectHandler( hdd_adapter_t *pAdapter, tCsrRoamInfo *
     if (pHddCtx->cfg_ini->enable_dynamic_sta_chainmask)
        hdd_decide_dynamic_chain_mask(pHddCtx,
                           HDD_ANTENNA_MODE_INVALID);
+
     //Unblock anyone waiting for disconnect to complete
     complete(&pAdapter->disconnect_comp_var);
+    hdd_print_bss_info(pHddStaCtx);
     return( status );
 }
 
@@ -1532,15 +2098,10 @@ static void hdd_SendReAssocEvent(struct net_device *dev,
                                  (int)pCsrRoamInfo->pBssDesc->channelId);
     memset(&roam_profile, 0, sizeof(tCsrRoamConnectedProfile));
     sme_RoamGetConnectProfile(hal_handle, pAdapter->sessionId, &roam_profile);
-    bss = cfg80211_get_bss(pAdapter->wdev.wiphy, chan, pCsrRoamInfo->bssid,
-        &roam_profile.SSID.ssId[0], roam_profile.SSID.length,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 1, 0)) && !defined(WITH_BACKPORTS) \
-     && !defined(IEEE80211_PRIVACY)
-        WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
-#else
-        IEEE80211_BSS_TYPE_ESS, IEEE80211_PRIVACY_ANY);
-#endif
-
+    bss = hdd_cfg80211_get_bss(pAdapter->wdev.wiphy,
+            chan, pCsrRoamInfo->bssid,
+            &roam_profile.SSID.ssId[0],
+            roam_profile.SSID.length);
     if (bss == NULL)
         hddLog(LOGE, FL("Get BSS returned NULL"));
     buf_ptr = buf_ssid_ie;
@@ -1613,6 +2174,7 @@ static int hdd_change_sta_state_authenticated(hdd_adapter_t *adapter,
 			hdd_is_roam_sync_in_progress(roaminfo));
 	hdd_connSetAuthenticated(adapter, VOS_TRUE);
 	if (hddctx->cfg_ini->enablePowersaveOffload &&
+		(false == hddctx->is_mon_enable) &&
 		((WLAN_HDD_INFRA_STATION == adapter->device_mode) ||
 		(WLAN_HDD_P2P_CLIENT == adapter->device_mode))) {
 		sme_PsOffloadEnableDeferredPowerSave(
@@ -1649,6 +2211,21 @@ void hdd_PerformRoamSetKeyComplete(hdd_adapter_t *pAdapter)
     pHddStaCtx->roam_info.deferKeyComplete = FALSE;
 }
 
+#if defined(WLAN_FEATURE_FILS_SK) && defined(CFG80211_FILS_SK_OFFLOAD_SUPPORT)
+static void hdd_clear_fils_connection_info(hdd_adapter_t *adapter)
+{
+       hdd_wext_state_t *wext_state = WLAN_HDD_GET_WEXT_STATE_PTR(adapter);
+
+       if (wext_state->roamProfile.fils_con_info) {
+              vos_mem_free(wext_state->roamProfile.fils_con_info);
+              wext_state->roamProfile.fils_con_info = NULL;
+       }
+}
+#else
+static void hdd_clear_fils_connection_info(hdd_adapter_t *adapter)
+{ }
+#endif
+
 /**
  * hdd_sap_restart_handle() - to handle restarting of SAP
  * @work: name of the work
@@ -1683,97 +2260,12 @@ void hdd_sap_restart_handle(struct work_struct *work)
         wlan_hdd_restart_sap(sap_adapter);
         hdd_change_ch_avoidance_status(hdd_ctx, false);
     } else {
-        wlan_hdd_start_sap(sap_adapter);
+        wlan_hdd_start_sap(sap_adapter, false);
         hdd_change_sap_restart_required_status(hdd_ctx, false);
     }
     vos_ssr_unprotect(__func__);
 }
 
-void hdd_get_band(uint8_t channel, uint8_t *band)
-{
-   if ( channel > 0 && channel < 14 )
-       *band = 2;
-   else if (channel >= 36 && channel <= 184 )
-       *band = 5;
-}
-
-uint8_t hdd_is_mcc_in_2_band(hdd_context_t *hdd_ctx)
-{
-	VOS_STATUS status;
-	hdd_adapter_t *hdd_adapter = NULL;
-	hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
-	uint8_t ret = 0;
-	hdd_station_ctx_t *sta_ctx;
-	hdd_ap_ctx_t *ap_ctx;
-	uint8_t band1 = 0, band2 = 0;
-	uint8_t channel = 0, band = 0;
-	hdd_hostapd_state_t *hostapd_state;
-
-	status =  hdd_get_front_adapter(hdd_ctx, &adapter_node);
-
-	/* loop through all adapters and check MCC for STA,P2P,SAP adapters */
-	while (NULL != adapter_node && VOS_STATUS_SUCCESS == status) {
-		hdd_adapter = adapter_node->pAdapter;
-
-		if (!((hdd_adapter->device_mode >= WLAN_HDD_INFRA_STATION)
-					&& (hdd_adapter->device_mode
-						<= WLAN_HDD_P2P_GO))) {
-			/* skip for other adapters */
-			status = hdd_get_next_adapter(hdd_ctx,
-					adapter_node, &next);
-			adapter_node = next;
-			continue;
-		} else {
-			if (WLAN_HDD_INFRA_STATION ==
-					hdd_adapter->device_mode ||
-					WLAN_HDD_P2P_CLIENT ==
-					hdd_adapter->device_mode) {
-				sta_ctx =
-					WLAN_HDD_GET_STATION_CTX_PTR(
-								hdd_adapter);
-				if (eConnectionState_Associated ==
-						sta_ctx->conn_info.connState)
-					channel =
-						sta_ctx->conn_info.
-							operationChannel;
-					hdd_get_band(channel, &band);
-			} else if (WLAN_HDD_P2P_GO ==
-					hdd_adapter->device_mode ||
-					WLAN_HDD_SOFTAP ==
-					hdd_adapter->device_mode) {
-				ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(hdd_adapter);
-				hostapd_state =
-					WLAN_HDD_GET_HOSTAP_STATE_PTR(
-								hdd_adapter);
-				if (hostapd_state->bssState == BSS_START &&
-						hostapd_state->vosStatus ==
-						VOS_STATUS_SUCCESS)
-					channel = ap_ctx->operatingChannel;
-					hdd_get_band(channel, &band);
-			}
-
-			if (band1 == 0 && band != 0) {
-				band1 = band;
-			} else if (band2 == 0 && band != 0) {
-				band2 = band;
-			}
-
-			if (band1 != 0 && band2 != 0 && band1 != band2) {
-				hddLog(LOGE,
-					"MCC in 2 bands");
-				return 1;
-			}
-
-			status = hdd_get_next_adapter(hdd_ctx,
-					adapter_node, &next);
-			adapter_node = next;
-		}
-		channel = 0;
-		band = 0;
-	}
-	return ret;
-}
-
 static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCsrRoamInfo *pRoamInfo,
                                                     tANI_U32 roamId, eRoamCmdStatus roamStatus,
                                                     eCsrRoamResult roamResult )
@@ -1797,6 +2289,7 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
     hdd_adapter_t *sap_adapter;
     hdd_ap_ctx_t *hdd_ap_ctx;
     uint8_t default_sap_channel = 6;
+    tSirResultCodes timeout_reason = 0;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
     if (pRoamInfo && pRoamInfo->roamSynchInProgress) {
        /* change logging before release */
@@ -1912,7 +2405,12 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
         wlan_hdd_auto_shutdown_enable(pHddCtx, VOS_FALSE);
 #endif
-
+        /* validate cfg_ini */
+        if (!pHddCtx->cfg_ini) {
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                          "cfg_ini is NULL");
+                return eHAL_STATUS_E_NULL_VALUE;
+        }
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
         if ((pHddCtx->cfg_ini->WlanMccToSccSwitchMode
                 != VOS_MCC_TO_SCC_SWITCH_DISABLE) &&
@@ -1937,6 +2435,11 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
            vos_pkt_trace_buf_update("ST:ASSOC");
         }
 #endif /* QCA_PKT_PROTO_TRACE */
+
+        DPTRACE(adf_dp_trace_mgmt_pkt(ADF_DP_TRACE_MGMT_PACKET_RECORD,
+                       pAdapter->sessionId,
+                       ADF_PROTO_TYPE_MGMT, ADF_PROTO_MGMT_ASSOC));
+
         //For reassoc, the station is already registered, all we need is to change the state
         //of the STA in TL.
         //If authentication is required (WPA/WPA2/DWEP), change TL to CONNECTED instead of AUTHENTICATED
@@ -1956,10 +2459,24 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
             /* add bss_id to cfg80211 data base */
             bss = wlan_hdd_cfg80211_update_bss_db(pAdapter, pRoamInfo);
             if (NULL == bss) {
-                pr_err("wlan: Not able to create BSS entry\n");
+                hddLog(LOGE,
+                     FL("Not able to add BSS entry"));
                 wlan_hdd_netif_queue_control(pAdapter,
                     WLAN_NETIF_CARRIER_OFF,
                     WLAN_CONTROL_PATH);
+                if (!hddDisconInProgress) {
+                   /*
+                    * Here driver was not able to add bss in cfg80211 database
+                    * this can happen if connected channel is not valid,
+                    * i.e reg domain was changed during connection.
+                    * Queue disconnect for the session if disconnect is
+                    * not in progress.
+                    */
+                    hddLog(LOGE, FL("Disconnecting..."));
+                    sme_RoamDisconnect( WLAN_HDD_GET_HAL_CTX(pAdapter),
+                                 pAdapter->sessionId,
+                                 eCSR_DISCONNECT_REASON_UNSPECIFIED);
+                }
                 return eHAL_STATUS_FAILURE;
             }
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -2015,6 +2532,8 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
                 {
                     if ( !hddDisconInProgress )
                     {
+                        struct cfg80211_bss *roam_bss;
+
                         /* After roaming is completed, active session count is
                          * incremented as a part of connect indication but
                          * effectively the active session count should still
@@ -2029,9 +2548,19 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
                                              (int)pRoamInfo->pBssDesc->channelId);
                         hddLog(LOG1, "assocReqlen %d assocRsplen %d", assocReqlen,
                                              assocRsplen);
-                        cfg80211_roamed(dev,chan, pRoamInfo->bssid,
-                                         pFTAssocReq, assocReqlen, pFTAssocRsp, assocRsplen,
-                                        GFP_KERNEL);
+                        roam_bss =
+                            hdd_cfg80211_get_bss(
+                               pAdapter->wdev.wiphy,
+                               chan,
+                               pRoamInfo->bssid,
+                               pRoamInfo->u.
+                               pConnectedProfile->SSID.ssId,
+                               pRoamInfo->u.
+                               pConnectedProfile->SSID.length);
+                        cfg80211_roamed_bss(dev, roam_bss,
+                               pFTAssocReq, assocReqlen,
+                               pFTAssocRsp, assocRsplen,
+                               GFP_KERNEL);
                     }
                     if (sme_GetFTPTKState(WLAN_HDD_GET_HAL_CTX(pAdapter),
                                           pAdapter->sessionId))
@@ -2060,7 +2589,8 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
                                        pFTAssocReq, assocReqlen,
                                        pFTAssocRsp, assocRsplen,
                                        WLAN_STATUS_SUCCESS,
-                                       GFP_KERNEL);
+                                       GFP_KERNEL, false,
+                                       pRoamInfo->statusCode);
                 }
             }
             else
@@ -2095,7 +2625,7 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
                                 reqRsnIe, reqRsnLength,
                                 rspRsnIe, rspRsnLength,
                                 WLAN_STATUS_SUCCESS,
-                                GFP_KERNEL);
+                                GFP_KERNEL, false, pRoamInfo->statusCode);
                     }
                 }
             }
@@ -2203,6 +2733,7 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
     else
     {
         hdd_context_t* pHddCtx = (hdd_context_t*)pAdapter->pHddCtx;
+        bool connect_timeout = false;
 
         hdd_wext_state_t *pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
         if (pRoamInfo)
@@ -2276,22 +2807,25 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
                     pRoamInfo ? pRoamInfo->bssid : pWextState->req_bssId);
              sme_remove_bssid_from_scan_list(hHal,
                     pRoamInfo ? pRoamInfo->bssid : pWextState->req_bssId);
+             connect_timeout = true;
         }
 
         /* CR465478: Only send up a connection failure result when CSR has
          * completed operation - with a ASSOCIATION_FAILURE status.*/
         if ( eCSR_ROAM_ASSOCIATION_FAILURE == roamStatus &&  !hddDisconInProgress )
         {
-            if (pRoamInfo)
+            if (pRoamInfo) {
                 hddLog(VOS_TRACE_LEVEL_ERROR,
                        "%s: send connect failure to nl80211: for bssid " MAC_ADDRESS_STR" result:%d and Status:%d reasonCode %d" ,
                        __func__, MAC_ADDR_ARRAY(pRoamInfo->bssid),
                        roamResult, roamStatus, pRoamInfo->reasonCode);
-            else
+                pHddStaCtx->conn_info.assoc_status_code = pRoamInfo->statusCode;
+            } else {
                 hddLog(VOS_TRACE_LEVEL_ERROR,
                        "%s: connect failed: for bssid " MAC_ADDRESS_STR " result:%d and Status:%d " ,
                        __func__, MAC_ADDR_ARRAY(pWextState->req_bssId),
                        roamResult, roamStatus);
+            }
 
             hddLog(LOG1, FL("Invoking packetdump deregistration API"));
             wlan_deregister_txrx_packetdump();
@@ -2300,30 +2834,32 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
             if ( eCSR_ROAM_RESULT_ASSOC_FAIL_CON_CHANNEL == roamResult )
             {
                if (pRoamInfo)
-                   hdd_connect_result(dev, pRoamInfo->bssid, NULL,
+                   hdd_connect_result(dev, pRoamInfo->bssid,
+                        pRoamInfo,
                         NULL, 0, NULL, 0,
                         WLAN_STATUS_ASSOC_DENIED_UNSPEC,
-                        GFP_KERNEL);
+                        GFP_KERNEL, connect_timeout, pRoamInfo->statusCode);
                else
                    hdd_connect_result(dev, pWextState->req_bssId, NULL,
                         NULL, 0, NULL, 0,
                         WLAN_STATUS_ASSOC_DENIED_UNSPEC,
-                        GFP_KERNEL);
+                        GFP_KERNEL, connect_timeout, timeout_reason);
             }
             else
             {
                if (pRoamInfo)
-                   hdd_connect_result(dev, pRoamInfo->bssid, NULL,
+                   hdd_connect_result(dev, pRoamInfo->bssid,
+                        pRoamInfo,
                         NULL, 0, NULL, 0,
                         pRoamInfo->reasonCode ?
                         pRoamInfo->reasonCode :
                         WLAN_STATUS_UNSPECIFIED_FAILURE,
-                        GFP_KERNEL);
+                        GFP_KERNEL, connect_timeout, pRoamInfo->statusCode);
                else
                    hdd_connect_result(dev, pWextState->req_bssId, NULL,
                         NULL, 0, NULL, 0,
                         WLAN_STATUS_UNSPECIFIED_FAILURE,
-                        GFP_KERNEL);
+                        GFP_KERNEL, connect_timeout, timeout_reason);
             }
             /* Clear the roam profile */
             hdd_clearRoamProfileIe(pAdapter);
@@ -2394,7 +2930,7 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
 
 
     }
-
+    hdd_clear_fils_connection_info(pAdapter);
     /*
      * Call hdd_decide_dynamic_chain_mask only when CSR has
      * completed connect with failure or success i.e. with
@@ -2426,47 +2962,6 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
         }
     }
 #endif /* FEATURE_WLAN_FORCE_SAP_SCC */
-    if (eConnectionState_Associated == pHddStaCtx->conn_info.connState) {
-        if (hdd_is_mcc_in_2_band(pHddCtx)) {
-            switch (pHddCtx->thermal_level) {
-                case 0:
-                    thermal_band =
-                         (pHddCtx->cfg_ini->throttle_dutycycle_level0_2g
-                         > pHddCtx->cfg_ini->throttle_dutycycle_level0_5g)
-                         ? 2
-                         : 5;
-                         break;
-                case 1:
-                    thermal_band =
-                         (pHddCtx->cfg_ini->throttle_dutycycle_level1_2g
-                         > pHddCtx->cfg_ini->throttle_dutycycle_level1_5g)
-                         ? 2
-                         : 5;
-                         break;
-                case 2:
-                    thermal_band =
-                         (pHddCtx->cfg_ini->throttle_dutycycle_level2_2g
-                         > pHddCtx->cfg_ini->throttle_dutycycle_level2_5g)
-                         ? 2
-                         : 5;
-                         break;
-                case 3:
-                    thermal_band =
-                         (pHddCtx->cfg_ini->throttle_dutycycle_level3_2g
-                         > pHddCtx->cfg_ini->throttle_dutycycle_level3_5g)
-                         ? 2
-                         : 5;
-                         break;
-                default:
-                    hddLog(VOS_TRACE_LEVEL_ERROR,
-                       "invalid thermal level %d",
-                       pHddCtx->thermal_level);
-           }
-        } else {
-             hdd_get_band(pHddStaCtx->conn_info.operationChannel, &thermal_band);
-        }
-        sme_SetThermalLevel(pHddCtx->hHal, pHddCtx->thermal_level);
-    }
     return eHAL_STATUS_SUCCESS;
 }
 
@@ -3008,7 +3503,7 @@ static eHalStatus roamRoamConnectStatusUpdateHandler( hdd_adapter_t *pAdapter, t
                hddLog(VOS_TRACE_LEVEL_ERROR,
                        "%s: sme_RoamSetKey failed, returned %d",
                        __func__, vosStatus);
-               return VOS_STATUS_E_FAILURE;
+               return eHAL_STATUS_FAILURE;
             }
          }
          hddLog(LOG1, FL("Enabling queues"));
@@ -3244,8 +3739,17 @@ hdd_RoamTdlsStatusUpdateHandler(hdd_adapter_t *pAdapter,
         {
             if(eSIR_SME_SUCCESS != pRoamInfo->statusCode)
             {
+                hddTdlsPeer_t *curr_peer;
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                      ("%s: Add Sta is failed. %d"),__func__, pRoamInfo->statusCode);
+                mutex_lock(&pHddCtx->tdls_lock);
+                curr_peer = wlan_hdd_tdls_find_peer(pAdapter,
+                                     pRoamInfo->peerMac, FALSE);
+                if (curr_peer)
+                    curr_peer->link_status = eTDLS_LINK_TEARING;
+                else
+                    hddLog(LOG1, FL("curr_peer is Null"));
+                mutex_unlock(&pHddCtx->tdls_lock);
             }
             else
             {
@@ -3310,10 +3814,21 @@ hdd_RoamTdlsStatusUpdateHandler(hdd_adapter_t *pAdapter,
         }
         case eCSR_ROAM_RESULT_LINK_ESTABLISH_REQ_RSP:
         {
+
+            hddTdlsPeer_t *curr_peer;
             if (eSIR_SME_SUCCESS != pRoamInfo->statusCode)
             {
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                      "%s: Link Establish Request failed. %d", __func__, pRoamInfo->statusCode);
+                mutex_lock(&pHddCtx->tdls_lock);
+                curr_peer = wlan_hdd_tdls_find_peer(pAdapter,
+                                          pRoamInfo->peerMac, FALSE);
+                if (curr_peer)
+                    curr_peer->link_status = eTDLS_LINK_TEARING;
+                else
+                    hddLog(LOGE, FL("curr_peer is Null"));
+
+                mutex_unlock(&pHddCtx->tdls_lock);
             }
             complete(&pAdapter->tdls_link_establish_req_comp);
             break;
@@ -3350,7 +3865,6 @@ hdd_RoamTdlsStatusUpdateHandler(hdd_adapter_t *pAdapter,
                     pHddCtx->tdlsConnInfo[staIdx].sessionId = 255;
                     vos_mem_zero(&pHddCtx->tdlsConnInfo[staIdx].peerMac,
                                                sizeof(v_MACADDR_t)) ;
-                    wlan_hdd_tdls_check_bmps(pAdapter);
                     status = eHAL_STATUS_SUCCESS ;
                     break ;
                 }
@@ -3358,6 +3872,12 @@ hdd_RoamTdlsStatusUpdateHandler(hdd_adapter_t *pAdapter,
             complete(&pAdapter->tdls_del_station_comp);
         }
         break ;
+        case  eCSR_ROAM_TDLS_CHECK_BMPS:
+        {
+            wlan_hdd_tdls_check_bmps(pAdapter);
+            status = eHAL_STATUS_SUCCESS ;
+            break;
+        }
         case eCSR_ROAM_RESULT_TEARDOWN_TDLS_PEER_IND:
         {
             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
@@ -3444,10 +3964,11 @@ hdd_RoamTdlsStatusUpdateHandler(hdd_adapter_t *pAdapter,
                 break;
             }
 
-            curr_peer = wlan_hdd_tdls_get_peer(pAdapter, pRoamInfo->peerMac);
+            curr_peer = wlan_hdd_tdls_get_peer(pAdapter, pRoamInfo->peerMac,
+                                               TRUE);
             if (!curr_peer)
             {
-                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                           "%s: curr_peer null", __func__);
                 status = eHAL_STATUS_FAILURE;
             }
@@ -3498,7 +4019,7 @@ hdd_RoamTdlsStatusUpdateHandler(hdd_adapter_t *pAdapter,
             curr_peer = wlan_hdd_tdls_find_peer(pAdapter, pRoamInfo->peerMac, TRUE);
             if (!curr_peer)
             {
-                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                           "%s: curr_peer null", __func__);
                 status = eHAL_STATUS_FAILURE;
             }
@@ -3554,7 +4075,7 @@ hdd_RoamTdlsStatusUpdateHandler(hdd_adapter_t *pAdapter,
             curr_peer = wlan_hdd_tdls_find_peer(pAdapter, pRoamInfo->peerMac, TRUE);
             if (!curr_peer)
             {
-                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                           "%s: curr_peer null", __func__);
                 status = eHAL_STATUS_FAILURE;
             }
@@ -3624,7 +4145,7 @@ static void iw_full_power_cbfn (void *pContext, eHalStatus status)
     if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Bad param, pAdapter [%p]",
+             "%s: Bad param, pAdapter [%pK]",
                __func__, pAdapter);
         return;
     }
@@ -4096,11 +4617,6 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
 #endif
             }
            break;
-	case eCSR_ROAM_LOSTLINK_DETECTED:
-            if((roamResult != eCSR_ROAM_RESULT_DISASSOC_IND) &&
-               (roamResult != eCSR_ROAM_RESULT_DEAUTH_IND)) {
-                break;
-            } /* else fall through */
         case eCSR_ROAM_LOSTLINK:
             if(roamResult == eCSR_ROAM_RESULT_LOSTLINK) {
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
@@ -4140,7 +4656,8 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
                 /* Call to clear any MC Addr List filter applied after
                  * successful connection.
                  */
-                wlan_hdd_set_mc_addr_list(pAdapter, FALSE);
+                if (wlan_hdd_set_mc_addr_list(pAdapter, FALSE))
+                    hddLog(VOS_TRACE_LEVEL_ERROR, FL("failed to clear mc addr list"));
 #endif
             }
             break;
@@ -4308,6 +4825,7 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
         case eCSR_ROAM_RESULT_MGMT_TX_COMPLETE_IND:
             wlan_hdd_tdls_mgmt_completion_callback(pAdapter, pRoamInfo->reasonCode);
             break;
+
 #endif
 #ifdef WLAN_FEATURE_11W
        case eCSR_ROAM_UNPROT_MGMT_FRAME_IND:
@@ -4368,9 +4886,37 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
     }
     return( halStatus );
 }
+
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * hdd_translate_fils_rsn_to_csr_auth() - Translate FILS RSN to CSR auth type
+ * @auth_suite: auth suite
+ * @auth_type: pointer to eCsrAuthType
+ *
+ * Return: None
+ */
+static void hdd_translate_fils_rsn_to_csr_auth(u_int8_t auth_suite[4],
+					eCsrAuthType *auth_type)
+{
+	if (!memcmp(auth_suite, ccp_rsn_oui_0e, 4))
+		*auth_type = eCSR_AUTH_TYPE_FILS_SHA256;
+	else if (!memcmp(auth_suite, ccp_rsn_oui_0f, 4))
+		*auth_type = eCSR_AUTH_TYPE_FILS_SHA384;
+	else if (!memcmp(auth_suite, ccp_rsn_oui_10, 4))
+		*auth_type = eCSR_AUTH_TYPE_FT_FILS_SHA256;
+	else if (!memcmp(auth_suite, ccp_rsn_oui_11, 4))
+		*auth_type = eCSR_AUTH_TYPE_FT_FILS_SHA384;
+}
+#else
+static inline void hdd_translate_fils_rsn_to_csr_auth(u_int8_t auth_suite[4],
+					eCsrAuthType *auth_type)
+{
+}
+#endif
+
 eCsrAuthType hdd_TranslateRSNToCsrAuthType( u_int8_t auth_suite[4])
 {
-    eCsrAuthType auth_type;
+    eCsrAuthType auth_type = eCSR_AUTH_TYPE_UNKNOWN;
     // is the auth type supported?
     if ( memcmp(auth_suite , ccpRSNOui01, 4) == 0)
     {
@@ -4408,16 +4954,17 @@ eCsrAuthType hdd_TranslateRSNToCsrAuthType( u_int8_t auth_suite[4])
         auth_type = eCSR_AUTH_TYPE_RSN_8021X_SHA256;
     } else
 #endif
-    {
-        auth_type = eCSR_AUTH_TYPE_UNKNOWN;
-    }
+	/* If auth suite is of fils, auth_type will be
+	 * overwritten in hdd_translate_fils_rsn_to_csr_auth
+	 */
+	hdd_translate_fils_rsn_to_csr_auth(auth_suite, &auth_type);
     return auth_type;
 }
 
 eCsrAuthType
 hdd_TranslateWPAToCsrAuthType(u_int8_t auth_suite[4])
 {
-    eCsrAuthType auth_type;
+    eCsrAuthType auth_type = eCSR_AUTH_TYPE_UNKNOWN;
     // is the auth type supported?
     if ( memcmp(auth_suite , ccpWpaOui01, 4) == 0)
     {
@@ -4433,9 +4980,11 @@ hdd_TranslateWPAToCsrAuthType(u_int8_t auth_suite[4])
         auth_type = eCSR_AUTH_TYPE_CCKM_WPA;
     } else
 #endif /* FEATURE_WLAN_ESE */
-    {
-        auth_type = eCSR_AUTH_TYPE_UNKNOWN;
-    }
+	/* If auth suite is of fils, auth_type will be
+	 * overwritten in hdd_translate_fils_rsn_to_csr_auth
+	 */
+	hdd_translate_fils_rsn_to_csr_auth(auth_suite, &auth_type);
+
     hddLog(LOG1, FL("auth_type: %d"), auth_type);
     return auth_type;
 }
@@ -4518,6 +5067,28 @@ hdd_TranslateWPAToCsrEncryptionType(u_int8_t cipher_suite[4])
     return cipher_type;
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+/*
+ * hdd_is_fils_connection: API to determine if connection is FILS
+ * @adapter: hdd adapter
+ *
+ * Return: true if fils connection else false
+*/
+static inline bool hdd_is_fils_connection(hdd_adapter_t *adapter)
+{
+    hdd_wext_state_t *wext_state = WLAN_HDD_GET_WEXT_STATE_PTR(adapter);
+    if (wext_state->roamProfile.fils_con_info)
+        return wext_state->roamProfile.fils_con_info->is_fils_connection;
+
+    return false;
+}
+#else
+static inline bool hdd_is_fils_connection(hdd_adapter_t *adapter)
+{
+    return false;
+}
+#endif
+
 static tANI_S32 hdd_ProcessGENIE(hdd_adapter_t *pAdapter,
                 struct ether_addr *pBssid,
                 eCsrEncryptionType *pEncryptType,
@@ -4535,11 +5106,13 @@ static tANI_S32 hdd_ProcessGENIE(hdd_adapter_t *pAdapter,
     tDot11fIERSN dot11RSNIE;
     tDot11fIEWPA dot11WPAIE;
     tANI_U32 i;
+    tANI_U32 status;
     tANI_U8 *pRsnIe;
     tANI_U16 RSNIeLen;
     tPmkidCacheInfo PMKIDCache[4]; // Local transfer memory
     v_BOOL_t updatePMKCache = FALSE;
 
+    vos_mem_zero(PMKIDCache, sizeof PMKIDCache);
     /* Clear struct of tDot11fIERSN and tDot11fIEWPA specifically setting present
        flag to 0 */
     memset( &dot11WPAIE, 0 , sizeof(tDot11fIEWPA) );
@@ -4560,10 +5133,17 @@ static tANI_S32 hdd_ProcessGENIE(hdd_adapter_t *pAdapter,
         pRsnIe = gen_ie + 2;
         RSNIeLen = gen_ie_len - 2;
         // Unpack the RSN IE
-        dot11fUnpackIeRSN((tpAniSirGlobal) halHandle,
+        status = dot11fUnpackIeRSN((tpAniSirGlobal) halHandle,
                             pRsnIe,
                             RSNIeLen,
                             &dot11RSNIE);
+        if (DOT11F_FAILED(status))
+        {
+            hddLog(LOGE,
+                       FL("Parse failure in hdd_ProcessGENIE (0x%08x)"),
+                       status);
+            return -EINVAL;
+        }
         // Copy out the encryption and authentication types
         hddLog(LOG1, FL("%s: pairwise cipher suite count: %d"),
                 __func__, dot11RSNIE.pwise_cipher_suite_count );
@@ -4726,6 +5306,32 @@ int hdd_SetGENIEToCsr( hdd_adapter_t *pAdapter, eCsrAuthType *RSNAuthType)
     }
     return 0;
 }
+
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * hdd_check_fils_rsn_n_set_auth_type() - This API checks whether a give
+ * auth type is fils if yes, sets it in profile.
+ * @rsn_auth_type: auth type
+ *
+ * Return: true if FILS auth else false
+ */
+static bool hdd_check_fils_rsn_n_set_auth_type(tCsrRoamProfile *roam_profile,
+			    eCsrAuthType rsn_auth_type)
+{
+	bool is_fils_rsn = false;
+
+	if ((rsn_auth_type == eCSR_AUTH_TYPE_FILS_SHA256) ||
+	   (rsn_auth_type == eCSR_AUTH_TYPE_FILS_SHA384) ||
+	   (rsn_auth_type == eCSR_AUTH_TYPE_FT_FILS_SHA256) ||
+	   (rsn_auth_type == eCSR_AUTH_TYPE_FT_FILS_SHA384))
+		is_fils_rsn = true;
+	if (is_fils_rsn)
+		roam_profile->fils_con_info->akm_type = rsn_auth_type;
+
+	return is_fils_rsn;
+}
+#endif
+
 int hdd_set_csr_auth_type ( hdd_adapter_t  *pAdapter, eCsrAuthType RSNAuthType)
 {
     hdd_wext_state_t *pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
@@ -4807,7 +5413,12 @@ int hdd_set_csr_auth_type ( hdd_adapter_t  *pAdapter, eCsrAuthType RSNAuthType)
                                             eCSR_AUTH_TYPE_RSN_8021X_SHA256;
             } else
 #endif
-
+#ifdef WLAN_FEATURE_FILS_SK
+            if (hdd_check_fils_rsn_n_set_auth_type(pRoamProfile, RSNAuthType)) {
+				pRoamProfile->AuthType.authType[0] = RSNAuthType;
+				hddLog(LOG1, "updated profile authtype as %d", RSNAuthType);
+            } else
+#endif
             if( (pWextState->authKeyMgmt & IW_AUTH_KEY_MGMT_802_1X)
                     == IW_AUTH_KEY_MGMT_802_1X) {
                pRoamProfile->AuthType.authType[0] = eCSR_AUTH_TYPE_RSN;
@@ -4854,18 +5465,15 @@ static int __iw_set_essid(struct net_device *dev,
                         struct iw_request_info *info,
                         union iwreq_data *wrqu, char *extra)
 {
-    unsigned long rc;
     v_U32_t status = 0;
     hdd_wext_state_t *pWextState;
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
     v_U32_t roamId;
     tCsrRoamProfile          *pRoamProfile;
     hdd_context_t *pHddCtx;
-    eMib_dot11DesiredBssType connectedBssType;
     eCsrAuthType RSNAuthType;
     uint16_t ch_width;
     tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
-    hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
     int ret;
 
     ENTER();
@@ -4893,25 +5501,15 @@ static int __iw_set_essid(struct net_device *dev,
         return -EINVAL;
 
     pRoamProfile = &pWextState->roamProfile;
-    if (hdd_connGetConnectedBssType(pHddStaCtx, &connectedBssType) ||
-       (eMib_dot11DesiredBssType_independent ==
-                               pHddStaCtx->conn_info.connDot11DesiredBssType)) {
-        VOS_STATUS vosStatus;
-
-        /* Need to issue a disconnect to CSR. */
-        INIT_COMPLETION(pAdapter->disconnect_comp_var);
-        vosStatus = sme_RoamDisconnect(hHal, pAdapter->sessionId,
-                                       eCSR_DISCONNECT_REASON_UNSPECIFIED);
 
-        if (VOS_STATUS_SUCCESS == vosStatus) {
-            rc = wait_for_completion_timeout(&pAdapter->disconnect_comp_var,
-                          msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
-            if (!rc) {
-                hddLog( LOGE, FL("Disconnect event timed out"));
-            }
-        }
+    /*Try disconnecting if already in connected state*/
+    status = wlan_hdd_try_disconnect(pAdapter);
+    if (0 > status)
+    {
+      hddLog(VOS_TRACE_LEVEL_ERROR, FL("Failed to disconnect the existing"
+            " connection"));
+      return -EALREADY;
     }
-
     /** when cfg80211 defined, wpa_supplicant wext driver uses
       zero-length, null-string ssid for force disconnection.
       after disconnection (if previously connected) and cleaning ssid,
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg.c
index f6731608e82..a1e8202d44c 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -573,6 +573,13 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_CHANNEL_BONDING_MODE_MIN,
                  CFG_CHANNEL_BONDING_MODE_MAX),
 
+   REG_VARIABLE(CFG_OVERRIDE_HT40_20_24GHZ_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, override_ht20_40_24g,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_OVERRIDE_HT40_20_24GHZ_DEFAULT,
+                CFG_OVERRIDE_HT40_20_24GHZ_MIN,
+                CFG_OVERRIDE_HT40_20_24GHZ_MAX),
+
    REG_VARIABLE( CFG_CHANNEL_BONDING_MODE_5GHZ_NAME, WLAN_PARAM_Integer,
                  hdd_config_t, nChannelBondingMode5GHz,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK,
@@ -950,21 +957,6 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_IDLE_TIME_DEFAULT,
                  CFG_IDLE_TIME_MIN,
                  CFG_IDLE_TIME_MAX ),
-
-
-   REG_VARIABLE( CFG_NUM_STA_CHAN_COMBINED_CONC_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, nNumStaChanCombinedConc,
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_NUM_STA_CHAN_COMBINED_CONC_DEFAULT,
-                 CFG_NUM_STA_CHAN_COMBINED_CONC_MIN,
-                 CFG_NUM_STA_CHAN_COMBINED_CONC_MAX ),
-
-   REG_VARIABLE( CFG_NUM_P2P_CHAN_COMBINED_CONC_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, nNumP2PChanCombinedConc,
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_NUM_P2P_CHAN_COMBINED_CONC_DEFAULT,
-                 CFG_NUM_P2P_CHAN_COMBINED_CONC_MIN,
-                 CFG_NUM_P2P_CHAN_COMBINED_CONC_MAX ),
 #endif
 
    REG_VARIABLE( CFG_MAX_PS_POLL_NAME, WLAN_PARAM_Integer,
@@ -1080,6 +1072,13 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_QOS_WMM_MODE_MIN,
                  CFG_QOS_WMM_MODE_MAX ),
 
+   REG_VARIABLE( CFG_STA_LOCAL_EDCA_FOR_ETSI_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, gStaLocalEDCAEnable,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_STA_LOCAL_EDCA_FOR_ETSI_DEFAULT,
+                 CFG_STA_LOCAL_EDCA_FOR_ETSI_MIN,
+                 CFG_STA_LOCAL_EDCA_FOR_ETSI_MAX ),
+
    REG_VARIABLE( CFG_QOS_WMM_80211E_ENABLED_NAME , WLAN_PARAM_Integer,
                  hdd_config_t, b80211eIsEnabled,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -1478,6 +1477,27 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_WLAN_MCC_TO_SCC_SWITCH_MODE_DEFAULT,
                  CFG_WLAN_MCC_TO_SCC_SWITCH_MODE_MIN,
                  CFG_WLAN_MCC_TO_SCC_SWITCH_MODE_MAX ),
+
+   REG_VARIABLE( CFG_WLAN_BAND_SWITCH_ENABLE , WLAN_PARAM_Integer,
+                 hdd_config_t, wlan_band_switch_enable,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_WLAN_BAND_SWITCH_ENABLE_DEFAULT,
+                 CFG_WLAN_BAND_SWITCH_ENABLE_MIN,
+                 CFG_WLAN_BAND_SWITCH_ENABLE_MAX ),
+
+   REG_VARIABLE( CFG_WLAN_AP_P2PGO_CONC_ENABLE , WLAN_PARAM_Integer,
+                 hdd_config_t, wlan_ap_p2pgo_conc_enable,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_WLAN_AP_P2PGO_CONC_ENABLE_DEFAULT,
+                 CFG_WLAN_AP_P2PGO_CONC_ENABLE_MIN,
+                 CFG_WLAN_AP_P2PGO_CONC_ENABLE_MAX ),
+
+   REG_VARIABLE( CFG_WLAN_AP_P2PGC_CONC_ENABLE , WLAN_PARAM_Integer,
+                 hdd_config_t, wlan_ap_p2pclient_conc_enable,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_WLAN_AP_P2PGC_CONC_ENABLE_DEFAULT,
+                 CFG_WLAN_AP_P2PGC_CONC_ENABLE_MIN,
+                 CFG_WLAN_AP_P2PGC_CONC_ENABLE_MAX ),
 #endif
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
    REG_VARIABLE( CFG_WLAN_AUTO_SHUTDOWN , WLAN_PARAM_Integer,
@@ -2022,20 +2042,6 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_BCN_EARLY_TERM_WAKE_MIN,
                  CFG_BCN_EARLY_TERM_WAKE_MAX ),
 
-   REG_VARIABLE( CFG_AP_DATA_AVAIL_POLL_PERIOD_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, apDataAvailPollPeriodInMs,
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_AP_DATA_AVAIL_POLL_PERIOD_DEFAULT,
-                 CFG_AP_DATA_AVAIL_POLL_PERIOD_MIN,
-                 CFG_AP_DATA_AVAIL_POLL_PERIOD_MAX ),
-
-   REG_VARIABLE( CFG_ENABLE_CLOSE_LOOP_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, enableCloseLoop,
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_ENABLE_CLOSE_LOOP_DEFAULT,
-                 CFG_ENABLE_CLOSE_LOOP_MIN,
-                 CFG_ENABLE_CLOSE_LOOP_MAX ),
-
    REG_VARIABLE( CFG_ENABLE_BYPASS_11D_NAME, WLAN_PARAM_Integer,
                  hdd_config_t, enableBypass11d,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -2064,13 +2070,6 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_ENABLE_DYNAMIC_DTIM_MIN,
                  CFG_ENABLE_DYNAMIC_DTIM_MAX ),
 
-   REG_VARIABLE( CFG_ENABLE_AUTOMATIC_TX_POWER_CONTROL_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, enableAutomaticTxPowerControl,
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_ENABLE_AUTOMATIC_TX_POWER_CONTROL_DEFAULT,
-                 CFG_ENABLE_AUTOMATIC_TX_POWER_CONTROL_MIN,
-                 CFG_ENABLE_AUTOMATIC_TX_POWER_CONTROL_MAX ),
-
    REG_VARIABLE( CFG_SHORT_GI_40MHZ_NAME, WLAN_PARAM_Integer,
                  hdd_config_t, ShortGI40MhzEnable,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -2180,61 +2179,33 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_THROTTLE_PERIOD_MIN,
                  CFG_THROTTLE_PERIOD_MAX ),
 
-   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL0_2G_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, throttle_dutycycle_level0_2g,
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL0_2G_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL0_2G_MIN,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL0_2G_MAX ),
-
-   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL1_2G_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, throttle_dutycycle_level1_2g,
+   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL0_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, throttle_dutycycle_level0,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL1_2G_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL1_2G_MIN,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL1_2G_MAX ),
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL0_DEFAULT,
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL0_MIN,
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL0_MAX ),
 
-   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL2_2G_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, throttle_dutycycle_level2_2g,
+   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL1_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, throttle_dutycycle_level1,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL2_2G_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL2_2G_MIN,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL2_2G_MAX ),
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL1_DEFAULT,
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL1_MIN,
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL1_MAX ),
 
-   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL3_2G_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, throttle_dutycycle_level3_2g,
+   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL2_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, throttle_dutycycle_level2,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL3_2G_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL3_2G_MIN,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL3_2G_MAX ),
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL2_DEFAULT,
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL2_MIN,
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL2_MAX ),
 
-   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL0_5G_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, throttle_dutycycle_level0_5g,
+   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL3_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, throttle_dutycycle_level3,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL0_5G_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL0_5G_MIN,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL0_5G_MAX ),
-
-   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL1_5G_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, throttle_dutycycle_level1_5g,
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL1_5G_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL1_5G_MIN,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL1_5G_MAX ),
-
-   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL2_5G_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, throttle_dutycycle_level2_5g,
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL2_5G_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL2_5G_MIN,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL2_5G_MAX ),
-
-   REG_VARIABLE( CFG_THROTTLE_DUTY_CYCLE_LEVEL3_5G_NAME, WLAN_PARAM_Integer,
-                 hdd_config_t, throttle_dutycycle_level3_5g,
-                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL3_5G_DEFAULT,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL3_5G_MIN,
-                 CFG_THROTTLE_DUTY_CYCLE_LEVEL3_5G_MAX ),
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL3_DEFAULT,
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL3_MIN,
+                 CFG_THROTTLE_DUTY_CYCLE_LEVEL3_MAX ),
 
    REG_VARIABLE( CFG_ENABLE_MODULATED_DTIM_NAME, WLAN_PARAM_Integer,
                  hdd_config_t, enableModulatedDTIM,
@@ -2300,19 +2271,33 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_ENABLE_VHT_DYNAMIC_STA_CHAINMASK_MIN,
                  CFG_ENABLE_VHT_DYNAMIC_STA_CHAINMASK_MAX),
 
-   REG_VARIABLE( CFG_CHAIN_MASK_2G, WLAN_PARAM_Integer,
-                 hdd_config_t, chain_mask_2g,
+   REG_VARIABLE( CFG_RX_CHAIN_MASK_2G, WLAN_PARAM_Integer,
+                 hdd_config_t, chain_mask_2g_rx,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_CHAIN_MASK_2G_DEFAULT,
-                 CFG_CHAIN_MASK_2G_MIN,
-                 CFG_CHAIN_MASK_2G_MAX ),
+                 CFG_RX_CHAIN_MASK_2G_DEFAULT,
+                 CFG_RX_CHAIN_MASK_2G_MIN,
+                 CFG_RX_CHAIN_MASK_2G_MAX ),
 
-   REG_VARIABLE( CFG_CHAIN_MASK_5G, WLAN_PARAM_Integer,
-                 hdd_config_t, chain_mask_5g,
+   REG_VARIABLE( CFG_RX_CHAIN_MASK_5G, WLAN_PARAM_Integer,
+                 hdd_config_t, chain_mask_5g_rx,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                 CFG_CHAIN_MASK_5G_DEFAULT,
-                 CFG_CHAIN_MASK_5G_MIN,
-                 CFG_CHAIN_MASK_5G_MAX ),
+                 CFG_RX_CHAIN_MASK_5G_DEFAULT,
+                 CFG_RX_CHAIN_MASK_5G_MIN,
+                 CFG_RX_CHAIN_MASK_5G_MAX ),
+
+   REG_VARIABLE( CFG_TX_CHAIN_MASK_2G, WLAN_PARAM_Integer,
+                 hdd_config_t, chain_mask_2g_tx,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_TX_CHAIN_MASK_2G_DEFAULT,
+                 CFG_TX_CHAIN_MASK_2G_MIN,
+                 CFG_TX_CHAIN_MASK_2G_MAX ),
+
+   REG_VARIABLE( CFG_TX_CHAIN_MASK_5G, WLAN_PARAM_Integer,
+                 hdd_config_t, chain_mask_5g_tx,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_TX_CHAIN_MASK_5G_DEFAULT,
+                 CFG_TX_CHAIN_MASK_5G_MIN,
+                 CFG_TX_CHAIN_MASK_5G_MAX ),
 
    REG_VARIABLE( CFG_VDEV_TYPE_NSS_2G, WLAN_PARAM_Integer,
                  hdd_config_t, vdev_type_nss_2g,
@@ -2392,6 +2377,13 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_DISABLE_DFS_CH_SWITCH_MIN,
                  CFG_DISABLE_DFS_CH_SWITCH_MAX ),
 
+   REG_VARIABLE( CFG_ENABLE_RADAR_WAR, WLAN_PARAM_Integer,
+                 hdd_config_t, enable_radar_war,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_ENABLE_RADAR_WAR_DEFAULT,
+                 CFG_ENABLE_RADAR_WAR_MIN,
+                 CFG_ENABLE_RADAR_WAR_MAX ),
+
    REG_VARIABLE( CFG_ENABLE_DFS_MASTER_CAPABILITY, WLAN_PARAM_Integer,
                  hdd_config_t, enableDFSMasterCap,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -2415,6 +2407,62 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_DISABLE_DFS_JAPAN_W53_MAX,
                  chNotify_set_gDisableDfsJapanW53, 0),
 
+   REG_VARIABLE(CFG_SET_RTS_FOR_SIFS_BURSTING, WLAN_PARAM_Integer,
+                 hdd_config_t, enable_rts_sifsbursting,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_SET_RTS_FOR_SIFS_BURSTING_DEFAULT,
+                 CFG_SET_RTS_FOR_SIFS_BURSTING_MIN,
+                 CFG_SET_RTS_FOR_SIFS_BURSTING_MAX),
+
+   REG_VARIABLE(CFG_MAX_MPDUS_IN_AMPDU, WLAN_PARAM_Integer,
+                 hdd_config_t, max_mpdus_inampdu,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_MAX_MPDUS_IN_AMPDU_DEFAULT,
+                 CFG_MAX_MPDUS_IN_AMPDU_MIN,
+                 CFG_MAX_MPDUS_IN_AMPDU_MAX),
+
+   REG_VARIABLE(CFG_MAX_HT_MCS_FOR_TX_DATA, WLAN_PARAM_HexInteger,
+                 hdd_config_t, max_ht_mcs_txdata,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_MAX_HT_MCS_FOR_TX_DATA_DEFAULT,
+                 CFG_MAX_HT_MCS_FOR_TX_DATA_MIN,
+                 CFG_MAX_HT_MCS_FOR_TX_DATA_MAX),
+
+   REG_VARIABLE(CFG_SAP_GET_PEER_INFO, WLAN_PARAM_Integer,
+                 hdd_config_t, sap_get_peer_info,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_SAP_GET_PEER_INFO_DEFAULT,
+                 CFG_SAP_GET_PEER_INFO_MIN,
+                 CFG_SAP_GET_PEER_INFO_MAX),
+
+   REG_VARIABLE(CFG_DISABLE_ABG_RATE_FOR_TX_DATA, WLAN_PARAM_Integer,
+                 hdd_config_t, disable_abg_rate_txdata,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_DISABLE_ABG_RATE_FOR_TX_DATA_DEFAULT,
+                 CFG_DISABLE_ABG_RATE_FOR_TX_DATA_MIN,
+                 CFG_DISABLE_ABG_RATE_FOR_TX_DATA_MAX),
+
+   REG_VARIABLE(CFG_RATE_FOR_TX_MGMT, WLAN_PARAM_HexInteger,
+                 hdd_config_t, rate_for_tx_mgmt,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_RATE_FOR_TX_MGMT_DEFAULT,
+                 CFG_RATE_FOR_TX_MGMT_MIN,
+                 CFG_RATE_FOR_TX_MGMT_MAX),
+
+   REG_VARIABLE(CFG_RATE_FOR_TX_MGMT_2G, WLAN_PARAM_HexInteger,
+                hdd_config_t, rate_for_tx_mgmt_2g,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_RATE_FOR_TX_MGMT_2G_DEFAULT,
+                CFG_RATE_FOR_TX_MGMT_2G_MIN,
+                CFG_RATE_FOR_TX_MGMT_2G_MAX),
+
+   REG_VARIABLE(CFG_RATE_FOR_TX_MGMT_5G, WLAN_PARAM_HexInteger,
+                hdd_config_t, rate_for_tx_mgmt_5g,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_RATE_FOR_TX_MGMT_5G_DEFAULT,
+                CFG_RATE_FOR_TX_MGMT_5G_MIN,
+                CFG_RATE_FOR_TX_MGMT_5G_MAX),
+
    REG_VARIABLE( CFG_ENABLE_FIRST_SCAN_2G_ONLY_NAME, WLAN_PARAM_Integer,
                  hdd_config_t, enableFirstScan2GOnly,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -3309,6 +3357,50 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_THERMAL_TEMP_MAX_LEVEL3_MIN,
                  CFG_THERMAL_TEMP_MAX_LEVEL3_MAX ),
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+   REG_VARIABLE( CFG_THERMAL_SHUTDOWN_ENABLE_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, thermal_shutdown_enabled,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_ENABLE_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_ENABLE_MIN,
+                 CFG_THERMAL_SHUTDOWN_ENABLE_MAX),
+
+   REG_VARIABLE( CFG_THERMAL_SHUTDOWN_AUTO_ENABLE_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, thermal_shutdown_auto_enabled,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_AUTO_ENABLE_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_AUTO_ENABLE_MIN,
+                 CFG_THERMAL_SHUTDOWN_AUTO_ENABLE_MAX),
+
+   REG_VARIABLE( CFG_THERMAL_SHUTDOWN_TEMP_RESUME_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, thermal_resume_threshold,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_TEMP_RESUME_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_TEMP_RESUME_MIN,
+                 CFG_THERMAL_SHUTDOWN_TEMP_RESUME_MAX),
+
+   REG_VARIABLE( CFG_THERMAL_SHUTDOWN_TEMP_WARNING_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, thermal_warning_threshold,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_TEMP_WARNING_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_TEMP_WARNING_MIN,
+                 CFG_THERMAL_SHUTDOWN_TEMP_WARNING_MAX),
+
+   REG_VARIABLE( CFG_THERMAL_SHUTDOWN_TEMP_SUSPEND_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, thermal_suspend_threshold,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_TEMP_SUSPEND_DEFAULT,
+                 CFG_THERMAL_SHUTDOWN_TEMP_SUSPEND_MIN,
+                 CFG_THERMAL_SHUTDOWN_TEMP_SUSPEND_MAX),
+
+   REG_VARIABLE( CFG_THERMAL_SAMPLE_RATE_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, thermal_sample_rate,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_THERMAL_SAMPLE_RATE_DEFAULT,
+                 CFG_THERMAL_SAMPLE_RATE_MIN,
+                 CFG_THERMAL_SAMPLE_RATE_MAX),
+#endif /* FEATURE_WLAN_THERMAL_SHUTDOWN */
+
   REG_VARIABLE( CFG_SET_TXPOWER_LIMIT2G_NAME , WLAN_PARAM_Integer,
                 hdd_config_t, TxPower2g,
                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -3372,6 +3464,7 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_SAP_SCAN_BAND_PREFERENCE_DEFAULT,
                  CFG_SAP_SCAN_BAND_PREFERENCE_MIN,
                  CFG_SAP_SCAN_BAND_PREFERENCE_MAX ),
+
    REG_VARIABLE( CFG_AUTO_CHANNEL_SELECT_WEIGHT, WLAN_PARAM_HexInteger,
                  hdd_config_t, auto_channel_select_weight,
                  VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -3379,7 +3472,6 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_AUTO_CHANNEL_SELECT_WEIGHT_MIN,
                  CFG_AUTO_CHANNEL_SELECT_WEIGHT_MAX ),
 
-
 #ifdef QCA_LL_TX_FLOW_CT
    REG_VARIABLE( CFG_LL_TX_FLOW_LWM, WLAN_PARAM_Integer,
                  hdd_config_t, TxFlowLowWaterMark,
@@ -3522,6 +3614,12 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_ENABLE_PACKET_LOG_DEFAULT,
                  CFG_ENABLE_PACKET_LOG_MIN,
                  CFG_ENABLE_PACKET_LOG_MAX ),
+   REG_VARIABLE( CFG_EDCA_FROM_HOSTAPD,  WLAN_PARAM_Integer,
+                 hdd_config_t, enable_hostapd_edca_local,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK,
+                 CFG_EDCA_FROM_HOSTAPD_DEFAULT,
+                 CFG_EDCA_FROM_HOSTAPD_MIN,
+                 CFG_EDCA_FROM_HOSTAPD_MAX),
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
    REG_VARIABLE( CFG_ROAMING_OFFLOAD_NAME,  WLAN_PARAM_Integer,
@@ -3620,6 +3718,43 @@ REG_TABLE_ENTRY g_registry_table[] =
 
 #endif
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+
+    REG_VARIABLE(CFG_DEL_ACK_THRESHOLD_HIGH, WLAN_PARAM_Integer,
+                 hdd_config_t, del_ack_threshold_high,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_DEL_ACK_THRESHOLD_HIGH_DEFAULT,
+                 CFG_DEL_ACK_THRESHOLD_HIGH_MIN,
+                 CFG_DEL_ACK_THRESHOLD_HIGH_MAX),
+
+    REG_VARIABLE(CFG_DEL_ACK_THRESHOLD_LOW, WLAN_PARAM_Integer,
+                 hdd_config_t, del_ack_threshold_low,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_DEL_ACK_THRESHOLD_LOW_DEFAULT,
+                 CFG_DEL_ACK_THRESHOLD_LOW_MIN,
+                 CFG_DEL_ACK_THRESHOLD_LOW_MAX),
+
+    REG_VARIABLE(CFG_DEL_ACK_TIMER_IN_MS, WLAN_PARAM_Integer,
+                 hdd_config_t, del_ack_timer_value,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_DEL_ACK_TIMER_IN_MS_DEFAULT,
+                 CFG_DEL_ACK_TIMER_IN_MS_MIN,
+                 CFG_DEL_ACK_TIMER_IN_MS_MAX),
+
+    REG_VARIABLE(CFG_DEL_ACK_PKT_COUNT, WLAN_PARAM_Integer,
+                 hdd_config_t, del_ack_pkt_count,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_DEL_ACK_PKT_COUNT_DEFAULT,
+                 CFG_DEL_ACK_PKT_COUNT_MIN,
+                 CFG_DEL_ACK_PKT_COUNT_MAX),
+
+    REG_VARIABLE(CFG_DEL_ACK_ENABLE, WLAN_PARAM_Integer,
+                 hdd_config_t, del_ack_enable,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_DEL_ACK_ENABLE_DEFAULT,
+                 CFG_DEL_ACK_ENABLE_MIN,
+                 CFG_DEL_ACK_ENABLE_MAX),
+#endif
 
    REG_VARIABLE( CFG_ENABLE_FW_LOG_TYPE , WLAN_PARAM_Integer,
                 hdd_config_t, enableFwLogType,
@@ -3833,6 +3968,13 @@ REG_TABLE_ENTRY g_registry_table[] =
               CFG_ENABLE_SELF_RECOVERY_MIN,
               CFG_ENABLE_SELF_RECOVERY_MAX ),
 
+   REG_VARIABLE( CFG_ENABLE_AC_TXQ_OPTIMIZE, WLAN_PARAM_HexInteger,
+              hdd_config_t, enable_ac_txq_optimize,
+              VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+              CFG_ENABLE_AC_TXQ_OPTIMIZE_DEFAULT,
+              CFG_ENABLE_AC_TXQ_OPTIMIZE_MIN,
+              CFG_ENABLE_AC_TXQ_OPTIMIZE_MAX ),
+
 #ifdef FEATURE_WLAN_FORCE_SAP_SCC
    REG_VARIABLE(CFG_SAP_SCC_CHAN_AVOIDANCE, WLAN_PARAM_Integer,
                  hdd_config_t, SapSccChanAvoidance,
@@ -4261,6 +4403,76 @@ REG_TABLE_ENTRY g_registry_table[] =
                 CFG_BTC_ANTENNA_ISOLATION_MIN,
                 CFG_BTC_ANTENNA_ISOLATION_MAX),
 
+   REG_VARIABLE(CFG_BTC_BT_INTERVAL_PAGE_P2P_STA, WLAN_PARAM_Integer,
+                hdd_config_t, coex_page_p2p_sta_bt_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_BT_INTERVAL_PAGE_P2P_STA_DEFAULT,
+                CFG_BTC_BT_INTERVAL_PAGE_P2P_STA_MIN,
+                CFG_BTC_BT_INTERVAL_PAGE_P2P_STA_MAX),
+
+   REG_VARIABLE(CFG_BTC_WLAN_INTERVAL_PAGE_P2P_STA, WLAN_PARAM_Integer,
+                hdd_config_t, coex_page_p2p_sta_wlan_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_PAGE_P2P_STA_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_PAGE_P2P_STA_MIN,
+                CFG_BTC_WLAN_INTERVAL_PAGE_P2P_STA_MAX),
+
+   REG_VARIABLE(CFG_BTC_BT_INTERVAL_INQ_STA, WLAN_PARAM_Integer,
+                hdd_config_t, coex_inquiry_sta_bt_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_BT_INTERVAL_INQ_STA_DEFAULT,
+                CFG_BTC_BT_INTERVAL_INQ_STA_MIN,
+                CFG_BTC_BT_INTERVAL_INQ_STA_MAX),
+
+   REG_VARIABLE(CFG_BTC_WLAN_INTERVAL_INQ_STA, WLAN_PARAM_Integer,
+                hdd_config_t, coex_inquiry_sta_wlan_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_INQ_STA_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_INQ_STA_MIN,
+                CFG_BTC_WLAN_INTERVAL_INQ_STA_MAX),
+
+   REG_VARIABLE(CFG_BTC_BT_INTERVAL_INQ_SAP, WLAN_PARAM_Integer,
+                hdd_config_t, coex_inquiry_sap_bt_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_BT_INTERVAL_INQ_SAP_DEFAULT,
+                CFG_BTC_BT_INTERVAL_INQ_SAP_MIN,
+                CFG_BTC_BT_INTERVAL_INQ_SAP_MAX),
+
+   REG_VARIABLE(CFG_BTC_WLAN_INTERVAL_INQ_SAP, WLAN_PARAM_Integer,
+                hdd_config_t, coex_inquiry_sap_wlan_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_INQ_SAP_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_INQ_SAP_MIN,
+                CFG_BTC_WLAN_INTERVAL_INQ_SAP_MAX),
+
+   REG_VARIABLE(CFG_BTC_BT_INTERVAL_INQ_P2P, WLAN_PARAM_Integer,
+                hdd_config_t, coex_inquiry_p2p_bt_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_BT_INTERVAL_INQ_P2P_DEFAULT,
+                CFG_BTC_BT_INTERVAL_INQ_P2P_MIN,
+                CFG_BTC_BT_INTERVAL_INQ_P2P_MAX),
+
+   REG_VARIABLE(CFG_BTC_WLAN_INTERVAL_INQ_P2P, WLAN_PARAM_Integer,
+                hdd_config_t, coex_inquiry_p2p_wlan_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_INQ_P2P_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_INQ_P2P_MIN,
+                CFG_BTC_WLAN_INTERVAL_INQ_P2P_MAX),
+
+   REG_VARIABLE(CFG_BTC_BT_INTERVAL_INQ_P2P_STA, WLAN_PARAM_Integer,
+                hdd_config_t, coex_inquiry_p2p_sta_bt_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_BT_INTERVAL_INQ_P2P_STA_DEFAULT,
+                CFG_BTC_BT_INTERVAL_INQ_P2P_STA_MIN,
+                CFG_BTC_BT_INTERVAL_INQ_P2P_STA_MAX),
+
+   REG_VARIABLE(CFG_BTC_WLAN_INTERVAL_INQ_P2P_STA, WLAN_PARAM_Integer,
+                hdd_config_t, coex_inquiry_p2p_sta_wlan_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_INQ_P2P_STA_DEFAULT,
+                CFG_BTC_WLAN_INTERVAL_INQ_P2P_STA_MIN,
+                CFG_BTC_WLAN_INTERVAL_INQ_P2P_STA_MAX),
+
    REG_VARIABLE(CFG_BTC_WLAN_COEX_TX_POWER, WLAN_PARAM_Integer,
                 hdd_config_t, coex_tx_power,
                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -4268,24 +4480,6 @@ REG_TABLE_ENTRY g_registry_table[] =
                 CFG_BTC_WLAN_COEX_TX_POWER_MIN,
                 CFG_BTC_WLAN_COEX_TX_POWER_MAX),
 
-#ifdef WMI_COEX_BTC_DUTYCYCLE
-   REG_VARIABLE(CFG_COEX_PAUSE_NAME,
-                WLAN_PARAM_Integer,
-                hdd_config_t, coex_btc_PauseDuration,
-                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                CFG_COEX_PAUSE_DEFAULT,
-                CFG_COEX_PAUSE_MIN,
-                CFG_COEX_PAUSE_MAX),
-
-   REG_VARIABLE(CFG_COEX_UNPAUSE_NAME,
-                WLAN_PARAM_Integer,
-                hdd_config_t, coex_btc_UnPauseDuration,
-                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                CFG_COEX_UNPAUSE_DEFAULT,
-                CFG_COEX_UNPAUSE_MIN,
-                CFG_COEX_UNPAUSE_MAX),
-#endif
-
    REG_VARIABLE(CFG_INFORM_BSS_RSSI_RAW_NAME, WLAN_PARAM_Integer,
                 hdd_config_t, inform_bss_rssi_raw,
                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -4299,6 +4493,15 @@ REG_TABLE_ENTRY g_registry_table[] =
                 CFG_SET_TSF_GPIO_PIN_DEFAULT,
                 CFG_SET_TSF_GPIO_PIN_MIN,
                 CFG_SET_TSF_GPIO_PIN_MAX),
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+      REG_VARIABLE(CFG_SET_TSF_PTP_OPT_NAME, WLAN_PARAM_HexInteger,
+                hdd_config_t, tsf_ptp_options,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_SET_TSF_PTP_OPT_DEFAULT,
+                CFG_SET_TSF_PTP_OPT_MIN,
+                CFG_SET_TSF_PTP_OPT_MAX),
+#endif /* WLAN_FEATURE_TSF_PLUS */
 #endif
    REG_VARIABLE(CFG_FINE_TIME_MEAS_CAPABILITY, WLAN_PARAM_HexInteger,
                 hdd_config_t, fine_time_meas_cap,
@@ -4342,6 +4545,13 @@ REG_TABLE_ENTRY g_registry_table[] =
                 CFG_TX_CHAIN_MASK_1SS_MIN,
                 CFG_TX_CHAIN_MASK_1SS_MAX),
 
+   REG_VARIABLE(CFG_TX_SCH_DELAY, WLAN_PARAM_Integer,
+                hdd_config_t, tx_sch_delay,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_TX_SCH_DELAY_DEFAULT,
+                CFG_TX_SCH_DELAY_MIN,
+                CFG_TX_SCH_DELAY_MAX),
+
    REG_VARIABLE(CFG_SELF_GEN_FRM_PWR, WLAN_PARAM_Integer,
                 hdd_config_t, self_gen_frm_pwr,
                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -4685,12 +4895,12 @@ REG_TABLE_ENTRY g_registry_table[] =
                 CFG_TGT_GTX_USR_CFG_MIN,
                 CFG_TGT_GTX_USR_CFG_MAX),
 
-   REG_VARIABLE(CFG_CH_AVOID_SAP_RESTART_NAME, WLAN_PARAM_Integer,
-                hdd_config_t, sap_restrt_ch_avoid,
+   REG_VARIABLE(CFG_SAP_INTERNAL_RESTART_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, sap_internal_restart,
                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-                CFG_CH_AVOID_SAP_RESTART_DEFAULT,
-                CFG_CH_AVOID_SAP_RESTART_MIN,
-                CFG_CH_AVOID_SAP_RESTART_MAX),
+                CFG_SAP_INTERNAL_RESTART_DEFAULT,
+                CFG_SAP_INTERNAL_RESTART_MIN,
+                CFG_SAP_INTERNAL_RESTART_MAX),
 
    REG_VARIABLE(CFG_BUG_ON_REINIT_FAILURE_NAME, WLAN_PARAM_Integer,
                 hdd_config_t, bug_on_reinit_failure,
@@ -4721,6 +4931,13 @@ REG_TABLE_ENTRY g_registry_table[] =
                 CFG_ACTIVE_MODE_OFFLOAD_MIN,
                 CFG_ACTIVE_MODE_OFFLOAD_MAX),
 
+   REG_VARIABLE(CFG_STA_CHANGE_COUNTRYCODE_DYN_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, sta_change_cc_via_beacon,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_STA_CHANGE_COUNTRYCODE_DYN_DEFAULT,
+                CFG_STA_CHANGE_COUNTRYCODE_DYN_DISABLE,
+                CFG_STA_CHANGE_COUNTRYCODE_DYN_ENABLE),
+
    REG_VARIABLE(CFG_SIFS_BURST_DURATION_NAME, WLAN_PARAM_Integer,
                 hdd_config_t, sifs_burst_duration,
                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -4728,6 +4945,20 @@ REG_TABLE_ENTRY g_registry_table[] =
                 CFG_SIFS_BURST_DURATION_MIN,
                 CFG_SIFS_BURST_DURATION_MAX),
 
+  REG_VARIABLE(CFG_BPF_PACKET_FILTER_OFFLOAD, WLAN_PARAM_Integer,
+               struct hdd_config, bpf_packet_filter_enable,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_BPF_PACKET_FILTER_OFFLOAD_DEFAULT,
+               CFG_BPF_PACKET_FILTER_OFFLOAD_MIN,
+               CFG_BPF_PACKET_FILTER_OFFLOAD_MAX),
+
+  REG_VARIABLE(CFG_TDLS_ENABLE_DEFER_TIMER, WLAN_PARAM_Integer,
+                hdd_config_t, tdls_enable_defer_time,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_TDLS_ENABLE_DEFER_TIMER_DEFAULT,
+                CFG_TDLS_ENABLE_DEFER_TIMER_MIN,
+                CFG_TDLS_ENABLE_DEFER_TIMER_MAX),
+
    REG_VARIABLE(CFG_HOST_WAKEUP_GPIO_NAME, WLAN_PARAM_Integer,
                 hdd_config_t, host_wakeup_gpio,
                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -4755,6 +4986,266 @@ REG_TABLE_ENTRY g_registry_table[] =
                 CFG_TARGET_WAKEUP_TYPE_DEFAULT,
                 CFG_TARGET_WAKEUP_TYPE_MIN,
                 CFG_TARGET_WAKEUP_TYPE_MAX),
+
+   REG_VARIABLE(CFG_MAX_SCHED_SCAN_PLAN_INT_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, max_sched_scan_plan_interval,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_MAX_SCHED_SCAN_PLAN_INT_DEFAULT,
+                CFG_MAX_SCHED_SCAN_PLAN_INT_MIN,
+                CFG_MAX_SCHED_SCAN_PLAN_INT_MAX),
+
+   REG_VARIABLE(CFG_MAX_SCHED_SCAN_PLAN_ITRNS_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, max_sched_scan_plan_iterations,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_MAX_SCHED_SCAN_PLAN_ITRNS_DEFAULT,
+                CFG_MAX_SCHED_SCAN_PLAN_ITRNS_MIN,
+                CFG_MAX_SCHED_SCAN_PLAN_ITRNS_MAX),
+
+   REG_VARIABLE(CFG_ENABLE_5G_BAND_PREF_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, enable_5g_band_pref,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_ENABLE_5G_BAND_PREF_DEFAULT,
+                CFG_ENABLE_5G_BAND_PREF_MIN,
+                CFG_ENABLE_5G_BAND_PREF_MAX),
+
+   REG_VARIABLE(CFG_5G_RSSI_BOOST_THRESHOLD_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, rssi_boost_threshold_5g,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_5G_RSSI_BOOST_THRESHOLD_DEFAULT,
+                CFG_5G_RSSI_BOOST_THRESHOLD_MIN,
+                CFG_5G_RSSI_BOOST_THRESHOLD_MAX),
+
+   REG_VARIABLE(CFG_5G_RSSI_BOOST_FACTOR_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, rssi_boost_factor_5g,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_5G_RSSI_BOOST_FACTOR_DEFAULT,
+                CFG_5G_RSSI_BOOST_FACTOR_MIN,
+                CFG_5G_RSSI_BOOST_FACTOR_MAX),
+
+   REG_VARIABLE(CFG_5G_MAX_RSSI_BOOST_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, max_rssi_boost_5g,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_5G_MAX_RSSI_BOOST_DEFAULT,
+                CFG_5G_MAX_RSSI_BOOST_MIN,
+                CFG_5G_MAX_RSSI_BOOST_MAX),
+
+   REG_VARIABLE(CFG_5G_RSSI_PENALIZE_THRESHOLD_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, rssi_penalize_threshold_5g,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_5G_RSSI_PENALIZE_THRESHOLD_DEFAULT,
+                CFG_5G_RSSI_PENALIZE_THRESHOLD_MIN,
+                CFG_5G_RSSI_PENALIZE_THRESHOLD_MAX),
+
+   REG_VARIABLE(CFG_5G_RSSI_PENALIZE_FACTOR_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, rssi_penalize_factor_5g,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_5G_RSSI_PENALIZE_FACTOR_DEFAULT,
+                CFG_5G_RSSI_PENALIZE_FACTOR_MIN,
+                CFG_5G_RSSI_PENALIZE_FACTOR_MAX),
+
+   REG_VARIABLE(CFG_5G_MAX_RSSI_PENALIZE_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, max_rssi_penalize_5g,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_5G_MAX_RSSI_PENALIZE_DEFAULT,
+                CFG_5G_MAX_RSSI_PENALIZE_MIN,
+                CFG_5G_MAX_RSSI_PENALIZE_MAX),
+
+   REG_VARIABLE(CFG_PRB_REQ_IE_WHITELIST_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, probe_req_ie_whitelist,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_PRB_REQ_IE_WHITELIST_DEFAULT,
+                CFG_PRB_REQ_IE_WHITELIST_MIN,
+                CFG_PRB_REQ_IE_WHITELIST_MAX),
+
+   REG_VARIABLE(CFG_PRB_REQ_IE_BIT_MAP0_NAME, WLAN_PARAM_HexInteger,
+                hdd_config_t, probe_req_ie_bitmap_0,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP0_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP0_MIN,
+                CFG_PRB_REQ_IE_BIT_MAP0_MAX),
+
+   REG_VARIABLE(CFG_PRB_REQ_IE_BIT_MAP1_NAME, WLAN_PARAM_HexInteger,
+                hdd_config_t, probe_req_ie_bitmap_1,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP1_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP1_MIN,
+                CFG_PRB_REQ_IE_BIT_MAP1_MAX),
+
+   REG_VARIABLE(CFG_PRB_REQ_IE_BIT_MAP2_NAME, WLAN_PARAM_HexInteger,
+                hdd_config_t, probe_req_ie_bitmap_2,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP2_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP2_MIN,
+                CFG_PRB_REQ_IE_BIT_MAP2_MAX),
+
+   REG_VARIABLE(CFG_PRB_REQ_IE_BIT_MAP3_NAME, WLAN_PARAM_HexInteger,
+                hdd_config_t, probe_req_ie_bitmap_3,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP3_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP3_MIN,
+                CFG_PRB_REQ_IE_BIT_MAP3_MAX),
+
+   REG_VARIABLE(CFG_PRB_REQ_IE_BIT_MAP4_NAME, WLAN_PARAM_HexInteger,
+                hdd_config_t, probe_req_ie_bitmap_4,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP4_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP4_MIN,
+                CFG_PRB_REQ_IE_BIT_MAP4_MAX),
+
+   REG_VARIABLE(CFG_PRB_REQ_IE_BIT_MAP5_NAME, WLAN_PARAM_HexInteger,
+                hdd_config_t, probe_req_ie_bitmap_5,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP5_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP5_MIN,
+                CFG_PRB_REQ_IE_BIT_MAP5_MAX),
+
+   REG_VARIABLE(CFG_PRB_REQ_IE_BIT_MAP6_NAME, WLAN_PARAM_HexInteger,
+                hdd_config_t, probe_req_ie_bitmap_6,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP6_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP6_MIN,
+                CFG_PRB_REQ_IE_BIT_MAP6_MAX),
+
+   REG_VARIABLE(CFG_PRB_REQ_IE_BIT_MAP7_NAME, WLAN_PARAM_HexInteger,
+                hdd_config_t, probe_req_ie_bitmap_7,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP7_DEFAULT,
+                CFG_PRB_REQ_IE_BIT_MAP7_MIN,
+                CFG_PRB_REQ_IE_BIT_MAP7_MAX),
+
+   REG_VARIABLE_STRING(CFG_PROBE_REQ_OUI_NAME, WLAN_PARAM_String,
+                       hdd_config_t, probe_req_ouis,
+                       VAR_FLAGS_OPTIONAL,
+                       (void *)CFG_PROBE_REQ_OUI_DEFAULT),
+
+   REG_VARIABLE(CFG_SUB_20_CHANNEL_WIDTH_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, sub_20_channel_width,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_SUB_20_CHANNEL_WIDTH_DEFAULT,
+                CFG_SUB_20_CHANNEL_WIDTH_MIN,
+                CFG_SUB_20_CHANNEL_WIDTH_MAX),
+
+   REG_VARIABLE(CFG_RX_WAKELOCK_TIMEOUT_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, rx_wakelock_timeout,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_RX_WAKELOCK_TIMEOUT_DEFAULT,
+                CFG_RX_WAKELOCK_TIMEOUT_MIN,
+                CFG_RX_WAKELOCK_TIMEOUT_MAX),
+
+   REG_VARIABLE(CFG_SAP_CH_SWITCH_BEACON_CNT, WLAN_PARAM_Integer,
+                hdd_config_t, sap_chanswitch_beacon_cnt,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_SAP_CH_SWITCH_BEACON_CNT_DEFAULT,
+                CFG_SAP_CH_SWITCH_BEACON_CNT_MIN,
+                CFG_SAP_CH_SWITCH_BEACON_CNT_MAX),
+
+   REG_VARIABLE(CFG_SAP_CH_SWITCH_MODE, WLAN_PARAM_Integer,
+                hdd_config_t, sap_chanswitch_mode,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_SAP_CH_SWITCH_MODE_DEFAULT,
+                CFG_SAP_CH_SWITCH_MODE_MIN,
+                CFG_SAP_CH_SWITCH_MODE_MAX),
+
+   REG_VARIABLE(CFG_DFS_BEACON_TX_ENHANCED, WLAN_PARAM_Integer,
+                hdd_config_t, dfs_beacon_tx_enhanced,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_DFS_BEACON_TX_ENHANCED_DEFAULT,
+                CFG_DFS_BEACON_TX_ENHANCED_MIN,
+                CFG_DFS_BEACON_TX_ENHANCED_MAX),
+
+  REG_VARIABLE(CFG_REDUCED_BEACON_INTERVAL, WLAN_PARAM_Integer,
+               hdd_config_t, reduced_beacon_interval,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_REDUCED_BEACON_INTERVAL_DEFAULT,
+               CFG_REDUCED_BEACON_INTERVAL_MIN,
+               CFG_REDUCED_BEACON_INTERVAL_MAX),
+
+  REG_VARIABLE(CFG_NO_ACK_ENABLE, WLAN_PARAM_Integer,
+               hdd_config_t, gEnableNoAck,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_NO_ACK_DEFAULT,
+               CFG_NO_ACK_MIN,
+               CFG_NO_ACK_MAX),
+
+#ifdef FEATURE_COEX_PTA_CONFIG_ENABLE
+  REG_VARIABLE(CFG_COEX_PTA_CONFIG_ENABLE, WLAN_PARAM_Integer,
+               hdd_config_t, coex_pta_config_enable,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_COEX_PTA_CONFIG_ENABLE_DEFAULT,
+               CFG_COEX_PTA_CONFIG_ENABLE_MIN,
+               CFG_COEX_PTA_CONFIG_ENABLE_MAX),
+
+  REG_VARIABLE(CFG_COEX_PTA_CONFIG_PARAM, WLAN_PARAM_Integer,
+               hdd_config_t, coex_pta_config_param,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_COEX_PTA_CONFIG_PARAM_DEFAULT,
+               CFG_COEX_PTA_CONFIG_PARAM_MIN,
+               CFG_COEX_PTA_CONFIG_PARAM_MAX),
+#endif
+
+   REG_VARIABLE(CFG_ARP_AC_CATEGORY, WLAN_PARAM_Integer,
+                hdd_config_t, arp_ac_category,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_ARP_AC_CATEGORY_DEFAULT,
+                CFG_ARP_AC_CATEGORY_MIN,
+                CFG_ARP_AC_CATEGORY_MAX),
+
+   REG_VARIABLE(CFG_SAP_PROBE_RESP_OFFLOAD_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, sap_probe_resp_offload,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_SAP_PROBE_RESP_OFFLOAD_DEFAULT,
+                CFG_SAP_PROBE_RESP_OFFLOAD_MIN,
+                CFG_SAP_PROBE_RESP_OFFLOAD_MAX),
+
+   REG_VARIABLE( CFG_STA_AUTH_RETRIES_FOR_CODE17_NAME, WLAN_PARAM_Integer,
+                hdd_config_t, sta_auth_retries_for_code17,
+                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                CFG_STA_AUTH_RETRIES_FOR_CODE17_DEFAULT,
+                CFG_STA_AUTH_RETRIES_FOR_CODE17_MIN,
+                CFG_STA_AUTH_RETRIES_FOR_CODE17_MAX ),
+
+  REG_VARIABLE(CFG_SKIP_MAC_CONFIG, WLAN_PARAM_Integer,
+               hdd_config_t, skip_mac_config,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_SKIP_MAC_CONFIG_DEFAULT,
+               CFG_SKIP_MAC_CONFIG_MIN,
+               CFG_SKIP_MAC_CONFIG_MAX),
+#ifdef WLAN_FEATURE_DSRC
+  REG_VARIABLE(CFG_OCB_TX_PER_PKT_STATS_ENABLE_NAME, WLAN_PARAM_Integer,
+               hdd_config_t, ocb_tx_per_pkt_stats_enabled,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_OCB_TX_PER_PKT_STATS_ENABLE_DEFAULT,
+               CFG_OCB_TX_PER_PKT_STATS_ENABLE_MIN,
+               CFG_OCB_TX_PER_PKT_STATS_ENABLE_MAX),
+#endif
+
+	REG_VARIABLE(CFG_CCA_THRESHOLD_ENABLE_NAME, WLAN_PARAM_Integer,
+		hdd_config_t, cca_threshold_enable,
+		VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		CFG_CCA_THRESHOLD_ENABLE_DEFAULT,
+		CFG_CCA_THRESHOLD_ENABLE_MIN,
+		CFG_CCA_THRESHOLD_ENABLE_MAX),
+
+	REG_VARIABLE(CFG_CCA_THRESHOLD_2G_NAME, WLAN_PARAM_Integer,
+		hdd_config_t, cca_threshold_2g,
+		VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		CFG_CCA_THRESHOLD_2G_DEFAULT,
+		CFG_CCA_THRESHOLD_2G_MIN,
+		CFG_CCA_THRESHOLD_2G_MAX),
+
+	REG_VARIABLE(CFG_CCA_THRESHOLD_5G_NAME, WLAN_PARAM_Integer,
+		hdd_config_t, cca_threshold_5g,
+		VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		CFG_CCA_THRESHOLD_5G_DEFAULT,
+		CFG_CCA_THRESHOLD_5G_MIN,
+		CFG_CCA_THRESHOLD_5G_MAX),
+
+	REG_VARIABLE(CFG_ENABLE_MONITOR_ON_STA, WLAN_PARAM_Integer,
+		     hdd_config_t, mon_on_sta_enable,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_ENABLE_MONITOR_ON_STA_DEFAULT,
+		     CFG_ENABLE_MONITOR_ON_STA_MIN,
+		     CFG_ENABLE_MONITOR_ON_STA_MAX),
 };
 
 
@@ -4833,8 +5324,8 @@ static char *i_trim(char *str)
 
    /* Find the first non white-space*/
    for (ptr = str; i_isspace(*ptr); ptr++);
-      if (*ptr == '\0')
-         return str;
+   if (*ptr == '\0')
+        return str;
 
    /* This is the new start of the string*/
    str = ptr;
@@ -4842,8 +5333,8 @@ static char *i_trim(char *str)
    /* Find the last non white-space */
    ptr += strlen(ptr) - 1;
    for (; ptr != str && i_isspace(*ptr); ptr--);
-      /* Null terminate the following character */
-      ptr[1] = '\0';
+   /* Null terminate the following character */
+   ptr[1] = '\0';
 
    return str;
 }
@@ -4954,7 +5445,8 @@ VOS_STATUS hdd_parse_config_ini(hdd_context_t* pHddCtx)
 
    hddLog(LOG1, "%s: qcom_cfg.ini Size %zu", __func__, fw->size);
 
-   buffer = (char*)vos_mem_malloc(fw->size);
+   buffer = (char*)vos_mem_malloc(fw->size + 1);
+   buffer[fw->size] = '\0';
 
    if(NULL == buffer) {
       hddLog(VOS_TRACE_LEVEL_FATAL, "%s: kmalloc failure",__func__);
@@ -5054,6 +5546,9 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gAPAutoShutOff] Value = [%u]", pHddCtx->cfg_ini->nAPAutoShutOff);
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gWlanMccToSccSwitchMode] Value = [%u]", pHddCtx->cfg_ini->WlanMccToSccSwitchMode);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gWlanBandSwitchEnable] Value = [%u]", pHddCtx->cfg_ini->wlan_band_switch_enable);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gWlanApP2pGOConcurrencyEnable] Value = [%u]", pHddCtx->cfg_ini->wlan_ap_p2pgo_conc_enable);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gWlanApP2pClientConcurEnable] Value = [%u]", pHddCtx->cfg_ini->wlan_ap_p2pclient_conc_enable);
 #endif
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gWlanAutoShutdown] Value = [%u]", pHddCtx->cfg_ini->WlanAutoShutdown);
@@ -5086,6 +5581,8 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
   VOS_TRACE (VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gACSBandSwitchThreshold] value = [%u]", pHddCtx->cfg_ini->acsBandSwitchThreshold);
 
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [ChannelBondingMode] Value = [%u]",pHddCtx->cfg_ini->nChannelBondingMode24GHz);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [%s] Value = [%u] ",
+            CFG_OVERRIDE_HT40_20_24GHZ_NAME, pHddCtx->cfg_ini->override_ht20_40_24g);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [ChannelBondingMode] Value = [%u]",pHddCtx->cfg_ini->nChannelBondingMode5GHz);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [dot11Mode] Value = [%u]",pHddCtx->cfg_ini->dot11Mode);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [WmmMode] Value = [%u] ",pHddCtx->cfg_ini->WmmMode);
@@ -5139,6 +5636,9 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
             "Name = [enable_tdls_scan] Value = [%u]",
             pHddCtx->cfg_ini->enable_tdls_scan);
 #endif
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gEnableNoAck] Value = [%u] ",pHddCtx->cfg_ini->gEnableNoAck);
+
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [InfraDirAcVo] Value = [%u] ",pHddCtx->cfg_ini->InfraDirAcVo);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [InfraNomMsduSizeAcVo] Value = [0x%x] ",pHddCtx->cfg_ini->InfraNomMsduSizeAcVo);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [InfraMeanDataRateAcVo] Value = [0x%x] ",pHddCtx->cfg_ini->InfraMeanDataRateAcVo);
@@ -5242,7 +5742,6 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [maxListenInterval] Value = [%u] ",pHddCtx->cfg_ini->nTeleBcnMaxListenInterval);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [maxLiNumIdleBeacons] Value = [%u] ",pHddCtx->cfg_ini->nTeleBcnMaxLiNumIdleBeacons);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [bcnEarlyTermWakeInterval] Value = [%u] ",pHddCtx->cfg_ini->bcnEarlyTermWakeInterval);
-  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gApDataAvailPollInterVal] Value = [%u] ",pHddCtx->cfg_ini->apDataAvailPollPeriodInMs);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gEnableBypass11d] Value = [%u] ",pHddCtx->cfg_ini->enableBypass11d);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gEnableDFSChnlScan] Value = [%u] ",pHddCtx->cfg_ini->enableDFSChnlScan);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [gEnableDFSPnoChnlScan] Value = [%u] ",pHddCtx->cfg_ini->enable_dfs_pno_chnl_scan);
@@ -5361,6 +5860,11 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
            "Name = [isRoamOffloadEnabled] Value = [%u]",
                    pHddCtx->cfg_ini->isRoamOffloadEnabled);
 #endif
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+           "Name = [gEnableHostapdEdcaLocal] Value = [%u]",
+                   pHddCtx->cfg_ini->enable_hostapd_edca_local);
+
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
            "Name = [gEnableSifsBurst] Value = [%u]",
                    pHddCtx->cfg_ini->enableSifsBurst);
@@ -5376,6 +5880,10 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
                    pHddCtx->cfg_ini->enableSelfRecovery);
 
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+           "Name = [gEnableAcTxqOptimize] Value = [%u]",
+                   pHddCtx->cfg_ini->enable_ac_txq_optimize);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
             "Name = [gEnableSapSuspend] Value = [%u]",
             pHddCtx->cfg_ini->enableSapSuspend);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
@@ -5498,6 +6006,10 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
             "Name = [gEnableDumpCollect] Value = [%u]",
                      pHddCtx->cfg_ini->is_ramdump_enabled);
 
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+        "Name = [sta_auth_retries_for_code17] Value = [%u] ",
+         pHddCtx->cfg_ini->sta_auth_retries_for_code17);
+
   hddLog(LOG2, "Name = [gP2PListenDeferInterval] Value = [%u]",
                    pHddCtx->cfg_ini->p2p_listen_defer_interval);
 
@@ -5589,8 +6101,8 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
                  pHddCtx->cfg_ini->tgt_gtx_usr_cfg);
 
   hddLog(LOG2, "Name = [%s] Value = [%u]",
-                 CFG_CH_AVOID_SAP_RESTART_NAME,
-                 pHddCtx->cfg_ini->sap_restrt_ch_avoid);
+                 CFG_SAP_INTERNAL_RESTART_NAME,
+                 pHddCtx->cfg_ini->sap_internal_restart);
 
   hddLog(LOG2, "Name = [%s] Value = [%u]",
                 CFG_SAP_FORCE_11N_FOR_11AC_NAME,
@@ -5602,7 +6114,71 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
                  CFG_ACTIVE_MODE_OFFLOAD,
                  pHddCtx->cfg_ini->active_mode_offload);
 
+  hddLog(LOG2, "Name = [%s] Value = [%u]",
+                 CFG_BPF_PACKET_FILTER_OFFLOAD,
+                 pHddCtx->cfg_ini->bpf_packet_filter_enable);
+  hddLog(LOG2, "Name = [%s] Value = [%u] ",
+          CFG_SAP_PROBE_RESP_OFFLOAD_NAME,
+          pHddCtx->cfg_ini->sap_probe_resp_offload);
+
+  hddLog(LOG2, "Name = [%s] Value = [%u]",
+         CFG_SUB_20_CHANNEL_WIDTH_NAME,
+         pHddCtx->cfg_ini->sub_20_channel_width);
+
+  hddLog(LOGE, "Name = [%s] Value = [%u]",
+         CFG_STA_CHANGE_COUNTRYCODE_DYN_NAME ,
+         pHddCtx->cfg_ini->sta_change_cc_via_beacon);
+
+
   hdd_ndp_print_ini_config(pHddCtx);
+
+  hddLog(LOG2, "Name = [%s] Value = [%u] ",
+                 CFG_TDLS_ENABLE_DEFER_TIMER,
+                 pHddCtx->cfg_ini->tdls_enable_defer_time);
+
+  hddLog(LOG2, "Name = [%s] Value = [%x] ",
+               CFG_PRB_REQ_IE_WHITELIST_NAME,
+               pHddCtx->cfg_ini->probe_req_ie_whitelist);
+
+  hddLog(LOG2, "Name = [%s] Value = [%x] ",
+               CFG_PRB_REQ_IE_BIT_MAP0_NAME,
+               pHddCtx->cfg_ini->probe_req_ie_bitmap_0);
+
+  hddLog(LOG2, "Name = [%s] Value = [%x] ",
+               CFG_PRB_REQ_IE_BIT_MAP1_NAME,
+               pHddCtx->cfg_ini->probe_req_ie_bitmap_1);
+
+  hddLog(LOG2, "Name = [%s] Value = [%x] ",
+               CFG_PRB_REQ_IE_BIT_MAP2_NAME,
+               pHddCtx->cfg_ini->probe_req_ie_bitmap_2);
+
+  hddLog(LOG2, "Name = [%s] Value = [%x] ",
+               CFG_PRB_REQ_IE_BIT_MAP3_NAME,
+               pHddCtx->cfg_ini->probe_req_ie_bitmap_3);
+
+  hddLog(LOG2, "Name = [%s] Value = [%x] ",
+               CFG_PRB_REQ_IE_BIT_MAP4_NAME,
+               pHddCtx->cfg_ini->probe_req_ie_bitmap_4);
+
+  hddLog(LOG2, "Name = [%s] Value = [%x] ",
+               CFG_PRB_REQ_IE_BIT_MAP5_NAME,
+               pHddCtx->cfg_ini->probe_req_ie_bitmap_5);
+
+  hddLog(LOG2, "Name = [%s] Value = [%x] ",
+               CFG_PRB_REQ_IE_BIT_MAP6_NAME,
+               pHddCtx->cfg_ini->probe_req_ie_bitmap_6);
+
+  hddLog(LOG2, "Name = [%s] Value = [%x] ",
+               CFG_PRB_REQ_IE_BIT_MAP7_NAME,
+               pHddCtx->cfg_ini->probe_req_ie_bitmap_7);
+
+  hddLog(LOG2, "Name = [%s] Value =[%s]",
+               CFG_PROBE_REQ_OUI_NAME,
+               pHddCtx->cfg_ini->probe_req_ouis);
+
+  hddLog(LOG2, "Name = [%s] Value = [%u]",
+                 CFG_ARP_AC_CATEGORY,
+                 pHddCtx->cfg_ini->arp_ac_category);
 }
 
 #define CFG_VALUE_MAX_LEN 256
@@ -5697,7 +6273,6 @@ static VOS_STATUS hdd_cfg_get_config(REG_TABLE_ENTRY *reg_table,
 #else
       printk(KERN_INFO "%s", configStr);
 #endif // RETURN_IN_BUFFER
-
 }
 
 #ifndef RETURN_IN_BUFFER
@@ -5792,7 +6367,7 @@ VOS_STATUS hdd_update_mac_config(hdd_context_t *pHddCtx)
 {
    int status, i = 0;
    const struct firmware *fw = NULL;
-   char *line, *buffer = NULL;
+   char *line, *buffer = NULL, *temp = NULL;
    char *name, *value;
    tCfgIniEntry macTable[VOS_MAX_CONCURRENCY_PERSONA];
    tSirMacAddr customMacAddr;
@@ -5816,7 +6391,15 @@ VOS_STATUS hdd_update_mac_config(hdd_context_t *pHddCtx)
       goto config_exit;
    }
 
-   buffer = (char *)fw->data;
+   temp = buffer = (char *) vos_mem_malloc(fw->size + 1);
+   if (NULL == buffer) {
+      hddLog(VOS_TRACE_LEVEL_FATAL, "%s: unable to allocate memory",__func__);
+      release_firmware(fw);
+      return VOS_STATUS_E_NOMEM;
+   }
+
+   vos_mem_copy((void*)buffer,(void *)fw->data, fw->size);
+   buffer[fw->size] = '\0';
 
    /* data format:
     * Intf0MacAddress=00AA00BB00CC
@@ -5872,6 +6455,7 @@ VOS_STATUS hdd_update_mac_config(hdd_context_t *pHddCtx)
 
 config_exit:
    release_firmware(fw);
+   vos_mem_free(temp);
    return vos_status;
 }
 
@@ -6167,6 +6751,111 @@ eCsrPhyMode hdd_cfg_xlate_to_csr_phy_mode( eHddDot11Mode dot11Mode )
 
 }
 
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+/**
+ * hdd_cfg_get_sub20_dyn_capabilities()
+ * @hdd_ctx_ptr:  HDD context
+ *
+ * This function is used to get dynamic capabilities of sub 20MHz channel width
+ * Return: sub 20 channel width
+ */
+uint8_t hdd_cfg_get_sub20_dyn_capabilities(hdd_context_t *hdd_ctx_ptr)
+{
+	hdd_config_t *config_ptr = hdd_ctx_ptr->cfg_ini;
+	uint8_t sub_20_channel_width = config_ptr->sub_20_channel_width;
+
+	switch (sub_20_channel_width) {
+	case CFG_SUB_20_CHANNEL_WIDTH_DYN_5MHZ:
+		return SUB20_MODE_5MHZ;
+	case CFG_SUB_20_CHANNEL_WIDTH_DYN_10MHZ:
+		return SUB20_MODE_10MHZ;
+	case CFG_SUB_20_CHANNEL_WIDTH_DYN_ALL:
+	case CFG_SUB_20_CHANNEL_WIDTH_MANUAL:
+		return SUB20_MODE_5MHZ | SUB20_MODE_10MHZ;
+	default:
+		return SUB20_MODE_NONE;
+	}
+}
+/**
+ * hdd_cfg_get_static_sub20_channel_width()
+ * @hdd_ctx_ptr:  HDD context
+ *
+ * This function is used to get static sub 20MHz channel width
+ * Return: sub 20 channel width
+ */
+uint8_t hdd_cfg_get_static_sub20_channel_width(hdd_context_t *hdd_ctx_ptr)
+{
+	hdd_config_t *config_ptr = hdd_ctx_ptr->cfg_ini;
+
+	if (config_ptr->sub_20_channel_width ==
+	    CFG_SUB_20_CHANNEL_WIDTH_5MHZ) {
+		return SUB20_MODE_5MHZ;
+	} else if (config_ptr->sub_20_channel_width ==
+		   CFG_SUB_20_CHANNEL_WIDTH_10MHZ) {
+		return SUB20_MODE_10MHZ;
+	}
+	return SUB20_MODE_NONE;
+}
+
+/**
+ * hdd_cfg_is_sub20_channel_width_enabled()
+ * @hdd_ctx_ptr:  HDD context
+ *
+ * This function is used to check if sub 20MHz enabled
+ * Return: true of false
+ */
+bool hdd_cfg_is_sub20_channel_width_enabled(hdd_context_t *hdd_ctx_ptr)
+{
+	hdd_config_t *config_ptr = hdd_ctx_ptr->cfg_ini;
+
+	return config_ptr->sub_20_channel_width !=
+		 CFG_SUB_20_CHANNEL_WIDTH_DISABLE;
+}
+
+/**
+ * hdd_cfg_is_static_sub20_channel_width_enabled()
+ * @hdd_ctx_ptr:  HDD context
+ *
+ * This function is used to check if static sub 20MHz enabled
+ * Return: true of false
+ */
+bool hdd_cfg_is_static_sub20_channel_width_enabled(hdd_context_t *hdd_ctx_ptr)
+{
+	hdd_config_t *config_ptr = hdd_ctx_ptr->cfg_ini;
+
+	return (config_ptr->sub_20_channel_width ==
+		CFG_SUB_20_CHANNEL_WIDTH_5MHZ) ||
+	       (config_ptr->sub_20_channel_width ==
+		CFG_SUB_20_CHANNEL_WIDTH_10MHZ);
+}
+
+/**
+ * hdd_cfg_get_sub20_channel_config()
+ * @hdd_ctx_ptr:  HDD context
+ *
+ * This function is used to get sub20 config
+ * Return: sub20 config value
+ */
+uint8_t hdd_cfg_get_sub20_channel_config(hdd_context_t *hdd_ctx_ptr)
+{
+	hdd_config_t *config_ptr = hdd_ctx_ptr->cfg_ini;
+
+	if (config_ptr->sub_20_channel_width >= CFG_SUB_20_CHANNEL_WIDTH_MIN &&
+	    config_ptr->sub_20_channel_width <= CFG_SUB_20_CHANNEL_WIDTH_MAX)
+		return config_ptr->sub_20_channel_width;
+	return 0;
+}
+#endif
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+bool hdd_cfg_is_ptp_opt_enable(hdd_context_t *hdd_ctx_ptr)
+{
+	hdd_config_t *config_ptr = hdd_ctx_ptr->cfg_ini;
+
+	return (config_ptr->tsf_ptp_options != 0);
+}
+#endif
+
 static void hdd_set_power_save_config(hdd_context_t *pHddCtx, tSmeConfigParams *smeConfig)
 {
    hdd_config_t *pConfig = pHddCtx->cfg_ini;
@@ -6282,9 +6971,10 @@ VOS_STATUS hdd_set_idle_ps_config(hdd_context_t *pHddCtx, v_U32_t val)
    hdd_config_t *pConfig = pHddCtx->cfg_ini;
    VOS_STATUS status = VOS_STATUS_SUCCESS;
 
-   hddLog(LOG1, "hdd_set_idle_ps_config: Enter Val %d", val);
+   hddLog(LOG1, "hdd_set_idle_ps_config: Enter Val %d pconfig %pK ",
+                 val, pConfig);
 
-   if(pConfig->fIsImpsEnabled)
+   if(pConfig && pConfig->fIsImpsEnabled)
    {
       status = sme_SetIdlePowersaveConfig(pHddCtx->pvosContext, val);
       if(VOS_STATUS_SUCCESS != status)
@@ -6432,7 +7122,7 @@ VOS_STATUS hdd_hex_string_to_u16_array(char *str,
 		return VOS_STATUS_E_INVAL;
 
 	hddLog(VOS_TRACE_LEVEL_ERROR,
-		FL("str %p intArray %p intArrayMaxLen %d"),
+		FL("str %pK intArray %pK intArrayMaxLen %d"),
 		s, int_array, int_array_max_len);
 
 	*len = 0;
@@ -6445,7 +7135,7 @@ VOS_STATUS hdd_hex_string_to_u16_array(char *str,
 		if (sscanf(s, "%x", &val) == 1) {
 			int_array[*len] = (uint16_t) val;
 			hddLog(VOS_TRACE_LEVEL_DEBUG,
-				FL("s %p val %x intArray[%d]=0x%x"),
+				FL("s %pK val %x intArray[%d]=0x%x"),
 				s, val, *len, int_array[*len]);
 			*len += 1;
 		}
@@ -6471,7 +7161,7 @@ VOS_STATUS hdd_string_to_string_array(char *data, uint8_t *datalist,
     /* parse the string */
     while (str && ('\0' != *str) && (num < max_entries)) {
         field = str;
-        while (str && ('\0' != *str) && (separator != *str))
+        while (('\0' != *str) && (separator != *str))
            str++;
         if ('\0' == *str) {
             /* reach the end of string */
@@ -6686,6 +7376,11 @@ v_BOOL_t hdd_update_config_dat( hdd_context_t *pHddCtx )
 #if defined WLAN_FEATURE_VOWIFI
     if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_MCAST_BCAST_FILTER_SETTING, pConfig->mcastBcastFilterSetting,
                      NULL, eANI_BOOLEAN_FALSE)==eHAL_STATUS_FAILURE)
+     {
+        fStatus = FALSE;
+        hddLog(LOGE,
+		"Could not pass on WNI_CFG_MCAST_BCAST_FILTER_SETTING to CCM");
+     }
 #endif
 
      if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_SINGLE_TID_RC, pConfig->bSingleTidRc,
@@ -6806,29 +7501,6 @@ v_BOOL_t hdd_update_config_dat( hdd_context_t *pHddCtx )
         hddLog(LOGE,"Failure: Could not pass on WNI_CFG_HEART_BEAT_THRESHOLD configuration info to CCM");
     }
 
-   if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD, pConfig->apDataAvailPollPeriodInMs,
-               NULL, eANI_BOOLEAN_FALSE)==eHAL_STATUS_FAILURE)
-   {
-      fStatus = FALSE;
-      hddLog(LOGE,"Failure: Could not pass on WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD configuration info to CCM");
-   }
-
-   if(ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_ENABLE_CLOSE_LOOP,
-                   pConfig->enableCloseLoop, NULL, eANI_BOOLEAN_FALSE)
-       ==eHAL_STATUS_FAILURE)
-   {
-      fStatus = FALSE;
-      hddLog(LOGE, "Could not pass on WNI_CFG_ENABLE_CLOSE_LOOP to CCM");
-   }
-
-   if(ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_TX_PWR_CTRL_ENABLE,
-                   pConfig->enableAutomaticTxPowerControl, NULL, eANI_BOOLEAN_FALSE)
-                   ==eHAL_STATUS_FAILURE)
-   {
-      fStatus = FALSE;
-      hddLog(LOGE, "Could not pass on WNI_CFG_TX_PWR_CTRL_ENABLE to CCM");
-   }
-
    if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_SHORT_GI_40MHZ,
       pConfig->ShortGI40MhzEnable, NULL, eANI_BOOLEAN_FALSE)==eHAL_STATUS_FAILURE)
    {
@@ -7163,6 +7835,41 @@ v_BOOL_t hdd_update_config_dat( hdd_context_t *pHddCtx )
       hddLog(LOGE, "Could not pass on WNI_CFG_TGT_GTX_USR_CFG to CCM");
    }
 
+   if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_MAX_HT_MCS_TX_DATA,
+                    pConfig->max_ht_mcs_txdata, NULL,
+                    eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE) {
+       fStatus = FALSE;
+       hddLog(LOGE, "Could not pass on WNI_CFG_MAX_HT_MCS_TX_DATA to CCM");
+   }
+
+   if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA,
+                    pConfig->disable_abg_rate_txdata, NULL,
+                    eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE) {
+       fStatus = FALSE;
+       hddLog(LOGE, "Could not pass on WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA to CCM");
+   }
+
+   if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_RATE_FOR_TX_MGMT,
+                    pConfig->rate_for_tx_mgmt, NULL,
+                    eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE) {
+       fStatus = FALSE;
+       hddLog(LOGE, "Could not pass on WNI_CFG_RATE_FOR_TX_MGMT to CCM");
+   }
+
+   if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_RATE_FOR_TX_MGMT_2G,
+                    pConfig->rate_for_tx_mgmt_2g, NULL,
+                    eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE) {
+       fStatus = FALSE;
+       hddLog(LOGE, "Could not pass on WNI_CFG_RATE_FOR_TX_MGMT_2G to CCM");
+   }
+
+   if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_RATE_FOR_TX_MGMT_5G,
+                    pConfig->rate_for_tx_mgmt_5g, NULL,
+                    eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE) {
+       fStatus = FALSE;
+       hddLog(LOGE, "Could not pass on WNI_CFG_RATE_FOR_TX_MGMT_5G to CCM");
+   }
+
    return fStatus;
 }
 
@@ -7259,12 +7966,10 @@ VOS_STATUS hdd_set_sme_config( hdd_context_t *pHddCtx )
    smeConfig->csrConfig.min_rest_time_conc       = pConfig->min_rest_time_conc;
    smeConfig->csrConfig.idle_time_conc           = pConfig->idle_time_conc;
 
-   smeConfig->csrConfig.nNumStaChanCombinedConc  = pConfig->nNumStaChanCombinedConc;
-   smeConfig->csrConfig.nNumP2PChanCombinedConc  = pConfig->nNumP2PChanCombinedConc;
-
 #endif
    smeConfig->csrConfig.Is11eSupportEnabled      = pConfig->b80211eIsEnabled;
    smeConfig->csrConfig.WMMSupportMode           = pConfig->WmmMode;
+   smeConfig->csrConfig.gStaLocalEDCAEnable      = pConfig->gStaLocalEDCAEnable;
    /*
     * -channelBondingMode5GHz is getting updated by SAP
     * so stacbmode will be used for STA connection.
@@ -7445,6 +8150,14 @@ VOS_STATUS hdd_set_sme_config( hdd_context_t *pHddCtx )
    smeConfig->csrConfig.enableTxLdpc = pConfig->enableTxLdpc;
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
    smeConfig->csrConfig.cc_switch_mode = pConfig->WlanMccToSccSwitchMode;
+   smeConfig->csrConfig.band_switch_enable = pConfig->wlan_band_switch_enable;
+   smeConfig->csrConfig.ap_p2pgo_concurrency_enable =
+                        pConfig->wlan_ap_p2pgo_conc_enable;
+   smeConfig->csrConfig.ap_p2pclient_concur_enable =
+                        pConfig->wlan_ap_p2pclient_conc_enable;
+   smeConfig->csrConfig.ch_width_24g_orig = pConfig->nChannelBondingMode24GHz ?
+                        eHT_CHANNEL_WIDTH_40MHZ : eHT_CHANNEL_WIDTH_20MHZ;
+   smeConfig->csrConfig.ch_width_5g_orig = pConfig->vhtChannelWidth;
 #endif
 
    smeConfig->csrConfig.max_amsdu_num = pConfig->max_amsdu_num;
@@ -7550,6 +8263,18 @@ VOS_STATUS hdd_set_sme_config( hdd_context_t *pHddCtx )
    smeConfig->csrConfig.sta_roam_policy_params.skip_unsafe_channels = 0;
 
    smeConfig->snr_monitor_enabled = pHddCtx->cfg_ini->fEnableSNRMonitoring;
+   smeConfig->sub20_config_info =
+       hdd_cfg_get_sub20_channel_config(pHddCtx);
+   smeConfig->sub20_channelwidth =
+              hdd_cfg_get_static_sub20_channel_width(pHddCtx);
+   smeConfig->sub20_dynamic_channelwidth =
+              hdd_cfg_get_sub20_dyn_capabilities(pHddCtx);
+
+   smeConfig->csrConfig.sta_auth_retries_for_code17 =
+                        pHddCtx->cfg_ini->sta_auth_retries_for_code17;
+
+   smeConfig->sta_change_cc_via_beacon =
+	 pHddCtx->cfg_ini->sta_change_cc_via_beacon;
 
    halStatus = sme_UpdateConfig( pHddCtx->hHal, smeConfig);
    if ( !HAL_STATUS_SUCCESS( halStatus ) )
@@ -7562,7 +8287,6 @@ VOS_STATUS hdd_set_sme_config( hdd_context_t *pHddCtx )
    return status;
 }
 
-
 /**---------------------------------------------------------------------------
 
   \brief hdd_execute_config_command() -
@@ -8064,6 +8788,51 @@ void hdd_set_btc_bt_wlan_interval(hdd_context_t *hdd_ctx)
 			hddLog(LOGE, "Fail to set coex wlan connection parameters");
 	}
 
+        if ((config->coex_page_p2p_sta_bt_interval !=0) &&
+                (config->coex_page_p2p_sta_wlan_interval !=0)) {
+                status = sme_set_btc_bt_wlan_interval_page_p2p_sta(
+                                   config->coex_page_p2p_sta_bt_interval,
+                                   config->coex_page_p2p_sta_wlan_interval);
+                if (VOS_STATUS_SUCCESS != status)
+                        hddLog(LOGE, "Fail to set coex page p2p sta bt interval parameters");
+        }
+
+        if ((config->coex_inquiry_sta_bt_interval !=0) &&
+                (config->coex_inquiry_sta_wlan_interval !=0)) {
+                status = sme_set_btc_bt_wlan_interval_inquiry_sta(
+                                   config->coex_inquiry_sta_bt_interval,
+                                   config->coex_inquiry_sta_wlan_interval);
+                if (VOS_STATUS_SUCCESS != status)
+                        hddLog(LOGE, "Fail to set coex inquiry sta bt interval parameters");
+        }
+
+        if ((config->coex_inquiry_sap_bt_interval !=0) &&
+                (config->coex_inquiry_sap_wlan_interval !=0)) {
+                status = sme_set_btc_bt_wlan_interval_inquiry_sap(
+                                   config->coex_inquiry_sap_bt_interval,
+                                   config->coex_inquiry_sap_wlan_interval);
+                if (VOS_STATUS_SUCCESS != status)
+                        hddLog(LOGE, "Fail to set coex inquiry sap bt interval parameters");
+        }
+
+        if ((config->coex_inquiry_p2p_bt_interval !=0) &&
+                (config->coex_inquiry_p2p_wlan_interval !=0)) {
+                status = sme_set_btc_bt_wlan_interval_inquiry_p2p(
+                                   config->coex_inquiry_p2p_bt_interval,
+                                   config->coex_inquiry_p2p_wlan_interval);
+                if (VOS_STATUS_SUCCESS != status)
+                        hddLog(LOGE, "Fail to set coex inquiry p2p bt interval parameters");
+        }
+
+        if ((config->coex_inquiry_p2p_sta_bt_interval !=0) &&
+                (config->coex_inquiry_p2p_sta_wlan_interval !=0)) {
+                status = sme_set_btc_bt_wlan_interval_inquiry_p2p_sta(
+                                   config->coex_inquiry_p2p_sta_bt_interval,
+                                   config->coex_inquiry_p2p_sta_wlan_interval);
+                if (VOS_STATUS_SUCCESS != status)
+                        hddLog(LOGE, "Fail to set coex inquiry p2p sta bt interval parameters");
+        }
+
 	status = sme_set_btc_dynamic_bt_wlan_coex(
 		config->dynamic_wlan_bt_coex, config->antenna_isolation);
 
@@ -8075,11 +8844,223 @@ void hdd_set_btc_bt_wlan_interval(hdd_context_t *hdd_ctx)
 	if (VOS_STATUS_SUCCESS != status)
 		hddLog(LOGE, "Fail to set coex tx power");
 
-#ifdef WMI_COEX_BTC_DUTYCYCLE
-       status = sme_set_btc_coex_dutycycle(config->coex_btc_PauseDuration,config->coex_btc_UnPauseDuration);
+#ifdef FEATURE_COEX_PTA_CONFIG_ENABLE
+       status = sme_configure_pta_coex(config->coex_pta_config_enable,config->coex_pta_config_param);
 
         if (VOS_STATUS_SUCCESS != status)
-                hddLog(LOGE, "Fail to set coex PauseDuration");
+                hddLog(LOGE, "Fail to set pta coex");
 #endif
 
 }
+
+/**
+ * hdd_validate_prb_req_ie_bitmap - validates user input for ie bit map
+ * @hdd_ctx: the pointer to hdd context
+ *
+ * This function checks whether user have entered valid probe request
+ * ie bitmap and also verifies vendor ouis if vendor specific ie is set
+ *
+ * Return: status of verification
+ *              1 - valid input
+ *              0 - invalid input
+ */
+uint32_t hdd_validate_prb_req_ie_bitmap(hdd_context_t* pHddCtx)
+{
+	if (!(pHddCtx->cfg_ini->probe_req_ie_bitmap_0 ||
+	    pHddCtx->cfg_ini->probe_req_ie_bitmap_1 ||
+	    pHddCtx->cfg_ini->probe_req_ie_bitmap_2 ||
+	    pHddCtx->cfg_ini->probe_req_ie_bitmap_3 ||
+	    pHddCtx->cfg_ini->probe_req_ie_bitmap_4 ||
+	    pHddCtx->cfg_ini->probe_req_ie_bitmap_5 ||
+	    pHddCtx->cfg_ini->probe_req_ie_bitmap_6 ||
+	    pHddCtx->cfg_ini->probe_req_ie_bitmap_7))
+		return 0;
+
+	/**
+	 * check whether vendor oui IE is set and OUIs are present, each OUI
+	 * is eneterd in the form of string of 8 characters from ini, therefore,
+	 * for atleast one OUI, minimum length is 8 and hence this string length
+	 * is checked for minimum of 8
+	 */
+	if ((pHddCtx->cfg_ini->probe_req_ie_bitmap_6 &
+	     VENDOR_SPECIFIC_IE_BITMAP) &&
+	     (strlen(pHddCtx->cfg_ini->probe_req_ouis) < 8))
+		return 0;
+
+	/* check whether vendor oui IE is not set but OUIs are present */
+	if (!(pHddCtx->cfg_ini->probe_req_ie_bitmap_6 &
+	    VENDOR_SPECIFIC_IE_BITMAP) &&
+	    (strlen(pHddCtx->cfg_ini->probe_req_ouis) > 0))
+		return 0;
+
+	return 1;
+}
+
+/**
+ * probe_req_voui_convert_to_hex - converts str of 8 chars into two hex values
+ * @temp: string to be converted
+ * @voui: contains the type and subtype values
+ *
+ * This function converts the string length of 8 characters into two
+ * hexa-decimal values, oui_type and oui_subtype, where oui_type is the
+ * hexa decimal value converted from first 6 characters and oui_subtype is
+ * hexa decimal value converted from last 2 characters.
+ * strings which doesn't match with the specified pattern are ignored.
+ *
+ * Return: status of conversion
+ *	   1 - if conversion is successful
+ *	   0 - if conversion is failed
+ */
+static uint32_t hdd_probe_req_voui_convert_to_hex(uint8_t *temp,
+						  struct vendor_oui *voui)
+{
+	uint32_t hex_value[4];
+	uint32_t i = 0;
+	uint32_t indx = 0;
+
+	memset(hex_value, 0x00, sizeof(hex_value));
+	memset(voui, 0x00, sizeof(*voui));
+
+	/* convert string to hex */
+	for (i = 0; i < 8; i++) {
+		if (temp[i] >= '0' && temp[i] <= '9') {
+			hex_value[indx] = (temp[i] - '0') << 4;
+		} else if (temp[i] >= 'A' && temp[i] <= 'F') {
+			hex_value[indx] = (temp[i] - 'A') + 0xA;
+			hex_value[indx] = hex_value[indx] << 4;
+		} else {
+			/* invalid character in oui */
+			return 0;
+		}
+
+		if (temp[i + 1] >= '0' && temp[i + 1] <= '9') {
+			hex_value[indx] |= (temp[i + 1] - '0');
+			i = i + 1;
+			indx = indx + 1;
+		} else if (temp[i + 1] >= 'A' && temp[i + 1] <= 'F') {
+			hex_value[indx] |= ((temp[i + 1] - 'A') + 0xA);
+			i = i + 1;
+			indx = indx + 1;
+		} else {
+			/* invalid character in oui */
+			return 0;
+		}
+	}
+
+	voui->oui_type = (hex_value[0] | (hex_value[1] << 8) |
+			 (hex_value[2] << 16));
+	voui->oui_subtype = hex_value[3];
+
+	hddLog(LOG1, FL("OUI_type = %x and OUI_subtype = %x"), voui->oui_type,
+							voui->oui_subtype);
+	return 1;
+}
+
+/**
+ * hdd_parse_probe_req_ouis - form ouis from ini gProbeReqOUIs
+ * @hdd_ctx: the pointer to hdd context
+ *
+ * This function parses the ini string gProbeReqOUIs which needs to in the
+ * following format:
+ * "<8 characters of [0-9] or [A-F]>space<8 characters from [0-9] etc.,"
+ * example: "AABBCCDD 1122EEFF"
+ * and the logic counts the number of OUIS and allocates the memory
+ * for every valid OUI and is stored in hdd_context_t
+ *
+ * Return: status of parsing
+ */
+VOS_STATUS hdd_parse_probe_req_ouis(hdd_context_t* pHddCtx)
+{
+	struct vendor_oui voui[MAX_PROBE_REQ_OUIS];
+	uint8_t *str;
+	uint8_t temp[9];
+	uint32_t start = 0, end = 0;
+	uint32_t oui_indx = 0;
+	uint32_t i = 0;
+
+	pHddCtx->cfg_ini->probe_req_ouis[MAX_PRB_REQ_VENDOR_OUI_INI_LEN - 1] =
+									'\0';
+	if (!strlen(pHddCtx->cfg_ini->probe_req_ouis)) {
+		pHddCtx->no_of_probe_req_ouis = 0;
+		pHddCtx->probe_req_voui = NULL;
+		hddLog(LOG1, FL("NO OUIS to parse"));
+		return VOS_STATUS_SUCCESS;
+	}
+
+	str = (uint8_t *)(pHddCtx->cfg_ini->probe_req_ouis);
+
+	while(str[i] != '\0') {
+		if (str[i] == ' ') {
+			if ((end - start) != 8)
+			{
+				end = start = 0;
+				i++;
+				continue;
+			} else {
+				memcpy(temp, &str[i - 8], 8);
+				i++;
+				temp[8] = '\0';
+				if (hdd_probe_req_voui_convert_to_hex(temp,
+					&voui[oui_indx]) == 0) {
+					end = start = 0;
+					continue;
+				}
+				oui_indx++;
+				if (oui_indx >= MAX_PROBE_REQ_OUIS) {
+					hddLog(LOGE, "Max no.of OUIS supported "
+						"is 16. ignoring the rest");
+					break;
+				}
+			}
+			start = end = 0;
+		} else {
+			i++;
+			end++;
+		}
+	}
+
+	if ((end - start) == 8 && oui_indx < MAX_PROBE_REQ_OUIS) {
+		memcpy(temp, &str[i - 8], 8);
+		temp[8] = '\0';
+		if (hdd_probe_req_voui_convert_to_hex(temp,
+		    &voui[oui_indx]) == 1)
+			oui_indx++;
+	}
+
+	if (!oui_indx)
+		return VOS_STATUS_SUCCESS;
+
+	pHddCtx->probe_req_voui = (struct vendor_oui *)vos_mem_malloc(oui_indx *
+						sizeof(struct vendor_oui));
+	if (pHddCtx->probe_req_voui == NULL) {
+		hddLog(LOGE,"Not Enough memory for OUI");
+		pHddCtx->no_of_probe_req_ouis = 0;
+		return VOS_STATUS_E_FAILURE;
+	}
+	vos_mem_zero(pHddCtx->probe_req_voui,
+				oui_indx * sizeof(struct vendor_oui));
+	pHddCtx->no_of_probe_req_ouis = oui_indx;
+	vos_mem_copy(pHddCtx->probe_req_voui, voui,
+				oui_indx * sizeof(struct vendor_oui));
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * hdd_free_probe_req_ouis - de-allocates the probe req ouis
+ * @hdd_ctx: the pointer to hdd context
+ *
+ * This function de-alloactes the probe req ouis which are
+ * allocated while parsing of ini string gProbeReqOUIs
+ *
+ * Return: None
+ */
+void hdd_free_probe_req_ouis(hdd_context_t* pHddCtx)
+{
+	if (pHddCtx->probe_req_voui) {
+		vos_mem_free(pHddCtx->probe_req_voui);
+		pHddCtx->probe_req_voui = NULL;
+	}
+
+	pHddCtx->no_of_probe_req_ouis = 0;
+}
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c
index 6b769d42261..ef2ec7c507a 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -106,12 +106,12 @@
 #include "wlan_hdd_ocb.h"
 #include "qwlan_version.h"
 
-#include "wlan_hdd_memdump.h"
-
 #include "wlan_logging_sock_svc.h"
 #include "sapApi.h"
 #include "csrApi.h"
 
+#include "wmi_unified_priv.h"
+
 #define g_mode_rates_size (12)
 #define a_mode_rates_size (8)
 #define FREQ_BASE_80211G          (2407)
@@ -131,6 +131,13 @@
 
 #define WLAN_HDD_TGT_NOISE_FLOOR_DBM      (-96)
 
+/*
+ * max_sched_scan_plans defined to 2 for
+ * (1)fast scan
+ * (2)slow scan
+ */
+#define MAX_SCHED_SCAN_PLANS 2
+
 /* For IBSS, enable obss, fromllb, overlapOBSS & overlapFromllb protection
    check. The bit map is defined in:
 
@@ -193,8 +200,6 @@
 #define WLAN_HDD_MAX_FEATURE_SET   8
 
 #define IS_DFS_MODE_VALID(mode) ((mode >= DFS_MODE_NONE && mode <= DFS_MODE_DEPRIORITIZE))
-#define IS_CHANNEL_VALID(channel) ((channel >= 0 && channel < 15) \
-		|| (channel >= 36 && channel <= 184))
 
 #ifdef FEATURE_WLAN_EXTSCAN
 /*
@@ -231,6 +236,11 @@
 /* (30 Mins) */
 #define MIN_TIME_REQUIRED_FOR_NEXT_BUG_REPORT (30 * 60 * 1000)
 
+/*
+ * Count to ratelimit the HDD logs during Scan and connect
+ */
+#define HDD_SCAN_REJECT_RATE_LIMIT 5
+
 static const u32 hdd_cipher_suites[] =
 {
     WLAN_CIPHER_SUITE_WEP40,
@@ -415,6 +425,7 @@ wlan_hdd_txrx_stypes[NUM_NL80211_IFTYPES] = {
     [NL80211_IFTYPE_STATION] = {
         .tx = 0xffff,
         .rx = BIT(SIR_MAC_MGMT_ACTION) |
+            BIT(SIR_MAC_MGMT_TIME_ADVERT) |
             BIT(SIR_MAC_MGMT_PROBE_REQ),
     },
     [NL80211_IFTYPE_AP] = {
@@ -480,7 +491,11 @@ wlan_hdd_adhoc_iface_limit[] = {
    },
 };
 
-/* AP ( + AP ) combination */
+/*
+ * AP ( + AP) combination or
+ * AP ( + AP + AP + AP) combination if 4-SAP is supported
+ *  (WLAN_4SAP_CONCURRENCY)
+ */
 static const struct ieee80211_iface_limit
 wlan_hdd_ap_iface_limit[] = {
    {
@@ -554,6 +569,14 @@ wlan_hdd_sta_ap_p2pgo_iface_limit[] = {
    }
 };
 
+static const struct ieee80211_iface_limit
+   wlan_hdd_mon_iface_limit[] = {
+   {
+       .max = 3, /* Monitor interface */
+       .types = BIT(NL80211_IFTYPE_MONITOR),
+   },
+};
+
 static struct ieee80211_iface_combination
 wlan_hdd_iface_combination[] = {
    /* STA */
@@ -577,6 +600,9 @@ wlan_hdd_iface_combination[] = {
       .max_interfaces = (SAP_MAX_OBSS_STA_CNT +
                          VOS_MAX_NO_OF_SAP_MODE),
       .n_limits = ARRAY_SIZE(wlan_hdd_ap_iface_limit),
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)) || defined(BEACON_INTV_BACKPORTS)
+      .beacon_int_min_gcd = 1,
+#endif
    },
    /* P2P */
    {
@@ -593,6 +619,9 @@ wlan_hdd_iface_combination[] = {
                          VOS_MAX_NO_OF_SAP_MODE),
       .n_limits = ARRAY_SIZE(wlan_hdd_sta_ap_iface_limit),
       .beacon_int_infra_match = true,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)) || defined(BEACON_INTV_BACKPORTS)
+      .beacon_int_min_gcd = 1,
+#endif
    },
    /* STA + P2P */
    {
@@ -615,6 +644,13 @@ wlan_hdd_iface_combination[] = {
       .n_limits = ARRAY_SIZE(wlan_hdd_sta_ap_p2pgo_iface_limit),
       .beacon_int_infra_match = true,
    },
+   /* Monitor */
+   {
+      .limits = wlan_hdd_mon_iface_limit,
+      .max_interfaces = 3,
+      .num_different_channels = 2,
+      .n_limits = ARRAY_SIZE(wlan_hdd_mon_iface_limit),
+   },
 };
 #endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3,4,0)) ||
          defined(WITH_BACKPORTS) */
@@ -763,6 +799,30 @@ static int rssiMcsTbl[][10] =
 
 extern struct net_device_ops net_ops_struct;
 
+/**
+ * struct cfg_hostapd_edca - Store hostapd EDCA params
+ *                           and fill them in gLimEdcaParams
+ *                           structure
+ * @acm: EDCA param
+ * @aifs: EDCA param
+ * @cwmin: EDCA param
+ * @cwmax: EDCA param
+ * @txop: EDCA param
+ * @paramb: EDCA param for 11b
+ * @paramg: EDCA param for 11g
+ * @enable: enable hostapd EDCA params
+ */
+struct cfg_hostapd_edca {
+	uint8_t acm;
+	uint8_t aifs;
+	uint16_t cwmin;
+	uint16_t cwmax;
+	uint8_t txop;
+	uint8_t paramsb[5];
+	uint8_t paramsg[5];
+	uint8_t enable;
+};
+
 #ifdef WLAN_NL80211_TESTMODE
 enum wlan_hdd_tm_attr
 {
@@ -784,6 +844,11 @@ enum wlan_hdd_tm_cmd
 
 #define WLAN_HDD_TM_DATA_MAX_LEN    5000
 
+enum wlan_hdd_vendor_ie_access_policy {
+	WLAN_HDD_VENDOR_IE_ACCESS_NONE = 0,
+	WLAN_HDD_VENDOR_IE_ACCESS_ALLOW_IF_LISTED,
+};
+
 static const struct nla_policy wlan_hdd_tm_policy[WLAN_HDD_TM_ATTR_MAX + 1] =
 {
     [WLAN_HDD_TM_ATTR_CMD]        = { .type = NLA_U32 },
@@ -799,6 +864,7 @@ wlan_hdd_extscan_config_policy[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_
 {
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID] = { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_WIFI_BAND] = { .type = NLA_U32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_MAX_CHANNELS] = { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_CHANNEL] = { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_DWELL_TIME] = { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC_PASSIVE] = { .type = NLA_U8 },
@@ -817,7 +883,9 @@ wlan_hdd_extscan_config_policy[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_CACHED_SCAN_RESULTS_CONFIG_PARAM_FLUSH] = { .type = NLA_U8 },
 
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_CACHED_SCAN_RESULTS_CONFIG_PARAM_MAX] = { .type = NLA_U32 },
-    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_BSSID] = { .type = NLA_UNSPEC },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_BSSID] = {
+        .type = NLA_UNSPEC,
+        .len = HDD_MAC_ADDR_LEN},
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_LOW] = { .type = NLA_S32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_HIGH] = { .type = NLA_S32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_CHANNEL] = { .type = NLA_U32 },
@@ -826,11 +894,9 @@ wlan_hdd_extscan_config_policy[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_LOST_AP_SAMPLE_SIZE] = { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_MIN_BREACHING] = { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP] = { .type = NLA_U32 },
-    [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_NUM_NETWORKS] = { .type = NLA_U32 },
-    [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_SSID] = { .type = NLA_BINARY,
-							.len = IEEE80211_MAX_SSID_LEN },
-    [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_FLAGS] = { .type = NLA_U8 },
-    [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_AUTH_BIT] = { .type = NLA_U8 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_MAX_PERIOD] = { .type = NLA_U32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_BASE] = { .type = NLA_U32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_STEP_COUNT] = { .type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_SSID] = { .type = NLA_BINARY,
 							.len = IEEE80211_MAX_SSID_LEN + 1 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_LOST_SSID_SAMPLE_SIZE] = { .type = NLA_U32 },
@@ -839,6 +905,54 @@ wlan_hdd_extscan_config_policy[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_LOW] = { .type = NLA_S32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_HIGH] = { .type = NLA_S32 },
     [QCA_WLAN_VENDOR_ATTR_EXTSCAN_CONFIGURATION_FLAGS] = { .type = NLA_U32 },
+    [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_LOST_AP_SAMPLE_SIZE] = { .type = NLA_U32 },
+};
+
+static const struct nla_policy
+wlan_hdd_pno_config_policy[QCA_WLAN_VENDOR_ATTR_PNO_MAX + 1] = {
+    [QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ID] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_NUM_NETWORKS] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_SSID] = {
+        .type = NLA_BINARY,
+        .len = IEEE80211_MAX_SSID_LEN + 1
+    },
+    [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_FLAGS] = {
+        .type = NLA_U8
+    },
+    [QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_AUTH_BIT] = {
+        .type = NLA_U8
+    },
+    [QCA_WLAN_VENDOR_ATTR_EPNO_MIN5GHZ_RSSI] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_EPNO_MIN24GHZ_RSSI] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_EPNO_INITIAL_SCORE_MAX] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_EPNO_CURRENT_CONNECTION_BONUS] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_EPNO_SAME_NETWORK_BONUS] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_EPNO_SECURE_BONUS] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_EPNO_BAND5GHZ_BONUS] = {
+        .type = NLA_U32
+    },
+    [QCA_WLAN_VENDOR_ATTR_PNO_CONFIG_REQUEST_ID] = {
+         .type = NLA_U32
+    },
 };
 
 static const struct nla_policy
@@ -1189,14 +1303,6 @@ static const struct nl80211_vendor_cmd_info wlan_hdd_cfg80211_vendor_events[] =
         .vendor_id = QCA_NL80211_VENDOR_ID,
         .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SIGNIFICANT_CHANGE
     },
-    [QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND_INDEX] = {
-        .vendor_id = QCA_NL80211_VENDOR_ID,
-        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND
-    },
-    [QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST_INDEX] = {
-        .vendor_id = QCA_NL80211_VENDOR_ID,
-        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST
-    },
 #endif /* FEATURE_WLAN_EXTSCAN */
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -1224,6 +1330,10 @@ static const struct nl80211_vendor_cmd_info wlan_hdd_cfg80211_vendor_events[] =
         .vendor_id = QCA_NL80211_VENDOR_ID,
         .subcmd = QCA_NL80211_VENDOR_SUBCMD_LL_STATS_PEERS_RESULTS
     },
+    [QCA_NL80211_VENDOR_SUBCMD_LL_STATS_EXT_INDEX] = {
+        .vendor_id = QCA_NL80211_VENDOR_ID,
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_LL_STATS_EXT
+    },
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
 /* EXT TDLS */
     [QCA_NL80211_VENDOR_SUBCMD_TDLS_STATE_CHANGE_INDEX] =  {
@@ -1269,30 +1379,27 @@ static const struct nl80211_vendor_cmd_info wlan_hdd_cfg80211_vendor_events[] =
         .vendor_id = QCA_NL80211_VENDOR_ID,
         .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_PASSPOINT_NETWORK_FOUND
     },
-    [QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST_INDEX] = {
+    [QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_LOST_INDEX] = {
         .vendor_id = QCA_NL80211_VENDOR_ID,
-        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_LOST
     },
-    [QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SSID_HOTLIST_INDEX] = {
+#endif /* FEATURE_WLAN_EXTSCAN */
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+    [QCA_NL80211_VENDOR_SUBCMD_TEMPERATURE_EVENT_INDEX] = {
         .vendor_id = QCA_NL80211_VENDOR_ID,
-        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SSID_HOTLIST
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_TEMPERATURE_EVENT
     },
-    [QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_LOST_INDEX] = {
+    [QCA_NL80211_VENDOR_SUBCMD_RESUME_COMP_EVENT_INDEX] = {
         .vendor_id = QCA_NL80211_VENDOR_ID,
-        .subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_AP_LOST
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_RESUME_COMP_EVENT
     },
-#endif /* FEATURE_WLAN_EXTSCAN */
+#endif /* FEATURE_WLAN_THERMAL_SHUTDOWN */
+
     /* OCB events */
     [QCA_NL80211_VENDOR_SUBCMD_DCC_STATS_EVENT_INDEX] =  {
         .vendor_id = QCA_NL80211_VENDOR_ID,
         .subcmd = QCA_NL80211_VENDOR_SUBCMD_DCC_STATS_EVENT
     },
-#ifdef WLAN_FEATURE_MEMDUMP
-    [QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP_INDEX] = {
-        .vendor_id = QCA_NL80211_VENDOR_ID,
-        .subcmd = QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP
-    },
-#endif /* WLAN_FEATURE_MEMDUMP */
     [QCA_NL80211_VENDOR_SUBCMD_MONITOR_RSSI_INDEX] = {
         .vendor_id = QCA_NL80211_VENDOR_ID,
         .subcmd = QCA_NL80211_VENDOR_SUBCMD_MONITOR_RSSI
@@ -1303,6 +1410,10 @@ static const struct nl80211_vendor_cmd_info wlan_hdd_cfg80211_vendor_events[] =
         .subcmd = QCA_NL80211_VENDOR_SUBCMD_NDP
     },
 #endif /* WLAN_FEATURE_NAN_DATAPATH */
+    [QCA_NL80211_VENDOR_SUBCMD_PWR_SAVE_FAIL_DETECTED_INDEX] = {
+        .vendor_id = QCA_NL80211_VENDOR_ID,
+        .subcmd = QCA_NL80211_VENDOR_SUBCMD_CHIP_PWRSAVE_FAILURE
+    }
 };
 
 /**
@@ -1419,19 +1530,19 @@ __wlan_hdd_cfg80211_get_supported_features(struct wiphy *wiphy,
         return -EINVAL;
 
     if (wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION)) {
-        hddLog(LOG1, FL("Infra Station mode is supported by driver"));
+        hddLog(LOG1, "Infra Station mode is supported by driver");
         fset |= WIFI_FEATURE_INFRA;
     }
 
     if (TRUE == hdd_is_5g_supported(pHddCtx)) {
-        hddLog(LOG1, FL("INFRA_5G is supported by firmware"));
+        hddLog(LOG1, "INFRA_5G is supported by firmware");
         fset |= WIFI_FEATURE_INFRA_5G;
     }
 
 #ifdef WLAN_FEATURE_P2P
     if ((wiphy->interface_modes & BIT(NL80211_IFTYPE_P2P_CLIENT)) &&
         (wiphy->interface_modes & BIT(NL80211_IFTYPE_P2P_GO))) {
-        hddLog(LOG1, FL("WiFi-Direct is supported by driver"));
+        hddLog(LOG1, "WiFi-Direct is supported by driver");
         fset |= WIFI_FEATURE_P2P;
     }
 #endif
@@ -1445,20 +1556,20 @@ __wlan_hdd_cfg80211_get_supported_features(struct wiphy *wiphy,
 #ifdef FEATURE_WLAN_EXTSCAN
     if (pHddCtx->cfg_ini->extscan_enabled &&
         sme_IsFeatureSupportedByFW(EXTENDED_SCAN)) {
-        hddLog(LOG1, FL("EXTScan is supported by firmware"));
+        hddLog(LOG1, "EXTScan is supported by firmware");
         fset |= WIFI_FEATURE_EXTSCAN | WIFI_FEATURE_HAL_EPNO;
     }
 #endif
 
 #ifdef WLAN_FEATURE_NAN
     if (sme_IsFeatureSupportedByFW(NAN)) {
-        hddLog(LOG1, FL("NAN is supported by firmware"));
+        hddLog(LOG1, "NAN is supported by firmware");
         fset |= WIFI_FEATURE_NAN;
     }
 #endif
 
     if (sme_IsFeatureSupportedByFW(RTT)) {
-        hddLog(LOG1, FL("RTT is supported by firmware"));
+        hddLog(LOG1, "RTT is supported by firmware");
         fset |= WIFI_FEATURE_D2D_RTT;
         fset |= WIFI_FEATURE_D2AP_RTT;
     }
@@ -1466,7 +1577,7 @@ __wlan_hdd_cfg80211_get_supported_features(struct wiphy *wiphy,
 #ifdef FEATURE_WLAN_SCAN_PNO
     if (pHddCtx->cfg_ini->configPNOScanSupport &&
         sme_IsFeatureSupportedByFW(PNO)) {
-        hddLog(LOG1, FL("PNO is supported by firmware"));
+        hddLog(LOG1, "PNO is supported by firmware");
         fset |= WIFI_FEATURE_PNO;
     }
 #endif
@@ -1477,14 +1588,14 @@ __wlan_hdd_cfg80211_get_supported_features(struct wiphy *wiphy,
 #ifdef FEATURE_WLAN_TDLS
     if ((TRUE == pHddCtx->cfg_ini->fEnableTDLSSupport) &&
         sme_IsFeatureSupportedByFW(TDLS)) {
-        hddLog(LOG1, FL("TDLS is supported by firmware"));
+        hddLog(LOG1, "TDLS is supported by firmware");
         fset |= WIFI_FEATURE_TDLS;
     }
 
     if (sme_IsFeatureSupportedByFW(TDLS) &&
        (TRUE == pHddCtx->cfg_ini->fEnableTDLSOffChannel) &&
        sme_IsFeatureSupportedByFW(TDLS_OFF_CHANNEL)) {
-        hddLog(LOG1, FL("TDLS off-channel is supported by firmware"));
+        hddLog(LOG1, "TDLS off-channel is supported by firmware");
         fset |= WIFI_FEATURE_TDLS_OFFCHANNEL;
     }
 #endif
@@ -1499,6 +1610,15 @@ __wlan_hdd_cfg80211_get_supported_features(struct wiphy *wiphy,
     if (hdd_link_layer_stats_supported())
         fset |= WIFI_FEATURE_LINK_LAYER_STATS;
 
+    if (hdd_roaming_supported(pHddCtx))
+        fset |= WIFI_FEATURE_CONTROL_ROAMING;
+
+    if (pHddCtx->cfg_ini->probe_req_ie_whitelist)
+        fset |= WIFI_FEATURE_IE_WHITELIST;
+
+    if (hdd_scan_random_mac_addr_supported())
+        fset |= WIFI_FEATURE_SCAN_RAND;
+
     skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, sizeof(fset) +
                                               NLMSG_HDRLEN);
 
@@ -1546,6 +1666,49 @@ wlan_hdd_cfg80211_get_supported_features(struct wiphy *wiphy,
 }
 
 /**
+ * wlan_hdd_fill_whitelist_ie_attrs - fill the white list members
+ * @ie_whitelist: enables whitelist
+ * @probe_req_ie_bitmap: bitmap to be filled
+ * @num_vendor_oui: pointer to no of ouis
+ * @voui: pointer to ouis to be filled
+ * @pHddCtx: pointer to hdd ctx
+ *
+ * This function fills the ie bitmap and vendor oui fields with the
+ * corresponding values present in cfg_ini and PHddCtx
+ *
+ * Return:   Return none
+ */
+static void wlan_hdd_fill_whitelist_ie_attrs(bool *ie_whitelist,
+					     uint32_t *probe_req_ie_bitmap,
+					     uint32_t *num_vendor_oui,
+					     struct vendor_oui *voui,
+					     hdd_context_t *pHddCtx)
+{
+	uint32_t i = 0;
+
+	*ie_whitelist = true;
+	probe_req_ie_bitmap[0] = pHddCtx->cfg_ini->probe_req_ie_bitmap_0;
+	probe_req_ie_bitmap[1] = pHddCtx->cfg_ini->probe_req_ie_bitmap_1;
+	probe_req_ie_bitmap[2] = pHddCtx->cfg_ini->probe_req_ie_bitmap_2;
+	probe_req_ie_bitmap[3] = pHddCtx->cfg_ini->probe_req_ie_bitmap_3;
+	probe_req_ie_bitmap[4] = pHddCtx->cfg_ini->probe_req_ie_bitmap_4;
+	probe_req_ie_bitmap[5] = pHddCtx->cfg_ini->probe_req_ie_bitmap_5;
+	probe_req_ie_bitmap[6] = pHddCtx->cfg_ini->probe_req_ie_bitmap_6;
+	probe_req_ie_bitmap[7] = pHddCtx->cfg_ini->probe_req_ie_bitmap_7;
+
+	*num_vendor_oui = 0;
+
+	if ((pHddCtx->no_of_probe_req_ouis != 0) && (voui != NULL)) {
+		*num_vendor_oui = pHddCtx->no_of_probe_req_ouis;
+		for (i = 0; i < pHddCtx->no_of_probe_req_ouis; i++) {
+			voui[i].oui_type = pHddCtx->probe_req_voui[i].oui_type;
+			voui[i].oui_subtype =
+					pHddCtx->probe_req_voui[i].oui_subtype;
+		}
+	}
+}
+
+/**
  * __wlan_hdd_cfg80211_set_scanning_mac_oui() - set scan MAC
  * @wiphy:   pointer to wireless wiphy structure.
  * @wdev:    pointer to wireless_dev structure.
@@ -1567,6 +1730,8 @@ __wlan_hdd_cfg80211_set_scanning_mac_oui(struct wiphy *wiphy,
     struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI_MAX + 1];
     eHalStatus status;
     int ret;
+    struct net_device *ndev = wdev->netdev;
+    hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(ndev);
 
     ENTER();
 
@@ -1591,11 +1756,16 @@ __wlan_hdd_cfg80211_set_scanning_mac_oui(struct wiphy *wiphy,
         return -EINVAL;
     }
 
-    pReqMsg = vos_mem_malloc(sizeof(*pReqMsg));
+    pReqMsg = vos_mem_malloc(sizeof(*pReqMsg) +
+                    (pHddCtx->no_of_probe_req_ouis) *
+                    (sizeof(struct vendor_oui)));
     if (!pReqMsg) {
         hddLog(LOGE, FL("vos_mem_malloc failed"));
         return -ENOMEM;
     }
+    vos_mem_zero(pReqMsg, sizeof(*pReqMsg) +
+                    (pHddCtx->no_of_probe_req_ouis) *
+                    (sizeof(struct vendor_oui)));
 
     /* Parse and fetch oui */
     if (!tb[QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI]) {
@@ -1607,8 +1777,20 @@ __wlan_hdd_cfg80211_set_scanning_mac_oui(struct wiphy *wiphy,
             tb[QCA_WLAN_VENDOR_ATTR_SET_SCANNING_MAC_OUI],
             sizeof(pReqMsg->oui));
 
-    hddLog(LOG1, FL("Oui (%02x:%02x:%02x)"), pReqMsg->oui[0], pReqMsg->oui[1],
-                 pReqMsg->oui[2]);
+    /* populate pReqMsg for mac addr randomization */
+    pReqMsg->vdev_id = pAdapter->sessionId;
+    pReqMsg->enb_probe_req_sno_randomization = 1;
+
+    hddLog(LOG1, FL("Oui (%02x:%02x:%02x), vdev_id = %d"), pReqMsg->oui[0],
+                     pReqMsg->oui[1], pReqMsg->oui[2], pReqMsg->vdev_id);
+
+    if (pHddCtx->cfg_ini->probe_req_ie_whitelist)
+         wlan_hdd_fill_whitelist_ie_attrs(&pReqMsg->ie_whitelist,
+                                      pReqMsg->probe_req_ie_bitmap,
+                                      &pReqMsg->num_vendor_oui,
+                                      (struct vendor_oui *)((uint8_t *)pReqMsg +
+                                      sizeof(*pReqMsg)),
+                                      pHddCtx);
 
     status = sme_SetScanningMacOui(pHddCtx->hHal, pReqMsg);
     if (!HAL_STATUS_SUCCESS(status)) {
@@ -1652,6 +1834,15 @@ wlan_hdd_cfg80211_set_scanning_mac_oui(struct wiphy *wiphy,
 	return ret;
 }
 
+#define MAX_CONCURRENT_MATRIX \
+	QCA_WLAN_VENDOR_ATTR_GET_CONCURRENCY_MATRIX_MAX
+#define MATRIX_CONFIG_PARAM_SET_SIZE_MAX \
+	QCA_WLAN_VENDOR_ATTR_GET_CONCURRENCY_MATRIX_CONFIG_PARAM_SET_SIZE_MAX
+static const struct nla_policy
+wlan_hdd_get_concurrency_matrix_policy[MAX_CONCURRENT_MATRIX + 1] = {
+	[MATRIX_CONFIG_PARAM_SET_SIZE_MAX] = {.type = NLA_U32},
+};
+
 static int
 __wlan_hdd_cfg80211_get_concurrency_matrix(struct wiphy *wiphy,
                                          struct wireless_dev *wdev,
@@ -1660,7 +1851,7 @@ __wlan_hdd_cfg80211_get_concurrency_matrix(struct wiphy *wiphy,
 {
     uint32_t feature_set_matrix[WLAN_HDD_MAX_FEATURE_SET] = {0};
     uint8_t i, feature_sets, max_feature_sets;
-    struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_GET_CONCURRENCY_MATRIX_MAX + 1];
+    struct nlattr *tb[MAX_CONCURRENT_MATRIX + 1];
     struct sk_buff *reply_skb;
     hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
     int ret;
@@ -1676,19 +1867,19 @@ __wlan_hdd_cfg80211_get_concurrency_matrix(struct wiphy *wiphy,
     if (0 != ret)
         return ret;
 
-    if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_GET_CONCURRENCY_MATRIX_MAX,
-                  data, data_len, NULL)) {
+    if (nla_parse(tb, MAX_CONCURRENT_MATRIX,
+                  data, data_len, wlan_hdd_get_concurrency_matrix_policy)) {
         hddLog(LOGE, FL("Invalid ATTR"));
         return -EINVAL;
     }
 
     /* Parse and fetch max feature set */
-    if (!tb[QCA_WLAN_VENDOR_ATTR_GET_CONCURRENCY_MATRIX_CONFIG_PARAM_SET_SIZE_MAX]) {
+    if (!tb[MATRIX_CONFIG_PARAM_SET_SIZE_MAX]) {
         hddLog(LOGE, FL("Attr max feature set size failed"));
         return -EINVAL;
     }
-    max_feature_sets = nla_get_u32(
-     tb[QCA_WLAN_VENDOR_ATTR_GET_CONCURRENCY_MATRIX_CONFIG_PARAM_SET_SIZE_MAX]);
+
+    max_feature_sets = nla_get_u32(tb[MATRIX_CONFIG_PARAM_SET_SIZE_MAX]);
     hddLog(LOG1, FL("Max feature set size: %d"), max_feature_sets);
 
     /* Fill feature combination matrix */
@@ -1730,6 +1921,9 @@ __wlan_hdd_cfg80211_get_concurrency_matrix(struct wiphy *wiphy,
     return -ENOMEM;
 }
 
+#undef MAX_CONCURRENT_MATRIX
+#undef MATRIX_CONFIG_PARAM_SET_SIZE_MAX
+
 /**
  * wlan_hdd_cfg80211_get_concurrency_matrix() - get concurrency matrix
  * @wiphy:   pointer to wireless wiphy structure.
@@ -1753,6 +1947,49 @@ wlan_hdd_cfg80211_get_concurrency_matrix(struct wiphy *wiphy,
 	return ret;
 }
 
+#define MAX_ROAMING_PARAM \
+       QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX
+
+static const struct nla_policy
+wlan_hdd_set_roam_param_policy[MAX_ROAMING_PARAM + 1] = {
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_SUBCMD] = {.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_REQ_ID] = {.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID_NUM_NETWORKS] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID_LIST] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_BOOST_THRESHOLD] = {
+					.type = NLA_S32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_PENALTY_THRESHOLD] = {
+					.type = NLA_S32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_BOOST_FACTOR] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_PENALTY_FACTOR] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_A_BAND_MAX_BOOST] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_LAZY_ROAM_HISTERESYS] = {
+					.type = NLA_S32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_ALERT_ROAM_RSSI_TRIGGER] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_ENABLE] = {
+					.type = NLA_S32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_NUM_BSSID] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_BSSID] = {
+					.type = NLA_BINARY,
+					.len = MAC_ADDRESS_STR_LEN},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_RSSI_MODIFIER] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_NUM_BSSID] = {
+					.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_BSSID] = {
+					.type = NLA_BINARY,
+					.len = MAC_ADDRESS_STR_LEN},
+};
+
 static int
 __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
                                    struct wireless_dev *wdev,
@@ -1765,11 +2002,12 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
 	uint8_t session_id;
 	struct roam_ext_params roam_params;
 	uint32_t cmd_type, req_id;
-	struct nlattr *curr_attr;
+	struct nlattr *curr_attr = NULL;
 	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX + 1];
 	struct nlattr *tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX + 1];
 	int rem, i;
 	uint32_t buf_len = 0;
+	uint32_t count;
 	int ret;
 
 	if (VOS_FTM_MODE == hdd_get_conparam()) {
@@ -1783,7 +2021,7 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
 
 	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX,
 		data, data_len,
-		NULL)) {
+		wlan_hdd_set_roam_param_policy)) {
 		hddLog(LOGE, FL("Invalid ATTR"));
 		return -EINVAL;
 	}
@@ -1806,47 +2044,62 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
 	switch(cmd_type) {
 	case QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_SSID_WHITE_LIST:
 		i = 0;
-		nla_for_each_nested(curr_attr,
-			tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID_LIST],
-			rem) {
-			if (nla_parse(tb2,
-				QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_MAX,
-				nla_data(curr_attr), nla_len(curr_attr),
-				NULL)) {
-				hddLog(LOGE, FL("nla_parse failed"));
-				goto fail;
-			}
-			/* Parse and Fetch allowed SSID list*/
-			if (!tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID]) {
-				hddLog(LOGE, FL("attr allowed ssid failed"));
-				goto fail;
-			}
-			buf_len = nla_len(tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID]);
-			/*
-			 * Upper Layers include a null termination character.
-			 * Check for the actual permissible length of SSID and
-			 * also ensure not to copy the NULL termination
-			 * character to the driver buffer.
-			 */
-			if (buf_len && (i < MAX_SSID_ALLOWED_LIST) &&
-				((buf_len - 1) <= SIR_MAC_MAX_SSID_LENGTH)) {
-				nla_memcpy(roam_params.ssid_allowed_list[i].ssId,
-					tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID],
-					buf_len - 1);
-				roam_params.ssid_allowed_list[i].length =
-					buf_len - 1;
-				hddLog(VOS_TRACE_LEVEL_DEBUG,
-					FL("SSID[%d]: %.*s,length = %d"), i,
-					roam_params.ssid_allowed_list[i].length,
-					roam_params.ssid_allowed_list[i].ssId,
-					roam_params.ssid_allowed_list[i].length);
-				i++;
-			}
-			else {
-				hddLog(LOGE, FL("Invalid SSID len %d,idx %d"),
-					buf_len, i);
+		if (tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID_NUM_NETWORKS]) {
+			count = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID_NUM_NETWORKS]);
+		} else {
+			hddLog(LOGE, FL("Number of networks is not provided"));
+			goto fail;
+		}
+
+		if (count &&
+		    tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID_LIST]) {
+			nla_for_each_nested(curr_attr,
+				tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID_LIST],
+				rem) {
+				if (nla_parse(tb2,
+					QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_MAX,
+					nla_data(curr_attr), nla_len(curr_attr),
+					wlan_hdd_set_roam_param_policy)) {
+					hddLog(LOGE, FL("nla_parse failed"));
+					goto fail;
+				}
+				/* Parse and Fetch allowed SSID list*/
+				if (!tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID]) {
+					hddLog(LOGE, FL("attr allowed ssid failed"));
+					goto fail;
+				}
+				buf_len = nla_len(tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID]);
+				/*
+				 * Upper Layers include a null termination character.
+				 * Check for the actual permissible length of SSID and
+				 * also ensure not to copy the NULL termination
+				 * character to the driver buffer.
+				 */
+				if (buf_len && (i < MAX_SSID_ALLOWED_LIST) &&
+					((buf_len - 1) <= SIR_MAC_MAX_SSID_LENGTH)) {
+					nla_memcpy(roam_params.ssid_allowed_list[i].ssId,
+						tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_WHITE_LIST_SSID],
+						buf_len - 1);
+					roam_params.ssid_allowed_list[i].length =
+						buf_len - 1;
+					hddLog(VOS_TRACE_LEVEL_DEBUG,
+						FL("SSID[%d]: %.*s,length = %d"), i,
+						roam_params.ssid_allowed_list[i].length,
+						roam_params.ssid_allowed_list[i].ssId,
+						roam_params.ssid_allowed_list[i].length);
+					i++;
+				} else {
+					hddLog(LOGE, FL("Invalid SSID len %d,idx %d"),
+						buf_len, i);
+				}
 			}
 		}
+		if (i != count) {
+			hddLog(LOGE, FL("Invalid number of SSIDs i = %d, count = %d"),
+						i, count);
+			goto fail;
+		}
 		roam_params.num_ssid_allowed_list = i;
 		hddLog(VOS_TRACE_LEVEL_DEBUG, FL("Num of Allowed SSID %d"),
 			roam_params.num_ssid_allowed_list);
@@ -1945,19 +2198,33 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
 			hddLog(LOGE, FL("attr num of preferred bssid failed"));
 			goto fail;
 		}
-		roam_params.num_bssid_favored = nla_get_u32(
+		count = nla_get_u32(
 			tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_NUM_BSSID]);
+		if (count > MAX_BSSID_FAVORED) {
+			hddLog(LOGE, FL("Preferred BSSID count %u exceeds max %u"),
+			       count, MAX_BSSID_FAVORED);
+			goto fail;
+		}
 		hddLog(VOS_TRACE_LEVEL_DEBUG,
-			FL("Num of Preferred BSSID (%d)"),
-			roam_params.num_bssid_favored);
+			FL("Num of Preferred BSSID: %d"), count);
+		if (!tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PREFS]) {
+			hddLog(LOGE, FL("attr Preferred BSSID failed"));
+			goto fail;
+		}
 		i = 0;
 		nla_for_each_nested(curr_attr,
 			tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PREFS],
 			rem) {
+
+			if (i == count) {
+				hddLog(LOGW, FL("Ignoring excess Preferred BSSID"));
+				break;
+			}
+
 			if (nla_parse(tb2,
 				QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX,
 				nla_data(curr_attr), nla_len(curr_attr),
-				NULL)) {
+				wlan_hdd_set_roam_param_policy)) {
 				hddLog(LOGE, FL("nla_parse failed"));
 				goto fail;
 			}
@@ -1983,6 +2250,11 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
 				roam_params.bssid_favored_factor[i]);
 			i++;
 		}
+		if (i < count)
+			hddLog(LOGW,
+			       FL("Num Preferred BSSID %u less than expected %u"),
+			       i, count);
+		roam_params.num_bssid_favored = i;
 		sme_update_roam_params(pHddCtx->hHal, session_id,
 			roam_params, REASON_ROAM_SET_FAVORED_BSSID);
 		break;
@@ -1992,35 +2264,51 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
 			hddLog(LOGE, FL("attr num of blacklist bssid failed"));
 			goto fail;
 		}
-		roam_params.num_bssid_avoid_list = nla_get_u32(
+		count = nla_get_u32(
 			tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_NUM_BSSID]);
+		if (count > MAX_BSSID_AVOID_LIST) {
+			hddLog(LOGE, FL("Blacklist BSSID count %u exceeds max %u"),
+			       count, MAX_BSSID_AVOID_LIST);
+			goto fail;
+		}
 		hddLog(VOS_TRACE_LEVEL_DEBUG,
-			FL("Num of blacklist BSSID (%d)"),
-			roam_params.num_bssid_avoid_list);
+			FL("Num of blacklist BSSID: %d"), count);
 		i = 0;
-		nla_for_each_nested(curr_attr,
-			tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS],
-			rem) {
-			if (nla_parse(tb2,
-				QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX,
-				nla_data(curr_attr), nla_len(curr_attr),
-				NULL)) {
-				hddLog(LOGE, FL("nla_parse failed"));
-				goto fail;
-			}
-			/* Parse and fetch MAC address */
-			if (!tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_BSSID]) {
-				hddLog(LOGE, FL("attr blacklist addr failed"));
-				goto fail;
+		if (count &&
+		    tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS]) {
+			nla_for_each_nested(curr_attr,
+				tb[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS],
+				rem) {
+				if (i == count) {
+					hddLog(LOGW, FL("Ignoring excess Blacklist BSSID"));
+					break;
+				}
+				if (nla_parse(tb2,
+					QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_MAX,
+					nla_data(curr_attr), nla_len(curr_attr),
+					wlan_hdd_set_roam_param_policy)) {
+					hddLog(LOGE, FL("nla_parse failed"));
+					goto fail;
+				}
+				/* Parse and fetch MAC address */
+				if (!tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_BSSID]) {
+					hddLog(LOGE, FL("attr blacklist addr failed"));
+					goto fail;
+				}
+				nla_memcpy(roam_params.bssid_avoid_list[i],
+					tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_BSSID],
+					sizeof(tSirMacAddr));
+				hddLog(VOS_TRACE_LEVEL_DEBUG, MAC_ADDRESS_STR,
+					MAC_ADDR_ARRAY(
+					roam_params.bssid_avoid_list[i]));
+				i++;
 			}
-			nla_memcpy(roam_params.bssid_avoid_list[i],
-				tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_BSSID],
-				sizeof(tSirMacAddr));
-			hddLog(VOS_TRACE_LEVEL_DEBUG, MAC_ADDRESS_STR,
-				MAC_ADDR_ARRAY(
-				roam_params.bssid_avoid_list[i]));
-			i++;
 		}
+		if (i < count)
+			hddLog(LOGW,
+			       FL("Num Blacklist BSSID %u less than expected %u"),
+			       i, count);
+		roam_params.num_bssid_avoid_list = i;
 		sme_update_roam_params(pHddCtx->hHal, session_id,
 			roam_params, REASON_ROAM_SET_BLACKLIST_BSSID);
 		break;
@@ -2192,11 +2480,75 @@ static void wlan_hdd_cfg80211_stats_ext_callback(void* ctx, tStatsExtEvent* msg)
 
 }
 
+/**
+ * wlan_hdd_cfg80211_stats_ext2_callback - stats_ext2_callback
+ * @ctx: hdd context
+ * @pmsg: stats_ext2_event
+ *
+ * Return: void
+ */
+static void wlan_hdd_cfg80211_stats_ext2_callback(void *ctx,
+	struct stats_ext2_event *pmsg)
+{
+	hdd_context_t *hdd_ctx = (hdd_context_t *)ctx;
+	int status, data_size;
+	struct sk_buff *vendor_event;
+
+	status = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != status)
+		return;
+
+	if (NULL == pmsg) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+				"msg received here is null");
+		return;
+	}
+
+	data_size = sizeof(struct stats_ext2_event) +
+		(pmsg->hole_cnt)*sizeof(pmsg->hole_info_array[0]);
+
+	vendor_event = cfg80211_vendor_event_alloc(hdd_ctx->wiphy,
+			NULL,
+			data_size + NLMSG_HDRLEN + NLMSG_HDRLEN,
+			QCA_NL80211_VENDOR_SUBCMD_STATS_EXT_INDEX,
+			GFP_KERNEL);
+
+	if (!vendor_event) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"vendor_event_alloc failed for STATS_EXT2");
+		return;
+	}
+
+	if (nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_RX_AGGREGATION_STATS_HOLES_NUM,
+			pmsg->hole_cnt)) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"%s put fail",
+			"QCA_WLAN_VENDOR_ATTR_RX_AGGREGATION_STATS_HOLES_NUM");
+		kfree_skb(vendor_event);
+		return;
+	}
+
+        if (nla_put(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_RX_AGGREGATION_STATS_HOLES_INFO,
+			(pmsg->hole_cnt)*sizeof(pmsg->hole_info_array[0]),
+			(void *)(pmsg->hole_info_array))) {
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"%s put fail",
+			"QCA_WLAN_VENDOR_ATTR_RX_AGGREGATION_STATS_HOLES_INFO");
+		kfree_skb(vendor_event);
+		return;
+	}
+
+	cfg80211_vendor_event(vendor_event, GFP_KERNEL);
+}
 
 void wlan_hdd_cfg80211_stats_ext_init(hdd_context_t *pHddCtx)
 {
     sme_StatsExtRegisterCallback(pHddCtx->hHal,
                                  wlan_hdd_cfg80211_stats_ext_callback);
+    sme_register_stats_ext2_callback(pHddCtx->hHal,
+				wlan_hdd_cfg80211_stats_ext2_callback);
 }
 
 #endif
@@ -2235,6 +2587,8 @@ void wlan_hdd_cfg80211_stats_ext_init(hdd_context_t *pHddCtx)
 	QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_NUM_EPNO_NETS_BY_SSID
 #define MAX_NUM_WHITELISTED_SSID \
 	QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_CAPABILITIES_MAX_NUM_WHITELISTED_SSID
+#define MAX_NUM_BLACKLISTED_BSSID \
+	QCA_WLAN_VENDOR_ATTR_EXTSCAN_MAX_NUM_BLACKLISTED_BSSID
 
 /**
  * wlan_hdd_send_ext_scan_capability - send ext scan capability to user space
@@ -2269,7 +2623,8 @@ static int wlan_hdd_send_ext_scan_capability(hdd_context_t *hdd_ctx)
 	(sizeof(data->max_hotlist_ssids) + NLA_HDRLEN) +
 	(sizeof(data->max_number_epno_networks) + NLA_HDRLEN) +
 	(sizeof(data->max_number_epno_networks_by_ssid) + NLA_HDRLEN) +
-	(sizeof(data->max_number_of_white_listed_ssid) + NLA_HDRLEN);
+	(sizeof(data->max_number_of_white_listed_ssid) + NLA_HDRLEN) +
+	(sizeof(data->max_number_of_black_listed_bssid) + NLA_HDRLEN);
 
 	skb = cfg80211_vendor_cmd_alloc_reply_skb(hdd_ctx->wiphy, nl_buf_len);
 
@@ -2299,6 +2654,8 @@ static int wlan_hdd_send_ext_scan_capability(hdd_context_t *hdd_ctx)
 					data->max_number_epno_networks_by_ssid);
 	hddLog(LOG1, "max_number_of_white_listed_ssid (%u)",
 					data->max_number_of_white_listed_ssid);
+	hddLog(LOG1, "max_number_of_black_listed_bssid (%u)",
+					data->max_number_of_black_listed_bssid);
 
 	if (nla_put_u32(skb, PARAM_REQUEST_ID, data->requestId) ||
 	    nla_put_u32(skb, PARAM_STATUS, data->status) ||
@@ -2321,7 +2678,9 @@ static int wlan_hdd_send_ext_scan_capability(hdd_context_t *hdd_ctx)
 	    nla_put_u32(skb, MAX_NUM_EPNO_NETS_BY_SSID,
 			data->max_number_epno_networks_by_ssid) ||
 	    nla_put_u32(skb, MAX_NUM_WHITELISTED_SSID,
-			data->max_number_of_white_listed_ssid)) {
+			data->max_number_of_white_listed_ssid) ||
+	    nla_put_u32(skb, MAX_NUM_BLACKLISTED_BSSID,
+			data->max_number_of_black_listed_bssid)) {
 		hddLog(LOGE, FL("nla put fail"));
 		goto nla_put_failure;
 	}
@@ -2351,6 +2710,7 @@ nla_put_failure:
 #undef MAX_NUM_EPNO_NETS
 #undef MAX_NUM_EPNO_NETS_BY_SSID
 #undef MAX_NUM_WHITELISTED_SSID
+#undef MAX_NUM_BLACKLISTED_BSSID
 
 static int __wlan_hdd_cfg80211_extscan_get_capabilities(struct wiphy *wiphy,
                                                 struct wireless_dev *wdev,
@@ -2690,6 +3050,11 @@ static int __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy,
     }
     pReqMsg->numAp = nla_get_u32(
               tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_NUM_AP]);
+    if (pReqMsg->numAp > WLAN_EXTSCAN_MAX_HOTLIST_APS) {
+        hddLog(LOGE, FL("Number of AP: %u exceeds max: %u"),
+               pReqMsg->numAp, WLAN_EXTSCAN_MAX_HOTLIST_APS);
+        goto fail;
+    }
     hddLog(LOG1, FL("Number of AP %d"), pReqMsg->numAp);
 
     /* Parse and fetch lost ap sample size */
@@ -2705,9 +3070,18 @@ static int __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy,
     pReqMsg->sessionId = pAdapter->sessionId;
     hddLog(LOG1, FL("Session Id %d"), pReqMsg->sessionId);
 
+    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM]) {
+        hddLog(LOGE, FL("attr ap threshold failed"));
+        goto fail;
+    }
     i = 0;
     nla_for_each_nested(apTh,
                 tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM], rem) {
+        if (i == pReqMsg->numAp) {
+            hddLog(LOGW, FL("Ignoring excess AP"));
+            break;
+        }
+
         if (nla_parse(tb2, QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
                 nla_data(apTh), nla_len(apTh),
                 wlan_hdd_extscan_config_policy)) {
@@ -2746,6 +3120,12 @@ static int __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy,
         i++;
     }
 
+    if (i < pReqMsg->numAp) {
+        hddLog(LOGW, FL("Number of AP %u less than expected %u"),
+               i, pReqMsg->numAp);
+        pReqMsg->numAp = i;
+    }
+
     context = &pHddCtx->ext_scan_context;
     spin_lock(&hdd_context_lock);
     INIT_COMPLETION(context->response_event);
@@ -2805,244 +3185,6 @@ static int wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy,
 }
 
 
-/*
- * define short names for the global vendor params
- * used by wlan_hdd_cfg80211_extscan_set_ssid_hotlist()
- */
-#define PARAM_MAX \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX
-#define PARAM_REQUEST_ID \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID
-#define PARAMS_LOST_SSID_SAMPLE_SIZE \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_LOST_SSID_SAMPLE_SIZE
-#define PARAMS_NUM_SSID \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_NUM_SSID
-#define THRESHOLD_PARAM \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM
-#define PARAM_SSID \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_SSID
-#define PARAM_BAND \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_BAND
-#define PARAM_RSSI_LOW \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_LOW
-#define PARAM_RSSI_HIGH \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_RSSI_HIGH
-
-/**
- * __wlan_hdd_cfg80211_extscan_set_ssid_hotlist() - set ssid hot list
- * @wiphy: Pointer to wireless phy
- * @wdev: Pointer to wireless device
- * @data: Pointer to data
- * @data_len: Data length
- *
- * Return: 0 on success, negative errno on failure
- */
-static int
-__wlan_hdd_cfg80211_extscan_set_ssid_hotlist(struct wiphy *wiphy,
-					   struct wireless_dev *wdev,
-					   const void *data,
-					   int data_len)
-{
-	struct sir_set_ssid_hotlist_request *request;
-	struct net_device *dev = wdev->netdev;
-	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
-	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
-	struct nlattr *tb[PARAM_MAX + 1];
-	struct nlattr *tb2[PARAM_MAX + 1];
-	struct nlattr *ssids;
-	struct hdd_ext_scan_context *context;
-	uint32_t request_id;
-	char ssid_string[SIR_MAC_MAX_SSID_LENGTH + 1];
-	int ssid_len;
-	eHalStatus status;
-	int i, rem, retval;
-	unsigned long rc;
-
-	ENTER();
-
-	if (VOS_FTM_MODE == hdd_get_conparam()) {
-		hddLog(LOGE, FL("Command not allowed in FTM mode"));
-		return -EINVAL;
-	}
-
-	retval = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != retval)
-		return -EINVAL;
-
-	if (nla_parse(tb, PARAM_MAX,
-		      data, data_len,
-		      wlan_hdd_extscan_config_policy)) {
-		hddLog(LOGE, FL("Invalid ATTR"));
-		return -EINVAL;
-	}
-
-	request = vos_mem_malloc(sizeof(*request));
-	if (!request) {
-		hddLog(LOGE, FL("vos_mem_malloc failed"));
-		return -ENOMEM;
-	}
-
-	/* Parse and fetch request Id */
-	if (!tb[PARAM_REQUEST_ID]) {
-		hddLog(LOGE, FL("attr request id failed"));
-		goto fail;
-	}
-
-	request->request_id = nla_get_u32(tb[PARAM_REQUEST_ID]);
-	hddLog(LOG1, FL("Request Id %d"), request->request_id);
-
-	/* Parse and fetch lost SSID sample size */
-	if (!tb[PARAMS_LOST_SSID_SAMPLE_SIZE]) {
-		hddLog(LOGE, FL("attr number of Ssid failed"));
-		goto fail;
-	}
-	request->lost_ssid_sample_size =
-		nla_get_u32(tb[PARAMS_LOST_SSID_SAMPLE_SIZE]);
-	hddLog(LOG1, FL("Lost SSID Sample Size %d"),
-	       request->lost_ssid_sample_size);
-
-	/* Parse and fetch number of hotlist SSID */
-	if (!tb[PARAMS_NUM_SSID]) {
-		hddLog(LOGE, FL("attr number of Ssid failed"));
-		goto fail;
-	}
-	request->ssid_count = nla_get_u32(tb[PARAMS_NUM_SSID]);
-	hddLog(LOG1, FL("Number of SSID %d"), request->ssid_count);
-
-	request->session_id = adapter->sessionId;
-	hddLog(LOG1, FL("Session Id (%d)"), request->session_id);
-
-	i = 0;
-	nla_for_each_nested(ssids, tb[THRESHOLD_PARAM], rem) {
-		if (i >= WLAN_EXTSCAN_MAX_HOTLIST_SSIDS) {
-			hddLog(LOGE,
-			       FL("Too Many SSIDs, %d exceeds %d"),
-			       i, WLAN_EXTSCAN_MAX_HOTLIST_SSIDS);
-			break;
-		}
-		if (nla_parse(tb2, PARAM_MAX,
-			      nla_data(ssids), nla_len(ssids),
-			      wlan_hdd_extscan_config_policy)) {
-			hddLog(LOGE, FL("nla_parse failed"));
-			goto fail;
-		}
-
-		/* Parse and fetch SSID */
-		if (!tb2[PARAM_SSID]) {
-			hddLog(LOGE, FL("attr ssid failed"));
-			goto fail;
-		}
-		nla_memcpy(ssid_string,
-			   tb2[PARAM_SSID],
-			   sizeof(ssid_string));
-		hddLog(LOG1, FL("SSID %s"),
-		       ssid_string);
-		ssid_len = strlen(ssid_string);
-		memcpy(request->ssids[i].ssid.ssId, ssid_string, ssid_len);
-		request->ssids[i].ssid.length = ssid_len;
-
-		/* Parse and fetch low RSSI */
-		if (!tb2[PARAM_BAND]) {
-			hddLog(LOGE, FL("attr band failed"));
-			goto fail;
-		}
-		request->ssids[i].band = nla_get_u8(tb2[PARAM_BAND]);
-		hddLog(LOG1, FL("band %d"), request->ssids[i].band);
-
-		/* Parse and fetch low RSSI */
-		if (!tb2[PARAM_RSSI_LOW]) {
-			hddLog(LOGE, FL("attr low RSSI failed"));
-			goto fail;
-		}
-		request->ssids[i].rssi_low = nla_get_s32(tb2[PARAM_RSSI_LOW]);
-		hddLog(LOG1, FL("RSSI low %d"), request->ssids[i].rssi_low);
-
-		/* Parse and fetch high RSSI */
-		if (!tb2[PARAM_RSSI_HIGH]) {
-			hddLog(LOGE, FL("attr high RSSI failed"));
-			goto fail;
-		}
-		request->ssids[i].rssi_high = nla_get_u32(tb2[PARAM_RSSI_HIGH]);
-		hddLog(LOG1, FL("RSSI high %d"), request->ssids[i].rssi_high);
-		i++;
-	}
-
-	context = &hdd_ctx->ext_scan_context;
-	spin_lock(&hdd_context_lock);
-	INIT_COMPLETION(context->response_event);
-	context->request_id = request_id = request->request_id;
-	spin_unlock(&hdd_context_lock);
-
-	status = sme_set_ssid_hotlist(hdd_ctx->hHal, request);
-	if (!HAL_STATUS_SUCCESS(status)) {
-		hddLog(LOGE,
-		       FL("sme_set_ssid_hotlist failed(err=%d)"), status);
-		goto fail;
-	}
-
-	vos_mem_free(request);
-
-	/* request was sent -- wait for the response */
-	rc = wait_for_completion_timeout(&context->response_event,
-					 msecs_to_jiffies
-						(WLAN_WAIT_TIME_EXTSCAN));
-	if (!rc) {
-		hddLog(LOGE, FL("sme_set_ssid_hotlist timed out"));
-		retval = -ETIMEDOUT;
-	} else {
-		spin_lock(&hdd_context_lock);
-		if (context->request_id == request_id)
-			retval = context->response_status;
-		else
-			retval = -EINVAL;
-		spin_unlock(&hdd_context_lock);
-	}
-
-	return retval;
-
-fail:
-	vos_mem_free(request);
-	return -EINVAL;
-}
-
-/*
- * done with short names for the global vendor params
- * used by wlan_hdd_cfg80211_extscan_set_ssid_hotlist()
- */
-#undef PARAM_MAX
-#undef PARAM_REQUEST_ID
-#undef PARAMS_NUM_SSID
-#undef THRESHOLD_PARAM
-#undef PARAM_SSID
-#undef PARAM_BAND
-#undef PARAM_RSSI_LOW
-#undef PARAM_RSSI_HIGH
-
-/**
- * wlan_hdd_cfg80211_extscan_set_ssid_hotlist() - set ssid hot list
- * @wiphy: Pointer to wireless phy
- * @wdev: Pointer to wireless device
- * @data: Pointer to data
- * @data_len: Data length
- *
- * Return: 0 on success, negative errno on failure
- */
-static int
-wlan_hdd_cfg80211_extscan_set_ssid_hotlist(struct wiphy *wiphy,
-					   struct wireless_dev *wdev,
-					   const void *data,
-					   int data_len)
-{
-	int ret;
-
-	vos_ssr_protect(__func__);
-	ret = __wlan_hdd_cfg80211_extscan_set_ssid_hotlist(wiphy, wdev, data,
-							data_len);
-	vos_ssr_unprotect(__func__);
-
-	return ret;
-}
-
 static int __wlan_hdd_cfg80211_extscan_set_significant_change(
                                         struct wiphy *wiphy,
                                         struct wireless_dev *wdev,
@@ -3135,14 +3277,28 @@ static int __wlan_hdd_cfg80211_extscan_set_significant_change(
     }
     pReqMsg->numAp = nla_get_u32(
             tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP]);
+    if (pReqMsg->numAp > WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS) {
+        hddLog(LOGE, FL("Number of AP %u exceeds max %u"),
+               pReqMsg->numAp, WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS);
+        goto fail;
+    }
 
     pReqMsg->sessionId = pAdapter->sessionId;
     hddLog(LOG1, FL("Number of AP %d Session Id %d"), pReqMsg->numAp,
            pReqMsg->sessionId);
-
+    if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM]) {
+        hddLog(LOGE, FL("attr ap threshold failed"));
+        goto fail;
+    }
     i = 0;
     nla_for_each_nested(apTh,
                 tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM], rem) {
+
+        if (i == pReqMsg->numAp) {
+            hddLog(LOGW, FL("Ignoring excess AP"));
+            break;
+        }
+
         if (nla_parse(tb2,
                 QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
                 nla_data(apTh), nla_len(apTh),
@@ -3182,6 +3338,11 @@ static int __wlan_hdd_cfg80211_extscan_set_significant_change(
 
         i++;
     }
+    if (i < pReqMsg->numAp) {
+        hddLog(LOGW, FL("Number of AP %u less than expected %u"),
+               i, pReqMsg->numAp);
+        pReqMsg->numAp = i;
+    }
 
     context = &pHddCtx->ext_scan_context;
     spin_lock(&hdd_context_lock);
@@ -3487,6 +3648,7 @@ static int hdd_extscan_start_fill_bucket_channel_spec(
 	int rem1, rem2;
 	eHalStatus status;
 	uint8_t bktIndex, j, numChannels, total_channels = 0;
+	uint32_t expected_buckets;
 	uint32_t chanList[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
 
 	uint32_t min_dwell_time_active_bucket =
@@ -3498,7 +3660,6 @@ static int hdd_extscan_start_fill_bucket_channel_spec(
 	uint32_t max_dwell_time_passive_bucket =
 		pHddCtx->cfg_ini->extscan_passive_max_chn_time;
 
-	bktIndex = 0;
 	pReqMsg->min_dwell_time_active =
 		pReqMsg->max_dwell_time_active =
 			pHddCtx->cfg_ini->extscan_active_max_chn_time;
@@ -3506,13 +3667,23 @@ static int hdd_extscan_start_fill_bucket_channel_spec(
 	pReqMsg->min_dwell_time_passive =
 		pReqMsg->max_dwell_time_passive =
 			pHddCtx->cfg_ini->extscan_passive_max_chn_time;
+
+	expected_buckets = pReqMsg->numBuckets;
 	pReqMsg->numBuckets = 0;
+	bktIndex = 0;
 
 	nla_for_each_nested(buckets,
 			tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC], rem1) {
+
+		if (bktIndex >= expected_buckets) {
+			hddLog(LOGW, FL("ignoring excess buckets"));
+			break;
+		}
+
 		if (nla_parse(bucket,
-			QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
-			nla_data(buckets), nla_len(buckets), NULL)) {
+			      QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
+			      nla_data(buckets), nla_len(buckets),
+			      wlan_hdd_extscan_config_policy)) {
 			hddLog(LOGE, FL("nla_parse failed"));
 			return -EINVAL;
 		}
@@ -4011,8 +4182,10 @@ static int __wlan_hdd_cfg80211_extscan_start(struct wiphy *wiphy,
 		hddLog(LOGW,
 			FL("Exceeded MAX number of buckets: %d"),
 			WLAN_EXTSCAN_MAX_BUCKETS);
+		num_buckets = WLAN_EXTSCAN_MAX_BUCKETS;
 	}
 	hddLog(LOG1, FL("Input: Number of Buckets %d"), num_buckets);
+	pReqMsg->numBuckets = num_buckets;
 
 	/* This is optional attribute, if not present set it to 0 */
 	if (!tb[PARAM_CONFIG_FLAGS])
@@ -4336,15 +4509,6 @@ fail:
     return -EINVAL;
 }
 
-/*
- * define short names for the global vendor params
- * used by wlan_hdd_cfg80211_extscan_reset_ssid_hotlist()
- */
-#define PARAM_MAX \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX
-#define PARAM_REQUEST_ID \
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID
-
 /**
  * wlan_hdd_cfg80211_extscan_reset_bssid_hotlist() - reset bssid hot list
  * @wiphy: Pointer to wireless phy
@@ -4368,143 +4532,6 @@ static int wlan_hdd_cfg80211_extscan_reset_bssid_hotlist(struct wiphy *wiphy,
 	return ret;
 }
 
-/**
- * __wlan_hdd_cfg80211_extscan_reset_ssid_hotlist() - reset ssid hot list
- * @wiphy: Pointer to wireless phy
- * @wdev: Pointer to wireless device
- * @data: Pointer to data
- * @data_len: Data length
- *
- * Return: 0 on success, negative errno on failure
- */
-static int
-__wlan_hdd_cfg80211_extscan_reset_ssid_hotlist(struct wiphy *wiphy,
-					     struct wireless_dev *wdev,
-					     const void *data,
-					     int data_len)
-{
-	struct sir_set_ssid_hotlist_request *request;
-	struct net_device *dev = wdev->netdev;
-	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
-	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
-	struct nlattr *tb[PARAM_MAX + 1];
-	struct hdd_ext_scan_context *context;
-	uint32_t request_id;
-	eHalStatus status;
-	int retval;
-	unsigned long rc;
-
-	ENTER();
-
-	if (VOS_FTM_MODE == hdd_get_conparam()) {
-		hddLog(LOGE, FL("Command not allowed in FTM mode"));
-		return -EINVAL;
-	}
-
-	retval = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != retval)
-		return -EINVAL;
-
-	if (!hdd_ctx->cfg_ini->extscan_enabled) {
-		hddLog(LOGE, FL("extscan not supported"));
-		return -ENOTSUPP;
-	}
-	if (nla_parse(tb, PARAM_MAX,
-		      data, data_len,
-		      wlan_hdd_extscan_config_policy)) {
-		hddLog(LOGE, FL("Invalid ATTR"));
-		return -EINVAL;
-	}
-
-	request = vos_mem_malloc(sizeof(*request));
-	if (!request) {
-		hddLog(LOGE, FL("vos_mem_malloc failed"));
-		return -ENOMEM;
-	}
-
-	/* Parse and fetch request Id */
-	if (!tb[PARAM_REQUEST_ID]) {
-		hddLog(LOGE, FL("attr request id failed"));
-		goto fail;
-	}
-
-	request->request_id = nla_get_u32(tb[PARAM_REQUEST_ID]);
-	request->session_id = adapter->sessionId;
-	hddLog(LOG1, FL("Request Id %d Session Id %d"), request->request_id,
-		request->session_id);
-
-	request->lost_ssid_sample_size = 0;
-	request->ssid_count = 0;
-
-	context = &hdd_ctx->ext_scan_context;
-	spin_lock(&hdd_context_lock);
-	INIT_COMPLETION(context->response_event);
-	context->request_id = request_id = request->request_id;
-	spin_unlock(&hdd_context_lock);
-
-	status = sme_set_ssid_hotlist(hdd_ctx->hHal, request);
-	if (!HAL_STATUS_SUCCESS(status)) {
-		hddLog(LOGE,
-		       FL("sme_reset_ssid_hotlist failed(err=%d)"), status);
-		goto fail;
-	}
-
-	vos_mem_free(request);
-
-	/* request was sent -- wait for the response */
-	rc = wait_for_completion_timeout(&context->response_event,
-					 msecs_to_jiffies
-						(WLAN_WAIT_TIME_EXTSCAN));
-	if (!rc) {
-		hddLog(LOGE, FL("sme_reset_ssid_hotlist timed out"));
-		retval = -ETIMEDOUT;
-	} else {
-		spin_lock(&hdd_context_lock);
-		if (context->request_id == request_id)
-			retval = context->response_status;
-		else
-			retval = -EINVAL;
-		spin_unlock(&hdd_context_lock);
-	}
-
-	return retval;
-
-fail:
-	vos_mem_free(request);
-	return -EINVAL;
-}
-
-/**
- * wlan_hdd_cfg80211_extscan_reset_ssid_hotlist() - reset ssid hot list
- * @wiphy: Pointer to wireless phy
- * @wdev: Pointer to wireless device
- * @data: Pointer to data
- * @data_len: Data length
- *
- * Return: 0 on success, negative errno on failure
- */
-static int
-wlan_hdd_cfg80211_extscan_reset_ssid_hotlist(struct wiphy *wiphy,
-					     struct wireless_dev *wdev,
-					     const void *data,
-					     int data_len)
-{
-	int ret;
-
-	vos_ssr_protect(__func__);
-	ret = __wlan_hdd_cfg80211_extscan_reset_ssid_hotlist(wiphy, wdev,
-							data, data_len);
-	vos_ssr_unprotect(__func__);
-
-	return ret;
-}
-/*
- * done with short names for the global vendor params
- * used by wlan_hdd_cfg80211_extscan_reset_ssid_hotlist()
- */
-#undef PARAM_MAX
-#undef PARAM_REQUEST_ID
-
 static int __wlan_hdd_cfg80211_extscan_reset_significant_change(
                                         struct wiphy *wiphy,
                                         struct wireless_dev *wdev,
@@ -4640,19 +4667,30 @@ static int hdd_extscan_epno_fill_network_list(
 			struct wifi_epno_params *req_msg,
 			struct nlattr **tb)
 {
-	struct nlattr *network[
-		QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX + 1];
+	struct nlattr *network[QCA_WLAN_VENDOR_ATTR_PNO_MAX + 1];
 	struct nlattr *networks;
 	int rem1, ssid_len;
 	uint8_t index, *ssid;
+	uint32_t expected_networks;
 
+	expected_networks = req_msg->num_networks;
 	index = 0;
+	if (!tb[QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORKS_LIST]) {
+		hddLog(LOGE, FL("attr networks list failed"));
+		return -EINVAL;
+	}
 	nla_for_each_nested(networks,
-		tb[QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORKS_LIST],
-		rem1) {
-		if (nla_parse(network,
-			QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX,
-			nla_data(networks), nla_len(networks), NULL)) {
+			    tb[QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORKS_LIST],
+			    rem1) {
+
+		if (index == expected_networks) {
+			hddLog(LOGW, FL("ignoring excess networks"));
+			break;
+		}
+
+		if (nla_parse(network, QCA_WLAN_VENDOR_ATTR_PNO_MAX,
+			      nla_data(networks), nla_len(networks),
+			      wlan_hdd_pno_config_policy)) {
 			hddLog(LOGE, FL("nla_parse failed"));
 			return -EINVAL;
 		}
@@ -4665,6 +4703,12 @@ static int hdd_extscan_epno_fill_network_list(
 		ssid_len = nla_len(
 			network[QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORK_SSID]);
 
+		/* nla_parse will detect overflow but not underflow */
+		if (0 == ssid_len) {
+			hddLog(LOGE, FL("zero ssid length"));
+			return -EINVAL;
+		}
+
 		/* Decrement by 1, don't count null character */
 		ssid_len--;
 
@@ -4697,6 +4741,7 @@ static int hdd_extscan_epno_fill_network_list(
 
 		index++;
 	}
+	req_msg->num_networks = index;
 	return 0;
 }
 
@@ -4739,8 +4784,8 @@ static int __wlan_hdd_cfg80211_set_epno_list(struct wiphy *wiphy,
 	}
 
 	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_PNO_MAX,
-		data, data_len,
-		wlan_hdd_extscan_config_policy)) {
+		      data, data_len,
+		      wlan_hdd_pno_config_policy)) {
 		hddLog(LOGE, FL("Invalid ATTR"));
 		return -EINVAL;
 	}
@@ -4777,12 +4822,12 @@ static int __wlan_hdd_cfg80211_set_epno_list(struct wiphy *wiphy,
 	req_msg->num_networks = num_networks;
 
 	/* Parse and fetch request Id */
-	if (!tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]) {
+	if (!tb[QCA_WLAN_VENDOR_ATTR_PNO_CONFIG_REQUEST_ID]) {
 		hddLog(LOGE, FL("attr request id failed"));
 		goto fail;
 	}
 	req_msg->request_id = nla_get_u32(
-	    tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID]);
+	    tb[QCA_WLAN_VENDOR_ATTR_PNO_CONFIG_REQUEST_ID]);
 
 	req_msg->session_id = adapter->sessionId;
 	hddLog(LOG1, FL("Req Id %u Session Id %d"),
@@ -4926,14 +4971,28 @@ static int hdd_extscan_passpoint_fill_network_list(
 	struct nlattr *networks;
 	int rem1, len;
 	uint8_t index;
+	uint32_t expected_networks;
 
+	expected_networks = req_msg->num_networks;
 	index = 0;
+
+	if (!tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NETWORK_ARRAY]) {
+		hddLog(LOGE, FL("attr network array failed"));
+		return -EINVAL;
+	}
 	nla_for_each_nested(networks,
 		tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NETWORK_ARRAY],
 		rem1) {
+
+		if (index == expected_networks) {
+			hddLog(LOGW, FL("ignoring excess networks"));
+			break;
+		}
+
 		if (nla_parse(network,
 			QCA_WLAN_VENDOR_ATTR_PNO_MAX,
-			nla_data(networks), nla_len(networks), NULL)) {
+			nla_data(networks), nla_len(networks),
+			wlan_hdd_pno_config_policy)) {
 			hddLog(LOGE, FL("nla_parse failed"));
 			return -EINVAL;
 		}
@@ -4992,6 +5051,7 @@ static int hdd_extscan_passpoint_fill_network_list(
 
 		index++;
 	}
+	req_msg->num_networks = index;
 	return 0;
 }
 
@@ -5033,7 +5093,7 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy,
 	}
 
 	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_PNO_MAX, data, data_len,
-		wlan_hdd_extscan_config_policy)) {
+		wlan_hdd_pno_config_policy)) {
 		hddLog(LOGE, FL("Invalid ATTR"));
 		return -EINVAL;
 	}
@@ -5045,8 +5105,13 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy,
 	}
 	num_networks = nla_get_u32(
 		tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM]);
-	hddLog(LOG1, FL("num networks %u"), num_networks);
+	if (num_networks > SIR_PASSPOINT_LIST_MAX_NETWORKS) {
+		hddLog(LOGE, FL("num networks %u exceeds max %u"),
+		       num_networks, SIR_PASSPOINT_LIST_MAX_NETWORKS);
+		return -EINVAL;
+	}
 
+	hddLog(LOG1, FL("num networks %u"), num_networks);
 	req_msg = vos_mem_malloc(sizeof(*req_msg) +
 			(num_networks * sizeof(req_msg->networks[0])));
 	if (!req_msg) {
@@ -5427,6 +5492,9 @@ static bool put_wifi_wmm_ac_stat( tpSirWifiWmmAcStat stats,
     if (nla_put_u32(vendor_event, QCA_WLAN_VENDOR_ATTR_LL_STATS_WMM_AC_AC,
                     stats->ac ) ||
         nla_put_u32(vendor_event,
+                    QCA_WLAN_VENDOR_ATTR_LL_STATS_WMM_AC_PENDING_MSDU,
+                    stats->pending_msdu ) ||
+        nla_put_u32(vendor_event,
                     QCA_WLAN_VENDOR_ATTR_LL_STATS_WMM_AC_TX_MPDU,
                     stats->txMpdu ) ||
         nla_put_u32(vendor_event,
@@ -5575,9 +5643,28 @@ static bool put_wifi_iface_stats(tpSirWifiIfaceStat pWifiIfaceStat,
         nla_put_u32(vendor_event,
                     QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_LEAKY_AP_GUARD_TIME,
                     pWifiIfaceStat->rx_leak_window) ||
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+        nla_put_u64_64bit(vendor_event,
+                    QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_AVERAGE_TSF_OFFSET,
+                    average_tsf_offset,
+                   QCA_WLAN_VENDOR_ATTR_LL_STATS_PAD) ||
+#else
         nla_put_u64(vendor_event,
                     QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_AVERAGE_TSF_OFFSET,
-                    average_tsf_offset))
+                    average_tsf_offset) ||
+#endif
+        nla_put_u32(vendor_event,
+                    QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_RTS_SUCC_CNT,
+                    pWifiIfaceStat->rts_succ_cnt) ||
+        nla_put_u32(vendor_event,
+                    QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_RTS_FAIL_CNT,
+                    pWifiIfaceStat->rts_fail_cnt) ||
+        nla_put_u32(vendor_event,
+                    QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_PPDU_SUCC_CNT,
+                    pWifiIfaceStat->ppdu_succ_cnt) ||
+        nla_put_u32(vendor_event,
+                    QCA_WLAN_VENDOR_ATTR_LL_STATS_IFACE_PPDU_FAIL_CNT,
+                    pWifiIfaceStat->ppdu_fail_cnt))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
                FL("QCA_WLAN_VENDOR_ATTR put fail"));
@@ -6049,8 +6136,7 @@ static void hdd_link_layer_process_radio_stats(hdd_adapter_t *pAdapter,
  * after receiving Link Layer indications from FW.This callback converts the
  * firmware data to the NL data and send the same to the kernel/upper layers.
  */
-static void wlan_hdd_cfg80211_link_layer_stats_callback(void *ctx,
-                                                        int indType,
+static void wlan_hdd_cfg80211_link_layer_stats_callback(void *ctx, int indType,
                                                         void *pRsp)
 {
     hdd_adapter_t *pAdapter = NULL;
@@ -6083,7 +6169,7 @@ static void wlan_hdd_cfg80211_link_layer_stats_callback(void *ctx,
     case SIR_HAL_LL_STATS_RESULTS_RSP:
         {
             hddLog(VOS_TRACE_LEVEL_INFO,
-                 "LL_STATS RESP paramID = 0x%x, ifaceId = %u respId = %u, moreResultToFollow = %u, num radio = %u result = %p",
+                 "LL_STATS RESP paramID = 0x%x, ifaceId = %u respId = %u, moreResultToFollow = %u, num radio = %u result = %pK",
                  linkLayerStatsResults->paramId, linkLayerStatsResults->ifaceId,
                  linkLayerStatsResults->rspId,
                  linkLayerStatsResults->moreResultToFollow,
@@ -6172,13 +6258,1132 @@ static void wlan_hdd_cfg80211_link_layer_stats_callback(void *ctx,
     return;
 }
 
+static const struct nla_policy
+qca_wlan_vendor_ll_ext_policy[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_MAX + 1] = {
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_PERIOD] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_GLOBAL] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_THRESHOLD] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BITMAP] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BITMAP] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CCA_BSS_BITMAP] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_SIGNAL_BITMAP] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MSDU] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MPDU] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_PPDU] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BYTES] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP_BYTES] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_RETRY] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_ACK] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_BACK] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_AGGR] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_SUCC_MCS] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_FAIL_MCS] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DELAY] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_BYTES] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU_BYTES] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_LOST] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_RETRY] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DUP] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DISCARD] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MCS] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_AGGR] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_TIMES] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_DURATION] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PROBE_REQ] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MGMT] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IDLE_TIME] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_TIME] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BUSY] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BAD] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BAD] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_NO_AVAIL] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IN_BSS_TIME] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_OUT_BSS_TIME] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_SNR] = {
+		.type = NLA_U32
+	},
+	[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_NF] = {
+		.type = NLA_U32
+	},
+};
 
-void wlan_hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx)
+/**
+ * __wlan_hdd_cfg80211_ll_stats_ext_set_param - config monitor parameters
+ * @wiphy: wiphy handle
+ * @wdev: wdev handle
+ * @data: user layer input
+ * @data_len: length of user layer input
+ *
+ * This function is called in SSR protected environment.
+ *
+ * Return: 0 Success, EINVAL failure
+ */
+static int __wlan_hdd_cfg80211_ll_stats_ext_set_param(struct wiphy *wiphy,
+						      struct wireless_dev *wdev,
+						      const void *data,
+						      int data_len)
 {
-    sme_SetLinkLayerStatsIndCB(pHddCtx->hHal,
-                                 wlan_hdd_cfg80211_link_layer_stats_callback);
+	int status;
+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_MAX + 1];
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct sir_ll_ext_stats_threshold thresh = {0,};
+
+	if (VOS_FTM_MODE == hdd_get_conparam()) {
+		hddLog(LOGE, FL("Command not allowed in FTM mode"));
+		return -EINVAL;
+	}
+
+	ENTER();
+
+	status = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != status)
+		return -EINVAL;
+
+	hddLog(VOS_TRACE_LEVEL_INFO_LOW,
+	       FL("Get user layer settings for LL stat. Length is %d bytes"),
+	       data_len);
+	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_MAX,
+		      (struct nlattr *)data, data_len,
+		      qca_wlan_vendor_ll_ext_policy)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("maximum attribute not present"));
+		return -EINVAL;
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_PERIOD]) {
+		thresh.period = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_PERIOD]);
+
+		if (thresh.period != 0 && thresh.period < LL_STATS_MIN_PERIOD)
+			thresh.period = LL_STATS_MIN_PERIOD;
+
+		if (thresh.period > LL_STATS_MAX_PERIOD)
+			thresh.period = LL_STATS_MAX_PERIOD;
+	} else {
+		thresh.period = LL_STATS_INVALID_PERIOD;
+		hddLog(VOS_TRACE_LEVEL_INFO,
+		       FL("No MAC counter period parameter"));
+	}
+
+	/* period==0. Just disable mac counter */
+	if (thresh.period == 0) {
+		hddLog(VOS_TRACE_LEVEL_INFO,
+		       FL("Mac counter will be disaabled"));
+		goto set_param;
+	}
+
+	/* global thresh is not enabled */
+	if (!tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_THRESHOLD]) {
+		thresh.global = false;
+		hddLog(VOS_TRACE_LEVEL_WARN, FL("Global thresh is not set"));
+	} else {
+		thresh.global_threshold = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_CFG_THRESHOLD]);
+		thresh.global = true;
+		hddLog(VOS_TRACE_LEVEL_INFO_LOW, FL("thresh is %d"),
+		       thresh.global_threshold);
+	}
+
+	if (!tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_GLOBAL]) {
+		thresh.global = false;
+		hddLog(VOS_TRACE_LEVEL_WARN, FL("Global thresh is not set"));
+	} else {
+		thresh.global = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_GLOBAL]);
+		hddLog(VOS_TRACE_LEVEL_INFO_LOW, FL("Global is %d"),
+		       thresh.global);
+	}
+
+	thresh.enable_bitmap = false;
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BITMAP]) {
+		thresh.tx_bitmap = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BITMAP]);
+		thresh.enable_bitmap = true;
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BITMAP]) {
+		thresh.rx_bitmap = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BITMAP]);
+		thresh.enable_bitmap = true;
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CCA_BSS_BITMAP]) {
+		thresh.cca_bitmap = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CCA_BSS_BITMAP]);
+		thresh.enable_bitmap = true;
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_SIGNAL_BITMAP]) {
+		thresh.signal_bitmap = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_SIGNAL_BITMAP]);
+		thresh.enable_bitmap = true;
+	}
+
+	if (!thresh.global && !thresh.enable_bitmap) {
+		hddLog(VOS_TRACE_LEVEL_WARN, FL("No thresh exits."));
+		thresh.enable = false;
+	} else {
+		thresh.enable = true;
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MSDU]) {
+		thresh.tx.msdu = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MSDU]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MPDU]) {
+		thresh.tx.mpdu = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MPDU]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_PPDU]) {
+		thresh.tx.ppdu = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_PPDU]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BYTES]) {
+		thresh.tx.bytes = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BYTES]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP]) {
+		thresh.tx.msdu_drop = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP_BYTES]) {
+		thresh.tx.byte_drop = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP_BYTES]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_RETRY]) {
+		thresh.tx.mpdu_retry = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_RETRY]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_ACK]) {
+		thresh.tx.mpdu_fail = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_ACK]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_BACK]) {
+		thresh.tx.ppdu_fail = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_BACK]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_AGGR]) {
+		thresh.tx.aggregation = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_AGGR]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_SUCC_MCS]) {
+		thresh.tx.succ_mcs = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_SUCC_MCS]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_FAIL_MCS]) {
+		thresh.tx.fail_mcs = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_FAIL_MCS]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DELAY]) {
+		thresh.tx.delay = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DELAY]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU]) {
+		thresh.rx.mpdu = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_BYTES]) {
+		thresh.rx.bytes = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_BYTES]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU]) {
+		thresh.rx.ppdu = nla_get_u32(tb[
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU_BYTES]) {
+		thresh.rx.ppdu_bytes = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU_BYTES]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_LOST]) {
+		thresh.rx.mpdu_lost = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_LOST]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_RETRY]) {
+		thresh.rx.mpdu_retry = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_RETRY]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DUP]) {
+		thresh.rx.mpdu_dup = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DUP]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DISCARD]) {
+		thresh.rx.mpdu_discard = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DISCARD]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_AGGR]) {
+		thresh.rx.aggregation = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_AGGR]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MCS]) {
+		thresh.rx.mcs = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MCS]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_TIMES]) {
+		thresh.rx.ps_inds = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_TIMES]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_DURATION]) {
+		thresh.rx.ps_durs = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_DURATION]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PROBE_REQ]) {
+		thresh.rx.probe_reqs = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PROBE_REQ]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MGMT]) {
+		thresh.rx.other_mgmt = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MGMT]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IDLE_TIME]) {
+		thresh.cca.idle_time = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IDLE_TIME]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_TIME]) {
+		thresh.cca.tx_time = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_TIME]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IN_BSS_TIME]) {
+		thresh.cca.rx_in_bss_time = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IN_BSS_TIME]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_OUT_BSS_TIME]) {
+		thresh.cca.rx_out_bss_time = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_OUT_BSS_TIME]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BUSY]) {
+		thresh.cca.rx_busy_time = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BUSY]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BAD]) {
+		thresh.cca.rx_in_bad_cond_time = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BAD]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BAD]) {
+		thresh.cca.tx_in_bad_cond_time = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BAD]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_NO_AVAIL]) {
+		thresh.cca.wlan_not_avail_time = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_NO_AVAIL]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_SNR]) {
+		thresh.signal.snr = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_SNR]);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_NF]) {
+		thresh.signal.nf = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_NF]);
+	}
+
+set_param:
+	hddLog(VOS_TRACE_LEVEL_INFO_LOW, FL("Send thresh settings to target"));
+	if (eHAL_STATUS_SUCCESS != sme_ll_stats_set_thresh(hdd_ctx->hHal,
+							   &thresh)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("sme_ll_stats_set_thresh failed."));
+		return -EINVAL;
+	}
+	EXIT();
+	return 0;
+}
+
+/**
+ * __wlan_hdd_cfg80211_ll_stats_ext_set_param - config monitor parameters
+ * @wiphy: wiphy handle
+ * @wdev: wdev handle
+ * @data: user layer input
+ * @data_len: length of user layer input
+ *
+ * Return: 0 Success, EINVAL failure
+ */
+int wlan_hdd_cfg80211_ll_stats_ext_set_param(struct wiphy *wiphy,
+					     struct wireless_dev *wdev,
+					     const void *data,
+					     int data_len)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __wlan_hdd_cfg80211_ll_stats_ext_set_param(wiphy, wdev,
+							 data, data_len);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+/**
+ * put_per_peer_ps_info() - put per peer sta's PS info into nl80211 msg
+ * @wifi_peer_info: peer information
+ * @vendor_event: buffer for vendor event
+ *
+ * Return: 0 success
+ */
+static int put_per_peer_ps_info(tSirWifiPeerInfo *wifi_peer_info,
+				struct sk_buff *vendor_event)
+{
+	if (!wifi_peer_info) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("Invalid pointer to peer info."));
+		return -EINVAL;
+	}
+
+	if (nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_STATE,
+			wifi_peer_info->power_saving) ||
+	    nla_put(vendor_event,
+		    QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_MAC_ADDRESS,
+		    VOS_MAC_ADDR_SIZE, wifi_peer_info->peerMacAddress)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("QCA_WLAN_VENDOR_ATTR put fail"));
+		return -EINVAL;
+	}
+	return 0;
+}
+
+/**
+ * put_wifi_peer_ps_info() - Put peer sta's power state into nl80211 msg
+ * @data - stats for peer STA
+ * @vendor_event - buffer for vendor event
+ *
+ * Return: 0 success
+ */
+static int put_wifi_peer_ps_info(tSirWifiPeerStat *data,
+				 struct sk_buff *vendor_event)
+{
+	uint32_t peer_num, i;
+	tSirWifiPeerInfo *wifi_peer_info;
+	struct nlattr *peer_info, *peers;
+
+	if (!data) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("Invalid pointer to Wifi peer stat."));
+		return -EINVAL;
+	}
+
+	peer_num = data->numPeers;
+
+	if (peer_num == 0) {
+		hddLog(VOS_TRACE_LEVEL_ERROR, FL("Peer number is zero."));
+		return -EINVAL;
+	}
+
+	if (nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_NUM,
+			peer_num)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("QCA_WLAN_VENDOR_ATTR put fail"));
+		return -EINVAL;
+	}
+
+	peers = nla_nest_start(vendor_event,
+			       QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_CHG);
+	if (peers == NULL) {
+		hddLog(LOGE, FL("nla_nest_start failed"));
+		return -EINVAL;
+	}
+
+	for (i = 0; i < peer_num; i++) {
+		wifi_peer_info = &data->peerInfo[i];
+		peer_info = nla_nest_start(vendor_event, i);
+
+		if (peer_info == NULL) {
+			hddLog(LOGE, FL("nla_nest_start failed"));
+			return -EINVAL;
+		}
+
+		if (put_per_peer_ps_info(wifi_peer_info, vendor_event))
+			return -EINVAL;
+
+		nla_nest_end(vendor_event, peer_info);
+	}
+	nla_nest_end(vendor_event, peers);
+
+	return 0;
 }
 
+/**
+ * put_tx_failure_info() - Put TX failure info
+ * @tx_fail - TX failure info
+ * @skb - buffer for vendor event
+ *
+ * Return: 0 Success
+ */
+static inline int put_tx_failure_info(struct sir_wifi_iface_tx_fail *tx_fail,
+				      struct sk_buff *skb)
+{
+	int status = 0;
+
+	if (!tx_fail || !skb)
+		return -EINVAL;
+
+	if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TID,
+			tx_fail->tid) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_NUM_MSDU,
+			tx_fail->msdu_num) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_STATUS,
+			tx_fail->status)) {
+		hddLog(LOGE, FL("QCA_WLAN_VENDOR_ATTR put fail"));
+		status = -EINVAL;
+	}
+	return status;
+}
+
+/**
+ * put_wifi_channel_cca_info() - put channel cca info to vendor event
+ * @info: cca info array for all channels
+ * @vendor_event: vendor event buffer
+ *
+ * Return: 0 Success, EINVAL failure
+ */
+static int put_wifi_channel_cca_info(struct sir_wifi_chan_cca_stats *cca,
+				     struct sk_buff *vendor_event)
+{
+	/* There might be no CCA info for a channel */
+	if (cca == NULL)
+		return 0;
+
+	if (nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IDLE_TIME,
+			cca->idle_time) ||
+	    nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_TIME,
+			cca->tx_time) ||
+	    nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IN_BSS_TIME,
+			cca->rx_in_bss_time) ||
+	    nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_OUT_BSS_TIME,
+			cca->rx_out_bss_time) ||
+	    nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BUSY,
+			cca->rx_busy_time) ||
+	    nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BAD,
+			cca->rx_in_bad_cond_time) ||
+	    nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BAD,
+			cca->tx_in_bad_cond_time) ||
+	    nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_NO_AVAIL,
+			cca->wlan_not_avail_time) ||
+	    nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IFACE_ID,
+			cca->vdev_id)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("QCA_WLAN_VENDOR_ATTR put fail"));
+		return -EINVAL;
+	}
+	return 0;
+}
+
+/**
+ * put_wifi_signal_info - put chain signal info
+ * @info: RF chain signal info
+ * @skb: vendor event buffer
+ *
+ * Return: 0 Success, EINVAL failure
+ */
+static int put_wifi_signal_info(struct sir_wifi_peer_signal_stats *peer_signal,
+				struct sk_buff *skb)
+{
+	uint32_t i, chain_count;
+	struct nlattr *chains, *att;
+
+	/* There might be no signal info for a peer */
+	if (peer_signal == NULL)
+		return 0;
+
+	chain_count = peer_signal->num_chain < WIFI_MAX_CHAINS ?
+		      peer_signal->num_chain : WIFI_MAX_CHAINS;
+	if (nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_ANT_NUM,
+			chain_count)) {
+		hddLog(LOGE, FL("QCA_WLAN_VENDOR_ATTR put fail"));
+		return -EINVAL;
+	}
+
+	att = nla_nest_start(skb,
+			     QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_SIGNAL);
+	if (att == NULL) {
+		hddLog(LOGE, FL("nla_nest_start failed"));
+		return -EINVAL;
+	}
+
+	for (i = 0; i < chain_count; i++) {
+		chains = nla_nest_start(skb, i);
+
+		if (chains == NULL) {
+			hddLog(LOGE, FL("nla_nest_start failed"));
+			return -EINVAL;
+		}
+
+		hddLog(LOG2,
+		       FL("SNR=%d, NF=%d, RX=%d, TX=%d"),
+		       peer_signal->per_ant_snr[i],
+		       peer_signal->nf[i],
+		       peer_signal->per_ant_rx_mpdus[i],
+		       peer_signal->per_ant_tx_mpdus[i]);
+		if (nla_put_u32(skb,
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_SNR,
+				peer_signal->per_ant_snr[i]) ||
+		    nla_put_u32(skb,
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_ANT_NF,
+				peer_signal->nf[i]) ||
+		    nla_put_u32(skb,
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU,
+				peer_signal->per_ant_rx_mpdus[i]) ||
+		    nla_put_u32(skb,
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MPDU,
+				peer_signal->per_ant_tx_mpdus[i])) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+			       FL("QCA_WLAN_VENDOR_ATTR put fail"));
+			return -EINVAL;
+		}
+		nla_nest_end(skb, chains);
+	}
+	nla_nest_end(skb, att);
+
+	return 0;
+}
+
+/**
+ * put_wifi_wmm_ac_tx_info() - put AC TX info
+ * @info: tx info
+ * @skb: vendor event buffer
+ *
+ * Return: 0 Success, EINVAL failure
+ */
+static int put_wifi_wmm_ac_tx_info(struct sir_wifi_tx *tx_stats,
+				   struct sk_buff *skb)
+{
+	uint32_t *agg_size, *succ_mcs, *fail_mcs, *delay;
+
+	/* There might be no TX info for a peer */
+	if (tx_stats == NULL)
+		return 0;
+
+	agg_size = tx_stats->mpdu_aggr_size;
+	succ_mcs = tx_stats->success_mcs;
+	fail_mcs = tx_stats->fail_mcs;
+	delay = tx_stats->delay;
+
+	if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MSDU,
+			tx_stats->msdus) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_MPDU,
+			tx_stats->mpdus) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_PPDU,
+			tx_stats->ppdus) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BYTES,
+			tx_stats->bytes) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP,
+			tx_stats->drops) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DROP_BYTES,
+			tx_stats->drop_bytes) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_RETRY,
+			tx_stats->retries) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_NO_ACK,
+			tx_stats->failed) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_AGGR_NUM,
+			tx_stats->aggr_len) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_SUCC_MCS_NUM,
+			tx_stats->success_mcs_len) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_FAIL_MCS_NUM,
+			tx_stats->fail_mcs_len) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_DELAY_ARRAY_SIZE,
+			tx_stats->delay_len))
+		goto put_attr_fail;
+
+	if (agg_size) {
+		if (nla_put(skb,
+			    QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_AGGR,
+			    tx_stats->aggr_len, agg_size))
+			goto put_attr_fail;
+	}
+
+	if (succ_mcs) {
+		if (nla_put(skb,
+			    QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_SUCC_MCS,
+			    tx_stats->success_mcs_len, succ_mcs))
+			goto put_attr_fail;
+	}
+
+	if (fail_mcs) {
+		if (nla_put(skb,
+			    QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_FAIL_MCS,
+			    tx_stats->fail_mcs_len, fail_mcs))
+			goto put_attr_fail;
+	}
+
+	if (delay) {
+		if (nla_put(skb,
+			    QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_DELAY,
+			    tx_stats->delay_len, delay))
+			goto put_attr_fail;
+	}
+	return 0;
+
+put_attr_fail:
+	hddLog(VOS_TRACE_LEVEL_ERROR,
+	       FL("QCA_WLAN_VENDOR_ATTR put fail"));
+	return -EINVAL;
+}
+
+/**
+ * put_wifi_wmm_ac_rx_info() - put AC RX info
+ * @info: rx info
+ * @skb: vendor event buffer
+ *
+ * Return: 0 Success, EINVAL failure
+ */
+static int put_wifi_wmm_ac_rx_info(struct sir_wifi_rx *rx_stats,
+				   struct sk_buff *skb)
+{
+	uint32_t *mcs, *aggr;
+
+	/* There might be no RX info for a peer */
+	if (rx_stats == NULL)
+		return 0;
+
+	aggr = rx_stats->mpdu_aggr;
+	mcs = rx_stats->mcs;
+
+	if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU,
+			rx_stats->mpdus) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_BYTES,
+			rx_stats->bytes) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU,
+			rx_stats->ppdus) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PPDU_BYTES,
+			rx_stats->ppdu_bytes) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_LOST,
+			rx_stats->mpdu_lost) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_RETRY,
+			rx_stats->mpdu_retry) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DUP,
+			rx_stats->mpdu_dup) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MPDU_DISCARD,
+			rx_stats->mpdu_discard) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_AGGR_NUM,
+			rx_stats->aggr_len) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MCS_NUM,
+			rx_stats->mcs_len))
+		goto put_attr_fail;
+
+	if (aggr) {
+		if (nla_put(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_AGGR,
+			    rx_stats->aggr_len, aggr))
+			goto put_attr_fail;
+	}
+
+	if (mcs) {
+		if (nla_put(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MCS,
+			    rx_stats->mcs_len, mcs))
+			goto put_attr_fail;
+	}
+
+	return 0;
+
+put_attr_fail:
+	hddLog(VOS_TRACE_LEVEL_ERROR, FL("QCA_WLAN_VENDOR_ATTR put fail"));
+	return -EINVAL;
+}
+
+/**
+ * put_wifi_wmm_ac_info() - put WMM AC info
+ * @info: per AC stats
+ * @skb: vendor event buffer
+ *
+ * Return: 0 Success, EINVAL failure
+ */
+static int put_wifi_wmm_ac_info(struct sir_wifi_ll_ext_wmm_ac_stats *ac_stats,
+				struct sk_buff *skb)
+{
+	struct nlattr *wmm;
+
+	wmm = nla_nest_start(skb, ac_stats->type);
+	if (wmm == NULL)
+		goto nest_start_fail;
+
+	if (put_wifi_wmm_ac_tx_info(ac_stats->tx_stats, skb) ||
+	    put_wifi_wmm_ac_rx_info(ac_stats->rx_stats, skb))
+		goto put_attr_fail;
+
+	nla_nest_end(skb, wmm);
+	return 0;
+
+nest_start_fail:
+	hddLog(LOGE, FL("nla_nest_start failed"));
+	return -EINVAL;
+
+put_attr_fail:
+	hddLog(VOS_TRACE_LEVEL_ERROR, FL("QCA_WLAN_VENDOR_ATTR put fail"));
+	return -EINVAL;
+}
+
+/**
+ * put_wifi_ll_ext_peer_info() - put per peer info
+ * @info: peer stats
+ * @skb: vendor event buffer
+ *
+ * Return: 0 Success, EINVAL failure
+ */
+static int put_wifi_ll_ext_peer_info(struct sir_wifi_ll_ext_peer_stats *peers,
+				     struct sk_buff *skb)
+{
+	uint32_t i;
+	struct nlattr *wmm_ac;
+
+	if (nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_ID,
+			peers->peer_id) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_IFACE_ID,
+			peers->vdev_id) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_TIMES,
+			peers->sta_ps_inds) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_PS_DURATION,
+			peers->sta_ps_durs) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_PROBE_REQ,
+			peers->rx_probe_reqs) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_MGMT,
+			peers->rx_oth_mgmts) ||
+	    nla_put(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_MAC_ADDRESS,
+		    VOS_MAC_ADDR_SIZE, peers->mac_address) ||
+	    put_wifi_signal_info(&peers->peer_signal_stats, skb)) {
+		hddLog(LOGE, FL("put peer signal attr failed"));
+		return -EINVAL;
+	}
+
+	wmm_ac = nla_nest_start(skb,
+				QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_STATUS);
+	if (wmm_ac == NULL) {
+		hddLog(LOGE, FL("nla_nest_start failed"));
+		return -EINVAL;
+	}
+
+	for (i = 0; i < WLAN_MAX_AC; i++) {
+		if (put_wifi_wmm_ac_info(&peers->ac_stats[i], skb)) {
+			hddLog(LOGE, FL("put WMM AC attr failed"));
+			return -EINVAL;
+		}
+	}
+
+	nla_nest_end(skb, wmm_ac);
+	return 0;
+}
+
+/**
+ * put_wifi_ll_ext_stats() - put link layer extension stats
+ * @info: link layer stats
+ * @skb: vendor event buffer
+ *
+ * Return: 0 Success, EINVAL failure
+ */
+static int put_wifi_ll_ext_stats(struct sir_wifi_ll_ext_stats *stats,
+				 struct sk_buff *skb)
+{
+	uint32_t i;
+	struct nlattr *peer, *peer_info, *channels, *channel_info;
+	struct sir_wifi_ll_ext_period *period;
+
+	period = &stats->time_stamp;
+	if (nla_put_u64(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_REPORT_TIME,
+			period->end_time) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_MEASUREMENT_TIME,
+			period->duration) ||
+	    nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_EVENT_MODE,
+			stats->trigger_cond_id) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CCA_BSS_BITMAP,
+			stats->cca_chgd_bitmap) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_SIGNAL_BITMAP,
+			stats->sig_chgd_bitmap) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_TX_BITMAP,
+			stats->tx_chgd_bitmap) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_RX_BITMAP,
+			stats->rx_chgd_bitmap) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CHANNEL_NUM,
+			stats->channel_num) ||
+	    nla_put_u32(skb,
+			QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER_NUM,
+			stats->peer_num)) {
+		goto put_attr_fail;
+	}
+
+	channels = nla_nest_start(skb,
+				  QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_CCA_BSS);
+	if (channels == NULL) {
+		hddLog(LOGE, FL("nla_nest_start failed"));
+		return -EINVAL;
+	}
+
+	for (i = 0; i < stats->channel_num; i++) {
+		channel_info = nla_nest_start(skb, i);
+		if (channel_info == NULL) {
+			hddLog(LOGE, FL("nla_nest_start failed"));
+			return -EINVAL;
+		}
+
+		if (put_wifi_channel_cca_info(&stats->cca[i], skb))
+			goto put_attr_fail;
+		nla_nest_end(skb, channel_info);
+	}
+	nla_nest_end(skb, channels);
+
+	peer_info = nla_nest_start(skb,
+				   QCA_WLAN_VENDOR_ATTR_LL_STATS_EXT_PEER);
+	if (peer_info == NULL) {
+		hddLog(LOGE, FL("nla_nest_start failed"));
+		return -EINVAL;
+	}
+
+	for (i = 0; i < stats->peer_num; i++) {
+		peer = nla_nest_start(skb, i);
+		if (peer == NULL) {
+			hddLog(LOGE, FL("nla_nest_start failed"));
+			return -EINVAL;
+		}
+
+		if (put_wifi_ll_ext_peer_info(&stats->peer_stats[i], skb))
+			goto put_attr_fail;
+		nla_nest_end(skb, peer);
+	}
+
+	nla_nest_end(skb, peer_info);
+	return 0;
+
+put_attr_fail:
+	hddLog(VOS_TRACE_LEVEL_ERROR, FL("QCA_WLAN_VENDOR_ATTR put fail"));
+	return -EINVAL;
+}
+
+/**
+ * wlan_hdd_cfg80211_ll_stats_ext_callback() - LL stats callback
+ * @rsp - msg from FW
+ *
+ * An extension of wlan_hdd_cfg80211_link_layer_stats_callback.
+ * It converts monitoring parameters offloaded to NL data and send the same
+ * to the kerbel/upper layer.
+ */
+static void wlan_hdd_cfg80211_ll_stats_ext_callback(tSirLLStatsResults *rsp)
+{
+	hdd_context_t *hdd_ctx;
+	struct sk_buff *skb;
+	int flags = vos_get_gfp_flags();
+	uint32_t param_id, index;
+	hdd_adapter_t *adapter;
+	tSirWifiPeerStat *peer_stats;
+	uint8_t *results;
+	int status, len;
+	v_CONTEXT_t vos_context = vos_get_global_context(0, NULL);
+
+	ENTER();
+
+	if (!rsp) {
+		hddLog(VOS_TRACE_LEVEL_ERROR, FL("Invalid result."));
+		return;
+	}
+
+	hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_context);
+	status = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != status)
+		return;
+
+	adapter = hdd_get_adapter_by_vdev(hdd_ctx, rsp->ifaceId);
+	if (NULL == adapter) {
+		hddLog(LOGE, FL("vdev_id %d does not exist with host"),
+		       rsp->ifaceId);
+		return;
+	}
+
+	index = QCA_NL80211_VENDOR_SUBCMD_LL_STATS_EXT_INDEX;
+	len = LL_STATS_EVENT_BUF_SIZE + NLMSG_HDRLEN;
+	skb = cfg80211_vendor_event_alloc(hdd_ctx->wiphy, NULL, len,
+					  index, flags);
+	if (!skb) {
+		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
+		return;
+	}
+
+	results = rsp->results;
+	param_id = rsp->paramId;
+	hddLog(LOG1,
+	       FL("LL_STATS RESP paramID = 0x%x, ifaceId = %u, result = %pK"),
+	       rsp->paramId, rsp->ifaceId, rsp->results);
+	if (param_id & WMI_LL_STATS_EXT_PS_CHG) {
+		peer_stats = (tSirWifiPeerStat *)results;
+		status = put_wifi_peer_ps_info(peer_stats, skb);
+	} else if (param_id & WMI_LL_STATS_EXT_TX_FAIL) {
+		struct sir_wifi_iface_tx_fail *tx_fail;
+
+		tx_fail = (struct sir_wifi_iface_tx_fail *)results;
+		status = put_tx_failure_info(tx_fail, skb);
+	} else if (param_id & WMI_LL_STATS_EXT_MAC_COUNTER) {
+		hddLog(LOGE, FL("MAC counters stats"));
+		status = put_wifi_ll_ext_stats((struct sir_wifi_ll_ext_stats *)
+					       rsp->results, skb);
+	} else {
+		hddLog(LOGE, FL("Unknown link layer stats"));
+		status = -1;
+	}
+
+	if (status == 0)
+		cfg80211_vendor_event(skb, flags);
+	else
+		kfree_skb(skb);
+	EXIT();
+}
+
+void wlan_hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx)
+{
+        sme_SetLinkLayerStatsIndCB(pHddCtx->hHal,
+                                   wlan_hdd_cfg80211_link_layer_stats_callback);
+        sme_set_ll_ext_cb(pHddCtx->hHal,
+                          wlan_hdd_cfg80211_ll_stats_ext_callback);
+}
 
 const struct
 nla_policy
@@ -6330,7 +7535,7 @@ static int __wlan_hdd_cfg80211_ll_stats_get(struct wiphy *wiphy,
         return -EINVAL;
     }
 
-    ENTER();
+    /* ENTER() intentionally not used in a frequently invoked API */
 
     status = wlan_hdd_validate_context(pHddCtx);
     if (0 != status)
@@ -6379,12 +7584,6 @@ static int __wlan_hdd_cfg80211_ll_stats_get(struct wiphy *wiphy,
 
     LinkLayerStatsGetReq.staId = pAdapter->sessionId;
 
-    hddLog(VOS_TRACE_LEVEL_INFO,
-           "LL_STATS_GET reqId = %d, StaId = %d, paramIdMask = %d",
-           LinkLayerStatsGetReq.reqId, LinkLayerStatsGetReq.staId,
-           LinkLayerStatsGetReq.paramIdMask);
-
-
     spin_lock(&hdd_context_lock);
     context = &pHddCtx->ll_stats_context;
     context->request_id = LinkLayerStatsGetReq.reqId;
@@ -6874,7 +8073,7 @@ __wlan_hdd_cfg80211_get_wifi_info(struct wiphy *wiphy,
 			goto error_nla_fail;
 	}
 
-	if (tb_vendor[QCA_WLAN_VENDOR_ATTR_WIFI_INFO_DRIVER_VERSION]) {
+	if (tb_vendor[QCA_WLAN_VENDOR_ATTR_WIFI_INFO_FIRMWARE_VERSION]) {
 		if (nla_put_string(reply_skb,
 			    QCA_WLAN_VENDOR_ATTR_WIFI_INFO_FIRMWARE_VERSION,
 			    firmware_version))
@@ -6958,8 +8157,6 @@ __wlan_hdd_cfg80211_get_logger_supp_feature(struct wiphy *wiphy,
 
 	features = 0;
 
-	if (hdd_is_memdump_supported())
-		features |= WIFI_LOGGER_MEMORY_DUMP_SUPPORTED;
 	features |= WIFI_LOGGER_PER_PACKET_TX_RX_STATUS_SUPPORTED;
 	features |= WIFI_LOGGER_CONNECT_EVENT_SUPPORTED;
 	features |= WIFI_LOGGER_WAKE_LOCK_SUPPORTED;
@@ -7008,12 +8205,312 @@ wlan_hdd_cfg80211_get_logger_supp_feature(struct wiphy *wiphy,
 	return ret;
 }
 
+
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+static const struct nla_policy qca_wlan_vendor_thermal_cmd_policy[
+		QCA_WLAN_VENDOR_ATTR_THM_CMD_MAX + 1] = {
+	[QCA_WLAN_VENDOR_ATTR_THM_CMD_VALUE] = {
+		.type = NLA_U32
+	},
+};
+
+/**
+ * wlan_hdd_thermal_cmd_get_temperature() - Fetch temperature and send it to ap
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ *
+ * This is called by thermal cmd and data is sent to user space.
+ *
+ * Return:   Return the Success or Failure code.
+ */
+
+static int
+wlan_hdd_thermal_cmd_get_temperature(struct wiphy *wiphy,
+		struct wireless_dev *wdev)
+{
+	eHalStatus status;
+	struct statsContext temp_context;
+	unsigned long rc;
+	struct sk_buff *nl_resp = 0;
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct net_device *dev = wdev->netdev;
+	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+
+	if (VOS_FTM_MODE == hdd_get_conparam()) {
+		hddLog(LOGE, FL("Command not allowed in FTM mode"));
+		return -EINVAL;
+	}
+
+	if (wlan_hdd_validate_context(hdd_ctx))
+		return -EINVAL;
+
+	/* prepare callback context and magic pattern */
+	init_completion(&temp_context.completion);
+	temp_context.pAdapter = adapter;
+	temp_context.magic = TEMP_CONTEXT_MAGIC;
+
+	status = sme_GetTemperature(WLAN_HDD_GET_HAL_CTX(adapter),
+				&temp_context, hdd_GetTemperatureCB);
+	if (eHAL_STATUS_SUCCESS != status) {
+		hddLog(VOS_TRACE_LEVEL_ERROR, FL("Unable to get temperature"));
+	} else {
+		rc = wait_for_completion_timeout(&temp_context.completion,
+				msecs_to_jiffies(1000));
+		if (!rc) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("SME timed out while getting temperature"));
+			return -EBUSY;
+		}
+	}
+
+	spin_lock(&hdd_context_lock);
+	temp_context.magic = 0;
+	spin_unlock(&hdd_context_lock);
+
+	nl_resp = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 4 + NLMSG_HDRLEN);
+	if (!nl_resp) {
+		hddLog(LOGE, FL("cfg80211_vendor_cmd_alloc_reply_skb failed"));
+		rc = -ENOMEM;
+		goto exit;
+	}
+
+	rc = nla_put_u32(nl_resp, QCA_WLAN_VENDOR_ATTR_GET_TEMP_RSP_TEMPERATURE,
+			 adapter->temperature);
+	if (rc) {
+		kfree_skb(nl_resp);
+		goto exit;
+	}
+
+	rc = cfg80211_vendor_cmd_reply(nl_resp);
+	if (rc) {
+		hddLog(LOGE, FL("cfg80211_vendor_cmd_reply failed: %ld"), rc);
+		goto exit;
+	}
+exit:
+	return rc;
+}
+
+/**
+ * wlan_hdd_thermal_cmd_get_params() - Get thermal parameters and send them
+ * to app
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ *
+ * This is called by thermal cmd and data is sent to user space.
+ *
+ * Return:   Return the Success or Failure code.
+ */
+
+static int
+wlan_hdd_thermal_cmd_get_params(struct wiphy *wiphy)
+{
+	int rc;
+	struct sk_buff *nl_resp = 0;
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	uint32_t nl_buf_len;
+
+	if (VOS_FTM_MODE == hdd_get_conparam()) {
+		hddLog(LOGE, FL("Command not allowed in FTM mode"));
+		return -EINVAL;
+	}
+
+	if (wlan_hdd_validate_context(hdd_ctx))
+		return -EINVAL;
+
+	nl_buf_len = NLMSG_HDRLEN;
+	nl_buf_len += (sizeof(hdd_ctx->cfg_ini->thermal_shutdown_enabled)
+		+ NLA_HDRLEN) + (sizeof(hdd_ctx->cfg_ini->thermal_shutdown_auto_enabled)
+		+ NLA_HDRLEN) + (sizeof(hdd_ctx->cfg_ini->thermal_resume_threshold)
+		+ NLA_HDRLEN) + (sizeof(hdd_ctx->cfg_ini->thermal_warning_threshold)
+		+ NLA_HDRLEN) + (sizeof(hdd_ctx->cfg_ini->thermal_suspend_threshold)
+		+ NLA_HDRLEN) + (sizeof(hdd_ctx->cfg_ini->thermal_sample_rate)
+		+ NLA_HDRLEN);
+
+	nl_resp = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, nl_buf_len);
+	if (!nl_resp) {
+		hddLog(LOGE, FL("cfg80211_vendor_cmd_alloc_reply_skb failed"));
+		rc = -ENOMEM;
+		goto exit;
+	}
+
+	nla_put_u8(nl_resp, QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SHUTDOWN_EN,
+		hdd_ctx->cfg_ini->thermal_shutdown_enabled);
+	nla_put_u8(nl_resp,
+		QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SHUTDOWN_AUTO_EN,
+		hdd_ctx->cfg_ini->thermal_shutdown_auto_enabled);
+	nla_put_u16(nl_resp, QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_RESUME_THRESH,
+		    hdd_ctx->cfg_ini->thermal_resume_threshold);
+	nla_put_u16(nl_resp, QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_WARNING_THRESH,
+		    hdd_ctx->cfg_ini->thermal_warning_threshold);
+	nla_put_u16(nl_resp, QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SUSPEND_THRESH,
+		    hdd_ctx->cfg_ini->thermal_suspend_threshold);
+	nla_put_u16(nl_resp, QCA_WLAN_VENDOR_ATTR_GET_THM_PARAMS_RSP_SAMPLE_RATE,
+		    hdd_ctx->cfg_ini->thermal_sample_rate);
+
+	rc = cfg80211_vendor_cmd_reply(nl_resp);
+	if (rc) {
+		hddLog(LOGE, FL("cfg80211_vendor_cmd_reply failed: %d"), rc);
+		goto exit;
+	}
+exit:
+	return rc;
+}
+
+/**
+ * wlan_hdd_thermal_cmd_suspend() - Execute the suspend command
+ *
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ *
+ * This is called by thermal cmd.
+ *
+ * Return:   Return the Success or Failure code.
+ */
+static int wlan_hdd_thermal_cmd_suspend(struct wiphy *wiphy)
+{
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+
+	if (!hdd_ctx->cfg_ini->thermal_shutdown_enabled)
+		return -ENOSYS;
+
+	if (hdd_ctx->cfg_ini->thermal_shutdown_auto_enabled)
+		return -EINVAL;
+
+	if (hdd_thermal_suspend_state(hdd_ctx) == HDD_WLAN_THERMAL_ACTIVE)
+		if (hdd_thermal_suspend_queue_work(hdd_ctx, 0))
+			return 0;
+
+	return -EBUSY;
+}
+
+/**
+ * wlan_hdd_thermal_cmd_resume() - Execute the resume command
+ *
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ *
+ * This is called by thermal cmd.
+ *
+ * Return:   Return the Success or Failure code.
+ */
+static int wlan_hdd_thermal_cmd_resume(struct wiphy *wiphy)
+{
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+
+	if (!hdd_ctx->cfg_ini->thermal_shutdown_enabled)
+		return -ENOSYS;
+
+	if (hdd_ctx->cfg_ini->thermal_shutdown_auto_enabled)
+		return -EINVAL;
+
+	if (hdd_thermal_suspend_state(hdd_ctx) == HDD_WLAN_THERMAL_ACTIVE)
+		if (hdd_thermal_suspend_queue_work(hdd_ctx, 0))
+			return 0;
+
+	return -EBUSY;
+}
+
+/**
+ * __wlan_hdd_cfg80211_thermal_cmd() - Parse the thermal command from user space
+ * and call the function according to different commands.
+ *
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ * @data:    Pointer to the Key data
+ * @data_len:Length of the data passed
+ *
+ * This is called when the wlan_ts tool execute commands.
+ *
+ * Return:   Return the Success or Failure code.
+ */
+static int
+__wlan_hdd_cfg80211_thermal_cmd(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data, int data_len)
+{
+	int ret;
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_THM_CMD_MAX + 1];
+	uint32_t ts_cmd;
+
+	if (VOS_FTM_MODE == hdd_get_conparam()) {
+		hddLog(LOGE, FL("Command not allowed in FTM mode"));
+		return -EINVAL;
+	}
+
+	if (wlan_hdd_validate_context(hdd_ctx))
+		return -EINVAL;
+
+	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_THM_CMD_VALUE,
+			data, data_len,
+			qca_wlan_vendor_thermal_cmd_policy)) {
+		hddLog(LOGE, FL("Invalid ATTR"));
+		return -EINVAL;
+	}
+
+	if (!tb[QCA_WLAN_VENDOR_ATTR_THM_CMD_VALUE]) {
+		hddLog(LOGE, FL("attr thermal cmd failed"));
+		return -EINVAL;
+	}
+	ts_cmd = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_THM_CMD_VALUE]);
+
+	switch(ts_cmd) {
+		case WLAN_TS_CMD_GET_PARAMS:
+			ret = wlan_hdd_thermal_cmd_get_params(wiphy);
+		break;
+		case WLAN_TS_CMD_GET_TEMP:
+			ret = wlan_hdd_thermal_cmd_get_temperature(wiphy, wdev);
+		break;
+		case WLAN_TS_CMD_SUSPEND:
+			ret = wlan_hdd_thermal_cmd_suspend(wiphy);
+		break;
+		case WLAN_TS_CMD_RESUME:
+			ret = wlan_hdd_thermal_cmd_resume(wiphy);
+		break;
+		default:
+			ret = -EINVAL;
+		break;
+	}
+	return ret;
+}
+
+/**
+ * wlan_hdd_cfg80211_thermal_cmd() - Parse the thermal command from user space
+ * and call the function according to different commands.
+ *
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ * @data:    Pointer to the Key data
+ * @data_len:Length of the data passed
+ *
+ * This is called when the wlan_ts tool execute commands.
+ *
+ * Return:   Return the Success or Failure code.
+ */
+
+static int
+wlan_hdd_cfg80211_thermal_cmd(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data, int data_len)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __wlan_hdd_cfg80211_thermal_cmd(wiphy, wdev, data, data_len);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+#endif /* FEATURE_WLAN_THERMAL_SHUTDOWN */
+
 #ifdef FEATURE_WLAN_TDLS
 /* EXT TDLS */
 static const struct nla_policy
 wlan_hdd_tdls_config_enable_policy[QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAX +1] =
 {
-    [QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAC_ADDR] = {.type = NLA_UNSPEC },
+    [QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAC_ADDR] = {
+        .type = NLA_UNSPEC,
+        .len = HDD_MAC_ADDR_LEN},
     [QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_CHANNEL] = {.type = NLA_S32 },
     [QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_GLOBAL_OPERATING_CLASS] =
                                                        {.type = NLA_S32 },
@@ -7025,15 +8522,18 @@ wlan_hdd_tdls_config_enable_policy[QCA_WLAN_VENDOR_ATTR_TDLS_ENABLE_MAX +1] =
 static const struct nla_policy
 wlan_hdd_tdls_config_disable_policy[QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAX +1] =
 {
-    [QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAC_ADDR] = {.type = NLA_UNSPEC },
-
+    [QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAC_ADDR] = {
+        .type = NLA_UNSPEC,
+        .len = HDD_MAC_ADDR_LEN},
 };
 
 static const struct nla_policy
 wlan_hdd_tdls_config_state_change_policy[
                     QCA_WLAN_VENDOR_ATTR_TDLS_STATE_MAX +1] =
 {
-    [QCA_WLAN_VENDOR_ATTR_TDLS_STATE_MAC_ADDR] = {.type = NLA_UNSPEC },
+    [QCA_WLAN_VENDOR_ATTR_TDLS_STATE_MAC_ADDR] = {
+        .type = NLA_UNSPEC,
+        .len = HDD_MAC_ADDR_LEN},
     [QCA_WLAN_VENDOR_ATTR_TDLS_NEW_STATE] = {.type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_TDLS_STATE_REASON] = {.type = NLA_S32 },
     [QCA_WLAN_VENDOR_ATTR_TDLS_STATE_CHANNEL] = {.type = NLA_U32 },
@@ -7046,7 +8546,9 @@ static const struct nla_policy
 wlan_hdd_tdls_config_get_status_policy[
                      QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_MAX +1] =
 {
-    [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_MAC_ADDR] = {.type = NLA_UNSPEC },
+    [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_MAC_ADDR] = {
+        .type = NLA_UNSPEC,
+        .len = HDD_MAC_ADDR_LEN},
     [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_STATE] = {.type = NLA_U32 },
     [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_REASON] = {.type = NLA_S32 },
     [QCA_WLAN_VENDOR_ATTR_TDLS_GET_STATUS_CHANNEL] = {.type = NLA_U32 },
@@ -7647,6 +9149,32 @@ static int wlan_hdd_sap_cfg_dfs_override(hdd_adapter_t *adapter)
 	hdd_adapter_t *con_sap_adapter;
 	tsap_Config_t *sap_config, *con_sap_config;
 	int con_ch;
+	tHalHandle hHal;
+
+	/*
+	 * Check if STA is running in a concurrent channel
+	 */
+	hHal = WLAN_HDD_GET_HAL_CTX(adapter);
+	con_ch = sme_GetConcurrentOperationChannel(hHal);
+	sap_config = &adapter->sessionCtx.ap.sapConfig;
+
+	if (con_ch && vos_get_concurrency_mode() == VOS_STA_SAP) {
+
+		hddLog(LOG1, FL("concurrent STA role running on channel %d"),
+			con_ch);
+
+		/*
+		 * There is a STA role running on the same card, in that case
+		 * DFS channel cannot be used by concurrent SAP.
+		 * Try to use the same channel as the STA to achieve SCC
+		 */
+		if (VOS_IS_DFS_CH(sap_config->channel)) {
+			hddLog(LOG1,
+				FL("SAP channel config overridden due to DFS channel not allowed in STA+SAP mode %d -> %d"),
+				sap_config->channel, con_ch);
+			sap_config->channel = con_ch;
+		}
+	}
 
 	/*
 	 * Check if AP+AP case, once primary AP chooses a DFS
@@ -7659,7 +9187,6 @@ static int wlan_hdd_sap_cfg_dfs_override(hdd_adapter_t *adapter)
 	if (!con_sap_adapter)
 		return 0;
 
-	sap_config = &adapter->sessionCtx.ap.sapConfig;
 	con_sap_config = &con_sap_adapter->sessionCtx.ap.sapConfig;
 	con_ch = con_sap_adapter->sessionCtx.ap.operatingChannel;
 
@@ -7837,14 +9364,20 @@ static void wlan_hdd_set_acs_ch_range(tsap_Config_t *sap_cfg, bool ht_enabled,
 		sap_cfg->acs_cfg.hw_mode = eCSR_DOT11_MODE_11b;
 		sap_cfg->acs_cfg.start_ch = rfChannels[RF_CHAN_1].channelNum;
 		sap_cfg->acs_cfg.end_ch = rfChannels[RF_CHAN_14].channelNum;
+		sap_cfg->target_band = eCSR_BAND_24;
 	} else if (sap_cfg->acs_cfg.hw_mode == QCA_ACS_MODE_IEEE80211G) {
 		sap_cfg->acs_cfg.hw_mode = eCSR_DOT11_MODE_11g;
 		sap_cfg->acs_cfg.start_ch = rfChannels[RF_CHAN_1].channelNum;
 		sap_cfg->acs_cfg.end_ch = rfChannels[RF_CHAN_13].channelNum;
+		sap_cfg->target_band = eCSR_BAND_24;
 	} else if (sap_cfg->acs_cfg.hw_mode == QCA_ACS_MODE_IEEE80211A) {
 		sap_cfg->acs_cfg.hw_mode = eCSR_DOT11_MODE_11a;
 		sap_cfg->acs_cfg.start_ch = rfChannels[RF_CHAN_36].channelNum;
 		sap_cfg->acs_cfg.end_ch = rfChannels[RF_CHAN_165].channelNum;
+		sap_cfg->target_band = eCSR_BAND_5G;
+	} else {
+		hddLog(LOG1, FL("hw_mode %d"), sap_cfg->acs_cfg.hw_mode);
+		sap_cfg->target_band = eCSR_BAND_5G;
 	}
 	if (ht_enabled)
 		sap_cfg->acs_cfg.hw_mode = eCSR_DOT11_MODE_11n;
@@ -7893,6 +9426,10 @@ static int wlan_hdd_cfg80211_start_acs(hdd_adapter_t *adapter)
 	int status;
 
 	sap_config = &adapter->sessionCtx.ap.sapConfig;
+
+	if (test_bit(SOFTAP_BSS_STARTED, &adapter->event_flags))
+		sap_config->backup_channel = sap_config->channel;
+
 	if (hdd_ctx->acs_policy.acs_channel)
 		sap_config->channel = hdd_ctx->acs_policy.acs_channel;
 	else
@@ -7943,7 +9480,142 @@ static int wlan_hdd_cfg80211_start_acs(hdd_adapter_t *adapter)
 }
 
 /**
- * __wlan_hdd_cfg80211_do_acs : CFG80211 handler fucntion for DO_ACS Vendor CMD
+ * wlan_hdd_cfg80211_relaunch_acs() - Relaunch ACS for SAP
+ * @adapter: pointer to SAP adapter structure
+ *
+ * This function relaunches ACS.
+ *
+ * Return: Result status of ACS relaunch
+ */
+
+static int wlan_hdd_cfg80211_relaunch_acs(hdd_adapter_t *adapter)
+{
+	uint8_t channel_list[MAX_CHANNEL] = {0};
+	uint8_t number_of_channels = 0;
+	hdd_context_t *hdd_ctx = (hdd_context_t *)adapter->pHddCtx;
+	tsap_Config_t *sap_config;
+	int status;
+	uint8_t cur_band, i;
+	uint8_t band_start_channel;
+	uint8_t band_end_channel;
+	bool ht_enabled = false, vht_enabled = false;
+
+	if (!test_bit(SOFTAP_BSS_STARTED, &adapter->event_flags)) {
+		hddLog(LOGE, FL("Softap is not started"));
+		return -EINVAL;
+	}
+
+	cur_band = vos_chan_to_band((WLAN_HDD_GET_AP_CTX_PTR(
+				   adapter))->operatingChannel);
+	sap_config = &adapter->sessionCtx.ap.sapConfig;
+	vos_mem_zero(&sap_config->acs_cfg, sizeof(struct sap_acs_cfg));
+
+	if (VOS_BAND_2GHZ == cur_band) {
+		band_start_channel = RF_CHAN_1;
+		band_end_channel = RF_CHAN_14;
+	} else {
+		band_start_channel = RF_CHAN_36;
+		band_end_channel = RF_CHAN_165;
+	}
+
+	for (i = band_start_channel; i <= band_end_channel; i++) {
+		if (NV_CHANNEL_ENABLE ==
+			vos_nv_getChannelEnabledState(
+			    rfChannels[i].channelNum)) {
+			channel_list[number_of_channels++] =
+			    rfChannels[i].channelNum;
+			hddLog(LOG1,
+			       FL("Config acs channel[%d]"),
+			       rfChannels[i].channelNum);
+		}
+	}
+
+	if (sap_config->SapHw_mode &
+		(eCSR_DOT11_MODE_11n |
+		 eCSR_DOT11_MODE_11n_ONLY |
+		 eCSR_DOT11_MODE_11ac))
+		ht_enabled = true;
+
+	if (sap_config->SapHw_mode &
+		(eCSR_DOT11_MODE_11ac |
+		 eCSR_DOT11_MODE_11ac_ONLY))
+		vht_enabled = true;
+
+	sap_config->acs_cfg.ch_width = sap_config->ch_width_orig;
+
+	hddLog(LOG1,
+	       FL("ht_enabled=%d vht_enabled=%d ch_width=%d"),
+	       ht_enabled,
+	       vht_enabled,
+	       sap_config->acs_cfg.ch_width);
+
+	wlan_hdd_set_acs_ch_range(sap_config, ht_enabled, vht_enabled);
+
+	sap_config->acsBandSwitchThreshold =
+	    hdd_ctx->cfg_ini->acsBandSwitchThreshold;
+
+	if (hdd_ctx->cfg_ini->auto_channel_select_weight)
+		sap_config->auto_channel_select_weight =
+		    hdd_ctx->cfg_ini->auto_channel_select_weight;
+
+	sap_config->acs_cfg.acs_mode = true;
+	if (test_bit(ACS_IN_PROGRESS, &hdd_ctx->g_event_flags)) {
+		hddLog(LOG1, FL("ACS Pending for wlan"));
+		status = -EINVAL;
+	} else {
+		hddLog(LOG1, FL("Relaunch ACS"));
+		wlan_hdd_cfg80211_start_acs(adapter);
+		status = 0;
+	}
+
+	return status;
+}
+
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+/**
+ * wlan_hdd_set_mcc_to_scc_switch() - set mcc to scc switch mode from ini
+ * @adapter:  hdd_adapter_t ptr of the interface
+ *
+ * This function updates ini WlanMccToSccSwitchMode value to adapter
+ * context. The value controls the MCC to SCC switch behavior.
+ *
+ * Return: void
+ */
+static void
+wlan_hdd_set_mcc_to_scc_switch(hdd_adapter_t *adapter)
+{
+	hdd_context_t * hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+	hdd_config_t *cfg_ini = hdd_ctx->cfg_ini;
+	tsap_Config_t *sap_config;
+
+	sap_config = &adapter->sessionCtx.ap.sapConfig;
+	sap_config->cc_switch_mode = cfg_ini->WlanMccToSccSwitchMode;
+	sap_config->band_switch_enable = cfg_ini->wlan_band_switch_enable;
+	sap_config->ap_p2pclient_concur_enable =
+		cfg_ini->wlan_ap_p2pgo_conc_enable;
+	sap_config->ch_width_24g_orig = cfg_ini->nChannelBondingMode24GHz ?
+		eHT_CHANNEL_WIDTH_40MHZ : eHT_CHANNEL_WIDTH_20MHZ;
+	sap_config->ch_width_5g_orig = cfg_ini->vhtChannelWidth;
+}
+#else
+static void
+wlan_hdd_set_mcc_to_scc_switch(hdd_adapter_t *adapter)
+{}
+#endif
+static const struct nla_policy
+wlan_hdd_cfg80211_do_acs_policy[QCA_WLAN_VENDOR_ATTR_ACS_MAX+1] = {
+	[QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE] = { .type = NLA_U8 },
+	[QCA_WLAN_VENDOR_ATTR_ACS_HT_ENABLED] = { .type = NLA_FLAG },
+	[QCA_WLAN_VENDOR_ATTR_ACS_HT40_ENABLED] = { .type = NLA_FLAG },
+	[QCA_WLAN_VENDOR_ATTR_ACS_VHT_ENABLED] = { .type = NLA_FLAG },
+	[QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH] = { .type = NLA_U16 },
+	[QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST] = { .type = NLA_UNSPEC },
+};
+
+
+/**
+ * __wlan_hdd_cfg80211_do_acs() : CFG80211 handler fucntion for DO_ACS
+ * Vendor CMD
  * @wiphy:  Linux wiphy struct pointer
  * @wdev:   Linux wireless device struct pointer
  * @data:   ACS information from hostapd
@@ -7987,27 +9659,36 @@ static int __wlan_hdd_cfg80211_do_acs(struct wiphy *wiphy,
 	 * config shall be set only from start_acs.
 	 */
 
-	/* nla_policy Policy template. Policy not applied as some attributes are
-	 * optional and QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST has variable length
-	 *
-	 * [QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE] = { .type = NLA_U8 },
-	 * [QCA_WLAN_VENDOR_ATTR_ACS_HT_ENABLED] = { .type = NLA_FLAG },
-	 * [QCA_WLAN_VENDOR_ATTR_ACS_HT40_ENABLED] = { .type = NLA_FLAG },
-	 * [QCA_WLAN_VENDOR_ATTR_ACS_VHT_ENABLED] = { .type = NLA_FLAG },
-	 * [QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH] = { .type = NLA_U16 },
-	 * [QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST] = { .type = NLA_NESTED },
-	 */
-
-
 	status = wlan_hdd_validate_context(hdd_ctx);
 	if (0 != status)
 		return status;
 
+	if (hdd_cfg_is_static_sub20_channel_width_enabled(hdd_ctx)) {
+		hddLog(LOGE, FL("ACS not support if static sub20 enable"));
+		status = -EINVAL;
+		goto out;
+	}
+
+	if (test_bit(SOFTAP_BSS_STARTED, &adapter->event_flags)) {
+		uint32_t sap_sub20_channelwidth;
+		WLANSAP_get_sub20_channelwidth(WLAN_HDD_GET_SAP_CTX_PTR(
+						adapter),
+					       &sap_sub20_channelwidth);
+		if (sap_sub20_channelwidth == SUB20_MODE_NONE) {
+			hddLog(LOGE, FL("Bss started, relaunch ACS"));
+			status = wlan_hdd_cfg80211_relaunch_acs(adapter);
+		} else {
+			hddLog(LOGE, FL("ACS not support in sub20 enable"));
+			status = -EINVAL;
+		}
+		return status;
+	}
+
 	sap_config = &adapter->sessionCtx.ap.sapConfig;
 	vos_mem_zero(&sap_config->acs_cfg, sizeof(struct sap_acs_cfg));
 
 	status = nla_parse(tb, QCA_WLAN_VENDOR_ATTR_ACS_MAX, data, data_len,
-						NULL);
+						wlan_hdd_cfg80211_do_acs_policy);
 	if (status) {
 		hddLog(VOS_TRACE_LEVEL_ERROR, FL("Invalid ATTR"));
 		goto out;
@@ -8084,6 +9765,7 @@ static int __wlan_hdd_cfg80211_do_acs(struct wiphy *wiphy,
 					sap_config->acs_cfg.ch_list_count);
 		}
 	}
+	wlan_hdd_set_mcc_to_scc_switch(adapter);
 	wlan_hdd_set_acs_ch_range(sap_config, ht_enabled, vht_enabled);
 
 	/* ACS override for android */
@@ -8099,6 +9781,7 @@ static int __wlan_hdd_cfg80211_do_acs(struct wiphy *wiphy,
 			sap_config->acs_cfg.ch_width == eHT_CHANNEL_WIDTH_80MHZ)
 			sap_config->acs_cfg.ch_width = eHT_CHANNEL_WIDTH_40MHZ;
 	}
+
 	sap_config->acsBandSwitchThreshold =
 		hdd_ctx->cfg_ini->acsBandSwitchThreshold;
 
@@ -8106,7 +9789,6 @@ static int __wlan_hdd_cfg80211_do_acs(struct wiphy *wiphy,
 		sap_config->auto_channel_select_weight =
 		    hdd_ctx->cfg_ini->auto_channel_select_weight;
 
-
 	hddLog(LOG1, FL("ACS Config for wlan%d: HW_MODE: %d ACS_BW: %d HT: %d VHT: %d START_CH: %d END_CH: %d"),
 		adapter->dev->ifindex, sap_config->acs_cfg.hw_mode,
 		ch_width, ht_enabled, vht_enabled,
@@ -8370,6 +10052,7 @@ wlan_hdd_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_MODULATED_DTIM] = {.type = NLA_U32 },
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR] = {.type = NLA_U16 },
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME] = {.type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_FINE_TIME_MEASUREMENT] = {.type = NLA_U32},
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_TX_RATE] = {.type = NLA_U16 },
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_CHANNEL_AVOIDANCE_IND] = {.type = NLA_U8 },
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_TX_MPDU_AGGREGATION] = {.type = NLA_U8 },
@@ -8380,6 +10063,24 @@ wlan_hdd_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_CTRL_RETRY] = {.type = NLA_U8},
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_DELAY] = {.type = NLA_U8},
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_TX_FAIL_COUNT] = {.type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_ENA] = {.type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_CHAIN] = {.type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SELFTEST] = {.type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SELFTEST_INTVL] = {.type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VOICE] = {
+							.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VIDEO] = {
+							.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BESTEFFORT] = {
+							.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BACKGROUND] = {
+							.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_PEER_MAC] = {
+							.type = NLA_UNSPEC},
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_WINLIMIT] = {
+							.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_SUB20_CHAN_WIDTH] = {.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_ABS_DELAY] = {.type = NLA_U32},
 };
 
 /**
@@ -8444,6 +10145,124 @@ int wlan_hdd_update_tx_rate(hdd_context_t *hddctx, uint16_t tx_rate)
 	return 0;
 }
 
+/**
+ * hdd_set_qpower_config() - set qpower config to firmware
+ * @adapter: HDD adapter
+ * @qpower: new qpower config value
+ *
+ * Return: 0 on success; Errno on failure
+ */
+static int hdd_set_qpower_config(hdd_context_t *hddctx, hdd_adapter_t *adapter,
+				 uint8_t qpower)
+{
+	VOS_STATUS vos_status;
+
+	if(!adapter) {
+		hddLog(LOGE,"invalid adapter");
+		return -EINVAL;
+	}
+	if (adapter->device_mode != WLAN_HDD_INFRA_STATION &&
+	    adapter->device_mode != WLAN_HDD_P2P_CLIENT) {
+		hddLog(VOS_TRACE_LEVEL_INFO,
+		       FL("QPOWER is only supported for STA/P2P-CLIENT"));
+		return -EINVAL;
+	}
+	if (!hddctx->cfg_ini->enablePowersaveOffload) {
+		hddLog(LOGE,
+		       FL("qpower is disabled in configuration"));
+		return -EINVAL;
+	}
+	if (qpower > PS_DUTY_CYCLING_QPOWER ||
+	    qpower < PS_LEGACY_NODEEPSLEEP) {
+		hddLog(LOGE,
+		       FL("invalid qpower value=%d"), qpower);
+		return -EINVAL;
+	}
+	vos_status = wma_set_powersave_config(adapter->sessionId, qpower);
+	if (vos_status != VOS_STATUS_SUCCESS) {
+		hddLog(LOGE,
+		       FL("failed to update qpower %d"),
+		       vos_status);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+/**
+ * hdd_sta_set_sub20_channelwidth() -
+ * This api function does a sub20 channel width change
+ * for STA while STA in disconnect state
+ * @adapter: HDD adapter
+ * @chan_width:  New channel width change to
+ *
+ * Return: The VOS_STATUS code associated with performing
+ * the operation
+ */
+static VOS_STATUS
+hdd_sta_set_sub20_channelwidth(hdd_adapter_t *adapter, uint32_t chan_width)
+{
+	tHalHandle hal_ptr;
+
+	hddLog(LOGE, FL("chanwidth: %d"), chan_width);
+
+	if (WLAN_HDD_ADAPTER_MAGIC != adapter->magic) {
+		hddLog(LOGE, FL("hdd adapter cookie is invalid"));
+		return -EINVAL;
+	}
+
+	if (WLAN_HDD_INFRA_STATION != adapter->device_mode) {
+		hddLog(LOGE, FL("Only Sta Mode supported!"));
+		return -ENOTSUPP;
+	}
+
+	hal_ptr = WLAN_HDD_GET_HAL_CTX(adapter);
+	if (hal_ptr == NULL) {
+		hddLog(LOGE, FL("hdd hal is null"));
+		return -EINVAL;
+	}
+
+	sme_set_sta_chanlist_with_sub20(hal_ptr, chan_width);
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * hdd_get_sub20_channelwidth() -
+ * This api function get sub20 channel width
+ * @adapter: HDD adapter
+ * @sub20_channelwidth:  restore sub20 channel width
+ *
+ * Return: The VOS_STATUS code associated with performing
+ * the operation
+ */
+static VOS_STATUS
+hdd_get_sub20_channelwidth(hdd_adapter_t *adapter, uint32_t *sub20_channelwidth)
+{
+	tHalHandle hal_ptr = WLAN_HDD_GET_HAL_CTX(adapter);
+	tpAniSirGlobal mac_ptr = PMAC_STRUCT(hal_ptr);
+	v_CONTEXT_t vos_ctx_ptr = WLAN_HDD_GET_SAP_CTX_PTR(adapter);
+	uint32_t sap_sub20_channelwidth;
+
+	if (WLAN_HDD_ADAPTER_MAGIC != adapter->magic) {
+		hddLog(LOGE, FL("hdd adapter cookie is invalid"));
+		return -EINVAL;
+	}
+
+	if (WLAN_HDD_INFRA_STATION == adapter->device_mode) {
+		*sub20_channelwidth = mac_ptr->sta_sub20_current_channelwidth ?
+			mac_ptr->sta_sub20_current_channelwidth :
+			mac_ptr->sub20_channelwidth;
+	} else if (WLAN_HDD_SOFTAP == adapter->device_mode) {
+		WLANSAP_get_sub20_channelwidth(vos_ctx_ptr,
+					       &sap_sub20_channelwidth);
+		*sub20_channelwidth = sap_sub20_channelwidth;
+	} else {
+		hddLog(LOGE, FL("error dev mode!"));
+		return -EINVAL;
+	}
+
+	return VOS_STATUS_SUCCESS;
+}
 
 /**
  * __wlan_hdd_cfg80211_wifi_configuration_set() - Wifi configuration
@@ -8470,15 +10289,23 @@ static int __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 	int ret_val = 0;
 	u32 modulated_dtim;
 	uint16_t stats_avg_factor, tx_rate;
-	uint8_t set_value;
-	uint8_t retry;
-	uint8_t delay;
+	uint8_t set_value, retry, qpower, delay;
+	uint32_t abs_delay;
 	u32 guard_time;
 	u32 ftm_capab;
 	eHalStatus status;
 	struct sir_set_tx_rx_aggregation_size request;
+	struct sir_set_rx_reorder_timeout_val reorder_timeout;
+	struct sir_peer_set_rx_blocksize rx_blocksize;
 	VOS_STATUS vos_status;
 	uint32_t tx_fail_count;
+	uint32_t antdiv_ena, antdiv_chain;
+	uint32_t antdiv_selftest, antdiv_selftest_intvl;
+	int attr_len;
+	int access_policy = 0;
+	char vendor_ie[SIR_MAC_MAX_IE_LENGTH + 2];
+	bool vendor_ie_present = false, access_policy_present = false;
+	uint32_t ant_div_usrcfg;
 
 	if (VOS_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
@@ -8561,6 +10388,13 @@ static int __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 		ret_val = hdd_enable_disable_ca_event(pHddCtx, set_value);
 	}
 
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_QPOWER]) {
+		qpower = nla_get_u8(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_QPOWER]);
+		if (hdd_set_qpower_config(pHddCtx, pAdapter, qpower) != 0)
+			ret_val = -EINVAL;
+	}
+
 	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_TX_MPDU_AGGREGATION] ||
 	    tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_MPDU_AGGREGATION]) {
 		/* if one is specified, both must be specified */
@@ -8603,35 +10437,67 @@ static int __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 
 	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_NON_AGG_RETRY]) {
 		retry = nla_get_u8(
-			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_NON_AGG_RETRY]);
+				tb[QCA_WLAN_VENDOR_ATTR_CONFIG_NON_AGG_RETRY]);
 
-		/* Maximum value is 31 */
-		retry = retry > 31 ? 31 : retry;
-		ret_val = process_wma_set_command((int)pAdapter->sessionId,
-				(int)WMI_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
-				retry, PDEV_CMD);
+		retry = retry > CFG_NON_AGG_RETRY_MAX ?
+				CFG_NON_AGG_RETRY_MAX : retry;
+
+		if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_IFINDEX]) {
+			status = sme_update_short_retry_limit_threshold(
+					pHddCtx->hHal,
+					pAdapter->sessionId,
+					retry);
+			if (!HAL_STATUS_SUCCESS(status)) {
+				hddLog(LOGE,
+				FL("sme_update_short_retry_limit_threshold(err=%d)"),
+				status);
+				return -EINVAL;
+			}
+		} else {
+			ret_val = process_wma_set_command(
+					(int)pAdapter->sessionId,
+					(int)WMI_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+					retry, PDEV_CMD);
+		}
 	}
 
 	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_AGG_RETRY]) {
 		retry = nla_get_u8(
-			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_AGG_RETRY]);
+				tb[QCA_WLAN_VENDOR_ATTR_CONFIG_AGG_RETRY]);
 
-		/* Maximum value is 31(0x1f), 0 disable */
-		retry = retry > 31 ? 31 : retry;
+		retry = retry > CFG_AGG_RETRY_MAX ?
+			CFG_AGG_RETRY_MAX : retry;
+
+		/* Value less than CFG_AGG_RETRY_MIN has side effect to t-put */
+		retry = ((retry > 0) && (retry < CFG_AGG_RETRY_MIN)) ?
+				CFG_AGG_RETRY_MIN : retry;
+
+		if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_IFINDEX]) {
+			status = sme_update_long_retry_limit_threshold(
+					pHddCtx->hHal,
+					pAdapter->sessionId,
+					retry);
+			if (!HAL_STATUS_SUCCESS(status)) {
+				hddLog(LOGE,
+				FL("sme_update_long_retry_limit_threshold(err=%d)"),
+						status);
+				return -EINVAL;
+			}
+		} else {
+			ret_val = process_wma_set_command(
+					(int)pAdapter->sessionId,
+					(int)WMI_PDEV_PARAM_AGG_SW_RETRY_TH,
+					retry, PDEV_CMD);
+		}
 
-		/* Value less than 5 has side effect to t-put */
-		retry = ((retry > 0) && (retry < 5)) ? 5 : retry;
-		ret_val = process_wma_set_command((int)pAdapter->sessionId,
-				(int)WMI_PDEV_PARAM_AGG_SW_RETRY_TH,
-				retry, PDEV_CMD);
 	}
 
 	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_MGMT_RETRY]) {
 		retry = nla_get_u8(
 			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_MGMT_RETRY]);
 
-		/* Maximum value is 31 */
-		retry = retry > 31 ? 31 : retry;
+		retry = retry > CFG_MGMT_RETRY_MAX ?
+				CFG_MGMT_RETRY_MAX : retry;
 		ret_val = process_wma_set_command((int)pAdapter->sessionId,
 				(int)WMI_PDEV_PARAM_MGMT_RETRY_LIMIT,
 				retry, PDEV_CMD);
@@ -8640,8 +10506,8 @@ static int __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_CTRL_RETRY]) {
 		retry = nla_get_u8(
 			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_CTRL_RETRY]);
-		/* Maximum value is 31 */
-		retry = retry > 31 ? 31 : retry;
+		retry = retry > CFG_CTRL_RETRY_MAX ?
+				CFG_CTRL_RETRY_MAX : retry;
 		ret_val = process_wma_set_command((int)pAdapter->sessionId,
 				(int)WMI_PDEV_PARAM_CTRL_RETRY_LIMIT,
 				retry, PDEV_CMD);
@@ -8650,11 +10516,20 @@ static int __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_DELAY]) {
 		delay = nla_get_u8(
 			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_DELAY]);
-		/* Maximum value is 63 */
-		delay = delay > 63 ? 63 : delay;
+		delay = delay > CFG_PROPAGATION_DELAY_MAX ?
+				CFG_PROPAGATION_DELAY_MAX : delay;
+		abs_delay = delay + CFG_PROPAGATION_DELAY_BASE;
 		ret_val = process_wma_set_command((int)pAdapter->sessionId,
 				(int)WMI_PDEV_PARAM_PROPAGATION_DELAY,
-				delay, PDEV_CMD);
+				abs_delay, PDEV_CMD);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_ABS_DELAY]) {
+		abs_delay = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_PROPAGATION_ABS_DELAY]);
+		ret_val = process_wma_set_command((int)pAdapter->sessionId,
+				(int)WMI_PDEV_PARAM_PROPAGATION_DELAY,
+				abs_delay, PDEV_CMD);
 	}
 
 	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_TX_FAIL_COUNT]) {
@@ -8672,6 +10547,308 @@ static int __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 			}
 		}
 	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY_IE_LIST]) {
+		vos_mem_zero(&vendor_ie[0], SIR_MAC_MAX_IE_LENGTH + 2);
+		attr_len = nla_len(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY_IE_LIST]);
+		if (attr_len < 0 || attr_len > SIR_MAC_MAX_IE_LENGTH + 2) {
+			hddLog(LOGE, FL("Invalid value. attr_len %d"),
+					attr_len);
+			return -EINVAL;
+		}
+
+		nla_memcpy(&vendor_ie,
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY_IE_LIST],
+			attr_len);
+		vendor_ie_present = true;
+		hddLog(LOG1, FL("Access policy vendor ie present.attr_len %d"),
+				attr_len);
+		vos_trace_hex_dump(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+				&vendor_ie[0], attr_len);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY]) {
+		access_policy = (int) nla_get_u32(
+				tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ACCESS_POLICY]);
+		if ((access_policy < QCA_ACCESS_POLICY_ACCEPT_UNLESS_LISTED) ||
+			(access_policy > QCA_ACCESS_POLICY_DENY_UNLESS_LISTED)){
+			hddLog(LOGE, FL("Invalid value. access_policy %d"),
+					access_policy);
+			return -EINVAL;
+		}
+		access_policy_present = true;
+		hddLog(LOG1, FL("Access policy present. access_policy %d"),
+				access_policy);
+	}
+
+	if (vendor_ie_present && access_policy_present) {
+		if (access_policy == QCA_ACCESS_POLICY_DENY_UNLESS_LISTED) {
+			access_policy =
+				WLAN_HDD_VENDOR_IE_ACCESS_ALLOW_IF_LISTED;
+		}
+		else {
+			access_policy = WLAN_HDD_VENDOR_IE_ACCESS_NONE;
+		}
+
+		hddLog(LOG1, FL("calling sme_update_access_policy_vendor_ie"));
+		status = sme_update_access_policy_vendor_ie(pHddCtx->hHal,
+				pAdapter->sessionId, &vendor_ie[0],
+				access_policy);
+		if (status == eHAL_STATUS_FAILURE) {
+			hddLog(LOGE, FL(
+				"Failed to set vendor ie and access policy."));
+			return -EINVAL;
+		}
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_ENA]) {
+		antdiv_ena = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_ENA]);
+		hddLog(LOG1, FL("antdiv_ena: %d"), antdiv_ena);
+		ret_val = process_wma_set_command((int)pAdapter->sessionId,
+					(int)WMI_PDEV_PARAM_ENA_ANT_DIV,
+					antdiv_ena, PDEV_CMD);
+		if (ret_val) {
+			hddLog(LOG1, FL("Failed to set antdiv_ena"));
+			return ret_val;
+		}
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_CHAIN]) {
+		antdiv_chain = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_CHAIN]);
+		hddLog(LOG1, FL("antdiv_chain: %d"), antdiv_chain);
+		ret_val = process_wma_set_command((int)pAdapter->sessionId,
+					(int)WMI_PDEV_PARAM_FORCE_CHAIN_ANT,
+					antdiv_chain, PDEV_CMD);
+		if (ret_val) {
+			hddLog(LOG1, FL("Failed to set antdiv_chain"));
+			return ret_val;
+		}
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SELFTEST]) {
+		antdiv_selftest = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SELFTEST]);
+		hddLog(LOG1, FL("antdiv_selftest: %d"), antdiv_selftest);
+		ret_val = process_wma_set_command((int)pAdapter->sessionId,
+					(int)WMI_PDEV_PARAM_ANT_DIV_SELFTEST,
+					antdiv_selftest, PDEV_CMD);
+		if (ret_val) {
+			hddLog(LOG1, FL("Failed to set antdiv_selftest"));
+			return ret_val;
+		}
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SELFTEST_INTVL]) {
+		antdiv_selftest_intvl = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SELFTEST_INTVL]);
+		hddLog(LOG1, FL("antdiv_selftest_intvl: %d"),
+			antdiv_selftest_intvl);
+		ret_val = process_wma_set_command((int)pAdapter->sessionId,
+				(int)WMI_PDEV_PARAM_ANT_DIV_SELFTEST_INTVL,
+				antdiv_selftest_intvl, PDEV_CMD);
+		if (ret_val) {
+			hddLog(LOG1, FL("Failed to set antdiv_selftest_intvl"));
+			return ret_val;
+		}
+	}
+
+#define RX_TIMEOUT_VAL_MIN 10
+#define RX_TIMEOUT_VAL_MAX 1000
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VOICE] ||
+	    tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VIDEO] ||
+	    tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BESTEFFORT] ||
+	    tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BACKGROUND]) {
+
+		/* if one is specified, all must be specified */
+		if (!tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VOICE] ||
+		    !tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VIDEO] ||
+		    !tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BESTEFFORT] ||
+		    !tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BACKGROUND]) {
+			hddLog(LOGE,
+				FL("four AC timeout val are required MAC"));
+			return -EINVAL;
+		}
+
+		reorder_timeout.rx_timeout_pri[0] = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VOICE]);
+		reorder_timeout.rx_timeout_pri[1] = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_VIDEO]);
+		reorder_timeout.rx_timeout_pri[2] = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BESTEFFORT]);
+		reorder_timeout.rx_timeout_pri[3] = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_REORDER_TIMEOUT_BACKGROUND]);
+		/* timeout value is required to be in the rang 10 to 1000ms */
+		if (reorder_timeout.rx_timeout_pri[0] >= RX_TIMEOUT_VAL_MIN &&
+		    reorder_timeout.rx_timeout_pri[0] <= RX_TIMEOUT_VAL_MAX &&
+		    reorder_timeout.rx_timeout_pri[1] >= RX_TIMEOUT_VAL_MIN &&
+		    reorder_timeout.rx_timeout_pri[1] <= RX_TIMEOUT_VAL_MAX &&
+		    reorder_timeout.rx_timeout_pri[2] >= RX_TIMEOUT_VAL_MIN &&
+		    reorder_timeout.rx_timeout_pri[2] <= RX_TIMEOUT_VAL_MAX &&
+		    reorder_timeout.rx_timeout_pri[3] >= RX_TIMEOUT_VAL_MIN &&
+		    reorder_timeout.rx_timeout_pri[3] <= RX_TIMEOUT_VAL_MAX) {
+			vos_status = sme_set_reorder_timeout(pHddCtx->hHal,
+				&reorder_timeout);
+			if (vos_status != VOS_STATUS_SUCCESS) {
+				hddLog(LOGE,
+					FL("failed to set reorder timeout err %d"),
+					vos_status);
+				ret_val = -EPERM;
+			}
+		} else {
+			hddLog(LOGE,
+				FL("one of the timeout value is not in range"));
+			ret_val = -EINVAL;
+		}
+	}
+
+#define WINDOW_SIZE_VAL_MIN 1
+#define WINDOW_SIZE_VAL_MAX 64
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_PEER_MAC] ||
+	    tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_WINLIMIT]) {
+
+		/* if one is specified, both must be specified */
+		if (!tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_PEER_MAC] ||
+		    !tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_WINLIMIT]) {
+			hddLog(LOGE,
+				FL("Both Peer MAC and windows limit required"));
+			return -EINVAL;
+		}
+
+		memcpy(&rx_blocksize.peer_macaddr,
+			nla_data(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_PEER_MAC]),
+			sizeof(rx_blocksize.peer_macaddr)),
+
+		rx_blocksize.vdev_id = pAdapter->sessionId;
+		set_value = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_RX_BLOCKSIZE_WINLIMIT]);
+		/* maximum window size is 64 */
+		if (set_value >= WINDOW_SIZE_VAL_MIN &&
+		    set_value <= WINDOW_SIZE_VAL_MAX) {
+			rx_blocksize.rx_block_ack_win_limit = set_value;
+			vos_status = sme_set_rx_set_blocksize(pHddCtx->hHal,
+							&rx_blocksize);
+			if (vos_status != VOS_STATUS_SUCCESS) {
+				hddLog(LOGE,
+					FL("failed to set aggr sizes err %d"),
+					vos_status);
+				ret_val = -EPERM;
+			}
+		} else {
+			hddLog(LOGE, FL("window size val is not in range"));
+			ret_val = -EINVAL;
+		}
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_SUB20_CHAN_WIDTH]) {
+		bool manual_set_sub20;
+		uint32_t sub20_chan_width;
+
+		sub20_chan_width = nla_get_u32(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_SUB20_CHAN_WIDTH]);
+		hddLog(LOGE, FL("SUB20 %d"), sub20_chan_width);
+
+		switch (sub20_chan_width) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+		case NL80211_CHAN_WIDTH_5:
+			sub20_chan_width = SUB20_MODE_5MHZ;
+			break;
+		case NL80211_CHAN_WIDTH_10:
+			sub20_chan_width = SUB20_MODE_10MHZ;
+			break;
+#endif
+		case NL80211_CHAN_WIDTH_20_NOHT:
+			sub20_chan_width = SUB20_MODE_NONE;
+			break;
+		default:
+			hddLog(LOGE, FL("invalid param %d"), sub20_chan_width);
+			return -EINVAL;
+		}
+		manual_set_sub20 =
+			hdd_sub20_channelwidth_can_set(pAdapter,
+						       sub20_chan_width);
+		if (!manual_set_sub20) {
+			hddLog(LOGE, FL("STA can't set sub20 chanwidth"));
+			return -EINVAL;
+		}
+		hdd_sta_set_sub20_channelwidth(pAdapter, sub20_chan_width);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_PROBE_PERIOD] ||
+	    tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_STAY_PERIOD]) {
+
+		if (!tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_PROBE_PERIOD] ||
+		    !tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_STAY_PERIOD]) {
+			hddLog(LOGE, FL("Both probe and stay period required"));
+			return -EINVAL;
+		}
+
+		ant_div_usrcfg = ANT_DIV_SET_PERIOD(
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_PROBE_PERIOD]),
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_STAY_PERIOD]));
+		hddLog(LOG1, FL("ant div set period: %x"), ant_div_usrcfg);
+		ret_val = process_wma_set_command((int)pAdapter->sessionId,
+					(int)WMI_PDEV_PARAM_ANT_DIV_USRCFG,
+					ant_div_usrcfg, PDEV_CMD);
+		if (ret_val) {
+			hddLog(LOG1, FL("Failed to set ant div period"));
+			return ret_val;
+		}
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SNR_DIFF]) {
+		ant_div_usrcfg = ANT_DIV_SET_SNR_DIFF(
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_SNR_DIFF]));
+		hddLog(LOG1, FL("ant div set snr diff: %x"), ant_div_usrcfg);
+		ret_val = process_wma_set_command((int)pAdapter->sessionId,
+					(int)WMI_PDEV_PARAM_ANT_DIV_USRCFG,
+					ant_div_usrcfg, PDEV_CMD);
+		if (ret_val) {
+			hddLog(LOG1, FL("Failed to set ant snr diff"));
+			return ret_val;
+		}
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_PROBE_DWELL_TIME]) {
+		ant_div_usrcfg = ANT_DIV_SET_PROBE_DWELL_TIME(
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_PROBE_DWELL_TIME]));
+		hddLog(LOG1, FL("ant div set probe dewll time: %x"), ant_div_usrcfg);
+		ret_val = process_wma_set_command((int)pAdapter->sessionId,
+					(int)WMI_PDEV_PARAM_ANT_DIV_USRCFG,
+					ant_div_usrcfg, PDEV_CMD);
+		if (ret_val) {
+			hddLog(LOG1, FL("Failed to set ant div probe dewll time"));
+			return ret_val;
+		}
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_MGMT_SNR_WEIGHT] ||
+	    tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_DATA_SNR_WEIGHT] ||
+	    tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_ACK_SNR_WEIGHT]) {
+
+		if (!tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_MGMT_SNR_WEIGHT] ||
+		    !tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_DATA_SNR_WEIGHT] ||
+		    !tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_ACK_SNR_WEIGHT]) {
+			hddLog(LOGE, FL("Mgmt snr, data snr and ack snr weight are required"));
+			return -EINVAL;
+		}
+
+		ant_div_usrcfg = ANT_DIV_SET_WEIGHT(
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_MGMT_SNR_WEIGHT]),
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_DATA_SNR_WEIGHT]),
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_ANT_DIV_ACK_SNR_WEIGHT]));
+		hddLog(LOG1, FL("ant div set weight: %x"), ant_div_usrcfg);
+		ret_val = process_wma_set_command((int)pAdapter->sessionId,
+					(int)WMI_PDEV_PARAM_ANT_DIV_USRCFG,
+					ant_div_usrcfg, PDEV_CMD);
+		if (ret_val) {
+			hddLog(LOG1, FL("Failed to set ant div weight"));
+			return ret_val;
+		}
+	}
+
 	return ret_val;
 }
 
@@ -8703,6 +10880,126 @@ static int wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 	return ret;
 }
 
+/**
+ * __wlan_hdd_cfg80211_wifi_configuration_get() -
+ * Get the wifi configuration info
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ * @data:    Pointer to the data to be passed via vendor interface
+ * @data_len:Length of the data to be passed
+ *
+ * Return:   Return the Success or Failure code.
+ */
+static int
+__wlan_hdd_cfg80211_wifi_configuration_get(struct wiphy *wiphy,
+					   struct wireless_dev *wdev,
+					   const void *data, int data_len)
+{
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1];
+	uint32_t sub20_chan_width = 0;
+	int status;
+	struct sk_buff *reply_skb;
+	uint32_t skb_len = 0, count = 0;
+	struct net_device *dev = wdev->netdev;
+	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+
+	ENTER();
+
+	if (VOS_FTM_MODE == hdd_get_conparam()) {
+		hddLog(LOGE, FL("Command not allowed in FTM mode"));
+		return -EINVAL;
+	}
+
+	status = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != status)
+		return -EINVAL;
+
+	if (nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_CONFIG_MAX, data,
+		      data_len, wlan_hdd_wifi_config_policy)) {
+		hddLog(LOGE, FL("WIFI_CFG_GET NL CMD parsing failed"));
+		return -EINVAL;
+	}
+
+	if (tb_vendor[QCA_WLAN_VENDOR_ATTR_CONFIG_SUB20_CHAN_WIDTH]) {
+		hdd_get_sub20_channelwidth(adapter, &sub20_chan_width);
+
+		switch (sub20_chan_width) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+		case SUB20_MODE_5MHZ:
+			sub20_chan_width = NL80211_CHAN_WIDTH_5;
+			break;
+		case SUB20_MODE_10MHZ:
+			sub20_chan_width = NL80211_CHAN_WIDTH_10;
+			break;
+#endif
+		case SUB20_MODE_NONE:
+			sub20_chan_width = NL80211_CHAN_WIDTH_20_NOHT;
+			break;
+		default:
+			hddLog(LOGE, FL("invalid val %d"), sub20_chan_width);
+			return -EINVAL;
+		}
+		hddLog(LOGE, FL("SUB20 chanwidth %d"), sub20_chan_width);
+
+		skb_len += sizeof(sub20_chan_width);
+		count++;
+	}
+
+	if (count == 0) {
+		hddLog(LOGE, FL("unknown attribute in get_wifi_cfg request"));
+		return -EINVAL;
+	}
+
+	skb_len += NLMSG_HDRLEN;
+	reply_skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, skb_len);
+
+	if (!reply_skb)
+		goto error_skb_fail;
+
+	if (tb_vendor[QCA_WLAN_VENDOR_ATTR_CONFIG_SUB20_CHAN_WIDTH]) {
+		if (nla_put_u32(reply_skb,
+				QCA_WLAN_VENDOR_ATTR_CONFIG_SUB20_CHAN_WIDTH,
+				sub20_chan_width))
+		goto error_nla_fail;
+	}
+
+	return cfg80211_vendor_cmd_reply(reply_skb);
+
+error_skb_fail:
+	hddLog(LOGE, FL("cfg80211_vendor_cmd_alloc_reply_skb failed"));
+	return -ENOMEM;
+
+error_nla_fail:
+	hddLog(LOGE, FL("nla put fail"));
+	kfree_skb(reply_skb);
+	return -EINVAL;
+}
+
+/**
+ * wlan_hdd_cfg80211_wifi_configuration_get() - Get the wifi configuration info
+ * @wiphy:   pointer to wireless wiphy structure.
+ * @wdev:    pointer to wireless_dev structure.
+ * @data:    Pointer to the data to be passed via vendor interface
+ * @data_len:Length of the data to be passed
+ *
+ * Return:   Return the Success or Failure code.
+ */
+static int
+wlan_hdd_cfg80211_wifi_configuration_get(struct wiphy *wiphy,
+					 struct wireless_dev *wdev,
+					 const void *data, int data_len)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __wlan_hdd_cfg80211_wifi_configuration_get(wiphy, wdev,
+							 data, data_len);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
 #ifdef FEATURE_WLAN_TDLS
 
 /* TDLS capabilities params */
@@ -8908,7 +11205,9 @@ static int __wlan_hdd_cfg80211_wifi_logger_start(struct wiphy *wiphy,
 static const struct
 nla_policy
 qca_wlan_vendor_attr_policy[QCA_WLAN_VENDOR_ATTR_MAX+1] = {
-	[QCA_WLAN_VENDOR_ATTR_MAC_ADDR] = { .type = NLA_UNSPEC },
+	[QCA_WLAN_VENDOR_ATTR_MAC_ADDR] = {
+		.type = NLA_BINARY,
+		.len = HDD_MAC_ADDR_LEN},
 };
 
 /**
@@ -8963,6 +11262,13 @@ static int __wlan_hdd_cfg80211_get_link_properties(struct wiphy *wiphy,
 		return -EINVAL;
 	}
 
+	if (nla_len(tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]) < sizeof(peer_mac)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Attribute peerMac is invalid=%d"),
+			adapter->device_mode);
+		return -EINVAL;
+	}
+
 	memcpy(peer_mac, nla_data(tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]),
 	       sizeof(peer_mac));
 	hddLog(VOS_TRACE_LEVEL_INFO,
@@ -9187,19 +11493,24 @@ static int __wlan_hdd_cfg80211_wifi_logger_get_ring_data(struct wiphy *wiphy,
 	if (ring_id == RING_ID_PER_PACKET_STATS) {
 		wlan_logging_set_per_pkt_stats();
 		hddLog(LOG1, FL("Flushing/Retrieving packet stats"));
-	}
-
-	hddLog(LOG1, FL("Bug report triggered by framework"));
-
-	ret = vos_flush_logs(WLAN_LOG_TYPE_NON_FATAL,
-			     WLAN_LOG_INDICATOR_FRAMEWORK,
-			     WLAN_LOG_REASON_CODE_UNUSED,
-			     true);
-	if (VOS_STATUS_SUCCESS != ret) {
-		hddLog(LOGE, FL("Failed to trigger bug report"));
-		return -EINVAL;
-	}
-
+	} else if (ring_id == RING_ID_DRIVER_DEBUG) {
+		/*
+		 * As part of DRIVER ring ID, flush both driver and fw logs.
+		 * For other Ring ID's driver doesn't have any rings to flush
+		 */
+		hddLog(LOG1, FL("Bug report triggered by framework"));
+
+		ret = vos_flush_logs(WLAN_LOG_TYPE_NON_FATAL,
+				     WLAN_LOG_INDICATOR_FRAMEWORK,
+				     WLAN_LOG_REASON_CODE_UNUSED,
+				     DUMP_VOS_TRACE | DUMP_PACKET_TRACE);
+		if (VOS_STATUS_SUCCESS != ret) {
+			hddLog(LOGE, FL("Failed to trigger bug report"));
+			return -EINVAL;
+		}
+	} else
+		wlan_report_log_completion(FALSE, WLAN_LOG_INDICATOR_FRAMEWORK,
+					   WLAN_LOG_REASON_CODE_UNUSED);
 	return 0;
 }
 
@@ -9835,6 +12146,72 @@ fail:
 	kfree_skb(skb);
 	return;
 }
+#define PWR_SAVE_FAIL_CMD_INDEX \
+        QCA_NL80211_VENDOR_SUBCMD_PWR_SAVE_FAIL_DETECTED_INDEX
+/**
+ * hdd_chip_pwr_save_fail_detected() - chip power save failure detected
+ * NL event
+ * @hddctx: HDD context
+ * @data: chip power save failure detected data
+ *
+ * This function reads the chip power save failure detected data and fill in
+ * the skb with NL attributes and send up the NL event.
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
+ *
+ * Return: none
+ */
+void hdd_chip_pwr_save_fail_detected_cb(void *hddctx,
+				struct chip_pwr_save_fail_detected_params
+				*data)
+{
+	hdd_context_t *hdd_ctx  = hddctx;
+	struct sk_buff *skb;
+	int flags = vos_get_gfp_flags();
+
+	ENTER();
+
+	if (wlan_hdd_validate_context(hdd_ctx))
+		return;
+
+	if (!data) {
+		hddLog(LOGE, FL("data is null"));
+		return;
+	}
+
+	skb = cfg80211_vendor_event_alloc(hdd_ctx->wiphy,
+				  NULL, NLMSG_HDRLEN +
+				  sizeof(data-> failure_reason_code) +
+				  NLMSG_HDRLEN, PWR_SAVE_FAIL_CMD_INDEX,
+				  flags);
+
+	if (!skb) {
+		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
+		return;
+	}
+
+	hddLog(LOG1, "failure reason code: %u, wake lock bitmap : %u %u %u %u",
+			data->failure_reason_code,
+			data->wake_lock_bitmap[0],
+			data->wake_lock_bitmap[1],
+			data->wake_lock_bitmap[2],
+			data->wake_lock_bitmap[3]);
+
+	if (nla_put_u32(skb,
+		QCA_ATTR_CHIP_POWER_SAVE_FAILURE_REASON,
+		data->failure_reason_code))
+		goto fail;
+
+	cfg80211_vendor_event(skb, flags);
+	EXIT();
+	return;
+
+fail:
+	kfree_skb(skb);
+	EXIT();
+	return;
+}
+#undef PWR_SAVE_FAIL_CMD_INDEX
 
 static const struct nla_policy
 ns_offload_set_policy[QCA_WLAN_VENDOR_ATTR_ND_OFFLOAD_MAX + 1] = {
@@ -10297,7 +12674,7 @@ __wlan_hdd_cfg80211_bpf_offload(struct wiphy *wiphy,
 	}
 
 	if (!hdd_ctx->bpf_enabled) {
-		hddLog(LOGE, FL("BPF offload is not supported by firmware"));
+		hddLog(LOGE, FL("BPF offload is not supported/enabled"));
 		return -ENOTSUPP;
 	}
 
@@ -10484,6 +12861,16 @@ static int wlan_hdd_cfg80211_get_bus_size(struct wiphy *wiphy,
 		QCA_WLAN_VENDOR_ATTR_ICMP6_RX_MULTICAST_CNT
 #define PARAM_OTHER_RX_MULTICAST_CNT \
 		QCA_WLAN_VENDOR_ATTR_OTHER_RX_MULTICAST_CNT
+#define PARAM_RSSI_BREACH_CNT \
+		QCA_WLAN_VENDOR_ATTR_RSSI_BREACH_CNT
+#define PARAM_LOW_RSSI_CNT \
+		QCA_WLAN_VENDOR_ATTR_LOW_RSSI_CNT
+#define PARAM_GSCAN_CNT \
+		QCA_WLAN_VENDOR_ATTR_GSCAN_CNT
+#define PARAM_PNO_COMPLETE_CNT \
+		QCA_WLAN_VENDOR_ATTR_PNO_COMPLETE_CNT
+#define PARAM_PNO_MATCH_CNT \
+		QCA_WLAN_VENDOR_ATTR_PNO_MATCH_CNT
 
 
 /**
@@ -10534,6 +12921,16 @@ static uint32_t hdd_send_wakelock_stats(hdd_context_t *hdd_ctx,
 			data->wow_ipv6_mcast_na_stats);
 	hddLog(LOG1, "wow_icmpv4_count %d", data->wow_icmpv4_count);
 	hddLog(LOG1, "wow_icmpv6_count %d", data->wow_icmpv6_count);
+	hddLog(LOG1, "wow_rssi_breach_wake_up_count %d",
+			data->wow_rssi_breach_wake_up_count);
+	hddLog(LOG1, "wow_low_rssi_wake_up_count %d",
+			data->wow_low_rssi_wake_up_count);
+	hddLog(LOG1, "wow_gscan_wake_up_count %d",
+			data->wow_gscan_wake_up_count);
+	hddLog(LOG1, "wow_pno_complete_wake_up_count %d",
+			data->wow_pno_complete_wake_up_count);
+	hddLog(LOG1, "wow_pno_match_wake_up_count %d",
+			data->wow_pno_match_wake_up_count);
 
 	ipv6_rx_multicast_addr_cnt =
 		data->wow_ipv6_mcast_wake_up_count;
@@ -10578,7 +12975,17 @@ static uint32_t hdd_send_wakelock_stats(hdd_context_t *hdd_ctx,
 				data->wow_ipv4_mcast_wake_up_count) ||
 	    nla_put_u32(skb, PARAM_ICMP6_RX_MULTICAST_CNT,
 				ipv6_rx_multicast_addr_cnt) ||
-	    nla_put_u32(skb, PARAM_OTHER_RX_MULTICAST_CNT, 0)) {
+	    nla_put_u32(skb, PARAM_OTHER_RX_MULTICAST_CNT, 0) ||
+	    nla_put_u32(skb, PARAM_RSSI_BREACH_CNT,
+				data->wow_rssi_breach_wake_up_count) ||
+		nla_put_u32(skb, PARAM_LOW_RSSI_CNT,
+				data->wow_low_rssi_wake_up_count) ||
+		nla_put_u32(skb, PARAM_GSCAN_CNT,
+				data->wow_gscan_wake_up_count) ||
+		nla_put_u32(skb, PARAM_PNO_COMPLETE_CNT,
+				data->wow_pno_complete_wake_up_count) ||
+		nla_put_u32(skb, PARAM_PNO_MATCH_CNT,
+				data->wow_pno_match_wake_up_count)) {
 		hddLog(LOGE, FL("nla put fail"));
 		goto nla_put_failure;
 	}
@@ -10806,6 +13213,41 @@ static enum sta_roam_policy_dfs_mode wlan_hdd_get_sta_roam_dfs_mode(
 		return  CSR_STA_ROAM_POLICY_NONE;
 	}
 }
+/*
+ * hdd_get_sap_operating_channel:  Get current operating channel
+ * for sap.
+ * @hdd_ctx: hdd context
+ *
+ * Return : Corresponding band for SAP operating channel
+ */
+uint8_t hdd_get_sap_operating_channel(hdd_context_t *hdd_ctx) {
+	hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
+	VOS_STATUS status;
+	hdd_adapter_t *adapter;
+	uint8_t  operating_channel = 0;
+	uint8_t sap_operating_band = 0;
+	status = hdd_get_front_adapter(hdd_ctx, &adapter_node);
+	while (NULL != adapter_node && VOS_STATUS_SUCCESS == status) {
+		adapter = adapter_node->pAdapter;
+
+		if (!(adapter && (WLAN_HDD_SOFTAP == adapter->device_mode))) {
+			status = hdd_get_next_adapter(hdd_ctx, adapter_node,
+					&next);
+			adapter_node = next;
+			continue;
+		}
+		operating_channel = adapter->sessionCtx.ap.operatingChannel;
+		if (IS_24G_CH(operating_channel))
+			sap_operating_band = eCSR_BAND_24;
+		else if(IS_5G_CH(operating_channel))
+			sap_operating_band = eCSR_BAND_5G;
+		else sap_operating_band = eCSR_BAND_ALL;
+		status = hdd_get_next_adapter(hdd_ctx, adapter_node,
+				&next);
+		adapter_node = next;
+	}
+	return sap_operating_band;
+}
 
 static const struct nla_policy
 wlan_hdd_set_sta_roam_config_policy[
@@ -10846,6 +13288,7 @@ __wlan_hdd_cfg80211_sta_roam_policy(struct wiphy *wiphy,
 	enum dfs_mode mode = DFS_MODE_NONE;
 	bool skip_unsafe_channels = false;
 	eHalStatus status;
+	uint8_t sap_operating_band = 0;
 
 	ENTER();
 
@@ -10876,9 +13319,10 @@ __wlan_hdd_cfg80211_sta_roam_policy(struct wiphy *wiphy,
 	if (tb[QCA_WLAN_VENDOR_ATTR_STA_SKIP_UNSAFE_CHANNEL])
 		skip_unsafe_channels = nla_get_u8(
 			tb[QCA_WLAN_VENDOR_ATTR_STA_SKIP_UNSAFE_CHANNEL]);
-
+	sap_operating_band = hdd_get_sap_operating_channel(hdd_ctx);
 	status = sme_update_sta_roam_policy(hdd_ctx->hHal, sta_roam_dfs_mode,
-			skip_unsafe_channels, adapter->sessionId);
+			skip_unsafe_channels, adapter->sessionId,
+			sap_operating_band);
 
 	if (!HAL_STATUS_SUCCESS(status)) {
 		hddLog(LOGE,
@@ -11054,6 +13498,7 @@ __wlan_hdd_cfg80211_sap_configuration_set(struct wiphy *wiphy,
 		hddLog(LOGE, FL("invalid attr"));
 		return -EINVAL;
 	}
+
 	if (tb[QCA_WLAN_VENDOR_ATTR_SAP_CONFIG_CHANNEL])
 		config_channel =
 			nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_SAP_CONFIG_CHANNEL]);
@@ -11105,6 +13550,991 @@ static int wlan_hdd_cfg80211_sap_configuration_set(struct wiphy *wiphy,
 	return ret;
 }
 
+/*
+ * define short names for the global vendor params
+ * used by __wlan_hdd_cfg80211_get_station_cmd()
+ */
+#define STATION_INVALID \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INVALID
+#define STATION_INFO \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO
+#define STATION_ASSOC_FAIL_REASON \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_ASSOC_FAIL_REASON
+#define STATION_REMOTE \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_REMOTE
+#define STATION_MAX \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_MAX
+
+static const struct nla_policy
+hdd_get_station_policy[STATION_MAX + 1] = {
+        [STATION_INFO] = {.type = NLA_FLAG},
+        [STATION_ASSOC_FAIL_REASON] = {.type = NLA_FLAG},
+};
+
+/* define short names for get station info attributes */
+#define LINK_INFO_STANDARD_NL80211_ATTR \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_LINK_STANDARD_NL80211_ATTR
+#define AP_INFO_STANDARD_NL80211_ATTR \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AP_STANDARD_NL80211_ATTR
+#define INFO_ROAM_COUNT \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_ROAM_COUNT
+#define INFO_AKM \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AKM
+#define WLAN802_11_MODE \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_802_11_MODE
+#define AP_INFO_HS20_INDICATION \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_AP_HS20_INDICATION
+#define HT_OPERATION \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_HT_OPERATION
+#define VHT_OPERATION \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_VHT_OPERATION
+#define INFO_ASSOC_FAIL_REASON \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_ASSOC_FAIL_REASON
+#define REMOTE_MAX_PHY_RATE \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_MAX_PHY_RATE
+#define REMOTE_TX_PACKETS \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_TX_PACKETS
+#define REMOTE_TX_BYTES \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_TX_BYTES
+#define REMOTE_RX_PACKETS \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_RX_PACKETS
+#define REMOTE_RX_BYTES \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_RX_BYTES
+#define REMOTE_LAST_TX_RATE \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_LAST_TX_RATE
+#define REMOTE_LAST_RX_RATE \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_LAST_RX_RATE
+#define REMOTE_WMM \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_WMM
+#define REMOTE_SUPPORTED_MODE \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_SUPPORTED_MODE
+#define REMOTE_AMPDU \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_AMPDU
+#define REMOTE_TX_STBC \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_TX_STBC
+#define REMOTE_RX_STBC \
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_RX_STBC
+#define REMOTE_CH_WIDTH\
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_CH_WIDTH
+#define REMOTE_SGI_ENABLE\
+	QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_REMOTE_SGI_ENABLE
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+#define REMOTE_PAD\
+       QCA_WLAN_VENDOR_ATTR_GET_STATION_INFO_PAD
+#endif
+
+/**
+ * hdd_get_station_assoc_fail() - Handle get station assoc fail
+ * @hdd_ctx: HDD context within host driver
+ * @wdev: wireless device
+ *
+ * Handles QCA_NL80211_VENDOR_SUBCMD_GET_STATION_ASSOC_FAIL.
+ * Validate cmd attributes and send the station info to upper layers.
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int hdd_get_station_assoc_fail(hdd_context_t *hdd_ctx,
+						 hdd_adapter_t *adapter)
+{
+	struct sk_buff *skb = NULL;
+	uint32_t nl_buf_len;
+	hdd_station_ctx_t *hdd_sta_ctx;
+
+	nl_buf_len = NLMSG_HDRLEN;
+	nl_buf_len += sizeof(uint32_t);
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(hdd_ctx->wiphy, nl_buf_len);
+
+	if (!skb) {
+		hddLog(LOGE, FL("cfg80211_vendor_cmd_alloc_reply_skb failed"));
+		return -ENOMEM;
+	}
+
+	hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+
+	if (nla_put_u32(skb, INFO_ASSOC_FAIL_REASON,
+			hdd_sta_ctx->conn_info.assoc_status_code)) {
+		hddLog(LOGE, FL("put fail assoc status code"));
+		goto fail;
+	}
+
+	return cfg80211_vendor_cmd_reply(skb);
+fail:
+	if (skb)
+		kfree_skb(skb);
+	return -EINVAL;
+}
+
+#ifdef FEATURE_WLAN_ESE
+/**
+ * hdd_check_cckm_auth_type() - check cckm auth type
+ * @auth_type: csr auth type
+ *
+ * Return: auth type
+ */
+static int hdd_check_cckm_auth_type(uint32_t auth_type)
+{
+	uint32_t ret_val = QCA_WLAN_AUTH_TYPE_INVALID;
+
+	if (auth_type == eCSR_AUTH_TYPE_CCKM_WPA)
+		ret_val = QCA_WLAN_AUTH_TYPE_CCKM_WPA;
+	else if (auth_type == eCSR_AUTH_TYPE_CCKM_RSN)
+		ret_val = QCA_WLAN_AUTH_TYPE_CCKM_RSN;
+	return ret_val;
+}
+#else
+static int hdd_check_cckm_auth_type(uint32_t auth_type)
+{
+	return QCA_WLAN_AUTH_TYPE_INVALID;
+}
+#endif
+
+/**
+ * hdd_map_auth_type() - transform auth type specific to
+ * vendor command
+ * @auth_type: csr auth type
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int hdd_convert_auth_type(uint32_t auth_type)
+{
+	uint32_t ret_val;
+
+	ret_val = hdd_check_cckm_auth_type(auth_type);
+	if (ret_val != QCA_WLAN_AUTH_TYPE_INVALID)
+		return ret_val;
+
+	switch (auth_type) {
+	case eCSR_AUTH_TYPE_OPEN_SYSTEM:
+		ret_val = QCA_WLAN_AUTH_TYPE_OPEN;
+		break;
+	case eCSR_AUTH_TYPE_SHARED_KEY:
+		ret_val = QCA_WLAN_AUTH_TYPE_SHARED;
+		break;
+	case eCSR_AUTH_TYPE_WPA:
+		ret_val = QCA_WLAN_AUTH_TYPE_WPA;
+		break;
+	case eCSR_AUTH_TYPE_WPA_PSK:
+		ret_val = QCA_WLAN_AUTH_TYPE_WPA_PSK;
+		break;
+	case eCSR_AUTH_TYPE_AUTOSWITCH:
+		ret_val = QCA_WLAN_AUTH_TYPE_AUTOSWITCH;
+		break;
+	case eCSR_AUTH_TYPE_WPA_NONE:
+		ret_val = QCA_WLAN_AUTH_TYPE_WPA_NONE;
+		break;
+	case eCSR_AUTH_TYPE_RSN:
+		ret_val = QCA_WLAN_AUTH_TYPE_RSN;
+		break;
+	case eCSR_AUTH_TYPE_RSN_PSK:
+		ret_val = QCA_WLAN_AUTH_TYPE_RSN_PSK;
+		break;
+	case eCSR_AUTH_TYPE_FT_RSN:
+		ret_val = QCA_WLAN_AUTH_TYPE_FT;
+		break;
+	case eCSR_AUTH_TYPE_FT_RSN_PSK:
+		ret_val = QCA_WLAN_AUTH_TYPE_FT_PSK;
+		break;
+	case eCSR_AUTH_TYPE_WAPI_WAI_CERTIFICATE:
+		ret_val = QCA_WLAN_AUTH_TYPE_WAI;
+		break;
+	case eCSR_AUTH_TYPE_WAPI_WAI_PSK:
+		ret_val = QCA_WLAN_AUTH_TYPE_WAI_PSK;
+		break;
+#ifdef WLAN_FEATURE_11W
+	case eCSR_AUTH_TYPE_RSN_PSK_SHA256:
+		ret_val = QCA_WLAN_AUTH_TYPE_SHA256_PSK;
+		break;
+	case eCSR_AUTH_TYPE_RSN_8021X_SHA256:
+		ret_val = QCA_WLAN_AUTH_TYPE_SHA256;
+		break;
+#endif
+	case eCSR_NUM_OF_SUPPORT_AUTH_TYPE:
+	case eCSR_AUTH_TYPE_FAILED:
+	case eCSR_AUTH_TYPE_NONE:
+	default:
+		ret_val = QCA_WLAN_AUTH_TYPE_INVALID;
+		break;
+	}
+	return ret_val;
+}
+
+/**
+ * hdd_map_dot_11_mode() - transform dot11mode type specific to
+ * vendor command
+ * @dot11mode: dot11mode
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int hdd_convert_dot11mode(uint32_t dot11mode)
+{
+	uint32_t ret_val;
+
+	switch (dot11mode) {
+	case eCSR_CFG_DOT11_MODE_11A:
+		ret_val = QCA_WLAN_802_11_MODE_11A;
+		break;
+	case eCSR_CFG_DOT11_MODE_11B:
+		ret_val = QCA_WLAN_802_11_MODE_11B;
+		break;
+	case eCSR_CFG_DOT11_MODE_11G:
+		ret_val = QCA_WLAN_802_11_MODE_11G;
+		break;
+	case eCSR_CFG_DOT11_MODE_11N:
+		ret_val = QCA_WLAN_802_11_MODE_11N;
+		break;
+	case eCSR_CFG_DOT11_MODE_11AC:
+		ret_val = QCA_WLAN_802_11_MODE_11AC;
+		break;
+	case eCSR_CFG_DOT11_MODE_AUTO:
+	case eCSR_CFG_DOT11_MODE_ABG:
+	default:
+		ret_val = QCA_WLAN_802_11_MODE_INVALID;
+	}
+	return ret_val;
+}
+
+/**
+ * hdd_add_tx_bitrate() - add tx bitrate attribute
+ * @skb: pointer to sk buff
+ * @hdd_sta_ctx: pointer to hdd station context
+ * @idx: attribute index
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int32_t hdd_add_tx_bitrate(struct sk_buff *skb,
+					  hdd_station_ctx_t *hdd_sta_ctx,
+					  int idx)
+{
+	struct nlattr *nla_attr;
+	uint32_t bitrate, bitrate_compat;
+	struct rate_info txrate;
+
+	nla_attr = nla_nest_start(skb, idx);
+	if (!nla_attr)
+		goto fail;
+	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
+	txrate.flags = hdd_sta_ctx->conn_info.txrate.flags;
+	txrate.mcs = hdd_sta_ctx->conn_info.txrate.mcs;
+	txrate.legacy = hdd_sta_ctx->conn_info.txrate.legacy;
+	txrate.nss = hdd_sta_ctx->conn_info.txrate.nss;
+
+	bitrate = cfg80211_calculate_bitrate(&txrate);
+
+	hdd_sta_ctx->conn_info.txrate.flags = txrate.flags;
+	hdd_sta_ctx->conn_info.txrate.mcs = txrate.mcs;
+	hdd_sta_ctx->conn_info.txrate.legacy = txrate.legacy;
+	hdd_sta_ctx->conn_info.txrate.nss = txrate.nss;
+
+	/* report 16-bit bitrate only if we can */
+	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
+	if (bitrate > 0 &&
+	    nla_put_u32(skb, NL80211_RATE_INFO_BITRATE32, bitrate)) {
+		hddLog(LOGE, FL("put fail bitrate32"));
+		goto fail;
+	}
+	if (bitrate_compat > 0 &&
+	    nla_put_u16(skb, NL80211_RATE_INFO_BITRATE, bitrate_compat)) {
+		hddLog(LOGE, FL("put fail bitrate"));
+		goto fail;
+	}
+	if (nla_put_u8(skb, NL80211_RATE_INFO_VHT_NSS,
+		       hdd_sta_ctx->conn_info.txrate.nss)) {
+		hddLog(LOGE, FL("put fail nss"));
+		goto fail;
+	}
+	nla_nest_end(skb, nla_attr);
+	return 0;
+fail:
+	return -EINVAL;
+}
+
+/**
+ * hdd_add_sta_info() - add station info attribute
+ * @skb: pointer to sk buff
+ * @hdd_sta_ctx: pointer to hdd station context
+ * @idx: attribute index
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int32_t hdd_add_sta_info(struct sk_buff *skb,
+				       hdd_station_ctx_t *hdd_sta_ctx, int idx)
+{
+	struct nlattr *nla_attr;
+
+	nla_attr = nla_nest_start(skb, idx);
+	if (!nla_attr)
+		goto fail;
+	if (nla_put_u8(skb, NL80211_STA_INFO_SIGNAL,
+		       (hdd_sta_ctx->conn_info.signal + 100))) {
+		hddLog(LOGE, FL("put fail signal"));
+		goto fail;
+	}
+	if (hdd_add_tx_bitrate(skb, hdd_sta_ctx, NL80211_STA_INFO_TX_BITRATE))
+		goto fail;
+	nla_nest_end(skb, nla_attr);
+	return 0;
+fail:
+	return -EINVAL;
+}
+
+/**
+ * hdd_add_survey_info() - add survey info attribute
+ * @skb: pointer to sk buff
+ * @hdd_sta_ctx: pointer to hdd station context
+ * @idx: attribute index
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int32_t hdd_add_survey_info(struct sk_buff *skb,
+					   hdd_station_ctx_t *hdd_sta_ctx,
+					   int idx)
+{
+	struct nlattr *nla_attr;
+
+	nla_attr = nla_nest_start(skb, idx);
+	if (!nla_attr)
+		goto fail;
+	if (nla_put_u32(skb, NL80211_SURVEY_INFO_FREQUENCY,
+			hdd_sta_ctx->conn_info.freq) ||
+	    nla_put_u8(skb, NL80211_SURVEY_INFO_NOISE,
+		       (hdd_sta_ctx->conn_info.noise + 100))) {
+		hddLog(LOGE, FL("put fail noise"));
+		goto fail;
+	}
+	nla_nest_end(skb, nla_attr);
+	return 0;
+fail:
+	return -EINVAL;
+}
+
+/**
+ * hdd_add_link_standard_info() - add link info attribute
+ * @skb: pointer to sk buff
+ * @hdd_sta_ctx: pointer to hdd station context
+ * @idx: attribute index
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int32_t
+hdd_add_link_standard_info(struct sk_buff *skb,
+			   hdd_station_ctx_t *hdd_sta_ctx, int idx)
+{
+	struct nlattr *nla_attr;
+
+	nla_attr = nla_nest_start(skb, idx);
+	if (!nla_attr)
+		goto fail;
+	if (nla_put(skb,
+		    NL80211_ATTR_SSID,
+		    hdd_sta_ctx->conn_info.last_ssid.SSID.length,
+		    hdd_sta_ctx->conn_info.last_ssid.SSID.ssId)) {
+		hddLog(LOGE, FL("put fail ssid"));
+		goto fail;
+	}
+	if (hdd_add_survey_info(skb, hdd_sta_ctx, NL80211_ATTR_SURVEY_INFO))
+		goto fail;
+	if (hdd_add_sta_info(skb, hdd_sta_ctx, NL80211_ATTR_STA_INFO))
+		goto fail;
+	nla_nest_end(skb, nla_attr);
+	return 0;
+fail:
+	return -EINVAL;
+}
+
+/**
+ * hdd_add_ap_standard_info() - add ap info attribute
+ * @skb: pointer to sk buff
+ * @hdd_sta_ctx: pointer to hdd station context
+ * @idx: attribute index
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int32_t
+hdd_add_ap_standard_info(struct sk_buff *skb,
+			 hdd_station_ctx_t *hdd_sta_ctx, int idx)
+{
+	struct nlattr *nla_attr;
+
+	nla_attr = nla_nest_start(skb, idx);
+	if (!nla_attr)
+		goto fail;
+	if (hdd_sta_ctx->conn_info.conn_flag.vht_present)
+		if (nla_put(skb, NL80211_ATTR_VHT_CAPABILITY,
+			    sizeof(hdd_sta_ctx->conn_info.vht_caps),
+			    &hdd_sta_ctx->conn_info.vht_caps)) {
+			hddLog(LOGE, FL("put fail vht cap"));
+			goto fail;
+		}
+	if (hdd_sta_ctx->conn_info.conn_flag.ht_present)
+		if (nla_put(skb, NL80211_ATTR_HT_CAPABILITY,
+			    sizeof(hdd_sta_ctx->conn_info.ht_caps),
+			    &hdd_sta_ctx->conn_info.ht_caps)) {
+			hddLog(LOGE, FL("put fail ht cap"));
+			goto fail;
+		}
+	nla_nest_end(skb, nla_attr);
+	return 0;
+fail:
+	return -EINVAL;
+}
+
+/**
+ * hdd_get_station_info() - send BSS information to supplicant
+ * @hdd_ctx: pointer to hdd context
+ * @adapter: pointer to adapter
+ *
+ * Return: 0 if success else error status
+ */
+static int hdd_get_station_info(hdd_context_t *hdd_ctx,
+					 hdd_adapter_t *adapter)
+{
+	struct sk_buff *skb = NULL;
+	uint8_t *tmp_hs20 = NULL;
+	uint32_t nl_buf_len;
+	hdd_station_ctx_t *hdd_sta_ctx;
+
+	hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+
+	nl_buf_len = NLMSG_HDRLEN;
+	nl_buf_len += sizeof(hdd_sta_ctx->conn_info.last_ssid.SSID.length) +
+		      sizeof(hdd_sta_ctx->conn_info.freq) +
+		      sizeof(hdd_sta_ctx->conn_info.noise) +
+		      sizeof(hdd_sta_ctx->conn_info.signal) +
+		      (sizeof(uint32_t) * 2) +
+		      sizeof(hdd_sta_ctx->conn_info.txrate.nss) +
+		      sizeof(hdd_sta_ctx->conn_info.roam_count) +
+		      sizeof(hdd_sta_ctx->conn_info.last_auth_type) +
+		      sizeof(hdd_sta_ctx->conn_info.dot11Mode);
+	if (hdd_sta_ctx->conn_info.conn_flag.vht_present)
+		nl_buf_len += sizeof(hdd_sta_ctx->conn_info.vht_caps);
+	if (hdd_sta_ctx->conn_info.conn_flag.ht_present)
+		nl_buf_len += sizeof(hdd_sta_ctx->conn_info.ht_caps);
+	if (hdd_sta_ctx->conn_info.conn_flag.hs20_present) {
+		tmp_hs20 = (uint8_t *)&(hdd_sta_ctx->conn_info.hs20vendor_ie);
+		nl_buf_len += (sizeof(hdd_sta_ctx->conn_info.hs20vendor_ie) -
+			       1);
+	}
+	if (hdd_sta_ctx->conn_info.conn_flag.ht_op_present)
+		nl_buf_len += sizeof(hdd_sta_ctx->conn_info.ht_operation);
+	if (hdd_sta_ctx->conn_info.conn_flag.vht_op_present)
+		nl_buf_len += sizeof(hdd_sta_ctx->conn_info.vht_operation);
+
+
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(hdd_ctx->wiphy, nl_buf_len);
+	if (!skb) {
+		hddLog(LOGE, FL("cfg80211_vendor_cmd_alloc_reply_skb failed"));
+		return -ENOMEM;
+	}
+
+	if (hdd_add_link_standard_info(skb, hdd_sta_ctx,
+				       LINK_INFO_STANDARD_NL80211_ATTR)) {
+		hddLog(LOGE, FL("put fail link standard info"));
+		goto fail;
+	}
+	if (hdd_add_ap_standard_info(skb, hdd_sta_ctx,
+				     AP_INFO_STANDARD_NL80211_ATTR)) {
+		hddLog(LOGE, FL("put fail ap standard info"));
+		goto fail;
+	}
+	if (nla_put_u32(skb, INFO_ROAM_COUNT,
+			hdd_sta_ctx->conn_info.roam_count) ||
+	    nla_put_u32(skb, INFO_AKM,
+			hdd_convert_auth_type(
+			hdd_sta_ctx->conn_info.last_auth_type)) ||
+	    nla_put_u32(skb, WLAN802_11_MODE,
+			hdd_convert_dot11mode(
+			hdd_sta_ctx->conn_info.dot11Mode))) {
+		hddLog(LOGE, FL("put fail roam_count, etc."));
+		goto fail;
+	}
+	if (hdd_sta_ctx->conn_info.conn_flag.ht_op_present)
+		if (nla_put(skb, HT_OPERATION,
+			    (sizeof(hdd_sta_ctx->conn_info.ht_operation)),
+			    &hdd_sta_ctx->conn_info.ht_operation)) {
+			hddLog(LOGE, FL("put fail HT oper"));
+			goto fail;
+		}
+	if (hdd_sta_ctx->conn_info.conn_flag.vht_op_present)
+		if (nla_put(skb, VHT_OPERATION,
+			    (sizeof(hdd_sta_ctx->conn_info.vht_operation)),
+			    &hdd_sta_ctx->conn_info.vht_operation)) {
+			hddLog(LOGE, FL("put fail VHT oper"));
+			goto fail;
+		}
+	if (hdd_sta_ctx->conn_info.conn_flag.hs20_present)
+		if (nla_put(skb, AP_INFO_HS20_INDICATION,
+			    (sizeof(hdd_sta_ctx->conn_info.hs20vendor_ie) - 1),
+			    tmp_hs20 + 1)) {
+			hddLog(LOGE, FL("put fail HS20 IND"));
+			goto fail;
+		}
+
+	return cfg80211_vendor_cmd_reply(skb);
+fail:
+	if (skb)
+		kfree_skb(skb);
+	return -EINVAL;
+}
+
+/**
+ * hdd_get_peer_txrx_rate_cb() - get station's txrx rate callback
+ * @peer_info: pointer of peer information
+ * @context: get peer info callback context
+ *
+ * This function fill txrx rate information to aStaInfo[staid] of hostapd
+ * adapter
+ */
+static void hdd_get_peer_txrx_rate_cb(struct sir_peer_info_ext_resp *peer_info,
+		void *context)
+{
+	struct statsContext *get_txrx_rate_context;
+	struct sir_peer_info_ext *txrx_rate = NULL;
+	hdd_adapter_t *adapter;
+	uint8_t staid;
+
+	if ((NULL == peer_info) || (NULL == context)) {
+
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			"%s: Bad param, peer_info [%pK] context [%pK]",
+			__func__, peer_info, context);
+		return;
+	}
+
+	spin_lock(&hdd_context_lock);
+	/*
+	 * there is a race condition that exists between this callback
+	 * function and the caller since the caller could time out either
+	 * before or while this code is executing.  we use a spinlock to
+	 * serialize these actions
+	 */
+	get_txrx_rate_context = context;
+	if (PEER_INFO_CONTEXT_MAGIC !=
+			get_txrx_rate_context->magic) {
+
+		/*
+		 * the caller presumably timed out so there is nothing
+		 * we can do
+		 */
+		spin_unlock(&hdd_context_lock);
+		hddLog(VOS_TRACE_LEVEL_WARN,
+			"%s: Invalid context, magic [%08x]",
+			__func__,
+			get_txrx_rate_context->magic);
+		return;
+	}
+
+	if (!peer_info->count) {
+		spin_unlock(&hdd_context_lock);
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("Fail to get remote peer info"));
+		return;
+	}
+
+	adapter = get_txrx_rate_context->pAdapter;
+	txrx_rate = peer_info->info;
+	if (VOS_STATUS_SUCCESS != hdd_softap_GetStaId(adapter,
+				(v_MACADDR_t *)txrx_rate->peer_macaddr,
+				&staid)) {
+		spin_unlock(&hdd_context_lock);
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				"%s: Station MAC address does not matching",
+				__func__);
+		return;
+	}
+
+	adapter->aStaInfo[staid].tx_rate = txrx_rate->tx_rate;
+	adapter->aStaInfo[staid].rx_rate = txrx_rate->rx_rate;
+	hddLog(VOS_TRACE_LEVEL_INFO, "%s txrate %x rxrate %x\n",
+			__func__,
+			adapter->aStaInfo[staid].tx_rate,
+			adapter->aStaInfo[staid].rx_rate);
+
+	get_txrx_rate_context->magic = 0;
+
+	/* notify the caller */
+	complete(&get_txrx_rate_context->completion);
+
+	/* serialization is complete */
+	spin_unlock(&hdd_context_lock);
+
+	if (txrx_rate)
+		hddLog(VOS_TRACE_LEVEL_INFO, "%s %pM tx rate %u rx rate %u",
+				__func__,
+				txrx_rate->peer_macaddr,
+				txrx_rate->tx_rate,
+				txrx_rate->rx_rate);
+}
+
+/**
+ * wlan_hdd_get_peer_txrx_rate() - get station's txrx rate
+ * @adapter: hostapd interface
+ * @macaddress: mac address of requested peer
+ *
+ * This function call sme_get_peer_info_ext to get txrx rate
+ *
+ * Return: 0 on success, otherwise error value
+ */
+static int wlan_hdd_get_txrx_rate(hdd_adapter_t *adapter,
+		v_MACADDR_t macaddress)
+{
+	eHalStatus hstatus;
+	int ret;
+	struct statsContext context;
+	struct sir_peer_info_ext_req txrx_rate_req;
+
+	if (NULL == adapter) {
+		hddLog(VOS_TRACE_LEVEL_ERROR, "%s: pAdapter is NULL",
+			__func__);
+		return -EFAULT;
+	}
+
+	init_completion(&context.completion);
+	context.magic = PEER_INFO_CONTEXT_MAGIC;
+	context.pAdapter = adapter;
+
+	vos_mem_copy(&(txrx_rate_req.peer_macaddr), &macaddress,
+				VOS_MAC_ADDR_SIZE);
+	txrx_rate_req.sessionid = adapter->sessionId;
+	txrx_rate_req.reset_after_request = 0;
+	hstatus = sme_get_peer_info_ext(WLAN_HDD_GET_HAL_CTX(adapter),
+				&txrx_rate_req,
+				&context,
+				hdd_get_peer_txrx_rate_cb);
+	if (eHAL_STATUS_SUCCESS != hstatus) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			"%s: Unable to retrieve statistics for txrx_rate",
+			__func__);
+		ret = -EFAULT;
+	} else {
+		if (!wait_for_completion_timeout(&context.completion,
+				msecs_to_jiffies(WLAN_WAIT_TIME_STATS))) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+				"%s: SME timed out while retrieving txrx_rate",
+				__func__);
+			ret = -EFAULT;
+		} else {
+			ret = 0;
+		}
+	}
+	/*
+	 * either we never sent a request, we sent a request and received a
+	 * response or we sent a request and timed out.  if we never sent a
+	 * request or if we sent a request and got a response, we want to
+	 * clear the magic out of paranoia.  if we timed out there is a
+	 * race condition such that the callback function could be
+	 * executing at the same time we are. of primary concern is if the
+	 * callback function had already verified the "magic" but had not
+	 * yet set the completion variable when a timeout occurred. we
+	 * serialize these activities by invalidating the magic while
+	 * holding a shared spinlock which will cause us to block if the
+	 * callback is currently executing
+	 */
+	spin_lock(&hdd_context_lock);
+	context.magic = 0;
+	spin_unlock(&hdd_context_lock);
+	return ret;
+}
+
+/**
+ * hdd_get_stainfo() - get stainfo for the specified peer
+ * @adapter: hostapd interface
+ * @mac_addr: mac address of requested peer
+ *
+ * This function find the stainfo for the peer with mac_addr
+ *
+ * Return: stainfo if found, NULL if not found
+ */
+static hdd_station_info_t *hdd_get_stainfo(hdd_adapter_t *adapter,
+		v_MACADDR_t mac_addr)
+{
+	hdd_station_info_t *stainfo = NULL;
+	int i;
+
+	for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
+		if (vos_mem_compare(&adapter->aStaInfo[i].macAddrSTA,
+					&mac_addr,
+					VOS_MAC_ADDR_SIZE))
+			stainfo = &adapter->aStaInfo[i];
+	}
+
+	return stainfo;
+}
+
+/**
+ * hdd_get_station_remote() - get remote peer's info
+ * @hdd_ctx: hdd context
+ * @adapter: hostapd interface
+ * @mac_addr: mac address of requested peer
+ *
+ * This function collect and indicate the remote peer's info
+ *
+ * Return: 0 on success, otherwise error value
+ */
+static int hdd_get_station_remote(hdd_context_t *hdd_ctx,
+		hdd_adapter_t *adapter,
+		v_MACADDR_t mac_addr)
+{
+	hdd_station_info_t *stainfo = hdd_get_stainfo(adapter, mac_addr);
+	struct sk_buff *skb = NULL;
+	uint32_t nl_buf_len;
+	bool txrx_rate = true;
+
+	if (!stainfo) {
+		hddLog(LOGE, FL("peer" MAC_ADDRESS_STR "not found"),
+				MAC_ADDR_ARRAY(mac_addr.bytes));
+		goto fail;
+	}
+
+	nl_buf_len = NLMSG_HDRLEN;
+	nl_buf_len += (sizeof(stainfo->max_phy_rate) + NLA_HDRLEN) +
+		(sizeof(stainfo->tx_packets) + NLA_HDRLEN) +
+		(sizeof(stainfo->tx_bytes) + NLA_HDRLEN) +
+		(sizeof(stainfo->rx_packets) + NLA_HDRLEN) +
+		(sizeof(stainfo->rx_bytes) + NLA_HDRLEN) +
+		(sizeof(stainfo->isQosEnabled) + NLA_HDRLEN) +
+		(sizeof(stainfo->mode) + NLA_HDRLEN);
+
+	if (!hdd_ctx->cfg_ini->sap_get_peer_info ||
+			wlan_hdd_get_txrx_rate(adapter, mac_addr)) {
+		hddLog(LOGE, FL("fail to get tx/rx rate"));
+		txrx_rate = false;
+	} else {
+		nl_buf_len += (sizeof(stainfo->tx_rate) + NLA_HDRLEN) +
+			(sizeof(stainfo->rx_rate) + NLA_HDRLEN);
+	}
+
+	/* below info is only valid for HT/VHT mode */
+	if (stainfo->mode > SIR_SME_PHY_MODE_LEGACY)
+		nl_buf_len += (sizeof(stainfo->ampdu) + NLA_HDRLEN) +
+			(sizeof(stainfo->tx_stbc) + NLA_HDRLEN) +
+			(sizeof(stainfo->rx_stbc) + NLA_HDRLEN) +
+			(sizeof(stainfo->ch_width) + NLA_HDRLEN) +
+			(sizeof(stainfo->sgi_enable) + NLA_HDRLEN);
+
+	hddLog(VOS_TRACE_LEVEL_INFO, FL("buflen %d hdrlen %d"),
+			nl_buf_len, NLMSG_HDRLEN);
+
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(hdd_ctx->wiphy,
+			nl_buf_len);
+	if (!skb) {
+		hddLog(LOGE, FL("cfg80211_vendor_cmd_alloc_reply_skb failed"));
+		goto fail;
+	}
+
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("stainfo"));
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("maxrate %x tx_pkts %x tx_bytes %llx"),
+			stainfo->max_phy_rate, stainfo->tx_packets,
+			stainfo->tx_bytes);
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("rx_pkts %x rx_bytes %llx mode %x"),
+			stainfo->rx_packets, stainfo->rx_bytes,
+			stainfo->mode);
+	if (stainfo->mode > SIR_SME_PHY_MODE_LEGACY) {
+		hddLog(VOS_TRACE_LEVEL_INFO,
+				FL("ampdu %d tx_stbc %d rx_stbc %d"),
+				stainfo->ampdu, stainfo->tx_stbc,
+				stainfo->rx_stbc);
+		hddLog(VOS_TRACE_LEVEL_INFO,
+				FL("wmm %d chwidth %d sgi %d"),
+				stainfo->isQosEnabled,
+				stainfo->ch_width,
+				stainfo->sgi_enable);
+	}
+
+	if (nla_put_u32(skb, REMOTE_MAX_PHY_RATE, stainfo->max_phy_rate) ||
+	    nla_put_u32(skb, REMOTE_TX_PACKETS, stainfo->tx_packets) ||
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+           nla_put_u64_64bit(skb, REMOTE_TX_BYTES, stainfo->tx_bytes,
+                                                       REMOTE_PAD) ||
+#else
+	    nla_put_u64(skb, REMOTE_TX_BYTES, stainfo->tx_bytes) ||
+#endif
+	    nla_put_u32(skb, REMOTE_RX_PACKETS, stainfo->rx_packets) ||
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+           nla_put_u64_64bit(skb, REMOTE_RX_BYTES, stainfo->rx_bytes,
+                                                       REMOTE_PAD) ||
+#else
+	    nla_put_u64(skb, REMOTE_RX_BYTES, stainfo->rx_bytes) ||
+#endif
+	    nla_put_u8(skb, REMOTE_WMM, stainfo->isQosEnabled) ||
+	    nla_put_u8(skb, REMOTE_SUPPORTED_MODE, stainfo->mode)) {
+		hddLog(LOGE, FL("put fail"));
+		goto fail;
+	}
+
+	if (txrx_rate) {
+		if (nla_put_u32(skb, REMOTE_LAST_TX_RATE, stainfo->tx_rate) ||
+		    nla_put_u32(skb, REMOTE_LAST_RX_RATE, stainfo->rx_rate)) {
+			hddLog(LOGE, FL("put fail"));
+			goto fail;
+		} else {
+			hddLog(VOS_TRACE_LEVEL_INFO,
+					FL("tx_rate %x rx_rate %x"),
+					stainfo->tx_rate, stainfo->rx_rate);
+		}
+	}
+
+	if (stainfo->mode > SIR_SME_PHY_MODE_LEGACY) {
+		if (nla_put_u8(skb, REMOTE_AMPDU, stainfo->ampdu) ||
+		    nla_put_u8(skb, REMOTE_TX_STBC, stainfo->tx_stbc) ||
+		    nla_put_u8(skb, REMOTE_RX_STBC, stainfo->rx_stbc) ||
+		    nla_put_u8(skb, REMOTE_CH_WIDTH, stainfo->ch_width) ||
+		    nla_put_u8(skb, REMOTE_SGI_ENABLE, stainfo->sgi_enable)) {
+			hddLog(LOGE, FL("put fail"));
+			goto fail;
+		}
+	}
+
+	return cfg80211_vendor_cmd_reply(skb);
+
+fail:
+	if (skb)
+		kfree_skb(skb);
+
+	return -EINVAL;
+}
+
+/**
+ * __hdd_cfg80211_get_station_cmd() - Handle get station vendor cmd
+ * @wiphy: corestack handler
+ * @wdev: wireless device
+ * @data: data
+ * @data_len: data length
+ *
+ * Handles QCA_NL80211_VENDOR_SUBCMD_GET_STATION.
+ * Validate cmd attributes and send the station info to upper layers.
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int
+__hdd_cfg80211_get_station_cmd(struct wiphy *wiphy,
+			       struct wireless_dev *wdev,
+			       const void *data,
+			       int data_len)
+{
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct net_device *dev = wdev->netdev;
+	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_GET_STATION_MAX + 1];
+	int32_t status;
+
+	ENTER();
+	if (VOS_FTM_MODE == hdd_get_conparam()) {
+		hddLog(LOGE, FL("Command not allowed in FTM mode"));
+		status = -EPERM;
+		goto out;
+	}
+
+	status = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != status)
+		goto out;
+
+	status = nla_parse(tb, STATION_MAX, data, data_len,
+			   hdd_get_station_policy);
+	if (status) {
+		hddLog(LOGE, FL("Invalid ATTR"));
+		goto out;
+	}
+
+	/* Parse and fetch Command Type*/
+	if (tb[STATION_INFO]) {
+		status = hdd_get_station_info(hdd_ctx, adapter);
+	} else if (tb[STATION_ASSOC_FAIL_REASON]) {
+		status = hdd_get_station_assoc_fail(hdd_ctx, adapter);
+	} else if (tb[STATION_REMOTE]) {
+		v_MACADDR_t mac_addr;
+
+		if (adapter->device_mode != WLAN_HDD_SOFTAP) {
+			hddLog(VOS_TRACE_LEVEL_INFO,
+					FL("invalid device_mode:%d"),
+					adapter->device_mode);
+			status = -EINVAL;
+			goto out;
+		}
+
+		memcpy(mac_addr.bytes,
+				nla_data(tb[STATION_REMOTE]),
+				VOS_MAC_ADDRESS_LEN);
+
+		hddLog(VOS_TRACE_LEVEL_INFO,
+				FL("STATION_REMOTE "MAC_ADDRESS_STR""),
+				MAC_ADDR_ARRAY(mac_addr.bytes));
+
+		status = hdd_get_station_remote(hdd_ctx, adapter, mac_addr);
+	} else {
+		hddLog(LOGE, FL("get station info cmd type failed"));
+		status = -EINVAL;
+		goto out;
+	}
+	EXIT();
+out:
+	return status;
+}
+
+/**
+ * wlan_hdd_cfg80211_get_station_cmd() - Handle get station vendor cmd
+ * @wiphy: corestack handler
+ * @wdev: wireless device
+ * @data: data
+ * @data_len: data length
+ *
+ * Handles QCA_NL80211_VENDOR_SUBCMD_GET_STATION.
+ * Validate cmd attributes and send the station info to upper layers.
+ *
+ * Return: Success(0) or reason code for failure
+ */
+static int32_t
+hdd_cfg80211_get_station_cmd(struct wiphy *wiphy,
+			     struct wireless_dev *wdev,
+			     const void *data,
+			     int data_len)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __hdd_cfg80211_get_station_cmd(wiphy, wdev, data, data_len);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+/*
+ * undef short names defined for get station command
+ * used by __wlan_hdd_cfg80211_get_station_cmd()
+ */
+#undef STATION_INVALID
+#undef STATION_INFO
+#undef STATION_ASSOC_FAIL_REASON
+#undef STATION_REMOTE
+#undef STATION_MAX
+#undef LINK_INFO_STANDARD_NL80211_ATTR
+#undef AP_INFO_STANDARD_NL80211_ATTR
+#undef INFO_ROAM_COUNT
+#undef INFO_AKM
+#undef WLAN802_11_MODE
+#undef AP_INFO_HS20_INDICATION
+#undef HT_OPERATION
+#undef VHT_OPERATION
+#undef INFO_ASSOC_FAIL_REASON
+#undef REMOTE_MAX_PHY_RATE
+#undef REMOTE_TX_PACKETS
+#undef REMOTE_TX_BYTES
+#undef REMOTE_RX_PACKETS
+#undef REMOTE_RX_BYTES
+#undef REMOTE_LAST_TX_RATE
+#undef REMOTE_LAST_RX_RATE
+#undef REMOTE_WMM
+#undef REMOTE_SUPPORTED_MODE
+#undef REMOTE_AMPDU
+#undef REMOTE_TX_STBC
+#undef REMOTE_RX_STBC
+#undef REMOTE_CH_WIDTH
+#undef REMOTE_SGI_ENABLE
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+#undef REMOTE_PAD
+#endif
 static const struct
 nla_policy qca_wlan_vendor_attr[QCA_WLAN_VENDOR_ATTR_MAX+1] = {
 	[QCA_WLAN_VENDOR_ATTR_ROAMING_POLICY] = {.type = NLA_U32},
@@ -11134,6 +14564,7 @@ static int __wlan_hdd_cfg80211_fast_roaming(struct wiphy *wiphy,
 	uint32_t is_fast_roam_enabled;
 	eHalStatus status;
 	int ret;
+	hdd_station_ctx_t *hddstactx;
 
 	ENTER();
 
@@ -11163,6 +14594,26 @@ static int __wlan_hdd_cfg80211_fast_roaming(struct wiphy *wiphy,
 				tb[QCA_WLAN_VENDOR_ATTR_ROAMING_POLICY]);
 	hddLog(LOG1, FL("isFastRoamEnabled %d"), is_fast_roam_enabled);
 
+	/*
+	 * If framework sends pause_roam, host to send WAIT indication to
+	 * framework if roaming is in progress. This can help framework to
+	 * defer out-network roaming. EBUSY is used to convey wait indication.
+	 */
+	if (!is_fast_roam_enabled) {
+		if (sme_staInMiddleOfRoaming(hdd_ctx->hHal,
+					adapter->sessionId)) {
+			hddLog(LOG1, FL("Roaming in progress, do not allow disable"));
+			return -EBUSY;
+		}
+
+		hddstactx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+		if (hddstactx->hdd_ReassocScenario) {
+			hddLog(LOG1,
+				FL("Roaming in progress, so unable to disable roaming"));
+			return -EBUSY;
+		}
+	}
+
 	/* Update roaming */
 	status = sme_config_fast_roaming(hdd_ctx->hHal, adapter->sessionId,
 					 is_fast_roam_enabled);
@@ -11171,6 +14622,7 @@ static int __wlan_hdd_cfg80211_fast_roaming(struct wiphy *wiphy,
 			FL("sme_config_fast_roaming (err=%d)"), status);
 		return -EINVAL;
 	}
+
 	EXIT();
 	return 0;
 }
@@ -11200,6 +14652,11 @@ static int wlan_hdd_cfg80211_fast_roaming(struct wiphy *wiphy,
 	return ret;
 }
 
+static const struct nla_policy
+txpower_scale_policy[QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_MAX + 1] = {
+	[QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE] = { .type = NLA_U8 },
+};
+
 /**
  * __wlan_hdd_cfg80211_txpower_scale () - txpower scaling
  * @wiphy: Pointer to wireless phy
@@ -11231,7 +14688,7 @@ static int __wlan_hdd_cfg80211_txpower_scale(struct wiphy *wiphy,
 	adapter = WLAN_HDD_GET_PRIV_PTR(dev);
 
 	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_MAX,
-		      data, data_len, NULL)) {
+		      data, data_len, txpower_scale_policy)) {
 		hddLog(LOGE, "Invalid ATTR");
 		return -EINVAL;
 	}
@@ -11283,6 +14740,11 @@ static int wlan_hdd_cfg80211_txpower_scale(struct wiphy *wiphy,
 	return ret;
 }
 
+static const struct nla_policy txpower_scale_decr_db_policy
+[QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_MAX + 1] = {
+	[QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB] = { .type = NLA_U8 },
+};
+
 /**
  * __wlan_hdd_cfg80211_txpower_scale_decr_db () - txpower scaling
  * @wiphy: Pointer to wireless phy
@@ -11312,7 +14774,7 @@ static int __wlan_hdd_cfg80211_txpower_scale_decr_db(struct wiphy *wiphy,
 	adapter = WLAN_HDD_GET_PRIV_PTR(dev);
 
 	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_MAX,
-		      data, data_len, NULL)) {
+		      data, data_len, txpower_scale_decr_db_policy)) {
 		hddLog(LOGE, "Invalid ATTR");
 		return -EINVAL;
 	}
@@ -11360,6 +14822,259 @@ static int wlan_hdd_cfg80211_txpower_scale_decr_db(struct wiphy *wiphy,
 	return ret;
 }
 
+/**
+ * hdd_post_get_chain_rssi_rsp - send rsp to user space
+ * @hdd_ctx: Pointer to hdd context
+ *
+ * Return: 0 for success, non-zero for failure
+ */
+static int hdd_post_get_chain_rssi_rsp(hdd_context_t *hdd_ctx)
+{
+	struct sk_buff *skb = NULL;
+	struct chain_rssi_result *result =
+			&hdd_ctx->chain_rssi_context.result;
+
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(hdd_ctx->wiphy,
+			(sizeof(result->chain_rssi) + NLA_HDRLEN) +
+			(sizeof(result->ant_id) + NLA_HDRLEN) +
+			NLMSG_HDRLEN);
+
+	if (!skb) {
+		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
+		return -ENOMEM;
+	}
+
+	if (nla_put(skb, QCA_WLAN_VENDOR_ATTR_CHAIN_RSSI,
+			sizeof(result->chain_rssi),
+			result->chain_rssi)) {
+		hddLog(LOGE, FL("put fail"));
+		goto nla_put_failure;
+	}
+
+	if (nla_put(skb, QCA_WLAN_VENDOR_ATTR_ANTENNA_INFO,
+			sizeof(result->ant_id),
+			result->ant_id)) {
+		hddLog(LOGE, FL("put fail"));
+		goto nla_put_failure;
+	}
+
+	cfg80211_vendor_cmd_reply(skb);
+	return 0;
+
+nla_put_failure:
+	kfree_skb(skb);
+	return -EINVAL;
+}
+
+/**
+ * __wlan_hdd_cfg80211_get_chain_rssi() - get chain rssi
+ * @wiphy: wiphy pointer
+ * @wdev: pointer to struct wireless_dev
+ * @data: pointer to incoming NL vendor data
+ * @data_len: length of @data
+ *
+ * Return: 0 on success; error number otherwise.
+ */
+static int __wlan_hdd_cfg80211_get_chain_rssi(struct wiphy *wiphy,
+						struct wireless_dev *wdev,
+						const void *data,
+						int data_len)
+{
+	struct get_chain_rssi_req_params req_msg;
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct hdd_chain_rssi_context *context;
+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
+	eHalStatus status;
+	int retval;
+	unsigned long rc;
+	const int mac_len = sizeof(req_msg.peer_macaddr);
+	int msg_len;
+
+	ENTER();
+
+	retval = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != retval)
+		return retval;
+
+	/* nla validation doesn't do exact lengths, do the validation later */
+	retval = nla_parse(tb, QCA_WLAN_VENDOR_ATTR_MAX, data, data_len, NULL);
+	if (retval) {
+		hddLog(LOGE, FL("Invalid ATTR"));
+		return retval;
+	}
+
+	if (!tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]) {
+		hddLog(LOGE, FL("attr mac addr failed"));
+		return -EINVAL;
+	}
+
+	msg_len = nla_len(tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]);
+	if (msg_len != mac_len) {
+		hddLog(LOGE, FL("Invalid mac address length: %d, expected %d"),
+			msg_len, mac_len);
+		return -ERANGE;
+	}
+
+	memcpy(&req_msg.peer_macaddr,
+		nla_data(tb[QCA_WLAN_VENDOR_ATTR_MAC_ADDR]), mac_len);
+
+	spin_lock(&hdd_context_lock);
+	context = &hdd_ctx->chain_rssi_context;
+	INIT_COMPLETION(context->response_event);
+	context->ignore_result = false;
+	spin_unlock(&hdd_context_lock);
+
+	status = sme_get_chain_rssi(hdd_ctx->hHal, &req_msg);
+	if (!HAL_STATUS_SUCCESS(status)) {
+		hddLog(LOGE,
+			FL("sme_get_chain_rssi failed(err=%d)"), status);
+		return -EINVAL;
+	}
+
+	rc = wait_for_completion_timeout(&context->response_event,
+			msecs_to_jiffies(WLAN_WAIT_TIME_CHAIN_RSSI));
+	if (!rc) {
+		hddLog(LOGE, FL("Target response timed out"));
+		spin_lock(&hdd_context_lock);
+		context->ignore_result = true;
+		spin_unlock(&hdd_context_lock);
+		return -ETIMEDOUT;
+	}
+
+	retval = hdd_post_get_chain_rssi_rsp(hdd_ctx);
+	if (retval)
+		hddLog(LOGE,
+			FL("Failed to send chain rssi to user space"));
+
+	EXIT();
+	return retval;
+}
+
+/**
+ * wlan_hdd_cfg80211_get_chain_rssi() - get chain rssi
+ * @wiphy: wiphy pointer
+ * @wdev: pointer to struct wireless_dev
+ * @data: pointer to incoming NL vendor data
+ * @data_len: length of @data
+ *
+ * Return: 0 on success; error number otherwise.
+ */
+static int wlan_hdd_cfg80211_get_chain_rssi(struct wiphy *wiphy,
+			struct wireless_dev *wdev,
+			const void *data, int data_len)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __wlan_hdd_cfg80211_get_chain_rssi(wiphy, wdev, data, data_len);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+static const struct
+nla_policy
+qca_wlan_vendor_peer_flush_pending_policy
+	[QCA_WLAN_VENDOR_ATTR_FLUSH_PENDING_MAX + 1] = {
+	[QCA_WLAN_VENDOR_ATTR_PEER_ADDR] = {.type = NLA_BINARY,
+					.len = VOS_MAC_ADDR_SIZE},
+	[QCA_WLAN_VENDOR_ATTR_AC] = { .type = NLA_U8 },
+};
+
+/**
+ * __wlan_hdd_cfg80211_peer_flush_tids() - flush peer pending packets
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Length of @data
+ *
+ * This function is used to flush peer pending packets using vendor commands
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int
+__wlan_hdd_cfg80211_peer_flush_pending(struct wiphy *wiphy,
+				       struct wireless_dev *wdev,
+				       const void *data, int data_len)
+{
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct net_device *dev = wdev->netdev;
+	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_FLUSH_PENDING_MAX + 1];
+	struct sme_flush_pending flush_pending;
+	eHalStatus status;
+	int ret;
+
+	ENTER();
+
+	ret = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != ret)
+		return ret;
+
+	if (VOS_FTM_MODE == hdd_get_conparam()) {
+		hddLog(LOGE, FL("Command not allowed in FTM mode"));
+		return -EINVAL;
+	}
+	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_FLUSH_PENDING_MAX, data,
+		      data_len, qca_wlan_vendor_peer_flush_pending_policy)) {
+		hddLog(LOGE, FL("Invalid attribute"));
+		return -EINVAL;
+	}
+
+	if (!tb[QCA_WLAN_VENDOR_ATTR_PEER_ADDR]) {
+		hddLog(LOGE,
+		       FL("Attribute peerMac not provided"));
+		return -EINVAL;
+	}
+	memcpy(flush_pending.peer_addr.bytes,
+	       nla_data(tb[QCA_WLAN_VENDOR_ATTR_PEER_ADDR]),
+	       VOS_MAC_ADDR_SIZE);
+
+	if (!tb[QCA_WLAN_VENDOR_ATTR_AC]) {
+		hddLog(LOGE, FL("Attribute AC not provided"));
+		return -EINVAL;
+	}
+	flush_pending.flush_ac = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_AC]);
+	hddLog(LOG1, FL("flush ac = %02x"), flush_pending.flush_ac & 0x0f);
+
+	flush_pending.session_id = adapter->sessionId;
+	hddLog(LOG1, FL("session_id = %d"), flush_pending.session_id);
+
+	status = sme_peer_flush_pending(hdd_ctx->hHal, &flush_pending);
+	if (!HAL_STATUS_SUCCESS(status)) {
+		hddLog(LOGE, FL("sme_config_peer_flush_pending (err=%d)"),
+		       status);
+		return -EINVAL;
+	}
+	EXIT();
+	return 0;
+}
+
+/**
+ * wlan_hdd_cfg80211_peer_flush_tids() - flush peer pending packets
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Length of @data
+ *
+ * Wrapper function of __wlan_hdd_cfg80211_peer_flush_ac()
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int wlan_hdd_cfg80211_peer_flush_pending(struct wiphy *wiphy,
+						struct wireless_dev *wdev,
+						const void *data, int data_len)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __wlan_hdd_cfg80211_peer_flush_pending(wiphy, wdev,
+						     data, data_len);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
 const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] =
 {
     {
@@ -11419,8 +15134,7 @@ const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] =
         .info.vendor_id = QCA_NL80211_VENDOR_ID,
         .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_GET_CAPABILITIES,
         .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
-                 WIPHY_VENDOR_CMD_NEED_NETDEV |
-                 WIPHY_VENDOR_CMD_NEED_RUNNING,
+                 WIPHY_VENDOR_CMD_NEED_NETDEV,
         .doit = wlan_hdd_cfg80211_extscan_get_capabilities
     },
     {
@@ -11601,6 +15315,14 @@ const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] =
     },
     {
         .info.vendor_id = QCA_NL80211_VENDOR_ID,
+        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_GET_WIFI_CONFIGURATION,
+        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+                 WIPHY_VENDOR_CMD_NEED_NETDEV |
+                 WIPHY_VENDOR_CMD_NEED_RUNNING,
+        .doit = wlan_hdd_cfg80211_wifi_configuration_get
+    },
+    {
+        .info.vendor_id = QCA_NL80211_VENDOR_ID,
         .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_ROAM,
         .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
                  WIPHY_VENDOR_CMD_NEED_NETDEV,
@@ -11623,22 +15345,6 @@ const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] =
                  WIPHY_VENDOR_CMD_NEED_RUNNING,
         .doit = wlan_hdd_cfg80211_reset_passpoint_list
     },
-    {
-        .info.vendor_id = QCA_NL80211_VENDOR_ID,
-        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SET_SSID_HOTLIST,
-        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
-                 WIPHY_VENDOR_CMD_NEED_NETDEV |
-                 WIPHY_VENDOR_CMD_NEED_RUNNING,
-        .doit = wlan_hdd_cfg80211_extscan_set_ssid_hotlist
-    },
-    {
-        .info.vendor_id = QCA_NL80211_VENDOR_ID,
-        .info.subcmd = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_RESET_SSID_HOTLIST,
-        .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
-                 WIPHY_VENDOR_CMD_NEED_NETDEV |
-                 WIPHY_VENDOR_CMD_NEED_RUNNING,
-        .doit = wlan_hdd_cfg80211_extscan_reset_ssid_hotlist
-    },
 #endif /* FEATURE_WLAN_EXTSCAN */
     {
         .info.vendor_id = QCA_NL80211_VENDOR_ID,
@@ -11721,16 +15427,6 @@ const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] =
 			WIPHY_VENDOR_CMD_NEED_RUNNING,
 		.doit = wlan_hdd_cfg80211_get_logger_supp_feature
 	},
-#ifdef WLAN_FEATURE_MEMDUMP
-	{
-		.info.vendor_id = QCA_NL80211_VENDOR_ID,
-		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_MEMORY_DUMP,
-		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
-			WIPHY_VENDOR_CMD_NEED_NETDEV |
-			WIPHY_VENDOR_CMD_NEED_RUNNING,
-		.doit = wlan_hdd_cfg80211_get_fw_mem_dump
-	},
-#endif /* WLAN_FEATURE_MEMDUMP */
 	{
 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_WIFI_LOGGER_START,
@@ -11809,8 +15505,7 @@ const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] =
 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_GET_BUS_SIZE,
 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
-			WIPHY_VENDOR_CMD_NEED_NETDEV |
-			WIPHY_VENDOR_CMD_NEED_RUNNING,
+			WIPHY_VENDOR_CMD_NEED_NETDEV,
 		.doit = wlan_hdd_cfg80211_get_bus_size
 	},
 	{
@@ -11865,7 +15560,14 @@ const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] =
 			WIPHY_VENDOR_CMD_NEED_RUNNING,
 		.doit = wlan_hdd_cfg80211_sap_configuration_set
 	},
-
+	{
+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
+		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_GET_STATION,
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			WIPHY_VENDOR_CMD_NEED_NETDEV |
+			WIPHY_VENDOR_CMD_NEED_RUNNING,
+		.doit = hdd_cfg80211_get_station_cmd
+	},
 	{
 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_ROAMING,
@@ -11891,9 +15593,42 @@ const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] =
 				 WIPHY_VENDOR_CMD_NEED_RUNNING,
 		.doit = wlan_hdd_cfg80211_txpower_scale_decr_db
 	},
+	{
+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
+		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI,
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+				 WIPHY_VENDOR_CMD_NEED_NETDEV |
+				 WIPHY_VENDOR_CMD_NEED_RUNNING,
+		.doit = wlan_hdd_cfg80211_get_chain_rssi
+	},
+	{
+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
+		.info.subcmd =
+			QCA_NL80211_VENDOR_SUBCMD_LL_STATS_EXT,
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+				 WIPHY_VENDOR_CMD_NEED_NETDEV |
+				 WIPHY_VENDOR_CMD_NEED_RUNNING,
+		.doit = wlan_hdd_cfg80211_ll_stats_ext_set_param
+	},
+	{
+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
+		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_PEER_FLUSH_PENDING,
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+				 WIPHY_VENDOR_CMD_NEED_NETDEV |
+				 WIPHY_VENDOR_CMD_NEED_RUNNING,
+		.doit = wlan_hdd_cfg80211_peer_flush_pending
+	},
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+	{
+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
+		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_THERMAL_CMD,
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+				 WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = wlan_hdd_cfg80211_thermal_cmd
+	},
+#endif /* FEATURE_WLAN_THERMAL_SHUTDOWN */
 };
 
-
 /*
  * FUNCTION: wlan_hdd_cfg80211_wiphy_alloc
  * This function is called by hdd_wlan_startup()
@@ -11920,6 +15655,101 @@ struct wiphy *wlan_hdd_cfg80211_wiphy_alloc(int priv_size)
     return wiphy;
 }
 
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,4,0)) || \
+    defined (CFG80211_MULTI_SCAN_PLAN_BACKPORT)
+/**
+ * hdd_config_sched_scan_plans_to_wiphy() - configure sched scan plans to wiphy
+ * @wiphy: pointer to wiphy
+ * @config: pointer to config
+ *
+ * Return: None
+ */
+static void hdd_config_sched_scan_plans_to_wiphy(struct wiphy *wiphy,
+						 hdd_config_t *config)
+{
+	wiphy->max_sched_scan_plans = MAX_SCHED_SCAN_PLANS;
+	if (config->max_sched_scan_plan_interval)
+		wiphy->max_sched_scan_plan_interval =
+			config->max_sched_scan_plan_interval;
+	if (config->max_sched_scan_plan_iterations)
+		wiphy->max_sched_scan_plan_iterations =
+			config->max_sched_scan_plan_iterations;
+}
+#else
+static void hdd_config_sched_scan_plans_to_wiphy(struct wiphy *wiphy,
+						 hdd_config_t *config)
+{
+}
+#endif
+
+#ifdef CFG80211_SCAN_RANDOM_MAC_ADDR
+static void wlan_hdd_cfg80211_scan_randomization_init(struct wiphy *wiphy)
+{
+	wiphy->features |= NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
+	wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
+}
+#else
+static void wlan_hdd_cfg80211_scan_randomization_init(struct wiphy *wiphy)
+{
+	return;
+}
+#endif
+
+/**
+ * wlan_hdd_cfg80211_add_connected_pno_support() - Set connected PNO support
+ * @wiphy: Pointer to wireless phy
+ *
+ * This function is used to set connected PNO support to kernel
+ *
+ * Return: None
+ */
+#if defined(CFG80211_REPORT_BETTER_BSS_IN_SCHED_SCAN)
+static void wlan_hdd_cfg80211_add_connected_pno_support(struct wiphy *wiphy)
+{
+	wiphy_ext_feature_set(wiphy,
+		NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI);
+}
+#else
+static void wlan_hdd_cfg80211_add_connected_pno_support(struct wiphy *wiphy)
+{
+	return;
+}
+#endif
+
+#ifdef CFG80211_RAND_TA_FOR_PUBLIC_ACTION_FRAME
+/**
+ * wlan_hdd_cfg80211_action_frame_randomization_init() - Randomize SA of MA frms
+ * @wiphy: Pointer to wiphy
+ *
+ * This function is used to indicate the support of source mac address
+ * randomization of management action frames
+ *
+ * Return: None
+ */
+static void
+wlan_hdd_cfg80211_action_frame_randomization_init(struct wiphy *wiphy)
+{
+       wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA);
+}
+#else
+static void
+wlan_hdd_cfg80211_action_frame_randomization_init(struct wiphy *wiphy)
+{
+       return;
+}
+#endif
+
+#if defined(WLAN_FEATURE_FILS_SK) && defined(CFG80211_FILS_SK_OFFLOAD_SUPPORT)
+static void wlan_hdd_cfg80211_set_wiphy_fils_feature(struct wiphy *wiphy)
+{
+    wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
+}
+#else
+static void wlan_hdd_cfg80211_set_wiphy_fils_feature(struct wiphy *wiphy)
+{
+}
+#endif
+
 /*
  * FUNCTION: wlan_hdd_cfg80211_init
  * This function is called by hdd_wlan_startup()
@@ -11960,7 +15790,7 @@ int wlan_hdd_cfg80211_init(struct device *dev,
                     | WIPHY_FLAG_OFFCHAN_TX;
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0)) || defined(WITH_BACKPORTS)
-    wiphy->regulatory_flags = REGULATORY_COUNTRY_IE_IGNORE;
+    wiphy->regulatory_flags |= REGULATORY_COUNTRY_IE_IGNORE;
 #else
     wiphy->country_ie_pref = NL80211_COUNTRY_IE_IGNORE_CORE;
 #endif
@@ -12003,6 +15833,7 @@ int wlan_hdd_cfg80211_init(struct device *dev,
         wiphy->max_match_sets       = SIR_PNO_MAX_SUPP_NETWORKS;
         wiphy->max_sched_scan_ie_len = SIR_MAC_MAX_IE_LENGTH;
     }
+    wlan_hdd_cfg80211_add_connected_pno_support(wiphy);
 #endif/*FEATURE_WLAN_SCAN_PNO*/
 
 #if  defined QCA_WIFI_FTM
@@ -12032,7 +15863,8 @@ int wlan_hdd_cfg80211_init(struct device *dev,
                              | BIT(NL80211_IFTYPE_ADHOC)
                              | BIT(NL80211_IFTYPE_P2P_CLIENT)
                              | BIT(NL80211_IFTYPE_P2P_GO)
-                             | BIT(NL80211_IFTYPE_AP);
+                             | BIT(NL80211_IFTYPE_AP)
+                             | BIT(NL80211_IFTYPE_MONITOR);
 
     if( pCfg->advertiseConcurrentOperation )
     {
@@ -12163,7 +15995,23 @@ int wlan_hdd_cfg80211_init(struct device *dev,
 #ifdef CHANNEL_SWITCH_SUPPORTED
     wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 #endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+    if (pCfg->sub_20_channel_width)
+        wiphy->flags |= WIPHY_FLAG_SUPPORTS_5_10_MHZ;
+#endif
     wiphy->features |= NL80211_FEATURE_INACTIVITY_TIMER;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0)) || \
+    defined(CFG80211_BEACON_TX_RATE_CUSTOM_BACKPORT)
+    wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
+    wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_HT);
+    wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_VHT);
+#endif
+    wlan_hdd_cfg80211_set_wiphy_fils_feature(wiphy);
+    hdd_config_sched_scan_plans_to_wiphy(wiphy, pCfg);
+    wlan_hdd_cfg80211_scan_randomization_init(wiphy);
+    wlan_hdd_cfg80211_action_frame_randomization_init(wiphy);
+
     EXIT();
     return 0;
 }
@@ -12753,7 +16601,7 @@ static void wlan_hdd_add_hostapd_conf_vsie(hdd_adapter_t* pHostapdAdapter,
                     elem_id, elem_len, left);
             return;
         }
-        if (IE_EID_VENDOR == elem_id)
+        if ((IE_EID_VENDOR == elem_id) && (elem_len >= WPS_OUI_TYPE_SIZE))
         {
             /* skipping the VSIE's which we don't want to include or
              * it will be included by existing code
@@ -12884,7 +16732,6 @@ int wlan_hdd_cfg80211_update_apies(hdd_adapter_t* pHostapdAdapter)
 
     wlan_hdd_add_extra_ie(pHostapdAdapter, genie, &total_ielen,
                           WLAN_EID_VHT_TX_POWER_ENVELOPE);
-
     if (0 != wlan_hdd_add_ie(pHostapdAdapter, genie,
                               &total_ielen, WPS_OUI_TYPE, WPS_OUI_TYPE_SIZE))
     {
@@ -13613,15 +17460,15 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
     v_SINT_t i;
     hdd_config_t *iniConfig;
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pHostapdAdapter);
-    tSmeConfigParams sme_config;
+    tSmeConfigParams *sme_config_ptr = NULL;
     v_BOOL_t MFPCapable =  VOS_FALSE;
     v_BOOL_t MFPRequired =  VOS_FALSE;
     u_int16_t prev_rsn_length = 0;
     enum dfs_mode mode;
     int ret;
-    extern uint8_t thermal_band;
     ENTER();
 
+    wlan_hdd_tdls_disable_offchan_and_teardown_links(pHddCtx);
     iniConfig = pHddCtx->cfg_ini;
     pHostapdState = WLAN_HDD_GET_HOSTAP_STATE_PTR(pHostapdAdapter);
 
@@ -13637,6 +17484,35 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
     pConfig->beacon_int =  pMgmt_frame->u.beacon.beacon_int;
 
     pConfig->disableDFSChSwitch = iniConfig->disableDFSChSwitch;
+    pConfig->enable_radar_war = iniConfig->enable_radar_war;
+
+    pConfig->sap_chanswitch_beacon_cnt =
+        iniConfig->sap_chanswitch_beacon_cnt;
+    pConfig->sap_chanswitch_mode =
+        iniConfig->sap_chanswitch_mode;
+
+    pConfig->dfs_beacon_tx_enhanced =
+        iniConfig->dfs_beacon_tx_enhanced;
+
+    pConfig->reduced_beacon_interval =
+        iniConfig->reduced_beacon_interval;
+    switch (iniConfig->sub_20_channel_width) {
+    case CFG_SUB_20_CHANNEL_WIDTH_DISABLE:
+        pConfig->sub20_switch_mode = SUB20_NONE;
+        break;
+    case CFG_SUB_20_CHANNEL_WIDTH_5MHZ:
+    case CFG_SUB_20_CHANNEL_WIDTH_10MHZ:
+        pConfig->sub20_switch_mode = SUB20_STATIC;
+        break;
+    case CFG_SUB_20_CHANNEL_WIDTH_DYN_5MHZ:
+    case CFG_SUB_20_CHANNEL_WIDTH_DYN_10MHZ:
+    case CFG_SUB_20_CHANNEL_WIDTH_DYN_ALL:
+        pConfig->sub20_switch_mode = SUB20_DYN;
+        break;
+    case CFG_SUB_20_CHANNEL_WIDTH_MANUAL:
+        pConfig->sub20_switch_mode = SUB20_MANUAL;
+        break;
+    }
 
     pConfig->auto_channel_select_weight = iniConfig->auto_channel_select_weight;
     //channel is already set in the set_channel Call back
@@ -14004,8 +17880,12 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
      */
     if ((0 == pHddCtx->cfg_ini->conc_custom_rule1) ||
         (pHddCtx->cfg_ini->conc_custom_rule1 &&
-         WLAN_HDD_SOFTAP == pHostapdAdapter->device_mode))
-    pConfig->cc_switch_mode = iniConfig->WlanMccToSccSwitchMode;
+         WLAN_HDD_SOFTAP == pHostapdAdapter->device_mode)) {
+        pConfig->cc_switch_mode = iniConfig->WlanMccToSccSwitchMode;
+        pConfig->band_switch_enable = iniConfig->wlan_band_switch_enable;
+        pConfig->ap_p2pclient_concur_enable =
+                iniConfig->wlan_ap_p2pclient_conc_enable;
+    }
 #endif
 
     pIe = wlan_hdd_get_vendor_oui_ie_ptr(BLACKLIST_OUI_TYPE, WPA_OUI_TYPE_SIZE,
@@ -14102,16 +17982,22 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
      * As per spec 11n/11AC STA are QOS STA and may not connect to nonQOS 11n AP
      * Default enable QOS for SAP
      */
-    vos_mem_zero(&sme_config, sizeof(tSmeConfigParams));
-    sme_GetConfigParam(pHddCtx->hHal, &sme_config);
-    sme_config.csrConfig.WMMSupportMode = eCsrRoamWmmAuto;
+    sme_config_ptr = vos_mem_malloc(sizeof(*sme_config_ptr));
+    if (!sme_config_ptr) {
+        hddLog(LOGE, FL("memory allocation failed for sme_config"));
+        return -ENOMEM;
+    }
+    vos_mem_zero(sme_config_ptr, sizeof(tSmeConfigParams));
+    sme_GetConfigParam(pHddCtx->hHal, sme_config_ptr);
+    sme_config_ptr->csrConfig.WMMSupportMode = eCsrRoamWmmAuto;
+
     pIe = wlan_hdd_get_vendor_oui_ie_ptr(WMM_OUI_TYPE, WMM_OUI_TYPE_SIZE,
                                          pBeacon->tail, pBeacon->tail_len);
     if (!pIe && (pConfig->SapHw_mode == eCSR_DOT11_MODE_11a ||
                  pConfig->SapHw_mode == eCSR_DOT11_MODE_11g ||
                  pConfig->SapHw_mode == eCSR_DOT11_MODE_11b))
-        sme_config.csrConfig.WMMSupportMode = eCsrRoamWmmNoQos;
-    sme_UpdateConfig(pHddCtx->hHal, &sme_config);
+        sme_config_ptr->csrConfig.WMMSupportMode = eCsrRoamWmmNoQos;
+    sme_UpdateConfig(pHddCtx->hHal, sme_config_ptr);
 
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0)) && !defined(WITH_BACKPORTS)
     /* Linux kernel < 3.8 does not support ch width param. So for
@@ -14139,6 +18025,12 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
         goto error;
     }
 
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+    pConfig->ch_width_24g_orig = iniConfig->nChannelBondingMode24GHz ?
+        eHT_CHANNEL_WIDTH_40MHZ : eHT_CHANNEL_WIDTH_20MHZ;
+    pConfig->ch_width_5g_orig = iniConfig->vhtChannelWidth;
+#endif
+
     // ht_capab is not what the name conveys,this is used for protection bitmap
     pConfig->ht_capab = iniConfig->apProtection;
 
@@ -14188,6 +18080,7 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
         WLANSAP_ResetSapConfigAddIE(pConfig, eUPDATE_IE_ALL);
         //Bss already started. just return.
         //TODO Probably it should update some beacon params.
+        vos_mem_free(sme_config_ptr);
         hddLog( LOGE, "Bss Already started...Ignore the request");
         EXIT();
         return 0;
@@ -14209,6 +18102,8 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
     if (pHddCtx->cfg_ini->enable_dynamic_sta_chainmask)
        hdd_decide_dynamic_chain_mask(pHddCtx, HDD_ANTENNA_MODE_2X2);
 
+    set_bit(SOFTAP_INIT_DONE, &pHostapdAdapter->event_flags);
+
     vos_event_reset(&pHostapdState->vosEvent);
     status = WLANSAP_StartBss(
 #ifdef WLAN_FEATURE_MBSSID
@@ -14284,57 +18179,18 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
          }
     }
 #endif
+    /* Check and restart SAP if it is on unsafe channel */
+    hdd_unsafe_channel_restart_sap(pHddCtx);
 
     pHostapdState->bCommit = TRUE;
-
-    if (hdd_is_mcc_in_2_band(pHddCtx)) {
-            switch (pHddCtx->thermal_level) {
-                case 0:
-                    thermal_band =
-                         (pHddCtx->cfg_ini->throttle_dutycycle_level0_2g
-                         > pHddCtx->cfg_ini->throttle_dutycycle_level0_5g)
-                         ? 2
-                         : 5;
-                         break;
-                case 1:
-                    thermal_band =
-                         (pHddCtx->cfg_ini->throttle_dutycycle_level1_2g
-                         > pHddCtx->cfg_ini->throttle_dutycycle_level1_5g)
-                         ? 2
-                         : 5;
-                         break;
-                case 2:
-                    thermal_band =
-                         (pHddCtx->cfg_ini->throttle_dutycycle_level2_2g
-                         > pHddCtx->cfg_ini->throttle_dutycycle_level2_5g)
-                         ? 2
-                         : 5;
-                         break;
-                case 3:
-                    thermal_band =
-                         (pHddCtx->cfg_ini->throttle_dutycycle_level3_2g
-                         > pHddCtx->cfg_ini->throttle_dutycycle_level3_5g)
-                         ? 2
-                         : 5;
-                         break;
-                default:
-                    hddLog(VOS_TRACE_LEVEL_ERROR,
-                       "invalid thermal level %d",
-                       pHddCtx->thermal_level);
-           }
-    } else {
-         hdd_get_band(
-                      (WLAN_HDD_GET_AP_CTX_PTR(pHostapdAdapter))->operatingChannel,
-                      &thermal_band
-                      );
-    }
-    sme_SetThermalLevel(pHddCtx->hHal, pHddCtx->thermal_level);
-
+    vos_mem_free(sme_config_ptr);
     EXIT();
 
    return 0;
 
 error:
+    vos_mem_free(sme_config_ptr);
+    clear_bit(SOFTAP_INIT_DONE, &pHostapdAdapter->event_flags);
     if (pHostapdAdapter->sessionCtx.ap.sapConfig.acs_cfg.ch_list) {
         vos_mem_free(pHostapdAdapter->sessionCtx.ap.sapConfig.acs_cfg.ch_list);
         pHostapdAdapter->sessionCtx.ap.sapConfig.acs_cfg.ch_list = NULL;
@@ -14542,6 +18398,8 @@ static int __wlan_hdd_cfg80211_stop_ap (struct wiphy *wiphy,
 #endif
 {
     hdd_adapter_t  *pAdapter   = WLAN_HDD_GET_PRIV_PTR(dev);
+    tHalHandle hal_ptr = WLAN_HDD_GET_HAL_CTX(pAdapter);
+    tpAniSirGlobal mac_ptr = PMAC_STRUCT(hal_ptr);
     hdd_context_t  *pHddCtx    = NULL;
     hdd_scaninfo_t *pScanInfo  = NULL;
     hdd_adapter_t  *staAdapter = NULL;
@@ -14552,6 +18410,11 @@ static int __wlan_hdd_cfg80211_stop_ap (struct wiphy *wiphy,
     unsigned long   rc;
     hdd_adapter_list_node_t *pAdapterNode = NULL;
     hdd_adapter_list_node_t *pNext        = NULL;
+    uint8_t i, zeros[18] = {0};
+    uint32_t hostapd_edca_local[] = {WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL,
+                                     WNI_CFG_EDCA_HOSTAPD_ACVI_LOCAL,
+                                     WNI_CFG_EDCA_HOSTAPD_ACBE_LOCAL,
+                                     WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL};
 
     ENTER();
 
@@ -14559,6 +18422,12 @@ static int __wlan_hdd_cfg80211_stop_ap (struct wiphy *wiphy,
                      TRACE_CODE_HDD_CFG80211_STOP_AP,
                      pAdapter->sessionId, pAdapter->device_mode));
 
+    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    status = wlan_hdd_validate_context(pHddCtx);
+    if (0 != status)
+    {
+        return status;
+    }
 
     if (VOS_FTM_MODE == hdd_get_conparam()) {
         hddLog(LOGE, FL("Command not allowed in FTM mode"));
@@ -14574,7 +18443,14 @@ static int __wlan_hdd_cfg80211_stop_ap (struct wiphy *wiphy,
            hdd_device_mode_to_string(pAdapter->device_mode),
            pAdapter->device_mode);
 
-    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    if (WLAN_HDD_SOFTAP == pAdapter->device_mode)
+        hdd_wlan_green_ap_stop_bss(pHddCtx);
+
+    if ((WLAN_HDD_SOFTAP == pAdapter->device_mode) &&
+        (pHddCtx->cfg_ini->enable_hostapd_edca_local)) {
+        for (i = 0; i < 4; ++i)
+            cfgSetStr(mac_ptr, hostapd_edca_local[i], zeros, 18);
+    }
 
     status = hdd_get_front_adapter (pHddCtx, &pAdapterNode);
     while (NULL != pAdapterNode && VOS_STATUS_SUCCESS == status) {
@@ -14636,6 +18512,7 @@ static int __wlan_hdd_cfg80211_stop_ap (struct wiphy *wiphy,
     }
 
     hdd_cleanup_actionframe(pHddCtx, pAdapter);
+    wlan_hdd_cleanup_remain_on_channel_ctx(pAdapter);
 
     mutex_lock(&pHddCtx->sap_lock);
     if (test_bit(SOFTAP_BSS_STARTED, &pAdapter->event_flags)) {
@@ -14695,6 +18572,7 @@ static int __wlan_hdd_cfg80211_stop_ap (struct wiphy *wiphy,
 
     // Reset WNI_CFG_PROBE_RSP Flags
     wlan_hdd_reset_prob_rspies(pAdapter);
+    clear_bit(SOFTAP_INIT_DONE, &pAdapter->event_flags);
 
 #ifdef WLAN_FEATURE_P2P_DEBUG
     if((pAdapter->device_mode == WLAN_HDD_P2P_GO) &&
@@ -14748,6 +18626,79 @@ static int wlan_hdd_cfg80211_stop_ap(struct wiphy *wiphy,
 }
 #endif
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)) || \
+	defined(CFG80211_BEACON_TX_RATE_CUSTOM_BACKPORT)
+/**
+ * hdd_get_data_rate_from_rate_mask() - convert mask to rate
+ * @wiphy: Pointer to wiphy
+ * @band: band
+ * @bit_rate_mask: pointer to bit_rake_mask
+ *
+ * This function takes band and bit_rate_mask as input and
+ * derives the beacon_tx_rate based on the supported rates
+ * published as part of wiphy register.
+ *
+ * Return: zero for data rate on success or 0 on failure
+ */
+uint16_t hdd_get_data_rate_from_rate_mask(struct wiphy *wiphy,
+		enum ieee80211_band band,
+		struct cfg80211_bitrate_mask *bit_rate_mask)
+{
+	struct ieee80211_supported_band *sband = wiphy->bands[band];
+	int sband_n_bitrates;
+	struct ieee80211_rate *sband_bitrates;
+	int i;
+
+	if (sband) {
+		sband_bitrates = sband->bitrates;
+		sband_n_bitrates = sband->n_bitrates;
+		for (i = 0; i < sband_n_bitrates; i++) {
+			if (bit_rate_mask->control[band].legacy ==
+				sband_bitrates[i].hw_value) {
+				return sband_bitrates[i].bitrate;
+			}
+		}
+	}
+	return 0;
+}
+
+/**
+ * hdd_update_beacon_rate() - Update beacon tx rate
+ * @pAdapter: Pointer to hdd_adapter_t
+ * @wiphy: Pointer to wiphy
+ * @params: Pointet to cfg80211_ap_settings
+ *
+ * This function updates the beacon tx rate which is provided
+ * as part of cfg80211_ap_settions in to the sapConfig
+ * structure
+ *
+ * Return: zero for data rate on success or 0 on failure
+ */
+void hdd_update_beacon_rate(hdd_adapter_t *pAdapter, struct wiphy *wiphy,
+		struct cfg80211_ap_settings *params)
+{
+	struct cfg80211_bitrate_mask *beacon_rate_mask;
+	enum ieee80211_band band;
+
+	band = params->chandef.chan->band;
+	beacon_rate_mask = &params->beacon_rate;
+	if (beacon_rate_mask->control[band].legacy) {
+		pAdapter->sessionCtx.ap.sapConfig.beacon_tx_rate =
+			hdd_get_data_rate_from_rate_mask(wiphy, band,
+					beacon_rate_mask);
+		hddLog(VOS_TRACE_LEVEL_INFO,
+				FL("beacon mask value %u, rate %hu"),
+				params->beacon_rate.control[0].legacy,
+				pAdapter->sessionCtx.ap.sapConfig.beacon_tx_rate);
+	}
+}
+#else
+void hdd_update_beacon_rate(hdd_adapter_t *pAdapter, struct wiphy *wiphy,
+		struct cfg80211_ap_settings *params)
+{
+}
+#endif
+
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(3,3,0)) || defined(WITH_BACKPORTS)
 
 static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
@@ -14755,11 +18706,13 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
                                       struct cfg80211_ap_settings *params)
 {
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    uint8_t channel;
+    uint32_t channel_width;
     hdd_context_t *pHddCtx;
     int            status;
-
     ENTER();
 
+    clear_bit(SOFTAP_INIT_DONE, &pAdapter->event_flags);
     MTRACE(vos_trace(VOS_MODULE_ID_HDD,
                      TRACE_CODE_HDD_CFG80211_START_AP, pAdapter->sessionId,
                      params->beacon_interval));
@@ -14780,7 +18733,7 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
         return -EINVAL;
     }
 
-    hddLog(LOG2, FL("pAdapter = %p, device mode %s(%d)"),
+    hddLog(LOG2, FL("pAdapter = %pK, device mode %s(%d)"),
            pAdapter, hdd_device_mode_to_string(pAdapter->device_mode),
            pAdapter->device_mode);
 
@@ -14788,6 +18741,120 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
         hddLog(VOS_TRACE_LEVEL_DEBUG, FL("Reached max concurrent connections"));
         return -EINVAL;
     }
+
+    if (WLAN_HDD_SOFTAP == pAdapter->device_mode)
+        hdd_wlan_green_ap_start_bss(pHddCtx);
+
+    channel_width = params->chandef.width;
+    channel = ieee80211_frequency_to_channel(
+                  params->chandef.chan->center_freq);
+
+    /* Avoid ACS/DFS, and overwrite channel width to 20 */
+    if (hdd_cfg_is_sub20_channel_width_enabled(pHddCtx)) {
+            bool channel_support_sub20 = true;
+            tSmeConfigParams sme_config;
+            uint8_t sub20_config;
+            uint8_t sub20_dyn_channelwidth = 0;
+            uint8_t sub20_static_channelwidth = 0;
+            uint8_t sub20_channelwidth = 0;
+            enum phy_ch_width phy_sub20_channel_width = CH_WIDTH_INVALID;
+
+            vos_mem_zero(&sme_config, sizeof(sme_config));
+            sme_GetConfigParam(pHddCtx->hHal, &sme_config);
+            sub20_config = sme_config.sub20_config_info;
+
+            switch (sub20_config) {
+            case CFG_SUB_20_CHANNEL_WIDTH_5MHZ:
+                sub20_static_channelwidth = SUB20_MODE_5MHZ;
+                break;
+            case CFG_SUB_20_CHANNEL_WIDTH_10MHZ:
+                sub20_static_channelwidth = SUB20_MODE_10MHZ;
+                break;
+            case CFG_SUB_20_CHANNEL_WIDTH_DYN_5MHZ:
+                sub20_dyn_channelwidth = SUB20_MODE_5MHZ;
+                break;
+            case CFG_SUB_20_CHANNEL_WIDTH_DYN_10MHZ:
+                sub20_dyn_channelwidth = SUB20_MODE_10MHZ;
+                break;
+            case CFG_SUB_20_CHANNEL_WIDTH_DYN_ALL:
+                sub20_dyn_channelwidth = SUB20_MODE_5MHZ | SUB20_MODE_10MHZ;
+                break;
+            default:
+                break;
+            }
+
+            if (channel == 0) {
+                    hddLog(VOS_TRACE_LEVEL_WARN,
+                           FL("Can't start SAP-ACS with sub20 channel width"));
+                    return -EINVAL;
+            }
+
+            if (CSR_IS_CHANNEL_DFS(channel)) {
+                    hddLog(VOS_TRACE_LEVEL_WARN,
+                           FL("Can't start SAP-DFS with sub20 channel width"));
+                    return -EINVAL;
+            }
+
+            if (channel_width != NL80211_CHAN_WIDTH_20 &&
+                channel_width != NL80211_CHAN_WIDTH_20_NOHT) {
+                    hddLog(VOS_TRACE_LEVEL_WARN,
+                           FL("Hostapd (20+MHz) conflicts config.ini(sub20)"));
+                    return -EINVAL;
+            }
+
+            switch (sub20_config) {
+            case CFG_SUB_20_CHANNEL_WIDTH_5MHZ:
+            case CFG_SUB_20_CHANNEL_WIDTH_10MHZ:
+            case CFG_SUB_20_CHANNEL_WIDTH_DYN_5MHZ:
+            case CFG_SUB_20_CHANNEL_WIDTH_DYN_10MHZ:
+                sub20_channelwidth = (sub20_static_channelwidth != 0) ?
+                        sub20_static_channelwidth : sub20_dyn_channelwidth;
+                phy_sub20_channel_width =
+                        (sub20_channelwidth == SUB20_MODE_5MHZ) ?
+                            CH_WIDTH_5MHZ : CH_WIDTH_10MHZ;
+                channel_support_sub20 =
+                        vos_is_channel_support_sub20(channel,
+                                                     phy_sub20_channel_width,
+                                                     0);
+                if (!channel_support_sub20) {
+                        hddLog(VOS_TRACE_LEVEL_ERROR,
+                               FL("ch%dwidth%d unsupport by reg domain"),
+                               channel, phy_sub20_channel_width);
+                        return -EINVAL;
+                }
+                break;
+            case CFG_SUB_20_CHANNEL_WIDTH_DYN_ALL:
+                channel_support_sub20 =
+                    vos_is_channel_support_sub20(channel, CH_WIDTH_5MHZ, 0);
+                if (!channel_support_sub20) {
+                        hddLog(VOS_TRACE_LEVEL_ERROR,
+                               FL("ch%dwidth5M unsupport by reg domain"),
+                               channel);
+                        sub20_dyn_channelwidth &= ~SUB20_MODE_5MHZ;
+                }
+
+                channel_support_sub20 =
+                    vos_is_channel_support_sub20(channel, CH_WIDTH_10MHZ, 0);
+                if (!channel_support_sub20) {
+                        hddLog(VOS_TRACE_LEVEL_ERROR,
+                               FL("ch%dwidth10M unsupport by reg domain"),
+                               channel);
+                        sub20_dyn_channelwidth &= ~SUB20_MODE_10MHZ;
+                }
+
+                if (sub20_dyn_channelwidth == 0) {
+                        return -EINVAL;
+                } else {
+                        sme_config.sub20_dynamic_channelwidth =
+                                 sub20_dyn_channelwidth;
+                        sme_UpdateConfig(pHddCtx->hHal, &sme_config);
+                }
+                break;
+            default:
+                break;
+            }
+    }
+
     if (pAdapter->device_mode == WLAN_HDD_P2P_GO) {
         hdd_adapter_t  *pP2pAdapter = NULL;
         pP2pAdapter = hdd_get_adapter(pHddCtx, WLAN_HDD_P2P_DEVICE);
@@ -14844,6 +18911,9 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
         params->chandef.chan, channel_type);
 #endif
 #endif
+
+        hdd_update_beacon_rate(pAdapter, wiphy, params);
+
         /* set authentication type */
         switch ( params->auth_type )
         {
@@ -14861,6 +18931,7 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
         pAdapter->sessionCtx.ap.sapConfig.ch_width_orig =
                                              params->chandef.width;
 #endif
+
         status = wlan_hdd_cfg80211_start_bss(pAdapter, &params->beacon, params->ssid,
                                              params->ssid_len, params->hidden_ssid);
         if (status == 0) {
@@ -15037,29 +19108,22 @@ static int __wlan_hdd_cfg80211_change_bss (struct wiphy *wiphy,
     return ret;
 }
 
-static int
-wlan_hdd_change_iface_to_adhoc(struct net_device *ndev,
-                               tCsrRoamProfile *pRoamProfile,
-                               enum nl80211_iftype type)
-{
-    hdd_adapter_t *pAdapter   = WLAN_HDD_GET_PRIV_PTR(ndev);
-    hdd_context_t *pHddCtx    = WLAN_HDD_GET_CTX(pAdapter);
-    hdd_config_t  *pConfig    = pHddCtx->cfg_ini;
-    struct wireless_dev *wdev = ndev->ieee80211_ptr;
-
-    pRoamProfile->BSSType = eCSR_BSS_TYPE_START_IBSS;
-    pRoamProfile->phyMode = hdd_cfg_xlate_to_csr_phy_mode(pConfig->dot11Mode);
-    pAdapter->device_mode = WLAN_HDD_IBSS;
-    wdev->iftype = type;
-
-    return 0;
-}
-
-static int wlan_hdd_change_iface_to_sta_mode(struct net_device *ndev,
-                                                      enum nl80211_iftype type)
+/**
+ * wlan_hdd_change_client_iface_to_new_mode() - to change iface to provided mode
+ * @ndev: pointer to net device provided by supplicant
+ * @type: type of the interface, upper layer wanted to change
+ *
+ * Upper layer provides the new interface mode that needs to be changed
+ * for given net device
+ *
+ * Return: success or failure in terms of integer value
+ */
+static int wlan_hdd_change_client_iface_to_new_mode(struct net_device *ndev,
+                                                    enum nl80211_iftype type)
 {
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(ndev);
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    hdd_config_t *config = pHddCtx->cfg_ini;
     hdd_wext_state_t *wext;
     struct wireless_dev *wdev;
     VOS_STATUS status;
@@ -15081,6 +19145,8 @@ static int wlan_hdd_change_iface_to_sta_mode(struct net_device *ndev,
         pAdapter->device_mode =
                         (type == NL80211_IFTYPE_STATION)?
                                      WLAN_HDD_P2P_DEVICE : WLAN_HDD_P2P_CLIENT;
+    } else if (type == NL80211_IFTYPE_ADHOC) {
+        pAdapter->device_mode = WLAN_HDD_IBSS;
     } else {
         pAdapter->device_mode =
                         (type == NL80211_IFTYPE_STATION) ?
@@ -15097,6 +19163,11 @@ static int wlan_hdd_change_iface_to_sta_mode(struct net_device *ndev,
     wext = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
     wext->roamProfile.pAddIEScan = pAdapter->scan_info.scanAddIE.addIEdata;
     wext->roamProfile.nAddIEScanLength = pAdapter->scan_info.scanAddIE.length;
+    if (type == NL80211_IFTYPE_ADHOC) {
+        wext->roamProfile.BSSType = eCSR_BSS_TYPE_START_IBSS;
+        wext->roamProfile.phyMode =
+            hdd_cfg_xlate_to_csr_phy_mode(config->dot11Mode);
+    }
     EXIT();
 
     return vos_status_to_os_return(status);
@@ -15140,7 +19211,6 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
     tCsrRoamProfile *pRoamProfile = NULL;
     eCsrRoamBssType LastBSSType;
     hdd_config_t *pConfig = NULL;
-    eMib_dot11DesiredBssType connectedBssType;
     unsigned long rc;
     VOS_STATUS vstatus;
     eHalStatus hstatus;
@@ -15191,7 +19261,13 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
         switch (type) {
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
-           status = wlan_hdd_change_iface_to_sta_mode(ndev, type);
+        case NL80211_IFTYPE_ADHOC:
+           if (type == NL80211_IFTYPE_ADHOC) {
+               wlan_hdd_tdls_exit(pAdapter);
+               wlan_hdd_clean_tx_flow_control_timer(pHddCtx, pAdapter);
+               hddLog(LOG1, FL("Setting interface Type to ADHOC"));
+           }
+           status = wlan_hdd_change_client_iface_to_new_mode(ndev, type);
            if (status != 0)
                return status;
 
@@ -15203,7 +19279,13 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
                              pAdapter);
               pAdapter->tx_flow_timer_initialized = VOS_TRUE;
            }
-           WLANTL_RegisterTXFlowControl(pHddCtx->pvosContext,
+
+           /*
+            * for ibss interface type flow control is not required
+            * so don't register tx flow control
+            */
+           if (type != NL80211_IFTYPE_ADHOC)
+                WLANTL_RegisterTXFlowControl(pHddCtx->pvosContext,
                             hdd_tx_resume_cb,
                             pAdapter->sessionId,
                            (void *)pAdapter);
@@ -15211,13 +19293,6 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
 
            goto done;
 
-        case NL80211_IFTYPE_ADHOC:
-           wlan_hdd_tdls_exit(pAdapter);
-           wlan_hdd_clean_tx_flow_control_timer(pHddCtx, pAdapter);
-           hddLog(LOG1, FL("Setting interface Type to ADHOC"));
-           wlan_hdd_change_iface_to_adhoc(ndev, pRoamProfile, type);
-           break;
-
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
         {
@@ -15230,25 +19305,6 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
                 wlan_hdd_cancel_existing_remain_on_channel(pAdapter);
             }
 
-            if (NL80211_IFTYPE_AP == type) {
-                /* As Loading WLAN Driver one interface being created for
-                 * p2p device address. This will take one HW STA and the
-                 * max number of clients that can connect to softAP will be
-                 * reduced by one. so while changing the interface type to
-                 * NL80211_IFTYPE_AP (SoftAP) remove p2p0 interface as it is
-                 * not required in SoftAP mode.
-                 */
-
-                /* Get P2P Adapter */
-                hdd_adapter_t  *pP2pAdapter = NULL;
-                pP2pAdapter = hdd_get_adapter(pHddCtx, WLAN_HDD_P2P_DEVICE);
-
-                if (pP2pAdapter) {
-                    hdd_stop_adapter(pHddCtx, pP2pAdapter, VOS_TRUE);
-                    hdd_deinit_adapter(pHddCtx, pP2pAdapter, true);
-                    hdd_close_adapter(pHddCtx, pP2pAdapter, VOS_TRUE);
-                }
-            }
             hdd_stop_adapter(pHddCtx, pAdapter, VOS_TRUE);
 
             /* De-init the adapter */
@@ -15319,7 +19375,7 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
                 }
             }
 
-            vstatus = hdd_init_ap_mode(pAdapter);
+            vstatus = hdd_init_ap_mode(pAdapter, false);
             if (vstatus != VOS_STATUS_SUCCESS) {
                 hddLog(LOGP, FL("Error initializing the ap mode"));
                 return -EINVAL;
@@ -15361,7 +19417,16 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
        case NL80211_IFTYPE_STATION:
        case NL80211_IFTYPE_P2P_CLIENT:
        case NL80211_IFTYPE_ADHOC:
-          status = wlan_hdd_change_iface_to_sta_mode(ndev, type);
+
+          if (WLAN_HDD_VDEV_STA_MAX ==
+              hdd_get_current_vdev_sta_count(pHddCtx)) {
+              hddLog(VOS_TRACE_LEVEL_DEBUG,
+                  FL("Unable to change as sta interface: max sta cnt is %d"),
+                  WLAN_HDD_VDEV_STA_MAX);
+              return -EINVAL;
+          }
+
+          status = wlan_hdd_change_client_iface_to_new_mode(ndev, type);
           if (status != 0)
               return status;
 
@@ -15421,32 +19486,6 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
       return -EOPNOTSUPP;
     }
 
-    if (LastBSSType != pRoamProfile->BSSType) {
-        /* Interface type changed update in wiphy structure */
-        wdev->iftype = type;
-
-        /* The BSS mode changed, We need to issue disconnect
-           if connected or in IBSS disconnect state */
-        if (hdd_connGetConnectedBssType(
-            WLAN_HDD_GET_STATION_CTX_PTR(pAdapter), &connectedBssType) ||
-           (eCSR_BSS_TYPE_START_IBSS == LastBSSType)) {
-            /* Need to issue a disconnect to CSR.*/
-            INIT_COMPLETION(pAdapter->disconnect_comp_var);
-            if (eHAL_STATUS_SUCCESS ==
-                sme_RoamDisconnect(WLAN_HDD_GET_HAL_CTX(pAdapter),
-                            pAdapter->sessionId,
-                            eCSR_DISCONNECT_REASON_UNSPECIFIED)) {
-                rc = wait_for_completion_timeout(
-                              &pAdapter->disconnect_comp_var,
-                              msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
-                if (!rc) {
-                    hddLog(LOGE,
-                           FL("Wait on disconnect_comp_var failed"));
-                 }
-            }
-        }
-    }
-
 done:
     /* Set bitmask based on updated value */
     wlan_hdd_set_concurrency_mode(pHddCtx, pAdapter->device_mode);
@@ -15526,7 +19565,7 @@ static int wlan_hdd_tdls_add_station(struct wiphy *wiphy,
         set_bit(TDLS_INIT_DONE, &pAdapter->event_flags);
     }
 
-    pTdlsPeer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    pTdlsPeer = wlan_hdd_tdls_get_peer(pAdapter, mac, TRUE);
 
     if ( NULL == pTdlsPeer ) {
         VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
@@ -15560,7 +19599,7 @@ static int wlan_hdd_tdls_add_station(struct wiphy *wiphy,
     }
 
     /* when others are on-going, we want to change link_status to idle */
-    if (NULL != wlan_hdd_tdls_is_progress(pHddCtx, mac, TRUE))
+    if (NULL != wlan_hdd_tdls_is_progress(pHddCtx, mac, TRUE, TRUE))
     {
         VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                    "%s: " MAC_ADDRESS_STR
@@ -15661,16 +19700,23 @@ static int wlan_hdd_tdls_add_station(struct wiphy *wiphy,
                                        pAdapter->sessionId, mac, StaParams);
     }
 
-     rc = wait_for_completion_timeout(&pAdapter->tdls_add_station_comp,
+    rc = wait_for_completion_timeout(&pAdapter->tdls_add_station_comp,
            msecs_to_jiffies(WAIT_TIME_TDLS_ADD_STA));
+    if (rc <= 0) {
+        hddLog(LOGE, FL("timeout waiting for tdls add station indication %ld"), ret);
+        goto error;
+    }
 
-    if (!rc) {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  "%s: timeout waiting for tdls add station indication",
-                  __func__);
-        return -EPERM;
+    mutex_lock(&pHddCtx->tdls_lock);
+    pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, mac, FALSE);
+
+    if (pTdlsPeer && (pTdlsPeer->link_status == eTDLS_LINK_TEARING)) {
+        hddLog(LOGE, FL("peer link status %u"), pTdlsPeer->link_status);
+        mutex_unlock(&pHddCtx->tdls_lock);
+        goto error;
     }
 
+    mutex_unlock(&pHddCtx->tdls_lock);
     if ( eHAL_STATUS_SUCCESS != pAdapter->tdlsAddStaStatus)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
@@ -15734,6 +19780,7 @@ static int __wlan_hdd_change_station(struct wiphy *wiphy,
     tANI_U8 isOffChannelSupported = 0;
     bool is_qos_wmm_sta = false;
 #endif
+    uint32_t  sub20_chanwidth;
     int ret;
 
     ENTER();
@@ -15767,11 +19814,22 @@ static int __wlan_hdd_change_station(struct wiphy *wiphy,
                        FL("Not able to change TL state to AUTHENTICATED"));
                 return -EINVAL;
             }
+
+            if (hdd_hostapd_sub20_channelwidth_can_switch(pAdapter,
+                                                          &sub20_chanwidth)) {
+                    WLANSAP_set_sub20_channelwidth_with_csa(
+                        WLAN_HDD_GET_SAP_CTX_PTR(pAdapter), sub20_chanwidth);
+            }
         }
     } else if ((pAdapter->device_mode == WLAN_HDD_INFRA_STATION) ||
                (pAdapter->device_mode == WLAN_HDD_P2P_CLIENT)) {
 #ifdef FEATURE_WLAN_TDLS
         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) {
+                if (hdd_cfg_is_sub20_channel_width_enabled(pHddCtx)) {
+                        hddLog(LOGE, FL("TDLS not allowed with sub 20 MHz"));
+                        return -EINVAL;
+                }
+
             StaParams.capability = params->capability;
             StaParams.uapsd_queues = params->uapsd_queues;
             StaParams.max_sp = params->max_sp;
@@ -15850,15 +19908,30 @@ static int __wlan_hdd_change_station(struct wiphy *wiphy,
                           "%s: After removing duplcates StaParams.supported_channels_len: %d",
                           __func__, StaParams.supported_channels_len);
             }
+            if (params->supported_oper_classes_len >
+                SIR_MAC_MAX_SUPP_OPER_CLASSES) {
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                          "received oper classes:%d, resetting it to max supported %d",
+                          params->supported_oper_classes_len,
+                          SIR_MAC_MAX_SUPP_OPER_CLASSES);
+                params->supported_oper_classes_len =
+                    SIR_MAC_MAX_SUPP_OPER_CLASSES;
+            }
             vos_mem_copy(StaParams.supported_oper_classes,
                          params->supported_oper_classes,
                          params->supported_oper_classes_len);
             StaParams.supported_oper_classes_len  =
                                              params->supported_oper_classes_len;
 
+            if (params->ext_capab_len > sizeof(StaParams.extn_capability)) {
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                          "received extn capabilities:%d, resetting it to max supported",
+                          params->ext_capab_len);
+                params->ext_capab_len = sizeof(StaParams.extn_capability);
+            }
             if (0 != params->ext_capab_len)
                 vos_mem_copy(StaParams.extn_capability, params->ext_capab,
-                             sizeof(StaParams.extn_capability));
+                             params->ext_capab_len);
 
             if (NULL != params->ht_capa) {
                 StaParams.htcap_present = 1;
@@ -15907,7 +19980,8 @@ static int __wlan_hdd_change_station(struct wiphy *wiphy,
             }
 
             if (pHddCtx->cfg_ini->fEnableTDLSWmmMode &&
-                (params->sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
+                (params->ht_capa || params->vht_capa ||
+                (params->sta_flags_set & BIT(NL80211_STA_FLAG_WME))))
                 is_qos_wmm_sta = true;
 
             hddLog(VOS_TRACE_LEVEL_INFO,
@@ -16030,15 +20104,24 @@ static int __wlan_hdd_cfg80211_add_key( struct wiphy *wiphy,
         return -EINVAL;
     }
 
+    if (CSR_MAX_RSC_LEN < params->seq_len)
+    {
+        hddLog(VOS_TRACE_LEVEL_ERROR,"%s: Invalid seq length %d", __func__,
+                params->seq_len);
+
+        return -EINVAL;
+    }
+
     hddLog(VOS_TRACE_LEVEL_INFO,
-           "%s: called with key index = %d & key length %d",
-           __func__, key_index, params->key_len);
+           "%s: called with key index = %d & key length %d & seq length %d",
+           __func__, key_index, params->key_len, params->seq_len);
 
     /*extract key idx, key len and key*/
     vos_mem_zero(&setKey,sizeof(tCsrRoamSetKey));
     setKey.keyId = key_index;
     setKey.keyLength = params->key_len;
     vos_mem_copy(&setKey.Key[0],params->key, params->key_len);
+    vos_mem_copy(&setKey.keyRsc[0], params->seq, params->seq_len);
 
     switch (params->cipher)
     {
@@ -16610,6 +20693,10 @@ static int __wlan_hdd_cfg80211_set_default_key( struct wiphy *wiphy,
         (pAdapter->device_mode == WLAN_HDD_P2P_CLIENT)) {
         if ((eCSR_ENCRYPT_TYPE_TKIP !=
                 pHddStaCtx->conn_info.ucEncryptionType) &&
+#ifdef FEATURE_WLAN_WAPI
+            (eCSR_ENCRYPT_TYPE_WPI !=
+                pHddStaCtx->conn_info.ucEncryptionType) &&
+#endif
             (eCSR_ENCRYPT_TYPE_AES !=
                 pHddStaCtx->conn_info.ucEncryptionType)) {
             /* If default key index is not same as previous one,
@@ -16712,20 +20799,9 @@ struct cfg80211_bss* wlan_hdd_cfg80211_update_bss_list(
     struct wiphy *wiphy = wdev->wiphy;
     struct cfg80211_bss *bss = NULL;
 
-    bss = cfg80211_get_bss(wiphy, NULL, bssid,
+    bss = hdd_cfg80211_get_bss(wiphy, NULL, bssid,
                            NULL,
-                           0,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 1, 0)) && !defined(WITH_BACKPORTS) \
-     && !defined(IEEE80211_PRIVACY)
-                           (pAdapter->device_mode == WLAN_HDD_IBSS) ? \
-                               WLAN_CAPABILITY_IBSS : WLAN_CAPABILITY_ESS,
-                           (pAdapter->device_mode == WLAN_HDD_IBSS) ? \
-                               WLAN_CAPABILITY_IBSS : WLAN_CAPABILITY_ESS);
-#else
-                           (pAdapter->device_mode == WLAN_HDD_IBSS) ? \
-                               IEEE80211_BSS_TYPE_IBSS : IEEE80211_BSS_TYPE_ESS,
-                           IEEE80211_PRIVACY_ANY);
-#endif
+                           0);
     if (bss == NULL) {
         hddLog(LOGE, FL("BSS not present"));
     } else {
@@ -16736,6 +20812,43 @@ struct cfg80211_bss* wlan_hdd_cfg80211_update_bss_list(
     return bss;
 }
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4 , 3, 0)) || \
+    defined (CFG80211_INFORM_BSS_FRAME_DATA)
+static struct cfg80211_bss *
+wlan_hdd_cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
+		struct ieee80211_channel *chan,
+		struct ieee80211_mgmt *mgmt,
+		size_t frame_len,
+		int rssi, gfp_t gfp,
+		uint64_t boottime_ns)
+{
+	struct cfg80211_bss *bss_status  = NULL;
+	struct cfg80211_inform_bss data  = {0};
+
+	data.chan = chan;
+	data.boottime_ns = boottime_ns;
+	data.signal = rssi;
+	bss_status = cfg80211_inform_bss_frame_data(wiphy, &data, mgmt,
+						    frame_len, gfp);
+	return bss_status;
+}
+#else
+static struct cfg80211_bss *
+wlan_hdd_cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
+		struct ieee80211_channel *chan,
+		struct ieee80211_mgmt *mgmt,
+		size_t frame_len,
+		int rssi, gfp_t gfp,
+		uint64_t boottime_ns)
+{
+	struct cfg80211_bss *bss_status = NULL;
+
+	bss_status = cfg80211_inform_bss_frame(wiphy, chan, mgmt, frame_len,
+					       rssi, gfp);
+	return bss_status;
+}
+#endif
+
 /*
  * FUNCTION: wlan_hdd_cfg80211_inform_bss_frame
  * This function is used to inform the BSS details to nl80211 interface.
@@ -16770,13 +20883,12 @@ wlan_hdd_cfg80211_inform_bss_frame( hdd_adapter_t *pAdapter,
     struct ieee80211_channel *chan;
     struct ieee80211_mgmt *mgmt = NULL;
     struct cfg80211_bss *bss_status = NULL;
-    size_t frame_len = sizeof (struct ieee80211_mgmt) + ie_length;
+    size_t frame_len = ie_length + offsetof(struct ieee80211_mgmt,
+                                               u.probe_resp.variable);
     int rssi = 0;
     hdd_context_t *pHddCtx;
     int status;
-#ifdef ANI_OS_TYPE_ANDROID
     struct timespec ts;
-#endif
     hdd_config_t *cfg_param = NULL;
 
     pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
@@ -16793,18 +20905,11 @@ wlan_hdd_cfg80211_inform_bss_frame( hdd_adapter_t *pAdapter,
 
     memcpy(mgmt->bssid, bss_desc->bssId, ETH_ALEN);
 
-#ifdef ANI_OS_TYPE_ANDROID
     /* Android does not want the time stamp from the frame.
        Instead it wants a monotonic increasing value */
     vos_get_monotonic_boottime_ts(&ts);
     mgmt->u.probe_resp.timestamp =
          ((u64)ts.tv_sec * 1000000) + (ts.tv_nsec / 1000);
-#else
-    /* keep old behavior for non-open source (for now) */
-    memcpy(&mgmt->u.probe_resp.timestamp, bss_desc->timeStamp,
-            sizeof (bss_desc->timeStamp));
-
-#endif
 
     mgmt->u.probe_resp.beacon_int = bss_desc->beaconInterval;
     mgmt->u.probe_resp.capab_info = bss_desc->capabilityInfo;
@@ -16820,7 +20925,14 @@ wlan_hdd_cfg80211_inform_bss_frame( hdd_adapter_t *pAdapter,
     qie_age->oui_2      = QCOM_OUI2;
     qie_age->oui_3      = QCOM_OUI3;
     qie_age->type       = QCOM_VENDOR_IE_AGE_TYPE;
-    qie_age->age        = vos_timer_get_system_time() - bss_desc->nReceivedTime;
+    /*
+     * Lowi expects the timestamp of bss in units of 1/10 ms. In driver all
+     * bss related timestamp is in units of ms. Due to this when scan results
+     * are sent to lowi the scan age is high.To address this, send age in units
+     * of 1/10 ms.
+     */
+    qie_age->age        = (vos_timer_get_system_time() -
+                                 bss_desc->nReceivedTime)/10;
     qie_age->tsf_delta  = bss_desc->tsf_delta;
 #endif
 
@@ -16886,12 +20998,14 @@ wlan_hdd_cfg80211_inform_bss_frame( hdd_adapter_t *pAdapter,
     /* Supplicant takes the signal strength in terms of mBm(100*dBm) */
     rssi = (VOS_MIN(rssi, 0)) * 100;
 
-    hddLog(LOG1, FL("BSSID: "MAC_ADDRESS_STR" Channel:%d RSSI:%d"),
+    hddLog(LOG1, "BSSID: "MAC_ADDRESS_STR" Channel:%d RSSI:%d",
            MAC_ADDR_ARRAY(mgmt->bssid),
            vos_freq_to_chan(chan->center_freq),(int)(rssi/100));
 
-    bss_status = cfg80211_inform_bss_frame(wiphy, chan, mgmt, frame_len, rssi,
-                                           GFP_KERNEL);
+    bss_status = wlan_hdd_cfg80211_inform_bss_frame_data(wiphy, chan, mgmt,
+                                                         frame_len, rssi,
+                                                         GFP_KERNEL,
+                                                   bss_desc->scansystimensec);
     kfree(mgmt);
     return bss_status;
 }
@@ -17193,6 +21307,55 @@ VOS_STATUS wlan_hdd_cfg80211_roam_metrics_handover(hdd_adapter_t * pAdapter,
 }
 #endif
 
+
+/**
+ * wlan_hdd_cfg80211_validate_scan_req - validate scan request
+ * @scan_req: scan request to be checked
+ *
+ * Return: true or false
+ */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+static inline bool wlan_hdd_cfg80211_validate_scan_req(struct
+                                                       cfg80211_scan_request
+                                                       *scan_req, hdd_context_t
+                                                       *hdd_ctx)
+{
+        if (!scan_req || !scan_req->wiphy ||
+            scan_req->wiphy != hdd_ctx->wiphy ) {
+                hddLog(VOS_TRACE_LEVEL_ERROR, "Invalid scan request");
+                return false;
+        }
+        if (vos_is_load_unload_in_progress(VOS_MODULE_ID_HDD, NULL)) {
+                /* As per CR1059683, not invoking cfg80211_scan_done when module
+                   load/unload is in progress, but this is causing assertion in
+                   cfg80211 in kernel. Hence setting scan_req->notified to avoid
+                   assertion. Kernel will take care of memory cleanup.
+                */
+                scan_req->notified = true;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0))
+                scan_req->info.aborted = true;
+#endif
+                hddLog(VOS_TRACE_LEVEL_ERROR, "Load/Unload in progress");
+                return false;
+        }
+        return true;
+}
+#else
+static inline bool wlan_hdd_cfg80211_validate_scan_req(struct
+                                                       cfg80211_scan_request
+                                                       *scan_req, hdd_context_t
+                                                       *hdd_ctx)
+{
+        if (!scan_req || !scan_req->wiphy ||
+            scan_req->wiphy != hdd_ctx->wiphy) {
+                hddLog(VOS_TRACE_LEVEL_ERROR, "Invalid scan request");
+                return false;
+        }
+        return true;
+}
+#endif
+
+
 /*
  * FUNCTION: hdd_cfg80211_scan_done_callback
  * scanning callback function, called after finishing scan
@@ -17232,14 +21395,14 @@ static eHalStatus hdd_cfg80211_scan_done_callback(tHalHandle halHandle,
     }
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
-    if (!(pAdapter->dev->flags & IFF_UP)) {
+    if (pAdapter->dev && !(pAdapter->dev->flags & IFF_UP)) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("Interface is down"));
         iface_down = true;
     }
 #endif
 
     hddLog(VOS_TRACE_LEVEL_INFO,
-            "%s called with halHandle = %p, pContext = %p,"
+            "%s called with halHandle = %pK, pContext = %pK,"
             "scanID = %d, returned status = %d",
             __func__, halHandle, pContext, (int) scanId, (int) status);
 
@@ -17292,9 +21455,10 @@ static eHalStatus hdd_cfg80211_scan_done_callback(tHalHandle halHandle,
                     vos_flush_logs(WLAN_LOG_TYPE_NON_FATAL,
                                    WLAN_LOG_INDICATOR_HOST_DRIVER,
                                    WLAN_LOG_REASON_NO_SCAN_RESULTS,
-                                   true);
+                                   DUMP_VOS_TRACE);
                     pHddCtx->last_scan_bug_report_timestamp = current_timestamp;
                 }
+                pHddCtx->last_scan_bug_report_timestamp = current_timestamp;
             }
         }
     }
@@ -17332,9 +21496,17 @@ static eHalStatus hdd_cfg80211_scan_done_callback(tHalHandle halHandle,
     /* Scan is no longer pending */
     pScanInfo->mScanPending = VOS_FALSE;
 
-    if (!req || req->wiphy == NULL)
+    if (!wlan_hdd_cfg80211_validate_scan_req(req, pHddCtx))
     {
-        hddLog(VOS_TRACE_LEVEL_ERROR, "request is became NULL");
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+            hddLog(VOS_TRACE_LEVEL_ERROR, FL("interface state %s"),
+                   iface_down ? "down" : "up");
+#endif
+        if (pAdapter->dev)
+        {
+            hddLog(VOS_TRACE_LEVEL_ERROR, FL("device name %s"),
+                   pAdapter->dev->name);
+        }
         complete(&pScanInfo->abortscan_event_var);
         goto allow_suspend;
     }
@@ -17351,7 +21523,17 @@ static eHalStatus hdd_cfg80211_scan_done_callback(tHalHandle halHandle,
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
     if (!iface_down)
 #endif
+    {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0))
+        struct cfg80211_scan_info info = {
+                        .aborted = aborted,
+        };
+
+        cfg80211_scan_done(req, &info);
+#else
         cfg80211_scan_done(req, aborted);
+#endif
+    }
 
     complete(&pScanInfo->abortscan_event_var);
 
@@ -17380,23 +21562,144 @@ allow_suspend:
     return 0;
 }
 
+/**
+ * hdd_is_sta_in_middle_of_eapol() - to check STA connection Status
+ * @adapter: Pointer to Global MAC Structure
+ * @session_id: session id
+ * @reason: scan reject reason
+ *
+ * This function is used to check the connection status of STA/P2P Client
+ *
+ * Return: true or false
+ */
+static bool hdd_is_sta_in_middle_of_eapol(hdd_adapter_t *adapter,
+			v_U8_t *session_id, scan_reject_states *reason)
+{
+	hdd_station_ctx_t *hdd_sta_ctx = NULL;
+	v_U8_t *sta_mac = NULL;
+
+	hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+	if ((eConnectionState_Associated == hdd_sta_ctx->conn_info.connState) &&
+	    (VOS_FALSE == hdd_sta_ctx->conn_info.uIsAuthenticated)) {
+		sta_mac = (v_U8_t *) &(adapter->macAddressCurrent.bytes[0]);
+		hddLog(LOG1, FL("client " MAC_ADDRESS_STR " is in the middle of WPS/EAPOL exchange."),
+			MAC_ADDR_ARRAY(sta_mac));
+		if (session_id && reason) {
+			*session_id = adapter->sessionId;
+			*reason = eHDD_EAPOL_IN_PROGRESS;
+		}
+		return true;
+	}
+	return false;
+}
+
+/**
+ * hdd_is_sap_in_middle_of_eapol() - to check SAP connection Status
+ * @adapter: Pointer to Global MAC Structure
+ * @session_id: session id
+ * @reason: scan reject reason
+ *
+ * This function is used to check the connection status of SAP/P2P GO
+ *
+ * Return: true or false
+ */
+static bool hdd_is_sap_in_middle_of_eapol(hdd_adapter_t *adapter,
+			v_U8_t *session_id, scan_reject_states *reason)
+{
+	v_U8_t sta_id = 0;
+	v_U8_t *sta_mac = NULL;
+
+	for (sta_id = 0; sta_id < WLAN_MAX_STA_COUNT; sta_id++) {
+		if ((adapter->aStaInfo[sta_id].isUsed) &&
+		    (WLANTL_STA_CONNECTED ==
+		     adapter->aStaInfo[sta_id].tlSTAState)) {
+			sta_mac = (v_U8_t *) &(adapter->aStaInfo[sta_id].
+				macAddrSTA.bytes[0]);
+
+			hddLog(LOG1, FL("client " MAC_ADDRESS_STR " of SoftAP/P2P-GO is in the middle of WPS/EAPOL exchange."),
+				MAC_ADDR_ARRAY(sta_mac));
+			if (session_id && reason) {
+				*session_id = adapter->sessionId;
+				*reason = eHDD_SAP_EAPOL_IN_PROGRESS;
+			}
+			return true;
+		}
+	}
+	return false;
+}
+
+/**
+ * hdd_check_connection_status() - to check connection Status
+ * @adapter: Pointer to Global MAC Structure
+ * @session_id: session id
+ * @reason: scan reject reason
+ *
+ * This function is used to check the connection status
+ *
+ * Return: true or false
+ */
+static bool hdd_check_connection_status(hdd_adapter_t *adapter,
+			v_U8_t *session_id, scan_reject_states *reason)
+{
+	hddLog(LOG1, FL("Adapter with device mode %s(%d) exists"),
+		hdd_device_mode_to_string(adapter->device_mode),
+		adapter->device_mode);
+	if (((WLAN_HDD_INFRA_STATION == adapter->device_mode) ||
+	     (WLAN_HDD_P2P_CLIENT == adapter->device_mode) ||
+	     (WLAN_HDD_P2P_DEVICE == adapter->device_mode)) &&
+	    (eConnectionState_Connecting ==
+	     (WLAN_HDD_GET_STATION_CTX_PTR(adapter))->conn_info.connState)) {
+		hddLog(LOG1, FL("%pK(%d) Connection is in progress"),
+			WLAN_HDD_GET_STATION_CTX_PTR(adapter),
+			adapter->sessionId);
+		if (session_id && reason) {
+			*session_id = adapter->sessionId;
+			*reason = eHDD_CONNECTION_IN_PROGRESS;
+		}
+		return true;
+	}
+	if ((WLAN_HDD_INFRA_STATION == adapter->device_mode) &&
+	    smeNeighborMiddleOfRoaming(WLAN_HDD_GET_HAL_CTX(adapter),
+					adapter->sessionId)) {
+		hddLog(LOG1, FL("%pK(%d) Reassociation is in progress"),
+			WLAN_HDD_GET_STATION_CTX_PTR(adapter),
+			adapter->sessionId);
+		if (session_id && reason) {
+			*session_id = adapter->sessionId;
+			*reason = eHDD_REASSOC_IN_PROGRESS;
+		}
+		return true;
+	}
+	if ((WLAN_HDD_INFRA_STATION == adapter->device_mode) ||
+	    (WLAN_HDD_P2P_CLIENT == adapter->device_mode) ||
+	    (WLAN_HDD_P2P_DEVICE == adapter->device_mode)) {
+		if(hdd_is_sta_in_middle_of_eapol(adapter, session_id, reason))
+			return true;
+	} else if ((WLAN_HDD_SOFTAP == adapter->device_mode) ||
+		   (WLAN_HDD_P2P_GO == adapter->device_mode)) {
+		if(hdd_is_sap_in_middle_of_eapol(adapter, session_id, reason))
+			return true;
+	}
+	return false;
+}
+
+
 /*
  * hdd_isConnectionInProgress() - HDD function to check connection in progress
  * @pHddCtx - HDD context
- * @is_roc - roc
+ * @session_id: session id
+ * @reason: scan reject reason
  *
  * Go through each adapter and check if Connection is in progress
  *
  * Return: true if connection in progress; false otherwise.
  */
-bool hdd_isConnectionInProgress(hdd_context_t *pHddCtx)
+bool hdd_isConnectionInProgress(hdd_context_t *pHddCtx, v_U8_t *session_id,
+				scan_reject_states *reason)
 {
 	hdd_adapter_list_node_t *pAdapterNode = NULL, *pNext = NULL;
-	hdd_station_ctx_t *pHddStaCtx = NULL;
 	hdd_adapter_t *pAdapter = NULL;
 	VOS_STATUS status = 0;
-	v_U8_t staId = 0;
-	v_U8_t *staMac = NULL;
 
 	if (TRUE == pHddCtx->btCoexModeSet) {
 		hddLog(LOG1, FL("BTCoex Mode operation in progress"));
@@ -17408,76 +21711,9 @@ bool hdd_isConnectionInProgress(hdd_context_t *pHddCtx)
 	while (NULL != pAdapterNode && VOS_STATUS_SUCCESS == status) {
 		pAdapter = pAdapterNode->pAdapter;
 
-		if (pAdapter) {
-			hddLog(LOG1, FL("Adapter with device mode %s(%d) exists"),
-				hdd_device_mode_to_string(pAdapter->device_mode),
-				pAdapter->device_mode);
-			if (((WLAN_HDD_INFRA_STATION ==
-					pAdapter->device_mode) ||
-				(WLAN_HDD_P2P_CLIENT ==
-					pAdapter->device_mode) ||
-				(WLAN_HDD_P2P_DEVICE ==
-					pAdapter->device_mode)) &&
-				(eConnectionState_Connecting ==
-				(WLAN_HDD_GET_STATION_CTX_PTR(pAdapter))->
-					conn_info.connState)) {
-				hddLog(LOGE,
-					FL("%p(%d) Connection is in progress"),
-					WLAN_HDD_GET_STATION_CTX_PTR(pAdapter),
-					pAdapter->sessionId);
-				return true;
-			}
-			if ((WLAN_HDD_INFRA_STATION == pAdapter->device_mode) &&
-				smeNeighborMiddleOfRoaming(
-				WLAN_HDD_GET_HAL_CTX(pAdapter), pAdapter->sessionId))
-			{
-				hddLog(VOS_TRACE_LEVEL_ERROR,
-				"%s: %p(%d) Reassociation is in progress", __func__,
-				WLAN_HDD_GET_STATION_CTX_PTR(pAdapter), pAdapter->sessionId);
-				return VOS_TRUE;
-			}
-			if ((WLAN_HDD_INFRA_STATION ==
-					pAdapter->device_mode) ||
-				(WLAN_HDD_P2P_CLIENT ==
-					pAdapter->device_mode) ||
-				(WLAN_HDD_P2P_DEVICE ==
-					pAdapter->device_mode)) {
-				pHddStaCtx =
-					WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-				if ((eConnectionState_Associated ==
-					pHddStaCtx->conn_info.connState) &&
-					(VOS_FALSE ==
-						pHddStaCtx->conn_info.
-							uIsAuthenticated)) {
-					staMac = (v_U8_t *) &(pAdapter->
-						macAddressCurrent.bytes[0]);
-					hddLog(LOGE,
-						FL("client " MAC_ADDRESS_STR " is in the middle of WPS/EAPOL exchange."),
-						MAC_ADDR_ARRAY(staMac));
-					return true;
-				}
-			} else if ((WLAN_HDD_SOFTAP == pAdapter->device_mode) ||
-				   (WLAN_HDD_P2P_GO == pAdapter->device_mode)) {
-				for (staId = 0; staId < WLAN_MAX_STA_COUNT;
-					staId++) {
-					if ((pAdapter->aStaInfo[staId].
-							isUsed) &&
-						(WLANTL_STA_CONNECTED ==
-						 pAdapter->aStaInfo[staId].
-								tlSTAState)) {
-						staMac = (v_U8_t *) &(pAdapter->
-							aStaInfo[staId].
-							macAddrSTA.bytes[0]);
-
-					hddLog(LOGE,
-						FL("client " MAC_ADDRESS_STR " of SoftAP/P2P-GO is in the "
-						"middle of WPS/EAPOL exchange."),
-						MAC_ADDR_ARRAY(staMac));
-					return true;
-					}
-				}
-			}
-		}
+		if (pAdapter)
+			hdd_check_connection_status(pAdapter, session_id,
+						    reason);
 		status = hdd_get_next_adapter(pHddCtx, pAdapterNode, &pNext);
 		pAdapterNode = pNext;
 	}
@@ -17544,7 +21780,7 @@ static bool wlan_hdd_sap_skip_scan_check(hdd_context_t *hdd_ctx,
 }
 #endif
 
-static void wlan_hdd_cfg80211_scan_block_cb(struct work_struct *work)
+void wlan_hdd_cfg80211_scan_block_cb(struct work_struct *work)
 {
     hdd_adapter_t *adapter = container_of(work,
                                    hdd_adapter_t, scan_block_work);
@@ -17563,11 +21799,104 @@ static void wlan_hdd_cfg80211_scan_block_cb(struct work_struct *work)
         hddLog(LOGE,
                 "%s:##In DFS Master mode. Scan aborted. Null result sent",
                  __func__);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0))
+       {
+            struct cfg80211_scan_info info = {
+                            .aborted = true,
+            };
+
+            cfg80211_scan_done(request, &info);
+       }
+#else
         cfg80211_scan_done(request, true);
+#endif
         adapter->request = NULL;
     }
 }
 
+#ifdef CFG80211_SCAN_RANDOM_MAC_ADDR
+/**
+ * wlan_hdd_update_scan_rand_attrs - fill the host/pno scan rand attrs
+ * @scan_req: pointer for destination mac addr and mac mask
+ * @cfg_scan_req: pointer for source mac addr and mac mask
+ * @scan_type: type of scan from enum wlan_hdd_scan_type_for_randomization
+ *
+ * If scan randomize flag is set in cfg scan request flags, this function
+ * copies mac addr and mac mask in cfg80211 scan/sched scan request to
+ * randomization attributes in tCsrScanRequest (normal scan) or
+ * tpSirPNOScanReq (sched scan). Based on the type of scan, scan_req and
+ * cfg_scan_req are type casted accordingly.
+ *
+ * Return:   Return none
+ */
+static void wlan_hdd_update_scan_rand_attrs(void *scan_req,
+					    void *cfg_scan_req,
+					    uint32_t scan_type)
+{
+	uint32_t flags = 0;
+	uint8_t *cfg_mac_addr = NULL;
+	uint8_t *cfg_mac_addr_mask = NULL;
+	uint32_t *scan_randomization = NULL;
+	uint8_t *scan_mac_addr = NULL;
+	uint8_t *scan_mac_addr_mask = NULL;
+
+	if (scan_type == WLAN_HDD_HOST_SCAN) {
+		tCsrScanRequest *csr_scan_req = NULL;
+		struct cfg80211_scan_request *request = NULL;
+
+		csr_scan_req = (tCsrScanRequest *)scan_req;
+		request = (struct cfg80211_scan_request *)cfg_scan_req;
+
+		flags = request->flags;
+		if (!(flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
+			return;
+
+		cfg_mac_addr = request->mac_addr;
+		cfg_mac_addr_mask = request->mac_addr_mask;
+		scan_randomization = &csr_scan_req->enable_scan_randomization;
+		scan_mac_addr = csr_scan_req->mac_addr;
+		scan_mac_addr_mask = csr_scan_req->mac_addr_mask;
+	} else if (scan_type == WLAN_HDD_PNO_SCAN) {
+		tpSirPNOScanReq pno_scan_req = NULL;
+		struct cfg80211_sched_scan_request *request = NULL;
+
+		pno_scan_req = (tpSirPNOScanReq)scan_req;
+		request = (struct cfg80211_sched_scan_request *)cfg_scan_req;
+
+		flags = request->flags;
+		if (!(flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
+			return;
+
+		cfg_mac_addr = request->mac_addr;
+		cfg_mac_addr_mask = request->mac_addr_mask;
+		scan_randomization =
+				&pno_scan_req->enable_pno_scan_randomization;
+		scan_mac_addr = pno_scan_req->mac_addr;
+		scan_mac_addr_mask = pno_scan_req->mac_addr_mask;
+	} else {
+		hddLog(LOGE, FL("invalid scan type for randomization"));
+		return;
+	}
+
+	/* enable mac randomization */
+	*scan_randomization = 1;
+	memcpy(scan_mac_addr, cfg_mac_addr, VOS_MAC_ADDR_SIZE);
+	memcpy(scan_mac_addr_mask, cfg_mac_addr_mask, VOS_MAC_ADDR_SIZE);
+
+	hddLog(LOG1, FL("Mac Addr: "MAC_ADDRESS_STR
+			" and Mac Mask: " MAC_ADDRESS_STR),
+			MAC_ADDR_ARRAY(scan_mac_addr),
+			MAC_ADDR_ARRAY(scan_mac_addr_mask));
+}
+#else
+static void wlan_hdd_update_scan_rand_attrs(void *scan_req,
+					    void *cfg_scan_req,
+					    uint32_t scan_type)
+{
+	return;
+}
+#endif
+
 /*
  * FUNCTION: __wlan_hdd_cfg80211_scan
  * this scan respond to scan trigger and update cfg80211 scan database
@@ -17585,6 +21914,7 @@ int __wlan_hdd_cfg80211_scan( struct wiphy *wiphy,
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR( dev );
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX( pAdapter );
     hdd_wext_state_t *pwextBuf = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
+    hdd_station_ctx_t *station_ctx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
     hdd_config_t *cfg_param = NULL;
     tCsrScanRequest scanRequest;
     tANI_U8 *channelList = NULL, i;
@@ -17596,6 +21926,9 @@ int __wlan_hdd_cfg80211_scan( struct wiphy *wiphy,
     uint16_t con_dfs_ch;
     bool is_p2p_scan = false;
     uint8_t num_chan = 0;
+    v_U8_t curr_session_id;
+    scan_reject_states curr_reason;
+    static uint32_t scan_ebusy_cnt;
 
     ENTER();
 
@@ -17640,19 +21973,17 @@ int __wlan_hdd_cfg80211_scan( struct wiphy *wiphy,
 
             pAdapter->request = request;
 
-            vos_init_work(&pAdapter->scan_block_work,
-                                            wlan_hdd_cfg80211_scan_block_cb);
-
             schedule_work(&pAdapter->scan_block_work);
             return 0;
         }
     }
 
-    if (TRUE == pScanInfo->mScanPending)
-    {
-        if ( MAX_PENDING_LOG > pScanInfo->mScanPendingCounter++ )
-        {
-            hddLog(VOS_TRACE_LEVEL_ERROR, "%s: mScanPending is TRUE", __func__);
+    if (TRUE == pScanInfo->mScanPending) {
+        scan_ebusy_cnt++;
+
+        if (MAX_PENDING_LOG > pScanInfo->mScanPendingCounter++) {
+            hddLog(LOGE, "%s: mScanPending is TRUE scan_ebusy_cnt: %u",
+                   __func__, scan_ebusy_cnt);
         }
         return -EBUSY;
     }
@@ -17661,9 +21992,11 @@ int __wlan_hdd_cfg80211_scan( struct wiphy *wiphy,
     //Channel and action frame is pending
     //Otherwise Cancel Remain On Channel and allow Scan
     //If no action frame pending
-    if (0 != wlan_hdd_check_remain_on_channel(pAdapter))
-    {
-        hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Remain On Channel Pending", __func__);
+    if (0 != wlan_hdd_check_remain_on_channel(pAdapter)) {
+        scan_ebusy_cnt++;
+        hddLog(LOGE, "%s: Remain On Channel Pending. scan_ebusy_cnt: %u",
+               __func__, scan_ebusy_cnt);
+
         return -EBUSY;
     }
 #ifdef FEATURE_WLAN_TDLS
@@ -17699,25 +22032,63 @@ int __wlan_hdd_cfg80211_scan( struct wiphy *wiphy,
     if (TRUE == pHddCtx->tmInfo.tmAction.enterImps)
     {
         mutex_unlock(&pHddCtx->tmInfo.tmOperationLock);
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-               "%s: MAX TM Level Scan not allowed", __func__);
+        scan_ebusy_cnt++;
+        hddLog(LOGE, "%s: MAX TM Level Scan not allowed. scan_ebusy_cnt: %u",
+               __func__, scan_ebusy_cnt);
+
         return -EBUSY;
     }
     mutex_unlock(&pHddCtx->tmInfo.tmOperationLock);
 
     /* Check if scan is allowed at this point of time.
      */
-    if (hdd_isConnectionInProgress(pHddCtx)) {
-        hddLog(LOGE, FL("Scan not allowed"));
+    if (hdd_isConnectionInProgress(pHddCtx, &curr_session_id, &curr_reason)) {
+        scan_ebusy_cnt++;
+	if (!(pHddCtx->scan_reject_cnt % HDD_SCAN_REJECT_RATE_LIMIT))
+	    hddLog(LOGE, FL("Scan not allowed Session %d reason %d"),
+		curr_session_id, curr_reason);
+
+        if (pHddCtx->last_scan_reject_session_id != curr_session_id ||
+            pHddCtx->last_scan_reject_reason != curr_reason ||
+            !pHddCtx->last_scan_reject_timestamp) {
+            pHddCtx->last_scan_reject_session_id = curr_session_id;
+            pHddCtx->last_scan_reject_reason = curr_reason;
+            pHddCtx->last_scan_reject_timestamp =
+              jiffies_to_msecs(jiffies) + SCAN_REJECT_THRESHOLD_TIME;
+            pHddCtx->scan_reject_cnt = 0;
+        } else {
+            pHddCtx->scan_reject_cnt++;
+            if ((pHddCtx->scan_reject_cnt >=
+               SCAN_REJECT_THRESHOLD) &&
+               vos_system_time_after(jiffies_to_msecs(jiffies),
+               pHddCtx->last_scan_reject_timestamp)) {
+		hddLog(LOGE, FL("scan reject threshold reached Session %d reason %d reject cnt %d"),
+			curr_session_id, curr_reason, pHddCtx->scan_reject_cnt);
+                pHddCtx->last_scan_reject_timestamp = 0;
+                pHddCtx->scan_reject_cnt = 0;
+                if (pHddCtx->cfg_ini->enable_fatal_event) {
+                    vos_flush_logs(WLAN_LOG_TYPE_FATAL,
+                          WLAN_LOG_INDICATOR_HOST_DRIVER,
+                          WLAN_LOG_REASON_SCAN_NOT_ALLOWED,
+                          DUMP_NO_TRACE);
+                } else {
+                    hddLog(LOGE, FL("Triggering SSR due to scan stuck"));
+                    vos_wlanRestart();
+                }
+            }
+         }
         return -EBUSY;
     }
+    pHddCtx->last_scan_reject_timestamp = 0;
+    pHddCtx->last_scan_reject_session_id = 0xFF;
+    pHddCtx->last_scan_reject_reason = 0;
+    pHddCtx->scan_reject_cnt = 0;
+
     /* Check whether SAP scan can be skipped or not */
     if (pAdapter->device_mode == WLAN_HDD_SOFTAP &&
        wlan_hdd_sap_skip_scan_check(pHddCtx, request)) {
         hddLog(LOGE, FL("sap scan skipped"));
         pAdapter->request = request;
-        vos_init_work(&pAdapter->scan_block_work,
-                  wlan_hdd_cfg80211_scan_block_cb);
         schedule_work(&pAdapter->scan_block_work);
         return 0;
     }
@@ -17775,13 +22146,29 @@ int __wlan_hdd_cfg80211_scan( struct wiphy *wiphy,
          *Set the scan type to passive if there is no ssid list provided else
          *set default type configured in the driver.
          */
-        if (!request->ssids)
-            scanRequest.scanType = eSIR_PASSIVE_SCAN;
+        if (!request->ssids) {
+            /* In case of AP+AP there is a reason to fix scanType to
+             * ACTIVE, historically this is to increase probablity of
+             * successfull OBSS scan
+             */
+            if((WLAN_HDD_SOFTAP == pAdapter->device_mode) && \
+               (pHddCtx->no_of_active_sessions[VOS_STA_SAP_MODE] > 1)) {
+                scanRequest.scanType = eSIR_ACTIVE_SCAN;
+            }
+            else {
+                scanRequest.scanType = eSIR_PASSIVE_SCAN;
+            }
+        }
         else
             scanRequest.scanType = pHddCtx->ioctl_scan_mode;
     }
-    scanRequest.minChnTime = cfg_param->nActiveMinChnTime;
-    scanRequest.maxChnTime = cfg_param->nActiveMaxChnTime;
+    if (scanRequest.scanType == eSIR_PASSIVE_SCAN) {
+        scanRequest.minChnTime = cfg_param->nPassiveMinChnTime;
+        scanRequest.maxChnTime = cfg_param->nPassiveMaxChnTime;
+    } else {
+        scanRequest.minChnTime = cfg_param->nActiveMinChnTime;
+        scanRequest.maxChnTime = cfg_param->nActiveMaxChnTime;
+    }
 
 #ifdef CFG80211_SCAN_BSSID
     vos_mem_copy(scanRequest.bssid, request->bssid, VOS_MAC_ADDR_SIZE);
@@ -17957,6 +22344,32 @@ int __wlan_hdd_cfg80211_scan( struct wiphy *wiphy,
                 pAdapter->sessionId);
 #endif
 
+    wlan_hdd_update_scan_rand_attrs((void *)&scanRequest, (void *)request,
+                                    WLAN_HDD_HOST_SCAN);
+
+    if (pAdapter->device_mode == WLAN_HDD_INFRA_STATION &&
+        !is_p2p_scan &&
+        !hdd_connIsConnected(station_ctx) &&
+        (pHddCtx->cfg_ini->probe_req_ie_whitelist)) {
+        if (pHddCtx->no_of_probe_req_ouis != 0) {
+            scanRequest.voui = (struct vendor_oui *)vos_mem_malloc(
+                                              pHddCtx->no_of_probe_req_ouis *
+                                              sizeof(struct vendor_oui));
+            if (!scanRequest.voui) {
+                hddLog(LOGE, FL("Not enough memory for voui"));
+                scanRequest.num_vendor_oui = 0;
+                status = -ENOMEM;
+                goto free_mem;
+            }
+        }
+
+        wlan_hdd_fill_whitelist_ie_attrs(&scanRequest.ie_whitelist,
+                                         scanRequest.probe_req_ie_bitmap,
+                                         &scanRequest.num_vendor_oui,
+                                         scanRequest.voui,
+                                         pHddCtx);
+    }
+
     vos_runtime_pm_prevent_suspend(pHddCtx->runtime_context.scan);
     status = sme_ScanRequest( WLAN_HDD_GET_HAL_CTX(pAdapter),
                               pAdapter->sessionId, &scanRequest, &scanId,
@@ -17967,14 +22380,13 @@ int __wlan_hdd_cfg80211_scan( struct wiphy *wiphy,
         hddLog(VOS_TRACE_LEVEL_ERROR,
                 "%s: sme_ScanRequest returned error %d", __func__, status);
         complete(&pScanInfo->scan_req_completion_event);
-        if(eHAL_STATUS_RESOURCES == status)
-        {
-           hddLog(VOS_TRACE_LEVEL_ERROR, "%s: HO is in progress.So defer the scan by informing busy",
-                  __func__);
+        if (eHAL_STATUS_RESOURCES == status) {
+           scan_ebusy_cnt++;
+           hddLog(LOGE, FL("HO is in progress. Defer scan by informing busy scan_ebusy_cnt: %u"),
+                  scan_ebusy_cnt);
+
            status = -EBUSY;
-        }
-        else
-        {
+        } else {
            status = -EIO;
         }
 
@@ -17998,6 +22410,12 @@ free_mem:
     if( channelList )
       vos_mem_free( channelList );
 
+    if(scanRequest.voui)
+        vos_mem_free(scanRequest.voui);
+
+    if (status == 0)
+        scan_ebusy_cnt = 0;
+
     EXIT();
     return status;
 }
@@ -18022,20 +22440,16 @@ int wlan_hdd_cfg80211_scan( struct wiphy *wiphy,
 }
 
 void hdd_select_cbmode(hdd_adapter_t *pAdapter, v_U8_t operationChannel,
-                uint16_t *vht_channel_width)
+                       uint16_t *vht_channel_width)
 {
     v_U8_t iniDot11Mode =
                (WLAN_HDD_GET_CTX(pAdapter))->cfg_ini->dot11Mode;
     eHddDot11Mode   hddDot11Mode = iniDot11Mode;
-    hdd_station_ctx_t *station_ctx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-    uint32_t cb_mode;
-    struct hdd_mon_set_ch_info *ch_info = &station_ctx->ch_info;
 
     hddLog(LOG1, FL("Channel Bonding Mode Selected is %u"),
            iniDot11Mode);
-    if (VOS_MONITOR_MODE != hdd_get_conparam())
-        *vht_channel_width =
-                  (WLAN_HDD_GET_CTX(pAdapter))->cfg_ini->vhtChannelWidth;
+    *vht_channel_width =
+               (WLAN_HDD_GET_CTX(pAdapter))->cfg_ini->vhtChannelWidth;
 
     /*
      * In IBSS mode while operating in 2.4 GHz,
@@ -18068,22 +22482,72 @@ void hdd_select_cbmode(hdd_adapter_t *pAdapter, v_U8_t operationChannel,
           break;
     }
      /* This call decides required channel bonding mode */
-    cb_mode = sme_SelectCBMode((WLAN_HDD_GET_CTX(pAdapter)->hHal),
+    sme_SelectCBMode((WLAN_HDD_GET_CTX(pAdapter)->hHal),
                      hdd_cfg_xlate_to_csr_phy_mode(hddDot11Mode),
                      operationChannel, 0,
                      vht_channel_width,
                      *vht_channel_width);
+}
+
+/**
+ * hdd_select_mon_cbmode() - This function will handle channel bonding mode
+                             for monitor mode.
+ * @adapter: pointer to hdd adapter.
+ * @operation_channel: operating channel.
+ * @vht_channel_width: pointer to channel width.
+ *
+ *
+ * Return: None.
+ */
+void hdd_select_mon_cbmode(hdd_adapter_t *adapter, v_U8_t operation_channel,
+                uint16_t *vht_channel_width)
+{
+    v_U8_t ini_dot11_mode = (WLAN_HDD_GET_CTX(adapter))->cfg_ini->dot11Mode;
+    eHddDot11Mode   hdd_dot11_mode = ini_dot11_mode;
+    hdd_station_ctx_t *station_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+    uint32_t cb_mode;
+    struct hdd_mon_set_ch_info *ch_info = &station_ctx->ch_info;
+
+    hddLog(LOG1, FL("Channel Bonding Mode Selected is %u"), ini_dot11_mode);
 
-    if (VOS_MONITOR_MODE == hdd_get_conparam()) {
-        ch_info->channel_width = *vht_channel_width;
-        ch_info->phy_mode = hdd_cfg_xlate_to_csr_phy_mode(hddDot11Mode);
-        ch_info->channel = operationChannel;
-        ch_info->cb_mode = cb_mode;
-        hddLog(LOG1, FL("ch_info width %d, phymode %d channel %d"),
-               ch_info->channel_width, ch_info->phy_mode, ch_info->channel);
+    switch ( ini_dot11_mode )
+    {
+       case eHDD_DOT11_MODE_AUTO:
+       case eHDD_DOT11_MODE_11ac:
+       case eHDD_DOT11_MODE_11ac_ONLY:
+#ifdef WLAN_FEATURE_11AC
+          if (sme_IsFeatureSupportedByFW(DOT11AC))
+              hdd_dot11_mode = eHDD_DOT11_MODE_11ac;
+          else
+              hdd_dot11_mode = eHDD_DOT11_MODE_11n;
+#else
+          hdd_dot11_mode = eHDD_DOT11_MODE_11n;
+#endif
+          break;
+       case eHDD_DOT11_MODE_11n:
+       case eHDD_DOT11_MODE_11n_ONLY:
+          hdd_dot11_mode = eHDD_DOT11_MODE_11n;
+          break;
+       default:
+          hdd_dot11_mode = ini_dot11_mode;
+          break;
     }
+    /* This call decides required channel bonding mode */
+    cb_mode = sme_SelectCBMode((WLAN_HDD_GET_CTX(adapter)->hHal),
+                     hdd_cfg_xlate_to_csr_phy_mode(hdd_dot11_mode),
+                     operation_channel, 0,
+                     vht_channel_width,
+                     *vht_channel_width);
+
+    ch_info->channel_width = *vht_channel_width;
+    ch_info->phy_mode = hdd_cfg_xlate_to_csr_phy_mode(hdd_dot11_mode);
+    ch_info->channel = operation_channel;
+    ch_info->cb_mode = cb_mode;
+    hddLog(LOG1, FL("ch_info width %d, phymode %d channel %d"),
+           ch_info->channel_width, ch_info->phy_mode, ch_info->channel);
 }
 
+
 /**
  * wlan_hdd_sta_sap_concur_handle() - This function will handle Station and sap
  *                                    concurrency.
@@ -18281,6 +22745,7 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
     int status = 0;
     hdd_wext_state_t *pWextState;
     hdd_context_t *pHddCtx;
+    hdd_station_ctx_t *hdd_sta_ctx;
     v_U32_t roamId;
     tCsrRoamProfile *pRoamProfile;
     eCsrAuthType RSNAuthType;
@@ -18290,6 +22755,7 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
 
     pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
     pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
 
     status = wlan_hdd_validate_context(pHddCtx);
     if (status)
@@ -18306,8 +22772,13 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
         return -EINVAL;
     }
 
+    wlan_hdd_tdls_disable_offchan_and_teardown_links(pHddCtx);
+
     pRoamProfile = &pWextState->roamProfile;
 
+    adf_os_mem_zero(&hdd_sta_ctx->conn_info.conn_flag,
+                    sizeof(hdd_sta_ctx->conn_info.conn_flag));
+
     if (pRoamProfile)
     {
         hdd_station_ctx_t *pHddStaCtx;
@@ -18326,6 +22797,12 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
                      (WLAN_HDD_GET_CTX(pAdapter))->cfg_ini->UapsdMask;
         }
 
+        if (NULL == pRoamProfile->SSIDs.SSIDList)
+        {
+             hddLog(VOS_TRACE_LEVEL_ERROR, "%s: SSIDList NULL ", __func__);
+             return -EINVAL;
+        }
+
         pRoamProfile->SSIDs.numOfSSIDs = 1;
         pRoamProfile->SSIDs.SSIDList->SSID.length = ssid_len;
         vos_mem_zero(pRoamProfile->SSIDs.SSIDList->SSID.ssId,
@@ -18333,9 +22810,11 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
         vos_mem_copy((void *)(pRoamProfile->SSIDs.SSIDList->SSID.ssId),
                 ssid, ssid_len);
 
-        pRoamProfile->do_not_roam = false;
-        if (bssid)
-        {
+        /* cleanup bssid hint and bssid */
+        vos_mem_zero(pRoamProfile->bssid_hint, VOS_MAC_ADDR_SIZE);
+        vos_mem_zero(pRoamProfile->BSSIDs.bssid, VOS_MAC_ADDR_SIZE);
+
+        if (bssid) {
             pRoamProfile->BSSIDs.numOfBSSIDs = 1;
             pRoamProfile->do_not_roam = true;
             vos_mem_copy((void *)(pRoamProfile->BSSIDs.bssid), bssid,
@@ -18346,11 +22825,8 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
              */
             vos_mem_copy((void *)(pWextState->req_bssId), bssid,
                     VOS_MAC_ADDR_SIZE);
-        }
-        else if (bssid_hint)
-        {
-            pRoamProfile->BSSIDs.numOfBSSIDs = 1;
-            vos_mem_copy((void *)(pRoamProfile->BSSIDs.bssid), bssid_hint,
+        } else if (bssid_hint) {
+            vos_mem_copy(pRoamProfile->bssid_hint, bssid_hint,
                     VOS_MAC_ADDR_SIZE);
             /* Save BSSID in separate variable as well, as RoamProfile
                BSSID is getting zeroed out in the association process. And in
@@ -18360,11 +22836,6 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
                     VOS_MAC_ADDR_SIZE);
             hddLog(LOGW, FL(" bssid_hint "MAC_ADDRESS_STR),
                    MAC_ADDR_ARRAY(bssid_hint));
-
-        }
-        else
-        {
-            vos_mem_zero((void *)(pRoamProfile->BSSIDs.bssid), VOS_MAC_ADDR_SIZE);
         }
 
         hddLog(LOG1, FL("Connect to SSID: %.*s operating Channel: %u"),
@@ -18601,8 +23072,12 @@ static int wlan_hdd_cfg80211_set_auth_type(hdd_adapter_t *pAdapter,
             pHddStaCtx->conn_info.authType = eCSR_AUTH_TYPE_CCKM_WPA;//eCSR_AUTH_TYPE_CCKM_RSN needs to be handled as well if required.
             break;
 #endif
-
-
+#if defined(WLAN_FEATURE_FILS_SK) && defined(CFG80211_FILS_SK_OFFLOAD_SUPPORT)
+        case NL80211_AUTHTYPE_FILS_SK:
+            hddLog(LOG1, "set authentication type to FILS SHARED KEY");
+            pHddStaCtx->conn_info.authType = eCSR_AUTH_TYPE_OPEN_SYSTEM;
+            break;
+#endif
         default:
             hddLog(VOS_TRACE_LEVEL_ERROR,
                     "%s: Unsupported authentication type %d", __func__,
@@ -18616,6 +23091,26 @@ static int wlan_hdd_cfg80211_set_auth_type(hdd_adapter_t *pAdapter,
     return 0;
 }
 
+#if defined(WLAN_FEATURE_FILS_SK) && defined(CFG80211_FILS_SK_OFFLOAD_SUPPORT)
+static bool hdd_validate_fils_info_ptr(hdd_wext_state_t *wext_state)
+{
+    struct cds_fils_connection_info *fils_con_info;
+
+    fils_con_info = wext_state->roamProfile.fils_con_info;
+    if (!fils_con_info) {
+        hddLog(LOGE, "No valid Roam profile");
+        return false;
+    }
+
+    return true;
+}
+#else
+static bool hdd_validate_fils_info_ptr(hdd_wext_state_t *wext_state)
+{
+    return TRUE;
+}
+#endif
+
 /*
  * FUNCTION: wlan_hdd_set_akm_suite
  * This function is used to set the key mgmt type(PSK/8021x).
@@ -18626,10 +23121,19 @@ static int wlan_hdd_set_akm_suite( hdd_adapter_t *pAdapter,
                                    )
 {
     hdd_wext_state_t *pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
+    tCsrRoamProfile *roam_profile;
+
+    roam_profile = &pWextState->roamProfile;
+    if (!hdd_validate_fils_info_ptr(pWextState))
+        return -EINVAL;
 
     /* Should be in ieee802_11_defs.h */
+#ifndef WLAN_AKM_SUITE_8021X_SHA256
 #define WLAN_AKM_SUITE_8021X_SHA256 0x000FAC05
+#endif
+#ifndef WLAN_AKM_SUITE_PSK_SHA256
 #define WLAN_AKM_SUITE_PSK_SHA256   0x000FAC06
+#endif
     /*set key mgmt type*/
     switch(key_mgmt)
     {
@@ -18669,6 +23173,34 @@ static int wlan_hdd_set_akm_suite( hdd_adapter_t *pAdapter,
                             __func__);
             pWextState->authKeyMgmt |= IW_AUTH_KEY_MGMT_802_1X;
             break;
+#if defined(WLAN_FEATURE_FILS_SK) && defined(CFG80211_FILS_SK_OFFLOAD_SUPPORT)
+        case WLAN_AKM_SUITE_FILS_SHA256:
+            hddLog(LOG1, "setting key mgmt type to FILS SHA256");
+            pWextState->authKeyMgmt |= IW_AUTH_KEY_MGMT_802_1X;
+            roam_profile->fils_con_info->akm_type =
+                eCSR_AUTH_TYPE_FILS_SHA256;
+            break;
+
+        case WLAN_AKM_SUITE_FILS_SHA384:
+            hddLog(LOG1, "setting key mgmt type to FILS SH384");
+            pWextState->authKeyMgmt |= IW_AUTH_KEY_MGMT_802_1X;
+            roam_profile->fils_con_info->akm_type =
+                eCSR_AUTH_TYPE_FILS_SHA384;
+            break;
+
+        case WLAN_AKM_SUITE_FT_FILS_SHA256:
+            hddLog(LOG1, "setting key mgmt type to FILS FT SH256");
+            pWextState->authKeyMgmt |= IW_AUTH_KEY_MGMT_802_1X;
+            roam_profile->fils_con_info->akm_type =
+                eCSR_AUTH_TYPE_FT_FILS_SHA256;
+            break;
+
+        case WLAN_AKM_SUITE_FT_FILS_SHA384:
+            pWextState->authKeyMgmt |= IW_AUTH_KEY_MGMT_802_1X;
+            roam_profile->fils_con_info->akm_type =
+                eCSR_AUTH_TYPE_FT_FILS_SHA384;
+            break;
+#endif
 
         default:
             hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Unsupported key mgmt type %d",
@@ -18796,6 +23328,13 @@ int wlan_hdd_cfg80211_set_ie(hdd_adapter_t *pAdapter,
         eLen  = *genie++;
         remLen -= 2;
 
+        /* Sanity check on eLen */
+        if (eLen > remLen) {
+            hddLog(VOS_TRACE_LEVEL_FATAL, "%s: Invalid IE length[%d] for IE[0x%X]",
+                    __func__, eLen, elementId);
+            VOS_ASSERT(0);
+            return -EINVAL;
+        }
         hddLog(VOS_TRACE_LEVEL_INFO, "%s: IE[0x%X], LEN[%d]",
             __func__, elementId, eLen);
 
@@ -18832,6 +23371,13 @@ int wlan_hdd_cfg80211_set_ie(hdd_adapter_t *pAdapter,
                 }
                 else if (0 == memcmp(&genie[0], "\x00\x50\xf2", 3))
                 {
+                    if (eLen > (MAX_WPA_RSN_IE_LEN - 2)) {
+                        hddLog(VOS_TRACE_LEVEL_FATAL, "%s: Invalid WPA RSN IE length[%d], exceeds %d bytes",
+                                __func__, eLen, MAX_WPA_RSN_IE_LEN - 2);
+                        VOS_ASSERT(0);
+                        return -EINVAL;
+                    }
+
                     hddLog (VOS_TRACE_LEVEL_INFO, "%s Set WPA IE (len %d)",__func__, eLen + 2);
                     memset( pWextState->WPARSNIE, 0, MAX_WPA_RSN_IE_LEN );
                     memcpy( pWextState->WPARSNIE, genie - 2, (eLen + 2) /*ie_len*/);
@@ -18954,6 +23500,12 @@ int wlan_hdd_cfg80211_set_ie(hdd_adapter_t *pAdapter,
                 }
                 break;
             case DOT11F_EID_RSN:
+                if (eLen > (MAX_WPA_RSN_IE_LEN - 2)) {
+                    hddLog(VOS_TRACE_LEVEL_FATAL, "%s: Invalid WPA RSN IE length[%d], exceeds %d bytes",
+                            __func__, eLen, MAX_WPA_RSN_IE_LEN - 2);
+                    VOS_ASSERT(0);
+                    return -EINVAL;
+                }
                 hddLog (VOS_TRACE_LEVEL_INFO, "%s Set RSN IE(len %d)",__func__, eLen + 2);
                 memset( pWextState->WPARSNIE, 0, MAX_WPA_RSN_IE_LEN );
                 memcpy( pWextState->WPARSNIE, genie - 2, (eLen + 2)/*ie_len*/);
@@ -19077,6 +23629,107 @@ static bool hdd_isWPAIEPresent(const u8 *ie, u8 ie_len)
     return FALSE;
 }
 
+#if defined(WLAN_FEATURE_FILS_SK) && defined(CFG80211_FILS_SK_OFFLOAD_SUPPORT)
+static int wlan_hdd_get_fils_auth_type(enum nl80211_auth_type auth)
+{
+    switch (auth) {
+        case NL80211_AUTHTYPE_FILS_SK:
+            return eSIR_FILS_SK_WITHOUT_PFS;
+        case NL80211_AUTHTYPE_FILS_SK_PFS:
+            return eSIR_FILS_SK_WITH_PFS;
+        case NL80211_AUTHTYPE_FILS_PK:
+            return eSIR_FILS_PK_AUTH;
+        default:
+            return -EINVAL;
+    }
+}
+
+/**
+ * wlan_hdd_cfg80211_set_fils_config() - set fils config params during connect
+ * @adapter: Pointer to adapter
+ * @req: Pointer to fils parameters
+ *
+ * Return: 0 for success, non-zero for failure
+ */
+static int wlan_hdd_cfg80211_set_fils_config(hdd_adapter_t *adapter,
+                                             struct cfg80211_connect_params *req)
+{
+    hdd_wext_state_t *wext_state;
+    tCsrRoamProfile *roam_profile;
+    int auth_type;
+    uint8_t *buf;
+
+    wext_state = WLAN_HDD_GET_WEXT_STATE_PTR(adapter);
+    roam_profile = &wext_state->roamProfile;
+
+    if (!roam_profile) {
+        hddLog(LOGE, "No valid Roam profile");
+        return -EINVAL;
+    }
+
+    roam_profile->fils_con_info =
+        vos_mem_malloc(sizeof(struct cds_fils_connection_info));
+
+    if (!roam_profile->fils_con_info) {
+        hddLog(VOS_TRACE_LEVEL_INFO,"failed to allocate memory");
+        return -EINVAL;
+    }
+    if (req->auth_type != NL80211_AUTHTYPE_FILS_SK) {
+        roam_profile->fils_con_info->is_fils_connection = false;
+        return 0;
+    }
+
+    roam_profile->fils_con_info->is_fils_connection = true;
+    roam_profile->fils_con_info->sequence_number = req->fils_erp_next_seq_num;
+    auth_type = wlan_hdd_get_fils_auth_type(req->auth_type);
+    if (auth_type < 0) {
+        hddLog(VOS_TRACE_LEVEL_INFO,"invalid auth type for fils %d", req->auth_type);
+        return -EINVAL;
+    }
+    roam_profile->fils_con_info->auth_type = auth_type;
+
+    roam_profile->fils_con_info->r_rk_length = req->fils_erp_rrk_len;
+    if (req->fils_erp_rrk_len)
+        vos_mem_copy(roam_profile->fils_con_info->r_rk,
+            req->fils_erp_rrk,
+            roam_profile->fils_con_info->r_rk_length);
+
+    roam_profile->fils_con_info->realm_len = req->fils_erp_realm_len;
+    if (req->fils_erp_realm_len)
+        vos_mem_copy(roam_profile->fils_con_info->realm,
+            req->fils_erp_realm,
+            roam_profile->fils_con_info->realm_len);
+
+    roam_profile->fils_con_info->key_nai_length =
+            req->fils_erp_username_len + sizeof(char) +
+    req->fils_erp_realm_len;
+    if (req->fils_erp_username_len) {
+        buf = roam_profile->fils_con_info->keyname_nai;
+        vos_mem_copy(buf,
+            req->fils_erp_username,
+            req->fils_erp_username_len);
+            buf += req->fils_erp_username_len;
+            vos_mem_copy(buf, "@", sizeof(char));
+            buf += sizeof(char);
+            vos_mem_copy(buf, req->fils_erp_realm,
+            req->fils_erp_realm_len);
+    }
+    hddLog(VOS_TRACE_LEVEL_INFO,"fils connection seq=%d auth=%d user_len=%zu rrk_len=%zu realm_len=%zu keyname nai len %d\n",
+        req->fils_erp_next_seq_num, req->auth_type,
+        req->fils_erp_username_len, req->fils_erp_rrk_len,
+        req->fils_erp_realm_len,
+        roam_profile->fils_con_info->key_nai_length);
+
+    return 0;
+}
+#else
+static int wlan_hdd_cfg80211_set_fils_config(hdd_adapter_t *adapter,
+                                             struct cfg80211_connect_params *req)
+{
+    return 0;
+}
+#endif
+
 /*
  * FUNCTION: wlan_hdd_cfg80211_set_privacy
  * This function is used to initialize the security
@@ -19116,7 +23769,12 @@ int wlan_hdd_cfg80211_set_privacy(hdd_adapter_t *pAdapter,
                 "%s: failed to set authentication type ", __func__);
         return status;
     }
-
+    /* Parase extra info from connect request */
+    status = wlan_hdd_cfg80211_set_fils_config(pAdapter, req);
+    if (0 > status)
+    {
+        return status;
+    }
     /*set key mgmt type*/
     if (req->crypto.n_akm_suites)
     {
@@ -19224,7 +23882,7 @@ int wlan_hdd_cfg80211_set_privacy(hdd_adapter_t *pAdapter,
  * This function is used to disconnect from previous
  * connection
  */
-static int wlan_hdd_try_disconnect( hdd_adapter_t *pAdapter )
+int wlan_hdd_try_disconnect( hdd_adapter_t *pAdapter )
 {
     unsigned long rc;
     hdd_station_ctx_t *pHddStaCtx;
@@ -19299,8 +23957,8 @@ disconnected:
  * @req: Pointer to the structure cfg_connect_params receieved from user space
  * @status: out variable for status of reassoc request
  *
- * This function will start reassociation if bssid hint, channel hint and
- * previous bssid parameters are present in the connect request
+ * This function will start reassociation if prev_bssid is set and bssid/
+ * bssid_hint, channel/channel_hint  parameters are present in connect request.
  *
  * Return: true if connect was for ReAssociation, false otherwise
  */
@@ -19310,14 +23968,25 @@ static bool wlan_hdd_reassoc_bssid_hint(hdd_adapter_t *adapter,
 				int *status)
 {
 	bool reassoc = false;
-	if (req->bssid_hint && req->channel_hint && req->prev_bssid) {
+	const uint8_t *bssid = NULL;
+	uint16_t channel = 0;
+
+	if (req->bssid)
+		bssid = req->bssid;
+	else if (req->bssid_hint)
+		bssid = req->bssid_hint;
+
+	if (req->channel)
+		channel = req->channel->hw_value;
+	else if (req->channel_hint)
+		channel = req->channel_hint->hw_value;
+
+	if (bssid && channel && req->prev_bssid) {
 		reassoc = true;
 		hddLog(VOS_TRACE_LEVEL_INFO,
 			FL("REASSOC Attempt on channel %d to "MAC_ADDRESS_STR),
-			req->channel_hint->hw_value,
-			MAC_ADDR_ARRAY(req->bssid_hint));
-		*status  = hdd_reassoc(adapter, req->bssid_hint,
-					req->channel_hint->hw_value,
+			channel, MAC_ADDR_ARRAY(bssid));
+		*status  = hdd_reassoc(adapter, bssid, channel,
 					CONNECT_CMD_USERSPACE);
 		hddLog(VOS_TRACE_LEVEL_DEBUG,
 			"hdd_reassoc: status: %d", *status);
@@ -19333,6 +24002,51 @@ static bool wlan_hdd_reassoc_bssid_hint(hdd_adapter_t *adapter,
 }
 #endif
 
+/**
+ * wlan_hdd_check_ht20_ht40_ind() - check if Supplicant has indicated to
+ * connect in HT20 mode
+ * @hdd_ctx: hdd context
+ * @adapter: Pointer to the HDD adapter
+ * @req: Pointer to the structure cfg_connect_params receieved from user space
+ *
+ * This function will check if supplicant has indicated to to connect in HT20
+ * mode. this is currently applicable only for 2.4Ghz mode only.
+ * if feature is enabled and supplicant indicate HT20 set
+ * force_24ghz_in_ht20 to true to force 2.4Ghz in HT20 else set it to false.
+ *
+ * Return: void
+ */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)
+static void wlan_hdd_check_ht20_ht40_ind(hdd_context_t *hdd_ctx,
+    hdd_adapter_t *adapter,
+    struct cfg80211_connect_params *req)
+{
+    hdd_wext_state_t *wext_state = WLAN_HDD_GET_WEXT_STATE_PTR(adapter);
+    tCsrRoamProfile *roam_profile;
+
+    roam_profile = &wext_state->roamProfile;
+    roam_profile->force_24ghz_in_ht20 = false;
+    if (hdd_ctx->cfg_ini->override_ht20_40_24g &&
+        !(req->ht_capa.cap_info &
+          IEEE80211_HT_CAP_SUP_WIDTH_20_40))
+        roam_profile->force_24ghz_in_ht20 = true;
+
+    hddLog(LOG1, FL("req->ht_capa.cap_info %x override_ht20_40_24g %d"),
+         req->ht_capa.cap_info, hdd_ctx->cfg_ini->override_ht20_40_24g);
+}
+#else
+static inline void wlan_hdd_check_ht20_ht40_ind(hdd_context_t *hdd_ctx,
+    hdd_adapter_t *adapter,
+    struct cfg80211_connect_params *req)
+{
+    hdd_wext_state_t *wext_state = WLAN_HDD_GET_WEXT_STATE_PTR(adapter);
+    tCsrRoamProfile *roam_profile;
+
+    roam_profile = &wext_state->roamProfile;
+    roam_profile->force_24ghz_in_ht20 = false;
+}
+#endif
+
 /*
  * FUNCTION: __wlan_hdd_cfg80211_connect
  * This function is used to start the association process
@@ -19427,6 +24141,14 @@ static int __wlan_hdd_cfg80211_connect( struct wiphy *wiphy,
         channel = 0;
     if (pHddCtx->cfg_ini->enable_dynamic_sta_chainmask)
        hdd_decide_dynamic_chain_mask(pHddCtx, HDD_ANTENNA_MODE_2X2);
+
+    /* Abort if any scan is going on */
+    status = wlan_hdd_scan_abort(pAdapter);
+    if (0 != status)
+        hddLog(VOS_TRACE_LEVEL_ERROR, FL("scan abort failed"));
+
+    wlan_hdd_check_ht20_ht40_ind(pHddCtx, pAdapter, req);
+
     status = wlan_hdd_cfg80211_connect_start(pAdapter, req->ssid,
                                        req->ssid_len, req->bssid,
                                        bssid_hint, channel);
@@ -19477,6 +24199,7 @@ int wlan_hdd_disconnect( hdd_adapter_t *pAdapter, u16 reason )
     unsigned long rc;
     hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    eConnectionState prev_conn_state;
 
     ENTER();
 
@@ -19484,6 +24207,8 @@ int wlan_hdd_disconnect( hdd_adapter_t *pAdapter, u16 reason )
     if (0 != status)
         return status;
 
+    prev_conn_state = pHddStaCtx->conn_info.connState;
+
     /*stop tx queues*/
     hddLog(LOG1, FL("Disabling queues"));
     wlan_hdd_netif_queue_control(pAdapter, WLAN_NETIF_TX_DISABLE_N_CARRIER,
@@ -19497,13 +24222,20 @@ int wlan_hdd_disconnect( hdd_adapter_t *pAdapter, u16 reason )
 
     status = sme_RoamDisconnect( WLAN_HDD_GET_HAL_CTX(pAdapter),
                                  pAdapter->sessionId, reason);
+    if ((eHAL_STATUS_CMD_NOT_QUEUED == status) &&
+             prev_conn_state != eConnectionState_Connecting) {
+        hddLog(LOG1,
+               FL("status = %d, already disconnected"), status);
+        result = 0;
+        goto disconnected;
+    }
     /*
      * Wait here instead of returning directly, this will block the next
      * connect command and allow processing of the scan for ssid and
      * the previous connect command in CSR. Else we might hit some
      * race conditions leading to SME and HDD out of sync.
      */
-    if (eHAL_STATUS_CMD_NOT_QUEUED == status) {
+    else if (eHAL_STATUS_CMD_NOT_QUEUED == status) {
         hddLog(LOG1,
            FL("Already disconnected or connect was in sme/roam pending list and removed by disconnect"));
     } else if (0 != status) {
@@ -19674,6 +24406,9 @@ static int __wlan_hdd_cfg80211_disconnect( struct wiphy *wiphy,
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                   FL("convert to internal reason %d to reasonCode %d"),
                   reason, reasonCode);
+#ifdef QCA_PKT_PROTO_TRACE
+        vos_pkt_trace_buf_dump();
+#endif
         pScanInfo =  &pAdapter->scan_info;
         if (pScanInfo->mScanPending) {
             hddLog(VOS_TRACE_LEVEL_INFO, "Disconnect is in progress, "
@@ -20413,6 +25148,1031 @@ static int wlan_hdd_cfg80211_get_txpower(struct wiphy *wiphy,
 	return ret;
 }
 
+/**
+ * hdd_get_rate_flags_ht() - get HT rate flags based on rate, nss and mcs
+ * @rate: Data rate (100 kbps)
+ * @nss: Number of streams
+ * @mcs: HT mcs index
+ *
+ * This function is used to construct HT rate flag with rate, nss and mcs
+ *
+ * Return: rate flags for success, 0 on failure.
+ */
+static uint8_t hdd_get_rate_flags_ht(uint32_t rate,
+		uint8_t nss,
+		uint8_t mcs)
+{
+	struct index_data_rate_type *mcs_rate;
+	uint8_t flags = 0;
+
+	mcs_rate = (struct index_data_rate_type *)
+		((nss == 1) ? &supported_mcs_rate_nss1 :
+		 &supported_mcs_rate_nss2);
+
+	if (rate == mcs_rate[mcs].supported_rate[0]) {
+		flags |= eHAL_TX_RATE_HT20;
+	} else if (rate == mcs_rate[mcs].supported_rate[1]) {
+		flags |= eHAL_TX_RATE_HT40;
+	} else if (rate == mcs_rate[mcs].supported_rate[2]) {
+		flags |= eHAL_TX_RATE_HT20;
+		flags |= eHAL_TX_RATE_SGI;
+	} else if (rate == mcs_rate[mcs].supported_rate[3]) {
+		flags |= eHAL_TX_RATE_HT40;
+		flags |= eHAL_TX_RATE_SGI;
+	} else {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("invalid params rate %d nss %d mcs %d"),
+				rate, nss, mcs);
+	}
+
+	return flags;
+}
+
+#ifdef WLAN_FEATURE_11AC
+/**
+ * hdd_get_rate_flags_vht() - get VHT rate flags based on rate, nss and mcs
+ * @rate: Data rate (100 kbps)
+ * @nss: Number of streams
+ * @mcs: VHT mcs index
+ *
+ * This function is used to construct VHT rate flag with rate, nss and mcs
+ *
+ * Return: rate flags for success, 0 on failure.
+ */
+static uint8_t hdd_get_rate_flags_vht(uint32_t rate,
+		uint8_t nss,
+		uint8_t mcs)
+{
+	struct index_vht_data_rate_type *mcs_rate;
+	uint8_t flags = 0;
+
+	mcs_rate = (struct index_vht_data_rate_type *)
+		((nss == 1) ?
+		 &supported_vht_mcs_rate_nss1 :
+		 &supported_vht_mcs_rate_nss2);
+
+	if (rate == mcs_rate[mcs].supported_VHT80_rate[0]) {
+		flags |= eHAL_TX_RATE_VHT80;
+	} else if (rate == mcs_rate[mcs].supported_VHT80_rate[1]) {
+		flags |= eHAL_TX_RATE_VHT80;
+		flags |= eHAL_TX_RATE_SGI;
+	} else if (rate == mcs_rate[mcs].supported_VHT40_rate[0]) {
+		flags |= eHAL_TX_RATE_VHT40;
+	} else if (rate == mcs_rate[mcs].supported_VHT40_rate[1]) {
+		flags |= eHAL_TX_RATE_VHT40;
+		flags |= eHAL_TX_RATE_SGI;
+	} else if (rate == mcs_rate[mcs].supported_VHT20_rate[0]) {
+		flags |= eHAL_TX_RATE_VHT20;
+	} else if (rate == mcs_rate[mcs].supported_VHT20_rate[1]) {
+		flags |= eHAL_TX_RATE_VHT20;
+		flags |= eHAL_TX_RATE_SGI;
+	} else {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("invalid params rate %d nss %d mcs %d"),
+				rate, nss, mcs);
+	}
+
+	return flags;
+}
+#else
+static uint8_t hdd_get_rate_flags_vht(uint32_t rate,
+		uint8_t nss,
+		uint8_t mcs)
+{
+	return 0;
+}
+#endif
+
+/**
+ * hdd_get_rate_flags() - get HT/VHT rate flags based on rate, nss and mcs
+ * @rate: Data rate (100 kbps)
+ * @mode: Tx/Rx mode
+ * @nss: Number of streams
+ * @mcs: Mcs index
+ *
+ * This function is used to construct rate flag with rate, nss and mcs
+ *
+ * Return: rate flags for success, 0 on failure.
+ */
+static uint8_t hdd_get_rate_flags(uint32_t rate,
+		uint8_t mode,
+		uint8_t nss,
+		uint8_t mcs)
+{
+	uint8_t flags = 0;
+
+	if (mode == SIR_SME_PHY_MODE_HT)
+		flags = hdd_get_rate_flags_ht(rate, nss, mcs);
+	else if (mode == SIR_SME_PHY_MODE_VHT)
+		flags = hdd_get_rate_flags_vht(rate, nss, mcs);
+	else
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("invalid mode param %d"),
+				mode);
+
+	return flags;
+}
+
+/**
+ * wlan_hdd_fill_rate_info() - fill HDD rate info from SIR peer info
+ * @ap_ctx: AP Context
+ * @peer_info: SIR peer info pointer
+ *
+ * This function is used to fill HDD rate info rom SIR peer info
+ *
+ * Return: None
+ */
+static void wlan_hdd_fill_rate_info(hdd_ap_ctx_t *ap_ctx,
+		struct sir_peer_info_ext *peer_info)
+{
+	uint8_t flags;
+	uint32_t rate_code;
+
+	/* tx rate info */
+	ap_ctx->txrx_stats.tx_rate.rate = peer_info->tx_rate;
+	rate_code = peer_info->tx_rate_code;
+
+	ap_ctx->txrx_stats.tx_rate.mode = SIR_SME_PHY_MODE_LEGACY;
+	if ((WMI_GET_HW_RATECODE_PREAM_V1(rate_code)) ==
+			WMI_RATE_PREAMBLE_HT)
+		ap_ctx->txrx_stats.tx_rate.mode = SIR_SME_PHY_MODE_HT;
+	else if ((WMI_GET_HW_RATECODE_PREAM_V1(rate_code)) ==
+			WMI_RATE_PREAMBLE_VHT)
+		ap_ctx->txrx_stats.tx_rate.mode = SIR_SME_PHY_MODE_VHT;
+
+	ap_ctx->txrx_stats.tx_rate.nss =
+		WMI_GET_HW_RATECODE_NSS_V1(rate_code) + 1;
+	ap_ctx->txrx_stats.tx_rate.mcs =
+		WMI_GET_HW_RATECODE_RATE_V1(rate_code);
+
+	flags = hdd_get_rate_flags(ap_ctx->txrx_stats.tx_rate.rate/100,
+			ap_ctx->txrx_stats.tx_rate.mode,
+			ap_ctx->txrx_stats.tx_rate.nss,
+			ap_ctx->txrx_stats.tx_rate.mcs);
+	if (flags != 0)
+		ap_ctx->txrx_stats.tx_rate.rate_flags = flags;
+
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("tx: mode %d nss %d mcs %d rate_flags %x flags %x"),
+			ap_ctx->txrx_stats.tx_rate.mode,
+			ap_ctx->txrx_stats.tx_rate.nss,
+			ap_ctx->txrx_stats.tx_rate.mcs,
+			ap_ctx->txrx_stats.tx_rate.rate_flags,
+			flags);
+
+	/* rx rate info */
+	ap_ctx->txrx_stats.rx_rate.rate = peer_info->rx_rate;
+	rate_code = peer_info->rx_rate_code;
+
+	ap_ctx->txrx_stats.rx_rate.mode = SIR_SME_PHY_MODE_LEGACY;
+	if ((WMI_GET_HW_RATECODE_PREAM_V1(rate_code)) ==
+			WMI_RATE_PREAMBLE_HT)
+		ap_ctx->txrx_stats.rx_rate.mode = SIR_SME_PHY_MODE_HT;
+	else if ((WMI_GET_HW_RATECODE_PREAM_V1(rate_code)) ==
+			WMI_RATE_PREAMBLE_VHT)
+		ap_ctx->txrx_stats.rx_rate.mode = SIR_SME_PHY_MODE_VHT;
+
+	ap_ctx->txrx_stats.rx_rate.nss =
+		WMI_GET_HW_RATECODE_NSS_V1(rate_code) + 1;
+	ap_ctx->txrx_stats.rx_rate.mcs =
+		WMI_GET_HW_RATECODE_RATE_V1(rate_code);
+
+	flags = hdd_get_rate_flags(ap_ctx->txrx_stats.rx_rate.rate/100,
+			ap_ctx->txrx_stats.rx_rate.mode,
+			ap_ctx->txrx_stats.rx_rate.nss,
+			ap_ctx->txrx_stats.rx_rate.mcs);
+	if (flags != 0)
+		ap_ctx->txrx_stats.rx_rate.rate_flags = flags;
+
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("rx: mode %d nss %d mcs %d rate_flags %x flags %x"),
+			ap_ctx->txrx_stats.rx_rate.mode,
+			ap_ctx->txrx_stats.rx_rate.nss,
+			ap_ctx->txrx_stats.rx_rate.mcs,
+			ap_ctx->txrx_stats.rx_rate.rate_flags,
+			flags);
+}
+
+/**
+ * wlan_hdd_get_peer_info_cb() - get peer info callback
+ * @sta_info: pointer of peer information
+ * @context: get peer info callback context
+ *
+ * This function will fill stats info of AP Context
+ *
+ */
+void wlan_hdd_get_peer_info_cb(struct sir_peer_info_ext_resp *sta_info,
+		void *context)
+{
+	struct statsContext *get_peer_info_context;
+	struct sir_peer_info_ext *peer_info;
+	hdd_adapter_t *adapter;
+	hdd_ap_ctx_t *ap_ctx;
+
+	if ((NULL == sta_info) || (NULL == context)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			"%s: Bad param, sta_info [%pK] context [%pK]",
+			__func__, sta_info, context);
+		return;
+	}
+
+	spin_lock(&hdd_context_lock);
+	/*
+	 * there is a race condition that exists between this callback
+	 * function and the caller since the caller could time out either
+	 * before or while this code is executing.  we use a spinlock to
+	 * serialize these actions
+	 */
+	get_peer_info_context = context;
+	if (PEER_INFO_CONTEXT_MAGIC !=
+			get_peer_info_context->magic) {
+		/*
+		 * the caller presumably timed out so there is nothing
+		 * we can do
+		 */
+		spin_unlock(&hdd_context_lock);
+		hddLog(VOS_TRACE_LEVEL_WARN,
+			"%s: Invalid context, magic [%08x]",
+			__func__,
+			get_peer_info_context->magic);
+		return;
+	}
+
+	if (!sta_info->count) {
+		spin_unlock(&hdd_context_lock);
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("Fail to get remote peer info"));
+		return;
+	}
+
+	adapter = get_peer_info_context->pAdapter;
+	ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(adapter);
+	vos_mem_zero(&ap_ctx->txrx_stats,
+			sizeof(struct hdd_fw_txrx_stats));
+
+	peer_info = sta_info->info;
+	ap_ctx->txrx_stats.tx_packets = peer_info->tx_packets;
+	ap_ctx->txrx_stats.tx_bytes = peer_info->tx_bytes;
+	ap_ctx->txrx_stats.rx_packets = peer_info->rx_packets;
+	ap_ctx->txrx_stats.rx_bytes = peer_info->rx_bytes;
+	ap_ctx->txrx_stats.tx_retries = peer_info->tx_retries;
+	ap_ctx->txrx_stats.tx_failed = peer_info->tx_failed;
+	ap_ctx->txrx_stats.rssi =
+		peer_info->rssi + WLAN_HDD_TGT_NOISE_FLOOR_DBM;
+	wlan_hdd_fill_rate_info(ap_ctx, peer_info);
+
+	get_peer_info_context->magic = 0;
+
+	/* notify the caller */
+	complete(&get_peer_info_context->completion);
+
+	/* serialization is complete */
+	spin_unlock(&hdd_context_lock);
+}
+
+/**
+ * wlan_hdd_get_peer_info() - get peer info
+ * @adapter: hostapd interface
+ * @macaddress: request peer mac address
+ *
+ * This function will call sme_get_peer_info_ext to get peer info
+ *
+ * Return: 0 on success, otherwise error value
+ */
+static int wlan_hdd_get_peer_info(hdd_adapter_t *adapter,
+					v_MACADDR_t macaddress)
+{
+	eHalStatus hstatus;
+	int ret;
+	struct statsContext context;
+	struct sir_peer_info_ext_req peer_info_req;
+
+	if (NULL == adapter) {
+		hddLog(VOS_TRACE_LEVEL_ERROR, "%s: pAdapter is NULL",
+			__func__);
+		return -EFAULT;
+	}
+
+	init_completion(&context.completion);
+	context.magic = PEER_INFO_CONTEXT_MAGIC;
+	context.pAdapter = adapter;
+
+	vos_mem_copy(&(peer_info_req.peer_macaddr), &macaddress,
+			VOS_MAC_ADDR_SIZE);
+	peer_info_req.sessionid = adapter->sessionId;
+	peer_info_req.reset_after_request = 0;
+	hstatus = sme_get_peer_info_ext(WLAN_HDD_GET_HAL_CTX(adapter),
+			&peer_info_req,
+			&context,
+			wlan_hdd_get_peer_info_cb);
+	if (eHAL_STATUS_SUCCESS != hstatus) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			"%s: Unable to retrieve statistics for peer info",
+			__func__);
+		ret = -EFAULT;
+	} else {
+		if (!wait_for_completion_timeout(&context.completion,
+				msecs_to_jiffies(WLAN_WAIT_TIME_STATS))) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+				"%s: SME timed out while retrieving peer info",
+				__func__);
+			ret = -EFAULT;
+		} else
+			ret = 0;
+	}
+	/*
+	 * either we never sent a request, we sent a request and received a
+	 * response or we sent a request and timed out.  if we never sent a
+	 * request or if we sent a request and got a response, we want to
+	 * clear the magic out of paranoia.  if we timed out there is a
+	 * race condition such that the callback function could be
+	 * executing at the same time we are. of primary concern is if the
+	 * callback function had already verified the "magic" but had not
+	 * yet set the completion variable when a timeout occurred. we
+	 * serialize these activities by invalidating the magic while
+	 * holding a shared spinlock which will cause us to block if the
+	 * callback is currently executing
+	 */
+	spin_lock(&hdd_context_lock);
+	context.magic = 0;
+	spin_unlock(&hdd_context_lock);
+	return ret;
+}
+
+/**
+ * hdd_get_max_rate_legacy() - get max rate for legacy mode
+ * @stainfo: stainfo pointer
+ * @rssidx: rssi index
+ *
+ * This function will get max rate for legacy mode
+ *
+ * Return: max rate on success, otherwise 0
+ */
+static uint32_t hdd_get_max_rate_legacy(hdd_station_info_t *stainfo,
+		uint8_t rssidx)
+{
+	uint32_t maxrate = 0;
+	int maxidx = 12;
+	int i;
+
+	/* check supported rates */
+	if (stainfo->max_supp_idx != 0xff &&
+			maxidx < stainfo->max_supp_idx)
+		maxidx = stainfo->max_supp_idx;
+
+	/* check extended rates */
+	if (stainfo->max_ext_idx != 0xff &&
+			maxidx < stainfo->max_ext_idx)
+		maxidx = stainfo->max_ext_idx;
+
+	for (i = 0;
+		i < sizeof(supported_data_rate)/sizeof(supported_data_rate[0]);
+		i++) {
+		if (supported_data_rate[i].beacon_rate_index == maxidx)
+			maxrate =
+				supported_data_rate[i].supported_rate[rssidx];
+	}
+
+	hddLog(VOS_TRACE_LEVEL_INFO, FL("maxrate %d"), maxrate);
+
+	return maxrate;
+}
+
+/**
+ * hdd_get_max_rate_ht() - get max rate for ht mode
+ * @stainfo: stainfo pointer
+ * @stats: fw txrx status pointer
+ * @nss: number of streams
+ * @maxrate: returned max rate buffer pointer
+ * @max_mcs_idx: max mcs idx
+ * @report_max: report max rate or max rate
+ *
+ * This function will get max rate for ht mode
+ *
+ * Return: None
+ */
+static void hdd_get_max_rate_ht(hdd_station_info_t *stainfo,
+		struct hdd_fw_txrx_stats *stats,
+		uint32_t rate_flags,
+		uint8_t nss,
+		uint32_t *maxrate,
+		uint8_t *max_mcs_idx,
+		bool report_max)
+{
+	struct index_data_rate_type *supported_mcs_rate;
+	uint32_t tmprate, mcsidx;
+	uint8_t flag = 0;
+	int8_t rssi = stats->rssi;
+	int mode = 0;
+	int i;
+
+	if (rate_flags & eHAL_TX_RATE_HT40)
+		mode = 1;
+	else
+		mode = 0;
+
+	if (rate_flags & eHAL_TX_RATE_HT40)
+		flag |= 1;
+	if (rate_flags & eHAL_TX_RATE_SGI)
+		flag |= 2;
+
+	supported_mcs_rate = (struct index_data_rate_type *)
+		((nss == 1) ? &supported_mcs_rate_nss1 :
+		 &supported_mcs_rate_nss2);
+
+	if (stainfo->max_mcs_idx == 0xff) {
+		hddLog(LOGE, FL("invalid max_mcs_idx"));
+		/* report real mcs idx */
+		mcsidx = stats->tx_rate.mcs;
+	} else {
+		mcsidx = stainfo->max_mcs_idx;
+	}
+
+	if (!report_max) {
+		for (i = 0; i < mcsidx; i++) {
+			if (rssi <= rssiMcsTbl[mode][i]) {
+				mcsidx = i;
+				break;
+			}
+		}
+		if (mcsidx < stats->tx_rate.mcs)
+			mcsidx = stats->tx_rate.mcs;
+	}
+
+	tmprate = supported_mcs_rate[mcsidx].supported_rate[flag];
+
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("tmprate %d mcsidx %d"),
+			tmprate, mcsidx);
+
+	*maxrate = tmprate;
+	*max_mcs_idx = mcsidx;
+}
+
+#ifdef WLAN_FEATURE_11AC
+/**
+ * hdd_get_max_rate_vht() - get max rate for vht mode
+ * @stainfo: stainfo pointer
+ * @stats: fw txrx status pointer
+ * @nss: number of streams
+ * @maxrate: returned max rate buffer pointer
+ * @max_mcs_idx: max mcs idx
+ * @report_max: report max rate or max rate
+ *
+ * This function will get max rate for vht mode
+ *
+ * Return: None
+ */
+static void hdd_get_max_rate_vht(hdd_station_info_t *stainfo,
+		struct hdd_fw_txrx_stats *stats,
+		uint32_t rate_flags,
+		uint8_t nss,
+		uint32_t *maxrate,
+		uint8_t *max_mcs_idx,
+		bool report_max)
+{
+	struct index_vht_data_rate_type *supported_vht_mcs_rate;
+	uint32_t tmprate = 0, mcsidx = INVALID_MCS_IDX;
+	uint32_t vht_max_mcs;
+	uint8_t flag = 0;
+	int8_t rssi = stats->rssi;
+	int mode = 0;
+	int i;
+
+	supported_vht_mcs_rate = (struct index_vht_data_rate_type *)
+		((nss == 1) ?
+		 &supported_vht_mcs_rate_nss1 :
+		 &supported_vht_mcs_rate_nss2);
+
+	if (rate_flags & eHAL_TX_RATE_VHT80)
+		mode = 2;
+	else if (rate_flags & eHAL_TX_RATE_VHT40)
+		mode = 1;
+	else
+		mode = 0;
+
+	if (rate_flags &
+	    (eHAL_TX_RATE_VHT20 | eHAL_TX_RATE_VHT40 | eHAL_TX_RATE_VHT80)) {
+		vht_max_mcs =
+			(eDataRate11ACMaxMcs)
+			(stainfo->tx_mcs_map & DATA_RATE_11AC_MCS_MASK);
+		if (rate_flags & eHAL_TX_RATE_SGI)
+			flag |= 1;
+
+		if (DATA_RATE_11AC_MAX_MCS_7 == vht_max_mcs) {
+			mcsidx = 7;
+		} else if (DATA_RATE_11AC_MAX_MCS_8 == vht_max_mcs) {
+			mcsidx = 8;
+		} else if (DATA_RATE_11AC_MAX_MCS_9 == vht_max_mcs) {
+			/*
+			 * 'IEEE_P802.11ac_2013.pdf' page 325, 326
+			 * - MCS9 is valid for VHT20 when Nss = 3 or Nss = 6
+			 * - MCS9 is not valid for VHT20 when Nss = 1,2,4,5,7,8
+			 */
+			if ((rate_flags & eHAL_TX_RATE_VHT20) &&
+			    (nss != 3 && nss != 6))
+				mcsidx = 8;
+			else
+				mcsidx = 9;
+		} else {
+			hddLog(LOGE, FL("invalid vht_max_mcs"));
+			/* report real mcs idx */
+			mcsidx = stats->tx_rate.mcs;
+		}
+
+		if (!report_max) {
+			for (i = 0; i <= mcsidx; i++) {
+				if (rssi <= rssiMcsTbl[mode][i]) {
+					mcsidx = i;
+					break;
+				}
+			}
+			if (mcsidx < stats->tx_rate.mcs)
+				mcsidx = stats->tx_rate.mcs;
+		}
+
+		if (rate_flags & eHAL_TX_RATE_VHT80)
+			tmprate =
+		    supported_vht_mcs_rate[mcsidx].supported_VHT80_rate[flag];
+		else if (rate_flags & eHAL_TX_RATE_VHT40)
+			tmprate =
+		    supported_vht_mcs_rate[mcsidx].supported_VHT40_rate[flag];
+		else if (rate_flags & eHAL_TX_RATE_VHT20)
+			tmprate =
+		    supported_vht_mcs_rate[mcsidx].supported_VHT20_rate[flag];
+	}
+
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("tmprate %d mcsidx %d"),
+			tmprate, mcsidx);
+
+	*maxrate = tmprate;
+	*max_mcs_idx = mcsidx;
+}
+#else
+static void hdd_get_max_rate_vht(hdd_station_info_t *stainfo,
+		struct hdd_fw_txrx_stats *stats,
+		uint32_t rate_flags,
+		uint8_t nss,
+		uint32_t *maxrate,
+		uint8_t *max_mcs_idx,
+		bool report_max) { }
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+/**
+ * hdd_fill_bw_mcs() - fill ch width and mcs flags
+ * @stainfo: stainfo pointer
+ * @rate_flags: HDD rate flags
+ * @mcsidx: mcs index
+ * @nss: number of streams
+ * @vht: vht mode or not
+ *
+ * This function will fill ch width and mcs flags
+ *
+ * Return: None
+ */
+static void hdd_fill_bw_mcs(struct station_info *sinfo,
+		uint8_t rate_flags,
+		uint8_t mcsidx,
+		uint8_t nss,
+		bool vht)
+{
+	if (vht) {
+		sinfo->txrate.nss = nss;
+		sinfo->txrate.mcs = mcsidx;
+		sinfo->txrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
+		if (rate_flags & eHAL_TX_RATE_VHT80)
+			sinfo->txrate.bw = RATE_INFO_BW_80;
+		else if (rate_flags & eHAL_TX_RATE_VHT40)
+			sinfo->txrate.bw = RATE_INFO_BW_40;
+		else if (rate_flags & eHAL_TX_RATE_VHT20)
+			sinfo->txrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
+	} else {
+		sinfo->txrate.mcs = (nss-1) << 3;
+		sinfo->txrate.mcs |= mcsidx;
+		sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
+		if (rate_flags & eHAL_TX_RATE_HT40)
+			sinfo->txrate.bw = RATE_INFO_BW_40;
+	}
+}
+#else
+/**
+ * hdd_fill_bw_mcs() - fill ch width and mcs flags
+ * @stainfo: stainfo pointer
+ * @rate_flags: HDD rate flags
+ * @mcsidx: mcs index
+ * @nss: number of streams
+ * @vht: vht mode or not
+ *
+ * This function will fill ch width and mcs flags
+ *
+ * Return: None
+ */
+static void hdd_fill_bw_mcs(struct station_info *sinfo,
+		uint8_t rate_flags,
+		uint8_t mcsidx,
+		uint8_t nss,
+		bool vht)
+{
+	if (vht) {
+		sinfo->txrate.nss = nss;
+		sinfo->txrate.mcs = mcsidx;
+		sinfo->txrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
+		if (rate_flags & eHAL_TX_RATE_VHT80)
+			sinfo->txrate.flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
+		else if (rate_flags & eHAL_TX_RATE_VHT40)
+			sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+		else if (rate_flags & eHAL_TX_RATE_VHT20)
+			sinfo->txrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
+	} else {
+		sinfo->txrate.mcs = (nss-1) << 3;
+		sinfo->txrate.mcs |= mcsidx;
+		sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
+		if (rate_flags & eHAL_TX_RATE_HT40)
+			sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+	}
+}
+#endif
+
+#ifdef WLAN_FEATURE_11AC
+/**
+ * hdd_fill_bw_mcs_vht() - fill ch width and mcs flags for VHT mode
+ * @stainfo: stainfo pointer
+ * @rate_flags: HDD rate flags
+ * @mcsidx: mcs index
+ * @nss: number of streams
+ *
+ * This function will fill ch width and mcs flags for VHT mode
+ *
+ * Return: None
+ */
+static void hdd_fill_bw_mcs_vht(struct station_info *sinfo,
+		uint8_t rate_flags,
+		uint8_t mcsidx,
+		uint8_t nss)
+{
+	hdd_fill_bw_mcs(sinfo, rate_flags, mcsidx, nss, TRUE);
+}
+#else
+static void hdd_fill_bw_mcs_vht(struct station_info *sinfo,
+		uint8_t rate_flags,
+		uint8_t mcsidx,
+		uint8_t nss) { }
+#endif
+
+/**
+ * hdd_fill_sinfo_rate_info() - fill rate info of sinfo struct
+ * @sinfo: station_info struct pointer
+ * @rate_flags: HDD rate flags
+ * @mcsidx: mcs index
+ * @nss: number of streams
+ * @maxrate: data rate (kbps)
+ *
+ * This function will fill rate info of sinfo struct
+ *
+ * Return: None
+ */
+static void hdd_fill_sinfo_rate_info(struct station_info *sinfo,
+		uint32_t rate_flags,
+		uint8_t mcsidx,
+		uint8_t nss,
+		uint32_t maxrate)
+{
+	if (rate_flags & eHAL_TX_RATE_LEGACY) {
+		/* provide to the UI in units of 100kbps */
+		sinfo->txrate.legacy = maxrate;
+	} else {
+		/* must be MCS */
+		if (rate_flags &
+				(eHAL_TX_RATE_VHT80 |
+				 eHAL_TX_RATE_VHT40 |
+				 eHAL_TX_RATE_VHT20))
+			hdd_fill_bw_mcs_vht(sinfo, rate_flags, mcsidx, nss);
+
+		if (rate_flags & (eHAL_TX_RATE_HT20 | eHAL_TX_RATE_HT40))
+			hdd_fill_bw_mcs(sinfo, rate_flags, mcsidx, nss, FALSE);
+
+		if (rate_flags & eHAL_TX_RATE_SGI) {
+			if (!(sinfo->txrate.flags & RATE_INFO_FLAGS_VHT_MCS))
+				sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
+			sinfo->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
+		}
+	}
+
+	hddLog(VOS_TRACE_LEVEL_INFO, FL("flag %x mcs %d legacy %d nss %d"),
+			sinfo->txrate.flags,
+			sinfo->txrate.mcs,
+			sinfo->txrate.legacy,
+			sinfo->txrate.nss);
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0))
+/**
+ * hdd_fill_sinfo_rate_info() - fill flags of sinfo struct
+ * @sinfo: station_info struct pointer
+ *
+ * This function will fill flags of sinfo struct
+ *
+ * Return: None
+ */
+static void hdd_fill_station_info_flags(struct station_info *sinfo)
+{
+	sinfo->filled |= STATION_INFO_SIGNAL |
+		STATION_INFO_TX_BITRATE |
+		STATION_INFO_TX_BYTES   |
+		STATION_INFO_TX_BYTES64   |
+		STATION_INFO_TX_PACKETS |
+		STATION_INFO_TX_RETRIES |
+		STATION_INFO_TX_FAILED  |
+		STATION_INFO_RX_BYTES   |
+		STATION_INFO_RX_BYTES64   |
+		STATION_INFO_RX_PACKETS |
+		STATION_INFO_INACTIVE_TIME |
+		STATION_INFO_CONNECTED_TIME;
+}
+#else
+/**
+ * hdd_fill_sinfo_rate_info() - fill flags of sinfo struct
+ * @sinfo: station_info struct pointer
+ *
+ * This function will fill flags of sinfo struct
+ *
+ * Return: None
+ */
+static void hdd_fill_station_info_flags(struct station_info *sinfo)
+{
+	sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL) |
+		BIT(NL80211_STA_INFO_TX_BYTES)   |
+		BIT(NL80211_STA_INFO_TX_BYTES64)   |
+		BIT(NL80211_STA_INFO_TX_BITRATE) |
+		BIT(NL80211_STA_INFO_TX_PACKETS) |
+		BIT(NL80211_STA_INFO_TX_RETRIES) |
+		BIT(NL80211_STA_INFO_TX_FAILED)  |
+		BIT(NL80211_STA_INFO_RX_BYTES)   |
+		BIT(NL80211_STA_INFO_RX_BYTES64)   |
+		BIT(NL80211_STA_INFO_RX_PACKETS) |
+		BIT(NL80211_STA_INFO_INACTIVE_TIME) |
+		BIT(NL80211_STA_INFO_CONNECTED_TIME);
+}
+#endif
+
+/**
+ * hdd_fill_rate_info() - fill rate info of sinfo
+ * @sinfo: station_info struct pointer
+ * @stainfo: stainfo pointer
+ * @stats: fw txrx status pointer
+ * @cfg: hdd config pointer
+ *
+ * This function will fill rate info of sinfo
+ *
+ * Return: None
+ */
+static void hdd_fill_rate_info(struct station_info *sinfo,
+		hdd_station_info_t *stainfo,
+		struct hdd_fw_txrx_stats *stats,
+		hdd_config_t *cfg)
+{
+	uint8_t rate_flags;
+	uint8_t mcsidx = 0xff;
+	uint32_t myrate, maxrate, tmprate;
+	int rssidx;
+	int nss = 1;
+
+	hddLog(VOS_TRACE_LEVEL_INFO, FL("reportMaxLinkSpeed %d"),
+			cfg->reportMaxLinkSpeed);
+
+	/* convert to 100kbps expected in rate table */
+	myrate = stats->tx_rate.rate/100;
+	rate_flags = stainfo->rate_flags;
+	if (!(rate_flags & eHAL_TX_RATE_LEGACY)) {
+		nss = stainfo->nss;
+		if (eHDD_LINK_SPEED_REPORT_ACTUAL == cfg->reportMaxLinkSpeed) {
+			/* Get current rate flags if report actual */
+			if (stats->tx_rate.rate_flags)
+				rate_flags =
+					stats->tx_rate.rate_flags;
+			nss = stats->tx_rate.nss;
+		}
+
+		if (stats->tx_rate.mcs == INVALID_MCS_IDX)
+			rate_flags = eHAL_TX_RATE_LEGACY;
+	}
+
+	if (eHDD_LINK_SPEED_REPORT_ACTUAL != cfg->reportMaxLinkSpeed) {
+		/* we do not want to necessarily report the current speed */
+		if (eHDD_LINK_SPEED_REPORT_MAX == cfg->reportMaxLinkSpeed) {
+			/* report the max possible speed */
+			rssidx = 0;
+		} else if (eHDD_LINK_SPEED_REPORT_MAX_SCALED ==
+				cfg->reportMaxLinkSpeed) {
+			/* report the max possible speed with RSSI scaling */
+			if (stats->rssi >= cfg->linkSpeedRssiHigh) {
+				/* report the max possible speed */
+				rssidx = 0;
+			} else if (stats->rssi >=
+					cfg->linkSpeedRssiMid) {
+				/* report middle speed */
+				rssidx = 1;
+			} else if (stats->rssi >=
+					cfg->linkSpeedRssiLow) {
+				/* report middle speed */
+				rssidx = 2;
+			} else {
+				/* report actual speed */
+				rssidx = 3;
+			}
+		} else {
+			/* unknown, treat as eHDD_LINK_SPEED_REPORT_MAX */
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+			    "%s: Invalid value for reportMaxLinkSpeed: %u",
+			    __func__, cfg->reportMaxLinkSpeed);
+			rssidx = 0;
+		}
+
+		maxrate = hdd_get_max_rate_legacy(stainfo, rssidx);
+
+		/*
+		 * Get MCS Rate Set --
+		 * Only if we are connected in non legacy mode and not
+		 * reporting actual speed
+		 */
+		if ((3 != rssidx) &&
+				!(rate_flags & eHAL_TX_RATE_LEGACY)) {
+			hdd_get_max_rate_vht(stainfo,
+					stats,
+					rate_flags,
+					nss,
+					&tmprate,
+					&mcsidx,
+					rssidx == 0);
+
+			if (maxrate < tmprate &&
+					mcsidx != INVALID_MCS_IDX)
+				maxrate = tmprate;
+
+			if (mcsidx == INVALID_MCS_IDX)
+				hdd_get_max_rate_ht(stainfo,
+						stats,
+						rate_flags,
+						nss,
+						&tmprate,
+						&mcsidx,
+						rssidx == 0);
+
+			if (maxrate < tmprate &&
+					mcsidx != INVALID_MCS_IDX)
+				maxrate = tmprate;
+		} else if (!(rate_flags & eHAL_TX_RATE_LEGACY)) {
+			maxrate = myrate;
+			mcsidx = stats->tx_rate.mcs;
+		}
+
+		/*
+		 * make sure we report a value at least as big as our
+		 * current rate
+		 */
+		if ((maxrate < myrate) || (0 == maxrate)) {
+			maxrate = myrate;
+			if (!(rate_flags & eHAL_TX_RATE_LEGACY)) {
+				mcsidx = stats->tx_rate.mcs;
+				/*
+				 * 'IEEE_P802.11ac_2013.pdf' page 325, 326
+				 * - MCS9 is valid for VHT20 when Nss = 3 or
+				 *   Nss = 6
+				 * - MCS9 is not valid for VHT20 when
+				 *   Nss = 1,2,4,5,7,8
+				 */
+				if ((rate_flags & eHAL_TX_RATE_VHT20) &&
+						(mcsidx > 8) &&
+						(nss != 3 && nss != 6))
+					mcsidx = 8;
+			}
+		}
+	} else {
+		/* report current rate instead of max rate */
+		maxrate = myrate;
+		if (!(rate_flags & eHAL_TX_RATE_LEGACY))
+			mcsidx = stats->tx_rate.mcs;
+	}
+
+	hdd_fill_sinfo_rate_info(sinfo,
+			rate_flags,
+			mcsidx,
+			nss,
+			maxrate);
+}
+
+/**
+ * wlan_hdd_fill_station_info() - fill station_info struct
+ * @sinfo: station_info struct pointer
+ * @stainfo: stainfo pointer
+ * @stats: fw txrx status pointer
+ * @cfg: hdd config pointer
+ *
+ * This function will fill station_info struct
+ *
+ * Return: None
+ */
+static void wlan_hdd_fill_station_info(struct station_info *sinfo,
+		hdd_station_info_t *stainfo,
+		struct hdd_fw_txrx_stats *stats,
+		hdd_config_t *cfg)
+{
+	adf_os_time_t curr_time, dur;
+
+	curr_time = vos_system_ticks();
+	dur = curr_time - stainfo->assoc_ts;
+	sinfo->connected_time = vos_system_ticks_to_msecs(dur)/1000;
+	dur = curr_time - stainfo->last_tx_rx_ts;
+	sinfo->inactive_time = vos_system_ticks_to_msecs(dur);
+	sinfo->signal = stats->rssi;
+	sinfo->tx_bytes = stats->tx_bytes;
+	sinfo->tx_packets = stats->tx_packets;
+	sinfo->rx_bytes = stats->rx_bytes;
+	sinfo->rx_packets = stats->rx_packets;
+	sinfo->tx_failed = stats->tx_failed;
+	sinfo->tx_retries = stats->tx_retries;
+
+	/* tx rate info */
+	hdd_fill_rate_info(sinfo, stainfo, stats, cfg);
+
+	hdd_fill_station_info_flags(sinfo);
+
+	/* dump sta info*/
+	hddLog(VOS_TRACE_LEVEL_INFO, FL("dump stainfo"));
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("con_time %d inact_time %d tx_pkts %d rx_pkts %d"),
+			sinfo->connected_time, sinfo->inactive_time,
+			sinfo->tx_packets, sinfo->rx_packets);
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("failed %d retries %d tx_bytes %lld rx_bytes %lld"),
+			sinfo->tx_failed, sinfo->tx_retries,
+			sinfo->tx_bytes, sinfo->rx_bytes);
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("rssi %d mcs %d legacy %d nss %d flags %x"),
+			sinfo->signal, sinfo->txrate.mcs,
+			sinfo->txrate.legacy, sinfo->txrate.nss,
+			sinfo->txrate.flags);
+
+}
+
+/**
+ * wlan_hdd_get_station_remote() - NL80211_CMD_GET_STATION handler for SoftAP
+ * @wiphy: pointer to wiphy
+ * @dev: pointer to net_device structure
+ * @mac: request peer mac address
+ * @sinfo: pointer to station_info struct
+ *
+ * This function will get remote peer info from fw and fill sinfo struct
+ *
+ * Return: 0 on success, otherwise error value
+ */
+static int wlan_hdd_get_station_remote(struct wiphy *wiphy,
+		struct net_device *dev,
+		const u8 *mac,
+		struct station_info *sinfo)
+{
+	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+	hdd_context_t *hddctx = (hdd_context_t *)wiphy_priv(wiphy);
+	hdd_ap_ctx_t *ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(adapter);
+	hdd_station_info_t *stainfo = NULL;
+	hdd_config_t *cfg = hddctx->cfg_ini;
+	v_MACADDR_t macaddr;
+	int status;
+	int i;
+
+	status = wlan_hdd_validate_context(hddctx);
+	if (0 != status)
+		return status;
+
+	hddLog(VOS_TRACE_LEVEL_INFO, FL("get peer %pM info"), mac);
+
+	for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
+		if (vos_mem_compare(adapter->aStaInfo[i].macAddrSTA.bytes,
+					mac,
+					VOS_MAC_ADDR_SIZE)) {
+			stainfo = &adapter->aStaInfo[i];
+			break;
+		}
+	}
+
+	if (!stainfo) {
+		hddLog(LOGE, FL("peer %pM not found"), mac);
+		return -EINVAL;
+	}
+
+	vos_mem_copy(macaddr.bytes, mac, VOS_MAC_ADDR_SIZE);
+	status = wlan_hdd_get_peer_info(adapter, macaddr);
+	if (status) {
+		hddLog(LOGE, FL("fail to get peer info from fw"));
+		return -EPERM;
+	}
+
+	wlan_hdd_fill_station_info(sinfo, stainfo, &ap_ctx->txrx_stats, cfg);
+
+	return status;
+}
 
 static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
                                            struct net_device *dev,
@@ -20435,6 +26195,7 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
     tANI_U32 MCSLeng = SIZE_OF_BASIC_MCS_SET;
     tANI_U16 maxRate = 0;
     tANI_U16 myRate;
+    int8_t   snr = 0;
     tANI_U16 currentRate = 0;
     tANI_U8  maxSpeedMCS = 0;
     tANI_U8  maxMCSIdx = 0;
@@ -20459,6 +26220,9 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
         hddLog(LOGE, FL("Command not allowed in FTM mode"));
         return -EINVAL;
     }
+    if (pAdapter->device_mode == WLAN_HDD_SOFTAP &&
+		    pCfg->sap_get_peer_info)
+        return wlan_hdd_get_station_remote(wiphy, dev, mac, sinfo);
 
     if ((eConnectionState_Associated != pHddStaCtx->conn_info.connState) ||
             (0 == ssidlen))
@@ -20472,6 +26236,12 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
     if (true == pHddStaCtx->hdd_ReassocScenario) {
         hddLog(LOG1,
                FL("Roaming is in progress, cannot continue with this request"));
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0))
+    sinfo->filled |= STATION_INFO_SIGNAL;
+#else
+    sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+#endif
+        sinfo->signal = pAdapter->rssi;
         return 0;
     }
 
@@ -20480,6 +26250,10 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
         return status;
 
     wlan_hdd_get_rssi(pAdapter, &sinfo->signal);
+    wlan_hdd_get_snr(pAdapter, &snr);
+    pHddStaCtx->conn_info.signal = sinfo->signal;
+    pHddStaCtx->conn_info.noise =
+        pHddStaCtx->conn_info.signal - snr;
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0))
     sinfo->filled |= STATION_INFO_SIGNAL;
 #else
@@ -20826,6 +26600,9 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
             else if (rate_flags & eHAL_TX_RATE_VHT20)
             {
                 sinfo->txrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+                sinfo->txrate.bw = RATE_INFO_BW_20;
+#endif
             }
             else
                 sinfo->txrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
@@ -20841,6 +26618,12 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
                     sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
 #endif
                 }
+                else if (rate_flags & eHAL_TX_RATE_HT20)
+                {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+                    sinfo->txrate.bw = RATE_INFO_BW_20;
+#endif
+                }
             }
             if (rate_flags & eHAL_TX_RATE_SGI)
             {
@@ -20942,6 +26725,11 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
 
     sinfo->rx_packets = pAdapter->stats.rx_packets;
 
+    pHddStaCtx->conn_info.txrate.flags = sinfo->txrate.flags;
+    pHddStaCtx->conn_info.txrate.mcs = sinfo->txrate.mcs;
+    pHddStaCtx->conn_info.txrate.legacy = sinfo->txrate.legacy;
+    pHddStaCtx->conn_info.txrate.nss = sinfo->txrate.nss;
+
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0))
     sinfo->filled |= STATION_INFO_TX_BITRATE |
                      STATION_INFO_TX_BYTES   |
@@ -21194,7 +26982,47 @@ static int __wlan_hdd_set_txq_params(struct wiphy *wiphy,
 				     struct net_device *dev,
 				     struct ieee80211_txq_params *params)
 {
+	hdd_adapter_t *padapter = WLAN_HDD_GET_PRIV_PTR(dev);
+	tHalHandle hal_ptr = WLAN_HDD_GET_HAL_CTX(padapter);
+	tpAniSirGlobal pmac = PMAC_STRUCT(hal_ptr);
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	uint32_t hostapd_edca_local[] = {WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL,
+					 WNI_CFG_EDCA_HOSTAPD_ACVI_LOCAL,
+					 WNI_CFG_EDCA_HOSTAPD_ACBE_LOCAL,
+					 WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL};
+	int rc;
+	struct cfg_hostapd_edca tmp;
+
 	ENTER();
+
+	memset(&tmp, 0 , sizeof(struct cfg_hostapd_edca));
+
+	if (hdd_ctx->cfg_ini->enable_hostapd_edca_local) {
+		rc = wlan_hdd_validate_context(hdd_ctx);
+		if (0 != rc)
+			return rc;
+
+		if (VOS_FTM_MODE == hdd_get_conparam()) {
+			hddLog(LOGE, FL("Command not allowed in FTM mode"));
+			return -EINVAL;
+		}
+
+		if (params->ac >= MAX_NUM_AC) {
+			hddLog(LOGE, "Wrong Params ac %d\r\n", params->ac);
+			return -EINVAL;
+		}
+
+		tmp.aifs = params->aifs;
+		tmp.cwmin = sirSwapU16(params->cwmin);
+		tmp.cwmax = sirSwapU16(params->cwmax);
+		tmp.txop = (uint8_t)params->txop;
+		memcpy(&tmp.paramsb, (uint8_t *)(&tmp.cwmin), 5);
+		memcpy(&tmp.paramsg, (uint8_t *)(&tmp.cwmin), 5);
+		tmp.enable = 1;
+		/* Store Hostapd EDCA params in cfg */
+		cfgSetStr(pmac, hostapd_edca_local[params->ac], (uint8_t *)(&tmp),
+			  sizeof(struct cfg_hostapd_edca));
+	}
 	return 0;
 }
 #else
@@ -21307,13 +27135,13 @@ static int __wlan_hdd_cfg80211_del_station(struct wiphy *wiphy,
                         goto fn_end;
 
                     /* Send disassoc and deauth both to avoid some IOT issues */
-                    vos_event_reset(&pHostapdState->vosEvent);
+                    vos_event_reset(&pHostapdState->sta_disassoc_event);
 
                     vos_status = hdd_softap_sta_deauth(pAdapter, pDelStaParams);
                     if (VOS_IS_STATUS_SUCCESS(vos_status)) {
                         pAdapter->aStaInfo[i].isDeauthInProgress = TRUE;
                         vos_status = vos_wait_single_event(
-                                            &pHostapdState->vosEvent, 1000);
+                                            &pHostapdState->sta_disassoc_event, 1000);
                         if (!VOS_IS_STATUS_SUCCESS(vos_status))
                             hddLog(VOS_TRACE_LEVEL_ERROR,
                                 "!!%s: ERROR: Deauth wait expired!!", __func__);
@@ -21356,7 +27184,7 @@ static int __wlan_hdd_cfg80211_del_station(struct wiphy *wiphy,
                 goto fn_end;
 
             /* Send disassoc and deauth both to avoid some IOT issues */
-            vos_event_reset(&pHostapdState->vosEvent);
+            vos_event_reset(&pHostapdState->sta_disassoc_event);
             sme_send_disassoc_req_frame(WLAN_HDD_GET_HAL_CTX(pAdapter),
                              pAdapter->sessionId,
                              (uint8_t *)pDelStaParams->peerMacAddr,
@@ -21370,8 +27198,8 @@ static int __wlan_hdd_cfg80211_del_station(struct wiphy *wiphy,
                        MAC_ADDR_ARRAY(pDelStaParams->peerMacAddr));
                 return -ENOENT;
             } else {
-                vos_status = vos_wait_single_event(&pHostapdState->vosEvent,
-                                                                        1000);
+                vos_status = vos_wait_single_event(
+                    &pHostapdState->sta_disassoc_event, 1000);
                 if (!VOS_IS_STATUS_SUCCESS(vos_status))
                     hddLog(VOS_TRACE_LEVEL_ERROR,
                         "!!%s: ERROR: Deauth wait expired!!", __func__);
@@ -21488,6 +27316,99 @@ static int wlan_hdd_cfg80211_add_station(struct wiphy *wiphy,
     return ret;
 }
 
+#ifdef CFG80211_FILS_SK_OFFLOAD_SUPPORT
+/*
+ * wlan_hdd_is_pmksa_valid: API to validate pmksa
+ * @pmksa: pointer to cfg80211_pmksa structure
+ *
+ * Return: True if valid else false
+ */
+static inline bool wlan_hdd_is_pmksa_valid(struct cfg80211_pmksa *pmksa)
+{
+    if (pmksa->bssid || (pmksa->ssid && pmksa->cache_id) ){
+        return true;
+    }
+    else
+    {
+        hddLog(LOGE, FL(" Either of  bssid (%pK) ssid (%pK) or cache_id (%pK) are NULL"),
+                pmksa->bssid, pmksa->ssid, pmksa->cache_id);
+        return false;
+    }
+}
+
+/*
+ * hdd_update_pmksa_info: API to update tPmkidCacheInfo from cfg80211_pmksa
+ * @pmk_cache: pmksa from supplicant
+ * @pmk_cache: pmk needs to be updated
+ *
+ * Return: None
+ */
+static void hdd_update_pmksa_info(tPmkidCacheInfo *pmk_cache,
+        struct cfg80211_pmksa *pmksa, bool is_delete)
+{
+    if (pmksa->bssid) {
+        hddLog(VOS_TRACE_LEVEL_DEBUG,"set PMKSA for " MAC_ADDRESS_STR,
+                MAC_ADDR_ARRAY(pmksa->bssid));
+        vos_mem_copy(pmk_cache->BSSID,
+                pmksa->bssid, VOS_MAC_ADDR_SIZE);
+    } else {
+        vos_mem_copy(pmk_cache->ssid, pmksa->ssid,
+                SIR_MAC_MAX_SSID_LENGTH);
+        vos_mem_copy(pmk_cache->cache_id, pmksa->cache_id, CACHE_ID_LEN);
+        pmk_cache->ssid_len = pmksa->ssid_len;
+        hddLog(VOS_TRACE_LEVEL_INFO, "set PMKSA for ssid %*.*s cache_id %x %x",
+                pmk_cache->ssid_len, pmk_cache->ssid_len,
+                pmksa->ssid, pmksa->cache_id[0], pmksa->cache_id[1]);
+   }
+
+    if (is_delete)
+        return;
+
+    vos_mem_copy(pmk_cache->PMKID, pmksa->pmkid, CSR_RSN_PMKID_SIZE);
+    if (pmksa->pmk_len && (pmksa->pmk_len <= CSR_RSN_MAX_PMK_LEN)) {
+        vos_mem_copy(pmk_cache->pmk, pmksa->pmk, pmksa->pmk_len);
+        pmk_cache->pmk_len = pmksa->pmk_len;
+    } else
+        hddLog(VOS_TRACE_LEVEL_INFO, "pmk len is %zu", pmksa->pmk_len);
+}
+#else
+/*
+ * wlan_hdd_is_pmksa_valid: API to validate pmksa
+ * @pmksa: pointer to cfg80211_pmksa structure
+ *
+ * Return: True if valid else false
+ */
+static inline bool wlan_hdd_is_pmksa_valid(struct cfg80211_pmksa *pmksa)
+{
+    if (!pmksa->bssid) {
+        hddLog(LOGE,FL("both bssid is NULL %pK"), pmksa->bssid);
+        return false;
+    }
+    return true;
+}
+
+/*
+ * hdd_update_pmksa_info: API to update tPmkidCacheInfo from cfg80211_pmksa
+ * @pmk_cache: pmksa from supplicant
+ * @pmk_cache: pmk needs to be updated
+ *
+ * Return: None
+ */
+static void hdd_update_pmksa_info(tPmkidCacheInfo *pmk_cache,
+        struct cfg80211_pmksa *pmksa, bool is_delete)
+{
+    hddLog(VOS_TRACE_LEVEL_INFO,"set PMKSA for " MAC_ADDRESS_STR,
+            MAC_ADDR_ARRAY(pmksa->bssid));
+    vos_mem_copy(pmk_cache->BSSID,
+            pmksa->bssid, VOS_MAC_ADDR_SIZE);
+
+    if (is_delete)
+        return;
+
+    vos_mem_copy(pmk_cache->PMKID, pmksa->pmkid, CSR_RSN_PMKID_SIZE);
+}
+#endif
+
 #ifdef FEATURE_WLAN_LFR
 static int __wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
             struct cfg80211_pmksa *pmksa)
@@ -21497,7 +27418,7 @@ static int __wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device
     tHalHandle halHandle;
     eHalStatus result = eHAL_STATUS_SUCCESS;
     int status;
-    tPmkidCacheInfo pmk_id;
+    tPmkidCacheInfo pmk_cache;
 
     ENTER();
 
@@ -21511,14 +27432,14 @@ static int __wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device
         return -EINVAL;
     }
 
-    if (!pmksa->bssid || !pmksa->pmkid) {
-        hddLog(LOGE, FL("pmksa->bssid(%p) or pmksa->pmkid(%p) is NULL"),
-               pmksa->bssid, pmksa->pmkid);
+    if (!pmksa->pmkid) {
+        hddLog(LOGE, FL("pmksa->pmkid(%pK) is NULL"),
+               pmksa->pmkid);
         return -EINVAL;
     }
 
-    hddLog(VOS_TRACE_LEVEL_DEBUG, FL("set PMKSA for "MAC_ADDRESS_STR),
-           MAC_ADDR_ARRAY(pmksa->bssid));
+    if (!wlan_hdd_is_pmksa_valid(pmksa))
+        return -EINVAL;
 
     status = wlan_hdd_validate_context(pHddCtx);
     if (0 != status)
@@ -21526,12 +27447,18 @@ static int __wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device
 
     halHandle = WLAN_HDD_GET_HAL_CTX(pAdapter);
 
-    vos_mem_copy(pmk_id.BSSID, pmksa->bssid, ETHER_ADDR_LEN);
-    vos_mem_copy(pmk_id.PMKID, pmksa->pmkid, CSR_RSN_PMKID_SIZE);
+    vos_mem_zero(&pmk_cache, sizeof(pmk_cache));
+
+    hdd_update_pmksa_info(&pmk_cache, pmksa, false);
 
-    /* Add to the PMKSA ID Cache in CSR */
-    result = sme_RoamSetPMKIDCache(halHandle,pAdapter->sessionId,
-                                   &pmk_id, 1, FALSE);
+    /* Add to the PMKSA ID Cache in CSR
+     * PMKSA cache will be having following
+     * 1. pmkid id
+     * 2. pmk 15733
+     * 3. bssid or cache identifier
+    */
+   result = sme_RoamSetPMKIDCache(halHandle,pAdapter->sessionId,
+                                   &pmk_cache, 1, FALSE);
 
     MTRACE(vos_trace(VOS_MODULE_ID_HDD,
                      TRACE_CODE_HDD_CFG80211_SET_PMKSA,
@@ -21560,6 +27487,7 @@ static int __wlan_hdd_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     tHalHandle halHandle;
     int status = 0;
+    tPmkidCacheInfo pmk_cache;
 
     ENTER();
 
@@ -21573,13 +27501,8 @@ static int __wlan_hdd_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device
         return -EINVAL;
     }
 
-    if (!pmksa->bssid) {
-        hddLog(LOGE, FL("pmksa->bssid is NULL"));
+    if (!wlan_hdd_is_pmksa_valid(pmksa))
         return -EINVAL;
-    }
-
-    hddLog(VOS_TRACE_LEVEL_DEBUG, FL("Deleting PMKSA for "MAC_ADDRESS_STR),
-           MAC_ADDR_ARRAY(pmksa->bssid));
 
     status = wlan_hdd_validate_context(pHddCtx);
     if (0 != status)
@@ -21590,10 +27513,14 @@ static int __wlan_hdd_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device
     MTRACE(vos_trace(VOS_MODULE_ID_HDD, TRACE_CODE_HDD_CFG80211_DEL_PMKSA,
                                       pAdapter->sessionId, 0));
 
+    vos_mem_zero(&pmk_cache, sizeof(pmk_cache));
+
+    hdd_update_pmksa_info(&pmk_cache, pmksa, true);
+
     /* Delete the PMKID CSR cache */
     if (eHAL_STATUS_SUCCESS !=
         sme_RoamDelPMKIDfromCache(halHandle,
-                                  pAdapter->sessionId, pmksa->bssid, FALSE)) {
+                                  pAdapter->sessionId, &pmk_cache, FALSE)) {
        hddLog(LOGE, FL("Failed to delete PMKSA for "MAC_ADDRESS_STR),
                       MAC_ADDR_ARRAY(pmksa->bssid));
        status = -EINVAL;
@@ -21787,39 +27714,105 @@ void hdd_cfg80211_sched_scan_done_callback(void *callbackContext,
 
     ret = wlan_hdd_cfg80211_update_bss(pHddCtx->wiphy, pAdapter);
 
-    if (0 > ret)
+    if (0 > ret) {
         hddLog(VOS_TRACE_LEVEL_INFO, "%s: NO SCAN result", __func__);
 
+    } else {
+        /*
+         * Acquire wakelock to handle the case where APP's tries to suspend
+         * immediately after the driver gets connect request(i.e after pno)
+         * from supplicant, this result in app's is suspending and not able
+         * to process the connect request to AP
+         */
+        hdd_prevent_suspend_timeout(1000, WIFI_POWER_EVENT_WAKELOCK_SCAN);
+    }
     cfg80211_sched_scan_results(pHddCtx->wiphy);
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
             "%s: cfg80211 scan result database updated", __func__);
 }
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,4,0)) || \
+    defined (CFG80211_MULTI_SCAN_PLAN_BACKPORT)
+/**
+ * hdd_config_sched_scan_plan() - configures the sched scan plans
+ *	from the framework.
+ * @pno_req: pointer to PNO scan request
+ * @request: pointer to scan request from framework
+ *
+ * Return: None
+ */
+static void hdd_config_sched_scan_plan(tpSirPNOScanReq pno_req,
+				struct cfg80211_sched_scan_request *request,
+				hdd_context_t *hdd_ctx)
+{
+	if (request->n_scan_plans == 2) {
+		pno_req->fast_scan_period =
+			request->scan_plans[0].interval * MSEC_PER_SEC;
+		pno_req->fast_scan_max_cycles =
+			request->scan_plans[0].iterations;
+		pno_req->slow_scan_period =
+			request->scan_plans[1].interval * MSEC_PER_SEC;
+		hddLog(LOGE, "Base scan interval: %d sec, scan cycles: %d, slow scan interval %d",
+		       request->scan_plans[0].interval,
+		       request->scan_plans[0].iterations,
+		       request->scan_plans[1].interval);
+	} else if (request->n_scan_plans == 1) {
+		pno_req->fast_scan_period = request->scan_plans[0].interval *
+			MSEC_PER_SEC;
+		pno_req->fast_scan_max_cycles = 1;
+		pno_req->slow_scan_period = request->scan_plans[0].interval *
+			MSEC_PER_SEC;
+	} else {
+		hddLog(LOGE, "Invalid number of scan plans %d !!",
+		       request->n_scan_plans);
+	}
+}
+#else
+static void hdd_config_sched_scan_plan(tpSirPNOScanReq pno_req,
+				struct cfg80211_sched_scan_request *request,
+				hdd_context_t *hdd_ctx)
+{
+	pno_req->fast_scan_period = request->interval;
+	pno_req->fast_scan_max_cycles =
+		hdd_ctx->cfg_ini->configPNOScanTimerRepeatValue;
+	pno_req->slow_scan_period =
+		hdd_ctx->cfg_ini->pno_slow_scan_multiplier *
+		pno_req->fast_scan_period;
+	hddLog(LOGE, "Base scan interval: %d sec PNOScanTimerRepeatValue: %d",
+		    (request->interval / 1000),
+		    hdd_ctx->cfg_ini->configPNOScanTimerRepeatValue);
+}
+#endif
+
 /**
- * wlan_hdd_is_pno_allowed() -  Check if PNO is allowed
- * @adapter: HDD Device Adapter
+ * wlan_hdd_sched_scan_update_relative_rssi() - update CPNO params
+ * @pno_request: pointer to PNO scan request
+ * @request: Pointer to cfg80211 scheduled scan start request
  *
- * The PNO Start request is coming from upper layers.
- * It is to be allowed only for Infra STA device type
- * and the link should be in a disconnected state.
+ * This function is used to update Connected PNO params sent by kernel
  *
- * Return: Success if PNO is allowed, Failure otherwise.
+ * Return: None
  */
-static eHalStatus wlan_hdd_is_pno_allowed(hdd_adapter_t *adapter)
+#if defined(CFG80211_REPORT_BETTER_BSS_IN_SCHED_SCAN)
+static inline void wlan_hdd_sched_scan_update_relative_rssi(
+			tpSirPNOScanReq pno_request,
+			struct cfg80211_sched_scan_request *request)
+{
+	pno_request->relative_rssi_set = request->relative_rssi_set;
+	pno_request->relative_rssi = request->relative_rssi;
+	if (NL80211_BAND_2GHZ == request->rssi_adjust.band)
+		pno_request->band_rssi_pref.band = SIR_BAND_2_4_GHZ;
+	else if (NL80211_BAND_5GHZ == request->rssi_adjust.band)
+		pno_request->band_rssi_pref.band = SIR_BAND_5_GHZ;
+	pno_request->band_rssi_pref.rssi = request->rssi_adjust.delta;
+}
+#else
+static inline void wlan_hdd_sched_scan_update_relative_rssi(
+			tpSirPNOScanReq pno_request,
+			struct cfg80211_sched_scan_request *request)
 {
-	hddLog(LOG1,
-		FL("dev_mode=%d, conn_state=%d, session ID=%d"),
-		adapter->device_mode,
-		adapter->sessionCtx.station.conn_info.connState,
-		adapter->sessionId);
-	if ((adapter->device_mode == WLAN_HDD_INFRA_STATION) &&
-		(eConnectionState_NotConnected ==
-			 adapter->sessionCtx.station.conn_info.connState))
-		return eHAL_STATUS_SUCCESS;
-	else
-		return eHAL_STATUS_FAILURE;
-
 }
+#endif
 
 /*
  * FUNCTION: __wlan_hdd_cfg80211_sched_scan_start
@@ -21841,6 +27834,7 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
     hdd_scaninfo_t *pScanInfo = &pAdapter->scan_info;
     hdd_config_t *config = NULL;
     v_U32_t num_ignore_dfs_ch = 0;
+    hdd_station_ctx_t *station_ctx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
 
     ENTER();
 
@@ -21868,7 +27862,7 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
            (WLAN_HDD_GET_STATION_CTX_PTR(pAdapter))->conn_info.connState))
     {
         hddLog(VOS_TRACE_LEVEL_ERROR,
-                "%s: %p(%d) Connection in progress: sched_scan_start denied (EBUSY)",
+                "%s: %pK(%d) Connection in progress: sched_scan_start denied (EBUSY)",
                __func__,
                 WLAN_HDD_GET_STATION_CTX_PTR(pAdapter), pAdapter->sessionId);
         return -EBUSY;
@@ -21884,7 +27878,6 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
      * that the wlan wakelock which was held in the wlan_hdd_cfg80211_scan
      * function.
      */
-    sme_ScanFlushResult(hHal, pAdapter->sessionId);
     if (TRUE == pScanInfo->mScanPending)
     {
         ret = wlan_hdd_scan_abort(pAdapter);
@@ -21895,14 +27888,14 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
         }
     }
 
-    if (eHAL_STATUS_FAILURE == wlan_hdd_is_pno_allowed(pAdapter))
-    {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                  "%s: pno is not allowed", __func__);
-        return -ENOTSUPP;
-    }
+    if (!hdd_connIsConnected(station_ctx) &&
+        pHddCtx->cfg_ini->probe_req_ie_whitelist)
+        pPnoRequest = (tpSirPNOScanReq) vos_mem_malloc(sizeof(tSirPNOScanReq) +
+                                    (pHddCtx->no_of_probe_req_ouis) *
+                                    (sizeof(struct vendor_oui)));
+    else
+        pPnoRequest = (tpSirPNOScanReq) vos_mem_malloc(sizeof(tSirPNOScanReq));
 
-    pPnoRequest = (tpSirPNOScanReq) vos_mem_malloc(sizeof (tSirPNOScanReq));
     if (NULL == pPnoRequest)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
@@ -21910,7 +27903,14 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
         return -ENOMEM;
     }
 
-    memset(pPnoRequest, 0, sizeof (tSirPNOScanReq));
+    if (!hdd_connIsConnected(station_ctx) &&
+        pHddCtx->cfg_ini->probe_req_ie_whitelist)
+        memset(pPnoRequest, 0, sizeof (tSirPNOScanReq) +
+               (pHddCtx->no_of_probe_req_ouis) *
+               (sizeof(struct vendor_oui)));
+    else
+        memset(pPnoRequest, 0, sizeof (tSirPNOScanReq));
+
     pPnoRequest->enable = 1; /*Enable PNO */
     pPnoRequest->ucNetworksCount = request->n_match_sets;
     if ((!pPnoRequest->ucNetworksCount ) ||
@@ -22046,8 +28046,8 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
 
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
               "request->ie_len = %zu", request->ie_len);
-    if ((0 < request->ie_len) && (NULL != request->ie))
-    {
+    if ((request->ie_len > 0 && request->ie_len <= SIR_PNO_MAX_PB_REQ_SIZE) &&
+        (NULL != request->ie)) {
         pPnoRequest->us24GProbeTemplateLen = request->ie_len;
         memcpy(&pPnoRequest->p24GProbeTemplate, request->ie,
                 pPnoRequest->us24GProbeTemplateLen);
@@ -22057,22 +28057,8 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
                 pPnoRequest->us5GProbeTemplateLen);
     }
 
-    /*
-     * Driver gets only one time interval which is hard coded in
-     * supplicant for 10000ms. Taking power consumption into account
-     * firmware after gPNOScanTimerRepeatValue times fast_scan_period switches
-     * slow_scan_period. This is less frequent scans and firmware shall be
-     * in slow_scan_period mode until next PNO Start.
-     */
-    pPnoRequest->fast_scan_period = request->interval;
-    pPnoRequest->fast_scan_max_cycles =
-                              pHddCtx->cfg_ini->configPNOScanTimerRepeatValue;
-    pPnoRequest->slow_scan_period = pHddCtx->cfg_ini->pno_slow_scan_multiplier *
-                                        pPnoRequest->fast_scan_period;
-
-    hddLog(LOG1, "Base scan interval: %d sec PNOScanTimerRepeatValue: %d",
-           (request->interval / 1000),
-            pHddCtx->cfg_ini->configPNOScanTimerRepeatValue);
+    hdd_config_sched_scan_plan(pPnoRequest, request, pHddCtx);
+    wlan_hdd_sched_scan_update_relative_rssi(pPnoRequest, request);
 
     pPnoRequest->modePNO = SIR_PNO_MODE_IMMEDIATE;
 
@@ -22080,6 +28066,19 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
              "SessionId %d, enable %d, modePNO %d",
              pAdapter->sessionId, pPnoRequest->enable, pPnoRequest->modePNO);
 
+    wlan_hdd_update_scan_rand_attrs((void *)pPnoRequest, (void *)request,
+                                    WLAN_HDD_PNO_SCAN);
+
+    if (pHddCtx->cfg_ini->probe_req_ie_whitelist &&
+        !hdd_connIsConnected(station_ctx))
+        wlan_hdd_fill_whitelist_ie_attrs(&pPnoRequest->ie_whitelist,
+                                         pPnoRequest->probe_req_ie_bitmap,
+                                         &pPnoRequest->num_vendor_oui,
+                                         (struct vendor_oui *)(
+                                         (uint8_t *)pPnoRequest +
+                                         sizeof(*pPnoRequest)),
+                                         pHddCtx);
+
     status = sme_SetPreferredNetworkList(WLAN_HDD_GET_HAL_CTX(pAdapter),
                               pPnoRequest, pAdapter->sessionId,
                               hdd_cfg80211_sched_scan_done_callback, pAdapter);
@@ -22297,6 +28296,7 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
     u32 peer_capability;
     peer_capability = 0;
 #endif
+    tdlsCtx_t *pHddTdlsCtx;
 
     MTRACE(vos_trace(VOS_MODULE_ID_HDD,
                      TRACE_CODE_HDD_CFG80211_TDLS_MGMT,
@@ -22310,6 +28310,12 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
         return -EINVAL;
     }
 
+    pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
+    if (!pHddTdlsCtx) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: pHddTdlsCtx not valid.", __func__);
+    }
+
     if (eTDLS_SUPPORT_NOT_ENABLED == pHddCtx->tdls_mode)
     {
          VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
@@ -22369,7 +28375,7 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
     }
     if (WLAN_IS_TDLS_SETUP_ACTION(action_code))
     {
-        if (NULL != wlan_hdd_tdls_is_progress(pHddCtx, peer, TRUE))
+        if (NULL != wlan_hdd_tdls_is_progress(pHddCtx, peer, TRUE, TRUE))
         {
             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                        "%s: " MAC_ADDRESS_STR
@@ -22426,14 +28432,17 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
         else
         {
             hddTdlsPeer_t *pTdlsPeer;
-            pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, TRUE);
+            mutex_lock(&pHddCtx->tdls_lock);
+            pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, FALSE);
             if (pTdlsPeer && TDLS_IS_CONNECTED(pTdlsPeer))
             {
+                mutex_unlock(&pHddCtx->tdls_lock);
                 VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                         "%s:" MAC_ADDRESS_STR " already connected. action %d declined.",
                         __func__, MAC_ADDR_ARRAY(peer), action_code);
                 return -EPERM;
             }
+            mutex_unlock(&pHddCtx->tdls_lock);
         }
     }
 
@@ -22448,7 +28457,8 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
     {
 
        hddTdlsPeer_t *pTdlsPeer;
-       pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, TRUE);
+       mutex_lock(&pHddCtx->tdls_lock);
+       pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter, peer, FALSE);
 
        if(pTdlsPeer && TDLS_IS_CONNECTED(pTdlsPeer))
             responder = pTdlsPeer->is_responder;
@@ -22458,8 +28468,10 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
                     "%s: " MAC_ADDRESS_STR " peer doesn't exist or not connected %d dialog_token %d status %d, len = %zu",
                     __func__, MAC_ADDR_ARRAY(peer), (NULL == pTdlsPeer) ? -1 : pTdlsPeer->link_status,
                      dialog_token, status_code, len);
+           mutex_unlock(&pHddCtx->tdls_lock);
            return -EPERM;
        }
+       mutex_unlock(&pHddCtx->tdls_lock);
     }
 
     /* For explicit trigger of DIS_REQ come out of BMPS for
@@ -22477,7 +28489,9 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                           "%s: Sending frame action_code %u.Disable BMPS",
                           __func__, action_code);
-                hdd_disable_bmps_imps(pHddCtx, WLAN_HDD_INFRA_STATION);
+                status = hdd_disable_bmps_imps(pHddCtx, WLAN_HDD_INFRA_STATION);
+                if ((status == VOS_STATUS_SUCCESS) && (pHddTdlsCtx != NULL))
+                    pHddTdlsCtx->is_tdls_disabled_bmps = true;
             }
         }
         if (SIR_MAC_TDLS_DIS_REQ != action_code)
@@ -22567,7 +28581,7 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
             vos_flush_logs(WLAN_LOG_TYPE_FATAL,
                            WLAN_LOG_INDICATOR_HOST_DRIVER,
                            WLAN_LOG_REASON_HDD_TIME_OUT,
-                           true);
+                           DUMP_VOS_TRACE);
         pAdapter->mgmtTxCompletionStatus = FALSE;
         wlan_hdd_tdls_check_bmps(pAdapter);
         return -EINVAL;
@@ -22710,7 +28724,7 @@ int wlan_hdd_tdls_extctrl_config_peer(hdd_adapter_t *pAdapter,
     /* To cater the requirement of establishing the TDLS link
      * irrespective of the data traffic , get an entry of TDLS peer.
      */
-    pTdlsPeer = wlan_hdd_tdls_get_peer(pAdapter, peer);
+    pTdlsPeer = wlan_hdd_tdls_get_peer(pAdapter, peer, TRUE);
     if (pTdlsPeer == NULL) {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "%s: peer " MAC_ADDRESS_STR " does not exist",
@@ -22927,7 +28941,19 @@ static int __wlan_hdd_cfg80211_tdls_oper(struct wiphy *wiphy,
                         rc = wait_for_completion_timeout(
                                 &pAdapter->tdls_link_establish_req_comp,
                                 msecs_to_jiffies(WAIT_TIME_TDLS_LINK_ESTABLISH_REQ));
-                        if (!rc) {
+                        mutex_lock(&pHddCtx->tdls_lock);
+                        pTdlsPeer = wlan_hdd_tdls_find_peer(pAdapter,
+                                                            peer, FALSE);
+                        if (!pTdlsPeer) {
+                            mutex_unlock(&pHddCtx->tdls_lock);
+                            hddLog(LOGE, FL(MAC_ADDRESS_STR" (oper %d) peer got freed in other context. ignored"),
+                                         MAC_ADDR_ARRAY(peer), (int)oper);
+                            return -EINVAL;
+                        }
+                        mutex_unlock(&pHddCtx->tdls_lock);
+
+                        if ((rc <= 0) || (pTdlsPeer->link_status ==
+                                                eTDLS_LINK_TEARING)) {
                             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                               "%s: Link Establish Request timed out", __func__);
                             return -EINVAL;
@@ -22935,7 +28961,8 @@ static int __wlan_hdd_cfg80211_tdls_oper(struct wiphy *wiphy,
                     }
                     wlan_hdd_tdls_set_peer_link_status(pTdlsPeer,
                                                        eTDLS_LINK_CONNECTED,
-                                                       eTDLS_LINK_SUCCESS);
+                                                       eTDLS_LINK_SUCCESS,
+                                                       TRUE);
 
                     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                               "%s : tdlsLinkEstablishParams of peer " MAC_ADDRESS_STR "uapsdQueues: %d"
@@ -23107,7 +29134,8 @@ static int __wlan_hdd_cfg80211_tdls_oper(struct wiphy *wiphy,
                                 eTDLS_LINK_IDLE,
                                 (pTdlsPeer->link_status == eTDLS_LINK_TEARING)?
                                 eTDLS_LINK_UNSPECIFIED:
-                                eTDLS_LINK_DROPPED_BY_REMOTE);
+                                eTDLS_LINK_DROPPED_BY_REMOTE,
+                                TRUE);
                 }
                 else
                 {
@@ -23631,12 +29659,19 @@ static int __wlan_hdd_cfg80211_testmode(struct wiphy *wiphy,
                 (hb_params_temp->params.lphbTcpParamReq.timePeriodSec == 0))
                 return -EINVAL;
 
+            if (buf_len > sizeof(*hb_params)) {
+                hddLog(LOGE, FL("buf_len=%d exceeded hb_params size limit"),
+                       buf_len);
+                return -ERANGE;
+            }
+
             hb_params = (tSirLPHBReq *)vos_mem_malloc(sizeof(tSirLPHBReq));
             if (NULL == hb_params) {
                 hddLog(LOGE, FL("Request Buffer Alloc Fail"));
                 return -ENOMEM;
             }
 
+            vos_mem_zero(hb_params, sizeof(tSirLPHBReq));
             vos_mem_copy(hb_params, buf, buf_len);
             smeStatus = sme_LPHBConfigReq((tHalHandle)(pHddCtx->hHal),
                                hb_params,
@@ -23707,7 +29742,7 @@ void wlan_hdd_testmode_rx_event(void *buf, size_t buf_len)
 
     if (!buf || !buf_len) {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  "%s: buf or buf_len invalid, buf = %p buf_len = %zu",
+                  "%s: buf or buf_len invalid, buf = %pK buf_len = %zu",
                   __func__, buf, buf_len);
         return;
     }
@@ -23799,17 +29834,6 @@ static void wlan_hdd_chan_info_cb(struct scan_chan_info *info)
 				chan[idx].rx_clear_count = info->rx_clear_count;
 				chan[idx].tx_frame_count = info->tx_frame_count;
 				chan[idx].clock_freq = info->clock_freq;
-				hddLog(LOG1, FL("start "
-					"freq:%u nf:%d cc:%u rcc:%u clk:%u "
-					"cmd:%d tfc:%d index:%d"),
-					chan[idx].freq,
-					chan[idx].noise_floor,
-					chan[idx].cycle_count,
-					chan[idx].rx_clear_count,
-					chan[idx].clock_freq,
-					chan[idx].cmd_flag,
-					chan[idx].tx_frame_count,
-					idx);
 				break;
 			} else if (info->cmd_flag == WMI_CHAN_INFO_END_RESP) {
 				chan[idx].delta_cycle_count =
@@ -23826,20 +29850,6 @@ static void wlan_hdd_chan_info_cb(struct scan_chan_info *info)
 
 				chan[idx].noise_floor = info->noise_floor;
 				chan[idx].cmd_flag = info->cmd_flag;
-				hddLog(LOG1, FL("end "
-					"freq:%u nf:%d cc:%u rcc:%u clk:%u "
-					"cmd:%d tfc:%d dcc:%d drcc:%d dtfc:%d index:%d"),
-					chan[idx].freq,
-					chan[idx].noise_floor,
-					chan[idx].cycle_count,
-					chan[idx].rx_clear_count,
-					chan[idx].clock_freq,
-					chan[idx].cmd_flag,
-					chan[idx].tx_frame_count,
-					chan[idx].delta_cycle_count,
-					chan[idx].delta_rx_clear_count,
-					chan[idx].delta_tx_frame_count,
-					idx);
 				break;
 			} else {
 				hddLog(LOGE, FL("cmd flag is invalid: %d"),
@@ -23935,7 +29945,8 @@ static int __wlan_hdd_cfg80211_dump_survey(struct wiphy *wiphy,
     if (0 != status)
         return status;
 
-    if (NULL == pHddCtx->chan_info) {
+    if ((NULL == pHddCtx->chan_info) &&
+        (pHddCtx->cfg_ini->fEnableSNRMonitoring)) {
         hddLog(LOGE, FL("chan_info is NULL"));
         return -EINVAL;
     }
@@ -24070,11 +30081,18 @@ static int __wlan_hdd_cfg80211_channel_switch(struct wiphy *wiphy,
 	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
 	hdd_context_t *hdd_ctx;
 	v_U8_t channel;
+	uint8_t current_channel;
 	v_U16_t freq;
 	int ret;
+	tsap_Config_t *sap_config;
 
-	hddLog(LOG1, FL(" Set Freq %d"), csa_params->chandef.chan->center_freq);
+	hddLog(LOG1, FL("Set Freq %d sub20 chanwidth %d"),
+	       csa_params->chandef.chan->center_freq,
+	       csa_params->chandef.width);
 
+	current_channel =
+		(WLAN_HDD_GET_AP_CTX_PTR(adapter))->operatingChannel;
+	sap_config = &((WLAN_HDD_GET_AP_CTX_PTR(adapter))->sapConfig);
 	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 	ret = wlan_hdd_validate_context(hdd_ctx);
 
@@ -24089,7 +30107,15 @@ static int __wlan_hdd_cfg80211_channel_switch(struct wiphy *wiphy,
 	freq = csa_params->chandef.chan->center_freq;
 	channel = vos_freq_to_chan(freq);
 
-	ret = hdd_softap_set_channel_change(dev, channel);
+	if (channel != current_channel) {
+		ret = hdd_softap_set_channel_change(dev, channel);
+	} else if (sap_config->sub20_switch_mode == SUB20_MANUAL) {
+		ret = hdd_softap_set_channel_sub20_chanwidth_change(
+					dev, csa_params->chandef.width);
+	} else {
+		hddLog(LOGE, FL("nothing to do"));
+		return -EINVAL;
+	}
 	return ret;
 }
 
@@ -24117,12 +30143,49 @@ static int wlan_hdd_cfg80211_channel_switch(struct wiphy *wiphy,
 }
 #endif
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+static void wlan_hdd_thermal_suspend(hdd_context_t *pHddCtx)
+{
+	/* send auto shutdown timer val 0 to fw as suspend */
+	sme_set_auto_shutdown_timer(pHddCtx->hHal, 0);
+}
+
+static int wlan_hdd_thermal_resume(hdd_context_t *pHddCtx, bool thermal)
+{
+	hddLog(LOG1, "state=%d, thermal=%d\n",
+			   hdd_thermal_suspend_state(pHddCtx), thermal);
+
+	/* If system suspend after thermal suspend, assure system resume first. */
+	if (hdd_thermal_suspend_state(pHddCtx) == HDD_WLAN_THERMAL_SUSPENDED &&
+		!thermal) {
+		hddLog(LOG1, FL("System resume when thermal suspended"));
+		return -EINVAL;
+	}
+
+	/* send auto shutdown timer val 1 to fw as resume */
+	sme_set_auto_shutdown_timer(pHddCtx->hHal, 1);
+
+	return 0;
+}
+#else
+static int wlan_hdd_thermal_resume(hdd_context_t *pHddCtx, bool thermal)
+{
+	return 0;
+}
+
+static void wlan_hdd_thermal_suspend(hdd_context_t *pHddCtx)
+{
+	return;
+}
+
+#endif
+
 /*
  * FUNCTION: __wlan_hdd_cfg80211_resume_wlan
  * this is called when cfg80211 driver resume
  * driver updates  latest sched_scan scan result(if any) to cfg80211 database
  */
-int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
+int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy, bool thermal)
 {
     hdd_context_t *pHddCtx = wiphy_priv(wiphy);
     hdd_adapter_t *pAdapter;
@@ -24149,9 +30212,13 @@ int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
         return 0;
     }
 
-    if (hif_is_80211_fw_wow_required()) {
-       result = wma_resume_fw();
-       if (result) {
+    result = wlan_hdd_thermal_resume(pHddCtx, thermal);
+    if (0 != result)
+        return result;
+
+    if (!thermal && hif_is_80211_fw_wow_required()) {
+        result = wma_resume_fw();
+        if (result) {
           /* SSR happened while we were waiting for this */
           if (result == VOS_STATUS_E_ALREADY)
               return 0;
@@ -24163,9 +30230,8 @@ int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
           if (!vos_is_logp_in_progress(VOS_MODULE_ID_HDD, NULL))
               VOS_BUG(0);
           return -EBUSY;
-       }
+        }
     }
-
     dev = pHddCtx->parent_dev;
     vos_request_bus_bandwidth(dev, CNSS_BUS_WIDTH_MEDIUM);
 
@@ -24184,7 +30250,7 @@ int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
 
 #endif
 
-    hdd_resume_wlan();
+    hdd_resume_wlan(thermal);
 
     MTRACE(vos_trace(VOS_MODULE_ID_HDD, TRACE_CODE_HDD_CFG80211_RESUME_WLAN,
                           NO_SESSION, pHddCtx->isWiphySuspended));
@@ -24213,7 +30279,7 @@ int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
                  * results in app's is in suspended state and not able to
                  * process the connect request to AP
                  */
-                hdd_prevent_suspend_timeout(2000,
+                hdd_prevent_suspend_timeout(1000,
                                          WIFI_POWER_EVENT_WAKELOCK_RESUME_WLAN);
                 cfg80211_sched_scan_results(pHddCtx->wiphy);
             }
@@ -24240,21 +30306,69 @@ void wlan_hdd_cfg80211_ready_to_suspend(void *callbackContext, boolean suspended
 
 int wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
 {
+    hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
     int ret;
 
     vos_ssr_protect(__func__);
-    ret = __wlan_hdd_cfg80211_resume_wlan(wiphy);
+    ret = __wlan_hdd_cfg80211_resume_wlan(wiphy, false);
+    hdd_system_suspend_state_set(hdd_ctx, false);
     vos_ssr_unprotect(__func__);
 
     return ret;
 }
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+static bool wlan_hdd_is_thermal_suspended(hdd_context_t *pHddCtx)
+{
+	if (hdd_thermal_suspend_state(pHddCtx) == HDD_WLAN_THERMAL_SUSPENDED) {
+		hddLog(LOG1, FL("System suspend when thermal suspended"));
+		return true;
+	}
+	return false;
+}
+
+static VOS_STATUS wlan_hdd_suspend_mc_thread(pVosSchedContext vosSchedCtx,
+					hdd_context_t *pHddCtx)
+{
+	return VOS_STATUS_SUCCESS;
+}
+#else
+static bool wlan_hdd_is_thermal_suspended(hdd_context_t *pHddCtx)
+{
+	return false;
+}
+
+static VOS_STATUS wlan_hdd_suspend_mc_thread(pVosSchedContext vosSchedCtx,
+					hdd_context_t *pHddCtx)
+{
+	int rc;
+
+	/* Suspend MC thread */
+	set_bit(MC_SUSPEND_EVENT, &vosSchedCtx->mcEventFlag);
+	wake_up_interruptible(&vosSchedCtx->mcWaitQueue);
+
+	/* Wait for suspend confirmation from MC thread */
+	rc = wait_for_completion_timeout(&pHddCtx->mc_sus_event_var,
+			msecs_to_jiffies(WLAN_WAIT_TIME_MCTHREAD_SUSPEND));
+	if (!rc)
+	{
+		clear_bit(MC_SUSPEND_EVENT, &vosSchedCtx->mcEventFlag);
+		VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+				   "%s: Failed to stop mc thread", __func__);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	pHddCtx->isMcThreadSuspended = TRUE;
+	return VOS_STATUS_SUCCESS;
+}
+
+#endif
 /*
  * FUNCTION: __wlan_hdd_cfg80211_suspend_wlan
  * this is called when cfg80211 driver suspends
  */
 int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
-                                   struct cfg80211_wowlan *wow)
+                                   struct cfg80211_wowlan *wow, bool thermal)
 {
 #ifdef QCA_CONFIG_SMP
 #define RX_TLSHIM_SUSPEND_TIMEOUT 200 /* msecs */
@@ -24280,6 +30394,15 @@ int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
         return -EINVAL;
     }
 
+    if (true == vos_is_mon_enable()) {
+        hddLog(LOGE, FL("command not allowed in FTM mode"));
+        return -EINVAL;
+    }
+
+    if (wlan_hdd_is_thermal_suspended(pHddCtx)) {
+        return 0;
+    }
+
     /* If RADAR detection is in progress (HDD), prevent suspend. The flag
      * "dfs_cac_block_tx" is set to TRUE when RADAR is found and stay TRUE until
      * CAC is done for a SoftAP which is in started state.
@@ -24322,11 +30445,6 @@ int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
         pAdapter = pAdapterNode->pAdapter;
         pScanInfo = &pAdapter->scan_info;
 
-        if (sme_staInMiddleOfRoaming(pHddCtx->hHal, pAdapter->sessionId)) {
-            hddLog(LOG1, FL("Roaming in progress, do not allow suspend"));
-            return -EAGAIN;
-        }
-
         if (pScanInfo->mScanPending && pAdapter->request)
         {
            INIT_COMPLETION(pScanInfo->abortscan_event_var);
@@ -24345,6 +30463,11 @@ int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
            }
         }
 
+        if (sme_staInMiddleOfRoaming(pHddCtx->hHal, pAdapter->sessionId)) {
+            hddLog(LOG1, FL("Roaming in progress, don't allow suspend"));
+            return -EAGAIN;
+        }
+
         if (pAdapter->is_roc_inprogress)
             wlan_hdd_cleanup_remain_on_channel_ctx(pAdapter);
 
@@ -24366,7 +30489,7 @@ int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
     /* Wait for the target to be ready for suspend */
     INIT_COMPLETION(pHddCtx->ready_to_suspend);
 
-    hdd_suspend_wlan(&wlan_hdd_cfg80211_ready_to_suspend, pHddCtx);
+    hdd_suspend_wlan(&wlan_hdd_cfg80211_ready_to_suspend, pHddCtx, thermal);
 
     rc = wait_for_completion_timeout(&pHddCtx->ready_to_suspend,
                              msecs_to_jiffies(WLAN_WAIT_TIME_READY_TO_SUSPEND));
@@ -24385,21 +30508,9 @@ int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
     }
 
     /* Suspend MC thread */
-    set_bit(MC_SUSPEND_EVENT, &vosSchedContext->mcEventFlag);
-    wake_up_interruptible(&vosSchedContext->mcWaitQueue);
-
-    /* Wait for suspend confirmation from MC thread */
-    rc = wait_for_completion_timeout(&pHddCtx->mc_sus_event_var,
-                                 msecs_to_jiffies(WLAN_WAIT_TIME_MCTHREAD_SUSPEND));
-    if (!rc)
-    {
-        clear_bit(MC_SUSPEND_EVENT, &vosSchedContext->mcEventFlag);
-        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                   "%s: Failed to stop mc thread", __func__);
+    status = wlan_hdd_suspend_mc_thread(vosSchedContext, pHddCtx);
+    if (VOS_STATUS_SUCCESS != status)
         goto resume_tx;
-    }
-
-    pHddCtx->isMcThreadSuspended = TRUE;
 
 #ifdef QCA_CONFIG_SMP
     /* Suspend tlshim rx thread */
@@ -24423,17 +30534,20 @@ int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
 
     vos_request_bus_bandwidth(dev, CNSS_BUS_WIDTH_NONE);
 
-    if (hif_is_80211_fw_wow_required()) {
-       rc = wma_suspend_fw();
-       if (rc) {
-          hddLog(LOGE, FL("Failed to suspend FW err:%d"), rc);
-          goto fail_suspend;
-       }
+    if (thermal) {
+        wlan_hdd_thermal_suspend(pHddCtx);
+    } else {
+        if (hif_is_80211_fw_wow_required()) {
+           rc = wma_suspend_fw();
+           if (rc) {
+              hddLog(LOGE, FL("Failed to suspend FW err:%d"), rc);
+              goto fail_suspend;
+           }
+        }
     }
 
     EXIT();
     return 0;
-
 fail_suspend:
     vos_request_bus_bandwidth(dev, CNSS_BUS_WIDTH_MEDIUM);
     pHddCtx->isWiphySuspended = FALSE;
@@ -24452,7 +30566,7 @@ resume_all:
 
 resume_tx:
 
-    hdd_resume_wlan();
+    hdd_resume_wlan(thermal);
 
     return -ETIME;
 }
@@ -24460,15 +30574,18 @@ resume_tx:
 int wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
                                    struct cfg80211_wowlan *wow)
 {
+    hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
     int ret;
 
     vos_ssr_protect(__func__);
-    ret = __wlan_hdd_cfg80211_suspend_wlan(wiphy, wow);
+    ret = __wlan_hdd_cfg80211_suspend_wlan(wiphy, wow, false);
+    hdd_system_suspend_state_set(hdd_ctx, true);
     vos_ssr_unprotect(__func__);
 
     return ret;
 }
 
+
 #ifdef QCA_HT_2040_COEX
 /**
  * __wlan_hdd_cfg80211_set_ap_channel_width() - set ap channel bandwidth
@@ -24487,7 +30604,7 @@ __wlan_hdd_cfg80211_set_ap_channel_width(struct wiphy *wiphy,
     hdd_context_t *pHddCtx;
     VOS_STATUS status;
     tSmeConfigParams smeConfig;
-    bool cbModeChange;
+    bool cbModeChange = false;
 
     pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     status = wlan_hdd_validate_context(pHddCtx);
@@ -24648,6 +30765,10 @@ wlan_hdd_cfg80211_extscan_get_capabilities_rsp(void *ctx,
 	QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_IE_LENGTH
 #define PARAM_IE_DATA \
 	QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_IE_DATA
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+#define PARAM_PAD \
+       QCA_WLAN_VENDOR_ATTR_EXTSCAN_PAD
+#endif
 
 /** hdd_extscan_nl_fill_bss() - extscan nl fill bss
  * @skb: socket buffer
@@ -24665,7 +30786,12 @@ static int hdd_extscan_nl_fill_bss(struct sk_buff *skb, tSirWifiScanResult *ap,
 	if (!nla_ap)
 		return -EINVAL;
 
-	if (nla_put_u64(skb, PARAM_TIME_STAMP, ap->ts) ||
+	if (
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+        nla_put_u64_64bit(skb, PARAM_TIME_STAMP, ap->ts, PARAM_PAD) ||
+#else
+	nla_put_u64(skb, PARAM_TIME_STAMP, ap->ts) ||
+#endif
 	    nla_put(skb, PARAM_SSID, sizeof(ap->ssid), ap->ssid) ||
 	    nla_put(skb, PARAM_BSSID, sizeof(ap->bssid), ap->bssid) ||
 	    nla_put_u32(skb, PARAM_CHANNEL, ap->channel) ||
@@ -24704,7 +30830,9 @@ static int hdd_extscan_nl_fill_bss(struct sk_buff *skb, tSirWifiScanResult *ap,
 #undef PARAM_CAPABILITY
 #undef PARAM_IE_LENGTH
 #undef PARAM_IE_DATA
-
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+#undef PARAM_PAD
+#endif
 
 /** wlan_hdd_cfg80211_extscan_cached_results_ind() - get cached results
  * @ctx: hdd global context
@@ -25029,9 +31157,17 @@ wlan_hdd_cfg80211_extscan_hotlist_match_ind(void *ctx,
 			if (!ap)
 				goto fail;
 
-			if (nla_put_u64(skb,
+			if (
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+                           nla_put_u64_64bit(skb,
+                               QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_TIME_STAMP,
+                               data->ap[i].ts,
+                               QCA_WLAN_VENDOR_ATTR_EXTSCAN_PAD) ||
+#else
+				nla_put_u64(skb,
 				QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_TIME_STAMP,
 				data->ap[i].ts) ||
+#endif
 			    nla_put(skb,
 				QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_SSID,
 				sizeof(data->ap[i].ssid),
@@ -25119,152 +31255,6 @@ wlan_hdd_cfg80211_extscan_generic_rsp
 }
 
 /**
- * wlan_hdd_cfg80211_extscan_hotlist_ssid_match_ind() -
- *	Handle an SSID hotlist match event
- * @ctx: HDD context registered with SME
- * @event: The SSID hotlist match event
- *
- * This function will take an SSID match event that was generated by
- * firmware and will convert it into a cfg80211 vendor event which is
- * sent to userspace.
- * This callback execute in atomic context and must not invoke any
- * blocking calls.
- *
- * Return: none
- */
-static void
-wlan_hdd_cfg80211_extscan_hotlist_ssid_match_ind(void *ctx,
-						 tpSirWifiScanResultEvent event)
-{
-	hdd_context_t *hdd_ctx = ctx;
-	struct sk_buff *skb;
-	unsigned i;
-	unsigned index;
-	int flags = vos_get_gfp_flags();
-
-	ENTER();
-
-	if (wlan_hdd_validate_context(hdd_ctx))
-		return;
-
-	if (!event) {
-		hddLog(LOGE,
-			FL("event is null"));
-		return;
-	}
-	if (event->ap_found) {
-		index = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_FOUND_INDEX;
-		hddLog(LOG1, "SSID hotlist found");
-	} else {
-		index = QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_HOTLIST_SSID_LOST_INDEX;
-		hddLog(LOG1, "SSID hotlist lost");
-	}
-
-	skb = cfg80211_vendor_event_alloc(hdd_ctx->wiphy,
-		NULL,
-		EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-		index, flags);
-
-	if (!skb) {
-		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
-		return;
-	}
-	hddLog(LOG1, "Req Id %u, Num results %u, More Data (%u)",
-	       event->requestId, event->numOfAps, event->moreData);
-
-	for (i = 0; i < event->numOfAps; i++) {
-		hddLog(LOG1, "[i=%d] Timestamp %llu "
-		       "Ssid: %s "
-		       "Bssid (" MAC_ADDRESS_STR ") "
-		       "Channel %u "
-		       "Rssi %d "
-		       "RTT %u "
-		       "RTT_SD %u",
-		       i,
-		       event->ap[i].ts,
-		       event->ap[i].ssid,
-		       MAC_ADDR_ARRAY(event->ap[i].bssid),
-		       event->ap[i].channel,
-		       event->ap[i].rssi,
-		       event->ap[i].rtt,
-		       event->ap[i].rtt_sd);
-	}
-
-	if (nla_put_u32(skb,
-			QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-			event->requestId) ||
-	    nla_put_u32(skb,
-			QCA_WLAN_VENDOR_ATTR_EXTSCAN_NUM_RESULTS_AVAILABLE,
-			event->numOfAps)) {
-		hddLog(LOGE, FL("put fail"));
-		goto fail;
-	}
-
-	if (event->numOfAps) {
-		struct nlattr *aps;
-		aps = nla_nest_start(skb,
-				     QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_LIST);
-		if (!aps) {
-			hddLog(LOGE, FL("nest fail"));
-			goto fail;
-		}
-
-		for (i = 0; i < event->numOfAps; i++) {
-			struct nlattr *ap;
-
-			ap = nla_nest_start(skb, i);
-			if (!ap) {
-				hddLog(LOGE, FL("nest fail"));
-				goto fail;
-			}
-
-			if (nla_put_u64(skb,
-					QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_TIME_STAMP,
-					event->ap[i].ts) ||
-			    nla_put(skb,
-				    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_SSID,
-				    sizeof(event->ap[i].ssid),
-				    event->ap[i].ssid) ||
-			    nla_put(skb,
-				    QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_BSSID,
-				    sizeof(event->ap[i].bssid),
-				    event->ap[i].bssid) ||
-			    nla_put_u32(skb,
-					QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_CHANNEL,
-					event->ap[i].channel) ||
-			    nla_put_s32(skb,
-					QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RSSI,
-					event->ap[i].rssi) ||
-			    nla_put_u32(skb,
-					QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT,
-					event->ap[i].rtt) ||
-			    nla_put_u32(skb,
-					QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_RTT_SD,
-					event->ap[i].rtt_sd)) {
-				hddLog(LOGE, FL("put fail"));
-				goto fail;
-			}
-			nla_nest_end(skb, ap);
-		}
-		nla_nest_end(skb, aps);
-
-		if (nla_put_u8(skb,
-			       QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_MORE_DATA,
-			       event->moreData)) {
-			hddLog(LOGE, FL("put fail"));
-			goto fail;
-		}
-	}
-
-	cfg80211_vendor_event(skb, flags);
-	return;
-
-fail:
-	kfree_skb(skb);
-	return;
-}
-
-/**
  * wlan_hdd_cfg80211_extscan_signif_wifi_change_results_ind() - results callback
  * @hddctx: HDD context
  * @data: event data
@@ -25464,9 +31454,16 @@ wlan_hdd_cfg80211_extscan_full_scan_result_event(void *ctx,
 
 	if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
 		pData->requestId) ||
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+           nla_put_u64_64bit(skb,
+               QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_TIME_STAMP,
+               pData->ap.ts,
+               QCA_WLAN_VENDOR_ATTR_EXTSCAN_PAD) ||
+#else
 	    nla_put_u64(skb,
 		QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_TIME_STAMP,
 		pData->ap.ts) ||
+#endif
 	    nla_put(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_RESULT_SSID,
 		sizeof(pData->ap.ssid),
 		pData->ap.ssid) ||
@@ -25985,11 +31982,6 @@ void wlan_hdd_cfg80211_extscan_callback(void *ctx, const tANI_U16 evType,
 	    wlan_hdd_cfg80211_extscan_generic_rsp(ctx, pMsg);
 	    break;
 
-    case eSIR_EXTSCAN_HOTLIST_SSID_MATCH_IND:
-            wlan_hdd_cfg80211_extscan_hotlist_ssid_match_ind(ctx,
-                                    (tpSirWifiScanResultEvent)pMsg);
-            break;
-
     default:
             hddLog(LOGE, FL("Unknown event type %u"), evType);
             break;
@@ -25998,6 +31990,43 @@ void wlan_hdd_cfg80211_extscan_callback(void *ctx, const tANI_U16 evType,
 
 #endif /* FEATURE_WLAN_EXTSCAN */
 
+/**
+ * wlan_hdd_cfg80211_chainrssi_callback - chainrssi callback
+ * @ctx: hdd context
+ * @pmsg: pmsg
+ *
+ * Return: void
+ */
+void wlan_hdd_cfg80211_chainrssi_callback(void *ctx, void *pmsg)
+{
+	hdd_context_t *hdd_ctx = (hdd_context_t *)ctx;
+	struct chain_rssi_result *data = (struct chain_rssi_result *)pmsg;
+	struct hdd_chain_rssi_context *context;
+	bool ignore_result;
+
+	ENTER();
+
+	if (wlan_hdd_validate_context(hdd_ctx))
+		return;
+
+	spin_lock(&hdd_context_lock);
+	context = &hdd_ctx->chain_rssi_context;
+	ignore_result = context->ignore_result;
+
+	if (ignore_result) {
+		hddLog(LOGE, FL("Ignore the result received after timeout"));
+		spin_unlock(&hdd_context_lock);
+		return;
+	}
+
+	memcpy(&context->result, data, sizeof(*data));
+
+	complete(&context->response_event);
+	spin_unlock(&hdd_context_lock);
+
+	return;
+}
+
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,5,0)) || \
     defined(CFG80211_ABORT_SCAN)
 /**
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_debugfs.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_debugfs.c
index 5871ae6a54a..b4a7205bf33 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_debugfs.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_debugfs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -29,10 +29,21 @@
 #include <wlan_hdd_includes.h>
 #include <wlan_hdd_wowl.h>
 #include <vos_sched.h>
+#include "wlan_hdd_debugfs.h"
+#include "wlan_hdd_debugfs_ocb.h"
 
 #define MAX_USER_COMMAND_SIZE_WOWL_ENABLE 8
 #define MAX_USER_COMMAND_SIZE_WOWL_PATTERN 512
-#define MAX_USER_COMMAND_SIZE_FRAME 4096
+
+#ifdef MULTI_IF_NAME
+#define HDD_DEBUGFS_DIRNAME "wlan_wcnss" MULTI_IF_NAME
+#else
+#define HDD_DEBUGFS_DIRNAME "wlan_wcnss"
+#endif
+
+#ifdef WLAN_POWER_DEBUGFS
+#define POWER_DEBUGFS_BUFFER_MAX_LEN 4096
+#endif
 
 /**
  * __wcnss_wowenable_write() - write wow enable
@@ -535,13 +546,13 @@ static ssize_t wcnss_patterngen_write(struct file *file,
 }
 
 /**
- * __wcnss_debugfs_open() - open debugfs
+ * __wlan_hdd_debugfs_open() - open debugfs
  * @inode: inode pointer
  * @file: file pointer
  *
  * Return: 0 on success, error number otherwise
  */
-static int __wcnss_debugfs_open(struct inode *inode, struct file *file)
+static int __wlan_hdd_debugfs_open(struct inode *inode, struct file *file)
 {
 	hdd_adapter_t *adapter;
 	hdd_context_t *hdd_ctx;
@@ -570,48 +581,349 @@ static int __wcnss_debugfs_open(struct inode *inode, struct file *file)
 }
 
 /**
- * wcnss_debugfs_open() - SSR wrapper for __wcnss_debugfs_open
+ * wlan_hdd_debugfs_open() - SSR wrapper for __wlan_hdd_debugfs_open
  * @inode: inode pointer
  * @file: file pointer
  *
  * Return: 0 on success, error number otherwise
  */
-static int wcnss_debugfs_open(struct inode *inode, struct file *file)
+int wlan_hdd_debugfs_open(struct inode *inode, struct file *file)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __wlan_hdd_debugfs_open(inode, file);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+#ifdef WLAN_POWER_DEBUGFS
+/**
+ * hdd_power_debugstats_cb() - callback routine for Power stats debugs
+ * @response: Pointer to Power stats response
+ * @context: Pointer to statsContext
+ *
+ * Return: None
+ */
+static void hdd_power_debugstats_cb(struct power_stats_response *response,
+						void *context)
+{
+	struct statsContext *stats_context;
+	struct power_stats_response *power_stats;
+	hdd_adapter_t *adapter;
+	uint32_t power_stats_len;
+	uint32_t stats_registers_len;
+
+	ENTER();
+	if (NULL == context) {
+		hddLog(LOGE, FL("context is NULL"));
+		return;
+	}
+
+	stats_context = (struct statsContext *)context;
+
+	spin_lock(&hdd_context_lock);
+	adapter = stats_context->pAdapter;
+	if ((POWER_STATS_MAGIC != stats_context->magic) ||
+	    (NULL == adapter) ||
+	    (WLAN_HDD_ADAPTER_MAGIC != adapter->magic)) {
+		spin_unlock(&hdd_context_lock);
+		hddLog(LOGE, FL("Invalid context, adapter [%pK] magic [%08x]"),
+			adapter, stats_context->magic);
+		return;
+	}
+
+	/* Invalidate the Stats context magic */
+	stats_context->magic = 0;
+
+	stats_registers_len = (sizeof(response->debug_registers[0]) *
+					response->num_debug_register);
+	power_stats_len = stats_registers_len + sizeof(*power_stats);
+	adapter->chip_power_stats = vos_mem_malloc(power_stats_len);
+	if (!adapter->chip_power_stats) {
+		hddLog(LOGE, FL("Power stats memory alloc fails!"));
+		goto exit_stats_cb;
+	}
+
+	power_stats = adapter->chip_power_stats;
+	vos_mem_zero(power_stats, power_stats_len);
+
+	power_stats->cumulative_sleep_time_ms
+			= response->cumulative_sleep_time_ms;
+	power_stats->cumulative_total_on_time_ms
+			= response->cumulative_total_on_time_ms;
+	power_stats->deep_sleep_enter_counter
+			= response->deep_sleep_enter_counter;
+	power_stats->last_deep_sleep_enter_tstamp_ms
+			= response->last_deep_sleep_enter_tstamp_ms;
+	power_stats->debug_register_fmt
+			= response->debug_register_fmt;
+	power_stats->num_debug_register
+			= response->num_debug_register;
+
+	power_stats->debug_registers = (uint32_t *)(power_stats + 1);
+
+	vos_mem_copy(power_stats->debug_registers,
+			response->debug_registers,
+			stats_registers_len);
+
+exit_stats_cb:
+	complete(&stats_context->completion);
+	spin_unlock(&hdd_context_lock);
+	EXIT();
+}
+
+/**
+ * __wlan_hdd_read_power_debugfs() - API to collect Chip power stats from FW
+ * @file: file pointer
+ * @buf: buffer
+ * @count: count
+ * @pos: position pointer
+ *
+ * Return: Number of bytes read on success, error number otherwise
+ */
+static ssize_t __wlan_hdd_read_power_debugfs(struct file *file,
+				char __user *buf,
+				size_t count, loff_t *pos)
+{
+	hdd_adapter_t *adapter;
+	hdd_context_t *hdd_ctx;
+	struct statsContext context;
+	struct power_stats_response *chip_power_stats;
+	ssize_t ret_cnt = 0;
+	int rc = 0, j;
+	unsigned int len = 0;
+	char *power_debugfs_buf;
+
+	ENTER();
+	adapter = (hdd_adapter_t *)file->private_data;
+	if ((NULL == adapter) || (WLAN_HDD_ADAPTER_MAGIC != adapter->magic)) {
+		hddLog(LOGE,
+			FL("Invalid adapter or adapter has invalid magic"));
+		return -EINVAL;
+	}
+
+	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+	ret_cnt = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != ret_cnt)
+		return ret_cnt;
+
+	mutex_lock(&hdd_ctx->power_stats_lock);
+
+	if (adapter->chip_power_stats)
+		vos_mem_free(adapter->chip_power_stats);
+
+	adapter->chip_power_stats = NULL;
+	context.pAdapter = adapter;
+	context.magic = POWER_STATS_MAGIC;
+
+	init_completion(&context.completion);
+
+	if (eHAL_STATUS_SUCCESS !=
+		sme_power_debug_stats_req(hdd_ctx->hHal,
+					hdd_power_debugstats_cb,
+					&context)) {
+		hddLog(LOGE, FL("chip power stats request failed"));
+		ret_cnt = -EINVAL;
+		goto out;
+	}
+
+	rc = wait_for_completion_timeout(&context.completion,
+			msecs_to_jiffies(WLAN_WAIT_TIME_POWER_STATS));
+	if (!rc) {
+		hddLog(LOGE, FL("Target response timed out Power stats"));
+		/* Invalidate the Stats context magic */
+		spin_lock(&hdd_context_lock);
+		context.magic = 0;
+		spin_unlock(&hdd_context_lock);
+		ret_cnt = -ETIMEDOUT;
+		goto out;
+	}
+
+	chip_power_stats = adapter->chip_power_stats;
+	if (!chip_power_stats) {
+		hddLog(LOGE, FL("Power stats retrieval fails!"));
+		ret_cnt = -EINVAL;
+		goto out;
+	}
+
+	power_debugfs_buf = vos_mem_malloc(POWER_DEBUGFS_BUFFER_MAX_LEN);
+	if (!power_debugfs_buf) {
+		hddLog(LOGE, FL("Power stats buffer alloc fails!"));
+		vos_mem_free(chip_power_stats);
+		adapter->chip_power_stats = NULL;
+		ret_cnt = -EINVAL;
+		goto out;
+	}
+
+	len += scnprintf(power_debugfs_buf, POWER_DEBUGFS_BUFFER_MAX_LEN,
+			"POWER DEBUG STATS\n=================\n"
+			"cumulative_sleep_time_ms: %d\n"
+			"cumulative_total_on_time_ms: %d\n"
+			"deep_sleep_enter_counter: %d\n"
+			"last_deep_sleep_enter_tstamp_ms: %d\n"
+			"debug_register_fmt: %d\n"
+			"num_debug_register: %d\n",
+			chip_power_stats->cumulative_sleep_time_ms,
+			chip_power_stats->cumulative_total_on_time_ms,
+			chip_power_stats->deep_sleep_enter_counter,
+			chip_power_stats->last_deep_sleep_enter_tstamp_ms,
+			chip_power_stats->debug_register_fmt,
+			chip_power_stats->num_debug_register);
+
+	for (j = 0; j < chip_power_stats->num_debug_register; j++) {
+		if ((POWER_DEBUGFS_BUFFER_MAX_LEN - len) > 0)
+			len += scnprintf(power_debugfs_buf + len,
+					POWER_DEBUGFS_BUFFER_MAX_LEN - len,
+					"debug_registers[%d]: 0x%x\n", j,
+					chip_power_stats->debug_registers[j]);
+		else
+			j = chip_power_stats->num_debug_register;
+	}
+
+	vos_mem_free(chip_power_stats);
+	adapter->chip_power_stats = NULL;
+
+	ret_cnt = simple_read_from_buffer(buf, count, pos,
+					power_debugfs_buf, len);
+	vos_mem_free(power_debugfs_buf);
+
+out:
+	mutex_unlock(&hdd_ctx->power_stats_lock);
+	return ret_cnt;
+}
+
+/**
+ * wlan_hdd_read_power_debugfs() - SSR wrapper function to read power debugfs
+ * @file: file pointer
+ * @buf: buffer
+ * @count: count
+ * @pos: position pointer
+ *
+ * Return: Number of bytes read on success, error number otherwise
+ */
+static ssize_t wlan_hdd_read_power_debugfs(struct file *file,
+				char __user *buf,
+				size_t count, loff_t *pos)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __wlan_hdd_read_power_debugfs(file, buf, count, pos);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+/**
+ * __wlan_hdd_open_power_debugfs() - Function to save private on open
+ * @inode: Pointer to inode structure
+ * @file: file pointer
+ *
+ * Return: zero
+ */
+static int __wlan_hdd_open_power_debugfs(struct inode *inode, struct file *file)
+{
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+/**
+ * wlan_hdd_open_power_debugfs() - SSR wrapper function to save private on open
+ * @inode: Pointer to inode structure
+ * @file: file pointer
+ *
+ * Return: zero
+ */
+static int wlan_hdd_open_power_debugfs(struct inode *inode, struct file *file)
 {
 	int ret;
 
 	vos_ssr_protect(__func__);
-	ret = __wcnss_debugfs_open(inode, file);
+	ret = __wlan_hdd_open_power_debugfs(inode, file);
 	vos_ssr_unprotect(__func__);
 
 	return ret;
 }
 
+#endif
+
+
 static const struct file_operations fops_wowenable = {
     .write = wcnss_wowenable_write,
-    .open = wcnss_debugfs_open,
+    .open = wlan_hdd_debugfs_open,
     .owner = THIS_MODULE,
     .llseek = default_llseek,
 };
 
 static const struct file_operations fops_wowpattern = {
     .write = wcnss_wowpattern_write,
-    .open = wcnss_debugfs_open,
+    .open = wlan_hdd_debugfs_open,
     .owner = THIS_MODULE,
     .llseek = default_llseek,
 };
 
 static const struct file_operations fops_patterngen = {
     .write = wcnss_patterngen_write,
-    .open = wcnss_debugfs_open,
+    .open = wlan_hdd_debugfs_open,
     .owner = THIS_MODULE,
     .llseek = default_llseek,
 };
 
+#ifdef WLAN_POWER_DEBUGFS
+static const struct file_operations fops_powerdebugs = {
+	.read = wlan_hdd_read_power_debugfs,
+	.open = wlan_hdd_open_power_debugfs,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * wlan_hdd_init_power_stats_debugfs() - API to init power stats debugfs
+ *
+ * Return: VOS_STATUS
+ */
+static VOS_STATUS wlan_hdd_init_power_stats_debugfs(hdd_adapter_t *adapter,
+						    hdd_context_t *hdd_ctx)
+{
+	if (NULL == debugfs_create_file("power_stats",
+				S_IRUSR | S_IRGRP | S_IROTH,
+				hdd_ctx->debugfs_phy, adapter,
+				&fops_powerdebugs))
+		return VOS_STATUS_E_FAILURE;
+
+	mutex_init(&hdd_ctx->power_stats_lock);
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * wlan_hdd_deinit_power_stats_debugfs() - API to deinit power stats debugfs
+ *
+ * Return: None
+ */
+static void wlan_hdd_deinit_power_stats_debugfs(hdd_context_t *hdd_ctx)
+{
+	mutex_destroy(&hdd_ctx->power_stats_lock);
+}
+#else
+static VOS_STATUS wlan_hdd_init_power_stats_debugfs(hdd_adapter_t *adapter,
+						    hdd_context_t *hdd_ctx)
+{
+	return VOS_STATUS_SUCCESS;
+}
+
+static void wlan_hdd_deinit_power_stats_debugfs(hdd_context_t *hdd_ctx)
+{
+	return;
+}
+#endif
+
 VOS_STATUS hdd_debugfs_init(hdd_adapter_t *pAdapter)
 {
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-    pHddCtx->debugfs_phy = debugfs_create_dir("wlan_wcnss", 0);
+    pHddCtx->debugfs_phy = debugfs_create_dir(HDD_DEBUGFS_DIRNAME, 0);
 
     if (NULL == pHddCtx->debugfs_phy)
         return VOS_STATUS_E_FAILURE;
@@ -628,11 +940,22 @@ VOS_STATUS hdd_debugfs_init(hdd_adapter_t *pAdapter)
         pHddCtx->debugfs_phy, pAdapter, &fops_patterngen))
         return VOS_STATUS_E_FAILURE;
 
+    if (VOS_STATUS_SUCCESS != wlan_hdd_init_power_stats_debugfs(pAdapter,
+                                                                pHddCtx))
+        return VOS_STATUS_E_FAILURE;
+
+    if (wlan_hdd_create_dsrc_tx_stats_file(pAdapter, pHddCtx))
+        return VOS_STATUS_E_FAILURE;
+
+    if (wlan_hdd_create_dsrc_chan_stats_file(pAdapter, pHddCtx))
+        return VOS_STATUS_E_FAILURE;
+
     return VOS_STATUS_SUCCESS;
 }
 
 void hdd_debugfs_exit(hdd_context_t *pHddCtx)
 {
+    wlan_hdd_deinit_power_stats_debugfs(pHddCtx);
     debugfs_remove_recursive(pHddCtx->debugfs_phy);
 }
 #endif /* #ifdef WLAN_OPEN_SOURCE */
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_debugfs_ocb.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_debugfs_ocb.c
new file mode 100644
index 00000000000..9ea98101e1a
--- /dev/null
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_debugfs_ocb.c
@@ -0,0 +1,536 @@
+/*
+ * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifdef WLAN_OPEN_SOURCE
+#include <wlan_hdd_includes.h>
+#include <vos_sched.h>
+#include "wlan_hdd_debugfs.h"
+#include "wlan_hdd_debugfs_ocb.h"
+#include "ol_tx.h"
+#include "wma_api.h"
+#include "wlan_hdd_ocb.h"
+#include "adf_os_time.h"
+
+#define WLAN_DSRC_COMMAND_MAX_SIZE 8
+#define WLAN_DSRC_CHAN_STATS_ENABLE 1
+#define WLAN_DSRC_CHAN_STATS_REQUEST 2
+
+/**
+ * __wlan_hdd_write_dsrc_chan_stats_debugfs() - config DSRC channel stats by
+ * DSRC app
+ * @file: file pointer
+ * @buf: buffer
+ * @count: count
+ * @pos: position pointer
+ *
+ * Only after DSRC channel stats enabled, FW collects channel stats.
+ *
+ * <cmd_id> <cmd_param>
+ * cmd_id=1: config channel stats parameters
+ * cmd_param=0: disable DSRC channel stats
+ * cmd_param=1: enable DSRC channel stats
+ *
+ * Before reading the channel stats, MUST specify which channel to request.
+ *
+ * <cmd_id> <cmd_param> [chan_freq]. i.e.: "2 1 5860", "2 2".
+ * cmd_id=2 : request channel stats parameters
+ * cmd_param=1 : request one channel stats, need channel frequency provided.
+ * chan_freq=5860: channel frequency
+ * cmd_param=2 : request all configured channel stats.
+ *
+ * Return: @count on success, error number otherwise
+ */
+static int __wlan_hdd_write_dsrc_chan_stats_debugfs(struct file *file,
+						    const char __user *buf,
+						    size_t count, loff_t *pos)
+{
+	hdd_adapter_t *adapter;
+	hdd_context_t *hdd_ctx;
+	char cmd[WLAN_DSRC_COMMAND_MAX_SIZE + 1];
+	char *sptr, *token;
+	uint8_t cmd_idx = 0;
+	int ret;
+
+	ENTER();
+
+	adapter = (hdd_adapter_t *)file->private_data;
+	if ((NULL == adapter) || (WLAN_HDD_ADAPTER_MAGIC != adapter->magic)) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Invalid adapter or adapter has invalid magic.",
+			  __func__);
+		return -EINVAL;
+	}
+
+	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+	ret = wlan_hdd_validate_context(hdd_ctx);
+	if (ret)
+		return ret;
+
+	if (count > WLAN_DSRC_COMMAND_MAX_SIZE) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Command length is larger that %d bytes,",
+			  __func__, WLAN_DSRC_COMMAND_MAX_SIZE);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(cmd, buf, count))
+		return -EINVAL;
+	cmd[count] = '\0';
+	sptr = cmd;
+
+	token = strsep(&sptr, " ");
+	if (!token)
+		return -EINVAL;
+	if (kstrtou8(token, 0, &cmd_idx))
+		return -EINVAL;
+	switch (cmd_idx) {
+	case WLAN_DSRC_CHAN_STATS_ENABLE:
+	{
+		bool enable;
+		uint32_t value;
+
+		token = strsep(&sptr, " ");
+		if (!token)
+			return -EINVAL;
+		if (kstrtou32(token, 0, &value))
+			return -EINVAL;
+		enable = !!value;
+		if (wlan_hdd_dsrc_config_radio_chan_stats(adapter, enable)) {
+			VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+				  "%s: Config DSRC channel stats %d failure.",
+				  __func__, enable);
+			return -EINVAL;
+		}
+		break;
+	}
+	case WLAN_DSRC_CHAN_STATS_REQUEST:
+	{
+		uint32_t i, req_type = 0, chan_freq = 0;
+		struct dsrc_radio_chan_stats_ctxt *ctx;
+		struct radio_chan_stats_req *req = NULL;
+
+		ctx = &adapter->dsrc_chan_stats;
+		if (!ctx->enable_chan_stats) {
+			VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+				"DSRC radio channel stats not enabled.");
+			return -EINVAL;
+		}
+
+		token = strsep(&sptr, " ");
+		if (!token)
+			return -EINVAL;
+		if (kstrtou32(token, 0, &req_type))
+			return -EINVAL;
+		if (req_type == WLAN_DSRC_REQUEST_ONE_RADIO_CHAN_STATS) {
+			token = strsep(&sptr, " ");
+			if (!token)
+				return -EINVAL;
+			if (kstrtou32(token, 0, &chan_freq))
+				return -EINVAL;
+			for (i = 0; i < ctx->config_chans_num; i++) {
+				if (chan_freq == ctx->config_chans_freq[i])
+					break;
+			}
+			if (i == ctx->config_chans_num) {
+				VOS_TRACE(VOS_MODULE_ID_HDD,
+					VOS_TRACE_LEVEL_ERROR,
+					"%s: No channel freq %d found.",
+					__func__, chan_freq);
+				return -EINVAL;
+			}
+		} else if (req_type != WLAN_DSRC_REQUEST_ALL_RADIO_CHAN_STATS) {
+			VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+				  "%s: Invalid dsrc chan stats req type %d.",
+				  __func__, req_type);
+			return -EINVAL;
+		}
+		req = vos_mem_malloc(sizeof(*req));
+		if (!req) {
+			VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+				"No memory for dsrc chan stats request.");
+			return -ENOMEM;
+		}
+		vos_mem_zero(req, sizeof(*req));
+		req->req_type = req_type;
+		req->reset_after_req = true;
+		if (req_type == WLAN_DSRC_REQUEST_ONE_RADIO_CHAN_STATS)
+			req->chan_freq = chan_freq;
+		if (ctx->cur_req)
+			vos_mem_free(ctx->cur_req);
+		ctx->cur_req = req;
+		break;
+	}
+	default:
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Invalid dsrc chan stats cmd %d\n",
+			  __func__, cmd_idx);
+		return -EINVAL;
+	}
+
+	EXIT();
+	return count;
+}
+
+/**
+ * __wlan_hdd_read_dsrc_chan_stats_debugfs() - read DSRC channel stats by
+ * DSRC app
+ * @file: file pointer
+ * @buf: buffer
+ * @count: count
+ * @pos: position pointer
+ *
+ * Return: bytes read on success, error number otherwise
+ */
+static int __wlan_hdd_read_dsrc_chan_stats_debugfs(struct file *file,
+						   char __user *buf,
+						   size_t count, loff_t *pos)
+{
+	int i, len;
+	ssize_t ret_cnt = 0;
+	uint32_t chan_cnt = 0;
+	hdd_adapter_t *adapter;
+	hdd_context_t *hdd_ctx;
+	char *chan_stats_buf, *ptr;
+	struct radio_chan_stats_req *req;
+	struct dsrc_radio_chan_stats_ctxt *ctx;
+	struct radio_chan_stats_info *chan_stats;
+
+	ENTER();
+
+	adapter = (hdd_adapter_t *)file->private_data;
+	if ((NULL == adapter) || (WLAN_HDD_ADAPTER_MAGIC != adapter->magic)) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Invalid adapter or adapter has invalid magic.",
+			  __func__);
+		return -EINVAL;
+	}
+
+	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+	if (wlan_hdd_validate_context(hdd_ctx)) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Invalid hdd context.", __func__);
+		return -EINVAL;
+	}
+
+	ctx = &adapter->dsrc_chan_stats;
+	req = ctx->cur_req;
+	if (!req) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Request DSRC radio chan stats is null.",
+			  __func__);
+		return -EINVAL;
+	}
+
+	if (wlan_hdd_dsrc_request_radio_chan_stats(adapter, req)) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Request DSRC Radio chan stats failed.",
+			  __func__);
+		return -EINVAL;
+	}
+
+	len = sizeof(uint32_t) + DSRC_MAX_CHAN_STATS_CNT * sizeof(*chan_stats);
+	chan_stats_buf = vos_mem_malloc(len);
+	if (!chan_stats_buf) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "dsrc radio chan stats buffer alloc fail.");
+		return -EINVAL;
+	}
+	ptr = chan_stats_buf + sizeof(uint32_t);
+
+	chan_stats = ctx->chan_stats;
+	spin_lock(&ctx->chan_stats_lock);
+	/* Now only two channel stats supported */
+	for (i = 0; i < DSRC_MAX_CHAN_STATS_CNT; i++, chan_stats++) {
+		if (chan_stats->chan_freq == 0)
+			continue;
+		if ((req->req_type == WLAN_DSRC_REQUEST_ONE_RADIO_CHAN_STATS)
+		    && (chan_stats->chan_freq != req->chan_freq))
+			continue;
+
+		vos_mem_copy(ptr, chan_stats, sizeof(*chan_stats));
+		ptr += sizeof(*chan_stats);
+		chan_cnt++;
+	}
+	spin_unlock(&ctx->chan_stats_lock);
+	vos_mem_copy(chan_stats_buf, &chan_cnt, sizeof(uint32_t));
+
+	ret_cnt = sizeof(uint32_t) + chan_cnt * sizeof(*chan_stats);
+	ret_cnt = simple_read_from_buffer(buf, count, pos,
+				chan_stats_buf, ret_cnt);
+	vos_mem_free(chan_stats_buf);
+	vos_mem_free(ctx->cur_req);
+	ctx->cur_req = NULL;
+
+	return ret_cnt;
+}
+
+static ssize_t wlan_hdd_write_dsrc_chan_stats_debugfs(struct file *file,
+						      const char __user *buf,
+						      size_t count,
+						      loff_t *ppos)
+{
+	ssize_t ret;
+
+	vos_ssr_protect(__func__);
+	ret = __wlan_hdd_write_dsrc_chan_stats_debugfs(file, buf, count, ppos);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+static ssize_t wlan_hdd_read_dsrc_chan_stats_debugfs(struct file *file,
+						     char __user *buf,
+						     size_t count, loff_t *pos)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __wlan_hdd_read_dsrc_chan_stats_debugfs(file, buf, count, pos);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+static const struct file_operations fops_dsrc_chan_stats = {
+	.write = wlan_hdd_write_dsrc_chan_stats_debugfs,
+	.read = wlan_hdd_read_dsrc_chan_stats_debugfs,
+	.open = wlan_hdd_debugfs_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * wlan_hdd_create_dsrc_chan_stats_file() - API to create dsrc radio channel
+ * statistics file
+ * @adapter: HDD adapter
+ * @hdd_ctx: HDD context
+ *
+ * Return: 0 on success, -%ENODEV otherwise.
+ */
+int wlan_hdd_create_dsrc_chan_stats_file(hdd_adapter_t *adapter,
+					 hdd_context_t *hdd_ctx)
+{
+	if (NULL == debugfs_create_file("dsrc_chan_stats",
+					S_IRUSR | S_IWUSR | S_IROTH,
+					hdd_ctx->debugfs_phy, adapter,
+					&fops_dsrc_chan_stats))
+		return -ENODEV;
+
+	return 0;
+}
+
+static inline bool __tx_stats_enabled(void)
+{
+	return ol_per_pkt_tx_stats_enabled();
+}
+
+static inline void __enable_tx_stats(bool enable)
+{
+	ol_per_pkt_tx_stats_enable(enable);
+}
+
+/**
+ * __per_pkt_tx_stats_read() - read DSRC per-packet tx stats by DSRC app
+ * @file: file pointer
+ * @buf: buffer
+ * @count: count
+ * @pos: position pointer
+ *
+ * Return: bytes read on success, error number otherwise
+ */
+static ssize_t __per_pkt_tx_stats_read(struct file *file,
+				       char __user *buf,
+				       size_t count, loff_t *pos)
+{
+	hdd_adapter_t *adapter;
+	ssize_t ret = 0;
+	struct ol_tx_per_pkt_stats tx_stats;
+	long rc;
+
+	ENTER();
+	adapter = (hdd_adapter_t *)file->private_data;
+	if ((NULL == adapter) || (WLAN_HDD_ADAPTER_MAGIC != adapter->magic)) {
+		hddLog(LOGE,FL("Invalid adapter or adapter has invalid magic"));
+		return -EINVAL;
+	}
+
+	ret = wlan_hdd_validate_context(WLAN_HDD_GET_CTX(adapter));
+	if (ret)
+		return ret;
+
+	if (!__tx_stats_enabled())
+		return ret;
+
+	ret = ol_tx_stats_ring_deque(&tx_stats);
+	if (ret) {
+		ret = sizeof(tx_stats);
+		rc = copy_to_user(buf, &tx_stats, sizeof(tx_stats));
+		if (rc)
+			ret = -EFAULT;
+	}
+
+	EXIT();
+	return ret;
+}
+
+static ssize_t per_pkt_tx_stats_read(struct file *file,
+				     char __user *buf,
+				     size_t count, loff_t *pos)
+{
+	int ret;
+
+	vos_ssr_protect(__func__);
+	ret = __per_pkt_tx_stats_read(file, buf, count, pos);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+/**
+ * __enable_per_pkt_tx_stats() - en/disable DSRC tx stats
+ * @enable: 1 for enable, 0 for disable
+ *
+ * Return: 0 on success, error number otherwise
+ */
+static int __enable_per_pkt_tx_stats(bool enable)
+{
+	int ret = 0;
+
+	if (enable == __tx_stats_enabled())
+		return ret;
+
+	ret = process_wma_set_command(0, WMI_PDEV_PARAM_RADIO_DIAGNOSIS_ENABLE,
+				      enable ? 1 : 0, PDEV_CMD);
+	if (!ret) {
+		adf_os_msleep(100);
+		__enable_tx_stats(enable);
+	} else {
+		hddLog(LOGE,FL("WMI_PDEV_PARAM_RADIO_DIAGNOSIS_ENABLE failed"));
+	}
+
+	return ret;
+}
+
+/**
+ * __per_pkt_tx_stats_write() - en/disable DSRC tx stats by DSRC app
+ * @file: file pointer
+ * @buf: buffer
+ * @count: count
+ * @ppos: position pointer
+ *
+ * Return: @count on success, error number otherwise
+ */
+static ssize_t __per_pkt_tx_stats_write(struct file *file,
+					const char __user *buf,
+					size_t count, loff_t *pos)
+{
+	hdd_adapter_t *pAdapter;
+	int ret = -EINVAL;
+	char *cmd = 0;
+	v_U8_t enable = 0;
+
+	ENTER();
+
+	pAdapter = (hdd_adapter_t *)file->private_data;
+	if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic)) {
+		hddLog(LOGE,FL("Invalid adapter or adapter has invalid magic"));
+		return -EINVAL;
+	}
+
+	ret = wlan_hdd_validate_context(WLAN_HDD_GET_CTX(pAdapter));
+	if (ret)
+		return ret;
+
+	/* Get command from user */
+	if (count <= MAX_USER_COMMAND_SIZE_FRAME) {
+		cmd = vos_mem_malloc(count + 1);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Command length is larger than %d bytes.",
+			  __func__, MAX_USER_COMMAND_SIZE_FRAME);
+		return -EINVAL;
+	}
+
+	if (!cmd) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Memory allocation for cmd failed!", __func__);
+		return -EFAULT;
+	}
+
+	if (copy_from_user(cmd, buf, count)) {
+		ret = -EFAULT;
+		goto failure;
+	}
+	cmd[count] = '\0';
+
+	if (kstrtou8(cmd, 0, &enable)) {
+		ret = -EINVAL;
+		goto failure;
+	}
+
+	__enable_per_pkt_tx_stats(!!enable);
+
+	vos_mem_free(cmd);
+	EXIT();
+	return count;
+
+failure:
+	vos_mem_free(cmd);
+	return ret;
+}
+
+static ssize_t per_pkt_tx_stats_write(struct file *file,
+				      const char __user *buf,
+				      size_t count, loff_t *pos)
+{
+	ssize_t ret;
+
+	vos_ssr_protect(__func__);
+	ret = __per_pkt_tx_stats_write(file, buf, count, pos);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+static const struct file_operations fops_dsrc_tx_stats = {
+	.read = per_pkt_tx_stats_read,
+	.write = per_pkt_tx_stats_write,
+	.open = wlan_hdd_debugfs_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+/**
+ * wlan_hdd_create_dsrc_tx_stats_file() - API to create dsrc tx stats file
+ * @adapter: HDD adapter
+ * @hdd_ctx: HDD context
+ *
+ * Return: 0 on success, -%ENODEV otherwise.
+ */
+int wlan_hdd_create_dsrc_tx_stats_file(hdd_adapter_t *adapter,
+				       hdd_context_t *hdd_ctx)
+{
+	if (NULL == debugfs_create_file("dsrc_tx_stats",
+					S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH,
+					hdd_ctx->debugfs_phy, adapter,
+					&fops_dsrc_tx_stats))
+		return -ENODEV;
+
+	return 0;
+}
+#endif /* WLAN_OPEN_SOURCE */
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_dev_pwr.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_dev_pwr.c
index f7cbbab1547..64be51893e3 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_dev_pwr.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_dev_pwr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -136,7 +136,7 @@ void hddDevTmTxBlockTimeoutHandler(void *usrData)
    if ((NULL == staAdapater) ||
        (WLAN_HDD_ADAPTER_MAGIC != staAdapater->magic)) {
       VOS_TRACE(VOS_MODULE_ID_HDD,VOS_TRACE_LEVEL_ERROR,
-                FL("invalid Adapter %p"), staAdapater);
+                FL("invalid Adapter %pK"), staAdapater);
       VOS_ASSERT(0);
       return;
    }
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_early_suspend.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_early_suspend.c
index 2d24bcf9bd3..62d842dcc65 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_early_suspend.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_early_suspend.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -115,7 +115,7 @@ static eHalStatus g_full_pwr_status;
 static eHalStatus g_standby_status;
 
 extern VOS_STATUS hdd_post_voss_start_config(hdd_context_t* pHddCtx);
-extern void hdd_wlan_initial_scan(hdd_context_t *pHddCtx);
+extern void hdd_wlan_initial_scan(hdd_adapter_t *pAdapter);
 
 extern struct notifier_block hdd_netdev_notifier;
 extern tVOS_CON_MODE hdd_get_conparam ( void );
@@ -485,7 +485,7 @@ VOS_STATUS hdd_exit_deep_sleep(hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter)
    pHddCtx->hdd_ps_state = eHDD_SUSPEND_NONE;
 
    //Trigger the initial scan
-   hdd_wlan_initial_scan(pHddCtx);
+   hdd_wlan_initial_scan(pAdapter);
 
    return VOS_STATUS_SUCCESS;
 
@@ -600,6 +600,13 @@ static int __wlan_hdd_ipv6_changed(struct notifier_block *nb,
 	if (adapter->device_mode == WLAN_HDD_INFRA_STATION ||
 	    adapter->device_mode == WLAN_HDD_P2P_CLIENT ||
 	    adapter->device_mode == WLAN_HDD_NDI) {
+
+		if (eConnectionState_Associated ==
+			WLAN_HDD_GET_STATION_CTX_PTR
+			(adapter)->conn_info.connState)
+				sme_dhcp_done_ind(hdd_ctx->hHal,
+				adapter->sessionId);
+
 		if (hdd_ctx->cfg_ini->nEnableSuspend ==
 			WLAN_MAP_SUSPEND_TO_MCAST_BCAST_FILTER &&
 			hdd_ctx->ns_offload_enable)
@@ -1019,7 +1026,7 @@ void hdd_conf_hostoffload(hdd_adapter_t *pAdapter, v_BOOL_t fenable)
                                 ~(HDD_MCASTBCASTFILTER_FILTER_ALL_BROADCAST);
 
                              if (!VOS_IS_STATUS_SUCCESS(vstatus)) {
-                                 hddLog(VOS_TRACE_LEVEL_ERROR,
+                                 hddLog(VOS_TRACE_LEVEL_INFO,
                                     "Failed to enable ARPOFfloadFeature %d",
                                     vstatus);
                              }
@@ -1182,6 +1189,12 @@ static int __wlan_hdd_ipv4_changed(struct notifier_block *nb,
 	      adapter->device_mode == WLAN_HDD_NDI))
 		return NOTIFY_DONE;
 
+	if (eConnectionState_Associated ==
+		WLAN_HDD_GET_STATION_CTX_PTR(
+		adapter)->conn_info.connState)
+			sme_dhcp_done_ind(hdd_ctx->hHal,
+			adapter->sessionId);
+
 	if ((hdd_ctx->cfg_ini->nEnableSuspend !=
 				WLAN_MAP_SUSPEND_TO_MCAST_BCAST_FILTER) ||
 			(!hdd_ctx->cfg_ini->fhostArpOffload)) {
@@ -1538,9 +1551,40 @@ static void hdd_conf_resume_ind(hdd_adapter_t *pAdapter)
                   pHddCtx->configuredMcastBcastFilter);
 }
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+static void hdd_thermal_off_carrier(hdd_adapter_t *pAdapter)
+{
+	if (netif_carrier_ok(pAdapter->dev)) {
+		pAdapter->netif_carrier_on = TRUE;
+		wlan_hdd_netif_queue_control(pAdapter,
+		  WLAN_NETIF_CARRIER_OFF, WLAN_CONTROL_PATH);
+	} else {
+		pAdapter->netif_carrier_on = FALSE;
+	}
+}
+
+static void hdd_thermal_on_carrier(hdd_adapter_t *pAdapter)
+{
+	if (pAdapter->netif_carrier_on) {
+	/* Thermal shutdown is an urgent accident visible to user space. */
+		wlan_hdd_netif_queue_control(pAdapter,
+			WLAN_NETIF_CARRIER_ON, WLAN_CONTROL_PATH);
+	}
+}
+#else
+static inline void hdd_thermal_off_carrier(hdd_adapter_t *pAdapter)
+{
+	return;
+}
+
+static inline void hdd_thermal_on_carrier(hdd_adapter_t *pAdapter)
+{
+	return;
+}
+#endif
 //Suspend routine registered with Android OS
 void hdd_suspend_wlan(void (*callback)(void *callbackContext, boolean suspended),
-                      void *callbackContext)
+                      void *callbackContext, bool thermal)
 {
    hdd_context_t *pHddCtx = NULL;
    v_CONTEXT_t pVosContext = NULL;
@@ -1621,8 +1665,16 @@ void hdd_suspend_wlan(void (*callback)(void *callbackContext, boolean suspended)
 send_suspend_ind:
        //stop all TX queues before suspend
        hddLog(LOG1, FL("Disabling queues"));
+
+      /* Thermal shutdown is an urgent accident visible to user space. */
+        if (thermal) {
+            hdd_thermal_off_carrier(pAdapter);
+        }
+
        wlan_hdd_netif_queue_control(pAdapter, WLAN_NETIF_TX_DISABLE,
-                  WLAN_CONTROL_PATH);
+                      WLAN_CONTROL_PATH);
+
+
        WLANTL_PauseUnPauseQs(pVosContext, true);
 
       /* Keep this suspend indication at the end (before processing next adaptor)
@@ -1775,7 +1827,7 @@ void hdd_unregister_mcast_bcast_filter(hdd_context_t *pHddCtx)
    }
 }
 
-void hdd_resume_wlan(void)
+void hdd_resume_wlan(bool thermal)
 {
    hdd_context_t *pHddCtx = NULL;
    hdd_adapter_t *pAdapter = NULL;
@@ -1869,11 +1921,16 @@ void hdd_resume_wlan(void)
 send_resume_ind:
       //wake the tx queues
       hddLog(LOG1, FL("Enabling queues"));
+
       WLANTL_PauseUnPauseQs(pVosContext, false);
 
       wlan_hdd_netif_queue_control(pAdapter,
-            WLAN_WAKE_ALL_NETIF_QUEUE,
-            WLAN_CONTROL_PATH);
+                WLAN_WAKE_ALL_NETIF_QUEUE,
+                WLAN_CONTROL_PATH);
+
+      if (thermal) {
+        hdd_thermal_on_carrier(pAdapter);
+      }
 
       hdd_conf_resume_ind(pAdapter);
 
@@ -1947,6 +2004,55 @@ static void hdd_ssr_timer_start(int msec)
     ssr_timer_started = true;
 }
 
+/**
+ * hdd_svc_fw_shutdown_ind() - API to send FW SHUTDOWN IND to Userspace
+ *
+ * @dev: Device Pointer
+ *
+ * Return: None
+ */
+void hdd_svc_fw_shutdown_ind(struct device *dev)
+{
+	v_CONTEXT_t g_context;
+	hdd_context_t *hdd_ctx;
+
+	g_context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+
+	if(!g_context)
+		return;
+
+	hdd_ctx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD,
+						   g_context);
+
+	hdd_ctx ? wlan_hdd_send_svc_nlink_msg(hdd_ctx->radio_index,
+					      WLAN_SVC_FW_SHUTDOWN_IND,
+					      NULL, 0) : 0;
+}
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/**
+* hdd_wlan_ssr_shutdown_event() - Send ssr shutdown status
+*
+* This function sends ssr shutdown status diag event
+*
+* Return: - Void.
+*/
+static void hdd_wlan_ssr_shutdown_event(void)
+{
+	WLAN_VOS_DIAG_EVENT_DEF(ssr_shutdown,
+					struct host_event_wlan_ssr_shutdown);
+	vos_mem_zero(&ssr_shutdown, sizeof(ssr_shutdown));
+	ssr_shutdown.status = SSR_SUB_SYSTEM_SHUTDOWN;
+	WLAN_VOS_DIAG_EVENT_REPORT(&ssr_shutdown,
+					EVENT_WLAN_SSR_SHUTDOWN_SUBSYSTEM);
+}
+#else
+static inline void hdd_wlan_ssr_shutdown_event(void)
+{
+
+};
+#endif
+
 /* the HDD interface to WLAN driver shutdown,
  * the primary shutdown function in SSR
  */
@@ -1987,21 +2093,30 @@ VOS_STATUS hdd_wlan_shutdown(void)
    hddLog(VOS_TRACE_LEVEL_INFO,
            FL("Invoking packetdump deregistration API"));
    wlan_deregister_txrx_packetdump();
+
+   if (VOS_TIMER_STATE_RUNNING ==
+            vos_timer_getCurrentState(&pHddCtx->tdls_source_timer))
+      vos_timer_stop(&pHddCtx->tdls_source_timer);
+
 #ifdef FEATURE_BUS_BANDWIDTH
    if (VOS_TIMER_STATE_RUNNING ==
            vos_timer_getCurrentState(&pHddCtx->bus_bw_timer))
    {
       vos_timer_stop(&pHddCtx->bus_bw_timer);
       hdd_rst_tcp_delack(pHddCtx);
+
+      if (pHddCtx->hbw_requested) {
+          vos_remove_pm_qos();
+          pHddCtx->hbw_requested = false;
+      }
    }
 #endif
 
-   hdd_reset_all_adapters(pHddCtx);
-
 #ifdef IPA_UC_OFFLOAD
    hdd_ipa_uc_ssr_deinit();
 #endif
 
+   hdd_reset_all_adapters(pHddCtx);
    vosStatus = hddDevTmUnregisterNotifyCallback(pHddCtx);
    if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
    {
@@ -2062,6 +2177,7 @@ VOS_STATUS hdd_wlan_shutdown(void)
    vos_free_tlshim_pkt_freeq(vosSchedContext);
 #endif
 
+   tl_shim_flush_cache_rx_queue();
 
    hddLog(VOS_TRACE_LEVEL_FATAL, "%s: Doing WDA STOP", __func__);
    vosStatus = WDA_stop(pVosContext, HAL_STOP_TYPE_RF_KILL);
@@ -2133,12 +2249,64 @@ VOS_STATUS hdd_wlan_shutdown(void)
    wlan_hdd_send_status_pkg(NULL, NULL, 0, 0);
 #endif
 
+   hdd_wlan_ssr_shutdown_event();
    hddLog(VOS_TRACE_LEVEL_FATAL, "%s: WLAN driver shutdown complete"
                                    ,__func__);
    return VOS_STATUS_SUCCESS;
 }
 
+/**
+ * hdd_ssr_restart_sap() - restart sap on SSR
+ * @hdd_ctx:   hdd context
+ *
+ * Return:     nothing
+ */
+static void hdd_ssr_restart_sap(hdd_context_t *hdd_ctx)
+{
+	VOS_STATUS       status;
+	hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
+	hdd_adapter_t *adapter;
 
+	ENTER();
+
+	status =  hdd_get_front_adapter (hdd_ctx, &adapter_node);
+	while (NULL != adapter_node && VOS_STATUS_SUCCESS == status) {
+		adapter = adapter_node->pAdapter;
+		if (adapter && adapter->device_mode == WLAN_HDD_SOFTAP) {
+			if (test_bit(SOFTAP_INIT_DONE, &adapter->event_flags)) {
+				hddLog(VOS_TRACE_LEVEL_INFO, FL("Restart prev SAP session"));
+				wlan_hdd_start_sap(adapter, true);
+			}
+		}
+		status = hdd_get_next_adapter ( hdd_ctx, adapter_node, &next );
+		adapter_node = next;
+	}
+
+	EXIT();
+}
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/**
+ * hdd_wlan_ssr_reinit_event - Send ssr reinit status
+ *
+ * This function sends ssr reinit status diag event
+ *
+ * Return: void.
+ */
+static void hdd_wlan_ssr_reinit_event(void)
+{
+	WLAN_VOS_DIAG_EVENT_DEF(ssr_reinit, struct host_event_wlan_ssr_reinit);
+	vos_mem_zero(&ssr_reinit, sizeof(ssr_reinit));
+	ssr_reinit.status = SSR_SUB_SYSTEM_REINIT;
+	WLAN_VOS_DIAG_EVENT_REPORT(&ssr_reinit,
+					EVENT_WLAN_SSR_REINIT_SUBSYSTEM);
+}
+#else
+static void hdd_wlan_ssr_reinit_event(void)
+{
+
+};
+#endif
 
 /* the HDD interface to WLAN driver re-init.
  * This is called to initialize/start WLAN driver after a shutdown.
@@ -2150,7 +2318,6 @@ VOS_STATUS hdd_wlan_re_init(void *hif_sc)
    hdd_context_t    *pHddCtx = NULL;
    eHalStatus       halStatus;
    bool             bug_on_reinit_failure = 0;
-
    hdd_adapter_t *pAdapter;
    int i;
    hdd_prevent_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_REINIT);
@@ -2183,7 +2350,8 @@ VOS_STATUS hdd_wlan_re_init(void *hif_sc)
    ((VosContextType*)pVosContext)->pHIFContext = hif_sc;
 
    /* The driver should always be initialized in STA mode after SSR */
-   hdd_set_conparam(0);
+   if (VOS_STA_SAP_MODE != hdd_get_conparam())
+       hdd_set_conparam(0);
 
    /* Re-open VOSS, it is a re-open b'se control transport was never closed. */
    vosStatus = vos_open(&pVosContext, 0);
@@ -2221,6 +2389,8 @@ VOS_STATUS hdd_wlan_re_init(void *hif_sc)
       goto err_vosclose;
    }
 
+   hdd_set_dfs_regdomain(pHddCtx,true);
+
    vosStatus = hdd_set_sme_chan_list(pHddCtx);
    if (!VOS_IS_STATUS_SUCCESS(vosStatus)) {
       hddLog(VOS_TRACE_LEVEL_FATAL,
@@ -2250,6 +2420,15 @@ VOS_STATUS hdd_wlan_re_init(void *hif_sc)
       goto err_vosclose;
    }
 
+   /*
+    * Invoke ipa reinit before vos_start so that doorbell registers are
+    * updated
+    */
+#ifdef IPA_UC_OFFLOAD
+   if (hdd_ipa_uc_ssr_reinit(pHddCtx))
+      hddLog(LOGE, "%s: HDD IPA UC reinit failed", __func__);
+#endif
+
    /* Start VOSS which starts up the SME/MAC/HAL modules and everything else
       Note: Firmware image will be read and downloaded inside vos_start API */
    vosStatus = vos_start( pVosContext );
@@ -2258,11 +2437,6 @@ VOS_STATUS hdd_wlan_re_init(void *hif_sc)
       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: vos_start failed",__func__);
       goto err_vosclose;
    }
-#ifdef IPA_UC_OFFLOAD
-   if (hdd_ipa_uc_ssr_reinit())
-      hddLog(LOGE, "%s: HDD IPA UC reinit failed", __func__);
-#endif
-
 
    vosStatus = hdd_post_voss_start_config( pHddCtx );
    if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
@@ -2292,6 +2466,9 @@ VOS_STATUS hdd_wlan_re_init(void *hif_sc)
    /* Pass FW version to HIF layer */
    hif_set_fw_info(hif_sc, pHddCtx->target_fw_version);
 
+   wlan_hdd_send_svc_nlink_msg(pHddCtx->radio_index,
+                               WLAN_SVC_FW_CRASHED_IND, NULL, 0);
+
    /* Restart all adapters */
    hdd_start_all_adapters(pHddCtx);
 
@@ -2334,13 +2511,15 @@ VOS_STATUS hdd_wlan_re_init(void *hif_sc)
    /* Register TM level change handler function to the platform */
    hddDevTmRegisterNotifyCallback(pHddCtx);
 
+   pHddCtx->last_scan_reject_session_id = 0xFF;
+   pHddCtx->last_scan_reject_reason = 0;
+   pHddCtx->last_scan_reject_timestamp = 0;
+   pHddCtx->scan_reject_cnt = 0;
+
    pHddCtx->hdd_mcastbcast_filter_set = FALSE;
    pHddCtx->btCoexModeSet = false;
    hdd_register_mcast_bcast_filter(pHddCtx);
 
-   wlan_hdd_send_svc_nlink_msg(pHddCtx->radio_index,
-                               WLAN_SVC_FW_CRASHED_IND, NULL, 0);
-
    /* Allow the phone to go to sleep */
    hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_REINIT);
    /* register for riva power on lock */
@@ -2362,6 +2541,8 @@ VOS_STATUS hdd_wlan_re_init(void *hif_sc)
                                wlan_hdd_cfg80211_extscan_callback);
 #endif /* FEATURE_WLAN_EXTSCAN */
    sme_set_rssi_threshold_breached_cb(pHddCtx->hHal, hdd_rssi_threshold_breached);
+   wlan_hdd_cfg80211_link_layer_stats_init(pHddCtx);
+   sme_bpf_offload_register_callback(pHddCtx->hHal, hdd_get_bpf_offload_cb);
 
 #ifdef WLAN_FEATURE_LPSS
    wlan_hdd_send_all_scan_intf_info(pHddCtx);
@@ -2369,6 +2550,10 @@ VOS_STATUS hdd_wlan_re_init(void *hif_sc)
                              pHddCtx->target_hw_version,
                              pHddCtx->target_hw_name);
 #endif
+   /* set chip power save failure detected callback */
+   sme_set_chip_pwr_save_fail_cb(pHddCtx->hHal,
+                                 hdd_chip_pwr_save_fail_detected_cb);
+
    ol_pktlog_init(hif_sc);
    goto success;
 
@@ -2385,6 +2570,7 @@ err_vosclose:
    vos_sched_close(pVosContext);
 
 #ifdef MEMORY_DEBUG
+   adf_net_buf_debug_exit();
    vos_mem_exit();
 #endif
 
@@ -2421,6 +2607,9 @@ err_re_init:
    hdd_wlan_wakelock_destroy();
    return -EPERM;
 success:
+   hdd_wlan_ssr_reinit_event();
+   if (pHddCtx->cfg_ini->sap_internal_restart)
+       hdd_ssr_restart_sap(pHddCtx);
    pHddCtx->isLogpInProgress = FALSE;
    hdd_ssr_timer_del();
    return VOS_STATUS_SUCCESS;
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ftm.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ftm.c
index 9e13072e727..acf8c77c0dd 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ftm.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ftm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -346,7 +346,7 @@ static VOS_STATUS wlan_ftm_vos_open( v_CONTEXT_t pVosContext, v_SIZE_t hddContex
    macOpenParms.powersaveOffloadEnabled =
       pHddCtx->cfg_ini->enablePowersaveOffload;
    vStatus = WDA_open(gpVosContext, gpVosContext->pHDDContext,
-                      wlan_hdd_ftm_update_tgt_cfg, NULL,
+                      wlan_hdd_ftm_update_tgt_cfg, NULL, NULL,
                       &macOpenParms);
    if (!VOS_IS_STATUS_SUCCESS(vStatus))
    {
@@ -932,7 +932,7 @@ err_status_failure:
 }
 
 #if  defined(QCA_WIFI_FTM)
-int hdd_ftm_start(hdd_context_t *pHddCtx)
+VOS_STATUS hdd_ftm_start(hdd_context_t *pHddCtx)
 {
     return wlan_hdd_ftm_start(pHddCtx);
 }
@@ -955,7 +955,8 @@ static int wlan_hdd_qcmbr_command(hdd_adapter_t *pAdapter, qcmbr_data_t *pqcmbr_
     switch (pqcmbr_data->cmd) {
         case ATH_XIOCTL_UNIFIED_UTF_CMD: {
             pqcmbr_data->copy_to_user = 0;
-            if (pqcmbr_data->length) {
+            if (pqcmbr_data->length &&
+                pqcmbr_data->length <= sizeof(pqcmbr_data->buf)) {
                 if (wlan_hdd_ftm_testmode_cmd(pqcmbr_data->buf,
                                               pqcmbr_data->length,
                                               TRUE)
@@ -1059,7 +1060,11 @@ int wlan_hdd_qcmbr_unified_ioctl(hdd_adapter_t *pAdapter, struct ifreq *ifr)
 {
     int ret = 0;
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,6,0)) && defined(CONFIG_X86_64)
+    if (in_compat_syscall()) {
+#else
     if (is_compat_task()) {
+#endif
         ret = wlan_hdd_qcmbr_compat_ioctl(pAdapter, ifr);
     } else {
         ret = wlan_hdd_qcmbr_ioctl(pAdapter, ifr);
@@ -1074,8 +1079,10 @@ static void WLANQCMBR_McProcessMsg(v_VOID_t *message)
     u_int32_t data_len;
 
     data_len = *((u_int32_t *)message) + sizeof(u_int32_t);
-    qcmbr_buf = kzalloc(sizeof(qcmbr_queue_t), GFP_KERNEL);
+    if (data_len > MAX_UTF_LENGTH + 4)
+        return;
 
+    qcmbr_buf = kzalloc(sizeof(qcmbr_queue_t), GFP_KERNEL);
     if (qcmbr_buf != NULL) {
         memcpy(qcmbr_buf->utf_buf, message, data_len);
         spin_lock_bh(&qcmbr_queue_lock);
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c
index f4533c22c0d..aa1b1c4dec0 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -76,7 +76,7 @@
 #include <wlan_hdd_ipa.h>
 #endif
 #include "cfgApi.h"
-#include "wniCfgAp.h"
+#include "wni_cfg.h"
 #include "wlan_hdd_misc.h"
 #include <vos_utils.h>
 #include "vos_cnss.h"
@@ -119,6 +119,115 @@ extern int process_wma_set_command(int sessid, int paramid,
 /* EID byte + length byte + four byte WiFi OUI */
 #define DOT11F_EID_HEADER_LEN (6)
 
+/* Data rate 100KBPS based on IE Index */
+struct index_data_rate_type {
+	uint8_t   beacon_rate_index;
+	uint16_t  supported_rate[4];
+};
+
+/*
+ * 11B, 11G Rate table include Basic rate and Extended rate
+ * The IDX field is the rate index
+ * The HI field is the rate when RSSI is strong or being ignored
+ * (in this case we report actual rate)
+ * The MID field is the rate when RSSI is moderate
+ * (in this case we cap 11b rates at 5.5 and 11g rates at 24)
+ * The LO field is the rate when RSSI is low
+ * (in this case we don't report rates, actual current rate used)
+ */
+static const struct index_data_rate_type supported_data_rate[] = {
+	/* IDX     HI  HM  LM LO (RSSI-based index */
+	{2,   { 10,  10, 10, 0} },
+	{4,   { 20,  20, 10, 0} },
+	{11,  { 55,  20, 10, 0} },
+	{12,  { 60,  55, 20, 0} },
+	{18,  { 90,  55, 20, 0} },
+	{22,  {110,  55, 20, 0} },
+	{24,  {120,  90, 60, 0} },
+	{36,  {180, 120, 60, 0} },
+	{44,  {220, 180, 60, 0} },
+	{48,  {240, 180, 90, 0} },
+	{66,  {330, 180, 90, 0} },
+	{72,  {360, 240, 90, 0} },
+	{96,  {480, 240, 120, 0} },
+	{108, {540, 240, 120, 0} }
+};
+
+/* MCS Based rate table */
+/* HT MCS parameters with Nss = 1 */
+static struct index_data_rate_type supported_mcs_rate_nss1[] = {
+	/* MCS  L20   L40   S20  S40 */
+	{0,  { 65,  135,  72,  150} },
+	{1,  { 130, 270,  144, 300} },
+	{2,  { 195, 405,  217, 450} },
+	{3,  { 260, 540,  289, 600} },
+	{4,  { 390, 810,  433, 900} },
+	{5,  { 520, 1080, 578, 1200} },
+	{6,  { 585, 1215, 650, 1350} },
+	{7,  { 650, 1350, 722, 1500} }
+};
+
+/* HT MCS parameters with Nss = 2 */
+static struct index_data_rate_type supported_mcs_rate_nss2[] = {
+	/* MCS  L20    L40   S20   S40 */
+	{0,  {130,  270,  144,  300} },
+	{1,  {260,  540,  289,  600} },
+	{2,  {390,  810,  433,  900} },
+	{3,  {520,  1080, 578,  1200} },
+	{4,  {780,  1620, 867,  1800} },
+	{5,  {1040, 2160, 1156, 2400} },
+	{6,  {1170, 2430, 1300, 2700} },
+	{7,  {1300, 2700, 1444, 3000} }
+};
+
+#ifdef WLAN_FEATURE_11AC
+#define DATA_RATE_11AC_MCS_MASK    0x03
+
+enum data_rate_11ac_max_mcs {
+	DATA_RATE_11AC_MAX_MCS_7,
+	DATA_RATE_11AC_MAX_MCS_8,
+	DATA_RATE_11AC_MAX_MCS_9,
+	DATA_RATE_11AC_MAX_MCS_NA
+};
+
+struct index_vht_data_rate_type {
+	uint8_t   beacon_rate_index;
+	uint16_t  supported_VHT80_rate[2];
+	uint16_t  supported_VHT40_rate[2];
+	uint16_t  supported_VHT20_rate[2];
+};
+
+/* MCS Based VHT rate table */
+/* MCS parameters with Nss = 1*/
+static struct index_vht_data_rate_type supported_vht_mcs_rate_nss1[] = {
+	/* MCS  L80    S80     L40   S40    L20   S40*/
+	{0,  {293,  325},  {135,  150},  {65,   72} },
+	{1,  {585,  650},  {270,  300},  {130,  144} },
+	{2,  {878,  975},  {405,  450},  {195,  217} },
+	{3,  {1170, 1300}, {540,  600},  {260,  289} },
+	{4,  {1755, 1950}, {810,  900},  {390,  433} },
+	{5,  {2340, 2600}, {1080, 1200}, {520,  578} },
+	{6,  {2633, 2925}, {1215, 1350}, {585,  650} },
+	{7,  {2925, 3250}, {1350, 1500}, {650,  722} },
+	{8,  {3510, 3900}, {1620, 1800}, {780,  867} },
+	{9,  {3900, 4333}, {1800, 2000}, {780,  867} }
+};
+
+/*MCS parameters with Nss = 2*/
+static struct index_vht_data_rate_type supported_vht_mcs_rate_nss2[] = {
+	/* MCS  L80    S80     L40   S40    L20   S40*/
+	{0,  {585,  650},  {270,  300},  {130,  144} },
+	{1,  {1170, 1300}, {540,  600},  {260,  289} },
+	{2,  {1755, 1950}, {810,  900},  {390,  433} },
+	{3,  {2340, 2600}, {1080, 1200}, {520,  578} },
+	{4,  {3510, 3900}, {1620, 1800}, {780,  867} },
+	{5,  {4680, 5200}, {2160, 2400}, {1040, 1156} },
+	{6,  {5265, 5850}, {2430, 2700}, {1170, 1300} },
+	{7,  {5850, 6500}, {2700, 3000}, {1300, 1444} },
+	{8,  {7020, 7800}, {3240, 3600}, {1560, 1733} },
+	{9,  {7800, 8667}, {3600, 4000}, {1560, 1733} }
+};
+#endif /* WLAN_FEATURE_11AC */
 
 /*---------------------------------------------------------------------------
  *   Function definitions
@@ -244,6 +353,236 @@ void hdd_hostapd_channel_wakelock_deinit(hdd_context_t *pHddCtx)
     vos_wake_lock_destroy(&pHddCtx->sap_dfs_wakelock);
 }
 
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+/**
+  * hdd_hostapd_sub20_channelwidth_can_switch() - check
+  *	 channel width switch to 5/10M condition
+  * @adapter: pointer to HDD context
+  * @sub20_channel_width: 5MHz/10MHz channel width
+  *
+  * Return:  true or false
+  */
+bool hdd_hostapd_sub20_channelwidth_can_switch(
+	hdd_adapter_t *adapter, uint32_t *sub20_channel_width)
+{
+	int i;
+	int sta_count = 0;
+	uint8_t sap_s20_caps;
+	uint8_t sap_s20_config;
+	uint8_t sta_s20_caps = SUB20_MODE_NONE;
+	tHalHandle hal_ptr = WLAN_HDD_GET_HAL_CTX(adapter);
+	tSmeConfigParams *sme_config;
+	hdd_station_info_t *sta;
+	hdd_ap_ctx_t *ap = WLAN_HDD_GET_AP_CTX_PTR(adapter);
+
+	sme_config = vos_mem_malloc(sizeof(*sme_config));
+	if (!sme_config) {
+		hddLog(LOGE, FL("mem alloc failed for sme_config"));
+		return false;
+	}
+	vos_mem_zero(sme_config, sizeof(*sme_config));
+
+	sme_GetConfigParam(hal_ptr, sme_config);
+	sap_s20_caps = sme_config->sub20_dynamic_channelwidth;
+	sap_s20_config = sme_config->sub20_config_info;
+	vos_mem_free(sme_config);
+	if (sap_s20_caps == SUB20_MODE_NONE ||
+	    sap_s20_config == CFG_SUB_20_CHANNEL_WIDTH_MANUAL) {
+		hddLog(LOGE, FL("sub20 not switch"));
+		return false;
+	}
+
+	spin_lock_bh(&adapter->staInfo_lock);
+	for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
+		sta = &adapter->aStaInfo[i];
+		if (sta->isUsed && (ap->uBCStaId != i)) {
+			sta_count++;
+			sta_s20_caps |=
+				sta->sub20_dynamic_channelwidth;
+		}
+	}
+	spin_unlock_bh(&adapter->staInfo_lock);
+
+	if (sta_count != 1) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       "%d STAs connected with sub20 Channelwidth %d",
+		       sta_count, sta_s20_caps);
+		return false;
+	}
+
+	*sub20_channel_width = sta_s20_caps & sap_s20_caps;
+
+	if (*sub20_channel_width == (SUB20_MODE_5MHZ | SUB20_MODE_10MHZ))
+		*sub20_channel_width = SUB20_MODE_10MHZ;
+
+	if (*sub20_channel_width != 0)
+		return true;
+	else
+		return false;
+}
+
+/**
+  * hdd_hostapd_sub20_channelwidth_can_restore() - check
+  *	 channel width switch to normal condition
+  * @adapter: pointer to HDD context
+  *
+  * Return:  true or false
+  */
+bool hdd_hostapd_sub20_channelwidth_can_restore(
+	hdd_adapter_t *adapter)
+{
+	int i;
+	int sta_count = 0;
+	uint8_t sap_s20_caps;
+	uint8_t sta_s20_caps = SUB20_MODE_NONE;
+	tHalHandle hal_ptr = WLAN_HDD_GET_HAL_CTX(adapter);
+	tSmeConfigParams *sme_config;
+	hdd_station_info_t *sta;
+	hdd_ap_ctx_t *ap = WLAN_HDD_GET_AP_CTX_PTR(adapter);
+
+	sme_config = vos_mem_malloc(sizeof(*sme_config));
+	if (!sme_config) {
+		hddLog(LOGE, FL("mem alloc failed for sme_config"));
+		return false;
+	}
+	vos_mem_zero(sme_config, sizeof(*sme_config));
+	sme_GetConfigParam(hal_ptr, sme_config);
+
+	sap_s20_caps = sme_config->sub20_dynamic_channelwidth;
+	vos_mem_free(sme_config);
+	if (sap_s20_caps == SUB20_MODE_NONE) {
+		hddLog(LOGE, FL("sub20 none"));
+		return false;
+	}
+	spin_lock_bh(&adapter->staInfo_lock);
+	for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
+		sta = &adapter->aStaInfo[i];
+		if (sta->isUsed && (ap->uBCStaId != i)) {
+			sta_count++;
+			sta_s20_caps |=
+				sta->sub20_dynamic_channelwidth;
+		}
+	}
+	spin_unlock_bh(&adapter->staInfo_lock);
+
+	if (sta_count != 0) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       "%d STAs connected with sub20 Channelwidth %d",
+		       sta_count, sta_s20_caps);
+		return false;
+	} else {
+		return true;
+	}
+}
+
+/**
+  * hdd_sub20_channelwidth_can_set() - check
+  * channel width manual switch to 5/10M condition
+  * @adapter: pointer to HDD context
+  * @sub20_channel_width: new channel width
+  *
+  * Return:  true or false
+  */
+bool hdd_sub20_channelwidth_can_set(
+	hdd_adapter_t *adapter, uint32_t sub20_channel_width)
+{
+	int i;
+	uint32_t sta_count = 0;
+	uint8_t sap_s20_config;
+	uint8_t sta_s20_caps = SUB20_MODE_10MHZ|SUB20_MODE_5MHZ;
+	tHalHandle hal_ptr;
+	tSmeConfigParams *sme_config;
+	hdd_station_info_t *sta;
+	hdd_ap_ctx_t *ap;
+	bool channel_support_sub20 = true;
+	enum phy_ch_width phy_sub20_channel_width = CH_WIDTH_INVALID;
+	hdd_station_ctx_t *hddstactx;
+
+	if (adapter == NULL) {
+		hddLog(LOGE, FL("adapter NULL"));
+		return false;
+	}
+	hal_ptr = WLAN_HDD_GET_HAL_CTX(adapter);
+	ap = WLAN_HDD_GET_AP_CTX_PTR(adapter);
+
+	sme_config = vos_mem_malloc(sizeof(*sme_config));
+	if (!sme_config) {
+		hddLog(LOGE, FL("mem alloc failed for sme_config"));
+		return false;
+	}
+	vos_mem_zero(sme_config, sizeof(*sme_config));
+
+	sme_GetConfigParam(hal_ptr, sme_config);
+	sap_s20_config = sme_config->sub20_config_info;
+	vos_mem_free(sme_config);
+	sme_config = NULL;
+	if (sap_s20_config != CFG_SUB_20_CHANNEL_WIDTH_MANUAL) {
+		hddLog(LOGE, FL("ini unsupport manual set sub20"));
+		return false;
+	}
+
+	switch (sub20_channel_width) {
+	case SUB20_MODE_5MHZ:
+		phy_sub20_channel_width = CH_WIDTH_5MHZ;
+		break;
+	case SUB20_MODE_10MHZ:
+		phy_sub20_channel_width = CH_WIDTH_10MHZ;
+		break;
+	case SUB20_MODE_NONE:
+		if (WLAN_HDD_SOFTAP == adapter->device_mode)
+			return true;
+		break;
+	default:
+		return false;
+	}
+
+	if (WLAN_HDD_INFRA_STATION == adapter->device_mode) {
+		hddstactx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+		if (hddstactx == NULL) {
+			hddLog(LOGE, FL("hdd hddstactx is null"));
+			return false;
+		}
+		if (hdd_connIsConnected(hddstactx)) {
+			hddLog(LOGE, FL("sta in Connected state!"));
+			return false;
+		}
+		hddLog(LOGE, FL("sta can set sub20"));
+		return true;
+	}
+
+	channel_support_sub20 =
+	      vos_is_channel_support_sub20(ap->operatingChannel,
+					   phy_sub20_channel_width,
+					   0);
+	if (!channel_support_sub20) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("ch%d width%d unsupport by reg domain"),
+		       ap->operatingChannel, phy_sub20_channel_width);
+		return false;
+	}
+
+	spin_lock_bh(&adapter->staInfo_lock);
+	for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
+		sta = &adapter->aStaInfo[i];
+		if (sta->isUsed && (ap->uBCStaId != i)) {
+			sta_count++;
+			sta_s20_caps &=
+				sta->sub20_dynamic_channelwidth;
+		}
+	}
+	spin_unlock_bh(&adapter->staInfo_lock);
+	if (sta_count >= 1 && !(sta_s20_caps & sub20_channel_width)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       "%d STAs connected with sub20 Channelwidth %d",
+		       sta_count, sta_s20_caps);
+		return false;
+	}
+
+	return true;
+}
+
+#endif
+
 /**
  * __hdd_hostapd_open() - HDD Open function for hostapd interface
  * @dev: pointer to net device
@@ -478,6 +817,10 @@ static int hdd_hostapd_driver_command(hdd_adapter_t *pAdapter,
    else if (strncmp(command, "MIRACAST", 8) == 0)
    {
        hddLog(VOS_TRACE_LEVEL_INFO, "%s: Received MIRACAST command", __func__);
+       ret = hdd_drv_cmd_validate(command, 8);
+       if (ret)
+           goto exit;
+
        ret = hdd_set_miracast_mode(pAdapter, command);
    }
 exit:
@@ -584,7 +927,11 @@ static int __hdd_hostapd_ioctl(struct net_device *dev,
 
    switch (cmd) {
    case (SIOCDEVPRIVATE + 1):
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,6,0)) && defined(CONFIG_X86_64)
+      if (in_compat_syscall())
+#else
       if (is_compat_task())
+#endif
          ret = hdd_hostapd_driver_compat_ioctl(pAdapter, ifr);
       else
          ret = hdd_hostapd_driver_ioctl(pAdapter, ifr);
@@ -754,7 +1101,7 @@ void hdd_hostapd_inactivity_timer_cb(v_PVOID_t usrDataForCallback)
         if ((NULL == pHostapdAdapter) ||
             (WLAN_HDD_ADAPTER_MAGIC != pHostapdAdapter->magic))
         {
-            hddLog(LOGE, FL("invalid adapter: %p"), pHostapdAdapter);
+            hddLog(LOGE, FL("invalid adapter: %pK"), pHostapdAdapter);
             return;
         }
         pHddApCtx = WLAN_HDD_GET_AP_CTX_PTR(pHostapdAdapter);
@@ -1358,6 +1705,221 @@ static VOS_STATUS hdd_handle_acs_scan_event(tpSap_Event sap_event,
 }
 #endif
 
+/**
+ * get_max_rate_vht() - calculate max rate for VHT mode
+ * @nss: num of streams
+ * @ch_width: channel width
+ * @sgi: short gi
+ * @vht_mcs_map: vht mcs map
+ *
+ * This function calculate max rate for VHT mode
+ *
+ * Return: max rate
+ */
+#ifdef WLAN_FEATURE_11AC
+static int get_max_rate_vht(int nss, int ch_width, int sgi, int vht_mcs_map)
+{
+	struct index_vht_data_rate_type *supported_vht_mcs_rate;
+	enum data_rate_11ac_max_mcs vht_max_mcs;
+	int maxrate = 0;
+	int maxidx = 0;
+
+	if (nss == 1) {
+		supported_vht_mcs_rate = supported_vht_mcs_rate_nss1;
+	} else if (nss == 2) {
+		supported_vht_mcs_rate = supported_vht_mcs_rate_nss2;
+	} else {
+		/* Not Supported */
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				"%s: nss %d not supported\n",
+				__func__, nss);
+		return maxrate;
+	}
+
+	vht_max_mcs =
+		(enum data_rate_11ac_max_mcs)
+		vht_mcs_map & DATA_RATE_11AC_MCS_MASK;
+
+	if (vht_max_mcs == DATA_RATE_11AC_MAX_MCS_7) {
+		maxidx = 7;
+	} else if (vht_max_mcs == DATA_RATE_11AC_MAX_MCS_8) {
+		maxidx = 8;
+	} else if (vht_max_mcs == DATA_RATE_11AC_MAX_MCS_9) {
+		if (ch_width == eHT_CHANNEL_WIDTH_20MHZ)
+			/* MCS9 is not valid for VHT20 when nss=1,2 */
+			maxidx = 8;
+		else
+			maxidx = 9;
+	} else {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				"%s: vht mcs map %x not supported\n",
+				__func__,
+				vht_mcs_map & DATA_RATE_11AC_MCS_MASK);
+		return maxrate;
+	}
+
+	if (ch_width == eHT_CHANNEL_WIDTH_20MHZ) {
+		maxrate =
+		supported_vht_mcs_rate[maxidx].supported_VHT20_rate[sgi];
+	} else if (ch_width == eHT_CHANNEL_WIDTH_40MHZ) {
+		maxrate =
+		supported_vht_mcs_rate[maxidx].supported_VHT40_rate[sgi];
+	} else if (ch_width == eHT_CHANNEL_WIDTH_80MHZ) {
+		maxrate =
+		supported_vht_mcs_rate[maxidx].supported_VHT80_rate[sgi];
+	} else {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				"%s: ch_width %d not supported\n",
+				__func__, ch_width);
+		return maxrate;
+	}
+
+	return maxrate;
+}
+#else
+static int get_max_rate_vht(int nss, int ch_width, int sgi, int vht_mcs_map)
+{
+	return 0;
+}
+#endif
+
+/**
+ * calculate_max_phy_rate() - calcuate maximum phy rate (kbps)
+ * @mode: phymode: Legacy, 11a/b/g, HT, VHT
+ * @nss: num of stream (maximum num is 2)
+ * @ch_width: channel width
+ * @sgi: short gi enabled or not
+ * @supp_idx: max supported idx
+ * @ext_idx: max extended idx
+ * @ht_mcs_idx: max mcs index for HT
+ * @vht_mcs_map: mcs map for VHT
+ *
+ * return: maximum phy rate in kbps
+ * */
+static int calcuate_max_phy_rate(int mode, int nss, int ch_width,
+		int sgi, int supp_idx, int ext_idx, int ht_mcs_idx,
+		int vht_mcs_map)
+{
+	struct index_data_rate_type *supported_mcs_rate;
+	int maxidx = 12; /*default 6M mode*/
+	int maxrate = 0, tmprate = 0;
+	int i;
+
+	/* check supported rates */
+	if (supp_idx != 0xff && maxidx < supp_idx)
+		maxidx = supp_idx;
+
+	/* check extended rates */
+	if (ext_idx != 0xff && maxidx < ext_idx)
+		maxidx = ext_idx;
+
+	for (i = 0;
+		i < sizeof(supported_data_rate)/sizeof(supported_data_rate[0]);
+		i++) {
+		if (supported_data_rate[i].beacon_rate_index == maxidx)
+			maxrate = supported_data_rate[i].supported_rate[0];
+	}
+
+	if (mode == SIR_SME_PHY_MODE_HT) {
+		/* check for HT Mode */
+		maxidx = ht_mcs_idx;
+		if (nss == 1) {
+			supported_mcs_rate = supported_mcs_rate_nss1;
+		} else if (nss == 2) {
+			supported_mcs_rate = supported_mcs_rate_nss2;
+		} else {
+			/* Not Supported */
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+					"%s: nss %d not supported\n",
+					__func__, nss);
+			return maxrate;
+		}
+
+		if (ch_width == eHT_CHANNEL_WIDTH_20MHZ) {
+			tmprate =
+				supported_mcs_rate[maxidx].supported_rate[0];
+			if (sgi)
+			    tmprate =
+				supported_mcs_rate[maxidx].supported_rate[2];
+		} else if (ch_width == eHT_CHANNEL_WIDTH_40MHZ) {
+			tmprate =
+				supported_mcs_rate[maxidx].supported_rate[1];
+			if (sgi)
+			    tmprate =
+				supported_mcs_rate[maxidx].supported_rate[3];
+		} else {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+					"%s: invalid mode %d ch_width %d\n",
+					__func__, mode, ch_width);
+			return maxrate;
+		}
+
+		if (maxrate < tmprate)
+			maxrate = tmprate;
+	}
+
+	if (mode == SIR_SME_PHY_MODE_VHT) {
+		/* check for VHT Mode */
+		tmprate = get_max_rate_vht(nss, ch_width, sgi, vht_mcs_map);
+		if (maxrate < tmprate)
+			maxrate = tmprate;
+	}
+
+	return maxrate;
+}
+
+static void hdd_fill_station_info(hdd_station_info_t *stainfo,
+		tSap_StationAssocReassocCompleteEvent *event)
+{
+	stainfo->nss = event->chan_info.nss;
+	stainfo->rate_flags = event->chan_info.rate_flags;
+	stainfo->sub20_dynamic_channelwidth =
+		event->chan_info.sub20_channelwidth;
+	stainfo->ampdu = event->ampdu;
+	stainfo->sgi_enable = event->sgi_enable;
+	stainfo->tx_stbc = event->tx_stbc;
+	stainfo->rx_stbc = event->rx_stbc;
+	stainfo->ch_width = event->ch_width;
+	stainfo->mode = event->mode;
+	stainfo->max_supp_idx = event->max_supp_idx;
+	stainfo->max_ext_idx = event->max_ext_idx;
+	stainfo->max_mcs_idx = event->max_mcs_idx;
+	stainfo->rx_mcs_map = event->rx_mcs_map;
+	stainfo->tx_mcs_map = event->tx_mcs_map;
+	stainfo->assoc_ts = vos_system_ticks();
+	stainfo->max_phy_rate =
+		calcuate_max_phy_rate(stainfo->mode,
+				stainfo->nss,
+				stainfo->ch_width,
+				stainfo->sgi_enable,
+				stainfo->max_supp_idx,
+				stainfo->max_ext_idx,
+				stainfo->max_mcs_idx,
+				stainfo->rx_mcs_map);
+	/* expect max_phy_rate report in kbps */
+	stainfo->max_phy_rate *= 100;
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("cap %d %d %d %d %d %d %d %d %d %x %d"),
+			stainfo->ampdu,
+			stainfo->sgi_enable,
+			stainfo->tx_stbc,
+			stainfo->rx_stbc,
+			stainfo->isQosEnabled,
+			stainfo->ch_width,
+			stainfo->mode,
+			event->wmmEnabled,
+			event->chan_info.nss,
+			event->chan_info.rate_flags,
+			stainfo->max_phy_rate);
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("rate info %d %d %d %d %d"),
+			stainfo->max_supp_idx,
+			stainfo->max_ext_idx,
+			stainfo->max_mcs_idx,
+			stainfo->rx_mcs_map,
+			stainfo->tx_mcs_map);
+}
+
 VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCallback)
 {
     hdd_adapter_t *pHostapdAdapter;
@@ -1386,6 +1948,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
     struct wlan_dfs_info dfs_info;
     v_U8_t cc_len = WLAN_SVC_COUNTRY_CODE_LEN;
     hdd_adapter_t *con_sap_adapter;
+    tSap_StationAssocReassocCompleteEvent *event;
     VOS_STATUS status = VOS_STATUS_SUCCESS;
 
     dev = (struct net_device *)usrDataForCallback;
@@ -1393,7 +1956,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                 "%s: usrDataForCallback is null", __func__);
-        return eHAL_STATUS_FAILURE;
+        return VOS_STATUS_E_FAILURE;
     }
 
     pHostapdAdapter = netdev_priv(dev);
@@ -1403,7 +1966,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
                 "invalid adapter or adapter has invalid magic");
-        return eHAL_STATUS_FAILURE;
+        return VOS_STATUS_E_FAILURE;
     }
 
     pHostapdState = WLAN_HDD_GET_HOSTAP_STATE_PTR(pHostapdAdapter);
@@ -1413,7 +1976,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                 "%s: pSapEvent is null", __func__);
-        return eHAL_STATUS_FAILURE;
+        return VOS_STATUS_E_FAILURE;
     }
 
     sapEvent = pSapEvent->sapHddEventCode;
@@ -1422,14 +1985,14 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
 
     if (!pHddCtx) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("HDD context is null"));
-        return eHAL_STATUS_FAILURE;
+        return VOS_STATUS_E_FAILURE;
     }
 
     cfg = pHddCtx->cfg_ini;
 
     if (!cfg) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("HDD config is null"));
-        return eHAL_STATUS_FAILURE;
+        return VOS_STATUS_E_FAILURE;
     }
 
     dfs_info.channel = pHddApCtx->operatingChannel;
@@ -1522,8 +2085,6 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
 
             pHostapdState->bssState = BSS_START;
 
-            hdd_wlan_green_ap_start_bss(pHddCtx);
-
             /* Set default key index */
             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                     "%s: default key index %hu", __func__,
@@ -1592,7 +2153,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
             }
 
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_MED,
-                      "The value of dfs_cac_block_tx[%d] for ApCtx[%p]",
+                      "The value of dfs_cac_block_tx[%d] for ApCtx[%pK]",
                       pHddApCtx->dfs_cac_block_tx, pHddApCtx);
 
             if ((NV_CHANNEL_DFS ==
@@ -1634,8 +2195,6 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
             hdd_hostapd_channel_allow_suspend(pHostapdAdapter,
                     pHddApCtx->operatingChannel);
 
-            hdd_wlan_green_ap_stop_bss(pHddCtx);
-
             //Free up Channel List incase if it is set
 
             sapCleanupChannelList(WLAN_HDD_GET_SAP_CTX_PTR(pHostapdAdapter));
@@ -1672,9 +2231,22 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                        FL("P2PGO is going down now"));
                 hdd_issue_stored_joinreq(sta_adapter, pHddCtx);
             }
-            pHddApCtx->groupKey.keyLength = 0;
-            for (i = 0; i < CSR_MAX_NUM_KEY; i++)
-                pHddApCtx->wepKey[i].keyLength = 0;
+
+            hddLog(VOS_TRACE_LEVEL_INFO,
+                FL("bss_stop_reason=%d"), pHddApCtx->bss_stop_reason);
+            if (pHddApCtx->bss_stop_reason != BSS_STOP_DUE_TO_MCC_SCC_SWITCH){
+                /* when MCC to SCC switching happens, key storage should not be
+                 * cleared due to hostapd will not repopulate the original keys
+                 */
+                pHddApCtx->groupKey.keyLength = 0;
+                for (i = 0; i < CSR_MAX_NUM_KEY; i++)
+                    pHddApCtx->wepKey[i].keyLength = 0;
+            }
+
+            /* clear the reason code in case BSS is stopped
+             * in another place
+             */
+            pHddApCtx->bss_stop_reason = BSS_STOP_REASON_INVALID;
             goto stopbss;
 
         case eSAP_DFS_CAC_START:
@@ -1794,8 +2366,9 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
 
         case eSAP_STA_ASSOC_EVENT:
         case eSAP_STA_REASSOC_EVENT:
+            event = &pSapEvent->sapevt.sapStationAssocReassocCompleteEvent;
             wrqu.addr.sa_family = ARPHRD_ETHER;
-            memcpy(wrqu.addr.sa_data, &pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staMac,
+            memcpy(wrqu.addr.sa_data, &event->staMac,
                 sizeof(v_MACADDR_t));
             hddLog(LOG1, " associated "MAC_ADDRESS_STR, MAC_ADDR_ARRAY(wrqu.addr.sa_data));
             we_event = IWEVREGISTERED;
@@ -1818,11 +2391,11 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                 vos_status = hdd_softap_RegisterSTA(pHostapdAdapter,
                                                     TRUE,
                                                     pHddApCtx->uPrivacy,
-                                                    pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staId,
+                                                    event->staId,
                                                     0,
                                                     0,
                                                     (v_MACADDR_t *)wrqu.addr.sa_data,
-                                                    pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.wmmEnabled);
+                                                    event->wmmEnabled);
                 if (!VOS_IS_STATUS_SUCCESS(vos_status))
                      hddLog(LOGW, FL("Failed to register STA %d "MAC_ADDRESS_STR""),
                                      vos_status, MAC_ADDR_ARRAY(wrqu.addr.sa_data));
@@ -1832,31 +2405,32 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                 vos_status = hdd_softap_RegisterSTA(pHostapdAdapter,
                                                     FALSE,
                                                     pHddApCtx->uPrivacy,
-                                                    pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staId,
+                                                    event->staId,
                                                     0,
                                                     0,
                                                     (v_MACADDR_t *)wrqu.addr.sa_data,
-                                                    pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.wmmEnabled);
+                                                    event->wmmEnabled);
                 if (!VOS_IS_STATUS_SUCCESS(vos_status))
                     hddLog(LOGW, FL("Failed to register STA %d "MAC_ADDRESS_STR""),
                            vos_status, MAC_ADDR_ARRAY(wrqu.addr.sa_data));
             }
 
-            staId = pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staId;
             if (VOS_IS_STATUS_SUCCESS(vos_status)) {
-                pHostapdAdapter->aStaInfo[staId].nss =
-                    pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.chan_info.nss;
-                pHostapdAdapter->aStaInfo[staId].rate_flags =
-                    pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.chan_info.rate_flags;
+                staId = event->staId;
+                hdd_fill_station_info(&pHostapdAdapter->aStaInfo[staId],
+                                      event);
+                pHostapdAdapter->aStaInfo[staId].ecsa_capable =
+                    pSapEvent->
+                    sapevt.sapStationAssocReassocCompleteEvent.ecsa_capable;
             }
 
 #ifdef IPA_OFFLOAD
             if (hdd_ipa_is_enabled(pHddCtx))
             {
                 status = hdd_ipa_wlan_evt(pHostapdAdapter,
-                   pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staId,
+                   event->staId,
                    WLAN_CLIENT_CONNECT_EX,
-                   pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staMac.bytes);
+                   event->staMac.bytes);
                 if (status)
                 {
                    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ("ERROR: WLAN_CLIENT_CONNECT_EX event failed!!"));
@@ -1872,6 +2446,10 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
             }
 #endif /* QCA_PKT_PROTO_TRACE */
 
+            DPTRACE(adf_dp_trace_mgmt_pkt(ADF_DP_TRACE_MGMT_PACKET_RECORD,
+                           pHostapdAdapter->sessionId,
+                           ADF_PROTO_TYPE_MGMT, ADF_PROTO_MGMT_ASSOC));
+
 #ifdef FEATURE_BUS_BANDWIDTH
             /* start timer in sap/p2p_go */
             if (pHddApCtx->bApActive == VOS_FALSE)
@@ -1904,7 +2482,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                                           HDD_SAP_WAKE_LOCK_DURATION,
                                           WIFI_POWER_EVENT_WAKELOCK_SAP);
             {
-               v_U16_t iesLen =  pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.iesLen;
+               v_U16_t iesLen =  event->iesLen;
 
                if (iesLen <= MAX_ASSOC_IND_IE_LEN )
                {
@@ -1916,7 +2494,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                   }
                   memset(stainfo, 0, sizeof(*stainfo));
                   stainfo->assoc_req_ies =
-                     (const u8 *)&pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.ies[0];
+                     (const u8 *)&event->ies[0];
                   stainfo->assoc_req_ies_len = iesLen;
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0))
                   /*
@@ -1930,7 +2508,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
 #endif
 #endif
                   cfg80211_new_sta(dev,
-                        (const u8 *)&pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staMac.bytes[0],
+                        (const u8 *)&event->staMac.bytes[0],
                         stainfo, GFP_KERNEL);
                   vos_mem_free(stainfo);
                }
@@ -1951,23 +2529,33 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
             {
                 /* send peer status indication to oem app */
                 hdd_SendPeerStatusIndToOemApp(
-                    &pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staMac,
+                    &event->staMac,
                     ePeerConnected,
-                    pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.timingMeasCap,
+                    event->timingMeasCap,
                     pHostapdAdapter->sessionId,
-                    &pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.chan_info,
+                    &event->chan_info,
                     pHostapdAdapter->device_mode);
             }
 
             hdd_wlan_green_ap_add_sta(pHddCtx);
 
+            if (pHostapdAdapter->device_mode == WLAN_HDD_SOFTAP &&
+                !bAuthRequired  && bWPSState == eANI_BOOLEAN_FALSE) {
+                    uint32_t sub20_channelwidth;
+
+                    if (hdd_hostapd_sub20_channelwidth_can_switch(
+                         pHostapdAdapter, &sub20_channelwidth))
+                            WLANSAP_set_sub20_channelwidth_with_csa(
+                                WLAN_HDD_GET_SAP_CTX_PTR(pHostapdAdapter),
+                                sub20_channelwidth);
+            }
             break;
         case eSAP_STA_DISASSOC_EVENT:
             memcpy(wrqu.addr.sa_data, &pSapEvent->sapevt.sapStationDisassocCompleteEvent.staMac,
                    sizeof(v_MACADDR_t));
             hddLog(LOG1, " disassociated "MAC_ADDRESS_STR, MAC_ADDR_ARRAY(wrqu.addr.sa_data));
 
-            vos_status = vos_event_set(&pHostapdState->vosEvent);
+            vos_status = vos_event_set(&pHostapdState->sta_disassoc_event);
             if (!VOS_IS_STATUS_SUCCESS(vos_status))
                 hddLog(VOS_TRACE_LEVEL_ERROR,
                         "ERROR: Station deauth event reporting failed!!");
@@ -1984,7 +2572,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                 return VOS_STATUS_E_FAILURE;
             }
 #ifdef IPA_OFFLOAD
-            if (hdd_ipa_is_enabled(pHddCtx))
+            if (!pHddCtx->isLogpInProgress && hdd_ipa_is_enabled(pHddCtx))
             {
                 status = hdd_ipa_wlan_evt(pHostapdAdapter, staId, WLAN_CLIENT_DISCONNECT,
                 pSapEvent->sapevt.sapStationDisassocCompleteEvent.staMac.bytes);
@@ -2004,6 +2592,11 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                vos_pkt_trace_buf_update("HA:DISASC");
             }
 #endif /* QCA_PKT_PROTO_TRACE */
+
+            DPTRACE(adf_dp_trace_mgmt_pkt(ADF_DP_TRACE_MGMT_PACKET_RECORD,
+                           pHostapdAdapter->sessionId,
+                           ADF_PROTO_TYPE_MGMT, ADF_PROTO_MGMT_DISASSOC));
+
             hdd_softap_DeregisterSTA(pHostapdAdapter, staId);
 
             pHddApCtx->bApActive = VOS_FALSE;
@@ -2250,8 +2843,13 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
             pHddApCtx->sapConfig.acs_cfg.ch_width =
                  pSapEvent->sapevt.sapChSelected.ch_width;
             /* send vendor event to hostapd only for hostapd based acs */
-            if (!pHddCtx->cfg_ini->force_sap_acs)
-                wlan_hdd_cfg80211_acs_ch_select_evt(pHostapdAdapter);
+            if (!test_bit(SOFTAP_BSS_STARTED, &pHostapdAdapter->event_flags)) {
+                if (!pHddCtx->cfg_ini->force_sap_acs)
+                    wlan_hdd_cfg80211_acs_ch_select_evt(pHostapdAdapter);
+            } else {
+                pHddApCtx->sapConfig.channel =
+                    pHddApCtx->sapConfig.backup_channel;
+            }
 
             return VOS_STATUS_SUCCESS;
         case eSAP_ECSA_CHANGE_CHAN_IND:
@@ -2304,7 +2902,19 @@ stopbss :
 
         /* Stop the pkts from n/w stack as we are going to free all of
          * the TX WMM queues for all STAID's */
-        hdd_hostapd_stop(dev);
+
+       /*
+        * If channel avoidance is in progress means driver is performing SAP
+        * restart. So don't do carrier off, which may lead framework to do
+        * driver reload.
+        */
+        hddLog(LOG1, FL("ch avoid in progress: %d"),
+                        pHddCtx->is_ch_avoid_in_progress);
+        if (pHddCtx->is_ch_avoid_in_progress)
+            wlan_hdd_netif_queue_control(pHostapdAdapter, WLAN_NETIF_TX_DISABLE,
+                                         WLAN_CONTROL_PATH);
+        else
+            hdd_hostapd_stop(dev);
 
         /* reclaim all resources allocated to the BSS */
         vos_status = hdd_softap_stop_bss(pHostapdAdapter);
@@ -2533,6 +3143,117 @@ int hdd_softap_set_channel_change(struct net_device *dev, int target_channel)
     return ret;
 }
 
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+/**
+ * hdd_softap_set_channel_sub20_chanwidth_change() -This
+ * function to support SAP channel change with CSA IE
+ * set in the beacons.
+ * @dev: Pointer to the net device
+ * @chan_width: new sub20 channel width
+ *
+ * Return:  true or false
+ */
+int hdd_softap_set_channel_sub20_chanwidth_change(struct net_device *dev,
+						  uint32_t chan_width)
+{
+	VOS_STATUS status;
+	int ret;
+	hdd_adapter_t *hostapd_adapter = (netdev_priv(dev));
+	hdd_context_t *hdd_ctx_ptr;
+	hdd_adapter_t *sta_adapter;
+	hdd_station_ctx_t *sta_ctx;
+	uint32_t sub20_chan_width;
+	bool sub20_operate_permission;
+	void *vos_ctx_ptr;
+
+	hdd_ctx_ptr = WLAN_HDD_GET_CTX(hostapd_adapter);
+	ret = wlan_hdd_validate_context(hdd_ctx_ptr);
+	if (ret)
+		return ret;
+
+	sta_adapter = hdd_get_adapter(hdd_ctx_ptr, WLAN_HDD_INFRA_STATION);
+	/*
+	 * conc_custom_rule1:
+	 * Force SCC for SAP + STA
+	 * if STA is already connected then we shouldn't allow
+	 * channel switch in SAP interface
+	 */
+	if (sta_adapter && hdd_ctx_ptr->cfg_ini->conc_custom_rule1) {
+		sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(sta_adapter);
+		if (hdd_connIsConnected(sta_ctx)) {
+			hddLog(LOGE,
+			       FL("sub20 chan switch not allowed"));
+			return -EBUSY;
+		}
+	}
+
+	switch (chan_width) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+	case NL80211_CHAN_WIDTH_5:
+		sub20_chan_width = SUB20_MODE_5MHZ;
+		break;
+	case NL80211_CHAN_WIDTH_10:
+		sub20_chan_width = SUB20_MODE_10MHZ;
+		break;
+#endif
+	case NL80211_CHAN_WIDTH_20_NOHT:
+		sub20_chan_width = SUB20_MODE_NONE;
+		break;
+	default:
+		hddLog(LOGE, FL("invalid param %d"), chan_width);
+		return -EINVAL;
+	}
+
+	sub20_operate_permission =
+		hdd_sub20_channelwidth_can_set(hostapd_adapter,
+					       sub20_chan_width);
+	if (!sub20_operate_permission) {
+		hddLog(LOGE, FL("can't set sub20_chan_width in curr chan"));
+		return -EINVAL;
+	}
+
+	spin_lock_bh(&hdd_ctx_ptr->dfs_lock);
+	if (hdd_ctx_ptr->dfs_radar_found == VOS_TRUE) {
+		spin_unlock_bh(&hdd_ctx_ptr->dfs_lock);
+		hddLog(LOGE,
+		       FL("sub20 chan width switch in progress!!"));
+		return -EBUSY;
+	}
+	/*
+	 * Set the dfs_radar_found flag to mimic channel change
+	 * when a radar is found. This will enable synchronizing
+	 * SAP and HDD states similar to that of radar indication.
+	 * Suspend the netif queues to stop queuing Tx frames
+	 * from upper layers.  netif queues will be resumed
+	 * once the channel change is completed and SAP will
+	 * post eSAP_START_BSS_EVENT success event to HDD.
+	 */
+	hdd_ctx_ptr->dfs_radar_found = VOS_TRUE;
+	spin_unlock_bh(&hdd_ctx_ptr->dfs_lock);
+
+	vos_ctx_ptr = WLAN_HDD_GET_SAP_CTX_PTR(hostapd_adapter);
+	status = WLANSAP_set_sub20_channelwidth_with_csa(vos_ctx_ptr,
+							 sub20_chan_width);
+	if (VOS_STATUS_SUCCESS != status) {
+		hddLog(LOGE,
+		       FL("sub20 chan width %d switch failed"),
+		       sub20_chan_width);
+		/*
+		 * If channel change command fails then clear the
+		 * radar found flag and also restart the netif
+		 * queues.
+		 */
+		spin_lock_bh(&hdd_ctx_ptr->dfs_lock);
+		hdd_ctx_ptr->dfs_radar_found = VOS_FALSE;
+		spin_unlock_bh(&hdd_ctx_ptr->dfs_lock);
+
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+#endif
+
 /**
  * hdd_sap_get_chan_width() - get channel width of sap
  * @adapter: adapter being queried
@@ -2575,40 +3296,52 @@ static __iw_softap_set_ini_cfg(struct net_device *dev,
                           union iwreq_data *wrqu, char *extra)
 {
     VOS_STATUS vstatus;
-    int ret = 0; /* success */
-    hdd_adapter_t *pAdapter = (netdev_priv(dev));
-    hdd_context_t *pHddCtx;
+    int errno;
+    hdd_adapter_t *adapter;
+    hdd_context_t *hdd_ctx;
+    char *value;
+    size_t len;
+
+    ENTER();
 
-    if (pAdapter == NULL)
+    adapter = netdev_priv(dev);
+    if (adapter == NULL)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                                        "%s: pAdapter is NULL!", __func__);
+                                        "%s: adapter is NULL!", __func__);
         return -EINVAL;
     }
 
-    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-    ret = wlan_hdd_validate_context(pHddCtx);
-    if (ret != 0)
-        return ret;
+    hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+    errno = wlan_hdd_validate_context(hdd_ctx);
+    if (errno != 0)
+        return errno;
+
+    /* ensure null termination */
+    len = min_t(size_t, wrqu->data.length, QCSAP_IOCTL_MAX_STR_LEN);
+    value = vos_mem_malloc(len + 1);
+    if (!value)
+        return -ENOMEM;
 
+    vos_mem_copy(value, extra, len);
+    value[len] = '\0';
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-              "%s: Received data %s", __func__, extra);
+              "%s: Received data %s", __func__, value);
 
-    vstatus = hdd_execute_global_config_command(pHddCtx, extra);
+    vstatus = hdd_execute_global_config_command(hdd_ctx, value);
 #ifdef WLAN_FEATURE_MBSSID
     if (vstatus == VOS_STATUS_E_PERM) {
-        vstatus = hdd_execute_sap_dyn_config_command(pAdapter, extra);
+        vstatus = hdd_execute_sap_dyn_config_command(adapter, value);
         if (vstatus == VOS_STATUS_SUCCESS)
             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                    "%s: Stored in Dynamic SAP ini config", __func__);
     }
 #endif
-    if (VOS_STATUS_SUCCESS != vstatus)
-    {
-        ret = -EINVAL;
-    }
+    vos_mem_free(value);
 
-    return ret;
+    EXIT();
+
+    return vos_status_to_os_return(vstatus);
 }
 
 int
@@ -3589,6 +4322,27 @@ static __iw_softap_setparam(struct net_device *dev,
             ret = hdd_set_rx_stbc(pHostapdAdapter, set_value);
             break;
 
+        case QCSAP_SET_DEFAULT_AMPDU:
+            hddLog(LOG1, "QCSAP_SET_DEFAULT_AMPDU val %d", set_value);
+            ret = process_wma_set_command((int)pHostapdAdapter->sessionId,
+                                         (int)WMI_PDEV_PARAM_MAX_MPDUS_IN_AMPDU,
+                                         set_value, PDEV_CMD);
+            break;
+
+        case QCSAP_ENABLE_RTS_BURSTING:
+            hddLog(LOG1, "QCSAP_ENABLE_RTS_BURSTING val %d", set_value);
+            ret = process_wma_set_command((int)pHostapdAdapter->sessionId,
+                                   (int)WMI_PDEV_PARAM_ENABLE_RTS_SIFS_BURSTING,
+                                   set_value, PDEV_CMD);
+            break;
+
+        case QCSAP_ENABLE_DYNAMIC_BW:
+           hddLog(LOG1, "QCSAP_ENABLE_DYNAMIC_BW val %d", set_value);
+           ret = process_wma_set_command((int)pHostapdAdapter->sessionId,
+                                         (int)WMI_PDEV_PARAM_DYNAMIC_BW,
+                                         set_value, PDEV_CMD);
+            break;
+
         default:
             hddLog(LOGE, FL("Invalid setparam command %d value %d"),
                     sub_cmd, set_value);
@@ -3869,6 +4623,14 @@ static __iw_softap_getparam(struct net_device *dev,
                         VDEV_CMD);
             break;
         }
+    case QCSAP_GET_DYNAMIC_BW:
+        {
+            *value = wma_cli_get_command(pHddCtx->pvosContext,
+                                        (int)pHostapdAdapter->sessionId,
+                                        (int)WMI_PDEV_PARAM_DYNAMIC_BW,
+                                        PDEV_CMD);
+            break;
+        }
     case QCASAP_GET_TEMP_CMD:
         {
             hddLog(VOS_TRACE_LEVEL_INFO, "QCASAP_GET_TEMP_CMD");
@@ -4868,7 +5630,7 @@ static int __iw_set_ap_encodeext(struct net_device *dev,
          /*Convert from 1-based to 0-based keying*/
         key_index--;
     }
-    if(!ext->key_len) {
+    if(!ext->key_len || ext->key_len > CSR_MAX_KEY_LEN) {
 #if 0
       /*Set the encryption type to NONE*/
 #if 0
@@ -4919,7 +5681,7 @@ static int __iw_set_ap_encodeext(struct net_device *dev,
              retval = -EINVAL;
          }
 #endif
-         return ret;
+         return -EINVAL;
 
     }
 
@@ -4928,9 +5690,7 @@ static int __iw_set_ap_encodeext(struct net_device *dev,
     setKey.keyId = key_index;
     setKey.keyLength = ext->key_len;
 
-    if(ext->key_len <= CSR_MAX_KEY_LEN) {
-       vos_mem_copy(&setKey.Key[0],ext->key,ext->key_len);
-    }
+    vos_mem_copy(&setKey.Key[0],ext->key,ext->key_len);
 
     if(ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
       /*Key direction for group is RX only*/
@@ -5476,27 +6236,33 @@ hdd_softap_get_sta_info(hdd_adapter_t *pAdapter, v_U8_t *pBuf, int buf_len)
 
     for (i = 0; i <= maxSta; i++)
     {
-        if(pAdapter->aStaInfo[i].isUsed)
-        {
-            len = scnprintf(pBuf, buf_len, "%5d .%02x:%02x:%02x:%02x:%02x:%02x",
-                                       pAdapter->aStaInfo[i].ucSTAId,
-                                       pAdapter->aStaInfo[i].macAddrSTA.bytes[0],
-                                       pAdapter->aStaInfo[i].macAddrSTA.bytes[1],
-                                       pAdapter->aStaInfo[i].macAddrSTA.bytes[2],
-                                       pAdapter->aStaInfo[i].macAddrSTA.bytes[3],
-                                       pAdapter->aStaInfo[i].macAddrSTA.bytes[4],
-                                       pAdapter->aStaInfo[i].macAddrSTA.bytes[5]);
-            if (len >= buf_len) {
+        if (!pAdapter->aStaInfo[i].isUsed)
+                continue;
+
+        if (CHAN_HOP_ALL_BANDS_ENABLE &&
+            (i == (WLAN_HDD_GET_AP_CTX_PTR(pAdapter))->uBCStaId))
+                continue;
+
+        if (WE_GET_STA_INFO_SIZE > buf_len)
+                break;
+
+        len = scnprintf(pBuf, buf_len,
+                        "%d: %02x:%02x:%02x:%02x:%02x:%02x \t ecsa=%d\n",
+                        pAdapter->aStaInfo[i].ucSTAId,
+                        pAdapter->aStaInfo[i].macAddrSTA.bytes[0],
+                        pAdapter->aStaInfo[i].macAddrSTA.bytes[1],
+                        pAdapter->aStaInfo[i].macAddrSTA.bytes[2],
+                        pAdapter->aStaInfo[i].macAddrSTA.bytes[3],
+                        pAdapter->aStaInfo[i].macAddrSTA.bytes[4],
+                        pAdapter->aStaInfo[i].macAddrSTA.bytes[5],
+                        pAdapter->aStaInfo[i].ecsa_capable);
+
+        if (len >= buf_len) {
                 hddLog(LOGE, FL("Insufficient buffer:%d, %d"), buf_len, len);
                 return -E2BIG;
-            }
-            pBuf += len;
-            buf_len -= len;
-        }
-        if(WE_GET_STA_INFO_SIZE > buf_len)
-        {
-            break;
         }
+        pBuf += len;
+        buf_len -= len;
     }
     EXIT();
     return 0;
@@ -5589,6 +6355,13 @@ static int __iw_set_ap_genie(struct net_device *dev,
         return 0;
     }
 
+    if (wrqu->data.length > DOT11F_IE_RSN_MAX_LEN) {
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+               "%s: WPARSN Ie input length is more than max[%d]", __func__,
+                wrqu->data.length);
+       return -EINVAL;
+    }
+
     switch (genie[0])
     {
         case DOT11F_EID_WPA:
@@ -5810,17 +6583,17 @@ iw_get_softap_linkspeed(struct net_device *dev, struct iw_request_info *info,
 
 /**
  * hdd_get_rssi_cb() - get station's rssi callback
- * @sta_rssi: pointer of rssi information
+ * @sta_rssi: pointer of peer information
  * @context: get rssi callback context
  *
  * This function will fill rssi information to hostapd
  * adapter
  *
  */
-void hdd_get_rssi_cb(struct sir_rssi_resp *sta_rssi, void *context)
+void hdd_get_rssi_cb(struct sir_peer_info_resp *sta_rssi, void *context)
 {
 	struct statsContext *get_rssi_context;
-	struct sir_rssi_info *rssi_info;
+	struct sir_peer_info *rssi_info;
 	uint8_t peer_num;
 	int i;
 	int buf = 0;
@@ -5831,7 +6604,7 @@ void hdd_get_rssi_cb(struct sir_rssi_resp *sta_rssi, void *context)
 	if ((NULL == sta_rssi) || (NULL == context)) {
 
 		hddLog(VOS_TRACE_LEVEL_ERROR,
-			"%s: Bad param, sta_rssi [%p] context [%p]",
+			"%s: Bad param, sta_rssi [%pK] context [%pK]",
 			__func__, sta_rssi, context);
 		return;
 	}
@@ -5844,7 +6617,7 @@ void hdd_get_rssi_cb(struct sir_rssi_resp *sta_rssi, void *context)
 	 * serialize these actions
 	 */
 	get_rssi_context = context;
-	if (RSSI_CONTEXT_MAGIC !=
+	if (PEER_INFO_CONTEXT_MAGIC !=
 			get_rssi_context->magic) {
 
 		/*
@@ -5905,7 +6678,7 @@ void hdd_get_rssi_cb(struct sir_rssi_resp *sta_rssi, void *context)
  * @wrqu: iwpriv command parameter
  * @extra
  *
- * This function will call sme_get_rssi to get rssi
+ * This function will call sme_get_peer_info to get rssi
  *
  * Return: 0 on success, otherwise error value
  */
@@ -5917,7 +6690,7 @@ static int  wlan_hdd_get_peer_rssi(hdd_adapter_t *adapter,
 	eHalStatus hstatus;
 	int ret;
 	struct statsContext context;
-	struct sir_rssi_req rssi_req;
+	struct sir_peer_info_req rssi_req;
 
 	if (NULL == adapter) {
 		hddLog(VOS_TRACE_LEVEL_ERROR, "%s: pAdapter is NULL",
@@ -5926,14 +6699,14 @@ static int  wlan_hdd_get_peer_rssi(hdd_adapter_t *adapter,
 	}
 
 	init_completion(&context.completion);
-	context.magic = RSSI_CONTEXT_MAGIC;
+	context.magic = PEER_INFO_CONTEXT_MAGIC;
 	context.extra = extra;
 	context.wrqu = wrqu;
 
 	vos_mem_copy(&(rssi_req.peer_macaddr), &macaddress,
 				VOS_MAC_ADDR_SIZE);
-	rssi_req.sessionId = adapter->sessionId;
-	hstatus = sme_get_rssi(WLAN_HDD_GET_HAL_CTX(adapter),
+	rssi_req.sessionid = adapter->sessionId;
+	hstatus = sme_get_peer_info(WLAN_HDD_GET_HAL_CTX(adapter),
 				rssi_req,
 				&context,
 				hdd_get_rssi_cb);
@@ -6345,6 +7118,22 @@ static const struct iw_priv_args hostapd_private_args[] = {
         0,
         "set_rx_stbc" },
 
+    {   QCSAP_SET_DEFAULT_AMPDU,
+        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+        0,
+        "def_ampdu" },
+
+    {   QCSAP_ENABLE_RTS_BURSTING,
+        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+        0,
+        "rts_bursting" },
+
+    {   QCSAP_ENABLE_DYNAMIC_BW,
+        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+        0,
+        "cwmenable" },
+
+
   { QCSAP_IOCTL_GETPARAM, 0,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "getparam" },
   { QCSAP_IOCTL_GETPARAM, 0,
@@ -6401,6 +7190,8 @@ static const struct iw_priv_args hostapd_private_args[] = {
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "get_txchainmask" },
   { QCASAP_RX_CHAINMASK_CMD, 0,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "get_rxchainmask" },
+  { QCSAP_GET_DYNAMIC_BW, 0,
+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "get_cwmenable" },
   { QCASAP_NSS_CMD, 0,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "get_nss" },
   { QCASAP_GET_TEMP_CMD, 0,
@@ -6643,7 +7434,7 @@ void hdd_set_ap_ops( struct net_device *pWlanHostapdDev )
   pWlanHostapdDev->netdev_ops = &net_ops_struct;
 }
 
-VOS_STATUS hdd_init_ap_mode( hdd_adapter_t *pAdapter )
+VOS_STATUS hdd_init_ap_mode(hdd_adapter_t *pAdapter, bool reinit)
 {
     hdd_hostapd_state_t * phostapdBuf;
     struct net_device *dev = pAdapter->dev;
@@ -6669,20 +7460,27 @@ VOS_STATUS hdd_init_ap_mode( hdd_adapter_t *pAdapter )
             __func__, ret);
     }
 
+    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+               FL("SSR in progress: %d"), reinit);
 #ifdef WLAN_FEATURE_MBSSID
-    sapContext = WLANSAP_Open(pVosContext);
-    if (sapContext == NULL)
-    {
-          VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ("ERROR: WLANSAP_Open failed!!"));
-          return VOS_STATUS_E_FAULT;
-    }
-
-    pAdapter->sessionCtx.ap.sapContext = sapContext;
-    pAdapter->sessionCtx.ap.sapConfig.channel = pHddCtx->acs_policy.acs_channel;
-    mode = pHddCtx->acs_policy.acs_dfs_mode;
-    pAdapter->sessionCtx.ap.sapConfig.acs_dfs_mode =
-          wlan_hdd_get_dfs_mode(mode);
+    if (reinit) {
+        sapContext = pAdapter->sessionCtx.ap.sapContext;
+    } else {
+        sapContext = WLANSAP_Open(pVosContext);
+        if (sapContext == NULL)
+        {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                       FL("ERROR: WLANSAP_Open failed!!"));
+            return VOS_STATUS_E_FAULT;
+        }
 
+        pAdapter->sessionCtx.ap.sapContext = sapContext;
+        pAdapter->sessionCtx.ap.sapConfig.channel =
+                                   pHddCtx->acs_policy.acs_channel;
+        mode = pHddCtx->acs_policy.acs_dfs_mode;
+        pAdapter->sessionCtx.ap.sapConfig.acs_dfs_mode =
+                                        wlan_hdd_get_dfs_mode(mode);
+    }
 
     if (pAdapter->device_mode == WLAN_HDD_P2P_GO) {
         device_mode = VOS_P2P_GO_MODE;
@@ -6694,6 +7492,17 @@ VOS_STATUS hdd_init_ap_mode( hdd_adapter_t *pAdapter )
         return VOS_STATUS_E_FAILURE;
     }
 
+    ret = process_wma_set_command((int)pAdapter->sessionId,
+                         (int)WMI_PDEV_PARAM_BURST_ENABLE,
+                         (int)pHddCtx->cfg_ini->enableSifsBurst,
+                         PDEV_CMD);
+
+    if (0 != ret) {
+        hddLog(VOS_TRACE_LEVEL_ERROR,
+                    "%s: WMI_PDEV_PARAM_BURST_ENABLE set failed %d",
+                    __func__, ret);
+    }
+
     status = WLANSAP_Start(sapContext, device_mode,
             pAdapter->macAddressCurrent.bytes,
             &session_id);
@@ -6751,8 +7560,16 @@ VOS_STATUS hdd_init_ap_mode( hdd_adapter_t *pAdapter )
          return status;
     }
 
-    init_completion(&pAdapter->session_close_comp_var);
-    init_completion(&pAdapter->session_open_comp_var);
+    status = vos_event_init(&phostapdBuf->sta_disassoc_event);
+    if (!VOS_IS_STATUS_SUCCESS(status)) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+            "ERROR: Hostapd HDD sta disassoc event init failed!!");
+#ifdef WLAN_FEATURE_MBSSID
+        WLANSAP_Close(sapContext);
+        pAdapter->sessionCtx.ap.sapContext = NULL;
+#endif
+        return status;
+    }
 
     sema_init(&(WLAN_HDD_GET_AP_CTX_PTR(pAdapter))->semWpsPBCOverlapInd, 1);
 
@@ -6766,6 +7583,8 @@ VOS_STATUS hdd_init_ap_mode( hdd_adapter_t *pAdapter )
        hddLog(VOS_TRACE_LEVEL_FATAL, "%s: hdd_softap_init_tx_rx failed", __func__);
     }
 
+    set_bit(INIT_TX_RX_SUCCESS, &pAdapter->event_flags);
+
     status = hdd_wmm_adapter_init( pAdapter );
     if (!VOS_IS_STATUS_SUCCESS(status))
     {
@@ -6777,25 +7596,17 @@ VOS_STATUS hdd_init_ap_mode( hdd_adapter_t *pAdapter )
 
     set_bit(WMM_INIT_DONE, &pAdapter->event_flags);
 
-    ret = process_wma_set_command((int)pAdapter->sessionId,
-                         (int)WMI_PDEV_PARAM_BURST_ENABLE,
-                         (int)pHddCtx->cfg_ini->enableSifsBurst,
-                         PDEV_CMD);
-
-    if (0 != ret) {
-        hddLog(VOS_TRACE_LEVEL_ERROR,
-                    "%s: WMI_PDEV_PARAM_BURST_ENABLE set failed %d",
-                    __func__, ret);
+    if (!reinit) {
+        pAdapter->sessionCtx.ap.sapConfig.acs_cfg.acs_mode = false;
+        vos_mem_free(pAdapter->sessionCtx.ap.sapConfig.acs_cfg.ch_list);
+        vos_mem_zero(&pAdapter->sessionCtx.ap.sapConfig.acs_cfg,
+                                           sizeof(struct sap_acs_cfg));
     }
-
-    pAdapter->sessionCtx.ap.sapConfig.acs_cfg.acs_mode = false;
-    vos_mem_free(pAdapter->sessionCtx.ap.sapConfig.acs_cfg.ch_list);
-    vos_mem_zero(&pAdapter->sessionCtx.ap.sapConfig.acs_cfg,
-                                                   sizeof(struct sap_acs_cfg));
     return status;
 
 error_wmm_init:
     hdd_softap_deinit_tx_rx( pAdapter );
+    clear_bit(INIT_TX_RX_SUCCESS, &pAdapter->event_flags);
 #ifdef WLAN_FEATURE_MBSSID
     WLANSAP_Close(sapContext);
     pAdapter->sessionCtx.ap.sapContext = NULL;
@@ -6835,8 +7646,8 @@ hdd_adapter_t* hdd_wlan_create_ap_dev(hdd_context_t *pHddCtx,
         pHostapdAdapter->pHddCtx = pHddCtx;
         pHostapdAdapter->magic = WLAN_HDD_ADAPTER_MAGIC;
 
-        hddLog(VOS_TRACE_LEVEL_DEBUG, "%s: pWlanHostapdDev = %p, "
-                                      "pHostapdAdapter = %p, "
+        hddLog(VOS_TRACE_LEVEL_DEBUG, "%s: pWlanHostapdDev = %pK, "
+                                      "pHostapdAdapter = %pK, "
                                       "concurrency_mode=0x%x", __func__,
                                       pWlanHostapdDev,
                                       pHostapdAdapter,
@@ -6859,13 +7670,6 @@ hdd_adapter_t* hdd_wlan_create_ap_dev(hdd_context_t *pHddCtx,
         pWlanHostapdDev->ieee80211_ptr = &pHostapdAdapter->wdev ;
         pHostapdAdapter->wdev.wiphy = pHddCtx->wiphy;
         pHostapdAdapter->wdev.netdev =  pWlanHostapdDev;
-        init_completion(&pHostapdAdapter->tx_action_cnf_event);
-        init_completion(&pHostapdAdapter->cancel_rem_on_chan_var);
-        init_completion(&pHostapdAdapter->rem_on_chan_ready_event);
-        init_completion(&pHostapdAdapter->ula_complete);
-        init_completion(&pHostapdAdapter->offchannel_tx_event);
-        init_completion(&pHostapdAdapter->scan_info.scan_req_completion_event);
-        init_completion(&pHostapdAdapter->scan_info.abortscan_event_var);
         vos_event_init(&pHostapdAdapter->scan_info.scan_finished_event);
         pHostapdAdapter->scan_info.scan_pending_option = WEXT_SCAN_PENDING_GIVEUP;
         /*
@@ -6875,6 +7679,12 @@ hdd_adapter_t* hdd_wlan_create_ap_dev(hdd_context_t *pHddCtx,
         hdd_set_needed_headroom(pWlanHostapdDev,
                            pWlanHostapdDev->hard_header_len);
 
+        if (pHddCtx->cfg_ini->enableIPChecksumOffload)
+            pWlanHostapdDev->features |= NETIF_F_HW_CSUM;
+        else if (pHddCtx->cfg_ini->enableTCPChkSumOffld)
+            pWlanHostapdDev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+        pWlanHostapdDev->features |= NETIF_F_RXCSUM;
+
         SET_NETDEV_DEV(pWlanHostapdDev, pHddCtx->parent_dev);
         spin_lock_init(&pHostapdAdapter->pause_map_lock);
         pHostapdAdapter->last_tx_jiffies = jiffies;
@@ -6931,8 +7741,6 @@ VOS_STATUS hdd_unregister_hostapd(hdd_adapter_t *pAdapter, bool rtnl_held)
 
    ENTER();
 
-   hdd_softap_deinit_tx_rx(pAdapter);
-
    /* if we are being called during driver unload, then the dev has already
       been invalidated.  if we are being called at other times, then we can
       detach the wireless device handlers */
@@ -6963,3 +7771,85 @@ VOS_STATUS hdd_unregister_hostapd(hdd_adapter_t *pAdapter, bool rtnl_held)
    EXIT();
    return 0;
 }
+
+/**
+ * hdd_sap_indicate_disconnect_for_sta() - Indicate disconnect indication
+ * to supplicant, if there any clients connected to SAP interface.
+ * @adapter: sap adapter context
+ *
+ * Return:   nothing
+ */
+void hdd_sap_indicate_disconnect_for_sta(hdd_adapter_t *adapter)
+{
+	tSap_Event sap_event;
+	int staId;
+	ptSapContext sap_ctx = WLAN_HDD_GET_SAP_CTX_PTR(adapter);
+
+	ENTER();
+
+	if (!sap_ctx) {
+		hddLog(LOGE, FL("invalid sap context"));
+		return;
+	}
+
+	for (staId = 0; staId < WLAN_MAX_STA_COUNT; staId++) {
+		if (adapter->aStaInfo[staId].isUsed) {
+			hddLog(LOG1, FL("staId: %d isUsed: %d %pK"),
+				staId, adapter->aStaInfo[staId].isUsed,
+				sap_ctx);
+
+			if (vos_is_macaddr_broadcast(
+				&adapter->aStaInfo[staId].macAddrSTA))
+				continue;
+
+			sap_event.sapHddEventCode = eSAP_STA_DISASSOC_EVENT;
+			vos_mem_copy(
+				&sap_event.sapevt.
+					sapStationDisassocCompleteEvent.staMac,
+				&adapter->aStaInfo[staId].macAddrSTA,
+				sizeof(v_MACADDR_t));
+			sap_event.sapevt.sapStationDisassocCompleteEvent.
+			reason =
+				eSAP_MAC_INITATED_DISASSOC;
+			sap_event.sapevt.sapStationDisassocCompleteEvent.
+			statusCode =
+				eSIR_SME_RESOURCES_UNAVAILABLE;
+			hdd_hostapd_SAPEventCB(&sap_event,
+				sap_ctx->pUsrContext);
+		}
+	}
+
+	clear_bit(SOFTAP_BSS_STARTED, &adapter->event_flags);
+
+	EXIT();
+}
+
+/**
+ * hdd_sap_destroy_events() - Destroy sap evets
+ * @adapter: sap adapter context
+ *
+ * Return:   nothing
+ */
+void hdd_sap_destroy_events(hdd_adapter_t *adapter)
+{
+	ptSapContext sap_ctx = WLAN_HDD_GET_SAP_CTX_PTR(adapter);
+
+	if (!sap_ctx) {
+	hddLog(LOGE, FL("invalid sap context"));
+	return;
+	}
+
+	if (!VOS_IS_STATUS_SUCCESS(vos_lock_destroy(&sap_ctx->SapGlobalLock)))
+		VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+		FL("WLANSAP_Stop failed destroy lock"));
+
+	if (!VOS_IS_STATUS_SUCCESS(vos_event_destroy(
+		&sap_ctx->sap_session_opened_evt)))
+		VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+		FL("failed to destroy session open event"));
+        if (!VOS_IS_STATUS_SUCCESS(vos_event_destroy(
+               &sap_ctx->sap_session_closed_evt)))
+            VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+               FL("failed to destroy session close event"));
+
+}
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ipa.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ipa.c
index 54c840b6fb5..f169620f9d0 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ipa.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ipa.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -545,6 +545,21 @@ static inline bool hdd_ipa_uc_sta_is_enabled(struct hdd_ipa_priv *hdd_ipa)
 #endif /* IPA_UC_STA_OFFLOAD */
 }
 
+#ifdef IPA_UC_STA_OFFLOAD
+static inline void hdd_ipa_uc_sta_reset_sta_connected(
+		struct hdd_ipa_priv *hdd_ipa)
+{
+	vos_lock_acquire(&hdd_ipa->event_lock);
+	hdd_ipa->sta_connected = 0;
+	vos_lock_release(&hdd_ipa->event_lock);
+}
+#else
+static inline void hdd_ipa_uc_sta_reset_sta_connected(
+		struct hdd_ipa_priv *hdd_ipa)
+{
+}
+#endif
+
 static inline bool hdd_ipa_is_pre_filter_enabled(struct hdd_ipa_priv *hdd_ipa)
 {
 	hdd_context_t *hdd_ctx = hdd_ipa->hdd_ctx;
@@ -930,21 +945,21 @@ void hdd_ipa_dump_hdd_ipa(struct hdd_ipa_priv *hdd_ipa)
 			"==== HDD IPA ====\n"
 			"num_iface: %d\n"
 			"rm_state: %d\n"
-			"rm_lock: %p\n"
-			"rm_work: %p\n"
-			"uc_rm_work: %p\n"
-			"uc_op_work: %p\n"
-			"wake_lock: %p\n"
-			"wake_lock_work: %p\n"
+			"rm_lock: %pK\n"
+			"rm_work: %pK\n"
+			"uc_rm_work: %pK\n"
+			"uc_op_work: %pK\n"
+			"wake_lock: %pK\n"
+			"wake_lock_work: %pK\n"
 			"wake_lock_released: %d\n"
 			"prod_client: %d\n"
 			"tx_ref_cnt: %d\n"
 			"pm_queue_head----\n"
-			"\thead: %p\n"
-			"\ttail: %p\n"
+			"\thead: %pK\n"
+			"\ttail: %pK\n"
 			"\tqlen: %d\n"
-			"pm_work: %p\n"
-			"pm_lock: %p\n"
+			"pm_work: %pK\n"
+			"pm_lock: %pK\n"
 			"suspended: %d\n",
 			hdd_ipa->num_iface,
 			hdd_ipa->rm_state,
@@ -966,19 +981,19 @@ void hdd_ipa_dump_hdd_ipa(struct hdd_ipa_priv *hdd_ipa)
 	pr_err(
 			"pending_hw_desc_cnt: %d\n"
 			"hw_desc_cnt: %d\n"
-			"q_lock: %p\n"
+			"q_lock: %pK\n"
 			"freeq_cnt: %d\n"
 			"free_desc_head----\n"
-			"\tnext: %p\n"
-			"\tprev: %p\n"
+			"\tnext: %pK\n"
+			"\tprev: %pK\n"
 			"pend_q_cnt: %d\n"
 			"pend_desc_head----\n"
-			"\tnext: %p\n"
-			"\tprev: %p\n"
-			"hdd_ctx: %p\n"
-			"debugfs_dir: %p\n"
-			"stats: %p\n"
-			"ipv4_notifier: %p\n"
+			"\tnext: %pK\n"
+			"\tprev: %pK\n"
+			"hdd_ctx: %pK\n"
+			"debugfs_dir: %pK\n"
+			"stats: %pK\n"
+			"ipv4_notifier: %pK\n"
 			"curr_prod_bw: %d\n"
 			"curr_cons_bw: %d\n"
 			"activated_fw_pipe: %d\n"
@@ -1014,12 +1029,12 @@ void hdd_ipa_dump_hdd_ipa(struct hdd_ipa_priv *hdd_ipa)
 			"resource_unloading: %d\n"
 			"pending_cons_req: %d\n"
 			"pending_event----\n"
-			"\tanchor.next: %p\n"
-			"\tanchor.prev: %p\n"
+			"\tanchor.next: %pK\n"
+			"\tanchor.prev: %pK\n"
 			"\tcount: %d\n"
-			"\tlock: %p\n"
+			"\tlock: %pK\n"
 			"\tcookie: 0x%x\n"
-			"event_lock: %p\n"
+			"event_lock: %pK\n"
 			"ipa_tx_packets_diff: %d\n"
 			"ipa_rx_packets_diff: %d\n"
 			"ipa_p_tx_packets: %d\n"
@@ -1043,7 +1058,7 @@ void hdd_ipa_dump_hdd_ipa(struct hdd_ipa_priv *hdd_ipa)
 			hdd_ipa->stat_req_reason);
 	pr_err(
 			"cons_pipe_in----\n"
-			"\tsys: %p\n"
+			"\tsys: %pK\n"
 			"\tdl.comp_ring_base_pa: 0x%x\n"
 			"\tdl.comp_ring_size: %d\n"
 			"\tdl.ce_ring_base_pa: 0x%x\n"
@@ -1051,7 +1066,7 @@ void hdd_ipa_dump_hdd_ipa(struct hdd_ipa_priv *hdd_ipa)
 			"\tdl.ce_ring_size: %d\n"
 			"\tdl.num_tx_buffers: %d\n"
 			"prod_pipe_in----\n"
-			"\tsys: %p\n"
+			"\tsys: %pK\n"
 			"\tul.rdy_ring_base_pa: 0x%x\n"
 			"\tul.rdy_ring_size: %d\n"
 			"\tul.rdy_ring_rp_pa: 0x%x\n"
@@ -1117,8 +1132,8 @@ void hdd_ipa_dump_sys_pipe(struct hdd_ipa_priv *hdd_ipa)
 			"\tmode: %d\n"
 			"\tclient: %d\n"
 			"\tdesc_fifo_sz: %d\n"
-			"\tpriv: %p\n"
-			"\tnotify: %p\n"
+			"\tpriv: %pK\n"
+			"\tnotify: %pK\n"
 			"\tskip_ep_cfg: %d\n"
 			"\tkeep_ipa_awake: %d\n",
 			i,
@@ -1163,14 +1178,14 @@ void hdd_ipa_dump_iface_context(struct hdd_ipa_priv *hdd_ipa)
 
 		pr_err(
 			"iface_context[%d]----\n"
-			"\thdd_ipa: %p\n"
-			"\tadapter: %p\n"
-			"\ttl_context: %p\n"
+			"\thdd_ipa: %pK\n"
+			"\tadapter: %pK\n"
+			"\ttl_context: %pK\n"
 			"\tcons_client: %d\n"
 			"\tprod_client: %d\n"
 			"\tiface_id: %d\n"
 			"\tsta_id: %d\n"
-			"\tinterface_lock: %p\n"
+			"\tinterface_lock: %pK\n"
 			"\tifa_address: 0x%x\n",
 			i,
 			iface_context->hdd_ipa,
@@ -1195,7 +1210,20 @@ void hdd_ipa_dump_iface_context(struct hdd_ipa_priv *hdd_ipa)
  */
 void hdd_ipa_dump_info(hdd_context_t *hdd_ctx)
 {
-	struct hdd_ipa_priv *hdd_ipa = (struct hdd_ipa_priv *)hdd_ctx->hdd_ipa;
+	struct hdd_ipa_priv *hdd_ipa;
+
+	if (wlan_hdd_validate_context(hdd_ctx))
+		return;
+
+	hdd_ipa = (struct hdd_ipa_priv *)hdd_ctx->hdd_ipa;
+	if (!hdd_ipa_is_enabled(hdd_ctx) ||
+	    !hdd_ipa_uc_is_enabled(hdd_ipa)) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"IPA/IPA UC is not enabled, IpaConfig %u,IpaUcOffloadEnabled %u.",
+			hdd_ctx->cfg_ini->IpaConfig,
+			hdd_ctx->cfg_ini->IpaUcOffloadEnabled);
+		return;
+	}
 
 	hdd_ipa_dump_hdd_ipa(hdd_ipa);
 	hdd_ipa_dump_sys_pipe(hdd_ipa);
@@ -1621,7 +1649,6 @@ void hdd_ipa_uc_loaded_uc_cb(void *priv_ctxt)
 	return;
 }
 
-#define HDD_BW_GET_DIFF(_x, _y) (unsigned long)((ULONG_MAX - (_y)) + (_x) + 1)
 static void hdd_ipa_uc_op_cb(struct op_msg_type *op_msg, void *usr_ctxt)
 {
 	struct op_msg_type *msg = op_msg;
@@ -2012,8 +2039,11 @@ static VOS_STATUS hdd_ipa_uc_ol_init(hdd_context_t *hdd_ctx)
 	vos_mem_zero(&pipe_out, sizeof(struct ipa_wdi_out_params));
 
 	vos_list_init(&ipa_ctxt->pending_event);
-	vos_lock_init(&ipa_ctxt->event_lock);
-	vos_lock_init(&ipa_ctxt->ipa_lock);
+
+	if (!hdd_ctx->isLogpInProgress) {
+		vos_lock_init(&ipa_ctxt->event_lock);
+		vos_lock_init(&ipa_ctxt->ipa_lock);
+	}
 
 	/* TX PIPE */
 	pipe_in.sys.ipa_ep_cfg.nat.nat_en = IPA_BYPASS_NAT;
@@ -2165,6 +2195,166 @@ void hdd_ipa_uc_force_pipe_shutdown(hdd_context_t *hdd_ctx)
 }
 
 /**
+ * hdd_ipa_uc_send_evt() - send event to ipa
+ * @hdd_ctx: pointer to hdd context
+ * @type: event type
+ * @mac_addr: pointer to mac address
+ *
+ * Send event to IPA driver
+ *
+ * Return: 0 - Success
+ */
+static int hdd_ipa_uc_send_evt(hdd_adapter_t *adapter,
+            enum ipa_wlan_event type, uint8_t *mac_addr )
+{
+	struct hdd_ipa_priv *hdd_ipa = ghdd_ipa;
+	struct ipa_msg_meta meta;
+	struct ipa_wlan_msg *msg;
+	int ret = 0;
+
+	meta.msg_len = sizeof(struct ipa_wlan_msg);
+	msg = adf_os_mem_alloc(NULL, meta.msg_len);
+	if (msg == NULL) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"msg allocation failed");
+		return -ENOMEM;
+	}
+
+	meta.msg_type = type;
+	strlcpy(msg->name, adapter->dev->name,
+		IPA_RESOURCE_NAME_MAX);
+	memcpy(msg->mac_addr, mac_addr, ETH_ALEN);
+	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO, "%s: Evt: %d",
+		msg->name, meta.msg_type);
+	ret = ipa_send_msg(&meta, msg, hdd_ipa_msg_free_fn);
+	if (ret) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"%s: Evt: %d fail:%d",
+			msg->name, meta.msg_type,  ret);
+		adf_os_mem_free(msg);
+		return ret;
+	}
+
+	hdd_ipa->stats.num_send_msg++;
+
+	return ret;
+}
+
+/**
+ * hdd_ipa_uc_disconnect_client() - send client disconnect event
+ * @hdd_ctx: pointer to hdd adapter
+ *
+ * Send disconnect client event to IPA driver during SSR
+ *
+ * Return: 0 - Success
+ */
+static int hdd_ipa_uc_disconnect_client(hdd_adapter_t *adapter)
+{
+	struct hdd_ipa_priv *hdd_ipa = ghdd_ipa;
+	int ret = 0;
+	int i;
+
+	for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
+		if (vos_is_macaddr_broadcast(&adapter->aStaInfo[i].macAddrSTA))
+			continue;
+		if ((adapter->aStaInfo[i].isUsed) &&
+		   (!adapter->aStaInfo[i].isDeauthInProgress) &&
+		   hdd_ipa->sap_num_connected_sta) {
+			hdd_ipa_uc_send_evt(adapter, WLAN_CLIENT_DISCONNECT,
+				adapter->aStaInfo[i].macAddrSTA.bytes);
+			hdd_ipa->sap_num_connected_sta--;
+		}
+	}
+
+	return ret;
+}
+
+/**
+ * hdd_ipa_uc_disconnect_ap() - send ap disconnect event
+ * @hdd_ctx: pointer to hdd adapter
+ *
+ * Send disconnect ap event to IPA driver during SSR
+ *
+ * Return: 0 - Success
+ */
+
+static int hdd_ipa_uc_disconnect_ap(hdd_adapter_t *adapter)
+{
+	int ret = 0;
+
+	if (adapter->ipa_context)
+		hdd_ipa_uc_send_evt(adapter, WLAN_AP_DISCONNECT,
+			adapter->dev->dev_addr);
+
+	return ret;
+}
+
+#ifdef IPA_UC_STA_OFFLOAD
+/**
+ * hdd_ipa_uc_disconnect_sta() - send sta disconnect event
+ * @hdd_ctx: pointer to hdd adapter
+ *
+ * Send disconnect sta event to IPA driver during SSR
+ *
+ * Return: 0 - Success
+ */
+static int hdd_ipa_uc_disconnect_sta(hdd_adapter_t *adapter)
+{
+	hdd_station_ctx_t *pHddStaCtx;
+	struct hdd_ipa_priv *hdd_ipa = ghdd_ipa;
+	int ret = 0;
+
+	if (hdd_ipa_uc_sta_is_enabled(hdd_ipa) &&
+	    hdd_ipa->sta_connected) {
+		pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+		hdd_ipa_uc_send_evt(adapter, WLAN_STA_DISCONNECT,
+			pHddStaCtx->conn_info.bssId);
+	}
+
+	return ret;
+}
+#else
+static int hdd_ipa_uc_disconnect_sta(hdd_adapter_t *adapter)
+{
+	return 0;
+}
+
+#endif
+
+/**
+ * hdd_ipa_uc_disconnect() - send disconnect ipa event
+ * @hdd_ctx: pointer to hdd context
+ *
+ * Send disconnect event to IPA driver during SSR
+ *
+ * Return: 0 - Success
+ */
+static int hdd_ipa_uc_disconnect(hdd_context_t *hdd_ctx)
+{
+	hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
+	VOS_STATUS status;
+	hdd_adapter_t *adapter;
+	int ret = 0;
+
+	status =  hdd_get_front_adapter (hdd_ctx, &adapter_node);
+	while (NULL != adapter_node && VOS_STATUS_SUCCESS == status) {
+		adapter = adapter_node->pAdapter;
+		if (adapter->device_mode == WLAN_HDD_SOFTAP) {
+			hdd_ipa_uc_disconnect_client(adapter);
+			hdd_ipa_uc_disconnect_ap(adapter);
+		} else if (adapter->device_mode == WLAN_HDD_INFRA_STATION) {
+			hdd_ipa_uc_disconnect_sta(adapter);
+		}
+
+		status = hdd_get_next_adapter(
+				hdd_ctx, adapter_node, &next);
+		adapter_node = next;
+	}
+
+	return ret;
+}
+
+/**
  * hdd_ipa_uc_ssr_deinit() - handle ipa deinit for SSR
  *
  * Deinit basic IPA UC host side to be in sync reloaded FW during
@@ -2177,10 +2367,15 @@ int hdd_ipa_uc_ssr_deinit()
 	struct hdd_ipa_priv *hdd_ipa = ghdd_ipa;
 	int idx;
 	struct hdd_ipa_iface_context *iface_context;
+	hdd_context_t *hdd_ctx;
 
 	if (!hdd_ipa_uc_is_enabled(hdd_ipa))
 		return 0;
 
+	hdd_ctx = hdd_ipa->hdd_ctx;
+	/* send disconnect to ipa driver */
+	hdd_ipa_uc_disconnect(hdd_ctx);
+
 	/* Clean up HDD IPA interfaces */
 	for (idx = 0; (hdd_ipa->num_iface > 0) &&
 		(idx < HDD_IPA_MAX_IFACE); idx++) {
@@ -2203,6 +2398,26 @@ int hdd_ipa_uc_ssr_deinit()
 	}
 	vos_lock_release(&hdd_ipa->ipa_lock);
 
+	/*
+	 * Do WDI pipes disconnect here. During reinit new WDI pipes
+	 * will be created.
+	 */
+	/* In MDM case pipes will be disconnected as part of ipa cleanup */
+	if (hdd_ctx->cfg_ini->sap_internal_restart) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
+			"%s: Disconnect TX PIPE tx_pipe_handle=0x%x",
+			__func__, hdd_ipa->tx_pipe_handle);
+		ipa_disconnect_wdi_pipe(hdd_ipa->tx_pipe_handle);
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
+			"%s: Disconnect RX PIPE rx_pipe_handle=0x%x",
+			__func__, hdd_ipa->rx_pipe_handle);
+		ipa_disconnect_wdi_pipe(hdd_ipa->rx_pipe_handle);
+	}
+
+	if (hdd_ipa_uc_sta_is_enabled(hdd_ipa)) {
+		hdd_ipa_uc_sta_reset_sta_connected(hdd_ipa);
+	}
+
 	/* Full IPA driver cleanup not required since wlan driver is now
 	 * unloaded and reloaded after SSR.
 	 */
@@ -2217,19 +2432,16 @@ int hdd_ipa_uc_ssr_deinit()
  *
  * Return: 0 - Success
  */
-int hdd_ipa_uc_ssr_reinit()
+int hdd_ipa_uc_ssr_reinit(hdd_context_t *hdd_ctx)
 {
 	struct hdd_ipa_priv *hdd_ipa = ghdd_ipa;
 
 	if (!hdd_ipa_uc_is_enabled(hdd_ipa))
 		return 0;
 
-	/* After SSR is complete, IPA UC can resume operation. But now wlan
-	 * driver will be unloaded and reloaded, which takes care of IPA cleanup
-	 * and initialization.
-	 * This is a placeholder func if IPA has to resume operations without
-	 * driver reload.
-	 */
+	if (hdd_ctx->cfg_ini->sap_internal_restart)
+		hdd_ipa_uc_ol_init(hdd_ctx);
+
 	return 0;
 }
 #else
@@ -2639,6 +2851,39 @@ int hdd_ipa_set_perf_level(hdd_context_t *hdd_ctx, uint64_t tx_packets,
 	return 0;
 }
 
+/**
+ * hdd_ipa_is_present() - get IPA hw status
+ * @hdd_ctx: pointer to hdd context
+ *
+ * ipa_uc_reg_rdyCB is not directly designed to check
+ * ipa hw status. This is an undocumented function which
+ * has confirmed with IPA team.
+ *
+ * Return: true - ipa hw present
+ *         false - ipa hw not present
+ */
+bool hdd_ipa_is_present(hdd_context_t *hdd_ctx)
+{
+	/* Check if ipa hw is enabled */
+	if (ipa_uc_reg_rdyCB(NULL) != -EPERM)
+		return true;
+	else
+		return false;
+}
+
+/**
+ * hdd_ipa_reset_ipaconfig() - reset IpaConfig
+ * @hdd_ctx: pointer to hdd context
+ * @ipaconfig: new value for IpaConfig
+ *
+ * Return: none
+ */
+void hdd_ipa_reset_ipaconfig(hdd_context_t *hdd_ctx, v_U32_t ipaconfig)
+{
+	hdd_ctx->cfg_ini->IpaConfig = ipaconfig;
+	return;
+}
+
 static int hdd_ipa_setup_rm(struct hdd_ipa_priv *hdd_ipa)
 {
 	struct ipa_rm_create_params create_params = {0};
@@ -2766,7 +3011,7 @@ static void hdd_ipa_send_skb_to_network(adf_nbuf_t skb, hdd_adapter_t *adapter)
 	unsigned int cpu_index;
 
 	if (!adapter || adapter->magic != WLAN_HDD_ADAPTER_MAGIC) {
-		HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO_LOW, "Invalid adapter: 0x%p",
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO_LOW, "Invalid adapter: 0x%pK",
 				adapter);
 		HDD_IPA_INCREASE_INTERNAL_DROP_COUNT(hdd_ipa);
 		adf_nbuf_free(skb);
@@ -3060,6 +3305,9 @@ static void hdd_ipa_w2i_cb(void *priv, enum ipa_dp_evt_type evt,
 
 	hdd_ipa = (struct hdd_ipa_priv *)priv;
 
+	if (!hdd_ipa || wlan_hdd_validate_context(hdd_ipa->hdd_ctx))
+		return;
+
 	switch (evt) {
 	case IPA_RECEIVE:
 		skb = (adf_nbuf_t) data;
@@ -3202,12 +3450,15 @@ static void hdd_ipa_send_pkt_to_tl(struct hdd_ipa_iface_context *iface_context,
 	 * During CAC period, data packets shouldn't be sent over the air so
 	 * drop all the packets here
 	 */
-	if (WLAN_HDD_GET_AP_CTX_PTR(adapter)->dfs_cac_block_tx) {
-		ipa_free_skb(ipa_tx_desc);
-		adf_os_spin_unlock_bh(&iface_context->interface_lock);
-		iface_context->stats.num_tx_cac_drop++;
-		hdd_ipa_rm_try_release(hdd_ipa);
-		return;
+	if (WLAN_HDD_SOFTAP == adapter->device_mode ||
+	    WLAN_HDD_P2P_GO == adapter->device_mode) {
+		if (WLAN_HDD_GET_AP_CTX_PTR(adapter)->dfs_cac_block_tx) {
+			ipa_free_skb(ipa_tx_desc);
+			adf_os_spin_unlock_bh(&iface_context->interface_lock);
+			iface_context->stats.num_tx_cac_drop++;
+			hdd_ipa_rm_try_release(hdd_ipa);
+			return;
+		}
 	}
 
 	interface_id = adapter->sessionId;
@@ -4181,7 +4432,7 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 		if (!hdd_ipa_uc_is_enabled(hdd_ipa)) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
 				"%s: Evt: %d, IPA UC OFFLOAD NOT ENABLED",
-				msg_ex->name, meta.msg_type);
+				adapter->dev->name, type);
 		} else if ((!hdd_ipa->sap_num_connected_sta) &&
 				(!hdd_ipa->sta_connected)) {
 			/* Enable IPA UC TX PIPE when STA connected */
@@ -4238,7 +4489,7 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 		if (ret) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
 				"%s: Evt: %d, Interface setup failed",
-				msg_ex->name, meta.msg_type);
+				adapter->dev->name, type);
 #ifdef IPA_UC_OFFLOAD
 			vos_lock_release(&hdd_ipa->event_lock);
 #endif /* IPA_UC_OFFLOAD */
@@ -4263,26 +4514,29 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 		if (!hdd_ipa->sta_connected) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
 				"%s: Evt: %d, STA already disconnected",
-				msg_ex->name, meta.msg_type);
+				adapter->dev->name, type);
 			vos_lock_release(&hdd_ipa->event_lock);
 			return -EINVAL;
 		}
-		hdd_ipa->sta_connected = 0;
+
 		if (!hdd_ipa_uc_is_enabled(hdd_ipa)) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
 				"%s: IPA UC OFFLOAD NOT ENABLED",
 				msg_ex->name);
 		} else {
 			/* Disable IPA UC TX PIPE when STA disconnected */
-			if ((!hdd_ipa->sap_num_connected_sta) ||
-				((!hdd_ipa->num_iface) &&
-					(HDD_IPA_UC_NUM_WDI_PIPE ==
-					hdd_ipa->activated_fw_pipe &&
-					!hdd_ipa->ipa_pipes_down))) {
+			if ((!hdd_ipa->sap_num_connected_sta &&
+			     hdd_ipa->sta_connected) ||
+			    (!hdd_ipa->num_iface &&
+			    (HDD_IPA_UC_NUM_WDI_PIPE ==
+					hdd_ipa->activated_fw_pipe) &&
+			    !hdd_ipa->ipa_pipes_down)) {
 				hdd_ipa_uc_handle_last_discon(hdd_ipa);
 			}
 		}
 
+		hdd_ipa->sta_connected = 0;
+
 		vos_lock_release(&hdd_ipa->event_lock);
 
                 if (hdd_ipa_uc_sta_is_enabled(hdd_ipa)) {
@@ -4297,7 +4551,7 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 		if (!adapter->ipa_context) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
 				"%s: Evt: %d, SAP already disconnected",
-				msg_ex->name, meta.msg_type);
+				adapter->dev->name, type);
 			return -EINVAL;
 		}
 
@@ -4343,7 +4597,7 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 		if (!hdd_ipa_uc_is_enabled(hdd_ipa)) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
 				"%s: Evt: %d, IPA UC OFFLOAD NOT ENABLED",
-				adapter->dev->name, meta.msg_type);
+				adapter->dev->name, type);
 			return 0;
 		}
 
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c
index 022a40d9701..75b872b28a8 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -133,6 +133,11 @@ extern int hdd_hostapd_stop (struct net_device *dev);
 #include "wlan_hdd_tsf.h"
 #include "tl_shim.h"
 #include "wlan_hdd_oemdata.h"
+#include "sirApi.h"
+
+#ifdef CNSS_GENL
+#include <net/cnss_nl.h>
+#endif
 
 #if defined(LINUX_QCMBR)
 #define SIOCIOCTLTX99 (SIOCDEVPRIVATE+13)
@@ -161,7 +166,6 @@ extern int hdd_hostapd_stop (struct net_device *dev);
 #define MEMORY_DEBUG_STR ""
 #endif
 
-#define DISABLE_KRAIT_IDLE_PS_VAL   1
 #ifdef IPA_UC_OFFLOAD
 /* If IPA UC data path is enabled, target should reserve extra tx descriptors
  * for IPA WDI data path.
@@ -239,6 +243,9 @@ DEFINE_SPINLOCK(hdd_context_lock);
 
 #define WLAN_NLINK_CESIUM 30
 
+/*Nss - 1, (Nss = 2 for 2x2)*/
+#define NUM_OF_SOUNDING_DIMENSIONS 1
+
 /*
  * Android DRIVER command structures
  */
@@ -316,8 +323,11 @@ struct init_comp {
 };
 static struct init_comp wlan_comp;
 
+/* Keep track unload status */
+static uint32_t g_current_unload_state;
+#define TRACK_UNLOAD_STATUS(state) (g_current_unload_state =  state)
+
 #ifdef QCA_WIFI_FTM
-extern int hdd_ftm_start(hdd_context_t *pHddCtx);
 extern int hdd_ftm_stop(hdd_context_t *pHddCtx);
 #endif
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
@@ -533,8 +543,7 @@ void hdd_wlan_green_ap_mc(hdd_context_t *pHddCtx,
             break;
 
         case GREEN_AP_PS_STOP_EVENT:
-            if (!(hdd_get_concurrency_mode() & VOS_SAP))
-                green_ap->ps_enable = 0;
+            green_ap->ps_enable = 0;
             break;
 
         case GREEN_AP_ADD_STA_EVENT:
@@ -555,14 +564,6 @@ void hdd_wlan_green_ap_mc(hdd_context_t *pHddCtx,
             break;
     }
 
-    /* Confirm that power save is enabled  before doing state transitions */
-    if (!green_ap->ps_enable) {
-        hddLog(VOS_TRACE_LEVEL_INFO, FL("Green-AP is disabled"));
-        hdd_wlan_green_ap_update(pHddCtx,
-            GREEN_AP_PS_IDLE_STATE, GREEN_AP_PS_WAIT_EVENT);
-        goto done;
-    }
-
     pAdapter = hdd_get_adapter (pHddCtx, WLAN_HDD_SOFTAP );
 
     if (pAdapter == NULL) {
@@ -570,6 +571,16 @@ void hdd_wlan_green_ap_mc(hdd_context_t *pHddCtx,
         goto done;
     }
 
+    /* Confirm that power save is enabled  before doing state transitions */
+    if (!green_ap->ps_enable) {
+        hddLog(VOS_TRACE_LEVEL_INFO, FL("green ap is disabled"));
+        hdd_wlan_green_ap_update(pHddCtx,
+            GREEN_AP_PS_OFF_STATE, GREEN_AP_PS_WAIT_EVENT);
+        if (hdd_wlan_green_ap_enable(pAdapter, 0))
+            hddLog(LOGE, FL("failed to set green ap mode"));
+        goto done;
+    }
+
     /* handle the green ap ps state */
     switch(green_ap->ps_state) {
         case GREEN_AP_PS_IDLE_STATE:
@@ -679,6 +690,65 @@ void wlan_hdd_set_egap_support(hdd_context_t *hdd_ctx, struct hdd_tgt_cfg *cfg)
 }
 
 /**
+ * hdd_wlan_is_egap_enabled() - Get Enhance Green AP feature status
+ * @fw_egap_support: flag whether firmware supports egap or not
+ * @cfg: pointer to the struct hdd_config_t
+ *
+ * Return: true if firmware, feature_flag and ini are all enabled the egap
+ */
+static bool hdd_wlan_is_egap_enabled(bool fw_egap_support, hdd_config_t *cfg)
+{
+	/* check if the firmware and ini are both enabled the egap,
+	 * and also the feature_flag enable.
+	 */
+	if (fw_egap_support && cfg->enable_egap &&
+			cfg->egap_feature_flag)
+		return true;
+
+	return false;
+}
+
+
+/**
+ * hdd_wlan_enable_egap() - Enable Enhance Green AP
+ * @hdd_ctx: HDD global context
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+int hdd_wlan_enable_egap(struct hdd_context_s *hdd_ctx)
+{
+	hdd_config_t *cfg;
+
+	if (!hdd_ctx) {
+		hddLog(LOGE, FL("hdd context is NULL"));
+		return -EINVAL;
+	}
+
+	cfg = hdd_ctx->cfg_ini;
+
+	if (!cfg) {
+		hddLog(LOGE, FL("hdd cfg is NULL"));
+		return -EINVAL;
+	}
+
+	if (!hdd_ctx->green_ap_ctx) {
+		hddLog(LOGE, FL("green ap context is NULL"));
+		return -EINVAL;
+	}
+
+	if (!hdd_wlan_is_egap_enabled(hdd_ctx->green_ap_ctx->egap_support,
+			hdd_ctx->cfg_ini))
+		return -ENOTSUPP;
+
+	if (VOS_STATUS_SUCCESS != sme_send_egap_conf_params(cfg->enable_egap,
+			cfg->egap_inact_time,
+			cfg->egap_wait_time,
+			cfg->egap_feature_flag))
+		return -EINVAL;
+	return 0;
+}
+
+/**
  * hdd_wlan_green_ap_start_bss() - Notify Green AP of Start BSS event
  * @hdd_ctx: HDD global context
  *
@@ -690,52 +760,40 @@ void hdd_wlan_green_ap_start_bss(struct hdd_context_s *hdd_ctx)
 
 	if (!hdd_ctx) {
 		hddLog(LOGE, FL("hdd context is NULL"));
-		goto exit;
+		return;
 	}
 
 	cfg = hdd_ctx->cfg_ini;
 
 	if (!cfg) {
 		hddLog(LOGE, FL("hdd cfg is NULL"));
-		goto exit;
+		return;
 	}
 
-	/* check if the firmware and ini are both enabled the egap,
-	 * and also the feature_flag enable, then we enable the egap
-	 */
-	if (hdd_ctx->green_ap_ctx->egap_support && cfg->enable_egap &&
-	    cfg->egap_feature_flag) {
-		hddLog(LOG1,
-		       FL("Set EGAP - enabled: %d, flag: %x, inact_time: %d, wait_time: %d"),
-			  cfg->enable_egap,
-			  cfg->egap_feature_flag,
-			  cfg->egap_inact_time,
-			  cfg->egap_wait_time);
-		if (!sme_send_egap_conf_params(cfg->enable_egap,
-					       cfg->egap_inact_time,
-					       cfg->egap_wait_time,
-					       cfg->egap_feature_flag)) {
-			/* EGAP is enabled, disable host GAP */
-			hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_PS_STOP_EVENT);
-			goto exit;
-		}
-		/* fall through, if send_egap_conf_params() failed,
-		 * then check host GAP and enable it accordingly
-		 */
+	if (!hdd_ctx->green_ap_ctx) {
+		hddLog(LOGE, FL("green ap context is NULL"));
+		return;
 	}
 
-	if (!(VOS_STA & hdd_ctx->concurrency_mode) &&
-	    cfg->enable2x2 && cfg->enableGreenAP) {
+	if (hdd_wlan_is_egap_enabled(hdd_ctx->green_ap_ctx->egap_support,
+			hdd_ctx->cfg_ini))
+		return;
+
+	if ((hdd_ctx->concurrency_mode & VOS_SAP) &&
+			!(hdd_ctx->concurrency_mode & (~VOS_SAP)) &&
+			cfg->enable2x2 && cfg->enableGreenAP) {
+		hddLog(LOG1,
+			FL("Green AP enabled - sta_con: %d, 2x2: %d, GAP: %d"),
+			(VOS_STA & hdd_ctx->concurrency_mode),
+			cfg->enable2x2, cfg->enableGreenAP);
 		hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_PS_START_EVENT);
 	} else {
 		hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_PS_STOP_EVENT);
 		hddLog(LOG1,
-		       FL("Green AP disabled - sta_con: %d, 2x2: %d, GAP: %d"),
-		       (VOS_STA & hdd_ctx->concurrency_mode),
-		       cfg->enable2x2, cfg->enableGreenAP);
+			FL("Green AP disabled- sta_con: %d, 2x2: %d, GAP: %d"),
+			(VOS_STA & hdd_ctx->concurrency_mode),
+			cfg->enable2x2, cfg->enableGreenAP);
 	}
-exit:
-	return;
 }
 
 /**
@@ -746,7 +804,30 @@ exit:
  */
 void hdd_wlan_green_ap_stop_bss(struct hdd_context_s *hdd_ctx)
 {
-	hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_PS_STOP_EVENT);
+	if (!hdd_ctx) {
+		hddLog(LOGE, FL("hdd context is NULL"));
+		return;
+	}
+
+	if (!hdd_ctx->cfg_ini) {
+		hddLog(LOGE, FL("hdd cfg is NULL"));
+		return;
+	}
+
+	if (!hdd_ctx->green_ap_ctx) {
+		hddLog(LOGE, FL("green ap context is NULL"));
+		return;
+	}
+
+	if (hdd_wlan_is_egap_enabled(hdd_ctx->green_ap_ctx->egap_support,
+			hdd_ctx->cfg_ini))
+		return;
+
+	/* For AP+AP mode, only trigger GREEN_AP_PS_STOP_EVENT, when the
+	 * last AP stops.
+	 */
+	if (1 == (hdd_ctx->no_of_open_sessions[VOS_STA_SAP_MODE]))
+		hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_PS_STOP_EVENT);
 }
 
 /**
@@ -757,6 +838,25 @@ void hdd_wlan_green_ap_stop_bss(struct hdd_context_s *hdd_ctx)
  */
 void hdd_wlan_green_ap_add_sta(struct hdd_context_s *hdd_ctx)
 {
+	if (!hdd_ctx) {
+		hddLog(LOGE, FL("hdd context is NULL"));
+		return;
+	}
+
+	if (!hdd_ctx->cfg_ini) {
+		hddLog(LOGE, FL("hdd cfg is NULL"));
+		return;
+	}
+
+	if (!hdd_ctx->green_ap_ctx) {
+		hddLog(LOGE, FL("green ap context is NULL"));
+		return;
+	}
+
+	if (hdd_wlan_is_egap_enabled(hdd_ctx->green_ap_ctx->egap_support,
+			hdd_ctx->cfg_ini))
+		return;
+
 	hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_ADD_STA_EVENT);
 }
 
@@ -768,6 +868,25 @@ void hdd_wlan_green_ap_add_sta(struct hdd_context_s *hdd_ctx)
  */
 void hdd_wlan_green_ap_del_sta(struct hdd_context_s *hdd_ctx)
 {
+	if (!hdd_ctx) {
+		hddLog(LOGE, FL("hdd context is NULL"));
+		return;
+	}
+
+	if (!hdd_ctx->cfg_ini) {
+		hddLog(LOGE, FL("hdd cfg is NULL"));
+		return;
+	}
+
+	if (!hdd_ctx->green_ap_ctx) {
+		hddLog(LOGE, FL("green ap context is NULL"));
+		return;
+	}
+
+	if (hdd_wlan_is_egap_enabled(hdd_ctx->green_ap_ctx->egap_support,
+			hdd_ctx->cfg_ini))
+		return;
+
 	hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_DEL_STA_EVENT);
 }
 
@@ -928,14 +1047,17 @@ void wlan_hdd_restart_sap(hdd_adapter_t *ap_adapter)
             goto end;
         }
 
+        vos_event_reset(&pHostapdState->vosEvent);
         if (WLANSAP_StartBss(p_sap_ctx, hdd_hostapd_SAPEventCB, pConfig,
             (v_PVOID_t)ap_adapter->dev) != VOS_STATUS_SUCCESS) {
             hddLog(LOGE, FL("SAP Start Bss fail"));
+            WLANSAP_ResetSapConfigAddIE(pConfig, eUPDATE_IE_ALL);
             goto end;
         }
 
         hddLog(LOG1, FL("Waiting for SAP to start"));
         vos_status = vos_wait_single_event(&pHostapdState->vosEvent, 10000);
+        WLANSAP_ResetSapConfigAddIE(pConfig, eUPDATE_IE_ALL);
         if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
             hddLog(LOGE, FL("SAP Start failed"));
             goto end;
@@ -968,6 +1090,7 @@ static int __hdd_netdev_notifier_call(struct notifier_block * nb,
 
    //Make sure that this callback corresponds to our device.
    if ((strncmp(dev->name, "wlan", 4)) &&
+      (strncmp(dev->name, "softAP", 6)) &&
       (strncmp(dev->name, "p2p", 3)))
       return NOTIFY_DONE;
 
@@ -1035,6 +1158,7 @@ static int __hdd_netdev_notifier_call(struct notifier_block * nb,
         }
         else
         {
+           vos_flush_work(&pAdapter->scan_block_work);
            VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                "%s: Scan is not Pending from user" , __func__);
         }
@@ -1140,17 +1264,24 @@ int wlan_hdd_validate_context(hdd_context_t *pHddCtx)
 {
 
     if (NULL == pHddCtx || NULL == pHddCtx->cfg_ini) {
-        hddLog(LOGE, FL("%pS HDD context is Null"), (void *)_RET_IP_);
+        hddLog(LOG1, FL("%pS HDD context is Null"), (void *)_RET_IP_);
         return -ENODEV;
     }
 
     if (pHddCtx->isLogpInProgress) {
-        hddLog(LOGE, FL("%pS LOGP in Progress. Ignore!!!"), (void *)_RET_IP_);
+        hddLog(LOG1, FL("%pS LOGP in Progress. Ignore!!!"), (void *)_RET_IP_);
         return -EAGAIN;
     }
 
     if ((pHddCtx->isLoadInProgress) ||
         (pHddCtx->isUnloadInProgress)) {
+        hddLog(LOG1,
+             FL("%pS loading: %d unloading:%d in Progress. Ignore!!!"),
+             (void *)_RET_IP_,
+             pHddCtx->isLoadInProgress,
+             pHddCtx->isUnloadInProgress);
+        if (pHddCtx->isUnloadInProgress)
+             hddLog(LOG1, "current unload state: %d", g_current_unload_state);
         return -EAGAIN;
     }
     return 0;
@@ -1297,7 +1428,7 @@ static int hdd_parse_setrmcenable_command(tANI_U8 *pValue, tANI_U8 *pRmcEnable)
         return 0;
     }
 
-    sscanf(inPtr, "%32s ", buf);
+    sscanf(inPtr, "%31s ", buf);
     v = kstrtos32(buf, 10, &tempInt);
     if ( v < 0)
     {
@@ -1341,7 +1472,7 @@ static int hdd_parse_setrmcactionperiod_command(tANI_U8 *pValue,
         return 0;
     }
 
-    sscanf(inPtr, "%32s ", buf);
+    sscanf(inPtr, "%31s ", buf);
     v = kstrtos32(buf, 10, &tempInt);
     if ( v < 0)
     {
@@ -1392,7 +1523,7 @@ static int hdd_parse_setrmcrate_command(tANI_U8 *pValue,
         return 0;
     }
 
-    sscanf(inPtr, "%32s ", buf);
+    sscanf(inPtr, "%31s ", buf);
     v = kstrtos32(buf, 10, &tempInt);
     if ( v < 0)
     {
@@ -1587,7 +1718,9 @@ static VOS_STATUS
 hdd_parse_get_ibss_peer_info(tANI_U8 *pValue, v_MACADDR_t *pPeerMacAddr)
 {
     tANI_U8 *inPtr = pValue;
-    inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE);
+    size_t inPtrLen = strlen(pValue);
+
+    inPtr = strnchr(pValue, inPtrLen, SPACE_ASCII_VALUE);
 
     if (NULL == inPtr)
     {
@@ -1606,6 +1739,12 @@ hdd_parse_get_ibss_peer_info(tANI_U8 *pValue, v_MACADDR_t *pPeerMacAddr)
         return VOS_STATUS_E_FAILURE;;
     }
 
+    inPtrLen -= (inPtr - pValue);
+    if (inPtrLen < 17)
+    {
+        return VOS_STATUS_E_FAILURE;
+    }
+
     if (inPtr[2] != ':' || inPtr[5] != ':' || inPtr[8] != ':' ||
         inPtr[11] != ':' || inPtr[14] != ':')
     {
@@ -1631,15 +1770,283 @@ static void hdd_set_thermal_level_cb(hdd_context_t *pHddCtx, u_int8_t level)
    else
       /* restore original concurrency mode */
       hdd_ipa_send_mcc_scc_msg(pHddCtx, pHddCtx->mcc_mode);
-   pHddCtx->thermal_level = level;
 }
 #else
 static void hdd_set_thermal_level_cb(hdd_context_t *pHddCtx, u_int8_t level)
 {
-   pHddCtx->thermal_level = level;
 }
 #endif
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+static bool
+hdd_system_suspend_state(hdd_context_t *hdd_ctx)
+{
+	unsigned long flags;
+	bool s;
+
+	spin_lock_irqsave(&hdd_ctx->thermal_suspend_lock, flags);
+	s = hdd_ctx->system_suspended;
+	spin_unlock_irqrestore(&hdd_ctx->thermal_suspend_lock, flags);
+	return s;
+}
+
+/**
+ * hdd_system_suspend_state_set() - Set the system suspended state
+ * @hdd_ctx: Pointer to hdd_context_t
+ * @state: The target state to be set
+ *
+ * Set the system suspended state
+ *
+ * Return: The state before set.
+ */
+bool
+hdd_system_suspend_state_set(hdd_context_t *hdd_ctx, bool state)
+{
+	unsigned long flags;
+	bool old;
+
+	spin_lock_irqsave(&hdd_ctx->thermal_suspend_lock, flags);
+	old = hdd_ctx->system_suspended;
+	hdd_ctx->system_suspended = state;
+	spin_unlock_irqrestore(&hdd_ctx->thermal_suspend_lock, flags);
+
+	return old;
+}
+
+/**
+ * hdd_thermal_suspend_state() - Get the thermal suspend state
+ * @hdd_ctx: Pointer to hdd_context_t
+ *
+ * Get the thermal suspend state
+ *
+ * Return: The current thermal suspend state
+ */
+int
+hdd_thermal_suspend_state(hdd_context_t *hdd_ctx)
+{
+	unsigned long flags;
+	int s;
+
+	spin_lock_irqsave(&hdd_ctx->thermal_suspend_lock, flags);
+	s = hdd_ctx->thermal_suspend_state;
+	spin_unlock_irqrestore(&hdd_ctx->thermal_suspend_lock, flags);
+
+	return s;
+}
+
+static bool
+hdd_thermal_suspend_transit(hdd_context_t *hdd_ctx, int target, int *old)
+{
+	unsigned long flags;
+	int s;
+	bool ret = false;
+
+	spin_lock_irqsave(&hdd_ctx->thermal_suspend_lock, flags);
+
+	s = hdd_ctx->thermal_suspend_state;
+	if (old)
+		*old = s;
+
+	switch (target) {
+	case HDD_WLAN_THERMAL_ACTIVE:
+		if (s == HDD_WLAN_THERMAL_RESUMING ||
+			s == HDD_WLAN_THERMAL_SUSPENDING)
+			ret = true;
+		break;
+	case HDD_WLAN_THERMAL_SUSPENDING:
+		if (s == HDD_WLAN_THERMAL_ACTIVE)
+			ret = true;
+		break;
+	case HDD_WLAN_THERMAL_SUSPENDED:
+		if (s == HDD_WLAN_THERMAL_SUSPENDING ||
+			s == HDD_WLAN_THERMAL_RESUMING)
+			ret = true;
+		break;
+	case HDD_WLAN_THERMAL_RESUMING:
+		if (s == HDD_WLAN_THERMAL_SUSPENDED)
+			ret = true;
+		break;
+	case HDD_WLAN_THERMAL_DEINIT:
+		if (s != HDD_WLAN_THERMAL_DEINIT)
+			ret = true;
+		break;
+	}
+
+	if (ret)
+		hdd_ctx->thermal_suspend_state = target;
+
+	spin_unlock_irqrestore(&hdd_ctx->thermal_suspend_lock, flags);
+	return ret;
+}
+
+static void
+hdd_thermal_suspend_cleanup(hdd_context_t *hdd_ctx)
+{
+	int state;
+	bool okay;
+
+	if (!hdd_ctx->thermal_suspend_wq)
+		return;
+
+	cancel_delayed_work_sync(&hdd_ctx->thermal_suspend_work);
+	okay = hdd_thermal_suspend_transit(hdd_ctx, HDD_WLAN_THERMAL_DEINIT,
+					   &state);
+	destroy_workqueue(hdd_ctx->thermal_suspend_wq);
+	hdd_ctx->thermal_suspend_wq = NULL;
+
+	if (!okay || state == HDD_WLAN_THERMAL_ACTIVE)
+		return;
+
+	if (state == HDD_WLAN_THERMAL_SUSPENDED) {
+		hdd_prevent_suspend(WIFI_POWER_EVENT_WAKELOCK_THERMAL);
+		__wlan_hdd_cfg80211_resume_wlan(hdd_ctx->wiphy, true);
+		hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_THERMAL);
+	}
+}
+
+static inline void
+hdd_thermal_resume_complete_ind(struct wiphy *wiphy)
+{
+	struct sk_buff *vendor_event;
+
+	hddLog(LOG1, FL("Thermal resume complete indication"));
+
+	vendor_event = cfg80211_vendor_event_alloc(wiphy, NULL, NLMSG_HDRLEN,
+			QCA_NL80211_VENDOR_SUBCMD_RESUME_COMP_EVENT_INDEX,
+			GFP_KERNEL);
+	if (!vendor_event) {
+		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
+		return;
+	}
+
+	cfg80211_vendor_event(vendor_event, GFP_KERNEL);
+}
+
+static void
+hdd_thermal_suspend_work(struct work_struct *work)
+{
+	hdd_context_t *hdd_ctx =
+		container_of(work, hdd_context_t, thermal_suspend_work.work);
+	struct wiphy *wiphy = hdd_ctx->wiphy;
+	int ret;
+
+	while (hdd_system_suspend_state(hdd_ctx)) {
+		hddLog(LOG1, FL("Waiting for system resume complete"));
+		schedule_timeout_interruptible(100 * HZ / 1000);
+	}
+
+	if (hdd_thermal_suspend_transit(hdd_ctx,
+		HDD_WLAN_THERMAL_SUSPENDING, NULL)) {
+		hdd_prevent_suspend(WIFI_POWER_EVENT_WAKELOCK_THERMAL);
+		ret = __wlan_hdd_cfg80211_suspend_wlan(wiphy, NULL, true);
+		hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_THERMAL);
+		if (ret) {
+			hdd_thermal_suspend_transit(hdd_ctx,
+				HDD_WLAN_THERMAL_ACTIVE, NULL);
+			hddLog(LOGE, FL("Thermal suspend failed: %d"), ret);
+			return;
+		}
+		hdd_thermal_suspend_transit(hdd_ctx, HDD_WLAN_THERMAL_SUSPENDED,
+						NULL);
+	} else if (hdd_thermal_suspend_transit(hdd_ctx,
+		   HDD_WLAN_THERMAL_RESUMING, NULL)) {
+		hdd_prevent_suspend(WIFI_POWER_EVENT_WAKELOCK_THERMAL);
+		ret = __wlan_hdd_cfg80211_resume_wlan(wiphy, true);
+		hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_THERMAL);
+		if (ret) {
+			hdd_thermal_suspend_transit(hdd_ctx,
+				HDD_WLAN_THERMAL_SUSPENDED, NULL);
+			hddLog(LOGE, FL("Thermal resume failed: %d"), ret);
+			return;
+		}
+		hdd_thermal_suspend_transit(hdd_ctx, HDD_WLAN_THERMAL_ACTIVE,
+						NULL);
+	} else {
+		hddLog(LOGE, FL("Should not reach here"));
+	}
+}
+
+/**
+ * hdd_thermal_suspend_queue_work() - Queue a thermal suspend work
+ * @hdd_ctx: Pointer to hdd_context_t
+ * @ms: Delay time in milliseconds to execute the work
+ *
+ * Queue thermal suspend work on the workqueue after delay
+ *
+ * Return: false if work was already on a queue, true otherwise.
+ */
+bool
+hdd_thermal_suspend_queue_work(hdd_context_t *hdd_ctx, unsigned long ms)
+{
+	hddLog(LOG1, FL("Queue a thermal suspend work, delay %ld ms"), ms);
+	return queue_delayed_work(hdd_ctx->thermal_suspend_wq,
+		&hdd_ctx->thermal_suspend_work, (ms * HZ) / 1000);
+}
+
+static void
+hdd_thermal_temp_ind_event_cb(hdd_context_t *hdd_ctx, uint32_t degreeC)
+{
+	struct sk_buff *vendor_event;
+
+	vendor_event = cfg80211_vendor_event_alloc(hdd_ctx->wiphy,
+			NULL, sizeof(uint32_t) + NLMSG_HDRLEN,
+			QCA_NL80211_VENDOR_SUBCMD_TEMPERATURE_EVENT_INDEX,
+			GFP_KERNEL);
+	if (!vendor_event) {
+		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
+		return;
+	}
+
+	if (nla_put_u32(vendor_event,
+		QCA_WLAN_VENDOR_ATTR_GET_TEMP_RSP_TEMPERATURE, degreeC)) {
+		hddLog(LOGE, FL("nla put failed"));
+		kfree_skb(vendor_event);
+		return;
+	}
+
+	cfg80211_vendor_event(vendor_event, GFP_KERNEL);
+
+	if (!hdd_ctx->cfg_ini->thermal_shutdown_auto_enabled) {
+		return;
+	}
+
+	/*
+	 * Here, we only do thermal suspend.
+	 *
+	 * We can only resume FW elsewhere in two ways:
+	 * 1. triggered by wakeup interrupt from FW when it detects T < Tresume
+	 * 2. user space app launch thermal resume after suspend as app wants
+	 *
+	 * Key factor: FW cannot provide temperature when it suspended.
+	 */
+	if ((hdd_thermal_suspend_state(hdd_ctx) == HDD_WLAN_THERMAL_ACTIVE &&
+		degreeC >= hdd_ctx->cfg_ini->thermal_suspend_threshold) ||
+		(hdd_thermal_suspend_state(hdd_ctx) == HDD_WLAN_THERMAL_SUSPENDED &&
+		degreeC < hdd_ctx->cfg_ini->thermal_resume_threshold)) {
+		hdd_thermal_suspend_queue_work(hdd_ctx, 0);
+	}
+}
+#else
+bool
+hdd_system_suspend_state_set(hdd_context_t *hdd_ctx, bool state)
+{
+	return TRUE;
+}
+
+static inline void
+hdd_thermal_suspend_cleanup(hdd_context_t *hdd_ctx)
+{
+	return;
+}
+
+static inline void
+hdd_thermal_temp_ind_event_cb(hdd_context_t *hdd_ctx, uint32_t degreeC)
+{
+	return;
+}
+
+#endif
+
 /**---------------------------------------------------------------------------
 
   \brief hdd_setIbssPowerSaveParams - update IBSS Power Save params to WMA.
@@ -1956,18 +2363,25 @@ hdd_parse_reassoc_v1(hdd_adapter_t *pAdapter, const char *command)
   \param - pAdapter - Adapter upon which the command was received
   \param - command - command that was received, ASCII command followed
                      by binary data
+  \param - total_len - total length of the command received
 
   \return - 0 for success non-zero for failure
 
   --------------------------------------------------------------------------*/
 static int
 hdd_parse_reassoc_v2(hdd_adapter_t *pAdapter,
-                     const char *command)
+                     const char *command,
+                     int total_len)
 {
    struct android_wifi_reassoc_params params;
    tSirMacAddr bssid;
    int ret;
 
+   if (total_len < sizeof(params) + 8) {
+      hddLog(LOGE, FL("Invalid command length"));
+      return -EINVAL;
+   }
+
    /* The params are located after "REASSOC " */
    memcpy(&params, command + 8, sizeof(params));
 
@@ -1992,12 +2406,13 @@ hdd_parse_reassoc_v2(hdd_adapter_t *pAdapter,
 
   \param - pAdapter - Adapter upon which the command was received
   \param - command - command that was received
+  \param - total_len - total length of the command received
 
   \return - 0 for success non-zero for failure
 
   --------------------------------------------------------------------------*/
 static int
-hdd_parse_reassoc(hdd_adapter_t *pAdapter, const char *command)
+hdd_parse_reassoc(hdd_adapter_t *pAdapter, const char *command, int total_len)
 {
    int ret;
 
@@ -2014,10 +2429,16 @@ hdd_parse_reassoc(hdd_adapter_t *pAdapter, const char *command)
     *           1111111111222222
     * 01234567890123456789012345
     */
+
+   if (total_len < 26) {
+      hddLog(LOGE, FL("Invalid command (total_len=%d)"), total_len);
+      return -EINVAL;
+   }
+
    if (command[25]) {
       ret = hdd_parse_reassoc_v1(pAdapter, command);
    } else {
-      ret = hdd_parse_reassoc_v2(pAdapter, command);
+      ret = hdd_parse_reassoc_v2(pAdapter, command, total_len);
    }
 
    return ret;
@@ -2387,13 +2808,20 @@ hdd_parse_sendactionframe_v2(hdd_adapter_t *pAdapter,
 	struct android_wifi_af_params *params;
 	tSirMacAddr bssid;
 	int ret;
+	int len_wo_payload = 0;
 
 	/* The params are located after "SENDACTIONFRAME " */
 	total_len -= 16;
+	len_wo_payload = sizeof(*params) - ANDROID_WIFI_ACTION_FRAME_SIZE;
+	if (total_len <= len_wo_payload) {
+		hddLog(LOGE, FL("Invalid command len"));
+		return -EINVAL;
+	}
+
 	params = (struct android_wifi_af_params *)(command + 16);
 
 	if (params->len <= 0 || params->len > ANDROID_WIFI_ACTION_FRAME_SIZE ||
-            (params->len > total_len)) {
+            (params->len > (total_len - len_wo_payload))) {
 		hddLog(LOGE, FL("Invalid payload length: %d"), params->len);
 		return -EINVAL;
 	}
@@ -3475,6 +3903,14 @@ static int hdd_get_dwell_time(hdd_config_t *pCfg, tANI_U8 *command, char *extra,
     return ret;
 }
 
+int hdd_drv_cmd_validate(tANI_U8 *command, int len)
+{
+	if (command[len] != ' ')
+		return -EINVAL;
+
+	return 0;
+}
+
 static int hdd_set_dwell_time(hdd_adapter_t *pAdapter, tANI_U8 *command)
 {
     tHalHandle hHal;
@@ -3497,6 +3933,9 @@ static int hdd_set_dwell_time(hdd_adapter_t *pAdapter, tANI_U8 *command)
 
     if (strncmp(command, "SETDWELLTIME ACTIVE MAX", 23) == 0 )
     {
+        if (hdd_drv_cmd_validate(command, 23))
+            return -EINVAL;
+
         value = value + 24;
         temp = kstrtou32(value, 10, &val);
         if (temp != 0 || val < CFG_ACTIVE_MAX_CHANNEL_TIME_MIN ||
@@ -3513,6 +3952,9 @@ static int hdd_set_dwell_time(hdd_adapter_t *pAdapter, tANI_U8 *command)
     }
     else if (strncmp(command, "SETDWELLTIME ACTIVE MIN", 23) == 0)
     {
+        if (hdd_drv_cmd_validate(command, 23))
+            return -EINVAL;
+
         value = value + 24;
         temp = kstrtou32(value, 10, &val);
         if (temp !=0 || val < CFG_ACTIVE_MIN_CHANNEL_TIME_MIN  ||
@@ -3529,6 +3971,9 @@ static int hdd_set_dwell_time(hdd_adapter_t *pAdapter, tANI_U8 *command)
     }
     else if (strncmp(command, "SETDWELLTIME PASSIVE MAX", 24) == 0)
     {
+        if (hdd_drv_cmd_validate(command, 24))
+            return -EINVAL;
+
         value = value + 25;
         temp = kstrtou32(value, 10, &val);
         if (temp != 0 || val < CFG_PASSIVE_MAX_CHANNEL_TIME_MIN ||
@@ -3545,6 +3990,9 @@ static int hdd_set_dwell_time(hdd_adapter_t *pAdapter, tANI_U8 *command)
     }
     else if (strncmp(command, "SETDWELLTIME PASSIVE MIN", 24) == 0)
     {
+        if (hdd_drv_cmd_validate(command, 24))
+            return -EINVAL;
+
         value = value + 25;
         temp = kstrtou32(value, 10, &val);
         if (temp != 0 || val < CFG_PASSIVE_MIN_CHANNEL_TIME_MIN ||
@@ -3561,6 +4009,9 @@ static int hdd_set_dwell_time(hdd_adapter_t *pAdapter, tANI_U8 *command)
     }
     else if (strncmp(command, "SETDWELLTIME", 12) == 0)
     {
+        if (hdd_drv_cmd_validate(command, 12))
+            return -EINVAL;
+
         value = value + 13;
         temp = kstrtou32(value, 10, &val);
         if (temp != 0 || val < CFG_ACTIVE_MAX_CHANNEL_TIME_MIN ||
@@ -3642,7 +4093,7 @@ static void hdd_GetLink_statusCB(v_U8_t status, void *pContext)
    hdd_adapter_t *pAdapter;
 
    if (NULL == pContext) {
-      hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Bad pContext [%p]",
+      hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Bad pContext [%pK]",
               __func__, pContext);
       return;
    }
@@ -3656,7 +4107,7 @@ static void hdd_GetLink_statusCB(v_U8_t status, void *pContext)
       /* the caller presumably timed out so there is nothing we can do */
       spin_unlock(&hdd_context_lock);
       hddLog(VOS_TRACE_LEVEL_WARN,
-             "%s: Invalid context, pAdapter [%p] magic [%08x]",
+             "%s: Invalid context, pAdapter [%pK] magic [%08x]",
               __func__, pAdapter, pLinkContext->magic);
       return;
    }
@@ -3688,7 +4139,7 @@ static void hdd_get_fw_state_cb(void *callback_context)
 	hdd_adapter_t *adapter;
 
 	if (NULL == callback_context) {
-		hddLog(LOGE, FL("Bad pContext [%p]"), callback_context);
+		hddLog(LOGE, FL("Bad pContext [%pK]"), callback_context);
 		return;
 	}
 
@@ -3702,7 +4153,7 @@ static void hdd_get_fw_state_cb(void *callback_context)
 		 * nothing we can do
 		 */
 		spin_unlock(&hdd_context_lock);
-		hddLog(LOGE, FL("Invalid context, Adapter [%p] magic [%08x]"),
+		hddLog(LOGE, FL("Invalid context, Adapter [%pK] magic [%08x]"),
 			adapter, context->magic);
 		return;
 	}
@@ -4307,7 +4758,7 @@ static void hdd_GetTsmStatsCB( tAniTrafStrmMetrics tsmMetrics,
 
    if (NULL == pContext) {
       hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Bad param, pContext [%p]",
+             "%s: Bad param, pContext [%pK]",
              __func__, pContext);
       return;
    }
@@ -4324,7 +4775,7 @@ static void hdd_GetTsmStatsCB( tAniTrafStrmMetrics tsmMetrics,
       /* the caller presumably timed out so there is nothing we can do */
       spin_unlock(&hdd_context_lock);
       hddLog(VOS_TRACE_LEVEL_WARN,
-             "%s: Invalid context, pAdapter [%p] magic [%08x]",
+             "%s: Invalid context, pAdapter [%pK] magic [%08x]",
               __func__, pAdapter, pStatsContext->magic);
       return;
    }
@@ -4570,6 +5021,11 @@ static int hdd_set_rx_filter(hdd_adapter_t *adapter, bool action,
 		return -EINVAL;
 	}
 
+	if (!hdd_ctx->cfg_ini->fEnableMCAddrList) {
+		hddLog(VOS_TRACE_LEVEL_ERROR, FL("mc addr ini is disabled"));
+		return -EINVAL;
+	}
+
 	/*
 	 * If action is false it means start dropping packets
 	 * Set addr_filter_pattern which will be used when sending
@@ -4605,6 +5061,8 @@ static int hdd_set_rx_filter(hdd_adapter_t *adapter, bool action,
 				    MAC_ADDR_ARRAY(filter->multicastAddr[j]));
 				j++;
 			}
+			if (j == SIR_MAX_NUM_MULTICAST_ADDRESS)
+				break;
 		}
 		filter->ulMulticastAddrCnt = j;
 		/* Set rx filter */
@@ -5314,7 +5772,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        else if (strncmp(command, "SETBAND", 7) == 0)
        {
            tANI_U8 *ptr = command ;
-           int ret = 0 ;
+
+           if (hdd_drv_cmd_validate(command, 7))
+               goto exit;
 
            /* Change band request received */
 
@@ -5329,6 +5789,10 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        else if (strncmp(command, "SETWMMPS", 8) == 0)
        {
            tANI_U8 *ptr = command;
+
+           if (hdd_drv_cmd_validate(command, 8))
+               goto exit;
+
            ret = hdd_wmmps_helper(pAdapter, ptr);
        }
        else if (strncasecmp(command, "COUNTRY", 7) == 0)
@@ -5337,6 +5801,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            unsigned long rc;
            char *country_code;
 
+           if (hdd_drv_cmd_validate(command, 7))
+               goto exit;
+
            country_code = command + 8;
 
            INIT_COMPLETION(pAdapter->change_country_code);
@@ -5380,6 +5847,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 lookUpThreshold = CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_DEFAULT;
            eHalStatus status = eHAL_STATUS_SUCCESS;
 
+           if (hdd_drv_cmd_validate(command, 14))
+               goto exit;
+
            /* Move pointer to ahead of SETROAMTRIGGER<delimiter> */
            value = value + 15;
 
@@ -5463,6 +5933,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 roamScanPeriod = 0;
            tANI_U16 neighborEmptyScanRefreshPeriod = CFG_EMPTY_SCAN_REFRESH_PERIOD_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 17))
+               goto exit;
+
            /* input refresh period is in terms of seconds */
            /* Move pointer to ahead of SETROAMSCANPERIOD<delimiter> */
            value = value + 18;
@@ -5533,6 +6006,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 roamScanRefreshPeriod = 0;
            tANI_U16 neighborScanRefreshPeriod = CFG_NEIGHBOR_SCAN_RESULTS_REFRESH_PERIOD_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 24))
+               goto exit;
+
            /* input refresh period is in terms of seconds */
            /* Move pointer to ahead of SETROAMSCANREFRESHPERIOD<delimiter> */
            value = value + 25;
@@ -5598,11 +6074,14 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
 	   tANI_BOOLEAN roamMode = CFG_LFR_FEATURE_ENABLED_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, SIZE_OF_SETROAMMODE))
+               goto exit;
+
 	   /* Move pointer to ahead of SETROAMMODE<delimiter> */
 	   value = value + SIZE_OF_SETROAMMODE + 1;
 
 	   /* Convert the value from ascii to integer */
-	   ret = kstrtou8(value, SIZE_OF_SETROAMMODE, &roamMode);
+	   ret = kstrtou8(value, 10, &roamMode);
 	   if (ret < 0)
 	   {
 	      /* If the input value is greater than max value of datatype, then also
@@ -5696,6 +6175,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 roamRssiDiff = CFG_ROAM_RSSI_DIFF_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 12))
+               goto exit;
+
            /* Move pointer to ahead of SETROAMDELTA<delimiter> */
            value = value + 13;
            /* Convert the value from ascii to integer */
@@ -5773,6 +6255,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        }
        else if (strncmp(command, "SETROAMSCANCHANNELS ", 20) == 0)
        {
+           if (hdd_drv_cmd_validate(command, 20))
+               goto exit;
+
            ret = hdd_parse_set_roam_scan_channels(pAdapter, command);
        }
        else if (strncmp(command, "GETROAMSCANCHANNELS", 19) == 0)
@@ -5801,7 +6286,7 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            [Number of roam scan channels][Channel1][Channel2]... */
            /* copy the number of channels in the 0th index */
            len = scnprintf(extra, sizeof(extra), "%s %d", command, numChannels);
-           for (j = 0; (j < numChannels); j++)
+           for (j = 0; (j < numChannels) && len <= sizeof(extra); j++)
            {
                len += scnprintf(extra + len, sizeof(extra) - len, " %d",
                        ChannelList[j]);
@@ -5910,6 +6395,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 minTime = CFG_NEIGHBOR_SCAN_MIN_CHAN_TIME_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 25))
+               goto exit;
+
            /* Move pointer to ahead of SETROAMSCANCHANNELMINTIME<delimiter> */
            value = value + 26;
            /* Convert the value from ascii to integer */
@@ -5949,6 +6437,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        }
        else if (strncmp(command, "SENDACTIONFRAME", 15) == 0)
        {
+           if (hdd_drv_cmd_validate(command, 15))
+               goto exit;
+
            ret = hdd_parse_sendactionframe(pAdapter, command,
                                            priv_data.total_len);
        }
@@ -5979,6 +6470,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U16 maxTime = CFG_NEIGHBOR_SCAN_MAX_CHAN_TIME_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 18))
+               goto exit;
+
            /* Move pointer to ahead of SETSCANCHANNELTIME<delimiter> */
            value = value + 19;
            /* Convert the value from ascii to integer */
@@ -6037,6 +6531,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U16 val = CFG_NEIGHBOR_SCAN_TIMER_PERIOD_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 15))
+               goto exit;
+
            /* Move pointer to ahead of SETSCANHOMETIME<delimiter> */
            value = value + 16;
            /* Convert the value from ascii to integer */
@@ -6095,6 +6592,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 val = CFG_ROAM_INTRA_BAND_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 16))
+               goto exit;
+
            /* Move pointer to ahead of SETROAMINTRABAND<delimiter> */
            value = value + 17;
            /* Convert the value from ascii to integer */
@@ -6150,6 +6650,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 nProbes = CFG_ROAM_SCAN_N_PROBES_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 14))
+               goto exit;
+
            /* Move pointer to ahead of SETSCANNPROBES<delimiter> */
            value = value + 15;
            /* Convert the value from ascii to integer */
@@ -6205,6 +6708,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U16 homeAwayTime = CFG_ROAM_SCAN_HOME_AWAY_TIME_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 19))
+               goto exit;
+
            /* Move pointer to ahead of SETSCANHOMEAWAYTIME<delimiter> */
            /* input value is in units of msec */
            value = value + 20;
@@ -6261,13 +6767,19 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        }
        else if (strncmp(command, "REASSOC", 7) == 0)
        {
-           ret = hdd_parse_reassoc(pAdapter, command);
+           if (hdd_drv_cmd_validate(command, 7))
+               goto exit;
+
+           ret = hdd_parse_reassoc(pAdapter, command, priv_data.total_len);
        }
        else if (strncmp(command, "SETWESMODE", 10) == 0)
        {
            tANI_U8 *value = command;
            tANI_BOOLEAN wesMode = CFG_ENABLE_WES_MODE_NAME_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 10))
+               goto exit;
+
            /* Move pointer to ahead of SETWESMODE<delimiter> */
            value = value + 11;
            /* Convert the value from ascii to integer */
@@ -6321,6 +6833,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 nOpportunisticThresholdDiff = CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 24))
+               goto exit;
+
            /* Move pointer to ahead of SETOPPORTUNISTICRSSIDIFF<delimiter> */
            value = value + 25;
            /* Convert the value from ascii to integer */
@@ -6365,6 +6880,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 nRoamRescanRssiDiff = CFG_ROAM_RESCAN_RSSI_DIFF_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 21))
+               goto exit;
+
            /* Move pointer to ahead of SETROAMRESCANRSSIDIFF<delimiter> */
            value = value + 22;
            /* Convert the value from ascii to integer */
@@ -6409,6 +6927,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 lfrMode = CFG_LFR_FEATURE_ENABLED_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 11))
+               goto exit;
+
            /* Move pointer to ahead of SETFASTROAM<delimiter> */
            value = value + 12;
            /* Convert the value from ascii to integer */
@@ -6452,6 +6973,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 ft = CFG_FAST_TRANSITION_ENABLED_NAME_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 17))
+               goto exit;
+
            /* Move pointer to ahead of SETFASTROAM<delimiter> */
            value = value + 18;
            /* Convert the value from ascii to integer */
@@ -6596,6 +7120,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 eseMode = CFG_ESE_FEATURE_ENABLED_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 10))
+               goto exit;
+
            /* Check if the features OKC/ESE/11R are supported simultaneously,
               then this operation is not permitted (return FAILURE) */
            if (sme_getIsEseFeatureEnabled(pHddCtx->hHal) &&
@@ -6648,6 +7175,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_BOOLEAN roamScanControl = 0;
 
+           if (hdd_drv_cmd_validate(command, 18))
+               goto exit;
+
            /* Move pointer to ahead of SETROAMSCANCONTROL<delimiter> */
            value = value + 19;
            /* Convert the value from ascii to integer */
@@ -6680,6 +7210,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 okcMode = CFG_OKC_FEATURE_ENABLED_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 10))
+               goto exit;
+
            /* Check if the features OKC/ESE/11R are supported simultaneously,
               then this operation is not permitted (return FAILURE) */
            if (sme_getIsEseFeatureEnabled(pHddCtx->hHal) &&
@@ -6731,6 +7264,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            char *bcMode;
            int ret;
 
+           if (hdd_drv_cmd_validate(command, 10))
+               goto exit;
+
            bcMode = command + 11;
            if ('1' == *bcMode)
            {
@@ -6773,6 +7309,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 filterType = 0;
            tANI_U8 *value = command;
 
+           if (hdd_drv_cmd_validate(command, 21))
+               goto exit;
+
            /* Move pointer to ahead of ENABLE_PKTFILTER_IPV6<delimiter> */
            value = value + 22;
 
@@ -6803,6 +7342,10 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        else if (strncmp(command, "BTCOEXMODE", 10) == 0 )
        {
            char *bcMode;
+
+           if (hdd_drv_cmd_validate(command, 10))
+               goto exit;
+
            bcMode = command + 11;
            if ('1' == *bcMode)
            {
@@ -6856,6 +7399,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                    "%s: Received MIRACAST command", __func__);
 
+           if (hdd_drv_cmd_validate(command, 8))
+               goto exit;
+
            ret = hdd_set_miracast_mode(pAdapter, command);
        }
        else if ((strncasecmp(command, "SETIBSSBEACONOUIDATA", 20) == 0) &&
@@ -6885,6 +7431,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
                goto exit;
            }
 
+           if (hdd_drv_cmd_validate(command, 20))
+               goto exit;
+
            /* moving to arguments of commands */
            value = value + 21;
            command_len = strlen(value);
@@ -7154,9 +7703,10 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
                ret = -EFAULT;
                goto exit;
             }
-            priv_data.buf[numOfBytestoPrint] = '\0';
+            /* This overwrites the last space, which we already copied */
+            extra[numOfBytestoPrint - 1] = '\0';
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_MED,
-                      "%s", priv_data.buf);
+                      "%s", extra);
 
             if (length > numOfBytestoPrint)
             {
@@ -7170,7 +7720,7 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
                     goto exit;
                 }
                 VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_MED,
-                          "%s", &priv_data.buf[numOfBytestoPrint]);
+                          "%s", &extra[numOfBytestoPrint]);
             }
 
             /* Free temporary buffer */
@@ -7433,6 +7983,10 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8             tid = 0;
            hdd_station_ctx_t  *pHddStaCtx = NULL;
            tAniTrafStrmMetrics tsmMetrics;
+
+           if (hdd_drv_cmd_validate(command, 11))
+               goto exit;
+
            pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
            /* if not associated, return error */
            if (eConnectionState_Associated != pHddStaCtx->conn_info.connState)
@@ -7614,6 +8168,10 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        {
            tANI_U8 *value = command;
            int      targetRate;
+
+           if (hdd_drv_cmd_validate(command, 9))
+               goto exit;
+
            /* Move pointer to ahead of SETMCRATE<delimiter> */
            /* input value is in units of hundred kbps */
            value = value + 10;
@@ -7676,6 +8234,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            tANI_U8 dfsScanMode = CFG_ROAMING_DFS_CHANNEL_DEFAULT;
 
+           if (hdd_drv_cmd_validate(command, 14))
+               goto exit;
+
            /* Move pointer to ahead of SETDFSSCANMODE<delimiter> */
            value = value + 15;
            /* Convert the value from ascii to integer */
@@ -7760,6 +8321,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
            tANI_U8 *value = command;
            int set_value;
 
+           if (hdd_drv_cmd_validate(command, 12))
+               goto exit;
+
            /* Move pointer to ahead of ENABLEEXTWOW*/
            value += 12;
            if (!(sscanf(value, "%d", &set_value))) {
@@ -7774,6 +8338,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        } else if (strncmp(command, "SETAPP1PARAMS", 13) == 0) {
            tANI_U8 *value = command;
 
+           if (hdd_drv_cmd_validate(command, 13))
+               goto exit;
+
            /* Move pointer to ahead of SETAPP1PARAMS*/
            value += 13;
            ret = hdd_set_app_type1_parser(pAdapter,
@@ -7784,6 +8351,9 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        } else if (strncmp(command, "SETAPP2PARAMS", 13) == 0) {
            tANI_U8 *value = command;
 
+           if (hdd_drv_cmd_validate(command, 13))
+               goto exit;
+
            /* Move pointer to ahead of SETAPP2PARAMS*/
            value += 13;
            ret = hdd_set_app_type2_parser(pAdapter,
@@ -7796,6 +8366,10 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        else if (strncmp(command, "TDLSSECONDARYCHANNELOFFSET", 26) == 0) {
            tANI_U8 *value = command;
            int set_value;
+
+           if (hdd_drv_cmd_validate(command, 26))
+               goto exit;
+
            /* Move pointer to point the string */
            value += 26;
            if (!(sscanf(value, "%d", &set_value))) {
@@ -7811,6 +8385,10 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        } else if (strncmp(command, "TDLSOFFCHANNELMODE", 18) == 0) {
            tANI_U8 *value = command;
            int set_value;
+
+           if (hdd_drv_cmd_validate(command, 18))
+               goto exit;
+
            /* Move pointer to point the string */
            value += 18;
            if (!(sscanf(value, "%d", &set_value))) {
@@ -7826,6 +8404,10 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        } else if (strncmp(command, "TDLSOFFCHANNEL", 14) == 0) {
            tANI_U8 *value = command;
            int set_value;
+
+           if (hdd_drv_cmd_validate(command, 14))
+               goto exit;
+
            /* Move pointer to point the string */
            value += 14;
            ret = sscanf(value, "%d", &set_value);
@@ -7849,6 +8431,10 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
        } else if (strncmp(command, "TDLSSCAN", 8) == 0) {
            uint8_t *value = command;
            int set_value;
+
+           if (hdd_drv_cmd_validate(command, 8))
+               goto exit;
+
            /* Move pointer to point the string */
            value += 8;
            ret = sscanf(value, "%d", &set_value);
@@ -7904,14 +8490,23 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
             * country code is set
             */
 
+           if (hdd_drv_cmd_validate(command, 15))
+               goto exit;
+
            ret = drv_cmd_set_fcc_channel(pAdapter, command, 15);
 
        } else if (strncmp(command, "RXFILTER-REMOVE", 15) == 0) {
 
+           if (hdd_drv_cmd_validate(command, 15))
+               goto exit;
+
            ret = hdd_driver_rxfilter_comand_handler(command, pAdapter, false);
 
        } else if (strncmp(command, "RXFILTER-ADD", 12) == 0) {
 
+           if (hdd_drv_cmd_validate(command, 12))
+               goto exit;
+
            ret = hdd_driver_rxfilter_comand_handler(command, pAdapter, true);
 
        } else if (strncasecmp(command, "SETANTENNAMODE", 14) == 0) {
@@ -7921,8 +8516,6 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter,
 
            ret = drv_cmd_get_antenna_mode(pAdapter, pHddCtx, command,
                                           14, &priv_data);
-           hddLog(LOG1, FL("Get antenna mode ret: %d mode: %s"),
-                  ret, priv_data.buf);
        } else if (strncmp(command, "STOP", 4) == 0) {
           hddLog(LOG1, FL("STOP command"));
           pHddCtx->driver_being_stopped = true;
@@ -8045,7 +8638,11 @@ static int __hdd_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 
    switch (cmd) {
    case (SIOCDEVPRIVATE + 1):
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,6,0)) && defined(CONFIG_X86_64)
+      if (in_compat_syscall())
+#else
       if (is_compat_task())
+#endif
          ret = hdd_driver_compat_ioctl(pAdapter, ifr);
       else
          ret = hdd_driver_ioctl(pAdapter, ifr);
@@ -8156,7 +8753,7 @@ static void hdd_update_tgt_services(hdd_context_t *hdd_ctx,
     cfg_ini->fEnableTDLSSupport &= cfg->en_tdls;
     cfg_ini->fEnableTDLSOffChannel = cfg_ini->fEnableTDLSOffChannel &&
                                      cfg->en_tdls_offchan;
-    cfg_ini->fEnableTDLSBufferSta = cfg_ini->fEnableTDLSOffChannel &&
+    cfg_ini->fEnableTDLSBufferSta = cfg_ini->fEnableTDLSBufferSta &&
                                     cfg->en_tdls_uapsd_buf_sta;
     if (cfg_ini->fTDLSUapsdMask && cfg->en_tdls_uapsd_sleep_sta)
     {
@@ -8175,6 +8772,7 @@ static void hdd_update_tgt_services(hdd_context_t *hdd_ctx,
 #ifdef SAP_AUTH_OFFLOAD
     cfg_ini->enable_sap_auth_offload &= cfg->sap_auth_offload_service;
 #endif
+    cfg_ini->sap_get_peer_info &= cfg->get_peer_info_enabled;
 }
 
 /**
@@ -8192,66 +8790,83 @@ static void hdd_update_chain_mask_vdev_nss(hdd_context_t *hdd_ctx,
 		struct hdd_tgt_services *cfg)
 {
 	hdd_config_t *cfg_ini = hdd_ctx->cfg_ini;
-	uint8_t chain_mask, ret;
+	uint8_t chain_mask_rx, chain_mask_tx, ret;
 	uint8_t max_supp_nss = 1;
 
 	cfg_ini->enable2x2 = 0;
-	chain_mask = cfg->chain_mask_2g & cfg_ini->chain_mask_2g;
-	if (!chain_mask)
-		chain_mask = cfg->chain_mask_2g;
-	hddLog(VOS_TRACE_LEVEL_INFO,
-			"%s: set 2G chain mask value %d",
-			__func__, chain_mask);
+	chain_mask_rx = cfg->chain_mask_2g & cfg_ini->chain_mask_2g_rx;
+	chain_mask_tx = cfg->chain_mask_2g & cfg_ini->chain_mask_2g_tx;
+	if (!chain_mask_rx)
+		chain_mask_rx = cfg->chain_mask_2g;
+	if (!chain_mask_tx)
+		chain_mask_tx = chain_mask_rx;
+	hddLog(LOG1,
+		FL("set 2G chain mask rx %d tx %d"),
+		chain_mask_rx, chain_mask_tx);
 	ret = process_wma_set_command(0, WMI_PDEV_PARAM_RX_CHAIN_MASK_2G,
-			chain_mask, PDEV_CMD);
+			chain_mask_rx, PDEV_CMD);
 	if (0 != ret) {
 		hddLog(VOS_TRACE_LEVEL_ERROR,
 			"%s: set WMI_PDEV_PARAM_RX_CHAIN_MASK_2G failed %d",
 			__func__, ret);
 	}
 	ret = process_wma_set_command(0, WMI_PDEV_PARAM_TX_CHAIN_MASK_2G,
-			chain_mask, PDEV_CMD);
+			chain_mask_tx, PDEV_CMD);
 	if (0 != ret) {
 		hddLog(VOS_TRACE_LEVEL_ERROR,
 			"%s: WMI_PDEV_PARAM_TX_CHAIN_MASK_2G set failed %d",
 			__func__, ret);
 	}
-	max_supp_nss += ((chain_mask & 0x3) == 0x3);
+	if (((chain_mask_rx & 0x3) == 0x3) ||
+		((chain_mask_tx & 0x3) == 0x3))
+		max_supp_nss++;
 
 	if (max_supp_nss == 2)
 		cfg_ini->enable2x2 = 1;
 	sme_update_vdev_type_nss(hdd_ctx->hHal, max_supp_nss,
 			cfg_ini->vdev_type_nss_2g, eCSR_BAND_24);
-	hdd_ctx->supp_2g_chain_mask = chain_mask;
+
+	if (chain_mask_rx >= chain_mask_tx)
+		hdd_ctx->supp_2g_chain_mask = chain_mask_rx;
+	else
+		hdd_ctx->supp_2g_chain_mask = chain_mask_tx;
 
 	max_supp_nss = 1;
-	chain_mask = cfg->chain_mask_5g & cfg_ini->chain_mask_5g;
-	if (!chain_mask)
-		chain_mask = cfg->chain_mask_5g;
-	hddLog(VOS_TRACE_LEVEL_INFO,
-			"%s: set 5G chain mask value %d",
-			__func__, chain_mask);
+	chain_mask_rx = cfg->chain_mask_5g & cfg_ini->chain_mask_5g_rx;
+	chain_mask_tx = cfg->chain_mask_5g & cfg_ini->chain_mask_5g_tx;
+	if (!chain_mask_rx)
+		chain_mask_rx = cfg->chain_mask_5g;
+	if (!chain_mask_tx)
+		chain_mask_tx = chain_mask_rx;
+	hddLog(LOG1,
+		FL("set 5G chain mask rx %d tx %d"),
+		chain_mask_rx, chain_mask_tx);
 	ret = process_wma_set_command(0, WMI_PDEV_PARAM_RX_CHAIN_MASK_5G,
-			chain_mask, PDEV_CMD);
+			chain_mask_rx, PDEV_CMD);
 	if (0 != ret) {
 		hddLog(VOS_TRACE_LEVEL_ERROR,
 			"%s: set WMI_PDEV_PARAM_RX_CHAIN_MASK_5G failed %d",
 			__func__, ret);
 	}
 	ret = process_wma_set_command(0, WMI_PDEV_PARAM_TX_CHAIN_MASK_5G,
-			chain_mask, PDEV_CMD);
+			chain_mask_tx, PDEV_CMD);
 	if (0 != ret) {
 		hddLog(VOS_TRACE_LEVEL_ERROR,
 			"%s: WMI_PDEV_PARAM_TX_CHAIN_MASK_5G set failed %d",
 			__func__, ret);
 	}
-	max_supp_nss += ((chain_mask & 0x3) == 0x3);
+	if (((chain_mask_rx & 0x3) == 0x3) ||
+		((chain_mask_tx & 0x3) == 0x3))
+		max_supp_nss++;
 
 	if (max_supp_nss == 2)
 		cfg_ini->enable2x2 = 1;
 	sme_update_vdev_type_nss(hdd_ctx->hHal, max_supp_nss,
 			cfg_ini->vdev_type_nss_5g, eCSR_BAND_5G);
-	hdd_ctx->supp_5g_chain_mask = chain_mask;
+	if (chain_mask_rx >= chain_mask_tx)
+		hdd_ctx->supp_5g_chain_mask = chain_mask_rx;
+	else
+		hdd_ctx->supp_5g_chain_mask = chain_mask_tx;
 	hddLog(LOG1, FL("Supported chain mask 2G: %d 5G: %d"),
 	       hdd_ctx->supp_2g_chain_mask,
 	       hdd_ctx->supp_5g_chain_mask);
@@ -8694,11 +9309,15 @@ static void hdd_update_tgt_vht_cap(hdd_context_t *hdd_ctx,
         value = 0;
     }
 
+    /* check and update MU BEAMFORMEE capability*/
+    if (pconfig->enableMuBformee && !cfg->vht_mu_bformee)
+        pconfig->enableMuBformee = cfg->vht_mu_bformee;
+
     /* set VHT MU Beamformee cap */
     if (value && !cfg->vht_mu_bformee) {
         status = ccmCfgSetInt(hdd_ctx->hHal,
                               WNI_CFG_VHT_MU_BEAMFORMEE_CAP,
-                              cfg->vht_mu_bformee, NULL,
+                              pconfig->enableMuBformee, NULL,
                               eANI_BOOLEAN_FALSE);
 
         if (status == eHAL_STATUS_FAILURE) {
@@ -8762,15 +9381,47 @@ static void hdd_update_tgt_vht_cap(hdd_context_t *hdd_ctx,
                       __func__);
         }
     }
+
+    hddLog(LOG1, "enable2x2 %d ", pconfig->enable2x2);
+    if (pconfig->enable2x2)
+    {
+        if (ccmCfgSetInt(hdd_ctx->hHal,
+                         WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS,
+                         NUM_OF_SOUNDING_DIMENSIONS, NULL,
+                         eANI_BOOLEAN_FALSE) == eHAL_STATUS_FAILURE) {
+            hddLog(LOGE,
+                   "Could not set WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS to CCM");
+        }
+    }
 }
 #endif  /* #ifdef WLAN_FEATURE_11AC */
 
+#ifdef FEATURE_WLAN_RA_FILTERING
+static void hdd_update_ra_rate_limit(hdd_context_t *hdd_ctx,
+				     struct hdd_tgt_cfg *cfg)
+{
+    hdd_ctx->cfg_ini->IsRArateLimitEnabled = cfg->is_ra_rate_limit_enabled;
+}
+#else
+static void hdd_update_ra_rate_limit(hdd_context_t *hdd_ctx,
+				     struct hdd_tgt_cfg *cfg)
+{
+}
+#endif
+
 void hdd_update_tgt_cfg(void *context, void *param)
 {
     hdd_context_t *hdd_ctx = (hdd_context_t *)context;
     struct hdd_tgt_cfg *cfg = (struct hdd_tgt_cfg *)param;
     tANI_U8 temp_band_cap;
 
+    if (hdd_cfg_is_sub20_channel_width_enabled(hdd_ctx) &&
+        cfg->sub_20_support == 0) {
+            hddLog(VOS_TRACE_LEVEL_WARN,
+                   FL("requests 5/10M, target not support"));
+            hdd_ctx->cfg_ini->sub_20_channel_width = 0;
+    }
+
     /* first store the INI band capability */
     temp_band_cap = hdd_ctx->cfg_ini->nBandCapability;
 
@@ -8839,7 +9490,12 @@ void hdd_update_tgt_cfg(void *context, void *param)
     hdd_ctx->fine_time_meas_cap_target = cfg->fine_time_measurement_cap;
     hddLog(LOG1, FL("fine_time_measurement_cap: 0x%x"),
              hdd_ctx->cfg_ini->fine_time_meas_cap);
-    hdd_ctx->bpf_enabled = cfg->bpf_enabled;
+
+    hddLog(LOG1, FL("Target BPF %d Host BPF %d"),
+             cfg->bpf_enabled, hdd_ctx->cfg_ini->bpf_packet_filter_enable);
+    hdd_ctx->bpf_enabled = (cfg->bpf_enabled &&
+                            hdd_ctx->cfg_ini->bpf_packet_filter_enable);
+    hdd_update_ra_rate_limit(hdd_ctx, cfg);
 
     /*
      * If BPF is enabled, maxWowFilters set to WMA_STA_WOW_DEFAULT_PTRN_MAX
@@ -8856,6 +9512,30 @@ void hdd_update_tgt_cfg(void *context, void *param)
     hdd_ctx->max_mc_addr_list = cfg->max_mc_addr_list;
 }
 
+void hdd_update_dfs_cac_block_tx_flag(void *context, bool cac_block_tx)
+{
+	hdd_context_t *hdd_ctx = (hdd_context_t *)context;
+	hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
+	hdd_adapter_t *adapter;
+	VOS_STATUS status;
+
+	if (wlan_hdd_validate_context(hdd_ctx))
+		return;
+	if (hdd_ctx->cfg_ini->disableDFSChSwitch)
+		return;
+	status = hdd_get_front_adapter(hdd_ctx, &adapter_node);
+	while (NULL != adapter_node && VOS_STATUS_SUCCESS == status) {
+		adapter = adapter_node->pAdapter;
+		if (WLAN_HDD_SOFTAP == adapter->device_mode ||
+				WLAN_HDD_P2P_GO == adapter->device_mode)
+			WLAN_HDD_GET_AP_CTX_PTR(adapter)->dfs_cac_block_tx =
+					cac_block_tx;
+
+		status = hdd_get_next_adapter(hdd_ctx, adapter_node, &next);
+		adapter_node = next;
+	}
+}
+
 /* This function is invoked in atomic context when a radar
  * is found on the SAP current operating channel and Data
  * Tx from netif has to be stopped to honor the DFS regulations.
@@ -9009,6 +9689,14 @@ static int __hdd_open(struct net_device *dev)
             WLAN_CONTROL_PATH);
    }
 
+   /* Enable carrier and transmit queues for NDI */
+   if (WLAN_HDD_IS_NDI(pAdapter)) {
+       hddLog(LOG1, FL("Enabling Tx Queues"));
+       wlan_hdd_netif_queue_control(pAdapter,
+            WLAN_START_ALL_NETIF_QUEUE_N_CARRIER,
+            WLAN_CONTROL_PATH);
+   }
+
    return 0;
 }
 
@@ -9094,6 +9782,206 @@ static int hdd_mon_open(struct net_device *dev)
 	return ret;
 }
 
+int wlan_hdd_monitor_mode_enable(hdd_context_t *hdd_ctx, bool enable)
+{
+	int ret = 0;
+
+	ret = process_wma_set_command(
+		0,
+		GEN_PDEV_MONITOR_MODE,
+		enable,
+		GEN_CMD);
+
+	if (ret) {
+		hddLog(LOGE,
+		       FL("send monitor enable cmd fail, ret %d"),
+		       ret);
+		return ret;
+	}
+
+	hdd_ctx->is_mon_enable = enable;
+
+	return ret;
+}
+
+/**
+ * __hdd_vir_mon_open() - HDD monitor open
+ * @dev: pointer to net_device
+ *
+ * Return: 0 for success and error number for failure
+ */
+static int __hdd_vir_mon_open(struct net_device *dev)
+{
+	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+	hdd_context_t *hdd_ctx =  WLAN_HDD_GET_CTX(adapter);
+	hdd_adapter_t *sta_adapter = NULL;
+	int ret;
+	VOS_STATUS vos_status;
+
+	if (!hdd_ctx->cfg_ini->mon_on_sta_enable) {
+		hddLog(LOGE,
+		       FL("monitor feature for STA is not enabled"));
+		goto exit;
+	}
+
+	MTRACE(vos_trace(VOS_MODULE_ID_HDD, TRACE_CODE_HDD_OPEN_REQUEST,
+			 adapter->sessionId, adapter->device_mode));
+
+	ret = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != ret)
+		return ret;
+
+	/* register monitor RX callback to TLSHIM and OL */
+	vos_status = tl_register_vir_mon_cb(hdd_ctx->pvosContext,
+					    hdd_vir_mon_rx_cbk);
+
+	if (VOS_STATUS_SUCCESS != vos_status) {
+		hddLog(LOGE,
+		       FL("failed to register monitor cbk"));
+		goto exit;
+	}
+
+	/* get STA adapter to check if STA is connected */
+	sta_adapter = hdd_get_adapter(hdd_ctx, WLAN_HDD_INFRA_STATION);
+
+	if ((NULL == sta_adapter) ||
+	    (WLAN_HDD_ADAPTER_MAGIC != sta_adapter->magic)) {
+		hddLog(LOGE,
+		       FL("STA adapter is not existed."));
+		return ret;
+	}
+
+	if (hdd_connIsConnected(WLAN_HDD_GET_STATION_CTX_PTR(sta_adapter)) &&
+	    (false == hdd_ctx->is_mon_enable)) {
+		/* send WMI cmd to enable monitor function */
+		ret = wlan_hdd_monitor_mode_enable(hdd_ctx, true);
+
+		/* disable Sta BMPS */
+		if (hdd_ctx->cfg_ini->enablePowersaveOffload)
+			sme_PsOffloadDisablePowerSave(
+				WLAN_HDD_GET_HAL_CTX(sta_adapter),
+				NULL,
+				NULL,
+				sta_adapter->sessionId);
+
+#if defined(FEATURE_WLAN_LFR) && defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD)
+		if (hdd_ctx->cfg_ini->isFastRoamIniFeatureEnabled &&
+		    hdd_ctx->cfg_ini->isRoamOffloadScanEnabled)
+			sme_stopRoaming(WLAN_HDD_GET_HAL_CTX(sta_adapter),
+					sta_adapter->sessionId, 0);
+#endif
+	}
+
+	return ret;
+exit:
+	return -EIO;
+}
+
+/**
+ * __hdd_vir_mon_stop() - HDD monitor stop
+ * @dev: pointer to net_device
+ *
+ * Return: 0 for success and error number for failure
+ */
+static int __hdd_vir_mon_stop(struct net_device *dev)
+{
+	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+	hdd_context_t *hdd_ctx =  WLAN_HDD_GET_CTX(adapter);
+	hdd_adapter_t *sta_adapter = NULL;
+	int ret;
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+
+	if (!hdd_ctx->cfg_ini->mon_on_sta_enable) {
+		hddLog(LOGE,
+		       FL("monitor feature for STA is not enabled"));
+		goto exit;
+	}
+
+	MTRACE(vos_trace(VOS_MODULE_ID_HDD, TRACE_CODE_HDD_OPEN_REQUEST,
+			 adapter->sessionId, adapter->device_mode));
+
+	ret = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != ret)
+		return ret;
+
+	/* if monitor is enabled already,
+	 * send WMI cmd to disable target monitor.
+	 */
+	if (true == hdd_ctx->is_mon_enable) {
+		ret = wlan_hdd_monitor_mode_enable(hdd_ctx, false);
+
+		/* get STA adapter to check if STA is connected */
+		sta_adapter = hdd_get_adapter(hdd_ctx, WLAN_HDD_INFRA_STATION);
+
+	    if (sta_adapter &&
+		(WLAN_HDD_ADAPTER_MAGIC == sta_adapter->magic) &&
+		hdd_connIsConnected(
+				WLAN_HDD_GET_STATION_CTX_PTR(sta_adapter))) {
+		/* enable BMPS power save */
+		if (hdd_ctx->cfg_ini->enablePowersaveOffload)
+			sme_PsOffloadEnablePowerSave(
+					WLAN_HDD_GET_HAL_CTX(sta_adapter),
+					sta_adapter->sessionId);
+
+#if defined(FEATURE_WLAN_LFR) && defined(WLAN_FEATURE_ROAM_SCAN_OFFLOAD)
+		/* enable roaming */
+		if (hdd_ctx->cfg_ini->isFastRoamIniFeatureEnabled &&
+		    hdd_ctx->cfg_ini->isRoamOffloadScanEnabled)
+			sme_startRoaming(WLAN_HDD_GET_HAL_CTX(sta_adapter),
+					 sta_adapter->sessionId,
+					 REASON_CONNECT);
+#endif
+		}
+	}
+
+	/* Deregister monitor RX callback to TLSHIM and OL */
+	vos_status = tl_deregister_vir_mon_cb(hdd_ctx->pvosContext);
+
+	if (VOS_STATUS_SUCCESS != vos_status) {
+		hddLog(LOGE,
+		       FL("failed to deregister monitor cbk"));
+		goto exit;
+	}
+
+	return ret;
+exit:
+	return -EIO;
+}
+
+/**
+ * hdd_vir_mon_open()
+ * @dev: pointer to net_device
+ *
+ * Return: 0 for success and error number for failure
+ */
+static int hdd_vir_mon_open(struct net_device *dev)
+{
+	int ret = 0;
+
+	vos_ssr_protect(__func__);
+	__hdd_vir_mon_open(dev);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+/**
+ * hdd_vir_mon_stop()
+ * @dev: pointer to net_device
+ *
+ * Return: 0 for success and error number for failure
+ */
+static int hdd_vir_mon_stop(struct net_device *dev)
+{
+	int ret = 0;
+
+	vos_ssr_protect(__func__);
+	__hdd_vir_mon_stop(dev);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
 #ifdef MODULE
 /**
  * wlan_hdd_stop_enter_lowpower() - Enter low power mode
@@ -9101,7 +9989,7 @@ static int hdd_mon_open(struct net_device *dev)
  *
  * For module, when all the interfaces are down, enter low power mode.
  */
-static inline void wlan_hdd_stop_enter_lowpower(hdd_context_t *hdd_ctx)
+void wlan_hdd_stop_enter_lowpower(hdd_context_t *hdd_ctx)
 {
 	hddLog(VOS_TRACE_LEVEL_INFO,
 			"%s: All Interfaces are Down entering standby",
@@ -9141,18 +10029,8 @@ static inline int wlan_hdd_stop_can_enter_lowpower(hdd_adapter_t *adapter)
  */
 static void kickstart_driver_handler(struct work_struct *work)
 {
-	bool ready;
-
-	ready = vos_is_load_unload_ready(__func__);
-	if (!ready) {
-		VOS_ASSERT(0);
-		return;
-	}
-
-	vos_load_unload_protect(__func__);
 	hdd_driver_exit();
 	wlan_hdd_inited = 0;
-	vos_load_unload_unprotect(__func__);
 }
 
 static DECLARE_WORK(kickstart_driver_work, kickstart_driver_handler);
@@ -9220,7 +10098,7 @@ static int kickstart_driver(bool load, bool mode_change)
  * For static driver, when all the interfaces are down, enter low power mode by
  * bringing down WLAN hardware.
  */
-static inline void wlan_hdd_stop_enter_lowpower(hdd_context_t *hdd_ctx)
+void wlan_hdd_stop_enter_lowpower(hdd_context_t *hdd_ctx)
 {
 	bool ready;
 
@@ -9316,6 +10194,17 @@ static int __hdd_stop(struct net_device *dev)
    wlan_hdd_netif_queue_control(pAdapter, WLAN_NETIF_TX_DISABLE_N_CARRIER,
                          WLAN_CONTROL_PATH);
 
+   /*
+    * NAN data interface is different in some sense. The traffic on NDI is
+    * bursty in nature and depends on the need to transfer. The service layer
+    * may down the interface after the usage and up again when required.
+    * In some sense, the NDI is expected to be available (like SAP) iface
+    * until NDI delete request is issued by the service layer.
+    * Skip BSS termination and adapter deletion for NAN Data interface (NDI).
+    */
+    if (WLAN_HDD_IS_NDI(pAdapter))
+       return 0;
+
    /* The interface is marked as down for outside world (aka kernel)
     * But the driver is pretty much alive inside. The driver needs to
     * tear down the existing connection on the netdev (session)
@@ -9475,7 +10364,7 @@ static void hdd_tx_fail_ind_callback(v_U8_t *MacAddr, v_U8_t seqNo)
    payload_len = ETH_ALEN;
 
    if (0 == cesium_pid || cesium_nl_srv_sock == NULL) {
-      hddLog(LOGE, FL("cesium process not registered, pid: %d, nl_sock: %p"),
+      hddLog(LOGE, FL("cesium process not registered, pid: %d, nl_sock: %pK"),
              cesium_pid, cesium_nl_srv_sock);
       return;
    }
@@ -9851,9 +10740,18 @@ static void __hdd_set_multicast_list(struct net_device *dev)
    if (0 != wlan_hdd_validate_context(pHddCtx))
       return;
 
+   if (!pHddCtx->cfg_ini->fEnableMCAddrList) {
+      hddLog(VOS_TRACE_LEVEL_ERROR, FL("mc addr list ini is disabled"));
+      return;
+   }
+
    /* Delete already configured multicast address list */
    if (0 < pAdapter->mc_addr_list.mc_cnt)
-      wlan_hdd_set_mc_addr_list(pAdapter, false);
+      if (wlan_hdd_set_mc_addr_list(pAdapter, false)) {
+           hddLog(VOS_TRACE_LEVEL_ERROR, FL("failed to clear mc addr list"));
+           return;
+      }
+
 
    if (dev->flags & IFF_ALLMULTI)
    {
@@ -9910,7 +10808,8 @@ static void __hdd_set_multicast_list(struct net_device *dev)
    }
 
    /* Configure the updated multicast address list */
-   wlan_hdd_set_mc_addr_list(pAdapter, true);
+   if (wlan_hdd_set_mc_addr_list(pAdapter, true))
+       hddLog(VOS_TRACE_LEVEL_INFO, FL("failed to set mc addr list"));
 
    EXIT();
    return;
@@ -9976,9 +10875,16 @@ static struct net_device_ops wlan_drv_ops = {
  static struct net_device_ops wlan_mon_drv_ops = {
       .ndo_open = hdd_mon_open,
       .ndo_stop = hdd_stop,
+#ifdef CONFIG_HL_SUPPORT
+      .ndo_start_xmit = hdd_hard_start_xmit,
+#endif
       .ndo_get_stats = hdd_stats,
 };
 
+static struct net_device_ops wlan_mon_dev_ops = {
+	.ndo_open = hdd_vir_mon_open,
+	.ndo_stop = hdd_vir_mon_stop,
+};
 
 void hdd_set_station_ops( struct net_device *pWlanDev )
 {
@@ -9988,6 +10894,11 @@ void hdd_set_station_ops( struct net_device *pWlanDev )
 		pWlanDev->netdev_ops = &wlan_drv_ops;
 }
 
+void hdd_set_monitor_ops(struct net_device *pwlan_dev)
+{
+	pwlan_dev->netdev_ops = &wlan_mon_dev_ops;
+}
+
 static void mon_mode_ether_setup(struct net_device *dev)
 {
 	dev->header_ops         = NULL;
@@ -10086,6 +10997,19 @@ static inline void
 hdd_adapter_runtime_suspend_denit(hdd_adapter_t *adapter) { }
 #endif
 
+/**
+ * hdd_adapter_init_action_frame_random_mac() - Initialze attributes needed for
+ * randomization of SA in management action frames
+ * @adapter: Pointer to adapter
+ *
+ * Return: None
+ */
+static void hdd_adapter_init_action_frame_random_mac(hdd_adapter_t *adapter)
+{
+	spin_lock_init(&adapter->random_mac_lock);
+	vos_mem_zero(adapter->random_mac, sizeof(adapter->random_mac));
+}
+
 static hdd_adapter_t* hdd_alloc_station_adapter(hdd_context_t *pHddCtx,
                                                 tSirMacAddr macAddr,
                                                 unsigned char name_assign_type,
@@ -10117,37 +11041,6 @@ static hdd_adapter_t* hdd_alloc_station_adapter(hdd_context_t *pHddCtx,
       pAdapter->pHddCtx = pHddCtx;
       pAdapter->magic = WLAN_HDD_ADAPTER_MAGIC;
 
-      init_completion(&pAdapter->session_open_comp_var);
-      init_completion(&pAdapter->smps_force_mode_comp_var);
-      init_completion(&pAdapter->session_close_comp_var);
-      init_completion(&pAdapter->disconnect_comp_var);
-      init_completion(&pAdapter->linkup_event_var);
-      init_completion(&pAdapter->cancel_rem_on_chan_var);
-      init_completion(&pAdapter->rem_on_chan_ready_event);
-      init_completion(&pAdapter->offchannel_tx_event);
-      init_completion(&pAdapter->tx_action_cnf_event);
-#ifdef FEATURE_WLAN_TDLS
-      init_completion(&pAdapter->tdls_add_station_comp);
-      init_completion(&pAdapter->tdls_del_station_comp);
-      init_completion(&pAdapter->tdls_mgmt_comp);
-      init_completion(&pAdapter->tdls_link_establish_req_comp);
-#endif
-
-      init_completion(&pAdapter->ibss_peer_info_comp);
-      init_completion(&pHddCtx->mc_sus_event_var);
-      init_completion(&pHddCtx->tx_sus_event_var);
-      init_completion(&pHddCtx->rx_sus_event_var);
-      init_completion(&pHddCtx->ready_to_suspend);
-      init_completion(&pAdapter->ula_complete);
-      init_completion(&pAdapter->change_country_code);
-
-#ifdef WLAN_FEATURE_EXTWOW_SUPPORT
-      init_completion(&pHddCtx->ready_to_extwow);
-#endif
-
-      init_completion(&pAdapter->scan_info.scan_req_completion_event);
-      init_completion(&pAdapter->scan_info.abortscan_event_var);
-
       vos_event_init(&pAdapter->scan_info.scan_finished_event);
       pAdapter->scan_info.scan_pending_option = WEXT_SCAN_PENDING_GIVEUP;
 
@@ -10170,7 +11063,7 @@ static hdd_adapter_t* hdd_alloc_station_adapter(hdd_context_t *pHddCtx,
          pWlanDev->features |= NETIF_F_HW_CSUM;
       else if (pHddCtx->cfg_ini->enableTCPChkSumOffld)
          pWlanDev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
-         pWlanDev->features |= NETIF_F_RXCSUM;
+      pWlanDev->features |= NETIF_F_RXCSUM;
       hdd_set_station_ops( pAdapter->dev );
 
       pWlanDev->destructor = free_netdev;
@@ -10191,6 +11084,79 @@ static hdd_adapter_t* hdd_alloc_station_adapter(hdd_context_t *pHddCtx,
    return pAdapter;
 }
 
+static hdd_adapter_t *hdd_alloc_monitor_adapter(hdd_context_t *pHddCtx,
+						tSirMacAddr macAddr,
+						unsigned char name_assign_type,
+						const char *name)
+{
+	struct net_device *pwlan_dev = NULL;
+	hdd_adapter_t *pAdapter = NULL;
+	/*
+	 * cfg80211 initialization and registration....
+	 */
+	pwlan_dev = alloc_netdev_mq(sizeof(hdd_adapter_t),
+				   name,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)) || defined(WITH_BACKPORTS)
+				   name_assign_type,
+#endif
+				   mon_mode_ether_setup,
+				   NUM_TX_QUEUES);
+
+	if (pwlan_dev != NULL) {
+	   /* Save the pointer to the net_device in the HDD adapter */
+	   pAdapter = (hdd_adapter_t *)netdev_priv(pwlan_dev);
+
+	   vos_mem_zero(pAdapter, sizeof(hdd_adapter_t));
+
+	   pAdapter->dev = pwlan_dev;
+	   pAdapter->pHddCtx = pHddCtx;
+	   pAdapter->magic = WLAN_HDD_ADAPTER_MAGIC;
+
+	   vos_event_init(&pAdapter->scan_info.scan_finished_event);
+	   pAdapter->scan_info.scan_pending_option = WEXT_SCAN_PENDING_GIVEUP;
+
+	   pAdapter->offloads_configured = FALSE;
+	   pAdapter->isLinkUpSvcNeeded = FALSE;
+	   pAdapter->higherDtimTransition = eANI_BOOLEAN_TRUE;
+	   /* Init the net_device structure */
+	   strlcpy(pwlan_dev->name, name, IFNAMSIZ);
+
+	   vos_mem_copy(pwlan_dev->dev_addr,
+			(void *)macAddr, sizeof(tSirMacAddr));
+	   vos_mem_copy(pAdapter->macAddressCurrent.bytes,
+			macAddr, sizeof(tSirMacAddr));
+	   pwlan_dev->watchdog_timeo = HDD_TX_TIMEOUT;
+	   /*
+	    * kernel will consume ethernet header length buffer for hard_header,
+	    * so just reserve it
+	    */
+	   hdd_set_needed_headroom(pwlan_dev, pwlan_dev->hard_header_len);
+
+	   if (pHddCtx->cfg_ini->enableIPChecksumOffload)
+		pwlan_dev->features |= NETIF_F_HW_CSUM;
+	   else if (pHddCtx->cfg_ini->enableTCPChkSumOffld)
+		pwlan_dev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+	   pwlan_dev->features |= NETIF_F_RXCSUM;
+	   hdd_set_monitor_ops(pAdapter->dev);
+
+	   pwlan_dev->destructor = free_netdev;
+	   pwlan_dev->ieee80211_ptr = &pAdapter->wdev;
+	   pwlan_dev->tx_queue_len = HDD_NETDEV_TX_QUEUE_LEN;
+	   pAdapter->wdev.wiphy = pHddCtx->wiphy;
+	   pAdapter->wdev.netdev =  pwlan_dev;
+	   /* set pwlan_dev's parent to underlying device */
+	   SET_NETDEV_DEV(pwlan_dev, pHddCtx->parent_dev);
+	   hdd_wmm_init(pAdapter);
+	   hdd_adapter_runtime_suspend_init(pAdapter);
+	   spin_lock_init(&pAdapter->pause_map_lock);
+	   pAdapter->last_tx_jiffies = jiffies;
+	   pAdapter->bug_report_count = 0;
+	   pAdapter->start_time = pAdapter->last_time = vos_system_ticks();
+	}
+
+	return pAdapter;
+}
+
 VOS_STATUS hdd_register_interface( hdd_adapter_t *pAdapter, tANI_U8 rtnl_lock_held )
 {
    struct net_device *pWlanDev = pAdapter->dev;
@@ -10312,6 +11278,35 @@ static void hdd_close_tx_queues(hdd_context_t *hdd_ctx)
 	EXIT();
 }
 
+/**
+ * hdd_check_and_init_tdls() - check and init TDLS operation for desired mode
+ * @adapter: pointer to device adapter
+ * @type: type of interface
+ *
+ * This routine will check the mode of adapter and if it is required then it
+ * will initialize the TDLS operations
+ *
+ * Return: VOS_STATUS
+ */
+#ifdef FEATURE_WLAN_TDLS
+static VOS_STATUS hdd_check_and_init_tdls(hdd_adapter_t *adapter, uint32_t type)
+{
+	if (VOS_IBSS_MODE != type) {
+		if (0 != wlan_hdd_tdls_init(adapter)) {
+			hddLog(LOGE, FL("wlan_hdd_tdls_init failed"));
+			return VOS_STATUS_E_FAILURE;
+		}
+		set_bit(TDLS_INIT_DONE, &adapter->event_flags);
+	}
+	return VOS_STATUS_SUCCESS;
+}
+#else
+static VOS_STATUS hdd_check_and_init_tdls(hdd_adapter_t *adapter, uint32_t type)
+{
+	return VOS_STATUS_SUCCESS;
+}
+#endif
+
 VOS_STATUS hdd_init_station_mode( hdd_adapter_t *pAdapter )
 {
    struct net_device *pWlanDev = pAdapter->dev;
@@ -10332,6 +11327,18 @@ VOS_STATUS hdd_init_station_mode( hdd_adapter_t *pAdapter )
       hddLog(VOS_TRACE_LEVEL_ERROR, "failed to get vdev type");
       goto error_sme_open;
    }
+
+   ret_val = process_wma_set_command((int)pAdapter->sessionId,
+                         (int)WMI_PDEV_PARAM_BURST_ENABLE,
+                         (int)pHddCtx->cfg_ini->enableSifsBurst,
+                         PDEV_CMD);
+
+   if (0 != ret_val) {
+       hddLog(VOS_TRACE_LEVEL_ERROR,
+                   "%s: WMI_PDEV_PARAM_BURST_ENABLE set failed %d",
+                   __func__, ret_val);
+   }
+
    //Open a SME session for future operation
    halStatus = sme_OpenSession( pHddCtx->hHal, hdd_smeRoamCallback, pAdapter,
          (tANI_U8 *)&pAdapter->macAddressCurrent, &pAdapter->sessionId,
@@ -10396,34 +11403,15 @@ VOS_STATUS hdd_init_station_mode( hdd_adapter_t *pAdapter )
 
    set_bit(WMM_INIT_DONE, &pAdapter->event_flags);
 
-   ret_val = process_wma_set_command((int)pAdapter->sessionId,
-                         (int)WMI_PDEV_PARAM_BURST_ENABLE,
-                         (int)pHddCtx->cfg_ini->enableSifsBurst,
-                         PDEV_CMD);
-
-   if (0 != ret_val) {
-       hddLog(VOS_TRACE_LEVEL_ERROR,
-                   "%s: WMI_PDEV_PARAM_BURST_ENABLE set failed %d",
-                   __func__, ret_val);
-   }
-
-#ifdef FEATURE_WLAN_TDLS
-   if(0 != wlan_hdd_tdls_init(pAdapter))
-   {
-       status = VOS_STATUS_E_FAILURE;
-       hddLog(VOS_TRACE_LEVEL_ERROR,"%s: wlan_hdd_tdls_init failed",__func__);
+   status = hdd_check_and_init_tdls(pAdapter, type);
+   if (status != VOS_STATUS_SUCCESS)
        goto error_tdls_init;
-   }
-   set_bit(TDLS_INIT_DONE, &pAdapter->event_flags);
-#endif
 
    return VOS_STATUS_SUCCESS;
 
-#ifdef FEATURE_WLAN_TDLS
 error_tdls_init:
    clear_bit(WMM_INIT_DONE, &pAdapter->event_flags);
    hdd_wmm_adapter_close(pAdapter);
-#endif
 error_wmm_init:
    clear_bit(INIT_TX_RX_SUCCESS, &pAdapter->event_flags);
    hdd_deinit_tx_rx(pAdapter);
@@ -10489,13 +11477,13 @@ void hdd_deinit_adapter(hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter,
       case WLAN_HDD_P2P_CLIENT:
       case WLAN_HDD_P2P_DEVICE:
       {
-         if(test_bit(INIT_TX_RX_SUCCESS, &pAdapter->event_flags))
+         if (test_bit(INIT_TX_RX_SUCCESS, &pAdapter->event_flags))
          {
             hdd_deinit_tx_rx( pAdapter );
             clear_bit(INIT_TX_RX_SUCCESS, &pAdapter->event_flags);
          }
 
-         if(test_bit(WMM_INIT_DONE, &pAdapter->event_flags))
+         if (test_bit(WMM_INIT_DONE, &pAdapter->event_flags))
          {
             hdd_wmm_adapter_close( pAdapter );
             clear_bit(WMM_INIT_DONE, &pAdapter->event_flags);
@@ -10509,6 +11497,11 @@ void hdd_deinit_adapter(hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter,
       case WLAN_HDD_SOFTAP:
       case WLAN_HDD_P2P_GO:
       {
+         if (test_bit(INIT_TX_RX_SUCCESS, &pAdapter->event_flags))
+         {
+            hdd_softap_deinit_tx_rx(pAdapter);
+            clear_bit(INIT_TX_RX_SUCCESS, &pAdapter->event_flags);
+         }
 
          if (test_bit(WMM_INIT_DONE, &pAdapter->event_flags))
          {
@@ -10819,466 +11812,605 @@ VOS_STATUS hdd_check_for_existing_macaddr( hdd_context_t *pHddCtx,
     return VOS_STATUS_SUCCESS;
 }
 
-hdd_adapter_t* hdd_open_adapter( hdd_context_t *pHddCtx, tANI_U8 session_type,
-                                 const char *iface_name, tSirMacAddr macAddr,
-                                 unsigned char name_assign_type,
-                                 tANI_U8 rtnl_held )
+uint32_t hdd_get_current_vdev_sta_count(hdd_context_t *hdd_ctx)
 {
-   hdd_adapter_t *pAdapter = NULL;
-   hdd_adapter_list_node_t *pHddAdapterNode = NULL;
-   VOS_STATUS status = VOS_STATUS_E_FAILURE;
-   VOS_STATUS exitbmpsStatus = VOS_STATUS_E_FAILURE;
-   hdd_cfg80211_state_t *cfgState;
-   int ret;
+	hdd_adapter_t *adapter;
+	hdd_adapter_list_node_t *hdd_adapter_node, *next;
+	VOS_STATUS status;
+	uint32_t vdev_sta_cnt = 0;
 
-   hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "%s: iface =%s type = %d\n", __func__,
-                                      iface_name, session_type);
+	status = hdd_get_front_adapter(hdd_ctx, &hdd_adapter_node);
 
-   if (pHddCtx->current_intf_count >= pHddCtx->max_intf_count){
-        /* Max limit reached on the number of vdevs configured by the host.
-         *  Return error
-         */
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 "%s: Unable to add virtual intf: currentVdevCnt=%d,hostConfiguredVdevCnt=%d",
-                 __func__,pHddCtx->current_intf_count, pHddCtx->max_intf_count);
-        return NULL;
-   }
+	while (NULL != hdd_adapter_node && VOS_STATUS_SUCCESS == status) {
+		adapter = hdd_adapter_node->pAdapter;
+		if ((NULL != adapter) &&
+		    ((WLAN_HDD_INFRA_STATION == adapter->device_mode) ||
+		     (WLAN_HDD_P2P_CLIENT == adapter->device_mode) ||
+		     (WLAN_HDD_IBSS == adapter->device_mode)))
+			vdev_sta_cnt++;
 
-   if(macAddr == NULL)
-   {
-         /* Not received valid macAddr */
-         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 "%s:Unable to add virtual intf: Not able to get"
-                             "valid mac address",__func__);
-         return NULL;
-   }
+		status = hdd_get_next_adapter(hdd_ctx, hdd_adapter_node, &next);
+		hdd_adapter_node = next;
+	}
 
-   status = hdd_check_for_existing_macaddr(pHddCtx, macAddr);
-   if (VOS_STATUS_E_FAILURE == status) {
-         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                   "%s: Duplicate MAC addr: "MAC_ADDRESS_STR" already exists",
-                   __func__, MAC_ADDR_ARRAY(macAddr));
-         return NULL;
-   }
+	return vdev_sta_cnt;
+}
 
-   /*
-    * If Powersave Offload is enabled
-    * Fw will take care incase of concurrency
-    */
-   if(!pHddCtx->cfg_ini->enablePowersaveOffload)
-   {
-      //Disable BMPS incase of Concurrency
-      exitbmpsStatus = hdd_disable_bmps_imps(pHddCtx, session_type);
+hdd_adapter_t *hdd_open_adapter(hdd_context_t *hdd_ctx,
+				uint8_t session_type,
+				const char *iface_name,
+				tSirMacAddr mac_addr,
+				uint8_t name_assign_type,
+				uint8_t rtnl_held)
+{
+	VOS_STATUS status, exit_bmps_status = VOS_STATUS_E_FAILURE;
+	hdd_adapter_t *adapter;
+	hdd_adapter_list_node_t *hdd_adapter_node;
+	hdd_cfg80211_state_t *cfg_state;
+	int ret;
 
-      if(VOS_STATUS_E_FAILURE == exitbmpsStatus)
-      {
-         //Fail to Exit BMPS
-         hddLog(VOS_TRACE_LEVEL_ERROR, FL("Fail to Exit BMPS"));
-         VOS_ASSERT(0);
-         return NULL;
-      }
-   }
+	hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "%s: iface =%s type = %d\n",
+	       __func__, iface_name, session_type);
 
-   switch(session_type)
-   {
-      case WLAN_HDD_INFRA_STATION:
-         /* Reset locally administered bit if the device mode is STA */
-         WLAN_HDD_RESET_LOCALLY_ADMINISTERED_BIT(macAddr);
-         /* fall through */
-      case WLAN_HDD_P2P_CLIENT:
-      case WLAN_HDD_P2P_DEVICE:
-      case WLAN_HDD_OCB:
-      case WLAN_HDD_NDI:
-      {
-         pAdapter = hdd_alloc_station_adapter(pHddCtx, macAddr,
-                                              name_assign_type,
-                                              iface_name);
+	if (hdd_ctx->current_intf_count >= hdd_ctx->max_intf_count) {
+		/*
+		 * Max limit reached on the number of vdevs
+		 * configured by the host.
+		 */
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       "%s: Unable to add virtual intf: "
+		       "current_vdev_cnt=%d,host_configured_vdev_cnt=%d",
+		       __func__,
+		       hdd_ctx->current_intf_count,
+		       hdd_ctx->max_intf_count);
+		return NULL;
+	}
 
-         if( NULL == pAdapter )
-         {
-            hddLog(VOS_TRACE_LEVEL_FATAL,
-                   FL("failed to allocate adapter for session %d"), session_type);
-            return NULL;
-         }
+	if (((WLAN_HDD_INFRA_STATION == session_type) ||
+	     (WLAN_HDD_P2P_CLIENT == session_type) ||
+	     (WLAN_HDD_IBSS == session_type)) &&
+	    (WLAN_HDD_VDEV_STA_MAX ==
+	     hdd_get_current_vdev_sta_count(hdd_ctx))) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       "%s: Unable to add sta interface: max sta cnt is %d",
+		       __func__, WLAN_HDD_VDEV_STA_MAX);
+		return NULL;
+	}
 
-         if (0 != hdd_init_packet_filtering(pHddCtx, pAdapter))
-            goto err_free_netdev;
+	if (hdd_cfg_is_sub20_channel_width_enabled(hdd_ctx) &&
+	    (hdd_ctx->current_intf_count >= 1)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       "%s: Unable add another virtual intf when sub20 enable",
+		       __func__);
+		return NULL;
+	}
 
-         if (session_type == WLAN_HDD_P2P_CLIENT)
-            pAdapter->wdev.iftype = NL80211_IFTYPE_P2P_CLIENT;
-         else
-            pAdapter->wdev.iftype = NL80211_IFTYPE_STATION;
+	if (NULL == mac_addr) {
+		/* Not received valid macAddr */
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       "%s:Unable to add virtual intf: Not able to get"
+		       "valid mac address", __func__);
+		return NULL;
+	}
 
-         pAdapter->device_mode = session_type;
+	status = hdd_check_for_existing_macaddr(hdd_ctx, mac_addr);
+	if (VOS_STATUS_E_FAILURE == status) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       "%s: Duplicate MAC addr: "MAC_ADDRESS_STR
+		       " already exists",
+		       __func__, MAC_ADDR_ARRAY(mac_addr));
+		return NULL;
+	}
 
-         if (WLAN_HDD_NDI == session_type)
-                status = hdd_init_nan_data_mode(pAdapter);
-         else
-                status = hdd_init_station_mode( pAdapter );
+	/*
+	 * If Powersave Offload is enabled
+	 * Fw will take care incase of concurrency
+	 */
+	if (!hdd_ctx->cfg_ini->enablePowersaveOffload) {
+		/* Disable BMPS incase of Concurrency */
+		exit_bmps_status = hdd_disable_bmps_imps(hdd_ctx, session_type);
+
+		if (VOS_STATUS_E_FAILURE == exit_bmps_status) {
+			/* Fail to Exit BMPS */
+			hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Fail to Exit BMPS",
+			       __func__);
+			VOS_ASSERT(0);
+			return NULL;
+		}
+	}
 
-         if( VOS_STATUS_SUCCESS != status )
-            goto err_free_netdev;
+	switch (session_type) {
+
+	case WLAN_HDD_INFRA_STATION:
+		 /* Reset locally administered bit if the device mode is STA */
+		WLAN_HDD_RESET_LOCALLY_ADMINISTERED_BIT(mac_addr);
+	/* fall through */
+	case WLAN_HDD_P2P_CLIENT:
+	case WLAN_HDD_P2P_DEVICE:
+	case WLAN_HDD_OCB:
+	case WLAN_HDD_NDI:
+	{
+		adapter = hdd_alloc_station_adapter(hdd_ctx,
+						    mac_addr,
+						    name_assign_type,
+						    iface_name);
+
+		if (NULL == adapter) {
+			hddLog(VOS_TRACE_LEVEL_FATAL,
+			       FL("%s: Failed to allocate adapter for session %d"),
+			       __func__, session_type);
+			return NULL;
+		}
 
-         // Workqueue which gets scheduled in IPv4 notification callback
-         vos_init_work(&pAdapter->ipv4NotifierWorkQueue,
-                        hdd_ipv4_notifier_work_queue);
+		if (0 != hdd_init_packet_filtering(hdd_ctx, adapter))
+			goto err_init_packet_filtering;
+
+		if (session_type == WLAN_HDD_P2P_CLIENT)
+			adapter->wdev.iftype = NL80211_IFTYPE_P2P_CLIENT;
+		else
+			adapter->wdev.iftype = NL80211_IFTYPE_STATION;
+
+		adapter->device_mode = session_type;
+
+		hdd_initialize_adapter_common(adapter);
+		if (WLAN_HDD_NDI == session_type)
+			status = hdd_init_nan_data_mode(adapter);
+		else
+			status = hdd_init_station_mode(adapter);
+
+		if (VOS_STATUS_SUCCESS != status)
+			goto err_init_adapter_mode;
+
+		/* initialize action frame random mac info */
+		hdd_adapter_init_action_frame_random_mac(adapter);
+
+		/* Workqueue which gets scheduled in IPv4
+		 * notification callback
+		 */
+		vos_init_work(&adapter->ipv4NotifierWorkQueue,
+			      hdd_ipv4_notifier_work_queue);
 
 #ifdef WLAN_NS_OFFLOAD
-         // Workqueue which gets scheduled in IPv6 notification callback.
-         vos_init_work(&pAdapter->ipv6NotifierWorkQueue,
-                        hdd_ipv6_notifier_work_queue);
+		/* Workqueue which gets scheduled in IPv6
+		 * notification callback
+		 */
+		vos_init_work(&adapter->ipv6NotifierWorkQueue,
+			      hdd_ipv6_notifier_work_queue);
 #endif
-         status = hdd_register_interface(pAdapter, rtnl_held);
-         if (VOS_STATUS_SUCCESS != status) {
-            hdd_deinit_adapter(pHddCtx, pAdapter, rtnl_held);
-            goto err_free_netdev;
-         }
-
-         //Stop the Interface TX queue.
-         hddLog(LOG1, FL("Disabling queues"));
-         wlan_hdd_netif_queue_control(pAdapter,
-            WLAN_NETIF_TX_DISABLE_N_CARRIER,
-            WLAN_CONTROL_PATH);
+		status = hdd_register_interface(adapter, rtnl_held);
+		if (VOS_STATUS_SUCCESS != status)
+			goto err_register_interface;
+
+		/* do not disable tx in monitor mode */
+		if (VOS_MONITOR_MODE != vos_get_conparam()) {
+			/* Stop the Interface TX queue */
+			hddLog(LOG1, FL("Disabling queues"));
+			wlan_hdd_netif_queue_control(adapter,
+					WLAN_NETIF_TX_DISABLE_N_CARRIER,
+					WLAN_CONTROL_PATH);
+		}
 
 #ifdef QCA_LL_TX_FLOW_CT
-         /* SAT mode default TX Flow control instance
-          * This instance will be used for
-          * STA mode, IBSS mode and TDLS mode */
-         if (pAdapter->tx_flow_timer_initialized == VOS_FALSE) {
-            vos_timer_init(&pAdapter->tx_flow_control_timer,
-                           VOS_TIMER_TYPE_SW,
-                           hdd_tx_resume_timer_expired_handler,
-                           pAdapter);
-            pAdapter->tx_flow_timer_initialized = VOS_TRUE;
-         }
-         WLANTL_RegisterTXFlowControl(pHddCtx->pvosContext,
-                     hdd_tx_resume_cb,
-                     pAdapter->sessionId,
-                     (void *)pAdapter);
+		/* SAT mode default TX Flow control instance
+		 * This instance will be used for
+		 * STA mode, IBSS mode and TDLS mode */
+		if (adapter->tx_flow_timer_initialized == VOS_FALSE) {
+			vos_timer_init(&adapter->tx_flow_control_timer,
+				       VOS_TIMER_TYPE_SW,
+				       hdd_tx_resume_timer_expired_handler,
+				       adapter);
+			adapter->tx_flow_timer_initialized = VOS_TRUE;
+		}
+		WLANTL_RegisterTXFlowControl(hdd_ctx->pvosContext,
+					     hdd_tx_resume_cb,
+					     adapter->sessionId,
+					     (void *)adapter);
 #endif /* QCA_LL_TX_FLOW_CT */
 
-         break;
-      }
+		break;
+	}
 
-      case WLAN_HDD_P2P_GO:
-      case WLAN_HDD_SOFTAP:
-      {
-         pAdapter = hdd_wlan_create_ap_dev(pHddCtx, macAddr,
-                                           name_assign_type,
-                                           (tANI_U8 *)iface_name );
-         if( NULL == pAdapter )
-         {
-            hddLog(VOS_TRACE_LEVEL_FATAL,
-                   FL("failed to allocate adapter for session %d"), session_type);
-            return NULL;
-         }
+	case WLAN_HDD_P2P_GO:
+	case WLAN_HDD_SOFTAP:
+	{
+		adapter = hdd_wlan_create_ap_dev(hdd_ctx,
+						 mac_addr,
+						 name_assign_type,
+						 (tANI_U8 *)iface_name);
+		if (NULL == adapter) {
+			hddLog(VOS_TRACE_LEVEL_FATAL,
+			       FL("failed to allocate adapter for session %d"),
+			       session_type);
+			return NULL;
+		}
 
-         if (0 != hdd_init_packet_filtering(pHddCtx, pAdapter))
-            goto err_free_netdev;
+		if (0 != hdd_init_packet_filtering(hdd_ctx, adapter))
+			goto err_init_packet_filtering;
 
-         pAdapter->wdev.iftype = (session_type == WLAN_HDD_SOFTAP) ?
-                                  NL80211_IFTYPE_AP:
-                                  NL80211_IFTYPE_P2P_GO;
-         pAdapter->device_mode = session_type;
+		adapter->wdev.iftype = (session_type == WLAN_HDD_SOFTAP) ?
+				       NL80211_IFTYPE_AP :
+				       NL80211_IFTYPE_P2P_GO;
+		adapter->device_mode = session_type;
 
-         status = hdd_init_ap_mode(pAdapter);
-         if( VOS_STATUS_SUCCESS != status )
-            goto err_free_netdev;
+		hdd_initialize_adapter_common(adapter);
+		status = hdd_init_ap_mode(adapter, false);
+		if (VOS_STATUS_SUCCESS != status)
+			goto err_init_adapter_mode;
 
-         status = hdd_register_hostapd( pAdapter, rtnl_held );
-         if( VOS_STATUS_SUCCESS != status )
-         {
-            hdd_deinit_adapter(pHddCtx, pAdapter, rtnl_held);
-            goto err_free_netdev;
-         }
+		status = hdd_register_hostapd(adapter, rtnl_held);
+		if (VOS_STATUS_SUCCESS != status)
+			goto err_register_interface;
 
-         hddLog(LOG1, FL("Disabling queues"));
-         wlan_hdd_netif_queue_control(pAdapter,
-             WLAN_NETIF_TX_DISABLE_N_CARRIER,
-             WLAN_CONTROL_PATH);
-         hdd_set_conparam( 1 );
+		hddLog(LOG1, FL("Disabling queues"));
+		wlan_hdd_netif_queue_control(adapter,
+					     WLAN_NETIF_TX_DISABLE_N_CARRIER,
+					     WLAN_CONTROL_PATH);
+		hdd_set_conparam(1);
 
-         break;
-      }
-      case WLAN_HDD_FTM:
-      {
-         pAdapter = hdd_alloc_station_adapter(pHddCtx, macAddr,
-                                              name_assign_type,
-                                              iface_name );
+		/* Workqueue which gets scheduled in IPv4
+		 * notification callback
+		 */
+		vos_init_work(&adapter->ipv4NotifierWorkQueue,
+			      hdd_ipv4_notifier_work_queue);
 
-         if( NULL == pAdapter )
-         {
-            hddLog(VOS_TRACE_LEVEL_FATAL,
-                   FL("failed to allocate adapter for session %d"), session_type);
-            return NULL;
-         }
+#ifdef WLAN_NS_OFFLOAD
+		/* Workqueue which gets scheduled in IPv6
+		 * notification callback
+		 */
+		vos_init_work(&adapter->ipv6NotifierWorkQueue,
+			      hdd_ipv6_notifier_work_queue);
+#endif
 
-         /* Assign NL80211_IFTYPE_STATION as interface type to resolve Kernel Warning
-          * message while loading driver in FTM mode. */
-         pAdapter->wdev.iftype = NL80211_IFTYPE_STATION;
-         pAdapter->device_mode = session_type;
-         status = hdd_register_interface( pAdapter, rtnl_held );
+		break;
+	}
 
-         hdd_init_tx_rx( pAdapter );
+	case WLAN_HDD_FTM:
+	{
+		adapter = hdd_alloc_station_adapter(hdd_ctx,
+						    mac_addr,
+						    name_assign_type,
+						    iface_name);
+
+		if (NULL == adapter) {
+			hddLog(VOS_TRACE_LEVEL_FATAL,
+			       FL("failed to allocate adapter for session %d"),
+			       session_type);
+			return NULL;
+		}
 
-         //Stop the Interface TX queue.
-         hddLog(LOG1, FL("Disabling queues"));
-         wlan_hdd_netif_queue_control(pAdapter,
-            WLAN_NETIF_TX_DISABLE_N_CARRIER,
-            WLAN_CONTROL_PATH);
-      }
-         break;
-      default:
-      {
-         hddLog(VOS_TRACE_LEVEL_FATAL,"%s Invalid session type %d",
-                __func__, session_type);
-         VOS_ASSERT(0);
-         return NULL;
-      }
-   }
+		/* Assign NL80211_IFTYPE_STATION as interface type to resolve
+		 * Kernel Warning message while loading driver in FTM mode.
+		 */
+		adapter->wdev.iftype = NL80211_IFTYPE_STATION;
+		adapter->device_mode = session_type;
+		status = hdd_register_interface(adapter, rtnl_held);
+		if (VOS_STATUS_SUCCESS != status)
+			goto err_register_interface;
 
-    cfgState = WLAN_HDD_GET_CFG_STATE_PTR( pAdapter );
-    mutex_init(&cfgState->remain_on_chan_ctx_lock);
+		hdd_initialize_adapter_common(adapter);
+		hdd_init_tx_rx(adapter);
+
+		/* Stop the Interface TX queue */
+		hddLog(LOG1, FL("Disabling queues"));
+		wlan_hdd_netif_queue_control(adapter,
+					     WLAN_NETIF_TX_DISABLE_N_CARRIER,
+					     WLAN_CONTROL_PATH);
+
+		break;
+	}
+
+	case WLAN_HDD_MONITOR:
+	{
+		adapter = hdd_alloc_monitor_adapter(hdd_ctx,
+						    mac_addr,
+						    name_assign_type,
+						    iface_name);
+
+		if (NULL == adapter) {
+			hddLog(VOS_TRACE_LEVEL_FATAL,
+			       FL("failed to allocate adapter for session %d"),
+			       session_type);
+			return NULL;
+		}
+
+		adapter->wdev.iftype = NL80211_IFTYPE_MONITOR;
+		adapter->device_mode = session_type;
+		status = hdd_register_interface(adapter, rtnl_held);
+		if (VOS_STATUS_SUCCESS != status)
+			goto err_register_interface;
+
+		hdd_initialize_adapter_common(adapter);
+
+		/* Stop the Interface TX queue */
+		hddLog(LOG1, FL("Disabling queues"));
+		wlan_hdd_netif_queue_control(adapter,
+					     WLAN_NETIF_TX_DISABLE_N_CARRIER,
+					     WLAN_CONTROL_PATH);
+
+		break;
+	}
+
+	default:
+	{
+		hddLog(VOS_TRACE_LEVEL_FATAL, "%s Invalid session type %d",
+		       __func__, session_type);
+		VOS_ASSERT(0);
+		return NULL;
+	}
+
+	}
+
+	vos_init_work(&adapter->scan_block_work,
+		      wlan_hdd_cfg80211_scan_block_cb);
+
+	cfg_state = WLAN_HDD_GET_CFG_STATE_PTR(adapter);
+	mutex_init(&cfg_state->remain_on_chan_ctx_lock);
 
-   if( VOS_STATUS_SUCCESS == status )
-   {
 #ifdef WLAN_FEATURE_MBSSID
-      hdd_mbssid_apply_def_cfg_ini(pAdapter);
+	hdd_mbssid_apply_def_cfg_ini(adapter);
 #endif
-      //Add it to the hdd's session list.
-      pHddAdapterNode = vos_mem_malloc( sizeof( hdd_adapter_list_node_t ) );
-      if( NULL == pHddAdapterNode )
-      {
-         status = VOS_STATUS_E_NOMEM;
-      }
-      else
-      {
-         pHddAdapterNode->pAdapter = pAdapter;
-         status = hdd_add_adapter_back ( pHddCtx,
-                                         pHddAdapterNode );
-      }
-   }
+	/* Add it to the hdd's session list */
+	hdd_adapter_node = vos_mem_malloc(sizeof(hdd_adapter_list_node_t));
+	if (NULL == hdd_adapter_node)
+		goto err_malloc_adapter_node;
 
-   if( VOS_STATUS_SUCCESS != status )
-   {
-      if( NULL != pAdapter )
-      {
-         hdd_deinit_packet_filtering(pAdapter);
-         hdd_cleanup_adapter( pHddCtx, pAdapter, rtnl_held );
-         pAdapter = NULL;
-      }
-      if( NULL != pHddAdapterNode )
-      {
-         vos_mem_free( pHddAdapterNode );
-      }
+	hdd_adapter_node->pAdapter = adapter;
+	status = hdd_add_adapter_back(hdd_ctx,
+				      hdd_adapter_node);
 
-      goto resume_bmps;
-   }
+	if (VOS_STATUS_SUCCESS != status)
+		goto err_add_adapter_back;
 
-   if(VOS_STATUS_SUCCESS == status)
-   {
-      wlan_hdd_set_concurrency_mode(pHddCtx, session_type);
+	wlan_hdd_set_concurrency_mode(hdd_ctx, session_type);
 
-      //Initialize the WoWL service
-      if(!hdd_init_wowl(pAdapter))
-      {
-          hddLog(VOS_TRACE_LEVEL_FATAL,"%s: hdd_init_wowl failed",__func__);
-          goto err_free_netdev;
-      }
+	/* Initialize the WoWL service */
+	if (!hdd_init_wowl(adapter)) {
+		hddLog(VOS_TRACE_LEVEL_FATAL,
+		       "%s: hdd_init_wowl failed", __func__);
+		goto err_post_add_adapter;
+	}
 
-      /* Adapter successfully added. Increment the vdev count  */
-      pHddCtx->current_intf_count++;
+	/* Adapter successfully added. Increment the vdev count  */
+	hdd_ctx->current_intf_count++;
 
-      hddLog(VOS_TRACE_LEVEL_DEBUG,"%s: current_intf_count=%d", __func__,
-                                    pHddCtx->current_intf_count);
+	hddLog(VOS_TRACE_LEVEL_DEBUG,
+	       "%s: current_intf_count=%d", __func__,
+	       hdd_ctx->current_intf_count);
 #ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
-      if (vos_get_concurrency_mode() == VOS_STA_SAP) {
-          hdd_adapter_t *ap_adapter;
-
-          ap_adapter = hdd_get_adapter(pHddCtx, WLAN_HDD_SOFTAP);
-          if (ap_adapter != NULL &&
-              test_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags) &&
-              VOS_IS_DFS_CH(ap_adapter->sessionCtx.ap.operatingChannel)) {
-
-              hddLog(VOS_TRACE_LEVEL_WARN,
-                  "STA-AP Mode DFS not supported. Restart SAP with Non DFS ACS"
-                  );
-              ap_adapter->sessionCtx.ap.sapConfig.channel = AUTO_CHANNEL_SELECT;
-              ap_adapter->sessionCtx.ap.sapConfig.acs_cfg.acs_mode = true;
-              wlan_hdd_restart_sap(ap_adapter);
-          }
-      }
+	if (vos_get_concurrency_mode() == VOS_STA_SAP) {
+		hdd_adapter_t *ap_adapter;
+
+		ap_adapter = hdd_get_adapter(hdd_ctx, WLAN_HDD_SOFTAP);
+		if (ap_adapter != NULL &&
+		    test_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags) &&
+		    VOS_IS_DFS_CH(ap_adapter->sessionCtx.ap.operatingChannel)) {
+
+			hddLog(VOS_TRACE_LEVEL_WARN,
+			       "STA-AP Mode DFS not supported. "
+			       "Restart SAP with Non DFS ACS");
+			ap_adapter->sessionCtx.ap.sapConfig.channel =
+				AUTO_CHANNEL_SELECT;
+			ap_adapter->sessionCtx.ap.sapConfig.acs_cfg.acs_mode =
+				true;
+			wlan_hdd_restart_sap(ap_adapter);
+		}
+	}
 #endif
-   }
 
-   if ((vos_get_conparam() != VOS_FTM_MODE) && (!pHddCtx->cfg_ini->enable2x2))
-   {
+	if ((vos_get_conparam() != VOS_FTM_MODE) &&
+	    (!hdd_ctx->cfg_ini->enable2x2)) {
 #define HDD_DTIM_1CHAIN_RX_ID 0x5
 #define HDD_SMPS_PARAM_VALUE_S 29
 
-      /* Disable DTIM 1 chain Rx when in 1x1, we are passing two values as
-         param_id << 29 | param_value. Below param_value = 0(disable) */
-      ret = process_wma_set_command((int)pAdapter->sessionId,
-                             (int)WMI_STA_SMPS_PARAM_CMDID,
-                             HDD_DTIM_1CHAIN_RX_ID << HDD_SMPS_PARAM_VALUE_S,
-                             VDEV_CMD);
+		/* Disable DTIM 1 chain Rx when in 1x1,
+		 * we are passing two values as
+		 * param_id << 29 | param_value.
+		 * Below param_value = 0(disable)
+		 */
+		ret = process_wma_set_command((int)adapter->sessionId,
+				(int)WMI_STA_SMPS_PARAM_CMDID,
+				HDD_DTIM_1CHAIN_RX_ID << HDD_SMPS_PARAM_VALUE_S,
+				VDEV_CMD);
 
-      if (ret != 0)
-      {
-         hddLog(VOS_TRACE_LEVEL_ERROR,"%s: DTIM 1 chain set failed %d", __func__, ret);
-         goto err_free_netdev;
-      }
+		if (ret != 0) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+			       "%s: DTIM 1 chain set failed %d",
+			       __func__, ret);
+			goto err_post_add_adapter;
+		}
 
-        if (!pHddCtx->per_band_chainmask_supp) {
-            ret = process_wma_set_command((int)pAdapter->sessionId,
-                        (int)WMI_PDEV_PARAM_TX_CHAIN_MASK,
-                        (int)pHddCtx->cfg_ini->txchainmask1x1, PDEV_CMD);
-            if (ret != 0)
-            {
-                hddLog(VOS_TRACE_LEVEL_ERROR,
-                                "%s: PDEV_PARAM_TX_CHAIN_MASK set failed %d",
-                                __func__, ret);
-                goto err_free_netdev;
-            }
-            ret = process_wma_set_command((int)pAdapter->sessionId,
-                            (int)WMI_PDEV_PARAM_RX_CHAIN_MASK,
-                            (int)pHddCtx->cfg_ini->rxchainmask1x1, PDEV_CMD);
-            if (ret != 0)
-            {
-                hddLog(VOS_TRACE_LEVEL_ERROR,
-                                "%s: WMI_PDEV_PARAM_RX_CHAIN_MASK set failed %d",
-                                __func__, ret);
-                goto err_free_netdev;
-            }
-        }
+		if (!hdd_ctx->per_band_chainmask_supp) {
+			ret = process_wma_set_command((int)adapter->sessionId,
+					(int)WMI_PDEV_PARAM_TX_CHAIN_MASK,
+					(int)hdd_ctx->cfg_ini->txchainmask1x1,
+					PDEV_CMD);
+			if (ret != 0) {
+				hddLog(VOS_TRACE_LEVEL_ERROR,
+				       "%s: PDEV_PARAM_TX_CHAIN_MASK set failed %d",
+				       __func__, ret);
+				goto err_post_add_adapter;
+			}
+			ret = process_wma_set_command((int)adapter->sessionId,
+					(int)WMI_PDEV_PARAM_RX_CHAIN_MASK,
+					(int)hdd_ctx->cfg_ini->rxchainmask1x1,
+					PDEV_CMD);
+			if (ret != 0) {
+				hddLog(VOS_TRACE_LEVEL_ERROR,
+				       "%s: WMI_PDEV_PARAM_RX_CHAIN_MASK set failed %d",
+				       __func__, ret);
+				goto err_post_add_adapter;
+			}
+		}
 #undef HDD_DTIM_1CHAIN_RX_ID
 #undef HDD_SMPS_PARAM_VALUE_S
-   }
+	}
 
-  if (VOS_FTM_MODE != vos_get_conparam())
-  {
-       ret = process_wma_set_command((int)pAdapter->sessionId,
-                         (int)WMI_PDEV_PARAM_HYST_EN,
-                         (int)pHddCtx->cfg_ini->enableMemDeepSleep,
-                         PDEV_CMD);
+	if (VOS_FTM_MODE != vos_get_conparam()) {
+		uint32_t cca_threshold;
 
-       if (ret != 0)
-       {
-           hddLog(VOS_TRACE_LEVEL_ERROR,"%s: WMI_PDEV_PARAM_HYST_EN set"
-                                 " failed %d", __func__, ret);
-           goto err_free_netdev;
-       }
+		cca_threshold = hdd_ctx->cfg_ini->cca_threshold_2g |
+				hdd_ctx->cfg_ini->cca_threshold_5g << 8;
 
-        hddLog(LOG1, FL("SET AMSDU num %d"), pHddCtx->cfg_ini->max_amsdu_num);
+		if (hdd_ctx->cfg_ini->cca_threshold_enable) {
+			hddLog(VOS_TRACE_LEVEL_DEBUG,
+			       "%s: CCA Threshold is enabled.", __func__);
+			ret = process_wma_set_command((int)adapter->sessionId,
+					WMI_PDEV_PARAM_CCA_THRESHOLD,
+					cca_threshold,
+					PDEV_CMD);
+		} else {
+			ret = 0;
+		}
 
-        ret = process_wma_set_command((int)pAdapter->sessionId,
-                        (int)GEN_VDEV_PARAM_AMSDU,
-                        (int)pHddCtx->cfg_ini->max_amsdu_num,
-                        GEN_CMD);
-        if (ret != 0) {
-                hddLog(VOS_TRACE_LEVEL_ERROR,
-                        FL("GEN_VDEV_PARAM_AMSDU set failed %d"), ret);
-                goto err_free_netdev;
-        }
-  }
+		if (ret != 0) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+			       "%s: WMI_PDEV_PARAM_CCA_THRESHOLD set failed %d",
+			       __func__, ret);
+			goto err_post_add_adapter;
+		}
 
+		ret = process_wma_set_command((int)adapter->sessionId,
+			      (int)WMI_PDEV_PARAM_HYST_EN,
+			      (int)hdd_ctx->cfg_ini->enableMemDeepSleep,
+			      PDEV_CMD);
+		if (ret != 0) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+			       "%s: WMI_PDEV_PARAM_HYST_EN set failed %d",
+			       __func__, ret);
+			goto err_post_add_adapter;
+		}
 
-#ifdef CONFIG_FW_LOGS_BASED_ON_INI
+		hddLog(LOG1, FL("SET AMSDU num %d"),
+		       hdd_ctx->cfg_ini->max_amsdu_num);
 
-  /* Enable FW logs based on INI configuration */
-  if ((VOS_FTM_MODE != vos_get_conparam()) &&
-             (pHddCtx->cfg_ini->enablefwlog))
-  {
-     tANI_U8 count = 0;
-     tANI_U32 value = 0;
-     tANI_U8 numEntries = 0;
-     tANI_U8 moduleLoglevel[FW_MODULE_LOG_LEVEL_STRING_LENGTH];
-
-     pHddCtx->fw_log_settings.dl_type = pHddCtx->cfg_ini->enableFwLogType;
-     ret = process_wma_set_command( (int)pAdapter->sessionId,
-                                  (int)WMI_DBGLOG_TYPE,
-                                  pHddCtx->cfg_ini->enableFwLogType, DBG_CMD );
-     if (ret != 0)
-     {
-          hddLog(LOGE, FL("Failed to enable FW log type ret %d"), ret);
-     }
-
-     pHddCtx->fw_log_settings.dl_loglevel = pHddCtx->cfg_ini->enableFwLogLevel;
-     ret = process_wma_set_command((int)pAdapter->sessionId,
-                                   (int)WMI_DBGLOG_LOG_LEVEL,
-                                   pHddCtx->cfg_ini->enableFwLogLevel, DBG_CMD);
-     if (ret != 0)
-     {
-          hddLog(LOGE, FL("Failed to enable FW log level ret %d"), ret);
-     }
-
-     hdd_string_to_u8_array( pHddCtx->cfg_ini->enableFwModuleLogLevel,
-                             moduleLoglevel,
-                             &numEntries,
-                             FW_MODULE_LOG_LEVEL_STRING_LENGTH);
-
-     while (count < numEntries)
-     {
-         /* FW module log level input string looks like below:
-            gFwDebugModuleLoglevel=<FW Module ID>, <Log Level>, so on....
-            For example:
-            gFwDebugModuleLoglevel=1,0,2,1,3,2,4,3,5,4,6,5,7,6,8,7
-            Above input string means :
-            For FW module ID 1 enable log level 0
-            For FW module ID 2 enable log level 1
-            For FW module ID 3 enable log level 2
-            For FW module ID 4 enable log level 3
-            For FW module ID 5 enable log level 4
-            For FW module ID 6 enable log level 5
-            For FW module ID 7 enable log level 6
-            For FW module ID 8 enable log level 7
-         */
-         /* FW expects WMI command value = Module ID * 10 + Module Log level */
-         value = ( (moduleLoglevel[count] * 10) + moduleLoglevel[count + 1] );
-         ret = process_wma_set_command((int)pAdapter->sessionId,
-                                       (int)WMI_DBGLOG_MOD_LOG_LEVEL,
-                                       value, DBG_CMD);
-         if (ret != 0)
-         {
-            hddLog(LOGE, FL("Failed to enable FW module log level %d ret %d"),
-              value, ret);
-         }
+		ret = process_wma_set_command((int)adapter->sessionId,
+				(int)GEN_VDEV_PARAM_AMSDU,
+				(int)hdd_ctx->cfg_ini->max_amsdu_num,
+				GEN_CMD);
+		if (ret != 0) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+			       FL("GEN_VDEV_PARAM_AMSDU set failed %d"), ret);
+			goto err_post_add_adapter;
+		}
+	}
 
-         count += 2;
-     }
-  }
+#ifdef CONFIG_FW_LOGS_BASED_ON_INI
+
+	/* Enable FW logs based on INI configuration */
+	if ((VOS_FTM_MODE != vos_get_conparam()) &&
+	    (hdd_ctx->cfg_ini->enablefwlog) &&
+	    (hdd_ctx->current_intf_count == 1)) {
+		uint8_t count = 0;
+		uint32_t value = 0;
+		uint8_t num_entries = 0;
+		uint8_t module_loglevel[FW_MODULE_LOG_LEVEL_STRING_LENGTH];
+
+		hdd_ctx->fw_log_settings.dl_type =
+					hdd_ctx->cfg_ini->enableFwLogType;
+		ret = process_wma_set_command((int)adapter->sessionId,
+					(int)WMI_DBGLOG_TYPE,
+					hdd_ctx->cfg_ini->enableFwLogType,
+					DBG_CMD);
+		if (ret != 0)
+			hddLog(LOGE,
+			       FL("Failed to enable FW log type ret %d"), ret);
+
+		hdd_ctx->fw_log_settings.dl_loglevel =
+					hdd_ctx->cfg_ini->enableFwLogLevel;
+		ret = process_wma_set_command((int)adapter->sessionId,
+					(int)WMI_DBGLOG_LOG_LEVEL,
+					hdd_ctx->cfg_ini->enableFwLogLevel,
+					DBG_CMD);
+		if (ret != 0)
+			hddLog(LOGE,
+			       FL("Failed to enable FW log level ret %d"),
+			       ret);
+
+		hdd_string_to_u8_array(hdd_ctx->cfg_ini->enableFwModuleLogLevel,
+				       module_loglevel,
+				       &num_entries,
+				       FW_MODULE_LOG_LEVEL_STRING_LENGTH);
+
+		while (count < num_entries) {
+			/* FW module log level input string looks like below:
+			 * gFwDebugModuleLoglevel=
+			 *	<FW Module ID>, <Log Level>, so on....
+			 * For example:
+			 * gFwDebugModuleLoglevel=
+			 *	1,0,2,1,3,2,4,3,5,4,6,5,7,6,8,7
+			 * Above input string means :
+			 * For FW module ID 1 enable log level 0
+			 * For FW module ID 2 enable log level 1
+			 * For FW module ID 3 enable log level 2
+			 * For FW module ID 4 enable log level 3
+			 * For FW module ID 5 enable log level 4
+			 * For FW module ID 6 enable log level 5
+			 * For FW module ID 7 enable log level 6
+			 * For FW module ID 8 enable log level 7
+			 *
+			 * FW expects WMI command value =
+			 *	Module ID * 10 + Module Log level
+			 */
+			value = ((module_loglevel[count] * 10) +
+						module_loglevel[count + 1]);
+			ret = process_wma_set_command((int)adapter->sessionId,
+						(int)WMI_DBGLOG_MOD_LOG_LEVEL,
+						value, DBG_CMD);
+			if (ret != 0)
+				hddLog(LOGE, FL("Failed to enable FW module log level %d ret %d"),
+				       value, ret);
+
+			count += 2;
+		}
+	}
 
 #endif
 
-     ret = process_wma_set_command((int)pAdapter->sessionId,
-                                (int)WMI_VDEV_PARAM_ENABLE_RTSCTS,
-                                pHddCtx->cfg_ini->rts_profile, VDEV_CMD);
-     if (ret != 0)
-        hddLog(LOGE, "FAILED TO SET RTSCTS Profile ret:%d", ret);
+	ret = process_wma_set_command((int)adapter->sessionId,
+				      (int)WMI_VDEV_PARAM_ENABLE_RTSCTS,
+				      hdd_ctx->cfg_ini->rts_profile, VDEV_CMD);
+	if (ret != 0)
+		hddLog(LOGE, "FAILED TO SET RTSCTS Profile ret:%d", ret);
 
+	return adapter;
 
-   return pAdapter;
+err_post_add_adapter:
+	hdd_remove_adapter(hdd_ctx, hdd_adapter_node);
 
-err_free_netdev:
-   free_netdev(pAdapter->dev);
-   wlan_hdd_release_intf_addr( pHddCtx,
-                               pAdapter->macAddressCurrent.bytes );
+err_add_adapter_back:
+	vos_mem_free(hdd_adapter_node);
 
-resume_bmps:
-   //If bmps disabled enable it
-   if (!pHddCtx->cfg_ini->enablePowersaveOffload)
-   {
-       if(VOS_STATUS_SUCCESS == exitbmpsStatus)
-       {
-          if (pHddCtx->hdd_wlan_suspended)
-          {
-             hdd_set_pwrparams(pHddCtx);
-          }
-          hdd_enable_bmps_imps(pHddCtx);
-       }
-   }
+err_malloc_adapter_node:
+	if (rtnl_held)
+		unregister_netdevice(adapter->dev);
+	else
+		unregister_netdev(adapter->dev);
 
-   return NULL;
+err_register_interface:
+	/* close sme session to detach vdev */
+	hdd_stop_adapter(hdd_ctx, adapter, VOS_TRUE);
+	hdd_deinit_adapter(hdd_ctx, adapter, rtnl_held);
+
+err_init_adapter_mode:
+	hdd_deinit_packet_filtering(adapter);
+
+err_init_packet_filtering:
+	hdd_adapter_runtime_suspend_denit(adapter);
+
+	free_netdev(adapter->dev);
+	wlan_hdd_release_intf_addr(hdd_ctx,
+				   adapter->macAddressCurrent.bytes);
+
+	/* If bmps disabled enable it */
+	if (!hdd_ctx->cfg_ini->enablePowersaveOffload) {
+		if (VOS_STATUS_SUCCESS == exit_bmps_status) {
+			if (hdd_ctx->hdd_wlan_suspended)
+				hdd_set_pwrparams(hdd_ctx);
+			hdd_enable_bmps_imps(hdd_ctx);
+		}
+	}
+
+	return NULL;
 }
 
 VOS_STATUS hdd_close_adapter( hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter,
@@ -11453,12 +12585,15 @@ VOS_STATUS hdd_stop_adapter( hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter,
 {
    eHalStatus halStatus = eHAL_STATUS_SUCCESS;
    hdd_wext_state_t *pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
+   hdd_scaninfo_t *pScanInfo = NULL;
    union iwreq_data wrqu;
    tSirUpdateIE updateIE ;
    unsigned long rc;
 
    ENTER();
 
+   pScanInfo = &pAdapter->scan_info;
+
    hddLog(LOG1, FL("Disabling queues"));
    wlan_hdd_netif_queue_control(pAdapter, WLAN_NETIF_TX_DISABLE_N_CARRIER,
                                     WLAN_CONTROL_PATH);
@@ -11511,7 +12646,8 @@ VOS_STATUS hdd_stop_adapter( hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter,
            memset(wrqu.ap_addr.sa_data,'\0',ETH_ALEN);
            wireless_send_event(pAdapter->dev, SIOCGIWAP, &wrqu, NULL);
          }
-         else
+
+         if (pScanInfo != NULL && pScanInfo->mScanPending)
          {
             wlan_hdd_scan_abort(pAdapter);
          }
@@ -11622,16 +12758,27 @@ VOS_STATUS hdd_stop_adapter( hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter,
             pAdapter->sessionCtx.ap.beacon = NULL;
          }
          mutex_unlock(&pHddCtx->sap_lock);
+
+         cancel_work_sync(&pAdapter->ipv4NotifierWorkQueue);
+
+#ifdef WLAN_NS_OFFLOAD
+         cancel_work_sync(&pAdapter->ipv6NotifierWorkQueue);
+#endif
          if (bCloseSession)
              hdd_wait_for_sme_close_sesion(pHddCtx, pAdapter);
          break;
 
       case WLAN_HDD_OCB:
+         wlan_hdd_dsrc_deinit_chan_stats(pAdapter);
          hdd_disconnect_tx_rx(pAdapter);
          WLANTL_ClearSTAClient(WLAN_HDD_GET_CTX(pAdapter)->pvosContext,
             WLAN_HDD_GET_STATION_CTX_PTR(pAdapter)->conn_info.staId[0]);
          break;
 
+      case WLAN_HDD_MONITOR:
+         hdd_vir_mon_stop(pAdapter->dev);
+         break;
+
       default:
          break;
    }
@@ -11676,10 +12823,24 @@ VOS_STATUS hdd_reset_all_adapters( hdd_context_t *pHddCtx )
    while ( NULL != pAdapterNode && VOS_STATUS_SUCCESS == status )
    {
       pAdapter = pAdapterNode->pAdapter;
+
       hddLog(LOG1, FL("Disabling queues"));
-      wlan_hdd_netif_queue_control(pAdapter,
-          WLAN_NETIF_TX_DISABLE_N_CARRIER,
-          WLAN_CONTROL_PATH);
+
+      if (pHddCtx->cfg_ini->sap_internal_restart &&
+          pAdapter->device_mode == WLAN_HDD_SOFTAP) {
+          hddLog(LOG1, FL("driver supports sap restart"));
+          vos_flush_work(&pHddCtx->sap_start_work);
+          wlan_hdd_netif_queue_control(pAdapter,
+                                 WLAN_NETIF_TX_DISABLE,
+                                  WLAN_CONTROL_PATH);
+          hdd_sap_indicate_disconnect_for_sta(pAdapter);
+          hdd_cleanup_actionframe(pHddCtx, pAdapter);
+          hdd_sap_destroy_events(pAdapter);
+
+      } else
+          wlan_hdd_netif_queue_control(pAdapter,
+              WLAN_NETIF_TX_DISABLE_N_CARRIER,
+              WLAN_CONTROL_PATH);
 
       pAdapter->sessionCtx.station.hdd_ReassocScenario = VOS_FALSE;
 
@@ -11691,6 +12852,18 @@ VOS_STATUS hdd_reset_all_adapters( hdd_context_t *pHddCtx )
           clear_bit(WMM_INIT_DONE, &pAdapter->event_flags);
       }
 
+      /*
+       * If adapter is SAP, set session ID to invalid since SAP
+       * session will be cleanup during SSR.
+       */
+      if (pAdapter->device_mode == WLAN_HDD_SOFTAP)
+          wlansap_set_invalid_session(
+#ifdef WLAN_FEATURE_MBSSID
+                  WLAN_HDD_GET_SAP_CTX_PTR(pAdapter));
+#else
+                  (WLAN_HDD_GET_CTX(pAdapter))->pvosContext);
+#endif
+
       status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
       pAdapterNode = pNext;
    }
@@ -11701,6 +12874,351 @@ VOS_STATUS hdd_reset_all_adapters( hdd_context_t *pHddCtx )
 }
 
 /**
+ * hdd_get_bss_entry() - Get the bss entry matching the chan, bssid and ssid
+ * @wiphy: wiphy
+ * @channel: channel of the BSS to find
+ * @bssid: bssid of the BSS to find
+ * @ssid: ssid of the BSS to find
+ * @ssid_len: ssid len of of the BSS to find
+ *
+ * The API is a wrapper to get bss from kernel matching the chan,
+ * bssid and ssid
+ *
+ * Return: bss structure if found else NULL
+ */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 1, 0)) \
+	&& !defined(WITH_BACKPORTS) && !defined(IEEE80211_PRIVACY)
+struct cfg80211_bss *hdd_cfg80211_get_bss(struct wiphy *wiphy,
+	  struct ieee80211_channel *channel,
+	  const u8 *bssid, const u8 *ssid,
+	  size_t ssid_len)
+{
+	return cfg80211_get_bss(wiphy, channel, bssid,
+			ssid, ssid_len,
+			WLAN_CAPABILITY_ESS,
+			WLAN_CAPABILITY_ESS);
+}
+#else
+struct cfg80211_bss *hdd_cfg80211_get_bss(struct wiphy *wiphy,
+	  struct ieee80211_channel *channel,
+	  const u8 *bssid, const u8 *ssid,
+	  size_t ssid_len)
+{
+	return cfg80211_get_bss(wiphy, channel, bssid,
+			ssid, ssid_len,
+			IEEE80211_BSS_TYPE_ESS,
+			IEEE80211_PRIVACY_ANY);
+}
+#endif
+
+#if defined CFG80211_CONNECT_BSS
+#if defined CFG80211_CONNECT_TIMEOUT_REASON_CODE || \
+	(LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0))
+/**
+ * hdd_convert_timeout_reason() - Convert to kernel specific enum
+ * @timeout_reason: reason for connect timeout
+ *
+ * This function is used to convert host timeout
+ * reason enum to kernel specific enum.
+ *
+ * Return: nl timeout enum
+ */
+static enum nl80211_timeout_reason hdd_convert_timeout_reason(
+	  tSirResultCodes timeout_reason)
+{
+	switch (timeout_reason) {
+	case eSIR_SME_JOIN_TIMEOUT_RESULT_CODE:
+		return NL80211_TIMEOUT_SCAN;
+	case eSIR_SME_AUTH_TIMEOUT_RESULT_CODE:
+		return NL80211_TIMEOUT_AUTH;
+	case eSIR_SME_ASSOC_TIMEOUT_RESULT_CODE:
+		return NL80211_TIMEOUT_ASSOC;
+	default:
+		return NL80211_TIMEOUT_UNSPECIFIED;
+	}
+}
+
+/**
+ * hdd_cfg80211_connect_timeout() - API to send connection timeout reason
+ * @dev: network device
+ * @bssid: bssid to which we want to associate
+ * @timeout_reason: reason for connect timeout
+ *
+ * This API is used to send connection timeout reason to supplicant
+ *
+ * Return: void
+ */
+static void hdd_cfg80211_connect_timeout(struct net_device *dev,
+					 const u8 *bssid,
+					 tSirResultCodes timeout_reason)
+{
+	enum nl80211_timeout_reason nl_timeout_reason;
+	nl_timeout_reason = hdd_convert_timeout_reason(timeout_reason);
+
+	cfg80211_connect_timeout(dev, bssid, NULL, 0, GFP_KERNEL,
+				 nl_timeout_reason);
+}
+
+/**
+ * __hdd_connect_bss() - API to send connection status to supplicant
+ * @dev: network device
+ * @bssid: bssid to which we want to associate
+ * @req_ie: Request Information Element
+ * @req_ie_len: len of the req IE
+ * @resp_ie: Response IE
+ * @resp_ie_len: len of ht response IE
+ * @status: status
+ * @gfp: Kernel Flag
+ * @timeout_reason: reason for connect timeout
+ *
+ * Return: void
+ */
+static void __hdd_connect_bss(struct net_device *dev, const u8 *bssid,
+			      struct cfg80211_bss *bss, const u8 *req_ie,
+			      size_t req_ie_len, const u8 *resp_ie,
+			      size_t resp_ie_len, int status, gfp_t gfp,
+			      tSirResultCodes timeout_reason)
+{
+	enum nl80211_timeout_reason nl_timeout_reason;
+	nl_timeout_reason = hdd_convert_timeout_reason(timeout_reason);
+
+	cfg80211_connect_bss(dev, bssid, bss, req_ie, req_ie_len,
+			     resp_ie, resp_ie_len, status, gfp,
+			     nl_timeout_reason);
+}
+#else /* CFG80211_CONNECT_TIMEOUT_REASON_CODE */
+#if defined CFG80211_CONNECT_TIMEOUT
+static void hdd_cfg80211_connect_timeout(struct net_device *dev,
+					 const u8 *bssid,
+					 tSirResultCodes timeout_reason)
+{
+	cfg80211_connect_timeout(dev, bssid, NULL, 0, GFP_KERNEL);
+}
+#endif /* CFG80211_CONNECT_TIMEOUT */
+static void __hdd_connect_bss(struct net_device *dev, const u8 *bssid,
+			      struct cfg80211_bss *bss, const u8 *req_ie,
+			      size_t req_ie_len, const u8 *resp_ie,
+			      size_t resp_ie_len, int status, gfp_t gfp,
+			      tSirResultCodes timeout_reason)
+{
+	cfg80211_connect_bss(dev, bssid, bss, req_ie, req_ie_len,
+			     resp_ie, resp_ie_len, status, gfp);
+}
+#endif /* CFG80211_CONNECT_TIMEOUT_REASON_CODE */
+/**
+ * hdd_connect_bss() - API to send connection status to supplicant
+ * @dev: network device
+ * @bssid: bssid to which we want to associate
+ * @req_ie: Request Information Element
+ * @req_ie_len: len of the req IE
+ * @resp_ie: Response IE
+ * @resp_ie_len: len of ht response IE
+ * @status: status
+ * @gfp: Kernel Flag
+ * @connect_timeout: If timed out waiting for Auth/Assoc/Probe resp
+ * @timeout_reason: reason for connect timeout
+ *
+ * The API is a wrapper to send connection status to supplicant
+ *
+ * Return: Void
+ */
+#if defined CFG80211_CONNECT_TIMEOUT
+static void hdd_connect_bss(struct net_device *dev, const u8 *bssid,
+			struct cfg80211_bss *bss, const u8 *req_ie,
+			size_t req_ie_len, const u8 *resp_ie,
+			size_t resp_ie_len, int status, gfp_t gfp,
+			bool connect_timeout, tSirResultCodes timeout_reason)
+{
+	if (connect_timeout)
+		hdd_cfg80211_connect_timeout(dev, bssid, timeout_reason);
+	else
+		__hdd_connect_bss(dev, bssid, bss, req_ie, req_ie_len,
+			resp_ie, resp_ie_len, status, gfp, timeout_reason);
+}
+#else
+static void hdd_connect_bss(struct net_device *dev, const u8 *bssid,
+			struct cfg80211_bss *bss, const u8 *req_ie,
+			size_t req_ie_len, const u8 *resp_ie,
+			size_t resp_ie_len, int status, gfp_t gfp,
+			bool connect_timeout, tSirResultCodes timeout_reason)
+{
+	__hdd_connect_bss(dev, bssid, bss, req_ie, req_ie_len,
+		resp_ie, resp_ie_len, status, gfp, timeout_reason);
+}
+#endif
+
+#ifdef WLAN_FEATURE_FILS_SK
+#ifdef CFG80211_CONNECT_DONE
+#ifdef CFG80211_FILS_SK_OFFLOAD_SUPPORT
+/**
+ * hdd_populate_fils_params() - Populate FILS keys to connect response
+ * @fils_params: connect response to supplicant
+ * @fils_kek: FILS kek
+ * @fils_kek_len: FILS kek length
+ * @pmk: FILS PMK
+ * @pmk_len: FILS PMK length
+ * @pmkid: PMKID
+ * @fils_seq_num: FILS Seq number
+ *
+ * Return: None
+ */
+static void hdd_populate_fils_params(struct cfg80211_connect_resp_params
+                     *fils_params, const uint8_t *fils_kek,
+                     size_t fils_kek_len, const uint8_t *pmk,
+                     size_t pmk_len, const uint8_t *pmkid,
+                     uint16_t fils_seq_num)
+{
+    /* Increament seq number to be used for next FILS */
+    fils_params->fils_erp_next_seq_num = fils_seq_num + 1;
+    fils_params->update_erp_next_seq_num = true;
+    fils_params->fils_kek = fils_kek;
+    fils_params->fils_kek_len = fils_kek_len;
+    fils_params->pmk = pmk;
+    fils_params->pmk_len = pmk_len;
+    fils_params->pmkid = pmkid;
+}
+#else /* CFG80211_FILS_SK_OFFLOAD_SUPPORT */
+static inline void hdd_populate_fils_params(struct cfg80211_connect_resp_params
+                        *fils_params, const uint8_t
+                        *fils_kek, size_t fils_kek_len,
+                        const uint8_t *pmk, size_t pmk_len,
+                        const uint8_t *pmkid,
+                        uint16_t fils_seq_num)
+{ }
+#endif /* CFG80211_FILS_SK_OFFLOAD_SUPPORT */
+
+/**
+ * hdd_connect_done() - Wrapper API to call cfg80211_connect_done
+ * @dev: network device
+ * @bssid: bssid to which we want to associate
+ * @bss: cfg80211 bss info
+ * @roam_info: information about connected bss
+ * @req_ie: Request Information Element
+ * @req_ie_len: len of the req IE
+ * @resp_ie: Response IE
+ * @resp_ie_len: len of ht response IE
+ * @status: status
+ * @gfp: allocation flags
+ * @connect_timeout: If timed out waiting for Auth/Assoc/Probe resp
+ * @timeout_reason: reason for connect timeout
+ * @roam_fils_params: FILS join response params
+ *
+ * This API is used as wrapper to send FILS key/sequence number
+ * params etc. to supplicant in case of FILS connection
+ *
+ * Return: None
+ */
+static void hdd_connect_done(struct net_device *dev, const u8 *bssid,
+                 struct cfg80211_bss *bss, tCsrRoamInfo *roam_info,
+                 const u8 *req_ie, size_t req_ie_len,
+                 const u8 *resp_ie, size_t resp_ie_len, u16 status,
+                 gfp_t gfp, bool connect_timeout, tSirResultCodes
+                 timeout_reason, struct fils_join_rsp_params
+                 *roam_fils_params)
+{
+    struct cfg80211_connect_resp_params fils_params;
+    vos_mem_zero(&fils_params, sizeof(fils_params));
+
+    fils_params.bssid = bssid;
+    if (!roam_fils_params) {
+        fils_params.status = WLAN_STATUS_UNSPECIFIED_FAILURE;
+        hdd_populate_fils_params(&fils_params, NULL, 0, NULL,
+                     0, NULL, roam_info->fils_seq_num);
+    } else {
+        fils_params.status = status;
+        fils_params.timeout_reason = timeout_reason;
+        fils_params.req_ie = req_ie;
+        fils_params.req_ie_len = req_ie_len;
+        fils_params.resp_ie = resp_ie;
+        fils_params.resp_ie_len = resp_ie_len;
+        fils_params.bss = bss;
+        hdd_populate_fils_params(&fils_params, roam_fils_params->kek,
+                     roam_fils_params->kek_len,
+                     roam_fils_params->fils_pmk,
+                     roam_fils_params->fils_pmk_len,
+                     roam_fils_params->fils_pmkid,
+                     roam_info->fils_seq_num);
+    }
+    hddLog(LOG1, "FILS indicate connect status %d seq no %d",
+          fils_params.status,
+          fils_params.fils_erp_next_seq_num);
+
+    cfg80211_connect_done(dev, &fils_params, gfp);
+
+    /* Clear all the FILS key info */
+    if (roam_fils_params && roam_fils_params->fils_pmk)
+        vos_mem_free(roam_fils_params->fils_pmk);
+    if (roam_fils_params)
+        vos_mem_free(roam_fils_params);
+    roam_info->fils_join_rsp = NULL;
+}
+#else /* CFG80211_CONNECT_DONE */
+static inline void hdd_connect_done(struct net_device *dev, const u8 *bssid,
+                    struct cfg80211_bss *bss, tCsrRoamInfo
+                    *roam_info, const u8 *req_ie,
+                    size_t req_ie_len, const u8 *resp_ie,
+                    size_t resp_ie_len, u16 status, gfp_t gfp,
+                    bool connect_timeout, tSirResultCodes
+                    timeout_reason, struct fils_join_rsp_params
+                    *roam_fils_params)
+{ }
+#endif /* CFG80211_CONNECT_DONE */
+#endif /* WLAN_FEATURE_FILS_SK */
+
+#if defined(CFG80211_CONNECT_DONE) && defined(WLAN_FEATURE_FILS_SK)
+/**
+ * hdd_fils_update_connect_results() - API to send fils connection status to
+ * supplicant.
+ * @dev: network device
+ * @bssid: bssid to which we want to associate
+ * @bss: cfg80211 bss info
+ * @roam_info: information about connected bss
+ * @req_ie: Request Information Element
+ * @req_ie_len: len of the req IE
+ * @resp_ie: Response IE
+ * @resp_ie_len: len of ht response IE
+ * @status: status
+ * @gfp: allocation flags
+ * @connect_timeout: If timed out waiting for Auth/Assoc/Probe resp
+ * @timeout_reason: reason for connect timeout
+ *
+ * The API is a wrapper to send connection status to supplicant
+ *
+ * Return: 0 if success else failure
+ */
+static int hdd_fils_update_connect_results(struct net_device *dev,
+            const u8 *bssid,
+            struct cfg80211_bss *bss,
+            tCsrRoamInfo *roam_info, const u8 *req_ie,
+            size_t req_ie_len, const u8 *resp_ie,
+            size_t resp_ie_len, u16 status, gfp_t gfp,
+            bool connect_timeout,
+            tSirResultCodes timeout_reason)
+{
+    ENTER();
+    if (!roam_info || !roam_info->is_fils_connection)
+        return -EINVAL;
+
+    hdd_connect_done(dev, bssid, bss, roam_info, req_ie, req_ie_len,
+             resp_ie, resp_ie_len, status, gfp, connect_timeout,
+             timeout_reason, roam_info->fils_join_rsp);
+    return 0;
+}
+#else /* CFG80211_CONNECT_DONE && WLAN_FEATURE_FILS_SK */
+static inline int hdd_fils_update_connect_results(struct net_device *dev,
+            const u8 *bssid,
+            struct cfg80211_bss *bss,
+            tCsrRoamInfo *roam_info, const u8 *req_ie,
+            size_t req_ie_len, const u8 *resp_ie,
+            size_t resp_ie_len, u16 status, gfp_t gfp,
+            bool connect_timeout,
+            tSirResultCodes timeout_reason)
+{
+    return -EINVAL;
+}
+#endif /* CFG80211_CONNECT_DONE && WLAN_FEATURE_FILS_SK */
+
+/**
  * hdd_connect_result() - API to send connection status to supplicant
  * @dev: network device
  * @bssid: bssid to which we want to associate
@@ -11711,13 +13229,14 @@ VOS_STATUS hdd_reset_all_adapters( hdd_context_t *pHddCtx )
  * @resp_ie_len: len of ht response IE
  * @status: status
  * @gfp: Kernel Flag
+ * @connect_timeout: If timed out waiting for Auth/Assoc/Probe resp
+ * @timeout_reason: reason for connect timeout
  *
  * The API is a wrapper to send connection status to supplicant
  * and allow runtime suspend
  *
  * Return: Void
  */
-#if defined CFG80211_CONNECT_BSS
 void hdd_connect_result(struct net_device *dev,
 			const u8 *bssid,
 			tCsrRoamInfo *roam_info,
@@ -11726,7 +13245,8 @@ void hdd_connect_result(struct net_device *dev,
 			const u8 *resp_ie,
 			size_t resp_ie_len,
 			u16 status,
-			gfp_t gfp)
+			gfp_t gfp,
+			bool connect_timeout, tSirResultCodes timeout_reason)
 {
 	hdd_adapter_t *padapter = (hdd_adapter_t *) netdev_priv(dev);
 	struct cfg80211_bss *bss = NULL;
@@ -11744,25 +13264,23 @@ void hdd_connect_result(struct net_device *dev,
 						IEEE80211_BAND_5GHZ);
 
 		chan = ieee80211_get_channel(padapter->wdev.wiphy, freq);
-		bss = cfg80211_get_bss(padapter->wdev.wiphy, chan, bssid,
-				   roam_info->u.pConnectedProfile->SSID.ssId,
-				   roam_info->u.pConnectedProfile->SSID.length,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 1, 0)) \
-    && !defined(WITH_BACKPORTS) && !defined(IEEE80211_PRIVACY)
-				   WLAN_CAPABILITY_ESS
-				   WLAN_CAPABILITY_ESS);
-#else
-				   IEEE80211_BSS_TYPE_ESS,
-				   IEEE80211_PRIVACY_ANY);
-#endif
+		bss = hdd_cfg80211_get_bss(padapter->wdev.wiphy, chan, bssid,
+			roam_info->u.pConnectedProfile->SSID.ssId,
+			roam_info->u.pConnectedProfile->SSID.length);
 	}
 
-	cfg80211_connect_bss(dev, bssid, bss, req_ie, req_ie_len,
-			     resp_ie, resp_ie_len, status, gfp);
+	if (hdd_fils_update_connect_results(dev, bssid, bss,
+			roam_info, req_ie, req_ie_len, resp_ie,
+			resp_ie_len, status, gfp, connect_timeout,
+			timeout_reason) != 0) {
+			hdd_connect_bss(dev, bssid, bss, req_ie,
+				req_ie_len, resp_ie, resp_ie_len,
+				status, gfp, connect_timeout, timeout_reason);
+	}
 
 	vos_runtime_pm_allow_suspend(padapter->runtime_context.connect);
 }
-#else
+#else /* CFG80211_CONNECT_BSS */
 void hdd_connect_result(struct net_device *dev,
 			const u8 *bssid,
 			tCsrRoamInfo *roam_info,
@@ -11771,7 +13289,8 @@ void hdd_connect_result(struct net_device *dev,
 			const u8 * resp_ie,
 			size_t resp_ie_len,
 			u16 status,
-			gfp_t gfp)
+			gfp_t gfp,
+			bool connect_timeout, tSirResultCodes timeout_reason)
 {
 	hdd_adapter_t *padapter = (hdd_adapter_t *) netdev_priv(dev);
 
@@ -11780,7 +13299,7 @@ void hdd_connect_result(struct net_device *dev,
 
 	vos_runtime_pm_allow_suspend(padapter->runtime_context.connect);
 }
-#endif
+#endif /* CFG80211_CONNECT_BSS */
 
 VOS_STATUS hdd_start_all_adapters( hdd_context_t *pHddCtx )
 {
@@ -11843,10 +13362,18 @@ VOS_STATUS hdd_start_all_adapters( hdd_context_t *pHddCtx )
                hdd_connect_result(pAdapter->dev, NULL, NULL,
                                        NULL, 0, NULL, 0,
                                        WLAN_STATUS_ASSOC_DENIED_UNSPEC,
-                                       GFP_KERNEL);
+                                       GFP_KERNEL, false, 0);
             }
 
 #ifdef QCA_LL_TX_FLOW_CT
+            if (pAdapter->tx_flow_timer_initialized == VOS_FALSE) {
+                vos_timer_init(&pAdapter->tx_flow_control_timer,
+                               VOS_TIMER_TYPE_SW,
+                               hdd_tx_resume_timer_expired_handler,
+                               pAdapter);
+                pAdapter->tx_flow_timer_initialized = VOS_TRUE;
+            }
+
             WLANTL_RegisterTXFlowControl(pHddCtx->pvosContext, hdd_tx_resume_cb,
                                          pAdapter->sessionId, (void *)pAdapter);
 #endif
@@ -11854,7 +13381,25 @@ VOS_STATUS hdd_start_all_adapters( hdd_context_t *pHddCtx )
             break;
 
          case WLAN_HDD_SOFTAP:
-            /* softAP can handle SSR */
+            if (pHddCtx->cfg_ini->sap_internal_restart) {
+                hdd_init_ap_mode(pAdapter, true);
+
+#ifdef QCA_LL_TX_FLOW_CT
+                if (pAdapter->tx_flow_timer_initialized == VOS_FALSE) {
+                    vos_timer_init(&pAdapter->tx_flow_control_timer,
+                                   VOS_TIMER_TYPE_SW,
+                                   hdd_softap_tx_resume_timer_expired_handler,
+                                   pAdapter);
+                    pAdapter->tx_flow_timer_initialized = VOS_TRUE;
+                }
+
+                WLANTL_RegisterTXFlowControl(pHddCtx->pvosContext,
+                          hdd_softap_tx_resume_cb,
+                          pAdapter->sessionId,
+                          (void *)pAdapter);
+#endif
+
+            }
             break;
 
          case WLAN_HDD_P2P_GO:
@@ -12230,10 +13775,10 @@ void hdd_dump_concurrency_info(hdd_context_t *pHddCtx)
 #endif
        pHddCtx->mcc_mode = mcc_mode;
    }
-   hddLog(VOS_TRACE_LEVEL_INFO, "wlan(%d) " MAC_ADDRESS_STR " %s",
+   hddLog(VOS_TRACE_LEVEL_ERROR, "wlan(%d) " MAC_ADDRESS_STR " %s",
                 staChannel, MAC_ADDR_ARRAY(staBssid), mcc_mode ? "MCC" : "SCC");
    if (p2pChannel > 0) {
-       hddLog(VOS_TRACE_LEVEL_INFO, "p2p-%s(%d) " MAC_ADDRESS_STR,
+       hddLog(VOS_TRACE_LEVEL_ERROR, "p2p-%s(%d) " MAC_ADDRESS_STR,
                      p2pMode, p2pChannel, MAC_ADDR_ARRAY(p2pBssid));
    }
    if (apChannel1 > 0) {
@@ -12361,6 +13906,25 @@ hdd_adapter_t * hdd_get_adapter_by_macaddr( hdd_context_t *pHddCtx,
 
 }
 
+hdd_adapter_t * hdd_get_adapter_by_rand_macaddr(hdd_context_t *hdd_ctx,
+						tSirMacAddr mac_addr)
+{
+	hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
+	hdd_adapter_t *adapter;
+	VOS_STATUS status;
+
+	status = hdd_get_front_adapter(hdd_ctx, &adapter_node);
+	while (adapter_node && status == VOS_STATUS_SUCCESS) {
+		adapter = adapter_node->pAdapter;
+		if(adapter && hdd_check_random_mac(adapter, mac_addr))
+			return adapter;
+		status = hdd_get_next_adapter(hdd_ctx, adapter_node, &next);
+		adapter_node = next;
+	}
+
+	return NULL;
+}
+
 hdd_adapter_t * hdd_get_adapter_by_name( hdd_context_t *pHddCtx, tANI_U8 *name )
 {
    hdd_adapter_list_node_t *pAdapterNode = NULL, *pNext = NULL;
@@ -12611,12 +14175,12 @@ static void hdd_full_power_callback(void *callbackContext, eHalStatus status)
    struct statsContext *pContext = callbackContext;
 
    hddLog(VOS_TRACE_LEVEL_INFO,
-          "%s: context = %p, status = %d", __func__, pContext, status);
+          "%s: context = %pK, status = %d", __func__, pContext, status);
 
    if (NULL == callbackContext)
    {
       hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Bad param, context [%p]",
+             "%s: Bad param, context [%pK]",
              __func__, callbackContext);
       return;
    }
@@ -12856,6 +14420,76 @@ static inline int wlan_hdd_logging_sock_deactivate_svc(hdd_context_t *hdd_ctx)
 }
 #endif
 
+/**
+ * enum driver_unload_state - Various driver unload states
+ * @unload_start: Driver starting unload module.
+ * @unload_unregister_ip_notifier: Driver unregistering with ip notifiers.
+ * @unload_unregister_wext_adpater: Driver unregistering wext adapter.
+ * @unload_hdd_ftm_stop: Driver stopping ftm.
+ * @unload_hdd_ftm_close: Driver closing ftm.
+ * @unload_deregister_pm_ops:  Driver deregistering pm ops.
+ * @unload_unregister_thermal_notify_cb: Driver unregistering thermal callback.
+ * @unload_aborting_all_scan: Driver aborting all scan.
+ * @unload_disable_pwr_save: Driver disable power save in firmware.
+ * @unload_req_full_power: Driver requesting full power mode.
+ * @unload_set_idle_ps_config: Driver setting imps false.
+ * @unload_debugfs_exit: Driver exiting debugfs.
+ * @unload_netdev_notifier: Driver unregistering with netdev notifiers.
+ * @unload_stop_all_adapter: Driver stopping all adapters.
+ * @unload_vos_stop: Driver stopping vos.
+ * @unload_vos_sched_close: Driver closing scheduler.
+ * @unload_vos_nv_close: Driver closing nv module.
+ * @unload_vos_close: Driver closing vos module.
+ * @unload_deinit_greep_ap: Driver deinit greep ap.
+ * @unload_logging_sock_deactivate_svc: Driver deactivating logging socket.
+ * @unload_hdd_send_status_pkg: Driver sending status packet to LPSS.
+ * @unload_close_cesium_nl_sock: Driver closing cesium nl socket.
+ * @unload_runtime_suspend_deinit: Driver deinit  runtime suspend.
+ * @unload_close_all_adapters: Driver closing all adapter.
+ * @unload_ipa_cleanup: Driver performing ipa cleanup.
+ * @unload_flush_roc_work: Driver flush roc work.
+ * @unload_nl_srv_exit: Driver exit netlink service.
+ * @unload_wiphy_unregister: Driver unregister wiphy.
+ * @unload_wiphy_free: Driver free wiphy.
+ * @unload_subsystem_restart: Driver do subsystem restart.
+ * @unload_finish: Driver completed unload.
+ */
+enum driver_unload_state{
+	unload_start = 1,
+	unload_unregister_ip_notifier,
+	unload_unregister_wext_adpater,
+	unload_hdd_ftm_stop,
+	unload_hdd_ftm_close =5 ,
+	unload_deregister_pm_ops,
+	unload_unregister_thermal_notify_cb,
+	unload_aborting_all_scan,
+	unload_disable_pwr_save,
+	unload_req_full_power = 10,
+	unload_set_idle_ps_config,
+	unload_debugfs_exit,
+	unload_netdev_notifier,
+	unload_stop_all_adapter,
+	unload_vos_stop = 15,
+	unload_vos_sched_close,
+	unload_vos_nv_close,
+	unload_vos_close,
+	unload_deinit_greep_ap,
+	unload_logging_sock_deactivate_svc = 20,
+	unload_hdd_send_status_pkg,
+	unload_close_cesium_nl_sock,
+	unload_runtime_suspend_deinit,
+	unload_close_all_adapters,
+	unload_ipa_cleanup = 25,
+	unload_flush_roc_work,
+	unload_nl_srv_exit,
+	unload_wiphy_unregister,
+	unload_wiphy_free,
+	unload_subsystem_restart = 30,
+
+	/* keep it last*/
+	unload_finish = 0xff
+};
+
 /**---------------------------------------------------------------------------
 
   \brief hdd_wlan_exit() - HDD WLAN exit function
@@ -12878,23 +14512,26 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
    hdd_config_t *pConfig = pHddCtx->cfg_ini;
 
    ENTER();
+   TRACK_UNLOAD_STATUS(unload_start);
 
    hddLog(LOGE, FL("Unregister IPv6 notifier"));
+   TRACK_UNLOAD_STATUS(unload_unregister_ip_notifier);
    hdd_wlan_unregister_ip6_notifier(pHddCtx);
    hddLog(LOGE, FL("Unregister IPv4 notifier"));
    unregister_inetaddr_notifier(&pHddCtx->ipv4_notifier);
+   wlan_hdd_tsf_deinit(pHddCtx);
 
    if (VOS_FTM_MODE != hdd_get_conparam())
    {
       // Unloading, restart logic is no more required.
       wlan_hdd_restart_deinit(pHddCtx);
    }
-
+   TRACK_UNLOAD_STATUS(unload_unregister_wext_adpater);
    hdd_UnregisterWext_all_adapters(pHddCtx);
-
    if (VOS_FTM_MODE == hdd_get_conparam())
    {
       hddLog(VOS_TRACE_LEVEL_INFO, "%s: FTM MODE", __func__);
+      TRACK_UNLOAD_STATUS(unload_hdd_ftm_stop);
 #if  defined(QCA_WIFI_FTM)
       if (hdd_ftm_stop(pHddCtx))
       {
@@ -12903,11 +14540,13 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
       }
       pHddCtx->ftm.ftm_state = WLAN_FTM_STOPPED;
 #endif
+      TRACK_UNLOAD_STATUS(unload_hdd_ftm_close);
       wlan_hdd_ftm_close(pHddCtx);
       hddLog(VOS_TRACE_LEVEL_FATAL, "%s: FTM driver unloaded", __func__);
       goto free_hdd_ctx;
    }
 
+   TRACK_UNLOAD_STATUS(unload_deregister_pm_ops);
    /* DeRegister with platform driver as client for Suspend/Resume */
    vosStatus = hddDeregisterPmOps(pHddCtx);
    if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
@@ -12916,12 +14555,18 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
       VOS_ASSERT(0);
    }
 
+   TRACK_UNLOAD_STATUS(unload_unregister_thermal_notify_cb);
    vosStatus = hddDevTmUnregisterNotifyCallback(pHddCtx);
    if ( !VOS_IS_STATUS_SUCCESS( vosStatus ) )
    {
       hddLog(VOS_TRACE_LEVEL_FATAL,"%s: hddDevTmUnregisterNotifyCallback failed",__func__);
    }
 
+   if (VOS_TIMER_STATE_RUNNING ==
+                  vos_timer_getCurrentState(&pHddCtx->tdls_source_timer))
+       vos_timer_stop(&pHddCtx->tdls_source_timer);
+   vos_timer_destroy(&pHddCtx->tdls_source_timer);
+
    /*
     * Cancel any outstanding scan requests.  We are about to close all
     * of our adapters, but an adapter structure is what SME passes back
@@ -12937,14 +14582,19 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
     * the expectation is that by the time Request Full Power has completed,
     * all scans will be cancelled.
     */
+   TRACK_UNLOAD_STATUS(unload_aborting_all_scan);
    hdd_abort_mac_scan_all_adapters(pHddCtx);
-
 #ifdef FEATURE_BUS_BANDWIDTH
    if (VOS_TIMER_STATE_RUNNING ==
                         vos_timer_getCurrentState(&pHddCtx->bus_bw_timer))
    {
       vos_timer_stop(&pHddCtx->bus_bw_timer);
       hdd_rst_tcp_delack(pHddCtx);
+
+      if (pHddCtx->hbw_requested) {
+          vos_remove_pm_qos();
+          pHddCtx->hbw_requested = false;
+      }
    }
 
    if (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy(
@@ -12973,8 +14623,10 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
    spin_unlock(&pHddCtx->acs_skip_lock);
 #endif
 
+
    if (pConfig && !pConfig->enablePowersaveOffload)
    {
+      TRACK_UNLOAD_STATUS(unload_disable_pwr_save);
       //Disable IMPS/BMPS as we do not want the device to enter any power
       //save mode during shutdown
       sme_DisablePowerSave(pHddCtx->hHal, ePMC_IDLE_MODE_POWER_SAVE);
@@ -12985,6 +14637,7 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
       init_completion(&powerContext.completion);
       powerContext.magic = POWER_CONTEXT_MAGIC;
 
+      TRACK_UNLOAD_STATUS(unload_req_full_power);
       halStatus = sme_RequestFullPower(pHddCtx->hHal, hdd_full_power_callback,
             &powerContext, eSME_FULL_PWR_NEEDED_BY_HDD);
 
@@ -13031,18 +14684,22 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
        * Powersave Offload Case
        * Disable Idle Power Save Mode
        */
+      TRACK_UNLOAD_STATUS(unload_set_idle_ps_config);
       hdd_set_idle_ps_config(pHddCtx, FALSE);
    }
 
+   TRACK_UNLOAD_STATUS(unload_debugfs_exit);
    hdd_debugfs_exit(pHddCtx);
 
    // Unregister the Net Device Notifier
+   TRACK_UNLOAD_STATUS(unload_netdev_notifier);
    unregister_netdevice_notifier(&hdd_netdev_notifier);
 
    /* Stop all adapters, this will ensure the termination of active
     * connections on the interface. Make sure the vos_scheduler is
     * still available to handle those control messages
     */
+   TRACK_UNLOAD_STATUS(unload_stop_all_adapter);
    hdd_stop_all_adapters( pHddCtx );
 
 #ifdef QCA_PKT_PROTO_TRACE
@@ -13050,6 +14707,7 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
        vos_pkt_proto_trace_close();
 #endif
 
+   TRACK_UNLOAD_STATUS(unload_vos_stop);
    //Stop all the modules
    vosStatus = vos_stop( pVosContext );
    if (!VOS_IS_STATUS_SUCCESS(vosStatus))
@@ -13062,6 +14720,7 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
    //This requires pMac access, Call this before vos_close().
    hdd_unregister_mcast_bcast_filter(pHddCtx);
 
+   TRACK_UNLOAD_STATUS(unload_vos_sched_close);
    //Close the scheduler before calling vos_close to make sure no thread is
    // scheduled after the each module close is called i.e after all the data
    // structures are freed.
@@ -13071,15 +14730,14 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
          "%s: Failed to close VOSS Scheduler",__func__);
       VOS_ASSERT( VOS_IS_STATUS_SUCCESS( vosStatus ) );
    }
-#ifdef WLAN_FEATURE_HOLD_RX_WAKELOCK
    /* Destroy the wake lock */
    vos_wake_lock_destroy(&pHddCtx->rx_wake_lock);
-#endif
    /* Destroy the wake lock */
    vos_wake_lock_destroy(&pHddCtx->sap_wake_lock);
 
    hdd_hostapd_channel_wakelock_deinit(pHddCtx);
 
+  TRACK_UNLOAD_STATUS(unload_vos_nv_close);
   vosStatus = vos_nv_close();
   if (!VOS_IS_STATUS_SUCCESS(vosStatus))
   {
@@ -13088,29 +14746,37 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
      VOS_ASSERT( VOS_IS_STATUS_SUCCESS( vosStatus ) );
   }
 
+   TRACK_UNLOAD_STATUS(unload_vos_close);
    //Close VOSS
    //This frees pMac(HAL) context. There should not be any call that requires pMac access after this.
    vos_close(pVosContext);
 
+   TRACK_UNLOAD_STATUS(unload_deinit_greep_ap);
    hdd_wlan_green_ap_deinit(pHddCtx);
 
    //Close Watchdog
    if (pConfig && pConfig->fIsLogpEnabled)
       vos_watchdog_close(pVosContext);
 
-   if (VOS_FTM_MODE != hdd_get_conparam())
+   if (VOS_FTM_MODE != hdd_get_conparam()) {
+       TRACK_UNLOAD_STATUS(unload_logging_sock_deactivate_svc);
        wlan_hdd_logging_sock_deactivate_svc(pHddCtx);
+   }
 
 #ifdef WLAN_FEATURE_LPSS
+   TRACK_UNLOAD_STATUS(unload_hdd_send_status_pkg);
    wlan_hdd_send_status_pkg(NULL, NULL, 0, 0);
 #endif
-
+   TRACK_UNLOAD_STATUS(unload_close_cesium_nl_sock);
    hdd_close_cesium_nl_sock();
 
+   TRACK_UNLOAD_STATUS(unload_runtime_suspend_deinit);
    hdd_runtime_suspend_deinit(pHddCtx);
+   TRACK_UNLOAD_STATUS(unload_close_all_adapters);
    hdd_close_all_adapters( pHddCtx );
 
 #ifdef IPA_OFFLOAD
+   TRACK_UNLOAD_STATUS(unload_ipa_cleanup);
    hdd_ipa_cleanup(pHddCtx);
 #endif
 
@@ -13121,11 +14787,13 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
                                            __func__);
    }
 
+   TRACK_UNLOAD_STATUS(unload_flush_roc_work);
    /* Free up RoC request queue and flush workqueue */
    vos_flush_work(&pHddCtx->rocReqWork);
    hdd_list_destroy(&pHddCtx->hdd_roc_req_q);
 
 free_hdd_ctx:
+   TRACK_UNLOAD_STATUS(unload_nl_srv_exit);
    nl_srv_exit();
 
    /* Free up dynamically allocated members inside HDD Adapter */
@@ -13136,20 +14804,25 @@ free_hdd_ctx:
 
    wlan_hdd_deinit_chan_info(pHddCtx);
    wlan_hdd_deinit_tx_rx_histogram(pHddCtx);
+   hdd_free_probe_req_ouis(pHddCtx);
+   TRACK_UNLOAD_STATUS(unload_wiphy_unregister);
    wiphy_unregister(wiphy) ;
    wlan_hdd_cfg80211_deinit(wiphy);
+   TRACK_UNLOAD_STATUS(unload_wiphy_free);
    wiphy_free(wiphy) ;
    if (hdd_is_ssr_required())
    {
 #ifdef MSM_PLATFORM
 #ifdef CONFIG_CNSS
        /* WDI timeout had happened during unload, so SSR is needed here */
+       TRACK_UNLOAD_STATUS(unload_subsystem_restart);
        subsystem_restart("wcnss");
 #endif
 #endif
        msleep(5000);
    }
    hdd_set_ssr_required (VOS_FALSE);
+   TRACK_UNLOAD_STATUS(unload_finish);
 }
 
 void __hdd_wlan_exit(void)
@@ -13202,7 +14875,6 @@ void __hdd_wlan_exit(void)
 
    hdd_close_tx_queues(pHddCtx);
    //Do all the cleanup before deregistering the driver
-   memdump_deinit();
    hdd_driver_memdump_deinit();
    hdd_wlan_exit(pHddCtx);
    EXIT();
@@ -13392,9 +15064,7 @@ void hdd_wlan_wakelock_destroy(void)
 void wlan_hdd_wakelocks_destroy(hdd_context_t *hdd_ctx)
 {
 	if (hdd_ctx) {
-#ifdef WLAN_FEATURE_HOLD_RX_WAKELOCK
 		vos_wake_lock_destroy(&hdd_ctx->rx_wake_lock);
-#endif
 		vos_wake_lock_destroy(&hdd_ctx->sap_wake_lock);
 		hdd_hostapd_channel_wakelock_deinit(hdd_ctx);
 	}
@@ -13564,6 +15234,24 @@ VOS_STATUS hdd_set_sme_chan_list(hdd_context_t *hdd_ctx)
                               hdd_ctx->reg.cc_src);
 }
 
+void hdd_set_dfs_regdomain(hdd_context_t *phddctx, bool restore)
+{
+    if(!restore) {
+        if (vos_nv_get_dfs_region(&phddctx->hdd_dfs_regdomain)) {
+             hddLog(VOS_TRACE_LEVEL_FATAL,
+                    "%s: unable to retrieve dfs region from hdd",
+                    __func__);
+        }
+    }
+    else {
+        if (vos_nv_set_dfs_region(phddctx->hdd_dfs_regdomain)) {
+             hddLog(VOS_TRACE_LEVEL_FATAL,
+                    "%s: unable to set dfs region",
+                    __func__);
+        }
+    }
+}
+
 /**
  * hdd_is_5g_supported() - to know if ini configuration supports 5GHz
  * @pHddCtx: Pointer to the hdd context
@@ -13624,13 +15312,6 @@ static VOS_STATUS wlan_hdd_reg_init(hdd_context_t *hdd_ctx)
     wiphy->wowlan.pattern_max_len = WOW_MAX_PATTERN_SIZE;
 #endif
 
-   /* registration of wiphy dev with cfg80211 */
-   if (0 > wlan_hdd_cfg80211_register(wiphy))
-   {
-      hddLog(VOS_TRACE_LEVEL_ERROR,"%s: wiphy register failed", __func__);
-      status = VOS_STATUS_E_FAILURE;
-   }
-
    return status;
 }
 
@@ -13653,6 +15334,7 @@ static void hdd_set_bundle_require(uint16_t session_id, hdd_context_t *hdd_ctx,
 }
 #endif
 
+
 void hdd_cnss_request_bus_bandwidth(hdd_context_t *pHddCtx,
         const uint64_t tx_packets, const uint64_t rx_packets)
 {
@@ -13754,7 +15436,6 @@ void hdd_cnss_request_bus_bandwidth(hdd_context_t *pHddCtx,
     pHddCtx->hdd_txrx_hist_idx &= NUM_TX_RX_HISTOGRAM_MASK;
 }
 
-#define HDD_BW_GET_DIFF(x, y) ((x) >= (y) ? (x) - (y) : (ULONG_MAX - (y) + (x)))
 static void hdd_bus_bw_compute_cbk(void *priv)
 {
     hdd_context_t *pHddCtx = (hdd_context_t *)priv;
@@ -13782,6 +15463,9 @@ static void hdd_bus_bw_compute_cbk(void *priv)
 
         if ((pAdapter = pAdapterNode->pAdapter) == NULL)
             continue;
+        /* Validate magic so we don't end up accessing a freed adapter.*/
+        if (pAdapter->magic != WLAN_HDD_ADAPTER_MAGIC)
+            continue;
 
 #ifdef IPA_UC_OFFLOAD
         if (NULL == pValidAdapter)
@@ -13825,6 +15509,7 @@ static void hdd_bus_bw_compute_cbk(void *priv)
         }
 
         hdd_set_bundle_require(pAdapter->sessionId, pHddCtx, tx_bytes);
+        hdd_set_driver_del_ack_enable(pAdapter->sessionId, pHddCtx, rx_packets);
 
         total_rx += pAdapter->stats.rx_packets;
         total_tx += pAdapter->stats.tx_packets;
@@ -14346,36 +16031,6 @@ static int wlan_hdd_set_wakeup_gpio(hdd_context_t *hddctx)
 }
 
 /**
- * hdd_tsf_init() - Initialize the TSF synchronization interface
- * @hdd_ctx: HDD global context
- *
- * When TSF synchronization via GPIO is supported by the driver and
- * has been enabled in the configuration file, this function plumbs
- * the GPIO value down to firmware via SME.
- *
- * Return: None
- */
-#ifdef WLAN_FEATURE_TSF
-static void hdd_tsf_init(hdd_context_t *hdd_ctx)
-{
-	eHalStatus hal_status;
-
-	if (hdd_ctx->cfg_ini->tsf_gpio_pin == TSF_GPIO_PIN_INVALID)
-		return;
-
-	hal_status = sme_set_tsf_gpio(hdd_ctx->hHal,
-				      hdd_ctx->cfg_ini->tsf_gpio_pin);
-	if (eHAL_STATUS_SUCCESS != hal_status)
-		hddLog(LOGE, FL("set tsf GPIO failed, status: %d"),
-		       hal_status);
-}
-#else
-static void hdd_tsf_init(hdd_context_t *hdd_ctx)
-{
-}
-#endif
-
-/**
  * hdd_state_info_dump() - prints state information of hdd layer
  * @buf: buffer pointer
  * @size: size of buffer to be filled
@@ -14424,7 +16079,7 @@ static void hdd_state_info_dump(char **buf_ptr, uint16_t *size)
 		if (adapter->dev)
 			len += scnprintf(buf + len, *size - len,
 				"\n device name: %s", adapter->dev->name);
-			len += scnprintf(buf + len, *size - len,
+		len += scnprintf(buf + len, *size - len,
 				"\n device_mode: %d", adapter->device_mode);
 		switch (adapter->device_mode) {
 		case WLAN_HDD_INFRA_STATION:
@@ -14561,15 +16216,60 @@ static int hdd_initialize_mac_address(hdd_context_t *hdd_ctx)
 
 	hddLog(LOGW, FL("Can't update MAC via platform driver ret: %d"), ret);
 
-	status = hdd_update_mac_config(hdd_ctx);
-	if (status != VOS_STATUS_SUCCESS) {
-		hddLog(LOGW,
-		      FL("Failed to update MAC from %s status: %d"),
-		      WLAN_MAC_FILE, status);
-		return -EIO;
+	if (!hdd_ctx->cfg_ini->skip_mac_config) {
+		status = hdd_update_mac_config(hdd_ctx);
+		if (status != VOS_STATUS_SUCCESS) {
+			hddLog(LOGW,
+			      FL("Failed to update MAC from %s status: %d"),
+			      WLAN_MAC_FILE, status);
+			return -EIO;
+		}
 	}
 	return 0;
 }
+
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+static VOS_STATUS hdd_init_thermal_ctx(hdd_context_t *pHddCtx)
+{
+	pHddCtx->system_suspended = false;
+	pHddCtx->thermal_suspend_state = HDD_WLAN_THERMAL_ACTIVE;
+	spin_lock_init(&pHddCtx->thermal_suspend_lock);
+	INIT_DELAYED_WORK(&pHddCtx->thermal_suspend_work, hdd_thermal_suspend_work);
+	pHddCtx->thermal_suspend_wq = create_singlethread_workqueue("thermal_wq");
+	if (!pHddCtx->thermal_suspend_wq)
+		return VOS_STATUS_E_INVAL;
+	return VOS_STATUS_SUCCESS;
+}
+
+static void hdd_get_thermal_shutdown_ini_param(tSmeThermalParams   *pthermalParam,
+						hdd_context_t    *pHddCtx)
+{
+	pthermalParam->thermal_shutdown_enabled =
+	  pHddCtx->cfg_ini->thermal_shutdown_enabled;
+	pthermalParam->thermal_shutdown_auto_enabled =
+	  pHddCtx->cfg_ini->thermal_shutdown_auto_enabled;
+	pthermalParam->thermal_resume_threshold =
+	  pHddCtx->cfg_ini->thermal_resume_threshold;
+	pthermalParam->thermal_warning_threshold =
+	  pHddCtx->cfg_ini->thermal_warning_threshold;
+	pthermalParam->thermal_suspend_threshold =
+	  pHddCtx->cfg_ini->thermal_suspend_threshold;
+	pthermalParam->thermal_sample_rate =
+		pHddCtx->cfg_ini->thermal_sample_rate;
+}
+#else
+static inline VOS_STATUS hdd_init_thermal_ctx(hdd_context_t *pHddCtx)
+{
+	return VOS_STATUS_SUCCESS;
+}
+
+static inline void hdd_get_thermal_shutdown_ini_param(tSmeThermalParams   *pthermalParam,
+						hdd_context_t    *pHddCtx)
+{
+	return;
+}
+
+#endif
 /**---------------------------------------------------------------------------
 
   \brief hdd_wlan_startup() - HDD init function
@@ -14611,6 +16311,7 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
    adf_os_device_t adf_ctx;
 #endif
    int set_value;
+   struct sme_5g_band_pref_params band_pref_params;
 
    ENTER();
 
@@ -14638,6 +16339,11 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
 
    pHddCtx->wiphy = wiphy;
    pHddCtx->isLoadInProgress = TRUE;
+
+   status = hdd_init_thermal_ctx(pHddCtx);
+   if (VOS_STATUS_SUCCESS != status)
+        goto err_free_hdd_context;
+
    pHddCtx->ioctl_scan_mode = eSIR_ACTIVE_SCAN;
    vos_set_wakelock_logging(false);
 
@@ -14668,10 +16374,21 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
    ((VosContextType*)(pVosContext))->pHDDContext = (v_VOID_t*)pHddCtx;
 
    pHddCtx->parent_dev = dev;
+   pHddCtx->last_scan_reject_session_id = 0xFF;
+   pHddCtx->last_scan_reject_reason = 0;
+   pHddCtx->last_scan_reject_timestamp = 0;
+   pHddCtx->scan_reject_cnt = 0;
 
    init_completion(&pHddCtx->full_pwr_comp_var);
    init_completion(&pHddCtx->standby_comp_var);
    init_completion(&pHddCtx->req_bmps_comp_var);
+   init_completion(&pHddCtx->mc_sus_event_var);
+   init_completion(&pHddCtx->tx_sus_event_var);
+   init_completion(&pHddCtx->rx_sus_event_var);
+   init_completion(&pHddCtx->ready_to_suspend);
+#ifdef WLAN_FEATURE_EXTWOW_SUPPORT
+      init_completion(&pHddCtx->ready_to_extwow);
+#endif
    hdd_init_bpf_completion();
 #ifdef FEATURE_WLAN_EXTSCAN
    init_completion(&pHddCtx->ext_scan_context.response_event);
@@ -14679,6 +16396,8 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
 
    hdd_init_ll_stats_ctx(pHddCtx);
 
+   init_completion(&pHddCtx->chain_rssi_context.response_event);
+
    spin_lock_init(&pHddCtx->schedScan_lock);
 
    hdd_list_init( &pHddCtx->hddAdapters, MAX_NUMBER_OF_ADAPTERS );
@@ -14719,6 +16438,31 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
       goto err_config;
    }
 
+   /* If IPA HW is not existing, disable offload from INI */
+   if (!hdd_ipa_is_present(pHddCtx))
+      hdd_ipa_reset_ipaconfig(pHddCtx, 0);
+
+   if (pHddCtx->cfg_ini->probe_req_ie_whitelist)
+   {
+      if (hdd_validate_prb_req_ie_bitmap(pHddCtx))
+      {
+         /* parse ini string probe req oui */
+         status = hdd_parse_probe_req_ouis(pHddCtx);
+         if (VOS_STATUS_SUCCESS != status)
+         {
+            hddLog(LOGE, FL("Error parsing probe req ouis - Ignoring them"
+                            " disabling white list"));
+            pHddCtx->cfg_ini->probe_req_ie_whitelist = false;
+         }
+      }
+      else
+      {
+         hddLog(LOGE, FL("invalid probe req ie bitmap and ouis,"
+                         " disabling white list"));
+         pHddCtx->cfg_ini->probe_req_ie_whitelist = false;
+      }
+   }
+
    if (0 == pHddCtx->cfg_ini->max_go_peers)
       pHddCtx->cfg_ini->max_go_peers = pHddCtx->cfg_ini->max_sap_peers;
 
@@ -14854,129 +16598,169 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
    }
    vos_set_radio_index(pHddCtx->radio_index);
 
-   if (VOS_FTM_MODE == hdd_get_conparam())
-       goto ftm_processing;
-
-   //Open watchdog module
-   if(pHddCtx->cfg_ini->fIsLogpEnabled)
-   {
-      status = vos_watchdog_open(pVosContext,
-         &((VosContextType*)pVosContext)->vosWatchdog, sizeof(VosWatchdogContext));
+   if (VOS_FTM_MODE == hdd_get_conparam()) {
+      if ( VOS_STATUS_SUCCESS != wlan_hdd_ftm_open(pHddCtx) )
+      {
+          hddLog(VOS_TRACE_LEVEL_FATAL,
+                 "%s: wlan_hdd_ftm_open Failed",__func__);
+          goto err_nl_srv;
+      }
+      if (VOS_STATUS_SUCCESS != hdd_ftm_start(pHddCtx))
+      {
+          hddLog(VOS_TRACE_LEVEL_FATAL,"%s: hdd_ftm_start Failed",__func__);
+          goto err_free_ftm_open;
+      }
+   } else {
 
-      if(!VOS_IS_STATUS_SUCCESS( status ))
+      //Open watchdog module
+      if(pHddCtx->cfg_ini->fIsLogpEnabled)
       {
-         hddLog(VOS_TRACE_LEVEL_FATAL,"%s: vos_watchdog_open failed",__func__);
-         goto err_nl_srv;
+         status = vos_watchdog_open(pVosContext,
+            &((VosContextType*)pVosContext)->vosWatchdog,
+            sizeof(VosWatchdogContext));
+
+         if(!VOS_IS_STATUS_SUCCESS( status ))
+         {
+            hddLog(VOS_TRACE_LEVEL_FATAL,
+                   "%s: vos_watchdog_open failed",__func__);
+            goto err_nl_srv;
+         }
       }
-   }
 
-   pHddCtx->isLogpInProgress = FALSE;
-   vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, FALSE);
+      pHddCtx->isLogpInProgress = FALSE;
+      vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, FALSE);
 
-   status = vos_nv_open();
-   if (!VOS_IS_STATUS_SUCCESS(status))
-   {
-      /* NV module cannot be initialized */
-      hddLog( VOS_TRACE_LEVEL_FATAL,
-            "%s: vos_nv_open failed", __func__);
-      goto err_wdclose;
-   }
+      status = vos_nv_open();
+      if (!VOS_IS_STATUS_SUCCESS(status))
+      {
+         /* NV module cannot be initialized */
+         hddLog( VOS_TRACE_LEVEL_FATAL,
+               "%s: vos_nv_open failed", __func__);
+         goto err_wdclose;
+      }
 
-   hdd_wlan_green_ap_init(pHddCtx);
+      hdd_wlan_green_ap_init(pHddCtx);
 
-   status = vos_open( &pVosContext, 0);
-   if ( !VOS_IS_STATUS_SUCCESS( status ))
-   {
-      hddLog(VOS_TRACE_LEVEL_FATAL, "%s: vos_open failed", __func__);
-      goto err_vos_nv_close;
-   }
+      status = vos_open( &pVosContext, 0);
+      if ( !VOS_IS_STATUS_SUCCESS( status ))
+      {
+         hddLog(VOS_TRACE_LEVEL_FATAL, "%s: vos_open failed", __func__);
+         goto err_vos_nv_close;
+      }
 
 #if      !defined(REMOVE_PKT_LOG)
-   hif_init_pdev_txrx_handle(hif_sc,
-                             vos_get_context(VOS_MODULE_ID_TXRX, pVosContext));
+      hif_init_pdev_txrx_handle(hif_sc,
+                            vos_get_context(VOS_MODULE_ID_TXRX, pVosContext));
 #endif
 
-   pHddCtx->hHal = (tHalHandle)vos_get_context( VOS_MODULE_ID_SME, pVosContext );
+      pHddCtx->hHal = (tHalHandle)vos_get_context(VOS_MODULE_ID_SME,
+                                                  pVosContext );
 
-   if ( NULL == pHddCtx->hHal )
-   {
-      hddLog(VOS_TRACE_LEVEL_FATAL, "%s: HAL context is null", __func__);
-      goto err_vosclose;
-   }
+      if ( NULL == pHddCtx->hHal )
+      {
+         hddLog(VOS_TRACE_LEVEL_FATAL, "%s: HAL context is null", __func__);
+         goto err_vosclose;
+      }
 
-   status = vos_preStart( pHddCtx->pvosContext );
-   if ( !VOS_IS_STATUS_SUCCESS( status ) )
-   {
-      hddLog(VOS_TRACE_LEVEL_FATAL, "%s: vos_preStart failed", __func__);
-      goto err_vosclose;
-   }
+      status = vos_preStart( pHddCtx->pvosContext );
+      if ( !VOS_IS_STATUS_SUCCESS( status ) )
+      {
+         hddLog(VOS_TRACE_LEVEL_FATAL, "%s: vos_preStart failed", __func__);
+         goto err_vosclose;
+      }
 
-   wlan_hdd_update_wiphy(wiphy, pHddCtx);
+      wlan_hdd_update_wiphy(wiphy, pHddCtx);
 
-   if (sme_IsFeatureSupportedByFW(DOT11AC)) {
-      hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "%s: support 11ac", __func__);
-   } else {
-      hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "%s: not support 11ac", __func__);
-      if ((pHddCtx->cfg_ini->dot11Mode == eHDD_DOT11_MODE_11ac_ONLY)||
-          (pHddCtx->cfg_ini->dot11Mode == eHDD_DOT11_MODE_11ac)) {
+      if (sme_IsFeatureSupportedByFW(DOT11AC)) {
+         hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "%s: support 11ac", __func__);
+      } else {
+         hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "%s: not support 11ac", __func__);
+         if ((pHddCtx->cfg_ini->dot11Mode == eHDD_DOT11_MODE_11ac_ONLY)||
+             (pHddCtx->cfg_ini->dot11Mode == eHDD_DOT11_MODE_11ac)) {
 
-          pHddCtx->cfg_ini->dot11Mode = eHDD_DOT11_MODE_11n;
-          pHddCtx->cfg_ini->sap_p2p_11ac_override = 0;
+            pHddCtx->cfg_ini->dot11Mode = eHDD_DOT11_MODE_11n;
+            pHddCtx->cfg_ini->sap_p2p_11ac_override = 0;
+         }
       }
-   }
 
-   if (0 != wlan_hdd_set_wow_pulse(pHddCtx, true)) {
-      hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Failed to set wow pulse", __func__);
-   }
+      if (0 != wlan_hdd_set_wow_pulse(pHddCtx, true)) {
+         hddLog(VOS_TRACE_LEVEL_ERROR,
+                "%s: Failed to set wow pulse", __func__);
+      }
 
-   if ((pHddCtx->cfg_ini->host_wakeup_gpio !=
-        CFG_HOST_WAKEUP_GPIO_DEFAULT) ||
-       (pHddCtx->cfg_ini->target_wakeup_gpio !=
-        CFG_TARGET_WAKEUP_GPIO_DEFAULT)) {
+      if ((pHddCtx->cfg_ini->host_wakeup_gpio !=
+				CFG_HOST_WAKEUP_GPIO_DEFAULT) ||
+          (pHddCtx->cfg_ini->target_wakeup_gpio !=
+				CFG_HOST_WAKEUP_GPIO_DEFAULT)) {
           if (0 != wlan_hdd_set_wakeup_gpio(pHddCtx)) {
              hddLog(VOS_TRACE_LEVEL_ERROR,
                 "%s: Failed to set wakeup gpio", __func__);
           }
-   }
+      }
 
-   /* Set 802.11p config
-    * TODO-OCB: This has been temporarily added here to ensure this paramter
-    * is set in CSR when we init the channel list. This should be removed
-    * once the 5.9 GHz channels are added to the regulatory domain.
-    */
-   hdd_set_dot11p_config(pHddCtx);
+      /* Set 802.11p config
+       * TODO-OCB: This has been temporarily added here to ensure this paramter
+       * is set in CSR when we init the channel list. This should be removed
+       * once the 5.9 GHz channels are added to the regulatory domain.
+       */
+      hdd_set_dot11p_config(pHddCtx);
 
-   if (0 == enable_dfs_chan_scan || 1 == enable_dfs_chan_scan)
-   {
-      pHddCtx->cfg_ini->enableDFSChnlScan = enable_dfs_chan_scan;
-      hddLog(VOS_TRACE_LEVEL_INFO, "%s: module enable_dfs_chan_scan set to %d",
-             __func__, enable_dfs_chan_scan);
+      if (0 == enable_dfs_chan_scan || 1 == enable_dfs_chan_scan)
+      {
+         pHddCtx->cfg_ini->enableDFSChnlScan = enable_dfs_chan_scan;
+         hddLog(VOS_TRACE_LEVEL_INFO,
+                "%s: module enable_dfs_chan_scan set to %d",
+                __func__, enable_dfs_chan_scan);
+      }
+      if (0 == enable_11d || 1 == enable_11d)
+      {
+         pHddCtx->cfg_ini->Is11dSupportEnabled = enable_11d;
+         hddLog(VOS_TRACE_LEVEL_INFO, "%s: module enable_11d set to %d",
+                __func__, enable_11d);
+      }
+
+      /* Note that the vos_preStart() sequence triggers the cfg download.
+         The cfg download must occur before we update the SME config
+         since the SME config operation must access the cfg database */
+      status = hdd_set_sme_config( pHddCtx );
+
+      if ( VOS_STATUS_SUCCESS != status )
+      {
+         hddLog(VOS_TRACE_LEVEL_FATAL, "%s: Failed hdd_set_sme_config",
+                __func__);
+         goto err_vosclose;
+      }
+
+      status = wlan_hdd_reg_init(pHddCtx);
+      if (status != VOS_STATUS_SUCCESS) {
+         hddLog(VOS_TRACE_LEVEL_FATAL,
+                "%s: Failed to init channel list", __func__);
+         goto err_vosclose;
+      }
    }
-   if (0 == enable_11d || 1 == enable_11d)
-   {
-      pHddCtx->cfg_ini->Is11dSupportEnabled = enable_11d;
-      hddLog(VOS_TRACE_LEVEL_INFO, "%s: module enable_11d set to %d",
-             __func__, enable_11d);
+
+   /* registration of wiphy dev with cfg80211 */
+   if (0 > wlan_hdd_cfg80211_register(pHddCtx->wiphy)) {
+      hddLog(VOS_TRACE_LEVEL_ERROR,"%s: wiphy register failed", __func__);
+      status = VOS_STATUS_E_FAILURE;
+      if (VOS_FTM_MODE == hdd_get_conparam())
+         goto err_free_ftm_open;
+      else
+         goto err_vosclose;
    }
 
-   /* Note that the vos_preStart() sequence triggers the cfg download.
-      The cfg download must occur before we update the SME config
-      since the SME config operation must access the cfg database */
-   status = hdd_set_sme_config( pHddCtx );
+   if (VOS_FTM_MODE == hdd_get_conparam()) {
+      vos_set_load_unload_in_progress(VOS_MODULE_ID_VOSS, FALSE);
+      vos_set_load_in_progress(VOS_MODULE_ID_VOSS, FALSE);
+      pHddCtx->isLoadInProgress = FALSE;
 
-   if ( VOS_STATUS_SUCCESS != status )
-   {
-      hddLog(VOS_TRACE_LEVEL_FATAL, "%s: Failed hdd_set_sme_config", __func__);
-      goto err_vosclose;
+      hdd_driver_memdump_init();
+      hddLog(LOGE, FL("FTM driver loaded"));
+      wlan_comp.status = 0;
+      complete(&wlan_comp.wlan_start_comp);
+      return VOS_STATUS_SUCCESS;
    }
 
-   status = wlan_hdd_reg_init(pHddCtx);
-   if (status != VOS_STATUS_SUCCESS) {
-      hddLog(VOS_TRACE_LEVEL_FATAL,
-             "%s: Failed to init channel list", __func__);
-      goto err_vosclose;
-   }
    ret = process_wma_set_command(0, WMI_PDEV_PARAM_TX_CHAIN_MASK_1SS,
                                  pHddCtx->cfg_ini->tx_chain_mask_1ss,
                                  PDEV_CMD);
@@ -14986,6 +16770,37 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
               __func__, ret);
    }
 
+   ret = process_wma_set_command(0, WMI_PDEV_PARAM_TX_SCH_DELAY,
+                                 pHddCtx->cfg_ini->tx_sch_delay,
+                                 PDEV_CMD);
+   if (0 != ret) {
+       hddLog(VOS_TRACE_LEVEL_ERROR,
+              "%s: WMI_PDEV_PARAM_TX_SCH_DELAY failed %d",
+              __func__, ret);
+   }
+
+   if (pHddCtx->cfg_ini->sap_get_peer_info) {
+       hddLog(VOS_TRACE_LEVEL_INFO,
+              "%s Send WMI_PDEV_PARAM_PEER_STATS_INFO_ENABLE",
+              __func__);
+       ret = process_wma_set_command(0,
+                                     WMI_PDEV_PARAM_PEER_STATS_INFO_ENABLE,
+                                     pHddCtx->cfg_ini->sap_get_peer_info,
+                                     PDEV_CMD);
+       if (0 != ret) {
+           hddLog(VOS_TRACE_LEVEL_ERROR,
+                  "%s: WMI_PDEV_PARAM_PEER_STATS_INFO_ENABLE failed %d",
+                  __func__, ret);
+       }
+   }
+   ret = process_wma_set_command(0, WMI_PDEV_PARAM_ARP_AC_OVERRIDE,
+                                 pHddCtx->cfg_ini->arp_ac_category, PDEV_CMD);
+   if (0 != ret) {
+       hddLog(LOGE,
+              "%s: WMI_PDEV_PARAM_ARP_AC_OVERRIDE failed AC: %d ret: %d",
+              __func__, pHddCtx->cfg_ini->arp_ac_category, ret);
+   }
+
    status = hdd_set_sme_chan_list(pHddCtx);
    if (status != VOS_STATUS_SUCCESS) {
       hddLog(VOS_TRACE_LEVEL_FATAL,
@@ -15097,44 +16912,9 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
 
 #ifdef QCA_PKT_PROTO_TRACE
    /* Ensure pkt tracing happen only in Non FTM mode */
-   if (VOS_FTM_MODE != hdd_get_conparam())
-       vos_pkt_proto_trace_init();
+   vos_pkt_proto_trace_init();
 #endif /* QCA_PKT_PROTO_TRACE */
 
- ftm_processing:
-   if (VOS_FTM_MODE == hdd_get_conparam())
-   {
-      if ( VOS_STATUS_SUCCESS != wlan_hdd_ftm_open(pHddCtx) )
-      {
-          hddLog(VOS_TRACE_LEVEL_FATAL,"%s: wlan_hdd_ftm_open Failed",__func__);
-          goto err_nl_srv;
-      }
-#if  defined(QCA_WIFI_FTM)
-      if (hdd_ftm_start(pHddCtx))
-      {
-          hddLog(VOS_TRACE_LEVEL_FATAL,"%s: hdd_ftm_start Failed",__func__);
-          goto err_free_ftm_open;
-      }
-#endif
-
-      /* registration of wiphy dev with cfg80211 */
-      if (0 > wlan_hdd_cfg80211_register(wiphy)) {
-          hddLog(LOGE, FL("wiphy register failed"));
-          goto err_free_ftm_open;
-      }
-
-      vos_set_load_unload_in_progress(VOS_MODULE_ID_VOSS, FALSE);
-      vos_set_load_in_progress(VOS_MODULE_ID_VOSS, FALSE);
-      pHddCtx->isLoadInProgress = FALSE;
-
-      memdump_init();
-      hdd_driver_memdump_init();
-      hddLog(LOGE, FL("FTM driver loaded"));
-      wlan_comp.status = 0;
-      complete(&wlan_comp.wlan_start_comp);
-      return VOS_STATUS_SUCCESS;
-   }
-
 #if defined(CONFIG_HDD_INIT_WITH_RTNL_LOCK)
    rtnl_lock();
    rtnl_lock_enable = TRUE;
@@ -15161,7 +16941,8 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
 
 #ifdef WLAN_OPEN_P2P_INTERFACE
       /* Open P2P device interface */
-      if (pAdapter != NULL) {
+      if (pAdapter != NULL &&
+          !hdd_cfg_is_sub20_channel_width_enabled(pHddCtx)) {
          if (pHddCtx->cfg_ini->isP2pDeviceAddrAdministrated &&
              !(pHddCtx->cfg_ini->intfMacAddr[0].bytes[0] & 0x02)) {
             vos_mem_copy(pHddCtx->p2pDeviceAddress.bytes,
@@ -15382,11 +17163,9 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
    reg_netdev_notifier_done = TRUE;
 #endif
 
-#ifdef WLAN_FEATURE_HOLD_RX_WAKELOCK
    /* Initialize the wake lcok */
    vos_wake_lock_init(&pHddCtx->rx_wake_lock,
            "qcom_rx_wakelock");
-#endif
    /* Initialize the wake lcok */
    vos_wake_lock_init(&pHddCtx->sap_wake_lock,
            "qcom_sap_wakelock");
@@ -15401,6 +17180,10 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
       hdd_set_idle_ps_config(pHddCtx, TRUE);
    }
 
+   if ((pHddCtx->cfg_ini->enable_ac_txq_optimize >> 4) & 0x01)
+      sme_set_ac_txq_optimize(pHddCtx->hHal,
+                              &pHddCtx->cfg_ini->enable_ac_txq_optimize);
+
    if (pHddCtx->cfg_ini->enable_go_cts2self_for_sta)
        sme_set_cts2self_for_p2p_go(pHddCtx->hHal);
 
@@ -15438,23 +17221,14 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
        pHddCtx->cfg_ini->thermalMitigationEnable;
    thermalParam.smeThrottlePeriod = pHddCtx->cfg_ini->throttlePeriod;
 
-   thermalParam.sme_throttle_duty_cycle_2g_tbl[0]=
-       pHddCtx->cfg_ini->throttle_dutycycle_level0_2g;
-   thermalParam.sme_throttle_duty_cycle_2g_tbl[1]=
-       pHddCtx->cfg_ini->throttle_dutycycle_level1_2g;
-   thermalParam.sme_throttle_duty_cycle_2g_tbl[2]=
-       pHddCtx->cfg_ini->throttle_dutycycle_level2_2g;
-   thermalParam.sme_throttle_duty_cycle_2g_tbl[3]=
-       pHddCtx->cfg_ini->throttle_dutycycle_level3_2g;
-
-   thermalParam.sme_throttle_duty_cycle_5g_tbl[0]=
-       pHddCtx->cfg_ini->throttle_dutycycle_level0_5g;
-   thermalParam.sme_throttle_duty_cycle_5g_tbl[1]=
-       pHddCtx->cfg_ini->throttle_dutycycle_level1_5g;
-   thermalParam.sme_throttle_duty_cycle_5g_tbl[2]=
-       pHddCtx->cfg_ini->throttle_dutycycle_level2_5g;
-   thermalParam.sme_throttle_duty_cycle_5g_tbl[3]=
-       pHddCtx->cfg_ini->throttle_dutycycle_level3_5g;
+   thermalParam.sme_throttle_duty_cycle_tbl[0]=
+       pHddCtx->cfg_ini->throttle_dutycycle_level0;
+   thermalParam.sme_throttle_duty_cycle_tbl[1]=
+       pHddCtx->cfg_ini->throttle_dutycycle_level1;
+   thermalParam.sme_throttle_duty_cycle_tbl[2]=
+       pHddCtx->cfg_ini->throttle_dutycycle_level2;
+   thermalParam.sme_throttle_duty_cycle_tbl[3]=
+       pHddCtx->cfg_ini->throttle_dutycycle_level3;
 
    thermalParam.smeThermalLevels[0].smeMinTempThreshold =
        pHddCtx->cfg_ini->thermalTempMinLevel0;
@@ -15473,6 +17247,8 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
    thermalParam.smeThermalLevels[3].smeMaxTempThreshold =
        pHddCtx->cfg_ini->thermalTempMaxLevel3;
 
+   hdd_get_thermal_shutdown_ini_param(&thermalParam, pHddCtx);
+
    if (eHAL_STATUS_SUCCESS != sme_InitThermalInfo(pHddCtx->hHal,thermalParam))
    {
        hddLog(VOS_TRACE_LEVEL_ERROR,
@@ -15483,6 +17259,9 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
    sme_add_set_thermal_level_callback(pHddCtx->hHal,
                      (tSmeSetThermalLevelCallback)hdd_set_thermal_level_cb);
 
+   sme_add_thermal_temperature_ind_callback(pHddCtx->hHal,
+                    (tSmeThermalTempIndCb)hdd_thermal_temp_ind_event_cb);
+
    /* Bad peer tx flow control */
    wlan_hdd_bad_peer_txctl(pHddCtx);
 
@@ -15504,7 +17283,8 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
                "%s: Error setting txlimit in sme", __func__);
    }
 
-   hdd_tsf_init(pHddCtx);
+   vos_timer_init(&pHddCtx->tdls_source_timer, VOS_TIMER_TYPE_SW,
+                  wlan_hdd_change_tdls_mode, (void *)pHddCtx);
 
 #ifdef FEATURE_BUS_BANDWIDTH
    spin_lock_init(&pHddCtx->bus_bw_lock);
@@ -15521,12 +17301,11 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
     sme_ExtScanRegisterCallback(pHddCtx->hHal,
                                 wlan_hdd_cfg80211_extscan_callback);
 #endif /* FEATURE_WLAN_EXTSCAN */
+    sme_chain_rssi_register_callback(pHddCtx->hHal,
+                                wlan_hdd_cfg80211_chainrssi_callback);
     sme_set_rssi_threshold_breached_cb(pHddCtx->hHal, hdd_rssi_threshold_breached);
-#ifdef WLAN_FEATURE_LINK_LAYER_STATS
-   wlan_hdd_cfg80211_link_layer_stats_init(pHddCtx);
-#endif
-
-   wlan_hdd_tsf_init(pHddCtx);
+    wlan_hdd_cfg80211_link_layer_stats_init(pHddCtx);
+    wlan_hdd_tsf_init(pHddCtx);
 
 #ifdef WLAN_FEATURE_LPSS
    wlan_hdd_send_all_scan_intf_info(pHddCtx);
@@ -15588,16 +17367,40 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
    vos_set_load_unload_in_progress(VOS_MODULE_ID_VOSS, FALSE);
    vos_set_load_in_progress(VOS_MODULE_ID_VOSS, FALSE);
 
+   if (pHddCtx->cfg_ini->fIsLogpEnabled) {
+       vos_wdthread_init_timer_work(vos_process_wd_timer);
+       /* Initialize the timer to detect thread stuck issues */
+       vos_thread_stuck_timer_init(
+               &((VosContextType*)pVosContext)->vosWatchdog);
+   }
+
    if (pHddCtx->cfg_ini->enable_dynamic_sta_chainmask)
       hdd_decide_dynamic_chain_mask(pHddCtx,
                             HDD_ANTENNA_MODE_1X1);
-   memdump_init();
+
    hdd_driver_memdump_init();
+
    if (pHddCtx->cfg_ini->goptimize_chan_avoid_event) {
        hal_status = sme_enable_disable_chanavoidind_event(pHddCtx->hHal, 0);
        if (eHAL_STATUS_SUCCESS != hal_status)
            hddLog(LOGE, FL("Failed to disable Chan Avoidance Indcation"));
    }
+   if (pHddCtx->cfg_ini->enable_5g_band_pref) {
+        band_pref_params.rssi_boost_threshold_5g =
+                                  pHddCtx->cfg_ini->rssi_boost_threshold_5g;
+        band_pref_params.rssi_boost_factor_5g =
+                                  pHddCtx->cfg_ini->rssi_boost_factor_5g;
+        band_pref_params.max_rssi_boost_5g =
+                                  pHddCtx->cfg_ini->max_rssi_boost_5g;
+        band_pref_params.rssi_penalize_threshold_5g =
+                                  pHddCtx->cfg_ini->rssi_penalize_threshold_5g;
+        band_pref_params.rssi_penalize_factor_5g =
+                                  pHddCtx->cfg_ini->rssi_penalize_factor_5g;
+        band_pref_params.max_rssi_penalize_5g =
+                                  pHddCtx->cfg_ini->max_rssi_penalize_5g;
+        sme_set_5g_band_pref(pHddCtx->hHal, &band_pref_params);
+   }
+
 
    if (pHddCtx->cfg_ini->sifs_burst_duration) {
        set_value = (SIFS_BURST_DUR_MULTIPLIER) *
@@ -15608,6 +17411,26 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
                                           set_value, PDEV_CMD);
    }
 
+   if (pHddCtx->cfg_ini->max_mpdus_inampdu) {
+       set_value = pHddCtx->cfg_ini->max_mpdus_inampdu;
+       process_wma_set_command(0, (int)WMI_PDEV_PARAM_MAX_MPDUS_IN_AMPDU,
+                                      set_value, PDEV_CMD);
+   }
+
+   if (pHddCtx->cfg_ini->enable_rts_sifsbursting) {
+       set_value = pHddCtx->cfg_ini->enable_rts_sifsbursting;
+       process_wma_set_command(0, (int)WMI_PDEV_PARAM_ENABLE_RTS_SIFS_BURSTING,
+                                      set_value, PDEV_CMD);
+
+   }
+
+   if (hdd_wlan_enable_egap(pHddCtx))
+        hddLog(LOGE, FL("enhance green ap is not enabled"));
+
+   /* set chip power save failure detected callback */
+   sme_set_chip_pwr_save_fail_cb(pHddCtx->hHal,
+                                 hdd_chip_pwr_save_fail_detected_cb);
+
    wlan_comp.status = 0;
    complete(&wlan_comp.wlan_start_comp);
    goto success;
@@ -15707,8 +17530,10 @@ err_histogram:
 
 err_free_hdd_context:
    /* wiphy_free() will free the HDD context so remove global reference */
-   if (pVosContext)
+   if (pVosContext) {
+      hdd_free_probe_req_ouis(pHddCtx);
       ((VosContextType*)(pVosContext))->pHDDContext = NULL;
+   }
 
    wiphy_free(wiphy) ;
    //kfree(wdev) ;
@@ -15777,6 +17602,51 @@ int hdd_hif_register_driver(void)
 	return wlan_comp.status;
 }
 
+#ifdef TIMER_MANAGER
+static inline void hdd_timer_exit(void)
+{
+	vos_timer_exit();
+}
+#else
+static inline void hdd_timer_exit(void)
+{
+}
+#endif
+
+#ifdef MEMORY_DEBUG
+static inline void hdd_mem_exit(void)
+{
+	adf_net_buf_debug_exit();
+	vos_mem_exit();
+}
+#else
+static inline void hdd_mem_exit(void)
+{
+}
+#endif
+
+#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
+static inline void hdd_logging_sock_deinit_svc(void)
+{
+	wlan_logging_sock_deinit_svc();
+}
+#else
+static inline void hdd_logging_sock_deinit_svc(void)
+{
+}
+#endif
+
+static int hdd_register_fail_clean_up(v_CONTEXT_t vos_context)
+{
+	hif_unregister_driver();
+	vos_preClose(&vos_context);
+	hdd_timer_exit();
+	hdd_mem_exit();
+	hdd_logging_sock_deinit_svc();
+
+	return -ENODEV;
+}
+
 /**---------------------------------------------------------------------------
 
   \brief hdd_driver_init() - Core Driver Init Function
@@ -15810,6 +17680,7 @@ static int hdd_driver_init( void)
 
 #ifdef MEMORY_DEBUG
       vos_mem_init();
+      adf_net_buf_debug_init();
 #endif
 
    hdd_wlan_wakelock_create();
@@ -15836,9 +17707,9 @@ static int hdd_driver_init( void)
    do {
 
 #ifndef MODULE
-      /* For statically linked driver, call hdd_set_conparam to update curr_con_mode */
+      /* For statically linked driver, call hdd_set_conparam to update curr_con_mode
+       */
       hdd_set_conparam((v_UINT_t)con_mode);
-
       if (WLAN_IS_EPPING_ENABLED(con_mode)) {
          ret_status =  epping_driver_init(con_mode, &wlan_wake_lock,
                           WLAN_MODULE_NAME);
@@ -15868,6 +17739,7 @@ static int hdd_driver_init( void)
    if (!VOS_IS_STATUS_SUCCESS(status))
    {
          hddLog(VOS_TRACE_LEVEL_FATAL,"%s: Failed to preOpen VOSS", __func__);
+         vos_remove_pm_qos();
          ret_status = -1;
          break;
    }
@@ -15879,39 +17751,22 @@ static int hdd_driver_init( void)
 
    ret_status = hdd_hif_register_driver();
    vos_remove_pm_qos();
-   hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_INIT);
 
-   if (ret_status) {
-       hddLog(VOS_TRACE_LEVEL_FATAL, "%s: WLAN Driver Initialization failed",
-               __func__);
-       hif_unregister_driver();
-       vos_preClose( &pVosContext );
-       ret_status = -ENODEV;
-       break;
-   } else {
-       pr_info("%s: driver loaded in %lld\n", WLAN_MODULE_NAME,
-                                              adf_get_boottime() - start);
-       return 0;
+   if (ret_status == 0) {
+      pr_info("%s: driver loaded in %lld\n", WLAN_MODULE_NAME,
+             adf_get_boottime() - start);
+      hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_INIT);
+      return 0;
    }
 
+   hddLog(VOS_TRACE_LEVEL_FATAL, "%s: WLAN Driver Initialization failed",
+          __func__);
 
-   } while (0);
-
-   if (0 != ret_status)
-   {
-#ifdef TIMER_MANAGER
-      vos_timer_exit();
-#endif
-#ifdef MEMORY_DEBUG
-      vos_mem_exit();
-#endif
-     hdd_wlan_wakelock_destroy();
+   ret_status = hdd_register_fail_clean_up(pVosContext);
+   hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_INIT);
+   hdd_wlan_wakelock_destroy();
 
-#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
-      wlan_logging_sock_deinit_svc();
-#endif
-      pr_err("%s: driver load failure\n", WLAN_MODULE_NAME);
-   }
+   } while (0);
 
    EXIT();
 
@@ -15942,6 +17797,91 @@ static int __init hdd_module_init ( void)
 }
 #endif /* #ifdef MODULE */
 
+static struct timer_list unload_timer;
+static bool unload_timer_started;
+
+#ifdef CONFIG_SLUB_DEBUG_ON
+#define HDD_UNLOAD_WAIT_TIME 35000
+#else
+#define HDD_UNLOAD_WAIT_TIME 30000
+#endif
+
+/**
+ * hdd_unload_timer_init() - API to initialize unload timer
+ *
+ * initialize unload timer
+ *
+ * Return: None
+ */
+static void hdd_unload_timer_init(void)
+{
+	init_timer(&unload_timer);
+}
+
+/**
+ * hdd_unload_timer_del() - API to Delete unload timer
+ *
+ * Delete unload timer
+ *
+ * Return: None
+ */
+static void hdd_unload_timer_del(void)
+{
+	del_timer(&unload_timer);
+	unload_timer_started = false;
+}
+
+/**
+ * hdd_unload_timer_cb() - Unload timer callback function
+ *
+ * Unload timer callback function
+ *
+ * Return: None
+ */
+static void hdd_unload_timer_cb(unsigned long data)
+{
+	v_CONTEXT_t vos_context = NULL;
+	hdd_context_t *hdd_ctx = NULL;
+
+	pr_err("HDD unload timer expired!,current unload status: %d",
+		g_current_unload_state);
+	/* Get the global VOSS context. */
+	vos_context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+	if(vos_context) {
+		hdd_ctx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD,
+						vos_context );
+	if(hdd_ctx)
+		pr_err("Driver loading: %d unloading:%d logp_in_progress: %d",
+				hdd_ctx->isLoadInProgress,
+				hdd_ctx->isUnloadInProgress,
+			hdd_ctx->isLogpInProgress);
+	} else
+		pr_err("%s: Global VOS context is Null", __func__);
+
+#ifdef CONFIG_SLUB_DEBUG_ON
+	VOS_BUG(0);
+#endif
+}
+
+/**
+ * hdd_unload_timer_start() - API to start unload timer
+ * @msec: timer interval in msec units
+ *
+ * API to start unload timer
+ *
+ * Return: None
+ */
+static void hdd_unload_timer_start(int msec)
+{
+	if(unload_timer_started)
+		hddLog(VOS_TRACE_LEVEL_FATAL,
+			"%s: Starting unload timer when it's running!",
+			__func__);
+	unload_timer.expires = jiffies + msecs_to_jiffies(msec);
+	unload_timer.function = hdd_unload_timer_cb;
+	add_timer(&unload_timer);
+	unload_timer_started = true;
+}
 /**---------------------------------------------------------------------------
 
   \brief hdd_driver_exit() - Exit function
@@ -15985,6 +17925,8 @@ static void hdd_driver_exit(void)
    }
    else
    {
+       hdd_thermal_suspend_cleanup(pHddCtx);
+
       /*
        * Check IPA HW pipe shutdown properly or not
        * If not, force shut down HW pipe
@@ -15993,6 +17935,12 @@ static void hdd_driver_exit(void)
 
       pHddCtx->driver_being_stopped = false;
 
+      rtnl_lock();
+      pHddCtx->isUnloadInProgress = TRUE;
+      vos_set_load_unload_in_progress(VOS_MODULE_ID_VOSS, TRUE);
+      vos_set_unload_in_progress(TRUE);
+      rtnl_unlock();
+
       while(pHddCtx->isLogpInProgress ||
             vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
          VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
@@ -16005,22 +17953,22 @@ static void hdd_driver_exit(void)
             VOS_BUG(0);
          }
       }
-
-      rtnl_lock();
-      pHddCtx->isUnloadInProgress = TRUE;
-      vos_set_load_unload_in_progress(VOS_MODULE_ID_VOSS, TRUE);
-      vos_set_unload_in_progress(TRUE);
-      rtnl_unlock();
    }
 
    vos_wait_for_work_thread_completion(__func__);
+   /* If unload never completes, then do kernel panic. */
+   hdd_unload_timer_init();
+   hdd_unload_timer_start(HDD_UNLOAD_WAIT_TIME);
    hif_unregister_driver();
+   hdd_unload_timer_del();
+
    vos_preClose( &pVosContext );
 
 #ifdef TIMER_MANAGER
    vos_timer_exit();
 #endif
 #ifdef MEMORY_DEBUG
+   adf_net_buf_debug_exit();
    vos_mem_exit();
 #endif
 
@@ -16186,7 +18134,7 @@ VOS_STATUS hdd_softap_sta_deauth(hdd_adapter_t *pAdapter,
 
     ENTER();
 
-    hddLog(LOG1, "hdd_softap_sta_deauth:(%p, false)",
+    hddLog(LOG1, "hdd_softap_sta_deauth:(%pK, false)",
            (WLAN_HDD_GET_CTX(pAdapter))->pvosContext);
 
     //Ignore request to deauth bcmc station
@@ -16227,7 +18175,7 @@ void hdd_softap_sta_disassoc(hdd_adapter_t *pAdapter,
 
     ENTER();
 
-    hddLog( LOGE, "hdd_softap_sta_disassoc:(%p, false)", (WLAN_HDD_GET_CTX(pAdapter))->pvosContext);
+    hddLog( LOGE, "hdd_softap_sta_disassoc:(%pK, false)", (WLAN_HDD_GET_CTX(pAdapter))->pvosContext);
 
     //Ignore request to disassoc bcmc station
     if( pDelStaParams->peerMacAddr[0] & 0x1 )
@@ -16248,7 +18196,7 @@ void hdd_softap_tkip_mic_fail_counter_measure(hdd_adapter_t *pAdapter,v_BOOL_t e
 
     ENTER();
 
-    hddLog( LOGE, "hdd_softap_tkip_mic_fail_counter_measure:(%p, false)", (WLAN_HDD_GET_CTX(pAdapter))->pvosContext);
+    hddLog( LOGE, "hdd_softap_tkip_mic_fail_counter_measure:(%pK, false)", (WLAN_HDD_GET_CTX(pAdapter))->pvosContext);
 
 #ifdef WLAN_FEATURE_MBSSID
     WLANSAP_SetCounterMeasure(WLAN_HDD_GET_SAP_CTX_PTR(pAdapter), (v_BOOL_t)enable);
@@ -16304,42 +18252,48 @@ v_BOOL_t hdd_is_suspend_notify_allowed(hdd_context_t* pHddCtx)
 
 void wlan_hdd_set_concurrency_mode(hdd_context_t *pHddCtx, tVOS_CON_MODE mode)
 {
-   switch (mode) {
-       case VOS_STA_MODE:
-       case VOS_P2P_CLIENT_MODE:
-       case VOS_P2P_GO_MODE:
-       case VOS_STA_SAP_MODE:
-            pHddCtx->concurrency_mode |= (1 << mode);
-            pHddCtx->no_of_open_sessions[mode]++;
-            break;
-       default:
-            break;
-   }
-   hddLog(VOS_TRACE_LEVEL_INFO, FL("concurrency_mode = 0x%x "
-          "Number of open sessions for mode %d = %d"),
-           pHddCtx->concurrency_mode, mode,
-           pHddCtx->no_of_open_sessions[mode]);
+	switch (mode) {
+		case VOS_STA_MODE:
+		case VOS_P2P_CLIENT_MODE:
+		case VOS_P2P_GO_MODE:
+		case VOS_STA_SAP_MODE:
+			pHddCtx->concurrency_mode |= (1 << mode);
+			pHddCtx->no_of_open_sessions[mode]++;
+			break;
+		default:
+			break;
+	}
+
+	hddLog(VOS_TRACE_LEVEL_INFO, FL("concurrency_mode = 0x%x, Number of open sessions for mode %d = %d"),
+			pHddCtx->concurrency_mode, mode,
+			pHddCtx->no_of_open_sessions[mode]);
+
+	hdd_wlan_green_ap_start_bss(pHddCtx);
 }
 
 
 void wlan_hdd_clear_concurrency_mode(hdd_context_t *pHddCtx, tVOS_CON_MODE mode)
-   {
-   switch (mode)  {
-       case VOS_STA_MODE:
-       case VOS_P2P_CLIENT_MODE:
-       case VOS_P2P_GO_MODE:
-       case VOS_STA_SAP_MODE:
-            pHddCtx->no_of_open_sessions[mode]--;
-            if (!(pHddCtx->no_of_open_sessions[mode]))
-                pHddCtx->concurrency_mode &= (~(1 << mode));
-            break;
-       default:
-            break;
-   }
-   hddLog(VOS_TRACE_LEVEL_INFO, FL("concurrency_mode = 0x%x "
-          "Number of open sessions for mode %d = %d"),
-          pHddCtx->concurrency_mode, mode, pHddCtx->no_of_open_sessions[mode]);
-   }
+{
+	switch (mode)  {
+		case VOS_STA_MODE:
+		case VOS_P2P_CLIENT_MODE:
+		case VOS_P2P_GO_MODE:
+		case VOS_STA_SAP_MODE:
+			pHddCtx->no_of_open_sessions[mode]--;
+			if (!(pHddCtx->no_of_open_sessions[mode]))
+				pHddCtx->concurrency_mode &= (~(1 << mode));
+			break;
+		default:
+			break;
+	}
+
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("concurrency_mode = 0x%x, Number of open sessions for mode %d = %d"),
+			pHddCtx->concurrency_mode, mode,
+			pHddCtx->no_of_open_sessions[mode]);
+
+	hdd_wlan_green_ap_start_bss(pHddCtx);
+}
 
 /**---------------------------------------------------------------------------
  *
@@ -16535,7 +18489,7 @@ static VOS_STATUS wlan_hdd_framework_restart(hdd_context_t *pHddCtx)
    status =  hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
    if ((NULL == pAdapterNode) || (VOS_STATUS_SUCCESS != status)) {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                 FL("fail to get adapter: %p %d"), pAdapterNode, status);
+                 FL("fail to get adapter: %pK %d"), pAdapterNode, status);
        goto end;
    }
    do
@@ -16672,7 +18626,7 @@ uint8_t hdd_find_prefd_safe_chnl(hdd_context_t *hdd_ctxt,
    uint16_t             channel_loop;
 
    if (!hdd_ctxt || !ap_adapter) {
-      hddLog(LOGE, "%s : Invalid arguments: hdd_ctxt=%p, ap_adapter=%p",
+      hddLog(LOGE, "%s : Invalid arguments: hdd_ctxt=%pK, ap_adapter=%pK",
              __func__, hdd_ctxt, ap_adapter);
       return 0;
    }
@@ -16799,11 +18753,17 @@ void hdd_unsafe_channel_restart_sap(hdd_context_t *hdd_ctx)
 						NULL,
 						0);
 
-				hdd_hostapd_stop(adapter->dev);
-
-				if (hdd_ctx->cfg_ini->sap_restrt_ch_avoid)
+				hddLog(LOG1, FL("driver to start sap: %d"),
+					hdd_ctx->cfg_ini->sap_internal_restart);
+				if (hdd_ctx->cfg_ini->sap_internal_restart) {
+					wlan_hdd_netif_queue_control(adapter,
+							WLAN_NETIF_TX_DISABLE,
+							WLAN_CONTROL_PATH);
 					schedule_work(
 					&hdd_ctx->sap_start_work);
+				}
+				else
+					hdd_hostapd_stop(adapter->dev);
 
 				return;
 			}
@@ -17167,6 +19127,23 @@ void wlan_hdd_enable_roaming(hdd_adapter_t *pAdapter)
 }
 #endif
 
+/**
+ * nl_srv_bcast_svc() - Wrapper function to send bcast msgs to SVC mcast group
+ * @skb: sk buffer pointer
+ *
+ * Sends the bcast message to SVC multicast group with generic nl socket
+ * if CNSS_GENL is enabled. Else, use the legacy netlink socket to send.
+ *
+ * Return: None
+ */
+static void nl_srv_bcast_svc(struct sk_buff *skb)
+{
+#ifdef CNSS_GENL
+	nl_srv_bcast(skb, CLD80211_MCGRP_SVC_MSGS, WLAN_NL_MSG_SVC);
+#else
+	nl_srv_bcast(skb);
+#endif
+}
 
 void wlan_hdd_send_svc_nlink_msg(int radio, int type, void *data, int len)
 {
@@ -17201,6 +19178,7 @@ void wlan_hdd_send_svc_nlink_msg(int radio, int type, void *data, int len)
 
     switch(type) {
         case WLAN_SVC_FW_CRASHED_IND:
+        case WLAN_SVC_FW_SHUTDOWN_IND:
         case WLAN_SVC_LTE_COEX_IND:
         case WLAN_SVC_WLAN_AUTO_SHUTDOWN_IND:
         case WLAN_SVC_WLAN_AUTO_SHUTDOWN_CANCEL_IND:
@@ -17250,7 +19228,7 @@ void wlan_hdd_send_svc_nlink_msg(int radio, int type, void *data, int len)
     nlh->nlmsg_len += tlv_len;
     skb_put(skb, NLMSG_SPACE(sizeof(tAniMsgHdr) + len + tlv_len));
 
-    nl_srv_bcast(skb);
+    nl_srv_bcast_svc(skb);
 
     return;
 }
@@ -17512,8 +19490,15 @@ void hdd_stop_bus_bw_compute_timer(hdd_adapter_t *pAdapter)
 
     if (can_stop == VOS_TRUE) {
         vos_timer_stop(&pHddCtx->bus_bw_timer);
+        if (pHddCtx->hbw_requested) {
+            vos_remove_pm_qos();
+            pHddCtx->hbw_requested = false;
+        }
+        /* reset the ipa perf level */
+        hdd_ipa_set_perf_level(pHddCtx, 0, 0);
         hdd_rst_tcp_delack(pHddCtx);
         tlshim_reset_bundle_require();
+        tlshim_driver_del_ack_disable();
     }
 }
 #endif
@@ -17527,6 +19512,7 @@ void wlan_hdd_check_sta_ap_concurrent_ch_intf(void *data)
     tHalHandle hHal;
     hdd_ap_ctx_t *pHddApCtx;
     uint16_t intf_ch = 0, vht_channel_width = 0;
+    eCsrBand orig_band, new_band;
 
    if ((pHddCtx->cfg_ini->WlanMccToSccSwitchMode == VOS_MCC_TO_SCC_SWITCH_DISABLE)
        || !(vos_concurrent_open_sessions_running()
@@ -17551,7 +19537,37 @@ void wlan_hdd_check_sta_ap_concurrent_ch_intf(void *data)
     if (intf_ch == 0)
         return;
 
+    if (pHddApCtx->sapConfig.band_switch_enable) {
+        if (pHddApCtx->sapConfig.channel > MAX_2_4GHZ_CHANNEL) {
+            orig_band = eCSR_BAND_5G;
+        } else {
+            orig_band = eCSR_BAND_24;
+        }
+
+        if (intf_ch > MAX_2_4GHZ_CHANNEL) {
+            new_band = eCSR_BAND_5G;
+        } else {
+            new_band = eCSR_BAND_24;
+        }
+
+        if (orig_band != new_band) {
+            if (new_band == eCSR_BAND_5G) {
+                pHddApCtx->sapConfig.ch_width_orig =
+                    pHddApCtx->sapConfig.ch_width_5g_orig;
+            } else {
+                pHddApCtx->sapConfig.ch_width_orig =
+                    pHddApCtx->sapConfig.ch_width_24g_orig;
+            }
+        }
+    }
+
+    hddLog(VOS_TRACE_LEVEL_INFO,
+        FL("SAP restarts due to MCC->SCC switch, orig chan: %d, new chan: %d"),
+        pHddApCtx->sapConfig.channel, intf_ch);
+
     pHddApCtx->sapConfig.channel = intf_ch;
+    pHddApCtx->bss_stop_reason = BSS_STOP_DUE_TO_MCC_SCC_SWITCH;
+
     sme_SelectCBMode(hHal,
                      pHddApCtx->sapConfig.SapHw_mode,
                      pHddApCtx->sapConfig.channel,
@@ -17704,7 +19720,7 @@ void wlan_hdd_stop_sap(hdd_adapter_t *ap_adapter)
  *
  * Return: void.
  */
-void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter)
+void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter, bool reinit)
 {
     hdd_ap_ctx_t *hdd_ap_ctx;
     hdd_hostapd_state_t *hostapd_state;
@@ -17723,8 +19739,13 @@ void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter)
     hostapd_state = WLAN_HDD_GET_HOSTAP_STATE_PTR(ap_adapter);
     pConfig = &ap_adapter->sessionCtx.ap.sapConfig;
 
-    if (0 != wlan_hdd_validate_context(hdd_ctx))
-        return;
+    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+              FL("ssr in progress %d"), reinit);
+
+     if (!reinit) {
+        if (0 != wlan_hdd_validate_context(hdd_ctx))
+            return;
+    }
 
     mutex_lock(&hdd_ctx->sap_lock);
     if (test_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags))
@@ -17736,6 +19757,7 @@ void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter)
         goto end;
     }
 
+    vos_event_reset(&hostapd_state->vosEvent);
     if (WLANSAP_StartBss(hdd_ap_ctx->sapContext, hdd_hostapd_SAPEventCB,
                          &hdd_ap_ctx->sapConfig, (v_PVOID_t)ap_adapter->dev)
                          != VOS_STATUS_SUCCESS) {
@@ -18037,22 +20059,6 @@ void hdd_get_fw_version(hdd_context_t *hdd_ctx,
 	*crmid = hdd_ctx->target_fw_version & 0x7fff;
 }
 
-/**
- * hdd_is_memdump_supported() - to check if memdump feature support
- *
- * This function is used to check if memdump feature is supported in
- * the host driver
- *
- * Return: true if supported and false otherwise
- */
-bool hdd_is_memdump_supported(void)
-{
-#ifdef WLAN_FEATURE_MEMDUMP
-	return true;
-#endif
-	return false;
-}
-
 #ifdef QCA_CONFIG_SMP
 int wlan_hdd_get_cpu()
 {
@@ -18137,6 +20143,9 @@ int hdd_init_packet_filtering(hdd_context_t *hdd_ctx,
 		return -ENOMEM;
 	}
 
+	vos_mem_zero(adapter->mc_addr_list.addr,
+		(hdd_ctx->max_mc_addr_list * ETH_ALEN));
+
 	return 0;
 }
 
@@ -18201,6 +20210,45 @@ void hdd_set_rps_cpu_mask(hdd_context_t *hdd_ctx)
 	}
 }
 
+/**
+ * hdd_initialize_adapter_common() - initialize completion variables
+ * @adapter: pointer to hdd_adapter_t
+ *
+ * Return: none
+ */
+void hdd_initialize_adapter_common(hdd_adapter_t *adapter)
+{
+	if (NULL == adapter) {
+		hddLog(VOS_TRACE_LEVEL_ERROR, "%s: adapter is NULL ", __func__);
+		return;
+	}
+	init_completion(&adapter->session_open_comp_var);
+	init_completion(&adapter->session_close_comp_var);
+	init_completion(&adapter->disconnect_comp_var);
+	init_completion(&adapter->linkup_event_var);
+	init_completion(&adapter->cancel_rem_on_chan_var);
+	init_completion(&adapter->rem_on_chan_ready_event);
+	init_completion(&adapter->offchannel_tx_event);
+	init_completion(&adapter->tx_action_cnf_event);
+#ifdef FEATURE_WLAN_TDLS
+	init_completion(&adapter->tdls_add_station_comp);
+	init_completion(&adapter->tdls_del_station_comp);
+	init_completion(&adapter->tdls_mgmt_comp);
+	init_completion(&adapter->tdls_link_establish_req_comp);
+#endif
+
+#ifdef WLAN_FEATURE_RMC
+	init_completion(&adapter->ibss_peer_info_comp);
+#endif /* WLAN_FEATURE_RMC */
+	init_completion(&adapter->ula_complete);
+	init_completion(&adapter->change_country_code);
+	init_completion(&adapter->smps_force_mode_comp_var);
+	init_completion(&adapter->scan_info.scan_req_completion_event);
+	init_completion(&adapter->scan_info.abortscan_event_var);
+
+	return;
+}
+
 //Register the module init/exit functions
 module_init(hdd_module_init);
 module_exit(hdd_module_exit);
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_memdump.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_memdump.c
index b8366191a97..cb6947230c3 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_memdump.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_memdump.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -42,324 +42,17 @@
 #include <linux/proc_fs.h> /* Necessary because we use the proc fs */
 #include <linux/uaccess.h> /* for copy_to_user */
 
-/**
- * hdd_fw_dump_context - hdd firmware memory dump context
- *
- * @request_id: userspace assigned firmware memory dump request ID
- * @response_event: firmware memory dump request wait event
- */
-struct hdd_fw_dump_context {
-	uint32_t request_id;
-	struct completion response_event;
-};
-static struct hdd_fw_dump_context fw_dump_context;
-
-/**
- * memdump_cleanup_timer_cb() - Timer callback function for memory dump cleanup.
- *
- * @data: Callback data (used to stored HDD context)
- *
- * Callback function registered for memory dump cleanup VOS timer.
- *
- * Return: none
- */
-
-static void memdump_cleanup_timer_cb(void *data)
-{
-	int status;
-	hdd_context_t *hdd_ctx = data;
-	adf_os_dma_addr_t paddr;
-	adf_os_dma_addr_t dma_ctx;
-	adf_os_device_t adf_ctx;
-
-	status = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != status)
-		return;
-
-	if (!hdd_ctx->fw_dump_loc) {
-		hddLog(LOG1, FL("Memory dump already freed"));
-		return;
-	}
-
-	adf_ctx = vos_get_context(VOS_MODULE_ID_ADF, hdd_ctx->pvosContext);
-	if (!adf_ctx) {
-		hddLog(LOGE, FL("ADF context is NULL"));
-		return;
-	}
-
-	paddr = hdd_ctx->dump_loc_paddr;
-	mutex_lock(&hdd_ctx->memdump_lock);
-	adf_os_mem_free_consistent(adf_ctx,
-		FW_MEM_DUMP_SIZE, hdd_ctx->fw_dump_loc, paddr, dma_ctx);
-	hdd_ctx->fw_dump_loc = NULL;
-	hdd_ctx->memdump_in_progress = false;
-	mutex_unlock(&hdd_ctx->memdump_lock);
-
-}
-
-/**
- * wlan_hdd_cfg80211_fw_mem_dump_cb() -  Callback to receive FW memory dump
- * @ctx: pointer to HDD context.
- * @rsp: pointer to fw dump copy complete response
- *
- * This is a callback function used to indicate user space about the
- * availability for firmware memory dump via vendor event.
- *
- * Return: None
- */
-static void wlan_hdd_cfg80211_fw_mem_dump_cb(void *ctx,
-					     struct fw_dump_rsp *dump_rsp)
-{
-	hdd_context_t *hdd_ctx = ctx;
-	struct hdd_fw_dump_context *context;
-	int status;
-
-	status = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != status)
-		return;
-
-	spin_lock(&hdd_context_lock);
-	context = &fw_dump_context;
-	/* validate the response received */
-	if (!dump_rsp->dump_complete ||
-	    context->request_id != dump_rsp->request_id) {
-		spin_unlock(&hdd_context_lock);
-		hddLog(LOGE,
-		       FL("Error @ request_id: %d response_id: %d status: %d"),
-		       context->request_id, dump_rsp->request_id,
-		       dump_rsp->dump_complete);
-		return;
-	} else {
-		complete(&context->response_event);
-	}
-	spin_unlock(&hdd_context_lock);
-
-	return;
-}
-
-/**
- * wlan_hdd_send_memdump_rsp - send memory dump response to user space
- * @hdd_ctx: Pointer to hdd context
- *
- * Return: 0 for success; non-zero for failure
- */
-static int wlan_hdd_send_memdump_rsp(hdd_context_t *hdd_ctx)
-{
-	struct sk_buff *skb;
-	int status;
-
-	status = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != status)
-		return status;
-
-	skb = cfg80211_vendor_cmd_alloc_reply_skb(hdd_ctx->wiphy,
-			NLMSG_HDRLEN + NLA_HDRLEN + sizeof(uint32_t));
-
-	if (!skb) {
-		hddLog(LOGE, FL("cfg80211_vendor_cmd_alloc_reply_skb failed"));
-		return -ENOMEM;
-	}
-
-	if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_MEMDUMP_SIZE,
-			     FW_MEM_DUMP_SIZE)) {
-		hddLog(LOGE, FL("nla put fail"));
-		goto nla_put_failure;
-	}
-
-	cfg80211_vendor_cmd_reply(skb);
-	hddLog(LOG1, FL("Memdump event sent successfully to user space"));
-	return 0;
-
-nla_put_failure:
-	kfree_skb(skb);
-	return -EINVAL;
-}
-
-/**
- * __wlan_hdd_cfg80211_get_fw_mem_dump() - Get FW memory dump
- * @wiphy:   pointer to wireless wiphy structure.
- * @wdev:    pointer to wireless_dev structure.
- * @data:    Pointer to the NL data.
- * @data_len:Length of @data
- *
- * This is called when wlan driver needs to get the firmware memory dump
- * via vendor specific command.
- *
- * Return:   0 on success, error number otherwise.
- */
-static int
-__wlan_hdd_cfg80211_get_fw_mem_dump(struct wiphy *wiphy,
-				    struct wireless_dev *wdev,
-				    const void *data, int data_len)
-{
-	int status;
-	VOS_STATUS sme_status;
-	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
-	struct fw_dump_req fw_mem_dump_req;
-	struct fw_dump_seg_req* seg_req;
-	uint8_t loop;
-	adf_os_dma_addr_t paddr;
-	adf_os_dma_addr_t dma_ctx;
-	adf_os_device_t adf_ctx;
-	unsigned long rc;
-	struct hdd_fw_dump_context *context;
-
-	if (VOS_FTM_MODE == hdd_get_conparam()) {
-		hddLog(LOGE, FL("Command not allowed in FTM mode"));
-		return -EINVAL;
-	}
-
-	status = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != status)
-		return status;
-
-	adf_ctx = vos_get_context(VOS_MODULE_ID_ADF, hdd_ctx->pvosContext);
-	if (!adf_ctx) {
-		hddLog(LOGE, FL("ADF context is NULL"));
-		return -EINVAL;
-	}
-
-	if (hdd_ctx->memdump_in_progress) {
-		hddLog(LOGE, FL("Already a memdump req in progress."));
-		return -EBUSY;
-	}
-
-	/*
-	 * Allocate memory for fw memory dump. Memory allocated should be
-	 * contiguous. Physical address of the allocated memory is passed
-	 * to the FW for copy
-	 *
-	 * Reuse the memory if available.
-	 */
-	mutex_lock(&hdd_ctx->memdump_lock);
-	if (!hdd_ctx->fw_dump_loc) {
-		hdd_ctx->fw_dump_loc = adf_os_mem_alloc_consistent(
-			adf_ctx, FW_MEM_DUMP_SIZE, &paddr, dma_ctx);
-		if (!hdd_ctx->fw_dump_loc) {
-			mutex_unlock(&hdd_ctx->memdump_lock);
-			hddLog(LOGE, FL("adf_os_mem_alloc_consistent failed"));
-			return -ENOMEM;
-		}
-		hdd_ctx->dump_loc_paddr = paddr;
-	}
-	mutex_unlock(&hdd_ctx->memdump_lock);
-
-	/*
-	 * Currently request_id and num_seg is assumed to be default(1)
-	 * It is assumed that firmware dump requested is for DRAM section
-	 * only
-	 */
-
-	fw_mem_dump_req.request_id = FW_MEM_DUMP_REQ_ID;
-	fw_mem_dump_req.num_seg = FW_MEM_DUMP_NUM_SEG;
-
-	hddLog(LOG1, FL("request_id:%d num_seg:%d"),
-		fw_mem_dump_req.request_id, fw_mem_dump_req.num_seg);
-	seg_req = (struct fw_dump_seg_req *) fw_mem_dump_req.segment;
-	for (loop = 0; loop < fw_mem_dump_req.num_seg; loop++) {
-		seg_req->seg_id = 1;
-		seg_req->seg_start_addr_lo = FW_DRAM_LOCATION;
-		seg_req->seg_start_addr_hi = 0;
-		seg_req->seg_length = FW_MEM_DUMP_SIZE;
-		seg_req->dst_addr_lo = hdd_ctx->dump_loc_paddr;
-		seg_req->dst_addr_hi = 0;
-		hddLog(LOG1, FL("seg_number:%d"), loop);
-		hddLog(LOG1,
-		    FL("seg_id:%d start_addr_lo:0x%x start_addr_hi:0x%x"),
-		    seg_req->seg_id, seg_req->seg_start_addr_lo,
-		    seg_req->seg_start_addr_hi);
-		hddLog(LOG1,
-		    FL("seg_length:%d dst_addr_lo:0x%x dst_addr_hi:0x%x"),
-		    seg_req->seg_length, seg_req->dst_addr_lo,
-		    seg_req->dst_addr_hi);
-		seg_req++;
-	}
-
-	/**
-	 * Start the cleanup timer.
-	 * Memory allocated for this request will be freed up
-	 * once the timer expires. Memory dump request is expected to be
-	 * completed by this time.
-	 *
-	 * User space will not be able to access the dump after this time.
-	 * New request should be issued to get the dump again.
-	 */
-	vos_timer_start(&hdd_ctx->memdump_cleanup_timer,
-			MEMDUMP_COMPLETION_TIME_MS);
-	hdd_ctx->memdump_in_progress = true;
-
-	spin_lock(&hdd_context_lock);
-	context = &fw_dump_context;
-	context->request_id = fw_mem_dump_req.request_id;
-	INIT_COMPLETION(context->response_event);
-	spin_unlock(&hdd_context_lock);
-
-	sme_status = sme_fw_mem_dump(hdd_ctx->hHal, &fw_mem_dump_req);
-	if (VOS_STATUS_SUCCESS != sme_status) {
-		hddLog(LOGE, FL("sme_fw_mem_dump Failed"));
-		mutex_lock(&hdd_ctx->memdump_lock);
-		adf_os_mem_free_consistent(adf_ctx,
-			FW_MEM_DUMP_SIZE, hdd_ctx->fw_dump_loc, paddr, dma_ctx);
-		hdd_ctx->fw_dump_loc = NULL;
-		mutex_unlock(&hdd_ctx->memdump_lock);
-		hdd_ctx->memdump_in_progress = false;
-		if (VOS_TIMER_STATE_RUNNING ==
-		  vos_timer_getCurrentState(&hdd_ctx->memdump_cleanup_timer)) {
-			vos_timer_stop(&hdd_ctx->memdump_cleanup_timer);
-		}
-		return -EINVAL;
-	}
-
-	rc = wait_for_completion_timeout(&context->response_event,
-		msecs_to_jiffies(MEMDUMP_COMPLETION_TIME_MS));
-	if (!rc) {
-		hddLog(LOGE, FL("Target response timed out for request_id: %d"),
-		       context->request_id);
-		return -ETIMEDOUT;
-	}
-
-	status = wlan_hdd_send_memdump_rsp(hdd_ctx);
-	if (status)
-		hddLog(LOGE,
-			FL("Failed to send FW memory dump rsp to user space"));
-
-	return status;
-}
-
-/**
- * wlan_hdd_cfg80211_get_fw_mem_dump() - Get FW memory dump
- * @wiphy:   pointer to wireless wiphy structure.
- * @wdev:    pointer to wireless_dev structure.
- * @data:    Pointer to the NL data.
- * @data_len:Length of @data
- *
- * This is called when wlan driver needs to get the firmware memory dump
- * via vendor specific command.
- *
- * Return:   0 on success, error number otherwise.
- */
-int wlan_hdd_cfg80211_get_fw_mem_dump(struct wiphy *wiphy,
-					     struct wireless_dev *wdev,
-					     const void *data, int data_len)
-{
-	int ret;
-
-	vos_ssr_protect(__func__);
-	ret = __wlan_hdd_cfg80211_get_fw_mem_dump(wiphy, wdev, data, data_len);
-	vos_ssr_unprotect(__func__);
-
-	return ret;
-}
+#define PROCFS_DRIVER_DUMP_DIR "debugdriver"
 
 #ifdef MULTI_IF_NAME
-#define PROCFS_MEMDUMP_DIR "debug" MULTI_IF_NAME
+#define PROCFS_DRIVER_DUMP_NAME "driverdump" MULTI_IF_NAME
 #else
-#define PROCFS_MEMDUMP_DIR "debug"
+#define PROCFS_DRIVER_DUMP_NAME "driverdump"
 #endif
-#define PROCFS_MEMDUMP_NAME "fwdump"
-#define PROCFS_MEMDUMP_PERM 0444
 
-static struct proc_dir_entry *proc_file, *proc_dir;
+#define PROCFS_DRIVER_DUMP_PERM 0444
+
+static struct proc_dir_entry *proc_file_driver, *proc_dir_driver;
 
 /** memdump_get_file_data() - get data available in proc file
  *
@@ -389,299 +82,6 @@ static void *memdump_get_file_data(struct file *file)
 #endif
 
 /**
- * memdump_read() - perform read operation in memory dump proc file
- *
- * @file  - handle for the proc file.
- * @buf   - pointer to user space buffer.
- * @count - number of bytes to be read.
- * @pos   - offset in the from buffer.
- *
- * This function performs read operation for the memory dump proc file.
- *
- * Return: number of bytes read on success, error code otherwise.
- */
-static ssize_t memdump_read(struct file *file, char __user *buf,
-					size_t count, loff_t *pos)
-{
-	int status;
-	hdd_context_t *hdd_ctx;
-	adf_os_dma_addr_t paddr;
-	adf_os_dma_addr_t dma_ctx;
-	adf_os_device_t adf_ctx;
-
-	hdd_ctx = memdump_get_file_data(file);
-
-	hddLog(LOG1, FL("Read req for size:%zu pos:%llu"), count, *pos);
-	status = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != status)
-		return -EINVAL;
-
-	adf_ctx = vos_get_context(VOS_MODULE_ID_ADF, hdd_ctx->pvosContext);
-	if (!adf_ctx) {
-		hddLog(LOGE, FL("ADF context is NULL"));
-		return -EINVAL;
-	}
-
-	if (!hdd_ctx->memdump_in_progress) {
-		hddLog(LOGE, FL("Current mem dump request timed out/failed"));
-		return -EINVAL;
-	}
-
-	if (*pos < 0) {
-		hddLog(LOGE, FL("Invalid start offset for memdump read"));
-		return -EINVAL;
-	} else if (*pos >= FW_MEM_DUMP_SIZE || !count) {
-		hddLog(LOGE, FL("No more data to copy"));
-		return 0;
-	} else if (count > FW_MEM_DUMP_SIZE - *pos) {
-		count = FW_MEM_DUMP_SIZE - *pos;
-	}
-
-	if (!hdd_ctx->fw_dump_loc) {
-		hddLog(LOGE, FL("Invalid fw mem dump location"));
-		return -EINVAL;
-	}
-
-	if (copy_to_user(buf, hdd_ctx->fw_dump_loc + *pos, count)) {
-		hddLog(LOGE, FL("copy to user space failed"));
-		return -EFAULT;
-	}
-
-	/* offset(pos) should be updated here based on the copy done */
-	*pos += count;
-
-	/* Entire FW memory dump copy completed */
-	if (*pos >= FW_MEM_DUMP_SIZE) {
-		paddr = hdd_ctx->dump_loc_paddr;
-		mutex_lock(&hdd_ctx->memdump_lock);
-		adf_os_mem_free_consistent(adf_ctx,
-			FW_MEM_DUMP_SIZE, hdd_ctx->fw_dump_loc, paddr, dma_ctx);
-		hdd_ctx->fw_dump_loc = NULL;
-		hdd_ctx->memdump_in_progress = false;
-		if (VOS_TIMER_STATE_RUNNING ==
-		  vos_timer_getCurrentState(&hdd_ctx->memdump_cleanup_timer)) {
-			vos_timer_stop(&hdd_ctx->memdump_cleanup_timer);
-		}
-		mutex_unlock(&hdd_ctx->memdump_lock);
-	}
-
-	return count;
-}
-
-/**
- * struct memdump_fops - file operations for memory dump feature
- * @read - read function for memory dump operation.
- *
- * This structure initialize the file operation handle for memory
- * dump feature
- */
-static const struct file_operations memdump_fops = {
-	read: memdump_read
-};
-
-/**
- * memdump_procfs_init() - Initialize procfs for memory dump
- *
- * @vos_ctx - Global vos context.
- *
- * This function create file under proc file system to be used later for
- * processing firmware memory dump
- *
- * Return:   0 on success, error code otherwise.
- */
-static int memdump_procfs_init(void *vos_ctx)
-{
-	hdd_context_t *hdd_ctx;
-
-	hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
-	if (!hdd_ctx) {
-		hddLog(LOGE , FL("Invalid HDD context"));
-		return -EINVAL;
-	}
-
-	proc_dir = proc_mkdir(PROCFS_MEMDUMP_DIR, NULL);
-	if (proc_dir == NULL) {
-		remove_proc_entry(PROCFS_MEMDUMP_DIR, NULL);
-		pr_debug("Error: Could not initialize /proc/%s\n",
-			 PROCFS_MEMDUMP_DIR);
-		return -ENOMEM;
-	}
-
-	proc_file = proc_create_data(PROCFS_MEMDUMP_NAME,
-				     PROCFS_MEMDUMP_PERM, proc_dir,
-				     &memdump_fops, hdd_ctx);
-	if (proc_file == NULL) {
-		remove_proc_entry(PROCFS_MEMDUMP_NAME, proc_dir);
-		pr_debug("Error: Could not initialize /proc/%s\n",
-			  PROCFS_MEMDUMP_NAME);
-		return -ENOMEM;
-	}
-
-	pr_debug("/proc/%s/%s created\n", PROCFS_MEMDUMP_DIR,
-		 PROCFS_MEMDUMP_NAME);
-	return 0;
-}
-
-/**
- * memdump_procfs_remove() - Remove file/dir under procfs for memory dump
- *
- * This function removes file/dir under proc file system that was
- * processing firmware memory dump
- *
- * Return:  None
- */
-static void memdump_procfs_remove(void)
-{
-	remove_proc_entry(PROCFS_MEMDUMP_NAME, proc_dir);
-	pr_debug("/proc/%s/%s removed\n", PROCFS_MEMDUMP_DIR,
-					  PROCFS_MEMDUMP_NAME);
-	remove_proc_entry(PROCFS_MEMDUMP_DIR, NULL);
-	pr_debug("/proc/%s removed\n", PROCFS_MEMDUMP_DIR);
-}
-
-/**
- * memdump_init() - Intialization function for memory dump feature
- *
- * This function creates proc file for memdump feature and registers
- * HDD callback function with SME.
- *
- * Return - 0 on success, error otherwise
- */
-int memdump_init(void)
-{
-	hdd_context_t *hdd_ctx;
-	void *vos_ctx;
-	int status = 0;
-	eHalStatus cb_status;
-	VOS_STATUS vos_status;
-
-	vos_ctx = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
-	if (!vos_ctx) {
-		hddLog(LOGE, FL("Invalid VOS context"));
-		return -EINVAL;
-	}
-
-	hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
-	if (!hdd_ctx) {
-		hddLog(LOGE , FL("Invalid HDD context"));
-		return -EINVAL;
-	}
-
-	if (VOS_FTM_MODE == hdd_get_conparam()) {
-		hddLog(LOGE, FL("Not initializing memdump in FTM mode"));
-		return -EINVAL;
-	}
-
-	cb_status = sme_fw_mem_dump_register_cb(hdd_ctx->hHal,
-				wlan_hdd_cfg80211_fw_mem_dump_cb);
-	if (eHAL_STATUS_SUCCESS != cb_status) {
-		hddLog(LOGE , FL("Failed to register the callback"));
-		return -EINVAL;
-	}
-
-	status = memdump_procfs_init(vos_ctx);
-	if (status) {
-		hddLog(LOGE , FL("Failed to create proc file"));
-		return status;
-	}
-
-	init_completion(&fw_dump_context.response_event);
-
-	vos_status = vos_timer_init(&hdd_ctx->memdump_cleanup_timer,
-				    VOS_TIMER_TYPE_SW, memdump_cleanup_timer_cb,
-				    (void *)hdd_ctx);
-	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
-		hddLog(LOGE, FL("Failed to init memdump cleanup timer"));
-		return -EINVAL;
-	}
-
-	mutex_init(&hdd_ctx->memdump_lock);
-	hdd_ctx->memdump_init_done = true;
-
-	return 0;
-}
-
-/**
- * memdump_deinit() - De initialize memdump feature
- *
- * This function removes proc file created for memdump feature.
- *
- * Return: None
- */
-void memdump_deinit(void) {
-	hdd_context_t *hdd_ctx;
-	void *vos_ctx;
-	adf_os_dma_addr_t paddr;
-	adf_os_dma_addr_t dma_ctx;
-	adf_os_device_t adf_ctx;
-	VOS_STATUS vos_status;
-
-	vos_ctx = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
-	if (!vos_ctx) {
-		hddLog(LOGE, FL("Invalid VOS context"));
-		return;
-	}
-
-	hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
-	if(!hdd_ctx) {
-		hddLog(LOGE , FL("Invalid HDD context"));
-		return;
-	}
-
-	if (VOS_FTM_MODE == hdd_get_conparam()) {
-		hddLog(LOGE, FL("Not deinitializing memdump in FTM mode"));
-		return;
-	}
-
-	if (!hdd_ctx->memdump_init_done) {
-		hddLog(LOGE, FL("MemDump not initialized"));
-		return;
-	}
-
-	hdd_ctx->memdump_init_done = false;
-	adf_ctx = vos_get_context(VOS_MODULE_ID_ADF, hdd_ctx->pvosContext);
-	if (!adf_ctx) {
-		hddLog(LOGE, FL("ADF context is NULL"));
-		return;
-	}
-
-	memdump_procfs_remove();
-	sme_fw_mem_dump_unregister_cb(hdd_ctx->hHal);
-
-	mutex_lock(&hdd_ctx->memdump_lock);
-	if (hdd_ctx->fw_dump_loc) {
-		paddr = hdd_ctx->dump_loc_paddr;
-		adf_os_mem_free_consistent(adf_ctx,
-			FW_MEM_DUMP_SIZE, hdd_ctx->fw_dump_loc, paddr, dma_ctx);
-		hdd_ctx->fw_dump_loc = NULL;
-		hdd_ctx->memdump_in_progress = false;
-	}
-
-	mutex_unlock(&hdd_ctx->memdump_lock);
-	mutex_destroy(&hdd_ctx->memdump_lock);
-
-	if (VOS_TIMER_STATE_RUNNING ==
-	  vos_timer_getCurrentState(&hdd_ctx->memdump_cleanup_timer)) {
-		vos_timer_stop(&hdd_ctx->memdump_cleanup_timer);
-	}
-
-	vos_status = vos_timer_destroy(&hdd_ctx->memdump_cleanup_timer);
-	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
-		hddLog(LOGE, FL("Failed to deallocate timer"));
-	}
-}
-
-#ifdef MULTI_IF_NAME
-#define PROCFS_DRIVER_DUMP_DIR "debugdriver" MULTI_IF_NAME
-#else
-#define PROCFS_DRIVER_DUMP_DIR "debugdriver"
-#endif
-#define PROCFS_DRIVER_DUMP_NAME "driverdump"
-#define PROCFS_DRIVER_DUMP_PERM 0444
-
-static struct proc_dir_entry *proc_file_driver, *proc_dir_driver;
-
-/**
  * hdd_driver_mem_cleanup() - Frees memory allocated for
  * driver dump
  *
@@ -739,11 +139,14 @@ static ssize_t hdd_driver_memdump_read(struct file *file, char __user *buf,
 	if (0 != status)
 		return -EINVAL;
 
+	mutex_lock(&hdd_ctx->memdump_lock);
 	if (*pos < 0) {
+		mutex_unlock(&hdd_ctx->memdump_lock);
 		hddLog(LOGE, FL("Invalid start offset for memdump read"));
 		return -EINVAL;
 	} else if (!count || (hdd_ctx->driver_dump_size &&
 				(*pos >= hdd_ctx->driver_dump_size))) {
+		mutex_unlock(&hdd_ctx->memdump_lock);
 		hddLog(LOGE, FL("No more data to copy"));
 		return 0;
 	} else if ((*pos == 0) || (hdd_ctx->driver_dump_mem == NULL)) {
@@ -754,6 +157,7 @@ static ssize_t hdd_driver_memdump_read(struct file *file, char __user *buf,
 			hdd_ctx->driver_dump_mem =
 				vos_mem_malloc(DRIVER_MEM_DUMP_SIZE);
 			if (!hdd_ctx->driver_dump_mem) {
+				mutex_unlock(&hdd_ctx->memdump_lock);
 				hddLog(LOGE, FL("vos_mem_malloc failed"));
 				return -ENOMEM;
 			}
@@ -782,6 +186,7 @@ static ssize_t hdd_driver_memdump_read(struct file *file, char __user *buf,
 
 	if (copy_to_user(buf, hdd_ctx->driver_dump_mem + *pos,
 					no_of_bytes_read)) {
+		mutex_unlock(&hdd_ctx->memdump_lock);
 		hddLog(LOGE, FL("copy to user space failed"));
 		return -EFAULT;
 	}
@@ -793,6 +198,8 @@ static ssize_t hdd_driver_memdump_read(struct file *file, char __user *buf,
 	if (*pos >= hdd_ctx->driver_dump_size)
 		hdd_driver_mem_cleanup();
 
+	mutex_unlock(&hdd_ctx->memdump_lock);
+
 	return no_of_bytes_read;
 }
 
@@ -810,29 +217,15 @@ static const struct file_operations driver_dump_fops = {
 
 /**
  * hdd_driver_memdump_procfs_init() - Initialize procfs for driver memory dump
+ * @hdd_ctx: hdd context
  *
  * This function create file under proc file system to be used later for
  * processing driver memory dump
  *
  * Return:   0 on success, error code otherwise.
  */
-static int hdd_driver_memdump_procfs_init(void)
+static int hdd_driver_memdump_procfs_init(hdd_context_t *hdd_ctx)
 {
-	hdd_context_t *hdd_ctx;
-	void *vos_ctx;
-
-	vos_ctx = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
-	if (!vos_ctx) {
-		VOS_ASSERT(0);
-		return -EINVAL;
-	}
-
-	hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
-	if (!hdd_ctx) {
-		hddLog(LOGE, FL("Invalid HDD context"));
-		return -EINVAL;
-	}
-
 	proc_dir_driver = proc_mkdir(PROCFS_DRIVER_DUMP_DIR, NULL);
 	if (proc_dir_driver == NULL) {
 		pr_debug("Error: Could not initialize /proc/%s\n",
@@ -884,13 +277,29 @@ static void hdd_driver_memdump_procfs_remove(void)
 int hdd_driver_memdump_init(void)
 {
 	int status;
+	void *vos_ctx;
+	hdd_context_t *hdd_ctx;
 
 	if (VOS_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Not initializing memdump in FTM mode"));
 		return -EINVAL;
 	}
 
-	status = hdd_driver_memdump_procfs_init();
+	vos_ctx = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+	if (!vos_ctx) {
+		hddLog(LOGE, FL("Invalid VOS context"));
+		return -EINVAL;
+	}
+
+	hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
+	if (!hdd_ctx) {
+		hddLog(LOGE , FL("Invalid HDD context"));
+		return -EINVAL;
+	}
+
+	mutex_init(&hdd_ctx->memdump_lock);
+
+	status = hdd_driver_memdump_procfs_init(hdd_ctx);
 	if (status) {
 		hddLog(LOGE, FL("Failed to create proc file"));
 		return status;
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_nan_datapath.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_nan_datapath.c
index 62f97f51cb0..feb1a2b6450 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_nan_datapath.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_nan_datapath.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,8 +40,8 @@ static const struct nla_policy
 qca_wlan_vendor_ndp_policy[QCA_WLAN_VENDOR_ATTR_NDP_PARAMS_MAX + 1] = {
 	[QCA_WLAN_VENDOR_ATTR_NDP_SUBCMD] = { .type = NLA_U32 },
 	[QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID] = { .type = NLA_U16 },
-	[QCA_WLAN_VENDOR_ATTR_NDP_IFACE_STR] = { .type = NLA_STRING,
-					.len = IFNAMSIZ },
+	[QCA_WLAN_VENDOR_ATTR_NDP_IFACE_STR] = { .type = NLA_NUL_STRING,
+					.len = IFNAMSIZ - 1 },
 	[QCA_WLAN_VENDOR_ATTR_NDP_SERVICE_INSTANCE_ID] = { .type = NLA_U32 },
 	[QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL] = { .type = NLA_U32 },
 	[QCA_WLAN_VENDOR_ATTR_NDP_PEER_DISCOVERY_MAC_ADDR] = {
@@ -58,8 +58,15 @@ qca_wlan_vendor_ndp_policy[QCA_WLAN_VENDOR_ATTR_NDP_PARAMS_MAX + 1] = {
 					.len = VOS_MAC_ADDR_SIZE },
 	[QCA_WLAN_VENDOR_ATTR_NDP_INSTANCE_ID_ARRAY] = { .type = NLA_BINARY,
 					.len = NDP_NUM_INSTANCE_ID },
-	[QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE] = { .type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE] = { .type =
+								NLA_U32 },
 	[QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE] = { .type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL_CONFIG] = { .type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE] = { .type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_NDP_PMK] = { .type = NLA_BINARY,
+					.len = NDP_PMK_LEN },
+	[QCA_WLAN_VENDOR_ATTR_NDP_SCID] = { .type = NLA_BINARY,
+					.len = NDP_SCID_BUF_LEN },
 };
 
 /**
@@ -387,6 +394,7 @@ static int hdd_ndi_delete_req_handler(hdd_context_t *hdd_ctx,
 	uint16_t transaction_id;
 	struct nan_datapath_ctx *ndp_ctx;
 	int ret;
+	hdd_station_ctx_t *sta_ctx;
 
 	ENTER();
 
@@ -426,6 +434,12 @@ static int hdd_ndi_delete_req_handler(hdd_context_t *hdd_ctx,
 		return -EINVAL;
 	}
 
+	sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+	if (!sta_ctx) {
+		hddLog(LOGE, FL("sta_ctx is NULL"));
+		return -EINVAL;
+	}
+
 	/* check if there are active peers on the adapter */
 	if (ndp_ctx->active_ndp_peers > 0) {
 		hddLog(LOGE, FL("NDP peers active: %d, cannot delete NDI"),
@@ -433,6 +447,12 @@ static int hdd_ndi_delete_req_handler(hdd_context_t *hdd_ctx,
 		return -EINVAL;
 	}
 
+	/*
+	 * Since, the interface is being deleted, remove the
+	 */
+	hdd_ctx->sta_to_adapter[sta_ctx->broadcast_staid] = 0;
+	sta_ctx->broadcast_staid = HDD_WLAN_INVALID_STA_ID;
+
 	ndp_ctx->ndp_delete_transaction_id = transaction_id;
 	ndp_ctx->state = NAN_DATA_NDI_DELETING_STATE;
 
@@ -451,6 +471,18 @@ static int hdd_ndi_delete_req_handler(hdd_context_t *hdd_ctx,
  * @hdd_ctx: hdd context
  * @tb: parsed NL attribute list
  *
+ * tb will contain following vendor attributes:
+ * QCA_WLAN_VENDOR_ATTR_NDP_IFACE_STR
+ * QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID
+ * QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL - optional
+ * QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL_CONFIG
+ * QCA_WLAN_VENDOR_ATTR_NDP_SERVICE_INSTANCE_ID
+ * QCA_WLAN_VENDOR_ATTR_NDP_PEER_DISCOVERY_MAC_ADDR
+ * QCA_WLAN_VENDOR_ATTR_NDP_APP_INFO - optional
+ * QCA_WLAN_VENDOR_ATTR_NDP_CONFIG_QOS - optional
+ * QCA_WLAN_VENDOR_ATTR_NDP_PMK - optional
+ * QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE - optional
+ *
  * Return:  0 on success or error code on failure
  */
 static int hdd_ndp_initiator_req_handler(hdd_context_t *hdd_ctx,
@@ -506,12 +538,17 @@ static int hdd_ndp_initiator_req_handler(hdd_context_t *hdd_ctx,
 	req.transaction_id =
 		nla_get_u16(tb[QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID]);
 
-	if (!tb[QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL]) {
-		hddLog(LOGE, FL("NDP channel is unavailable"));
+	if (tb[QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL])
+		req.channel =
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL]);
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL_CONFIG]) {
+		req.channel_cfg =
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL_CONFIG]);
+	} else {
+		hddLog(LOGE, FL("Channel config is unavailable"));
 		return -EINVAL;
 	}
-	req.channel =
-		nla_get_u16(tb[QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL]);
 
 	if (!tb[QCA_WLAN_VENDOR_ATTR_NDP_SERVICE_INSTANCE_ID]) {
 		hddLog(LOGE, FL("NDP service instance ID is unavailable"));
@@ -546,10 +583,31 @@ static int hdd_ndp_initiator_req_handler(hdd_context_t *hdd_ctx,
 			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_NDP_CONFIG_QOS]);
 	}
 
-	hddLog(LOG1, FL("vdev_id: %d, transaction_id: %d, channel: %d, service_instance_id: %d, ndp_app_info_len: %d, peer_discovery_mac_addr: %pM"),
+	if (tb[QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE] &&
+		!tb[QCA_WLAN_VENDOR_ATTR_NDP_PMK]) {
+		hddLog(LOGE, FL("PMK cannot be absent when CSID is present."));
+		return -EINVAL;
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_NDP_PMK]) {
+		req.pmk.pmk = nla_data(tb[QCA_WLAN_VENDOR_ATTR_NDP_PMK]);
+		req.pmk.pmk_len = nla_len(tb[QCA_WLAN_VENDOR_ATTR_NDP_PMK]);
+		VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_HDD,
+				VOS_TRACE_LEVEL_DEBUG,
+				req.pmk.pmk, req.pmk.pmk_len);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE]) {
+		req.ncs_sk_type =
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE]);
+
+	}
+
+	hddLog(LOG1,
+		FL("vdev_id: %d, transaction_id: %d, channel: %d, service_instance_id: %d, ndp_app_info_len: %d, csid: %d, peer_discovery_mac_addr: %pM"),
 		req.vdev_id, req.transaction_id, req.channel,
 		req.service_instance_id, req.ndp_info.ndp_app_info_len,
-		req.peer_discovery_mac_addr.bytes);
+		req.ncs_sk_type, req.peer_discovery_mac_addr.bytes);
 	status = sme_ndp_initiator_req_handler(hal, &req);
 	if (status != VOS_STATUS_SUCCESS) {
 		hddLog(LOGE,
@@ -566,6 +624,16 @@ static int hdd_ndp_initiator_req_handler(hdd_context_t *hdd_ctx,
  * @hdd_ctx: hdd context
  * @tb: parsed NL attribute list
  *
+ * tb includes following vendor attributes:
+ * QCA_WLAN_VENDOR_ATTR_NDP_IFACE_STR
+ * QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID
+ * QCA_WLAN_VENDOR_ATTR_NDP_INSTANCE_ID
+ * QCA_WLAN_VENDOR_ATTR_NDP_RESPONSE_CODE
+ * QCA_WLAN_VENDOR_ATTR_NDP_APP_INFO - optional
+ * QCA_WLAN_VENDOR_ATTR_NDP_CONFIG_QOS - optional
+ * QCA_WLAN_VENDOR_ATTR_NDP_PMK - optional
+ * QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE - optional
+ *
  * Return: 0 on success or error code on failure
  */
 static int hdd_ndp_responder_req_handler(hdd_context_t *hdd_ctx,
@@ -660,10 +728,31 @@ static int hdd_ndp_responder_req_handler(hdd_context_t *hdd_ctx,
 		hddLog(LOG1, FL("NDP config data is unavailable"));
 	}
 
+	if (tb[QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE] &&
+		!tb[QCA_WLAN_VENDOR_ATTR_NDP_PMK]) {
+		hddLog(LOGE, FL("PMK cannot be absent when CSID is present."));
+		return -EINVAL;
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_NDP_PMK]) {
+		req.pmk.pmk = nla_data(tb[QCA_WLAN_VENDOR_ATTR_NDP_PMK]);
+		req.pmk.pmk_len = nla_len(tb[QCA_WLAN_VENDOR_ATTR_NDP_PMK]);
+		VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_HDD,
+				VOS_TRACE_LEVEL_DEBUG,
+				req.pmk.pmk, req.pmk.pmk_len);
+	}
+
+	if (tb[QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE]) {
+		req.ncs_sk_type =
+			nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE]);
+
+	}
+
 	hddLog(LOG1,
-		FL("vdev_id: %d, transaction_id: %d, ndp_rsp %d, ndp_instance_id: %d, ndp_app_info_len: %d"),
+		FL("vdev_id: %d, transaction_id: %d, ndp_rsp %d, ndp_instance_id: %d, ndp_app_info_len: %d, csid: %d"),
 		req.vdev_id, req.transaction_id, req.ndp_rsp,
-		req.ndp_instance_id, req.ndp_info.ndp_app_info_len);
+		req.ndp_instance_id, req.ndp_info.ndp_app_info_len,
+		req.ncs_sk_type);
 
 	status = sme_ndp_responder_req_handler(hdd_ctx->hHal, &req);
 	if (status != eHAL_STATUS_SUCCESS) {
@@ -744,7 +833,7 @@ static int hdd_ndp_end_req_handler(hdd_context_t *hdd_ctx, struct nlattr **tb)
  * QCA_WLAN_VENDOR_ATTR_NDP_SUBCMD =
  *         QCA_WLAN_VENDOR_ATTR_NDP_INTERFACE_CREATE (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID (2 bytes)
- * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE (4 bytes)
+ * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE (4 bytes)
  *
  * Return: none
@@ -762,6 +851,10 @@ static void hdd_ndp_iface_create_rsp_handler(hdd_adapter_t *adapter,
 	uint8_t create_transaction_id = 0;
 	uint32_t create_status = NDP_RSP_STATUS_ERROR;
 	uint32_t create_reason = NDP_NAN_DATA_IFACE_CREATE_FAILED;
+	hdd_station_ctx_t *sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+	v_MACADDR_t bc_mac_addr = VOS_MAC_ADDR_BROADCAST_INITIALIZER;
+	tCsrRoamInfo roam_info = {0};
+	tSirBssDescription tmp_bss_descp = {0};
 
 	ENTER();
 
@@ -784,6 +877,11 @@ static void hdd_ndp_iface_create_rsp_handler(hdd_adapter_t *adapter,
 		create_fail = true;
 	}
 
+	if (!sta_ctx) {
+		hddLog(LOGE, FL("ndp_ctx is NULL"));
+		create_fail = true;
+	}
+
 	/* notify response to the upper layer */
 	vendor_event = cfg80211_vendor_event_alloc(hdd_ctx->wiphy,
 				NULL,
@@ -812,7 +910,8 @@ static void hdd_ndp_iface_create_rsp_handler(hdd_adapter_t *adapter,
 	}
 
 	/* Status code */
-	if (nla_put_u32(vendor_event, QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE,
+	if (nla_put_u32(vendor_event,
+		QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE,
 		create_status)) {
 		hddLog(LOGE, FL("VENDOR_ATTR_NDP_DRV_RETURN_TYPE put fail"));
 		goto nla_put_failure;
@@ -833,7 +932,8 @@ static void hdd_ndp_iface_create_rsp_handler(hdd_adapter_t *adapter,
 		QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID,
 		create_transaction_id);
 	hddLog(LOG2, FL("status code: %d, value: %d"),
-		QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE, create_status);
+		QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE,
+		create_status);
 	hddLog(LOG2, FL("Return value: %d, value: %d"),
 		QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE,
 		create_reason);
@@ -857,6 +957,13 @@ static void hdd_ndp_iface_create_rsp_handler(hdd_adapter_t *adapter,
 	if (create_fail)
 		goto close_ndi;
 
+	sta_ctx->broadcast_staid = ndi_rsp->sta_id;
+	hdd_save_peer(sta_ctx, sta_ctx->broadcast_staid, &bc_mac_addr);
+	hdd_roamRegisterSTA(adapter, &roam_info,
+			sta_ctx->broadcast_staid,
+			&bc_mac_addr, &tmp_bss_descp);
+	hdd_ctx->sta_to_adapter[sta_ctx->broadcast_staid] = adapter;
+
 	EXIT();
 	return;
 
@@ -915,7 +1022,7 @@ static void hdd_ndp_iface_delete_rsp_handler(hdd_adapter_t *adapter,
  * QCA_WLAN_VENDOR_ATTR_NDP_SUBCMD =
  *         QCA_WLAN_VENDOR_ATTR_NDP_INTERFACE_DELETE (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID (2 bytes)
- * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE (4 bytes)
+ * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE (4 bytes)
  *
  * Return: none
@@ -927,6 +1034,9 @@ void hdd_ndp_session_end_handler(hdd_adapter_t *adapter)
 	struct nan_datapath_ctx *ndp_ctx;
 	uint32_t data_len = sizeof(uint32_t) * 3 + sizeof(uint16_t) +
 				NLA_HDRLEN * 4 + NLMSG_HDRLEN;
+	VOS_STATUS status;
+	bool can_enter_standby = true;
+	hdd_adapter_list_node_t *adapter_node, *next;
 
 	ENTER();
 
@@ -984,7 +1094,7 @@ void hdd_ndp_session_end_handler(hdd_adapter_t *adapter)
 
 	/* Status code */
 	if (nla_put_u32(vendor_event,
-			QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE,
+			QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE,
 			ndp_ctx->ndi_delete_rsp_status)) {
 		hddLog(LOGE, FL("VENDOR_ATTR_NDP_DRV_RETURN_TYPE put fail"));
 		goto failure;
@@ -1005,7 +1115,7 @@ void hdd_ndp_session_end_handler(hdd_adapter_t *adapter)
 		QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID,
 		ndp_ctx->ndp_delete_transaction_id);
 	hddLog(LOG2, FL("status code: %d, value: %d"),
-		QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE,
+		QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE,
 		ndp_ctx->ndi_delete_rsp_status);
 	hddLog(LOG2, FL("Return value: %d, value: %d"),
 		QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE,
@@ -1016,6 +1126,24 @@ void hdd_ndp_session_end_handler(hdd_adapter_t *adapter)
 
 	cfg80211_vendor_event(vendor_event, GFP_KERNEL);
 
+	/*
+	 * It is possible that deleted NDI was the last active interface.
+	 * We should let the device enter lower power mode
+	 */
+	status = hdd_get_front_adapter(hdd_ctx, &adapter_node);
+	while ((NULL != adapter_node) && (VOS_STATUS_SUCCESS == status)) {
+		if (test_bit(DEVICE_IFACE_OPENED,
+				&adapter_node->pAdapter->event_flags)) {
+			can_enter_standby = false;
+			break;
+		}
+		status = hdd_get_next_adapter(hdd_ctx, adapter_node, &next);
+		adapter_node = next;
+	}
+
+	if (can_enter_standby)
+		wlan_hdd_stop_enter_lowpower(hdd_ctx);
+
 	EXIT();
 	return;
 
@@ -1034,7 +1162,7 @@ failure:
  *         QCA_WLAN_VENDOR_ATTR_NDP_INITIATOR_RESPONSE (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID (2 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_INSTANCE_ID (4 bytes)
- * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE (4 bytes)
+ * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE (4 bytes)
  *
  * Return: none
@@ -1078,7 +1206,8 @@ static void hdd_ndp_initiator_rsp_handler(hdd_adapter_t *adapter,
 			rsp->ndp_instance_id))
 		goto ndp_initiator_rsp_nla_failed;
 
-	if (nla_put_u32(vendor_event, QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE,
+	if (nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE,
 			rsp->status))
 		goto ndp_initiator_rsp_nla_failed;
 
@@ -1115,7 +1244,6 @@ static void hdd_ndp_new_peer_ind_handler(hdd_adapter_t *adapter,
 	tCsrRoamInfo roam_info = {0};
 	struct nan_datapath_ctx *ndp_ctx = WLAN_HDD_GET_NDP_CTX_PTR(adapter);
 	hdd_station_ctx_t *sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
-	v_MACADDR_t bc_mac_addr = VOS_MAC_ADDR_BROADCAST_INITIALIZER;
 
 	ENTER();
 
@@ -1138,16 +1266,11 @@ static void hdd_ndp_new_peer_ind_handler(hdd_adapter_t *adapter,
 	ndp_ctx->active_ndp_peers++;
 	hddLog(LOG1, FL("vdev_id: %d, num_peers: %d"),
 		adapter->sessionId,  ndp_ctx->active_ndp_peers);
-
 	hdd_roamRegisterSTA(adapter, &roam_info, new_peer_ind->sta_id,
 			    &new_peer_ind->peer_mac_addr, &tmp_bss_descp);
 	hdd_ctx->sta_to_adapter[new_peer_ind->sta_id] = adapter;
 	/* perform following steps for first new peer ind */
 	if (ndp_ctx->active_ndp_peers == 1) {
-		hdd_ctx->sta_to_adapter[NDP_BROADCAST_STAID] = adapter;
-		hdd_save_peer(sta_ctx, NDP_BROADCAST_STAID, &bc_mac_addr);
-		hdd_roamRegisterSTA(adapter, &roam_info, NDP_BROADCAST_STAID,
-				    &bc_mac_addr, &tmp_bss_descp);
 		hddLog(LOG1, FL("Set ctx connection state to connected"));
 		sta_ctx->conn_info.connState = eConnectionState_NdiConnected;
 		hdd_wmm_connect(adapter, &roam_info, eCSR_BSS_TYPE_NDI);
@@ -1155,6 +1278,7 @@ static void hdd_ndp_new_peer_ind_handler(hdd_adapter_t *adapter,
 			WLAN_WAKE_ALL_NETIF_QUEUE,
 			WLAN_CONTROL_PATH);
 	}
+
 	EXIT();
 }
 /**
@@ -1313,6 +1437,8 @@ ndp_confirm_nla_failed:
  * QCA_WLAN_VENDOR_ATTR_NDP_INSTANCE_ID (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_APP_INFO (ndp_app_info_len size)
  * QCA_WLAN_VENDOR_ATTR_NDP_CONFIG_QOS (4 bytes)
+ * QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE(4 bytes)
+ * QCA_WLAN_VENDOR_ATTR_NDP_SCID(scid_len in size)
  *
  * Return: none
  */
@@ -1368,9 +1494,9 @@ static void hdd_ndp_indication_handler(hdd_adapter_t *adapter,
 		return;
 	}
 
-	data_len = (4 * sizeof(uint32_t)) + (2 * VOS_MAC_ADDR_SIZE) + IFNAMSIZ +
-			event->ndp_info.ndp_app_info_len + (8 * NLA_HDRLEN) +
-			NLMSG_HDRLEN;
+	data_len = (5 * sizeof(uint32_t)) + (2 * VOS_MAC_ADDR_SIZE) + IFNAMSIZ +
+		event->ndp_info.ndp_app_info_len + event->scid.scid_len +
+		(10 * NLA_HDRLEN) + NLMSG_HDRLEN;
 
 	/* notify response to the upper layer */
 	vendor_event = cfg80211_vendor_event_alloc(hdd_ctx->wiphy,
@@ -1424,6 +1550,24 @@ static void hdd_ndp_indication_handler(hdd_adapter_t *adapter,
 			goto ndp_indication_nla_failed;
 	}
 
+	if (event->scid.scid_len) {
+		if (nla_put_u32(vendor_event,
+				QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE,
+				event->ncs_sk_type))
+			goto ndp_indication_nla_failed;
+
+		if (nla_put(vendor_event, QCA_WLAN_VENDOR_ATTR_NDP_SCID,
+				event->scid.scid_len,
+				event->scid.scid))
+			goto ndp_indication_nla_failed;
+
+		hddLog(LOG1, FL("csid: %d, scid_len: %d"),
+			event->ncs_sk_type, event->scid.scid_len);
+
+		VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_DEBUG,
+				event->scid.scid, event->scid.scid_len);
+	}
+
 	cfg80211_vendor_event(vendor_event, GFP_KERNEL);
 	EXIT();
 	return;
@@ -1442,8 +1586,8 @@ ndp_indication_nla_failed:
  * QCA_WLAN_VENDOR_ATTR_NDP_SUBCMD =
  *         QCA_WLAN_VENDOR_ATTR_NDP_RESPONDER_RESPONSE (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID (2 bytes)
- * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE (4 bytes)
- * QCA_WLAN_VENDOR_ATTR_NDP_RESPONSE_CODE (4 bytes)
+ * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE (4 bytes)
+ * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE (4 bytes)
  *
  * Return: none
  */
@@ -1489,12 +1633,13 @@ static void hdd_ndp_responder_rsp_handler(hdd_adapter_t *adapter,
 	   rsp->transaction_id))
 		goto ndp_responder_rsp_nla_failed;
 
-	if (nla_put_u32(vendor_event, QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE,
+	if (nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE,
 	   rsp->status))
 		goto ndp_responder_rsp_nla_failed;
 
 	if (nla_put_u32(vendor_event,
-	   QCA_WLAN_VENDOR_ATTR_NDP_RESPONSE_CODE,
+	   QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE,
 	   rsp->reason))
 		goto ndp_responder_rsp_nla_failed;
 
@@ -1515,7 +1660,7 @@ ndp_responder_rsp_nla_failed:
  * Following vendor event is sent to cfg80211:
  * QCA_WLAN_VENDOR_ATTR_NDP_SUBCMD =
  *         QCA_WLAN_VENDOR_ATTR_NDP_END_RESPONSE (4 bytes)
- * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE (4 bytes)
+ * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE (4 bytes)
  * QCA_WLAN_VENDOR_ATTR_NDP_TRANSACTION_ID (2 bytes)
  *
@@ -1553,7 +1698,8 @@ static void hdd_ndp_end_rsp_handler(hdd_adapter_t *adapter, void *rsp_params)
 			QCA_WLAN_VENDOR_ATTR_NDP_END_RESPONSE))
 		goto ndp_end_rsp_nla_failed;
 
-	if (nla_put_u32(vendor_event, QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE,
+	if (nla_put_u32(vendor_event,
+			QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE,
 			rsp->status))
 		goto ndp_end_rsp_nla_failed;
 
@@ -1888,6 +2034,15 @@ int hdd_init_nan_data_mode(struct hdd_adapter_s *adapter)
 		goto error_sme_open;
 	}
 
+	ret_val = process_wma_set_command((int)adapter->sessionId,
+			(int)WMI_PDEV_PARAM_BURST_ENABLE,
+			(int)hdd_ctx->cfg_ini->enableSifsBurst,
+			PDEV_CMD);
+	if (0 != ret_val) {
+		hddLog(LOGE, FL("WMI_PDEV_PARAM_BURST_ENABLE set failed %d"),
+				ret_val);
+	}
+
 	/* open sme session for future use */
 	hal_status = sme_OpenSession(hdd_ctx->hHal, hdd_smeRoamCallback,
 			adapter, (uint8_t *)&adapter->macAddressCurrent,
@@ -1939,15 +2094,6 @@ int hdd_init_nan_data_mode(struct hdd_adapter_s *adapter)
 
 	set_bit(WMM_INIT_DONE, &adapter->event_flags);
 
-	ret_val = process_wma_set_command((int)adapter->sessionId,
-			(int)WMI_PDEV_PARAM_BURST_ENABLE,
-			(int)hdd_ctx->cfg_ini->enableSifsBurst,
-			PDEV_CMD);
-	if (0 != ret_val) {
-		hddLog(LOGE, FL("WMI_PDEV_PARAM_BURST_ENABLE set failed %d"),
-				ret_val);
-	}
-
 	ndp_ctx->state = NAN_DATA_NDI_CREATING_STATE;
 	return ret_val;
 
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_nan_datapath.h b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_nan_datapath.h
index 0ee46a119ea..3af78bdac5a 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_nan_datapath.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_nan_datapath.h
@@ -39,6 +39,8 @@ struct wireless_dev;
 
 #define NDP_APP_INFO_LEN 255
 #define NDP_QOS_INFO_LEN 255
+#define NDP_PMK_LEN 32
+#define NDP_SCID_BUF_LEN 256
 #define NDP_NUM_INSTANCE_ID 255
 
 
@@ -72,8 +74,9 @@ struct wireless_dev;
  * @QCA_WLAN_VENDOR_ATTR_NDP_INSTANCE_ID_ARRAY: NDP instance id array
  * @QCA_WLAN_VENDOR_ATTR_NDP_RESPONSE_CODE: Schedule response
  * @QCA_WLAN_VENDOR_ATTR_NDP_NDI_MAC_ADDR: NDI mac address
- * @QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE: Driver return status
+ * @QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE: Driver return status
  * @QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE: Driver return value
+ * @QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL_CONFIG: Channel config request type
  */
 enum qca_wlan_vendor_attr_ndp_params {
 	QCA_WLAN_VENDOR_ATTR_NDP_PARAM_INVALID = 0,
@@ -83,6 +86,7 @@ enum qca_wlan_vendor_attr_ndp_params {
 	QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL,
 	QCA_WLAN_VENDOR_ATTR_NDP_PEER_DISCOVERY_MAC_ADDR,
 	QCA_WLAN_VENDOR_ATTR_NDP_IFACE_STR,
+	/* CONFIG_SECURITY is deprecated, use NCS_SK_TYPE/PMK/SCID instead */
 	QCA_WLAN_VENDOR_ATTR_NDP_CONFIG_SECURITY,
 	QCA_WLAN_VENDOR_ATTR_NDP_CONFIG_QOS,
 	QCA_WLAN_VENDOR_ATTR_NDP_APP_INFO,
@@ -90,8 +94,12 @@ enum qca_wlan_vendor_attr_ndp_params {
 	QCA_WLAN_VENDOR_ATTR_NDP_INSTANCE_ID_ARRAY,
 	QCA_WLAN_VENDOR_ATTR_NDP_RESPONSE_CODE,
 	QCA_WLAN_VENDOR_ATTR_NDP_NDI_MAC_ADDR,
-	QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_TYPE,
+	QCA_WLAN_VENDOR_ATTR_NDP_DRV_RESPONSE_STATUS_TYPE,
 	QCA_WLAN_VENDOR_ATTR_NDP_DRV_RETURN_VALUE,
+	QCA_WLAN_VENDOR_ATTR_NDP_CHANNEL_CONFIG,
+	QCA_WLAN_VENDOR_ATTR_NDP_NCS_SK_TYPE,
+	QCA_WLAN_VENDOR_ATTR_NDP_PMK,
+	QCA_WLAN_VENDOR_ATTR_NDP_SCID,
 
 	QCA_WLAN_VENDOR_ATTR_NDP_PARAMS_AFTER_LAST,
 	QCA_WLAN_VENDOR_ATTR_NDP_PARAMS_MAX =
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ocb.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ocb.c
index b6494ca47e4..d511f9b097b 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ocb.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ocb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,6 +39,7 @@
 #include "wlan_tgt_def_config.h"
 #include "schApi.h"
 #include "wma.h"
+#include "vos_types.h"
 
 /* Structure definitions for WLAN_SET_DOT11P_CHANNEL_SCHED */
 #define AIFSN_MIN		(2)
@@ -125,7 +126,7 @@ static int dot11p_validate_qos_params(struct sir_qos_params qos_params[])
 
 #define DOT11P_TX_PWR_MAX	30
 #define DOT11P_TX_ANTENNA_MAX	6
-#define NUM_DOT11P_CHANNELS	10
+#define NUM_DOT11P_CHANNELS	ARRAY_SIZE(valid_dot11p_channels)
 /*
  * If FEATURE_STATICALLY_ADD_11P_CHANNELS
  * is defined, IEEE80211_CHAN_NO_10MHZ,
@@ -145,7 +146,7 @@ struct chan_info {
 	uint32_t max_bandwidth;
 };
 
-struct chan_info valid_dot11p_channels[NUM_DOT11P_CHANNELS] = {
+struct chan_info valid_dot11p_channels[] = {
 	{5860, 10},
 	{5870, 10},
 	{5880, 10},
@@ -155,7 +156,21 @@ struct chan_info valid_dot11p_channels[NUM_DOT11P_CHANNELS] = {
 	{5920, 10},
 	{5875, 20},
 	{5905, 20},
-	{5852, 5}
+	{5852, 5},
+	{5857, 5},
+	{5862, 5},
+	{5867, 5},
+	{5872, 5},
+	{5877, 5},
+	{5882, 5},
+	{5887, 5},
+	{5892, 5},
+	{5897, 5},
+	{5902, 5},
+	{5907, 5},
+	{5912, 5},
+	{5917, 5},
+	{5922, 5},
 };
 
 /**
@@ -406,10 +421,11 @@ static int hdd_ocb_register_sta(hdd_adapter_t *adapter)
  *
  * Return: A pointer to the OCB configuration struct, NULL on failure.
  */
-static struct sir_ocb_config *hdd_ocb_config_new(int num_channels,
-						 int num_schedule,
-						 int ndl_chan_list_len,
-						 int ndl_active_state_list_len)
+static
+struct sir_ocb_config *hdd_ocb_config_new(uint32_t num_channels,
+					  uint32_t num_schedule,
+					  uint32_t ndl_chan_list_len,
+					  uint32_t ndl_active_state_list_len)
 {
 	struct sir_ocb_config *ret = 0;
 	uint32_t len;
@@ -516,22 +532,41 @@ static void hdd_ocb_set_config_callback(void *context_ptr, void *response_ptr)
 static int hdd_ocb_set_config_req(hdd_adapter_t *adapter,
 				  struct sir_ocb_config *config)
 {
-	int rc;
+	int i, rc;
 	eHalStatus halStatus;
+	bool enable_chan_stats;
 	struct hdd_ocb_ctxt context = {0};
+	struct dsrc_radio_chan_stats_ctxt *ctx;
 
 	if (hdd_ocb_validate_config(adapter, config)) {
 		hddLog(LOGE, FL("The configuration is invalid"));
 		return -EINVAL;
 	}
 
+	/*
+	 * Save OCB configured channel information for
+	 * DSRC Radio channel statistics event processsor.
+	 */
+	ctx = &adapter->dsrc_chan_stats;
+	ctx->config_chans_num = config->channel_count;
+	for (i = 0; i < config->channel_count; i++)
+		ctx->config_chans_freq[i] = config->channels[i].chan_freq;
+	if (ctx->cur_req) {
+		vos_mem_free(ctx->cur_req);
+		ctx->cur_req = NULL;
+	}
+	/* Disable Channel Statistics */
+	enable_chan_stats = ctx->enable_chan_stats;
+	if (enable_chan_stats)
+		wlan_hdd_dsrc_config_radio_chan_stats(adapter, false);
+
 	init_completion(&context.completion_evt);
 	context.adapter = adapter;
 	context.magic = HDD_OCB_MAGIC;
 
 	hddLog(LOG1, FL("Disabling queues"));
 	wlan_hdd_netif_queue_control(adapter, WLAN_NETIF_TX_DISABLE_N_CARRIER,
-				WLAN_CONTROL_PATH);
+				     WLAN_CONTROL_PATH);
 	/* Call the SME API to set the config */
 	halStatus = sme_ocb_set_config(
 		((hdd_context_t *)adapter->pHddCtx)->hHal, &context,
@@ -566,8 +601,31 @@ end:
 	spin_lock(&hdd_context_lock);
 	context.magic = 0;
 	spin_unlock(&hdd_context_lock);
-	if (rc)
+	if (rc) {
 		hddLog(LOGE, FL("Operation failed: %d"), rc);
+
+		/* Flush already saved configured channel frequence */
+		ctx->config_chans_num = 0;
+		vos_mem_zero(ctx->config_chans_freq, 2 * sizeof(uint32_t));
+	} else {
+		if (enable_chan_stats)
+			wlan_hdd_dsrc_config_radio_chan_stats(adapter, true);
+
+		/*
+		 * Net device mtu size is 1500 by default, But for OCB RAW mode,
+		 * driver need later convert 802.3 data header to IEEE802.11
+		 * data header and EPD header, which will increase total frame
+		 * length. In such case, long packet length will exceed the
+		 * target credit size. It resulted in that the packet is cut
+		 * down, data would be missed and the traffic would be broken.
+		 * So decrease the netdev mtu size to work around this issue
+		 * in IEEE80211p RAW mode.
+		 */
+		if (config->flags & OCB_CONFIG_FLAG_80211_FRAME_MODE)
+			adapter->dev->mtu = ETH_DATA_LEN - 8;
+		else
+			adapter->dev->mtu = ETH_DATA_LEN;
+	}
 	return rc;
 }
 
@@ -754,6 +812,9 @@ static const struct nla_policy qca_wlan_vendor_ocb_set_config_policy[
 	[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM] = {
 		.type = NLA_BINARY
 	},
+	[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_TA_MAX_DURATION] = {
+		.type = NLA_U32
+	},
 };
 
 static const struct nla_policy qca_wlan_vendor_ocb_set_utc_time_policy[
@@ -846,6 +907,8 @@ struct wlan_hdd_ocb_config_channel {
 	sir_qos_params_t qos_params[MAX_NUM_AC];
 	uint32_t max_pwr;
 	uint32_t min_pwr;
+	uint32_t datarate;
+	uint8_t mac_address[6];
 };
 
 static void wlan_hdd_ocb_config_channel_to_sir_ocb_config_channel(
@@ -872,6 +935,7 @@ static void wlan_hdd_ocb_config_channel_to_sir_ocb_config_channel(
 		dest[i].max_pwr = src[i].max_pwr / 2;
 		dest[i].min_pwr = (src[i].min_pwr + 1) / 2;
 		dest[i].flags = src[i].flags;
+		vos_mem_copy(dest[i].mac_address, src[i].mac_address, 6);
 	}
 }
 
@@ -900,10 +964,11 @@ static int __wlan_hdd_cfg80211_ocb_set_config(struct wiphy *wiphy,
 	struct nlattr *ndl_active_state_list;
 	uint32_t ndl_active_state_list_len;
 	uint32_t flags = 0;
+	uint32_t ta_max_duration = 0;
 	void *def_tx_param = NULL;
 	uint32_t def_tx_param_size = 0;
 	int i;
-	int channel_count, schedule_size;
+	uint32_t channel_count, schedule_size;
 	struct sir_ocb_config *config;
 	int rc = -EINVAL;
 	uint8_t *mac_addr;
@@ -948,10 +1013,18 @@ static int __wlan_hdd_cfg80211_ocb_set_config(struct wiphy *wiphy,
 		tb[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_SCHEDULE_SIZE]);
 
 	/* Get the ndl chan array and the ndl active state array. */
+	if (!tb[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_NDL_CHANNEL_ARRAY]) {
+		hddLog(LOGE, FL("NDL_CHANNEL_ARRAY is not present"));
+		return -EINVAL;
+	}
 	ndl_chan_list =
 		tb[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_NDL_CHANNEL_ARRAY];
 	ndl_chan_list_len = (ndl_chan_list ? nla_len(ndl_chan_list) : 0);
 
+	if (!tb[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_NDL_ACTIVE_STATE_ARRAY]) {
+		hddLog(LOGE, FL("NDL_ACTIVE_STATE_ARRAY is not present"));
+		return -EINVAL;
+	}
 	ndl_active_state_list =
 		tb[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_NDL_ACTIVE_STATE_ARRAY];
 	ndl_active_state_list_len = (ndl_active_state_list ?
@@ -970,6 +1043,11 @@ static int __wlan_hdd_cfg80211_ocb_set_config(struct wiphy *wiphy,
 			QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM]);
 	}
 
+	/* Get the ta max duration. This parameter is optional. */
+	if (tb[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_TA_MAX_DURATION])
+		ta_max_duration = nla_get_u32(tb[
+			QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_TA_MAX_DURATION]);
+
 	config = hdd_ocb_config_new(channel_count, schedule_size,
 				    ndl_chan_list_len,
 				    ndl_active_state_list_len);
@@ -981,6 +1059,14 @@ static int __wlan_hdd_cfg80211_ocb_set_config(struct wiphy *wiphy,
 	config->channel_count = channel_count;
 	config->schedule_size = schedule_size;
 	config->flags = flags;
+	/*
+	 * Set max duration after the last TA received that the local time set
+	 * by TA is synchronous to other communicating OCB STAs. If it expires,
+	 * the OCB STA itself without UTC time source like GPS thinks that the
+	 * local time of itself is not sync to other STAs and stop scheduling
+	 * DSRC channel switch.
+	 */
+	config->ta_max_duration = ta_max_duration;
 	config->def_tx_param = def_tx_param;
 	config->def_tx_param_size = def_tx_param_size;
 
@@ -1009,10 +1095,19 @@ static int __wlan_hdd_cfg80211_ocb_set_config(struct wiphy *wiphy,
 	adapter->ocb_mac_addr_count = 0;
 
 	/*
-	 * Setup locally administered mac addresses for each channel.
-	 * First channel uses the adapter's address.
+	 * Setup locally managed mac addresses for each channel.
+	 * If no configured mac address set from userspace,
+	 * first channel uses the adapter's default address.
 	 */
 	for (i = 0; i < config->channel_count; i++) {
+		/*
+		 * If dsrc_config not set the mac address, then default mac
+		 * address from dsrc_config app is all zero and invalid.
+		 */
+		if (!vos_is_macaddr_zero(
+		    (v_MACADDR_t *)config->channels[i].mac_address))
+			continue;
+
 		if (i == 0) {
 			vos_mem_copy(config->channels[i].mac_address,
 				adapter->macAddressCurrent.bytes,
@@ -2154,3 +2249,288 @@ void wlan_hdd_dcc_register_for_dcc_stats_event(hdd_context_t *hdd_ctx)
 	if (rc)
 		hddLog(LOGE, FL("Register callback failed: %d"), rc);
 }
+
+static void wlan_hdd_dsrc_update_radio_chan_stats(
+		struct dsrc_radio_chan_stats_ctxt *ctx,
+		struct radio_chan_stats_rsp *resp)
+{
+	int i, j;
+	struct radio_chan_stats_info *src, *dest;
+
+	if (!ctx || !resp)
+		return;
+
+	if (resp->num_chans > ctx->config_chans_num)
+		return;
+
+	src = resp->chan_stats;
+	dest = ctx->chan_stats;
+	/* Check if current event is for previous channel configuration. */
+	for (i = 0; i < resp->num_chans; i++, src++) {
+		if (!src) {
+			hddLog(LOGE, FL("Channel stats data is null"));
+			return;
+		}
+
+		for (j = 0; j < ctx->config_chans_num; j++) {
+			if (src->chan_freq == ctx->config_chans_freq[j])
+				break;
+		}
+		if (j == ctx->config_chans_num) {
+			/*
+			 * This DSRC Channel Radio channel statistics event
+			 * is for previous old channel configuration.
+			 * Now just Ignore this type event and clear saved
+			 * entry in driver. If possible, driver can post
+			 * the recorders to application.
+			 */
+			spin_lock(&ctx->chan_stats_lock);
+			ctx->chan_stats_num = 0;
+			vos_mem_zero(dest, 2 * sizeof(*dest));
+			spin_unlock(&ctx->chan_stats_lock);
+			hddLog(LOGE, FL("Old Chan Stats Data"));
+			return;
+		}
+	}
+
+	/* Save the first channels statistics event in adapter. */
+	src = resp->chan_stats;
+	if (!ctx->chan_stats_num) {
+		spin_lock(&ctx->chan_stats_lock);
+		vos_mem_copy(dest, src, resp->num_chans * sizeof(*src));
+		ctx->chan_stats_num = resp->num_chans;
+		spin_unlock(&ctx->chan_stats_lock);
+		return;
+	}
+
+	/* Merge new received channel statistics data to previous entry. */
+	spin_lock(&ctx->chan_stats_lock);
+	for (i = 0; i < resp->num_chans; i++, src++) {
+		struct radio_chan_stats_info *dest_entry = NULL;
+		struct radio_chan_stats_info *empty_entry = NULL;
+
+		/* Now only two channel stats supported. */
+		dest = ctx->chan_stats;
+		for (j = 0; j < DSRC_MAX_CHAN_STATS_CNT; j++, dest++) {
+			/* Get empty entry */
+			if (dest->chan_freq == 0) {
+				empty_entry = dest;
+				continue;
+			}
+			if (src->chan_freq == dest->chan_freq) {
+				dest_entry = dest;
+				break;
+			}
+		}
+
+		if (dest_entry) {
+			dest = dest_entry;
+		} else if (empty_entry) {
+			/* Copy new recorders to new entry*/
+			ctx->chan_stats_num++;
+			vos_mem_copy(empty_entry, src, sizeof(*src));
+			continue;
+		} else {
+			spin_unlock(&ctx->chan_stats_lock);
+			hddLog(LOGE, FL("No entry found."));
+			return;
+		}
+
+		/* Ignore Invalid statistics data. */
+		if (src->measurement_period == 0) {
+			hddLog(LOGE, FL("Invalid stats data."));
+			continue;
+		}
+
+		/* Merge Channel Statistics. */
+		dest->measurement_period += src->measurement_period;
+		dest->on_chan_us += src->on_chan_us;
+		dest->on_chan_ratio = (uint32_t)vos_do_div64(
+				dest->on_chan_us * 100,
+				dest->measurement_period);
+		dest->tx_duration_us += src->tx_duration_us;
+		dest->rx_duration_us += src->rx_duration_us;
+		if (dest->on_chan_us == 0) {
+			dest->chan_busy_ratio = 0;
+		} else {
+			dest->chan_busy_ratio = (uint32_t)vos_do_div64(
+				(dest->tx_duration_us +
+				 dest->rx_duration_us) * 100,
+				dest->on_chan_us);
+		}
+		dest->tx_mpdus += src->tx_mpdus;
+		dest->tx_msdus += src->tx_msdus;
+		dest->rx_succ_pkts += src->rx_succ_pkts;
+		dest->rx_fail_pkts += src->rx_fail_pkts;
+	}
+	spin_unlock(&ctx->chan_stats_lock);
+
+	return;
+}
+
+/**
+ * wlan_hdd_dsrc_radio_chan_stats_event_callback() - Callback function for
+ * WLAN DSRC Radio channel statistics event.
+ * @context_ptr: pointer to radio channel statistics context.
+ * @resp_ptr: pointer to radio channel statistics event buffer.
+ */
+static void wlan_hdd_dsrc_radio_chan_stats_event_callback(void *context_ptr,
+							  void *resp_ptr)
+{
+	int i;
+	struct radio_chan_stats_req *req;
+	struct radio_chan_stats_rsp *resp;
+	struct radio_chan_stats_info *chan_stats;
+	struct dsrc_radio_chan_stats_ctxt *ctx;
+
+	if (!context_ptr || !resp_ptr)
+		return;
+
+	ctx = (struct dsrc_radio_chan_stats_ctxt *)context_ptr;
+	resp = (struct radio_chan_stats_rsp *)resp_ptr;
+	chan_stats = resp->chan_stats;
+
+	if (!chan_stats) {
+		hddLog(LOGE, FL("No channel stats data"));
+		return;
+	}
+
+	wlan_hdd_dsrc_update_radio_chan_stats(ctx, resp);
+
+	/*
+	 * DSRC Radio channel statistics RADIO_CHAN_STATS event is reported
+	 * to HDD as following cases.
+	 * 1. FW randomly report event caused by overflow,
+	 *	configuration change....
+	 * 2. Firmware response to the request from Host APP.
+	 * Need check whether current event is response for request.
+	 */
+	spin_lock(&hdd_context_lock);
+	if ((ctx->magic != HDD_OCB_MAGIC) || (!ctx->cur_req)) {
+		spin_unlock(&hdd_context_lock);
+		return;
+	}
+	req = ctx->cur_req;
+	switch (req->req_type) {
+	case WLAN_DSRC_REQUEST_ONE_RADIO_CHAN_STATS:
+		if ((resp->num_chans == 1) &&
+		    (req->chan_freq == chan_stats->chan_freq)) {
+			complete(&ctx->completion_evt);
+			spin_unlock(&hdd_context_lock);
+			return;
+		}
+		break;
+	case WLAN_DSRC_REQUEST_ALL_RADIO_CHAN_STATS:
+		if (resp->num_chans != ctx->config_chans_num) {
+			spin_unlock(&hdd_context_lock);
+			return;
+		}
+		/* Check response channel is configured. */
+		for (i = 0; i < resp->num_chans; i++) {
+			if (chan_stats[i].chan_freq !=
+			    ctx->config_chans_freq[i]) {
+				spin_unlock(&hdd_context_lock);
+				return;
+			}
+		}
+		complete(&ctx->completion_evt);
+		break;
+	}
+	spin_unlock(&hdd_context_lock);
+
+	return;
+}
+
+int wlan_hdd_dsrc_config_radio_chan_stats(hdd_adapter_t *adapter,
+					  bool enable_chan_stats)
+{
+	int ret = 0;
+	hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+	struct dsrc_radio_chan_stats_ctxt *ctx;
+	struct radio_chan_stats_info *chan_stats;
+
+	if (VOS_FTM_MODE == hdd_get_conparam()) {
+		hddLog(LOGE, FL("Command not allowed in FTM mode"));
+		return -EINVAL;
+	}
+
+	if (wlan_hdd_validate_context(hdd_ctx))
+		return -EINVAL;
+
+	ctx = &adapter->dsrc_chan_stats;
+	if (ctx->enable_chan_stats == enable_chan_stats) {
+		hddLog(LOGE, FL("DSRC channel stats already %s\n"),
+			enable_chan_stats == true ? "enable" : "disable");
+		return ret;
+	}
+
+	ctx->chan_stats_num = 0;
+	chan_stats = ctx->chan_stats;
+	vos_mem_zero(chan_stats, DSRC_MAX_CHAN_STATS_CNT * sizeof(*chan_stats));
+
+	if (enable_chan_stats) {
+		spin_lock_init(&ctx->chan_stats_lock);
+		ret = sme_register_radio_chan_stats_cb(
+			((hdd_context_t *)adapter->pHddCtx)->hHal, (void *)ctx,
+			wlan_hdd_dsrc_radio_chan_stats_event_callback);
+	} else {
+		ret = sme_unregister_radio_chan_stats_cb(
+			((hdd_context_t *)adapter->pHddCtx)->hHal);
+	}
+
+	ret = process_wma_set_command((int)adapter->sessionId,
+			(int)WMI_PDEV_PARAM_RADIO_CHAN_STATS_ENABLE,
+			enable_chan_stats, PDEV_CMD);
+
+	if (!ret)
+		ctx->enable_chan_stats = enable_chan_stats;
+
+	return ret;
+}
+
+int wlan_hdd_dsrc_request_radio_chan_stats(hdd_adapter_t *adapter,
+					   struct radio_chan_stats_req *req)
+{
+	int ret = 0;
+	eHalStatus halStatus;
+	struct dsrc_radio_chan_stats_ctxt *ctx;
+
+	halStatus = sme_request_radio_chan_stats(
+			((hdd_context_t *)adapter->pHddCtx)->hHal, req);
+	if (halStatus != eHAL_STATUS_SUCCESS) {
+		hddLog(LOGE, FL("Error call dsrc chan stats req func."));
+		return -EINVAL;
+	}
+
+	ctx = &adapter->dsrc_chan_stats;
+	init_completion(&ctx->completion_evt);
+	spin_lock(&hdd_context_lock);
+	ctx->magic = HDD_OCB_MAGIC;
+	spin_unlock(&hdd_context_lock);
+	if (!wait_for_completion_timeout(&ctx->completion_evt,
+		msecs_to_jiffies(WLAN_WAIT_TIME_OCB_CMD))) {
+		hddLog(LOGE, FL("Wait for request completion timedout."));
+		ret = -ETIMEDOUT;
+	}
+
+	spin_lock(&hdd_context_lock);
+	ctx->magic = 0;
+	spin_unlock(&hdd_context_lock);
+	return ret;
+}
+
+void wlan_hdd_dsrc_deinit_chan_stats(hdd_adapter_t *adapter)
+{
+	struct dsrc_radio_chan_stats_ctxt *ctx;
+
+	if (!adapter)
+		return;
+
+	ctx = &adapter->dsrc_chan_stats;
+	if (ctx->cur_req) {
+		vos_mem_free(ctx->cur_req);
+		ctx->cur_req = NULL;
+	}
+
+	return;
+}
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ocb.h b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ocb.h
index 57c55a40bc2..7d33b3e6e79 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ocb.h
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_ocb.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -33,6 +33,8 @@
 
 #define WLAN_OCB_CHANNEL_MAX 5
 
+#define DOT11P_CONTROL_CHANNEL 5890
+
 /**
  * struct ocb_qos_params - QoS Parameters for each AC
  * @aifsn:  Arbitration Inter-Frame Spacing
@@ -96,6 +98,9 @@ struct dot11p_channel_sched {
  * @QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM:
  *      default TX parameters to use in the case that a packet is sent without
  *      a TX control header
+ * @QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_TA_MAX_DURATION:
+ *      max duration after the last TA received that the local time set
+ *      by TA is synchronous to other communicating OCB STAs
  */
 enum qca_wlan_vendor_attr_ocb_set_config {
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_INVALID = 0,
@@ -107,6 +112,7 @@ enum qca_wlan_vendor_attr_ocb_set_config {
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_NDL_ACTIVE_STATE_ARRAY,
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_FLAGS,
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM,
+	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_TA_MAX_DURATION,
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_AFTER_LAST,
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_MAX =
 		QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_AFTER_LAST - 1,
@@ -242,7 +248,7 @@ enum qca_wlan_vendor_attr_dcc_update_ndl {
 	QCA_WLAN_VENDOR_ATTR_DCC_UPDATE_NDL_MAX =
 		QCA_WLAN_VENDOR_ATTR_DCC_UPDATE_NDL_AFTER_LAST - 1,
 };
-
+#ifdef WLAN_FEATURE_DSRC
 void hdd_set_dot11p_config(hdd_context_t *hdd_ctx);
 
 int iw_set_dot11p_channel_sched(struct net_device *dev,
@@ -291,4 +297,112 @@ int wlan_hdd_cfg80211_dcc_update_ndl(struct wiphy *wiphy,
 
 void wlan_hdd_dcc_register_for_dcc_stats_event(hdd_context_t *hdd_ctx);
 
+int wlan_hdd_dsrc_config_radio_chan_stats(hdd_adapter_t *adapter,
+					  bool enable_chan_stats);
+
+int wlan_hdd_dsrc_request_radio_chan_stats(hdd_adapter_t *adapter,
+					   struct radio_chan_stats_req *req);
+
+void wlan_hdd_dsrc_deinit_chan_stats(hdd_adapter_t *adapter);
+#else
+static inline void hdd_set_dot11p_config(hdd_context_t *hdd_ctx)
+{
+	return;
+}
+
+static inline int iw_set_dot11p_channel_sched(struct net_device *dev,
+		struct iw_request_info *info,
+		union iwreq_data *wrqu, char *extra)
+{
+	return 0;
+}
+
+static inline int wlan_hdd_cfg80211_ocb_set_config(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data,
+		int data_len)
+{
+	return 0;
+}
+
+static inline int wlan_hdd_cfg80211_ocb_set_utc_time(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data,
+		int data_len)
+{
+	return 0;
+}
+
+static inline int wlan_hdd_cfg80211_ocb_start_timing_advert(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data,
+		int data_len)
+{
+	return 0;
+}
+
+static inline int wlan_hdd_cfg80211_ocb_stop_timing_advert(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data,
+		int data_len)
+{
+	return 0;
+}
+
+static inline int wlan_hdd_cfg80211_ocb_get_tsf_timer(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data,
+		int data_len)
+{
+	return 0;
+}
+
+static inline int wlan_hdd_cfg80211_dcc_get_stats(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data,
+		int data_len)
+{
+	return 0;
+}
+
+static inline int wlan_hdd_cfg80211_dcc_clear_stats(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data,
+		int data_len)
+{
+	return 0;
+}
+
+static inline int wlan_hdd_cfg80211_dcc_update_ndl(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data,
+		int data_len)
+{
+	return 0;
+}
+
+static inline void wlan_hdd_dcc_register_for_dcc_stats_event(
+		hdd_context_t *hdd_ctx)
+{
+	return;
+}
+
+static inline int wlan_hdd_dsrc_config_radio_chan_stats(hdd_adapter_t *adapter,
+		bool enable_chan_stats)
+{
+	return 0;
+}
+
+static inline int wlan_hdd_dsrc_request_radio_chan_stats(hdd_adapter_t *adapter,
+		struct radio_chan_stats_req *req)
+{
+	return 0;
+}
+
+static inline void wlan_hdd_dsrc_deinit_chan_stats(hdd_adapter_t *adapter)
+{
+	return;
+}
+#endif
+
 #endif /* __WLAN_HDD_OCB_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_oemdata.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_oemdata.c
index c8b39968206..2e6072fab83 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_oemdata.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_oemdata.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -48,6 +48,9 @@
 #include "vos_utils.h"
 #include "wma.h"
 #include "wlan_hdd_oemdata.h"
+#ifdef CNSS_GENL
+#include <net/cnss_nl.h>
+#endif
 
 static struct hdd_context_s *pHddCtx;
 
@@ -178,6 +181,26 @@ int iw_get_oem_data_cap(
     return 0;
 }
 
+/**
+ * nl_srv_ucast_oem() - Wrapper function to send ucast msgs to OEM
+ * @skb: sk buffer pointer
+ * @dst_pid: Destination PID
+ * @flag: flags
+ *
+ * Sends the ucast message to OEM with generic nl socket if CNSS_GENL
+ * is enabled. Else, use the legacy netlink socket to send.
+ *
+ * Return: None
+ */
+static void nl_srv_ucast_oem(struct sk_buff *skb, int dst_pid, int flag)
+{
+#ifdef CNSS_GENL
+	nl_srv_ucast(skb, dst_pid, flag, WLAN_NL_MSG_OEM,
+					CLD80211_MCGRP_OEM_MSGS);
+#else
+	nl_srv_ucast(skb, dst_pid, flag);
+#endif
+}
 /**---------------------------------------------------------------------------
 
   \brief send_oem_reg_rsp_nlink_msg() - send oem registration response
@@ -267,7 +290,7 @@ static void send_oem_reg_rsp_nlink_msg(void)
              "%s: sending App Reg Response length (%d) to process pid (%d)",
              __func__, aniHdr->length, pHddCtx->oem_pid);
 
-   (void)nl_srv_ucast(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
+   (void)nl_srv_ucast_oem(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
 
    return;
 }
@@ -319,7 +342,7 @@ static void send_oem_err_rsp_nlink_msg(v_SINT_t app_pid, tANI_U8 error_code)
              "%s: sending oem error response to process pid (%d)",
              __func__, app_pid);
 
-   (void)nl_srv_ucast(skb, app_pid, MSG_DONTWAIT);
+   (void)nl_srv_ucast_oem(skb, app_pid, MSG_DONTWAIT);
 
    return;
 }
@@ -387,7 +410,7 @@ void send_oem_data_rsp_msg(int length, tANI_U8 *oemDataRsp)
              "%s: sending Oem Data Response of len (%d) to process pid (%d)",
              __func__, length, pHddCtx->oem_pid);
 
-   (void)nl_srv_ucast(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
+   (void)nl_srv_ucast_oem(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
 
    return;
 }
@@ -624,7 +647,7 @@ static int oem_process_channel_info_req_msg(int numOfChannels, char *chanList)
              "%s: sending channel info resp for num channels (%d) to pid (%d)",
              __func__, numOfChannels, pHddCtx->oem_pid);
 
-   (void)nl_srv_ucast(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
+   (void)nl_srv_ucast_oem(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
 
    return 0;
 }
@@ -686,7 +709,7 @@ static int oem_process_set_cap_req_msg(int oem_cap_len,
 
 	hddLog(LOG1, FL("sending oem response to process pid %d"), app_pid);
 
-	(void)nl_srv_ucast(skb, app_pid, MSG_DONTWAIT);
+	(void)nl_srv_ucast_oem(skb, app_pid, MSG_DONTWAIT);
 
 	return error_code;
 }
@@ -752,7 +775,7 @@ static int oem_process_get_cap_req_msg(void)
 	hddLog(LOG1, FL("send rsp to oem-pid:%d for get_capability"),
 		pHddCtx->oem_pid);
 
-	(void)nl_srv_ucast(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
+	(void)nl_srv_ucast_oem(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
 	return 0;
 }
 
@@ -870,7 +893,7 @@ void hdd_SendPeerStatusIndToOemApp(v_MACADDR_t *peerMac,
              pPeerInfo->peer_chan_info.reg_info_2,
              pPeerInfo->reserved0);
 
-   (void)nl_srv_ucast(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
+   (void)nl_srv_ucast_oem(skb, pHddCtx->oem_pid, MSG_DONTWAIT);
 
    return;
 }
@@ -881,18 +904,19 @@ void hdd_SendPeerStatusIndToOemApp(v_MACADDR_t *peerMac,
  * @hdd_ctx: handle to HDD context
  * @msg_hdr: pointer to ANI message header
  * @nlh: pointer to NL message header
+ * @pid: Process ID
  *
  * Return: 0 if success, error code otherwise
  */
 static int oem_app_reg_req_handler(struct hdd_context_s *hdd_ctx,
-				   tAniMsgHdr *msg_hdr, struct nlmsghdr *nlh)
+				   tAniMsgHdr *msg_hdr, int pid)
 {
 	char *sign_str = NULL;
 
 	/* Registration request is only allowed for Qualcomm Application */
 	hddLog(LOG1,
 	       FL("Received App Reg Req from App process pid(%d), len(%d)"),
-	       nlh->nlmsg_pid, msg_hdr->length);
+	       pid, msg_hdr->length);
 
 	sign_str = (char *)((char *)msg_hdr + sizeof(tAniMsgHdr));
 	if ((OEM_APP_SIGNATURE_LEN == msg_hdr->length) &&
@@ -900,17 +924,16 @@ static int oem_app_reg_req_handler(struct hdd_context_s *hdd_ctx,
 			  OEM_APP_SIGNATURE_LEN))) {
 		hddLog(LOG1,
 		       FL("Valid App Reg Req from oem app process pid(%d)"),
-		       nlh->nlmsg_pid);
+		       pid);
 
 		hdd_ctx->oem_app_registered = TRUE;
-		hdd_ctx->oem_pid = nlh->nlmsg_pid;
+		hdd_ctx->oem_pid = pid;
 		send_oem_reg_rsp_nlink_msg();
 	} else {
 		hddLog(LOGE,
 		       FL("Invalid signature in App Reg Req from pid(%d)"),
-		       nlh->nlmsg_pid);
-		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-					   OEM_ERR_INVALID_SIGNATURE);
+		       pid);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_INVALID_SIGNATURE);
 		return -EPERM;
 	}
 
@@ -922,30 +945,29 @@ static int oem_app_reg_req_handler(struct hdd_context_s *hdd_ctx,
  * @hdd_ctx: handle to HDD context
  * @msg_hdr: pointer to ANI message header
  * @nlh: pointer to NL message header
+ * @pid: Process ID
  *
  * Return: 0 if success, error code otherwise
  */
 static int oem_data_req_handler(struct hdd_context_s *hdd_ctx,
-				tAniMsgHdr *msg_hdr, struct nlmsghdr *nlh)
+				tAniMsgHdr *msg_hdr, int pid)
 {
 	hddLog(LOG1, FL("Received Oem Data Request length(%d) from pid: %d"),
-		     msg_hdr->length, nlh->nlmsg_pid);
+		     msg_hdr->length, pid);
 
 	if ((!hdd_ctx->oem_app_registered) ||
-	    (nlh->nlmsg_pid != hdd_ctx->oem_pid)) {
+	    (pid != hdd_ctx->oem_pid)) {
 		/* either oem app is not registered yet or pid is different */
 		hddLog(LOGE, FL("OEM DataReq: app not registered(%d) or incorrect pid(%d)"),
-			     hdd_ctx->oem_app_registered, nlh->nlmsg_pid);
-		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-					   OEM_ERR_APP_NOT_REGISTERED);
+			     hdd_ctx->oem_app_registered, pid);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_APP_NOT_REGISTERED);
 		return -EPERM;
 	}
 
 	if ((!msg_hdr->length) || (OEM_DATA_REQ_SIZE < msg_hdr->length)) {
 		hddLog(LOGE, FL("Invalid length (%d) in Oem Data Request"),
 			     msg_hdr->length);
-		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-					   OEM_ERR_INVALID_MESSAGE_LENGTH);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_INVALID_MESSAGE_LENGTH);
 		return -EPERM;
 	}
 
@@ -961,24 +983,24 @@ static int oem_data_req_handler(struct hdd_context_s *hdd_ctx,
  * @hdd_ctx: handle to HDD context
  * @msg_hdr: pointer to ANI message header
  * @nlh: pointer to NL message header
+ * @pid: Process ID
  *
  * Return: 0 if success, error code otherwise
  */
 static int oem_chan_info_req_handler(struct hdd_context_s *hdd_ctx,
-				     tAniMsgHdr *msg_hdr, struct nlmsghdr *nlh)
+				     tAniMsgHdr *msg_hdr, int pid)
 {
 	hddLog(LOG1,
 	       FL("Received channel info request, num channel(%d) from pid: %d"),
-	       msg_hdr->length, nlh->nlmsg_pid);
+	       msg_hdr->length, pid);
 
 	if ((!hdd_ctx->oem_app_registered) ||
-	    (nlh->nlmsg_pid != hdd_ctx->oem_pid)) {
+	    (pid != hdd_ctx->oem_pid)) {
 		/* either oem app is not registered yet or pid is different */
 		hddLog(LOGE,
 		       FL("Chan InfoReq: app not registered(%d) or incorrect pid(%d)"),
-		       hdd_ctx->oem_app_registered, nlh->nlmsg_pid);
-		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-					   OEM_ERR_APP_NOT_REGISTERED);
+		       hdd_ctx->oem_app_registered, pid);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_APP_NOT_REGISTERED);
 		return -EPERM;
 	}
 
@@ -988,8 +1010,7 @@ static int oem_chan_info_req_handler(struct hdd_context_s *hdd_ctx,
 		hddLog(LOGE,
 		       FL("Invalid length (%d) in channel info request"),
 		       msg_hdr->length);
-		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-					   OEM_ERR_INVALID_MESSAGE_LENGTH);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_INVALID_MESSAGE_LENGTH);
 		return -EPERM;
 	}
 	oem_process_channel_info_req_msg(msg_hdr->length,
@@ -1003,22 +1024,22 @@ static int oem_chan_info_req_handler(struct hdd_context_s *hdd_ctx,
  * @hdd_ctx: handle to HDD context
  * @msg_hdr: pointer to ANI message header
  * @nlh: pointer to NL message header
+ * @pid: Process ID
  *
  * Return: 0 if success, error code otherwise
  */
 static int oem_set_cap_req_handler(struct hdd_context_s *hdd_ctx,
-				   tAniMsgHdr *msg_hdr, struct nlmsghdr *nlh)
+				   tAniMsgHdr *msg_hdr, int pid)
 {
 	hddLog(LOG1, FL("Received set oem cap req of length:%d from pid: %d"),
-		     msg_hdr->length, nlh->nlmsg_pid);
+		     msg_hdr->length, pid);
 
 	if ((!hdd_ctx->oem_app_registered) ||
-	    (nlh->nlmsg_pid != hdd_ctx->oem_pid)) {
+	    (pid != hdd_ctx->oem_pid)) {
 		/* oem app is not registered yet or pid is different */
 		hddLog(LOGE, FL("set_oem_capability : app not registered(%d) or incorrect pid(%d)"),
-			     hdd_ctx->oem_app_registered, nlh->nlmsg_pid);
-		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-					   OEM_ERR_APP_NOT_REGISTERED);
+			     hdd_ctx->oem_app_registered, pid);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_APP_NOT_REGISTERED);
 		return -EPERM;
 	}
 
@@ -1026,14 +1047,13 @@ static int oem_set_cap_req_handler(struct hdd_context_s *hdd_ctx,
 		(sizeof(struct sme_oem_capability) < msg_hdr->length)) {
 		hddLog(LOGE, FL("Invalid length (%d) in set_oem_capability"),
 			     msg_hdr->length);
-		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-					   OEM_ERR_INVALID_MESSAGE_LENGTH);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_INVALID_MESSAGE_LENGTH);
 		return -EPERM;
 	}
 
 	oem_process_set_cap_req_msg(msg_hdr->length, (char *)
 				    ((char *)msg_hdr + sizeof(tAniMsgHdr)),
-				    nlh->nlmsg_pid);
+				    pid);
 	return 0;
 }
 
@@ -1042,22 +1062,22 @@ static int oem_set_cap_req_handler(struct hdd_context_s *hdd_ctx,
  * @hdd_ctx: handle to HDD context
  * @msg_hdr: pointer to ANI message header
  * @nlh: pointer to NL message header
+ * @pid: Process ID
  *
  * Return: 0 if success, error code otherwise
  */
 static int oem_get_cap_req_handler(struct hdd_context_s *hdd_ctx,
-				   tAniMsgHdr *msg_hdr, struct nlmsghdr *nlh)
+				   tAniMsgHdr *msg_hdr, int pid)
 {
 	hddLog(LOG1, FL("Rcvd get oem capability req - length:%d from pid: %d"),
-		     msg_hdr->length, nlh->nlmsg_pid);
+		     msg_hdr->length, pid);
 
 	if ((!hdd_ctx->oem_app_registered) ||
-	    (nlh->nlmsg_pid != hdd_ctx->oem_pid)) {
+	    (pid != hdd_ctx->oem_pid)) {
 		/* oem app is not registered yet or pid is different */
 		hddLog(LOGE, FL("get_oem_capability : app not registered(%d) or incorrect pid(%d)"),
-			     hdd_ctx->oem_app_registered, nlh->nlmsg_pid);
-		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-					   OEM_ERR_APP_NOT_REGISTERED);
+			     hdd_ctx->oem_app_registered, pid);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_APP_NOT_REGISTERED);
 		return -EPERM;
 	}
 
@@ -1065,6 +1085,120 @@ static int oem_get_cap_req_handler(struct hdd_context_s *hdd_ctx,
 	return 0;
 }
 
+/**
+ * oem_request_dispatcher() - OEM command dispatcher API
+ * @msg_hdr: ANI Message Header
+ * @pid: process id
+ *
+ * This API is used to dispatch the command from OEM depending
+ * on the type of the message received.
+ *
+ * Return: None
+ */
+static void oem_request_dispatcher(tAniMsgHdr *msg_hdr, int pid)
+{
+	switch (msg_hdr->type) {
+	case ANI_MSG_APP_REG_REQ:
+		oem_app_reg_req_handler(pHddCtx, msg_hdr, pid);
+		break;
+
+	case ANI_MSG_OEM_DATA_REQ:
+		oem_data_req_handler(pHddCtx, msg_hdr, pid);
+		break;
+
+	case ANI_MSG_CHANNEL_INFO_REQ:
+		oem_chan_info_req_handler(pHddCtx, msg_hdr, pid);
+		break;
+
+	case ANI_MSG_SET_OEM_CAP_REQ:
+		oem_set_cap_req_handler(pHddCtx, msg_hdr, pid);
+		break;
+
+	case ANI_MSG_GET_OEM_CAP_REQ:
+		oem_get_cap_req_handler(pHddCtx, msg_hdr, pid);
+		break;
+
+	default:
+		hddLog(LOGE, FL("Received Invalid message type (%d), length (%d)"),
+				msg_hdr->type, msg_hdr->length);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_INVALID_MESSAGE_TYPE);
+	}
+}
+
+#ifdef CNSS_GENL
+/**
+ * oem_cmd_handler() - API to handle OEM commands
+ * @data: Pointer to data
+ * @data_len: length of the received data
+ * @ctx: Pointer to the context
+ * @pid: Process id
+ *
+ * This API handles the command from OEM application from user space and
+ * send back event to user space if necessary.
+ *
+ * Return: None
+ */
+static void oem_cmd_handler(const void *data, int data_len, void *ctx, int pid)
+{
+	tAniMsgHdr *msg_hdr;
+	int msg_len;
+	int ret;
+	struct nlattr *tb[CLD80211_ATTR_MAX + 1];
+
+	ret = wlan_hdd_validate_context(pHddCtx);
+	if (ret) {
+		hddLog(LOGE, FL("hdd ctx validate fails"));
+		return;
+	}
+
+	/*
+	 * audit note: it is ok to pass a NULL policy here since only
+	 * one attribute is parsed and it is explicitly validated
+	 */
+	if (nla_parse(tb, CLD80211_ATTR_MAX, data, data_len, NULL)) {
+		hddLog(LOGE, FL("Invalid ATTR"));
+		return;
+	}
+
+	if (!tb[CLD80211_ATTR_DATA]) {
+		hddLog(LOGE, FL("attr ATTR_DATA failed"));
+		return;
+	}
+
+	msg_len = nla_len(tb[CLD80211_ATTR_DATA]);
+	if (msg_len < sizeof(*msg_hdr)) {
+		hdd_err("runt ATTR_DATA size %d", msg_len);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_NULL_MESSAGE_HEADER);
+		return;
+	}
+
+	msg_hdr = nla_data(tb[CLD80211_ATTR_DATA]);
+	if (msg_len < (sizeof(*msg_hdr) + msg_hdr->length)) {
+		hdd_err("Invalid nl msg len %d, msg hdr len %d",
+			msg_len, msg_hdr->length);
+		send_oem_err_rsp_nlink_msg(pid, OEM_ERR_INVALID_MESSAGE_LENGTH);
+		return;
+	}
+
+	oem_request_dispatcher(msg_hdr, pid);
+}
+
+/**
+ * oem_activate_service() - API to register the oem command handler
+ * @hdd_ctx: Pointer to HDD Context
+ *
+ * This API is used to register the oem app command handler. Argument
+ * @pAdapter is given for prototype compatibility with legacy code.
+ *
+ * Return: 0
+ */
+int oem_activate_service(void *hdd_ctx)
+{
+	pHddCtx = (struct hdd_context_s *) hdd_ctx;
+	register_cld_cmd_cb(WLAN_NL_MSG_OEM, oem_cmd_handler, NULL);
+	return 0;
+}
+#else
 /*
  * Callback function invoked by Netlink service for all netlink
  * messages (from user space) addressed to WLAN_NL_MSG_OEM
@@ -1082,67 +1216,39 @@ static int oem_get_cap_req_handler(struct hdd_context_s *hdd_ctx,
  */
 static int oem_msg_callback(struct sk_buff *skb)
 {
-   struct nlmsghdr *nlh;
-   tAniMsgHdr *msg_hdr;
-   int ret;
-
-   nlh = (struct nlmsghdr *)skb->data;
+	struct nlmsghdr *nlh;
+	tAniMsgHdr *msg_hdr;
+	int ret;
 
-   if (!nlh) {
-       hddLog(LOGE, FL("Netlink header null"));
-       return -EPERM;
-   }
+	nlh = (struct nlmsghdr *)skb->data;
 
-   ret = wlan_hdd_validate_context(pHddCtx);
-   if (0 != ret)
-       return ret;
+	if (!nlh) {
+		hddLog(LOGE, FL("Netlink header null"));
+		return -EPERM;
+	}
 
-   msg_hdr = NLMSG_DATA(nlh);
+	ret = wlan_hdd_validate_context(pHddCtx);
+	if (0 != ret)
+		return ret;
 
-   if (!msg_hdr) {
-       hddLog(LOGE, FL("Message header null"));
-       send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid, OEM_ERR_NULL_MESSAGE_HEADER);
-       return -EPERM;
-   }
+	msg_hdr = NLMSG_DATA(nlh);
+	if (!msg_hdr) {
+		hddLog(LOGE, FL("Message header null"));
+		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
+						OEM_ERR_NULL_MESSAGE_HEADER);
+		return -EPERM;
+	}
 
-   if (nlh->nlmsg_len < NLMSG_LENGTH(sizeof(tAniMsgHdr) + msg_hdr->length)) {
-       hddLog(LOGE, FL("Invalid nl msg len, nlh->nlmsg_len (%d), msg_hdr->len (%d)"),
-              nlh->nlmsg_len, msg_hdr->length);
-       send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-                                  OEM_ERR_INVALID_MESSAGE_LENGTH);
-       return -EPERM;
-   }
+	if (nlh->nlmsg_len < NLMSG_LENGTH(sizeof(tAniMsgHdr) + msg_hdr->length)) {
+		hddLog(LOGE, FL("Invalid nl msg len, nlh->nlmsg_len (%d), msg_hdr->len (%d)"),
+				nlh->nlmsg_len, msg_hdr->length);
+		send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
+				OEM_ERR_INVALID_MESSAGE_LENGTH);
+		return -EPERM;
+	}
 
-   switch (msg_hdr->type) {
-   case ANI_MSG_APP_REG_REQ:
-      ret = oem_app_reg_req_handler(pHddCtx, msg_hdr, nlh);
-      break;
-
-   case ANI_MSG_OEM_DATA_REQ:
-      ret = oem_data_req_handler(pHddCtx, msg_hdr, nlh);
-      break;
-
-   case ANI_MSG_CHANNEL_INFO_REQ:
-      ret = oem_chan_info_req_handler(pHddCtx, msg_hdr, nlh);
-      break;
-
-   case ANI_MSG_SET_OEM_CAP_REQ:
-      ret = oem_set_cap_req_handler(pHddCtx, msg_hdr, nlh);
-      break;
-
-   case ANI_MSG_GET_OEM_CAP_REQ:
-      ret = oem_get_cap_req_handler(pHddCtx, msg_hdr, nlh);
-      break;
-
-   default:
-      hddLog(LOGE,
-             FL("Received Invalid message type (%d), length (%d)"),
-             msg_hdr->type, msg_hdr->length);
-      send_oem_err_rsp_nlink_msg(nlh->nlmsg_pid,
-                                 OEM_ERR_INVALID_MESSAGE_TYPE);
-      return -EPERM;
-   }
-   return ret;
+	oem_request_dispatcher(msg_hdr, nlh->nlmsg_pid);
+	return ret;
 }
 
 static int __oem_msg_callback(struct sk_buff *skb)
@@ -1164,20 +1270,18 @@ static int __oem_msg_callback(struct sk_buff *skb)
   an OEM application process.
 
   \param -
-     - pAdapter - pointer to HDD adapter
+     - hdd_ctx: Pointer to HDD context
 
   \return - 0 for success, non zero for failure
 
   --------------------------------------------------------------------------*/
-int oem_activate_service(void *pAdapter)
+int oem_activate_service(void *hdd_ctx)
 {
-   pHddCtx = (struct hdd_context_s*) pAdapter;
+   pHddCtx = (struct hdd_context_s *) hdd_ctx;
 
    /* Register the msg handler for msgs addressed to WLAN_NL_MSG_OEM */
    nl_srv_register(WLAN_NL_MSG_OEM, __oem_msg_callback);
    return 0;
 }
-
-
-
+#endif
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_p2p.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_p2p.c
index e170d6b4697..363d1a1076c 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_p2p.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_p2p.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -117,10 +117,13 @@ const char *tdls_action_frame_type[] = {"TDLS Setup Request",
 
 extern struct net_device_ops net_ops_struct;
 
-static bool wlan_hdd_is_type_p2p_action( const u8 *buf )
+static bool wlan_hdd_is_type_p2p_action( const u8 *buf, uint32_t len)
 {
     const u8 *ouiPtr;
 
+    if (len < WLAN_HDD_PUBLIC_ACTION_FRAME_SUB_TYPE_OFFSET + 1)
+        return FALSE;
+
     if ( buf[WLAN_HDD_PUBLIC_ACTION_FRAME_CATEGORY_OFFSET] !=
                WLAN_HDD_PUBLIC_ACTION_FRAME ) {
         return FALSE;
@@ -145,11 +148,11 @@ static bool wlan_hdd_is_type_p2p_action( const u8 *buf )
     return TRUE;
 }
 
-static bool hdd_p2p_is_action_type_rsp( const u8 *buf )
+static bool hdd_p2p_is_action_type_rsp( const u8 *buf, uint32_t len )
 {
     tActionFrmType actionFrmType;
 
-    if ( wlan_hdd_is_type_p2p_action(buf) )
+    if ( wlan_hdd_is_type_p2p_action(buf, len) )
     {
         actionFrmType = buf[WLAN_HDD_PUBLIC_ACTION_FRAME_SUB_TYPE_OFFSET];
         if ( actionFrmType != WLAN_HDD_INVITATION_REQ &&
@@ -162,6 +165,501 @@ static bool hdd_p2p_is_action_type_rsp( const u8 *buf )
     return FALSE;
 }
 
+/**
+ * hdd_random_mac_callback() - Callback invoked from wmi layer
+ * @set_random_addr: Status of random mac filter set operation
+ * @context: Context passed while registring callback
+ *
+ * This function is invoked from wmi layer to give the status of
+ * random mac filter set operation by firmware.
+ *
+ * Return: None
+ */
+static void hdd_random_mac_callback(bool set_random_addr, void *context)
+{
+	struct random_mac_context *rnd_ctx;
+	hdd_adapter_t *adapter;
+
+	if (!context) {
+		hddLog(LOGE, FL("Bad param, pContext"));
+		return;
+	}
+
+	rnd_ctx = context;
+	adapter = rnd_ctx->adapter;
+
+	spin_lock(&hdd_context_lock);
+	if ((!adapter) ||
+	    (rnd_ctx->magic != ACTION_FRAME_RANDOM_CONTEXT_MAGIC)) {
+		spin_unlock(&hdd_context_lock);
+		hddLog(VOS_TRACE_LEVEL_WARN,
+		       FL("Invalid context, magic [%08x]"), rnd_ctx->magic);
+		return;
+	}
+
+	rnd_ctx->magic = 0;
+	if (set_random_addr)
+		rnd_ctx->set_random_addr = true;
+
+	complete(&rnd_ctx->random_mac_completion);
+	spin_unlock(&hdd_context_lock);
+}
+
+/**
+ * hdd_set_random_mac() - Invoke sme api to set random mac filter
+ * @adapter: Pointer to adapter
+ * @random_mac_addr: Mac addr filter to be set
+ *
+ * Return: If set is successful return true else return false
+ */
+static bool hdd_set_random_mac(hdd_adapter_t *adapter, uint8_t *random_mac_addr)
+{
+	struct random_mac_context context;
+	hdd_context_t *hdd_ctx;
+	eHalStatus sme_status;
+	unsigned long rc;
+	bool status = false;
+
+	ENTER();
+	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+	if (wlan_hdd_validate_context(hdd_ctx)) {
+		hddLog(LOGE,FL("Invalid hdd ctx"));
+		return false;
+	}
+
+	init_completion(&context.random_mac_completion);
+	context.adapter = adapter;
+	context.magic = ACTION_FRAME_RANDOM_CONTEXT_MAGIC;
+	context.set_random_addr = false;
+
+	sme_status = sme_set_random_mac(hdd_ctx->hHal, hdd_random_mac_callback,
+				     adapter->sessionId, random_mac_addr,
+				     &context);
+
+	if (sme_status != eHAL_STATUS_SUCCESS) {
+		hddLog(LOGE,FL("Unable to set random mac"));
+	} else {
+		rc = wait_for_completion_timeout(&context.random_mac_completion,
+                                    msecs_to_jiffies(WLAN_WAIT_TIME_SET_RND));
+		if (!rc) {
+			hddLog(LOGE,
+			FL("SME timed out while setting random mac"));
+		}
+	}
+
+	spin_lock(&hdd_context_lock);
+	context.magic = 0;
+	status = context.set_random_addr;
+	spin_unlock(&hdd_context_lock);
+
+	EXIT();
+	return status;
+}
+
+/**
+ * hdd_clear_random_mac() - Invoke sme api to clear random mac filter
+ * @adapter: Pointer to adapter
+ * @random_mac_addr: Mac addr filter to be cleared
+ *
+ * Return: If clear is successful return true else return false
+ */
+static bool hdd_clear_random_mac(hdd_adapter_t *adapter,
+				 uint8_t *random_mac_addr)
+{
+	hdd_context_t *hdd_ctx;
+	eHalStatus status;
+
+	ENTER();
+	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+	if (wlan_hdd_validate_context(hdd_ctx)) {
+		hddLog(LOGE,FL("Invalid hdd ctx"));
+		return false;
+	}
+
+	status = sme_clear_random_mac(hdd_ctx->hHal, adapter->sessionId,
+				      random_mac_addr);
+
+	if (status != eHAL_STATUS_SUCCESS) {
+		hddLog(LOGE,FL("Unable to clear random mac"));
+		return false;
+	}
+
+	EXIT();
+	return true;
+}
+
+bool hdd_check_random_mac(hdd_adapter_t *adapter, uint8_t *random_mac_addr)
+{
+	uint32_t i = 0;
+
+	spin_lock(&adapter->random_mac_lock);
+	for (i = 0; i < MAX_RANDOM_MAC_ADDRS; i++) {
+		if ((adapter->random_mac[i].in_use) &&
+		    (!memcmp(adapter->random_mac[i].addr, random_mac_addr,
+			     VOS_MAC_ADDR_SIZE))) {
+			spin_unlock(&adapter->random_mac_lock);
+			return true;
+		}
+	}
+	spin_unlock(&adapter->random_mac_lock);
+	return false;
+}
+
+/**
+ * find_action_frame_cookie() - Checks for action cookie in cookie list
+ * @cookie_list: List of cookies
+ * @cookie: Cookie to be searched
+ *
+ * Return: If search is successful return pointer to action_frame_cookie
+ * object in which cookie item is encapsulated.
+ */
+static struct action_frame_cookie * find_action_frame_cookie(
+						struct list_head *cookie_list,
+						uint64_t cookie)
+{
+	struct action_frame_cookie *action_cookie = NULL;
+	struct list_head *temp = NULL;
+
+	list_for_each(temp, cookie_list) {
+		action_cookie = list_entry(temp, struct action_frame_cookie,
+					   cookie_node);
+		if (action_cookie->cookie == cookie)
+			return action_cookie;
+	}
+
+	return NULL;
+}
+
+/**
+ * allocate_action_frame_cookie() - Allocate and add action cookie to given list
+ * @cookie_list: List of cookies
+ * @cookie: Cookie to be added
+ *
+ * Return: If allocation and addition is successful return pointer to
+ * action_frame_cookie object in which cookie item is encapsulated.
+ */
+static struct action_frame_cookie * allocate_action_frame_cookie(
+						struct list_head *cookie_list,
+						uint64_t cookie)
+{
+	struct action_frame_cookie *action_cookie = NULL;
+
+	action_cookie = vos_mem_malloc(sizeof(*action_cookie));
+	if(!action_cookie)
+		return NULL;
+
+	action_cookie->cookie = cookie;
+	list_add(&action_cookie->cookie_node, cookie_list);
+
+	return action_cookie;
+}
+
+/**
+ * delete_action_frame_cookie() - Delete the cookie from given list
+ * @cookie_list: List of cookies
+ * @cookie: Cookie to be deleted
+ *
+ * This function deletes the cookie item from given list and corresponding
+ * object in which it is encapsulated.
+ *
+ * Return: None
+ */
+static void delete_action_frame_cookie(
+				struct action_frame_cookie *action_cookie)
+{
+	list_del(&action_cookie->cookie_node);
+	vos_mem_free(action_cookie);
+}
+
+/**
+ * append_action_frame_cookie() - Append action cookie to given list
+ * @cookie_list: List of cookies
+ * @cookie: Cookie to be append
+ *
+ * This is a wrapper function which invokes allocate_action_frame_cookie
+ * if the cookie to be added is not duplicate
+ *
+ * Return: 0 - for successfull case
+ *         -EALREADY - if cookie is duplicate
+ *         -ENOMEM - if allocation is failed
+ */
+static int32_t append_action_frame_cookie(struct list_head *cookie_list,
+					  uint64_t cookie)
+{
+	struct action_frame_cookie *action_cookie = NULL;
+
+	/*
+	 * There should be no mac entry with empty cookie list,
+	 * check and ignore if duplicate
+	 */
+	action_cookie = find_action_frame_cookie(cookie_list, cookie);
+	if (action_cookie)
+		/* random mac address is already programmed */
+		return -EALREADY;
+
+	/* insert new cookie in cookie list */
+	action_cookie = allocate_action_frame_cookie(cookie_list, cookie);
+	if (!action_cookie)
+		return -ENOMEM;
+
+	return 0;
+}
+
+/**
+ * hdd_set_action_frame_random_mac() - Store action frame cookie
+ * @adapter: Pointer to adapter
+ * @random_mac_addr: Mac addr for cookie
+ * @cookie: Cookie to be stored
+ *
+ * This function is used to create cookie list and append the cookies
+ * to same for corresponding random mac addr. If this cookie is the first
+ * item in the list then random mac filter is set.
+ *
+ * Return: 0 - for success else negative value
+ */
+static int32_t hdd_set_action_frame_random_mac(hdd_adapter_t *adapter,
+					       uint8_t *random_mac_addr,
+					       uint64_t cookie)
+{
+	uint32_t i = 0;
+	uint32_t in_use_cnt = 0;
+	struct action_frame_cookie *action_cookie = NULL;
+	int32_t append_ret = 0;
+
+	if (!cookie) {
+		hddLog(LOGE, FL("Invalid cookie"));
+		return -EINVAL;
+	}
+
+	hddLog(LOG1, FL("mac_addr: " MAC_ADDRESS_STR " && cookie = %llu"),
+			MAC_ADDR_ARRAY(random_mac_addr), cookie);
+
+	spin_lock(&adapter->random_mac_lock);
+	for (i = 0; i < MAX_RANDOM_MAC_ADDRS; i++) {
+		if (adapter->random_mac[i].in_use) {
+			in_use_cnt++;
+			if (!memcmp(adapter->random_mac[i].addr,
+				random_mac_addr, VOS_MAC_ADDR_SIZE))
+				break;
+		}
+	}
+
+	if (i != MAX_RANDOM_MAC_ADDRS) {
+		append_ret = append_action_frame_cookie(
+					&adapter->random_mac[i].cookie_list,
+					cookie);
+		spin_unlock(&adapter->random_mac_lock);
+
+		if(append_ret == -ENOMEM) {
+			hddLog(LOGE, FL("No Sufficient memory for cookie"));
+			return append_ret;
+		}
+
+		return 0;
+	}
+
+	/* get the first unused buf and store new random mac */
+	for (i = 0; i < MAX_RANDOM_MAC_ADDRS; i++) {
+		if (!adapter->random_mac[i].in_use)
+			break;
+	}
+
+	if ((in_use_cnt == MAX_RANDOM_MAC_ADDRS)
+		|| (i == MAX_RANDOM_MAC_ADDRS)) {
+		spin_unlock(&adapter->random_mac_lock);
+		hddLog(LOGE, FL("Reached the limit of Max random addresses"));
+		return -EBUSY;
+	}
+
+	INIT_LIST_HEAD(&adapter->random_mac[i].cookie_list);
+	action_cookie = allocate_action_frame_cookie(&adapter->random_mac[i].cookie_list,
+					cookie);
+	if(!action_cookie) {
+		spin_unlock(&adapter->random_mac_lock);
+		hddLog(LOGE, FL("No Sufficient memory for cookie"));
+		return -ENOMEM;
+	}
+	vos_mem_copy(adapter->random_mac[i].addr, random_mac_addr,
+		     VOS_MAC_ADDR_SIZE);
+	adapter->random_mac[i].in_use = true;
+	spin_unlock(&adapter->random_mac_lock);
+	/* Program random mac_addr */
+	if (!hdd_set_random_mac(adapter, adapter->random_mac[i].addr)) {
+		spin_lock(&adapter->random_mac_lock);
+		/* clear the cookie */
+		delete_action_frame_cookie(action_cookie);
+		adapter->random_mac[i].in_use = false;
+		spin_unlock(&adapter->random_mac_lock);
+		hddLog(LOGE, FL("random mac filter set failed for: "
+				MAC_ADDRESS_STR),
+				MAC_ADDR_ARRAY(adapter->random_mac[i].addr));
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+/**
+ * hdd_reset_action_frame_random_mac() - Delete action frame cookie with
+ * given random mac addr
+ * @adapter: Pointer to adapter
+ * @random_mac_addr: Mac addr for cookie
+ * @cookie: Cookie to be deleted
+ *
+ * This function is used to delete the cookie from the cookie list corresponding
+ * to given random mac addr.If cookie list is empty after deleting,
+ * it will clear random mac filter.
+ *
+ * Return: 0 - for success else negative value
+ */
+static int32_t hdd_reset_action_frame_random_mac(hdd_adapter_t *adapter,
+						 uint8_t *random_mac_addr,
+						 uint64_t cookie)
+{
+	uint32_t i = 0;
+	struct action_frame_cookie *action_cookie = NULL;
+
+	if (!cookie) {
+		hddLog(LOGE, FL("Invalid cookie"));
+		return -EINVAL;
+	}
+
+	hddLog(LOG1, FL("mac_addr: " MAC_ADDRESS_STR " && cookie = %llu"),
+			MAC_ADDR_ARRAY(random_mac_addr), cookie);
+
+	spin_lock(&adapter->random_mac_lock);
+	for (i = 0; i < MAX_RANDOM_MAC_ADDRS; i++) {
+		if ((adapter->random_mac[i].in_use) &&
+		    (!memcmp(adapter->random_mac[i].addr,
+			     random_mac_addr, VOS_MAC_ADDR_SIZE)))
+			break;
+	}
+
+	if (i == MAX_RANDOM_MAC_ADDRS) {
+		spin_unlock(&adapter->random_mac_lock);
+		hddLog(LOGE, FL("trying to delete cookie of random mac-addr"
+				" for which entry is not present"));
+		return -EINVAL;
+	}
+
+	action_cookie = find_action_frame_cookie(&adapter->random_mac[i].cookie_list,
+				    cookie);
+
+	if (!action_cookie) {
+		spin_unlock(&adapter->random_mac_lock);
+		hddLog(LOG1, FL("No cookie matches"));
+		return 0;
+	}
+
+	delete_action_frame_cookie(action_cookie);
+	if (list_empty(&adapter->random_mac[i].cookie_list)) {
+		adapter->random_mac[i].in_use = false;
+		spin_unlock(&adapter->random_mac_lock);
+		hdd_clear_random_mac(adapter, random_mac_addr);
+		hddLog(LOG1, FL("Deleted random mac_addr:"
+				MAC_ADDRESS_STR),
+				MAC_ADDR_ARRAY(random_mac_addr));
+		return 0;
+	}
+
+	spin_unlock(&adapter->random_mac_lock);
+	return 0;
+}
+
+/**
+ * hdd_delete_action_frame_cookie() - Delete action frame cookie
+ * @adapter: Pointer to adapter
+ * @cookie: Cookie to be deleted
+ *
+ * This function parses the cookie list of each random mac addr until the
+ * specified cookie is found and then deletes it. If cookie list is empty
+ * after deleting, it will clear random mac filter.
+ *
+ * Return: 0 - for success else negative value
+ */
+static int32_t hdd_delete_action_frame_cookie(hdd_adapter_t *adapter,
+					      uint64_t cookie)
+{
+	uint32_t i = 0;
+	struct action_frame_cookie *action_cookie = NULL;
+
+	hddLog(LOG1, FL("Delete cookie = %llu"), cookie);
+
+        spin_lock(&adapter->random_mac_lock);
+        for (i = 0; i < MAX_RANDOM_MAC_ADDRS; i++) {
+		if (!adapter->random_mac[i].in_use)
+			continue;
+
+		action_cookie = find_action_frame_cookie(&adapter->random_mac[i].cookie_list,
+					    cookie);
+
+		if (!action_cookie)
+			continue;
+
+		delete_action_frame_cookie(action_cookie);
+
+		if (list_empty(&adapter->random_mac[i].cookie_list)) {
+			adapter->random_mac[i].in_use = false;
+			spin_unlock(&adapter->random_mac_lock);
+			hdd_clear_random_mac(adapter,
+					     adapter->random_mac[i].addr);
+			hddLog(LOG1, FL("Deleted random addr "MAC_ADDRESS_STR),
+				MAC_ADDR_ARRAY(adapter->random_mac[i].addr));
+			return 0;
+		}
+		spin_unlock(&adapter->random_mac_lock);
+		return 0;
+	}
+
+	spin_unlock(&adapter->random_mac_lock);
+	hddLog(LOG1, FL("Invalid cookie"));
+	return -EINVAL;
+}
+
+/**
+ * hdd_delete_all_action_frame_cookies() - Delete all action frame cookies
+ * @adapter: Pointer to adapter
+ *
+ * This function deletes all the cookie lists of each random mac addr and clears
+ * the corresponding random mac filters.
+ *
+ * Return: 0 - for success else negative value
+ */
+static void hdd_delete_all_action_frame_cookies(hdd_adapter_t *adapter)
+{
+	uint32_t i = 0;
+	struct action_frame_cookie *action_cookie = NULL;
+	struct list_head *n;
+	struct list_head *temp;
+
+	spin_lock(&adapter->random_mac_lock);
+
+	for (i = 0; i < MAX_RANDOM_MAC_ADDRS; i++) {
+
+		if (!adapter->random_mac[i].in_use)
+			continue;
+
+		/* empty the list and clear random addr */
+		list_for_each_safe(temp, n,
+				   &adapter->random_mac[i].cookie_list) {
+			action_cookie = list_entry(temp,
+						   struct action_frame_cookie,
+						   cookie_node);
+			list_del(temp);
+			vos_mem_free(action_cookie);
+		}
+
+		adapter->random_mac[i].in_use = false;
+		spin_unlock(&adapter->random_mac_lock);
+		hdd_clear_random_mac(adapter, adapter->random_mac[i].addr);
+		hddLog(LOG1, FL("Deleted random addr " MAC_ADDRESS_STR),
+				MAC_ADDR_ARRAY(adapter->random_mac[i].addr));
+		spin_lock(&adapter->random_mac_lock);
+	}
+
+	spin_unlock(&adapter->random_mac_lock);
+}
+
 static eHalStatus
 wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
                                     eHalStatus status)
@@ -170,9 +668,15 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
     hdd_cfg80211_state_t *cfgState = WLAN_HDD_GET_CFG_STATE_PTR( pAdapter );
     hdd_remain_on_chan_ctx_t *pRemainChanCtx;
     hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
+    int ret_code;
 
-    if (0 != wlan_hdd_validate_context(hdd_ctx))
-        return eHAL_STATUS_FAILURE;
+    ret_code = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != ret_code) {
+        /* If ssr is inprogress, do not return, resource release is necessary */
+        if (!(-EAGAIN == ret_code && hdd_ctx->isLogpInProgress)) {
+            return eHAL_STATUS_FAILURE;
+        }
+    }
 
     mutex_lock(&cfgState->remain_on_chan_ctx_lock);
     pRemainChanCtx = cfgState->remain_on_chan_ctx;
@@ -186,11 +690,13 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
     }
 
     hddLog( LOG1, "Received remain on channel rsp");
-    vos_timer_stop(&pRemainChanCtx->hdd_remain_on_chan_timer);
-    vos_timer_destroy(&pRemainChanCtx->hdd_remain_on_chan_timer);
-
+    if (!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                    &pRemainChanCtx->hdd_remain_on_chan_timer)))
+        hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
+    if (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy(
+                    &pRemainChanCtx->hdd_remain_on_chan_timer)))
+        hddLog( LOGE, FL("Failed to destroy hdd_remain_on_chan_timer"));
     cfgState->remain_on_chan_ctx = NULL;
-
     /*
      * Resetting the roc in progress early ensures that the subsequent
      * roc requests are immediately processed without being queued
@@ -236,7 +742,9 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
      * after sending any cancel remain on channel event will also
      * ensure that the cancel roc is sent without any delays.
      */
-    schedule_delayed_work(&hdd_ctx->rocReqWork, 0);
+     /* If ssr is inprogress, do not schedule next roc req */
+     if (!hdd_ctx->isLogpInProgress)
+        schedule_delayed_work(&hdd_ctx->rocReqWork, 0);
 
     if ( ( WLAN_HDD_INFRA_STATION == pAdapter->device_mode ) ||
          ( WLAN_HDD_P2P_CLIENT == pAdapter->device_mode ) ||
@@ -270,7 +778,6 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
                 NULL, 0 );
 
     }
-
     mutex_lock(&cfgState->remain_on_chan_ctx_lock);
     if(pRemainChanCtx->action_pkt_buff.frame_ptr != NULL
        && pRemainChanCtx->action_pkt_buff.frame_length != 0 )
@@ -301,9 +808,12 @@ void wlan_hdd_cancel_existing_remain_on_channel(hdd_adapter_t *pAdapter)
 
         if (VOS_TIMER_STATE_RUNNING == vos_timer_getCurrentState(
                     &cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer))
-            vos_timer_stop(&cfgState->remain_on_chan_ctx->
-                                              hdd_remain_on_chan_timer);
-
+        {
+            if (!VOS_IS_STATUS_SUCCESS(
+                        vos_timer_stop(&cfgState->remain_on_chan_ctx->
+                                 hdd_remain_on_chan_timer)))
+                hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
+        }
         pRemainChanCtx = cfgState->remain_on_chan_ctx;
         if (NULL == pRemainChanCtx)
         {
@@ -342,7 +852,7 @@ void wlan_hdd_cancel_existing_remain_on_channel(hdd_adapter_t *pAdapter)
             vos_flush_logs(WLAN_LOG_TYPE_FATAL,
                            WLAN_LOG_INDICATOR_HOST_DRIVER,
                            WLAN_LOG_REASON_HDD_TIME_OUT,
-                           true);
+                           DUMP_VOS_TRACE);
         }
 
         INIT_COMPLETION(pAdapter->cancel_rem_on_chan_var);
@@ -356,6 +866,7 @@ void wlan_hdd_cancel_existing_remain_on_channel(hdd_adapter_t *pAdapter)
              ( WLAN_HDD_P2P_DEVICE == pAdapter->device_mode )
            )
         {
+            hdd_delete_all_action_frame_cookies(pAdapter);
             sme_CancelRemainOnChannel( WLAN_HDD_GET_HAL_CTX( pAdapter ),
                                                      pAdapter->sessionId );
         }
@@ -459,6 +970,7 @@ void wlan_hdd_cleanup_remain_on_channel_ctx(hdd_adapter_t *pAdapter)
            } else if (pAdapter->device_mode == WLAN_HDD_P2P_CLIENT ||
                 pAdapter->device_mode == WLAN_HDD_P2P_DEVICE)
            {
+               hdd_delete_all_action_frame_cookies(pAdapter);
                sme_CancelRemainOnChannel(WLAN_HDD_GET_HAL_CTX(pAdapter),
                                      pAdapter->sessionId);
            }
@@ -474,8 +986,13 @@ wait:
                 if (roc_ctx != NULL)
                 {
                      cfgState->remain_on_chan_ctx = NULL;
-                     vos_timer_stop(&roc_ctx->hdd_remain_on_chan_timer);
-                     vos_timer_destroy(&roc_ctx->hdd_remain_on_chan_timer);
+                     if (!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                                     &roc_ctx->hdd_remain_on_chan_timer)))
+                         hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
+                     if (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy
+                                 (&roc_ctx->hdd_remain_on_chan_timer)))
+                         hddLog( LOGE, FL(
+                                     "Failed to destroy hdd_remain_on_chan_timer"));
                      if (roc_ctx->action_pkt_buff.frame_ptr != NULL
                            && roc_ctx->action_pkt_buff.frame_length != 0)
                      {
@@ -506,7 +1023,7 @@ void wlan_hdd_remain_on_chan_timeout(void *data)
     hdd_cfg80211_state_t *cfgState;
 
     if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic)) {
-        hddLog(LOGE, FL("pAdapter is invalid %p !!!"), pAdapter);
+        hddLog(LOGE, FL("pAdapter is invalid %pK !!!"), pAdapter);
         return;
     }
 
@@ -539,6 +1056,7 @@ void wlan_hdd_remain_on_chan_timeout(void *data)
            ( WLAN_HDD_P2P_DEVICE == pAdapter->device_mode )
        )
     {
+        hdd_delete_all_action_frame_cookies(pAdapter);
         sme_CancelRemainOnChannel( WLAN_HDD_GET_HAL_CTX( pAdapter ),
                                                      pAdapter->sessionId );
     }
@@ -550,6 +1068,7 @@ void wlan_hdd_remain_on_chan_timeout(void *data)
                          (WLAN_HDD_GET_CTX(pAdapter))->pvosContext);
     }
 
+    wlan_hdd_start_stop_tdls_source_timer(pHddCtx, eTDLS_SUPPORT_ENABLED);
     vos_runtime_pm_allow_suspend(pHddCtx->runtime_context.roc);
     hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_ROC);
 }
@@ -635,11 +1154,21 @@ static int wlan_hdd_execute_remain_on_channel(hdd_adapter_t *pAdapter,
                                   == REMAIN_ON_CHANNEL_REQUEST)? TRUE:FALSE)) {
             hddLog(LOGE, FL("sme_RemainOnChannel returned failure"));
             mutex_lock(&cfgState->remain_on_chan_ctx_lock);
-            cfgState->remain_on_chan_ctx = NULL;
             pAdapter->is_roc_inprogress = FALSE;
+            pRemainChanCtx = cfgState->remain_on_chan_ctx;
+            hddLog( LOG1, FL(
+                        "Freeing ROC ctx cfgState->remain_on_chan_ctx=%pK"),
+                         cfgState->remain_on_chan_ctx);
+            if (pRemainChanCtx)
+            {
+                if (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy
+                            (&pRemainChanCtx->hdd_remain_on_chan_timer)))
+                    hddLog( LOGE, FL(
+                        "Failed to destroy hdd_remain_on_chan_timer"));
+                vos_mem_free(pRemainChanCtx);
+                cfgState->remain_on_chan_ctx = NULL;
+            }
             mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
-	    vos_timer_destroy(&pRemainChanCtx->hdd_remain_on_chan_timer);
-            vos_mem_free(pRemainChanCtx);
             vos_runtime_pm_allow_suspend(pHddCtx->runtime_context.roc);
             hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_ROC);
             return -EINVAL;
@@ -671,11 +1200,21 @@ static int wlan_hdd_execute_remain_on_channel(hdd_adapter_t *pAdapter,
                     "%s: WLANSAP_RemainOnChannel returned fail", __func__);
 
            mutex_lock(&cfgState->remain_on_chan_ctx_lock);
-           cfgState->remain_on_chan_ctx = NULL;
            pAdapter->is_roc_inprogress = FALSE;
+           pRemainChanCtx = cfgState->remain_on_chan_ctx;
+           hddLog( LOG1, FL(
+                        "Freeing ROC ctx cfgState->remain_on_chan_ctx=%pK"),
+                         cfgState->remain_on_chan_ctx);
+           if (pRemainChanCtx)
+           {
+                if (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy
+                            (&pRemainChanCtx->hdd_remain_on_chan_timer)))
+                    hddLog( LOGE, FL(
+                         "Failed to destroy hdd_remain_on_chan_timer"));
+                vos_mem_free (pRemainChanCtx);
+                cfgState->remain_on_chan_ctx = NULL;
+           }
            mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
-	   vos_timer_destroy(&pRemainChanCtx->hdd_remain_on_chan_timer);
-           vos_mem_free (pRemainChanCtx);
            vos_runtime_pm_allow_suspend(pHddCtx->runtime_context.roc);
            hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_ROC);
            return -EINVAL;
@@ -705,6 +1244,7 @@ static int wlan_hdd_execute_remain_on_channel(hdd_adapter_t *pAdapter,
         }
 
     }
+    wlan_hdd_start_stop_tdls_source_timer(pHddCtx, eTDLS_SUPPORT_DISABLED);
     return 0;
 }
 
@@ -863,8 +1403,6 @@ static int wlan_hdd_request_remain_on_channel( struct wiphy *wiphy,
     int ret = 0;
     int status = 0;
 
-    ENTER();
-
     hddLog(LOG1, FL("Device_mode %s(%d)"),
            hdd_device_mode_to_string(pAdapter->device_mode),
            pAdapter->device_mode);
@@ -890,7 +1428,8 @@ static int wlan_hdd_request_remain_on_channel( struct wiphy *wiphy,
     if (0 != ret)
         return ret;
 
-    if (hdd_isConnectionInProgress((hdd_context_t *)pAdapter->pHddCtx)) {
+    if (hdd_isConnectionInProgress((hdd_context_t *)pAdapter->pHddCtx, NULL,
+                                    NULL)) {
         hddLog(LOGE, FL("Connection is in progress"));
         isBusy = VOS_TRUE;
     }
@@ -935,7 +1474,7 @@ static int wlan_hdd_request_remain_on_channel( struct wiphy *wiphy,
                 wlan_hdd_roc_request_enqueue(pAdapter, pRemainChanCtx);
                 schedule_delayed_work(&pHddCtx->rocReqWork,
                 msecs_to_jiffies(pHddCtx->cfg_ini->p2p_listen_defer_interval));
-                hddLog(LOG1, "Defer interval is %hu, pAdapter %p",
+                hddLog(LOG1, "Defer interval is %hu, pAdapter %pK",
                        pHddCtx->cfg_ini->p2p_listen_defer_interval, pAdapter);
                 return 0;
             }
@@ -976,7 +1515,6 @@ static int wlan_hdd_request_remain_on_channel( struct wiphy *wiphy,
         hddLog(LOG1, FL("scheduling delayed work: no connection/roc active"));
         schedule_delayed_work(&pHddCtx->rocReqWork, 0);
     }
-    EXIT();
     return 0;
 }
 
@@ -1091,7 +1629,9 @@ void hdd_remainChanReadyHandler( hdd_adapter_t *pAdapter )
            vos_timer_getCurrentState(&pRemainChanCtx->hdd_remain_on_chan_timer))
         {
             hddLog( LOGE, "Timer Started before ready event!!!");
-            vos_timer_stop(&pRemainChanCtx->hdd_remain_on_chan_timer);
+            if (!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                            &pRemainChanCtx->hdd_remain_on_chan_timer)))
+                hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
         }
         status = vos_timer_start(&pRemainChanCtx->hdd_remain_on_chan_timer,
                                 (pRemainChanCtx->duration + COMPLETE_EVENT_PROPOGATE_TIME));
@@ -1221,19 +1761,56 @@ int __wlan_hdd_cfg80211_cancel_remain_on_channel( struct wiphy *wiphy,
      */
     mutex_lock(&cfgState->remain_on_chan_ctx_lock);
     pRemainChanCtx = cfgState->remain_on_chan_ctx;
-    if( (cfgState->remain_on_chan_ctx == NULL) ||
-        (cfgState->remain_on_chan_ctx->cookie != cookie) )
-    {
-        mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
-        hddLog( LOGE,
-            "%s: No Remain on channel pending with specified cookie value",
-             __func__);
-        return -EINVAL;
+
+    if (pRemainChanCtx) {
+       hddLog(LOGE,
+             "action_cookie = %08llx, roc cookie = %08llx, cookie = %08llx",
+             cfgState->action_cookie, pRemainChanCtx->cookie, cookie);
+
+       if (pRemainChanCtx->cookie == cookie) {
+          /* request to cancel on-going roc */
+           if (cfgState->buf) {
+              /* Tx frame pending */
+               if (cfgState->action_cookie != cookie) {
+                  hddLog( LOGE,
+                        FL("Cookie matched with RoC cookie but not with tx cookie, indicate expired event for roc"));
+                  /* RoC was extended to accomodate the tx frame */
+                  if (REMAIN_ON_CHANNEL_REQUEST ==
+                                       pRemainChanCtx->rem_on_chan_request) {
+                     cfg80211_remain_on_channel_expired(pRemainChanCtx->dev->
+                                                        ieee80211_ptr,
+                                                        pRemainChanCtx->cookie,
+                                                        &pRemainChanCtx->chan,
+                                                        GFP_KERNEL);
+                   }
+                   pRemainChanCtx->rem_on_chan_request = OFF_CHANNEL_ACTION_TX;
+                   pRemainChanCtx->cookie = cfgState->action_cookie;
+                   return 0;
+                }
+            }
+       } else if (cfgState->buf && cfgState->action_cookie == cookie) {
+                 mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
+                 hddLog( LOGE,
+                       FL("Cookie not matched with RoC cookie but matched with tx cookie, cleanup action frame"));
+                 /*free the buf and return 0*/
+                 hdd_cleanup_actionframe(pHddCtx, pAdapter);
+                 return 0;
+	 } else {
+		 mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
+		 hddLog( LOGE, FL("No matching cookie"));
+		 return -EINVAL;
+         }
+    } else {
+	    mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
+	    hddLog( LOGE, FL("RoC context is NULL, return success"));
+	    return 0;
     }
 
     if (NULL != cfgState->remain_on_chan_ctx)
     {
-        vos_timer_stop(&cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer);
+        if (!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                    &cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer)))
+            hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
         if (TRUE == pRemainChanCtx->hdd_remain_on_chan_cancel_in_progress)
         {
             mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
@@ -1273,7 +1850,7 @@ int __wlan_hdd_cfg80211_cancel_remain_on_channel( struct wiphy *wiphy,
         vos_flush_logs(WLAN_LOG_TYPE_FATAL,
                        WLAN_LOG_INDICATOR_HOST_DRIVER,
                        WLAN_LOG_REASON_HDD_TIME_OUT,
-                       true);
+                       DUMP_VOS_TRACE);
     }
     INIT_COMPLETION(pAdapter->cancel_rem_on_chan_var);
     /* Issue abort remain on chan request to sme.
@@ -1284,6 +1861,7 @@ int __wlan_hdd_cfg80211_cancel_remain_on_channel( struct wiphy *wiphy,
         (WLAN_HDD_P2P_CLIENT == pAdapter->device_mode) ||
         (WLAN_HDD_P2P_DEVICE == pAdapter->device_mode)) {
         tANI_U8 sessionId = pAdapter->sessionId;
+        hdd_delete_all_action_frame_cookies(pAdapter);
         sme_CancelRemainOnChannel( WLAN_HDD_GET_HAL_CTX( pAdapter ),
                                             sessionId );
     } else if ((WLAN_HDD_SOFTAP== pAdapter->device_mode) ||
@@ -1336,7 +1914,6 @@ int wlan_hdd_cfg80211_cancel_remain_on_channel( struct wiphy *wiphy,
     return ret;
 }
 
-
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0)) || defined(WITH_BACKPORTS)
 int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                        struct ieee80211_channel *chan, bool offchan,
@@ -1370,17 +1947,27 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
     hdd_remain_on_chan_ctx_t *pRemainChanCtx;
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX( pAdapter );
     tANI_U16 extendedWait = 0;
-    tANI_U8 type = WLAN_HDD_GET_TYPE_FRM_FC(buf[0]);
-    tANI_U8 subType = WLAN_HDD_GET_SUBTYPE_FRM_FC(buf[0]);
+    tANI_U8 type;
+    tANI_U8 subType;
     tActionFrmType actionFrmType;
     bool noack = 0;
     int status;
     unsigned long rc;
     hdd_adapter_t *goAdapter;
     uint8_t home_ch = 0;
+    bool enb_random_mac = false;
+    uint32_t mgmt_hdr_len = sizeof(struct ieee80211_hdr_3addr);
 
     ENTER();
 
+    if (len < mgmt_hdr_len + 1) {
+        hddLog(LOGE, FL("Invalid Length"));
+        return -EINVAL;
+    }
+
+    type = WLAN_HDD_GET_TYPE_FRM_FC(buf[0]);
+    subType = WLAN_HDD_GET_SUBTYPE_FRM_FC(buf[0]);
+
     hddLog(LOG1, FL("wait: %d, offchan: %d"), wait, offchan);
     MTRACE(vos_trace(VOS_MODULE_ID_HDD,
                       TRACE_CODE_HDD_ACTION, pAdapter->sessionId,
@@ -1398,16 +1985,20 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
            hdd_device_mode_to_string(pAdapter->device_mode),
            pAdapter->device_mode, type);
 
-    hddLog(LOG1, FL("category: %d, actionID: %d"),
-           buf[WLAN_HDD_PUBLIC_ACTION_FRAME_BODY_OFFSET +
+    if (type == SIR_MAC_MGMT_FRAME && subType == SIR_MAC_MGMT_ACTION &&
+        len > IEEE80211_MIN_ACTION_SIZE)
+        hddLog(LOG1, FL("category: %d, actionID: %d"),
+               buf[WLAN_HDD_PUBLIC_ACTION_FRAME_BODY_OFFSET +
                WLAN_HDD_PUBLIC_ACTION_FRAME_CATEGORY_OFFSET],
-           buf[WLAN_HDD_PUBLIC_ACTION_FRAME_BODY_OFFSET +
+               buf[WLAN_HDD_PUBLIC_ACTION_FRAME_BODY_OFFSET +
                WLAN_HDD_PUBLIC_ACTION_FRAME_ACTION_OFFSET]);
 
 #ifdef WLAN_FEATURE_P2P_DEBUG
     if ((type == SIR_MAC_MGMT_FRAME) &&
             (subType == SIR_MAC_MGMT_ACTION) &&
-            wlan_hdd_is_type_p2p_action(&buf[WLAN_HDD_PUBLIC_ACTION_FRAME_BODY_OFFSET]))
+            wlan_hdd_is_type_p2p_action(
+             &buf[WLAN_HDD_PUBLIC_ACTION_FRAME_BODY_OFFSET],
+             len - mgmt_hdr_len))
     {
         actionFrmType = buf[WLAN_HDD_PUBLIC_ACTION_FRAME_TYPE_OFFSET];
         if(actionFrmType >= MAX_P2P_ACTION_FRAME_TYPE)
@@ -1541,6 +2132,7 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
             home_ch = goAdapter->sessionCtx.ap.operatingChannel;
     }
 
+
     if (ieee80211_frequency_to_channel(chan->center_freq) == home_ch) {
         /* if adapter is already on requested ch, no need for ROC */
         wait = 0;
@@ -1560,14 +2152,43 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
         pRemainChanCtx = cfgState->remain_on_chan_ctx;
         if ((type == SIR_MAC_MGMT_FRAME) &&
               (subType == SIR_MAC_MGMT_ACTION) &&
-               hdd_p2p_is_action_type_rsp(&buf[WLAN_HDD_PUBLIC_ACTION_FRAME_BODY_OFFSET]) &&
+               hdd_p2p_is_action_type_rsp(
+                &buf[WLAN_HDD_PUBLIC_ACTION_FRAME_BODY_OFFSET],
+                len - mgmt_hdr_len) &&
                cfgState->remain_on_chan_ctx &&
                cfgState->current_freq == chan->center_freq )
          {
                if(VOS_TIMER_STATE_RUNNING == vos_timer_getCurrentState(
                    &cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer))
                {
-                   vos_timer_stop(&cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer);
+                   /* In the latest wpa_supplicant, the wait time for go
+                    * negotiation response is set to 100msec, due to which,
+                    * there could be a possibility that, if the go negotaition
+                    * confirmation frame is not received within 100 msec, ROC
+                    * would be timeout and resulting in connection failures as
+                    * the device will not be on the listen channel anymore to
+                    * receive the confirmation frame.
+                    * Also wpa_supplicant has set the wait to 50msec for go
+                    * negotiation confirmation, invitation response and
+                    * provisional discovery response frames. So increase the
+                    * wait time for all these frames.
+                    */
+                   actionFrmType =
+                          buf[WLAN_HDD_PUBLIC_ACTION_FRAME_TYPE_OFFSET];
+                   if ( actionFrmType == WLAN_HDD_GO_NEG_RESP ||
+                           actionFrmType == WLAN_HDD_PROV_DIS_RESP)
+                       wait = wait + ACTION_FRAME_RSP_WAIT;
+                   else if ( actionFrmType == WLAN_HDD_GO_NEG_CNF ||
+                           actionFrmType == WLAN_HDD_INVITATION_RESP )
+                       wait = wait + ACTION_FRAME_ACK_WAIT;
+
+                   hddLog( LOG1, "%s: Extending the wait time %d for actionFrmType=%d",
+                           __func__,wait,actionFrmType);
+
+                   if (!VOS_IS_STATUS_SUCCESS(
+                               vos_timer_stop(&cfgState->remain_on_chan_ctx->
+                                   hdd_remain_on_chan_timer)))
+                       hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
                    status = vos_timer_start(&cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer,
                                                         wait);
                    mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
@@ -1602,17 +2223,18 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
          } else
              mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
 
+        mutex_lock(&cfgState->remain_on_chan_ctx_lock);
         if((cfgState->remain_on_chan_ctx != NULL) &&
            (cfgState->current_freq == chan->center_freq)
           )
         {
+            mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
             hddLog(LOG1,"action frame: extending the wait time");
             extendedWait = (tANI_U16)wait;
             goto send_frame;
         }
-
+        mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
         INIT_COMPLETION(pAdapter->offchannel_tx_event);
-
         status = wlan_hdd_request_remain_on_channel(wiphy, dev,
                                         chan,
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0)) && !defined(WITH_BACKPORTS)
@@ -1665,18 +2287,16 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
         vos_mem_copy( cfgState->buf, buf, len);
 
         mutex_lock(&cfgState->remain_on_chan_ctx_lock);
-
-        if( cfgState->remain_on_chan_ctx )
-        {
-            cfgState->action_cookie = cfgState->remain_on_chan_ctx->cookie;
-            *cookie = cfgState->action_cookie;
-        }
-        else
-        {
-            *cookie = (uintptr_t) cfgState->buf;
-            cfgState->action_cookie = *cookie;
-        }
-
+       if( cfgState->remain_on_chan_ctx )
+       {
+          cfgState->action_cookie = cfgState->remain_on_chan_ctx->cookie;
+          *cookie = cfgState->action_cookie;
+       }
+       else
+       {
+          *cookie = (uintptr_t) cfgState->buf;
+          cfgState->action_cookie = *cookie;
+       }
         mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
     }
 
@@ -1689,7 +2309,9 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 
         if ((type == SIR_MAC_MGMT_FRAME) &&
                 (subType == SIR_MAC_MGMT_ACTION) &&
-                (buf[WLAN_HDD_PUBLIC_ACTION_FRAME_OFFSET] == WLAN_HDD_PUBLIC_ACTION_FRAME))
+                wlan_hdd_is_type_p2p_action(
+                 &buf[WLAN_HDD_PUBLIC_ACTION_FRAME_BODY_OFFSET],
+                 len - mgmt_hdr_len))
         {
             actionFrmType = buf[WLAN_HDD_PUBLIC_ACTION_FRAME_TYPE_OFFSET];
             hddLog(LOG1, "Tx Action Frame %u", actionFrmType);
@@ -1705,6 +2327,19 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
             }
         }
 
+        if (!vos_mem_compare((uint8_t *)(&buf[WLAN_HDD_80211_FRM_SA_OFFSET]),
+                        &pAdapter->macAddressCurrent, VOS_MAC_ADDR_SIZE)) {
+            hddLog(LOG1, "%s: sa of action frame is randomized with mac-addr: "
+               MAC_ADDRESS_STR, __func__,
+               MAC_ADDR_ARRAY((uint8_t *)(&buf[WLAN_HDD_80211_FRM_SA_OFFSET])));
+            enb_random_mac = true;
+        }
+
+        if (enb_random_mac && !noack)
+            hdd_set_action_frame_random_mac(pAdapter,
+                                (uint8_t *)(&buf[WLAN_HDD_80211_FRM_SA_OFFSET]),
+                                *cookie);
+
         if (eHAL_STATUS_SUCCESS !=
                sme_sendAction( WLAN_HDD_GET_HAL_CTX(pAdapter),
                                sessionId, buf, len, extendedWait, noack))
@@ -1737,6 +2372,13 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 err:
     if(!noack)
     {
+       if (enb_random_mac &&
+           ((pAdapter->device_mode == WLAN_HDD_INFRA_STATION) ||
+           (pAdapter->device_mode == WLAN_HDD_P2P_CLIENT) ||
+           (pAdapter->device_mode == WLAN_HDD_P2P_DEVICE)))
+           hdd_reset_action_frame_random_mac(pAdapter,
+                                (uint8_t *)(&buf[WLAN_HDD_80211_FRM_SA_OFFSET]),
+                                *cookie);
        hdd_sendActionCnf( pAdapter, FALSE );
     }
     return 0;
@@ -1810,6 +2452,31 @@ int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
     return ret;
 }
 
+/**
+ * hdd_wlan_delete_mgmt_tx_cookie() - Wrapper to delete action frame cookie
+ * @wdev: Pointer to wireless device
+ * @cookie: Cookie to be deleted
+ *
+ * This is a wrapper function which actually invokes the hdd api to delete
+ * cookie based on the device mode of adapter.
+ *
+ * Return: 0 - for success else negative value
+ */
+static int hdd_wlan_delete_mgmt_tx_cookie(struct wireless_dev *wdev,
+				   u64 cookie)
+{
+	struct net_device *dev = wdev->netdev;
+	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+
+	if ((adapter->device_mode == WLAN_HDD_INFRA_STATION) ||
+	    (adapter->device_mode == WLAN_HDD_P2P_CLIENT) ||
+	    (adapter->device_mode == WLAN_HDD_P2P_DEVICE)) {
+		hdd_delete_action_frame_cookie(adapter, cookie);
+	}
+
+	return 0;
+}
+
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0)) || defined(WITH_BACKPORTS)
 int __wlan_hdd_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
                                             struct wireless_dev *wdev,
@@ -1820,6 +2487,8 @@ int __wlan_hdd_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
         return -EINVAL;
     }
 
+    hdd_wlan_delete_mgmt_tx_cookie(wdev, cookie);
+
     return wlan_hdd_cfg80211_cancel_remain_on_channel(wiphy, wdev, cookie);
 }
 #else
@@ -2479,12 +3148,20 @@ void __hdd_indicate_mgmt_frame(hdd_adapter_t *pAdapter,
 
     /* Get pAdapter from Destination mac address of the frame */
     if ((type == SIR_MAC_MGMT_FRAME) &&
-            (subType != SIR_MAC_MGMT_PROBE_REQ))
+        (subType != SIR_MAC_MGMT_PROBE_REQ) &&
+        !vos_is_macaddr_broadcast(
+         (v_MACADDR_t *)&pbFrames[WLAN_HDD_80211_FRM_DA_OFFSET]))
     {
          pAdapter = hdd_get_adapter_by_macaddr(pHddCtx,
                             &pbFrames[WLAN_HDD_80211_FRM_DA_OFFSET]);
          if (NULL == pAdapter)
          {
+             pAdapter = hdd_get_adapter_by_rand_macaddr(pHddCtx,
+                                     &pbFrames[WLAN_HDD_80211_FRM_DA_OFFSET]);
+         }
+
+         if (NULL == pAdapter)
+         {
              /* We will receive broadcast management frames in OCB mode */
              pAdapter = hdd_get_adapter(pHddCtx, WLAN_HDD_OCB);
              if (NULL == pAdapter || !vos_is_macaddr_broadcast(
@@ -2606,7 +3283,9 @@ void __hdd_indicate_mgmt_frame(hdd_adapter_t *pAdapter,
                           if(VOS_TIMER_STATE_RUNNING ==
                             vos_timer_getCurrentState(&pRemainChanCtx->hdd_remain_on_chan_timer))
                           {
-                              vos_timer_stop(&pRemainChanCtx->hdd_remain_on_chan_timer);
+                              if (!VOS_IS_STATUS_SUCCESS(vos_timer_stop(
+                                    &pRemainChanCtx->hdd_remain_on_chan_timer)))
+                                  hddLog( LOGE, FL("Failed to stop hdd_remain_on_chan_timer"));
                               status = vos_timer_start(
                                   &pRemainChanCtx->hdd_remain_on_chan_timer,
                                             extend_time);
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_scan.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_scan.c
index 2c57f9f8f05..73630b9a2e5 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_scan.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_scan.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -541,7 +541,7 @@ static eHalStatus hdd_ScanRequestCallback(tHalHandle halHandle, void *pContext,
 
     ENTER();
 
-    hddLog(LOGW,"%s called with halHandle = %p, pContext = %p, scanID = %d,"
+    hddLog(LOGW,"%s called with halHandle = %pK, pContext = %pK, scanID = %d,"
            " returned status = %d", __func__, halHandle, pContext,
            (int) scanId, (int) status);
 
@@ -551,7 +551,7 @@ static eHalStatus hdd_ScanRequestCallback(tHalHandle halHandle, void *pContext,
        do some quick sanity before proceeding */
     if (pAdapter->dev != dev)
     {
-       hddLog(LOGW, "%s: device mismatch %p vs %p",
+       hddLog(LOGW, "%s: device mismatch %pK vs %pK",
                __func__, pAdapter->dev, dev);
         return eHAL_STATUS_SUCCESS;
     }
@@ -888,7 +888,7 @@ static eHalStatus hdd_CscanRequestCallback(tHalHandle halHandle, void *pContext,
     VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
     ENTER();
 
-    hddLog(LOG1,"%s called with halHandle = %p, pContext = %p, scanID = %d,"
+    hddLog(LOG1,"%s called with halHandle = %pK, pContext = %pK, scanID = %d,"
            " returned status = %d", __func__, halHandle, pContext,
             (int) scanId, (int) status);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_softap_tx_rx.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
index 3f6fa67c183..501f073917d 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -53,6 +53,7 @@
 #include <wlan_hdd_ipa.h>
 #endif
 #include "adf_trace.h"
+#include <wlan_hdd_tsf.h>
 /*---------------------------------------------------------------------------
   Preprocessor definitions and constants
   -------------------------------------------------------------------------*/
@@ -145,7 +146,7 @@ void hdd_softap_tx_resume_timer_expired_handler(void *adapter_context)
 
    hddLog(LOG1, FL("Enabling queues"));
    wlan_hdd_netif_queue_control(pAdapter, WLAN_WAKE_ALL_NETIF_QUEUE,
-                 WLAN_CONTROL_PATH);
+                 WLAN_DATA_FLOW_CONTROL);
    return;
 }
 
@@ -234,21 +235,20 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
    WLANTL_ACEnumType ac;
    hdd_adapter_t *pAdapter = (hdd_adapter_t *)netdev_priv(dev);
    hdd_ap_ctx_t *pHddApCtx = WLAN_HDD_GET_AP_CTX_PTR(pAdapter);
-   hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+   hdd_context_t *hddCtxt = WLAN_HDD_GET_CTX(pAdapter);
    v_MACADDR_t *pDestMacAddress;
    v_U8_t STAId;
    struct sk_buff *skb_next, *list_head = NULL, *list_tail = NULL;
    void *vdev_handle = NULL, *vdev_temp;
    bool is_update_ac_stats = FALSE;
 #ifdef QCA_PKT_PROTO_TRACE
-   hdd_context_t *hddCtxt = (hdd_context_t *)pAdapter->pHddCtx;
    v_U8_t proto_type = 0;
 #endif /* QCA_PKT_PROTO_TRACE */
 
    ++pAdapter->hdd_stats.hddTxRxStats.txXmitCalled;
    /* Prevent this function to be called during SSR since TL context may
       not be reinitialized at this time which will lead crash. */
-   if (pHddCtx->isLogpInProgress)
+   if (hddCtxt->isLogpInProgress)
    {
        VOS_TRACE(VOS_MODULE_ID_HDD_SAP_DATA, VOS_TRACE_LEVEL_INFO_HIGH,
                  "%s: LOGP in Progress. Ignore!!!", __func__);
@@ -270,8 +270,14 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
    while (skb) {
        skb_next = skb->next;
+       /* memset skb control block */
+       vos_mem_zero(skb->cb, sizeof(skb->cb));
+       wlan_hdd_classify_pkt(skb);
+
        pDestMacAddress = (v_MACADDR_t*)skb->data;
 
+       hdd_tsf_record_sk_for_skb(hddCtxt, skb);
+
 /*
 * The TCP TX throttling logic is changed a little after 3.19-rc1 kernel,
 * the TCP sending limit will be smaller, which will throttle the TCP packets
@@ -285,10 +291,18 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 */
 #ifdef QCA_LL_TX_FLOW_CT
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(3,19,0))
-       if (pAdapter->tx_flow_low_watermark > 0) {
+        //remove if condition for improving SCC TCP TX KPI
+       //if (pAdapter->tx_flow_low_watermark > 0) {
            skb_orphan(skb);
-       }
+       //}
 #endif
+#else
+      /*
+       * For PTP feature enabled system, need to orphan the socket buffer asap
+       * otherwise the latency will become unacceptable
+       */
+      if (hdd_cfg_is_ptp_opt_enable(hddCtxt))
+          skb_orphan(skb);
 #endif
 
        if (vos_is_macaddr_broadcast( pDestMacAddress ) ||
@@ -307,7 +321,7 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                goto drop_pkt;
            }
 
-           if (STAId == HDD_WLAN_INVALID_STA_ID)
+           if (STAId == HDD_WLAN_INVALID_STA_ID || STAId >= WLAN_MAX_STA_COUNT)
            {
                VOS_TRACE( VOS_MODULE_ID_HDD_SAP_DATA, VOS_TRACE_LEVEL_WARN,
                           "%s: Failed to find right station", __func__);
@@ -341,8 +355,7 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
            }
        }
 
-       vdev_temp = tlshim_peer_validity(
-                     (WLAN_HDD_GET_CTX(pAdapter))->pvosContext, STAId);
+       vdev_temp = tlshim_peer_validity(hddCtxt->pvosContext, STAId);
        if (!vdev_temp)
            goto drop_pkt;
 
@@ -351,10 +364,10 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 #ifdef QCA_LL_TX_FLOW_CT
        if ((pAdapter->hdd_stats.hddTxRxStats.is_txflow_paused != TRUE) &&
             VOS_FALSE ==
-              WLANTL_GetTxResource((WLAN_HDD_GET_CTX(pAdapter))->pvosContext,
-                                    pAdapter->sessionId,
-                                    pAdapter->tx_flow_low_watermark,
-                                    pAdapter->tx_flow_high_watermark_offset)) {
+              WLANTL_GetTxResource(hddCtxt->pvosContext,
+				   pAdapter->sessionId,
+				   pAdapter->tx_flow_low_watermark,
+				   pAdapter->tx_flow_high_watermark_offset)) {
            if ((pAdapter->tx_flow_timer_initialized == TRUE) &&
                (VOS_TIMER_STATE_STOPPED ==
                 vos_timer_getCurrentState(&pAdapter->tx_flow_control_timer))) {
@@ -374,9 +387,6 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
        ac = hdd_QdiscAcToTlAC[skb->queue_mapping];
        ++pAdapter->hdd_stats.hddTxRxStats.txXmitClassifiedAC[ac];
 
-       adf_dp_trace_log_pkt(pAdapter->sessionId, skb,
-                          WIFI_EVENT_DRIVER_EAPOL_FRAME_TRANSMIT_REQUESTED);
-
 #ifdef QCA_PKT_PROTO_TRACE
        if ((hddCtxt->cfg_ini->gEnableDebugLog & VOS_PKT_TRAC_TYPE_EAPOL) ||
            (hddCtxt->cfg_ini->gEnableDebugLog & VOS_PKT_TRAC_TYPE_DHCP))
@@ -384,13 +394,24 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
            /* Proto Trace enabled */
            proto_type = vos_pkt_get_proto_type(skb,
                         hddCtxt->cfg_ini->gEnableDebugLog, 0);
-           if (VOS_PKT_TRAC_TYPE_EAPOL & proto_type)
-           {
+           switch (proto_type) {
+           case VOS_PKT_TRAC_TYPE_EAPOL:
                vos_pkt_trace_buf_update("HA:T:EPL");
-           }
-           else if (VOS_PKT_TRAC_TYPE_DHCP & proto_type)
-           {
+               break;
+           case VOS_PKT_TRAC_TYPE_DHCP:
                hdd_dhcp_pkt_trace_buf_update(skb, TX_PATH, AP);
+               break;
+           case VOS_PKT_TRAC_TYPE_ARP:
+               vos_pkt_trace_buf_update("HA:T:ARP");
+               break;
+           case VOS_PKT_TRAC_TYPE_NS:
+               vos_pkt_trace_buf_update("HA:T:NS");
+               break;
+           case VOS_PKT_TRAC_TYPE_NA:
+               vos_pkt_trace_buf_update("HA:T:NA");
+               break;
+           default:
+               break;
            }
        }
 #endif /* QCA_PKT_PROTO_TRACE */
@@ -398,6 +419,11 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
        pAdapter->stats.tx_bytes += skb->len;
        ++pAdapter->stats.tx_packets;
 
+       /* Per peer tx/rx statistics */
+       pAdapter->aStaInfo[STAId].tx_packets++;
+       pAdapter->aStaInfo[STAId].tx_bytes += skb->len;
+       pAdapter->aStaInfo[STAId].last_tx_rx_ts = vos_system_ticks();
+
        if (!list_head) {
            list_head = skb;
            list_tail = skb;
@@ -405,7 +431,8 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
            list_tail->next = skb;
            list_tail = list_tail->next;
        }
-       vos_mem_zero(skb->cb, sizeof(skb->cb));
+
+       adf_dp_trace_log_pkt(pAdapter->sessionId, skb, ADF_TX);
        NBUF_SET_PACKET_TRACK(skb, NBUF_TX_PKT_DATA_TRACK);
        NBUF_UPDATE_TX_PKT_COUNT(skb, NBUF_TX_PKT_HDD);
 
@@ -413,11 +440,13 @@ int __hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
        DPTRACE(adf_dp_trace(skb, ADF_DP_TRACE_HDD_TX_PACKET_PTR_RECORD,
                   (uint8_t *)&skb->data, sizeof(skb->data), ADF_TX));
        DPTRACE(adf_dp_trace(skb, ADF_DP_TRACE_HDD_TX_PACKET_RECORD,
-                  (uint8_t *)skb->data, skb->len, ADF_TX));
-       if (skb->len > ADF_DP_TRACE_RECORD_SIZE)
+                  (uint8_t *)skb->data, adf_nbuf_len(skb), ADF_TX));
+
+       if (adf_nbuf_len(skb) > ADF_DP_TRACE_RECORD_SIZE)
             DPTRACE(adf_dp_trace(skb, ADF_DP_TRACE_HDD_TX_PACKET_RECORD,
-                  (uint8_t *)&skb->data[ADF_DP_TRACE_RECORD_SIZE],
-                  (skb->len - ADF_DP_TRACE_RECORD_SIZE), ADF_TX));
+                    (uint8_t *)&skb->data[ADF_DP_TRACE_RECORD_SIZE],
+                    (adf_nbuf_len(skb) - ADF_DP_TRACE_RECORD_SIZE),
+                    ADF_TX));
 
        skb = skb_next;
        continue;
@@ -436,8 +465,7 @@ drop_pkt:
 
    list_tail->next = NULL;
 
-   skb = WLANTL_SendSTA_DataFrame((WLAN_HDD_GET_CTX(pAdapter))->pvosContext,
-                                   vdev_handle, list_head
+   skb = WLANTL_SendSTA_DataFrame(hddCtxt->pvosContext, vdev_handle, list_head
 #ifdef QCA_PKT_PROTO_TRACE
                                  , proto_type
 #endif /* QCA_PKT_PROTO_TRACE */
@@ -449,8 +477,11 @@ drop_pkt:
        is_update_ac_stats = TRUE;
        goto drop_list;
    }
-
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0))
+   netif_trans_update(dev);
+#else
    dev->trans_start = jiffies;
+#endif
    return NETDEV_TX_OK;
 
 drop_list:
@@ -502,11 +533,15 @@ static void __hdd_softap_tx_timeout(struct net_device *dev)
     * case of disassociation it is ok to ignore this. But if associated, we have
     * do possible recovery here.
     */
-
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0))
+    VOS_TRACE(VOS_MODULE_ID_HDD_SAP_DATA, VOS_TRACE_LEVEL_ERROR,
+        "%s: Transmission timeout occurred jiffies %lu",
+        __func__, jiffies);
+#else
     VOS_TRACE(VOS_MODULE_ID_HDD_SAP_DATA, VOS_TRACE_LEVEL_ERROR,
         "%s: Transmission timeout occurred jiffies %lu trans_start %lu",
         __func__, jiffies, dev->trans_start);
-
+#endif
     for (i = 0; i < NUM_TX_QUEUES; i++) {
         txq = netdev_get_tx_queue(dev, i);
         VOS_TRACE(VOS_MODULE_ID_HDD_SAP_DATA,
@@ -803,7 +838,7 @@ VOS_STATUS hdd_softap_rx_packet_cbk(v_VOID_t *vosContext,
    struct sk_buff *skb = NULL;
    hdd_context_t *pHddCtx = NULL;
 #ifdef QCA_PKT_PROTO_TRACE
-   v_U8_t proto_type;
+   v_U8_t proto_type = 0;
 #endif /* QCA_PKT_PROTO_TRACE */
    struct sk_buff *skb_next;
    unsigned int cpu_index;
@@ -854,25 +889,60 @@ VOS_STATUS hdd_softap_rx_packet_cbk(v_VOID_t *vosContext,
       ++pAdapter->stats.rx_packets;
       pAdapter->stats.rx_bytes += skb->len;
 
-      DPTRACE(adf_dp_trace(rxBuf,
+      pAdapter->aStaInfo[staId].rx_packets++;
+      pAdapter->aStaInfo[staId].rx_bytes += skb->len;
+      pAdapter->aStaInfo[staId].last_tx_rx_ts = vos_system_ticks();
+
+      DPTRACE(adf_dp_trace(skb,
               ADF_DP_TRACE_RX_HDD_PACKET_PTR_RECORD,
-              adf_nbuf_data_addr(rxBuf),
-              sizeof(adf_nbuf_data(rxBuf)), ADF_RX));
+              adf_nbuf_data_addr(skb),
+              sizeof(adf_nbuf_data(skb)), ADF_RX));
+      DPTRACE(adf_dp_trace(skb,
+              ADF_DP_TRACE_HDD_RX_PACKET_RECORD,
+              (uint8_t *)skb->data, adf_nbuf_len(skb), ADF_RX));
+
+      if (adf_nbuf_len(skb) > ADF_DP_TRACE_RECORD_SIZE)
+          DPTRACE(adf_dp_trace(skb,
+                  ADF_DP_TRACE_HDD_RX_PACKET_RECORD,
+                  (uint8_t *)&skb->data[ADF_DP_TRACE_RECORD_SIZE],
+                  (adf_nbuf_len(skb) - ADF_DP_TRACE_RECORD_SIZE),
+                  ADF_RX));
 
 #ifdef QCA_PKT_PROTO_TRACE
       if ((pHddCtx->cfg_ini->gEnableDebugLog & VOS_PKT_TRAC_TYPE_EAPOL) ||
           (pHddCtx->cfg_ini->gEnableDebugLog & VOS_PKT_TRAC_TYPE_DHCP)) {
          proto_type = vos_pkt_get_proto_type(skb,
                            pHddCtx->cfg_ini->gEnableDebugLog, 0);
-         if (VOS_PKT_TRAC_TYPE_EAPOL & proto_type)
-            vos_pkt_trace_buf_update("HA:R:EPL");
-         else if (VOS_PKT_TRAC_TYPE_DHCP & proto_type)
-            hdd_dhcp_pkt_trace_buf_update(skb, RX_PATH, AP);
+         switch (proto_type) {
+         case VOS_PKT_TRAC_TYPE_EAPOL:
+             vos_pkt_trace_buf_update("HA:R:EPL");
+             break;
+         case VOS_PKT_TRAC_TYPE_DHCP:
+             hdd_dhcp_pkt_trace_buf_update(skb, RX_PATH, AP);
+             break;
+         case VOS_PKT_TRAC_TYPE_ARP:
+             vos_pkt_trace_buf_update("HA:R:ARP");
+             break;
+         case VOS_PKT_TRAC_TYPE_NS:
+             vos_pkt_trace_buf_update("HA:R:NS");
+             break;
+         case VOS_PKT_TRAC_TYPE_NA:
+             vos_pkt_trace_buf_update("HA:R:NA");
+             break;
+         default:
+             break;
+         }
       }
 #endif /* QCA_PKT_PROTO_TRACE */
 
       skb->protocol = eth_type_trans(skb, skb->dev);
 
+      /**
+       * Remove SKB from internal tracking table before submitting it
+       * to stack.
+       */
+      adf_net_buf_debug_release_skb(skb);
+
       /*
        * If this is not a last packet on the chain
        * Just put packet into backlog queue, not scheduling RX sirq
@@ -880,11 +950,12 @@ VOS_STATUS hdd_softap_rx_packet_cbk(v_VOID_t *vosContext,
       if (skb->next) {
          rxstat = netif_rx(skb);
       } else {
-#ifdef WLAN_FEATURE_HOLD_RX_WAKELOCK
-         vos_wake_lock_timeout_acquire(&pHddCtx->rx_wake_lock,
-                                       HDD_WAKE_LOCK_DURATION,
-                                       WIFI_POWER_EVENT_WAKELOCK_HOLD_RX);
-#endif
+         if ((pHddCtx->cfg_ini->rx_wakelock_timeout) &&
+             (PACKET_BROADCAST != skb->pkt_type) &&
+             (PACKET_MULTICAST != skb->pkt_type))
+               vos_wake_lock_timeout_acquire(&pHddCtx->rx_wake_lock,
+                              pHddCtx->cfg_ini->rx_wakelock_timeout,
+                              WIFI_POWER_EVENT_WAKELOCK_HOLD_RX);
          /*
           * This is the last packet on the chain
           * Scheduling rx sirq
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tdls.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tdls.c
index 48c58ed772d..53ae33f3bb8 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tdls.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tdls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -330,7 +330,7 @@ static void wlan_hdd_tdls_check_power_save_prohibited(hdd_adapter_t *pAdapter)
 
     if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic)) {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  FL("invalid pAdapter: %p"), pAdapter);
+                  FL("invalid pAdapter: %pK"), pAdapter);
          return;
      }
 
@@ -395,9 +395,16 @@ static v_VOID_t wlan_hdd_tdls_discovery_timeout_peer_cb(v_PVOID_t userData)
                            "%s: " MAC_ADDRESS_STR " to idle state", __func__,
                            MAC_ADDR_ARRAY(tmp->peerMac));
                 mutex_unlock(&pHddCtx->tdls_lock);
+                if (tmp->discovery_attempt ==
+                         pHddTdlsCtx->threshold_config.discovery_tries_n) {
+                    tmp->discovery_attempt = 0;
+                    tmp->discovery_cycles_retry_cnt++;
+                    tmp->last_discovery_req_cycle_ts = jiffies;
+                }
                 wlan_hdd_tdls_set_peer_link_status(tmp,
                                                    eTDLS_LINK_IDLE,
-                                                   eTDLS_LINK_NOT_SUPPORTED);
+                                                   eTDLS_LINK_NOT_SUPPORTED,
+                                                   TRUE);
                 mutex_lock(&pHddCtx->tdls_lock);
             }
         }
@@ -542,7 +549,7 @@ int wlan_hdd_tdls_init(hdd_adapter_t *pAdapter)
         vos_mem_zero(pHddTdlsCtx, sizeof(tdlsCtx_t));
 
         vos_timer_init(&pHddTdlsCtx->peerDiscoveryTimeoutTimer,
-                VOS_TIMER_TYPE_SW,
+                VOS_TIMER_TYPE_WAKE_APPS,
                 wlan_hdd_tdls_discovery_timeout_peer_cb,
                 pHddTdlsCtx);
 
@@ -573,6 +580,7 @@ int wlan_hdd_tdls_init(hdd_adapter_t *pAdapter)
                     tmp->reason = eTDLS_LINK_UNSPECIFIED;
                     tmp->staId = 0;
                     tmp->discovery_attempt = 0;
+                    tmp->discovery_cycles_retry_cnt = 0;
                 }
             }
         }
@@ -923,7 +931,8 @@ done:
    if mac address doesn't exist, create a list and add, return pointer
    return NULL if fails to get new mac address
 */
-hddTdlsPeer_t *wlan_hdd_tdls_get_peer(hdd_adapter_t *pAdapter, const u8 *mac)
+hddTdlsPeer_t *wlan_hdd_tdls_get_peer(hdd_adapter_t *pAdapter, const u8 *mac,
+                                      bool need_lock)
 {
     struct list_head *head;
     hddTdlsPeer_t *peer;
@@ -934,27 +943,33 @@ hddTdlsPeer_t *wlan_hdd_tdls_get_peer(hdd_adapter_t *pAdapter, const u8 *mac)
     if (0 != (wlan_hdd_validate_context(pHddCtx)))
        return NULL;
 
+    if (need_lock)
+        mutex_lock(&pHddCtx->tdls_lock);
+
     /* if already there, just update */
-    peer = wlan_hdd_tdls_find_peer(pAdapter, mac, TRUE);
+    peer = wlan_hdd_tdls_find_peer(pAdapter, mac, FALSE);
     if (peer != NULL)
     {
+        if (need_lock)
+            mutex_unlock(&pHddCtx->tdls_lock);
         return peer;
     }
 
     /* not found, allocate and add the list */
     peer = vos_mem_malloc(sizeof(hddTdlsPeer_t));
     if (NULL == peer) {
+        if (need_lock)
+            mutex_unlock(&pHddCtx->tdls_lock);
         hddLog(VOS_TRACE_LEVEL_ERROR, "%s peer malloc failed!", __func__);
         return NULL;
     }
 
-    mutex_lock(&pHddCtx->tdls_lock);
-
     pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
 
     if (NULL == pHddTdlsCtx) {
         vos_mem_free(peer);
-        mutex_unlock(&pHddCtx->tdls_lock);
+        if (need_lock)
+            mutex_unlock(&pHddCtx->tdls_lock);
         hddLog(LOG1, FL("pHddTdlsCtx is NULL"));
         return NULL;
     }
@@ -971,7 +986,8 @@ hddTdlsPeer_t *wlan_hdd_tdls_get_peer(hdd_adapter_t *pAdapter, const u8 *mac)
                                 pHddCtx->cfg_ini->fTDLSPrefOffChanBandwidth);
 
     list_add_tail(&peer->node, head);
-    mutex_unlock(&pHddCtx->tdls_lock);
+    if (need_lock)
+        mutex_unlock(&pHddCtx->tdls_lock);
     return peer;
 }
 
@@ -980,23 +996,37 @@ int wlan_hdd_tdls_set_cap(hdd_adapter_t *pAdapter,
                                    tTDLSCapType cap)
 {
     hddTdlsPeer_t *curr_peer;
+    hdd_context_t *hdd_ctx;
+    int status = 0;
 
-    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
+    if (0 != (wlan_hdd_validate_context(hdd_ctx))) {
+       status = -EINVAL;
+       goto ret_status;
+    }
+
+    mutex_lock(&hdd_ctx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
-       return -1;
+       status = -EINVAL;
+       goto rel_lock;
     }
 
     curr_peer->tdls_support = cap;
 
-    return 0;
+rel_lock:
+    mutex_unlock(&hdd_ctx->tdls_lock);
+ret_status:
+    return status;
 }
 
 void wlan_hdd_tdls_set_peer_link_status(hddTdlsPeer_t *curr_peer,
                                         tTDLSLinkStatus status,
-                                        tTDLSLinkReason reason)
+                                        tTDLSLinkReason reason,
+                                        bool need_lock)
 {
     tANI_U32 state = 0;
     tANI_S32 res = 0;
@@ -1024,7 +1054,8 @@ void wlan_hdd_tdls_set_peer_link_status(hddTdlsPeer_t *curr_peer,
     hddLog(VOS_TRACE_LEVEL_WARN, "tdls set peer " MAC_ADDRESS_STR " link status to %u",
             MAC_ADDR_ARRAY(curr_peer->peerMac), status);
 
-    mutex_lock(&pHddCtx->tdls_lock);
+    if (need_lock)
+       mutex_lock(&pHddCtx->tdls_lock);
 
     curr_peer->link_status = status;
 
@@ -1034,9 +1065,11 @@ void wlan_hdd_tdls_set_peer_link_status(hddTdlsPeer_t *curr_peer,
     if (status >= eTDLS_LINK_DISCOVERED)
     {
         curr_peer->discovery_attempt = 0;
+        curr_peer->discovery_cycles_retry_cnt = 0;
     }
 
-    mutex_unlock(&pHddCtx->tdls_lock);
+    if (need_lock)
+       mutex_unlock(&pHddCtx->tdls_lock);
 
     if (curr_peer->isForcedPeer && curr_peer->state_change_notification)
     {
@@ -1083,6 +1116,9 @@ void wlan_hdd_tdls_set_link_status(hdd_adapter_t *pAdapter,
 
     mutex_lock(&pHddCtx->tdls_lock);
 
+    hddLog(LOG1, FL("tdls set peer " MAC_ADDRESS_STR " link status to %u"),
+                 MAC_ADDR_ARRAY(curr_peer->peerMac), linkStatus);
+
     curr_peer->link_status= linkStatus;
 
     /* If TDLS link status is already passed the discovery state
@@ -1091,6 +1127,7 @@ void wlan_hdd_tdls_set_link_status(hdd_adapter_t *pAdapter,
     if (linkStatus >= eTDLS_LINK_DISCOVERED)
     {
         curr_peer->discovery_attempt = 0;
+        curr_peer->discovery_cycles_retry_cnt = 0;
     }
 
     mutex_unlock(&pHddCtx->tdls_lock);
@@ -1121,39 +1158,45 @@ void wlan_hdd_tdls_set_link_status(hdd_adapter_t *pAdapter,
 int wlan_hdd_tdls_recv_discovery_resp(hdd_adapter_t *pAdapter, u8 *mac)
 {
     hddTdlsPeer_t *curr_peer;
-    tdlsCtx_t *pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
+    tdlsCtx_t *pHddTdlsCtx;
     hdd_context_t *pHddCtx;
+    int status = 0;
 
     ENTER();
 
+    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+
+    if (0 != (wlan_hdd_validate_context(pHddCtx))) {
+       status = -EINVAL;
+       goto ret_status;
+    }
+
+    mutex_lock(&pHddCtx->tdls_lock);
+
+    pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
     if ( NULL == pHddTdlsCtx )
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("pHddTdlsCtx is NULL"));
-       return -1;
+       status = -EINVAL;
+       goto rel_lock;
     }
 
-    pHddCtx = WLAN_HDD_GET_CTX(pHddTdlsCtx->pAdapter);
-
-    if (0 != (wlan_hdd_validate_context(pHddCtx)))
-       return -1;
-
-    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac, FALSE);
 
     if (NULL == curr_peer)
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
-       return -1;
+       status = -EINVAL;
+       goto rel_lock;
     }
 
     if (pHddTdlsCtx->discovery_sent_cnt)
         pHddTdlsCtx->discovery_sent_cnt--;
 
-    mutex_lock(&pHddCtx->tdls_lock);
     wlan_hdd_tdls_check_power_save_prohibited(pAdapter);
 
-    mutex_unlock(&pHddCtx->tdls_lock);
     if (0 == pHddTdlsCtx->discovery_sent_cnt)
     {
         vos_timer_stop(&pHddTdlsCtx->peerDiscoveryTimeoutTimer);
@@ -1174,7 +1217,8 @@ int wlan_hdd_tdls_recv_discovery_resp(hdd_adapter_t *pAdapter, u8 *mac)
         {
             wlan_hdd_tdls_set_peer_link_status(curr_peer,
                                                eTDLS_LINK_DISCOVERED,
-                                               eTDLS_LINK_SUCCESS);
+                                               eTDLS_LINK_SUCCESS,
+                                               FALSE);
             VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
             "Rssi Threshold met: "MAC_ADDRESS_STR" rssi = %d threshold= %d" ,
              MAC_ADDR_ARRAY(curr_peer->peerMac), curr_peer->rssi,
@@ -1189,7 +1233,8 @@ int wlan_hdd_tdls_recv_discovery_resp(hdd_adapter_t *pAdapter, u8 *mac)
             pHddTdlsCtx->threshold_config.rssi_trigger_threshold);
             wlan_hdd_tdls_set_peer_link_status(curr_peer,
                                                eTDLS_LINK_IDLE,
-                                               eTDLS_LINK_UNSPECIFIED);
+                                               eTDLS_LINK_UNSPECIFIED,
+                                               FALSE);
 
             /* if RSSI threshold is not met then allow further discovery
              * attempts by decrementing count for the last attempt
@@ -1200,12 +1245,18 @@ int wlan_hdd_tdls_recv_discovery_resp(hdd_adapter_t *pAdapter, u8 *mac)
     }
     else
     {
+        mutex_unlock(&pHddCtx->tdls_lock);
         wlan_hdd_tdls_check_bmps(pAdapter);
+        goto ret_status;
     }
 
     curr_peer->tdls_support = eTDLS_CAP_SUPPORTED;
+
+rel_lock:
+    mutex_unlock(&pHddCtx->tdls_lock);
+ret_status:
     EXIT();
-    return 0;
+    return status;
 }
 
 int wlan_hdd_tdls_set_peer_caps(hdd_adapter_t *pAdapter,
@@ -1216,13 +1267,22 @@ int wlan_hdd_tdls_set_peer_caps(hdd_adapter_t *pAdapter,
                                 bool is_qos_wmm_sta)
 {
     hddTdlsPeer_t *curr_peer;
+    hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
+    int status = 0;
+
+    if (0 != (wlan_hdd_validate_context(hdd_ctx))) {
+       status = -EINVAL;
+       goto ret_status;
+    }
 
-    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    mutex_lock(&hdd_ctx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
-       return -1;
+       status = -EINVAL;
+       goto rel_lock;
     }
 
     curr_peer->uapsdQueues = StaParams->uapsd_queues;
@@ -1246,7 +1306,10 @@ int wlan_hdd_tdls_set_peer_caps(hdd_adapter_t *pAdapter,
 
     curr_peer->qos = is_qos_wmm_sta;
 
-    return 0;
+rel_lock:
+    mutex_unlock(&hdd_ctx->tdls_lock);
+ret_status:
+    return status;
 }
 
 int wlan_hdd_tdls_get_link_establish_params(hdd_adapter_t *pAdapter,
@@ -1254,13 +1317,22 @@ int wlan_hdd_tdls_get_link_establish_params(hdd_adapter_t *pAdapter,
                                             tCsrTdlsLinkEstablishParams* tdlsLinkEstablishParams)
 {
     hddTdlsPeer_t *curr_peer;
+    hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
+    int status = 0;
 
-    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    if (0 != (wlan_hdd_validate_context(hdd_ctx))) {
+       status = -EINVAL;
+       goto ret_status;
+    }
+
+    mutex_lock(&hdd_ctx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
-       return -1;
+       status = -EINVAL;
+       goto rel_lock;
     }
 
     tdlsLinkEstablishParams->isResponder = curr_peer->is_responder;
@@ -1286,24 +1358,34 @@ int wlan_hdd_tdls_get_link_establish_params(hdd_adapter_t *pAdapter,
 
     tdlsLinkEstablishParams->qos = curr_peer->qos;
 
-    return 0;
+rel_lock:
+    mutex_unlock(&hdd_ctx->tdls_lock);
+ret_status:
+    return status;
 }
 
 int wlan_hdd_tdls_set_rssi(hdd_adapter_t *pAdapter, const u8 *mac,
                            tANI_S8 rxRssi)
 {
     hddTdlsPeer_t *curr_peer;
+    hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
 
-    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, TRUE);
+    if (0 != (wlan_hdd_validate_context(hdd_ctx)))
+       return -1;
+
+    mutex_lock(&hdd_ctx->tdls_lock);
+
+    curr_peer = wlan_hdd_tdls_find_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
+       mutex_unlock(&hdd_ctx->tdls_lock);
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
        return -1;
     }
 
     curr_peer->rssi = rxRssi;
-
+    mutex_unlock(&hdd_ctx->tdls_lock);
     return 0;
 }
 
@@ -1311,36 +1393,60 @@ int wlan_hdd_tdls_set_responder(hdd_adapter_t *pAdapter, const u8 *mac,
                                 tANI_U8 responder)
 {
     hddTdlsPeer_t *curr_peer;
+    hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
+    int status = 0;
 
-    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    if (0 != (wlan_hdd_validate_context(hdd_ctx))) {
+       status = -EINVAL;
+       goto ret_status;
+    }
+    mutex_lock(&hdd_ctx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
-       return -1;
+       status = -EINVAL;
+       goto rel_lock;
     }
 
     curr_peer->is_responder = responder;
 
-    return 0;
+rel_lock:
+    mutex_unlock(&hdd_ctx->tdls_lock);
+ret_status:
+    return status;
 }
 
 int wlan_hdd_tdls_set_signature(hdd_adapter_t *pAdapter, const u8 *mac,
                                 tANI_U8 uSignature)
 {
     hddTdlsPeer_t *curr_peer;
+    hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
+    int status = 0;
+
+    if (0 != (wlan_hdd_validate_context(hdd_ctx))) {
+       status = -EINVAL;
+       goto ret_status;
+    }
 
-    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    mutex_lock(&hdd_ctx->tdls_lock);
+
+    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
-       return -1;
+       status = -EINVAL;
+       goto rel_lock;
     }
 
     curr_peer->signature = uSignature;
 
-    return 0;
+rel_lock:
+    mutex_unlock(&hdd_ctx->tdls_lock);
+ret_status:
+    return status;
 }
 
 
@@ -1358,16 +1464,27 @@ int wlan_hdd_tdls_increment_pkt_count(hdd_adapter_t *pAdapter, const u8 *mac,
                                       u8 tx)
 {
     hddTdlsPeer_t *curr_peer;
-    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
+    int status = 0;
 
-    if (eTDLS_SUPPORT_ENABLED != pHddCtx->tdls_mode &&
-        eTDLS_SUPPORT_EXTERNAL_CONTROL != pHddCtx->tdls_mode)
-        return -1;
+    if (0 != (wlan_hdd_validate_context(hdd_ctx))) {
+        status = -EINVAL;
+        goto ret_status;
+    }
+
+    if (eTDLS_SUPPORT_ENABLED != hdd_ctx->tdls_mode &&
+        eTDLS_SUPPORT_EXTERNAL_CONTROL != hdd_ctx->tdls_mode) {
+        status = -EINVAL;
+        goto ret_status;
+    }
 
-    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    mutex_lock(&hdd_ctx->tdls_lock);
+
+    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL) {
         hddLog(LOG1, FL("curr_peer is NULL"));
-        return -1;
+        status = -EINVAL;
+        goto rel_lock;
     }
 
     if (tx)
@@ -1375,7 +1492,10 @@ int wlan_hdd_tdls_increment_pkt_count(hdd_adapter_t *pAdapter, const u8 *mac,
     else
         curr_peer->rx_pkt++;
 
-    return 0;
+rel_lock:
+    mutex_unlock(&hdd_ctx->tdls_lock);
+ret_status:
+    return status;
 }
 
 static int wlan_hdd_tdls_check_config(tdls_config_params_t *config)
@@ -1534,7 +1654,8 @@ static void wlan_hdd_tdls_implicit_enable(tdlsCtx_t *pHddTdlsCtx)
 
 static void wlan_hdd_tdls_set_mode(hdd_context_t *pHddCtx,
                             eTDLSSupportMode tdls_mode,
-                            v_BOOL_t bUpdateLast)
+                            v_BOOL_t bUpdateLast,
+                            enum tdls_disable_source source)
 {
     hdd_adapter_list_node_t *pAdapterNode = NULL, *pNext = NULL;
     VOS_STATUS status;
@@ -1556,6 +1677,19 @@ static void wlan_hdd_tdls_set_mode(hdd_context_t *pHddCtx,
         mutex_unlock(&pHddCtx->tdls_lock);
         hddLog(VOS_TRACE_LEVEL_INFO,
                "%s already in mode %d", __func__, (int)tdls_mode);
+
+        /* TDLS is already disabled hence set source mask and return */
+        if (eTDLS_SUPPORT_DISABLED == tdls_mode) {
+            set_bit((unsigned long)source, &pHddCtx->tdls_source_bitmap);
+            return;
+        }
+
+        /* TDLS is already enabled hence clear source mask and return */
+        if (eTDLS_SUPPORT_ENABLED == tdls_mode) {
+            clear_bit((unsigned long)source,
+                        &pHddCtx->tdls_source_bitmap);
+            return;
+        }
         return;
     }
 
@@ -1568,11 +1702,47 @@ static void wlan_hdd_tdls_set_mode(hdd_context_t *pHddCtx,
        if (NULL != pHddTdlsCtx)
        {
            if(eTDLS_SUPPORT_ENABLED == tdls_mode ||
-              eTDLS_SUPPORT_EXTERNAL_CONTROL == tdls_mode)
+              eTDLS_SUPPORT_EXTERNAL_CONTROL == tdls_mode) {
+               clear_bit((unsigned long)source,
+                            &pHddCtx->tdls_source_bitmap);
+
+               /*
+                * Check if any TDLS source bit is set and if bitmap is
+                * not zero then we should not enable TDLS
+                */
+               if (pHddCtx->tdls_source_bitmap) {
+                   mutex_unlock(&pHddCtx->tdls_lock);
+                   return;
+               }
                wlan_hdd_tdls_implicit_enable(pHddTdlsCtx);
-           else if((eTDLS_SUPPORT_DISABLED == tdls_mode) ||
-                   (eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == tdls_mode))
+           } else if (eTDLS_SUPPORT_DISABLED == tdls_mode) {
+               set_bit((unsigned long)source,
+                            &pHddCtx->tdls_source_bitmap);
                wlan_hdd_tdls_implicit_disable(pHddTdlsCtx);
+               if (pHddTdlsCtx->is_tdls_disabled_bmps) {
+                   if (FALSE == sme_IsPmcBmps(pHddCtx->hHal)) {
+                       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_DEBUG,
+                                 "%s: TDLS is disabled. Enable BMPS", __func__);
+                       status = hdd_enable_bmps_imps(pHddCtx);
+
+                       if (status == VOS_STATUS_SUCCESS)
+                           pHddTdlsCtx->is_tdls_disabled_bmps = false;
+                   }
+               }
+           } else if (eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == tdls_mode) {
+               clear_bit((unsigned long)source,
+                            &pHddCtx->tdls_source_bitmap);
+               wlan_hdd_tdls_implicit_disable(pHddTdlsCtx);
+
+               /*
+                * Check if any TDLS source bit is set and if bitmap is
+                * not zero then we should not enable TDLS
+                */
+               if (pHddCtx->tdls_source_bitmap) {
+                   mutex_unlock(&pHddCtx->tdls_lock);
+                   return;
+               }
+           }
        }
        status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
        pAdapterNode = pNext;
@@ -1639,7 +1809,8 @@ int wlan_hdd_tdls_set_params(struct net_device *dev, tdls_config_params_t *confi
             config->rssi_trigger_threshold,
             config->rssi_teardown_threshold);
 
-    wlan_hdd_tdls_set_mode(pHddCtx, req_tdls_mode, TRUE);
+    wlan_hdd_tdls_set_mode(pHddCtx, req_tdls_mode, TRUE,
+                        HDD_SET_TDLS_MODE_SOURCE_USER);
 
     tdlsParams = vos_mem_malloc(sizeof(tdlsInfo_t));
     if (NULL == tdlsParams)
@@ -1868,18 +2039,30 @@ void wlan_hdd_update_tdls_info(hdd_adapter_t *adapter, bool tdls_prohibited,
 int wlan_hdd_tdls_set_sta_id(hdd_adapter_t *pAdapter, const u8 *mac, u8 staId)
 {
     hddTdlsPeer_t *curr_peer;
+    hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
+    int status = 0;
 
-    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    if (0 != (wlan_hdd_validate_context(hdd_ctx))) {
+        status = -EINVAL;
+        goto ret_status;
+    }
+
+    mutex_lock(&hdd_ctx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
-       return -1;
+       status = -EINVAL;
+       goto rel_lock;
     }
 
     curr_peer->staId = staId;
 
-    return 0;
+rel_lock:
+    mutex_unlock(&hdd_ctx->tdls_lock);
+ret_status:
+    return status;
 }
 
 int wlan_hdd_tdls_set_extctrl_param(hdd_adapter_t *pAdapter, const uint8_t *mac,
@@ -2055,15 +2238,23 @@ int wlan_hdd_tdls_reset_peer(hdd_adapter_t *pAdapter, const u8 *mac)
 {
     hdd_context_t *pHddCtx;
     hddTdlsPeer_t *curr_peer;
+    int status = 0;
 
     pHddCtx = WLAN_HDD_GET_CTX( pAdapter );
 
-    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
+    if (0 != (wlan_hdd_validate_context(pHddCtx))) {
+        status = -EINVAL;
+        goto ret_status;
+    }
+
+    mutex_lock(&pHddCtx->tdls_lock);
+    curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac, FALSE);
     if (curr_peer == NULL)
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                  FL("curr_peer is NULL"));
-       return -1;
+       status = -EINVAL;
+       goto rel_lock;
     }
 
     /*
@@ -2083,10 +2274,14 @@ int wlan_hdd_tdls_reset_peer(hdd_adapter_t *pAdapter, const u8 *mac)
 
     wlan_hdd_tdls_set_peer_link_status(curr_peer,
                                        eTDLS_LINK_IDLE,
-                                       eTDLS_LINK_UNSPECIFIED);
+                                       eTDLS_LINK_UNSPECIFIED,
+                                       FALSE);
     curr_peer->staId = 0;
 
-    return 0;
+rel_lock:
+    mutex_unlock(&pHddCtx->tdls_lock);
+ret_status:
+    return status;
 }
 
 tANI_U16 wlan_hdd_tdlsConnectedPeers(hdd_adapter_t *pAdapter)
@@ -2095,7 +2290,7 @@ tANI_U16 wlan_hdd_tdlsConnectedPeers(hdd_adapter_t *pAdapter)
 
    if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic)) {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  FL("invalid pAdapter: %p"), pAdapter);
+                  FL("invalid pAdapter: %pK"), pAdapter);
         return 0;
     }
     pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
@@ -2118,12 +2313,25 @@ int wlan_hdd_tdls_get_all_peers(hdd_adapter_t *pAdapter, char *buf, int buflen)
     hddTdlsPeer_t *curr_peer;
     tdlsCtx_t *pHddTdlsCtx;
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    hdd_station_ctx_t *hdd_sta_ctx;
 
     ENTER();
 
     if (0 != (wlan_hdd_validate_context(pHddCtx)))
        return 0;
 
+    if ((WLAN_HDD_INFRA_STATION != pAdapter->device_mode)
+        && (WLAN_HDD_P2P_CLIENT != pAdapter->device_mode)) {
+        len = scnprintf(buf, buflen, "\nNo TDLS support for this adapter");
+        return len;
+    }
+
+    hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+    if (eConnectionState_Associated != hdd_sta_ctx->conn_info.connState) {
+        len = scnprintf(buf, buflen, "\nSTA is not associated\n");
+        return len;
+    }
+
     init_len = buflen;
     len = scnprintf(buf, buflen, "\n%-18s%-3s%-4s%-3s%-5s\n",
             "MAC", "Id", "cap", "up", "RSSI");
@@ -2295,10 +2503,11 @@ void wlan_hdd_tdls_check_bmps(hdd_adapter_t *pAdapter)
     tdlsCtx_t *pHddTdlsCtx = NULL;
     hdd_context_t *pHddCtx = NULL;
     hddTdlsPeer_t *curr_peer;
+    VOS_STATUS status;
 
     if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic)) {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  FL("invalid pAdapter: %p"), pAdapter);
+                  FL("invalid pAdapter: %pK"), pAdapter);
         return;
     }
     pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
@@ -2312,7 +2521,7 @@ void wlan_hdd_tdls_check_bmps(hdd_adapter_t *pAdapter)
        return;
     }
 
-    curr_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0);
+    curr_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, TRUE);
     if (NULL != curr_peer)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
@@ -2335,7 +2544,9 @@ void wlan_hdd_tdls_check_bmps(hdd_adapter_t *pAdapter)
                 VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
                      "%s: No TDLS peer connected/discovery sent. Enable BMPS",
                       __func__);
-                hdd_enable_bmps_imps(pHddCtx);
+                status = hdd_enable_bmps_imps(pHddCtx);
+                if (status == VOS_STATUS_SUCCESS)
+                    pHddTdlsCtx->is_tdls_disabled_bmps = false;
             }
         }
         else
@@ -2344,7 +2555,9 @@ void wlan_hdd_tdls_check_bmps(hdd_adapter_t *pAdapter)
             {
                 VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                            "%s: TDLS peer connected. Disable BMPS", __func__);
-                hdd_disable_bmps_imps(pHddCtx, WLAN_HDD_INFRA_STATION);
+                status = hdd_disable_bmps_imps(pHddCtx, WLAN_HDD_INFRA_STATION);
+                if (status == VOS_STATUS_SUCCESS)
+                    pHddTdlsCtx->is_tdls_disabled_bmps = true;
             }
         }
     }
@@ -2369,7 +2582,8 @@ void wlan_hdd_tdls_check_bmps(hdd_adapter_t *pAdapter)
             sme_SetTdlsPowerSaveProhibited(WLAN_HDD_GET_HAL_CTX(pAdapter),
                                            pAdapter->sessionId, TRUE);
             sme_PsOffloadDisablePowerSave(WLAN_HDD_GET_HAL_CTX(pAdapter),
-                                        pAdapter->sessionId);
+                                          NULL, NULL,
+                                          pAdapter->sessionId);
 
         }
     }
@@ -2421,7 +2635,8 @@ static hddTdlsPeer_t *wlan_hdd_tdls_find_progress_peer(hdd_adapter_t *pAdapter,
 }
 
 hddTdlsPeer_t *wlan_hdd_tdls_is_progress(hdd_context_t *pHddCtx,
-                                         const u8 *mac, u8 skip_self)
+                                         const u8 *mac, u8 skip_self,
+                                         bool need_lock)
 {
     hdd_adapter_list_node_t *pAdapterNode = NULL, *pNext = NULL;
     hdd_adapter_t *pAdapter = NULL;
@@ -2429,7 +2644,8 @@ hddTdlsPeer_t *wlan_hdd_tdls_is_progress(hdd_context_t *pHddCtx,
     hddTdlsPeer_t *curr_peer= NULL;
     VOS_STATUS status = 0;
 
-    mutex_lock(&pHddCtx->tdls_lock);
+    if (need_lock)
+        mutex_lock(&pHddCtx->tdls_lock);
 
     status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
     while ( NULL != pAdapterNode && VOS_STATUS_SUCCESS == status )
@@ -2442,14 +2658,16 @@ hddTdlsPeer_t *wlan_hdd_tdls_is_progress(hdd_context_t *pHddCtx,
             curr_peer = wlan_hdd_tdls_find_progress_peer(pAdapter, mac, skip_self);
             if (curr_peer)
             {
-                mutex_unlock(&pHddCtx->tdls_lock);
+                if (need_lock)
+                    mutex_unlock(&pHddCtx->tdls_lock);
                 return curr_peer;
             }
         }
         status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
         pAdapterNode = pNext;
     }
-    mutex_unlock(&pHddCtx->tdls_lock);
+    if (need_lock)
+        mutex_unlock(&pHddCtx->tdls_lock);
     return NULL;
 }
 
@@ -2503,7 +2721,7 @@ void wlan_hdd_tdls_implicit_send_discovery_request(tdlsCtx_t * pHddTdlsCtx)
         }
     }
 
-    temp_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0);
+    temp_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, TRUE);
 
     if (NULL != temp_peer)
     {
@@ -2515,7 +2733,8 @@ void wlan_hdd_tdls_implicit_send_discovery_request(tdlsCtx_t * pHddTdlsCtx)
     if (eTDLS_CAP_UNKNOWN != curr_peer->tdls_support)
         wlan_hdd_tdls_set_peer_link_status(curr_peer,
                                            eTDLS_LINK_DISCOVERING,
-                                           eTDLS_LINK_SUCCESS);
+                                           eTDLS_LINK_SUCCESS,
+                                           TRUE);
 
     mutex_lock(&pHddCtx->tdls_lock);
 
@@ -2525,14 +2744,19 @@ void wlan_hdd_tdls_implicit_send_discovery_request(tdlsCtx_t * pHddTdlsCtx)
      */
     if (FALSE == curr_peer->isForcedPeer)
     {
-        if (curr_peer->discovery_attempt >=
-            pHddTdlsCtx->threshold_config.discovery_tries_n)
-        {
+        if ((curr_peer->discovery_cycles_retry_cnt >=
+                        MAX_TDLS_DISCOVERY_CYCLE_RETRIES) ||
+            ((curr_peer->discovery_cycles_retry_cnt != 0) &&
+             (curr_peer->discovery_cycles_retry_cnt <
+                        MAX_TDLS_DISCOVERY_CYCLE_RETRIES) &&
+             (adf_os_ticks_to_msecs(HDD_BW_GET_DIFF(jiffies,
+                        curr_peer->last_discovery_req_cycle_ts)) <=
+                        MIN_TDLS_DISCOVERY_CYCLE_RETRY_TIME))) {
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                      "%s: discovery attempt (%d) reached max (%d) for peer "
+                      "%s: discovery attempt (%d), discovery cycle retry count (%d) for peer "
                       MAC_ADDRESS_STR ", ignore discovery trigger from fw",
                       __func__, curr_peer->discovery_attempt,
-                      pHddTdlsCtx->threshold_config.discovery_tries_n,
+                      curr_peer->discovery_cycles_retry_cnt,
                       MAC_ADDR_ARRAY(curr_peer->peerMac));
             curr_peer->tdls_support = eTDLS_CAP_NOT_SUPPORTED;
             /* Since TDLS discovery attempt reached the
@@ -2552,7 +2776,8 @@ void wlan_hdd_tdls_implicit_send_discovery_request(tdlsCtx_t * pHddTdlsCtx)
 
     wlan_hdd_tdls_set_peer_link_status(curr_peer,
                                        eTDLS_LINK_DISCOVERING,
-                                       eTDLS_LINK_SUCCESS);
+                                       eTDLS_LINK_SUCCESS,
+                                       TRUE);
 
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
               "%s: Implicit TDLS, Send Discovery request event", __func__);
@@ -2571,11 +2796,17 @@ void wlan_hdd_tdls_implicit_send_discovery_request(tdlsCtx_t * pHddTdlsCtx)
 
     wlan_hdd_tdls_check_power_save_prohibited(pHddTdlsCtx->pAdapter);
 
+    mutex_unlock(&pHddCtx->tdls_lock);
+
+    wlan_hdd_tdls_check_bmps(pHddTdlsCtx->pAdapter);
+
     VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                "%s: discovery count %u timeout %u msec",
                __func__, pHddTdlsCtx->discovery_sent_cnt,
                pHddTdlsCtx->threshold_config.tx_period_t - TDLS_DISCOVERY_TIMEOUT_BEFORE_UPDATE);
 
+    mutex_lock(&pHddCtx->tdls_lock);
+
     wlan_hdd_tdls_timer_restart(pHddTdlsCtx->pAdapter,
                                 &pHddTdlsCtx->peerDiscoveryTimeoutTimer,
                                 pHddTdlsCtx->threshold_config.tx_period_t - TDLS_DISCOVERY_TIMEOUT_BEFORE_UPDATE);
@@ -2661,7 +2892,7 @@ int wlan_hdd_tdls_scan_callback (hdd_adapter_t *pAdapter,
     if (eTDLS_SUPPORT_NOT_ENABLED == pHddCtx->tdls_mode)
         return 1;
 
-    curr_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0);
+    curr_peer = wlan_hdd_tdls_is_progress(pHddCtx, NULL, 0, TRUE);
     if (NULL != curr_peer)
     {
         if (pHddCtx->tdls_scan_ctxt.reject++ >= TDLS_MAX_SCAN_REJECT)
@@ -2673,7 +2904,8 @@ int wlan_hdd_tdls_scan_callback (hdd_adapter_t *pAdapter,
 
             wlan_hdd_tdls_set_peer_link_status (curr_peer,
                                                 eTDLS_LINK_IDLE,
-                                                eTDLS_LINK_UNSPECIFIED);
+                                                eTDLS_LINK_UNSPECIFIED,
+                                                TRUE);
             return 1;
         }
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
@@ -2714,7 +2946,8 @@ int wlan_hdd_tdls_scan_callback (hdd_adapter_t *pAdapter,
         eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == pHddCtx->tdls_mode)
     {
         /* Disable implicit trigger logic & tdls operation */
-        wlan_hdd_tdls_set_mode(pHddCtx, eTDLS_SUPPORT_DISABLED, FALSE);
+        wlan_hdd_tdls_set_mode(pHddCtx, eTDLS_SUPPORT_DISABLED, FALSE,
+                        HDD_SET_TDLS_MODE_SOURCE_SCAN);
         /* indicate the teardown all connected to peer */
         connectedTdlsPeers = wlan_hdd_tdlsConnectedPeers(pAdapter);
         if (connectedTdlsPeers)
@@ -2831,7 +3064,8 @@ void wlan_hdd_tdls_scan_done_callback(hdd_adapter_t *pAdapter)
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                        ("%s: revert tdls mode %d"), __func__, pHddCtx->tdls_mode_last);
 
-        wlan_hdd_tdls_set_mode(pHddCtx, pHddCtx->tdls_mode_last, FALSE);
+        wlan_hdd_tdls_set_mode(pHddCtx, pHddCtx->tdls_mode_last, FALSE,
+                        HDD_SET_TDLS_MODE_SOURCE_SCAN);
     }
     wlan_hdd_tdls_check_bmps(pAdapter);
     EXIT();
@@ -2845,7 +3079,7 @@ void wlan_hdd_tdls_timer_restart(hdd_adapter_t *pAdapter,
 
 	if (NULL == pAdapter || WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic) {
 		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-				  FL("invalid pAdapter: %p"), pAdapter);
+				  FL("invalid pAdapter: %pK"), pAdapter);
 		return;
 	}
 
@@ -2878,7 +3112,8 @@ void wlan_hdd_tdls_indicate_teardown(hdd_adapter_t *pAdapter,
 
     wlan_hdd_tdls_set_peer_link_status(curr_peer,
                                        eTDLS_LINK_TEARING,
-                                       eTDLS_LINK_UNSPECIFIED);
+                                       eTDLS_LINK_UNSPECIFIED,
+                                       TRUE);
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
               FL("Indicating NL80211_TDLS_TEARDOWN to supplicant, reason %d"),
                     reason);
@@ -3366,3 +3601,47 @@ int hdd_set_tdls_scan_type(hdd_context_t *hdd_ctx, int val)
 		return 0;
 	}
 }
+
+/**
+ * wlan_hdd_change_tdls_mode - Change TDLS mode
+ * @data: void pointer
+ *
+ * Return: None
+ */
+void wlan_hdd_change_tdls_mode(void *data)
+{
+	hdd_context_t *hdd_ctx = (hdd_context_t *)data;
+
+	wlan_hdd_tdls_set_mode(hdd_ctx, eTDLS_SUPPORT_ENABLED, FALSE,
+			HDD_SET_TDLS_MODE_SOURCE_OFFCHANNEL);
+}
+
+/**
+ * wlan_hdd_start_stop_tdls_source_timer - Restart TDLS source timer
+ * @pHddCtx: ptr to hdd context.
+ * @tdls_mode: value for TDLS support mode.
+ *
+ * This timer is the handler for avoiding overlapping for P2P listen
+ * and TDLS operation. This handler will start the source timer for
+ * the duration of tdls_enable_defer_time after P2P listen ends and
+ * before enabling TDLS again.
+ *
+ * Return: None
+ */
+void wlan_hdd_start_stop_tdls_source_timer(hdd_context_t *pHddCtx,
+					   eTDLSSupportMode tdls_mode)
+{
+	if (VOS_TIMER_STATE_RUNNING ==
+	    vos_timer_getCurrentState(&pHddCtx->tdls_source_timer))
+		vos_timer_stop(&pHddCtx->tdls_source_timer);
+
+	if (tdls_mode == eTDLS_SUPPORT_DISABLED)
+		wlan_hdd_tdls_set_mode(pHddCtx, tdls_mode, FALSE,
+				HDD_SET_TDLS_MODE_SOURCE_OFFCHANNEL);
+
+	vos_timer_start(&pHddCtx->tdls_source_timer,
+		pHddCtx->cfg_ini->tdls_enable_defer_time);
+
+	return;
+}
+
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_trace.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_trace.c
index 37a7af213ca..2e9b34c60e2 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_trace.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_trace.c
@@ -128,11 +128,11 @@ static tANI_U8 *hddTraceGetEventString(tANI_U32 code)
 void hddTraceDump(void *pMac, tpvosTraceRecord pRecord, tANI_U16 recIndex)
 {
     if (TRACE_CODE_HDD_RX_SME_MSG == pRecord->code)
-        hddLog(LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+        hddLog(LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
             recIndex, pRecord->time, pRecord->session, "RX SME MSG:",
             get_eRoamCmdStatus_str(pRecord->data), pRecord->data);
     else
-        hddLog(LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+        hddLog(LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
             recIndex, pRecord->time, pRecord->session, "HDD Event:",
             hddTraceGetEventString(pRecord->code), pRecord->data);
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tsf.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tsf.c
index f9df7b160da..7544b98dcb2 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tsf.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tsf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -30,151 +30,1076 @@
  */
 
 #include "wlan_hdd_main.h"
+#include "wlan_hdd_tsf.h"
 #include "wma_api.h"
+#include <linux/errqueue.h>
 
 /**
- * hdd_capture_tsf() - capture tsf
+ * enum hdd_tsf_op_result - result of tsf operation
  *
- * @adapter: pointer to adapter
- * @buf: pointer to uplayer buf
- * @len : the length of buf
- *
- * This function returns tsf value to uplayer.
- *
- * Return: Describe the execute result of this routine
+ * HDD_TSF_OP_SUCC:  succeed
+ * HDD_TSF_OP_FAIL:  fail
  */
-int hdd_capture_tsf(hdd_adapter_t *adapter, uint32_t *buf, int len)
+enum hdd_tsf_op_result {
+	HDD_TSF_OP_SUCC,
+	HDD_TSF_OP_FAIL
+};
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+static inline void hdd_set_th_sync_status(hdd_adapter_t *adapter,
+		bool initialized)
+{
+	adf_os_atomic_set(&adapter->tsf_sync_ready_flag,
+			(initialized ? 1 : 0));
+}
+
+static inline bool hdd_get_th_sync_status(hdd_adapter_t *adapter)
+{
+	return (!adf_os_atomic_read(&adapter->tsf_sync_ready_flag) == 0);
+}
+
+#else
+static inline bool hdd_get_th_sync_status(hdd_adapter_t *adapter)
+{
+	return true;
+}
+#endif
+
+static
+enum hdd_tsf_get_state hdd_tsf_check_conn_state(hdd_adapter_t *adapter)
 {
-	int ret = 0;
+	enum hdd_tsf_get_state ret = TSF_RETURN;
 	hdd_station_ctx_t *hdd_sta_ctx;
 
+	if (adapter->device_mode == WLAN_HDD_INFRA_STATION ||
+			adapter->device_mode == WLAN_HDD_P2P_CLIENT) {
+		hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+		if (hdd_sta_ctx->conn_info.connState !=
+				eConnectionState_Associated) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("failed to cap tsf, not connect with ap"));
+			ret = TSF_STA_NOT_CONNECTED_NO_TSF;
+		}
+	} else if ((adapter->device_mode == WLAN_HDD_SOFTAP ||
+				adapter->device_mode == WLAN_HDD_P2P_GO) &&
+			!(test_bit(SOFTAP_BSS_STARTED,
+					&adapter->event_flags))) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Soft AP / P2p GO not beaconing"));
+		ret = TSF_SAP_NOT_STARTED_NO_TSF;
+	}
+	return ret;
+}
+
+static bool hdd_tsf_is_initialized(hdd_adapter_t *adapter)
+{
+	hdd_context_t *hddctx;
+
+	if (!adapter) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("invalid adapter"));
+		return false;
+	}
+
+	hddctx = WLAN_HDD_GET_CTX(adapter);
+	if (!hddctx) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("invalid hdd context"));
+		return false;
+	}
+
+	if (!adf_os_atomic_read(&hddctx->tsf_ready_flag) ||
+		!hdd_get_th_sync_status(adapter)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("TSF is not initialized"));
+		return false;
+	}
+
+	return true;
+}
+
+static inline int hdd_reset_tsf_gpio(hdd_adapter_t *adapter)
+{
+	return process_wma_set_command((int)adapter->sessionId,
+			(int)GEN_PARAM_RESET_TSF_GPIO,
+			adapter->sessionId,
+			GEN_CMD);
+}
+
+static enum hdd_tsf_op_result hdd_capture_tsf_internal(
+	hdd_adapter_t *adapter, uint32_t *buf, int len)
+{
+	int ret;
+	hdd_context_t *hddctx;
+
 	if (adapter == NULL || buf == NULL) {
 		hddLog(VOS_TRACE_LEVEL_ERROR,
-			FL("invalid pointer"));
-		return -EINVAL;
+				FL("invalid pointer"));
+		return HDD_TSF_OP_FAIL;
 	}
+
 	if (len != 1)
-		return -EINVAL;
+		return HDD_TSF_OP_FAIL;
+
+	hddctx = WLAN_HDD_GET_CTX(adapter);
+	if (!hddctx) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("invalid hdd context"));
+		return HDD_TSF_OP_FAIL;
+	}
+
+	if (!hdd_tsf_is_initialized(adapter)) {
+		buf[0] = TSF_NOT_READY;
+		return HDD_TSF_OP_SUCC;
+	}
+
+	buf[0] = hdd_tsf_check_conn_state(adapter);
+	if (buf[0] != TSF_RETURN)
+		return HDD_TSF_OP_SUCC;
+
+	if (adf_os_atomic_inc_return(&hddctx->cap_tsf_flag) > 1) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("current in capture state"));
+		buf[0] = TSF_CURRENT_IN_CAP_STATE;
+		return HDD_TSF_OP_SUCC;
+	}
+
+	/* record adapter for cap_tsf_irq_handler  */
+	hddctx->cap_tsf_context = adapter;
+
+	hddLog(VOS_TRACE_LEVEL_INFO, FL("+ioctl issue cap tsf cmd"));
 
 	/* Reset TSF value for new capture */
-	adapter->tsf_high = 0;
-	adapter->tsf_low = 0;
+	adapter->cur_target_time = 0;
 
-	if (adapter->device_mode == WLAN_HDD_INFRA_STATION ||
-		adapter->device_mode == WLAN_HDD_P2P_CLIENT) {
-		hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
-		if (hdd_sta_ctx->conn_info.connState !=
-			eConnectionState_Associated) {
+	buf[0] = TSF_RETURN;
+	ret = process_wma_set_command((int)adapter->sessionId,
+			(int)GEN_PARAM_CAPTURE_TSF,
+			adapter->sessionId,
+			GEN_CMD);
 
-			hddLog(VOS_TRACE_LEVEL_ERROR,
-				FL("failed to cap tsf, not connect with ap"));
-			buf[0] = TSF_STA_NOT_CONNECTED_NO_TSF;
-			return ret;
-		}
+	if (0 != ret) {
+		hddLog(VOS_TRACE_LEVEL_ERROR, FL("cap tsf fail"));
+		buf[0] = TSF_CAPTURE_FAIL;
+		hddctx->cap_tsf_context = NULL;
+		adf_os_atomic_set(&hddctx->cap_tsf_flag, 0);
+		return HDD_TSF_OP_SUCC;
 	}
-	if ((adapter->device_mode == WLAN_HDD_SOFTAP ||
-		adapter->device_mode == WLAN_HDD_P2P_GO) &&
-		!(test_bit(SOFTAP_BSS_STARTED, &adapter->event_flags))) {
+	hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("-ioctl return cap tsf cmd"));
+
+	return HDD_TSF_OP_SUCC;
+}
+
+static enum hdd_tsf_op_result hdd_indicate_tsf_internal(
+	hdd_adapter_t *adapter, uint32_t *buf, int len)
+{
+	int ret;
+	hdd_context_t *hddctx;
+
+	if (adapter == NULL || buf == NULL) {
 		hddLog(VOS_TRACE_LEVEL_ERROR,
-			FL("Soft AP / P2p GO not beaconing"));
-		buf[0] = TSF_SAP_NOT_STARTED_NO_TSF;
-		return ret;
+				FL("invalid pointer"));
+		return HDD_TSF_OP_FAIL;
 	}
-	if (adapter->tsf_state == TSF_CAP_STATE) {
+
+	if (len != 3)
+		return HDD_TSF_OP_FAIL;
+
+	hddctx = WLAN_HDD_GET_CTX(adapter);
+	if (!hddctx) {
 		hddLog(VOS_TRACE_LEVEL_ERROR,
-			FL("current in capture state, pls reset"));
-			buf[0] = TSF_CURRENT_IN_CAP_STATE;
+				FL("invalid hdd context"));
+		return HDD_TSF_OP_FAIL;
+	}
+
+	buf[1] = 0;
+	buf[2] = 0;
+
+	if (!hdd_tsf_is_initialized(adapter)) {
+		buf[0] = TSF_NOT_READY;
+		return HDD_TSF_OP_SUCC;
+	}
+
+	buf[0] = hdd_tsf_check_conn_state(adapter);
+	if (buf[0] != TSF_RETURN)
+		return HDD_TSF_OP_SUCC;
+
+	if (adapter->cur_target_time == 0) {
+		hddLog(VOS_TRACE_LEVEL_INFO,
+				FL("not getting tsf value"));
+		buf[0] = TSF_NOT_RETURNED_BY_FW;
+		return HDD_TSF_OP_SUCC;
 	} else {
-		hddLog(VOS_TRACE_LEVEL_INFO, FL("+ioctl issue cap tsf cmd"));
 		buf[0] = TSF_RETURN;
-		adapter->tsf_state = TSF_CAP_STATE;
-		ret = process_wma_set_command((int)adapter->sessionId,
-				(int)GEN_PARAM_CAPTURE_TSF,
-				adapter->sessionId,
-				GEN_CMD);
-
-		if (ret != VOS_STATUS_SUCCESS) {
-			hddLog(VOS_TRACE_LEVEL_ERROR, FL("capture fail"));
-			buf[0] = TSF_CAPTURE_FAIL;
-			adapter->tsf_state = TSF_IDLE;
+		buf[1] = (uint32_t)(adapter->cur_target_time & 0xffffffff);
+		buf[2] = (uint32_t)((adapter->cur_target_time >> 32) &
+				0xffffffff);
+
+		if (!adf_os_atomic_read(&hddctx->cap_tsf_flag)) {
+			hddLog(VOS_TRACE_LEVEL_INFO,
+				FL("old: status=%u, tsf_low=%u, tsf_high=%u"),
+				buf[0], buf[1], buf[2]);
+			return HDD_TSF_OP_SUCC;
 		}
+
+		ret = hdd_reset_tsf_gpio(adapter);
+		if (0 != ret) {
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+					FL("reset tsf gpio fail"));
+			buf[0] = TSF_RESET_GPIO_FAIL;
+			return HDD_TSF_OP_SUCC;
+		}
+		hddctx->cap_tsf_context = NULL;
+		adf_os_atomic_set(&hddctx->cap_tsf_flag, 0);
 		hddLog(VOS_TRACE_LEVEL_INFO,
-			FL("-ioctl return cap tsf cmd, ret = %d"), ret);
+			FL("get tsf cmd,status=%u, tsf_low=%u, tsf_high=%u"),
+			buf[0], buf[1], buf[2]);
+		return HDD_TSF_OP_SUCC;
 	}
-	return ret;
+}
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+/* unit for target time: us;  host time: ns */
+#define HOST_TO_TARGET_TIME_RATIO NSEC_PER_USEC
+#define MAX_ALLOWED_DEVIATION_NS (100 * NSEC_PER_USEC)
+#define MAX_CONTINUOUS_ERROR_CNT 3
+
+/**
+ * to distinguish 32-bit overflow case, this inverval should:
+ * equal or less than (1/2 * OVERFLOW_INDICATOR32 us)
+ */
+#define WLAN_HDD_CAPTURE_TSF_INTERVAL_SEC 10
+#define WLAN_HDD_CAPTURE_TSF_INIT_INTERVAL_MS 100
+#define OVERFLOW_INDICATOR32 (((int64_t)0x1) << 32)
+#define MAX_UINT64 ((uint64_t)0xffffffffffffffff)
+#define MASK_UINT32 0xffffffff
+#define CAP_TSF_TIMER_FIX_SEC 1
+
+/**
+ * TS_STATUS - timestamp status
+ *
+ * HDD_TS_STATUS_WAITING:  one of the stamp-pair
+ *    is not updated
+ * HDD_TS_STATUS_READY:  valid tstamp-pair
+ * HDD_TS_STATUS_INVALID: invalid tstamp-pair
+ */
+enum hdd_ts_status {
+	HDD_TS_STATUS_WAITING,
+	HDD_TS_STATUS_READY,
+	HDD_TS_STATUS_INVALID
+};
+
+static
+enum hdd_tsf_op_result __hdd_start_tsf_sync(hdd_adapter_t *adapter)
+{
+	VOS_STATUS ret;
+
+	if (!hdd_get_th_sync_status(adapter)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Host Target sync has not initialized"));
+		return HDD_TSF_OP_FAIL;
+	}
+
+	ret = vos_timer_start(&adapter->host_target_sync_timer,
+			WLAN_HDD_CAPTURE_TSF_INIT_INTERVAL_MS);
+	if (ret != VOS_STATUS_SUCCESS && ret != VOS_STATUS_E_ALREADY) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("Failed to start timer, ret: %d"), ret);
+		return HDD_TSF_OP_FAIL;
+	}
+	return HDD_TSF_OP_SUCC;
+}
+
+static
+enum hdd_tsf_op_result __hdd_stop_tsf_sync(hdd_adapter_t *adapter)
+{
+	VOS_STATUS ret;
+
+	if (!hdd_get_th_sync_status(adapter)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Host Target sync has not initialized"));
+		return HDD_TSF_OP_SUCC;
+	}
+
+	ret = vos_timer_stop(&adapter->host_target_sync_timer);
+	if (ret != VOS_STATUS_SUCCESS) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("Failed to stop timer, ret: %d"), ret);
+		return HDD_TSF_OP_FAIL;
+	}
+	return HDD_TSF_OP_SUCC;
+}
+
+static inline void hdd_reset_timestamps(hdd_adapter_t *adapter)
+{
+	spin_lock_bh(&adapter->host_target_sync_lock);
+	adapter->cur_host_time = 0;
+	adapter->cur_target_time = 0;
+	adapter->last_host_time = 0;
+	adapter->last_target_time = 0;
+	spin_unlock_bh(&adapter->host_target_sync_lock);
 }
 
 /**
- * hdd_indicate_tsf() - return tsf to uplayer
+ * hdd_check_timestamp_status() - return the tstamp status
  *
- * @adapter: pointer to adapter
- * @buf: pointer to uplayer buf
- * @len : the length of buf
+ * @last_target_time: the last saved target time
+ * @last_host_time: the last saved host time
+ * @cur_target_time : new target time
+ * @cur_host_time : new host time
  *
- * This function returns tsf value to uplayer.
+ * This function check the new timstamp-pair(cur_host_time/cur_target_time)
  *
- * Return: Describe the execute result of this routine
+ * Return:
+ * HDD_TS_STATUS_WAITING: cur_host_time or cur_host_time is 0
+ * HDD_TS_STATUS_READY: cur_target_time/cur_host_time is a valid pair,
+ *    and can be saved
+ * HDD_TS_STATUS_INVALID: cur_target_time/cur_host_time is a invalid pair,
+ *    should be discard
  */
-int hdd_indicate_tsf(hdd_adapter_t *adapter, uint32_t *buf, int len)
+static
+enum hdd_ts_status hdd_check_timestamp_status(
+		uint64_t last_target_time,
+		uint64_t last_host_time,
+		uint64_t cur_target_time,
+		uint64_t cur_host_time)
+{
+	uint64_t delta_ns, delta_target_time, delta_host_time;
+
+	/* one or more are not updated, need to wait */
+	if (cur_target_time == 0 || cur_host_time == 0)
+		return HDD_TS_STATUS_WAITING;
+
+	/* init value, it's the first time to update the pair */
+	if (last_target_time == 0 && last_host_time == 0)
+		return HDD_TS_STATUS_READY;
+
+	/* the new values should be greater than the saved values */
+	if ((cur_target_time <= last_target_time) ||
+			(cur_host_time <= last_host_time)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Invalid timestamps!last_target_time: %llu;"
+				"last_host_time: %llu; cur_target_time: %llu;"
+				"cur_host_time: %llu"),
+			last_target_time, last_host_time,
+			cur_target_time, cur_host_time);
+		return HDD_TS_STATUS_INVALID;
+	}
+
+	delta_target_time = (cur_target_time - last_target_time) *
+		HOST_TO_TARGET_TIME_RATIO;
+	delta_host_time = cur_host_time - last_host_time;
+
+	/*
+	 * DO NOT use abs64() , a big uint64 value might be turned to
+	 * a small int64 value
+	 */
+	delta_ns = ((delta_target_time > delta_host_time) ?
+			(delta_target_time - delta_host_time) :
+			(delta_host_time - delta_target_time));
+
+	/* the deviation should be smaller than a threshold */
+	if (delta_ns > MAX_ALLOWED_DEVIATION_NS) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Invalid timestamps - delta: %llu ns"), delta_ns);
+		return HDD_TS_STATUS_INVALID;
+	}
+	return HDD_TS_STATUS_READY;
+}
+
+static void hdd_update_timestamp(hdd_adapter_t *adapter,
+		uint64_t target_time, uint64_t host_time)
+{
+	int interval = 0;
+	enum hdd_ts_status sync_status;
+
+	if (!adapter)
+		return;
+
+	/* host time is updated in IRQ context, it's always before target time,
+	 * and so no need to update last_host_time at present;
+	 * assume the interval of capturing TSF
+	 * (WLAN_HDD_CAPTURE_TSF_INTERVAL_SEC) is long enough, host and target
+	 * time are updated in pairs, we can return here to avoid requiring
+	 * spin lock, and to speed up the IRQ processing.
+	 */
+	if (host_time > 0) {
+		adapter->cur_host_time = host_time;
+		return;
+	}
+
+	spin_lock_bh(&adapter->host_target_sync_lock);
+	if (target_time > 0)
+		adapter->cur_target_time = target_time;
+
+	sync_status = hdd_check_timestamp_status(adapter->last_target_time,
+			adapter->last_host_time,
+			adapter->cur_target_time,
+			adapter->cur_host_time);
+	switch (sync_status) {
+	case HDD_TS_STATUS_INVALID:
+		if (++adapter->continuous_error_count <
+			MAX_CONTINUOUS_ERROR_CNT) {
+			interval =
+				WLAN_HDD_CAPTURE_TSF_INIT_INTERVAL_MS;
+			adapter->cur_target_time = 0;
+			adapter->cur_host_time = 0;
+			break;
+		}
+		hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("Reach the max continuous error count"));
+		/*
+		 * fall through:
+		 * If reach MAX_CONTINUOUS_ERROR_CNT, treat it as a
+		 * valid pair
+		 */
+	case HDD_TS_STATUS_READY:
+		adapter->last_target_time = adapter->cur_target_time;
+		adapter->last_host_time = adapter->cur_host_time;
+		adapter->cur_target_time = 0;
+		adapter->cur_host_time = 0;
+		hddLog(VOS_TRACE_LEVEL_INFO,
+			FL("ts-pair updated: target: %llu; host: %llu"),
+			adapter->last_target_time,
+			adapter->last_host_time);
+
+		/* TSF-HOST need to be updated in at most
+		 * WLAN_HDD_CAPTURE_TSF_INTERVAL_SEC, it couldn't be achieved
+		 * if the timer interval is also
+		 * WLAN_HDD_CAPTURE_TSF_INTERVAL_SEC, due to processing or
+		 * schedule delay. So deduct several seconds from
+		 * WLAN_HDD_CAPTURE_TSF_INTERVAL_SEC.
+		 * Without this change, hdd_get_hosttime_from_targettime() will
+		 * get wrong host time when it's longer than
+		 * WLAN_HDD_CAPTURE_TSF_INTERVAL_SEC from last
+		 * TSF-HOST update. */
+		interval = (WLAN_HDD_CAPTURE_TSF_INTERVAL_SEC -
+			    CAP_TSF_TIMER_FIX_SEC) * MSEC_PER_SEC;
+		adapter->continuous_error_count = 0;
+		break;
+	case HDD_TS_STATUS_WAITING:
+		interval = 0;
+		break;
+	}
+	spin_unlock_bh(&adapter->host_target_sync_lock);
+
+	if (interval > 0)
+		vos_timer_start(&adapter->host_target_sync_timer, interval);
+}
+
+static inline bool hdd_tsf_is_in_cap(hdd_adapter_t *adapter)
+{
+	hdd_context_t *hddctx;
+
+	hddctx = WLAN_HDD_GET_CTX(adapter);
+	if (!hddctx)
+		return false;
+
+	return (adf_os_atomic_read(&hddctx->cap_tsf_flag) > 0);
+}
+
+/* define 64bit plus/minus to deal with overflow */
+static inline int hdd_64bit_plus(uint64_t x, int64_t y, uint64_t *ret)
+{
+	if ((y < 0 && (-y) > x) ||
+	    (y > 0 && (y > MAX_UINT64 - x))) {
+		*ret = 0;
+		return -EINVAL;
+	}
+
+	*ret = x + y;
+	return 0;
+}
+
+static inline int hdd_uint64_plus(uint64_t x, uint64_t y, uint64_t *ret)
+{
+	if (!ret)
+		return -EINVAL;
+
+	if (x > (MAX_UINT64 - y)) {
+		*ret = 0;
+		return -EINVAL;
+	}
+
+	*ret = x + y;
+	return 0;
+}
+
+static inline int hdd_uint64_minus(uint64_t x, uint64_t y, uint64_t *ret)
+{
+	if (!ret)
+		return -EINVAL;
+
+	if (x < y) {
+		*ret = 0;
+		return -EINVAL;
+	}
+
+	*ret = x - y;
+	return 0;
+}
+
+static inline int32_t hdd_get_hosttime_from_targettime(
+	hdd_adapter_t *adapter, uint64_t target_time,
+	uint64_t *host_time)
+{
+	int32_t ret = -EINVAL;
+	int64_t delta32_target;
+	bool in_cap_state;
+	int64_t normal_interval_target_value;
+
+	in_cap_state = hdd_tsf_is_in_cap(adapter);
+
+	/*
+	 * To avoid check the lock when it's not capturing tsf
+	 * (the tstamp-pair won't be changed)
+	 */
+	if (in_cap_state)
+		spin_lock_bh(&adapter->host_target_sync_lock);
+
+	/* at present, target_time is only 32bit in fact */
+	delta32_target = (int64_t)((target_time & MASK_UINT32) -
+			(adapter->last_target_time & MASK_UINT32));
+
+	normal_interval_target_value =
+		 (int64_t)WLAN_HDD_CAPTURE_TSF_INTERVAL_SEC  * NSEC_PER_SEC;
+	do_div(normal_interval_target_value, HOST_TO_TARGET_TIME_RATIO);
+
+	if (delta32_target <
+			(normal_interval_target_value - OVERFLOW_INDICATOR32))
+		delta32_target += OVERFLOW_INDICATOR32;
+	else if (delta32_target >
+			(OVERFLOW_INDICATOR32 - normal_interval_target_value))
+		delta32_target -= OVERFLOW_INDICATOR32;
+
+	ret = hdd_64bit_plus(adapter->last_host_time,
+			     HOST_TO_TARGET_TIME_RATIO * delta32_target,
+			     host_time);
+
+	if (in_cap_state)
+		spin_unlock_bh(&adapter->host_target_sync_lock);
+
+	return ret;
+}
+
+static inline int32_t hdd_get_targettime_from_hosttime(
+	hdd_adapter_t *adapter, uint64_t host_time,
+	uint64_t *target_time)
+{
+	int32_t ret = -EINVAL;
+	bool in_cap_state;
+
+	if (!adapter || host_time == 0)
+		return ret;
+
+	in_cap_state = hdd_tsf_is_in_cap(adapter);
+	if (in_cap_state)
+		spin_lock_bh(&adapter->host_target_sync_lock);
+
+	if (host_time < adapter->last_host_time)
+		ret = hdd_uint64_minus(adapter->last_target_time,
+				       vos_do_div(adapter->last_host_time -
+						  host_time,
+						  HOST_TO_TARGET_TIME_RATIO),
+				       target_time);
+	else
+		ret = hdd_uint64_plus(adapter->last_target_time,
+				      vos_do_div(host_time -
+						 adapter->last_host_time,
+						 HOST_TO_TARGET_TIME_RATIO),
+				      target_time);
+
+	if (in_cap_state)
+		spin_unlock_bh(&adapter->host_target_sync_lock);
+
+	return ret;
+}
+
+static inline uint64_t hdd_get_monotonic_host_time(hdd_context_t *hdd_ctx)
+{
+	return (HDD_TSF_IS_RAW_SET(hdd_ctx) ?
+		ktime_get_ns() : ktime_get_real_ns());
+}
+
+static ssize_t __hdd_wlan_tsf_show(struct device *dev,
+				   struct device_attribute *attr, char *buf)
 {
-	int ret = 0;
 	hdd_station_ctx_t *hdd_sta_ctx;
+	hdd_adapter_t *adapter;
+	hdd_context_t *hdd_ctx;
+	ssize_t size;
+	uint64_t host_time, target_time;
 
-	if (adapter == NULL || buf == NULL) {
+	struct net_device *net_dev = container_of(dev, struct net_device, dev);
+
+	adapter = (hdd_adapter_t *)(netdev_priv(net_dev));
+	if (adapter->magic != WLAN_HDD_ADAPTER_MAGIC)
+		return scnprintf(buf, PAGE_SIZE, "Invalid device\n");
+
+	if (!hdd_get_th_sync_status(adapter))
+		return scnprintf(buf, PAGE_SIZE,
+				 "TSF sync is not initialized\n");
+
+	hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+	if (eConnectionState_Associated != hdd_sta_ctx->conn_info.connState)
+		return scnprintf(buf, PAGE_SIZE, "NOT connected\n");
+
+	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+	if (!hdd_ctx)
+		return scnprintf(buf, PAGE_SIZE, "Invalid HDD context\n");
+
+	host_time = hdd_get_monotonic_host_time(hdd_ctx);
+	if (hdd_get_targettime_from_hosttime(adapter, host_time,
+					     &target_time))
+		size = scnprintf(buf, PAGE_SIZE, "Invalid timestamp\n");
+	else
+		size = scnprintf(buf, PAGE_SIZE, "%s%llu %llu %pM\n",
+				 buf, target_time, host_time,
+				 hdd_sta_ctx->conn_info.bssId);
+	return size;
+}
+
+static ssize_t hdd_wlan_tsf_show(struct device *dev,
+				 struct device_attribute *attr, char *buf)
+{
+	ssize_t ret;
+
+	vos_ssr_protect(__func__);
+	ret = __hdd_wlan_tsf_show(dev, attr, buf);
+	vos_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+static DEVICE_ATTR(tsf, 0400, hdd_wlan_tsf_show, NULL);
+
+static void hdd_capture_tsf_timer_expired_handler(void *arg)
+{
+	uint32_t tsf_op_resp;
+	hdd_adapter_t *adapter;
+
+	if (!arg)
+		return;
+
+	adapter = (hdd_adapter_t *)arg;
+	hdd_capture_tsf_internal(adapter, &tsf_op_resp, 1);
+}
+
+static irqreturn_t hdd_tsf_captured_irq_handler(int irq, void *arg)
+{
+	hdd_adapter_t *adapter;
+	hdd_context_t *hdd_ctx;
+	uint64_t host_time;
+	char *name = NULL;
+
+	if (!arg)
+		return IRQ_NONE;
+
+	hdd_ctx = (hdd_context_t *)arg;
+	host_time = hdd_get_monotonic_host_time(hdd_ctx);
+
+	adapter = hdd_ctx->cap_tsf_context;
+	if (!adapter)
+		return IRQ_HANDLED;
+
+	if (!hdd_tsf_is_initialized(adapter)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("tsf is not init, ignore irq"));
+		return IRQ_HANDLED;
+	}
+
+	hdd_update_timestamp(adapter, 0, host_time);
+	if (adapter->dev)
+		name = adapter->dev->name;
+
+	hddLog(VOS_TRACE_LEVEL_INFO,
+	       FL("irq: %d - iface: %s - host_time: %llu"),
+	       irq, (!name ? "none" : name), host_time);
+
+	return IRQ_HANDLED;
+}
+
+static enum hdd_tsf_op_result hdd_tsf_sync_init(hdd_adapter_t *adapter)
+{
+	VOS_STATUS ret;
+	hdd_context_t *hddctx;
+	struct net_device *net_dev;
+
+	if (!adapter)
+		return HDD_TSF_OP_FAIL;
+
+	hddctx = WLAN_HDD_GET_CTX(adapter);
+	if (!hddctx) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("invalid hdd context"));
+		return HDD_TSF_OP_FAIL;
+	}
+
+	if (!adf_os_atomic_read(&hddctx->tsf_ready_flag)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("TSF feature has NOT been initialized"));
+		return HDD_TSF_OP_FAIL;
+	}
+
+	if (hdd_get_th_sync_status(adapter)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("Host Target sync has been initialized!!"));
+		return HDD_TSF_OP_SUCC;
+	}
+
+	spin_lock_init(&adapter->host_target_sync_lock);
+
+	hdd_reset_timestamps(adapter);
+
+	ret = vos_timer_init(&adapter->host_target_sync_timer,
+			     VOS_TIMER_TYPE_SW,
+			     hdd_capture_tsf_timer_expired_handler,
+			     (void *)adapter);
+	if (ret != VOS_STATUS_SUCCESS) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+		       FL("Failed to init timer, ret: %d"), ret);
+		goto fail;
+	}
+
+	net_dev = adapter->dev;
+	if (net_dev && HDD_TSF_IS_DBG_FS_SET(hddctx))
+		device_create_file(&net_dev->dev, &dev_attr_tsf);
+	hdd_set_th_sync_status(adapter, true);
+
+	return HDD_TSF_OP_SUCC;
+fail:
+	hdd_set_th_sync_status(adapter, false);
+	return HDD_TSF_OP_FAIL;
+}
+
+static enum hdd_tsf_op_result hdd_tsf_sync_deinit(hdd_adapter_t *adapter)
+{
+	VOS_STATUS ret;
+	hdd_context_t *hddctx;
+	struct net_device *net_dev;
+
+	if (!adapter)
+		return HDD_TSF_OP_FAIL;
+
+	if (!hdd_get_th_sync_status(adapter)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Host Target sync has not been initialized!!"));
+		return HDD_TSF_OP_SUCC;
+	}
+
+	hdd_set_th_sync_status(adapter, false);
+
+	ret = vos_timer_destroy(&adapter->host_target_sync_timer);
+	if (ret != VOS_STATUS_SUCCESS)
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Failed to destroy timer, ret: %d"), ret);
+
+	hddctx = WLAN_HDD_GET_CTX(adapter);
+
+	/* reset the cap_tsf flag and gpio if needed */
+	if (hddctx && adf_os_atomic_read(&hddctx->cap_tsf_flag) &&
+			hddctx->cap_tsf_context == adapter) {
+		int reset_ret = hdd_reset_tsf_gpio(adapter);
+
+		if (reset_ret)
+			hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("Failed to reset tsf gpio, ret:%d"),
+				reset_ret);
+		hddctx->cap_tsf_context = NULL;
+		adf_os_atomic_set(&hddctx->cap_tsf_flag, 0);
+	}
+
+	hdd_reset_timestamps(adapter);
+
+	net_dev = adapter->dev;
+	if (net_dev && HDD_TSF_IS_DBG_FS_SET(hddctx)) {
+		struct device *dev = &net_dev->dev;
+
+		device_remove_file(dev, &dev_attr_tsf);
+	}
+	return HDD_TSF_OP_SUCC;
+}
+
+static inline void hdd_update_tsf(hdd_adapter_t *adapter, uint64_t tsf)
+{
+	uint32_t tsf_op_resp[3];
+
+	hdd_indicate_tsf_internal(adapter, tsf_op_resp, 3);
+	hdd_update_timestamp(adapter, tsf, 0);
+}
+
+static inline
+enum hdd_tsf_op_result hdd_netbuf_timestamp(adf_nbuf_t netbuf,
+					    uint64_t target_time)
+{
+	hdd_adapter_t *adapter;
+	struct net_device *net_dev = netbuf->dev;
+
+	if (!net_dev)
+		return HDD_TSF_OP_FAIL;
+
+	adapter = (hdd_adapter_t *)(netdev_priv(net_dev));
+	if (adapter && adapter->magic == WLAN_HDD_ADAPTER_MAGIC &&
+	    hdd_get_th_sync_status(adapter)) {
+		uint64_t host_time;
+		int32_t ret = hdd_get_hosttime_from_targettime(adapter,
+				target_time, &host_time);
+		if (!ret) {
+			netbuf->tstamp = ns_to_ktime(host_time);
+			return HDD_TSF_OP_SUCC;
+		}
+	}
+
+	return HDD_TSF_OP_FAIL;
+}
+
+int hdd_start_tsf_sync(hdd_adapter_t *adapter)
+{
+	enum hdd_tsf_op_result ret;
+
+	if (!adapter)
+		return -EINVAL;
+
+	ret = hdd_tsf_sync_init(adapter);
+	if (ret != HDD_TSF_OP_SUCC) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Failed to init tsf sync, ret: %d"), ret);
+		return -EINVAL;
+	}
+
+	return (__hdd_start_tsf_sync(adapter) ==
+		HDD_TSF_OP_SUCC ? 0 : -EINVAL);
+}
+
+int hdd_stop_tsf_sync(hdd_adapter_t *adapter)
+{
+	enum hdd_tsf_op_result ret;
+
+	if (!adapter)
+		return -EINVAL;
+
+	ret = __hdd_stop_tsf_sync(adapter);
+	if (ret != HDD_TSF_OP_SUCC)
+		return -EINVAL;
+
+	ret = hdd_tsf_sync_deinit(adapter);
+	if (ret != HDD_TSF_OP_SUCC) {
 		hddLog(VOS_TRACE_LEVEL_ERROR,
-			FL("invalid pointer"));
+			FL("Failed to deinit tsf sync, ret: %d"), ret);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int hdd_tx_timestamp(adf_nbuf_t netbuf, uint64_t target_time)
+{
+	struct sock *sk = NULL;
+
+	if (netbuf->sk != NULL)
+		sk = netbuf->sk;
+	else
+		memcpy((void *)(&sk), (void *)(&netbuf->tstamp.tv64),
+		       sizeof(sk));
+
+	if (!sk)
+		return -EINVAL;
+
+	if ((skb_shinfo(netbuf)->tx_flags & SKBTX_SW_TSTAMP) &&
+	    !(skb_shinfo(netbuf)->tx_flags & SKBTX_IN_PROGRESS)) {
+		struct sock_exterr_skb *serr;
+		adf_nbuf_t new_netbuf;
+		int err;
+
+		if (hdd_netbuf_timestamp(netbuf, target_time) !=
+		    HDD_TSF_OP_SUCC)
+			return -EINVAL;
+
+		new_netbuf = adf_nbuf_clone(netbuf);
+		if (!new_netbuf)
+			return -ENOMEM;
+
+		serr = SKB_EXT_ERR(new_netbuf);
+		memset(serr, 0, sizeof(*serr));
+		serr->ee.ee_errno = ENOMSG;
+		serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
+
+		err = sock_queue_err_skb(sk, new_netbuf);
+		if (err) {
+			adf_nbuf_free(new_netbuf);
+			return err;
+		}
+
+		return 0;
+	}
+	return -EINVAL;
+}
+
+int hdd_rx_timestamp(adf_nbuf_t netbuf, uint64_t target_time)
+{
+	if (hdd_netbuf_timestamp(netbuf, target_time) ==
+		HDD_TSF_OP_SUCC)
+		return 0;
+
+	/* reset tstamp when failed */
+	netbuf->tstamp = ns_to_ktime(0);
+	return -EINVAL;
+}
+
+static inline int __hdd_capture_tsf(hdd_adapter_t *adapter,
+		uint32_t *buf, int len)
+{
+	if (!adapter || !buf) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("invalid pointer"));
+		return -EINVAL;
+	}
+
+	if (len != 1)
+		return -EINVAL;
+
+	buf[0] = TSF_DISABLED_BY_TSFPLUS;
+
+	return 0;
+}
+
+static inline int __hdd_indicate_tsf(hdd_adapter_t *adapter,
+		uint32_t *buf, int len)
+{
+	if (!adapter || !buf) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+				FL("invalid pointer"));
 		return -EINVAL;
 	}
 
 	if (len != 3)
 		return -EINVAL;
 
+	buf[0] = TSF_DISABLED_BY_TSFPLUS;
 	buf[1] = 0;
 	buf[2] = 0;
-	if (adapter->device_mode == WLAN_HDD_INFRA_STATION ||
-		adapter->device_mode == WLAN_HDD_P2P_CLIENT) {
-		hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
-		if (hdd_sta_ctx->conn_info.connState !=
-			eConnectionState_Associated) {
 
-			hddLog(VOS_TRACE_LEVEL_INFO,
-				FL("fail to get tsf, sta in disconnected"));
-			buf[0] = TSF_STA_NOT_CONNECTED_NO_TSF;
-			return ret;
-		}
+	return 0;
+}
+
+static inline
+enum hdd_tsf_op_result wlan_hdd_tsf_plus_init(hdd_context_t *hdd_ctx)
+{
+	int ret;
+
+	if (!HDD_TSF_IS_PTP_ENABLED(hdd_ctx)) {
+		hddLog(VOS_TRACE_LEVEL_INFO,
+		       FL("To enable TSF_PLUS, set gtsf_ptp_options in ini"));
+		return HDD_TSF_OP_FAIL;
 	}
-	if ((adapter->device_mode == WLAN_HDD_SOFTAP ||
-		adapter->device_mode == WLAN_HDD_P2P_GO) &&
-		!(test_bit(SOFTAP_BSS_STARTED, &adapter->event_flags))) {
+
+	ret = cnss_common_register_tsf_captured_handler(
+			hdd_ctx->parent_dev,
+			hdd_tsf_captured_irq_handler,
+			(void *)hdd_ctx);
+	if (ret != 0) {
 		hddLog(VOS_TRACE_LEVEL_ERROR,
-			FL("Soft AP / P2p GO not beaconing"));
-		buf[0] = TSF_SAP_NOT_STARTED_NO_TSF;
-		return ret;
+			FL("Failed to register irq handler: %d"), ret);
+		return HDD_TSF_OP_FAIL;
 	}
-	if (adapter->tsf_high == 0 && adapter->tsf_low == 0) {
-		hddLog(VOS_TRACE_LEVEL_INFO,
-			FL("not getting tsf value"));
-		buf[0] = TSF_NOT_RETURNED_BY_FW;
-	} else {
-		buf[0] = TSF_RETURN;
-		buf[1] = adapter->tsf_low;
-		buf[2] = adapter->tsf_high;
-		adapter->tsf_state = TSF_IDLE;
 
-		ret = process_wma_set_command((int)adapter->sessionId,
-				(int)GEN_PARAM_RESET_TSF_GPIO,
-				adapter->sessionId,
-				GEN_CMD);
+	if (HDD_TSF_IS_TX_SET(hdd_ctx))
+		ol_register_timestamp_callback(hdd_tx_timestamp);
 
-		if (0 != ret) {
-			hddLog(VOS_TRACE_LEVEL_ERROR, FL("tsf get fail "));
-			buf[0] = TSF_RESET_GPIO_FAIL;
-		}
-		hddLog(VOS_TRACE_LEVEL_INFO,
-			FL("get tsf cmd,status=%u, tsf_low=%u, tsf_high=%u"),
-			buf[0], buf[1], buf[2]);
+	return HDD_TSF_OP_SUCC;
+}
+
+static inline
+enum hdd_tsf_op_result wlan_hdd_tsf_plus_deinit(hdd_context_t *hdd_ctx)
+{
+	int ret;
+
+	if (!HDD_TSF_IS_PTP_ENABLED(hdd_ctx))
+		return HDD_TSF_OP_SUCC;
+
+	if (HDD_TSF_IS_TX_SET(hdd_ctx))
+		ol_deregister_timestamp_callback();
+
+	ret = cnss_common_unregister_tsf_captured_handler(
+				hdd_ctx->parent_dev,
+				(void *)hdd_ctx);
+	if (ret != 0) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Failed to unregister irq handler, ret:%d"),
+			ret);
+		ret = HDD_TSF_OP_FAIL;
 	}
-	return ret;
+
+	return HDD_TSF_OP_SUCC;
+}
+
+void hdd_tsf_notify_wlan_state_change(hdd_adapter_t *adapter,
+	eConnectionState old_state,
+	eConnectionState new_state)
+{
+	if (!adapter)
+		return;
+
+	if (old_state != eConnectionState_Associated &&
+		new_state == eConnectionState_Associated)
+		hdd_start_tsf_sync(adapter);
+	else if (old_state == eConnectionState_Associated &&
+		new_state != eConnectionState_Associated)
+		hdd_stop_tsf_sync(adapter);
+}
+
+void
+hdd_tsf_record_sk_for_skb(hdd_context_t *hdd_ctx, adf_nbuf_t nbuf)
+{
+	/* if TSF_TX is enabled, skb->sk is required when timestamping
+	 * the tx skb; at the same time, skb->tstamp is useless at this
+	 * point in such case, so record sk in tstamp, in case it will
+	 * be set to NULL in skb_orphan().
+	 */
+	if (HDD_TSF_IS_TX_SET(hdd_ctx))
+		memcpy((void *)(&nbuf->tstamp.tv64), (void *)(&nbuf->sk),
+		       sizeof(nbuf->sk));
+}
+#else
+static inline void hdd_update_tsf(hdd_adapter_t *adapter, uint64_t tsf)
+{
+}
+
+static inline int __hdd_indicate_tsf(hdd_adapter_t *adapter,
+		uint32_t *buf, int len)
+{
+	return (hdd_indicate_tsf_internal(adapter, buf, len) ==
+		HDD_TSF_OP_SUCC ? 0 : -EINVAL);
+}
+
+static inline int __hdd_capture_tsf(hdd_adapter_t *adapter,
+		uint32_t *buf, int len)
+{
+	return (hdd_capture_tsf_internal(adapter, buf, len) ==
+		HDD_TSF_OP_SUCC ? 0 : -EINVAL);
+}
+
+static inline
+enum hdd_tsf_op_result wlan_hdd_tsf_plus_init(hdd_context_t *hdd_ctx)
+{
+	return HDD_TSF_OP_SUCC;
+}
+
+static inline
+enum hdd_tsf_op_result wlan_hdd_tsf_plus_deinit(hdd_context_t *hdd_ctx)
+{
+	return HDD_TSF_OP_SUCC;
+}
+#endif /* WLAN_FEATURE_TSF_PLUS */
+
+int hdd_capture_tsf(hdd_adapter_t *adapter, uint32_t *buf, int len)
+{
+	return __hdd_capture_tsf(adapter, buf, len);
+}
+
+int hdd_indicate_tsf(hdd_adapter_t *adapter, uint32_t *buf, int len)
+{
+	return __hdd_indicate_tsf(adapter, buf, len);
 }
 
 /**
@@ -215,12 +1140,20 @@ static int hdd_get_tsf_cb(void *pcb_cxt, struct stsf *ptsf)
 		return -EINVAL;
 	}
 
+	if (!hdd_tsf_is_initialized(adapter)) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("tsf is not init, ignore tsf event"));
+		return -EINVAL;
+	}
+
 	hddLog(VOS_TRACE_LEVEL_INFO,
 		FL("tsf cb handle event, device_mode is %d"),
 		adapter->device_mode);
 
-	adapter->tsf_low = ptsf->tsf_low;
-	adapter->tsf_high = ptsf->tsf_high;
+	adapter->cur_target_time = ((uint64_t)ptsf->tsf_high << 32 |
+			 ptsf->tsf_low);
+
+	hdd_update_tsf(adapter, adapter->cur_target_time);
 
 	hddLog(VOS_TRACE_LEVEL_INFO,
 		FL("hdd_get_tsf_cb sta=%u, tsf_low=%u, tsf_high=%u"),
@@ -228,16 +1161,63 @@ static int hdd_get_tsf_cb(void *pcb_cxt, struct stsf *ptsf)
 	return 0;
 }
 
-/**
- * wlan_hdd_tsf_init() - set callback to handle tsf value.
- * @hdd_ctx: pointer to the hdd_context_t
- *
- * This function set the callback to sme module, the callback will be
- * called when a tsf event is reported by firmware
- *
- * Return: nothing
- */
 void wlan_hdd_tsf_init(hdd_context_t *hdd_ctx)
 {
-	sme_set_tsfcb(hdd_ctx->hHal, hdd_get_tsf_cb, hdd_ctx);
+	eHalStatus hal_status;
+
+	if (!hdd_ctx)
+		return;
+
+	if (adf_os_atomic_inc_return(&hdd_ctx->tsf_ready_flag) > 1)
+		return;
+
+	adf_os_atomic_init(&hdd_ctx->cap_tsf_flag);
+
+	if (hdd_ctx->cfg_ini->tsf_gpio_pin == TSF_GPIO_PIN_INVALID)
+		goto fail;
+
+	hal_status = sme_set_tsf_gpio(hdd_ctx->hHal,
+			hdd_ctx->cfg_ini->tsf_gpio_pin);
+	if (eHAL_STATUS_SUCCESS != hal_status) {
+		hddLog(LOGE, FL("set tsf GPIO failed, status: %d"),
+				hal_status);
+		goto fail;
+	}
+
+	hal_status = sme_set_tsfcb(hdd_ctx->hHal, hdd_get_tsf_cb, hdd_ctx);
+	if (eHAL_STATUS_SUCCESS != hal_status) {
+		hddLog(LOGE, FL("set tsf cb failed, status: %d"),
+				hal_status);
+		goto fail;
+	}
+
+	if (wlan_hdd_tsf_plus_init(hdd_ctx) != HDD_TSF_OP_SUCC)
+		goto fail;
+
+	return;
+
+fail:
+	adf_os_atomic_set(&hdd_ctx->tsf_ready_flag, 0);
+	return;
+}
+
+void wlan_hdd_tsf_deinit(hdd_context_t *hdd_ctx)
+{
+	eHalStatus hal_status;
+
+	if (!hdd_ctx)
+		return;
+
+	if (!adf_os_atomic_read(&hdd_ctx->tsf_ready_flag))
+		return;
+
+	hal_status = sme_set_tsfcb(hdd_ctx->hHal, NULL, NULL);
+	if (eHAL_STATUS_SUCCESS != hal_status) {
+		hddLog(LOGE, FL("reset tsf cb failed, status: %d"),
+				hal_status);
+	}
+
+	wlan_hdd_tsf_plus_deinit(hdd_ctx);
+	adf_os_atomic_set(&hdd_ctx->tsf_ready_flag, 0);
+	adf_os_atomic_set(&hdd_ctx->cap_tsf_flag, 0);
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tx_rx.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tx_rx.c
index cb91d749eda..d4841595ff2 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tx_rx.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_tx_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -43,6 +43,8 @@
 #include <wlan_hdd_tx_rx.h>
 #include <wlan_hdd_softap_tx_rx.h>
 #include <wlan_hdd_dp_utils.h>
+#include <wlan_hdd_tsf.h>
+
 #include <wlan_qct_tl.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
@@ -52,6 +54,7 @@
 #include <linux/if_ether.h>
 #endif
 
+#include <linux/inetdevice.h>
 #include <wlan_hdd_p2p.h>
 #include <linux/wireless.h>
 #include <net/cfg80211.h>
@@ -174,21 +177,17 @@ void hdd_flush_ibss_tx_queues( hdd_adapter_t *pAdapter, v_U8_t STAId)
       list_for_each_safe(tmp, next, &pAdapter->wmm_tx_queue[i].anchor)
       {
          pktNode = list_entry(tmp, skb_list_node_t, anchor);
-         if (pktNode != NULL)
-         {
-            skb = pktNode->skb;
+         skb = pktNode->skb;
 
-            /* Get the STAId from data */
-            skbStaIdx = *(v_U8_t *)(((v_U8_t *)(skb->data)) - 1);
-            if (skbStaIdx == STAId)
-            {
-               /* Data for STAId is freed along with the queue node */
+         /* Get the STAId from data */
+         skbStaIdx = *(v_U8_t *)(((v_U8_t *)(skb->data)) - 1);
+         if (skbStaIdx == STAId) {
+            /* Data for STAId is freed along with the queue node */
 
-               list_del(tmp);
-               kfree_skb(skb);
+            list_del(tmp);
+            kfree_skb(skb);
 
-               pAdapter->wmm_tx_queue[i].count--;
-            }
+            pAdapter->wmm_tx_queue[i].count--;
          }
       }
 
@@ -232,7 +231,7 @@ void hdd_tx_resume_timer_expired_handler(void *adapter_context)
 
    hddLog(LOG1, FL("Enabling queues"));
    wlan_hdd_netif_queue_control(pAdapter, WLAN_WAKE_ALL_NETIF_QUEUE,
-            WLAN_CONTROL_PATH);
+            WLAN_DATA_FLOW_CONTROL);
    pAdapter->hdd_stats.hddTxRxStats.txflow_unpause_cnt++;
    pAdapter->hdd_stats.hddTxRxStats.is_txflow_paused = FALSE;
 
@@ -270,11 +269,6 @@ void hdd_tx_resume_cb(void *adapter_context,
        {
           vos_timer_stop(&pAdapter->tx_flow_control_timer);
        }
-       if (adf_os_unlikely(hdd_sta_ctx->hdd_ReassocScenario)) {
-           hddLog(LOGW,
-                  FL("flow control, tx queues un-pause avoided as we are in REASSOCIATING state"));
-           return;
-       }
        hddLog(LOG1, FL("Enabling queues"));
        wlan_hdd_netif_queue_control(pAdapter,
             WLAN_WAKE_ALL_NETIF_QUEUE,
@@ -433,13 +427,15 @@ static void hdd_get_transmit_sta_id(hdd_adapter_t *adapter,
 		 */
 		if (mcbc_addr)
 			*station_id = IBSS_BROADCAST_STAID;
+	} else if (adapter->device_mode == WLAN_HDD_OCB) {
+		*station_id = sta_ctx->conn_info.staId[0];
 	} else if (adapter->device_mode == WLAN_HDD_NDI) {
 		/*
 		 * This check is necessary to make sure station id is not
 		 * overwritten for UC traffic in NAN data mode
 		 */
 		if (mcbc_addr)
-			*station_id = NDP_BROADCAST_STAID;
+			*station_id = sta_ctx->broadcast_staid;
 	} else {
 		/* For the rest, traffic is directed to AP/P2P GO */
            if (eConnectionState_Associated == sta_ctx->conn_info.connState)
@@ -471,8 +467,8 @@ int __hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
    void *vdev_handle = NULL, *vdev_temp;
    bool is_update_ac_stats = FALSE;
    v_MACADDR_t *pDestMacAddress = NULL;
-#ifdef QCA_PKT_PROTO_TRACE
    hdd_context_t *hddCtxt = WLAN_HDD_GET_CTX(pAdapter);
+#ifdef QCA_PKT_PROTO_TRACE
    v_U8_t proto_type = 0;
 #endif /* QCA_PKT_PROTO_TRACE */
 
@@ -497,9 +493,15 @@ int __hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
    while (skb) {
        skb_next = skb->next;
+       /* memset skb control block */
+       vos_mem_zero(skb->cb, sizeof(skb->cb));
+       wlan_hdd_classify_pkt(skb);
+
        pDestMacAddress = (v_MACADDR_t*)skb->data;
        STAId = HDD_WLAN_INVALID_STA_ID;
 
+       hdd_tsf_record_sk_for_skb(hddCtxt, skb);
+
 /*
 * The TCP TX throttling logic is changed a little after 3.19-rc1 kernel,
 * the TCP sending limit will be smaller, which will throttle the TCP packets
@@ -513,20 +515,33 @@ int __hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 */
 #ifdef QCA_LL_TX_FLOW_CT
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(3,19,0))
-      if (pAdapter->tx_flow_low_watermark > 0) {
+       //remove if condition for improving SCC TCP TX KPI
+      //if (pAdapter->tx_flow_low_watermark > 0) {
           skb_orphan(skb);
-      }
+     // }
 #endif
+#else
+      /*
+       * For PTP feature enabled system, need to orphan the socket buffer asap
+       * otherwise the latency will become unacceptable
+       */
+      if (hdd_cfg_is_ptp_opt_enable(hddCtxt))
+          skb_orphan(skb);
 #endif
 
-       hdd_get_transmit_sta_id(pAdapter, pDestMacAddress, &STAId);
-       if (STAId == HDD_WLAN_INVALID_STA_ID) {
-           hddLog(LOG1, "Invalid station id, transmit operation suspended");
-           goto drop_pkt;
-       }
+       /* use self peer directly in monitor mode */
+       if (VOS_MONITOR_MODE != vos_get_conparam()) {
+           hdd_get_transmit_sta_id(pAdapter, pDestMacAddress, &STAId);
+           if (STAId == HDD_WLAN_INVALID_STA_ID) {
+               hddLog(LOG1, "Invalid station id, transmit operation suspended");
+               goto drop_pkt;
+           }
 
-       vdev_temp = tlshim_peer_validity(
-                     (WLAN_HDD_GET_CTX(pAdapter))->pvosContext, STAId);
+           vdev_temp = tlshim_peer_validity(hddCtxt->pvosContext, STAId);
+       } else {
+           vdev_temp =
+               tlshim_selfpeer_vdev(hddCtxt->pvosContext);
+       }
        if (!vdev_temp)
            goto drop_pkt;
 
@@ -535,10 +550,10 @@ int __hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 #ifdef QCA_LL_TX_FLOW_CT
        if ((pAdapter->hdd_stats.hddTxRxStats.is_txflow_paused != TRUE) &&
             VOS_FALSE ==
-              WLANTL_GetTxResource((WLAN_HDD_GET_CTX(pAdapter))->pvosContext,
-                                    pAdapter->sessionId,
-                                    pAdapter->tx_flow_low_watermark,
-                                    pAdapter->tx_flow_high_watermark_offset)) {
+              WLANTL_GetTxResource(hddCtxt->pvosContext,
+				   pAdapter->sessionId,
+				   pAdapter->tx_flow_low_watermark,
+				   pAdapter->tx_flow_high_watermark_offset)) {
            hddLog(LOG1, FL("Disabling queues"));
            wlan_hdd_netif_queue_control(pAdapter, WLAN_STOP_ALL_NETIF_QUEUE,
                     WLAN_DATA_FLOW_CONTROL);
@@ -640,13 +655,24 @@ int __hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
        {
            proto_type = vos_pkt_get_proto_type(skb,
                         hddCtxt->cfg_ini->gEnableDebugLog, 0);
-           if (VOS_PKT_TRAC_TYPE_EAPOL & proto_type)
-           {
+           switch (proto_type) {
+           case VOS_PKT_TRAC_TYPE_EAPOL:
                vos_pkt_trace_buf_update("ST:T:EPL");
-           }
-           else if (VOS_PKT_TRAC_TYPE_DHCP & proto_type)
-           {
+               break;
+           case VOS_PKT_TRAC_TYPE_DHCP:
                hdd_dhcp_pkt_trace_buf_update(skb, TX_PATH, STA);
+               break;
+           case VOS_PKT_TRAC_TYPE_ARP:
+               vos_pkt_trace_buf_update("ST:T:ARP");
+               break;
+           case VOS_PKT_TRAC_TYPE_NS:
+               vos_pkt_trace_buf_update("ST:T:NS");
+               break;
+           case VOS_PKT_TRAC_TYPE_NA:
+               vos_pkt_trace_buf_update("ST:T:NA");
+               break;
+           default:
+               break;
            }
        }
 #endif /* QCA_PKT_PROTO_TRACE */
@@ -661,7 +687,7 @@ int __hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
            list_tail->next = skb;
            list_tail = list_tail->next;
        }
-       vos_mem_zero(skb->cb, sizeof(skb->cb));
+
        adf_dp_trace_log_pkt(pAdapter->sessionId, skb, ADF_TX);
        NBUF_SET_PACKET_TRACK(skb, NBUF_TX_PKT_DATA_TRACK);
        NBUF_UPDATE_TX_PKT_COUNT(skb, NBUF_TX_PKT_HDD);
@@ -670,11 +696,14 @@ int __hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
        DPTRACE(adf_dp_trace(skb, ADF_DP_TRACE_HDD_TX_PACKET_PTR_RECORD,
                  (uint8_t *)&skb->data, sizeof(skb->data), ADF_TX));
        DPTRACE(adf_dp_trace(skb, ADF_DP_TRACE_HDD_TX_PACKET_RECORD,
-                 (uint8_t *)skb->data, skb->len, ADF_TX));
-       if (skb->len > ADF_DP_TRACE_RECORD_SIZE)
-           DPTRACE(adf_dp_trace(skb, ADF_DP_TRACE_HDD_TX_PACKET_RECORD,
-                      (uint8_t *)&skb->data[ADF_DP_TRACE_RECORD_SIZE],
-                      (skb->len - ADF_DP_TRACE_RECORD_SIZE), ADF_TX));
+                 (uint8_t *)skb->data, adf_nbuf_len(skb), ADF_TX));
+
+       if (adf_nbuf_len(skb) > ADF_DP_TRACE_RECORD_SIZE)
+            DPTRACE(adf_dp_trace(skb, ADF_DP_TRACE_HDD_TX_PACKET_RECORD,
+                    (uint8_t *)&skb->data[ADF_DP_TRACE_RECORD_SIZE],
+                    (adf_nbuf_len(skb) - ADF_DP_TRACE_RECORD_SIZE),
+                    ADF_TX));
+
        skb = skb_next;
        continue;
 
@@ -694,8 +723,7 @@ drop_pkt:
    /*
     * TODO: Should we stop net queues when txrx returns non-NULL?.
     */
-   skb = WLANTL_SendSTA_DataFrame((WLAN_HDD_GET_CTX(pAdapter))->pvosContext,
-                                   vdev_handle, list_head
+   skb = WLANTL_SendSTA_DataFrame(hddCtxt->pvosContext, vdev_handle, list_head
 #ifdef QCA_PKT_PROTO_TRACE
                                  , proto_type
 #endif /* QCA_PKT_PROTO_TRACE */
@@ -707,8 +735,11 @@ drop_pkt:
         is_update_ac_stats = TRUE;
         goto drop_list;
    }
-
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0))
+   netif_trans_update(dev);
+#else
    dev->trans_start = jiffies;
+#endif
    return NETDEV_TX_OK;
 
 drop_list:
@@ -829,7 +860,7 @@ void wlan_display_tx_timeout_stats(hdd_adapter_t *adapter)
 		vos_flush_logs(WLAN_LOG_TYPE_FATAL,
 			       WLAN_LOG_INDICATOR_HOST_DRIVER,
 			       WLAN_LOG_REASON_HDD_TIME_OUT,
-			       true);
+			       DUMP_VOS_TRACE);
 	}
 }
 
@@ -849,8 +880,12 @@ static void __hdd_tx_timeout(struct net_device *dev)
    struct netdev_queue *txq;
    int i = 0;
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0))
+   hddLog(LOGE, FL("Transmission timeout occurred jiffies %lu"),jiffies);
+#else
    hddLog(LOGE, FL("Transmission timeout occurred jiffies %lu trans_start %lu"),
           jiffies, dev->trans_start);
+#endif
    DPTRACE(adf_dp_trace(NULL, ADF_DP_TRACE_HDD_TX_TIMEOUT,
                         NULL, 0, ADF_TX));
    /*
@@ -1100,6 +1135,40 @@ bool drop_ip6_mcast(struct sk_buff *skb)
 #define drop_ip6_mcast(_a) 0
 #endif
 
+#ifdef CONFIG_HL_SUPPORT
+/*
+ * hdd_move_radiotap_header_forward - move radiotap header to head of skb
+ * @skb: skb to be modified
+ *
+ * For HL monitor mode, radiotap is appended to tail when update radiotap
+ * info in htt layer. Need to copy it ahead of skb before indicating to OS.
+ */
+static void hdd_move_radiotap_header_forward(struct sk_buff *skb)
+{
+	adf_nbuf_t msdu = (adf_nbuf_t)skb;
+	struct ieee80211_radiotap_header *rthdr;
+	uint8_t rtap_len;
+
+	adf_nbuf_put_tail(msdu,
+		sizeof(struct ieee80211_radiotap_header));
+	rthdr = (struct ieee80211_radiotap_header *)
+	    (adf_nbuf_data(msdu) + adf_nbuf_len(msdu) -
+	     sizeof(struct ieee80211_radiotap_header));
+	rtap_len = rthdr->it_len;
+	adf_nbuf_put_tail(msdu,
+			  rtap_len -
+			  sizeof(struct ieee80211_radiotap_header));
+	adf_nbuf_push_head(msdu, rtap_len);
+	adf_os_mem_copy(adf_nbuf_data(msdu), rthdr, rtap_len);
+	adf_nbuf_trim_tail(msdu, rtap_len);
+}
+#else
+static inline void hdd_move_radiotap_header_forward(struct sk_buff *skb)
+{
+    /* no-op */
+}
+#endif
+
 /**
  * hdd_mon_rx_packet_cbk() - Receive callback registered with TLSHIM.
  * @vosContext: [in] pointer to VOS context
@@ -1140,7 +1209,7 @@ VOS_STATUS hdd_mon_rx_packet_cbk(v_VOID_t *vos_ctx, adf_nbuf_t rx_buf,
 	adapter = adapter_node->pAdapter;
 	if ((NULL == adapter) || (WLAN_HDD_ADAPTER_MAGIC != adapter->magic)) {
 		VOS_TRACE(VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_ERROR,
-			  "invalid adapter %p for sta Id %d", adapter, sta_id);
+			  "invalid adapter %pK for sta Id %d", adapter, sta_id);
 		return VOS_STATUS_E_FAILURE;
 	}
 
@@ -1149,6 +1218,8 @@ VOS_STATUS hdd_mon_rx_packet_cbk(v_VOID_t *vos_ctx, adf_nbuf_t rx_buf,
 	/* walk the chain until all are processed */
 	skb = (struct sk_buff *) rx_buf;
 	while (NULL != skb) {
+		hdd_move_radiotap_header_forward(skb);
+
 		skb_next = skb->next;
 		skb->dev = adapter->dev;
 
@@ -1182,6 +1253,123 @@ VOS_STATUS hdd_mon_rx_packet_cbk(v_VOID_t *vos_ctx, adf_nbuf_t rx_buf,
 
 	return VOS_STATUS_SUCCESS;
 }
+
+VOS_STATUS hdd_vir_mon_rx_cbk(v_VOID_t *vos_ctx, adf_nbuf_t rx_buf,
+			      uint8_t sta_id)
+{
+	hdd_adapter_t *adapter = NULL;
+	hdd_context_t *hdd_ctx = NULL;
+	int rxstat;
+	struct sk_buff *skb = NULL;
+	struct sk_buff *skb_next;
+
+	/* Sanity check on inputs */
+	if ((NULL == vos_ctx) || (NULL == rx_buf)) {
+		VOS_TRACE(VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Null params being passed", __func__);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
+	if (NULL == hdd_ctx) {
+		VOS_TRACE(VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_ERROR,
+			  "%s: HDD adapter context is Null", __func__);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	adapter = hdd_get_adapter(hdd_ctx, WLAN_HDD_MONITOR);
+	if ((NULL == adapter) || (WLAN_HDD_ADAPTER_MAGIC != adapter->magic)) {
+		VOS_TRACE(VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_ERROR,
+			  "invalid adapter %p for sta Id %d", adapter, sta_id);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	/* walk the chain until all are processed */
+	skb = (struct sk_buff *)rx_buf;
+	while (NULL != skb) {
+		skb_next = skb->next;
+		skb->dev = adapter->dev;
+
+		/*
+		 * If this is not a last packet on the chain
+		 * Just put packet into backlog queue, not scheduling RX sirq
+		 */
+		if (skb->next) {
+			rxstat = netif_rx(skb);
+		} else {
+			/*
+			 * This is the last packet on the chain
+			 * Scheduling rx sirq
+			 */
+			rxstat = netif_rx_ni(skb);
+		}
+
+		skb = skb_next;
+	}
+
+	adapter->dev->last_rx = jiffies;
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * hdd_is_arp_local() - check if local or non local arp
+ * @skb: pointer to sk_buff
+ *
+ * Return: true if local arp or false otherwise.
+ */
+static bool hdd_is_arp_local(struct sk_buff *skb)
+{
+
+	struct arphdr *arp;
+	struct in_ifaddr **ifap = NULL;
+	struct in_ifaddr *ifa = NULL;
+	struct in_device *in_dev;
+	unsigned char *arp_ptr;
+	__be32 tip;
+
+	arp = (struct arphdr *)skb->data;
+	if (arp->ar_op == htons(ARPOP_REQUEST)) {
+		if ((in_dev = __in_dev_get_rtnl(skb->dev)) != NULL) {
+			for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
+				ifap = &ifa->ifa_next) {
+				if (!strcmp(skb->dev->name,
+				    ifa->ifa_label))
+					break;
+			}
+		}
+
+		if (ifa && ifa->ifa_local) {
+			arp_ptr = (unsigned char *)(arp + 1);
+			arp_ptr += (skb->dev->addr_len + 4 + skb->dev->addr_len);
+			memcpy(&tip, arp_ptr, 4);
+			hddLog(VOS_TRACE_LEVEL_INFO, "ARP packets: local IP: %x dest IP: %x\n",
+					ifa->ifa_local, tip);
+			if (ifa->ifa_local != tip)
+				return false;
+		}
+	}
+	return true;
+}
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+static inline void hdd_tsf_timestamp_rx(hdd_context_t *hdd_ctx,
+					adf_nbuf_t netbuf,
+					uint64_t target_time)
+{
+	if (!HDD_TSF_IS_RX_SET(hdd_ctx))
+		return;
+
+	hdd_rx_timestamp(netbuf, target_time);
+}
+#else
+static inline void hdd_tsf_timestamp_rx(hdd_context_t *hdd_ctx,
+					adf_nbuf_t netbuf,
+					uint64_t target_time)
+{
+}
+#endif
+
 /**============================================================================
   @brief hdd_rx_packet_cbk() - Receive callback registered with TL.
   TL will call this to notify the HDD when one or more packets were
@@ -1204,9 +1392,10 @@ VOS_STATUS hdd_rx_packet_cbk(v_VOID_t *vosContext,
    struct sk_buff *skb_next;
    unsigned int cpu_index;
 #ifdef QCA_PKT_PROTO_TRACE
-   v_U8_t proto_type;
+   v_U8_t proto_type = 0;
 #endif /* QCA_PKT_PROTO_TRACE */
    hdd_station_ctx_t *pHddStaCtx = NULL;
+   bool wake_lock = false;
 
    //Sanity check on inputs
    if ((NULL == vosContext) || (NULL == rxBuf))
@@ -1224,7 +1413,7 @@ VOS_STATUS hdd_rx_packet_cbk(v_VOID_t *vosContext,
 
    pAdapter = pHddCtx->sta_to_adapter[staId];
    if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic)) {
-      hddLog(LOGE, FL("invalid adapter %p for sta Id %d"), pAdapter, staId);
+      hddLog(LOGE, FL("invalid adapter %pK for sta Id %d"), pAdapter, staId);
       return VOS_STATUS_E_FAILURE;
    }
 
@@ -1251,26 +1440,50 @@ VOS_STATUS hdd_rx_packet_cbk(v_VOID_t *vosContext,
                "%s: Dropping HS 2.0 Gratuitous ARP or Unsolicited NA"
                " else dropping as Driver load/unload is in progress",
                __func__);
-            kfree_skb(skb);
-
+            adf_nbuf_free(skb);
             skb = skb_next;
             continue;
       }
 
-      DPTRACE(adf_dp_trace(rxBuf,
+      DPTRACE(adf_dp_trace(skb,
               ADF_DP_TRACE_RX_HDD_PACKET_PTR_RECORD,
-              adf_nbuf_data_addr(rxBuf),
-              sizeof(adf_nbuf_data(rxBuf)), ADF_RX));
+              adf_nbuf_data_addr(skb),
+              sizeof(adf_nbuf_data(skb)), ADF_RX));
+      DPTRACE(adf_dp_trace(skb,
+              ADF_DP_TRACE_HDD_RX_PACKET_RECORD,
+              (uint8_t *)skb->data, adf_nbuf_len(skb), ADF_RX));
+
+      if (adf_nbuf_len(skb) > ADF_DP_TRACE_RECORD_SIZE)
+          DPTRACE(adf_dp_trace(skb,
+                  ADF_DP_TRACE_HDD_RX_PACKET_RECORD,
+                  (uint8_t *)&skb->data[ADF_DP_TRACE_RECORD_SIZE],
+                  (adf_nbuf_len(skb) - ADF_DP_TRACE_RECORD_SIZE),
+                  ADF_RX));
 
 #ifdef QCA_PKT_PROTO_TRACE
       if ((pHddCtx->cfg_ini->gEnableDebugLog & VOS_PKT_TRAC_TYPE_EAPOL) ||
           (pHddCtx->cfg_ini->gEnableDebugLog & VOS_PKT_TRAC_TYPE_DHCP)) {
          proto_type = vos_pkt_get_proto_type(skb,
                         pHddCtx->cfg_ini->gEnableDebugLog, 0);
-         if (VOS_PKT_TRAC_TYPE_EAPOL & proto_type)
-            vos_pkt_trace_buf_update("ST:R:EPL");
-         else if (VOS_PKT_TRAC_TYPE_DHCP & proto_type)
-            hdd_dhcp_pkt_trace_buf_update(skb, RX_PATH, STA);
+         switch (proto_type) {
+         case VOS_PKT_TRAC_TYPE_EAPOL:
+             vos_pkt_trace_buf_update("ST:R:EPL");
+             break;
+         case VOS_PKT_TRAC_TYPE_DHCP:
+             hdd_dhcp_pkt_trace_buf_update(skb, RX_PATH, STA);
+             break;
+         case VOS_PKT_TRAC_TYPE_ARP:
+             vos_pkt_trace_buf_update("ST:R:ARP");
+             break;
+         case VOS_PKT_TRAC_TYPE_NS:
+             vos_pkt_trace_buf_update("ST:R:NS");
+             break;
+         case VOS_PKT_TRAC_TYPE_NA:
+             vos_pkt_trace_buf_update("ST:R:NA");
+             break;
+         default:
+             break;
+         }
       }
 #endif /* QCA_PKT_PROTO_TRACE */
 
@@ -1285,8 +1498,7 @@ VOS_STATUS hdd_rx_packet_cbk(v_VOID_t *vosContext,
          ++pAdapter->hdd_stats.hddTxRxStats.rxDropped[cpu_index];
          VOS_TRACE(VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_INFO,
                    "%s: Dropping multicast to self NA", __func__);
-         kfree_skb(skb);
-
+         adf_nbuf_free(skb);
          skb = skb_next;
          continue;
       }
@@ -1295,6 +1507,23 @@ VOS_STATUS hdd_rx_packet_cbk(v_VOID_t *vosContext,
       ++pAdapter->stats.rx_packets;
       pAdapter->stats.rx_bytes += skb->len;
 
+      /**
+       * Remove SKB from internal tracking table before submitting it
+       * to stack.
+       */
+      adf_net_buf_debug_release_skb(skb);
+
+      if (!wake_lock) {
+         if (skb->protocol == htons(ETH_P_ARP)) {
+            if (hdd_is_arp_local(skb))
+               wake_lock = true;
+         }
+         else
+            wake_lock = true;
+      }
+
+      hdd_tsf_timestamp_rx(pHddCtx, skb, ktime_to_us(skb->tstamp));
+
       /*
        * If this is not a last packet on the chain
        * Just put packet into backlog queue, not scheduling RX sirq
@@ -1302,16 +1531,20 @@ VOS_STATUS hdd_rx_packet_cbk(v_VOID_t *vosContext,
       if (skb->next) {
          rxstat = netif_rx(skb);
       } else {
-#ifdef WLAN_FEATURE_HOLD_RX_WAKELOCK
-         vos_wake_lock_timeout_acquire(&pHddCtx->rx_wake_lock,
-                                       HDD_WAKE_LOCK_DURATION,
-                                       WIFI_POWER_EVENT_WAKELOCK_HOLD_RX);
-#endif
-         /*
-          * This is the last packet on the chain
-          * Scheduling rx sirq
-          */
-         rxstat = netif_rx_ni(skb);
+          if ((pHddCtx->cfg_ini->rx_wakelock_timeout) &&
+              (PACKET_BROADCAST != skb->pkt_type) &&
+              (PACKET_MULTICAST != skb->pkt_type))
+                wake_lock = true;
+
+          if (wake_lock && pHddStaCtx->conn_info.uIsAuthenticated)
+             vos_wake_lock_timeout_acquire(&pHddCtx->rx_wake_lock,
+                            pHddCtx->cfg_ini->rx_wakelock_timeout,
+                            WIFI_POWER_EVENT_WAKELOCK_HOLD_RX);
+          /*
+           * This is the last packet on the chain
+           * Scheduling rx sirq
+           */
+          rxstat = netif_rx_ni(skb);
       }
 
       if (NET_RX_SUCCESS == rxstat)
@@ -1467,6 +1700,7 @@ void wlan_hdd_netif_queue_control(hdd_adapter_t *adapter,
 		hddLog(LOGE, FL("adapter is invalid"));
 		return;
 	}
+	hddLog(LOG1, FL("action is %d reason is %d"),action,reason);
 
 	switch (action) {
 	case WLAN_NETIF_CARRIER_ON:
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c
index bb1c38ffef3..49708b9937e 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -243,6 +243,8 @@ static const hdd_freq_chan_map_t freq_chan_map[] = { {2412, 1}, {2417, 2},
 #define WE_CLEAR_STATS                        86
 #define WE_SET_CHANNEL                        87
 
+#define WE_SET_MODULATED_DTIM                 88
+
 
 /* Private ioctls and their sub-ioctls */
 #define WLAN_PRIV_SET_NONE_GET_INT    (SIOCIWFIRSTPRIV + 1)
@@ -412,7 +414,8 @@ static const hdd_freq_chan_map_t freq_chan_map[] = { {2412, 1}, {2417, 2},
 #define WE_GET_TSF      1
 
 /* (SIOCIWFIRSTPRIV + 17) is currently unused */
-/* (SIOCIWFIRSTPRIV + 19) is currently unused */
+
+#define WLAN_GET_ISOLATION                (SIOCIWFIRSTPRIV + 19)
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
 #define WLAN_PRIV_SET_FTIES             (SIOCIWFIRSTPRIV + 20)
@@ -668,7 +671,11 @@ int hdd_priv_get_data(struct iw_point *p_priv_data,
    }
 
 #ifdef CONFIG_COMPAT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,6,0)) && defined(CONFIG_X86_64)
+   if (in_compat_syscall()) {
+#else
    if (is_compat_task()) {
+#endif
       struct compat_iw_point *p_compat_priv_data;
 
       /* Compat task: typecast to compat structure and copy the members. */
@@ -690,6 +697,48 @@ int hdd_priv_get_data(struct iw_point *p_priv_data,
    return 0;
 }
 
+#define WLAN_HDD_MAX_BW_VALUE	5
+
+/**
+ * wlan_hdd_validate_mon_channel() - check channel number is valid or not
+ * @channel: channel number
+ *
+ * @return: VOS_STATUS
+ */
+VOS_STATUS wlan_hdd_validate_mon_channel(int channel)
+{
+        uint8_t fValidChannel = FALSE, count = 0;
+
+        for (count = RF_CHAN_1; count <= RF_CHAN_165; count++)
+        {
+            if ( channel == rfChannels[count].channelNum )
+            {
+                fValidChannel = TRUE;
+                break;
+            }
+        }
+        if (fValidChannel != TRUE)
+        {
+            hddLog(VOS_TRACE_LEVEL_ERROR,
+                "%s: Invalid Channel [%d]", __func__, channel);
+            return VOS_STATUS_E_FAILURE;
+        }
+        return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * wlan_hdd_validate_mon_bw() - check bandwidth value is valid or not
+ * @bw: bandwidth value
+ *
+ * @return: VOS_STATUS
+ */
+VOS_STATUS wlan_hdd_validate_mon_bw(int bw)
+{
+        if (bw >= 0 && bw <= WLAN_HDD_MAX_BW_VALUE)
+            return VOS_STATUS_SUCCESS;
+
+        return VOS_STATUS_E_FAILURE;
+}
 
 /**---------------------------------------------------------------------------
 
@@ -1171,14 +1220,14 @@ static void hdd_GetRssiCB( v_S7_t rssi, tANI_U32 staId, void *pContext )
 
    if (ioctl_debug)
    {
-      pr_info("%s: rssi [%d] STA [%d] pContext [%p]\n",
+      pr_info("%s: rssi [%d] STA [%d] pContext [%pK]\n",
               __func__, (int)rssi, (int)staId, pContext);
    }
 
    if (NULL == pContext)
    {
       hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Bad param, pContext [%p]",
+             "%s: Bad param, pContext [%pK]",
              __func__, pContext);
       return;
    }
@@ -1192,16 +1241,16 @@ static void hdd_GetRssiCB( v_S7_t rssi, tANI_U32 staId, void *pContext )
       serialize these actions */
    spin_lock(&hdd_context_lock);
 
-   if ((NULL == pAdapter) || (RSSI_CONTEXT_MAGIC != pStatsContext->magic))
+   if ((NULL == pAdapter) || (PEER_INFO_CONTEXT_MAGIC != pStatsContext->magic))
    {
       /* the caller presumably timed out so there is nothing we can do */
       spin_unlock(&hdd_context_lock);
       hddLog(VOS_TRACE_LEVEL_WARN,
-             "%s: Invalid context, pAdapter [%p] magic [%08x]",
+             "%s: Invalid context, pAdapter [%pK] magic [%08x]",
               __func__, pAdapter, pStatsContext->magic);
       if (ioctl_debug)
       {
-         pr_info("%s: Invalid context, pAdapter [%p] magic [%08x]\n",
+         pr_info("%s: Invalid context, pAdapter [%pK] magic [%08x]\n",
                  __func__, pAdapter, pStatsContext->magic);
       }
       return;
@@ -1231,14 +1280,14 @@ static void hdd_GetSnrCB(tANI_S8 snr, tANI_U32 staId, void *pContext)
 
    if (ioctl_debug)
    {
-      pr_info("%s: snr [%d] STA [%d] pContext [%p]\n",
+      pr_info("%s: snr [%d] STA [%d] pContext [%pK]\n",
               __func__, (int)snr, (int)staId, pContext);
    }
 
    if (NULL == pContext)
    {
       hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Bad param, pContext [%p]",
+             "%s: Bad param, pContext [%pK]",
              __func__, pContext);
       return;
    }
@@ -1257,11 +1306,11 @@ static void hdd_GetSnrCB(tANI_S8 snr, tANI_U32 staId, void *pContext)
       /* the caller presumably timed out so there is nothing we can do */
       spin_unlock(&hdd_context_lock);
       hddLog(VOS_TRACE_LEVEL_WARN,
-             "%s: Invalid context, pAdapter [%p] magic [%08x]",
+             "%s: Invalid context, pAdapter [%pK] magic [%08x]",
               __func__, pAdapter, pStatsContext->magic);
       if (ioctl_debug)
       {
-         pr_info("%s: Invalid context, pAdapter [%p] magic [%08x]\n",
+         pr_info("%s: Invalid context, pAdapter [%pK] magic [%08x]\n",
                  __func__, pAdapter, pStatsContext->magic);
       }
       return;
@@ -1324,7 +1373,7 @@ VOS_STATUS wlan_hdd_get_rssi(hdd_adapter_t *pAdapter, v_S7_t *rssi_value)
 
    init_completion(&context.completion);
    context.pAdapter = pAdapter;
-   context.magic = RSSI_CONTEXT_MAGIC;
+   context.magic = PEER_INFO_CONTEXT_MAGIC;
 
    hstatus = sme_GetRssi(pHddCtx->hHal, hdd_GetRssiCB,
                          pHddStaCtx->conn_info.staId[ 0 ],
@@ -1364,6 +1413,7 @@ VOS_STATUS wlan_hdd_get_rssi(hdd_adapter_t *pAdapter, v_S7_t *rssi_value)
    spin_unlock(&hdd_context_lock);
 
    *rssi_value = pAdapter->rssi;
+   hddLog(LOG1, FL("RSSI = %d"), *rssi_value);
 
    return VOS_STATUS_SUCCESS;
 }
@@ -1577,6 +1627,8 @@ void hdd_clearRoamProfileIe( hdd_adapter_t *pAdapter)
    pWextState->roamProfile.AuthType.numEntries = 1;
    pWextState->roamProfile.AuthType.authType[0] = eCSR_AUTH_TYPE_OPEN_SYSTEM;
 
+   vos_mem_zero((pWextState->roamProfile.bssid_hint), VOS_MAC_ADDR_SIZE);
+
 #ifdef WLAN_FEATURE_11W
    pWextState->roamProfile.MFPEnabled = eANI_BOOLEAN_FALSE;
    pWextState->roamProfile.MFPRequired = 0;
@@ -1673,7 +1725,7 @@ v_U8_t* wlan_hdd_get_vendor_oui_ie_ptr(v_U8_t *oui, v_U8_t oui_size, v_U8_t *ie,
                     eid,elem_len,left);
             return NULL;
         }
-        if (elem_id == eid)
+        if ((elem_id == eid) && (elem_len >= oui_size))
         {
             if(memcmp( &ptr[2], oui, oui_size)==0)
                 return ptr;
@@ -2755,6 +2807,13 @@ static int __iw_set_genie(struct net_device *dev, struct iw_request_info *info,
         hddLog(VOS_TRACE_LEVEL_INFO, "%s: IE[0x%X], LEN[%d]",
             __func__, elementId, eLen);
 
+        if (remLen < eLen) {
+            hddLog(LOGE, "Remaining len: %u less than ie len: %u",
+                   remLen, eLen);
+            ret = -EINVAL;
+            goto exit;
+        }
+
         switch ( elementId )
          {
             case IE_EID_VENDOR:
@@ -2837,8 +2896,11 @@ static int __iw_set_genie(struct net_device *dev, struct iw_request_info *info,
                 hddLog (LOGE, "%s Set UNKNOWN IE %X",__func__, elementId);
                 goto exit;
     }
-        genie += eLen;
         remLen -= eLen;
+
+        /* Move genie only if next element is present */
+        if (remLen >= 2)
+            genie += eLen;
     }
 exit:
     EXIT();
@@ -3561,6 +3623,62 @@ static int iw_get_range(struct net_device *dev, struct iw_request_info *info,
 	return ret;
 }
 
+/**
+ * iw_power_offload_callback_fn() - Callback function registered with PMC to
+ * know status of PMC request
+ *
+ * @context: pointer to calling context
+ * @session_id: session_id
+ * @status: eHAL_STATUS_SUCCESS if success else eHalStatus error code
+ *
+ * Return:
+ */
+static void iw_power_offload_callback_fn(void *context, tANI_U32 session_id,
+					  eHalStatus status)
+{
+	struct statsContext *stats_context;
+
+	if (NULL == context) {
+		hddLog(VOS_TRACE_LEVEL_ERROR,
+			FL("Bad param, context [%pK]"),
+			context);
+		return;
+	}
+
+	stats_context = (struct statsContext *)context;
+
+	/*
+	 * there is a race condition that exists between this callback
+	 * function and the caller since the caller could time out either
+	 * before or while this code is executing.  we use a spinlock to
+	 * serialize these actions
+	 */
+	spin_lock(&hdd_context_lock);
+
+	if (POWER_CONTEXT_MAGIC != stats_context->magic) {
+		/* the caller presumably timed out */
+		spin_unlock(&hdd_context_lock);
+		hddLog(VOS_TRACE_LEVEL_WARN,
+			FL("Invalid context, magic [%08x]"),
+			stats_context->magic);
+
+		if (ioctl_debug)
+			pr_info("%s: Invalid context, magic [%08x]\n",
+				__func__, stats_context->magic);
+		return;
+	}
+	/* context is valid so caller is still waiting */
+
+	/* paranoia: invalidate the magic */
+	stats_context->magic = 0;
+
+	/* notify the caller */
+	complete(&stats_context->completion);
+
+	/* serialization is complete */
+	spin_unlock(&hdd_context_lock);
+}
+
 /* Callback function registered with PMC to know status of PMC request */
 static void iw_power_callback_fn (void *pContext, eHalStatus status)
 {
@@ -3569,7 +3687,7 @@ static void iw_power_callback_fn (void *pContext, eHalStatus status)
    if (NULL == pContext)
    {
        hddLog(VOS_TRACE_LEVEL_ERROR,
-            "%s: Bad param, pContext [%p]",
+            "%s: Bad param, pContext [%pK]",
               __func__, pContext);
        return;
    }
@@ -3635,14 +3753,14 @@ void hdd_GetClassA_statisticsCB(void *pStats, void *pContext)
 
    if (ioctl_debug)
    {
-      pr_info("%s: pStats [%p] pContext [%p]\n",
+      pr_info("%s: pStats [%pK] pContext [%pK]\n",
               __func__, pStats, pContext);
    }
 
    if ((NULL == pStats) || (NULL == pContext))
    {
       hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Bad param, pStats [%p] pContext [%p]",
+             "%s: Bad param, pStats [%pK] pContext [%pK]",
               __func__, pStats, pContext);
       return;
    }
@@ -3662,11 +3780,11 @@ void hdd_GetClassA_statisticsCB(void *pStats, void *pContext)
       /* the caller presumably timed out so there is nothing we can do */
       spin_unlock(&hdd_context_lock);
       hddLog(VOS_TRACE_LEVEL_WARN,
-             "%s: Invalid context, pAdapter [%p] magic [%08x]",
+             "%s: Invalid context, pAdapter [%pK] magic [%08x]",
               __func__, pAdapter, pStatsContext->magic);
       if (ioctl_debug)
       {
-         pr_info("%s: Invalid context, pAdapter [%p] magic [%08x]\n",
+         pr_info("%s: Invalid context, pAdapter [%pK] magic [%08x]\n",
                  __func__, pAdapter, pStatsContext->magic);
       }
       return;
@@ -3695,7 +3813,7 @@ void hdd_GetLink_SpeedCB(tSirLinkSpeedInfo *pLinkSpeed, void *pContext)
    if ((NULL == pLinkSpeed) || (NULL == pContext))
    {
       hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Bad param, pLinkSpeed [%p] pContext [%p]",
+             "%s: Bad param, pLinkSpeed [%pK] pContext [%pK]",
              __func__, pLinkSpeed, pContext);
       return;
    }
@@ -3713,11 +3831,11 @@ void hdd_GetLink_SpeedCB(tSirLinkSpeedInfo *pLinkSpeed, void *pContext)
        /* the caller presumably timed out so there is nothing we can do */
       spin_unlock(&hdd_context_lock);
       hddLog(VOS_TRACE_LEVEL_WARN,
-             "%s: Invalid context, pAdapter [%p] magic [%08x]",
+             "%s: Invalid context, pAdapter [%pK] magic [%08x]",
               __func__, pAdapter, pLinkSpeedContext->magic);
       if (ioctl_debug)
       {
-         pr_info("%s: Invalid context, pAdapter [%p] magic [%08x]\n",
+         pr_info("%s: Invalid context, pAdapter [%pK] magic [%08x]\n",
                  __func__, pAdapter, pLinkSpeedContext->magic);
       }
       return;
@@ -3817,14 +3935,14 @@ static void hdd_get_station_statisticsCB(void *pStats, void *pContext)
 
    if (ioctl_debug)
    {
-      pr_info("%s: pStats [%p] pContext [%p]\n",
+      pr_info("%s: pStats [%pK] pContext [%pK]\n",
               __func__, pStats, pContext);
    }
 
    if ((NULL == pStats) || (NULL == pContext))
    {
       hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Bad param, pStats [%p] pContext [%p]",
+             "%s: Bad param, pStats [%pK] pContext [%pK]",
              __func__, pStats, pContext);
       return;
    }
@@ -3846,11 +3964,11 @@ static void hdd_get_station_statisticsCB(void *pStats, void *pContext)
       /* the caller presumably timed out so there is nothing we can do */
       spin_unlock(&hdd_context_lock);
       hddLog(VOS_TRACE_LEVEL_WARN,
-             "%s: Invalid context, pAdapter [%p] magic [%08x]",
+             "%s: Invalid context, pAdapter [%pK] magic [%08x]",
              __func__, pAdapter, pStatsContext->magic);
       if (ioctl_debug)
       {
-         pr_info("%s: Invalid context, pAdapter [%p] magic [%08x]\n",
+         pr_info("%s: Invalid context, pAdapter [%pK] magic [%08x]\n",
                  __func__, pAdapter, pStatsContext->magic);
       }
       return;
@@ -4019,67 +4137,165 @@ static int iw_get_linkspeed_priv(struct net_device *dev,
 	return ret;
 }
 
-/*
- * Support for the RSSI & RSSI-APPROX private commands
- * Per the WiFi framework the response must be of the form
- *         "<ssid> rssi <xx>"
- * unless we are not associated, in which case the response is
- *         "OK"
- */
-static int iw_get_rssi(struct net_device *dev,
-                       struct iw_request_info *info,
-                       union iwreq_data *wrqu, char *extra)
+void hdd_get_isolation_cb(struct sir_isolation_resp *isolation,
+        void *context)
 {
-   hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
-   char *cmd = extra;
-   int len = wrqu->data.length;
-   v_S7_t s7Rssi = 0;
-   hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-   int ssidlen = pHddStaCtx->conn_info.SSID.SSID.length;
-   VOS_STATUS vosStatus;
-   int rc;
+    struct statsContext *isolation_context;
+    int buf = 0;
+    int length = 0;
+    char *isolation_output;
+    union iwreq_data *wrqu;
 
-   if ((eConnectionState_Associated != pHddStaCtx->conn_info.connState) ||
-       (0 == ssidlen) || (ssidlen >= len))
-   {
-      /* we are not connected or our SSID is too long
-         so we cannot report an rssi */
-      rc = scnprintf(cmd, len, "OK");
-   }
-   else
-   {
-      /* we are connected with a valid SSID
-         so we can write the SSID into the return buffer
-         (note that it is not NUL-terminated) */
-      memcpy(cmd, pHddStaCtx->conn_info.SSID.SSID.ssId, ssidlen );
+    if ((NULL == isolation) || (NULL == context)) {
 
-      vosStatus = wlan_hdd_get_rssi(pAdapter, &s7Rssi);
+        hddLog(VOS_TRACE_LEVEL_ERROR,
+                "%s: Bad param, %s",
+                __func__,
+				isolation ? "context is NULL" : "isolation is NULL");
+        return;
+    }
 
-      if (VOS_STATUS_SUCCESS == vosStatus)
-      {
-          /* append the rssi to the ssid in the format required by
-             the WiFI Framework */
-          rc = scnprintf(&cmd[ssidlen], len - ssidlen, " rssi %d", s7Rssi);
-          rc += ssidlen;
-      }
-      else
-      {
-          rc = -1;
-      }
-   }
+    spin_lock(&hdd_context_lock);
 
-   /* verify that we wrote a valid response */
-   if ((rc < 0) || (rc >= len))
-   {
-      // encoding or length error?
-      hddLog(VOS_TRACE_LEVEL_ERROR,
-             "%s: Unable to encode RSSI, got [%s]",
-             __func__, cmd);
-      return -EIO;
-   }
+    isolation_context = context;
+    if (ISOLATION_CONTEXT_MAGIC !=
+            isolation_context->magic) {
+
+        /*
+         * the caller presumably timed out so there is nothing
+         * we can do
+         */
+        spin_unlock(&hdd_context_lock);
+        hddLog(VOS_TRACE_LEVEL_WARN,
+                "%s: Invalid context, magic [%08x]",
+                __func__,
+                isolation_context->magic);
+        return;
+    }
+
+    isolation_output = isolation_context->extra;
+    wrqu = isolation_context->wrqu;
+    isolation_context->magic = 0;
+
+    hddLog(LOG1, "%s: chain1 %d chain2 %d chain3 %d chain4 %d", __func__,
+            isolation->isolation_chain0, isolation->isolation_chain1,
+            isolation->isolation_chain2, isolation->isolation_chain3);
+
+    length = scnprintf((isolation_output), WE_MAX_STR_LEN, "\n");
+    buf = scnprintf
+        (
+         (isolation_output + length), WE_MAX_STR_LEN - length,
+         "isolation chain 0 : %d\n",
+         isolation->isolation_chain0
+        );
+    length += buf;
+    buf = scnprintf
+        (
+         (isolation_output + length), WE_MAX_STR_LEN - length,
+         "isolation chain 1 : %d\n",
+         isolation->isolation_chain1
+        );
+    length += buf;
+    buf = scnprintf
+        (
+         (isolation_output + length), WE_MAX_STR_LEN - length,
+         "isolation chain 2 : %d\n",
+         isolation->isolation_chain2
+        );
+    length += buf;
+    buf = scnprintf
+        (
+         (isolation_output + length), WE_MAX_STR_LEN - length,
+         "isolation chain 3 : %d\n",
+         isolation->isolation_chain3
+        );
+    length += buf;
+
+    wrqu->data.length = length + 1;
+
+    /* notify the caller */
+    complete(&isolation_context->completion);
+
+    /* serialization is complete */
+    spin_unlock(&hdd_context_lock);
+}
+
+static int wlan_hdd_get_isolation(hdd_adapter_t *adapter,
+        union iwreq_data *wrqu, char *extra)
+{
+    eHalStatus hstatus;
+    int ret;
+    struct statsContext context;
+
+    if (NULL == adapter) {
+        hddLog(VOS_TRACE_LEVEL_ERROR, "%s: pAdapter is NULL",
+                __func__);
+        return -EINVAL;
+    }
+
+    init_completion(&context.completion);
+    context.magic = ISOLATION_CONTEXT_MAGIC;
+    context.extra = extra;
+    context.wrqu = wrqu;
+
+    hstatus = sme_get_isolation(WLAN_HDD_GET_HAL_CTX(adapter),
+            &context,
+            hdd_get_isolation_cb);
+    if (eHAL_STATUS_SUCCESS != hstatus) {
+        hddLog(VOS_TRACE_LEVEL_ERROR,
+                "%s: Unable to retrieve isolation",
+                __func__);
+        ret = -EFAULT;
+    } else {
+        if (!wait_for_completion_timeout(&context.completion,
+                    msecs_to_jiffies(8000))) {
+            hddLog(VOS_TRACE_LEVEL_ERROR,
+                    "%s: SME timed out while retrieving isolation",
+                    __func__);
+            ret = -ETIMEDOUT;
+        } else
+            ret = 0;
+    }
+
+    spin_lock(&hdd_context_lock);
+    context.magic = 0;
+    spin_unlock(&hdd_context_lock);
+    return ret;
+}
+
+static int __iw_get_isolation(struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu, char *extra)
+{
+    hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    hdd_context_t *hdd_ctx;
+    int ret;
 
-   /* a value is being successfully returned */
-   return rc;
+    hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+    ret = wlan_hdd_validate_context(hdd_ctx);
+    if (0 != ret)
+        return ret;
+
+    ret = wlan_hdd_get_isolation(adapter, wrqu, extra);
+
+    if (ret < 0)
+        return ret;
+
+    /* a value is being successfully returned */
+    return 0;
+}
+
+static int iw_get_isolation(struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu, char *extra)
+{
+    int ret;
+
+    vos_ssr_protect(__func__);
+    ret = __iw_get_isolation(dev, info, wrqu, extra);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
 }
 
 VOS_STATUS  wlan_hdd_enter_bmps(hdd_adapter_t *pAdapter, int mode)
@@ -4184,6 +4400,8 @@ VOS_STATUS  wlan_hdd_enter_bmps(hdd_adapter_t *pAdapter, int mode)
 VOS_STATUS  wlan_hdd_set_powersave(hdd_adapter_t *pAdapter, int mode)
 {
    hdd_context_t *pHddCtx;
+   eHalStatus status;
+   struct statsContext context;
 
    if (NULL == pAdapter)
    {
@@ -4195,6 +4413,11 @@ VOS_STATUS  wlan_hdd_set_powersave(hdd_adapter_t *pAdapter, int mode)
 
    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
 
+   init_completion(&context.completion);
+
+   context.pAdapter = pAdapter;
+   context.magic = POWER_CONTEXT_MAGIC;
+
    if (DRIVER_POWER_MODE_ACTIVE == mode)
    {
        hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "%s:Wlan driver Entering "
@@ -4204,8 +4427,21 @@ VOS_STATUS  wlan_hdd_set_powersave(hdd_adapter_t *pAdapter, int mode)
         * Enter Full power command received from GUI
         * this means we are disconnected
         */
-       sme_PsOffloadDisablePowerSave(WLAN_HDD_GET_HAL_CTX(pAdapter),
+       status = sme_PsOffloadDisablePowerSave(WLAN_HDD_GET_HAL_CTX(pAdapter),
+                                     iw_power_offload_callback_fn, &context,
                                      pAdapter->sessionId);
+       if (eHAL_STATUS_PMC_PENDING == status) {
+           unsigned long rc;
+           /* request was sent -- wait for the response */
+           rc = wait_for_completion_timeout(
+                   &context.completion,
+                   msecs_to_jiffies(WLAN_WAIT_TIME_POWER));
+
+           if (!rc) {
+               hddLog(VOS_TRACE_LEVEL_ERROR,
+                  FL("SME timed out while disabling power save"));
+           }
+       }
        if (pHddCtx->cfg_ini->fIsBmpsEnabled)
           sme_ConfigDisablePowerSave(pHddCtx->hHal,
                              ePMC_BEACON_MODE_POWER_SAVE);
@@ -4232,6 +4468,9 @@ VOS_STATUS  wlan_hdd_set_powersave(hdd_adapter_t *pAdapter, int mode)
                    "enabled in the cfg");
        }
    }
+   spin_lock(&hdd_context_lock);
+   context.magic = 0;
+   spin_unlock(&hdd_context_lock);
    return VOS_STATUS_SUCCESS;
 }
 
@@ -4319,377 +4558,6 @@ void* wlan_hdd_change_country_code_callback(void *pAdapter)
 }
 
 /**
- * __iw_set_priv() - SIOCSIWPRIV ioctl handler
- * @dev: device upon which the ioctl was received
- * @info: ioctl request information
- * @wrqu: ioctl request data
- * @extra: ioctl extra data
- *
- * Return: 0 on success, non-zero on error
- */
-static int __iw_set_priv(struct net_device *dev, struct iw_request_info *info,
-			 union iwreq_data *wrqu, char *extra)
-{
-    hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
-    char *cmd = NULL;
-    int cmd_len = wrqu->data.length;
-    int ret = 0;
-    int rc = 0;
-    VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
-
-    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-
-    ENTER();
-    cmd = mem_alloc_copy_from_user_helper(wrqu->data.pointer,
-                                          wrqu->data.length);
-    if (NULL == cmd)
-    {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  "mem_alloc_copy_from_user_helper fail");
-        return -ENOMEM;
-    }
-
-    if (ioctl_debug)
-    {
-       pr_info("%s: req [%s] len [%d]\n", __func__, cmd, cmd_len);
-    }
-
-    hddLog(VOS_TRACE_LEVEL_INFO_MED,
-           "%s: ***Received %s cmd from Wi-Fi GUI***", __func__, cmd);
-
-    if (pHddCtx->isLogpInProgress) {
-        if (ioctl_debug)
-        {
-            pr_info("%s: RESTART in progress\n", __func__);
-        }
-
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
-                 "%s:LOGP in Progress. Ignore!!!",__func__);
-        vos_mem_free(cmd);
-        return -EBUSY;
-    }
-
-    if (strncmp(cmd, "CSCAN", 5) == 0 )
-    {
-       if (eHAL_STATUS_SUCCESS != iw_set_cscan(dev, info, wrqu, cmd)) {
-           VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                     "%s: Error in iw_set_scan!", __func__);
-          rc = -EINVAL;
-       }
-    }
-    else if( strcasecmp(cmd, "start") == 0 ) {
-
-        hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "Start command");
-        /*Exit from Deep sleep or standby if we get the driver START cmd from android GUI*/
-
-        vos_status = wlan_hdd_exit_lowpower(pHddCtx, pAdapter);
-        if (vos_status == VOS_STATUS_SUCCESS)
-        {
-            union iwreq_data wrqu;
-            char buf[10];
-
-            memset(&wrqu, 0, sizeof(wrqu));
-            wrqu.data.length = strlcpy(buf, "START", sizeof(buf));
-            wireless_send_event(pAdapter->dev, IWEVCUSTOM, &wrqu, buf);
-        }
-        else
-        {
-            hddLog(VOS_TRACE_LEVEL_ERROR, "%s: START CMD Status %d", __func__, vos_status);
-            rc = -EIO;
-        }
-        goto done;
-    }
-    else if( strcasecmp(cmd, "stop") == 0 )
-    {
-        union iwreq_data wrqu;
-        char buf[10];
-
-        hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "Stop command");
-
-        wlan_hdd_enter_lowpower(pHddCtx);
-        memset(&wrqu, 0, sizeof(wrqu));
-        wrqu.data.length = strlcpy(buf, "STOP", sizeof(buf));
-        wireless_send_event(pAdapter->dev, IWEVCUSTOM, &wrqu, buf);
-        goto done;
-    }
-    else if (strcasecmp(cmd, "macaddr") == 0)
-    {
-        ret = snprintf(cmd, cmd_len, "Macaddr = " MAC_ADDRESS_STR,
-                       MAC_ADDR_ARRAY(pAdapter->macAddressCurrent.bytes));
-    }
-    else if (strcasecmp(cmd, "scan-active") == 0)
-    {
-        hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-        hddLog(LOG1, FL("making default scan to active"));
-        pHddCtx->ioctl_scan_mode = eSIR_ACTIVE_SCAN;
-        ret = snprintf(cmd, cmd_len, "OK");
-    }
-    else if (strcasecmp(cmd, "scan-passive") == 0)
-    {
-        hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-        hddLog(LOG1, FL("making default scan to active"));
-        pHddCtx->ioctl_scan_mode = eSIR_PASSIVE_SCAN;
-        ret = snprintf(cmd, cmd_len, "OK");
-    }
-    else if( strcasecmp(cmd, "scan-mode") == 0 )
-    {
-        ret = snprintf(cmd, cmd_len, "ScanMode = %u", pAdapter->scan_info.scan_mode);
-    }
-    else if( strcasecmp(cmd, "linkspeed") == 0 )
-    {
-        ret = iw_get_linkspeed(dev, info, wrqu, cmd);
-    }
-    else if( strncasecmp(cmd, "COUNTRY", 7) == 0 ) {
-        char *country_code;
-        unsigned long rc;
-        eHalStatus eHal_status;
-
-        country_code =  cmd + 8;
-
-        init_completion(&pAdapter->change_country_code);
-
-        eHal_status = sme_ChangeCountryCode(pHddCtx->hHal,
-                                            (void *)(tSmeChangeCountryCallback)wlan_hdd_change_country_code_callback,
-                                            country_code,
-                                            pAdapter,
-                                            pHddCtx->pvosContext,
-                                            eSIR_TRUE,
-                                            eSIR_TRUE);
-
-        /* Wait for completion */
-        rc = wait_for_completion_timeout(&pAdapter->change_country_code,
-                                  msecs_to_jiffies(WLAN_WAIT_TIME_STATS));
-
-        if (!rc) {
-            hddLog(VOS_TRACE_LEVEL_ERROR,
-               FL("SME timedout while setting country code"));
-        }
-
-        if (eHAL_STATUS_SUCCESS != eHal_status)
-        {
-            VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                       "%s: SME Change Country code fail", __func__);
-            vos_mem_free(cmd);
-            return -EIO;
-        }
-    }
-    else if( strncasecmp(cmd, "rssi", 4) == 0 )
-    {
-        ret = iw_get_rssi(dev, info, wrqu, cmd);
-    }
-    else if( strncasecmp(cmd, "powermode", 9) == 0 ) {
-        int mode;
-        char *ptr;
-
-        if (9 < cmd_len)
-        {
-            ptr = (char*)(cmd + 9);
-
-        }else{
-              VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                        "CMD LENGTH %d is not correct",cmd_len);
-              vos_mem_free(cmd);
-              return -EINVAL;
-        }
-
-        if (1 != sscanf(ptr,"%d",&mode))
-        {
-            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                      "powermode input %s is not correct",ptr);
-            vos_mem_free(cmd);
-            return -EIO;
-        }
-
-        if(!pHddCtx->cfg_ini->enablePowersaveOffload)
-            wlan_hdd_enter_bmps(pAdapter, mode);
-        else
-            wlan_hdd_set_powersave(pAdapter, mode);
-    }
-    else if (strncasecmp(cmd, "getpower", 8) == 0 ) {
-        v_U32_t pmc_state;
-        v_U16_t value;
-
-        pmc_state = pmcGetPmcState(WLAN_HDD_GET_HAL_CTX(pAdapter));
-        if(pmc_state == BMPS) {
-           value = DRIVER_POWER_MODE_AUTO;
-        }
-        else {
-           value = DRIVER_POWER_MODE_ACTIVE;
-        }
-        ret = snprintf(cmd, cmd_len, "powermode = %u", value);
-    }
-    else if( strncasecmp(cmd, "btcoexmode", 10) == 0 ) {
-        hddLog( VOS_TRACE_LEVEL_INFO, "btcoexmode");
-        /*TODO: set the btcoexmode*/
-    }
-    else if( strcasecmp(cmd, "btcoexstat") == 0 ) {
-
-        hddLog(VOS_TRACE_LEVEL_INFO, "BtCoex Status");
-        /*TODO: Return the btcoex status*/
-    }
-    else if( strcasecmp(cmd, "rxfilter-start") == 0 ) {
-
-        hddLog(VOS_TRACE_LEVEL_INFO, "Rx Data Filter Start command");
-
-        /*TODO: Enable Rx data Filter*/
-    }
-    else if( strcasecmp(cmd, "rxfilter-stop") == 0 ) {
-
-        hddLog(VOS_TRACE_LEVEL_INFO, "Rx Data Filter Stop command");
-
-        /*TODO: Disable Rx data Filter*/
-    }
-    else if( strcasecmp(cmd, "rxfilter-statistics") == 0 ) {
-
-        hddLog( VOS_TRACE_LEVEL_INFO, "Rx Data Filter Statistics command");
-        /*TODO: rxfilter-statistics*/
-    }
-    else if( strncasecmp(cmd, "rxfilter-add", 12) == 0 ) {
-
-        hddLog( VOS_TRACE_LEVEL_INFO, "rxfilter-add");
-        /*TODO: rxfilter-add*/
-    }
-    else if( strncasecmp(cmd, "rxfilter-remove",15) == 0 ) {
-
-        hddLog( VOS_TRACE_LEVEL_INFO, "rxfilter-remove");
-        /*TODO: rxfilter-remove*/
-    }
-#ifdef FEATURE_WLAN_SCAN_PNO
-    else if( strncasecmp(cmd, "pnosetup", 8) == 0 ) {
-        hddLog( VOS_TRACE_LEVEL_INFO, "pnosetup");
-        /*TODO: support pnosetup*/
-    }
-    else if( strncasecmp(cmd, "pnoforce", 8) == 0 ) {
-        hddLog( VOS_TRACE_LEVEL_INFO, "pnoforce");
-        /*TODO: support pnoforce*/
-    }
-    else if( strncasecmp(cmd, "pno",3) == 0 ) {
-
-        hddLog( VOS_TRACE_LEVEL_INFO, "pno");
-        ret = iw_set_pno(dev, info, wrqu, cmd, 3);
-        vos_mem_free(cmd);
-        return ret;
-    }
-#endif /*FEATURE_WLAN_SCAN_PNO*/
-    else if( strncasecmp(cmd, "powerparams",11) == 0 ) {
-      hddLog( VOS_TRACE_LEVEL_INFO, "powerparams");
-      vos_status = iw_set_power_params(dev, info, wrqu, cmd, 11);
-      vos_mem_free(cmd);
-      return (vos_status == VOS_STATUS_SUCCESS) ? 0 : -EINVAL;
-    }
-    else if( 0 == strncasecmp(cmd, "CONFIG-TX-TRACKING", 18) ) {
-        tSirTxPerTrackingParam tTxPerTrackingParam;
-        char *ptr;
-
-        if (18 < cmd_len)
-        {
-           ptr = (char*)(cmd + 18);
-        }else{
-               VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                         "CMD LENGTH %d is not correct",cmd_len);
-               vos_mem_free(cmd);
-               return -EINVAL;
-        }
-
-        if (4 != sscanf(ptr,"%hhu %hhu %hhu %u",
-                        &(tTxPerTrackingParam.ucTxPerTrackingEnable),
-                        &(tTxPerTrackingParam.ucTxPerTrackingPeriod),
-                        &(tTxPerTrackingParam.ucTxPerTrackingRatio),
-                        &(tTxPerTrackingParam.uTxPerTrackingWatermark)))
-        {
-            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                      "CONFIG-TX-TRACKING %s input is not correct",ptr);
-                      vos_mem_free(cmd);
-                      return -EIO;
-        }
-
-        // parameters checking
-        // period has to be larger than 0
-        if (0 == tTxPerTrackingParam.ucTxPerTrackingPeriod)
-        {
-            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN, "Period input is not correct");
-            vos_mem_free(cmd);
-            return -EIO;
-        }
-
-        // use default value 5 is the input is not reasonable. in unit of 10%
-        if ((tTxPerTrackingParam.ucTxPerTrackingRatio > TX_PER_TRACKING_MAX_RATIO) || (0 == tTxPerTrackingParam.ucTxPerTrackingRatio))
-        {
-            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN, "Ratio input is not good. use default 5");
-            tTxPerTrackingParam.ucTxPerTrackingRatio = TX_PER_TRACKING_DEFAULT_RATIO;
-        }
-
-        // default is 5
-        if (0 == tTxPerTrackingParam.uTxPerTrackingWatermark)
-        {
-            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN, "Tx Packet number input is not good. use default 5");
-            tTxPerTrackingParam.uTxPerTrackingWatermark = TX_PER_TRACKING_DEFAULT_WATERMARK;
-        }
-
-        if (eHAL_STATUS_SUCCESS !=
-            sme_SetTxPerTracking(pHddCtx->hHal,
-                                 hdd_tx_per_hit_cb,
-                                 (void*)pAdapter, &tTxPerTrackingParam)) {
-           VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN, "Set Tx PER Tracking Failed!");
-            rc = -EIO;
-        }
-    }
-    else {
-        hddLog( VOS_TRACE_LEVEL_WARN, "%s: Unsupported GUI command %s",
-                __func__, cmd);
-    }
-done:
-    /* many of the commands write information back into the command
-       string using snprintf().  check the return value here in one
-       place */
-    if ((ret < 0) || (ret >= cmd_len))
-    {
-       /* there was an encoding error or overflow */
-       rc = -EINVAL;
-    }
-    else if (ret > 0)
-    {
-       if (copy_to_user(wrqu->data.pointer, cmd, ret))
-       {
-          hddLog(VOS_TRACE_LEVEL_ERROR,
-                 "%s: failed to copy data to user buffer", __func__);
-          vos_mem_free(cmd);
-          return -EFAULT;
-       }
-       wrqu->data.length = ret;
-    }
-
-    if (ioctl_debug)
-    {
-       pr_info("%s: rsp [%s] len [%d] status %d\n",
-               __func__, cmd, wrqu->data.length, rc);
-    }
-    vos_mem_free(cmd);
-    return rc;
-}
-
-/**
- * iw_set_priv() - SSR wrapper for __iw_set_priv()
- * @dev: pointer to net_device
- * @info: pointer to iw_request_info
- * @wrqu: pointer to iwreq_data
- * @extra: pointer to extra ioctl payload
- *
- * Return: 0 on success, error number otherwise
- */
-static int iw_set_priv(struct net_device *dev, struct iw_request_info *info,
-		       union iwreq_data *wrqu, char *extra)
-{
-	int ret;
-
-	vos_ssr_protect(__func__);
-	ret = __iw_set_priv(dev, info, wrqu, extra);
-	vos_ssr_unprotect(__func__);
-
-	return ret;
-}
-
-/**
  * __iw_set_nick() - set nick
  * @dev: pointer to net_device
  * @info: pointer to iw_request_info
@@ -4793,48 +4661,12 @@ static int iw_get_nick(struct net_device *dev,
  * __get_wireless_stats() - get wireless stats
  * @dev: pointer to net_device
  *
- * Return: pointer to iw_statistics on success, NULL otherwise
+ * Return: %NULL
  */
 static struct iw_statistics *__get_wireless_stats(struct net_device *dev)
 {
-	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
-	hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
-	hdd_wext_state_t  *wext_state =  WLAN_HDD_GET_WEXT_STATE_PTR(adapter);
-	hdd_station_ctx_t *hdd_sta_ctx;
-	v_S7_t snr = 0, rssi = 0;
-	int status;
-
 	ENTER();
-
-	status = wlan_hdd_validate_context(hdd_ctx);
-	if (0 != status)
-		return NULL;
-
-	hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
-	if (eConnectionState_Associated != hdd_sta_ctx->conn_info.connState) {
-		hddLog(VOS_TRACE_LEVEL_INFO,
-			FL("not in associated state: %d"),
-				hdd_sta_ctx->conn_info.connState);
-		return NULL;
-	}
-
-	wlan_hdd_get_station_stats(adapter);
-	wlan_hdd_get_snr(adapter, &snr);
-	wlan_hdd_get_rssi(adapter, &rssi);
-
-	vos_mem_zero(&wext_state->iw_stats, sizeof(wext_state->iw_stats));
-	wext_state->iw_stats.status = 0;
-	wext_state->iw_stats.qual.qual = snr;
-	wext_state->iw_stats.qual.level = rssi;
-	wext_state->iw_stats.qual.noise = rssi - snr;
-	wext_state->iw_stats.discard.code = 0;
-	wext_state->iw_stats.discard.retries = 0;
-	wext_state->iw_stats.miss.beacon = 0;
-	wext_state->iw_stats.qual.updated =
-					IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
-
-	EXIT();
-	return &(wext_state->iw_stats);
+	return NULL;
 }
 
 /**
@@ -4855,6 +4687,7 @@ static struct iw_statistics *get_wireless_stats(struct net_device *dev)
 	return iw_stats;
 }
 
+
 /**
  * __iw_set_encode() - SIOCSIWENCODE ioctl handler
  * @dev: device upon which the ioctl was received
@@ -6084,7 +5917,7 @@ void hdd_GetTemperatureCB(int temperature, void *pContext)
         /* the caller presumably timed out so there is nothing we can do */
         spin_unlock(&hdd_context_lock);
         hddLog(VOS_TRACE_LEVEL_WARN,
-                FL("Invalid context, pAdapter [%p] magic [%08x]"),
+                FL("Invalid context, pAdapter [%pK] magic [%08x]"),
                 pAdapter, pTempContext->magic);
         return;
     }
@@ -6201,8 +6034,8 @@ static int __iw_setint_getnone(struct net_device *dev,
     {
         case WE_SET_11D_STATE:
         {
-            if((ENABLE_11D == set_value) || (DISABLE_11D == set_value)) {
-
+            if(((ENABLE_11D == set_value) || (DISABLE_11D == set_value)) &&
+               (hHal)) {
                 sme_GetConfigParam(hHal, &smeConfig);
                 smeConfig.csrConfig.Is11dSupportEnabled = (v_BOOL_t)set_value;
 
@@ -6249,13 +6082,16 @@ static int __iw_setint_getnone(struct net_device *dev,
               case  0: //Full Power
               {
                  struct statsContext context;
-                 eHalStatus status;
+                 eHalStatus status = eHAL_STATUS_FAILURE;
 
                  init_completion(&context.completion);
 
                  context.pAdapter = pAdapter;
                  context.magic = POWER_CONTEXT_MAGIC;
 
+                 if (NULL == hHal)
+                    return -EINVAL;
+
                  status = sme_RequestFullPower(WLAN_HDD_GET_HAL_CTX(pAdapter),
                               iw_power_callback_fn, &context,
                               eSME_FULL_PWR_NEEDED_BY_HDD);
@@ -6288,23 +6124,32 @@ static int __iw_setint_getnone(struct net_device *dev,
                  break;
               }
               case  1: //Enable BMPS
-                 sme_EnablePowerSave(hHal, ePMC_BEACON_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_EnablePowerSave(hHal, ePMC_BEACON_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  2: //Disable BMPS
-                 sme_DisablePowerSave(hHal, ePMC_BEACON_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_DisablePowerSave(hHal, ePMC_BEACON_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  3: //Request Bmps
               {
                  struct statsContext context;
-                 eHalStatus status;
+                 eHalStatus status = eHAL_STATUS_FAILURE;
 
                  init_completion(&context.completion);
 
                  context.pAdapter = pAdapter;
                  context.magic = POWER_CONTEXT_MAGIC;
 
+                 if (NULL == hHal)
+                    return -EINVAL;
+
                  status = sme_RequestBmps(WLAN_HDD_GET_HAL_CTX(pAdapter),
-                           iw_power_callback_fn, &context);
+                              iw_power_callback_fn, &context);
                  if (eHAL_STATUS_PMC_PENDING == status)
                  {
                     unsigned long rc;
@@ -6334,26 +6179,44 @@ static int __iw_setint_getnone(struct net_device *dev,
                  break;
               }
               case  4: //Enable IMPS
-                 sme_EnablePowerSave(hHal, ePMC_IDLE_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_EnablePowerSave(hHal, ePMC_IDLE_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  5: //Disable IMPS
-                 sme_DisablePowerSave(hHal, ePMC_IDLE_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_DisablePowerSave(hHal, ePMC_IDLE_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  6: //Enable Standby
-                 sme_EnablePowerSave(hHal, ePMC_STANDBY_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_EnablePowerSave(hHal, ePMC_STANDBY_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  7: //Disable Standby
-                 sme_DisablePowerSave(hHal, ePMC_STANDBY_MODE_POWER_SAVE);
+                 if (hHal)
+                     sme_DisablePowerSave(hHal, ePMC_STANDBY_MODE_POWER_SAVE);
+                 else
+                     ret = -EINVAL;
                  break;
               case  8: //Request Standby
 #ifdef CONFIG_HAS_EARLYSUSPEND
 #endif
                  break;
               case  9: //Start Auto Bmps Timer
-                 sme_StartAutoBmpsTimer(hHal);
+                 if (hHal)
+                     sme_StartAutoBmpsTimer(hHal);
+                 else
+                     ret = -EINVAL;
                  break;
               case  10://Stop Auto BMPS Timer
-                 sme_StopAutoBmpsTimer(hHal);
+                 if (hHal)
+                     sme_StopAutoBmpsTimer(hHal);
+                 else
+                     ret = -EINVAL;
                  break;
 #ifdef CONFIG_HAS_EARLYSUSPEND
               case  11://suspend to standby
@@ -6388,7 +6251,8 @@ static int __iw_setint_getnone(struct net_device *dev,
         case WE_SET_MAX_ASSOC:
         {
             if ((WNI_CFG_ASSOC_STA_LIMIT_STAMIN > set_value) ||
-                (WNI_CFG_ASSOC_STA_LIMIT_STAMAX < set_value))
+                (WNI_CFG_ASSOC_STA_LIMIT_STAMAX < set_value) ||
+                (NULL == hHal))
             {
                 ret = -EINVAL;
             }
@@ -6413,6 +6277,9 @@ static int __iw_setint_getnone(struct net_device *dev,
 
         case  WE_SET_DATA_INACTIVITY_TO:
         {
+           if (NULL == hHal)
+               return -EINVAL;
+
            if  ((set_value < CFG_DATA_INACTIVITY_TIMEOUT_MIN) ||
                 (set_value > CFG_DATA_INACTIVITY_TIMEOUT_MAX) ||
                 (ccmCfgSetInt((WLAN_HDD_GET_CTX(pAdapter))->hHal,
@@ -6436,6 +6303,8 @@ static int __iw_setint_getnone(struct net_device *dev,
         {
            tSirMacAddr bssid;
 
+           if (NULL == hHal)
+               return -EINVAL;
            vos_mem_copy(bssid, pHddStaCtx->conn_info.bssId, VOS_MAC_ADDR_SIZE);
            if ( sme_SetTxPower(hHal, pAdapter->sessionId, bssid,
                               pAdapter->device_mode, set_value) !=
@@ -6452,6 +6321,8 @@ static int __iw_setint_getnone(struct net_device *dev,
            tSirMacAddr bssid;
            tSirMacAddr selfMac;
 
+           if (NULL == hHal)
+               return -EINVAL;
            hddLog(VOS_TRACE_LEVEL_INFO, "%s: Setting maximum tx power %d dBm",
                   __func__, set_value);
            vos_mem_copy(bssid, pHddStaCtx->conn_info.bssId,
@@ -6471,10 +6342,13 @@ static int __iw_setint_getnone(struct net_device *dev,
         }
         case WE_SET_MAX_TX_POWER_2_4:
         {
+           if (NULL == hHal)
+               return -EINVAL;
+
            hddLog(VOS_TRACE_LEVEL_INFO,
                   "%s: Setting maximum tx power %d dBm for 2.4 GHz band",
                   __func__, set_value);
-           if (sme_SetMaxTxPowerPerBand(eCSR_BAND_24, set_value) !=
+           if (sme_SetMaxTxPowerPerBand(eCSR_BAND_24, set_value, hHal) !=
                                         eHAL_STATUS_SUCCESS)
            {
               hddLog(VOS_TRACE_LEVEL_ERROR,
@@ -6487,10 +6361,13 @@ static int __iw_setint_getnone(struct net_device *dev,
         }
         case WE_SET_MAX_TX_POWER_5_0:
         {
+           if (NULL == hHal)
+               return -EINVAL;
+
            hddLog(VOS_TRACE_LEVEL_INFO,
                   "%s: Setting maximum tx power %d dBm for 5.0 GHz band",
                   __func__, set_value);
-           if (sme_SetMaxTxPowerPerBand(eCSR_BAND_5G, set_value) !=
+           if (sme_SetMaxTxPowerPerBand(eCSR_BAND_5G, set_value, hHal) !=
                                         eHAL_STATUS_SUCCESS)
            {
               hddLog(VOS_TRACE_LEVEL_ERROR,
@@ -6523,6 +6400,8 @@ static int __iw_setint_getnone(struct net_device *dev,
 
         case WE_SET_TM_LEVEL:
         {
+           if (NULL == hHal)
+               return -EINVAL;
            hddLog(VOS_TRACE_LEVEL_INFO, "Set Thermal Mitigation Level %d",
                   set_value);
            (void)sme_SetThermalLevel(hHal, set_value);
@@ -6533,6 +6412,8 @@ static int __iw_setint_getnone(struct net_device *dev,
         {
            hdd_context_t *phddctx = WLAN_HDD_GET_CTX(pAdapter);
 
+           if (NULL == hHal)
+               return -EINVAL;
            ret = wlan_hdd_update_phymode(dev, hHal, set_value, phddctx);
            break;
         }
@@ -6637,6 +6518,8 @@ static int __iw_setint_getnone(struct net_device *dev,
 
         case WE_SET_SHORT_GI:
         {
+           if (NULL == hHal)
+               return -EINVAL;
            hddLog(LOG1, "WMI_VDEV_PARAM_SGI val %d", set_value);
            ret = sme_UpdateHTConfig(hHal, pAdapter->sessionId,
                                    WNI_CFG_HT_CAP_INFO_SHORT_GI_20MHZ,
@@ -6651,6 +6534,8 @@ static int __iw_setint_getnone(struct net_device *dev,
         {
            u_int32_t value;
 
+           if (NULL == hHal)
+               return -EINVAL;
            hddLog(LOG1, "WMI_VDEV_PARAM_ENABLE_RTSCTS val 0x%x", set_value);
 
            if ((set_value & HDD_RTSCTS_EN_MASK) == HDD_RTSCTS_ENABLE)
@@ -6680,6 +6565,9 @@ static int __iw_setint_getnone(struct net_device *dev,
         {
            bool chwidth = false;
            hdd_context_t *phddctx = WLAN_HDD_GET_CTX(pAdapter);
+
+           if (NULL == hHal)
+               return -EINVAL;
            /*updating channel bonding only on 5Ghz*/
            hddLog(LOG1, "WMI_VDEV_PARAM_CHWIDTH val %d", set_value);
            if (set_value > eHT_CHANNEL_WIDTH_80MHZ) {
@@ -7064,6 +6952,7 @@ static int __iw_setint_getnone(struct net_device *dev,
                  WLANTL_clear_datapath_stats(hdd_ctx->pvosContext, set_value);
                  break;
          }
+         break;
     }
 
     case WE_PPS_PAID_MATCH:
@@ -7231,7 +7120,8 @@ static int __iw_setint_getnone(struct net_device *dev,
         }
         case WE_SET_SCAN_BAND_PREFERENCE:
         {
-           if(pAdapter->device_mode != WLAN_HDD_INFRA_STATION) {
+           if((pAdapter->device_mode != WLAN_HDD_INFRA_STATION) ||
+              (NULL == hHal)) {
                ret = -EINVAL;
                break;
            }
@@ -7315,6 +7205,8 @@ static int __iw_setint_getnone(struct net_device *dev,
        case WE_SET_DEBUG_LOG:
        {
            hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+           if (NULL == hHal)
+               return -EINVAL;
 #ifdef QCA_PKT_PROTO_TRACE
            /* Trace buffer dump only */
            if (VOS_PKT_TRAC_DUMP_CMD == set_value)
@@ -7397,7 +7289,8 @@ static int __iw_setint_getnone(struct net_device *dev,
                      pAdapter->sessionId, pAdapter->device_mode);
 
           if ((WLAN_HDD_INFRA_STATION == pAdapter->device_mode) ||
-              (WLAN_HDD_P2P_CLIENT == pAdapter->device_mode)) {
+              (WLAN_HDD_P2P_CLIENT == pAdapter->device_mode) ||
+              (NULL == hHal)) {
 
                status = sme_ext_change_channel(pHddCtx->hHal,
                               set_value, pAdapter->sessionId);
@@ -7409,6 +7302,19 @@ static int __iw_setint_getnone(struct net_device *dev,
           }
           break;
         }
+        case WE_SET_MODULATED_DTIM:
+        {
+            if ((set_value < CFG_ENABLE_MODULATED_DTIM_MIN) ||
+                (set_value > CFG_ENABLE_MODULATED_DTIM_MAX)) {
+                hddLog(LOGE, FL("Invalid value %d in gEnableModuleDTIM"),
+                             set_value);
+                return -EINVAL;
+            } else {
+                ret = (WLAN_HDD_GET_CTX(pAdapter))->cfg_ini->
+                          enableModulatedDTIM = set_value;
+            }
+            break;
+        }
         default:
         {
            hddLog(LOGE, "%s: Invalid sub command %d", __func__, sub_cmd);
@@ -8753,7 +8659,11 @@ static int __iw_setnone_getnone(struct net_device *dev,
      * different between 32-bit and 64-bit user space, and the standard
      * compat support in the kernel does not handle this case.  so we
      * need to explicitly handle it here. */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,6,0)) && defined(CONFIG_X86_64)
+    if (in_compat_syscall()) {
+#else
     if (is_compat_task()) {
+#endif
         struct compat_iw_point *compat_iw_point =
             (struct compat_iw_point *) &wrqu->data;
         sub_cmd = compat_iw_point->flags;
@@ -8897,7 +8807,7 @@ void hdd_wmm_tx_snapshot(hdd_adapter_t *pAdapter)
     for ( i=0; i< NUM_TX_QUEUES; i++)
     {
         spin_lock_bh(&pAdapter->wmm_tx_queue[i].lock);
-        hddLog(LOGE, "HDD WMM TxQueue Info For AC: %d Count: %d PrevAdress:%p, NextAddress:%p",
+        hddLog(LOGE, "HDD WMM TxQueue Info For AC: %d Count: %d PrevAdress:%pK, NextAddress:%pK",
                i, pAdapter->wmm_tx_queue[i].count,
                pAdapter->wmm_tx_queue[i].anchor.prev, pAdapter->wmm_tx_queue[i].anchor.next);
         spin_unlock_bh(&pAdapter->wmm_tx_queue[i].lock);
@@ -8911,7 +8821,7 @@ void hdd_wmm_tx_snapshot(hdd_adapter_t *pAdapter)
              for ( j=0; j< NUM_TX_QUEUES; j++)
              {
                 spin_lock_bh(&pAdapter->aStaInfo[i].wmm_tx_queue[j].lock);
-                hddLog(LOGE, "HDD TxQueue Info For AC: %d Count: %d PrevAdress:%p, NextAddress:%p",
+                hddLog(LOGE, "HDD TxQueue Info For AC: %d Count: %d PrevAdress:%pK, NextAddress:%pK",
                        j, pAdapter->aStaInfo[i].wmm_tx_queue[j].count,
                        pAdapter->aStaInfo[i].wmm_tx_queue[j].anchor.prev,
                        pAdapter->aStaInfo[i].wmm_tx_queue[j].anchor.next);
@@ -8985,9 +8895,9 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
                 hddLog(LOG1, "%s: LOG_DUMP %d arg1 %d arg2 %d arg3 %d arg4 %d",
                         __func__, apps_args[0], apps_args[1], apps_args[2],
                         apps_args[3], apps_args[4]);
-
-                logPrintf(hHal, apps_args[0], apps_args[1], apps_args[2],
-                        apps_args[3], apps_args[4]);
+                if (hHal)
+                    return logPrintf(hHal, apps_args[0], apps_args[1],
+                                     apps_args[2], apps_args[3], apps_args[4]);
 
             }
             break;
@@ -9042,8 +8952,9 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
                        "bitmask_of_module %d ",
                         __func__, apps_args[0], apps_args[1], apps_args[2],
                         apps_args[3]);
-                vosTraceDumpAll((void*)hHal , apps_args[0], apps_args[1],
-                                apps_args[2], apps_args[3]);
+                if (hHal)
+                    vosTraceDumpAll((void*)hHal , apps_args[0], apps_args[1],
+                                    apps_args[2], apps_args[3]);
 
             }
             break;
@@ -9052,7 +8963,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
             {
                 cmd = 287; //Command should be updated if there is any change
                            // in the Riva dump command
-                if((apps_args[0] >= 40 ) && (apps_args[0] <= 160 ))
+                if((apps_args[0] >= 40 ) && (apps_args[0] <= 160 ) && (hHal))
                 {
                     logPrintf(hHal, cmd, staId, apps_args[0], apps_args[1], apps_args[2]);
                 }
@@ -9868,11 +9779,14 @@ static int __iw_set_host_offload(struct net_device *dev,
         }
     }
 
-    /* Execute offload request. The reason that we can copy the request information
-       from the ioctl structure to the SME structure is that they are laid out
-       exactly the same.  Otherwise, each piece of information would have to be
-       copied individually. */
-    memcpy(&offloadRequest, pRequest, wrqu->data.length);
+    vos_mem_zero(&offloadRequest, sizeof(offloadRequest));
+    offloadRequest.offloadType = pRequest->offloadType;
+    offloadRequest.enableOrDisable = pRequest->enableOrDisable;
+    vos_mem_copy(&offloadRequest.params, &pRequest->params,
+                 sizeof(pRequest->params));
+    vos_mem_copy(&offloadRequest.bssId, &pRequest->bssId.bytes,
+                 VOS_MAC_ADDRESS_LEN);
+
     if (eHAL_STATUS_SUCCESS != sme_SetHostOffload(WLAN_HDD_GET_HAL_CTX(pAdapter),
                                         pAdapter->sessionId, &offloadRequest))
     {
@@ -10274,11 +10188,12 @@ int wlan_hdd_setIPv6Filter(hdd_context_t *pHddCtx, tANI_U8 filterType,
  * @pAdapter: Adapter context
  * @set: flag to notify set/clear action on the multicast addr
  *
- * Returns: None
+ * Returns: 0 on success, errno on failure
  */
-void wlan_hdd_set_mc_addr_list(hdd_adapter_t *pAdapter, v_U8_t set)
+int wlan_hdd_set_mc_addr_list(hdd_adapter_t *pAdapter, v_U8_t set)
 {
     v_U8_t i;
+    int ret = 0;
     tpSirRcvFltMcAddrList pMulticastAddrs = NULL;
     tHalHandle hHal;
     hdd_context_t* pHddCtx = (hdd_context_t*)pAdapter->pHddCtx;
@@ -10286,26 +10201,26 @@ void wlan_hdd_set_mc_addr_list(hdd_adapter_t *pAdapter, v_U8_t set)
 
     ENTER();
 
-    if (wlan_hdd_validate_context(pHddCtx))
-        return;
+    if ((ret = wlan_hdd_validate_context(pHddCtx)))
+        return ret;
 
     hHal = pHddCtx->hHal;
 
     if (NULL == hHal) {
         hddLog(VOS_TRACE_LEVEL_ERROR, FL("HAL Handle is NULL"));
-        return;
+        return -EINVAL;
     }
 
     if (!sta_ctx) {
         hddLog(LOGE, "sta_ctx is NULL");
-        return;
+        return -EINVAL;
     }
 
     if (pHddCtx->cfg_ini->fEnableMCAddrList) {
         pMulticastAddrs = vos_mem_malloc(sizeof(tSirRcvFltMcAddrList));
         if (NULL == pMulticastAddrs) {
             hddLog(VOS_TRACE_LEVEL_ERROR, FL("Could not allocate Memory"));
-            return;
+            return -ENOMEM;
         }
         vos_mem_zero(pMulticastAddrs, sizeof(tSirRcvFltMcAddrList));
         pMulticastAddrs->action = set;
@@ -10317,10 +10232,16 @@ void wlan_hdd_set_mc_addr_list(hdd_adapter_t *pAdapter, v_U8_t set)
                        hdd_connIsConnected(sta_ctx)) ||
                      (WLAN_HDD_IS_NDI(pAdapter) &&
                        WLAN_HDD_IS_NDI_CONNECTED(pAdapter)))) {
-
+                if (pAdapter->mc_addr_list.mc_cnt >
+                          HDD_MAX_NUM_MULTICAST_ADDRESS) {
+                    hddLog(LOGE, FL("mc_cnt: %u max: %u"),
+                           pAdapter->mc_addr_list.mc_cnt,
+                           HDD_MAX_NUM_MULTICAST_ADDRESS);
+                    pAdapter->mc_addr_list.mc_cnt =
+                        HDD_MAX_NUM_MULTICAST_ADDRESS;
+                }
                 pMulticastAddrs->ulMulticastAddrCnt =
                                  pAdapter->mc_addr_list.mc_cnt;
-
                 for (i = 0; i < pAdapter->mc_addr_list.mc_cnt; i++) {
                     memcpy(pMulticastAddrs->multicastAddr[i],
                            &pAdapter->mc_addr_list.addr[i * ETH_ALEN],
@@ -10372,10 +10293,11 @@ void wlan_hdd_set_mc_addr_list(hdd_adapter_t *pAdapter, v_U8_t set)
     } else {
         hddLog(VOS_TRACE_LEVEL_INFO,
                 FL("gMCAddrListEnable is not enabled in INI"));
+        return -EINVAL;
     }
 
     EXIT();
-    return;
+    return ret;
 }
 
 static int __iw_set_packet_filter_params(struct net_device *dev,
@@ -10675,8 +10597,9 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
      serialized by the kernel rtnl_lock and hence does not need to be
      reentrant */
   static tSirPNOScanReq pnoRequest;
-  char *ptr;
+  char *ptr, *data;
   v_U8_t i,j, ucParams, ucMode;
+  size_t len;
   /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
 
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
@@ -10699,10 +10622,10 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
     for each network:
     <ssid_len> <ssid> <authentication> <encryption>
     <ch_num> <channel_list optional> <bcast_type> <rssi_threshold>
-    <scan_timers> <scan_time> <scan_repeat> <scan_time> <scan_repeat>
+    <fast_scan_period> <fast_scan_cycles> <slow_scan_period> <pno_mode>
 
     e.g:
-    1 2 4 test 0 0 3 1 6 11 2 40 5 test2 4 4 6 1 2 3 4 5 6 1 0 2 5 2 300 0
+    1 2 4 test 0 0 3 1 6 11 2 40 5 test2 4 4 6 1 2 3 4 5 6 1 0 2 5 3 0
 
     this translates into:
     -----------------------------
@@ -10720,12 +10643,24 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
 
     scan every 5 seconds 2 times, scan every 300 seconds until stopped
   -----------------------------------------------------------------------*/
-  ptr = extra + nOffset;
 
-  if (1 != sscanf(ptr,"%hhu%n", &(pnoRequest.enable), &nOffset))
+  /* making sure argument string ends with '\0' */
+  len = (wrqu->data.length-nOffset) + 1;
+  data = vos_mem_malloc(len);
+  if (NULL == data) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                FL("fail to allocate memory %zu"), len);
+      return -EINVAL;
+  }
+  vos_mem_zero(data, len);
+  vos_mem_copy(data, &extra[nOffset], (len-1));
+  ptr = data;
+
+  if (1 != sscanf(ptr," %hhu%n", &(pnoRequest.enable), &nOffset))
   {
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                 "PNO enable input is not valid %s",ptr);
+      vos_mem_free(data);
       return -EINVAL;
   }
 
@@ -10736,15 +10671,17 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
     sme_SetPreferredNetworkList(WLAN_HDD_GET_HAL_CTX(pAdapter), &pnoRequest,
                                 pAdapter->sessionId,
                                 found_pref_network_cb, pAdapter);
+    vos_mem_free(data);
     return 0;
   }
 
   ptr += nOffset;
 
-  if (1 != sscanf(ptr,"%hhu %n", &(pnoRequest.ucNetworksCount), &nOffset))
+  if (1 != sscanf(ptr," %hhu %n", &(pnoRequest.ucNetworksCount), &nOffset))
   {
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                 "PNO count input not valid %s",ptr);
+      vos_mem_free(data);
       return -EINVAL;
   }
 
@@ -10760,6 +10697,7 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
       ( pnoRequest.ucNetworksCount > SIR_PNO_MAX_SUPP_NETWORKS ))
   {
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN, "Network input is not correct");
+      vos_mem_free(data);
       return -EINVAL;
   }
 
@@ -10770,13 +10708,14 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
 
     pnoRequest.aNetworks[i].ssId.length = 0;
 
-    ucParams = sscanf(ptr,"%hhu %n",
+    ucParams = sscanf(ptr," %hhu %n",
                       &(pnoRequest.aNetworks[i].ssId.length),&nOffset);
 
     if (1 != ucParams)
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "PNO ssid length input is not valid %s",ptr);
+        vos_mem_free(data);
         return -EINVAL;
     }
 
@@ -10786,6 +10725,7 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                 "SSID Len %d is not correct for network %d",
                 pnoRequest.aNetworks[i].ssId.length, i);
+      vos_mem_free(data);
       return -EINVAL;
     }
 
@@ -10796,7 +10736,7 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
            pnoRequest.aNetworks[i].ssId.length);
     ptr += pnoRequest.aNetworks[i].ssId.length;
 
-    ucParams = sscanf(ptr,"%u %u %hhu %n",
+    ucParams = sscanf(ptr," %u %u %hhu %n",
                       &(pnoRequest.aNetworks[i].authentication),
                       &(pnoRequest.aNetworks[i].encryption),
                       &(pnoRequest.aNetworks[i].ucChannelCount),
@@ -10806,6 +10746,7 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
     {
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
                 "Incorrect cmd %s",ptr);
+      vos_mem_free(data);
       return -EINVAL;
     }
 
@@ -10833,6 +10774,7 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
     {
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
                 "Incorrect number of channels");
+      vos_mem_free(data);
       return -EINVAL;
     }
 
@@ -10840,27 +10782,42 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
     {
       for ( j = 0; j < pnoRequest.aNetworks[i].ucChannelCount; j++)
       {
-           if (1 != sscanf(ptr,"%hhu %n",
+           if (1 != sscanf(ptr," %hhu %n",
                            &(pnoRequest.aNetworks[i].aChannels[j]),
                            &nOffset))
             {    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                            "PNO network channel input is not valid %s",ptr);
+               vos_mem_free(data);
                return -EINVAL;
             }
+            if (!IS_CHANNEL_VALID(pnoRequest.aNetworks[i].aChannels[j])) {
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                          FL("invalid channel: %hhu"),
+                             pnoRequest.aNetworks[i].aChannels[j]);
+                vos_mem_free(data);
+                return -EINVAL;
+            }
             /*Advance to next channel number*/
             ptr += nOffset;
       }
     }
 
-    if (1 != sscanf(ptr,"%u %n",
+    if (1 != sscanf(ptr," %u %n",
                     &(pnoRequest.aNetworks[i].bcastNetwType),
                     &nOffset))
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "PNO broadcast network type input is not valid %s",ptr);
+        vos_mem_free(data);
+        return -EINVAL;
+    }
+    if (pnoRequest.aNetworks[i].bcastNetwType > 2) {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  FL("invalid bcast nw type: %u"),
+                      pnoRequest.aNetworks[i].bcastNetwType);
+        vos_mem_free(data);
         return -EINVAL;
     }
-
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
             "PNO bcastNetwType %d offset %d",
             pnoRequest.aNetworks[i].bcastNetwType,
@@ -10868,12 +10825,13 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
 
     /*Advance to rssi Threshold*/
     ptr += nOffset;
-    if (1 != sscanf(ptr,"%d %n",
+    if (1 != sscanf(ptr," %d %n",
                     &(pnoRequest.aNetworks[i].rssiThreshold),
                     &nOffset))
     {
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "PNO rssi threshold input is not valid %s",ptr);
+        vos_mem_free(data);
         return -EINVAL;
     }
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
@@ -10884,12 +10842,63 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
     ptr += nOffset;
   }/*For ucNetworkCount*/
 
-  ucParams = sscanf(ptr,"%hhu %n",&(ucMode), &nOffset);
+  if (1 != sscanf(ptr, " %u %n", &(pnoRequest.fast_scan_period), &nOffset) ) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "failed to read fast scan period %u", *ptr);
+        vos_mem_free(data);
+        return -EINVAL;
+  }
+  if (pnoRequest.fast_scan_period == 0) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                FL("invalid fast scan period %u"),
+                 pnoRequest.fast_scan_period);
+        vos_mem_free(data);
+        return -EINVAL;
+  }
+  pnoRequest.fast_scan_period *= MSEC_PER_SEC;
+  ptr += nOffset;
+
+  if (1 != sscanf(ptr, " %hhu %n", &(pnoRequest.fast_scan_max_cycles),
+             &nOffset)) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "failed to read fast scan max cycles %hhu", *ptr);
+        vos_mem_free(data);
+        return -EINVAL;
+  }
+  if (pnoRequest.fast_scan_max_cycles < CFG_PNO_SCAN_TIMER_REPEAT_VALUE_MIN ||
+      pnoRequest.fast_scan_max_cycles > CFG_PNO_SCAN_TIMER_REPEAT_VALUE_MAX) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "invalid fast scan max cycles %hhu",
+                 pnoRequest.fast_scan_max_cycles);
+        vos_mem_free(data);
+        return -EINVAL;
+  }
+  ptr += nOffset;
+
+  if (1 != sscanf(ptr, " %u %n", &(pnoRequest.slow_scan_period), &nOffset)) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "failed to read slow scan period %u", *ptr);
+        vos_mem_free(data);
+        return -EINVAL;
+  }
+  pnoRequest.slow_scan_period *= MSEC_PER_SEC;
+  if (pnoRequest.slow_scan_period < pnoRequest.fast_scan_period) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "invalid slow scan period %u",
+                 pnoRequest.slow_scan_period);
+        vos_mem_free(data);
+        return -EINVAL;
+  }
+  ptr += nOffset;
+
+  ucParams = sscanf(ptr," %hhu %n",&(ucMode), &nOffset);
 
   pnoRequest.modePNO = ucMode;
   /*for LA we just expose suspend option*/
   if (( 1 != ucParams )||(  ucMode >= SIR_PNO_MODE_MAX ))
   {
+     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                "fail to get valid pno mode %hhu %hhu", ucParams, ucMode);
      pnoRequest.modePNO = SIR_PNO_MODE_ON_SUSPEND;
   }
 
@@ -10897,6 +10906,7 @@ int iw_set_pno(struct net_device *dev, struct iw_request_info *info,
                                 pAdapter->sessionId,
                                 found_pref_network_cb, pAdapter);
 
+  vos_mem_free(data);
   return 0;
 }/*iw_set_pno*/
 
@@ -11349,11 +11359,13 @@ static int __iw_set_two_ints_getnone(struct net_device *dev,
             hddLog(LOGE, "Crash Inject ini disabled, Ignore Crash Inject");
             return 0;
         }
+
+        hdd_ctx->isLogpInProgress = true;
         ret = process_wma_set_command_twoargs((int) pAdapter->sessionId,
                                               (int) GEN_PARAM_CRASH_INJECT,
                                               value[1], value[2], GEN_CMD);
-        if (!ret)
-           hdd_ctx->isLogpInProgress = true;
+        if (ret)
+            hdd_ctx->isLogpInProgress = false;
 
         break;
 #endif
@@ -11371,26 +11383,66 @@ static int __iw_set_two_ints_getnone(struct net_device *dev,
 
             tHalHandle hal_hdl = hdd_ctx->hHal;
             tCsrBssid bssid = {0};
-            tCsrRoamProfile roam_profile;
+            tCsrRoamProfile *roam_profile = NULL;
+            uint8_t ini_sub_20_ch_width =
+                        hdd_ctx->cfg_ini->sub_20_channel_width;
+
+            /* Validate channel Number*/
+            if (wlan_hdd_validate_mon_channel(value[1]) != VOS_STATUS_SUCCESS) {
+                hddLog(LOGE, "Invalid channel for monitor mode");
+                return -EINVAL;
+            }
+
+            /* Validate bandwidth Number*/
+            if (wlan_hdd_validate_mon_bw(value[2]) != VOS_STATUS_SUCCESS) {
+                hddLog(LOGE, "Invalid bandwidth for monitor mode");
+                return -EINVAL;
+            }
+
+            roam_profile = vos_mem_malloc(sizeof(tCsrRoamProfile));
+            if (roam_profile == NULL){
+                hddLog(LOGE, "Failed to allocate memory");
+                return -ENOMEM;
+            }
+            vos_mem_zero(roam_profile, sizeof(*roam_profile));
+
+            if (vht_channel_width == 4) {
+                vht_channel_width = 0;
+                roam_profile->sub20_channelwidth = SUB20_MODE_5MHZ;
+            } else if (vht_channel_width == 5) {
+                vht_channel_width = 0;
+                roam_profile->sub20_channelwidth = SUB20_MODE_10MHZ;
+            } else {
+                if (ini_sub_20_ch_width < CFG_SUB_20_CHANNEL_WIDTH_DYN_5MHZ)
+                    roam_profile->sub20_channelwidth = ini_sub_20_ch_width;
+                else
+                    roam_profile->sub20_channelwidth = SUB20_MODE_NONE;
+            }
+
+            hddLog(LOGE, "Set monitor mode Channel %d bandwidth %d sub20 %d",
+                   value[1], vht_channel_width,
+                   roam_profile->sub20_channelwidth);
+
+            hdd_select_mon_cbmode(pAdapter, value[1], &vht_channel_width);
+
+            roam_profile->ChannelInfo.ChannelList = &ch_info->channel;
+            roam_profile->ChannelInfo.numOfChannels = 1;
+            roam_profile->vht_channel_width = ch_info->channel_width;
+            roam_profile->phyMode = ch_info->phy_mode;
 
-            hddLog(LOG1, "Set monitor mode Channel %d", value[1]);
-            hdd_select_cbmode(pAdapter, value[1], &vht_channel_width);
-            roam_profile.ChannelInfo.ChannelList = &ch_info->channel;
-            roam_profile.ChannelInfo.numOfChannels = 1;
-            roam_profile.vht_channel_width = ch_info->channel_width;
-            roam_profile.phyMode = ch_info->phy_mode;
 
             vos_mem_copy(bssid, pAdapter->macAddressCurrent.bytes,
                          VOS_MAC_ADDR_SIZE);
 
             hal_status = sme_RoamChannelChangeReq(hal_hdl,
                                  bssid,
-                                 ch_info->cb_mode, &roam_profile);
+                                 ch_info->cb_mode, roam_profile);
             if (!HAL_STATUS_SUCCESS(hal_status)) {
                 hddLog(LOGE,
                        "Failed to set sme_RoamChannel for monitor mode");
                 ret = -EINVAL;
             }
+            vos_mem_free(roam_profile);
         } else {
             hddLog(LOGE, "Not supported, device is not in monitor mode");
             ret = -EINVAL;
@@ -11446,7 +11498,7 @@ static const iw_handler      we_handler[] =
    (iw_handler) NULL,              /* SIOCGIWSENS */
    (iw_handler) NULL,             /* SIOCSIWRANGE */
    (iw_handler) iw_get_range,      /* SIOCGIWRANGE */
-   (iw_handler) iw_set_priv,       /* SIOCSIWPRIV */
+   (iw_handler) NULL,             /* SIOCSIWPRIV */
    (iw_handler) NULL,             /* SIOCGIWPRIV */
    (iw_handler) NULL,             /* SIOCSIWSTATS */
    (iw_handler) NULL,             /* SIOCGIWSTATS */
@@ -11527,6 +11579,7 @@ static const iw_handler we_private[] = {
    [WLAN_GET_LINK_SPEED                 - SIOCIWFIRSTPRIV]   = iw_get_linkspeed_priv,
    [WLAN_PRIV_SET_TWO_INT_GET_NONE      - SIOCIWFIRSTPRIV]   = iw_set_two_ints_getnone,
    [WLAN_SET_DOT11P_CHANNEL_SCHED       - SIOCIWFIRSTPRIV]   = iw_set_dot11p_channel_sched,
+   [WLAN_GET_ISOLATION                  - SIOCIWFIRSTPRIV]   = iw_get_isolation,
 };
 
 /*Maximum command length can be only 15 */
@@ -11963,6 +12016,10 @@ static const struct iw_priv_args we_private_args[] = {
         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
         0, "setChanChange" },
 
+    {   WE_SET_MODULATED_DTIM,
+        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+        0, "setModDTIM" },
+
     /* handlers for sub-ioctl */
     {   WE_GET_11D_STATE,
         0,
@@ -12586,7 +12643,12 @@ static const struct iw_priv_args we_private_args[] = {
         WLAN_GET_LINK_SPEED,
         IW_PRIV_TYPE_CHAR | 18,
         IW_PRIV_TYPE_CHAR | 5, "getLinkSpeed" },
-
+    {
+        WLAN_GET_ISOLATION,
+        0,
+        IW_PRIV_TYPE_CHAR | WE_MAX_STR_LEN,
+        "get_isolation"
+    },
     /* handlers for main ioctl */
     {   WLAN_PRIV_SET_TWO_INT_GET_NONE,
         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2,
@@ -12610,6 +12672,10 @@ static const struct iw_priv_args we_private_args[] = {
     {   WE_DUMP_DP_TRACE_LEVEL,
         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2,
         0, "dump_dp_trace"},
+    {
+        WLAN_PRIV_SET_FTIES,
+        IW_PRIV_TYPE_CHAR | MAX_FTIE_SIZE,
+        0, "set_ft_ies"},
 };
 
 
@@ -12857,6 +12923,16 @@ int hdd_set_wext(hdd_adapter_t *pAdapter)
     return VOS_STATUS_SUCCESS;
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+static void hdd_initialize_fils_info(hdd_wext_state_t *pwextBuf)
+{
+    pwextBuf->roamProfile.fils_con_info = NULL;
+}
+#else
+static void hdd_initialize_fils_info(hdd_wext_state_t *pwextBuf)
+{ }
+#endif
+
 /**
  * hdd_register_wext() - register wext context
  * @dev: net device handle
@@ -12898,7 +12974,7 @@ int hdd_register_wext(struct net_device *dev)
         hddLog(LOGE, ("ERROR: HDD scan event init failed!!"));
         return eHAL_STATUS_FAILURE;
     }
-
+    hdd_initialize_fils_info(pwextBuf);
     /* Register as a wireless device */
     dev->wireless_handlers = (struct iw_handler_def *)&we_handler_def;
 
@@ -12908,7 +12984,7 @@ int hdd_register_wext(struct net_device *dev)
 
 int hdd_UnregisterWext(struct net_device *dev)
 {
-	hddLog(LOG1, FL("dev(%p)"), dev);
+	hddLog(LOG1, FL("dev(%pK)"), dev);
 
 	if (dev != NULL) {
 		rtnl_lock();
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wmm.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wmm.c
index a3b53c3b57c..f3f32b7d11c 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wmm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -300,7 +300,7 @@ static void hdd_wmm_free_context (hdd_wmm_qos_context_t* pQosContext)
    hdd_adapter_t* pAdapter;
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO_LOW,
-             "%s: Entered, context %p",
+             "%s: Entered, context %pK",
              __func__, pQosContext);
 
    if (unlikely((NULL == pQosContext) ||
@@ -348,7 +348,7 @@ static void hdd_wmm_notify_app (hdd_wmm_qos_context_t* pQosContext)
    char buf[MAX_NOTIFY_LEN+1];
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO_LOW,
-             "%s: Entered, context %p",
+             "%s: Entered, context %pK",
              __func__, pQosContext);
 
    if (unlikely((NULL == pQosContext) ||
@@ -408,7 +408,7 @@ void hdd_wmm_inactivity_timer_cb( v_PVOID_t pUserData )
     pAdapter = pQosContext->pAdapter;
     if ((NULL == pAdapter) || (WLAN_HDD_ADAPTER_MAGIC != pAdapter->magic)) {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  FL("invalid pAdapter: %p"), pAdapter);
+                  FL("invalid pAdapter: %pK"), pAdapter);
         return;
     }
     pAc = &pAdapter->hddWmmStatus.wmmAcStatus[acType];
@@ -578,7 +578,7 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
    VOS_STATUS status;
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO_LOW,
-             "%s: Entered, context %p",
+             "%s: Entered, context %pK",
              __func__, pQosContext);
 
    if (unlikely((NULL == pQosContext) ||
@@ -595,7 +595,7 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
    pAc = &pAdapter->hddWmmStatus.wmmAcStatus[acType];
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO_LOW,
-             "%s: status %d flowid %d info %p",
+             "%s: status %d flowid %d info %pK",
              __func__, smeStatus, qosFlowId, pCurrentQosInfo);
 
    switch (smeStatus)
@@ -1260,7 +1260,7 @@ static void __hdd_wmm_do_implicit_qos(struct work_struct *work)
    hdd_context_t *hdd_ctx;
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO_LOW,
-             "%s: Entered, context %p",
+             "%s: Entered, context %pK",
              __func__, pQosContext);
 
    if (unlikely(HDD_WMM_CTX_MAGIC != pQosContext->magic))
@@ -1281,7 +1281,7 @@ static void __hdd_wmm_do_implicit_qos(struct work_struct *work)
    pAc = &pAdapter->hddWmmStatus.wmmAcStatus[acType];
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO_LOW,
-             "%s: pAdapter %p acType %d",
+             "%s: pAdapter %pK acType %d",
              __func__, pAdapter, acType);
 
    if (!pAc->wmmAcAccessNeeded)
@@ -2024,7 +2024,7 @@ VOS_STATUS hdd_wmm_acquire_access( hdd_adapter_t* pAdapter,
 
    // we need to establish implicit QoS
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
-             "%s: Need to schedule implicit QoS for TL AC %d, pAdapter is %p",
+             "%s: Need to schedule implicit QoS for TL AC %d, pAdapter is %pK",
              __func__, acType, pAdapter);
 
    pAdapter->hddWmmStatus.wmmAcStatus[acType].wmmAcAccessNeeded = VOS_TRUE;
@@ -2051,7 +2051,7 @@ VOS_STATUS hdd_wmm_acquire_access( hdd_adapter_t* pAdapter,
              hdd_wmm_do_implicit_qos);
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
-             "%s: Scheduling work for AC %d, context %p",
+             "%s: Scheduling work for AC %d, context %pK",
              __func__, acType, pQosContext);
 
    schedule_work(&pQosContext->wmmAcSetupImplicitQos);
@@ -2508,7 +2508,7 @@ hdd_wlan_wmm_status_e hdd_wmm_addts( hdd_adapter_t* pAdapter,
    pQosContext->magic = HDD_WMM_CTX_MAGIC;
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
-             "%s: Setting up QoS, context %p",
+             "%s: Setting up QoS, context %pK",
              __func__, pQosContext);
 
    mutex_lock(&pAdapter->hddWmmStatus.wmmLock);
@@ -2625,7 +2625,7 @@ hdd_wlan_wmm_status_e hdd_wmm_delts( hdd_adapter_t* pAdapter,
 
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO_LOW,
-             "%s: found handle 0x%x, flow %d, AC %d, context %p",
+             "%s: found handle 0x%x, flow %d, AC %d, context %pK",
              __func__, handle, qosFlowId, acType, pQosContext);
 
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
@@ -2719,7 +2719,7 @@ hdd_wlan_wmm_status_e hdd_wmm_checkts( hdd_adapter_t* pAdapter,
       if (pQosContext->handle == handle)
       {
          VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO_LOW,
-                   "%s: found handle 0x%x, context %p",
+                   "%s: found handle 0x%x, context %pK",
                    __func__, handle, pQosContext);
 
          status = pQosContext->lastStatus;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/aniGlobal.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/aniGlobal.h
index a9e3ed79514..367fc9482be 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/aniGlobal.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/aniGlobal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -42,12 +42,6 @@
 #ifndef _ANIGLOBAL_H
 #define _ANIGLOBAL_H
 
-// Take care to avoid redefinition of this type, if it is
-// already defined in "halWmmApi.h"
-#if !defined(_HALMAC_WMM_API_H)
-typedef struct sAniSirGlobal *tpAniSirGlobal;
-#endif
-
 #include "halTypes.h"
 #include "sirCommon.h"
 #include "aniSystemDefs.h"
@@ -195,6 +189,19 @@ enum log_event_indicator {
 };
 
 /**
+ * enum log_dump_trace_mask - Mask to indicate what traces to log
+ * @DUMP_NO_TRACE: Do not dump any logs
+ * @DUMP_VOS_TRACE: Dump vos trace logs
+ * @DUMP_PACKET_TRACE: Dump packet trace
+ *
+ */
+enum log_dump_trace_mask {
+	DUMP_NO_TRACE      = 0x0,
+	DUMP_VOS_TRACE     = 0x1,
+	DUMP_PACKET_TRACE  = 0x2
+};
+
+/**
  * enum log_event_host_reason_code - Reason code for bug report
  * @WLAN_LOG_REASON_CODE_UNUSED: Unused
  * @WLAN_LOG_REASON_ROAM_FAIL: Driver initiated roam has failed
@@ -217,6 +224,7 @@ enum log_event_indicator {
  * @WLAN_LOG_REASON_SME_OUT_OF_CMD_BUFL sme out of cmd buffer
  * @WLAN_LOG_REASON_NO_SCAN_RESULTS: no scan results to report from HDD
  * This enum contains the different reason codes for bug report
+ * @WLAN_LOG_REASON_SCAN_NOT_ALLOWED: scan not allowed due to connection states
  */
 enum log_event_host_reason_code {
 	WLAN_LOG_REASON_CODE_UNUSED,
@@ -237,6 +245,7 @@ enum log_event_host_reason_code {
 	WLAN_LOG_REASON_SME_OUT_OF_CMD_BUF,
 	WLAN_LOG_REASON_NO_SCAN_RESULTS,
 	WLAN_LOG_REASON_STALE_SESSION_FOUND,
+	WLAN_LOG_REASON_SCAN_NOT_ALLOWED,
 };
 
 
@@ -528,6 +537,7 @@ typedef struct sAniSirLim
     tLimScanChnInfo scanChnInfo;
 
     struct lim_scan_channel_status scan_channel_status;
+
     //////////////////////////////////////     SCAN/LEARN RELATED START ///////////////////////////////////////////
     tSirMacAddr         gSelfMacAddr;   //added for BT-AMP Support
 
@@ -1125,10 +1135,19 @@ typedef struct sMacOpenParameters
 #ifdef WLAN_FEATURE_NAN
     bool is_nan_enabled;
 #endif
+#ifdef WLAN_FEATURE_TSF_PLUS
+    bool is_ptp_enabled;
+#endif
     uint16_t  max_mgmt_tx_fail_count;
     bool force_target_assert_enabled;
     uint16_t pkt_bundle_timer_value;
     uint16_t pkt_bundle_size;
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+    uint8_t  del_ack_enable;
+    uint16_t del_ack_timer_value;
+    uint16_t del_ack_pkt_count;
+#endif
+    bool bpf_packet_filter_enable;
 
     struct ol_tx_sched_wrr_ac_specs_t ac_specs[OL_TX_NUM_WMM_AC];
 } tMacOpenParameters;
@@ -1271,6 +1290,13 @@ typedef struct sAniSirGlobal
     bool snr_monitor_enabled;
     /* channel information callback */
     void (*chan_info_cb)(struct scan_chan_info *chan_info);
+    uint8_t  sub20_config_info;
+    uint8_t  sub20_channelwidth;
+    uint8_t  sub20_dynamic_channelwidth;
+    uint8_t  sta_sub20_current_channelwidth;
+    bool     sta_change_cc_via_beacon;
+    bool max_power_cmd_pending;
+    uint32_t sta_auth_retries_for_code17;
 } tAniSirGlobal;
 
 typedef enum
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/aniSystemDefs.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/aniSystemDefs.h
index 2e666359fbb..ce8fcfd3ffe 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/aniSystemDefs.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/aniSystemDefs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -80,6 +80,11 @@ typedef enum eAniAuthType
 #if defined WLAN_FEATURE_VOWIFI_11R
     eSIR_FT_AUTH,
 #endif
+#ifdef WLAN_FEATURE_FILS_SK
+    eSIR_FILS_SK_WITHOUT_PFS = 4,
+    eSIR_FILS_SK_WITH_PFS = 5,
+    eSIR_FILS_PK_AUTH = 6,
+#endif
 #if defined FEATURE_WLAN_ESE
     eSIR_LEAP_AUTH = 0x80,
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/logDump.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/logDump.h
index 863b746c001..d8a22627fa3 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/logDump.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/logDump.h
@@ -65,7 +65,7 @@ typedef struct sRegList {
 int log_sprintf(tpAniSirGlobal pMac, char *pBuf, char *fmt, ... );
 
 #ifdef ANI_LOGDUMP
-void logPrintf(tpAniSirGlobal mac, tANI_U32 cmd,
+int logPrintf(tpAniSirGlobal mac, tANI_U32 cmd,
 			   tANI_U32 arg1, tANI_U32 arg2,
 			   tANI_U32 arg3, tANI_U32 arg4);
 #else
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/qwlan_version.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/qwlan_version.h
index e37a1dab79e..99777e6fdfa 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/qwlan_version.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/qwlan_version.h
@@ -39,12 +39,12 @@ BRIEF DESCRIPTION:
 ===========================================================================*/
 
 #define QWLAN_VERSION_MAJOR            4
-#define QWLAN_VERSION_MINOR            5
-#define QWLAN_VERSION_PATCH            50
-#define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            11
+#define QWLAN_VERSION_MINOR            0
+#define QWLAN_VERSION_PATCH            11
+#define QWLAN_VERSION_EXTRA            "P"
+#define QWLAN_VERSION_BUILD            213
 
-#define QWLAN_VERSIONSTR               "4.5.50.11"
+#define QWLAN_VERSIONSTR               "4.0.11.213P"
 
 
 #define AR6320_REV1_VERSION             0x5000000
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h
index b91ca1f2d8e..0b50aee66ed 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,11 +39,20 @@
 #ifndef __SIR_API_H
 #define __SIR_API_H
 
+/* Take care to avoid redefinition of this type, if it is */
+/* already defined in "halWmmApi.h" */
+#if !defined(_HALMAC_WMM_API_H)
+typedef struct sAniSirGlobal *tpAniSirGlobal;
+#endif
+
+#ifdef WLAN_FEATURE_FILS_SK
+#include "lim_fils_defs.h"
+#endif
 #include "sirTypes.h"
 #include "sirMacProtDef.h"
 #include "aniSystemDefs.h"
 #include "sirParams.h"
-
+#include <dot11f.h>
 #if defined(FEATURE_WLAN_ESE) && !defined(FEATURE_WLAN_ESE_UPLOAD)
 #include "eseGlobal.h"
 #endif
@@ -56,6 +65,8 @@
 
 #define SIR_MDIE_SIZE               3
 
+#define SIR_MAX_ELEMENT_ID          255
+
 // Increase dwell time for P2P search in ms
 #define P2P_SEARCH_DWELL_TIME_INCREASE   20
 #define P2P_SOCIAL_CHANNELS              3
@@ -89,16 +100,23 @@ typedef tANI_U8 tSirVersionString[SIR_VERSION_STRING_LEN];
 #define MAXNUM_PERIODIC_TX_PTRNS 6
 
 #define WIFI_SCANNING_MAC_OUI_LENGTH 3
+#define PROBE_REQ_BITMAP_LEN 8
 
 #define MAX_LEN_UDP_RESP_OFFLOAD 128
 
+/* Maximum number of realms present in fils indication element */
+#define SIR_MAX_REALM_COUNT 7
+/* Realm length */
+#define SIR_REALM_LEN 2
+/* Cache ID length */
+#define CACHE_ID_LEN 2
+
 #ifdef FEATURE_WLAN_EXTSCAN
 
 #define WLAN_EXTSCAN_MAX_CHANNELS                 36
 #define WLAN_EXTSCAN_MAX_BUCKETS                  16
 #define WLAN_EXTSCAN_MAX_HOTLIST_APS              128
 #define WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS   64
-#define WLAN_EXTSCAN_MAX_HOTLIST_SSIDS            8
 
 #define NUM_CHAINS_MAX  2
 
@@ -110,7 +128,6 @@ typedef tANI_U8 tSirVersionString[SIR_VERSION_STRING_LEN];
 #define ACS_FW_REPORT_PARAM_CONFIGURED false
 #endif
 
-
 typedef enum
 {
     eSIR_EXTSCAN_INVALID,
@@ -133,7 +150,6 @@ typedef enum
     eSIR_PASSPOINT_NETWORK_FOUND_IND,
     eSIR_EXTSCAN_SET_SSID_HOTLIST_RSP,
     eSIR_EXTSCAN_RESET_SSID_HOTLIST_RSP,
-    eSIR_EXTSCAN_HOTLIST_SSID_MATCH_IND,
 
     /* Keep this last */
     eSIR_EXTSCAN_CALLBACK_TYPE_MAX,
@@ -370,6 +386,20 @@ typedef enum eSirResultCodes
     eSIR_DONOT_USE_RESULT_CODE = SIR_MAX_ENUM_SIZE
 } tSirResultCodes;
 
+#ifdef WLAN_FEATURE_FILS_SK
+struct fils_join_rsp_params {
+    uint8_t *fils_pmk;
+    uint8_t fils_pmk_len;
+    uint8_t fils_pmkid[PMKID_LEN];
+    uint8_t kek[MAX_KEK_LEN];
+    uint8_t kek_len;
+    uint8_t tk[MAX_TK_LEN];
+    uint8_t tk_len;
+    uint8_t gtk_len;
+    uint8_t gtk[MAX_GTK_LEN];
+};
+#endif
+
 #define RMENABLEDCAP_MAX_LEN 5
 
 struct rrm_config_param
@@ -704,6 +734,7 @@ typedef struct sSirSmeStartBssReq
     uint8_t                 sap_dot11mc;
     bool                    vendor_vht_for_24ghz_sap;
     uint16_t                beacon_tx_rate;
+    uint8_t                 sub20_channelwidth;
 } tSirSmeStartBssReq, *tpSirSmeStartBssReq;
 
 #define GET_IE_LEN_IN_BSS(lenInBss) ( lenInBss + sizeof(lenInBss) - \
@@ -711,12 +742,30 @@ typedef struct sSirSmeStartBssReq
 
 #define WSCIE_PROBE_RSP_LEN (317 + 2)
 
+#ifdef WLAN_FEATURE_FILS_SK
+/* struct fils_ind_elements: elements parsed from fils indication present
+ * in beacon/probe resp
+ * @realm_cnt: number of realm present
+ * @realm: realms
+ * @is_fils_sk_supported: if FILS SK supported
+ * @is_cache_id_present: if cache id present
+ * @cache_id: cache id
+ */
+struct fils_ind_elements {
+    uint16_t realm_cnt;
+    uint8_t realm[SIR_MAX_REALM_COUNT][SIR_REALM_LEN];
+    bool is_fils_sk_supported;
+    bool is_cache_id_present;
+    uint8_t cache_id[CACHE_ID_LEN];
+};
+#endif
+
 typedef struct sSirBssDescription
 {
     //offset of the ieFields from bssId.
     tANI_U16             length;
     tSirMacAddr          bssId;
-    v_TIME_t             scanSysTimeMsec;
+    v_TIME_t             scansystimensec;
     tANI_U32             timeStamp[2];
     tANI_U16             beaconInterval;
     tANI_U16             capabilityInfo;
@@ -755,6 +804,9 @@ typedef struct sSirBssDescription
     tANI_U8              reservedPadding4;
     tANI_U32             tsf_delta;
 
+#ifdef WLAN_FEATURE_FILS_SK
+    struct fils_ind_elements fils_info_element;
+#endif
     tANI_U32             ieFields[1];
 } tSirBssDescription, *tpSirBssDescription;
 
@@ -943,6 +995,15 @@ typedef struct sSirSmeScanReq
     tANI_U16             uIEFieldLen;
     tANI_U16             uIEFieldOffset;
 
+    uint32_t enable_scan_randomization;
+    uint8_t mac_addr[VOS_MAC_ADDR_SIZE];
+    uint8_t mac_addr_mask[VOS_MAC_ADDR_SIZE];
+    bool ie_whitelist;
+    uint32_t probe_req_ie_bitmap[PROBE_REQ_BITMAP_LEN];
+    uint32_t num_vendor_oui;
+    uint32_t oui_field_len;
+    uint32_t oui_field_offset;
+
     //channelList MUST be the last field of this structure
     tSirChannelList channelList;
     /*-----------------------------
@@ -961,7 +1022,10 @@ typedef struct sSirSmeScanReq
       ----------------------------- <--+
       ... variable size uIEFiled
       up to uIEFieldLen (can be 0)
-      -----------------------------*/
+      -----------------------------
+      ... variable size upto num_vendor_oui
+      struct vendor_oui voui;
+    */
 } tSirSmeScanReq, *tpSirSmeScanReq;
 
 typedef struct sSirSmeScanAbortReq
@@ -1139,8 +1203,17 @@ typedef struct sSirSmeJoinReq
     tAniBool            spectrumMgtIndicator;
     tSirMacPowerCapInfo powerCap;
     tSirSupChnl         supportedChannels;
+    bool                force_24ghz_in_ht20;
+    uint8_t             sub20_channelwidth;
+#ifdef WLAN_FEATURE_FILS_SK
+    struct cds_fils_connection_info fils_con_info;
+#endif
     tSirBssDescription  bssDescription;
-
+    /*
+     * WARNING: Pls make bssDescription as last variable in struct
+     * tSirSmeJoinReq as it has ieFields followed after this bss
+     * description. Adding a variable after this corrupts the ieFields
+     */
 } tSirSmeJoinReq, *tpSirSmeJoinReq;
 
 /* Definition for response message to previously issued join request */
@@ -1194,6 +1267,16 @@ typedef struct sSirSmeJoinRsp
 #endif
 
     bool supported_nss_1x1;
+    tDot11fIEHTCaps ht_caps;
+    tDot11fIEVHTCaps vht_caps;
+    tDot11fIEHTInfo ht_operation;
+    tDot11fIEVHTOperation vht_operation;
+    tDot11fIEhs20vendor_ie hs20vendor_ie;
+#ifdef WLAN_FEATURE_FILS_SK
+    bool is_fils_connection;
+    uint16_t fils_seq_num;
+    struct fils_join_rsp_params *fils_join_rsp;
+#endif
     /* Add new members before 'frames' to avoid memory corruption of 'frames' */
     tANI_U8         frames[ 1 ];
 } tSirSmeJoinRsp, *tpSirSmeJoinRsp;
@@ -1239,7 +1322,16 @@ typedef struct sSirSmeChanInfo
     uint8_t  nss;
     /* rate flags */
     uint32_t rate_flags;
+    /* sub20 channelwidth */
+    uint32_t sub20_channelwidth;
 } tSirSmeChanInfo, *tpSirSmeChanInfo;
+
+enum sir_sme_phy_mode {
+	SIR_SME_PHY_MODE_LEGACY = 0,
+	SIR_SME_PHY_MODE_HT = 1,
+	SIR_SME_PHY_MODE_VHT = 2
+};
+
 /// Definition for Association indication from peer
 /// MAC --->
 typedef struct sSirSmeAssocInd
@@ -1275,6 +1367,19 @@ typedef struct sSirSmeAssocInd
     /* Timing and fine Timing measurement capability clubbed together */
     tANI_U8              timingMeasCap;
     tSirSmeChanInfo      chan_info;
+    /* Extended CSA capability of station */
+    uint8_t              ecsa_capable;
+    bool                 ampdu;
+    bool                 sgi_enable;
+    bool                 tx_stbc;
+    bool                 rx_stbc;
+    tSirMacHTChannelWidth ch_width;
+    enum sir_sme_phy_mode mode;
+    uint8_t              max_supp_idx;
+    uint8_t              max_ext_idx;
+    uint8_t              max_mcs_idx;
+    uint8_t              rx_mcs_map;
+    uint8_t              tx_mcs_map;
 } tSirSmeAssocInd, *tpSirSmeAssocInd;
 
 
@@ -1731,6 +1836,15 @@ typedef struct sSirSmeDeauthCnf
     tSirMacAddr        peerMacAddr;
 } tSirSmeDeauthCnf, *tpSirSmeDeauthCnf;
 
+/* Definition for disconnect done indication */
+typedef struct sSirSmeDisConDoneInd {
+   tANI_U16           messageType;
+   tANI_U16           length;
+   tANI_U8            sessionId;
+   tSirResultCodes    reasonCode;
+   tSirMacAddr        peerMacAddr;
+} tSirSmeDisConDoneInd, *tpSirSmeDisConDoneInd;
+
 /// Definition for stop BSS request message
 typedef struct sSirSmeStopBssReq
 {
@@ -1796,6 +1910,17 @@ typedef struct sSirSmeNeighborBssInd
     tSirBssDescription     bssDescription[1];
 } tSirSmeNeighborBssInd, *tpSirSmeNeighborBssInd;
 
+/**
+ * sir_sme_rx_aggr_hole_ind - sme rx aggr hole indication
+ * @hole_cnt: num of holes detected
+ * @hole_info_array: hole info
+ */
+struct sir_sme_rx_aggr_hole_ind
+{
+	uint32_t hole_cnt;
+	uint32_t hole_info_array[];
+};
+
 /*
  * Definition for MIC failure indication
  * MAC --->
@@ -2915,7 +3040,6 @@ typedef struct sSirSmePreSwitchChannelInd
     tANI_U8   sessionId;
 } tSirSmePreSwitchChannelInd, *tpSirSmePreSwitchChannelInd;
 
-
 //
 // HDD -> LIM
 // tSirMsgQ.type = eWNI_SME_DEL_BA_PEER_IND
@@ -2989,21 +3113,25 @@ typedef struct sLimScanChn
  * @rx_frame_count: rx frame count (cumulative)
  * @bss_rx_cycle_count: BSS rx cycle count
  * @rx_11b_mode_data_duration: b-mode data rx time (units are microseconds)
+ * @tx_frame_count: BSS tx cycle count
+ * @mac_clk_mhz: sample frequency
  * @channel_id: channel index
  * @cmd_flags: indicate which stat event is this status coming from
  */
 struct lim_channel_status {
-       uint32_t    channelfreq;
-       uint32_t    noise_floor;
-       uint32_t    rx_clear_count;
-       uint32_t    cycle_count;
-       uint32_t    chan_tx_pwr_range;
-       uint32_t    chan_tx_pwr_throughput;
-       uint32_t    rx_frame_count;
-       uint32_t    bss_rx_cycle_count;
-       uint32_t    rx_11b_mode_data_duration;
-       uint32_t    channel_id;
-       uint32_t    cmd_flags;
+	uint32_t    channelfreq;
+	uint32_t    noise_floor;
+	uint32_t    rx_clear_count;
+	uint32_t    cycle_count;
+	uint32_t    chan_tx_pwr_range;
+	uint32_t    chan_tx_pwr_throughput;
+	uint32_t    rx_frame_count;
+	uint32_t    bss_rx_cycle_count;
+	uint32_t    rx_11b_mode_data_duration;
+	uint32_t    tx_frame_count;
+	uint32_t    mac_clk_mhz;
+	uint32_t    channel_id;
+	uint32_t    cmd_flags;
 };
 
 typedef struct sSmeGetScanChnRsp
@@ -3029,12 +3157,11 @@ typedef struct sLimScanChnInfo
  * @channel_status_list: channel status info store in this array
  */
 struct lim_scan_channel_status {
-       uint8_t total_channel;
-       struct lim_channel_status
-        channel_status_list[SIR_MAX_SUPPORTED_ACS_CHANNEL_LIST];
+	uint8_t total_channel;
+	struct lim_channel_status
+	 channel_status_list[SIR_MAX_SUPPORTED_ACS_CHANNEL_LIST];
 };
 
-
 typedef struct sSirSmeGetAssocSTAsReq
 {
     tANI_U16    messageType;    // eWNI_SME_GET_ASSOC_STAS_REQ
@@ -3757,6 +3884,18 @@ typedef struct
 } tSirNetworkType;
 
 /**
+ * struct connected_pno_band_rssi_pref - BSS preference based on band
+ * and RSSI
+ * @band: band preference
+ * @rssi_pref: RSSI preference
+ */
+struct connected_pno_band_rssi_pref
+{
+	tSirRFBand band;
+	int8_t rssi;
+};
+
+/**
  * struct sSirPNOScanReq - PNO Scan request structure
  * @enable: flag to enable or disable
  * @modePNO: PNO Mode
@@ -3775,6 +3914,10 @@ typedef struct
  * @p24GProbeTemplate: 2.4G probe template
  * @us5GProbeTemplateLen: 5G probe template length
  * @p5GProbeTemplate: 5G probe template
+ * @relative_rssi_set: Flag to check whether realtive_rssi is set or not
+ * @relative_rssi: Relative rssi threshold, used for connected pno
+ * @band_rssi_pref: Band and RSSI preference that can be given to one BSS
+ * over the other BSS
  */
 typedef struct sSirPNOScanReq {
 	uint8_t         enable;
@@ -3796,6 +3939,19 @@ typedef struct sSirPNOScanReq {
 	uint8_t         p24GProbeTemplate[SIR_PNO_MAX_PB_REQ_SIZE];
 	uint16_t        us5GProbeTemplateLen;
 	uint8_t         p5GProbeTemplate[SIR_PNO_MAX_PB_REQ_SIZE];
+
+	bool            relative_rssi_set;
+	int8_t          relative_rssi;
+	struct          connected_pno_band_rssi_pref band_rssi_pref;
+
+	/* mac address randomization attributes */
+	uint32_t enable_pno_scan_randomization;
+	uint8_t mac_addr[VOS_MAC_ADDR_SIZE];
+	uint8_t mac_addr_mask[VOS_MAC_ADDR_SIZE];
+	bool ie_whitelist;
+	uint32_t probe_req_ie_bitmap[PROBE_REQ_BITMAP_LEN];
+	uint32_t num_vendor_oui;
+	/* followed by one or more struct vendor_oui */
 } tSirPNOScanReq, *tpSirPNOScanReq;
 
 typedef struct sSirSetRSSIFilterReq
@@ -3817,7 +3973,7 @@ typedef struct sSirSetRSSIFilterReq
  * SIR_MAC_ACTION_DLP              2      0
  * SIR_MAC_ACTION_BLKACK           3      0
  * SIR_MAC_ACTION_PUBLIC_USAGE     4      1
- * SIR_MAC_ACTION_RRM              5      1
+ * SIR_MAC_ACTION_RRM              5      0
  * SIR_MAC_ACTION_FAST_BSS_TRNST   6      0
  * SIR_MAC_ACTION_HT               7      0
  * SIR_MAC_ACTION_SA_QUERY         8      1
@@ -3837,7 +3993,6 @@ typedef struct sSirSetRSSIFilterReq
 		((1 << SIR_MAC_ACTION_SPECTRUM_MGMT) | \
 		 (1 << SIR_MAC_ACTION_QOS_MGMT) | \
 		 (1 << SIR_MAC_ACTION_PUBLIC_USAGE) | \
-		 (1 << SIR_MAC_ACTION_RRM) | \
 		 (1 << SIR_MAC_ACTION_SA_QUERY) | \
 		 (1 << SIR_MAC_ACTION_WNM) | \
 		 (1 << SIR_MAC_ACTION_WME) | \
@@ -3854,6 +4009,26 @@ typedef struct sSirSetRSSIFilterReq
 #define ALLOWED_ACTION_FRAMES_BITMAP5	0x0
 #define ALLOWED_ACTION_FRAMES_BITMAP6	0x0
 #define ALLOWED_ACTION_FRAMES_BITMAP7	0x0
+
+/*
+ * DROP_SPEC_MGMT_ACTION_FRAME_BITMAP
+ *
+ * Bitmask is based on the below. The frames with 1's
+ * set to their corresponding bit can be dropped in FW.
+ *
+ * ----------------------------------+-----+------+
+ *         Type                      | Bit | Drop |
+ * ----------------------------------+-----+------+
+ * SIR_MAC_ACTION_MEASURE_REQUEST_ID    0     1
+ * SIR_MAC_ACTION_TPC_REQUEST_ID        1     1
+ * ----------------------------------+-----+------+
+ */
+#define DROP_SPEC_MGMT_ACTION_FRAME_BITMAP \
+		((1 << SIR_MAC_ACTION_MEASURE_REQUEST_ID) |\
+		 (1 << SIR_MAC_ACTION_MEASURE_REPORT_ID) |\
+		 (1 << SIR_MAC_ACTION_TPC_REPORT_ID) |\
+		 (1 << SIR_MAC_ACTION_TPC_REQUEST_ID))
+
 /**
  * struct sir_allowed_action_frames - Parameters to set Allowed action frames
  * @operation: 0 reset to fw default, 1 set the bits,
@@ -3863,6 +4038,7 @@ typedef struct sSirSetRSSIFilterReq
 struct sir_allowed_action_frames {
 	uint32_t operation;
 	uint32_t action_category_map[SIR_MAC_ACTION_MAX / 32];
+	uint32_t action_per_category[SIR_MAC_ACTION_MAX];
 };
 
 // Update Scan Params
@@ -4089,7 +4265,7 @@ typedef struct sSirTxPerTrackingParam
 #define    SIR_IPV4_ADDR_LEN                 4
 #define    SIR_MAC_ADDR_LEN                  6
 #define    SIR_MAX_FILTER_TEST_DATA_LEN       8
-#define    SIR_MAX_NUM_MULTICAST_ADDRESS    240
+#define    SIR_MAX_NUM_MULTICAST_ADDRESS    16
 #define    SIR_MAX_NUM_FILTERS               20
 #define    SIR_MAX_NUM_TESTS_PER_FILTER      10
 
@@ -4382,6 +4558,7 @@ typedef struct
     tANI_U16            transactionId; // Transaction ID for cmd
     tSirResultCodes        statusCode;
     tSirMacAddr            peerMac;
+    uint16_t            sta_idx;
 }tSirTdlsLinkEstablishReqRsp, *tpSirTdlsLinkEstablishReqRsp;
 
 /* TDLS Request struct SME-->PE */
@@ -4453,6 +4630,7 @@ typedef struct sSirActiveModeSetBcnFilterReq
    tANI_U16               messageType;
    tANI_U16               length;
    tANI_U8                seesionId;
+   tSirMacAddr            bssid;
 } tSirSetActiveModeSetBncFilterReq, *tpSirSetActiveModeSetBncFilterReq;
 
 //Reset AP Caps Changed
@@ -4516,6 +4694,17 @@ typedef struct sSirScanOffloadReq {
     tSirP2pScanType p2pScanType;
     tANI_U16 uIEFieldLen;
     tANI_U16 uIEFieldOffset;
+
+    uint32_t burst_scan_duration;
+    uint32_t enable_scan_randomization;
+    uint8_t mac_addr[VOS_MAC_ADDR_SIZE];
+    uint8_t mac_addr_mask[VOS_MAC_ADDR_SIZE];
+    bool ie_whitelist;
+    uint32_t probe_req_ie_bitmap[PROBE_REQ_BITMAP_LEN];
+    uint32_t num_vendor_oui;
+    uint32_t oui_field_len;
+    uint32_t oui_field_offset;
+
     tSirChannelList channelList;
     /*-----------------------------
       sSirScanOffloadReq....
@@ -4533,7 +4722,10 @@ typedef struct sSirScanOffloadReq {
       ----------------------------- <--+
       ... variable size uIEField
       up to uIEFieldLen (can be 0)
-      -----------------------------*/
+      -----------------------------
+      ... variable size upto num_vendor_oui
+      struct vendor_oui voui;
+      ------------------------*/
 } tSirScanOffloadReq, *tpSirScanOffloadReq;
 
 /**
@@ -4704,42 +4896,111 @@ typedef struct sSirLinkSpeedInfo
 
 
 /*
- * struct sir_rssi_req - rssi request struct
+ * struct sir_peer_info_req - peer info request struct
  * @peer_macaddr: MAC address
  * @sessionId: vdev id
  *
- * rssi request message's struct
+ * peer info request message's struct
  */
-struct sir_rssi_req {
+struct sir_peer_info_req {
 	v_MACADDR_t peer_macaddr;
-	uint8_t sessionId;
+	uint8_t sessionid;
 };
 
 
 /*
- * struct sir_rssi_info - rssi information struct
+ * struct sir_peer_info - peer information struct
  * @peer_macaddr: MAC address
  * @rssi: rssi
+ * @tx_rate: last tx rate
+ * @rx_rate: last rx rate
  *
- * a station's rssi information
+ * a station's information
  */
-struct sir_rssi_info {
+struct sir_peer_info {
 	tSirMacAddr peer_macaddr;
 	int8_t rssi;
+	uint32_t tx_rate;
+	uint32_t rx_rate;
 };
 
 /*
- * struct sir_rssi_info - all peers rssi information struct
+ * struct sir_peer_info_resp - all peers information struct
+ * @count: peer's number
+ * @info: peer information
+ *
+ * all station's information
+ */
+struct sir_peer_info_resp {
+	uint8_t count;
+	struct sir_peer_info info[0];
+};
+
+/**
+ * struct sir_peer_info_ext_req - peer info request struct
+ * @peer_macaddr: MAC address
+ * @sessionId: vdev id
+ * @reset_after_request: fw reset statistics after query
+ *
+ * peer info request message's struct
+ */
+struct sir_peer_info_ext_req {
+	v_MACADDR_t peer_macaddr;
+	uint8_t sessionid;
+	uint8_t reset_after_request;
+};
+
+/**
+ * struct sir_peer_info_ext - peer info information struct
+ *                            (refer to station_info struct in Kernel)
+ * @peer_macaddr: MAC address
+ * @tx_packets: packets transmitted to this station
+ * @tx_bytes: bytes transmitted to this station
+ * @rx_packets: packets received from this station
+ * @rx_bytes: bytes received from this station
+ * @rx_retries: cumulative retry counts
+ * @tx_failed: number of failed transmissions
+ * @rssi: The signal strength
+ * @tx_rate: last used tx bitrate (kbps)
+ * @tx_rate_code: last tx rate code (last_tx_rate_code of wmi_peer_stats_info)
+ * @rx_rate: last used rx bitrate (kbps)
+ * @rx_rate_code: last rx rate code (last_rx_rate_code of wmi_peer_stats_info)
+ *
+ * a station's information
+ */
+struct sir_peer_info_ext {
+	tSirMacAddr peer_macaddr;
+	uint32_t tx_packets;
+	uint64_t tx_bytes;
+	uint32_t rx_packets;
+	uint64_t rx_bytes;
+	uint32_t tx_retries;
+	uint32_t tx_failed;
+	int32_t rssi;
+	uint32_t tx_rate;
+	uint32_t tx_rate_code;
+	uint32_t rx_rate;
+	uint32_t rx_rate_code;
+};
+
+/**
+ * struct sir_peer_info_ext_resp - all peers' information struct
  * @count: peer's number
- * @info: rssi information
+ * @info: peer information
  *
- * all station's rssi information
+ * all station's information
  */
-struct sir_rssi_resp {
+struct sir_peer_info_ext_resp {
 	uint8_t count;
-	struct sir_rssi_info info[0];
+	struct sir_peer_info_ext info[0];
 };
 
+struct sir_isolation_resp {
+    uint32_t isolation_chain0:8,    //[7:0],   isolation value for chain 0
+             isolation_chain1:8,    //[15:8],  isolation value for chain 1
+             isolation_chain2:8,    //[23:16], isolation value for chain 2
+             isolation_chain3:8;    //[31:24], isolation value for chain 3
+};
 
 typedef struct sSirAddPeriodicTxPtrn
 {
@@ -4904,6 +5165,7 @@ typedef struct sSirChanChangeRequest
     tANI_U32     dot11mode;
     tSirMacRateSet      operational_rateset;
     tSirMacRateSet      extended_rateset;
+    uint8_t             sub20_channelwidth;
 }tSirChanChangeRequest, *tpSirChanChangeRequest;
 
 typedef struct sSirChanChangeResponse
@@ -4992,6 +5254,11 @@ typedef struct sSirDfsCsaIeRequest
     tANI_U8  csaIeRequired;
     tANI_U8  bssid[VOS_MAC_ADDR_SIZE];
     u_int8_t  ch_bandwidth;
+    uint8_t  sub20_channelwidth;
+    uint8_t  ch_switch_beacon_cnt;
+    uint8_t  ch_switch_mode;
+    uint8_t  dfs_ch_switch_disable;
+    uint8_t  sub20_switch_mode;
 }tSirDfsCsaIeRequest, *tpSirDfsCsaIeRequest;
 
 /* Indication from lower layer indicating the completion of first beacon send
@@ -5034,8 +5301,16 @@ typedef struct{
     u_int8_t thermalCurrLevel;
     u_int8_t thermalMgmtEnabled;
     u_int32_t throttlePeriod;
-    u_int8_t throttle_duty_cycle_2g_tbl[WLAN_THROTTLE_DUTY_CYCLE_LEVEL_MAX];
-    u_int8_t throttle_duty_cycle_5g_tbl[WLAN_THROTTLE_DUTY_CYCLE_LEVEL_MAX];
+    u_int8_t throttle_duty_cycle_tbl[WLAN_THROTTLE_DUTY_CYCLE_LEVEL_MAX];
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+    uint8_t  thermal_shutdown_enabled;
+    uint8_t  thermal_shutdown_auto_enabled;
+    uint16_t thermal_resume_threshold;
+    uint16_t thermal_warning_threshold;
+    uint16_t thermal_suspend_threshold;
+    uint16_t thermal_sample_rate;
+#endif
+
 } t_thermal_mgmt, *tp_thermal_mgmt;
 
 typedef struct sSirTxPowerLimit
@@ -5263,6 +5538,7 @@ struct ext_scan_capabilities_response
 	uint32_t    max_number_epno_networks;
 	uint32_t    max_number_epno_networks_by_ssid;
 	uint32_t    max_number_of_white_listed_ssid;
+	uint32_t    max_number_of_black_listed_bssid;
 };
 
 
@@ -5387,6 +5663,18 @@ struct extscan_cached_scan_results
 	struct extscan_cached_scan_result  *result;
 };
 
+/**
+ * struct chain_rssi_result - chain rssi result
+ * @chain_rssi: chain rssi result
+ * @ant_id: antenna id
+ */
+struct chain_rssi_result
+{
+	#define CHAIN_MAX_NUM  8
+	uint32_t num_chains_valid;
+	uint32_t chain_rssi[CHAIN_MAX_NUM];
+	uint32_t ant_id[CHAIN_MAX_NUM];
+};
 
 /**
  * struct tSirWifiFullScanResultEvent - extscan full scan event
@@ -5394,6 +5682,7 @@ struct extscan_cached_scan_results
  * @moreData: 0 - for last fragment
  *             1 - still more fragment(s) coming
  * @ap: bssid info
+ * @bss_description: BSS description
  *
  * Reported when each probe response is received, if reportEvents
  * enabled in tSirWifiScanCmdReqParams
@@ -5403,6 +5692,7 @@ typedef struct
 	uint32_t            requestId;
 	bool                moreData;
 	tSirWifiScanResult  ap;
+	tSirBssDescription bss_description;
 } tSirWifiFullScanResultEvent, *tpSirWifiFullScanResultEvent;
 
 /**
@@ -5565,37 +5855,6 @@ typedef struct
 } tSirExtScanResetBssidHotlistReqParams,
   *tpSirExtScanResetBssidHotlistReqParams;
 
-/**
- * struct sir_ssid_hotlist_param - param for SSID Hotlist
- * @ssid: SSID which is being hotlisted
- * @band: Band in which the given SSID should be scanned
- * @rssi_low: Low bound on RSSI
- * @rssi_high: High bound on RSSI
- */
-struct sir_ssid_hotlist_param {
-	tSirMacSSid ssid;
-	uint8_t band;
-	int32_t rssi_low;
-	int32_t rssi_high;
-};
-
-/**
- * struct sir_set_ssid_hotlist_request - set SSID hotlist request struct
- * @request_id: ID of the request
- * @session_id: ID of the session
- * @lost_ssid_sample_size: Number of consecutive scans in which the SSID
- *	must not be seen in order to consider the SSID "lost"
- * @ssid_count: Number of valid entries in the @ssids array
- * @ssids: Array that defines the SSIDs that are in the hotlist
- */
-struct sir_set_ssid_hotlist_request {
-	uint32_t request_id;
-	uint8_t session_id;
-	uint32_t lost_ssid_sample_size;
-	uint32_t ssid_count;
-	struct sir_ssid_hotlist_param ssids[WLAN_EXTSCAN_MAX_HOTLIST_SSIDS];
-};
-
 typedef struct
 {
     tANI_U32              requestId;
@@ -5704,6 +5963,7 @@ struct wifi_epno_params
 	struct wifi_epno_network networks[];
 };
 
+#define SIR_PASSPOINT_LIST_MAX_NETWORKS 8
 #define SIR_PASSPOINT_REALM_LEN 256
 #define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16
 #define SIR_PASSPOINT_PLMN_LEN 3
@@ -5791,9 +6051,47 @@ typedef struct
   tANI_U8   stopReq;
 } tSirLLStatsClearReq, *tpSirLLStatsClearReq;
 
+/**
+ * struct vendor_oui - probe request ie vendor oui information
+ * @oui_type: type of the vendor oui (3 valid octets)
+ * @oui_subtype: subtype of the vendor oui (1 valid octet)
+ */
+struct vendor_oui {
+	uint32_t oui_type;
+	uint32_t oui_subtype;
+};
+
+#ifdef WLAN_POWER_DEBUGFS
+/**
+ * struct power_stats_response - Power stats response
+ * @cumulative_sleep_time_ms: cumulative sleep time in ms
+ * @cumulative_total_on_time_ms: total awake time in ms
+ * @deep_sleep_enter_counter: deep sleep enter counter
+ * @last_deep_sleep_enter_tstamp_ms: last deep sleep enter timestamp
+ * @debug_register_fmt: debug registers format
+ * @num_debug_register: number of debug registers
+ * @debug_registers: Pointer to the debug registers buffer
+ */
+struct power_stats_response {
+	uint32_t cumulative_sleep_time_ms;
+	uint32_t cumulative_total_on_time_ms;
+	uint32_t deep_sleep_enter_counter;
+	uint32_t last_deep_sleep_enter_tstamp_ms;
+	uint32_t debug_register_fmt;
+	uint32_t num_debug_register;
+	uint32_t *debug_registers;
+};
+#endif
+
 typedef struct
 {
     tANI_U8 oui[WIFI_SCANNING_MAC_OUI_LENGTH];
+    uint32_t vdev_id;
+    uint32_t enb_probe_req_sno_randomization;
+    bool ie_whitelist;
+    uint32_t probe_req_ie_bitmap[PROBE_REQ_BITMAP_LEN];
+    uint32_t num_vendor_oui;
+    /* Followed by 0 or more struct vendor_oui */
 } tSirScanMacOui, *tpSirScanMacOui;
 
 enum {
@@ -6059,8 +6357,13 @@ typedef struct
     tSirMacAddr    peerMacAddress;
     /* peer WIFI_CAPABILITY_XXX */
     tANI_U32       capabilities;
-    /* number of rates */
-    tANI_U32       numRate;
+
+    union {
+        /* peer power saving mode */
+        uint32_t power_saving;
+        /* number of rates */
+        tANI_U32       numRate;
+    };
     /* per rate statistics, number of entries  = num_rate */
     tSirWifiRateStat rateStats[0];
 } tSirWifiPeerInfo, *tpSirWifiPeerInfo;
@@ -6101,6 +6404,8 @@ typedef struct
     tANI_U32 contentionTimeAvg;
     /* num of data pkts used for contention statistics */
     tANI_U32 contentionNumSamples;
+    /* num of pending msdu */
+    tANI_U32 pending_msdu;
 } tSirWifiWmmAcStat, *tpSirWifiWmmAcStat;
 
 /* Interface statistics - corresponding to 2nd most
@@ -6146,6 +6451,10 @@ typedef struct
         time driver waits before shutting down the radio or switching the channel and after receiving an ACK for
         a data frame with PM bit set) */
     tANI_U32 rx_leak_window;
+    uint32_t rts_succ_cnt;
+    uint32_t rts_fail_cnt;
+    uint32_t ppdu_succ_cnt;
+    uint32_t ppdu_fail_cnt;
     /* per ac data packet statistics */
     tSirWifiWmmAcStat    AccessclassStats[WIFI_AC_MAX];
 } tSirWifiIfaceStat, *tpSirWifiIfaceStat;
@@ -6189,6 +6498,486 @@ typedef struct
 /** Clear particular peer stats depending on the peer_mac */
 #define WIFI_STATS_IFACE_PER_PEER      0x00000200
 
+/**
+ * struct sir_wifi_iface_tx_fail - TX failure event
+ * @tid: TX TID
+ * @msdu_num: TX MSDU failed counter
+ * @status: failure status
+ *    1: TX packet discarded
+ *    2: No ACK
+ *    3: Postpone
+ */
+struct sir_wifi_iface_tx_fail {
+	uint8_t  tid;
+	uint16_t msdu_num;
+	uint32_t status;
+};
+
+/**
+ * struct sir_wifi_chan_cca_stats - channal CCA stats
+ * @vdev_id: vdev ID
+ * @idle_time: percentage of idle time, no TX, no RX, no interference
+ * @tx_time: percentage of time transmitting packets
+ * @rx_in_bss_time: percentage of time receiving packets in current BSS
+ * @rx_out_bss_time: percentage of time receiving packets not in current BSS
+ * @rx_busy_time: percentage of time interference detected
+ * @rx_in_bad_cond_time: percentage of time receiving packets with errors
+ *	or packets flagged as retransmission or seqnum discontinued.
+ * @tx_in_bad_cond_time: percentage of time the device transmitted packets
+ *	that haven't been ACKed.
+ * @wlan_not_avail_time: percentage of time the chip is unable to
+ *	work in normal conditions.
+ */
+struct sir_wifi_chan_cca_stats {
+	uint32_t vdev_id;
+	uint32_t idle_time;
+	uint32_t tx_time;
+	uint32_t rx_in_bss_time;
+	uint32_t rx_out_bss_time;
+	uint32_t rx_busy_time;
+	uint32_t rx_in_bad_cond_time;
+	uint32_t tx_in_bad_cond_time;
+	uint32_t wlan_not_avail_time;
+};
+
+#define WIFI_MAX_CHAINS                 8
+
+/**
+ * struct sir_wifi_peer_signal_stats - peer signal stats
+ * @vdev_id: vdev ID
+ * @peer_id: peer ID
+ * @per_ant_snr: per antenna SNR
+ * @nf: peer background noise
+ * @per_ant_rx_mpdus: MPDUs received per antenna
+ * @per_ant_tx_mpdus: MPDUs transferred per antenna
+ * @num_chain: valid chain count
+ */
+struct sir_wifi_peer_signal_stats {
+	uint32_t vdev_id;
+	uint32_t peer_id;
+
+	/* per antenna SNR in current bss */
+	int32_t per_ant_snr[WIFI_MAX_CHAINS];
+
+	/* Background noise */
+	int32_t nf[WIFI_MAX_CHAINS];
+
+	int32_t per_ant_rx_mpdus[WIFI_MAX_CHAINS];
+	int32_t per_ant_tx_mpdus[WIFI_MAX_CHAINS];
+	int32_t num_chain;
+};
+
+#define WIFI_VDEV_NUM		4
+#define WFIF_MCS_NUM		10
+#define WIFI_AGGR_NUM		8
+#define WIFI_DELAY_SIZE	11
+
+/**
+ * struct sir_wifi_tx - per AC tx stats
+ * @msdus: number of totoal MSDUs on MAC layer in the period
+ * @mpdus: number of totoal MPDUs on MAC layer in the period
+ * @ppdus: number of totoal PPDUs on PHY layer in the period
+ * @bytes: bytes of tx data on MAC layer in the period
+ * @drops: number of TX packets cancelled due to any reason in the period,
+ *	such as WMM limitation/bandwidth limitation/radio congestion
+ * @drop_bytes: bytes of dropped TX packets in the period
+ * @retries: number of unacked transmissions of MPDUs
+ * @failed: number of packets have not been ACKed despite retried
+ * @aggr_len: length of the MPDU aggregation size buffer
+ * @mpdu_aggr_size: histogram of MPDU aggregation size
+ * @success_mcs_len: length of success mcs buffer
+ * @success_mcs: histogram of successed received MPDUs encoding rate
+ * @fail_mcs_len: length of failed mcs buffer
+ * @fail_mcs: histogram of failed received MPDUs encoding rate
+ * @delay_len: length of the delay histofram buffer
+ * @delay: histogram of delays on MAC layer
+ */
+struct sir_wifi_tx {
+	uint32_t msdus;
+	uint32_t mpdus;
+	uint32_t ppdus;
+	uint32_t bytes;
+	uint32_t drops;
+	uint32_t drop_bytes;
+	uint32_t retries;
+	uint32_t failed;
+	uint32_t aggr_len;
+	uint32_t *mpdu_aggr_size;
+	uint32_t success_mcs_len;
+	uint32_t *success_mcs;
+	uint32_t fail_mcs_len;
+	uint32_t *fail_mcs;
+	uint32_t delay_len;
+	uint32_t *delay;
+};
+
+/**
+ * struct sir_wifi_rx - per AC rx stats
+ * @mpdus: number of RX packets on MAC layer
+ * @bytes: bytes of RX packets on MAC layer
+ * @ppdus: number of RX packets on PHY layer
+ * @ppdu_bytes: bytes of RX packets on PHY layer
+ * @mpdu_lost: number of discontinuity in seqnum
+ * @mpdu_retry: number of RX packets flagged as retransmissions
+ * @mpdu_dup: number of RX packets identified as duplicates
+ * @mpdu_discard: number of RX packets discarded
+ * @aggr_len: length of MPDU aggregation histogram buffer
+ * @mpdu_aggr: histogram of MPDU aggregation size
+ * @mcs_len: length of mcs histogram buffer
+ * @mcs: histogram of encoding rate.
+ */
+struct sir_wifi_rx {
+	uint32_t mpdus;
+	uint32_t bytes;
+	uint32_t ppdus;
+	uint32_t ppdu_bytes;
+	uint32_t mpdu_lost;
+	uint32_t mpdu_retry;
+	uint32_t mpdu_dup;
+	uint32_t mpdu_discard;
+	uint32_t aggr_len;
+	uint32_t *mpdu_aggr;
+	uint32_t mcs_len;
+	uint32_t *mcs;
+};
+
+/**
+ * struct sir_wifi_ll_ext_wmm_ac_stats - stats for WMM AC
+ * @type: WMM AC type
+ * @tx_stats: pointer to TX stats
+ * @rx_stats: pointer to RX stats
+ */
+struct sir_wifi_ll_ext_wmm_ac_stats {
+	uint32_t type;
+	struct sir_wifi_tx *tx_stats;
+	struct sir_wifi_rx *rx_stats;
+};
+
+#define WIFI_INVALID_PEER_ID		(-1)
+#define WIFI_INVALID_VDEV_ID		(-1)
+#define WIFI_MAX_AC                     (4)
+
+/**
+ * struct sir_wifi_ll_ext_peer_stats - per peer stats
+ * @peer_id: peer ID
+ * @vdev_id: VDEV ID
+ * mac_address: MAC address
+ * @sta_ps_inds: how many times STAs go to sleep
+ * @sta_ps_durs: total sleep time of STAs (units in ms)
+ * @rx_probe_reqs: number of probe requests received
+ * @rx_oth_mgmts: number of other management frames received,
+ *		  not including probe requests
+ * @peer_signal_stat: signal stats
+ * @ac_stats: WMM BE/BK/VI/VO stats
+ */
+struct sir_wifi_ll_ext_peer_stats {
+	uint32_t peer_id;
+	uint32_t vdev_id;
+	tSirMacAddr mac_address;
+	uint32_t sta_ps_inds;
+	uint32_t sta_ps_durs;
+	uint32_t rx_probe_reqs;
+	uint32_t rx_oth_mgmts;
+	struct sir_wifi_peer_signal_stats peer_signal_stats;
+	struct sir_wifi_ll_ext_wmm_ac_stats ac_stats[WIFI_MAX_AC];
+};
+
+/**
+ * struct sir_wifi_ll_ext_time_stamp - time stamp for stats report
+ * @duration: the count duration on fw side for this report
+ * @end_time: timestamp when LL stats reported to user layer
+ */
+struct sir_wifi_ll_ext_period {
+	uint32_t duration;
+	v_TIME_t end_time;
+};
+
+/**
+ * struct sir_wifi_ll_ext_stats - link layer stats report
+ * @trigger_cond_id:  Indicate what triggered this event.
+ *	1: timeout. 2: threshold
+ * @cca_chgd_bitmap: Bitmap to indicate changed channel CCA stats
+ *	which exceeded the thresholds
+ * @sig_chgd_bitmap: Bitmap to indicate changed peer signal stats
+ *	which exceeded the thresholds
+ * @tx_chgd_bitmap: Bitmap to indicate changed TX counters
+ *	which exceeded the thresholds
+ * @rx_chgd_bitmap: Bitmap to indicate changed RX counters
+ *	which exceeded the thresholds
+ * @chan_cca_stats: channel CCA stats
+ * @peer_signal_stats: peer signal stats
+ * @tx_mpdu_aggr_array_len: length of TX MPDU aggregation buffer
+ * @tx_succ_mcs_array_len: length of mcs buffer for ACKed MPDUs
+ * @tx_fail_mcs_array_len: length of mcs buffer for no-ACKed MPDUs
+ * @tx_delay_array_len: length of delay stats buffer
+ * @rx_mpdu_aggr_array_len: length of RX MPDU aggregation buffer
+ * @rx_mcs_array_len: length of RX mcs stats buffer
+ * @peer_stats: peer stats
+ * @cca: physical channel CCA stats
+ * @stats: pointer to stats data buffer.
+ *
+ * Structure of the whole statictics is like this:
+ *     ---------------------------------
+ *     |      trigger_cond_i           |
+ *     +-------------------------------+
+ *     |      cca_chgd_bitmap          |
+ *     +-------------------------------+
+ *     |      sig_chgd_bitmap          |
+ *     +-------------------------------+
+ *     |      tx_chgd_bitmap           |
+ *     +-------------------------------+
+ *     |      rx_chgd_bitmap           |
+ *     +-------------------------------+
+ *     |      peer_num                 |
+ *     +-------------------------------+
+ *     |      channel_num              |
+ *     +-------------------------------+
+ *     |      time stamp               |
+ *     +-------------------------------+
+ *     |      tx_mpdu_aggr_array_len   |
+ *     +-------------------------------+
+ *     |      tx_succ_mcs_array_len    |
+ *     +-------------------------------+
+ *     |      tx_fail_mcs_array_len    |
+ *     +-------------------------------+
+ *     |      tx_delay_array_len       |
+ *     +-------------------------------+
+ *     |      rx_mpdu_aggr_array_len   |
+ *     +-------------------------------+
+ *     |      rx_mcs_array_len         |
+ *     +-------------------------------+
+ *     |      pointer to CCA stats     |
+ *     +-------------------------------+
+ *     |      pointer to peer stats    |
+ *     +-------------------------------+
+ *     |      CCA stats                |
+ *     +-------------------------------+
+ *     |      peer_stats               |----+
+ *     +-------------------------------+    |
+ *     |      per peer signals stats   |<---+
+ *     |        peer0 ~ peern          |    |
+ *     +-------------------------------+    |
+ *     | TX aggr/mcs parameters array  |    |
+ *     | Length of this buffer is      |    |
+ *     | configurable for user layer.  |<-+ |
+ *     +-------------------------------+  | |
+ *     |      per peer tx stats        |--+ |
+ *     |         BE                    | <--+
+ *     |         BK                    |    |
+ *     |         VI                    |    |
+ *     |         VO                    |    |
+ *     +-------------------------------+    |
+ *     | TX aggr/mcs parameters array  |    |
+ *     | Length of this buffer is      |    |
+ *     | configurable for user layer.  |<-+ |
+ *     +-------------------------------+  | |
+ *     |      peer peer rx stats       |--+ |
+ *     |         BE                    | <--+
+ *     |         BE                    |
+ *     |         BK                    |
+ *     |         VI                    |
+ *     |         VO                    |
+ *     ---------------------------------
+ */
+struct sir_wifi_ll_ext_stats {
+	uint32_t trigger_cond_id;
+	uint32_t cca_chgd_bitmap;
+	uint32_t sig_chgd_bitmap;
+	uint32_t tx_chgd_bitmap;
+	uint32_t rx_chgd_bitmap;
+	uint8_t peer_num;
+	uint8_t channel_num;
+	struct sir_wifi_ll_ext_period time_stamp;
+	uint32_t tx_mpdu_aggr_array_len;
+	uint32_t tx_succ_mcs_array_len;
+	uint32_t tx_fail_mcs_array_len;
+	uint32_t tx_delay_array_len;
+	uint32_t rx_mpdu_aggr_array_len;
+	uint32_t rx_mcs_array_len;
+	struct sir_wifi_ll_ext_peer_stats *peer_stats;
+	struct sir_wifi_chan_cca_stats *cca;
+	uint8_t stats[];
+};
+
+/**
+ * struct sir_channel_cca_threshold - threshold for channel CCA
+ * @idle_time: idle time, no TX, no RX, no interference
+ * @tx_time: time transmitting packets
+ * @rx_in_bss_time: time receiving packets in current BSSs
+ * @rx_out_bss_time: time receiving packets not in current BSSs
+ * @rx_busy_time: time interference detected
+ * @rx_in_bad_cond_time: receiving packets with errors
+ * @tx_in_bad_cond_time: time transmitted packets not been ACKed
+ * @wlan_not_avail_time: wlan card cannot work
+ */
+struct sir_channel_cca_threshold {
+	uint32_t idle_time;
+	uint32_t tx_time;
+	uint32_t rx_in_bss_time;
+	uint32_t rx_out_bss_time;
+	uint32_t rx_busy_time;
+	uint32_t rx_in_bad_cond_time;
+	uint32_t tx_in_bad_cond_time;
+	uint32_t wlan_not_avail_time;
+};
+
+/**
+ * struct sir_signal_threshold - threshold for per peer sigbal
+ * @snr: signal to noise rate
+ * @nf: noise floor
+ */
+struct sir_signal_threshold {
+	uint32_t snr;
+	uint32_t nf;
+};
+
+/**
+ * struct sir_tx_threshold - threshold for TX
+ * @msdu: TX MSDUs on MAC layer
+ * @mpdu: TX MPDUs on MAC layer
+ * @ppdu: TX PPDUs on MAC layer
+ * @bytes: TX bytes on MAC layer
+ * @msdu_drop: drooped MSDUs
+ * @byte_drop: dropped Bytes
+ * @mpdu_retry: MPDU not acked
+ * @ppdu_fail: PPDUs which received no block ack
+ * @aggregation: aggregation size
+ * @succ_mcs: histogram of encoding rate for acked PPDUs
+ * @fail_mcs: histogram of encoding rate for no-acked PPDUs
+ */
+struct sir_tx_threshold {
+	uint32_t msdu;
+	uint32_t mpdu;
+	uint32_t ppdu;
+	uint32_t bytes;
+	uint32_t msdu_drop;
+	uint32_t byte_drop;
+	uint32_t mpdu_retry;
+	uint32_t mpdu_fail;
+	uint32_t ppdu_fail;
+	uint32_t aggregation;
+	uint32_t succ_mcs;
+	uint32_t fail_mcs;
+	uint32_t delay;
+};
+
+/**
+ * struct sir_rx_threshold - threshold for RX
+ * @mpdu: RX MPDUs on MAC layer
+ * @bytes: RX bytes on MAC layer
+ * @ppdu: RX PPDU on PHY layer
+ * @ppdu_bytes: RX bytes on PHY layer
+ * @disorder: discontinuity in seqnum
+ * @mpdu_retry: MPDUs flagged as retry
+ * @mpdu_dup: MPDUs identified as duplicated
+ * @aggregation: aggregation size
+ * @mcs: histogram of encoding rate for PPDUs
+ * @ps_inds: power save indication
+ * @ps_durs: total time in power save
+ * @probe_reqs: probe request received
+ * @other_mgmt: other MGMT frames received
+ */
+struct sir_rx_threshold {
+	uint32_t mpdu;
+	uint32_t bytes;
+	uint32_t ppdu;
+	uint32_t ppdu_bytes;
+	uint32_t disorder;
+	uint32_t mpdu_lost;
+	uint32_t mpdu_retry;
+	uint32_t mpdu_dup;
+	uint32_t mpdu_discard;
+	uint32_t aggregation;
+	uint32_t mcs;
+	uint32_t ps_inds;
+	uint32_t ps_durs;
+	uint32_t probe_reqs;
+	uint32_t other_mgmt;
+};
+
+/**
+ * struct sir_wifi_ll_ext_stats_threshold - Threshold for stats update
+ * @period: MAC counter indication period (unit in ms)
+ * @enable: if threshold mechnism is enabled or disabled
+ * @enable_bitmap: whether dedicated threshold is enabed.
+ *     Every MAC counter has a dedicated threshold. If the dedicated
+ *     threshold is not set in the bitmap, global threshold will take
+ *     effect.
+ * @global: whether clobal threshold is enabled.
+ *     When both global and dedicated threshold are diabled, MAC counter
+ *     will indicate stats periodically.
+ * @global_threshold: global threshold value
+ * @cca_bitmap: bitmap for CCA.
+ *     Bit0: idle time
+ *     Bit1: tx time
+ *     Bit2: RX in BSS
+ *     Bit3: RX out of BSS
+ *     Bit4: medium busy
+ *     Bit5: RX bad
+ *     Bit6: TX bad
+ *     Bit7: WLAN card not available
+ * @signal_bitmap:
+ *     Bit0: Per channel SNR counter
+ *     Bit1: Per channel noise floor counter
+ * @tx_bitmap:  bitmap for TX counters
+ *     Bit0: TX counter unit in MSDU
+ *     Bit1: TX counter unit in MPDU
+ *     Bit2: TX counter unit in PPDU
+ *     Bit3: TX counter unit in byte
+ *     Bit4: Dropped MSDUs
+ *     Bit5: Dropped Bytes
+ *     Bit6: MPDU retry counter
+ *     Bit7: MPDU failure counter
+ *     Bit8: PPDU failure counter
+ *     Bit9: MPDU aggregation counter
+ *     Bit10: MCS counter for ACKed MPDUs
+ *     Bit11: MCS counter for Failed MPDUs
+ *     Bit12: TX Delay counter
+ * @rx_bitmap:bitmap for RX counters
+ *     Bit0: MAC RX counter unit in MPDU
+ *     Bit1: MAC RX counter unit in byte
+ *     Bit2: PHY RX counter unit in PPDU
+ *     Bit3: PHY RX counter unit in byte
+ *     Bit4: Disorder counter
+ *     Bit5: Retry counter
+ *     Bit6: Duplication counter
+ *     Bit7: Discard counter
+ *     Bit8: MPDU aggregation size counter
+ *     Bit9: MCS counter
+ *     Bit10: Peer STA power state change (wake to sleep) counter
+ *     Bit11: Peer STA power save counter, total time in PS mode
+ *     Bit12: Probe request counter
+ *     Bit13: Other management frames counter
+ * @cca_thresh: CCA threshold
+ * @signal_thresh: signal threshold
+ * @tx_thresh: TX threshold
+ * @rx_thresh: RX threshold
+ *
+ * Generally, Link layer statistics is reported periodically. But if the
+ * variation of one stats of compared to the pervious notification exceeds
+ * a threshold, FW will report the new stats immediately.
+ * This structure contains threshold for different counters.
+ */
+struct sir_ll_ext_stats_threshold {
+	uint32_t period;
+	uint32_t enable;
+	uint32_t enable_bitmap;
+	uint32_t global;
+	uint32_t global_threshold;
+	uint32_t cca_bitmap;
+	uint32_t signal_bitmap;
+	uint32_t tx_bitmap;
+	uint32_t rx_bitmap;
+	struct sir_channel_cca_threshold cca;
+	struct sir_signal_threshold signal;
+	struct sir_tx_threshold tx;
+	struct sir_rx_threshold rx;
+};
+
+#define LL_STATS_MIN_PERIOD          10
+#define LL_STATS_MAX_PERIOD          10000
+#define LL_STATS_INVALID_PERIOD      0xFFFFFFFF
+
 typedef struct
 {
     tANI_U32 paramId;
@@ -6206,6 +6995,11 @@ typedef struct
     tANI_U8 results[0];
 } tSirLLStatsResults, *tpSirLLStatsResults;
 
+/* Result ID for LL stats extension */
+#define WMI_LL_STATS_EXT_PS_CHG             0x00000100
+#define WMI_LL_STATS_EXT_TX_FAIL            0x00000200
+#define WMI_LL_STATS_EXT_MAC_COUNTER        0x00000400
+
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
 
 typedef struct sAniGetLinkStatus
@@ -6443,6 +7237,7 @@ struct sir_ocb_config_sched {
  * @channel_count: number of channels
  * @schedule_size: size of the channel schedule
  * @flags: reserved
+ * @ta_max_duration: ta max duration after last ta received
  * @channels: array of OCB channels
  * @schedule: array of OCB schedule elements
  * @dcc_ndl_chan_list_len: size of the ndl_chan array
@@ -6457,6 +7252,7 @@ struct sir_ocb_config {
 	uint32_t channel_count;
 	uint32_t schedule_size;
 	uint32_t flags;
+	uint32_t ta_max_duration;
 	struct sir_ocb_config_channel *channels;
 	struct sir_ocb_config_sched *schedule;
 	uint32_t dcc_ndl_chan_list_len;
@@ -6467,6 +7263,11 @@ struct sir_ocb_config {
 	uint32_t def_tx_param_size;
 };
 
+/* Flag to indicate expiry time in TSF. */
+#define OCB_CONFIG_FLAG_EXPIRY_TIME_IN_TSF (0x01)
+/* Flag to indicate 802.11 frame mode. */
+#define OCB_CONFIG_FLAG_80211_FRAME_MODE   (0x02)
+
 /* The size of the utc time in bytes. */
 #define SIZE_UTC_TIME (10)
 /* The size of the utc time error in bytes. */
@@ -6591,6 +7392,101 @@ struct sir_dcc_update_ndl {
 };
 
 /**
+ * DSRC Radio channel statistics request type
+ * 0x01 - Stats for only one channel with specified frequence.
+ * 0x02 - Stats for all channels which is configured through
+ *	ocb_set_config command.
+ */
+enum dsrc_radio_chan_stats_req_type {
+	WLAN_DSRC_REQUEST_ONE_RADIO_CHAN_STATS = 0x01,
+	WLAN_DSRC_REQUEST_ALL_RADIO_CHAN_STATS = 0x02,
+};
+
+/**
+ * struct radio_chan_stats_req - Request for radio channel statistics.
+ * @req_type - request type to indicate statistics of
+ *	0x01: one specified channel.
+ *	0x02: all channels.
+ * @chan_freq - frequence of requested channel,
+ *	only used when req_type == 0x01
+ * @reset_after_req - flags to indicate whether FW needs reset statistics
+ *	of specified channel/channels.
+ */
+struct radio_chan_stats_req {
+	uint32_t req_type;
+	uint32_t chan_freq;
+	bool  reset_after_req;
+};
+
+/**
+ * struct radio_chan_stats_info - struct for radio channel statistics event.
+ * @chan_freq - channel frequence.
+ * @measurement_period - meaurement period, in uints of microseconds.
+ * @on_chan_us - accumulation of time the radio is tuned on this channel,
+ *	in uints of microseconds.
+ * @on_chan_ratio - ratio of on_chan_us to meaurement period,
+ *	in uints of percents.
+ * @tx_duration_us - accumulation of TX PPDU duration over the meaurement
+ *	period, in uints of microseconds.
+ * @rx_duration_us - accumulation of RX PPDU duration over the meaurement
+ *	period, in uints of microseconds.
+ * @chan_busy_ratio - ratio of channel busy time to on_chan_us,
+ *	in uints of percents.
+ * @tx_pkts - total packets transmitted on this channel.
+ * @rx_succ_pkts - MPDUs successfully received on this channel.
+ * @rx_fail_pkts - Failed MPDUs (CRC failures) received on this channel.
+ */
+struct radio_chan_stats_info {
+	uint32_t chan_freq;
+	uint32_t chan_busy_ratio;
+	uint64_t measurement_period;
+	uint64_t tx_duration_us;
+	uint64_t rx_duration_us;
+	uint64_t on_chan_us;
+	uint32_t on_chan_ratio;
+	uint32_t tx_mpdus;
+	uint32_t tx_msdus;
+	uint32_t rx_succ_pkts;
+	uint32_t rx_fail_pkts;
+};
+
+/**
+ * struct radio_chan_stats_response - struct for reporting radio channel
+ *	statistics to applicatopn.
+ * @num_chans - channel numbers of this report included.
+ * @chan_stats - pointer to specified channel statistics info.
+ */
+struct radio_chan_stats_rsp {
+	uint32_t num_chans;
+	struct radio_chan_stats_info *chan_stats;
+};
+
+#define DSRC_MAX_CHAN_STATS_CNT 2
+
+/**
+ * struct dsrc_radio_chan_stats_ctxt - DSRC radio channel statistics context.
+ * @magic:     For OCB specific magic.
+ * @enable_chan_stats: Radio channel statistics is current enabled/disabled.
+ * @cur_req:   Pointer to current channel statistics request.
+ * @completion_evt:    completion structure to wait for request completed.
+ * @config_chans_num:  Configured channel numbers to firmware by ocb.
+ * @config_chans_freq: Configured channel frequence.
+ * @chan_stats_num:    current channel number of whose statistics is existent.
+ * @chan_stats:        Array of radio channel statistics.
+ */
+struct dsrc_radio_chan_stats_ctxt {
+	uint32_t magic;
+	bool enable_chan_stats;
+	struct radio_chan_stats_req *cur_req;
+	struct completion completion_evt;
+	uint32_t config_chans_num;
+	uint32_t config_chans_freq[DSRC_MAX_CHAN_STATS_CNT];
+	spinlock_t chan_stats_lock;
+	uint32_t chan_stats_num;
+	struct radio_chan_stats_info chan_stats[DSRC_MAX_CHAN_STATS_CNT];
+};
+
+/**
  * struct sir_stats_avg_factor
  * @vdev_id: session id
  * @stats_avg_factor: average factor
@@ -6613,61 +7509,6 @@ struct sir_guard_time_request {
 /* Max number of rates allowed in Supported Rates IE */
 #define MAX_NUM_SUPPORTED_RATES (8)
 
-#define MAX_NUM_FW_SEGMENTS 4
-
-/**
- * struct fw_dump_seg_req - individual segment details
- * @seg_id - segment id.
- * @seg_start_addr_lo - lower address of the segment.
- * @seg_start_addr_hi - higher address of the segment.
- * @seg_length - length of the segment.
- * @dst_addr_lo - lower address of the destination buffer.
- * @dst_addr_hi - higher address of the destination buffer.
- *
- * This structure carries the information to firmware about the
- * individual segments. This structure is part of firmware memory
- * dump request.
- */
-struct fw_dump_seg_req
-{
-	uint8_t seg_id;
-	uint32_t seg_start_addr_lo;
-	uint32_t seg_start_addr_hi;
-	uint32_t seg_length;
-	uint32_t dst_addr_lo;
-	uint32_t dst_addr_hi;
-};
-
-/**
- * struct fw_dump_req - firmware memory dump request details.
- * @request_id - request id.
- * @num_seg - requested number of segments.
- * @fw_dump_seg_req - individual segment information.
- *
- * This structure carries information about the firmware
- * memory dump request.
- */
-struct fw_dump_req
-{
-	uint32_t request_id;
-	uint32_t num_seg;
-	struct fw_dump_seg_req segment[MAX_NUM_FW_SEGMENTS];
-};
-
-/**
- * struct fw_dump_rsp - firmware dump response details.
- * @request_id - request id.
- * @dump_complete - copy completion status.
- *
- * This structure is used to store the firmware dump copy complete
- * response from the firmware.
- */
-struct fw_dump_rsp
-{
-	uint32_t request_id;
-	uint32_t dump_complete;
-};
-
 /**
  * struct vdev_ie_info - IE info
  * @vdev_i - vdev for which the IE is being sent
@@ -6716,6 +7557,17 @@ struct rssi_breach_event {
 };
 
 /**
+ * struct chip_pwr_save_fail_detected_params - chip power save failure detected
+ * event params
+ * @failure_reason_code:failure reason code
+ * @wake_lock_bitmap:bitmap for modules voting against sleep for long duration.
+ */
+struct chip_pwr_save_fail_detected_params {
+	uint32_t     failure_reason_code;
+	uint32_t     wake_lock_bitmap[4];
+};
+
+/**
  * struct sir_sme_ext_change_chan_req - channel change request
  * @message_type: message id
  * @length: msg length
@@ -6844,6 +7696,7 @@ struct egap_conf_params {
 	uint32_t   flags;
 };
 
+#define SIR_BCN_FLT_MAX_ELEMS_IE_LIST 8
 /**
  * struct beacon_filter_param - parameters for beacon filtering
  * @vdev_id: vdev id
@@ -6852,7 +7705,7 @@ struct egap_conf_params {
  */
 struct beacon_filter_param {
 	uint32_t   vdev_id;
-	uint32_t   ie_map[8];
+	uint32_t   ie_map[SIR_BCN_FLT_MAX_ELEMS_IE_LIST];
 };
 
 /**
@@ -6917,6 +7770,11 @@ struct sir_bpf_get_offload {
  * @wow_ipv6_mcast_na_stats: ipv6 multicast na stats
  * @wow_icmpv4_count: ipv4 icmp packet count
  * @wow_icmpv6_count: ipv6 icmp packet count
+ * @wow_rssi_breach_wake_up_count: rssi breach wakeup count
+ * @wow_low_rssi_wake_up_count: low rssi wakeup count
+ * @wow_gscan_wake_up_count: gscan wakeup count
+ * @wow_pno_complete_wake_up_count: pno complete wakeup count
+ * @wow_pno_match_wake_up_count: pno match wakeup count
  */
 struct sir_wake_lock_stats {
 	uint32_t wow_ucast_wake_up_count;
@@ -6928,6 +7786,11 @@ struct sir_wake_lock_stats {
 	uint32_t wow_ipv6_mcast_na_stats;
 	uint32_t wow_icmpv4_count;
 	uint32_t wow_icmpv6_count;
+	uint32_t wow_rssi_breach_wake_up_count;
+	uint32_t wow_low_rssi_wake_up_count;
+	uint32_t wow_gscan_wake_up_count;
+	uint32_t wow_pno_complete_wake_up_count;
+	uint32_t wow_pno_match_wake_up_count;
 };
 
 /**
@@ -7259,6 +8122,28 @@ struct ndp_app_info {
 };
 
 /**
+ * struct ndp_scid - structure to hold sceurity context identifier
+ * @scid_len: length of scid
+ * @scid: scid
+ *
+ */
+struct ndp_scid {
+	uint32_t scid_len;
+	uint8_t *scid;
+};
+
+/**
+ * struct ndp_pmk - structure to hold pairwise master key
+ * @pmk_len: length of pairwise master key
+ * @pmk: buffer containing pairwise master key
+ *
+ */
+struct ndp_pmk {
+	uint32_t pmk_len;
+	uint8_t *pmk;
+};
+
+/**
  * struct ndi_create_req - ndi create request params
  * @transaction_id: unique identifier
  * @iface_name: interface name
@@ -7278,6 +8163,7 @@ struct ndp_app_info {
  struct ndi_create_rsp {
 	uint32_t status;
 	uint32_t reason;
+	uint8_t sta_id;
 };
 
 /**
@@ -7296,22 +8182,28 @@ struct ndp_app_info {
  * @transaction_id: unique identifier
  * @vdev_id: session id of the interface over which ndp is being created
  * @channel: suggested channel for ndp creation
+ * @channel_cfg: channel config, 0=no channel, 1=optional, 2=mandatory
  * @service_instance_id: Service identifier
  * @peer_discovery_mac_addr: Peer's discovery mac address
  * @self_ndi_mac_addr: self NDI mac address
  * @ndp_config: ndp configuration params
  * @ndp_info: ndp application info
+ * @ncs_sk_type: indicates NCS_SK_128 or NCS_SK_256
+ * @pmk: pairwise master key
  *
  */
 struct ndp_initiator_req {
 	uint32_t transaction_id;
 	uint32_t vdev_id;
 	uint32_t channel;
+	uint32_t channel_cfg;
 	uint32_t service_instance_id;
 	v_MACADDR_t peer_discovery_mac_addr;
 	v_MACADDR_t self_ndi_mac_addr;
 	struct ndp_cfg ndp_config;
 	struct ndp_app_info ndp_info;
+	uint32_t ncs_sk_type;
+	struct ndp_pmk pmk;
 };
 
 /**
@@ -7343,6 +8235,8 @@ struct ndp_initiator_rsp {
  * @ndp_accept_policy: accept policy configured by the upper layer
  * @ndp_config: ndp configuration params
  * @ndp_info: ndp application info
+ * @ncs_sk_type: indicates NCS_SK_128 or NCS_SK_256
+ * @scid: security context identifier
  *
  */
 struct ndp_indication_event {
@@ -7355,6 +8249,8 @@ struct ndp_indication_event {
 	enum ndp_accept_policy policy;
 	struct ndp_cfg ndp_config;
 	struct ndp_app_info ndp_info;
+	uint32_t ncs_sk_type;
+	struct ndp_scid scid;
 };
 
 /**
@@ -7365,6 +8261,8 @@ struct ndp_indication_event {
  * @ndp_rsp: response to the ndp create request
  * @ndp_config: ndp configuration params
  * @ndp_info: ndp application info
+ * @pmk: pairwise master key
+ * @ncs_sk_type: indicates NCS_SK_128 or NCS_SK_256
  *
  */
 struct ndp_responder_req {
@@ -7374,6 +8272,8 @@ struct ndp_responder_req {
 	enum ndp_response_code ndp_rsp;
 	struct ndp_cfg ndp_config;
 	struct ndp_app_info ndp_info;
+	struct ndp_pmk pmk;
+	uint32_t ncs_sk_type;
 };
 
 /**
@@ -7391,6 +8291,7 @@ struct ndp_responder_rsp_event {
 	uint32_t status;
 	uint32_t reason;
 	v_MACADDR_t peer_mac_addr;
+	bool create_peer;
 };
 
 /**
@@ -7566,7 +8467,7 @@ struct sme_tx_fail_cnt_threshold {
  */
 struct sme_short_retry_limit {
 	uint8_t session_id;
-	uint32_t short_retry_limit;
+	uint8_t short_retry_limit;
 };
 
 /**
@@ -7577,7 +8478,7 @@ struct sme_short_retry_limit {
  */
 struct sme_long_retry_limit {
 	uint8_t session_id;
-	uint32_t long_retry_limit;
+	uint8_t long_retry_limit;
 };
 
 /**
@@ -7592,6 +8493,18 @@ struct sme_sta_inactivity_timeout {
 };
 
 /**
+ * struct sme_flush_pending - flush pending packets with specified tids
+ * @vdev_id: vdev Id.
+ * @peer_addr: peer mac address.
+ * @flush_ac: access category pending packets using
+ */
+struct sme_flush_pending {
+	uint8_t session_id;
+	v_MACADDR_t  peer_addr;
+	uint8_t flush_ac;
+};
+
+/**
  * struct scan_chan_info - channel info
  * @freq: radio frequence
  * @cmd flag: cmd flag
@@ -7610,4 +8523,93 @@ struct scan_chan_info {
 	uint32_t tx_frame_count;
 	uint32_t clock_freq;
 };
+
+/**
+ * struct get_chain_rssi_req_params - get chain rssi req params
+ * @peer_macaddr: specific peer mac address
+ */
+struct get_chain_rssi_req_params
+{
+	v_MACADDR_t peer_macaddr;
+};
+/**
+ * struct sme_sub20_chan_width - set sub20 channel width
+ * @message_type: message Type.
+ * @length: message length.
+ * @session_id: session Id.
+ * @channelwidth: sub20 channel Width.
+ */
+struct sme_sub20_chan_width {
+	uint16_t	message_type;
+	uint16_t	length;
+	uint8_t	session_id;
+	uint8_t	channelwidth;
+};
+
+/**
+ * struct sme_change_country_code_ind - indicate country code changed
+ * @message_type: message Type is eWNI_SME_CC_CHANGE_IND.
+ * @msg_len: message length.
+ * @session_id: session Id.
+ * @country_code: country code information.
+ */
+struct sme_change_country_code_ind {
+	uint16_t  message_type;
+	uint16_t  msg_len;
+	uint8_t   session_id;
+	uint8_t   country_code[WNI_CFG_COUNTRY_CODE_LEN];
+};
+
+/**
+ * struct sir_set_rx_reorder_timeout_val - rx reorder timeout
+ * @rx_timeout_pri: reorder timeout for AC
+ *                  rx_timeout_pri[0] : AC_VO
+ *                  rx_timeout_pri[1] : AC_VI
+ *                  rx_timeout_pri[2] : AC_BE
+ *                  rx_timeout_pri[3] : AC_BK
+ */
+struct sir_set_rx_reorder_timeout_val {
+	uint32_t rx_timeout_pri[4];
+};
+
+/**
+ * struct sir_peer_set_rx_blocksize - set rx blocksize
+ * @vdev_id: vdev id
+ * @peer_macaddr: peer mac address
+ * @rx_block_ack_win_limit: windows size limitation
+ */
+struct sir_peer_set_rx_blocksize {
+	uint32_t vdev_id;
+	v_MACADDR_t peer_macaddr;
+	uint32_t rx_block_ack_win_limit;
+};
+
+/**
+ * enum action_filter_type - Type of action frame filter
+ * @SME_ACTION_FRAME_RANDOM_MAC_SET: Set filter
+ * @SME_ACTION_FRAME_RANDOM_MAC_CLEAR: Clear filter
+ */
+enum action_filter_type {
+	SME_ACTION_FRAME_RANDOM_MAC_SET,
+	SME_ACTION_FRAME_RANDOM_MAC_CLEAR,
+};
+
+typedef void (*action_frame_random_filter_callback)(bool set_random_addr,
+						    void *context);
+/**
+ * struct action_frame_random_filter - Random mac filter attrs for set/clear
+ * @session_id: Session interface
+ * @filter_type: Type of filter from action_filter_type
+ * @callback: Invoked from wmi
+ * @context: Parameter to be used with callback
+ * @mac_addr: Random mac addr for which filter is to be set
+ */
+struct action_frame_random_filter {
+	uint32_t session_id;
+	enum action_filter_type filter_type;
+	action_frame_random_filter_callback callback;
+	void *context;
+	uint8_t mac_addr[VOS_MAC_ADDR_SIZE];
+};
+
 #endif /* __SIR_API_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirMacProtDef.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirMacProtDef.h
index 5e0a6d0ed7b..edd14557df9 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirMacProtDef.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirMacProtDef.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -41,8 +41,10 @@
 
 #include "palTypes.h"
 #include "sirTypes.h"
-#include "wniCfgSta.h"
-
+#include "wni_cfg.h"
+#ifdef WLAN_FEATURE_FILS_SK
+#include <lim_fils_defs.h>
+#endif
 
 ///Capability information related
 #define CAPABILITY_INFO_DELAYED_BA_BIT 14
@@ -165,6 +167,11 @@
 #define SIR_MAC_QOS_DEL_BA_REQ      6
 #define SIR_MAC_QOS_DEL_BA_RSP      7
 
+#define SIR_MAC_ACTION_MEASURE_REQUEST_ID      0
+#define SIR_MAC_ACTION_MEASURE_REPORT_ID       1
+#define SIR_MAC_ACTION_TPC_REQUEST_ID          2
+#define SIR_MAC_ACTION_TPC_REPORT_ID           3
+
 #define SIR_MAC_ACTION_CHANNEL_SWITCH_ID       4
 
 
@@ -408,11 +415,9 @@
 #define NSS_1x1_MODE 1
 #define NSS_2x2_MODE 2
 
-#ifdef FEATURE_AP_MCC_CH_AVOIDANCE
 #define SIR_MAC_QCOM_VENDOR_EID      200
 #define SIR_MAC_QCOM_VENDOR_OUI      "\x00\xA0\xC6"
 #define SIR_MAC_QCOM_VENDOR_SIZE     3
-#endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
 /// Workaround IE to change beacon length when it is 4*n+1
 #define SIR_MAC_ANI_WORKAROUND_EID     255
@@ -458,6 +463,10 @@
 #define SIR_MAC_CISCO_OUI "\x00\x40\x96"
 #define SIR_MAC_CISCO_OUI_SIZE 3
 
+/* WFA vendor specific TPC OUI */
+#define SIR_MAC_WFA_TPC_OUI           "\x00\x50\xF2\x08\x00"
+#define SIR_MAC_WFA_TPC_OUI_SIZE      5
+
 // min size of wme oui header: oui(3) + type + subtype + version
 #define SIR_MAC_OUI_WME_HDR_MIN       6
 
@@ -585,12 +594,18 @@
 #define SIR_MAC_MAX_NUMBER_OF_RATES          12
 #define SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS      4
 #define SIR_MAC_KEY_LENGTH                   13   // WEP Maximum key length size
-#define SIR_MAC_AUTH_CHALLENGE_LENGTH        128
+#define SIR_MAC_AUTH_CHALLENGE_LENGTH        253
+#define SIR_MAC_SAP_AUTH_CHALLENGE_LENGTH    128
 #define SIR_MAC_WEP_IV_LENGTH                4
 #define SIR_MAC_WEP_ICV_LENGTH               4
+#define SIR_MAC_CHALLENGE_ID_LEN             2
+
+/* 2 bytes each for auth algo number, transaction number and status code */
+#define SIR_MAC_AUTH_FRAME_INFO_LEN          6
 
 /// MAX key length when ULA is used
 #define SIR_MAC_MAX_KEY_LENGTH               32
+#define SIR_MAC_MAX_KEY_RSC_LEN              16
 
 /// Macro definitions for get/set on FC fields
 #define SIR_MAC_GET_PROT_VERSION(x)      ((((tANI_U16) x) & 0x0300) >> 8)
@@ -643,10 +658,6 @@
 #define IS_WES_MODE_ENABLED(x) \
                     ((x)->roam.configParam.isWESModeEnabled)
 
-#define BA_RECIPIENT       1
-#define BA_INITIATOR       2
-#define BA_BOTH_DIRECTIONS 3
-
 /// Status Code (present in Management response frames) enum
 
 typedef enum eSirMacStatusCodes
@@ -807,34 +818,6 @@ typedef enum eSirMacReasonCodes
 } tSirMacReasonCodes;
 
 
-// BA Initiator v/s Recipient
-typedef enum eBADirection
-{
-  eBA_RECIPIENT,
-  eBA_INITIATOR
-} tBADirection;
-
-// A-MPDU/BA Enable/Disable in Tx/Rx direction
-typedef enum eBAEnable
-{
-  eBA_DISABLE,
-  eBA_ENABLE
-} tBAEnable;
-
-// A-MPDU/BA Policy
-typedef enum eBAPolicy
-{
-  eBA_UNCOMPRESSED,
-  eBA_COMPRESSED
-} tBAPolicy;
-
-// A-MPDU/BA Policy
-typedef enum eBAPolicyType
-{
-  eBA_POLICY_DELAYED,
-  eBA_POLICY_IMMEDIATE
-} tBAPolicyType;
-
 /// Frame control field format (2 bytes)
 typedef  __ani_attr_pre_packed struct sSirMacFrameCtl
 {
@@ -1037,6 +1020,14 @@ typedef __ani_attr_pre_packed struct sSirMacRateSet
     tANI_U8  rate[SIR_MAC_RATESET_EID_MAX];
 } __ani_attr_packed tSirMacRateSet;
 
+/** struct merged_mac_rate_set - merged mac rate set
+ * @num_rates: num of rates
+ * @rate: rate list
+ */
+struct merged_mac_rate_set {
+	uint8_t num_rates;
+	uint8_t rate[2 * SIR_MAC_RATESET_EID_MAX];
+};
 
 typedef __ani_attr_pre_packed struct sSirMacSSid
 {
@@ -2071,6 +2062,14 @@ typedef __ani_attr_pre_packed struct sSirMacAuthFrameBody
     tANI_U8      type;   // = SIR_MAC_CHALLENGE_TEXT_EID
     tANI_U8      length; // = SIR_MAC_AUTH_CHALLENGE_LENGTH
     tANI_U8      challengeText[SIR_MAC_AUTH_CHALLENGE_LENGTH];
+#ifdef WLAN_FEATURE_FILS_SK
+    tSirMacRsnInfo rsn_ie;
+    uint8_t assoc_delay_info;
+    uint8_t session[SIR_FILS_SESSION_LENGTH];
+    uint8_t wrapped_data_len;
+    uint8_t wrapped_data[SIR_FILS_WRAPPED_DATA_MAX_SIZE];
+    uint8_t nonce[SIR_FILS_NONCE_LENGTH];
+#endif
 } __ani_attr_packed tSirMacAuthFrameBody, *tpSirMacAuthFrameBody;
 
 typedef __ani_attr_pre_packed struct sSirMacAuthenticationFrame
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/wniApi.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/wniApi.h
index a0756777804..e4379ed4c90 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/wniApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/wniApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -114,6 +114,7 @@ enum eWniMsgTypes
     eWNI_SME_DEAUTH_REQ,
     eWNI_SME_DEAUTH_RSP,
     eWNI_SME_DEAUTH_IND,
+    eWNI_SME_DISCONNECT_DONE_IND,
     eWNI_SME_WM_STATUS_CHANGE_NTF,
     eWNI_SME_IBSS_NEW_PEER_IND,
     eWNI_SME_IBSS_PEER_DEPARTED_IND,
@@ -285,6 +286,7 @@ enum eWniMsgTypes
 
     eWNI_SME_CHANGE_COUNTRY_CODE,
     eWNI_SME_GENERIC_CHANGE_COUNTRY_CODE,
+    eWNI_SME_CC_CHANGE_IND,
     eWNI_SME_PRE_SWITCH_CHL_IND,
     eWNI_SME_POST_SWITCH_CHL_IND,
 
@@ -345,6 +347,7 @@ enum eWniMsgTypes
 #ifdef FEATURE_WLAN_CH_AVOID
     eWNI_SME_CH_AVOID_IND,
 #endif /* FEATURE_WLAN_CH_AVOID */
+    eWNI_SME_SET_SUB20_CH_WIDTH,
     /* DFS EVENTS */
     eWNI_SME_DFS_RADAR_FOUND, //RADAR found indication from DFS
     eWNI_SME_CHANNEL_CHANGE_REQ,//Channel Change Request from SAP
@@ -383,20 +386,23 @@ enum eWniMsgTypes
 #endif
     eWNI_SME_FW_STATUS_IND,
     eWNI_SME_SET_THERMAL_LEVEL_IND,
-
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+    eWNI_SME_THERMAL_TEMPERATURE_IND,
+#endif
     eWNI_SME_OCB_SET_CONFIG_RSP,
     eWNI_SME_OCB_GET_TSF_TIMER_RSP,
     eWNI_SME_DCC_GET_STATS_RSP,
     eWNI_SME_DCC_UPDATE_NDL_RSP,
     eWNI_SME_DCC_STATS_EVENT,
+    eWNI_SME_RADIO_CHAN_STATS_IND,
 
     eWNI_SME_TSF_EVENT,
-    eWNI_SME_FW_DUMP_IND,
     eWNI_SME_PDEV_SET_HT_VHT_IE,
     eWNI_SME_EXT_CHANGE_CHANNEL,
     eWNI_SME_EXT_CHANGE_CHANNEL_IND,
     eWNI_SME_LOST_LINK_INFO_IND,
-    eWNI_SME_GET_RSSI_IND,
+    eWNI_SME_GET_PEER_INFO_IND,
+    eWNI_SME_GET_PEER_INFO_EXT_IND,
     eWNI_SME_ROAM_SCAN_OFFLOAD_REQ,
     eWNI_SME_SMPS_FORCE_MODE_IND,
     eWNI_SME_REGISTER_MGMT_FRAME_CB,
@@ -417,6 +423,10 @@ enum eWniMsgTypes
     eWNI_SME_NDP_END_IND,
     eWNI_SME_REGISTER_P2P_ACK_CB,
     eWNI_SME_UPDATE_ACCESS_POLICY_VENDOR_IE,
+    eWNI_SME_RX_AGGR_HOLE_IND,
+
+    /* Link layer statistics */
+    eWMI_SME_LL_STATS_IND,
 
     eWNI_SME_MSG_TYPES_END
 };
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/wniCfgAp.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/wniCfgAp.h
deleted file mode 100644
index dbc5ab58d29..00000000000
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/wniCfgAp.h
+++ /dev/null
@@ -1,2548 +0,0 @@
-/*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
- *
- * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
- *
- *
- * Permission to use, copy, modify, and/or distribute this software for
- * any purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
- * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
- * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
- * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
- * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
- * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * This file was originally distributed by Qualcomm Atheros, Inc.
- * under proprietary terms before Copyright ownership was assigned
- * to the Linux Foundation.
- */
-
-/*
- * DO NOT EDIT - This file is generated automatically
- */
-
-/*
- * IMPORTANT:  This file is for system that supports both STA and AP mode.
- */
-
-
-#ifndef __WNICFGAP_H
-#define __WNICFGAP_H
-
-/*
- * Configuration Parameter ID for STA and AP
- */
-
-#define WNI_CFG_STA_ID    0
-#define WNI_CFG_CF_POLLABLE    1
-#define WNI_CFG_CFP_PERIOD    2
-#define WNI_CFG_CFP_MAX_DURATION    3
-#define WNI_CFG_SSID    4
-#define WNI_CFG_BEACON_INTERVAL    5
-#define WNI_CFG_DTIM_PERIOD    6
-#define WNI_CFG_WEP_KEY_LENGTH    7
-#define WNI_CFG_WEP_DEFAULT_KEY_TABLE    8
-#define WNI_CFG_WEP_DEFAULT_KEY_TABLE_ROW    4
-#define WNI_CFG_WEP_DEFAULT_KEY_TABLE_COL    1
-#define WNI_CFG_WEP_DEFAULT_KEY_1    8
-#define WNI_CFG_WEP_DEFAULT_KEY_2    9
-#define WNI_CFG_WEP_DEFAULT_KEY_3    10
-#define WNI_CFG_WEP_DEFAULT_KEY_4    11
-#define WNI_CFG_WEP_DEFAULT_KEYID    12
-#define WNI_CFG_EXCLUDE_UNENCRYPTED    13
-#define WNI_CFG_RTS_THRESHOLD    14
-#define WNI_CFG_SHORT_RETRY_LIMIT    15
-#define WNI_CFG_LONG_RETRY_LIMIT    16
-#define WNI_CFG_FRAGMENTATION_THRESHOLD    17
-#define WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME    18
-#define WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME    19
-#define WNI_CFG_PASSIVE_MINIMUM_CHANNEL_TIME    20
-#define WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME    21
-#define WNI_CFG_JOIN_FAILURE_TIMEOUT    22
-#define WNI_CFG_AUTHENTICATE_FAILURE_TIMEOUT    23
-#define WNI_CFG_AUTHENTICATE_RSP_TIMEOUT    24
-#define WNI_CFG_ASSOCIATION_FAILURE_TIMEOUT    25
-#define WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT    26
-#define WNI_CFG_RA_PERIODICITY_TIMEOUT_IN_PS    27
-#define WNI_CFG_PS_ENABLE_BCN_FILTER    28
-#define WNI_CFG_PS_ENABLE_HEART_BEAT    29
-#define WNI_CFG_PS_ENABLE_RSSI_MONITOR    30
-#define WNI_CFG_PS_DATA_INACTIVITY_TIMEOUT    31
-#define WNI_CFG_RF_SETTLING_TIME_CLK    32
-#define WNI_CFG_SUPPORTED_RATES_11B    33
-#define WNI_CFG_SUPPORTED_RATES_11A    34
-#define WNI_CFG_PHY_MODE    35
-#define WNI_CFG_DOT11_MODE    36
-#define WNI_CFG_OPERATIONAL_RATE_SET    37
-#define WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET    38
-#define WNI_CFG_PROPRIETARY_OPERATIONAL_RATE_SET    39
-#define WNI_CFG_LISTEN_INTERVAL    40
-#define WNI_CFG_VALID_CHANNEL_LIST    41
-#define WNI_CFG_CURRENT_CHANNEL    42
-#define WNI_CFG_DEFAULT_RATE_INDEX_5GHZ    43
-#define WNI_CFG_DEFAULT_RATE_INDEX_24GHZ    44
-#define WNI_CFG_RATE_ADAPTATION_TYPE    45
-#define WNI_CFG_FIXED_RATE    46
-#define WNI_CFG_FIXED_RATE_MULTICAST_24GHZ    47
-#define WNI_CFG_FIXED_RATE_MULTICAST_5GHZ    48
-#define WNI_CFG_RETRYRATE_POLICY    49
-#define WNI_CFG_RETRYRATE_SECONDARY    50
-#define WNI_CFG_RETRYRATE_TERTIARY    51
-#define WNI_CFG_APSD_ENABLED    52
-#define WNI_CFG_SHARED_KEY_AUTH_ENABLE    53
-#define WNI_CFG_OPEN_SYSTEM_AUTH_ENABLE    54
-#define WNI_CFG_AUTHENTICATION_TYPE    55
-#define WNI_CFG_CF_POLL_REQUEST    56
-#define WNI_CFG_PRIVACY_ENABLED    57
-#define WNI_CFG_SHORT_PREAMBLE    58
-#define WNI_CFG_SHORT_SLOT_TIME    59
-#define WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY    60
-#define WNI_CFG_QOS_ENABLED    61
-#define WNI_CFG_HCF_ENABLED    62
-#define WNI_CFG_RSN_ENABLED    63
-#define WNI_CFG_BACKGROUND_SCAN_PERIOD    64
-#define WNI_CFG_MAX_NUM_PRE_AUTH    65
-#define WNI_CFG_PREAUTH_CLNUP_TIMEOUT    66
-#define WNI_CFG_RELEASE_AID_TIMEOUT    67
-#define WNI_CFG_HEART_BEAT_THRESHOLD    68
-#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT    69
-#define WNI_CFG_MANUFACTURER_OUI    70
-#define WNI_CFG_MANUFACTURER_NAME    71
-#define WNI_CFG_MODEL_NUMBER    72
-#define WNI_CFG_MODEL_NAME    73
-#define WNI_CFG_MANUFACTURER_PRODUCT_NAME    74
-#define WNI_CFG_MANUFACTURER_PRODUCT_VERSION    75
-#define WNI_CFG_11D_ENABLED    76
-#define WNI_CFG_MAX_TX_POWER_2_4    77
-#define WNI_CFG_MAX_TX_POWER_5    78
-#define WNI_CFG_NETWORK_DENSITY    79
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM    80
-#define WNI_CFG_CURRENT_TX_ANTENNA    81
-#define WNI_CFG_CURRENT_RX_ANTENNA    82
-#define WNI_CFG_CURRENT_TX_POWER_LEVEL    83
-#define WNI_CFG_NEW_BSS_FOUND_IND    84
-#define WNI_CFG_PROPRIETARY_RATES_ENABLED    85
-#define WNI_CFG_AP_NODE_NAME    86
-#define WNI_CFG_COUNTRY_CODE    87
-#define WNI_CFG_11H_ENABLED    88
-#define WNI_CFG_WT_CNF_TIMEOUT    89
-#define WNI_CFG_KEEPALIVE_TIMEOUT    90
-#define WNI_CFG_PROXIMITY    91
-#define WNI_CFG_LOG_LEVEL    92
-#define WNI_CFG_OLBC_DETECT_TIMEOUT    93
-#define WNI_CFG_PROTECTION_ENABLED    94
-#define WNI_CFG_11G_PROTECTION_ALWAYS    95
-#define WNI_CFG_FORCE_POLICY_PROTECTION    96
-#define WNI_CFG_11G_SHORT_PREAMBLE_ENABLED    97
-#define WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED    98
-#define WNI_CFG_11G_ONLY_POLICY    99
-#define WNI_CFG_PACKET_CLASSIFICATION    100
-#define WNI_CFG_WME_ENABLED    101
-#define WNI_CFG_ADDTS_RSP_TIMEOUT    102
-#define WNI_CFG_MAX_SP_LENGTH    103
-#define WNI_CFG_KEEP_ALIVE_STA_LIMIT_THRESHOLD    104
-#define WNI_CFG_SEND_SINGLE_SSID_ALWAYS    105
-#define WNI_CFG_WSM_ENABLED    106
-#define WNI_CFG_EDCA_PROFILE    107
-#define WNI_CFG_EDCA_ANI_ACBK_LOCAL    108
-#define WNI_CFG_EDCA_ANI_ACBE_LOCAL    109
-#define WNI_CFG_EDCA_ANI_ACVI_LOCAL    110
-#define WNI_CFG_EDCA_ANI_ACVO_LOCAL    111
-#define WNI_CFG_EDCA_ANI_ACBK    112
-#define WNI_CFG_EDCA_ANI_ACBE    113
-#define WNI_CFG_EDCA_ANI_ACVI    114
-#define WNI_CFG_EDCA_ANI_ACVO    115
-#define WNI_CFG_EDCA_WME_ACBK_LOCAL    116
-#define WNI_CFG_EDCA_WME_ACBE_LOCAL    117
-#define WNI_CFG_EDCA_WME_ACVI_LOCAL    118
-#define WNI_CFG_EDCA_WME_ACVO_LOCAL    119
-#define WNI_CFG_EDCA_WME_ACBK    120
-#define WNI_CFG_EDCA_WME_ACBE    121
-#define WNI_CFG_EDCA_WME_ACVI    122
-#define WNI_CFG_EDCA_WME_ACVO    123
-#define WNI_CFG_RDET_FLAG    124
-#define WNI_CFG_RADAR_CHANNEL_LIST    125
-#define WNI_CFG_LOCAL_POWER_CONSTRAINT    126
-#define WNI_CFG_ADMIT_POLICY    127
-#define WNI_CFG_ADMIT_BWFACTOR    128
-#define WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE    129
-#define WNI_CFG_CHANNEL_BONDING_MODE    130
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE    131
-#define WNI_CFG_DYNAMIC_THRESHOLD_ZERO    132
-#define WNI_CFG_DYNAMIC_THRESHOLD_ONE    133
-#define WNI_CFG_DYNAMIC_THRESHOLD_TWO    134
-#define WNI_CFG_TRIG_STA_BK_SCAN    135
-#define WNI_CFG_DYNAMIC_PROFILE_SWITCHING    136
-#define WNI_CFG_SCAN_CONTROL_LIST    137
-#define WNI_CFG_MIMO_ENABLED    138
-#define WNI_CFG_BLOCK_ACK_ENABLED    139
-#define WNI_CFG_BA_ACTIVITY_CHECK_TIMEOUT    140
-#define WNI_CFG_HT_RX_STBC    141
-#define WNI_CFG_HT_CAP_INFO    142
-#define WNI_CFG_HT_AMPDU_PARAMS    143
-#define WNI_CFG_SUPPORTED_MCS_SET    144
-#define WNI_CFG_EXT_HT_CAP_INFO    145
-#define WNI_CFG_TX_BF_CAP    146
-#define WNI_CFG_AS_CAP    147
-#define WNI_CFG_HT_INFO_FIELD1    148
-#define WNI_CFG_HT_INFO_FIELD2    149
-#define WNI_CFG_HT_INFO_FIELD3    150
-#define WNI_CFG_BASIC_MCS_SET    151
-#define WNI_CFG_CURRENT_MCS_SET    152
-#define WNI_CFG_GREENFIELD_CAPABILITY    153
-#define WNI_CFG_VHT_MAX_MPDU_LENGTH    154
-#define WNI_CFG_VHT_SUPPORTED_CHAN_WIDTH_SET    155
-#define WNI_CFG_VHT_LDPC_CODING_CAP    156
-#define WNI_CFG_VHT_SHORT_GI_80MHZ    157
-#define WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ    158
-#define WNI_CFG_VHT_TXSTBC    159
-#define WNI_CFG_VHT_RXSTBC    160
-#define WNI_CFG_VHT_SU_BEAMFORMER_CAP    161
-#define WNI_CFG_VHT_SU_BEAMFORMEE_CAP    162
-#define WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED    163
-#define WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS    164
-#define WNI_CFG_VHT_MU_BEAMFORMER_CAP    165
-#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP    166
-#define WNI_CFG_VHT_TXOP_PS    167
-#define WNI_CFG_VHT_HTC_VHTC_CAP    168
-#define WNI_CFG_VHT_AMPDU_LEN_EXPONENT    169
-#define WNI_CFG_VHT_LINK_ADAPTATION_CAP    170
-#define WNI_CFG_VHT_RX_ANT_PATTERN    171
-#define WNI_CFG_VHT_TX_ANT_PATTERN    172
-#define WNI_CFG_VHT_RX_MCS_MAP    173
-#define WNI_CFG_VHT_TX_MCS_MAP    174
-#define WNI_CFG_VHT_RX_HIGHEST_SUPPORTED_DATA_RATE    175
-#define WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE    176
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1    177
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT2    178
-#define WNI_CFG_VHT_BASIC_MCS_SET    179
-#define WNI_CFG_VHT_MU_MIMO_CAP_STA_COUNT    180
-#define WNI_CFG_VHT_SS_UNDER_UTIL    181
-#define WNI_CFG_VHT_40MHZ_UTILIZATION    182
-#define WNI_CFG_VHT_80MHZ_UTILIZATION    183
-#define WNI_CFG_VHT_160MHZ_UTILIZATION    184
-#define WNI_CFG_MAX_AMSDU_LENGTH    185
-#define WNI_CFG_MPDU_DENSITY    186
-#define WNI_CFG_NUM_BUFF_ADVERT    187
-#define WNI_CFG_MAX_RX_AMPDU_FACTOR    188
-#define WNI_CFG_SHORT_GI_20MHZ    189
-#define WNI_CFG_SHORT_GI_40MHZ    190
-#define WNI_CFG_RIFS_ENABLED    191
-#define WNI_CFG_MAX_PS_POLL    192
-#define WNI_CFG_NUM_BEACON_PER_RSSI_AVERAGE    193
-#define WNI_CFG_RSSI_FILTER_PERIOD    194
-#define WNI_CFG_MIN_RSSI_THRESHOLD    195
-#define WNI_CFG_NTH_BEACON_FILTER    196
-#define WNI_CFG_BROADCAST_FRAME_FILTER_ENABLE    197
-#define WNI_CFG_SCAN_IN_POWERSAVE    198
-#define WNI_CFG_IGNORE_DTIM    199
-#define WNI_CFG_WOWLAN_UCAST_PATTERN_FILTER_ENABLE    200
-#define WNI_CFG_WOWLAN_CHANNEL_SWITCH_ENABLE    201
-#define WNI_CFG_WOWLAN_DEAUTH_ENABLE    202
-#define WNI_CFG_WOWLAN_DISASSOC_ENABLE    203
-#define WNI_CFG_WOWLAN_MAX_MISSED_BEACON    204
-#define WNI_CFG_WOWLAN_MAX_SLEEP_PERIOD    205
-#define WNI_CFG_BA_TIMEOUT    206
-#define WNI_CFG_BA_THRESHOLD_HIGH    207
-#define WNI_CFG_MAX_BA_BUFFERS    208
-#define WNI_CFG_MAX_BA_SESSIONS    209
-#define WNI_CFG_BA_AUTO_SETUP    210
-#define WNI_CFG_ADDBA_REQ_DECLINE    211
-#define WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC    212
-#define WNI_CFG_BG_SCAN_CHANNEL_LIST    213
-#define WNI_CFG_MAX_MEDIUM_TIME    214
-#define WNI_CFG_MAX_MPDUS_IN_AMPDU    215
-#define WNI_CFG_IBSS_AUTO_BSSID    216
-#define WNI_CFG_PROBE_REQ_ADDNIE_FLAG    217
-#define WNI_CFG_PROBE_REQ_ADDNIE_DATA    218
-#define WNI_CFG_PROBE_RSP_ADDNIE_FLAG    219
-#define WNI_CFG_PROBE_RSP_ADDNIE_DATA1    220
-#define WNI_CFG_PROBE_RSP_ADDNIE_DATA2    221
-#define WNI_CFG_PROBE_RSP_ADDNIE_DATA3    222
-#define WNI_CFG_ASSOC_RSP_ADDNIE_FLAG    223
-#define WNI_CFG_ASSOC_RSP_ADDNIE_DATA    224
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_FLAG    225
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_DATA    226
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG    227
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA    228
-#define WNI_CFG_WPS_ENABLE    229
-#define WNI_CFG_WPS_STATE    230
-#define WNI_CFG_WPS_PROBE_REQ_FLAG    231
-#define WNI_CFG_WPS_VERSION    232
-#define WNI_CFG_WPS_REQUEST_TYPE    233
-#define WNI_CFG_WPS_CFG_METHOD    234
-#define WNI_CFG_WPS_UUID    235
-#define WNI_CFG_WPS_PRIMARY_DEVICE_CATEGORY    236
-#define WNI_CFG_WPS_PIMARY_DEVICE_OUI    237
-#define WNI_CFG_WPS_DEVICE_SUB_CATEGORY    238
-#define WNI_CFG_WPS_ASSOCIATION_STATE    239
-#define WNI_CFG_WPS_CONFIGURATION_ERROR    240
-#define WNI_CFG_WPS_DEVICE_PASSWORD_ID    241
-#define WNI_CFG_WPS_ASSOC_METHOD    242
-#define WNI_CFG_LOW_GAIN_OVERRIDE    243
-#define WNI_CFG_ENABLE_PHY_AGC_LISTEN_MODE    244
-#define WNI_CFG_RPE_POLLING_THRESHOLD    245
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG    246
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG    247
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG    248
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG    249
-#define WNI_CFG_NO_OF_ONCHIP_REORDER_SESSIONS    250
-#define WNI_CFG_SINGLE_TID_RC    251
-#define WNI_CFG_TX_PWR_CTRL_ENABLE    252
-#define WNI_CFG_MCAST_BCAST_FILTER_SETTING    253
-#define WNI_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK    254
-#define WNI_CFG_DYNAMIC_PS_POLL_VALUE    255
-#define WNI_CFG_PS_NULLDATA_AP_RESP_TIMEOUT    256
-#define WNI_CFG_TELE_BCN_WAKEUP_EN    257
-#define WNI_CFG_TELE_BCN_TRANS_LI    258
-#define WNI_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS    259
-#define WNI_CFG_TELE_BCN_MAX_LI    260
-#define WNI_CFG_TELE_BCN_MAX_LI_IDLE_BCNS    261
-#define WNI_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS    262
-#define WNI_CFG_INFRA_STA_KEEP_ALIVE_PERIOD    263
-#define WNI_CFG_ASSOC_STA_LIMIT    264
-#define WNI_CFG_SAP_CHANNEL_SELECT_START_CHANNEL    265
-#define WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL    266
-#define WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND    267
-#define WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD    268
-#define WNI_CFG_ENABLE_CLOSE_LOOP    269
-#define WNI_CFG_ENABLE_LTE_COEX    270
-#define WNI_CFG_AP_KEEP_ALIVE_TIMEOUT    271
-#define WNI_CFG_GO_KEEP_ALIVE_TIMEOUT    272
-#define WNI_CFG_ENABLE_MC_ADDR_LIST    273
-#define WNI_CFG_ENABLE_UC_FILTER    274
-#define WNI_CFG_ENABLE_LPWR_IMG_TRANSITION    275
-#define WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED    276
-#define WNI_CFG_DISABLE_LDPC_WITH_TXBF_AP    277
-#define WNI_CFG_AP_LINK_MONITOR_TIMEOUT    278
-#define WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK    279
-#define WNI_CFG_TDLS_BUF_STA_ENABLED    280
-#define WNI_CFG_TDLS_PUAPSD_INACT_TIME    281
-#define WNI_CFG_TDLS_RX_FRAME_THRESHOLD    282
-#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES    283
-#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL    284
-#define WNI_CFG_ENABLE_ADAPT_RX_DRAIN    285
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR    286
-#define WNI_CFG_ANTENNA_DIVESITY    287
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT    288
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY    289
-#define WNI_CFG_CURRENT_RSSI    290
-#define WNI_CFG_RTT3_ENABLE    291
-#define WNI_CFG_DEBUG_P2P_REMAIN_ON_CHANNEL    292
-#define WNI_CFG_TDLS_OFF_CHANNEL_ENABLED    293
-#define WNI_CFG_IBSS_ATIM_WIN_SIZE    294
-#define WNI_CFG_DFS_MASTER_ENABLED    295
-#define WNI_CFG_VHT_ENABLE_TXBF_20MHZ    296
-#define WNI_CFG_TDLS_WMM_MODE_ENABLED    297
-#define WNI_CFG_TGT_GTX_USR_CFG    298
-#define WNI_CFG_ASSOC_STA_LIMIT_GO    299
-#define WNI_CFG_ASSOC_STA_LIMIT_AP    300
-/*
- * String parameter lengths
- */
-
-#define WNI_CFG_STA_ID_LEN    6
-#define WNI_CFG_SSID_LEN    32
-#define WNI_CFG_WEP_DEFAULT_KEY_1_LEN    13
-#define WNI_CFG_WEP_DEFAULT_KEY_2_LEN    13
-#define WNI_CFG_WEP_DEFAULT_KEY_3_LEN    13
-#define WNI_CFG_WEP_DEFAULT_KEY_4_LEN    13
-#define WNI_CFG_SUPPORTED_RATES_11B_LEN    4
-#define WNI_CFG_SUPPORTED_RATES_11A_LEN    8
-#define WNI_CFG_OPERATIONAL_RATE_SET_LEN    12
-#define WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET_LEN    8
-#define WNI_CFG_PROPRIETARY_OPERATIONAL_RATE_SET_LEN    4
-#define WNI_CFG_VALID_CHANNEL_LIST_LEN    100
-#define WNI_CFG_MANUFACTURER_OUI_LEN    3
-#define WNI_CFG_MANUFACTURER_NAME_LEN    64
-#define WNI_CFG_MODEL_NUMBER_LEN    32
-#define WNI_CFG_MODEL_NAME_LEN    32
-#define WNI_CFG_MANUFACTURER_PRODUCT_NAME_LEN    32
-#define WNI_CFG_MANUFACTURER_PRODUCT_VERSION_LEN    32
-#define WNI_CFG_MAX_TX_POWER_2_4_LEN    128
-#define WNI_CFG_MAX_TX_POWER_5_LEN    128
-#define WNI_CFG_AP_NODE_NAME_LEN    32
-#define WNI_CFG_COUNTRY_CODE_LEN    3
-#define WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN    20
-#define WNI_CFG_EDCA_ANI_ACBE_LOCAL_LEN    20
-#define WNI_CFG_EDCA_ANI_ACVI_LOCAL_LEN    20
-#define WNI_CFG_EDCA_ANI_ACVO_LOCAL_LEN    20
-#define WNI_CFG_EDCA_ANI_ACBK_LEN    20
-#define WNI_CFG_EDCA_ANI_ACBE_LEN    20
-#define WNI_CFG_EDCA_ANI_ACVI_LEN    20
-#define WNI_CFG_EDCA_ANI_ACVO_LEN    20
-#define WNI_CFG_EDCA_WME_ACBK_LOCAL_LEN    20
-#define WNI_CFG_EDCA_WME_ACBE_LOCAL_LEN    20
-#define WNI_CFG_EDCA_WME_ACVI_LOCAL_LEN    20
-#define WNI_CFG_EDCA_WME_ACVO_LOCAL_LEN    20
-#define WNI_CFG_EDCA_WME_ACBK_LEN    20
-#define WNI_CFG_EDCA_WME_ACBE_LEN    20
-#define WNI_CFG_EDCA_WME_ACVI_LEN    20
-#define WNI_CFG_EDCA_WME_ACVO_LEN    20
-#define WNI_CFG_RADAR_CHANNEL_LIST_LEN    20
-#define WNI_CFG_SCAN_CONTROL_LIST_LEN    128
-#define WNI_CFG_SUPPORTED_MCS_SET_LEN    16
-#define WNI_CFG_BASIC_MCS_SET_LEN    16
-#define WNI_CFG_CURRENT_MCS_SET_LEN    16
-#define WNI_CFG_BG_SCAN_CHANNEL_LIST_LEN    100
-#define WNI_CFG_PROBE_REQ_ADDNIE_DATA_LEN    255
-#define WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN    255
-#define WNI_CFG_PROBE_RSP_ADDNIE_DATA2_LEN    255
-#define WNI_CFG_PROBE_RSP_ADDNIE_DATA3_LEN    255
-#define WNI_CFG_ASSOC_RSP_ADDNIE_DATA_LEN    255
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_DATA_LEN    255
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA_LEN    255
-#define WNI_CFG_WPS_UUID_LEN    16
-
-/*
- * Integer parameter min/max/default values
- */
-
-#define WNI_CFG_CF_POLLABLE_APMIN    0
-#define WNI_CFG_CF_POLLABLE_APMAX    1
-#define WNI_CFG_CF_POLLABLE_APDEF    0
-
-#define WNI_CFG_CFP_PERIOD_STAMIN    0
-#define WNI_CFG_CFP_PERIOD_STAMAX    255
-#define WNI_CFG_CFP_PERIOD_STADEF    1
-
-#define WNI_CFG_CFP_PERIOD_APMIN    0
-#define WNI_CFG_CFP_PERIOD_APMAX    255
-#define WNI_CFG_CFP_PERIOD_APDEF    1
-
-#define WNI_CFG_CFP_MAX_DURATION_STAMIN    0
-#define WNI_CFG_CFP_MAX_DURATION_STAMAX    65535
-#define WNI_CFG_CFP_MAX_DURATION_STADEF    30000
-
-#define WNI_CFG_CFP_MAX_DURATION_APMIN    0
-#define WNI_CFG_CFP_MAX_DURATION_APMAX    65535
-#define WNI_CFG_CFP_MAX_DURATION_APDEF    30000
-
-#define WNI_CFG_BEACON_INTERVAL_STAMIN    0
-#define WNI_CFG_BEACON_INTERVAL_STAMAX    65535
-#define WNI_CFG_BEACON_INTERVAL_STADEF    100
-
-#define WNI_CFG_BEACON_INTERVAL_APMIN    0
-#define WNI_CFG_BEACON_INTERVAL_APMAX    65535
-#define WNI_CFG_BEACON_INTERVAL_APDEF    100
-
-#define WNI_CFG_DTIM_PERIOD_STAMIN    0
-#define WNI_CFG_DTIM_PERIOD_STAMAX    65535
-#define WNI_CFG_DTIM_PERIOD_STADEF    1
-
-#define WNI_CFG_DTIM_PERIOD_APMIN    0
-#define WNI_CFG_DTIM_PERIOD_APMAX    65535
-#define WNI_CFG_DTIM_PERIOD_APDEF    1
-
-#define WNI_CFG_WEP_KEY_LENGTH_STAMIN    5
-#define WNI_CFG_WEP_KEY_LENGTH_STAMAX    13
-#define WNI_CFG_WEP_KEY_LENGTH_STADEF    5
-
-#define WNI_CFG_WEP_KEY_LENGTH_APMIN    5
-#define WNI_CFG_WEP_KEY_LENGTH_APMAX    13
-#define WNI_CFG_WEP_KEY_LENGTH_APDEF    5
-
-#define WNI_CFG_WEP_KEY_LENGTH_5    5
-#define WNI_CFG_WEP_KEY_LENGTH_13    13
-
-#define WNI_CFG_WEP_DEFAULT_KEYID_STAMIN    0
-#define WNI_CFG_WEP_DEFAULT_KEYID_STAMAX    3
-#define WNI_CFG_WEP_DEFAULT_KEYID_STADEF    0
-
-#define WNI_CFG_WEP_DEFAULT_KEYID_APMIN    0
-#define WNI_CFG_WEP_DEFAULT_KEYID_APMAX    3
-#define WNI_CFG_WEP_DEFAULT_KEYID_APDEF    0
-
-#define WNI_CFG_WEP_DEFAULT_KEYID_0    0
-#define WNI_CFG_WEP_DEFAULT_KEYID_1    1
-#define WNI_CFG_WEP_DEFAULT_KEYID_2    2
-#define WNI_CFG_WEP_DEFAULT_KEYID_3    3
-
-#define WNI_CFG_EXCLUDE_UNENCRYPTED_STAMIN    0
-#define WNI_CFG_EXCLUDE_UNENCRYPTED_STAMAX    1
-#define WNI_CFG_EXCLUDE_UNENCRYPTED_STADEF    0
-
-#define WNI_CFG_EXCLUDE_UNENCRYPTED_APMIN    0
-#define WNI_CFG_EXCLUDE_UNENCRYPTED_APMAX    1
-#define WNI_CFG_EXCLUDE_UNENCRYPTED_APDEF    0
-
-#define WNI_CFG_RTS_THRESHOLD_STAMIN    0
-#define WNI_CFG_RTS_THRESHOLD_STAMAX    1048576
-#define WNI_CFG_RTS_THRESHOLD_STADEF    2347
-
-#define WNI_CFG_RTS_THRESHOLD_APMIN    0
-#define WNI_CFG_RTS_THRESHOLD_APMAX    1048576
-#define WNI_CFG_RTS_THRESHOLD_APDEF    2347
-
-#define WNI_CFG_SHORT_RETRY_LIMIT_STAMIN    0
-#define WNI_CFG_SHORT_RETRY_LIMIT_STAMAX    255
-#define WNI_CFG_SHORT_RETRY_LIMIT_STADEF    6
-
-#define WNI_CFG_SHORT_RETRY_LIMIT_APMIN    0
-#define WNI_CFG_SHORT_RETRY_LIMIT_APMAX    255
-#define WNI_CFG_SHORT_RETRY_LIMIT_APDEF    6
-
-#define WNI_CFG_LONG_RETRY_LIMIT_STAMIN    0
-#define WNI_CFG_LONG_RETRY_LIMIT_STAMAX    255
-#define WNI_CFG_LONG_RETRY_LIMIT_STADEF    6
-
-#define WNI_CFG_LONG_RETRY_LIMIT_APMIN    0
-#define WNI_CFG_LONG_RETRY_LIMIT_APMAX    255
-#define WNI_CFG_LONG_RETRY_LIMIT_APDEF    6
-
-#define WNI_CFG_FRAGMENTATION_THRESHOLD_STAMIN    256
-#define WNI_CFG_FRAGMENTATION_THRESHOLD_STAMAX    8000
-#define WNI_CFG_FRAGMENTATION_THRESHOLD_STADEF    8000
-
-#define WNI_CFG_FRAGMENTATION_THRESHOLD_APMIN    256
-#define WNI_CFG_FRAGMENTATION_THRESHOLD_APMAX    8000
-#define WNI_CFG_FRAGMENTATION_THRESHOLD_APDEF    8000
-
-#define WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME_STAMIN    0
-#define WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME_STAMAX    65535
-#define WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME_STADEF    20
-
-#define WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME_APMIN    0
-#define WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME_APMAX    65535
-#define WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME_APDEF    20
-
-#define WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME_STAMIN    0
-#define WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME_STAMAX    65535
-#define WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME_STADEF    40
-
-#define WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME_APMIN    0
-#define WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME_APMAX    65535
-#define WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME_APDEF    40
-
-#define WNI_CFG_PASSIVE_MINIMUM_CHANNEL_TIME_STAMIN    0
-#define WNI_CFG_PASSIVE_MINIMUM_CHANNEL_TIME_STAMAX    65535
-#define WNI_CFG_PASSIVE_MINIMUM_CHANNEL_TIME_STADEF    60
-
-#define WNI_CFG_PASSIVE_MINIMUM_CHANNEL_TIME_APMIN    0
-#define WNI_CFG_PASSIVE_MINIMUM_CHANNEL_TIME_APMAX    65535
-#define WNI_CFG_PASSIVE_MINIMUM_CHANNEL_TIME_APDEF    60
-
-#define WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME_STAMIN    0
-#define WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME_STAMAX    65535
-#define WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME_STADEF    110
-
-#define WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME_APMIN    0
-#define WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME_APMAX    65535
-#define WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME_APDEF    110
-
-#define WNI_CFG_JOIN_FAILURE_TIMEOUT_STAMIN    0
-#define WNI_CFG_JOIN_FAILURE_TIMEOUT_STAMAX    65535
-#define WNI_CFG_JOIN_FAILURE_TIMEOUT_STADEF    3000
-
-#define WNI_CFG_JOIN_FAILURE_TIMEOUT_APMIN    0
-#define WNI_CFG_JOIN_FAILURE_TIMEOUT_APMAX    65535
-#define WNI_CFG_JOIN_FAILURE_TIMEOUT_APDEF    3000
-
-#define WNI_CFG_AUTHENTICATE_FAILURE_TIMEOUT_STAMIN    0
-#define WNI_CFG_AUTHENTICATE_FAILURE_TIMEOUT_STAMAX    65535
-#define WNI_CFG_AUTHENTICATE_FAILURE_TIMEOUT_STADEF    1000
-
-#define WNI_CFG_AUTHENTICATE_FAILURE_TIMEOUT_APMIN    0
-#define WNI_CFG_AUTHENTICATE_FAILURE_TIMEOUT_APMAX    65535
-#define WNI_CFG_AUTHENTICATE_FAILURE_TIMEOUT_APDEF    1000
-
-#define WNI_CFG_AUTHENTICATE_RSP_TIMEOUT_STAMIN    0
-#define WNI_CFG_AUTHENTICATE_RSP_TIMEOUT_STAMAX    65535
-#define WNI_CFG_AUTHENTICATE_RSP_TIMEOUT_STADEF    1000
-
-#define WNI_CFG_AUTHENTICATE_RSP_TIMEOUT_APMIN    0
-#define WNI_CFG_AUTHENTICATE_RSP_TIMEOUT_APMAX    65535
-#define WNI_CFG_AUTHENTICATE_RSP_TIMEOUT_APDEF    1000
-
-#define WNI_CFG_ASSOCIATION_FAILURE_TIMEOUT_STAMIN    0
-#define WNI_CFG_ASSOCIATION_FAILURE_TIMEOUT_STAMAX    65535
-#define WNI_CFG_ASSOCIATION_FAILURE_TIMEOUT_STADEF    2000
-
-#define WNI_CFG_ASSOCIATION_FAILURE_TIMEOUT_APMIN    0
-#define WNI_CFG_ASSOCIATION_FAILURE_TIMEOUT_APMAX    65535
-#define WNI_CFG_ASSOCIATION_FAILURE_TIMEOUT_APDEF    3000
-
-#define WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT_STAMIN    0
-#define WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT_STAMAX    65535
-#define WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT_STADEF    1000
-
-#define WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT_APMIN    0
-#define WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT_APMAX    65535
-#define WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT_APDEF    3000
-
-#define WNI_CFG_RA_PERIODICITY_TIMEOUT_IN_PS_STAMIN    0
-#define WNI_CFG_RA_PERIODICITY_TIMEOUT_IN_PS_STAMAX    65535
-#define WNI_CFG_RA_PERIODICITY_TIMEOUT_IN_PS_STADEF    1000
-
-#define WNI_CFG_PS_ENABLE_BCN_FILTER_STAMIN    0
-#define WNI_CFG_PS_ENABLE_BCN_FILTER_STAMAX    1
-#define WNI_CFG_PS_ENABLE_BCN_FILTER_STADEF    1
-
-#define WNI_CFG_PS_ENABLE_HEART_BEAT_STAMIN    0
-#define WNI_CFG_PS_ENABLE_HEART_BEAT_STAMAX    1
-#define WNI_CFG_PS_ENABLE_HEART_BEAT_STADEF    1
-
-#define WNI_CFG_PS_ENABLE_RSSI_MONITOR_STAMIN    0
-#define WNI_CFG_PS_ENABLE_RSSI_MONITOR_STAMAX    1
-#define WNI_CFG_PS_ENABLE_RSSI_MONITOR_STADEF    0
-
-#define WNI_CFG_PS_DATA_INACTIVITY_TIMEOUT_STAMIN    1
-#define WNI_CFG_PS_DATA_INACTIVITY_TIMEOUT_STAMAX    255
-#define WNI_CFG_PS_DATA_INACTIVITY_TIMEOUT_STADEF    20
-
-#define WNI_CFG_RF_SETTLING_TIME_CLK_STAMIN    0
-#define WNI_CFG_RF_SETTLING_TIME_CLK_STAMAX    60000
-#define WNI_CFG_RF_SETTLING_TIME_CLK_STADEF    1500
-
-#define WNI_CFG_PHY_MODE_STAMIN    0
-#define WNI_CFG_PHY_MODE_STAMAX    3
-#define WNI_CFG_PHY_MODE_STADEF    0
-
-#define WNI_CFG_PHY_MODE_APMIN    0
-#define WNI_CFG_PHY_MODE_APMAX    3
-#define WNI_CFG_PHY_MODE_APDEF    0
-
-#define WNI_CFG_PHY_MODE_11A    0
-#define WNI_CFG_PHY_MODE_11B    1
-#define WNI_CFG_PHY_MODE_11G    2
-#define WNI_CFG_PHY_MODE_NONE    3
-
-#define WNI_CFG_DOT11_MODE_STAMIN    0
-#define WNI_CFG_DOT11_MODE_STAMAX    11
-#define WNI_CFG_DOT11_MODE_STADEF    0
-
-#define WNI_CFG_DOT11_MODE_APMIN    0
-#define WNI_CFG_DOT11_MODE_APMAX    11
-#define WNI_CFG_DOT11_MODE_APDEF    0
-
-#define WNI_CFG_DOT11_MODE_ALL    0
-#define WNI_CFG_DOT11_MODE_11A    1
-#define WNI_CFG_DOT11_MODE_11B    2
-#define WNI_CFG_DOT11_MODE_11G    3
-#define WNI_CFG_DOT11_MODE_11N    4
-#define WNI_CFG_DOT11_MODE_11G_ONLY    5
-#define WNI_CFG_DOT11_MODE_11N_ONLY    6
-#define WNI_CFG_DOT11_MODE_11AC    7
-#define WNI_CFG_DOT11_MODE_11AC_ONLY    8
-
-#define WNI_CFG_LISTEN_INTERVAL_STAMIN    0
-#define WNI_CFG_LISTEN_INTERVAL_STAMAX    65535
-#define WNI_CFG_LISTEN_INTERVAL_STADEF    1
-
-#define WNI_CFG_LISTEN_INTERVAL_APMIN    0
-#define WNI_CFG_LISTEN_INTERVAL_APMAX    65535
-#define WNI_CFG_LISTEN_INTERVAL_APDEF    1
-
-#define WNI_CFG_CURRENT_CHANNEL_STAMIN    0
-#define WNI_CFG_CURRENT_CHANNEL_STAMAX    165
-#define WNI_CFG_CURRENT_CHANNEL_STADEF    1
-
-#define WNI_CFG_CURRENT_CHANNEL_APMIN    0
-#define WNI_CFG_CURRENT_CHANNEL_APMAX    165
-#define WNI_CFG_CURRENT_CHANNEL_APDEF    1
-
-#define WNI_CFG_DEFAULT_RATE_INDEX_5GHZ_STAMIN    0
-#define WNI_CFG_DEFAULT_RATE_INDEX_5GHZ_STAMAX    11
-#define WNI_CFG_DEFAULT_RATE_INDEX_5GHZ_STADEF    5
-
-#define WNI_CFG_DEFAULT_RATE_INDEX_5GHZ_APMIN    0
-#define WNI_CFG_DEFAULT_RATE_INDEX_5GHZ_APMAX    11
-#define WNI_CFG_DEFAULT_RATE_INDEX_5GHZ_APDEF    5
-
-#define WNI_CFG_DEFAULT_RATE_INDEX_24GHZ_STAMIN    0
-#define WNI_CFG_DEFAULT_RATE_INDEX_24GHZ_STAMAX    31
-#define WNI_CFG_DEFAULT_RATE_INDEX_24GHZ_STADEF    1
-
-#define WNI_CFG_DEFAULT_RATE_INDEX_24GHZ_APMIN    0
-#define WNI_CFG_DEFAULT_RATE_INDEX_24GHZ_APMAX    31
-#define WNI_CFG_DEFAULT_RATE_INDEX_24GHZ_APDEF    1
-
-#define WNI_CFG_RATE_ADAPTATION_TYPE_STAMIN    0
-#define WNI_CFG_RATE_ADAPTATION_TYPE_STAMAX    2
-#define WNI_CFG_RATE_ADAPTATION_TYPE_STADEF    1
-
-#define WNI_CFG_RATE_ADAPTATION_TYPE_APMIN    0
-#define WNI_CFG_RATE_ADAPTATION_TYPE_APMAX    2
-#define WNI_CFG_RATE_ADAPTATION_TYPE_APDEF    1
-
-#define WNI_CFG_RATE_ADAPTATION_TYPE_FIXED    0
-#define WNI_CFG_RATE_ADAPTATION_TYPE_AUTO    1
-#define WNI_CFG_RATE_ADAPTATION_TYPE_SNR_BASED    2
-
-#define WNI_CFG_FIXED_RATE_STAMIN    0
-#define WNI_CFG_FIXED_RATE_STAMAX    44
-#define WNI_CFG_FIXED_RATE_STADEF    0
-
-#define WNI_CFG_FIXED_RATE_APMIN    0
-#define WNI_CFG_FIXED_RATE_APMAX    44
-#define WNI_CFG_FIXED_RATE_APDEF    0
-
-#define WNI_CFG_FIXED_RATE_AUTO    0
-#define WNI_CFG_FIXED_RATE_1MBPS    1
-#define WNI_CFG_FIXED_RATE_2MBPS    2
-#define WNI_CFG_FIXED_RATE_5_5MBPS    3
-#define WNI_CFG_FIXED_RATE_11MBPS    4
-#define WNI_CFG_FIXED_RATE_6MBPS    5
-#define WNI_CFG_FIXED_RATE_9MBPS    6
-#define WNI_CFG_FIXED_RATE_12MBPS    7
-#define WNI_CFG_FIXED_RATE_18MBPS    8
-#define WNI_CFG_FIXED_RATE_24MBPS    9
-#define WNI_CFG_FIXED_RATE_36MBPS    10
-#define WNI_CFG_FIXED_RATE_48MBPS    11
-#define WNI_CFG_FIXED_RATE_54MBPS    12
-#define WNI_CFG_FIXED_RATE_6_5MBPS_MCS0_20MHZ_SIMO    13
-#define WNI_CFG_FIXED_RATE_13MBPS_MCS1_20MHZ_SIMO    14
-#define WNI_CFG_FIXED_RATE_19_5MBPS_MCS2_20MHZ_SIMO    15
-#define WNI_CFG_FIXED_RATE_26MBPS_MCS3_20MHZ_SIMO    16
-#define WNI_CFG_FIXED_RATE_39MBPS_MCS4_20MHZ_SIMO    17
-#define WNI_CFG_FIXED_RATE_52MBPS_MCS5_20MHZ_SIMO    18
-#define WNI_CFG_FIXED_RATE_58_5MBPS_MCS6_20MHZ_SIMO    19
-#define WNI_CFG_FIXED_RATE_65MBPS_MCS7_20MHZ_SIMO    20
-#define WNI_CFG_FIXED_RATE_7_2MBPS_MCS0_20MHZ_SIMO_SGI    21
-#define WNI_CFG_FIXED_RATE_14_4MBPS_MCS1_20MHZ_SIMO_SGI    22
-#define WNI_CFG_FIXED_RATE_21_7MBPS_MCS2_20MHZ_SIMO_SGI    23
-#define WNI_CFG_FIXED_RATE_28_9MBPS_MCS3_20MHZ_SIMO_SGI    24
-#define WNI_CFG_FIXED_RATE_43_3MBPS_MCS4_20MHZ_SIMO_SGI    25
-#define WNI_CFG_FIXED_RATE_57_8MBPS_MCS5_20MHZ_SIMO_SGI    26
-#define WNI_CFG_FIXED_RATE_65MBPS_MCS6_20MHZ_SIMO_SGI    27
-#define WNI_CFG_FIXED_RATE_72_2MBPS_MCS7_20MHZ_SIMO_SGI    28
-#define WNI_CFG_FIXED_RATE_0_25MBPS_SLR_20MHZ_SIMO    29
-#define WNI_CFG_FIXED_RATE_0_5MBPS_SLR_20MHZ_SIMO    30
-#define WNI_CFG_FIXED_RATE_68_25MBPS_QC_PROP_20MHZ_SIMO    31
-#define WNI_CFG_FIXED_RATE_54MBPS_MCS3_40MHZ_SIMO    32
-#define WNI_CFG_FIXED_RATE_81MBPS_MCS4_40MHZ_SIMO    33
-#define WNI_CFG_FIXED_RATE_108MBPS_MCS5_40MHZ_SIMO    34
-#define WNI_CFG_FIXED_RATE_121_5MBPS_MCS6_40MHZ_SIMO    35
-#define WNI_CFG_FIXED_RATE_135MBPS_MCS7_40MHZ_SIMO    36
-#define WNI_CFG_FIXED_RATE_15MBPS_MCS0_40MHZ_SIMO_SGI    37
-#define WNI_CFG_FIXED_RATE_30MBPS_MCS1_40MHZ_SIMO_SGI    38
-#define WNI_CFG_FIXED_RATE_45MBPS_MCS2_40MHZ_SIMO_SGI    39
-#define WNI_CFG_FIXED_RATE_60MBPS_MCS3_40MHZ_SIMO_SGI    40
-#define WNI_CFG_FIXED_RATE_90MBPS_MCS4_40MHZ_SIMO_SGI    41
-#define WNI_CFG_FIXED_RATE_120MBPS_MCS5_40MHZ_SIMO_SGI    42
-#define WNI_CFG_FIXED_RATE_135MBPS_MCS6_40MHZ_SIMO_SGI    43
-#define WNI_CFG_FIXED_RATE_150MBPS_MCS7_40MHZ_SIMO_SGI    44
-
-#define WNI_CFG_FIXED_RATE_MULTICAST_24GHZ_STAMIN    0
-#define WNI_CFG_FIXED_RATE_MULTICAST_24GHZ_STAMAX    31
-#define WNI_CFG_FIXED_RATE_MULTICAST_24GHZ_STADEF    1
-
-#define WNI_CFG_FIXED_RATE_MULTICAST_24GHZ_APMIN    0
-#define WNI_CFG_FIXED_RATE_MULTICAST_24GHZ_APMAX    31
-#define WNI_CFG_FIXED_RATE_MULTICAST_24GHZ_APDEF    1
-
-#define WNI_CFG_FIXED_RATE_MULTICAST_5GHZ_STAMIN    0
-#define WNI_CFG_FIXED_RATE_MULTICAST_5GHZ_STAMAX    31
-#define WNI_CFG_FIXED_RATE_MULTICAST_5GHZ_STADEF    5
-
-#define WNI_CFG_FIXED_RATE_MULTICAST_5GHZ_APMIN    0
-#define WNI_CFG_FIXED_RATE_MULTICAST_5GHZ_APMAX    31
-#define WNI_CFG_FIXED_RATE_MULTICAST_5GHZ_APDEF    5
-
-#define WNI_CFG_RETRYRATE_POLICY_STAMIN    0
-#define WNI_CFG_RETRYRATE_POLICY_STAMAX    255
-#define WNI_CFG_RETRYRATE_POLICY_STADEF    4
-
-#define WNI_CFG_RETRYRATE_POLICY_APMIN    0
-#define WNI_CFG_RETRYRATE_POLICY_APMAX    255
-#define WNI_CFG_RETRYRATE_POLICY_APDEF    4
-
-#define WNI_CFG_RETRYRATE_POLICY_MIN_SUPPORTED    0
-#define WNI_CFG_RETRYRATE_POLICY_PRIMARY    1
-#define WNI_CFG_RETRYRATE_POLICY_RESERVED    2
-#define WNI_CFG_RETRYRATE_POLICY_CLOSEST    3
-#define WNI_CFG_RETRYRATE_POLICY_AUTOSELECT    4
-#define WNI_CFG_RETRYRATE_POLICY_MAX    5
-
-#define WNI_CFG_RETRYRATE_SECONDARY_STAMIN    0
-#define WNI_CFG_RETRYRATE_SECONDARY_STAMAX    255
-#define WNI_CFG_RETRYRATE_SECONDARY_STADEF    0
-
-#define WNI_CFG_RETRYRATE_SECONDARY_APMIN    0
-#define WNI_CFG_RETRYRATE_SECONDARY_APMAX    255
-#define WNI_CFG_RETRYRATE_SECONDARY_APDEF    0
-
-#define WNI_CFG_RETRYRATE_TERTIARY_STAMIN    0
-#define WNI_CFG_RETRYRATE_TERTIARY_STAMAX    255
-#define WNI_CFG_RETRYRATE_TERTIARY_STADEF    0
-
-#define WNI_CFG_RETRYRATE_TERTIARY_APMIN    0
-#define WNI_CFG_RETRYRATE_TERTIARY_APMAX    255
-#define WNI_CFG_RETRYRATE_TERTIARY_APDEF    0
-
-#define WNI_CFG_APSD_ENABLED_STAMIN    0
-#define WNI_CFG_APSD_ENABLED_STAMAX    1
-#define WNI_CFG_APSD_ENABLED_STADEF    0
-
-#define WNI_CFG_APSD_ENABLED_APMIN    0
-#define WNI_CFG_APSD_ENABLED_APMAX    1
-#define WNI_CFG_APSD_ENABLED_APDEF    0
-
-#define WNI_CFG_SHARED_KEY_AUTH_ENABLE_STAMIN    0
-#define WNI_CFG_SHARED_KEY_AUTH_ENABLE_STAMAX    1
-#define WNI_CFG_SHARED_KEY_AUTH_ENABLE_STADEF    1
-
-#define WNI_CFG_SHARED_KEY_AUTH_ENABLE_APMIN    0
-#define WNI_CFG_SHARED_KEY_AUTH_ENABLE_APMAX    1
-#define WNI_CFG_SHARED_KEY_AUTH_ENABLE_APDEF    1
-
-#define WNI_CFG_OPEN_SYSTEM_AUTH_ENABLE_STAMIN    0
-#define WNI_CFG_OPEN_SYSTEM_AUTH_ENABLE_STAMAX    1
-#define WNI_CFG_OPEN_SYSTEM_AUTH_ENABLE_STADEF    1
-
-#define WNI_CFG_OPEN_SYSTEM_AUTH_ENABLE_APMIN    0
-#define WNI_CFG_OPEN_SYSTEM_AUTH_ENABLE_APMAX    1
-#define WNI_CFG_OPEN_SYSTEM_AUTH_ENABLE_APDEF    1
-
-#define WNI_CFG_AUTHENTICATION_TYPE_STAMIN    0
-#define WNI_CFG_AUTHENTICATION_TYPE_STAMAX    65535
-#define WNI_CFG_AUTHENTICATION_TYPE_STADEF    0
-
-#define WNI_CFG_AUTHENTICATION_TYPE_APMIN    0
-#define WNI_CFG_AUTHENTICATION_TYPE_APMAX    65535
-#define WNI_CFG_AUTHENTICATION_TYPE_APDEF    0
-
-#define WNI_CFG_CF_POLL_REQUEST_APMIN    0
-#define WNI_CFG_CF_POLL_REQUEST_APMAX    1
-#define WNI_CFG_CF_POLL_REQUEST_APDEF    0
-
-#define WNI_CFG_PRIVACY_ENABLED_STAMIN    0
-#define WNI_CFG_PRIVACY_ENABLED_STAMAX    1
-#define WNI_CFG_PRIVACY_ENABLED_STADEF    0
-
-#define WNI_CFG_PRIVACY_ENABLED_APMIN    0
-#define WNI_CFG_PRIVACY_ENABLED_APMAX    1
-#define WNI_CFG_PRIVACY_ENABLED_APDEF    0
-
-#define WNI_CFG_SHORT_PREAMBLE_STAMIN    0
-#define WNI_CFG_SHORT_PREAMBLE_STAMAX    1
-#define WNI_CFG_SHORT_PREAMBLE_STADEF    1
-
-#define WNI_CFG_SHORT_PREAMBLE_APMIN    0
-#define WNI_CFG_SHORT_PREAMBLE_APMAX    1
-#define WNI_CFG_SHORT_PREAMBLE_APDEF    1
-
-#define WNI_CFG_SHORT_SLOT_TIME_STAMIN    0
-#define WNI_CFG_SHORT_SLOT_TIME_STAMAX    1
-#define WNI_CFG_SHORT_SLOT_TIME_STADEF    1
-
-#define WNI_CFG_SHORT_SLOT_TIME_APMIN    0
-#define WNI_CFG_SHORT_SLOT_TIME_APMAX    1
-#define WNI_CFG_SHORT_SLOT_TIME_APDEF    0
-
-#define WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY_STAMIN    0
-#define WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY_STAMAX    1
-#define WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY_STADEF    0
-
-#define WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY_APMIN    0
-#define WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY_APMAX    1
-#define WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY_APDEF    0
-
-#define WNI_CFG_QOS_ENABLED_STAMIN    0
-#define WNI_CFG_QOS_ENABLED_STAMAX    1
-#define WNI_CFG_QOS_ENABLED_STADEF    0
-
-#define WNI_CFG_QOS_ENABLED_APMIN    0
-#define WNI_CFG_QOS_ENABLED_APMAX    1
-#define WNI_CFG_QOS_ENABLED_APDEF    0
-
-#define WNI_CFG_HCF_ENABLED_STAMIN    0
-#define WNI_CFG_HCF_ENABLED_STAMAX    1
-#define WNI_CFG_HCF_ENABLED_STADEF    0
-
-#define WNI_CFG_HCF_ENABLED_APMIN    0
-#define WNI_CFG_HCF_ENABLED_APMAX    1
-#define WNI_CFG_HCF_ENABLED_APDEF    0
-
-#define WNI_CFG_RSN_ENABLED_STAMIN    0
-#define WNI_CFG_RSN_ENABLED_STAMAX    1
-#define WNI_CFG_RSN_ENABLED_STADEF    0
-
-#define WNI_CFG_RSN_ENABLED_APMIN    0
-#define WNI_CFG_RSN_ENABLED_APMAX    1
-#define WNI_CFG_RSN_ENABLED_APDEF    0
-
-#define WNI_CFG_BACKGROUND_SCAN_PERIOD_STAMIN    0
-#define WNI_CFG_BACKGROUND_SCAN_PERIOD_STAMAX    180000
-#define WNI_CFG_BACKGROUND_SCAN_PERIOD_STADEF    5000
-
-#define WNI_CFG_BACKGROUND_SCAN_PERIOD_APMIN    0
-#define WNI_CFG_BACKGROUND_SCAN_PERIOD_APMAX    18000
-#define WNI_CFG_BACKGROUND_SCAN_PERIOD_APDEF    5000
-
-#define WNI_CFG_MAX_NUM_PRE_AUTH_STAMIN    0
-#define WNI_CFG_MAX_NUM_PRE_AUTH_STAMAX    256
-#define WNI_CFG_MAX_NUM_PRE_AUTH_STADEF    64
-
-#define WNI_CFG_MAX_NUM_PRE_AUTH_APMIN    0
-#define WNI_CFG_MAX_NUM_PRE_AUTH_APMAX    256
-#define WNI_CFG_MAX_NUM_PRE_AUTH_APDEF    64
-
-#define WNI_CFG_PREAUTH_CLNUP_TIMEOUT_APMIN    0
-#define WNI_CFG_PREAUTH_CLNUP_TIMEOUT_APMAX    120000
-#define WNI_CFG_PREAUTH_CLNUP_TIMEOUT_APDEF    30000
-
-#define WNI_CFG_RELEASE_AID_TIMEOUT_APMIN    0
-#define WNI_CFG_RELEASE_AID_TIMEOUT_APMAX    100000
-#define WNI_CFG_RELEASE_AID_TIMEOUT_APDEF    1000
-
-#define WNI_CFG_HEART_BEAT_THRESHOLD_STAMIN    0
-#define WNI_CFG_HEART_BEAT_THRESHOLD_STAMAX    65535
-#define WNI_CFG_HEART_BEAT_THRESHOLD_STADEF    40
-
-#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_STAMIN    10
-#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_STAMAX    10000
-#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_STADEF    40
-
-#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_APMIN    10
-#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_APMAX    10000
-#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_APDEF    40
-
-#define WNI_CFG_11D_ENABLED_STAMIN    0
-#define WNI_CFG_11D_ENABLED_STAMAX    1
-#define WNI_CFG_11D_ENABLED_STADEF    1
-
-#define WNI_CFG_11D_ENABLED_APMIN    0
-#define WNI_CFG_11D_ENABLED_APMAX    1
-#define WNI_CFG_11D_ENABLED_APDEF    0
-
-#define WNI_CFG_NETWORK_DENSITY_STAMIN    0
-#define WNI_CFG_NETWORK_DENSITY_STAMAX    3
-#define WNI_CFG_NETWORK_DENSITY_STADEF    3
-
-#define WNI_CFG_NETWORK_DENSITY_APMIN    0
-#define WNI_CFG_NETWORK_DENSITY_APMAX    3
-#define WNI_CFG_NETWORK_DENSITY_APDEF    0
-
-#define WNI_CFG_NETWORK_DENSITY_LOW    0
-#define WNI_CFG_NETWORK_DENSITY_MEDIUM    1
-#define WNI_CFG_NETWORK_DENSITY_HIGH    2
-#define WNI_CFG_NETWORK_DENSITY_ADAPTIVE    3
-
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM_STAMIN    1
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM_STAMAX    2
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM_STADEF    2
-
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM_APMIN    1
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM_APMAX    2
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM_APDEF    2
-
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM_CARRIER    1
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM_CORRELATION    2
-
-#define WNI_CFG_CURRENT_TX_ANTENNA_STAMIN    1
-#define WNI_CFG_CURRENT_TX_ANTENNA_STAMAX    1
-#define WNI_CFG_CURRENT_TX_ANTENNA_STADEF    1
-
-#define WNI_CFG_CURRENT_TX_ANTENNA_APMIN    1
-#define WNI_CFG_CURRENT_TX_ANTENNA_APMAX    2
-#define WNI_CFG_CURRENT_TX_ANTENNA_APDEF    2
-
-#define WNI_CFG_CURRENT_RX_ANTENNA_STAMIN    1
-#define WNI_CFG_CURRENT_RX_ANTENNA_STAMAX    2
-#define WNI_CFG_CURRENT_RX_ANTENNA_STADEF    2
-
-#define WNI_CFG_CURRENT_RX_ANTENNA_APMIN    1
-#define WNI_CFG_CURRENT_RX_ANTENNA_APMAX    3
-#define WNI_CFG_CURRENT_RX_ANTENNA_APDEF    3
-
-#define WNI_CFG_CURRENT_TX_POWER_LEVEL_STAMIN    0
-#define WNI_CFG_CURRENT_TX_POWER_LEVEL_STAMAX    128
-#define WNI_CFG_CURRENT_TX_POWER_LEVEL_STADEF    27
-
-#define WNI_CFG_CURRENT_TX_POWER_LEVEL_APMIN    0
-#define WNI_CFG_CURRENT_TX_POWER_LEVEL_APMAX    128
-#define WNI_CFG_CURRENT_TX_POWER_LEVEL_APDEF    27
-
-#define WNI_CFG_NEW_BSS_FOUND_IND_STAMIN    0
-#define WNI_CFG_NEW_BSS_FOUND_IND_STAMAX    1
-#define WNI_CFG_NEW_BSS_FOUND_IND_STADEF    0
-
-#define WNI_CFG_NEW_BSS_FOUND_IND_APMIN    0
-#define WNI_CFG_NEW_BSS_FOUND_IND_APMAX    1
-#define WNI_CFG_NEW_BSS_FOUND_IND_APDEF    0
-
-#define WNI_CFG_PROPRIETARY_RATES_ENABLED_STAMIN    0
-#define WNI_CFG_PROPRIETARY_RATES_ENABLED_STAMAX    1
-#define WNI_CFG_PROPRIETARY_RATES_ENABLED_STADEF    0
-
-#define WNI_CFG_PROPRIETARY_RATES_ENABLED_APMIN    0
-#define WNI_CFG_PROPRIETARY_RATES_ENABLED_APMAX    1
-#define WNI_CFG_PROPRIETARY_RATES_ENABLED_APDEF    0
-
-#define WNI_CFG_11H_ENABLED_STAMIN    0
-#define WNI_CFG_11H_ENABLED_STAMAX    1
-#define WNI_CFG_11H_ENABLED_STADEF    1
-
-#define WNI_CFG_11H_ENABLED_APMIN    0
-#define WNI_CFG_11H_ENABLED_APMAX    1
-#define WNI_CFG_11H_ENABLED_APDEF    1
-
-#define WNI_CFG_WT_CNF_TIMEOUT_STAMIN    10
-#define WNI_CFG_WT_CNF_TIMEOUT_STAMAX    3000
-#define WNI_CFG_WT_CNF_TIMEOUT_STADEF    1000
-
-#define WNI_CFG_WT_CNF_TIMEOUT_APMIN    10
-#define WNI_CFG_WT_CNF_TIMEOUT_APMAX    3000
-#define WNI_CFG_WT_CNF_TIMEOUT_APDEF    1000
-
-#define WNI_CFG_KEEPALIVE_TIMEOUT_STAMIN    0
-#define WNI_CFG_KEEPALIVE_TIMEOUT_STAMAX    3600000
-#define WNI_CFG_KEEPALIVE_TIMEOUT_STADEF    0
-
-#define WNI_CFG_KEEPALIVE_TIMEOUT_APMIN    0
-#define WNI_CFG_KEEPALIVE_TIMEOUT_APMAX    3600000
-#define WNI_CFG_KEEPALIVE_TIMEOUT_APDEF    3000
-
-#define WNI_CFG_PROXIMITY_STAMIN    0
-#define WNI_CFG_PROXIMITY_STAMAX    1
-#define WNI_CFG_PROXIMITY_STADEF    0
-
-#define WNI_CFG_PROXIMITY_APMIN    0
-#define WNI_CFG_PROXIMITY_APMAX    1
-#define WNI_CFG_PROXIMITY_APDEF    0
-
-#define WNI_CFG_PROXIMITY_OFF    0
-#define WNI_CFG_PROXIMITY_ON    1
-
-#define WNI_CFG_LOG_LEVEL_STAMIN    0
-#define WNI_CFG_LOG_LEVEL_STAMAX    7
-#define WNI_CFG_LOG_LEVEL_STADEF    4
-
-#define WNI_CFG_LOG_LEVEL_APMIN    0
-#define WNI_CFG_LOG_LEVEL_APMAX    7
-#define WNI_CFG_LOG_LEVEL_APDEF    4
-
-#define WNI_CFG_OLBC_DETECT_TIMEOUT_STAMIN    1000
-#define WNI_CFG_OLBC_DETECT_TIMEOUT_STAMAX    30000
-#define WNI_CFG_OLBC_DETECT_TIMEOUT_STADEF    10000
-
-#define WNI_CFG_OLBC_DETECT_TIMEOUT_APMIN    1000
-#define WNI_CFG_OLBC_DETECT_TIMEOUT_APMAX    30000
-#define WNI_CFG_OLBC_DETECT_TIMEOUT_APDEF    10000
-
-#define WNI_CFG_PROTECTION_ENABLED_STAMIN    0
-#define WNI_CFG_PROTECTION_ENABLED_STAMAX    65535
-#define WNI_CFG_PROTECTION_ENABLED_STADEF    65535
-
-#define WNI_CFG_PROTECTION_ENABLED_APMIN    0
-#define WNI_CFG_PROTECTION_ENABLED_APMAX    65535
-#define WNI_CFG_PROTECTION_ENABLED_APDEF    65535
-
-#define WNI_CFG_PROTECTION_ENABLED_FROM_llA    0
-#define WNI_CFG_PROTECTION_ENABLED_FROM_llB    1
-#define WNI_CFG_PROTECTION_ENABLED_FROM_llG    2
-#define WNI_CFG_PROTECTION_ENABLED_HT_20    3
-#define WNI_CFG_PROTECTION_ENABLED_NON_GF    4
-#define WNI_CFG_PROTECTION_ENABLED_LSIG_TXOP    5
-#define WNI_CFG_PROTECTION_ENABLED_RIFS    6
-#define WNI_CFG_PROTECTION_ENABLED_OBSS    7
-#define WNI_CFG_PROTECTION_ENABLED_OLBC_FROM_llA    8
-#define WNI_CFG_PROTECTION_ENABLED_OLBC_FROM_llB    9
-#define WNI_CFG_PROTECTION_ENABLED_OLBC_FROM_llG    10
-#define WNI_CFG_PROTECTION_ENABLED_OLBC_HT20    11
-#define WNI_CFG_PROTECTION_ENABLED_OLBC_NON_GF    12
-#define WNI_CFG_PROTECTION_ENABLED_OLBC_LSIG_TXOP    13
-#define WNI_CFG_PROTECTION_ENABLED_OLBC_RIFS    14
-#define WNI_CFG_PROTECTION_ENABLED_OLBC_OBSS    15
-
-#define WNI_CFG_11G_PROTECTION_ALWAYS_STAMIN    0
-#define WNI_CFG_11G_PROTECTION_ALWAYS_STAMAX    1
-#define WNI_CFG_11G_PROTECTION_ALWAYS_STADEF    0
-
-#define WNI_CFG_11G_PROTECTION_ALWAYS_APMIN    0
-#define WNI_CFG_11G_PROTECTION_ALWAYS_APMAX    1
-#define WNI_CFG_11G_PROTECTION_ALWAYS_APDEF    0
-
-#define WNI_CFG_FORCE_POLICY_PROTECTION_STAMIN    0
-#define WNI_CFG_FORCE_POLICY_PROTECTION_STAMAX    5
-#define WNI_CFG_FORCE_POLICY_PROTECTION_STADEF    5
-
-#define WNI_CFG_FORCE_POLICY_PROTECTION_APMIN    0
-#define WNI_CFG_FORCE_POLICY_PROTECTION_APMAX    5
-#define WNI_CFG_FORCE_POLICY_PROTECTION_APDEF    5
-
-#define WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE    0
-#define WNI_CFG_FORCE_POLICY_PROTECTION_CTS    1
-#define WNI_CFG_FORCE_POLICY_PROTECTION_RTS    2
-#define WNI_CFG_FORCE_POLICY_PROTECTION_DUAL_CTS    3
-#define WNI_CFG_FORCE_POLICY_PROTECTION_RTS_ALWAYS    4
-#define WNI_CFG_FORCE_POLICY_PROTECTION_AUTO    5
-
-#define WNI_CFG_11G_SHORT_PREAMBLE_ENABLED_STAMIN    0
-#define WNI_CFG_11G_SHORT_PREAMBLE_ENABLED_STAMAX    1
-#define WNI_CFG_11G_SHORT_PREAMBLE_ENABLED_STADEF    0
-
-#define WNI_CFG_11G_SHORT_PREAMBLE_ENABLED_APMIN    0
-#define WNI_CFG_11G_SHORT_PREAMBLE_ENABLED_APMAX    1
-#define WNI_CFG_11G_SHORT_PREAMBLE_ENABLED_APDEF    0
-
-#define WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED_STAMIN    0
-#define WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED_STAMAX    1
-#define WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED_STADEF    1
-
-#define WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED_APMIN    0
-#define WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED_APMAX    1
-#define WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED_APDEF    1
-
-#define WNI_CFG_11G_ONLY_POLICY_STAMIN    0
-#define WNI_CFG_11G_ONLY_POLICY_STAMAX    1
-#define WNI_CFG_11G_ONLY_POLICY_STADEF    0
-
-#define WNI_CFG_11G_ONLY_POLICY_APMIN    0
-#define WNI_CFG_11G_ONLY_POLICY_APMAX    1
-#define WNI_CFG_11G_ONLY_POLICY_APDEF    0
-
-#define WNI_CFG_PACKET_CLASSIFICATION_STAMIN    0
-#define WNI_CFG_PACKET_CLASSIFICATION_STAMAX    3
-#define WNI_CFG_PACKET_CLASSIFICATION_STADEF    0
-
-#define WNI_CFG_PACKET_CLASSIFICATION_APMIN    0
-#define WNI_CFG_PACKET_CLASSIFICATION_APMAX    3
-#define WNI_CFG_PACKET_CLASSIFICATION_APDEF    0
-
-#define WNI_CFG_PACKET_CLASSIFICATION_DISABLED    0
-#define WNI_CFG_PACKET_CLASSIFICATION_DSCP    1
-#define WNI_CFG_PACKET_CLASSIFICATION_8021P    2
-#define WNI_CFG_PACKET_CLASSIFICATION_ALL    3
-
-#define WNI_CFG_WME_ENABLED_STAMIN    0
-#define WNI_CFG_WME_ENABLED_STAMAX    1
-#define WNI_CFG_WME_ENABLED_STADEF    1
-
-#define WNI_CFG_WME_ENABLED_APMIN    0
-#define WNI_CFG_WME_ENABLED_APMAX    1
-#define WNI_CFG_WME_ENABLED_APDEF    1
-
-#define WNI_CFG_ADDTS_RSP_TIMEOUT_STAMIN    0
-#define WNI_CFG_ADDTS_RSP_TIMEOUT_STAMAX    65535
-#define WNI_CFG_ADDTS_RSP_TIMEOUT_STADEF    1000
-
-#define WNI_CFG_ADDTS_RSP_TIMEOUT_APMIN    0
-#define WNI_CFG_ADDTS_RSP_TIMEOUT_APMAX    65535
-#define WNI_CFG_ADDTS_RSP_TIMEOUT_APDEF    1000
-
-#define WNI_CFG_MAX_SP_LENGTH_STAMIN    0
-#define WNI_CFG_MAX_SP_LENGTH_STAMAX    3
-#define WNI_CFG_MAX_SP_LENGTH_STADEF    0
-
-#define WNI_CFG_MAX_SP_LENGTH_APMIN    0
-#define WNI_CFG_MAX_SP_LENGTH_APMAX    3
-#define WNI_CFG_MAX_SP_LENGTH_APDEF    0
-
-#define WNI_CFG_KEEP_ALIVE_STA_LIMIT_THRESHOLD_APMIN    0
-#define WNI_CFG_KEEP_ALIVE_STA_LIMIT_THRESHOLD_APMAX    32
-#define WNI_CFG_KEEP_ALIVE_STA_LIMIT_THRESHOLD_APDEF    0
-
-#define WNI_CFG_SEND_SINGLE_SSID_ALWAYS_STAMIN    0
-#define WNI_CFG_SEND_SINGLE_SSID_ALWAYS_STAMAX    1
-#define WNI_CFG_SEND_SINGLE_SSID_ALWAYS_STADEF    0
-
-#define WNI_CFG_SEND_SINGLE_SSID_ALWAYS_APMIN    0
-#define WNI_CFG_SEND_SINGLE_SSID_ALWAYS_APMAX    1
-#define WNI_CFG_SEND_SINGLE_SSID_ALWAYS_APDEF    0
-
-#define WNI_CFG_WSM_ENABLED_STAMIN    0
-#define WNI_CFG_WSM_ENABLED_STAMAX    1
-#define WNI_CFG_WSM_ENABLED_STADEF    0
-
-#define WNI_CFG_WSM_ENABLED_APMIN    0
-#define WNI_CFG_WSM_ENABLED_APMAX    1
-#define WNI_CFG_WSM_ENABLED_APDEF    0
-
-#define WNI_CFG_EDCA_PROFILE_STAMIN    0
-#define WNI_CFG_EDCA_PROFILE_STAMAX    255
-#define WNI_CFG_EDCA_PROFILE_STADEF    1
-
-#define WNI_CFG_EDCA_PROFILE_APMIN    0
-#define WNI_CFG_EDCA_PROFILE_APMAX    255
-#define WNI_CFG_EDCA_PROFILE_APDEF    1
-
-#define WNI_CFG_EDCA_PROFILE_ANI    0
-#define WNI_CFG_EDCA_PROFILE_WMM    1
-#define WNI_CFG_EDCA_PROFILE_TIT_DEMO    2
-#define WNI_CFG_EDCA_PROFILE_MAX    3
-#define WNI_CFG_EDCA_PROFILE_ACM_IDX    0
-#define WNI_CFG_EDCA_PROFILE_AIFSN_IDX    1
-#define WNI_CFG_EDCA_PROFILE_CWMINA_IDX    2
-#define WNI_CFG_EDCA_PROFILE_CWMAXA_IDX    4
-#define WNI_CFG_EDCA_PROFILE_TXOPA_IDX    6
-#define WNI_CFG_EDCA_PROFILE_CWMINB_IDX    7
-#define WNI_CFG_EDCA_PROFILE_CWMAXB_IDX    9
-#define WNI_CFG_EDCA_PROFILE_TXOPB_IDX    11
-#define WNI_CFG_EDCA_PROFILE_CWMING_IDX    12
-#define WNI_CFG_EDCA_PROFILE_CWMAXG_IDX    14
-#define WNI_CFG_EDCA_PROFILE_TXOPG_IDX    16
-
-#define WNI_CFG_RDET_FLAG_STAMIN    0
-#define WNI_CFG_RDET_FLAG_STAMAX    1
-#define WNI_CFG_RDET_FLAG_STADEF    0
-
-#define WNI_CFG_RDET_FLAG_APMIN    0
-#define WNI_CFG_RDET_FLAG_APMAX    1
-#define WNI_CFG_RDET_FLAG_APDEF    0
-
-#define WNI_CFG_RDET_FLAG_ENABLE    1
-#define WNI_CFG_RDET_FLAG_DISABLE    0
-
-#define WNI_CFG_LOCAL_POWER_CONSTRAINT_STAMIN    0
-#define WNI_CFG_LOCAL_POWER_CONSTRAINT_STAMAX    255
-#define WNI_CFG_LOCAL_POWER_CONSTRAINT_STADEF    0
-
-#define WNI_CFG_LOCAL_POWER_CONSTRAINT_APMIN    0
-#define WNI_CFG_LOCAL_POWER_CONSTRAINT_APMAX    255
-#define WNI_CFG_LOCAL_POWER_CONSTRAINT_APDEF    0
-
-#define WNI_CFG_ADMIT_POLICY_STAMIN    0
-#define WNI_CFG_ADMIT_POLICY_STAMAX    2
-#define WNI_CFG_ADMIT_POLICY_STADEF    0
-
-#define WNI_CFG_ADMIT_POLICY_APMIN    0
-#define WNI_CFG_ADMIT_POLICY_APMAX    2
-#define WNI_CFG_ADMIT_POLICY_APDEF    0
-
-#define WNI_CFG_ADMIT_POLICY_ADMIT_ALL    0
-#define WNI_CFG_ADMIT_POLICY_REJECT_ALL    1
-#define WNI_CFG_ADMIT_POLICY_BW_FACTOR    2
-
-#define WNI_CFG_ADMIT_BWFACTOR_STAMIN    0
-#define WNI_CFG_ADMIT_BWFACTOR_STAMAX    100
-#define WNI_CFG_ADMIT_BWFACTOR_STADEF    20
-
-#define WNI_CFG_ADMIT_BWFACTOR_APMIN    0
-#define WNI_CFG_ADMIT_BWFACTOR_APMAX    100
-#define WNI_CFG_ADMIT_BWFACTOR_APDEF    20
-
-#define WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE_STAMIN    0
-#define WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE_STAMAX    256
-#define WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE_STADEF    60
-
-#define WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE_APMIN    0
-#define WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE_APMAX    256
-#define WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE_APDEF    60
-
-#define WNI_CFG_CHANNEL_BONDING_MODE_STAMIN    0
-#define WNI_CFG_CHANNEL_BONDING_MODE_STAMAX    10
-#define WNI_CFG_CHANNEL_BONDING_MODE_STADEF    0
-
-#define WNI_CFG_CHANNEL_BONDING_MODE_APMIN    0
-#define WNI_CFG_CHANNEL_BONDING_MODE_APMAX    10
-#define WNI_CFG_CHANNEL_BONDING_MODE_APDEF    0
-
-#define WNI_CFG_CHANNEL_BONDING_MODE_DISABLE    0
-#define WNI_CFG_CHANNEL_BONDING_MODE_ENABLE    1
-#define WNI_CFG_CHANNEL_BONDING_MODE_IF_NO_LEGACY_BSS    2
-#define WNI_CFG_CHANNEL_BONDING_MODE_IF_NO_LEGACY_ALL    3
-#define WNI_CFG_CHANNEL_BONDING_MODE_INTELLIGENT    4
-
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_STAMIN    0
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_STAMAX    10
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_STADEF    0
-
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_APMIN    0
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_APMAX    10
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_APDEF    0
-
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_NONE    0
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_LOWER    1
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_HIGHER    2
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_11AC_20MHZ_LOW_40MHZ_CENTERED    3
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_11AC_20MHZ_CENTERED_40MHZ_CENTERED    4
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_11AC_20MHZ_HIGH_40MHZ_CENTERED    5
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_11AC_20MHZ_LOW_40MHZ_LOW    6
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_11AC_20MHZ_HIGH_40MHZ_LOW    7
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_11AC_20MHZ_LOW_40MHZ_HIGH    8
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE_11AC_20MHZ_HIGH_40MHZ_HIGH    9
-
-#define WNI_CFG_DYNAMIC_THRESHOLD_ZERO_STAMIN    0
-#define WNI_CFG_DYNAMIC_THRESHOLD_ZERO_STAMAX    255
-#define WNI_CFG_DYNAMIC_THRESHOLD_ZERO_STADEF    2
-
-#define WNI_CFG_DYNAMIC_THRESHOLD_ZERO_APMIN    0
-#define WNI_CFG_DYNAMIC_THRESHOLD_ZERO_APMAX    255
-#define WNI_CFG_DYNAMIC_THRESHOLD_ZERO_APDEF    2
-
-#define WNI_CFG_DYNAMIC_THRESHOLD_ONE_STAMIN    0
-#define WNI_CFG_DYNAMIC_THRESHOLD_ONE_STAMAX    255
-#define WNI_CFG_DYNAMIC_THRESHOLD_ONE_STADEF    4
-
-#define WNI_CFG_DYNAMIC_THRESHOLD_ONE_APMIN    0
-#define WNI_CFG_DYNAMIC_THRESHOLD_ONE_APMAX    255
-#define WNI_CFG_DYNAMIC_THRESHOLD_ONE_APDEF    4
-
-#define WNI_CFG_DYNAMIC_THRESHOLD_TWO_STAMIN    0
-#define WNI_CFG_DYNAMIC_THRESHOLD_TWO_STAMAX    255
-#define WNI_CFG_DYNAMIC_THRESHOLD_TWO_STADEF    6
-
-#define WNI_CFG_DYNAMIC_THRESHOLD_TWO_APMIN    0
-#define WNI_CFG_DYNAMIC_THRESHOLD_TWO_APMAX    255
-#define WNI_CFG_DYNAMIC_THRESHOLD_TWO_APDEF    6
-
-#define WNI_CFG_TRIG_STA_BK_SCAN_STAMIN    0
-#define WNI_CFG_TRIG_STA_BK_SCAN_STAMAX    1
-#define WNI_CFG_TRIG_STA_BK_SCAN_STADEF    0
-
-#define WNI_CFG_TRIG_STA_BK_SCAN_APMIN    0
-#define WNI_CFG_TRIG_STA_BK_SCAN_APMAX    1
-#define WNI_CFG_TRIG_STA_BK_SCAN_APDEF    1
-
-#define WNI_CFG_DYNAMIC_PROFILE_SWITCHING_STAMIN    0
-#define WNI_CFG_DYNAMIC_PROFILE_SWITCHING_STAMAX    255
-#define WNI_CFG_DYNAMIC_PROFILE_SWITCHING_STADEF    255
-
-#define WNI_CFG_DYNAMIC_PROFILE_SWITCHING_APMIN    0
-#define WNI_CFG_DYNAMIC_PROFILE_SWITCHING_APMAX    255
-#define WNI_CFG_DYNAMIC_PROFILE_SWITCHING_APDEF    1
-
-#define WNI_CFG_DYNAMIC_PROFILE_SWITCHING_UNUSED    255
-
-#define WNI_CFG_MIMO_ENABLED_STAMIN    0
-#define WNI_CFG_MIMO_ENABLED_STAMAX    1
-#define WNI_CFG_MIMO_ENABLED_STADEF    1
-
-#define WNI_CFG_MIMO_ENABLED_APMIN    0
-#define WNI_CFG_MIMO_ENABLED_APMAX    1
-#define WNI_CFG_MIMO_ENABLED_APDEF    1
-
-#define WNI_CFG_MIMO_ENABLED_ENABLE    1
-#define WNI_CFG_MIMO_ENABLED_DISABLE    0
-
-#define WNI_CFG_BLOCK_ACK_ENABLED_STAMIN    0
-#define WNI_CFG_BLOCK_ACK_ENABLED_STAMAX    3
-#define WNI_CFG_BLOCK_ACK_ENABLED_STADEF    0
-
-#define WNI_CFG_BLOCK_ACK_ENABLED_APMIN    0
-#define WNI_CFG_BLOCK_ACK_ENABLED_APMAX    3
-#define WNI_CFG_BLOCK_ACK_ENABLED_APDEF    0
-
-#define WNI_CFG_BLOCK_ACK_ENABLED_DELAYED    0
-#define WNI_CFG_BLOCK_ACK_ENABLED_IMMEDIATE    1
-
-#define WNI_CFG_BA_ACTIVITY_CHECK_TIMEOUT_STAMIN    0
-#define WNI_CFG_BA_ACTIVITY_CHECK_TIMEOUT_STAMAX    65535
-#define WNI_CFG_BA_ACTIVITY_CHECK_TIMEOUT_STADEF    1000
-
-#define WNI_CFG_BA_ACTIVITY_CHECK_TIMEOUT_APMIN    0
-#define WNI_CFG_BA_ACTIVITY_CHECK_TIMEOUT_APMAX    65535
-#define WNI_CFG_BA_ACTIVITY_CHECK_TIMEOUT_APDEF    1000
-
-#define WNI_CFG_HT_RX_STBC_STAMIN    0
-#define WNI_CFG_HT_RX_STBC_STAMAX    3
-#define WNI_CFG_HT_RX_STBC_STADEF    1
-
-#define WNI_CFG_HT_RX_STBC_APMIN    0
-#define WNI_CFG_HT_RX_STBC_APMAX    3
-#define WNI_CFG_HT_RX_STBC_APDEF    1
-
-#define WNI_CFG_HT_CAP_INFO_STAMIN    0
-#define WNI_CFG_HT_CAP_INFO_STAMAX    65535
-#define WNI_CFG_HT_CAP_INFO_STADEF    364
-
-#define WNI_CFG_HT_CAP_INFO_APMIN    0
-#define WNI_CFG_HT_CAP_INFO_APMAX    65535
-#define WNI_CFG_HT_CAP_INFO_APDEF    4206
-
-#define WNI_CFG_HT_CAP_INFO_ADVANCE_CODING    0
-#define WNI_CFG_HT_CAP_INFO_SUPPORTED_CHAN_WIDTH_SET    1
-#define WNI_CFG_HT_CAP_INFO_SM_POWER_SAVE    2
-#define WNI_CFG_HT_CAP_INFO_GREEN_FIELD    4
-#define WNI_CFG_HT_CAP_INFO_SHORT_GI_20MHZ    5
-#define WNI_CFG_HT_CAP_INFO_SHORT_GI_40MHZ    6
-#define WNI_CFG_HT_CAP_INFO_TX_STBC    7
-#define WNI_CFG_HT_CAP_INFO_RX_STBC    8
-#define WNI_CFG_HT_CAP_INFO_DELAYED_BA    10
-#define WNI_CFG_HT_CAP_INFO_MAX_AMSDU_SIZE    11
-#define WNI_CFG_HT_CAP_INFO_DSSS_CCK_MODE_40MHZ    12
-#define WNI_CFG_HT_CAP_INFO_PSMP    13
-#define WNI_CFG_HT_CAP_INFO_STBC_CONTROL_FRAME    14
-#define WNI_CFG_HT_CAP_INFO_LSIG_TXOP_PROTECTION    15
-
-#define WNI_CFG_HT_AMPDU_PARAMS_STAMIN    0
-#define WNI_CFG_HT_AMPDU_PARAMS_STAMAX    255
-#define WNI_CFG_HT_AMPDU_PARAMS_STADEF    0
-
-#define WNI_CFG_HT_AMPDU_PARAMS_APMIN    0
-#define WNI_CFG_HT_AMPDU_PARAMS_APMAX    255
-#define WNI_CFG_HT_AMPDU_PARAMS_APDEF    2
-
-#define WNI_CFG_HT_AMPDU_PARAMS_MAX_RX_AMPDU_FACTOR    0
-#define WNI_CFG_HT_AMPDU_PARAMS_MPDU_DENSITY    2
-#define WNI_CFG_HT_AMPDU_PARAMS_RESERVED    5
-
-#define WNI_CFG_EXT_HT_CAP_INFO_STAMIN    0
-#define WNI_CFG_EXT_HT_CAP_INFO_STAMAX    65535
-#define WNI_CFG_EXT_HT_CAP_INFO_STADEF    1024
-
-#define WNI_CFG_EXT_HT_CAP_INFO_APMIN    0
-#define WNI_CFG_EXT_HT_CAP_INFO_APMAX    65535
-#define WNI_CFG_EXT_HT_CAP_INFO_APDEF    1024
-
-#define WNI_CFG_EXT_HT_CAP_INFO_PCO    0
-#define WNI_CFG_EXT_HT_CAP_INFO_TRANSITION_TIME    1
-#define WNI_CFG_EXT_HT_CAP_INFO_RESERVED1    3
-#define WNI_CFG_EXT_HT_CAP_INFO_MCS_FEEDBACK    8
-#define WNI_CFG_EXT_HT_CAP_INFO_HTC_SUPPORT    10
-#define WNI_CFG_EXT_HT_CAP_INFO_RD_RESPONDER    11
-#define WNI_CFG_EXT_HT_CAP_INFO_RESERVED2    12
-
-#define WNI_CFG_TX_BF_CAP_STAMIN    0
-#define WNI_CFG_TX_BF_CAP_STAMAX    4294967295
-#define WNI_CFG_TX_BF_CAP_STADEF    0
-
-#define WNI_CFG_TX_BF_CAP_APMIN    0
-#define WNI_CFG_TX_BF_CAP_APMAX    4294967295
-#define WNI_CFG_TX_BF_CAP_APDEF    0
-
-#define WNI_CFG_AS_CAP_STAMIN    0
-#define WNI_CFG_AS_CAP_STAMAX    255
-#define WNI_CFG_AS_CAP_STADEF    0
-
-#define WNI_CFG_AS_CAP_APMIN    0
-#define WNI_CFG_AS_CAP_APMAX    255
-#define WNI_CFG_AS_CAP_APDEF    0
-
-#define WNI_CFG_AS_CAP_ANTENNA_SELECTION    0
-#define WNI_CFG_AS_CAP_EXPLICIT_CSI_FEEDBACK_TX    1
-#define WNI_CFG_AS_CAP_ANTENNA_INDICES_FEEDBACK_TX    2
-#define WNI_CFG_AS_CAP_EXPLICIT_CSI_FEEDBACK    3
-#define WNI_CFG_AS_CAP_ANTENNA_INDICES_FEEDBACK    4
-#define WNI_CFG_AS_CAP_RX_AS    5
-#define WNI_CFG_AS_CAP_TX_SOUNDING_PPDUS    6
-#define WNI_CFG_AS_CAP_RESERVED    7
-
-#define WNI_CFG_HT_INFO_FIELD1_STAMIN    0
-#define WNI_CFG_HT_INFO_FIELD1_STAMAX    255
-#define WNI_CFG_HT_INFO_FIELD1_STADEF    15
-
-#define WNI_CFG_HT_INFO_FIELD1_APMIN    0
-#define WNI_CFG_HT_INFO_FIELD1_APMAX    255
-#define WNI_CFG_HT_INFO_FIELD1_APDEF    15
-
-#define WNI_CFG_HT_INFO_FIELD1_SECONDARY_CHANNEL_OFFSET    0
-#define WNI_CFG_HT_INFO_FIELD1_RECOMMENDED_CHANNEL_WIDTH    2
-#define WNI_CFG_HT_INFO_FIELD1_RIFS_MODE    3
-#define WNI_CFG_HT_INFO_FIELD1_PSMP_ACCESS_ONLY    4
-#define WNI_CFG_HT_INFO_FIELD1_SERVICE_INTERVAL_GRANULARITY    5
-
-#define WNI_CFG_HT_INFO_FIELD2_STAMIN    0
-#define WNI_CFG_HT_INFO_FIELD2_STAMAX    65535
-#define WNI_CFG_HT_INFO_FIELD2_STADEF    0
-
-#define WNI_CFG_HT_INFO_FIELD2_APMIN    0
-#define WNI_CFG_HT_INFO_FIELD2_APMAX    65535
-#define WNI_CFG_HT_INFO_FIELD2_APDEF    0
-
-#define WNI_CFG_HT_INFO_FIELD2_OP_MODE    0
-#define WNI_CFG_HT_INFO_FIELD2_NON_GF_DEVICES_PRESENT    2
-#define WNI_CFG_HT_INFO_FIELD2_RESERVED    3
-
-#define WNI_CFG_HT_INFO_FIELD3_STAMIN    0
-#define WNI_CFG_HT_INFO_FIELD3_STAMAX    65535
-#define WNI_CFG_HT_INFO_FIELD3_STADEF    0
-
-#define WNI_CFG_HT_INFO_FIELD3_APMIN    0
-#define WNI_CFG_HT_INFO_FIELD3_APMAX    65535
-#define WNI_CFG_HT_INFO_FIELD3_APDEF    0
-
-#define WNI_CFG_HT_INFO_FIELD3_BASIC_STBC_MCS    0
-#define WNI_CFG_HT_INFO_FIELD3_DUAL_STBC_PROTECTION    7
-#define WNI_CFG_HT_INFO_FIELD3_SECONDARY_BEACON    8
-#define WNI_CFG_HT_INFO_FIELD3_LSIG_TXOP_PROTECTION_FULL_SUPPORT    9
-#define WNI_CFG_HT_INFO_FIELD3_PCO_ACTIVE    10
-#define WNI_CFG_HT_INFO_FIELD3_PCO_PHASE    11
-#define WNI_CFG_HT_INFO_FIELD3_RESERVED    12
-
-#define WNI_CFG_GREENFIELD_CAPABILITY_STAMIN    0
-#define WNI_CFG_GREENFIELD_CAPABILITY_STAMAX    1
-#define WNI_CFG_GREENFIELD_CAPABILITY_STADEF    0
-
-#define WNI_CFG_GREENFIELD_CAPABILITY_APMIN    0
-#define WNI_CFG_GREENFIELD_CAPABILITY_APMAX    1
-#define WNI_CFG_GREENFIELD_CAPABILITY_APDEF    0
-
-#define WNI_CFG_GREENFIELD_CAPABILITY_ENABLE    1
-#define WNI_CFG_GREENFIELD_CAPABILITY_DISABLE    0
-
-#define WNI_CFG_VHT_MAX_MPDU_LENGTH_STAMIN    0
-#define WNI_CFG_VHT_MAX_MPDU_LENGTH_STAMAX    2
-#define WNI_CFG_VHT_MAX_MPDU_LENGTH_STADEF    0
-
-#define WNI_CFG_VHT_MAX_MPDU_LENGTH_APMIN    0
-#define WNI_CFG_VHT_MAX_MPDU_LENGTH_APMAX    2
-#define WNI_CFG_VHT_MAX_MPDU_LENGTH_APDEF    0
-
-#define WNI_CFG_VHT_SUPPORTED_CHAN_WIDTH_SET_STAMIN    0
-#define WNI_CFG_VHT_SUPPORTED_CHAN_WIDTH_SET_STAMAX    0
-#define WNI_CFG_VHT_SUPPORTED_CHAN_WIDTH_SET_STADEF    0
-
-#define WNI_CFG_VHT_SUPPORTED_CHAN_WIDTH_SET_APMIN    0
-#define WNI_CFG_VHT_SUPPORTED_CHAN_WIDTH_SET_APMAX    0
-#define WNI_CFG_VHT_SUPPORTED_CHAN_WIDTH_SET_APDEF    0
-
-#define WNI_CFG_VHT_LDPC_CODING_CAP_STAMIN    0
-#define WNI_CFG_VHT_LDPC_CODING_CAP_STAMAX    1
-#define WNI_CFG_VHT_LDPC_CODING_CAP_STADEF    0
-
-#define WNI_CFG_VHT_LDPC_CODING_CAP_APMIN    0
-#define WNI_CFG_VHT_LDPC_CODING_CAP_APMAX    1
-#define WNI_CFG_VHT_LDPC_CODING_CAP_APDEF    0
-
-#define WNI_CFG_VHT_SHORT_GI_80MHZ_STAMIN    0
-#define WNI_CFG_VHT_SHORT_GI_80MHZ_STAMAX    1
-#define WNI_CFG_VHT_SHORT_GI_80MHZ_STADEF    1
-
-#define WNI_CFG_VHT_SHORT_GI_80MHZ_APMIN    0
-#define WNI_CFG_VHT_SHORT_GI_80MHZ_APMAX    1
-#define WNI_CFG_VHT_SHORT_GI_80MHZ_APDEF    1
-
-#define WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ_STAMIN    0
-#define WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ_STAMAX    1
-#define WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ_STADEF    0
-
-#define WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ_APMIN    0
-#define WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ_APMAX    1
-#define WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ_APDEF    0
-
-#define WNI_CFG_VHT_TXSTBC_STAMIN    0
-#define WNI_CFG_VHT_TXSTBC_STAMAX    1
-#define WNI_CFG_VHT_TXSTBC_STADEF    0
-
-#define WNI_CFG_VHT_TXSTBC_APMIN    0
-#define WNI_CFG_VHT_TXSTBC_APMAX    1
-#define WNI_CFG_VHT_TXSTBC_APDEF    0
-
-#define WNI_CFG_VHT_RXSTBC_STAMIN    0
-#define WNI_CFG_VHT_RXSTBC_STAMAX    1
-#define WNI_CFG_VHT_RXSTBC_STADEF    1
-
-#define WNI_CFG_VHT_RXSTBC_APMIN    0
-#define WNI_CFG_VHT_RXSTBC_APMAX    1
-#define WNI_CFG_VHT_RXSTBC_APDEF    1
-
-#define WNI_CFG_VHT_SU_BEAMFORMER_CAP_STAMIN    0
-#define WNI_CFG_VHT_SU_BEAMFORMER_CAP_STAMAX    1
-#define WNI_CFG_VHT_SU_BEAMFORMER_CAP_STADEF    0
-
-#define WNI_CFG_VHT_SU_BEAMFORMER_CAP_APMIN    0
-#define WNI_CFG_VHT_SU_BEAMFORMER_CAP_APMAX    1
-#define WNI_CFG_VHT_SU_BEAMFORMER_CAP_APDEF    0
-
-#define WNI_CFG_VHT_SU_BEAMFORMEE_CAP_STAMIN    0
-#define WNI_CFG_VHT_SU_BEAMFORMEE_CAP_STAMAX    1
-#define WNI_CFG_VHT_SU_BEAMFORMEE_CAP_STADEF    1
-
-#define WNI_CFG_VHT_SU_BEAMFORMEE_CAP_APMIN    0
-#define WNI_CFG_VHT_SU_BEAMFORMEE_CAP_APMAX    1
-#define WNI_CFG_VHT_SU_BEAMFORMEE_CAP_APDEF    1
-
-#define WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_STAMIN    0
-#define WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_STAMAX    4
-#define WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_STADEF    0
-
-#define WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_APMIN    0
-#define WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_APMAX    4
-#define WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_APDEF    0
-
-#define WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS_STAMIN    0
-#define WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS_STAMAX    3
-#define WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS_STADEF    0
-
-#define WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS_APMIN    0
-#define WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS_APMAX    3
-#define WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS_APDEF    0
-
-#define WNI_CFG_VHT_MU_BEAMFORMER_CAP_STAMIN    0
-#define WNI_CFG_VHT_MU_BEAMFORMER_CAP_STAMAX    1
-#define WNI_CFG_VHT_MU_BEAMFORMER_CAP_STADEF    0
-
-#define WNI_CFG_VHT_MU_BEAMFORMER_CAP_APMIN    0
-#define WNI_CFG_VHT_MU_BEAMFORMER_CAP_APMAX    1
-#define WNI_CFG_VHT_MU_BEAMFORMER_CAP_APDEF    0
-
-#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_STAMIN    0
-#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_STAMAX    1
-#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_STADEF    0
-
-#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_APMIN    0
-#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_APMAX    1
-#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_APDEF    0
-
-#define WNI_CFG_VHT_TXOP_PS_STAMIN    0
-#define WNI_CFG_VHT_TXOP_PS_STAMAX    1
-#define WNI_CFG_VHT_TXOP_PS_STADEF    0
-
-#define WNI_CFG_VHT_TXOP_PS_APMIN    0
-#define WNI_CFG_VHT_TXOP_PS_APMAX    1
-#define WNI_CFG_VHT_TXOP_PS_APDEF    0
-
-#define WNI_CFG_VHT_HTC_VHTC_CAP_STAMIN    0
-#define WNI_CFG_VHT_HTC_VHTC_CAP_STAMAX    1
-#define WNI_CFG_VHT_HTC_VHTC_CAP_STADEF    0
-
-#define WNI_CFG_VHT_HTC_VHTC_CAP_APMIN    0
-#define WNI_CFG_VHT_HTC_VHTC_CAP_APMAX    1
-#define WNI_CFG_VHT_HTC_VHTC_CAP_APDEF    0
-
-#define WNI_CFG_VHT_AMPDU_LEN_EXPONENT_STAMIN    0
-#define WNI_CFG_VHT_AMPDU_LEN_EXPONENT_STAMAX    7
-#define WNI_CFG_VHT_AMPDU_LEN_EXPONENT_STADEF    3
-
-#define WNI_CFG_VHT_AMPDU_LEN_EXPONENT_APMIN    0
-#define WNI_CFG_VHT_AMPDU_LEN_EXPONENT_APMAX    7
-#define WNI_CFG_VHT_AMPDU_LEN_EXPONENT_APDEF    3
-
-#define WNI_CFG_VHT_LINK_ADAPTATION_CAP_STAMIN    0
-#define WNI_CFG_VHT_LINK_ADAPTATION_CAP_STAMAX    3
-#define WNI_CFG_VHT_LINK_ADAPTATION_CAP_STADEF    0
-
-#define WNI_CFG_VHT_LINK_ADAPTATION_CAP_APMIN    0
-#define WNI_CFG_VHT_LINK_ADAPTATION_CAP_APMAX    3
-#define WNI_CFG_VHT_LINK_ADAPTATION_CAP_APDEF    0
-
-#define WNI_CFG_VHT_RX_ANT_PATTERN_STAMIN    0
-#define WNI_CFG_VHT_RX_ANT_PATTERN_STAMAX    1
-#define WNI_CFG_VHT_RX_ANT_PATTERN_STADEF    1
-
-#define WNI_CFG_VHT_RX_ANT_PATTERN_APMIN    0
-#define WNI_CFG_VHT_RX_ANT_PATTERN_APMAX    1
-#define WNI_CFG_VHT_RX_ANT_PATTERN_APDEF    1
-
-#define WNI_CFG_VHT_TX_ANT_PATTERN_STAMIN    0
-#define WNI_CFG_VHT_TX_ANT_PATTERN_STAMAX    1
-#define WNI_CFG_VHT_TX_ANT_PATTERN_STADEF    1
-
-#define WNI_CFG_VHT_TX_ANT_PATTERN_APMIN    0
-#define WNI_CFG_VHT_TX_ANT_PATTERN_APMAX    1
-#define WNI_CFG_VHT_TX_ANT_PATTERN_APDEF    1
-
-#define WNI_CFG_VHT_RX_MCS_MAP_STAMIN    0
-#define WNI_CFG_VHT_RX_MCS_MAP_STAMAX    65535
-#define WNI_CFG_VHT_RX_MCS_MAP_STADEF    65534
-
-#define WNI_CFG_VHT_RX_MCS_MAP_APMIN    0
-#define WNI_CFG_VHT_RX_MCS_MAP_APMAX    65535
-#define WNI_CFG_VHT_RX_MCS_MAP_APDEF    65534
-
-#define WNI_CFG_VHT_TX_MCS_MAP_STAMIN    0
-#define WNI_CFG_VHT_TX_MCS_MAP_STAMAX    65535
-#define WNI_CFG_VHT_TX_MCS_MAP_STADEF    65534
-
-#define WNI_CFG_VHT_TX_MCS_MAP_APMIN    0
-#define WNI_CFG_VHT_TX_MCS_MAP_APMAX    65535
-#define WNI_CFG_VHT_TX_MCS_MAP_APDEF    65534
-
-#define WNI_CFG_VHT_RX_HIGHEST_SUPPORTED_DATA_RATE_STAMIN    0
-#define WNI_CFG_VHT_RX_HIGHEST_SUPPORTED_DATA_RATE_STAMAX    780
-#define WNI_CFG_VHT_RX_HIGHEST_SUPPORTED_DATA_RATE_STADEF    780
-
-#define WNI_CFG_VHT_RX_HIGHEST_SUPPORTED_DATA_RATE_APMIN    0
-#define WNI_CFG_VHT_RX_HIGHEST_SUPPORTED_DATA_RATE_APMAX    780
-#define WNI_CFG_VHT_RX_HIGHEST_SUPPORTED_DATA_RATE_APDEF    780
-
-#define WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE_STAMIN    0
-#define WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE_STAMAX    780
-#define WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE_STADEF    780
-
-#define WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE_APMIN    0
-#define WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE_APMAX    780
-#define WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE_APDEF    780
-
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1_STAMIN    0
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1_STAMAX    256
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1_STADEF    0
-
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1_APMIN    0
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1_APMAX    256
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1_APDEF    0
-
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT2_STAMIN    0
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT2_STAMAX    0
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT2_STADEF    0
-
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT2_APMIN    0
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT2_APMAX    0
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT2_APDEF    0
-
-#define WNI_CFG_VHT_BASIC_MCS_SET_STAMIN    0
-#define WNI_CFG_VHT_BASIC_MCS_SET_STAMAX    65535
-#define WNI_CFG_VHT_BASIC_MCS_SET_STADEF    65534
-
-#define WNI_CFG_VHT_BASIC_MCS_SET_APMIN    0
-#define WNI_CFG_VHT_BASIC_MCS_SET_APMAX    65535
-#define WNI_CFG_VHT_BASIC_MCS_SET_APDEF    65534
-
-#define WNI_CFG_VHT_MU_MIMO_CAP_STA_COUNT_STAMIN    0
-#define WNI_CFG_VHT_MU_MIMO_CAP_STA_COUNT_STAMAX    4
-#define WNI_CFG_VHT_MU_MIMO_CAP_STA_COUNT_STADEF    0
-
-#define WNI_CFG_VHT_MU_MIMO_CAP_STA_COUNT_APMIN    0
-#define WNI_CFG_VHT_MU_MIMO_CAP_STA_COUNT_APMAX    4
-#define WNI_CFG_VHT_MU_MIMO_CAP_STA_COUNT_APDEF    0
-
-#define WNI_CFG_VHT_SS_UNDER_UTIL_STAMIN    0
-#define WNI_CFG_VHT_SS_UNDER_UTIL_STAMAX    0
-#define WNI_CFG_VHT_SS_UNDER_UTIL_STADEF    0
-
-#define WNI_CFG_VHT_SS_UNDER_UTIL_APMIN    0
-#define WNI_CFG_VHT_SS_UNDER_UTIL_APMAX    0
-#define WNI_CFG_VHT_SS_UNDER_UTIL_APDEF    0
-
-#define WNI_CFG_VHT_40MHZ_UTILIZATION_STAMIN    0
-#define WNI_CFG_VHT_40MHZ_UTILIZATION_STAMAX    0
-#define WNI_CFG_VHT_40MHZ_UTILIZATION_STADEF    0
-
-#define WNI_CFG_VHT_40MHZ_UTILIZATION_APMIN    0
-#define WNI_CFG_VHT_40MHZ_UTILIZATION_APMAX    0
-#define WNI_CFG_VHT_40MHZ_UTILIZATION_APDEF    0
-
-#define WNI_CFG_VHT_80MHZ_UTILIZATION_STAMIN    0
-#define WNI_CFG_VHT_80MHZ_UTILIZATION_STAMAX    0
-#define WNI_CFG_VHT_80MHZ_UTILIZATION_STADEF    0
-
-#define WNI_CFG_VHT_80MHZ_UTILIZATION_APMIN    0
-#define WNI_CFG_VHT_80MHZ_UTILIZATION_APMAX    0
-#define WNI_CFG_VHT_80MHZ_UTILIZATION_APDEF    0
-
-#define WNI_CFG_VHT_160MHZ_UTILIZATION_STAMIN    0
-#define WNI_CFG_VHT_160MHZ_UTILIZATION_STAMAX    0
-#define WNI_CFG_VHT_160MHZ_UTILIZATION_STADEF    0
-
-#define WNI_CFG_VHT_160MHZ_UTILIZATION_APMIN    0
-#define WNI_CFG_VHT_160MHZ_UTILIZATION_APMAX    0
-#define WNI_CFG_VHT_160MHZ_UTILIZATION_APDEF    0
-
-#define WNI_CFG_MAX_AMSDU_LENGTH_STAMIN    0
-#define WNI_CFG_MAX_AMSDU_LENGTH_STAMAX    1
-#define WNI_CFG_MAX_AMSDU_LENGTH_STADEF    0
-
-#define WNI_CFG_MAX_AMSDU_LENGTH_APMIN    0
-#define WNI_CFG_MAX_AMSDU_LENGTH_APMAX    1
-#define WNI_CFG_MAX_AMSDU_LENGTH_APDEF    0
-
-#define WNI_CFG_MAX_AMSDU_LENGTH_SHORT_3839_BYTES    0
-#define WNI_CFG_MAX_AMSDU_LENGTH_LONG_7935__BYTES    1
-
-#define WNI_CFG_MPDU_DENSITY_STAMIN    0
-#define WNI_CFG_MPDU_DENSITY_STAMAX    7
-#define WNI_CFG_MPDU_DENSITY_STADEF    7
-
-#define WNI_CFG_MPDU_DENSITY_APMIN    0
-#define WNI_CFG_MPDU_DENSITY_APMAX    7
-#define WNI_CFG_MPDU_DENSITY_APDEF    7
-
-#define WNI_CFG_NUM_BUFF_ADVERT_STAMIN    0
-#define WNI_CFG_NUM_BUFF_ADVERT_STAMAX    128
-#define WNI_CFG_NUM_BUFF_ADVERT_STADEF    64
-
-#define WNI_CFG_NUM_BUFF_ADVERT_APMIN    0
-#define WNI_CFG_NUM_BUFF_ADVERT_APMAX    128
-#define WNI_CFG_NUM_BUFF_ADVERT_APDEF    64
-
-#define WNI_CFG_MAX_RX_AMPDU_FACTOR_STAMIN    0
-#define WNI_CFG_MAX_RX_AMPDU_FACTOR_STAMAX    3
-#define WNI_CFG_MAX_RX_AMPDU_FACTOR_STADEF    3
-
-#define WNI_CFG_MAX_RX_AMPDU_FACTOR_APMIN    0
-#define WNI_CFG_MAX_RX_AMPDU_FACTOR_APMAX    3
-#define WNI_CFG_MAX_RX_AMPDU_FACTOR_APDEF    3
-
-#define WNI_CFG_SHORT_GI_20MHZ_STAMIN    0
-#define WNI_CFG_SHORT_GI_20MHZ_STAMAX    1
-#define WNI_CFG_SHORT_GI_20MHZ_STADEF    1
-
-#define WNI_CFG_SHORT_GI_20MHZ_APMIN    0
-#define WNI_CFG_SHORT_GI_20MHZ_APMAX    1
-#define WNI_CFG_SHORT_GI_20MHZ_APDEF    1
-
-#define WNI_CFG_SHORT_GI_20MHZ_ENABLE    1
-#define WNI_CFG_SHORT_GI_20MHZ_DISABLE    0
-
-#define WNI_CFG_SHORT_GI_40MHZ_STAMIN    0
-#define WNI_CFG_SHORT_GI_40MHZ_STAMAX    1
-#define WNI_CFG_SHORT_GI_40MHZ_STADEF    0
-
-#define WNI_CFG_SHORT_GI_40MHZ_APMIN    0
-#define WNI_CFG_SHORT_GI_40MHZ_APMAX    1
-#define WNI_CFG_SHORT_GI_40MHZ_APDEF    1
-
-#define WNI_CFG_SHORT_GI_40MHZ_ENABLE    1
-#define WNI_CFG_SHORT_GI_40MHZ_DISABLE    0
-
-#define WNI_CFG_RIFS_ENABLED_STAMIN    0
-#define WNI_CFG_RIFS_ENABLED_STAMAX    1
-#define WNI_CFG_RIFS_ENABLED_STADEF    1
-
-#define WNI_CFG_RIFS_ENABLED_APMIN    0
-#define WNI_CFG_RIFS_ENABLED_APMAX    1
-#define WNI_CFG_RIFS_ENABLED_APDEF    1
-
-#define WNI_CFG_RIFS_ENABLED_ENABLE    1
-#define WNI_CFG_RIFS_ENABLED_DISABLE    0
-
-#define WNI_CFG_MAX_PS_POLL_STAMIN    0
-#define WNI_CFG_MAX_PS_POLL_STAMAX    255
-#define WNI_CFG_MAX_PS_POLL_STADEF    0
-
-#define WNI_CFG_NUM_BEACON_PER_RSSI_AVERAGE_STAMIN    1
-#define WNI_CFG_NUM_BEACON_PER_RSSI_AVERAGE_STAMAX    20
-#define WNI_CFG_NUM_BEACON_PER_RSSI_AVERAGE_STADEF    20
-
-#define WNI_CFG_RSSI_FILTER_PERIOD_STAMIN    0
-#define WNI_CFG_RSSI_FILTER_PERIOD_STAMAX    255
-#define WNI_CFG_RSSI_FILTER_PERIOD_STADEF    5
-
-#define WNI_CFG_MIN_RSSI_THRESHOLD_STAMIN    0
-#define WNI_CFG_MIN_RSSI_THRESHOLD_STAMAX    10
-#define WNI_CFG_MIN_RSSI_THRESHOLD_STADEF    10
-
-#define WNI_CFG_NTH_BEACON_FILTER_STAMIN    0
-#define WNI_CFG_NTH_BEACON_FILTER_STAMAX    255
-#define WNI_CFG_NTH_BEACON_FILTER_STADEF    10
-
-#define WNI_CFG_BROADCAST_FRAME_FILTER_ENABLE_STAMIN    0
-#define WNI_CFG_BROADCAST_FRAME_FILTER_ENABLE_STAMAX    1
-#define WNI_CFG_BROADCAST_FRAME_FILTER_ENABLE_STADEF    0
-
-#define WNI_CFG_SCAN_IN_POWERSAVE_STAMIN    0
-#define WNI_CFG_SCAN_IN_POWERSAVE_STAMAX    1
-#define WNI_CFG_SCAN_IN_POWERSAVE_STADEF    1
-
-#define WNI_CFG_SCAN_IN_POWERSAVE_APMIN    0
-#define WNI_CFG_SCAN_IN_POWERSAVE_APMAX    1
-#define WNI_CFG_SCAN_IN_POWERSAVE_APDEF    1
-
-#define WNI_CFG_IGNORE_DTIM_STAMIN    0
-#define WNI_CFG_IGNORE_DTIM_STAMAX    1
-#define WNI_CFG_IGNORE_DTIM_STADEF    0
-
-#define WNI_CFG_IGNORE_DTIM_APMIN    0
-#define WNI_CFG_IGNORE_DTIM_APMAX    1
-#define WNI_CFG_IGNORE_DTIM_APDEF    0
-
-#define WNI_CFG_WOWLAN_UCAST_PATTERN_FILTER_ENABLE_STAMIN    0
-#define WNI_CFG_WOWLAN_UCAST_PATTERN_FILTER_ENABLE_STAMAX    1
-#define WNI_CFG_WOWLAN_UCAST_PATTERN_FILTER_ENABLE_STADEF    1
-
-#define WNI_CFG_WOWLAN_CHANNEL_SWITCH_ENABLE_STAMIN    0
-#define WNI_CFG_WOWLAN_CHANNEL_SWITCH_ENABLE_STAMAX    1
-#define WNI_CFG_WOWLAN_CHANNEL_SWITCH_ENABLE_STADEF    1
-
-#define WNI_CFG_WOWLAN_DEAUTH_ENABLE_STAMIN    0
-#define WNI_CFG_WOWLAN_DEAUTH_ENABLE_STAMAX    1
-#define WNI_CFG_WOWLAN_DEAUTH_ENABLE_STADEF    1
-
-#define WNI_CFG_WOWLAN_DISASSOC_ENABLE_STAMIN    0
-#define WNI_CFG_WOWLAN_DISASSOC_ENABLE_STAMAX    1
-#define WNI_CFG_WOWLAN_DISASSOC_ENABLE_STADEF    1
-
-#define WNI_CFG_WOWLAN_MAX_MISSED_BEACON_STAMIN    0
-#define WNI_CFG_WOWLAN_MAX_MISSED_BEACON_STAMAX    65535
-#define WNI_CFG_WOWLAN_MAX_MISSED_BEACON_STADEF    40
-
-#define WNI_CFG_WOWLAN_MAX_SLEEP_PERIOD_STAMIN    0
-#define WNI_CFG_WOWLAN_MAX_SLEEP_PERIOD_STAMAX    65535
-#define WNI_CFG_WOWLAN_MAX_SLEEP_PERIOD_STADEF    65535
-
-#define WNI_CFG_BA_TIMEOUT_STAMIN    0
-#define WNI_CFG_BA_TIMEOUT_STAMAX    65535
-#define WNI_CFG_BA_TIMEOUT_STADEF    0
-
-#define WNI_CFG_BA_TIMEOUT_APMIN    0
-#define WNI_CFG_BA_TIMEOUT_APMAX    65535
-#define WNI_CFG_BA_TIMEOUT_APDEF    0
-
-#define WNI_CFG_BA_THRESHOLD_HIGH_STAMIN    0
-#define WNI_CFG_BA_THRESHOLD_HIGH_STAMAX    65535
-#define WNI_CFG_BA_THRESHOLD_HIGH_STADEF    128
-
-#define WNI_CFG_BA_THRESHOLD_HIGH_APMIN    0
-#define WNI_CFG_BA_THRESHOLD_HIGH_APMAX    65535
-#define WNI_CFG_BA_THRESHOLD_HIGH_APDEF    128
-
-#define WNI_CFG_MAX_BA_BUFFERS_STAMIN    0
-#define WNI_CFG_MAX_BA_BUFFERS_STAMAX    2560
-#define WNI_CFG_MAX_BA_BUFFERS_STADEF    2560
-
-#define WNI_CFG_MAX_BA_BUFFERS_APMIN    0
-#define WNI_CFG_MAX_BA_BUFFERS_APMAX    2560
-#define WNI_CFG_MAX_BA_BUFFERS_APDEF    2560
-
-#define WNI_CFG_MAX_BA_SESSIONS_STAMIN    0
-#define WNI_CFG_MAX_BA_SESSIONS_STAMAX    64
-#define WNI_CFG_MAX_BA_SESSIONS_STADEF    40
-
-#define WNI_CFG_MAX_BA_SESSIONS_APMIN    0
-#define WNI_CFG_MAX_BA_SESSIONS_APMAX    64
-#define WNI_CFG_MAX_BA_SESSIONS_APDEF    40
-
-#define WNI_CFG_BA_AUTO_SETUP_STAMIN    0
-#define WNI_CFG_BA_AUTO_SETUP_STAMAX    1
-#define WNI_CFG_BA_AUTO_SETUP_STADEF    1
-
-#define WNI_CFG_BA_AUTO_SETUP_APMIN    0
-#define WNI_CFG_BA_AUTO_SETUP_APMAX    1
-#define WNI_CFG_BA_AUTO_SETUP_APDEF    1
-
-#define WNI_CFG_BA_AUTO_SETUP_ENABLE    1
-#define WNI_CFG_BA_AUTO_SETUP_DISABLE    0
-
-#define WNI_CFG_ADDBA_REQ_DECLINE_STAMIN    0
-#define WNI_CFG_ADDBA_REQ_DECLINE_STAMAX    255
-#define WNI_CFG_ADDBA_REQ_DECLINE_STADEF    0
-
-#define WNI_CFG_ADDBA_REQ_DECLINE_APMIN    0
-#define WNI_CFG_ADDBA_REQ_DECLINE_APMAX    255
-#define WNI_CFG_ADDBA_REQ_DECLINE_APDEF    0
-
-#define WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC_STAMIN    0
-#define WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC_STAMAX    1
-#define WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC_STADEF    0
-
-#define WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC_APMIN    0
-#define WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC_APMAX    1
-#define WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC_APDEF    0
-
-#define WNI_CFG_MAX_MEDIUM_TIME_STAMIN    0
-#define WNI_CFG_MAX_MEDIUM_TIME_STAMAX    65535
-#define WNI_CFG_MAX_MEDIUM_TIME_STADEF    2048
-
-#define WNI_CFG_MAX_MEDIUM_TIME_APMIN    0
-#define WNI_CFG_MAX_MEDIUM_TIME_APMAX    65535
-#define WNI_CFG_MAX_MEDIUM_TIME_APDEF    2048
-
-#define WNI_CFG_MAX_MPDUS_IN_AMPDU_STAMIN    0
-#define WNI_CFG_MAX_MPDUS_IN_AMPDU_STAMAX    65535
-#define WNI_CFG_MAX_MPDUS_IN_AMPDU_STADEF    64
-
-#define WNI_CFG_MAX_MPDUS_IN_AMPDU_APMIN    0
-#define WNI_CFG_MAX_MPDUS_IN_AMPDU_APMAX    65535
-#define WNI_CFG_MAX_MPDUS_IN_AMPDU_APDEF    64
-
-#define WNI_CFG_IBSS_AUTO_BSSID_STAMIN    0
-#define WNI_CFG_IBSS_AUTO_BSSID_STAMAX    1
-#define WNI_CFG_IBSS_AUTO_BSSID_STADEF    1
-
-#define WNI_CFG_PROBE_REQ_ADDNIE_FLAG_STAMIN    0
-#define WNI_CFG_PROBE_REQ_ADDNIE_FLAG_STAMAX    1
-#define WNI_CFG_PROBE_REQ_ADDNIE_FLAG_STADEF    0
-
-#define WNI_CFG_PROBE_REQ_ADDNIE_FLAG_APMIN    0
-#define WNI_CFG_PROBE_REQ_ADDNIE_FLAG_APMAX    1
-#define WNI_CFG_PROBE_REQ_ADDNIE_FLAG_APDEF    0
-
-#define WNI_CFG_PROBE_RSP_ADDNIE_FLAG_STAMIN    0
-#define WNI_CFG_PROBE_RSP_ADDNIE_FLAG_STAMAX    1
-#define WNI_CFG_PROBE_RSP_ADDNIE_FLAG_STADEF    0
-
-#define WNI_CFG_PROBE_RSP_ADDNIE_FLAG_APMIN    0
-#define WNI_CFG_PROBE_RSP_ADDNIE_FLAG_APMAX    1
-#define WNI_CFG_PROBE_RSP_ADDNIE_FLAG_APDEF    0
-
-#define WNI_CFG_ASSOC_RSP_ADDNIE_FLAG_STAMIN    0
-#define WNI_CFG_ASSOC_RSP_ADDNIE_FLAG_STAMAX    1
-#define WNI_CFG_ASSOC_RSP_ADDNIE_FLAG_STADEF    0
-
-#define WNI_CFG_ASSOC_RSP_ADDNIE_FLAG_APMIN    0
-#define WNI_CFG_ASSOC_RSP_ADDNIE_FLAG_APMAX    1
-#define WNI_CFG_ASSOC_RSP_ADDNIE_FLAG_APDEF    0
-
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_FLAG_STAMIN    0
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_FLAG_STAMAX    1
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_FLAG_STADEF    0
-
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_FLAG_APMIN    0
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_FLAG_APMAX    1
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_FLAG_APDEF    0
-
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG_STAMIN    0
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG_STAMAX    1
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG_STADEF    0
-
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG_APMIN    0
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG_APMAX    1
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG_APDEF    0
-
-#define WNI_CFG_WPS_ENABLE_STAMIN    0
-#define WNI_CFG_WPS_ENABLE_STAMAX    255
-#define WNI_CFG_WPS_ENABLE_STADEF    0
-
-#define WNI_CFG_WPS_ENABLE_APMIN    0
-#define WNI_CFG_WPS_ENABLE_APMAX    255
-#define WNI_CFG_WPS_ENABLE_APDEF    0
-
-#define WNI_CFG_WPS_ENABLE_AP    1
-#define WNI_CFG_WPS_ENABLE_STA    2
-
-#define WNI_CFG_WPS_STATE_STAMIN    0
-#define WNI_CFG_WPS_STATE_STAMAX    255
-#define WNI_CFG_WPS_STATE_STADEF    1
-
-#define WNI_CFG_WPS_STATE_APMIN    0
-#define WNI_CFG_WPS_STATE_APMAX    255
-#define WNI_CFG_WPS_STATE_APDEF    1
-
-#define WNI_CFG_WPS_PROBE_REQ_FLAG_STAMIN    0
-#define WNI_CFG_WPS_PROBE_REQ_FLAG_STAMAX    1
-#define WNI_CFG_WPS_PROBE_REQ_FLAG_STADEF    0
-
-#define WNI_CFG_WPS_PROBE_REQ_FLAG_APMIN    0
-#define WNI_CFG_WPS_PROBE_REQ_FLAG_APMAX    1
-#define WNI_CFG_WPS_PROBE_REQ_FLAG_APDEF    0
-
-#define WNI_CFG_WPS_VERSION_STAMIN    0
-#define WNI_CFG_WPS_VERSION_STAMAX    255
-#define WNI_CFG_WPS_VERSION_STADEF    16
-
-#define WNI_CFG_WPS_VERSION_APMIN    0
-#define WNI_CFG_WPS_VERSION_APMAX    255
-#define WNI_CFG_WPS_VERSION_APDEF    16
-
-#define WNI_CFG_WPS_REQUEST_TYPE_STAMIN    0
-#define WNI_CFG_WPS_REQUEST_TYPE_STAMAX    255
-#define WNI_CFG_WPS_REQUEST_TYPE_STADEF    0
-
-#define WNI_CFG_WPS_REQUEST_TYPE_APMIN    0
-#define WNI_CFG_WPS_REQUEST_TYPE_APMAX    255
-#define WNI_CFG_WPS_REQUEST_TYPE_APDEF    3
-
-#define WNI_CFG_WPS_CFG_METHOD_STAMIN    0
-#define WNI_CFG_WPS_CFG_METHOD_STAMAX    4294967295
-#define WNI_CFG_WPS_CFG_METHOD_STADEF    8
-
-#define WNI_CFG_WPS_CFG_METHOD_APMIN    0
-#define WNI_CFG_WPS_CFG_METHOD_APMAX    4294967295
-#define WNI_CFG_WPS_CFG_METHOD_APDEF    25952654
-
-#define WNI_CFG_WPS_PRIMARY_DEVICE_CATEGORY_STAMIN    0
-#define WNI_CFG_WPS_PRIMARY_DEVICE_CATEGORY_STAMAX    65535
-#define WNI_CFG_WPS_PRIMARY_DEVICE_CATEGORY_STADEF    1
-
-#define WNI_CFG_WPS_PRIMARY_DEVICE_CATEGORY_APMIN    0
-#define WNI_CFG_WPS_PRIMARY_DEVICE_CATEGORY_APMAX    65535
-#define WNI_CFG_WPS_PRIMARY_DEVICE_CATEGORY_APDEF    6
-
-#define WNI_CFG_WPS_PIMARY_DEVICE_OUI_STAMIN    0
-#define WNI_CFG_WPS_PIMARY_DEVICE_OUI_STAMAX    4294967295
-#define WNI_CFG_WPS_PIMARY_DEVICE_OUI_STADEF    5304836
-
-#define WNI_CFG_WPS_PIMARY_DEVICE_OUI_APMIN    0
-#define WNI_CFG_WPS_PIMARY_DEVICE_OUI_APMAX    4294967295
-#define WNI_CFG_WPS_PIMARY_DEVICE_OUI_APDEF    5304836
-
-#define WNI_CFG_WPS_DEVICE_SUB_CATEGORY_STAMIN    0
-#define WNI_CFG_WPS_DEVICE_SUB_CATEGORY_STAMAX    65535
-#define WNI_CFG_WPS_DEVICE_SUB_CATEGORY_STADEF    1
-
-#define WNI_CFG_WPS_DEVICE_SUB_CATEGORY_APMIN    0
-#define WNI_CFG_WPS_DEVICE_SUB_CATEGORY_APMAX    65535
-#define WNI_CFG_WPS_DEVICE_SUB_CATEGORY_APDEF    1
-
-#define WNI_CFG_WPS_ASSOCIATION_STATE_STAMIN    0
-#define WNI_CFG_WPS_ASSOCIATION_STATE_STAMAX    65535
-#define WNI_CFG_WPS_ASSOCIATION_STATE_STADEF    0
-
-#define WNI_CFG_WPS_ASSOCIATION_STATE_APMIN    0
-#define WNI_CFG_WPS_ASSOCIATION_STATE_APMAX    65535
-#define WNI_CFG_WPS_ASSOCIATION_STATE_APDEF    0
-
-#define WNI_CFG_WPS_CONFIGURATION_ERROR_STAMIN    0
-#define WNI_CFG_WPS_CONFIGURATION_ERROR_STAMAX    65535
-#define WNI_CFG_WPS_CONFIGURATION_ERROR_STADEF    0
-
-#define WNI_CFG_WPS_CONFIGURATION_ERROR_APMIN    0
-#define WNI_CFG_WPS_CONFIGURATION_ERROR_APMAX    65535
-#define WNI_CFG_WPS_CONFIGURATION_ERROR_APDEF    0
-
-#define WNI_CFG_WPS_DEVICE_PASSWORD_ID_STAMIN    0
-#define WNI_CFG_WPS_DEVICE_PASSWORD_ID_STAMAX    4294967295
-#define WNI_CFG_WPS_DEVICE_PASSWORD_ID_STADEF    0
-
-#define WNI_CFG_WPS_DEVICE_PASSWORD_ID_APMIN    0
-#define WNI_CFG_WPS_DEVICE_PASSWORD_ID_APMAX    4294967295
-#define WNI_CFG_WPS_DEVICE_PASSWORD_ID_APDEF    0
-
-#define WNI_CFG_WPS_ASSOC_METHOD_STAMIN    0
-#define WNI_CFG_WPS_ASSOC_METHOD_STAMAX    65535
-#define WNI_CFG_WPS_ASSOC_METHOD_STADEF    0
-
-#define WNI_CFG_WPS_ASSOC_METHOD_APMIN    0
-#define WNI_CFG_WPS_ASSOC_METHOD_APMAX    65535
-#define WNI_CFG_WPS_ASSOC_METHOD_APDEF    0
-
-#define WNI_CFG_LOW_GAIN_OVERRIDE_STAMIN    0
-#define WNI_CFG_LOW_GAIN_OVERRIDE_STAMAX    1
-#define WNI_CFG_LOW_GAIN_OVERRIDE_STADEF    0
-
-#define WNI_CFG_LOW_GAIN_OVERRIDE_APMIN    0
-#define WNI_CFG_LOW_GAIN_OVERRIDE_APMAX    1
-#define WNI_CFG_LOW_GAIN_OVERRIDE_APDEF    0
-
-#define WNI_CFG_ENABLE_PHY_AGC_LISTEN_MODE_STAMIN    0
-#define WNI_CFG_ENABLE_PHY_AGC_LISTEN_MODE_STAMAX    128
-#define WNI_CFG_ENABLE_PHY_AGC_LISTEN_MODE_STADEF    128
-
-#define WNI_CFG_ENABLE_PHY_AGC_LISTEN_MODE_APMIN    0
-#define WNI_CFG_ENABLE_PHY_AGC_LISTEN_MODE_APMAX    128
-#define WNI_CFG_ENABLE_PHY_AGC_LISTEN_MODE_APDEF    128
-
-#define WNI_CFG_RPE_POLLING_THRESHOLD_STAMIN    0
-#define WNI_CFG_RPE_POLLING_THRESHOLD_STAMAX    65535
-#define WNI_CFG_RPE_POLLING_THRESHOLD_STADEF    10
-
-#define WNI_CFG_RPE_POLLING_THRESHOLD_APMIN    0
-#define WNI_CFG_RPE_POLLING_THRESHOLD_APMAX    65535
-#define WNI_CFG_RPE_POLLING_THRESHOLD_APDEF    10
-
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG_STAMIN    0
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG_STAMAX    65535
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG_STADEF    30
-
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG_APMIN    0
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG_APMAX    65535
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG_APDEF    30
-
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG_STAMIN    0
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG_STAMAX    65535
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG_STADEF    30
-
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG_APMIN    0
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG_APMAX    65535
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG_APDEF    30
-
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG_STAMIN    0
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG_STAMAX    65535
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG_STADEF    30
-
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG_APMIN    0
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG_APMAX    65535
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG_APDEF    30
-
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG_STAMIN    0
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG_STAMAX    65535
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG_STADEF    30
-
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG_APMIN    0
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG_APMAX    65535
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG_APDEF    30
-
-#define WNI_CFG_NO_OF_ONCHIP_REORDER_SESSIONS_STAMIN    0
-#define WNI_CFG_NO_OF_ONCHIP_REORDER_SESSIONS_STAMAX    2
-#define WNI_CFG_NO_OF_ONCHIP_REORDER_SESSIONS_STADEF    1
-
-#define WNI_CFG_NO_OF_ONCHIP_REORDER_SESSIONS_APMIN    0
-#define WNI_CFG_NO_OF_ONCHIP_REORDER_SESSIONS_APMAX    2
-#define WNI_CFG_NO_OF_ONCHIP_REORDER_SESSIONS_APDEF    1
-
-#define WNI_CFG_SINGLE_TID_RC_STAMIN    0
-#define WNI_CFG_SINGLE_TID_RC_STAMAX    1
-#define WNI_CFG_SINGLE_TID_RC_STADEF    1
-
-#define WNI_CFG_SINGLE_TID_RC_APMIN    0
-#define WNI_CFG_SINGLE_TID_RC_APMAX    1
-#define WNI_CFG_SINGLE_TID_RC_APDEF    1
-
-#define WNI_CFG_TX_PWR_CTRL_ENABLE_STAMIN    0
-#define WNI_CFG_TX_PWR_CTRL_ENABLE_STAMAX    1
-#define WNI_CFG_TX_PWR_CTRL_ENABLE_STADEF    1
-
-#define WNI_CFG_TX_PWR_CTRL_ENABLE_APMIN    0
-#define WNI_CFG_TX_PWR_CTRL_ENABLE_APMAX    1
-#define WNI_CFG_TX_PWR_CTRL_ENABLE_APDEF    1
-
-#define WNI_CFG_MCAST_BCAST_FILTER_SETTING_STAMIN    0
-#define WNI_CFG_MCAST_BCAST_FILTER_SETTING_STAMAX    3
-#define WNI_CFG_MCAST_BCAST_FILTER_SETTING_STADEF    0
-
-#define WNI_CFG_MCAST_BCAST_FILTER_SETTING_APMIN    0
-#define WNI_CFG_MCAST_BCAST_FILTER_SETTING_APMAX    3
-#define WNI_CFG_MCAST_BCAST_FILTER_SETTING_APDEF    0
-
-#define WNI_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK_STAMIN    0
-#define WNI_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK_STAMAX    255
-#define WNI_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK_STADEF    0
-
-#define WNI_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK_APMIN    0
-#define WNI_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK_APMAX    255
-#define WNI_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK_APDEF    0
-
-#define WNI_CFG_DYNAMIC_PS_POLL_VALUE_STAMIN    0
-#define WNI_CFG_DYNAMIC_PS_POLL_VALUE_STAMAX    255
-#define WNI_CFG_DYNAMIC_PS_POLL_VALUE_STADEF    0
-
-#define WNI_CFG_DYNAMIC_PS_POLL_VALUE_APMIN    0
-#define WNI_CFG_DYNAMIC_PS_POLL_VALUE_APMAX    255
-#define WNI_CFG_DYNAMIC_PS_POLL_VALUE_APDEF    0
-
-#define WNI_CFG_PS_NULLDATA_AP_RESP_TIMEOUT_STAMIN    0
-#define WNI_CFG_PS_NULLDATA_AP_RESP_TIMEOUT_STAMAX    80
-#define WNI_CFG_PS_NULLDATA_AP_RESP_TIMEOUT_STADEF    0
-
-#define WNI_CFG_TELE_BCN_WAKEUP_EN_STAMIN    0
-#define WNI_CFG_TELE_BCN_WAKEUP_EN_STAMAX    1
-#define WNI_CFG_TELE_BCN_WAKEUP_EN_STADEF    0
-
-#define WNI_CFG_TELE_BCN_WAKEUP_EN_APMIN    0
-#define WNI_CFG_TELE_BCN_WAKEUP_EN_APMAX    1
-#define WNI_CFG_TELE_BCN_WAKEUP_EN_APDEF    0
-
-#define WNI_CFG_TELE_BCN_TRANS_LI_STAMIN    0
-#define WNI_CFG_TELE_BCN_TRANS_LI_STAMAX    7
-#define WNI_CFG_TELE_BCN_TRANS_LI_STADEF    3
-
-#define WNI_CFG_TELE_BCN_TRANS_LI_APMIN    0
-#define WNI_CFG_TELE_BCN_TRANS_LI_APMAX    7
-#define WNI_CFG_TELE_BCN_TRANS_LI_APDEF    3
-
-#define WNI_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS_STAMIN    5
-#define WNI_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS_STAMAX    255
-#define WNI_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS_STADEF    10
-
-#define WNI_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS_APMIN    5
-#define WNI_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS_APMAX    255
-#define WNI_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS_APDEF    10
-
-#define WNI_CFG_TELE_BCN_MAX_LI_STAMIN    0
-#define WNI_CFG_TELE_BCN_MAX_LI_STAMAX    7
-#define WNI_CFG_TELE_BCN_MAX_LI_STADEF    5
-
-#define WNI_CFG_TELE_BCN_MAX_LI_APMIN    0
-#define WNI_CFG_TELE_BCN_MAX_LI_APMAX    7
-#define WNI_CFG_TELE_BCN_MAX_LI_APDEF    5
-
-#define WNI_CFG_TELE_BCN_MAX_LI_IDLE_BCNS_STAMIN    5
-#define WNI_CFG_TELE_BCN_MAX_LI_IDLE_BCNS_STAMAX    255
-#define WNI_CFG_TELE_BCN_MAX_LI_IDLE_BCNS_STADEF    15
-
-#define WNI_CFG_TELE_BCN_MAX_LI_IDLE_BCNS_APMIN    5
-#define WNI_CFG_TELE_BCN_MAX_LI_IDLE_BCNS_APMAX    255
-#define WNI_CFG_TELE_BCN_MAX_LI_IDLE_BCNS_APDEF    15
-
-#define WNI_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS_STAMIN    0
-#define WNI_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS_STAMAX    255
-#define WNI_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS_STADEF    7
-
-#define WNI_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS_APMIN    0
-#define WNI_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS_APMAX    255
-#define WNI_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS_APDEF    7
-
-#define WNI_CFG_INFRA_STA_KEEP_ALIVE_PERIOD_STAMIN    0
-#define WNI_CFG_INFRA_STA_KEEP_ALIVE_PERIOD_STAMAX    1000
-#define WNI_CFG_INFRA_STA_KEEP_ALIVE_PERIOD_STADEF    0
-
-#define WNI_CFG_INFRA_STA_KEEP_ALIVE_PERIOD_APMIN    0
-#define WNI_CFG_INFRA_STA_KEEP_ALIVE_PERIOD_APMAX    1000
-#define WNI_CFG_INFRA_STA_KEEP_ALIVE_PERIOD_APDEF    0
-
-#define WNI_CFG_ASSOC_STA_LIMIT_STAMIN    1
-#define WNI_CFG_ASSOC_STA_LIMIT_STAMAX    32
-#define WNI_CFG_ASSOC_STA_LIMIT_STADEF    10
-
-#define WNI_CFG_ASSOC_STA_LIMIT_APMIN    1
-#define WNI_CFG_ASSOC_STA_LIMIT_APMAX    32
-#define WNI_CFG_ASSOC_STA_LIMIT_APDEF    10
-
-#define WNI_CFG_SAP_CHANNEL_SELECT_START_CHANNEL_STAMIN    1
-#define WNI_CFG_SAP_CHANNEL_SELECT_START_CHANNEL_STAMAX    252
-#define WNI_CFG_SAP_CHANNEL_SELECT_START_CHANNEL_STADEF    1
-
-#define WNI_CFG_SAP_CHANNEL_SELECT_START_CHANNEL_APMIN    1
-#define WNI_CFG_SAP_CHANNEL_SELECT_START_CHANNEL_APMAX    252
-#define WNI_CFG_SAP_CHANNEL_SELECT_START_CHANNEL_APDEF    1
-
-#define WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL_STAMIN    1
-#define WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL_STAMAX    252
-#define WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL_STADEF    11
-
-#define WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL_APMIN    1
-#define WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL_APMAX    252
-#define WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL_APDEF    11
-
-#define WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND_STAMIN    0
-#define WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND_STAMAX    5
-#define WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND_STADEF    0
-
-#define WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND_APMIN    0
-#define WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND_APMAX    5
-#define WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND_APDEF    0
-
-#define WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD_STAMIN    0
-#define WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD_STAMAX    65535
-#define WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD_STADEF    5
-
-#define WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD_APMIN    0
-#define WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD_APMAX    65535
-#define WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD_APDEF    5
-
-#define WNI_CFG_ENABLE_CLOSE_LOOP_STAMIN    0
-#define WNI_CFG_ENABLE_CLOSE_LOOP_STAMAX    1
-#define WNI_CFG_ENABLE_CLOSE_LOOP_STADEF    0
-
-#define WNI_CFG_ENABLE_CLOSE_LOOP_APMIN    0
-#define WNI_CFG_ENABLE_CLOSE_LOOP_APMAX    1
-#define WNI_CFG_ENABLE_CLOSE_LOOP_APDEF    0
-
-#define WNI_CFG_ENABLE_LTE_COEX_STAMIN    0
-#define WNI_CFG_ENABLE_LTE_COEX_STAMAX    1
-#define WNI_CFG_ENABLE_LTE_COEX_STADEF    0
-
-#define WNI_CFG_ENABLE_LTE_COEX_APMIN    0
-#define WNI_CFG_ENABLE_LTE_COEX_APMAX    1
-#define WNI_CFG_ENABLE_LTE_COEX_APDEF    0
-
-#define WNI_CFG_AP_KEEP_ALIVE_TIMEOUT_STAMIN    1
-#define WNI_CFG_AP_KEEP_ALIVE_TIMEOUT_STAMAX    65535
-#define WNI_CFG_AP_KEEP_ALIVE_TIMEOUT_STADEF    20
-
-#define WNI_CFG_AP_KEEP_ALIVE_TIMEOUT_APMIN    1
-#define WNI_CFG_AP_KEEP_ALIVE_TIMEOUT_APMAX    65535
-#define WNI_CFG_AP_KEEP_ALIVE_TIMEOUT_APDEF    20
-
-#define WNI_CFG_GO_KEEP_ALIVE_TIMEOUT_STAMIN    1
-#define WNI_CFG_GO_KEEP_ALIVE_TIMEOUT_STAMAX    65535
-#define WNI_CFG_GO_KEEP_ALIVE_TIMEOUT_STADEF    20
-
-#define WNI_CFG_GO_KEEP_ALIVE_TIMEOUT_APMIN    1
-#define WNI_CFG_GO_KEEP_ALIVE_TIMEOUT_APMAX    65535
-#define WNI_CFG_GO_KEEP_ALIVE_TIMEOUT_APDEF    20
-
-#define WNI_CFG_ENABLE_MC_ADDR_LIST_STAMIN    0
-#define WNI_CFG_ENABLE_MC_ADDR_LIST_STAMAX    1
-#define WNI_CFG_ENABLE_MC_ADDR_LIST_STADEF    0
-
-#define WNI_CFG_ENABLE_MC_ADDR_LIST_APMIN    0
-#define WNI_CFG_ENABLE_MC_ADDR_LIST_APMAX    1
-#define WNI_CFG_ENABLE_MC_ADDR_LIST_APDEF    0
-
-#define WNI_CFG_ENABLE_UC_FILTER_STAMIN    0
-#define WNI_CFG_ENABLE_UC_FILTER_STAMAX    1
-#define WNI_CFG_ENABLE_UC_FILTER_STADEF    0
-
-#define WNI_CFG_ENABLE_UC_FILTER_APMIN    0
-#define WNI_CFG_ENABLE_UC_FILTER_APMAX    1
-#define WNI_CFG_ENABLE_UC_FILTER_APDEF    0
-
-#define WNI_CFG_ENABLE_LPWR_IMG_TRANSITION_STAMIN    0
-#define WNI_CFG_ENABLE_LPWR_IMG_TRANSITION_STAMAX    1
-#define WNI_CFG_ENABLE_LPWR_IMG_TRANSITION_STADEF    0
-
-#define WNI_CFG_ENABLE_LPWR_IMG_TRANSITION_APMIN    0
-#define WNI_CFG_ENABLE_LPWR_IMG_TRANSITION_APMAX    1
-#define WNI_CFG_ENABLE_LPWR_IMG_TRANSITION_APDEF    0
-
-#define WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED_STAMIN    0
-#define WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED_STAMAX    1
-#define WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED_STADEF    0
-
-#define WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED_APMIN    0
-#define WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED_APMAX    1
-#define WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED_APDEF    0
-
-#define WNI_CFG_DISABLE_LDPC_WITH_TXBF_AP_STAMIN    0
-#define WNI_CFG_DISABLE_LDPC_WITH_TXBF_AP_STAMAX    1
-#define WNI_CFG_DISABLE_LDPC_WITH_TXBF_AP_STADEF    0
-
-#define WNI_CFG_DISABLE_LDPC_WITH_TXBF_AP_APMIN    0
-#define WNI_CFG_DISABLE_LDPC_WITH_TXBF_AP_APMAX    1
-#define WNI_CFG_DISABLE_LDPC_WITH_TXBF_AP_APDEF    0
-
-#define WNI_CFG_AP_LINK_MONITOR_TIMEOUT_STAMIN    1
-#define WNI_CFG_AP_LINK_MONITOR_TIMEOUT_STAMAX    255
-#define WNI_CFG_AP_LINK_MONITOR_TIMEOUT_STADEF    3
-
-#define WNI_CFG_AP_LINK_MONITOR_TIMEOUT_APMIN    1
-#define WNI_CFG_AP_LINK_MONITOR_TIMEOUT_APMAX    255
-#define WNI_CFG_AP_LINK_MONITOR_TIMEOUT_APDEF    3
-
-#define WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK_STAMIN    0
-#define WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK_STAMAX    15
-#define WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK_STADEF    0
-
-#define WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK_APMIN    0
-#define WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK_APMAX    15
-#define WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK_APDEF    0
-
-#define WNI_CFG_TDLS_BUF_STA_ENABLED_STAMIN    0
-#define WNI_CFG_TDLS_BUF_STA_ENABLED_STAMAX    1
-#define WNI_CFG_TDLS_BUF_STA_ENABLED_STADEF    0
-
-#define WNI_CFG_TDLS_BUF_STA_ENABLED_APMIN    0
-#define WNI_CFG_TDLS_BUF_STA_ENABLED_APMAX    1
-#define WNI_CFG_TDLS_BUF_STA_ENABLED_APDEF    0
-
-#define WNI_CFG_TDLS_PUAPSD_INACT_TIME_STAMIN    0
-#define WNI_CFG_TDLS_PUAPSD_INACT_TIME_STAMAX    10
-#define WNI_CFG_TDLS_PUAPSD_INACT_TIME_STADEF    0
-
-#define WNI_CFG_TDLS_PUAPSD_INACT_TIME_APMIN    0
-#define WNI_CFG_TDLS_PUAPSD_INACT_TIME_APMAX    10
-#define WNI_CFG_TDLS_PUAPSD_INACT_TIME_APDEF    0
-
-#define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_STAMIN    10
-#define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_STAMAX    20
-#define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_STADEF    10
-
-#define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_APMIN    10
-#define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_APMAX    20
-#define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_APDEF    10
-
-#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_STAMIN    0
-#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_STAMAX    20
-#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_STADEF    5
-
-#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_APMIN    0
-#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_APMAX    20
-#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_APDEF    5
-
-#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STAMIN    10
-#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STAMAX    2000
-#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STADEF    200
-
-#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_APMIN    10
-#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_APMAX    2000
-#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_APDEF    200
-
-#define WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STAMIN    0
-#define WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STAMAX    1
-#define WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STADEF    1
-
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR_STAMIN    0
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR_STAMAX    9
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR_STADEF    0
-
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR_APMIN    0
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR_APMAX    9
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR_APDEF    0
-
-#define WNI_CFG_ANTENNA_DIVESITY_STAMIN    0
-#define WNI_CFG_ANTENNA_DIVESITY_STAMAX    3
-#define WNI_CFG_ANTENNA_DIVESITY_STADEF    0
-
-#define WNI_CFG_ANTENNA_DIVESITY_APMIN    0
-#define WNI_CFG_ANTENNA_DIVESITY_APMAX    3
-#define WNI_CFG_ANTENNA_DIVESITY_APDEF    0
-
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT_STAMIN    3
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT_STAMAX    50
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT_STADEF    10
-
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT_APMIN    3
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT_APMAX    50
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT_APDEF    10
-
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMIN    100
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STAMAX    1000
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_STADEF    300
-
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_APMIN    100
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_APMAX    1000
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY_APDEF    300
-
-#define WNI_CFG_CURRENT_RSSI_STAMIN    0
-#define WNI_CFG_CURRENT_RSSI_STAMAX    127
-#define WNI_CFG_CURRENT_RSSI_STADEF    0
-
-#define WNI_CFG_CURRENT_RSSI_APMIN    0
-#define WNI_CFG_CURRENT_RSSI_APMAX    127
-#define WNI_CFG_CURRENT_RSSI_APDEF    0
-
-#define WNI_CFG_RTT3_ENABLE_STAMIN    0
-#define WNI_CFG_RTT3_ENABLE_STAMAX    1
-#define WNI_CFG_RTT3_ENABLE_STADEF    1
-
-#define WNI_CFG_RTT3_ENABLE_APMIN    0
-#define WNI_CFG_RTT3_ENABLE_APMAX    1
-#define WNI_CFG_RTT3_ENABLE_APDEF    1
-
-#define WNI_CFG_DEBUG_P2P_REMAIN_ON_CHANNEL_STAMIN    0
-#define WNI_CFG_DEBUG_P2P_REMAIN_ON_CHANNEL_STAMAX    1
-#define WNI_CFG_DEBUG_P2P_REMAIN_ON_CHANNEL_STADEF    0
-
-#define WNI_CFG_DEBUG_P2P_REMAIN_ON_CHANNEL_APMIN    0
-#define WNI_CFG_DEBUG_P2P_REMAIN_ON_CHANNEL_APMAX    1
-#define WNI_CFG_DEBUG_P2P_REMAIN_ON_CHANNEL_APDEF    0
-
-#define WNI_CFG_TDLS_OFF_CHANNEL_ENABLED_STAMIN    0
-#define WNI_CFG_TDLS_OFF_CHANNEL_ENABLED_STAMAX    1
-#define WNI_CFG_TDLS_OFF_CHANNEL_ENABLED_STADEF    0
-
-#define WNI_CFG_TDLS_OFF_CHANNEL_ENABLED_APMIN    0
-#define WNI_CFG_TDLS_OFF_CHANNEL_ENABLED_APMAX    1
-#define WNI_CFG_TDLS_OFF_CHANNEL_ENABLED_APDEF    0
-
-#define WNI_CFG_IBSS_ATIM_WIN_SIZE_STAMIN    0
-#define WNI_CFG_IBSS_ATIM_WIN_SIZE_STAMAX    100
-#define WNI_CFG_IBSS_ATIM_WIN_SIZE_STADEF    0
-
-#define WNI_CFG_IBSS_ATIM_WIN_SIZE_APMIN    0
-#define WNI_CFG_IBSS_ATIM_WIN_SIZE_APMAX    100
-#define WNI_CFG_IBSS_ATIM_WIN_SIZE_APDEF    0
-
-#define WNI_CFG_DFS_MASTER_ENABLED_STAMIN    0
-#define WNI_CFG_DFS_MASTER_ENABLED_STAMAX    1
-#define WNI_CFG_DFS_MASTER_ENABLED_STADEF    0
-
-#define WNI_CFG_DFS_MASTER_ENABLED_APMIN    0
-#define WNI_CFG_DFS_MASTER_ENABLED_APMAX    1
-#define WNI_CFG_DFS_MASTER_ENABLED_APDEF    0
-
-#define WNI_CFG_VHT_ENABLE_TXBF_20MHZ_STAMIN    0
-#define WNI_CFG_VHT_ENABLE_TXBF_20MHZ_STAMAX    1
-#define WNI_CFG_VHT_ENABLE_TXBF_20MHZ_STADEF    0
-
-#define WNI_CFG_VHT_ENABLE_TXBF_20MHZ_APMIN    0
-#define WNI_CFG_VHT_ENABLE_TXBF_20MHZ_APMAX    1
-#define WNI_CFG_VHT_ENABLE_TXBF_20MHZ_APDEF    0
-
-#define WNI_CFG_TDLS_WMM_MODE_ENABLED_STAMIN    0
-#define WNI_CFG_TDLS_WMM_MODE_ENABLED_STAMAX    1
-#define WNI_CFG_TDLS_WMM_MODE_ENABLED_STADEF    0
-
-#define WNI_CFG_TDLS_WMM_MODE_ENABLED_APMIN    0
-#define WNI_CFG_TDLS_WMM_MODE_ENABLED_APMAX    1
-#define WNI_CFG_TDLS_WMM_MODE_ENABLED_APDEF    0
-
-#define WNI_CFG_TGT_GTX_USR_CFG_STAMIN    0
-#define WNI_CFG_TGT_GTX_USR_CFG_STAMAX    32
-#define WNI_CFG_TGT_GTX_USR_CFG_STADEF    32
-
-#define WNI_CFG_TGT_GTX_USR_CFG_APMIN    0
-#define WNI_CFG_TGT_GTX_USR_CFG_APMAX    32
-#define WNI_CFG_TGT_GTX_USR_CFG_APDEF    32
-
-#define WNI_CFG_ASSOC_STA_LIMIT_AP_STAMIN    1
-#define WNI_CFG_ASSOC_STA_LIMIT_AP_STAMAX    32
-#define WNI_CFG_ASSOC_STA_LIMIT_AP_STADEF    10
-
-#define WNI_CFG_ASSOC_STA_LIMIT_AP_APMIN    1
-#define WNI_CFG_ASSOC_STA_LIMIT_AP_APMAX    32
-#define WNI_CFG_ASSOC_STA_LIMIT_AP_APDEF    10
-
-#define WNI_CFG_ASSOC_STA_LIMIT_GO_STAMIN    1
-#define WNI_CFG_ASSOC_STA_LIMIT_GO_STAMAX    32
-#define WNI_CFG_ASSOC_STA_LIMIT_GO_STADEF    10
-
-#define WNI_CFG_ASSOC_STA_LIMIT_GO_APMIN    1
-#define WNI_CFG_ASSOC_STA_LIMIT_GO_APMAX    32
-#define WNI_CFG_ASSOC_STA_LIMIT_GO_APDEF    10
-
-#define CFG_PARAM_MAX_NUM         301
-#define CFG_AP_IBUF_MAX_SIZE      246
-#define CFG_AP_SBUF_MAX_SIZE      3233
-#define CFG_STA_IBUF_MAX_SIZE     244
-#define CFG_STA_SBUF_MAX_SIZE     3199
-#define CFG_SEM_MAX_NUM           19
-
-#define CFG_STA_MAGIC_DWORD     0xbeefbeef
-
-#define CFG_AP_MAGIC_DWORD      0xdeaddead
-
-
-#endif
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/wniCfgSta.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/wni_cfg.h
index 2ae9de219ba..146312f9466 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/wniCfgSta.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/wni_cfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -25,321 +25,329 @@
  * to the Linux Foundation.
  */
 
-/*
- * DO NOT EDIT - This file is generated automatically
- */
-
-/*
- * IMPORTANT:  This file is for system that supports STA mode ONLY.
- */
-
-
-#ifndef __WNICFGSTA_H
-#define __WNICFGSTA_H
+#ifndef __WNICFG_H
+#define __WNICFG_H
 
 /*
  * Configuration Parameter ID for STA
  */
 
-#define WNI_CFG_STA_ID    0
-#define WNI_CFG_CFP_PERIOD    2
-#define WNI_CFG_CFP_MAX_DURATION    3
-#define WNI_CFG_SSID    4
-#define WNI_CFG_BEACON_INTERVAL    5
-#define WNI_CFG_DTIM_PERIOD    6
-#define WNI_CFG_WEP_KEY_LENGTH    7
-#define WNI_CFG_WEP_DEFAULT_KEY_TABLE    8
-#define WNI_CFG_WEP_DEFAULT_KEY_TABLE_ROW    4
-#define WNI_CFG_WEP_DEFAULT_KEY_TABLE_COL    1
-#define WNI_CFG_WEP_DEFAULT_KEY_1    8
-#define WNI_CFG_WEP_DEFAULT_KEY_2    9
-#define WNI_CFG_WEP_DEFAULT_KEY_3    10
-#define WNI_CFG_WEP_DEFAULT_KEY_4    11
-#define WNI_CFG_WEP_DEFAULT_KEYID    12
-#define WNI_CFG_EXCLUDE_UNENCRYPTED    13
-#define WNI_CFG_RTS_THRESHOLD    14
-#define WNI_CFG_SHORT_RETRY_LIMIT    15
-#define WNI_CFG_LONG_RETRY_LIMIT    16
-#define WNI_CFG_FRAGMENTATION_THRESHOLD    17
-#define WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME    18
-#define WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME    19
-#define WNI_CFG_PASSIVE_MINIMUM_CHANNEL_TIME    20
-#define WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME    21
-#define WNI_CFG_JOIN_FAILURE_TIMEOUT    22
-#define WNI_CFG_AUTHENTICATE_FAILURE_TIMEOUT    23
-#define WNI_CFG_AUTHENTICATE_RSP_TIMEOUT    24
-#define WNI_CFG_ASSOCIATION_FAILURE_TIMEOUT    25
-#define WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT    26
-#define WNI_CFG_RA_PERIODICITY_TIMEOUT_IN_PS    27
-#define WNI_CFG_PS_ENABLE_BCN_FILTER    28
-#define WNI_CFG_PS_ENABLE_HEART_BEAT    29
-#define WNI_CFG_PS_ENABLE_RSSI_MONITOR    30
-#define WNI_CFG_PS_DATA_INACTIVITY_TIMEOUT    31
-#define WNI_CFG_RF_SETTLING_TIME_CLK    32
-#define WNI_CFG_SUPPORTED_RATES_11B    33
-#define WNI_CFG_SUPPORTED_RATES_11A    34
-#define WNI_CFG_PHY_MODE    35
-#define WNI_CFG_DOT11_MODE    36
-#define WNI_CFG_OPERATIONAL_RATE_SET    37
-#define WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET    38
-#define WNI_CFG_PROPRIETARY_OPERATIONAL_RATE_SET    39
-#define WNI_CFG_LISTEN_INTERVAL    40
-#define WNI_CFG_VALID_CHANNEL_LIST    41
-#define WNI_CFG_CURRENT_CHANNEL    42
-#define WNI_CFG_DEFAULT_RATE_INDEX_5GHZ    43
-#define WNI_CFG_DEFAULT_RATE_INDEX_24GHZ    44
-#define WNI_CFG_RATE_ADAPTATION_TYPE    45
-#define WNI_CFG_FIXED_RATE    46
-#define WNI_CFG_FIXED_RATE_MULTICAST_24GHZ    47
-#define WNI_CFG_FIXED_RATE_MULTICAST_5GHZ    48
-#define WNI_CFG_RETRYRATE_POLICY    49
-#define WNI_CFG_RETRYRATE_SECONDARY    50
-#define WNI_CFG_RETRYRATE_TERTIARY    51
-#define WNI_CFG_APSD_ENABLED    52
-#define WNI_CFG_SHARED_KEY_AUTH_ENABLE    53
-#define WNI_CFG_OPEN_SYSTEM_AUTH_ENABLE    54
-#define WNI_CFG_AUTHENTICATION_TYPE    55
-#define WNI_CFG_PRIVACY_ENABLED    57
-#define WNI_CFG_SHORT_PREAMBLE    58
-#define WNI_CFG_SHORT_SLOT_TIME    59
-#define WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY    60
-#define WNI_CFG_QOS_ENABLED    61
-#define WNI_CFG_HCF_ENABLED    62
-#define WNI_CFG_RSN_ENABLED    63
-#define WNI_CFG_BACKGROUND_SCAN_PERIOD    64
-#define WNI_CFG_MAX_NUM_PRE_AUTH    65
-#define WNI_CFG_HEART_BEAT_THRESHOLD    68
-#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT    69
-#define WNI_CFG_MANUFACTURER_OUI    70
-#define WNI_CFG_MANUFACTURER_NAME    71
-#define WNI_CFG_MODEL_NUMBER    72
-#define WNI_CFG_MODEL_NAME    73
-#define WNI_CFG_MANUFACTURER_PRODUCT_NAME    74
-#define WNI_CFG_MANUFACTURER_PRODUCT_VERSION    75
-#define WNI_CFG_11D_ENABLED    76
-#define WNI_CFG_MAX_TX_POWER_2_4    77
-#define WNI_CFG_MAX_TX_POWER_5    78
-#define WNI_CFG_NETWORK_DENSITY    79
-#define WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM    80
-#define WNI_CFG_CURRENT_TX_ANTENNA    81
-#define WNI_CFG_CURRENT_RX_ANTENNA    82
-#define WNI_CFG_CURRENT_TX_POWER_LEVEL    83
-#define WNI_CFG_NEW_BSS_FOUND_IND    84
-#define WNI_CFG_PROPRIETARY_RATES_ENABLED    85
-#define WNI_CFG_COUNTRY_CODE    87
-#define WNI_CFG_11H_ENABLED    88
-#define WNI_CFG_WT_CNF_TIMEOUT    89
-#define WNI_CFG_KEEPALIVE_TIMEOUT    90
-#define WNI_CFG_PROXIMITY    91
-#define WNI_CFG_LOG_LEVEL    92
-#define WNI_CFG_OLBC_DETECT_TIMEOUT    93
-#define WNI_CFG_PROTECTION_ENABLED    94
-#define WNI_CFG_11G_PROTECTION_ALWAYS    95
-#define WNI_CFG_FORCE_POLICY_PROTECTION    96
-#define WNI_CFG_11G_SHORT_PREAMBLE_ENABLED    97
-#define WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED    98
-#define WNI_CFG_11G_ONLY_POLICY    99
-#define WNI_CFG_PACKET_CLASSIFICATION    100
-#define WNI_CFG_WME_ENABLED    101
-#define WNI_CFG_ADDTS_RSP_TIMEOUT    102
-#define WNI_CFG_MAX_SP_LENGTH    103
-#define WNI_CFG_SEND_SINGLE_SSID_ALWAYS    105
-#define WNI_CFG_WSM_ENABLED    106
-#define WNI_CFG_EDCA_PROFILE    107
-#define WNI_CFG_EDCA_ANI_ACBK_LOCAL    108
-#define WNI_CFG_EDCA_ANI_ACBE_LOCAL    109
-#define WNI_CFG_EDCA_ANI_ACVI_LOCAL    110
-#define WNI_CFG_EDCA_ANI_ACVO_LOCAL    111
-#define WNI_CFG_EDCA_ANI_ACBK    112
-#define WNI_CFG_EDCA_ANI_ACBE    113
-#define WNI_CFG_EDCA_ANI_ACVI    114
-#define WNI_CFG_EDCA_ANI_ACVO    115
-#define WNI_CFG_EDCA_WME_ACBK_LOCAL    116
-#define WNI_CFG_EDCA_WME_ACBE_LOCAL    117
-#define WNI_CFG_EDCA_WME_ACVI_LOCAL    118
-#define WNI_CFG_EDCA_WME_ACVO_LOCAL    119
-#define WNI_CFG_EDCA_WME_ACBK    120
-#define WNI_CFG_EDCA_WME_ACBE    121
-#define WNI_CFG_EDCA_WME_ACVI    122
-#define WNI_CFG_EDCA_WME_ACVO    123
-#define WNI_CFG_RDET_FLAG    124
-#define WNI_CFG_RADAR_CHANNEL_LIST    125
-#define WNI_CFG_LOCAL_POWER_CONSTRAINT    126
-#define WNI_CFG_ADMIT_POLICY    127
-#define WNI_CFG_ADMIT_BWFACTOR    128
-#define WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE    129
-#define WNI_CFG_CHANNEL_BONDING_MODE    130
-#define WNI_CFG_CB_SECONDARY_CHANNEL_STATE    131
-#define WNI_CFG_DYNAMIC_THRESHOLD_ZERO    132
-#define WNI_CFG_DYNAMIC_THRESHOLD_ONE    133
-#define WNI_CFG_DYNAMIC_THRESHOLD_TWO    134
-#define WNI_CFG_TRIG_STA_BK_SCAN    135
-#define WNI_CFG_DYNAMIC_PROFILE_SWITCHING    136
-#define WNI_CFG_SCAN_CONTROL_LIST    137
-#define WNI_CFG_MIMO_ENABLED    138
-#define WNI_CFG_BLOCK_ACK_ENABLED    139
-#define WNI_CFG_BA_ACTIVITY_CHECK_TIMEOUT    140
-#define WNI_CFG_HT_RX_STBC    141
-#define WNI_CFG_HT_CAP_INFO    142
-#define WNI_CFG_HT_AMPDU_PARAMS    143
-#define WNI_CFG_SUPPORTED_MCS_SET    144
-#define WNI_CFG_EXT_HT_CAP_INFO    145
-#define WNI_CFG_TX_BF_CAP    146
-#define WNI_CFG_AS_CAP    147
-#define WNI_CFG_HT_INFO_FIELD1    148
-#define WNI_CFG_HT_INFO_FIELD2    149
-#define WNI_CFG_HT_INFO_FIELD3    150
-#define WNI_CFG_BASIC_MCS_SET    151
-#define WNI_CFG_CURRENT_MCS_SET    152
-#define WNI_CFG_GREENFIELD_CAPABILITY    153
-#define WNI_CFG_VHT_MAX_MPDU_LENGTH    154
-#define WNI_CFG_VHT_SUPPORTED_CHAN_WIDTH_SET    155
-#define WNI_CFG_VHT_LDPC_CODING_CAP    156
-#define WNI_CFG_VHT_SHORT_GI_80MHZ    157
-#define WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ    158
-#define WNI_CFG_VHT_TXSTBC    159
-#define WNI_CFG_VHT_RXSTBC    160
-#define WNI_CFG_VHT_SU_BEAMFORMER_CAP    161
-#define WNI_CFG_VHT_SU_BEAMFORMEE_CAP    162
-#define WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED    163
-#define WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS    164
-#define WNI_CFG_VHT_MU_BEAMFORMER_CAP    165
-#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP    166
-#define WNI_CFG_VHT_TXOP_PS    167
-#define WNI_CFG_VHT_HTC_VHTC_CAP    168
-#define WNI_CFG_VHT_AMPDU_LEN_EXPONENT    169
-#define WNI_CFG_VHT_LINK_ADAPTATION_CAP    170
-#define WNI_CFG_VHT_RX_ANT_PATTERN    171
-#define WNI_CFG_VHT_TX_ANT_PATTERN    172
-#define WNI_CFG_VHT_RX_MCS_MAP    173
-#define WNI_CFG_VHT_TX_MCS_MAP    174
-#define WNI_CFG_VHT_RX_HIGHEST_SUPPORTED_DATA_RATE    175
-#define WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE    176
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1    177
-#define WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT2    178
-#define WNI_CFG_VHT_BASIC_MCS_SET    179
-#define WNI_CFG_VHT_MU_MIMO_CAP_STA_COUNT    180
-#define WNI_CFG_VHT_SS_UNDER_UTIL    181
-#define WNI_CFG_VHT_40MHZ_UTILIZATION    182
-#define WNI_CFG_VHT_80MHZ_UTILIZATION    183
-#define WNI_CFG_VHT_160MHZ_UTILIZATION    184
-#define WNI_CFG_MAX_AMSDU_LENGTH    185
-#define WNI_CFG_MPDU_DENSITY    186
-#define WNI_CFG_NUM_BUFF_ADVERT    187
-#define WNI_CFG_MAX_RX_AMPDU_FACTOR    188
-#define WNI_CFG_SHORT_GI_20MHZ    189
-#define WNI_CFG_SHORT_GI_40MHZ    190
-#define WNI_CFG_RIFS_ENABLED    191
-#define WNI_CFG_MAX_PS_POLL    192
-#define WNI_CFG_NUM_BEACON_PER_RSSI_AVERAGE    193
-#define WNI_CFG_RSSI_FILTER_PERIOD    194
-#define WNI_CFG_MIN_RSSI_THRESHOLD    195
-#define WNI_CFG_NTH_BEACON_FILTER    196
-#define WNI_CFG_BROADCAST_FRAME_FILTER_ENABLE    197
-#define WNI_CFG_SCAN_IN_POWERSAVE    198
-#define WNI_CFG_IGNORE_DTIM    199
-#define WNI_CFG_WOWLAN_UCAST_PATTERN_FILTER_ENABLE    200
-#define WNI_CFG_WOWLAN_CHANNEL_SWITCH_ENABLE    201
-#define WNI_CFG_WOWLAN_DEAUTH_ENABLE    202
-#define WNI_CFG_WOWLAN_DISASSOC_ENABLE    203
-#define WNI_CFG_WOWLAN_MAX_MISSED_BEACON    204
-#define WNI_CFG_WOWLAN_MAX_SLEEP_PERIOD    205
-#define WNI_CFG_BA_TIMEOUT    206
-#define WNI_CFG_BA_THRESHOLD_HIGH    207
-#define WNI_CFG_MAX_BA_BUFFERS    208
-#define WNI_CFG_MAX_BA_SESSIONS    209
-#define WNI_CFG_BA_AUTO_SETUP    210
-#define WNI_CFG_ADDBA_REQ_DECLINE    211
-#define WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC    212
-#define WNI_CFG_BG_SCAN_CHANNEL_LIST    213
-#define WNI_CFG_MAX_MEDIUM_TIME    214
-#define WNI_CFG_MAX_MPDUS_IN_AMPDU    215
-#define WNI_CFG_IBSS_AUTO_BSSID    216
-#define WNI_CFG_PROBE_REQ_ADDNIE_FLAG    217
-#define WNI_CFG_PROBE_REQ_ADDNIE_DATA    218
-#define WNI_CFG_PROBE_RSP_ADDNIE_FLAG    219
-#define WNI_CFG_PROBE_RSP_ADDNIE_DATA1    220
-#define WNI_CFG_PROBE_RSP_ADDNIE_DATA2    221
-#define WNI_CFG_PROBE_RSP_ADDNIE_DATA3    222
-#define WNI_CFG_ASSOC_RSP_ADDNIE_FLAG    223
-#define WNI_CFG_ASSOC_RSP_ADDNIE_DATA    224
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_FLAG    225
-#define WNI_CFG_PROBE_REQ_ADDNP2PIE_DATA    226
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG    227
-#define WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA    228
-#define WNI_CFG_WPS_ENABLE    229
-#define WNI_CFG_WPS_STATE    230
-#define WNI_CFG_WPS_PROBE_REQ_FLAG    231
-#define WNI_CFG_WPS_VERSION    232
-#define WNI_CFG_WPS_REQUEST_TYPE    233
-#define WNI_CFG_WPS_CFG_METHOD    234
-#define WNI_CFG_WPS_UUID    235
-#define WNI_CFG_WPS_PRIMARY_DEVICE_CATEGORY    236
-#define WNI_CFG_WPS_PIMARY_DEVICE_OUI    237
-#define WNI_CFG_WPS_DEVICE_SUB_CATEGORY    238
-#define WNI_CFG_WPS_ASSOCIATION_STATE    239
-#define WNI_CFG_WPS_CONFIGURATION_ERROR    240
-#define WNI_CFG_WPS_DEVICE_PASSWORD_ID    241
-#define WNI_CFG_WPS_ASSOC_METHOD    242
-#define WNI_CFG_LOW_GAIN_OVERRIDE    243
-#define WNI_CFG_ENABLE_PHY_AGC_LISTEN_MODE    244
-#define WNI_CFG_RPE_POLLING_THRESHOLD    245
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG    246
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG    247
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG    248
-#define WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG    249
-#define WNI_CFG_NO_OF_ONCHIP_REORDER_SESSIONS    250
-#define WNI_CFG_SINGLE_TID_RC    251
-#define WNI_CFG_TX_PWR_CTRL_ENABLE    252
-#define WNI_CFG_MCAST_BCAST_FILTER_SETTING    253
-#define WNI_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK    254
-#define WNI_CFG_DYNAMIC_PS_POLL_VALUE    255
-#define WNI_CFG_PS_NULLDATA_AP_RESP_TIMEOUT    256
-#define WNI_CFG_TELE_BCN_WAKEUP_EN    257
-#define WNI_CFG_TELE_BCN_TRANS_LI    258
-#define WNI_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS    259
-#define WNI_CFG_TELE_BCN_MAX_LI    260
-#define WNI_CFG_TELE_BCN_MAX_LI_IDLE_BCNS    261
-#define WNI_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS    262
-#define WNI_CFG_INFRA_STA_KEEP_ALIVE_PERIOD    263
-#define WNI_CFG_ASSOC_STA_LIMIT    264
-#define WNI_CFG_SAP_CHANNEL_SELECT_START_CHANNEL    265
-#define WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL    266
-#define WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND    267
-#define WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD    268
-#define WNI_CFG_ENABLE_CLOSE_LOOP    269
-#define WNI_CFG_ENABLE_LTE_COEX    270
-#define WNI_CFG_AP_KEEP_ALIVE_TIMEOUT    271
-#define WNI_CFG_GO_KEEP_ALIVE_TIMEOUT    272
-#define WNI_CFG_ENABLE_MC_ADDR_LIST    273
-#define WNI_CFG_ENABLE_UC_FILTER    274
-#define WNI_CFG_ENABLE_LPWR_IMG_TRANSITION    275
-#define WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED    276
-#define WNI_CFG_DISABLE_LDPC_WITH_TXBF_AP    277
-#define WNI_CFG_AP_LINK_MONITOR_TIMEOUT    278
-#define WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK    279
-#define WNI_CFG_TDLS_BUF_STA_ENABLED    280
-#define WNI_CFG_TDLS_PUAPSD_INACT_TIME    281
-#define WNI_CFG_TDLS_RX_FRAME_THRESHOLD    282
-#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES    283
-#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL    284
-#define WNI_CFG_ENABLE_ADAPT_RX_DRAIN    285
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR    286
-#define WNI_CFG_ANTENNA_DIVESITY    287
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT    288
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY    289
-#define WNI_CFG_CURRENT_RSSI    290
-#define WNI_CFG_RTT3_ENABLE    291
-#define WNI_CFG_DEBUG_P2P_REMAIN_ON_CHANNEL    292
-#define WNI_CFG_TDLS_OFF_CHANNEL_ENABLED    293
-#define WNI_CFG_IBSS_ATIM_WIN_SIZE    294
-#define WNI_CFG_DFS_MASTER_ENABLED    295
-#define WNI_CFG_VHT_ENABLE_TXBF_20MHZ    296
-#define WNI_CFG_TDLS_WMM_MODE_ENABLED    297
-#define WNI_CFG_TGT_GTX_USR_CFG    298
-#define WNI_CFG_ASSOC_STA_LIMIT_GO    299
-#define WNI_CFG_ASSOC_STA_LIMIT_AP    300
-
+enum {
+	WNI_CFG_STA_ID,
+	WNI_CFG_CFP_PERIOD,
+	WNI_CFG_CFP_MAX_DURATION,
+	WNI_CFG_SSID,
+	WNI_CFG_BEACON_INTERVAL,
+	WNI_CFG_DTIM_PERIOD,
+	WNI_CFG_WEP_KEY_LENGTH,
+	WNI_CFG_WEP_DEFAULT_KEY_1,
+	WNI_CFG_WEP_DEFAULT_KEY_2,
+	WNI_CFG_WEP_DEFAULT_KEY_3,
+	WNI_CFG_WEP_DEFAULT_KEY_4,
+	WNI_CFG_WEP_DEFAULT_KEYID,
+	WNI_CFG_EXCLUDE_UNENCRYPTED,
+	WNI_CFG_RTS_THRESHOLD,
+	WNI_CFG_SHORT_RETRY_LIMIT,
+	WNI_CFG_LONG_RETRY_LIMIT,
+	WNI_CFG_FRAGMENTATION_THRESHOLD,
+	WNI_CFG_ACTIVE_MINIMUM_CHANNEL_TIME,
+	WNI_CFG_ACTIVE_MAXIMUM_CHANNEL_TIME,
+	WNI_CFG_PASSIVE_MINIMUM_CHANNEL_TIME,
+	WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME,
+	WNI_CFG_JOIN_FAILURE_TIMEOUT,
+	WNI_CFG_AUTHENTICATE_FAILURE_TIMEOUT,
+	WNI_CFG_AUTHENTICATE_RSP_TIMEOUT,
+	WNI_CFG_ASSOCIATION_FAILURE_TIMEOUT,
+	WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT,
+	WNI_CFG_RA_PERIODICITY_TIMEOUT_IN_PS,
+	WNI_CFG_PS_ENABLE_BCN_FILTER,
+	WNI_CFG_PS_ENABLE_HEART_BEAT,
+	WNI_CFG_PS_ENABLE_RSSI_MONITOR,
+	WNI_CFG_PS_DATA_INACTIVITY_TIMEOUT,
+	WNI_CFG_RF_SETTLING_TIME_CLK,
+	WNI_CFG_SUPPORTED_RATES_11B,
+	WNI_CFG_SUPPORTED_RATES_11A,
+	WNI_CFG_PHY_MODE,
+	WNI_CFG_DOT11_MODE,
+	WNI_CFG_OPERATIONAL_RATE_SET,
+	WNI_CFG_EXTENDED_OPERATIONAL_RATE_SET,
+	WNI_CFG_PROPRIETARY_OPERATIONAL_RATE_SET,
+	WNI_CFG_LISTEN_INTERVAL,
+	WNI_CFG_VALID_CHANNEL_LIST,
+	WNI_CFG_CURRENT_CHANNEL,
+	WNI_CFG_DEFAULT_RATE_INDEX_5GHZ,
+	WNI_CFG_DEFAULT_RATE_INDEX_24GHZ,
+	WNI_CFG_RATE_ADAPTATION_TYPE,
+	WNI_CFG_FIXED_RATE,
+	WNI_CFG_FIXED_RATE_MULTICAST_24GHZ,
+	WNI_CFG_FIXED_RATE_MULTICAST_5GHZ,
+	WNI_CFG_RETRYRATE_POLICY,
+	WNI_CFG_RETRYRATE_SECONDARY,
+	WNI_CFG_RETRYRATE_TERTIARY,
+	WNI_CFG_APSD_ENABLED,
+	WNI_CFG_SHARED_KEY_AUTH_ENABLE,
+	WNI_CFG_OPEN_SYSTEM_AUTH_ENABLE,
+	WNI_CFG_AUTHENTICATION_TYPE,
+	WNI_CFG_PRIVACY_ENABLED,
+	WNI_CFG_SHORT_PREAMBLE,
+	WNI_CFG_SHORT_SLOT_TIME,
+	WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY,
+	WNI_CFG_QOS_ENABLED,
+	WNI_CFG_HCF_ENABLED,
+	WNI_CFG_RSN_ENABLED,
+	WNI_CFG_BACKGROUND_SCAN_PERIOD,
+	WNI_CFG_MAX_NUM_PRE_AUTH,
+	WNI_CFG_HEART_BEAT_THRESHOLD,
+	WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT,
+	WNI_CFG_MANUFACTURER_OUI,
+	WNI_CFG_MANUFACTURER_NAME,
+	WNI_CFG_MODEL_NUMBER,
+	WNI_CFG_MODEL_NAME,
+	WNI_CFG_MANUFACTURER_PRODUCT_NAME,
+	WNI_CFG_MANUFACTURER_PRODUCT_VERSION,
+	WNI_CFG_11D_ENABLED,
+	WNI_CFG_MAX_TX_POWER_2_4,
+	WNI_CFG_MAX_TX_POWER_5,
+	WNI_CFG_NETWORK_DENSITY,
+	WNI_CFG_ADAPTIVE_THRESHOLD_ALGORITHM,
+	WNI_CFG_CURRENT_TX_ANTENNA,
+	WNI_CFG_CURRENT_RX_ANTENNA,
+	WNI_CFG_CURRENT_TX_POWER_LEVEL,
+	WNI_CFG_NEW_BSS_FOUND_IND,
+	WNI_CFG_PROPRIETARY_RATES_ENABLED,
+	WNI_CFG_COUNTRY_CODE,
+	WNI_CFG_11H_ENABLED,
+	WNI_CFG_WT_CNF_TIMEOUT,
+	WNI_CFG_KEEPALIVE_TIMEOUT,
+	WNI_CFG_PROXIMITY,
+	WNI_CFG_LOG_LEVEL,
+	WNI_CFG_OLBC_DETECT_TIMEOUT,
+	WNI_CFG_PROTECTION_ENABLED,
+	WNI_CFG_11G_PROTECTION_ALWAYS,
+	WNI_CFG_FORCE_POLICY_PROTECTION,
+	WNI_CFG_11G_SHORT_PREAMBLE_ENABLED,
+	WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED,
+	WNI_CFG_11G_ONLY_POLICY,
+	WNI_CFG_PACKET_CLASSIFICATION,
+	WNI_CFG_WME_ENABLED,
+	WNI_CFG_ADDTS_RSP_TIMEOUT,
+	WNI_CFG_MAX_SP_LENGTH,
+	WNI_CFG_SEND_SINGLE_SSID_ALWAYS,
+	WNI_CFG_WSM_ENABLED,
+	WNI_CFG_EDCA_PROFILE,
+	WNI_CFG_EDCA_ANI_ACBK_LOCAL,
+	WNI_CFG_EDCA_ANI_ACBE_LOCAL,
+	WNI_CFG_EDCA_ANI_ACVI_LOCAL,
+	WNI_CFG_EDCA_ANI_ACVO_LOCAL,
+	WNI_CFG_EDCA_ANI_ACBK,
+	WNI_CFG_EDCA_ANI_ACBE,
+	WNI_CFG_EDCA_ANI_ACVI,
+	WNI_CFG_EDCA_ANI_ACVO,
+	WNI_CFG_EDCA_WME_ACBK_LOCAL,
+	WNI_CFG_EDCA_WME_ACBE_LOCAL,
+	WNI_CFG_EDCA_WME_ACVI_LOCAL,
+	WNI_CFG_EDCA_WME_ACVO_LOCAL,
+	WNI_CFG_EDCA_WME_ACBK,
+	WNI_CFG_EDCA_WME_ACBE,
+	WNI_CFG_EDCA_WME_ACVI,
+	WNI_CFG_EDCA_WME_ACVO,
+	WNI_CFG_RDET_FLAG,
+	WNI_CFG_RADAR_CHANNEL_LIST,
+	WNI_CFG_LOCAL_POWER_CONSTRAINT,
+	WNI_CFG_ADMIT_POLICY,
+	WNI_CFG_ADMIT_BWFACTOR,
+	WNI_CFG_MAX_CONSECUTIVE_BACKGROUND_SCAN_FAILURE,
+	WNI_CFG_CHANNEL_BONDING_MODE,
+	WNI_CFG_CB_SECONDARY_CHANNEL_STATE,
+	WNI_CFG_DYNAMIC_THRESHOLD_ZERO,
+	WNI_CFG_DYNAMIC_THRESHOLD_ONE,
+	WNI_CFG_DYNAMIC_THRESHOLD_TWO,
+	WNI_CFG_TRIG_STA_BK_SCAN,
+	WNI_CFG_DYNAMIC_PROFILE_SWITCHING,
+	WNI_CFG_SCAN_CONTROL_LIST,
+	WNI_CFG_MIMO_ENABLED,
+	WNI_CFG_BLOCK_ACK_ENABLED,
+	WNI_CFG_BA_ACTIVITY_CHECK_TIMEOUT,
+	WNI_CFG_HT_RX_STBC,
+	WNI_CFG_HT_CAP_INFO,
+	WNI_CFG_HT_AMPDU_PARAMS,
+	WNI_CFG_SUPPORTED_MCS_SET,
+	WNI_CFG_EXT_HT_CAP_INFO,
+	WNI_CFG_TX_BF_CAP,
+	WNI_CFG_AS_CAP,
+	WNI_CFG_HT_INFO_FIELD1,
+	WNI_CFG_HT_INFO_FIELD2,
+	WNI_CFG_HT_INFO_FIELD3,
+	WNI_CFG_BASIC_MCS_SET,
+	WNI_CFG_CURRENT_MCS_SET,
+	WNI_CFG_GREENFIELD_CAPABILITY,
+	WNI_CFG_VHT_MAX_MPDU_LENGTH,
+	WNI_CFG_VHT_SUPPORTED_CHAN_WIDTH_SET,
+	WNI_CFG_VHT_LDPC_CODING_CAP,
+	WNI_CFG_VHT_SHORT_GI_80MHZ,
+	WNI_CFG_VHT_SHORT_GI_160_AND_80_PLUS_80MHZ,
+	WNI_CFG_VHT_TXSTBC,
+	WNI_CFG_VHT_RXSTBC,
+	WNI_CFG_VHT_SU_BEAMFORMER_CAP,
+	WNI_CFG_VHT_SU_BEAMFORMEE_CAP,
+	WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED,
+	WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS,
+	WNI_CFG_VHT_MU_BEAMFORMER_CAP,
+	WNI_CFG_VHT_MU_BEAMFORMEE_CAP,
+	WNI_CFG_VHT_TXOP_PS,
+	WNI_CFG_VHT_HTC_VHTC_CAP,
+	WNI_CFG_VHT_AMPDU_LEN_EXPONENT,
+	WNI_CFG_VHT_LINK_ADAPTATION_CAP,
+	WNI_CFG_VHT_RX_ANT_PATTERN,
+	WNI_CFG_VHT_TX_ANT_PATTERN,
+	WNI_CFG_VHT_RX_MCS_MAP,
+	WNI_CFG_VHT_TX_MCS_MAP,
+	WNI_CFG_VHT_RX_HIGHEST_SUPPORTED_DATA_RATE,
+	WNI_CFG_VHT_TX_HIGHEST_SUPPORTED_DATA_RATE,
+	WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT1,
+	WNI_CFG_VHT_CHANNEL_CENTER_FREQ_SEGMENT2,
+	WNI_CFG_VHT_BASIC_MCS_SET,
+	WNI_CFG_VHT_MU_MIMO_CAP_STA_COUNT,
+	WNI_CFG_VHT_SS_UNDER_UTIL,
+	WNI_CFG_VHT_40MHZ_UTILIZATION,
+	WNI_CFG_VHT_80MHZ_UTILIZATION,
+	WNI_CFG_VHT_160MHZ_UTILIZATION,
+	WNI_CFG_MAX_AMSDU_LENGTH,
+	WNI_CFG_MPDU_DENSITY,
+	WNI_CFG_NUM_BUFF_ADVERT,
+	WNI_CFG_MAX_RX_AMPDU_FACTOR,
+	WNI_CFG_SHORT_GI_20MHZ,
+	WNI_CFG_SHORT_GI_40MHZ,
+	WNI_CFG_RIFS_ENABLED,
+	WNI_CFG_MAX_PS_POLL,
+	WNI_CFG_NUM_BEACON_PER_RSSI_AVERAGE,
+	WNI_CFG_RSSI_FILTER_PERIOD,
+	WNI_CFG_MIN_RSSI_THRESHOLD,
+	WNI_CFG_NTH_BEACON_FILTER,
+	WNI_CFG_BROADCAST_FRAME_FILTER_ENABLE,
+	WNI_CFG_SCAN_IN_POWERSAVE,
+	WNI_CFG_IGNORE_DTIM,
+	WNI_CFG_WOWLAN_UCAST_PATTERN_FILTER_ENABLE,
+	WNI_CFG_WOWLAN_CHANNEL_SWITCH_ENABLE,
+	WNI_CFG_WOWLAN_DEAUTH_ENABLE,
+	WNI_CFG_WOWLAN_DISASSOC_ENABLE,
+	WNI_CFG_WOWLAN_MAX_MISSED_BEACON,
+	WNI_CFG_WOWLAN_MAX_SLEEP_PERIOD,
+	WNI_CFG_BA_TIMEOUT,
+	WNI_CFG_BA_THRESHOLD_HIGH,
+	WNI_CFG_MAX_BA_BUFFERS,
+	WNI_CFG_MAX_BA_SESSIONS,
+	WNI_CFG_BA_AUTO_SETUP,
+	WNI_CFG_ADDBA_REQ_DECLINE,
+	WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC,
+	WNI_CFG_BG_SCAN_CHANNEL_LIST,
+	WNI_CFG_MAX_MEDIUM_TIME,
+	WNI_CFG_MAX_MPDUS_IN_AMPDU,
+	WNI_CFG_IBSS_AUTO_BSSID,
+	WNI_CFG_PROBE_REQ_ADDNIE_FLAG,
+	WNI_CFG_PROBE_REQ_ADDNIE_DATA,
+	WNI_CFG_PROBE_RSP_ADDNIE_FLAG,
+	WNI_CFG_PROBE_RSP_ADDNIE_DATA1,
+	WNI_CFG_PROBE_RSP_ADDNIE_DATA2,
+	WNI_CFG_PROBE_RSP_ADDNIE_DATA3,
+	WNI_CFG_ASSOC_RSP_ADDNIE_FLAG,
+	WNI_CFG_ASSOC_RSP_ADDNIE_DATA,
+	WNI_CFG_PROBE_REQ_ADDNP2PIE_FLAG,
+	WNI_CFG_PROBE_REQ_ADDNP2PIE_DATA,
+	WNI_CFG_PROBE_RSP_BCN_ADDNIE_FLAG,
+	WNI_CFG_PROBE_RSP_BCN_ADDNIE_DATA,
+	WNI_CFG_WPS_ENABLE,
+	WNI_CFG_WPS_STATE,
+	WNI_CFG_WPS_PROBE_REQ_FLAG,
+	WNI_CFG_WPS_VERSION,
+	WNI_CFG_WPS_REQUEST_TYPE,
+	WNI_CFG_WPS_CFG_METHOD,
+	WNI_CFG_WPS_UUID,
+	WNI_CFG_WPS_PRIMARY_DEVICE_CATEGORY,
+	WNI_CFG_WPS_PIMARY_DEVICE_OUI,
+	WNI_CFG_WPS_DEVICE_SUB_CATEGORY,
+	WNI_CFG_WPS_ASSOCIATION_STATE,
+	WNI_CFG_WPS_CONFIGURATION_ERROR,
+	WNI_CFG_WPS_DEVICE_PASSWORD_ID,
+	WNI_CFG_WPS_ASSOC_METHOD,
+	WNI_CFG_LOW_GAIN_OVERRIDE,
+	WNI_CFG_ENABLE_PHY_AGC_LISTEN_MODE,
+	WNI_CFG_RPE_POLLING_THRESHOLD,
+	WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG,
+	WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG,
+	WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG,
+	WNI_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG,
+	WNI_CFG_NO_OF_ONCHIP_REORDER_SESSIONS,
+	WNI_CFG_SINGLE_TID_RC,
+	WNI_CFG_TX_PWR_CTRL_ENABLE,
+	WNI_CFG_MCAST_BCAST_FILTER_SETTING,
+	WNI_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK,
+	WNI_CFG_DYNAMIC_PS_POLL_VALUE,
+	WNI_CFG_PS_NULLDATA_AP_RESP_TIMEOUT,
+	WNI_CFG_TELE_BCN_WAKEUP_EN,
+	WNI_CFG_TELE_BCN_TRANS_LI,
+	WNI_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS,
+	WNI_CFG_TELE_BCN_MAX_LI,
+	WNI_CFG_TELE_BCN_MAX_LI_IDLE_BCNS,
+	WNI_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS,
+	WNI_CFG_INFRA_STA_KEEP_ALIVE_PERIOD,
+	WNI_CFG_ASSOC_STA_LIMIT,
+	WNI_CFG_SAP_CHANNEL_SELECT_START_CHANNEL,
+	WNI_CFG_SAP_CHANNEL_SELECT_END_CHANNEL,
+	WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND,
+	WNI_CFG_AP_DATA_AVAIL_POLL_PERIOD,
+	WNI_CFG_ENABLE_CLOSE_LOOP,
+	WNI_CFG_ENABLE_LTE_COEX,
+	WNI_CFG_AP_KEEP_ALIVE_TIMEOUT,
+	WNI_CFG_GO_KEEP_ALIVE_TIMEOUT,
+	WNI_CFG_ENABLE_MC_ADDR_LIST,
+	WNI_CFG_ENABLE_UC_FILTER,
+	WNI_CFG_ENABLE_LPWR_IMG_TRANSITION,
+	WNI_CFG_ENABLE_MCC_ADAPTIVE_SCHED,
+	WNI_CFG_DISABLE_LDPC_WITH_TXBF_AP,
+	WNI_CFG_AP_LINK_MONITOR_TIMEOUT,
+	WNI_CFG_TDLS_QOS_WMM_UAPSD_MASK,
+	WNI_CFG_TDLS_BUF_STA_ENABLED,
+	WNI_CFG_TDLS_PUAPSD_INACT_TIME,
+	WNI_CFG_TDLS_RX_FRAME_THRESHOLD,
+	WNI_CFG_PMF_SA_QUERY_MAX_RETRIES,
+	WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL,
+	WNI_CFG_ENABLE_ADAPT_RX_DRAIN,
+	WNI_CFG_FLEX_CONNECT_POWER_FACTOR,
+	WNI_CFG_ANTENNA_DIVESITY,
+	WNI_CFG_GO_LINK_MONITOR_TIMEOUT,
+	WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY,
+	WNI_CFG_CURRENT_RSSI,
+	WNI_CFG_RTT3_ENABLE,
+	WNI_CFG_DEBUG_P2P_REMAIN_ON_CHANNEL,
+	WNI_CFG_TDLS_OFF_CHANNEL_ENABLED,
+	WNI_CFG_IBSS_ATIM_WIN_SIZE,
+	WNI_CFG_DFS_MASTER_ENABLED,
+	WNI_CFG_VHT_ENABLE_TXBF_20MHZ,
+	WNI_CFG_TDLS_WMM_MODE_ENABLED,
+	WNI_CFG_TGT_GTX_USR_CFG,
+	WNI_CFG_ASSOC_STA_LIMIT_GO,
+	WNI_CFG_ASSOC_STA_LIMIT_AP,
+	WNI_CFG_MAX_HT_MCS_TX_DATA,
+	WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA,
+	WNI_CFG_RATE_FOR_TX_MGMT,
+	WNI_CFG_RATE_FOR_TX_MGMT_2G,
+	WNI_CFG_RATE_FOR_TX_MGMT_5G,
+	WNI_CFG_EDCA_ETSI_ACBK_LOCAL,
+	WNI_CFG_EDCA_ETSI_ACBE_LOCAL,
+	WNI_CFG_EDCA_ETSI_ACVI_LOCAL,
+	WNI_CFG_EDCA_ETSI_ACVO_LOCAL,
+	WNI_CFG_EDCA_ETSI_ACBK,
+	WNI_CFG_EDCA_ETSI_ACBE,
+	WNI_CFG_EDCA_ETSI_ACVI,
+	WNI_CFG_EDCA_ETSI_ACVO,
+	WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL,
+	WNI_CFG_EDCA_HOSTAPD_ACVI_LOCAL,
+	WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL,
+	WNI_CFG_EDCA_HOSTAPD_ACBE_LOCAL,
+
+	WNI_CFG_MAX,
+};
 /*
  * String parameter lengths
  */
@@ -364,6 +372,7 @@
 #define WNI_CFG_MANUFACTURER_PRODUCT_VERSION_LEN    32
 #define WNI_CFG_MAX_TX_POWER_2_4_LEN    128
 #define WNI_CFG_MAX_TX_POWER_5_LEN    128
+#define WNI_CFG_AP_NODE_NAME_LEN    32
 #define WNI_CFG_COUNTRY_CODE_LEN    3
 #define WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN    20
 #define WNI_CFG_EDCA_ANI_ACBE_LOCAL_LEN    20
@@ -381,6 +390,20 @@
 #define WNI_CFG_EDCA_WME_ACBE_LEN    20
 #define WNI_CFG_EDCA_WME_ACVI_LEN    20
 #define WNI_CFG_EDCA_WME_ACVO_LEN    20
+#define WNI_CFG_EDCA_ETSI_ACBK_LOCAL_LEN    20
+#define WNI_CFG_EDCA_ETSI_ACBE_LOCAL_LEN    20
+#define WNI_CFG_EDCA_ETSI_ACVI_LOCAL_LEN    20
+#define WNI_CFG_EDCA_ETSI_ACVO_LOCAL_LEN    20
+#define WNI_CFG_EDCA_ETSI_ACBK_LEN    20
+#define WNI_CFG_EDCA_ETSI_ACBE_LEN    20
+#define WNI_CFG_EDCA_ETSI_ACVI_LEN    20
+#define WNI_CFG_EDCA_ETSI_ACVO_LEN    20
+#define WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL_LEN    20
+#define WNI_CFG_EDCA_HOSTAPD_ACBE_LOCAL_LEN    20
+#define WNI_CFG_EDCA_HOSTAPD_ACVI_LOCAL_LEN    20
+#define WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL_LEN    20
+
+
 #define WNI_CFG_RADAR_CHANNEL_LIST_LEN    20
 #define WNI_CFG_SCAN_CONTROL_LIST_LEN    128
 #define WNI_CFG_SUPPORTED_MCS_SET_LEN    16
@@ -694,7 +717,7 @@
 
 #define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_STAMIN    10
 #define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_STAMAX    10000
-#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_STADEF    40
+#define WNI_CFG_PROBE_AFTER_HB_FAIL_TIMEOUT_STADEF    70
 
 #define WNI_CFG_11D_ENABLED_STAMIN    0
 #define WNI_CFG_11D_ENABLED_STAMAX    1
@@ -847,7 +870,8 @@
 #define WNI_CFG_EDCA_PROFILE_ANI    0
 #define WNI_CFG_EDCA_PROFILE_WMM    1
 #define WNI_CFG_EDCA_PROFILE_TIT_DEMO    2
-#define WNI_CFG_EDCA_PROFILE_MAX    3
+#define WNI_CFG_EDCA_PROFILE_ETSI_EUROPE   3
+#define WNI_CFG_EDCA_PROFILE_MAX    4
 #define WNI_CFG_EDCA_PROFILE_ACM_IDX    0
 #define WNI_CFG_EDCA_PROFILE_AIFSN_IDX    1
 #define WNI_CFG_EDCA_PROFILE_CWMINA_IDX    2
@@ -1099,7 +1123,7 @@
 
 #define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_STAMIN    0
 #define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_STAMAX    1
-#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_STADEF    0
+#define WNI_CFG_VHT_MU_BEAMFORMEE_CAP_STADEF    1
 
 #define WNI_CFG_VHT_TXOP_PS_STAMIN    0
 #define WNI_CFG_VHT_TXOP_PS_STAMAX    1
@@ -1619,10 +1643,28 @@
 #define WNI_CFG_ASSOC_STA_LIMIT_GO_STAMAX    32
 #define WNI_CFG_ASSOC_STA_LIMIT_GO_STADEF    10
 
-#define CFG_PARAM_MAX_NUM        301
-#define CFG_STA_IBUF_MAX_SIZE    244
-#define CFG_STA_SBUF_MAX_SIZE    3199
-#define CFG_SEM_MAX_NUM          19
+#define WNI_CFG_MAX_HT_MCS_TX_DATA_STAMIN  0x0
+#define WNI_CFG_MAX_HT_MCS_TX_DATA_STAMAX  0x17f
+#define WNI_CFG_MAX_HT_MCS_TX_DATA_STADEF  0x0
+
+#define WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STAMIN  0
+#define WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STAMAX  1
+#define WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STADEF  0
+
+#define WNI_CFG_RATE_FOR_TX_MGMT_STAMIN   0x0
+#define WNI_CFG_RATE_FOR_TX_MGMT_STAMAX   0xFF
+#define WNI_CFG_RATE_FOR_TX_MGMT_STADEF   0xFF
+
+#define WNI_CFG_RATE_FOR_TX_MGMT_2G_STAMIN   0x0
+#define WNI_CFG_RATE_FOR_TX_MGMT_2G_STAMAX   0xFF
+#define WNI_CFG_RATE_FOR_TX_MGMT_2G_STADEF   0xFF
+
+#define WNI_CFG_RATE_FOR_TX_MGMT_5G_STAMIN   0x0
+#define WNI_CFG_RATE_FOR_TX_MGMT_5G_STAMAX   0xFF
+#define WNI_CFG_RATE_FOR_TX_MGMT_5G_STADEF   0xFF
+
+#define CFG_STA_IBUF_MAX_SIZE    249
+#define CFG_STA_SBUF_MAX_SIZE    3465
 
 #define CFG_STA_MAGIC_DWORD    0xbeefbeef
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgApi.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgApi.c
index f5760c33244..84ee3ac3a1f 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -44,7 +44,7 @@
 //---------------------------------------------------------------------
 // Static Variables
 //----------------------------------------------------------------------
-static tCfgCtl   __gCfgEntry[CFG_PARAM_MAX_NUM]                ;
+static tCfgCtl   __gCfgEntry[WNI_CFG_MAX]                ;
 static tANI_U32  __gCfgIBufMin[CFG_STA_IBUF_MAX_SIZE]          ;
 static tANI_U32  __gCfgIBufMax[CFG_STA_IBUF_MAX_SIZE]          ;
 static tANI_U32  __gCfgIBuf[CFG_STA_IBUF_MAX_SIZE]             ;
@@ -141,7 +141,10 @@ tSirRetStatus cfgInit(tpAniSirGlobal pMac)
     pMac->cfg.gSBuffer     = __gSBuffer;
     pMac->cfg.gCfgEntry    = __gCfgEntry;
 
-    for (i = 0; i < CFG_PARAM_MAX_NUM; i++) {
+    pMac->cfg.gCfgMaxIBufSize = CFG_STA_IBUF_MAX_SIZE;
+    pMac->cfg.gCfgMaxSBufSize = CFG_STA_SBUF_MAX_SIZE;
+
+    for (i = 0; i < WNI_CFG_MAX; i++) {
         if (!(cfg_static[i].control & CFG_CTL_INT))
             cfg_get_str_index(pMac, i);
         else
@@ -196,7 +199,7 @@ cfgSetInt(tpAniSirGlobal pMac, tANI_U16 cfgId, tANI_U32 value)
     tANI_U32      control, mask;
     tSirRetStatus  retVal;
 
-    if (cfgId >= CFG_PARAM_MAX_NUM)
+    if (cfgId >= WNI_CFG_MAX)
     {
         PELOGE(cfgLog(pMac, LOGE, FL("Invalid cfg id %d"), cfgId);)
         return eSIR_CFG_INVALID_ID;
@@ -276,7 +279,7 @@ cfgCheckValid(tpAniSirGlobal pMac, tANI_U16 cfgId)
 {
     tANI_U32      control;
 
-    if (cfgId >= CFG_PARAM_MAX_NUM)
+    if (cfgId >= WNI_CFG_MAX)
     {
         PELOG3(cfgLog(pMac, LOG3, FL("Invalid cfg id %d"), cfgId);)
         return(eSIR_CFG_INVALID_ID);
@@ -327,7 +330,7 @@ wlan_cfgGetInt(tpAniSirGlobal pMac, tANI_U16 cfgId, tANI_U32 *pValue)
     tANI_U32      control;
     tSirRetStatus  retVal;
 
-    if (cfgId >= CFG_PARAM_MAX_NUM)
+    if (cfgId >= WNI_CFG_MAX)
     {
         PELOGE(cfgLog(pMac, LOGE, FL("Invalid cfg id %d"), cfgId);)
         retVal = eSIR_CFG_INVALID_ID;
@@ -437,7 +440,7 @@ cfgSetStrNotify(tpAniSirGlobal pMac, tANI_U16 cfgId, tANI_U8 *pStr,
     tANI_U32      index, paramLen, control, mask;
     tSirRetStatus  retVal;
 
-    if (cfgId >= CFG_PARAM_MAX_NUM)
+    if (cfgId >= WNI_CFG_MAX)
     {
         PELOGE(cfgLog(pMac, LOGE, FL("Invalid cfg id %d"), cfgId);)
         return eSIR_CFG_INVALID_ID;
@@ -539,7 +542,7 @@ wlan_cfgGetStr(tpAniSirGlobal pMac, tANI_U16 cfgId, tANI_U8 *pBuf, tANI_U32 *pLe
     tANI_U32            index, control;
     tSirRetStatus  retVal;
 
-    if (cfgId >= CFG_PARAM_MAX_NUM)
+    if (cfgId >= WNI_CFG_MAX)
     {
         PELOGE(cfgLog(pMac, LOGE, FL("Invalid cfg id %d"), cfgId);)
         retVal = eSIR_CFG_INVALID_ID;
@@ -621,7 +624,7 @@ wlan_cfgGetStrMaxLen(tpAniSirGlobal pMac, tANI_U16 cfgId, tANI_U32 *pLength)
     tANI_U32            index, control;
     tSirRetStatus  retVal;
 
-    if (cfgId >= CFG_PARAM_MAX_NUM)
+    if (cfgId >= WNI_CFG_MAX)
     {
         PELOGE(cfgLog(pMac, LOGE, FL("Invalid cfg id %d"), cfgId);)
         retVal = eSIR_CFG_INVALID_ID;
@@ -687,7 +690,7 @@ wlan_cfgGetStrLen(tpAniSirGlobal pMac, tANI_U16 cfgId, tANI_U32 *pLength)
     tANI_U32            index, control;
     tSirRetStatus  retVal;
 
-    if (cfgId >= CFG_PARAM_MAX_NUM)
+    if (cfgId >= WNI_CFG_MAX)
     {
         PELOGE(cfgLog(pMac, LOGE, FL("Invalid cfg id %d"), cfgId);)
         retVal = eSIR_CFG_INVALID_ID;
@@ -1079,8 +1082,6 @@ Notify(tpAniSirGlobal pMac, tANI_U16 cfgId, tANI_U32 ntfMask)
     mmhMsg.bodyval = (tANI_U32)cfgId;
     mmhMsg.bodyptr = NULL;
 
-    MTRACE(macTraceMsgTx(pMac, NO_SESSION, mmhMsg.type));
-
     if ((ntfMask & CFG_CTL_NTF_SCH) != 0)
         schPostMessage(pMac, &mmhMsg);
 
@@ -1131,8 +1132,9 @@ uint8_t* cfg_get_vendor_ie_ptr_from_oui(tpAniSirGlobal mac_ctx,
 			return NULL;
 		}
 		if (SIR_MAC_EID_VENDOR == elem_id) {
-			if(memcmp(&ptr[2], oui, oui_size)==0)
-			return ptr;
+			if((elem_len>=oui_size) &&
+				(memcmp(&ptr[2], oui, oui_size)==0))
+				return ptr;
 		}
 
 		left -= elem_len;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgDef.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgDef.h
index 0be77c6e9f6..57e9c883dbd 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgDef.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgDef.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2012 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2012,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -68,8 +68,6 @@
 #define CFG_CTL_NTF_HW        (CFG_CTL_NTF_MAC | CFG_CTL_NTF_PHY)
 
 #define CFG_BUF_INDX_MASK     0x00000fff
-#define CFG_SEM_INDX_MASK     0x0000f000
-#define CFG_SEM_INDX_SHIFT    12
 
 
 #endif /* __CFGDEF_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgParamName.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgParamName.c
index fc2ebae7634..612679f2e98 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgParamName.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgParamName.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -333,5 +333,20 @@ unsigned char *gCfgParamName[] = {
     (unsigned char *)"DFS_MASTER_ENABLED",
     (unsigned char *)"VHT_ENABLE_TXBF_20MHZ",
     (unsigned char *)"TDLS_WMM_MODE_ENABLED",
+    (unsigned char *)"TGT_GTX_USR_CFG",
+    (unsigned char *)"ASSOC_STA_LIMIT_GO",
+    (unsigned char *)"ASSOC_STA_LIMIT_AP",
+    (unsigned char *)"MAX_HT_MCS_TX_DATA",
+    (unsigned char *)"DISABLE_ABG_RATE_TX_DATA",
+    (unsigned char *)"RATE_FOR_TX_MGMT",
+    (unsigned char *)"RATE_FOR_TX_MGMT_2G",
+    (unsigned char *)"RATE_FOR_TX_MGMT_5G",
+    (unsigned char *)"EDCA_ETSI_ACBK_LOCAL",
+    (unsigned char *)"EDCA_ETSI_ACBE_LOCAL",
+    (unsigned char *)"EDCA_ETSI_ACVI_LOCAL",
+    (unsigned char *)"EDCA_ETSI_ACVO_LOCAL",
+    (unsigned char *)"EDCA_ETSI_ACBK",
+    (unsigned char *)"EDCA_ETSI_ACBE",
+    (unsigned char *)"EDCA_ETSI_ACVI",
+    (unsigned char *)"EDCA_ETSI_ACVO",
 };
-
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgPriv.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgPriv.h
index 7ab0fec8006..b52244892cd 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgPriv.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgPriv.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -48,8 +48,7 @@
 #include <schApi.h>
 #include <cfgApi.h>
 #include "cfgDef.h"
-
-    #include <wniCfgSta.h>
+#include <wni_cfg.h>
 
 /*--------------------------------------------------------------------*/
 /* CFG miscellaneous definition                                       */
@@ -87,6 +86,6 @@ extern void cfgSendHostMsg(tpAniSirGlobal, tANI_U16, tANI_U32, tANI_U32, tANI_U3
 
 extern struct cfgstatic_string cfg_static_string[CFG_MAX_STATIC_STRING];
 
-extern struct cgstatic cfg_static[CFG_PARAM_MAX_NUM];
+extern struct cgstatic cfg_static[WNI_CFG_MAX];
 
 #endif /* __CFGPRIV_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgProcMsg.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgProcMsg.c
index 943ba48cab5..56f57111abb 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgProcMsg.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgProcMsg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -41,16 +41,12 @@
 #include "cfgDebug.h"
 #include "wlan_qct_wda.h"
 
-struct cgstatic cfg_static[CFG_PARAM_MAX_NUM] = {
+struct cgstatic cfg_static[WNI_CFG_MAX] = {
 	{WNI_CFG_STA_ID,
 	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RELOAD |
 	 CFG_CTL_NTF_HAL,
 	 0, 255, 1},
 
-	{WNI_CFG_CF_POLLABLE,
-	 CFG_CTL_RE | CFG_CTL_INT | CFG_CTL_RESTART,
-	 0, 255, 1},
-
 	{WNI_CFG_CFP_PERIOD,
 	 CFG_CTL_VALID  | CFG_CTL_RE | CFG_CTL_INT,
 	 WNI_CFG_CFP_PERIOD_STAMIN,
@@ -380,10 +376,6 @@ struct cgstatic cfg_static[CFG_PARAM_MAX_NUM] = {
 	 WNI_CFG_AUTHENTICATION_TYPE_STAMAX,
 	 WNI_CFG_AUTHENTICATION_TYPE_STADEF},
 
-	{WNI_CFG_CF_POLL_REQUEST,
-	 CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT | CFG_CTL_RESTART,
-	 0, 255, 1},
-
 	{WNI_CFG_PRIVACY_ENABLED,
 	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT |
 	 CFG_CTL_RESTART,
@@ -446,14 +438,6 @@ struct cgstatic cfg_static[CFG_PARAM_MAX_NUM] = {
 	 WNI_CFG_MAX_NUM_PRE_AUTH_STAMAX,
 	 WNI_CFG_MAX_NUM_PRE_AUTH_STADEF},
 
-	{WNI_CFG_PREAUTH_CLNUP_TIMEOUT,
-	 CFG_CTL_INT,
-	 0, 255, 1},
-
-	{WNI_CFG_RELEASE_AID_TIMEOUT,
-	 CFG_CTL_INT,
-	 0, 255, 1},
-
 	{WNI_CFG_HEART_BEAT_THRESHOLD,
 	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT |
 	 CFG_CTL_NTF_LIM,
@@ -553,12 +537,8 @@ struct cgstatic cfg_static[CFG_PARAM_MAX_NUM] = {
 	 WNI_CFG_PROPRIETARY_RATES_ENABLED_STAMAX,
 	 WNI_CFG_PROPRIETARY_RATES_ENABLED_STADEF},
 
-	{WNI_CFG_AP_NODE_NAME,
-	 CFG_CTL_RE,
-	 0, 255, 1},
-
 	{WNI_CFG_COUNTRY_CODE,
-	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_NTF_SCH,
 	 0, 0, 0},
 
 	{WNI_CFG_11H_ENABLED,
@@ -666,10 +646,6 @@ struct cgstatic cfg_static[CFG_PARAM_MAX_NUM] = {
 	 WNI_CFG_MAX_SP_LENGTH_STAMAX,
 	 WNI_CFG_MAX_SP_LENGTH_STADEF},
 
-	{WNI_CFG_KEEP_ALIVE_STA_LIMIT_THRESHOLD,
-	 CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT,
-	 0, 255, 1},
-
 	{WNI_CFG_SEND_SINGLE_SSID_ALWAYS,
 	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT,
 	 WNI_CFG_SEND_SINGLE_SSID_ALWAYS_STAMIN,
@@ -1907,6 +1883,13 @@ struct cgstatic cfg_static[CFG_PARAM_MAX_NUM] = {
 	 WNI_CFG_TGT_GTX_USR_CFG_STAMAX,
 	 WNI_CFG_TGT_GTX_USR_CFG_STADEF},
 
+	{WNI_CFG_ASSOC_STA_LIMIT_GO,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT |
+	 CFG_CTL_NTF_LIM,
+	 WNI_CFG_ASSOC_STA_LIMIT_GO_STAMIN,
+	 WNI_CFG_ASSOC_STA_LIMIT_GO_STAMAX,
+	 WNI_CFG_ASSOC_STA_LIMIT_GO_STADEF},
+
 	{WNI_CFG_ASSOC_STA_LIMIT_AP,
 	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT |
 	 CFG_CTL_NTF_LIM,
@@ -1914,12 +1897,83 @@ struct cgstatic cfg_static[CFG_PARAM_MAX_NUM] = {
 	 WNI_CFG_ASSOC_STA_LIMIT_AP_STAMAX,
 	 WNI_CFG_ASSOC_STA_LIMIT_AP_STADEF},
 
-	{WNI_CFG_ASSOC_STA_LIMIT_GO,
-	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT |
-	 CFG_CTL_NTF_LIM,
-	 WNI_CFG_ASSOC_STA_LIMIT_GO_STAMIN,
-	 WNI_CFG_ASSOC_STA_LIMIT_GO_STAMAX,
-	 WNI_CFG_ASSOC_STA_LIMIT_GO_STADEF}
+	{WNI_CFG_MAX_HT_MCS_TX_DATA,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT,
+	 WNI_CFG_MAX_HT_MCS_TX_DATA_STAMIN,
+	 WNI_CFG_MAX_HT_MCS_TX_DATA_STAMAX,
+	 WNI_CFG_MAX_HT_MCS_TX_DATA_STADEF},
+
+	{WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT,
+	 WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STAMIN,
+	 WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STAMAX,
+	 WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STADEF},
+
+	{WNI_CFG_RATE_FOR_TX_MGMT,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT,
+	 WNI_CFG_RATE_FOR_TX_MGMT_STAMIN,
+	 WNI_CFG_RATE_FOR_TX_MGMT_STAMAX,
+	 WNI_CFG_RATE_FOR_TX_MGMT_STADEF},
+
+	{WNI_CFG_RATE_FOR_TX_MGMT_2G,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT,
+	 WNI_CFG_RATE_FOR_TX_MGMT_2G_STAMIN,
+	 WNI_CFG_RATE_FOR_TX_MGMT_2G_STAMAX,
+	 WNI_CFG_RATE_FOR_TX_MGMT_2G_STADEF},
+
+	{WNI_CFG_RATE_FOR_TX_MGMT_5G,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_INT,
+	 WNI_CFG_RATE_FOR_TX_MGMT_5G_STAMIN,
+	 WNI_CFG_RATE_FOR_TX_MGMT_5G_STAMAX,
+	 WNI_CFG_RATE_FOR_TX_MGMT_5G_STADEF},
+
+	{WNI_CFG_EDCA_ETSI_ACBK_LOCAL,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_ETSI_ACBE_LOCAL,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_ETSI_ACVI_LOCAL,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_ETSI_ACVO_LOCAL,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_ETSI_ACBK,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_ETSI_ACBE,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_ETSI_ACVI,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_ETSI_ACVO,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_HOSTAPD_ACBE_LOCAL,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_HOSTAPD_ACVI_LOCAL,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
+
+	{WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL,
+	 CFG_CTL_VALID | CFG_CTL_RE | CFG_CTL_WE | CFG_CTL_RESTART,
+	 0, 0, 0},
 };
 
 struct cfgstatic_string cfg_static_string[CFG_MAX_STATIC_STRING] = {
@@ -2026,11 +2080,6 @@ struct cfgstatic_string cfg_static_string[CFG_MAX_STATIC_STRING] = {
 	 3,
 	 {0x24, 0x7e, 0x14}},
 
-	{WNI_CFG_AP_NODE_NAME,
-	 WNI_CFG_AP_NODE_NAME_LEN,
-	 0,
-	 {0}},
-
 	{WNI_CFG_COUNTRY_CODE,
 	 WNI_CFG_COUNTRY_CODE_LEN,
 	 0,
@@ -2132,6 +2181,78 @@ struct cfgstatic_string cfg_static_string[CFG_MAX_STATIC_STRING] = {
 	 {0x0, 0x2, 0x0, 0x3, 0x0, 0x7, 0x2f, 0x0, 0x3, 0x0, 0x7, 0x66, 0x0,
 	  0x3, 0x0, 0x7, 0x2f}},
 
+	{WNI_CFG_EDCA_ETSI_ACBK_LOCAL,
+	 WNI_CFG_EDCA_ETSI_ACBK_LOCAL_LEN,
+	 17,
+	 {0x0, 0x7, 0x0, 0xf, 0x3, 0xff, 0xbb, 0x0, 0x1f, 0x3, 0xff, 0x0, 0x0,
+	  0xf, 0x3, 0xff, 0x0}},
+
+	{WNI_CFG_EDCA_ETSI_ACBE_LOCAL,
+	 WNI_CFG_EDCA_ETSI_ACBE_LOCAL_LEN,
+	 17,
+	 {0x0, 0x3, 0x0, 0xf, 0x0, 0x3f, 0xbb, 0x0, 0x1f, 0x3, 0xff,0x0, 0x0,
+	  0xf, 0x0, 0x3f, 0x0}},
+
+	{WNI_CFG_EDCA_ETSI_ACVI_LOCAL,
+	 WNI_CFG_EDCA_ETSI_ACVI_LOCAL_LEN,
+	 17,
+	 {0x0, 0x1, 0x0, 0x7, 0x0, 0xf, 0x7d, 0x0, 0x7, 0x0, 0xf, 0xbc, 0x0,
+	  0x7, 0x0, 0xf, 0x5e}},
+
+	{WNI_CFG_EDCA_ETSI_ACVO_LOCAL,
+	 WNI_CFG_EDCA_ETSI_ACVO_LOCAL_LEN,
+	 17,
+	 {0x0, 0x1, 0x0, 0x3, 0x0, 0x7, 0x3e, 0x0, 0x3, 0x0, 0x7, 0x66, 0x0,
+	  0x3, 0x0, 0x7, 0x2f}},
+
+	{WNI_CFG_EDCA_ETSI_ACBK,
+	 WNI_CFG_EDCA_ETSI_ACBK_LEN,
+	 17,
+	 {0x0, 0x7, 0x0, 0xf, 0x3, 0xff, 0xbb, 0x0, 0xf, 0x3, 0xff, 0x0, 0x0,
+	  0xf, 0x3, 0xff, 0x0}},
+
+	{WNI_CFG_EDCA_ETSI_ACBE,
+	 WNI_CFG_EDCA_ETSI_ACBE_LEN,
+	 17,
+	 {0x0, 0x3, 0x0, 0xf, 0x3, 0xff, 0xbb, 0x0, 0xf, 0x3, 0xff, 0x0, 0x0,
+	  0xf, 0x3, 0xff, 0x0}},
+
+	{WNI_CFG_EDCA_ETSI_ACVI,
+	 WNI_CFG_EDCA_ETSI_ACVI_LEN,
+	 17,
+	 {0x0, 0x2, 0x0, 0x7, 0x0, 0xf, 0x7d, 0x0, 0x7, 0x0, 0xf, 0xbc, 0x0,
+	  0x7, 0x0, 0xf, 0x5e}},
+
+	{WNI_CFG_EDCA_ETSI_ACVO,
+	 WNI_CFG_EDCA_ETSI_ACVO_LEN,
+	 17,
+	 {0x0, 0x2, 0x0, 0x3, 0x0, 0x7, 0x3e, 0x0, 0x3, 0x0, 0x7, 0x66, 0x0,
+	  0x3, 0x0, 0x7, 0x2f}},
+
+	{WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL,
+	 WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL_LEN,
+	 18,
+	 {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	  0, 0, 0, 0, 0}},
+
+	{WNI_CFG_EDCA_HOSTAPD_ACVI_LOCAL,
+	 WNI_CFG_EDCA_HOSTAPD_ACVI_LOCAL_LEN,
+	 18,
+	 {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	  0, 0, 0, 0, 0}},
+
+	{WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL,
+	 WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL_LEN,
+	 18,
+	 {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	  0, 0, 0, 0, 0}},
+
+	{WNI_CFG_EDCA_HOSTAPD_ACBE_LOCAL,
+	 WNI_CFG_EDCA_HOSTAPD_ACBE_LOCAL_LEN,
+	 18,
+	 {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	  0, 0, 0, 0, 0}},
+
 	{WNI_CFG_RADAR_CHANNEL_LIST,
 	 WNI_CFG_RADAR_CHANNEL_LIST_LEN,
 	 15,
@@ -2352,7 +2473,7 @@ ProcDnldRsp(tpAniSirGlobal pMac, tANI_U16 length, tANI_U32 *pParam)
     PELOGW(cfgLog(pMac, LOGW, FL("CFG hdr totParams %d intParams %d strBufSize %d/%d"),
            pHdr->controlSize, pHdr->iBufSize, pHdr->sBufSize, pMac->cfg.gCfgMaxSBufSize);)
 
-    expLen = ((CFG_PARAM_MAX_NUM + 3 * pMac->cfg.gCfgMaxIBufSize) << 2) +
+    expLen = ((WNI_CFG_MAX + 3 * pMac->cfg.gCfgMaxIBufSize) << 2) +
              pHdr->sBufSize + sizeof(tCfgBinHdr);
 
     if (length != expLen)
@@ -2364,7 +2485,7 @@ ProcDnldRsp(tpAniSirGlobal pMac, tANI_U16 length, tANI_U32 *pParam)
     }
 
 
-    if (pHdr->controlSize != CFG_PARAM_MAX_NUM)
+    if (pHdr->controlSize != WNI_CFG_MAX)
     {
         PELOGE(cfgLog(pMac, LOGE, FL("<CFG> Total parameter count mismatch"));)
         retVal = WNI_CFG_INVALID_LEN;
@@ -2380,7 +2501,7 @@ ProcDnldRsp(tpAniSirGlobal pMac, tANI_U16 length, tANI_U32 *pParam)
 
     // Copy control array
     pDst = (tANI_U32*)pMac->cfg.gCfgEntry;
-    pDstEnd = pDst + CFG_PARAM_MAX_NUM;
+    pDstEnd = pDst + WNI_CFG_MAX;
     pSrc = pParam;
     while (pDst < pDstEnd)
     {
@@ -2422,7 +2543,7 @@ ProcDnldRsp(tpAniSirGlobal pMac, tANI_U16 length, tANI_U32 *pParam)
 
     // Calculate max string buffer lengths for all string parameters
     bufEnd = pMac->cfg.gCfgMaxSBufSize;
-    for (i = CFG_PARAM_MAX_NUM - 1; i >= 0; i--)
+    for (i = WNI_CFG_MAX - 1; i >= 0; i--)
     {
         if ((pMac->cfg.gCfgEntry[i].control & CFG_CTL_INT) != 0)
             continue;
@@ -2712,7 +2833,8 @@ ProcSetReqInternal(tpAniSirGlobal pMac, tANI_U16 length, tANI_U32 *pParam, tANI_
                 // Process string parameter
                 else
                 {
-                    if (valueLenRoundedUp4 > length)
+                    if ((valueLenRoundedUp4 > length) ||
+                        (valueLen > CFG_MAX_STR_LEN))
                     {
                        PELOGE(cfgLog(pMac, LOGE, FL("Invalid string length %d"
                               "in set param %d (tot %d)"), valueLen,
@@ -2816,7 +2938,7 @@ static tANI_U8
 CheckParam(tpAniSirGlobal pMac, tANI_U16 cfgId, tANI_U32 flag, tANI_U32 failedResult, tANI_U32 *pResult)
 {
     // Check if parameter ID is out of bound
-    if (cfgId >= CFG_PARAM_MAX_NUM)
+    if (cfgId >= WNI_CFG_MAX)
     {
         PELOGE(cfgLog(pMac, LOGE, FL("Invalid param id %d"), cfgId);)
         *pResult = WNI_CFG_INVALID_PID;
@@ -2907,7 +3029,7 @@ processCfgDownloadReq(tpAniSirGlobal pMac)
     uint32_t    icount = 0;
     uint32_t    scount = 0;
 
-    for (i = 0; i < CFG_PARAM_MAX_NUM ; i++) {
+    for (i = 0; i < WNI_CFG_MAX ; i++) {
         if ((cfg_static[i].control & CFG_CTL_VALID) != 0) {
             if (!(cfg_static[i].control & CFG_CTL_INT)) {
                 str_cfg = (struct cfgstatic_string *)cfg_static[i].p_str_data;
@@ -2933,7 +3055,7 @@ processCfgDownloadReq(tpAniSirGlobal pMac)
     /*Fill the SBUF wih maxLength*/
     buf_end = pMac->cfg.gCfgMaxSBufSize;
 
-    for (i = CFG_PARAM_MAX_NUM - 1; i >= 0; i--)
+    for (i = WNI_CFG_MAX - 1; i >= 0; i--)
     {
         if ((pMac->cfg.gCfgEntry[i].control & CFG_CTL_INT) != 0)
             continue;
@@ -2950,7 +3072,7 @@ processCfgDownloadReq(tpAniSirGlobal pMac)
         buf_end = buf_start;
     }
 
-    for (i = 0; i < CFG_PARAM_MAX_NUM ; i++) {
+    for (i = 0; i < WNI_CFG_MAX ; i++) {
         index = pMac->cfg.gCfgEntry[i].control & CFG_BUF_INDX_MASK;
 
         if ((pMac->cfg.gCfgEntry[i].control & CFG_CTL_INT) != 0) {
@@ -2963,8 +3085,11 @@ processCfgDownloadReq(tpAniSirGlobal pMac)
             if ((pMac->cfg.gCfgEntry[i].control & CFG_CTL_VALID) == 0)
                 continue;
 
-            if (index >= CFG_STA_SBUF_MAX_SIZE)
+            if (index >= CFG_STA_SBUF_MAX_SIZE) {
+                cfgLog(pMac, LOGE, FL("str_cfg id %d index %d too long"),
+                       i, index);
                 continue;
+            }
 
             dst_ptr = &pMac->cfg.gCfgSBuf[index];
             str_cfg = (struct cfgstatic_string *)cfg_static[i].p_str_data;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgUtil/dot11f.frms b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgUtil/dot11f.frms
index 93ee08f4490..b746fa65a6b 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgUtil/dot11f.frms
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/cfg/cfgUtil/dot11f.frms
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006-2007, 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2006-2007, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -42,13 +42,13 @@
  *
  */
 
-
 // Tell framesc what types to use for...
 %8-bit-type   tANI_U8  // 8,
 %16-bit-type  tANI_U16 // 16,
 %32-bit-type  tANI_U32 // & 32-bit unsigned integral types.  These can also
                        // be specified on the command line.
 
+
 // Define some mnemonic constants; these are just for our use with the frames
 // files we're compiling.  IOW, they won't result in any C code being
 // emitted.
@@ -120,8 +120,26 @@ const EID_AID                        =  197;
 const EID_EXT_CAP           	     =  127;
 const EID_OPERATING_MODE             =  199;
 const EID_WIDER_BW_CHANNEL_SWITCH_ANN=  194;
+const VHT_TRANSMIT_POWER_ENVELOPE    = 195;
 const EID_CHANNEL_SWITCH_WRAPPER     = 196;
 const EID_VENDOR_SPECIFIC            = 221;
+const EID_FILS_INDICATION            = 240;
+/**
+ * Extended Element ID
+ *
+ * As part of IEEE-802.11-2016 spec, extended element ID is introduced(9.4.2.1)
+ * Elements are defined to have a common general format consisting of a 1 octet
+ * Element ID field, a 1 octet Length field, an optional 1 octet Element ID
+ * Extension field, and a variable-length element-specific Information field.
+ * Each element is identified by the contents of the Element ID and, when
+ * present, Element ID Extension fields as defined in this standard. An Extended
+ * Element ID is a combination of an Element ID and an Element ID Extension for
+ * those elements that have a defined Element ID Extension. The Length field
+ * specifies the number of octets following the Length field. The presence of
+ * the Element ID Extension field is determined by the Element ID field having
+ * value of 255
+ */
+const EID_EXTN_ID_ELEMENT            = 255;
 
 const SIR_MAC_PROP_EXT_RATES_TYPE    =   0;
 const SIR_MAC_PROP_AP_NAME_TYPE      =   1;
@@ -2048,10 +2066,43 @@ IE Vendor3IE (EID_VENDOR_SPECIFIC) OUI (0x00, 0x16, 0x32)
 {
 }
 
+const EID_VENDOR_QCOM_MCC_CHAN              =    1;
+const EID_VENDOR_QCOM_SUB20_BW              =    2;
+
+IE hs20vendor_ie (EID_VENDOR_SPECIFIC) OUI (0x50, 0x6F, 0x9A, 0x10)
+{
+    /* hotspot_configurations */
+    {
+        dgaf_dis:               1;
+        hs_id_present:          2;
+        reserved:               1;
+        release_num:            4;
+    }
+    OPTIONAL UNION hs_id (DISCRIMINATOR hs_id_present)
+    {
+        pps_mo (hs_id_present IS 1)
+        {
+            pps_mo_id,          2;
+        }
+        anqp_domain (hs_id_present IS 2)
+        {
+            anqp_domain_id,     2;
+        }
+    };
+}
+
 IE QComVendorIE (EID_VENDOR_SPECIFIC) OUI (0x00, 0xA0, 0xC6)
 {
-    type,      1;
-    channel,   1;
+    OPTIE IE MccChanInfo (EID_VENDOR_QCOM_MCC_CHAN)
+    {
+        channel,   1;
+    }
+
+    OPTIE IE Sub20Info (EID_VENDOR_QCOM_SUB20_BW)
+    {
+        capability,     1;
+        csa_chanwidth,  1;
+    }
 }
 
 IE ESETrafStrmMet (EID_VENDOR_SPECIFIC) OUI (0x00, 0x40, 0x96, 0x07)
@@ -2415,13 +2466,19 @@ IE WiderBWChanSwitchAnn (EID_WIDER_BW_CHANNEL_SWITCH_ANN)
    newCenterChanFreq1,    1;
 }
 
+IE vht_transmit_power_env (VHT_TRANSMIT_POWER_ENVELOPE)
+{
+    bytes[2..5];
+}
+
 IE ChannelSwitchWrapper (EID_CHANNEL_SWITCH_WRAPPER)
 {
     OPTIE IE  WiderBWChanSwitchAnn;
+    OPTIE IE  vht_transmit_power_env;
 }
 IE ExtCap (EID_EXT_CAP)
 {
-    bytes[8..9];
+    bytes[1..9];
 }
 
 IE HTCaps (EID_HT_CAPABILITIES)
@@ -2580,6 +2637,68 @@ IE TimeAdvertisement (EID_TIME_ADVERTISEMENT)   // 8.4.2.63
     time_error[5];
 }
 
+IE fils_indication (EID_FILS_INDICATION)
+{
+   // FILS Information element
+   {
+       public_key_identifiers_cnt     : 3;
+       realm_identifiers_cnt          : 3;
+       is_ip_config_supported         : 1;
+       is_cache_id_present            : 1;
+       is_hessid_present              : 1;
+       is_fils_sk_auth_supported      : 1;
+       is_fils_sk_auth_pfs_supported  : 1;
+       is_pk_auth_supported           : 1;
+       reserved                       : 4;
+   }
+   // other FILS elements
+   variable_data[3..255];
+}
+
+IE fils_assoc_delay_info (EID_EXTN_ID_ELEMENT) OUI ( 0x01 )
+{
+    assoc_delay_info, 1;
+}
+
+IE fils_key_confirmation (EID_EXTN_ID_ELEMENT) OUI ( 0x03 )
+{
+    key_auth[0..255];
+}
+
+IE fils_session (EID_EXTN_ID_ELEMENT) OUI ( 0x04 )
+{
+    session[8];
+}
+
+IE fils_hlp_container (EID_EXTN_ID_ELEMENT) OUI ( 0x05 )
+{
+    dest_mac[6];
+    src_mac[6];
+    hlp_packet[0..255];
+}
+
+IE fils_kde (EID_EXTN_ID_ELEMENT) OUI ( 0x07 )
+{
+    key_rsc[8];
+    kde_list[0..255];
+}
+
+IE fils_wrapped_data (EID_EXTN_ID_ELEMENT) OUI ( 0x08 )
+{
+    wrapped_data[0..255];
+}
+
+IE fils_public_key (EID_EXTN_ID_ELEMENT) OUI ( 0x0C )
+{
+    key_type, 1;
+    public_key[0..255];
+}
+
+IE fils_nonce (EID_EXTN_ID_ELEMENT) OUI ( 0x0D )
+{
+    nonce[16];
+}
+
 /////////////////////////////////////////////////////////////////////////////
 //                                MULTIIEs                                 //
 /////////////////////////////////////////////////////////////////////////////
@@ -3073,9 +3192,12 @@ FRAME Beacon                              // C.f. Sec. 7.2.3.1
     OPTIE  OperatingMode;
     OPTIE  WiderBWChanSwitchAnn;
     OPTIE  OBSSScanParameters;
+    //WLAN_FEATURE_FILS_SK
+    OPTIE  fils_indication;
     OPTIE  Vendor1IE;
     OPTIE  vendor2_ie;
     OPTIE  Vendor3IE;
+    OPTIE  hs20vendor_ie;
     OPTIE  ChannelSwitchWrapper;
     OPTIE  QComVendorIE;
     OPTIE  ESEVersion;
@@ -3160,9 +3282,12 @@ FRAME Beacon2
     OPTIE  OperatingMode;
     OPTIE  WiderBWChanSwitchAnn;
     OPTIE  OBSSScanParameters;
+    //WLAN_FEATURE_FILS_SK
+    OPTIE  fils_indication;
     OPTIE  Vendor1IE;
     OPTIE  vendor2_ie;
     OPTIE  Vendor3IE;
+    OPTIE  hs20vendor_ie;
     OPTIE  ChannelSwitchWrapper;
     OPTIE  QComVendorIE;
     OPTIE  ESEVersion;
@@ -3224,9 +3349,12 @@ FRAME BeaconIEs
     OPTIE  OperatingMode;
     OPTIE  WiderBWChanSwitchAnn;
     OPTIE  OBSSScanParameters;
+    //WLAN_FEATURE_FILS_SK
+    OPTIE  fils_indication;
     OPTIE  Vendor1IE;
     OPTIE  vendor2_ie;
     OPTIE  Vendor3IE;
+    OPTIE  hs20vendor_ie;
     OPTIE  ChannelSwitchWrapper;
     OPTIE  QComVendorIE;
 
@@ -3263,10 +3391,17 @@ FRAME AssocRequest                        // 7.2.3.4
     OPTIE  P2PIEOpaque;
     OPTIE  WFDIEOpaque;
     OPTIE  VHTCaps;
+    //WLAN_FEATURE_FILS_SK
+    OPTIE  fils_session;
+    OPTIE  fils_public_key;
+    OPTIE  fils_key_confirmation;
+    OPTIE  fils_hlp_container;
     OPTIE  ExtCap;
     OPTIE  OperatingMode;
     OPTIE  QosMapSet;
     OPTIE  vendor2_ie;
+    OPTIE  QComVendorIE;
+    OPTIE  hs20vendor_ie;
 } // End frame AssocRequest.
 
 FRAME AssocResponse                       // 7.2.3.5
@@ -3300,7 +3435,14 @@ FRAME AssocResponse                       // 7.2.3.5
     OPTIE  ExtCap;
     OPTIE  OBSSScanParameters;
     OPTIE  QosMapSet;
+    //WLAN_FEATURE_FILS_SK
+    OPTIE  fils_session;
+    OPTIE  fils_public_key;
+    OPTIE  fils_key_confirmation;
+    OPTIE  fils_hlp_container;
+    OPTIE  fils_kde;
     OPTIE  vendor2_ie;
+    OPTIE  QComVendorIE;
 } // End frame AssocResponse.
 
 FRAME ReAssocRequest                      // 7.2.3.6
@@ -3338,6 +3480,8 @@ FRAME ReAssocRequest                      // 7.2.3.6
     OPTIE  OperatingMode;
     OPTIE  QosMapSet;
     OPTIE  vendor2_ie;
+    OPTIE  QComVendorIE;
+    OPTIE  hs20vendor_ie;
 } // End frame ReAssocRequest.
 
 FRAME ReAssocResponse                     // 7.2.3.7
@@ -3373,6 +3517,7 @@ FRAME ReAssocResponse                     // 7.2.3.7
     OPTIE  OBSSScanParameters;
     OPTIE  QosMapSet;
     OPTIE  vendor2_ie;
+    OPTIE  QComVendorIE;
 } // End frame ReAssocResponse.
 
 FRAME ProbeRequest                        // 7.2.3.8
@@ -3438,9 +3583,12 @@ FRAME ProbeResponse                       // 7.2.3.9
     OPTIE  VHTExtBssLoad;
     OPTIE  ExtCap;
     OPTIE  OBSSScanParameters;
+    //WLAN_FEATURE_FILS_SK
+    OPTIE  fils_indication;
     OPTIE  Vendor1IE;
     OPTIE  vendor2_ie;
     OPTIE  Vendor3IE;
+    OPTIE  hs20vendor_ie;
     OPTIE  ChannelSwitchWrapper;
     OPTIE  QComVendorIE;
     OPTIE  ESEVersion;
@@ -3457,6 +3605,11 @@ FRAME Authentication                      // 7.2.3.10
     OPTIE  FTInfo;
     OPTIE  TimeoutInterval;
     OPTIE  RICDataDesc[2];
+    //WLAN_FEATURE_FILS_SK
+    OPTIE  fils_nonce;
+    OPTIE  fils_session;
+    OPTIE  fils_wrapped_data;
+    OPTIE  fils_assoc_delay_info;
 } // End frame Auth.
 
 FRAME DeAuth                              // 7.2.3.11
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/dph/dphHashTable.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/dph/dphHashTable.c
index 383fb49e127..42a7b44b10a 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/dph/dphHashTable.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/dph/dphHashTable.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -248,7 +248,7 @@ tpDphHashNode dphInitStaState(tpAniSirGlobal pMac, tSirMacAddr staAddr,
 {
     tANI_U32 val;
 
-    tpDphHashNode pStaDs;
+    tpDphHashNode pStaDs, pnext;
     tANI_U16 staIdx = HAL_STA_INVALID_IDX;
 
     if (assocId >= pDphHashTable->size)
@@ -259,23 +259,25 @@ tpDphHashNode dphInitStaState(tpAniSirGlobal pMac, tSirMacAddr staAddr,
 
     pStaDs = getNode(pMac, (tANI_U8) assocId, pDphHashTable);
     staIdx = pStaDs->staIndex;
+    pnext = pStaDs->next;
 
-    PELOG1(limLog(pMac, LOG1, FL("Assoc Id %d, Addr %p"), assocId, &pStaDs);)
+    PELOG1(limLog(pMac, LOG1, FL("Assoc Id %d, Addr %pK"), assocId, &pStaDs);)
 
-    // Clear the STA node except for the next pointer (last 4 bytes)
-    vos_mem_set( (tANI_U8 *) pStaDs, sizeof(tDphHashNode) - sizeof(tpDphHashNode), 0);
+    /* Clear the STA node except for the next pointer */
+    vos_mem_set((tANI_U8 *)pStaDs, sizeof(tDphHashNode), 0);
+    pStaDs->next = pnext;
 
-    // Initialize the assocId
+    /* Initialize the assocId */
     pStaDs->assocId = assocId;
     if(true == validStaIdx)
       pStaDs->staIndex = staIdx;
     else
       pStaDs->staIndex = HAL_STA_INVALID_IDX;
 
-    // Initialize STA mac address
+    /* Initialize STA mac address */
     vos_mem_copy( pStaDs->staAddr, staAddr, sizeof(tSirMacAddr));
 
-    // Initialize fragmentation threshold
+    /* Initialize fragmentation threshold */
     if (wlan_cfgGetInt(pMac, WNI_CFG_FRAGMENTATION_THRESHOLD, &val) != eSIR_SUCCESS)
         limLog(pMac, LOGP, FL("could not retrieve fragmentation threshold"));
     else
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/cfgGlobal.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/cfgGlobal.h
index 893ebae20e4..3b7d560b390 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/cfgGlobal.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/cfgGlobal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013, 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2013, 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,8 +40,7 @@
 
 #include "sirCommon.h"
 #include "sirTypes.h"
-#include "wniCfgSta.h"
-#include "wniCfgAp.h"
+#include "wni_cfg.h"
 
 #define CFG_MAX_NUM_STA      SIR_MAX_NUM_STA_IN_IBSS
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/dot11f.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/dot11f.h
index 6855e2237b9..1456e379503 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/dot11f.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/dot11f.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -24,7 +24,6 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
-
 #ifndef DOT11F_H
 #define DOT11F_H
 /**
@@ -32,12 +31,8 @@
   *
   * \brief Structures, function prototypes & definitions
   * for working with 802.11 Frames
-  *
-  *
-  *
-  *
   * This file was automatically generated by 'framesc'
-  * Thu Oct  8 17:27:11 2015 from the following file(s):
+  * Thu Dec 28 13:33:15 2017 from the following file(s):
   *
   * dot11f.frms
   *
@@ -91,8 +86,8 @@ typedef tANI_U32 tDOT11F_U64[2];
 #define DOT11F_BUFFER_OVERFLOW       ( 0x10000005 )
 #define DOT11F_MANDATORY_TLV_MISSING ( 0x00001000 )
 #define DOT11F_FAILED(code)          ( (code) & 0x10000000 )
-#define DOT11F_WARNED(code)          ( ( ( 0 == (code) ) & 0x10000000 ) && code)
 #define DOT11F_SUCCEEDED(code)       ( (code) == 0 )
+#define DOT11F_WARNED(code)          (!DOT11F_SUCCEEDED(code) && !DOT11F_FAILED(code))
 
 /*********************************************************************
  * Fixed Fields                                                      *
@@ -1829,6 +1824,31 @@ tANI_U32 dot11fGetPackedIEIGTK(tpAniSirGlobal, tDot11fIEIGTK*, tANI_U32*);
 #ifdef __cplusplus
 }; /* End extern "C". */
 #endif /* C++ */
+// EID 1 (0x01)
+typedef struct sDot11fIEMccChanInfo {
+    tANI_U8      present;
+    tANI_U8      channel;
+} tDot11fIEMccChanInfo;
+
+#define DOT11F_EID_MCCCHANINFO ( 1 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_MCCCHANINFO_MIN_LEN ( 1 )
+
+#define DOT11F_IE_MCCCHANINFO_MAX_LEN ( 1 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIeMccChanInfo(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEMccChanInfo*);
+
+tANI_U32 dot11fPackIeMccChanInfo(tpAniSirGlobal, tDot11fIEMccChanInfo*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEMccChanInfo(tpAniSirGlobal, tDot11fIEMccChanInfo*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
 // EID 3 (0x03)
 typedef struct sDot11fIER0KH_ID {
     tANI_U8      present;
@@ -1880,6 +1900,32 @@ tANI_U32 dot11fGetPackedIER1KH_ID(tpAniSirGlobal, tDot11fIER1KH_ID*, tANI_U32*);
 #ifdef __cplusplus
 }; /* End extern "C". */
 #endif /* C++ */
+// EID 2 (0x02)
+typedef struct sDot11fIESub20Info {
+    tANI_U8      present;
+    tANI_U8      capability;
+    tANI_U8      csa_chanwidth;
+} tDot11fIESub20Info;
+
+#define DOT11F_EID_SUB20INFO ( 2 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_SUB20INFO_MIN_LEN ( 2 )
+
+#define DOT11F_IE_SUB20INFO_MAX_LEN ( 2 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIeSub20Info(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIESub20Info*);
+
+tANI_U32 dot11fPackIeSub20Info(tpAniSirGlobal, tDot11fIESub20Info*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIESub20Info(tpAniSirGlobal, tDot11fIESub20Info*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
 // EID 1 (0x01)
 typedef struct sDot11fIETSFInfo {
     tANI_U8      present;
@@ -2729,6 +2775,32 @@ tANI_U32 dot11fGetPackedIEWiderBWChanSwitchAnn(tpAniSirGlobal, tDot11fIEWiderBWC
 #ifdef __cplusplus
 }; /* End extern "C". */
 #endif /* C++ */
+// EID 195 (0xc3)
+typedef struct sDot11fIEvht_transmit_power_env {
+    tANI_U8      present;
+    tANI_U8      num_bytes;
+    tANI_U8      bytes[5];
+} tDot11fIEvht_transmit_power_env;
+
+#define DOT11F_EID_VHT_TRANSMIT_POWER_ENV ( 195 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_VHT_TRANSMIT_POWER_ENV_MIN_LEN ( 2 )
+
+#define DOT11F_IE_VHT_TRANSMIT_POWER_ENV_MAX_LEN ( 5 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIevht_transmit_power_env(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEvht_transmit_power_env*);
+
+tANI_U32 dot11fPackIevht_transmit_power_env(tpAniSirGlobal, tDot11fIEvht_transmit_power_env*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEvht_transmit_power_env(tpAniSirGlobal, tDot11fIEvht_transmit_power_env*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
 // EID 197 (0xc5)
 typedef struct sDot11fIEAID {
     tANI_U8      present;
@@ -2837,8 +2909,9 @@ tANI_U32 dot11fGetPackedIEChanSwitchAnn(tpAniSirGlobal, tDot11fIEChanSwitchAnn*,
 #endif /* C++ */
 // EID 196 (0xc4)
 typedef struct sDot11fIEChannelSwitchWrapper {
-    tANI_U8                       present;
-    tDot11fIEWiderBWChanSwitchAnn WiderBWChanSwitchAnn;
+    tANI_U8                         present;
+    tDot11fIEWiderBWChanSwitchAnn   WiderBWChanSwitchAnn;
+    tDot11fIEvht_transmit_power_env vht_transmit_power_env;
 } tDot11fIEChannelSwitchWrapper;
 
 #define DOT11F_EID_CHANNELSWITCHWRAPPER ( 196 )
@@ -2846,7 +2919,7 @@ typedef struct sDot11fIEChannelSwitchWrapper {
 // N.B. These #defines do *not* include the EID & length
 #define DOT11F_IE_CHANNELSWITCHWRAPPER_MIN_LEN ( 0 )
 
-#define DOT11F_IE_CHANNELSWITCHWRAPPER_MAX_LEN ( 5 )
+#define DOT11F_IE_CHANNELSWITCHWRAPPER_MAX_LEN ( 12 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -3162,7 +3235,7 @@ typedef struct sDot11fIEExtCap {
 #define DOT11F_EID_EXTCAP ( 127 )
 
 // N.B. These #defines do *not* include the EID & length
-#define DOT11F_IE_EXTCAP_MIN_LEN ( 8 )
+#define DOT11F_IE_EXTCAP_MIN_LEN ( 1 )
 
 #define DOT11F_IE_EXTCAP_MAX_LEN ( 9 )
 
@@ -4543,17 +4616,17 @@ tANI_U32 dot11fGetPackedIEQBSSLoad(tpAniSirGlobal, tDot11fIEQBSSLoad*, tANI_U32*
 #endif /* C++ */
 // EID 221 (0xdd) {OUI 0x00, 0xa0, 0xc6}
 typedef struct sDot11fIEQComVendorIE {
-    tANI_U8      present;
-    tANI_U8      type;
-    tANI_U8      channel;
+    tANI_U8              present;
+    tDot11fIEMccChanInfo MccChanInfo;
+    tDot11fIESub20Info   Sub20Info;
 } tDot11fIEQComVendorIE;
 
 #define DOT11F_EID_QCOMVENDORIE ( 221 )
 
 // N.B. These #defines do *not* include the EID & length
-#define DOT11F_IE_QCOMVENDORIE_MIN_LEN ( 5 )
+#define DOT11F_IE_QCOMVENDORIE_MIN_LEN ( 3 )
 
-#define DOT11F_IE_QCOMVENDORIE_MAX_LEN ( 5 )
+#define DOT11F_IE_QCOMVENDORIE_MAX_LEN ( 10 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -4764,7 +4837,7 @@ typedef struct sDot11fIERSN {
 // N.B. These #defines do *not* include the EID & length
 #define DOT11F_IE_RSN_MIN_LEN ( 6 )
 
-#define DOT11F_IE_RSN_MAX_LEN ( 255 )
+#define DOT11F_IE_RSN_MAX_LEN ( 114 )
 
 #ifdef __cplusplus
 extern "C" {
@@ -4906,7 +4979,7 @@ typedef struct sDot11fIESuppRates {
                       ((_x) == 48) || \
                       ((_x) == 72) || \
                       ((_x) == 96) || \
-                      ((_x) == 108))  
+                      ((_x) == 108))
 
 #ifdef __cplusplus
 extern "C" {
@@ -5390,7 +5463,7 @@ tANI_U32 dot11fGetPackedIEWMMParams(tpAniSirGlobal, tDot11fIEWMMParams*, tANI_U3
 typedef struct sDot11fIEWPA {
     tANI_U8      present;
     tANI_U16     version /* Must be 1! */;
-    tANI_U8      multicast_cipher_present;   //field added to fix the bug in dot11fPackIEWPA 
+    tANI_U8      multicast_cipher_present;   //field added to fix the bug in dot11fPackIEWPA
     tANI_U8      multicast_cipher[4];
     tANI_U16     unicast_cipher_count;
     tANI_U8      unicast_ciphers[4][4];
@@ -5779,6 +5852,289 @@ tANI_U32 dot11fGetPackedIEext_chan_switch_ann(tpAniSirGlobal, tDot11fIEext_chan_
 #ifdef __cplusplus
 }; /* End extern "C". */
 #endif /* C++ */
+// EID 255 (0xff) Extended EID 1 (0x01)
+typedef struct sDot11fIEfils_assoc_delay_info {
+    tANI_U8      present;
+    tANI_U8      assoc_delay_info;
+} tDot11fIEfils_assoc_delay_info;
+
+#define DOT11F_EID_FILS_ASSOC_DELAY_INFO ( 255 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_FILS_ASSOC_DELAY_INFO_MIN_LEN ( 1 )
+
+#define DOT11F_IE_FILS_ASSOC_DELAY_INFO_MAX_LEN ( 1 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIefils_assoc_delay_info(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEfils_assoc_delay_info*);
+
+tANI_U32 dot11fPackIefils_assoc_delay_info(tpAniSirGlobal, tDot11fIEfils_assoc_delay_info*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEfils_assoc_delay_info(tpAniSirGlobal, tDot11fIEfils_assoc_delay_info*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
+// EID 255 (0xff) Extended EID 5 (0x05)
+typedef struct sDot11fIEfils_hlp_container {
+    tANI_U8      present;
+    tANI_U8      dest_mac[6];
+    tANI_U8      src_mac[6];
+    tANI_U8      num_hlp_packet;
+    tANI_U8      hlp_packet[255];
+} tDot11fIEfils_hlp_container;
+
+#define DOT11F_EID_FILS_HLP_CONTAINER ( 255 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_FILS_HLP_CONTAINER_MIN_LEN ( 12 )
+
+#define DOT11F_IE_FILS_HLP_CONTAINER_MAX_LEN ( 267 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIefils_hlp_container(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEfils_hlp_container*);
+
+tANI_U32 dot11fPackIefils_hlp_container(tpAniSirGlobal, tDot11fIEfils_hlp_container*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEfils_hlp_container(tpAniSirGlobal, tDot11fIEfils_hlp_container*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
+// EID 240 (0xf0)
+typedef struct sDot11fIEfils_indication {
+    tANI_U8      present;
+    tANI_U16 public_key_identifiers_cnt: 3;
+    tANI_U16 realm_identifiers_cnt: 3;
+    tANI_U16 is_ip_config_supported: 1;
+    tANI_U16 is_cache_id_present: 1;
+    tANI_U16 is_hessid_present: 1;
+    tANI_U16 is_fils_sk_auth_supported: 1;
+    tANI_U16 is_fils_sk_auth_pfs_supported: 1;
+    tANI_U16 is_pk_auth_supported: 1;
+    tANI_U16         reserved: 4;
+    tANI_U8      num_variable_data;
+    tANI_U8      variable_data[255];
+} tDot11fIEfils_indication;
+
+#define DOT11F_EID_FILS_INDICATION ( 240 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_FILS_INDICATION_MIN_LEN ( 5 )
+
+#define DOT11F_IE_FILS_INDICATION_MAX_LEN ( 257 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIefils_indication(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEfils_indication*);
+
+tANI_U32 dot11fPackIefils_indication(tpAniSirGlobal, tDot11fIEfils_indication*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEfils_indication(tpAniSirGlobal, tDot11fIEfils_indication*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
+// EID 255 (0xff) Extended EID 7 (0x07)
+typedef struct sDot11fIEfils_kde {
+    tANI_U8      present;
+    tANI_U8      key_rsc[8];
+    tANI_U8      num_kde_list;
+    tANI_U8      kde_list[255];
+} tDot11fIEfils_kde;
+
+#define DOT11F_EID_FILS_KDE ( 255 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_FILS_KDE_MIN_LEN ( 8 )
+
+#define DOT11F_IE_FILS_KDE_MAX_LEN ( 263 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIefils_kde(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEfils_kde*);
+
+tANI_U32 dot11fPackIefils_kde(tpAniSirGlobal, tDot11fIEfils_kde*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEfils_kde(tpAniSirGlobal, tDot11fIEfils_kde*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
+// EID 255 (0xff) Extended EID 3 (0x03)
+typedef struct sDot11fIEfils_key_confirmation {
+    tANI_U8      present;
+    tANI_U8      num_key_auth;
+    tANI_U8      key_auth[255];
+} tDot11fIEfils_key_confirmation;
+
+#define DOT11F_EID_FILS_KEY_CONFIRMATION ( 255 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_FILS_KEY_CONFIRMATION_MIN_LEN ( 0 )
+
+#define DOT11F_IE_FILS_KEY_CONFIRMATION_MAX_LEN ( 255 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIefils_key_confirmation(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEfils_key_confirmation*);
+
+tANI_U32 dot11fPackIefils_key_confirmation(tpAniSirGlobal, tDot11fIEfils_key_confirmation*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEfils_key_confirmation(tpAniSirGlobal, tDot11fIEfils_key_confirmation*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
+// EID 255 (0xff) Extended EID 13 (0x0d)
+typedef struct sDot11fIEfils_nonce {
+    tANI_U8      present;
+    tANI_U8      nonce[16];
+} tDot11fIEfils_nonce;
+
+#define DOT11F_EID_FILS_NONCE ( 255 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_FILS_NONCE_MIN_LEN ( 16 )
+
+#define DOT11F_IE_FILS_NONCE_MAX_LEN ( 16 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIefils_nonce(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEfils_nonce*);
+
+tANI_U32 dot11fPackIefils_nonce(tpAniSirGlobal, tDot11fIEfils_nonce*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEfils_nonce(tpAniSirGlobal, tDot11fIEfils_nonce*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
+// EID 255 (0xff) Extended EID 12 (0x0c)
+typedef struct sDot11fIEfils_public_key {
+    tANI_U8      present;
+    tANI_U8      key_type;
+    tANI_U8      num_public_key;
+    tANI_U8      public_key[255];
+} tDot11fIEfils_public_key;
+
+#define DOT11F_EID_FILS_PUBLIC_KEY ( 255 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_FILS_PUBLIC_KEY_MIN_LEN ( 1 )
+
+#define DOT11F_IE_FILS_PUBLIC_KEY_MAX_LEN ( 256 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIefils_public_key(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEfils_public_key*);
+
+tANI_U32 dot11fPackIefils_public_key(tpAniSirGlobal, tDot11fIEfils_public_key*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEfils_public_key(tpAniSirGlobal, tDot11fIEfils_public_key*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
+// EID 255 (0xff) Extended EID 4 (0x04)
+typedef struct sDot11fIEfils_session {
+    tANI_U8      present;
+    tANI_U8      session[8];
+} tDot11fIEfils_session;
+
+#define DOT11F_EID_FILS_SESSION ( 255 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_FILS_SESSION_MIN_LEN ( 8 )
+
+#define DOT11F_IE_FILS_SESSION_MAX_LEN ( 8 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIefils_session(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEfils_session*);
+
+tANI_U32 dot11fPackIefils_session(tpAniSirGlobal, tDot11fIEfils_session*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEfils_session(tpAniSirGlobal, tDot11fIEfils_session*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
+// EID 255 (0xff) Extended EID 8 (0x08)
+typedef struct sDot11fIEfils_wrapped_data {
+    tANI_U8      present;
+    tANI_U8      num_wrapped_data;
+    tANI_U8      wrapped_data[255];
+} tDot11fIEfils_wrapped_data;
+
+#define DOT11F_EID_FILS_WRAPPED_DATA ( 255 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_FILS_WRAPPED_DATA_MIN_LEN ( 0 )
+
+#define DOT11F_IE_FILS_WRAPPED_DATA_MAX_LEN ( 255 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIefils_wrapped_data(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEfils_wrapped_data*);
+
+tANI_U32 dot11fPackIefils_wrapped_data(tpAniSirGlobal, tDot11fIEfils_wrapped_data*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEfils_wrapped_data(tpAniSirGlobal, tDot11fIEfils_wrapped_data*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
+// EID 221 (0xdd) {OUI 0x50, 0x6f, 0x9a, 0x10}
+typedef struct sDot11fIEhs20vendor_ie {
+    tANI_U8      present;
+    tANI_U8         dgaf_dis: 1;
+    tANI_U8    hs_id_present: 2;
+    tANI_U8         reserved: 1;
+    tANI_U8      release_num: 4;
+    union
+    {
+        struct
+        {
+            tANI_U16 pps_mo_id;
+        } pps_mo; /* hs_id_present = 1 */
+        struct
+        {
+            tANI_U16 anqp_domain_id;
+        } anqp_domain; /* hs_id_present = 2 */
+    } hs_id;
+} tDot11fIEhs20vendor_ie;
+
+#define DOT11F_EID_HS20VENDOR_IE ( 221 )
+
+// N.B. These #defines do *not* include the EID & length
+#define DOT11F_IE_HS20VENDOR_IE_MIN_LEN ( 5 )
+
+#define DOT11F_IE_HS20VENDOR_IE_MAX_LEN ( 7 )
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* C++ */
+tANI_U32 dot11fUnpackIehs20vendor_ie(tpAniSirGlobal, tANI_U8*,tANI_U8, tDot11fIEhs20vendor_ie*);
+
+tANI_U32 dot11fPackIehs20vendor_ie(tpAniSirGlobal, tDot11fIEhs20vendor_ie*, tANI_U8*, tANI_U32, tANI_U32*);
+
+tANI_U32 dot11fGetPackedIEhs20vendor_ie(tpAniSirGlobal, tDot11fIEhs20vendor_ie*, tANI_U32*);
+
+#ifdef __cplusplus
+}; /* End extern "C". */
+#endif /* C++ */
 // EID 62 (0x3e)
 typedef struct sDot11fIEsec_chan_offset_ele {
     tANI_U8      present;
@@ -5946,33 +6302,39 @@ tANI_U32 dot11fGetPackedAddTSResponseSize(tpAniSirGlobal pCtx, tDot11fAddTSRespo
 #endif /* C++ */
 
 typedef struct sDot11fAssocRequest{
-    tDot11fFfCapabilities   Capabilities;
-    tDot11fFfListenInterval ListenInterval;
-    tDot11fIESSID           SSID;
-    tDot11fIESuppRates      SuppRates;
-    tDot11fIEExtSuppRates   ExtSuppRates;
-    tDot11fIEPowerCaps      PowerCaps;
-    tDot11fIESuppChannels   SuppChannels;
-    tDot11fIERSNOpaque      RSNOpaque;
-    tDot11fIEQOSCapsStation QOSCapsStation;
-    tDot11fIERRMEnabledCap  RRMEnabledCap;
-    tDot11fIEMobilityDomain MobilityDomain;
-    tDot11fIEWPAOpaque      WPAOpaque;
-    tDot11fIEHTCaps         HTCaps;
-    tDot11fIEWMMCaps        WMMCaps;
-    tDot11fIEWMMInfoStation WMMInfoStation;
-    tDot11fIEWscIEOpaque    WscIEOpaque;
-    tDot11fIEWAPIOpaque     WAPIOpaque;
-    tDot11fIEWAPI           WAPI;
-    tDot11fIEESERadMgmtCap  ESERadMgmtCap;
-    tDot11fIEESEVersion     ESEVersion;
-    tDot11fIEP2PIEOpaque    P2PIEOpaque;
-    tDot11fIEWFDIEOpaque    WFDIEOpaque;
-    tDot11fIEVHTCaps        VHTCaps;
-    tDot11fIEExtCap         ExtCap;
-    tDot11fIEOperatingMode  OperatingMode;
-    tDot11fIEQosMapSet      QosMapSet;
-    tDot11fIEvendor2_ie     vendor2_ie;
+    tDot11fFfCapabilities          Capabilities;
+    tDot11fFfListenInterval        ListenInterval;
+    tDot11fIESSID                  SSID;
+    tDot11fIESuppRates             SuppRates;
+    tDot11fIEExtSuppRates          ExtSuppRates;
+    tDot11fIEPowerCaps             PowerCaps;
+    tDot11fIESuppChannels          SuppChannels;
+    tDot11fIERSNOpaque             RSNOpaque;
+    tDot11fIEQOSCapsStation        QOSCapsStation;
+    tDot11fIERRMEnabledCap         RRMEnabledCap;
+    tDot11fIEMobilityDomain        MobilityDomain;
+    tDot11fIEWPAOpaque             WPAOpaque;
+    tDot11fIEHTCaps                HTCaps;
+    tDot11fIEWMMCaps               WMMCaps;
+    tDot11fIEWMMInfoStation        WMMInfoStation;
+    tDot11fIEWscIEOpaque           WscIEOpaque;
+    tDot11fIEWAPIOpaque            WAPIOpaque;
+    tDot11fIEWAPI                  WAPI;
+    tDot11fIEESERadMgmtCap         ESERadMgmtCap;
+    tDot11fIEESEVersion            ESEVersion;
+    tDot11fIEP2PIEOpaque           P2PIEOpaque;
+    tDot11fIEWFDIEOpaque           WFDIEOpaque;
+    tDot11fIEVHTCaps               VHTCaps;
+    tDot11fIEfils_session          fils_session;
+    tDot11fIEfils_public_key       fils_public_key;
+    tDot11fIEfils_key_confirmation fils_key_confirmation;
+    tDot11fIEfils_hlp_container    fils_hlp_container;
+    tDot11fIEExtCap                ExtCap;
+    tDot11fIEOperatingMode         OperatingMode;
+    tDot11fIEQosMapSet             QosMapSet;
+    tDot11fIEvendor2_ie            vendor2_ie;
+    tDot11fIEQComVendorIE          QComVendorIE;
+    tDot11fIEhs20vendor_ie         hs20vendor_ie;
 } tDot11fAssocRequest;
 
 #define DOT11F_ASSOCREQUEST ( 5 )
@@ -5990,38 +6352,44 @@ tANI_U32 dot11fGetPackedAssocRequestSize(tpAniSirGlobal pCtx, tDot11fAssocReques
 #endif /* C++ */
 
 typedef struct sDot11fAssocResponse{
-    tDot11fFfCapabilities       Capabilities;
-    tDot11fFfStatus             Status;
-    tDot11fFfAID                AID;
-    tDot11fIESuppRates          SuppRates;
-    tDot11fIEExtSuppRates       ExtSuppRates;
-    tDot11fIEEDCAParamSet       EDCAParamSet;
-    tDot11fIERCPIIE             RCPIIE;
-    tDot11fIERSNIIE             RSNIIE;
-    tDot11fIERRMEnabledCap      RRMEnabledCap;
-    tDot11fIEMobilityDomain     MobilityDomain;
-    tDot11fIEFTInfo             FTInfo;
-    tANI_U16                    num_RICDataDesc;
-    tDot11fIERICDataDesc        RICDataDesc[2];
-    tDot11fIEWPA                WPA;
-    tDot11fIETimeoutInterval    TimeoutInterval;
-    tDot11fIEHTCaps             HTCaps;
-    tDot11fIEHTInfo             HTInfo;
-    tDot11fIEWMMParams          WMMParams;
-    tDot11fIEWMMCaps            WMMCaps;
-    tDot11fIEESERadMgmtCap      ESERadMgmtCap;
-    tDot11fIEESETrafStrmMet     ESETrafStrmMet;
-    tDot11fIEESETxmitPower      ESETxmitPower;
-    tANI_U16                    num_WMMTSPEC;
-    tDot11fIEWMMTSPEC           WMMTSPEC[4];
-    tDot11fIEWscAssocRes        WscAssocRes;
-    tDot11fIEP2PAssocRes        P2PAssocRes;
-    tDot11fIEVHTCaps            VHTCaps;
-    tDot11fIEVHTOperation       VHTOperation;
-    tDot11fIEExtCap             ExtCap;
-    tDot11fIEOBSSScanParameters OBSSScanParameters;
-    tDot11fIEQosMapSet          QosMapSet;
-    tDot11fIEvendor2_ie         vendor2_ie;
+    tDot11fFfCapabilities          Capabilities;
+    tDot11fFfStatus                Status;
+    tDot11fFfAID                   AID;
+    tDot11fIESuppRates             SuppRates;
+    tDot11fIEExtSuppRates          ExtSuppRates;
+    tDot11fIEEDCAParamSet          EDCAParamSet;
+    tDot11fIERCPIIE                RCPIIE;
+    tDot11fIERSNIIE                RSNIIE;
+    tDot11fIERRMEnabledCap         RRMEnabledCap;
+    tDot11fIEMobilityDomain        MobilityDomain;
+    tDot11fIEFTInfo                FTInfo;
+    tANI_U16                       num_RICDataDesc;
+    tDot11fIERICDataDesc           RICDataDesc[2];
+    tDot11fIEWPA                   WPA;
+    tDot11fIETimeoutInterval       TimeoutInterval;
+    tDot11fIEHTCaps                HTCaps;
+    tDot11fIEHTInfo                HTInfo;
+    tDot11fIEWMMParams             WMMParams;
+    tDot11fIEWMMCaps               WMMCaps;
+    tDot11fIEESERadMgmtCap         ESERadMgmtCap;
+    tDot11fIEESETrafStrmMet        ESETrafStrmMet;
+    tDot11fIEESETxmitPower         ESETxmitPower;
+    tANI_U16                       num_WMMTSPEC;
+    tDot11fIEWMMTSPEC              WMMTSPEC[4];
+    tDot11fIEWscAssocRes           WscAssocRes;
+    tDot11fIEP2PAssocRes           P2PAssocRes;
+    tDot11fIEVHTCaps               VHTCaps;
+    tDot11fIEVHTOperation          VHTOperation;
+    tDot11fIEExtCap                ExtCap;
+    tDot11fIEOBSSScanParameters    OBSSScanParameters;
+    tDot11fIEQosMapSet             QosMapSet;
+    tDot11fIEfils_session          fils_session;
+    tDot11fIEfils_public_key       fils_public_key;
+    tDot11fIEfils_key_confirmation fils_key_confirmation;
+    tDot11fIEfils_hlp_container    fils_hlp_container;
+    tDot11fIEfils_kde              fils_kde;
+    tDot11fIEvendor2_ie            vendor2_ie;
+    tDot11fIEQComVendorIE          QComVendorIE;
 } tDot11fAssocResponse;
 
 #define DOT11F_ASSOCRESPONSE ( 6 )
@@ -6039,16 +6407,20 @@ tANI_U32 dot11fGetPackedAssocResponseSize(tpAniSirGlobal pCtx, tDot11fAssocRespo
 #endif /* C++ */
 
 typedef struct sDot11fAuthentication{
-    tDot11fFfAuthAlgo        AuthAlgo;
-    tDot11fFfAuthSeqNo       AuthSeqNo;
-    tDot11fFfStatus          Status;
-    tDot11fIEChallengeText   ChallengeText;
-    tDot11fIERSNOpaque       RSNOpaque;
-    tDot11fIEMobilityDomain  MobilityDomain;
-    tDot11fIEFTInfo          FTInfo;
-    tDot11fIETimeoutInterval TimeoutInterval;
-    tANI_U16                 num_RICDataDesc;
-    tDot11fIERICDataDesc     RICDataDesc[2];
+    tDot11fFfAuthAlgo              AuthAlgo;
+    tDot11fFfAuthSeqNo             AuthSeqNo;
+    tDot11fFfStatus                Status;
+    tDot11fIEChallengeText         ChallengeText;
+    tDot11fIERSNOpaque             RSNOpaque;
+    tDot11fIEMobilityDomain        MobilityDomain;
+    tDot11fIEFTInfo                FTInfo;
+    tDot11fIETimeoutInterval       TimeoutInterval;
+    tANI_U16                       num_RICDataDesc;
+    tDot11fIERICDataDesc           RICDataDesc[2];
+    tDot11fIEfils_nonce            fils_nonce;
+    tDot11fIEfils_session          fils_session;
+    tDot11fIEfils_wrapped_data     fils_wrapped_data;
+    tDot11fIEfils_assoc_delay_info fils_assoc_delay_info;
 } tDot11fAuthentication;
 
 #define DOT11F_AUTHENTICATION ( 7 )
@@ -6114,9 +6486,11 @@ typedef struct sDot11fBeacon{
     tDot11fIEOperatingMode        OperatingMode;
     tDot11fIEWiderBWChanSwitchAnn WiderBWChanSwitchAnn;
     tDot11fIEOBSSScanParameters   OBSSScanParameters;
+    tDot11fIEfils_indication      fils_indication;
     tDot11fIEVendor1IE            Vendor1IE;
     tDot11fIEvendor2_ie           vendor2_ie;
     tDot11fIEVendor3IE            Vendor3IE;
+    tDot11fIEhs20vendor_ie        hs20vendor_ie;
     tDot11fIEChannelSwitchWrapper ChannelSwitchWrapper;
     tDot11fIEQComVendorIE         QComVendorIE;
     tDot11fIEESEVersion           ESEVersion;
@@ -6195,9 +6569,11 @@ typedef struct sDot11fBeacon2{
     tDot11fIEOperatingMode        OperatingMode;
     tDot11fIEWiderBWChanSwitchAnn WiderBWChanSwitchAnn;
     tDot11fIEOBSSScanParameters   OBSSScanParameters;
+    tDot11fIEfils_indication      fils_indication;
     tDot11fIEVendor1IE            Vendor1IE;
     tDot11fIEvendor2_ie           vendor2_ie;
     tDot11fIEVendor3IE            Vendor3IE;
+    tDot11fIEhs20vendor_ie        hs20vendor_ie;
     tDot11fIEChannelSwitchWrapper ChannelSwitchWrapper;
     tDot11fIEQComVendorIE         QComVendorIE;
     tDot11fIEESEVersion           ESEVersion;
@@ -6264,9 +6640,11 @@ typedef struct sDot11fBeaconIEs{
     tDot11fIEOperatingMode        OperatingMode;
     tDot11fIEWiderBWChanSwitchAnn WiderBWChanSwitchAnn;
     tDot11fIEOBSSScanParameters   OBSSScanParameters;
+    tDot11fIEfils_indication      fils_indication;
     tDot11fIEVendor1IE            Vendor1IE;
     tDot11fIEvendor2_ie           vendor2_ie;
     tDot11fIEVendor3IE            Vendor3IE;
+    tDot11fIEhs20vendor_ie        hs20vendor_ie;
     tDot11fIEChannelSwitchWrapper ChannelSwitchWrapper;
     tDot11fIEQComVendorIE         QComVendorIE;
 } tDot11fBeaconIEs;
@@ -6887,9 +7265,11 @@ typedef struct sDot11fProbeResponse{
     tDot11fIEVHTExtBssLoad        VHTExtBssLoad;
     tDot11fIEExtCap               ExtCap;
     tDot11fIEOBSSScanParameters   OBSSScanParameters;
+    tDot11fIEfils_indication      fils_indication;
     tDot11fIEVendor1IE            Vendor1IE;
     tDot11fIEvendor2_ie           vendor2_ie;
     tDot11fIEVendor3IE            Vendor3IE;
+    tDot11fIEhs20vendor_ie        hs20vendor_ie;
     tDot11fIEChannelSwitchWrapper ChannelSwitchWrapper;
     tDot11fIEQComVendorIE         QComVendorIE;
     tDot11fIEESEVersion           ESEVersion;
@@ -7056,6 +7436,8 @@ typedef struct sDot11fReAssocRequest{
     tDot11fIEOperatingMode      OperatingMode;
     tDot11fIEQosMapSet          QosMapSet;
     tDot11fIEvendor2_ie         vendor2_ie;
+    tDot11fIEQComVendorIE       QComVendorIE;
+    tDot11fIEhs20vendor_ie      hs20vendor_ie;
 } tDot11fReAssocRequest;
 
 #define DOT11F_REASSOCREQUEST ( 43 )
@@ -7106,6 +7488,7 @@ typedef struct sDot11fReAssocResponse{
     tDot11fIEOBSSScanParameters OBSSScanParameters;
     tDot11fIEQosMapSet          QosMapSet;
     tDot11fIEvendor2_ie         vendor2_ie;
+    tDot11fIEQComVendorIE       QComVendorIE;
 } tDot11fReAssocResponse;
 
 #define DOT11F_REASSOCRESPONSE ( 44 )
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/dphGlobal.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/dphGlobal.h
index 2ea951b0899..4cd9bfc6564 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/dphGlobal.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/dphGlobal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -501,20 +501,20 @@ typedef struct sDphHashNode
 
     uint8_t nss;
 
-    /* When a station with already an existing dph entry tries to
+    tANI_U8 isDisassocDeauthInProgress;
+    bool sta_deletion_in_progress;
+    tANI_S8 del_sta_ctx_rssi;
+    uint8_t sub20_dynamic_channelwidth;
+    /* Flag indicating connected STA doesn't support ECSA */
+    uint8_t non_ecsa_capable;
 
+    /* When a station with an existing dph entry tries to
      * associate again, the old dph entry will be zeroed out except
-
      * for the next pointer. The next pointer must be defined at the
-
      * end of the structure.
-
      */
-
-    tANI_U8 isDisassocDeauthInProgress;
-    bool sta_deletion_in_progress;
     struct sDphHashNode  *next;
-    tANI_S8 del_sta_ctx_rssi;
+    /* DO NOT ADD NEW MEMBER AFTER MEMBER *next */
 } tDphHashNode, *tpDphHashNode;
 
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/parserApi.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/parserApi.h
index 6da39f5b9ce..6db362dbecb 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/parserApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/parserApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -67,10 +67,25 @@ struct sAvoidChannelIE {
 	uint8_t oui[3];
 	/* following must be 0x01 */
 	uint8_t type;
+	uint8_t type_len;
 	uint8_t channel;
 };
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
+/**
+ * struct vendor_ie_sub20_channelwidth
+ * @elem_id: Vendor Sub20 Channel Width Element id
+ * @elem_len: Vendor Sub20 Channel Width Element data length
+ * @sub20_capability: sub20 capability
+ * @new_sub20_channelwidth: new sub20 channelwidth
+ */
+struct vendor_ie_sub20_channelwidth {
+        uint8_t    elem_id;
+        uint8_t    elem_len;
+        uint8_t    sub20_capability;
+        uint8_t    new_sub20_channelwidth;
+} __packed;
+
 #define SIZE_OF_FIXED_PARAM ( 12 )
 #define SIZE_OF_TAG_PARAM_NUM  ( 1 )
 #define SIZE_OF_TAG_PARAM_LEN ( 1 )
@@ -90,6 +105,91 @@ typedef struct sSirCountryInformation
     } channelTransmitPower[COUNTRY_INFO_MAX_CHANNEL];
 } tSirCountryInformation,*tpSirCountryInformation;
 
+#ifdef WLAN_FEATURE_FILS_SK
+
+#define SIR_MAX_IDENTIFIER_CNT 7
+#define SIR_CACHE_IDENTIFIER_LEN 2
+#define SIR_HESSID_LEN 6
+#define SIR_MAX_KEY_CNT 7
+#define SIR_MAX_KEY_LEN 48
+
+/*
+ * struct public_key_identifier: structure for public key identifier
+ * present in fils indication element
+ * @is_present: if Key info is present
+ * @key_cnt:  number of keys present
+ * @key_type: type of key used
+ * @length: length of key
+ * @key: key data
+ */
+
+struct public_key_identifier {
+	bool is_present;
+	uint8_t key_cnt;
+	uint8_t key_type;
+	uint8_t length;
+    uint8_t key[SIR_MAX_KEY_CNT][SIR_MAX_KEY_LEN];
+};
+
+/*
+ * struct fils_cache_identifier: structure for fils cache identifier
+ * present in fils indication element
+ * @is_present: if cache identifier is present
+ * @identifier: cache identifier
+ */
+struct fils_cache_identifier {
+	bool is_present;
+	uint8_t identifier[SIR_CACHE_IDENTIFIER_LEN];
+};
+
+/*
+ * struct fils_hessid: structure for fils hessid
+ * present in fils indication element
+ * @is_present: if hessid info is present
+ * @hessid: hessid data
+ */
+struct fils_hessid {
+	bool is_present;
+	uint8_t hessid[SIR_HESSID_LEN];
+};
+
+/*
+ * struct fils_realm_identifier: structure for fils_realm_identifier
+ * present in fils indication element
+ * @is_present: if realm info is present
+ * @realm_cnt: realm count
+ * @realm: realm data
+ */
+struct fils_realm_identifier {
+	bool is_present;
+	uint8_t realm_cnt;
+	uint8_t realm[SIR_MAX_REALM_COUNT][SIR_REALM_LEN];
+};
+
+/*
+ * struct sir_fils_indication: structure for fils indication element
+ * @is_present: if indication element is present
+ * @is_ip_config_supported: if IP config is supported
+ * @is_fils_sk_auth_supported: if fils sk suppprted
+ * @is_fils_sk_auth_pfs_supported: if fils sk with pfs supported
+ * @is_pk_auth_supported: if fils public key supported
+ * @cache_identifier: fils cache idenfier info
+ * @hessid: fils hessid info
+ * @realm_identifier: fils realm info
+ * @key_identifier: fils key identifier info
+ */
+struct sir_fils_indication {
+	bool is_present;
+	uint8_t is_ip_config_supported;
+	uint8_t is_fils_sk_auth_supported;
+	uint8_t is_fils_sk_auth_pfs_supported;
+	uint8_t is_pk_auth_supported;
+	struct fils_cache_identifier cache_identifier;
+	struct fils_hessid hessid;
+	struct fils_realm_identifier realm_identifier;
+	struct public_key_identifier key_identifier;
+};
+#endif
 
 /* Structure common to Beacons & Probe Responses */
 typedef struct sSirProbeRespBeacon
@@ -173,6 +273,7 @@ typedef struct sSirProbeRespBeacon
     tANI_U8                   Vendor1IEPresent;
     tDot11fIEvendor2_ie       vendor2_ie;
     tANI_U8                   Vendor3IEPresent;
+    tDot11fIEhs20vendor_ie    hs20vendor_ie;
     tDot11fIEIBSSParams       IBSSParams;
 
 #ifdef FEATURE_AP_MCC_CH_AVOIDANCE
@@ -181,6 +282,10 @@ typedef struct sSirProbeRespBeacon
 #ifdef FEATURE_WLAN_ESE
     uint8_t    is_ese_ver_ie_present;
 #endif
+    uint8_t                   vendor_sub20_capability;
+#ifdef WLAN_FEATURE_FILS_SK
+    struct sir_fils_indication fils_ind;
+#endif
 } tSirProbeRespBeacon, *tpSirProbeRespBeacon;
 
 // probe Request structure
@@ -256,6 +361,8 @@ typedef struct sSirAssocReq
 #endif
     tDot11fIEExtCap           ExtCap;
     tDot11fIEvendor2_ie       vendor2_ie;
+    uint8_t                   vendor_sub20_capability;
+    tDot11fIEhs20vendor_ie    hs20vendor_ie;
 } tSirAssocReq, *tpSirAssocReq;
 
 
@@ -313,6 +420,12 @@ typedef struct sSirAssocRsp
     tDot11fIETimeoutInterval  TimeoutInterval;
 #endif
     tDot11fIEvendor2_ie       vendor2_ie;
+    uint8_t                   vendor_sub20_capability;
+#ifdef WLAN_FEATURE_FILS_SK
+    tDot11fIEfils_session fils_session;
+    tDot11fIEfils_key_confirmation fils_key_auth;
+    tDot11fIEfils_kde fils_kde;
+#endif
 } tSirAssocRsp, *tpSirAssocRsp;
 
 #if defined(FEATURE_WLAN_ESE_UPLOAD)
@@ -488,6 +601,7 @@ sirConvertAssocReqFrame2Struct(struct sAniSirGlobal *pMac,
 
 tSirRetStatus
 sirConvertAssocRespFrame2Struct(struct sAniSirGlobal *pMac,
+                                tpPESession psessionEntry,
                                 tANI_U8 * frame,
                                 tANI_U32 len,
                                 tpSirAssocRsp assoc);
@@ -632,6 +746,22 @@ populate_dot11f_avoid_channel_ie(tpAniSirGlobal mac_ctx,
 				 tpPESession session_entry);
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+void
+populate_dot11f_sub_20_channel_width_ie(tpAniSirGlobal mac_ctx_ptr,
+                                        tDot11fIEQComVendorIE *dot11f_ptr,
+                                        tpPESession pe_session);
+#else
+static inline void
+populate_dot11f_sub_20_channel_width_ie(
+	tpAniSirGlobal mac_ctx_ptr,
+	tDot11fIEQComVendorIE *dot11f_ptr,
+	tpPESession pe_session)
+{
+	dot11f_ptr->Sub20Info.present = false;
+	return;
+}
+#endif
 /// Populate a tDot11fIECountry
 tSirRetStatus
 PopulateDot11fCountry(tpAniSirGlobal    pMac,
@@ -963,7 +1093,6 @@ void PopulateDot11fAssocRspRates ( tpAniSirGlobal pMac, tDot11fIESuppRates *pSup
 int FindIELocation( tpAniSirGlobal pMac,
                            tpSirRSNie pRsnIe,
                            tANI_U8 EID);
-#endif
 
 #ifdef WLAN_FEATURE_11AC
 tSirRetStatus
@@ -1010,3 +1139,38 @@ tSirRetStatus sirvalidateandrectifyies(tpAniSirGlobal pMac,
                                        tANI_U8 *pMgmtFrame,
                                        tANI_U32 nFrameBytes,
                                        tANI_U32 *nMissingRsnBytes);
+
+/**
+ * sir_copy_hs20_ie() - Update HS 2.0 Information Element.
+ * @dest: dest HS IE buffer to be updated
+ * @src: src HS IE buffer
+ *
+ * Update HS2.0 IE info from src to dest
+ *
+ * Return: void
+ */
+void sir_copy_hs20_ie(tDot11fIEhs20vendor_ie *dest,
+                      tDot11fIEhs20vendor_ie *src);
+
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * populate_dot11f_fils_params() - Populate FILS IE to frame
+ * @mac_ctx: global mac context
+ * @frm: Assoc request frame
+ * @pe_session: PE session
+ *
+ * This API is used to populate FILS IE to Association request
+ *
+ * Return: None
+ */
+void populate_dot11f_fils_params(tpAniSirGlobal mac_ctx,
+                 tDot11fAssocRequest *frm,
+                 tpPESession pe_session);
+#else
+static inline void populate_dot11f_fils_params(tpAniSirGlobal mac_ctx,
+                 tDot11fAssocRequest *frm,
+                 tpPESession pe_session)
+{}
+#endif
+
+#endif  /* __PARSE_H__ */
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/sirParams.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/sirParams.h
index 571375da133..826ae6c5fc1 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/sirParams.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/sirParams.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -535,11 +535,11 @@ typedef struct sSirMbMsgP2p
 
 #define SIR_HAL_FLUSH_LOG_TO_FW            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 218)
 
-#define SIR_HAL_GET_RSSI                   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 219)
+#define SIR_HAL_GET_PEER_INFO              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 219)
 
 #define SIR_HAL_SMPS_FORCE_MODE_IND        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 220)
 
-/* 221 unused */
+#define SIR_HAL_GET_ISOLATION              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 221)
 
 #define SIR_HAL_START_ROAM_CANDIDATE_LOOKUP_REQ (SIR_HAL_ITC_MSG_TYPES_BEGIN + 222)
 
@@ -725,8 +725,7 @@ typedef struct sSirMbMsgP2p
 #define SIR_HAL_CONFIG_GUARD_TIME          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 315)
 #define SIR_HAL_SET_PASSPOINT_LIST_REQ     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 316)
 #define SIR_HAL_RESET_PASSPOINT_LIST_REQ   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 317)
-#define SIR_HAL_EXTSCAN_SET_SSID_HOTLIST_REQ   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 318)
-
+#define SIR_HAL_DSRC_RADIO_CHAN_STATS_REQ  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 318)
 #define SIR_HAL_OCB_SET_CONFIG_CMD          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 319)
 #define SIR_HAL_OCB_SET_UTC_TIME_CMD        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 320)
 #define SIR_HAL_OCB_START_TIMING_ADVERT_CMD (SIR_HAL_ITC_MSG_TYPES_BEGIN + 321)
@@ -735,7 +734,7 @@ typedef struct sSirMbMsgP2p
 #define SIR_HAL_DCC_GET_STATS_CMD           (SIR_HAL_ITC_MSG_TYPES_BEGIN + 324)
 #define SIR_HAL_DCC_CLEAR_STATS_CMD         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 325)
 #define SIR_HAL_DCC_UPDATE_NDL_CMD          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 326)
-#define SIR_HAL_FW_MEM_DUMP_REQ            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 327)
+/* FW Memory Dump feature is deprecated */
 #define SIR_HAL_START_STOP_LOGGING          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 328)
 #define SIR_HAL_EXTSCAN_STATUS_IND          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 329)
 
@@ -784,6 +783,21 @@ typedef struct sSirMbMsgP2p
 #define SIR_HAL_STA_INACTIVITY_TIMEOUT      (SIR_HAL_ITC_MSG_TYPES_BEGIN + 365)
 #define SIR_HAL_RX_CHN_STATUS_EVENT         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 366)
 
+#ifdef WLAN_FEATURE_LINK_LAYER_STATS
+#define SIR_HAL_LL_STATS_EXT_SET_THRESHOLD  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 367)
+#endif
+
+#define SIR_HAL_SET_REORDER_TIMEOUT_CMDID   (SIR_HAL_ITC_MSG_TYPES_BEGIN + 368)
+#define SIR_HAL_SET_RX_BLOCKSIZE_CMDID      (SIR_HAL_ITC_MSG_TYPES_BEGIN + 369)
+#define SIR_HAL_GET_CHAIN_RSSI_REQ          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 370)
+#define SIR_HAL_POWER_DEBUG_STATS_REQ       (SIR_HAL_ITC_MSG_TYPES_BEGIN + 371)
+#define SIR_HAL_GET_PEER_INFO_EXT           (SIR_HAL_ITC_MSG_TYPES_BEGIN + 372)
+#define SIR_HAL_GET_PEER_INFO_EXT_IND       (SIR_HAL_ITC_MSG_TYPES_BEGIN + 373)
+#define SIR_HAL_ACTION_FRAME_RANDOM_MAC     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 374)
+
+#define SIR_HAL_PEER_FLUSH_PENDING          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 375)
+#define SIR_HAL_SET_AC_TXQ_OPTIMIZE         (SIR_HAL_ITC_MSG_TYPES_BEGIN + 376)
+
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
 
 // CFG message types
@@ -825,14 +839,8 @@ typedef struct sSirMbMsgP2p
 
 // Message from Hal to send out a DEL-TS indication
 #define SIR_LIM_DEL_TS_IND                  (SIR_LIM_ITC_MSG_TYPES_BEGIN + 0xE)
-//Message from HAL to send BA global timer timeout
-#define SIR_LIM_ADD_BA_IND                  (SIR_LIM_ITC_MSG_TYPES_BEGIN + 0xF)
-//Indication from HAL to delete all the BA sessions when the BA activity check timer is disabled
-#define SIR_LIM_DEL_BA_ALL_IND                  (SIR_LIM_ITC_MSG_TYPES_BEGIN + 0x10)
 //Indication from HAL to delete Station context
 #define SIR_LIM_DELETE_STA_CONTEXT_IND          (SIR_LIM_ITC_MSG_TYPES_BEGIN + 0x11)
-//Indication from HAL to delete BA
-#define SIR_LIM_DEL_BA_IND                      (SIR_LIM_ITC_MSG_TYPES_BEGIN + 0x12)
 #define SIR_LIM_UPDATE_BEACON                   (SIR_LIM_ITC_MSG_TYPES_BEGIN + 0x13)
 
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/utilsApi.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/utilsApi.h
index e130f969b10..d81ee004349 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/utilsApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/utilsApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -58,7 +58,7 @@ extern tANI_U32 gPktAllocCnt, gPktFreeCnt;
 extern  VOS_TRACE_LEVEL getVosDebugLevel(tANI_U32 debugLevel);
 
 /// Debug dumps
-extern void logPrintf(tpAniSirGlobal, tANI_U32, tANI_U32 arg1, tANI_U32 arg2, tANI_U32 arg3, tANI_U32 arg4);
+extern int logPrintf(tpAniSirGlobal, tANI_U32, tANI_U32 arg1, tANI_U32 arg2, tANI_U32 arg3, tANI_U32 arg4);
 
 /// RTAI dump
 extern int logRtaiDump(tpAniSirGlobal, tANI_U32, tANI_U32, tANI_U32, tANI_U32, tANI_U32, tANI_U8 *);
@@ -72,7 +72,6 @@ logDeinit(tpAniSirGlobal );
 extern tSirRetStatus cfgInit(tpAniSirGlobal);
 extern void cfgDeInit(tpAniSirGlobal);
 
-// -------------------------------------------------------------------
 /**
  * sirDumpBuf()
  *
@@ -89,9 +88,25 @@ extern void cfgDeInit(tpAniSirGlobal);
  * @param pBuf: buffer pointer
  * @return None.
  */
+void sirDumpBuf(tpAniSirGlobal pMac, tANI_U8 modId, tANI_U32 level,
+		tANI_U8 *buf, tANI_U32 size);
 
-void sirDumpBuf(tpAniSirGlobal pMac, tANI_U8 modId, tANI_U32 level, tANI_U8 *buf, tANI_U32 size);
-
+#ifdef WLAN_FEATURE_DSRC
+/**
+ * sir_copy_sir_ocb_config() - Performs deep copy of an OCB configuration
+ * @src: the source configuration
+ *
+ * Return: pointer to the copied OCB configuration
+ */
+struct sir_ocb_config *
+sir_copy_sir_ocb_config(const struct sir_ocb_config *src);
+#else
+static inline struct sir_ocb_config *
+sir_copy_sir_ocb_config(const struct sir_ocb_config *src)
+{
+	return NULL;
+}
+#endif /* WLAN_FEATURE_DSRC */
 
 // --------------------------------------------------------------------
 /**
@@ -706,7 +721,7 @@ halRoundS32(tANI_S32 p)
     else
         k = p;
 
-        return(k);
+    return(k);
 }
 
 /* New functions for endianness conversion */
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limFTDefs.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limFTDefs.h
index 9d3ba2a9dad..ca224c8fbc5 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limFTDefs.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limFTDefs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2015, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -56,6 +56,7 @@ typedef struct sSirFTPreAuthReq
 {
    tANI_U16    messageType;      // eWNI_SME_FT_PRE_AUTH_REQ
    tANI_U16    length;
+   tANI_U32    dot11mode;
    tANI_BOOLEAN bPreAuthRspProcessed; /* Track if response is processed for this request
                                          We expect only one response per request. */
    tANI_U8     preAuthchannelNum;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limGlobal.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limGlobal.h
index f9b16a7a7e3..5adc4f15bc0 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limGlobal.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limGlobal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -45,7 +45,7 @@
 #include "sirMacPropExts.h"
 #include "sirCommon.h"
 #include "sirDebug.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "csrApi.h"
 #include "sapApi.h"
 #include "dot11f.h"
@@ -68,7 +68,11 @@
 #define IS_5G_BAND(__rfBand)     ((__rfBand & 0x3) == 0x2)
 #define IS_24G_BAND(__rfBand)    ((__rfBand & 0x3) == 0x1)
 
-#define LIM_MAX_CSA_IE_UPDATES                  ( 5 )
+#ifdef CHANNEL_HOPPING_ALL_BANDS
+#define CHAN_HOP_ALL_BANDS_ENABLE        1
+#else
+#define CHAN_HOP_ALL_BANDS_ENABLE        0
+#endif
 
 // enums exported by LIM are as follows
 
@@ -257,6 +261,11 @@ typedef struct sLimMlmJoinReq
     tSirMacRateSet         operationalRateSet;
     tANI_U8                 sessionId;
     tSirBssDescription     bssDescription;
+    /*
+     * WARNING: Pls make bssDescription as last variable in struct
+     * tLimMlmJoinReq as it has ieFields followed after this bss
+     * description. Adding a variable after this corrupts the ieFields
+     */
 } tLimMlmJoinReq, *tpLimMlmJoinReq;
 
 typedef struct sLimMlmScanReq
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limSession.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limSession.h
index e55e4dcec6d..a8eafaa348a 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limSession.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limSession.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -28,6 +28,9 @@
 #if !defined( __LIM_SESSION_H )
 #define __LIM_SESSION_H
 
+#ifdef WLAN_FEATURE_FILS_SK
+#include "lim_fils_defs.h"
+#endif
 /**=========================================================================
 
   \file  limSession.h
@@ -358,6 +361,8 @@ typedef struct sPESession           // Added to Support BT-AMP
     tLimChannelSwitchInfo  gLimChannelSwitch;
     /* *********************End 11H related*****************************/
 
+    uint8_t    lim_sub20_channel_switch_bandwidth;
+
     /*Flag to Track Status/Indicate HBFailure on this session */
     tANI_BOOLEAN LimHBFailureStatus;
     tANI_U32           gLimPhyMode;
@@ -493,6 +498,8 @@ typedef struct sPESession           // Added to Support BT-AMP
 #ifdef FEATURE_WLAN_ESE
     uint8_t is_ese_version_ie_present;
 #endif
+    /* HS 2.0 Indication */
+    tDot11fIEhs20vendor_ie hs20vendor_ie;
     /* flag to indicate country code in beacon */
     tANI_U8 countryInfoPresent;
     uint8_t vdev_nss;
@@ -501,6 +508,10 @@ typedef struct sPESession           // Added to Support BT-AMP
     /* Supported NSS is intersection of self and peer NSS */
     bool supported_nss_1x1;
     bool is_ext_caps_present;
+    tDot11fIEHTCaps ht_caps;
+    tDot11fIEVHTCaps vht_caps;
+    tDot11fIEHTInfo ht_operation;
+    tDot11fIEVHTOperation vht_operation;
     bool is_vendor_specific_vhtcaps;
     uint8_t vendor_specific_vht_ie_type;
     uint8_t vendor_specific_vht_ie_sub_type;
@@ -508,7 +519,16 @@ typedef struct sPESession           // Added to Support BT-AMP
     uint16_t beacon_tx_rate;
     uint8_t *access_policy_vendor_ie;
     uint8_t access_policy;
-
+    uint8_t sap_sub20_channelwidth;
+    uint8_t sub20_channelwidth;
+    uint8_t vht_channel_width;
+    /* Number of STAs that do not support ECSA capability */
+    uint8_t lim_non_ecsa_cap_num;
+    uint32_t sta_auth_retries_for_code17;
+    bool force_24ghz_in_ht20;
+#ifdef WLAN_FEATURE_FILS_SK
+    struct pe_fils_session *fils_info;
+#endif
 } tPESession, *tpPESession;
 
 /*-------------------------------------------------------------------------
@@ -652,4 +672,13 @@ uint8_t pe_count_session_with_sme_session_id(tpAniSirGlobal mac_ctx,
 	uint8_t sme_session_id);
 
 int pe_get_active_session_count(tpAniSirGlobal mac_ctx);
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * pe_delete_fils_info: API to delete fils session info
+ * @session: pe session
+ *
+ * Return: void
+ */
+void pe_delete_fils_info(tpPESession session);
+#endif
 #endif //#if !defined( __LIM_SESSION_H )
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/lim_fils_defs.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/lim_fils_defs.h
new file mode 100755
index 00000000000..87279cd0d59
--- /dev/null
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/lim_fils_defs.h
@@ -0,0 +1,286 @@
+/*
+ * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef __LIM_FILS_DEFS_H
+#define __LIM_FILS_DEFS_H
+
+#include "palTypes.h"
+
+#define FILS_EAP_TLV_MAX_DATA_LEN 255
+#define FILS_SHA256_128_AUTH_TAG 16
+#define FILS_SHA256_256_AUTH_TAG 32
+
+#define FILS_SHA256_CRYPTO_TYPE "hmac(sha256)"
+#define FILS_SHA384_CRYPTO_TYPE "hmac(sha384)"
+
+/* RFC 6696 */
+#define RMSK_LABEL "Re-authentication Master Session Key@ietf.org"
+
+/* 12.12.2.5.3 80211-ai draft */
+#define PTK_KEY_LABEL "FILS PTK Derivation"
+#define MAX_ICK_LEN 48
+#define MAX_KEK_LEN 64
+#define MAX_TK_LEN 32
+#define MAX_KEY_AUTH_DATA_LEN 48
+#define MAX_GTK_LEN 255
+#define MAX_IGTK_LEN 255
+#define SIR_FILS_SESSION_IE_LEN 11
+#define FILS_KEY_RSC_LEN 8
+#define FILS_MAX_KEY_AUTH_LEN (MAX_ICK_LEN + MAX_KEK_LEN + MAX_TK_LEN)
+
+#define IPN_LEN 6
+#define FILS_SESSION_LENGTH 8
+#define FILS_MAX_KDE_LIST_LEN 255
+
+/* 12.12.2.5.3 80211-ai draft */
+#define FILS_SHA384_KEK_LEN 64
+#define FILS_SHA256_KEK_LEN 32
+
+/* 12.12.2.5.3 80211-ai draft */
+#define FILS_SHA256_ICK_LEN 32
+#define FILS_SHA384_ICK_LEN 48
+
+#define TK_LEN_TKIP 32
+#define TK_LEN_CCMP 16
+#define TK_LEN_AES_128_CMAC 32
+
+#define FILS_SHA256_PKM_LEN 32
+#define FILS_SHA384_PKM_LEN 48
+
+#define PMKID_LEN 16
+
+#define MAX_PRF_INTERATIONS_COUNT 255
+
+/* 9.4.2.180 FILS Session element */
+#define SIR_FILS_SESSION_LENGTH    8
+#define SIR_FILS_SESSION_EXT_EID   4
+
+/* 9.4.2.190 FILS Nonce element */
+#define SIR_FILS_NONCE_LENGTH      16
+#define SIR_FILS_NONCE_EXT_EID   13
+
+/*9.4.2.188 FILS Wrapped Data element */
+#define SIR_FILS_WRAPPED_DATA_MAX_SIZE 255
+#define SIR_FILS_WRAPPED_DATA_EXT_EID   8
+
+#define MAX_IE_LENGTH 255
+
+/* RFC 6696 5.3.1: EAP-Initiate/Re-auth-Start Packet */
+#define SIR_FILS_EAP_REAUTH_PACKET_TYPE 1
+#define SIR_FILS_EAP_INIT_PACKET_TYPE 2
+
+#define FILS_AUTH_TAG_MAX_LENGTH 32
+
+#define SIR_FILS_OPTIONAL_DATA_LEN 3
+/* RFC 6696 4.3: RiK deriavtion */
+#define SIR_FILS_RIK_LABEL "Re-authentication Integrity Key@ietf.org"
+
+/* RFC 6696 5.3.1: EAP-Initiate/Re-auth-Start Packet */
+#define SIR_FILS_EAP_TLV_KEYNAME_NAI 1
+#define SIR_FILS_EAP_TLV_R_RK_LIFETIME 2
+#define SIR_FILS_EAP_TLV_R_MSK_LIFETIME 3
+#define SIR_FILS_EAP_TLV_DOMAIN_NAME 4
+#define SIR_FILS_EAP_TLV_CRYPTO_LIST 5
+#define SIR_FILS_EAP_TLV_AUTH_INDICATION 6
+
+#define DATA_TYPE_GTK 1
+#define DATA_TYPE_IGTK 9
+#define KEY_RSC_LEN 8
+#define KDE_IE_DATA_OFFSET 4
+#define KDE_DATA_TYPE_OFFSET 3
+#define GTK_OFFSET 2
+#define IPN_OFFSET 2
+#define IGTK_OFFSET 8
+
+#define KDE_OUI_TYPE   "\x00\x0F\xAC"
+#define KDE_OUI_TYPE_SIZE  3
+
+#ifdef WLAN_FEATURE_FILS_SK
+#define MAX_PMK_LEN 48
+#define FILS_MAX_KEYNAME_NAI_LENGTH 255
+#define FILS_MAX_REALM_LEN 255
+#define FILS_MAX_RRK_LENGTH 64
+
+struct cds_fils_connection_info {
+	bool is_fils_connection;
+	uint8_t keyname_nai[FILS_MAX_KEYNAME_NAI_LENGTH];
+	uint32_t key_nai_length;
+	uint16_t sequence_number;
+	uint8_t r_rk[FILS_MAX_RRK_LENGTH];
+	uint32_t r_rk_length;
+	uint8_t realm[FILS_MAX_REALM_LEN];
+	uint32_t realm_len;
+	uint8_t akm_type;
+	uint8_t auth_type;
+	uint8_t pmk[MAX_PMK_LEN];
+	uint8_t pmk_len;
+	uint8_t pmkid[16];
+};
+#endif
+/*
+ * struct eap_auth_reserved: this structure defines flags format in eap packets
+ * as defined in RFC 6696 5.3.1
+ * flag_r:
+ * flag_b:
+ * flag_l:
+ */
+struct eap_auth_reserved {
+	uint8_t flag_r:1;
+	uint8_t flag_b:1;
+	uint8_t flag_l:1;
+	uint8_t reverved:5;
+};
+
+/*
+ * enum fils_erp_cryptosuite: this enum defines the cryptosuites used
+ * to calculate auth tag and auth tag length as defined by RFC 6696 5.3.1
+ * @HMAC_SHA256_64: sha256 with auth tag len as 64 bits
+ * @HMAC_SHA256_128: sha256 with auth tag len as 128 bits
+ * @HMAC_SHA256_256: sha256 with auth tag len as 256 bits
+ */
+enum fils_erp_cryptosuite {
+	INVALID = 0, /* reserved */
+	HMAC_SHA256_64,
+	HMAC_SHA256_128,
+	HMAC_SHA256_256,
+};
+
+/*
+ * struct fils_eap_tlv: this structure defines the eap header
+ * for eap packet present in warpped data element IE
+ * @type: type of packet
+ * @length: length of packet
+ * @data: pointer to eap data
+ */
+struct fils_eap_tlv {
+	uint8_t type;
+	uint8_t length;
+	uint8_t data[FILS_EAP_TLV_MAX_DATA_LEN];
+};
+
+/* struct fils_auth_rsp_info: this structure saves the info from
+ * fils auth response.
+ * @keyname: pointer to keyname nai
+ * @keylength: keyname nai length
+ * @domain_name: pointer to domain name
+ * @domain_len: domain length
+ * @r_rk_lifetime: rRk lifetime
+ * @r_msk_lifetime: RMSK lifetime
+ * @sequence: sequence number to be validated
+ * @fils_nonce: anonce
+ * @assoc_delay: time in ms, DUT needs to wait after association req
+ */
+struct fils_auth_rsp_info {
+	uint8_t *keyname;
+	uint8_t keylength;
+	uint8_t *domain_name;
+	uint8_t domain_len;
+	uint32_t r_rk_lifetime;
+	uint32_t r_msk_lifetime;
+	uint16_t sequence;
+	uint8_t fils_nonce[SIR_FILS_NONCE_LENGTH];
+	uint8_t assoc_delay;
+};
+
+/*
+ * struct pe_fils_session: fils session info used in PE session
+ * @is_fils_connection: whether connection is fils or not
+ * @keyname_nai_data: keyname nai data
+ * @keyname_nai_length: keyname nai length
+ * @akm: akm type will be used
+ * @auth: authentication type
+ * @cipher: cipher type
+ * @fils_erp_reauth_pkt: pointer to fils reauth packet data
+ * @fils_erp_reauth_pkt_len: reauth packet length
+ * @fils_r_rk: pointer to fils rRk
+ * @fils_r_rk_len: fils rRk length
+ * @fils_r_ik: pointer to fils rIk
+ * @fils_r_ik_len: fils rIk length
+ * @sequence_number: sequence number needs to be used in eap packet
+ * @fils_session: fils session IE element
+ * @fils_nonce: fils snonce
+ * @rsn_ie: rsn ie used in auth request
+ * @rsn_ie_len: rsn ie length
+ * @fils_eap_finish_pkt: pointer to eap finish packet
+ * @fils_eap_finish_pkt_len: eap finish packet length
+ * @fils_rmsk: rmsk data pointer
+ * @fils_rmsk_len: rmsk data length
+ * @fils_pmk: pointer to pmk data
+ * @fils_pmk_len: pmk length
+ * @fils_pmkid: pointer to pmkid derived
+ * @auth_info: data obtained from auth response
+ * @ick: pointer to ick
+ * @ick_len: ick length
+ * @kek: pointer to kek
+ * @kek_len: kek length
+ * @tk: pointer to tk
+ * @tk_len: tk length
+ * @key_auth: data needs to be sent in assoc req, will be validated by AP
+ * @key_auth_len: key auth data length
+ * @ap_key_auth_data: data needs to be validated in assoc rsp
+ * @ap_key_auth_len:  ap key data length
+ * @gtk_len: gtk key length
+ * @gtk: pointer to gtk data
+ * @rsc: rsc value
+ * @igtk_len: igtk length
+ * @igtk: igtk data pointer
+ * @ipn: pointer to ipn data
+ */
+struct pe_fils_session {
+	bool is_fils_connection;
+	uint8_t *keyname_nai_data;
+	uint8_t keyname_nai_length;
+	uint8_t akm;
+	uint8_t auth;
+	uint8_t cipher;
+	uint8_t *fils_erp_reauth_pkt;
+	uint32_t fils_erp_reauth_pkt_len;
+	uint8_t *fils_r_rk;
+	uint8_t fils_r_rk_len;
+	uint8_t *fils_r_ik;
+	uint32_t fils_r_ik_len;
+	uint16_t sequence_number;
+	uint8_t fils_session[SIR_FILS_SESSION_LENGTH];
+	uint8_t fils_nonce[SIR_FILS_NONCE_LENGTH];
+	uint8_t rsn_ie[MAX_IE_LENGTH];
+	uint8_t rsn_ie_len;
+	uint8_t *fils_eap_finish_pkt;
+	uint8_t fils_eap_finish_pkt_len;
+	uint8_t *fils_rmsk;
+	uint8_t fils_rmsk_len;
+	uint8_t *fils_pmk;
+	uint8_t fils_pmk_len;
+	uint8_t fils_pmkid[PMKID_LEN];
+	struct fils_auth_rsp_info auth_info;
+	uint8_t ick[MAX_ICK_LEN];
+	uint8_t ick_len;
+	uint8_t kek[MAX_KEK_LEN];
+	uint8_t kek_len;
+	uint8_t tk[MAX_TK_LEN];
+	uint8_t tk_len;
+	uint8_t key_auth[MAX_KEY_AUTH_DATA_LEN];
+	uint8_t key_auth_len;
+	uint8_t ap_key_auth_data[MAX_KEY_AUTH_DATA_LEN];
+	uint8_t ap_key_auth_len;
+	uint8_t gtk_len;
+	uint8_t gtk[MAX_GTK_LEN];
+	uint8_t rsc;
+	uint8_t igtk_len;
+	uint8_t igtk[MAX_IGTK_LEN];
+	uint8_t ipn[IPN_LEN];
+};
+#endif /* __LIM_FILS_DEFS_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/lim_process_fils.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/lim_process_fils.h
new file mode 100755
index 00000000000..39863be7f8a
--- /dev/null
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/lim_process_fils.h
@@ -0,0 +1,248 @@
+/*
+ * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <wma.h>
+#include <csrApi.h>
+#include <limGlobal.h>
+#include <aniGlobal.h>
+#include <limSerDesUtils.h>
+
+#ifdef WLAN_FEATURE_FILS_SK
+
+/**
+ * lim_process_fils_auth_frame2()- This API processes fils data from auth resp
+ * @mac_ctx: mac context
+ * @session: PE session
+ * @rx_auth_frm_body: pointer to auth frame
+ *
+ * Return: true if fils data needs to be processed else false
+ */
+bool lim_process_fils_auth_frame2(tpAniSirGlobal mac_ctx,
+				tpPESession pe_session,
+				tSirMacAuthFrameBody * rx_auth_frm_body);
+
+/**
+ * lim_add_fils_data_to_auth_frame()- This API adds fils data to auth frame.
+ * Following will be added in this.
+ *     1. RSNIE
+ *     2. SNonce
+ *     3. Session
+ *     4. Wrapped data
+ * @session: PE session
+ * @body: pointer to auth frame where data needs to be added
+ *
+ * Return: None
+ */
+void lim_add_fils_data_to_auth_frame(tpPESession session, uint8_t *body);
+
+/**
+ * lim_is_valid_fils_auth_frame()- This API checks whether auth frame is a
+ * valid frame.
+ * @mac_ctx: mac context
+ * @pe_session: pe session pointer
+ * @rx_auth_frm_body: pointer to autherntication frame
+ *
+ * Return: true if frame is valid or fils is disable, false otherwise
+ */
+bool lim_is_valid_fils_auth_frame(tpAniSirGlobal mac_ctx,
+	tpPESession pe_session, tSirMacAuthFrameBody *rx_auth_frm_body);
+
+/**
+ * lim_update_fils_config()- This API updates fils session info to csr config
+ * from join request.
+ * @session: PE session
+ * @sme_join_req: pointer to join request
+ *
+ * Return: None
+ */
+void lim_update_fils_config(tpPESession session, tpSirSmeJoinReq sme_join_req);
+
+/**
+ * lim_create_fils_auth_data()- This API creates the fils auth data
+ * which needs to be sent in auth req.
+ * @mac_ctx: mac context
+ * @auth_frame: pointer to auth frame
+ * @session: PE session
+ *
+ * Return: length of fils data
+ */
+uint32_t lim_create_fils_auth_data(tpAniSirGlobal mac_ctx,
+		tpSirMacAuthFrameBody auth_frame, tpPESession session);
+
+/**
+ * lim_increase_fils_sequence_number: this API increases fils sequence number in
+ * the event of resending auth packet
+ * @session_entry: pointer to PE session
+ *
+ * Return: None
+ */
+static inline void lim_increase_fils_sequence_number(tpPESession session_entry)
+{
+	if (session_entry->fils_info->is_fils_connection)
+		session_entry->fils_info->sequence_number++;
+}
+
+/**
+ * populate_fils_connect_params() - Populate FILS connect params to join rsp
+ * @mac_ctx: Mac context
+ * @session: PE session
+ * @sme_join_rsp: SME join rsp
+ *
+ * This API copies the FILS connect params from PE session to SME join rsp
+ *
+ * Return: None
+ */
+void populate_fils_connect_params(tpAniSirGlobal mac_ctx,
+				  tpPESession session,
+				  tpSirSmeJoinRsp sme_join_rsp);
+
+/**
+ * aead_encrypt_assoc_req() - Encrypt FILS IE's in assoc request
+ * @mac_ctx: mac context
+ * @pe_session: PE session
+ * @frame: packed frame buffer
+ * @payload: length of @frame
+ *
+ * This API is used to encrypt the all the IE present after FILS session IE
+ * in Association request frame
+ *
+ * Return: VOS_STATUS
+ */
+VOS_STATUS aead_encrypt_assoc_req(tpAniSirGlobal mac_ctx,
+				  tpPESession pe_session,
+				  uint8_t *frame, uint32_t *payload);
+
+/**
+ * aead_decrypt_assoc_rsp() - API for AEAD decryption in FILS connection
+ * @mac_ctx: MAC context
+ * @session: PE session
+ * @ar: Assoc response frame structure
+ * @p_frame: frame buffer received
+ * @n_frame: length of @p_frame
+ *
+ * This API is used to decrypt the AEAD encrypted part of FILS assoc response
+ * and populate the decrypted FILS IE's to Assoc response frame structure(ar)
+ *
+ * Return: VOS_STATUS
+ */
+VOS_STATUS aead_decrypt_assoc_rsp(tpAniSirGlobal mac_ctx,
+				  tpPESession session,
+				  tDot11fAssocResponse *ar,
+				  uint8_t *p_frame, uint32_t *n_frame);
+/**
+ * lim_is_fils_connection() - Check if it is FILS connection
+ * @pe_session: PE session
+ *
+ * This API is used to check if current PE session is FILS connection
+ *
+ * Return: True if FILS connection, false if not
+ */
+static inline bool lim_is_fils_connection(tpPESession pe_session)
+{
+
+	if (!pe_session->fils_info)
+		return false;
+
+	if (pe_session->fils_info->is_fils_connection)
+		return true;
+	return false;
+}
+
+/**
+ * lim_verify_fils_params_assoc_rsp() - Verify FILS params in assoc rsp
+ * @mac_ctx: Mac context
+ * @session_entry: PE session
+ * @assoc_rsp: Assoc response received
+ * @assoc_cnf: Assoc cnf msg to be sent to MLME
+ *
+ * This API is used to match FILS params received in Assoc response
+ * with Assoc params received/derived at the Authentication stage
+ *
+ * Return: True, if successfully matches. False, otherwise
+ */
+bool lim_verify_fils_params_assoc_rsp(tpAniSirGlobal mac_ctx,
+				      tpPESession session_entry,
+				      tpSirAssocRsp assoc_rsp,
+				      tLimMlmAssocCnf *assoc_cnf);
+#else
+static inline bool lim_process_fils_auth_frame2(tpAniSirGlobal mac_ctx,
+		tpPESession pe_session, tSirMacAuthFrameBody *rx_auth_frm_body)
+{
+	return false;
+}
+
+static inline void
+lim_increase_fils_sequence_number(tpPESession session_entry)
+{ }
+
+static inline void
+lim_add_fils_data_to_auth_frame(tpPESession session, uint8_t *body)
+{
+}
+
+static inline bool lim_is_valid_fils_auth_frame(tpAniSirGlobal mac_ctx,
+	tpPESession pe_session, tSirMacAuthFrameBody *rx_auth_frm_body)
+{
+	return true;
+}
+
+static inline void
+lim_update_fils_config(tpPESession session, tpSirSmeJoinReq sme_join_req)
+{ }
+
+static inline uint32_t lim_create_fils_auth_data(tpAniSirGlobal mac_ctx,
+		tpSirMacAuthFrameBody auth_frame, tpPESession session)
+{
+	return 0;
+}
+
+static inline bool lim_is_fils_connection(tpPESession pe_session)
+{
+	return false;
+}
+
+static inline void populate_fils_connect_params(tpAniSirGlobal mac_ctx,
+						tpPESession session,
+						tpSirSmeJoinRsp sme_join_rsp)
+{ }
+
+static inline VOS_STATUS aead_encrypt_assoc_req(tpAniSirGlobal mac_ctx,
+						tpPESession pe_session,
+						uint8_t *frame,
+						uint32_t *payload)
+{
+	return VOS_STATUS_SUCCESS;
+}
+
+static inline VOS_STATUS aead_decrypt_assoc_rsp(tpAniSirGlobal mac_ctx,
+				  tpPESession session,
+				  tDot11fAssocResponse *ar,
+				  uint8_t *p_frame, uint32_t *n_frame)
+{
+	return VOS_STATUS_SUCCESS;
+}
+
+static inline bool lim_verify_fils_params_assoc_rsp(tpAniSirGlobal mac_ctx,
+			tpPESession session_entry,
+			tpSirAssocRsp assoc_rsp,
+			tLimMlmAssocCnf *assoc_cnf)
+
+{
+	return true;
+}
+#endif
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/schApi.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/schApi.h
index 130f165ba25..86d84379096 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/schApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/schApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014,2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -73,6 +73,8 @@ extern void schInitializeCfPollTemplate(tpAniSirGlobal pMac);
 /// Initialize CF End template
 extern void schInitializeCfEndTemplate(tpAniSirGlobal pMac);
 
+extern tSirRetStatus schGetParams(tpAniSirGlobal pMac, tANI_U32 params[][WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN], tANI_U8 local);
+extern void setSchEdcaParams(tpAniSirGlobal pMac, tANI_U32 params[][WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN], tpPESession psessionEntry);
 /// Process the scheduler messages
 extern void schProcessMessage(tpAniSirGlobal pMac,tpSirMsgQ pSchMsg);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAIDmgmt.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAIDmgmt.c
index 5e286287c25..ca959609239 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAIDmgmt.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAIDmgmt.c
@@ -37,7 +37,7 @@
  */
 
 #include "palTypes.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "aniGlobal.h"
 #include "cfgApi.h"
 #include "sirParams.h"
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAdmitControl.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAdmitControl.c
index 696f3e3daa7..05e03ad936c 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAdmitControl.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAdmitControl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2015, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -404,7 +404,7 @@ void limTspecDelete(tpAniSirGlobal pMac, tpLimTspecInfo pInfo)
         return;
         //pierre
     limLog(pMac, ADMIT_CONTROL_LOGLEVEL, FL("tspec entry = %d"), pInfo->idx);
-    limLog(pMac, ADMIT_CONTROL_LOGLEVEL, FL("delete tspec %p"), pInfo);
+    limLog(pMac, ADMIT_CONTROL_LOGLEVEL, FL("delete tspec %pK"), pInfo);
     pInfo->inuse = 0;
 
     return;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limApi.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limApi.c
index 60d66759c1b..6a1ac07aa26 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,7 +38,7 @@
  *
  */
 #include "palTypes.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "wniApi.h"
 #include "sirCommon.h"
 #include "sirDebug.h"
@@ -2392,7 +2392,7 @@ void limRoamOffloadSynchInd(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
      pftSessionEntry->limPrevSmeState = pftSessionEntry->limSmeState;
      pftSessionEntry->limSmeState = eLIM_SME_WT_REASSOC_STATE;
      VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_DEBUG,
-               "LFR3:%s:created session (%p) with id = %d",
+               "LFR3:%s:created session (%pK) with id = %d",
                __func__, pftSessionEntry, pftSessionEntry->peSessionId);
      /* Update the ReAssoc BSSID of the current session */
      sirCopyMacAddr(psessionEntry->limReAssocbssId, pbssDescription->bssId);
@@ -2435,6 +2435,7 @@ void lim_mon_init_session(tpAniSirGlobal mac_ptr,
 		return;
 	}
 	psession_entry->vhtCapability = 1;
+	psession_entry->sub20_channelwidth = mac_ptr->sub20_channelwidth;
 }
 
 /** -----------------------------------------------------------------
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAssocUtils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAssocUtils.c
index 1f18d9a5b30..ef8d7f21fa9 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAssocUtils.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limAssocUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -42,7 +42,7 @@
 #include "wniApi.h"
 #include "sirCommon.h"
 
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "pmmApi.h"
 #include "cfgApi.h"
 
@@ -774,12 +774,6 @@ limSendDelStaCnf(tpAniSirGlobal pMac, tSirMacAddr staDsAddr,
         }
 
         psessionEntry->limAID = 0;
-
-    } else if (
-       (mlmStaContext.cleanupTrigger == eLIM_LINK_MONITORING_DISASSOC) ||
-       (mlmStaContext.cleanupTrigger == eLIM_LINK_MONITORING_DEAUTH)) {
-       /* only for non-STA cases PE/SME is serialized */
-       return;
     }
 
     if ((mlmStaContext.cleanupTrigger ==
@@ -886,15 +880,15 @@ limSendDelStaCnf(tpAniSirGlobal pMac, tSirMacAddr staDsAddr,
                                     mlmStaContext.resultCode,
                                     mlmStaContext.protStatusCode,
                                     psessionEntry->peSessionId);
+
+            limSendSmeJoinReassocRsp(pMac, eWNI_SME_REASSOC_RSP,
+                               mlmStaContext.resultCode, mlmStaContext.protStatusCode, psessionEntry,
+                               smesessionId, smetransactionId);
             if(mlmStaContext.resultCode != eSIR_SME_SUCCESS )
             {
                 peDeleteSession(pMac, psessionEntry);
                 psessionEntry = NULL;
             }
-
-            limSendSmeJoinReassocRsp(pMac, eWNI_SME_REASSOC_RSP,
-                               mlmStaContext.resultCode, mlmStaContext.protStatusCode, psessionEntry,
-                               smesessionId, smetransactionId);
         }
         else
         {
@@ -908,17 +902,17 @@ limSendDelStaCnf(tpAniSirGlobal pMac, tSirMacAddr staDsAddr,
                                     mlmStaContext.protStatusCode,
                                     psessionEntry->peSessionId);
 
-            if(mlmStaContext.resultCode != eSIR_SME_SUCCESS)
-            {
-                peDeleteSession(pMac,psessionEntry);
-                psessionEntry = NULL;
-            }
 
             limSendSmeJoinReassocRsp(pMac, eWNI_SME_JOIN_RSP,
                                      mlmStaContext.resultCode,
                                      mlmStaContext.protStatusCode,
                                      psessionEntry, smesessionId,
                                      smetransactionId);
+            if(mlmStaContext.resultCode != eSIR_SME_SUCCESS)
+            {
+                peDeleteSession(pMac,psessionEntry);
+                psessionEntry = NULL;
+            }
         }
 
     }
@@ -2653,13 +2647,6 @@ limAddSta(
     }
 #endif
 
-    //Disable BA. It will be set as part of ADDBA negotiation.
-    for( i = 0; i < STACFG_MAX_TC; i++ )
-    {
-          pAddStaParams->staTCParams[i].txUseBA = eBA_DISABLE;
-          pAddStaParams->staTCParams[i].rxUseBA = eBA_DISABLE;
-    }
-
 #ifdef FEATURE_WLAN_TDLS
     if(pStaDs->wmeEnabled &&
       (LIM_IS_AP_ROLE(psessionEntry) ||
@@ -3335,6 +3322,19 @@ limDeleteDphHashEntry(tpAniSirGlobal pMac, tSirMacAddr staAddr, tANI_U16 staId,t
                 }
             }
 
+            if (pStaDs->non_ecsa_capable) {
+                    if (psessionEntry->lim_non_ecsa_cap_num == 0) {
+                            limLog(pMac, LOGE,
+                                   FL("Non ECSA sta cnt 0, sta: %d is ecsa\n"),
+                                   staId);
+                    } else {
+                            psessionEntry->lim_non_ecsa_cap_num--;
+                            limLog(pMac, LOGE,
+                                   FL("reducing the non ECSA num to %d"),
+                                   psessionEntry->lim_non_ecsa_cap_num);
+                    }
+            }
+
             if (LIM_IS_IBSS_ROLE(psessionEntry))
                 limIbssDecideProtectionOnDelete(pMac, pStaDs, &beaconParams, psessionEntry);
 
@@ -3362,8 +3362,6 @@ limDeleteDphHashEntry(tpAniSirGlobal pMac, tSirMacAddr staAddr, tANI_U16 staId,t
     }
 }
 
-
-
 /**
  * limCheckAndAnnounceJoinSuccess()
  *
@@ -3512,6 +3510,8 @@ limCheckAndAnnounceJoinSuccess(tpAniSirGlobal pMac,
                     "VHT caps are present in vendor specific IE"));
     }
 
+    /* Update HS 2.0 Information Element */
+    sir_copy_hs20_ie(&psessionEntry->hs20vendor_ie, &pBPR->hs20vendor_ie);
 }
 
 /**
@@ -3766,9 +3766,9 @@ tSirRetStatus limStaSendAddBss( tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
     tSirMsgQ msgQ;
     tpAddBssParams pAddBssParams = NULL;
     tSirRetStatus retCode = eSIR_SUCCESS;
-    tANI_U8 i;
     tpDphHashNode pStaDs = NULL;
     tANI_U8 chanWidthSupp = 0;
+    tANI_U8 isVHTCapInVendorIE = 0;
     tANI_U32 shortGi20MhzSupport;
     tANI_U32 shortGi40MhzSupport;
     tANI_U32 enableTxBF20MHz;
@@ -4012,7 +4012,7 @@ tSirRetStatus limStaSendAddBss( tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
                               &pAssocRsp->vendor2_ie.VHTCaps;
                       limLog(pMac, LOG1,
                               FL("VHT Caps is present in vendor Specfic IE"));
-
+                      isVHTCapInVendorIE = 1;
                 }
                 if ((vht_caps != NULL) && (vht_caps->suBeamFormerCap ||
                       vht_caps->muBeamformerCap) &&
@@ -4137,11 +4137,16 @@ tSirRetStatus limStaSendAddBss( tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
                             (tANI_U8)pAssocRsp->HTCaps.advCodingCap;
                 else
                     pAddBssParams->staContext.htLdpcCapable = 0;
-                if (psessionEntry->txLdpcIniFeatureEnabled & 0x2)
-                    pAddBssParams->staContext.vhtLdpcCapable =
-                        (tANI_U8)pAssocRsp->VHTCaps.ldpcCodingCap;
-                else
+                if (psessionEntry->txLdpcIniFeatureEnabled & 0x2) {
+                    if (!isVHTCapInVendorIE)
+                        pAddBssParams->staContext.vhtLdpcCapable =
+                            (tANI_U8)pAssocRsp->VHTCaps.ldpcCodingCap;
+                    else
+                        pAddBssParams->staContext.vhtLdpcCapable =
+                            (tANI_U8)vht_caps->ldpcCodingCap;
+                } else {
                     pAddBssParams->staContext.vhtLdpcCapable = 0;
+                }
             }
 
             if( pBeaconStruct->HTInfo.present )
@@ -4205,15 +4210,6 @@ tSirRetStatus limStaSendAddBss( tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
 
     }
 
-    //Disable BA. It will be set as part of ADDBA negotiation.
-    for( i = 0; i < STACFG_MAX_TC; i++ )
-    {
-        pAddBssParams->staContext.staTCParams[i].txUseBA    = eBA_DISABLE;
-        pAddBssParams->staContext.staTCParams[i].rxUseBA    = eBA_DISABLE;
-        pAddBssParams->staContext.staTCParams[i].txBApolicy = eBA_POLICY_IMMEDIATE;
-        pAddBssParams->staContext.staTCParams[i].rxBApolicy = eBA_POLICY_IMMEDIATE;
-    }
-
     pAddBssParams->staContext.encryptType =  psessionEntry->encryptType;
 
 #if defined WLAN_FEATURE_VOWIFI
@@ -4276,6 +4272,11 @@ tSirRetStatus limStaSendAddBss( tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
     //we need to defer the message until we get the response back from HAL.
     SET_LIM_PROCESS_DEFD_MESGS(pMac, false);
 
+    if (psessionEntry->sub20_channelwidth == SUB20_MODE_5MHZ)
+            pAddBssParams->channelwidth = CH_WIDTH_5MHZ;
+    else if (psessionEntry->sub20_channelwidth == SUB20_MODE_10MHZ)
+            pAddBssParams->channelwidth = CH_WIDTH_10MHZ;
+
     msgQ.type = WDA_ADD_BSS_REQ;
     /** @ToDo : Update the Global counter to keeptrack of the PE <--> HAL messages*/
     msgQ.reserved = 0;
@@ -4313,7 +4314,6 @@ tSirRetStatus limStaSendAddBssPreAssoc( tpAniSirGlobal pMac, tANI_U8 updateEntry
     tSirMsgQ msgQ;
     tpAddBssParams pAddBssParams = NULL;
     tANI_U32 retCode;
-    tANI_U8 i;
     tSchBeaconStruct *pBeaconStruct;
     tANI_U8 chanWidthSupp = 0;
     tANI_U32 shortGi20MhzSupport;
@@ -4342,14 +4342,14 @@ tSirRetStatus limStaSendAddBssPreAssoc( tpAniSirGlobal pMac, tANI_U8 updateEntry
     vos_mem_set((tANI_U8 *) pAddBssParams, sizeof( tAddBssParams ), 0);
 
 
-    limExtractApCapabilities( pMac,
+    limExtractApCapabilities(pMac,
                             (tANI_U8 *) bssDescription->ieFields,
-                            limGetIElenFromBssDescription( bssDescription ),
-                            pBeaconStruct );
+                            GET_IE_LEN_IN_BSS(bssDescription->length),
+                            pBeaconStruct);
 
     if(pMac->lim.gLimProtectionControl != WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
         limDecideStaProtectionOnAssoc(pMac, pBeaconStruct, psessionEntry);
-        vos_mem_copy(pAddBssParams->bssId, bssDescription->bssId,
+    vos_mem_copy(pAddBssParams->bssId, bssDescription->bssId,
                      sizeof(tSirMacAddr));
 
     // Fill in tAddBssParams selfMacAddr
@@ -4684,16 +4684,6 @@ tSirRetStatus limStaSendAddBssPreAssoc( tpAniSirGlobal pMac, tANI_U8 updateEntry
 
     }
 
-
-    //Disable BA. It will be set as part of ADDBA negotiation.
-    for( i = 0; i < STACFG_MAX_TC; i++ )
-    {
-        pAddBssParams->staContext.staTCParams[i].txUseBA    = eBA_DISABLE;
-        pAddBssParams->staContext.staTCParams[i].rxUseBA    = eBA_DISABLE;
-        pAddBssParams->staContext.staTCParams[i].txBApolicy = eBA_POLICY_IMMEDIATE;
-        pAddBssParams->staContext.staTCParams[i].rxBApolicy = eBA_POLICY_IMMEDIATE;
-    }
-
     pAddBssParams->staContext.encryptType = psessionEntry->encryptType;
 
 #if defined WLAN_FEATURE_VOWIFI
@@ -4744,6 +4734,11 @@ tSirRetStatus limStaSendAddBssPreAssoc( tpAniSirGlobal pMac, tANI_U8 updateEntry
     //we need to defer the message until we get the response back from HAL.
     SET_LIM_PROCESS_DEFD_MESGS(pMac, false);
 
+    if (psessionEntry->sub20_channelwidth == SUB20_MODE_5MHZ)
+            pAddBssParams->channelwidth = CH_WIDTH_5MHZ;
+    else if (psessionEntry->sub20_channelwidth == SUB20_MODE_10MHZ)
+            pAddBssParams->channelwidth = CH_WIDTH_10MHZ;
+
     msgQ.type = WDA_ADD_BSS_REQ;
     /** @ToDo : Update the Global counter to keeptrack of the PE <--> HAL messages*/
     msgQ.reserved = 0;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limFT.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limFT.c
index 677e974ce1e..7636056b8bf 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limFT.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limFT.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -95,7 +95,7 @@ void limFTCleanupPreAuthInfo(tpAniSirGlobal pMac, tpPESession psessionEntry)
                &sessionId);
 
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-      PELOG1(limLog( pMac, LOG1, FL("Freeing pFTPreAuthReq= %p"),
+      PELOG1(limLog( pMac, LOG1, FL("Freeing pFTPreAuthReq= %pK"),
              psessionEntry->ftPEContext.pFTPreAuthReq);)
 #endif
       if (psessionEntry->ftPEContext.pFTPreAuthReq->pbssDescription) {
@@ -166,7 +166,7 @@ void limFTCleanup(tpAniSirGlobal pMac, tpPESession psessionEntry)
 
    if (NULL != psessionEntry->ftPEContext.pFTPreAuthReq) {
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-      PELOG1(limLog( pMac, LOG1, FL("Freeing pFTPreAuthReq= %p"),
+      PELOG1(limLog( pMac, LOG1, FL("Freeing pFTPreAuthReq= %pK"),
              psessionEntry->ftPEContext.pFTPreAuthReq);)
 #endif
       if (NULL != psessionEntry->ftPEContext.pFTPreAuthReq->pbssDescription) {
@@ -314,13 +314,13 @@ int limProcessFTPreAuthReq(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
         || limIsInMCC(pMac)) {
        /* Need to suspend link only if the channels are different */
        PELOG2(limLog(pMac, LOG2, FL("Performing pre-auth on different"
-               " channel (session %p)"), psessionEntry);)
+               " channel (session %pK)"), psessionEntry);)
        limSuspendLink(pMac, eSIR_CHECK_ROAMING_SCAN,
                       limFTPreAuthSuspendLinkHandler,
                       (tANI_U32 *)psessionEntry);
     } else {
        PELOG2(limLog(pMac, LOG2, FL("Performing pre-auth on same"
-                " channel (session %p)"), psessionEntry);)
+                " channel (session %pK)"), psessionEntry);)
         /* We are in the same channel. Perform pre-auth */
        limPerformFTPreAuth(pMac, eHAL_STATUS_SUCCESS, NULL, psessionEntry);
     }
@@ -376,7 +376,7 @@ void limPerformFTPreAuth(tpAniSirGlobal pMac, eHalStatus status,
 
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
     PELOG2(limLog(pMac,LOG2,"Entered wait auth2 state for FT"
-           " (old session %p)", psessionEntry);)
+           " (old session %pK)", psessionEntry);)
 #endif
 
     if (psessionEntry->is11Rconnection) {
@@ -442,7 +442,6 @@ tSirRetStatus limFTPrepareAddBssReq( tpAniSirGlobal pMac,
     tpSirBssDescription bssDescription )
 {
     tpAddBssParams pAddBssParams = NULL;
-    tANI_U8 i;
     tANI_U8 chanWidthSupp = 0;
     tSchBeaconStruct *pBeaconStruct;
 
@@ -472,9 +471,9 @@ tSirRetStatus limFTPrepareAddBssReq( tpAniSirGlobal pMac,
 
     vos_mem_set((tANI_U8 *) pAddBssParams, sizeof( tAddBssParams ), 0);
 
-    limExtractApCapabilities( pMac,
+    limExtractApCapabilities(pMac,
         (tANI_U8 *) bssDescription->ieFields,
-        limGetIElenFromBssDescription( bssDescription ), pBeaconStruct );
+        GET_IE_LEN_IN_BSS(bssDescription->length), pBeaconStruct);
 
     if (pMac->lim.gLimProtectionControl !=
                                     WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
@@ -771,17 +770,6 @@ tSirRetStatus limFTPrepareAddBssReq( tpAniSirGlobal pMac,
         }
     }
 
-    //Disable BA. It will be set as part of ADDBA negotiation.
-    for( i = 0; i < STACFG_MAX_TC; i++ )
-    {
-        pAddBssParams->staContext.staTCParams[i].txUseBA    = eBA_DISABLE;
-        pAddBssParams->staContext.staTCParams[i].rxUseBA    = eBA_DISABLE;
-        pAddBssParams->staContext.staTCParams[i].txBApolicy =
-                                                      eBA_POLICY_IMMEDIATE;
-        pAddBssParams->staContext.staTCParams[i].rxBApolicy =
-                                                      eBA_POLICY_IMMEDIATE;
-    }
-
 #if defined WLAN_FEATURE_VOWIFI
     pAddBssParams->maxTxPower = pftSessionEntry->maxTxPower;
 #endif
@@ -834,7 +822,6 @@ void limFillFTSession(tpAniSirGlobal pMac,
    tPowerdBm         localPowerConstraint;
    tPowerdBm         regMax;
    tSchBeaconStruct  *pBeaconStruct;
-   tANI_U32          selfDot11Mode;
    ePhyChanBondState cbEnabledMode;
 #ifdef WLAN_FEATURE_11W
    VOS_STATUS vosStatus;
@@ -864,10 +851,10 @@ void limFillFTSession(tpAniSirGlobal pMac,
    pftSessionEntry->smeSessionId = psessionEntry->smeSessionId;
    pftSessionEntry->transactionId = 0;
 
-   limExtractApCapabilities( pMac,
-         (tANI_U8 *) pbssDescription->ieFields,
-         limGetIElenFromBssDescription( pbssDescription ),
-         pBeaconStruct );
+   limExtractApCapabilities(pMac,
+         (tANI_U8 *)pbssDescription->ieFields,
+         GET_IE_LEN_IN_BSS(pbssDescription->length),
+         pBeaconStruct);
 
    pftSessionEntry->rateSet.numRates = pBeaconStruct->supportedRates.numRates;
    vos_mem_copy(pftSessionEntry->rateSet.rate,
@@ -881,9 +868,10 @@ void limFillFTSession(tpAniSirGlobal pMac,
    vos_mem_copy(pftSessionEntry->ssId.ssId, pBeaconStruct->ssId.ssId,
          pftSessionEntry->ssId.length);
 
-   wlan_cfgGetInt(pMac, WNI_CFG_DOT11_MODE, &selfDot11Mode);
-   limLog(pMac, LOG1, FL("selfDot11Mode %d"),selfDot11Mode );
-   pftSessionEntry->dot11mode = selfDot11Mode;
+
+   pftSessionEntry->dot11mode =
+                  psessionEntry->ftPEContext.pFTPreAuthReq->dot11mode;
+   limLog(pMac, LOG1, FL("dot11mode %d"), pftSessionEntry->dot11mode);
    pftSessionEntry->vhtCapability =
          (IS_DOT11_MODE_VHT(pftSessionEntry->dot11mode)
          && IS_BSS_VHT_CAPABLE(pBeaconStruct->VHTCaps));
@@ -947,10 +935,10 @@ void limFillFTSession(tpAniSirGlobal pMac,
                                           pftSessionEntry->currentOperChannel );
    localPowerConstraint = regMax;
    limExtractApCapability( pMac, (tANI_U8 *) pbssDescription->ieFields,
-         limGetIElenFromBssDescription(pbssDescription),
+         GET_IE_LEN_IN_BSS(pbssDescription->length),
          &pftSessionEntry->limCurrentBssQosCaps,
          &pftSessionEntry->limCurrentBssPropCap,
-         &currentBssUapsd , &localPowerConstraint, psessionEntry);
+         &currentBssUapsd , &localPowerConstraint, pftSessionEntry);
 
    pftSessionEntry->limReassocBssQosCaps =
       pftSessionEntry->limCurrentBssQosCaps;
@@ -1002,14 +990,14 @@ void limFillFTSession(tpAniSirGlobal pMac,
 #ifdef WLAN_FEATURE_11W
    pftSessionEntry->limRmfEnabled = psessionEntry->limRmfEnabled;
 
-   if (psessionEntry->limRmfEnabled) {
-       psessionEntry->pmfComebackTimerInfo.pMac = pMac;
-       psessionEntry->pmfComebackTimerInfo.sessionID =
+   if (pftSessionEntry->limRmfEnabled) {
+       pftSessionEntry->pmfComebackTimerInfo.pMac = pMac;
+       pftSessionEntry->pmfComebackTimerInfo.sessionID =
                                      psessionEntry->smeSessionId;
-       vosStatus = vos_timer_init(&psessionEntry->pmfComebackTimer,
+       vosStatus = vos_timer_init(&pftSessionEntry->pmfComebackTimer,
                                   VOS_TIMER_TYPE_SW,
                                   limPmfComebackTimerCallback,
-                                 (void *)&psessionEntry->pmfComebackTimerInfo);
+                                 (void *)&pftSessionEntry->pmfComebackTimerInfo);
        if (VOS_STATUS_SUCCESS != vosStatus) {
            limLog(pMac, LOGP,
                   FL("cannot init pmf comeback timer."));
@@ -1159,7 +1147,7 @@ void limPostFTPreAuthRsp(tpAniSirGlobal pMac, tSirRetStatus status,
    vos_mem_zero( pFTPreAuthRsp, rspLen);
 
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-   PELOGE(limLog( pMac, LOG1, FL("Auth Rsp = %p"), pFTPreAuthRsp);)
+   PELOGE(limLog( pMac, LOG1, FL("Auth Rsp = %pK"), pFTPreAuthRsp);)
 #endif
 
    if (psessionEntry) {
@@ -1308,7 +1296,7 @@ void limHandleFTPreAuthRsp(tpAniSirGlobal pMac, tSirRetStatus status,
       else
           pftSessionEntry->vdev_nss = pMac->vdev_type_nss_2g.sta;
 
-      PELOGE(limLog(pMac, LOG1, "%s:created session (%p) with id = %d",
+      PELOGE(limLog(pMac, LOG1, "%s:created session (%pK) with id = %d",
                __func__, pftSessionEntry, pftSessionEntry->peSessionId);)
 
       /* Update the ReAssoc BSSID of the current session */
@@ -1359,7 +1347,7 @@ void lim_ft_reassoc_set_link_state_callback(tpAniSirGlobal mac,
 	session_entry = peFindSessionBySessionId(mac,
 				mlm_reassoc_req->sessionId);
 	if (!status || !session_entry) {
-		limLog(mac, LOGE, FL("Failed: session:%p for session id:%d status:%d"),
+		limLog(mac, LOGE, FL("Failed: session:%pK for session id:%d status:%d"),
 			session_entry, mlm_reassoc_req->sessionId, status);
 		goto failure;
 	}
@@ -1590,7 +1578,7 @@ void limProcessFTPreauthRspTimeout(tpAniSirGlobal pMac)
    if (eANI_BOOLEAN_TRUE ==
          psessionEntry->ftPEContext.pFTPreAuthReq->bPreAuthRspProcessed) {
       limLog(pMac,LOGE,FL("Auth rsp already posted to SME"
-               " (session %p)"), psessionEntry);
+               " (session %pK)"), psessionEntry);
       return;
    }
    else {
@@ -1602,7 +1590,7 @@ void limProcessFTPreauthRspTimeout(tpAniSirGlobal pMac)
        * limProcessAuthFrameNoSession.
        */
       limLog(pMac,LOG1,FL("Auth rsp not yet posted to SME"
-               " (session %p)"), psessionEntry);
+               " (session %pK)"), psessionEntry);
       psessionEntry->ftPEContext.pFTPreAuthReq->bPreAuthRspProcessed =
          eANI_BOOLEAN_TRUE;
    }
@@ -1711,29 +1699,6 @@ tANI_BOOLEAN limProcessFTUpdateKey(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf )
                        pKeyInfo->bssId);
 
         pAddBssParams->extSetStaKeyParam.sendRsp = FALSE;
-
-        if(pAddBssParams->extSetStaKeyParam.key[0].keyLength == 16)
-        {
-            PELOG1(limLog(pMac, LOG1,
-            FL("BSS key = %02X-%02X-%02X-%02X-%02X-%02X-%02X- "
-            "%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X"),
-            pAddBssParams->extSetStaKeyParam.key[0].key[0],
-            pAddBssParams->extSetStaKeyParam.key[0].key[1],
-            pAddBssParams->extSetStaKeyParam.key[0].key[2],
-            pAddBssParams->extSetStaKeyParam.key[0].key[3],
-            pAddBssParams->extSetStaKeyParam.key[0].key[4],
-            pAddBssParams->extSetStaKeyParam.key[0].key[5],
-            pAddBssParams->extSetStaKeyParam.key[0].key[6],
-            pAddBssParams->extSetStaKeyParam.key[0].key[7],
-            pAddBssParams->extSetStaKeyParam.key[0].key[8],
-            pAddBssParams->extSetStaKeyParam.key[0].key[9],
-            pAddBssParams->extSetStaKeyParam.key[0].key[10],
-            pAddBssParams->extSetStaKeyParam.key[0].key[11],
-            pAddBssParams->extSetStaKeyParam.key[0].key[12],
-            pAddBssParams->extSetStaKeyParam.key[0].key[13],
-            pAddBssParams->extSetStaKeyParam.key[0].key[14],
-            pAddBssParams->extSetStaKeyParam.key[0].key[15]);)
-        }
     }
     return TRUE;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c
index cba481b965f..6427a5073ca 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,7 +38,7 @@
 #include "palTypes.h"
 #include "aniGlobal.h"
 #include "sirCommon.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "limUtils.h"
 #include "limAssocUtils.h"
 #include "limStaHashApi.h"
@@ -1108,7 +1108,7 @@ __limIbssSearchAndDeletePeer(tpAniSirGlobal pMac,
 					limDelSta(pMac, pStaDs,
 						false /*asynchronous*/,
 						psessionEntry);
-					limDeleteDphHashEntry(pMac,
+				limDeleteDphHashEntry(pMac,
 							pStaDs->staAddr,
 							peerIdx, psessionEntry);
 				limReleasePeerIdx(pMac, peerIdx, psessionEntry);
@@ -1128,7 +1128,8 @@ __limIbssSearchAndDeletePeer(tpAniSirGlobal pMac,
 					pPrevNode = pMac->lim.gLimIbssPeerList;
 				} else
 					pPrevNode->next = pTempNode->next;
-
+				if (pTempNode->beacon)
+					vos_mem_free(pTempNode->beacon);
 				vos_mem_free(pTempNode);
 				pMac->lim.gLimNumIbssPeers--;
 
@@ -1643,6 +1644,8 @@ void limIbssHeartBeatHandle(tpAniSirGlobal pMac,tpPESession psessionEntry)
                 else
                     pPrevNode->next = pTempNode->next;
 
+                if (pTempNode->beacon)
+                    vos_mem_free(pTempNode->beacon);
                 vos_mem_free(pTempNode);
                 pMac->lim.gLimNumIbssPeers--;
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c
index 5db1fd51364..a4b14d6e0c1 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,7 +38,7 @@
  */
 
 #include "aniGlobal.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "cfgApi.h"
 
 
@@ -281,7 +281,7 @@ limTriggerSTAdeletion(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpPESession pse
         pStaDs->sta_deletion_in_progress) {
         /* Already in the process of deleting context for the peer */
         limLog(pMac, LOG1,
-            FL("Deletion is in progress (%d) for peer:%p in mlmState %d"),
+            FL("Deletion is in progress (%d) for peer:%pK in mlmState %d"),
             pStaDs->sta_deletion_in_progress, pStaDs->staAddr,
             pStaDs->mlmStaContext.mlmState);
         return;
@@ -401,7 +401,9 @@ limTearDownLinkWithAp(tpAniSirGlobal pMac, tANI_U8 sessionId, tSirMacReasonCodes
         mlmDeauthInd.reasonCode    = (tANI_U8) pStaDs->mlmStaContext.disassocReason;
         mlmDeauthInd.deauthTrigger =  pStaDs->mlmStaContext.cleanupTrigger;
 
-        limPostSmeMessage(pMac, LIM_MLM_DEAUTH_IND, (tANI_U32 *) &mlmDeauthInd);
+        if (GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_STA_ROLE)
+            limPostSmeMessage(pMac, LIM_MLM_DEAUTH_IND,
+                                    (tANI_U32 *) &mlmDeauthInd);
 
         limSendSmeDeauthInd(pMac, pStaDs, psessionEntry);
         limReInitScanResults(pMac);
@@ -465,11 +467,19 @@ void limHandleHeartBeatFailure(tpAniSirGlobal pMac,tpPESession psessionEntry)
     {
         if (!pMac->sys.gSysEnableLinkMonitorMode)
             return;
+        /* Ignore HB if channel switch is in progress */
+        if (psessionEntry->gLimSpecMgmt.dot11hChanSwState ==
+                          eLIM_11H_CHANSW_RUNNING) {
+           limLog(pMac, LOGE,
+               FL("Ignore Heartbeat failure as Channel switch is in progress"));
+           pMac->pmm.inMissedBeaconScenario = false;
+           return;
+        }
 
         /**
          * Beacon frame not received within heartbeat timeout.
          */
-        PELOGW(limLog(pMac, LOGW, FL("Heartbeat Failure"));)
+        limLog(pMac, LOGW, FL("Heartbeat Failure"));
         pMac->lim.gLimHBfailureCntInLinkEstState++;
 
         /**
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limLogDump.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limLogDump.c
index eefedfcf3b8..51dff7c7201 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limLogDump.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limLogDump.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -933,7 +933,7 @@ dump_lim_send_SM_Power_Mode( tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2,
 static char *
 dump_lim_addba_req( tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2, tANI_U32 arg3, tANI_U32 arg4, char *p)
 {
-  tSirRetStatus status;
+  tSirRetStatus status= eSIR_SUCCESS;
   tpDphHashNode pSta;
   tpPESession psessionEntry = &pMac->lim.gpSession[0];
 
@@ -951,7 +951,6 @@ dump_lim_addba_req( tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2, tANI_U32
   }
   else
   {
-    status = limPostMlmAddBAReq( pMac, pSta, (tANI_U8) arg2, (tANI_U16) arg3,psessionEntry);
     p += log_sprintf( pMac, p,
         "\n%s: Attempted to send an ADDBA Req to STA Index %d, for TID %d. Send Status = %s\n",
         __func__,
@@ -966,7 +965,7 @@ dump_lim_addba_req( tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2, tANI_U32
 static char *
 dump_lim_delba_req( tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2, tANI_U32 arg3, tANI_U32 arg4, char *p)
 {
-tSirRetStatus status;
+tSirRetStatus status = eSIR_SUCCESS;
 tpDphHashNode pSta;
   tpPESession psessionEntry = &pMac->lim.gpSession[0];
 
@@ -981,7 +980,6 @@ tpDphHashNode pSta;
   }
   else
   {
-    status = limPostMlmDelBAReq( pMac, pSta, (tANI_U8) arg2, (tANI_U8) arg3, (tANI_U16) arg4 ,psessionEntry);
     p += log_sprintf( pMac, p,
         "\n%s: Attempted to send a DELBA Ind to STA Index %d, "
         "as the BA \"%s\" for TID %d, with Reason code %d. "
@@ -1816,7 +1814,7 @@ dump_lim_ft_event( tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2, tANI_U32 a
             p += log_sprintf( pMac, p, "%s: Session %02x %02x %02x\n", __func__,
                   psessionEntry->bssId[0],
                   psessionEntry->bssId[1], psessionEntry->bssId[2]);
-            p += log_sprintf( pMac, p, "%s: Session %02x %02x %02x %p\n",
+            p += log_sprintf( pMac, p, "%s: Session %02x %02x %02x %pK\n",
                   __func__,
                   pftPreAuthReq->currbssId[0],
                   pftPreAuthReq->currbssId[1],
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limP2P.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limP2P.c
index 0bbb9c39780..18efbe70419 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limP2P.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limP2P.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -926,7 +926,7 @@ send_action_frame:
                 }
                 nBytes += noaLen;
                 limLog( pMac, LOGE,
-                        FL("noaLen=%d origLen=%d pP2PIe=%p"
+                        FL("noaLen=%d origLen=%d pP2PIe=%pK"
                         " nBytes=%d nBytesToCopy=%zu "),
                                    noaLen,origLen,pP2PIe,nBytes,
                    ((pP2PIe + origLen + 2) - (v_U8_t *)pMbMsg->data));
@@ -1087,7 +1087,6 @@ send_frame1:
         }
         else
         {
-             pMac->lim.mgmtFrameSessionId = pMbMsg->sessionId;
              limLog( pMac, LOG2, FL("lim.actionFrameSessionId = %u" ),
                      pMac->lim.mgmtFrameSessionId);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessActionFrame.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessActionFrame.c
index 210e38b7fe1..c8c4d97fa31 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessActionFrame.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessActionFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,7 +40,7 @@
 #include "wniApi.h"
 #include "sirApi.h"
 #include "aniGlobal.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "schApi.h"
 #include "utilsApi.h"
 #include "limTypes.h"
@@ -101,6 +101,13 @@ void limStopTxAndSwitchChannel(tpAniSirGlobal pMac, tANI_U8 sessionId)
       return;
     }
 
+    if(psessionEntry->ftPEContext.pFTPreAuthReq)
+    {
+        limLog(pMac, LOGE,
+           FL("Avoid Switch Channel req during pre auth"));
+        return;
+    }
+
     /*
      * Sme Session is passed in limSendSmePreChannelSwitchInd
      * so that it can be passed till sme to request full power for
@@ -466,7 +473,8 @@ lim_process_ext_channel_switch_action_frame(tpAniSirGlobal mac_ctx,
 		return;
 	}
 
-	if (eLIM_AP_ROLE == session_entry->limSystemRole) {
+	if ((eLIM_STA_ROLE == session_entry->limSystemRole) || \
+	    (eLIM_P2P_DEVICE_CLIENT == session_entry->limSystemRole)) {
 
 		struct sir_sme_ext_cng_chan_ind *ext_cng_chan_ind;
 		tSirMsgQ mmh_msg;
@@ -1238,538 +1246,6 @@ __limProcessQosMapConfigureFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
                                psessionEntry, 0);
 }
 
-
-
-/**
- * \brief Validate an ADDBA Req from peer with respect
- * to our own BA configuration
- *
- * \sa __limValidateAddBAParameterSet
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param baParameterSet The ADDBA Parameter Set.
- *
- * \param pDelBAFlag this parameter is NULL except for call from processAddBAReq
- *        delBAFlag is set when entry already exists.
- *
- * \param reqType ADDBA Req v/s ADDBA Rsp
- * 1 - ADDBA Req
- * 0 - ADDBA Rsp
- *
- * \return eSIR_SUCCESS if setup completes successfully
- *         eSIR_FAILURE is some problem is encountered
- */
-
-static tSirMacStatusCodes
-__limValidateAddBAParameterSet( tpAniSirGlobal pMac,
-    tpDphHashNode pSta,
-    tDot11fFfAddBAParameterSet baParameterSet,
-    tANI_U8 dialogueToken,
-    tLimAddBaValidationReqType reqType ,
-    tANI_U8* pDelBAFlag /*this parameter is NULL except for call from processAddBAReq*/)
-{
-  if(baParameterSet.tid >= STACFG_MAX_TC)
-  {
-      return eSIR_MAC_WME_INVALID_PARAMS_STATUS;
-  }
-
-  //check if there is already a BA session setup with this STA/TID while processing AddBaReq
-  if((true == pSta->tcCfg[baParameterSet.tid].fUseBARx) &&
-        (LIM_ADDBA_REQ == reqType))
-  {
-      //There is already BA session setup for STA/TID.
-      limLog(pMac, LOGE,
-          FL("AddBAReq rcvd when there is already a session for this StaId = %d, tid = %d"),
-          pSta->staIndex, baParameterSet.tid);
-      limPrintMacAddr( pMac, pSta->staAddr, LOGW );
-
-      if(pDelBAFlag)
-        *pDelBAFlag = true;
-  }
-  return eSIR_MAC_SUCCESS_STATUS;
-}
-
-/**
- * \brief Validate a DELBA Ind from peer with respect
- * to our own BA configuration
- *
- * \sa __limValidateDelBAParameterSet
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param baParameterSet The DELBA Parameter Set.
- *
- * \param pSta Runtime, STA-related configuration cached
- * in the HashNode object
- *
- * \return eSIR_SUCCESS if setup completes successfully
- *         eSIR_FAILURE is some problem is encountered
- */
-static tSirMacStatusCodes
-__limValidateDelBAParameterSet( tpAniSirGlobal pMac,
-    tDot11fFfDelBAParameterSet baParameterSet,
-    tpDphHashNode pSta )
-{
-tSirMacStatusCodes statusCode = eSIR_MAC_STA_BLK_ACK_NOT_SUPPORTED_STATUS;
-
-  // Validate if a BA is active for the requested TID
-    if( pSta->tcCfg[baParameterSet.tid].fUseBATx ||
-        pSta->tcCfg[baParameterSet.tid].fUseBARx )
-    {
-      statusCode = eSIR_MAC_SUCCESS_STATUS;
-
-      limLog( pMac, LOGW,
-          FL("Valid DELBA Ind received. Time to send WDA_DELBA_IND to HAL..."));
-    }
-    else
-      limLog( pMac, LOGW,
-          FL("Received an INVALID DELBA Ind for TID %d..."),
-          baParameterSet.tid );
-
-  return statusCode;
-}
-
-/**
- * \brief Process an ADDBA REQ
- *
- * \sa limProcessAddBAReq
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pRxPacketInfo Handle to the Rx packet info from HDD
- *
- * \return none
- *
- */
-static void
-__limProcessAddBAReq( tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession psessionEntry)
-{
-    tDot11fAddBAReq frmAddBAReq;
-    tpSirMacMgmtHdr pHdr;
-    tpDphHashNode pSta;
-    tSirMacStatusCodes status = eSIR_MAC_SUCCESS_STATUS;
-    tANI_U16 aid;
-    tANI_U32 frameLen, nStatus,val;
-    tANI_U8 *pBody;
-    tANI_U8 delBAFlag =0;
-
-    pHdr = WDA_GET_RX_MAC_HEADER( pRxPacketInfo );
-    pBody = WDA_GET_RX_MPDU_DATA( pRxPacketInfo );
-    frameLen = WDA_GET_RX_PAYLOAD_LEN( pRxPacketInfo );
-    val = 0;
-
-    // Unpack the received frame
-    nStatus = dot11fUnpackAddBAReq( pMac, pBody, frameLen, &frmAddBAReq );
-    if( DOT11F_FAILED( nStatus ))
-    {
-        limLog( pMac, LOGE,
-            FL("Failed to unpack and parse an ADDBA Request (0x%08x, %d bytes):"),
-            nStatus,
-            frameLen );
-
-        PELOG2(sirDumpBuf( pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen );)
-
-        // Without an unpacked request we cannot respond, so silently ignore the request
-        return;
-    }
-    else if ( DOT11F_WARNED( nStatus ) )
-    {
-        limLog( pMac, LOGW,
-            FL( "There were warnings while unpacking an ADDBA Request (0x%08x, %d bytes):"),
-            nStatus,
-            frameLen );
-
-        PELOG2(sirDumpBuf( pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen );)
-    }
-
-    psessionEntry->amsduSupportedInBA = frmAddBAReq.AddBAParameterSet.amsduSupported;
-
-    pSta = dphLookupHashEntry( pMac, pHdr->sa, &aid, &psessionEntry->dph.dphHashTable );
-    if( pSta == NULL )
-    {
-        limLog( pMac, LOGE,
-            FL( "STA context not found - ignoring ADDBA from " ));
-        limPrintMacAddr( pMac, pHdr->sa, LOGE );
-
-        // FIXME - Should we do this?
-        status = eSIR_MAC_INABLITY_TO_CONFIRM_ASSOC_STATUS;
-        goto returnAfterError;
-    }
-
-    limLog( pMac, LOG1, FL( "ADDBA Req from STA "MAC_ADDRESS_STR " with AID %d"
-                            " tid = %d policy = %d buffsize = %d"
-                            " amsduSupported = %d"), MAC_ADDR_ARRAY(pHdr->sa),
-                            aid, frmAddBAReq.AddBAParameterSet.tid,
-                            frmAddBAReq.AddBAParameterSet.policy,
-                            frmAddBAReq.AddBAParameterSet.bufferSize,
-                            frmAddBAReq.AddBAParameterSet.amsduSupported);
-
-#ifdef WLAN_SOFTAP_VSTA_FEATURE
-    // we can only do BA on "hard" STAs
-    if (!(IS_HWSTA_IDX(pSta->staIndex)))
-    {
-        status = eSIR_MAC_REQ_DECLINED_STATUS;
-        goto returnAfterError;
-    }
-#endif //WLAN_SOFTAP_VSTA_FEATURE
-
-    if (wlan_cfgGetInt(pMac, WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC, &val) !=
-                    eSIR_SUCCESS)
-    {
-        limLog(pMac, LOGE,
-               FL("Unable to get WNI_CFG_DEL_ALL_RX_BA_SESSIONS_2_4_G_BTC"));
-        val = 0;
-    }
-    if ((SIR_BAND_2_4_GHZ == limGetRFBand(psessionEntry->currentOperChannel)) &&
-                    val)
-    {
-        limLog( pMac, LOGW,
-            FL( "BTC disabled aggregation - ignoring ADDBA from " ));
-        limPrintMacAddr( pMac, pHdr->sa, LOGW );
-
-        status = eSIR_MAC_REQ_DECLINED_STATUS;
-        goto returnAfterError;
-    }
-
-    // Now, validate the ADDBA Req
-    if( eSIR_MAC_SUCCESS_STATUS !=
-      (status = __limValidateAddBAParameterSet( pMac, pSta,
-                                              frmAddBAReq.AddBAParameterSet,
-                                              0, //dialogue token is don't care in request validation.
-                                              LIM_ADDBA_REQ, &delBAFlag)))
-        goto returnAfterError;
-
-    //BA already set, so we need to delete it before adding new one.
-    if(delBAFlag)
-    {
-        if( eSIR_SUCCESS != limPostMsgDelBAInd( pMac,
-            pSta,
-            (tANI_U8)frmAddBAReq.AddBAParameterSet.tid,
-            eBA_RECIPIENT,psessionEntry))
-        {
-            status = eSIR_MAC_UNSPEC_FAILURE_STATUS;
-            goto returnAfterError;
-        }
-    }
-
-  // Check if the ADD BA Declined configuration is Disabled
-    if ((pMac->lim.gAddBA_Declined & ( 1 << frmAddBAReq.AddBAParameterSet.tid ) )) {
-        limLog( pMac, LOGE, FL( "Declined the ADDBA Req for the TID %d  " ),
-                        frmAddBAReq.AddBAParameterSet.tid);
-        status = eSIR_MAC_REQ_DECLINED_STATUS;
-        goto returnAfterError;
-    }
-
-  //
-  // Post WDA_ADDBA_REQ to HAL.
-  // If HAL/HDD decide to allow this ADDBA Req session,
-  // then this BA session is termed active
-  //
-
-  // Change the Block Ack state of this STA to wait for
-  // ADDBA Rsp from HAL
-  LIM_SET_STA_BA_STATE(pSta, frmAddBAReq.AddBAParameterSet.tid, eLIM_BA_STATE_WT_ADD_RSP);
-
-  if (wlan_cfgGetInt(pMac, WNI_CFG_NUM_BUFF_ADVERT , &val) != eSIR_SUCCESS)
-  {
-        limLog(pMac, LOGP, FL("Unable to get WNI_CFG_NUM_BUFF_ADVERT"));
-        return ;
-  }
-
-
-  if (frmAddBAReq.AddBAParameterSet.bufferSize)
-  {
-      frmAddBAReq.AddBAParameterSet.bufferSize =
-            VOS_MIN(val, frmAddBAReq.AddBAParameterSet.bufferSize);
-  }
-  else
-  {
-      frmAddBAReq.AddBAParameterSet.bufferSize = val;
-  }
-  limLog( pMac, LOG1, FL( "ADDBAREQ NUMBUFF %d" ),
-                        frmAddBAReq.AddBAParameterSet.bufferSize);
-
-  if( eSIR_SUCCESS != limPostMsgAddBAReq( pMac,
-        pSta,
-        (tANI_U8) frmAddBAReq.DialogToken.token,
-        (tANI_U8) frmAddBAReq.AddBAParameterSet.tid,
-        (tANI_U8) frmAddBAReq.AddBAParameterSet.policy,
-        frmAddBAReq.AddBAParameterSet.bufferSize,
-        frmAddBAReq.BATimeout.timeout,
-        (tANI_U16) frmAddBAReq.BAStartingSequenceControl.ssn,
-        eBA_RECIPIENT,psessionEntry))
-    status = eSIR_MAC_UNSPEC_FAILURE_STATUS;
-  else
-    return;
-
-returnAfterError:
-
-  //
-  // Package LIM_MLM_ADDBA_RSP to MLME, with proper
-  // status code. MLME will then send an ADDBA RSP
-  // over the air to the peer MAC entity
-  //
-  if( eSIR_SUCCESS != limPostMlmAddBARsp( pMac,
-        pHdr->sa,
-        status,
-        frmAddBAReq.DialogToken.token,
-        (tANI_U8) frmAddBAReq.AddBAParameterSet.tid,
-        (tANI_U8) frmAddBAReq.AddBAParameterSet.policy,
-        frmAddBAReq.AddBAParameterSet.bufferSize,
-        frmAddBAReq.BATimeout.timeout,psessionEntry))
-  {
-    limLog( pMac, LOGW,
-        FL( "Failed to post LIM_MLM_ADDBA_RSP to " ));
-    limPrintMacAddr( pMac, pHdr->sa, LOGW );
-  }
-
-}
-
-/**
- * \brief Process an ADDBA RSP
- *
- * \sa limProcessAddBARsp
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pRxPacketInfo Handle to the packet info structure from HDD
- *
- * \return none
- *
- */
-static void
-__limProcessAddBARsp( tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession psessionEntry)
-{
-tDot11fAddBARsp frmAddBARsp;
-tpSirMacMgmtHdr pHdr;
-tpDphHashNode pSta;
-tSirMacReasonCodes reasonCode = eSIR_MAC_UNSPEC_FAILURE_REASON;
-tANI_U16 aid;
-tANI_U32 frameLen, nStatus;
-tANI_U8 *pBody;
-
-  pHdr = WDA_GET_RX_MAC_HEADER( pRxPacketInfo );
-  pBody = WDA_GET_RX_MPDU_DATA( pRxPacketInfo );
-  frameLen = WDA_GET_RX_PAYLOAD_LEN( pRxPacketInfo );
-
-  pSta = dphLookupHashEntry( pMac, pHdr->sa, &aid, &psessionEntry->dph.dphHashTable );
-  if( pSta == NULL )
-  {
-    limLog( pMac, LOGE,
-        FL( "STA context not found - ignoring ADDBA from " ));
-    limPrintMacAddr( pMac, pHdr->sa, LOGW );
-    return;
-  }
-
-#ifdef WLAN_SOFTAP_VSTA_FEATURE
-  // We can only do BA on "hard" STAs.  We should not have issued an ADDBA
-  // Request, so we should never be processing a ADDBA Response
-  if (!(IS_HWSTA_IDX(pSta->staIndex)))
-  {
-    return;
-  }
-#endif //WLAN_SOFTAP_VSTA_FEATURE
-
-  // Unpack the received frame
-  nStatus = dot11fUnpackAddBARsp( pMac, pBody, frameLen, &frmAddBARsp );
-  if( DOT11F_FAILED( nStatus ))
-  {
-    limLog( pMac, LOGE,
-        FL( "Failed to unpack and parse an ADDBA Response (0x%08x, %d bytes):"),
-        nStatus,
-        frameLen );
-
-    PELOG2(sirDumpBuf( pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen );)
-    goto returnAfterError;
-  }
-  else if ( DOT11F_WARNED( nStatus ) )
-  {
-    limLog( pMac, LOGW,
-        FL( "There were warnings while unpacking an ADDBA Response (0x%08x, %d bytes):"),
-        nStatus,
-        frameLen );
-
-    PELOG2(sirDumpBuf( pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen );)
-  }
-
-  limLog( pMac, LOG1, FL( "ADDBA Rsp from STA "MAC_ADDRESS_STR " with AID %d "
-                          "tid = %d policy = %d buffsize = %d "
-                          "amsduSupported = %d status = %d"),
-                          MAC_ADDR_ARRAY(pHdr->sa), aid,
-                          frmAddBARsp.AddBAParameterSet.tid,
-                          frmAddBARsp.AddBAParameterSet.policy,
-                          frmAddBARsp.AddBAParameterSet.bufferSize,
-                          frmAddBARsp.AddBAParameterSet.amsduSupported,
-                          frmAddBARsp.Status.status);
-
-  //if there is no matchin dialougue token then ignore the response.
-
-  if(eSIR_SUCCESS != limSearchAndDeleteDialogueToken(pMac, frmAddBARsp.DialogToken.token,
-        pSta->assocId, frmAddBARsp.AddBAParameterSet.tid))
-  {
-      PELOGW(limLog(pMac, LOGE, FL("dialogueToken in received addBARsp did not match with outstanding requests"));)
-      return;
-  }
-
-  // Check first if the peer accepted the ADDBA Req
-  if( eSIR_MAC_SUCCESS_STATUS == frmAddBARsp.Status.status )
-  {
-    //if peer responded with buffer size 0 then we should pick the default.
-    if(0 == frmAddBARsp.AddBAParameterSet.bufferSize)
-        frmAddBARsp.AddBAParameterSet.bufferSize = BA_DEFAULT_TX_BUFFER_SIZE;
-
-    // Now, validate the ADDBA Rsp
-    if( eSIR_MAC_SUCCESS_STATUS !=
-        __limValidateAddBAParameterSet( pMac, pSta,
-                                       frmAddBARsp.AddBAParameterSet,
-                                       (tANI_U8)frmAddBARsp.DialogToken.token,
-                                       LIM_ADDBA_RSP, NULL))
-      goto returnAfterError;
-  }
-  else
-    goto returnAfterError;
-
-  // Change STA state to wait for ADDBA Rsp from HAL
-  LIM_SET_STA_BA_STATE(pSta, frmAddBARsp.AddBAParameterSet.tid, eLIM_BA_STATE_WT_ADD_RSP);
-
-  //
-  // Post WDA_ADDBA_REQ to HAL.
-  // If HAL/HDD decide to allow this ADDBA Rsp session,
-  // then this BA session is termed active
-  //
-
-  if( eSIR_SUCCESS != limPostMsgAddBAReq( pMac,
-        pSta,
-        (tANI_U8) frmAddBARsp.DialogToken.token,
-        (tANI_U8) frmAddBARsp.AddBAParameterSet.tid,
-        (tANI_U8) frmAddBARsp.AddBAParameterSet.policy,
-        frmAddBARsp.AddBAParameterSet.bufferSize,
-        frmAddBARsp.BATimeout.timeout,
-        0,
-        eBA_INITIATOR,psessionEntry))
-    reasonCode = eSIR_MAC_UNSPEC_FAILURE_REASON;
-  else
-    return;
-
-returnAfterError:
-
-  // TODO: Do we need to signal an error status to SME,
-  // if status != eSIR_MAC_SUCCESS_STATUS
-
-  // Restore STA "BA" State
-  LIM_SET_STA_BA_STATE(pSta, frmAddBARsp.AddBAParameterSet.tid, eLIM_BA_STATE_IDLE);
-  //
-  // Need to send a DELBA IND to peer, who
-  // would have setup a BA session with this STA
-  //
-  if( eSIR_MAC_SUCCESS_STATUS == frmAddBARsp.Status.status )
-  {
-    //
-    // Package LIM_MLM_DELBA_REQ to MLME, with proper
-    // status code. MLME will then send a DELBA IND
-    // over the air to the peer MAC entity
-    //
-    if( eSIR_SUCCESS != limPostMlmDelBAReq( pMac,
-          pSta,
-          eBA_INITIATOR,
-          (tANI_U8) frmAddBARsp.AddBAParameterSet.tid,
-          reasonCode, psessionEntry))
-    {
-      limLog( pMac, LOGW,
-          FL( "Failed to post LIM_MLM_DELBA_REQ to " ));
-      limPrintMacAddr( pMac, pHdr->sa, LOGW );
-    }
-  }
-}
-
-/**
- * \brief Process a DELBA Indication
- *
- * \sa limProcessDelBAInd
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pRxPacketInfo Handle to the Rx packet info from HDD
- *
- * \return none
- *
- */
-static void
-__limProcessDelBAReq( tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession psessionEntry)
-{
-tDot11fDelBAInd frmDelBAInd;
-tpSirMacMgmtHdr pHdr;
-tpDphHashNode pSta;
-tANI_U16 aid;
-tANI_U32 frameLen, nStatus;
-tANI_U8 *pBody;
-
-  pHdr = WDA_GET_RX_MAC_HEADER( pRxPacketInfo );
-  pBody = WDA_GET_RX_MPDU_DATA( pRxPacketInfo );
-  frameLen = WDA_GET_RX_PAYLOAD_LEN( pRxPacketInfo );
-
-  pSta = dphLookupHashEntry( pMac, pHdr->sa, &aid, &psessionEntry->dph.dphHashTable );
-  if( pSta == NULL )
-  {
-    limLog( pMac, LOGE, FL( "STA context not found - ignoring DELBA from "));
-    limPrintMacAddr( pMac, pHdr->sa, LOGW );
-    return;
-  }
-
-  limLog( pMac, LOG1, FL( "DELBA Ind from STA with AID %d" ), aid );
-
-  // Unpack the received frame
-  nStatus = dot11fUnpackDelBAInd( pMac, pBody, frameLen, &frmDelBAInd );
-  if( DOT11F_FAILED( nStatus ))
-  {
-    limLog( pMac, LOGE,
-        FL( "Failed to unpack and parse a DELBA Indication (0x%08x, %d bytes):"),
-        nStatus,
-        frameLen );
-
-    PELOG2(sirDumpBuf( pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen );)
-    return;
-  }
-  else if ( DOT11F_WARNED( nStatus ) )
-  {
-    limLog( pMac, LOGW,
-        FL( "There were warnings while unpacking a DELBA Indication (0x%08x, %d bytes):"),
-        nStatus,
-        frameLen );
-
-    PELOG2(sirDumpBuf( pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen );)
-  }
-
-  limLog( pMac, LOGW,
-      FL( "Received DELBA for TID %d, Reason code %d" ),
-      frmDelBAInd.DelBAParameterSet.tid,
-      frmDelBAInd.Reason.code );
-
-  // Now, validate the DELBA Ind
-  if( eSIR_MAC_SUCCESS_STATUS != __limValidateDelBAParameterSet( pMac,
-                                             frmDelBAInd.DelBAParameterSet,
-                                             pSta ))
-      return;
-
-  //
-  // Post WDA_DELBA_IND to HAL and delete the
-  // existing BA session
-  //
-  // NOTE - IEEE 802.11-REVma-D8.0, Section 7.3.1.16
-  // is kind of confusing...
-  //
-  if( eSIR_SUCCESS != limPostMsgDelBAInd( pMac,
-        pSta,
-        (tANI_U8) frmDelBAInd.DelBAParameterSet.tid,
-        (eBA_RECIPIENT == frmDelBAInd.DelBAParameterSet.initiator)?
-          eBA_INITIATOR: eBA_RECIPIENT,psessionEntry))
-    limLog( pMac, LOGE, FL( "Posting WDA_DELBA_IND to HAL failed "));
-
-  return;
-
-}
-
 static void
 __limProcessSMPowerSaveUpdate(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo ,tpPESession psessionEntry)
 {
@@ -1855,7 +1331,7 @@ __limProcessRadioMeasureRequest( tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo ,tp
 
      limSendSmeMgmtFrameInd(pMac, pHdr->fc.subType, (tANI_U8*)pHdr,
           frameLen + sizeof(tSirMacMgmtHdr), 0, WDA_GET_RX_CH(pRxPacketInfo),
-          psessionEntry, 0);
+          psessionEntry, WDA_GET_RX_RSSI_NORMALIZED(pRxPacketInfo));
 
      /**Unpack the received frame */
      nStatus = dot11fUnpackRadioMeasurementRequest( pMac, pBody, frameLen, &frm );
@@ -2057,7 +1533,8 @@ static void __limProcessSAQueryResponseActionFrame(tpAniSirGlobal pMac, tANI_U8
         limSendSmeMgmtFrameInd(pMac, pHdr->fc.subType, (tANI_U8*)pHdr,
                                frameLen + sizeof(tSirMacMgmtHdr), 0,
                                WDA_GET_RX_CH( pRxPacketInfo ),
-                               psessionEntry, 0);
+                               psessionEntry,
+                               WDA_GET_RX_RSSI_NORMALIZED(pRxPacketInfo));
         return;
     }
 
@@ -2280,27 +1757,6 @@ limProcessActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession ps
             }
             break;
 
-        case SIR_MAC_ACTION_BLKACK:
-            // Determine the "type" of BA Action Frame
-            switch(pActionHdr->actionID)
-            {
-              case SIR_MAC_BLKACK_ADD_REQ:
-                __limProcessAddBAReq( pMac, (tANI_U8 *) pRxPacketInfo,psessionEntry);
-                break;
-
-              case SIR_MAC_BLKACK_ADD_RSP:
-                __limProcessAddBARsp( pMac, (tANI_U8 *) pRxPacketInfo,psessionEntry);
-                break;
-
-              case SIR_MAC_BLKACK_DEL:
-                __limProcessDelBAReq( pMac, (tANI_U8 *) pRxPacketInfo,psessionEntry);
-                break;
-
-              default:
-                break;
-            }
-
-            break;
     case SIR_MAC_ACTION_HT:
         /** Type of HT Action to be performed*/
         switch(pActionHdr->actionID) {
@@ -2349,7 +1805,9 @@ limProcessActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession ps
     }
 #if defined WLAN_FEATURE_VOWIFI
     case SIR_MAC_ACTION_RRM:
-        if( pMac->rrm.rrmPEContext.rrmEnable )
+        /* Ignore RRM measurement request until DHCP is set */
+        if (pMac->rrm.rrmPEContext.rrmEnable &&
+           pMac->roam.roamSession[psessionEntry->smeSessionId].dhcp_done)
         {
             switch(pActionHdr->actionID) {
                 case SIR_MAC_RRM_RADIO_MEASURE_REQ:
@@ -2371,9 +1829,11 @@ limProcessActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession ps
         }
         else
         {
-            // Else we will just ignore the RRM messages.
+            /* Else we will just ignore the RRM messages.*/
             limLog(pMac, LOG1,
-              FL("RRM Action frame ignored as RRM is disabled in cfg"));
+              FL("RRM Action frame ignored as rrmEnable is %d or DHCP not completed %d"),
+              pMac->rrm.rrmPEContext.rrmEnable,
+              pMac->roam.roamSession[psessionEntry->smeSessionId].dhcp_done);
         }
         break;
 #endif
@@ -2429,6 +1889,12 @@ limProcessActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession ps
               pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo);
               frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
 
+              if (frameLen < sizeof(pPubAction)) {
+                limLog(pMac, LOG1,
+                  FL("Received action frame of invalid len %d"), frameLen);
+                break;
+              }
+
               //Check if it is a P2P public action frame.
               if (vos_mem_compare(pPubAction->Oui, P2POui, 4))
               {
@@ -2437,7 +1903,8 @@ limProcessActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession ps
                  limSendSmeMgmtFrameInd(pMac, pHdr->fc.subType,
                     (tANI_U8*)pHdr, frameLen + sizeof(tSirMacMgmtHdr),
                     psessionEntry->smeSessionId,
-                    WDA_GET_RX_CH( pRxPacketInfo ), psessionEntry, 0);
+                    WDA_GET_RX_CH( pRxPacketInfo ), psessionEntry,
+                    WDA_GET_RX_RSSI_NORMALIZED(pRxPacketInfo));
               }
               else
               {
@@ -2460,7 +1927,8 @@ limProcessActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession ps
               limSendSmeMgmtFrameInd(pMac, pHdr->fc.subType,
                     (tANI_U8*)pHdr, frameLen + sizeof(tSirMacMgmtHdr),
                     psessionEntry->smeSessionId,
-                    WDA_GET_RX_CH( pRxPacketInfo ), psessionEntry, 0);
+                    WDA_GET_RX_CH( pRxPacketInfo ), psessionEntry,
+                    WDA_GET_RX_RSSI_NORMALIZED(pRxPacketInfo));
             }
             break;
 #ifdef FEATURE_WLAN_TDLS
@@ -2554,7 +2022,8 @@ limProcessActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession ps
                                frameLen + sizeof(tSirMacMgmtHdr),
                                psessionEntry->smeSessionId,
                                WDA_GET_RX_CH(pRxPacketInfo),
-                               psessionEntry, 0);
+                               psessionEntry,
+                               WDA_GET_RX_RSSI_NORMALIZED(pRxPacketInfo));
         break;
     }
     default:
@@ -2606,6 +2075,12 @@ limProcessActionFrameNoSession(tpAniSirGlobal pMac, tANI_U8 *pBd)
                 pHdr = WDA_GET_RX_MAC_HEADER(pBd);
                 frameLen = WDA_GET_RX_PAYLOAD_LEN(pBd);
 
+                if (frameLen < sizeof(pActionHdr)) {
+                  limLog(pMac, LOG1,
+                    FL("Received action frame of invalid len %d"), frameLen);
+                  break;
+                }
+
                 //Check if it is a P2P public action frame.
                 if (vos_mem_compare(pActionHdr->Oui, P2POui, 4))
                 {
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index a8ba2145801..34c6dd2cd7d 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,7 +38,7 @@
  */
 #include "palTypes.h"
 #include "aniGlobal.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "sirApi.h"
 #include "cfgApi.h"
 
@@ -54,13 +54,10 @@
 #include "limAdmitControl.h"
 #include "palApi.h"
 #include "limSessionUtils.h"
-#ifdef WLAN_FEATURE_11W
-#include "wniCfgAp.h"
-#endif
-
 
 #include "vos_types.h"
 #include "vos_utils.h"
+#include "wma.h"
 /**
  * limConvertSupportedChannels
  *
@@ -268,6 +265,11 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
           psessionEntry->peSessionId, GET_LIM_SYSTEM_ROLE(psessionEntry),
           psessionEntry->limMlmState, MAC_ADDR_ARRAY(pHdr->sa));
 
+   if (pMac->sap.SapDfsInfo.sap_enable_radar_war && (NV_CHANNEL_DFS ==
+           vos_nv_getChannelEnabledState(psessionEntry->currentOperChannel))) {
+       wma_ignore_radar_soon_after_assoc();
+       wma_stop_radar_delay_timer();
+   }
    if (LIM_IS_STA_ROLE(psessionEntry) ||
        LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
         limLog(pMac, LOGE, FL("received unexpected ASSOC REQ on sessionid: %d "
@@ -278,7 +280,15 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
         WDA_GET_RX_MPDU_DATA(pRxPacketInfo), framelen);
         return;
     }
-
+    if (psessionEntry->limMlmState == eLIM_MLM_WT_DEL_BSS_RSP_STATE) {
+        limLog(pMac, LOGE, FL("drop ASSOC REQ on sessionid: %d "
+              "role=%d from: "MAC_ADDRESS_STR" in limMlmState %d"),
+              psessionEntry->peSessionId,
+              GET_LIM_SYSTEM_ROLE(psessionEntry),
+              MAC_ADDR_ARRAY(pHdr->sa),
+              eLIM_MLM_WT_DEL_BSS_RSP_STATE);
+        return;
+    }
     /*
      * If a STA is already present in DPH and it
      * is initiating a Assoc re-transmit, do not
@@ -311,7 +321,7 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
              */
             limSendAssocRspMgmtFrame(pMac, eSIR_SUCCESS,
                     pStaDs->assocId, pStaDs->staAddr,
-                    pStaDs->mlmStaContext.subType, pStaDs,
+                    subType, pStaDs,
                     psessionEntry);
             limLog(pMac, LOGE,
                    FL("DUT already received an assoc request frame "
@@ -548,7 +558,7 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
 
     if (LIM_IS_AP_ROLE(psessionEntry) &&
        (psessionEntry->dot11mode == WNI_CFG_DOT11_MODE_11AC_ONLY) &&
-       (vht_caps != NULL) && (!vht_caps->present)) {
+       ((vht_caps == NULL) || ((vht_caps != NULL) && (!vht_caps->present)))) {
         limSendAssocRspMgmtFrame( pMac, eSIR_MAC_CAPABILITIES_NOT_SUPPORTED_STATUS,
                                   1, pHdr->sa, subType, 0, psessionEntry );
         limLog(pMac, LOGE, FL("SOFTAP was in 11AC only mode, reject"));
@@ -742,10 +752,18 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
                 if(pAssocReq->rsn.length)
                 {
                     // Unpack the RSN IE
-                    dot11fUnpackIeRSN(pMac,
+                    if (dot11fUnpackIeRSN(pMac,
                                         &pAssocReq->rsn.info[0],
                                         pAssocReq->rsn.length,
-                                        &Dot11fIERSN);
+                                        &Dot11fIERSN) != DOT11F_PARSE_SUCCESS)
+                    {
+                        limLog(pMac, LOG1,
+                            FL("Invalid RSNIE received"));
+                        limSendAssocRspMgmtFrame(pMac,
+                            eSIR_MAC_INVALID_RSN_IE_CAPABILITIES_STATUS,
+                            1, pHdr->sa, subType, 0,psessionEntry);
+                        goto error;
+                    }
 
                     /* Check RSN version is supported or not */
                     if(SIR_MAC_OUI_VERSION_1 == Dot11fIERSN.version)
@@ -811,10 +829,17 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
                 // Unpack the WPA IE
                 if(pAssocReq->wpa.length)
                 {
-                    dot11fUnpackIeWPA(pMac,
+                    if (dot11fUnpackIeWPA(pMac,
                                         &pAssocReq->wpa.info[4], //OUI is not taken care
                                         pAssocReq->wpa.length,
-                                        &Dot11fIEWPA);
+                                        &Dot11fIEWPA) != DOT11F_PARSE_SUCCESS)
+                    {
+                        limLog(pMac, LOGE, FL("Invalid WPA IE"));
+                        limSendAssocRspMgmtFrame(pMac,
+                                eSIR_MAC_INVALID_INFORMATION_ELEMENT_STATUS,
+                                1, pHdr->sa, subType, 0,psessionEntry);
+                        goto error;
+                    }
                     /* check the groupwise and pairwise cipher suites */
                     if(eSIR_SUCCESS != (status = limCheckRxWPAIeMatch(pMac, Dot11fIEWPA, psessionEntry, pAssocReq->HTCaps.present)))
                     {
@@ -1305,6 +1330,12 @@ sendIndToSme:
         pStaDs->vhtLdpcCapable = (tANI_U8)vht_caps->ldpcCodingCap;
     }
 
+    if (pAssocReq->ExtCap.present)
+            pStaDs->non_ecsa_capable =
+                !((struct s_ext_cap *)pAssocReq->ExtCap.bytes)->extChanSwitch;
+    else
+            pStaDs->non_ecsa_capable = 1;
+
     if (!pAssocReq->wmeInfoPresent) {
         pStaDs->mlmStaContext.htCapability = 0;
 #ifdef WLAN_FEATURE_11AC
@@ -1437,9 +1468,9 @@ if (limPopulateMatchingRateSet(pMac,
                              (tSirResultCodes) eSIR_MAC_UNSPEC_FAILURE_STATUS, psessionEntry);
         goto error;
     }
-    if (WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_APMIN > retryInterval)
+    if (WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STAMIN > retryInterval)
     {
-        retryInterval = WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_APDEF;
+        retryInterval = WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STADEF;
     }
     if (tx_timer_create(&pStaDs->pmfSaQueryTimer, "PMF SA Query timer",
                         limPmfSaQueryTimerHandler, timerId.value,
@@ -1466,6 +1497,8 @@ if (limPopulateMatchingRateSet(pMac,
         PELOG1(limLog(pMac, LOG1, FL("ExtCap not present"));)
     }
 
+    pStaDs->sub20_dynamic_channelwidth = pAssocReq->vendor_sub20_capability;
+
     // BTAMP: Storing the parsed assoc request in the psessionEntry array
     if(psessionEntry->parsedAssocReq)
         psessionEntry->parsedAssocReq[pStaDs->assocId] = pAssocReq;
@@ -1593,7 +1626,55 @@ error:
 
 } /*** end limProcessAssocReqFrame() ***/
 
+static uint8_t lim_get_max_rate_idx(tSirMacRateSet *rateset)
+{
+	uint8_t maxidx = 0;
+	int i;
+
+	maxidx = rateset->rate[0] & 0x7f;
+	for (i = 1; i < rateset->numRates; i++) {
+		if ((rateset->rate[i] & 0x7f) > maxidx)
+			maxidx = rateset->rate[i] & 0x7f;
+	}
 
+	return maxidx;
+}
+
+#ifdef WLAN_FEATURE_11AC
+static void fill_mlm_assoc_ind_vht(tpSirAssocReq assocreq,
+		tpDphHashNode stads,
+		tpLimMlmAssocInd assocind)
+{
+	if (stads->mlmStaContext.vhtCapability) {
+		/* ampdu */
+		assocind->ampdu = 1;
+
+		/* sgi */
+		if (assocreq->VHTCaps.shortGI80MHz ||
+		    assocreq->VHTCaps.shortGI160and80plus80MHz)
+			assocind->sgi_enable = 1;
+
+		/* stbc */
+		assocind->tx_stbc = assocreq->VHTCaps.txSTBC;
+		assocind->rx_stbc = assocreq->VHTCaps.rxSTBC;
+
+		/* ch width */
+		assocind->ch_width = stads->vhtSupportedChannelWidthSet ?
+			eHT_CHANNEL_WIDTH_80MHZ :
+			stads->htSupportedChannelWidthSet ?
+			eHT_CHANNEL_WIDTH_40MHZ : eHT_CHANNEL_WIDTH_20MHZ;
+
+		/* mode */
+		assocind->mode = SIR_SME_PHY_MODE_VHT;
+		assocind->rx_mcs_map = assocreq->VHTCaps.rxMCSMap & 0xff;
+		assocind->tx_mcs_map = assocreq->VHTCaps.txMCSMap & 0xff;
+	}
+}
+#else
+static void fill_assoc_ind_vht(tpSirAssocReq assocreq,
+		tpDphHashNode stads,
+		tpLimMlmAssocInd assocind) { }
+#endif
 
 /**---------------------------------------------------------------
 \fn     limSendMlmAssocInd
@@ -1623,6 +1704,7 @@ void limSendMlmAssocInd(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpPESession p
     tANI_U8                 subType;
     tANI_U8                 *wpsIe = NULL;
     tANI_U32                tmp;
+    uint8_t                 maxidx;
     tANI_U16                i, j=0;
 
     // Get a copy of the already parsed Assoc Request
@@ -1849,6 +1931,56 @@ void limSendMlmAssocInd(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpPESession p
         pMlmAssocInd->chan_info.rate_flags =
                       lim_get_max_rate_flags(pMac, pStaDs);
 
+        pMlmAssocInd->chan_info.sub20_channelwidth =
+                 pStaDs->sub20_dynamic_channelwidth;
+        if (pAssocReq->ExtCap.present)
+                pMlmAssocInd->ecsa_capable =
+                  ((struct s_ext_cap *)pAssocReq->ExtCap.bytes)->extChanSwitch;
+        pMlmAssocInd->ampdu = 0;
+        pMlmAssocInd->sgi_enable = 0;
+        pMlmAssocInd->tx_stbc = 0;
+        pMlmAssocInd->rx_stbc = 0;
+        pMlmAssocInd->ch_width = eHT_CHANNEL_WIDTH_20MHZ;
+        pMlmAssocInd->mode = SIR_SME_PHY_MODE_LEGACY;
+        pMlmAssocInd->max_supp_idx = 0xff;
+        pMlmAssocInd->max_ext_idx = 0xff;
+        pMlmAssocInd->max_mcs_idx = 0xff;
+        pMlmAssocInd->rx_mcs_map = 0xff;
+        pMlmAssocInd->tx_mcs_map = 0xff;
+
+        if (pAssocReq->supportedRates.numRates)
+            pMlmAssocInd->max_supp_idx =
+                lim_get_max_rate_idx(&pAssocReq->supportedRates);
+        if (pAssocReq->extendedRates.numRates)
+            pMlmAssocInd->max_ext_idx =
+                lim_get_max_rate_idx(&pAssocReq->extendedRates);
+
+        if (pStaDs->mlmStaContext.htCapability) {
+            /* ampdu */
+            pMlmAssocInd->ampdu = 1;
+
+            /* sgi */
+            if (pStaDs->htShortGI20Mhz || pStaDs->htShortGI40Mhz)
+                pMlmAssocInd->sgi_enable = 1;
+
+            /* stbc */
+            pMlmAssocInd->tx_stbc = pAssocReq->HTCaps.txSTBC;
+            pMlmAssocInd->rx_stbc = pAssocReq->HTCaps.rxSTBC;
+
+            /* ch width */
+            pMlmAssocInd->ch_width = pStaDs->htSupportedChannelWidthSet ?
+                eHT_CHANNEL_WIDTH_40MHZ: eHT_CHANNEL_WIDTH_20MHZ;
+
+            /* mode */
+            pMlmAssocInd->mode = SIR_SME_PHY_MODE_HT;
+            maxidx = 0;
+            for (i = 0; i < 8; i++) {
+                if (pAssocReq->HTCaps.supportedMCSSet[0] & 1 << i)
+                    maxidx = i;
+            }
+            pMlmAssocInd->max_mcs_idx = maxidx;
+        }
+        fill_mlm_assoc_ind_vht(pAssocReq, pStaDs, pMlmAssocInd);
         limPostSmeMessage(pMac, LIM_MLM_ASSOC_IND, (tANI_U32 *) pMlmAssocInd);
         vos_mem_free(pMlmAssocInd);
     }
@@ -1985,6 +2117,10 @@ void limSendMlmAssocInd(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpPESession p
         pMlmReassocInd->beaconPtr = psessionEntry->beacon;
         pMlmReassocInd->beaconLength = psessionEntry->bcnLen;
 
+        if (pAssocReq->ExtCap.present)
+                pMlmReassocInd->ecsa_capable =
+                   ((struct s_ext_cap *)pAssocReq->ExtCap.bytes)->extChanSwitch;
+
         limPostSmeMessage(pMac, LIM_MLM_REASSOC_IND, (tANI_U32 *) pMlmReassocInd);
         vos_mem_free(pMlmReassocInd);
     }
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c
index 314f2009967..f2eb391aa19 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAssocRspFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,7 +38,7 @@
  */
 
 #include "wniApi.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "aniGlobal.h"
 #include "cfgApi.h"
 
@@ -55,6 +55,7 @@
 #if defined(FEATURE_WLAN_ESE) && !defined(FEATURE_WLAN_ESE_UPLOAD)
 #include "eseApi.h"
 #endif
+#include "lim_process_fils.h"
 
 extern tSirRetStatus schBeaconEdcaProcess(tpAniSirGlobal pMac, tSirMacEdcaParamSetIE *edca, tpPESession psessionEntry);
 
@@ -114,53 +115,61 @@ void limUpdateAssocStaDatas(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpSirAsso
                else
                    pStaDs->htSupportedChannelWidthSet = eHT_CHANNEL_WIDTH_20MHZ;
 
-                   pStaDs->htLsigTXOPProtection = ( tANI_U8 ) pAssocRsp->HTCaps.lsigTXOPProtection;
-                   pStaDs->htMIMOPSState =  (tSirMacHTMIMOPowerSaveState)pAssocRsp->HTCaps.mimoPowerSave;
-                   pStaDs->htMaxAmsduLength = ( tANI_U8 ) pAssocRsp->HTCaps.maximalAMSDUsize;
-                   pStaDs->htAMpduDensity =             pAssocRsp->HTCaps.mpduDensity;
-                   pStaDs->htDsssCckRate40MHzSupport = (tANI_U8)pAssocRsp->HTCaps.dsssCckMode40MHz;
-                   pStaDs->htMaxRxAMpduFactor = pAssocRsp->HTCaps.maxRxAMPDUFactor;
-                   limFillRxHighestSupportedRate(pMac, &rxHighestRate, pAssocRsp->HTCaps.supportedMCSSet);
-                   pStaDs->supportedRates.rxHighestDataRate = rxHighestRate;
-                   /* This is for AP as peer STA and we are INFRA STA. We will put APs offset in dph node which is peer STA */
-                   pStaDs->htSecondaryChannelOffset = (tANI_U8)pAssocRsp->HTInfo.secondaryChannelOffset;
-
-                   //FIXME_AMPDU
-                   // In the future, may need to check for "assoc.HTCaps.delayedBA"
-                   // For now, it is IMMEDIATE BA only on ALL TID's
-                   pStaDs->baPolicyFlag = 0xFF;
-
-                   /*
-                    * Check if we have support for gShortGI20Mhz and
-                    * gShortGI40Mhz from ini file.
-                    */
-                   if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac,
+               pStaDs->htLsigTXOPProtection =
+	       ( tANI_U8 ) pAssocRsp->HTCaps.lsigTXOPProtection;
+               pStaDs->htMIMOPSState =
+	       (tSirMacHTMIMOPowerSaveState)pAssocRsp->HTCaps.mimoPowerSave;
+               pStaDs->htMaxAmsduLength =
+	       ( tANI_U8 ) pAssocRsp->HTCaps.maximalAMSDUsize;
+               pStaDs->htAMpduDensity = pAssocRsp->HTCaps.mpduDensity;
+               pStaDs->htDsssCckRate40MHzSupport =
+	       (tANI_U8)pAssocRsp->HTCaps.dsssCckMode40MHz;
+               pStaDs->htMaxRxAMpduFactor = pAssocRsp->HTCaps.maxRxAMPDUFactor;
+               limFillRxHighestSupportedRate(pMac, &rxHighestRate,
+	       		pAssocRsp->HTCaps.supportedMCSSet);
+               pStaDs->supportedRates.rxHighestDataRate = rxHighestRate;
+               /* This is for AP as peer STA and we are INFRA STA.
+	        * We will put APs offset in dph node which is peer STA
+		*/
+               pStaDs->htSecondaryChannelOffset =
+	       (tANI_U8)pAssocRsp->HTInfo.secondaryChannelOffset;
+
+               //FIXME_AMPDU
+               // In the future, may need to check for "assoc.HTCaps.delayedBA"
+               // For now, it is IMMEDIATE BA only on ALL TID's
+               pStaDs->baPolicyFlag = 0xFF;
+
+               /*
+                * Check if we have support for gShortGI20Mhz and
+                * gShortGI40Mhz from ini file.
+                */
+               if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac,
                                           WNI_CFG_SHORT_GI_20MHZ,
                                           &shortgi_20mhz_support))) {
-                       if (VOS_TRUE == shortgi_20mhz_support)
-                           pStaDs->htShortGI20Mhz =
+                   if (VOS_TRUE == shortgi_20mhz_support)
+                       pStaDs->htShortGI20Mhz =
                                   (tANI_U8)pAssocRsp->HTCaps.shortGI20MHz;
-                       else
-                           pStaDs->htShortGI20Mhz = VOS_FALSE;
-                   } else {
-                       limLog(pMac, LOGE,
-                              FL("could not retrieve shortGI 20Mhz CFG, setting value to default"));
-                       pStaDs->htShortGI20Mhz = WNI_CFG_SHORT_GI_20MHZ_STADEF;
-                   }
-
-                   if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac,
+                   else
+                       pStaDs->htShortGI20Mhz = VOS_FALSE;
+               } else {
+                   limLog(pMac, LOGE,
+                       FL("could not retrieve shortGI 20Mhz CFG, setting value to default"));
+                   pStaDs->htShortGI20Mhz = WNI_CFG_SHORT_GI_20MHZ_STADEF;
+               }
+
+               if (HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac,
                                           WNI_CFG_SHORT_GI_40MHZ,
                                           &shortgi_40mhz_support))) {
-                       if (VOS_TRUE == shortgi_40mhz_support)
-                           pStaDs->htShortGI40Mhz =
+                   if (VOS_TRUE == shortgi_40mhz_support)
+                       pStaDs->htShortGI40Mhz =
                                    (tANI_U8)pAssocRsp->HTCaps.shortGI40MHz;
-                       else
-                           pStaDs->htShortGI40Mhz = VOS_FALSE;
-                   } else {
-                       limLog(pMac, LOGE,
-                              FL("could not retrieve shortGI 40Mhz CFG,setting value to default"));
-                       pStaDs->htShortGI40Mhz = WNI_CFG_SHORT_GI_40MHZ_STADEF;
-                   }
+                   else
+                       pStaDs->htShortGI40Mhz = VOS_FALSE;
+               } else {
+                   limLog(pMac, LOGE,
+                      FL("could not retrieve shortGI 40Mhz CFG,setting value to default"));
+                   pStaDs->htShortGI40Mhz = WNI_CFG_SHORT_GI_40MHZ_STADEF;
+               }
            }
        }
 
@@ -506,9 +515,8 @@ limProcessAssocRspFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tANI_U8 sub
 #endif
     pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
 
-    // parse Re/Association Response frame.
     if (sirConvertAssocRespFrame2Struct(
-                        pMac, pBody, frameLen, pAssocRsp) == eSIR_FAILURE)
+                        pMac, psessionEntry, pBody, frameLen, pAssocRsp) == eSIR_FAILURE)
     {
         vos_mem_free(pAssocRsp);
         PELOGE(limLog(pMac, LOGE, FL("Parse error Assoc resp subtype %d,"
@@ -536,16 +544,18 @@ limProcessAssocRspFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tANI_U8 sub
         psessionEntry->assocRspLen = 0;
     }
 
-    psessionEntry->assocRsp = vos_mem_malloc(frameLen);
-    if (NULL == psessionEntry->assocRsp)
-    {
-        PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc response, len = %d"), frameLen);)
-    }
-    else
-    {
-        //Store the Assoc response. This is sent to csr/hdd in join cnf response.
-        vos_mem_copy(psessionEntry->assocRsp, pBody, frameLen);
-        psessionEntry->assocRspLen = frameLen;
+    if (frameLen) {
+        psessionEntry->assocRsp = vos_mem_malloc(frameLen);
+        if (NULL == psessionEntry->assocRsp)
+        {
+            PELOGE(limLog(pMac, LOGE, FL("Unable to allocate memory to store assoc response, len = %d"), frameLen);)
+        }
+        else
+        {
+            //Store the Assoc response. This is sent to csr/hdd in join cnf response.
+            vos_mem_copy(psessionEntry->assocRsp, pBody, frameLen);
+            psessionEntry->assocRspLen = frameLen;
+        }
     }
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -716,6 +726,20 @@ limProcessAssocRspFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tANI_U8 sub
 
         goto assocReject;
     }
+
+    if (!lim_verify_fils_params_assoc_rsp(pMac, psessionEntry,
+                                       pAssocRsp, &mlmAssocCnf))
+    {
+        /* Log error */
+        PELOGW(limLog(pMac, LOGE, "FILS params doesnot match");)
+        mlmAssocCnf.resultCode = eSIR_SME_INVALID_ASSOC_RSP_RXED;
+        mlmAssocCnf.protStatusCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
+
+        /* Send advisory Disassociation frame to AP */
+        limSendDisassocMgmtFrame(pMac, eSIR_MAC_UNSPEC_FAILURE_REASON,
+                                 pHdr->sa, psessionEntry, FALSE);
+        goto assocReject;
+    }
     // Association Response received with success code
     /*
      * Set the link state to POSTASSOC now that we have received
@@ -979,10 +1003,21 @@ limProcessAssocRspFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tANI_U8 sub
     limUpdateAssocStaDatas(pMac, pStaDs, pAssocRsp,psessionEntry);
     // Extract the AP capabilities from the beacon that was received earlier
     // TODO - Watch out for an error response!
-    limExtractApCapabilities( pMac,
-                            (tANI_U8 *) psessionEntry->pLimJoinReq->bssDescription.ieFields,
-                            limGetIElenFromBssDescription( &psessionEntry->pLimJoinReq->bssDescription ),
-                            pBeaconStruct );
+    limExtractApCapabilities(pMac,
+      (tANI_U8 *) psessionEntry->pLimJoinReq->bssDescription.ieFields,
+      GET_IE_LEN_IN_BSS(psessionEntry->pLimJoinReq->bssDescription.length),
+      pBeaconStruct);
+
+    if (pBeaconStruct->VHTCaps.present)
+        psessionEntry->vht_caps = pBeaconStruct->VHTCaps;
+    if (pBeaconStruct->HTCaps.present)
+        psessionEntry->ht_caps = pBeaconStruct->HTCaps;
+    if (pBeaconStruct->hs20vendor_ie.present)
+        psessionEntry->hs20vendor_ie = pBeaconStruct->hs20vendor_ie;
+    if (pBeaconStruct->HTInfo.present)
+        psessionEntry->ht_operation = pBeaconStruct->HTInfo;
+    if (pBeaconStruct->VHTOperation.present)
+        psessionEntry->vht_operation = pBeaconStruct->VHTOperation;
 
     if(pMac->lim.gLimProtectionControl != WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
         limDecideStaProtectionOnAssoc(pMac, pBeaconStruct, psessionEntry);
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAuthFrame.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
index 355765784a0..3a88aa4bbc9 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,7 +39,7 @@
  */
 
 #include "wniApi.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "aniGlobal.h"
 #include "cfgApi.h"
 
@@ -52,7 +52,7 @@
 #include "limFT.h"
 #endif
 #include "vos_utils.h"
-
+#include "lim_process_fils.h"
 
 /**
  * isAuthValid
@@ -147,11 +147,13 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
 {
     tANI_U8                 *pBody, keyId, cfgPrivacyOptImp,
                             defaultKey[SIR_MAC_KEY_LENGTH],
-                            encrAuthFrame[LIM_ENCR_AUTH_BODY_LEN],
-                            plainBody[256];
+                            *encrAuthFrame = NULL,
+                            *plainBody = NULL;
     tANI_U16                frameLen;
     tANI_U32                maxNumPreAuth, val;
-    tSirMacAuthFrameBody    *pRxAuthFrameBody, rxAuthFrame, authFrame;
+    tSirMacAuthFrameBody    *pRxAuthFrameBody,
+                            *rxAuthFrame = NULL,
+                            *authFrame = NULL;
     tpSirMacMgmtHdr         pHdr;
     tCfgWepKeyEntry         *pKeyMapEntry = NULL;
     struct tLimPreAuthNode  *pAuthNode;
@@ -159,7 +161,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
     tANI_U8                 decryptResult;
     tANI_U8                 *pChallenge;
     tANI_U32                key_length=8;
-    tANI_U8                 challengeTextArray[SIR_MAC_AUTH_CHALLENGE_LENGTH];
+    tANI_U8                 *challengeTextArray = NULL;
     tpDphHashNode           pStaDs = NULL;
     tANI_U16                assocId = 0;
     tANI_U16                currSeqNum = 0;
@@ -208,6 +210,35 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                           psessionEntry->defaultAuthFailureTimeout, NULL, eANI_BOOLEAN_FALSE);
     }
 
+    rxAuthFrame = vos_mem_malloc(sizeof(tSirMacAuthFrameBody));
+    if (!rxAuthFrame) {
+        limLog(pMac, LOGE, FL("Failed to allocate memory"));
+        return;
+    }
+
+    authFrame = vos_mem_malloc(sizeof(tSirMacAuthFrameBody));
+    if (!authFrame) {
+        limLog(pMac, LOGE, FL("failed to allocate memory"));
+        goto free;
+    }
+
+    plainBody = vos_mem_malloc(LIM_ENCR_AUTH_BODY_LEN);
+    if (!plainBody) {
+        limLog(pMac, LOGE, FL("failed to allocate memory"));
+        goto free;
+    }
+
+    challengeTextArray = vos_mem_malloc(SIR_MAC_SAP_AUTH_CHALLENGE_LENGTH);
+    if(!challengeTextArray) {
+        limLog(pMac, LOGE, FL("failed to allocate memory"));
+        goto free;
+    }
+
+    vos_mem_set(rxAuthFrame, sizeof(tSirMacAuthFrameBody), 0);
+    vos_mem_set(authFrame, sizeof(tSirMacAuthFrameBody), 0);
+    vos_mem_set(plainBody, LIM_ENCR_AUTH_BODY_LEN, 0);
+    vos_mem_set(challengeTextArray, SIR_MAC_SAP_AUTH_CHALLENGE_LENGTH, 0);
+
     /// Determine if WEP bit is set in the FC or received MAC header
     if (pHdr->fc.wep)
     {
@@ -224,7 +255,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
 
             limSendDeauthMgmtFrame( pMac, eSIR_MAC_MIC_FAILURE_REASON,
                                     pHdr->sa, psessionEntry, FALSE );
-            return;
+            goto free;
         }
 
         // Extract key ID from IV (most 2 bits of 4th byte of IV)
@@ -242,24 +273,25 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
 
         if (LIM_IS_STA_ROLE(psessionEntry) ||
             LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
-            authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-            authFrame.authTransactionSeqNumber = SIR_MAC_AUTH_FRAME_4;
-            authFrame.authStatusCode = eSIR_MAC_CHALLENGE_FAILURE_STATUS;
+            authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+            authFrame->authTransactionSeqNumber = SIR_MAC_AUTH_FRAME_4;
+            authFrame->authStatusCode = eSIR_MAC_CHALLENGE_FAILURE_STATUS;
             // Log error
             PELOGE(limLog(pMac, LOGE,
                    FL("received Authentication frame with wep bit set on role=%d"
                    MAC_ADDRESS_STR), GET_LIM_SYSTEM_ROLE(psessionEntry),
                    MAC_ADDR_ARRAY(pHdr->sa));)
 
-            limSendAuthMgmtFrame(pMac, &authFrame,
+            limSendAuthMgmtFrame(pMac, authFrame,
                                  pHdr->sa,
                                  LIM_NO_WEP_IN_FC,
                                  psessionEntry,
                                  eSIR_FALSE);
-            return;
+            goto free;
         }
 
-        if (frameLen < LIM_ENCR_AUTH_BODY_LEN)
+        if ((frameLen < LIM_ENCR_AUTH_BODY_LEN_SAP) ||
+            (frameLen > LIM_ENCR_AUTH_BODY_LEN))
         {
             // Log error
             limLog(pMac, LOGE,
@@ -267,7 +299,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                    frameLen);
             limPrintMacAddr(pMac, pHdr->sa, LOGE);
 
-            return;
+            goto free;
         }
         if (LIM_IS_AP_ROLE(psessionEntry)) {
             val = psessionEntry->privacy;
@@ -307,18 +339,18 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                  * an Authentication frame with FC bit set.
                  * Send Auth frame4 with 'out of sequence' status code.
                  */
-                authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                authFrame.authTransactionSeqNumber =
+                authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                authFrame->authTransactionSeqNumber =
                 SIR_MAC_AUTH_FRAME_4;
-                authFrame.authStatusCode =
+                authFrame->authStatusCode =
                 eSIR_MAC_AUTH_FRAME_OUT_OF_SEQ_STATUS;
 
-                limSendAuthMgmtFrame(pMac, &authFrame,
+                limSendAuthMgmtFrame(pMac, authFrame,
                                      pHdr->sa,
                                      LIM_NO_WEP_IN_FC,
                                      psessionEntry,
                                      eSIR_FALSE);
-                return;
+                goto free;
             }
             else
             {
@@ -345,18 +377,18 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                      * out of sequence Auth frame status code.
                      */
 
-                    authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                    authFrame.authTransactionSeqNumber =
+                    authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                    authFrame->authTransactionSeqNumber =
                     SIR_MAC_AUTH_FRAME_4;
-                    authFrame.authStatusCode =
+                    authFrame->authStatusCode =
                     eSIR_MAC_AUTH_FRAME_OUT_OF_SEQ_STATUS;
 
-                    limSendAuthMgmtFrame(pMac, &authFrame,
+                    limSendAuthMgmtFrame(pMac, authFrame,
                                          pHdr->sa,
                                          LIM_NO_WEP_IN_FC,
                                          psessionEntry,
                                          eSIR_FALSE);
-                    return;
+                    goto free;
                 }
             }
 
@@ -379,18 +411,18 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                      * Send Authentication frame
                      * with challenge failure status code
                      */
-                    authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                    authFrame.authTransactionSeqNumber =
+                    authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                    authFrame->authTransactionSeqNumber =
                     SIR_MAC_AUTH_FRAME_4;
-                    authFrame.authStatusCode =
+                    authFrame->authStatusCode =
                     eSIR_MAC_CHALLENGE_FAILURE_STATUS;
 
-                    limSendAuthMgmtFrame(pMac, &authFrame,
+                    limSendAuthMgmtFrame(pMac, authFrame,
                                          pHdr->sa,
                                          LIM_NO_WEP_IN_FC,
                                          psessionEntry,
                                          eSIR_FALSE);
-                    return;
+                    goto free;
                 } // if (!pKeyMapEntry->wepOn)
                 else
                 {
@@ -408,30 +440,30 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
 
                         limDeletePreAuthNode(pMac,
                                              pHdr->sa);
-                        authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                        authFrame.authTransactionSeqNumber =
+                        authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                        authFrame->authTransactionSeqNumber =
                         SIR_MAC_AUTH_FRAME_4;
-                        authFrame.authStatusCode =
+                        authFrame->authStatusCode =
                         eSIR_MAC_CHALLENGE_FAILURE_STATUS;
 
                         limSendAuthMgmtFrame(
-                                            pMac, &authFrame,
+                                            pMac, authFrame,
                                             pHdr->sa,
                                             LIM_NO_WEP_IN_FC,
                                             psessionEntry,
                                             eSIR_FALSE);
 
 
-                        return;
+                        goto free;
                     }
 
                     if ((sirConvertAuthFrame2Struct(pMac, plainBody, frameLen-8,
-                         &rxAuthFrame)!=eSIR_SUCCESS ) ||
-                        ( !isAuthValid(pMac, &rxAuthFrame,psessionEntry)))
+                         rxAuthFrame)!=eSIR_SUCCESS ) ||
+                        ( !isAuthValid(pMac, rxAuthFrame,psessionEntry)))
                     {
                         PELOGE(limLog(pMac, LOGE, FL(
                                "failed to convert Auth Frame to structure or Auth is not valid "));)
-                        return;
+                        goto free;
                     }
                 } // end if (pKeyMapEntry->key == NULL)
             } // if keyMappings has entry
@@ -458,19 +490,19 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                      * with challenge failure status code
                      */
 
-                    authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                    authFrame.authTransactionSeqNumber =
+                    authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                    authFrame->authTransactionSeqNumber =
                     SIR_MAC_AUTH_FRAME_4;
-                    authFrame.authStatusCode =
+                    authFrame->authStatusCode =
                     eSIR_MAC_CHALLENGE_FAILURE_STATUS;
 
-                    limSendAuthMgmtFrame(pMac, &authFrame,
+                    limSendAuthMgmtFrame(pMac, authFrame,
                                          pHdr->sa,
                                          LIM_NO_WEP_IN_FC,
                                          psessionEntry,
                                          eSIR_FALSE);
 
-                    return;
+                    goto free;
                 }
 
                     key_length=val;
@@ -489,27 +521,27 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                        /// ICV failure
                         limDeletePreAuthNode(pMac,
                                              pHdr->sa);
-                        authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                        authFrame.authTransactionSeqNumber =
+                        authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                        authFrame->authTransactionSeqNumber =
                         SIR_MAC_AUTH_FRAME_4;
-                        authFrame.authStatusCode =
+                        authFrame->authStatusCode =
                         eSIR_MAC_CHALLENGE_FAILURE_STATUS;
 
                         limSendAuthMgmtFrame(
-                                            pMac, &authFrame,
+                                            pMac, authFrame,
                                             pHdr->sa,
                                             LIM_NO_WEP_IN_FC,
                                             psessionEntry,
                                             eSIR_FALSE);
-                        return;
+                        goto free;
                     }
                     if ( ( sirConvertAuthFrame2Struct(pMac, plainBody, frameLen-8,
-                          &rxAuthFrame)!=eSIR_SUCCESS ) ||
-                        ( !isAuthValid(pMac, &rxAuthFrame, psessionEntry) ) )
+                          rxAuthFrame)!=eSIR_SUCCESS ) ||
+                        ( !isAuthValid(pMac, rxAuthFrame, psessionEntry) ) )
                     {
                         limLog(pMac, LOGE,
                                FL("failed to convert Auth Frame to structure or Auth is not valid "));
-                        return;
+                        goto free;
                     }
             } // End of check for Key Mapping/Default key presence
         }
@@ -528,41 +560,45 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
              * should have been 'unsupported algorithm' status code.
              */
 
-            authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-            authFrame.authTransactionSeqNumber =
+            authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+            authFrame->authTransactionSeqNumber =
             SIR_MAC_AUTH_FRAME_4;
-            authFrame.authStatusCode =
+            authFrame->authStatusCode =
             eSIR_MAC_CHALLENGE_FAILURE_STATUS;
 
-            limSendAuthMgmtFrame(pMac, &authFrame,
+            limSendAuthMgmtFrame(pMac, authFrame,
                                  pHdr->sa,
                                  LIM_NO_WEP_IN_FC,
                                  psessionEntry,
                                  eSIR_FALSE);
-            return;
+            goto free;
         } // else if (wlan_cfgGetInt(CFG_PRIVACY_OPTION_IMPLEMENTED))
     } // if (fc.wep)
     else
     {
         if ( ( sirConvertAuthFrame2Struct(pMac, pBody,
-            frameLen, &rxAuthFrame)!=eSIR_SUCCESS ) ||
-            ( !isAuthValid(pMac, &rxAuthFrame,psessionEntry) ) )
+            frameLen, rxAuthFrame)!=eSIR_SUCCESS ) ||
+            ( !isAuthValid(pMac, rxAuthFrame,psessionEntry) ) )
         {
             PELOGE(limLog(pMac, LOGE,
                    FL("failed to convert Auth Frame to structure or Auth is not valid "));)
-            return;
+            goto free;
         }
     }
 
 
-    pRxAuthFrameBody = &rxAuthFrame;
+    pRxAuthFrameBody = rxAuthFrame;
 
-   PELOGW(limLog(pMac, LOGW,
+    PELOGW(limLog(pMac, LOGW,
            FL("Received Auth frame with type=%d seqnum=%d, status=%d (%d)"),
            (tANI_U32) pRxAuthFrameBody->authAlgoNumber,
            (tANI_U32) pRxAuthFrameBody->authTransactionSeqNumber,
            (tANI_U32) pRxAuthFrameBody->authStatusCode,(tANI_U32)pMac->lim.gLimNumPreAuthContexts);)
-
+    if (!lim_is_valid_fils_auth_frame(pMac, psessionEntry, pRxAuthFrameBody))
+    {
+        limLog(pMac, LOGE, FL("Received invalid FILS auth packet"));
+        goto free;
+    }
     // IOT Workaround: with invalid WEP password, some APs reply AUTH frame 4
     // with invalid seqNumber. This AUTH frame will be dropped by driver,
     // thus driver sends the generic status code instead of protocol status code.
@@ -638,7 +674,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                 "(staId: %d, assocId: %d) "),
                             pStaDs->staIndex, assocId);
                     limTriggerSTAdeletion(pMac, pStaDs, psessionEntry);
-                    return;
+                    goto free;
                 }
             }
 
@@ -700,7 +736,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                         limSendDeauthMgmtFrame(pMac,
                                eSIR_MAC_UNSPEC_FAILURE_REASON, (tANI_U8 *) pAuthNode->peerMacAddr, psessionEntry, FALSE);
                         limTriggerSTAdeletion(pMac, pStaDs, psessionEntry);
-                        return;
+                        goto free;
                     }
                 }
                 else
@@ -711,7 +747,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                      * in transmission queue
                      * */
                     limLog(pMac, LOGW, FL("STA is initiating Authentication after ACK lost..."));
-                    return;
+                    goto free;
                 }
             }
             if (wlan_cfgGetInt(pMac, WNI_CFG_MAX_NUM_PRE_AUTH,
@@ -733,20 +769,20 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                  * reached. Send Authentication frame
                  * with unspecified failure
                  */
-                authFrame.authAlgoNumber =
+                authFrame->authAlgoNumber =
                 pRxAuthFrameBody->authAlgoNumber;
-                authFrame.authTransactionSeqNumber =
+                authFrame->authTransactionSeqNumber =
                 pRxAuthFrameBody->authTransactionSeqNumber + 1;
-                authFrame.authStatusCode =
+                authFrame->authStatusCode =
                 eSIR_MAC_UNSPEC_FAILURE_STATUS;
 
-                limSendAuthMgmtFrame(pMac, &authFrame,
+                limSendAuthMgmtFrame(pMac, authFrame,
                                      pHdr->sa,
                                      LIM_NO_WEP_IN_FC,
                                      psessionEntry,
                                      eSIR_FALSE);
 
-                return;
+                goto free;
             }
             /// No Pre-auth context exists for the STA.
             if (limIsAuthAlgoSupported(
@@ -766,11 +802,10 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                             limLog(pMac, LOGW,
                                    FL("Max pre-auth nodes reached "));
                             limPrintMacAddr(pMac, pHdr->sa, LOGW);
-
-                            return;
+                            goto free;
                         }
 
-                        PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %p peer"), pAuthNode);
+                        PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %pK peer"), pAuthNode);
                         limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
                         vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
@@ -793,13 +828,13 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                          * status code.
                          */
 
-                        authFrame.authAlgoNumber =
+                        authFrame->authAlgoNumber =
                         pRxAuthFrameBody->authAlgoNumber;
-                        authFrame.authTransactionSeqNumber =
+                        authFrame->authTransactionSeqNumber =
                         pRxAuthFrameBody->authTransactionSeqNumber + 1;
-                        authFrame.authStatusCode = eSIR_MAC_SUCCESS_STATUS;
+                        authFrame->authStatusCode = eSIR_MAC_SUCCESS_STATUS;
                         limSendAuthMgmtFrame(
-                                            pMac, &authFrame,
+                                            pMac, authFrame,
                                             pHdr->sa,
                                             LIM_NO_WEP_IN_FC,
                                             psessionEntry,
@@ -849,20 +884,20 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                              * code.
                              */
 
-                            authFrame.authAlgoNumber =
+                            authFrame->authAlgoNumber =
                             pRxAuthFrameBody->authAlgoNumber;
-                            authFrame.authTransactionSeqNumber =
+                            authFrame->authTransactionSeqNumber =
                             pRxAuthFrameBody->authTransactionSeqNumber + 1;
-                            authFrame.authStatusCode =
+                            authFrame->authStatusCode =
                             eSIR_MAC_AUTH_ALGO_NOT_SUPPORTED_STATUS;
 
                             limSendAuthMgmtFrame(
-                                                pMac, &authFrame,
+                                                pMac, authFrame,
                                                 pHdr->sa,
                                                 LIM_NO_WEP_IN_FC,
                                                 psessionEntry,
                                                 eSIR_FALSE);
-                            return;
+                            goto free;
                         }
                         else
                         {
@@ -876,7 +911,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                        FL("Max pre-auth nodes reached "));
                                 limPrintMacAddr(pMac, pHdr->sa, LOGW);
 
-                                return;
+                                goto free;
                             }
 
                             vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
@@ -896,7 +931,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                             pAuthNode->timestamp = vos_timer_get_system_ticks();
                             limAddPreAuthNode(pMac, pAuthNode);
 
-                            PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %p id %d peer "),
+                            PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %pK id %d peer "),
                                           pAuthNode, pAuthNode->authNodeIdx);)
                             PELOG1(limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
@@ -914,32 +949,34 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                  * unspecified failure status code.
                                  */
 
-                                authFrame.authAlgoNumber =
+                                authFrame->authAlgoNumber =
                                         pRxAuthFrameBody->authAlgoNumber;
-                                authFrame.authTransactionSeqNumber =
+                                authFrame->authTransactionSeqNumber =
                                         pRxAuthFrameBody->authTransactionSeqNumber + 1;
-                                authFrame.authStatusCode =
+                                authFrame->authStatusCode =
                                         eSIR_MAC_UNSPEC_FAILURE_STATUS;
 
-                                limSendAuthMgmtFrame(pMac, &authFrame,
+                                limSendAuthMgmtFrame(pMac, authFrame,
                                                      pHdr->sa,
                                                      LIM_NO_WEP_IN_FC,
                                                      psessionEntry,
                                                      eSIR_FALSE);
 
                                 limDeletePreAuthNode(pMac, pHdr->sa);
-                                return;
+                                goto free;
                             }
 
                             limActivateAuthRspTimer(pMac, pAuthNode);
 
                             pAuthNode->fTimerStarted = 1;
 
-                            // get random bytes and use as
-                            // challenge text. If it fails we already have random stack bytes.
-                            if( !VOS_IS_STATUS_SUCCESS( vos_rand_get_bytes( 0, (tANI_U8 *)challengeTextArray, SIR_MAC_AUTH_CHALLENGE_LENGTH ) ) )
+                            /*
+                             * get random bytes and use as challenge text
+                             */
+                            if( !VOS_IS_STATUS_SUCCESS( vos_rand_get_bytes( 0, (tANI_U8 *)challengeTextArray, SIR_MAC_SAP_AUTH_CHALLENGE_LENGTH ) ) )
                             {
                                limLog(pMac, LOGE,FL("Challenge text preparation failed in limProcessAuthFrame"));
+                               goto free;
                             }
 
                             pChallenge = pAuthNode->challengeText;
@@ -952,20 +989,20 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                              * Sending Authenticaton frame with challenge.
                              */
 
-                            authFrame.authAlgoNumber =
+                            authFrame->authAlgoNumber =
                             pRxAuthFrameBody->authAlgoNumber;
-                            authFrame.authTransactionSeqNumber =
+                            authFrame->authTransactionSeqNumber =
                             pRxAuthFrameBody->authTransactionSeqNumber + 1;
-                            authFrame.authStatusCode =
+                            authFrame->authStatusCode =
                             eSIR_MAC_SUCCESS_STATUS;
-                            authFrame.type   = SIR_MAC_CHALLENGE_TEXT_EID;
-                            authFrame.length = SIR_MAC_AUTH_CHALLENGE_LENGTH;
-                            vos_mem_copy(authFrame.challengeText,
+                            authFrame->type   = SIR_MAC_CHALLENGE_TEXT_EID;
+                            authFrame->length = SIR_MAC_SAP_AUTH_CHALLENGE_LENGTH;
+                            vos_mem_copy(authFrame->challengeText,
                                          pAuthNode->challengeText,
-                                         SIR_MAC_AUTH_CHALLENGE_LENGTH);
+                                         SIR_MAC_SAP_AUTH_CHALLENGE_LENGTH);
 
                             limSendAuthMgmtFrame(
-                                                pMac, &authFrame,
+                                                pMac, authFrame,
                                                 pHdr->sa,
                                                 LIM_NO_WEP_IN_FC,
                                                 psessionEntry,
@@ -989,20 +1026,20 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                          * with auth algorithm not supported status code
                          */
 
-                        authFrame.authAlgoNumber =
+                        authFrame->authAlgoNumber =
                         pRxAuthFrameBody->authAlgoNumber;
-                        authFrame.authTransactionSeqNumber =
+                        authFrame->authTransactionSeqNumber =
                         pRxAuthFrameBody->authTransactionSeqNumber + 1;
-                        authFrame.authStatusCode =
+                        authFrame->authStatusCode =
                         eSIR_MAC_AUTH_ALGO_NOT_SUPPORTED_STATUS;
 
                         limSendAuthMgmtFrame(
-                                            pMac, &authFrame,
+                                            pMac, authFrame,
                                             pHdr->sa,
                                             LIM_NO_WEP_IN_FC,
                                             psessionEntry,
                                             eSIR_FALSE);
-                        return;
+                        goto free;
                 } // end switch(pRxAuthFrameBody->authAlgoNumber)
             } // if (limIsAuthAlgoSupported(pRxAuthFrameBody->authAlgoNumber))
             else
@@ -1018,19 +1055,19 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                  * authentication algorithm requested by sending party.
                  * Reject Authentication with StatusCode=13.
                  */
-                authFrame.authAlgoNumber =
+                authFrame->authAlgoNumber =
                 pRxAuthFrameBody->authAlgoNumber;
-                authFrame.authTransactionSeqNumber =
+                authFrame->authTransactionSeqNumber =
                 pRxAuthFrameBody->authTransactionSeqNumber + 1;
-                authFrame.authStatusCode =
+                authFrame->authStatusCode =
                 eSIR_MAC_AUTH_ALGO_NOT_SUPPORTED_STATUS;
 
-                limSendAuthMgmtFrame(pMac, &authFrame,
+                limSendAuthMgmtFrame(pMac, authFrame,
                                      pHdr->sa,
                                      LIM_NO_WEP_IN_FC,
                                      psessionEntry,
                                      eSIR_FALSE);
-                return;
+                goto free;
             } //end if (limIsAuthAlgoSupported(pRxAuthFrameBody->authAlgoNumber))
             break;
 
@@ -1081,7 +1118,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                     PELOG1(limPrintMacAddr(pMac, pHdr->sa, LOG1);)
                 }
 
-                return;
+                goto free;
 
             }
 
@@ -1143,6 +1180,12 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
             if (pRxAuthFrameBody->authStatusCode ==
                 eSIR_MAC_SUCCESS_STATUS)
             {
+                if (lim_process_fils_auth_frame2(pMac, psessionEntry, pRxAuthFrameBody))
+                {
+                    limRestoreFromAuthState(pMac, eSIR_SME_SUCCESS,
+                                           pRxAuthFrameBody->authStatusCode, psessionEntry);
+                    goto free;
+                }
                 if (pRxAuthFrameBody->authAlgoNumber ==
                     eSIR_OPEN_SYSTEM)
                 {
@@ -1157,10 +1200,10 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                FL("Max pre-auth nodes reached "));
                         limPrintMacAddr(pMac, pHdr->sa, LOGW);
 
-                        return;
+                        goto free;
                     }
 
-                    PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %p peer "), pAuthNode);)
+                    PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %pK peer "), pAuthNode);)
                     PELOG1(limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
                     vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
@@ -1206,19 +1249,19 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                MAC_ADDRESS_STR), pRxAuthFrameBody->authAlgoNumber,
                                MAC_ADDR_ARRAY(pHdr->sa));)
 
-                        authFrame.authAlgoNumber =
+                        authFrame->authAlgoNumber =
                         pRxAuthFrameBody->authAlgoNumber;
-                        authFrame.authTransactionSeqNumber =
+                        authFrame->authTransactionSeqNumber =
                         pRxAuthFrameBody->authTransactionSeqNumber + 1;
-                        authFrame.authStatusCode =
+                        authFrame->authStatusCode =
                         eSIR_MAC_AUTH_ALGO_NOT_SUPPORTED_STATUS;
 
-                        limSendAuthMgmtFrame(pMac, &authFrame,
+                        limSendAuthMgmtFrame(pMac, authFrame,
                                             pHdr->sa,
                                             LIM_NO_WEP_IN_FC,
                                             psessionEntry,
                                             eSIR_FALSE);
-                        return;
+                        goto free;
                     }
                     else
                     {
@@ -1230,7 +1273,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                             PELOGE(limLog(pMac, LOGE,
                                    FL("received Auth frame with invalid challenge text IE"));)
 
-                            return;
+                            goto free;
                         }
 
                         /**
@@ -1248,10 +1291,18 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                 sirSwapU16ifNeeded((tANI_U16) (pRxAuthFrameBody->authTransactionSeqNumber + 1));
                                 ((tpSirMacAuthFrameBody) plainBody)->authStatusCode = eSIR_MAC_SUCCESS_STATUS;
                                 ((tpSirMacAuthFrameBody) plainBody)->type   = SIR_MAC_CHALLENGE_TEXT_EID;
-                                ((tpSirMacAuthFrameBody) plainBody)->length = SIR_MAC_AUTH_CHALLENGE_LENGTH;
+                                ((tpSirMacAuthFrameBody) plainBody)->length = pRxAuthFrameBody->length;
                                 vos_mem_copy((tANI_U8 *) ((tpSirMacAuthFrameBody) plainBody)->challengeText,
                                               pRxAuthFrameBody->challengeText,
-                                              SIR_MAC_AUTH_CHALLENGE_LENGTH);
+                                              pRxAuthFrameBody->length);
+                                encrAuthFrame = vos_mem_malloc(pRxAuthFrameBody->length +
+                                                               LIM_ENCR_AUTH_INFO_LEN);
+                                if (!encrAuthFrame) {
+                                    limLog(pMac, LOGE, FL("failed to allocate memory"));
+                                    goto free;
+                                }
+                                vos_mem_set(encrAuthFrame, pRxAuthFrameBody->length +
+                                            LIM_ENCR_AUTH_INFO_LEN, 0);
 
                                 limEncryptAuthFrame(pMac, 0,
                                                     pKeyMapEntry->key,
@@ -1264,7 +1315,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                 limSendAuthMgmtFrame(pMac,
                                                      (tpSirMacAuthFrameBody) encrAuthFrame,
                                                      pHdr->sa,
-                                                     LIM_WEP_IN_FC,
+                                                     pRxAuthFrameBody->length,
                                                      psessionEntry,
                                                      eSIR_FALSE);
 
@@ -1298,15 +1349,15 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                 limLog(pMac, LOGP,
                                        FL("could not retrieve Default key"));
 
-                                authFrame.authAlgoNumber =
+                                authFrame->authAlgoNumber =
                                 pRxAuthFrameBody->authAlgoNumber;
-                                authFrame.authTransactionSeqNumber =
+                                authFrame->authTransactionSeqNumber =
                                 pRxAuthFrameBody->authTransactionSeqNumber + 1;
-                                authFrame.authStatusCode =
+                                authFrame->authStatusCode =
                                 eSIR_MAC_CHALLENGE_FAILURE_STATUS;
 
                                 limSendAuthMgmtFrame(
-                                                    pMac, &authFrame,
+                                                    pMac, authFrame,
                                                     pHdr->sa,
                                                     LIM_NO_WEP_IN_FC,
                                                     psessionEntry,
@@ -1324,10 +1375,19 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                 sirSwapU16ifNeeded((tANI_U16) (pRxAuthFrameBody->authTransactionSeqNumber + 1));
                                 ((tpSirMacAuthFrameBody) plainBody)->authStatusCode = eSIR_MAC_SUCCESS_STATUS;
                                 ((tpSirMacAuthFrameBody) plainBody)->type   = SIR_MAC_CHALLENGE_TEXT_EID;
-                                ((tpSirMacAuthFrameBody) plainBody)->length = SIR_MAC_AUTH_CHALLENGE_LENGTH;
+                                ((tpSirMacAuthFrameBody) plainBody)->length = pRxAuthFrameBody->length;
                                 vos_mem_copy((tANI_U8 *) ((tpSirMacAuthFrameBody) plainBody)->challengeText,
                                               pRxAuthFrameBody->challengeText,
-                                              SIR_MAC_AUTH_CHALLENGE_LENGTH);
+                                              pRxAuthFrameBody->length);
+
+                                encrAuthFrame = vos_mem_malloc(pRxAuthFrameBody->length +
+                                                               LIM_ENCR_AUTH_INFO_LEN);
+                                if (!encrAuthFrame) {
+                                    limLog(pMac, LOGE, FL("failed to allocate memory"));
+                                    goto free;
+                                }
+                                vos_mem_set(encrAuthFrame, pRxAuthFrameBody->length +
+                                            LIM_ENCR_AUTH_INFO_LEN, 0);
 
                                 limEncryptAuthFrame(pMac, keyId,
                                                     defaultKey,
@@ -1341,10 +1401,9 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                 limSendAuthMgmtFrame(pMac,
                                                      (tpSirMacAuthFrameBody) encrAuthFrame,
                                                      pHdr->sa,
-                                                     LIM_WEP_IN_FC,
+                                                     pRxAuthFrameBody->length,
                                                      psessionEntry,
                                                      eSIR_FALSE);
-
                                 break;
                         } // end if (pKeyMapEntry)
                     } // end if (!wlan_cfgGetInt(CFG_PRIVACY_OPTION_IMPLEMENTED))
@@ -1385,18 +1444,18 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                  * Shared Key authentication type. Reject with Auth frame4
                  * with 'out of sequence' status code.
                  */
-                authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                authFrame.authTransactionSeqNumber =
+                authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                authFrame->authTransactionSeqNumber =
                 SIR_MAC_AUTH_FRAME_4;
-                authFrame.authStatusCode =
+                authFrame->authStatusCode =
                 eSIR_MAC_AUTH_FRAME_OUT_OF_SEQ_STATUS;
 
-                limSendAuthMgmtFrame(pMac, &authFrame,
+                limSendAuthMgmtFrame(pMac, authFrame,
                                      pHdr->sa,
                                      LIM_NO_WEP_IN_FC,
                                      psessionEntry,
                                      eSIR_FALSE);
-                return;
+                goto free;
             }
 
             if (LIM_IS_AP_ROLE(psessionEntry) ||
@@ -1415,18 +1474,18 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                            MAC_ADDR_ARRAY(pHdr->sa));)
 
                     /// WEP bit is not set in FC of Auth Frame3
-                    authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                    authFrame.authTransactionSeqNumber =
+                    authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                    authFrame->authTransactionSeqNumber =
                     SIR_MAC_AUTH_FRAME_4;
-                    authFrame.authStatusCode =
+                    authFrame->authStatusCode =
                     eSIR_MAC_CHALLENGE_FAILURE_STATUS;
 
-                    limSendAuthMgmtFrame(pMac, &authFrame,
+                    limSendAuthMgmtFrame(pMac, authFrame,
                                          pHdr->sa,
                                          LIM_NO_WEP_IN_FC,
                                          psessionEntry,
                                          eSIR_FALSE);
-                    return;
+                    goto free;
                 }
 
                 pAuthNode = limSearchPreAuthList(pMac,
@@ -1444,18 +1503,18 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                      * Send Auth frame4 with 'out of sequence'
                      * status code.
                      */
-                    authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                    authFrame.authTransactionSeqNumber =
+                    authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                    authFrame->authTransactionSeqNumber =
                     SIR_MAC_AUTH_FRAME_4;
-                    authFrame.authStatusCode =
+                    authFrame->authStatusCode =
                     eSIR_MAC_AUTH_FRAME_OUT_OF_SEQ_STATUS;
 
-                    limSendAuthMgmtFrame(pMac, &authFrame,
+                    limSendAuthMgmtFrame(pMac, authFrame,
                                          pHdr->sa,
                                          LIM_NO_WEP_IN_FC,
                                          psessionEntry,
                                          eSIR_FALSE);
-                    return;
+                    goto free;
                 }
 
                 if (pAuthNode->mlmState == eLIM_MLM_AUTH_RSP_TIMEOUT_STATE)
@@ -1470,14 +1529,14 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                      * Reject by sending Auth Frame4 with
                      * Auth respone timeout Status Code.
                      */
-                    authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                    authFrame.authTransactionSeqNumber =
+                    authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                    authFrame->authTransactionSeqNumber =
                     SIR_MAC_AUTH_FRAME_4;
-                    authFrame.authStatusCode =
+                    authFrame->authStatusCode =
                     eSIR_MAC_AUTH_RSP_TIMEOUT_STATUS;
 
                     limSendAuthMgmtFrame(
-                                        pMac, &authFrame,
+                                        pMac, authFrame,
                                         pHdr->sa,
                                         LIM_NO_WEP_IN_FC,
                                         psessionEntry,
@@ -1487,7 +1546,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                     limDeletePreAuthNode(pMac,
                                          pHdr->sa);
 
-                    return;
+                    goto free;
                 } // end switch (pAuthNode->mlmState)
 
                 if (pRxAuthFrameBody->authStatusCode != eSIR_MAC_SUCCESS_STATUS)
@@ -1504,7 +1563,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                            MAC_ADDRESS_STR), pRxAuthFrameBody->authStatusCode,
                            MAC_ADDR_ARRAY(pHdr->sa));)
 
-                    return;
+                    goto free;
                 }
 
                 /**
@@ -1514,7 +1573,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
 
                 if (vos_mem_compare(pRxAuthFrameBody->challengeText,
                                     pAuthNode->challengeText,
-                                    SIR_MAC_AUTH_CHALLENGE_LENGTH))
+                                    SIR_MAC_SAP_AUTH_CHALLENGE_LENGTH))
                 {
                     /// Challenge match. STA is autheticated !
 
@@ -1529,12 +1588,12 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                     /**
                      * Send Authentication Frame4 with 'success' Status Code.
                      */
-                    authFrame.authAlgoNumber = eSIR_SHARED_KEY;
-                    authFrame.authTransactionSeqNumber =
+                    authFrame->authAlgoNumber = eSIR_SHARED_KEY;
+                    authFrame->authTransactionSeqNumber =
                         SIR_MAC_AUTH_FRAME_4;
-                    authFrame.authStatusCode = eSIR_MAC_SUCCESS_STATUS;
+                    authFrame->authStatusCode = eSIR_MAC_SUCCESS_STATUS;
 
-                    limSendAuthMgmtFrame(pMac, &authFrame,
+                    limSendAuthMgmtFrame(pMac, authFrame,
                                          pHdr->sa,
                                          LIM_NO_WEP_IN_FC,
                                          psessionEntry,
@@ -1567,19 +1626,19 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                      * delete STA context.
                      */
 
-                    authFrame.authAlgoNumber =
+                    authFrame->authAlgoNumber =
                         pRxAuthFrameBody->authAlgoNumber;
-                    authFrame.authTransactionSeqNumber =
+                    authFrame->authTransactionSeqNumber =
                         SIR_MAC_AUTH_FRAME_4;
-                    authFrame.authStatusCode =
+                    authFrame->authStatusCode =
                         eSIR_MAC_CHALLENGE_FAILURE_STATUS;
 
-                    limSendAuthMgmtFrame(pMac, &authFrame,
+                    limSendAuthMgmtFrame(pMac, authFrame,
                                          pHdr->sa,
                                          LIM_NO_WEP_IN_FC,
                                          psessionEntry,
                                          eSIR_FALSE);
-                    return;
+                    goto free;
                 }
             } // if (pMac->lim.gLimSystemRole == eLIM_AP_ROLE || ...
 
@@ -1600,7 +1659,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                        MAC_ADDRESS_STR), psessionEntry->limMlmState,
                        MAC_ADDR_ARRAY(pHdr->sa));)
 
-                return;
+                goto free;
             }
 
             if (pRxAuthFrameBody->authAlgoNumber != eSIR_SHARED_KEY)
@@ -1618,7 +1677,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                            MAC_ADDRESS_STR), pRxAuthFrameBody->authAlgoNumber,
                        MAC_ADDR_ARRAY(pHdr->sa));)
 
-                return;
+                goto free;
             }
 
             if ( !vos_mem_compare((tANI_U8 *) pHdr->sa,
@@ -1673,9 +1732,9 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                            FL("Max pre-auth nodes reached "));
                     limPrintMacAddr(pMac, pHdr->sa, LOGW);
 
-                    return;
+                    goto free;
                 }
-                PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %p peer "), pAuthNode);
+                PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %pK peer "), pAuthNode);
                 limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
                 vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
@@ -1721,6 +1780,19 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
 
             break;
     } // end switch (pRxAuthFrameBody->authTransactionSeqNumber)
+
+free:
+    if (authFrame)
+        vos_mem_free(authFrame);
+    if (rxAuthFrame)
+        vos_mem_free(rxAuthFrame);
+    if (encrAuthFrame)
+        vos_mem_free(encrAuthFrame);
+    if (plainBody)
+        vos_mem_free(plainBody);
+    if (challengeTextArray)
+        vos_mem_free(challengeTextArray);
+
 } /*** end limProcessAuthFrame() ***/
 
 
@@ -1746,7 +1818,7 @@ tSirRetStatus limProcessAuthFrameNoSession(tpAniSirGlobal pMac, tANI_U8 *pBd, vo
     tpPESession psessionEntry = NULL;
     tANI_U8 *pBody;
     tANI_U16  frameLen;
-    tSirMacAuthFrameBody rxAuthFrame;
+    tSirMacAuthFrameBody *rxAuthFrame = NULL;
     tSirMacAuthFrameBody *pRxAuthFrameBody = NULL;
     tSirRetStatus ret_status = eSIR_FAILURE;
     int i;
@@ -1833,14 +1905,14 @@ tSirRetStatus limProcessAuthFrameNoSession(tpAniSirGlobal pMac, tANI_U8 *pBd, vo
          * pre-auth.
          */
         PELOGE(limLog(pMac,LOG1,"Auth rsp already posted to SME"
-               " (session %p, FT session %p)", psessionEntry,
+               " (session %pK, FT session %pK)", psessionEntry,
                psessionEntry););
         return eSIR_SUCCESS;
     }
     else
     {
         PELOGE(limLog(pMac,LOGW,"Auth rsp not yet posted to SME"
-               " (session %p, FT session %p)", psessionEntry,
+               " (session %pK, FT session %pK)", psessionEntry,
                psessionEntry););
         psessionEntry->ftPEContext.pFTPreAuthReq->bPreAuthRspProcessed =
             eANI_BOOLEAN_TRUE;
@@ -1854,15 +1926,22 @@ tSirRetStatus limProcessAuthFrameNoSession(tpAniSirGlobal pMac, tANI_U8 *pBd, vo
     // of our choice.
     limDeactivateAndChangeTimer(pMac, eLIM_FT_PREAUTH_RSP_TIMER);
 
+    rxAuthFrame = vos_mem_malloc(sizeof(tSirMacAuthFrameBody));
+    if (!rxAuthFrame) {
+        limLog(pMac, LOGE, FL("Failed to allocate memory"));
+        return eSIR_MEM_ALLOC_FAILED;
+    }
+
 
     // Save off the auth resp.
-    if ((sirConvertAuthFrame2Struct(pMac, pBody, frameLen, &rxAuthFrame) != eSIR_SUCCESS))
+    if ((sirConvertAuthFrame2Struct(pMac, pBody, frameLen, rxAuthFrame) != eSIR_SUCCESS))
     {
         limLog(pMac, LOGE, FL("failed to convert Auth frame to struct"));
         limHandleFTPreAuthRsp(pMac, eSIR_FAILURE, NULL, 0, psessionEntry);
-        return eSIR_FAILURE;
+        ret_status = eSIR_FAILURE;
+        goto free;
     }
-    pRxAuthFrameBody = &rxAuthFrame;
+    pRxAuthFrameBody = rxAuthFrame;
 
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
     PELOGE(limLog(pMac, LOG1,
@@ -1900,6 +1979,9 @@ tSirRetStatus limProcessAuthFrameNoSession(tpAniSirGlobal pMac, tANI_U8 *pBd, vo
 
     // Send the Auth response to SME
     limHandleFTPreAuthRsp(pMac, ret_status, pBody, frameLen, psessionEntry);
+free:
+    if (rxAuthFrame)
+        vos_mem_free(rxAuthFrame);
 
     return ret_status;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c
index 9bc63fe6fdb..fbef8032fff 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessBeaconFrame.c
@@ -37,7 +37,7 @@
  *
  */
 
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "aniGlobal.h"
 #include "cfgApi.h"
 #include "schApi.h"
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessCfgUpdates.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessCfgUpdates.c
index bd7cbfd3dbf..9639d21ef69 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessCfgUpdates.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessCfgUpdates.c
@@ -37,7 +37,7 @@
 
 #include "aniGlobal.h"
 
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "sirMacProtDef.h"
 #include "cfgApi.h"
 #include "limTypes.h"
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c
index 917c99c60d4..24c41d3e722 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -547,7 +547,8 @@ limProcessDeauthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession p
     lim_update_lost_link_info(pMac, psessionEntry, frame_rssi);
 
     /// Deauthentication from peer MAC entity
-    limPostSmeMessage(pMac, LIM_MLM_DEAUTH_IND, (tANI_U32 *) &mlmDeauthInd);
+    if (GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_STA_ROLE)
+        limPostSmeMessage(pMac, LIM_MLM_DEAUTH_IND, (tANI_U32 *) &mlmDeauthInd);
 
     // send eWNI_SME_DEAUTH_IND to SME
     limSendSmeDeauthInd(pMac, pStaDs, psessionEntry);
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
index e61f5af459e..c9b19210317 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
@@ -40,8 +40,7 @@
 #include "wniApi.h"
 #include "sirApi.h"
 #include "aniGlobal.h"
-#include "wniCfgSta.h"
-
+#include "wni_cfg.h"
 #include "utilsApi.h"
 #include "limTypes.h"
 #include "limUtils.h"
@@ -299,6 +298,15 @@ limProcessDisassocFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession
         return;
     }
 
+#ifdef FEATURE_WLAN_TDLS
+    /* Delete all the TDLS peers only if Disassoc is received from the AP */
+    if ((LIM_IS_STA_ROLE(psessionEntry)) &&
+        ((pStaDs->mlmStaContext.mlmState == eLIM_MLM_LINK_ESTABLISHED_STATE) ||
+        (pStaDs->mlmStaContext.mlmState == eLIM_MLM_IDLE_STATE)) &&
+        (IS_CURRENT_BSSID(pMac, pHdr->sa, psessionEntry)))
+        limDeleteTDLSPeers(pMac, psessionEntry);
+#endif
+
     if (pStaDs->mlmStaContext.mlmState != eLIM_MLM_LINK_ESTABLISHED_STATE)
     {
         /**
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index 4f45e3e9457..b7dc0c9618c 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,8 +39,7 @@
 #include "palTypes.h"
 #include "wniApi.h"
 #include "wlan_qct_wda.h"
-
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "cfgApi.h"
 #include "sirCommon.h"
 #include "utilsApi.h"
@@ -75,6 +74,7 @@
 #include "vos_memory.h"
 #include "nan_datapath.h"
 
+#define CHECK_BIT(value, mask)    ((value) & (1 << (mask)))
 void limLogSessionStates(tpAniSirGlobal pMac);
 
 /** -------------------------------------------------------------
@@ -124,7 +124,6 @@ defMsgDecision(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         (limMsg->type != WDA_REMOVE_BSSKEY_RSP) &&
         (limMsg->type != WDA_REMOVE_STAKEY_RSP) &&
         (limMsg->type != WDA_SET_MIMOPS_RSP)&&
-        (limMsg->type != WDA_ADDBA_RSP) &&
         (limMsg->type != WDA_ENTER_BMPS_RSP) &&
         (limMsg->type != WDA_EXIT_BMPS_RSP) &&
         (limMsg->type != WDA_ENTER_IMPS_RSP) &&
@@ -244,14 +243,14 @@ __limExtScanForwardBcnProbeRsp(tpAniSirGlobal pmac, uint8_t *rx_pkt_info,
 	tSirMsgQ                     mmh_msg;
 	tpSirMacMgmtHdr              hdr;
 
-	result = vos_mem_malloc(sizeof(*result) + ie_len);
+	result = vos_mem_malloc(sizeof(*result) + ie_len + ie_len);
 	if (NULL == result) {
 		limLog(pmac, LOGE, FL("Memory allocation failed"));
 		return;
 	}
 	hdr = WDA_GET_RX_MAC_HEADER(rx_pkt_info);
 	body = WDA_GET_RX_MPDU_DATA(rx_pkt_info);
-	vos_mem_zero(result, sizeof(*result) + ie_len);
+	vos_mem_zero(result, sizeof(*result) + ie_len + ie_len);
 
 	/* Received frame does not have request id, hence set 0 */
 	result->requestId = 0;
@@ -275,6 +274,15 @@ __limExtScanForwardBcnProbeRsp(tpAniSirGlobal pmac, uint8_t *rx_pkt_info,
 	vos_mem_copy((uint8_t *) &result->ap.ieData,
 			body + SIR_MAC_B_PR_SSID_OFFSET, ie_len);
 
+	/* bss_description points to ap.ieData as ap.ieData is flexible arrary
+	 * member.
+	 * Fill result->bss_description by leaving ie_len bytes after ap.ieData
+	 * manually.
+	 */
+	limCollectBssDescription(pmac,
+		(tSirBssDescription *)((uint8_t *)&result->bss_description +
+		ie_len), frame, rx_pkt_info, eANI_BOOLEAN_FALSE);
+
 	mmh_msg.type = msg_type;
 	mmh_msg.bodyptr = result;
 	mmh_msg.bodyval = 0;
@@ -370,10 +378,10 @@ __limHandleBeacon(tpAniSirGlobal pMac, tpSirMsgQ pMsg, tpPESession psessionEntry
     {
         schBeaconProcess(pMac, pRxPacketInfo, psessionEntry);
     }
-     else
+    else
         limProcessBeaconFrame(pMac, pRxPacketInfo, psessionEntry);
 
-        return;
+    return;
 }
 
 
@@ -663,7 +671,8 @@ limCheckMgmtRegisteredFrames(tpAniSirGlobal pMac, tANI_U8 *pBd,
         limSendSmeMgmtFrameInd( pMac, pHdr->fc.subType, (tANI_U8*)pHdr,
                      WDA_GET_RX_PAYLOAD_LEN(pBd) + sizeof(tSirMacMgmtHdr),
                      pLimMgmtRegistration->sessionId,
-                     WDA_GET_RX_CH(pBd), psessionEntry, 0);
+                     WDA_GET_RX_CH(pBd), psessionEntry,
+                     WDA_GET_RX_RSSI_NORMALIZED(pBd));
 
         if ( (type == SIR_MAC_MGMT_FRAME) && (fc.type == SIR_MAC_MGMT_FRAME)
               && (subType == SIR_MAC_MGMT_RESERVED15) )
@@ -736,13 +745,15 @@ limHandle80211Frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, tANI_U8 *pDeferMsg)
             (fc.subType != SIR_MAC_MGMT_BEACON))
     {
          limLog(pMac, LOG1, FL("RX MGMT - Type %hu, SubType %hu, "
-                "BSSID: "MAC_ADDRESS_STR " RSSI %d Seq.no %d"),
+                "BSSID: "MAC_ADDRESS_STR " RSSI %d Seq.no %d"
+		" Source-Addr: "MAC_ADDRESS_STR),
                 fc.type, fc.subType, MAC_ADDR_ARRAY(pHdr->bssId),
                 (uint8_t)abs(
                 (tANI_S8)WDA_GET_RX_RSSI_NORMALIZED(pRxPacketInfo)),
                 ((pHdr->seqControl.seqNumHi << 4) |
-                               (pHdr->seqControl.seqNumLo)));
-     }
+                               (pHdr->seqControl.seqNumLo)),
+                MAC_ADDR_ARRAY(pHdr->sa));
+    }
 
 #ifdef FEATURE_WLAN_EXTSCAN
     if (WMA_IS_EXTSCAN_SCAN_SRC(pRxPacketInfo) ||
@@ -812,7 +823,10 @@ limHandle80211Frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, tANI_U8 *pDeferMsg)
         if((fc.subType != SIR_MAC_MGMT_PROBE_RSP )&&
             (fc.subType != SIR_MAC_MGMT_BEACON)&&
             (fc.subType != SIR_MAC_MGMT_PROBE_REQ)
-            && (fc.subType != SIR_MAC_MGMT_ACTION ) //Public action frame can be received from non-associated stations.
+            /* TA for 11p DSRC */
+            && (fc.subType != SIR_MAC_MGMT_TIME_ADVERT)
+            /* Public action frame can be received from non-associated STAs */
+            && (fc.subType != SIR_MAC_MGMT_ACTION )
           )
         {
 
@@ -932,6 +946,16 @@ limHandle80211Frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, tANI_U8 *pDeferMsg)
                     limProcessDeauthFrame(pMac, pRxPacketInfo,psessionEntry);
                     break;
 
+                case SIR_MAC_MGMT_TIME_ADVERT:
+                {
+                    tANI_U32 frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
+                    limSendSmeMgmtFrameInd(pMac, SIR_MAC_MGMT_TIME_ADVERT,
+                            (tANI_U8*)pHdr, frameLen + sizeof(tSirMacMgmtHdr),
+                            0, WDA_GET_RX_CH(pRxPacketInfo), NULL,
+                            WDA_GET_RX_RSSI_RAW(pRxPacketInfo));
+                }
+                    break;
+
                 case SIR_MAC_MGMT_ACTION:
                    if(psessionEntry == NULL)
                       limProcessActionFrameNoSession(pMac, pRxPacketInfo);
@@ -1119,29 +1143,6 @@ void limMessageProcessor(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
 }
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
-
-void limOemDataRspHandleResumeLinkRsp(tpAniSirGlobal pMac, eHalStatus status, tANI_U32* mlmOemDataRsp)
-{
-    if(status != eHAL_STATUS_SUCCESS)
-    {
-        limLog(pMac, LOGE, FL("OEM Data Rsp failed to get the response for resume link"));
-    }
-
-    if(NULL != pMac->lim.gpLimMlmOemDataReq)
-    {
-        vos_mem_free(pMac->lim.gpLimMlmOemDataReq);
-        pMac->lim.gpLimMlmOemDataReq = NULL;
-    }
-
-    //"Failure" status doesn't mean that Oem Data Rsp did not happen
-    //and hence we need to respond to upper layers. Only Resume link is failed, but
-    //we got the oem data response already.
-    //Post the meessage to MLM
-    limPostSmeMessage(pMac, LIM_MLM_OEM_DATA_CNF, (tANI_U32*)(mlmOemDataRsp));
-
-    return;
-}
-
 void limProcessOemDataRsp(tpAniSirGlobal pMac, tANI_U32* body)
 {
     tpLimMlmOemDataRsp mlmOemDataRsp = NULL;
@@ -1396,12 +1397,10 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
             break;
         case eWNI_SME_SCAN_ABORT_IND:
           {
-            tSirMbMsg *pMsg = limMsg->bodyptr;
-            tANI_U8 sessionId;
+            tSirSmeScanAbortReq *pMsg = (tSirSmeScanAbortReq *)limMsg->bodyptr;
             if (pMsg)
             {
-               sessionId = (tANI_U8) pMsg->data[0];
-               limProcessAbortScanInd(pMac, sessionId);
+               limProcessAbortScanInd(pMac, pMsg->sessionId);
                vos_mem_free((v_VOID_t *)limMsg->bodyptr);
                limMsg->bodyptr = NULL;
             }
@@ -1425,7 +1424,6 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         case eWNI_SME_REASSOC_CNF:
         case eWNI_SME_ADDTS_REQ:
         case eWNI_SME_DELTS_REQ:
-        case eWNI_SME_DEL_BA_PEER_IND:
         case eWNI_SME_SET_TX_POWER_REQ:
         case eWNI_SME_GET_TX_POWER_REQ:
         case eWNI_SME_GET_NOISE_REQ:
@@ -1719,16 +1717,6 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         case SIR_LIM_DEL_TS_IND:
           limProcessDelTsInd(pMac, limMsg);
             break;
-        case SIR_LIM_ADD_BA_IND:
-            limProcessAddBaInd(pMac, limMsg);
-            break;
-        case SIR_LIM_DEL_BA_ALL_IND:
-            limDelAllBASessions(pMac);
-            break;
-        case SIR_LIM_DEL_BA_IND:
-            limProcessMlmHalBADeleteInd( pMac, limMsg );
-            break;
-
          case SIR_LIM_BEACON_GEN_IND: {
 
                 if( pMac->lim.gLimSystemRole != eLIM_AP_ROLE )
@@ -1979,9 +1967,6 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         case WDA_REMOVE_STAKEY_RSP:
             limProcessMlmRemoveKeyRsp( pMac, limMsg );
             break;
-        case WDA_ADDBA_RSP:
-            limProcessMlmHalAddBARsp( pMac, limMsg );
-            break;
 
         case WDA_STA_STAT_RSP:
         case WDA_AGGR_STAT_RSP:
@@ -2069,8 +2054,11 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         {
 #ifdef WLAN_ACTIVEMODE_OFFLOAD_FEATURE
             tpPESession     psessionEntry;
-            tANI_U8 sessionId = (tANI_U8)limMsg->bodyval ;
-            psessionEntry = &pMac->lim.gpSession[sessionId];
+            tANI_U8 session_id;
+            tSirSetActiveModeSetBncFilterReq *bcn_filter_req =
+               (tSirSetActiveModeSetBncFilterReq *)limMsg->bodyptr;
+            psessionEntry = peFindSessionByBssid(pMac, bcn_filter_req->bssid,
+                                                 &session_id);
             if(psessionEntry != NULL && IS_ACTIVEMODE_OFFLOAD_FEATURE_ENABLE)
             {
                // sending beacon filtering information down to HAL
@@ -2089,6 +2077,8 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         {
             tpPESession     psessionEntry;
             tANI_U8         sessionId;
+            tDphHashNode   *sta_ds = NULL;
+            int i, aid;
             tTdlsLinkEstablishParams *pTdlsLinkEstablishParams;
             pTdlsLinkEstablishParams = (tTdlsLinkEstablishParams*) limMsg->bodyptr;
 
@@ -2109,11 +2099,33 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
             }
             else
             {
-                limSendSmeTdlsLinkEstablishReqRsp(pMac,
-                                                  psessionEntry->smeSessionId,
-                                                  NULL,
-                                                  NULL,
-                                                  pTdlsLinkEstablishParams->status) ;
+                for (i = 0;
+                     i < sizeof(psessionEntry->peerAIDBitmap)
+                                           / sizeof(uint32_t); i++) {
+                    for (aid = 0; aid < (sizeof(tANI_U32) << 3); aid++) {
+                        if (CHECK_BIT(psessionEntry->peerAIDBitmap[i], aid)) {
+                            sta_ds = dphGetHashEntry(pMac,
+                                           (aid + i*(sizeof(tANI_U32) << 3)),
+                                            &psessionEntry->dph.dphHashTable);
+                              if ((sta_ds) &&
+                                   (pTdlsLinkEstablishParams->staIdx ==
+                                                       sta_ds->staIndex))
+                                  goto send_link_resp;
+                        }
+                    }
+                }
+send_link_resp:
+                if (sta_ds)
+                    limSendSmeTdlsLinkEstablishReqRsp(pMac,
+                                              psessionEntry->smeSessionId,
+                                              sta_ds->staAddr,
+                                              sta_ds,
+                                              pTdlsLinkEstablishParams->status);
+                else
+                    limSendSmeTdlsLinkEstablishReqRsp(pMac,
+                                              psessionEntry->smeSessionId,
+                                              NULL, NULL,
+                                              pTdlsLinkEstablishParams->status);
             }
             vos_mem_free((v_VOID_t *)(limMsg->bodyptr));
             limMsg->bodyptr = NULL;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index a75263ed902..b8ff3272721 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -36,7 +36,7 @@
  *
  */
 #include "palTypes.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "aniGlobal.h"
 #include "sirApi.h"
 #include "sirParams.h"
@@ -58,7 +58,7 @@
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM
 #include "vos_diag_core_log.h"
 #endif
-
+#include "lim_process_fils.h"
 
 // MLM REQ processing function templates
 static void limProcessMlmStartReq(tpAniSirGlobal, tANI_U32 *);
@@ -73,11 +73,6 @@ static void limProcessMlmReassocReq(tpAniSirGlobal, tANI_U32 *);
 static void limProcessMlmDisassocReq(tpAniSirGlobal, tANI_U32 *);
 static void limProcessMlmDeauthReq(tpAniSirGlobal, tANI_U32 *);
 static void limProcessMlmSetKeysReq(tpAniSirGlobal, tANI_U32 *);
-
-static void limProcessMlmAddBAReq( tpAniSirGlobal, tANI_U32 * );
-static void limProcessMlmAddBARsp( tpAniSirGlobal, tANI_U32 * );
-static void limProcessMlmDelBAReq( tpAniSirGlobal, tANI_U32 * );
-
 // MLM Timeout event handler templates
 static void limProcessMinChannelTimeout(tpAniSirGlobal);
 static void limProcessMaxChannelTimeout(tpAniSirGlobal);
@@ -164,9 +159,6 @@ limProcessMlmReqMessages(tpAniSirGlobal pMac, tpSirMsgQ Msg)
                                             break;
         case SIR_LIM_DISASSOC_ACK_TIMEOUT:  limProcessDisassocAckTimeout(pMac); break;
         case SIR_LIM_DEAUTH_ACK_TIMEOUT:    limProcessDeauthAckTimeout(pMac); break;
-        case LIM_MLM_ADDBA_REQ:             limProcessMlmAddBAReq( pMac, Msg->bodyptr ); break;
-        case LIM_MLM_ADDBA_RSP:             limProcessMlmAddBARsp( pMac, Msg->bodyptr ); break;
-        case LIM_MLM_DELBA_REQ:             limProcessMlmDelBAReq( pMac, Msg->bodyptr ); break;
         case LIM_MLM_TSPEC_REQ:
         default:
             break;
@@ -273,7 +265,7 @@ limSuspendLink(tpAniSirGlobal pMac, tSirLinkTrafficCheck trafficCheck,  SUSPEND_
    if( pMac->lim.gpLimSuspendCallback ||
        pMac->lim.gLimSystemInScanLearnMode )
    {
-      limLog( pMac, LOGE, FL("Something is wrong, SuspendLinkCbk:%p "
+      limLog( pMac, LOGE, FL("Something is wrong, SuspendLinkCbk:%pK "
               "IsSystemInScanLearnMode:%d"), pMac->lim.gpLimSuspendCallback,
                pMac->lim.gLimSystemInScanLearnMode );
       callback( pMac, eHAL_STATUS_FAILURE, data );
@@ -712,8 +704,47 @@ void limSetDFSChannelList(tpAniSirGlobal pMac,tANI_U8 channelNum, tSirDFSChannel
     return;
 }
 
+void limDoSendAuthMgmtFrame(tpAniSirGlobal pMac, tpPESession psessionEntry)
+{
+        tSirMacAuthFrameBody    authFrameBody;
 
+        //Prepare & send Authentication frame
+        authFrameBody.authAlgoNumber =
+                        (tANI_U8) pMac->lim.gpLimMlmAuthReq->authType;
+        authFrameBody.authTransactionSeqNumber = SIR_MAC_AUTH_FRAME_1;
+        authFrameBody.authStatusCode = 0;
+        pMac->auth_ack_status = LIM_AUTH_ACK_NOT_RCD;
 
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+        limDiagEventReport(pMac, WLAN_PE_DIAG_AUTH_START_EVENT, psessionEntry,
+                           eSIR_SUCCESS, authFrameBody.authStatusCode);
+#endif
+
+        limSendAuthMgmtFrame(pMac,
+                        &authFrameBody,
+                        pMac->lim.gpLimMlmAuthReq->peerMacAddr,
+                        LIM_NO_WEP_IN_FC, psessionEntry, eSIR_TRUE);
+        if (tx_timer_activate(&pMac->lim.limTimers.gLimAuthFailureTimer)
+                        != TX_SUCCESS) {
+                //Could not start Auth failure timer.
+                //Log error
+                limLog(pMac, LOGP,
+                FL("could not start Auth failure timer"));
+                //Cleanup as if auth timer expired
+                limProcessAuthFailureTimeout(pMac);
+        } else {
+                MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE,
+                        psessionEntry->peSessionId, eLIM_AUTH_RETRY_TIMER));
+                //Activate Auth Retry timer
+                if (tx_timer_activate
+                        (&pMac->lim.limTimers.g_lim_periodic_auth_retry_timer)
+                                            != TX_SUCCESS) {
+                        limLog(pMac, LOGP,
+                                  FL("could not activate Auth Retry timer"));
+                }
+        }
+        return;
+}
 
 /*
 * Creates a Raw frame to be sent before every Scan, if required.
@@ -891,7 +922,7 @@ limSendHalInitScanReq(tpAniSirGlobal pMac, tLimLimHalScanState nextState, tSirLi
 
     rc = wdaPostCtrlMsg(pMac, &msg);
     if (rc == eSIR_SUCCESS) {
-        PELOG3(limLog(pMac, LOG3, FL("wdaPostCtrlMsg() return eSIR_SUCCESS pMac=%p nextState=%d"),
+        PELOG3(limLog(pMac, LOG3, FL("wdaPostCtrlMsg() return eSIR_SUCCESS pMac=%pK nextState=%d"),
                     pMac, pMac->lim.gLimHalScanState);)
             return;
     }
@@ -1424,88 +1455,6 @@ error:
 
     return;
 }
-/**
- * limSetOemDataReqModeFailed()
- *
- * FUNCTION:
- *  This function is used as callback to resume link after the suspend fails while
- *  starting oem data req mode.
- * LOGIC:
- *  NA
- *
- * ASSUMPTIONS:
- *  NA
- *
- * NOTE:
- *
- * @param pMac - Pointer to Global MAC structure
- * @return None
- */
-
-void limSetOemDataReqModeFailed(tpAniSirGlobal pMac, eHalStatus status, tANI_U32* data)
-{
-    tpLimMlmOemDataRsp pMlmOemDataRsp;
-
-    pMac->lim.gLimMlmState = pMac->lim.gLimPrevMlmState;
-    MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, NO_SESSION, pMac->lim.gLimMlmState));
-
-    pMlmOemDataRsp = vos_mem_malloc(sizeof(tLimMlmOemDataRsp));
-    if ( NULL == pMlmOemDataRsp )
-    {
-        limLog(pMac->hHdd, LOGP, FL("OEM_DATA: memory allocation for pMlmOemDataRsp failed under suspend link failure"));
-        return;
-    }
-
-    if (NULL != pMac->lim.gpLimMlmOemDataReq)
-    {
-        vos_mem_free(pMac->lim.gpLimMlmOemDataReq);
-        pMac->lim.gpLimMlmOemDataReq = NULL;
-    }
-
-    vos_mem_set(pMlmOemDataRsp, sizeof(tLimMlmOemDataRsp), 0);
-
-    limPostSmeMessage(pMac, LIM_MLM_OEM_DATA_CNF, (tANI_U32*)pMlmOemDataRsp);
-
-    return;
-}
-
-/**
- * limSetOemDataReqMode()
- *
- *FUNCTION:
- * This function is called to setup system into OEM DATA REQ mode
- *
- *LOGIC:
- * NA
- *
- *ASSUMPTIONS:
- * NA
- *
- *NOTE:
- *
- * @param  pMac - Pointer to Global MAC structure
- * @return None
- */
-
-void limSetOemDataReqMode(tpAniSirGlobal pMac, eHalStatus status, tANI_U32* data)
-{
-    if(status != eHAL_STATUS_SUCCESS)
-    {
-        limLog(pMac, LOGE, FL("OEM_DATA: failed in suspend link"));
-        /* If failed to suspend the link, there is no need
-         * to resume link. Return failure.
-         */
-        limSetOemDataReqModeFailed(pMac, status, data);
-    }
-    else
-    {
-        PELOGE(limLog(pMac, LOGE, FL("OEM_DATA: Calling limSendHalOemDataReq"));)
-        limSendHalOemDataReq(pMac);
-    }
-
-    return;
-} /*** end limSendHalOemDataReq() ***/
-
 #endif //FEATURE_OEM_DATA_SUPPORT
 
 static void
@@ -1517,7 +1466,6 @@ mlm_add_sta(
     tpPESession     psessionEntry)  //psessionEntry  may required in future
 {
     tANI_U32 val;
-    int      i;
     tANI_U32 selfStaDot11Mode = 0;
 
     wlan_cfgGetInt(pMac, WNI_CFG_DOT11_MODE, &selfStaDot11Mode);
@@ -1606,13 +1554,6 @@ mlm_add_sta(
          pSta->p2pCapableSta = 1;
      }
 
-    //Disable BA. It will be set as part of ADDBA negotiation.
-    for( i = 0; i < STACFG_MAX_TC; i++ )
-    {
-        pSta->staTCParams[i].txUseBA = eBA_DISABLE;
-        pSta->staTCParams[i].rxUseBA = eBA_DISABLE;
-    }
-
 }
 
 //
@@ -1740,6 +1681,11 @@ limMlmAddBss (
 
     pAddBssParams->beacon_tx_rate = pMlmStartReq->beacon_tx_rate;
 
+    if (psessionEntry->sub20_channelwidth == SUB20_MODE_5MHZ)
+            pAddBssParams->channelwidth = CH_WIDTH_5MHZ;
+    else if (psessionEntry->sub20_channelwidth == SUB20_MODE_10MHZ)
+            pAddBssParams->channelwidth = CH_WIDTH_10MHZ;
+
     limLog(pMac, LOG2, FL("dot11_mode:%d"), pAddBssParams->dot11_mode);
 
     msgQ.type       = WDA_ADD_BSS_REQ;
@@ -2044,8 +1990,10 @@ static void limProcessMlmOemDataReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
 
         limPrintMlmState(pMac, LOGW, pMac->lim.gLimMlmState);
 
-        /// Free up buffer allocated
-        vos_mem_free(pMsgBuf);
+        /* Free up incoming buffer */
+        if (data_req->data)
+            vos_mem_free(data_req->data);
+        vos_mem_free(data_req);
 
         /// Return Meas confirm with INVALID_PARAMETERS
         pMlmOemDataRsp = vos_mem_malloc(sizeof(tLimMlmOemDataRsp));
@@ -2331,7 +2279,6 @@ limProcessMlmAuthReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
 {
     tANI_U32                numPreAuthContexts;
     tSirMacAddr             currentBssId;
-    tSirMacAuthFrameBody    authFrameBody;
     tLimMlmAuthCnf          mlmAuthCnf;
     struct tLimPreAuthNode  *preAuthNode;
     tpDphHashNode           pStaDs;
@@ -2452,21 +2399,6 @@ limProcessMlmAuthReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         psessionEntry->limMlmState = eLIM_MLM_WT_AUTH_FRAME2_STATE;
         MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId, psessionEntry->limMlmState));
 
-        /// Prepare & send Authentication frame
-        authFrameBody.authAlgoNumber =
-                                  (tANI_U8) pMac->lim.gpLimMlmAuthReq->authType;
-        authFrameBody.authTransactionSeqNumber = SIR_MAC_AUTH_FRAME_1;
-        authFrameBody.authStatusCode = 0;
-#ifdef FEATURE_WLAN_DIAG_SUPPORT
-        limDiagEventReport(pMac, WLAN_PE_DIAG_AUTH_START_EVENT, psessionEntry,
-                           eSIR_SUCCESS, authFrameBody.authStatusCode);
-#endif
-        pMac->auth_ack_status = LIM_AUTH_ACK_NOT_RCD;
-        limSendAuthMgmtFrame(pMac,
-                             &authFrameBody,
-                             pMac->lim.gpLimMlmAuthReq->peerMacAddr,
-                             LIM_NO_WEP_IN_FC, psessionEntry, eSIR_TRUE);
-
         //assign appropriate sessionId to the timer object
         pMac->lim.limTimers.gLimAuthFailureTimer.sessionId = sessionId;
 
@@ -2475,26 +2407,9 @@ limProcessMlmAuthReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         limDeactivateAndChangeTimer(pMac, eLIM_AUTH_RETRY_TIMER);
         /* Activate Auth failure timer */
         MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE, psessionEntry->peSessionId, eLIM_AUTH_FAIL_TIMER));
-        if (tx_timer_activate(&pMac->lim.limTimers.gLimAuthFailureTimer)
-                                       != TX_SUCCESS)
-        {
-            /// Could not start Auth failure timer.
-            // Log error
-            limLog(pMac, LOGP,
-                   FL("could not start Auth failure timer"));
-            /* Clean up as if auth timer expired */
-            limProcessAuthFailureTimeout(pMac);
-        } else {
-            MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE,
-                    psessionEntry->peSessionId, eLIM_AUTH_RETRY_TIMER));
-            /* Activate Auth Retry timer */
-            if (tx_timer_activate
-                  (&pMac->lim.limTimers.g_lim_periodic_auth_retry_timer)
-                                                          != TX_SUCCESS) {
-               limLog(pMac, LOGP, FL("could not activate Auth Retry timer"));
-            }
-        }
-        return;
+
+	limDoSendAuthMgmtFrame(pMac, psessionEntry);
+	return;
     }
     else
     {
@@ -3730,16 +3645,16 @@ tLimMlmRemoveKeyCnf  mlmRemoveKeyCnf;
       goto end;
   }
   else
-    staIdx = pStaDs->staIndex;
-
-
+      staIdx = pStaDs->staIndex;
 
-    psessionEntry->limMlmState = eLIM_MLM_WT_REMOVE_STA_KEY_STATE;
-    MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId, psessionEntry->limMlmState));
+  psessionEntry->limMlmState = eLIM_MLM_WT_REMOVE_STA_KEY_STATE;
+  MTRACE(
+      macTrace(pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId,
+      psessionEntry->limMlmState));
 
-    // Package WDA_REMOVE_STAKEY_REQ message parameters
-    limSendRemoveStaKeyReq( pMac,pMlmRemoveKeyReq,staIdx,psessionEntry);
-    return;
+  // Package WDA_REMOVE_STAKEY_REQ message parameters
+  limSendRemoveStaKeyReq( pMac,pMlmRemoveKeyReq,staIdx,psessionEntry);
+  return;
 
 end:
     limPostSmeRemoveKeyCnf( pMac,
@@ -4175,6 +4090,7 @@ static void lim_process_auth_retry_timer(tpAniSirGlobal mac_ctx)
 			auth_frame.authStatusCode = 0;
 			limLog(mac_ctx, LOGW, FL("Retry Auth "));
 			mac_ctx->auth_ack_status = LIM_AUTH_ACK_NOT_RCD;
+                        lim_increase_fils_sequence_number(session_entry);
 			limSendAuthMgmtFrame(mac_ctx,
 					&auth_frame,
 					mac_ctx->lim.gpLimMlmAuthReq->peerMacAddr,
@@ -4559,254 +4475,6 @@ limCompleteMlmScan(tpAniSirGlobal pMac, tSirResultCodes retCode)
 } /*** limCompleteMlmScan() ***/
 
 /**
- * \brief Setup an A-MPDU/BA session
- *
- * \sa limProcessMlmAddBAReq
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pMsgBuf The MLME ADDBA Req message buffer
- *
- * \return none
- */
-void limProcessMlmAddBAReq( tpAniSirGlobal pMac,
-    tANI_U32 *pMsgBuf )
-{
-tSirRetStatus status = eSIR_SUCCESS;
-tpLimMlmAddBAReq pMlmAddBAReq;
-tpLimMlmAddBACnf pMlmAddBACnf;
-  tpPESession     psessionEntry;
-
-  if(pMsgBuf == NULL)
-  {
-      PELOGE(limLog(pMac, LOGE,FL("Buffer is Pointing to NULL"));)
-           return;
-  }
-
-  pMlmAddBAReq = (tpLimMlmAddBAReq) pMsgBuf;
-  if((psessionEntry = peFindSessionBySessionId(pMac,pMlmAddBAReq->sessionId))== NULL)
-  {
-      PELOGE(limLog(pMac, LOGE,
-               FL("session does not exist for given sessionId"));)
-      vos_mem_free(pMsgBuf);
-      return;
-  }
-
-
-  // Send ADDBA Req over the air
-  status = limSendAddBAReq( pMac, pMlmAddBAReq,psessionEntry);
-
-  //
-  // Respond immediately to LIM, only if MLME has not been
-  // successfully able to send WDA_ADDBA_REQ to HAL.
-  // Else, LIM_MLM_ADDBA_CNF will be sent after receiving
-  // ADDBA Rsp from peer entity
-  //
-  if( eSIR_SUCCESS != status )
-  {
-    // Allocate for LIM_MLM_ADDBA_CNF
-
-    pMlmAddBACnf = vos_mem_malloc(sizeof( tLimMlmAddBACnf ));
-    if ( NULL == pMlmAddBACnf )
-    {
-      limLog( pMac, LOGP,
-          FL("AllocateMemory failed"));
-      vos_mem_free(pMsgBuf);
-      return;
-    }
-    else
-    {
-        vos_mem_set((void *) pMlmAddBACnf, sizeof( tLimMlmAddBACnf ), 0);
-        vos_mem_copy((void *) pMlmAddBACnf->peerMacAddr,
-                     (void *) pMlmAddBAReq->peerMacAddr,
-                     sizeof( tSirMacAddr ));
-
-      pMlmAddBACnf->baDialogToken = pMlmAddBAReq->baDialogToken;
-      pMlmAddBACnf->baTID = pMlmAddBAReq->baTID;
-      pMlmAddBACnf->baPolicy = pMlmAddBAReq->baPolicy;
-      pMlmAddBACnf->baBufferSize = pMlmAddBAReq->baBufferSize;
-      pMlmAddBACnf->baTimeout = pMlmAddBAReq->baTimeout;
-      pMlmAddBACnf->sessionId = pMlmAddBAReq->sessionId;
-
-      // Update the result code
-      pMlmAddBACnf->addBAResultCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
-
-      limPostSmeMessage( pMac,
-          LIM_MLM_ADDBA_CNF,
-          (tANI_U32 *) pMlmAddBACnf );
-    }
-
-    // Restore MLME state
-    psessionEntry->limMlmState = psessionEntry->limPrevMlmState;
-    MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId, psessionEntry->limMlmState));
-
-  }
-
-  // Free the buffer allocated for tLimMlmAddBAReq
-  vos_mem_free(pMsgBuf);
-
-}
-
-/**
- * \brief Send an ADDBA Rsp to peer STA in response
- * to an ADDBA Req received earlier
- *
- * \sa limProcessMlmAddBARsp
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pMsgBuf The MLME ADDBA Rsp message buffer
- *
- * \return none
- */
-void limProcessMlmAddBARsp( tpAniSirGlobal pMac,
-    tANI_U32 *pMsgBuf )
-{
-tpLimMlmAddBARsp pMlmAddBARsp;
-   tANI_U16 aid;
-   tpDphHashNode pSta;
-   tpPESession  psessionEntry;
-
-
-    if(pMsgBuf == NULL)
-    {
-           PELOGE(limLog(pMac, LOGE,FL("Buffer is Pointing to NULL"));)
-           return;
-    }
-
-    pMlmAddBARsp = (tpLimMlmAddBARsp) pMsgBuf;
-
-    if(( psessionEntry = peFindSessionBySessionId(pMac,pMlmAddBARsp->sessionId))== NULL)
-    {
-        PELOGE(limLog(pMac, LOGE,
-                  FL("session does not exist for given session ID"));)
-        vos_mem_free(pMsgBuf);
-        return;
-    }
-
-
-  // Send ADDBA Rsp over the air
-  if( eSIR_SUCCESS != limSendAddBARsp( pMac,pMlmAddBARsp,psessionEntry))
-  {
-    limLog( pMac, LOGE,
-    FL("Failed to send ADDBA Rsp to peer "));
-    limPrintMacAddr( pMac, pMlmAddBARsp->peerMacAddr, LOGE );
-    /* Clean the BA context maintained by HAL and TL on failure */
-    pSta = dphLookupHashEntry( pMac, pMlmAddBARsp->peerMacAddr, &aid,
-            &psessionEntry->dph.dphHashTable);
-     if( NULL != pSta )
-    {
-        limPostMsgDelBAInd( pMac, pSta, pMlmAddBARsp->baTID, eBA_RECIPIENT,
-                psessionEntry);
-    }
-  }
-
-  // Time to post a WDA_DELBA_IND to HAL in order
-  // to cleanup the HAL and SoftMAC entries
-
-
-  // Free the buffer allocated for tLimMlmAddBARsp
-  vos_mem_free(pMsgBuf);
-
-}
-
-/**
- * \brief Setup an A-MPDU/BA session
- *
- * \sa limProcessMlmDelBAReq
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pMsgBuf The MLME DELBA Req message buffer
- *
- * \return none
- */
-void limProcessMlmDelBAReq( tpAniSirGlobal pMac,
-    tANI_U32 *pMsgBuf )
-{
-    tSirRetStatus status = eSIR_SUCCESS;
-    tpLimMlmDelBAReq pMlmDelBAReq;
-    tpLimMlmDelBACnf pMlmDelBACnf;
-    tpPESession  psessionEntry;
-
-
-    if(pMsgBuf == NULL)
-    {
-           PELOGE(limLog(pMac, LOGE,FL("Buffer is Pointing to NULL"));)
-           return;
-    }
-
-  // TODO - Need to validate MLME state
-    pMlmDelBAReq = (tpLimMlmDelBAReq) pMsgBuf;
-
-    if((psessionEntry = peFindSessionBySessionId(pMac,pMlmDelBAReq->sessionId))== NULL)
-    {
-        PELOGE(limLog(pMac, LOGE,FL("session does not exist for given bssId"));)
-        vos_mem_free(pMsgBuf);
-        return;
-    }
-
-  // Send DELBA Ind over the air
-  if( eSIR_SUCCESS !=
-      (status = limSendDelBAInd( pMac, pMlmDelBAReq,psessionEntry)))
-    status = eSIR_SME_HAL_SEND_MESSAGE_FAIL;
-  else
-  {
-    tANI_U16 aid;
-    tpDphHashNode pSta;
-
-    // Time to post a WDA_DELBA_IND to HAL in order
-    // to cleanup the HAL and SoftMAC entries
-    pSta = dphLookupHashEntry( pMac, pMlmDelBAReq->peerMacAddr, &aid , &psessionEntry->dph.dphHashTable);
-    if( NULL != pSta )
-    {
-        status = limPostMsgDelBAInd( pMac,
-         pSta,
-          pMlmDelBAReq->baTID,
-          pMlmDelBAReq->baDirection,psessionEntry);
-
-    }
-  }
-
-  //
-  // Respond immediately to SME with DELBA CNF using
-  // LIM_MLM_DELBA_CNF with appropriate status
-  //
-
-  // Allocate for LIM_MLM_DELBA_CNF
-
-  pMlmDelBACnf = vos_mem_malloc(sizeof( tLimMlmDelBACnf ));
-  if ( NULL == pMlmDelBACnf )
-  {
-    limLog( pMac, LOGP, FL("AllocateMemory failed"));
-    vos_mem_free(pMsgBuf);
-    return;
-  }
-  else
-  {
-    vos_mem_set((void *) pMlmDelBACnf, sizeof( tLimMlmDelBACnf ), 0);
-
-    vos_mem_copy((void *) pMlmDelBACnf,
-                 (void *) pMlmDelBAReq,
-                 sizeof( tLimMlmDelBAReq ));
-
-    // Update DELBA result code
-    pMlmDelBACnf->delBAReasonCode = pMlmDelBAReq->delBAReasonCode;
-
-    /* Update PE session Id*/
-    pMlmDelBACnf->sessionId = pMlmDelBAReq->sessionId;
-
-    limPostSmeMessage( pMac,
-        LIM_MLM_DELBA_CNF,
-        (tANI_U32 *) pMlmDelBACnf );
-  }
-
-  // Free the buffer allocated for tLimMlmDelBAReq
-  vos_mem_free(pMsgBuf);
-
-}
-
-/**
  * @function :  limSMPowerSaveStateInd( )
  *
  * @brief  : This function is called upon receiving the PMC Indication to update the STA's MimoPs State.
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
index a4fe7dae0de..5211d130f6a 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -36,7 +36,7 @@
  *
  */
 #include "wniApi.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "cfgApi.h"
 #include "sirApi.h"
 #include "schApi.h"
@@ -84,8 +84,6 @@ void limProcessMlmDisassocCnf(tpAniSirGlobal, tANI_U32 *);
 void limProcessMlmDeauthInd(tpAniSirGlobal, tANI_U32 *);
 void limProcessMlmDeauthCnf(tpAniSirGlobal, tANI_U32 *);
 void limProcessMlmPurgeStaInd(tpAniSirGlobal, tANI_U32 *);
-void limProcessMlmAddBACnf(tpAniSirGlobal, tANI_U32 *);
-void limProcessMlmDelBACnf(tpAniSirGlobal, tANI_U32 *);
 void limProcessMlmRemoveKeyCnf(tpAniSirGlobal pMac, tANI_U32 * pMsgBuf);
 static void  limHandleDelBssInReAssocContext(tpAniSirGlobal pMac, tpDphHashNode pStaDs,tpPESession psessionEntry);
 void limGetSessionInfo(tpAniSirGlobal pMac, tANI_U8 *, tANI_U8 *, tANI_U16 *);
@@ -180,14 +178,6 @@ limProcessMlmRspMessages(tpAniSirGlobal pMac, tANI_U32 msgType, tANI_U32 *pMsgBu
             break;
         case LIM_MLM_TSPEC_CNF:
             break;
-        case LIM_MLM_ADDBA_CNF:
-            limProcessMlmAddBACnf( pMac, pMsgBuf );
-            pMsgBuf = NULL;
-            break;
-        case LIM_MLM_DELBA_CNF:
-            limProcessMlmDelBACnf( pMac, pMsgBuf );
-            pMsgBuf = NULL;
-            break;
         default:
             break;
     } // switch (msgType)
@@ -573,11 +563,11 @@ limSendMlmAssocReq( tpAniSirGlobal pMac,
         caps &= (~LIM_SPECTRUM_MANAGEMENT_BIT_MASK);
     }
 
-    /*
-     * RM capability should be independent of AP's capabilities
-     * Refer 8.4.1.4 Capability Information field in 802.11-2012
-     * Do not modify it.
-     */
+    /* Clear rrm bit if AP doesn't support it */
+    if(!(psessionEntry->pLimJoinReq->bssDescription.capabilityInfo &
+          LIM_RRM_BIT_MASK)) {
+        caps &= (~LIM_RRM_BIT_MASK);
+    }
 
     /* Clear short preamble bit if AP does not support it */
     if(!(psessionEntry->pLimJoinReq->bssDescription.capabilityInfo &
@@ -984,7 +974,7 @@ limProcessMlmReassocCnf(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
      * allowed following any change in HT params.
      */
     if (psessionEntry->ftPEContext.pFTPreAuthReq) {
-        limLog(pMac, LOG1, FL("Freeing pFTPreAuthReq= %p"),
+        limLog(pMac, LOG1, FL("Freeing pFTPreAuthReq= %pK"),
                psessionEntry->ftPEContext.pFTPreAuthReq);
         if (psessionEntry->ftPEContext.pFTPreAuthReq->pbssDescription) {
             vos_mem_free(
@@ -1257,6 +1247,18 @@ limFillAssocIndParams(tpAniSirGlobal pMac, tpLimMlmAssocInd pAssocInd,
                  sizeof(tSirSmeChanInfo));
     // Fill in WmmInfo
     pSirSmeAssocInd->wmmEnabledSta = pAssocInd->WmmStaInfoPresent;
+    pSirSmeAssocInd->ecsa_capable = pAssocInd->ecsa_capable;
+    pSirSmeAssocInd->ampdu = pAssocInd->ampdu;
+    pSirSmeAssocInd->sgi_enable = pAssocInd->sgi_enable;
+    pSirSmeAssocInd->tx_stbc = pAssocInd->tx_stbc;
+    pSirSmeAssocInd->rx_stbc = pAssocInd->rx_stbc;
+    pSirSmeAssocInd->ch_width = pAssocInd->ch_width;
+    pSirSmeAssocInd->mode = pAssocInd->mode;
+    pSirSmeAssocInd->max_supp_idx = pAssocInd->max_supp_idx;
+    pSirSmeAssocInd->max_ext_idx = pAssocInd->max_ext_idx;
+    pSirSmeAssocInd->max_mcs_idx = pAssocInd->max_mcs_idx;
+    pSirSmeAssocInd->rx_mcs_map = pAssocInd->rx_mcs_map;
+    pSirSmeAssocInd->tx_mcs_map = pAssocInd->tx_mcs_map;
 } /*** end limAssocIndSerDes() ***/
 
 
@@ -2845,6 +2847,22 @@ limProcessIbssMlmAddBssRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ ,tpPESession
     }
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+static void lim_update_fils_auth_mode(tpPESession session_entry,
+                                      tAniAuthType *auth_mode)
+{
+    if (!session_entry->fils_info)
+        return;
+
+    if (session_entry->fils_info->is_fils_connection)
+        *auth_mode = session_entry->fils_info->auth;
+}
+#else
+static void lim_update_fils_auth_mode(tpPESession session_entry,
+                                      tAniAuthType *auth_mode)
+{}
+#endif
+
 static void
 limProcessStaMlmAddBssRspPreAssoc( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ, tpPESession psessionEntry )
 {
@@ -2887,7 +2905,7 @@ limProcessStaMlmAddBssRspPreAssoc( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ, tpPES
                 authMode = eSIR_SHARED_KEY; // Try Shared Authentication first
             else
                 authMode = cfgAuthType;
-
+            lim_update_fils_auth_mode(psessionEntry, &authMode);
             // Trigger MAC based Authentication
             pMlmAuthReq = vos_mem_malloc(sizeof(tLimMlmAuthReq));
             if ( NULL == pMlmAuthReq )
@@ -2961,6 +2979,11 @@ limProcessStaMlmAddBssRspFT(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ, tpPESession
     tpAddBssParams pAddBssParams = (tpAddBssParams) limMsgQ->bodyptr;
     tANI_U32 selfStaDot11Mode = 0;
 
+#ifdef FEATURE_WLAN_ESE
+    tLimMlmReassocReq *pMlmReassocReq;
+    tANI_U32 val = 0;
+#endif
+
     /* Sanity Checks */
 
     if (pAddBssParams == NULL)
@@ -2981,6 +3004,39 @@ limProcessStaMlmAddBssRspFT(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ, tpPESession
         limPrintMacAddr(pMac, pAddBssParams->staContext.staMac, LOGE);
         goto end;
     }
+
+#ifdef FEATURE_WLAN_ESE
+    /*
+     * In case of Ese Reassociation, change the reassoc timer
+     * value.
+     */
+    pMlmReassocReq = (tLimMlmReassocReq *)(psessionEntry->pLimMlmReassocReq);
+    if (pMlmReassocReq == NULL)
+    {
+        limLog(pMac, LOGE,
+                   FL("Invalid pMlmReassocReq"));
+        goto end;
+    }
+    val = pMlmReassocReq->reassocFailureTimeout;
+    if (psessionEntry->isESEconnection)
+    {
+        val = val/LIM_MAX_REASSOC_RETRY_LIMIT;
+    }
+    if (tx_timer_deactivate(&pMac->lim.limTimers.gLimReassocFailureTimer) !=
+            TX_SUCCESS)
+    {
+        limLog(pMac, LOGP,
+                   FL("unable to deactivate Reassoc failure timer"));
+    }
+    val = SYS_MS_TO_TICKS(val);
+    if (tx_timer_change(&pMac->lim.limTimers.gLimReassocFailureTimer,
+                        val, 0) != TX_SUCCESS)
+    {
+        limLog(pMac, LOGP,
+                   FL("unable to change Reassociation failure timer"));
+    }
+#endif
+
     // Prepare and send Reassociation request frame
     // start reassoc timer.
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
@@ -3199,6 +3255,7 @@ end:
 static void
 limProcessStaMlmAddBssRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,tpPESession psessionEntry)
 {
+    tANI_U32 params[4][WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN];
     tpAddBssParams pAddBssParams = (tpAddBssParams) limMsgQ->bodyptr;
     tLimMlmAssocCnf mlmAssocCnf;
     tANI_U32 mesgType       = LIM_MLM_ASSOC_CNF;
@@ -3280,6 +3337,20 @@ limProcessStaMlmAddBssRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,tpPESession ps
             pStaDs->staIndex = pAddBssParams->staContext.staIdx;
             pStaDs->ucUcastSig   = pAddBssParams->staContext.ucUcastSig;
             pStaDs->ucBcastSig   = pAddBssParams->staContext.ucBcastSig;
+
+            //for ETSI, STA should follow AP' country code and judge the country of EU, while we have no valid AP, so need ignore country for ETSI test.
+            //if(pMac->roam.configParam.gStaLocalEDCAEnable && vos_is_etsi_europe_country(pMac->scan.countryCodeCurrent))
+            if(pMac->roam.configParam.gStaLocalEDCAEnable)
+            {
+
+                if (schGetParams(pMac, params, true /*local*/) != eSIR_SUCCESS)
+                    {
+                        PELOGE(limLog(pMac, LOGE, FL("schGetParams(local) failed"));)
+                    }
+                    else
+                        setSchEdcaParams(pMac, params, psessionEntry);
+            }
+
             // Downgrade the EDCA parameters if needed
             limSetActiveEdcaParams(pMac, psessionEntry->gLimEdcaParams, psessionEntry);
             limSendEdcaParams(pMac, psessionEntry->gLimEdcaParamsActive,
@@ -3814,6 +3885,11 @@ static void limProcessSwitchChannelReAssocReq(tpAniSirGlobal pMac, tpPESession p
 {
     tLimMlmReassocCnf       mlmReassocCnf;
     tLimMlmReassocReq       *pMlmReassocReq;
+
+#ifdef FEATURE_WLAN_ESE
+    tANI_U32                val = 0;
+#endif
+
     pMlmReassocReq = (tLimMlmReassocReq *)(psessionEntry->pLimMlmReassocReq);
     if(pMlmReassocReq == NULL)
     {
@@ -3828,6 +3904,32 @@ static void limProcessSwitchChannelReAssocReq(tpAniSirGlobal pMac, tpPESession p
         mlmReassocCnf.resultCode = eSIR_SME_CHANNEL_SWITCH_FAIL;
         goto end;
     }
+#ifdef FEATURE_WLAN_ESE
+    /*
+     * In case of Ese Reassociation, change the reassoc timer
+     * value.
+     */
+    val = pMlmReassocReq->reassocFailureTimeout;
+    if (psessionEntry->isESEconnection)
+    {
+        val = val/LIM_MAX_REASSOC_RETRY_LIMIT;
+    }
+    if (tx_timer_deactivate(&pMac->lim.limTimers.gLimReassocFailureTimer) !=
+                 TX_SUCCESS)
+    {
+        limLog(pMac, LOGP,
+               FL("unable to deactivate Reassoc failure timer"));
+    }
+    val = SYS_MS_TO_TICKS(val);
+    if (tx_timer_change(&pMac->lim.limTimers.gLimReassocFailureTimer,
+                        val, 0) != TX_SUCCESS)
+    {
+        limLog(pMac, LOGP,
+               FL("unable to change Reassociation failure timer"));
+
+    }
+#endif
+    pMac->lim.limTimers.gLimReassocFailureTimer.sessionId = psessionEntry->peSessionId;
     /// Start reassociation failure timer
     MTRACE(macTrace(pMac, TRACE_CODE_TIMER_ACTIVATE, psessionEntry->peSessionId, eLIM_REASSOC_FAIL_TIMER));
     if (tx_timer_activate(&pMac->lim.limTimers.gLimReassocFailureTimer)
@@ -4364,321 +4466,6 @@ void limProcessFinishScanRsp(tpAniSirGlobal pMac,  void *body)
     }
     return;
 }
-/**
- * @function : limProcessMlmHalAddBARsp
- *
- * @brief:     Process WDA_ADDBA_RSP coming from HAL
- *
- *
- * @param pMac The global tpAniSirGlobal object
- *
- * @param tSirMsgQ The MsgQ header containing the response buffer
- *
- * @return none
- */
-void limProcessMlmHalAddBARsp( tpAniSirGlobal pMac,
-    tpSirMsgQ limMsgQ )
-{
-    // Send LIM_MLM_ADDBA_CNF to LIM
-    tpLimMlmAddBACnf pMlmAddBACnf;
-    tpPESession     psessionEntry = NULL;
-    tpAddBAParams pAddBAParams = (tpAddBAParams) limMsgQ->bodyptr;
-
-    //now LIM can process any defer message.
-    SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-    if (pAddBAParams == NULL) {
-        PELOGE(limLog(pMac, LOGE,FL("NULL ADD BA Response from HAL"));)
-        return;
-    }
-    if((psessionEntry = peFindSessionBySessionId(pMac, pAddBAParams->sessionId))==NULL)
-    {
-        PELOGE(limLog(pMac, LOGE,FL("session does not exist for given sessionID: %d"),pAddBAParams->sessionId );)
-        vos_mem_free(limMsgQ->bodyptr);
-        limMsgQ->bodyptr = NULL;
-        return;
-    }
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
-    limDiagEventReport(pMac, WLAN_PE_DIAG_HAL_ADDBA_RSP_EVENT, psessionEntry, 0, 0);
-#endif //FEATURE_WLAN_DIAG_SUPPORT
-
-    // Allocate for LIM_MLM_ADDBA_CNF
-    pMlmAddBACnf = vos_mem_malloc(sizeof(tLimMlmAddBACnf));
-    if ( NULL == pMlmAddBACnf ) {
-        limLog( pMac, LOGP, FL(" AllocateMemory failed for pMlmAddBACnf"));
-        vos_mem_free(limMsgQ->bodyptr);
-        limMsgQ->bodyptr = NULL;
-        return;
-    }
-     vos_mem_set((void *) pMlmAddBACnf, sizeof( tLimMlmAddBACnf ), 0);
-     // Copy the peer MAC
-     vos_mem_copy(pMlmAddBACnf->peerMacAddr, pAddBAParams->peerMacAddr,
-                  sizeof( tSirMacAddr ));
-     // Copy other ADDBA Rsp parameters
-     pMlmAddBACnf->baDialogToken = pAddBAParams->baDialogToken;
-     pMlmAddBACnf->baTID = pAddBAParams->baTID;
-     pMlmAddBACnf->baPolicy = pAddBAParams->baPolicy;
-     pMlmAddBACnf->baBufferSize = pAddBAParams->baBufferSize;
-     pMlmAddBACnf->baTimeout = pAddBAParams->baTimeout;
-     pMlmAddBACnf->baDirection = pAddBAParams->baDirection;
-     pMlmAddBACnf->sessionId = psessionEntry->peSessionId;
-     if(eHAL_STATUS_SUCCESS == pAddBAParams->status)
-        pMlmAddBACnf->addBAResultCode = eSIR_MAC_SUCCESS_STATUS;
-     else
-        pMlmAddBACnf->addBAResultCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
-     vos_mem_free(limMsgQ->bodyptr);
-     limMsgQ->bodyptr = NULL;
-     // Send ADDBA CNF to LIM
-     limPostSmeMessage( pMac, LIM_MLM_ADDBA_CNF, (tANI_U32 *) pMlmAddBACnf );
-}
-/**
- * \brief Process LIM_MLM_ADDBA_CNF
- *
- * \sa limProcessMlmAddBACnf
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param tSirMsgQ The MsgQ header containing the response buffer
- *
- * \return none
- */
-void limProcessMlmAddBACnf( tpAniSirGlobal pMac,
-    tANI_U32 *pMsgBuf )
-{
-tpLimMlmAddBACnf pMlmAddBACnf;
-tpDphHashNode pSta;
-tANI_U16 aid;
-tLimBAState curBaState;
-tpPESession psessionEntry = NULL;
-if(pMsgBuf == NULL)
-{
-    PELOGE(limLog(pMac, LOGE,FL("Buffer is Pointing to NULL"));)
-    return;
-}
-pMlmAddBACnf = (tpLimMlmAddBACnf) pMsgBuf;
-  if((psessionEntry = peFindSessionBySessionId(pMac,pMlmAddBACnf->sessionId))== NULL)
-  {
-        PELOGE(limLog(pMac, LOGE,FL("session does not exist for given BSSId"));)
-        vos_mem_free(pMsgBuf);
-        return;
-  }
-  // First, extract the DPH entry
-  pSta = dphLookupHashEntry( pMac, pMlmAddBACnf->peerMacAddr, &aid, &psessionEntry->dph.dphHashTable);
-  if( NULL == pSta )
-  {
-    PELOGE(limLog( pMac, LOGE,
-        FL( "STA context not found - ignoring ADDBA CNF from HAL" ));)
-    vos_mem_free(pMsgBuf);
-    return;
-  }
-  LIM_GET_STA_BA_STATE(pSta, pMlmAddBACnf->baTID, &curBaState);
-  // Need to validate SME state
-  if( eLIM_BA_STATE_WT_ADD_RSP != curBaState)
-  {
-    PELOGE(limLog( pMac, LOGE,
-        FL( "Received unexpected ADDBA CNF when STA BA state is %d" ),
-        curBaState );)
-      vos_mem_free(pMsgBuf);
-    return;
-  }
-  // Restore STA BA state
-  LIM_SET_STA_BA_STATE(pSta, pMlmAddBACnf->baTID, eLIM_BA_STATE_IDLE);
-  if( eSIR_MAC_SUCCESS_STATUS == pMlmAddBACnf->addBAResultCode )
-  {
-    // Update LIM internal cache...
-    if( eBA_RECIPIENT == pMlmAddBACnf->baDirection )
-    {
-      pSta->tcCfg[pMlmAddBACnf->baTID].fUseBARx = 1;
-      pSta->tcCfg[pMlmAddBACnf->baTID].fRxCompBA = 1;
-      pSta->tcCfg[pMlmAddBACnf->baTID].fRxBApolicy = pMlmAddBACnf->baPolicy;
-      pSta->tcCfg[pMlmAddBACnf->baTID].rxBufSize = pMlmAddBACnf->baBufferSize;
-      pSta->tcCfg[pMlmAddBACnf->baTID].tuRxBAWaitTimeout = pMlmAddBACnf->baTimeout;
-      // Package LIM_MLM_ADDBA_RSP to MLME, with proper
-      // status code. MLME will then send an ADDBA RSP
-      // over the air to the peer MAC entity
-      if( eSIR_SUCCESS != limPostMlmAddBARsp( pMac,
-            pMlmAddBACnf->peerMacAddr,
-            pMlmAddBACnf->addBAResultCode,
-            pMlmAddBACnf->baDialogToken,
-            (tANI_U8) pMlmAddBACnf->baTID,
-            (tANI_U8) pMlmAddBACnf->baPolicy,
-            pMlmAddBACnf->baBufferSize,
-            pMlmAddBACnf->baTimeout,psessionEntry))
-      {
-        PELOGW(limLog( pMac, LOGW,
-            FL( "Failed to post LIM_MLM_ADDBA_RSP to " ));
-        limPrintMacAddr( pMac, pMlmAddBACnf->peerMacAddr, LOGW );)
-      }
-    }
-    else
-    {
-      pSta->tcCfg[pMlmAddBACnf->baTID].fUseBATx = 1;
-      pSta->tcCfg[pMlmAddBACnf->baTID].fTxCompBA = 1;
-      pSta->tcCfg[pMlmAddBACnf->baTID].fTxBApolicy = pMlmAddBACnf->baPolicy;
-      pSta->tcCfg[pMlmAddBACnf->baTID].txBufSize = pMlmAddBACnf->baBufferSize;
-      pSta->tcCfg[pMlmAddBACnf->baTID].tuTxBAWaitTimeout = pMlmAddBACnf->baTimeout;
-    }
-  }
-  // Free the memory allocated for LIM_MLM_ADDBA_CNF
-  vos_mem_free(pMsgBuf);
-  pMsgBuf = NULL;
-}
-/**
- * \brief Process LIM_MLM_DELBA_CNF
- *
- * \sa limProcessMlmDelBACnf
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param tSirMsgQ The MsgQ header containing the response buffer
- *
- * \return none
- */
-void limProcessMlmDelBACnf( tpAniSirGlobal pMac,
-    tANI_U32 *pMsgBuf )
-{
-    tpLimMlmDelBACnf    pMlmDelBACnf;
-    tpDphHashNode       pSta;
-    tANI_U16            aid;
-    tLimBAState         curBaState;
-    tpPESession         psessionEntry;
-
-    if(pMsgBuf == NULL)
-    {
-         PELOGE(limLog(pMac, LOGE,FL("Buffer is Pointing to NULL"));)
-         return;
-    }
-    pMlmDelBACnf = (tpLimMlmDelBACnf) pMsgBuf;
-    if((psessionEntry = peFindSessionBySessionId(pMac, pMlmDelBACnf->sessionId))== NULL)
-   {
-        limLog(pMac, LOGP,FL("SessionId:%d Session Does not exist"),
-        pMlmDelBACnf->sessionId);
-        vos_mem_free(pMsgBuf);
-        return;
-   }
-    // First, extract the DPH entry
-    pSta = dphLookupHashEntry( pMac, pMlmDelBACnf->peerMacAddr, &aid, &psessionEntry->dph.dphHashTable );
-    if( NULL == pSta )
-    {
-        limLog( pMac, LOGE,
-            FL( "STA context not found - ignoring DELBA CNF from HAL" ));
-        vos_mem_free(pMsgBuf);
-        return;
-    }
-    if(NULL == pMlmDelBACnf)
-    {
-        limLog( pMac, LOGE,
-        FL( "pMlmDelBACnf is NULL - ignoring DELBA CNF from HAL" ));
-        return;
-    }
-    // Need to validate baState
-    LIM_GET_STA_BA_STATE(pSta, pMlmDelBACnf->baTID, &curBaState);
-    if( eLIM_BA_STATE_WT_DEL_RSP != curBaState )
-    {
-        limLog( pMac, LOGE,
-        FL( "Received unexpected DELBA CNF when STA BA state is %d" ),
-        curBaState );
-        vos_mem_free(pMsgBuf);
-        return;
-    }
-    // Restore STA BA state
-    LIM_SET_STA_BA_STATE(pSta, pMlmDelBACnf->baTID, eLIM_BA_STATE_IDLE);
-    // Free the memory allocated for LIM_MLM_DELBA_CNF
-    vos_mem_free(pMsgBuf);
-}
-/**
- * \brief Process SIR_LIM_DEL_BA_IND
- *
- * \sa limProcessMlmHalBADeleteInd
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param tSirMsgQ The MsgQ header containing the indication buffer
- *
- * \return none
- */
-void limProcessMlmHalBADeleteInd( tpAniSirGlobal pMac,
-    tpSirMsgQ limMsgQ )
-{
-    tSirRetStatus       status = eSIR_SUCCESS;
-    tpBADeleteParams    pBADeleteParams;
-    tpDphHashNode       pSta;
-    tANI_U16            aid;
-    tLimBAState         curBaState;
-    tpPESession         psessionEntry;
-    tANI_U8             sessionId;
-
-  pBADeleteParams = (tpBADeleteParams) limMsgQ->bodyptr;
-
-    if((psessionEntry = peFindSessionByBssid(pMac,pBADeleteParams->bssId,&sessionId))== NULL)
-    {
-        PELOGE(limLog(pMac, LOGE,FL("session does not exist for given BSSId"));)
-        vos_mem_free(limMsgQ->bodyptr);
-        limMsgQ->bodyptr = NULL;
-        return;
-    }
-    // First, extract the DPH entry
-    pSta = dphLookupHashEntry( pMac, pBADeleteParams->peerMacAddr, &aid, &psessionEntry->dph.dphHashTable );
-    if( NULL == pSta )
-    {
-        limLog( pMac, LOGE,
-        FL( "STA context not found - ignoring BA Delete IND from HAL" ));
-        goto returnAfterCleanup;
-    }
-
-  // Need to validate BA state
-  LIM_GET_STA_BA_STATE(pSta, pBADeleteParams->baTID, &curBaState);
-  if( eLIM_BA_STATE_IDLE != curBaState )
-  {
-    limLog( pMac, LOGE,
-        FL( "Received unexpected BA Delete IND when STA BA state is %d" ),
-        curBaState );
-        goto returnAfterCleanup;
-    }
-
-  // Validate if a BA is active for the requested TID
-  // AND in that desired direction
-  if( eBA_INITIATOR == pBADeleteParams->baDirection )
-  {
-    if( 0 == pSta->tcCfg[pBADeleteParams->baTID].fUseBATx )
-      status = eSIR_FAILURE;
-  }
-  else
-  {
-    if( 0 == pSta->tcCfg[pBADeleteParams->baTID].fUseBARx )
-      status = eSIR_FAILURE;
-  }
-    if( eSIR_FAILURE == status )
-    {
-        limLog( pMac, LOGW,
-        FL("Received an INVALID DELBA Delete Ind for TID %d..."),
-        pBADeleteParams->baTID );
-    }
-    else
-    {
-        // Post DELBA REQ to MLME...
-        if( eSIR_SUCCESS !=
-        (status = limPostMlmDelBAReq( pMac,
-                                      pSta,
-                                      pBADeleteParams->baDirection,
-                                      pBADeleteParams->baTID,
-                                      eSIR_MAC_UNSPEC_FAILURE_REASON,psessionEntry )))
-        {
-            limLog( pMac, LOGE,
-            FL( "Attempt to post LIM_MLM_DELBA_REQ failed with status %d" ), status);
-    }
-    else
-    {
-      limLog( pMac, LOGE,
-          FL( "BA Delete - Reason 0x%08x. Attempting to delete BA session for TID %d with peer STA "  ),
-          pBADeleteParams->reasonCode, pBADeleteParams->baTID );
-            limPrintMacAddr( pMac, pSta->staAddr, LOGE );
-        }
-  }
-returnAfterCleanup:
-  // Free the memory allocated for SIR_LIM_DEL_BA_IND
-  vos_mem_free(limMsgQ->bodyptr);
-  limMsgQ->bodyptr = NULL;
-}
 
 /**
   *     @function : limHandleDelBssInReAssocContext
@@ -4744,13 +4531,15 @@ limHandleDelBssInReAssocContext(tpAniSirGlobal pMac, tpDphHashNode pStaDs,tpPESe
             assocRsp = (tpSirAssocRsp)psessionEntry->limAssocResponseData;
             limUpdateAssocStaDatas(pMac, pStaDs, assocRsp,psessionEntry);
             limUpdateReAssocGlobals(pMac, assocRsp,psessionEntry);
-            limExtractApCapabilities( pMac,
-                  (tANI_U8 *) psessionEntry->pLimReAssocReq->bssDescription.ieFields,
-                  limGetIElenFromBssDescription( &psessionEntry->pLimReAssocReq->bssDescription ),
-                    pBeaconStruct );
+            limExtractApCapabilities(pMac,
+              (tANI_U8 *)
+              psessionEntry->pLimReAssocReq->bssDescription.ieFields,
+              GET_IE_LEN_IN_BSS(
+              psessionEntry->pLimReAssocReq->bssDescription.length),
+              pBeaconStruct);
             if(pMac->lim.gLimProtectionControl != WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
                 limDecideStaProtectionOnAssoc(pMac, pBeaconStruct, psessionEntry);
-                if(pBeaconStruct->erpPresent) {
+            if(pBeaconStruct->erpPresent) {
                 if (pBeaconStruct->erpIEInfo.barkerPreambleMode)
                     psessionEntry->beaconParams.fShortPreamble = 0;
                 else
@@ -4917,10 +4706,11 @@ limHandleAddBssInReAssocContext(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpPES
             assocRsp = (tpSirAssocRsp)psessionEntry->limAssocResponseData;
             limUpdateAssocStaDatas(pMac, pStaDs, assocRsp, psessionEntry);
             limUpdateReAssocGlobals(pMac, assocRsp, psessionEntry);
-            limExtractApCapabilities( pMac,
-                  (tANI_U8 *) psessionEntry->pLimReAssocReq->bssDescription.ieFields,
-                  limGetIElenFromBssDescription( &psessionEntry->pLimReAssocReq->bssDescription ),
-                    pBeaconStruct );
+            limExtractApCapabilities(pMac,
+             (tANI_U8 *)psessionEntry->pLimReAssocReq->bssDescription.ieFields,
+             GET_IE_LEN_IN_BSS(
+             psessionEntry->pLimReAssocReq->bssDescription.length),
+             pBeaconStruct);
             if(pMac->lim.gLimProtectionControl != WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
                 limDecideStaProtectionOnAssoc(pMac, pBeaconStruct, psessionEntry);
 
@@ -5135,7 +4925,7 @@ void limProcessRxScanEvent(tpAniSirGlobal pMac, void *buf)
 
 /**
  * lim_process_rx_channel_status_event() - processes
- *     event WDA_RX_CHN_STATUS_EVENT
+ * 	event WDA_RX_CHN_STATUS_EVENT
  * @mac_ctx Pointer to Global MAC structure
  * @buf: Received message info
  *
@@ -5143,23 +4933,23 @@ void limProcessRxScanEvent(tpAniSirGlobal pMac, void *buf)
  */
 void lim_process_rx_channel_status_event(tpAniSirGlobal mac_ctx, void *buf)
 {
-       struct lim_channel_status *channel_status_info = buf;
-
-       if (ACS_FW_REPORT_PARAM_CONFIGURED) {
-               if (channel_status_info != NULL)
-                       lim_add_channel_status_info(mac_ctx,
-                                channel_status_info,
-                                channel_status_info->channel_id);
-               else
-                       VOS_TRACE(VOS_MODULE_ID_PE,
-                               VOS_TRACE_LEVEL_ERROR,
-                               "%s: ACS evt report buf NULL", __func__);
-       } else {
-               VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
-                       "%s: Error evt report", __func__);
-       }
+	struct lim_channel_status *channel_status_info = buf;
+
+	if (ACS_FW_REPORT_PARAM_CONFIGURED) {
+		if (channel_status_info != NULL)
+			lim_add_channel_status_info(mac_ctx,
+				 channel_status_info,
+				 channel_status_info->channel_id);
+		else
+			VOS_TRACE(VOS_MODULE_ID_PE,
+				VOS_TRACE_LEVEL_ERROR,
+				"%s: ACS evt report buf NULL", __func__);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+			"%s: Error evt report", __func__);
+	}
 
-       if (NULL != buf)
-               vos_mem_free(buf);
-       return;
+	if (NULL != buf)
+		vos_mem_free(buf);
+	return;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessProbeReqFrame.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessProbeReqFrame.c
index 4cef79044b9..c04dda1e79c 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessProbeReqFrame.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessProbeReqFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -36,7 +36,7 @@
  *
  */
 
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "aniGlobal.h"
 #include "cfgApi.h"
 
@@ -172,8 +172,8 @@ void limRemovePBCSessions(tpAniSirGlobal pMac, tSirMacAddr pRemoveMac,tpPESessio
           prev->next = pbc->next;
           if (pbc == psessionEntry->pAPWPSPBCSession)
             psessionEntry->pAPWPSPBCSession = pbc->next;
-            vos_mem_free(pbc);
-            return;
+          vos_mem_free(pbc);
+          return;
         }
         prev = pbc;
         pbc = pbc->next;
@@ -628,7 +628,7 @@ limIndicateProbeReqToHDD(tpAniSirGlobal pMac, tANI_U8 *pBd,
     limSendSmeMgmtFrameInd( pMac, pHdr->fc.subType,
                (tANI_U8*)pHdr, (frameLen + sizeof(tSirMacMgmtHdr)),
                psessionEntry->smeSessionId, WDA_GET_RX_CH(pBd),
-               psessionEntry, 0);
+               psessionEntry, WDA_GET_RX_RSSI_NORMALIZED(pBd));
 } /*** end limIndicateProbeReqToHDD() ***/
 
 /**
@@ -742,6 +742,10 @@ limSendSmeProbeReqInd(tpAniSirGlobal pMac,
 
     MTRACE(macTrace(pMac, TRACE_CODE_TX_SME_MSG, psessionEntry->peSessionId,
                                                                msgQ.type));
+
+    if (ProbeReqIELen > sizeof(pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIE))
+        ProbeReqIELen = sizeof(pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIE);
+
     pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIELen = (tANI_U16)ProbeReqIELen;
     vos_mem_copy(pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIE, pProbeReqIE, ProbeReqIELen);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c
index e6c2d4b39d9..ea015bd0cdd 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c
@@ -38,7 +38,7 @@
  */
 
 #include "wniApi.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "aniGlobal.h"
 #include "schApi.h"
 #include "utilsApi.h"
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index 27065a7a124..83c5afc1f19 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,7 +39,7 @@
 
 #include "palTypes.h"
 #include "wniApi.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "cfgApi.h"
 #include "sirApi.h"
 #include "schApi.h"
@@ -62,7 +62,7 @@
 #include "nan_datapath.h"
 #include "wma.h"
 #include "sapApi.h"
-
+#include "lim_process_fils.h"
 #if defined(FEATURE_WLAN_ESE) && !defined(FEATURE_WLAN_ESE_UPLOAD)
 #include "eseApi.h"
 #endif
@@ -82,6 +82,10 @@
 #define DEFAULT_PASSIVE_MAX_CHANNEL_TIME    110     // in msecs
 
 #define CONV_MS_TO_US 1024 //conversion factor from ms to us
+
+#define BEACON_INTERVAL_THRESHOLD 50  /* in msecs */
+#define STA_BURST_SCAN_DURATION 120   /* in msecs */
+
 // SME REQ processing function templates
 static void __limProcessSmeStartReq(tpAniSirGlobal, tANI_U32 *);
 static tANI_BOOLEAN __limProcessSmeSysReadyInd(tpAniSirGlobal, tANI_U32 *);
@@ -727,6 +731,11 @@ __limHandleSmeStartBssRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         limLog(pMac, LOG1, FL("Session RMF enabled: %d"), psessionEntry->limRmfEnabled);
 #endif
 
+        /* Update sub 20MHz channel width */
+        psessionEntry->sub20_channelwidth = pSmeStartBssReq->sub20_channelwidth;
+        psessionEntry->lim_sub20_channel_switch_bandwidth =
+            pSmeStartBssReq->sub20_channelwidth;
+
         vos_mem_copy((void*)&psessionEntry->rateSet,
             (void*)&pSmeStartBssReq->operationalRateSet,
             sizeof(tSirMacRateSet));
@@ -1061,23 +1070,23 @@ __limHandleSmeStartBssRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
 
         // Initialize 11h Enable Flag
         psessionEntry->lim11hEnable = 0;
-        if((pMlmStartReq->bssType != eSIR_IBSS_MODE) &&
-            (SIR_BAND_5_GHZ == psessionEntry->limRFBand) )
-        {
-            if (wlan_cfgGetInt(pMac, WNI_CFG_11H_ENABLED, &val) != eSIR_SUCCESS)
-                limLog(pMac, LOGP, FL("Fail to get WNI_CFG_11H_ENABLED "));
-            psessionEntry->lim11hEnable = val;
+        if (pMlmStartReq->bssType != eSIR_IBSS_MODE) {
+            if (CHAN_HOP_ALL_BANDS_ENABLE ||
+                SIR_BAND_5_GHZ == psessionEntry->limRFBand) {
+                if (wlan_cfgGetInt(pMac, WNI_CFG_11H_ENABLED, &val) !=
+                    eSIR_SUCCESS)
+                        limLog(pMac, LOGP,
+                               FL("Fail to get WNI_CFG_11H_ENABLED "));
+                psessionEntry->lim11hEnable = val;
 
-            if (psessionEntry->lim11hEnable &&
-                (eSIR_INFRA_AP_MODE == pMlmStartReq->bssType))
-            {
-                if (wlan_cfgGetInt(pMac, WNI_CFG_DFS_MASTER_ENABLED, &val) !=
-                                eSIR_SUCCESS)
-                {
-                    limLog(pMac, LOGE,
-                            FL("Fail to get WNI_CFG_DFS_MASTER_ENABLED"));
+                if (psessionEntry->lim11hEnable &&
+                    (eSIR_INFRA_AP_MODE == pMlmStartReq->bssType)) {
+                        if (wlan_cfgGetInt(pMac, WNI_CFG_DFS_MASTER_ENABLED,
+                                           &val) != eSIR_SUCCESS)
+                        limLog(pMac, LOGE,
+                               FL("Fail to get WNI_CFG_DFS_MASTER_ENABLED"));
+                    psessionEntry->lim11hEnable = val;
                 }
-                psessionEntry->lim11hEnable = val;
             }
         }
 
@@ -1199,9 +1208,14 @@ static eHalStatus limSendHalStartScanOffloadReq(tpAniSirGlobal pMac,
     tANI_U8 *vht_cap_ie;
     tANI_U16 vht_cap_len = 0;
 #endif /* WLAN_FEATURE_11AC */
+    uint8_t *vendor_tpc_ie;
     tSirRetStatus status, rc = eSIR_SUCCESS;
     tDot11fIEExtCap extracted_extcap = {0};
     bool extcap_present = true;
+    uint32_t lim_11h_enable = WNI_CFG_11H_ENABLED_STADEF;
+
+    wlan_cfgGetInt(pMac, WNI_CFG_11H_ENABLED, &lim_11h_enable);
+
 
     pMac->lim.fOffloadScanPending = 0;
     pMac->lim.fOffloadScanP2PSearch = 0;
@@ -1228,7 +1242,7 @@ static eHalStatus limSendHalStartScanOffloadReq(tpAniSirGlobal pMac,
     /* The tSirScanOffloadReq will reserve the space for first channel,
        so allocate the memory for (numChannels - 1) and uIEFieldLen */
     len = sizeof(tSirScanOffloadReq) + (pScanReq->channelList.numChannels - 1) +
-        pScanReq->uIEFieldLen;
+        pScanReq->uIEFieldLen + pScanReq->oui_field_len;
 
     if (!pMac->per_band_chainmask_supp) {
         if (IS_DOT11_MODE_HT(pScanReq->dot11mode)) {
@@ -1254,6 +1268,11 @@ static eHalStatus limSendHalStartScanOffloadReq(tpAniSirGlobal pMac,
 #endif /* WLAN_FEATURE_11AC */
     }
 
+    if (lim_11h_enable) {
+            addn_ie_len += DOT11F_IE_WFATPC_MAX_LEN + 2;
+            len += DOT11F_IE_WFATPC_MAX_LEN + 2;
+    }
+
     pScanOffloadReq = vos_mem_malloc(len);
     if ( NULL == pScanOffloadReq )
     {
@@ -1302,7 +1321,16 @@ static eHalStatus limSendHalStartScanOffloadReq(tpAniSirGlobal pMac,
     pScanOffloadReq->min_rest_time= pScanReq->min_rest_time;
     pScanOffloadReq->idle_time= pScanReq->idle_time;
 
-
+    for (i = 0; i < pMac->lim.maxBssId; i++) {
+        tpPESession session_entry = peFindSessionBySessionId(pMac,i);
+        if (session_entry &&
+            (eLIM_MLM_LINK_ESTABLISHED_STATE == session_entry->limMlmState) &&
+            (session_entry->beaconParams.beaconInterval
+                                      < BEACON_INTERVAL_THRESHOLD)) {
+            pScanOffloadReq->burst_scan_duration = STA_BURST_SCAN_DURATION;
+            break;
+        }
+    }
     /* for normal scan, the value for p2pScanType should be 0
        always */
     if (pScanReq->p2pSearch)
@@ -1322,7 +1350,8 @@ static eHalStatus limSendHalStartScanOffloadReq(tpAniSirGlobal pMac,
 
     pScanOffloadReq->uIEFieldLen = pScanReq->uIEFieldLen;
     pScanOffloadReq->uIEFieldOffset = len - addn_ie_len -
-                                      pScanOffloadReq->uIEFieldLen;
+                                      pScanOffloadReq->uIEFieldLen -
+                                      pScanReq->oui_field_len;
     vos_mem_copy(
             (tANI_U8 *) pScanOffloadReq + pScanOffloadReq->uIEFieldOffset,
             (tANI_U8 *) pScanReq + pScanReq->uIEFieldOffset,
@@ -1358,6 +1387,50 @@ static eHalStatus limSendHalStartScanOffloadReq(tpAniSirGlobal pMac,
 #endif /* WLAN_FEATURE_11AC */
     }
 
+    if (lim_11h_enable) {
+            tDot11fIEWFATPC wfa_tpc;
+            vendor_tpc_ie = (uint8_t *) pScanOffloadReq +
+                                 pScanOffloadReq->uIEFieldOffset +
+                                 pScanOffloadReq->uIEFieldLen;
+            PopulateDot11fWFATPC(pMac, &wfa_tpc,
+                                 rrmGetMgmtTxPower(pMac, NULL), 0);
+            vendor_tpc_ie[0] = DOT11F_EID_WFATPC;
+            vendor_tpc_ie[1] = DOT11F_IE_WFATPC_MAX_LEN;
+            vos_mem_copy(&vendor_tpc_ie[2], SIR_MAC_WFA_TPC_OUI,
+                                 SIR_MAC_WFA_TPC_OUI_SIZE);
+            vos_mem_copy(&vendor_tpc_ie[SIR_MAC_WFA_TPC_OUI_SIZE + 2],
+                                 ((uint8_t *)&wfa_tpc) + 1,
+                                  DOT11F_IE_WFATPC_MAX_LEN
+                                  - SIR_MAC_WFA_TPC_OUI_SIZE);
+            pScanOffloadReq->uIEFieldLen += DOT11F_IE_WFATPC_MAX_LEN + 2;
+    }
+
+    pScanOffloadReq->enable_scan_randomization =
+                                           pScanReq->enable_scan_randomization;
+    if (pScanOffloadReq->enable_scan_randomization) {
+        vos_mem_copy(pScanOffloadReq->mac_addr, pScanReq->mac_addr,
+                     VOS_MAC_ADDR_SIZE);
+        vos_mem_copy(pScanOffloadReq->mac_addr_mask, pScanReq->mac_addr_mask,
+                     VOS_MAC_ADDR_SIZE);
+    }
+
+    pScanOffloadReq->oui_field_len = pScanReq->oui_field_len;
+    pScanOffloadReq->num_vendor_oui = pScanReq->num_vendor_oui;
+    pScanOffloadReq->ie_whitelist = pScanReq->ie_whitelist;
+    if (pScanOffloadReq->ie_whitelist)
+        vos_mem_copy(pScanOffloadReq->probe_req_ie_bitmap,
+                     pScanReq->probe_req_ie_bitmap,
+                     PROBE_REQ_BITMAP_LEN * sizeof(uint32_t));
+    pScanOffloadReq->oui_field_offset = sizeof(tSirScanOffloadReq) +
+                               (pScanOffloadReq->channelList.numChannels - 1) +
+                               pScanOffloadReq->uIEFieldLen;
+    if (pScanOffloadReq->num_vendor_oui != 0) {
+        vos_mem_copy(
+            (tANI_U8 *) pScanOffloadReq + pScanOffloadReq->oui_field_offset,
+            (uint8_t *) pScanReq + pScanReq->oui_field_offset,
+            pScanReq->oui_field_len);
+    }
+
     rc = wdaPostCtrlMsg(pMac, &msg);
     if (rc != eSIR_SUCCESS)
     {
@@ -1786,6 +1859,8 @@ static void __limProcessSmeOemDataReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
     if (!pMlmOemDataReq->data) {
         limLog(pMac, LOGP, FL("memory allocation failed"));
         vos_mem_free(pMlmOemDataReq);
+        /* buffer from SME copied, free it now */
+        vos_mem_free(pOemDataReq->data);
         return;
     }
 
@@ -1919,7 +1994,7 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
             vos_flush_logs(WLAN_LOG_TYPE_FATAL,
                            WLAN_LOG_INDICATOR_HOST_DRIVER,
                            WLAN_LOG_REASON_STALE_SESSION_FOUND,
-                           true);
+                           DUMP_VOS_TRACE);
             retCode = eSIR_SME_REFUSED;
             goto end;
         }
@@ -2004,9 +2079,7 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
 
 
         /* Store vendor specfic IE for CISCO AP */
-        ieLen = (pSmeJoinReq->bssDescription.length +
-                  sizeof( pSmeJoinReq->bssDescription.length ) -
-                  GET_FIELD_OFFSET( tSirBssDescription, ieFields ));
+        ieLen = GET_IE_LEN_IN_BSS(pSmeJoinReq->bssDescription.length);
 
         vendorIE = cfg_get_vendor_ie_ptr_from_oui(pMac, SIR_MAC_CISCO_OUI,
                     SIR_MAC_CISCO_OUI_SIZE,
@@ -2052,13 +2125,14 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
             psessionEntry->vdev_nss = vdev_type_nss->sta;
 
         limLog(pMac, LOG1,
-              FL("persona: %d, nss: %d cbMode: %d enableHtSmps: %d htSmps: %d supported NSS 1x1: %d"),
+              FL("persona: %d, nss: %d cbMode: %d enableHtSmps: %d htSmps: %d supported NSS 1x1: %d force_24ghz_in_ht20 %d"),
                         psessionEntry->pePersona,
                         psessionEntry->vdev_nss,
                         pSmeJoinReq->cbMode,
                         psessionEntry->enableHtSmps,
                         psessionEntry->htSmpsvalue,
-                        psessionEntry->supported_nss_1x1);
+                        psessionEntry->supported_nss_1x1,
+                        pSmeJoinReq->force_24ghz_in_ht20);
 
 #ifdef WLAN_FEATURE_11AC
         psessionEntry->vhtCapability = IS_DOT11_MODE_VHT(psessionEntry->dot11mode);
@@ -2075,17 +2149,14 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
             psessionEntry->txMuBformee = pSmeJoinReq->txMuBformee;
             psessionEntry->enableVhtpAid = pSmeJoinReq->enableVhtpAid;
             psessionEntry->enableVhtGid = pSmeJoinReq->enableVhtGid;
-            if( psessionEntry->txBFIniFeatureEnabled )
-            {
-                if (cfgSetInt(pMac, WNI_CFG_VHT_SU_BEAMFORMEE_CAP,
-                                     psessionEntry->txBFIniFeatureEnabled)
-                                                             != eSIR_SUCCESS)
-                {
-                    limLog(pMac, LOGE, FL("could not set  "
-                                  "WNI_CFG_VHT_SU_BEAMFORMEE_CAP at CFG"));
+            if (cfgSetInt(pMac, WNI_CFG_VHT_SU_BEAMFORMEE_CAP,
+                    psessionEntry->txBFIniFeatureEnabled)) {
+                    limLog(pMac, LOGE, FL("Could not set WNI_CFG_VHT_SU_BEAMFORMEE_CAP at CFG"));
                     retCode = eSIR_LOGP_EXCEPTION;
                     goto end;
-                }
+            }
+
+            if (psessionEntry->txBFIniFeatureEnabled) {
                 if (cfgSetInt(pMac, WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED,
                                                        pSmeJoinReq->txBFCsnValue)
                                                              != eSIR_SUCCESS)
@@ -2109,6 +2180,7 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         psessionEntry->gLimPhyMode = pSmeJoinReq->bssDescription.nwType;
         handleHTCapabilityandHTInfo(pMac, psessionEntry);
         psessionEntry->htSupportedChannelWidthSet = (pSmeJoinReq->cbMode > 0)?1:0; // This is already merged value of peer and self - done by csr in csrGetCBModeFromIes
+        psessionEntry->force_24ghz_in_ht20 = pSmeJoinReq->force_24ghz_in_ht20;
         psessionEntry->htRecommendedTxWidthSet = psessionEntry->htSupportedChannelWidthSet;
         psessionEntry->htSecondaryChannelOffset = pSmeJoinReq->cbMode;
 
@@ -2168,7 +2240,7 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         psessionEntry->isFastRoamIniFeatureEnabled = pSmeJoinReq->isFastRoamIniFeatureEnabled;
 #endif
         psessionEntry->txLdpcIniFeatureEnabled = pSmeJoinReq->txLdpcIniFeatureEnabled;
-
+        lim_update_fils_config(psessionEntry, pSmeJoinReq);
         if (psessionEntry->bssType == eSIR_INFRASTRUCTURE_MODE)
         {
             psessionEntry->limSystemRole = eLIM_STA_ROLE;
@@ -2248,8 +2320,8 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         {
            limExtractApCapability( pMac,
               (tANI_U8 *) psessionEntry->pLimJoinReq->bssDescription.ieFields,
-              limGetIElenFromBssDescription(
-              &psessionEntry->pLimJoinReq->bssDescription),
+              GET_IE_LEN_IN_BSS(
+              psessionEntry->pLimJoinReq->bssDescription.length),
               &psessionEntry->limCurrentBssQosCaps,
               &psessionEntry->limCurrentBssPropCap,
               &pMac->lim.gLimCurrentBssUapsd
@@ -2261,8 +2333,8 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         {
            limExtractApCapability( pMac,
               (tANI_U8 *) psessionEntry->pLimJoinReq->bssDescription.ieFields,
-              limGetIElenFromBssDescription(
-              &psessionEntry->pLimJoinReq->bssDescription),
+              GET_IE_LEN_IN_BSS(
+              psessionEntry->pLimJoinReq->bssDescription.length),
               &psessionEntry->limCurrentBssQosCaps,
               &psessionEntry->limCurrentBssPropCap,
               &psessionEntry->gLimCurrentBssUapsd,
@@ -2274,6 +2346,20 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         psessionEntry->maxTxPower = limGetMaxTxPower(regMax,
                    localPowerConstraint, pMac->roam.configParam.nTxPowerCap);
 
+        limLog(pMac, LOG1,
+                FL("regMax = %d, localPowerConstraint = %d,"
+                    "max tx pwr = %d, UAPSD flag for all AC - 0x%2x"),
+                regMax, localPowerConstraint,
+                psessionEntry->maxTxPower,
+                psessionEntry->gUapsdPerAcBitmask);
+
+        if (pSmeJoinReq->powerCap.maxTxPower > psessionEntry->maxTxPower)
+        {
+            pSmeJoinReq->powerCap.maxTxPower = psessionEntry->maxTxPower;
+            VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+                    "Update MaxTxPower in join Req to %d",
+                    pSmeJoinReq->powerCap.maxTxPower);
+        }
         if(!pMac->psOffloadEnabled)
         {
             if (pMac->lim.gLimCurrentBssUapsd)
@@ -2296,12 +2382,6 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
                 psessionEntry->gUapsdPerAcTriggerEnableMask = 0;
              }
         }
-        limLog(pMac, LOG1,
-               FL("regMax = %d, localPowerConstraint = %d,"
-                  "max tx pwr = %d, UAPSD flag for all AC - 0x%2x"),
-                        regMax, localPowerConstraint,
-                        psessionEntry->maxTxPower,
-                        psessionEntry->gUapsdPerAcBitmask);
 
         psessionEntry->limRFBand = limGetRFBand(psessionEntry->currentOperChannel);
 
@@ -2339,6 +2419,8 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         psessionEntry->isOSENConnection =
            pSmeJoinReq->isOSENConnection;
 
+        psessionEntry->sub20_channelwidth = pSmeJoinReq->sub20_channelwidth;
+
         /* Issue LIM_MLM_JOIN_REQ to MLM */
         limPostMlmMessage(pMac, LIM_MLM_JOIN_REQ, (tANI_U32 *) pMlmJoinReq);
         return;
@@ -2472,7 +2554,7 @@ __limProcessSmeReassocReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         vos_flush_logs(WLAN_LOG_TYPE_FATAL,
                       WLAN_LOG_INDICATOR_HOST_DRIVER,
                       WLAN_LOG_REASON_STALE_SESSION_FOUND,
-                      true);
+                      DUMP_VOS_TRACE);
         retCode = eSIR_SME_REFUSED;
         goto end;
    }
@@ -2611,8 +2693,8 @@ __limProcessSmeReassocReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
     {
         limExtractApCapability( pMac,
             (tANI_U8 *) psessionEntry->pLimReAssocReq->bssDescription.ieFields,
-            limGetIElenFromBssDescription(
-                     &psessionEntry->pLimReAssocReq->bssDescription),
+            GET_IE_LEN_IN_BSS(
+            psessionEntry->pLimReAssocReq->bssDescription.length),
             &psessionEntry->limReassocBssQosCaps,
             &psessionEntry->limReassocBssPropCap,
             &pMac->lim.gLimCurrentBssUapsd
@@ -2624,8 +2706,8 @@ __limProcessSmeReassocReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
     {
         limExtractApCapability(pMac,
             (tANI_U8 *) psessionEntry->pLimReAssocReq->bssDescription.ieFields,
-            limGetIElenFromBssDescription(
-                     &psessionEntry->pLimReAssocReq->bssDescription),
+            GET_IE_LEN_IN_BSS(
+            psessionEntry->pLimReAssocReq->bssDescription.length),
             &psessionEntry->limReassocBssQosCaps,
             &psessionEntry->limReassocBssPropCap,
             &psessionEntry->gLimCurrentBssUapsd,
@@ -2750,13 +2832,6 @@ __limProcessSmeReassocReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
        }
     }
 
-    /* Delete all BA sessions before Re-Assoc.
-     *  BA frames are class 3 frames and the session
-     *  is lost upon disassociation and reassociation.
-     */
-
-    limDeleteBASessions(pMac, psessionEntry, BA_BOTH_DIRECTIONS);
-
     pMlmReassocReq->listenInterval = (tANI_U16) val;
 
     /* Indicate whether spectrum management is enabled*/
@@ -5253,49 +5328,6 @@ static void __limProcessSmeSetHT2040Mode(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
 }
 #endif
 
-/** -------------------------------------------------------------
-\fn limProcessSmeDelBaPeerInd
-\brief handles indication message from HDD to send delete BA request
-\param   tpAniSirGlobal pMac
-\param   tANI_U32 pMsgBuf
-\return None
--------------------------------------------------------------*/
-void
-limProcessSmeDelBaPeerInd(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
-{
-    tANI_U16            assocId =0;
-    tpSmeDelBAPeerInd   pSmeDelBAPeerInd = (tpSmeDelBAPeerInd)pMsgBuf;
-    tpDphHashNode       pSta;
-    tpPESession         psessionEntry;
-    tANI_U8             sessionId;
-
-
-
-    if(NULL == pSmeDelBAPeerInd)
-        return;
-
-    if ((psessionEntry = peFindSessionByBssid(pMac,pSmeDelBAPeerInd->bssId,&sessionId))==NULL)
-    {
-        limLog(pMac, LOGE,FL("session does not exist for given bssId"));
-        return;
-    }
-    limLog(pMac, LOGW, FL("called with staId = %d, tid = %d, baDirection = %d"),
-              pSmeDelBAPeerInd->staIdx, pSmeDelBAPeerInd->baTID, pSmeDelBAPeerInd->baDirection);
-
-    pSta = dphLookupAssocId(pMac, pSmeDelBAPeerInd->staIdx, &assocId, &psessionEntry->dph.dphHashTable);
-    if( eSIR_SUCCESS != limPostMlmDelBAReq( pMac,
-          pSta,
-          pSmeDelBAPeerInd->baDirection,
-          pSmeDelBAPeerInd->baTID,
-          eSIR_MAC_UNSPEC_FAILURE_REASON,psessionEntry))
-    {
-      limLog( pMac, LOGW,
-          FL( "Failed to post LIM_MLM_DELBA_REQ to " ));
-      if (pSta)
-          limPrintMacAddr(pMac, pSta->staAddr, LOGW);
-    }
-}
-
 // --------------------------------------------------------------------
 /**
  * __limProcessReportMessage
@@ -6028,6 +6060,49 @@ static void lim_process_sme_update_access_policy_vendor_ie(
 	return;
 }
 
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+/**
+ * lim_process_sme_set_sub20_channelwidth() - update sub 20MHz channel width
+ * @mac_ptr: Mac pointer
+ * @msgbuf_ptr: Msg pointer containing the callback
+ *
+ * This function is used to save sub 20MHz channel width
+ *
+ * Return: None
+ */
+static void lim_process_sme_set_sub20_channelwidth(
+	tpAniSirGlobal mac_ptr, uint32_t *msgbuf_ptr)
+{
+	struct sme_sub20_chan_width *msg;
+	tpPESession	session_entry_ptr;
+
+	if (msgbuf_ptr == NULL) {
+		limLog(mac_ptr, LOGE, FL("Buffer is Pointing to NULL"));
+		return;
+	}
+
+	msg = (struct sme_sub20_chan_width *)msgbuf_ptr;
+	session_entry_ptr =
+		 pe_find_session_by_sme_session_id(mac_ptr, msg->session_id);
+	if (session_entry_ptr == NULL) {
+		limLog(mac_ptr, LOGE, FL("Session not exist"));
+		return;
+	}
+
+	session_entry_ptr->sub20_channelwidth = msg->channelwidth;
+	limLog(mac_ptr, LOGE, "Set sub20 channel width %d\n",
+	       session_entry_ptr->sub20_channelwidth);
+	return;
+}
+#else
+static void lim_process_sme_set_sub20_channelwidth(
+	tpAniSirGlobal mac_ptr, uint32_t *msgbuf_ptr)
+{
+	limLog(mac_ptr, LOGE, FL("invalid event"));
+	return;
+}
+#endif
+
 /**
  * limProcessSmeReqMessages()
  *
@@ -6247,9 +6322,6 @@ limProcessSmeReqMessages(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
             bufConsumed = FALSE;
             break;
 #endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
-        case eWNI_SME_DEL_BA_PEER_IND:
-            limProcessSmeDelBaPeerInd(pMac, pMsgBuf);
-            break;
         case eWNI_SME_GET_SCANNED_CHANNEL_REQ:
             limProcessSmeGetScanChannelInfo(pMac, pMsgBuf);
             break;
@@ -6384,6 +6456,9 @@ limProcessSmeReqMessages(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
         case eWNI_SME_UPDATE_ACCESS_POLICY_VENDOR_IE:
             lim_process_sme_update_access_policy_vendor_ie(pMac, pMsgBuf);
             break;
+        case eWNI_SME_SET_SUB20_CH_WIDTH:
+            lim_process_sme_set_sub20_channelwidth(pMac, pMsgBuf);
+            break;
         default:
             vos_mem_free((v_VOID_t*)pMsg->bodyptr);
             pMsg->bodyptr = NULL;
@@ -6507,13 +6582,17 @@ limProcessSmeChannelChangeRequest(tpAniSirGlobal pMac, tANI_U32 *pMsg)
 
         /* Store the New Channel Params in psessionEntry */
         if (psessionEntry->currentOperChannel !=
-                              pChannelChangeReq->targetChannel)
-        {
-            limLog(pMac, LOGE,
-                   FL("switch old chnl %d --> new chnl %d and CH width - %d"),
-                                 psessionEntry->currentOperChannel,
-                                 pChannelChangeReq->targetChannel,
-                                 pChannelChangeReq->vht_channel_width);
+            pChannelChangeReq->targetChannel ||
+            psessionEntry->sub20_channelwidth !=
+            pChannelChangeReq->sub20_channelwidth ||
+            ((VOS_MONITOR_MODE == vos_get_conparam()) &&
+            (pChannelChangeReq->vht_channel_width !=
+             psessionEntry->vht_channel_width))) {
+                limLog(pMac, LOGE,
+                       FL("switch old chn %d --> new chn %d CH width - %d"),
+                       psessionEntry->currentOperChannel,
+                       pChannelChangeReq->targetChannel,
+                       pChannelChangeReq->vht_channel_width);
 
 
 #ifdef WLAN_FEATURE_11AC
@@ -6574,12 +6653,19 @@ limProcessSmeChannelChangeRequest(tpAniSirGlobal pMac, tANI_U32 *pMsg)
                                   pChannelChangeReq->targetChannel;
             psessionEntry->limRFBand =
                                 limGetRFBand(psessionEntry->currentOperChannel);
+
+            /* Update sub 20MHz channel width */
+            psessionEntry->sub20_channelwidth =
+                 pChannelChangeReq->sub20_channelwidth;
+            psessionEntry->vht_channel_width =
+                 pChannelChangeReq->vht_channel_width;
             // Initialize 11h Enable Flag
-            if (SIR_BAND_5_GHZ == psessionEntry->limRFBand)
-            {
-                if (wlan_cfgGetInt(pMac, WNI_CFG_11H_ENABLED, &val) !=
-                                               eSIR_SUCCESS)
-                    limLog(pMac, LOGP, FL("Fail to get WNI_CFG_11H_ENABLED "));
+            if (CHAN_HOP_ALL_BANDS_ENABLE ||
+                SIR_BAND_5_GHZ == psessionEntry->limRFBand) {
+                    if (wlan_cfgGetInt(pMac, WNI_CFG_11H_ENABLED, &val) !=
+                        eSIR_SUCCESS)
+                            limLog(pMac, LOGP,
+                                   FL("Fail to get WNI_CFG_11H_ENABLED "));
             }
 
             psessionEntry->lim11hEnable = val;
@@ -6740,7 +6826,7 @@ limUpdateIBssPropAddIEs(tpAniSirGlobal pMac, tANI_U8 **pDstData_buff,
 
     if ((0 == oui_length) || (NULL == ibss_ie)) {
         VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
-                  FL("Invalid set IBSS vendor IE comamnd length %d ibss_ie %p"),
+                  FL("Invalid set IBSS vendor IE comamnd length %d ibss_ie %pK"),
                   oui_length, ibss_ie);
         return FALSE;
     }
@@ -6758,8 +6844,17 @@ limUpdateIBssPropAddIEs(tpAniSirGlobal pMac, tANI_U8 **pDstData_buff,
         vos_mem_copy(vendor_ie, pModifyIE->pIEBuffer,
                      pModifyIE->ieBufferlength);
     } else {
-        uint16_t new_length = pModifyIE->ieBufferlength + *pDstDataLen;
-        uint8_t *new_ptr = vos_mem_malloc(new_length);
+	uint8_t *new_ptr;
+	uint16_t new_length;
+
+	if (USHRT_MAX - pModifyIE->ieBufferlength < *pDstDataLen) {
+			limLog(pMac,LOGE,FL("U16 overflow due to %d + %d"),
+				pModifyIE->ieBufferlength, *pDstDataLen);
+			return false;
+		}
+
+        new_length = pModifyIE->ieBufferlength + *pDstDataLen;
+        new_ptr = vos_mem_malloc(new_length);
 
         if (NULL == new_ptr) {
             limLog(pMac, LOGE, FL("Memory allocation failed."));
@@ -6856,7 +6951,7 @@ limProcessModifyAddIEs(tpAniSirGlobal pMac, tANI_U32 *pMsg)
         }
         else
         {
-            limLog(pMac, LOGE, FL("Invalid request pIEBuffer %p ieBufferlength"
+            limLog(pMac, LOGE, FL("Invalid request pIEBuffer %pK ieBufferlength"
                             " %d ieIDLen %d ieID %d. update Type %d"),
                             pModifyAddIEs->modifyIE.pIEBuffer,
                             pModifyAddIEs->modifyIE.ieBufferlength,
@@ -7133,6 +7228,21 @@ limProcessUpdateAddIEs(tpAniSirGlobal pMac, tANI_U32 *pMsg)
                 tANI_U16 new_length = pUpdateAddIEs->updateIE.ieBufferlength +
                                 psessionEntry->addIeParams.probeRespDataLen;
                 tANI_U8 *new_ptr = vos_mem_malloc(new_length);
+                /* Multiple back to back append commands
+                 * can lead to a huge length.So, check
+                 * for the validity of the length.
+                 */
+                if (psessionEntry->addIeParams.probeRespDataLen >
+                     (USHRT_MAX - pUpdateAddIEs->updateIE.ieBufferlength))
+                {
+                    limLog(pMac, LOGE,
+                           FL("IE Length overflow, curr:%d, new:%d."),
+                           psessionEntry->addIeParams.probeRespDataLen,
+                           pUpdateAddIEs->updateIE.ieBufferlength);
+                    vos_mem_free(pUpdateAddIEs->updateIE.pAdditionIEBuffer);
+                    pUpdateAddIEs->updateIE.pAdditionIEBuffer = NULL;
+                    return;
+                }
                 if (NULL == new_ptr)
                 {
                     limLog(pMac, LOGE, FL("Memory allocation failed."));
@@ -7221,6 +7331,7 @@ static void send_extended_chan_switch_action_frame(tpAniSirGlobal mac_ctx,
 	uint16_t op_class;
 	uint8_t switch_mode = 0, i;
 	tpDphHashNode psta;
+	uint8_t switch_count;
 
 
 	op_class = regdm_get_opclass_from_channel(
@@ -7230,10 +7341,13 @@ static void send_extended_chan_switch_action_frame(tpAniSirGlobal mac_ctx,
 
 	if (LIM_IS_AP_ROLE(session_entry) &&
 		(mac_ctx->sap.SapDfsInfo.disable_dfs_ch_switch == VOS_FALSE))
-		switch_mode = 1;
+	        switch_mode = session_entry->gLimChannelSwitch.switchMode;
+
+	switch_count = session_entry->gLimChannelSwitch.switchCount;
 
 	if (LIM_IS_AP_ROLE(session_entry)) {
-		for (i = 0; i < mac_ctx->lim.maxStation; i++) {
+		/* first node in hash table not used */
+		for (i = 0; i < (mac_ctx->lim.maxStation + 1); i++) {
 			psta =
 			  session_entry->dph.dphHashTable.pDphNodeArray + i;
 			if (psta && psta->added) {
@@ -7241,19 +7355,77 @@ static void send_extended_chan_switch_action_frame(tpAniSirGlobal mac_ctx,
 					mac_ctx,
 					psta->staAddr,
 					switch_mode, op_class, new_channel,
-					LIM_MAX_CSA_IE_UPDATES, session_entry);
+					switch_count, session_entry);
 			}
 		}
 	} else if (LIM_IS_STA_ROLE(session_entry)) {
 		lim_send_extended_chan_switch_action_frame(mac_ctx,
 					session_entry->bssId,
 					switch_mode, op_class, new_channel,
-					LIM_MAX_CSA_IE_UPDATES, session_entry);
+					switch_count, session_entry);
 	}
 
 }
 
 /**
+ * lim_send_chan_switch_action_frame()- Send an action frame
+ * containing CSA IE or ECSA IE depending on the connected
+ * sta capability.
+ *
+ * @mac_ctx: pointer to global mac structure
+ * @new_channel: new channel to switch to.
+ * @ch_bandwidth: BW of channel to calculate op_class
+ * @session_entry: pe session
+ *
+ * Return: void
+ */
+void lim_send_chan_switch_action_frame(tpAniSirGlobal mac_ctx,
+				       uint16_t new_channel,
+				       uint8_t ch_bandwidth,
+				       tpPESession session_entry)
+{
+	uint16_t op_class;
+	uint8_t switch_mode = 0, i;
+	uint8_t switch_count;
+	tpDphHashNode psta;
+	tpDphHashNode dph_node_array_ptr;
+
+	dph_node_array_ptr = session_entry->dph.dphHashTable.pDphNodeArray;
+
+	op_class = regdm_get_opclass_from_channel(
+			mac_ctx->scan.countryCodeCurrent,
+			new_channel, ch_bandwidth);
+
+	if (LIM_IS_AP_ROLE(session_entry) &&
+	    mac_ctx->sap.SapDfsInfo.disable_dfs_ch_switch == VOS_FALSE)
+		switch_mode = session_entry->gLimChannelSwitch.switchMode;
+
+	switch_count = session_entry->gLimChannelSwitch.switchCount;
+
+	if (LIM_IS_AP_ROLE(session_entry)) {
+		for (i = 0; i < mac_ctx->lim.maxStation; i++) {
+			psta = dph_node_array_ptr + i;
+			if (!(psta && psta->added))
+				continue;
+			if (session_entry->lim_non_ecsa_cap_num == 0)
+			    lim_send_extended_chan_switch_action_frame
+				(mac_ctx, psta->staAddr, switch_mode,
+				 op_class, new_channel, switch_count,
+				 session_entry);
+			else
+			    limSendChannelSwitchMgmtFrame
+				(mac_ctx, psta->staAddr, switch_mode,
+				 new_channel, switch_count,
+				 session_entry);
+		}
+	} else if (LIM_IS_STA_ROLE(session_entry)) {
+		lim_send_extended_chan_switch_action_frame
+			(mac_ctx, session_entry->bssId, switch_mode, op_class,
+			 new_channel, switch_count, session_entry);
+	}
+}
+
+/**
  * limProcessSmeDfsCsaIeRequest()
  *
  *FUNCTION:
@@ -7278,6 +7450,7 @@ limProcessSmeDfsCsaIeRequest(tpAniSirGlobal pMac, tANI_U32 *pMsg)
     tpPESession           psessionEntry = NULL;
     tANI_U32 chanWidth = 0;
     tANI_U8               sessionId;
+    uint8_t target_channel;
 
     if ( pMsg == NULL )
     {
@@ -7302,20 +7475,32 @@ limProcessSmeDfsCsaIeRequest(tpAniSirGlobal pMac, tANI_U32 *pMsg)
         return;
     }
 
+    target_channel = pDfsCsaIeRequest->targetChannel;
+
     if ( psessionEntry )
     {
         /* target channel */
-        psessionEntry->gLimChannelSwitch.primaryChannel =
-                                    pDfsCsaIeRequest->targetChannel;
+        psessionEntry->gLimChannelSwitch.primaryChannel = target_channel;
 
         /* Channel switch announcement needs to be included in beacon */
         psessionEntry->dfsIncludeChanSwIe = VOS_TRUE;
-        psessionEntry->gLimChannelSwitch.switchCount = LIM_MAX_CSA_IE_UPDATES;
-        if (pMac->sap.SapDfsInfo.disable_dfs_ch_switch == VOS_FALSE)
-            psessionEntry->gLimChannelSwitch.switchMode = 1;
+
+        psessionEntry->gLimChannelSwitch.switchCount =
+            pDfsCsaIeRequest->ch_switch_beacon_cnt;
+
+
+        if (pDfsCsaIeRequest->dfs_ch_switch_disable == VOS_FALSE)
+                psessionEntry->gLimChannelSwitch.switchMode =
+                    pDfsCsaIeRequest->ch_switch_mode;
+
+
         psessionEntry->gLimChannelSwitch.secondarySubBand =
                                          pDfsCsaIeRequest->ch_bandwidth;
 
+        /* Sub 20MHz channel width changing request */
+        psessionEntry->lim_sub20_channel_switch_bandwidth =
+                 pDfsCsaIeRequest->sub20_channelwidth;
+
         /* Validate if SAP is operating HT or VHT
          * mode and set the Channel Switch Wrapper
          * element with the Wide Band Switch
@@ -7381,10 +7566,10 @@ limProcessSmeDfsCsaIeRequest(tpAniSirGlobal pMac, tANI_U32 *pMsg)
              * Fetch the center channel based on the channel width
              */
             psessionEntry->gLimWiderBWChannelSwitch.newCenterChanFreq0 =
-                           limGetCenterChannel(pMac,
-                             pDfsCsaIeRequest->targetChannel,
-                             psessionEntry->htSecondaryChannelOffset,
-                             psessionEntry->gLimWiderBWChannelSwitch.newChanWidth);
+                    limGetCenterChannel(
+                        pMac, target_channel,
+                        psessionEntry->htSecondaryChannelOffset,
+                        psessionEntry->gLimWiderBWChannelSwitch.newChanWidth);
             /*
              * This is not applicable for 20/40/80 Mhz.
              * Only used when we support 80+80 Mhz
@@ -7411,11 +7596,23 @@ limProcessSmeDfsCsaIeRequest(tpAniSirGlobal pMac, tANI_U32 *pMsg)
         limLog(pMac, LOG1,
                    FL(" Updated CSA IE, IE COUNT = %d"),
                        psessionEntry->gLimChannelSwitch.switchCount );
-        /* Send ECSA Action frame after updating the beacon */
-        send_extended_chan_switch_action_frame(pMac,
-          psessionEntry->gLimChannelSwitch.primaryChannel,
-            psessionEntry->gLimChannelSwitch.secondarySubBand,
-                                                  psessionEntry);
+        /**
+         * Send Action frame after updating the beacon
+         * Action frame is not required if sub20 enabled
+         */
+        if (pDfsCsaIeRequest->sub20_switch_mode == 0) {
+            if (CHAN_HOP_ALL_BANDS_ENABLE)
+                lim_send_chan_switch_action_frame
+                    (pMac, psessionEntry->gLimChannelSwitch.primaryChannel,
+                     psessionEntry->gLimChannelSwitch.secondarySubBand,
+                     psessionEntry);
+            else
+                send_extended_chan_switch_action_frame
+                    (pMac, psessionEntry->gLimChannelSwitch.primaryChannel,
+                     psessionEntry->gLimChannelSwitch.secondarySubBand,
+                     psessionEntry);
+        }
+
         psessionEntry->gLimChannelSwitch.switchCount--;
     }
     return;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessTdls.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessTdls.c
index 1df76cfccd6..a3e6a93aaa0 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessTdls.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limProcessTdls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -548,7 +548,8 @@ tSirRetStatus limSendTdlsDisReqFrame(tpAniSirGlobal pMac, tSirMacAddr peer_mac,
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             lim_mgmt_tdls_tx_complete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                            HAL_USE_PEER_STA_REQUESTED_MASK,
                             smeSessionId, false );
     if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
     {
@@ -1180,7 +1181,8 @@ tSirRetStatus limSendTdlsLinkSetupReqFrame(tpAniSirGlobal pMac,
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             lim_mgmt_tdls_tx_complete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                            HAL_USE_PEER_STA_REQUESTED_MASK,
                             smeSessionId, true );
 #else
     halstatus = halTxFrameWithTxComplete( pMac, pPacket, ( tANI_U16 ) nBytes,
@@ -1189,7 +1191,8 @@ tSirRetStatus limSendTdlsLinkSetupReqFrame(tpAniSirGlobal pMac,
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             lim_mgmt_tdls_tx_complete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                            HAL_USE_PEER_STA_REQUESTED_MASK,
                             smeSessionId, false );
 #endif
     if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
@@ -1389,7 +1392,8 @@ tSirRetStatus limSendTdlsTeardownFrame(tpAniSirGlobal pMac,
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             lim_mgmt_tdls_tx_complete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                            HAL_USE_PEER_STA_REQUESTED_MASK,
                             smeSessionId,
                             (reason == eSIR_MAC_TDLS_TEARDOWN_PEER_UNREACHABLE) ? true : false );
 #else
@@ -1399,7 +1403,8 @@ tSirRetStatus limSendTdlsTeardownFrame(tpAniSirGlobal pMac,
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             lim_mgmt_tdls_tx_complete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                            HAL_USE_PEER_STA_REQUESTED_MASK,
                             smeSessionId,
                             false );
 #endif
@@ -1668,7 +1673,8 @@ static tSirRetStatus limSendTdlsSetupRspFrame(tpAniSirGlobal pMac,
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             lim_mgmt_tdls_tx_complete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                            HAL_USE_PEER_STA_REQUESTED_MASK,
                             smeSessionId, true );
 #else
     halstatus = halTxFrameWithTxComplete( pMac, pPacket, ( tANI_U16 ) nBytes,
@@ -1677,7 +1683,8 @@ static tSirRetStatus limSendTdlsSetupRspFrame(tpAniSirGlobal pMac,
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             lim_mgmt_tdls_tx_complete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                            HAL_USE_PEER_STA_REQUESTED_MASK,
                             smeSessionId, false );
 #endif
     if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
@@ -1899,7 +1906,8 @@ tSirRetStatus limSendTdlsLinkSetupCnfFrame(tpAniSirGlobal pMac,
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             lim_mgmt_tdls_tx_complete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                            HAL_USE_PEER_STA_REQUESTED_MASK,
                             smeSessionId, true );
 #else
     halstatus = halTxFrameWithTxComplete( pMac, pPacket, ( tANI_U16 ) nBytes,
@@ -1908,7 +1916,8 @@ tSirRetStatus limSendTdlsLinkSetupCnfFrame(tpAniSirGlobal pMac,
                             TID_AC_VI,
                             limTxComplete, pFrame,
                             lim_mgmt_tdls_tx_complete,
-                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
+                            HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME |
+                            HAL_USE_PEER_STA_REQUESTED_MASK,
                             smeSessionId, false );
 #endif
 
@@ -2318,8 +2327,6 @@ static void limTdlsUpdateHashNodeInfo(tpAniSirGlobal pMac, tDphHashNode *pStaDs,
     tDot11fIEVHTCaps vhtCap;
     tANI_U8 cbMode;
 #endif
-    tpDphHashNode pSessStaDs = NULL;
-    tANI_U16 aid;
 
     if (pTdlsAddStaReq->tdlsAddOper == TDLS_OPER_ADD)
     {
@@ -2403,22 +2410,21 @@ static void limTdlsUpdateHashNodeInfo(tpAniSirGlobal pMac, tDphHashNode *pStaDs,
         pStaDs->vhtSupportedChannelWidthSet = WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
     }
 #endif
-    /*Calculate the Secondary Coannel Offset */
-    cbMode = limSelectCBMode(pStaDs, psessionEntry,
-                             psessionEntry->currentOperChannel,
-                             pStaDs->vhtSupportedChannelWidthSet);
-
-    pStaDs->htSecondaryChannelOffset = cbMode;
+    /*
+     * Calculate the Secondary Channel Offset if our own channel bonding
+     * state is enabled
+     */
+    if (psessionEntry->htSupportedChannelWidthSet) {
+        cbMode = limSelectCBMode(pStaDs, psessionEntry,
+                                 psessionEntry->currentOperChannel,
+                                 pStaDs->vhtSupportedChannelWidthSet);
 
+        pStaDs->htSecondaryChannelOffset = cbMode;
 #ifdef WLAN_FEATURE_11AC
-    if ( pStaDs->mlmStaContext.vhtCapability )
-    {
-        pStaDs->htSecondaryChannelOffset = limGetHTCBState(cbMode);
-    }
+        if ( pStaDs->mlmStaContext.vhtCapability )
+            pStaDs->htSecondaryChannelOffset = limGetHTCBState(cbMode);
 #endif
-
-    pSessStaDs = dphLookupHashEntry(pMac, psessionEntry->bssId, &aid,
-                                          &psessionEntry->dph.dphHashTable) ;
+    }
 
     /* Lets enable QOS parameter */
     pStaDs->qosMode    = (pTdlsAddStaReq->capability & CAPABILITIES_QOS_OFFSET)
@@ -2806,8 +2812,7 @@ void PopulateDot11fTdlsExtCapability(tpAniSirGlobal pMac,
     p_ext_cap->TDLSProhibited = TDLS_PROHIBITED ;
 
     extCapability->present = 1 ;
-    /* For STA cases we alwasy support 11mc - Allow MAX length */
-    extCapability->num_bytes = DOT11F_IE_EXTCAP_MAX_LEN;
+    extCapability->num_bytes = lim_compute_ext_cap_ie_length(extCapability);
 
     return ;
 }
@@ -2960,10 +2965,14 @@ void limSendSmeTdlsLinkEstablishReqRsp(tpAniSirGlobal pMac,
         limLog(pMac, LOGE, FL("Failed to allocate memory"));
         return ;
     }
+
+    vos_mem_zero(pTdlsLinkEstablishReqRsp, sizeof(*pTdlsLinkEstablishReqRsp));
+
     pTdlsLinkEstablishReqRsp->statusCode = status ;
-    if ( peerMac )
+    if (pStaDs && peerMac)
     {
         vos_mem_copy(pTdlsLinkEstablishReqRsp->peerMac, peerMac, sizeof(tSirMacAddr));
+        pTdlsLinkEstablishReqRsp->sta_idx = pStaDs->staIndex;
     }
     pTdlsLinkEstablishReqRsp->sessionId = sessionId;
     mmhMsg.type = eWNI_SME_TDLS_LINK_ESTABLISH_RSP ;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limPropExtsUtils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limPropExtsUtils.c
index 752c1fc81d8..06e859ab479 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limPropExtsUtils.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limPropExtsUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,7 +39,7 @@
  *
  */
 #include "aniGlobal.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "sirCommon.h"
 #include "sirDebug.h"
 #include "utilsApi.h"
@@ -212,10 +212,10 @@ limExtractApCapability(tpAniSirGlobal pMac, tANI_U8 *pIE, tANI_U16 ieLen,
              * adapt to it. Hence there is else condition check
              * for this if statement.
              */
-            if ( pBeaconStruct->eseTxPwr.present)
+            if (pBeaconStruct->eseTxPwr.present)
                  *localConstraint = pBeaconStruct->eseTxPwr.power_limit;
 
-                 psessionEntry->is_ese_version_ie_present =
+            psessionEntry->is_ese_version_ie_present =
                               pBeaconStruct->is_ese_ver_ie_present;
 #endif
             }
@@ -234,6 +234,15 @@ limExtractApCapability(tpAniSirGlobal pMac, tANI_U8 *pIE, tANI_U16 ieLen,
     /* Check if Extended caps are present in probe resp or not */
     if (pBeaconStruct->ExtCap.present)
         psessionEntry->is_ext_caps_present = true;
+
+    if (pBeaconStruct->vendor_sub20_capability != 0)
+        psessionEntry->sap_sub20_channelwidth =
+                       pBeaconStruct->vendor_sub20_capability;
+
+    /* Update HS 2.0 Information Element */
+    sir_copy_hs20_ie(&psessionEntry->hs20vendor_ie,
+                     &pBeaconStruct->hs20vendor_ie);
+
     vos_mem_free(pBeaconStruct);
     return;
 } /****** end limExtractApCapability() ******/
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limRoamingAlgo.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limRoamingAlgo.c
index b44504681ce..995ef7966c9 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limRoamingAlgo.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limRoamingAlgo.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -37,7 +37,7 @@
  *
  */
 
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "cfgApi.h"
 #include "limTypes.h"
 #include "limTimerUtils.h"
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limScanResultUtils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limScanResultUtils.c
index 772f2ed4dd0..a5146ae1fb3 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limScanResultUtils.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limScanResultUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -48,6 +48,44 @@
 #endif
 #include "vos_utils.h"
 
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * lim_update_bss_with_fils_data: update fils data to bss descriptor
+ * if available in probe/beacon.
+ * @pr: probe response/beacon
+ * @bss_descr: pointer to bss descriptor
+ *
+ * @Return: None
+ */
+static void lim_update_bss_with_fils_data(tpSirProbeRespBeacon pr,
+                tSirBssDescription *bss_descr)
+{
+    if (!pr->fils_ind.is_present)
+        return;
+
+    if (pr->fils_ind.realm_identifier.realm_cnt > SIR_MAX_REALM_COUNT)
+        pr->fils_ind.realm_identifier.realm_cnt = SIR_MAX_REALM_COUNT;
+
+    bss_descr->fils_info_element.realm_cnt =
+        pr->fils_ind.realm_identifier.realm_cnt;
+    vos_mem_copy(bss_descr->fils_info_element.realm,
+        pr->fils_ind.realm_identifier.realm,
+        bss_descr->fils_info_element.realm_cnt * SIR_REALM_LEN);
+    if (pr->fils_ind.cache_identifier.is_present) {
+        bss_descr->fils_info_element.is_cache_id_present = true;
+        vos_mem_copy(bss_descr->fils_info_element.cache_id,
+            pr->fils_ind.cache_identifier.identifier, CACHE_ID_LEN);
+    }
+    if (pr->fils_ind.is_fils_sk_auth_supported)
+        bss_descr->fils_info_element.is_fils_sk_supported = true;
+}
+#else
+static inline void lim_update_bss_with_fils_data(tpSirProbeRespBeacon pr,
+                tSirBssDescription *bss_descr)
+{
+}
+#endif
+
 /**
  * limDeactiveMinChannelTimerDuringScan()
  *
@@ -96,7 +134,58 @@ limDeactivateMinChannelTimerDuringScan(tpAniSirGlobal pMac)
     return eSIR_SUCCESS;
 } /*** end limDeactivateMinChannelTimerDuringScan() ***/
 
+/**
+ * lim_check_and_change_cc: indicate upper layer country code changed
+ * @mac_ptr: Pointer to Global MAC structure
+ * @beacon_ptr: pointer to beacon
+ * @session_ptr: pointer to session
+ *
+ * @Return: None
+ */
+void
+lim_check_and_change_cc(tpAniSirGlobal mac_ptr,
+			tpSirProbeRespBeacon beacon_ptr,
+			tpPESession session_ptr)
+{
 
+	tSirMsgQ  mmh_msg;
+	tANI_U16  msg_len = 0;
+	struct sme_change_country_code_ind *change_cc_ind_ptr = NULL;
+	v_BOOL_t country_code_not_changed;
+
+	limLog(mac_ptr, LOG1, FL("enter new cc %c%c  old cc: %c%c"),
+	       beacon_ptr->countryInfoParam.countryString[0],
+	       beacon_ptr->countryInfoParam.countryString[1],
+	       mac_ptr->scan.countryCodeCurrent[0],
+	       mac_ptr->scan.countryCodeCurrent[1]);
+
+	country_code_not_changed =
+		vos_mem_compare(beacon_ptr->countryInfoParam.countryString,
+				mac_ptr->scan.countryCodeCurrent,
+				VOS_COUNTRY_CODE_LEN);
+	if (FALSE == country_code_not_changed) {
+		msg_len = sizeof(*change_cc_ind_ptr);
+		change_cc_ind_ptr = vos_mem_malloc(msg_len);
+		if (NULL == change_cc_ind_ptr) {
+			limLog(mac_ptr, LOGE, FL("Mem alloc failed"));
+			return;
+		}
+
+		change_cc_ind_ptr->message_type = eWNI_SME_CC_CHANGE_IND;
+		change_cc_ind_ptr->msg_len = msg_len;
+		change_cc_ind_ptr->session_id = session_ptr->smeSessionId;
+		memcpy(change_cc_ind_ptr->country_code,
+		       beacon_ptr->countryInfoParam.countryString,
+		       VOS_COUNTRY_CODE_LEN);
+
+		mmh_msg.type = eWNI_SME_CC_CHANGE_IND;
+		mmh_msg.bodyptr = change_cc_ind_ptr;
+		mmh_msg.bodyval = 0;
+		limSysProcessMmhMsgApi(mac_ptr, &mmh_msg, ePROT);
+
+		return;
+	}
+}
 
 /**
  * limCollectBssDescription()
@@ -179,7 +268,7 @@ limCollectBssDescription(tpAniSirGlobal pMac,
                   sizeof(tSirMacAddr));
 
     // Copy Timestamp, Beacon Interval and Capability Info
-    pBssDescr->scanSysTimeMsec = vos_timer_get_system_time();
+    pBssDescr->scansystimensec = vos_get_bootbased_boottime_ns();
 
     pBssDescr->timeStamp[0]   = pBPR->timeStamp[0];
     pBssDescr->timeStamp[1]   = pBPR->timeStamp[1];
@@ -283,6 +372,9 @@ limCollectBssDescription(tpAniSirGlobal pMac,
         pBssDescr->QBSSLoad_avail = pBPR->QBSSLoad.avail;
     }
 #endif
+#ifdef WLAN_FEATURE_FILS_SK
+    lim_update_bss_with_fils_data(pBPR, pBssDescr);
+#endif
     // Copy IE fields
     vos_mem_copy((tANI_U8 *) &pBssDescr->ieFields,
                   pBody + SIR_MAC_B_PR_SSID_OFFSET,
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limScanResultUtils.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limScanResultUtils.h
index 4d06b9bd8af..cbf08f1c45f 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limScanResultUtils.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limScanResultUtils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -61,6 +61,10 @@ void    limReInitLfrScanResults(tpAniSirGlobal);
 #endif
 tANI_U32 limDeactivateMinChannelTimerDuringScan(tpAniSirGlobal);
 void    limCheckAndAddBssDescription(tpAniSirGlobal, tpSirProbeRespBeacon, tANI_U8 *, tANI_BOOLEAN, tANI_U8);
+void lim_check_and_change_cc(tpAniSirGlobal mac_ptr,
+			     tpSirProbeRespBeacon beacon_ptr,
+			     tpPESession session_ptr);
+
 #if defined WLAN_FEATURE_VOWIFI
 void    limCollectBssDescription(tpAniSirGlobal,
                                  tSirBssDescription *,
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSecurityUtils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSecurityUtils.c
index 049c86aa55f..67fa19865fb 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSecurityUtils.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSecurityUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,7 +40,7 @@
 #include "wniApi.h"
 
 #include "sirCommon.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "cfgApi.h"
 
 
@@ -416,7 +416,7 @@ limDeletePreAuthNode(tpAniSirGlobal pMac, tSirMacAddr macAddr)
 
 
         PELOG1(limLog(pMac, LOG1, FL("=====> limDeletePreAuthNode : first node to delete"));)
-        PELOG1(limLog(pMac, LOG1, FL("Release data entry: %p id %d peer "),
+        PELOG1(limLog(pMac, LOG1, FL("Release data entry: %pK id %d peer "),
                         pTempNode, pTempNode->authNodeIdx);
         limPrintMacAddr(pMac, macAddr, LOG1);)
         limReleasePreAuthNode(pMac, pTempNode);
@@ -437,7 +437,7 @@ limDeletePreAuthNode(tpAniSirGlobal pMac, tSirMacAddr macAddr)
             pPrevNode->next = pTempNode->next;
 
             PELOG1(limLog(pMac, LOG1, FL("=====> limDeletePreAuthNode : subsequent node to delete"));
-            limLog(pMac, LOG1, FL("Release data entry: %p id %d peer "),
+            limLog(pMac, LOG1, FL("Release data entry: %pK id %d peer "),
                          pTempNode, pTempNode->authNodeIdx);
             limPrintMacAddr(pMac, macAddr, LOG1);)
             limReleasePreAuthNode(pMac, pTempNode);
@@ -456,10 +456,6 @@ limDeletePreAuthNode(tpAniSirGlobal pMac, tSirMacAddr macAddr)
 
 } /*** end limDeletePreAuthNode() ***/
 
-
-
-
-
 /**
  * limRestoreFromPreAuthState
  *
@@ -504,13 +500,6 @@ limRestoreFromAuthState(tpAniSirGlobal pMac, tSirResultCodes resultCode, tANI_U1
     /* Update PE session ID*/
     mlmAuthCnf.sessionId = sessionEntry->peSessionId;
 
-    /// Free up buffer allocated
-    /// for pMac->lim.gLimMlmAuthReq
-    vos_mem_free(pMac->lim.gpLimMlmAuthReq);
-    pMac->lim.gpLimMlmAuthReq = NULL;
-
-    sessionEntry->limMlmState = sessionEntry->limPrevMlmState;
-
     MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, sessionEntry->peSessionId, sessionEntry->limMlmState));
     /* Set the authAckStatus status flag as sucess as
      * host have received the auth rsp and no longer auth
@@ -529,13 +518,27 @@ limRestoreFromAuthState(tpAniSirGlobal pMac, tSirResultCodes resultCode, tANI_U1
         pMac->lim.gLimPreAuthChannelNumber = 0;
     }
 
-    limPostSmeMessage(pMac,
+    if ((protStatusCode == eSIR_MAC_MAX_ASSOC_STA_REACHED_STATUS)
+             && (sessionEntry->sta_auth_retries_for_code17 <
+                            pMac->sta_auth_retries_for_code17)) {
+        limLog(pMac, LOG1, FL("Retry Auth "));
+        limDoSendAuthMgmtFrame(pMac, sessionEntry);
+        sessionEntry->sta_auth_retries_for_code17++;
+    } else {
+        /// Free up buffer allocated
+        /// for pMac->lim.gLimMlmAuthReq
+        vos_mem_free(pMac->lim.gpLimMlmAuthReq);
+        pMac->lim.gpLimMlmAuthReq = NULL;
+
+        sessionEntry->limMlmState = sessionEntry->limPrevMlmState;
+
+        limPostSmeMessage(pMac,
                       LIM_MLM_AUTH_CNF,
                       (tANI_U32 *) &mlmAuthCnf);
+        sessionEntry->sta_auth_retries_for_code17 = 0;
+    }
 } /*** end limRestoreFromAuthState() ***/
 
-
-
 /**
  * limLookUpKeyMappings()
  *
@@ -595,7 +598,10 @@ limEncryptAuthFrame(tpAniSirGlobal pMac, tANI_U8 keyId, tANI_U8 *pKey, tANI_U8 *
                     tANI_U8 *pEncrBody, tANI_U32 keyLength)
 {
     tANI_U8  seed[LIM_SEED_LENGTH], icv[SIR_MAC_WEP_ICV_LENGTH];
+    tANI_U16 framelen;
 
+    framelen = ((tpSirMacAuthFrameBody)pPlainText)->length +
+                 SIR_MAC_AUTH_FRAME_INFO_LEN + SIR_MAC_CHALLENGE_ID_LEN;
     keyLength += 3;
 
     // Bytes 0-2 of seed is IV
@@ -606,15 +612,15 @@ limEncryptAuthFrame(tpAniSirGlobal pMac, tANI_U8 keyId, tANI_U8 *pKey, tANI_U8 *
     vos_mem_copy((tANI_U8 *) &seed[3], pKey, keyLength - 3);
 
     // Compute CRC-32 and place them in last 4 bytes of plain text
-    limComputeCrc32(icv, pPlainText, sizeof(tSirMacAuthFrameBody));
+    limComputeCrc32(icv, pPlainText, framelen);
 
-    vos_mem_copy( pPlainText + sizeof(tSirMacAuthFrameBody),
+    vos_mem_copy((pPlainText + framelen),
                   icv, SIR_MAC_WEP_ICV_LENGTH);
 
     // Run RC4 on plain text with the seed
     limRC4(pEncrBody + SIR_MAC_WEP_IV_LENGTH,
            (tANI_U8 *) pPlainText, seed, keyLength,
-           LIM_ENCR_AUTH_BODY_LEN - SIR_MAC_WEP_IV_LENGTH);
+           framelen + SIR_MAC_WEP_IV_LENGTH);
 
     // Prepare IV
     pEncrBody[0] = seed[0];
@@ -734,7 +740,7 @@ limRC4(tANI_U8 *pDest, tANI_U8 *pSrc, tANI_U8 *seed, tANI_U32 keyLength, tANI_U1
     {
         tANI_U8 i   = ctx.i;
         tANI_U8 j   = ctx.j;
-        tANI_U8 len = (tANI_U8) frameLen;
+        tANI_U16 len = frameLen;
 
         while (len-- > 0)
         {
@@ -816,7 +822,7 @@ limDecryptAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pKey, tANI_U8 *pEncrBody,
     // Compute CRC-32 and place them in last 4 bytes of encrypted body
     limComputeCrc32(icv,
                     (tANI_U8 *) pPlainBody,
-                    (tANI_U8) (frameLen - SIR_MAC_WEP_ICV_LENGTH));
+                    (frameLen - SIR_MAC_WEP_ICV_LENGTH));
 
     // Compare RX_ICV with computed ICV
     for (i = 0; i < SIR_MAC_WEP_ICV_LENGTH; i++)
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSecurityUtils.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSecurityUtils.h
index 9139ce20f3b..4591343abab 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSecurityUtils.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSecurityUtils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015, 2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -42,6 +42,17 @@
 #define LIM_ENCR_AUTH_BODY_LEN  (sizeof(tSirMacAuthFrameBody) + \
                                 SIR_MAC_WEP_IV_LENGTH + \
                                 SIR_MAC_WEP_ICV_LENGTH)
+
+#define LIM_ENCR_AUTH_INFO_LEN  (SIR_MAC_AUTH_FRAME_INFO_LEN +\
+                                 SIR_MAC_WEP_IV_LENGTH + \
+                                 SIR_MAC_WEP_ICV_LENGTH + \
+                                 SIR_MAC_CHALLENGE_ID_LEN)
+
+#define LIM_ENCR_AUTH_BODY_LEN_SAP  (SIR_MAC_SAP_AUTH_CHALLENGE_LENGTH + \
+                                     SIR_MAC_CHALLENGE_ID_LEN + \
+                                     SIR_MAC_AUTH_FRAME_INFO_LEN + \
+                                     SIR_MAC_WEP_IV_LENGTH + \
+                                     SIR_MAC_WEP_ICV_LENGTH)
 struct tLimPreAuthNode;
 
 tANI_U8        limIsAuthAlgoSupported(tpAniSirGlobal, tAniAuthType, tpPESession);
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index c0ede03c564..ebba5232da7 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -50,9 +50,9 @@
 #include "limAssocUtils.h"
 #include "limFT.h"
 #ifdef WLAN_FEATURE_11W
-#include "wniCfgAp.h"
+#include "wni_cfg.h"
 #endif
-
+#include<crypto/aes.h>
 #ifdef WLAN_FEATURE_VOWIFI_11R
 #include "limFTDefs.h"
 #endif
@@ -64,9 +64,9 @@
 #if defined WLAN_FEATURE_VOWIFI
 #include "rrmApi.h"
 #endif
-
+#include "qdf_crypto.h"
 #include "wlan_qct_wda.h"
-
+#include "lim_process_fils.h"
 
 ////////////////////////////////////////////////////////////////////////
 /**
@@ -380,23 +380,6 @@ limSendProbeReqMgmtFrame(tpAniSirGlobal pMac,
        limLog(pMac, LOGE,
               FL("session entry null, ext capabilities will not be populated"));
 
-    // That's it-- now we pack it.  First, how much space are we going to
-    // need?
-    nStatus = dot11fGetPackedProbeRequestSize( pMac, &pr, &nPayload );
-    if ( DOT11F_FAILED( nStatus ) )
-    {
-        limLog( pMac, LOGP, FL("Failed to calculate the packed size f"
-                               "or a Probe Request (0x%08x)."), nStatus );
-        // We'll fall back on the worst case scenario:
-        nPayload = sizeof( tDot11fProbeRequest );
-    }
-    else if ( DOT11F_WARNED( nStatus ) )
-    {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
-                               "the packed size for a Probe Request ("
-                               "0x%08x)."), nStatus );
-    }
-
     if (addn_ielen) {
 
         vos_mem_set((tANI_U8 *)&extracted_ext_cap,
@@ -413,11 +396,36 @@ limSendProbeReqMgmtFrame(tpAniSirGlobal pMac,
             if (p_ext_cap->interworkingService)
                 p_ext_cap->qosMap = 1;
 
-            extracted_ext_cap_flag = lim_is_ext_cap_ie_present(p_ext_cap);
+            extracted_ext_cap.num_bytes =
+                    lim_compute_ext_cap_ie_length(&extracted_ext_cap);
+            extracted_ext_cap_flag = (extracted_ext_cap.num_bytes > 0);
         }
     }
+    /* merge the ExtCap struct */
+    if (extracted_ext_cap_flag)
+        lim_merge_extcap_struct(&pr.ExtCap, &extracted_ext_cap, true);
+
+    /*
+     * That's it-- now we pack it.
+     * First, how much space are we going to need?
+     */
+    nStatus = dot11fGetPackedProbeRequestSize(pMac, &pr, &nPayload);
+    if (DOT11F_FAILED(nStatus))
+    {
+        limLog(pMac, LOGE,
+             FL("Failed to calculate the packed size for a Probe Request (0x%08x)."),
+             nStatus);
+        /* We'll fall back on the worst case scenario: */
+        nPayload = sizeof(tDot11fProbeRequest);
+    }
+    else if (DOT11F_WARNED(nStatus))
+    {
+        limLog(pMac, LOGW,
+             FL("There were warnings while calculating the packed size for a Probe Request (0x%08x)."),
+             nStatus);
+    }
 
-    nBytes = nPayload + sizeof( tSirMacMgmtHdr ) + addn_ielen;
+    nBytes = nPayload + sizeof(tSirMacMgmtHdr) + addn_ielen;
 
     // Ok-- try to allocate some memory:
     halstatus = palPktAlloc( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
@@ -446,10 +454,6 @@ limSendProbeReqMgmtFrame(tpAniSirGlobal pMac,
         return nSirStatus;      // allocated!
     }
 
-    /* merge the ExtCap struct*/
-    if (extracted_ext_cap_flag)
-        lim_merge_extcap_struct(&pr.ExtCap, &extracted_ext_cap);
-
     // That done, pack the Probe Request:
     nStatus = dot11fPackProbeRequest( pMac, &pr, pFrame +
                                       sizeof( tSirMacMgmtHdr ),
@@ -575,7 +579,7 @@ limSendProbeRspMgmtFrame(tpAniSirGlobal pMac,
 {
     tDot11fProbeResponse *pFrm;
     tSirRetStatus        nSirStatus;
-    tANI_U32             cfg, nPayload, nBytes, nStatus;
+    tANI_U32             cfg, nPayload, nBytes = 0, nStatus;
     tpSirMacMgmtHdr      pMacHdr;
     tANI_U8             *pFrame;
     void                *pPacket;
@@ -741,25 +745,6 @@ limSendProbeRspMgmtFrame(tpAniSirGlobal pMac,
 #endif // defined(FEATURE_WLAN_WAPI)
 
 
-    nStatus = dot11fGetPackedProbeResponseSize( pMac, pFrm, &nPayload );
-    if ( DOT11F_FAILED( nStatus ) )
-    {
-        limLog( pMac, LOGP, FL("Failed to calculate the packed size f"
-                               "or a Probe Response (0x%08x)."),
-                nStatus );
-        // We'll fall back on the worst case scenario:
-        nPayload = sizeof( tDot11fProbeResponse );
-    }
-    else if ( DOT11F_WARNED( nStatus ) )
-    {
-        limLog( pMac, LOGW, FL("There were warnings while calculating"
-                               "the packed size for a Probe Response "
-                               "(0x%08x)."), nStatus );
-    }
-
-    nBytes = nPayload + sizeof( tSirMacMgmtHdr );
-
-
     if( pMac->lim.gpLimRemainOnChanReq )
     {
         nBytes += (pMac->lim.gpLimRemainOnChanReq->length - sizeof( tSirRemainOnChnReq ) );
@@ -827,6 +812,29 @@ limSendProbeRspMgmtFrame(tpAniSirGlobal pMac,
             }
         }
     }
+    /* merge ExtCap IE */
+    if (extractedExtCapFlag)
+    {
+        lim_merge_extcap_struct(&pFrm->ExtCap, &extractedExtCap, true);
+    }
+
+    nStatus = dot11fGetPackedProbeResponseSize(pMac, pFrm, &nPayload);
+    if (DOT11F_FAILED(nStatus))
+    {
+        limLog(pMac, LOGE,
+             FL("Failed to calculate the packed size for a Probe Response (0x%08x)."),
+             nStatus);
+        /* We'll fall back on the worst case scenario: */
+        nPayload = sizeof(tDot11fProbeResponse);
+    }
+    else if (DOT11F_WARNED(nStatus))
+    {
+        limLog(pMac, LOGW,
+             FL("There were warnings while calculating the packed size for a Probe Response (0x%08x)."),
+             nStatus);
+    }
+
+    nBytes += nPayload + sizeof(tSirMacMgmtHdr);
 
     halstatus = palPktAlloc( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
                              ( tANI_U16 )nBytes, ( void** ) &pFrame,
@@ -868,11 +876,6 @@ limSendProbeRspMgmtFrame(tpAniSirGlobal pMac,
 
     sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
 
-    /*merge ExtCap IE*/
-    if (extractedExtCapFlag)
-    {
-        lim_merge_extcap_struct(&pFrm->ExtCap, &extractedExtCap);
-    }
     // That done, pack the Probe Response:
     nStatus = dot11fPackProbeResponse( pMac, pFrm, pFrame + sizeof(tSirMacMgmtHdr),
                                        nPayload, &nPayload );
@@ -1224,7 +1227,7 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
     tSirRetStatus        nSirStatus;
     tANI_U8              lleMode = 0, fAddTS;
     tHalBitVal           qosMode, wmeMode;
-    tANI_U32             nPayload, nBytes, nStatus;
+    tANI_U32             nPayload = 0, nBytes = 0, nStatus;
     void                *pPacket;
     eHalStatus           halstatus;
     tUpdateBeaconParams beaconParams;
@@ -1389,6 +1392,9 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
     if (LIM_IS_AP_ROLE(psessionEntry)) {
         if(psessionEntry->gLimProtectionControl != WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
         limDecideApProtection(pMac, peerMacAddr, &beaconParams,psessionEntry);
+
+        if (NULL != pSta && pSta->non_ecsa_capable)
+                psessionEntry->lim_non_ecsa_cap_num++;
     }
 
     limUpdateShortPreamble(pMac, peerMacAddr, &beaconParams, psessionEntry);
@@ -1408,24 +1414,11 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
         limSendBeaconParams(pMac, &beaconParams, psessionEntry );
     }
 
-    // Allocate a buffer for this frame:
-    nStatus = dot11fGetPackedAssocResponseSize( pMac, &frm, &nPayload );
-    if ( DOT11F_FAILED( nStatus ) )
-    {
-        limLog( pMac, LOGE, FL("Failed to calculate the packed size f"
-                               "or an Association Response (0x%08x)."),
-                nStatus );
-        return;
-    }
-    else if ( DOT11F_WARNED( nStatus ) )
-    {
-        limLog( pMac, LOGW, FL("There were warnings while calculating "
-                               "the packed size for an Association Re"
-                               "sponse (0x%08x)."), nStatus );
-    }
-
-    nBytes = sizeof( tSirMacMgmtHdr ) + nPayload;
+    if (NULL != pSta && pSta->sub20_dynamic_channelwidth != 0)
+            populate_dot11f_sub_20_channel_width_ie(
+                pMac, &frm.QComVendorIE, psessionEntry);
 
+    // Allocate a buffer for this frame:
     if ( pAssocReq != NULL )
     {
         addnIEPresent = (psessionEntry->addIeParams.assocRespDataLen != 0);
@@ -1473,6 +1466,29 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
                                 addnIEPresent, pAssocReq->addIEPresent);
         }
     }
+    /* merge the ExtCap struct */
+    if (extractedExtCapFlag)
+    {
+        lim_merge_extcap_struct(&(frm.ExtCap), &extractedExtCap, true);
+    }
+
+    nStatus = dot11fGetPackedAssocResponseSize(pMac, &frm, &nPayload);
+    if (DOT11F_FAILED(nStatus))
+    {
+        limLog(pMac, LOGE,
+             FL("Failed to calculate the packed size for an Association Response (0x%08x)."),
+             nStatus);
+        return;
+    }
+    else if (DOT11F_WARNED(nStatus))
+    {
+        limLog(pMac, LOGW,
+             FL("There were warnings while calculating the packed size for an Association Response (0x%08x)."),
+             nStatus);
+    }
+
+    nBytes += sizeof(tSirMacMgmtHdr) + nPayload;
+
     halstatus = palPktAlloc( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
                              ( tANI_U16 )nBytes, ( void** ) &pFrame,
                              ( void** ) &pPacket );
@@ -1507,11 +1523,6 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
 
     sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
 
-    /* merge the ExtCap struct*/
-    if (extractedExtCapFlag)
-    {
-        lim_merge_extcap_struct(&(frm.ExtCap), &extractedExtCap);
-    }
     nStatus = dot11fPackAssocResponse( pMac, &frm,
                                        pFrame + sizeof( tSirMacMgmtHdr ),
                                        nPayload, &nPayload );
@@ -2039,7 +2050,7 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
     tANI_U8            *pFrame;
     tSirRetStatus       nSirStatus;
     tLimMlmAssocCnf     mlmAssocCnf;
-    tANI_U32            nBytes, nPayload, nStatus;
+    tANI_U32            nBytes = 0, nPayload, nStatus;
     tANI_U8             fQosEnabled, fWmeEnabled, fWsmEnabled;
     void               *pPacket;
     eHalStatus          halstatus;
@@ -2055,6 +2066,13 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
     tDot11fIEExtCap     extractedExtCap;
     tANI_BOOLEAN        extractedExtCapFlag = eANI_BOOLEAN_TRUE;
     tpSirMacMgmtHdr     pMacHdr;
+    tDot11fIEExtCap     ap_extcap;
+    tANI_U8            *ap_extcap_ptr = NULL;
+    tANI_U8            *pIe = NULL;
+    tANI_U32            ieLen = 0;
+    tANI_U32            fixed_param_len = 0;
+    VOS_STATUS          vos_status;
+    tANI_U32            aes_block_size_len = 0;
 
     if(NULL == psessionEntry)
     {
@@ -2100,7 +2118,10 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
                                           extractedExtCap.bytes;
             if (p_ext_cap->interworkingService)
                 p_ext_cap->qosMap = 1;
-            extractedExtCapFlag = lim_is_ext_cap_ie_present(p_ext_cap);
+
+            extractedExtCap.num_bytes =
+                    lim_compute_ext_cap_ie_length(&extractedExtCap);
+            extractedExtCapFlag = (extractedExtCap.num_bytes > 0);
         }
     } else {
         limLog(pMac, LOG1,
@@ -2305,24 +2326,60 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
 #endif
     }
 #endif
+    /* merge the ExtCap struct */
+    if (extractedExtCapFlag)
+    {
+        lim_merge_extcap_struct(&pFrm->ExtCap, &extractedExtCap, true);
+    }
 
-    nStatus = dot11fGetPackedAssocRequestSize( pMac, pFrm, &nPayload );
-    if ( DOT11F_FAILED( nStatus ) )
+    /* Clear the bits in EXTCAP IE if AP not advertise it in beacon */
+    if (pFrm->ExtCap.present && psessionEntry->is_ext_caps_present)
     {
-        limLog( pMac, LOGP, FL("Failed to calculate the packed size f"
-                    "or an Association Request (0x%08x)."),
-                nStatus );
-        // We'll fall back on the worst case scenario:
-        nPayload = sizeof( tDot11fAssocRequest );
+        fixed_param_len = DOT11F_FF_TIMESTAMP_LEN +
+                          DOT11F_FF_BEACONINTERVAL_LEN +
+                          DOT11F_FF_CAPABILITIES_LEN;
+        vos_mem_zero((tANI_U8*)&ap_extcap, sizeof(tDot11fIEExtCap));
+        if (psessionEntry->beacon && psessionEntry->bcnLen > fixed_param_len)
+        {
+            pIe = psessionEntry->beacon + fixed_param_len;
+            ieLen = psessionEntry->bcnLen - fixed_param_len;
+
+            /* Extract EXTCAP IE from beacon frame */
+            ap_extcap_ptr = lim_get_ie_ptr(pIe, ieLen, DOT11F_EID_EXTCAP);
+            lim_update_extcap_struct(pMac, ap_extcap_ptr, &ap_extcap);
+
+            /* Clear the bits if AP not advertise it in beacon */
+            lim_merge_extcap_struct(&pFrm->ExtCap, &ap_extcap, false);
+        }
     }
-    else if ( DOT11F_WARNED( nStatus ) )
+
+    populate_dot11f_sub_20_channel_width_ie(pMac,
+                                            &pFrm->QComVendorIE,
+                                            psessionEntry);
+
+    if (lim_is_fils_connection(psessionEntry)) {
+        populate_dot11f_fils_params(pMac, pFrm, psessionEntry);
+        aes_block_size_len = AES_BLOCK_SIZE;
+    }
+
+    nStatus = dot11fGetPackedAssocRequestSize(pMac, pFrm, &nPayload);
+    if (DOT11F_FAILED(nStatus))
     {
-        limLog( pMac, LOGW, FL("There were warnings while calculating "
-                    "the packed size for an Association Re "
-                    "quest(0x%08x)."), nStatus );
+        limLog(pMac, LOGE,
+             FL("Failed to calculate the packed size for an Association Request (0x%08x)."),
+             nStatus);
+        /* We'll fall back on the worst case scenario: */
+        nPayload = sizeof(tDot11fAssocRequest);
+    }
+    else if (DOT11F_WARNED(nStatus))
+    {
+        limLog(pMac, LOGW,
+             FL("There were warnings while calculating the packed size for an Association Request(0x%08x)."),
+             nStatus);
     }
 
-    nBytes = nPayload + sizeof( tSirMacMgmtHdr ) + nAddIELen;
+    nBytes = nPayload + sizeof(tSirMacMgmtHdr) 
+                      + nAddIELen + aes_block_size_len;
 
     halstatus = palPktAlloc( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
             ( tANI_U16 )nBytes, ( void** ) &pFrame,
@@ -2367,12 +2424,6 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
         vos_mem_free(pFrm);
         return;
     }
-    /* merge the ExtCap struct*/
-    if (extractedExtCapFlag)
-    {
-        lim_merge_extcap_struct(&pFrm->ExtCap, &extractedExtCap);
-    }
-
     // That done, pack the Assoc Request:
     nStatus = dot11fPackAssocRequest( pMac, pFrm, pFrame +
             sizeof(tSirMacMgmtHdr),
@@ -2401,7 +2452,6 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
         psessionEntry->assocReq = NULL;
         psessionEntry->assocReqLen = 0;
     }
-
     if( nAddIELen )
     {
         vos_mem_copy( pFrame + sizeof(tSirMacMgmtHdr) + nPayload,
@@ -2410,6 +2460,20 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
         nPayload += nAddIELen;
     }
 
+    if (lim_is_fils_connection(psessionEntry)) {
+        vos_status = aead_encrypt_assoc_req(pMac, psessionEntry,
+                                            pFrame, &nPayload);
+        if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+            limDiagEventReport(pMac,
+                        WLAN_PE_DIAG_ASSOC_IND_EVENT,
+                        psessionEntry, eSIR_FAILURE, eSIR_FAILURE);
+            palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
+                        ( void* ) pFrame, ( void* ) pPacket );
+            vos_mem_free(pFrm);
+            return;
+        }
+    }
+
     psessionEntry->assocReq = vos_mem_malloc(nPayload);
     if ( NULL == psessionEntry->assocReq )
     {
@@ -2957,6 +3021,16 @@ void limSendRetryReassocReqFrame(tpAniSirGlobal     pMac,
 {
     tLimMlmReassocCnf       mlmReassocCnf; // keep sme
     tLimMlmReassocReq       *pTmpMlmReassocReq = NULL;
+#ifdef FEATURE_WLAN_ESE
+    tANI_U32                val=0;
+#endif
+    if (pMlmReassocReq == NULL)
+    {
+	    limLog(pMac, LOGE,
+			    FL("Invalid pMlmReassocReq"));
+	    goto end;
+    }
+
     if(NULL == pTmpMlmReassocReq)
     {
         pTmpMlmReassocReq = vos_mem_malloc(sizeof(tLimMlmReassocReq));
@@ -2967,6 +3041,31 @@ void limSendRetryReassocReqFrame(tpAniSirGlobal     pMac,
 
     // Prepare and send Reassociation request frame
     // start reassoc timer.
+#ifdef FEATURE_WLAN_ESE
+    /*
+     * In case of Ese Reassociation, change the reassoc timer
+     * value.
+     */
+    val = pMlmReassocReq->reassocFailureTimeout;
+    if (psessionEntry->isESEconnection)
+    {
+        val = val/LIM_MAX_REASSOC_RETRY_LIMIT;
+    }
+    if (tx_timer_deactivate(&pMac->lim.limTimers.gLimReassocFailureTimer) !=
+                            TX_SUCCESS)
+    {
+        limLog(pMac, LOGP,
+               FL("unable to deactivate Reassoc failure timer"));
+    }
+    val = SYS_MS_TO_TICKS(val);
+    if (tx_timer_change(&pMac->lim.limTimers.gLimReassocFailureTimer,
+                       val, 0) != TX_SUCCESS)
+    {
+        limLog(pMac, LOGP,
+               FL("unable to change Reassociation failure timer"));
+    }
+#endif
+
     pMac->lim.limTimers.gLimReassocFailureTimer.sessionId = psessionEntry->peSessionId;
     // Start reassociation failure timer
     MTRACE(vos_trace(VOS_MODULE_ID_PE, TRACE_CODE_TIMER_ACTIVATE,
@@ -3377,7 +3476,7 @@ void
 limSendAuthMgmtFrame(tpAniSirGlobal pMac,
                      tpSirMacAuthFrameBody pAuthFrameBody,
                      tSirMacAddr           peerMacAddr,
-                     tANI_U8               wepBit,
+                     tANI_U8               wep_challenge_len,
                      tpPESession           psessionEntry,
                      tAniBool              waitForAck)
 {
@@ -3404,7 +3503,7 @@ limSendAuthMgmtFrame(tpAniSirGlobal pMac,
            pAuthFrameBody->authStatusCode,
            (pAuthFrameBody->authStatusCode == eSIR_MAC_SUCCESS_STATUS),
             MAC_ADDR_ARRAY(peerMacAddr));
-    if (wepBit == LIM_WEP_IN_FC)
+    if (wep_challenge_len)
     {
         /// Auth frame3 to be sent with encrypted framebody
         /**
@@ -3415,9 +3514,9 @@ limSendAuthMgmtFrame(tpAniSirGlobal pMac,
          * IV & ICV.
          */
 
-        frameLen = sizeof(tSirMacMgmtHdr) + LIM_ENCR_AUTH_BODY_LEN;
+        bodyLen = wep_challenge_len + LIM_ENCR_AUTH_INFO_LEN;
+        frameLen = sizeof(tSirMacMgmtHdr) + bodyLen;
 
-        bodyLen = LIM_ENCR_AUTH_BODY_LEN;
     } // if (wepBit == LIM_WEP_IN_FC)
     else
     {
@@ -3434,6 +3533,8 @@ limSendAuthMgmtFrame(tpAniSirGlobal pMac,
                 frameLen = sizeof(tSirMacMgmtHdr) +
                            SIR_MAC_AUTH_CHALLENGE_OFFSET;
                 bodyLen  = SIR_MAC_AUTH_CHALLENGE_OFFSET;
+                frameLen += lim_create_fils_auth_data(pMac,
+                                                pAuthFrameBody, psessionEntry);
 
 #if defined WLAN_FEATURE_VOWIFI_11R
             if (pAuthFrameBody->authAlgoNumber == eSIR_FT_AUTH)
@@ -3484,10 +3585,11 @@ limSendAuthMgmtFrame(tpAniSirGlobal pMac,
                      * transaction number, status code and 128 bytes
                      * for challenge text.
                      */
-
+                    bodyLen = SIR_MAC_AUTH_FRAME_INFO_LEN +
+                              SIR_MAC_SAP_AUTH_CHALLENGE_LENGTH +
+                              SIR_MAC_CHALLENGE_ID_LEN;
                     frameLen = sizeof(tSirMacMgmtHdr) +
-                               sizeof(tSirMacAuthFrame);
-                    bodyLen  = sizeof(tSirMacAuthFrameBody);
+                               bodyLen;
                 }
 
                 break;
@@ -3548,7 +3650,10 @@ limSendAuthMgmtFrame(tpAniSirGlobal pMac,
     }
 
     pMacHdr = ( tpSirMacMgmtHdr ) pFrame;
-    pMacHdr->fc.wep = wepBit;
+    if (wep_challenge_len)
+        pMacHdr->fc.wep = LIM_WEP_IN_FC;
+    else
+        pMacHdr->fc.wep = LIM_NO_WEP_IN_FC;
 
     // Prepare BSSId
     if (LIM_IS_AP_ROLE(psessionEntry) ||
@@ -3561,7 +3666,7 @@ limSendAuthMgmtFrame(tpAniSirGlobal pMac,
     /// Prepare Authentication frame body
     pBody    = pFrame + sizeof(tSirMacMgmtHdr);
 
-    if (wepBit == LIM_WEP_IN_FC)
+    if (wep_challenge_len)
     {
        vos_mem_copy(pBody, (tANI_U8 *) pAuthFrameBody, bodyLen);
 
@@ -3637,6 +3742,13 @@ limSendAuthMgmtFrame(tpAniSirGlobal pMac,
              }
           }
        }
+#ifdef WLAN_FEATURE_FILS_SK
+       else if (pAuthFrameBody->authAlgoNumber ==
+                      eSIR_FILS_SK_WITHOUT_PFS) {
+               limLog(pMac, LOG1,FL("appending fils Auth data"));
+               lim_add_fils_data_to_auth_frame(psessionEntry, pBody);
+       }
+#endif
 #endif
 
        PELOG1(limLog(pMac, LOG1,
@@ -3754,7 +3866,7 @@ eHalStatus limSendDeauthCnf(tpAniSirGlobal pMac)
 #endif
                  (psessionEntry->is11Rconnection ))) {
             PELOGE(limLog(pMac, LOGE,
-                   FL("FT Preauth Session (%p,%d) Cleanup"
+                   FL("FT Preauth Session (%pK,%d) Cleanup"
                       " Deauth reason %d Trigger = %d"),
                    psessionEntry, psessionEntry->peSessionId,
                    pMlmDeauthReq->reasonCode,
@@ -3854,7 +3966,7 @@ eHalStatus limSendDisassocCnf(tpAniSirGlobal pMac)
                  eSIR_MAC_DISASSOC_DUE_TO_FTHANDOFF_REASON))
         {
             PELOGE(limLog(pMac, LOG1,
-                   FL("FT Preauth Session (%p,%d) Clean up"
+                   FL("FT Preauth Session (%pK,%d) Clean up"
 
 #ifdef FEATURE_WLAN_ESE
                    " isESE %d"
@@ -4924,606 +5036,8 @@ limSendVHTChannelSwitchMgmtFrame(tpAniSirGlobal pMac,
     return eSIR_SUCCESS;
 
 } // End limSendVHTChannelSwitchMgmtFrame.
-
-
-
-#endif
-
-/**
- * \brief Send an ADDBA Req Action Frame to peer
- *
- * \sa limSendAddBAReq
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pMlmAddBAReq A pointer to tLimMlmAddBAReq. This contains
- * the necessary parameters reqd by PE send the ADDBA Req Action
- * Frame to the peer
- *
- * \return eSIR_SUCCESS if setup completes successfully
- *         eSIR_FAILURE is some problem is encountered
- */
-tSirRetStatus limSendAddBAReq( tpAniSirGlobal pMac,
-    tpLimMlmAddBAReq pMlmAddBAReq, tpPESession psessionEntry)
-{
-    tDot11fAddBAReq frmAddBAReq;
-    tANI_U8 *pAddBAReqBuffer = NULL;
-    tpSirMacMgmtHdr pMacHdr;
-    tANI_U32 frameLen = 0, nStatus, nPayload;
-    tSirRetStatus statusCode;
-    eHalStatus halStatus;
-    void *pPacket;
-    tANI_U8 txFlag = 0;
-    tANI_U8 smeSessionId = 0;
-
-     if(NULL == psessionEntry)
-    {
-        return eSIR_FAILURE;
-    }
-
-    smeSessionId = psessionEntry->smeSessionId;
-
-    vos_mem_set( (void *) &frmAddBAReq, sizeof( frmAddBAReq ), 0);
-
-    // Category - 3 (BA)
-    frmAddBAReq.Category.category = SIR_MAC_ACTION_BLKACK;
-
-    // Action - 0 (ADDBA Req)
-    frmAddBAReq.Action.action = SIR_MAC_BLKACK_ADD_REQ;
-
-    // FIXME - Dialog Token, generalize this...
-    frmAddBAReq.DialogToken.token = pMlmAddBAReq->baDialogToken;
-
-    // Fill the ADDBA Parameter Set
-    frmAddBAReq.AddBAParameterSet.tid = pMlmAddBAReq->baTID;
-    frmAddBAReq.AddBAParameterSet.policy = pMlmAddBAReq->baPolicy;
-    frmAddBAReq.AddBAParameterSet.bufferSize = pMlmAddBAReq->baBufferSize;
-
-    // BA timeout
-    // 0 - indicates no BA timeout
-    frmAddBAReq.BATimeout.timeout = pMlmAddBAReq->baTimeout;
-
-  // BA Starting Sequence Number
-  // Fragment number will always be zero
-  if (pMlmAddBAReq->baSSN < LIM_TX_FRAMES_THRESHOLD_ON_CHIP) {
-      pMlmAddBAReq->baSSN = LIM_TX_FRAMES_THRESHOLD_ON_CHIP;
-  }
-
-  frmAddBAReq.BAStartingSequenceControl.ssn =
-                pMlmAddBAReq->baSSN - LIM_TX_FRAMES_THRESHOLD_ON_CHIP;
-
-    nStatus = dot11fGetPackedAddBAReqSize( pMac, &frmAddBAReq, &nPayload );
-
-    if( DOT11F_FAILED( nStatus ))
-    {
-        limLog( pMac, LOGW,
-        FL( "Failed to calculate the packed size for "
-          "an ADDBA Request (0x%08x)."),
-        nStatus );
-
-        // We'll fall back on the worst case scenario:
-        nPayload = sizeof( tDot11fAddBAReq );
-    }
-    else if( DOT11F_WARNED( nStatus ))
-    {
-        limLog( pMac, LOGW,
-        FL( "There were warnings while calculating "
-          "the packed size for an ADDBA Req (0x%08x)."),
-        nStatus );
-    }
-
-    // Add the MGMT header to frame length
-    frameLen = nPayload + sizeof( tSirMacMgmtHdr );
-
-    // Need to allocate a buffer for ADDBA AF
-    if( eHAL_STATUS_SUCCESS !=
-      (halStatus = palPktAlloc( pMac->hHdd,
-                                HAL_TXRX_FRM_802_11_MGMT,
-                                (tANI_U16) frameLen,
-                                (void **) &pAddBAReqBuffer,
-                                (void **) &pPacket )))
-    {
-        // Log error
-        limLog( pMac, LOGP,
-        FL("palPktAlloc FAILED! Length [%d], Status [%d]"),
-        frameLen,
-        halStatus );
-
-        statusCode = eSIR_MEM_ALLOC_FAILED;
-        goto returnAfterError;
-    }
-
-    vos_mem_set( (void *) pAddBAReqBuffer, frameLen, 0 );
-
-    // Copy necessary info to BD
-    if( eSIR_SUCCESS !=
-      (statusCode = limPopulateMacHeader( pMac,
-                                   pAddBAReqBuffer,
-                                   SIR_MAC_MGMT_FRAME,
-                                   SIR_MAC_MGMT_ACTION,
-                                   pMlmAddBAReq->peerMacAddr,psessionEntry->selfMacAddr)))
-    goto returnAfterError;
-
-    // Update A3 with the BSSID
-    pMacHdr = ( tpSirMacMgmtHdr ) pAddBAReqBuffer;
-
-    sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
-
-#ifdef WLAN_FEATURE_11W
-    limSetProtectedBit(pMac, psessionEntry, pMlmAddBAReq->peerMacAddr, pMacHdr);
-#endif
-
-    // Now, we're ready to "pack" the frames
-    nStatus = dot11fPackAddBAReq( pMac,
-      &frmAddBAReq,
-      pAddBAReqBuffer + sizeof( tSirMacMgmtHdr ),
-      nPayload,
-      &nPayload );
-
-    if( DOT11F_FAILED( nStatus ))
-    {
-        limLog( pMac, LOGE,
-        FL( "Failed to pack an ADDBA Req (0x%08x)." ),
-        nStatus );
-
-        // FIXME - Need to convert to tSirRetStatus
-        statusCode = eSIR_FAILURE;
-        goto returnAfterError;
-    }
-    else if( DOT11F_WARNED( nStatus ))
-    {
-        limLog( pMac, LOGW,
-                FL( "There were warnings while packing an ADDBA Req (0x%08x)."),
-                nStatus );
-    }
-
-    limLog( pMac, LOG1, FL( "Sending an ADDBA REQ to "MAC_ADDRESS_STR " with"
-                            " tid = %d policy = %d buffsize = %d "
-                            " amsduSupported = %d"),
-                            MAC_ADDR_ARRAY(pMlmAddBAReq->peerMacAddr),
-                            frmAddBAReq.AddBAParameterSet.tid,
-                            frmAddBAReq.AddBAParameterSet.policy,
-                            frmAddBAReq.AddBAParameterSet.bufferSize,
-                            frmAddBAReq.AddBAParameterSet.amsduSupported);
-
-    if( ( SIR_BAND_5_GHZ == limGetRFBand(psessionEntry->currentOperChannel))
-       || ( psessionEntry->pePersona == VOS_P2P_CLIENT_MODE ) ||
-         ( psessionEntry->pePersona == VOS_P2P_GO_MODE)
-         )
-    {
-        txFlag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
-    }
-
-    MTRACE(vos_trace(VOS_MODULE_ID_PE, TRACE_CODE_TX_MGMT,
-           psessionEntry->peSessionId, pMacHdr->fc.subType));
-    halStatus = halTxFrame( pMac,
-                            pPacket,
-                            (tANI_U16) frameLen,
-                            HAL_TXRX_FRM_802_11_MGMT,
-                            ANI_TXDIR_TODS,
-                            7,
-                            limTxComplete,
-                            pAddBAReqBuffer, txFlag, smeSessionId);
-    MTRACE(vos_trace(VOS_MODULE_ID_PE, TRACE_CODE_TX_COMPLETE,
-           psessionEntry->peSessionId, halStatus));
-    if (eHAL_STATUS_SUCCESS != halStatus )
-    {
-        limLog( pMac, LOGE,
-        FL( "halTxFrame FAILED! Status [%d]"),
-        halStatus );
-
-    // FIXME - Need to convert eHalStatus to tSirRetStatus
-    statusCode = eSIR_FAILURE;
-    //Pkt will be freed up by the callback
-    return statusCode;
-  }
-  else
-    return eSIR_SUCCESS;
-
-returnAfterError:
-
-  // Release buffer, if allocated
-  if( NULL != pAddBAReqBuffer )
-    palPktFree( pMac->hHdd,
-        HAL_TXRX_FRM_802_11_MGMT,
-        (void *) pAddBAReqBuffer,
-        (void *) pPacket );
-
-  return statusCode;
-}
-
-/**
- * \brief Send an ADDBA Rsp Action Frame to peer
- *
- * \sa limSendAddBARsp
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pMlmAddBARsp A pointer to tLimMlmAddBARsp. This contains
- * the necessary parameters reqd by PE send the ADDBA Rsp Action
- * Frame to the peer
- *
- * \return eSIR_SUCCESS if setup completes successfully
- *         eSIR_FAILURE is some problem is encountered
- */
-tSirRetStatus limSendAddBARsp( tpAniSirGlobal pMac,
-    tpLimMlmAddBARsp pMlmAddBARsp,
-    tpPESession      psessionEntry)
-{
-    tDot11fAddBARsp frmAddBARsp;
-    tANI_U8 *pAddBARspBuffer = NULL;
-    tpSirMacMgmtHdr pMacHdr;
-    tANI_U32 frameLen = 0, nStatus, nPayload;
-    tSirRetStatus statusCode;
-    eHalStatus halStatus;
-    void *pPacket;
-    tANI_U8 txFlag = 0;
-    tANI_U8 smeSessionId = 0;
-
-     if(NULL == psessionEntry)
-    {
-        PELOGE(limLog(pMac, LOGE, FL("Session entry is NULL!!!"));)
-        return eSIR_FAILURE;
-    }
-
-      vos_mem_set( (void *) &frmAddBARsp, sizeof( frmAddBARsp ), 0);
-
-      // Category - 3 (BA)
-      frmAddBARsp.Category.category = SIR_MAC_ACTION_BLKACK;
-      // Action - 1 (ADDBA Rsp)
-      frmAddBARsp.Action.action = SIR_MAC_BLKACK_ADD_RSP;
-
-      // Should be same as the one we received in the ADDBA Req
-      frmAddBARsp.DialogToken.token = pMlmAddBARsp->baDialogToken;
-
-      // ADDBA Req status
-      frmAddBARsp.Status.status = pMlmAddBARsp->addBAResultCode;
-
-      // Fill the ADDBA Parameter Set as provided by caller
-      frmAddBARsp.AddBAParameterSet.tid = pMlmAddBARsp->baTID;
-      frmAddBARsp.AddBAParameterSet.policy = pMlmAddBARsp->baPolicy;
-      frmAddBARsp.AddBAParameterSet.bufferSize = pMlmAddBARsp->baBufferSize;
-
-      if (psessionEntry->max_amsdu_num > 0)
-      {
-         frmAddBARsp.AddBAParameterSet.amsduSupported =
-                                          psessionEntry->amsduSupportedInBA;
-      }
-      else
-      {
-         frmAddBARsp.AddBAParameterSet.amsduSupported = 0;
-      }
-
-      // BA timeout
-      // 0 - indicates no BA timeout
-      frmAddBARsp.BATimeout.timeout = pMlmAddBARsp->baTimeout;
-
-      nStatus = dot11fGetPackedAddBARspSize( pMac, &frmAddBARsp, &nPayload );
-
-      if( DOT11F_FAILED( nStatus ))
-      {
-        limLog( pMac, LOGW,
-            FL( "Failed to calculate the packed size for "
-              "an ADDBA Response (0x%08x)."),
-            nStatus );
-
-        // We'll fall back on the worst case scenario:
-        nPayload = sizeof( tDot11fAddBARsp );
-      }
-      else if( DOT11F_WARNED( nStatus ))
-      {
-        limLog( pMac, LOGW,
-            FL( "There were warnings while calculating "
-              "the packed size for an ADDBA Rsp (0x%08x)."),
-            nStatus );
-      }
-
-      // Need to allocate a buffer for ADDBA AF
-      frameLen = nPayload + sizeof( tSirMacMgmtHdr );
-
-      // Allocate shared memory
-      if( eHAL_STATUS_SUCCESS !=
-          (halStatus = palPktAlloc( pMac->hHdd,
-                                    HAL_TXRX_FRM_802_11_MGMT,
-                                    (tANI_U16) frameLen,
-                                    (void **) &pAddBARspBuffer,
-                                    (void **) &pPacket )))
-      {
-        // Log error
-        limLog( pMac, LOGP,
-            FL("palPktAlloc FAILED! Length [%d], Status [%d]"),
-            frameLen,
-            halStatus );
-
-        statusCode = eSIR_MEM_ALLOC_FAILED;
-        goto returnAfterError;
-      }
-
-      vos_mem_set( (void *) pAddBARspBuffer, frameLen, 0 );
-
-      // Copy necessary info to BD
-      if( eSIR_SUCCESS !=
-          (statusCode = limPopulateMacHeader( pMac,
-                                       pAddBARspBuffer,
-                                       SIR_MAC_MGMT_FRAME,
-                                       SIR_MAC_MGMT_ACTION,
-                                       pMlmAddBARsp->peerMacAddr,psessionEntry->selfMacAddr)))
-        goto returnAfterError;
-
-      // Update A3 with the BSSID
-
-      pMacHdr = ( tpSirMacMgmtHdr ) pAddBARspBuffer;
-
-      sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
-
-#ifdef WLAN_FEATURE_11W
-      limSetProtectedBit(pMac, psessionEntry, pMlmAddBARsp->peerMacAddr, pMacHdr);
 #endif
 
-      // Now, we're ready to "pack" the frames
-      nStatus = dot11fPackAddBARsp( pMac,
-          &frmAddBARsp,
-          pAddBARspBuffer + sizeof( tSirMacMgmtHdr ),
-          nPayload,
-          &nPayload );
-
-      if( DOT11F_FAILED( nStatus ))
-      {
-        limLog( pMac, LOGE,
-            FL( "Failed to pack an ADDBA Rsp (0x%08x)." ),
-            nStatus );
-
-        // FIXME - Need to convert to tSirRetStatus
-        statusCode = eSIR_FAILURE;
-        goto returnAfterError;
-      }
-      else if( DOT11F_WARNED( nStatus ))
-      {
-        limLog( pMac, LOGW,
-                FL( "There were warnings while packing an ADDBA Rsp (0x%08x)." ),
-                nStatus);
-      }
-
-      limLog( pMac, LOG1, FL( "Sending an ADDBA RSP to "MAC_ADDRESS_STR " with"
-                              " tid = %d policy = %d buffsize = %d"
-                              " amsduSupported = %d status %d"),
-                              MAC_ADDR_ARRAY(pMlmAddBARsp->peerMacAddr),
-                              frmAddBARsp.AddBAParameterSet.tid,
-                              frmAddBARsp.AddBAParameterSet.policy,
-                              frmAddBARsp.AddBAParameterSet.bufferSize,
-                              frmAddBARsp.AddBAParameterSet.amsduSupported,
-                              frmAddBARsp.Status.status);
-
-    if( ( SIR_BAND_5_GHZ == limGetRFBand(psessionEntry->currentOperChannel))
-       || ( psessionEntry->pePersona == VOS_P2P_CLIENT_MODE ) ||
-         ( psessionEntry->pePersona == VOS_P2P_GO_MODE)
-         )
-    {
-        txFlag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
-    }
-
-    MTRACE(vos_trace(VOS_MODULE_ID_PE, TRACE_CODE_TX_MGMT,
-           psessionEntry->peSessionId, pMacHdr->fc.subType));
-    halStatus = halTxFrame( pMac,
-                            pPacket,
-                            (tANI_U16) frameLen,
-                            HAL_TXRX_FRM_802_11_MGMT,
-                            ANI_TXDIR_TODS,
-                            7,
-                            limTxComplete,
-                            pAddBARspBuffer, txFlag, smeSessionId);
-    MTRACE(vos_trace(VOS_MODULE_ID_PE, TRACE_CODE_TX_COMPLETE,
-           psessionEntry->peSessionId, halStatus));
-    if (eHAL_STATUS_SUCCESS != halStatus )
-    {
-        limLog( pMac, LOGE,
-                FL( "halTxFrame FAILED! Status [%d]" ),
-                halStatus );
-
-    // FIXME - HAL error codes are different from PE error
-    // codes!! And, this routine is returning tSirRetStatus
-    statusCode = eSIR_FAILURE;
-    //Pkt will be freed up by the callback
-    return statusCode;
-   }
-   else
-      return eSIR_SUCCESS;
-
-      returnAfterError:
-
-      // Release buffer, if allocated
-      if( NULL != pAddBARspBuffer )
-        palPktFree( pMac->hHdd,
-            HAL_TXRX_FRM_802_11_MGMT,
-            (void *) pAddBARspBuffer,
-            (void *) pPacket );
-
-      return statusCode;
-}
-
-/**
- * \brief Send a DELBA Indication Action Frame to peer
- *
- * \sa limSendDelBAInd
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param peerMacAddr MAC Address of peer
- *
- * \param reasonCode Reason for the DELBA notification
- *
- * \param pBAParameterSet The DELBA Parameter Set.
- * This identifies the TID for which the BA session is
- * being deleted.
- *
- * \return eSIR_SUCCESS if setup completes successfully
- *         eSIR_FAILURE is some problem is encountered
- */
-tSirRetStatus limSendDelBAInd( tpAniSirGlobal pMac,
-    tpLimMlmDelBAReq pMlmDelBAReq,tpPESession psessionEntry)
-{
-    tDot11fDelBAInd frmDelBAInd;
-    tANI_U8 *pDelBAIndBuffer = NULL;
-    tpSirMacMgmtHdr pMacHdr;
-    tANI_U32 frameLen = 0, nStatus, nPayload;
-    tSirRetStatus statusCode;
-    eHalStatus halStatus;
-    void *pPacket;
-    tANI_U8 txFlag = 0;
-   tANI_U8             smeSessionId = 0;
-
-     if(NULL == psessionEntry)
-    {
-        return eSIR_FAILURE;
-    }
-
-    smeSessionId = psessionEntry->smeSessionId;
-    vos_mem_set( (void *) &frmDelBAInd, sizeof( frmDelBAInd ), 0);
-
-      // Category - 3 (BA)
-      frmDelBAInd.Category.category = SIR_MAC_ACTION_BLKACK;
-      // Action - 2 (DELBA)
-      frmDelBAInd.Action.action = SIR_MAC_BLKACK_DEL;
-
-      // Fill the DELBA Parameter Set as provided by caller
-      frmDelBAInd.DelBAParameterSet.tid = pMlmDelBAReq->baTID;
-      frmDelBAInd.DelBAParameterSet.initiator = pMlmDelBAReq->baDirection;
-
-      // BA Starting Sequence Number
-      // Fragment number will always be zero
-      frmDelBAInd.Reason.code = pMlmDelBAReq->delBAReasonCode;
-
-      nStatus = dot11fGetPackedDelBAIndSize( pMac, &frmDelBAInd, &nPayload );
-
-      if( DOT11F_FAILED( nStatus ))
-      {
-        limLog( pMac, LOGW,
-            FL( "Failed to calculate the packed size for "
-              "an DELBA Indication (0x%08x)."),
-            nStatus );
-
-        // We'll fall back on the worst case scenario:
-        nPayload = sizeof( tDot11fDelBAInd );
-      }
-      else if( DOT11F_WARNED( nStatus ))
-      {
-        limLog( pMac, LOGW,
-            FL( "There were warnings while calculating "
-              "the packed size for an DELBA Ind (0x%08x)."),
-            nStatus );
-      }
-
-      // Add the MGMT header to frame length
-      frameLen = nPayload + sizeof( tSirMacMgmtHdr );
-
-      // Allocate shared memory
-      if( eHAL_STATUS_SUCCESS !=
-          (halStatus = palPktAlloc( pMac->hHdd,
-                                    HAL_TXRX_FRM_802_11_MGMT,
-                                    (tANI_U16) frameLen,
-                                    (void **) &pDelBAIndBuffer,
-                                    (void **) &pPacket )))
-      {
-        // Log error
-        limLog( pMac, LOGP,
-            FL("palPktAlloc FAILED! Length [%d], Status [%d]"),
-            frameLen,
-            halStatus );
-
-        statusCode = eSIR_MEM_ALLOC_FAILED;
-        goto returnAfterError;
-      }
-
-      vos_mem_set( (void *) pDelBAIndBuffer, frameLen, 0 );
-
-      // Copy necessary info to BD
-      if( eSIR_SUCCESS !=
-          (statusCode = limPopulateMacHeader( pMac,
-                                       pDelBAIndBuffer,
-                                       SIR_MAC_MGMT_FRAME,
-                                       SIR_MAC_MGMT_ACTION,
-                                       pMlmDelBAReq->peerMacAddr,psessionEntry->selfMacAddr)))
-        goto returnAfterError;
-
-      // Update A3 with the BSSID
-      pMacHdr = ( tpSirMacMgmtHdr ) pDelBAIndBuffer;
-
-      sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
-
-#ifdef WLAN_FEATURE_11W
-      limSetProtectedBit(pMac, psessionEntry, pMlmDelBAReq->peerMacAddr, pMacHdr);
-#endif
-
-      // Now, we're ready to "pack" the frames
-      nStatus = dot11fPackDelBAInd( pMac,
-          &frmDelBAInd,
-          pDelBAIndBuffer + sizeof( tSirMacMgmtHdr ),
-          nPayload,
-          &nPayload );
-
-      if( DOT11F_FAILED( nStatus ))
-      {
-        limLog( pMac, LOGE,
-            FL( "Failed to pack an DELBA Ind (0x%08x)." ),
-            nStatus );
-
-        // FIXME - Need to convert to tSirRetStatus
-        statusCode = eSIR_FAILURE;
-        goto returnAfterError;
-      }
-      else if( DOT11F_WARNED( nStatus ))
-      {
-        limLog( pMac, LOGW,
-                FL( "There were warnings while packing an DELBA Ind (0x%08x)." ),
-                nStatus);
-      }
-
-      limLog( pMac, LOGW,
-          FL( "Sending a DELBA IND to " ));
-      limPrintMacAddr( pMac, pMlmDelBAReq->peerMacAddr, LOGW );
-
-    if( ( SIR_BAND_5_GHZ == limGetRFBand(psessionEntry->currentOperChannel))
-       || ( psessionEntry->pePersona == VOS_P2P_CLIENT_MODE ) ||
-         ( psessionEntry->pePersona == VOS_P2P_GO_MODE)
-         )
-    {
-        txFlag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
-    }
-
-    MTRACE(vos_trace(VOS_MODULE_ID_PE, TRACE_CODE_TX_MGMT,
-           psessionEntry->peSessionId, pMacHdr->fc.subType));
-    halStatus = halTxFrame( pMac,
-                            pPacket,
-                            (tANI_U16) frameLen,
-                            HAL_TXRX_FRM_802_11_MGMT,
-                            ANI_TXDIR_TODS,
-                            7,
-                            limTxComplete,
-                            pDelBAIndBuffer, txFlag, smeSessionId);
-    MTRACE(vos_trace(VOS_MODULE_ID_PE, TRACE_CODE_TX_COMPLETE,
-                     psessionEntry->peSessionId, halStatus));
-   if (eHAL_STATUS_SUCCESS != halStatus )
-   {
-       PELOGE(limLog( pMac, LOGE, FL( "halTxFrame FAILED! Status [%d]" ), halStatus );)
-       statusCode = eSIR_FAILURE;
-       //Pkt will be freed up by the callback
-       return statusCode;
-    }
-    else
-      return eSIR_SUCCESS;
-
-      returnAfterError:
-
-      // Release buffer, if allocated
-      if( NULL != pDelBAIndBuffer )
-        palPktFree( pMac->hHdd,
-            HAL_TXRX_FRM_802_11_MGMT,
-            (void *) pDelBAIndBuffer,
-            (void *) pPacket );
-
-      return statusCode;
-}
-
 #if defined WLAN_FEATURE_VOWIFI
 
 /**
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendMessages.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendMessages.c
index ac092806455..3f0655c3207 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendMessages.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -235,6 +235,7 @@ tSirRetStatus limSendSwitchChnlParams(tpAniSirGlobal pMac,
     tSirRetStatus   retCode = eSIR_SUCCESS;
     tSirMsgQ msgQ;
     tpPESession pSessionEntry;
+
     if((pSessionEntry = peFindSessionBySessionId(pMac, peSessionId)) == NULL)
     {
        limLog( pMac, LOGP,
@@ -270,6 +271,22 @@ tSirRetStatus limSendSwitchChnlParams(tpAniSirGlobal pMac,
        pChnlParams->isDfsChannel = VOS_FALSE;
 
     pChnlParams->restart_on_chan_switch = is_restart;
+    pChnlParams->reduced_beacon_interval =
+       pMac->sap.SapDfsInfo.reduced_beacon_interval;
+
+    if (pSessionEntry->sub20_channelwidth == SUB20_MODE_5MHZ)
+            pChnlParams->channelwidth = CH_WIDTH_5MHZ;
+    else if (pSessionEntry->sub20_channelwidth == SUB20_MODE_10MHZ)
+            pChnlParams->channelwidth = CH_WIDTH_10MHZ;
+
+    if (pSessionEntry->bssType == eSIR_INFRASTRUCTURE_MODE &&
+        pSessionEntry->sub20_channelwidth !=
+        pMac->sta_sub20_current_channelwidth)
+        sme_set_sta_chanlist_with_sub20(pMac,
+                                        pSessionEntry->sub20_channelwidth);
+
+    limLog(pMac, LOG1, FL("Set sub20 channel width %d"),
+           pSessionEntry->sub20_channelwidth);
 
     //we need to defer the message until we get the response back from WDA.
     SET_LIM_PROCESS_DEFD_MESGS(pMac, false);
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
index 5c7aba25569..e00b4e6c9ff 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,8 +40,7 @@
 #include "wniApi.h"
 #include "sirCommon.h"
 #include "aniGlobal.h"
-
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "sysDef.h"
 #include "cfgApi.h"
 
@@ -58,6 +57,7 @@
 #include "nan_datapath.h"
 
 #include "sirApi.h"
+#include "lim_process_fils.h"
 
 /**
  * limRemoveSsidFromScanCache()
@@ -332,6 +332,42 @@ static void limSendSmeJoinReassocRspAfterResume( tpAniSirGlobal pMac,
     limSysProcessMmhMsgApi(pMac, &mmhMsg,  ePROT);
 }
 
+/**
+ * lim_add_bss_info() - copy data from session entry to join rsp
+ * @session entry: PE Session Info
+ * @sme_join_rsp: Join response buffer to be filled up
+ *
+ * Return: None
+ */
+static void lim_add_bss_info(tpPESession session_entry,
+					tpSirSmeJoinRsp sme_join_rsp)
+{
+	if (session_entry->hs20vendor_ie.present)
+		sme_join_rsp->hs20vendor_ie = session_entry->hs20vendor_ie;
+	if (session_entry->vht_caps.present)
+		sme_join_rsp->vht_caps = session_entry->vht_caps;
+	if (session_entry->ht_caps.present)
+		sme_join_rsp->ht_caps = session_entry->ht_caps;
+	if (session_entry->ht_operation.present)
+		sme_join_rsp->ht_operation = session_entry->ht_operation;
+	if (session_entry->vht_operation.present)
+		sme_join_rsp->vht_operation = session_entry->vht_operation;
+}
+
+#ifdef WLAN_FEATURE_FILS_SK
+static void lim_update_fils_seq_num(tpSirSmeJoinRsp sme_join_rsp,
+                    tpPESession session_entry)
+{
+    sme_join_rsp->fils_seq_num =
+        session_entry->fils_info->sequence_number;
+    PELOG1(limLog(pMac, LOG1, FL("FILS seq number %d"),
+            sme_join_rsp->fils_seq_num);)
+}
+#else
+static inline void lim_update_fils_seq_num(tpSirSmeJoinRsp sme_join_rsp,
+                       tpPESession session_entry)
+{}
+#endif
 
 /**
  * limSendSmeJoinReassocRsp()
@@ -423,7 +459,14 @@ limSendSmeJoinReassocRsp(tpAniSirGlobal pMac, tANI_U16 msgType,
         }
 
         vos_mem_set((tANI_U8*)pSirSmeJoinRsp, rspLen, 0);
-
+#ifdef WLAN_FEATURE_FILS_SK
+        if (lim_is_fils_connection(psessionEntry))
+        {
+            pSirSmeJoinRsp->is_fils_connection = true;
+            lim_update_fils_seq_num(pSirSmeJoinRsp,
+                                        psessionEntry);
+        }
+#endif
         if (resultCode == eSIR_SME_SUCCESS)
         {
             pStaDs = dphGetHashEntry(pMac, DPH_STA_HASH_INDEX_PEER, &psessionEntry->dph.dphHashTable);
@@ -447,6 +490,10 @@ limSendSmeJoinReassocRsp(tpAniSirGlobal pMac, tANI_U16 msgType,
                 pSirSmeJoinRsp->nss = pStaDs->nss;
                 pSirSmeJoinRsp->max_rate_flags =
                                 lim_get_max_rate_flags(pMac, pStaDs);
+                lim_add_bss_info(psessionEntry, pSirSmeJoinRsp);
+                /* Copy FILS params only for Successful join */
+                populate_fils_connect_params(pMac, psessionEntry,
+                                             pSirSmeJoinRsp);
             }
         }
 
@@ -555,28 +602,26 @@ limSendSmeJoinReassocRsp(tpAniSirGlobal pMac, tANI_U16 msgType,
             }
 
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-            if (psessionEntry->cc_switch_mode != VOS_MCC_TO_SCC_SWITCH_DISABLE) {
-                pSirSmeJoinRsp->HTProfile.htSupportedChannelWidthSet =
-                                      psessionEntry->htSupportedChannelWidthSet;
-                pSirSmeJoinRsp->HTProfile.htRecommendedTxWidthSet =
-                                      psessionEntry->htRecommendedTxWidthSet;
-                pSirSmeJoinRsp->HTProfile.htSecondaryChannelOffset =
-                                      psessionEntry->htSecondaryChannelOffset;
-                pSirSmeJoinRsp->HTProfile.dot11mode =
-                                      psessionEntry->dot11mode;
-                pSirSmeJoinRsp->HTProfile.htCapability =
-                                      psessionEntry->htCapability;
+            pSirSmeJoinRsp->HTProfile.htSupportedChannelWidthSet =
+                                  psessionEntry->htSupportedChannelWidthSet;
+            pSirSmeJoinRsp->HTProfile.htRecommendedTxWidthSet =
+                                  psessionEntry->htRecommendedTxWidthSet;
+            pSirSmeJoinRsp->HTProfile.htSecondaryChannelOffset =
+                                  psessionEntry->htSecondaryChannelOffset;
+            pSirSmeJoinRsp->HTProfile.dot11mode =
+                                  psessionEntry->dot11mode;
+            pSirSmeJoinRsp->HTProfile.htCapability =
+                                  psessionEntry->htCapability;
 #ifdef WLAN_FEATURE_11AC
-                pSirSmeJoinRsp->HTProfile.vhtCapability =
-                                      psessionEntry->vhtCapability;
-                pSirSmeJoinRsp->HTProfile.vhtTxChannelWidthSet =
-                                      psessionEntry->vhtTxChannelWidthSet;
-                pSirSmeJoinRsp->HTProfile.apCenterChan =
-                                      psessionEntry->apCenterChan;
-                pSirSmeJoinRsp->HTProfile.apChanWidth =
-                                      psessionEntry->apChanWidth;
+            pSirSmeJoinRsp->HTProfile.vhtCapability =
+                                  psessionEntry->vhtCapability;
+            pSirSmeJoinRsp->HTProfile.vhtTxChannelWidthSet =
+                                  psessionEntry->vhtTxChannelWidthSet;
+            pSirSmeJoinRsp->HTProfile.apCenterChan =
+                                  psessionEntry->apCenterChan;
+            pSirSmeJoinRsp->HTProfile.apChanWidth =
+                                  psessionEntry->apChanWidth;
 #endif
-            }
 #endif
         }
         else
@@ -783,8 +828,8 @@ limSendSmeStartBssRsp(tpAniSirGlobal pMac,
                        * pointer to ieFields.
                        */
                       pSirSmeRsp->bssDescription.length =
-                              sizeof(pSirSmeRsp->bssDescription) -
-                              sizeof(tANI_U16) - sizeof(tANI_U32) + ieLen;
+                              ((uintptr_t)OFFSET_OF(tSirBssDescription, ieFields))
+                               - sizeof(pSirSmeRsp->bssDescription.length) + ieLen;
                       /*
                        * This is the size of the message, subtract the size of
                        * the pointer to ieFields
@@ -792,29 +837,26 @@ limSendSmeStartBssRsp(tpAniSirGlobal pMac,
                       size += ieLen - sizeof(tANI_U32);
                 }
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-                if (psessionEntry->cc_switch_mode
-                                             != VOS_MCC_TO_SCC_SWITCH_DISABLE) {
-                    pSirSmeRsp->HTProfile.htSupportedChannelWidthSet =
-                                      psessionEntry->htSupportedChannelWidthSet;
-                    pSirSmeRsp->HTProfile.htRecommendedTxWidthSet =
-                                      psessionEntry->htRecommendedTxWidthSet;
-                    pSirSmeRsp->HTProfile.htSecondaryChannelOffset =
-                                      psessionEntry->htSecondaryChannelOffset;
-                    pSirSmeRsp->HTProfile.dot11mode =
-                                      psessionEntry->dot11mode;
-                    pSirSmeRsp->HTProfile.htCapability =
-                                      psessionEntry->htCapability;
+                pSirSmeRsp->HTProfile.htSupportedChannelWidthSet =
+                                  psessionEntry->htSupportedChannelWidthSet;
+                pSirSmeRsp->HTProfile.htRecommendedTxWidthSet =
+                                  psessionEntry->htRecommendedTxWidthSet;
+                pSirSmeRsp->HTProfile.htSecondaryChannelOffset =
+                                  psessionEntry->htSecondaryChannelOffset;
+                pSirSmeRsp->HTProfile.dot11mode =
+                                  psessionEntry->dot11mode;
+                pSirSmeRsp->HTProfile.htCapability =
+                                  psessionEntry->htCapability;
 #ifdef WLAN_FEATURE_11AC
-                    pSirSmeRsp->HTProfile.vhtCapability =
-                                      psessionEntry->vhtCapability;
-                    pSirSmeRsp->HTProfile.vhtTxChannelWidthSet =
-                                      psessionEntry->vhtTxChannelWidthSet;
-                    pSirSmeRsp->HTProfile.apCenterChan =
-                                      psessionEntry->apCenterChan;
-                    pSirSmeRsp->HTProfile.apChanWidth =
-                                      psessionEntry->apChanWidth;
+                pSirSmeRsp->HTProfile.vhtCapability =
+                                  psessionEntry->vhtCapability;
+                pSirSmeRsp->HTProfile.vhtTxChannelWidthSet =
+                                  psessionEntry->vhtTxChannelWidthSet;
+                pSirSmeRsp->HTProfile.apCenterChan =
+                                  psessionEntry->apCenterChan;
+                pSirSmeRsp->HTProfile.apChanWidth =
+                                  psessionEntry->apChanWidth;
 #endif
-                }
 #endif
         }
     }
@@ -1517,6 +1559,7 @@ limSendSmeDisassocNtf(tpAniSirGlobal pMac,
     tANI_U8                     *pBuf;
     tSirSmeDisassocRsp      *pSirSmeDisassocRsp;
     tSirSmeDisassocInd      *pSirSmeDisassocInd;
+    tSirSmeDisConDoneInd    *pSirSmeDisConDoneInd;
     tANI_U32 *pMsg;
     bool failure = false;
 
@@ -1527,12 +1570,6 @@ limSendSmeDisassocNtf(tpAniSirGlobal pMac,
 
     switch (disassocTrigger)
     {
-        case eLIM_PEER_ENTITY_DISASSOC:
-            if (reasonCode != eSIR_SME_STA_NOT_ASSOCIATED) {
-                failure = true;
-                goto error;
-            }
-
         case eLIM_HOST_DISASSOC:
             /**
              * Disassociation response due to
@@ -1584,6 +1621,41 @@ limSendSmeDisassocNtf(tpAniSirGlobal pMac,
             pMsg = (tANI_U32*) pSirSmeDisassocRsp;
             break;
 
+        case eLIM_PEER_ENTITY_DISASSOC:
+        case eLIM_LINK_MONITORING_DISASSOC:
+            pSirSmeDisConDoneInd =
+                                  vos_mem_malloc(sizeof(tSirSmeDisConDoneInd));
+            if ( NULL == pSirSmeDisConDoneInd )
+            {
+                /* Log error */
+                limLog(pMac, LOGP,
+                       FL("call to AllocateMemory failed for"
+                          "disconnect indication"));
+                return;
+            }
+            vos_mem_zero(pSirSmeDisConDoneInd, sizeof(tSirSmeDisConDoneInd));
+            limLog(pMac, LOG1,
+                   FL("send  eWNI_SME_DISCONNECT_DONE_IND with retCode: %d"),
+                   reasonCode);
+            pSirSmeDisConDoneInd->messageType = eWNI_SME_DISCONNECT_DONE_IND;
+            pSirSmeDisConDoneInd->length      = sizeof(tSirSmeDisConDoneInd);
+            vos_mem_copy(pSirSmeDisConDoneInd->peerMacAddr, peerMacAddr,
+                         sizeof(tSirMacAddr));
+            pSirSmeDisConDoneInd->sessionId   = smesessionId;
+
+            /*
+             * Instead of sending deauth reason code as 505 which is internal
+             * value to driver(eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE).
+             * Send reason code as zero to Supplicant
+             */
+            if (reasonCode == eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
+                pSirSmeDisConDoneInd->reasonCode = 0;
+            else
+                pSirSmeDisConDoneInd->reasonCode = reasonCode;
+
+            pMsg = (tANI_U32 *)pSirSmeDisConDoneInd;
+            break;
+
         default:
             /**
              * Disassociation indication due to Disassociation
@@ -1674,7 +1746,7 @@ limSendSmeDisassocInd(tpAniSirGlobal pMac, tpDphHashNode pStaDs,tpPESession pses
 
     pSirSmeDisassocInd->sessionId     =  psessionEntry->smeSessionId;
     pSirSmeDisassocInd->transactionId =  psessionEntry->transactionId;
-    pSirSmeDisassocInd->statusCode    =  pStaDs->mlmStaContext.disassocReason;
+    pSirSmeDisassocInd->statusCode    =  eSIR_SME_DEAUTH_STATUS;
     pSirSmeDisassocInd->reasonCode    =  pStaDs->mlmStaContext.disassocReason;
 
     vos_mem_copy( pSirSmeDisassocInd->bssId, psessionEntry->bssId, sizeof(tSirMacAddr));
@@ -1980,6 +2052,7 @@ limSendSmeDeauthNtf(tpAniSirGlobal pMac, tSirMacAddr peerMacAddr, tSirResultCode
     tANI_U8             *pBuf;
     tSirSmeDeauthRsp    *pSirSmeDeauthRsp;
     tSirSmeDeauthInd    *pSirSmeDeauthInd;
+    tSirSmeDisConDoneInd *pSirSmeDisConDoneInd;
     tpPESession         psessionEntry;
     tANI_U8             sessionId;
     tANI_U32            *pMsg;
@@ -1987,9 +2060,6 @@ limSendSmeDeauthNtf(tpAniSirGlobal pMac, tSirMacAddr peerMacAddr, tSirResultCode
     psessionEntry = peFindSessionByBssid(pMac,peerMacAddr,&sessionId);
     switch (deauthTrigger)
     {
-        case eLIM_PEER_ENTITY_DEAUTH:
-            return;
-
         case eLIM_HOST_DEAUTH:
             /**
              * Deauthentication response to host triggered
@@ -2024,6 +2094,42 @@ limSendSmeDeauthNtf(tpAniSirGlobal pMac, tSirMacAddr peerMacAddr, tSirResultCode
 
             break;
 
+        case eLIM_PEER_ENTITY_DEAUTH:
+        case eLIM_LINK_MONITORING_DEAUTH:
+            pSirSmeDisConDoneInd =
+                                vos_mem_malloc(sizeof(tSirSmeDisConDoneInd));
+            if ( NULL == pSirSmeDisConDoneInd )
+            {
+                /* Log error */
+                limLog(pMac, LOGP,
+                       FL("call to AllocateMemory failed for"
+                          "disconnect indication"));
+                return;
+            }
+
+            vos_mem_zero(pSirSmeDisConDoneInd, sizeof(tSirSmeDisConDoneInd));
+            limLog(pMac, LOG1,
+                   FL("send  eWNI_SME_DISCONNECT_DONE_IND withretCode: %d"),
+                   reasonCode);
+            pSirSmeDisConDoneInd->messageType = eWNI_SME_DISCONNECT_DONE_IND;
+            pSirSmeDisConDoneInd->length      = sizeof(tSirSmeDisConDoneInd);
+            pSirSmeDisConDoneInd->sessionId   = smesessionId;
+
+            /*
+             * Instead of sending deauth reason code as 505 which is internal
+             * value to driver(eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE).
+             * Send reason code as zero to Supplicant
+             */
+            if (reasonCode == eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
+                pSirSmeDisConDoneInd->reasonCode = 0;
+            else
+                pSirSmeDisConDoneInd->reasonCode = reasonCode;
+            pMsg = (tANI_U32 *)pSirSmeDisConDoneInd;
+            vos_mem_copy(pSirSmeDisConDoneInd->peerMacAddr, peerMacAddr,
+                         sizeof(tSirMacAddr));
+
+            break;
+
         default:
             /**
              * Deauthentication indication due to Deauthentication
@@ -2980,7 +3086,7 @@ void limHandleCSAoffloadMsg(tpAniSirGlobal pMac,tpSirMsgQ MsgQ)
 
       } else
 #endif
-      if (psessionEntry->htCapability) {
+      if (psessionEntry->htSupportedChannelWidthSet) {
           psessionEntry->gLimChannelSwitch.secondarySubBand =
                                              limSelectCBMode(pStaDs,
                                                  psessionEntry,
@@ -2994,6 +3100,9 @@ void limHandleCSAoffloadMsg(tpAniSirGlobal pMac,tpSirMsgQ MsgQ)
       limLog(pMac, LOG1, FL("secondarySubBand = %d"),
              psessionEntry->gLimChannelSwitch.secondarySubBand);
 
+      psessionEntry->lim_sub20_channel_switch_bandwidth =
+                         csa_params->new_sub20_channelwidth;
+
       limPrepareFor11hChannelSwitch(pMac, psessionEntry);
       pCsaOffloadInd = vos_mem_malloc(sizeof(tSmeCsaOffloadInd));
       if (NULL == pCsaOffloadInd) {
@@ -3395,6 +3504,15 @@ limProcessBeaconTxSuccessInd(tpAniSirGlobal pMac, tANI_U16 msgType, void *event)
           * Send the next beacon with updated CSA IE count
           */
           limSendDfsChanSwIEUpdate(pMac, psessionEntry);
+
+          if (pMac->sap.SapDfsInfo.dfs_beacon_tx_enhanced) {
+              /* Send Action frame after updating the beacon */
+              lim_send_chan_switch_action_frame(pMac,
+                  psessionEntry->gLimChannelSwitch.primaryChannel,
+                  psessionEntry->gLimChannelSwitch.secondarySubBand,
+                  psessionEntry);
+          }
+
           /* Decrement the IE count */
           psessionEntry->gLimChannelSwitch.switchCount--;
       }
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSerDesUtils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSerDesUtils.c
index c911c50d0f3..795e42c41c8 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSerDesUtils.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSerDesUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -126,8 +126,8 @@ limGetBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pBssDescription,
         return eSIR_FAILURE;
 
     // Extract timer
-    vos_mem_copy( (tANI_U8 *) (&pBssDescription->scanSysTimeMsec),
-                  pBuf, sizeof(v_TIME_t));
+    vos_mem_copy( (tANI_U8 *) (&pBssDescription->scansystimensec),
+                               pBuf, sizeof(v_TIME_t));
     pBuf += sizeof(v_TIME_t);
     len  -= sizeof(v_TIME_t);
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
@@ -291,6 +291,12 @@ limGetBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pBssDescription,
     pBuf += sizeof(tANI_U32);
     len  -= sizeof(tANI_U32);
 
+#ifdef WLAN_FEATURE_FILS_SK
+    vos_mem_copy(&pBssDescription->fils_info_element, pBuf, sizeof(struct fils_ind_elements));
+    pBuf += sizeof(struct fils_ind_elements);
+    len -= sizeof(struct fils_ind_elements);
+#endif
+
     if (len > 0)
     {
         vos_mem_copy( (tANI_U8 *) pBssDescription->ieFields,
@@ -704,6 +710,9 @@ limStartBssReqSerDes(tpAniSirGlobal pMac, tpSirSmeStartBssReq pStartBssReq, tANI
     len -= sizeof(pStartBssReq->beacon_tx_rate);
     pBuf += sizeof(pStartBssReq->beacon_tx_rate);
 
+    pStartBssReq->sub20_channelwidth = *pBuf++;
+    len--;
+
     if (len)
     {
         limLog(pMac, LOGW, FL("Extra bytes left in SME_START_BSS_REQ, len=%d"), len);
@@ -962,6 +971,14 @@ limJoinReqSerDes(tpAniSirGlobal pMac, tpSirSmeJoinReq pJoinReq, tANI_U8 *pBuf)
         limLog(pMac, LOGE, FL("remaining len %d is too short"), len);
         return eSIR_FAILURE;
     }
+    /* Extract force_24ghz_in_ht20 */
+    pJoinReq->force_24ghz_in_ht20 = *pBuf++;
+    len--;
+    if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
+    {
+        limLog(pMac, LOGE, FL("remaining len %d is too short"), len);
+        return eSIR_FAILURE;
+    }
 
     // Extract uapsdPerAcBitmask
     pJoinReq->uapsdPerAcBitmask = *pBuf++;
@@ -1335,6 +1352,17 @@ limJoinReqSerDes(tpAniSirGlobal pMac, tpSirSmeJoinReq pJoinReq, tANI_U8 *pBuf)
             pJoinReq->powerCap.maxTxPower,
             pJoinReq->supportedChannels.numChnl);)
 
+    if (pJoinReq->messageType == eWNI_SME_JOIN_REQ)
+    {
+        pJoinReq->sub20_channelwidth = *pBuf++;
+        len--;
+    }
+#ifdef WLAN_FEATURE_FILS_SK
+    vos_mem_copy(&pJoinReq->fils_con_info, pBuf, sizeof(struct cds_fils_connection_info));
+    pBuf += sizeof(struct cds_fils_connection_info);
+    len -= sizeof(struct cds_fils_connection_info);
+#endif
+
     // Extract uapsdPerAcBitmask
     pJoinReq->uapsdPerAcBitmask = *pBuf++;
     len--;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSerDesUtils.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSerDesUtils.h
index ca0cb207cc0..d53f2ee0d05 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSerDesUtils.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSerDesUtils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -123,6 +123,31 @@ static inline tANI_U32 limGetU32(tANI_U8 *ptr)
 #endif
 }
 
+/**
+ * lim_copy_u16_be()- This API copies a u16 value in buffer
+ * to network byte order
+ * @ptr: pointer to buffer
+ * @u16_val: value needs to be copied
+ *
+ * Return: None
+ */
+static inline void lim_copy_u16_be(tANI_U8 *ptr, tANI_U16 u16_val)
+{
+    ptr[0] = u16_val >> 8;
+    ptr[1] = u16_val & 0xff;
+}
+
+/**
+ * lim_copy_u16_be()- This API reads u16 value from network byte order buffer
+ * @ptr: pointer to buffer
+ *
+ * Return: 16bit value
+ */
+static inline tANI_U16 lim_get_u16_be(tANI_U8 *buf)
+{
+    return (buf[0] << 8) | buf[1];
+}
+
 tSirRetStatus lim_send_disassoc_frm_req_ser_des(tpAniSirGlobal mac_ctx,
                 struct sme_send_disassoc_frm_req *disassoc_frm_req,
                 uint8_t *buf);
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSession.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSession.c
index fc13b7e2e80..e21b37ccc1b 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSession.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSession.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -231,6 +231,97 @@ void pe_reset_protection_callback(void *ptr)
     }
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * pe_delete_fils_info: API to delete fils session info
+ * @session: pe session
+ *
+ * Return: void
+ */
+void pe_delete_fils_info(tpPESession session)
+{
+    struct pe_fils_session *fils_info;
+
+    if (!session || (session && !session->valid)) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_DEBUG,
+              FL("session is not valid"));
+        return;
+    }
+    fils_info = session->fils_info;
+    if (!fils_info) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_DEBUG,
+              FL("fils info not found"));
+        return;
+    }
+    if (fils_info->keyname_nai_data)
+        vos_mem_free(fils_info->keyname_nai_data);
+    if (fils_info->fils_erp_reauth_pkt)
+        vos_mem_free(fils_info->fils_erp_reauth_pkt);
+    if (fils_info->fils_r_rk)
+        vos_mem_free(fils_info->fils_r_rk);
+    if (fils_info->fils_r_ik)
+        vos_mem_free(fils_info->fils_r_ik);
+    if (fils_info->fils_eap_finish_pkt)
+        vos_mem_free(fils_info->fils_eap_finish_pkt);
+    if (fils_info->fils_rmsk)
+        vos_mem_free(fils_info->fils_rmsk);
+    if (fils_info->fils_pmk)
+        vos_mem_free(fils_info->fils_pmk);
+    if (fils_info->auth_info.keyname)
+        vos_mem_free(fils_info->auth_info.keyname);
+    if (fils_info->auth_info.domain_name)
+        vos_mem_free(fils_info->auth_info.domain_name);
+    vos_mem_zero(fils_info->ick, MAX_ICK_LEN);
+    vos_mem_zero(fils_info->kek, MAX_KEK_LEN);
+    vos_mem_zero(fils_info->tk, MAX_TK_LEN);
+    vos_mem_zero(fils_info->key_auth, MAX_KEY_AUTH_DATA_LEN);
+    vos_mem_zero(fils_info->ap_key_auth_data, MAX_KEY_AUTH_DATA_LEN);
+    vos_mem_zero(fils_info->gtk, MAX_GTK_LEN);
+    vos_mem_zero(fils_info->igtk, MAX_IGTK_LEN);
+    vos_mem_zero(fils_info->ipn, IPN_LEN);
+
+    vos_mem_free(fils_info);
+    session->fils_info = NULL;
+}
+/**
+ * pe_init_fils_info: API to initialize fils session info elements to null
+ * @session: pe session
+ *
+ * Return: void
+ */
+static void pe_init_fils_info(tpPESession session)
+{
+    struct pe_fils_session *fils_info;
+
+    if (!session || (session && !session->valid)) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_DEBUG,
+              FL("session is not valid"));
+        return;
+    }
+    session->fils_info = vos_mem_malloc(sizeof(struct pe_fils_session));
+    fils_info = session->fils_info;
+    if (!fils_info) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_DEBUG,
+              FL("fils info not found"));
+        return;
+    }
+
+    vos_mem_set(session->fils_info, sizeof(struct pe_fils_session), 0);
+    fils_info->keyname_nai_data = NULL;
+    fils_info->fils_erp_reauth_pkt = NULL;
+    fils_info->fils_r_rk = NULL;
+    fils_info->fils_r_ik = NULL;
+    fils_info->fils_eap_finish_pkt = NULL;
+    fils_info->fils_rmsk = NULL;
+    fils_info->fils_pmk = NULL;
+    fils_info->auth_info.keyname = NULL;
+    fils_info->auth_info.domain_name = NULL;
+}
+#else
+static void pe_delete_fils_info(tpPESession session) { }
+static void pe_init_fils_info(tpPESession session) { }
+#endif
+
 /*--------------------------------------------------------------------------
 
   \brief peCreateSession() - creates a new PE session given the BSSID
@@ -347,8 +438,7 @@ tpPESession peCreateSession(tpAniSirGlobal pMac,
             VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_DEBUG,
               "Create a new PE session (%d) with BSSID: "
                MAC_ADDRESS_STR " Max No. of STA %d",
-               pMac->lim.gpSession[i].peSessionId,
-               MAC_ADDR_ARRAY(bssid), numSta);
+               *sessionId, MAC_ADDR_ARRAY(bssid), numSta);
             pMac->lim.gpSession[i].roaming_in_progress = false;
 
             /* Initialize PMM Ps Offload Module */
@@ -421,6 +511,8 @@ tpPESession peCreateSession(tpAniSirGlobal pMac,
                 }
             }
 
+            pe_init_fils_info(&pMac->lim.gpSession[i]);
+
             return(&pMac->lim.gpSession[i]);
         }
     }
@@ -826,7 +918,7 @@ void peDeleteSession(tpAniSirGlobal pMac, tpPESession psessionEntry)
 
 #ifdef WLAN_FEATURE_11W
     /* if PMF connection */
-    if (psessionEntry->limRmfEnabled) {
+    if (psessionEntry->limRmfEnabled && LIM_IS_STA_ROLE(psessionEntry)) {
         vos_timer_destroy(&psessionEntry->pmfComebackTimer);
     }
 #endif
@@ -836,6 +928,8 @@ void peDeleteSession(tpAniSirGlobal pMac, tpPESession psessionEntry)
 
     psessionEntry->access_policy_vendor_ie = NULL;
 
+    pe_delete_fils_info(psessionEntry);
+
     psessionEntry->valid = FALSE;
 
     if (LIM_IS_AP_ROLE(psessionEntry))
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSmeReqUtils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSmeReqUtils.c
index 5c83a931026..b5335d6188e 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSmeReqUtils.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSmeReqUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,7 +39,7 @@
  */
 
 #include "wniApi.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "cfgApi.h"
 #include "sirApi.h"
 #include "schApi.h"
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTimerUtils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTimerUtils.c
index 189ea21d43f..c4c4a0fda3b 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTimerUtils.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTimerUtils.c
@@ -923,7 +923,16 @@ limAssocFailureTimerHandler(void *pMacGlobal, tANI_U32 param)
        (pMac->lim.pSessionEntry->limMlmState == eLIM_MLM_WT_FT_REASSOC_RSP_STATE))
     {
         limLog(pMac, LOGE, FL("Reassoc timeout happened"));
-        if(pMac->lim.reAssocRetryAttempt < LIM_MAX_REASSOC_RETRY_LIMIT)
+#ifdef FEATURE_WLAN_ESE
+	if (((pMac->lim.pSessionEntry->isESEconnection) &&
+             (pMac->lim.reAssocRetryAttempt <
+             (LIM_MAX_REASSOC_RETRY_LIMIT - 1)))||
+             ((!pMac->lim.pSessionEntry->isESEconnection) &&
+             (pMac->lim.reAssocRetryAttempt < LIM_MAX_REASSOC_RETRY_LIMIT))
+	   )
+#else
+        if (pMac->lim.reAssocRetryAttempt < LIM_MAX_REASSOC_RETRY_LIMIT)
+#endif
         {
             limSendRetryReassocReqFrame(pMac, pMac->lim.pSessionEntry->pLimMlmReassocRetryReq, pMac->lim.pSessionEntry);
             pMac->lim.reAssocRetryAttempt++;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTrace.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTrace.c
index 8ad0e21d9cc..f0d1218359f 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTrace.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTrace.c
@@ -151,19 +151,19 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
 
     switch (pRecord->code) {
         case TRACE_CODE_MLM_STATE:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "MLM State:", limTraceGetMlmStateString((tANI_U16)pRecord->data),
               pRecord->data );
             break;
         case TRACE_CODE_SME_STATE:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "SME State:", limTraceGetSmeStateString((tANI_U16)pRecord->data),
               pRecord->data );
             break;
         case TRACE_CODE_TX_MGMT:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "TX Mgmt:", frameSubtypeStr[pRecord->data], pRecord->data);
             break;
@@ -176,7 +176,7 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
             }
             else
             {
-                limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(%d) SN: %d",
+                limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(%d) SN: %d",
                   recIndex, pRecord->time, pRecord->session,
                   "RX Mgmt:",
                   frameSubtypeStr[LIM_TRACE_GET_SUBTYPE(pRecord->data)],
@@ -185,7 +185,7 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
             }
             break;
         case TRACE_CODE_RX_MGMT_DROP:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(%d)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(%d)",
               recIndex, pRecord->time, pRecord->session,
               "Drop RX Mgmt:",
               __limTraceGetMgmtDropReasonString((tANI_U16)pRecord->data),
@@ -194,26 +194,26 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
 
 
         case TRACE_CODE_RX_MGMT_TSF:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s0x%x(%d)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s0x%x(%d)",
               recIndex, pRecord->time, pRecord->session,
               "RX Mgmt TSF:", " ", pRecord->data, pRecord->data );
             break;
 
         case TRACE_CODE_TX_COMPLETE:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %d" ,
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %d" ,
               recIndex, pRecord->time, pRecord->session,
              "TX Complete", pRecord->data );
             break;
 
         case TRACE_CODE_TX_SME_MSG:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "TX SME Msg:",
               macTraceGetSmeMsgString((tANI_U16)pRecord->data),
               pRecord->data );
             break;
         case TRACE_CODE_RX_SME_MSG:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               LIM_TRACE_GET_DEFRD_OR_DROPPED(pRecord->data) ?
               "Def/Drp LIM Msg:": "RX Sme Msg:",
@@ -222,7 +222,7 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
             break;
 
         case TRACE_CODE_TX_WDA_MSG:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "TX WDA Msg:",
               macTraceGetWdaMsgString((tANI_U16)pRecord->data),
@@ -230,7 +230,7 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
             break;
 
         case TRACE_CODE_RX_WDA_MSG:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               LIM_TRACE_GET_DEFRD_OR_DROPPED(pRecord->data) ?
               "Def/Drp LIM Msg:": "RX WDA Msg:",
@@ -239,14 +239,14 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
             break;
 
         case TRACE_CODE_TX_LIM_MSG:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "TX LIM Msg:",
               macTraceGetLimMsgString((tANI_U16)pRecord->data),
               pRecord->data );
             break;
         case TRACE_CODE_RX_LIM_MSG:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               LIM_TRACE_GET_DEFRD_OR_DROPPED(pRecord->data) ?
               "Def/Drp LIM Msg:": "RX LIM Msg",
@@ -254,14 +254,14 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
               pRecord->data );
             break;
         case TRACE_CODE_TX_CFG_MSG:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "TX CFG Msg:",
               macTraceGetCfgMsgString((tANI_U16)pRecord->data),
               pRecord->data );
             break;
         case TRACE_CODE_RX_CFG_MSG:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               LIM_TRACE_GET_DEFRD_OR_DROPPED(pRecord->data) ?
               "Def/Drp LIM Msg:": "RX CFG Msg:",
@@ -271,14 +271,14 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
             break;
 
         case TRACE_CODE_TIMER_ACTIVATE:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "Timer Actvtd",
               __limTraceGetTimerString((tANI_U16)pRecord->data),
               pRecord->data );
             break;
         case TRACE_CODE_TIMER_DEACTIVATE:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "Timer DeActvtd",
               __limTraceGetTimerString((tANI_U16)pRecord->data),
@@ -286,14 +286,14 @@ void limTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord, tANI_U16 recInd
             break;
 
         case TRACE_CODE_INFO_LOG:
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "INFORMATION_LOG",
               macTraceGetInfoLogString((tANI_U16)pRecord->data),
               pRecord->data );
             break;
         default :
-            limLog(pMac, LOG1, "%04d %012llu S%d %-14s(%d) (0x%x)",
+            limLog(pMac, LOG1, "%04d %s S%d %-14s(%d) (0x%x)",
               recIndex, pRecord->time, pRecord->session,
               "Unknown Code", pRecord->code, pRecord->data );
             break;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTypes.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTypes.h
index aa5f6dce24e..f46dd6c0990 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTypes.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limTypes.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -90,13 +90,6 @@
 #define LIM_MLM_SETKEYS_CNF         (LIM_MLM_MSG_START + 25)
 #define LIM_MLM_LINK_TEST_STOP_REQ  (LIM_MLM_MSG_START + 30)
 #define LIM_MLM_PURGE_STA_IND       (LIM_MLM_MSG_START + 31)
-#define LIM_MLM_ADDBA_REQ           (LIM_MLM_MSG_START + 32)
-#define LIM_MLM_ADDBA_CNF           (LIM_MLM_MSG_START + 33)
-#define LIM_MLM_ADDBA_IND           (LIM_MLM_MSG_START + 34)
-#define LIM_MLM_ADDBA_RSP           (LIM_MLM_MSG_START + 35)
-#define LIM_MLM_DELBA_REQ           (LIM_MLM_MSG_START + 36)
-#define LIM_MLM_DELBA_CNF           (LIM_MLM_MSG_START + 37)
-#define LIM_MLM_DELBA_IND           (LIM_MLM_MSG_START + 38)
 #define LIM_MLM_REMOVEKEY_REQ  (LIM_MLM_MSG_START + 39)
 #define LIM_MLM_REMOVEKEY_CNF  (LIM_MLM_MSG_START + 40)
 
@@ -206,8 +199,13 @@ typedef struct sLimMlmScanCnf
 {
     tSirResultCodes         resultCode;
     tANI_U16                scanResultLength;
-    tSirBssDescription      bssDescription[1];
     tANI_U8                 sessionId;
+    tSirBssDescription      bssDescription[1];
+    /*
+     * WARNING: Pls make bssDescription as last variable in struct
+     * tLimMlmScanCnf as it has ieFields followed after this bss
+     * description. Adding a variable after this corrupts the ieFields
+     */
 } tLimMlmScanCnf, *tpLimMlmScanCnf;
 
 typedef struct sLimScanResult
@@ -263,6 +261,18 @@ typedef struct sLimMlmAssocInd
     tANI_U32             assocReqLength;
     tANI_U8*             assocReqPtr;
     tSirSmeChanInfo      chan_info;
+    uint8_t              ecsa_capable;
+    bool                 ampdu;
+    bool                 sgi_enable;
+    bool                 tx_stbc;
+    bool                 rx_stbc;
+    tSirMacHTChannelWidth ch_width;
+    enum sir_sme_phy_mode mode;
+    uint8_t              max_supp_idx;
+    uint8_t              max_ext_idx;
+    uint8_t              max_mcs_idx;
+    uint8_t              rx_mcs_map;
+    uint8_t              tx_mcs_map;
 } tLimMlmAssocInd, *tpLimMlmAssocInd;
 
 typedef struct sLimMlmReassocReq
@@ -303,6 +313,7 @@ typedef struct sLimMlmReassocInd
     tANI_U8*             beaconPtr;
     tANI_U32             assocReqLength;
     tANI_U8*             assocReqPtr;
+    uint8_t              ecsa_capable;
 } tLimMlmReassocInd, *tpLimMlmReassocInd;
 
 typedef struct sLimMlmAuthCnf
@@ -687,6 +698,8 @@ void limSendDeauthMgmtFrame(tpAniSirGlobal, tANI_U16, tSirMacAddr, tpPESession,
 void limSendSmeDisassocDeauthNtf(tpAniSirGlobal pMac, eHalStatus status,
                                  tANI_U32 *pCtx);
 
+void limDoSendAuthMgmtFrame(tpAniSirGlobal, tpPESession);
+
 void limContinueChannelScan(tpAniSirGlobal);
 tSirResultCodes limMlmAddBss(tpAniSirGlobal, tLimMlmStartReq *,tpPESession psessionEntry);
 
@@ -773,12 +786,6 @@ void limSetChannel(tpAniSirGlobal pMac, tANI_U8 channel, tANI_U8 secChannelOffse
 /// Function that completes channel scan
 void limCompleteMlmScan(tpAniSirGlobal, tSirResultCodes);
 
-#ifdef FEATURE_OEM_DATA_SUPPORT
-/* Function that sets system into meas mode for oem data req */
-void limSetOemDataReqMode(tpAniSirGlobal pMac, eHalStatus status, tANI_U32* data);
-#endif
-
-
 /// Function that sends TPC Request action frame
 void limSendTpcRequestFrame(tpAniSirGlobal, tSirMacAddr, tpPESession psessionEntry);
 
@@ -825,15 +832,6 @@ void limSuspendLink(tpAniSirGlobal, tSirLinkTrafficCheck, SUSPEND_RESUME_LINK_CA
 void limResumeLink(tpAniSirGlobal, SUSPEND_RESUME_LINK_CALLBACK, tANI_U32*);
 //end WLAN_SUSPEND_LINK Related
 
-tSirRetStatus limSendAddBAReq( tpAniSirGlobal pMac,
-    tpLimMlmAddBAReq pMlmAddBAReq,tpPESession);
-
-tSirRetStatus limSendAddBARsp( tpAniSirGlobal pMac,
-    tpLimMlmAddBARsp pMlmAddBARsp,tpPESession);
-
-tSirRetStatus limSendDelBAInd( tpAniSirGlobal pMac,
-    tpLimMlmDelBAReq pMlmDelBAReq ,tpPESession psessionEntry);
-
 void limProcessMlmHalAddBARsp( tpAniSirGlobal pMac,
     tpSirMsgQ limMsgQ );
 
@@ -972,57 +970,6 @@ limGetCurrentScanChannel(tpAniSirGlobal pMac)
     return (*(pChanNum + pMac->lim.gLimCurrentScanChannelId));
 } /*** end limGetCurrentScanChannel() ***/
 
-
-
-/**
- * limGetIElenFromBssDescription()
- *
- *FUNCTION:
- * This function is called in various places to get IE length
- * from tSirBssDescription structure
- * number being scanned.
- *
- *PARAMS:
- *
- *LOGIC:
- *
- *ASSUMPTIONS:
- * NA
- *
- *NOTE:
- * NA
- *
- * @param     pBssDescr
- * @return    Total IE length
- */
-
-static inline tANI_U16
-limGetIElenFromBssDescription(tpSirBssDescription pBssDescr)
-{
-    uint16_t ielen;
-
-    if (!pBssDescr)
-        return 0;
-
-    /**
-     * Length of BSS desription is without length of
-     * length itself and length of pointer
-     * that holds ieFields
-     *
-     * <------------sizeof(tSirBssDescription)-------------------->
-     * +--------+---------------------------------+---------------+
-     * | length | other fields                    | pointer to IEs|
-     * +--------+---------------------------------+---------------+
-     *                                            ^
-     *                                            ieFields
-     */
-
-    ielen = ((tANI_U16) (pBssDescr->length + sizeof(pBssDescr->length) +
-                   sizeof(tANI_U32 *) - sizeof(tSirBssDescription)));
-
-    return ielen;
-} /*** end limGetIElenFromBssDescription() ***/
-
 /**
  * limSendBeaconInd()
  *
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limUtils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limUtils.c
index 1641ef67204..cb1e80b15a6 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limUtils.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limUtils.c
@@ -61,7 +61,7 @@
 
 #include "pmmApi.h"
 #ifdef WLAN_FEATURE_11W
-#include "wniCfgAp.h"
+#include "wni_cfg.h"
 #endif
 
 #ifdef SAP_AUTH_OFFLOAD
@@ -1036,7 +1036,7 @@ tANI_U8 limWriteDeferredMsgQ(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
             vos_flush_logs(WLAN_LOG_TYPE_NON_FATAL,
                            WLAN_LOG_INDICATOR_HOST_DRIVER,
                            WLAN_LOG_REASON_QUEUE_FULL,
-                           true);
+                           DUMP_VOS_TRACE);
         }
         else
         {
@@ -2088,9 +2088,10 @@ void limProcessChannelSwitchTimeout(tpAniSirGlobal pMac)
     tANI_U8    channel; // This is received and stored from channelSwitch Action frame
     tANI_U8 isSessionPowerActive = false;
 
-    if((psessionEntry = peFindSessionBySessionId(pMac, pMac->lim.limTimers.gLimChannelSwitchTimer.sessionId))== NULL)
-    {
-        limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
+    psessionEntry = peFindSessionBySessionId(pMac,
+                       pMac->lim.limTimers.gLimChannelSwitchTimer.sessionId);
+    if (!psessionEntry) {
+        limLog(pMac, LOGW, FL("Session Does not exist for given sessionID"));
         return;
     }
 
@@ -2100,6 +2101,13 @@ void limProcessChannelSwitchTimeout(tpAniSirGlobal pMac)
                GET_LIM_SYSTEM_ROLE(psessionEntry));)
         return;
     }
+    if (psessionEntry->gLimSpecMgmt.dot11hChanSwState !=
+                                  eLIM_11H_CHANSW_RUNNING) {
+        limLog(pMac, LOGW,
+            FL("Channel switch timer should not have been running in state %d"),
+            psessionEntry->gLimSpecMgmt.dot11hChanSwState);
+        return;
+    }
 
     if(pMac->psOffloadEnabled)
     {
@@ -2109,7 +2117,6 @@ void limProcessChannelSwitchTimeout(tpAniSirGlobal pMac)
     {
         isSessionPowerActive = limIsSystemInActiveState(pMac);
     }
-
     channel = psessionEntry->gLimChannelSwitch.primaryChannel;
 
     /*
@@ -2169,13 +2176,19 @@ void limProcessChannelSwitchTimeout(tpAniSirGlobal pMac)
             return;
         }
 
-        /* If the channel-list that AP is asking us to switch is invalid,
+        /*
+         * If the channel-list that AP is asking us to switch is invalid,
          * then we cannot switch the channel. Just disassociate from AP.
          * We will find a better AP !!!
          */
-        limTearDownLinkWithAp(pMac,
+        if ((psessionEntry->limMlmState == eLIM_MLM_LINK_ESTABLISHED_STATE) &&
+           (psessionEntry->limSmeState != eLIM_SME_WT_DISASSOC_STATE)&&
+           (psessionEntry->limSmeState != eLIM_SME_WT_DEAUTH_STATE)) {
+              limLog(pMac, LOGE, FL("Invalid channel!! Disconnect.."));
+              limTearDownLinkWithAp(pMac,
                         pMac->lim.limTimers.gLimChannelSwitchTimer.sessionId,
                         eSIR_MAC_UNSPEC_FAILURE_REASON);
+        }
         return;
     }
     limCovertChannelScanType(pMac, psessionEntry->currentOperChannel, false);
@@ -2800,6 +2813,9 @@ void limSwitchPrimaryChannel(tpAniSirGlobal pMac, tANI_U8 newChannel,tpPESession
     pMac->lim.gpchangeChannelCallback = limSwitchChannelCback;
     pMac->lim.gpchangeChannelData = NULL;
 
+    psessionEntry->sub20_channelwidth =
+         psessionEntry->lim_sub20_channel_switch_bandwidth;
+
 #if defined WLAN_FEATURE_VOWIFI
     limSendSwitchChnlParams(pMac, newChannel, PHY_SINGLE_CHANNEL_CENTERED,
                             psessionEntry->maxTxPower,
@@ -2860,6 +2876,9 @@ void limSwitchPrimarySecondaryChannel(tpAniSirGlobal pMac, tpPESession psessionE
     pMac->lim.gpchangeChannelCallback = limSwitchChannelCback;
     pMac->lim.gpchangeChannelData = NULL;
 
+    psessionEntry->sub20_channelwidth =
+         psessionEntry->lim_sub20_channel_switch_bandwidth;
+
 #if defined WLAN_FEATURE_VOWIFI
                 limSendSwitchChnlParams(pMac, newChannel, subband,
                                         psessionEntry->maxTxPower,
@@ -4080,23 +4099,23 @@ limEnableHT20Protection(tpAniSirGlobal pMac, tANI_U8 enable,
     if(!psessionEntry->htCapability)
         return eSIR_SUCCESS; // this protection  is only for HT stations.
 
-        //overlapping protection configuration check.
-        if(overlap) {
-        } else {
-            //normal protection config check
-            if (LIM_IS_AP_ROLE(psessionEntry) &&
-                !psessionEntry->cfgProtection.ht20) {
+    //overlapping protection configuration check.
+    if(overlap) {
+    } else {
+        //normal protection config check
+        if (LIM_IS_AP_ROLE(psessionEntry) &&
+            !psessionEntry->cfgProtection.ht20) {
+            // protection disabled.
+            PELOG3(limLog(pMac, LOG3, FL("protection from HT20 is disabled"));)
+            return eSIR_SUCCESS;
+        } else if (!LIM_IS_AP_ROLE(psessionEntry)) {
+            if (!pMac->lim.cfgProtection.ht20) {
                 // protection disabled.
                 PELOG3(limLog(pMac, LOG3, FL("protection from HT20 is disabled"));)
                 return eSIR_SUCCESS;
-            } else if (!LIM_IS_AP_ROLE(psessionEntry)) {
-                if (!pMac->lim.cfgProtection.ht20) {
-                    // protection disabled.
-                    PELOG3(limLog(pMac, LOG3, FL("protection from HT20 is disabled"));)
-                    return eSIR_SUCCESS;
-                }
             }
         }
+    }
 
     if (enable) {
         //If we are AP and HT capable, we need to set the HT OP mode
@@ -4284,24 +4303,24 @@ limEnableHTNonGfProtection(tpAniSirGlobal pMac, tANI_U8 enable,
     if(!psessionEntry->htCapability)
         return eSIR_SUCCESS; // this protection  is only for HT stations.
 
-        //overlapping protection configuration check.
-        if(overlap) {
-        } else {
+    //overlapping protection configuration check.
+    if(overlap) {
+    } else {
+        //normal protection config check
+        if (LIM_IS_AP_ROLE(psessionEntry) &&
+            !psessionEntry->cfgProtection.nonGf) {
+            // protection disabled.
+            PELOG3(limLog(pMac, LOG3, FL("protection from NonGf is disabled"));)
+            return eSIR_SUCCESS;
+        } else if(!LIM_IS_AP_ROLE(psessionEntry)) {
             //normal protection config check
-            if (LIM_IS_AP_ROLE(psessionEntry) &&
-                !psessionEntry->cfgProtection.nonGf) {
+            if (!pMac->lim.cfgProtection.nonGf) {
                 // protection disabled.
                 PELOG3(limLog(pMac, LOG3, FL("protection from NonGf is disabled"));)
                 return eSIR_SUCCESS;
-            } else if(!LIM_IS_AP_ROLE(psessionEntry)) {
-                //normal protection config check
-                if (!pMac->lim.cfgProtection.nonGf) {
-                    // protection disabled.
-                    PELOG3(limLog(pMac, LOG3, FL("protection from NonGf is disabled"));)
-                    return eSIR_SUCCESS;
-                }
             }
         }
+    }
 
     if (LIM_IS_AP_ROLE(psessionEntry)) {
         if ((enable) && (false == psessionEntry->beaconParams.llnNonGFCoexist))
@@ -4349,24 +4368,24 @@ limEnableHTLsigTxopProtection(tpAniSirGlobal pMac, tANI_U8 enable,
     if(!psessionEntry->htCapability)
         return eSIR_SUCCESS; // this protection  is only for HT stations.
 
-        //overlapping protection configuration check.
-        if(overlap) {
-        } else {
+    //overlapping protection configuration check.
+    if(overlap) {
+    } else {
+        //normal protection config check
+        if (LIM_IS_AP_ROLE(psessionEntry) &&
+           !psessionEntry->cfgProtection.lsigTxop) {
+            // protection disabled.
+            PELOG3(limLog(pMac, LOG3, FL(" protection from LsigTxop not supported is disabled"));)
+            return eSIR_SUCCESS;
+        } else if(!LIM_IS_AP_ROLE(psessionEntry)) {
             //normal protection config check
-            if (LIM_IS_AP_ROLE(psessionEntry) &&
-               !psessionEntry->cfgProtection.lsigTxop) {
+            if(!pMac->lim.cfgProtection.lsigTxop) {
                 // protection disabled.
                 PELOG3(limLog(pMac, LOG3, FL(" protection from LsigTxop not supported is disabled"));)
                 return eSIR_SUCCESS;
-            } else if(!LIM_IS_AP_ROLE(psessionEntry)) {
-                //normal protection config check
-                if(!pMac->lim.cfgProtection.lsigTxop) {
-                    // protection disabled.
-                    PELOG3(limLog(pMac, LOG3, FL(" protection from LsigTxop not supported is disabled"));)
-                    return eSIR_SUCCESS;
-                }
             }
         }
+    }
 
     if (LIM_IS_AP_ROLE(psessionEntry)) {
         if ((enable) && (false == psessionEntry->beaconParams.fLsigTXOPProtectionFullSupport))
@@ -4415,24 +4434,24 @@ limEnableHtRifsProtection(tpAniSirGlobal pMac, tANI_U8 enable,
         return eSIR_SUCCESS; // this protection  is only for HT stations.
 
 
-        //overlapping protection configuration check.
-        if(overlap) {
-        } else {
-             //normal protection config check
-            if (LIM_IS_AP_ROLE(psessionEntry) &&
-               !psessionEntry->cfgProtection.rifs) {
-                // protection disabled.
-                PELOG3(limLog(pMac, LOG3, FL(" protection from Rifs is disabled"));)
-                return eSIR_SUCCESS;
-            } else if (!LIM_IS_AP_ROLE(psessionEntry)) {
-               //normal protection config check
-               if(!pMac->lim.cfgProtection.rifs) {
-                  // protection disabled.
-                  PELOG3(limLog(pMac, LOG3, FL(" protection from Rifs is disabled"));)
-                  return eSIR_SUCCESS;
-               }
-            }
+    //overlapping protection configuration check.
+    if(overlap) {
+    } else {
+         //normal protection config check
+        if (LIM_IS_AP_ROLE(psessionEntry) &&
+           !psessionEntry->cfgProtection.rifs) {
+            // protection disabled.
+            PELOG3(limLog(pMac, LOG3, FL(" protection from Rifs is disabled"));)
+            return eSIR_SUCCESS;
+        } else if (!LIM_IS_AP_ROLE(psessionEntry)) {
+           //normal protection config check
+           if(!pMac->lim.cfgProtection.rifs) {
+              // protection disabled.
+              PELOG3(limLog(pMac, LOG3, FL(" protection from Rifs is disabled"));)
+              return eSIR_SUCCESS;
+           }
         }
+    }
 
     if (LIM_IS_AP_ROLE(psessionEntry)) {
         // Disabling the RIFS Protection means Enable the RIFS mode of operation in the BSS
@@ -4631,6 +4650,13 @@ void limUpdateStaRunTimeHTSwitchChnlParams( tpAniSirGlobal   pMac,
    if( !limGetHTCapability( pMac, eHT_SUPPORTED_CHANNEL_WIDTH_SET, psessionEntry ))
         return;
 
+   if ((RF_CHAN_14 >= psessionEntry->currentOperChannel) &&
+       psessionEntry->force_24ghz_in_ht20) {
+        limLog(pMac, LOG1,
+               FL("force_24_gh_in_ht20 is set and channel is 2.4 Ghz"));
+        return;
+   }
+
 #if !defined WLAN_FEATURE_VOWIFI
     if(wlan_cfgGetInt(pMac, WNI_CFG_LOCAL_POWER_CONSTRAINT, &localPwrConstraint) != eSIR_SUCCESS) {
         limLog( pMac, LOGP, FL( "Unable to get Local Power Constraint from cfg" ));
@@ -4834,8 +4860,6 @@ tSirRetStatus limProcessHalIndMessages(tpAniSirGlobal pMac, tANI_U32 msgId, void
   switch(msgId)
   {
     case SIR_LIM_DEL_TS_IND:
-    case SIR_LIM_ADD_BA_IND:
-    case SIR_LIM_DEL_BA_ALL_IND:
     case SIR_LIM_DELETE_STA_CONTEXT_IND:
     case SIR_LIM_BEACON_GEN_IND:
       msg.type = (tANI_U16) msgId;
@@ -5021,213 +5045,6 @@ limRegisterHalIndCallBack(tpAniSirGlobal pMac)
     return;
 }
 
-
-/** -------------------------------------------------------------
-\fn limProcessAddBaInd
-
-\brief handles the BA activity check timeout indication coming from HAL.
-         Validates the request, posts request for sending addBaReq message for every candidate in the list.
-\param   tpAniSirGlobal pMac
-\param  tSirMsgQ limMsg
-\return None
--------------------------------------------------------------*/
-void
-limProcessAddBaInd(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
-{
-    tANI_U8             i;
-    tANI_U8             tid;
-    tANI_U16            assocId;
-    tpDphHashNode       pSta;
-    tpAddBaCandidate    pBaCandidate;
-    tANI_U32            baCandidateCnt;
-    tpBaActivityInd     pBaActivityInd;
-    tpPESession         psessionEntry;
-    tANI_U8             sessionId;
-#ifdef FEATURE_WLAN_TDLS
-    boolean             htCapable = FALSE;
-#endif
-
-
-    if (limMsg->bodyptr == NULL)
-        return;
-
-    pBaActivityInd = (tpBaActivityInd)limMsg->bodyptr;
-    baCandidateCnt = pBaActivityInd->baCandidateCnt;
-
-    if ((psessionEntry = peFindSessionByBssid(pMac,pBaActivityInd->bssId,&sessionId))== NULL)
-    {
-        limLog(pMac, LOGE,FL("session does not exist for given BSSId"));
-        vos_mem_free(limMsg->bodyptr);
-        limMsg->bodyptr = NULL;
-        return;
-    }
-
-    //if we are not HT capable we don't need to handle BA timeout indication from HAL.
-#ifdef FEATURE_WLAN_TDLS
-    if ((baCandidateCnt  > pMac->lim.maxStation))
-#else
-    if ((baCandidateCnt  > pMac->lim.maxStation) || !psessionEntry->htCapability )
-#endif
-    {
-        vos_mem_free(limMsg->bodyptr);
-        limMsg->bodyptr = NULL;
-        return;
-    }
-
-#ifdef FEATURE_WLAN_TDLS
-    //if we have TDLS peers, we should look at peers HT capability, which can be different than
-    //AP capability
-    pBaCandidate =  (tpAddBaCandidate) (((tANI_U8*)pBaActivityInd) + sizeof(tBaActivityInd));
-
-    for (i=0; i<baCandidateCnt; i++, pBaCandidate++)
-    {
-       pSta = dphLookupHashEntry(pMac, pBaCandidate->staAddr, &assocId, &psessionEntry->dph.dphHashTable);
-       if ((NULL == pSta) || (!pSta->valid))
-           continue;
-
-       if (STA_ENTRY_TDLS_PEER == pSta->staType)
-           htCapable = pSta->mlmStaContext.htCapability;
-       else
-           htCapable = psessionEntry->htCapability;
-
-       if (htCapable)
-           break;
-    }
-    if (!htCapable)
-    {
-        vos_mem_free(limMsg->bodyptr);
-        limMsg->bodyptr = NULL;
-        return;
-    }
-#endif
-
-    /* Delete the complete dialogue token linked list */
-    limDeleteDialogueTokenList(pMac);
-    pBaCandidate =  (tpAddBaCandidate) (((tANI_U8*)pBaActivityInd) + sizeof(tBaActivityInd));
-
-    for (i=0; i<baCandidateCnt; i++, pBaCandidate++)
-    {
-       pSta = dphLookupHashEntry(pMac, pBaCandidate->staAddr, &assocId, &psessionEntry->dph.dphHashTable);
-       if ((NULL == pSta) || (!pSta->valid))
-           continue;
-
-        for (tid=0; tid<STACFG_MAX_TC; tid++)
-        {
-            if((eBA_DISABLE == pSta->tcCfg[tid].fUseBATx) &&
-                 (pBaCandidate->baInfo[tid].fBaEnable))
-            {
-                limLog(pMac, LOG1, FL("BA setup for staId = %d, TID: %d, SSN: %d"),
-                        pSta->staIndex, tid, pBaCandidate->baInfo[tid].startingSeqNum);
-                limPostMlmAddBAReq(pMac, pSta, tid, pBaCandidate->baInfo[tid].startingSeqNum,psessionEntry);
-            }
-        }
-    }
-    vos_mem_free(limMsg->bodyptr);
-    limMsg->bodyptr = NULL;
-    return;
-}
-
-
-/** -------------------------------------------------------------
-\fn      limDeleteBASessions
-\brief   Deletes all the existing BA sessions for given session
-         and BA direction.
-\param   tpAniSirGlobal pMac
-\param   tpPESession pSessionEntry
-\param   tANI_U32 baDirection
-\return  None
--------------------------------------------------------------*/
-
-void
-limDeleteBASessions(tpAniSirGlobal pMac, tpPESession pSessionEntry,
-                    tANI_U32 baDirection)
-{
-    tANI_U32 i;
-    tANI_U8 tid;
-    tpDphHashNode pSta;
-
-    if (NULL == pSessionEntry)
-    {
-        limLog(pMac, LOGE, FL("Session does not exist"));
-    }
-    else
-    {
-        for(tid = 0; tid < STACFG_MAX_TC; tid++)
-        {
-            if (LIM_IS_AP_ROLE(pSessionEntry) ||
-                LIM_IS_BT_AMP_AP_ROLE(pSessionEntry) ||
-                LIM_IS_IBSS_ROLE(pSessionEntry) ||
-                LIM_IS_P2P_DEVICE_GO(pSessionEntry)) {
-                for (i = 0; i < pMac->lim.maxStation; i++)
-                {
-                    pSta = pSessionEntry->dph.dphHashTable.pDphNodeArray + i;
-                    if (pSta && pSta->added)
-                    {
-                        if ((eBA_ENABLE == pSta->tcCfg[tid].fUseBATx) &&
-                                       (baDirection & BA_INITIATOR))
-                        {
-                            limPostMlmDelBAReq(pMac, pSta, eBA_INITIATOR, tid,
-                                               eSIR_MAC_UNSPEC_FAILURE_REASON,
-                                               pSessionEntry);
-                        }
-                        if ((eBA_ENABLE == pSta->tcCfg[tid].fUseBARx) &&
-                                        (baDirection & BA_RECIPIENT))
-                        {
-                            limPostMlmDelBAReq(pMac, pSta, eBA_RECIPIENT, tid,
-                                               eSIR_MAC_UNSPEC_FAILURE_REASON,
-                                               pSessionEntry);
-                        }
-                    }
-                }
-            } else if (LIM_IS_STA_ROLE(pSessionEntry) ||
-                     LIM_IS_BT_AMP_STA_ROLE(pSessionEntry) ||
-                     LIM_IS_P2P_DEVICE_ROLE(pSessionEntry)) {
-                pSta = dphGetHashEntry(pMac, DPH_STA_HASH_INDEX_PEER,
-                                       &pSessionEntry->dph.dphHashTable);
-                if (pSta && pSta->added)
-                {
-                    if ((eBA_ENABLE == pSta->tcCfg[tid].fUseBATx) &&
-                                    (baDirection & BA_INITIATOR))
-                    {
-                        limPostMlmDelBAReq(pMac, pSta, eBA_INITIATOR, tid,
-                                           eSIR_MAC_UNSPEC_FAILURE_REASON,
-                                           pSessionEntry);
-                    }
-                    if ((eBA_ENABLE == pSta->tcCfg[tid].fUseBARx) &&
-                                    (baDirection & BA_RECIPIENT))
-                    {
-                        limPostMlmDelBAReq(pMac, pSta, eBA_RECIPIENT, tid,
-                                           eSIR_MAC_UNSPEC_FAILURE_REASON,
-                                           pSessionEntry);
-                    }
-                }
-            }
-        }
-    }
-}
-
-/** -------------------------------------------------------------
-\fn     limDelAllBASessions
-\brief  Deletes all the existing BA sessions.
-\param  tpAniSirGlobal pMac
-\return None
--------------------------------------------------------------*/
-
-void limDelAllBASessions(tpAniSirGlobal pMac)
-{
-    tANI_U32 i;
-    tpPESession pSessionEntry;
-
-    for (i = 0; i < pMac->lim.maxBssId; i++)
-    {
-        pSessionEntry = peFindSessionBySessionId(pMac, i);
-        if (pSessionEntry)
-        {
-            limDeleteBASessions(pMac, pSessionEntry, BA_BOTH_DIRECTIONS);
-        }
-    }
-}
-
 /** -------------------------------------------------------------
 \fn limProcessDelTsInd
 \brief Handles the DeleteTS indication coming from HAL or generated by
@@ -5327,520 +5144,6 @@ error1:
 }
 
 /**
- * \brief Setup an A-MPDU/BA session
- *
- * \sa limPostMlmAddBAReq
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pStaDs DPH Hash Node object of peer STA
- *
- * \param tid TID for which a BA is being setup.
- *            If this is set to 0xFFFF, then we retrieve
- *            the default TID from the CFG
- *
- * \return eSIR_SUCCESS if setup completes successfully
- *         eSIR_FAILURE is some problem is encountered
- */
-tSirRetStatus limPostMlmAddBAReq( tpAniSirGlobal pMac,
-    tpDphHashNode pStaDs,
-    tANI_U8 tid, tANI_U16 startingSeqNum,tpPESession psessionEntry)
-{
-    tSirRetStatus status = eSIR_SUCCESS;
-    tpLimMlmAddBAReq pMlmAddBAReq = NULL;
-    tpDialogueToken dialogueTokenNode;
-    tANI_U32        val = 0;
-
-  // Allocate for LIM_MLM_ADDBA_REQ
-  pMlmAddBAReq = vos_mem_malloc(sizeof( tLimMlmAddBAReq ));
-  if ( NULL == pMlmAddBAReq )
-  {
-    limLog( pMac, LOGP, FL("AllocateMemory failed"));
-    status = eSIR_MEM_ALLOC_FAILED;
-    goto returnFailure;
-  }
-
-  vos_mem_set( (void *) pMlmAddBAReq, sizeof( tLimMlmAddBAReq ), 0);
-
-  // Copy the peer MAC
-  vos_mem_copy(
-      pMlmAddBAReq->peerMacAddr,
-      pStaDs->staAddr,
-      sizeof( tSirMacAddr ));
-
-  // Update the TID
-  pMlmAddBAReq->baTID = tid;
-
-  // Determine the supported BA policy of local STA
-  // for the TID of interest
-  pMlmAddBAReq->baPolicy = (pStaDs->baPolicyFlag >> tid) & 0x1;
-
-  // BA Buffer Size
-  // Requesting the ADDBA recipient to populate the size.
-  // If ADDBA is accepted, a non-zero buffer size should
-  // be returned in the ADDBA Rsp
-  if ((TRUE == psessionEntry->isCiscoVendorAP) &&
-        (eHT_CHANNEL_WIDTH_80MHZ != pStaDs->htSupportedChannelWidthSet))
-  {
-     /* Cisco AP has issues in receiving more than 25 "mpdu in ampdu"
-        causing very low throughput in HT40 case */
-     limLog( pMac, LOGW,
-         FL( "Requesting ADDBA with Cisco 1225 AP, window size 25"));
-     pMlmAddBAReq->baBufferSize = MAX_BA_WINDOW_SIZE_FOR_CISCO;
-  }
-  else
-     pMlmAddBAReq->baBufferSize = 0;
-
-  limLog( pMac, LOGW,
-      FL( "Requesting an ADDBA to setup a %s BA session with STA %d for TID %d" ),
-      (pMlmAddBAReq->baPolicy ? "Immediate": "Delayed"),
-      pStaDs->staIndex,
-      tid );
-
-  // BA Timeout
-  if (wlan_cfgGetInt(pMac, WNI_CFG_BA_TIMEOUT, &val) != eSIR_SUCCESS)
-  {
-     limLog(pMac, LOGE, FL("could not retrieve BA TIME OUT Param CFG"));
-     status = eSIR_FAILURE;
-     goto returnFailure;
-  }
-  pMlmAddBAReq->baTimeout = val; // In TU's
-
-  // ADDBA Failure Timeout
-  // FIXME_AMPDU - Need to retrieve this from CFG.
-  //right now we are not checking for response timeout. so this field is dummy just to be compliant with the spec.
-  pMlmAddBAReq->addBAFailureTimeout = 2000; // In TU's
-
-  // BA Starting Sequence Number
-  pMlmAddBAReq->baSSN = startingSeqNum;
-
-  /* Update PE session Id*/
-  pMlmAddBAReq->sessionId = psessionEntry->peSessionId;
-
-  LIM_SET_STA_BA_STATE(pStaDs, tid, eLIM_BA_STATE_WT_ADD_RSP);
-
-  dialogueTokenNode = limAssignDialogueToken(pMac);
-  if (NULL == dialogueTokenNode)
-  {
-     limLog(pMac, LOGE, FL("could not assign dialogue token"));
-     status = eSIR_FAILURE;
-     goto returnFailure;
-  }
-
-  pMlmAddBAReq->baDialogToken = dialogueTokenNode->token;
-  //set assocId and tid information in the lim linked list
-  dialogueTokenNode->assocId = pStaDs->assocId;
-  dialogueTokenNode->tid = tid;
-  // Send ADDBA Req to MLME
-  limPostMlmMessage( pMac,
-      LIM_MLM_ADDBA_REQ,
-      (tANI_U32 *) pMlmAddBAReq );
-  return eSIR_SUCCESS;
-
-returnFailure:
-  vos_mem_free(pMlmAddBAReq);
-  return status;
-}
-
-/**
- * \brief Post LIM_MLM_ADDBA_RSP to MLME. MLME
- * will then send an ADDBA Rsp to peer MAC entity
- * with the appropriate ADDBA status code
- *
- * \sa limPostMlmAddBARsp
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param peerMacAddr MAC address of peer entity that will
- * be the recipient of this ADDBA Rsp
- *
- * \param baStatusCode ADDBA Rsp status code
- *
- * \param baDialogToken ADDBA Rsp dialog token
- *
- * \param baTID TID of interest
- *
- * \param baPolicy The BA policy
- *
- * \param baBufferSize The BA buffer size
- *
- * \param baTimeout BA timeout in TU's
- *
- * \return eSIR_SUCCESS if setup completes successfully
- *         eSIR_FAILURE is some problem is encountered
- */
-tSirRetStatus limPostMlmAddBARsp( tpAniSirGlobal pMac,
-    tSirMacAddr peerMacAddr,
-    tSirMacStatusCodes baStatusCode,
-    tANI_U8 baDialogToken,
-    tANI_U8 baTID,
-    tANI_U8 baPolicy,
-    tANI_U16 baBufferSize,
-    tANI_U16 baTimeout,
-    tpPESession psessionEntry)
-{
-tSirRetStatus status = eSIR_SUCCESS;
-tpLimMlmAddBARsp pMlmAddBARsp;
-
-  // Allocate for LIM_MLM_ADDBA_RSP
-  pMlmAddBARsp = vos_mem_malloc(sizeof( tLimMlmAddBARsp ));
-  if ( NULL == pMlmAddBARsp )
-  {
-    limLog( pMac, LOGE,
-        FL("AllocateMemory failed with error code %d"),
-        status );
-
-    status = eSIR_MEM_ALLOC_FAILED;
-    goto returnFailure;
-  }
-
-  vos_mem_set( (void *) pMlmAddBARsp, sizeof( tLimMlmAddBARsp ), 0);
-
-  // Copy the peer MAC
-  vos_mem_copy(
-      pMlmAddBARsp->peerMacAddr,
-      peerMacAddr,
-      sizeof( tSirMacAddr ));
-
-  pMlmAddBARsp->baDialogToken = baDialogToken;
-  pMlmAddBARsp->addBAResultCode = baStatusCode;
-  pMlmAddBARsp->baTID = baTID;
-  pMlmAddBARsp->baPolicy = baPolicy;
-  pMlmAddBARsp->baBufferSize = baBufferSize;
-  pMlmAddBARsp->baTimeout = baTimeout;
-
-  /* UPdate PE session ID*/
-  pMlmAddBARsp->sessionId = psessionEntry->peSessionId;
-
-  // Send ADDBA Rsp to MLME
-  limPostMlmMessage( pMac,
-      LIM_MLM_ADDBA_RSP,
-      (tANI_U32 *) pMlmAddBARsp );
-
-returnFailure:
-
-  return status;
-}
-
-/**
- * \brief Post LIM_MLM_DELBA_REQ to MLME. MLME
- * will then send an DELBA Ind to peer MAC entity
- * with the appropriate DELBA status code
- *
- * \sa limPostMlmDelBAReq
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pSta DPH Hash Node object of peer MAC entity
- * for which the BA session is being deleted
- *
- * \param baDirection DELBA direction
- *
- * \param baTID TID for which the BA session is being deleted
- *
- * \param baReasonCode DELBA Req reason code
- *
- * \return eSIR_SUCCESS if setup completes successfully
- *         eSIR_FAILURE is some problem is encountered
- */
-tSirRetStatus limPostMlmDelBAReq( tpAniSirGlobal pMac,
-    tpDphHashNode pSta,
-    tANI_U8 baDirection,
-    tANI_U8 baTID,
-    tSirMacReasonCodes baReasonCode,
-    tpPESession psessionEntry)
-{
-tSirRetStatus status = eSIR_SUCCESS;
-tpLimMlmDelBAReq pMlmDelBAReq;
-tLimBAState curBaState;
-
-if(NULL == pSta)
-    return eSIR_FAILURE;
-
-LIM_GET_STA_BA_STATE(pSta, baTID, &curBaState);
-
-  // Need to validate the current BA State.
-  if( eLIM_BA_STATE_IDLE != curBaState)
-  {
-    limLog( pMac, LOGE,
-        FL( "Received unexpected DELBA REQ when STA BA state for tid = %d is %d" ),
-        baTID,
-        curBaState);
-
-    status = eSIR_FAILURE;
-    goto returnFailure;
-  }
-
-  // Allocate for LIM_MLM_DELBA_REQ
-  pMlmDelBAReq = vos_mem_malloc(sizeof( tLimMlmDelBAReq ));
-  if ( NULL == pMlmDelBAReq )
-  {
-    limLog( pMac, LOGE,
-        FL("AllocateMemory failed with error code %d"),
-        status );
-
-    status = eSIR_MEM_ALLOC_FAILED;
-    goto returnFailure;
-  }
-
-  vos_mem_set( (void *) pMlmDelBAReq, sizeof( tLimMlmDelBAReq ), 0);
-
-  // Copy the peer MAC
-  vos_mem_copy(
-      pMlmDelBAReq->peerMacAddr,
-      pSta->staAddr,
-      sizeof( tSirMacAddr ));
-
-  pMlmDelBAReq->baDirection = baDirection;
-  pMlmDelBAReq->baTID = baTID;
-  pMlmDelBAReq->delBAReasonCode = baReasonCode;
-
-  /* Update PE session ID*/
-  pMlmDelBAReq->sessionId = psessionEntry->peSessionId;
-
-  //we don't have valid BA session for the given direction.
-  // HDD wants to get the BA session deleted on PEER in this case.
-  // in this case we just need to send DelBA to the peer.
-  if(((eBA_RECIPIENT == baDirection) && (eBA_DISABLE == pSta->tcCfg[baTID].fUseBARx)) ||
-      ((eBA_INITIATOR == baDirection) && (eBA_DISABLE == pSta->tcCfg[baTID].fUseBATx)))
-  {
-        // Send DELBA Ind over the air
-        if( eSIR_SUCCESS !=
-            (status = limSendDelBAInd( pMac, pMlmDelBAReq,psessionEntry)))
-          status = eSIR_FAILURE;
-
-        vos_mem_free(pMlmDelBAReq);
-        return status;
-  }
-
-
-  // Update the BA state in STA
-  LIM_SET_STA_BA_STATE(pSta, pMlmDelBAReq->baTID, eLIM_BA_STATE_WT_DEL_RSP);
-
-  // Send DELBA Req to MLME
-  limPostMlmMessage( pMac,
-      LIM_MLM_DELBA_REQ,
-      (tANI_U32 *) pMlmDelBAReq );
-
-returnFailure:
-
-  return status;
-}
-
-/**
- * \brief Send WDA_ADDBA_REQ to HAL, in order
- * to setup a new BA session with a peer
- *
- * \sa limPostMsgAddBAReq
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pSta Runtime, STA-related configuration cached
- * in the HashNode object
- *
- * \param baDialogToken The Action Frame dialog token
- *
- * \param baTID TID for which the BA session is being setup
- *
- * \param baPolicy BA Policy
- *
- * \param baBufferSize The requested BA buffer size
- *
- * \param baTimeout BA Timeout. 0 indicates no BA timeout enforced
- *
- * \param baSSN Starting Sequence Number for this BA session
- *
- * \param baDirection BA Direction: 1 - Initiator, 0 - Recipient
- *
- * \return none
- *
- */
-tSirRetStatus limPostMsgAddBAReq( tpAniSirGlobal pMac,
-    tpDphHashNode pSta,
-    tANI_U8 baDialogToken,
-    tANI_U8 baTID,
-    tANI_U8 baPolicy,
-    tANI_U16 baBufferSize,
-    tANI_U16 baTimeout,
-    tANI_U16 baSSN,
-    tANI_U8 baDirection,
-    tpPESession psessionEntry)
-{
-tpAddBAParams pAddBAParams = NULL;
-tSirRetStatus retCode = eSIR_SUCCESS;
-tSirMsgQ msgQ;
-
-#ifdef WLAN_SOFTAP_VSTA_FEATURE
-  // we can only do BA on "hard" STAs
-  if (!(IS_HWSTA_IDX(pSta->staIndex)))
-  {
-    retCode = eHAL_STATUS_FAILURE;
-    goto returnFailure;
-  }
-#endif //WLAN_SOFTAP_VSTA_FEATURE
-
-  // Allocate for WDA_ADDBA_REQ
-  pAddBAParams = vos_mem_malloc(sizeof( tAddBAParams ));
-  if ( NULL == pAddBAParams )
-  {
-    limLog( pMac, LOGE,
-        FL("AllocateMemory failed")
-         );
-
-    retCode = eSIR_MEM_ALLOC_FAILED;
-    goto returnFailure;
-  }
-
-  vos_mem_set( (void *) pAddBAParams, sizeof( tAddBAParams ), 0);
-
-  // Copy the peer MAC address
-  vos_mem_copy(
-      (void *) pAddBAParams->peerMacAddr,
-      (void *) pSta->staAddr,
-      sizeof( tSirMacAddr ));
-
-  // Populate the REQ parameters
-  pAddBAParams->staIdx = pSta->staIndex;
-  pAddBAParams->baDialogToken = baDialogToken;
-  pAddBAParams->baTID = baTID;
-  pAddBAParams->baPolicy = baPolicy;
-  pAddBAParams->baBufferSize = baBufferSize;
-  pAddBAParams->baTimeout = baTimeout;
-  pAddBAParams->baSSN = baSSN;
-  pAddBAParams->baDirection = baDirection;
-  pAddBAParams->respReqd = 1;
-
-  /* UPdate PE session ID */
-  pAddBAParams->sessionId = psessionEntry->peSessionId;
-
-  // Post WDA_ADDBA_REQ to HAL.
-  msgQ.type = WDA_ADDBA_REQ;
-  msgQ.reserved = 0;
-  msgQ.bodyptr = pAddBAParams;
-  msgQ.bodyval = 0;
-
-  limLog( pMac, LOGW,
-      FL( "Sending WDA_ADDBA_REQ..." ));
-
-  //defer any other message until we get response back.
-  SET_LIM_PROCESS_DEFD_MESGS(pMac, false);
-
-  MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, msgQ.type));
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
-    limDiagEventReport(pMac, WLAN_PE_DIAG_HAL_ADDBA_REQ_EVENT, psessionEntry, 0, 0);
-#endif //FEATURE_WLAN_DIAG_SUPPORT
-
-  if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
-    limLog( pMac, LOGE,
-        FL("Posting WDA_ADDBA_REQ to HAL failed! Reason = %d"),
-        retCode );
-  else
-    return retCode;
-
-returnFailure:
-
-  // Clean-up...
-  if( NULL != pAddBAParams )
-    vos_mem_free( pAddBAParams );
-
-  return retCode;
-
-}
-
-/**
- * \brief Send WDA_DELBA_IND to HAL, in order
- * to delete an existing BA session with peer
- *
- * \sa limPostMsgDelBAInd
- *
- * \param pMac The global tpAniSirGlobal object
- *
- * \param pSta Runtime, STA-related configuration cached
- * in the HashNode object
- *
- * \param baTID TID for which the BA session is being setup
- *
- * \param baDirection Identifies whether the DELBA Ind was
- * sent by the BA initiator or recipient
- *
- * \return none
- *
- */
-tSirRetStatus limPostMsgDelBAInd( tpAniSirGlobal pMac,
-    tpDphHashNode pSta,
-    tANI_U8 baTID,
-    tANI_U8 baDirection,
-    tpPESession psessionEntry)
-{
-tpDelBAParams pDelBAParams = NULL;
-tSirRetStatus retCode = eSIR_SUCCESS;
-tSirMsgQ msgQ;
-
-  // Allocate for SIR_HAL_DELBA_IND
-  pDelBAParams = vos_mem_malloc(sizeof( tDelBAParams ));
-  if ( NULL == pDelBAParams )
-  {
-    limLog( pMac, LOGE,
-        FL("AllocateMemory failed")
-        );
-
-    retCode = eSIR_MEM_ALLOC_FAILED;
-    goto returnFailure;
-  }
-
-  vos_mem_set( (void *) pDelBAParams, sizeof( tDelBAParams ), 0);
-
-  // Populate the REQ parameters
-  pDelBAParams->staIdx = pSta->staIndex;
-  pDelBAParams->baTID = baTID;
-  pDelBAParams->baDirection = baDirection;
-
-  // Post WDA_DELBA_IND to HAL.
-  msgQ.type = WDA_DELBA_IND;
-  msgQ.reserved = 0;
-  msgQ.bodyptr = pDelBAParams;
-  msgQ.bodyval = 0;
-
-  limLog( pMac, LOGW,
-      FL( "Sending SIR_HAL_DELBA_IND..." ));
-
-  MTRACE(macTraceMsgTx(pMac, psessionEntry->peSessionId, msgQ.type));
-#ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM //FEATURE_WLAN_DIAG_SUPPORT
-    limDiagEventReport(pMac, WLAN_PE_DIAG_HAL_DELBA_IND_EVENT, psessionEntry, 0, 0);
-#endif //FEATURE_WLAN_DIAG_SUPPORT
-
-  if( eSIR_SUCCESS != (retCode = wdaPostCtrlMsg( pMac, &msgQ )))
-    limLog( pMac, LOGE,
-        FL("Posting WDA_DELBA_IND to HAL failed! Reason = %d"),
-        retCode );
-  else
-  {
-    // Update LIM's internal cache...
-    if( eBA_INITIATOR == baDirection)
-    {
-      pSta->tcCfg[baTID].fUseBATx = 0;
-      pSta->tcCfg[baTID].txBufSize = 0;
-    }
-    else
-    {
-      pSta->tcCfg[baTID].fUseBARx = 0;
-      pSta->tcCfg[baTID].rxBufSize = 0;
-    }
-
-    return retCode;
-  }
-
-returnFailure:
-
-  // Clean-up...
-  if( NULL != pDelBAParams )
-    vos_mem_free( pDelBAParams );
-
-  return retCode;
-
-}
-
-/**
  * @function :  limPostSMStateUpdate()
  *
  * @brief  :  This function Updates the HAL and Softmac about the change in the STA's SMPS state.
@@ -5978,7 +5281,7 @@ void limAddScanChannelInfo(tpAniSirGlobal pMac, tANI_U8 channelId)
 
 /**
  * lim_add_channel_status_info() - store
- *     chan status info into Global MAC structure
+ * 	chan status info into Global MAC structure
  * @p_mac: Pointer to Global MAC structure
  * @channel_stat: Pointer to chan status info reported by firmware
  * @channel_id: current channel id
@@ -5986,17 +5289,17 @@ void limAddScanChannelInfo(tpAniSirGlobal pMac, tANI_U8 channelId)
  * Return: None
  */
 void lim_add_channel_status_info(tpAniSirGlobal p_mac,
-       struct lim_channel_status *channel_stat, uint8_t channel_id)
+	struct lim_channel_status *channel_stat, uint8_t channel_id)
 {
-       uint8_t i;
-       boolean found = false;
-       struct lim_scan_channel_status *channel_info =
-               &p_mac->lim.scan_channel_status;
-       struct lim_channel_status *channel_status_list =
-               channel_info->channel_status_list;
-       uint8_t total_channel = channel_info->total_channel;
+	uint8_t i;
+	boolean found = false;
+	struct lim_scan_channel_status *channel_info =
+		&p_mac->lim.scan_channel_status;
+	struct lim_channel_status *channel_status_list =
+		channel_info->channel_status_list;
+	uint8_t total_channel = channel_info->total_channel;
 
-       if (ACS_FW_REPORT_PARAM_CONFIGURED) {
+	if (ACS_FW_REPORT_PARAM_CONFIGURED) {
 	    for (i = 0; i < total_channel; i++) {
 		if (channel_status_list[i].channel_id == channel_id) {
 		    if (channel_stat->cmd_flags ==
@@ -6010,6 +5313,8 @@ void lim_add_channel_status_info(tpAniSirGlobal p_mac,
 			    channel_status_list[i].cycle_count;
 			channel_stat->rx_frame_count -=
 			    channel_status_list[i].rx_frame_count;
+			channel_stat->tx_frame_count -=
+			    channel_status_list[i].tx_frame_count;
 			channel_stat->bss_rx_cycle_count -=
 			    channel_status_list[i].bss_rx_cycle_count;
 		    }
@@ -6019,10 +5324,9 @@ void lim_add_channel_status_info(tpAniSirGlobal p_mac,
 			    sizeof(*channel_status_list));
 		    found = true;
 		    break;
-
-               }
-           }
-           if (!found) {
+		}
+	    }
+	    if (!found) {
 		if (total_channel <
 			SIR_MAX_SUPPORTED_ACS_CHANNEL_LIST) {
 		    vos_mem_copy(
@@ -6034,11 +5338,10 @@ void lim_add_channel_status_info(tpAniSirGlobal p_mac,
 		    PELOGW(limLog(p_mac, LOGW,
 				FL("Chan cnt exceed, channel_id=%d"),
 				channel_id);)
- 		}
-
-           }
-       }
-       return;
+		}
+	    }
+	}
+	return;
 }
 
 
@@ -7653,7 +6956,7 @@ void lim_set_ht_caps(tpAniSirGlobal p_mac, tpPESession p_session_entry,
     PopulateDot11fHTCaps(p_mac, p_session_entry, &dot11_ht_cap);
     p_ie = limGetIEPtr(p_mac, p_ie_start, num_bytes, DOT11F_EID_HTCAPS,
                                                     ONE_BYTE);
-    limLog( p_mac, LOG2, FL("p_ie %p dot11_ht_cap.supportedMCSSet[0]=0x%x"),
+    limLog( p_mac, LOG2, FL("p_ie %pK dot11_ht_cap.supportedMCSSet[0]=0x%x"),
             p_ie, dot11_ht_cap.supportedMCSSet[0]);
 
     if(p_ie)
@@ -8147,7 +7450,7 @@ lim_pop_sap_deferred_msg(tpAniSirGlobal pmac, tpPESession sessionentry)
 			TAILQ_REMOVE(&pmac->lim.glim_sap_deferred_msgq.tq_head,
 				pdefermsg, list_elem);
 
-			limLog(pmac, LOGE, FL("pop def msg(H %p T %p)."
+			limLog(pmac, LOGE, FL("pop def msg(H %pK T %pK)."
 			"assid= %d,  %pM"),
 			TAILQ_FIRST(&pmac->lim.glim_sap_deferred_msgq.tq_head),
 			TAILQ_LAST(&pmac->lim.glim_sap_deferred_msgq.tq_head,
@@ -8177,7 +7480,7 @@ lim_push_sap_deferred_msg(tpAniSirGlobal pmac, tpSirMsgQ lim_msgq)
 
 	pdefermsg = vos_mem_malloc(sizeof(*pdefermsg));
 	if (pdefermsg == NULL) {
-		limLog(pmac, LOGE, FL("No mem for push msg %p!"), lim_msgq);
+		limLog(pmac, LOGE, FL("No mem for push msg %pK!"), lim_msgq);
 		vos_mem_free(lim_msgq->bodyptr);
 		return;
 	}
@@ -8187,7 +7490,7 @@ lim_push_sap_deferred_msg(tpAniSirGlobal pmac, tpSirMsgQ lim_msgq)
 	TAILQ_INSERT_TAIL(&pmac->lim.glim_sap_deferred_msgq.tq_head, pdefermsg,
 		list_elem);
 
-	limLog(pmac, LOGW, FL("push def msg(H %p T %p): P %p."),
+	limLog(pmac, LOGW, FL("push def msg(H %pK T %pK): P %pK."),
 			TAILQ_FIRST(&pmac->lim.glim_sap_deferred_msgq.tq_head),
 			TAILQ_LAST(&pmac->lim.glim_sap_deferred_msgq.tq_head,
 			t_slim_deferred_sap_msg_head),
@@ -8507,7 +7810,7 @@ eHalStatus lim_send_ext_cap_ie(tpAniSirGlobal mac_ctx,
 	if (merge && NULL != extra_extcap && extra_extcap->num_bytes > 0) {
 		if (extra_extcap->num_bytes > ext_cap_data.num_bytes)
 			num_bytes = extra_extcap->num_bytes;
-		lim_merge_extcap_struct(&ext_cap_data, extra_extcap);
+		lim_merge_extcap_struct(&ext_cap_data, extra_extcap, true);
 	}
 
 	/* Allocate memory for the WMI request, and copy the parameter */
@@ -8644,10 +7947,10 @@ void lim_update_extcap_struct(tpAniSirGlobal mac_ctx,
 	}
 
 	vos_mem_set((uint8_t *)&out[0], DOT11F_IE_EXTCAP_MAX_LEN, 0);
-	vos_mem_copy(&out[0], &buf[2], DOT11F_IE_EXTCAP_MAX_LEN);
+	vos_mem_copy(&out[0], &buf[2], buf[1]);
 
 	if (DOT11F_PARSE_SUCCESS != dot11fUnpackIeExtCap(mac_ctx, &out[0],
-					DOT11F_IE_EXTCAP_MAX_LEN, dst))
+                                        buf[1], dst))
 		limLog(mac_ctx, LOGE, FL("dot11fUnpackIeExtCap Parse Error "));
 }
 
@@ -8689,24 +7992,43 @@ tSirRetStatus lim_strip_extcap_update_struct(tpAniSirGlobal mac_ctx,
  * lim_merge_extcap_struct() - merge extended capabilities info
  * @dst: destination extended capabilities
  * @src: source extended capabilities
+ * @add: true if add the capabilites, false if strip the capabilites.
  *
- * This function is used to take @src info and merge it with @dst
- * extended capabilities info.
+ * This function is used to take @src info and add/strip it to/from
+ * @dst extended capabilities info.
  *
  * Return: None
  */
 void lim_merge_extcap_struct(tDot11fIEExtCap *dst,
-			     tDot11fIEExtCap *src)
+			     tDot11fIEExtCap *src,
+			     bool add)
 {
 	uint8_t *tempdst = (uint8_t *)dst->bytes;
 	uint8_t *tempsrc = (uint8_t *)src->bytes;
 	uint8_t structlen = member_size(tDot11fIEExtCap, bytes);
 
-	while(tempdst && tempsrc && structlen--) {
-		*tempdst |= *tempsrc;
+	/* Return if @src not present */
+	if (!src->present)
+		return;
+
+	/* Return if strip the capabilites from @dst which not present */
+	if (!dst->present && !add)
+		return;
+
+	/* Merge the capabilites info in other cases */
+	while (tempdst && tempsrc && structlen--) {
+		if (add)
+			*tempdst |= *tempsrc;
+		else
+			*tempdst &= *tempsrc;
 		tempdst++;
 		tempsrc++;
 	}
+	dst->num_bytes = lim_compute_ext_cap_ie_length(dst);
+        if (dst->num_bytes == 0)
+		dst->present = 0;
+	else
+		dst->present = 1;
 }
 
 /**
@@ -8741,24 +8063,23 @@ lim_get_80Mhz_center_channel(uint8_t primary_channel)
 }
 
 /**
- * lim_is_ext_cap_ie_present - checks if ext ie is present
+ * lim_compute_ext_cap_ie_length - compute the length of ext cap ie
+ * based on the bits set
  * @ext_cap: extended IEs structure
  *
- * Return: true if ext IEs are present else false
+ * Return: length of the ext cap ie, 0 means should not present
  */
-bool lim_is_ext_cap_ie_present (struct s_ext_cap *ext_cap)
-{
-	int i, size;
-	uint8_t *tmp_buf;
-
-	tmp_buf = (uint8_t *) ext_cap;
-	size = sizeof(*ext_cap);
+tANI_U8 lim_compute_ext_cap_ie_length (tDot11fIEExtCap *ext_cap) {
+	tANI_U8 i = DOT11F_IE_EXTCAP_MAX_LEN;
 
-	for (i = 0; i < size; i++)
-		if (tmp_buf[i])
-			return true;
+	while (i) {
+		if (ext_cap->bytes[i-1]) {
+			break;
+		}
+		i --;
+	}
 
-	return false;
+	return i;
 }
 
 /**
@@ -8891,3 +8212,23 @@ void lim_parse_beacon_for_tim(tpAniSirGlobal mac_ctx,
 	return;
 }
 
+bool lim_check_if_vendor_oui_match(tpAniSirGlobal mac_ctx,
+                    uint8_t *oui, uint8_t oui_len,
+                   uint8_t *ie, uint8_t ie_len)
+{
+    uint8_t *ptr = ie;
+    uint8_t elem_id = 0;
+
+    if (NULL == ie || 0 == ie_len) {
+        limLog(mac_ctx, LOG1, FL("IE Null or ie len zero %d"), ie_len);
+        return false;
+    }
+
+    elem_id = *ie;
+
+    if (elem_id == IE_EID_VENDOR &&
+        !adf_os_mem_cmp(&ptr[2], oui, oui_len))
+        return true;
+    else
+        return false;
+}
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limUtils.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limUtils.h
index 6b1a5506f56..e36c9132ede 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limUtils.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limUtils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -64,16 +64,6 @@ typedef enum
 // classifier ID is coded as 0-3: tsid, 4-5:direction
 #define LIM_MAKE_CLSID(tsid, dir) (((tsid) & 0x0F) | (((dir) & 0x03) << 4))
 
-#define LIM_SET_STA_BA_STATE(pSta, tid, newVal) \
-{\
-    pSta->baState = ((pSta->baState | (0x3 << tid*2)) & ((newVal << tid*2) | ~(0x3 << tid*2)));\
-}
-
-#define LIM_GET_STA_BA_STATE(pSta, tid, pCurVal)\
-{\
-    *pCurVal = (tLimBAState)(((pSta->baState >> tid*2) & 0x3));\
-}
-
 #define VHT_MCS_3x3_MASK    0x30
 #define VHT_MCS_2x2_MASK    0x0C
 
@@ -354,57 +344,18 @@ tANI_U32 result = 1, i;
   return result;
 }
 
-
-
-tSirRetStatus limPostMlmAddBAReq( tpAniSirGlobal pMac,
-    tpDphHashNode pStaDs,
-    tANI_U8 tid, tANI_U16 startingSeqNum,tpPESession psessionEntry);
-tSirRetStatus limPostMlmAddBARsp( tpAniSirGlobal pMac,
-    tSirMacAddr peerMacAddr,
-    tSirMacStatusCodes baStatusCode,
-    tANI_U8 baDialogToken,
-    tANI_U8 baTID,
-    tANI_U8 baPolicy,
-    tANI_U16 baBufferSize,
-    tANI_U16 baTimeout,
-    tpPESession psessionEntry);
-tSirRetStatus limPostMlmDelBAReq( tpAniSirGlobal pMac,
-    tpDphHashNode pSta,
-    tANI_U8 baDirection,
-    tANI_U8 baTID,
-    tSirMacReasonCodes baReasonCode ,
-    tpPESession psessionEntry);
-tSirRetStatus limPostMsgAddBAReq( tpAniSirGlobal pMac,
-    tpDphHashNode pSta,
-    tANI_U8 baDialogToken,
-    tANI_U8 baTID,
-    tANI_U8 baPolicy,
-    tANI_U16 baBufferSize,
-    tANI_U16 baTimeout,
-    tANI_U16 baSSN,
-    tANI_U8 baDirection,
-    tpPESession psessionEntry);
-tSirRetStatus limPostMsgDelBAInd( tpAniSirGlobal pMac,
-    tpDphHashNode pSta,
-    tANI_U8 baTID,
-    tANI_U8 baDirection,
-    tpPESession psessionEntry);
-
 tSirRetStatus limPostSMStateUpdate(tpAniSirGlobal pMac,
     tANI_U16 StaIdx,
     tSirMacHTMIMOPowerSaveState MIMOPSState,
     tANI_U8 *pPeerStaMac, tANI_U8 sessionId);
 
 void limDeleteStaContext(tpAniSirGlobal pMac, tpSirMsgQ limMsg);
-void limProcessAddBaInd(tpAniSirGlobal pMac, tpSirMsgQ limMsg);
-void limDeleteBASessions(tpAniSirGlobal pMac, tpPESession pSessionEntry, tANI_U32 baDirection);
-void limDelAllBASessions(tpAniSirGlobal pMac);
 void limDeleteDialogueTokenList(tpAniSirGlobal pMac);
 tSirRetStatus limSearchAndDeleteDialogueToken(tpAniSirGlobal pMac, tANI_U8 token, tANI_U16 assocId, tANI_U16 tid);
 void limRessetScanChannelInfo(tpAniSirGlobal pMac);
 void limAddScanChannelInfo(tpAniSirGlobal pMac, tANI_U8 channelId);
 void lim_add_channel_status_info(tpAniSirGlobal p_mac,
-       struct lim_channel_status *channel_stat, uint8_t channel_id);
+	struct lim_channel_status *channel_stat, uint8_t channel_id);
 
 tANI_U8 limGetChannelFromBeacon(tpAniSirGlobal pMac, tpSchBeaconStruct pBeacon);
 tSirNwType limGetNwType(tpAniSirGlobal pMac, tANI_U8 channelNum, tANI_U32 type, tpSchBeaconStruct pBeacon);
@@ -668,10 +619,11 @@ void lim_update_extcap_struct(tpAniSirGlobal mac_ctx, uint8_t *buf,
 			       tDot11fIEExtCap *ext_cap);
 tSirRetStatus lim_strip_extcap_update_struct(tpAniSirGlobal mac_ctx,
 		uint8_t* addn_ie, uint16_t *addn_ielen, tDot11fIEExtCap *dst);
-void lim_merge_extcap_struct(tDot11fIEExtCap *dst, tDot11fIEExtCap *src);
+void lim_merge_extcap_struct(tDot11fIEExtCap *dst, tDot11fIEExtCap *src,
+			bool add);
 uint8_t
 lim_get_80Mhz_center_channel(uint8_t primary_channel);
-bool lim_is_ext_cap_ie_present (struct s_ext_cap *ext_cap);
+tANI_U8 lim_compute_ext_cap_ie_length (tDot11fIEExtCap *ext_cap);
 bool lim_is_robust_mgmt_action_frame(uint8_t action_catagory);
 void lim_update_caps_info_for_bss(tpAniSirGlobal mac_ctx,
 				uint16_t *caps, uint16_t bss_caps);
@@ -680,4 +632,23 @@ void lim_parse_beacon_for_tim(tpAniSirGlobal mac_ctx, uint8_t* rx_packet_info,
 eHalStatus limP2PActionCnf(tpAniSirGlobal mac_ctx,
 				uint32_t tx_complete_success);
 
+void lim_send_chan_switch_action_frame(tpAniSirGlobal mac_ctx,
+	uint16_t new_channel, uint8_t ch_bandwidth,
+	tpPESession session_entry);
+/**
+ * lim_check_if_vendor_oui_match() - Check if the given OUI match in IE buffer
+ * @mac_ctx: MAC context
+ * @ie: IE buffer
+ * @oui: OUI string
+ * @oui_len: length of @oui
+ * @ie_len: length of @ie
+ *
+ * This API is used to check if given vendor OUI
+ * matches in given IE buffer
+ *
+ * Return: True, if mataches. False otherwise
+ */
+bool lim_check_if_vendor_oui_match(tpAniSirGlobal mac_ctx,
+                uint8_t *oui, uint8_t oui_len,
+                uint8_t *ie, uint8_t ie_len);
 #endif /* __LIM_UTILS_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/lim_process_fils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/lim_process_fils.c
new file mode 100644
index 00000000000..5ab7e27bab0
--- /dev/null
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/lim_process_fils.c
@@ -0,0 +1,1867 @@
+/*
+ * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <palTypes.h>
+#include <lim_fils_defs.h>
+#include <lim_process_fils.h>
+#include <limSendMessages.h>
+#include <limTypes.h>
+#include <limUtils.h>
+#include <limPropExtsUtils.h>
+#include <limAssocUtils.h>
+#include <limSession.h>
+#include <ieee80211_defines.h>
+#include <qdf_crypto.h>
+#include <limSerDesUtils.h>
+#ifdef WLAN_FEATURE_FILS_SK
+
+#define SHA256_DIGEST_SIZE 32
+#define SHA384_DIGEST_SIZE 48
+
+#define HMAC_SHA256_CRYPTO_TYPE "hmac(sha256)"
+#define HMAC_SHA386_CRYPTO_TYPE "hmac(sha384)"
+
+int alloc_tfm(uint8_t *type);
+
+#ifdef WLAN_FILS_DEBUG
+/**
+ * lim_fils_data_dump()- dump fils data
+ * @type: Data name
+ * @data: pointer to data buffer
+ * @len: data len
+ *
+ * Return: None
+ */
+void lim_fils_data_dump(char *type, uint8_t *data, uint32_t len)
+{
+
+	VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+			("%s : length %d"), type, len);
+	vos_trace_hex_dump(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO, data, len);
+}
+#else
+static void lim_fils_data_dump(char *type, uint8_t *data, uint32_t len)
+{ }
+#endif
+
+/**
+ * lim_get_crypto_digest_len()- This API return hash length based on crypto type
+ * @type: Crypto type
+ *
+ * Return: hash length
+ */
+static int lim_get_crypto_digest_len(uint8_t *type)
+{
+	if (!strcmp(type, HMAC_SHA386_CRYPTO_TYPE))
+		return SHA384_DIGEST_SIZE;
+	else if (!strcmp(type, HMAC_SHA256_CRYPTO_TYPE))
+		return SHA256_DIGEST_SIZE;
+	return -EINVAL;
+}
+
+/**
+ * lim_get_auth_tag_len()- This API return auth tag len based on crypto suit
+ * used to encrypt erp packet.
+ * @crypto_suite: Crtpto suit
+ *
+ * Return: tag length
+ */
+static uint8_t lim_get_auth_tag_len(enum fils_erp_cryptosuite crypto_suite)
+{
+	switch (crypto_suite) {
+		case HMAC_SHA256_64:
+			return -EINVAL;
+		case HMAC_SHA256_128:
+			return FILS_SHA256_128_AUTH_TAG;
+		case HMAC_SHA256_256:
+			return FILS_SHA256_256_AUTH_TAG;
+		default:
+			return -EINVAL;
+	}
+}
+
+/**
+ * lim_copy_u16_be()- This API reads u16 value from network byte order buffer
+ * @ptr: pointer to buffer
+ *
+ * Return: 16bit value
+ */
+static uint16_t limGetU16_be(uint8_t *buf)
+{
+	return (buf[0] << 8) | buf[1];
+}
+/**
+ * lim_get_crypto_type()- This API returns crypto type based on akm suite used
+ * @akm: akm used for authentication
+ *
+ * Return: Crypto type
+ */
+static uint8_t *lim_get_crypto_type(uint8_t akm)
+{
+	switch (akm) {
+		case eCSR_AUTH_TYPE_FILS_SHA384:
+		case eCSR_AUTH_TYPE_FT_FILS_SHA384:
+			return FILS_SHA384_CRYPTO_TYPE;
+		case eCSR_AUTH_TYPE_FILS_SHA256:
+		case eCSR_AUTH_TYPE_FT_FILS_SHA256:
+		default:
+			return FILS_SHA256_CRYPTO_TYPE;
+	}
+}
+
+/**
+ * lim_get_pmk_length()- This API returns pmk length based on akm used
+ * @akm: akm used for authentication
+ *
+ * Return: PMK length
+ */
+static uint8_t lim_get_pmk_length(int akm_type)
+{
+	switch (akm_type) {
+		case eCSR_AUTH_TYPE_FILS_SHA256:
+		case eCSR_AUTH_TYPE_FT_FILS_SHA256:
+			return FILS_SHA256_PKM_LEN;
+		case eCSR_AUTH_TYPE_FILS_SHA384:
+		case eCSR_AUTH_TYPE_FT_FILS_SHA384:
+			return FILS_SHA384_PKM_LEN;
+		default:
+			return FILS_SHA256_PKM_LEN;
+	}
+}
+
+/**
+ * lim_get_kek_len()- This API returns kek length based on akm used
+ * @akm: akm used for authentication
+ *
+ * Return: KEK length
+ */
+static uint8_t lim_get_kek_len(uint8_t akm)
+{
+	switch (akm) {
+		case eCSR_AUTH_TYPE_FILS_SHA384:
+		case eCSR_AUTH_TYPE_FT_FILS_SHA384:
+			return FILS_SHA384_KEK_LEN;
+		case eCSR_AUTH_TYPE_FILS_SHA256:
+		case eCSR_AUTH_TYPE_FT_FILS_SHA256:
+			return FILS_SHA256_KEK_LEN;
+		default:
+			return FILS_SHA256_KEK_LEN;
+	}
+}
+
+/**
+ * lim_get_tk_len()- This API returns tk length based on cypher used
+ * @akm: cypher used
+ *
+ * Return: TK length
+ */
+static uint8_t lim_get_tk_len(int cypher_suite)
+{
+	switch (cypher_suite) {
+		case eSIR_ED_TKIP:
+			return TK_LEN_TKIP;
+		case eSIR_ED_CCMP:
+			return TK_LEN_CCMP;
+		case eSIR_ED_AES_128_CMAC:
+			return TK_LEN_AES_128_CMAC;
+		default:
+			return 0;
+	}
+}
+
+/**
+ * lim_get_ick_len()- This API returns ick length based on akm used
+ * @akm: akm used for authentication
+ *
+ * Return: ICK length
+ */
+static int lim_get_ick_len(uint8_t akm)
+{
+	switch (akm) {
+		case eCSR_AUTH_TYPE_FILS_SHA384:
+		case eCSR_AUTH_TYPE_FT_FILS_SHA384:
+			return FILS_SHA384_ICK_LEN;
+		case eCSR_AUTH_TYPE_FILS_SHA256:
+		case eCSR_AUTH_TYPE_FT_FILS_SHA256:
+		default:
+			return FILS_SHA256_ICK_LEN;
+	}
+}
+
+/**
+ * lim_get_key_from_prf()- This API returns key data using PRF-X as defined in
+ * 11.6.1.7.2 ieee-80211-2012.
+ * @type: crypto type needs to be used
+ * @secret: key which needs to be used in crypto
+ * @secret_len: key_len of secret
+ * @label: PRF label
+ * @optional_data: Data used for hash
+ * @optional_data_len: data length
+ * @key: key data output
+ * @keylen: key data length
+ *
+ * Return: VOS_STATUS
+ */
+static VOS_STATUS lim_get_key_from_prf(uint8_t *type, uint8_t *secret,
+		uint32_t secret_len, uint8_t *label, uint8_t *optional_data,
+		uint32_t optional_data_len, uint8_t *key, uint32_t keylen)
+{
+	uint8_t count[2];
+	uint8_t *addr[4];
+	uint32_t len[4];
+	uint16_t key_bit_length = keylen * 8;
+	uint8_t key_length[2];
+	uint32_t i = 0, remain_len;
+	uint16_t interation;
+	uint8_t crypto_digest_len = lim_get_crypto_digest_len(type);
+	uint8_t tmp_hash[SHA384_DIGEST_SIZE] = {0};
+
+	addr[0] = count;
+	len[0] = sizeof(count);
+
+	addr[1] = label;
+	len[1] = strlen(label);
+
+	addr[2] = optional_data;
+	len[2] = optional_data_len;
+
+	vos_mem_copy(key_length, &key_bit_length, sizeof(key_bit_length));
+	addr[3] = key_length;
+	len[3] = sizeof(key_length);
+
+	for (interation = 1; i < keylen; interation++) {
+		remain_len = keylen - i;
+		vos_mem_copy(count, &interation, sizeof(interation));
+
+		if (remain_len >= crypto_digest_len)
+			remain_len = crypto_digest_len;
+
+		if(!alloc_tfm(type))
+		{
+			if (qdf_get_hmac_hash(type, secret, secret_len, 4,
+						addr, len, tmp_hash) < 0) {
+				VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+						FL("qdf_get_hmac_hash failed"));
+				return VOS_STATUS_E_FAILURE;
+			}
+		}
+		vos_mem_copy(&key[i], tmp_hash, remain_len);
+		i += crypto_digest_len;
+	}
+	return VOS_STATUS_SUCCESS;
+}
+
+#define MAX_PRF_INTERATIONS_COUNT 255
+
+/**
+ * lim_default_hmac_sha256_kdf()- This API calculates key data using default kdf
+ * defined in RFC4306.
+ * @secret: key which needs to be used in crypto
+ * @secret_len: key_len of secret
+ * @label: PRF label
+ * @optional_data: Data used for hash
+ * @optional_data_len: data length
+ * @key: key data output
+ * @keylen: key data length
+ *
+ * This API creates default KDF as defined in RFC4306
+ * PRF+ (K,S) = T1 | T2 | T3 | T4 | ...
+ * T1 = PRF (K, S | 0x01)
+ * T2 = PRF (K, T1 | S | 0x02)
+ * T3 = PRF (K, T2 | S | 0x03)
+ * T4 = PRF (K, T3 | S | 0x04)
+ *
+ * for every iteration its creates 32 bit of hash
+ *
+ * Return: VOS_STATUS
+ */
+	static VOS_STATUS
+lim_default_hmac_sha256_kdf(uint8_t *secret, uint32_t secret_len,
+		uint8_t *label, uint8_t *optional_data,
+		uint32_t optional_data_len, uint8_t *key, uint32_t keylen)
+{
+	uint8_t tmp_hash[SHA256_DIGEST_SIZE] = {0};
+	uint8_t count = 1;
+	uint8_t *addr[4];
+	uint32_t len[4];
+	uint32_t current_position = 0, remaining_data = SHA256_DIGEST_SIZE;
+
+	addr[0] = tmp_hash;
+	len[0] = SHA256_DIGEST_SIZE;
+	addr[1] = label;
+	len[1] = strlen(label) + 1;
+	addr[2] = optional_data;
+	len[2] = optional_data_len;
+	addr[3] = &count;
+	len[3] = 1;
+
+	if (keylen == 0 ||
+			(keylen > (MAX_PRF_INTERATIONS_COUNT * SHA256_DIGEST_SIZE))) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("invalid key length %d"), keylen);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	if(!alloc_tfm(FILS_SHA256_CRYPTO_TYPE))
+	{
+		/* Create T1 */
+		if (qdf_get_hmac_hash(FILS_SHA256_CRYPTO_TYPE, secret, secret_len, 3,
+					&addr[1], &len[1], tmp_hash) < 0) {
+			VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+					FL("failed to get hmac hash"));
+			return VOS_STATUS_E_FAILURE;
+		}
+	}
+	/* Update hash from tmp_hash */
+	vos_mem_copy(key + current_position, tmp_hash, remaining_data);
+	current_position += remaining_data;
+
+	for (count = 2; current_position < keylen; count++) {
+		remaining_data = keylen - current_position;
+		if (remaining_data > SHA256_DIGEST_SIZE)
+			remaining_data = SHA256_DIGEST_SIZE;
+
+		if(!alloc_tfm(FILS_SHA256_CRYPTO_TYPE))
+		{
+			/* Create T-n */
+			if (qdf_get_hmac_hash(FILS_SHA256_CRYPTO_TYPE, secret,
+						secret_len, 4, addr, len, tmp_hash) < 0) {
+				VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+						FL("failed to get hmac hash"));
+				return VOS_STATUS_E_FAILURE;
+			}
+		}
+		/* Update hash from tmp_hash */
+		vos_mem_copy(key + current_position, tmp_hash, remaining_data);
+		current_position += remaining_data;
+	}
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * lim_process_fils_eap_tlv()- This API process eap tlv available in auth resp
+ * and returns remaining length.
+ * @pe_session: PE session
+ * @wrapped_data: wrapped data
+ * @data_len: length of tlv
+ *
+ * Return: remaining length
+ */
+static uint32_t lim_process_fils_eap_tlv(tpPESession pe_session,
+		uint8_t *wrapped_data, uint32_t data_len)
+{
+	struct fils_eap_tlv *tlv;
+	struct fils_auth_rsp_info *auth_info;
+	uint8_t auth_tag_len;
+
+	auth_info = &pe_session->fils_info->auth_info;
+	/* Minimum */
+	auth_tag_len = lim_get_auth_tag_len(HMAC_SHA256_128);
+
+	while (data_len > (auth_tag_len + 1)) {
+		tlv = (struct fils_eap_tlv *) wrapped_data;
+
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+				FL("tlv type %x len %u total %u"),
+				tlv->type, tlv->length, data_len);
+		switch (tlv->type) {
+			case SIR_FILS_EAP_TLV_KEYNAME_NAI:
+				auth_info->keyname = vos_mem_malloc(tlv->length);
+				if (!auth_info->keyname) {
+					VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+							FL("failed to alloc memory"));
+					return 0;
+				}
+				vos_mem_copy(auth_info->keyname,
+						tlv->data, tlv->length);
+				auth_info->keylength = tlv->length;
+				data_len -= (tlv->length + 2);
+				wrapped_data += (tlv->length + 2);
+				break;
+			case SIR_FILS_EAP_TLV_R_RK_LIFETIME:
+				/* TODO check this */
+				auth_info->r_rk_lifetime = limGetU32(tlv->data);
+				data_len -= (tlv->length + 2);
+				wrapped_data += (tlv->length + 2);
+				break;
+			case SIR_FILS_EAP_TLV_R_MSK_LIFETIME:
+				/* TODO check this */
+				auth_info->r_msk_lifetime = limGetU32(tlv->data);
+				data_len -= (tlv->length + 2);
+				wrapped_data += (tlv->length + 2);
+				break;
+			case SIR_FILS_EAP_TLV_DOMAIN_NAME:
+				auth_info->domain_name = vos_mem_malloc(tlv->length);
+				if (!auth_info->domain_name) {
+					VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+							FL("failed to alloc memory"));
+					return 0;
+				}
+				vos_mem_copy(auth_info->domain_name,
+						tlv->data, tlv->length);
+				auth_info->domain_len = tlv->length;
+				data_len -= (tlv->length + 2);
+				wrapped_data += (tlv->length + 2);
+				break;
+				/* TODO process these now */
+			case SIR_FILS_EAP_TLV_CRYPTO_LIST:
+			case SIR_FILS_EAP_TLV_AUTH_INDICATION:
+				data_len -= (tlv->length + 2);
+				wrapped_data += (tlv->length + 2);
+				break;
+			default:
+				VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+						FL("Unknown type"));
+				return data_len;
+		}
+	}
+	return data_len;
+}
+
+/**
+ * lim_generate_key_data()- This API generates key data using prf
+ * FILS-Key-Data = KDF-X(PMK, "FILS PTK Derivation", SPA||AA||SNonce||ANonce)
+ * @fils_info: fils session info
+ * @key_label: label used
+ * @data: data buffer
+ * @data_len: data buffer len
+ * @key_data: hash data needs to be generated
+ * @key_data_len: hash data len
+ *
+ * Return: VOS_STATUS
+ */
+static VOS_STATUS lim_generate_key_data(struct pe_fils_session *fils_info,
+		uint8_t *key_label, uint8_t *data, uint32_t data_len,
+		uint8_t *key_data, uint32_t key_data_len)
+{
+	VOS_STATUS status;
+
+	if (!fils_info)
+		return VOS_STATUS_E_FAILURE;
+
+	status = lim_get_key_from_prf(lim_get_crypto_type(fils_info->akm),
+			fils_info->fils_pmk,
+			fils_info->fils_pmk_len,
+			key_label, data, data_len, key_data, key_data_len);
+	if (status != VOS_STATUS_SUCCESS)
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("failed to generate keydata"));
+	return status;
+}
+
+/**
+ * lim_generate_ap_key_auth()- This API generates ap auth data which needs to be
+ * verified in assoc response.
+ * @pe_session: pe session pointer
+ *
+ * Return: None
+ */
+static void lim_generate_ap_key_auth(tpPESession pe_session)
+{
+	uint8_t *buf, *addr[1];
+	uint32_t len;
+	struct pe_fils_session *fils_info = pe_session->fils_info;
+	uint8_t data[SIR_FILS_NONCE_LENGTH + SIR_FILS_NONCE_LENGTH
+		+ QDF_MAC_ADDR_SIZE + QDF_MAC_ADDR_SIZE] = {0};
+
+	if (!fils_info)
+		return;
+	len = SIR_FILS_NONCE_LENGTH + SIR_FILS_NONCE_LENGTH +
+		QDF_MAC_ADDR_SIZE +  QDF_MAC_ADDR_SIZE;
+	addr[0] = data;
+	buf = data;
+	vos_mem_copy(buf, fils_info->auth_info.fils_nonce,
+			SIR_FILS_NONCE_LENGTH);
+	buf += SIR_FILS_NONCE_LENGTH;
+	vos_mem_copy(buf, fils_info->fils_nonce, SIR_FILS_NONCE_LENGTH);
+	buf += SIR_FILS_NONCE_LENGTH;
+	vos_mem_copy(buf, pe_session->bssId, QDF_MAC_ADDR_SIZE);
+	buf += QDF_MAC_ADDR_SIZE;
+	vos_mem_copy(buf, pe_session->selfMacAddr, QDF_MAC_ADDR_SIZE);
+	buf += QDF_MAC_ADDR_SIZE;
+
+	if(!alloc_tfm(lim_get_crypto_type(fils_info->akm)))
+	{
+		if (qdf_get_hmac_hash(lim_get_crypto_type(fils_info->akm),
+					fils_info->ick, fils_info->ick_len, 1, &addr[0],
+					&len, fils_info->ap_key_auth_data) < 0)
+			VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+					FL("failed to generate PMK id"));
+	}
+	fils_info->ap_key_auth_len = lim_get_crypto_digest_len(
+			lim_get_crypto_type(fils_info->akm));
+	lim_fils_data_dump("AP Key Auth", fils_info->ap_key_auth_data,
+			fils_info->ap_key_auth_len);
+}
+
+/**
+ * lim_generate_key_auth()- This API generates sta auth data which needs to be
+ * send to AP in assoc request, AP will generate the same the verify it.
+ * @pe_session: pe session pointer
+ *
+ * Return: None
+ */
+static void lim_generate_key_auth(tpPESession pe_session)
+{
+	uint8_t *buf, *addr[1];
+	uint32_t len;
+	struct pe_fils_session *fils_info = pe_session->fils_info;
+	uint8_t data[SIR_FILS_NONCE_LENGTH + SIR_FILS_NONCE_LENGTH
+		+ QDF_MAC_ADDR_SIZE + QDF_MAC_ADDR_SIZE] = {0};
+
+	if (!fils_info)
+		return;
+
+	len = SIR_FILS_NONCE_LENGTH + SIR_FILS_NONCE_LENGTH +
+		QDF_MAC_ADDR_SIZE +  QDF_MAC_ADDR_SIZE;
+	addr[0] = data;
+	buf = data;
+	vos_mem_copy(buf, fils_info->fils_nonce, SIR_FILS_NONCE_LENGTH);
+	buf += SIR_FILS_NONCE_LENGTH;
+	vos_mem_copy(buf, fils_info->auth_info.fils_nonce,
+			SIR_FILS_NONCE_LENGTH);
+	buf += SIR_FILS_NONCE_LENGTH;
+	vos_mem_copy(buf, pe_session->selfMacAddr, QDF_MAC_ADDR_SIZE);
+	buf += QDF_MAC_ADDR_SIZE;
+	vos_mem_copy(buf, pe_session->bssId, QDF_MAC_ADDR_SIZE);
+	buf += QDF_MAC_ADDR_SIZE;
+
+	if(!alloc_tfm(lim_get_crypto_type(fils_info->akm)))
+	{
+		if (qdf_get_hmac_hash(lim_get_crypto_type(fils_info->akm),
+					fils_info->ick, fils_info->ick_len, 1,
+					&addr[0], &len, fils_info->key_auth) < 0)
+			VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+					FL("failed to generate key auth"));
+	}
+	fils_info->key_auth_len = lim_get_crypto_digest_len(
+			lim_get_crypto_type(fils_info->akm));
+	lim_fils_data_dump("STA Key Auth",
+			fils_info->key_auth, fils_info->key_auth_len);
+}
+
+/**
+ * lim_get_keys()- This API generates keys keydata which is generated after
+ * parsing of auth response.
+ * KCK = L(FILS-Key-Data, 0, KCK_bits)
+ * KEK = L(FILS-Key-Data, KCK_bits, KEK_bits)
+ * TK = L(FILS-Key-Data, KCK_bits + KEK_bits, TK_bits)
+ * FILS-FT = L(FILS-Key-Data, KCK_bits + KEK_bits + TK_bits, FILS-FT_bits)
+ * @pe_session: pe session pointer
+ *
+ * Return: None
+ */
+static void lim_get_keys(tpPESession pe_session)
+{
+	uint8_t key_label[] = PTK_KEY_LABEL;
+	uint8_t *data;
+	uint8_t data_len;
+	struct pe_fils_session *fils_info = pe_session->fils_info;
+	uint8_t key_data[MAX_ICK_LEN + MAX_KEK_LEN + MAX_TK_LEN] = {0};
+	uint8_t key_data_len;
+	uint8_t ick_len = lim_get_ick_len(fils_info->akm);
+	uint8_t kek_len = lim_get_kek_len(fils_info->akm);
+	uint8_t tk_len = lim_get_tk_len(pe_session->encryptType);
+	uint8_t *buf;
+
+	if (!fils_info)
+		return;
+	key_data_len = ick_len + kek_len + tk_len;
+
+	data_len = 2 * SIR_FILS_NONCE_LENGTH + 2 * QDF_MAC_ADDR_SIZE;
+	data = vos_mem_malloc(data_len);
+	if (!data) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("failed to alloc memory"));
+		return;
+	}
+
+	/* Update data */
+	buf = data;
+	vos_mem_copy(buf, pe_session->selfMacAddr, QDF_MAC_ADDR_SIZE);
+	buf += QDF_MAC_ADDR_SIZE;
+	vos_mem_copy(buf, pe_session->bssId, QDF_MAC_ADDR_SIZE);
+	buf += QDF_MAC_ADDR_SIZE;
+	vos_mem_copy(buf, fils_info->fils_nonce, SIR_FILS_NONCE_LENGTH);
+	buf += SIR_FILS_NONCE_LENGTH;
+	vos_mem_copy(buf, fils_info->auth_info.fils_nonce,
+			SIR_FILS_NONCE_LENGTH);
+	lim_generate_key_data(fils_info, key_label, data, data_len,
+			key_data, key_data_len);
+	buf = key_data;
+	vos_mem_copy(fils_info->ick, buf, ick_len);
+	fils_info->ick_len = ick_len;
+	buf += ick_len;
+	vos_mem_copy(fils_info->kek, buf, kek_len);
+	fils_info->kek_len = kek_len;
+	buf += kek_len;
+	vos_mem_copy(fils_info->tk, buf, tk_len);
+	fils_info->tk_len = tk_len;
+	lim_fils_data_dump("Key Data", key_data, key_data_len);
+	lim_fils_data_dump("ICK", fils_info->ick, ick_len);
+	lim_fils_data_dump("KEK", fils_info->kek, kek_len);
+	lim_fils_data_dump("TK", fils_info->tk, tk_len);
+	vos_mem_free(data);
+}
+
+/**
+ * lim_generate_pmkid()- This API generates PMKID using hash of erp auth packet
+ * parsing of auth response.
+ * PMKID = Truncate-128(Hash(EAP-Initiate/Reauth))
+ * @pe_session: pe session pointer
+ *
+ * Return: None
+ */
+static void lim_generate_pmkid(tpPESession pe_session)
+{
+	uint8_t hash[SHA384_DIGEST_SIZE];
+	struct pe_fils_session *fils_info = pe_session->fils_info;
+
+	if (!fils_info)
+		return;
+
+	if(!alloc_tfm(lim_get_crypto_type(fils_info->akm)))
+	{
+		qdf_get_hash(lim_get_crypto_type(fils_info->akm), 1,
+				&fils_info->fils_erp_reauth_pkt,
+				&fils_info->fils_erp_reauth_pkt_len, hash);
+		vos_mem_copy(fils_info->fils_pmkid, hash, PMKID_LEN);
+		lim_fils_data_dump("PMKID", fils_info->fils_pmkid, PMKID_LEN);
+	}
+}
+
+/**
+ * lim_generate_pmk()- This API generates PMK using hmac hash of rmsk data
+ * anonce, snonce will be used as key for this
+ * PMK = HMAC-Hash(SNonce || ANonce, rMSK [ || DHss ])
+ * @pe_session: pe session pointer
+ *
+ * Return: None
+ */
+static void lim_generate_pmk(tpPESession pe_session)
+{
+	uint8_t nounce[2 * SIR_FILS_NONCE_LENGTH] = {0};
+	uint8_t nounce_len = 2 * SIR_FILS_NONCE_LENGTH;
+	uint8_t *addr[1];
+	uint32_t len[1];
+	struct pe_fils_session *fils_info = pe_session->fils_info;
+
+	/* Snounce */
+	vos_mem_copy(nounce, fils_info->fils_nonce,
+			SIR_FILS_NONCE_LENGTH);
+	/* anounce */
+	vos_mem_copy(nounce + SIR_FILS_NONCE_LENGTH,
+			fils_info->auth_info.fils_nonce,
+			SIR_FILS_NONCE_LENGTH);
+	fils_info->fils_pmk_len = lim_get_pmk_length(fils_info->akm);
+
+	if (fils_info->fils_pmk)
+		vos_mem_free(fils_info->fils_pmk);
+
+	fils_info->fils_pmk = vos_mem_malloc(fils_info->fils_pmk_len);
+	if (!fils_info->fils_pmk) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("failed to alloc memory"));
+		return;
+	}
+	addr[0] = fils_info->fils_rmsk;
+	len[0] = fils_info->fils_rmsk_len;
+	lim_fils_data_dump("Nonce", nounce, nounce_len);
+
+	if(!alloc_tfm(lim_get_crypto_type(fils_info->akm)))
+	{
+		if (qdf_get_hmac_hash(lim_get_crypto_type(fils_info->akm), nounce,
+					nounce_len, 1,
+					&addr[0], &len[0], fils_info->fils_pmk) < 0)
+			VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+					FL("failed to generate PMK"));
+	}
+	lim_fils_data_dump("PMK", fils_info->fils_pmk, fils_info->fils_pmk_len);
+}
+
+/**
+ * lim_generate_rmsk_data()- This API generates RMSK data using
+ * default kdf as defined in RFC4306.
+ * @pe_session: pe session pointer
+ *
+ * Return: None
+ */
+static void lim_generate_rmsk_data(tpPESession pe_session)
+{
+	uint8_t optional_data[4] = {0};
+	uint8_t rmsk_label[] = RMSK_LABEL;
+	struct pe_fils_session *fils_info = pe_session->fils_info;
+	struct fils_auth_rsp_info *auth_info;
+
+	if (!fils_info)
+		return;
+	auth_info = &(pe_session->fils_info->auth_info);
+	fils_info->fils_rmsk_len = fils_info->fils_r_rk_len;
+	fils_info->fils_rmsk = vos_mem_malloc(fils_info->fils_r_rk_len);
+	if (!fils_info->fils_rmsk) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("failed to alloc memory"));
+		return;
+	}
+	/*
+	 * Sequence number sent in EAP-INIT packet,
+	 * it should be in network byte order
+	 */
+	lim_copy_u16_be(&optional_data[0], fils_info->sequence_number);
+	lim_copy_u16_be(&optional_data[2], fils_info->fils_r_rk_len);
+	lim_default_hmac_sha256_kdf(fils_info->fils_r_rk,
+			fils_info->fils_r_rk_len, rmsk_label,
+			optional_data, sizeof(optional_data),
+			fils_info->fils_rmsk, fils_info->fils_rmsk_len);
+	lim_fils_data_dump("RMSK", fils_info->fils_rmsk,
+			fils_info->fils_rmsk_len);
+}
+
+/**
+ * lim_process_auth_wrapped_data()- This API process wrapped data element
+ * of auth response.
+ * @pe_session: pe session pointer
+ * @wrapped_data: wrapped data pointer
+ * @data_len: wrapped data len
+ *
+ * Return: None
+ */
+static VOS_STATUS lim_process_auth_wrapped_data(tpPESession pe_session,
+		uint8_t *wrapped_data, uint32_t data_len)
+{
+	uint8_t code;
+	uint8_t identifier;
+	uint16_t length;
+	uint8_t type;
+	unsigned long flags;
+	struct pe_fils_session *fils_info;
+	uint8_t hash[32], crypto;
+	uint32_t remaining_len = data_len, new_len;
+	uint8_t *input_data[1];
+	uint32_t input_len[1];
+	uint8_t auth_tag_len;
+
+	fils_info = pe_session->fils_info;
+	if (!fils_info)
+		return VOS_STATUS_E_FAILURE;
+	input_data[0] = wrapped_data;
+	input_len[0] = data_len;
+
+	VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+			FL("trying to process the wrappped data"));
+
+	code = *wrapped_data;
+	wrapped_data++;
+	remaining_len--;
+	identifier = *wrapped_data;
+	wrapped_data++;
+	remaining_len--;
+
+	length = limGetU16(wrapped_data);
+	wrapped_data += sizeof(uint16_t);
+	remaining_len -= sizeof(uint16_t);
+
+	type = *wrapped_data; /* val should be 2 here */
+	wrapped_data++;
+	remaining_len--;
+
+	flags = *wrapped_data;
+	if (test_bit(7, &flags)) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("R bit is set in flag, error"));
+		return VOS_STATUS_E_FAILURE;
+	}
+	wrapped_data++;
+	remaining_len--;
+
+	fils_info->auth_info.sequence = limGetU16_be(wrapped_data);
+	wrapped_data += sizeof(uint16_t);
+	remaining_len -= sizeof(uint16_t);
+	/* Validate Auth sequence number */
+	if (fils_info->auth_info.sequence < fils_info->sequence_number) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("sequence EAP-finish:%d is less than EAP-init:%d"),
+				fils_info->auth_info.sequence,
+				fils_info->sequence_number);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	/* Parse attached TLVs */
+	new_len = lim_process_fils_eap_tlv(pe_session,
+			wrapped_data, remaining_len);
+	VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+			FL("new len=%d remain=%d"), new_len, remaining_len);
+
+	wrapped_data += remaining_len - new_len;
+	remaining_len = new_len;
+	/* Remove cryptosuite */
+	crypto = *wrapped_data;
+	wrapped_data++;
+	remaining_len--;
+
+	auth_tag_len = lim_get_auth_tag_len(crypto);
+	input_len[0] -= auth_tag_len;
+	/* if we have auth tag remaining */
+	if (remaining_len == auth_tag_len) {
+
+		if(!alloc_tfm(FILS_SHA256_CRYPTO_TYPE))
+		{
+			qdf_get_hmac_hash(FILS_SHA256_CRYPTO_TYPE, fils_info->fils_r_ik,
+					fils_info->fils_r_ik_len, 1,
+					input_data, input_len, hash);
+		}
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("invalid remaining len %d"),
+				remaining_len);
+	}
+	if (!vos_mem_compare(wrapped_data, hash, auth_tag_len)) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("integratity check failed for auth, crypto %d"),
+				crypto);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	lim_generate_rmsk_data(pe_session);
+	lim_generate_pmk(pe_session);
+	lim_generate_pmkid(pe_session);
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * lim_is_valid_fils_auth_frame()- This API check whether auth frame is a
+ * valid frame.
+ * @mac_ctx: mac context
+ * @pe_session: pe session pointer
+ * @rx_auth_frm_body: pointer to autherntication frame
+ *
+ * Return: true if frame is valid or fils is disable, false otherwise
+ */
+bool lim_is_valid_fils_auth_frame(tpAniSirGlobal mac_ctx,
+		tpPESession pe_session,
+		tSirMacAuthFrameBody *rx_auth_frm_body)
+{
+	if (!pe_session->fils_info)
+		return true;
+	if (pe_session->fils_info->is_fils_connection == false)
+		return true;
+
+	if (!vos_mem_compare(rx_auth_frm_body->session,
+				pe_session->fils_info->fils_session,
+				SIR_FILS_SESSION_LENGTH)) {
+		lim_fils_data_dump("Current FILS session",
+				pe_session->fils_info->fils_session,
+				SIR_FILS_SESSION_LENGTH);
+		lim_fils_data_dump("FILS Session in pkt",
+				rx_auth_frm_body->session,
+				SIR_FILS_SESSION_LENGTH);
+		return false;
+	}
+	vos_mem_copy(pe_session->fils_info->auth_info.fils_nonce,
+			rx_auth_frm_body->nonce, SIR_FILS_NONCE_LENGTH);
+	pe_session->fils_info->auth_info.assoc_delay =
+		rx_auth_frm_body->assoc_delay_info;
+	return true;
+}
+
+/**
+ * lim_create_fils_r_ik()- This API create rik using rrk coming from
+ * supplicant.
+ * rIK = KDF (K, S), where
+ * K = rRK and
+ * S = rIK Label + "\0" + cryptosuite + length
+ * The rIK Label is the 8-bit ASCII string:
+ * Re-authentication Integrity Key@ietf.org
+ * @fils_info: fils session info
+ *
+ * Return: None
+ */
+static VOS_STATUS lim_create_fils_r_ik(struct pe_fils_session *fils_info)
+{
+	uint8_t optional_data[SIR_FILS_OPTIONAL_DATA_LEN];
+	uint8_t label[] = SIR_FILS_RIK_LABEL;
+
+	if (!fils_info)
+		return VOS_STATUS_E_FAILURE;
+	optional_data[0] = HMAC_SHA256_128;
+	/* basic validation */
+	if (fils_info->fils_r_rk_len <= 0) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+				FL("invalid r_rk length %d"), fils_info->fils_r_rk_len);
+		return VOS_STATUS_E_FAILURE;
+	}
+	lim_copy_u16_be(&optional_data[1], fils_info->fils_r_rk_len);
+	fils_info->fils_r_ik = vos_mem_malloc(fils_info->fils_r_rk_len);
+	if (!fils_info->fils_r_ik) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+				FL("failed to alloc memory"));
+		return VOS_STATUS_E_FAILURE;
+	}
+	if (lim_default_hmac_sha256_kdf(fils_info->fils_r_rk,
+				fils_info->fils_r_rk_len, label,
+				optional_data, sizeof(optional_data),
+				fils_info->fils_r_ik, fils_info->fils_r_rk_len)
+			!= VOS_STATUS_SUCCESS) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+				FL("failed to create r_ik"));
+		return VOS_STATUS_E_FAILURE;
+	}
+	fils_info->fils_r_ik_len = fils_info->fils_r_rk_len;
+	lim_fils_data_dump("rRk", fils_info->fils_r_rk,
+			fils_info->fils_r_rk_len);
+	lim_fils_data_dump("rIk", fils_info->fils_r_ik,
+			fils_info->fils_r_rk_len);
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * lim_create_fils_wrapper_data()- This API create warpped data which will be
+ * sent in auth request.
+ * @fils_info: fils session info
+ *
+ * Return: None
+ */
+static int lim_create_fils_wrapper_data(struct pe_fils_session *fils_info)
+{
+	uint8_t *buf;
+	uint8_t auth_tag[FILS_AUTH_TAG_MAX_LENGTH] = {0};
+	uint32_t length = 0;
+	int buf_len =
+		/* code + identifier */
+		sizeof(uint8_t) * 2 +
+		/* length */
+		sizeof(uint16_t) +
+		/* type + flags */
+		sizeof(uint8_t) * 2 +
+		/* sequence */
+		sizeof(uint16_t) +
+		/* tlv : type, length, data */
+		sizeof(uint8_t) * 2 + fils_info->keyname_nai_length +
+		/* cryptosuite + auth_tag */
+		sizeof(uint8_t) + lim_get_auth_tag_len(HMAC_SHA256_128);
+
+	if (!fils_info)
+		return 0;
+	fils_info->fils_erp_reauth_pkt = vos_mem_malloc(buf_len);
+	if (!fils_info->fils_erp_reauth_pkt) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("failed to allocate memory"));
+		return -EINVAL;
+	}
+	buf = fils_info->fils_erp_reauth_pkt;
+	*buf = 5;
+	buf++;
+	/* Identifier */
+	*buf = 0;
+	buf++;
+	/* Length */
+	lim_copy_u16_be(buf, buf_len);
+	buf += sizeof(uint16_t);
+	/* type */
+	*buf = SIR_FILS_EAP_INIT_PACKET_TYPE;
+	buf++;
+
+	/**
+	 *  flag
+	 *  0 1 2  <-- 5 -->
+	 * ----------------
+	 * |R|B|L| Reserved|
+	 * -----------------
+	 */
+	*buf = 0x20; /* l=1, b=0, r=0 */
+	buf++;
+	/* sequence */
+	lim_copy_u16_be(buf, fils_info->sequence_number);
+	buf += sizeof(uint16_t);
+
+	/* tlv */
+	/* Type */
+	*buf = SIR_FILS_EAP_TLV_KEYNAME_NAI;
+	buf++;
+	/* NAI Length */
+	*buf = fils_info->keyname_nai_length;
+	buf++;
+	/* NAI Data */
+	vos_mem_copy(buf, fils_info->keyname_nai_data,
+			fils_info->keyname_nai_length);
+	buf += fils_info->keyname_nai_length;
+
+	/* cryptosuite */
+	*buf = HMAC_SHA256_128;
+	buf++;
+
+	/*
+	 * This should be moved to just after sending probe to save time
+	 * lim_process_switch_channel_join_req ??
+	 */
+	lim_create_fils_r_ik(fils_info);
+	fils_info->fils_erp_reauth_pkt_len = buf_len;
+	length = fils_info->fils_erp_reauth_pkt_len -
+		lim_get_auth_tag_len(HMAC_SHA256_128);
+	if(!alloc_tfm(FILS_SHA256_CRYPTO_TYPE))
+	{
+		qdf_get_hmac_hash(FILS_SHA256_CRYPTO_TYPE,
+				fils_info->fils_r_ik, fils_info->fils_r_ik_len, 1,
+				&fils_info->fils_erp_reauth_pkt, &length, auth_tag);
+	}
+	lim_fils_data_dump("Auth tag", auth_tag,
+			lim_get_auth_tag_len(HMAC_SHA256_128));
+	lim_fils_data_dump("EAP init pkt", fils_info->fils_erp_reauth_pkt,
+			fils_info->fils_erp_reauth_pkt_len);
+
+	vos_mem_copy(buf, auth_tag, lim_get_auth_tag_len(HMAC_SHA256_128));
+	buf += lim_get_auth_tag_len(HMAC_SHA256_128);
+
+	return buf_len;
+}
+
+/**
+ * lim_add_fils_data_to_auth_frame()- This API add fils data to auth frame.
+ * Following will be added in this.
+ * RSNIE
+ * SNonce
+ * Session
+ * Wrapped data
+ * @session: PE session
+ * @body: pointer to auth frame where data needs to be added
+ *
+ * Return: None
+ */
+void lim_add_fils_data_to_auth_frame(tpPESession session,
+		uint8_t *body)
+{
+	struct pe_fils_session *fils_info;
+
+	fils_info = session->fils_info;
+	if (!fils_info)
+		return;
+	/* RSN IE */
+	vos_mem_copy(body, fils_info->rsn_ie, fils_info->rsn_ie_len);
+	body += fils_info->rsn_ie_len;
+	lim_fils_data_dump("FILS RSN", fils_info->rsn_ie,
+			fils_info->rsn_ie_len);
+
+	/* ***Nounce*** */
+	/* Add element id */
+	*body = SIR_MAX_ELEMENT_ID;
+	body++;
+	/* Add nounce length + 1 for ext element id */
+	*body = SIR_FILS_NONCE_LENGTH + 1;
+	body++;
+	/* Add ext element */
+	*body = SIR_FILS_NONCE_EXT_EID;
+	body++;
+	/* Add data */
+	vos_rand_get_bytes(0, fils_info->fils_nonce, SIR_FILS_NONCE_LENGTH);
+	vos_mem_copy(body, fils_info->fils_nonce, SIR_FILS_NONCE_LENGTH);
+	body = body + SIR_FILS_NONCE_LENGTH;
+	/* Dump data */
+	lim_fils_data_dump("fils anonce", fils_info->fils_nonce,
+			SIR_FILS_NONCE_LENGTH);
+
+	/*   *** Session ***  */
+	/* Add element id */
+	*body = SIR_MAX_ELEMENT_ID;
+	body++;
+	/* Add nounce length + 1 for ext element id */
+	*body = SIR_FILS_SESSION_LENGTH + 1;
+	body++;
+	/* Add ext element */
+	*body = SIR_FILS_SESSION_EXT_EID;
+	body++;
+	/* Add data */
+	vos_rand_get_bytes(0, fils_info->fils_session, SIR_FILS_SESSION_LENGTH);
+	vos_mem_copy(body, fils_info->fils_session, SIR_FILS_SESSION_LENGTH);
+	body = body + SIR_FILS_SESSION_LENGTH;
+	/* dump data */
+	lim_fils_data_dump("Fils Session",
+			fils_info->fils_session, SIR_FILS_SESSION_LENGTH);
+
+	/*  ERP Packet  */
+	/* Add element id */
+	*body = SIR_MAX_ELEMENT_ID;
+	body++;
+	/* Add packet length + 1 for ext element id */
+	*body = fils_info->fils_erp_reauth_pkt_len + 1;
+	body++;
+	/* Add ext element */
+	*body = SIR_FILS_WRAPPED_DATA_EXT_EID;
+	body++;
+	/* Copy data */
+	vos_mem_copy(body, fils_info->fils_erp_reauth_pkt,
+			fils_info->fils_erp_reauth_pkt_len);
+	lim_fils_data_dump("Fils ERP reauth Pkt",
+			fils_info->fils_erp_reauth_pkt,
+			fils_info->fils_erp_reauth_pkt_len);
+	body = body + fils_info->fils_erp_reauth_pkt_len;
+}
+
+/**
+ * lim_process_fils_auth_frame2()- This API process fils data from auth response
+ * @mac_ctx: mac context
+ * @session: PE session
+ * @rx_auth_frm_body: pointer to auth frame
+ *
+ * Return: true if fils data needs to be processed else false
+ */
+bool lim_process_fils_auth_frame2(tpAniSirGlobal mac_ctx,
+		tpPESession pe_session,
+		tSirMacAuthFrameBody *rx_auth_frm_body)
+{
+	bool pmkid_found = false;
+	int i;
+	tDot11fIERSN dot11f_ie_rsn = {0};
+
+	if (rx_auth_frm_body->authAlgoNumber != eSIR_FILS_SK_WITHOUT_PFS)
+		return false;
+
+	if (!pe_session->fils_info)
+		return false;
+
+	if (dot11fUnpackIeRSN(mac_ctx,
+			&rx_auth_frm_body->rsn_ie.info[0],
+			rx_auth_frm_body->rsn_ie.length,
+			&dot11f_ie_rsn) != DOT11F_PARSE_SUCCESS) {
+		return false;
+	}
+
+	for (i = 0; i < dot11f_ie_rsn.pmkid_count; i++) {
+		if (vos_mem_compare(dot11f_ie_rsn.pmkid[i],
+					pe_session->fils_info->fils_pmkid,
+					IEEE80211_PMKID_LEN)) {
+			pmkid_found = true;
+			VOS_TRACE(VOS_MODULE_ID_PE,
+					VOS_TRACE_LEVEL_DEBUG,
+					FL("pmkid match in rsn ie total_count %d"),
+					dot11f_ie_rsn.pmkid_count);
+			break;
+		}
+	}
+	if (!pmkid_found) {
+		if (VOS_STATUS_SUCCESS !=
+				lim_process_auth_wrapped_data(pe_session,
+					rx_auth_frm_body->wrapped_data,
+					rx_auth_frm_body->wrapped_data_len))
+			return false;
+	} else {
+		lim_fils_data_dump("PMK",
+				pe_session->fils_info->fils_pmk,
+				pe_session->fils_info->fils_pmk_len);
+	}
+	lim_get_keys(pe_session);
+	lim_generate_key_auth(pe_session);
+	lim_generate_ap_key_auth(pe_session);
+	return true;
+}
+
+/**
+ * lim_update_fils_config()- This API update fils session info to csr config
+ * from join request.
+ * @session: PE session
+ * @sme_join_req: pointer to join request
+ *
+ * Return: None
+ */
+void lim_update_fils_config(tpPESession session,
+		tpSirSmeJoinReq sme_join_req)
+{
+	struct pe_fils_session *csr_fils_info;
+	struct cds_fils_connection_info *fils_config_info;
+
+	fils_config_info = &sme_join_req->fils_con_info;
+	csr_fils_info = session->fils_info;
+	if (!csr_fils_info){
+		VOS_TRACE(VOS_MODULE_ID_PE,
+				VOS_TRACE_LEVEL_DEBUG,
+				FL(" csr fils info not present exiting....."));
+		return;
+	}
+	if (fils_config_info->is_fils_connection == false){
+		VOS_TRACE(VOS_MODULE_ID_PE,
+				VOS_TRACE_LEVEL_DEBUG,
+				FL(" is_fils_connection is false....."));
+		return;
+	}
+
+	csr_fils_info->is_fils_connection =
+		fils_config_info->is_fils_connection;
+	csr_fils_info->keyname_nai_length =
+		fils_config_info->key_nai_length;
+	csr_fils_info->fils_r_rk_len =
+		fils_config_info->r_rk_length;
+	csr_fils_info->akm = fils_config_info->akm_type;
+	csr_fils_info->auth = fils_config_info->auth_type;
+	csr_fils_info->sequence_number = fils_config_info->sequence_number;
+	csr_fils_info->keyname_nai_data =
+		vos_mem_malloc(fils_config_info->key_nai_length);
+	if (!csr_fils_info->keyname_nai_data) {
+		VOS_TRACE(VOS_MODULE_ID_PE,
+				VOS_TRACE_LEVEL_DEBUG,
+				FL("failed to alloc memory"));
+		return;
+	}
+	vos_mem_copy(csr_fils_info->keyname_nai_data,
+			fils_config_info->keyname_nai,
+			fils_config_info->key_nai_length);
+	csr_fils_info->fils_r_rk =
+		vos_mem_malloc(fils_config_info->r_rk_length);
+	if (!csr_fils_info->fils_r_rk) {
+		VOS_TRACE(VOS_MODULE_ID_PE,
+				VOS_TRACE_LEVEL_DEBUG,
+				FL("failed to alloc memory"));
+		vos_mem_free(csr_fils_info->keyname_nai_data);
+		return;
+	}
+	vos_mem_copy(csr_fils_info->fils_r_rk,
+			fils_config_info->r_rk,
+			fils_config_info->r_rk_length);
+
+	vos_mem_copy(csr_fils_info->fils_pmkid,
+			fils_config_info->pmkid, PMKID_LEN);
+
+	csr_fils_info->rsn_ie_len = sme_join_req->rsnIE.length;
+	vos_mem_copy(csr_fils_info->rsn_ie,
+			sme_join_req->rsnIE.rsnIEdata,
+			sme_join_req->rsnIE.length);
+
+	csr_fils_info->fils_pmk_len = fils_config_info->pmk_len;
+	if (fils_config_info->pmk_len)
+	{
+		csr_fils_info->fils_pmk =
+			vos_mem_malloc(fils_config_info->pmk_len);
+		if (!csr_fils_info->fils_pmk) {
+			vos_mem_free(csr_fils_info->keyname_nai_data);
+			vos_mem_free(csr_fils_info->fils_r_rk);
+			VOS_TRACE(VOS_MODULE_ID_PE,
+					VOS_TRACE_LEVEL_DEBUG,
+					FL("failed to alloc memory"));
+			return;
+		}
+	}
+	vos_mem_copy(csr_fils_info->fils_pmk, fils_config_info->pmk,
+			fils_config_info->pmk_len);
+
+	VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+			FL("fils=%d nai-len=%d rrk_len=%d akm=%d auth=%d pmk_len=%d"),
+			fils_config_info->is_fils_connection,
+			fils_config_info->key_nai_length,
+			fils_config_info->r_rk_length,
+			fils_config_info->akm_type,
+			fils_config_info->auth_type,
+			fils_config_info->pmk_len);
+}
+
+#define EXTENDED_IE_HEADER_LEN 3
+/**
+ * lim_create_fils_auth_data()- This API creates the fils auth data
+ * which needs to be sent in auth req.
+ * @mac_ctx: mac context
+ * @auth_frame: pointer to auth frame
+ * @session: PE session
+ *
+ * Return: length of fils data
+ */
+uint32_t lim_create_fils_auth_data(tpAniSirGlobal mac_ctx,
+		tpSirMacAuthFrameBody auth_frame,
+		tpPESession session)
+{
+	uint32_t frame_len = 0;
+	uint32_t wrapped_data_len;
+
+	if (!session->fils_info)
+		return 0;
+	if (auth_frame->authAlgoNumber == eSIR_FILS_SK_WITHOUT_PFS) {
+		frame_len += session->fils_info->rsn_ie_len;
+		/* FILS nounce */
+		frame_len += SIR_FILS_NONCE_LENGTH + EXTENDED_IE_HEADER_LEN;
+		/* FILS Session */
+		frame_len += SIR_FILS_SESSION_LENGTH + EXTENDED_IE_HEADER_LEN;
+		/* Calculate data/length for FILS Wrapped Data */
+		wrapped_data_len =
+			lim_create_fils_wrapper_data(session->fils_info);
+		if (wrapped_data_len < 0) {
+			VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+					FL("failed to create warpped data"));
+			return 0;
+		}
+		frame_len += wrapped_data_len + EXTENDED_IE_HEADER_LEN;
+	}
+	return frame_len;
+}
+
+void populate_fils_connect_params(tpAniSirGlobal mac_ctx,
+		tpPESession session,
+		tpSirSmeJoinRsp sme_join_rsp)
+{
+	struct fils_join_rsp_params *fils_join_rsp;
+	struct pe_fils_session *fils_info = (session->fils_info);
+
+	if (!fils_info)
+		return;
+
+	if (!lim_is_fils_connection(session))
+		return;
+
+	if (!fils_info->fils_pmk_len ||
+			!fils_info->tk_len || !fils_info->gtk_len ||
+			!fils_info->fils_pmk || !fils_info->kek_len) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+			FL("Invalid FILS info pmk len %d kek len %d tk len %d gtk len %d"),
+				fils_info->fils_pmk_len,
+				fils_info->kek_len,
+				fils_info->tk_len,
+				fils_info->gtk_len);
+		return;
+	}
+
+	sme_join_rsp->fils_join_rsp = vos_mem_malloc(sizeof(*fils_join_rsp));
+	if (!sme_join_rsp->fils_join_rsp) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+				FL("fils_join_rsp malloc fails!"));
+		pe_delete_fils_info(session);
+		return;
+	}
+
+	fils_join_rsp = sme_join_rsp->fils_join_rsp;
+	fils_join_rsp->fils_pmk = vos_mem_malloc(fils_info->fils_pmk_len);
+	if (!fils_join_rsp->fils_pmk) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+				FL("fils_pmk malloc fails!"));
+		vos_mem_free(fils_join_rsp);
+		pe_delete_fils_info(session);
+		return;
+	}
+
+	fils_join_rsp->fils_pmk_len = fils_info->fils_pmk_len;
+	vos_mem_copy(fils_join_rsp->fils_pmk, fils_info->fils_pmk,
+			fils_info->fils_pmk_len);
+
+	vos_mem_copy(fils_join_rsp->fils_pmkid, fils_info->fils_pmkid,
+			IEEE80211_PMKID_LEN);
+
+	fils_join_rsp->kek_len = fils_info->kek_len;
+	vos_mem_copy(fils_join_rsp->kek, fils_info->kek, fils_info->kek_len);
+
+	fils_join_rsp->tk_len = fils_info->tk_len;
+	vos_mem_copy(fils_join_rsp->tk, fils_info->tk, fils_info->tk_len);
+
+	fils_join_rsp->gtk_len = fils_info->gtk_len;
+	vos_mem_copy(fils_join_rsp->gtk, fils_info->gtk, fils_info->gtk_len);
+
+	VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+			FL("FILS connect params copied lim"));
+	pe_delete_fils_info(session);
+}
+
+/**
+ * lim_parse_kde_elements() - Parse Key Delivery Elements
+ * @mac_ctx: mac context
+ * @fils_info: FILS info
+ * @kde_list: KDE list buffer
+ * @kde_list_len: Length of @kde_list
+ *
+ * This API is used to parse the Key Delivery Elements from buffer
+ * and populate them in PE FILS session struct i.e @fils_info
+ *
+ *             Key Delivery Element[KDE] format
+ * +----------+--------+-----------+------------+----------+
+ * | ID(0xDD) | length |  KDE OUI  |  data type |  IE data |
+ * |----------|--------|-----------|------------|----------|
+ * |  1 byte  | 1 byte |  3 bytes  |   1 byte   | variable |
+ * +----------+--------+-----------+------------+----------+
+ *
+ * there can be multiple KDE present inside KDE list.
+ * the IE data could be GTK, IGTK etc based on the data type
+ *
+ * Return: QDF_STATUS_SUCCESS if we parse GTK successfully,
+ *         QDF_STATUS_E_FAILURE otherwise
+ */
+static VOS_STATUS lim_parse_kde_elements(tpAniSirGlobal mac_ctx,
+		struct pe_fils_session *fils_info,
+		uint8_t *kde_list,
+		uint8_t kde_list_len)
+{
+	uint8_t rem_len = kde_list_len;
+	uint8_t *temp_ie = kde_list;
+	uint8_t elem_id, data_type, data_len, *ie_data = NULL, *current_ie;
+	uint16_t elem_len;
+
+	if (!kde_list_len || !kde_list) {
+		limLog(mac_ctx, LOGE, FL("kde_list_len %d"), kde_list_len);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	while (rem_len >= 2) {
+		current_ie = temp_ie;
+		elem_id = *temp_ie++;
+		elem_len = *temp_ie++;
+		rem_len -= 2;
+
+		if (lim_check_if_vendor_oui_match(mac_ctx, KDE_OUI_TYPE,
+					KDE_OUI_TYPE_SIZE, current_ie, elem_len)) {
+			data_type = *(temp_ie + KDE_DATA_TYPE_OFFSET);
+			ie_data = (temp_ie + KDE_IE_DATA_OFFSET);
+			data_len = (elem_len - KDE_IE_DATA_OFFSET);
+			switch(data_type) {
+				/* TODO - is anymore KDE type expected */
+				case DATA_TYPE_GTK:
+					limLog(mac_ctx, LOG1, FL("GTK found "));
+					vos_mem_copy(fils_info->gtk, (ie_data +
+							GTK_OFFSET), (data_len -
+							GTK_OFFSET));
+					fils_info->gtk_len = (data_len - GTK_OFFSET);
+					break;
+				case DATA_TYPE_IGTK:
+					limLog(mac_ctx, LOG1, FL("IGTK found"));
+					fils_info->igtk_len = (data_len - IGTK_OFFSET);
+					vos_mem_copy(fils_info->igtk, (ie_data +
+							IGTK_OFFSET), (data_len -
+							IGTK_OFFSET));
+					vos_mem_copy(fils_info->ipn, (ie_data +
+							IPN_OFFSET), IPN_LEN);
+					break;
+				default:
+					limLog(mac_ctx, LOGE, FL("Unknown KDE data type %x"),
+							data_type);
+					break;
+			}
+		}
+		temp_ie += elem_len;
+		rem_len -= elem_len;
+		ie_data = NULL;
+	}
+	/* Expecting GTK in KDE */
+	if (!fils_info->gtk_len) {
+		limLog(mac_ctx, LOGE, FL("GTK not found in KDE"));
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	return VOS_STATUS_SUCCESS;
+}
+
+bool lim_verify_fils_params_assoc_rsp(tpAniSirGlobal mac_ctx,
+		tpPESession session_entry,
+		tpSirAssocRsp assoc_rsp,
+		tLimMlmAssocCnf *assoc_cnf)
+{
+	struct pe_fils_session *fils_info = (session_entry->fils_info);
+	tDot11fIEfils_session fils_session = assoc_rsp->fils_session;
+	tDot11fIEfils_key_confirmation fils_key_auth = assoc_rsp->fils_key_auth;
+	tDot11fIEfils_kde fils_kde = assoc_rsp->fils_kde;
+	VOS_STATUS status;
+
+	if (!fils_info){
+		return true;
+	}
+	if (!lim_is_fils_connection(session_entry)){
+		return true;
+	}
+	if (!assoc_rsp->fils_session.present) {
+		limLog(mac_ctx, LOGE, FL("FILS IE not present"));
+		goto verify_fils_params_fails;
+	}
+
+	/* Compare FILS session */
+	if (adf_os_mem_cmp(fils_info->fils_session,
+				fils_session.session, DOT11F_IE_FILS_SESSION_MAX_LEN)) {
+		limLog(mac_ctx, LOGE, FL("FILS session mismatch"));
+		goto verify_fils_params_fails;
+	}
+
+	/* Compare FILS key auth */
+	if ((fils_key_auth.num_key_auth != fils_info->key_auth_len) ||
+			adf_os_mem_cmp(fils_info->ap_key_auth_data, fils_key_auth.key_auth,
+				fils_info->ap_key_auth_len)) {
+		lim_fils_data_dump("session keyauth",
+				fils_info->ap_key_auth_data,
+				fils_info->ap_key_auth_len);
+		lim_fils_data_dump("Pkt keyauth",
+				fils_key_auth.key_auth,
+				fils_key_auth.num_key_auth);
+		goto verify_fils_params_fails;
+	}
+
+	/* Verify the Key Delivery Element presence */
+	if (!fils_kde.num_kde_list) {
+		limLog(mac_ctx, LOGE, FL("FILS KDE list absent"));
+		goto verify_fils_params_fails;
+	}
+
+	/* Derive KDE elements */
+	status = lim_parse_kde_elements(mac_ctx, fils_info, fils_kde.kde_list,
+			fils_kde.num_kde_list);
+	if (!VOS_IS_STATUS_SUCCESS(status)) {
+		limLog(mac_ctx, LOGE, FL("KDE Parsing fails"));
+		goto verify_fils_params_fails;
+	}
+	return true;
+
+verify_fils_params_fails:
+	assoc_cnf->resultCode = eSIR_SME_ASSOC_REFUSED;
+	assoc_cnf->protStatusCode = eSIR_MAC_UNSPEC_FAILURE_STATUS;
+	return false;
+}
+
+/**
+ * find_ie_data_after_fils_session_ie() - Find IE pointer after FILS Session IE
+ * @mac_ctx: MAC context
+ * @buf: IE buffer
+ * @buf_len: Length of @buf
+ * @ie: Pointer to update the found IE pointer after FILS session IE
+ * @ie_len: length of the IE data after FILS session IE
+ *
+ * This API is used to find the IE data ptr and length after FILS session IE
+ *
+ * Return: VOS_STATUS_SUCCESS if found, else VOS_STATUS_E_FAILURE
+ */
+static VOS_STATUS find_ie_data_after_fils_session_ie(tpAniSirGlobal mac_ctx,
+		uint8_t *buf,
+		uint32_t buf_len,
+		uint8_t **ie,
+		uint32_t *ie_len)
+{
+	uint32_t left = buf_len;
+	uint8_t *ptr = buf;
+	uint8_t elem_id, elem_len;
+
+	if (NULL == buf || 0 == buf_len)
+		return VOS_STATUS_E_FAILURE;
+
+	while (left >= 2) {
+		elem_id = ptr[0];
+		elem_len = ptr[1];
+		left -= 2;
+		if (elem_len > left)
+			return VOS_STATUS_E_FAILURE;
+
+		if (elem_id == SIR_MAC_REQUEST_EID_MAX &&
+				ptr[2] == SIR_FILS_SESSION_EXT_EID) {
+			(*ie) = ((&ptr[1]) + ptr[1] + 1);
+			(*ie_len) = (left - elem_len);
+			return VOS_STATUS_SUCCESS;
+		}
+		left -= elem_len;
+		ptr += (elem_len + 2);
+	}
+	return VOS_STATUS_E_FAILURE;
+}
+
+/**
+ * fils_aead_encrypt() - API to do FILS AEAD encryption
+ *
+ * @kek: Pointer to KEK
+ * @kek_len: KEK length
+ * @own_mac: Pointer to own MAC address
+ * @bssid: Bssid
+ * @snonce: Supplicant Nonce
+ * @anonce: Authenticator Nonce
+ * @data: Pointer to data after MAC header
+ * @data_len: length of @data
+ * @plain_text: Pointer to data after FILS Session IE
+ * @plain_text_len: length of @plain_text
+ * @out: Pointer to the encrypted data
+ *
+ * length of AEAD encryption @out is @plain_text_len + AES_BLOCK_SIZE[16 bytes]
+ *
+ * Return: zero on success, error otherwise
+ */
+static int fils_aead_encrypt(const uint8_t *kek, unsigned int kek_len,
+		const uint8_t *own_mac, const uint8_t *bssid,
+		const uint8_t *snonce, const uint8_t *anonce,
+		const uint8_t *data, size_t data_len, uint8_t *plain_text,
+		size_t plain_text_len, uint8_t *out)
+{
+	uint8_t v[AES_BLOCK_SIZE];
+	const uint8_t *aad[6];
+	size_t aad_len[6];
+	uint8_t *buf;
+	int ret;
+
+	/* SIV Encrypt/Decrypt takes input key of length 256, 384 or 512 bits */
+	if (kek_len != 32 && kek_len != 48 && kek_len != 64) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("Invalid key length: %u"), kek_len);
+		return -EINVAL;
+	}
+
+	if (own_mac == NULL || bssid == NULL || snonce == NULL ||
+			anonce == NULL || data_len == 0 || plain_text_len == 0 ||
+			out == NULL) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("Error missing params mac:%pK bssid:%pK snonce:%pK"
+				    "anonce:%pK data_len:%zu"
+				    "plain_text_len:%zu out:%pK"),
+				own_mac, bssid, snonce, anonce, data_len,
+				plain_text_len, out);
+		return -EINVAL;
+	}
+
+	if (plain_text == out) {
+		buf = vos_mem_malloc(plain_text_len);
+		if (buf == NULL) {
+			VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+					FL("Failed to allocate memory"));
+			return -ENOMEM;
+		}
+		vos_mem_copy(buf, plain_text, plain_text_len);
+	} else {
+		buf = plain_text;
+	}
+
+	aad[0] = own_mac;
+	aad_len[0] = QDF_MAC_ADDR_SIZE;
+	aad[1] = bssid;
+	aad_len[1] = QDF_MAC_ADDR_SIZE;
+	aad[2] = snonce;
+	aad_len[2] = SIR_FILS_NONCE_LENGTH;
+	aad[3] = anonce;
+	aad_len[3] = SIR_FILS_NONCE_LENGTH;
+	aad[4] = data;
+	aad_len[4] = data_len;
+	/* Plain text, P, is Sn in AES-SIV */
+	aad[5] = buf;
+	aad_len[5] = plain_text_len;
+
+	/* AES-SIV S2V */
+	/* K1 = leftmost(K, len(K)/2) */
+	ret = qdf_aes_s2v(kek, kek_len/2, aad, aad_len, 6, v);
+	if (ret)
+		goto error;
+
+	/* out = SIV || C (Synthetic Initialization Vector || Ciphered text) */
+	vos_mem_copy(out, v, AES_BLOCK_SIZE);
+
+	/* AES-SIV CTR */
+	/* K2 = rightmost(K, len(K)/2) */
+	/* Clear 31st and 63rd bits in counter synthetic iv */
+	v[12] &= 0x7F;
+	v[8] &= 0x7F;
+
+	ret = qdf_aes_ctr(kek + kek_len/2, kek_len/2, v, buf, plain_text_len,
+			out + AES_BLOCK_SIZE, true);
+
+error:
+	if (plain_text == out)
+		vos_mem_free(buf);
+	return ret;
+}
+
+VOS_STATUS aead_encrypt_assoc_req(tpAniSirGlobal mac_ctx,
+		tpPESession pe_session,
+		uint8_t *frm, uint32_t *frm_len)
+{
+	uint8_t *plain_text = NULL, *data;
+	uint32_t plain_text_len = 0, data_len;
+	VOS_STATUS status;
+	struct pe_fils_session *fils_info = (pe_session->fils_info);
+
+	if (!fils_info)
+		return VOS_STATUS_E_FAILURE;
+
+	/*
+	 * data is the packet data after MAC header till
+	 * FILS session IE(inclusive)
+	 */
+	data = frm + sizeof(tSirMacMgmtHdr);
+
+	/*
+	 * plain_text is the packet data after FILS session IE
+	 * which needs to be encrypted. Get plain_text ptr and
+	 * plain_text_len values using find_ptr_aft_fils_session_ie()
+	 */
+	status = find_ie_data_after_fils_session_ie(mac_ctx, data +
+			FIXED_PARAM_OFFSET_ASSOC_REQ,
+			(*frm_len -
+			 FIXED_PARAM_OFFSET_ASSOC_REQ),
+			&plain_text, &plain_text_len);
+	if (!VOS_IS_STATUS_SUCCESS(status)) {
+		limLog(mac_ctx, LOGE, FL("Could not find FILS session IE"));
+		return VOS_STATUS_E_FAILURE;
+	}
+	data_len = ((*frm_len) - plain_text_len);
+
+	/* Overwrite the AEAD encrypted output @ plain_text */
+	if (fils_aead_encrypt(fils_info->kek, fils_info->kek_len,
+				pe_session->selfMacAddr, pe_session->bssId,
+				fils_info->fils_nonce,
+				fils_info->auth_info.fils_nonce,
+				data, data_len, plain_text, plain_text_len,
+				plain_text)) {
+		limLog(mac_ctx, LOGE, FL("AEAD Encryption fails !"));
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	/*
+	 * AEAD encrypted output(cipher_text) will have length equals to
+	 * plain_text_len + AES_BLOCK_SIZE(AEAD encryption header info).
+	 * Add this to frm_len
+	 */
+	(*frm_len) += (AES_BLOCK_SIZE);
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * fils_aead_decrypt() - API to do AEAD decryption
+ *
+ * @kek: Pointer to KEK
+ * @kek_len: KEK length
+ * @own_mac: Pointer to own MAC address
+ * @bssid: Bssid
+ * @snonce: Supplicant Nonce
+ * @anonce: Authenticator Nonce
+ * @data: Pointer to data after MAC header
+ * @data_len: length of @data
+ * @plain_text: Pointer to data after FILS Session IE
+ * @plain_text_len: length of @plain_text
+ * @out: Pointer to the encrypted data
+ *
+ * Return: zero on success, error otherwise
+ */
+static int fils_aead_decrypt(const uint8_t *kek, unsigned int kek_len,
+		const uint8_t *own_mac, const uint8_t *bssid,
+		const uint8_t *snonce, const uint8_t *anonce,
+		const uint8_t *data, size_t data_len, uint8_t *ciphered_text,
+		size_t ciphered_text_len, uint8_t *plain_text)
+{
+	const uint8_t *aad[6];
+	size_t aad_len[6];
+	uint8_t *buf;
+	size_t buf_len;
+	uint8_t v[AES_BLOCK_SIZE];
+	uint8_t siv[AES_BLOCK_SIZE];
+	int ret;
+
+	/* SIV Encrypt/Decrypt takes input key of length 256, 384 or 512 bits */
+	if (kek_len != 32 && kek_len != 48 && kek_len != 64) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("Invalid key length: %u"), kek_len);
+		return -EINVAL;
+	}
+
+	if (own_mac == NULL || bssid == NULL || snonce == NULL ||
+			anonce == NULL || data_len == 0 || ciphered_text_len == 0 ||
+			plain_text == NULL) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("Error missing params mac:%pK bssid:%pK snonce:%pK"
+				    "anonce:%pK data_len:%zu ciphered_text_len:%zu"
+				    "plain_text:%pK"),
+				own_mac, bssid, snonce, anonce, data_len,
+				ciphered_text_len, plain_text);
+		return -EINVAL;
+	}
+
+	vos_mem_copy(v, ciphered_text, AES_BLOCK_SIZE);
+	vos_mem_copy(siv, ciphered_text, AES_BLOCK_SIZE);
+	v[12] &= 0x7F;
+	v[8] &= 0x7F;
+
+	buf_len = ciphered_text_len - AES_BLOCK_SIZE;
+	if (ciphered_text == plain_text) {
+		/* in place decryption */
+		buf = vos_mem_malloc(buf_len);
+		if (buf == NULL) {
+			VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+					FL("Failed to allocate memory"));
+			return -ENOMEM;
+		}
+		vos_mem_copy(buf, ciphered_text + AES_BLOCK_SIZE, buf_len);
+	} else {
+		buf = ciphered_text + AES_BLOCK_SIZE;
+	}
+
+	/* AES-SIV CTR */
+	/* K2 = rightmost(K, len(K)/2) */
+	ret = qdf_aes_ctr(kek + kek_len/2, kek_len/2, v, buf, buf_len,
+			plain_text, false);
+	if (ret)
+		goto error;
+
+	aad[0] = bssid;
+	aad_len[0] = QDF_MAC_ADDR_SIZE;
+	aad[1] = own_mac;
+	aad_len[1] = QDF_MAC_ADDR_SIZE;
+	aad[2] = anonce;
+	aad_len[2] = SIR_FILS_NONCE_LENGTH;
+	aad[3] = snonce;
+	aad_len[3] = SIR_FILS_NONCE_LENGTH;
+	aad[4] = data;
+	aad_len[4] = data_len;
+	aad[5] = plain_text;
+	aad_len[5] = buf_len;
+
+	/* AES-SIV S2V */
+	/* K1 = leftmost(K, len(K)/2) */
+	ret = qdf_aes_s2v(kek, kek_len/2, aad, aad_len, 6, v);
+	if (ret)
+		goto error;
+
+	/* compare the iv generated against the one sent by AP */
+	if (memcmp(v, siv, AES_BLOCK_SIZE) != 0) {
+		VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+				FL("siv not same as frame siv"));
+		ret = -EINVAL;
+	}
+
+error:
+	if (ciphered_text == plain_text)
+		vos_mem_free(buf);
+	return ret;
+}
+
+VOS_STATUS aead_decrypt_assoc_rsp(tpAniSirGlobal mac_ctx,
+		tpPESession session,
+		tDot11fAssocResponse *ar,
+		uint8_t *p_frame, uint32_t *n_frame)
+{
+	VOS_STATUS status;
+	uint32_t data_len, fils_ies_len;
+	uint8_t *fils_ies;
+	struct pe_fils_session *fils_info = (session->fils_info);
+
+	lim_fils_data_dump("Assoc Rsp :", p_frame, *n_frame);
+	status = find_ie_data_after_fils_session_ie(mac_ctx, p_frame +
+			FIXED_PARAM_OFFSET_ASSOC_RSP,
+			((*n_frame) -
+			 FIXED_PARAM_OFFSET_ASSOC_RSP),
+			&fils_ies, &fils_ies_len);
+	if (!VOS_IS_STATUS_SUCCESS(status)) {
+		limLog(mac_ctx, LOGE, FL("FILS session IE not present"));
+		return status;
+	}
+
+	data_len = (*n_frame) - fils_ies_len;
+
+	if (fils_aead_decrypt(fils_info->kek, fils_info->kek_len,
+				session->selfMacAddr, session->bssId,
+				fils_info->fils_nonce,
+				fils_info->auth_info.fils_nonce,
+				p_frame, data_len,
+				fils_ies, fils_ies_len, fils_ies)){
+		limLog(mac_ctx, LOGE, FL("AEAD decryption fails"));
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	/* Dump the output of AEAD decrypt */
+	lim_fils_data_dump("Plain text: ", fils_ies,
+			fils_ies_len - AES_BLOCK_SIZE);
+
+	(*n_frame) -= AES_BLOCK_SIZE;
+	return status;
+}
+#endif
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/nan/nan_datapath.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/nan/nan_datapath.c
index de83345062e..24ab0900096 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/nan/nan_datapath.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/nan/nan_datapath.c
@@ -131,8 +131,9 @@ static VOS_STATUS lim_handle_ndp_indication_event(tpAniSirGlobal mac_ctx,
 	VOS_STATUS status = VOS_STATUS_SUCCESS;
 
 	limLog(mac_ctx, LOG1,
-		FL("role: %d, vdev: %d, peer_mac_addr "MAC_ADDRESS_STR),
-		ndp_ind->role, ndp_ind->vdev_id,
+		FL("role: %d, vdev: %d, csid: %d, peer_mac_addr "
+			MAC_ADDRESS_STR),
+		ndp_ind->role, ndp_ind->vdev_id, ndp_ind->ncs_sk_type,
 		MAC_ADDR_ARRAY(ndp_ind->peer_mac_addr.bytes));
 
 	if ((ndp_ind->role == NDP_ROLE_INITIATOR) ||
@@ -197,7 +198,8 @@ static VOS_STATUS lim_ndp_responder_rsp_handler(tpAniSirGlobal mac_ctx,
 		goto responder_rsp;
 	}
 
-	if (VOS_STATUS_SUCCESS == rsp_ind->status) {
+	if (VOS_STATUS_SUCCESS == rsp_ind->status &&
+	    rsp_ind->create_peer == true) {
 		ret_val = lim_add_ndi_peer(mac_ctx, rsp_ind->vdev_id,
 				rsp_ind->peer_mac_addr);
 		if (VOS_STATUS_SUCCESS != ret_val) {
@@ -729,6 +731,7 @@ void lim_process_ndi_mlm_add_bss_rsp(tpAniSirGlobal mac_ctx, tpSirMsgQ lim_msgq,
 		session_entry->bssIdx = (uint8_t) add_bss_params->bssIdx;
 		session_entry->limSystemRole = eLIM_NDI_ROLE;
 		session_entry->statypeForBss = STA_ENTRY_SELF;
+		session_entry->staId = add_bss_params->staContext.staIdx;
 		/* Apply previously set configuration at HW */
 		limApplyConfiguration(mac_ctx, session_entry);
 		mlm_start_cnf.resultCode = eSIR_SME_SUCCESS;
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/pmm/pmmAP.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/pmm/pmmAP.c
index d3ee1b4d54c..0e2ee7ce9b3 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/pmm/pmmAP.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/pmm/pmmAP.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -44,8 +44,7 @@
 #include "schApi.h"
 #include "limApi.h"
 #include "cfgApi.h"
-#include "wniCfgSta.h"
-
+#include "wni_cfg.h"
 #include "pmmApi.h"
 #include "pmmDebug.h"
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/pmm/pmmApi.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/pmm/pmmApi.c
index c80f4fa5410..09d33fb9465 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/pmm/pmmApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/pmm/pmmApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014, 2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,8 +38,7 @@
  */
 
 #include "palTypes.h"
-#include "wniCfgSta.h"
-
+#include "wni_cfg.h"
 #include "sirCommon.h"
 #include "aniGlobal.h"
 
@@ -3197,7 +3196,7 @@ tSirRetStatus pmmOffloadExitBmpsRespHandler(tpAniSirGlobal pMac,
     }
     else
     {
-        pmmLog(pMac, LOG1,
+        pmmLog(pMac, LOGE,
                "ExitBmpsResp Failed PeSessionId %x SmeSessionId %x",
                psessionEntry->peSessionId, psessionEntry->smeSessionId);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/rrm/rrmApi.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/rrm/rrmApi.c
index d42cedabbbe..5c02cefcfdb 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/rrm/rrmApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/rrm/rrmApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -44,7 +44,7 @@
 #include "wniApi.h"
 #include "sirApi.h"
 #include "aniGlobal.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "limTypes.h"
 #include "limUtils.h"
 #include "limSendSmeRspMessages.h"
@@ -282,7 +282,7 @@ rrmProcessLinkMeasurementRequest( tpAniSirGlobal pMac,
    }
    pHdr = WDA_GET_RX_MAC_HEADER( pRxPacketInfo );
 
-   LinkReport.txPower = limGetMaxTxPower (pLinkReq->MaxTxPower.maxTxPower,
+   LinkReport.txPower = limGetMaxTxPower (pSessionEntry->maxTxPower,
                                           pLinkReq->MaxTxPower.maxTxPower,
                                           pMac->roam.configParam.nTxPowerCap);
 
@@ -628,14 +628,25 @@ rrmProcessBeaconReportReq( tpAniSirGlobal pMac,
    pSmeBcnReportReq->channelList.numChannels = num_channels;
    if( pBeaconReq->measurement_request.Beacon.num_APChannelReport )
    {
-      tANI_U8 *pChanList = pSmeBcnReportReq->channelList.channelNumber;
-      for( num_APChanReport = 0 ; num_APChanReport < pBeaconReq->measurement_request.Beacon.num_APChannelReport ; num_APChanReport++ )
-      {
-         vos_mem_copy(pChanList,
-          pBeaconReq->measurement_request.Beacon.APChannelReport[num_APChanReport].channelList,
-          pBeaconReq->measurement_request.Beacon.APChannelReport[num_APChanReport].num_channelList);
-
-         pChanList += pBeaconReq->measurement_request.Beacon.APChannelReport[num_APChanReport].num_channelList;
+      tANI_U8 *ch_lst = pSmeBcnReportReq->channelList.channelNumber;
+      tANI_U8 len;
+      tANI_U16 ch_ctr = 0;
+      for(num_APChanReport = 0;
+          num_APChanReport <
+          pBeaconReq->measurement_request.Beacon.num_APChannelReport;
+          num_APChanReport++) {
+              len = pBeaconReq->measurement_request.Beacon.
+                  APChannelReport[num_APChanReport].num_channelList;
+              if (ch_ctr + len >
+                 sizeof(pSmeBcnReportReq->channelList.channelNumber))
+                      break;
+
+              vos_mem_copy(&ch_lst[ch_ctr],
+                           pBeaconReq->measurement_request.Beacon.
+                           APChannelReport[num_APChanReport].channelList,
+                           len);
+
+              ch_ctr += len;
       }
    }
 
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schApi.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schApi.c
index 4820f645685..f441e3abffe 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,8 +39,7 @@
  */
 #include "palTypes.h"
 #include "aniGlobal.h"
-#include "wniCfgSta.h"
-
+#include "wni_cfg.h"
 #include "sirMacProtDef.h"
 #include "sirMacPropExts.h"
 #include "sirCommon.h"
@@ -347,7 +346,8 @@ tSirRetStatus schSendBeaconReq( tpAniSirGlobal pMac, tANI_U8 *beaconPayload, tAN
         FL("Successfully posted WDA_SEND_BEACON_REQ to HAL"));
 
     if (LIM_IS_AP_ROLE(psessionEntry) &&
-        pMac->sch.schObject.fBeaconChanged) {
+        pMac->sch.schObject.fBeaconChanged &&
+        vos_is_probe_rsp_offload_enabled()) {
         if(eSIR_SUCCESS != (retCode = limSendProbeRspTemplateToHal(pMac,psessionEntry,
                                     &psessionEntry->DefProbeRspIeBitmap[0])))
         {
@@ -412,7 +412,7 @@ tANI_U32 limSendProbeRspTemplateToHal(tpAniSirGlobal pMac,tpPESession psessionEn
     tANI_U8 *pFrame2Hal = psessionEntry->pSchProbeRspTemplate;
     tpSendProbeRespParams pprobeRespParams=NULL;
     tANI_U32  retCode = eSIR_FAILURE;
-    tANI_U32             nPayload,nBytes,nStatus;
+    tANI_U32             nPayload, nBytes = 0, nStatus;
     tpSirMacMgmtHdr      pMacHdr;
     tANI_U32             addnIEPresent = VOS_FALSE;
     tSirRetStatus        nSirStatus;
@@ -426,24 +426,6 @@ tANI_U32 limSendProbeRspTemplateToHal(tpAniSirGlobal pMac,tpPESession psessionEn
     tSirRetStatus status;
     uint16_t addn_ielen = 0;
 
-    nStatus = dot11fGetPackedProbeResponseSize( pMac, &psessionEntry->probeRespFrame, &nPayload );
-    if ( DOT11F_FAILED( nStatus ) )
-    {
-        schLog( pMac, LOGE, FL("Failed to calculate the packed size f"
-                               "or a Probe Response (0x%08x)."),
-                nStatus );
-        // We'll fall back on the worst case scenario:
-        nPayload = sizeof( tDot11fProbeResponse );
-    }
-    else if ( DOT11F_WARNED( nStatus ) )
-    {
-        schLog( pMac, LOGE, FL("There were warnings while calculating"
-                               "the packed size for a Probe Response "
-                               "(0x%08x)."), nStatus );
-    }
-
-    nBytes = nPayload + sizeof( tSirMacMgmtHdr );
-
     //Check if probe response IE is present or not
     addnIEPresent = (psessionEntry->addIeParams.probeRespDataLen != 0);
     if (addnIEPresent)
@@ -512,6 +494,28 @@ tANI_U32 limSendProbeRspTemplateToHal(tpAniSirGlobal pMac,tpPESession psessionEn
             addnIEPresent = false; //Dont include the IE.
     }
 
+    /* merge extcap IE */
+    prb_rsp_frm = &psessionEntry->probeRespFrame;
+    if (extcap_present)
+        lim_merge_extcap_struct(&prb_rsp_frm->ExtCap, &extracted_extcap, true);
+
+    nStatus = dot11fGetPackedProbeResponseSize(pMac, &psessionEntry->probeRespFrame, &nPayload);
+    if (DOT11F_FAILED(nStatus))
+    {
+        schLog(pMac, LOGE,
+             FL("Failed to calculate the packed size for a Probe Response (0x%08x)."),
+             nStatus);
+        /* We'll fall back on the worst case scenario: */
+        nPayload = sizeof(tDot11fProbeResponse);
+    }
+    else if (DOT11F_WARNED(nStatus))
+    {
+        schLog(pMac, LOGE,
+             FL("There were warnings while calculating the packed size for a Probe Response (0x%08x)."),
+             nStatus);
+    }
+
+    nBytes += nPayload + sizeof(tSirMacMgmtHdr);
 
     // Paranoia:
     vos_mem_set(pFrame2Hal, nBytes, 0);
@@ -534,11 +538,6 @@ tANI_U32 limSendProbeRspTemplateToHal(tpAniSirGlobal pMac,tpPESession psessionEn
 
     sirCopyMacAddr(pMacHdr->bssId,psessionEntry->bssId);
 
-    /* merge extcap IE */
-    prb_rsp_frm = &psessionEntry->probeRespFrame;
-    if (extcap_present)
-        lim_merge_extcap_struct(&prb_rsp_frm->ExtCap, &extracted_extcap);
-
     // That done, pack the Probe Response:
     nStatus = dot11fPackProbeResponse( pMac, &psessionEntry->probeRespFrame, pFrame2Hal + sizeof(tSirMacMgmtHdr),
                                        nPayload, &nPayload );
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schBeaconGen.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schBeaconGen.c
index 7a8a96cba6c..94d874b92ea 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schBeaconGen.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schBeaconGen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,7 +38,7 @@
  */
 
 #include "palTypes.h"
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "aniGlobal.h"
 #include "sirMacProtDef.h"
 
@@ -271,13 +271,15 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
         vos_mem_set(( tANI_U8* )&(psessionEntry->probeRespFrame),
                     sizeof(psessionEntry->probeRespFrame), 0);
 
-        /* Can be efficiently updated whenever new IE added
-         * in Probe response in future
-         */
-        if (limUpdateProbeRspTemplateIeBitmapBeacon1(pMac, pBcn1,
-                psessionEntry) != eSIR_SUCCESS) {
-                    schLog(pMac, LOGE,
-                        FL("Failed to build ProbeRsp template"));
+        if (vos_is_probe_rsp_offload_enabled()) {
+            /* Can be efficiently updated whenever new IE added
+             * in Probe response in future
+             */
+            if (limUpdateProbeRspTemplateIeBitmapBeacon1(pMac, pBcn1,
+                   psessionEntry) != eSIR_SUCCESS) {
+                       schLog(pMac, LOGE,
+                           FL("Failed to build ProbeRsp template"));
+            }
         }
     }
 
@@ -309,9 +311,13 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
 
     if ((psessionEntry->limSystemRole == eLIM_AP_ROLE) &&
        psessionEntry->dfsIncludeChanSwIe == VOS_TRUE) {
-           populate_dot_11_f_ext_chann_switch_ann(pMac,
-                           &pBcn2->ext_chan_switch_ann,
-                           psessionEntry);
+           if (!CHAN_HOP_ALL_BANDS_ENABLE ||
+               psessionEntry->lim_non_ecsa_cap_num == 0)
+                   populate_dot_11_f_ext_chann_switch_ann(
+                       pMac, &pBcn2->ext_chan_switch_ann, psessionEntry);
+           else
+                   PopulateDot11fChanSwitchAnn(pMac, &pBcn2->ChanSwitchAnn,
+                                               psessionEntry);
     }
 
     populate_dot11_supp_operating_classes(pMac, &pBcn2->SuppOperatingClasses,
@@ -335,8 +341,10 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
           * and SAP has instructed to announce channel switch IEs
           * in beacon and probe responses
           */
-         PopulateDot11fChanSwitchAnn(pMac, &pBcn2->ChanSwitchAnn,
-                                     psessionEntry);
+          if (!CHAN_HOP_ALL_BANDS_ENABLE)
+                  PopulateDot11fChanSwitchAnn(pMac, &pBcn2->ChanSwitchAnn,
+                                              psessionEntry);
+
 #ifdef WLAN_FEATURE_11AC
          /* TODO: If in 11AC mode, wider bw channel switch announcement needs
           * to be called
@@ -362,6 +370,9 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
     populate_dot11f_avoid_channel_ie(pMac, &pBcn2->QComVendorIE, psessionEntry);
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
+    populate_dot11f_sub_20_channel_width_ie(
+        pMac, &pBcn2->QComVendorIE, psessionEntry);
+
     if (psessionEntry->dot11mode != WNI_CFG_DOT11_MODE_11B)
         PopulateDot11fERPInfo( pMac, &pBcn2->ERPInfo, psessionEntry );
 
@@ -441,9 +452,11 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
     }
 
     if (LIM_IS_AP_ROLE(psessionEntry)) {
-        /* Can be efficiently updated whenever new IE added  in Probe response in future */
-        limUpdateProbeRspTemplateIeBitmapBeacon2(pMac,pBcn2,&psessionEntry->DefProbeRspIeBitmap[0],
-                                                &psessionEntry->probeRespFrame);
+        if (vos_is_probe_rsp_offload_enabled()) {
+            /* Can be efficiently updated whenever new IE added  in Probe response in future */
+            limUpdateProbeRspTemplateIeBitmapBeacon2(pMac,pBcn2,&psessionEntry->DefProbeRspIeBitmap[0],
+                                                     &psessionEntry->probeRespFrame);
+        }
 
         /* update probe response WPS IE instead of beacon WPS IE
         * */
@@ -492,7 +505,7 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
         /* merge extcap IE */
         if (extcap_present &&
             psessionEntry->limSystemRole != eLIM_STA_IN_IBSS_ROLE)
-            lim_merge_extcap_struct(&pBcn2->ExtCap, &extracted_extcap);
+            lim_merge_extcap_struct(&pBcn2->ExtCap, &extracted_extcap, true);
 
     }
 
@@ -652,7 +665,6 @@ void limUpdateProbeRspTemplateIeBitmapBeacon2(tpAniSirGlobal pMac,
                      sizeof(beacon2->SuppOperatingClasses));
     }
 
-#ifdef FEATURE_AP_MCC_CH_AVOIDANCE
     if(beacon2->QComVendorIE.present)
     {
         SetProbeRspIeBitmap(DefProbeRspIeBitmap, SIR_MAC_QCOM_VENDOR_EID);
@@ -660,7 +672,6 @@ void limUpdateProbeRspTemplateIeBitmapBeacon2(tpAniSirGlobal pMac,
                      (void *)&beacon2->QComVendorIE,
                      sizeof(beacon2->QComVendorIE));
     }
-#endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
     /* ERP information */
     if(beacon2->ERPInfo.present)
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schBeaconProcess.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schBeaconProcess.c
index c6419cc2519..10e9920adf0 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schBeaconProcess.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schBeaconProcess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,8 +38,7 @@
  */
 
 #include "palTypes.h"
-#include "wniCfgSta.h"
-
+#include "wni_cfg.h"
 #include "cfgApi.h"
 #include "pmmApi.h"
 #include "limApi.h"
@@ -360,10 +359,16 @@ static void __schBeaconProcessForSession( tpAniSirGlobal      pMac,
     vos_mem_zero(&beaconParams, sizeof(tUpdateBeaconParams));
     beaconParams.paramChangeBitmap = 0;
 
-    if (RF_CHAN_14 >= psessionEntry->currentOperChannel)
-        cbMode = pMac->roam.configParam.channelBondingMode24GHz;
-    else
+    if (RF_CHAN_14 >= psessionEntry->currentOperChannel) {
+        if (psessionEntry->force_24ghz_in_ht20)
+                cbMode =
+                     WNI_CFG_CHANNEL_BONDING_MODE_DISABLE;
+            else
+                cbMode =
+                     pMac->roam.configParam.channelBondingMode24GHz;
+    } else {
         cbMode = pMac->roam.configParam.channelBondingMode5GHz;
+    }
 
     if (LIM_IS_IBSS_ROLE(psessionEntry)) {
         limHandleIBSScoalescing(pMac, pBeacon,  pRxPacketInfo, psessionEntry);
@@ -529,8 +534,9 @@ static void __schBeaconProcessForSession( tpAniSirGlobal      pMac,
                 skip_opmode_update = true;
 
              if (!skip_opmode_update &&
-                 (operMode != pBeacon->OperatingMode.chanWidth))
-             {
+                 ((operMode != pBeacon->OperatingMode.chanWidth) ||
+                 (pStaDs->vhtSupportedRxNss !=
+                  (pBeacon->OperatingMode.rxNSS + 1)))) {
                 uint32_t fw_vht_ch_wd = wma_get_vht_ch_width();
                 PELOG1(schLog(pMac, LOG1,
                          FL(" received OpMode Chanwidth %d, staIdx = %d"),
@@ -718,6 +724,14 @@ static void __schBeaconProcessForSession( tpAniSirGlobal      pMac,
     else
         limReceivedHBHandler(pMac, (tANI_U8)pBeacon->channelNumber, psessionEntry);
 
+    if (pBeacon->countryInfoPresent && pMac->sta_change_cc_via_beacon) {
+        schLog(pMac, LOG1, "beacon country code %c%c ssid: %s",
+               pBeacon->countryInfoParam.countryString[0],
+               pBeacon->countryInfoParam.countryString[1],
+               pBeacon->ssId.ssId);
+        lim_check_and_change_cc(pMac, pBeacon, psessionEntry);
+    }
+
     // I don't know if any additional IE is required here. Currently, not include addIE.
     if(sendProbeReq)
         limSendProbeReqMgmtFrame(pMac, &psessionEntry->ssId,
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schMessage.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schMessage.c
index 8578c14beaa..12bfadeb4f5 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schMessage.c
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/sch/schMessage.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -37,8 +37,7 @@
  */
 #include "palTypes.h"
 #include "sirCommon.h"
-
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "aniGlobal.h"
 #include "cfgApi.h"
 #include "limApi.h"
@@ -60,7 +59,6 @@
 
 // local functions
 static tSirRetStatus getWmmLocalParams(tpAniSirGlobal pMac, tANI_U32 params[][WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN]);
-static void setSchEdcaParams(tpAniSirGlobal pMac, tANI_U32 params[][WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN], tpPESession psessionEntry);
 
 // --------------------------------------------------------------------
 /**
@@ -94,6 +92,17 @@ void schSetBeaconInterval(tpAniSirGlobal pMac,tpPESession psessionEntry)
     pMac->sch.schObject.gSchBeaconInterval = (tANI_U16)bi;
 }
 
+static void sch_edca_profile_update_all(tpAniSirGlobal pmac)
+{
+	tANI_U8 i;
+	tpPESession psession_entry;
+
+	for (i = 0; i < pmac->lim.maxBssId; i++) {
+		psession_entry = &pmac->lim.gpSession[i];
+		if (psession_entry->valid)
+			schEdcaProfileUpdate(pmac, psession_entry);
+	}
+}
 
 // --------------------------------------------------------------------
 /**
@@ -113,7 +122,6 @@ void schSetBeaconInterval(tpAniSirGlobal pMac,tpPESession psessionEntry)
 
 void schProcessMessage(tpAniSirGlobal pMac,tpSirMsgQ pSchMsg)
 {
-    tANI_U32            val;
     tpPESession psessionEntry = &pMac->lim.gpSession[0];
     PELOG3(schLog(pMac, LOG3, FL("Received message (%x) "), pSchMsg->type);)
 
@@ -154,10 +162,6 @@ void schProcessMessage(tpAniSirGlobal pMac,tpSirMsgQ pSchMsg)
             break;
 
         case SIR_CFG_PARAM_UPDATE_IND:
-
-            if (wlan_cfgGetInt(pMac, (tANI_U16) pSchMsg->bodyval, &val) != eSIR_SUCCESS)
-                schLog(pMac, LOGP, FL("failed to cfg get id %d"), pSchMsg->bodyval);
-
             switch (pSchMsg->bodyval)
             {
                 case WNI_CFG_BEACON_INTERVAL:
@@ -166,7 +170,6 @@ void schProcessMessage(tpAniSirGlobal pMac,tpSirMsgQ pSchMsg)
                         schSetBeaconInterval(pMac,psessionEntry);
                     break;
 
-
                 case WNI_CFG_DTIM_PERIOD:
                     pMac->sch.schObject.gSchDTIMCount = 0;
                     break;
@@ -175,6 +178,11 @@ void schProcessMessage(tpAniSirGlobal pMac,tpSirMsgQ pSchMsg)
                     pMac->sch.schObject.gSchCFPCount = 0;
                     break;
 
+                case WNI_CFG_COUNTRY_CODE:
+                    schLog(pMac, LOG3, FL("sch : WNI_CFG_COUNTRY_CODE"));
+                    sch_edca_profile_update_all(pMac);
+                    break;
+
                 case WNI_CFG_EDCA_PROFILE:
                     schEdcaProfileUpdate(pMac, psessionEntry);
                     break;
@@ -229,18 +237,31 @@ schGetParams(
     tANI_U32 val;
     tANI_U32 i,idx;
     tANI_U32 *prf;
-
+    tANI_U8 country_code_str[WNI_CFG_COUNTRY_CODE_LEN] = {0};
+    tANI_U32 country_code_len = WNI_CFG_COUNTRY_CODE_LEN;
     tANI_U32 ani_l[] = { WNI_CFG_EDCA_ANI_ACBE_LOCAL,WNI_CFG_EDCA_ANI_ACBK_LOCAL,
                    WNI_CFG_EDCA_ANI_ACVI_LOCAL, WNI_CFG_EDCA_ANI_ACVO_LOCAL };
     tANI_U32 wme_l[] = {WNI_CFG_EDCA_WME_ACBE_LOCAL, WNI_CFG_EDCA_WME_ACBK_LOCAL,
                    WNI_CFG_EDCA_WME_ACVI_LOCAL, WNI_CFG_EDCA_WME_ACVO_LOCAL};
+    tANI_U32 etsi_l[] = {WNI_CFG_EDCA_ETSI_ACBE_LOCAL,
+                   WNI_CFG_EDCA_ETSI_ACBK_LOCAL,
+                   WNI_CFG_EDCA_ETSI_ACVI_LOCAL,
+                   WNI_CFG_EDCA_ETSI_ACVO_LOCAL};
     tANI_U32 ani_b[] = {WNI_CFG_EDCA_ANI_ACBE, WNI_CFG_EDCA_ANI_ACBK,
                    WNI_CFG_EDCA_ANI_ACVI, WNI_CFG_EDCA_ANI_ACVO};
     tANI_U32 wme_b[] = {WNI_CFG_EDCA_WME_ACBE, WNI_CFG_EDCA_WME_ACBK,
                    WNI_CFG_EDCA_WME_ACVI, WNI_CFG_EDCA_WME_ACVO};
-
-    if (wlan_cfgGetInt(pMac, WNI_CFG_EDCA_PROFILE, &val) != eSIR_SUCCESS)
-    {
+    tANI_U32 etsi_b[] = {WNI_CFG_EDCA_ETSI_ACBE, WNI_CFG_EDCA_ETSI_ACBK,
+                   WNI_CFG_EDCA_ETSI_ACVI, WNI_CFG_EDCA_ETSI_ACVO};
+
+    if ((wlan_cfgGetStr(pMac, WNI_CFG_COUNTRY_CODE, country_code_str,
+                        &country_code_len) == eSIR_SUCCESS) &&
+        vos_is_etsi_europe_country(country_code_str)) {
+        val = WNI_CFG_EDCA_PROFILE_ETSI_EUROPE;
+        schLog(pMac, LOG1, FL("swith to ETSI EUROPE profile cc:%c%c"),
+               country_code_str[0], country_code_str[1]);
+    } else if (wlan_cfgGetInt(pMac, WNI_CFG_EDCA_PROFILE, &val) !=
+               eSIR_SUCCESS) {
         schLog(pMac, LOGP, FL("failed to cfg get EDCA_PROFILE id %d"),
                WNI_CFG_EDCA_PROFILE);
         return eSIR_FAILURE;
@@ -263,6 +284,9 @@ schGetParams(
            case WNI_CFG_EDCA_PROFILE_WMM:
               prf = &wme_l[0];
               break;
+           case WNI_CFG_EDCA_PROFILE_ETSI_EUROPE:
+              prf = &etsi_l[0];
+              break;
            case WNI_CFG_EDCA_PROFILE_ANI:
            default:
               prf = &ani_l[0];
@@ -276,6 +300,9 @@ schGetParams(
            case WNI_CFG_EDCA_PROFILE_WMM:
               prf = &wme_b[0];
               break;
+           case WNI_CFG_EDCA_PROFILE_ETSI_EUROPE:
+              prf = &etsi_b[0];
+              break;
            case WNI_CFG_EDCA_PROFILE_ANI:
            default:
               prf = &ani_b[0];
@@ -301,10 +328,69 @@ schGetParams(
         for (idx=0; idx < len; idx++)
             params[i][idx] = (tANI_U32) data[idx];
     }
+
+    /* If gStaLocalEDCAEnable = 1,
+     * WNI_CFG_EDCA_ETSI_ACBE Txop limit minus 500us
+     */
+    if (local && (val == WNI_CFG_EDCA_PROFILE_ETSI_EUROPE) &&
+        pMac->roam.configParam.gStaLocalEDCAEnable) {
+        /* Txop limit 5500us / 32 = 0xab */
+        params[0][WNI_CFG_EDCA_PROFILE_TXOPA_IDX] = 0xab;
+    }
     PELOG1(schLog(pMac, LOG1, FL("GetParams: local=%d, profile = %d Done"), local, val);)
     return eSIR_SUCCESS;
 }
 
+/* Get Hostapd EDCA params if set*/
+tSirRetStatus
+sch_get_hostapd_edca(tpAniSirGlobal pMac,
+		     tANI_U32 params[][WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN],
+		     tANI_U8 local)
+{
+	tANI_U32 i, idx;
+	tANI_U32 *prf;
+	tANI_U32 hostapd_edca_local[] = {WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL,
+					 WNI_CFG_EDCA_HOSTAPD_ACVI_LOCAL,
+					 WNI_CFG_EDCA_HOSTAPD_ACBE_LOCAL,
+					 WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL};
+	tANI_U8 ac[4] = {EDCA_AC_VO, EDCA_AC_VI, EDCA_AC_BE, EDCA_AC_BK};
+
+	if (local) {
+		for (i = 0; i < MAX_NUM_AC; i++) {
+			tANI_U8  data[WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL_LEN];
+			tANI_U32 len = WNI_CFG_EDCA_HOSTAPD_ACVO_LOCAL_LEN;
+
+			prf = &hostapd_edca_local[i];
+
+			if (wlan_cfgGetStr(pMac, (tANI_U16)(*prf), (tANI_U8 *)
+			    &data[0], &len) != eSIR_SUCCESS) {
+				schLog(pMac, LOGP,
+				       FL("cfgGet %d failed"), *prf);
+				return eSIR_FAILURE;
+			}
+			if (len > WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL_LEN) {
+				schLog(pMac, LOGE,
+				       FL("cfgGet %d: length is %d not %d"),
+				       *prf, len,
+				       WNI_CFG_EDCA_HOSTAPD_ACBK_LOCAL_LEN);
+				return eSIR_FAILURE;
+			}
+			if (data[len-1]) {
+				for (idx = 0; idx < len-1; idx++)
+					params[ac[i]][idx] =
+					       (tANI_U32)data[idx];
+			} else {
+				/* Jump the loop if the first cfg is not enable,
+				 * no need to judge the other 3 cfg as hostapd
+				 * set 4 AC one time */
+				break;
+			}
+
+		}
+	}
+	return eSIR_SUCCESS;
+}
+
 static bool
 broadcastWMMOfConcurrentSTASession(tpAniSirGlobal pMac,
 	tpPESession psessionEntry)
@@ -461,6 +547,12 @@ schQosUpdateLocal(tpAniSirGlobal pMac, tpPESession psessionEntry)
         return;
     }
 
+    if (LIM_IS_AP_ROLE(psessionEntry)) {
+        if (sch_get_hostapd_edca(pMac, params, true) != eSIR_SUCCESS) {
+            /* If fail to get Hostapd EDCA, use default EDCA */
+            PELOGE(schLog(pMac, LOGE, FL("sch_get_hostapd_edca failed"));)
+        }
+    }
     setSchEdcaParams(pMac, params, psessionEntry);
 
     //For AP, the bssID is stored in LIM Global context.
@@ -490,7 +582,6 @@ schSetDefaultEdcaParams(tpAniSirGlobal pMac, tpPESession psessionEntry)
     return;
 }
 
-
 /** ----------------------------------------------------------
 \fn      setSchEdcaParams
 \brief   This function fills in the gLimEdcaParams structure
@@ -498,7 +589,7 @@ schSetDefaultEdcaParams(tpAniSirGlobal pMac, tpPESession psessionEntry)
 \param   tpAniSirGlobal  pMac
 \return  none
 \ ------------------------------------------------------------ */
-static void
+void
 setSchEdcaParams(tpAniSirGlobal pMac, tANI_U32 params[][WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN], tpPESession psessionEntry)
 {
     tANI_U32 i;
@@ -545,6 +636,7 @@ setSchEdcaParams(tpAniSirGlobal pMac, tANI_U32 params[][WNI_CFG_EDCA_ANI_ACBK_LO
                 psessionEntry->gLimEdcaParams[i].cw.max,
                 psessionEntry->gLimEdcaParams[i].txoplimit);)
 
+
     }
     return;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/SAP/inc/sapApi.h b/drivers/staging/qcacld-2.0/CORE/SAP/inc/sapApi.h
index 42208fea064..1c34ba5a1ab 100644
--- a/drivers/staging/qcacld-2.0/CORE/SAP/inc/sapApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/SAP/inc/sapApi.h
@@ -73,6 +73,8 @@ when           who                what, where, why
 #include "vos_packet.h"
 #include "vos_types.h"
 
+#include "wlan_defs.h"
+
 #include "p2p_Api.h"
 #include "sme_Api.h"
 /*----------------------------------------------------------------------------
@@ -101,7 +103,14 @@ when           who                what, where, why
 #define       MAX_TEXT_SIZE                32
 
 #define       MAX_CHANNEL_LIST_LEN         256
-#define       VOS_MAX_NO_OF_SAP_MODE       2 // max # of SAP
+/*
+ * max # of SAP
+ */
+#ifdef WLAN_4SAP_CONCURRENCY
+#define       VOS_MAX_NO_OF_SAP_MODE       4
+#else
+#define       VOS_MAX_NO_OF_SAP_MODE       2
+#endif
 #define       SAP_MAX_NUM_SESSION          5
 #define       SAP_MAX_OBSS_STA_CNT         1 // max # of OBSS STA
 
@@ -257,6 +266,7 @@ typedef struct sap_StationAssocIndication_s {
     eCsrEncryptionType negotiatedUCEncryptionType;
     eCsrEncryptionType negotiatedMCEncryptionType;
     tANI_BOOLEAN fAuthRequired;
+    uint8_t      ecsa_capable;
 } tSap_StationAssocIndication;
 
 typedef struct sap_StationAssocReassocCompleteEvent_s {
@@ -277,6 +287,18 @@ typedef struct sap_StationAssocReassocCompleteEvent_s {
     tANI_U8*     assocRespPtr;
     tANI_U8      timingMeasCap;
     tSirSmeChanInfo chan_info;
+    uint8_t      ecsa_capable;
+    bool                 ampdu;
+    bool                 sgi_enable;
+    bool                 tx_stbc;
+    bool                 rx_stbc;
+    tSirMacHTChannelWidth ch_width;
+    enum sir_sme_phy_mode mode;
+    uint8_t              max_supp_idx;
+    uint8_t              max_ext_idx;
+    uint8_t              max_mcs_idx;
+    uint8_t              rx_mcs_map;
+    uint8_t              tx_mcs_map;
 } tSap_StationAssocReassocCompleteEvent;
 
 typedef struct sap_StationDisassocCompleteEvent_s {
@@ -492,6 +514,24 @@ enum vendor_ie_access_policy {
 	ACCESS_POLICY_DONOT_RESPOND_IF_IE_IS_PRESENT,
 };
 
+/*
+ * enum sub20_chan_switch_mode- sub20 channel
+ * switch mode
+ * @SUB20_NONE: unsupport sub20 channel width
+ * @SUB20_STATIC: support sub20 channel width,
+ * but unsupport sub20 channel width switch
+ * @SUB20_DYN: support sub20 channel width,
+ * sub20 channel width switch auto
+ * @SUB20_MANUAL: support sub20 channel width,
+ * sub20 channel width switch manual
+ */
+enum sub20_chan_switch_mode {
+	SUB20_NONE,
+	SUB20_STATIC,
+	SUB20_DYN,
+	SUB20_MANUAL
+};
+
 typedef struct sap_Config {
     tSap_SSIDInfo_t SSIDinfo;
     eCsrPhyMode     SapHw_mode; /* Wireless Mode */
@@ -507,6 +547,10 @@ typedef struct sap_Config {
     uint8_t         sec_ch;
     uint16_t         vht_channel_width;
     uint16_t         ch_width_orig;
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+    uint16_t         ch_width_24g_orig;
+    uint16_t         ch_width_5g_orig;
+#endif
     v_U8_t          max_num_sta;     /* maximum number of STAs in station table */
     v_U8_t          dtim_period;     /* dtim interval */
     v_U8_t          num_accept_mac;
@@ -532,6 +576,7 @@ typedef struct sap_Config {
     v_U32_t         ht_op_mode_fixed;
     tVOS_CON_MODE   persona; /*Tells us which persona it is GO or AP for now*/
     v_U8_t          disableDFSChSwitch;
+    v_U8_t          enable_radar_war;
     eCsrBand        scanBandPreference;
     v_BOOL_t        enOverLapCh;
     v_U16_t         acsBandSwitchThreshold;
@@ -543,6 +588,8 @@ typedef struct sap_Config {
 #endif
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
     v_U8_t          cc_switch_mode;
+    bool            band_switch_enable;
+    bool            ap_p2pclient_concur_enable;
 #endif
 
     v_U16_t    probeRespIEsBufferLen;
@@ -565,6 +612,15 @@ typedef struct sap_Config {
     uint8_t ampdu_size;
     tSirMacRateSet  supported_rates;
     tSirMacRateSet  extended_rates;
+    eCsrBand   target_band;
+    uint16_t  sub20_channelwidth;
+    /* beacon count before channel switch */
+    uint8_t          sap_chanswitch_beacon_cnt;
+    uint8_t          sap_chanswitch_mode;
+    bool             dfs_beacon_tx_enhanced;
+    uint16_t         reduced_beacon_interval;
+    enum sub20_chan_switch_mode  sub20_switch_mode;
+    uint8_t backup_channel;
 } tsap_Config_t;
 
 #ifdef FEATURE_WLAN_AP_AP_ACS_OPTIMIZE
@@ -674,7 +730,15 @@ typedef struct sSapDfsInfo
      * channel switch is disabled.
      */
     v_U8_t              disable_dfs_ch_switch;
+    v_U8_t              sap_enable_radar_war;
     uint16_t            tx_leakage_threshold;
+    uint8_t             new_sub20_channelwidth;
+    /* beacon count before channel switch */
+    uint8_t            sap_ch_switch_beacon_cnt;
+    uint8_t            sap_ch_switch_mode;
+    bool               dfs_beacon_tx_enhanced;
+    uint16_t           reduced_beacon_interval;
+    enum sub20_chan_switch_mode  sub20_switch_mode;
 } tSapDfsInfo;
 
 typedef struct tagSapCtxList
@@ -2428,8 +2492,31 @@ VOS_STATUS wlansap_set_tx_leakage_threshold(tHalHandle hal,
 VOS_STATUS wlansap_get_chan_width(void *pvosctx,
 			uint32_t *pchanwidth);
 
-eHalStatus sapRoamSessionCloseCallback(void *pContext);
+VOS_STATUS wlansap_set_invalid_session(v_PVOID_t pctx);
 
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+VOS_STATUS
+WLANSAP_set_sub20_channelwidth_with_csa(
+	void *vos_ctx_ptr, uint32_t chan_width);
+VOS_STATUS
+WLANSAP_get_sub20_channelwidth(void *vos_ctx_ptr, uint32_t *chan_width);
+
+#else
+static inline VOS_STATUS
+WLANSAP_set_sub20_channelwidth_with_csa(
+	void *vos_ctx_ptr, uint32_t chan_width)
+{
+	return VOS_STATUS_SUCCESS;
+}
+
+static inline VOS_STATUS
+WLANSAP_get_sub20_channelwidth(void *vos_ctx_ptr, uint32_t *chan_width)
+{
+	*chan_width = 0;
+	return VOS_STATUS_SUCCESS;
+}
+#endif
+eHalStatus sapRoamSessionCloseCallback(void *pContext);
 #ifdef __cplusplus
  }
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapApiLinkCntl.c b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapApiLinkCntl.c
index f02a33b5210..8c7c26dcd71 100644
--- a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapApiLinkCntl.c
+++ b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapApiLinkCntl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -139,6 +139,7 @@ WLANSAP_ScanCallback
     tWLAN_SAPEvent sapEvent; /* State machine event */
     v_U8_t operChannel = 0;
     VOS_STATUS sapstatus;
+    tCsrRoamInfo *roam_info = NULL;
     tpAniSirGlobal pMac = NULL;
     v_U32_t event;
 
@@ -211,48 +212,62 @@ WLANSAP_ScanCallback
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, CSR scanStatus = %s (%d)", __func__, "eCSR_SCAN_ABORT/FAILURE", scanStatus);
     }
 
-    if (operChannel == SAP_CHANNEL_NOT_SELECTED)
+    if (psapContext->sapsMachine != eSAP_STARTED) {
+        if (operChannel == SAP_CHANNEL_NOT_SELECTED)
 #ifdef SOFTAP_CHANNEL_RANGE
-    {
-        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-             "%s: No suitable channel selected due to DFS, LTE-Coex and "
-             "Concurrent mode restrictions", __func__);
-
-        if ( eCSR_BAND_ALL ==  psapContext->scanBandPreference ||
-                     psapContext->allBandScanned == eSAP_TRUE)
-        {
-            psapContext->sapsMachine = eSAP_CH_SELECT;
-            event = eSAP_CHANNEL_SELECTION_FAILED;
-        }
-        else
         {
-            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
-             "%s: Has scan band preference",
-             __func__);
-            if (eCSR_BAND_24 == psapContext->currentPreferredBand)
-                psapContext->currentPreferredBand = eCSR_BAND_5G;
-            else
-                psapContext->currentPreferredBand = eCSR_BAND_24;
+            VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+                      "%s: No suitable channel selected due to DFS, LTE-Coex and Concurrent mode restrictions", __func__);
+
+            if (eCSR_BAND_ALL == psapContext->scanBandPreference ||
+                psapContext->allBandScanned == eSAP_TRUE) {
+                psapContext->sapsMachine = eSAP_CH_SELECT;
+                event = eSAP_CHANNEL_SELECTION_FAILED;
+            } else {
+                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                          "%s: Has scan band preference",
+                          __func__);
+                if (eCSR_BAND_24 == psapContext->currentPreferredBand)
+                    psapContext->currentPreferredBand = eCSR_BAND_5G;
+                else
+                    psapContext->currentPreferredBand = eCSR_BAND_24;
 
-            psapContext->allBandScanned = eSAP_TRUE;
-            //go back to DISCONNECT state, scan next band
-            psapContext->sapsMachine = eSAP_DISCONNECTED;
-            event = eSAP_CHANNEL_SELECTION_RETRY;
-         }
-    }
+                psapContext->allBandScanned = eSAP_TRUE;
+                /* go back to DISCONNECT state, scan next band */
+                psapContext->sapsMachine = eSAP_DISCONNECTED;
+                event = eSAP_CHANNEL_SELECTION_RETRY;
+            }
+        }
 #else
-        psapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
+            psapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
 #endif
-    else
-    {
-        psapContext->channel = operChannel;
+        else
+            psapContext->channel = operChannel;
+
+        sme_SelectCBMode(halHandle,
+                         psapContext->csrRoamProfile.phyMode,
+                         psapContext->channel, psapContext->secondary_ch,
+                         &psapContext->vht_channel_width,
+                         psapContext->ch_width_orig);
+
+        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+                  "In %s, Channel selected = %d", __func__,
+                  psapContext->channel);
+    } else {
+        psapContext->channel = psapContext->backup_channel;
+
+        roam_info = vos_mem_malloc(sizeof(*roam_info));
+        if (!roam_info) {
+            VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                      FL("Memory allocation failure!"));
+        } else {
+            roam_info->target_channel = operChannel;
+            VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+                      "In %s, Channel selected = %d", __func__,
+                      roam_info->target_channel);
+        }
     }
 
-    sme_SelectCBMode(halHandle,
-                     psapContext->csrRoamProfile.phyMode,
-                     psapContext->channel, psapContext->secondary_ch,
-                     &psapContext->vht_channel_width,
-                     psapContext->ch_width_orig);
 #ifdef SOFTAP_CHANNEL_RANGE
     if(psapContext->channelList != NULL)
     {
@@ -264,17 +279,17 @@ WLANSAP_ScanCallback
     }
 #endif
 
-    VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, Channel selected = %d", __func__, psapContext->channel);
-
     /* Fill in the event structure */
     sapEvent.event = event;
-    sapEvent.params = 0;        // pCsrRoamInfo;
+    sapEvent.params = roam_info;
     sapEvent.u1 = scanStatus;   // roamstatus
     sapEvent.u2 = 0;            // roamResult
 
     /* Handle event */
     sapstatus = sapFsm(psapContext, &sapEvent);
 
+    if (roam_info)
+        vos_mem_free(roam_info);
     return sapstatus;
 }// WLANSAP_ScanCallback
 
@@ -479,7 +494,7 @@ WLANSAP_PreStartBssAcsScanCallback
             }
         }
 #else
-        psapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
+        psapContext->channel = sap_select_default_oper_chan_ini(halHandle, 0);
 #endif
         else
         {
@@ -520,16 +535,28 @@ WLANSAP_PreStartBssAcsScanCallback
     }
     else
     {
+#ifdef SOFTAP_CHANNEL_RANGE
+        if(psapContext->channelList != NULL)
+        {
+            /*
+             * Always free up the memory for
+             * channel selection whatever
+             * the result
+             */
+            vos_mem_free(psapContext->channelList);
+            psapContext->channelList = NULL;
+            psapContext->num_of_channel = 0;
+        }
+#endif
+
         VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
                    FL("CSR scanStatus = %s (%d), choose default channel"),
                    "eCSR_SCAN_ABORT/FAILURE", scanStatus );
 #ifdef SOFTAP_CHANNEL_RANGE
-        if(psapContext->acs_cfg->hw_mode == eCSR_DOT11_MODE_11a)
-            psapContext->channel = SAP_DEFAULT_5GHZ_CHANNEL;
-        else
-            psapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
+        psapContext->channel = sap_select_default_oper_chan_ini(halHandle,
+                                         psapContext->acs_cfg->hw_mode);
 #else
-        psapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
+        psapContext->channel = sap_select_default_oper_chan_ini(halHandle, 0);
 #endif
         halStatus = sapSignalHDDevent(psapContext, NULL,
                                       eSAP_ACS_CHANNEL_SELECTED,
@@ -758,7 +785,7 @@ WLANSAP_RoamCallback
                         pSapContext = pMac->sap.sapCtxList[intf].pSapContext;
                         VOS_TRACE(VOS_MODULE_ID_SAP,
                                   VOS_TRACE_LEVEL_ERROR,
-                        "sapdfs: no available channel for sapctx[%p], StopBss",
+                        "sapdfs: no available channel for sapctx[%pK], StopBss",
                                   pSapContext);
 
                         WLANSAP_StopBss(pSapContext);
@@ -878,6 +905,7 @@ WLANSAP_RoamCallback
             }
             break;
 
+        case eCSR_ROAM_RESULT_DEAUTH_IND:
         case eCSR_ROAM_RESULT_DISASSOC_IND:
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                           FL("CSR roamResult = %s (%d)"),
@@ -891,20 +919,6 @@ WLANSAP_RoamCallback
             }
             break;
 
-        case eCSR_ROAM_RESULT_DEAUTH_IND:
-            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-                          FL("CSR roamResult = %s (%d)"),
-                             "eCSR_ROAM_RESULT_DEAUTH_IND",
-                              roamResult);
-            /* Fill in the event structure */
-            //TODO: we will use the same event inorder to inform HDD to disassociate the station
-            vosStatus = sapSignalHDDevent( sapContext, pCsrRoamInfo, eSAP_STA_DISASSOC_EVENT, (v_PVOID_t)eSAP_STATUS_SUCCESS);
-            if(!VOS_IS_STATUS_SUCCESS(vosStatus))
-            {
-                halStatus = eHAL_STATUS_FAILURE;
-            }
-            break;
-
         case eCSR_ROAM_RESULT_MIC_ERROR_GROUP:
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                           FL("CSR roamResult = %s (%d)"),
@@ -1225,7 +1239,7 @@ WLANSAP_RoamCallback
                                       pMac->sap.sapCtxList[intf].pSapContext;
                                       VOS_TRACE(VOS_MODULE_ID_SAP,
                                                 VOS_TRACE_LEVEL_INFO_MED,
-                                    "sapdfs:issue chnl change for sapctx[%p]",
+                                    "sapdfs:issue chnl change for sapctx[%pK]",
                                                 pSapContext);
                                    /* Send channel switch request */
                                    sapEvent.event = eWNI_SME_CHANNEL_CHANGE_REQ;
@@ -1241,7 +1255,7 @@ WLANSAP_RoamCallback
                                        halStatus = eHAL_STATUS_FAILURE;
                                        VOS_TRACE(VOS_MODULE_ID_SAP,
                                                  VOS_TRACE_LEVEL_ERROR,
-                                       FL("post chnl chng req failed, sap[%p]"),
+                                       FL("post chnl chng req failed, sap[%pK]"),
                                        sapContext);
                                    }
                                    else
@@ -1256,7 +1270,7 @@ WLANSAP_RoamCallback
                      else
                      {
                          VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_MED,
-                         FL("sapdfs: sapctx[%p] ready but not concurrent sap"),
+                         FL("sapdfs: sapctx[%pK] ready but not concurrent sap"),
                          sapContext);
 
                          halStatus = eHAL_STATUS_SUCCESS;
@@ -1317,7 +1331,7 @@ WLANSAP_RoamCallback
                       sapContext->sapsMachine = eSAP_DISCONNECTED;
 
                       VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_MED,
-                      "sapdfs: from state %s => %s with ignore cac FALSE on sapctx[%p]",
+                      "sapdfs: from state %s => %s with ignore cac FALSE on sapctx[%pK]",
                       "eSAP_DISCONNECTING", "DISCONNECTED", sapContext);
 
                       /* DFS Channel */
@@ -1329,7 +1343,7 @@ WLANSAP_RoamCallback
                    else
                    {
                       VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_MED,
-                      "sapdfs: from state %s => %s with ignore cac TRUE on sapctx[%p]",
+                      "sapdfs: from state %s => %s with ignore cac TRUE on sapctx[%pK]",
                       "eSAP_DISCONNECTING", "eSAP_STARTING", sapContext);
 
                       /* Start beaconing on the new channel */
@@ -1345,7 +1359,7 @@ WLANSAP_RoamCallback
                else
                {
                   VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_MED,
-                  "sapdfs: from state %s => %s on sapctx[%p]",
+                  "sapdfs: from state %s => %s on sapctx[%pK]",
                   "eSAP_DISCONNECTING", "eSAP_STARTING", sapContext);
 
                   /* non-DFS channel */
diff --git a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapChSelect.c b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapChSelect.c
index 7fcecd69193..6db07799b0f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapChSelect.c
+++ b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapChSelect.c
@@ -139,7 +139,6 @@
 #define ACS_WEIGHT_SOFTAP_TX_POWER_THROUGHPUT_CFG(weights) \
 	(((weights) & 0xf00000) >> 20)
 
-
 #ifdef FEATURE_WLAN_CH_AVOID
 sapSafeChannelType safeChannels[NUM_20MHZ_RF_CHANNELS] =
 {
@@ -363,9 +362,7 @@ sap_process_avoid_ie(tHalHandle hal,
 	node = sme_ScanResultGetFirst(hal, scan_result);
 
 	while (node) {
-		total_ie_len = (node->BssDescriptor.length +
-				sizeof(tANI_U16) + sizeof(tANI_U32) -
-				sizeof(tSirBssDescription));
+		total_ie_len = GET_IE_LEN_IN_BSS(node->BssDescriptor.length);
 		temp_ptr = cfg_get_vendor_ie_ptr_from_oui(mac_ctx,
 				SIR_MAC_QCOM_VENDOR_OUI,
 				SIR_MAC_QCOM_VENDOR_SIZE,
@@ -375,6 +372,7 @@ sap_process_avoid_ie(tHalHandle hal,
 		if (temp_ptr) {
 			avoid_ch_ie = (struct sAvoidChannelIE*)temp_ptr;
 			if (avoid_ch_ie->type != QCOM_VENDOR_IE_MCC_AVOID_CH) {
+				node = sme_ScanResultGetNext(hal, scan_result);
 				continue;
 			}
 			sap_ctx->sap_detected_avoid_ch_ie.present = 1;
@@ -653,7 +651,6 @@ v_U8_t sapSelectPreferredChannelFromChannelList(v_U8_t bestChNum,
   PARAMETERS
 
     IN
-    sap_ctx     : Softap context
     halHandle          : Pointer to tHalHandle
     *pSpectInfoParams  : Pointer to tSapChSelSpectInfo structure
      pSapCtx           : Pointer to SAP Context
@@ -781,6 +778,7 @@ v_BOOL_t sapChanSelInit(tHalHandle halHandle,
   PARAMETERS
 
     IN
+    sap_ctx     : Softap context
     rssi        : Max signal strength receieved from a BSS for the channel
     count       : Number of BSS observed in the channel
 
@@ -811,20 +809,18 @@ v_U32_t sapweightRssiCount(ptSapContext sap_ctx, v_S7_t rssi, v_U16_t count)
         ACS_WEIGHT_CFG_TO_LOCAL(sap_ctx->auto_channel_select_weight,
                                 softap_count_weight_cfg);
 
-
     // Weight from RSSI
     rssiWeight = ACS_WEIGHT_COMPUTE(sap_ctx->auto_channel_select_weight,
                                     softap_rssi_weight_cfg,
                                     rssi - SOFTAP_MIN_RSSI,
                                     SOFTAP_MAX_RSSI - SOFTAP_MIN_RSSI);
+
     if(rssiWeight > softap_rssi_weight_local)
         rssiWeight = softap_rssi_weight_local;
-
     else if (rssiWeight < 0)
         rssiWeight = 0;
 
     // Weight from data count
-
     countWeight = ACS_WEIGHT_COMPUTE(sap_ctx->auto_channel_select_weight,
                                      softap_count_weight_cfg,
                                      count - SOFTAP_MIN_COUNT,
@@ -841,6 +837,7 @@ v_U32_t sapweightRssiCount(ptSapContext sap_ctx, v_S7_t rssi, v_U16_t count)
     return(rssicountWeight);
 }
 
+
 /**
  * sap_get_channel_status() - get channel info via channel number
  * @p_mac: Pointer to Global MAC structure
@@ -849,9 +846,9 @@ v_U32_t sapweightRssiCount(ptSapContext sap_ctx, v_S7_t rssi, v_U16_t count)
  * Return: chan status info
  */
 struct lim_channel_status *sap_get_channel_status
-       (tpAniSirGlobal p_mac, uint32_t channel_id)
+	(tpAniSirGlobal p_mac, uint32_t channel_id)
 {
-       return csr_get_channel_status(p_mac, channel_id);
+	return csr_get_channel_status(p_mac, channel_id);
 }
 
 /**
@@ -862,14 +859,15 @@ struct lim_channel_status *sap_get_channel_status
  */
 void sap_clear_channel_status(tpAniSirGlobal p_mac)
 {
-       csr_clear_channel_status(p_mac);
+	csr_clear_channel_status(p_mac);
 }
 
 /**
- * sap_weight_channel_noise_floor() - compute chan floor weight
+ * sap_weight_channel_noise_floor() - compute noise floor weight
+ * @sap_ctx:  sap context
  * @chn_stat: Pointer to chan status info
  *
- * Return: chan noise floor weight
+ * Return: channel noise floor weight
  */
 uint32_t sap_weight_channel_noise_floor(ptSapContext sap_ctx,
 	struct lim_channel_status *channel_stat)
@@ -921,17 +919,15 @@ uint32_t sap_weight_channel_noise_floor(ptSapContext sap_ctx,
  * @chn_stat: Pointer to chan status info
  *
  * Return: channel free weight
-  */
-
+ */
 uint32_t sap_weight_channel_free(ptSapContext sap_ctx,
 	struct lim_channel_status *channel_stat)
-
 {
-       uint32_t     channel_free_weight;
-       uint8_t      softap_channel_free_weight_cfg;
-       uint8_t      softap_channel_free_weight_local;
-       uint32_t     rx_clear_count = 0;
-       uint32_t     cycle_count = 0;
+	uint32_t     channel_free_weight;
+	uint8_t      softap_channel_free_weight_cfg;
+	uint8_t      softap_channel_free_weight_local;
+	uint32_t     rx_clear_count = 0;
+	uint32_t     cycle_count = 0;
 
 	softap_channel_free_weight_cfg =
 	    ACS_WEIGHT_SOFTAP_CHANNEL_FREE_CFG
@@ -948,31 +944,35 @@ uint32_t sap_weight_channel_free(ptSapContext sap_ctx,
 		return softap_channel_free_weight_local;
 	}
 
+	rx_clear_count = channel_stat->rx_clear_count -
+			 channel_stat->tx_frame_count -
+			 channel_stat->rx_frame_count;
+	cycle_count = channel_stat->cycle_count;
 
-       rx_clear_count = channel_stat->rx_clear_count;
-       cycle_count = channel_stat->cycle_count;
 	/* LSH 4, otherwise it is always 0. */
 	channel_free_weight = (cycle_count == 0) ? 0 :
 			 (ACS_WEIGHT_COMPUTE(
 			  sap_ctx->auto_channel_select_weight,
 			  softap_channel_free_weight_cfg,
 			  ((rx_clear_count << 8) +
-	                  (cycle_count >> 1))/cycle_count -
+			   (cycle_count >> 1))/cycle_count -
 			  (SOFTAP_MIN_CHNFREE << 8),
 			  (SOFTAP_MAX_CHNFREE -
 			   SOFTAP_MIN_CHNFREE) << 8));
 
-       if (channel_free_weight > softap_channel_free_weight_local)
+	if (channel_free_weight > softap_channel_free_weight_local)
 		channel_free_weight = softap_channel_free_weight_local;
 
 	VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-		  "In %s, rcc=%d, cc=%d, cfwc=%d, cfwl=%d, cfw=%d",
+		  "In %s, rcc=%d, cc=%d, tc=%d, rc=%d, cfwc=%d, cfwl=%d, cfw=%d",
 		  __func__, rx_clear_count, cycle_count,
+		  channel_stat->tx_frame_count,
+		  channel_stat->rx_frame_count,
 		  softap_channel_free_weight_cfg,
 		  softap_channel_free_weight_local,
 		  channel_free_weight);
 
-       return channel_free_weight;
+	return channel_free_weight;
 }
 
 /**
@@ -1011,18 +1011,18 @@ uint32_t sap_weight_channel_txpwr_range(ptSapContext sap_ctx,
 				 SOFTAP_MAX_TXPWR -
 				 channel_stat->chan_tx_pwr_range,
 				 SOFTAP_MAX_TXPWR - SOFTAP_MIN_TXPWR));
+
 	if (txpwr_weight_low_speed > softap_txpwr_range_weight_local)
 		txpwr_weight_low_speed = softap_txpwr_range_weight_local;
 
-
-        VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+	VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
 		  "In %s, tpr=%d, tprwc=%d, tprwl=%d, tprw=%d",
 		  __func__, channel_stat->chan_tx_pwr_range,
 		  softap_txpwr_range_weight_cfg,
 		  softap_txpwr_range_weight_local,
 		  txpwr_weight_low_speed);
 
-        return txpwr_weight_low_speed;
+	return txpwr_weight_low_speed;
 }
 
 /**
@@ -1065,8 +1065,7 @@ uint32_t sap_weight_channel_txpwr_tput(ptSapContext sap_ctx,
 	if (txpwr_weight_high_speed > softap_txpwr_tput_weight_local)
 		txpwr_weight_high_speed = softap_txpwr_tput_weight_local;
 
-       VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-
+	VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
 		  "In %s, tpt=%d, tptwc=%d, tptwl=%d, tptw=%d",
 		  __func__, channel_stat->chan_tx_pwr_throughput,
 		  softap_txpwr_tput_weight_cfg,
@@ -1111,7 +1110,9 @@ uint32_t sap_weight_channel_status(ptSapContext sap_ctx,
 
   SIDE EFFECTS
 ============================================================================*/
-void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
+void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh,
+                              tSapSpectChInfo *spect_ch_strt_addr,
+                              tSapSpectChInfo *spect_ch_end_addr)
 {
     tSapSpectChInfo *pExtSpectCh = NULL;
     v_S31_t rssi;
@@ -1127,7 +1128,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
     {
         case CHANNEL_1:
             pExtSpectCh = (pSpectCh + 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1140,7 +1143,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1153,7 +1158,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 3);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1166,7 +1173,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 4);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1182,7 +1191,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
 
         case CHANNEL_2:
             pExtSpectCh = (pSpectCh - 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1195,7 +1206,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1208,7 +1221,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1221,7 +1236,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 3);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1234,7 +1251,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 4);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1249,7 +1268,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
             break;
         case CHANNEL_3:
             pExtSpectCh = (pSpectCh - 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1262,7 +1283,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1275,7 +1298,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1288,7 +1313,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1301,7 +1328,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 3);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1314,7 +1343,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 4);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1329,7 +1360,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
             break;
         case CHANNEL_4:
             pExtSpectCh = (pSpectCh - 3);
-            if(pExtSpectCh != NULL)
+            if(pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1342,7 +1375,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1355,7 +1390,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1368,7 +1405,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1381,7 +1420,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1394,7 +1435,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 3);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1407,7 +1450,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 4);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1428,7 +1473,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
         case CHANNEL_9:
         case CHANNEL_10:
             pExtSpectCh = (pSpectCh - 4);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1441,7 +1488,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 3);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1454,7 +1503,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1467,7 +1518,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1480,7 +1533,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 1);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1493,7 +1548,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 2);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1506,7 +1563,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 3);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1519,7 +1578,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 4);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1535,7 +1596,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
 
         case CHANNEL_11:
             pExtSpectCh = (pSpectCh - 4);
-            if(pExtSpectCh != NULL)
+            if(pExtSpectCh != NULL &&
+               (pExtSpectCh >= spect_ch_strt_addr &&
+                pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1549,7 +1612,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
             }
 
             pExtSpectCh = (pSpectCh - 3);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1562,7 +1627,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1575,7 +1642,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1588,7 +1657,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 1);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1601,7 +1672,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 2);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1614,7 +1687,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 3);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1630,7 +1705,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
 
         case CHANNEL_12:
             pExtSpectCh = (pSpectCh - 4);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1644,7 +1721,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
             }
 
             pExtSpectCh = (pSpectCh - 3);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1657,7 +1736,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1670,7 +1751,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1683,7 +1766,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 1);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1696,7 +1781,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 2);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1712,7 +1799,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
 
         case CHANNEL_13:
             pExtSpectCh = (pSpectCh - 4);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1726,7 +1815,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
             }
 
             pExtSpectCh = (pSpectCh - 3);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1739,7 +1830,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 2);
-            if(pExtSpectCh != NULL)
+            if(pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1752,7 +1845,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1765,7 +1860,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh + 1);
-            if ((pExtSpectCh != NULL) && (pExtSpectCh->chNum <= CHANNEL_14))
+            if ((pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr)))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1781,7 +1878,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
 
         case CHANNEL_14:
             pExtSpectCh = (pSpectCh - 1);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1794,7 +1893,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 2);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1807,7 +1908,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 3);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1820,7 +1923,9 @@ void sapInterferenceRssiCount(tSapSpectChInfo *pSpectCh)
                     pExtSpectCh->rssiAgr = SOFTAP_MIN_RSSI;
             }
             pExtSpectCh = (pSpectCh - 4);
-            if (pExtSpectCh != NULL)
+            if (pExtSpectCh != NULL &&
+                (pExtSpectCh >= spect_ch_strt_addr &&
+                 pExtSpectCh < spect_ch_end_addr))
             {
                 ++pExtSpectCh->bssCount;
                 rssi = pSpectCh->rssiAgr +
@@ -1908,7 +2013,7 @@ void sapComputeSpectWeight( tSapChSelSpectInfo* pSpectInfoParams,
         vhtSupport = 0;
         centerFreq = 0;
 
-        ieLen = (pScanResult->BssDescriptor.length + sizeof(tANI_U16) + sizeof(tANI_U32) - sizeof(tSirBssDescription));
+        ieLen = GET_IE_LEN_IN_BSS(pScanResult->BssDescriptor.length);
         vos_mem_set((tANI_U8 *) pBeaconStruct, sizeof(tSirProbeRespBeacon), 0);
 
         if ((sirParseBeaconIE(pMac, pBeaconStruct,(tANI_U8 *)( pScanResult->BssDescriptor.ieFields), ieLen)) == eSIR_SUCCESS)
@@ -2188,11 +2293,12 @@ void sapComputeSpectWeight( tSapChSelSpectInfo* pSpectInfoParams,
 
                 if(operatingBand == eCSR_DOT11_MODE_11g)
                 {
-                     sapInterferenceRssiCount(pSpectCh);
+                     sapInterferenceRssiCount(pSpectCh, pSpectChStartAddr,
+                                              pSpectChEndAddr);
                 }
 
                 VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-                   "In %s, bssdes.ch_self=%d, bssdes.ch_ID=%d, bssdes.rssi=%d, SpectCh.bssCount=%d, pScanResult=%p, ChannelWidth %d, secondaryChanOffset %d, center frequency %d",
+                   "In %s, bssdes.ch_self=%d, bssdes.ch_ID=%d, bssdes.rssi=%d, SpectCh.bssCount=%d, pScanResult=%pK, ChannelWidth %d, secondaryChanOffset %d, center frequency %d",
                   __func__, pScanResult->BssDescriptor.channelIdSelf,
                  pScanResult->BssDescriptor.channelId,
                  pScanResult->BssDescriptor.rssi, pSpectCh->bssCount,
@@ -2224,10 +2330,10 @@ void sapComputeSpectWeight( tSapChSelSpectInfo* pSpectInfoParams,
         rssi = (v_S7_t)pSpectCh->rssiAgr;
 
         pSpectCh->weight = SAPDFS_NORMALISE_1000 *
-            (sapweightRssiCount(sap_ctx, rssi, pSpectCh->bssCount)
-            + sap_weight_channel_status(sap_ctx,
-            sap_get_channel_status(pMac, pSpectCh->chNum)));
-	if (pSpectCh->weight > ACS_WEIGHT_MAX)
+                (sapweightRssiCount(sap_ctx, rssi, pSpectCh->bssCount)
+                 + sap_weight_channel_status(sap_ctx,
+                 sap_get_channel_status(pMac, pSpectCh->chNum)));
+        if (pSpectCh->weight > ACS_WEIGHT_MAX)
             pSpectCh->weight = ACS_WEIGHT_MAX;
         pSpectCh->weight_copy = pSpectCh->weight;
 
@@ -2239,7 +2345,6 @@ void sapComputeSpectWeight( tSapChSelSpectInfo* pSpectInfoParams,
         //------ Debug Info ------
         pSpectCh++;
     }
-
     sap_clear_channel_status(pMac);
     vos_mem_free(pBeaconStruct);
 }
@@ -2859,7 +2964,7 @@ v_U8_t sapSelectChannel(tHalHandle halHandle, ptSapContext pSapCtx,  tScanResult
      * then skip acs process if no bss found.
      */
     if (NULL == pScanResult &&
-	!(pSapCtx->auto_channel_select_weight & 0xffff00))
+        !(pSapCtx->auto_channel_select_weight & 0xffff00))
     {
         VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                   "%s: No external AP present", __func__);
@@ -3055,7 +3160,7 @@ v_U8_t sapSelectChannel(tHalHandle halHandle, ptSapContext pSapCtx,  tScanResult
                                  pSapCtx->acsBestChannelInfo.weight))
                     {
                         tmpChNum = pSpectInfoParams->pSpectCh[count].chNum;
-	                tmpChNum = sap_channel_in_acs_channel_list(
+                        tmpChNum = sap_channel_in_acs_channel_list(
                                        tmpChNum, pSapCtx, pSpectInfoParams);
                         if ( tmpChNum != SAP_CHANNEL_NOT_SELECTED)
                         {
diff --git a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapChSelect.h b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapChSelect.h
index 475a4955989..9ad66dbfec5 100644
--- a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapChSelect.h
+++ b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapChSelect.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -78,6 +78,7 @@
 #define SOFTAP_MAX_RSSI         (0)
 #define SOFTAP_MIN_COUNT        (0)
 #define SOFTAP_MAX_COUNT        (60)
+
 #define SOFTAP_MIN_NF           (-120)
 #define SOFTAP_MAX_NF           (-60)
 #define SOFTAP_MIN_CHNFREE              (0)
@@ -85,9 +86,10 @@
 #define SOFTAP_MIN_TXPWR                (0)
 #define SOFTAP_MAX_TXPWR                (63)
 
-
 #define SAP_DEFAULT_24GHZ_CHANNEL     (6)
-#define SAP_DEFAULT_5GHZ_CHANNEL      (40)
+#define SAP_DEFAULT_LOW_5GHZ_CHANNEL      (40)
+#define SAP_DEFAULT_MID_5GHZ_CHANNEL      (100)
+#define SAP_DEFAULT_HIGH_5GHZ_CHANNEL     (149)
 #define SAP_CHANNEL_NOT_SELECTED (0)
 
 #define SOFTAP_HT20_CHANNELWIDTH 0
diff --git a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapFsm.c b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapFsm.c
index 30fc2477c76..3a258830910 100644
--- a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapFsm.c
+++ b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapFsm.c
@@ -1966,7 +1966,7 @@ v_BOOL_t
 sapDfsIsChannelInNolList(ptSapContext sapContext, v_U8_t channelNumber,
         ePhyChanBondState chanBondState)
 {
-    int i, j;
+    int i = 0, j;
     v_U64_t timeElapsedSinceLastRadar,timeWhenRadarFound,currentTime = 0;
     v_U64_t max_jiffies;
     tHalHandle hHal = VOS_GET_HAL_CB(sapContext->pvosGCtx);
@@ -2114,6 +2114,529 @@ sapDfsIsChannelInNolList(ptSapContext sapContext, v_U8_t channelNumber,
     return VOS_FALSE;
 }
 
+/**
+ * sap_select_default_oper_chan_ini() - Selects operating channel based on ini
+ * @hal: pointer to HAL
+ * @acs_11a: 11a acs cfg
+ *
+ * Return: selected operating channel
+ */
+uint8_t sap_select_default_oper_chan_ini(tHalHandle hal, uint32_t acs_11a)
+{
+	uint32_t operating_band = 0;
+	uint8_t channel;
+	ccmCfgGetInt(hal, WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND,
+			&operating_band);
+	if (acs_11a || operating_band == RF_SUBBAND_5_LOW_GHZ ||
+		operating_band == RF_SUBBAND_5_MID_GHZ ||
+		operating_band == RF_SUBBAND_5_HIGH_GHZ) {
+		VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+				FL("Default channel selection from band %d"),
+				operating_band);
+		if (operating_band)
+			(operating_band == RF_SUBBAND_5_LOW_GHZ) ?
+				(channel = SAP_DEFAULT_LOW_5GHZ_CHANNEL) :
+				(operating_band == RF_SUBBAND_5_MID_GHZ) ?
+				(channel = SAP_DEFAULT_MID_5GHZ_CHANNEL) :
+				(operating_band == RF_SUBBAND_5_HIGH_GHZ) ?
+				(channel = SAP_DEFAULT_HIGH_5GHZ_CHANNEL) : 0;
+		else
+			channel = SAP_DEFAULT_LOW_5GHZ_CHANNEL;
+
+	} else {
+		channel = SAP_DEFAULT_24GHZ_CHANNEL;
+	}
+	VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+			FL("channel selected to start bss %d"), channel);
+	return channel;
+}
+
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+/**
+ * sap_create_session_info() - create session info based on
+ *              the input chan and phymode
+ * @sap_context: ptSapContext ptr
+ * @session_info: information returned.
+ * @sap_ch: requesting channel number
+ *
+ * Return: TRUE if session info returned
+ */
+static v_BOOL_t sap_create_session_info(
+	ptSapContext sap_context,
+	session_info_t *session_info,
+	v_U16_t sap_ch)
+{
+	tHalHandle hHal;
+	eCsrPhyMode sap_phymode;
+
+	hHal = (tHalHandle)vos_get_context( VOS_MODULE_ID_SME,
+			sap_context->pvosGCtx);
+	if (NULL == hHal) {
+		VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_FATAL,
+		    "In %s, invalid hHal", __func__);
+		return FALSE;
+	}
+
+	sap_phymode = sap_context->csrRoamProfile.phyMode;
+	return sme_create_sap_session_info(
+		hHal, sap_phymode, sap_ch, session_info);
+}
+/**
+ * sap_find_station_session_info() - get active station session info
+ * @sap_context: ptSapContext ptr
+ * @session_info: information returned.
+ *
+ * Return: TRUE if session info returned
+ */
+static v_BOOL_t sap_find_station_session_info(
+	ptSapContext sap_context,
+	session_info_t * session_info)
+{
+	tHalHandle hHal;
+
+	hHal = (tHalHandle)vos_get_context( VOS_MODULE_ID_SME,
+			sap_context->pvosGCtx);
+	if (NULL == hHal) {
+		VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_FATAL,
+		    "In %s, invalid hHal", __func__);
+		return FALSE;
+	}
+	return sme_find_sta_session_info(hHal, session_info);
+}
+/**
+ * sap_find_all_session_info() - get all active session info
+ * @sap_context: ptSapContext ptr
+ * @session_info: information returned.
+ * @count: number of session returned.
+ *
+ * Return: TRUE if any session info returned
+ */
+static v_BOOL_t sap_find_all_session_info(
+	ptSapContext sap_context,
+	session_info_t *session_info,
+	v_U8_t *count)
+{
+	tHalHandle hHal;
+
+	hHal = (tHalHandle)vos_get_context( VOS_MODULE_ID_SME,
+			sap_context->pvosGCtx);
+	if (NULL == hHal) {
+		VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_FATAL,
+		    "In %s, invalid hHal", __func__);
+		return FALSE;
+	}
+	return sme_find_all_session_info(hHal, session_info, count);
+}
+/**
+ * sap_overlap_check() - check channel overlap or not
+ * @sap_context: ptSapContext ptr
+ * @info_1: session info 1.
+ * @info_2: session info 2.
+ *
+ * Return: TRUE if two session channels are overlap
+ */
+static v_BOOL_t sap_overlap_check(
+	session_info_t *info_1,
+	session_info_t *info_2)
+{
+	v_BOOL_t intf = TRUE;
+	if (!(((info_1->lfreq >= info_2->lfreq
+		&& info_1->lfreq < info_2->hfreq) ||
+		(info_1->hfreq > info_2->lfreq
+		&& info_1->hfreq <= info_2->hfreq))
+		|| ((info_2->lfreq >= info_1->lfreq
+		&& info_2->lfreq < info_1->hfreq) ||
+		(info_2->hfreq > info_1->lfreq
+		&& info_2->hfreq <= info_1->hfreq))
+		)) {
+		intf = FALSE;
+	}
+
+	VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+	    "%s:info_1 mode %d band %d och %d lf %d"
+	    "hf %d cf %d hbw %d",
+	    __func__, info_1->con_mode, info_1->band,
+	    info_1->och, info_1->lfreq, info_1->hfreq,
+	    info_1->cfreq, info_1->hbw);
+	VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+	    "%s:info_2 mode %d band %d och %d lf %d"
+	    "hf %d cf %d hbw %d",
+	    __func__, info_2->con_mode, info_2->band,
+	    info_2->och, info_2->lfreq, info_2->hfreq,
+	    info_2->cfreq, info_2->hbw);
+	VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+	    "%s:info_1 %s with info_2",
+	    __func__, intf ? "overlap" : "not overlap");
+
+	return intf;
+}
+/**
+ * sap_check_mcc_valid() - check mcc violation or not
+ * @sap_context: ptSapContext ptr
+ * @chan: chan to check
+ * @band: band of the channel
+ * @session_info: session info array of all active sessions
+ * @session_count: session counts
+ *
+ * Return: VOS_STATUS_SUCCESS if the new sap chan is valid.
+ */
+static VOS_STATUS sap_check_mcc_valid(
+	ptSapContext sap_context,
+	v_SINT_t chan,
+	eCsrBand band,
+	session_info_t *session_info,
+	v_U8_t session_count)
+{
+	session_info_t *info;
+	session_info_t sessions[VOS_MAX_CONCURRENCY_PERSONA + 1];
+	v_U8_t	i, j;
+	v_U8_t session_cnt[VOS_MAX_CONCURRENCY_PERSONA + 1];
+	v_U32_t channels[VOS_MAX_CONCURRENCY_PERSONA + 1];
+	v_U8_t chan_cnt = 0;
+
+	if (session_count <= 0)
+		return VOS_STATUS_SUCCESS;
+	else if (session_count > VOS_MAX_CONCURRENCY_PERSONA) {
+		VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+		    "%s: invalid session count %d", __func__,
+		    session_count);
+		return VOS_STATUS_E_INVAL;
+	}
+	/*
+	 * create channel & session matrix
+	 */
+	vos_mem_copy(sessions, session_info,
+		sizeof(session_info_t) * session_count);
+	info = &sessions[session_count];
+	info->con_mode = VOS_STA_SAP_MODE;
+	info->och = chan;
+	session_count++;
+	for (i = 0; i < session_count &&
+		chan_cnt < VOS_MAX_CONCURRENCY_PERSONA; i++) {
+		info = &sessions[i];
+		for (j = 0; j < chan_cnt; j++) {
+			if (info->och == channels[j]) {
+				session_cnt[j]++;
+				break;
+			}
+		}
+		if ((j >= chan_cnt) &&
+		    (chan_cnt < (VOS_MAX_CONCURRENCY_PERSONA + 1))) {
+			channels[chan_cnt] = info->och;
+			session_cnt[chan_cnt] = 1;
+			chan_cnt++;
+		}
+	}
+	/*
+	 * 1 .FW doesn't support > 2 home channel MCC.
+	 */
+	if (chan_cnt > MAX_CONCURRENCY_CHAN_COUNT) {
+		VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+		    "%s: exceed 2 home chan in MCC (chan %d band %d)",
+		    __func__, chan, band);
+		return VOS_STATUS_E_FAILURE;
+	}
+	/*
+	 * 2. FW doesn't support the MCC case in which >= 3 SAP sessions
+	 *  on one channel, e.g. AP1 AP2 AP3 on channel A and AP4 on
+	 * channel B is not supported.
+	 */
+	if (chan_cnt > 1) {
+		for (j = 0; j < chan_cnt; j++) {
+			if (session_cnt[j] >
+				    MAX_SESSSION_PER_CHAN_MCC) {
+				VOS_TRACE( VOS_MODULE_ID_SAP,
+					VOS_TRACE_LEVEL_ERROR,
+				    "%s: exceed 2 session in MCC "
+				    "(chan %d band %d)",
+				    __func__, chan, band);
+				return VOS_STATUS_E_FAILURE;
+			}
+		}
+	}
+	/*
+	 * 3. Don't support MCC on DFS channel.
+	 */
+	if (chan_cnt > 1) {
+		for (j = 0; j < chan_cnt; j++) {
+			if (channels[j] != 0
+			    && vos_nv_getChannelEnabledState(channels[j])
+			    == NV_CHANNEL_DFS) {
+				VOS_TRACE( VOS_MODULE_ID_SAP,
+				    VOS_TRACE_LEVEL_ERROR,
+				    "%s: dfs not support in MCC dfs chan %d"
+				    "(chan %d band %d)",
+				    __func__, channels[j], chan, band);
+				return VOS_STATUS_E_FAILURE;
+			}
+		}
+	}
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+* sap_concurrence_chan_override() - override SAP channel if necessary
+* @sap_context: ptSapContext ptr
+* @cc_switch_mode: override policy
+* @con_ch: the override result channel
+*
+* This function will check and override sap channel based on configurated
+* MCC to SCC policy :
+* gWlanMccToSccSwitchMode = 0: disabled.
+* gWlanMccToSccSwitchMode = 1: override to SCC if channel overlap in
+*    same band.
+* gWlanMccToSccSwitchMode = 2: force to SCC in same band.
+*
+* gWlanBandSwitchEnable = false: disabled.
+* gWlanBandSwitchEnable = true:  enable band switch for MCC to SCC
+*
+* Return: VOS_STATUS_SUCCESS: Success
+*             other value will fail the sap start request
+*/
+static VOS_STATUS
+sap_concurrency_chan_override(
+	ptSapContext sap_context,
+	v_U8_t cc_switch_mode,
+	tANI_U8 *con_ch)
+{
+	v_U8_t	i;
+	v_SINT_t target_chan;
+	eCsrBand target_band;
+	session_info_t target_info;
+	v_SINT_t candidate_chan = 0;
+	v_SINT_t candidate[2 * VOS_MAX_CONCURRENCY_PERSONA + 1];
+	v_U8_t candidate_count = 0;
+	session_info_t session_info[VOS_MAX_CONCURRENCY_PERSONA];
+	v_U8_t session_count = 0;
+	VOS_STATUS status = VOS_STATUS_SUCCESS;
+
+	if (sap_context->channel == AUTO_CHANNEL_SELECT) {
+		target_band = sap_context->target_band;
+		target_chan = 0;
+		candidate_chan = 0;
+	} else {
+		if (sap_context->channel > MAX_2_4GHZ_CHANNEL) {
+			target_band = eCSR_BAND_5G;
+			sap_context->target_band = eCSR_BAND_5G;
+		} else {
+			target_band = eCSR_BAND_24;
+			sap_context->target_band = eCSR_BAND_24;
+		}
+		target_chan = sap_context->channel;
+		candidate_chan = sap_context->channel;
+		if (!sap_create_session_info(sap_context, &target_info,
+			target_chan)) {
+			VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+			    "Failed to create channel(%d) info", target_chan);
+			return VOS_STATUS_E_FAILURE;
+		}
+		VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+			"%s:curr sap mode %d band %d och %d lf %d hf"
+			"%d cf %d hbw %d",
+			__func__, target_info.con_mode, target_info.band,
+			target_info.och, target_info.lfreq, target_info.hfreq,
+			target_info.cfreq, target_info.hbw);
+	}
+
+	/*
+	 * 1. find all active session info
+	 */
+	sap_find_all_session_info(sap_context, session_info, &session_count);
+	/*
+	 * 2. get candidate chan list from more preference to less preference
+	 */
+	for (i = 0; i < session_count; i++) {
+		session_info_t *info = &session_info[i];
+		VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+		    "%s: mode %d band %d och %d lf %d hf %d cf %d hbw %d",
+		    __func__, info->con_mode, info->band, info->och,
+		    info->lfreq, info->hfreq, info->cfreq, info->hbw);
+		if (info->band != target_band) {
+			if (sap_context->band_switch_enable) {
+				if (info->band == eCSR_BAND_5G) {
+					sap_context->ch_width_orig =
+						sap_context->ch_width_5g_orig;
+				} else {
+					sap_context->ch_width_orig =
+						sap_context->ch_width_24g_orig;
+				}
+			} else {
+				continue;
+			}
+		}
+		if (cc_switch_mode == VOS_MCC_TO_SCC_SWITCH_ENABLE
+			&& target_chan != 0
+			&& sap_overlap_check(&target_info, info))
+			candidate[candidate_count++] = info->och;
+		else if (cc_switch_mode == VOS_MCC_TO_SCC_SWITCH_FORCE)
+			candidate[candidate_count++] = info->och;
+	}
+	candidate[candidate_count++] = target_chan;
+	if (cc_switch_mode == VOS_MCC_TO_SCC_SWITCH_ENABLE
+		&& target_chan == 0) {
+		for (i = 0; i < session_count; i++) {
+			session_info_t *info = &session_info[i];
+			VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+			    "%s: mode %d band %d och %d lf %d"
+			    "hf %d cf %d hbw %d",
+			    __func__, info->con_mode, info->band,
+			    info->och, info->lfreq, info->hfreq,
+			    info->cfreq, info->hbw);
+			if (info->band != target_band) {
+				if (sap_context->band_switch_enable) {
+					if (info->band == eCSR_BAND_5G) {
+						sap_context->ch_width_orig =
+							sap_context->ch_width_5g_orig;
+					} else {
+						sap_context->ch_width_orig =
+							sap_context->ch_width_24g_orig;
+					}
+				} else {
+					continue;
+				}
+			}
+			candidate[candidate_count++] = info->och;
+		}
+	}
+	/*
+	 * 3. check MCC violation and find the first good channel.
+	 */
+	for (i = 0; i < candidate_count; i++) {
+		status = sap_check_mcc_valid(sap_context, candidate[i],
+				target_band,
+				session_info,
+				session_count);
+		if (status == VOS_STATUS_SUCCESS) {
+			candidate_chan = candidate[i];
+			VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+				   "%s: found chan %d band %d",
+				   __func__, candidate_chan, target_band);
+			break;
+		}
+	}
+	if (status == VOS_STATUS_SUCCESS) {
+		sap_context->channel = candidate_chan;
+		*con_ch = sap_context->channel;
+		if (target_chan != candidate_chan)
+			VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+				"In %s, override to chan %d band %d from %d",
+				__func__, candidate_chan, target_band,
+				target_chan);
+		else
+			VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+				"In %s, no override chan %d band %d",
+				__func__, target_chan, target_band);
+	} else {
+		VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+			"In %s, mcc violation chan %d band %d",
+			__func__, target_chan, target_band);
+	}
+	return status;
+}
+
+/**
+* sap_same_band_channel_switch_validate() -
+*    check target chan valid or not during chan switch
+* @sap_context: ptSapContext ptr
+* @target_chan: target chan to switch
+*
+* This function checks whether target chan violates the same band
+* SCC policy.
+*
+* Return: TRUE: target chan doesn't violate the policy
+*/
+static bool
+sap_same_band_channel_switch_validate(
+	ptSapContext sap_context,
+	v_U16_t target_chan)
+{
+	session_info_t station_info;
+	v_SINT_t candidate_chan = 0;
+	eCsrBand target_band;
+
+	if (target_chan == 0)
+		return false;
+
+	if (target_chan > MAX_2_4GHZ_CHANNEL)
+		target_band = eCSR_BAND_5G;
+	else
+		target_band = eCSR_BAND_24;
+
+	/*
+	 * find and check active station session on same band
+	 */
+	if (sap_find_station_session_info(sap_context, &station_info)) {
+		if (station_info.band == target_band)
+			candidate_chan = station_info.och;
+	}
+	return candidate_chan == 0 || candidate_chan == target_chan;
+}
+/**
+* sap_overlap_channel_switch_validate() -
+*    check target chan valid or not during chan switch
+* @sap_context: ptSapContext ptr
+* @target_chan: target chan to switch
+*
+* This function checks whether target chan violates the same band
+* overlap policy.
+*
+* Return: TRUE: target chan doesn't violate the policy
+*/
+static bool
+sap_overlap_channel_switch_validate(
+	ptSapContext sap_context,
+	v_U16_t target_chan)
+{
+	session_info_t station_info, target_info;
+	v_SINT_t candidate_chan = 0;
+
+	if (target_chan == 0)
+		return false;
+
+	if (!sap_create_session_info(sap_context, &target_info,
+		target_chan))
+		return false;
+	/*
+	 * find and check active station session on same band
+	 */
+	if (sap_find_station_session_info(sap_context, &station_info)) {
+		if (station_info.band == target_info.band)
+			if (sap_overlap_check(&target_info, &station_info))
+				candidate_chan = station_info.och;
+	}
+	return candidate_chan == 0 || candidate_chan == target_chan;
+}
+/**
+* sap_channel_switch_validate() -
+*    check target chan valid or not during chan switch
+* @sap_context: ptSapContext ptr
+* @target_chan: target chan to switch
+*
+* This function checks whether target chan violates the configurated MCC to
+* SCC policy.
+*
+* Return: TRUE: target chan doesn't violate the policy
+*/
+bool
+sap_channel_switch_validate(
+	ptSapContext sap_context,
+	tHalHandle hal,
+	uint16_t target_channel,
+	eCsrPhyMode sap_phy_mode,
+	uint8_t cc_switch_mode,
+	uint32_t session_id)
+{
+	if (sap_context->cc_switch_mode == VOS_MCC_TO_SCC_SWITCH_FORCE)
+		return sap_same_band_channel_switch_validate(sap_context,
+				target_channel);
+	else if (sap_context->cc_switch_mode
+			== VOS_MCC_TO_SCC_SWITCH_ENABLE)
+		return sap_overlap_channel_switch_validate(sap_context,
+				target_channel);
+	else
+		return true;
+}
+#endif
 
 /*==========================================================================
   FUNCTION    sapGotoChannelSel
@@ -2182,27 +2705,15 @@ sapGotoChannelSel
         }
 #endif
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-        if (sapContext->cc_switch_mode != VOS_MCC_TO_SCC_SWITCH_DISABLE
-            && sapContext->channel) {
-            /*
-             * For ACS request ,the sapContext->channel is 0, we skip
-             * below overlap checking. When the ACS finish and SAP
-             * BSS start, the sapContext->channel will not be 0. Then
-             * the overlap checking will be reactivated.
-             * If we use sapContext->channel = 0 to perform the overlap
-             * checking, an invalid overlap channel con_ch could be
-             * created. That may cause SAP start failed.
-             */
-            con_ch = sme_CheckConcurrentChannelOverlap(hHal,
-                                        sapContext->channel,
-                                        sapContext->csrRoamProfile.phyMode,
-                                        sapContext->cc_switch_mode);
-            if (con_ch) {
-                VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                             "%s: Override Chosen Ch:%d to %d due to CC Intf!!",
-                            __func__,sapContext->channel, con_ch);
-                sapContext->channel = con_ch;
-            }
+        vosStatus = sap_concurrency_chan_override(
+                      sapContext,
+                      sapContext->cc_switch_mode,
+                      &con_ch);
+        if (vosStatus != VOS_STATUS_SUCCESS) {
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                "%s: invalid SAP channel(%d) configuration",
+                __func__,sapContext->channel);
+            return VOS_STATUS_E_ABORTED;
         }
 #endif
     }
@@ -2214,23 +2725,21 @@ sapGotoChannelSel
             sapContext->dfs_ch_disable = VOS_TRUE;
         else if (VOS_IS_DFS_CH(sapContext->channel)) {
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_WARN,
-                       "In %s, DFS not supported in STA_AP Mode", __func__);
+                       "In %s, DFS not supported in STA_AP Mode, chan=%d",
+                       __func__, sapContext->channel);
             return VOS_STATUS_E_ABORTED;
         }
 #endif
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-        if (sapContext->cc_switch_mode != VOS_MCC_TO_SCC_SWITCH_DISABLE
-            && sapContext->channel) {
-             con_ch = sme_CheckConcurrentChannelOverlap(hHal,
-                                        sapContext->channel,
-                                        sapContext->csrRoamProfile.phyMode,
-                                        sapContext->cc_switch_mode);
-             if (con_ch && !VOS_IS_DFS_CH(con_ch)) {
-                         VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                             "%s: Override Chosen Ch:%d to %d due to CC Intf!!",
-                            __func__,sapContext->channel, con_ch);
-                         sapContext->channel = con_ch;
-             }
+        vosStatus = sap_concurrency_chan_override(
+                sapContext,
+                sapContext->cc_switch_mode,
+                &con_ch);
+        if (vosStatus != VOS_STATUS_SUCCESS) {
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                "%s: invalid SAP channel(%d) configuration",
+                __func__,sapContext->channel);
+            return VOS_STATUS_E_ABORTED;
         }
 #else
         /* If STA-AP concurrency is enabled take the concurrent connected
@@ -2239,6 +2748,9 @@ sapGotoChannelSel
         if (con_ch)
         { /*if a valid channel is returned then use concurrent channel.
                   Else take whatever comes from configuartion*/
+            VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+                FL("Channel overridden due to MCC->SCC switch: %d -> %d"),
+                sapContext->channel, con_ch);
             sapContext->channel = con_ch;
             sme_SelectCBMode(hHal, sapContext->csrRoamProfile.phyMode,
                                 con_ch, 0, &sapContext->vht_channel_width,
@@ -2246,6 +2758,31 @@ sapGotoChannelSel
         }
 #endif
     }
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+    else if (sapContext->ap_p2pclient_concur_enable &&
+             vos_get_concurrency_mode() == (VOS_SAP|VOS_P2P_CLIENT)) {
+#ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
+        if (sapContext->channel == AUTO_CHANNEL_SELECT)
+            sapContext->dfs_ch_disable = VOS_TRUE;
+        else if (VOS_IS_DFS_CH(sapContext->channel)) {
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_WARN,
+                       "In %s, DFS not supported in STA_AP Mode, chan=%d",
+                       __func__, sapContext->channel);
+            return VOS_STATUS_E_ABORTED;
+        }
+#endif
+        vosStatus = sap_concurrency_chan_override(
+                sapContext,
+                sapContext->cc_switch_mode,
+                &con_ch);
+        if (vosStatus != VOS_STATUS_SUCCESS) {
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                "%s: invalid SAP channel(%d) configuration",
+                __func__,sapContext->channel);
+            return VOS_STATUS_E_ABORTED;
+        }
+    }
+#endif
 
     if (sapContext->channel == AUTO_CHANNEL_SELECT)
     {
@@ -2347,9 +2884,9 @@ sapGotoChannelSel
                     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                         "SoftAP Configuring for default channel, Ch= %d",
                         sapContext->channel);
-                    /* In case of error, switch to default channel */
-                    sapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
 
+                        sapContext->channel =
+                                     sap_select_default_oper_chan_ini(hHal, 0);
 #ifdef SOFTAP_CHANNEL_RANGE
                     if(sapContext->channelList != NULL)
                     {
@@ -2419,7 +2956,6 @@ sapGotoChannelSel
                        __func__, sapContext->channel);
 
             sapContext->acs_cfg->pri_ch = sapContext->channel;
-            sapContext->acs_cfg->ch_width = sapContext->ch_width_orig;
             sap_config_acs_result(hHal, sapContext, 0);
             return VOS_STATUS_E_CANCELED;
         }
@@ -2489,13 +3025,15 @@ sap_OpenSession (tHalHandle hHal, ptSapContext sapContext,
         return VOS_STATUS_E_FAILURE;
     }
 
-    sme_set_allowed_action_frames(hHal, ALLOWED_ACTION_FRAMES_BITMAP0_SAP);
+    sme_set_allowed_action_frames(hHal,
+		ALLOWED_ACTION_FRAMES_BITMAP0_SAP, false);
     status = vos_wait_single_event(
             &sapContext->sap_session_opened_evt,
             SAP_OPEN_SESSION_TIMEOUT);
     if (!VOS_IS_STATUS_SUCCESS(status)) {
         VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
                   "wait for sap open session event timed out");
+        sme_CloseSession(hHal, sapContext->sessionId, NULL, FALSE);
         return VOS_STATUS_E_FAILURE;
     }
 
@@ -2756,7 +3294,6 @@ sapSignalHDDevent
     /* Format the Start BSS Complete event to return... */
     if (NULL == sapContext->pfnSapEventCallback)
     {
-        VOS_ASSERT(0);
         return VOS_STATUS_E_FAILURE;
     }
     if (NULL == hHal)
@@ -2782,6 +3319,9 @@ sapSignalHDDevent
             sapApAppEvent.sapevt.sapAssocIndication.assocReqLength = pCsrRoamInfo->assocReqLength;
             sapApAppEvent.sapevt.sapAssocIndication.assocReqPtr = pCsrRoamInfo->assocReqPtr;
             sapApAppEvent.sapevt.sapAssocIndication.fWmmEnabled = pCsrRoamInfo->wmmEnabledSta;
+            sapApAppEvent.sapevt.sapAssocIndication.ecsa_capable =
+                pCsrRoamInfo->ecsa_capable;
+
             if ( pCsrRoamInfo->u.pConnectedProfile != NULL )
             {
                sapApAppEvent.sapevt.sapAssocIndication.negotiatedAuthType = pCsrRoamInfo->u.pConnectedProfile->AuthType;
@@ -2801,7 +3341,9 @@ sapSignalHDDevent
             }
             else
             {
-                sapApAppEvent.sapevt.sapStartBssCompleteEvent.staId = 0;
+                sapApAppEvent.sapevt.sapStartBssCompleteEvent.staId =
+                    tl_shim_get_sta_id_by_addr(sapContext->pvosGCtx,
+                        sapContext->self_mac_addr);
             }
 
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "%s(eSAP_START_BSS_EVENT): staId = %d",
@@ -2864,6 +3406,10 @@ sapSignalHDDevent
         case eSAP_STA_REASSOC_EVENT:
         {
             tSirSmeChanInfo *pChanInfo;
+            tSap_StationAssocReassocCompleteEvent *sta_event_ptr;
+
+            sta_event_ptr =
+                &sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent;
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                        FL("SAP event callback event = %s"),
                           "eSAP_STA_ASSOC_EVENT");
@@ -2873,21 +3419,32 @@ sapSignalHDDevent
                 sapApAppEvent.sapHddEventCode = eSAP_STA_ASSOC_EVENT;
 
             //TODO: Need to fill the SET KEY information and pass to HDD
-            vos_mem_copy( &sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.staMac,
+            vos_mem_copy(&sta_event_ptr->staMac,
                          pCsrRoamInfo->peerMac,sizeof(tSirMacAddr));
-            sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.staId = pCsrRoamInfo->staId ;
-            sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.statusCode = pCsrRoamInfo->statusCode;
-            sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.iesLen = pCsrRoamInfo->rsnIELen;
-            vos_mem_copy(sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.ies, pCsrRoamInfo->prsnIE,
-                        pCsrRoamInfo->rsnIELen);
+            sta_event_ptr->staId = pCsrRoamInfo->staId;
+            sta_event_ptr->statusCode = pCsrRoamInfo->statusCode;
+            sta_event_ptr->iesLen = pCsrRoamInfo->rsnIELen;
+            vos_mem_copy(sta_event_ptr->ies, pCsrRoamInfo->prsnIE,
+                         pCsrRoamInfo->rsnIELen);
+            sta_event_ptr->ampdu = pCsrRoamInfo->ampdu;
+            sta_event_ptr->sgi_enable = pCsrRoamInfo->sgi_enable;
+            sta_event_ptr->tx_stbc = pCsrRoamInfo->tx_stbc;
+            sta_event_ptr->rx_stbc = pCsrRoamInfo->rx_stbc;
+            sta_event_ptr->ch_width = pCsrRoamInfo->ch_width;
+            sta_event_ptr->mode = pCsrRoamInfo->mode;
+            sta_event_ptr->max_supp_idx = pCsrRoamInfo->max_supp_idx;
+            sta_event_ptr->max_ext_idx = pCsrRoamInfo->max_ext_idx;
+            sta_event_ptr->max_mcs_idx = pCsrRoamInfo->max_mcs_idx;
+            sta_event_ptr->rx_mcs_map = pCsrRoamInfo->rx_mcs_map;
+            sta_event_ptr->tx_mcs_map = pCsrRoamInfo->tx_mcs_map;
 
 #ifdef FEATURE_WLAN_WAPI
             if(pCsrRoamInfo->wapiIELen)
             {
-                v_U8_t  len = sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.iesLen;
-                sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.iesLen
+                v_U8_t  len = sta_event_ptr->iesLen;
+                sta_event_ptr->iesLen
                                                         += pCsrRoamInfo->wapiIELen;
-                vos_mem_copy(&sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.ies[len],
+                vos_mem_copy(&sta_event_ptr->ies[len],
                         pCsrRoamInfo->pwapiIE,
                             pCsrRoamInfo->wapiIELen);
             }
@@ -2895,16 +3452,16 @@ sapSignalHDDevent
 
             if(pCsrRoamInfo->addIELen)
             {
-                v_U8_t  len = sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.iesLen;
-                sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.iesLen
+                v_U8_t  len = sta_event_ptr->iesLen;
+                sta_event_ptr->iesLen
                                                         += pCsrRoamInfo->addIELen;
-                vos_mem_copy(&sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.ies[len], pCsrRoamInfo->paddIE,
+                vos_mem_copy(&sta_event_ptr->ies[len], pCsrRoamInfo->paddIE,
                             pCsrRoamInfo->addIELen);
             }
 
             /* also fill up the channel info from the csrRoamInfo */
             pChanInfo =
-            &sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.chan_info;
+            &sta_event_ptr->chan_info;
 
             pChanInfo->chan_id = pCsrRoamInfo->chan_info.chan_id;
             pChanInfo->mhz = pCsrRoamInfo->chan_info.mhz;
@@ -2915,10 +3472,12 @@ sapSignalHDDevent
             pChanInfo->reg_info_2 = pCsrRoamInfo->chan_info.reg_info_2;
             pChanInfo->nss = pCsrRoamInfo->chan_info.nss;
             pChanInfo->rate_flags = pCsrRoamInfo->chan_info.rate_flags;
-
-            sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.wmmEnabled = pCsrRoamInfo->wmmEnabledSta;
-            sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.status = (eSapStatus )context;
-            sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.timingMeasCap = pCsrRoamInfo->timingMeasCap;
+            pChanInfo->sub20_channelwidth =
+                                     pCsrRoamInfo->chan_info.sub20_channelwidth;
+            sta_event_ptr->wmmEnabled = pCsrRoamInfo->wmmEnabledSta;
+            sta_event_ptr->status = (eSapStatus )context;
+            sta_event_ptr->timingMeasCap = pCsrRoamInfo->timingMeasCap;
+            sta_event_ptr->ecsa_capable = pCsrRoamInfo->ecsa_capable;
             //TODO: Need to fill sapAuthType
             //sapApAppEvent.sapevt.sapStationAssocReassocCompleteEvent.SapAuthType = pCsrRoamInfo->pProfile->negotiatedAuthType;
             break;
@@ -3222,7 +3781,7 @@ eHalStatus sap_CloseSession(tHalHandle hHal,
          * to FW
          */
         sme_set_allowed_action_frames(hHal,
-                           ALLOWED_ACTION_FRAMES_BITMAP0_STA);
+			ALLOWED_ACTION_FRAMES_BITMAP0_STA, true);
     }
 
     return halstatus;
@@ -3289,7 +3848,7 @@ VOS_STATUS sap_CacStartNotify(tHalHandle hHal)
              (VOS_FALSE == pSapContext->isCacStartNotified))
          {
               VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_MED,
-              "sapdfs: Signaling eSAP_DFS_CAC_START to HDD for sapctx[%p]",
+              "sapdfs: Signaling eSAP_DFS_CAC_START to HDD for sapctx[%pK]",
               pSapContext);
 
               vosStatus = sapSignalHDDevent(pSapContext, NULL,
@@ -3356,7 +3915,7 @@ VOS_STATUS sap_CacEndNotify(tHalHandle hHal, tCsrRoamInfo *roamInfo)
                 pSapContext->isCacEndNotified = VOS_TRUE;
                 pMac->sap.SapDfsInfo.sap_radar_found_status = VOS_FALSE;
                 VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_MED,
-                          "sapdfs: Start beacon request on sapctx[%p]",
+                          "sapdfs: Start beacon request on sapctx[%pK]",
                           pSapContext);
 
                 /* Start beaconing on the new channel */
@@ -3404,6 +3963,53 @@ VOS_STATUS sap_CacEndNotify(tHalHandle hHal, tCsrRoamInfo *roamInfo)
       return vosStatus;
 }
 
+/**
+ * sap_relaunch_acs_result_handler() - handle relaunched ACS result
+ * @sap_context: pointer of ptSapContext
+ * @roam_info:   pointer to tCsrRoamInfo which contains result channel
+ *
+ * This function handle the relaunched ACS result and check if need to
+ * trigger CSA.
+ *
+ * Return: VOS_STATUS
+ */
+VOS_STATUS
+sap_relaunch_acs_result_handler(ptSapContext sap_context,
+				tCsrRoamInfo *roam_info)
+{
+	VOS_STATUS vos_status;
+
+	vos_mem_zero(sap_context->acs_cfg,
+		     sizeof(struct sap_acs_cfg));
+
+	vos_status = sapSignalHDDevent(sap_context, NULL,
+				       eSAP_ACS_CHANNEL_SELECTED,
+				       (v_PVOID_t)eSAP_STATUS_SUCCESS);
+
+	if (!VOS_IS_STATUS_SUCCESS(vos_status))
+		VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+			  FL("Failed to indicate ACS complete."));
+
+	VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+		  "In %s: acs_target_channel=%d cur_channel=%d",
+		  __func__,
+		  roam_info->target_channel,
+		  sap_context->channel);
+
+	if (!((roam_info->target_channel == sap_context->channel) ||
+	      (roam_info->target_channel == SAP_CHANNEL_NOT_SELECTED))) {
+		vos_status = sapSignalHDDevent(sap_context, roam_info,
+					       eSAP_ECSA_CHANGE_CHAN_IND,
+					       (v_PVOID_t)NULL);
+		if (!VOS_IS_STATUS_SUCCESS(vos_status))
+			VOS_TRACE(VOS_MODULE_ID_SAP,
+				  VOS_TRACE_LEVEL_ERROR,
+				  FL("trigger channel switch failed"));
+	}
+
+	return vos_status;
+}
+
 /*==========================================================================
   FUNCTION    sapFsm
 
@@ -3458,7 +4064,7 @@ sapFsm
     }
     pMac = PMAC_STRUCT( hHal );
 
-    VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_DEBUG, "%s: sapContext=%p, stateVar=%d, msg=0x%x", __func__, sapContext, stateVar, msg);
+    VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_DEBUG, "%s: sapContext=%pK, stateVar=%d, msg=0x%x", __func__, sapContext, stateVar, msg);
 
     switch (stateVar)
     {
@@ -3522,7 +4128,7 @@ sapFsm
                if ( pMac->sap.SapDfsInfo.is_dfs_cac_timer_running != VOS_TRUE)
                {
                    VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_MED,
-                             "sapdfs: starting dfs cac timer on sapctx[%p]",
+                             "sapdfs: starting dfs cac timer on sapctx[%pK]",
                              sapContext);
                    sapStartDfsCacTimer(sapContext);
                }
@@ -3568,6 +4174,7 @@ sapFsm
                                         &sapContext->vht_channel_width,
                                         sapContext->ch_width_orig);
 
+                 cbMode = sme_GetCBPhyStateFromCBIniValue(cbMode);
 #ifdef WLAN_ENABLE_CHNL_MATRIX_RESTRICTION
                  temp_chan = sapContext->channel;
                  pNol = pMac->sap.SapDfsInfo.sapDfsChannelNolList;
@@ -3655,6 +4262,8 @@ sapFsm
                  VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
                            "\n\n***In %s, Cannot start BSS, ACS Fail***\n\n",
                              __func__);
+                sapSignalHDDevent(sapContext, NULL, eSAP_START_BSS_EVENT,
+                               (v_PVOID_t) eSAP_STATUS_FAILURE);
             } else if (msg == eSAP_HDD_STOP_INFRA_BSS) {
                  sapContext->sapsMachine = eSAP_DISCONNECTED;
                  sapSignalHDDevent(sapContext, NULL, eSAP_START_BSS_EVENT,
@@ -3708,13 +4317,14 @@ sapFsm
                 for (intf = 0; intf < SAP_MAX_NUM_SESSION; intf++)
                 {
                      ptSapContext sapContext;
+                     sapContext = pMac->sap.sapCtxList [intf].pSapContext;
                      if (((VOS_STA_SAP_MODE ==
                            pMac->sap.sapCtxList[intf].sapPersona) ||
                           (VOS_P2P_GO_MODE ==
                            pMac->sap.sapCtxList[intf].sapPersona)) &&
-                           pMac->sap.sapCtxList [intf].pSapContext != NULL)
+                           sapContext != NULL &&
+                           sapContext->sapsMachine != eSAP_DISCONNECTED)
                      {
-                         sapContext = pMac->sap.sapCtxList [intf].pSapContext;
                          /* SAP to be moved to DISCONNECTING state */
                          sapContext->sapsMachine = eSAP_DISCONNECTING;
                          /*
@@ -3956,7 +4566,7 @@ sapFsm
                             pSapContext = pMac->sap.sapCtxList [intf].pSapContext;
                             VOS_TRACE(VOS_MODULE_ID_SAP,
                                       VOS_TRACE_LEVEL_INFO_MED,
-                                      "sapdfs: Sending CSAIE for sapctx[%p]",
+                                      "sapdfs: Sending CSAIE for sapctx[%pK]",
                                       pSapContext);
 
                             vosStatus =
@@ -3964,6 +4574,27 @@ sapFsm
                         }
                     }
                 }
+            } else if (eSAP_MAC_SCAN_COMPLETE == msg) {
+                if (!sapContext->acs_cfg->acs_mode) {
+                    VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                              "In %s, not a in ACS mode", __func__);
+                    return VOS_STATUS_E_INVAL;
+                }
+
+                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                          "In %s, ACS scan complete in state %s",
+                          __func__,
+                          "eSAP_STARTED");
+
+                if (!roamInfo) {
+                    VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                              "In %s, roam info can't be NULL",
+                              __func__);
+                    return VOS_STATUS_E_INVAL;
+                }
+
+                vosStatus = sap_relaunch_acs_result_handler(sapContext,
+                                                            roamInfo);
             }
             else
             {
@@ -4010,7 +4641,7 @@ sapFsm
             else if (msg == eWNI_SME_CHANNEL_CHANGE_REQ)
             {
                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_MED,
-                         "sapdfs: Send channel change request on sapctx[%p]",
+                         "sapdfs: Send channel change request on sapctx[%pK]",
                          sapContext);
                /* Most likely, radar has been detected and SAP wants to
                 * change the channel
@@ -4821,7 +5452,7 @@ void sapDfsCacTimerCallback(void *data)
          * CAC Complete, post eSAP_DFS_CHANNEL_CAC_END to sapFsm
          */
         VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_MED,
-        "sapdfs: Sending eSAP_DFS_CHANNEL_CAC_END for target_channel = %d on sapctx[%p]",
+        "sapdfs: Sending eSAP_DFS_CHANNEL_CAC_END for target_channel = %d on sapctx[%pK]",
         sapContext->channel, sapContext);
 
         sapEvent.event = eSAP_DFS_CHANNEL_CAC_END;
@@ -5055,6 +5686,7 @@ tANI_BOOLEAN is_concurrent_sap_ready_for_channel_change(tHalHandle hHal,
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     ptSapContext pSapContext;
     v_U8_t intf = 0;
+    tANI_BOOLEAN is_ready_for_chng = VOS_TRUE;
 
     for (intf = 0; intf < SAP_MAX_NUM_SESSION; intf++) {
          if (((VOS_STA_SAP_MODE == pMac->sap.sapCtxList [intf].sapPersona) ||
@@ -5064,15 +5696,16 @@ tANI_BOOLEAN is_concurrent_sap_ready_for_channel_change(tHalHandle hHal,
                     (ptSapContext)pMac->sap.sapCtxList [intf].pSapContext;
              if (pSapContext == sapContext) {
                  VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                           FL("sapCtx matched [%p]"), sapContext);
+                           FL("sapCtx matched [%pK]"), sapContext);
                  continue;
              } else {
                  VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                           FL("concurrent sapCtx[%p] didn't matche with [%p]"),
+                           FL("concurrent sapCtx[%pK] didn't matche with [%pK]"),
                            pSapContext, sapContext);
-                 return pSapContext->is_sap_ready_for_chnl_chng;
+                 is_ready_for_chng = is_ready_for_chng &&
+                     pSapContext->is_sap_ready_for_chnl_chng;
              }
          }
     }
-    return VOS_FALSE;
+    return is_ready_for_chng;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapInternal.h b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapInternal.h
index a061841f49c..79da55f8b18 100644
--- a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapInternal.h
+++ b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapInternal.h
@@ -250,6 +250,10 @@ typedef struct sSapContext {
     tSapChannelListInfo SapChnlList;
     uint16_t           vht_channel_width;
     uint16_t           ch_width_orig;
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+    uint16_t           ch_width_24g_orig;
+    uint16_t           ch_width_5g_orig;
+#endif
 
     // session to scan
     tANI_BOOLEAN        isScanSessionOpen;
@@ -274,6 +278,8 @@ typedef struct sSapContext {
     struct sap_acs_cfg *acs_cfg;
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
     v_U8_t             cc_switch_mode;
+    bool               band_switch_enable;
+    bool               ap_p2pclient_concur_enable;
 #endif
 
 #if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE)
@@ -304,6 +310,9 @@ typedef struct sSapContext {
     tSirMacRateSet extended_rate_set;
     vos_event_t sap_session_opened_evt;
     vos_event_t sap_session_closed_evt;
+    eCsrBand	target_band;
+    uint8_t     sub20_channelwidth;
+    uint32_t    backup_channel;
 } *ptSapContext;
 
 
@@ -1095,7 +1104,18 @@ eHalStatus sap_CloseSession(tHalHandle hHal,
                             ptSapContext sapContext,
                             csrRoamSessionCloseCallback callback,
                             v_BOOL_t valid);
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+bool
+sap_channel_switch_validate(
+	ptSapContext sap_context,
+	tHalHandle hal,
+	uint16_t target_channel,
+	eCsrPhyMode sap_phy_mode,
+	uint8_t cc_switch_mode,
+	uint32_t session_id);
+#endif
 #ifdef __cplusplus
 }
 #endif
+uint8_t sap_select_default_oper_chan_ini(tHalHandle hal, uint32_t acs_11a);
 #endif /* #ifndef WLAN_QCT_WLANSAP_INTERNAL_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapModule.c b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapModule.c
index d9c186499d8..b190766efc4 100644
--- a/drivers/staging/qcacld-2.0/CORE/SAP/src/sapModule.c
+++ b/drivers/staging/qcacld-2.0/CORE/SAP/src/sapModule.c
@@ -417,16 +417,17 @@ WLANSAP_CleanCB
     if (eSAP_TRUE == pSapCtx->isSapSessionOpen && hal) {
         VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
                 "close existing SAP session");
-	vos_event_reset(&pSapCtx->sap_session_closed_evt);
+        vos_event_reset(&pSapCtx->sap_session_closed_evt);
         sap_CloseSession(hal, pSapCtx, sapRoamSessionCloseCallback, true);
         status = vos_wait_single_event(
-               &pSapCtx->sap_session_closed_evt,
-               SAP_CLOSE_SESSION_TIMEOUT);
+            &pSapCtx->sap_session_closed_evt,
+            SAP_CLOSE_SESSION_TIMEOUT);
         if (!VOS_IS_STATUS_SUCCESS(status)) {
             VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
                       "wait for sap open session event timed out");
             return VOS_STATUS_E_FAILURE;
         }
+
     }
 
     vos_mem_zero( pSapCtx, sizeof(tSapContext));
@@ -435,7 +436,7 @@ WLANSAP_CleanCB
 
     pSapCtx->sapsMachine= eSAP_DISCONNECTED;
 
-    VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "%s: Initializing State: %d, sapContext value = %p",
+    VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "%s: Initializing State: %d, sapContext value = %pK",
             __func__, pSapCtx->sapsMachine, pSapCtx);
     pSapCtx->sessionId = 0;
     pSapCtx->channel = 0;
@@ -663,6 +664,11 @@ WLANSAP_SetScanAcsChannelParams(tsap_Config_t *pConfig,
     pSapCtx->dfs_mode = pConfig->acs_dfs_mode;
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
     pSapCtx->cc_switch_mode = pConfig->cc_switch_mode;
+    pSapCtx->band_switch_enable = pConfig->band_switch_enable;
+    pSapCtx->ap_p2pclient_concur_enable =
+            pConfig->ap_p2pclient_concur_enable;
+    pSapCtx->ch_width_24g_orig = pConfig->ch_width_24g_orig;
+    pSapCtx->ch_width_5g_orig = pConfig->ch_width_5g_orig;
 #endif
     pSapCtx->scanBandPreference = pConfig->scanBandPreference;
     pSapCtx->acsBandSwitchThreshold = pConfig->acsBandSwitchThreshold;
@@ -767,7 +773,7 @@ WLANSAP_StartBss
         pSapCtx = VOS_GET_SAP_CB(pCtx);
 
         VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-                     "WLANSAP_StartBss: sapContext=%p", pSapCtx);
+                     "WLANSAP_StartBss: sapContext=%pK", pSapCtx);
 
         if ( NULL == pSapCtx )
         {
@@ -784,6 +790,11 @@ WLANSAP_StartBss
         pSapCtx->ch_width_orig = pConfig->ch_width_orig;
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
         pSapCtx->cc_switch_mode = pConfig->cc_switch_mode;
+        pSapCtx->band_switch_enable = pConfig->band_switch_enable;
+        pSapCtx->ap_p2pclient_concur_enable =
+                pConfig->ap_p2pclient_concur_enable;
+        pSapCtx->ch_width_24g_orig = pConfig->ch_width_24g_orig;
+        pSapCtx->ch_width_5g_orig = pConfig->ch_width_5g_orig;
 #endif
         pSapCtx->scanBandPreference = pConfig->scanBandPreference;
         pSapCtx->acsBandSwitchThreshold = pConfig->acsBandSwitchThreshold;
@@ -832,8 +843,28 @@ WLANSAP_StartBss
          * Copy the DFS Test Mode setting to pmac for
          * access in lower layers
          */
+        pmac->sap.SapDfsInfo.sap_enable_radar_war =
+                                   pConfig->enable_radar_war;
         pmac->sap.SapDfsInfo.disable_dfs_ch_switch =
                                    pConfig->disableDFSChSwitch;
+        pmac->sap.SapDfsInfo.sap_ch_switch_beacon_cnt =
+            pConfig->sap_chanswitch_beacon_cnt;
+        pmac->sap.SapDfsInfo.sap_ch_switch_mode =
+            pConfig->sap_chanswitch_mode;
+        pmac->sap.SapDfsInfo.dfs_beacon_tx_enhanced =
+            pConfig->dfs_beacon_tx_enhanced;
+        pmac->sap.SapDfsInfo.reduced_beacon_interval =
+            pConfig->reduced_beacon_interval;
+        pmac->sap.SapDfsInfo.sub20_switch_mode = pConfig->sub20_switch_mode;
+        pmac->sap.SapDfsInfo.new_sub20_channelwidth =
+            pmac->sub20_channelwidth;
+
+        pmac->sap.sapCtxList[pSapCtx->sessionId].pSapContext = pSapCtx;
+        pmac->sap.sapCtxList[pSapCtx->sessionId].sapPersona =
+            pSapCtx->csrRoamProfile.csrPersona;
+        pmac->sap.sapCtxList[pSapCtx->sessionId].sessionID =
+            pSapCtx->sessionId;
+
         // Copy MAC filtering settings to sap context
         pSapCtx->eSapMacAddrAclMode = pConfig->SapMacaddr_acl;
         vos_mem_copy(pSapCtx->acceptMacList, pConfig->accept_mac, sizeof(pConfig->accept_mac));
@@ -851,6 +882,7 @@ WLANSAP_StartBss
 
         /* Store the HDD callback in SAP context */
         pSapCtx->pfnSapEventCallback = pSapEventCallback;
+        pSapCtx->sub20_channelwidth = pmac->sub20_channelwidth;
 
         /* Handle event*/
         vosStatus = sapFsm(pSapCtx, &sapEvent);
@@ -1668,7 +1700,8 @@ WLANSAP_SetChannelChangeWithCsa(v_PVOID_t pvosGCtx, v_U32_t targetChannel)
          /*
           * validate target channel switch w.r.t various concurrency rules set.
           */
-         valid = sme_validate_sap_channel_switch(VOS_GET_HAL_CB(sapContext->pvosGCtx),
+         valid = sap_channel_switch_validate(sapContext,
+                  VOS_GET_HAL_CB(sapContext->pvosGCtx),
                   targetChannel, sapContext->csrRoamProfile.phyMode,
                   sapContext->cc_switch_mode, sapContext->sessionId);
          if (!valid)
@@ -1765,6 +1798,163 @@ WLANSAP_SetChannelChangeWithCsa(v_PVOID_t pvosGCtx, v_U32_t targetChannel)
     return VOS_STATUS_SUCCESS;
 }
 
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+/**
+ * WLANSAP_set_sub20_channelwidth_with_csa() -
+ *	This api function does a channel width change
+ * @vos_ctx_ptr: Pointer to vos global context structure
+ * @chan_width:  New channel width to change to
+ *
+ * Return: The VOS_STATUS code associated with performing
+ *	the operation
+ */
+VOS_STATUS
+WLANSAP_set_sub20_channelwidth_with_csa(void *vos_ctx_ptr, uint32_t chan_width)
+{
+	ptSapContext sap_context_ptr = NULL;
+	tWLAN_SAPEvent sap_event;
+	tpAniSirGlobal mac_ptr = NULL;
+	void *hal_ptr = NULL;
+
+	sap_context_ptr = VOS_GET_SAP_CB(vos_ctx_ptr);
+	if (NULL == sap_context_ptr) {
+		VOS_TRACE(VOS_MODULE_ID_SAP,
+			  VOS_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pvosGCtx", __func__);
+
+		return VOS_STATUS_E_FAULT;
+	}
+	hal_ptr = VOS_GET_HAL_CB(sap_context_ptr->pvosGCtx);
+	if (NULL == hal_ptr) {
+		VOS_TRACE(VOS_MODULE_ID_SAP,
+			  VOS_TRACE_LEVEL_ERROR,
+			  "%s: Invalid HAL pointer from pvosGCtx", __func__);
+		return VOS_STATUS_E_FAULT;
+	}
+	mac_ptr = PMAC_STRUCT(hal_ptr);
+
+	/*
+	 * Now, validate if the passed channel is valid in the
+	 * current regulatory domain.
+	 */
+	if (sap_context_ptr->sub20_channelwidth != chan_width &&
+	    ((vos_nv_getChannelEnabledState(sap_context_ptr->channel) ==
+	    NV_CHANNEL_ENABLE) ||
+	    (vos_nv_getChannelEnabledState(sap_context_ptr->channel) ==
+	    NV_CHANNEL_DFS &&
+	    !vos_concurrent_open_sessions_running()))) {
+		/*
+		 * Post a CSA IE request to SAP state machine with
+		 * target channel information and also CSA IE required
+		 * flag set in sapContext only, if SAP is in eSAP_STARTED
+		 * state.
+		 */
+		if (eSAP_STARTED == sap_context_ptr->sapsMachine) {
+			mac_ptr->sap.SapDfsInfo.target_channel =
+				 sap_context_ptr->channel;
+			mac_ptr->sap.SapDfsInfo.new_chanWidth =
+				sap_context_ptr->ch_width_orig;
+			mac_ptr->sap.SapDfsInfo.new_sub20_channelwidth =
+				 chan_width;
+			mac_ptr->sub20_channelwidth = chan_width;
+			mac_ptr->sap.SapDfsInfo.csaIERequired =
+				 VOS_TRUE;
+
+			/*
+			 * Set the radar found status to allow the channel
+			 * change to happen same as in the case of a radar
+			 * detection. Since, this will allow SAP to be in
+			 * correct state and also resume the netif queues
+			 * that were suspended in HDD before the channel
+			 * request was issued.
+			 */
+			mac_ptr->sap.SapDfsInfo.sap_radar_found_status =
+				 VOS_TRUE;
+			mac_ptr->sap.SapDfsInfo.cac_state = eSAP_DFS_SKIP_CAC;
+			sap_CacResetNotify(hal_ptr);
+
+			/*
+			 * Post the eSAP_DFS_CHNL_SWITCH_ANNOUNCEMENT_START
+			 * to SAP state machine to process the channel
+			 * request with CSA IE set in the beacons.
+			 */
+			sap_event.event =
+				 eSAP_DFS_CHNL_SWITCH_ANNOUNCEMENT_START;
+			sap_event.params = 0;
+			sap_event.u1 = 0;
+			sap_event.u2 = 0;
+
+			sapFsm(sap_context_ptr, &sap_event);
+
+		} else {
+			VOS_TRACE(VOS_MODULE_ID_SAP,
+				  VOS_TRACE_LEVEL_ERROR,
+				  "%s: orgl chan_width=%d new chan_width=%d",
+				  __func__,
+				  sap_context_ptr->sub20_channelwidth,
+				  chan_width);
+			return VOS_STATUS_E_FAULT;
+		}
+
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_SAP,
+			  VOS_TRACE_LEVEL_ERROR,
+			  "%s: curr ChWidth = %d, %d is invalid",
+			  __func__, sap_context_ptr->sub20_channelwidth,
+			  chan_width);
+
+		return VOS_STATUS_E_FAULT;
+	}
+
+	VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+		  "%s: Posted CSA start evt for ChannelWidth = %d",
+		  __func__, chan_width);
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * WLANSAP_get_sub20_channelwidth() -
+ * This api function get sub20 channel width
+ * @vos_ctx_ptr: Pointer to vos global context structure
+ * @chan_width:  restore sub20 channel width
+ *
+ * Return: The VOS_STATUS code associated with performing
+ *	the operation
+ */
+VOS_STATUS
+WLANSAP_get_sub20_channelwidth(void *vos_ctx_ptr, uint32_t *chan_width)
+{
+	ptSapContext sap_context_ptr = NULL;
+	void *hal_ptr = NULL;
+	tpAniSirGlobal mac_ptr = NULL;
+
+	sap_context_ptr = VOS_GET_SAP_CB(vos_ctx_ptr);
+	if (NULL == sap_context_ptr) {
+		VOS_TRACE(VOS_MODULE_ID_SAP,
+			  VOS_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pvosGCtx", __func__);
+
+		return VOS_STATUS_E_FAULT;
+	}
+
+	hal_ptr = VOS_GET_HAL_CB(sap_context_ptr->pvosGCtx);
+	if (NULL == hal_ptr) {
+		VOS_TRACE(VOS_MODULE_ID_SAP,
+			  VOS_TRACE_LEVEL_ERROR,
+			  "%s: Invalid HAL pointer from pvosGCtx", __func__);
+		return VOS_STATUS_E_FAULT;
+	}
+	mac_ptr = PMAC_STRUCT(hal_ptr);
+
+	*chan_width = sap_context_ptr->sub20_channelwidth ?
+		 sap_context_ptr->sub20_channelwidth :
+		  mac_ptr->sub20_channelwidth;
+
+	return VOS_STATUS_SUCCESS;
+}
+#endif
+
 /*==========================================================================
   FUNCTION    WLANSAP_SetCounterMeasure
 
@@ -2417,7 +2607,7 @@ VOS_STATUS WLANSAP_SendAction
         if( ( NULL == hHal ) || ( eSAP_TRUE != pSapCtx->isSapSessionOpen ) )
         {
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                       "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+                       "%s: HAL pointer (%pK) NULL OR SME session is not open (%d)",
                        __func__, hHal, pSapCtx->isSapSessionOpen );
             return VOS_STATUS_E_FAULT;
         }
@@ -2492,7 +2682,7 @@ VOS_STATUS WLANSAP_RemainOnChannel
         if( ( NULL == hHal ) || ( eSAP_TRUE != pSapCtx->isSapSessionOpen ) )
         {
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                       "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+                       "%s: HAL pointer (%pK) NULL OR SME session is not open (%d)",
                        __func__, hHal, pSapCtx->isSapSessionOpen );
             return VOS_STATUS_E_FAULT;
         }
@@ -2559,7 +2749,7 @@ VOS_STATUS WLANSAP_CancelRemainOnChannel
         if( ( NULL == hHal ) || ( eSAP_TRUE != pSapCtx->isSapSessionOpen ) )
         {
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                       "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+                       "%s: HAL pointer (%pK) NULL OR SME session is not open (%d)",
                        __func__, hHal, pSapCtx->isSapSessionOpen );
             return VOS_STATUS_E_FAULT;
         }
@@ -2632,7 +2822,7 @@ VOS_STATUS WLANSAP_RegisterMgmtFrame
         if( ( NULL == hHal ) || ( eSAP_TRUE != pSapCtx->isSapSessionOpen ) )
         {
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                       "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+                       "%s: HAL pointer (%pK) NULL OR SME session is not open (%d)",
                        __func__, hHal, pSapCtx->isSapSessionOpen );
             return VOS_STATUS_E_FAULT;
         }
@@ -2705,7 +2895,7 @@ VOS_STATUS WLANSAP_DeRegisterMgmtFrame
         if( ( NULL == hHal ) || ( eSAP_TRUE != pSapCtx->isSapSessionOpen ) )
         {
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                       "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+                       "%s: HAL pointer (%pK) NULL OR SME session is not open (%d)",
                        __func__, hHal, pSapCtx->isSapSessionOpen );
             return VOS_STATUS_E_FAULT;
         }
@@ -2780,6 +2970,14 @@ WLANSAP_ChannelChangeRequest(v_PVOID_t pSapCtx, uint8_t target_channel)
     }
     pMac = PMAC_STRUCT( hHal );
     phyMode = sapContext->csrRoamProfile.phyMode;
+
+    if (sapContext->csrRoamProfile.ChannelInfo.numOfChannels == 0 ||
+        sapContext->csrRoamProfile.ChannelInfo.ChannelList == NULL)
+    {
+        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                   FL("Invalid channel list"));
+        return VOS_STATUS_E_FAULT;
+    }
     sapContext->csrRoamProfile.ChannelInfo.ChannelList[0] = target_channel;
     /*
      * We are getting channel bonding mode from sapDfsInfor structure
@@ -2792,6 +2990,12 @@ WLANSAP_ChannelChangeRequest(v_PVOID_t pSapCtx, uint8_t target_channel)
                                          pMac->sap.SapDfsInfo.new_chanWidth);
     sapContext->csrRoamProfile.vht_channel_width = vhtChannelWidth;
     sapContext->vht_channel_width = vhtChannelWidth;
+
+    sapContext->sub20_channelwidth =
+         pMac->sap.SapDfsInfo.new_sub20_channelwidth;
+    sapContext->csrRoamProfile.sub20_channelwidth =
+         pMac->sap.SapDfsInfo.new_sub20_channelwidth;
+
     /* Update the channel as this will be used to
      * send event to supplicant
      */
@@ -3793,6 +3997,7 @@ WLANSAP_ACS_CHSelect(v_PVOID_t pvosGCtx,
     tHalHandle hHal = NULL;
     VOS_STATUS vosStatus = VOS_STATUS_E_FAILURE;
     tpAniSirGlobal pMac = NULL;
+    tWLAN_SAPEvent sapEvent; /* State machine event */
 
     sapContext = VOS_GET_SAP_CB( pvosGCtx );
     if (NULL == sapContext) {
@@ -3813,7 +4018,7 @@ WLANSAP_ACS_CHSelect(v_PVOID_t pvosGCtx,
     pMac = PMAC_STRUCT( hHal );
     sapContext->acs_cfg = &pConfig->acs_cfg;
     sapContext->csrRoamProfile.phyMode = sapContext->acs_cfg->hw_mode;
-
+    sapContext->target_band = pConfig->target_band;
         /*
          * Copy the HDD callback function to report the
          * ACS result after scan in SAP context callback function.
@@ -3825,6 +4030,13 @@ WLANSAP_ACS_CHSelect(v_PVOID_t pvosGCtx,
         sapInitDfsChannelNolList(sapContext);
 
         /*
+         * If ACS is relaunched, the current operation channel needs
+         * to be backed up. If no better channel is found by ACS,
+         * need to use the current operating channel.
+         */
+        sapContext->backup_channel = sapContext->channel;
+
+        /*
          * Now, configure the scan and ACS channel params
          * to issue a scan request.
          */
@@ -3843,11 +4055,14 @@ WLANSAP_ACS_CHSelect(v_PVOID_t pvosGCtx,
          * different scan callback fucntion to process
          * the results pre start BSS.
          */
-        vosStatus = sapGotoChannelSel(sapContext, NULL, VOS_TRUE);
+        vosStatus = sapGotoChannelSel(sapContext,
+                                      &sapEvent,
+                                      sapContext->sapsMachine == eSAP_STARTED ?
+                                      VOS_FALSE : VOS_TRUE);
 
         if (VOS_STATUS_E_ABORTED == vosStatus) {
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                       "In %s,DFS not supported in the current operating mode",
+                       "In %s, acs configuration not supported",
                         __func__);
             return VOS_STATUS_E_FAILURE;
         }
@@ -3863,10 +4078,14 @@ WLANSAP_ACS_CHSelect(v_PVOID_t pvosGCtx,
 
              return sapSignalHDDevent(sapContext, NULL,
                      eSAP_ACS_CHANNEL_SELECTED, (v_PVOID_t) eSAP_STATUS_SUCCESS);
+        } else if (VOS_STATUS_SUCCESS == vosStatus) {
+            if (sapContext->sapsMachine == eSAP_STARTED)
+                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+                          FL("Successfully Issued a post start bss scan Request"));
+            else
+                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+                          FL("Successfully Issued a Pre Start Bss Scan Request"));
         }
-        else if (VOS_STATUS_SUCCESS == vosStatus)
-            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-                       FL("Successfully Issued a Pre Start Bss Scan Request"));
     return vosStatus;
 }
 /**
@@ -3939,3 +4158,28 @@ wlansap_get_chan_width(void *pvosctx, uint32_t *pchanwidth)
 	return VOS_STATUS_SUCCESS;
 }
 
+/*
+ * wlansap_set_invalid_session() - set session ID to invalid
+ * @pctx: pointer of global context
+ *
+ * This function sets session ID to invalid
+ *
+ * Return: VOS_STATUS
+ */
+VOS_STATUS
+wlansap_set_invalid_session(v_PVOID_t pctx)
+{
+	ptSapContext psapctx;
+	psapctx = VOS_GET_SAP_CB(pctx);
+	if ( NULL == psapctx) {
+		VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+			FL("Invalid SAP pointer from pctx"));
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	psapctx->sessionId = CSR_SESSION_ID_INVALID;
+	psapctx->isSapSessionOpen = eSAP_FALSE;
+
+	return VOS_STATUS_SUCCESS;
+}
+
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/bmi.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/bmi.c
index da5b6b4365c..5e89cab0883 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/bmi.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/bmi.c
@@ -1,5 +1,5 @@
 /*
- * copyright (c) 2012, 2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012, 2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -168,7 +168,7 @@ BMIDone(HIF_DEVICE *device, struct ol_softc *scn)
         return A_OK;
     }
 
-    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Enter (device: 0x%p)\n", device));
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Enter (device: 0x%pK)\n", device));
 
 #if defined(A_SIMOS_DEVHOST)
     /* Let HIF layer know that BMI phase is done.
@@ -351,7 +351,7 @@ BMIReadMemory(HIF_DEVICE *device,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-                ("BMI Read Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
+                ("BMI Read Memory: Enter (device: 0x%pK, address: 0x%x, length: %d)\n",
                     device, address, length));
 
     cid = BMI_READ_MEMORY;
@@ -422,7 +422,7 @@ BMIWriteMemory(HIF_DEVICE *device,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-         ("BMI Write Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
+         ("BMI Write Memory: Enter (device: 0x%pK, address: 0x%x, length: %d)\n",
          device, address, length));
 
     cid = BMI_WRITE_MEMORY;
@@ -487,7 +487,7 @@ BMIExecute(HIF_DEVICE *device,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-       ("BMI Execute: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
+       ("BMI Execute: Enter (device: 0x%pK, address: 0x%x, param: %d)\n",
         device, address, *param));
 
     cid = BMI_EXECUTE;
@@ -531,7 +531,7 @@ BMISetAppStart(HIF_DEVICE *device,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-       ("BMI Set App Start: Enter (device: 0x%p, address: 0x%x)\n",
+       ("BMI Set App Start: Enter (device: 0x%pK, address: 0x%x)\n",
         device, address));
 
     cid = BMI_SET_APP_START;
@@ -574,7 +574,7 @@ BMIReadSOCRegister(HIF_DEVICE *device,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-       ("BMI Read SOC Register: Enter (device: 0x%p, address: 0x%x)\n",
+       ("BMI Read SOC Register: Enter (device: 0x%pK, address: 0x%x)\n",
        device, address));
 
     cid = BMI_READ_SOC_REGISTER;
@@ -616,7 +616,7 @@ BMIWriteSOCRegister(HIF_DEVICE *device,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-     ("BMI Write SOC Register: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
+     ("BMI Write SOC Register: Enter (device: 0x%pK, address: 0x%x, param: %d)\n",
      device, address, param));
 
     cid = BMI_WRITE_SOC_REGISTER;
@@ -660,7 +660,7 @@ BMILZData(HIF_DEVICE *device,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-         ("BMI Send LZ Data: Enter (device: 0x%p, length: %d)\n",
+         ("BMI Send LZ Data: Enter (device: 0x%pK, length: %d)\n",
          device, length));
 
     cid = BMI_LZ_DATA;
@@ -715,7 +715,7 @@ BMISignStreamStart(HIF_DEVICE *device,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-         ("BMI SIGN Stream Start: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
+         ("BMI SIGN Stream Start: Enter (device: 0x%pK, address: 0x%x, length: %d)\n",
          device, address, length));
 
     cid = BMI_SIGN_STREAM_START;
@@ -778,7 +778,7 @@ BMILZStreamStart(HIF_DEVICE *device,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-         ("BMI LZ Stream Start: Enter (device: 0x%p, address: 0x%x)\n",
+         ("BMI LZ Stream Start: Enter (device: 0x%pK, address: 0x%x)\n",
          device, address));
 
     cid = BMI_LZ_STREAM_START;
@@ -857,7 +857,7 @@ BMInvramProcess(HIF_DEVICE *device, A_UCHAR *seg_name, A_UINT32 *retval,
     }
 
     AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-         ("BMI NVRAM Process: Enter (device: 0x%p, name: %s)\n",
+         ("BMI NVRAM Process: Enter (device: 0x%pK, name: %s)\n",
            device, seg_name));
 
     cid = BMI_NVRAM_PROCESS;
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/ol_fw.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/ol_fw.c
index e00a961396e..a9846364224 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/ol_fw.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/ol_fw.c
@@ -26,6 +26,7 @@
  */
 
 #include <linux/firmware.h>
+#include <linux/pm_qos.h>
 #include "ol_if_athvar.h"
 #include "ol_fw.h"
 #include "targaddrs.h"
@@ -150,6 +151,60 @@ static int ol_get_fw_files_for_target(struct ol_fw_files *pfw_files,
 }
 #endif
 
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+static struct non_qc_platform_pci_fw_files FW_FILES_QCA6174_FW_1_1 = {
+"qwlan11.bin", "bdwlan11.bin", "otp11.bin", "utf11.bin",
+"utfbd11.bin", "epping11.bin", "evicted11.bin"};
+static struct non_qc_platform_pci_fw_files FW_FILES_QCA6174_FW_2_0 = {
+"qwlan20.bin", "bdwlan20.bin", "otp20.bin", "utf20.bin",
+"utfbd20.bin", "epping20.bin", "evicted20.bin"};
+static struct non_qc_platform_pci_fw_files FW_FILES_QCA6174_FW_1_3 = {
+"qwlan13.bin", "bdwlan13.bin", "otp13.bin", "utf13.bin",
+"utfbd13.bin", "epping13.bin", "evicted13.bin"};
+static struct non_qc_platform_pci_fw_files FW_FILES_QCA6174_FW_3_0 = {
+"qwlan30.bin", "bdwlan30.bin", "otp30.bin", "utf30.bin",
+"utfbd30.bin", "epping30.bin", "evicted30.bin"};
+static struct non_qc_platform_pci_fw_files FW_FILES_DEFAULT = {
+"qwlan.bin", "bdwlan.bin", "otp.bin", "utf.bin",
+"utfbd.bin", "epping.bin", "evicted.bin"};
+
+static
+int get_fw_files_for_non_qc_pci_target(struct non_qc_platform_pci_fw_files *pfw_files,
+                           u32 target_type, u32 target_version)
+{
+	if (!pfw_files)
+		return -ENODEV;
+
+	switch (target_version) {
+		case AR6320_REV1_VERSION:
+		case AR6320_REV1_1_VERSION:
+			memcpy(pfw_files, &FW_FILES_QCA6174_FW_1_1,
+						sizeof(*pfw_files));
+		break;
+		case AR6320_REV1_3_VERSION:
+			memcpy(pfw_files, &FW_FILES_QCA6174_FW_1_3,
+						sizeof(*pfw_files));
+			break;
+		case AR6320_REV2_1_VERSION:
+			memcpy(pfw_files, &FW_FILES_QCA6174_FW_2_0,
+						sizeof(*pfw_files));
+			break;
+		case AR6320_REV3_VERSION:
+		case AR6320_REV3_2_VERSION:
+		case QCA9379_REV1_VERSION:
+			memcpy(pfw_files, &FW_FILES_QCA6174_FW_3_0,
+						sizeof(*pfw_files));
+			break;
+		default:
+			memcpy(pfw_files, &FW_FILES_DEFAULT,
+						sizeof(*pfw_files));
+			printk("%s version mismatch 0x%X 0x%X",
+				__func__, target_type, target_version);
+			break;
+	}
+	return 0;
+}
+#endif
 #ifdef HIF_USB
 static A_STATUS ol_usb_extra_initialization(struct ol_softc *scn);
 #endif
@@ -504,7 +559,12 @@ out:
 #else
 static char *ol_board_id_to_filename(struct ol_softc *scn, uint16_t board_id)
 {
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+	return kstrdup(scn->fw_files.board_data, GFP_KERNEL);
+#else
+
 	return kstrdup(QCA_BOARD_DATA_FILE, GFP_KERNEL);
+#endif
 }
 #endif
 
@@ -586,8 +646,8 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 		printk("%s: Unknown file type\n", __func__);
 		return -1;
 	case ATH_OTP_FILE:
-         
-#if defined(CONFIG_CNSS) || defined(HIF_SDIO)
+#if defined(CONFIG_CNSS) || defined(HIF_SDIO) || \
+defined(CONFIG_NON_QC_PLATFORM_PCI)
 		filename = scn->fw_files.otp_data;
 #else
 		filename = QCA_OTP_FILE;
@@ -597,7 +657,6 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 #endif
 		break;
 	case ATH_FIRMWARE_FILE:
-         
 		if (WLAN_IS_EPPING_ENABLED(vos_get_conparam())) {
 #if defined(CONFIG_CNSS) || defined(HIF_SDIO)
 			filename = scn->fw_files.epping_file;
@@ -631,12 +690,9 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 		break;
 	case ATH_PATCH_FILE:
 		printk("%s: no Patch file defined\n", __func__);
-        
 		return EOK;
 	case ATH_BOARD_DATA_FILE:
 		bd_id_filename = ol_board_id_to_filename(scn, scn->board_id);
- 
-        
 		if (bd_id_filename)
 			filename = bd_id_filename;
 		else {
@@ -651,7 +707,7 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 			bin_sign = TRUE;
 #endif
 			printk(KERN_INFO "%s: Loading board data file %s\n",
- 				__func__, filename);
+				__func__, filename);
 			break;
 		}
 #endif /* QCA_WIFI_FTM */
@@ -661,7 +717,6 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 #endif
 		break;
 	case ATH_SETUP_FILE:
-        
 		if (vos_get_conparam() != VOS_FTM_MODE &&
 		   !WLAN_IS_EPPING_ENABLED(vos_get_conparam())) {
 #ifdef CONFIG_CNSS
@@ -686,9 +741,10 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 		break;
 	}
 
-	if (request_firmware(&fw_entry, filename, scn->sc_osdev->device) != 0)
+       status = request_firmware(&fw_entry, filename, scn->sc_osdev->device);
+	if (status)
 	{
-		pr_err("%s: Failed to get %s\n", __func__, filename);
+		pr_err("%s: Failed to get %s:%d\n", __func__, filename, status);
 
 		if (file == ATH_OTP_FILE)
 			return -ENOENT;
@@ -706,10 +762,11 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 			pr_info("%s: Trying to load default %s\n",
 							__func__, filename);
 
-			if (request_firmware(&fw_entry, filename,
-					scn->sc_osdev->device) != 0) {
-				pr_err("%s: Failed to get %s\n",
-							__func__, filename);
+			status = request_firmware(&fw_entry, filename,
+					scn->sc_osdev->device);
+			if (status) {
+				pr_err("%s: Failed to get %s:%d\n",
+						__func__, filename, status);
 				kfree(bd_id_filename);
 				return -1;
 			}
@@ -723,9 +780,8 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 
 	if (!fw_entry || !fw_entry->data) {
 		pr_err("%s: Invalid fw_entries\n", __func__);
-		if (bd_id_filename)
-			kfree(bd_id_filename);
-		return A_ERROR;
+		status = A_NO_MEMORY;
+		goto release_fw;
 	}
 
 	fw_entry_size = fw_entry->size;
@@ -915,7 +971,8 @@ end:
 		(filename!=NULL)?filename:"", fw_entry_size);
 
 release_fw:
-	release_firmware(fw_entry);
+	if (fw_entry)
+		release_firmware(fw_entry);
 
 	if (bd_id_filename)
 		kfree(bd_id_filename);
@@ -993,7 +1050,8 @@ int dump_CE_register(struct ol_softc *scn)
 }
 #endif
 
-#if (defined(CONFIG_CNSS) && !defined(HIF_USB)) || defined(HIF_SDIO)
+#if (defined(CONFIG_CNSS) && !defined(HIF_USB)) || defined(HIF_SDIO) || \
+defined(CONFIG_NON_QC_PLATFORM_PCI)
 static struct ol_softc *ramdump_scn;
 #ifdef TARGET_DUMP_FOR_NON_QC_PLATFORM
 void *ol_fw_dram_addr=NULL;
@@ -1004,6 +1062,30 @@ u_int32_t ol_fw_iram_size;
 u_int32_t ol_fw_axi_size;
 #endif
 
+#if defined(HIF_SDIO)
+int ol_copy_ramdump(struct ol_softc *scn)
+{
+	int ret;
+
+	if (!vos_is_ssr_fw_dump_required())
+		return 0;
+
+	if (!scn->ramdump_base || !scn->ramdump_size) {
+		pr_info("%s: No RAM dump will be collected since ramdump_base "
+			"is NULL or ramdump_size is 0!\n", __func__);
+		ret = -EACCES;
+		goto out;
+	}
+
+	vos_request_pm_qos_type(PM_QOS_CPU_DMA_LATENCY,
+				DISABLE_KRAIT_IDLE_PS_VAL);
+	ret = ol_target_coredump(scn, scn->ramdump_base, scn->ramdump_size);
+	vos_remove_pm_qos();
+
+out:
+	return ret;
+}
+#else
 int ol_copy_ramdump(struct ol_softc *scn)
 {
 	int ret;
@@ -1023,6 +1105,7 @@ int ol_copy_ramdump(struct ol_softc *scn)
 out:
 	return ret;
 }
+#endif
 
 static void ramdump_work_handler(struct work_struct *ramdump)
 {
@@ -1036,9 +1119,10 @@ static void ramdump_work_handler(struct work_struct *ramdump)
 	u_int32_t host_interest_address;
 	u_int32_t dram_dump_values[4];
 #ifdef TARGET_DUMP_FOR_NON_QC_PLATFORM
+#ifndef CONFIG_NON_QC_PLATFORM_PCI
 	u_int8_t *byte_ptr;
 #endif
-
+#endif
 	if (!ramdump_scn) {
 		printk("No RAM dump will be collected since ramdump_scn is NULL!\n");
 		goto out_fail;
@@ -1101,6 +1185,7 @@ static void ramdump_work_handler(struct work_struct *ramdump)
 		goto out_fail;
 	}
 
+#ifndef CONFIG_NON_QC_PLATFORM_PCI
 	ol_fw_dram_size = DRAM_SIZE;
 	ol_fw_iram_size = IRAM_SIZE;
 	ol_fw_axi_size = AXI_SIZE;
@@ -1109,12 +1194,13 @@ static void ramdump_work_handler(struct work_struct *ramdump)
 	ol_fw_axi_addr = (void *)(byte_ptr + DRAM_SIZE);
 	ol_fw_iram_addr = (void *)(byte_ptr + DRAM_SIZE + AXI_SIZE);
 
-	pr_err("%s: DRAM => mem = %#08x, len = %d\n", __func__,
-			(u_int32_t)ol_fw_dram_addr, DRAM_SIZE);
-	pr_err("%s: AXI  => mem = %#08x, len = %d\n", __func__,
-			(u_int32_t)ol_fw_axi_addr, AXI_SIZE);
-	pr_err("%s: IRAM => mem = %#08x, len = %d\n", __func__,
-			(u_int32_t)ol_fw_iram_addr, IRAM_SIZE);
+	pr_err("%s: DRAM => mem = %pK, len = %d\n", __func__,
+				ol_fw_dram_addr, DRAM_SIZE);
+	pr_err("%s: AXI  => mem = %pK, len = %d\n", __func__,
+				ol_fw_axi_addr, AXI_SIZE);
+	pr_err("%s: IRAM => mem = %pK, len = %d\n", __func__,
+				ol_fw_iram_addr, IRAM_SIZE);
+#endif
 #endif
 
 	if (ol_copy_ramdump(ramdump_scn))
@@ -1122,7 +1208,7 @@ static void ramdump_work_handler(struct work_struct *ramdump)
 
 	printk("%s: RAM dump collecting completed!\n", __func__);
 
-#if defined(HIF_SDIO) && !defined(CONFIG_CNSS)
+#if (defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI)) && !defined(CONFIG_CNSS)
 	panic("CNSS Ram dump collected\n");
 #else
 	/* Notify SSR framework the target has crashed. */
@@ -1268,11 +1354,12 @@ void ol_ramdump_handler(struct ol_softc *scn)
 			}
 			hex_dump_to_buffer(reg, remaining, 16, 4, str_buf,
 						sizeof(str_buf), false);
-			if (printk_ratelimit())
-			    pr_err("%#08x: %s\n", start_addr + i, str_buf);
+			pr_err("%#08x: %s\n", start_addr + i, str_buf);
 			remaining -= 16;
 			reg += 4;
 		}
+		if ((scn->enableFwSelfRecovery || scn->enableRamdumpCollection) && (scn->fw_ram_dumping == 0))
+                        vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, FALSE);
 	}
 	else if ((!scn->enableFwSelfRecovery)&&
 			((pattern & FW_RAMDUMP_PATTERN_MASK) ==
@@ -1287,19 +1374,15 @@ void ol_ramdump_handler(struct ol_softc *scn)
 							fw_ram_seg_size[i],
 							GFP_KERNEL);
 			if (!scn->ramdump[i]) {
-				scn->ramdump[i] = vmalloc(sizeof(struct fw_ramdump) +
-								fw_ram_seg_size[i]);
-				if (!scn->ramdump[i]) {
-					pr_err("Fail to allocate memory for ram dump");
-					VOS_BUG(0);
-				}
+				pr_err("Fail to allocate memory for ram dump");
+				VOS_BUG(0);
 			}
 			(scn->ramdump[i])->mem =
 				(A_UINT8 *) (scn->ramdump[i] + 1);
 			fw_ram_seg_addr[i] = (scn->ramdump[i])->mem;
 			pr_err("FW %s start addr = %#08x\n",
 				fw_ram_seg_name[i], *reg);
-			pr_err("Memory addr for %s = %p\n",
+			pr_err("Memory addr for %s = %pK\n",
 				fw_ram_seg_name[i],
 				(scn->ramdump[i])->mem);
 			(scn->ramdump[i])->start_addr = *reg;
@@ -1413,7 +1496,7 @@ static int __ol_target_failure(struct ol_softc *scn, void *wma_hdl)
 					dbglog_buf.length) != A_OK)
 			pr_err("%s FW dbglog_data failed\n", __func__);
 		else {
-			pr_info("%s dbglog_hdr.dbuf=%u, dbglog_data=%p,"
+			pr_info("%s dbglog_hdr.dbuf=%u, dbglog_data=%pK,"
 				"dbglog_buf.buffer=%u, dbglog_buf.length=%u\n",
 				__func__, dbglog_hdr.dbuf, dbglog_data,
 				dbglog_buf.buffer, dbglog_buf.length);
@@ -1475,16 +1558,21 @@ void ol_target_failure(void *instance, A_STATUS status)
 
 		dump_CE_debug_register(scn->hif_sc);
 		ol_copy_ramdump(scn);
+#ifndef CONFIG_NON_QC_PLATFORM_PCI
 		VOS_BUG(0);
+#endif
 	}
 #endif
 
+	vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
 	if (vos_is_load_unload_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
 		printk("%s: Loading/Unloading is in progress, ignore!\n",
 			__func__);
+		vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, FALSE);
+#ifndef CONFIG_NON_QC_PLATFORM_PCI
 		return;
+#endif
 	}
-	vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
 
 #ifdef HIF_PCI
 	ret = hif_pci_check_fw_reg(scn->hif_sc);
@@ -1513,7 +1601,9 @@ void ol_target_failure(void *instance, A_STATUS status)
 	if (__ol_target_failure(scn, wma))
 		return;
 
-#if  defined(CONFIG_CNSS) || defined(HIF_SDIO)
+#if  defined(CONFIG_CNSS) || defined(HIF_SDIO) || \
+defined(CONFIG_NON_QC_PLATFORM_PCI)
+	vos_svc_fw_shutdown_ind(scn->adf_dev->dev);
 	/* Collect the RAM dump through a workqueue */
 	if (scn->enableRamdumpCollection)
 		ol_schedule_ramdump_work(scn);
@@ -2058,6 +2148,7 @@ A_STATUS ol_patch_pll_switch(struct ol_softc * scn)
 #endif
 
 #ifdef HIF_PCI
+#ifndef CONFIG_NON_QC_PLATFORM_PCI
 /* AXI Start Address */
 #define TARGET_ADDR (0xa0000)
 
@@ -2070,12 +2161,10 @@ void ol_transfer_codeswap_struct(struct ol_softc *scn) {
 		pr_err("%s: hif_pci_softc is null\n", __func__);
 		return;
 	}
-
 	if (cnss_get_codeswap_struct(&wlan_codeswap)) {
 		pr_err("%s: failed to get codeswap structure\n", __func__);
 		return;
 	}
-
 	rv = BMIWriteMemory(scn->hif_hdl, TARGET_ADDR,
 		(u_int8_t *)&wlan_codeswap, sizeof(wlan_codeswap), scn);
 
@@ -2086,6 +2175,7 @@ void ol_transfer_codeswap_struct(struct ol_softc *scn) {
 	pr_info("%s:codeswap structure is successfully downloaded\n", __func__);
 }
 #endif
+#endif
 
 int ol_download_firmware(struct ol_softc *scn)
 {
@@ -2096,7 +2186,14 @@ int ol_download_firmware(struct ol_softc *scn)
 	A_STATUS ret;
 #endif
 
-#ifdef HIF_PCI
+#if defined(CONFIG_NON_QC_PLATFORM_PCI)
+		if (0 != get_fw_files_for_non_qc_pci_target(&scn->fw_files,
+						scn->target_type,
+						scn->target_version)) {
+			printk("%s: No FW files from CNSS driver\n", __func__);
+			return -1;
+		}
+#elif defined(HIF_PCI)
 		if (0 != cnss_get_fw_files_for_target(&scn->fw_files,
 						scn->target_type,
 						scn->target_version)) {
@@ -2148,8 +2245,10 @@ int ol_download_firmware(struct ol_softc *scn)
 
 		if ( scn->enablesinglebinary == FALSE ) {
 #ifdef HIF_PCI
+#ifndef CONFIG_NON_QC_PLATFORM_PCI
 			ol_transfer_codeswap_struct(scn);
 #endif
+#endif
 
 			status = ol_transfer_bin_file(scn, ATH_OTP_FILE,
 						      address, TRUE);
@@ -2160,7 +2259,7 @@ int ol_download_firmware(struct ol_softc *scn)
 				bdf_ret = param & 0xff;
 				if (!bdf_ret)
 					scn->board_id = (param >> 8) & 0xffff;
-				pr_debug("%s: chip_id:0x%0x board_id:0x%0x\n",
+				pr_err("%s: chip_id:0x%0x board_id:0x%0x\n",
 						__func__, scn->target_version,
 							scn->board_id);
 			} else if (status < 0) {
@@ -2428,6 +2527,7 @@ static int ol_ath_get_reg_table(uint32_t target_version,
 	switch (target_version) {
 	case AR6320_REV3_VERSION:
 	case AR6320_REV3_2_VERSION:
+	case QCA9377_REV1_1_VERSION:
 		reg_table->section = (tgt_reg_section *)&ar6320v3_reg_table[0];
 		reg_table->section_size = sizeof(ar6320v3_reg_table)/
 			sizeof(ar6320v3_reg_table[0]);
@@ -2652,6 +2752,10 @@ int ol_target_coredump(void *inst, void *memoryBlock, u_int32_t blockLength)
 	uint32_t readLen = 0;
 	uint32_t max_count = ol_get_max_section_count(scn);
 
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+
+	char *fw_ram_seg_name[] = {"DRAM ", "AXI ", "REG ", "IRAM1 ", "IRAM2 "};
+#endif
 	while ((sectionCount < max_count) && (amountRead < blockLength)) {
 		switch (sectionCount) {
 		case 0:
@@ -2702,6 +2806,9 @@ int ol_target_coredump(void *inst, void *memoryBlock, u_int32_t blockLength)
 
 		pr_info("%s: Section:%d Bytes Read:%0x\n", __func__,
 			sectionCount, result);
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+		printk("\nMemory addr for %s = 0x%p (size: %x)\n",fw_ram_seg_name[sectionCount], bufferLoc, result);
+#endif
 		amountRead += result;
 		bufferLoc += result;
 		sectionCount++;
@@ -2817,9 +2924,16 @@ ol_sdio_extra_initialization(struct ol_softc *scn)
 			break;
 		}
 
-		param |= (HI_ACS_FLAGS_SDIO_SWAP_MAILBOX_SET|
-                  HI_ACS_FLAGS_SDIO_REDUCE_TX_COMPL_SET|
-                  HI_ACS_FLAGS_ALT_DATA_CREDIT_SIZE);
+		param |= (HI_ACS_FLAGS_SDIO_SWAP_MAILBOX_SET |
+			HI_ACS_FLAGS_ALT_DATA_CREDIT_SIZE);
+
+		if (!vos_is_ptp_tx_opt_enabled() &&
+		    !vos_is_ocb_tx_per_pkt_stats_enabled())
+			param |= HI_ACS_FLAGS_SDIO_REDUCE_TX_COMPL_SET;
+
+		/* enable TX completion to collect tx_desc for pktlog */
+		if (vos_is_packet_log_enabled())
+			param &= ~HI_ACS_FLAGS_SDIO_REDUCE_TX_COMPL_SET;
 
 		BMIWriteMemory(scn->hif_hdl,
 				host_interest_item_address(scn->target_type,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/ol_fw.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/ol_fw.h
index 2fc36997d48..aca4961bf50 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/ol_fw.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/BMI/ol_fw.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014,2016-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -72,8 +72,13 @@
  * read might change
  */
 #define REGISTER_LOCATION       0x00000800
-
 #ifdef TARGET_DUMP_FOR_NON_QC_PLATFORM
+#ifdef HIF_SDIO
+#define REG_SIZE		0x0007F820
+#endif
+#endif
+
+#if defined(TARGET_DUMP_FOR_NON_QC_PLATFORM) && !defined(HIF_PCI)
 #define DRAM_LOCATION           0x00400000
 #ifdef HIF_USB
 #define DRAM_SIZE               0x00098000
@@ -109,6 +114,9 @@
 #define IRAM1_SIZE              0x00080000
 #define IRAM2_LOCATION          0x00a00000
 #define IRAM2_SIZE              0x00040000
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+#define REG_SIZE		0x0007F820
+#endif
 #elif defined(HIF_SDIO) || defined(HIF_USB)
 #define IRAM_LOCATION           0x00980000
 #define IRAM_SIZE               0x000C0000
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/_ieee80211_common.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/_ieee80211_common.h
index f4a92944d87..a1df3977efe 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/_ieee80211_common.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/_ieee80211_common.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -548,4 +548,21 @@ struct ieee80211_chanutil_info {
     u_int8_t     beacon_intervals;
 };
 
+/**
+ * struct ieee80211_radiotap_header - radio tap header
+ * @it_version: version 0
+ * @it_pad:     padding
+ * @it_len:     length of the whole header in bytes
+ * @it_present: bitmap telling which fields are present
+ *
+ * This struct is used to indicate rx status in monitor mode
+ * and carry tx parameters in packet injection.
+ */
+struct ieee80211_radiotap_header {
+	u_int8_t it_version;
+	u_int8_t it_pad;
+	u_int16_t it_len;
+	u_int32_t it_present;
+} __packed;
+
 #endif /* _COMMON__IEEE80211_H_ */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_nbuf.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_nbuf.c
index e549f1a49d6..6f45f72687f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_nbuf.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_nbuf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -708,6 +708,9 @@ __adf_nbuf_data_get_icmp_subtype(uint8_t *data)
 	subtype = (uint8_t)(*(uint8_t *)
 			(data + ICMP_SUBTYPE_OFFSET));
 
+	VOS_TRACE(VOS_MODULE_ID_ADF, VOS_TRACE_LEVEL_DEBUG,
+		"ICMP proto type: 0x%02x", subtype);
+
 	switch (subtype) {
 	case ICMP_REQUEST:
 		proto_subtype = ADF_PROTO_ICMP_REQ;
@@ -740,6 +743,9 @@ __adf_nbuf_data_get_icmpv6_subtype(uint8_t *data)
 	subtype = (uint8_t)(*(uint8_t *)
 			(data + ICMPV6_SUBTYPE_OFFSET));
 
+	VOS_TRACE(VOS_MODULE_ID_ADF, VOS_TRACE_LEVEL_DEBUG,
+		"ICMPv6 proto type: 0x%02x", subtype);
+
 	switch (subtype) {
 	case ICMPV6_REQUEST:
 		proto_subtype = ADF_PROTO_ICMPV6_REQ;
@@ -747,6 +753,18 @@ __adf_nbuf_data_get_icmpv6_subtype(uint8_t *data)
 	case ICMPV6_RESPONSE:
 		proto_subtype = ADF_PROTO_ICMPV6_RES;
 		break;
+	case ICMPV6_RS:
+		proto_subtype = ADF_PROTO_ICMPV6_RS;
+		break;
+	case ICMPV6_RA:
+		proto_subtype = ADF_PROTO_ICMPV6_RA;
+		break;
+	case ICMPV6_NS:
+		proto_subtype = ADF_PROTO_ICMPV6_NS;
+		break;
+	case ICMPV6_NA:
+		proto_subtype = ADF_PROTO_ICMPV6_NA;
+		break;
 	default:
 		break;
 	}
@@ -798,11 +816,10 @@ __adf_nbuf_data_get_ipv6_proto(uint8_t *data)
  *
  * This func. checks whether it is a DHCP packet or not.
  *
- * Return: A_STATUS_OK if it is a DHCP packet
- *         A_STATUS_FAILED if not
+ * Return: TRUE if it is a DHCP packet
+ *         FALSE if not
  */
-a_status_t
-__adf_nbuf_data_is_dhcp_pkt(uint8_t *data)
+bool __adf_nbuf_data_is_dhcp_pkt(uint8_t *data)
 {
    a_uint16_t    SPort;
    a_uint16_t    DPort;
@@ -817,11 +834,11 @@ __adf_nbuf_data_is_dhcp_pkt(uint8_t *data)
        ((ADF_NBUF_TRAC_DHCP_CLI_PORT == adf_os_cpu_to_be16(SPort)) &&
        (ADF_NBUF_TRAC_DHCP_SRV_PORT == adf_os_cpu_to_be16(DPort))))
     {
-        return A_STATUS_OK;
+        return true;
     }
     else
     {
-        return A_STATUS_FAILED;
+        return false;
     }
 }
 
@@ -831,11 +848,10 @@ __adf_nbuf_data_is_dhcp_pkt(uint8_t *data)
  *
  * This func. checks whether it is a EAPOL packet or not.
  *
- * Return: A_STATUS_OK if it is a EAPOL packet
- *         A_STATUS_FAILED if not
+ * Return: TRUE if it is a EAPOL packet
+ *         FALSE if not
  */
-a_status_t
-__adf_nbuf_data_is_eapol_pkt(uint8_t *data)
+bool __adf_nbuf_data_is_eapol_pkt(uint8_t *data)
 {
     a_uint16_t    ether_type;
 
@@ -843,11 +859,11 @@ __adf_nbuf_data_is_eapol_pkt(uint8_t *data)
 			ADF_NBUF_TRAC_ETH_TYPE_OFFSET));
     if (ADF_NBUF_TRAC_EAPOL_ETH_TYPE == adf_os_cpu_to_be16(ether_type))
     {
-        return A_STATUS_OK;
+        return true;
     }
     else
     {
-        return A_STATUS_FAILED;
+        return false;
     }
 }
 
@@ -906,19 +922,51 @@ bool __adf_nbuf_data_is_ipv4_pkt(uint8_t *data)
  */
 bool __adf_nbuf_data_is_ipv4_mcast_pkt(uint8_t *data)
 {
-	uint8_t *dst_addr =
-		(uint8_t *)(data + ADF_NBUF_TRAC_IPV4_DEST_ADDR_OFFSET);
-
-	/*
-	 * Check first byte of the IP address and if it
-	 * from 224 to 239, then it can represent multicast IP.
-	 */
-	if (dst_addr[0] >= 224 && dst_addr[0]  <= 239)
-		return true;
-	else
+	if (__adf_nbuf_data_is_ipv4_pkt(data)) {
+		uint8_t *dst_addr =
+			(uint8_t *)(data + ADF_NBUF_TRAC_IPV4_DEST_ADDR_OFFSET);
+
+		/*
+		 * Check first byte of the IP address and if it
+		 * from 224 to 239, then it can represent multicast IP.
+		 */
+		if (dst_addr[0] >= 224 && dst_addr[0]  <= 239)
+			return true;
+		else
+			return false;
+	} else
 		return false;
 }
 
+/**
+ * __adf_nbuf_data_is_ipv6_mcast_pkt() - check if it is IPV6 multicast packet.
+ * @data: Pointer to IPV6 packet data buffer
+ *
+ * This func. checks whether it is a IPV6 muticast packet or not.
+ *
+ * Return: TRUE if it is a IPV6 multicast packet
+ *         FALSE if not
+ */
+bool __adf_nbuf_data_is_ipv6_mcast_pkt(uint8_t *data)
+{
+	if (__adf_nbuf_data_is_ipv6_pkt(data)) {
+		uint16_t *dst_addr;
+
+		dst_addr = (uint16_t *)
+			(data + ADF_NBUF_TRAC_IPV6_DEST_ADDR_OFFSET);
+
+		/*
+		 * Check first byte of the IP address and if it
+		 * 0xFF00 then it is a IPV6 mcast packet.
+		 */
+		if (*dst_addr ==
+		     adf_os_cpu_to_be16(ADF_NBUF_TRAC_IPV6_DEST_ADDR))
+			return true;
+		else
+			return false;
+	} else
+		return false;
+}
 
 /**
  * __adf_nbuf_data_is_ipv6_pkt() - check if it is IPV6 packet.
@@ -1116,22 +1164,33 @@ __adf_nbuf_trace_update(struct sk_buff *buf, char *event_string)
                    NBUF_PKT_TRAC_MAX_STRING);
    adf_os_mem_copy(string_buf,
                    event_string, adf_os_str_len(event_string));
-   if (NBUF_PKT_TRAC_TYPE_EAPOL &
-       adf_nbuf_trace_get_proto_type(buf)) {
+   switch (adf_nbuf_trace_get_proto_type(buf)) {
+   case NBUF_PKT_TRAC_TYPE_EAPOL:
       adf_os_mem_copy(string_buf + adf_os_str_len(event_string),
-                      "EPL",
-                      NBUF_PKT_TRAC_PROTO_STRING);
-   }
-   else if (NBUF_PKT_TRAC_TYPE_DHCP &
-            adf_nbuf_trace_get_proto_type(buf)) {
+                      "EPL", adf_os_str_len("EPL"));
+      break;
+   case NBUF_PKT_TRAC_TYPE_DHCP:
+      adf_os_mem_copy(string_buf + adf_os_str_len(event_string),
+                      "DHC", adf_os_str_len("DHC"));
+      break;
+   case NBUF_PKT_TRAC_TYPE_MGMT_ACTION:
+      adf_os_mem_copy(string_buf + adf_os_str_len(event_string),
+                      "MACT", adf_os_str_len("MACT"));
+      break;
+   case NBUF_PKT_TRAC_TYPE_ARP:
+      adf_os_mem_copy(string_buf + adf_os_str_len(event_string),
+                      "ARP", adf_os_str_len("ARP"));
+      break;
+   case NBUF_PKT_TRAC_TYPE_NS:
       adf_os_mem_copy(string_buf + adf_os_str_len(event_string),
-                      "DHC",
-                      NBUF_PKT_TRAC_PROTO_STRING);
-   } else if (NBUF_PKT_TRAC_TYPE_MGMT_ACTION &
-              adf_nbuf_trace_get_proto_type(buf)) {
+                      "NS", adf_os_str_len("NS"));
+      break;
+   case NBUF_PKT_TRAC_TYPE_NA:
       adf_os_mem_copy(string_buf + adf_os_str_len(event_string),
-                      "MACT",
-                      NBUF_PKT_TRAC_PROTO_STRING);
+                      "NA", adf_os_str_len("NA"));
+      break;
+   default:
+      break;
    }
 
    trace_update_cb(string_buf);
@@ -1139,6 +1198,493 @@ __adf_nbuf_trace_update(struct sk_buff *buf, char *event_string)
 }
 #endif /* QCA_PKT_PROTO_TRACE */
 
+#ifdef MEMORY_DEBUG
+#define ADF_NET_BUF_TRACK_MAX_SIZE    (1024)
+
+/**
+ * struct adf_nbuf_track_t - Network buffer track structure
+ *
+ * @p_next: Pointer to next
+ * @net_buf: Pointer to network buffer
+ * @file_name: File name
+ * @line_num: Line number
+ * @size: Size
+ */
+struct adf_nbuf_track_t {
+	struct adf_nbuf_track_t *p_next;
+	adf_nbuf_t net_buf;
+	uint8_t *file_name;
+	uint32_t line_num;
+	size_t size;
+};
+
+static spinlock_t g_adf_net_buf_track_lock[ADF_NET_BUF_TRACK_MAX_SIZE];
+typedef struct adf_nbuf_track_t ADF_NBUF_TRACK;
+
+static ADF_NBUF_TRACK *gp_adf_net_buf_track_tbl[ADF_NET_BUF_TRACK_MAX_SIZE];
+static struct kmem_cache *nbuf_tracking_cache;
+static ADF_NBUF_TRACK *adf_net_buf_track_free_list;
+static spinlock_t adf_net_buf_track_free_list_lock;
+static uint32_t adf_net_buf_track_free_list_count;
+static uint32_t adf_net_buf_track_used_list_count;
+static uint32_t adf_net_buf_track_max_used;
+static uint32_t adf_net_buf_track_max_free;
+static uint32_t adf_net_buf_track_max_allocated;
+
+/**
+ * adf_update_max_used() - update adf_net_buf_track_max_used tracking variable
+ *
+ * tracks the max number of network buffers that the wlan driver was tracking
+ * at any one time.
+ *
+ * Return: none
+ */
+static inline void adf_update_max_used(void)
+{
+	int sum;
+
+	if (adf_net_buf_track_max_used <
+	    adf_net_buf_track_used_list_count)
+		adf_net_buf_track_max_used = adf_net_buf_track_used_list_count;
+	sum = adf_net_buf_track_free_list_count +
+		adf_net_buf_track_used_list_count;
+	if (adf_net_buf_track_max_allocated < sum)
+		adf_net_buf_track_max_allocated = sum;
+}
+
+/**
+ * adf_update_max_free() - update adf_net_buf_track_free_list_count
+ *
+ * tracks the max number tracking buffers kept in the freelist.
+ *
+ * Return: none
+ */
+static inline void adf_update_max_free(void)
+{
+	if (adf_net_buf_track_max_free <
+	    adf_net_buf_track_free_list_count)
+		adf_net_buf_track_max_free = adf_net_buf_track_free_list_count;
+}
+
+/**
+ * adf_nbuf_track_alloc() - allocate a cookie to track nbufs allocated by wlan
+ *
+ * This function pulls from a freelist if possible and uses kmem_cache_alloc.
+ * This function also adds fexibility to adjust the allocation and freelist
+ * schemes.
+ *
+ * Return: a pointer to an unused ADF_NBUF_TRACK structure may not be zeroed.
+ */
+static ADF_NBUF_TRACK *adf_nbuf_track_alloc(void)
+{
+	int flags = GFP_KERNEL;
+	unsigned long irq_flag;
+	ADF_NBUF_TRACK *new_node = NULL;
+
+	spin_lock_irqsave(&adf_net_buf_track_free_list_lock, irq_flag);
+	adf_net_buf_track_used_list_count++;
+	if (adf_net_buf_track_free_list != NULL) {
+		new_node = adf_net_buf_track_free_list;
+		adf_net_buf_track_free_list =
+			adf_net_buf_track_free_list->p_next;
+		adf_net_buf_track_free_list_count--;
+	}
+	adf_update_max_used();
+	spin_unlock_irqrestore(&adf_net_buf_track_free_list_lock, irq_flag);
+
+	if (new_node != NULL)
+		return new_node;
+
+	if (in_interrupt() || irqs_disabled() || in_atomic())
+		flags = GFP_ATOMIC;
+
+	return kmem_cache_alloc(nbuf_tracking_cache, flags);
+}
+
+/* FREEQ_POOLSIZE initial and minimum desired freelist poolsize */
+#define FREEQ_POOLSIZE 2048
+
+/**
+ * adf_nbuf_track_free() - free the nbuf tracking cookie.
+ * @node: adf nbuf tarcking node
+ *
+ * Matches calls to adf_nbuf_track_alloc.
+ * Either frees the tracking cookie to kernel or an internal
+ * freelist based on the size of the freelist.
+ *
+ * Return: none
+ */
+static void adf_nbuf_track_free(ADF_NBUF_TRACK *node)
+{
+	unsigned long irq_flag;
+
+	if (!node)
+		return;
+
+	/* Try to shrink the freelist if free_list_count > than FREEQ_POOLSIZE
+	 * only shrink the freelist if it is bigger than twice the number of
+	 * nbufs in use. If the driver is stalling in a consistent bursty
+	 * fasion, this will keep 3/4 of thee allocations from the free list
+	 * while also allowing the system to recover memory as less frantic
+	 * traffic occurs.
+	 */
+
+	spin_lock_irqsave(&adf_net_buf_track_free_list_lock, irq_flag);
+
+	adf_net_buf_track_used_list_count--;
+	if (adf_net_buf_track_free_list_count > FREEQ_POOLSIZE &&
+	   (adf_net_buf_track_free_list_count >
+	    adf_net_buf_track_used_list_count << 1)) {
+		kmem_cache_free(nbuf_tracking_cache, node);
+	} else {
+		node->p_next = adf_net_buf_track_free_list;
+		adf_net_buf_track_free_list = node;
+		adf_net_buf_track_free_list_count++;
+	}
+	adf_update_max_free();
+	spin_unlock_irqrestore(&adf_net_buf_track_free_list_lock, irq_flag);
+}
+
+/**
+ * adf_nbuf_track_prefill() - prefill the nbuf tracking cookie freelist
+ *
+ * Removes a 'warmup time' characteristic of the freelist.  Prefilling
+ * the freelist first makes it performant for the first iperf udp burst
+ * as well as steady state.
+ *
+ * Return: None
+ */
+static void adf_nbuf_track_prefill(void)
+{
+	int i;
+	ADF_NBUF_TRACK *node, *head;
+
+	/* prepopulate the freelist */
+	head = NULL;
+	for (i = 0; i < FREEQ_POOLSIZE; i++) {
+		node = adf_nbuf_track_alloc();
+		if (node == NULL)
+			continue;
+		node->p_next = head;
+		head = node;
+	}
+	while (head) {
+		node = head->p_next;
+		adf_nbuf_track_free(head);
+		head = node;
+	}
+}
+
+/**
+ * adf_nbuf_track_memory_manager_create() - manager for nbuf tracking cookies
+ *
+ * This initializes the memory manager for the nbuf tracking cookies.  Because
+ * these cookies are all the same size and only used in this feature, we can
+ * use a kmem_cache to provide tracking as well as to speed up allocations.
+ * To avoid the overhead of allocating and freeing the buffers (including SLUB
+ * features) a freelist is prepopulated here.
+ *
+ * Return: None
+ */
+static void adf_nbuf_track_memory_manager_create(void)
+{
+	spin_lock_init(&adf_net_buf_track_free_list_lock);
+	nbuf_tracking_cache = kmem_cache_create("adf_nbuf_tracking_cache",
+						sizeof(ADF_NBUF_TRACK),
+						0, 0, NULL);
+
+	adf_nbuf_track_prefill();
+}
+
+/**
+ * adf_nbuf_track_memory_manager_destroy() - manager for nbuf tracking cookies
+ *
+ * Empty the freelist and print out usage statistics when it is no longer
+ * needed. Also the kmem_cache should be destroyed here so that it can warn if
+ * any nbuf tracking cookies were leaked.
+ *
+ * Return: None
+ */
+static void adf_nbuf_track_memory_manager_destroy(void)
+{
+	ADF_NBUF_TRACK *node, *tmp;
+	unsigned long irq_flag;
+
+	adf_print("%s: %d residual freelist size",
+			  __func__, adf_net_buf_track_free_list_count);
+
+	adf_print("%s: %d max freelist size observed",
+			  __func__, adf_net_buf_track_max_free);
+
+	adf_print("%s: %d max buffers used observed",
+			  __func__, adf_net_buf_track_max_used);
+
+	adf_print("%s: %d max buffers allocated observed",
+			  __func__, adf_net_buf_track_max_allocated);
+
+	spin_lock_irqsave(&adf_net_buf_track_free_list_lock, irq_flag);
+	node = adf_net_buf_track_free_list;
+
+	while (node) {
+		tmp = node;
+		node = node->p_next;
+		kmem_cache_free(nbuf_tracking_cache, tmp);
+		adf_net_buf_track_free_list_count--;
+	}
+
+	if (adf_net_buf_track_free_list_count != 0)
+		adf_print("%s: %d unfreed tracking memory lost in freelist",
+			  __func__, adf_net_buf_track_free_list_count);
+
+	if (adf_net_buf_track_used_list_count != 0)
+		adf_print("%s: %d unfreed tracking memory still in use",
+			  __func__, adf_net_buf_track_used_list_count);
+
+	adf_net_buf_track_free_list = NULL;
+	adf_net_buf_track_free_list_count = 0;
+	adf_net_buf_track_used_list_count = 0;
+	adf_net_buf_track_max_used = 0;
+	adf_net_buf_track_max_free = 0;
+	adf_net_buf_track_max_allocated = 0;
+
+	spin_unlock_irqrestore(&adf_net_buf_track_free_list_lock, irq_flag);
+	kmem_cache_destroy(nbuf_tracking_cache);
+}
+
+/**
+ * adf_net_buf_debug_init() - initialize network buffer debug functionality
+ *
+ * ADF network buffer debug feature tracks all SKBs allocated by WLAN driver
+ * in a hash table and when driver is unloaded it reports about leaked SKBs.
+ * WLAN driver module whose allocated SKB is freed by network stack are
+ * suppose to call adf_net_buf_debug_release_skb() such that the SKB is not
+ * reported as memory leak.
+ *
+ * Return: none
+ */
+void adf_net_buf_debug_init(void)
+{
+	uint32_t i;
+
+	adf_nbuf_track_memory_manager_create();
+
+	for (i = 0; i < ADF_NET_BUF_TRACK_MAX_SIZE; i++) {
+		gp_adf_net_buf_track_tbl[i] = NULL;
+		spin_lock_init(&g_adf_net_buf_track_lock[i]);
+	}
+
+	return;
+}
+
+/**
+ * adf_net_buf_debug_exit() - exit network buffer debug functionality
+ *
+ * Exit network buffer tracking debug functionality and log SKB memory leaks
+ * As part of exiting the functionality, free the leaked memory and
+ * cleanup the tracking buffers.
+ *
+ * Return: none
+ */
+void adf_net_buf_debug_exit(void)
+{
+	uint32_t i;
+	unsigned long irq_flag;
+	ADF_NBUF_TRACK *p_node;
+	ADF_NBUF_TRACK *p_prev;
+
+	for (i = 0; i < ADF_NET_BUF_TRACK_MAX_SIZE; i++) {
+		spin_lock_irqsave(&g_adf_net_buf_track_lock[i], irq_flag);
+		p_node = gp_adf_net_buf_track_tbl[i];
+		while (p_node) {
+			p_prev = p_node;
+			p_node = p_node->p_next;
+			adf_print("SKB buf memory Leak@ File %s, @Line %d, size %zu",
+				  p_prev->file_name, p_prev->line_num,
+				  p_prev->size);
+			adf_nbuf_track_free(p_prev);
+		}
+		spin_unlock_irqrestore(&g_adf_net_buf_track_lock[i], irq_flag);
+	}
+
+	adf_nbuf_track_memory_manager_destroy();
+
+	return;
+}
+
+/**
+ * adf_net_buf_debug_hash() - hash network buffer pointer
+ *
+ * Return: hash value
+ */
+uint32_t adf_net_buf_debug_hash(adf_nbuf_t net_buf)
+{
+	uint32_t i;
+
+	i = (uint32_t) (((uintptr_t) net_buf) >> 4);
+	i += (uint32_t) (((uintptr_t) net_buf) >> 14);
+	i &= (ADF_NET_BUF_TRACK_MAX_SIZE - 1);
+
+	return i;
+}
+
+/**
+ * adf_net_buf_debug_look_up() - look up network buffer in debug hash table
+ *
+ * Return: If skb is found in hash table then return pointer to network buffer
+ *         else return NULL
+ */
+ADF_NBUF_TRACK *adf_net_buf_debug_look_up(adf_nbuf_t net_buf)
+{
+	uint32_t i;
+	ADF_NBUF_TRACK *p_node;
+
+	i = adf_net_buf_debug_hash(net_buf);
+	p_node = gp_adf_net_buf_track_tbl[i];
+
+	while (p_node) {
+		if (p_node->net_buf == net_buf)
+			return p_node;
+		p_node = p_node->p_next;
+	}
+
+	return NULL;
+}
+
+/**
+ * adf_net_buf_debug_add_node() - store skb in debug hash table
+ *
+ * Return: none
+ */
+void adf_net_buf_debug_add_node(adf_nbuf_t net_buf, size_t size,
+				uint8_t *file_name, uint32_t line_num)
+{
+	uint32_t i;
+	unsigned long irq_flag;
+	ADF_NBUF_TRACK *p_node;
+	ADF_NBUF_TRACK *new_node;
+
+	new_node = adf_nbuf_track_alloc();
+
+	i = adf_net_buf_debug_hash(net_buf);
+	spin_lock_irqsave(&g_adf_net_buf_track_lock[i], irq_flag);
+
+	p_node = adf_net_buf_debug_look_up(net_buf);
+
+	if (p_node) {
+		adf_print("Double allocation of skb ! Already allocated from %pK %s %d current alloc from %pK %s %d",
+			  p_node->net_buf, p_node->file_name, p_node->line_num,
+			  net_buf, file_name, line_num);
+		adf_os_warn(1);
+		adf_nbuf_track_free(new_node);
+		goto done;
+	} else {
+		p_node = new_node;
+		if (p_node) {
+			p_node->net_buf = net_buf;
+			p_node->file_name = file_name;
+			p_node->line_num = line_num;
+			p_node->size = size;
+			p_node->p_next = gp_adf_net_buf_track_tbl[i];
+			gp_adf_net_buf_track_tbl[i] = p_node;
+		} else {
+			adf_print(
+				  "Mem alloc failed ! Could not track skb from %s %d of size %zu",
+				  file_name, line_num, size);
+			adf_os_warn(1);
+		}
+	}
+
+done:
+	spin_unlock_irqrestore(&g_adf_net_buf_track_lock[i], irq_flag);
+
+	return;
+}
+
+/**
+ * adf_net_buf_debug_delete_node() - remove skb from debug hash table
+ *
+ * Return: none
+ */
+void adf_net_buf_debug_delete_node(adf_nbuf_t net_buf)
+{
+	uint32_t i;
+	bool found = false;
+	ADF_NBUF_TRACK *p_head;
+	ADF_NBUF_TRACK *p_node;
+	unsigned long irq_flag;
+	ADF_NBUF_TRACK *p_prev;
+
+	i = adf_net_buf_debug_hash(net_buf);
+	spin_lock_irqsave(&g_adf_net_buf_track_lock[i], irq_flag);
+
+	p_head = gp_adf_net_buf_track_tbl[i];
+
+	/* Unallocated SKB */
+	if (!p_head)
+		goto done;
+
+	p_node = p_head;
+	/* Found at head of the table */
+	if (p_head->net_buf == net_buf) {
+		gp_adf_net_buf_track_tbl[i] = p_node->p_next;
+		found = true;
+		goto done;
+	}
+
+	/* Search in collision list */
+	while (p_node) {
+		p_prev = p_node;
+		p_node = p_node->p_next;
+		if ((NULL != p_node) && (p_node->net_buf == net_buf)) {
+			p_prev->p_next = p_node->p_next;
+			found = true;
+			break;
+		}
+	}
+
+done:
+	spin_unlock_irqrestore(&g_adf_net_buf_track_lock[i], irq_flag);
+
+	if (!found) {
+		adf_print("Unallocated buffer ! Double free of net_buf %pK ?",
+			  net_buf);
+		adf_os_warn(1);
+	} else {
+		adf_nbuf_track_free(p_node);
+	}
+
+	return;
+}
+
+/**
+ * adf_net_buf_debug_release_skb() - release skb to avoid memory leak
+ * @net_buf: Network buf holding head segment (single)
+ *
+ * WLAN driver module whose allocated SKB is freed by network stack are
+ * suppose to call this API before returning SKB to network stack such
+ * that the SKB is not reported as memory leak.
+ *
+ * Return: none
+ */
+void adf_net_buf_debug_release_skb(adf_nbuf_t net_buf)
+{
+	adf_nbuf_t ext_list = adf_nbuf_get_ext_list(net_buf);
+
+	while (ext_list) {
+		/*
+		 * Take care to free if it is Jumbo packet connected using
+		 * frag_list
+		 */
+		adf_nbuf_t next;
+
+		next = adf_nbuf_queue_next(ext_list);
+		adf_net_buf_debug_delete_node(ext_list);
+		ext_list = next;
+	}
+	adf_net_buf_debug_delete_node(net_buf);
+}
+#endif /*MEMORY_DEBUG */
+
 /**
  * adf_nbuf_update_radiotap() - Update radiotap header from rx_status
  *
@@ -1169,15 +1715,24 @@ int adf_nbuf_update_radiotap(struct mon_rx_status *rx_status, adf_nbuf_t nbuf,
 	rtap_len += 1;
 
 	/* IEEE80211_RADIOTAP_RATE  u8           500kb/s*/
-	rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
-	rtap_buf[rtap_len] = rx_status->rate;
-	rtap_len += 1;
+	if (!(rx_status->mcs_info.valid || rx_status->vht_info.valid)) {
+		rthdr->it_present |=
+			cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
+		rtap_buf[rtap_len] = rx_status->rate;
+		rtap_len += 1;
+	}
+
+	/* IEEE80211_RADIOTAP_CHANNEL */
 	rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_CHANNEL);
-	/* IEEE80211_RADIOTAP_CHANNEL, Channel frequency in Mhz */
+	/* padding */
+	if (rx_status->mcs_info.valid || rx_status->vht_info.valid) {
+		rtap_buf[rtap_len] = 0;
+		rtap_len += 1;
+	}
+	/* Channel frequency in Mhz */
 	put_unaligned_le16(rx_status->chan, (void *)&rtap_buf[rtap_len]);
 	rtap_len += 2;
 	/* Channel flags. */
-
 	put_unaligned_le16(rx_status->chan_flags, (void *)&rtap_buf[rtap_len]);
 	rtap_len += 2;
 
@@ -1191,20 +1746,178 @@ int adf_nbuf_update_radiotap(struct mon_rx_status *rx_status, adf_nbuf_t nbuf,
 	rtap_buf[rtap_len] = rx_status->ant_signal_db +
 		NORMALIZED_TO_NOISE_FLOOR;
 	rtap_len += 1;
+
+	/* IEEE80211_RADIOTAP_DBM_ANTNOISE */
+	rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
+	rtap_buf[rtap_len] = NORMALIZED_TO_NOISE_FLOOR;
+	rtap_len += 1;
+
+	/* IEEE80211_RADIOTAP_ANTENNA */
 	rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_ANTENNA);
 	rtap_buf[rtap_len] = rx_status->nr_ant;
 	rtap_len += 1;
 
+	/* IEEE80211_RADIOTAP_MCS: u8 known, u8 flags, u8 mcs */
+	if (rx_status->mcs_info.valid) {
+		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
+		/*
+		 * known fields: band width, mcs index, short GI, FEC type,
+		 * STBC streams, ness.
+		 */
+		rtap_buf[rtap_len] = 0x77;
+		rtap_len += 1;
+		/* band width */
+		rtap_buf[rtap_len] = 0;
+		rtap_buf[rtap_len] |= (rx_status->mcs_info.bw & 0x3);
+		/* short GI */
+		rtap_buf[rtap_len] |= ((rx_status->mcs_info.sgi << 2) & 0x4);
+		/* FEC type */
+		rtap_buf[rtap_len] |= ((rx_status->mcs_info.fec << 4) & 0x10);
+		/* STBC streams */
+		rtap_buf[rtap_len] |= ((rx_status->mcs_info.stbc << 5) & 0x60);
+		/* ness */
+		rtap_buf[rtap_len] |= ((rx_status->mcs_info.ness << 7) & 0x80);
+		rtap_len += 1;
+		/* mcs index */
+		rtap_buf[rtap_len] = rx_status->mcs_info.mcs;
+		rtap_len += 1;
+	}
+
+	/* IEEE80211_RADIOTAP_VHT: u16, u8, u8, u8[4], u8, u8, u16 */
+	if (rx_status->vht_info.valid) {
+		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
+		/* padding */
+		rtap_buf[rtap_len] = 0;
+		rtap_len += 1;
+		/*
+		 * known fields: STBC, TXOP_PS_NOT_ALLOWED,
+		 * Short GI NSYM disambiguation, short GI,
+		 * LDPC extra OFDM symbol, Beamformed ,
+		 * bandwidth, gid, Partial AID
+		 */
+		put_unaligned_le16(0x1ff, (void *)&rtap_buf[rtap_len]);
+		rtap_len += 2;
+		/* STBC */
+		rtap_buf[rtap_len] = 0;
+		rtap_buf[rtap_len] |= (rx_status->vht_info.stbc & 0x1);
+		/* TXOP_PS_NOT_ALLOWED */
+		rtap_buf[rtap_len] |=
+			((rx_status->vht_info.txps_forbidden << 1) & 0x2);
+		/* short GI */
+		rtap_buf[rtap_len] |=
+			((rx_status->vht_info.sgi << 2) & 0x4);
+		/* short GI NSYM disambiguation */
+		rtap_buf[rtap_len] |=
+			((rx_status->vht_info.sgi_disambiguation << 3) & 0x8);
+		/* LDPC Extra OFDM symbol */
+		rtap_buf[rtap_len] |=
+			((rx_status->vht_info.ldpc_extra_symbol << 4) & 0x10);
+		/* Beamformed */
+		rtap_buf[rtap_len] |=
+			((rx_status->vht_info.beamformed << 5) & 0x20);
+		rtap_len += 1;
+		/* band width, transform to radiotap format */
+		rtap_buf[rtap_len] =
+			((rx_status->vht_info.bw == 2) ?
+			 4 : rx_status->vht_info.bw) & 0x1f;
+		rtap_len += 1;
+		/* nss */
+		rtap_buf[rtap_len] |= ((1 + rx_status->vht_info.nss) & 0x0f);
+		/* mcs */
+		rtap_buf[rtap_len] |= ((rx_status->vht_info.mcs << 4) & 0xf0);
+		rtap_len += 1;
+		/* only support SG, so set 0 other 3 users */
+		rtap_buf[rtap_len] = 0;
+		rtap_len += 1;
+		rtap_buf[rtap_len] = 0;
+		rtap_len += 1;
+		rtap_buf[rtap_len] = 0;
+		rtap_len += 1;
+		/* LDPC */
+		rtap_buf[rtap_len] = rx_status->vht_info.coding;
+		rtap_len += 1;
+		/* gid */
+		rtap_buf[rtap_len] = rx_status->vht_info.gid;
+		rtap_len += 1;
+		/* pid */
+		put_unaligned_le16((uint16_t)(rx_status->vht_info.paid),
+				   (void *)&rtap_buf[rtap_len]);
+		rtap_len += 2;
+	}
+
 	rthdr->it_len = cpu_to_le16(rtap_len);
 
-	adf_nbuf_pull_head(nbuf, headroom_sz  - rtap_len);
-	adf_os_mem_copy(adf_nbuf_data(nbuf), rthdr, rtap_hdr_len);
-	adf_os_mem_copy(adf_nbuf_data(nbuf) + rtap_hdr_len, rtap_buf +
-			rtap_hdr_len, rtap_len - rtap_hdr_len);
+	if (headroom_sz >= rtap_len) {
+		adf_nbuf_pull_head(nbuf, headroom_sz  - rtap_len);
+		adf_os_mem_copy(adf_nbuf_data(nbuf), rthdr, rtap_len);
+	} else {
+		/* If no headroom, append to tail */
+		uint8_t *rtap_start = adf_nbuf_put_tail(nbuf, rtap_len);
+
+		if (!rtap_start) {
+			adf_print("No enough tail room to save radiotap len: "
+				"%d", rtap_len);
+			return 0;
+		}
+		adf_os_mem_copy(rtap_start, rthdr, rtap_len);
+		adf_nbuf_trim_tail(nbuf, rtap_len);
+	}
+
 	return rtap_len;
 }
 
 /**
+ * adf_nbuf_construct_radiotap() - fill in the info into radiotap buf
+ *
+ * @rtap_buf: pointer to radiotap buffer
+ * @tsf: timestamp of packet
+ * @rssi_comb: rssi of packet
+ *
+ * Return: length of rtap_len updated.
+ */
+uint16_t adf_nbuf_construct_radiotap(
+		uint8_t *rtap_buf,
+		uint32_t tsf,
+		uint32_t rssi_comb)
+{
+	struct ieee80211_radiotap_header *rthdr =
+		(struct ieee80211_radiotap_header *)rtap_buf;
+	uint32_t rtap_hdr_len = sizeof(struct ieee80211_radiotap_header);
+	uint32_t rtap_len = rtap_hdr_len;
+
+	/* IEEE80211_RADIOTAP_TSFT              __le64       microseconds*/
+	rthdr->it_present = cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
+	put_unaligned_le64((uint64_t)tsf,
+			   (void *)&rtap_buf[rtap_len]);
+	rtap_len += 8;
+
+	/* IEEE80211_RADIOTAP_FLAGS u8*/
+/*	rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_FLAGS);
+	rtap_buf[rtap_len] = 0x10;
+	rtap_len += 1; */
+
+	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
+	rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
+#define NORMALIZED_TO_NOISE_FLOOR (-96)
+	/*
+	 * rssi_comb is int dB, need to convert it to dBm.
+	 * normalize value to noise floor of -96 dBm
+	 */
+	rtap_buf[rtap_len] = rssi_comb +
+		NORMALIZED_TO_NOISE_FLOOR;
+	rtap_len += 1;
+
+	/* IEEE80211_RADIOTAP_DBM_ANTNOISE */
+	rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
+	rtap_buf[rtap_len] = NORMALIZED_TO_NOISE_FLOOR;
+	rtap_len += 1;
+
+	rthdr->it_len = cpu_to_le16(rtap_len);
+
+	return rthdr->it_len;
+}
+
+/**
  * __adf_nbuf_validate_skb_cb() - validate skb CB
  *
  * SKB control block size limit is 48 byte, add compile time
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_nbuf.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_nbuf.h
index 964fffa6076..0bf5a009f33 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_nbuf.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_nbuf.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -53,6 +53,8 @@
 #define NBUF_PKT_TRAC_TYPE_DHCP    0x04
 #define NBUF_PKT_TRAC_TYPE_MGMT_ACTION    0x08
 #define NBUF_PKT_TRAC_TYPE_ARP     0x10
+#define NBUF_PKT_TRAC_TYPE_NS      0x20
+#define NBUF_PKT_TRAC_TYPE_NA      0x40
 #define NBUF_PKT_TRAC_MAX_STRING   12
 #define NBUF_PKT_TRAC_PROTO_STRING 4
 #define ADF_NBUF_PKT_ERROR         1
@@ -70,14 +72,25 @@
 #define ADF_NBUF_DEST_MAC_OFFSET        0
 #define ADF_NBUF_SRC_MAC_OFFSET         6
 #define ADF_NBUF_TRAC_IPV4_PROTO_TYPE_OFFSET  23
-#define ADF_NBUF_TRAC_IPV4_DEST_ADDR_OFFSET  30
+#define ADF_NBUF_TRAC_IPV4_DEST_ADDR_OFFSET   30
+#define ADF_NBUF_TRAC_IPV4_SRC_ADDR_OFFSET    26
 #define ADF_NBUF_TRAC_IPV6_PROTO_TYPE_OFFSET  20
+#define ADF_NBUF_TRAC_IPV6_DEST_ADDR_OFFSET   38
+#define ADF_NBUF_TRAC_IPV6_DEST_ADDR          0xFF00
 #define ADF_NBUF_TRAC_ICMP_TYPE         1
 #define ADF_NBUF_TRAC_TCP_TYPE          6
 #define ADF_NBUF_TRAC_UDP_TYPE          17
 #define ADF_NBUF_TRAC_ICMPV6_TYPE       0x3a
 #define ADF_NBUF_TRAC_WAI_ETH_TYPE      0x88b4
 
+#define ADF_NBUF_TRAC_TCP_FLAGS_OFFSET       47
+#define ADF_NBUF_TRAC_TCP_ACK_OFFSET         42
+#define ADF_NBUF_TRAC_TCP_HEADER_LEN_OFFSET  46
+#define ADF_NBUF_TRAC_TCP_ACK_MASK           0x10
+#define ADF_NBUF_TRAC_TCP_SPORT_OFFSET       34
+#define ADF_NBUF_TRAC_TCP_DPORT_OFFSET       36
+
+
 /* EAPOL Related MASK */
 #define EAPOL_PACKET_TYPE_OFFSET        15
 #define EAPOL_KEY_INFO_OFFSET           19
@@ -117,6 +130,8 @@
  * @rate: Rate in terms 500Kbps
  * @ant_signal_db: Rx packet RSSI
  * @nr_ant: Number of Antennas used for streaming
+ * @mcs_info: Parsed ht sig info
+ * @vht_info: Parsed vht sig info
  */
 
 struct mon_rx_status {
@@ -127,6 +142,36 @@ struct mon_rx_status {
 	uint8_t  rate;
 	uint8_t  ant_signal_db;
 	uint8_t  nr_ant;
+	struct mon_rx_mcs_info {
+		uint8_t  valid;
+		uint32_t mcs: 7,
+			 bw: 1,
+			 smoothing: 1,
+			 not_sounding: 1,
+			 aggregation: 1,
+			 stbc: 2,
+			 fec: 1,
+			 sgi: 1,
+			 ness: 2,
+			 reserved: 15;
+	} mcs_info;
+
+	struct mon_rx_vht_info {
+		uint8_t  valid;
+		uint32_t bw: 2,
+			 stbc: 1,
+			 gid: 6,
+			 nss: 3,
+			 paid: 9,
+			 txps_forbidden: 1,
+			 sgi: 1,
+			 sgi_disambiguation: 1,
+			 coding: 1,
+			 ldpc_extra_symbol: 1,
+			 mcs: 4,
+			 beamformed: 1,
+			 reserved: 1;
+	} vht_info;
 };
 
 /* DHCP Related Mask */
@@ -174,16 +219,65 @@ struct mon_rx_status {
 #define ICMPV6_SUBTYPE_OFFSET         54
 #define ICMPV6_REQUEST                0x80
 #define ICMPV6_RESPONSE               0x81
-
+#define ICMPV6_RS                     0x85
+#define ICMPV6_RA                     0x86
+#define ICMPV6_NS                     0x87
+#define ICMPV6_NA                     0x88
 #define ADF_NBUF_IPA_CHECK_MASK       0x80000000
 
+/**
+ * adf_proto_type - protocol type
+ * @ADF_PROTO_TYPE_DHCP - DHCP
+ * @ADF_PROTO_TYPE_EAPOL - EAPOL
+ * @ADF_PROTO_TYPE_ARP - ARP
+ * @ADF_PROTO_TYPE_MGMT - MGMT
+ * @ADF_PROTO_TYPE_EVENT - EVENT
+ */
 enum adf_proto_type {
 	ADF_PROTO_TYPE_DHCP = 0,
 	ADF_PROTO_TYPE_EAPOL,
 	ADF_PROTO_TYPE_ARP,
+	ADF_PROTO_TYPE_MGMT,
+	ADF_PROTO_TYPE_EVENT,
 	ADF_PROTO_TYPE_MAX
 };
 
+/**
+ * adf_proto_subtype - subtype of packet
+ * @ADF_PROTO_EAPOL_M1 - EAPOL 1/4
+ * @ADF_PROTO_EAPOL_M2 - EAPOL 2/4
+ * @ADF_PROTO_EAPOL_M3 - EAPOL 3/4
+ * @ADF_PROTO_EAPOL_M4 - EAPOL 4/4
+ * @ADF_PROTO_DHCP_DISCOVER - discover
+ * @ADF_PROTO_DHCP_REQUEST - request
+ * @ADF_PROTO_DHCP_OFFER - offer
+ * @ADF_PROTO_DHCP_ACK - ACK
+ * @ADF_PROTO_DHCP_NACK - NACK
+ * @ADF_PROTO_DHCP_RELEASE - release
+ * @ADF_PROTO_DHCP_INFORM - inform
+ * @ADF_PROTO_DHCP_DECLINE - decline
+ * @ADF_PROTO_ARP_REQ - arp request
+ * @ADF_PROTO_ARP_RES - arp response
+ * @ADF_PROTO_ICMP_REQ - icmp request
+ * @ADF_PROTO_ICMP_RES - icmp response
+ * @ADF_PROTO_ICMPV6_REQ - icmpv6 request
+ * @ADF_PROTO_ICMPV6_RES - icmpv6 response
+ * @ADF_PROTO_ICMPV6_RS - icmpv6 rs packet
+ * @ADF_PROTO_ICMPV6_RA - icmpv6 ra packet
+ * @ADF_PROTO_ICMPV6_NS - icmpv6 ns packet
+ * @ADF_PROTO_ICMPV6_NA - icmpv6 na packet
+ * @ADF_PROTO_IPV4_UDP - ipv4 udp
+ * @ADF_PROTO_IPV4_TCP - ipv4 tcp
+ * @ADF_PROTO_IPV6_UDP - ipv6 udp
+ * @ADF_PROTO_IPV6_TCP - ipv6 tcp
+ * @ADF_PROTO_MGMT_ASSOC -assoc
+ * @ADF_PROTO_MGMT_DISASSOC - disassoc
+ * @ADF_PROTO_MGMT_AUTH - auth
+ * @ADF_PROTO_MGMT_DEAUTH - deauth
+ * @ADF_ROAM_SYNCH - roam synch indication from fw
+ * @ADF_ROAM_COMPLETE - roam complete cmd to fw
+ * @ADF_ROAM_EVENTID - roam eventid from fw
+ */
 enum adf_proto_subtype {
 	ADF_PROTO_INVALID = 0,
 	ADF_PROTO_EAPOL_M1,
@@ -200,15 +294,25 @@ enum adf_proto_subtype {
 	ADF_PROTO_DHCP_DECLINE,
 	ADF_PROTO_ARP_REQ,
 	ADF_PROTO_ARP_RES,
-	ADF_PROTO_ARP_SUBTYPE,
 	ADF_PROTO_ICMP_REQ,
 	ADF_PROTO_ICMP_RES,
 	ADF_PROTO_ICMPV6_REQ,
 	ADF_PROTO_ICMPV6_RES,
+	ADF_PROTO_ICMPV6_RS,
+	ADF_PROTO_ICMPV6_RA,
+	ADF_PROTO_ICMPV6_NS,
+	ADF_PROTO_ICMPV6_NA,
 	ADF_PROTO_IPV4_UDP,
 	ADF_PROTO_IPV4_TCP,
 	ADF_PROTO_IPV6_UDP,
 	ADF_PROTO_IPV6_TCP,
+	ADF_PROTO_MGMT_ASSOC,
+	ADF_PROTO_MGMT_DISASSOC,
+	ADF_PROTO_MGMT_AUTH,
+	ADF_PROTO_MGMT_DEAUTH,
+	ADF_ROAM_SYNCH,
+	ADF_ROAM_COMPLETE,
+	ADF_ROAM_EVENTID,
 	ADF_PROTO_SUBTYPE_MAX
 };
 
@@ -404,7 +508,49 @@ adf_nbuf_dmamap_info(adf_os_dma_map_t bmap, adf_os_dmamap_info_t *sg)
     __adf_nbuf_dmamap_info(bmap, sg);
 }
 
+#ifdef MEMORY_DEBUG
+void adf_net_buf_debug_init(void);
+void adf_net_buf_debug_exit(void);
+void adf_net_buf_debug_clean(void);
+void adf_net_buf_debug_add_node(adf_nbuf_t net_buf, size_t size,
+			uint8_t *file_name, uint32_t line_num);
+void adf_net_buf_debug_delete_node(adf_nbuf_t net_buf);
+void adf_net_buf_debug_release_skb(adf_nbuf_t net_buf);
+
+/* nbuf allocation routines */
+
+#define adf_nbuf_alloc(d, s, r, a, p)			\
+	adf_nbuf_alloc_debug(d, s, r, a, p, __FILE__, __LINE__)
+static inline adf_nbuf_t
+adf_nbuf_alloc_debug(adf_os_device_t osdev, adf_os_size_t size, int reserve,
+		int align, int prio, uint8_t *file_name,
+		uint32_t line_num)
+{
+	adf_nbuf_t net_buf;
+	net_buf = __adf_nbuf_alloc(osdev, size, reserve, align, prio);
+
+	/* Store SKB in internal ADF tracking table */
+	if (adf_os_likely(net_buf))
+		adf_net_buf_debug_add_node(net_buf, size, file_name, line_num);
+
+	return net_buf;
+}
+
+static inline void adf_nbuf_free(adf_nbuf_t net_buf)
+{
+	/* Remove SKB from internal ADF tracking table */
+	if (adf_os_likely(net_buf))
+		adf_net_buf_debug_delete_node(net_buf);
+
+	__adf_nbuf_free(net_buf);
+}
+
+#else
 
+static inline void adf_net_buf_debug_release_skb(adf_nbuf_t net_buf)
+{
+	return;
+}
 
 /*
  * nbuf allocation rouines
@@ -474,6 +620,8 @@ adf_nbuf_free(adf_nbuf_t buf)
     __adf_nbuf_free(buf);
 }
 
+#endif
+
 /**
  * @brief Free adf_nbuf
  *
@@ -1107,6 +1255,20 @@ adf_nbuf_append_ext_list(adf_nbuf_t head_buf, adf_nbuf_t ext_list,
 }
 
 /**
+ * adf_nbuf_get_ext_list() - Get the link to extended nbuf list.
+ * @head_buf: Network buf holding head segment (single)
+ *
+ * This ext_list is populated when we have Jumbo packet, for example in case of
+ * monitor mode amsdu packet reception, and are stiched using frags_list.
+ *
+ * Return: Network buf list holding linked extensions from head buf.
+ */
+static inline adf_nbuf_t adf_nbuf_get_ext_list(adf_nbuf_t head_buf)
+{
+	return (adf_nbuf_t)__adf_nbuf_get_ext_list(head_buf);
+}
+
+/**
  * @brief Gets the tx checksumming to be performed on this buf
  *
  * @param[in]  buf       buffer
@@ -1307,6 +1469,27 @@ adf_nbuf_set_fwd_flag(adf_nbuf_t buf, uint8_t flag)
 }
 
 /**
+ * adf_nbuf_is_ipa_nbuf() - Check if frame owner is IPA
+ * @skb: Pointer to skb
+ *
+ * Returns: TRUE if the owner is IPA else FALSE
+ *
+ */
+#if (defined(QCA_MDM_DEVICE) && defined(IPA_OFFLOAD))
+static inline bool
+adf_nbuf_is_ipa_nbuf(adf_nbuf_t buf)
+{
+    return (NBUF_OWNER_ID(buf) == IPA_NBUF_OWNER_ID);
+}
+#else
+static inline bool
+adf_nbuf_is_ipa_nbuf(adf_nbuf_t buf)
+{
+    return false;
+}
+#endif /* QCA_MDM_DEVICE && IPA_OFFLOAD*/
+
+/**
  * @brief This function registers protocol trace callback
  *
  * @param[in] adf_nbuf_trace_update_t   callback pointer
@@ -1542,11 +1725,11 @@ adf_nbuf_data_get_ipv6_proto(uint8_t *data)
  *
  * This func. checks whether it is a DHCP packet or not.
  *
- * Return: A_STATUS_OK if it is a DHCP packet
- *         A_STATUS_FAILED if not
+ * Return: TRUE if it is a DHCP packet
+ *         FALSE if not
  */
-static inline a_status_t
-adf_nbuf_is_dhcp_pkt(adf_nbuf_t buf)
+static inline
+bool adf_nbuf_is_dhcp_pkt(adf_nbuf_t buf)
 {
 	return __adf_nbuf_data_is_dhcp_pkt(adf_nbuf_data(buf));
 }
@@ -1557,11 +1740,11 @@ adf_nbuf_is_dhcp_pkt(adf_nbuf_t buf)
  *
  * This func. checks whether it is a DHCP packet or not.
  *
- * Return: A_STATUS_OK if it is a DHCP packet
- *         A_STATUS_FAILED if not
+ * Return: TRUE if it is a DHCP packet
+ *         FALSE if not
  */
-static inline a_status_t
-adf_nbuf_data_is_dhcp_pkt(uint8_t *data)
+static inline
+bool adf_nbuf_data_is_dhcp_pkt(uint8_t *data)
 {
 	return __adf_nbuf_data_is_dhcp_pkt(data);
 }
@@ -1572,11 +1755,11 @@ adf_nbuf_data_is_dhcp_pkt(uint8_t *data)
  *
  * This func. checks whether it is a EAPOL packet or not.
  *
- * Return: A_STATUS_OK if it is a EAPOL packet
- *         A_STATUS_FAILED if not
+ * Return: TRUE if it is a EAPOL packet
+ *         FALSE if not
  */
-static inline a_status_t
-adf_nbuf_is_eapol_pkt(adf_nbuf_t buf)
+static inline
+bool adf_nbuf_is_eapol_pkt(adf_nbuf_t buf)
 {
 	return __adf_nbuf_data_is_eapol_pkt(adf_nbuf_data(buf));
 }
@@ -1587,11 +1770,11 @@ adf_nbuf_is_eapol_pkt(adf_nbuf_t buf)
  *
  * This func. checks whether it is a EAPOL packet or not.
  *
- * Return: A_STATUS_OK if it is a EAPOL packet
- *         A_STATUS_FAILED if not
+ * Return: TRUE if it is a EAPOL packet
+ *         FALSE if not
  */
-static inline a_status_t
-adf_nbuf_data_is_eapol_pkt(uint8_t *data)
+static inline
+bool adf_nbuf_data_is_eapol_pkt(uint8_t *data)
 {
 	return __adf_nbuf_data_is_eapol_pkt(data);
 }
@@ -1671,6 +1854,20 @@ bool adf_nbuf_data_is_ipv4_mcast_pkt(uint8_t *data)
 	return __adf_nbuf_data_is_ipv4_mcast_pkt(data);
 }
 
+/**
+ * adf_nbuf_data_is_ipv6_mcast_pkt() - check if it is IPV6 multicast packet.
+ * @data: Pointer to IPV6 packet data buffer
+ *
+ * This func. checks whether it is a IPV6 multicast packet or not.
+ *
+ * Return: TRUE if it is a IPV6 multicast packet
+ *         FALSE if not
+ */
+static inline
+bool adf_nbuf_data_is_ipv6_mcast_pkt(uint8_t *data)
+{
+	return __adf_nbuf_data_is_ipv6_mcast_pkt(data);
+}
 
 /**
  * adf_nbuf_is_ipv6_pkt() - check if it is IPV6 packet.
@@ -1894,6 +2091,20 @@ int adf_nbuf_update_radiotap(struct mon_rx_status *rx_status, adf_nbuf_t nbuf,
 			     u_int32_t headroom_sz);
 
 /**
+ * adf_nbuf_construct_radiotap() - fill in the info into radiotap buf
+ *
+ * @rtap_buf: pointer to radiotap buffer
+ * @tsf: timestamp of packet
+ * @rssi_comb: rssi of packet
+ *
+ * Return: length of rtap_len updated.
+ */
+uint16_t adf_nbuf_construct_radiotap(
+		uint8_t *rtap_buf,
+		uint32_t tsf,
+		uint32_t rssi_comb);
+
+/**
  * adf_nbuf_update_skb_mark() - update skb->mark.
  * @skb: Pointer to nbuf
  * @mask: the mask to set in skb->mark
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_time.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_time.h
index 0c0c1118973..6c92692a5bf 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_time.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_time.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -117,6 +117,16 @@ adf_os_mdelay(int msecs)
 }
 
 /**
+ * adf_os_msleep() - sleep in milliseconds.
+ * @msecs: milliseconds to sleep
+ */
+static inline void
+adf_os_msleep(int msecs)
+{
+	__adf_os_msleep(msecs);
+}
+
+/**
  * @brief Check if _a is later than _b.
  */
 #define adf_os_time_after(_a, _b)       __adf_os_time_after(_a, _b)
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_timer.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_timer.h
index fdbe31227cf..c509a3d8b06 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_timer.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_timer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011,2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -44,7 +44,10 @@
  * @brief Platform timer object
  */
 typedef __adf_os_timer_t           adf_os_timer_t;
+typedef __adf_os_hrtimer_t         adf_os_hrtimer_t;
+typedef __adf_os_enum_hrtimer_t    adf_os_enum_hrtimer_t;
 
+typedef adf_os_enum_hrtimer_t (*adf_os_hrtimer_func_t) (adf_os_hrtimer_t *);
 
 /**
  * @brief Initialize a timer
@@ -65,6 +68,21 @@ adf_os_timer_init(adf_os_handle_t      hdl,
 }
 
 /**
+ * @brief Initialize a high resolution timer
+ *
+ * @param[in] hdl       OS handle
+ * @param[in] timer     timer object pointer
+ * @param[in] func      timer function
+ */
+static inline void
+adf_os_hrtimer_init(adf_os_handle_t      hdl,
+                  adf_os_hrtimer_t      *timer,
+                  adf_os_hrtimer_func_t  func)
+{
+    __adf_os_hrtimer_init(hdl, timer, (__adf_os_hrtimer_func_t)func);
+}
+
+/**
  * @brief Start a one-shot timer
  *
  * @param[in] timer     timer object pointer
@@ -77,6 +95,18 @@ adf_os_timer_start(adf_os_timer_t *timer, int msec)
 }
 
 /**
+ * @brief Start a high resolution timer
+ *
+ * @param[in] timer     timer object pointer
+ * @param[in] msec      expiration period in nenoseconds
+ */
+static inline void
+adf_os_hrtimer_start(adf_os_hrtimer_t *timer, uint64_t nsec)
+{
+    __adf_os_hrtimer_start(timer, nsec);
+}
+
+/**
  * @brief Modify existing timer to new timeout value
  *
  * @param[in] timer     timer object pointer
@@ -104,6 +134,20 @@ adf_os_timer_cancel(adf_os_timer_t *timer)
 }
 
 /**
+ * @brief Cancel a high resolution timer
+ * The function will return after any running timer completes.
+ *
+ * @param[in] timer     timer object pointer
+ *
+ * @retval    TRUE      timer was cancelled and deactived
+ */
+static inline a_bool_t
+adf_os_hrtimer_cancel(adf_os_hrtimer_t *timer)
+{
+    return __adf_os_hrtimer_cancel(timer);
+}
+
+/**
  * @brief Free a timer
  * The function will return after any running timer completes.
  *
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_types.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_types.h
index 5a67902711e..a1b5ce591c0 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_types.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_os_types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -136,6 +136,9 @@ typedef struct adf_os_sglist{
 
 }adf_os_sglist_t;
 
+#define adf_print(args...) \
+	VOS_TRACE(VOS_MODULE_ID_ADF, VOS_TRACE_LEVEL_ERROR, ## args)
+
 /**
  *  @brief All operations specified below are performed from
  *  the host memory point of view, where a read
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_trace.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_trace.c
index a9a8bf6c2b1..4a7b30aea52 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_trace.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_trace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -43,6 +43,7 @@
 #include "sirDebug.h"
 #include "debug_linux.h"
 #include "adf_os_io.h"
+#include "vos_timer.h"
 
 /* Static and Global variables */
 static spinlock_t l_dp_trace_lock;
@@ -75,23 +76,31 @@ void adf_dp_trace_init(void)
 	g_adf_dp_trace_data.head = INVALID_ADF_DP_TRACE_ADDR;
 	g_adf_dp_trace_data.tail = INVALID_ADF_DP_TRACE_ADDR;
 	g_adf_dp_trace_data.num = 0;
-	g_adf_dp_trace_data.proto_bitmap = NBUF_PKT_TRAC_TYPE_DHCP |
-			NBUF_PKT_TRAC_TYPE_EAPOL;
+	g_adf_dp_trace_data.proto_bitmap = NBUF_PKT_TRAC_TYPE_EAPOL |
+					   NBUF_PKT_TRAC_TYPE_DHCP |
+					   NBUF_PKT_TRAC_TYPE_MGMT_ACTION |
+					   NBUF_PKT_TRAC_TYPE_ARP;
 	g_adf_dp_trace_data.no_of_record = 0;
-	g_adf_dp_trace_data.verbosity    = ADF_DP_TRACE_VERBOSITY_LOW;
+	g_adf_dp_trace_data.verbosity    = ADF_DP_TRACE_VERBOSITY_HIGH;
 	g_adf_dp_trace_data.enable = true;
+	g_adf_dp_trace_data.tx_count = 0;
+	g_adf_dp_trace_data.rx_count = 0;
+	g_adf_dp_trace_data.live_mode = 0;
 
 	for (i = 0; i < ADF_DP_TRACE_MAX; i++)
 		adf_dp_trace_cb_table[i] = adf_dp_display_record;
 
 	adf_dp_trace_cb_table[ADF_DP_TRACE_TXRX_PACKET_PTR_RECORD] =
-	adf_dp_trace_cb_table[ADF_DP_TRACE_TXRX_FAST_PACKET_PTR_RECORD] =
 	adf_dp_trace_cb_table[ADF_DP_TRACE_FREE_PACKET_PTR_RECORD] =
 				adf_dp_display_ptr_record;
 	adf_dp_trace_cb_table[ADF_DP_TRACE_EAPOL_PACKET_RECORD] =
 	adf_dp_trace_cb_table[ADF_DP_TRACE_DHCP_PACKET_RECORD] =
 	adf_dp_trace_cb_table[ADF_DP_TRACE_ARP_PACKET_RECORD] =
 				adf_dp_display_proto_pkt;
+	adf_dp_trace_cb_table[ADF_DP_TRACE_MGMT_PACKET_RECORD] =
+				adf_dp_display_mgmt_pkt;
+	adf_dp_trace_cb_table[ADF_DP_TRACE_EVENT_RECORD] =
+				adf_dp_display_event_record;
 }
 
 /**
@@ -180,6 +189,9 @@ void adf_dp_trace_set_track(adf_nbuf_t nbuf,  enum adf_proto_dir dir)
 	spin_unlock_bh(&l_dp_trace_lock);
 }
 
+#define DPTRACE_PRINT(args...) \
+	VOS_TRACE(VOS_MODULE_ID_ADF, VOS_TRACE_LEVEL_INFO, ## args)
+
 /**
  * dump_hex_trace() - Display the data in buffer
  * @str:     string to print
@@ -190,13 +202,20 @@ void adf_dp_trace_set_track(adf_nbuf_t nbuf,  enum adf_proto_dir dir)
  */
 static void dump_hex_trace(char *str, uint8_t *buf, uint8_t buf_len)
 {
-	uint8_t i;
+	unsigned char linebuf[BUFFER_SIZE];
+	const u8 *ptr = buf;
+	int i, linelen, remaining = buf_len;
 
 	/* Dump the bytes in the last line */
-	adf_os_print("%s: ", str);
-	for (i = 0; i < buf_len; i++)
-		adf_os_print("%02x ", buf[i]);
-	adf_os_print("\n");
+	for (i = 0; i < buf_len; i += ROW_SIZE) {
+		linelen = min(remaining, ROW_SIZE);
+		remaining -= ROW_SIZE;
+
+		hex_dump_to_buffer(ptr + i, linelen, ROW_SIZE, 1,
+				linebuf, sizeof(linebuf), false);
+
+		DPTRACE_PRINT("DPT: %s: %s", str, linebuf);
+	}
 }
 
 /**
@@ -216,14 +235,16 @@ const char *adf_dp_code_to_string(enum ADF_DP_TRACE_ID code)
 		return "DHCP:";
 	case ADF_DP_TRACE_ARP_PACKET_RECORD:
 		return "ARP:";
+	case ADF_DP_TRACE_MGMT_PACKET_RECORD:
+		return "MGMT:";
+	case ADF_DP_TRACE_EVENT_RECORD:
+		return "EVENT:";
 	case ADF_DP_TRACE_HDD_TX_PACKET_PTR_RECORD:
 		return "HDD: TX: PTR:";
 	case ADF_DP_TRACE_HDD_TX_PACKET_RECORD:
 		return "HDD: TX: DATA:";
 	case ADF_DP_TRACE_CE_PACKET_PTR_RECORD:
 		return "CE: TX: PTR:";
-	case ADF_DP_TRACE_CE_FAST_PACKET_PTR_RECORD:
-		return "CE: TX: FAST: PTR:";
 	case ADF_DP_TRACE_FREE_PACKET_PTR_RECORD:
 		return "FREE: TX: PTR:";
 	case ADF_DP_TRACE_RX_HTT_PACKET_PTR_RECORD:
@@ -232,12 +253,12 @@ const char *adf_dp_code_to_string(enum ADF_DP_TRACE_ID code)
 		return "HTT: RX: OF: PTR:";
 	case ADF_DP_TRACE_RX_HDD_PACKET_PTR_RECORD:
 		return "HDD: RX: PTR:";
+	case ADF_DP_TRACE_HDD_RX_PACKET_RECORD:
+		return "HDD: RX: DATA:";
 	case ADF_DP_TRACE_TXRX_QUEUE_PACKET_PTR_RECORD:
 		return "TXRX: TX: Q: PTR:";
 	case ADF_DP_TRACE_TXRX_PACKET_PTR_RECORD:
 		return "TXRX: TX: PTR:";
-	case ADF_DP_TRACE_TXRX_FAST_PACKET_PTR_RECORD:
-		return "TXRX: TX: FAST: PTR:";
 	case ADF_DP_TRACE_HTT_PACKET_PTR_RECORD:
 		return "HTT: TX: PTR:";
 	case ADF_DP_TRACE_HTC_PACKET_PTR_RECORD:
@@ -288,6 +309,10 @@ const char *adf_dp_type_to_str(enum adf_proto_type type)
 		return "EAPOL";
 	case ADF_PROTO_TYPE_ARP:
 		return "ARP";
+	case ADF_PROTO_TYPE_MGMT:
+		return "MGMT";
+	case ADF_PROTO_TYPE_EVENT:
+		return "EVENT";
 	default:
 		return "invalid";
 	}
@@ -330,6 +355,20 @@ const char *adf_dp_subtype_to_str(enum adf_proto_subtype subtype)
 		return "REQUEST";
 	case ADF_PROTO_ARP_RES:
 		return "RESPONSE";
+	case ADF_PROTO_MGMT_ASSOC:
+		return "ASSOC";
+	case ADF_PROTO_MGMT_DISASSOC:
+		return "DISASSOC";
+	case ADF_PROTO_MGMT_AUTH:
+		return "AUTH";
+	case ADF_PROTO_MGMT_DEAUTH:
+		return "DEAUTH";
+	case ADF_ROAM_SYNCH:
+		return "ROAM SYNCH";
+	case ADF_ROAM_COMPLETE:
+		return "ROAM COMPLETE";
+	case ADF_ROAM_EVENTID:
+		return "ROAM EVENTID";
 	default:
 		return "invalid";
 	}
@@ -414,7 +453,8 @@ void adf_dp_add_record(enum ADF_DP_TRACE_ID code,
 		adf_os_mem_copy(rec->data, data, size);
 
 	}
-	rec->time = adf_os_gettimestamp();
+	vos_get_time_of_the_day_in_hr_min_sec_usec(rec->time,
+					sizeof(rec->time));
 	rec->pid = (in_interrupt() ? 0 : current->pid);
 	spin_unlock_bh(&l_dp_trace_lock);
 
@@ -437,7 +477,8 @@ bool adf_log_eapol_pkt(uint8_t session_id, struct sk_buff *skb,
 	enum adf_proto_subtype subtype;
 
 	if ((adf_dp_get_proto_bitmap() & NBUF_PKT_TRAC_TYPE_EAPOL) &&
-		ADF_NBUF_GET_IS_EAPOL(skb)) {
+		((dir == ADF_TX && ADF_NBUF_GET_IS_EAPOL(skb)) ||
+		(dir == ADF_RX && adf_nbuf_is_eapol_pkt(skb)))) {
 
 		subtype = adf_nbuf_get_eapol_subtype(skb);
 		DPTRACE(adf_dp_trace_proto_pkt(ADF_DP_TRACE_EAPOL_PACKET_RECORD,
@@ -449,6 +490,8 @@ bool adf_log_eapol_pkt(uint8_t session_id, struct sk_buff *skb,
 			ADF_NBUF_CB_TX_DP_TRACE(skb) = 1;
 		else if (ADF_RX == dir)
 			ADF_NBUF_CB_RX_DP_TRACE(skb) = 1;
+
+		ADF_NBUF_CB_DP_TRACE_PRINT(skb) = true;
 		return true;
 	}
 	return false;
@@ -468,7 +511,8 @@ bool adf_log_dhcp_pkt(uint8_t session_id, struct sk_buff *skb,
 	enum adf_proto_subtype subtype = ADF_PROTO_INVALID;
 
 	if ((adf_dp_get_proto_bitmap() & NBUF_PKT_TRAC_TYPE_DHCP) &&
-		ADF_NBUF_GET_IS_DHCP(skb)) {
+		((dir == ADF_TX && ADF_NBUF_GET_IS_DHCP(skb)) ||
+		(dir == ADF_RX && adf_nbuf_is_dhcp_pkt(skb)))) {
 
 		subtype = adf_nbuf_get_dhcp_subtype(skb);
 		DPTRACE(adf_dp_trace_proto_pkt(ADF_DP_TRACE_DHCP_PACKET_RECORD,
@@ -481,6 +525,7 @@ bool adf_log_dhcp_pkt(uint8_t session_id, struct sk_buff *skb,
 		else if (ADF_RX == dir)
 			ADF_NBUF_CB_RX_DP_TRACE(skb) = 1;
 
+		ADF_NBUF_CB_DP_TRACE_PRINT(skb) = true;
 		return true;
 	}
 	return false;
@@ -500,7 +545,8 @@ bool adf_log_arp_pkt(uint8_t session_id, struct sk_buff *skb,
 	enum adf_proto_subtype proto_subtype;
 
 	if ((adf_dp_get_proto_bitmap() & NBUF_PKT_TRAC_TYPE_ARP) &&
-	     ADF_NBUF_GET_IS_ARP(skb)) {
+	    ((dir == ADF_TX && ADF_NBUF_GET_IS_ARP(skb)) ||
+	    (dir == ADF_RX && adf_nbuf_is_ipv4_arp_pkt(skb)))){
 
 		proto_subtype = adf_nbuf_get_arp_subtype(skb);
 
@@ -514,6 +560,7 @@ bool adf_log_arp_pkt(uint8_t session_id, struct sk_buff *skb,
 		else if (ADF_RX == dir)
 			ADF_NBUF_CB_RX_DP_TRACE(skb) = 1;
 
+		ADF_NBUF_CB_DP_TRACE_PRINT(skb) = true;
 		return true;
 	}
 	return false;
@@ -557,10 +604,10 @@ void adf_dp_display_proto_pkt(struct adf_dp_trace_record_s *record,
 	struct adf_dp_trace_proto_buf *buf =
 		(struct adf_dp_trace_proto_buf *)record->data;
 
-	adf_os_print("DPT: %04d: %012llu: %s vdev_id %d\n", index,
+	DPTRACE_PRINT("DPT: %04d: %s: %s vdev_id %d\n", index,
 		record->time, adf_dp_code_to_string(record->code),
 		buf->vdev_id);
-	adf_os_print("DPT: SA: " MAC_ADDRESS_STR " %s DA: " MAC_ADDRESS_STR
+	DPTRACE_PRINT("DPT: SA: " MAC_ADDRESS_STR " %s DA: " MAC_ADDRESS_STR
 						" Type %s Subtype %s\n",
 		MAC_ADDR_ARRAY(buf->sa.bytes), adf_dp_dir_to_str(buf->dir),
 		MAC_ADDR_ARRAY(buf->da.bytes), adf_dp_type_to_str(buf->type),
@@ -601,6 +648,68 @@ void adf_dp_trace_proto_pkt(enum ADF_DP_TRACE_ID code, uint8_t vdev_id,
 	adf_dp_add_record(code, (uint8_t *)&buf, buf_size, true);
 }
 
+void adf_dp_display_mgmt_pkt(struct adf_dp_trace_record_s *record,
+			      uint16_t index)
+{
+	struct adf_dp_trace_mgmt_buf *buf =
+		(struct adf_dp_trace_mgmt_buf *)record->data;
+
+	DPTRACE_PRINT("DPT: %04d: %s: %s vdev_id %d", index,
+		record->time, adf_dp_code_to_string(record->code),
+		buf->vdev_id);
+	DPTRACE_PRINT("DPT: Type %s Subtype %s", adf_dp_type_to_str(buf->type),
+		adf_dp_subtype_to_str(buf->subtype));
+}
+
+void adf_dp_trace_mgmt_pkt(enum ADF_DP_TRACE_ID code, uint8_t vdev_id,
+		enum adf_proto_type type, enum adf_proto_subtype subtype)
+{
+	struct adf_dp_trace_mgmt_buf buf;
+	int buf_size = sizeof(struct adf_dp_trace_mgmt_buf);
+
+	if (adf_dp_enable_check(NULL, code, ADF_NA) == false)
+		return;
+
+	if (buf_size > ADF_DP_TRACE_RECORD_SIZE)
+		ADF_BUG(0);
+
+	buf.type = type;
+	buf.subtype = subtype;
+	buf.vdev_id = vdev_id;
+	adf_dp_add_record(code, (uint8_t *)&buf, buf_size, true);
+}
+
+void adf_dp_display_event_record(struct adf_dp_trace_record_s *record,
+			      uint16_t index)
+{
+	struct adf_dp_trace_event_buf *buf =
+		(struct adf_dp_trace_event_buf *)record->data;
+
+	DPTRACE_PRINT("DPT: %04d: %s: %s vdev_id %d", index,
+		record->time, adf_dp_code_to_string(record->code),
+		buf->vdev_id);
+	DPTRACE_PRINT("DPT: Type %s Subtype %s", adf_dp_type_to_str(buf->type),
+		adf_dp_subtype_to_str(buf->subtype));
+}
+
+void adf_dp_trace_record_event(enum ADF_DP_TRACE_ID code, uint8_t vdev_id,
+		enum adf_proto_type type, enum adf_proto_subtype subtype)
+{
+	struct adf_dp_trace_event_buf buf;
+	int buf_size = sizeof(struct adf_dp_trace_event_buf);
+
+	if (adf_dp_enable_check(NULL, code, ADF_NA) == false)
+		return;
+
+	if (buf_size > ADF_DP_TRACE_RECORD_SIZE)
+		ADF_BUG(0);
+
+	buf.type = type;
+	buf.subtype = subtype;
+	buf.vdev_id = vdev_id;
+	adf_dp_add_record(code, (uint8_t *)&buf, buf_size, true);
+}
+
 /**
  * adf_dp_display_ptr_record() - display record
  * @record: dptrace record
@@ -615,11 +724,11 @@ void adf_dp_display_ptr_record(struct adf_dp_trace_record_s *record,
 		(struct adf_dp_trace_ptr_buf *)record->data;
 
 	if (record->code == ADF_DP_TRACE_FREE_PACKET_PTR_RECORD)
-		adf_os_print("%04d: %012llu: %s msdu_id: %d, status: %d\n", index,
+		DPTRACE_PRINT("DPT: %04d: %s: %s msdu_id: %d, status: %d\n", index,
 			record->time, adf_dp_code_to_string(record->code),
 			buf->msdu_id, buf->status);
 	else
-		adf_os_print("%04d: %012llu: %s msdu_id: %d, vdev_id: %d\n", index,
+		DPTRACE_PRINT("DPT: %04d: %s: %s msdu_id: %d, vdev_id: %d\n", index,
 			record->time, adf_dp_code_to_string(record->code),
 			buf->msdu_id, buf->status);
 
@@ -651,7 +760,8 @@ void adf_dp_trace_ptr(adf_nbuf_t nbuf, enum ADF_DP_TRACE_ID code,
 	adf_os_mem_copy(&buf.cookie, data, size);
 	buf.msdu_id = msdu_id;
 	buf.status = status;
-	adf_dp_add_record(code, (uint8_t *)&buf, buf_size, false);
+	adf_dp_add_record(code, (uint8_t *)&buf, buf_size,
+				ADF_NBUF_CB_DP_TRACE_PRINT(nbuf));
 }
 
 /**
@@ -664,22 +774,25 @@ void adf_dp_trace_ptr(adf_nbuf_t nbuf, enum ADF_DP_TRACE_ID code,
 void adf_dp_display_record(struct adf_dp_trace_record_s *pRecord,
 				uint16_t recIndex)
 {
-	adf_os_print("DPT: %04d: %012llu: %s\n", recIndex,
+	uint8_t rsize = pRecord->size;
+	if (rsize > ADF_DP_TRACE_RECORD_SIZE)
+		rsize = ADF_DP_TRACE_RECORD_SIZE;
+
+	DPTRACE_PRINT("DPT: %04d: %s: %s\n", recIndex,
 		pRecord->time, adf_dp_code_to_string(pRecord->code));
 	switch (pRecord->code) {
 	case  ADF_DP_TRACE_HDD_TX_TIMEOUT:
-		VOS_TRACE(VOS_MODULE_ID_ADF, VOS_TRACE_LEVEL_ERROR,
-						"HDD TX Timeout\n");
+		DPTRACE_PRINT("DPT: HDD TX Timeout\n");
 		break;
 	case  ADF_DP_TRACE_HDD_SOFTAP_TX_TIMEOUT:
-		VOS_TRACE(VOS_MODULE_ID_ADF, VOS_TRACE_LEVEL_ERROR,
-						"HDD SoftAP TX Timeout\n");
+		DPTRACE_PRINT("DPT: HDD SoftAP TX Timeout\n");
 		break;
 	case ADF_DP_TRACE_HDD_TX_PACKET_RECORD:
-		dump_hex_trace("DATA", pRecord->data, pRecord->size);
+	case ADF_DP_TRACE_HDD_RX_PACKET_RECORD:
+		dump_hex_trace("DATA", pRecord->data, rsize);
 		break;
 	default:
-		dump_hex_trace("cookie", pRecord->data, pRecord->size);
+		dump_hex_trace("cookie", pRecord->data, rsize);
 	}
 }
 
@@ -699,7 +812,8 @@ void adf_dp_trace(adf_nbuf_t nbuf, enum ADF_DP_TRACE_ID code,
 	if (adf_dp_enable_check(nbuf, code, dir) == false)
 		return;
 
-	adf_dp_add_record(code, data, size, false);
+	adf_dp_add_record(code, data, size,
+			nbuf ? ADF_NBUF_CB_DP_TRACE_PRINT(nbuf) : false);
 }
 
 /**
@@ -717,10 +831,16 @@ void adf_dp_trace_clear_buffer(void)
 	g_adf_dp_trace_data.head = INVALID_ADF_DP_TRACE_ADDR;
 	g_adf_dp_trace_data.tail = INVALID_ADF_DP_TRACE_ADDR;
 	g_adf_dp_trace_data.num = 0;
-	g_adf_dp_trace_data.proto_bitmap = 0;
+	g_adf_dp_trace_data.proto_bitmap = NBUF_PKT_TRAC_TYPE_EAPOL |
+					   NBUF_PKT_TRAC_TYPE_DHCP |
+					   NBUF_PKT_TRAC_TYPE_MGMT_ACTION |
+					   NBUF_PKT_TRAC_TYPE_ARP;
 	g_adf_dp_trace_data.no_of_record = 0;
-	g_adf_dp_trace_data.verbosity	 = ADF_DP_TRACE_VERBOSITY_DEFAULT;
+	g_adf_dp_trace_data.verbosity	 = ADF_DP_TRACE_VERBOSITY_HIGH;
 	g_adf_dp_trace_data.enable = true;
+	g_adf_dp_trace_data.tx_count = 0;
+	g_adf_dp_trace_data.rx_count = 0;
+	g_adf_dp_trace_data.live_mode = 0;
 
 	memset(g_adf_dp_trace_tbl, 0,
 		MAX_ADF_DP_TRACE_RECORDS * sizeof(struct adf_dp_trace_record_s));
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_trace.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_trace.h
index e01cfbc17f7..7d6d19e080b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_trace.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/adf_trace.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -71,34 +71,47 @@ struct adf_mac_addr {
 
 /**
  * enum ADF_DP_TRACE_ID - Generic ID to identify various events in data path
- * @ADF_DP_TRACE_INVALID: Invalid ID
- * @ADF_DP_TRACE_DROP_PACKET_RECORD: Dropped packet stored with this id
- * @ADF_DP_TRACE_HDD_TX_PACKET_PTR_RECORD: nbuf->data ptr of HDD
- * @ADF_DP_TRACE_HDD_TX_PACKET_RECORD: nbuf->data stored with this id
- * @ADF_DP_TRACE_CE_PACKET_PTR_RECORD: nbuf->data ptr of CE
- * @ADF_DP_TRACE_CE_PACKET_RECORD: nbuf->data stored with this id
- * @ADF_DP_TRACE_TXRX_QUEUE_PACKET_PTR_RECORD: nbuf->data ptr of txrx queue
- * @ADF_DP_TRACE_TXRX_PACKET_PTR_RECORD: nbuf->data ptr of txrx
- * @ADF_DP_TRACE_HTT_PACKET_PTR_RECORD: nbuf->data ptr of htt
- * @ADF_DP_TRACE_HTC_PACKET_PTR_RECORD: nbuf->data ptr of htc
- * @ADF_DP_TRACE_HIF_PACKET_PTR_RECORD: nbuf->data ptr of hif
- * @ADF_DP_TRACE_HDD_TX_TIMEOUT: hdd tx timeout event
- * @ADF_DP_TRACE_HDD_SOFTAP_TX_TIMEOUT: hdd tx softap timeout event
- *
+ * @ADF_DP_TRACE_INVALID - invalid
+ * @ADF_DP_TRACE_DROP_PACKET_RECORD - record drop packet
+ * @ADF_DP_TRACE_EAPOL_PACKET_RECORD - record EAPOL packet
+ * @ADF_DP_TRACE_DHCP_PACKET_RECORD - record DHCP packet
+ * @ADF_DP_TRACE_ARP_PACKET_RECORD - record ARP packet
+ * @ADF_DP_TRACE_MGMT_PACKET_RECORD - record MGMT pacekt
+ * @ADF_DP_TRACE_EVENT_RECORD - record events
+ * @ADF_DP_TRACE_DEFAULT_VERBOSITY - below this are part of default verbosity
+ * @ADF_DP_TRACE_HDD_TX_TIMEOUT - HDD tx timeout
+ * @ADF_DP_TRACE_HDD_SOFTAP_TX_TIMEOUT- SOFTAP HDD tx timeout
+ * @ADF_DP_TRACE_HDD_TX_PACKET_PTR_RECORD - HDD layer ptr record
+ * @ADF_DP_TRACE_CE_PACKET_PTR_RECORD - CE layer ptr record
+ * @ADF_DP_TRACE_FREE_PACKET_PTR_RECORD - tx completion ptr record
+ * @ADF_DP_TRACE_RX_HTT_PACKET_PTR_RECORD - HTT RX record
+ * @ADF_DP_TRACE_RX_OFFLOAD_HTT_PACKET_PTR_RECORD- HTT RX offload record
+ * @ADF_DP_TRACE_RX_HDD_PACKET_PTR_RECORD - HDD RX record
+ * @ADF_DP_TRACE_LOW_VERBOSITY - below this are part of low verbosity
+ * @ADF_DP_TRACE_TXRX_QUEUE_PACKET_PTR_RECORD -tx queue ptr record
+ * @ADF_DP_TRACE_TXRX_PACKET_PTR_RECORD - txrx packet ptr record
+ * @ADF_DP_TRACE_HTT_PACKET_PTR_RECORD - htt packet ptr record
+ * @ADF_DP_TRACE_HTC_PACKET_PTR_RECORD - htc packet ptr record
+ * @ADF_DP_TRACE_HIF_PACKET_PTR_RECORD - hif packet ptr record
+ * @ADF_DP_TRACE_RX_TXRX_PACKET_PTR_RECORD - txrx packet ptr record
+ * @ADF_DP_TRACE_MED_VERBOSITY - below this are part of med verbosity
+ * @ADF_DP_TRACE_HDD_TX_PACKET_RECORD - record 32 bytes at HDD
+ * @ADF_DP_TRACE_HDD_RX_PACKET_RECORD - record 32 bytes at HDD
+ * @ADF_DP_TRACE_HIGH_VERBOSITY - below this are part of high verbosity
  */
-
 enum  ADF_DP_TRACE_ID {
 	ADF_DP_TRACE_INVALID = 0,
 	ADF_DP_TRACE_DROP_PACKET_RECORD,
 	ADF_DP_TRACE_EAPOL_PACKET_RECORD,
 	ADF_DP_TRACE_DHCP_PACKET_RECORD,
 	ADF_DP_TRACE_ARP_PACKET_RECORD,
+	ADF_DP_TRACE_MGMT_PACKET_RECORD,
+	ADF_DP_TRACE_EVENT_RECORD,
 	ADF_DP_TRACE_DEFAULT_VERBOSITY,
 	ADF_DP_TRACE_HDD_TX_TIMEOUT,
 	ADF_DP_TRACE_HDD_SOFTAP_TX_TIMEOUT,
 	ADF_DP_TRACE_HDD_TX_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_CE_PACKET_PTR_RECORD,
-	ADF_DP_TRACE_CE_FAST_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_FREE_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_RX_HTT_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_RX_OFFLOAD_HTT_PACKET_PTR_RECORD,
@@ -106,28 +119,50 @@ enum  ADF_DP_TRACE_ID {
 	ADF_DP_TRACE_LOW_VERBOSITY,
 	ADF_DP_TRACE_TXRX_QUEUE_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_TXRX_PACKET_PTR_RECORD,
-	ADF_DP_TRACE_TXRX_FAST_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_HTT_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_HTC_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_HIF_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_RX_TXRX_PACKET_PTR_RECORD,
 	ADF_DP_TRACE_MED_VERBOSITY,
 	ADF_DP_TRACE_HDD_TX_PACKET_RECORD,
+	ADF_DP_TRACE_HDD_RX_PACKET_RECORD,
 	ADF_DP_TRACE_HIGH_VERBOSITY,
 	ADF_DP_TRACE_MAX
 };
 
+/**
+ * adf_proto_dir - direction
+ * @ADF_TX: TX direction
+ * @ADF_RX: RX direction
+ * @ADF_NA: not applicable
+ */
 enum adf_proto_dir {
 	ADF_TX,
-	ADF_RX
+	ADF_RX,
+	ADF_NA
 };
 
+/**
+ * struct adf_dp_trace_ptr_buf - pointer record buffer
+ * @cookie: cookie value
+ * @msdu_id: msdu_id
+ * @status: completion status
+ */
 struct adf_dp_trace_ptr_buf {
 	uint64_t cookie;
 	uint16_t msdu_id;
 	uint16_t status;
 };
 
+/**
+ * struct adf_dp_trace_proto_buf - proto packet buffer
+ * @sa: source address
+ * @da: destination address
+ * @vdev_id : vdev id
+ * @type: packet type
+ * @subtype: packet subtype
+ * @dir: direction
+ */
 struct adf_dp_trace_proto_buf {
 	struct adf_mac_addr sa;
 	struct adf_mac_addr da;
@@ -137,6 +172,29 @@ struct adf_dp_trace_proto_buf {
 	uint8_t dir;
 };
 
+/**
+ * struct adf_dp_trace_mgmt_buf - mgmt packet buffer
+ * @vdev_id : vdev id
+ * @type: packet type
+ * @subtype: packet subtype
+ */
+struct adf_dp_trace_mgmt_buf {
+	uint8_t vdev_id;
+	uint8_t type;
+	uint8_t subtype;
+};
+
+/**
+ * struct adf_dp_trace_event_buf - event buffer
+ * @vdev_id : vdev id
+ * @type: packet type
+ * @subtype: packet subtype
+ */
+struct adf_dp_trace_event_buf {
+	uint8_t vdev_id;
+	uint8_t type;
+	uint8_t subtype;
+};
 
 /**
  * struct adf_dp_trace_record_s - Describes a record in DP trace
@@ -147,7 +205,7 @@ struct adf_dp_trace_proto_buf {
  * @pid : process id which stored the data in this record
  */
 struct adf_dp_trace_record_s {
-	uint64_t time;
+	char time[20];
 	uint8_t code;
 	uint8_t data[ADF_DP_TRACE_RECORD_SIZE];
 	uint8_t size;
@@ -209,6 +267,49 @@ void adf_dp_trace_log_pkt(uint8_t session_id, struct sk_buff *skb,
 void adf_dp_trace_enable_live_mode(void);
 void adf_dp_trace_clear_buffer(void);
 
+/**
+ * adf_dp_trace_mgmt_pkt() - record mgmt packet
+ * @code: dptrace code
+ * @vdev_id: vdev id
+ * @type: proto type
+ * @subtype: proto subtype
+ *
+ * Return: none
+ */
+void adf_dp_trace_mgmt_pkt(enum ADF_DP_TRACE_ID code, uint8_t vdev_id,
+		enum adf_proto_type type, enum adf_proto_subtype subtype);
+
+/**
+ * adf_dp_display_mgmt_pkt() - display proto packet
+ * @record: dptrace record
+ * @index: index
+ *
+ * Return: none
+ */
+void adf_dp_display_mgmt_pkt(struct adf_dp_trace_record_s *record,
+			      uint16_t index);
+
+/**
+ * adf_dp_display_event_record() - display event records
+ * @record: dptrace record
+ * @index: index
+ *
+ * Return: none
+ */
+void adf_dp_display_event_record(struct adf_dp_trace_record_s *record,
+			      uint16_t index);
+
+/**
+ * adf_dp_trace_record_event() - record events
+ * @code: dptrace code
+ * @vdev_id: vdev id
+ * @type: proto type
+ * @subtype: proto subtype
+ *
+ * Return: none
+ */
+void adf_dp_trace_record_event(enum ADF_DP_TRACE_ID code, uint8_t vdev_id,
+		enum adf_proto_type type, enum adf_proto_subtype subtype);
 #else
 static inline void adf_dp_trace_init(void)
 {
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_nbuf_pvt.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_nbuf_pvt.h
index e3f1faf8d6d..949af0c424f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_nbuf_pvt.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_nbuf_pvt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -36,7 +36,11 @@
 #include <linux/netdevice.h>
 #include <linux/dma-mapping.h>
 #include <asm/types.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,2,0))
+#include <linux/scatterlist.h>
+#else
 #include <asm/scatterlist.h>
+#endif
 #include <adf_os_types.h>
 #include <adf_nbuf.h>
 
@@ -65,18 +69,9 @@ typedef void (*__adf_nbuf_callback_fn) (struct sk_buff *skb);
 #define CVG_NBUF_MAX_EXTRA_FRAGS 2
 
 typedef void (*adf_nbuf_trace_update_t)(char *);
-struct nbuf_rx_cb {
-	uint8_t dp_trace:1,
-		    reserved:7;
-	uint8_t packet_trace;
-};
-
-#define ADF_NBUF_CB_RX_DP_TRACE(skb) \
-	(((struct nbuf_rx_cb*)((skb)->cb))->dp_trace)
-
-#define ADF_NBUF_CB_RX_PACKET_TRACE(skb) \
-	(((struct nbuf_rx_cb*)((skb)->cb))->packet_trace)
 
+#pragma pack(push)
+#pragma pack(1)
 struct cvg_nbuf_cb {
     /*
      * Store a pointer to a parent network buffer.
@@ -99,10 +94,10 @@ struct cvg_nbuf_cb {
      * Store info for data path tracing
      */
     struct {
-        uint8_t packet_state: 4;
-        uint8_t packet_track: 2;
-        uint8_t dp_trace: 1;
-        uint8_t dp_trace_reserved: 1;
+        uint8_t packet_state:4;
+        uint8_t packet_track:2;
+        uint8_t dp_trace_tx:1;
+        uint8_t dp_trace_rx:1;
     } trace;
 
     /*
@@ -147,7 +142,6 @@ struct cvg_nbuf_cb {
 #endif /* QCA_MDM_DEVICE */
 #ifdef QCA_PKT_PROTO_TRACE
     unsigned char proto_type;
-    unsigned char vdev_id;
 #endif /* QCA_PKT_PROTO_TRACE */
 #ifdef QOS_FWD_SUPPORT
     unsigned char fwd_flag: 1;
@@ -156,15 +150,17 @@ struct cvg_nbuf_cb {
     unsigned char tx_htt2_frm: 1;
 #endif /* QCA_TX_HTT2_SUPPORT */
     struct {
-        uint8_t is_eapol: 1;
-        uint8_t is_arp: 1;
-        uint8_t is_dhcp: 1;
-        uint8_t is_wapi: 1;
-        uint8_t is_mcast: 1;
-        uint8_t is_bcast: 1;
-        uint8_t reserved: 2;
+        uint8_t is_eapol:1;
+        uint8_t is_arp:1;
+        uint8_t is_dhcp:1;
+        uint8_t is_wapi:1;
+        uint8_t is_mcast:1;
+        uint8_t is_bcast:1;
+        uint8_t reserved:1;
+        uint8_t print:1;
     } packet_type;
 } __packed;
+#pragma pack(pop)
 
 #ifdef QCA_ARP_SPOOFING_WAR
 #define NBUF_CB_PTR(skb) \
@@ -271,7 +267,13 @@ struct cvg_nbuf_cb {
     adf_nbuf_set_state(skb, PACKET_STATE)
 
 #define ADF_NBUF_CB_TX_DP_TRACE(skb) \
-    (((struct cvg_nbuf_cb *)((skb)->cb))->trace.dp_trace)
+    (((struct cvg_nbuf_cb *)((skb)->cb))->trace.dp_trace_tx)
+
+#define ADF_NBUF_CB_DP_TRACE_PRINT(skb) \
+	(((struct cvg_nbuf_cb *)((skb)->cb))->packet_type.print)
+
+#define ADF_NBUF_CB_RX_DP_TRACE(skb) \
+    (((struct cvg_nbuf_cb *)((skb)->cb))->trace.dp_trace_rx)
 
 #define ADF_NBUF_GET_IS_EAPOL(skb) \
     (((struct cvg_nbuf_cb *)((skb)->cb))->packet_type.is_eapol)
@@ -407,6 +409,7 @@ void            __adf_nbuf_dmamap_set_cb(__adf_os_dma_map_t dmap, void *cb, void
 void            __adf_nbuf_reg_trace_cb(adf_nbuf_trace_update_t cb_func_ptr);
 bool            __adf_nbuf_data_is_ipv4_pkt(uint8_t *data);
 bool            __adf_nbuf_data_is_ipv4_mcast_pkt(uint8_t *data);
+bool            __adf_nbuf_data_is_ipv6_mcast_pkt(uint8_t *data);
 bool            __adf_nbuf_data_is_ipv6_pkt(uint8_t *data);
 bool            __adf_nbuf_data_is_icmp_pkt(uint8_t *data);
 bool            __adf_nbuf_data_is_icmpv6_pkt(uint8_t *data);
@@ -414,8 +417,8 @@ bool            __adf_nbuf_data_is_ipv4_udp_pkt(uint8_t *data);
 bool            __adf_nbuf_data_is_ipv4_tcp_pkt(uint8_t *data);
 bool            __adf_nbuf_data_is_ipv6_udp_pkt(uint8_t *data);
 bool            __adf_nbuf_data_is_ipv6_tcp_pkt(uint8_t *data);
-a_status_t      __adf_nbuf_data_is_dhcp_pkt(uint8_t *data);
-a_status_t      __adf_nbuf_data_is_eapol_pkt(uint8_t *data);
+bool            __adf_nbuf_data_is_dhcp_pkt(uint8_t *data);
+bool            __adf_nbuf_data_is_eapol_pkt(uint8_t *data);
 bool            __adf_nbuf_data_is_ipv4_arp_pkt(uint8_t *data);
 enum adf_proto_subtype  __adf_nbuf_data_get_dhcp_subtype(uint8_t *data);
 enum adf_proto_subtype  __adf_nbuf_data_get_eapol_subtype(uint8_t *data);
@@ -1217,6 +1220,21 @@ __adf_nbuf_append_ext_list(
         skb_head->len += skb_head->data_len;
 }
 
+/**
+ * __adf_nbuf_get_ext_list() - Get the link to extended nbuf list.
+ * @head_buf: Network buf holding head segment (single)
+ *
+ * This ext_list is populated when we have Jumbo packet, for example in case of
+ * monitor mode amsdu packet reception, and are stiched using frags_list.
+ *
+ * Return: Network buf list holding linked extensions from head buf.
+ */
+static inline struct sk_buff *
+__adf_nbuf_get_ext_list(struct sk_buff *head_buf)
+{
+	return skb_shinfo(head_buf)->frag_list;
+}
+
 static inline void
 __adf_nbuf_tx_free(struct sk_buff *bufs, int tx_err)
 {
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_defer_pvt.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_defer_pvt.c
index 05f8cebdd87..a47c2d99179 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_defer_pvt.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_defer_pvt.c
@@ -30,7 +30,6 @@
 #include <linux/version.h>
 #include <linux/module.h>
 #include <linux/workqueue.h>
-#include <linux/pci.h>
 
 #include "adf_os_defer_pvt.h"
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_time_pvt.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_time_pvt.h
index d8e07af8961..7eda8c9583f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_time_pvt.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_time_pvt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -103,6 +103,12 @@ __adf_os_mdelay(a_uint32_t msecs)
     mdelay(msecs);
 }
 
+static inline void
+__adf_os_msleep(a_uint32_t msecs)
+{
+	msleep(msecs);
+}
+
 /**
  * @brief Check if _a is later than _b.
  */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_timer_pvt.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_timer_pvt.h
index b57b1b6573d..d12b74a3116 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_timer_pvt.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/adf_os_timer_pvt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2015,2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -34,6 +34,7 @@
 #include <linux/timer.h>
 #include <linux/jiffies.h>
 #include <adf_os_types.h>
+#include <linux/hrtimer.h>
 
 #define ADF_DEFERRABLE_TIMER 0
 #define ADF_NON_DEFERRABLE_TIMER 1
@@ -42,6 +43,16 @@
  * timer data type
  */
 typedef struct timer_list       __adf_os_timer_t;
+typedef struct hrtimer          __adf_os_hrtimer_t;
+
+typedef enum {
+    ADF_OS_HRTIMER_NORESTART = HRTIMER_NORESTART,
+    ADF_OS_HRTIMER_RESTART = HRTIMER_RESTART,
+} __adf_os_enum_hrtimer_t;
+
+typedef enum hrtimer_restart (*__adf_os_hrtimer_func_t) (struct hrtimer *);
+
+
 
 /*
  * ugly - but every other OS takes, sanely, a void*
@@ -70,6 +81,30 @@ __adf_os_timer_init(adf_os_handle_t      hdl,
 }
 
 /*
+ * Initialize a timer
+ */
+static inline a_status_t
+__adf_os_hrtimer_init(adf_os_handle_t      hdl,
+                    struct hrtimer   *timer,
+                    __adf_os_hrtimer_func_t  func)
+{
+    hrtimer_init(timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+    timer->function = func;
+    return A_STATUS_OK;
+}
+
+
+/*
+ * start a timer
+ */
+static inline a_status_t
+__adf_os_hrtimer_start(struct hrtimer *timer, a_uint64_t delay)
+{
+    hrtimer_start(timer, ktime_set(0, delay), HRTIMER_MODE_REL);
+    return A_STATUS_OK;
+}
+
+/*
  * start a timer
  */
 static inline a_status_t
@@ -81,6 +116,7 @@ __adf_os_timer_start(struct timer_list *timer, a_uint32_t delay)
     return A_STATUS_OK;
 }
 
+
 /*
  * modify a timer
  */
@@ -107,6 +143,13 @@ __adf_os_timer_cancel(struct timer_list *timer)
         return 0;
 }
 
+static inline a_bool_t
+__adf_os_hrtimer_cancel(struct hrtimer *timer)
+{
+    hrtimer_cancel(timer);
+    return true;
+}
+
 /*
  * Free a timer
  *
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/qdf_crypto.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/qdf_crypto.c
new file mode 100644
index 00000000000..44088838b85
--- /dev/null
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/linux/qdf_crypto.c
@@ -0,0 +1,339 @@
+/*
+ * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/**
+ * DOC: qdf_crypto.c
+ *
+ * This source file contains linux specific definitions for QDF crypto APIs
+ */
+
+/* Include Files */
+#include "qdf_crypto.h"
+#include "sirDebug.h"
+#include "vos_utils.h"
+#include <linux/export.h>
+#include <crypto/hash.h>
+#include <crypto/aes.h>
+#include <crypto/skcipher.h>
+
+/* Function Definitions and Documentation */
+
+/* Function Definitions and Documentation */
+
+/*
+ * xor: API to calculate xor
+ * @a: first variable
+ * @b: second variable
+ * @len: length of variables
+ */
+static void xor(uint8_t *a, const uint8_t *b, size_t len)
+{
+    unsigned int i;
+
+    for (i = 0; i < len; i++)
+    a[i] ^= b[i];
+}
+
+static struct crypto_shash *tfm;
+
+int alloc_tfm(uint8_t *type)
+{
+    tfm = crypto_alloc_shash(type, 0, CRYPTO_ALG_ASYNC);
+    if (IS_ERR(tfm)) {
+        int error = PTR_ERR(tfm);
+        printk(KERN_ERR "failed to setup profile sha1 hashing: %d\n", error);
+        return error;
+    }
+    return 0;
+}
+
+int qdf_get_hash(uint8_t *type,
+        uint8_t element_cnt, uint8_t *addr[], uint32_t *addr_len,
+        int8_t *hash)
+{
+    int ret = 0,i;
+    struct {
+        struct shash_desc shash;
+        char ctx[crypto_shash_descsize(tfm)];
+    } desc;
+
+    desc.shash.tfm = tfm;
+    desc.shash.flags = 0;
+    ret = crypto_shash_init(&desc.shash);
+    if (ret)
+        goto fail;
+
+    for (i = 0; i < element_cnt ; i++) {
+        crypto_shash_update(&desc.shash,  addr[i], addr_len[i]);
+    }
+
+    ret = crypto_shash_final(&desc.shash, hash);
+    if (ret)
+        goto fail;
+
+    crypto_free_shash(tfm);
+    return 0;
+
+fail:
+   crypto_free_shash(tfm);
+   return ret;
+}
+
+int qdf_get_hmac_hash(uint8_t *type, uint8_t *key,
+        uint32_t keylen,
+        uint8_t element_cnt, uint8_t *addr[], uint32_t *addr_len,
+        int8_t *hash)
+{
+    int ret,i;
+    struct {
+        struct shash_desc shash;
+        char ctx[crypto_shash_descsize(tfm)];
+    } desc;
+
+    desc.shash.tfm = tfm;
+    desc.shash.flags = 0;
+    ret = crypto_shash_setkey(desc.shash.tfm, key, keylen);
+    if (ret)
+        goto fail;
+
+    ret = crypto_shash_init(&desc.shash);
+    if (ret)
+        goto fail;
+
+    for (i = 0; i < element_cnt ; i++) {
+        crypto_shash_update(&desc.shash,  addr[i], addr_len[i]);
+    }
+
+    crypto_shash_final(&desc.shash, hash);
+
+    crypto_free_shash(tfm);
+    return 0;
+
+fail:
+   crypto_free_shash(tfm);
+   return ret;
+}
+
+/* qdf_update_dbl from RFC 5297. Length of d is AES_BLOCK_SIZE (128 bits) */
+void qdf_update_dbl(uint8_t *d)
+{
+    int i;
+    uint8_t msb, msb_prev = 0;
+
+    /* left shift by 1 */
+    for (i = AES_BLOCK_SIZE - 1; i >= 0; i--) {
+        msb = d[i] & 0x80;
+        d[i] = d[i] << 1;
+        d[i] += msb_prev ? 1 : 0;
+        msb_prev = msb;
+    }
+
+    if (msb)
+        d[AES_BLOCK_SIZE - 1] ^= 0x87;
+}
+
+int qdf_get_keyed_hash(const char *alg, const uint8_t *key,
+            unsigned int key_len, const uint8_t *src[],
+            size_t *src_len, size_t num_elements, uint8_t *out)
+{
+    struct crypto_shash *tfm;
+    int ret;
+    size_t i;
+
+    tfm = crypto_alloc_shash(alg, 0, CRYPTO_ALG_ASYNC);
+    if (IS_ERR(tfm)) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+              FL("Failed to allocate transformation for %s: %ld"),
+              alg, PTR_ERR(tfm));
+        return -EINVAL;
+    }
+
+    if (key && key_len) {
+        ret = crypto_shash_setkey(tfm, key, key_len);
+        if (ret) {
+            VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+                  FL("Set key failed for %s, ret:%d"),
+                  alg, -ret);
+            goto error;
+        }
+    }
+
+    do {
+        SHASH_DESC_ON_STACK(desc, tfm);
+        desc->tfm = tfm;
+        desc->flags = crypto_shash_get_flags(tfm);
+
+        ret = crypto_shash_init(desc);
+        if (ret) {
+            VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+                  FL("Failed to init hash for %s, ret:%d"),
+                  alg, -ret);
+            goto error;
+        }
+
+        for (i = 0; i < num_elements; i++) {
+            ret = crypto_shash_update(desc, src[i], src_len[i]);
+            if (ret) {
+                VOS_TRACE(VOS_MODULE_ID_PE,
+                      VOS_TRACE_LEVEL_ERROR,
+                      FL("Failed to update hash for %s, ret:%d"),
+                      alg, -ret);
+                goto error;
+            }
+        }
+
+        ret = crypto_shash_final(desc, out);
+        if (ret)
+            VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+                  FL("Failed to get digest for %s, ret:%d"),
+                  alg, -ret);
+    } while (0);
+
+error:
+    crypto_free_shash(tfm);
+    return ret;
+}
+
+/* AES String to Vector from RFC 5297, 'out' should be of length AES_BLOCK_SIZE
+ */
+int qdf_aes_s2v(const uint8_t *key, unsigned int key_len, const uint8_t *s[],
+           size_t s_len[], size_t num_s, uint8_t *out)
+{
+    const char *alg = "cmac(aes)";
+    uint8_t d[AES_BLOCK_SIZE];
+    uint8_t buf[AES_BLOCK_SIZE] = { 0 };
+    size_t buf_len = AES_BLOCK_SIZE;
+    const uint8_t *a[1];
+    unsigned int i;
+    uint8_t *t = NULL;
+    size_t t_len;
+    int ret;
+
+    if (num_s == 0) {
+        /* V = AES-CMAC(K, <one>) */
+        buf[0] = 0x01;
+        a[0] = buf;
+        ret = qdf_get_keyed_hash(alg, key, key_len, a, &buf_len, 1,
+                     out);
+        return ret;
+    }
+
+    /* D = AES-CMAC(K, <zero>) */
+    a[0] = buf;
+    ret = qdf_get_keyed_hash(alg, key, key_len, a, &buf_len, 1, d);
+    if (ret)
+        goto error;
+
+    for (i = 0; i < num_s - 1; i++) {
+        /* D = qdf_update_dbl(D) xor AES-CMAC(K, Si) */
+        qdf_update_dbl(d);
+        ret = qdf_get_keyed_hash(alg, key, key_len, &s[i], &s_len[i], 1,
+                     buf);
+        if (ret)
+            goto error;
+        xor(d, buf, AES_BLOCK_SIZE);
+    }
+
+    if (s_len[i] >= AES_BLOCK_SIZE) {
+        /* len(Sn) >= 128 */
+        /* T = Sn xorend D */
+        t = vos_mem_malloc(s_len[i]);
+        if (!t)
+            return -EINVAL;
+        vos_mem_copy(t, s[i], s_len[i]);
+        xor(t + s_len[i] - AES_BLOCK_SIZE, d, AES_BLOCK_SIZE);
+        t_len = s_len[i];
+    } else {
+        /* len(Sn) < 128 */
+        /* T = qdf_update_dbl(D) xor pad(Sn) */
+        qdf_update_dbl(d);
+        vos_mem_set(buf, 0, AES_BLOCK_SIZE);
+        vos_mem_copy(buf, s[i], s_len[i]);
+        buf[s_len[i]] = 0x80;
+        xor(d, s[i], AES_BLOCK_SIZE);
+        t = d;
+        t_len = AES_BLOCK_SIZE;
+    }
+
+    /* V = AES-CMAC(K, T) */
+    a[0] = t;
+    ret = qdf_get_keyed_hash(alg, key, key_len, a, &t_len, 1, out);
+
+error:
+    if (t != NULL && t != d)
+        vos_mem_free(t);
+    return ret;
+}
+
+int qdf_aes_ctr(const uint8_t *key, unsigned int key_len, uint8_t *siv,
+        const uint8_t *src, size_t src_len, uint8_t *dest, bool enc)
+{
+    struct crypto_skcipher *tfm;
+    struct skcipher_request *req = NULL;
+    struct scatterlist sg_in, sg_out;
+    int ret;
+
+    if (key_len != 16 && key_len != 24 && key_len != 32) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+              FL("Invalid key length: %u"), key_len);
+        return -EINVAL;
+    }
+
+    tfm = crypto_alloc_skcipher("ctr(aes)", 0, CRYPTO_ALG_ASYNC);
+    if (IS_ERR(tfm)) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+              FL("Failed to alloc transformation for ctr(aes):%ld"),
+              PTR_ERR(tfm));
+        return -EAGAIN;
+    }
+
+    req = skcipher_request_alloc(tfm, GFP_KERNEL);
+    if (!req) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+              FL("Failed to allocate request for ctr(aes)"));
+        crypto_free_skcipher(tfm);
+        return -EAGAIN;
+    }
+
+    ret = crypto_skcipher_setkey(tfm, key, key_len);
+    if (ret) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+              FL("Set key failed for ctr(aes), ret:%d"), -ret);
+        skcipher_request_free(req);
+        crypto_free_skcipher(tfm);
+        return ret;
+    }
+
+    sg_init_one(&sg_in, src, src_len);
+    sg_init_one(&sg_out, dest, src_len);
+    skcipher_request_set_crypt(req, &sg_in, &sg_out, src_len, siv);
+
+    if (enc)
+        ret = crypto_skcipher_encrypt(req);
+    else
+        ret = crypto_skcipher_decrypt(req);
+
+    if (ret) {
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_ERROR,
+              FL("%s failed for ctr(aes), ret:%d"),
+              enc ? "Encryption" : "Decryption", -ret);
+    }
+
+    skcipher_request_free(req);
+    crypto_free_skcipher(tfm);
+    return ret;
+}
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/qdf_crypto.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/qdf_crypto.h
new file mode 100644
index 00000000000..617ccb01de8
--- /dev/null
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/adf/qdf_crypto.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/**
+ * DOC: qdf_crypto.h
+ * This file provides OS abstraction for crypto APIs.
+ */
+
+#if !defined(__QDF_CRYPTO_H)
+#define __QDF_CRYPTO_H
+
+/* Include Files */
+#include "vos_status.h"
+#include <vos_types.h>
+#include <vos_trace.h>
+#include <crypto/hash.h>
+#include <crypto/aes.h>
+#include <crypto/skcipher.h>
+#include <crypto/sha.h>
+
+/* Preprocessor definitions and constants */
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+#define AES_BLOCK_SIZE 16
+#define HMAC_SHA256_CRYPTO_TYPE "hmac(sha256)"
+#define HMAC_SHA386_CRYPTO_TYPE "hmac(sha384)"
+
+#define SHA256_CRYPTO_TYPE "sha256"
+#define SHA386_CRYPTO_TYPE "sha384"
+
+#define SHA256_DIGEST_SIZE 32
+#define SHA384_DIGEST_SIZE 48
+
+#define FIXED_PARAM_OFFSET_ASSOC_REQ 4
+#define FIXED_PARAM_OFFSET_ASSOC_RSP 6
+
+#define QDF_MAC_ADDR_SIZE (6)
+/* Function declarations and documenation */
+
+/**
+ * qdf_get_hash: API to get hash using specific crypto and scatterlist
+ * @type: crypto type
+ * @element_cnt: scatterlist element count
+ * @addr: scatterlist element array
+ * @addr_len: element length array
+ * @hash: new hash
+ *
+ * Return: 0 if success else error code
+ */
+int qdf_get_hash(uint8_t *type, uint8_t element_cnt,
+        uint8_t *addr[], uint32_t *addr_len,
+        int8_t *hash);
+
+/**
+ * qdf_get_hmac_hash: API to get hmac hash using specific crypto and
+ * scatterlist elements.
+ * @type: crypto type
+ * @key: key needs to be used for hmac api
+ * @keylen: length of key
+ * @element_cnt: scatterlist element count
+ * @addr: scatterlist element array
+ * @addr_len: element length array
+ * @hash: new hash
+ *
+ * Return: 0 if success else error code
+ */
+int qdf_get_hmac_hash(uint8_t *type, uint8_t *key,
+        uint32_t keylen, uint8_t element_cnt,
+        uint8_t *addr[], uint32_t *addr_len, int8_t *hash);
+
+/**
+ * qdf_get_keyed_hash: API to get hash using specific crypto and
+ * scatterlist elements.
+ * @type: crypto type
+ * @key: key needs to be used for hmac api
+ * @keylen: length of key
+ * @element_cnt: scatterlist element count
+ * @addr: scatterlist element array
+ * @addr_len: element length array
+ * @hash: new hash
+ *
+ * Return: 0 if success else error code
+ */
+int qdf_get_keyed_hash(const char *alg, const uint8_t *key,
+            unsigned int key_len, const uint8_t *src[],
+            size_t *src_len, size_t num_elements, uint8_t *out);
+/**
+ * qdf_update_dbl: This API does the doubling operation as defined in RFC5297
+ * @d: input for doubling
+ *
+ * Return: None
+ */
+void qdf_update_dbl(uint8_t *d);
+
+/**
+ * qdf_aes_s2v: This API gets vector from AES string as defined in RFC5297
+ * output length will be AES_BLOCK_SIZE.
+ * @key: key used for operation
+ * @key_len: key len
+ * @s: addresses of elements to be used
+ * @s_len: array of element length
+ * @num_s: number of elements
+ * @out: pointer to output vector
+ *
+ * Return: 0 if success else Error number
+ */
+int qdf_aes_s2v(const uint8_t *key, unsigned int key_len, const uint8_t *s[],
+           size_t s_len[], size_t num_s, uint8_t *out);
+
+/**
+ * qdf_aes_ctr: This API defines AES Counter Mode
+ * @key: key used for operation
+ * @key_len: key len
+ * @siv: Initialization vector
+ * @src: input
+ * @src_len: input len
+ * @dest: output
+ * @enc: if encryption needs to be done or decryption
+ *
+ * Return: 0 if success else Error number
+ */
+int qdf_aes_ctr(const uint8_t *key, unsigned int key_len, uint8_t *siv,
+        const uint8_t *src, size_t src_len, uint8_t *dest, bool enc);
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+#endif /* __QDF_CRYPTO_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/dbglog_id.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/dbglog_id.h
index 6922d6f27aa..4de3073a618 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/dbglog_id.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/dbglog_id.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1171,8 +1171,25 @@ extern "C" {
 #define WLAN_HB_DBGID_CHKSUM_ERR                        12
 #define WLAN_HB_DBGID_UDP_TX                            13
 #define WLAN_HB_DBGID_TCP_TX                            14
-#define WLAN_HB_DBGID_DEFINITION_END                    15
-
+/* WLAN DHCP Renew DBGIDs */
+#define WLAN_HB_DBGID_DHCP_RENEW_ALLOC_SESS_FAIL        15
+#define WLAN_HB_DBGID_DHCP_RENEW_CTX_NULL               16
+#define WLAN_HB_DBGID_DHCP_RENEW_CHKSUM_ERR             17
+#define WLAN_HB_DBGID_DHCP_RENEW_BSS_PEER_NULL          18
+#define WLAN_HB_DBGID_DHCP_RENEW_TCP_GET_TXBUF_FAIL     19
+#define WLAN_HB_DBGID_DHCP_RENEW_UDP_SEND_FAIL          20
+/* WLAN OIC Ping DBGIDs */
+#define WLAN_HB_DBGID_OIC_PING_INIT                     21
+#define WLAN_HB_DBGID_OIC_PING_HOST_WAKEUP              22
+#define WLAN_HB_DBGID_OIC_PING_INVALID_PARAM            23
+#define WLAN_HB_DBGID_OIC_PING_WMI_CMD_PARAM            24
+#define WLAN_HB_DBGID_OIC_PING_ALLOC_SESS_FAIL          25
+#define WLAN_HB_DBGID_OIC_PING_WOW_NOT_ENTERED          26
+#define WLAN_HB_DBGID_OIC_PING_TCP_TIMEOUT              27
+#define WLAN_HB_DBGID_OIC_PING_TLS_ERROR                28
+#define WLAN_HB_DBGID_OIC_PING_ENABLE                   29
+
+#define WLAN_HB_DBGID_DEFINITION_END                    30
 /* Thermal Manager DBGIDs*/
 #define THERMAL_MGR_DBGID_DEFINITION_START   0
 #define THERMAL_MGR_NEW_THRESH               1
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/debug_linux.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/debug_linux.h
index 541b8fb9023..6c2f007261d 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/debug_linux.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/debug_linux.h
@@ -51,12 +51,26 @@
     /* compile specific macro to get the function name string */
 #define _A_FUNCNAME_  __func__
 
+#ifdef PANIC_ON_BUG
+
 #define ADF_BUG(_condition) do {                                               \
 	if (!(_condition)) {                                                   \
 		printk(KERN_CRIT "ADF BUG in %s Line %d\n",                    \
 			__func__, __LINE__);                                   \
 		BUG_ON(1);                                                     \
 	}                                                                      \
-} while(0)
+} while (0)
+
+#else
+
+#define ADF_BUG(_condition) do {                                               \
+	if (!(_condition)) {                                                   \
+		printk(KERN_CRIT "ADF BUG in %s Line %d\n",                    \
+			__func__, __LINE__);                                   \
+		WARN_ON(1);                                                    \
+	}                                                                      \
+} while (0)
+
+#endif
 
 #endif /* _DEBUG_LINUX_H_ */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/hif.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/hif.h
index a3c31afe3bd..06a02eebc1b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/hif.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/hif.h
@@ -880,4 +880,12 @@ static inline void hif_request_runtime_pm_resume(void *ol_sc)
 
 A_BOOL HIFIsMailBoxSwapped(HIF_DEVICE *hd);
 
+#ifdef HIF_PCI
+int hif_addr_in_boundary(HIF_DEVICE *hif_device, A_UINT32 offset);
+#else
+static inline int hif_addr_in_boundary(HIF_DEVICE *hif_device, A_UINT32 offset)
+{
+	return 0;
+}
+#endif
 #endif /* _HIF_H_ */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/hif_msg_based.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/hif_msg_based.h
index af339aef124..ae333289373 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/hif_msg_based.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/hif_msg_based.h
@@ -149,9 +149,9 @@ void HIFSetBundleMode(HIF_DEVICE *hif_device, bool enabled, int rx_bundle_cnt);
 #endif
 
 #ifdef HIF_SDIO
-int hif_reset_target(HIF_DEVICE *hif_device);
+int hif_set_target_reset(HIF_DEVICE *hif_device);
 #else
-static inline int hif_reset_target(HIF_DEVICE *hif_device)
+static inline int hif_set_target_reset(HIF_DEVICE *hif_device)
 {
 	return 0;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/htc_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/htc_api.h
index 8fffe5381e5..29127179e7c 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/htc_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/htc_api.h
@@ -391,6 +391,17 @@ A_STATUS    HTCAddReceivePkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket);
 A_STATUS    HTCConnectService(HTC_HANDLE HTCHandle,
                               HTC_SERVICE_CONNECT_REQ  *pReq,
                               HTC_SERVICE_CONNECT_RESP *pResp);
+
+/**
+ * htc_disconnect_service() - Disconnect to an HTC service
+ * @endpoint_id: endpoint id
+ *
+ * Service disconnection must be performed during htt_detach.
+ *
+ * Return: None
+ */
+void htc_disconnect_service(HTC_ENDPOINT_ID endpoint_id);
+
 /*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
   @desc: HTC register log dump
   @function name: HTCDump
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/if_upperproto.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/if_upperproto.h
index 1e869ccf473..00d26990181 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/if_upperproto.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/if_upperproto.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -58,6 +58,10 @@ struct vlan_hdr {
 #define VLAN_VID_MASK   0xfff
 #endif
 
+#ifndef ETHERTYPE_WSMP
+#define ETHERTYPE_WSMP   0x88dc    /* WSMP protocol */
+#endif
+
 #ifndef ETHERTYPE_PAE
 #define ETHERTYPE_PAE    0x888e    /* EAPOL PAE/802.1x */
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/isoc_hw_desc.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/isoc_hw_desc.h
index 5f71e7f52ad..c48dfc6d9e3 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/isoc_hw_desc.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/isoc_hw_desc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -654,7 +654,7 @@ enum {
     ISOC_DPU_FEEDBACK_ZERO_LENGTH,      /* The received fragment had no MPDU data at all. */
     ISOC_DPU_FEEDBACK_BAD_EXTIV,        /* The received AES or TKIP fragment did not have the EXTIV bit set in the IV field of the cryptographic envelope. */
     ISOC_DPU_FEEDBACK_BAD_KID,          /* The KID field extracted from the received fragment did not match that in the DPU descriptor (or the BD for WEP encryption modes). */
-    ISOC_DPU_FEEDBACK_BAD_WEP_SEED,     /* The received TKIP fragment’s computed WEP Seed did not match that in the IV. */
+    ISOC_DPU_FEEDBACK_BAD_WEP_SEED,     /* The received TKIP fragment’s computed WEP Seed did not match that in the IV. */
     ISOC_DPU_FEEDBACK_UNPROTECTED,      /* The received packet was unprotected, but the associated DPU descriptor had encryption enabled. */
     ISOC_DPU_FEEDBACK_PROTECTED,        /* The received packet was protected, but the associated DPU descriptor did not have an encryption mode enabled. */
     ISOC_DPU_FEEDBACK_BAD_REPLAY,       /* The received packet failed replay count checking. */
@@ -1091,7 +1091,7 @@ static inline void
     char *p;
     int i;
 
-    adf_os_print("Tx BD (%p)\n", tx_bd);
+    adf_os_print("Tx BD (%pK)\n", tx_bd);
 
     adf_os_print("structured view:\n");
     adf_os_print("  BD type: %d\n", tx_bd->bd_type);
@@ -1140,7 +1140,7 @@ static inline void
     char *p;
     int i;
 
-    adf_os_print("Rx BD (%p)\n", rx_bd);
+    adf_os_print("Rx BD (%pK)\n", rx_bd);
 
     adf_os_print("structured view:\n");
     adf_os_print("  BD type: %d\n", rx_bd->bd_type);
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_cfg.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_cfg.h
index f6c56234278..494b4d9e595 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_cfg.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_cfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -89,12 +89,22 @@ struct txrx_pdev_cfg_t {
 	u8 rx_fwd_disabled;
 	u8 is_packet_log_enabled;
 	u8 is_full_reorder_offload;
+#ifdef WLAN_FEATURE_TSF_PLUS
+	u8 is_ptp_rx_opt_enabled;
+	a_bool_t is_ptp_enabled;
+#endif
 #ifdef IPA_UC_OFFLOAD
 	struct wlan_ipa_uc_rsc_t ipa_uc_rsc;
 #endif /* IPA_UC_OFFLOAD */
 	uint16_t pkt_bundle_timer_value;
 	uint16_t pkt_bundle_size;
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+	uint8_t  del_ack_enable;
+	uint16_t del_ack_timer_value;
+	uint16_t del_ack_pkt_count;
+#endif
+
 	struct ol_tx_sched_wrr_ac_specs_t ac_specs[OL_TX_NUM_WMM_AC];
 };
 
@@ -476,6 +486,38 @@ void ol_set_cfg_packet_log_enabled(ol_pdev_handle pdev, u_int8_t val);
  */
 u_int8_t ol_cfg_is_packet_log_enabled(ol_pdev_handle pdev);
 
+#ifdef WLAN_FEATURE_TSF_PLUS
+void ol_set_cfg_ptp_rx_opt_enabled(ol_pdev_handle pdev, u_int8_t val);
+u_int8_t ol_cfg_is_ptp_rx_opt_enabled(ol_pdev_handle pdev);
+a_bool_t ol_cfg_is_ptp_enabled(ol_pdev_handle pdev);
+void ol_cfg_update_ptp_params(struct txrx_pdev_cfg_t *cfg_ctx,
+                             struct txrx_pdev_cfg_param_t cfg_param);
+#else
+static inline void
+ol_set_cfg_ptp_rx_opt_enabled(ol_pdev_handle pdev, u_int8_t val)
+{
+}
+
+static inline u_int8_t
+ol_cfg_is_ptp_rx_opt_enabled(ol_pdev_handle pdev)
+{
+	return 0;
+}
+
+static inline a_bool_t
+ol_cfg_is_ptp_enabled(ol_pdev_handle pdev)
+{
+	return 0;
+}
+
+static inline void
+ol_cfg_update_ptp_params(struct txrx_pdev_cfg_t *cfg_ctx,
+                             struct txrx_pdev_cfg_param_t cfg_param)
+{
+	return;
+}
+#endif
+
 #ifdef IPA_UC_OFFLOAD
 /**
  * @brief IPA micro controller data path offload enable or not
@@ -524,6 +566,7 @@ unsigned int ol_cfg_ipa_uc_tx_partition_base(ol_pdev_handle pdev);
 
 #define DEFAULT_BUNDLE_TIMER_VALUE 100
 
+
 #ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
 int ol_cfg_get_bundle_timer_value(ol_pdev_handle pdev);
 int ol_cfg_get_bundle_size(ol_pdev_handle pdev);
@@ -541,6 +584,19 @@ int ol_cfg_get_bundle_size(ol_pdev_handle pdev)
 }
 #endif
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+int ol_cfg_get_del_ack_timer_value(ol_pdev_handle pdev);
+int ol_cfg_get_del_ack_enable_value(ol_pdev_handle pdev);
+int ol_cfg_get_del_ack_count_value(ol_pdev_handle pdev);
+void ol_cfg_update_del_ack_params(struct txrx_pdev_cfg_t *cfg_ctx,
+	struct txrx_pdev_cfg_param_t cfg_param);
+#else
+static inline
+void ol_cfg_update_del_ack_params(struct txrx_pdev_cfg_t *cfg_ctx,
+	struct txrx_pdev_cfg_param_t cfg_param)
+{
+}
+#endif
 
 int ol_cfg_get_wrr_skip_weight(ol_pdev_handle pdev, int ac);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_htt_rx_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_htt_rx_api.h
index b8e98250a4b..8cf7a4548fb 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_htt_rx_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_htt_rx_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2015, 2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -53,6 +53,7 @@
 /*================ constants and types used in the rx API ===================*/
 
 #define HTT_RSSI_INVALID 0x7fff
+#define HTT_NOISE_FLOOR_INVALID 0x7f
 
 /**
  * @brief RX stats header
@@ -74,6 +75,8 @@ PREPACK struct ocb_rx_stats_hdr_t {
     A_INT16 rssi_cmb;
     /* rssi - rssi for chains 0 through 3 (for 20 MHz bandwidth) */
     A_INT16 rssi[4];
+    /* noise_floor - noise floor for chain 0-3, only chain0/1 valid for DSRC */
+    A_INT8 noise_floor[4];
     /* tsf32 - timestamp in TSF units */
     A_UINT32 tsf32;
     /* timestamp_microsec - timestamp in microseconds */
@@ -252,6 +255,10 @@ int16_t
 htt_rx_ind_rssi_dbm_chain(htt_pdev_handle pdev, adf_nbuf_t rx_ind_msg,
                           int8_t chain);
 
+int8_t
+htt_rx_ind_noise_floor_chain(htt_pdev_handle pdev, adf_nbuf_t rx_ind_msg,
+                             int8_t chain);
+
 void
 htt_rx_ind_legacy_rate(htt_pdev_handle pdev, adf_nbuf_t rx_ind_msg,
     uint8_t *legacy_rate, uint8_t *legacy_rate_sel);
@@ -664,6 +671,15 @@ extern int
     adf_nbuf_t *tail_msdu);
 
 /**
+ * @brief Return the maximum number of available msdus currently
+ *
+ * @param pdev - the HTT instance the rx data was received on
+ */
+extern int
+(*htt_rx_offload_msdu_cnt)(
+    htt_pdev_handle pdev);
+
+/**
  * @brief Return a linked list of buffers holding one MSDU
  *  In some systems the buffers are delivered along with offload delivery
  *  indication message itself, while in other systems the buffers are uploaded
@@ -833,8 +849,8 @@ void
 htt_rx_frag_ind_flush_seq_num_range(
     htt_pdev_handle pdev,
     adf_nbuf_t rx_frag_ind_msg,
-    int *seq_num_start,
-    int *seq_num_end);
+    u_int16_t *seq_num_start,
+    u_int16_t *seq_num_end);
 /**
  * @brief Return the HL rx desc size
  * @param pdev - the HTT instance the rx data was received on
@@ -876,4 +892,19 @@ htt_rx_offload_paddr_msdu_pop_ll(
     u_int8_t *fw_desc,
     adf_nbuf_t *head_buf,
     adf_nbuf_t *tail_buf);
+
+/**
+ * @brief parse the htt msg to get necessary info
+ * @param pdev - the HTT instance the rx data was received on
+ * @param rx_ind_msg - the nbuf pointer containing the htt msg content
+ * @param head_buf - reference to the head buffer
+ * @param tail_buf - reference to the tail buffer
+ */
+int
+htt_rx_mac_header_mon_process(
+	htt_pdev_handle pdev,
+	adf_nbuf_t rx_ind_msg,
+	adf_nbuf_t *head_msdu,
+	adf_nbuf_t *tail_msdu);
+
 #endif /* _OL_HTT_RX_API__H_ */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_htt_tx_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_htt_tx_api.h
index 7e208012333..353b1060503 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_htt_tx_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_htt_tx_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -153,7 +153,10 @@ PREPACK struct ocb_tx_ctrl_hdr_t {
                 valid_expire_tsf:     1,
                 /* bit 5: if set, TID is valid */
                 valid_tid:            1,
-                reserved0_15_6:      10; /* bits 15:6 - unused, set to 0x0 */
+                /* bit 6: if set, tx frame with 802.3 ethernet header */
+                valid_eth_mode:       1,
+                /* bits 15:7 - unused, set to 0x0 */
+                reserved0_15_7:       9;
         };
         A_UINT16 all_flags;
     };
@@ -294,7 +297,7 @@ static inline void
 htt_msdu_info_dump(struct htt_msdu_info_t *msdu_info)
 {
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
-        "HTT MSDU info object (%p)\n", msdu_info);
+        "HTT MSDU info object (%pK)\n", msdu_info);
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
         "  ethertype: %#x\n", msdu_info->info.ethertype);
     VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO_LOW,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_if_athvar.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_if_athvar.h
index 753547908e0..03fc4d330b5 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_if_athvar.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_if_athvar.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -148,7 +148,18 @@ struct fw_ramdump {
     A_UINT8 *mem;
 };
 #endif
-
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+#define MAX_FILE_NAME        20
+struct non_qc_platform_pci_fw_files {
+    char image_file[MAX_FILE_NAME];
+    char board_data[MAX_FILE_NAME];
+    char otp_data[MAX_FILE_NAME];
+    char utf_file[MAX_FILE_NAME];
+    char utf_board_data[MAX_FILE_NAME];
+    char epping_file[MAX_FILE_NAME];
+    char evicted_data[MAX_FILE_NAME];
+};
+#endif
 
 struct ol_softc {
     /*
@@ -275,13 +286,14 @@ struct ol_softc {
     u_int32_t               set_ht_vht_ies:1; /* true if vht ies are set on target */
     bool                    scn_cwmenable;    /*CWM enable/disable state*/
     u_int8_t                max_no_of_peers;
-#ifdef HIF_PCI
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+    struct non_qc_platform_pci_fw_files fw_files;
+#elif defined(HIF_PCI)
     struct cnss_fw_files fw_files;
 #elif defined(HIF_SDIO)
     struct ol_fw_files fw_files;
 #endif
-
-#if defined(CONFIG_CNSS) || defined(HIF_SDIO)
+#if defined(CONFIG_CNSS) || defined(HIF_SDIO) || defined(HIF_PCI)
     void *ramdump_base;
     unsigned long ramdump_address;
     unsigned long ramdump_size;
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_api.h
index 8e8f47e5d22..805bb1e7067 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2013, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -125,4 +125,28 @@ void ol_register_packetdump_callback(tp_ol_packetdump_cb ol_tx_packetdump_cb,
 				tp_ol_packetdump_cb ol_rx_packetdump_cb);
 void ol_deregister_packetdump_callback(void);
 
+#ifdef WLAN_FEATURE_TSF_PLUS
+typedef int (*tp_ol_timestamp_cb)(adf_nbuf_t netbuf, uint64_t target_time);
+
+/**
+ * ol_register_timestamp_callback() - set callbacks for timestamp tx msdu.
+ * @ol_tx_timestamp_cb: callback function for time stamp tx msdu
+ *
+ * This function  register timestamp callback, the callback will
+ * be called when tx a msdu
+ *
+ * Return: nothing
+ */
+void ol_register_timestamp_callback(tp_ol_timestamp_cb ol_tx_timestamp_cb);
+
+/**
+ * ol_deregister_timestamp_callback() - reset callbacks for timestamp
+ * tx msdu to NULL.
+ *
+ * This function  reset the timestamp callbacks for tx
+ *
+ * Return: nothing
+ */
+void ol_deregister_timestamp_callback(void);
+#endif
 #endif /* _OL_TXRX_API__H_ */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
index 5113e270d25..31ac0846008 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1007,6 +1007,16 @@ struct txrx_pdev_cfg_param_t {
     uint16_t pkt_bundle_timer_value;
     uint16_t pkt_bundle_size;
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+    uint8_t  del_ack_enable;
+    uint16_t del_ack_timer_value;
+    uint16_t del_ack_pkt_count;
+#endif
+
+    /*  PTP feature enabled\disable status */
+#ifdef WLAN_FEATURE_TSF_PLUS
+    a_bool_t is_ptp_enabled;
+#endif
     struct ol_tx_sched_wrr_ac_specs_t ac_specs[OL_TX_NUM_WMM_AC];
 };
 
@@ -1208,11 +1218,11 @@ static inline void ol_tx_throttle_set_level(struct ol_txrx_pdev_t *pdev,
  * @param pdev - the physics device being throttled
  */
 void ol_tx_throttle_init_period(struct ol_txrx_pdev_t *pdev, int period,
-    u_int8_t *dutycycle_level_2g, u_int8_t *dutycycle_level_5g);
+    u_int8_t *dutycycle_level);
 
 #else
-static inline void ol_tx_throttle_init_period(struct ol_txrx_pdev_t *pdev, int period,
-    u_int8_t *dutycycle_level_2g, u_int8_t *dutycycle_level_5g)
+static inline void ol_tx_throttle_init_period(struct ol_txrx_pdev_t *pdev,
+    int period, u_int8_t *dutycycle_level)
 
 {
     /* no-op */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_dbg.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_dbg.h
index 7309db33dc8..45ef930797f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_dbg.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_dbg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -76,6 +76,13 @@ struct ol_txrx_stats_req {
     } wait;
 };
 
+struct ol_txrx_stats_req_internal {
+    struct ol_txrx_stats_req base;
+    TAILQ_ENTRY(ol_txrx_stats_req_internal) req_list_elem;
+    int serviced; /* state of this request */
+    int offset;
+};
+
 #ifndef TXRX_DEBUG_LEVEL
 #define TXRX_DEBUG_LEVEL 0 /* no debug info */
 #endif
@@ -84,7 +91,7 @@ struct ol_txrx_stats_req {
 
 #define ol_txrx_debug(vdev, debug_specs) 0
 #define ol_txrx_fw_stats_cfg(vdev, type, val) 0
-#define ol_txrx_fw_stats_get(vdev, req) 0
+#define ol_txrx_fw_stats_get(vdev, req, response_expected) 0
 #define ol_txrx_aggr_cfg(vdev, max_subfrms_ampdu, max_subfrms_amsdu) 0
 
 #else /*---------------------------------------------------------------------*/
@@ -101,7 +108,8 @@ void ol_txrx_fw_stats_cfg(
 
 int ol_txrx_fw_stats_get(
     ol_txrx_vdev_handle vdev,
-    struct ol_txrx_stats_req *req);
+    struct ol_txrx_stats_req *req,
+    bool response_expected);
 
 
 int ol_txrx_aggr_cfg(ol_txrx_vdev_handle vdev,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_htt_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_htt_api.h
index 0baafe0f6bd..941a6927633 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_htt_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_htt_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -140,6 +140,11 @@ enum htt_tx_status {
 
     /* peer_del - tx completion for alreay deleted peer used for HL case */
     htt_tx_status_peer_del = HTT_TX_COMPL_IND_STAT_PEER_DEL,
+
+#if defined(CONFIG_HL_SUPPORT)
+    /* failure notify */
+    htt_tx_status_fail_notify = HTT_TX_COMPL_IND_STAT_FAIL_NOTIFY,
+#endif
 };
 
 /**
@@ -162,16 +167,14 @@ enum htt_tx_status {
  * @param num_msdus - how many MSDUs are referenced by the tx completion
  *      message
  * @param status - whether transmission was successful
- * @param tx_msdu_id_iterator - abstract method of finding the IDs for the
- *      individual MSDUs referenced by the tx completion message, via the
- *      htt_tx_compl_desc_id API function
+ * @param msg_word -  the tx completion message
  */
 void
 ol_tx_completion_handler(
     ol_txrx_pdev_handle pdev,
     int num_msdus,
     enum htt_tx_status status,
-    void *tx_msdu_id_iterator);
+    void *msg_word);
 
 void
 ol_tx_credit_completion_handler(ol_txrx_pdev_handle pdev, int credits);
@@ -315,6 +318,18 @@ ol_tx_single_completion_handler(
 void
 ol_tx_target_credit_update(struct ol_txrx_pdev_t *pdev, int credit_delta);
 
+/**
+ * @brief Decrement target credit value
+ * @details
+ *  Function to read the target credit value atomically and decrement
+ *  if valid credit is available.
+ *
+ * @param pdev - the data physical device that sent the tx frames
+ * @param credit - value to be decremented
+ * @return success if decremented, else error
+ */
+int
+ol_tx_target_credit_dec(struct ol_txrx_pdev_t *pdev, int credit);
 
 /**
  * @brief Process an rx indication message sent by the target.
@@ -352,6 +367,44 @@ ol_rx_indication_handler(
     int num_mpdu_ranges);
 
 /**
+ * ol_rx_mon_indication_handler - brief Process an rx indication message
+ * sent by the target in monitor mode (only for HL, LL is in another path).
+ *
+ * The target sends a rx indication message to the host as a
+ * notification that there are new rx frames available for the
+ * host to process.
+ * The HTT host layer locates the rx descriptors and rx frames
+ * associated with the indication, and calls this function to
+ * invoke the rx data processing on the new frames.
+ * (For LL, the rx descriptors and frames are delivered directly
+ * to the host via MAC DMA, while for HL the rx descriptor and
+ * frame for individual frames are combined with the rx indication
+ * message.)
+ * All MPDUs referenced by a rx indication message belong to the
+ * same peer-TID.
+ *
+ * @pdev:            the data physical device that received the frames
+ *                   (registered with HTT as a context pointer during
+ *                   attach time)
+ * @rx_ind_msg:      the network buffer holding the rx indication message
+ *                   (For HL, this netbuf also holds the rx desc and rx
+ *                   payload, but the data SW is agnostic to whether the
+ *                   desc and payload are piggybacked with the rx indication
+ *                   message.)
+ * @peer_id: which peer sent this rx data
+ * @tid:             what (extended) traffic type the rx data is
+ * @num_mpdu_ranges: how many ranges of MPDUs does the message describe.
+ *                   Each MPDU within the range has the same rx status.
+ */
+void
+ol_rx_mon_indication_handler(
+	ol_txrx_pdev_handle pdev,
+	adf_nbuf_t rx_ind_msg,
+	u_int16_t peer_id,
+	u_int8_t tid,
+	int num_mpdu_ranges);
+
+/**
  * @brief Process an rx fragment indication message sent by the target.
  * @details
  *  The target sends a rx fragment indication message to the host as a
@@ -395,7 +448,7 @@ void
 ol_rx_offload_deliver_ind_handler(
     ol_txrx_pdev_handle pdev,
     adf_nbuf_t msg,
-    int msdu_cnt);
+    u_int16_t msdu_cnt);
 
 /**
  * @brief Process a peer map message sent by the target.
@@ -617,8 +670,8 @@ ol_rx_pn_ind_handler(
     ol_txrx_pdev_handle pdev,
     u_int16_t peer_id,
     u_int8_t tid,
-    int seq_num_start,
-    int seq_num_end,
+    u_int16_t seq_num_start,
+    u_int16_t seq_num_end,
     u_int8_t pn_ie_cnt,
     u_int8_t *pn_ie);
 
@@ -730,4 +783,70 @@ u_int32_t ol_tx_get_max_tx_groups_supported(struct ol_txrx_pdev_t *pdev);
 #define OL_TX_GET_MAX_GROUPS(pdev) 0
 #endif
 
+#ifdef MAC_NOTIFICATION_FEATURE
+/**
+ * ol_tx_failure_cb_set() - add TX failure callback
+ * @pdev: PDEV TXRX handle
+ * @tx_failure_cb: TX failure callback
+ */
+void
+ol_tx_failure_cb_set(struct ol_txrx_pdev_t *pdev,
+		     void (*tx_failure_cb)(void *ctx,
+					   unsigned int num_msdu,
+					   unsigned char tid,
+					   unsigned int status));
+
+/**
+ * ol_tx_failure_indication() - indicate TX failure to user layer
+ * @pdev: Pdev TXRX handle
+ * @tid: TID
+ * @msdu_num: number of MSDUs with the same failure status
+ * @status: failure status
+ */
+void
+ol_tx_failure_indication(struct ol_txrx_pdev_t *pdev, uint8_t tid,
+			 uint32_t msdu_num, uint32_t status);
+#else
+/**
+ * ol_tx_failure_cb_set() - add TX failure callback
+ * @pdev: PDEV TXRX handle
+ * @tx_failure_cb: TX failure callback
+ */
+static inline void
+ol_tx_failure_cb_set(ol_txrx_pdev_handle pdev,
+		     void (*tx_failure_cb)(void *ctx,
+					   unsigned int num_msdu,
+					   unsigned char tid,
+					   unsigned int status))
+{
+}
+
+/**
+ * ol_tx_failure_indication() - indicate TX failure to user layer
+ * @pdev: Pdev TXRX handle
+ * @tid: TID
+ * @msdu_num: number of MSDUs with the same failure status
+ * @status: failure status
+ */
+static inline void
+ol_tx_failure_indication(struct ol_txrx_pdev_t *pdev, uint8_t tid,
+			 uint32_t msdu_num, uint32_t status)
+{
+}
+#endif
+
+/**
+ * @brief Process an rx indication message sent by the target.
+ * @details
+ *  The target send a rx indication message containing thw HW descriptor
+ *  info and a list of Mac header. HTT layer parse this message, get
+ *  each Mac header, radiotap header info to fill in monitor nbuf,
+ *  then deliver these nbuf to upper layer.
+ *
+ * @param pdev - the data physical device that received the frames
+ *      (registered with HTT as a context pointer during attach time)
+ * @param rx_ind_msg - the network buffer holding the rx indication message
+ */
+void
+ol_rx_mon_mac_header_handler(ol_txrx_pdev_handle pdev, adf_nbuf_t rx_ind_msg);
 #endif /* _OL_TXRX_HTT_API__H_ */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_osif_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_osif_api.h
index 02dcef13564..b770729305f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_osif_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/ol_txrx_osif_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012, 2014, 2017-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -98,6 +98,12 @@ typedef void (*ol_txrx_rx_fp)(void *osif_dev, adf_nbuf_t msdus);
  */
 typedef void (*ol_txrx_tx_flow_control_fp)(void *osif_dev,
                                            u_int8_t vdev_id, a_bool_t tx_resume);
+/**
+ * @typedef ol_txrx_vir_mon_rx_fp
+ * @brief receive function to hand montior frames from txrx to OS shim
+ * @param msdus - rx monitor frame(s), in a null-terminated list
+ */
+typedef void (*ol_txrx_vir_mon_rx_fp)(adf_nbuf_t msdus);
 
 /**
  * @typedef ol_txrx_rx_fp
@@ -208,6 +214,44 @@ adf_nbuf_t ol_txrx_osif_tso_segment(
     int max_seg_payload_bytes,
     adf_nbuf_t jumbo_tcp_frame);
 
+/**
+ * @brief register the TLSHIM montior callback to OL pdev context
+ * @details
+ * For the virtual monitor interface which real VDEV is not created case,
+ * just store the TLSHIM RX montior callback into TXRX_PDEV context.
+ * later when receive RX montior packets from HTT layer, call the callback
+ * stored in TXRX_PDEV to deliver packets to TLSHIM.
+ *
+ * @param txrx_pdev - TXRX physical device context
+ * @param cbk - TLSHIM montior callback to be registered
+ */
+void
+ol_txrx_osif_pdev_mon_register_cbk(
+	ol_txrx_pdev_handle txrx_pdev,
+	ol_txrx_vir_mon_rx_fp cbk);
+
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+void
+ol_tx_vdev_set_driver_del_ack_enable(uint8_t vdev_id, unsigned long tx_packets,
+			uint32_t time_in_ms, uint32_t high_th, uint32_t low_th);
+void
+ol_tx_pdev_reset_driver_del_ack(void *pdev);
+
+#else
+static inline void
+ol_tx_vdev_set_driver_del_ack_enable(uint8_t vdev_id, unsigned long tx_packets,
+			uint32_t time_in_ms, uint32_t high_th, uint32_t low_th)
+{
+	return;
+}
+static inline void
+ol_tx_pdev_reset_driver_del_ack(void *pdev)
+{
+	return;
+}
+
+#endif
+
 #ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
 void
 ol_tx_vdev_set_bundle_require(uint8_t vdev_id, unsigned long tx_packets,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/osdep_adf.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/osdep_adf.h
index 9d7f0cf2d41..4e2ff99eb51 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/osdep_adf.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/osdep_adf.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -290,7 +290,7 @@ do { \
 do { \
 if (!spin_is_locked(x)) { \
 WARN_ON(1); \
-printk(KERN_EMERG " %s:%d unlock addr=%p, %s \n", __func__, __LINE__, x, \
+printk(KERN_EMERG " %s:%d unlock addr=%pK, %s \n", __func__, __LINE__, x, \
 !spin_is_locked(x)? "Not locked":""); \
 } \
 spin_unlock_bh(x);\
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wal_rx_desc.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wal_rx_desc.h
index 82ad0bf92b1..168f35ca362 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wal_rx_desc.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wal_rx_desc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2012, 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2012, 2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -89,6 +89,9 @@ struct fw_rx_desc_base {
     }u;
 };
 
+#define FW_MSDU_INFO_FIRST_WAKEUP_M 0x40
+#define FW_MSDU_INFO_FIRST_WAKEUP_S 6
+
 #define FW_RX_DESC_DISCARD_M 0x1
 #define FW_RX_DESC_DISCARD_S 0
 #define FW_RX_DESC_FORWARD_M 0x2
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wdi_in.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wdi_in.h
index 9745f46ef32..7627b0a20e6 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wdi_in.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wdi_in.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1046,7 +1046,7 @@ struct ol_txrx_stats_req {
 
 #define wdi_in_debug(vdev, debug_specs) 0
 #define wdi_in_fw_stats_cfg(vdev, type, val) 0
-#define wdi_in_fw_stats_get(vdev, req) 0
+#define wdi_in_fw_stats_get(vdev, req, response_expected) 0
 #define wdi_in_aggr_cfg(vdev, max_subfrms_ampdu, max_subfrms_amsdu) 0
 
 #else /*---------------------------------------------------------------------*/
@@ -1060,7 +1060,8 @@ void wdi_in_fw_stats_cfg(
 
 int wdi_in_fw_stats_get(
     ol_txrx_vdev_handle vdev,
-    struct ol_txrx_stats_req *req);
+    struct ol_txrx_stats_req *req,
+    bool response_expected);
 
 int wdi_in_aggr_cfg(ol_txrx_vdev_handle vdev,
                      int max_subfrms_ampdu,
@@ -1274,6 +1275,7 @@ ol_tx_queue_log_display(ol_txrx_pdev_handle pdev);
 #define wdi_in_event_unsub wdi_event_unsub
 #define wdi_in_set_cfg_rx_fwd_disabled ol_set_cfg_rx_fwd_disabled
 #define wdi_in_set_cfg_pakcet_log_enabled ol_set_cfg_packet_log_enabled
+#define wdi_in_set_cfg_ptp_rx_opt_enabled ol_set_cfg_ptp_rx_opt_enabled
 
 #endif /* WDI_API_AS_FUNCS / MACROS */
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_defs.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_defs.h
index 6a24728fa23..bb88fa24813 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_defs.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_defs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2004-2010, 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2004-2010, 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -143,6 +143,10 @@ typedef enum {
     WLAN_11AG_CAPABILITY  = 3,
 }WLAN_CAPABILITY;
 
+#define SUB20_MODE_NONE (0x00)
+#define SUB20_MODE_5MHZ (0x01)
+#define SUB20_MODE_10MHZ (0x02)
+
 #if defined(CONFIG_AR900B_SUPPORT) || defined(AR900B)
 #define A_RATEMASK A_UINT64
 #else
@@ -318,8 +322,20 @@ typedef struct {
         (_dst).flags           |= (_f);                                 \
     } while (0)
 
-/* NOTE: NUM_DYN_BW and NUM_SCHED_ENTRIES cannot be changed without breaking WMI Compatibility */
+/*
+ * NOTE: NUM_SCHED_ENTRIES is not used in the host/target interface, but for
+ * historical reasons has been defined in the host/target interface files.
+ * The NUM_SCHED_ENTRIES definition is being moved into a target-only
+ * header file for newer (Lithium) targets, but is being left here for
+ * non-Lithium cases, to avoid having to rework legacy targets to move
+ * the NUM_SCHED_ENTRIES definition into a target-only header file.
+ * Moving the NUM_SCHED_ENTRIES definition into a non-Lithium conditional
+ * block should have no impact on the host, since the host does not use
+ * NUM_SCHED_ENTRIES.
+ */
 #define NUM_SCHED_ENTRIES           2
+
+/* NOTE: NUM_DYN_BW cannot be changed without breaking WMI Compatibility */
 #define NUM_DYN_BW_MAX              4
 
 /* Some products only use 20/40/80; some use 20/40/80/160 */
@@ -845,4 +861,24 @@ struct wlan_dbg_tidq_stats{
     struct wlan_dbg_txq_stats txq_st;
 };
 
+typedef enum {
+    WLAN_DBG_DATA_STALL_NONE = 0,
+    WLAN_DBG_DATA_STALL_VDEV_PAUSE,         /* 1 */
+    WLAN_DBG_DATA_STALL_HWSCHED_CMD_FILTER, /* 2 */
+    WLAN_DBG_DATA_STALL_HWSCHED_CMD_FLUSH,  /* 3 */
+    WLAN_DBG_DATA_STALL_RX_REFILL_FAILED,   /* 4 */
+    WLAN_DBG_DATA_STALL_RX_FCS_LEN_ERROR,   /* 5 */
+    WLAN_DBG_DATA_STALL_MAC_WDOG_ERRORS,    /* 6 */ /* Mac watch dog */
+    WLAN_DBG_DATA_STALL_PHY_BB_WDOG_ERROR,  /* 7 */ /* PHY watch dog */
+    WLAN_DBG_DATA_STALL_MAX,
+} wlan_dbg_data_stall_type_e;
+
+typedef enum {
+    WLAN_DBG_DATA_STALL_RECOVERY_NONE = 0,
+    WLAN_DBG_DATA_STALL_RECOVERY_CONNECT_DISCONNECT,
+    WLAN_DBG_DATA_STALL_RECOVERY_CONNECT_MAC_PHY_RESET,
+    WLAN_DBG_DATA_STALL_RECOVERY_CONNECT_PDR,
+    WLAN_DBG_DATA_STALL_RECOVERY_CONNECT_SSR,
+} wlan_dbg_data_stall_recovery_type_e;
+
 #endif /* __WLANDEFS_H__ */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_module_ids.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_module_ids.h
index da99e3c9f9c..62dee693ac8 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_module_ids.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_module_ids.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -101,6 +101,13 @@ typedef enum {
   WLAN_MODULE_P2P_LISTEN_OFFLOAD,       /* 0x42 */
   WLAN_MODULE_HALPHY,                   /* 0x43 */
   WAL_MODULE_ENQ,                       /* 0x44 */
+  WLAN_MODULE_GNSS,                     /* 0x45 */
+  WLAN_MODULE_WAL_MEM,                  /* 0x46 */
+  WLAN_MODULE_SCHED_ALGO,               /* 0x47 */
+  WLAN_MODULE_TX,                       /* 0x48 */
+  WLAN_MODULE_RX,                       /* 0x49 */
+  WLAN_MODULE_WLM,                      /* 0x4a */
+  WLAN_MODULE_RU_ALLOCATOR,             /* 0x4b */
 
   WLAN_MODULE_ID_MAX,
   WLAN_MODULE_ID_INVALID = WLAN_MODULE_ID_MAX,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_tgt_def_config.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
index f34ec615ad9..68be053b967 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2016, 2018 The Linux Foundation.
+ * All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -35,9 +36,12 @@
 /*
  * default limit of 8 VAPs per device.
  */
+#ifdef WLAN_4SAP_CONCURRENCY
+#define CFG_TGT_NUM_VDEV                4
+#else
 /* Rome PRD support 3 vdevs */
 #define CFG_TGT_NUM_VDEV                3
-
+#endif
 /*
  * We would need 1 AST entry per peer. Scale it by a factor of 2 to minimize hash collisions.
  * TODO: This scaling factor would be taken care inside the WAL in the future.
@@ -178,7 +182,7 @@
 /*
  * total number of descriptors to use in the target
  */
-#define CFG_TGT_NUM_MSDU_DESC    (1024 + 32)
+#define CFG_TGT_NUM_MSDU_DESC    (2048 + 32)
 
 /*
  * Maximum number of frag table entries
@@ -188,7 +192,11 @@
 /*
  * Maximum number of VDEV that beacon tx offload will support
  */
+#ifdef WLAN_4SAP_CONCURRENCY
+#define CFG_TGT_DEFAULT_BEACON_TX_OFFLOAD_MAX_VDEV 4
+#else
 #define CFG_TGT_DEFAULT_BEACON_TX_OFFLOAD_MAX_VDEV 2
+#endif
 
 /*
  * number of vdevs that can support tdls
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_tgt_def_config_hl.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_tgt_def_config_hl.h
index 620dbbd0be5..168926f9820 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_tgt_def_config_hl.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wlan_tgt_def_config_hl.h
@@ -37,8 +37,12 @@
 /*
  * default limit of VAPs per device.
  */
+#ifdef WLAN_4SAP_CONCURRENCY
+#define CFG_TGT_NUM_VDEV                4
+#else
 #define CFG_TGT_NUM_VDEV                3
 #endif
+#endif
 /*
  * We would need 1 AST entry per peer. Scale it by a factor of 2 to minimize
  * hash collisions.
@@ -63,7 +67,11 @@
  * probably always be appropriate; it is probably not necessary to
  * determine this value dynamically.
  */
+#ifdef WLAN_4SAP_CONCURRENCY
+#define CFG_TGT_AST_SKID_LIMIT          8
+#else
 #define CFG_TGT_AST_SKID_LIMIT          6
+#endif
 /*
  * total number of peers per device.
  * currently set to 8 to bring up IP3.9 for memory size problem
@@ -243,7 +251,11 @@
  * Maximum number of VDEV that beacon tx offload will support
  */
 #ifdef HIF_SDIO
+#ifdef WLAN_4SAP_CONCURRENCY
+#define CFG_TGT_DEFAULT_BEACON_TX_OFFLOAD_MAX_VDEV 4
+#else
 #define CFG_TGT_DEFAULT_BEACON_TX_OFFLOAD_MAX_VDEV 2
+#endif
 #else
 #define CFG_TGT_DEFAULT_BEACON_TX_OFFLOAD_MAX_VDEV 1
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wma_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wma_api.h
index 0d1c12436a9..dc4b95bc2f7 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wma_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wma_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -79,6 +79,7 @@ typedef enum {
     GEN_PARAM_MODULATED_DTIM,
     GEN_PARAM_CAPTURE_TSF,
     GEN_PARAM_RESET_TSF_GPIO,
+    GEN_PDEV_MONITOR_MODE,
 } GEN_PARAM;
 
 #define VDEV_CMD 1
@@ -136,9 +137,7 @@ int wma_runtime_suspend_req(WMA_HANDLE handle);
 int wma_runtime_resume_req(WMA_HANDLE handle);
 #endif
 
-#ifdef FEATURE_WLAN_D0WOW
 int wma_get_client_count(WMA_HANDLE handle);
-#endif
 int wma_set_peer_param(void *wma_ctx, u_int8_t *peer_addr, u_int32_t param_id,
 			u_int32_t param_value, u_int32_t vdev_id);
 #ifdef NOT_YET
@@ -178,4 +177,8 @@ extern int wma_scpc_event_handler(void *handle, u_int8_t *event, u_int32_t len);
 VOS_STATUS wma_set_tx_power_scale(uint8_t vdev_id, int value);
 VOS_STATUS wma_set_tx_power_scale_decr_db(uint8_t vdev_id, int value);
 
+void wma_tx_failure_cb(void *ctx, uint32_t num_msdu,
+		       uint8_t tid, uint32_t status);
+
+VOS_STATUS wma_set_ac_txq_optimize(void *wda_handle, uint8_t *value);
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wma_dfs_interface.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wma_dfs_interface.h
index 3aad4665b0d..66161db41b8 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wma_dfs_interface.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wma_dfs_interface.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -202,6 +202,7 @@ typedef struct ieee80211com
     int (*ic_dfs_control)(struct ieee80211com *ic,
                           u_int id, void *indata, u_int32_t insize,
                           void *outdata, u_int32_t *outsize);
+    void (*ic_update_dfs_cac_block_tx)(bool cac_block_tx);
     HAL_DFS_DOMAIN current_dfs_regdomain;
     u_int8_t vdev_id;
     u_int8_t last_radar_found_chan;
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi.h
index 7d31ff203b2..13c2d8f5fd5 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2004-2010 2013, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2004-2010 2013, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -154,6 +154,7 @@ typedef enum {
     PAIRWISE_USAGE      = 0x00,
     GROUP_USAGE         = 0x01,
     TX_USAGE            = 0x02,     /* default Tx Key - Static WEP only */
+    PMK_USAGE           = 0x04,     /* PMK cache */
 } KEY_USAGE;
 
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_services.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_services.h
index 89c368b1ff7..fed86aac5de 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_services.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_services.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -113,7 +113,13 @@ typedef enum {
     WMI_SERVICE_BATCH_SCAN = 44,          /*Service to support batch scan*/
     WMI_SERVICE_QPOWER = 45,              /* QPower service */
     WMI_SERVICE_PLMREQ = 46,
-    WMI_SERVICE_THERMAL_MGMT = 47,        /* thermal throttling support */
+    WMI_SERVICE_THERMAL_MGMT = 47,        /* thermal throttling support,
+                                           * compared with
+                                           * WMI_SERVICE_THERM_THROT,
+                                           * this service only reports
+                                           * current temperature to host,
+                                           * and host will do the thermal
+                                           * throttling. */
     WMI_SERVICE_RMC = 48,                 /* RMC support */
     /* multi-hop forwarding offload */
     WMI_SERVICE_MHF_OFFLOAD = 49,
@@ -272,9 +278,21 @@ typedef enum {
      * support bigger MSDU ID partition
      */
     WMI_SERVICE_TX_MSDU_ID_NEW_PARTITION_SUPPORT = 112,
-
-
-    /***** ADD NEW SERVICES HERE UNTIL ALL VALUES UP TO 128 ARE USED *****/
+    WMI_SERVICE_DFS_PHYERR_OFFLOAD=113,
+    WMI_SERVICE_RCPI_SUPPORT=114,
+    WMI_SERVICE_FW_MEM_DUMP_SUPPORT = 115, /* Support FW Memory dump */
+    WMI_SERVICE_PEER_STATS_INFO = 116, /* support per peer stats info */
+    WMI_SERVICE_REGULATORY_DB = 117, /* support regulatory database in FW */
+    WMI_SERVICE_11D_OFFLOAD = 118, /* support 11D scan offload in FW */
+    WMI_SERVICE_HW_DATA_FILTERING = 119,
+    WMI_SERVICE_MULTIPLE_VDEV_RESTART=120, /* Support for single command for multiple vdev restart */
+    WMI_SERVICE_PKT_ROUTING=121, /* Support for routing specific data packets to selected destination rings */
+    WMI_SERVICE_CHECK_CAL_VERSION=122, /* Support cal version check */
+    WMI_SERVICE_OFFCHAN_TX_WMI=123, /* Support offchan data/mgmt tx over wmi */
+    WMI_SERVICE_8SS_TX_BFEE = 124, /* support for 8Ant Bfee */
+    WMI_SERVICE_EXTENDED_NSS_SUPPORT=125, /* Extend NSS support for 80Mhz and 160Mhz */
+    WMI_SERVICE_ACK_TIMEOUT=126, /* Support TX ack timeout configurations */
+    WMI_SERVICE_PDEV_BSS_CHANNEL_INFO_64 = 127, /* BSS channel info (freq, noise floor, rx clear, cycles 64-bit counters) event support */
 
     WMI_MAX_SERVICE = 128, /* max service */
 
@@ -289,8 +307,33 @@ typedef enum {
      * WMI_SERVICE_READY_EVENT message.
      */
 
-    /*PUT 1ST EXT SERVICE HERE:*//*WMI_SERVICE_xxxxxxxx=128,*/
-    /*PUT 2ND EXT SERVICE HERE:*//*WMI_SERVICE_yyyyyyyy=129,*/
+    WMI_SERVICE_CHAN_LOAD_INFO=128, /* The values in WMI_CHAN_INFO_EVENTID is the difference in cycle counters */
+    WMI_SERVICE_TX_PPDU_INFO_STATS_SUPPORT=129, /* support to report tx ppdu info stats via htt events */
+    WMI_SERVICE_VDEV_LIMIT_OFFCHAN_SUPPORT=130, /* support to report the offchannel duration limiting capability on connected interface */
+    WMI_SERVICE_FILS_SUPPORT=131, /* support for FILS */
+    WMI_SERVICE_WLAN_OIC_PING_OFFLOAD=132, /* Support for wlan OIC ping service */
+    WMI_SERVICE_WLAN_DHCP_RENEW=133, /* Support for wlan DHCP Renew service */
+    WMI_SERVICE_MAWC_SUPPORT = 134, /* Support for MAWC service */
+    WMI_SERVICE_VDEV_LATENCY_CONFIG=135, /* support for vdev latency config */
+    WMI_SERVICE_PDEV_UPDATE_CTLTABLE_SUPPORT=136, /* support for pdev update ctl table */
+    WMI_SERVICE_PKTLOG_SUPPORT_OVER_HTT=137, /* upload pktlog data over HTT communication channel */
+    WMI_SERVICE_VDEV_MULTI_GROUP_KEY_SUPPORT=138, /* Support for vdev level multi group key */
+    WMI_SERVICE_SCAN_PHYMODE_SUPPORT=139, /* Support for phymode also with channel in offchan WMI_START_SCAN_CMDID */
+    WMI_SERVICE_THERM_THROT = 140, /* Support thermal cfg and indication on AP.
+                                    * Compared with WMI_SERVICE_THERMAL_MGMT,
+                                    * this service is to allow thermal tool to
+                                    * configure thermal throttling threshold
+                                    * for different levels and pass down duty
+                                    * cycle value. FW will also report thermal
+                                    * throttling status to host through this
+                                    * service. */
+    WMI_SERVICE_BCN_OFFLOAD_START_STOP_SUPPORT=141, /* support dynamically enabling / disabling beacon tx offload */
+    WMI_SERVICE_WOW_WAKEUP_BY_TIMER_PATTERN=142, /* fw to support waking up host from wow pattern timer */
+    WMI_SERVICE_PEER_MAP_UNMAP_V2_SUPPORT=143, /* Support for HTT peer map/unmap V2 */
+    WMI_SERVICE_OFFCHAN_DATA_TID_SUPPORT=144, /* Support new tid for offchan data/mgmt tx over wmi */
+    WMI_SERVICE_RX_PROMISC_ENABLE_SUPPORT=145, /* Support enabling/disabling rx promiscuous mode as directed by a WMI message from the host */
+
+    /******* ADD NEW SERVICES HERE *******/
 
     WMI_MAX_EXT_SERVICE
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_tlv_defs.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_tlv_defs.h
index 64cc160309f..f5af397a02b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_tlv_defs.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_tlv_defs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -757,6 +757,113 @@ typedef enum {
     WMITLV_TAG_STRUC_wmi_tbtt_offset_ext_event_fixed_param,
     WMITLV_TAG_STRUC_wmi_sar_limits_cmd_fixed_param,
     WMITLV_TAG_STRUC_wmi_sar_limit_cmd_row,
+    WMITLV_TAG_STRUC_wmi_pdev_dfs_phyerr_offload_enable_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_dfs_phyerr_offload_disable_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_adfs_ch_cfg_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_adfs_ocac_abort_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_dfs_radar_detection_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_adfs_ocac_complete_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_dfs_cac_complete_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vendor_oui,
+    WMITLV_TAG_STRUC_wmi_request_rcpi_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_update_rcpi_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_request_peer_stats_info_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_peer_stats_info,
+    WMITLV_TAG_STRUC_wmi_peer_stats_info_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pkgid_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_connected_nlo_rssi_params,
+    WMITLV_TAG_STRUC_wmi_set_current_country_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_regulatory_rule_struct,
+    WMITLV_TAG_STRUC_wmi_reg_chan_list_cc_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_11d_scan_start_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_11d_scan_stop_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_11d_new_country_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_request_radio_chan_stats_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_radio_chan_stats,
+    WMITLV_TAG_STRUC_wmi_radio_chan_stats_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_roam_per_config_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_add_mac_addr_to_rx_filter_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_add_mac_addr_to_rx_filter_status_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_bpf_set_vdev_active_mode_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_hw_data_filter_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_connected_nlo_bss_band_rssi_pref,
+    WMITLV_TAG_STRUC_wmi_peer_oper_mode_change_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_chip_power_save_failure_detected_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_multiple_vdev_restart_request_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_csa_switch_count_status_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_update_pkt_routing_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_check_cal_version_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_check_cal_version_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_set_diversity_gain_cmd_fixed_param,
+    WMITLV_TAG_STRUC_WMI_MAC_PHY_CHAINMASK_COMBO,
+    WMITLV_TAG_STRUC_WMI_MAC_PHY_CHAINMASK_CAPABILITY,
+    WMITLV_TAG_STRUC_wmi_vdev_set_arp_stats_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_get_arp_stats_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_get_arp_stats_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_iface_offload_stats,
+    WMITLV_TAG_STRUC_wmi_request_stats_cmd_sub_struc_param,
+    WMITLV_TAG_STRUC_rssi_ctl_ext,
+    WMITLV_TAG_STRUC_wmi_single_phyerr_ext_rx_hdr,
+    WMITLV_TAG_STRUC_wmi_coex_bt_activity_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_get_tx_power_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_tx_power_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_offchan_data_tx_compl_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_offchan_data_tx_send_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_tx_send_params,
+    WMITLV_TAG_STRUC_wmi_he_rate_set,
+    WMITLV_TAG_STRUC_wmi_congestion_stats,
+    WMITLV_TAG_STRUC_wmi_set_init_country_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_scan_dbs_duty_cycle_fixed_param,
+    WMITLV_TAG_STRUC_wmi_scan_dbs_duty_cycle_param_tlv,
+    WMITLV_TAG_STRUC_wmi_pdev_div_get_rssi_antid_fixed_param,
+    WMITLV_TAG_STRUC_wmi_therm_throt_config_request_fixed_param,
+    WMITLV_TAG_STRUC_wmi_therm_throt_level_config_info,
+    WMITLV_TAG_STRUC_wmi_therm_throt_stats_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_therm_throt_level_stats_info,
+    WMITLV_TAG_STRUC_wmi_pdev_div_rssi_antid_event_fixed_param,
+    WMITLV_TAG_STRUC_WMI_OEM_DMA_RING_CAPABILITIES,
+    WMITLV_TAG_STRUC_wmi_oem_dma_ring_cfg_req_fixed_param,
+    WMITLV_TAG_STRUC_wmi_oem_dma_ring_cfg_rsp_fixed_param,
+    WMITLV_TAG_STRUC_wmi_oem_indirect_data,
+    WMITLV_TAG_STRUC_wmi_oem_dma_buf_release_fixed_param,
+    WMITLV_TAG_STRUC_wmi_oem_dma_buf_release_entry,
+    WMITLV_TAG_STRUC_wmi_pdev_bss_chan_info_request_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_bss_chan_info_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_roam_lca_disallow_config_tlv_param,
+    WMITLV_TAG_STRUC_wmi_vdev_limit_offchan_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_roam_rssi_rejection_oce_config_param,
+    WMITLV_TAG_STRUC_wmi_unit_test_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_roam_fils_offload_tlv_param,
+    WMITLV_TAG_STRUC_wmi_pdev_update_pmk_cache_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pmk_cache,
+    WMITLV_TAG_STRUC_wmi_pdev_update_fils_hlp_pkt_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_roam_fils_synch_tlv_param,
+    WMITLV_TAG_STRUC_wmi_gtk_offload_extended_tlv_param,
+    WMITLV_TAG_STRUC_wmi_roam_bg_scan_roaming_param,
+    WMITLV_TAG_STRUC_wmi_oic_ping_offload_params_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_oic_ping_offload_set_enable_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_oic_ping_handoff_event,
+    WMITLV_TAG_STRUC_wmi_dhcp_lease_renew_offload_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_dhcp_lease_renew_event,
+    WMITLV_TAG_STRUC_wmi_btm_config_fixed_param,
+    WMITLV_TAG_STRUC_wmi_debug_mesg_fw_data_stall_param,
+    WMITLV_TAG_STRUC_wmi_wlm_config_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_update_ctltable_request_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_update_ctltable_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_roam_cnd_scoring_param,
+    WMITLV_TAG_STRUC_wmi_pdev_config_vendor_oui_action_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vendor_oui_ext,
+    WMITLV_TAG_STRUC_wmi_roam_synch_frame_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_fd_send_from_host_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_enable_fils_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_host_swfda_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_bcn_offload_ctrl_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_stats_period,
+    WMITLV_TAG_STRUC_wmi_ndl_schedule_update_fixed_param,
+    WMITLV_TAG_STRUC_wmi_peer_tid_msduq_qdepth_thresh_update_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_msduq_qdepth_thresh_update,
+    WMITLV_TAG_STRUC_wmi_pdev_set_rx_filter_promiscuous_cmd_fixed_param,
 } WMITLV_TAG_ID;
 
 /*
@@ -1062,6 +1169,51 @@ typedef enum {
     OP(WMI_REQUEST_WLAN_STATS_CMDID) \
     OP(WMI_VDEV_ENCRYPT_DECRYPT_DATA_REQ_CMDID) \
     OP(WMI_SAR_LIMITS_CMDID) \
+    OP(WMI_PDEV_DFS_PHYERR_OFFLOAD_ENABLE_CMDID) \
+    OP(WMI_PDEV_DFS_PHYERR_OFFLOAD_DISABLE_CMDID) \
+    OP(WMI_VDEV_ADFS_CH_CFG_CMDID) \
+    OP(WMI_VDEV_ADFS_OCAC_ABORT_CMDID) \
+    OP(WMI_REQUEST_RCPI_CMDID) \
+    OP(WMI_REQUEST_PEER_STATS_INFO_CMDID) \
+    OP(WMI_SET_CURRENT_COUNTRY_CMDID) \
+    OP(WMI_11D_SCAN_START_CMDID) \
+    OP(WMI_11D_SCAN_STOP_CMDID) \
+    OP(WMI_REQUEST_RADIO_CHAN_STATS_CMDID) \
+    OP(WMI_ROAM_PER_CONFIG_CMDID) \
+    OP(WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_CMDID) \
+    OP(WMI_BPF_SET_VDEV_ACTIVE_MODE_CMDID) \
+    OP(WMI_HW_DATA_FILTER_CMDID) \
+    OP(WMI_PDEV_MULTIPLE_VDEV_RESTART_REQUEST_CMDID) \
+    OP(WMI_LPI_OEM_REQ_CMDID) \
+    OP(WMI_PDEV_UPDATE_PKT_ROUTING_CMDID) \
+    OP(WMI_PDEV_CHECK_CAL_VERSION_CMDID) \
+    OP(WMI_PDEV_SET_DIVERSITY_GAIN_CMDID) \
+    OP(WMI_VDEV_SET_ARP_STAT_CMDID) \
+    OP(WMI_VDEV_GET_ARP_STAT_CMDID) \
+    OP(WMI_VDEV_GET_TX_POWER_CMDID) \
+    OP(WMI_OFFCHAN_DATA_TX_SEND_CMDID) \
+    OP(WMI_SET_INIT_COUNTRY_CMDID) \
+    OP(WMI_SET_SCAN_DBS_DUTY_CYCLE_CMDID) \
+    OP(WMI_PDEV_DIV_GET_RSSI_ANTID_CMDID) \
+    OP(WMI_THERM_THROT_SET_CONF_CMDID) \
+    OP(WMI_OEM_DMA_RING_CFG_REQ_CMDID) \
+    OP(WMI_PDEV_BSS_CHAN_INFO_REQUEST_CMDID) \
+    OP(WMI_VDEV_LIMIT_OFFCHAN_CMDID) \
+    OP(WMI_PDEV_UPDATE_FILS_HLP_PKT_CMDID) \
+    OP(WMI_PDEV_UPDATE_PMK_CACHE_CMDID) \
+    OP(WMI_HB_OIC_PING_OFFLOAD_PARAM_CMDID) \
+    OP(WMI_HB_OIC_PING_OFFLOAD_SET_ENABLE_CMDID) \
+    OP(WMI_HB_DHCP_LEASE_RENEW_OFFLOAD_CMDID) \
+    OP(WMI_ROAM_BTM_CONFIG_CMDID) \
+    OP(WMI_WLM_CONFIG_CMDID) \
+    OP(WMI_PDEV_UPDATE_CTLTABLE_REQUEST_CMDID) \
+    OP(WMI_PDEV_CONFIG_VENDOR_OUI_ACTION_CMDID) \
+    OP(WMI_PDEV_SEND_FD_CMDID) \
+    OP(WMI_ENABLE_FILS_CMDID) \
+    OP(WMI_BCN_OFFLOAD_CTRL_CMDID) \
+    OP(WMI_PDEV_SET_AC_TX_QUEUE_OPTIMIZED_CMDID) \
+    OP(WMI_PEER_TID_MSDUQ_QDEPTH_THRESH_UPDATE_CMDID) \
+    OP(WMI_PDEV_SET_RX_FILTER_PROMISCUOUS_CMDID) \
     /* add new CMD_LIST elements above this line */
 
 /*
@@ -1150,6 +1302,7 @@ typedef enum {
     OP(WMI_EXTSCAN_HOTLIST_SSID_MATCH_EVENTID) \
     OP(WMI_D0_WOW_DISABLE_ACK_EVENTID) \
     OP(WMI_ROAM_SYNCH_EVENTID) \
+    OP(WMI_ROAM_SYNCH_FRAME_EVENTID) \
     OP(WMI_LPI_STATUS_EVENTID) \
     OP(WMI_LPI_HANDOFF_EVENTID) \
     OP(WMI_UPDATE_VDEV_RATE_STATS_EVENTID) \
@@ -1223,6 +1376,33 @@ typedef enum {
     OP(WMI_REPORT_STATS_EVENTID) \
     OP(WMI_REPORT_RX_AGGR_FAILURE_EVENTID) \
     OP(WMI_VDEV_ENCRYPT_DECRYPT_DATA_RESP_EVENTID) \
+    OP(WMI_PDEV_DFS_RADAR_DETECTION_EVENTID) \
+    OP(WMI_VDEV_DFS_CAC_COMPLETE_EVENTID) \
+    OP(WMI_VDEV_ADFS_OCAC_COMPLETE_EVENTID) \
+    OP(WMI_UPDATE_RCPI_EVENTID) \
+    OP(WMI_PEER_STATS_INFO_EVENTID) \
+    OP(WMI_PKGID_EVENTID) \
+    OP(WMI_REG_CHAN_LIST_CC_EVENTID) \
+    OP(WMI_11D_NEW_COUNTRY_EVENTID) \
+    OP(WMI_RADIO_CHAN_STATS_EVENTID) \
+    OP(WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_STATUS_EVENTID) \
+    OP(WMI_PEER_OPER_MODE_CHANGE_EVENTID) \
+    OP(WMI_PDEV_CHIP_POWER_SAVE_FAILURE_DETECTED_EVENTID) \
+    OP(WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID) \
+    OP(WMI_PDEV_CHECK_CAL_VERSION_EVENTID) \
+    OP(WMI_VDEV_GET_ARP_STAT_EVENTID) \
+    OP(WMI_WLAN_COEX_BT_ACTIVITY_EVENTID) \
+    OP(WMI_VDEV_GET_TX_POWER_EVENTID) \
+    OP(WMI_OFFCHAN_DATA_TX_COMPLETION_EVENTID) \
+    OP(WMI_THERM_THROT_STATS_EVENTID) \
+    OP(WMI_PDEV_DIV_RSSI_ANTID_EVENTID) \
+    OP(WMI_OEM_DMA_RING_CFG_RSP_EVENTID) \
+    OP(WMI_OEM_DMA_BUF_RELEASE_EVENTID) \
+    OP(WMI_PDEV_BSS_CHAN_INFO_EVENTID) \
+    OP(WMI_UNIT_TEST_EVENTID) \
+    OP(WMI_PDEV_UPDATE_CTLTABLE_EVENTID) \
+    OP(WMI_HOST_SWFDA_EVENTID) \
+    OP(WMI_NDL_SCHEDULE_UPDATE_EVENTID) \
     /* add new EVT_LIST elements above this line */
 
 
@@ -1233,7 +1413,8 @@ typedef enum {
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_init_cmd_fixed_param, wmi_init_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)\
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_resource_config, wmi_resource_config, resource_config, WMITLV_SIZE_FIX)\
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wlan_host_memory_chunk, host_mem_chunks, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_cmd_fixed_param, wmi_pdev_set_hw_mode_cmd_fixed_param, hw_mode, WMITLV_SIZE_FIX)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_cmd_fixed_param, wmi_pdev_set_hw_mode_cmd_fixed_param, hw_mode, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_pdev_band_to_mac, band_to_mac, WMITLV_SIZE_VAR)
 
 WMITLV_CREATE_PARAM_STRUC(WMI_INIT_CMDID);
 
@@ -1345,7 +1526,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_RMV_BCN_FILTER_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_11r_offload_tlv_param, offload_11r_param, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_ese_offload_tlv_param, offload_ese_param, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_tlv_buf_len_param, assoc_ie_len_param, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, assoc_ie_buf, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, assoc_ie_buf, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_fils_offload_tlv_param, offload_fils_info_param, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SCAN_MODE);
 
 /* Roam scan Rssi Threshold Cmd */
@@ -1353,7 +1535,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SCAN_MODE);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_roam_scan_rssi_threshold_fixed_param, wmi_roam_scan_rssi_threshold_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_scan_extended_threshold_param, extended_param, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_earlystop_rssi_thres_param, earlystop_param, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_dense_thres_param, dense_param, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_dense_thres_param, dense_param, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_bg_scan_roaming_param, bg_scan_param, WMITLV_SIZE_VAR)
 
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SCAN_RSSI_THRESHOLD);
 
@@ -1391,6 +1574,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SCAN_CMD);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, non_prefer_ch_attr, WMITLV_SIZE_VAR)
 
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SET_MBO_PARAM_CMDID);
+/* Roam PER configure cmd */
+#define WMITLV_TABLE_WMI_ROAM_PER_CONFIG_CMDID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_roam_per_config_fixed_param, wmi_roam_per_config_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_PER_CONFIG_CMDID);
 
 #define WMITLV_TABLE_WMI_VDEV_PLMREQ_START_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_plmreq_start_cmd_fixed_param, wmi_vdev_plmreq_start_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
@@ -1409,8 +1597,9 @@ WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_PLMREQ_STOP_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, channel_list, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_ssid, ssid_list, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_mac_addr, bssid_list, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ie_data, WMITLV_SIZE_VAR)
-
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ie_data, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_vendor_oui, vendor_oui, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, phymode_list, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_START_SCAN_CMDID);
 
 /* Scan adaptive dwell mode configuration */
@@ -1420,6 +1609,13 @@ WMITLV_CREATE_PARAM_STRUC(WMI_START_SCAN_CMDID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_SCAN_ADAPTIVE_DWELL_CONFIG_CMDID);
 
+/* Set scan selection duty cycle */
+#define WMITLV_TABLE_WMI_SET_SCAN_DBS_DUTY_CYCLE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_scan_dbs_duty_cycle_fixed_param, wmi_scan_dbs_duty_cycle_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_scan_dbs_duty_cycle_tlv_param, param, WMITLV_SIZE_VAR)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_SET_SCAN_DBS_DUTY_CYCLE_CMDID);
+
 /* Start ExtScan Cmd */
 #define WMITLV_TABLE_WMI_EXTSCAN_START_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_extscan_start_cmd_fixed_param, wmi_extscan_start_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
@@ -1516,6 +1712,16 @@ WMITLV_CREATE_PARAM_STRUC(WMI_P2P_LISTEN_OFFLOAD_STOPPED_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_channel, wmi_channel, chan, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_CHANNEL_CMDID);
 
+#define WMITLV_TABLE_WMI_PDEV_UPDATE_PMK_CACHE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_update_pmk_cache_cmd_fixed_param, wmi_pdev_update_pmk_cache_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_pmk_cache, pmk_cache, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_UPDATE_PMK_CACHE_CMDID);
+
+#define WMITLV_TABLE_WMI_PDEV_UPDATE_FILS_HLP_PKT_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_update_fils_hlp_pkt_cmd_fixed_param, wmi_pdev_update_fils_hlp_pkt_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, fils_hlp_pkt, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_UPDATE_FILS_HLP_PKT_CMDID);
+
 /* Echo Cmd */
 #define WMITLV_TABLE_WMI_ECHO_CMDID(id,op,buf,len)                                                         \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_echo_cmd_fixed_param, wmi_echo_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -1556,7 +1762,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_P2P_GO_SET_BEACON_IE);
 
 /* GTK offload Cmd */
 #define WMITLV_TABLE_WMI_GTK_OFFLOAD_CMDID(id,op,buf,len) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_WMI_GTK_OFFLOAD_CMD_fixed_param, WMI_GTK_OFFLOAD_CMD_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_WMI_GTK_OFFLOAD_CMD_fixed_param, WMI_GTK_OFFLOAD_CMD_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_gtk_offload_fils_tlv_param, wmi_fils_gtk_info, WMITLV_SIZE_VAR)
 
 WMITLV_CREATE_PARAM_STRUC(WMI_GTK_OFFLOAD_CMDID);
 
@@ -1618,7 +1825,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_IPSEC_NATKEEPALIVE_FILTER_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_peer_assoc_complete_cmd_fixed_param, wmi_peer_assoc_complete_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, peer_legacy_rates, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, peer_ht_rates, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vht_rate_set, wmi_vht_rate_set, peer_vht_rates, WMITLV_SIZE_FIX)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vht_rate_set, wmi_vht_rate_set, peer_vht_rates, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_he_rate_set, peer_he_rates, WMITLV_SIZE_VAR)
 
 WMITLV_CREATE_PARAM_STRUC(WMI_PEER_ASSOC_CMDID);
 
@@ -1703,7 +1911,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_WOW_UDP_SVC_OFLD_CMDID);
 WMITLV_CREATE_PARAM_STRUC(WMI_WOW_HOSTWAKEUP_GPIO_PIN_PATTERN_CONFIG_CMDID);
 
 #define WMITLV_TABLE_WMI_WOW_SET_ACTION_WAKE_UP_CMDID(id,op,buf,len) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_wow_set_action_wake_up_cmd_fixed_param, WMI_WOW_SET_ACTION_WAKE_UP_CMD_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_wow_set_action_wake_up_cmd_fixed_param, WMI_WOW_SET_ACTION_WAKE_UP_CMD_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, action_bitmaps_per_category, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_WOW_SET_ACTION_WAKE_UP_CMDID);
 
 /* Wow enable/disable wake up Cmd */
@@ -1734,6 +1943,17 @@ WMITLV_CREATE_PARAM_STRUC(WMI_OEM_REQ_CMDID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_OEM_REQUEST_CMDID);
 
+/* RTT OEM req Cmd through LPASS */
+#define WMITLV_TABLE_WMI_LPI_OEM_REQ_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_LPI_OEM_REQ_CMDID);
+
+#define WMITLV_TABLE_WMI_OEM_DMA_RING_CFG_REQ_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_oem_dma_ring_cfg_req_fixed_param, wmi_oem_dma_ring_cfg_req_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_OEM_DMA_RING_CFG_REQ_CMDID);
+
 /* Spectral scan configure Cmd */
 #define WMITLV_TABLE_WMI_VDEV_SPECTRAL_SCAN_CONFIGURE_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_spectral_configure_cmd_fixed_param, wmi_vdev_spectral_configure_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -1748,7 +1968,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_SPECTRAL_SCAN_ENABLE_CMDID);
 
 /* Request stats Cmd */
 #define WMITLV_TABLE_WMI_REQUEST_STATS_CMDID(id,op,buf,len) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_request_stats_cmd_fixed_param, wmi_request_stats_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_request_stats_cmd_fixed_param, wmi_request_stats_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_inst_rssi_stats_params, inst_rssi_params, WMITLV_SIZE_VAR)
 
 WMITLV_CREATE_PARAM_STRUC(WMI_REQUEST_STATS_CMDID);
 
@@ -1797,7 +2018,10 @@ WMITLV_CREATE_PARAM_STRUC(WMI_REQUEST_LINK_STATS_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, nlo_configured_parameters, nlo_list, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, channel_list, WMITLV_SIZE_VAR)\
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, nlo_channel_prediction_cfg, channel_prediction_param, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_enlo_candidate_score_param, enlo_candidate_score_params, candidate_score_params, WMITLV_SIZE_FIX)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_enlo_candidate_score_param, enlo_candidate_score_params, candidate_score_params, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_vendor_oui, vendor_oui, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_connected_nlo_rssi_params, connected_nlo_rssi_params, cnlo_rssi_params, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, connected_nlo_bss_band_rssi_pref, cnlo_bss_band_rssi_pref, WMITLV_SIZE_VAR)
 
 WMITLV_CREATE_PARAM_STRUC(WMI_NETWORK_LIST_OFFLOAD_CONFIG_CMDID);
 
@@ -1850,7 +2074,13 @@ WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_SET_KEEPALIVE_CMDID);
 #define WMITLV_TABLE_WMI_VDEV_GET_KEEPALIVE_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_get_keepalive_cmd_fixed_param, wmi_vdev_get_keepalive_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_GET_KEEPALIVE_CMDID);
-/*FWTEST Set TBTT mode Cmd*/
+
+/* Vdev cmd to enable/disable fw offloaded beacons. */
+#define WMITLV_TABLE_WMI_BCN_OFFLOAD_CTRL_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_bcn_offload_ctrl_cmd_fixed_param, wmi_bcn_offload_ctrl_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_BCN_OFFLOAD_CTRL_CMDID);
+
+/* FWTEST Set TBTT mode Cmd */
 #define WMITLV_TABLE_WMI_FWTEST_VDEV_MCC_SET_TBTT_MODE_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_mcc_set_tbtt_mode_cmd_fixed_param, wmi_vdev_mcc_set_tbtt_mode_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_FWTEST_VDEV_MCC_SET_TBTT_MODE_CMDID);
@@ -1931,9 +2161,29 @@ WMITLV_CREATE_PARAM_STRUC(WMI_MGMT_TX_CMDID);
 /* Management tx send cmd */
 #define WMITLV_TABLE_WMI_MGMT_TX_SEND_CMDID(id,op,buf,len)  \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_mgmt_tx_send_cmd_fixed_param, wmi_mgmt_tx_send_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_tx_send_params, wmi_tx_send_params, tx_send_params, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_MGMT_TX_SEND_CMDID);
 
+/* offchan data tx send cmd */
+#define WMITLV_TABLE_WMI_OFFCHAN_DATA_TX_SEND_CMDID(id,op,buf,len)  \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_offchan_data_tx_send_cmd_fixed_param, wmi_offchan_data_tx_send_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_tx_send_params, wmi_tx_send_params, tx_send_params, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_OFFCHAN_DATA_TX_SEND_CMDID);
+
+/** PDEV send FILS Discovery frame cmd */
+#define WMITLV_TABLE_WMI_PDEV_SEND_FD_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_fd_send_from_host_cmd_fixed_param, wmi_fd_send_from_host_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SEND_FD_CMDID);
+
+/** Enable or Disable Fast Initial Link Setup (FILS) feature cmd */
+#define WMITLV_TABLE_WMI_ENABLE_FILS_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_enable_fils_cmd_fixed_param, wmi_enable_fils_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_ENABLE_FILS_CMDID);
+
 /* ADD clear response Cmd */
 #define WMITLV_TABLE_WMI_ADDBA_CLEAR_RESP_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_addba_clear_resp_cmd_fixed_param, wmi_addba_clear_resp_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2006,6 +2256,35 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_GREEN_AP_PS_ENABLE_CMDID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_GET_TPC_CONFIG_CMDID);
 
+/* PDEV Get Antenna diversity chains rssi and antenna index Cmd */
+#define WMITLV_TABLE_WMI_PDEV_DIV_GET_RSSI_ANTID_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_div_get_rssi_antid_fixed_param,  wmi_pdev_div_get_rssi_antid_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_DIV_GET_RSSI_ANTID_CMDID);
+
+#define WMITLV_TABLE_WMI_PDEV_BSS_CHAN_INFO_REQUEST_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_bss_chan_info_request_fixed_param,  wmi_pdev_bss_chan_info_request_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_BSS_CHAN_INFO_REQUEST_CMDID);
+
+/* PDEV update ctl table Cmd */
+#define WMITLV_TABLE_WMI_PDEV_UPDATE_CTLTABLE_REQUEST_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_update_ctltable_request_fixed_param,  wmi_pdev_update_ctltable_request_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE,  A_UINT8, ctltable_data, WMITLV_SIZE_VAR)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_UPDATE_CTLTABLE_REQUEST_CMDID);
+
+/* VDEV Get Tx power Cmd */
+#define WMITLV_TABLE_WMI_VDEV_GET_TX_POWER_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_get_tx_power_cmd_fixed_param, wmi_vdev_get_tx_power_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_GET_TX_POWER_CMDID);
+
+/* Limit Offchannel duration Cmd */
+#define WMITLV_TABLE_WMI_VDEV_LIMIT_OFFCHAN_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_limit_offchan_cmd_fixed_param, wmi_vdev_limit_offchan_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_LIMIT_OFFCHAN_CMDID);
+
 /* PDEV Set Base Mac Address Cmd */
 #define WMITLV_TABLE_WMI_PDEV_SET_BASE_MACADDR_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_base_macaddr_cmd_fixed_param, wmi_pdev_set_base_macaddr_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2027,7 +2306,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PEER_MCAST_GROUP_CMDID);
 /* Roam AP profile Cmd */
 #define WMITLV_TABLE_WMI_ROAM_AP_PROFILE(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_roam_ap_profile_fixed_param, wmi_roam_ap_profile_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ap_profile, wmi_ap_profile, ap_profile, WMITLV_SIZE_FIX)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ap_profile, wmi_ap_profile, ap_profile, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_roam_cnd_scoring_param, wmi_roam_cnd_scoring_param, roam_cnd_scoring_param, WMITLV_SIZE_FIX)
 
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_AP_PROFILE);
 
@@ -2074,6 +2354,30 @@ WMITLV_CREATE_PARAM_STRUC(WMI_DFS_PHYERR_FILTER_ENA_CMDID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_DFS_PHYERR_FILTER_DIS_CMDID);
 
+/* DFS phyerr processing offload enable cmd */
+#define WMITLV_TABLE_WMI_PDEV_DFS_PHYERR_OFFLOAD_ENABLE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_dfs_phyerr_offload_enable_cmd_fixed_param, wmi_pdev_dfs_phyerr_offload_enable_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_DFS_PHYERR_OFFLOAD_ENABLE_CMDID);
+
+/* DFS phyerr processing offload disble cmd */
+#define WMITLV_TABLE_WMI_PDEV_DFS_PHYERR_OFFLOAD_DISABLE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_dfs_phyerr_offload_disable_cmd_fixed_param, wmi_pdev_dfs_phyerr_offload_disable_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_DFS_PHYERR_OFFLOAD_DISABLE_CMDID);
+
+/* set ADFS channel config cmd */
+#define WMITLV_TABLE_WMI_VDEV_ADFS_CH_CFG_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_adfs_ch_cfg_cmd_fixed_param, wmi_vdev_adfs_ch_cfg_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_ADFS_CH_CFG_CMDID);
+
+/* DFS abort ADFS ocac currently in progress */
+#define WMITLV_TABLE_WMI_VDEV_ADFS_OCAC_ABORT_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_adfs_ocac_abort_cmd_fixed_param, wmi_vdev_adfs_ocac_abort_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_ADFS_OCAC_ABORT_CMDID);
+
 /* WOW Add Wake Pattern Cmd */
 #define WMITLV_TABLE_WMI_WOW_ADD_WAKE_PATTERN_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_WMI_WOW_ADD_PATTERN_CMD_fixed_param, WMI_WOW_ADD_PATTERN_CMD_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
@@ -2216,10 +2520,17 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_RESUME_CMDID);
 WMITLV_CREATE_PARAM_STRUC(WMI_SCAN_UPDATE_REQUEST_CMDID);
 
 #define WMITLV_TABLE_WMI_SCAN_PROB_REQ_OUI_CMDID(id,op,buf,len) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_scan_prob_req_oui_cmd_fixed_param, wmi_scan_prob_req_oui_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
-
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_scan_prob_req_oui_cmd_fixed_param, wmi_scan_prob_req_oui_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_vendor_oui, vendor_oui, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_SCAN_PROB_REQ_OUI_CMDID);
 
+#define WMITLV_TABLE_WMI_PDEV_CONFIG_VENDOR_OUI_ACTION_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_config_vendor_oui_action_fixed_param, \
+        wmi_pdev_config_vendor_oui_action_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_vendor_oui_ext, vendor_oui_ext, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_CONFIG_VENDOR_OUI_ACTION_CMDID);
+
 #define WMITLV_TABLE_WMI_CHATTER_ADD_COALESCING_FILTER_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len,WMITLV_TAG_STRUC_wmi_chatter_coalescing_add_filter_cmd_fixed_param, wmi_chatter_coalescing_add_filter_cmd_fixed_param, fixed_param,WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, chatter_pkt_coalescing_filter, coalescing_filter, WMITLV_SIZE_VAR)
@@ -2495,12 +2806,18 @@ WMITLV_CREATE_PARAM_STRUC(WMI_NDI_GET_CAP_REQ_CMDID);
  * wmi_channel channel;
  * A_UINT8 ndp_cfg[];
  * A_UINT8 ndp_app_info[];
+ * A_UINT8 ndp_pmk[];
+ * A_INT8 ndp_passphrase[];
+ * A_INT8 nan_servicename[];
  */
 #define WMITLV_TABLE_WMI_NDP_INITIATOR_REQ_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_initiator_req_fixed_param, wmi_ndp_initiator_req_fixed_param_PROTOTYPE, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_channel, wmi_channel, channel, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_cfg, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_pmk, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_INT8, ndp_passphrase, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_INT8, nan_servicename, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_NDP_INITIATOR_REQ_CMDID);
 
 /** NAN Data Responder Request Cmd
@@ -2508,11 +2825,17 @@ WMITLV_CREATE_PARAM_STRUC(WMI_NDP_INITIATOR_REQ_CMDID);
  * structure. The TLV's are:
  * A_UINT8 ndp_cfg[];
  * A_UINT8 ndp_app_info[];
+ * A_UINT8 ndp_pmk[];
+ * A_INT8 ndp_passphrase[];
+ * A_INT8 nan_servicename[];
  */
 #define WMITLV_TABLE_WMI_NDP_RESPONDER_REQ_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_responder_req_fixed_param, wmi_ndp_responder_req_fixed_param_PROTOTYPE, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_cfg, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_pmk, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_INT8, ndp_passphrase, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_INT8, nan_servicename, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_NDP_RESPONDER_REQ_CMDID);
 
 /** NAN Data End Request Cmd
@@ -2526,6 +2849,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_NDP_RESPONDER_REQ_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_ndp_end_req_PROTOTYPE, ndp_end_req_list, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_NDP_END_REQ_CMDID);
 
+/* RCPI Info Request Cmd */
+#define WMITLV_TABLE_WMI_REQUEST_RCPI_CMDID(id,op,buf,len) \
+	WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_request_rcpi_cmd_fixed_param, wmi_request_rcpi_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_REQUEST_RCPI_CMDID);
+
 /* Modem power state cmd */
 #define WMITLV_TABLE_WMI_MODEM_POWER_STATE_CMDID(id,op,buf,len) \
    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_modem_power_state_cmd_param, wmi_modem_power_state_cmd_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2655,7 +2983,9 @@ WMITLV_CREATE_PARAM_STRUC(WMI_MDNS_GET_STATS_CMDID);
 #define WMITLV_TABLE_WMI_ROAM_INVOKE_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_roam_invoke_cmd_fixed_param, wmi_roam_invoke_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, channel_list, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_mac_addr, bssid_list, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_mac_addr, bssid_list, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_tlv_buf_len_param, bcn_prb_buf_list, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bcn_prb_frm, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_INVOKE_CMDID);
 
 /* SAP Authentication offload param Cmd */
@@ -2736,7 +3066,9 @@ WMITLV_CREATE_PARAM_STRUC(WMI_DCC_UPDATE_NDL_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_mac_addr, bssid_black_list, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_ssid, ssid_white_list, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_mac_addr, bssid_preferred_list, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, bssid_preferred_factor, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, bssid_preferred_factor, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_lca_disallow_config_tlv_param, lca_disallow_param, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_rssi_rejection_oce_config_param, rssi_rejection_list, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_FILTER_CMDID);
 
 /* TSF timestamp action cmd */
@@ -2865,6 +3197,10 @@ WMITLV_CREATE_PARAM_STRUC(WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_bpf_del_vdev_instructions_cmd_fixed_param, wmi_bpf_del_vdev_instructions_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID);
 
+#define WMITLV_TABLE_WMI_BPF_SET_VDEV_ACTIVE_MODE_CMDID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_bpf_set_vdev_active_mode_cmd_fixed_param, wmi_bpf_set_vdev_active_mode_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_BPF_SET_VDEV_ACTIVE_MODE_CMDID);
+
 /* Enable/Disable Smart Antenna */
 #define WMITLV_TABLE_WMI_PDEV_SMART_ANT_ENABLE_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_smart_ant_enable_cmd_fixed_param, wmi_pdev_smart_ant_enable_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
@@ -3039,6 +3375,120 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_STATS_THRESHOLD_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_request_wlan_stats_cmd_fixed_param, wmi_request_wlan_stats_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_REQUEST_WLAN_STATS_CMDID);
 
+/* Request peer stats info cmd */
+#define WMITLV_TABLE_WMI_REQUEST_PEER_STATS_INFO_CMDID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_request_peer_stats_info_cmd_fixed_param, wmi_request_peer_stats_info_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_REQUEST_PEER_STATS_INFO_CMDID);
+
+/* Host sets the current country code */
+#define WMITLV_TABLE_WMI_SET_CURRENT_COUNTRY_CMDID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_set_current_country_cmd_fixed_param, wmi_set_current_country_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_SET_CURRENT_COUNTRY_CMDID);
+
+/* Host sets the init country code */
+#define WMITLV_TABLE_WMI_SET_INIT_COUNTRY_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_set_init_country_cmd_fixed_param, wmi_set_init_country_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_SET_INIT_COUNTRY_CMDID);
+
+/* Start 11d scan in FW */
+#define WMITLV_TABLE_WMI_11D_SCAN_START_CMDID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_11d_scan_start_cmd_fixed_param, wmi_11d_scan_start_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_11D_SCAN_START_CMDID);
+
+/* Stop 11d scan in FW */
+#define WMITLV_TABLE_WMI_11D_SCAN_STOP_CMDID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_11d_scan_stop_cmd_fixed_param, wmi_11d_scan_stop_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_11D_SCAN_STOP_CMDID);
+
+/* Request radio channel stats cmd */
+#define WMITLV_TABLE_WMI_REQUEST_RADIO_CHAN_STATS_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_request_radio_chan_stats_cmd_fixed_param, wmi_request_radio_chan_stats_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_REQUEST_RADIO_CHAN_STATS_CMDID);
+/* mac randomization cmd */
+#define WMITLV_TABLE_WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_CMDID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_vdev_add_mac_addr_to_rx_filter_cmd_fixed_param, wmi_vdev_add_mac_addr_to_rx_filter_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_CMDID);
+
+#define WMITLV_TABLE_WMI_HW_DATA_FILTER_CMDID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_hw_data_filter_cmd_fixed_param, wmi_hw_data_filter_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_HW_DATA_FILTER_CMDID);
+
+/* Multiple vdev restart request cmd */
+#define WMITLV_TABLE_WMI_PDEV_MULTIPLE_VDEV_RESTART_REQUEST_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_multiple_vdev_restart_request_cmd_fixed_param, wmi_pdev_multiple_vdev_restart_request_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, vdev_ids, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_channel, wmi_channel, chan, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_MULTIPLE_VDEV_RESTART_REQUEST_CMDID);
+
+#define WMITLV_TABLE_WMI_PDEV_UPDATE_PKT_ROUTING_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_update_pkt_routing_cmd_fixed_param, wmi_pdev_update_pkt_routing_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_UPDATE_PKT_ROUTING_CMDID);
+
+/* Get cal version cmd */
+#define WMITLV_TABLE_WMI_PDEV_CHECK_CAL_VERSION_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_check_cal_version_cmd_fixed_param, wmi_pdev_check_cal_version_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_CHECK_CAL_VERSION_CMDID);
+
+#define WMITLV_TABLE_WMI_PDEV_SET_DIVERSITY_GAIN_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_diversity_gain_cmd_fixed_param, wmi_pdev_set_diversity_gain_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, diversity_gains, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_DIVERSITY_GAIN_CMDID);
+
+/* set arp stats cmd */
+#define WMITLV_TABLE_WMI_VDEV_SET_ARP_STAT_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_set_arp_stats_cmd_fixed_param, wmi_vdev_set_arp_stats_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_SET_ARP_STAT_CMDID);
+
+/* get arp stats cmd */
+#define WMITLV_TABLE_WMI_VDEV_GET_ARP_STAT_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_get_arp_stats_cmd_fixed_param, wmi_vdev_get_arp_stats_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_GET_ARP_STAT_CMDID);
+
+/* Thermal Throttling SET CONFIG commands. */
+#define WMITLV_TABLE_WMI_THERM_THROT_SET_CONF_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_therm_throt_config_request_fixed_param, wmi_therm_throt_config_request_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_therm_throt_level_config_info, therm_throt_level_config_info, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_THERM_THROT_SET_CONF_CMDID);
+
+/* OIC ping offload cmd */
+#define WMITLV_TABLE_WMI_HB_OIC_PING_OFFLOAD_PARAM_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_oic_ping_offload_params_cmd_fixed_param, wmi_oic_ping_offload_params_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_HB_OIC_PING_OFFLOAD_PARAM_CMDID);
+
+#define WMITLV_TABLE_WMI_HB_OIC_PING_OFFLOAD_SET_ENABLE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_oic_ping_offload_set_enable_cmd_fixed_param, wmi_oic_ping_offload_set_enable_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_HB_OIC_PING_OFFLOAD_SET_ENABLE_CMDID);
+
+/* DHCP Lease Renew Offload cmd */
+#define WMITLV_TABLE_WMI_HB_DHCP_LEASE_RENEW_OFFLOAD_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len,WMITLV_TAG_STRUC_wmi_dhcp_lease_renew_offload_cmd_fixed_param, wmi_dhcp_lease_renew_offload_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_HB_DHCP_LEASE_RENEW_OFFLOAD_CMDID);
+
+/* BTM config command */
+#define WMITLV_TABLE_WMI_ROAM_BTM_CONFIG_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_btm_config_fixed_param, wmi_btm_config_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_BTM_CONFIG_CMDID);
+
+/* vdev latency config cmd */
+#define WMITLV_TABLE_WMI_WLM_CONFIG_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_wlm_config_cmd_fixed_param, wmi_wlm_config_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_WLM_CONFIG_CMDID);
+
+/* Pdev Set AC TX Queue Optimized Cmd */
+#define WMITLV_TABLE_WMI_PDEV_SET_AC_TX_QUEUE_OPTIMIZED_CMDID(id,op,buf,len) \
+  WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param, wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_AC_TX_QUEUE_OPTIMIZED_CMDID);
+
+/* Set msduq qdepth threshold value Cmd */
+#define WMITLV_TABLE_WMI_PEER_TID_MSDUQ_QDEPTH_THRESH_UPDATE_CMDID(id,op,buf,len) \
+  WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_peer_tid_msduq_qdepth_thresh_update_cmd_fixed_param, wmi_peer_tid_msduq_qdepth_thresh_update_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+  WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_msduq_qdepth_thresh_update, msduq_qdepth_thresh_update, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PEER_TID_MSDUQ_QDEPTH_THRESH_UPDATE_CMDID);
+
+/* Pdev Set RX filter promiscuous Cmd */
+#define WMITLV_TABLE_WMI_PDEV_SET_RX_FILTER_PROMISCUOUS_CMDID(id,op,buf,len) \
+  WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_rx_filter_promiscuous_cmd_fixed_param, wmi_pdev_set_rx_filter_promiscuous_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_RX_FILTER_PROMISCUOUS_CMDID);
 /************************** TLV definitions of WMI events *******************************/
 
 /* Service Ready event */
@@ -3062,12 +3512,15 @@ WMITLV_CREATE_PARAM_STRUC(WMI_SERVICE_AVAILABLE_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, WMI_HW_MODE_CAPABILITIES, hw_mode_caps, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, WMI_MAC_PHY_CAPABILITIES, mac_phy_caps, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_WMI_SOC_HAL_REG_CAPABILITIES, WMI_SOC_HAL_REG_CAPABILITIES, soc_hal_reg_caps, WMITLV_SIZE_FIX) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, WMI_HAL_REG_CAPABILITIES_EXT, hal_reg_caps, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, WMI_HAL_REG_CAPABILITIES_EXT, hal_reg_caps, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, WMI_MAC_PHY_CHAINMASK_COMBO, mac_phy_chainmask_combo, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, WMI_MAC_PHY_CHAINMASK_CAPABILITY, mac_phy_chainmask_caps, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_SERVICE_READY_EXT_EVENTID);
 
 /* Ready event */
 #define WMITLV_TABLE_WMI_READY_EVENTID(id,op,buf,len)                                                                                                 \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ready_event_fixed_param, wmi_ready_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ready_event_fixed_param, wmi_ready_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_mac_addr, mac_addr_list, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_READY_EVENTID);
 
 /* Scan Event */
@@ -3145,6 +3598,26 @@ WMITLV_CREATE_PARAM_STRUC(WMI_UPDATE_WHAL_MIB_STATS_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ratesArray, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_TPC_CONFIG_EVENTID);
 
+/* PDEV DIV RSSI Antenna index Event */
+#define WMITLV_TABLE_WMI_PDEV_DIV_RSSI_ANTID_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_div_rssi_antid_event_fixed_param, wmi_pdev_div_rssi_antid_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_DIV_RSSI_ANTID_EVENTID);
+
+/* PDEV BSS CHAN info Event */
+#define WMITLV_TABLE_WMI_PDEV_BSS_CHAN_INFO_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_bss_chan_info_event_fixed_param, wmi_pdev_bss_chan_info_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_BSS_CHAN_INFO_EVENTID);
+
+/* PDEV update ctl table Event */
+#define WMITLV_TABLE_WMI_PDEV_UPDATE_CTLTABLE_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_update_ctltable_event_fixed_param, wmi_pdev_update_ctltable_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_UPDATE_CTLTABLE_EVENTID);
+
+/* VDEV Tx Power Event */
+#define WMITLV_TABLE_WMI_VDEV_GET_TX_POWER_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_tx_power_event_fixed_param, wmi_vdev_get_tx_power_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_GET_TX_POWER_EVENTID);
+
 /* Channel Info Event */
 #define WMITLV_TABLE_WMI_CHAN_INFO_EVENTID(id,op,buf,len)                                                                                                 \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_chan_info_event_fixed_param, wmi_chan_info_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -3153,7 +3626,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_CHAN_INFO_EVENTID);
 /* Phy Error Event */
 #define WMITLV_TABLE_WMI_PHYERR_EVENTID(id,op,buf,len)                                                                                                 \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_comb_phyerr_rx_hdr, wmi_comb_phyerr_rx_hdr, hdr, WMITLV_SIZE_FIX)   \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_single_phyerr_ext_rx_hdr, single_phyerr_ext, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_PHYERR_EVENTID);
 
 /* TX Pause/Unpause event */
@@ -3166,6 +3640,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_TX_PAUSE_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_mgmt_tx_compl_event_fixed_param, wmi_mgmt_tx_compl_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_MGMT_TX_COMPLETION_EVENTID);
 
+/* offchan data TX completion event */
+#define WMITLV_TABLE_WMI_OFFCHAN_DATA_TX_COMPLETION_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_offchan_data_tx_compl_event_fixed_param, wmi_offchan_data_tx_compl_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_OFFCHAN_DATA_TX_COMPLETION_EVENTID);
+
 /* Bundled Mgmt TX completion event */
 #define WMITLV_TABLE_WMI_MGMT_TX_BUNDLE_COMPLETION_EVENTID(id, op, buf, len) \
     WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_mgmt_tx_compl_bundle_event_fixed_param, wmi_mgmt_tx_compl_bundle_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
@@ -3201,7 +3680,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PEER_STA_KICKOUT_EVENTID);
 /* Management Rx Event */
 #define WMITLV_TABLE_WMI_MGMT_RX_EVENTID(id,op,buf,len)                                                                                                 \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_mgmt_rx_hdr, wmi_mgmt_rx_hdr, hdr, WMITLV_SIZE_FIX)   \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_rssi_ctl_ext, rssi_ctl_ext, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_MGMT_RX_EVENTID);
 
 /* TBTT offset Event */
@@ -3247,9 +3727,18 @@ WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, status, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, reassoc_req_frame, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_pdev_hw_mode_transition_event_fixed_param, hw_mode_transition_fixed_param, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_pdev_set_hw_mode_response_vdev_mac_entry, wmi_pdev_set_hw_mode_response_vdev_mac_mapping, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_pdev_set_hw_mode_response_vdev_mac_entry, wmi_pdev_set_hw_mode_response_vdev_mac_mapping, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_roam_fils_synch_tlv_param, roam_fils_synch_info, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SYNCH_EVENTID);
 
+/* Roam Synch frame Event */
+#define WMITLV_TABLE_WMI_ROAM_SYNCH_FRAME_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_roam_synch_frame_event_fixed_param, wmi_roam_synch_frame_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bcn_probe_rsp_frame, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, reassoc_rsp_frame, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, reassoc_req_frame, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SYNCH_FRAME_EVENTID);
+
 /* WOW Wakeup Host Event */
 /* NOTE: Make sure wow_bitmap_info can be zero or one elements only */
 #define WMITLV_TABLE_WMI_WOW_WAKEUP_HOST_EVENTID(id,op,buf,len)                                                         \
@@ -3257,8 +3746,9 @@ WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SYNCH_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, WOW_EVENT_INFO_SECTION_BITMAP, wow_bitmap_info, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, wow_packet_buffer, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_hb_ind_event_fixed_param, hb_indevt, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, WMI_GTK_OFFLOAD_STATUS_EVENT_fixed_param, wow_gtkigtk, WMITLV_SIZE_VAR)
-
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, WMI_GTK_OFFLOAD_STATUS_EVENT_fixed_param, wow_gtkigtk, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_oic_ping_handoff_event, wow_oic_ping_handoff, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_dhcp_lease_renew_event, wow_dhcp_lease_renew, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_WOW_WAKEUP_HOST_EVENTID);
 
 #define WMITLV_TABLE_WMI_WOW_INITIAL_WAKEUP_EVENTID(id,op,buf,len) \
@@ -3307,7 +3797,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_RFKILL_STATE_CHANGE_EVENTID);
 WMITLV_CREATE_PARAM_STRUC(WMI_DEBUG_MESG_EVENTID);
 
 #define WMITLV_TABLE_WMI_DEBUG_MESG_FLUSH_COMPLETE_EVENTID(id,op,buf,len)\
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_debug_mesg_flush_complete_fixed_param, wmi_debug_mesg_flush_complete_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_debug_mesg_flush_complete_fixed_param, wmi_debug_mesg_flush_complete_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_debug_mesg_fw_data_stall_param, data_stall, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_DEBUG_MESG_FLUSH_COMPLETE_EVENTID);
 
 #define WMITLV_TABLE_WMI_RSSI_BREACH_EVENTID(id,op,buf,len)\
@@ -3384,9 +3875,17 @@ WMITLV_CREATE_PARAM_STRUC(WMI_OEM_CAPABILITY_EVENTID);
 
 /*oem response event*/
 #define WMITLV_TABLE_WMI_OEM_RESPONSE_EVENTID(id,op,buf,len) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_oem_indirect_data, wmi_oem_indirect_data, indirect_data, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data2, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_OEM_RESPONSE_EVENTID);
 
+/* oem dma buffer release event */
+#define WMITLV_TABLE_WMI_OEM_DMA_BUF_RELEASE_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_oem_dma_buf_release_fixed_param, wmi_oem_dma_buf_release_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_oem_dma_buf_release_entry, entries, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_OEM_DMA_BUF_RELEASE_EVENTID);
+
 /* HOST SWBA Event */
 #define WMITLV_TABLE_WMI_HOST_SWBA_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_host_swba_event_fixed_param, wmi_host_swba_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
@@ -3395,13 +3894,19 @@ WMITLV_CREATE_PARAM_STRUC(WMI_OEM_RESPONSE_EVENTID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_HOST_SWBA_EVENTID);
 
+/* HOST SWFDA Event  requesting host to queue a FILS Discovery frame for transmission */
+#define WMITLV_TABLE_WMI_HOST_SWFDA_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_host_swfda_event_fixed_param, wmi_host_swfda_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+
+WMITLV_CREATE_PARAM_STRUC(WMI_HOST_SWFDA_EVENTID);
 
 /* Update stats Event */
 #define WMITLV_TABLE_WMI_UPDATE_STATS_EVENTID(id,op,buf,len)\
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_stats_event_fixed_param, wmi_stats_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_per_chain_rssi_stats, wmi_per_chain_rssi_stats, chain_stats, WMITLV_SIZE_FIX) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_rssi_stats, rssi_stats, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_rssi_stats, rssi_stats, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_congestion_stats, congestion_stats, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_UPDATE_STATS_EVENTID);
 
 /* For vdev based ht/vht info upload*/
@@ -3432,7 +3937,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_DIAG_EVENT_LOG_SUPPORTED_EVENTID);
 #define WMITLV_TABLE_WMI_IFACE_LINK_STATS_EVENTID(id,op,buf,len)\
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_iface_link_stats_event_fixed_param, wmi_iface_link_stats_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_iface_link_stats, iface_link_stats, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_wmm_ac_stats, ac, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_wmm_ac_stats, ac, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_iface_offload_stats, iface_offload_stats, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_IFACE_LINK_STATS_EVENTID);
 
 /* Update Peer link stats Event */
@@ -3557,16 +4063,36 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PEER_ANTDIV_INFO_EVENTID);
 WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_peer_tx_fail_cnt_thr_event_fixed_param, wmi_peer_tx_fail_cnt_thr_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
     WMITLV_CREATE_PARAM_STRUC(WMI_PEER_TX_FAIL_CNT_THR_EVENTID);
 
+#define WMITLV_TABLE_WMI_PEER_OPER_MODE_CHANGE_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_peer_oper_mode_change_event_fixed_param, wmi_peer_oper_mode_change_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+    WMITLV_CREATE_PARAM_STRUC(WMI_PEER_OPER_MODE_CHANGE_EVENTID);
+
 /* DFS radar Event */
 #define WMITLV_TABLE_WMI_DFS_RADAR_EVENTID(id,op,buf,len) \
 WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_dfs_radar_event_fixed_param, wmi_dfs_radar_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
     WMITLV_CREATE_PARAM_STRUC(WMI_DFS_RADAR_EVENTID);
 
+#define WMITLV_TABLE_WMI_PDEV_DFS_RADAR_DETECTION_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_dfs_radar_detection_event_fixed_param, wmi_pdev_dfs_radar_detection_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_DFS_RADAR_DETECTION_EVENTID);
+
+#define WMITLV_TABLE_WMI_VDEV_ADFS_OCAC_COMPLETE_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_adfs_ocac_complete_event_fixed_param, wmi_vdev_adfs_ocac_complete_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_ADFS_OCAC_COMPLETE_EVENTID);
+
+#define WMITLV_TABLE_WMI_VDEV_DFS_CAC_COMPLETE_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_dfs_cac_complete_event_fixed_param, wmi_vdev_dfs_cac_complete_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_DFS_CAC_COMPLETE_EVENTID);
+
 /* Thermal Event */
 #define WMITLV_TABLE_WMI_THERMAL_MGMT_EVENTID(id,op,buf,len) \
 WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_thermal_mgmt_event_fixed_param, wmi_thermal_mgmt_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
     WMITLV_CREATE_PARAM_STRUC(WMI_THERMAL_MGMT_EVENTID);
 
+#define WMITLV_TABLE_WMI_OEM_DMA_RING_CFG_RSP_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_oem_dma_ring_cfg_rsp_fixed_param, wmi_oem_dma_ring_cfg_rsp_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_OEM_DMA_RING_CFG_RSP_EVENTID)
+
 /* NAN Response/Indication Event */
 #define WMITLV_TABLE_WMI_NAN_EVENTID(id,op,buf,len)                                     \
 WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_nan_event_hdr, wmi_nan_event_hdr, fixed_param, WMITLV_SIZE_FIX) \
@@ -3636,7 +4162,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_NDP_END_RSP_EVENTID);
 #define WMITLV_TABLE_WMI_NDP_INDICATION_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_indication_event_fixed_param, wmi_ndp_indication_event_fixed_param_PROTOTYPE, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_cfg, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_scid, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_NDP_INDICATION_EVENTID);
 
 /** NDP confirm event
@@ -3644,13 +4171,27 @@ WMITLV_CREATE_PARAM_STRUC(WMI_NDP_INDICATION_EVENTID);
  * structure. The TLV's are:
  * A_UINT8 ndp_cfg[];
  * A_UINT8 ndp_app_info[];
+ * wmi_channel ndp_channel_list[]
  */
 #define WMITLV_TABLE_WMI_NDP_CONFIRM_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_confirm_event_fixed_param, wmi_ndp_confirm_event_fixed_param_PROTOTYPE, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_cfg, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_channel, ndp_channel_list, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_NDP_CONFIRM_EVENTID);
 
+/** NDL schedule update event
+ * TLV (tag lenght value ) parameters follow the ndl_schedule_update
+ * structure. The TLV's are:
+ * A_UINT32 ndp_instance_list[];
+ * wmi_channel ndl_channel_list[];
+ */
+#define WMITLV_TABLE_WMI_NDL_SCHEDULE_UPDATE_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndl_schedule_update_fixed_param, wmi_ndl_schedule_update_fixed_param_PROTOTYPE, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, ndp_instance_list, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_channel, ndl_channel_list, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDL_SCHEDULE_UPDATE_EVENTID);
+
 /** NDP end indication event
  *
  * TLV (tag length value ) parameters follow the ndp_end_indication
@@ -3661,6 +4202,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_NDP_CONFIRM_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_ndp_end_indication_PROTOTYPE, ndp_end_indication_list, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_NDP_END_INDICATION_EVENTID);
 
+/* Update RCPI Info Event */
+#define WMITLV_TABLE_WMI_UPDATE_RCPI_EVENTID(id,op,buf,len) \
+	WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_update_rcpi_event_fixed_param, wmi_update_rcpi_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_UPDATE_RCPI_EVENTID);
+
 /* L1SS track Event */
 #define WMITLV_TABLE_WMI_PDEV_L1SS_TRACK_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_l1ss_track_event_fixed_param, wmi_pdev_l1ss_track_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -3847,10 +4393,21 @@ WMITLV_CREATE_PARAM_STRUC(WMI_BPF_CAPABILIY_INFO_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_bpf_vdev_stats_info_evt_fixed_param, wmi_bpf_vdev_stats_info_evt_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_BPF_VDEV_STATS_INFO_EVENTID);
 
+/* Indicate new country code to host from 11d scan */
+#define WMITLV_TABLE_WMI_11D_NEW_COUNTRY_EVENTID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_11d_new_country_event_fixed_param, wmi_11d_new_country_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_11D_NEW_COUNTRY_EVENTID);
+
+/* Regulatory channel list of current country code */
+#define WMITLV_TABLE_WMI_REG_CHAN_LIST_CC_EVENTID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_reg_chan_list_cc_event_fixed_param, wmi_reg_chan_list_cc_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_regulatory_rule_struct, reg_rule_array, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_REG_CHAN_LIST_CC_EVENTID);
+
 /* FIPS event */
 #define WMITLV_TABLE_WMI_PDEV_FIPS_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_fips_event_fixed_param, wmi_pdev_fips_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)   \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, data, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_FIPS_EVENTID);
 
 #define WMITLV_TABLE_WMI_PDEV_CHANNEL_HOPPING_EVENTID(id,op,buf,len) \
@@ -3861,6 +4418,10 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_CHANNEL_HOPPING_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ani_cck_event_fixed_param, wmi_ani_cck_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_ANI_CCK_LEVEL_EVENTID);
 
+#define WMITLV_TABLE_WMI_PDEV_CHIP_POWER_SAVE_FAILURE_DETECTED_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_chip_power_save_failure_detected_fixed_param, wmi_chip_power_save_failure_detected_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_CHIP_POWER_SAVE_FAILURE_DETECTED_EVENTID);
+
 #define WMITLV_TABLE_WMI_PDEV_CHIP_POWER_STATS_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_chip_power_stats_event_fixed_param, wmi_pdev_chip_power_stats_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, debug_registers, WMITLV_SIZE_VAR)
@@ -3944,6 +4505,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_RADIO_TX_POWER_LEVEL_STATS_EVENTID);
  *    A_UINT32                 rx_mcs[][][];             Array length is (num_peer_ac_rx_stats * WLAN_MAX_AC) * rx_mcs_array_len,
  *                                                       array index is (peer_index * WLAN_MAX_AC + ac_index) * rx_mcs_array_len + MCS index
  *                                                       Contains a count of rx PPDUs for each MCS of each AC of each peer.
+ *    wmi_stats_period         stats_period[];           Array length is specified by stats_period_array_len
+ *
  * For example, if there were 2 peers (X and Y) whose stats were being reported,
  * the message and its TLV arrays would look like this:
  * 1.  fixed_param
@@ -4032,7 +4595,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_RADIO_TX_POWER_LEVEL_STATS_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_peer_ac_rx_stats, peer_ac_rx_stats, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_rx_stats, rx_stats, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, rx_mpdu_aggr, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, rx_mcs, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, rx_mcs, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_stats_period, stats_period, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_REPORT_STATS_EVENTID);
 
 #define WMITLV_TABLE_WMI_VDEV_ENCRYPT_DECRYPT_DATA_RESP_EVENTID(id, op, buf, len) \
@@ -4040,6 +4604,56 @@ WMITLV_CREATE_PARAM_STRUC(WMI_REPORT_STATS_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, enc80211_frame, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_ENCRYPT_DECRYPT_DATA_RESP_EVENTID);
 
+#define WMITLV_TABLE_WMI_PEER_STATS_INFO_EVENTID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_peer_stats_info_event_fixed_param, wmi_peer_stats_info_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_peer_stats_info, peer_stats_info, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PEER_STATS_INFO_EVENTID);
+
+#define WMITLV_TABLE_WMI_RADIO_CHAN_STATS_EVENTID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_radio_chan_stats_event_fixed_param,wmi_radio_chan_stats_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_radio_chan_stats, radio_chan_stats, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_RADIO_CHAN_STATS_EVENTID);
+
+#define WMITLV_TABLE_WMI_PKGID_EVENTID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_pkgid_event_fixed_param, wmi_pkgid_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PKGID_EVENTID);
+/* mac randomization event */
+#define WMITLV_TABLE_WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_STATUS_EVENTID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_vdev_add_mac_addr_to_rx_filter_status_event_fixed_param, wmi_vdev_add_mac_addr_to_rx_filter_status_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_STATUS_EVENTID);
+
+#define WMITLV_TABLE_WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_csa_switch_count_status_event_fixed_param, wmi_pdev_csa_switch_count_status_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, vdev_ids, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID);
+
+/* cal version response event */
+#define WMITLV_TABLE_WMI_PDEV_CHECK_CAL_VERSION_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_check_cal_version_event_fixed_param, wmi_pdev_check_cal_version_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_CHECK_CAL_VERSION_EVENTID);
+
+/* ARP stats response event */
+#define WMITLV_TABLE_WMI_VDEV_GET_ARP_STAT_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_get_arp_stats_event_fixed_param, wmi_vdev_get_arp_stats_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_GET_ARP_STAT_EVENTID);
+
+/* Coex BT activity response event */
+#define WMITLV_TABLE_WMI_WLAN_COEX_BT_ACTIVITY_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_coex_bt_activity_event_fixed_param, wmi_coex_bt_activity_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_WLAN_COEX_BT_ACTIVITY_EVENTID);
+
+/* Thermal Throttling stats event */
+#define WMITLV_TABLE_WMI_THERM_THROT_STATS_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_therm_throt_stats_event_fixed_param, wmi_therm_throt_stats_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_therm_throt_level_stats_info, therm_throt_level_stats_info, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_THERM_THROT_STATS_EVENTID);
+
+/* UNIT-TEST Event */
+#define WMITLV_TABLE_WMI_UNIT_TEST_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_unit_test_event_fixed_param, wmi_unit_test_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_UNIT_TEST_EVENTID);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_unified.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_unified.h
index 395e6f35cbb..272c8a3c0f8 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_unified.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -122,6 +122,8 @@ extern "C" {
     (((num_entries) / (32 / (bits_per_entry))) +            \
     (((num_entries) % (32 / (bits_per_entry))) ? 1 : 0))
 
+#define WMI_RETURN_STRING(str) case ((str)): return (uint8_t *)(# str);
+
 static INLINE A_UINT32 wmi_packed_arr_get_bits(A_UINT32 *arr,
     A_UINT32 entry_index, A_UINT32 bits_per_entry)
 {
@@ -237,6 +239,9 @@ typedef enum {
     WMI_GRP_NAN_DATA,            /* 0x37 */
     WMI_GRP_PROTOTYPE,           /* 0x38 */
     WMI_GRP_MONITOR,             /* 0x39 */
+    WMI_GRP_REGULATORY,          /* 0x3a */
+    WMI_GRP_HW_DATA_FILTER,      /* 0x3b */
+    WMI_GRP_WLM,                 /* 0x3c WLAN Latency Manager */
 } WMI_GRP_ID;
 
 #define WMI_CMD_GRP_START_ID(grp_id) (((grp_id) << 12) | 0x1)
@@ -268,6 +273,8 @@ typedef enum {
     WMI_SCAN_PROB_REQ_OUI_CMDID,
     /** config adaptive dwell scan */
     WMI_SCAN_ADAPTIVE_DWELL_CONFIG_CMDID,
+    /** Only applicable to DBS capable product */
+    WMI_SET_SCAN_DBS_DUTY_CYCLE_CMDID,
 
     /* PDEV(physical device) specific commands */
     /** set regulatorty ctl id used by FW to determine the exact ctl power limits */
@@ -354,6 +361,30 @@ typedef enum {
     WMI_PDEV_GET_CHIP_POWER_STATS_CMDID,
     /** set stats reporting thresholds - see WMI_REPORT_STATS_EVENTID */
     WMI_PDEV_SET_STATS_THRESHOLD_CMDID,
+    /** vdev restart request for multiple vdevs */
+    WMI_PDEV_MULTIPLE_VDEV_RESTART_REQUEST_CMDID,
+    /** Pdev update packet routing command */
+    WMI_PDEV_UPDATE_PKT_ROUTING_CMDID,
+    /** Get Calibration data version details */
+    WMI_PDEV_CHECK_CAL_VERSION_CMDID,
+    /* Set Diversity Gain */
+    WMI_PDEV_SET_DIVERSITY_GAIN_CMDID,
+    /** Get chain RSSI and antena index command */
+    WMI_PDEV_DIV_GET_RSSI_ANTID_CMDID,
+    /** get bss chan info */
+    WMI_PDEV_BSS_CHAN_INFO_REQUEST_CMDID,
+    /** update pmk cache info */
+    WMI_PDEV_UPDATE_PMK_CACHE_CMDID,
+    /**  update fils HLP */
+    WMI_PDEV_UPDATE_FILS_HLP_PKT_CMDID,
+    /** update ctltable request **/
+    WMI_PDEV_UPDATE_CTLTABLE_REQUEST_CMDID,
+    /** Command to set beacon OUI **/
+    WMI_PDEV_CONFIG_VENDOR_OUI_ACTION_CMDID,
+    /** enable/disable per-AC tx queue optimizations */
+    WMI_PDEV_SET_AC_TX_QUEUE_OPTIMIZED_CMDID,
+    /** enable/disable rx promiscuous mode */
+    WMI_PDEV_SET_RX_FILTER_PROMISCUOUS_CMDID,
 
     /* VDEV (virtual device) specific commands */
     /** vdev create */
@@ -405,6 +436,17 @@ typedef enum {
 
     /* DISA feature: Encrypt-decrypt data request */
     WMI_VDEV_ENCRYPT_DECRYPT_DATA_REQ_CMDID,
+    /** Command to enable mac randomizaton **/
+    WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_CMDID,
+
+    /** WMI commands related to dbg arp stats */
+    WMI_VDEV_SET_ARP_STAT_CMDID,
+    WMI_VDEV_GET_ARP_STAT_CMDID,
+
+    /** get tx power for the current vdev */
+    WMI_VDEV_GET_TX_POWER_CMDID,
+    /* limit STA offchannel activity */
+    WMI_VDEV_LIMIT_OFFCHAN_CMDID,
 
     /* peer specific commands */
 
@@ -432,7 +474,7 @@ typedef enum {
      */
     WMI_PEER_GET_ESTIMATED_LINKSPEED_CMDID,
     /** Set the conditions to report peer justified rate to driver
-     * The justified rate means the the user-rate is justified by PER.
+     * The justified rate means the user-rate is justified by PER.
      */
     WMI_PEER_SET_RATE_REPORT_CONDITION_CMDID,
 
@@ -462,6 +504,8 @@ typedef enum {
      */
     WMI_PEER_ANTDIV_INFO_REQ_CMDID,
 
+    /** Peer/Tid/Msduq threshold update */
+    WMI_PEER_TID_MSDUQ_QDEPTH_THRESH_UPDATE_CMDID,
 
     /* beacon/management specific commands */
 
@@ -485,6 +529,12 @@ typedef enum {
 
     /** Transmit Mgmt frame by reference */
     WMI_MGMT_TX_SEND_CMDID,
+    /** Transmit data frame by reference */
+    WMI_OFFCHAN_DATA_TX_SEND_CMDID,
+    /** transmit FILS Discovery frame by value */
+    WMI_PDEV_SEND_FD_CMDID,
+    /** Cmd to enable/disable offloaded beacons */
+    WMI_BCN_OFFLOAD_CTRL_CMDID,
 
     /** commands to directly control ba negotiation directly from host. only used in test mode */
 
@@ -518,6 +568,14 @@ typedef enum {
     WMI_DFS_PHYERR_FILTER_ENA_CMDID,
     /** enable DFS phyerr/parse filter offload */
     WMI_DFS_PHYERR_FILTER_DIS_CMDID,
+    /** enable DFS phyerr processing offload */
+    WMI_PDEV_DFS_PHYERR_OFFLOAD_ENABLE_CMDID,
+    /** disable DFS phyerr processing offload */
+    WMI_PDEV_DFS_PHYERR_OFFLOAD_DISABLE_CMDID,
+    /** set ADFS channel config */
+    WMI_VDEV_ADFS_CH_CFG_CMDID,
+    /** abort ADFS off-channel-availability-check currently in progress */
+    WMI_VDEV_ADFS_OCAC_ABORT_CMDID,
 
     /* Roaming specific  commands */
     /** set roam scan mode */
@@ -548,6 +606,12 @@ typedef enum {
     WMI_ROAM_CONFIGURE_MAWC_CMDID,
     /** configure MultiBand Operation(refer WFA MBO spec) parameter */
     WMI_ROAM_SET_MBO_PARAM_CMDID, /* DEPRECATED */
+    /** configure packet error rate threshold for triggering roaming */
+    WMI_ROAM_PER_CONFIG_CMDID,
+    /** configure BSS Transition Management (BTM) offload for roaming */
+    WMI_ROAM_BTM_CONFIG_CMDID,
+    /** Enable or Disable Fast Initial Link Setup (FILS) feature */
+    WMI_ENABLE_FILS_CMDID,
 
     /** offload scan specific commands */
     /** set offload scan AP profile   */
@@ -696,6 +760,15 @@ typedef enum {
     /** One time request for wlan stats */
     WMI_REQUEST_WLAN_STATS_CMDID,
 
+    /** Request for getting RCPI of peer */
+    WMI_REQUEST_RCPI_CMDID,
+
+    /** One time request for peer stats info */
+    WMI_REQUEST_PEER_STATS_INFO_CMDID,
+
+    /** One time request for radio channel stats */
+    WMI_REQUEST_RADIO_CHAN_STATS_CMDID,
+
     /** ARP OFFLOAD REQUEST*/
     WMI_SET_ARP_NS_OFFLOAD_CMDID=WMI_CMD_GRP_START_ID(WMI_GRP_ARP_NS_OFL),
 
@@ -803,6 +876,8 @@ typedef enum {
     WMI_SET_MULTIPLE_MCAST_FILTER_CMDID,
     /** upload a requested section of data from firmware flash to host */
     WMI_READ_DATA_FROM_FLASH_CMDID,
+    /* Thermal Throttling SET CONF commands */
+    WMI_THERM_THROT_SET_CONF_CMDID,
 
     /* GPIO Configuration */
     WMI_GPIO_CONFIG_CMDID=WMI_CMD_GRP_START_ID(WMI_GRP_GPIO),
@@ -858,6 +933,13 @@ typedef enum {
     /* set udp pkt filter for wlan HB */
     WMI_HB_SET_UDP_PKT_FILTER_CMDID,
 
+    /* OIC ping keep alive */
+    WMI_HB_OIC_PING_OFFLOAD_PARAM_CMDID,
+    WMI_HB_OIC_PING_OFFLOAD_SET_ENABLE_CMDID,
+
+    /* WMI commands related to DHCP Lease Renew Offload **/
+    WMI_HB_DHCP_LEASE_RENEW_OFFLOAD_CMDID,
+
     /** Wlan RMC commands*/
     /** enable/disable RMC */
     WMI_RMC_SET_MODE_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_RMC),
@@ -884,6 +966,9 @@ typedef enum {
     /* OEM related cmd */
     WMI_OEM_REQ_CMDID=WMI_CMD_GRP_START_ID(WMI_GRP_OEM),
     WMI_OEM_REQUEST_CMDID, /* UNUSED */
+    /* OEM related cmd used for Low Power ranging */
+    WMI_LPI_OEM_REQ_CMDID,
+    WMI_OEM_DMA_RING_CFG_REQ_CMDID,
 
     /** Nan Request */
     WMI_NAN_CMDID=WMI_CMD_GRP_START_ID(WMI_GRP_NAN),
@@ -974,10 +1059,17 @@ typedef enum {
     WMI_BPF_GET_VDEV_STATS_CMDID,
     WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID,
     WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID,
+    WMI_BPF_SET_VDEV_ACTIVE_MODE_CMDID,
 
     /** WMI commands related to monitor mode. */
     WMI_MNT_FILTER_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_MONITOR),
 
+    /** WMI commands related to regulatory offload */
+    WMI_SET_CURRENT_COUNTRY_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_REGULATORY),
+    WMI_11D_SCAN_START_CMDID,
+    WMI_11D_SCAN_STOP_CMDID,
+    WMI_SET_INIT_COUNTRY_CMDID,
+
     /**
      * Nan Data commands
      * NDI - NAN Data Interface
@@ -988,6 +1080,13 @@ typedef enum {
     WMI_NDP_INITIATOR_REQ_CMDID,
     WMI_NDP_RESPONDER_REQ_CMDID,
     WMI_NDP_END_REQ_CMDID,
+
+    /** WMI commands related to HW data filtering **/
+    WMI_HW_DATA_FILTER_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_HW_DATA_FILTER),
+
+    /** WMI commands related to WLAN latency module **/
+    WMI_WLM_CONFIG_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_WLM),
+
 } WMI_CMD_ID;
 
 typedef enum {
@@ -1059,6 +1158,23 @@ typedef enum {
     WMI_PDEV_ANTDIV_STATUS_EVENTID,
     /** Chip level Power stats */
     WMI_PDEV_CHIP_POWER_STATS_EVENTID,
+    /** Power Save Failure Detected */
+    WMI_PDEV_CHIP_POWER_SAVE_FAILURE_DETECTED_EVENTID,
+
+    /* Event to report the switch count in csa of one or more VDEVs */
+    WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID,
+
+    /** Report the caldata version to host */
+    WMI_PDEV_CHECK_CAL_VERSION_EVENTID,
+
+    /** Report chain RSSI and antenna index to host */
+    WMI_PDEV_DIV_RSSI_ANTID_EVENTID,
+
+    /** provide noise floor and cycle counts for a channel */
+    WMI_PDEV_BSS_CHAN_INFO_EVENTID,
+
+    /** Response received the ctl table to host */
+    WMI_PDEV_UPDATE_CTLTABLE_EVENTID,
 
     /* VDEV specific events */
     /** VDEV started event in response to VDEV_START request */
@@ -1086,6 +1202,14 @@ typedef enum {
      * 802.11 DISA frame
      */
     WMI_VDEV_ENCRYPT_DECRYPT_DATA_RESP_EVENTID,
+    /** event to report mac randomization success **/
+    WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_STATUS_EVENTID,
+
+    /* event for ARP stats collection */
+    WMI_VDEV_GET_ARP_STAT_EVENTID,
+
+    /** get tx power event in response to VDEV_GET_TX_POWER request */
+    WMI_VDEV_GET_TX_POWER_EVENTID,
 
     /* peer specific events */
     /** FW reauet to kick out the station for reasons like inactivity,lack of response ..etc */
@@ -1120,6 +1244,8 @@ typedef enum {
     WMI_PEER_STA_PS_STATECHG_EVENTID,
     /** Peer Ant Div Info Event with rssi per chain, etc */
     WMI_PEER_ANTDIV_INFO_EVENTID,
+    /** Peer operating mode change indication sent to host to update stats */
+    WMI_PEER_OPER_MODE_CHANGE_EVENTID,
 
     /* beacon/mgmt specific events */
     /** RX management frame. the entire frame is carried along with the event.  */
@@ -1127,7 +1253,7 @@ typedef enum {
     /** software beacon alert event to Host requesting host to Queue a beacon for transmission
         use only in host beacon mode */
     WMI_HOST_SWBA_EVENTID,
-    /** beacon tbtt offset event indicating the tsf offset of the tbtt from the theritical value.
+    /** beacon tbtt offset event indicating the tsf offset of the tbtt from the theoretical value.
         tbtt offset is normally 0 and will be non zero if there are multiple VDEVs operating in
         staggered beacon transmission mode */
     WMI_TBTTOFFSET_UPDATE_EVENTID,
@@ -1146,8 +1272,13 @@ typedef enum {
      *   Use this event if number of vdevs > 32.
      */
     WMI_TBTTOFFSET_EXT_UPDATE_EVENTID,
+    /** Event for offchan data TX completion event */
+    WMI_OFFCHAN_DATA_TX_COMPLETION_EVENTID,
 
-    /*ADDBA Related WMI Events*/
+    /** software FILS Discovery Frame alert event to Host, requesting host to Queue an FD frame for transmission */
+    WMI_HOST_SWFDA_EVENTID,
+
+    /* ADDBA Related WMI Events*/
     /** Indication the completion of the prior
        WMI_PEER_TID_DELBA_CMDID(initiator) */
     WMI_TX_DELBA_COMPLETE_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_BA_NEG),
@@ -1168,6 +1299,8 @@ typedef enum {
     WMI_PROFILE_MATCH,
     /** roam synch event */
     WMI_ROAM_SYNCH_EVENTID,
+    /** roam synch frame event */
+    WMI_ROAM_SYNCH_FRAME_EVENTID,
 
     /** P2P disc found */
     WMI_P2P_DISC_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_P2P),
@@ -1232,6 +1365,18 @@ typedef enum {
      */
     WMI_REPORT_STATS_EVENTID,
 
+    /** Event indicating RCPI of the peer requested by host in the
+     * WMI_REQUEST_RCPI_CMDID */
+    WMI_UPDATE_RCPI_EVENTID,
+
+    /** This event is used to respond to WMI_REQUEST_PEER_STATS_INFO_CMDID
+     *  and report peer stats info to host */
+    WMI_PEER_STATS_INFO_EVENTID,
+
+    /** This event is used to respond to WMI_REQUEST_RADIO_CHAN_STATS_CMDID
+    *  and report radio channel stats to host */
+    WMI_RADIO_CHAN_STATS_EVENTID,
+
     /* NLO specific events */
     /** NLO match event after the first match */
     WMI_NLO_MATCH_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_NLO_OFL),
@@ -1256,6 +1401,12 @@ typedef enum {
     /*chatter query reply event*/
     WMI_CHATTER_PC_QUERY_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_CHATTER),
 
+    /** DFS related events */
+    WMI_PDEV_DFS_RADAR_DETECTION_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_DFS),
+    /** Indicate channel-availability-check completion event to host */
+    WMI_VDEV_DFS_CAC_COMPLETE_EVENTID,
+    /** Indicate off-channel-availability-check completion event to host */
+    WMI_VDEV_ADFS_OCAC_COMPLETE_EVENTID,
     /** echo event in response to echo command */
     WMI_ECHO_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_MISC),
 
@@ -1327,6 +1478,15 @@ typedef enum {
     /** event to report rx aggregation failure frame information */
     WMI_REPORT_RX_AGGR_FAILURE_EVENTID,
 
+    /** event to upload a PKGID to host to identify chip for various products */
+    WMI_PKGID_EVENTID,
+
+    /* Thermal Throttling stats event id for every pdev and zones, etc */
+    WMI_THERM_THROT_STATS_EVENTID,
+
+    /* WMI UNIT TEST event */
+    WMI_UNIT_TEST_EVENTID,
+
     /* GPIO Event */
     WMI_GPIO_INPUT_EVENTID=WMI_EVT_GRP_START_ID(WMI_GRP_GPIO),
     /** upload H_CV info WMI event
@@ -1358,6 +1518,8 @@ typedef enum {
     WMI_OEM_MEASUREMENT_REPORT_EVENTID, /* DEPRECATED */
     WMI_OEM_ERROR_REPORT_EVENTID, /* DEPRECATED */
     WMI_OEM_RESPONSE_EVENTID,
+    WMI_OEM_DMA_RING_CFG_RSP_EVENTID,
+    WMI_OEM_DMA_BUF_RELEASE_EVENTID,
 
     /* NAN Event */
     WMI_NAN_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_NAN),
@@ -1411,6 +1573,10 @@ typedef enum {
     WMI_BPF_CAPABILIY_INFO_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_BPF_OFFLOAD),
     WMI_BPF_VDEV_STATS_INFO_EVENTID,
 
+    /** WMI events related to regulatory offload */
+    WMI_REG_CHAN_LIST_CC_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_REGULATORY),
+    WMI_11D_NEW_COUNTRY_EVENTID,
+
     _place_holder_evt_1 = WMI_EVT_GRP_START_ID(WMI_GRP_RMC),
 
     /** Events in Prototyping phase */
@@ -1421,6 +1587,8 @@ typedef enum {
     WMI_NDP_INDICATION_EVENTID,
     WMI_NDP_CONFIRM_EVENTID,
     WMI_NDP_END_INDICATION_EVENTID,
+    WMI_WLAN_COEX_BT_ACTIVITY_EVENTID,
+    WMI_NDL_SCHEDULE_UPDATE_EVENTID,
 } WMI_EVT_ID;
 
 /* defines for OEM message sub-types */
@@ -1445,6 +1613,7 @@ typedef enum {
 #define WMI_SSID_LIST_TAG		 0x2
 #define WMI_BSSID_LIST_TAG		 0x3
 #define WMI_IE_TAG			 0x4
+#define WMI_SCAN_START_OFFSET_TAG        0x5
 
 typedef struct {
     A_UINT32 tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_channel */
@@ -1641,6 +1810,10 @@ WMI_CHANNEL_CHANGE_CAUSE_CSA,
 #define WMI_HE_FRAG_SUPPORT_MASK          0x00000018
 #define WMI_HE_FRAG_SUPPORT_SHIFT         3
 
+/* Interested readers refer to Rx/Tx MCS Map definition as defined in 802.11ax
+ */
+#define WMI_HE_MAX_MCS_4_SS_MASK(r,ss)      ((3 & (r)) << (((ss) - 1) << 1))
+
 /* fragmentation support field value */
 enum {
     WMI_HE_FRAG_SUPPORT_LEVEL0, /* No Fragmentation support */
@@ -1674,27 +1847,30 @@ enum {
  * Note that in these macros, "ru" is one-based, not zero-based, while
  * nssm1 is zero-based.
  */
-#define WMI_SET_PPET16(ppet16_ppet8_ru3_ru0, ppet, ru, nssm1) \
+#define WMI_SET_PPET16(ppet16_ppet8_ru3_ru0, ru, nssm1, ppet) \
     do { \
-        ppet16_ppet8_ru3_ru0[nssm1] &= ~(7 << (((ru-1)%4)*6));       \
-        ppet16_ppet8_ru3_ru0[nssm1] |= ((ppet&7) << (((ru-1)%4)*6)); \
+        ppet16_ppet8_ru3_ru0[nssm1] &= ~(7 << (((ru-1)&3)*6));       \
+        ppet16_ppet8_ru3_ru0[nssm1] |= ((ppet&7) << (((ru-1)&3)*6)); \
     } while (0)
 
 #define WMI_GET_PPET16(ppet16_ppet8_ru3_ru0, ru, nssm1) \
-    ((ppet16_ppet8_ru3_ru0[nssm1] >> (((ru-1)%4)*6))&7)
+    ((ppet16_ppet8_ru3_ru0[nssm1] >> (((ru-1)&3)*6))&7)
 
-#define WMI_SET_PPET8(ppet16_ppet8_ru3_ru0, ppet, ru, nssm1) \
+#define WMI_SET_PPET8(ppet16_ppet8_ru3_ru0, ru, nssm1, ppet) \
     do { \
-        ppet16_ppet8_ru3_ru0[nssm1] &= ~(7 << (((ru-1)%4)*6+3));       \
-        ppet16_ppet8_ru3_ru0[nssm1] |= ((ppet&7) << (((ru-1)%4)*6+3)); \
+        ppet16_ppet8_ru3_ru0[nssm1] &= ~(7 << (((ru-1)&3)*6+3));       \
+        ppet16_ppet8_ru3_ru0[nssm1] |= ((ppet&7) << (((ru-1)&3)*6+3)); \
     } while (0)
 
 #define WMI_GET_PPET8(ppet16_ppet8_ru3_ru0, ru, nssm1) \
-    ((ppet16_ppet8_ru3_ru0[nssm1] >> (((ru-1)%4)*6+3))&7)
+    ((ppet16_ppet8_ru3_ru0[nssm1] >> (((ru-1)&3)*6+3))&7)
 
 typedef struct _wmi_ppe_threshold {
     A_UINT32 numss_m1; /** NSS - 1*/
-    A_UINT32 ru_count; /** Max RU count */
+    union {
+        A_UINT32 ru_count; /** RU COUNT OBSOLETE to be removed after few versions */
+        A_UINT32 ru_mask; /** RU index mask */
+    };
     A_UINT32 ppet16_ppet8_ru3_ru0[WMI_MAX_NUM_SS]; /** ppet8 and ppet16 for max num ss */
 } wmi_ppe_threshold;
 
@@ -1759,13 +1935,17 @@ typedef struct _wmi_ppe_threshold {
 #define WMI_DBS_HW_MODE_AGILE_DFS_GET(hw_mode)          \
     ((hw_mode & WMI_DBS_HW_MODE_AGILE_DFS_MODE_MASK) >> WMI_DBS_HW_MODE_AGILE_DFS_MODE_BITPOS)
 
-#define WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_BITPOS    (31)
-#define WMI_DBS_CONC_SCAN_CFG_AGILE_SCAN_BITPOS   (30)
+#define WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_BITPOS        (31)
+#define WMI_DBS_CONC_SCAN_CFG_AGILE_SCAN_BITPOS      (30)
 #define WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_BITPOS  (29)
+#define WMI_DBS_CONC_SCAN_CFG_ASYNC_DBS_SCAN_BITPOS  (28)
+#define WMI_DBS_CONC_SCAN_CFG_SYNC_DBS_SCAN_BITPOS   (27)
 
-#define WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_MASK    (0x1 << WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_BITPOS)
-#define WMI_DBS_CONC_SCAN_CFG_AGILE_SCAN_MASK   (0x1 << WMI_DBS_CONC_SCAN_CFG_AGILE_SCAN_BITPOS)
-#define WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_MASK  (0x1 << WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_BITPOS)
+#define WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_MASK         (0x1 << WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_BITPOS)
+#define WMI_DBS_CONC_SCAN_CFG_AGILE_SCAN_MASK       (0x1 << WMI_DBS_CONC_SCAN_CFG_AGILE_SCAN_BITPOS)
+#define WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_MASK   (0x1 << WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_BITPOS)
+#define WMI_DBS_CONC_SCAN_CFG_ASYC_DBS_SCAN_MASK    (0x1 << WMI_DBS_CONC_SCAN_CFG_ASYNC_DBS_SCAN_BITPOS)
+#define WMI_DBS_CONC_SCAN_CFG_SYNC_DBS_SCAN_MASK    (0x1 << WMI_DBS_CONC_SCAN_CFG_SYNC_DBS_SCAN_BITPOS)
 
 #define WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_SET(scan_cfg, value) \
     WMI_SET_BITS(scan_cfg, WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_BITPOS, 1, value)
@@ -1773,6 +1953,10 @@ typedef struct _wmi_ppe_threshold {
     WMI_SET_BITS(scan_cfg, WMI_DBS_CONC_SCAN_CFG_AGILE_SCAN_BITPOS, 1, value)
 #define WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_SET(scan_cfg, value) \
     WMI_SET_BITS(scan_cfg, WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_BITPOS, 1, value)
+#define WMI_DBS_CONC_SCAN_CFG_ASYNC_DBS_SCAN_SET(scan_cfg, value) \
+    WMI_SET_BITS(scan_cfg, WMI_DBS_CONC_SCAN_CFG_ASYNC_DBS_SCAN_BITPOS, 1, value)
+#define WMI_DBS_CONC_SCAN_CFG_SYNC_DBS_SCAN_SET(scan_cfg, value) \
+    WMI_SET_BITS(scan_cfg, WMI_DBS_CONC_SCAN_CFG_SYNC_DBS_SCAN_BITPOS, 1, value)
 
 #define WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_GET(scan_cfg)    \
     ((scan_cfg & WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_MASK) >> WMI_DBS_CONC_SCAN_CFG_DBS_SCAN_BITPOS)
@@ -1780,22 +1964,33 @@ typedef struct _wmi_ppe_threshold {
     ((scan_cfg & WMI_DBS_CONC_SCAN_CFG_AGILE_SCAN_MASK) >> WMI_DBS_CONC_SCAN_CFG_AGILE_SCAN_BITPOS)
 #define WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_GET(scan_cfg)    \
     ((scan_cfg & WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_MASK) >> WMI_DBS_CONC_SCAN_CFG_AGILE_DFS_SCAN_BITPOS)
+#define WMI_DBS_CONC_SCAN_CFG_ASYNC_DBS_SCAN_GET(scan_cfg)    \
+    ((scan_cfg & WMI_DBS_CONC_SCAN_CFG_ASYC_DBS_SCAN_MASK) >> WMI_DBS_CONC_SCAN_CFG_ASYNC_DBS_SCAN_BITPOS)
+#define WMI_DBS_CONC_SCAN_CFG_SYNC_DBS_SCAN_GET(scan_cfg)    \
+    ((scan_cfg & WMI_DBS_CONC_SCAN_CFG_SYNC_DBS_SCAN_MASK) >> WMI_DBS_CONC_SCAN_CFG_SYNC_DBS_SCAN_BITPOS)
 
 #define WMI_DBS_FW_MODE_CFG_DBS_BITPOS          (31)
 #define WMI_DBS_FW_MODE_CFG_AGILE_DFS_BITPOS    (30)
+#define WMI_DBS_FW_MODE_CFG_DBS_FOR_CXN_BITPOS  (29)
 
-#define WMI_DBS_FW_MODE_CFG_DBS_MASK          (0x1 << WMI_DBS_FW_MODE_CFG_DBS_BITPOS)
-#define WMI_DBS_FW_MODE_CFG_AGILE_DFS_MASK    (0x1 << WMI_DBS_FW_MODE_CFG_AGILE_DFS_BITPOS)
+#define WMI_DBS_FW_MODE_CFG_DBS_MASK             (0x1 << WMI_DBS_FW_MODE_CFG_DBS_BITPOS)
+#define WMI_DBS_FW_MODE_CFG_AGILE_DFS_MASK       (0x1 << WMI_DBS_FW_MODE_CFG_AGILE_DFS_BITPOS)
+#define WMI_DBS_FW_MODE_CFG_DBS_FOR_CXN_DFS_MASK (0x1 << WMI_DBS_FW_MODE_CFG_DBS_FOR_CXN_BITPOS)
 
 #define WMI_DBS_FW_MODE_CFG_DBS_SET(fw_mode, value) \
     WMI_SET_BITS(fw_mode, WMI_DBS_FW_MODE_CFG_DBS_BITPOS, 1, value)
 #define WMI_DBS_FW_MODE_CFG_AGILE_DFS_SET(fw_mode, value) \
     WMI_SET_BITS(fw_mode, WMI_DBS_FW_MODE_CFG_AGILE_DFS_BITPOS, 1, value)
+#define WMI_DBS_FW_MODE_CFG_DBS_FOR_CXN_SET(fw_mode, value) \
+    WMI_SET_BITS(fw_mode, WMI_DBS_FW_MODE_CFG_DBS_FOR_CXN_BITPOS, 1, value)
 
 #define WMI_DBS_FW_MODE_CFG_DBS_GET(fw_mode)    \
     ((fw_mode & WMI_DBS_FW_MODE_CFG_DBS_MASK) >> WMI_DBS_FW_MODE_CFG_DBS_BITPOS)
 #define WMI_DBS_FW_MODE_CFG_AGILE_DFS_GET(fw_mode)    \
     ((fw_mode & WMI_DBS_FW_MODE_CFG_AGILE_DFS_MAS) >> WMI_DBS_FW_MODE_CFG_AGILE_DFS_BITPOS)
+#define WMI_DBS_FW_MODE_CFG_DBS_FOR_CXN_GET(fw_mode)    \
+    ((fw_mode & WMI_DBS_FW_MODE_CFG_DBS_FOR_CXN_DFS_MASK) >> WMI_DBS_FW_MODE_CFG_DBS_FOR_CXN_BITPOS)
+
 
 /** NOTE: This structure cannot be extended in the future without breaking WMI compatibility */
 typedef struct _wmi_abi_version {
@@ -1845,6 +2040,10 @@ typedef struct {
     A_UINT32    vht_supp_mcs; /* VHT Supported MCS Set field Rx/Tx same */
     A_UINT32    hw_min_tx_power;
     A_UINT32    hw_max_tx_power;
+    /* sys_cap_info:
+     * bits  1:0  - RXTX LED + RFKILL enable flags (see WMI_LEDRFKILL_FLAGS)
+     * bits 31:2  - reserved (must be set to zero)
+     */
     A_UINT32    sys_cap_info;
     A_UINT32    min_pkt_size_enable; /* Enterprise mode short pkt enable */
     /** Max beacon and Probe Response IE offload size (includes
@@ -1913,6 +2112,11 @@ typedef struct {
          */
 } wmi_service_ready_event_fixed_param;
 
+typedef enum {
+    WMI_RXTX_LED_ENABLE         = 0x00000001,
+    WMI_RFKILL_ENABLE           = 0x00000002,
+} WMI_LEDRFKILL_FLAGS;
+
 #define WMI_SERVICE_SEGMENT_BM_SIZE32 4 /* 4x A_UINT32 = 128 bits */
 typedef struct {
     /**
@@ -1973,6 +2177,7 @@ typedef enum {
     WMI_FW_AP_RTT_RESPR =      0x00000080,
     WMI_FW_NAN_RTT_INITR =     0x00000100,
     WMI_FW_NAN_RTT_RESPR =     0x00000200,
+    WMI_FW_SCAN_DBS_POLICY =   0x00000400,
     /*
      * New fw sub feature capabilites before
      * WMI_FW_MAX_SUB_FEAT_CAP
@@ -2047,9 +2252,41 @@ typedef A_UINT32 WLAN_INIT_STATUS;
 typedef struct {
     A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ready_event_fixed_param */
     wmi_abi_version fw_abi_vers;
+    /*
+     * mac_addr is always filled; in addition, there can be a mac_addr_list
+     * TLV following this fixed_param TLV to specify additional MAC addresses,
+     * for cases where the target specifies one MAC address per pdev
+     * (so the host can treat the pdevs within the target as separately
+     * as possible) rather than one MAC address for the whole SOC.
+     */
     wmi_mac_addr mac_addr;
     A_UINT32    status;
     A_UINT32 num_dscp_table;
+    /* num_extra_mac_addr -
+     * how many additional MAC addresses besides the above mac_addr
+     * are provided in the subsequent mac_addr_list TLV
+     */
+    A_UINT32 num_extra_mac_addr;
+    /*
+     * Total number of "real" peers (remote peers of an AP vdev,
+     * BSS peer of a STA vdev, TDLS peer of a STA vdev) that FW supports.
+     * If 0, then Host can use param_tlv->resource_config->num_peers as
+     * total number of peers.
+     */
+    A_UINT32 num_total_peers;
+    /*
+     * Number of extra peers that Firmware adds.
+     * These are self peers and/or other FW only peers that don't represent
+     * a 802.11 transceiver, but instead are used for convenience, e.g. to
+     * provide a pseudo-peer object for an AP vdev's bcast/mcast tx queues,
+     * to allow each tx queue to belong to a peer object.
+     * Peer ID can be up to num_total_peers + num_extra_peers.
+     */
+    A_UINT32 num_extra_peers;
+/*
+ * This fixed_param TLV is followed by these additional TLVs:
+ * mac_addr_list[num_extra_mac_addr];
+ */
 } wmi_ready_event_fixed_param;
 
 typedef struct {
@@ -2359,6 +2596,11 @@ typedef struct {
     #define WMI_RSRC_CFG_FLAG_TX_MSDU_ID_NEW_PARTITION_SUPPORT_S 10
     #define WMI_RSRC_CFG_FLAG_TX_MSDU_ID_NEW_PARTITION_SUPPORT_M 0x400
 
+    #define WMI_RSRC_CFG_FLAG_TX_PPDU_STATS_ENABLE_S 11
+    #define WMI_RSRC_CFG_FLAG_TX_PPDU_STATS_ENABLE_M 0x800
+
+    #define WMI_RSRC_CFG_FLAG_TCL_CCE_DISABLE_S 12
+    #define WMI_RSRC_CFG_FLAG_TCL_CCE_DISABLE_M 0x1000
 
     A_UINT32 flag1;
 
@@ -2407,6 +2649,28 @@ typedef struct {
      * which is using MAC ID. 1 means PDEV ID, 0 means MAC ID.
      */
     A_UINT32 use_pdev_id;
+
+    /** Maximum number of scan clients whose DBS scan duty cycle can be configured */
+    A_UINT32 max_num_dbs_scan_duty_cycle;
+
+    /** Maximum number of Multi group key to support */
+    A_UINT32 max_num_group_keys;
+
+    /**
+     * HTT peer map/unmap V2 format support
+     * 0 -> host doesn't support HTT peer map/unmap v2 format.
+     * 1 -> host supports HTT peer map/unmap v2 format; the target is
+     *      allowed but not required to use peer map/unmap v2 format.
+     */
+    A_UINT32 peer_map_unmap_v2_support;
+
+    /** Sched config params for all pdevs
+     * These tx scheduling configuration parameters are currently only
+     * used for internal testing purposes; therefore the non-default
+     * values for this field are not currently documented.
+     * For regular use, this field should be set to 0x0.
+     */
+    A_UINT32 sched_params;
 } wmi_resource_config;
 
 #define WMI_RSRC_CFG_FLAG_SET(word32, flag, value) \
@@ -2474,6 +2738,11 @@ typedef struct {
 #define WMI_RSRC_CFG_FLAG_TX_MSDU_ID_NEW_PARTITION_SUPPORT_GET(word32) \
     WMI_RSRC_CFG_FLAG_GET((word32), TX_MSDU_ID_NEW_PARTITION_SUPPORT)
 
+#define WMI_RSRC_CFG_FLAG_TCL_CCE_DISABLE_SET(word32, value) \
+    WMI_RSRC_CFG_FLAG_SET((word32), TCL_CCE_DISABLE, (value))
+#define WMI_RSRC_CFG_FLAG_TCL_CCE_DISABLE_GET(word32) \
+    WMI_RSRC_CFG_FLAG_GET((word32), TCL_CCE_DISABLE)
+
 typedef struct {
     A_UINT32   tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_init_cmd_fixed_param */
 
@@ -2567,6 +2836,35 @@ typedef struct {
     wmi_ssid ssids[1];
 } wmi_ssid_list;
 
+typedef struct {
+    /** WMI_SCAN_START_OFFSET_TAG */
+    A_UINT32     tag;
+    /** Number of start TSF offsets */
+    A_UINT32     num_offset;
+    /** Array of start TSF offsets provided in milliseconds */
+    A_UINT32     start_tsf_offset[1];
+} wmi_scan_start_offset;
+
+/**
+ * WLAN_SCAN_CHAN_MODE Macros defined for A_UINT8 phymode_list[]
+ */
+/** enum WLAN_PHY_MODE _mode starts from 0, but the WMI message requires
+ * 0 to be used to represent unspecified / don't care / default values.
+ * Therefore, WMI phy mode = WLAN phy mode + 1.
+ */
+/** If the received WMI phy mode is 0 then it is ignored by the FW,
+ * and the FW will use any mode as long as the frequency matches.
+ */
+/** The number of phy_mode's (BW+mode) passed in the TLV phymode_list[] must
+ * be equal to num_chan.  (Unless the host does not specify phymode_list values
+ * at all, in which case the number of phymode_list elements will be zero.)
+ * The indexing of the phymode_list[] array corresponds to same index of
+ * the chan_list[] array.
+ */
+#define WMI_SCAN_CHAN_SET_MODE(_c) ((_c) + 1)
+#define WMI_SCAN_CHAN_GET_MODE(_c) ((_c) - 1)
+#define WMI_SCAN_CHAN_MODE_IS_SET(_c) (_c)
+
 /* prefix used by scan requestor ids on the host */
 #define WMI_HOST_SCAN_REQUESTOR_ID_PREFIX 0xA000
 /* prefix used by scan request ids generated on the host */
@@ -2577,11 +2875,14 @@ typedef struct {
 #define WLAN_SCAN_PARAMS_MAX_BSSID   4
 #define WLAN_SCAN_PARAMS_MAX_IE_LEN  512
 
+/* NOTE: This constant cannot be changed without breaking WMI compatibility */
+#define WMI_IE_BITMAP_SIZE 8
+
 typedef struct {
     A_UINT32 tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_start_scan_cmd_fixed_param */
-    /** Scan ID */
+    /** Scan ID (lower 16 bits) MSB 4 bits is used to identify scan client based on enum WMI_SCAN_CLIENT_ID */
     A_UINT32 scan_id;
-    /** Scan requestor ID */
+    /** Scan requestor ID (lower 16 bits) is used by scan client to classify the scan source, reason, ...etc */
     A_UINT32 scan_req_id;
     /** VDEV id(interface) that is requesting scan */
     A_UINT32 vdev_id;
@@ -2631,16 +2932,27 @@ typedef struct {
     A_UINT32 ie_len;
     /** Max number of probes to be sent */
     A_UINT32 n_probes;
+    /** MAC Address to use in Probe Req as SA **/
+    wmi_mac_addr mac_addr;
+    /** Mask on which MAC has to be randomized **/
+    wmi_mac_addr mac_mask;
+    /**  ie bitmap to use in probe req **/
+    A_UINT32 ie_bitmap[WMI_IE_BITMAP_SIZE];
+    /** Number of vendor OUIs. In the TLV vendor_oui[] **/
+    A_UINT32 num_vendor_oui;
+    /** Scan control flags extended **/
+    A_UINT32 scan_ctrl_flags_ext;
 
-
-    /**
-         * TLV (tag length value ) parameters follow the scan_cmd
-         * structure. The TLV's are:
-         *     A_UINT32 channel_list[];
-         *     wmi_ssid ssid_list[];
-         *     wmi_mac_addr bssid_list[];
-         *     A_UINT8 ie_data[];
-         */
+/**
+ * TLV (tag length value ) parameters follow the scan_cmd
+ * structure. The TLV's are:
+ *     A_UINT32 channel_list[num_chan];
+ *     wmi_ssid ssid_list[num_ssids];
+ *     wmi_mac_addr bssid_list[num_bssid];
+ *     A_UINT8 ie_data[ie_len];
+ *     wmi_vendor_oui vendor_oui[num_vendor_oui];
+ *     A_UINT8 phymode_list[0 or num_chan]; // see WMI_SCAN_CHAN_MODE macros
+ */
 } wmi_start_scan_cmd_fixed_param;
 
 /**
@@ -2689,6 +3001,8 @@ typedef struct {
 #define WMI_SCAN_FLAG_HALF_RATE_SUPPORT      0x20000
 /** set Quarter (5MHz) rate support */
 #define WMI_SCAN_FLAG_QUARTER_RATE_SUPPORT   0x40000
+#define WMI_SCAN_RANDOM_SEQ_NO_IN_PROBE_REQ 0x80000
+#define WMI_SCAN_ENABLE_IE_WHTELIST_IN_PROBE_REQ 0x100000
 
 /** for adaptive scan mode using 3 bits (21 - 23 bits) */
 #define WMI_SCAN_DWELL_MODE_MASK 0x00E00000
@@ -2725,6 +3039,22 @@ typedef enum {
 #define WMI_SCN_STOP_VAP_ALL    0x01000000
 #define WMI_SCAN_STOP_ALL       0x04000000
 
+/** extended Scan ctrl flags **/
+#define WMI_SCAN_FLAG_EXT_DBS_SCAN_POLICY_MASK 0x00000003 /* Bit 0-1 reserved for DBS scan selection policy.*/
+
+#define WMI_SCAN_DBS_POLICY_DEFAULT             0x0 /** Select duty cycle if configured, else fall back to whatever
+                                                        policy scan manager computes */
+#define WMI_SCAN_DBS_POLICY_FORCE_NONDBS        0x1 /** Force to select Non-DBS scan */
+#define WMI_SCAN_DBS_POLICY_IGNORE_DUTY         0x2 /** Ignore duty cycle even if configured and fall back to whatever
+                                                        policy scan manager computes*/
+#define WMI_SCAN_DBS_POLICY_RESERVED            0x3
+#define WMI_SCAN_DBS_POLICY_MAX                 0x3
+
+/** Enable Reception of Public Action frame with this flag
+ * (inside scan_ctrl_flags_ext field of wmi_start_scan_cmd_fixed_param)
+ */
+#define WMI_SCAN_FLAG_EXT_FILTER_PUBLIC_ACTION_FRAME      0x4
+
 typedef struct {
     A_UINT32 tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_stop_scan_cmd_fixed_param */
     /** requestor requesting cancel  */
@@ -2735,7 +3065,8 @@ typedef struct {
     * Req Type
     * req_type should be WMI_SCAN_STOP_ONE, WMI_SCN_STOP_VAP_ALL or WMI_SCAN_STOP_ALL
     * WMI_SCAN_STOP_ONE indicates to stop a specific scan with scan_id
-    * WMI_SCN_STOP_VAP_ALL indicates to stop all scan requests on a specific vDev with vdev_id
+    * WMI_SCN_STOP_VAP_ALL indicates to stop all scan requests on a specific
+    * vDev with vdev_id and pdev with pdev_id
     * WMI_SCAN_STOP_ALL indicates to stop all scan requests in both Scheduler's queue and Scan Engine
     */
     A_UINT32 req_type;
@@ -2744,6 +3075,11 @@ typedef struct {
     * used when req_type equals to WMI_SCN_STOP_VAP_ALL, it indexed the vDev on which to stop the scan
     */
     A_UINT32 vdev_id;
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     * In non-DBDC case host should set it to 0
+     */
+    A_UINT32 pdev_id;
 } wmi_stop_scan_cmd_fixed_param;
 
 #define MAX_NUM_CHAN_PER_WMI_CMD     58    // each WMI cmd can hold 58 channel entries at most
@@ -2753,6 +3089,7 @@ typedef struct {
     A_UINT32 tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_scan_chan_list_cmd_fixed_param */
     A_UINT32 num_scan_chans;  /** no of elements in chan_info[] */
     A_UINT32 flags; /* Flags used to control the behavior of channel list update on target side */
+    A_UINT32 pdev_id; /* pdev_id for identifying the MAC. See macros starting with WMI_PDEV_ID_ for values */
     /** Followed by the variable length TLV chan_info:
      *  wmi_channel chan_info[] */
 } wmi_scan_chan_list_cmd_fixed_param;
@@ -2792,6 +3129,12 @@ typedef struct {
     * for WLAN_M_STA type, there are 3 entries in the table (refer to default_scan_priority_mapping_table definition)
     */
     A_UINT32                    number_rows;
+    /**
+     * pdev_id for identifying the MAC.  See macros starting with
+     * WMI_PDEV_ID_ for values.In non-DBDC case host should
+     * set it to 0.
+     */
+    A_UINT32 pdev_id;
     /**  mapping_table for a specific vdev follows this TLV
       *   WLAN_PRIORITY_MAPPING mapping_table[]; */
 }wmi_scan_sch_priority_table_cmd_fixed_param;
@@ -2815,8 +3158,22 @@ typedef struct {
     A_UINT32 min_rest_time;
     /** min rest time. Only valid if WMI_SCAN_UPDATE_MAX_REST_TIME flag is set in scan_update_flag */
     A_UINT32 max_rest_time;
+    /**
+     * pdev_id for identifying the MAC. See macros starting with
+     * WMI_PDEV_ID_ for values. In non-DBDC case host should set it to 0
+     */
+    A_UINT32 pdev_id;
 } wmi_scan_update_request_cmd_fixed_param;
 
+#define WMI_SCAN_PROBE_OUI_SPOOFED_MAC_IN_PROBE_REQ 0x1
+#define WMI_SCAN_PROBE_OUI_RANDOM_SEQ_NO_IN_PROBE_REQ 0x2
+#define WMI_SCAN_PROBE_OUI_ENABLE_IE_WHITELIST_IN_PROBE_REQ 0x4
+
+typedef struct _wmi_vendor_oui {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vendor_oui */
+    A_UINT32 oui_type_subtype; /** Vendor OUI type and subtype, lower 3 bytes is type and highest byte is subtype**/
+}wmi_vendor_oui;
+
 typedef struct {
     A_UINT32 tlv_header;
     /** oui to be used in probe request frame when  random mac addresss is
@@ -2824,6 +3181,20 @@ typedef struct {
      * host initated scans. host can request for random mac address with
      * WMI_SCAN_ADD_SPOOFED_MAC_IN_PROBE_REQ flag.     */
     A_UINT32 prob_req_oui;
+    A_UINT32 vdev_id;
+    /** Control Flags **/
+    A_UINT32 flags;
+    /**  ie bitmap to use in probe req **/
+    A_UINT32 ie_bitmap[WMI_IE_BITMAP_SIZE];
+    /** Number of vendor OUIs. In the TLV vendor_oui[] **/
+    A_UINT32 num_vendor_oui;
+    /**
+     * pdev_id for identifying the MAC. See macros starting with
+     * WMI_PDEV_ID_ for values. In non-DBDC case host should set it to 0
+     */
+    A_UINT32 pdev_id;
+    /* Following this tlv, there comes an array of structure of type wmi_vendor_ouiwmi_vendor_oui vendor_oui[];*/
+
 } wmi_scan_prob_req_oui_cmd_fixed_param;
 
 enum wmi_scan_event_type {
@@ -2867,6 +3238,12 @@ typedef struct {
     A_UINT32 scan_id;
     /**id of VDEV that requested the scan */
     A_UINT32 vdev_id;
+    /** TSF Timestamp when the scan event (wmi_scan_event_type) is completed
+     * In case of AP it is TSF of the AP vdev
+     * In case of STA connected state this is the TSF of the AP
+     * In case of STA not connected it will be the free running HW timer
+     */
+    A_UINT32 tsf_timestamp;
 } wmi_scan_event_fixed_param;
 
 /* WMI Diag event */
@@ -2878,6 +3255,99 @@ typedef struct {
     /* followed by WMITLV_TAG_ARRAY_BYTE */
 } wmi_diag_event_fixed_param;
 
+#define WMI_MAX_PMKID_LEN   16
+#define WMI_MAX_PMK_LEN     64
+
+#define WMI_PMK_CACHE_CAT_FLAG_BSSID              0x1
+#define WMI_PMK_CACHE_CAT_FLAG_SSID_CACHE_ID      0x2
+
+#define WMI_PMK_CACHE_ACTION_FLAG_ADD_ENTRY       0x1
+#define WMI_PMK_CACHE_ACTION_FLAG_DEL_ENTRY       0x2
+
+typedef struct {
+    A_UINT32       tlv_header;
+    A_UINT32       pmk_len;
+    A_UINT8        pmk[WMI_MAX_PMK_LEN];/* for big-endian hosts, manual endian conversion will be needed to keep the array values in their original order,
+                                        in spite of the automatic byte-swap applied to WMI messages during download*/
+    A_UINT32       pmkid_len;
+    A_UINT8        pmkid[WMI_MAX_PMKID_LEN];
+    wmi_mac_addr   bssid;
+    wmi_ssid       ssid;
+    A_UINT32       cache_id;
+    A_UINT32       cat_flag;  // whether (bssid) or (ssid,cache_id) is valid
+    A_UINT32       action_flag;  // add/delete the entry
+} wmi_pmk_cache;
+
+#define WMI_PMK_CACHE_OP_FLAG_FLUSH_ALL       0x1
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_update_pmk_cache_cmd_fixed_param */
+    A_UINT32 op_flag;   //option to flush all the cache at once
+    A_UINT32 vdev_id;
+    A_UINT32 num_cache;
+    /**
+    * TLV (tag length value) parameters follow the update_pmk_cache cmd
+    * structure. The TLV's are:
+     * wmi_pmk_cache cache_list[];
+    */
+} wmi_pdev_update_pmk_cache_cmd_fixed_param;
+
+#define WMI_FILS_MAX_USERNAME_LEN 16
+#define WMI_FILS_MAX_REALM_LEN 256
+#define WMI_FILS_MAX_RRK_LEN 64
+#define WMI_FILS_MAX_RIK_LEN 64
+
+/* for big-endian hosts, manual endian conversion will be needed to keep the array values in their original order,
+in spite of the automatic byte-swap applied to WMI messages during download*/
+
+typedef struct {
+    A_UINT8     username[WMI_FILS_MAX_USERNAME_LEN];
+    A_UINT32    username_length;
+    A_UINT32    next_erp_seq_num;
+    A_UINT8     rRk[WMI_FILS_MAX_RRK_LEN];
+    A_UINT32    rRk_length;
+    A_UINT8     rIk[WMI_FILS_MAX_RIK_LEN];
+    A_UINT32    rIk_length;
+    A_UINT8     realm[WMI_FILS_MAX_REALM_LEN];
+    A_UINT32    realm_len;
+} wmi_erp_info;
+
+enum wmi_fils_hlp_pkt_type {
+    WMI_FILS_HLP_PKT_TYPE_DHCP_DISCOVER = 1,
+};
+
+typedef struct {
+    A_UINT32      tlv_header;  /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_fils_offload_tlv_param */
+    A_UINT32      flags;
+    wmi_erp_info  vdev_erp_info;
+} wmi_roam_fils_offload_tlv_param;
+
+typedef struct {
+    A_UINT32  tlv_header; /** tag WMITLV_TAG_STRUC_wmi_pdev_update_fils_hlp_pkt_cmd_fixed_param**/
+    A_UINT32  flags;
+    A_UINT32  vdev_id;
+    A_UINT32  size;
+    A_UINT32  pkt_type; // filled using enum wmi_fils_hlp_pkt_type
+ // A_UINT8          fils_hlp_pkt[];
+} wmi_pdev_update_fils_hlp_pkt_cmd_fixed_param;
+
+#define WMI_MAX_KEK_LEN 64
+#define GTK_OFFLOAD_KEK_EXTENDED_BYTES WMI_MAX_KEK_LEN /*KEK len has been increased to 64 to support FILS security.
+                                          To not break backward compatibility, new GTK_OFFLOAD_KEK_EXTENDED_BYTES has been defined without modifying old GTK_OFFLOAD_KEK_BYTES */
+
+typedef struct {
+    A_UINT32   tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_fils_synch_tlv_param */
+    A_UINT32   update_erp_next_seq_num;// Boolean denoting whether next erp_seq_num changed or not.
+    A_UINT32   next_erp_seq_num;
+    A_UINT32   kek_len;
+    A_UINT8    kek[WMI_MAX_KEK_LEN];
+    A_UINT32   pmk_len;
+    A_UINT8    pmk[WMI_MAX_PMK_LEN];
+    A_UINT8    pmkid[WMI_MAX_PMKID_LEN];
+    A_UINT8    realm[WMI_FILS_MAX_REALM_LEN];
+    A_UINT32   realm_len;
+} wmi_roam_fils_synch_tlv_param;
+
 /*
 * If FW has multiple active channels due to MCC(multi channel concurrency),
 * then these stats are combined stats for all the active channels.
@@ -2915,12 +3385,14 @@ typedef struct {
  /* ATH_MAX_ANTENNA value (4) can't be changed without breaking the compatibility */
 #define ATH_MAX_ANTENNA 4 /* To support beelinear, which is up to 4 chains */
 
-/** flag indicating that the the  mgmt frame (probe req/beacon) is received in the context of extscan performed by FW */
+/** flag indicating that the mgmt frame (probe req/beacon) is received in the context of extscan performed by FW */
 #define WMI_MGMT_RX_HDR_EXTSCAN     0x01
 
-/** flag indicating that the the  mgmt frame (probe req/beacon) is received in the context of matched network by FW ENLO */
+/** flag indicating that the mgmt frame (probe req/beacon) is received in the context of matched network by FW ENLO */
 #define WMI_MGMT_RX_HDR_ENLO     0x02
 
+#define MAX_ANTENNA_EIGHT  8
+
 typedef struct {
     A_UINT32 tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_mgmt_rx_hdr */
     /** channel on which this frame is received. */
@@ -2961,12 +3433,31 @@ typedef struct {
      */
     A_UINT32 rx_tsf_u32;
 
+    /** pdev_id for identifying the MAC the rx mgmt frame was received by
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
     /* This TLV is followed by array of bytes:
          * // management frame buffer
          *   A_UINT8 bufp[];
          */
+/* This TLV is optionally followed by array of struct:
+ *  wmi_rssi_ctl_ext rssi_ctl_ext;
+ */
 } wmi_mgmt_rx_hdr;
 
+/*
+ * Instead of universally increasing the RX_HDR_HEADROOM size which may cause problems for older targets,
+ * this new ext_hdr can be used for extending the header and will be only applicable for new targets.
+ */
+typedef struct
+{
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_rssi_ctl_ext */
+    /** RSSI of PRI 20MHz for each chain, in dB w.r.t. noise floor */
+    A_UINT32 rssi_ctl_ext[MAX_ANTENNA_EIGHT - ATH_MAX_ANTENNA];
+} wmi_rssi_ctl_ext;
+
 typedef struct {
     /** TSF timestamp */
     A_UINT32 tsf_timestamp;
@@ -3027,6 +3518,41 @@ typedef struct {
     A_UINT32 buf_len;
 } wmi_single_phyerr_rx_hdr;
 
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_single_phyerr_ext_rx_hdr */
+    /**
+     * RSSI on chain 4 through 7 in dB w.r.t noise floor.
+     *
+     * This is formatted the same as the PPDU_START RX descriptor
+     * field:
+     *
+     * [7:0]:   pri20
+     * [15:8]:  sec20
+     * [23:16]: sec40
+     * [31:24]: sec80
+     */
+    A_UINT32 rssi_chain4;
+    A_UINT32 rssi_chain5;
+    A_UINT32 rssi_chain6;
+    A_UINT32 rssi_chain7;
+    /**
+     * Last calibrated NF value for chain 4 through 7 in dbm
+     *
+     * nf_list_3:
+     * + [15:0] - chain 4
+     * + [31:16] - chain 5
+     *
+     * nf_list_4:
+     * + [15:0] - chain 6
+     * + [31:16] - chain 7
+     *
+     * Each chain's noise floor is stored as a sign-extended (negative)
+     * value in dBm units.
+     */
+    A_UINT32 nf_list_3;
+    A_UINT32 nf_list_4;
+} wmi_single_phyerr_ext_rx_hdr;
+
 #define WMI_UNIFIED_FREQINFO_1_LO   0x000000ff
 #define WMI_UNIFIED_FREQINFO_1_LO_S 0
 #define WMI_UNIFIED_FREQINFO_1_HI   0x0000ff00
@@ -3092,10 +3618,23 @@ typedef struct {
 #define WMI_UNIFIED_CHAIN_3     0xffff0000
 #define WMI_UNIFIED_CHAIN_3_S   16
 
+#define WMI_UNIFIED_CHAIN_4     0x0000ffff
+#define WMI_UNIFIED_CHAIN_4_S   0
+#define WMI_UNIFIED_CHAIN_5     0xffff0000
+#define WMI_UNIFIED_CHAIN_5_S   16
+#define WMI_UNIFIED_CHAIN_6     0x0000ffff
+#define WMI_UNIFIED_CHAIN_6_S   0
+#define WMI_UNIFIED_CHAIN_7     0xffff0000
+#define WMI_UNIFIED_CHAIN_7_S   16
+
 #define WMI_UNIFIED_CHAIN_0_FIELD   nf_list_1
 #define WMI_UNIFIED_CHAIN_1_FIELD   nf_list_1
 #define WMI_UNIFIED_CHAIN_2_FIELD   nf_list_2
 #define WMI_UNIFIED_CHAIN_3_FIELD   nf_list_2
+#define WMI_UNIFIED_CHAIN_4_FIELD   nf_list_3
+#define WMI_UNIFIED_CHAIN_5_FIELD   nf_list_3
+#define WMI_UNIFIED_CHAIN_6_FIELD   nf_list_4
+#define WMI_UNIFIED_CHAIN_7_FIELD   nf_list_4
 
 #define WMI_UNIFIED_NF_CHAIN_GET(hdr, c)                                    \
             ((int16_t) (WMI_F_MS((hdr)->WMI_UNIFIED_CHAIN_##c##_FIELD,      \
@@ -3174,6 +3713,10 @@ typedef struct {
          * // header - payload, header - payload...
          *  (The header is of type: wmi_single_phyerr_rx_hdr)
          *   A_UINT8 bufp[];
+         *     The extension hdr will repeat num_phyerr_events of times
+         *     and will have 1:1 mapping with above header. i.e the 1st
+         *     ext_rx_hdr will belong to 1st phyerr_rx_hdr and so on.
+         *   wmi_single_phyerr_ext_rx_hdr single_phyerr_ext;
          */
 } wmi_comb_phyerr_rx_hdr;
 
@@ -3196,6 +3739,167 @@ typedef struct {
          */
 } wmi_mgmt_tx_hdr;
 
+#define WMI_TX_SEND_PARAM_PWR_GET(tx_param_dword0) WMI_GET_BITS(tx_param_dword0, 0, 8)
+#define WMI_TX_SEND_PARAM_PWR_SET(tx_param_dword0, value) WMI_SET_BITS(tx_param_dword0, 0, 8, value)
+
+#define WMI_TX_SEND_PARAM_MCS_MASK_GET(tx_param_dword0) WMI_GET_BITS(tx_param_dword0, 8, 12)
+#define WMI_TX_SEND_PARAM_MCS_MASK_SET(tx_param_dword0, value) WMI_SET_BITS(tx_param_dword0, 8, 12, value)
+
+#define WMI_TX_SEND_PARAM_NSS_MASK_GET(tx_param_dword0) WMI_GET_BITS(tx_param_dword0, 20, 8)
+#define WMI_TX_SEND_PARAM_NSS_MASK_SET(tx_param_dword0, value) WMI_SET_BITS(tx_param_dword0, 20, 8, value)
+
+#define WMI_TX_SEND_PARAM_RETRY_LIMIT_GET(tx_param_dword0) WMI_GET_BITS(tx_param_dword0, 28, 4)
+#define WMI_TX_SEND_PARAM_RETRY_LIMIT_SET(tx_param_dword0, value) WMI_SET_BITS(tx_param_dword0, 28, 4, value)
+
+#define WMI_TX_SEND_PARAM_CHAIN_MASK_GET(tx_param_dword1) WMI_GET_BITS(tx_param_dword1, 0, 8)
+#define WMI_TX_SEND_PARAM_CHAIN_MASK_SET(tx_param_dword1, value) WMI_SET_BITS(tx_param_dword1, 0, 8, value)
+
+#define WMI_TX_SEND_PARAM_BW_MASK_GET(tx_param_dword1) WMI_GET_BITS(tx_param_dword1, 8, 7)
+#define WMI_TX_SEND_PARAM_BW_MASK_SET(tx_param_dword1, value) WMI_SET_BITS(tx_param_dword1, 8, 7, value)
+
+#define WMI_TX_SEND_PARAM_PREAMBLE_GET(tx_param_dword1) WMI_GET_BITS(tx_param_dword1, 15, 5)
+#define WMI_TX_SEND_PARAM_PREAMBLE_SET(tx_param_dword1, value) WMI_SET_BITS(tx_param_dword1, 15, 5, value)
+
+#define WMI_TX_SEND_PARAM_FRAME_TYPE_GET(tx_param_dword1) WMI_GET_BITS(tx_param_dword1, 20, 1)
+#define WMI_TX_SEND_PARAM_FRAME_TYPE_SET(tx_param_dword1, value) WMI_SET_BITS(tx_param_dword1, 20, 1, value)
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_tx_send_params */
+
+    union {
+        struct {
+            /* DWORD 0: tx power, tx rate, retry_limit */
+            A_UINT32
+                /* pwr -
+                 * Specify what power the tx frame needs to be transmitted at.
+                 * The power a signed (two's complement) value is in units of 0.5 dBm.
+                 * The value needs to be appropriately sign-extended when extracting
+                 * the value from the message and storing it in a variable that is
+                 * larger than A_INT8.  (fw automatically handles this sign-extension.)
+                 * If the transmission uses multiple tx chains, this power spec is
+                 * the total transmit power, assuming incoherent combination of
+                 * per-chain power to produce the total power.
+                 */
+                 pwr: 8,
+
+                /* mcs_mask -
+                 * Specify the allowable values for MCS index (modulation and coding)
+                 * to use for transmitting the frame.
+                 *
+                 * For HT / VHT preamble types, this mask directly corresponds to
+                 * the HT or VHT MCS indices that are allowed.  For each bit N set
+                 * within the mask, MCS index N is allowed for transmitting the frame.
+                 * For legacy CCK and OFDM rates, separate bits are provided for CCK
+                 * rates versus OFDM rates, so the host has the option of specifying
+                 * that the target must transmit the frame with CCK or OFDM rates
+                 * (not HT or VHT), but leaving the decision to the target whether
+                 * to use CCK or OFDM.
+                 *
+                 * For CCK and OFDM, the bits within this mask are interpreted as
+                 * follows:
+                 *     bit  0 -> CCK 1 Mbps rate is allowed
+                 *     bit  1 -> CCK 2 Mbps rate is allowed
+                 *     bit  2 -> CCK 5.5 Mbps rate is allowed
+                 *     bit  3 -> CCK 11 Mbps rate is allowed
+                 *     bit  4 -> OFDM BPSK modulation, 1/2 coding rate is allowed
+                 *     bit  5 -> OFDM BPSK modulation, 3/4 coding rate is allowed
+                 *     bit  6 -> OFDM QPSK modulation, 1/2 coding rate is allowed
+                 *     bit  7 -> OFDM QPSK modulation, 3/4 coding rate is allowed
+                 *     bit  8 -> OFDM 16-QAM modulation, 1/2 coding rate is allowed
+                 *     bit  9 -> OFDM 16-QAM modulation, 3/4 coding rate is allowed
+                 *     bit 10 -> OFDM 64-QAM modulation, 2/3 coding rate is allowed
+                 *     bit 11 -> OFDM 64-QAM modulation, 3/4 coding rate is allowed
+                 *
+                 * The MCS index specification needs to be compatible with the
+                 * bandwidth mask specification.  For example, a MCS index == 9
+                 * specification is inconsistent with a preamble type == VHT,
+                 * Nss == 1, and channel bandwidth == 20 MHz.
+                 *
+                 * Furthermore, the host has only a limited ability to specify to
+                 * the target to select from HT + legacy rates, or VHT + legacy rates,
+                 * since this mcs_mask can specify either HT/VHT rates or legacy rates.
+                 * If no bits are set, target can choose what MCS type to use.
+                 */
+                 mcs_mask: 12,
+
+                /* nss_mask -
+                 * Specify which numbers of spatial streams (MIMO factor) are permitted.
+                 * Each bit in this mask corresponds to a Nss value:
+                 *     bit 0: if set, Nss = 1 (non-MIMO) is permitted
+                 *     bit 1: if set, Nss = 2 (2x2 MIMO) is permitted
+                 *     bit 2: if set, Nss = 3 (3x3 MIMO) is permitted
+                 *     bit 3: if set, Nss = 4 (4x4 MIMO) is permitted
+                 *     bit 4: if set, Nss = 5 (5x5 MIMO) is permitted
+                 *     bit 5: if set, Nss = 6 (6x6 MIMO) is permitted
+                 *     bit 6: if set, Nss = 7 (7x7 MIMO) is permitted
+                 *     bit 7: if set, Nss = 8 (8x8 MIMO) is permitted
+                 * The values in the Nss mask must be suitable for the recipient, e.g.
+                 * a value of 0x4 (Nss = 3) cannot be specified for a tx frame to a
+                 * recipient which only supports 2x2 MIMO.
+                 * If no bits are set, target can choose what NSS type to use.
+                 */
+                 nss_mask: 8,
+
+                /* retry_limit -
+                 * Specify the maximum number of transmissions, including the
+                 * initial transmission, to attempt before giving up if no ack
+                 * is received.
+                 * If the tx rate is specified, then all retries shall use the
+                 * same rate as the initial transmission.
+                 * If no tx rate is specified, the target can choose whether to
+                 * retain the original rate during the retransmissions, or to
+                 * fall back to a more robust rate.
+                 */
+                 retry_limit: 4;
+
+       };
+       A_UINT32 tx_param_dword0;
+    };
+
+    union {
+        struct {
+            /* DWORD 1: tx chain mask, preamble_type, tx BW */
+            A_UINT32
+                /* chain_mask - specify which chains to transmit from
+                 * If not set, target will choose what chain_mask to use.
+                 */
+                 chain_mask: 8,
+
+                /* The bits in this mask correspond to the values as below
+                 *     bit  0 -> 5MHz
+                 *     bit  1 -> 10MHz
+                 *     bit  2 -> 20MHz
+                 *     bit  3 -> 40MHz
+                 *     bit  4 -> 80MHz
+                 *     bit  5 -> 160MHz
+                 *     bit  6 -> 80_80MHz
+                 * If no bits are set, target can choose what BW to use.
+                 */
+                 bw_mask: 7,
+
+                /* preamble_type_mask -
+                 * Specify which preamble types (CCK, OFDM, HT, VHT) the target
+                 * may choose from for transmitting this frame.
+                 * Each bit in this mask corresponds to a preamble_type value:
+                 *     bit 0: if set, OFDM
+                 *     bit 1: if set, CCK
+                 *     bit 2: if set, HT
+                 *     bit 3: if set, VHT
+                 *     bit 4: if set, HE
+                 * If no bits are set, target can choose what preamble type to use.
+                 */
+                 preamble_type: 5,
+
+                /* Data:1 Mgmt:0
+                 */
+                 frame_type: 1,
+
+                 reserved1_31_21: 11;
+       };
+       A_UINT32 tx_param_dword1;
+    };
+} wmi_tx_send_params;
+
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_mgmt_tx_send_cmd_fixed_param */
     A_UINT32 vdev_id;
@@ -3205,12 +3909,42 @@ typedef struct {
     A_UINT32 paddr_hi;
     A_UINT32 frame_len;
     A_UINT32 buf_len;  /** Buffer length in bytes */
+    /*
+     * The frame which will have tx_params_valid set will be always be RAW
+     * frame, as it will be tx'ed on non-pause tid
+     */
+    A_UINT32 tx_params_valid;
 /* This TLV is followed by array of bytes: First 64 bytes of management frame
  *   A_UINT8 bufp[];
  */
+/* This TLV is followed by wmi_tx_send_params
+ * wmi_tx_send_params tx_send_params;
+ */
 } wmi_mgmt_tx_send_cmd_fixed_param;
 
 typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_offchan_data_tx_send_cmd_fixed_param */
+    A_UINT32 vdev_id;
+    A_UINT32 desc_id;  /* echoed in tx_compl_event */
+    A_UINT32 chanfreq; /* MHz units */
+    A_UINT32 paddr_lo;
+    A_UINT32 paddr_hi;
+    A_UINT32 frame_len;
+    A_UINT32 buf_len;  /** Buffer length in bytes */
+    /* The frame which will have tx_params_valid set will be always be RAW
+     * frame, as it will be tx'ed on non-pause tid
+     */
+    A_UINT32 tx_params_valid;
+
+/* This TLV is followed by array of bytes: First 64 bytes of frame
+ *   A_UINT8 bufp[];
+ */
+/* This TLV is followed by wmi_tx_send_params
+ * wmi_tx_send_params tx_send_params;
+ */
+} wmi_offchan_data_tx_send_cmd_fixed_param;
+
+typedef struct {
     A_UINT32 tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_echo_event_fixed_param */
     A_UINT32 value;
 } wmi_echo_event_fixed_param;
@@ -3317,10 +4051,80 @@ typedef struct {
 typedef struct {
     A_UINT32 tlv_header;   /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_set_custom_aggr_size_cmd_fixed_param */
     A_UINT32 vdev_id;      /* vdev id indicating to which the vdev custom aggregation size will be applied. */
-    A_UINT32 tx_aggr_size; /* Size for tx aggregation (max MPDUs per A-MPDU) for the vdev mentioned in vdev id */
-    A_UINT32 rx_aggr_size; /* Size for rx aggregation (block ack window size limit) for the vdev mentioned in vdev id*/
+    /* Size for tx aggregation for the vdev mentioned in vdev id
+     * (max MPDUs per A-MPDU or max MSDUs per A-MSDU based on aggr_type field)
+     */
+    A_UINT32 tx_aggr_size;
+
+    A_UINT32 rx_aggr_size; /* Size for rx aggregation (block ack window size limit) for the vdev mentioned in vdev id */
+
+    /*
+     * To set TX aggregation size limits per VDEV per AC
+     * bits 1:0 (ac):
+     *     Access Category (0x0=BE, 0x1=BK, 0x2=VI, 0x3=VO)
+     *     If tx_ac_enable bit is not set, tx_aggr_size is applied
+     *     for all Access Categories
+     * bit 2 (aggr_type):            TX Aggregation Type (0=A-MPDU, 1=A-MSDU)
+     * bit 3 (tx_aggr_size_disable): If set tx_aggr_size is invalid
+     * bit 4 (rx_aggr_size_disable): If set rx_aggr_size is invalid
+     * bit 5 (tx_ac_enable):         If set, above ac bitmap is valid.
+     * bits 31:6:                    Reserved bits. should be set to zero.
+     */
+    A_UINT32 enable_bitmap;
 } wmi_vdev_set_custom_aggr_size_cmd_fixed_param;
 
+typedef enum {
+    WMI_VDEV_CUSTOM_AGGR_TYPE_AMPDU = 0,
+    WMI_VDEV_CUSTOM_AGGR_TYPE_AMSDU = 1,
+    WMI_VDEV_CUSTOM_AGGR_TYPE_MAX,
+} wmi_vdev_custom_aggr_type_t;
+
+#define WMI_VDEV_CUSTOM_AGGR_AC_BITPOS           0
+#define WMI_VDEV_CUSTOM_AGGR_AC_NUM_BITS         2
+#define WMI_VDEV_CUSTOM_AGGR_TYPE_BITPOS         2
+#define WMI_VDEV_CUSTOM_AGGR_TYPE_NUM_BITS       1
+#define WMI_VDEV_CUSTOM_TX_AGGR_SZ_DIS_BITPOS    3
+#define WMI_VDEV_CUSTOM_TX_AGGR_SZ_DIS_NUM_BITS  1
+#define WMI_VDEV_CUSTOM_RX_AGGR_SZ_DIS_BITPOS    4
+#define WMI_VDEV_CUSTOM_RX_AGGR_SZ_DIS_NUM_BITS  1
+#define WMI_VDEV_CUSTOM_TX_AC_EN_BITPOS          5
+#define WMI_VDEV_CUSTOM_TX_AC_EN_NUM_BITS        1
+
+#define WMI_VDEV_CUSTOM_AGGR_AC_SET(param, value) \
+    WMI_SET_BITS(param, WMI_VDEV_CUSTOM_AGGR_AC_BITPOS, \
+        WMI_VDEV_CUSTOM_AGGR_AC_NUM_BITS, value)
+#define WMI_VDEV_CUSTOM_AGGR_AC_GET(param)         \
+    WMI_GET_BITS(param, WMI_VDEV_CUSTOM_AGGR_AC_BITPOS, \
+        WMI_VDEV_CUSTOM_AGGR_AC_NUM_BITS)
+
+#define WMI_VDEV_CUSTOM_AGGR_TYPE_SET(param, value) \
+    WMI_SET_BITS(param, WMI_VDEV_CUSTOM_AGGR_TYPE_BITPOS, \
+        WMI_VDEV_CUSTOM_AGGR_TYPE_NUM_BITS, value)
+#define WMI_VDEV_CUSTOM_AGGR_TYPE_GET(param)         \
+    WMI_GET_BITS(param, WMI_VDEV_CUSTOM_AGGR_TYPE_BITPOS, \
+        WMI_VDEV_CUSTOM_AGGR_TYPE_NUM_BITS)
+
+#define WMI_VDEV_CUSTOM_TX_AGGR_SZ_DIS_SET(param, value) \
+    WMI_SET_BITS(param, WMI_VDEV_CUSTOM_TX_AGGR_SZ_DIS_BITPOS, \
+        WMI_VDEV_CUSTOM_TX_AGGR_SZ_DIS_NUM_BITS, value)
+#define WMI_VDEV_CUSTOM_TX_AGGR_SZ_DIS_GET(param)         \
+    WMI_GET_BITS(param, WMI_VDEV_CUSTOM_TX_AGGR_SZ_DIS_BITPOS, \
+        WMI_VDEV_CUSTOM_TX_AGGR_SZ_DIS_NUM_BITS)
+
+#define WMI_VDEV_CUSTOM_RX_AGGR_SZ_DIS_SET(param, value) \
+    WMI_SET_BITS(param, WMI_VDEV_CUSTOM_RX_AGGR_SZ_DIS_BITPOS, \
+        WMI_VDEV_CUSTOM_RX_AGGR_SZ_DIS_NUM_BITS, value)
+#define WMI_VDEV_CUSTOM_RX_AGGR_SZ_DIS_GET(param)         \
+    WMI_GET_BITS(param, WMI_VDEV_CUSTOM_RX_AGGR_SZ_DIS_BITPOS, \
+        WMI_VDEV_CUSTOM_RX_AGGR_SZ_DIS_NUM_BITS)
+
+#define WMI_VDEV_CUSTOM_TX_AC_EN_SET(param, value) \
+    WMI_SET_BITS(param, WMI_VDEV_CUSTOM_TX_AC_EN_BITPOS, \
+        WMI_VDEV_CUSTOM_TX_AC_EN_NUM_BITS, value)
+#define WMI_VDEV_CUSTOM_TX_AC_EN_GET(param)         \
+    WMI_GET_BITS(param, WMI_VDEV_CUSTOM_TX_AC_EN_BITPOS, \
+        WMI_VDEV_CUSTOM_TX_AC_EN_NUM_BITS)
+
 /*
  * Command to enable/disable Green AP Power Save.
  * This helps conserve power during AP operation. When the AP has no
@@ -3416,6 +4220,48 @@ typedef struct {
     A_UINT32    enable_cmd;
 } wmi_vdev_spectral_enable_cmd_fixed_param;
 
+typedef struct {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_get_tx_power_cmd_fixed_param */
+    A_UINT32 vdev_id;
+} wmi_vdev_get_tx_power_cmd_fixed_param;
+
+#define WMI_BEACON_CTRL_TX_DISABLE  0
+#define WMI_BEACON_CTRL_TX_ENABLE   1
+
+typedef struct {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_bcn_offload_ctrl_cmd_fixed_param */
+    /** unique id identifying the VDEV, generated by the caller */
+    A_UINT32 vdev_id;
+    A_UINT32 bcn_ctrl_op; /* fw default 1 (see WMI_BEACON_CTRL defs) */
+} wmi_bcn_offload_ctrl_cmd_fixed_param;
+
+/** common structure used for wmi_vedv_get_tx_power_event */
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_tx_power_event_fixed_param */
+    A_UINT32 tx_power; /** units: 0.5 dBm, per-chain tx power */
+    A_UINT32 vdev_id; /** unique id identifying the VDEV, generated by the caller */
+} wmi_vdev_get_tx_power_event_fixed_param;
+
+typedef enum {
+    /** Limit the offchannel duration */
+    WMI_VDEV_LIMIT_OFFCHAN_ENABLE   = 0x1,
+    /** Skip DFS channels from Scan channel list.
+     *  valid for both host scans and FW scans */
+    WMI_VDEV_LIMIT_OFFCHAN_SKIP_DFS = 0x2,
+} wmi_vdev_limit_offchan_flags;
+
+typedef struct {
+    A_UINT32 tlv_header; /* WMITLV_TAG_STRUC_wmi_vdev_limit_offchan_cmd_fixed_param */
+    /** Limit the duration of offchannel events requested by the vdev corresponding to the specified vdev_id */
+    A_UINT32 vdev_id;
+    /** see enum wmi_vdev_limit_offchan_flags */
+    A_UINT32 flags;
+    /** max offchannel time allowed in msec when WMI_VDEV_LIMIT_OFFCHAN_ENABLE flag is set */
+    A_UINT32 max_offchan_time;
+    /** rest time in msec on the BSS channel */
+    A_UINT32 rest_time;
+} wmi_vdev_limit_offchan_cmd_fixed_param;
+
 /* information sub element id for QSBW, expected value is 0x02 */
 #define WMI_CSA_EVENT_QSBW_ISE_ID_MASK    0x000000FF
 /* length of QSBW ISE data, expected value is 0x02 */
@@ -3444,6 +4290,15 @@ typedef struct {
 #define WMI_CSA_EVENT_QSBW_ISE_NOTIF_10M(qsbw_ise) \
         (((qsbw_ise) >> 24) & WMI_CSA_EVENT_QSBW_ISE_10M_BITMASK)
 
+#define WMI_CSA_EVENT_QSBW_ISE_EXTRACT_ID(qsbw_ise) \
+        ((qsbw_ise) & WMI_CSA_EVENT_QSBW_ISE_ID_MASK)
+#define WMI_CSA_EVENT_QSBW_ISE_EXTRACT_LEN(qsbw_ise)  \
+        (((qsbw_ise) & WMI_CSA_EVENT_QSBW_ISE_LEN_MASK) >> 8)
+#define WMI_CSA_EVENT_QSBW_ISE_EXTRACT_CAP(qsbw_ise)  \
+        (((qsbw_ise) & WMI_CSA_EVENT_QSBW_ISE_CAP_MASK) >> 16)
+#define WMI_CSA_EVENT_QSBW_ISE_EXTRACT_NOTIF(qsbw_ise)  \
+        (((qsbw_ise) & WMI_CSA_EVENT_QSBW_ISE_NOTIF_MASK) >> 24)
+
 typedef enum {
 WMI_CSA_IE_PRESENT = 0x00000001,
 WMI_XCSA_IE_PRESENT = 0x00000002,
@@ -3477,258 +4332,268 @@ typedef enum {
 } WMI_PEER_MCAST2UCAST_MODE;
 
 typedef enum {
+    PKT_PWR_SAVE_NAP_ENABLE     = 0x00000001,
+    PKT_PWR_SAVE_LS_ENABLE      = 0x00000002,
+    PKT_PWR_SAVE_DS_ENABLE      = 0x00000004,
+
+    PKT_PWR_SAVE_BTCOEX_ENABLE  = 0x00000008,
+
+    PKT_PWR_SAVE_FSM_ENABLE     = 0x80000000,
+} WMI_PDEV_PKT_PWR_SAVE_LEVEL;
+
+typedef enum {
     /** TX chain mask */
     WMI_PDEV_PARAM_TX_CHAIN_MASK = 0x1,
     /** RX chain mask */
-    WMI_PDEV_PARAM_RX_CHAIN_MASK,
+    WMI_PDEV_PARAM_RX_CHAIN_MASK,                     /* 0x2 */
     /** TX power limit for 2G Radio */
-    WMI_PDEV_PARAM_TXPOWER_LIMIT2G,
+    WMI_PDEV_PARAM_TXPOWER_LIMIT2G,                   /* 0x3 */
     /** TX power limit for 5G Radio */
-    WMI_PDEV_PARAM_TXPOWER_LIMIT5G,
+    WMI_PDEV_PARAM_TXPOWER_LIMIT5G,                   /* 0x4 */
     /** TX power scale */
-    WMI_PDEV_PARAM_TXPOWER_SCALE,
+    WMI_PDEV_PARAM_TXPOWER_SCALE,                     /* 0x5 */
     /** Beacon generation mode . 0: host, 1: target   */
-    WMI_PDEV_PARAM_BEACON_GEN_MODE,
+    WMI_PDEV_PARAM_BEACON_GEN_MODE,                   /* 0x6 */
     /** Beacon generation mode . 0: staggered 1: bursted   */
-    WMI_PDEV_PARAM_BEACON_TX_MODE,
+    WMI_PDEV_PARAM_BEACON_TX_MODE,                    /* 0x7 */
     /** Resource manager off chan mode .
      * 0: turn off off chan mode. 1: turn on offchan mode
      */
-    WMI_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+    WMI_PDEV_PARAM_RESMGR_OFFCHAN_MODE,               /* 0x8 */
     /** Protection mode  0: no protection 1:use CTS-to-self 2: use RTS/CTS */
-    WMI_PDEV_PARAM_PROTECTION_MODE,
+    WMI_PDEV_PARAM_PROTECTION_MODE,                   /* 0x9 */
     /** Dynamic bandwidth 0: disable 1: enable */
-    WMI_PDEV_PARAM_DYNAMIC_BW,
+    WMI_PDEV_PARAM_DYNAMIC_BW,                        /* 0xa */
     /** Non aggregrate/ 11g sw retry threshold.0-disable */
-    WMI_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+    WMI_PDEV_PARAM_NON_AGG_SW_RETRY_TH,               /* 0xb */
     /** aggregrate sw retry threshold. 0-disable*/
-    WMI_PDEV_PARAM_AGG_SW_RETRY_TH,
+    WMI_PDEV_PARAM_AGG_SW_RETRY_TH,                   /* 0xc */
     /** Station kickout threshold (non of consecutive failures).0-disable */
-    WMI_PDEV_PARAM_STA_KICKOUT_TH,
+    WMI_PDEV_PARAM_STA_KICKOUT_TH,                    /* 0xd */
     /** Aggerate size scaling configuration per AC */
-    WMI_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+    WMI_PDEV_PARAM_AC_AGGRSIZE_SCALING,               /* 0xe */
     /** LTR enable */
-    WMI_PDEV_PARAM_LTR_ENABLE,
+    WMI_PDEV_PARAM_LTR_ENABLE,                        /* 0xf */
     /** LTR latency for BE, in us */
-    WMI_PDEV_PARAM_LTR_AC_LATENCY_BE,
+    WMI_PDEV_PARAM_LTR_AC_LATENCY_BE,                 /* 0x10 */
     /** LTR latency for BK, in us */
-    WMI_PDEV_PARAM_LTR_AC_LATENCY_BK,
+    WMI_PDEV_PARAM_LTR_AC_LATENCY_BK,                 /* 0x11 */
     /** LTR latency for VI, in us */
-    WMI_PDEV_PARAM_LTR_AC_LATENCY_VI,
+    WMI_PDEV_PARAM_LTR_AC_LATENCY_VI,                 /* 0x12 */
     /** LTR latency for VO, in us  */
-    WMI_PDEV_PARAM_LTR_AC_LATENCY_VO,
+    WMI_PDEV_PARAM_LTR_AC_LATENCY_VO,                 /* 0x13 */
     /** LTR AC latency timeout, in ms */
-    WMI_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+    WMI_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,            /* 0x14 */
     /** LTR platform latency override, in us */
-    WMI_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+    WMI_PDEV_PARAM_LTR_SLEEP_OVERRIDE,                /* 0x15 */
     /** LTR-M override, in us */
-    WMI_PDEV_PARAM_LTR_RX_OVERRIDE,
+    WMI_PDEV_PARAM_LTR_RX_OVERRIDE,                   /* 0x16 */
     /** Tx activity timeout for LTR, in us */
-    WMI_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+    WMI_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,           /* 0x17 */
     /** L1SS state machine enable */
-    WMI_PDEV_PARAM_L1SS_ENABLE,
+    WMI_PDEV_PARAM_L1SS_ENABLE,                       /* 0x18 */
     /** Deep sleep state machine enable */
-    WMI_PDEV_PARAM_DSLEEP_ENABLE,
+    WMI_PDEV_PARAM_DSLEEP_ENABLE,                     /* 0x19 */
     /** RX buffering flush enable */
-    WMI_PDEV_PARAM_PCIELP_TXBUF_FLUSH,
+    WMI_PDEV_PARAM_PCIELP_TXBUF_FLUSH,                /* 0x1a */
     /** RX buffering matermark */
-    WMI_PDEV_PARAM_PCIELP_TXBUF_WATERMARK,
+    WMI_PDEV_PARAM_PCIELP_TXBUF_WATERMARK,            /* 0x1b */
     /** RX buffering timeout enable */
-    WMI_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+    WMI_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,               /* 0x1c */
     /** RX buffering timeout value */
-    WMI_PDEV_PARAM_PCIELP_TXBUF_TMO_VALUE,
+    WMI_PDEV_PARAM_PCIELP_TXBUF_TMO_VALUE,            /* 0x1d */
     /** pdev level stats update period in ms */
-    WMI_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+    WMI_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,          /* 0x1e */
     /** vdev level stats update period in ms */
-    WMI_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+    WMI_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,          /* 0x1f */
     /** peer level stats update period in ms */
-    WMI_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+    WMI_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,          /* 0x20 */
     /** beacon filter status update period */
-    WMI_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+    WMI_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,        /* 0x21 */
     /** QOS Mgmt frame protection MFP/PMF 0: disable, 1: enable */
-    WMI_PDEV_PARAM_PMF_QOS,
+    WMI_PDEV_PARAM_PMF_QOS,                           /* 0x22 */
     /** Access category on which ARP frames are sent */
-    WMI_PDEV_PARAM_ARP_AC_OVERRIDE,
+    WMI_PDEV_PARAM_ARP_AC_OVERRIDE,                   /* 0x23 */
     /** DCS configuration */
-    WMI_PDEV_PARAM_DCS,
+    WMI_PDEV_PARAM_DCS,                               /* 0x24 */
     /** Enable/Disable ANI on target */
-    WMI_PDEV_PARAM_ANI_ENABLE,
+    WMI_PDEV_PARAM_ANI_ENABLE,                        /* 0x25 */
     /** configure the ANI polling period */
-    WMI_PDEV_PARAM_ANI_POLL_PERIOD,
+    WMI_PDEV_PARAM_ANI_POLL_PERIOD,                   /* 0x26 */
     /** configure the ANI listening period */
-    WMI_PDEV_PARAM_ANI_LISTEN_PERIOD,
+    WMI_PDEV_PARAM_ANI_LISTEN_PERIOD,                 /* 0x27 */
     /** configure OFDM immunity level */
-    WMI_PDEV_PARAM_ANI_OFDM_LEVEL,
+    WMI_PDEV_PARAM_ANI_OFDM_LEVEL,                    /* 0x28 */
     /** configure CCK immunity level */
-    WMI_PDEV_PARAM_ANI_CCK_LEVEL,
+    WMI_PDEV_PARAM_ANI_CCK_LEVEL,                     /* 0x29 */
     /** Enable/Disable CDD for 1x1 STAs in rate control module */
-    WMI_PDEV_PARAM_DYNTXCHAIN,
+    WMI_PDEV_PARAM_DYNTXCHAIN,                        /* 0x2a */
     /** Enable/Disable proxy STA */
-    WMI_PDEV_PARAM_PROXY_STA,
+    WMI_PDEV_PARAM_PROXY_STA,                         /* 0x2b */
     /** Enable/Disable low power state when all VDEVs are inactive/idle. */
-    WMI_PDEV_PARAM_IDLE_PS_CONFIG,
+    WMI_PDEV_PARAM_IDLE_PS_CONFIG,                    /* 0x2c */
     /** Enable/Disable power gating sleep */
-    WMI_PDEV_PARAM_POWER_GATING_SLEEP,
+    WMI_PDEV_PARAM_POWER_GATING_SLEEP,                /* 0x2d */
     /** Enable/Disable Rfkill */
-    WMI_PDEV_PARAM_RFKILL_ENABLE,
+    WMI_PDEV_PARAM_RFKILL_ENABLE,                     /* 0x2e */
     /** Set Bursting DUR */
-    WMI_PDEV_PARAM_BURST_DUR,
+    WMI_PDEV_PARAM_BURST_DUR,                         /* 0x2f */
     /** Set Bursting ENABLE */
-    WMI_PDEV_PARAM_BURST_ENABLE,
+    WMI_PDEV_PARAM_BURST_ENABLE,                      /* 0x30 */
     /** HW rfkill config */
-    WMI_PDEV_PARAM_HW_RFKILL_CONFIG,
+    WMI_PDEV_PARAM_HW_RFKILL_CONFIG,                  /* 0x31 */
     /** Enable radio low power features */
-    WMI_PDEV_PARAM_LOW_POWER_RF_ENABLE,
-    /** L1SS entry and residency time track */
-    WMI_PDEV_PARAM_L1SS_TRACK,
+    WMI_PDEV_PARAM_LOW_POWER_RF_ENABLE,               /* 0x32 */
+   /** L1SS entry and residency time track */
+    WMI_PDEV_PARAM_L1SS_TRACK,                        /* 0x33 */
     /** set hyst at runtime, requirement from SS */
-    WMI_PDEV_PARAM_HYST_EN,
+    WMI_PDEV_PARAM_HYST_EN,                           /* 0x34 */
     /** Enable/ Disable POWER COLLAPSE */
-    WMI_PDEV_PARAM_POWER_COLLAPSE_ENABLE,
-    /** configure LED system state */
-    WMI_PDEV_PARAM_LED_SYS_STATE,
+    WMI_PDEV_PARAM_POWER_COLLAPSE_ENABLE,             /* 0x35 */
+   /** configure LED system state */
+    WMI_PDEV_PARAM_LED_SYS_STATE,                     /* 0x36 */
    /** Enable/Disable LED */
-    WMI_PDEV_PARAM_LED_ENABLE,
+    WMI_PDEV_PARAM_LED_ENABLE,                        /* 0x37 */
     /** set DIRECT AUDIO time latency */
-    WMI_PDEV_PARAM_AUDIO_OVER_WLAN_LATENCY, /* DEPRECATED */
+    WMI_PDEV_PARAM_AUDIO_OVER_WLAN_LATENCY, /* DEPRECATED */ /* 0x38 */
     /** set DIRECT AUDIO Feature ENABLE */
-    WMI_PDEV_PARAM_AUDIO_OVER_WLAN_ENABLE, /* DEPRECATED */
+    WMI_PDEV_PARAM_AUDIO_OVER_WLAN_ENABLE, /* DEPRECATED */  /* 0x39 */
     /** pdev level whal mib stats update enable */
-    WMI_PDEV_PARAM_WHAL_MIB_STATS_UPDATE_ENABLE,
+    WMI_PDEV_PARAM_WHAL_MIB_STATS_UPDATE_ENABLE,      /* 0x3a */
     /** ht/vht info based on vdev */
-    WMI_PDEV_PARAM_VDEV_RATE_STATS_UPDATE_PERIOD,
+    WMI_PDEV_PARAM_VDEV_RATE_STATS_UPDATE_PERIOD,     /* 0x3b */
     /** Set CTS channel BW for dynamic BW adjustment feature */
-    WMI_PDEV_PARAM_CTS_CBW,
+    WMI_PDEV_PARAM_CTS_CBW,                           /* 0x3c */
     /** Set GPIO pin info used by WNTS */
-    WMI_PDEV_PARAM_WNTS_CONFIG,
+    WMI_PDEV_PARAM_WNTS_CONFIG,                       /* 0x3d */
     /** Enable/Disable hardware adaptive early rx feature */
-    WMI_PDEV_PARAM_ADAPTIVE_EARLY_RX_ENABLE,
+    WMI_PDEV_PARAM_ADAPTIVE_EARLY_RX_ENABLE,          /* 0x3e */
     /** The minimum early rx duration, to ensure early rx duration is non-zero */
-    WMI_PDEV_PARAM_ADAPTIVE_EARLY_RX_MIN_SLEEP_SLOP,
+    WMI_PDEV_PARAM_ADAPTIVE_EARLY_RX_MIN_SLEEP_SLOP,  /* 0x3f */
     /** Increasing/decreasing step used by hardware */
-    WMI_PDEV_PARAM_ADAPTIVE_EARLY_RX_INC_DEC_STEP,
+    WMI_PDEV_PARAM_ADAPTIVE_EARLY_RX_INC_DEC_STEP,    /* 0x40 */
     /** The fixed early rx duration when adaptive early rx is disabled */
-    WMI_PDEV_PARAM_EARLY_RX_FIX_SLEEP_SLOP,
+    WMI_PDEV_PARAM_EARLY_RX_FIX_SLEEP_SLOP,           /* 0x41 */
     /** Enable/Disable bmiss based adaptive beacon timeout feature */
-    WMI_PDEV_PARAM_BMISS_BASED_ADAPTIVE_BTO_ENABLE,
+    WMI_PDEV_PARAM_BMISS_BASED_ADAPTIVE_BTO_ENABLE,   /* 0x42 */
     /** The minimum beacon timeout duration, to ensure beacon timeout duration is non-zero */
-    WMI_PDEV_PARAM_BMISS_BTO_MIN_BCN_TIMEOUT,
+    WMI_PDEV_PARAM_BMISS_BTO_MIN_BCN_TIMEOUT,         /* 0x43 */
     /** Increasing/decreasing step used by hardware */
-    WMI_PDEV_PARAM_BMISS_BTO_INC_DEC_STEP,
+    WMI_PDEV_PARAM_BMISS_BTO_INC_DEC_STEP,            /* 0x44 */
     /** The fixed beacon timeout duration when bmiss based adaptive beacon timeout is disabled */
-    WMI_PDEV_PARAM_BTO_FIX_BCN_TIMEOUT,
+    WMI_PDEV_PARAM_BTO_FIX_BCN_TIMEOUT,               /* 0x45 */
     /** Enable/Disable Congestion Estimator based adaptive beacon timeout feature */
-    WMI_PDEV_PARAM_CE_BASED_ADAPTIVE_BTO_ENABLE,
+    WMI_PDEV_PARAM_CE_BASED_ADAPTIVE_BTO_ENABLE,      /* 0x46 */
     /** combo value of ce_id, ce_threshold, ce_time, refer to WMI_CE_BTO_CE_ID_MASK */
-    WMI_PDEV_PARAM_CE_BTO_COMBO_CE_VALUE,
+    WMI_PDEV_PARAM_CE_BTO_COMBO_CE_VALUE,             /* 0x47 */
     /** 2G TX chain mask */
-    WMI_PDEV_PARAM_TX_CHAIN_MASK_2G,
+    WMI_PDEV_PARAM_TX_CHAIN_MASK_2G,                  /* 0x48 */
     /** 2G RX chain mask */
-    WMI_PDEV_PARAM_RX_CHAIN_MASK_2G,
+    WMI_PDEV_PARAM_RX_CHAIN_MASK_2G,                  /* 0x49 */
     /** 5G TX chain mask */
-    WMI_PDEV_PARAM_TX_CHAIN_MASK_5G,
+    WMI_PDEV_PARAM_TX_CHAIN_MASK_5G,                  /* 0x4a */
     /** 5G RX chain mask */
-    WMI_PDEV_PARAM_RX_CHAIN_MASK_5G,
+    WMI_PDEV_PARAM_RX_CHAIN_MASK_5G,                  /* 0x4b */
     /* Set tx chain mask for CCK rates */
-    WMI_PDEV_PARAM_TX_CHAIN_MASK_CCK,
+    WMI_PDEV_PARAM_TX_CHAIN_MASK_CCK,                 /* 0x4c */
     /* Set tx chain mask for 1SS stream */
-    WMI_PDEV_PARAM_TX_CHAIN_MASK_1SS,
+    WMI_PDEV_PARAM_TX_CHAIN_MASK_1SS,                 /* 0x4d */
     /* Enable/Disable CTS2Self for P2P GO when Non-P2P Client is connected */
-    WMI_PDEV_PARAM_CTS2SELF_FOR_P2P_GO_CONFIG,
+    WMI_PDEV_PARAM_CTS2SELF_FOR_P2P_GO_CONFIG,        /* 0x4e */
     /** TX power backoff in dB: tx power -= param value
      * Host passes values(DB) to Halphy, Halphy reduces the power table by
      * the values. Safety check will happen in Halphy
      */
-    WMI_PDEV_PARAM_TXPOWER_DECR_DB,
+    WMI_PDEV_PARAM_TXPOWER_DECR_DB,                   /* 0x4f */
     /** enable and disable aggregate burst along with duration */
-    WMI_PDEV_PARAM_AGGR_BURST,
+    WMI_PDEV_PARAM_AGGR_BURST,                        /* 0x50 */
     /** Set the global RX decap mode */
-    WMI_PDEV_PARAM_RX_DECAP_MODE,
+    WMI_PDEV_PARAM_RX_DECAP_MODE,                     /* 0x51 */
     /** Enable/Disable Fast channel reset */
-    WMI_PDEV_PARAM_FAST_CHANNEL_RESET,
+    WMI_PDEV_PARAM_FAST_CHANNEL_RESET,                /* 0x52 */
     /** Default antenna for Smart antenna */
-    WMI_PDEV_PARAM_SMART_ANTENNA_DEFAULT_ANTENNA,
+    WMI_PDEV_PARAM_SMART_ANTENNA_DEFAULT_ANTENNA,     /* 0x53 */
     /** Set the user-specified antenna gain */
-    WMI_PDEV_PARAM_ANTENNA_GAIN,
+    WMI_PDEV_PARAM_ANTENNA_GAIN,                      /* 0x54 */
     /** Set the user-specified RX filter */
-    WMI_PDEV_PARAM_RX_FILTER,
+    WMI_PDEV_PARAM_RX_FILTER,                         /* 0x55 */
     /** configure the user-specified MCAST tid for managed mcast feature
      *  0-15 is the valid range. 0xff will clear the tid setting */
-    WMI_PDEV_SET_MCAST_TO_UCAST_TID,
+    WMI_PDEV_SET_MCAST_TO_UCAST_TID,                  /* 0x56 */
     /** Enable/Disable Proxy sta mode */
-    WMI_PDEV_PARAM_PROXY_STA_MODE,
+    WMI_PDEV_PARAM_PROXY_STA_MODE,                    /* 0x57 */
     /** configure the mcast2ucast mode for the pdev->peer_mcast.
      *  See WMI_PEER_MCAST2UCAST_MODE for possible values */
-    WMI_PDEV_PARAM_SET_MCAST2UCAST_MODE,
+    WMI_PDEV_PARAM_SET_MCAST2UCAST_MODE,              /* 0x58 */
     /** Sets the Mcast buffers for cloning, to support Mcast enhancement */
-    WMI_PDEV_PARAM_SET_MCAST2UCAST_BUFFER,
+    WMI_PDEV_PARAM_SET_MCAST2UCAST_BUFFER,            /* 0x59 */
     /** Remove the Mcast buffers added by host */
-    WMI_PDEV_PARAM_REMOVE_MCAST2UCAST_BUFFER,
+    WMI_PDEV_PARAM_REMOVE_MCAST2UCAST_BUFFER,         /* 0x5a */
     /** En/disable station power save state indication */
-    WMI_PDEV_PEER_STA_PS_STATECHG_ENABLE,
+    WMI_PDEV_PEER_STA_PS_STATECHG_ENABLE,             /* 0x5b */
     /** Access category on which ARP frames are sent */
-    WMI_PDEV_PARAM_IGMPMLD_AC_OVERRIDE,
+    WMI_PDEV_PARAM_IGMPMLD_AC_OVERRIDE,               /* 0x5c */
     /** allow or disallow interbss frame forwarding */
-    WMI_PDEV_PARAM_BLOCK_INTERBSS,
+    WMI_PDEV_PARAM_BLOCK_INTERBSS,                    /* 0x5d */
     /** Enable/Disable reset */
-    WMI_PDEV_PARAM_SET_DISABLE_RESET_CMDID,
+    WMI_PDEV_PARAM_SET_DISABLE_RESET_CMDID,           /* 0x5e */
     /** Enable/Disable/Set MSDU_TTL in milliseconds. */
-    WMI_PDEV_PARAM_SET_MSDU_TTL_CMDID,
+    WMI_PDEV_PARAM_SET_MSDU_TTL_CMDID,                /* 0x5f */
     /** Set global PPDU duration limit (usec). */
-    WMI_PDEV_PARAM_SET_PPDU_DURATION_CMDID,
+    WMI_PDEV_PARAM_SET_PPDU_DURATION_CMDID,           /* 0x60 */
     /** set txbf sounding period of vap in milliseconds */
-    WMI_PDEV_PARAM_TXBF_SOUND_PERIOD_CMDID,
+    WMI_PDEV_PARAM_TXBF_SOUND_PERIOD_CMDID,           /* 0x61 */
     /** Set promiscuous mode */
-    WMI_PDEV_PARAM_SET_PROMISC_MODE_CMDID,
+    WMI_PDEV_PARAM_SET_PROMISC_MODE_CMDID,            /* 0x62 */
     /** Set burst mode */
-    WMI_PDEV_PARAM_SET_BURST_MODE_CMDID,
+    WMI_PDEV_PARAM_SET_BURST_MODE_CMDID,              /* 0x63 */
     /** enable enhanced stats */
-    WMI_PDEV_PARAM_EN_STATS,
+    WMI_PDEV_PARAM_EN_STATS,                          /* 0x64 */
     /** Set mu-grouping policy */
-    WMI_PDEV_PARAM_MU_GROUP_POLICY,
+    WMI_PDEV_PARAM_MU_GROUP_POLICY,                   /* 0x65 */
     /** Channel Hopping Enable */
-    WMI_PDEV_PARAM_NOISE_DETECTION,
+    WMI_PDEV_PARAM_NOISE_DETECTION,                   /* 0x66 */
     /** Set Channel Hopping NF threshold in dBm */
-    WMI_PDEV_PARAM_NOISE_THRESHOLD,
+    WMI_PDEV_PARAM_NOISE_THRESHOLD,                   /* 0x67 */
     /** Set PAPRD policy */
-    WMI_PDEV_PARAM_DPD_ENABLE,
+    WMI_PDEV_PARAM_DPD_ENABLE,                        /* 0x68 */
     /** Enable/disable mcast/bcast echo, used by ProxySTA */
-    WMI_PDEV_PARAM_SET_MCAST_BCAST_ECHO,
+    WMI_PDEV_PARAM_SET_MCAST_BCAST_ECHO,              /* 0x69 */
     /** ATF enable/disable strict schedule */
-    WMI_PDEV_PARAM_ATF_STRICT_SCH,
+    WMI_PDEV_PARAM_ATF_STRICT_SCH,                    /* 0x6a */
     /** ATF set access category duration, B0-B29 duration, B30-B31: AC */
-    WMI_PDEV_PARAM_ATF_SCHED_DURATION,
+    WMI_PDEV_PARAM_ATF_SCHED_DURATION,                /* 0x6b */
     /** Default antenna polarization */
-    WMI_PDEV_PARAM_ANT_PLZN,
+    WMI_PDEV_PARAM_ANT_PLZN,                          /* 0x6c */
     /** Set mgmt retry limit */
-    WMI_PDEV_PARAM_MGMT_RETRY_LIMIT,
+    WMI_PDEV_PARAM_MGMT_RETRY_LIMIT,                  /* 0x6d */
     /** Set CCA sensitivity level in dBm */
-    WMI_PDEV_PARAM_SENSITIVITY_LEVEL,
+    WMI_PDEV_PARAM_SENSITIVITY_LEVEL,                 /* 0x6e */
     /** Set 2G positive and negative Tx power in 0.5dBm units */
-    WMI_PDEV_PARAM_SIGNED_TXPOWER_2G,
+    WMI_PDEV_PARAM_SIGNED_TXPOWER_2G,                 /* 0x6f */
     /** Set 5G positive and negative Tx power in 0.5dBm
      *  units */
-    WMI_PDEV_PARAM_SIGNED_TXPOWER_5G,
+    WMI_PDEV_PARAM_SIGNED_TXPOWER_5G,                 /* 0x70 */
     /** Enable/disble AMSDU for tids */
-    WMI_PDEV_PARAM_ENABLE_PER_TID_AMSDU,
+    WMI_PDEV_PARAM_ENABLE_PER_TID_AMSDU,              /* 0x71 */
     /** Enable/disable AMPDU for tids */
-    WMI_PDEV_PARAM_ENABLE_PER_TID_AMPDU,
+    WMI_PDEV_PARAM_ENABLE_PER_TID_AMPDU,              /* 0x72 */
     /** Set CCA threshold in dBm */
-    WMI_PDEV_PARAM_CCA_THRESHOLD,
+    WMI_PDEV_PARAM_CCA_THRESHOLD,                     /* 0x73 */
     /** RTS Fixed rate setting */
-    WMI_PDEV_PARAM_RTS_FIXED_RATE,
+    WMI_PDEV_PARAM_RTS_FIXED_RATE,                    /* 0x74 */
     /** Pdev reset */
-    WMI_PDEV_PARAM_PDEV_RESET,
+    WMI_PDEV_PARAM_PDEV_RESET,                        /* 0x75 */
     /** wapi mbssid offset **/
-    WMI_PDEV_PARAM_WAPI_MBSSID_OFFSET,
+    WMI_PDEV_PARAM_WAPI_MBSSID_OFFSET,                /* 0x76 */
     /** ARP DEBUG source address*/
-    WMI_PDEV_PARAM_ARP_DBG_SRCADDR,
+    WMI_PDEV_PARAM_ARP_DBG_SRCADDR,                   /* 0x77 */
     /** ARP DEBUG destination address*/
-    WMI_PDEV_PARAM_ARP_DBG_DSTADDR,
+    WMI_PDEV_PARAM_ARP_DBG_DSTADDR,                   /* 0x78 */
     /** ATF enable/disable obss noise scheduling */
-    WMI_PDEV_PARAM_ATF_OBSS_NOISE_SCH,
+    WMI_PDEV_PARAM_ATF_OBSS_NOISE_SCH,                /* 0x79 */
     /** ATF obss noise scaling factor */
-    WMI_PDEV_PARAM_ATF_OBSS_NOISE_SCALING_FACTOR,
+    WMI_PDEV_PARAM_ATF_OBSS_NOISE_SCALING_FACTOR,     /* 0x7a */
     /**
      * TX power reduction scaling exponent - final tx power is the
      * nominal tx power (A_MIN(reg_pow,ctl,etc..)) divided by
@@ -3738,11 +4603,11 @@ typedef enum {
      * If this factor is 2, the power is scaled down by 2^2, i.e. 6 dB
      * If this factor is 3, the power is scaled down by 2^3, i.e. 9 dB
      */
-    WMI_PDEV_PARAM_CUST_TXPOWER_SCALE,
+    WMI_PDEV_PARAM_CUST_TXPOWER_SCALE,                /* 0x7b */
     /** ATF enabe/disabe dynamically */
-    WMI_PDEV_PARAM_ATF_DYNAMIC_ENABLE,
+    WMI_PDEV_PARAM_ATF_DYNAMIC_ENABLE,                /* 0x7c */
     /** Set tx retry limit for control frames. 0 = disable, 31 = max */
-    WMI_PDEV_PARAM_CTRL_RETRY_LIMIT,
+    WMI_PDEV_PARAM_CTRL_RETRY_LIMIT,                  /* 0x7d */
     /** Set propagation delay for 2G / 5G band.
      * The propagation delay is fundamentally a per-peer property, but
      * the target may not support per-peer settings for ack timeouts.
@@ -3751,49 +4616,157 @@ typedef enum {
      * within that pdev.
      * Units are microseconds.
      */
-    WMI_PDEV_PARAM_PROPAGATION_DELAY,
+    WMI_PDEV_PARAM_PROPAGATION_DELAY,                 /* 0x7e */
     /**
      * Host can enable/disable ANT DIV feature
      * if it's been enabled in BDF
      */
-    WMI_PDEV_PARAM_ENA_ANT_DIV,
+    WMI_PDEV_PARAM_ENA_ANT_DIV,                       /* 0x7f */
     /** Host can force one chain to select a specific ANT */
-    WMI_PDEV_PARAM_FORCE_CHAIN_ANT,
+    WMI_PDEV_PARAM_FORCE_CHAIN_ANT,                   /* 0x80 */
     /**
      * Start a cycle ANT self test periodically.
      * In the test, the FW would select each ANT pair
      * one by one, the cycle time could be configured
      * via WMI_PDEV_PARAM_ANT_DIV_SELFTEST_INTVL
      */
-    WMI_PDEV_PARAM_ANT_DIV_SELFTEST,
+    WMI_PDEV_PARAM_ANT_DIV_SELFTEST,                  /* 0x81 */
     /**
      * Configure the cycle time of ANT self test,
      * the unit is micro second. Per the timer
      * limitation, too small value could be not so
      * accurate.
      */
-    WMI_PDEV_PARAM_ANT_DIV_SELFTEST_INTVL,
-
+    WMI_PDEV_PARAM_ANT_DIV_SELFTEST_INTVL,            /* 0x82 */
     /**
      * wlan stats observation period, the unit is millisecond.
      * The value of 0 is used to turn off periodic stats report.
      */
-    WMI_PDEV_PARAM_STATS_OBSERVATION_PERIOD,
+    WMI_PDEV_PARAM_STATS_OBSERVATION_PERIOD,          /* 0x83 */
     /**
      * Set tx_ppdu_delay[] bin size to specify how many
      * milliseconds each bin of the wmi_tx_stats.tx_ppdu_delay[]
      * histogram represents.
      */
-    WMI_PDEV_PARAM_TX_PPDU_DELAY_BIN_SIZE_MS,
+    WMI_PDEV_PARAM_TX_PPDU_DELAY_BIN_SIZE_MS,         /* 0x84 */
     /** set wmi_tx_stats.tx_ppdu_delay[] array length */
-    WMI_PDEV_PARAM_TX_PPDU_DELAY_ARRAY_LEN,
+    WMI_PDEV_PARAM_TX_PPDU_DELAY_ARRAY_LEN,           /* 0x85 */
     /** set wmi_tx_stats.tx_mpdu_aggr[] array length */
-    WMI_PDEV_PARAM_TX_MPDU_AGGR_ARRAY_LEN,
+    WMI_PDEV_PARAM_TX_MPDU_AGGR_ARRAY_LEN,            /* 0x86 */
     /** set wmi_rx_stats.rx_mpdu_aggr[] array length */
-    WMI_PDEV_PARAM_RX_MPDU_AGGR_ARRAY_LEN,
-   /** Set TX delay value in TX sch module, unit is microseconds */
-    WMI_PDEV_PARAM_TX_SCH_DELAY,
-
+    WMI_PDEV_PARAM_RX_MPDU_AGGR_ARRAY_LEN,            /* 0x87 */
+    /** Set TX delay value in TX sch module, unit is microseconds */
+    WMI_PDEV_PARAM_TX_SCH_DELAY,                      /* 0x88 */
+    /** Set RTS enable for SIFS bursting */
+    WMI_PDEV_PARAM_ENABLE_RTS_SIFS_BURSTING,          /* 0x89 */
+    /** Set Maximum number of MPDUs in an AMPDU*/
+    WMI_PDEV_PARAM_MAX_MPDUS_IN_AMPDU,                /* 0x8a */
+
+    /** Enable/disable peer stats info mechanism
+     * A zero value disables; a non-zero value enables.
+     */
+    WMI_PDEV_PARAM_PEER_STATS_INFO_ENABLE,            /* 0x8b */
+
+    /** Configure Fast PWR Transition mode
+     * 0x0 -> inidcates Fast PWR transition disabled
+     * 0x1 -> indicates Static mode enabled
+     * 0x2 -> indicates Dynamic mode enabled
+     */
+    WMI_PDEV_PARAM_FAST_PWR_TRANSITION,               /* 0x8c */
+
+    /** Enable/disable radio channel stats mechanism
+     *  A zero value disables; a non-zero value enables.
+     */
+    WMI_PDEV_PARAM_RADIO_CHAN_STATS_ENABLE,           /* 0x8d */
+    /** Enable/disable radio diagnosis feature
+     *  which allows retrieving the status of radio.
+     *  A zero value disables; a non-zero value enables.
+     */
+    WMI_PDEV_PARAM_RADIO_DIAGNOSIS_ENABLE,            /* 0x8e */
+    /** Enable/Disable mesh mcast traffic
+     * 1 - Allow mesh mcast traffic
+     * 0 - Disallow mesh mcast traffic
+     */
+    WMI_PDEV_PARAM_MESH_MCAST_ENABLE,                 /* 0x8f */
+    /** Enable/Disable smart chainmask scheme
+      * 1 - Enable smart chainmask scheme
+      * 0 - Disable smart chainmask scheme
+      */
+    WMI_PDEV_PARAM_SMART_CHAINMASK_SCHEME,            /* 0x90 */
+    /** Enable/Disable alternate chainmask scheme
+     * 1 - Enable alternate chainmask scheme
+     * 0 - Disable alternate chainmask scheme
+     */
+    WMI_PDEV_PARAM_ALTERNATIVE_CHAINMASK_SCHEME,      /* 0x91 */
+    /** User configured parameters for antenna diversity algorithm
+     *  BIT[25..13]: Probe period (milliseconds units)
+     *  BIT[12..0]: Stay period (milliseconds units)
+     */
+    WMI_PDEV_PARAM_ANT_DIV_USRCFG,                    /* 0x92 */
+    /** pdev packet power save levels,
+     *  refer to WMI_PDEV_PKT_PWR_SAVE_LEVEL
+     */
+    WMI_PDEV_PARAM_PACKET_POWER_SAVE_LEVEL,           /* 0x93 */
+    /** Define IOT pattern to be enabled/disabled
+      * bit values: 0 - disable, 1 - enable
+      * BIT[0..31]: each bit represents an IOT pattern
+      * -----
+      * Bit 0 - avoid SMPS with certain APs
+      * Bits 31:1 - reserved
+      */
+    WMI_PDEV_PARAM_SET_IOT_PATTERN,                   /* 0x94 */
+    /** ACK timeout - change wireless packet ack timeout configuration,
+     *  units are microseconds
+     */
+    WMI_PDEV_PARAM_ACK_TIMEOUT,                       /* 0x95 */
+    /** Number of TX chains to use for a/b/g rates.
+     *  bit 0~15  : 11b mode TX chain number.
+     *  bit 16~31 : 11ag mode TX chain number.
+     */
+    WMI_PDEV_PARAM_ABG_MODE_TX_CHAIN_NUM,             /* 0x96 */
+    /** Enable/Disable cck txfir override
+     *  bit 0 - enable (1) or disable (0) CCK tx FIR
+     *  bits 31:1 - unused / reserved (set to 0)
+     */
+    WMI_PDEV_PARAM_ENABLE_CCK_TXFIR_OVERRIDE,         /* 0x97 */
+    /** Enable/Disable DTIM Synth
+     *   1- Enable DTIM Synth
+     *   0- Disable DTIM Synth
+     */
+    WMI_PDEV_PARAM_DTIM_SYNTH,                        /* 0x98 */
+    /** Configure auto detect power failure feature.
+     *   0 - FW will trigger crash if power failure happens.
+     *   1 - FW will send a failure notification to host, and the host
+     *       framework determines how to respond to the power failure
+     *   2 - Silently rejuvenate if power failure occurs.
+     *   3 - Feature disabled.
+     */
+    WMI_PDEV_AUTO_DETECT_POWER_FAILURE,               /* 0x99 */
+    /** Configure operating voltage corner mode based on phymode and bw.
+     * bit 0-1 -   operating voltage corner mode for 11a/b.
+     * bit 2-3 -   operating voltage corner mode for 11g.
+     * bit 4-5 -   operating voltage corner mode for 11n, 20MHz, 1x1.
+     * bit 6-7 -   operating voltage corner mode for 11n, 20MHz, 2x2.
+     * bit 8-9 -   operating voltage corner mode for 11n, 40MHz, 1x1.
+     * bit 10-11 - operating voltage corner mode for 11n, 40MHz, 2x2.
+     * bit 12-13 - operating voltage corner mode for 11ac, 20MHz, 1x1.
+     * bit 14-15 - operating voltage corner mode for 11ac, 20MHz, 2x2.
+     * bit 16-17 - operating voltage corner mode for 11ac, 40MHz, 1x1.
+     * bit 18-19 - operating voltage corner mode for 11ac, 40MHz, 2x2.
+     * bit 20-21 - operating voltage corner mode for 11ac, 80MHz, 1x1.
+     * bit 22-23 - operating voltage corner mode for 11ac, 80MHz, 2x2.
+     * bit 24-25 - operating voltage corner mode for 11ac, 160MHz, 1x1.
+     * bit 26-27 - operating voltage corner mode for 11ac, 160MHz, 2x2.
+     * ---------------------------------------------
+     * 00 - Static voltage corner SVS
+     * 01 - static voltage corner LOW SVS
+     * 10 - Dynamic voltage corner selection based on TPUT
+     * 11 - Dynamic voltage corner selection based on TPUT and Tx Flush counters
+     */
+    WMI_PDEV_UPDATE_WDCVS_ALGO,                       /* 0x9a */
+
+    /* Enable/Disable data stall detection */
+    WMI_PDEV_PARAM_DATA_STALL_DETECT_ENABLE,          /* 0x9b */
 } WMI_PDEV_PARAM;
 
 typedef enum {
@@ -3815,6 +4788,21 @@ typedef enum {
     WMI_DBGLOG_REPORT_ENABLE
 } WMI_DBG_PARAM;
 
+/** MACRO define to set / get 11b and 11ag mode TX chain number:
+ *  bit 0~15 : 11b mode TX chain number.
+ *  bit 16~31: 11ag mode TX chain number.
+ */
+#define WMI_PDEV_PARAM_11B_TX_CHAIN_NUM_S  0
+#define WMI_PDEV_PARAM_11B_TX_CHAIN_NUM    0x0000FFFF
+#define WMI_PDEV_PARAM_11AG_TX_CHAIN_NUM_S 16
+#define WMI_PDEV_PARAM_11AG_TX_CHAIN_NUM   0xFFFF0000
+
+#define WMI_PDEV_PARAM_GET_11B_TX_CHAIN_NUM(word32) WMI_F_MS(word32, WMI_PDEV_PARAM_11B_TX_CHAIN_NUM)
+#define WMI_PDEV_PARAM_SET_11B_TX_CHAIN_NUM(word32, value)  WMI_F_RMW(word32,value,WMI_PDEV_PARAM_11B_TX_CHAIN_NUM)
+
+#define WMI_PDEV_PARAM_GET_11AG_TX_CHAIN_NUM(word32) WMI_F_MS(word32, WMI_PDEV_PARAM_11AG_TX_CHAIN_NUM)
+#define WMI_PDEV_PARAM_SET_11AG_TX_CHAIN_NUM(word32, value) WMI_F_RMW(word32,value,WMI_PDEV_PARAM_11AG_TX_CHAIN_NUM)
+
 /* param_value for param_id WMI_PDEV_PARAM_CTS_CBW */
 typedef enum {
     WMI_CTS_CBW_INVALID = 0,
@@ -3832,8 +4820,8 @@ typedef struct {
      */
     A_UINT32 pdev_id;
     /** parameter id   */
-    A_UINT32 param_id;
-    /** parametr value */
+    A_UINT32 param_id;/* WMI_PDEV_PARAM */
+    /** parameter value */
     A_UINT32 param_value;
 } wmi_pdev_set_param_cmd_fixed_param;
 
@@ -3847,6 +4835,34 @@ typedef struct {
     A_UINT32 param;
 } wmi_pdev_get_tpc_config_cmd_fixed_param;
 
+typedef struct {
+    A_UINT32 tlv_header; /* WMITLV_TAG_STRUC_wmi_pdev_div_get_rssi_antid_fixed_param */
+    /** pdev_id for identifying the MAC */
+    A_UINT32 pdev_id;
+    /** RSSI (rssi_chain_x_pri20) on each chain (units: dB above noise floor) */
+    A_UINT32 chain_rssi[WMI_MAX_CHAINS];
+    /** index of the last-used antenna for each chain */
+    A_UINT32 ant_id[WMI_MAX_CHAINS];
+    /** mac address of diversity peer */
+    wmi_mac_addr macaddr;
+} wmi_pdev_div_get_rssi_antid_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /* WMITLV_TAG_STRUC_wmi_pdev_bss_chan_info_request_fixed_param */
+    A_UINT32 param;   /* 1 = read only, 2= read and clear */
+} wmi_pdev_bss_chan_info_request_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header;    /* WMITLV_TAG_STRUC_wmi_pdev_update_ctltable_request_fixed_param */
+    A_UINT32 total_len;     /* the total number of ctl table bytes to be transferred */
+    A_UINT32 len;           /* the number of ctltable bytes in current payload */
+    A_UINT32 seq;           /* the number of current transfers */
+/*
+ * This TLV is followed by the following additional TLVs:
+ * ARRAY_BYTE TLV of ctltable_data
+ */
+} wmi_pdev_update_ctltable_request_fixed_param;
+
 #define WMI_FAST_DIVERSITY_BIT_OFFSET 0
 #define WMI_SLOW_DIVERSITY_BIT_OFFSET 1
 
@@ -3958,9 +4974,23 @@ typedef struct {
     A_UINT32    tlv_header;
     A_UINT32    desc_id; /* from tx_send_cmd */
     A_UINT32    status;  /* WMI_MGMT_TX_COMP_STATUS_TYPE */
+    /** pdev_id for identifying the MAC that transmitted the mgmt frame
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32    pdev_id;
 } wmi_mgmt_tx_compl_event_fixed_param;
 
 typedef struct {
+    A_UINT32    tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_offchan_data_tx_compl_event_fixed_param */
+    A_UINT32    desc_id; /* from tx_send_cmd */
+    A_UINT32    status;  /* same status as WMI_MGMT_TX_COMP_STATUS_TYPE */
+    /** pdev_id for identifying the MAC that transmitted the mgmt frame
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32    pdev_id;
+} wmi_offchan_data_tx_compl_event_fixed_param;
+
+typedef struct {
     A_UINT32    tlv_header;
     A_UINT32    num_reports;
     /* tlv for completion
@@ -4007,6 +5037,52 @@ typedef struct {
 } wmi_pdev_tpc_config_event_fixed_param;
 
 typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_div_rssi_antid_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** how many elements in the MAX_CHAINS arrays below contain valid info */
+    A_UINT32 num_chains_valid;
+    /** RSSI (rssi_chain_x_pri20) on each chain (units: dB above noise floor) */
+    A_UINT32 chain_rssi[WMI_MAX_CHAINS];
+    /** index of the last-used antenna for each chain */
+    A_UINT32 ant_id[WMI_MAX_CHAINS];
+    /** mac address of diversity peer */
+    wmi_mac_addr macaddr;
+} wmi_pdev_div_rssi_antid_event_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header;                /* WMITLV_TAG_STRUC_wmi_pdev_bss_chan_info_event_fixed_param */
+    A_UINT32 freq;                      /* Units in MHz */
+    A_INT32 noise_floor;                /* units are dBm */
+
+    /* rx clear - how often the channel was unused */
+    A_UINT32 rx_clear_count_low;        /* low 31 bits of rx_clear cnt in 64bits format */
+    A_UINT32 rx_clear_count_high;       /* high 31 bits of rx_clear cnt in 64bits format */
+
+    /* cycle count - elapsed time during the measured period, in clock ticks */
+    A_UINT32 cycle_count_low;           /* low 31 bits of cycle cnt in 64bits format */
+    A_UINT32 cycle_count_high;          /* high 31 bits of cycle cnt in 64bits format */
+
+    /* tx cycle count - elapsed time spent in tx, in clock ticks */
+    A_UINT32 tx_cycle_count_low;        /* low 31 bits of tx_cycle cnt in 64bits format */
+    A_UINT32 tx_cycle_count_high;       /* high 31 bits of tx_cycle cnt in 64bits format */
+
+    /* rx cycle count - elapsed time spent in rx, in clock ticks */
+    A_UINT32 rx_cycle_count_low;        /* low 31 bits of rx_cycle cnt in 64bits format */
+    A_UINT32 rx_cycle_count_high;       /* high 31 bits of rx_cycle cnt in 64bits format */
+
+    A_UINT32 rx_bss_cycle_count_low;    /* low 31 bits of rx cycle cnt for my bss in 64bits format */
+    A_UINT32 rx_bss_cycle_count_high;   /* high 31 bits of rx_cycle cnt for my bss in 64bits format */
+} wmi_pdev_bss_chan_info_event_fixed_param;
+
+typedef struct {
+    /* WMI event response update ctltable request to host */
+    A_UINT32 tlv_header;                /* WMITLV_TAG_STRUC_wmi_pdev_update_ctltable_event_fixed_param */
+    A_UINT32 total_len;                 /* the total number of bytes to be transferred */
+    A_UINT32 len;                       /* the number of FW received bytes from host */
+    A_UINT32 seq;                       /* the number of current transfers */
+} wmi_pdev_update_ctltable_event_fixed_param;
+
+typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_l1ss_track_event_fixed_param  */
     A_UINT32 periodCnt;
     A_UINT32 L1Cnt;
@@ -4290,8 +5366,24 @@ typedef enum {
     WMI_REQUEST_INST_STAT      = 0x40,
     WMI_REQUEST_MIB_STAT       = 0x80,
     WMI_REQUEST_RSSI_PER_CHAIN_STAT = 0x100,
+    WMI_REQUEST_CONGESTION_STAT = 0x200,
+    WMI_REQUEST_PEER_EXTD_STAT = 0x400,
+    WMI_REQUEST_BCN_STAT       = 0x800,
 } wmi_stats_id;
 
+/*
+ * cfg_retry_count is set to max number of times the AP should try sending
+ * QoS Null frames to the STA for measuring the instantaneous RSSI
+ *
+ * retry_count is used to maintain the number of times the AP has tried sending
+ * QoS Null frames to the STA for measuring the instantaneous RSSI
+ */
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_request_stats_cmd_sub_struc_param */
+    A_UINT32 cfg_retry_count;
+    A_UINT32 retry_count;
+} wmi_inst_rssi_stats_params;
+
 typedef struct {
     A_UINT32   tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_request_stats_cmd_fixed_param */
     wmi_stats_id stats_id;
@@ -4299,6 +5391,11 @@ typedef struct {
     A_UINT32 vdev_id;
     /** peer MAC address */
     wmi_mac_addr peer_macaddr;
+    A_UINT32 pdev_id; /** pdev_id for identifying the MAC.  See macros starting with WMI_PDEV_ID_ for values. In non-DBDC case host should set it to 0. */
+/*
+ * This TLV is (optionally) followed by other TLVs:
+ *     wmi_inst_rssi_stats_params inst_rssi_params;
+ */
 } wmi_request_stats_cmd_fixed_param;
 
 /* stats type bitmap  */
@@ -4362,6 +5459,24 @@ typedef struct {
 } wmi_debug_mesg_flush_fixed_param;
 
 typedef struct {
+    A_UINT32 tlv_header;        /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_debug_mesg_fw_data_stall_param */
+    A_UINT32 vdev_id_bitmap;    /** bitmap representation for vdev_id's where data stall happened */
+    A_UINT32 data_stall_type;   /** wlan_dbg_data_stall_type_e */
+    /** reason_code1:
+     * The information stored in reason_code1 varies based on the data stally
+     * type values:
+     * data_stall_type      | reason_code1
+     * -----------------------------------------------------
+     * HWSCHED_CMD_FLUSH    | flush req reason (0-40)
+     * RX_REFILL_FAILED     | ring_id (0-7)
+     * RX_FCS_LEN_ERROR     | exact error type
+     */
+    A_UINT32 reason_code1;
+    A_UINT32 reason_code2;      /** on which tid/hwq stall happened */
+    A_UINT32 recovery_type;     /** wlan_dbg_data_stall_recovery_type_e */
+} wmi_debug_mesg_fw_data_stall_param;
+
+typedef struct {
     A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_debug_mesg_flush_complete_fixed_param*/
     A_UINT32 reserved0; /** placeholder for future */
 } wmi_debug_mesg_flush_complete_fixed_param;
@@ -4538,6 +5653,10 @@ typedef struct {
      * It is superseded by the WMI_RADIO_TX_POWER_LEVEL_STATS_EVENTID message.
      */
     A_UINT32 tx_time_per_tpc[MAX_TPC_LEVELS];
+    /** msecs the radio is awake due to Host initiated scan (accruing over time) */
+    A_UINT32 on_time_host_scan;
+    /** msecs the radio is awake due to LPI scan (accruing over time) */
+    A_UINT32 on_time_lpi_scan;
 } wmi_radio_link_stats;
 
 /** tx time per power level statistics */
@@ -4556,6 +5675,8 @@ typedef struct {
      * per power level stats.
      */
     A_UINT32 power_level_offset;
+    /* radio id for this tx time per power level statistics (if multiple radio supported) */
+    A_UINT32 radio_id;
 /*
  * This TLV will be followed by a TLV containing a variable-length array of
  * A_UINT32 with tx time per power level data
@@ -4698,6 +5819,8 @@ typedef struct {
     A_UINT32 contention_time_avg;
     /** num of data pkts used for contention statistics */
     A_UINT32 contention_num_samples;
+    /** number of pending pkts */
+    A_UINT32 tx_pending_msdu;
 } wmi_wmm_ac_stats;
 
 /* interface statistics */
@@ -4738,8 +5861,50 @@ typedef struct {
         time driver waits before shutting down the radio or switching the channel and after receiving an ACK for
         a data frame with PM bit set) */
     A_UINT32 rx_leak_window;
+    A_UINT32 tx_rts_succ_cnt;
+    A_UINT32 tx_rts_fail_cnt;
+    A_UINT32 tx_ppdu_succ_cnt;
+    A_UINT32 tx_ppdu_fail_cnt;
+    /** msecs the interface is in Connected state (accruing over time) */
+    A_UINT32 connected_duration;
+    /** msecs the interface is in DisConnected state (accruing over time) */
+    A_UINT32 disconnected_duration;
+    /** msecs the interface is doing RTT ranging (accruing over time) */
+    A_UINT32 rtt_ranging_duration;
+    /** msecs the interface is in RTT responder mode (accruing over time) */
+    A_UINT32 rtt_responder_duration;
+    /** Number of Probes (Tx) sent on the interface (accruing over time) */
+    A_UINT32 num_probes_tx;
+    /** Number of Beacon misses on this interface (accruing over time) */
+    A_UINT32 num_beacon_miss;
 } wmi_iface_link_stats;
 
+typedef enum {
+    WMI_OFFLOAD_STATS_TYPE_SOC_BCAST   = 0,
+    WMI_OFFLOAD_STATS_TYPE_SOC_MCAST   = 1,
+    WMI_OFFLOAD_STATS_TYPE_SOC_UCAST   = 2,
+    WMI_OFFLOAD_STATS_TYPE_ARP         = 3,
+    WMI_OFFLOAD_STATS_TYPE_NS          = 4,
+    WMI_OFFLOAD_STATS_TYPE_APF_BCAST   = 5,
+    WMI_OFFLOAD_STATS_TYPE_APF_MCAST   = 6,
+    WMI_OFFLOAD_STATS_TYPE_APF_UCAST   = 7,
+    /* Add New offload stat type here */
+    WMI_OFFLOAD_STATS_TYPE_MAX,
+} wmi_offload_stats_type;
+
+typedef struct {
+   A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_iface_offload_stats */
+   /** Type of offload stat. enum wmi_offload_stats_type **/
+   A_UINT32 type;
+   /** Number of (MSDUs) frames Received **/
+   A_UINT32 rx_count;
+   /** Number of frames Dropped **/
+   A_UINT32 drp_count;
+   /** Number of frames for which FW Responded (Valid for ARP and NS only). (or)
+     * Number of frames forwarded to Host (Valid for stats type except ARP and NS). **/
+   A_UINT32 fwd_count;
+} wmi_iface_offload_stats;
+
 /** Interface statistics (once started) reset and start afresh after each connection */
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_iface_link_stats_event_fixed_param */
@@ -4747,10 +5912,13 @@ typedef struct {
     A_UINT32 request_id;
     /** unique id identifying the VDEV, generated by the caller */
     A_UINT32 vdev_id;
+    /** Number of offload stats **/
+    A_UINT32 num_offload_stats;
 /*
- * This TLV is followed by another TLV
+ * This TLV is followed by other TLVs
  *   wmi_iface_link_stats iface_link_stats;
  *   num_ac * size of(struct wmi_wmm_ac_stats)
+ *   wmi_iface_offload_stats iface_offload_stats[num_offload_stats]
  */
 } wmi_iface_link_stats_event_fixed_param;
 
@@ -4819,6 +5987,9 @@ typedef struct {
     A_UINT32 num_chan_stats;
     /** number of MIB stats event structures (wmi_mib_stats) */
     A_UINT32 num_mib_stats;
+    A_UINT32 pdev_id; /** pdev_id for identifying the MAC.  See macros starting with WMI_PDEV_ID_ for values. In non-DBDC case host should set it to 0. */
+    /** number of beacon stats event structures (wmi_bcn_stats) */
+    A_UINT32 num_bcn_stats;
     /* This TLV is followed by another TLV of array of bytes
          *   A_UINT8 data[];
          *  This data array contains
@@ -4828,6 +5999,7 @@ typedef struct {
          *   num_bcnflt_stats * size_of()
          *   num_chan_stats * size of(struct wmi_chan_stats)
          *   num_mib_stats * size of(struct wmi_mib_stats)
+         *   num_bcn_stats * size of(struct wmi_bcn_stats)
          *
          */
 } wmi_stats_event_fixed_param;
@@ -4995,6 +6167,12 @@ typedef struct
     A_INT32 per_chain_snr[WMI_MAX_CHAINS];
     /** per chain background noise, units are dBm */
     A_INT32 per_chain_nf[WMI_MAX_CHAINS];
+    /** per antenna rx MPDUs */
+    A_UINT32 per_antenna_rx_mpdus[WMI_MAX_CHAINS];
+    /** per antenna tx MPDUs */
+    A_UINT32 per_antenna_tx_mpdus[WMI_MAX_CHAINS];
+    /** num of valid chains for per antenna rx/tx MPDU cnts*/
+    A_UINT32 num_chains_valid;
 } wmi_peer_signal_stats;
 
 /** Thresholds of signal stats, stand for percentage of stats variation.
@@ -5137,6 +6315,26 @@ typedef struct
      */
 } wmi_peer_ac_rx_stats;
 
+typedef struct
+{
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_stats_period */
+    /*
+     * This struct provides the timestamps from a low-frequency timer
+     * for the start and end of a stats period.
+     * Each timestamp is reported twice, with different units.
+     * The _msec timestamp is in millisecond units.
+     * The _count timestamp is in clock tick units.
+     * The timestamp is reported in clock ticks as well as in milliseconds
+     * so that if the stats start and end times fall within the same
+     * millisecond, the clock tick timestamps can still be used to
+     * determine what fraction of a millisecond the stats period occupied.
+     */
+    A_UINT32 start_low_freq_msec;
+    A_UINT32 start_low_freq_count;
+    A_UINT32 end_low_freq_msec;
+    A_UINT32 end_low_freq_count;
+} wmi_stats_period;
+
 typedef enum {
     /** Periodic timer timed out, based on the period specified
      *  by WMI_PDEV_PARAM_STATS_OBSERVATION_PERIOD
@@ -5209,6 +6407,8 @@ typedef struct {
     /** Array size of rx_mcs[] which is histogram of encoding rate.
      *  The array indicates number of PPDUs received at a specific rate */
     A_UINT32 rx_mcs_array_len;
+    /** Array size of stats_period[] which contains several stats periods. */
+    A_UINT32 stats_period_array_len;
 
     /**
      * This TLV is followed by TLVs below:
@@ -5230,9 +6430,150 @@ typedef struct {
      *                                                       array index is (peer_index * WLAN_MAX_AC + ac_index) * rx_mpdu_aggr_array_len + A-MPDU aggregation index
      *    A_UINT32                 rx_mcs[][][];             Array length is (num_peer_ac_rx_stats * WLAN_MAX_AC) * rx_mcs_array_len,
      *                                                       array index is (peer_index * WLAN_MAX_AC + ac_index) * rx_mcs_array_len + MCS index
+     *    wmi_stats_period         stats_period[];           Array length is specified by stats_period_array_len
      **/
 } wmi_report_stats_event_fixed_param;
 
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_peer_stats_info */
+    A_UINT32 tlv_header;
+    /** peer MAC address */
+    wmi_mac_addr peer_macaddr;
+    /** bytes (size of MPDUs) transmitted to this peer */
+    struct {
+        /* lower 32 bits of the tx_bytes value */
+        A_UINT32 low_32;
+        /* upper 32 bits of the tx_bytes value */
+        A_UINT32 high_32;
+    } tx_bytes;
+    /** packets (MSDUs) transmitted to this peer */
+    struct {
+        /* lower 32 bits of the tx_packets value */
+        A_UINT32 low_32;
+        /* upper 32 bits of the tx_packets value */
+        A_UINT32 high_32;
+    } tx_packets;
+    /** bytes (size of MPDUs) received from this peer */
+    struct {
+        /* lower 32 bits of the rx_bytes value */
+        A_UINT32 low_32;
+        /* upper 32 bits of the rx_bytes value */
+        A_UINT32 high_32;
+    } rx_bytes;
+    /** packets (MSDUs) received from this peer */
+    struct {
+        /* lower 32 bits of the rx_packets value */
+        A_UINT32 low_32;
+        /* upper 32 bits of the rx_packets value */
+        A_UINT32 high_32;
+    } rx_packets;
+    /** cumulative retry counts (MPDUs) */
+    A_UINT32 tx_retries;
+    /** number of failed transmissions (MPDUs) (retries exceeded, no ACK) */
+    A_UINT32 tx_failed;
+    /** rate information, it is output of WMI_ASSEMBLE_RATECODE_V1
+     *  (in format of 0x1000RRRR)
+     * The rate-code is a 4-bytes field in which,
+     * for given rate, nss and preamble
+     *
+     * b'31-b'29 unused / reserved
+     * b'28      indicate the version of rate-code (1 = RATECODE_V1)
+     * b'27-b'11 unused / reserved
+     * b'10-b'8  indicate the preamble (0 OFDM, 1 CCK, 2 HT, 3 VHT)
+     * b'7-b'5   indicate the NSS (0 - 1x1, 1 - 2x2, 2 - 3x3, 3 - 4x4)
+     * b'4-b'0   indicate the rate, which is indicated as follows:
+     *          OFDM :     0: OFDM 48 Mbps
+     *                     1: OFDM 24 Mbps
+     *                     2: OFDM 12 Mbps
+     *                     3: OFDM 6 Mbps
+     *                     4: OFDM 54 Mbps
+     *                     5: OFDM 36 Mbps
+     *                     6: OFDM 18 Mbps
+     *                     7: OFDM 9 Mbps
+     *         CCK (pream == 1)
+     *                     0: CCK 11 Mbps Long
+     *                     1: CCK 5.5 Mbps Long
+     *                     2: CCK 2 Mbps Long
+     *                     3: CCK 1 Mbps Long
+     *                     4: CCK 11 Mbps Short
+     *                     5: CCK 5.5 Mbps Short
+     *                     6: CCK 2 Mbps Short
+     *         HT/VHT (pream == 2/3)
+     *                     0..7: MCS0..MCS7 (HT)
+     *                     0..9: MCS0..MCS9 (11AC VHT)
+     *                     0..11: MCS0..MCS11 (11AX VHT)
+     */
+    /** rate-code of the last transmission */
+    A_UINT32 last_tx_rate_code;
+    /** rate-code of the last received PPDU */
+    A_UINT32 last_rx_rate_code;
+    /** bitrate of the last transmission, in units of kbps */
+    A_UINT32 last_tx_bitrate_kbps;
+    /** bitrate of the last received PPDU, in units of kbps */
+    A_UINT32 last_rx_bitrate_kbps;
+    /** combined RSSI of the last received PPDU, in unit of dBm */
+    A_INT32 peer_rssi;
+} wmi_peer_stats_info;
+
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_peer_stats_info_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** VDEV to which the peers belong to */
+    A_UINT32 vdev_id;
+    /** number of peers in peer_stats_info[] */
+    A_UINT32 num_peers;
+    /** flag to indicate if there are more peers which will
+     *  be sent a following seperate peer_stats_info event */
+    A_UINT32 more_data;
+    /* This TLV is followed by another TLV of array of structs
+     * wmi_peer_stats_info peer_stats_info[];
+     */
+} wmi_peer_stats_info_event_fixed_param;
+
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_radio_chan_stats */
+     A_UINT32 tlv_header;
+     /** primary channel freq of the channel whose stats is sent */
+     A_UINT32 chan_mhz;
+     /** accumulation of time the radio is tuned to this channel,
+     *  in units of microseconds */
+     A_UINT32 on_chan_us;
+     /** accumulation of the TX PPDU duration over the measurement period,
+     *  in units of microseconds */
+     A_UINT32 tx_duration_us;
+     /** accumulation of the RX PPDU duration over the measurement period,
+     *  in units of microseconds */
+     A_UINT32 rx_duration_us;
+     /** ratio of channel busy time to on_chan_us, in units of percent */
+     A_UINT32 chan_busy_ratio;
+     /** ratio of on_chan_us to the measurement period, in units of percent */
+     A_UINT32 on_chan_ratio;
+     /** measurement period, in units of microseconds */
+     A_UINT32 measurement_period_us;
+     /** MPDUs transmitted on this channel */
+     A_UINT32 tx_mpdus;
+     /** MSDUs transmitted on this channel */
+     A_UINT32 tx_msdus;
+     /** MPDUS successfully received on this channel */
+     A_UINT32 rx_succ_mpdus;
+     /** Failed MPDUs (CRC failures) received on this channel */
+     A_UINT32 rx_fail_mpdus;
+} wmi_radio_chan_stats;
+
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_radio_chan_stats_event_fixed_param */
+     A_UINT32 tlv_header;
+     /** number of channel stats in radio_chan_stats[] */
+     A_UINT32 num_chans;
+     /* This TLV is followed by another TLV of array of structs
+     * wmi_radio_chan_stats radio_chan_stats[];
+     */
+} wmi_radio_chan_stats_event_fixed_param;
+
 /**
  *  PDEV statistics
  *  @todo
@@ -5287,6 +6628,17 @@ typedef struct {
     A_UINT32         bcn_rssi_history[MAX_RSSI_VALUES];/*History of last ten Beacon rssi of the connected Bss*/
 } wmi_vdev_stats;
 
+/*
+ * vdev ext stats with additonal bcn stats
+ * (Due to backward compatiblity requirements, these new stats fields cannot be
+ * added inside wmi_vdev_stats.)
+ */
+typedef struct {
+    A_UINT32 vdev_id;
+    A_UINT32 tx_bcn_succ_cnt; /* Total number of beacon frame transmitted successfully */
+    A_UINT32 tx_bcn_outage_cnt; /* Total number of failed beacons */
+} wmi_bcn_stats;
+
 /**
  *  peer statistics.
  *
@@ -5380,6 +6732,17 @@ typedef struct {
 } wmi_rssi_stats;
 
 typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_congestion_stats */
+    A_UINT32 vdev_id;
+   /* congestion -
+    * This field holds the congestion percentage = (busy_time/total_time)*100
+    * for the interval from when the vdev was started to the current time
+    * (or the time at which the vdev was stopped).
+    */
+    A_UINT32 congestion;
+} wmi_congestion_stats;
+
+typedef struct {
     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_per_chain_rssi_stats */
     A_UINT32 tlv_header;
     A_UINT32 num_per_chain_rssi_stats;
@@ -5449,6 +6812,25 @@ typedef struct {
 /* NAN Data Interface */
 #define WMI_VDEV_TYPE_NDI        0x7
 
+/*
+ * Param values to be sent for WMI_VDEV_PARAM_SGI command
+ * which are used in 11ax systems
+ */
+#define WMI_SGI_LEGACY         0x1 /* for HT and VHT   */
+#define WMI_SGI_HE_400_NS      0x2 /* for HE 400 nsec  */
+#define WMI_SGI_HE_800_NS      0x4 /* for HE 800 nsec  */
+#define WMI_SGI_HE_1600_NS     0x8 /* for HE 1600 nsec */
+#define WMI_SGI_HE_3200_NS    0x10 /* for HE 3200 nsec */
+
+/*
+ * Param values to be sent for WMI_VDEV_PARAM_HE_LTF command
+ * which are used in 11ax systems
+ */
+#define WMI_HE_LTF_DEFAULT 0x0
+#define WMI_HE_LTF_1X      0x1
+#define WMI_HE_LTF_2X      0x2
+#define WMI_HE_LTF_4X      0x3
+
 /** values for vdev_subtype */
 #define WMI_UNIFIED_VDEV_SUBTYPE_P2P_DEVICE 0x1
 #define WMI_UNIFIED_VDEV_SUBTYPE_P2P_CLIENT 0x2
@@ -5478,157 +6860,597 @@ typedef struct {
  * Host is sending bcn_tx_rate to override the beacon tx rates.
  */
 #define WMI_UNIFIED_VDEV_START_BCN_TX_RATE_PRESENT (1<<2)
+/** Indicates if LDPC RX will be advertized inside HT/VHT Capabilities IE
+ * of assoc request/response
+ */
+#define WMI_UNIFIED_VDEV_START_LDPC_RX_ENABLED  (1<<3)
 
+/* BSS color 0-6 */
 #define WMI_HEOPS_COLOR_GET(he_ops) WMI_GET_BITS(he_ops, 0, 6)
 #define WMI_HEOPS_COLOR_SET(he_ops, value) WMI_SET_BITS(he_ops, 0, 6, value)
 
+/* Default PE Duration subfield indicates the PE duration in units of 4 us */
 #define WMI_HEOPS_DEFPE_GET(he_ops) WMI_GET_BITS(he_ops, 6, 3)
 #define WMI_HEOPS_DEFPE_SET(he_ops, value) WMI_SET_BITS(he_ops, 6, 3, value)
 
+/* TWT required */
 #define WMI_HEOPS_TWT_GET(he_ops) WMI_GET_BITS(he_ops, 9, 1)
 #define WMI_HEOPS_TWT_SET(he_ops, value) WMI_SET_BITS(he_ops, 9, 1, value)
 
-#define WMI_HEOPS_RTSTHLD_GET(he_ops) WMI_GET_BITS(he_ops, 10, 7)
-#define WMI_HEOPS_RTSTHLD_SET(he_ops, value) WMI_SET_BITS(he_ops, 10, 7, value)
+/* RTS threshold in units of 32 us,0 - always use RTS 1023 - this is disabled */
+#define WMI_HEOPS_RTSTHLD_GET(he_ops) WMI_GET_BITS(he_ops, 10, 10)
+#define WMI_HEOPS_RTSTHLD_SET(he_ops, value) WMI_SET_BITS(he_ops, 10, 10, value)
 
-#define WMI_HEOPS_PDMIN_GET(he_ops) WMI_GET_BITS(he_ops, 17, 5)
-#define WMI_HEOPS_PDMIN_SET(he_ops, value) WMI_SET_BITS(he_ops, 17, 5, value)
+/* Partial BSS Color field indicates whether BSS applies an AID assignment rule using partial BSS color bits */
+#define WMI_HEOPS_PARTBSSCOLOR_GET(he_ops) WMI_GET_BITS(he_ops, 20, 1)
+#define WMI_HEOPS_PARTBSSCOLOR_SET(he_ops, value) WMI_SET_BITS(he_ops, 20, 1, value)
 
-#define WMI_HEOPS_PDMAX_GET(he_ops) WMI_GET_BITS(he_ops, 22, 5)
-#define WMI_HEOPS_PDMAX_SET(he_ops, value) WMI_SET_BITS(he_ops, 22, 5, value)
+/* MAX BSS supported by MultiBSS element */
+#define WMI_HEOPS_MAXBSSID_GET(he_ops) WMI_GET_BITS(he_ops, 21, 8)
+#define WMI_HEOPS_MAXBSSID_SET(he_ops, value) WMI_SET_BITS(he_ops, 21, 8, value)
+
+/* Tx BSSID Indicator indicates whether HE AP corresponds to transmitted BSSID */
+#define WMI_HEOPS_TXBSSID_GET(he_ops) WMI_GET_BITS(he_ops, 29, 1)
+#define WMI_HEOPS_TXBSSID_SET(he_ops, value) WMI_SET_BITS(he_ops, 29, 1, value)
+
+/* when set to 1 disables use of BSS color */
+#define WMI_HEOPS_BSSCOLORDISABLE_GET(he_ops) WMI_GET_BITS(he_ops, 30, 1)
+#define WMI_HEOPS_BSSCOLORDISABLE_SET(he_ops, value) WMI_SET_BITS(he_ops, 30, 1, value)
+
+/**--- HEOPS_DUALBEACON: DO NOT USE - DEPRECATED ---*/
+/* When set to 1 HE AP transmits beacons using two PHY formats,
+ * one in non-HE format and other in an HE_EXT_SU PHY format
+ */
+#define WMI_HEOPS_DUALBEACON_GET(he_ops) (0)
+#define WMI_HEOPS_DUALBEACON_SET(he_ops, value) {;}
 
 #define WMI_MAX_HECAP_PHY_SIZE                 (3)
-#define WMI_HECAP_PHY_COD_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 0, 1)
-#define WMI_HECAP_PHY_COD_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 0, 1, value)
 
-#define WMI_HECAP_PHY_TXLDPC_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 1, 1)
-#define WMI_HECAP_PHY_TXLDPC_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 1, 1, value)
+/* Dual Band both 2.4 GHz and 5 GHz Supported */
+#define WMI_HECAP_PHY_DB_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 0, 1)
+#define WMI_HECAP_PHY_DB_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 0, 1, value)
 
-#define WMI_HECAP_PHY_RXLDPC_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 2, 1)
-#define WMI_HECAP_PHY_RXLDPC_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 2, 1, value)
+/*
+ * B0: Indicates STA support 40 MHz channel width in 2.4 GHz
+ * B1: Indicates STA support 40 MHz and 80 MHz channel width in 5 GHz
+ * B2: Indicates STA supports 160 MHz channel width in 5 GHz
+ * B3: Indicates STA supports 160/80+80 MHz channel width in 5 GHz
+ * B4: If B1 is set to 0, then B5 indicates support of 242/106/52/26-tone
+ *     RU mapping in 40 MHz channel width in 2.4 GHz. Otherwise Reserved.
+ * B5: If B2, B3, and B4 are set to 0, then B6 indicates support of
+ *     242-tone RU mapping in 40 MHz and 80
+ * MHz channel width in 5 GHz. Otherwise Reserved.
+ * B6: Reserved
+ */
+#define WMI_HECAP_PHY_CBW_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 1, 7)
+#define WMI_HECAP_PHY_CBW_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 1, 7, value)
 
-#define WMI_HECAP_PHY_DCM_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 3, 3)
-#define WMI_HECAP_PHY_DCM_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 3, 3, value)
+/*
+ * B0: Indicates STA supports reception of preamble puncturing in 80 MHz,
+ *     where in the preamble only the secondary 20 MHz is punctured
+ * B1: Indicates STA supports reception of preamble puncturing in 80 MHz,
+ *     where in the preamble only one of the two 20 MHz sub-channels in the
+ *     secondary 40 MHz is punctured
+ * B2: Indicates STA supports reception of preamble puncturing in 160 MHz
+ *     or 80+80 MHz, where in the primary 80 MHz of the preamble only the
+ *     secondary 20 MHz is punctured
+ * B3: Indicates STA supports reception of preamble puncturing in 160 MHz
+ *     or 80+80 MHz, where in the primary 80 MHz of the preamble, the
+ *     primary 40 MHz is present
+ */
+#define WMI_HECAP_PHY_PREAMBLEPUNCRX_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 8, 4)
+#define WMI_HECAP_PHY_PREAMBLEPUNCRX_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 8, 4, value)
 
-#define WMI_HECAP_PHY_OLTF_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 6, 1)
-#define WMI_HECAP_PHY_OLTF_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 6, 1, value)
+/* Indicates transmitting STA is a Class A (1) or a Class B (0) device */
+#define WMI_HECAP_PHY_COD_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 12, 1)
+#define WMI_HECAP_PHY_COD_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 12, 1, value)
 
-#define WMI_HECAP_PHY_CBW_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 7, 3)
-#define WMI_HECAP_PHY_CBW_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 7, 3, value)
+/* Indicates support of transmission and reception of LDPC encoded packets */
+#define WMI_HECAP_PHY_LDPC_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 13, 1)
+#define WMI_HECAP_PHY_LDPC_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 13, 1, value)
 
-#define WMI_HECAP_PHY_TXSTBC_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 10, 1)
-#define WMI_HECAP_PHY_TXSTBC_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 10, 1, value)
+/* Below 2 macros are for maintaining backward compatability - Deprecated use WMI_HECAP_PHY_LDPC instead */
+#define WMI_HECAP_PHY_TXLDPC_GET(he_cap_phy) WMI_HECAP_PHY_LDPC_GET(he_cap_phy)
+#define WMI_HECAP_PHY_TXLDPC_SET(he_cap_phy, value) WMI_HECAP_PHY_LDPC_SET(he_cap_phy, value)
+/* Below 2 macros are for maintaining backward compatability - Deprecated use WMI_HECAP_PHY_LDPC instead */
+#define WMI_HECAP_PHY_RXLDPC_GET(he_cap_phy) WMI_HECAP_PHY_LDPC_GET(he_cap_phy)
+#define WMI_HECAP_PHY_RXLDPC_SET(he_cap_phy, value) WMI_HECAP_PHY_LDPC_SET(he_cap_phy, value)
 
-#define WMI_HECAP_PHY_RXSTBC_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 11, 1)
-#define WMI_HECAP_PHY_RXSTBC_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 11, 1, value)
+/*
+ * B0: Indicates support of reception of 1x LTF and 0.8us guard interval duration for HE SU PPDUs.
+ */
+#define WMI_HECAP_PHY_LTFGIFORHE_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 14, 1)
+#define WMI_HECAP_PHY_LTFGIFORHE_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 14, 1, value)
 
-#define WMI_HECAP_PHY_DLOFMAMUMIMO_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 12, 1)
-#define WMI_HECAP_PHY_DLOFDMAMUMIO_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 12, 1, value)
+/*
+ * When the Doppler Rx subfield is 1, indicates the maximum number of space-
+ * time streams supported for reception when midamble is used in the Data field.
+ */
+#define WMI_HECAP_PHY_MIDAMBLERXMAXNSTS_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 15, 2)
+#define WMI_HECAP_PHY_MIDAMBLERXMAXNSTS_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 15, 2, value)
+/*
+ * B0: For a transmitting STA acting as beamformee, it indicates support of
+ *     NDP reception using 4x LTF and 3.2 us guard interval duration
+ */
+#define WMI_HECAP_PHY_LTFGIFORNDP_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 17, 1)
+#define WMI_HECAP_PHY_LTFGIFORNDP_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 17, 1, value)
 
-#define WMI_HECAP_PHY_UL_MU_MIMO_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 13, 1)
-#define WMI_HECAP_PHY_UL_MU_MIMO_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 13, 1, value)
+/* indicates support for the transmission of HE PPDUs using STBC with one spatial stream for <= 80MHz Tx*/
+#define WMI_HECAP_PHY_TXSTBC_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 18, 1)
+#define WMI_HECAP_PHY_TXSTBC_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 18, 1, value)
 
-#define WMI_HECAP_PHY_ULOFDMA_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 14, 1)
-#define WMI_HECAP_PHY_ULOFDMA_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 14, 1, value)
+/* indicates support for the reception of HE PPDUs using STBC with one spatial stream for <= 80MHz Tx*/
+#define WMI_HECAP_PHY_RXSTBC_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 19, 1)
+#define WMI_HECAP_PHY_RXSTBC_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 19, 1, value)
 
-#define WMI_HECAP_PHY_TXDOPPLER_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 15, 1)
-#define WMI_HECAP_PHY_TXDOPPLER_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 15, 1, value)
+/* indicates transmitting STA supports transmitting HE PPDUs with Doppler procedure */
+#define WMI_HECAP_PHY_TXDOPPLER_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 20, 1)
+#define WMI_HECAP_PHY_TXDOPPLER_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 20, 1, value)
 
-#define WMI_HECAP_PHY_RXDOPPLER_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 16, 1)
-#define WMI_HECAP_PHY_RXDOPPLER_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 16, 1, value)
+/* indicates transmitting STA supports receiving HE PPDUs with Doppler procedure */
+#define WMI_HECAP_PHY_RXDOPPLER_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 21, 1)
+#define WMI_HECAP_PHY_RXDOPPLER_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 21, 1, value)
 
-#define WMI_HECAP_PHY_CBMODE_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 17, 8)
-#define WMI_HECAP_PHY_CBMODE_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 17, 8, value)
+/*
+ * If the transmitting STA is an AP:
+ *     indicates STA supports of reception of full bandwidth UL MU-MIMO
+ *     transmission.
+ * If the transmitting STA is a non-AP STA:
+ *     indicates STA supports of transmission of full bandwidth UL MU-MIMO
+ *     transmission.
+ */
+#define WMI_HECAP_PHY_UL_MU_MIMO_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 22, 1)
+#define WMI_HECAP_PHY_UL_MU_MIMO_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 22, 1, value)
 
-#define WMI_HECAP_PHY_PADDING_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 25, 2)
-#define WMI_HECAP_PHY_PADDING_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 25, 2, value)
+/*
+ * If the transmitting STA is an AP:
+ *     indicates STA supports of reception of UL MUMIMO transmission on an
+ *     RU in an HE MU PPDU where the RU does not span the entire PPDU bandwidth.
+ * If the transmitting STA is a non-AP STA:
+ *     indicates STA supports of transmission of UL MU-MIMO transmission on an
+ *     RU in an HE MU PPDU where the RU does not span the entire PPDU bandwidth.
+ */
+#define WMI_HECAP_PHY_ULMUMIMOOFDMA_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 23, 1)
+#define WMI_HECAP_PHY_ULMUMIMOOFDMA_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 23, 1, value)
+
+/* Tx DCM
+ * B0:B1
+ *     00: Does not support DCM
+ *     01: BPSK
+ *     10: QPSK
+ *     11: 16-QAM
+ * B2 signals maximum number of spatial streams with DCM
+ *     0: 1 spatial stream
+ *     1: 2 spatial streams
+ */
+#define WMI_HECAP_PHY_DCMTX_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 24, 3)
+#define WMI_HECAP_PHY_DCMTX_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 24, 3, value)
+
+/* Rx DCM
+ * B0:B1
+ *     00: Does not support DCM
+ *     01: BPSK
+ *     10: QPSK
+ *     11: 16-QAM
+ * B2 signals maximum number of spatial streams with DCM
+ *     0: 1 spatial stream
+ *     1: 2 spatial streams
+ */
+#define WMI_HECAP_PHY_DCMRX_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 27, 3)
+#define WMI_HECAP_PHY_DCMRX_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 27, 3, value)
 
-#define WMI_HECAP_PHY_32GI_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 0, 26)
-#define WMI_HECAP_PHY_32GI_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 0, 26, value)
+/*
+ * Indicates that the STA supports the reception of an HE MU PPDU payload
+ * over full bandwidth and partial bandwidth (106-tone RU within 20 MHz).
+ */
+#define WMI_HECAP_PHY_ULHEMU_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 30, 1)
+#define WMI_HECAP_PHY_ULHEMU_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 30, 1, value)
 
-#define WMI_HECAP_PHY_SUBFMR_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 26, 1)
-#define WMI_HECAP_PHY_SUBFMR_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 26, 1, value)
+/* Indicates support for operation as an SU beamformer */
+#define WMI_HECAP_PHY_SUBFMR_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[0], 31, 1)
+#define WMI_HECAP_PHY_SUBFMR_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[0], 31, 1, value)
 
-#define WMI_HECAP_PHY_SUBFME_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 27, 1)
-#define WMI_HECAP_PHY_SUBFME_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 27, 1, value)
+/* Indicates support for operation as an SU beamformee */
+#define WMI_HECAP_PHY_SUBFME_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 0, 1)
+#define WMI_HECAP_PHY_SUBFME_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 0, 1, value)
 
-#define WMI_HECAP_PHY_SUBFMESTS_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 28, 3)
-#define WMI_HECAP_PHY_SUBFMESTS_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 28, 3, value)
+/* Indicates support for operation as an MU Beamformer */
+#define WMI_HECAP_PHY_MUBFMR_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 1, 1)
+#define WMI_HECAP_PHY_MUBFMR_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 1, 1, value)
 
-#define WMI_HECAP_PHY_NOSUNDIMENS_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[2], 0, 3)
-#define WMI_HECAP_PHY_NOSUNDIMENS_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[2], 0, 3, value)
+/*
+ * Num STS -1 for <= 80MHz (min val 3)
+ * The maximum number of space-time streams minus 1 that the STA can
+ * receive in an HE NDP
+ */
+#define WMI_HECAP_PHY_BFMESTSLT80MHZ_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 2, 3)
+#define WMI_HECAP_PHY_BFMESTSLT80MHZ_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 2, 3, value)
 
-#define WMI_HECAP_PHY_MUBFMR_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[2], 3, 1)
-#define WMI_HECAP_PHY_MUBFMR_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[2], 3, 1, value)
+/*
+ * Num STS -1 for > 80MHz (min val 3)
+ * The maximum number of space-time streams minus 1 that the STA can
+ * receive in an HE NDP
+ */
+#define WMI_HECAP_PHY_BFMESTSGT80MHZ_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 5, 3)
+#define WMI_HECAP_PHY_BFMESTSGT80MHZ_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 5, 3, value)
 
-#define WMI_HECAP_PHY_40MHZNSS_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[2], 4, 18)
-#define WMI_HECAP_PHY_40MHZNSS_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[2], 4, 18, value)
+/*
+ * Number Of Sounding Dimensions For <= 80 MHz
+ * If SU beamformer capable, set to the maximum supported value of the
+ * TXVECTOR parameter NUM_STS minus 1.
+ * Otherwise, reserved.
+ */
+#define WMI_HECAP_PHY_NUMSOUNDLT80MHZ_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 8, 3)
+#define WMI_HECAP_PHY_NUMSOUNDLT80MHZ_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 8, 3, value)
 
-#define WMI_HECAP_MAC_MTID_GET(he_cap) WMI_GET_BITS(he_cap, 0, 3)
-#define WMI_HECAP_MAC_MTID_SET(he_cap, value) WMI_SET_BITS(he_cap, 0, 3, value)
+/*
+ * Number Of Sounding Dimensions For > 80 MHz
+ * If SU beamformer capable, set to the maximum supported value of the
+ * TXVECTOR parameter NUM_STS minus 1.
+ * Otherwise, reserved.
+ */
+#define WMI_HECAP_PHY_NUMSOUNDGT80MHZ_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 11, 3)
+#define WMI_HECAP_PHY_NUMSOUNDGT80MHZ_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 11, 3, value)
 
-#define WMI_HECAP_MAC_AACK_GET(he_cap) WMI_GET_BITS(he_cap, 3, 1)
-#define WMI_HECAP_MAC_AACK_SET(he_cap, value) WMI_SET_BITS(he_cap, 3, 1, value)
+/*
+ * Indicates if the HE beamformee is capable of feedback with tone
+ * grouping of 16 in the HE Compressed Beamforming Report field for
+ * a SU-type feedback.
+ */
+#define WMI_HECAP_PHY_NG16SUFEEDBACKLT80_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 14, 1)
+#define WMI_HECAP_PHY_NG16SUFEEDBACKLT80_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 14, 1, value)
 
-#define WMI_HECAP_MAC_MINFRAGSZ_GET(he_cap) WMI_GET_BITS(he_cap, 4, 2)
-#define WMI_HECAP_MAC_MINFRAGSZ_SET(he_cap, value) WMI_SET_BITS(he_cap, 4, 2, value)
+/*
+ * Indicates if the HE beamformee is capable of feedback with tone
+ * grouping of 16 in the HE Compressed Beamforming Report field for
+ * a MU-type feedback.
+ */
+#define WMI_HECAP_PHY_NG16MUFEEDBACKGT80_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 15, 1)
+#define WMI_HECAP_PHY_NG16MUFEEDBACKGT80_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 15, 1, value)
 
-#define WMI_HECAP_MAC_HEFRAG_GET(he_cap) WMI_GET_BITS(he_cap, 6, 2)
-#define WMI_HECAP_MAC_HEFRAG_SET(he_cap, value) WMI_SET_BITS(he_cap, 6, 2, value)
+/*
+ * Indicates if HE beamformee is capable of feedback with codebook
+ * size {4, 2} in the HECompressed Beamforming Report field for
+ * a SU-type feedback.
+ */
+#define WMI_HECAP_PHY_CODBK42SU_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 16, 1)
+#define WMI_HECAP_PHY_CODBK42SU_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 16, 1, value)
 
-#define WMI_HECAP_MAC_MURTS_GET(he_cap) WMI_GET_BITS(he_cap, 8, 1)
-#define WMI_HECAP_MAC_MURTS_SET(he_cap, value) WMI_SET_BITS(he_cap, 8, 1, value)
+/*
+ * Indicates if HE beamformee is capable of feedback with codebook
+ * size {7, 5} in the HE Compressed Beamforming Report field for
+ * a MU-type feedback.
+ */
+#define WMI_HECAP_PHY_CODBK75MU_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 17, 1)
+#define WMI_HECAP_PHY_CODBK75MU_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 17, 1, value)
 
-#define WMI_HECAP_MAC_OMI_GET(he_cap) WMI_GET_BITS(he_cap, 9, 1)
-#define WMI_HECAP_MAC_OMI_SET(he_cap, value) WMI_SET_BITS(he_cap, 9, 1, value)
+/*
+ * Beamforming Feedback With Trigger Frame
+ * If the transmitting STA is an AP STA:
+ * B0: indicates support of reception of SU-Type partial(1) and full bandwidth feedback(0)
+ * B1: indicates support of reception of MU-Type partial(1) bandwidth feedback
+ * B2: indicates support of reception of CQI-Only partial and full bandwidth feedback
+ * If the transmitting STA is a non-AP STA:
+ * B0: indicates support of transmission of SU-Type partial(1) and full bandwidth(0) feedback
+ * B1: indicates support of transmission of MU-Type partial(1) bandwidth feedback
+ * B2: indicates support of transmission of CQI-Onlypartial (1)and full bandwidth feedback
+ */
+#define WMI_HECAP_PHY_BFFEEDBACKTRIG_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 18, 3)
+#define WMI_HECAP_PHY_BFFEEDBACKTRIG_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 18, 3, value)
 
-#define WMI_HECAP_MAC_HECTRL_GET(he_cap) WMI_GET_BITS(he_cap, 10, 1)
-#define WMI_HECAP_MAC_HECTRL_SET(he_cap, value) WMI_SET_BITS(he_cap, 10, 1, value)
+/* Indicates the support of transmission and reception of an HE extended range SU PPDU payload transmitted
+ * over the right 106-tone RU or partial BW ER
+ */
+#define WMI_HECAP_PHY_HEERSU_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 21, 1)
+#define WMI_HECAP_PHY_HEERSU_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 21, 1, value)
 
-#define WMI_HECAP_MAC_MBAHECTRL_GET(he_cap) WMI_GET_BITS(he_cap, 11, 1)
-#define WMI_HECAP_MAC_MBAHECTRL_SET(he_cap, value) WMI_SET_BITS(he_cap, 11, 1, value)
+/* Indicates that the non-AP STA supports reception of a DL MU-MIMO transmission on an RU in an HE MU PPDU
+ * where the RU does not span the entire PPDU bandwidth.
+ */
+#define WMI_HECAP_PHY_DLMUMIMOPARTIALBW_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 22, 1)
+#define WMI_HECAP_PHY_DLMUMIMOPARTIALBW_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 22, 1, value)
+
+/* Indicates whether or not the PPE Threshold field is present */
+#define WMI_HECAP_PHY_PETHRESPRESENT_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 23, 1)
+#define WMI_HECAP_PHY_PETHRESPRESENT_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 23, 1, value)
+
+/* Indicates that the STA supports SRP-based SR operation */
+#define WMI_HECAP_PHY_SRPSPRESENT_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 24, 1)
+#define WMI_HECAP_PHY_SRPPRESENT_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 24, 1, value)
+
+/* Indicates that the STA supports a power boost factor ar for the r-th RU in the range [0.5, 2] */
+#define WMI_HECAP_PHY_PWRBOOSTAR_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 25, 1)
+#define WMI_HECAP_PHY_PWRBOOSTAR_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 25, 1, value)
+
+/* Indicates support for the reception of 4x LTF and 0.8us guard interval duration for HE SU PPDUs. */
+#define WMI_HECAP_PHY_4XLTFAND800NSECSGI_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 26, 1)
+#define WMI_HECAP_PHY_4XLTFAND800NSECSGI_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 26, 1, value)
+
+/* For a transmitting STA acting as a beamformee, it indicates the maximum Nc for beamforming sounding
+ * feedback supported If SU beamformee capable, then set to the maximum Nc for beamforming sounding feedback
+ * minus 1. Otherwise, reserved.
+ */
+#define WMI_HECAP_PHY_MAXNC_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 27, 3)
+#define WMI_HECAP_PHY_MAXNC_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 27, 3, value)
+
+/* Indicates support for the transmission of an HE PPDU that has a bandwidth greater than 80 MHz and is using
+ * STBC with one spatial stream
+ */
+#define WMI_HECAP_PHY_STBCTXGT80_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 30, 1)
+#define WMI_HECAP_PHY_STBCTXGT80_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 30, 1, value)
+
+/* Indicates support for the reception of an HE PPDU that has a bandwidth greater than 80 MHz and is using
+ * STBC with one spatial stream
+ */
+#define WMI_HECAP_PHY_STBCRXGT80_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 31, 1)
+#define WMI_HECAP_PHY_STBCRXGT80_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 31, 1, value)
+
+/* Indicates support for the reception of an HE ER SU PPDU with 4x LTF and 0.8 us guard interval duration */
+#define WMI_HECAP_PHY_ERSU4X800NSECGI_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[2], 0, 1)
+#define WMI_HECAP_PHY_ERSU4X800NSECGI_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[2], 0, 1, value)
+
+/*
+ * Indicates support of 26-, 52-, and 106-tone mapping for a 20 MHz operating non-AP HE STA that is the
+ * receiver of a 40 MHz HE MU PPDU in 2.4 GHz band, or the transmitter of a 40 MHz HE TB PPDU in 2.4GHz band.
+ */
+#define WMI_HECAP_PHY_HEPPDU20IN40MHZ2G_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[2], 1, 1)
+#define WMI_HECAP_PHY_HEPPDU20IN40MHZ2G_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[2], 1, 1, value)
+
+/*
+ * Indicates support of 26-, 52-, and 106-tone mapping for a 20 MHz operating non-AP HE STA that is the
+ * receiver of a 80+80 MHz or a 160 MHz HE MU PPDU, or the transmitter of a 80+80 MHz or 160 MHz HE TB PPDU.
+ */
+#define WMI_HECAP_PHY_HEPPDU20IN160OR80P80MHZ_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[2], 2, 1)
+#define WMI_HECAP_PHY_HEPPDU20IN160OR80P80MHZ_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[2], 2, 1, value)
+
+/*
+ * Indicates supports of 160 MHz OFDMA for a non-AP HE STA that sets bit B1 of Channel Width Set to 1, and
+ * sets B2 and B3 of Channel Width Set each to 0, when operating with 80 MHz channel width. The capability
+ * bit is applicable while receiving a 80+80 MHz or a 160 MHz HE MU PPDU, or transmitting a 80+80 MHz or a
+ * 160 MHz HE TB PPDU.
+ */
+#define WMI_HECAP_PHY_HEPPDU80IN160OR80P80MHZ_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[2], 3, 1)
+#define WMI_HECAP_PHY_HEPPDU80IN160OR80P80MHZ_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[2], 3, 1, value)
+
+/* Indicates support for the reception of an HE ER SU PPDU with 1x LTF and 0.8 us guard interval duration */
+#define WMI_HECAP_PHY_ERSU1X800NSECGI_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[2], 4, 1)
+#define WMI_HECAP_PHY_ERSU1X800NSECGI_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[2], 4, 1, value)
+
+/*
+ * When the Doppler Rx subfield is 1, indicates support for receiving midambles with 2x HE-LTF, 1x HE-LTF
+ * in HE SU PPDU if the HE SU PPDU With 1x HE-LTF And 0.8 s GI subfield is set to 1, and 1x HE-LTF in
+ * HE ER SU PPDU if the HE ER SU PPDU With 1x HELTF And 0.8 s GI subfield is set to 1.
+ */
+#define WMI_HECAP_PHY_MIDAMBLERX2XAND1XHELTF_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[2], 5, 1)
+#define WMI_HECAP_PHY_MIDAMBLERX2XAND1XHELTF_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[2], 5, 1, value)
+
+/*HTC + HE Support  Set to 1 if STA supports reception of HE Variant HT control Field*/
+#define WMI_HECAP_MAC_HECTRL_GET(he_cap) WMI_GET_BITS(he_cap, 0, 1)
+#define WMI_HECAP_MAC_HECTRL_SET(he_cap, value) WMI_SET_BITS(he_cap, 0, 1, value)
+
+/* set to 1 to for TWT Requestor support*/
+#define WMI_HECAP_MAC_TWTREQ_GET(he_cap) WMI_GET_BITS(he_cap, 1, 1)
+#define WMI_HECAP_MAC_TWTREQ_SET(he_cap, value) WMI_SET_BITS(he_cap, 1, 1, value)
+
+/* set to 1 to for TWT Responder support*/
+#define WMI_HECAP_MAC_TWTRSP_GET(he_cap) WMI_GET_BITS(he_cap, 2, 1)
+#define WMI_HECAP_MAC_TWTRSP_SET(he_cap, value) WMI_SET_BITS(he_cap, 2, 1, value)
+
+/* Level of frag support
+   Set to 0 for no support for dynamic fragmentation.
+   Set to 1 for support for dynamic fragments that are contained within a S-MPDU
+   Set to 2 for support for dynamic fragments that are contained within a Single MPDU and support for up to
+        one dynamic fragment for each MSDU and each MMPDU within an A-MPDU or multi-TID A-MPDU.
+   Set to 3 for support for dynamic fragments that are contained within a Single MPDU and support for multiple
+        dynamic fragments for each MSDU within an AMPDU or multi-TID AMPDU and up to one dynamic fragment
+        for each MMPDU in a multi-TID A-MPDU that is not a Single MPDU
+*/
+#define WMI_HECAP_MAC_HEFRAG_GET(he_cap) WMI_GET_BITS(he_cap, 3, 2)
+#define WMI_HECAP_MAC_HEFRAG_SET(he_cap, value) WMI_SET_BITS(he_cap, 3, 2, value)
+
+/* The maximum number of fragmented MSDUs, Nmax,defined by this field is Nmax = 2 Maximum Number Of FMPDUs*/
+#define WMI_HECAP_MAC_MAXFRAGMSDU_GET(he_cap) WMI_GET_BITS(he_cap, 5, 3)
+#define WMI_HECAP_MAC_MAXFRAGMSDU_SET(he_cap, value) WMI_SET_BITS(he_cap, 5, 3, value)
+
+/* 0 =  no restriction on the minimum payload , 1 = 128 octets min, 2 = 256 octets min, 3 = 512 octets min */
+#define WMI_HECAP_MAC_MINFRAGSZ_GET(he_cap) WMI_GET_BITS(he_cap, 8, 2)
+#define WMI_HECAP_MAC_MINFRAGSZ_SET(he_cap, value) WMI_SET_BITS(he_cap, 8, 2, value)
+
+/*0 = no additional processing time, 1 = 8us,2 = 16us */
+#define WMI_HECAP_MAC_TRIGPADDUR_GET(he_cap) WMI_GET_BITS(he_cap, 10, 2)
+#define WMI_HECAP_MAC_TRIGPADDUR_SET(he_cap, value) WMI_SET_BITS(he_cap, 10, 2, value)
+
+/*number of TIDs minus 1 of QoS Data frames that HE STA can aggregate in  multi-TID AMPDU*/
+#define WMI_HECAP_MAC_MTID_GET(he_cap) WMI_GET_BITS(he_cap, 12, 3)
+#define WMI_HECAP_MAC_MTID_SET(he_cap, value) WMI_SET_BITS(he_cap, 12, 3, value)
+
+/*
+ * Indicates support by a STA to receive an ack-enabled A-MPDU in which an A-MSDU is carried in
+ * a QoS Data frame for which no block ack agreement exists.
+ */
+#define WMI_HECAP_MAC_AMSDUINAMPDU_GET(he_cap) WMI_GET_BITS(he_cap, 15, 1)
+#define WMI_HECAP_MAC_AMSDUINAMPDU_SET(he_cap, value) WMI_SET_BITS(he_cap, 15, 1, value)
+
+/*--- HECAP_MAC_HELKAD: DO NOT USE - DEPRECATED ---*/
+/*0=No Feedback,2=Unsolicited,3=Both*/
+#define WMI_HECAP_MAC_HELKAD_GET(he_cap) (0)
+#define WMI_HECAP_MAC_HELKAD_SET(he_cap, value) {;}
+
+/* bit 16 reserved. */
+
+/*Set to 1 for reception of AllAck support*/
+#define WMI_HECAP_MAC_AACK_GET(he_cap) WMI_GET_BITS(he_cap, 17, 1)
+#define WMI_HECAP_MAC_AACK_SET(he_cap, value) WMI_SET_BITS(he_cap, 17, 1, value)
+
+/*Set to 1 if the STA supports reception of the UL MU Response Scheduling A-Control field*/
+#define WMI_HECAP_MAC_ULMURSP_GET(he_cap) WMI_GET_BITS(he_cap, 18, 1)
+#define WMI_HECAP_MAC_ULMURSP_SET(he_cap, value) WMI_SET_BITS(he_cap, 18, 1, value)
 
-#define WMI_HECAP_MAC_ULMURSP_GET(he_cap) WMI_GET_BITS(he_cap, 12, 1)
-#define WMI_HECAP_MAC_ULMURSP_SET(he_cap, value) WMI_SET_BITS(he_cap, 12, 1, value)
+/*Set to 1 if the STA supports the BSR A-Control field functionality.*/
+#define WMI_HECAP_MAC_BSR_GET(he_cap) WMI_GET_BITS(he_cap, 19, 1)
+#define WMI_HECAP_MAC_BSR_SET(he_cap, value) WMI_SET_BITS(he_cap, 19, 1, value)
 
-#define WMI_HECAP_MAC_HELKAD_GET(he_cap) WMI_GET_BITS(he_cap, 13, 2)
-#define WMI_HECAP_MAC_HELKAD_SET(he_cap, value) WMI_SET_BITS(he_cap, 13, 2, value)
+/*Set to 1 when the STA supports broadcast TWT functionality.*/
+#define WMI_HECAP_MAC_BCSTTWT_GET(he_cap) WMI_GET_BITS(he_cap, 20, 1)
+#define WMI_HECAP_MAC_BCSTTWT_SET(he_cap, value) WMI_SET_BITS(he_cap, 20, 1, value)
 
-#define WMI_HECAP_MAC_BSR_GET(he_cap) WMI_GET_BITS(he_cap, 15, 1)
-#define WMI_HECAP_MAC_BSR_SET(he_cap, value) WMI_SET_BITS(he_cap, 15, 1, value)
+/*Set to 1 if STA supports rx of Multi-STA BA that has 32-bit Block Ack Bitmap*/
+#define WMI_HECAP_MAC_32BITBA_GET(he_cap) WMI_GET_BITS(he_cap, 21, 1)
+#define WMI_HECAP_MAC_32BITBA_SET(he_cap, value) WMI_SET_BITS(he_cap, 21, 1, value)
 
-#define WMI_HECAP_MAC_TWTREQ_GET(he_cap) WMI_GET_BITS(he_cap, 16, 1)
-#define WMI_HECAP_MAC_TWTREQ_SET(he_cap, value) WMI_SET_BITS(he_cap, 16, 1, value)
+/*Set to 1 if the STA supports MU cascading operation*/
+#define WMI_HECAP_MAC_MUCASCADE_GET(he_cap) WMI_GET_BITS(he_cap, 22, 1)
+#define WMI_HECAP_MAC_MUCASCADE_SET(he_cap, value) WMI_SET_BITS(he_cap, 22, 1, value)
 
-#define WMI_HECAP_MAC_TWTRSP_GET(he_cap) WMI_GET_BITS(he_cap, 17, 1)
-#define WMI_HECAP_MAC_TWTRSP_SET(he_cap, value) WMI_SET_BITS(he_cap, 17, 1, value)
+/*Set to 1 when the STA supports reception of this multi-TID A-MPDU format*/
+#define WMI_HECAP_MAC_ACKMTIDAMPDU_GET(he_cap) WMI_GET_BITS(he_cap, 23, 1)
+#define WMI_HECAP_MAC_ACKMTIDAMPDU_SET(he_cap, value) WMI_SET_BITS(he_cap, 23, 1, value)
 
-#define WMI_HECAP_MAC_BCSTTWT_GET(he_cap) WMI_GET_BITS(he_cap, 18, 1)
-#define WMI_HECAP_MAC_BCSTTWT_SET(he_cap, value) WMI_SET_BITS(he_cap, 18, 1, value)
+/*Set to 1 when the STA supports its reception*/
+#define WMI_HECAP_MAC_GROUPMSTABA_GET(he_cap) WMI_GET_BITS(he_cap, 24, 1)
+#define WMI_HECAP_MAC_GROUPMSTABA_SET(he_cap, value) WMI_SET_BITS(he_cap, 24, 1, value)
 
-#define WMI_HECAP_MAC_MBSS_GET(he_cap) WMI_GET_BITS(he_cap, 19, 1)
-#define WMI_HECAP_MAC_MBSS_SET(he_cap, value) WMI_SET_BITS(he_cap, 19, 1, value)
+/*Set to 1 if the STA supports reception of the OMI A-Control field*/
+#define WMI_HECAP_MAC_OMI_GET(he_cap) WMI_GET_BITS(he_cap, 25, 1)
+#define WMI_HECAP_MAC_OMI_SET(he_cap, value) WMI_SET_BITS(he_cap, 25, 1, value)
 
-#define WMI_HECAP_MAC_TRIGPADDUR_GET(he_cap) WMI_GET_BITS(he_cap, 20, 2)
-#define WMI_HECAP_MAC_TRIGPADDUR_SET(he_cap, value) WMI_SET_BITS(he_cap, 20, 2, value)
+/*1 if OFDMA Random Access Supported*/
+#define WMI_HECAP_MAC_OFDMARA_GET(he_cap) WMI_GET_BITS(he_cap, 26, 1)
+#define WMI_HECAP_MAC_OFDMARA_SET(he_cap, value) WMI_SET_BITS(he_cap, 26, 1, value)
 
-#define WMI_HECAP_MAC_MAXFRAGMSDU_GET(he_cap) WMI_GET_BITS(he_cap, 22, 3)
-#define WMI_HECAP_MAC_MAXFRAGMSDU_SET(he_cap, value) WMI_SET_BITS(he_cap, 22, 3, value)
+/* Maximum AMPDU Length Exponent.
+ * If the HE STA includes a VHT Capabilities element, the Maximum A-MPDU Length Exponent subfield in
+ * HE Capabilities element combined with the Maximum A-MPDU Length Exponent subfield in VHT
+ * Capabilities element indicate the maximum length of A-MPDU that the STA can Receive where EOF
+ * padding is not included in this limit.
+*/
+#define WMI_HECAP_MAC_MAXAMPDULEN_EXP_GET(he_cap) WMI_GET_BITS(he_cap, 27, 2)
+#define WMI_HECAP_MAC_MAXAMPDULEN_EXP_SET(he_cap, value) WMI_SET_BITS(he_cap, 27, 2, value)
+
+/*A-MSDU Fragmentation Support*/
+#define WMI_HECAP_MAC_AMSDUFRAG_GET(he_cap) WMI_GET_BITS(he_cap, 29, 1)
+#define WMI_HECAP_MAC_AMSDUFRAG_SET(he_cap, value) WMI_SET_BITS(he_cap, 29, 1, value)
+
+/*Flexible TWT Schedule Support*/
+#define WMI_HECAP_MAC_FLEXTWT_GET(he_cap) WMI_GET_BITS(he_cap, 30, 1)
+#define WMI_HECAP_MAC_FLEXTWT_SET(he_cap, value) WMI_SET_BITS(he_cap, 30, 1, value)
+
+/*Rx Control Frame to MultiBSS*/
+#define WMI_HECAP_MAC_MBSS_GET(he_cap) WMI_GET_BITS(he_cap, 31, 1)
+#define WMI_HECAP_MAC_MBSS_SET(he_cap, value) WMI_SET_BITS(he_cap, 31, 1, value)
+
+/* BSRP A-MPDU Aggregation
+ * maintaining compatability since we dont support this now so not wasting memory
+ */
+#define WMI_HECAP_MAC_BSRPAMPDU_GET(he_cap) (0)
+#define WMI_HECAP_MAC_BSRPAMPDU_SET(he_cap, value) {;}
+
+/* Quiet Time Period (QTP) operation
+ * maintaining compatability since we dont support this now so not wasting memory
+ */
+#define WMI_HECAP_MAC_QTP_GET(he_cap) (0)
+#define WMI_HECAP_MAC_QTP_SET(he_cap, value) {;}
+
+/* support by an AP for receiving an (A-)MPDU that contains a BQR in the
+ * A-Control subfield and support by a non-AP STA for generating an (A-)MPDU
+ * that contains a BQR in the A-Control subfield
+ * maintaining compatability since we dont support this now so not wasting memory
+ */
+#define WMI_HECAP_MAC_ABQR_GET(he_cap) (0)
+#define WMI_HECAP_MAC_ABQR_SET(he_cap, value) {;}
+
+/*Indicates support by the STA for the role of SR Responder.*/
+#define WMI_HECAP_MAC_SRRESP_GET(he_cap) (0)
+#define WMI_HECAP_MAC_SRRESP_SET(he_cap, value) {;}
+
+/* Indicates support for an AP to encode OPS information to TIM element of the FILS Discovery
+ * frames or TIM frames as described in AP operation for opportunistic power save.
+ * Indicates support for a non-AP STA to receive the opportunistic power save encoded TIM elements
+ */
+#define WMI_HECAP_MAC_OPS_GET(he_cap) (0)
+#define WMI_HECAP_MAC_OPS_SET(he_cap, value) {;}
+
+/* Indicates support for a non-AP STA to follow the NDP feedback report procedure and respond to
+ * the NDP Feedback Report Poll Trigger frame.
+ */
+#define WMI_HECAP_MAC_NDPFDBKRPT_GET(he_cap) (0)
+#define WMI_HECAP_MAC_NDPFDBKRPT_SET(he_cap, value) {;}
+
+/* BELOW MACROS ARE DEPRECATED Also we are not defining bits for capabilities
+ * beyond bit 31 we donot support as it adds additional dword to our struct which may be later
+ * removed by standard
+ */
+#define WMI_HECAP_MAC_MBAHECTRL_GET(he_cap) (0) /* DO NOT USE - DEPRECATED*/
+#define WMI_HECAP_MAC_MBAHECTRL_SET(he_cap, value) {;} /* DO NOT USE - DEPRECATED*/
+
+#define WMI_HECAP_MAC_MURTS_GET(he_cap) (0) /* DO NOT USE - DEPRECATED*/
+#define WMI_HECAP_MAC_MURTS_SET(he_cap, value) {;} /* DO NOT USE - DEPRECATED*/
+
+/*Deprecate use  WMI_HECAP_PHY_PREAMBLEPUNCRX instead*/
+#define WMI_HECAP_PHY_CBMODE_GET(he_cap_phy) WMI_HECAP_PHY_CBMODE_GET(he_cap_phy)
+#define WMI_HECAP_PHY_CBMODE_SET(he_cap_phy, value) WMI_HECAP_PHY_CBMODE_SET(he_cap_phy, value)
 
-#define WMI_HECAP_MAC_32BITBA_GET(he_cap) WMI_GET_BITS(he_cap, 25, 1)
-#define WMI_HECAP_MAC_32BITBA_SET(he_cap, value) WMI_SET_BITS(he_cap, 25, 1, value)
+/* Below 2 macros are for maintaining backward compatability - Deprecated use WMI_HECAP_PHY_LTFGIFORHE_GET instead */
+#define WMI_HECAP_PHY_OLTF_GET(he_cap_phy) WMI_HECAP_PHY_LTFGIFORHE_GET(he_cap_phy)
+#define WMI_HECAP_PHY_OLTF_SET(he_cap_phy, value) WMI_HECAP_PHY_LTFGIFORHE_SET(he_cap_phy, value)
 
-#define WMI_HECAP_MAC_MUCASCADE_GET(he_cap) WMI_GET_BITS(he_cap, 26, 1)
-#define WMI_HECAP_MAC_MUCASCADE_SET(he_cap, value) WMI_SET_BITS(he_cap, 26, 1, value)
+/*DEPRECATED - USE WMI_HECAP_PHY_BFMENLTSGT80MHZ*/
+#define WMI_HECAP_PHY_SUBFMESTS_GET(he_cap_phy) WMI_HECAP_PHY_BFMESTSLT80MHZ_GET(he_cap_phy)
+#define WMI_HECAP_PHY_SUBFMESTS_SET(he_cap_phy, value) WMI_HECAP_PHY_BFMESTSLT80MHZ_SET(he_cap_phy, value)
 
-#define WMI_HECAP_MAC_ACKMTIDAMPDU_GET(he_cap) WMI_GET_BITS(he_cap, 27, 1)
-#define WMI_HECAP_MAC_ACKMTIDAMPDU_SET(he_cap, value) WMI_SET_BITS(he_cap, 27, 1, value)
+/*DEPRECATED - use WMI_HECAP_PHY_PETHRESPRESENT**/
+#define WMI_HECAP_PHY_PADDING_GET(he_cap_phy) WMI_HECAP_PHY_PETHRESPRESENT_GET(he_cap_phy)
+#define WMI_HECAP_PHY_PADDING_SET(he_cap_phy, value) WMI_HECAP_PHY_PETHRESPRESENT_SET(he_cap_phy, value)
 
-#define WMI_HECAP_MAC_GROUPMSTABA_GET(he_cap) WMI_GET_BITS(he_cap, 28, 1)
-#define WMI_HECAP_MAC_GROUPMSTABA_SET(he_cap, value) WMI_SET_BITS(he_cap, 28, 1, value)
 
-#define WMI_HECAP_MAC_OFDMARA_GET(he_cap) WMI_GET_BITS(he_cap, 29, 1)
-#define WMI_HECAP_MAC_OFDMARA_SET(he_cap, value) WMI_SET_BITS(he_cap, 29, 1, value)
+/**DO NOT USE - DEPRECATED*/
+#define WMI_HECAP_PHY_DLOFMAMUMIMO_GET(he_cap_phy) (0)
+#define WMI_HECAP_PHY_DLOFDMAMUMIO_SET(he_cap_phy, value) {;}
+
+/*DO NOT USE - DEPRECATED**/
+#define WMI_HECAP_PHY_32GI_GET(he_cap_phy) (0)
+#define WMI_HECAP_PHY_32GI_SET(he_cap_phy, value) {;}
+
+/*DO NOT USE - DEPRECATED**/
+#define WMI_HECAP_PHY_NOSUNDIMENS_GET(he_cap_phy) (0)
+#define WMI_HECAP_PHY_NOSUNDIMENS_SET(he_cap_phy, value) {;}
+
+/*DO NOT USE - DEPRECATED**/
+#define WMI_HECAP_PHY_40MHZNSS_GET(he_cap_phy)(0)
+#define WMI_HECAP_PHY_40MHZNSS_SET(he_cap_phy, value) {;}
+
+/* START TEMPORARY WORKAROUND -
+ * Leave legacy names as aliases for new names, until all references to the
+ * legacy names have been removed.
+ */
+#define WMI_HECAP_PHY_ULOFDMA_GET WMI_HECAP_PHY_ULMUMIMOOFDMA_GET
+#define WMI_HECAP_PHY_ULOFDMA_SET WMI_HECAP_PHY_ULMUMIMOOFDMA_SET
+/* END TEMPORARY WORKAROUND */
+
+/* DEPRECATED - use WMI_HECAP_PHY_DCMRX or WMI_HECAP_PHY_DCMTX */
+#define WMI_HECAP_PHY_DCM_GET(he_cap_phy) WMI_HECAP_PHY_DCMRX_GET(he_cap_phy)
+#define WMI_HECAP_PHY_DCM_SET(he_cap_phy, value) WMI_HECAP_PHY_DCMRX_SET(he_cap_phy, value)
+
+/*
+ * The maximum value for NSTS-1<=80MHz,(min val 3)total that can be sent
+ * to the STA in a DL MU-MIMO transmission on full or partial bandwidth
+ */
+#define WMI_HECAP_PHY_NSTSLT80MHZ_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 5, 3)
+#define WMI_HECAP_PHY_NSTSLT80MHZ_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 5, 3, value)
+
+
+/*
+ * The maximum value for NSTS-1 > 80MHz (min val 3) total that can be sent
+ * to the STA in a DL MU-MIMO transmission on full or partial bandwidth
+ */
+#define WMI_HECAP_PHY_NSTSGT80MHZ_GET(he_cap_phy) WMI_GET_BITS(he_cap_phy[1], 8, 3)
+#define WMI_HECAP_PHY_NSTSGT80MHZ_SET(he_cap_phy, value) WMI_SET_BITS(he_cap_phy[1], 8, 3, value)
+
+#define WMI_GET_HW_RATECODE_PREAM_V1(_rcode)     (((_rcode) >> 8) & 0x7)
+#define WMI_GET_HW_RATECODE_NSS_V1(_rcode)       (((_rcode) >> 5) & 0x7)
+#define WMI_GET_HW_RATECODE_RATE_V1(_rcode)      (((_rcode) >> 0) & 0x1F)
+#define WMI_ASSEMBLE_RATECODE_V1(_rate, _nss, _pream) \
+	(((1) << 28) | ((_pream) << 8) | ((_nss) << 5) | (_rate))
 
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_start_request_cmd_fixed_param */
@@ -5664,7 +7486,8 @@ typedef struct {
     /** the DBS policy manager indicates the preferred number of receive streams. */
     A_UINT32 preferred_rx_streams;
     A_UINT32 he_ops; /* refer to WMI_HEOPS_xxx macros */
-
+    A_UINT32 cac_duration_ms;  /* in milliseconds */
+    A_UINT32 regdomain;
     /* The TLVs follows this structure:
          *     wmi_channel chan;   //WMI channel
          *     wmi_p2p_noa_descriptor  noa_descriptors[]; //actual p2p NOA descriptor from scan entry
@@ -5685,6 +7508,12 @@ typedef struct {
     A_UINT32 vdev_assoc_id;
     /** bssid of the BSS the VDEV is joining  */
     wmi_mac_addr vdev_bssid;
+    /** bssid of transmitted AP (mbssid case) */
+    wmi_mac_addr trans_bssid;
+    /** the profile index of the connected non-trans ap (mbssid case). 0 means invalid */
+    A_UINT32 profile_idx;
+    /** the total profile numbers of non-trans aps (mbssid case). 0 means legacy AP */
+    A_UINT32 profile_num;
 } wmi_vdev_up_cmd_fixed_param;
 
 typedef struct {
@@ -5724,17 +7553,18 @@ typedef struct {
     A_UINT32 key_seq_counter_h;
 } wmi_key_seq_counter;
 
-#define  WMI_CIPHER_NONE     0x0  /* clear key */
-#define  WMI_CIPHER_WEP      0x1
-#define  WMI_CIPHER_TKIP     0x2
-#define  WMI_CIPHER_AES_OCB  0x3
-#define  WMI_CIPHER_AES_CCM  0x4
-#define  WMI_CIPHER_WAPI     0x5
-#define  WMI_CIPHER_CKIP     0x6
-#define  WMI_CIPHER_AES_CMAC 0x7
-#define  WMI_CIPHER_ANY      0x8
-#define  WMI_CIPHER_AES_GCM  0x9
-#define  WMI_CIPHER_AES_GMAC 0xa
+#define  WMI_CIPHER_NONE         0x0  /* clear key */
+#define  WMI_CIPHER_WEP          0x1
+#define  WMI_CIPHER_TKIP         0x2
+#define  WMI_CIPHER_AES_OCB      0x3
+#define  WMI_CIPHER_AES_CCM      0x4
+#define  WMI_CIPHER_WAPI         0x5
+#define  WMI_CIPHER_CKIP         0x6
+#define  WMI_CIPHER_AES_CMAC     0x7
+#define  WMI_CIPHER_ANY          0x8
+#define  WMI_CIPHER_AES_GCM      0x9
+#define  WMI_CIPHER_AES_GMAC     0xa
+#define  WMI_CIPHER_WAPI_GCM_SM4 0xb
 
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_install_key_cmd_fixed_param */
@@ -5764,6 +7594,10 @@ typedef struct {
     A_UINT32 key_txmic_len;
     /** key rx mic length */
     A_UINT32 key_rxmic_len;
+    /** specifies if the group_key_ix is valid, filled by the sender */
+    A_UINT32 is_group_key_ix_valid;
+    /** Multi group key ID */
+    A_UINT32 group_key_ix;
         /*
          * Following this struct are this TLV.
          *     // actual key data
@@ -5777,94 +7611,124 @@ typedef enum {
     WMI_RATE_PREAMBLE_CCK,
     WMI_RATE_PREAMBLE_HT,
     WMI_RATE_PREAMBLE_VHT,
+    WMI_RATE_PREAMBLE_HE,
 } WMI_RATE_PREAMBLE;
 
 /** Value to disable fixed rate setting */
 #define WMI_FIXED_RATE_NONE    (0xff)
 
+#define WMI_GI_400_NS 1
+#define WMI_GI_800_NS 0
+#define WMI_GI_1600_NS 2
+#define WMI_GI_3200_NS 3
+
+/** OCE(Optimized Connectivity_Experience) Feature flags */
+#define WMI_VDEV_OCE_PROBE_REQUEST_RATE_FEATURE_BITMAP                 0x1
+#define WMI_VDEV_OCE_PROBE_RESPONSE_RATE_FEATURE_BITMAP                0x2
+#define WMI_VDEV_OCE_BEACON_RATE_FEATURE_BITMAP                        0x4
+#define WMI_VDEV_OCE_PROBE_REQUEST_DEFERRAL_FEATURE_BITMAP             0x8
+#define WMI_VDEV_OCE_FILS_DISCOVERY_FRAME_FEATURE_BITMAP               0x10
+#define WMI_VDEV_OCE_ESP_FEATURE_BITMAP                                0x20
+#define WMI_VDEV_OCE_REASSOC_REJECT_FEATURE_BITMAP                     0x40
+
 /** the definition of different VDEV parameters */
 typedef enum {
     /** RTS Threshold */
     WMI_VDEV_PARAM_RTS_THRESHOLD = 0x1,
     /** Fragmentation threshold */
-    WMI_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+    WMI_VDEV_PARAM_FRAGMENTATION_THRESHOLD,                   /* 0x2 */
     /** beacon interval in TUs */
-    WMI_VDEV_PARAM_BEACON_INTERVAL,
+    WMI_VDEV_PARAM_BEACON_INTERVAL,                           /* 0x3 */
     /** Listen interval in TUs */
-    WMI_VDEV_PARAM_LISTEN_INTERVAL,
+    WMI_VDEV_PARAM_LISTEN_INTERVAL,                           /* 0x4 */
     /** muticast rate in Mbps */
-    WMI_VDEV_PARAM_MULTICAST_RATE,
+    WMI_VDEV_PARAM_MULTICAST_RATE,                            /* 0x5 */
     /** management frame rate in Mbps */
-    WMI_VDEV_PARAM_MGMT_TX_RATE,
+    WMI_VDEV_PARAM_MGMT_TX_RATE,                              /* 0x6 */
     /** slot time (long vs short) */
-    WMI_VDEV_PARAM_SLOT_TIME,
+    WMI_VDEV_PARAM_SLOT_TIME,                                 /* 0x7 */
     /** preamble (long vs short) */
-    WMI_VDEV_PARAM_PREAMBLE,
+    WMI_VDEV_PARAM_PREAMBLE,                                  /* 0x8 */
     /** SWBA time (time before tbtt in msec) */
-    WMI_VDEV_PARAM_SWBA_TIME,
+    WMI_VDEV_PARAM_SWBA_TIME,                                 /* 0x9 */
     /** time period for updating VDEV stats */
-    WMI_VDEV_STATS_UPDATE_PERIOD,
+    WMI_VDEV_STATS_UPDATE_PERIOD,                             /* 0xa */
     /** age out time in msec for frames queued for station in power save*/
-    WMI_VDEV_PWRSAVE_AGEOUT_TIME,
+    WMI_VDEV_PWRSAVE_AGEOUT_TIME,                             /* 0xb */
     /** Host SWBA interval (time in msec before tbtt for SWBA event generation) */
-    WMI_VDEV_HOST_SWBA_INTERVAL,
+    WMI_VDEV_HOST_SWBA_INTERVAL,                              /* 0xc */
     /** DTIM period (specified in units of num beacon intervals) */
-    WMI_VDEV_PARAM_DTIM_PERIOD,
+    WMI_VDEV_PARAM_DTIM_PERIOD,                               /* 0xd */
     /** scheduler air time limit for this VDEV. used by off chan scheduler  */
-    WMI_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+    WMI_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,                     /* 0xe */
     /** enable/dsiable WDS for this VDEV  */
-    WMI_VDEV_PARAM_WDS,
+    WMI_VDEV_PARAM_WDS,                                       /* 0xf */
     /** ATIM Window */
-    WMI_VDEV_PARAM_ATIM_WINDOW,
+    WMI_VDEV_PARAM_ATIM_WINDOW,                               /* 0x10 */
     /** BMISS max */
-    WMI_VDEV_PARAM_BMISS_COUNT_MAX,
+    WMI_VDEV_PARAM_BMISS_COUNT_MAX,                           /* 0x11 */
     /** BMISS first time */
-    WMI_VDEV_PARAM_BMISS_FIRST_BCNT,
+    WMI_VDEV_PARAM_BMISS_FIRST_BCNT,                          /* 0x12 */
     /** BMISS final time */
-    WMI_VDEV_PARAM_BMISS_FINAL_BCNT,
+    WMI_VDEV_PARAM_BMISS_FINAL_BCNT,                          /* 0x13 */
     /** WMM enables/disabled */
-    WMI_VDEV_PARAM_FEATURE_WMM,
+    WMI_VDEV_PARAM_FEATURE_WMM,                               /* 0x14 */
     /** Channel width */
-    WMI_VDEV_PARAM_CHWIDTH,
+    WMI_VDEV_PARAM_CHWIDTH,                                   /* 0x15 */
     /** Channel Offset */
-    WMI_VDEV_PARAM_CHEXTOFFSET,
+    WMI_VDEV_PARAM_CHEXTOFFSET,                               /* 0x16 */
     /** Disable HT Protection */
-    WMI_VDEV_PARAM_DISABLE_HTPROTECTION,
+    WMI_VDEV_PARAM_DISABLE_HTPROTECTION,                      /* 0x17 */
     /** Quick STA Kickout */
-    WMI_VDEV_PARAM_STA_QUICKKICKOUT,
+    WMI_VDEV_PARAM_STA_QUICKKICKOUT,                          /* 0x18 */
     /** Rate to be used with Management frames */
-    WMI_VDEV_PARAM_MGMT_RATE,
+    WMI_VDEV_PARAM_MGMT_RATE,                                 /* 0x19 */
     /** Protection Mode */
-    WMI_VDEV_PARAM_PROTECTION_MODE,
-    /** Fixed rate setting */
-    WMI_VDEV_PARAM_FIXED_RATE,
-    /** Short GI Enable/Disable */
-    WMI_VDEV_PARAM_SGI,
+    WMI_VDEV_PARAM_PROTECTION_MODE,                           /* 0x1a */
+    /** Fixed rate setting
+     * The top nibble is used to select which format to use for encoding
+     * the rate specification: 0xVXXXXXXX
+     * If V == 0b0000: format is same as before: 0x000000RR
+     * If V == 0b0001: format is: 0x1000RRRR.
+     *                 This will be output of WMI_ASSEMBLE_RATECODE_V1
+     * The host shall use the new V1 format (and set V = 0x1) if the target
+     * indicates 802.11ax support via the WMI_SERVICE_11AX flag, or if the
+     * system is configured with Nss > 4 (either at compile time within the
+     * host driver, or through WMI_SERVICE_READY PHY capabilities provided
+     * by the target).
+     */
+    WMI_VDEV_PARAM_FIXED_RATE,                                /* 0x1b */
+    /**
+     * 11AX: GI =
+     *	   WMI_GI_400_NS, WMI_GI_800_NS, WMI_GI_1600_NS, or WMI_GI_3200_NS
+     * 11N: SGI=WMI_GI_400_NS
+     */
+    WMI_VDEV_PARAM_SGI,                                       /* 0x1c */
     /** Enable LDPC */
-    WMI_VDEV_PARAM_LDPC,
+    WMI_VDEV_PARAM_LDPC,                                      /* 0x1d */
     /** Enable Tx STBC */
-    WMI_VDEV_PARAM_TX_STBC,
+    WMI_VDEV_PARAM_TX_STBC,                                   /* 0x1e */
     /** Enable Rx STBC */
-    WMI_VDEV_PARAM_RX_STBC,
+    WMI_VDEV_PARAM_RX_STBC,                                   /* 0x1f */
     /** Intra BSS forwarding  */
-    WMI_VDEV_PARAM_INTRA_BSS_FWD,
+    WMI_VDEV_PARAM_INTRA_BSS_FWD,                             /* 0x20 */
     /** Setting Default xmit key for Vdev */
-    WMI_VDEV_PARAM_DEF_KEYID,
+    WMI_VDEV_PARAM_DEF_KEYID,                                 /* 0x21 */
     /** NSS width */
-    WMI_VDEV_PARAM_NSS,
+    WMI_VDEV_PARAM_NSS,                                       /* 0x22 */
     /** Set the custom rate for the broadcast data frames */
-    WMI_VDEV_PARAM_BCAST_DATA_RATE,
+    WMI_VDEV_PARAM_BCAST_DATA_RATE,                           /* 0x23 */
     /** Set the custom rate (rate-code) for multicast data frames */
-    WMI_VDEV_PARAM_MCAST_DATA_RATE,
+    WMI_VDEV_PARAM_MCAST_DATA_RATE,                           /* 0x24 */
     /** Tx multicast packet indicate Enable/Disable */
-    WMI_VDEV_PARAM_MCAST_INDICATE,
+    WMI_VDEV_PARAM_MCAST_INDICATE,                            /* 0x25 */
     /** Tx DHCP packet indicate Enable/Disable */
-    WMI_VDEV_PARAM_DHCP_INDICATE,
+    WMI_VDEV_PARAM_DHCP_INDICATE,                             /* 0x26 */
     /** Enable host inspection of Tx unicast packet to unknown destination */
-    WMI_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+    WMI_VDEV_PARAM_UNKNOWN_DEST_INDICATE,                     /* 0x27 */
 
     /* The minimum amount of time AP begins to consider STA inactive */
-    WMI_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+    WMI_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,  /* 0x28 */
 
     /* An associated STA is considered inactive when there is no recent TX/RX
      * activity and no downlink frames are buffered for it. Once a STA exceeds
@@ -5873,28 +7737,28 @@ typedef enum {
      * the data-null, or if the data-null is buffered and the STA does not
      * retrieve it, the STA will be considered unresponsive (see
      * WMI_VDEV_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS). */
-    WMI_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+    WMI_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,  /* 0x29 */
 
     /* An associated STA is considered unresponsive if there is no recent
      * TX/RX activity and downlink frames are buffered for it. Once a STA
      * exceeds the maximum unresponsive time, the AP will send a
      * WMI_STA_KICKOUT event to the host so the STA can be deleted. */
-    WMI_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+    WMI_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,   /* 0x2a */
 
     /* Enable NAWDS : MCAST INSPECT Enable, NAWDS Flag set */
-    WMI_VDEV_PARAM_AP_ENABLE_NAWDS,
+    WMI_VDEV_PARAM_AP_ENABLE_NAWDS,                           /* 0x2b */
     /** Enable/Disable RTS-CTS */
-    WMI_VDEV_PARAM_ENABLE_RTSCTS,
+    WMI_VDEV_PARAM_ENABLE_RTSCTS,                             /* 0x2c */
     /* Enable TXBFee/er */
-    WMI_VDEV_PARAM_TXBF,
+    WMI_VDEV_PARAM_TXBF,                                      /* 0x2d */
 
     /**Set packet power save */
-    WMI_VDEV_PARAM_PACKET_POWERSAVE,
+    WMI_VDEV_PARAM_PACKET_POWERSAVE,                          /* 0x2e */
 
     /**Drops un-encrypted packets if any received in an encryted connection
      * otherwise forwards to host
      */
-    WMI_VDEV_PARAM_DROP_UNENCRY,
+    WMI_VDEV_PARAM_DROP_UNENCRY,                              /* 0x2f */
 
     /*
      * Set TX encap type.
@@ -5902,7 +7766,7 @@ typedef enum {
      * enum wmi_pkt_type is to be used as the parameter
      * specifying the encap type.
      */
-    WMI_VDEV_PARAM_TX_ENCAP_TYPE,
+    WMI_VDEV_PARAM_TX_ENCAP_TYPE,                             /* 0x30 */
 
     /*
      * Try to detect stations that woke-up and exited power save but did not
@@ -5914,135 +7778,136 @@ typedef enum {
      *
      * 0 disables out-of-sync detection. Maximum time is 255 seconds.
      */
-    WMI_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
+    WMI_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,  /* 0x31 */
 
     /* Enable/Disable early rx dynamic adjust feature.
-      * Early-rx dynamic adjust is a advance power save feature.
-      * Early-rx is a wakeup duration before exact TBTT,which is deemed necessary to provide a cushion for various
-      * timing discrepancies in the system.
-      * In current code branch, the duration is set to a very conservative fix value to make sure the drift impact is minimum.
-      * The fix early-tx will result in the unnessary power consume, so a dynamic early-rx adjust algorithm can be designed
-      * properly to minimum the power consume.*/
-    WMI_VDEV_PARAM_EARLY_RX_ADJUST_ENABLE,
+     * Early-rx dynamic adjust is a advance power save feature.
+     * Early-rx is a wakeup duration before exact TBTT,which is deemed necessary to provide a cushion for various
+     * timing discrepancies in the system.
+     * In current code branch, the duration is set to a very conservative fix value to make sure the drift impact is minimum.
+     * The fix early-tx will result in the unnessary power consume, so a dynamic early-rx adjust algorithm can be designed
+     * properly to minimum the power consume.*/
+    WMI_VDEV_PARAM_EARLY_RX_ADJUST_ENABLE,                    /* 0x32 */
 
     /* set target bmiss number per sample cycle if bmiss adjust was chosen.
      * In this adjust policy,early-rx is adjusted by comparing the current bmiss rate to target bmiss rate
      * which can be set by user through WMI command.
      */
-    WMI_VDEV_PARAM_EARLY_RX_TGT_BMISS_NUM,
+    WMI_VDEV_PARAM_EARLY_RX_TGT_BMISS_NUM,                    /* 0x33 */
 
     /* set sample cycle(in the unit of beacon interval) if bmiss adjust was chosen */
-    WMI_VDEV_PARAM_EARLY_RX_BMISS_SAMPLE_CYCLE,
+    WMI_VDEV_PARAM_EARLY_RX_BMISS_SAMPLE_CYCLE,               /* 0x34 */
 
     /* set slop_step */
-    WMI_VDEV_PARAM_EARLY_RX_SLOP_STEP,
+    WMI_VDEV_PARAM_EARLY_RX_SLOP_STEP,                        /* 0x35 */
 
     /* set init slop */
-    WMI_VDEV_PARAM_EARLY_RX_INIT_SLOP,
+    WMI_VDEV_PARAM_EARLY_RX_INIT_SLOP,                        /* 0x36 */
 
     /* pause adjust enable/disable */
-    WMI_VDEV_PARAM_EARLY_RX_ADJUST_PAUSE,
+    WMI_VDEV_PARAM_EARLY_RX_ADJUST_PAUSE,                     /* 0x37 */
 
 
     /* Set channel pwr limit value of the vdev the minimal value of all
      * vdevs operating on this channel will be set as channel tx power
      * limit, which is used to configure ratearray
      */
-    WMI_VDEV_PARAM_TX_PWRLIMIT,
+    WMI_VDEV_PARAM_TX_PWRLIMIT,                               /* 0x38 */
 
     /* set the count of snr value for calculation in snr monitor */
-    WMI_VDEV_PARAM_SNR_NUM_FOR_CAL,
+    WMI_VDEV_PARAM_SNR_NUM_FOR_CAL,                           /* 0x39 */
 
     /** Roaming offload */
-    WMI_VDEV_PARAM_ROAM_FW_OFFLOAD,
+    WMI_VDEV_PARAM_ROAM_FW_OFFLOAD,                           /* 0x3a */
 
     /** Enable Leader request RX functionality for RMC */
-    WMI_VDEV_PARAM_ENABLE_RMC,
+    WMI_VDEV_PARAM_ENABLE_RMC,                                /* 0x3b */
 
-    /* IBSS does not have deauth/disassoc, vdev has to detect peer gone event
+   /* IBSS does not have deauth/disassoc, vdev has to detect peer gone event
      * by himself. If the beacon lost time exceed this threshold, the peer is
      * thought to be gone. */
-    WMI_VDEV_PARAM_IBSS_MAX_BCN_LOST_MS,
+    WMI_VDEV_PARAM_IBSS_MAX_BCN_LOST_MS,                      /* 0x3c */
 
     /** max rate in kpbs, transmit rate can't go beyond it */
-    WMI_VDEV_PARAM_MAX_RATE,
+    WMI_VDEV_PARAM_MAX_RATE,                                  /* 0x3d */
 
     /* enable/disable drift sample. 0: disable; 1: clk_drift; 2: ap_drift; 3 both clk and ap drift*/
-    WMI_VDEV_PARAM_EARLY_RX_DRIFT_SAMPLE,
+    WMI_VDEV_PARAM_EARLY_RX_DRIFT_SAMPLE,                     /* 0x3e */
+
     /* set Tx failure count threshold for the vdev */
-    WMI_VDEV_PARAM_SET_IBSS_TX_FAIL_CNT_THR,
+    WMI_VDEV_PARAM_SET_IBSS_TX_FAIL_CNT_THR,                  /* 0x3f */
 
     /* set ebt resync timeout value, in the unit of TU */
-    WMI_VDEV_PARAM_EBT_RESYNC_TIMEOUT,
+    WMI_VDEV_PARAM_EBT_RESYNC_TIMEOUT,                        /* 0x40 */
 
     /* Enable Aggregation State Trigger Event */
-    WMI_VDEV_PARAM_AGGR_TRIG_EVENT_ENABLE,
+    WMI_VDEV_PARAM_AGGR_TRIG_EVENT_ENABLE,                    /* 0x41 */
 
     /* This parameter indicates whether IBSS station can enter into power save
     * mode by sending Null frame (with PM=1). When not allowed, IBSS station has to stay
     * awake all the time and should never set PM=1 in its transmitted frames.
     * This parameter is meaningful/valid only when WMI_VDEV_PARAM_ATIM_WINDOW_LENGTH
     * is non-zero. */
-    WMI_VDEV_PARAM_IS_IBSS_POWER_SAVE_ALLOWED,
+    WMI_VDEV_PARAM_IS_IBSS_POWER_SAVE_ALLOWED,                /* 0x42 */
 
     /* This parameter indicates if this station can enter into power collapse
     * for the remaining beacon interval after the ATIM window.
     * This parameter is meaningful/valid only when WMI_VDEV_PARAM_IS_IBSS_POWER_SAVE_ALLOWED
     * is set to TRUE. */
-    WMI_VDEV_PARAM_IS_POWER_COLLAPSE_ALLOWED,
+    WMI_VDEV_PARAM_IS_POWER_COLLAPSE_ALLOWED,                 /* 0x43 */
 
     /* This parameter indicates whether IBSS station exit power save mode and
     * enter power active state (by sending Null frame with PM=0 in the immediate ATIM Window)
     * whenever there is a TX/RX activity. */
-    WMI_VDEV_PARAM_IS_AWAKE_ON_TXRX_ENABLED,
+    WMI_VDEV_PARAM_IS_AWAKE_ON_TXRX_ENABLED,                  /* 0x44 */
 
     /* If Awake on TX/RX activity is enabled, this parameter indicates
     * the data inactivity time in number of beacon intervals after which
     * IBSS station reenters power save by sending Null frame with PM=1. */
-    WMI_VDEV_PARAM_INACTIVITY_CNT,
+    WMI_VDEV_PARAM_INACTIVITY_CNT,                            /* 0x45 */
 
     /* Inactivity time in msec after which TX Service Period (SP) is
     * terminated by sending a Qos Null frame with EOSP.
     * If value is 0, TX SP is terminated with the last buffered packet itself
     * instead of waiting for the inactivity timeout. */
-    WMI_VDEV_PARAM_TXSP_END_INACTIVITY_TIME_MS,
+    WMI_VDEV_PARAM_TXSP_END_INACTIVITY_TIME_MS,               /* 0x46 */
 
     /** DTIM policy */
-    WMI_VDEV_PARAM_DTIM_POLICY,
+    WMI_VDEV_PARAM_DTIM_POLICY,                               /* 0x47 */
 
     /* When IBSS network is initialized, PS-supporting device
     * does not enter protocol sleep state during first
     * WMI_VDEV_PARAM_IBSS_PS_WARMUP_TIME_SECS seconds. */
-    WMI_VDEV_PARAM_IBSS_PS_WARMUP_TIME_SECS,
+    WMI_VDEV_PARAM_IBSS_PS_WARMUP_TIME_SECS,                  /* 0x48 */
 
     /* Enable/Disable 1 RX chain usage during the ATIM window */
-    WMI_VDEV_PARAM_IBSS_PS_1RX_CHAIN_IN_ATIM_WINDOW_ENABLE,
+    WMI_VDEV_PARAM_IBSS_PS_1RX_CHAIN_IN_ATIM_WINDOW_ENABLE,   /* 0x49 */
 
     /* RX Leak window is the time driver waits before shutting down
      * the radio or switching the channel and after receiving an ACK
      * for a data frame with PM bit set) */
-    WMI_VDEV_PARAM_RX_LEAK_WINDOW,
+    WMI_VDEV_PARAM_RX_LEAK_WINDOW,                            /* 0x4a */
 
     /** Averaging factor(16 bit value) is used in the calculations to
      * perform averaging of different link level statistics like average
      * beacon spread or average number of frames leaked */
-    WMI_VDEV_PARAM_STATS_AVG_FACTOR,
+    WMI_VDEV_PARAM_STATS_AVG_FACTOR,                          /* 0x4b */
 
     /** disconnect threshold, once the consecutive error for specific peer
-      * exceed this threhold, FW will send kickout event to host */
-    WMI_VDEV_PARAM_DISCONNECT_TH,
+     * exceed this threhold, FW will send kickout event to host */
+    WMI_VDEV_PARAM_DISCONNECT_TH,                             /* 0x4c */
 
     /** The rate_code of RTS_CTS changed by host. Now FW can support
      * more non-HT rates rather than 1Mbps or 6Mbps */
-    WMI_VDEV_PARAM_RTSCTS_RATE,
+    WMI_VDEV_PARAM_RTSCTS_RATE,                               /* 0x4d */
 
     /** This parameter indicates whether using a long duration RTS-CTS
      * protection when a SAP goes off channel in MCC mode */
-    WMI_VDEV_PARAM_MCC_RTSCTS_PROTECTION_ENABLE,
+    WMI_VDEV_PARAM_MCC_RTSCTS_PROTECTION_ENABLE,              /* 0x4e */
 
     /** This parameter indicates whether using a broadcast probe response
      * to increase the detectability of SAP in MCC mode */
-    WMI_VDEV_PARAM_MCC_BROADCAST_PROBE_ENABLE,
+    WMI_VDEV_PARAM_MCC_BROADCAST_PROBE_ENABLE,                /* 0x4f */
 
     /** This parameter indicates the power backoff in percentage
      * currently supports 100%, 50%, 25%, 12.5%, and minimum
@@ -6050,69 +7915,69 @@ typedef enum {
      * 0 --> 100% --> no changes, 1 --> 50% --> -3dB,
      * 2 --> 25% --> -6dB, 3 --> 12.5% --> -9dB, 4 --> minimum --> -32dB
      */
-    WMI_VDEV_PARAM_TXPOWER_SCALE,
+    WMI_VDEV_PARAM_TXPOWER_SCALE,                             /* 0x50 */
 
     /** TX power backoff in dB: tx power -= param value
      * Host passes values(DB) to Halphy, Halphy reduces the power table
      * by the values.  Safety check will happen in Halphy.
      */
-    WMI_VDEV_PARAM_TXPOWER_SCALE_DECR_DB,
+    WMI_VDEV_PARAM_TXPOWER_SCALE_DECR_DB,                     /* 0x51 */
 
     /** Multicast to Unicast conversion setting */
-    WMI_VDEV_PARAM_MCAST2UCAST_SET,
+    WMI_VDEV_PARAM_MCAST2UCAST_SET,                           /* 0x52 */
 
     /** Total number of HW retries */
-    WMI_VDEV_PARAM_RC_NUM_RETRIES,
+    WMI_VDEV_PARAM_RC_NUM_RETRIES,                            /* 0x53 */
 
     /** Max tx percentage for cabq */
-    WMI_VDEV_PARAM_CABQ_MAXDUR,
+    WMI_VDEV_PARAM_CABQ_MAXDUR,                               /* 0x54 */
 
     /** MFPTEST settings */
-    WMI_VDEV_PARAM_MFPTEST_SET,
+    WMI_VDEV_PARAM_MFPTEST_SET,                               /* 0x55 */
 
     /** RTS Fixed rate setting */
-    WMI_VDEV_PARAM_RTS_FIXED_RATE,
+    WMI_VDEV_PARAM_RTS_FIXED_RATE,                            /* 0x56 */
 
     /** VHT SGI MASK */
-    WMI_VDEV_PARAM_VHT_SGIMASK,
+    WMI_VDEV_PARAM_VHT_SGIMASK,                               /* 0x57 */
 
     /** VHT80 Auto Rate MASK */
-    WMI_VDEV_PARAM_VHT80_RATEMASK,
+    WMI_VDEV_PARAM_VHT80_RATEMASK,                            /* 0x58 */
 
     /** set Proxy STA features for this vap */
-    WMI_VDEV_PARAM_PROXY_STA,
+    WMI_VDEV_PARAM_PROXY_STA,                                 /* 0x59 */
 
     /** set virtual cell mode - enable/disable */
-    WMI_VDEV_PARAM_VIRTUAL_CELL_MODE,
+    WMI_VDEV_PARAM_VIRTUAL_CELL_MODE,                         /* 0x5a */
 
     /** Set receive packet type */
-    WMI_VDEV_PARAM_RX_DECAP_TYPE,
+    WMI_VDEV_PARAM_RX_DECAP_TYPE,                             /* 0x5b */
 
     /** Set ratemask with specific Bandwidth and NSS */
-    WMI_VDEV_PARAM_BW_NSS_RATEMASK,
+    WMI_VDEV_PARAM_BW_NSS_RATEMASK,                           /* 0x5c */
 
     /** Set SENSOR Support */
-    WMI_VDEV_PARAM_SENSOR_AP,
+    WMI_VDEV_PARAM_SENSOR_AP,                                 /* 0x5d */
 
     /** Set beacon rate */
-    WMI_VDEV_PARAM_BEACON_RATE,
+    WMI_VDEV_PARAM_BEACON_RATE,                               /* 0x5e */
 
     /** Enable CTS to self for DTIM beacon */
-    WMI_VDEV_PARAM_DTIM_ENABLE_CTS,
+    WMI_VDEV_PARAM_DTIM_ENABLE_CTS,                           /* 0x5f */
 
     /** Disable station kickout at Vap level */
-    WMI_VDEV_PARAM_STA_KICKOUT,
+    WMI_VDEV_PARAM_STA_KICKOUT,                               /* 0x60 */
 
     /* VDEV capabilities */
-    WMI_VDEV_PARAM_CAPABILITIES, /* see capabilities defs below */
-    /*
+    WMI_VDEV_PARAM_CAPABILITIES, /* see capabilities defs below */ /* 0x61 */
+
+    /**
      * Increment TSF in micro seconds to avoid beacon collision on mesh VAP.
      * The host must ensure that either no other vdevs share the TSF with
      * this vdev, or else that it is acceptable to apply this TSF adjustment
      * to all vdevs sharing the TSF.
      */
-    WMI_VDEV_PARAM_TSF_INCREMENT,
-
+    WMI_VDEV_PARAM_TSF_INCREMENT,                             /* 0x62 */
     /*
      * Disable/Enable AMPDU of vdev per AC:
      * bit | AC
@@ -6124,77 +7989,186 @@ typedef enum {
      * A value of 0 in a given bit disables A-MPDU aggregation for
      * that AC; a value of 1 enables A-MPDU aggregation
      */
-    WMI_VDEV_PARAM_AMPDU_PER_AC,
+    WMI_VDEV_PARAM_AMPDU_PER_AC,                              /* 0x63 */
 
-    /*
+    /**
      * Vdev level rx filter of from-ds / to-ds / no-ds / ta / ra frames.
      * Used mainly for mesh-vap.
      * The parameter value delivered with the RX_FILTER vdev param contains
      * a bit-or mask of wmi_vdev_param_filter enum values.
      */
-    WMI_VDEV_PARAM_RX_FILTER,
+    WMI_VDEV_PARAM_RX_FILTER,                                 /* 0x64 */
 
-    /* vdev-specific mgmt tx power in dBm units (signed integer value) */
-    WMI_VDEV_PARAM_MGMT_TX_POWER,
+    /** vdev-specific mgmt tx power in dBm units (signed integer value) */
+    WMI_VDEV_PARAM_MGMT_TX_POWER,                             /* 0x65 */
 
-    /*
-     * Vdev level non aggregration/11g sw retry threshold.
-     *   0-disable, min:0, max:31, default:15
+    /** Vdev level non aggregration/11g sw retry threshold. 0-disable, min:0, max:31, default:15 */
+    WMI_VDEV_PARAM_NON_AGG_SW_RETRY_TH,                       /* 0x66 */
+    /** Vdev level aggregration sw retry threshold. 0-disable, min:0, max:31, default:15 */
+    WMI_VDEV_PARAM_AGG_SW_RETRY_TH,                           /* 0x67 */
+
+    /** disable dynamic bw RTS **/
+    WMI_VDEV_PARAM_DISABLE_DYN_BW_RTS,                        /* 0x68 */
+
+    /** per ssid (vdev) based ATF strict/fair scheduling policy
+     *  param values are WMI_ATF_SSID_FAIR_SCHED or WMI_ATF_SSID_STRICT_SCHED
      */
-    WMI_VDEV_PARAM_NON_AGG_SW_RETRY_TH,
-    /*
-     * Vdev level aggregration sw retry threshold.
-     *   0-disable, min:0, max:31, default:15
+    WMI_VDEV_PARAM_ATF_SSID_SCHED_POLICY,                     /* 0x69 */
+
+    /** Enable or disable Dual carrier modulation
+     * valid values: 0-Disable DCM, 1-Enable DCM.
      */
-    WMI_VDEV_PARAM_AGG_SW_RETRY_TH,
+    WMI_VDEV_PARAM_HE_DCM,                                    /* 0x6a */
 
-    /** disable dynamic bw RTS **/
-    WMI_VDEV_PARAM_DISABLE_DYN_BW_RTS,
+    /** Enable or disable Extended range
+     * valid values: 0-Disable ER, 1-Enable ER.
+     */
+    WMI_VDEV_PARAM_HE_RANGE_EXT,                              /* 0x6b */
+
+    /* enable or disable BCAST probe response feature */
+    WMI_VDEV_PARAM_ENABLE_BCAST_PROBE_RESPONSE,               /* 0x6c */
+
+    /* param to specify probe request Tx delay during Fast Initial Link Setup */
+    WMI_VDEV_PARAM_FILS_MAX_CHANNEL_GUARD_TIME, /* units = milliseconds */ /* 0x6d */
+
+    /* enable or disable NOA for P2P GO */
+    WMI_VDEV_PARAM_DISABLE_NOA_P2P_GO,                        /* 0x6e */
+
+    /** Per band user management frame fix rate setting
+     *  BIT 31: enable (1) or disable (0) mgmt fix rate for 5G
+     *  BIT 30: enable (1) or disable (0) mgmt fix rate for 2G
+     *
+     *  BIT 23: 11ax (1) or legacy (0) rate code
+     *  BITS [22..12]: rate code for 5G
+     *
+     *  BIT 11: 11ax (1) or legacy (0) rate code
+     *  BITS [10..0]: rate code for 2G
+     */
+    WMI_VDEV_PARAM_PER_BAND_MGMT_TX_RATE,                     /* 0x6f */
+    /* This should be called before WMI_VDEV_PARAM_TXBF */
+    WMI_VDEV_PARAM_11AX_TXBF,                                 /* 0x70 */
+
+    /** This parameter indicates whether VDEV is SMPS intolerant.
+     * I.e. - SMPS action frame cannot be transmitted by the VDEV to
+     * dynamically change the RX NSS.
+     *
+     * valid values: 1 - VDEV is SMPS intolerant, 0 - VDEV is SMPS tolerant
+     */
+    WMI_VDEV_PARAM_SMPS_INTOLERANT,                           /* 0x71 */
+
+    /** specify probe request Tx delay for scans triggered on this VDEV */
+    WMI_VDEV_PARAM_PROBE_DELAY, /* units = milliseconds */    /* 0x72 */
+
+    /** specify the time gap between each set of probe request transmissions.
+     * The number of probe requests in each set depends on the ssid_list and
+     * bssid_list in the scan request.
+     * This parameter will be applied only for scans triggered on this VDEV.
+     */
+    WMI_VDEV_PARAM_REPEAT_PROBE_TIME, /* units = milliseconds */ /* 0x73 */
+
+    /** specify the HE LTF setting that should be used for fixed rate
+     * transmissions.
+     *
+     * Expects values of WMI_HE_LTF_DEFAULT, WMI_HE_LTF_1X, WMI_HE_LTF_2X,
+     * or WMI_HE_LTF_4X.
+     */
+    WMI_VDEV_PARAM_HE_LTF,                                    /* 0x74 */
+
+    /** VDEV parameter to configure the number of TX chains to use for
+     *  a/b/g rates.
+     *  bit 0~15  : 11b mode TX chain number.
+     *  bit 16~31 : 11ag mode TX chain number.
+     *
+     *  valid values:
+     *      Should not exceed the maximum number of supported TX Chains
+     *      0 - Used to reset the vote. Acts as Don't Care
+     */
+    WMI_VDEV_PARAM_ABG_MODE_TX_CHAIN_NUM,                     /* 0x75 */
 
     /**
-     * Per ssid (vdev) based ATF strict/fair scheduling policy
-     * Param values are WMI_ATF_SSID_FAIR_SCHED or
-     * WMI_ATF_SSID_STRICT_SCHED
+     * Enable or disable the multi group key feature on this VDEV.
+     * used for NAN APP and VLAN Tagging
+     */
+    WMI_VDEV_PARAM_ENABLE_MULTI_GROUP_KEY,                    /* 0x76 */
+
+    /*
+     * Specify the total number of multi group key on this VDEV.
      */
-    WMI_VDEV_PARAM_ATF_SSID_SCHED_POLICY,
+    WMI_VDEV_PARAM_NUM_GROUP_KEYS,                            /* 0x77 */
+
+    /** VDEV parameter to enable or disable various OCE features */
+    WMI_VDEV_PARAM_ENABLE_DISABLE_OCE_FEATURES,              /* 0x78 */
 
     /*
-     * === ADD NEW VDEV PARAM TYPES ABOVE THIS LINE ===
+     * Set/Clear 3 least-significant bits to
+     * Disable or Enable rate drop down for MGMT, SU data and MU data pkts
+     *
+     * bit 0 -> If set MGMT Pkt rate drop down is enabled else disabled
+     * bit 1 -> If set SU data Pkt rate drop down is enabled else disabled
+     * bit 2 -> If set MU data Pkt rate drop down is enabled else disabled
+     * bits 31:3 -> Reserved bits. should be set to zero.
+     */
+    WMI_VDEV_PARAM_RATE_DROPDOWN_BMAP,                       /* 0x79 */
+
+    /*=== ADD NEW VDEV PARAM TYPES ABOVE THIS LINE ===
      * The below vdev param types are used for prototyping, and are
      * prone to change.
      */
     WMI_VDEV_PARAM_PROTOTYPE = 0x8000,
-    /* 11AX SPECIFIC defines */
-    WMI_VDEV_PARAM_BSS_COLOR,
-    /*
-     * Enable / disable trigger access for a AP vdev's peers.
-     * For a STA mode vdev this will enable/disable triggered access
-     * and enable/disable Multi User mode of operation.
-     * 0 - Disable MU OFDMA and MU MIMO
-     * 1 - Disable DL OFDMA
-     * 2 - Disable DL MUMIMO
-     * 3 - Disable UL OFDMA
-     * 4 - Disable UL MUMIMO
-     * 5 - Enable MU OFDMA and MU MIMO
-     * 6 - Enable DL OFDMA
-     * 7 - Enable DL MUMIMO
-     * 8 - Enable UL OFDMA
-     * 9 - Enable UL MUMIMO
-     */
-    WMI_VDEV_PARAM_SET_HEMU_MODE,
-    /*
-     * For Tx OFDMA this will set values of CP length or guard interval
-     * to be
-     *     0: Auto
-     *     1: 0.8 us
-     *     2: 1.6 us
-     *     3: 3.2 us
-     * Similar to Guard Interval
-     */
-    WMI_VDEV_PARAM_TX_OFDMA_CPLEN,
+        /* 11AX SPECIFIC defines */
+        /* USE this for BSS color change */
+        WMI_VDEV_PARAM_BSS_COLOR,                             /* 0x8001 */
+
+        /*
+         * Enable / disable trigger access for a AP vdev's peers.
+         * For a STA mode vdev this will enable/disable triggered access
+         * and enable/disable Multi User mode of operation.
+         * A value of 0 in a given bit disables corresponding mode.
+         * bit | hemu mode
+         * ---------------
+         *  0  | HE SUBFEE
+         *  1  | HE SUBFER
+         *  2  | HE MUBFEE
+         *  3  | HE MUBFER
+         *  4  | DL OFDMA, for AP its DL Tx OFDMA for Sta its Rx OFDMA
+         *  5  | UL OFDMA, for AP its Tx OFDMA trigger for Sta its Rx OFDMA
+         *     |           trigger receive & UL response
+         *  6  | UL MUMIMO
+         */
+        WMI_VDEV_PARAM_SET_HEMU_MODE,                         /* 0x8002 */
+        WMI_VDEV_PARAM_HEOPS_0_31,                            /* 0x8003 */
+        WMI_VDEV_PARAM_OBSSPD,                                /* 0x8004 */
     /*=== END VDEV_PARAM_PROTOTYPE SECTION ===*/
 } WMI_VDEV_PARAM;
 
+#define WMI_VDEV_HE_SUBFEE_IS_ENABLED(hemu_mode) WMI_GET_BITS(hemu_mode, 0, 1)
+#define WMI_VDEV_HE_SUBFEE_ENABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 0, 1, 1)
+#define WMI_VDEV_HE_SUBFEE_DISABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 0, 1, 0)
+
+#define WMI_VDEV_HE_SUBFER_IS_ENABLED(hemu_mode) WMI_GET_BITS(hemu_mode, 1, 1)
+#define WMI_VDEV_HE_SUBFER_ENABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 1, 1, 1)
+#define WMI_VDEV_HE_SUBFER_DISABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 1, 1, 0)
+
+#define WMI_VDEV_HE_MUBFEE_IS_ENABLED(hemu_mode) WMI_GET_BITS(hemu_mode, 2, 1)
+#define WMI_VDEV_HE_MUBFEE_ENABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 2, 1, 1)
+#define WMI_VDEV_HE_MUBFEE_DISABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 2, 1, 0)
+
+#define WMI_VDEV_HE_MUBFER_IS_ENABLED(hemu_mode) WMI_GET_BITS(hemu_mode, 3, 1)
+#define WMI_VDEV_HE_MUBFER_ENABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 3, 1, 1)
+#define WMI_VDEV_HE_MUBFER_DISABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 3, 1, 0)
+
+#define WMI_VDEV_HE_DLOFDMA_IS_ENABLED(hemu_mode) WMI_GET_BITS(hemu_mode, 4, 1)
+#define WMI_VDEV_HE_DLOFDMA_ENABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 4, 1, 1)
+#define WMI_VDEV_HE_DLOFDMA_DISABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 4, 1, 0)
+
+#define WMI_VDEV_HE_ULOFDMA_IS_ENABLED(hemu_mode) WMI_GET_BITS(hemu_mode, 5, 1)
+#define WMI_VDEV_HE_ULOFDMA_ENABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 5, 1, 1)
+#define WMI_VDEV_HE_ULOFDMA_DISABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 5, 1, 0)
+
+#define WMI_VDEV_HE_ULMUMIMO_IS_ENABLED(hemu_mode) WMI_GET_BITS(hemu_mode, 6, 1)
+#define WMI_VDEV_HE_ULMUMIMO_ENABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 6, 1, 1)
+#define WMI_VDEV_HE_ULMUMIMO_DISABLE(hemu_mode) WMI_SET_BITS(hemu_mode, 6, 1, 0)
+
 /* vdev capabilities bit mask */
 #define WMI_VDEV_BEACON_SUPPORT  0x1
 #define WMI_VDEV_WDS_LRN_ENABLED 0x2
@@ -6204,6 +8178,25 @@ typedef enum {
 #define WMI_VDEV_IS_WDS_LRN_ENABLED(param) ((param) & WMI_VDEV_WDS_LRN_ENABLED)
 #define WMI_VDEV_IS_VOW_ENABLED(param) ((param) & WMI_VDEV_VOW_ENABLED)
 
+/* Per VAP rate dropdown masks */
+#define WMI_VDEV_MGMT_RATE_DROPDOWN_M        0x01
+#define WMI_VDEV_MGMT_RATE_DROPDOWN_S           0
+#define WMI_VDEV_MGMT_RATE_DROPDOWN (WMI_VDEV_MGMT_RATE_DROPDOWN_M << WMI_VDEV_MGMT_RATE_DROPDOWN_S)
+#define WMI_VDEV_MGMT_RATE_DROPDOWN_GET(x) WMI_F_MS(x, WMI_VDEV_MGMT_RATE_DROPDOWN)
+#define WMI_VDEV_MGMT_RATE_DROPDOWN_SET(x,z) WMI_F_RMW(x, z, WMI_VDEV_MGMT_RATE_DROPDOWN)
+
+#define WMI_VDEV_SU_DATA_RATE_DROPDOWN_M     0x01
+#define WMI_VDEV_SU_DATA_RATE_DROPDOWN_S        1
+#define WMI_VDEV_SU_DATA_RATE_DROPDOWN (WMI_VDEV_SU_DATA_RATE_DROPDOWN_M << WMI_VDEV_SU_DATA_RATE_DROPDOWN_S)
+#define WMI_VDEV_SU_DATA_RATE_DROPDOWN_GET(x) WMI_F_MS(x, WMI_VDEV_SU_DATA_RATE_DROPDOWN)
+#define WMI_VDEV_SU_DATA_RATE_DROPDOWN_SET(x,z) WMI_F_RMW(x, z, WMI_VDEV_SU_DATA_RATE_DROPDOWN)
+
+#define WMI_VDEV_MU_DATA_RATE_DROPDOWN_M     0x01
+#define WMI_VDEV_MU_DATA_RATE_DROPDOWN_S        2
+#define WMI_VDEV_MU_DATA_RATE_DROPDOWN (WMI_VDEV_MU_DATA_RATE_DROPDOWN_M << WMI_VDEV_MU_DATA_RATE_DROPDOWN_S)
+#define WMI_VDEV_MU_DATA_RATE_DROPDOWN_GET(x) WMI_F_MS(x, WMI_VDEV_MU_DATA_RATE_DROPDOWN)
+#define WMI_VDEV_MU_DATA_RATE_DROPDOWN_SET(x,z) WMI_F_RMW(x, z, WMI_VDEV_MU_DATA_RATE_DROPDOWN)
+
 /* TXBF capabilities masks */
 #define WMI_TXBF_CONF_SU_TX_BFEE_S 0
 #define WMI_TXBF_CONF_SU_TX_BFEE_M 0x1
@@ -6247,6 +8240,50 @@ typedef enum {
 #define WMI_TXBF_CONF_BF_SND_DIM_GET(x) WMI_F_MS(x,WMI_TXBF_CONF_BF_SND_DIM)
 #define WMI_TXBF_CONF_BF_SND_DIM_SET(x,z) WMI_F_RMW(x,z,WMI_TXBF_CONF_BF_SND_DIM)
 
+/* commands for 11ax TXBF capabilities */
+
+#define WMI_TXBF_CONF_11AX_SU_TX_BFER_GET(x) WMI_GET_BITS((x,0,1)
+#define WMI_TXBF_CONF_11AX_SU_TX_BFER_SET(x,z)  WMI_SET_BITS(x,0,1,z)
+
+#define WMI_TXBF_CONF_11AX_SU_TX_BFEE_GET(x) WMI_GET_BITS((x,1,1)
+#define WMI_TXBF_CONF_11AX_SU_TX_BFEE_SET(x,z) WMI_SET_BITS(x,1,1,z)
+
+#define WMI_TXBF_CONF_11AX_MU_TX_BFER_GET(x) WMI_GET_BITS((x,2,1)
+#define WMI_TXBF_CONF_11AX_MU_TX_BFER_SET(x,z)  WMI_SET_BITS(x,2,1,z)
+
+#define WMI_TXBF_CONF_11AX_BFEE_NDP_STS_LT_EQ_80_GET(x) WMI_GET_BITS((x,3,3)
+#define WMI_TXBF_CONF_11AX_BFEE_NDP_STS_LT_EQ_80_SET(x,z) WMI_SET_BITS(x,3,3,z)
+
+#define WMI_TXBF_CONF_11AX_NSTS_LT_EQ_80_GET(x) WMI_GET_BITS((x,6,3)
+#define WMI_TXBF_CONF_11AX_NSTS_LT_EQ_80_SET(x,z) WMI_SET_BITS(x,6,3,z)
+
+#define WMI_TXBF_CONF_11AX_TX_BFEE_NDP_STS_GT_80_GET(x) WMI_GET_BITS((x,9,3)
+#define WMI_TXBF_CONF_11AX_TX_BFEE_NDP_STS_GT_80_SET(x,z) WMI_SET_BITS(x,9,3,z)
+
+#define WMI_TXBF_CONF_11AX_NSTS_GT_80_GET(x) WMI_GET_BITS((x,12,3)
+#define WMI_TXBF_CONF_11AX_NSTS_GT_80_SET(x,z) WMI_SET_BITS(x,12,3,z)
+
+#define WMI_TXBF_CONF_AX_BFER_SND_DIM_LT_EQ_80_SND_DIM_GET(x) WMI_GET_BITS((x,15,3)
+#define WMI_TXBF_CONF_AX_BFER_SND_DIM_LT_EQ_80_SND_DIM_SET(x,z) WMI_SET_BITS(x,15,3,z)
+
+#define WMI_TXBF_CONF_AX_BFER_SND_DIM_GT_80_SND_DIM_GET(x) WMI_GET_BITS((x,18,3)
+#define WMI_TXBF_CONF_AX_BFER_SND_DIM_GT_80_SND_DIM_SET(x,z) WMI_SET_BITS(x,18,3,z)
+
+#define WMI_TXBF_CONF_AX_SU_BFEE_NG16_FDBK_GET(x) WMI_GET_BITS((x,21,1)
+#define WMI_TXBF_CONF_AX_SU_BFEE_NG16_FDBK_SET(x,z) WMI_SET_BITS(x,21,1,z)
+
+#define WMI_TXBF_CONF_AX_MU_BFEE_NG16_FDBK_GET(x) WMI_GET_BITS((x,22,1)
+#define WMI_TXBF_CONF_AX_MU_BFEE_NG16_FDBK_SET(x,z) WMI_SET_BITS(x,22,1,z)
+
+#define WMI_TXBF_CONF_AX_SU_BFEE_CDBK_4_2_GET(x) WMI_GET_BITS((x,23,1)
+#define WMI_TXBF_CONF_AX_SU_BFEE_CDBK_4_2_SET(x,z) WMI_SET_BITS(x,23,1,z)
+
+#define WMI_TXBF_CONF_AX_MU_BFEE_CDBK_7_5_GET(x) WMI_GET_BITS((x,24,1)
+#define WMI_TXBF_CONF_AX_MU_BFEE_CDBK_7_5_SET(x,z) WMI_SET_BITS(x,24,1,z)
+
+#define WMI_TXBF_CONF_AX_FDBK_TRIG_GET(x) WMI_GET_BITS((x,25,1)
+#define WMI_TXBF_CONF_AX_FDBK_TRIG_SET(x,z) WMI_SET_BITS(x,25,1,z)
+
 /* TXBF capabilities */
 typedef struct {
     A_UINT32 txbf_cap;
@@ -6426,6 +8463,22 @@ typedef struct {
      A_UINT32 tim_ie_offset;
      /** beacon buffer length. data is in TLV data[] */
      A_UINT32 buf_len;
+    /** CSA IE switch count offset from the beginning of data[]
+     *  Value 0 indicates CSA IE is not present in beacon template.
+     */
+    A_UINT32 csa_switch_count_offset; /* units = bytes */
+    /** Extended CSA IE switch count offset from the beginning of data[]
+     *  Value 0 indicates CSA IE is not present in beacon template.
+     */
+    A_UINT32 ext_csa_switch_count_offset; /* units = bytes */
+
+    /** Specify when to send the CSA switch count status from FW to host.
+     * See WMI_CSA_EVENT_BMAP* below for more information.
+     * E.g. if CSA switch count event is needed to be sent when the switch count
+     * is 0, 1, 4 and 5, set the bitmap to (0X80000033)
+     */
+    A_UINT32 csa_event_bitmap;
+
      /*
                  * The TLVs follows:
                  *    wmi_bcn_prb_info bcn_prb_info; //beacon probe capabilities and IEs
@@ -6433,6 +8486,10 @@ typedef struct {
                  */
 } wmi_bcn_tmpl_cmd_fixed_param;
 
+#define WMI_CSA_EVENT_BMAP_VALID_MASK           0X80000000  /* Follow bitmap for sending the CSA switch count event */
+#define WMI_CSA_EVENT_BMAP_SWITCH_COUNT_ZERO    0           /* Send only when the switch count becomes zero, added for backward compatibility
+                                                            Same can also be achieved by setting bitmap to 0X80000001 */
+#define WMI_CSA_EVENT_BMAP_ALL                  0XFFFFFFFF  /* Send CSA switch count event for every update to switch count */
 
  typedef struct {
      A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_prb_tmpl_cmd_fixed_param */
@@ -6635,6 +8692,12 @@ enum wmi_sta_powersave_param {
      * no-data bit set
      */
     WMI_STA_PS_PARAM_QPOWER_SPEC_MAX_SPEC_NODATA_PSPOLL = 9,
+
+    /**
+     * Max value of ITO reset when there is no tx-rx
+     * after AP has set the TIM bit
+     */
+    WMI_STA_PS_PARAM_MAX_RESET_ITO_COUNT_ON_TIM_NO_TXRX = 10,
 };
 
 typedef struct {
@@ -7001,6 +9064,15 @@ typedef struct {
 
         #define WMI_MAX_AP_VDEV 16
 
+	typedef struct {
+            A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_host_swfda_event_fixed_param  */
+            /** vdev_id identifying the VDEV for which FILS should be generated */
+            A_UINT32 vdev_id;
+            /** time (in TU) at which current FILS Discovery frame is scheduled for Tx */
+            A_UINT32 fils_tt;
+            /** next TBTT time (in TU) for this vdev  */
+            A_UINT32 tbtt;
+	} wmi_host_swfda_event_fixed_param;
 
         typedef struct {
             A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_tbtt_offset_event_fixed_param  */
@@ -7353,7 +9425,18 @@ typedef struct {
 #define WMI_PEER_PHYMODE                                0xD
 /** Use FIXED Pwr */
 #define WMI_PEER_USE_FIXED_PWR                          0xE
-/** Set peer fixed rate */
+/** Set peer fixed rate
+ * The top nibble is used to select which format to use for encoding
+ * the rate specification: 0xVXXXXXXX
+ * If V == 0b0000: format is same as before: 0x000000RR
+ * If V == 0b0001: format is: 0x1000RRRR.
+ *                 This will be output of WMI_ASSEMBLE_RATECODE_V1
+ * The host shall use the new V1 format (and set V = 0x1) if the target
+ * indicates 802.11ax support via the WMI_SERVICE_11AX flag, or if the
+ * system is configured with Nss > 4 (either at compile time within the
+ * host driver, or through WMI_SERVICE_READY PHY capabilities provided
+ * by the target).
+ */
 #define WMI_PEER_PARAM_FIXED_RATE                       0xF
 /** Whitelist peer TIDs */
 #define WMI_PEER_SET_MU_WHITELIST                       0x10
@@ -7369,6 +9452,10 @@ typedef struct {
  * selected from 0 to 31 values)
  */
 #define WMI_PEER_SET_DEFAULT_ROUTING                    0x13
+/* peer NSS for VHT160 - Extended NSS support */
+#define WMI_PEER_NSS_VHT160                             0x14
+/* peer NSS for VHT160 - Extended NSS support */
+#define WMI_PEER_NSS_VHT80_80                           0x15
 
 /** mimo ps values for the parameter WMI_PEER_MIMO_PS_STATE  */
 #define WMI_PEER_MIMO_PS_NONE                          0x0
@@ -7488,6 +9575,33 @@ typedef struct {
     A_UINT32 tx_max_mcs_nss;  /* b0-b3: max mcs idx; b4-b7: max nss */
 }wmi_vht_rate_set;
 
+/* NOTE: It would bea good idea to represent the Tx MCS
+ * info in one word and Rx in another word. This is split
+ * into multiple words for convenience
+ * currently this is being defined in IEEE802.11ax so this is same as wmi_vht_rate_set and is  sub change in future and may include BW as well
+ */
+typedef struct {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_he_rate_set */
+    /* HE Supported MCS Set field Rx
+     * - 2 bits are used for each NSS chain.Max of 8 NSS can be encoded with
+     *    value 0 - MCS 0-7 enabled for this NSS
+     *    value 1 - MCS 0-9 enabled for this NSS
+     *    value 2 - MCS 0-11 enabled for this NSS
+     *    value 3 - NSS disabled
+     * - WMI_HE_MAX_MCS_4_SS_MASK macro can be used for encoding this info
+     */
+    A_UINT32 rx_mcs_set; /* Negotiated RX HE rates (i.e. rate this node can RX from peer)*/
+    /* HE Supported MCS Set field Tx
+     * - 2 bits are used for each NSS chain.Max of 8 NSS can be encoded with
+     *    value 0 - MCS 0-7 enabled for this NSS
+     *    value 1 - MCS 0-9 enabled for this NSS
+     *    value 2 - MCS 0-11 enabled for this NSS
+     *    value 3 - NSS disabled
+     * - WMI_HE_MAX_MCS_4_SS_MASK macro can be used for encoding this info
+     */
+    A_UINT32 tx_mcs_set; /* Negotiated TX HE rates(i.e. rate this node can TX to peer) */
+} wmi_he_rate_set;
+
 /*
  * IMPORTANT: Make sure the bit definitions here are consistent
  * with the ni_flags definitions in wlan_peer.h
@@ -7579,17 +9693,19 @@ typedef struct {
      *  peer_ht_rates[] */
     A_UINT32 num_peer_ht_rates;
     /**
-     * Bitmap providing customized mapping of bandwidths to max Rx NSS
-     * for this peer.
-     * This is required since 802.11 standard currently facilitates peer to be
-     * able to advertise only a single max Rx NSS value across all bandwidths.
-     * Some QCA chipsets might need to be able to advertise a different max
-     * Rx NSS value for 160 MHz, than that for 80 MHz and lower.
+     * Bitmap providing the mapping of bandwidths to max Rx NSS for this peer
+     * in VHT160 / VHT80+80 Mode.
+     * As per the New IEEE 802.11 Update, the AP & Peer could advertise and
+     * handshake with the Max Rx NSS differing for different bandwidths
+     * instead of a single max Rx NSS Value.
+     * Some QCA chipsets have to advertise a different max Rx NSS value for
+     * 160 MHz and 80MHz.
      *
      *  bit[2:0] : Represents value of Rx NSS for VHT 160 MHz
-     *  bit[30:3]: Reserved
-     *  bit[31]  : MSB(0/1): 1 in case of valid data else all bits will be set
-     *             to 0 by host
+     *  bit[5:3] : Represents value of Rx NSS for VHT 80_80 MHz -
+     *             Extended NSS support
+     *  bit[30:6]: Reserved
+     *  bit[31]  : MSB(0/1): 1 in case of valid data sent from Host
      */
     A_UINT32 peer_bw_rxnss_override;
 
@@ -7598,12 +9714,13 @@ typedef struct {
     A_UINT32 peer_he_cap_info; /* protocol-defined HE / 11ax capability flags */
     A_UINT32 peer_he_ops; /* HE operation contains BSS color */
     A_UINT32 peer_he_cap_phy[WMI_MAX_HECAP_PHY_SIZE];
-    A_UINT32 peer_he_mcs; /* HE MCS/NSS set */
+    A_UINT32 peer_he_mcs; /* Indicates number of HE MCS TLV present */
 
     /* Following this struct are the TLV's:
          *     A_UINT8 peer_legacy_rates[];
          *     A_UINT8 peer_ht_rates[];
          *     wmi_vht_rate_set peer_vht_rates; //VHT capabilties of the peer
+         *     WMI_he_rate_set_peer_he_rates; <-- HE capabilities of the peer
          */
 } wmi_peer_assoc_complete_cmd_fixed_param;
 
@@ -7688,6 +9805,8 @@ typedef struct {
     A_UINT32 tx_frame_cnt;
     /** mac clock */
     A_UINT32 mac_clk_mhz;
+    /** unique id identifying the VDEV */
+    A_UINT32 vdev_id;
 } wmi_chan_info_event_fixed_param;
 
 /**
@@ -7841,6 +9960,10 @@ typedef struct{
  *  and to look for a matching AP profile from a list of
  *  configured profiles. */
 
+/* flags for roam_scan_mode_cmd
+ * indicate the status (success/fail) of wmi_roam_scan_mode cmd through WMI_ROAM_EVENTID */
+#define WMI_ROAM_SCAN_MODE_FLAG_REPORT_STATUS  0x1
+
 /**
  * WMI_ROAM_SCAN_MODE: Set Roam Scan mode
  *   the roam scan mode is one of the periodic, rssi change, both, none.
@@ -7853,8 +9976,9 @@ typedef struct{
  */
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_scan_mode_fixed_param */
-	A_UINT32 roam_scan_mode;
+    A_UINT32 roam_scan_mode;
     A_UINT32 vdev_id;
+    A_UINT32 flags; /* see WMI_ROAM_SCAN_MODE_FLAG defs */
 } wmi_roam_scan_mode_fixed_param;
 
 #define WMI_ROAM_SCAN_MODE_NONE        0x0
@@ -7873,7 +9997,7 @@ typedef struct {
 #define WMI_ROAM_SCAN_STOP_CMD 0x1
 
 /**
- * WMI_ROAM_SCAN_RSSI_THRESHOLD : set scan rssi thresold
+ * WMI_ROAM_SCAN_RSSI_THRESHOLD : set scan rssi threshold
  *  scan rssi threshold is the rssi threshold below which the FW will start running Roam scans.
  * Applicable when WMI_ROAM_SCAN_MODE is not set to none.
  */
@@ -7891,13 +10015,56 @@ typedef struct {
     A_UINT32 hirssi_scan_delta;
     /** 5G scan upper bound */
     A_UINT32 hirssi_upper_bound;
+    /** roam scan rssi threshold for 5G band.
+     *  offset from roam_scan_rssi_thres, in dB units
+     */
+    A_INT32 rssi_thresh_offset_5g;
     /* The TLVs will follow.
      * wmi_roam_scan_extended_threshold_param extended_param;
      * wmi_roam_earlystop_rssi_thres_param earlystop_param;
      * wmi_roam_dense_thres_param dense_param;
+     * wmi_roam_bg_scan_roaming_param bg_scan_param;
      */
 } wmi_roam_scan_rssi_threshold_fixed_param;
 
+/**
+ * WMI_ROAM_BTM_CONFIG_CMDID : set BTM (BSS Transition Management. 802.11v) offload config
+ *  Applicable only when WMI_ROAM_SCAN_MODE is enabled with WMI_ROAM_SCAN_MODE_ROAMOFFLOAD
+ */
+
+/**
+ *  btm_config.flags
+ *  BIT 0     : Enable/Disable the BTM offload.
+ *  BIT 1-2   : Action on non matching candidate with cache. Used WMI_ROAM_BTM_OFLD_NON_MATCHING_CND_XXX
+ *  BIT 3-5   : Roaming handoff decisions. Use WMI_ROAM_BTM_OFLD_CNDS_MATCH_XXX
+ *  BIT 6-31  : Reserved
+ */
+#define WMI_ROAM_BTM_SET_ENABLE(flags, val)                    WMI_SET_BITS(flags, 0, 1, val)
+#define WMI_ROAM_BTM_GET_ENABLE(flags)                         WMI_GET_BITS(flags, 0, 1)
+#define WMI_ROAM_BTM_SET_NON_MATCHING_CND_ACTION(flags, val)   WMI_SET_BITS(flags, 1, 2, val)
+#define WMI_ROAM_BTM_GET_NON_MATCHING_CND_ACTION(flags)        WMI_GET_BITS(flags, 1, 2)
+#define WMI_ROAM_BTM_SET_CNDS_MATCH_CONDITION(flags, val)      WMI_SET_BITS(flags, 3, 3, val)
+#define WMI_ROAM_BTM_GET_CNDS_MATCH_CONDITION(flags)           WMI_GET_BITS(flags, 3, 3)
+
+/** WMI_ROAM_BTM_SET_NON_MATCHING_CNDS_ACTION definition: When BTM candidate is not matched with cache by WMI_ROAM_BTM_SET_CNDS_MATCH_CONDITION, determine what to do */
+#define WMI_ROAM_BTM_NON_MATCHING_CNDS_SCAN_CONSUME      0 /** Invoke roam scan and consume within firmware. Applicable only when ROAM_SCAN_MODE is enabled. If ROAM_SCAN_MODE is disabled, firmware won't scan and forward it to host */
+#define WMI_ROAM_BTM_NON_MATCHING_CNDS_NO_SCAN_FORWARD   1 /** Does not allow roam scan and forward BTM frame to host */
+/** reserved upto 3 */
+
+/** WMI_ROAM_BTM_SET_CNDS_MATCH_CONDITION definition: This is used to invoke WMI_ROAM_BTM_SET_NON_MATCHING_CND_ACTION when compared with cache. i.e this condition is not applied with fresh scan result */
+#define WMI_ROAM_BTM_CNDS_MATCH_EXACT                    0 /** Exactly matched with roam candidate list to BTM candidates */
+#define WMI_ROAM_BTM_CNDS_MATCH_AT_LEAST_TOP             1 /** At least one or more top priority bssid matched */
+/** reserved upto 7 */
+
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_btm_config_fixed_param */
+    A_UINT32 tlv_header;
+    /** unique id identifying the VDEV on which BTM is enabled/disabled */
+    A_UINT32 vdev_id;
+    /** BTM configuration control flags */
+    A_UINT32 flags;
+} wmi_btm_config_fixed_param;
+
 #define WMI_ROAM_5G_BOOST_PENALIZE_ALGO_FIXED  0x0
 #define WMI_ROAM_5G_BOOST_PENALIZE_ALGO_LINEAR 0x1
 #define WMI_ROAM_5G_BOOST_PENALIZE_ALGO_LOG    0x2
@@ -7990,8 +10157,23 @@ enum {
     WMI_AUTH_RSNA_8021X_SHA256,
     WMI_AUTH_CCKM_WPA,
     WMI_AUTH_CCKM_RSNA,
+    WMI_AUTH_RSNA_FILS_SHA256,
+    WMI_AUTH_RSNA_FILS_SHA384,
 };
 
+typedef enum {
+    WMI_SCAN_CLIENT_NLO = 0x1,  /* 1 */
+    WMI_SCAN_CLIENT_EXTSCAN,    /* 2 */
+    WMI_SCAN_CLIENT_ROAM,       /* 3 */
+    WMI_SCAN_CLIENT_P2P,        /* 4 */
+    WMI_SCAN_CLIENT_LPI,        /* 5 */
+    WMI_SCAN_CLIENT_NAN,        /* 6 */
+    WMI_SCAN_CLIENT_ANQP,       /* 7 */
+    WMI_SCAN_CLIENT_OBSS,       /* 8 */
+    WMI_SCAN_CLIENT_PLM,        /* 9 */
+    WMI_SCAN_CLIENT_HOST,       /* 10 */
+} WMI_SCAN_CLIENT_ID;
+
 typedef struct {
     /** authentication mode (defined above)  */
     A_UINT32               rsn_authmode;
@@ -8010,6 +10192,228 @@ typedef struct {
 /** looking for a PMF enabled AP */
 #define WMI_AP_PROFILE_FLAG_PMF    0x4
 
+/* the value used in wmi_roam_cnd_scoring_param->disable_bitmap */
+#define WLAN_ROAM_SCORING_RSSI_DISABLE                  0x00000001
+#define WLAN_ROAM_SCORING_HT_DISABLE                    0x00000002
+#define WLAN_ROAM_SCORING_VHT_DISABLE                   0x00000004
+#define WLAN_ROAM_SCORING_BW_DISABLE                    0x00000008
+#define WLAN_ROAM_SCORING_BAND_DISABLE                  0x00000010
+#define WLAN_ROAM_SCORING_NSS_DISABLE                   0x00000020
+#define WLAN_ROAM_SCORING_CHAN_CONGESTION_DISABLE       0x00000040
+#define WLAN_ROAM_SCORING_BEAMFORMING_DISABLE           0x00000080
+#define WLAN_ROAM_SCORING_PCL_DISABLE                   0x00000100
+#define WLAN_ROAM_SCORING_HE_DISABLE                    0x00000200
+#define WLAN_ROAM_SCORING_OCE_WAN_DISABLE               0x00000400
+#define WLAN_ROAM_SCORING_DISABLE_ALL                   0xFFFFFFFF
+#define WLAN_ROAM_SCORING_DEFAULT_PARAM_ALLOW           0x0
+
+#define WLAN_ROAM_MAX_SELECTION_SCORE                   10000
+
+#define WLAN_ROAM_SCORE_20MHZ_BW_INDEX                  0
+#define WLAN_ROAM_SCORE_40MHZ_BW_INDEX                  1
+#define WLAN_ROAM_SCORE_80MHZ_BW_INDEX                  2
+#define WLAN_ROAM_SCORE_160MHZ_BW_INDEX                 3
+#define WLAN_ROAM_SCORE_MAX_BW_INDEX                    4
+#define WMI_ROAM_GET_BW_SCORE_PERCENTAGE(value32, bw_index)                   WMI_GET_BITS(value32, (8 * (bw_index)), 8)
+#define WMI_ROAM_SET_BW_SCORE_PERCENTAGE(value32, score_pcnt, bw_index)       WMI_SET_BITS(value32, (8 * (bw_index)), 8, score_pcnt)
+
+#define WLAN_ROAM_SCORE_NSS_1x1_INDEX                   0
+#define WLAN_ROAM_SCORE_NSS_2x2_INDEX                   1
+#define WLAN_ROAM_SCORE_NSS_3x3_INDEX                   2
+#define WLAN_ROAM_SCORE_NSS_4x4_INDEX                   3
+#define WLAN_ROAM_SCORE_MAX_NSS_INDEX                   4
+#define WMI_ROAM_GET_NSS_SCORE_PERCENTAGE(value32, nss_index)                 WMI_GET_BITS(value32, (8 * (nss_index)), 8)
+#define WMI_ROAM_SET_NSS_SCORE_PERCENTAGE(value32, score_pcnt, nss_index)     WMI_SET_BITS(value32, (8 * (nss_index)), 8, score_pcnt)
+
+#define WLAN_ROAM_SCORE_BAND_2G_INDEX                   0
+#define WLAN_ROAM_SCORE_BAND_5G_INDEX                   1
+/* 2 and 3 are reserved */
+#define WLAN_ROAM_SCORE_MAX_BAND_INDEX                  4
+#define WMI_ROAM_GET_BAND_SCORE_PERCENTAGE(value32, band_index)                 WMI_GET_BITS(value32, (8 * (band_index)), 8)
+#define WMI_ROAM_SET_BAND_SCORE_PERCENTAGE(value32, score_pcnt, band_index)     WMI_SET_BITS(value32, (8 * (band_index)), 8, score_pcnt)
+
+#define WLAN_ROAM_SCORE_MAX_CHAN_CONGESTION_SLOT        16
+#define WLAN_ROAM_SCORE_DEFAULT_CONGESTION_SLOT         0
+
+#define WLAN_ROAM_SCORE_MAX_OCE_WAN_SLOT                16
+#define WLAN_ROAM_SCORE_DEFAULT_OCE_WAN_SLOT            0
+
+/**
+    best_rssi_threshold: Roamable AP RSSI equal or better than this threshold, full rssi score 100. Units in dBm.
+    good_rssi_threshold: Below this threshold, scoring linear percentage between rssi_good_pcnt and 100. Units in dBm.
+    bad_rssi_threshold:  Between good and bad rssi threshold, scoring linear percentage between rssi_bad_pcnt and rssi_good_pcnt. Units in dBm.
+    good_rssi_pcnt: Used to assigned scoring percentage of each slot between best to good rssi threshold. Units in percentage.
+    bad_rssi_pcnt: Used to assigned scoring percentage of each slot between good to bad rssi threshold. Units in percentage.
+    good_bucket_size : bucket size of slot in good zone.  Units in dB.
+    bad_bucket_size : bucket size of slot in bad zone. Units in dB.
+    rssi_pref_5g_rssi_thresh: Below rssi threshold, 5G AP have given preference of band percentage. Units in dBm.
+*/
+/**
+    The graph below explains how RSSI scoring percentage is calculated
+    as the RSSI improves.  In the graph, the derived parameters good_buckets
+    and bad_buckets are used.  These derived parameters are related to the
+    specified parameters as follows:
+        good_buckets =
+            (best_rssi_threshold - good_rssi_threshold) / good_bucket_size
+        bad_buckets =
+            (good_rssi_threshold - bad_rssi_threshold) / bad_bucket_size
+
+      |     (x0,y0) (x0 = best_rssi, y0 = 100)
+p 100 |-------o
+e     |       |<--------- (100 - good_rssi_pct)/good_buckets
+r     |       |___  ,---- good_bucket_size
+c     |           | |
+e     |           |_V_
+n     |               |
+t     |               |___o (x1,y1) (x1 = good_rssi, y1 = good_rssi_pcnt)
+   80 |                   |
+%     |                   |<------ (good_rssi_pcnt - bad_rssi_pcnt)/bad_buckets
+      |                   |_____
+      |                         |  ,-- bad_bucket_size
+      |                         |  |
+      |                         |__v__
+      |                               |
+      |                               |
+   40 |                               o------------
+      |                             (x2,y2) (x2 = bad_rssi, y2 = bad_rssi_pcnt)
+      +------o------------o-----------o------------->
+            -50         -70          -80          rssi dBm
+
+| excellent  |  good      | bad       | poor
+| zone       |  zone      | zone      | zone
+             V            V           V
+        BEST_THRES   GOOD_THRES     BAD_THRES
+ */
+typedef struct {
+    A_INT32  best_rssi_threshold;
+    A_INT32  good_rssi_threshold;
+    A_INT32  bad_rssi_threshold;
+    A_UINT32 good_rssi_pcnt;
+    A_UINT32 bad_rssi_pcnt;
+    A_UINT32 good_bucket_size;
+    A_UINT32 bad_bucket_size;
+    A_INT32  rssi_pref_5g_rssi_thresh;
+} wmi_roam_cnd_rssi_scoring;
+
+/**
+    Use macro WMI_ROAM_CND_GET/SET_BW_SCORE_PERCENTAGE to get and set the value respectively.
+    BITS 0-7   :- It contains scoring percentage of 20MHz   BW
+    BITS 8-15  :- It contains scoring percentage of 40MHz   BW
+    BITS 16-23 :- It contains scoring percentage of 80MHz   BW
+    BITS 24-31 :- It contains scoring percentage of 1600MHz BW
+
+    The value of each index must be 0-100
+ */
+typedef struct {
+    A_UINT32 score_pcnt;
+} wmi_roam_cnd_bw_scoring;
+
+/**
+    Use macro WMI_ROAM_CND_GET/SET_BAND_SCORE_PERCENTAGE to get and set the value respectively.
+    BITS 0-7   :- It contains scoring percentage of 2G
+    BITS 8-15  :- It contains scoring percentage of 5G
+    BITS 16-23 :- reserved
+    BITS 24-31 :- reserved
+
+    The value of each index must be 0-100
+ */
+typedef struct {
+    A_UINT32 score_pcnt;
+} wmi_roam_cnd_band_scoring;
+
+/**
+    Use macro WMI_ROAM_CND_GET/SET_NSS_SCORE_PERCENTAGE to get and set the value respectively.
+        BITS 0-7   :- It contains scoring percentage of 1x1
+        BITS 8-15  :- It contains scoring percentage of 2x2
+        BITS 16-23 :- It contains scoring percentage of 3x3
+        BITS 24-31 :- It contains scoring percentage of 4x4
+
+    The value of each index must be 0-100
+ */
+typedef struct {
+    A_UINT32 score_pcnt;
+} wmi_roam_cnd_nss_scoring;
+
+/**
+    score_pcnt: Contains roam score percentage of each slot of respective channel_congestion_pcnt.It is also used same BITS for slot(0-3)
+                BITS 0-7   :- the scoring pcnt when AP is not advertise QBSS/ESP info
+                BITS 8-15 :-  SLOT_1
+                BITS 16-23 :- SLOT_2
+                BITS 24-31 :- SLOT_3
+                BITS 32-      ...
+
+    num_slot will equally divide 100. e.g, if num_slot = 4
+    slot 0 = 0-25%, slot 1 = 26-50% slot 2 = 51-75%, slot 3 = 76-100%
+*/
+typedef struct {
+    A_UINT32 num_slot; /* max 15 */
+    A_UINT32 score_pcnt3_to_0;
+    A_UINT32 score_pcnt7_to_4;
+    A_UINT32 score_pcnt11_to_8;
+    A_UINT32 score_pcnt15_to_12;
+} wmi_roam_cnd_esp_qbss_scoring;
+
+/**
+    score_pcnt: Contains roam score percentage of each slot of respective channel_congestion_pcnt.It is also used same BITS for slot(0-3)
+                BITS 0-7   :- the scoring pcnt when AP is not advertise QBSS/ESP info
+                BITS 8-15 :-  SLOT_1
+                BITS 16-23 :- SLOT_2
+                BITS 24-31 :- SLOT_3
+                BITS 32-      ...
+
+    num_slot will equally divide 100. e.g, if num_slot = 4
+    slot 0 = 0-25%, slot 1 = 26-50% slot 2 = 51-75%, slot 3 = 76-100%
+*/
+typedef struct {
+    A_UINT32 num_slot; /* max 15  */
+    A_UINT32 score_pcnt3_to_0;
+    A_UINT32 score_pcnt7_to_4;
+    A_UINT32 score_pcnt11_to_8;
+    A_UINT32 score_pcnt15_to_12;
+} wmi_roam_cnd_oce_wan_scoring;
+
+/**
+    disable_bitmap :- Each bit will be either allow(0)/disallow(1) to considered the roam score param.
+    rssi_weightage_pcnt :- RSSI weightage out of total score in percentage
+    ht_weightage_pcnt :- HT weightage out of total score in percentage.
+    vht_weightage_pcnt :- VHT weightage out of total score in percentage.
+    he_weightage_pcnt :- 11ax weightage out of total score in percentage.
+    bw_weightage_pcnt :- Bandwidth weightage out of total score in percentage.
+    band_weightage_pcnt :- Band(2G/5G) weightage out of total score in percentage.
+    nss_weightage_pcnt:- NSS(1x1 / 2x2) weightage out of total score in percentage.
+    esp_qbss_weightage_pcnt: ESP/QBSS weightage out of total score in percentage.
+    beamforming_weightage_pcnt :- Beamforming weightage out of total score in percentage.
+    pcl_weightage_pcnt :- PCL weightage out of total score in percentage.
+    oce_wan_weightage_pcnt :- OCE WAN metrics weightage out of total score in percentage.
+    rssi_scoring :- RSSI scoring information.
+    bw_scoring :- channel BW scoring percentage information.
+    band_scoring : - band scording percentage information.
+    nss_scoring :- NSS scoring percentage information.
+    esp_qbss_scoring :- ESP/QBSS scoring percentage information
+    oce_wan_scoring : OCE WAN metrics percentage information
+*/
+typedef struct {
+    A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_cnd_scoring_param */
+    A_UINT32 disable_bitmap;
+    A_INT32 rssi_weightage_pcnt;
+    A_INT32 ht_weightage_pcnt;
+    A_INT32 vht_weightage_pcnt;
+    A_INT32 he_weightage_pcnt;
+    A_INT32 bw_weightage_pcnt;
+    A_INT32 band_weightage_pcnt;
+    A_INT32 nss_weightage_pcnt;
+    A_INT32 esp_qbss_weightage_pcnt;
+    A_INT32 beamforming_weightage_pcnt;
+    A_INT32 pcl_weightage_pcnt;
+    A_INT32 oce_wan_weightage_pcnt;
+    wmi_roam_cnd_rssi_scoring rssi_scoring;
+    wmi_roam_cnd_bw_scoring bw_scoring;
+    wmi_roam_cnd_band_scoring band_scoring;
+    wmi_roam_cnd_nss_scoring nss_scoring;
+    wmi_roam_cnd_esp_qbss_scoring esp_qbss_scoring;
+    wmi_roam_cnd_oce_wan_scoring oce_wan_scoring;
+} wmi_roam_cnd_scoring_param;
+
 /** To match an open AP, the rs_authmode should be set to WMI_AUTH_NONE
  *  and WMI_AP_PROFILE_FLAG_CRYPTO should be clear.
  *  To match a WEP enabled AP, the rs_authmode should be set to WMI_AUTH_NONE
@@ -8021,7 +10425,7 @@ typedef struct {
     /** flags as defined above */
     A_UINT32  flags;
 	/**
-     * rssi thresold value: the value of the the candidate AP should
+     * rssi threshold value in dB: the value of the candidate AP should
 	 * higher by this threshold than the rssi of the currrently associated AP.
 	 */
 	A_UINT32 rssi_threshold;
@@ -8041,6 +10445,19 @@ typedef struct {
     A_UINT32               rsn_mcastcipherset;
     /** mcast/group management frames cipher set */
     A_UINT32               rsn_mcastmgmtcipherset;
+    /**
+    * rssi_abs_threshold value: the value of the candidate AP should
+    * higher than this absolute RSSI threshold.
+    * Zero means no absolute minimum RSSI is required.
+    * units are the offset from the noise floor in dB.
+    */
+    A_UINT32 rssi_abs_thresh;
+    /**
+     * bg_rssi_threshold value in dB: For background scan the value of
+     * the candidate AP should be higher by this threshold than the rssi
+     * of the currrently associated AP.
+     */
+    A_UINT32 bg_rssi_threshold;
 } wmi_ap_profile;
 
 /** Support early stop roaming scanning when finding a strong candidate AP
@@ -8071,6 +10488,27 @@ typedef struct {
     A_UINT32 roam_dense_traffic_thres;
 } wmi_roam_dense_thres_param;
 
+/* Definition for flags in wmi_roam_bg_scan_roaming_param
+ * Bit 0: BG roaming enabled when we connect to 2G AP only and roaming to 5G AP only.
+ * Bit 1-31: Reserved
+ */
+#define WMI_ROAM_BG_SCAN_FLAGS_2G_TO_5G_ONLY   1
+
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_bg_scan_roaming_param */
+    A_UINT32 tlv_header;
+    /** rssi threshold in dBm below which roaming will be triggered during background scan(non-roam scan). 0 will disable this threshold */
+    A_UINT32 roam_bg_scan_bad_rssi_thresh;
+    /** bitmap for which scan client will enable/disable background roaming. bit position is mapped to the enum WMI_SCAN_CLIENT_ID. 1 = enable, 0 = disable */
+    A_UINT32 roam_bg_scan_client_bitmap;
+    /** roam scan rssi threshold for 2G band.
+     *  offset from roam_bg_scan_bad_rssi_thresh, in dB units
+     */
+    A_INT32 bad_rssi_thresh_offset_2g;
+    /* flags for background roaming */
+    A_UINT32 flags;
+} wmi_roam_bg_scan_roaming_param;
+
 /** Beacon filter wmi command info */
 
 #define BCN_FLT_MAX_SUPPORTED_IES    256
@@ -8125,6 +10563,28 @@ typedef struct wmi_pdev_send_bcn {
     wmi_bcn_send_from_host_cmd_fixed_param   bcn_cmd[1];
 } wmi_pdev_send_bcn_cmd_t;
 
+typedef struct wmi_fd_send_from_host {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_fd_send_from_host_cmd_fixed_param  */
+    A_UINT32 vdev_id;
+    A_UINT32 data_len;
+    union {
+        A_UINT32 frag_ptr; /* Physical address of the frame */
+        A_UINT32 frag_ptr_lo; /* LSBs of physical address of the frame */
+    };
+    A_UINT32 frag_ptr_hi; /* MSBs of physical address of the frame */
+    A_UINT32 frame_ctrl; /* frame ctrl to setup PPDU desc */
+} wmi_fd_send_from_host_cmd_fixed_param;
+
+/*
+ * WMI command structure for FILS feature enable/disable
+ */
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_enable_fils_cmd_fixed_param  */
+    /* VDEV identifier */
+    A_UINT32 vdev_id;
+    A_UINT32 fd_period; /* non-zero - enable Fils Discovery frames with this period (in TU), 0 - disable FD frames */
+} wmi_enable_fils_cmd_fixed_param;
+
  /*
   * WMI_ROAM_AP_PROFILE:  AP profile of connected AP for roaming.
   */
@@ -8136,10 +10596,11 @@ typedef struct {
     /** unique id identifying the VDEV, generated by the caller */
     A_UINT32 vdev_id;
 
-    /*
-         * Following this structure is the TLV:
-         *     wmi_ap_profile ap_profile; //AP profile info
-        */
+/*
+ * Following this structure is the TLV:
+ * wmi_ap_profile ap_profile; //AP profile info
+ * wmi_roam_cnd_scoring_param roam_cnd_scoring_param
+ */
 } wmi_roam_ap_profile_fixed_param;
 
 /**
@@ -8209,7 +10670,9 @@ typedef struct {
 
 /* flags for 11i offload */
 #define WMI_ROAM_OFFLOAD_FLAG_OKC_ENABLED       0   /* okc is enabled */
-/* from bit 1 to bit 31 are reserved */
+/* pmk caching is disabled */
+#define WMI_ROAM_OFFLOAD_FLAG_PMK_CACHE_DISABLED 1
+/* from bit 2 to bit 31 are reserved */
 
 #define WMI_SET_ROAM_OFFLOAD_OKC_ENABLED(flag) do { \
         (flag) |=  (1 << WMI_ROAM_OFFLOAD_FLAG_OKC_ENABLED);      \
@@ -8222,6 +10685,19 @@ typedef struct {
 #define WMI_GET_ROAM_OFFLOAD_OKC_ENABLED(flag)   \
         ((flag) & (1 << WMI_ROAM_OFFLOAD_FLAG_OKC_ENABLED))
 
+#define WMI_SET_ROAM_OFFLOAD_PMK_CACHE_ENABLED(flag) \
+    do { \
+        (flag) &=  ~(1 << WMI_ROAM_OFFLOAD_FLAG_PMK_CACHE_DISABLED); \
+    } while (0)
+
+#define WMI_SET_ROAM_OFFLOAD_PMK_CACHE_DISABLED(flag) \
+    do { \
+        (flag) |=  (1 << WMI_ROAM_OFFLOAD_FLAG_PMK_CACHE_DISABLED); \
+    } while (0)
+
+#define WMI_GET_ROAM_OFFLOAD_PMK_CACHE_DISABLED(flag) \
+    ((flag) & (1 << WMI_ROAM_OFFLOAD_FLAG_PMK_CACHE_DISABLED))
+
 /* This TLV will be  filled only in case of wpa-psk/wpa2-psk */
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_11i_offload_fixed_param */
@@ -8285,6 +10761,8 @@ typedef struct {
  * WMI_ROAM_REASON_HO_FAILED no matter WMI_ROAM_INVOKE_CMDID is called or not.
  */
 #define WMI_ROAM_REASON_INVOKE_ROAM_FAIL 0x6
+#define WMI_ROAM_REASON_RSO_STATUS       0x7
+#define WMI_ROAM_REASON_BTM              0x8 /** Roaming because of BTM request received */
 /* reserved up through 0xF */
 
 /* subnet status: bits 4-5 */
@@ -8308,10 +10786,29 @@ typedef enum {
     (((roam_reason) & WMI_ROAM_SUBNET_CHANGE_STATUS_MASK) >> \
      WMI_ROAM_SUBNET_CHANGE_STATUS_SHIFT)
 
+#define WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE_MASK     0x40
+#define WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE_SHIFT    6
+
+#define WMI_SET_ROAM_REQUEST_HOST_HW_MODE_CHANGE(roam_reason, status) \
+    do { \
+        (roam_reason) |= \
+            (((status) << WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE_SHIFT) & \
+             WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE_MASK); \
+    } while (0)
+
+#define WMI_GET_ROAM_REQUEST_HOST_HW_MODE_CHANGE(roam_reason) \
+    (((roam_reason) & WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE_MASK) >> \
+     WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE_SHIFT)
+
 /* roaming notification */
-#define WMI_ROAM_NOTIF_INVALID     0x0  /** invalid notification. Do not interpret notif field  */
-#define WMI_ROAM_NOTIF_ROAM_START  0x1  /** indicate that roaming is started. sent only in non WOW state */
-#define WMI_ROAM_NOTIF_ROAM_ABORT  0x2  /** indicate that roaming is aborted. sent only in non WOW state */
+#define WMI_ROAM_NOTIF_INVALID           0x0 /** invalid notification. Do not interpret notif field  */
+#define WMI_ROAM_NOTIF_ROAM_START        0x1 /** indicate that roaming is started. sent only in non WOW state */
+#define WMI_ROAM_NOTIF_ROAM_ABORT        0x2 /** indicate that roaming is aborted. sent only in non WOW state */
+#define WMI_ROAM_NOTIF_ROAM_REASSOC      0x3 /** indicate that reassociation is done. sent only in non WOW state */
+#define WMI_ROAM_NOTIF_SCAN_MODE_SUCCESS 0x4 /** indicate that roaming scan mode is successful */
+#define WMI_ROAM_NOTIF_SCAN_MODE_FAIL    0x5 /** indicate that roaming scan mode is failed due to internal roaming state */
+#define WMI_ROAM_NOTIF_DISCONNECT        0x6 /** indicate that roaming not allowed due BTM req */
+#define WMI_ROAM_NOTIF_SUBNET_CHANGED    0x7 /** indicate that subnet has changed */
 
 /**whenever RIC request information change, host driver should pass all ric related information to firmware (now only support tsepc)
 * Once, 11r roaming happens, firmware can generate RIC request in reassoc request based on these informations
@@ -8371,6 +10868,7 @@ typedef struct{
 #define WMI_ROAM_INVOKE_SCAN_MODE_FIXED_CH      0   /* scan given channel only */
 #define WMI_ROAM_INVOKE_SCAN_MODE_CACHE_LIST    1   /* scan cached channel list */
 #define WMI_ROAM_INVOKE_SCAN_MODE_FULL_CH       2   /* scan full channel */
+#define WMI_ROAM_INVOKE_SCAN_MODE_SKIP          3   /* no scan is performed. use beacon/probe resp given by the host */
 
 #define WMI_ROAM_INVOKE_AP_SEL_FIXED_BSSID      0   /* roam to given BSSID only */
 #define WMI_ROAM_INVOKE_AP_SEL_ANY_BSSID        1   /* roam to any BSSID */
@@ -8397,11 +10895,14 @@ typedef struct {
     A_UINT32 roam_delay; /** 0 = immediate roam, 1-2^32 = roam after this delay (msec) */
     A_UINT32 num_chan; /** # if channels to scan. In the TLV channel_list[] */
     A_UINT32 num_bssid;  /** number of bssids. In the TLV bssid_list[] */
+    A_UINT32 num_buf; /** number of buffers In the TLV bcn_prb_buf_list[] */
     /**
      * TLV (tag length value ) parameters follows roam_invoke_req
      * The TLV's are:
      *     A_UINT32 channel_list[];
      *     wmi_mac_addr bssid_list[];
+     *     wmi_tlv_buf_len_param bcn_prb_buf_list[];
+     *     A_UINT8 bcn_prb_frm[];
      */
 } wmi_roam_invoke_cmd_fixed_param;
 
@@ -8410,8 +10911,32 @@ enum {
     ROAM_FILTER_OP_BITMAP_BLACK_LIST =   0x1,
     ROAM_FILTER_OP_BITMAP_WHITE_LIST =   0x2,
     ROAM_FILTER_OP_BITMAP_PREFER_BSSID = 0x4,
+    ROAM_FILTER_OP_BITMAP_LCA_DISALLOW = 0x8,
+    ROAM_FILTER_OP_BITMAP_RSSI_REJECTION_OCE = 0x10,
 };
 
+/** lca_enable_source_bitmap */
+#define WMI_ROAM_LCA_DISALLOW_SOURCE_PER         0x1
+#define WMI_ROAM_LCA_DISALLOW_SOURCE_BMISS       0x2
+#define WMI_ROAM_LCA_DISALLOW_SOURCE_LOW_RSSI    0x4
+#define WMI_ROAM_LCA_DISALLOW_SOURCE_HIGH_RSSI   0x8
+#define WMI_ROAM_LCA_DISALLOW_SOURCE_PERIODIC    0x10
+#define WMI_ROAM_LCA_DISALLOW_SOURCE_MAWC        0x20 /* MAWC = Motion Aided Wifi connectivity */
+#define WMI_ROAM_LCA_DISALLOW_SOURCE_DENSE       0x40
+#define WMI_ROAM_LCA_DISALLOW_SOURCE_BACKGROUND  0x80
+#define WMI_ROAM_LCA_DISALLOW_SOURCE_FORCED      0x100
+
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_rssi_rejection_oce_config_param */
+    A_UINT32 tlv_header;
+     /** BSSID of AP, who reject (re-)assoc due to low RSSI */
+    wmi_mac_addr bssid;
+    /** Disallowed AP for certain duration, in units of milliseconds */
+    A_UINT32 remaining_disallow_duration;
+   /** AP will be allowed for candidate, when AP RSSI better than expected RSSI units in dBm */
+    A_INT32 requested_rssi;
+} wmi_roam_rssi_rejection_oce_config_param;
+
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_filter_list_fixed_param */
     A_UINT32 vdev_id; /** Unique id identifying the VDEV on which roaming filter is adopted */
@@ -8420,6 +10945,7 @@ typedef struct {
     A_UINT32 num_bssid_black_list; /* number of blacklist in the TLV variable bssid_black_list */
     A_UINT32 num_ssid_white_list; /* number of whitelist in the TLV variable ssid_white_list */
     A_UINT32 num_bssid_preferred_list; /* only for lfr 3.0. number of preferred list & factor in the TLV */
+    A_UINT32 num_rssi_rejection_ap; /** number of list of AP who rejected STA due to low RSSI */
     /**
      * TLV (tag length value ) parameters follows roam_filter_list_cmd
      * The TLV's are:
@@ -8427,10 +10953,20 @@ typedef struct {
      *     wmi_ssid ssid_white_list[];
      *     wmi_mac_addr bssid_preferred_list[];
      *     A_UINT32 bssid_preferred_factor[];
+     *     wmi_roam_lca_disallow_config_tlv_param lca_disallow_param[0/1] (opt)
+     *     wmi_roam_rssi_rejection_oce_config_param rssi_rejection_list[]
      */
 } wmi_roam_filter_fixed_param;
 
 typedef struct {
+    A_UINT32 tlv_header;        /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_lca_disallow_config_tlv_param */
+    A_UINT32 disallow_duration; /** How long LCA AP will be disallowed before it can be a roaming candidate again, in units of seconds */
+    A_UINT32 rssi_channel_penalization; /** How much RSSI will be penalized if candidate(s) are found in the same channel as disallowed AP's, in units of db */
+    A_UINT32 num_disallowed_aps; /** How many APs the target should maintain in its LCA (Last Connected AP) list */
+    A_UINT32 disallow_lca_enable_source_bitmap; /** disallow LCA logic is enabled only when trigger sources are matched with corresponding bit (see WMI_ROAM_LCA_DISALLOW_SOURCE constants) */
+} wmi_roam_lca_disallow_config_tlv_param;
+
+typedef struct {
     A_UINT8 address[4]; /* IPV4 address in Network Byte Order */
 } WMI_IPV4_ADDR;
 
@@ -8651,6 +11187,11 @@ typedef enum p2p_lo_start_ctrl_flags_e {
     P2P_LO_START_CTRL_FLAG_FLUSH_LISTEN_RESULT = 1 << 0,
 } p2p_lo_start_ctrl_flags;
 
+#define P2P_LO_PER_DEV_TYPE_LEN     8
+#define P2P_LO_DEV_TYPES_COUNT_MAX  10
+#define P2P_LO_DEV_TYPES_LEN_MAX    (P2P_LO_PER_DEV_TYPE_LEN * P2P_LO_DEV_TYPES_COUNT_MAX)
+#define P2P_LO_PROB_RESP_MAX_LEN    512
+
 typedef struct {
     A_UINT32 tlv_header;
     A_UINT32 vdev_id;
@@ -8664,11 +11205,13 @@ typedef struct {
      * device_types_data[] byte-array TLV that follows this TLV.
      * The data in device_types_data[] is in 8-byte elements, so
      * device_types_len will be a multiple of 8.
+     * Refer to P2P_LO_DEV_TYPES_LEN_MAX
      */
     A_UINT32 device_types_len;
     /*
      * prob_resp_len specifies the number of bytes in the
      * prob_resp_data[] byte-array TLV that follows this TLV.
+     * Refer to P2P_LO_PROB_RESP_MAX_LEN
      */
     A_UINT32 prob_resp_len;
     /*
@@ -8872,6 +11415,8 @@ typedef enum event_type_e {
     WOW_OEM_RESPONSE_EVENT = WOW_NAN_RTT_EVENT, /* reuse deprecated event value */
     WOW_TDLS_CONN_TRACKER_EVENT,
     WOW_CRITICAL_LOG_EVENT,
+    WOW_CHIP_POWER_FAILURE_DETECT_EVENT,
+    WOW_11D_SCAN_EVENT,
 } WOW_WAKE_EVENT_TYPE;
 
 typedef enum wake_reason_e {
@@ -8923,6 +11468,11 @@ typedef enum wake_reason_e {
     WOW_REASON_CRITICAL_LOG,
     WOW_REASON_P2P_LISTEN_OFFLOAD,
     WOW_REASON_NAN_EVENT_WAKE_HOST,
+    WOW_REASON_CHIP_POWER_FAILURE_DETECT,
+    WOW_REASON_11D_SCAN,
+    WOW_REASON_THERMAL_CHANGE,
+    WOW_REASON_OIC_PING_OFFLOAD,
+    WOW_REASON_WLAN_DHCP_RENEW,
     WOW_REASON_DEBUG_TEST = 0xFF,
 } WOW_WAKE_REASON_TYPE;
 
@@ -8933,13 +11483,19 @@ typedef enum {
 
 enum {
     /* some win10 platfrom will not assert pcie_reset for wow.*/
-    WMI_WOW_FLAG_IGNORE_PCIE_RESET = 0x00000001,
+    WMI_WOW_FLAG_IGNORE_PCIE_RESET          = 0x00000001,
     /* WMI_WOW_FLAG_SEND_PM_PME
      * Some platforms have issues if the PM_PME message is sent after WoW,
      * so don't send PM_PME after WoW unless the host uses this flag
      * to request it.
      */
-    WMI_WOW_FLAG_SEND_PM_PME       = 0x00000002,
+    WMI_WOW_FLAG_SEND_PM_PME                = 0x00000002,
+    /* Flag to indicate unit test */
+    WMI_WOW_FLAG_UNIT_TEST_ENABLE           = 0x00000004,
+    /* Force HTC wakeup */
+    WMI_WOW_FLAG_DO_HTC_WAKEUP              = 0x00000008,
+    /* Enable L1SS sleep for PCIE DRV case */
+    WMI_WOW_FLAG_ENABLE_DRV_PCIE_L1SS_SLEEP = 0x00000010,
 };
 
 typedef struct {
@@ -9158,6 +11714,7 @@ typedef struct {
 } WMI_WOW_HOSTWAKEUP_GPIO_PIN_PATTERN_CONFIG_CMD_fixed_param;
 
 #define MAX_SUPPORTED_ACTION_CATEGORY           256
+#define MAX_SUPPORTED_ACTION_SUBCATEGORY        32
 #define MAX_SUPPORTED_ACTION_CATEGORY_ELE_LIST  (MAX_SUPPORTED_ACTION_CATEGORY/32)
 
 typedef enum {
@@ -9172,6 +11729,15 @@ typedef struct {
     A_UINT32 vdev_id;
     A_UINT32 operation; /* 0 reset to fw default, 1 set the bits, 2 add the setting bits, 3 delete the setting bits */
     A_UINT32 action_category_map[MAX_SUPPORTED_ACTION_CATEGORY_ELE_LIST];
+    /* This fixed_param TLV is followed by these additional TLV's
+     * action_bitmaps_per_category -
+     * Each element is a 32-bit bitmap indicating which subcategories
+     * for that particular action category are considered for WoW wakeup
+     * (if the subcategory's bit is 0) or ignored for WoW wakeup (if the
+     * subcategory's bit is 1).
+     *
+     * A_UINT32 action_bitmaps_per_category[]; <-- variable length array
+     */
 } WMI_WOW_SET_ACTION_WAKE_UP_CMD_fixed_param;
 
 typedef struct  wow_event_info_s {
@@ -9362,18 +11928,23 @@ typedef struct {
 #define WMI_RXERR_KEY_CACHE_MISS    0x20    /* No/incorrect key matter in h/w */
 
 typedef enum {
-    PKT_PWR_SAVE_PAID_MATCH =         0x0001,
-    PKT_PWR_SAVE_GID_MATCH =          0x0002,
-    PKT_PWR_SAVE_EARLY_TIM_CLEAR =    0x0004,
-    PKT_PWR_SAVE_EARLY_DTIM_CLEAR =   0x0008,
-    PKT_PWR_SAVE_EOF_PAD_DELIM =      0x0010,
-    PKT_PWR_SAVE_MACADDR_MISMATCH =   0x0020,
-    PKT_PWR_SAVE_DELIM_CRC_FAIL =     0x0040,
-    PKT_PWR_SAVE_GID_NSTS_ZERO =      0x0080,
-    PKT_PWR_SAVE_RSSI_CHECK =         0x0100,
-    PKT_PWR_SAVE_5G_EBT =             0x0200,
-    PKT_PWR_SAVE_2G_EBT =             0x0400,
-    WMI_PKT_PWR_SAVE_MAX =            0x0800,
+    PKT_PWR_SAVE_PAID_MATCH =           0x00000001,
+    PKT_PWR_SAVE_GID_MATCH =            0x00000002,
+    PKT_PWR_SAVE_EARLY_TIM_CLEAR =      0x00000004,
+    PKT_PWR_SAVE_EARLY_DTIM_CLEAR =     0x00000008,
+    PKT_PWR_SAVE_EOF_PAD_DELIM =        0x00000010,
+    PKT_PWR_SAVE_MACADDR_MISMATCH =     0x00000020,
+    PKT_PWR_SAVE_DELIM_CRC_FAIL =       0x00000040,
+    PKT_PWR_SAVE_GID_NSTS_ZERO =        0x00000080,
+    PKT_PWR_SAVE_RSSI_CHECK =           0x00000100,
+    PKT_PWR_SAVE_5G_EBT =               0x00000200,
+    PKT_PWR_SAVE_2G_EBT =               0x00000400,
+    PKT_PWR_SAVE_BSS_COLOR_MISMATCH =   0x00000800,
+    PKT_PWR_SAVE_UL_FLAG =              0x00001000,
+    PKT_PWR_SAVE_STA_ID_MISMATCH =      0x00002000,
+    PKT_PWR_SAVE_MACADDR_MISMATCH_FCS = 0x00004000,
+
+    PKT_PWR_SAVE_ENABLE =               0x80000000,
 } WMI_PKT_PWR_SAVE_TYPE;
 
 typedef struct {
@@ -9656,16 +12227,20 @@ typedef enum _WMI_NLO_SSID_BcastNwType
 #define WMI_NLO_MAX_SSIDS    16
 #define WMI_NLO_MAX_CHAN     48
 
-#define WMI_NLO_CONFIG_STOP             (0x1 << 0)
-#define WMI_NLO_CONFIG_START            (0x1 << 1)
-#define WMI_NLO_CONFIG_RESET            (0x1 << 2)
-#define WMI_NLO_CONFIG_SLOW_SCAN        (0x1 << 4)
-#define WMI_NLO_CONFIG_FAST_SCAN        (0x1 << 5)
-#define WMI_NLO_CONFIG_SSID_HIDE_EN     (0x1 << 6)
+#define WMI_NLO_CONFIG_STOP                             (0x1 << 0)
+#define WMI_NLO_CONFIG_START                            (0x1 << 1)
+#define WMI_NLO_CONFIG_RESET                            (0x1 << 2)
+#define WMI_NLO_CONFIG_SLOW_SCAN                        (0x1 << 4)
+#define WMI_NLO_CONFIG_FAST_SCAN                        (0x1 << 5)
+#define WMI_NLO_CONFIG_SSID_HIDE_EN                     (0x1 << 6)
 /* This bit is used to indicate if EPNO or supplicant PNO is enabled. Only one of them can be enabled at a given time */
-#define WMI_NLO_CONFIG_ENLO             (0x1 << 7)
-#define WMI_NLO_CONFIG_SCAN_PASSIVE     (0x1 << 8)
-#define WMI_NLO_CONFIG_ENLO_RESET       (0x1 << 9)
+#define WMI_NLO_CONFIG_ENLO                             (0x1 << 7)
+#define WMI_NLO_CONFIG_SCAN_PASSIVE                     (0x1 << 8)
+#define WMI_NLO_CONFIG_ENLO_RESET                       (0x1 << 9)
+#define WMI_NLO_CONFIG_SPOOFED_MAC_IN_PROBE_REQ         (0x1 << 10)
+#define WMI_NLO_CONFIG_RANDOM_SEQ_NO_IN_PROBE_REQ       (0x1 << 11)
+#define WMI_NLO_CONFIG_ENABLE_IE_WHITELIST_IN_PROBE_REQ (0x1 << 12)
+#define WMI_NLO_CONFIG_ENABLE_CNLO_RSSI_CONFIG          (0x1 << 13)
 
 /* Whether directed scan needs to be performed (for hidden SSIDs) */
 #define WMI_ENLO_FLAG_DIRECTED_SCAN      1
@@ -9768,6 +12343,24 @@ typedef struct enlo_candidate_score_params_t {
     A_UINT32 band5GHz_bonus; /* 5GHz RSSI score bonus (applied to all 5GHz networks) */
 } enlo_candidate_score_params;
 
+typedef struct connected_nlo_bss_band_rssi_pref_t {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_connected_nlo_bss_band_rssi_pref */
+    /** band which needs to get preference over other band - see wmi_set_vdev_ie_band enum */
+    A_UINT32 band;
+    /* Amount of RSSI preference (in dB) that can be given to a band */
+    A_INT32  rssi_pref;
+} connected_nlo_bss_band_rssi_pref;
+
+typedef struct connected_nlo_rssi_params_t {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_connected_nlo_rssi_params */
+    /* Relative rssi threshold (in dB) by which new BSS should have better rssi than
+     * the current connected BSS.
+     */
+    A_INT32  relative_rssi;
+    /* The amount of rssi preference (in dB) that can be given to a 5G BSS over 2.4G BSS. */
+    A_INT32  relative_rssi_5g_pref;
+} connected_nlo_rssi_params;
+
 typedef struct wmi_nlo_config {
     A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_nlo_config_cmd_fixed_param */
     A_UINT32    flags;
@@ -9784,11 +12377,25 @@ typedef struct wmi_nlo_config {
     A_UINT32    no_of_ssids;
     A_UINT32    num_of_channels;
     A_UINT32    delay_start_time; /* NLO scan start delay time in milliseconds */
+    /** MAC Address to use in Probe Req as SA **/
+    wmi_mac_addr mac_addr;
+    /** Mask on which MAC has to be randomized **/
+    wmi_mac_addr mac_mask;
+    /** IE bitmap to use in Probe Req **/
+    A_UINT32 ie_bitmap[WMI_IE_BITMAP_SIZE];
+    /** Number of vendor OUIs. In the TLV vendor_oui[] **/
+    A_UINT32 num_vendor_oui;
+    /** Number of connected NLO band preferences **/
+    A_UINT32 num_cnlo_band_pref;
+
     /* The TLVs will follow.
         * nlo_configured_parameters nlo_list[];
-        * A_UINT32 channel_list[];
+        * A_UINT32 channel_list[num_of_channels];
         * nlo_channel_prediction_cfg ch_prediction_cfg;
         * enlo_candidate_score_params candidate_score_params;
+        * wmi_vendor_oui vendor_oui[num_vendor_oui];
+        * connected_nlo_rssi_params cnlo_rssi_params;
+        * connected_nlo_bss_band_rssi_pref cnlo_bss_band_rssi_pref[num_cnlo_band_pref];
         */
 
 } wmi_nlo_config_cmd_fixed_param;
@@ -10014,6 +12621,16 @@ typedef struct {
 }WMI_GTK_OFFLOAD_CMD_fixed_param;
 
 typedef struct {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_gtk_offload_extended_tlv_param */
+    A_UINT32 vdev_id; /** unique id identifying the VDEV */
+    A_UINT32 flags; /* control flags, GTK offload command use high byte  */
+    A_UINT32 kek_len;
+    A_UINT8  KEK[GTK_OFFLOAD_KEK_EXTENDED_BYTES]; /* key encryption key */
+    A_UINT8  KCK[GTK_OFFLOAD_KCK_BYTES]; /* key confirmation key */
+    A_UINT8  replay_counter[GTK_REPLAY_COUNTER_BYTES]; /* replay counter for re-key */
+} wmi_gtk_offload_fils_tlv_param;
+
+typedef struct {
     A_UINT32 tlv_header;  /** TLV tag and len; tag equals WMITLV_TAG_STRUC_WMI_PMF_OFFLOAD_SET_SA_QUERY_CMD_fixed_param */
     A_UINT32 vdev_id;
     A_UINT32 sa_query_retry_interval;  /* in msec */
@@ -10072,6 +12689,54 @@ typedef struct {
     A_UINT32 keepaliveMethod;   /* seconds */
 } wmi_vdev_get_keepalive_event_fixed_param;
 
+typedef enum {
+    WMI_CLEAR_ARP_STATS_COLLECTED = 0x0,
+    WMI_START_ARP_STATS_COLLECTION,
+} WMI_ARP_STATS_ACTION;
+
+typedef enum {
+    WMI_ARP_STATS_RX_PKT_TYPE_ARP = 0x1,
+} WMI_ARP_STATS_RX_PKT_TYPE;
+
+typedef enum {
+    WMI_BA_SESSION_ESTABLISHMENT_STATUS_SUCCESS = 0x0,
+    WMI_BA_SESSION_ESTABLISHMENT_STATUS_FAILURE,
+} WMI_ARP_STATS_BA_SESSION_ESTABLISH_STATUS;
+
+typedef enum {
+    WMI_CONNECTION_STATUS_FAILURE = 0x0,
+    WMI_CONNECTION_STATUS_SUCCESS,
+} WMI_ARP_STATS_CONNECTION_STATUS;
+
+/* ARP stats set (configure) req */
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_set_arp_stats_cmd_fixed_param */
+    A_UINT32 vdev_id;
+    A_UINT32 set_clr;  /* WMI_ARP_STATS_ACTION */
+    A_UINT32 pkt_type; /* WMI_ARP_STATS_RX_PKT_TYPE */
+    A_UINT32 ipv4;     /* target will maintain ARP stats (only) for frames containing this IP address */
+} wmi_vdev_set_arp_stats_cmd_fixed_param;
+
+/* ARP stats get req */
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_get_arp_stats_cmd_fixed_param */
+    A_UINT32 vdev_id;
+} wmi_vdev_get_arp_stats_cmd_fixed_param;
+
+/* per vdev based ARP stats */
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_get_arp_stats_event_fixed_param */
+    A_UINT32 vdev_id;
+    A_UINT32 arp_req_enqueue;
+    A_UINT32 arp_req_tx_success;
+    A_UINT32 arp_req_tx_failure; /* number of times a tx MPDU containing a unicast ARP request went unacked */
+    A_UINT32 arp_rsp_recvd;
+    A_UINT32 out_of_order_arp_rsp_drop_cnt;
+    A_UINT32 dad_detected; /* duplicate address detection */
+    A_UINT32 connect_status; /* WMI_ARP_STATS_CONNECTION_STATUS */
+    A_UINT32 ba_session_establishment_status; /* WMI_ARP_STATS_BA_SESSION_ESTABLISH_STATUS */
+} wmi_vdev_get_arp_stats_event_fixed_param;
+
 #define IPSEC_NATKEEPALIVE_FILTER_DISABLE 0
 #define IPSEC_NATKEEPALIVE_FILTER_ENABLE  1
 
@@ -10090,6 +12755,108 @@ typedef struct {
     wmi_mac_addr mcc_bssid;
 } wmi_vdev_mcc_set_tbtt_mode_cmd_fixed_param;
 
+#define WMI_MAX_VENDOR_OUI_ACTION_SUPPORTED_PER_ACTION 10
+#define WMI_MAX_VENDOR_OUI_DATA_LENGTH                 20
+
+typedef enum
+{
+    WMI_VENDOR_OUI_ACTION_CONNECTION_1X1 = 0, /* Connect in 1X1 only */
+    WMI_VENDOR_OUI_ACTION_ITO_EXTENSION = 1,  /* Extend the Immediate Time-Out (ITO) if data is not received from AP after beacon with TIM bit set */
+    WMI_VENDOR_OUI_ACTION_CCKM_1X1 = 2,       /* TX (only) CCKM rates with 1 chain only */
+    /* Add any action before this line */
+    WMI_VENDOR_OUI_ACTION_MAX_ACTION_ID
+} wmi_vendor_oui_action_id;
+
+typedef struct {
+    A_UINT32 tlv_header;
+    /** vendor OUI actions */
+    A_UINT32 action_id;  /* enum wmi_vendor_oui_action_id */
+    A_UINT32 total_num_vendor_oui; /* total number of OUI present in ini for all actions.
+                                   ** For first command, this value will be used for allocating memory in FW accordingly */
+    A_UINT32 num_vendor_oui_ext; /* the number of wmi_vendor_oui_ext for action_id */
+    /* followed by TLVs, an array of structure of type wmi_vendor_oui_ext
+    ** wmi_vendor_oui_ext vendor_oui_ext[num_vendor_oui_ext];
+    */
+    /* followed by A_UINT8 data[] of concatenated data for each vendor_oui_ext[] element
+    ** first byte contains the index i of structure vendor_oui_ext[]
+    ** for which data is coming and length of the data is extracted as
+    ** wmi_vendor_oui_ext[i].buf_data_length. No padding between data of
+    ** N th OUI and (N+1) th OUI.
+    ** For example, if vendor_oui_ext[0].buf_data_length is 18, then
+    ** data[0] will hold the index value 0, data[1] through data[17]
+    ** will hold the OUI data for this first OUI, data[18] will hold
+    ** the index value 1, and the OUI data for the second OUI will
+    ** begin at data[19].
+    */
+} wmi_pdev_config_vendor_oui_action_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+    /** AC number */
+    A_UINT32 ac; /* refer to wmi_traffic_ac */
+    /**
+     * Enable/disable tx queue optimizations (such as dropping stale tx frms)
+     * for the specified AC.
+     */
+    A_UINT32 ac_tx_queue_optimize_enable;
+} wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_rx_filter_promiscuous_cmd_fixed_param */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+    /** Enable/disable rx filter promiscuous */
+    A_UINT32 rx_filter_promiscuous_enable;
+} wmi_pdev_set_rx_filter_promiscuous_cmd_fixed_param;
+
+typedef enum {
+    WMI_BEACON_INFO_PRESENCE_OUI_EXT            = 1 <<  0,
+    WMI_BEACON_INFO_PRESENCE_MAC_ADDRESS        = 1 <<  1,
+    WMI_BEACON_INFO_PRESENCE_AP_CAPABILITY_NSS  = 1 <<  2,
+    WMI_BEACON_INFO_PRESENCE_AP_CAPABILITY_HT   = 1 <<  3,
+    WMI_BEACON_INFO_PRESENCE_AP_CAPABILITY_VHT  = 1 <<  4,
+    WMI_BEACON_INFO_PRESENCE_AP_CAPABILITY_BAND = 1 <<  5,
+} wmi_beacon_info_presence_items;
+
+typedef struct _wmi_vendor_oui_ext {
+    A_UINT32 tlv_header;
+    A_UINT32 buf_data_length;        /* length of data in bytes for this OUI including index byte */
+    A_UINT32 info_presence_bit_mask; /* see enum wmi_beacon_info_presence_items */
+    A_UINT32 oui_header_length;      /* either 3 or 5 bytes */
+    A_UINT32 oui_data_length;        /* length of oui_data to compare in beacon which follows OUI header. Max length is capped to WMI_MAX_VENDOR_OUI_DATA_LENGTH bytes */
+    A_UINT32 mac_address_length;     /* MAC address length in bytes
+                                     ** (This value will always be 6,
+                                     ** but is explicitly specified for sake
+                                     ** of uniformity and completeness).
+                                     */
+    A_UINT32 capability_data_length; /* length of capability in bytes */
+} wmi_vendor_oui_ext;
+
+#define WMI_INFO_CAPABILITY_NSS_MASK                       0x0f
+#define WMI_INFO_CAPABILITY_NSS_OFFSET                     0
+#define WMI_INFO_CAPABILITY_HT_ENABLE_MASK                 0x10
+#define WMI_INFO_CAPABILITY_HT_ENABLE_OFFSET               4
+#define WMI_INFO_CAPABILITY_VHT_ENABLE_MASK                0x20
+#define WMI_INFO_CAPABILITY_VHT_ENABLE_OFFSET              5
+#define WMI_INFO_CAPABILITY_BAND_MASK                      0xc0
+#define WMI_INFO_CAPABILITY_BAND_OFFSET                    6
+
+/* definition of WMI_INFO_CAPABILITY_NSS_MASK */
+#define WMI_INFO_CAPABILITY_NSS_1X1                        1
+#define WMI_INFO_CAPABILITY_NSS_2X2                        2
+#define WMI_INFO_CAPABILITY_NSS_3X3                        3
+#define WMI_INFO_CAPABILITY_NSS_4X4                        4
+
+/* definition of WMI_INFO_CAPABILITY_BAND_MASK */
+#define WMI_INFO_CAPABILITY_2G_BAND_MASK                   (1 << 0)
+#define WMI_INFO_CAPABILITY_5G_BAND_MASK                   (1 << 1)
+
 typedef struct {
     A_UINT32 tlv_header;
     A_UINT32 vdev_id;        /* home vdev id */
@@ -10134,8 +12901,10 @@ typedef struct {
     A_UINT32 module_id;
     /* Num of test arguments passed */
     A_UINT32 num_args;
+    /* unique id identifying the unit test cmd, generated by the caller */
+    A_UINT32 diag_token;
 /**
- * TLV (tag length value ) parameters follow the wmi_roam_chan_list
+ * TLV (tag length value ) parameters follow the wmi_unit_test_cmd_fixed_param
  * structure. The TLV's are:
  *   A_UINT32 args[];
  **/
@@ -10355,6 +13124,21 @@ typedef struct {
     A_UINT32 vdev_id;
 } wmi_gtk_rekey_fail_event_fixed_param;
 
+typedef enum WLAN_COEX_EVENT {
+    WLAN_COEX_EVENT_BT_NONE                     = 0,
+    WLAN_COEX_EVENT_BT_A2DP_PROFILE_ADD         = 1,
+    WLAN_COEX_EVENT_BT_A2DP_PROFILE_REMOVE      = 2,
+    WLAN_COEX_EVENT_BT_VOICE_PROFILE_ADD        = 3,
+    WLAN_COEX_EVENT_BT_VOICE_PROFILE_REMOVE     = 4,
+    WLAN_COEX_EVENT_BT_SCAN_START               = 5,
+    WLAN_COEX_EVENT_BT_SCAN_STOP                = 6,
+}WLAN_COEX_EVENT;
+
+typedef struct {
+    A_UINT32 tlv_header;
+    A_UINT32 coex_profile_evt; //uses the enum values form WLAN_COEX_EVENT
+} wmi_coex_bt_activity_event_fixed_param;
+
 enum wmm_ac_downgrade_policy {
     WMM_AC_DOWNGRADE_DEPRIO,
     WMM_AC_DOWNGRADE_DROP,
@@ -10371,7 +13155,10 @@ typedef struct {
     A_UINT32 cwmin;
     A_UINT32 cwmax;
     A_UINT32 aifs;
-    A_UINT32 txoplimit;
+    union {
+        A_UINT32 txoplimit;
+        A_UINT32 mu_edca_timer;
+    };
     A_UINT32 acm;
     A_UINT32 no_ack;
 } wmi_wmm_vparams;
@@ -10450,6 +13237,76 @@ typedef struct {
     A_UINT32 pdev_id;
 } wmi_dfs_phyerr_filter_dis_cmd_fixed_param;
 
+typedef struct {
+    A_UINT32 tlv_header;
+    A_UINT32 pdev_id;
+} wmi_pdev_dfs_phyerr_offload_enable_cmd_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header;
+    A_UINT32 pdev_id;
+} wmi_pdev_dfs_phyerr_offload_disable_cmd_fixed_param;
+
+typedef enum {
+    QUICK_OCAC = 0,
+    EXTENSIVE_OCAC,
+} WMI_ADFS_OCAC_MODE;
+
+typedef struct {
+    A_UINT32  tlv_header;
+    A_UINT32  vdev_id;
+    A_UINT32  ocac_mode;  /* WMI_ADFS_OCAC_MODE */
+    A_UINT32  min_duration_ms; /* in milliseconds */
+    A_UINT32  max_duration_ms; /* in milliseconds */
+    A_UINT32  chan_freq;   /* in MHz */
+    A_UINT32  chan_width;  /* in MHz */
+    A_UINT32  center_freq; /* in MHz */
+} wmi_vdev_adfs_ch_cfg_cmd_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header;
+    A_UINT32 vdev_id;
+} wmi_vdev_adfs_ocac_abort_cmd_fixed_param;
+
+typedef enum {
+    IN_SERVICE_MODE = 0,
+    OCAC_MODE,
+} WMI_DFS_RADAR_DETECTION_MODE;
+
+typedef struct {
+    A_UINT32 tlv_header;
+    A_UINT32 pdev_id;
+    /* In-service mode or O-CAC mode */
+    A_UINT32 detection_mode; /* WMI_DFS_RADAR_DETECTION_MODE */
+    A_UINT32 chan_freq;  /* in MHz */
+    A_UINT32 chan_width; /* in MHz */
+    A_UINT32 detector_id;
+    A_UINT32 segment_id;
+    A_UINT32 timestamp;
+    A_UINT32 is_chirp;
+    A_INT32  freq_offset; /* in MHz */
+    A_INT32  sidx; /* segment index (where was the radar within the channel) */
+} wmi_pdev_dfs_radar_detection_event_fixed_param;
+
+typedef enum {
+    OCAC_COMPLETE = 0,
+    OCAC_ABORT,
+} WMI_VDEV_OCAC_COMPLETE_STATUS;
+
+typedef struct {
+    A_UINT32 tlv_header;
+    A_UINT32 vdev_id;
+    A_UINT32 chan_freq;   /* in MHz */
+    A_UINT32 chan_width;  /* in MHz */
+    A_UINT32 center_freq; /* in MHz */
+    A_UINT32 status;   /* WMI_VDEV_OCAC_COMPLETE_STATUS */
+} wmi_vdev_adfs_ocac_complete_event_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header;
+    A_UINT32 vdev_id;
+} wmi_vdev_dfs_cac_complete_event_fixed_param;
+
 /** TDLS COMMANDS */
 
 /* WMI_TDLS_SET_STATE_CMDID */
@@ -10865,27 +13722,27 @@ typedef struct {
 typedef struct {
     /** TLV tag and len; tag equals
      *  WMITLV_TAG_STRUC_wmi_hb_set_enable_cmd_fixed_param */
-    A_UINT32 tlv_header;
-    A_UINT32 vdev_id;
-    A_UINT32 enable;
-    A_UINT32 item;
-    A_UINT32 session;
+    A_UINT32 tlv_header;     /** TLV header*/
+    A_UINT32 vdev_id;        /** Vdev ID */
+    A_UINT32 enable;         /** 1: Enable, 0: Disable`*/
+    A_UINT32 item;           /** 1: UDP, 2: TCP */
+    A_UINT32 session;        /** Session ID from HOST */
 } wmi_hb_set_enable_cmd_fixed_param;
 
 typedef struct {
     /** TLV tag and len; tag equals
      *  WMITLV_TAG_STRUC_wmi_hb_set_tcp_params_cmd_fixed_param */
-    A_UINT32 tlv_header;
-    A_UINT32 vdev_id;
-    A_UINT32 srv_ip;
-    A_UINT32 dev_ip;
-    A_UINT32 seq;
-    A_UINT32 src_port;
-    A_UINT32 dst_port;
-    A_UINT32 interval;
-    A_UINT32 timeout;
-    A_UINT32 session;
-wmi_mac_addr gateway_mac;
+    A_UINT32 tlv_header;      /** TLV header*/
+    A_UINT32 vdev_id;         /** Vdev ID */
+    A_UINT32 srv_ip;          /** Server IP address (IPv4) */
+    A_UINT32 dev_ip;          /** Device IP address (IPv4) */
+    A_UINT32 seq;             /** TCP Sequence no */
+    A_UINT32 src_port;        /** Source port */
+    A_UINT32 dst_port;        /** Destination port */
+    A_UINT32 interval;        /** Keep alive interval */
+    A_UINT32 timeout;         /** Timeout if keep alive fails */
+    A_UINT32 session;         /** Session ID from HOST */
+    wmi_mac_addr gateway_mac; /** Server Mac Address */
 } wmi_hb_set_tcp_params_cmd_fixed_param;
 
 typedef struct {
@@ -10933,12 +13790,139 @@ typedef enum {
 } WMI_HB_WAKEUP_REASON;
 
 typedef struct {
-    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_hb_ind_event_fixed_param */
-    A_UINT32 vdev_id;    /* unique id identifying the VDEV */
-    A_UINT32 session;    /* Session ID from driver */
-    A_UINT32 reason;     /* wakeup reason */
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_hb_ind_event_fixed_param */
+    A_UINT32 vdev_id;    /** unique id identifying the VDEV */
+    A_UINT32 session;    /** Session ID from HOST */
+    A_UINT32 reason;     /** wakeup reason */
 } wmi_hb_ind_event_fixed_param;
 
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_oic_set_enable_cmd_fixed_param */
+    A_UINT32 tlv_header;           /** TLV Header */
+    A_UINT32 vdev_id;              /** Vdev ID */
+    A_UINT32 session;              /** Session number from the HOST */
+    A_UINT32 srv_ip;               /** IPv4 address of the OCF server */
+    A_UINT32 dev_ip;               /** IPv4 address of the device */
+    A_UINT32 tcp_tx_seq;           /** TCP sequence number */
+    A_UINT32 src_port;             /** Source port */
+    A_UINT32 dst_port;             /** Destination port */
+    A_UINT32 protocol;             /** Protocol used: TCP:0, UDP:1 */
+    A_UINT32 wlan_hb_session;      /** Linked WLAN HB session. If a keepalive is configured for the TCP session, the session ID of the TCP keepalive */
+    A_UINT32 timeout_retries;      /** timeout[31:16]: TCP ACK timeout, time to wait for a TCP ACK in ms
+                                       retries[15:0]: Number of TCP level retries of OIC ping request */
+    wmi_mac_addr peer_macaddr;     /** MAC address of the OCF server */
+    A_UINT32 oic_ping_pkt0;        /** OIC ping packet content [Byte03:Byte00] */
+    A_UINT32 oic_ping_pkt1;        /** OIC ping packet content [Byte07:Byte04] */
+    A_UINT32 oic_ping_pkt2;        /** OIC ping packet content [Byte11:Byte08] */
+    A_UINT32 oic_ping_pkt3;        /** OIC ping packet content [Byte15:Byte12] */
+
+    A_UINT32 tls_cipher_suite_version; /** Cipher suite [31:16] as defined in https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
+                                       TLS version  [15:00] */
+    A_UINT32 tls_tx_seq0;          /** Tx sequence number [31:00], incremented after every TLS packet transmission */
+    A_UINT32 tls_tx_seq1;          /** Tx sequence number [63:32] */
+    A_UINT32 tls_rx_seq0;          /** Rx sequence number [31:00], incremented after every TLS packet reception */
+    A_UINT32 tls_rx_seq1;          /** Rx sequence number [63:32] */
+    A_UINT32 tls_tx_key0;          /** client_write_key[Byte03:Byte00] refer Section 6.3 RFC 5246 */
+    A_UINT32 tls_tx_key1;          /** client_write_key[Byte07:Byte04] */
+    A_UINT32 tls_tx_key2;          /** client_write_key[Byte11:Byte08] */
+    A_UINT32 tls_tx_key3;          /** client_write_key[Byte15:Byte12] */
+    A_UINT32 tls_rx_key0;          /** server_write_key[Byte03:Byte00] */
+    A_UINT32 tls_rx_key1;          /** server_write_key[Byte07:Byte04] */
+    A_UINT32 tls_rx_key2;          /** server_write_key[Byte11:Byte08] */
+    A_UINT32 tls_rx_key3;          /** server_write_key[Byte15:Byte12] */
+    A_UINT32 tls_MAC_write_key0;   /** client_write_MAC_key[Byte03:Byte00] refer Section 6.3 RFC 5246 */
+    A_UINT32 tls_MAC_write_key1;   /** client_write_MAC_key[Byte07:Byte04] */
+    A_UINT32 tls_MAC_write_key2;   /** client_write_MAC_key[Byte11:Byte08] */
+    A_UINT32 tls_MAC_write_key3;   /** client_write_MAC_key[Byte15:Byte12] */
+    A_UINT32 tls_MAC_write_key4;   /** client_write_MAC_key[Byte19:Byte16] */
+    A_UINT32 tls_MAC_write_key5;   /** client_write_MAC_key[Byte23:Byte20] */
+    A_UINT32 tls_MAC_write_key6;   /** client_write_MAC_key[Byte27:Byte24] */
+    A_UINT32 tls_MAC_write_key7;   /** client_write_MAC_key[Byte31:Byte28] */
+    A_UINT32 tls_MAC_read_key0;    /** server_write_MAC_key[Byte03:Byte00] refer Section 6.3 RFC 5246 */
+    A_UINT32 tls_MAC_read_key1;    /** server_write_MAC_key[Byte07:Byte04] */
+    A_UINT32 tls_MAC_read_key2;    /** server_write_MAC_key[Byte11:Byte08] */
+    A_UINT32 tls_MAC_read_key3;    /** server_write_MAC_key[Byte15:Byte12] */
+    A_UINT32 tls_MAC_read_key4;    /** server_write_MAC_key[Byte19:Byte16] */
+    A_UINT32 tls_MAC_read_key5;    /** server_write_MAC_key[Byte23:Byte20] */
+    A_UINT32 tls_MAC_read_key6;    /** server_write_MAC_key[Byte27:Byte24] */
+    A_UINT32 tls_MAC_read_key7;    /** server_write_MAC_key[Byte31:Byte28] */
+    A_UINT32 tls_client_IV0;       /** CBC Mode: CBC_residue [Byte03:Byte00] refer section 6.2.3.2. CBC Block Cipher in RFC 5246
+                                   GCM Mode: GCMNonce.salt [Byte03:Byte00] refer Section 3 of RFC 5288 */
+    A_UINT32 tls_client_IV1;       /** CBC Mode: CBC_residue [Byte7:Byte4] */
+    A_UINT32 tls_client_IV2;       /** CBC Mode: CBC_residue [Byte11:Byte8] */
+    A_UINT32 tls_client_IV3;       /** CBC Mode: CBC_residue [Byte15:Byte12] */
+    A_UINT32 tls_server_IV0;       /** CBC Mode: CBC_residue [Byte3:Byte0] refer section 6.2.3.2. CBC Block Cipher in RFC 5246
+                                   GCM Mode: GCMNonce.salt [Byte4: Byte0] refer Section 3 of RFC 5288 */
+    A_UINT32 tls_server_IV1;       /** CBC Mode: CBC_residue [Byte7:Byte4] */
+    A_UINT32 tls_server_IV2;       /** CBC Mode: CBC_residue [Byte11:Byte8] */
+    A_UINT32 tls_server_IV3;       /** CBC Mode: CBC_residue [Byte15:Byte12] */
+} wmi_oic_ping_offload_params_cmd_fixed_param;
+
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_oic_set_enable_cmd_fixed_param */
+    A_UINT32 tlv_header; /** TLV Header*/
+    A_UINT32 vdev_id;    /** Interface number */
+    A_UINT32 session;    /** Session ID*/
+    A_UINT32 enable;     /** 1: Enable , 0: Disable */
+} wmi_oic_ping_offload_set_enable_cmd_fixed_param;
+
+/** wlan OIC events */
+typedef enum {
+    WMI_WLAN_OIC_REASON_UNKNOWN      = 0, /** Unknown */
+    WMI_WLAN_OIC_REASON_HOST_WAKE    = 1, /** No error , but host is woken up due to other reasons */
+    WMI_WLAN_OIC_REASON_TCP_TIMEOUT  = 2, /** TCP Timeout */
+    WMI_WLAN_OIC_REASON_PING_TIMEOUT = 3, /** OIC Ping resposnse timeout */
+    WMI_WLAN_OIC_REASON_TLS_ERROR    = 4, /** TLS decryption error */
+} WMI_OIC_WAKEUP_REASON;
+
+typedef struct {
+    A_UINT32 tlv_header;           /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_oic_ind_event_fixed_param */
+    A_UINT32 vdev_id;              /** unique id identifying the VDEV */
+    A_UINT32 session;              /** Session ID from driver */
+    A_UINT32 reason;               /** wakeup reason as per WMI_OIC_WAKEUP_REASON */
+    A_UINT32 tcp_tx_seq;           /** Current TCP sequence number */
+    A_UINT32 tcp_ack_num;          /** Current TCP Acknowledgement number */
+    A_UINT32 tls_tx_seq0;          /** Tx sequence number [31:00], incremented after every TLS packet transmission */
+    A_UINT32 tls_tx_seq1;          /** Tx sequence number [63:32] */
+    A_UINT32 tls_rx_seq0;          /** Rx sequence number [31:00], incremented after every TLS packet reception */
+    A_UINT32 tls_rx_seq1;          /** Rx sequence number [63:32] */
+    A_UINT32 tls_client_IV0;       /** CBC Mode: CBC_residue [Byte03:Byte00] refer section 6.2.3.2. CBC Block Cipher in RFC 5246 */
+    A_UINT32 tls_client_IV1;       /** CBC Mode: CBC_residue [Byte7:Byte4] */
+    A_UINT32 tls_client_IV2;       /** CBC Mode: CBC_residue [Byte11:Byte8] */
+    A_UINT32 tls_client_IV3;       /** CBC Mode: CBC_residue [Byte15:Byte12] */
+    A_UINT32 tls_server_IV0;       /** CBC Mode: CBC_residue [Byte3:Byte0] refer section 6.2.3.2. CBC Block Cipher in RFC 5246 */
+    A_UINT32 tls_server_IV1;       /** CBC Mode: CBC_residue [Byte7:Byte4] */
+    A_UINT32 tls_server_IV2;       /** CBC Mode: CBC_residue [Byte11:Byte8] */
+    A_UINT32 tls_server_IV3;       /** CBC Mode: CBC_residue [Byte15:Byte12] */
+} wmi_oic_ping_handoff_event;
+
+typedef struct {
+   /** TLV tag and len; tag equals
+    * WMITLV_TAG_STRUC_wmi_dhcp_lease_renew_offload_fixed_param */
+    A_UINT32 tlv_header;     /** TLV Header*/
+    A_UINT32 vdev_id;        /** Vdev ID */
+    A_UINT32 enable;         /** 1: Enable 0: Disable*/
+    A_UINT32 srv_ip;         /** DHCP Server IP address (IPv4) */
+    A_UINT32 client_ip;      /** Device IP address (IPv4) */
+    wmi_mac_addr srv_mac;    /** DHCP Server MAC address */
+    A_UINT32 parameter_list; /** Optional Parameter list. RFC 1533 gives the complete set of options defined for use with DHCP */
+} wmi_dhcp_lease_renew_offload_cmd_fixed_param;
+
+/** WLAN DHCP Lease Renew Events */
+typedef enum {
+    WMI_WLAN_DHCP_RENEW_REASON_UNKNOWN  = 0, /** Unknown */
+    WMI_WLAN_DHCP_RENEW_REASON_ACK_TIMEOUT  = 1, /** DHCP ACK Timeout */
+    WMI_WLAN_DHCP_RENEW_REASON_NACK     = 2, /** DHCP error */
+} WMI_DHCP_RENEW_WAKEUP_REASON;
+
+typedef struct {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_dhcp_renew_ind_event_fixed_param */
+    A_UINT32 vdev_id;    /** unique id identifying the VDEV */
+    A_UINT32 reason;     /** wakeup reason as per enum WMI_DHCP_RENEW_WAKEUP_REASON*/
+} wmi_dhcp_lease_renew_event;
+
 /** WMI_STA_SMPS_PARAM_CMDID */
 typedef enum {
     /** RSSI threshold to enter Dynamic SMPS mode from inactive mode */
@@ -11080,6 +14064,11 @@ typedef struct
 #define LPI_IE_BITMAP_FLAGS                  0x00200000     // reserved as a bitmap to indicate more scan information; one such use being to indicate if the on-going scan is interrupted or not
 #define LPI_IE_BITMAP_CACHING_REQD           0x00400000     // extscan will use this field to indicate if this frame info needs to be cached in LOWI LP or not
 #define LPI_IE_BITMAP_REPORT_CONTEXT_HUB     0x00800000     // extscan will use this field to indicate to LOWI LP whether to report result to context hub or not.
+#define LPI_IE_BITMAP_CHRE_ESS               0x010000000    /* ESS capability info for CHRE */
+#define LPI_IE_BITMAP_CHRE_SEC_MODE          0x020000000    /* Security capability info for CHRE */
+#define LPI_IE_BITMAP_CHRE_SUPPORTED_RATE    0x040000000    /* Hightest MCS corresponding NCC for TX and RX */
+/* send country string inside Country IE to LOWI LP */
+#define LPI_IE_BITMAP_COUNTRY_STRING         0x080000000
 #define LPI_IE_BITMAP_ALL                    0xFFFFFFFF
 
 typedef struct {
@@ -11444,6 +14433,91 @@ typedef struct {
     A_INT32 chain_rssi[8];
 } wmi_peer_antdiv_info;
 
+typedef struct {
+    A_UINT32    tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_msduq_qdepth_thresh_update */
+
+    /** tid_number */
+    A_UINT32 tid_num;
+
+    /** msduq_mask to set the value
+     * bit 0 - HI-PRI msdu flowq qdepth threshold need to update if set
+     * bit 1 - LOW-PRI msdu flowq qdepth threshold need to update if set
+     * bit 2 - UDP msdu flowq qdepth threshold need to update if set
+     * bit 3 - NON-UDP msdu flowq qdepth threshold need to update if set
+     * rest of bits are reserved and set to 0.
+     */
+    A_UINT32 msduq_update_mask;
+
+    /** Qdepth threshold value
+     * If number of msdus in a queue excess over qdepth_thresh_value value
+     * while queuing msdu's then we drop new msdus.
+     * (Though dropping older (stale) data rather than newer data might be
+     * preferable, the dropping is performed by MAC HW, and there’s no option
+     * to configure the HW to do head dropping rather than tail dropping.)
+     */
+    A_UINT32 qdepth_thresh_value;
+} wmi_msduq_qdepth_thresh_update;
+
+/** WMI_PEER_TID_MSDUQ_QDEPTH_THRESH_UPDATE_CMDID
+ *   Request FW to update msduq qdepth threshold per TID per peer */
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_peer_tid_msduq_qdepth_thresh_update_cmd_fixed_param
+     */
+    A_UINT32 tlv_header;
+
+    /** pdev id
+     * The pdev_id can be determined from the vdev_id, but the pdev_id
+     * is explicitly provided so it can be used for sanity checking.
+     */
+    A_UINT32 pdev_id;
+
+    /** vdev id */
+    A_UINT32 vdev_id;
+
+    /**
+     * To set the peer msduq qdepth threshold update for a single peer,
+     * the host shall send mac address for which peer need to be updated.
+     */
+    wmi_mac_addr peer_mac_address;
+
+    /** number of payload update tlvs */
+    A_UINT32 num_of_msduq_updates;
+
+    /** Followed by the variable length TLV msduq_qdepth_updates:
+     *  wmi_msduq_qdepth_th_update msduq_qdepth_thshd_update_list[]
+     */
+} wmi_peer_tid_msduq_qdepth_thresh_update_cmd_fixed_param;
+
+typedef enum {
+    WMI_PEER_IND_SMPS = 0x0, /* spatial multiplexing power save */
+    WMI_PEER_IND_OMN,        /* operating mode notification */
+    WMI_PEER_IND_OMI,        /* operating mode indication */
+} WMI_PEER_OPER_MODE_IND;
+
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_peer_oper_mode_change */
+    A_UINT32 tlv_header;
+    /** mac addr of the peer */
+    wmi_mac_addr peer_mac_address;
+    /** Peer type indication WMI_PEER_OPER_MODE_IND. */
+    A_UINT32 ind_type;
+    /** new_rxnss valid for all peer_operating mode ind. */
+    A_UINT32 new_rxnss;
+    /** new_bw  valid for peer_operating mode ind. OMN/OMI
+     *  value of this bw is as per 11ax/ac standard:
+     *  0 = 20MHz,1 = 40MHz, 2= 80MHz, 3 = 160MHz
+     */
+    A_UINT32 new_bw;
+    /** new_txnss valid for peer_operating mode ind. OMI */
+    A_UINT32 new_txnss;
+    /** new_disablemu: disable mu mode
+     *  valid for peer_operating mode ind. OMI
+     */
+    A_UINT32 new_disablemu;
+} wmi_peer_oper_mode_change_event_fixed_param;
+
 /** FW response when tx failure count has reached threshold
  *  for a peer */
 typedef struct {
@@ -11635,6 +14709,34 @@ typedef struct {
 
 } wmi_dfs_radar_event_fixed_param;
 
+enum {
+    /* DEFAULT - target chooses what action to take, based on its thermal
+     * management policy
+     * Targets which throttle tx (and potentially rx) based on thermal
+     * management thresholds specified by the host will shut down tx
+     * if the temperature exceeds upper_thresh_degreeC.
+     * Targets which simply inform the host about threshold breaches will
+     * send a notification message to the host if the temperature exceeds
+     * upper_thresh_degreeC.
+     * Conversely, if the temperature was above upper_thresh_degreeC but
+     * then drops to below lower_threshold_degreeC, the target will either
+     * resume tx, or notify the host.
+     */
+    WMI_THERMAL_MGMT_ACTION_DEFAULT = 0,
+    /* HALT_TRAFFIC -
+     * If the temperature rises above upper_thresh_degreeC, the target will
+     * halt tx.
+     * If the temperature falls back below lower_thresh_degreeC, the target
+     * will resume tx.
+     */
+    WMI_THERMAL_MGMT_ACTION_HALT_TRAFFIC = 1,
+    /* NOTIFY_HOST - the target will notify the host if the temperature
+     * either rises above upper_thresh_degreeC or falls below
+     * lower_thresh_degreeC.
+     */
+    WMI_THERMAL_MGMT_ACTION_NOTIFY_HOST = 2,
+};
+
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_thermal_mgmt_cmd_fixed_param  */
 
@@ -11644,6 +14746,14 @@ typedef struct {
 
     /*Enable/Disable Thermal Monitoring for Mitigation*/
     A_UINT32 enable;
+
+    /* action: what the target should do when a thermal upper/lower threshold
+     * is crossed.
+     * Refer to the WMI_THERMAL_MGMT_ACTION enum.
+     */
+    A_UINT32 action;
+    A_UINT32 threshold_warning_degreeC;
+    A_UINT32 sample_rate_ms;
 } wmi_thermal_mgmt_cmd_fixed_param;
 
 typedef struct {
@@ -11853,6 +14963,109 @@ typedef struct{
 } wmi_tpc_chainmask_config_cmd_fixed_param;
 
 typedef struct {
+    A_UINT32 tlv_header;        /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_oem_dma_ring_cfg_req_fixed_param */
+    A_UINT32 pdev_id;
+    /**
+     * Bits 31:0:   base address of ring [31:0]
+     */
+    A_UINT32 base_addr_lo;
+    /**
+     * Bits 3:0:    base address of ring [35:32]
+     * Bits 31:4:   reserved
+     */
+    A_UINT32 base_addr_hi;
+    /**
+     * Bits 31:0:   address of head index [31:0]
+     */
+    A_UINT32 head_idx_addr_lo;
+    /**
+     * Bits 3:0:    address of head index [35:32]
+     * Bits 31:4:   reserved
+     */
+    A_UINT32 head_idx_addr_hi;
+    /**
+     * Bits 31:0:   address of tail index [31:0]
+     */
+    A_UINT32 tail_idx_addr_lo;
+    /**
+     * Bits 3:0:    address of tail index [35:32]
+     * Bits 31:4:   reserved
+     */
+    A_UINT32 tail_idx_addr_hi;
+    A_UINT32 num_ptr;           /** Number of pointers in the ring */
+} wmi_oem_dma_ring_cfg_req_fixed_param;
+
+#define WMI_OEM_DMA_RING_ADDR_LO_S 0
+#define WMI_OEM_DMA_RING_ADDR_LO 0xffffffff
+
+#define WMI_OEM_DMA_RING_ADDR_LO_GET(dword) WMI_F_MS(dword, WMI_OEM_DMA_RING_ADDR_LO)
+#define WMI_OEM_DMA_RING_ADDR_LO_SET(dword, val) WMI_F_RMW(dword, val, WMI_OEM_DMA_RING_ADDR_LO)
+
+#define WMI_OEM_DMA_RING_ADDR_HI_S 0
+#define WMI_OEM_DMA_RING_ADDR_HI 0xf
+
+#define WMI_OEM_DMA_RING_ADDR_HI_GET(dword) WMI_F_MS(dword, WMI_OEM_DMA_RING_ADDR_HI)
+#define WMI_OEM_DMA_RING_ADDR_HI_SET(dword, val) WMI_F_RMW(dword, val, WMI_OEM_DMA_RING_ADDR_HI)
+
+typedef struct {
+    A_UINT32 tlv_header;    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_oem_dma_ring_cfg_rsp_fixed_param */
+    A_UINT32 pdev_id;
+    A_UINT32 cfg_status;    /** Configuration status; see A_STATUS */
+} wmi_oem_dma_ring_cfg_rsp_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header;    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_oem_indirect_data */
+    A_UINT32 pdev_id;       /** ID of pdev whose OEM DMA ring produced the data */
+    /**
+     * Bits 31:0:   address of data [31:0]
+     */
+    A_UINT32 addr_lo;
+    /**
+     * Bits 3:0:    address of data [35:32]
+     * Bits 11:4:   reserved
+     * Bits 31:12:  opaque host context data [19:0]
+     */
+    A_UINT32 addr_hi;
+    A_UINT32 len;           /** Length of data in bytes */
+} wmi_oem_indirect_data;
+
+#define WMI_OEM_DMA_DATA_ADDR_LO_S 0
+#define WMI_OEM_DMA_DATA_ADDR_LO 0xffffffff
+
+#define WMI_OEM_DMA_DATA_ADDR_LO_GET(dword) WMI_F_MS(dword, WMI_OEM_DMA_DATA_ADDR_LO)
+#define WMI_OEM_DMA_DATA_ADDR_LO_SET(dword, val) WMI_F_RMW(dword, val, WMI_OEM_DMA_DATA_ADDR_LO)
+
+#define WMI_OEM_DMA_DATA_ADDR_HI_S 0
+#define WMI_OEM_DMA_DATA_ADDR_HI 0xf
+
+#define WMI_OEM_DMA_DATA_ADDR_HI_GET(dword) WMI_F_MS(dword, WMI_OEM_DMA_DATA_ADDR_HI)
+#define WMI_OEM_DMA_DATA_ADDR_HI_SET(dword, val) WMI_F_RMW(dword, val, WMI_OEM_DMA_DATA_ADDR_HI)
+
+#define WMI_OEM_DMA_DATA_ADDR_HI_HOST_DATA_S 12
+#define WMI_OEM_DMA_DATA_ADDR_HI_HOST_DATA 0xfffff
+
+#define WMI_OEM_DMA_DATA_ADDR_HI_HOST_DATA_GET(dword) WMI_F_MS(dword, WMI_OEM_DMA_DATA_ADDR_HI_HOST_DATA)
+#define WMI_OEM_DMA_DATA_ADDR_HI_HOST_DATA_SET(dword, val) WMI_F_RMW(dword, val, WMI_OEM_DMA_DATA_ADDR_HI_HOST_DATA)
+
+typedef struct {
+    A_UINT32 tlv_header;    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_oem_dma_buf_release_hdr */
+    A_UINT32 pdev_id;       /** ID of pdev whose OEM DMA ring produced the data */
+} wmi_oem_dma_buf_release_fixed_param;
+
+typedef struct {
+    /**
+     * Bits 31:0:   address of data [31:0]
+     */
+    A_UINT32 addr_lo;
+    /**
+     * Bits 3:0:    address of data [35:32]
+     * Bits 11:4:   reserved
+     * Bits 31:12:  host context data [19:0]
+     */
+    A_UINT32 addr_hi;
+} wmi_oem_dma_buf_release_entry;
+
+typedef struct {
     A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_nan_cmd_param */
     A_UINT32 data_len; /** length in byte of data[]. */
     /* This structure is used to send REQ binary blobs
@@ -11952,6 +15165,17 @@ typedef enum {
 #define wmi_ndp_rsp_code wmi_ndp_rsp_code_PROTOTYPE
 
 /**
+* NDP Channel configuration type
+*/
+typedef enum {
+    WMI_NDP_CHANNEL_NOT_REQUESTED = 0, /* Channel will not configured */
+    WMI_NDP_REQUEST_CHANNEL_SETUP = 1, /* Channel will be provided and is optional/hint */
+    WMI_NDP_FORCE_CHANNEL_SETUP = 2/* NDP must start on the provided channel */
+} wmi_ndp_channel_cfg_PROTOTYPE;
+
+#define wmi_ndp_channel_cfg wmi_ndp_channel_cfg_PROTOTYPE
+
+/**
  * NDP Initiator requesting a data session
  */
 typedef struct {
@@ -11969,12 +15193,25 @@ typedef struct {
     A_UINT32 ndp_cfg_len;
     /** Actual number of bytes in TLV ndp_app_info */
     A_UINT32 ndp_app_info_len;
+    /** NDP channel configuration type defined in wmi_ndp_channel_cfg */
+    A_UINT32 ndp_channel_cfg;
+    /**  NAN Cipher Suite Shared Key */
+    A_UINT32 nan_csid;
+    /** Actual number of bytes in TLV ndp_pmk */
+    A_UINT32 nan_pmk_len;
+    /** Actual number of bytes in TLV ndp_passphrase */
+    A_UINT32 nan_passphrase_len;
+    /** Actual number of bytes in TLV nan_servicename */
+    A_UINT32 nan_servicename_len;
     /**
      * TLV (tag length value ) parameters follow the ndp_initiator_req
      * structure. The TLV's are:
      * wmi_channel channel;
      * A_UINT8 ndp_cfg[];
      * A_UINT8 ndp_app_info[];
+     * A_UINT8 ndp_pmk[];
+     * A_INT8 ndp_passphrase[];
+     * A_INT8 nan_servicename[];
      */
 } wmi_ndp_initiator_req_fixed_param_PROTOTYPE;
 
@@ -12002,11 +15239,22 @@ typedef struct {
     A_UINT32 ndp_cfg_len;
     /** Number of bytes in TLV ndp_app_info */
     A_UINT32 ndp_app_info_len;
+    /**  NAN Cipher Suite Shared Key */
+    A_UINT32 nan_csid;
+    /** Actual number of bytes in TLV ndp_pmk */
+    A_UINT32 nan_pmk_len;
+    /** Actual number of bytes in TLV ndp_passphrase */
+    A_UINT32 nan_passphrase_len;
+    /** Actual number of bytes in TLV nan_servicename */
+    A_UINT32 nan_servicename_len;
     /**
      * TLV (tag length value ) parameters follow the ndp_responder_req
      * structure. The TLV's are:
      * A_UINT8 ndp_cfg[];
      * A_UINT8 ndp_app_info[];
+     * A_UINT8 ndp_pmk[];
+     * A_INT8 ndp_passphrase[];
+     * A_INT8 nan_servicename[];
      */
 } wmi_ndp_responder_req_fixed_param_PROTOTYPE;
 
@@ -12137,6 +15385,8 @@ typedef struct {
     A_UINT32 ndp_instance_id;
     /** NDI mac address of the peer */
     wmi_mac_addr peer_ndi_mac_addr;
+    /** Host can create peer if this entry is TRUE */
+    A_UINT32 create_peer;
 } wmi_ndp_responder_rsp_event_fixed_param_PROTOTYPE;
 
 #define wmi_ndp_responder_rsp_event_fixed_param wmi_ndp_responder_rsp_event_fixed_param_PROTOTYPE
@@ -12242,11 +15492,18 @@ typedef struct {
     A_UINT32 ndp_cfg_len;
     /** Number of bytes in TLV wmi_ndp_app_info */
     A_UINT32 ndp_app_info_len;
+    /** Peer NAN Cipher Suite Shared Key */
+    A_UINT32 nan_csid;
+    /** Actual number of bytes in TLV nan_scid */
+    A_UINT32 nan_scid_len;
+    /** Self NDI mac address */
+    wmi_mac_addr self_ndi_mac_addr;
     /**
      * TLV (tag length value ) parameters follow the ndp_indication
      * structure. The TLV's are:
      * A_UINT8 ndp_cfg[];
      * A_UINT8 ndp_app_info[];
+     * A_UINT8 nan_scid[];
      */
 } wmi_ndp_indication_event_fixed_param_PROTOTYPE;
 
@@ -12278,11 +15535,17 @@ typedef struct {
     A_UINT32 reason_code;
     /** Number of active ndps on this peer */
     A_UINT32 num_active_ndps_on_peer;
+    /** Number of channels on this peer */
+    A_UINT32 num_ndp_channels;
+    /** Number of spatial streams associated */
+    A_UINT32 nss_2g;
+    A_UINT32 nss_5g;
     /**
      * TLV (tag length value ) parameters follow the ndp_confirm
      * structure. The TLV's are:
      * A_UINT8 ndp_cfg[];
      * A_UINT8 ndp_app_info[];
+     * wmi_channel ndp_channel_list[];
      */
 } wmi_ndp_confirm_event_fixed_param_PROTOTYPE;
 
@@ -12310,6 +15573,37 @@ typedef struct {
 
 #define wmi_ndp_end_indication wmi_ndp_end_indication_PROTOTYPE
 
+typedef struct
+{
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndl_schedule_update_fixed_param */
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+   /** peer MAC address */
+    wmi_mac_addr peer_macaddr;
+   /** Flags:
+    *  Bit   0    -> Nss updated
+    *  Bit   1    -> channel list updated
+    *  Bits  2-31 -> Reserved
+    */
+    A_UINT32 flags;
+    /** num spatial streams associated */
+    A_UINT32 nss_2g;
+    A_UINT32 nss_5g;
+    /** num of channels */
+    A_UINT32 num_channels;
+    /** num of ndp instances */
+    A_UINT32 num_ndp_instances;
+    /**
+     * TLV (tag length value) parameters follow the ndl_schedule_update
+     * structure. The TLV's are:
+     * A_UINT32 ndp_instance_list[];
+     * wmi_channel ndl_channel_list[];
+     */
+} wmi_ndl_schedule_update_fixed_param_PROTOTYPE;
+
+#define wmi_ndl_schedule_update_fixed_param wmi_ndl_schedule_update_fixed_param_PROTOTYPE
+
+
 typedef struct {
     A_UINT32 tlv_header;
     A_UINT32 num_data;
@@ -12340,6 +15634,18 @@ enum {
 #define GET_PDEV_PARAM_TXPOWER_REASON(txpower_param)     \
     (((txpower_param) & PDEV_PARAM_TXPOWER_REASON_MASK) >> PDEV_PARAM_TXPOWER_REASON_SHIFT)
 
+#define PDEV_PARAM_SMART_CHAINMASK_SCHEME_DECISION_MASK 0x00000001
+#define PDEV_PARAM_SMART_CHAINMASK_SCHEME_DECISION_SHIFT 0
+
+#define SET_PDEV_SMART_CHAINMASK_SCHEME_DECISION(param, value) \
+    do { \
+        (param) &= ~PDEV_PARAM_SMART_CHAINMASK_SCHEME_DECISION_MASK; \
+        (param) |= (value) << PDEV_PARAM_SMART_CHAINMASK_SCHEME_DECISION_SHIFT; \
+    while (0)
+
+#define GET_PDEV_SMART_CHAINMASK_SCHEME_DECISION(param)     \
+    (((param) & PDEV_PARAM_SMART_CHAINMASK_SCHEME_DECISION_MASK) >> PDEV_PARAM_SMART_CHAINMASK_SCHEME_DECISION_SHIFT)
+
 /**
  * This command is sent from WLAN host driver to firmware to
  * notify the current modem power state. Host would receive a
@@ -12387,6 +15693,7 @@ typedef struct {
     A_UINT32 tlv_header;
 
     /** when set to WMI_SAR_FEATURE_ON, enable SAR feature;
+     *  with BDF (SET_0 to 4) or WMI
      * if set to WMI_SAR_FEATURE_OFF, disable feature;
      * if set to WMI_SAR_FEATURE_NO_CHANGE, do not alter state of feature;
      */
@@ -12417,7 +15724,8 @@ enum wmi_sar_feature_state_flags {
     WMI_SAR_FEATURE_ON_SET_2,
     WMI_SAR_FEATURE_ON_SET_3,
     WMI_SAR_FEATURE_ON_SET_4,
-    WMI_SAR_FEATURE_NO_CHANGE
+    WMI_SAR_FEATURE_NO_CHANGE,
+    WMI_SAR_FEATURE_ON_USER_DEFINED,
 };
 
 typedef struct {
@@ -12506,6 +15814,8 @@ typedef struct {
       *  roam_reason:
       *  bits 0-3 for roam reason   see WMI_ROAM_REASON_XXX
       *  bits 4-5 for subnet status see WMI_ROAM_SUBNET_CHANGE_STATUS_XXX.
+      *  bit  6   for HW mode status, set 1 to indicate host to schedule
+      *           HW mode change, see WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE.
       */
     A_UINT32 roam_reason;
     /** associated AP's rssi calculated by FW when reason code is WMI_ROAM_REASON_LOW_RSSI. not valid if roam_reason is BMISS */
@@ -12533,6 +15843,39 @@ typedef struct {
      **/
 } wmi_roam_synch_event_fixed_param;
 
+/**
+ * The WMI_ROAM_SYNCH_FRAME_EVENTID message is used in conjunction with the
+ * WMI_ROAM_SYNCH_EVENTID message.  The former will be sent 1st followed by
+ * the latter for cases where the WMI_ROAM_SYNCH_EVENTID message size would
+ * exceed 2K.  The more_frag field in the WMI_ROAM_SYNCH_FRAME_EVENTID informs
+ * the host whether more WMI_ROAM_SYNCH_FRAME_EVENTID messages would follow;
+ * after the WMI_ROAM_SYNCH_FRAME_EVENTID messages the target sends the
+ * WMI_ROAM_SYNCH_EVENTID with bcn_probe_rsp_len, reassoc_rsp_len, and
+ * reassoc_rsp_len set to 0.
+ */
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_roam_synch_frame_event_fixed_param  */
+    /** Unique id identifying the VDEV on which roaming is done by firmware */
+    A_UINT32 vdev_id;
+    /** More frags to follow? */
+    A_UINT32 more_frag;
+    /** whether the frame is beacon or probe rsp */
+    A_UINT32 is_beacon;
+    /** the length of beacon/probe rsp */
+    A_UINT32 bcn_probe_rsp_len;
+    /** the length of reassoc rsp */
+    A_UINT32 reassoc_rsp_len;
+    /** the length of reassoc req */
+    A_UINT32 reassoc_req_len;
+    /**
+     * TLV (tag length value) parameters follows roam_synch_event
+     * The TLV's are:
+     *     A_UINT8 bcn_probe_rsp_frame[bcn_probe_rsp_len];
+     *     A_UINT8 reassoc_rsp_frame[reassoc_rsp_len];
+     *     A_UINT8 reassoc_req_frame[reassoc_req_len];
+     */
+} wmi_roam_synch_frame_event_fixed_param;
+
 #define WMI_PEER_ESTIMATED_LINKSPEED_INVALID    0xFFFFFFFF
 
 typedef struct {
@@ -15269,6 +18612,52 @@ typedef struct {
 } wmi_extscan_configure_mawc_cmd_fixed_param;
 
 typedef struct {
+   /*
+    * TLV tag and len; tag equals
+    * WMITLV_TAG_STRUC_wmi_roam_per_config_fixed_param
+    */
+    A_UINT32 tlv_header;
+   /* Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+   /* enable(1) or disable(0) packet error rate trigger for roaming */
+    A_UINT32 enable;
+   /* high_rate_thresh, low_rate_thresh, pkt_err_rate_thresh_pct:
+    * If PER monitoring as a trigger for roaming is enabled,
+    * it is controlled by high_rate_thresh, low_rate_thresh, and
+    * pkt_err_rate_thresh_pct.
+    * PER monitoring is performed only when the time-averaged throughput
+    * is less than high_rate_thresh.
+    * During PER monitoring, the target keeps track of the PHY rate for
+    * each of the first N PPDUs within a time window.
+    * If the number of PPDUs with PHY rate < low_rate_thresh exceeds
+    * N * pkt_err_rate_thresh_pct / 100, roaming will be triggered.
+    *
+    * This PER monitoring as a trigger for roaming is performed
+    * concurrently but independently for rx and tx.
+    */
+    A_UINT32 high_rate_thresh; /* units = Kbps */
+    A_UINT32 low_rate_thresh; /* units = Kbps */
+    A_UINT32 pkt_err_rate_thresh_pct;
+   /*
+    * rest time after associating to a new AP before
+    * starting to monitor PER as a roaming trigger,
+    * (units are seconds)
+    */
+    A_UINT32 per_rest_time;
+    /* This is the total time for which PER monitoring will be run.
+     * After completion of time windows, the average PER over the window
+     * will be computed.
+     * The parameter value stores specifications for both TX and RX
+     * monitor times.
+     * The two least-significant bytes (0 & 1) hold the RX monitor time;
+     * the two most-significant bytes (2 & 3) hold the TX monitor time.
+     */
+    A_UINT32 pkt_err_rate_mon_time; /* units = seconds */
+    /* Minimum roamable AP RSSI for candidate selection for PER based roam */
+    A_INT32 min_candidate_rssi; /* units = dBm */
+} wmi_roam_per_config_fixed_param;
+
+typedef struct {
     /* TLV tag and len; tag equals
      * WMITLV_TAG_STRUC_wmi_nlo_configure_mawc_cmd_fixed_param */
     A_UINT32 tlv_header;
@@ -15636,6 +19025,12 @@ typedef struct {
      */
 } wmi_scpc_event_fixed_param;
 
+typedef enum {
+FW_ACTIVE_BPF_MODE_DISABLE =         (1 << 1),
+FW_ACTIVE_BPF_MODE_FORCE_ENABLE =    (1 << 2),
+FW_ACTIVE_BPF_MODE_ADAPTIVE_ENABLE = (1 << 3),
+} FW_ACTIVE_BPF_MODE;
+
 /* bpf interface structure */
 typedef struct wmi_bpf_get_capability_cmd_s {
     A_UINT32 tlv_header;
@@ -15647,6 +19042,8 @@ typedef struct wmi_bpf_capability_info_evt_s {
     A_UINT32 bpf_version; /* fw's implement version */
     A_UINT32 max_bpf_filters; /* max filters that fw supports */
     A_UINT32 max_bytes_for_bpf_inst; /* the maximum bytes that can be used as bpf instructions */
+    A_UINT32 fw_active_bpf_support_mcbc_modes; /* multicast/broadcast - refer to FW_ACTIVE_BPF_MODE, it can be 'or' of them */
+    A_UINT32 fw_active_bpf_support_uc_modes; /* unicast - refer to FW_ACTIVE_BPF_MODE, it can be 'or' of them */
 } wmi_bpf_capability_info_evt_fixed_param;
 
 /* bit 0 of flags: report counters */
@@ -15687,6 +19084,13 @@ typedef struct wmi_bpf_del_vdev_instructions_cmd_s {
     A_UINT32 filter_id;  /* BPF_FILTER_ID_ALL means delete all */
 } wmi_bpf_del_vdev_instructions_cmd_fixed_param;
 
+typedef struct wmi_bpf_set_vdev_active_mode_cmd_s {
+    A_UINT32 tlv_header;
+    A_UINT32 vdev_id;
+    A_UINT32 mcbc_mode; /* refer to FW_ACTIVE_BPF_MODE */
+    A_UINT32 uc_mode; /* refer to FW_ACTIVE_BPF_MODE */
+} wmi_bpf_set_vdev_active_mode_cmd_fixed_param;
+
 #define AES_BLOCK_LEN           16  /* in bytes */
 #define FIPS_KEY_LENGTH_128     16  /* in bytes */
 #define FIPS_KEY_LENGTH_256     32  /* in bytes */
@@ -15907,6 +19311,8 @@ typedef struct {
     A_UINT32 atf_units; /* Based on 1 part in 1000 (per mille) */
     A_UINT32 atf_groupid; /* Group Id of the peers for ATF SSID grouping */
     A_UINT32 atf_units_reserved; /* Peer congestion threshold for future use */
+    A_UINT32 vdev_id;
+    A_UINT32 pdev_id;
 } wmi_atf_peer_info;
 
 typedef struct {
@@ -15926,6 +19332,8 @@ typedef struct {
     A_UINT32 bwf_guaranteed_bandwidth; /* BWF guaranteed_bandwidth for the peers in mbps */
     A_UINT32 bwf_max_airtime; /* BWF Maximum airtime percentage that can be allocated to the peer to meet the guaranteed_bandwidth */
     A_UINT32 bwf_peer_priority; /* BWF priority of the peer to allocate the tokens dynamically */
+    A_UINT32 vdev_id;
+    A_UINT32 pdev_id;
 } wmi_bwf_peer_info;
 
 /* Structure for Bandwidth Fairness peer request */
@@ -15943,6 +19351,7 @@ typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_atf_request_fixed_param */
     A_UINT32 vdev_id;
     A_UINT32 peer_atf_units; /* Per peer ATF units (per mille). */
+    A_UINT32 pdev_id;
 } wmi_vdev_atf_request_fixed_param;
 
 typedef struct {
@@ -16058,26 +19467,37 @@ typedef struct {
     A_UINT32 mac_id;     /* MAC ID */
     A_UINT32 rate_flags;
     /**
-    * FLAG_ONE_CHAIN     0x001  - one chain mask
-    * FLAG_TWO_CHAIN     0x005  - two chain mask
-    * FLAG_THREE_CHAIN   0x007  - three chain mask
-    * FLAG_FOUR_CHAIN    0x00F  - four chain mask
-    * FLAG_STBC          0x010  - STBC is set
-    * FLAG_40MHZ         0x020
-    * FLAG_80MHZ         0x040
-    * FLAG_160MHZ        0x080
-    * FLAG_TXBF          0x0100 - Tx Bf enabled
-    * FLAG_RTSENA        0x0200 - RTS enabled
-    * FLAG_CTSENA        0x0400 - CTS enabled
-    * FLAG_LDPC          0x0800 - LDPC set
-    * FLAG_SERIES1       0x1000 -
-    * FLAG_SGI           0x2000 - Short gaurd interval
-    * FLAG_MU2           0x4000 - MU2 data
-    * FLAG_MU3           0x8000 - MU3 data
+    * FLAG_ONE_CHAIN     0x00000001  - one chain mask
+    * FLAG_TWO_CHAIN     0x00000003  - two chain mask
+    * FLAG_THREE_CHAIN   0x00000007  - three chain mask
+    * FLAG_FOUR_CHAIN    0x0000000F  - four chain mask
+    * FLAG_FIVE_CHAIN    0x0000001F  - five chain mask
+    * FLAG_SIX_CHAIN     0x0000003F  - six chain mask
+    * FLAG_SEVEN_CHAIN   0x0000007F  - seven chain mask
+    * FLAG_EIGHT_CHAIN   0x000000FF  - eight chain mask
+    * FLAG_STBC          0x00000100  - STBC is set
+    * FLAG_40MHZ         0x00000200  - bits 9-10 used for BW:
+    * FLAG_80MHZ         0x00000400    (bw >> 9) & 3 will give
+    * FLAG_160MHZ        0x00000600    1 -> 40 MHz, 2 -> 80 MHz, 3 -> 160 MHz
+    * FLAG_TXBF          0x00000800 - Tx Bf enabled
+    * FLAG_RTSENA        0x00001000 - RTS enabled
+    * FLAG_CTSENA        0x00002000 - CTS enabled
+    * FLAG_LDPC          0x00004000 - LDPC set
+    * FLAG_SGI           0x00008000 - Short gaurd interval
+    *                   (0x00010000-0x00080000 unused)
+    *------------------
+    * 0x00100000-0x00700000 used for SU/MU/OFDMA tx mode
+    * FLAG_SU            0x00100000 - SU Data
+    * FLAG_DL_MU_MIMO_AC 0x00200000 - DL AC MU data
+    * FLAG_DL_MU_MIMO_AX 0x00300000 - DL AX MU data
+    * FLAG_DL_OFDMA      0x00400000 - DL OFDMA data
+    * FLAG_UL_OFDMA      0x00500000 - UL OFDMA data
+    * FLAG_UL_MU_MIMO    0x00600000 - UL MU data
+    *------------------
     * */
     A_UINT32 nss;
     /**
-    * NSS 0x0 - 0x3
+    * NSS 0x0 - 0x7
     * */
     A_UINT32 preamble;
     /**
@@ -16085,6 +19505,7 @@ typedef struct {
     * PREAM_CCK  - 0x1
     * PREAM_HT   - 0x2
     * PREAM_VHT  - 0x3
+    * PREAM_HE   - 0x4
     * */
     A_UINT32 hw_rate;
     /**
@@ -16108,7 +19529,7 @@ typedef struct {
      * CCK_2_SHORT_MBPS   - 0x6
      *
      * *** HW_HT / VHT_RATE ***
-     * MCS 0x0 - 0x9
+     * MCS 0x0 - 0xb
      * */
 } wmi_pdev_get_tpc_cmd_fixed_param;
 
@@ -16127,7 +19548,14 @@ typedef struct {
     A_UINT32 reserved0; /* for future need */
    /*
     * Following this structure is the TLV:
-    *    A_UINT32 tpc[1];
+    *    A_UINT32 tpc[2];
+    *    tpc[0] - maximum power per rate
+    *    tpc[1] - minimum power per rate
+    *    Currently this event only provides max and min power limits
+    *    for a single rate.  In the future this event may be expanded
+    *    to provide the information for multiple rates.
+    *    At that time, the format of the data will be provided.
+
     */
 } wmi_pdev_tpc_event_fixed_param;
 
@@ -16199,11 +19627,50 @@ typedef struct {
      */
 } wmi_pdev_chip_power_stats_event_fixed_param;
 
+typedef enum wmi_chip_power_save_failure_reason_code_type {
+    WMI_PROTOCOL_POWER_SAVE_FAILURE_REASON,
+    WMI_HW_POWER_SAVE_FAILURE_REASON,
+    WMI_CSS_LOCKED_POWER_FAILURE_REASON,
+    WMI_MAC0_LOCKED_POWER_FAILURE_REASON,
+    WMI_MAC1_LOCKED_POWER_FAILURE_REASON,
+    WMI_POWER_SAVE_FAILURE_REASON_MAX = 0xf,
+} WMI_POWER_SAVE_FAILURE_REASON_TYPE;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_chip_power_save_failure_detected_fixed_param */
+    A_UINT32 power_save_failure_reason_code; /* Chip power save failuire reason as defined in WMI_POWER_SAVE_FAILURE_REASON_TYPE */
+    A_UINT32 protocol_wake_lock_bitmap[4]; /* bitmap with bits set for modules (from WLAN_MODULE_ID enum) voting against sleep for prolonged duration */
+} wmi_chip_power_save_failure_detected_fixed_param;
+
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ani_ofdm_event_fixed_param */
     A_UINT32 ofdm_level;
 } wmi_ani_ofdm_event_fixed_param;
 
+/* When a bit is set it specifies the particular WLAN traffic type is high priority.
+ * BT low priority traffic has higher priority than WLAN low priority traffic and has
+ * lower priority when compared to WLAN high priority traffic.
+ * BT high priority traffic has higher priority than WLAN low/high priority traffic.
+ */
+#define WMI_PDEV_BE_PRIORITY_BIT     (1<<0)
+#define WMI_PDEV_BK_PRIORITY_BIT     (1<<1)
+#define WMI_PDEV_VI_PRIORITY_BIT     (1<<2)
+#define WMI_PDEV_VO_PRIORITY_BIT     (1<<3)
+#define WMI_PDEV_BEACON_PRIORITY_BIT (1<<4)
+#define WMI_PDEV_MGMT_PRIORITY_BIT   (1<<5)
+#define WMI_PDEV_IS_BE_PRIORITY_SET(val) ((val) & WMI_PDEV_BE_PRIORITY_BIT)
+#define WMI_PDEV_IS_BK_PRIORITY_SET(val) ((val) & WMI_PDEV_BK_PRIORITY_BIT)
+#define WMI_PDEV_IS_VI_PRIORITY_SET(val) ((val) & WMI_PDEV_VI_PRIORITY_BIT)
+#define WMI_PDEV_IS_VO_PRIORITY_SET(val) ((val) & WMI_PDEV_VO_PRIORITY_BIT)
+#define WMI_PDEV_IS_BEACON_PRIORITY_SET(val) ((val) & WMI_PDEV_BEACON_PRIORITY_BIT)
+#define WMI_PDEV_IS_MGMT_PRIORITY_SET(val) ((val) & WMI_PDEV_MGMT_PRIORITY_BIT)
+
+typedef enum wmi_coex_algo_type  {
+    WMI_COEX_ALGO_UNCONS_FREERUN  = 0,
+    WMI_COEX_ALGO_FREERUN         = 1,
+    WMI_COEX_ALGO_OCS             = 2,
+} WMI_COEX_ALGO_TYPE;
+
 typedef enum wmi_coex_config_type {
     /* config interval (arg1 BT, arg2 WLAN) for P2P + PAGE */
     WMI_COEX_CONFIG_PAGE_P2P_TDM        =  1,
@@ -16232,8 +19699,26 @@ typedef enum wmi_coex_config_type {
     WMI_COEX_CONFIG_INQUIRY_P2P_STA_TDM = 11,
     /* config wlan total tx power when bt coex (arg1 is wlan_tx_power_limit, in 0.5dbm units) */
     WMI_COEX_CONFIG_TX_POWER            = 12,
-    /* Config Wlan pause and Unpause Duration */
-    WMI_COEX_CONFIG_BTC_DUTYCYCLE       = 18
+    /* config  whether enable PTA and GPIO number (arg1 is pta_enable, arg2 is GPIO number used as /BT_ACTIVE/BT_PRIORITY/WLAN_DENY,8 bit for each) */
+    WMI_COEX_CONFIG_PTA_CONFIG          = 13,
+    WMI_COEX_CONFIG_AP_TDM              = 14, /* config interval (arg1 duty cycle in ms, arg2 WLAN duration in ms) for AP */
+    WMI_COEX_CONFIG_WLAN_SCAN_PRIORITY  = 15, /* config to set WLAN priority during Off Channel Scan */
+    WMI_COEX_CONFIG_WLAN_PKT_PRIORITY   = 16, /* config to set WLAN priority for BE/BK/VO/VI/Beacon/Management frame */
+    WMI_COEX_CONFIG_PTA_INTERFACE       = 17, /* config PTA interface,
+                                                 arg1 PTA num,
+                                                 arg2 mode (2-wire/3-wire/PTA),
+                                                 arg3 first slot time in microsec,
+                                                 arg4 BT priority time in microsec,
+                                                 arg5 PTA algorithm (WMI_COEX_ALGO_TYPE),
+                                                 arg6 PTA priority */
+    WMI_COEX_CONFIG_BTC_DUTYCYCLE       = 18, /* config interval (ms units) (arg1 WLAN pause duration, arg2 WLAN unpause duration) for WLAN UL + BT Rx */
+    WMI_COEX_CONFIG_HANDOVER_RSSI       = 19, /* config to set WLAN RSSI (dBm units) at which device switches from Hybrid to TDD coex mode */
+#ifdef FEATURE_COEX_PTA_CONFIG_ENABLE
+    /* config BT info to FW when coexistence enable */
+    WMI_COEX_CONFIG_PTA_BT_INFO         = 20,
+#endif
+    WMI_COEX_CONFIG_SINK_WLAN_TDM       = 21, /* config interval (ms units) (arg1 BT, arg2 WLAN) for A2DP SINK + WLAN */
+    WMI_COEX_CONFIG_COEX_ENABLE_MCC_TDM = 22, /* config disable/enable COEX TDM for MCC */
 } WMI_COEX_CONFIG_TYPE;
 
 typedef struct {
@@ -16242,6 +19727,10 @@ typedef struct {
     A_UINT32 config_type; /* wmi_coex_config_type enum */
     A_UINT32 config_arg1;
     A_UINT32 config_arg2;
+    A_UINT32 config_arg3;
+    A_UINT32 config_arg4;
+    A_UINT32 config_arg5;
+    A_UINT32 config_arg6;
 } WMI_COEX_CONFIG_CMD_fixed_param;
 
 /**
@@ -16271,6 +19760,11 @@ typedef struct {
     A_UINT32 enable;
     /** periodic stats duration (units are milliseconds) */
     A_UINT32 stats_period;
+    /*
+     * pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
 } wmi_set_periodic_channel_stats_config_fixed_param;
 
 typedef struct {
@@ -16372,6 +19866,56 @@ typedef struct {
 } wmi_request_wlan_stats_cmd_fixed_param;
 
 typedef enum {
+    WMI_REQUEST_ONE_PEER_STATS_INFO = 0x01, /* request stats of one specified peer */
+    WMI_REQUEST_VDEV_ALL_PEER_STATS_INFO = 0x02, /* request stats of all peers belong to specified VDEV */
+} wmi_peer_stats_info_request_type;
+
+/** It is required to issue WMI_PDEV_PARAM_PEER_STATS_INFO_ENABLE
+*  (with a non-zero value) before issuing the first REQUEST_PEER_STATS_INFO.
+*/
+typedef struct {
+    /** TLV tag and len; tag equals
+    * WMITLV_TAG_STRUC_wmi_request_peer_stats_info_cmd_fixed_param */
+    A_UINT32 tlv_header;
+    /** request_type to indicate if only stats of
+    *  one peer or all peers of the VDEV are requested,
+    *  see wmi_peer_stats_info_request_type.
+    */
+    A_UINT32 request_type;
+    /** VDEV identifier */
+    A_UINT32 vdev_id;
+    /** this peer_macaddr is only used if request_type == ONE_PEER_STATS_INFO */
+    wmi_mac_addr peer_macaddr;
+    /** flag to indicate if FW needs to reset requested peers stats */
+    A_UINT32 reset_after_request;
+} wmi_request_peer_stats_info_cmd_fixed_param;
+
+typedef enum {
+    WMI_REQUEST_ONE_RADIO_CHAN_STATS = 0x01, /* request stats of one specified channel */
+    WMI_REQUEST_ALL_RADIO_CHAN_STATS = 0x02, /* request stats of all channels */
+} wmi_radio_chan_stats_request_type;
+
+/** It is required to issue WMI_PDEV_PARAM_RADIO_CHAN_STATS_ENABLE
+ *  (with a non-zero value) before issuing the first REQUEST_RADIO_CHAN_STATS.
+ */
+typedef struct {
+    /** TLV tag and len; tag equals
+     * WMITLV_TAG_STRUC_wmi_request_radio_chan_stats_cmd_fixed_param */
+     A_UINT32 tlv_header;
+     /** request_type to indicate if only stats of
+     *  one channel or all channels are requested,
+     *  see wmi_radio_chan_stats_request_type.
+     */
+     A_UINT32 request_type;
+     /** Frequency of channel whose stats is requested,
+     *  only used when request_type == WMI_REQUEST_ONE_RADIO_CHAN_STATS
+     */
+     A_UINT32 chan_mhz;
+     /** flag to indicate if FW needs to reset requested stats of specified channel/channels */
+     A_UINT32 reset_after_request;
+} wmi_request_radio_chan_stats_cmd_fixed_param;
+
+typedef enum {
     WLAN_2G_CAPABILITY = 0x1,
     WLAN_5G_CAPABILITY = 0x2,
 } WLAN_BAND_CAPABILITY;
@@ -16403,6 +19947,7 @@ typedef enum wmi_hw_mode_config_type {
 	 * as in WMI_HW_MODE_SBS, and 3rd on the other band
 	 */
 	WMI_HW_MODE_DBS_SBS     = 4,
+	WMI_HW_MODE_DBS_OR_SBS  = 5, /* One PHY is on 5G and the other PHY can be in 2G or 5G. */
 } WMI_HW_MODE_CONFIG_TYPE;
 
 #define WMI_SUPPORT_11B_GET(flags) WMI_GET_BITS(flags, 0, 1)
@@ -16475,7 +20020,18 @@ typedef struct {
     A_UINT32 vht_supp_mcs_2G;
     /*HE capability info field of 802.11ax, WMI_HE_CAP defines */
     A_UINT32 he_cap_info_2G;
-    /* HE Supported MCS Set field Rx/Tx same */
+    /* HE Supported MCS Set field Rx/Tx same
+     * - 2 bits are used for each NSS chain.Max of 8 NSS can be encoded with
+     *     bit 2-0 indicating max HE MCS of NSS1
+     *     bit 5-3 indicating max HE MCS of NSS2 and so on
+     * - The max HE-MCS for n SS subfield (where n = 1,...,8) in case of
+     *     HE BW less than or equal to 80MHZ is encoded as follows
+     * - 0 indicates support for VHT-MCS 0-7 for n spatial streams
+     * - 1 indicates support for VHT-MCS 0-9 for n spatial streams
+     * - 2 indicates support for VHT-MCS 0-11 for n spatial streams
+     * - 3 indicates that n spatial streams is not supported
+     * - WMI_HE_MAX_MCS_4_SS_MASK macro can be used for encoding this info
+     */
     A_UINT32 he_supp_mcs_2G;
     /* Valid Transmit chain mask */
     A_UINT32 tx_chain_mask_2G;
@@ -16496,7 +20052,22 @@ typedef struct {
     A_UINT32 vht_supp_mcs_5G;
     /*HE capability info field of 802.11ax, WMI_HE_CAP defines */
     A_UINT32 he_cap_info_5G;
-    /* HE Supported MCS Set field Rx/Tx same */
+    /* HE Supported MCS Set field Rx/Tx same
+     * - 2 bits are used for each NSS chain.Max of 8 NSS can be encoded with
+     *     bit 2-0 indicating max HE MCS of NSS1
+     *     bit 5-3 indicating max HE MCS of NSS2 and so on
+     * - The max HE-MCS for n SS subfield (where n = 1,...,8) in case of
+     *     HE BW less than or equal to 80MHZ is encoded as follows
+     * - 0 indicates support for VHT-MCS 0-7 for n spatial streams
+     * - 1 indicates support for VHT-MCS 0-9 for n spatial streams
+     * - 2 indicates support for VHT-MCS 0-11 for n spatial streams
+     * - 3 indicates that n spatial streams is not supported
+     * - WMI_HE_MAX_MCS_4_SS_MASK macro can be used for encoding this info
+     * - The max HE-MCS for n SS subfield (where n = 1,...,8) in case of
+     *     HE BW equal to 80+80 or 160 MHZ encoding is same as above just the
+     *     lower 16 bits are used for lower 80MHz NSS-MCS supported combo and
+     *     upper 16 bits are used for upper 80MHz NSS-MCS supported combo
+     */
     A_UINT32 he_supp_mcs_5G;
     /* Valid Transmit chain mask */
     A_UINT32 tx_chain_mask_5G;
@@ -16507,6 +20078,8 @@ typedef struct {
     A_UINT32 he_cap_phy_info_5G[WMI_MAX_HECAP_PHY_SIZE];
     wmi_ppe_threshold he_ppet2G;
     wmi_ppe_threshold he_ppet5G;
+    /* chainmask table to be used for the MAC */
+    A_UINT32 chainmask_table_id;
 } WMI_MAC_PHY_CAPABILITIES;
 
 typedef struct {
@@ -16531,11 +20104,100 @@ typedef struct {
     A_UINT32 hw_mode_config_type;
 } WMI_HW_MODE_CAPABILITIES;
 
+/*
+ * The following macros are for the bitfields witihin the supported flags field
+ * of WMI_MAC_PHY_CHAINMASK_CAPABILITY:
+ * Capabilities for the chainmask
+ */
+
+#define WMI_SUPPORT_CHAN_WIDTH_20_GET(flags) WMI_GET_BITS(flags, 0, 1)
+#define WMI_SUPPORT_CHAN_WIDTH_20_SET(flags, value) WMI_SET_BITS(flags, 0, 1, value)
+
+#define WMI_SUPPORT_CHAN_WIDTH_40_GET(flags) WMI_GET_BITS(flags, 1, 1)
+#define WMI_SUPPORT_CHAN_WIDTH_40_SET(flags, value) WMI_SET_BITS(flags, 1, 1, value)
+
+#define WMI_SUPPORT_CHAN_WIDTH_80_GET(flags) WMI_GET_BITS(flags, 2, 1)
+#define WMI_SUPPORT_CHAN_WIDTH_80_SET(flags, value) WMI_SET_BITS(flags, 2, 1, value)
+
+#define WMI_SUPPORT_CHAN_WIDTH_160_GET(flags) WMI_GET_BITS(flags, 3, 1)
+#define WMI_SUPPORT_CHAN_WIDTH_160_SET(flags, value) WMI_SET_BITS(flags, 3, 1, value)
+
+#define WMI_SUPPORT_CHAN_WIDTH_80P80_GET(flags) WMI_GET_BITS(flags, 4, 1)
+#define WMI_SUPPORT_CHAN_WIDTH_80P80_SET(flags, value) WMI_SET_BITS(flags, 4, 1, value)
+
+#define WMI_SUPPORT_CHAIN_MASK_2G_GET(flags) WMI_GET_BITS(flags, 27, 1)
+#define WMI_SUPPORT_CHAIN_MASK_2G_SET(flags, value) WMI_SET_BITS(flags, 27, 1, value)
+
+#define WMI_SUPPORT_CHAIN_MASK_5G_GET(flags) WMI_GET_BITS(flags, 28, 1)
+#define WMI_SUPPORT_CHAIN_MASK_5G_SET(flags, value) WMI_SET_BITS(flags, 28, 1, value)
+
+#define WMI_SUPPORT_CHAIN_MASK_TX_GET(flags) WMI_GET_BITS(flags, 29, 1)
+#define WMI_SUPPORT_CHAIN_MASK_TX_SET(flags, value) WMI_SET_BITS(flags, 29, 1, value)
+
+#define WMI_SUPPORT_CHAIN_MASK_RX_GET(flags) WMI_GET_BITS(flags, 30, 1)
+#define WMI_SUPPORT_CHAIN_MASK_RX_SET(flags, value) WMI_SET_BITS(flags, 30, 1, value)
+
+#define WMI_SUPPORT_CHAIN_MASK_ADFS_GET(flags) WMI_GET_BITS(flags, 31, 1)
+#define WMI_SUPPORT_CHAIN_MASK_ADFS_SET(flags, value) WMI_SET_BITS(flags, 31, 1, value)
+
+/* Definition of valid chainmask and associated capabilities */
+typedef struct {
+    /* TLV tag and len; tag equals WMITLV_TAG_STRUC_WMI_MAC_PHY_CHAINMASK_CAPABILITY */
+    A_UINT32 tlv_header;
+    /* supported flags: Capabilities for this chianmask*/
+    union {
+        struct {
+            A_UINT32 supports_chan_width_20:1,
+                     supports_chan_width_40:1,
+                     supports_chan_width_80:1,
+                     supports_chan_width_160:1,
+                     supports_chan_width_80P80:1,
+                     reserved:22, /* bits 26:5 */
+                     chain_mask_2G:1,
+                     chain_mask_5G:1,
+                     chain_mask_tx:1,
+                     chain_mask_rx:1,
+                     supports_aDFS:1; /* agile DFS */
+        };
+        A_UINT32 supported_flags;
+    };
+    A_UINT32 chainmask;
+} WMI_MAC_PHY_CHAINMASK_CAPABILITY;
+
+typedef struct {
+    /* TLV tag and len; tag equals WMITLV_TAG_STRUC_WMI_MAC_PHY_CHAINMASK_COMBO */
+    A_UINT32 tlv_header;
+    A_UINT32 chainmask_table_id;
+    /* Number of vaild Chainmask in the table */
+    A_UINT32 num_valid_chainmask;
+    /*
+     * This TLV is followed by the below TLVs:
+     * WMI_MAC_PHY_CHAINMASK_CAPABILITY mac_phy_chainmask_caps[num_valid_chainmask]
+     */
+} WMI_MAC_PHY_CHAINMASK_COMBO;
+
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_WMI_SOC_MAC_PHY_HW_MODE_CAPS */
     /* num HW modes */
     A_UINT32 num_hw_modes;
-    /* num_hw_modes WMI_HW_MODE_CAPABILITIES TLV's */
+    /* number of unique chainmask combo tables */
+    A_UINT32 num_chainmask_tables;
+    /*
+     * This TLV is followed by the below TLVs:
+     *
+     * WMI_HW_MODE_CAPABILITIES soc_hw_mode_caps[num_hw_modes]
+     *
+     * (intervening TLVs, e.g. HW_MODE_CAPS, MAC_PHY_CAPS, HAL_REG_CAPS)
+     *
+     * WMI_MAC_PHY_CHAINMASK_COMBO mac_phy_chainmask_combo[num_chainmask_tables]
+     * // number of chainmasks specified in mac_phy_chainmask_combo[0]
+     * WMI_MAC_PHY_CHAINMASK_CAPABILITY mac_phy_chainmask_caps[num_valid_chainmask0]
+     * // number of chainmasks specified in mac_phy_chainmask_combo[1]
+     * WMI_MAC_PHY_CHAINMASK_CAPABILITY mac_phy_chainmask_caps[num_valid_chainmask1]
+     * // number of chainmasks specified in mac_phy_chainmask_combo[2]
+     * WMI_MAC_PHY_CHAINMASK_CAPABILITY mac_phy_chainmask_caps[num_valid_chainmask2]
+     * etc.
+     */
 } WMI_SOC_MAC_PHY_HW_MODE_CAPS;
 
 /*Below are Reg caps per PHY. Please note PHY ID starts with 0.*/
@@ -16566,6 +20228,17 @@ typedef struct {
 } WMI_SOC_HAL_REG_CAPABILITIES;
 
 typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_WMI_OEM_DMA_RING_CAPABILITIES */
+    A_UINT32 pdev_id;
+    A_UINT32 min_num_ptr;
+    /* Minimum number of pointers in the OEM DMA ring for this pdev */
+    A_UINT32 min_buf_size;
+    /* Minimum size in bytes of each buffer in the OEM DMA ring */
+    A_UINT32 min_buf_align;
+    /* Minimum alignment in bytes of each buffer in the OEM DMA ring */
+} WMI_OEM_DMA_RING_CAPABILITIES;
+
+typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_scan_adaptive_dwell_parameters_tlv */
     /** global default adaptive dwell mode, used when WMI_SCAN_DWELL_MODE_DEFAULT */
     A_UINT32 default_adaptive_dwell_mode;
@@ -16581,12 +20254,872 @@ typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_scan_adaptive_dwell_config_fixed_param */
     /* globally enable/disable adaptive dwell */
     A_UINT32 enable;
+    /**
+     * pdev_id for identifying the MAC. See macros starting with
+     * WMI_PDEV_ID_ for values. In non-DBDC case host should set it to 0
+     */
+    A_UINT32 pdev_id;
+    /**
+     * followed by TLV (tag length value) parameters array
+     * The TLV's are:
+     * wmi_scan_adaptive_dwell_parameters_tlv param[]; (0 or 1 elements)
+     */
+} wmi_scan_adaptive_dwell_config_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_scan_dbs_duty_cycle_param_tlv */
+    /**  module_id **/
+    A_UINT32 module_id;
+   /** number of dbs scans */
+    A_UINT32 num_dbs_scans;
+   /** number of non-dbs scans */
+    A_UINT32 num_non_dbs_scans;
+} wmi_scan_dbs_duty_cycle_tlv_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_scan_dbs_duty_cycle_fixed_param */
+    /* number of scan client dutycycle param elements */
+    A_UINT32 num_clients;
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     * In non-DBDC case host should set it to 0
+     */
+    A_UINT32 pdev_id;
 /**
  * followed by TLV (tag length value) parameters array
  * The TLV's are:
- * wmi_scan_adaptive_dwell_parameters_tlv param[]; (0 or 1 elements)
+ * wmi_scan_selection_duty_cycle_tlv_param[num_clients];
  */
-} wmi_scan_adaptive_dwell_config_fixed_param;
+} wmi_scan_dbs_duty_cycle_fixed_param;
+
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_therm_throt_level_config_info */
+    A_UINT32 tlv_header;
+    /**
+      * temperature sensor value in celsius when to exit to lower zone,
+      * this value can be lower than HWM of lower zone as zone overlapping
+      * is permitted by design to provide hysteresis
+      */
+    A_UINT32 temp_lwm;
+    /**
+      * temperature sensor value in celsius when to exit to higher zone,
+      * this value can be higher than LWM of higher zone as zone overlapping
+      * is permitted by design to provide hysteresis
+      */
+    A_UINT32 temp_hwm;
+    A_UINT32 dc_off_percent; /* duty cycle off percent 0-100. 0 means no off, 100 means no on (shutdown the phy) */
+    /** Disable only the transmit queues in firmware that have lower priority than value defined by prio
+       *    Prioritization:
+       *    0 = disable all data tx queues, No Prioritization defined
+       *    1 = disable BK tx queue
+       *    2 = disable BK+BE tx queues
+       *    3 = disable BK+BE+VI tx queues
+       */
+    A_UINT32 prio;
+} wmi_therm_throt_level_config_info;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_therm_throt_config_request_fixed_param */
+    A_UINT32 pdev_id;          /* config for each pdev */
+    A_UINT32 enable;           /* 0:disable, 1:enable */
+    A_UINT32 dc;               /* duty cycle in ms */
+    A_UINT32 dc_per_event;     /* how often (after how many duty cycles) the FW sends stats to host */
+    A_UINT32 therm_throt_levels; /* Indicates the number of thermal zone configuration */
+    /*
+     * Following this structure is the TLV:
+     * struct wmi_therm_throt_level_config_info therm_throt_level_config_info[therm_throt_levels];
+     */
+} wmi_therm_throt_config_request_fixed_param;
+
+/** FW response with the stats event id for every pdev and zones */
+typedef struct {
+    /*  TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_therm_throt_stats_event_fixed_param */
+    A_UINT32 tlv_header;
+    A_UINT32 pdev_id;            /* stats for corresponding pdev*/
+    A_UINT32 temp;               /* Temperature reading in celsius */
+    A_UINT32 level;              /* current thermal throttling level */
+    A_UINT32 therm_throt_levels; /* number of levels in therm_throt_level_stats_info */
+    /* This TLV is followed by another TLV of array of structs
+     * wmi_therm_throt_level_stats_info therm_throt_level_stats_info[therm_throt_levels];
+     */
+} wmi_therm_throt_stats_event_fixed_param;
+
+
+
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_therm_throt_level_stats_info */
+    A_UINT32 tlv_header;
+    A_UINT32 level_count; /* count of each time thermal throttling entered this state */
+    A_UINT32 dc_count;    /* total number of duty cycles spent in this state. */
+                          /* this number increments by one each time we are in this state and we finish one full duty cycle. */
+} wmi_therm_throt_level_stats_info;
+
+typedef enum {
+    WMI_REG_EXT_FCC_MIDBAND = 0,
+    WMI_REG_EXT_JAPAN_MIDBAND = 1,
+    WMI_REG_EXT_FCC_DFS_HT40 = 2,
+    WMI_REG_EXT_JAPAN_NONDFS_HT40 = 3,
+    WMI_REG_EXT_JAPAN_DFS_HT40 = 4,
+    WMI_REG_EXT_FCC_CH_144 = 5,
+} WMI_REG_EXT_BITMAP;
+
+#ifdef WMI_CMD_STRINGS
+static INLINE A_UINT8 *wmi_id_to_name(A_UINT32 wmi_command)
+{
+	switch (wmi_command) {
+		/* initialize the wlan sub system */
+		WMI_RETURN_STRING(WMI_INIT_CMDID);
+
+		/* Scan specific commands */
+
+		/* start scan request to FW  */
+		WMI_RETURN_STRING(WMI_START_SCAN_CMDID);
+		/* stop scan request to FW  */
+		WMI_RETURN_STRING(WMI_STOP_SCAN_CMDID);
+		/* full list of channels as defined by the regulatory
+		* that will be used by scanner   */
+		WMI_RETURN_STRING(WMI_SCAN_CHAN_LIST_CMDID);
+		/* overwrite default priority table in scan scheduler */
+		WMI_RETURN_STRING(WMI_SCAN_SCH_PRIO_TBL_CMDID);
+		/* This command to adjust the priority and min.max_rest_time
+		* of an on ongoing scan request.
+		*/
+		WMI_RETURN_STRING(WMI_SCAN_UPDATE_REQUEST_CMDID);
+
+		/* PDEV(physical device) specific commands */
+		/* set regulatorty ctl id used by FW to determine the exact
+		* ctl power limits */
+		WMI_RETURN_STRING(WMI_PDEV_SET_REGDOMAIN_CMDID);
+		/* set channel. mainly used for supporting monitor mode */
+		WMI_RETURN_STRING(WMI_PDEV_SET_CHANNEL_CMDID);
+		/* set pdev specific parameters */
+		WMI_RETURN_STRING(WMI_PDEV_SET_PARAM_CMDID);
+		/* enable packet log */
+		WMI_RETURN_STRING(WMI_PDEV_PKTLOG_ENABLE_CMDID);
+		/* disable packet log*/
+		WMI_RETURN_STRING(WMI_PDEV_PKTLOG_DISABLE_CMDID);
+		/* set wmm parameters */
+		WMI_RETURN_STRING(WMI_PDEV_SET_WMM_PARAMS_CMDID);
+		/* set HT cap ie that needs to be carried probe requests
+		* HT/VHT channels */
+		WMI_RETURN_STRING(WMI_PDEV_SET_HT_CAP_IE_CMDID);
+		/* set VHT cap ie that needs to be carried on probe
+		* requests on VHT channels */
+		WMI_RETURN_STRING(WMI_PDEV_SET_VHT_CAP_IE_CMDID);
+
+		/* Command to send the DSCP-to-TID map to the target */
+		WMI_RETURN_STRING(WMI_PDEV_SET_DSCP_TID_MAP_CMDID);
+		/* set quiet ie parameters. primarily used in AP mode */
+		WMI_RETURN_STRING(WMI_PDEV_SET_QUIET_MODE_CMDID);
+		/* Enable/Disable Green AP Power Save  */
+		WMI_RETURN_STRING(WMI_PDEV_GREEN_AP_PS_ENABLE_CMDID);
+		/* get TPC config for the current operating channel */
+		WMI_RETURN_STRING(WMI_PDEV_GET_TPC_CONFIG_CMDID);
+
+		/* set the base MAC address for the physical device before
+		* a VDEV is created. For firmware that does not support
+		* this feature and this command, the pdev MAC address will
+		* not be changed. */
+		WMI_RETURN_STRING(WMI_PDEV_SET_BASE_MACADDR_CMDID);
+
+		/* eeprom content dump , the same to bdboard data */
+		WMI_RETURN_STRING(WMI_PDEV_DUMP_CMDID);
+
+		/* VDEV(virtual device) specific commands */
+		/* vdev create */
+		WMI_RETURN_STRING(WMI_VDEV_CREATE_CMDID);
+		/* vdev delete */
+		WMI_RETURN_STRING(WMI_VDEV_DELETE_CMDID);
+		/* vdev start request */
+		WMI_RETURN_STRING(WMI_VDEV_START_REQUEST_CMDID);
+		/* vdev restart request (RX only, NO TX, used for CAC period)*/
+		WMI_RETURN_STRING(WMI_VDEV_RESTART_REQUEST_CMDID);
+		/* vdev up request */
+		WMI_RETURN_STRING(WMI_VDEV_UP_CMDID);
+		/* vdev stop request */
+		WMI_RETURN_STRING(WMI_VDEV_STOP_CMDID);
+		/* vdev down request */
+		WMI_RETURN_STRING(WMI_VDEV_DOWN_CMDID);
+		/* set a vdev param */
+		WMI_RETURN_STRING(WMI_VDEV_SET_PARAM_CMDID);
+		/* set a key (used for setting per peer unicast
+		* and per vdev multicast) */
+		WMI_RETURN_STRING(WMI_VDEV_INSTALL_KEY_CMDID);
+
+		/* wnm sleep mode command */
+		WMI_RETURN_STRING(WMI_VDEV_WNM_SLEEPMODE_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_WMM_ADDTS_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_WMM_DELTS_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_SET_WMM_PARAMS_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_SET_GTX_PARAMS_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_IPSEC_NATKEEPALIVE_FILTER_CMDID);
+
+		WMI_RETURN_STRING(WMI_VDEV_PLMREQ_START_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_PLMREQ_STOP_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_TSF_TSTAMP_ACTION_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_SET_IE_CMDID);
+
+		/* peer specific commands */
+
+		/** create a peer */
+		WMI_RETURN_STRING(WMI_PEER_CREATE_CMDID);
+		/** delete a peer */
+		WMI_RETURN_STRING(WMI_PEER_DELETE_CMDID);
+		/** flush specific  tid queues of a peer */
+		WMI_RETURN_STRING(WMI_PEER_FLUSH_TIDS_CMDID);
+		/** set a parameter of a peer */
+		WMI_RETURN_STRING(WMI_PEER_SET_PARAM_CMDID);
+		/* set peer to associated state. will cary all parameters
+		* determined during assocication time */
+		WMI_RETURN_STRING(WMI_PEER_ASSOC_CMDID);
+		/* add a wds  (4 address ) entry. used only for testing
+		* WDS feature on AP products */
+		WMI_RETURN_STRING(WMI_PEER_ADD_WDS_ENTRY_CMDID);
+		/* remove wds  (4 address ) entry. used only for testing WDS
+		* feature on AP products */
+		WMI_RETURN_STRING(WMI_PEER_REMOVE_WDS_ENTRY_CMDID);
+		/* set up mcast info for multicast to unicast conversion */
+		WMI_RETURN_STRING(WMI_PEER_MCAST_GROUP_CMDID);
+		/* request peer info from FW to get PEER_INFO_EVENTID */
+		WMI_RETURN_STRING(WMI_PEER_INFO_REQ_CMDID);
+
+		/* beacon/management specific commands */
+
+		/* transmit beacon by reference. used for transmitting beacon
+		* on low latency interface like pcie */
+		WMI_RETURN_STRING(WMI_BCN_TX_CMDID);
+		/* transmit beacon by value */
+		WMI_RETURN_STRING(WMI_PDEV_SEND_BCN_CMDID);
+		/* set the beacon template. used in beacon offload mode to setup
+		* the common beacon template with the FW to be used by FW to
+		* generate beacons */
+		WMI_RETURN_STRING(WMI_BCN_TMPL_CMDID);
+		/* set beacon filter with FW */
+		WMI_RETURN_STRING(WMI_BCN_FILTER_RX_CMDID);
+		/* enable/disable filtering of probe requests in the firmware */
+		WMI_RETURN_STRING(WMI_PRB_REQ_FILTER_RX_CMDID);
+		/* transmit management frame by value. will be deprecated */
+		WMI_RETURN_STRING(WMI_MGMT_TX_CMDID);
+		/* set the probe response template. used in beacon offload mode
+		* to setup the common probe response template with the FW to
+		* be used by FW to generate probe responses */
+		WMI_RETURN_STRING(WMI_PRB_TMPL_CMDID);
+
+		/* commands to directly control ba negotiation directly from
+		* host. only used in test mode */
+
+		/* turn off FW Auto addba mode and let host control addba */
+		WMI_RETURN_STRING(WMI_ADDBA_CLEAR_RESP_CMDID);
+		/* send add ba request */
+		WMI_RETURN_STRING(WMI_ADDBA_SEND_CMDID);
+		WMI_RETURN_STRING(WMI_ADDBA_STATUS_CMDID);
+		/* send del ba */
+		WMI_RETURN_STRING(WMI_DELBA_SEND_CMDID);
+		/* set add ba response will be used by FW to generate
+		* addba response*/
+		WMI_RETURN_STRING(WMI_ADDBA_SET_RESP_CMDID);
+		/* send single VHT MPDU with AMSDU */
+		WMI_RETURN_STRING(WMI_SEND_SINGLEAMSDU_CMDID);
+
+		/* Station power save specific config */
+		/* enable/disable station powersave */
+		WMI_RETURN_STRING(WMI_STA_POWERSAVE_MODE_CMDID);
+		/* set station power save specific parameter */
+		WMI_RETURN_STRING(WMI_STA_POWERSAVE_PARAM_CMDID);
+		/* set station mimo powersave mode */
+		WMI_RETURN_STRING(WMI_STA_MIMO_PS_MODE_CMDID);
+
+		/* DFS-specific commands */
+		/* enable DFS (radar detection)*/
+		WMI_RETURN_STRING(WMI_PDEV_DFS_ENABLE_CMDID);
+		/* disable DFS (radar detection)*/
+		WMI_RETURN_STRING(WMI_PDEV_DFS_DISABLE_CMDID);
+		/* enable DFS phyerr/parse filter offload */
+		WMI_RETURN_STRING(WMI_DFS_PHYERR_FILTER_ENA_CMDID);
+		/* enable DFS phyerr/parse filter offload */
+		WMI_RETURN_STRING(WMI_DFS_PHYERR_FILTER_DIS_CMDID);
+
+		/* Roaming specific  commands */
+		/* set roam scan mode */
+		WMI_RETURN_STRING(WMI_ROAM_SCAN_MODE);
+		/* set roam scan rssi threshold below which roam
+		* scan is enabled  */
+		WMI_RETURN_STRING(WMI_ROAM_SCAN_RSSI_THRESHOLD);
+		/* set roam scan period for periodic roam scan mode  */
+		WMI_RETURN_STRING(WMI_ROAM_SCAN_PERIOD);
+		/* set roam scan trigger rssi change threshold   */
+		WMI_RETURN_STRING(WMI_ROAM_SCAN_RSSI_CHANGE_THRESHOLD);
+		/* set roam AP profile   */
+		WMI_RETURN_STRING(WMI_ROAM_AP_PROFILE);
+		/* set channel list for roam scans */
+		WMI_RETURN_STRING(WMI_ROAM_CHAN_LIST);
+		/* offload scan specific commands */
+		/* set offload scan AP profile   */
+		WMI_RETURN_STRING(WMI_OFL_SCAN_ADD_AP_PROFILE);
+		/* remove offload scan AP profile   */
+		WMI_RETURN_STRING(WMI_OFL_SCAN_REMOVE_AP_PROFILE);
+		/* set offload scan period   */
+		WMI_RETURN_STRING(WMI_OFL_SCAN_PERIOD);
+
+		/* P2P specific commands */
+		/* set P2P device info. FW will used by FW to create P2P IE
+		* to be carried in probe response generated during p2p listen
+		* and for p2p discoverability  */
+		WMI_RETURN_STRING(WMI_P2P_DEV_SET_DEVICE_INFO);
+		/* enable/disable p2p discoverability on STA/AP VDEVs  */
+		WMI_RETURN_STRING(WMI_P2P_DEV_SET_DISCOVERABILITY);
+		/* set p2p ie to be carried in beacons generated by FW for GO */
+		WMI_RETURN_STRING(WMI_P2P_GO_SET_BEACON_IE);
+		/* set p2p ie to be carried in probe response frames generated
+		* by FW for GO  */
+		WMI_RETURN_STRING(WMI_P2P_GO_SET_PROBE_RESP_IE);
+		/* set the vendor specific p2p ie data.
+		* FW will use this to parse the P2P NoA
+		* attribute in the beacons/probe responses received.
+		*/
+		WMI_RETURN_STRING(WMI_P2P_SET_VENDOR_IE_DATA_CMDID);
+		/* set the configure of p2p find offload */
+		WMI_RETURN_STRING(WMI_P2P_DISC_OFFLOAD_CONFIG_CMDID);
+		/* set the vendor specific p2p ie data for p2p find offload */
+		WMI_RETURN_STRING(WMI_P2P_DISC_OFFLOAD_APPIE_CMDID);
+		/* set the BSSID/device name pattern of p2p find offload */
+		WMI_RETURN_STRING(WMI_P2P_DISC_OFFLOAD_PATTERN_CMDID);
+		/* set OppPS related parameters **/
+		WMI_RETURN_STRING(WMI_P2P_SET_OPPPS_PARAM_CMDID);
+
+		/* AP power save specific config
+		* set AP power save specific param */
+		WMI_RETURN_STRING(WMI_AP_PS_PEER_PARAM_CMDID);
+		/* set AP UAPSD coex pecific param */
+		WMI_RETURN_STRING(WMI_AP_PS_PEER_UAPSD_COEX_CMDID);
+
+		/* Rate-control specific commands */
+		WMI_RETURN_STRING(WMI_PEER_RATE_RETRY_SCHED_CMDID);
+
+		/* WLAN Profiling commands. */
+		WMI_RETURN_STRING(WMI_WLAN_PROFILE_TRIGGER_CMDID);
+		WMI_RETURN_STRING(WMI_WLAN_PROFILE_SET_HIST_INTVL_CMDID);
+		WMI_RETURN_STRING(WMI_WLAN_PROFILE_GET_PROFILE_DATA_CMDID);
+		WMI_RETURN_STRING(WMI_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID);
+		WMI_RETURN_STRING(WMI_WLAN_PROFILE_LIST_PROFILE_ID_CMDID);
+
+		/* Suspend resume command Ids */
+		WMI_RETURN_STRING(WMI_PDEV_SUSPEND_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_RESUME_CMDID);
+
+		/* Beacon filter commands */
+		/* add a beacon filter */
+		WMI_RETURN_STRING(WMI_ADD_BCN_FILTER_CMDID);
+		/* remove a  beacon filter */
+		WMI_RETURN_STRING(WMI_RMV_BCN_FILTER_CMDID);
+
+		/* WOW Specific WMI commands */
+		/* add pattern for awake */
+		WMI_RETURN_STRING(WMI_WOW_ADD_WAKE_PATTERN_CMDID);
+		/* deleta a wake pattern */
+		WMI_RETURN_STRING(WMI_WOW_DEL_WAKE_PATTERN_CMDID);
+		/* enable/deisable wake event  */
+		WMI_RETURN_STRING(WMI_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID);
+		/* enable WOW  */
+		WMI_RETURN_STRING(WMI_WOW_ENABLE_CMDID);
+		/* host woke up from sleep event to FW. Generated in response
+		* to WOW Hardware event */
+		WMI_RETURN_STRING(WMI_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID);
+
+		/* RTT measurement related cmd */
+		/* reques to make an RTT measurement */
+		WMI_RETURN_STRING(WMI_RTT_MEASREQ_CMDID);
+		/* reques to report a tsf measurement */
+		WMI_RETURN_STRING(WMI_RTT_TSF_CMDID);
+
+		/* spectral scan command */
+		/* configure spectral scan */
+		WMI_RETURN_STRING(WMI_VDEV_SPECTRAL_SCAN_CONFIGURE_CMDID);
+		/* enable/disable spectral scan and trigger */
+		WMI_RETURN_STRING(WMI_VDEV_SPECTRAL_SCAN_ENABLE_CMDID);
+
+		/* F/W stats */
+		/* one time request for stats */
+		WMI_RETURN_STRING(WMI_REQUEST_STATS_CMDID);
+		/* Push MCC Adaptive Scheduler Stats to Firmware */
+		WMI_RETURN_STRING(WMI_MCC_SCHED_TRAFFIC_STATS_CMDID);
+
+		/* ARP OFFLOAD REQUEST*/
+		WMI_RETURN_STRING(WMI_SET_ARP_NS_OFFLOAD_CMDID);
+
+		/* Proactive ARP Response Add Pattern Command*/
+		WMI_RETURN_STRING(WMI_ADD_PROACTIVE_ARP_RSP_PATTERN_CMDID);
+
+		/* Proactive ARP Response Del Pattern Command*/
+		WMI_RETURN_STRING(WMI_DEL_PROACTIVE_ARP_RSP_PATTERN_CMDID);
+
+		/* NS offload confid*/
+		WMI_RETURN_STRING(WMI_NETWORK_LIST_OFFLOAD_CONFIG_CMDID);
+
+		/* GTK offload Specific WMI commands */
+		WMI_RETURN_STRING(WMI_GTK_OFFLOAD_CMDID);
+
+		/* CSA offload Specific WMI commands */
+		/* csa offload enable */
+		WMI_RETURN_STRING(WMI_CSA_OFFLOAD_ENABLE_CMDID);
+		/* chan switch command */
+		WMI_RETURN_STRING(WMI_CSA_OFFLOAD_CHANSWITCH_CMDID);
+
+		/* Chatter commands */
+		/* Change chatter mode of operation */
+		WMI_RETURN_STRING(WMI_CHATTER_SET_MODE_CMDID);
+		/* chatter add coalescing filter command */
+		WMI_RETURN_STRING(WMI_CHATTER_ADD_COALESCING_FILTER_CMDID);
+		/* chatter delete coalescing filter command */
+		WMI_RETURN_STRING(WMI_CHATTER_DELETE_COALESCING_FILTER_CMDID);
+		/* chatter coalecing query command */
+		WMI_RETURN_STRING(WMI_CHATTER_COALESCING_QUERY_CMDID);
+
+		/* addba specific commands */
+		/* start the aggregation on this TID */
+		WMI_RETURN_STRING(WMI_PEER_TID_ADDBA_CMDID);
+		/* stop the aggregation on this TID */
+		WMI_RETURN_STRING(WMI_PEER_TID_DELBA_CMDID);
+
+		/* set station mimo powersave method */
+		WMI_RETURN_STRING(WMI_STA_DTIM_PS_METHOD_CMDID);
+		/* Configure the Station UAPSD AC Auto Trigger Parameters */
+		WMI_RETURN_STRING(WMI_STA_UAPSD_AUTO_TRIG_CMDID);
+		/* Configure the Keep Alive Parameters */
+		WMI_RETURN_STRING(WMI_STA_KEEPALIVE_CMDID);
+
+		/* Request ssn from target for a sta/tid pair */
+		WMI_RETURN_STRING(WMI_BA_REQ_SSN_CMDID);
+		/* misc command group */
+		/* echo command mainly used for testing */
+		WMI_RETURN_STRING(WMI_ECHO_CMDID);
+
+		/* !!IMPORTANT!!
+		* If you need to add a new WMI command to the
+		* WMI_RETURN_STRING(WMI_GRP_MISC) sub-group,
+		* please make sure you add it BEHIND
+		* WMI_RETURN_STRING(WMI_PDEV_UTF_CMDID);
+		* as we MUST have a fixed value here to maintain compatibility between
+		* UTF and the ART2 driver
+		*/
+		/* UTF WMI commands */
+		WMI_RETURN_STRING(WMI_PDEV_UTF_CMDID);
+
+		/* set debug log config */
+		WMI_RETURN_STRING(WMI_DBGLOG_CFG_CMDID);
+		/* QVIT specific command id */
+		WMI_RETURN_STRING(WMI_PDEV_QVIT_CMDID);
+		/* Factory Testing Mode request command
+		* used for integrated chipsets */
+		WMI_RETURN_STRING(WMI_PDEV_FTM_INTG_CMDID);
+		/* set and get keepalive parameters command */
+		WMI_RETURN_STRING(WMI_VDEV_SET_KEEPALIVE_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_GET_KEEPALIVE_CMDID);
+		/* For fw recovery test command */
+		WMI_RETURN_STRING(WMI_FORCE_FW_HANG_CMDID);
+		/* Set Mcast/Bdcast filter */
+		WMI_RETURN_STRING(WMI_SET_MCASTBCAST_FILTER_CMDID);
+		/* set thermal management params */
+		WMI_RETURN_STRING(WMI_THERMAL_MGMT_CMDID);
+		WMI_RETURN_STRING(WMI_RSSI_BREACH_MONITOR_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_LRO_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_TRANSFER_DATA_TO_FLASH_CMDID);
+		WMI_RETURN_STRING(WMI_CONFIG_ENHANCED_MCAST_FILTER_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_WISA_CMDID);
+		WMI_RETURN_STRING(WMI_SCAN_ADAPTIVE_DWELL_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_WOW_SET_ACTION_WAKE_UP_CMDID);
+		WMI_RETURN_STRING(WMI_MAWC_SENSOR_REPORT_IND_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_CONFIGURE_MAWC_CMDID);
+		WMI_RETURN_STRING(WMI_NLO_CONFIGURE_MAWC_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_CONFIGURE_MAWC_CMDID);
+		/* GPIO Configuration */
+		WMI_RETURN_STRING(WMI_GPIO_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_GPIO_OUTPUT_CMDID);
+
+		/* Txbf configuration command */
+		WMI_RETURN_STRING(WMI_TXBF_CMDID);
+
+		/* FWTEST Commands */
+		WMI_RETURN_STRING(WMI_FWTEST_VDEV_MCC_SET_TBTT_MODE_CMDID);
+		/* set NoA descs */
+		WMI_RETURN_STRING(WMI_FWTEST_P2P_SET_NOA_PARAM_CMDID);
+
+		/* TDLS Configuration */
+		/* enable/disable TDLS */
+		WMI_RETURN_STRING(WMI_TDLS_SET_STATE_CMDID);
+		/* set tdls peer state */
+		WMI_RETURN_STRING(WMI_TDLS_PEER_UPDATE_CMDID);
+
+		/* Resmgr Configuration */
+		/* Adaptive OCS is enabled by default in the FW.
+		* This command is used to disable FW based adaptive OCS.
+		*/
+		WMI_RETURN_STRING
+			(WMI_RESMGR_ADAPTIVE_OCS_ENABLE_DISABLE_CMDID);
+		/* set the requested channel time quota for the home channels */
+		WMI_RETURN_STRING(WMI_RESMGR_SET_CHAN_TIME_QUOTA_CMDID);
+		/* set the requested latency for the home channels */
+		WMI_RETURN_STRING(WMI_RESMGR_SET_CHAN_LATENCY_CMDID);
+
+		/* STA SMPS Configuration */
+		/* force SMPS mode */
+		WMI_RETURN_STRING(WMI_STA_SMPS_FORCE_MODE_CMDID);
+		/* set SMPS parameters */
+		WMI_RETURN_STRING(WMI_STA_SMPS_PARAM_CMDID);
+
+		/* Wlan HB commands */
+		/* enalbe/disable wlan HB */
+		WMI_RETURN_STRING(WMI_HB_SET_ENABLE_CMDID);
+		/* set tcp parameters for wlan HB */
+		WMI_RETURN_STRING(WMI_HB_SET_TCP_PARAMS_CMDID);
+		/* set tcp pkt filter for wlan HB */
+		WMI_RETURN_STRING(WMI_HB_SET_TCP_PKT_FILTER_CMDID);
+		/* set udp parameters for wlan HB */
+		WMI_RETURN_STRING(WMI_HB_SET_UDP_PARAMS_CMDID);
+		/* set udp pkt filter for wlan HB */
+		WMI_RETURN_STRING(WMI_HB_SET_UDP_PKT_FILTER_CMDID);
+
+		/* Wlan RMC commands*/
+		/* enable/disable RMC */
+		WMI_RETURN_STRING(WMI_RMC_SET_MODE_CMDID);
+		/* configure action frame period */
+		WMI_RETURN_STRING(WMI_RMC_SET_ACTION_PERIOD_CMDID);
+		/* For debug/future enhancement purposes only,
+		* configures/finetunes RMC algorithms */
+		WMI_RETURN_STRING(WMI_RMC_CONFIG_CMDID);
+
+		/* WLAN MHF offload commands */
+		/* enable/disable MHF offload */
+		WMI_RETURN_STRING(WMI_MHF_OFFLOAD_SET_MODE_CMDID);
+		/* Plumb routing table for MHF offload */
+		WMI_RETURN_STRING(WMI_MHF_OFFLOAD_PLUMB_ROUTING_TBL_CMDID);
+
+		/* location scan commands */
+		/* start batch scan */
+		WMI_RETURN_STRING(WMI_BATCH_SCAN_ENABLE_CMDID);
+		/* stop batch scan */
+		WMI_RETURN_STRING(WMI_BATCH_SCAN_DISABLE_CMDID);
+		/* get batch scan result */
+		WMI_RETURN_STRING(WMI_BATCH_SCAN_TRIGGER_RESULT_CMDID);
+		/* OEM related cmd */
+		WMI_RETURN_STRING(WMI_OEM_REQ_CMDID);
+		WMI_RETURN_STRING(WMI_OEM_REQUEST_CMDID);
+		/* NAN request cmd */
+		WMI_RETURN_STRING(WMI_NAN_CMDID);
+		/* Modem power state cmd */
+		WMI_RETURN_STRING(WMI_MODEM_POWER_STATE_CMDID);
+		WMI_RETURN_STRING(WMI_REQUEST_STATS_EXT_CMDID);
+		WMI_RETURN_STRING(WMI_OBSS_SCAN_ENABLE_CMDID);
+		WMI_RETURN_STRING(WMI_OBSS_SCAN_DISABLE_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_GET_ESTIMATED_LINKSPEED_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_SCAN_CMD);
+		WMI_RETURN_STRING(WMI_PDEV_SET_LED_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_HOST_AUTO_SHUTDOWN_CFG_CMDID);
+		WMI_RETURN_STRING(WMI_CHAN_AVOID_UPDATE_CMDID);
+		WMI_RETURN_STRING(WMI_COEX_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_WOW_IOAC_ADD_KEEPALIVE_CMDID);
+		WMI_RETURN_STRING(WMI_WOW_IOAC_DEL_KEEPALIVE_CMDID);
+		WMI_RETURN_STRING(WMI_WOW_IOAC_ADD_WAKE_PATTERN_CMDID);
+		WMI_RETURN_STRING(WMI_WOW_IOAC_DEL_WAKE_PATTERN_CMDID);
+		WMI_RETURN_STRING(WMI_REQUEST_LINK_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_START_LINK_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_CLEAR_LINK_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_GET_FW_MEM_DUMP_CMDID);
+		WMI_RETURN_STRING(WMI_LPI_MGMT_SNOOPING_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_LPI_START_SCAN_CMDID);
+		WMI_RETURN_STRING(WMI_LPI_STOP_SCAN_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_START_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_STOP_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_CONFIGURE_WLAN_CHANGE_MONITOR_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_CONFIGURE_HOTLIST_MONITOR_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_GET_CACHED_RESULTS_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_GET_WLAN_CHANGE_RESULTS_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_SET_CAPABILITIES_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_GET_CAPABILITIES_CMDID);
+		WMI_RETURN_STRING(WMI_EXTSCAN_CONFIGURE_HOTLIST_SSID_MONITOR_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_SYNCH_COMPLETE);
+		WMI_RETURN_STRING(WMI_D0_WOW_ENABLE_DISABLE_CMDID);
+		WMI_RETURN_STRING(WMI_EXTWOW_ENABLE_CMDID);
+		WMI_RETURN_STRING(WMI_EXTWOW_SET_APP_TYPE1_PARAMS_CMDID);
+		WMI_RETURN_STRING(WMI_EXTWOW_SET_APP_TYPE2_PARAMS_CMDID);
+		WMI_RETURN_STRING(WMI_UNIT_TEST_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_SET_RIC_REQUEST_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_GET_TEMPERATURE_CMDID);
+		WMI_RETURN_STRING(WMI_SET_DHCP_SERVER_OFFLOAD_CMDID);
+		WMI_RETURN_STRING(WMI_TPC_CHAINMASK_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_IPA_OFFLOAD_ENABLE_DISABLE_CMDID);
+		WMI_RETURN_STRING(WMI_SCAN_PROB_REQ_OUI_CMDID);
+		WMI_RETURN_STRING(WMI_TDLS_SET_OFFCHAN_MODE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_LED_FLASHING_CMDID);
+		WMI_RETURN_STRING(WMI_MDNS_OFFLOAD_ENABLE_CMDID);
+		WMI_RETURN_STRING(WMI_MDNS_SET_FQDN_CMDID);
+		WMI_RETURN_STRING(WMI_MDNS_SET_RESPONSE_CMDID);
+		WMI_RETURN_STRING(WMI_MDNS_GET_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_INVOKE_CMDID);
+		WMI_RETURN_STRING(WMI_SET_ANTENNA_DIVERSITY_CMDID);
+		WMI_RETURN_STRING(WMI_SAP_OFL_ENABLE_CMDID);
+		WMI_RETURN_STRING(WMI_APFIND_CMDID);
+		WMI_RETURN_STRING(WMI_PASSPOINT_LIST_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_OCB_SET_SCHED_CMDID);
+		WMI_RETURN_STRING(WMI_OCB_SET_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_OCB_SET_UTC_TIME_CMDID);
+		WMI_RETURN_STRING(WMI_OCB_START_TIMING_ADVERT_CMDID);
+		WMI_RETURN_STRING(WMI_OCB_STOP_TIMING_ADVERT_CMDID);
+		WMI_RETURN_STRING(WMI_OCB_GET_TSF_TIMER_CMDID);
+		WMI_RETURN_STRING(WMI_DCC_GET_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_DCC_CLEAR_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_DCC_UPDATE_NDL_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_FILTER_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_SUBNET_CHANGE_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_DEBUG_MESG_FLUSH_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_SET_RATE_REPORT_CONDITION_CMDID);
+		WMI_RETURN_STRING(WMI_SOC_SET_PCL_CMDID);
+		WMI_RETURN_STRING(WMI_SOC_SET_HW_MODE_CMDID);
+		WMI_RETURN_STRING(WMI_SOC_SET_DUAL_MAC_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_WOW_ENABLE_ICMPV6_NA_FLT_CMDID);
+		WMI_RETURN_STRING(WMI_DIAG_EVENT_LOG_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_PACKET_FILTER_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_PACKET_FILTER_ENABLE_CMDID);
+		WMI_RETURN_STRING(WMI_SAP_SET_BLACKLIST_PARAM_CMDID);
+		WMI_RETURN_STRING(WMI_WOW_UDP_SVC_OFLD_CMDID);
+		WMI_RETURN_STRING(WMI_MGMT_TX_SEND_CMDID);
+		WMI_RETURN_STRING(WMI_SOC_SET_ANTENNA_MODE_CMDID);
+		WMI_RETURN_STRING(WMI_WOW_HOSTWAKEUP_GPIO_PIN_PATTERN_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_AP_PS_EGAP_PARAM_CMDID);
+		WMI_RETURN_STRING(WMI_PMF_OFFLOAD_SET_SA_QUERY_CMDID);
+		WMI_RETURN_STRING(WMI_BPF_GET_CAPABILITY_CMDID);
+		WMI_RETURN_STRING(WMI_BPF_GET_VDEV_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID);
+		WMI_RETURN_STRING(WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID);
+		WMI_RETURN_STRING(WMI_NDI_GET_CAP_REQ_CMDID);
+		WMI_RETURN_STRING(WMI_NDP_INITIATOR_REQ_CMDID);
+		WMI_RETURN_STRING(WMI_NDP_RESPONDER_REQ_CMDID);
+		WMI_RETURN_STRING(WMI_NDP_END_REQ_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_UPDATE_WDS_ENTRY_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_ADD_PROXY_STA_ENTRY_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_FIPS_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SMART_ANT_ENABLE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SMART_ANT_SET_RX_ANTENNA_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_ANTENNA_SWITCH_TABLE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_CTL_TABLE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_MIMOGAIN_TABLE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_GET_TPC_CMDID);
+		WMI_RETURN_STRING(WMI_MIB_STATS_ENABLE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_GET_ANI_CCK_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_GET_ANI_OFDM_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_RATEMASK_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_ATF_REQUEST_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_SET_DSCP_TID_MAP_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_FILTER_NEIGHBOR_RX_PACKETS_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_SET_QUIET_MODE_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_SMART_ANT_SET_TX_ANTENNA_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_SMART_ANT_SET_TRAIN_INFO_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_SMART_ANT_SET_NODE_CONFIG_OPS_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_ATF_REQUEST_CMDID);
+		WMI_RETURN_STRING(WMI_FWTEST_CMDID);
+		WMI_RETURN_STRING(WMI_QBOOST_CFG_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_GET_NFCAL_POWER_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_PCL_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_HW_MODE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_MAC_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_ANTENNA_MODE_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_SET_MBO_PARAM_CMDID);
+		WMI_RETURN_STRING(WMI_CHAN_AVOID_RPT_ALLOW_CMDID);
+		WMI_RETURN_STRING(WMI_SET_PERIODIC_CHANNEL_STATS_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_SET_CUSTOM_AGGR_SIZE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_WAL_POWER_DEBUG_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_BWF_REQUEST_CMDID);
+		WMI_RETURN_STRING(WMI_DBGLOG_TIME_STAMP_SYNC_CMDID);
+		WMI_RETURN_STRING(WMI_P2P_LISTEN_OFFLOAD_START_CMDID);
+		WMI_RETURN_STRING(WMI_P2P_LISTEN_OFFLOAD_STOP_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_REORDER_QUEUE_SETUP_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_REORDER_QUEUE_REMOVE_CMDID);
+		WMI_RETURN_STRING(WMI_SET_MULTIPLE_MCAST_FILTER_CMDID);
+		WMI_RETURN_STRING(WMI_READ_DATA_FROM_FLASH_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_REORDER_TIMEOUT_VAL_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_SET_RX_BLOCKSIZE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_WAKEUP_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_GET_ANTDIV_STATUS_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_ANTDIV_INFO_REQ_CMDID);
+		WMI_RETURN_STRING(WMI_MNT_FILTER_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_GET_CHIP_POWER_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_COEX_GET_ANTENNA_ISOLATION_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_STATS_THRESHOLD_CMDID);
+		WMI_RETURN_STRING(WMI_REQUEST_WLAN_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_ENCRYPT_DECRYPT_DATA_REQ_CMDID);
+		WMI_RETURN_STRING(WMI_REQUEST_PEER_STATS_INFO_CMDID);
+		WMI_RETURN_STRING(WMI_REQUEST_RADIO_CHAN_STATS_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_PER_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_CMDID);
+		WMI_RETURN_STRING(WMI_BPF_SET_VDEV_ACTIVE_MODE_CMDID);
+		WMI_RETURN_STRING(WMI_HW_DATA_FILTER_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_MULTIPLE_VDEV_RESTART_REQUEST_CMDID);
+		WMI_RETURN_STRING(WMI_LPI_OEM_REQ_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_UPDATE_PKT_ROUTING_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_CHECK_CAL_VERSION_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_DIVERSITY_GAIN_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_SET_ARP_STAT_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_GET_ARP_STAT_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_GET_TX_POWER_CMDID);
+		WMI_RETURN_STRING(WMI_OFFCHAN_DATA_TX_SEND_CMDID);
+		WMI_RETURN_STRING(WMI_SET_INIT_COUNTRY_CMDID);
+		WMI_RETURN_STRING(WMI_SET_SCAN_DBS_DUTY_CYCLE_CMDID);
+		WMI_RETURN_STRING(WMI_THERM_THROT_SET_CONF_CMDID);
+		WMI_RETURN_STRING(WMI_OEM_DMA_RING_CFG_REQ_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_BSS_CHAN_INFO_REQUEST_CMDID);
+		WMI_RETURN_STRING(WMI_VDEV_LIMIT_OFFCHAN_CMDID);
+		WMI_RETURN_STRING(WMI_ROAM_BTM_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_WLM_CONFIG_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_UPDATE_CTLTABLE_REQUEST_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_CONFIG_VENDOR_OUI_ACTION_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SEND_FD_CMDID);
+		WMI_RETURN_STRING(WMI_ENABLE_FILS_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_AC_TX_QUEUE_OPTIMIZED_CMDID);
+		WMI_RETURN_STRING(WMI_PEER_TID_MSDUQ_QDEPTH_THRESH_UPDATE_CMDID);
+		WMI_RETURN_STRING(WMI_PDEV_SET_RX_FILTER_PROMISCUOUS_CMDID);
+	}
+
+	return "Invalid WMI cmd";
+}
+#endif /* WMI_CMD_STRINGS */
+
+/**  WMI commands/events for the regulatory offload  */
+
+/** Host indicating current country code to FW */
+typedef struct {
+    A_UINT32  tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_set_current_country_cmd_fixed_param */
+    A_UINT32  pdev_id;
+    A_UINT32  new_alpha2; /** alpha2 characters representing the country code */
+} wmi_set_current_country_cmd_fixed_param;
+
+typedef enum {
+    WMI_COUNTRYCODE_ALPHA2,
+    WMI_COUNTRYCODE_COUNTRY_ID,
+    WMI_COUNTRYCODE_DOMAIN_CODE,
+} WMI_COUNTRYCODE_TYPE;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_set_init_country_cmd_fixed_param */
+    A_UINT32 pdev_id;
+    A_UINT32 countrycode_type; /* WMI_COUNTRYCODE_TYPE */
+    union {
+        struct {
+            /* Three character for alpha2. The first two is ISO name for country the last one
+            present if it is indoor and out door.  First char in bits 7:0 and second char in bits 15:8 ... */
+            A_UINT32  alpha2:24,
+                      unused:8;
+        };
+        A_UINT32 country_id;   /* Country ID */
+        A_UINT32 domain_code;  /* Domain code */
+    } country_code;
+} wmi_set_init_country_cmd_fixed_param;
+
+/* Freq units in MHz */
+#define WMI_REG_RULE_START_FREQ_GET(freq_info)                     WMI_GET_BITS(freq_info, 0, 16)
+#define WMI_REG_RULE_START_FREQ_SET(freq_info, value)              WMI_SET_BITS(freq_info, 0, 16, value)
+#define WMI_REG_RULE_END_FREQ_GET(freq_info)                       WMI_GET_BITS(freq_info, 16, 16)
+#define WMI_REG_RULE_END_FREQ_SET(freq_info, value)                WMI_SET_BITS(freq_info, 16, 16, value)
+
+/* BW in MHz */
+#define WMI_REG_RULE_MAX_BW_GET(bw_pwr_info)                       WMI_GET_BITS(bw_pwr_info, 0, 16)
+#define WMI_REG_RULE_MAX_BW_SET(bw_pwr_info, value)                WMI_SET_BITS(bw_pwr_info, 0, 16, value)
+/* regpower in dBm */
+#define WMI_REG_RULE_REG_POWER_GET(bw_pwr_info)                    WMI_GET_BITS(bw_pwr_info, 16, 8)
+#define WMI_REG_RULE_REG_POWER_SET(bw_pwr_info, value)             WMI_SET_BITS(bw_pwr_info, 16, 8, value)
+/* antenna gain */
+#define WMI_REG_RULE_ANTENNA_GAIN_GET(bw_pwr_info)                 WMI_GET_BITS(bw_pwr_info, 24, 8)
+#define WMI_REG_RULE_ANTENNA_GAIN_SET(bw_pwr_info, value)          WMI_SET_BITS(bw_pwr_info, 24, 8, value)
+
+typedef enum {
+    WMI_REG_FLAG_CHAN_NO_IR           = 0x0001, /* passive channel */
+    WMI_REG_FLAG_CHAN_RADAR           = 0x0002, /* dfs channel */
+    WMI_REG_FLAG_CHAN_NO_OFDM         = 0x0004, /* no ofdm channel */
+    WMI_REG_FLAG_CHAN_INDOOR_ONLY     = 0x0008, /* indoor only channel */
+} WMI_REGULATORY_FLAGS;
+
+#define WMI_REG_RULE_FLAGS_GET(flag_info)                    WMI_GET_BITS(flag_info, 0, 16)
+#define WMI_REG_RULE_FLAGS_SET(flag_info, value)             WMI_SET_BITS(flag_info, 0, 16, value)
+
+typedef struct {
+    A_UINT32  tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_regulatory_rule_struct */
+    A_UINT32  freq_info;       /* bits 15:0  = u16 start_freq,
+                                * bits 31:16 = u16 end_freq
+                                * (both in MHz units) */
+    A_UINT32  bw_pwr_info;     /* bits 15:0  = u16 max_bw (MHz units),
+                                  bits 23:16 = u8 reg_power (dBm units),
+                                  bits 31:24 = u8 ant_gain (dB units) */
+    A_UINT32  flag_info;       /* bits 15:0  = u16 flags,
+                                  bits 31:16 reserved */
+} wmi_regulatory_rule_struct;
+
+typedef enum {
+    WMI_REG_DFS_UNINIT_REGION = 0,
+    WMI_REG_DFS_FCC_REGION    = 1,
+    WMI_REG_DFS_ETSI_REGION   = 2,
+    WMI_REG_DFS_MKK_REGION    = 3,
+    WMI_REG_DFS_CN_REGION     = 4,
+    WMI_REG_DFS_KR_REGION     = 5,
+
+    /* Add new items above */
+    WMI_REG_DFS_UNDEF_REGION = 0xFFFF,
+} WMI_REG_DFS_REGION;
+
+typedef enum {
+    WMI_REGULATORY_PHYMODE_NO11A    = 0x0001,  /* NO 11A */
+    WMI_REGULATORY_PHYMODE_NO11B    = 0x0002,  /* NO 11B */
+    WMI_REGULATORY_PHYMODE_NO11G    = 0x0004,  /* NO 11G */
+    WMI_REGULATORY_PHYMODE_NO11N    = 0x0008,  /* NO 11N */
+    WMI_REGULATORY_PHYMODE_NO11AC   = 0x0010,  /* NO 11AC */
+    WMI_REGULATORY_PHYMODE_NO11AX   = 0x0020,  /* NO 11AX */
+} WMI_REGULATORY_PHYBITMAP;
+
+typedef enum {
+    WMI_REG_SET_CC_STATUS_PASS = 0,
+    WMI_REG_CURRENT_ALPHA2_NOT_FOUND = 1,
+    WMI_REG_INIT_ALPHA2_NOT_FOUND = 2,
+    WMI_REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
+    WMI_REG_SET_CC_STATUS_NO_MEMORY = 4,
+    WMI_REG_SET_CC_STATUS_FAIL = 5,
+} WMI_REG_SET_CC_STATUS_CODE;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_reg_chan_list_cc_event_fixed_param */
+    A_UINT32 status_code; /* WMI_REG_SET_CC_STATUS_CODE */
+    A_UINT32 phy_id;
+    A_UINT32 alpha2;
+    A_UINT32 num_phy;
+    A_UINT32 country_id;
+    A_UINT32 domain_code;
+    A_UINT32 dfs_region;  /* WMI_REG_DFS_REGION */
+    A_UINT32 phybitmap;   /* WMI_REGULATORY_PHYBITMAP */
+    A_UINT32 min_bw_2g;   /* BW in MHz */
+    A_UINT32 max_bw_2g;   /* BW in MHz */
+    A_UINT32 min_bw_5g;   /* BW in MHz */
+    A_UINT32 max_bw_5g;   /* BW in MHz */
+    A_UINT32 num_2g_reg_rules;
+    A_UINT32 num_5g_reg_rules;
+/* followed by wmi_regulatory_rule_struct TLV array. First 2G and then 5G */
+} wmi_reg_chan_list_cc_event_fixed_param;
+
+typedef struct {
+    A_UINT32  tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_11d_scan_start_cmd_fixed_param */
+    A_UINT32  vdev_id;
+    A_UINT32  scan_period_msec;   /** scan duration in milli-seconds */
+    A_UINT32  start_interval_msec; /** offset duration to start the scan in milli-seconds */
+} wmi_11d_scan_start_cmd_fixed_param;
+
+typedef struct {
+    A_UINT32  tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_11d_scan_stop_cmd_fixed_param */
+    A_UINT32  vdev_id;
+} wmi_11d_scan_stop_cmd_fixed_param;
+
+/** FW indicating new current country code to Host */
+typedef struct {
+    A_UINT32  tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_11d_new_country_event_fixed_param */
+    A_UINT32  new_alpha2; /** alpha2 characters representing the country code */
+} wmi_11d_new_country_event_fixed_param;
 
 typedef struct {
     /** TLV tag and len; tag equals
@@ -16610,6 +21143,407 @@ typedef struct {
              isolation_chain3:8; /* [31:24], isolation value for chain 3 */
 } wmi_coex_report_isolation_event_fixed_param;
 
+typedef enum {
+    WMI_RCPI_MEASUREMENT_TYPE_AVG_MGMT  = 1,
+    WMI_RCPI_MEASUREMENT_TYPE_AVG_DATA  = 2,
+    WMI_RCPI_MEASUREMENT_TYPE_LAST_MGMT = 3,
+    WMI_RCPI_MEASUREMENT_TYPE_LAST_DATA = 4,
+} wmi_rcpi_measurement_type;
+
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_request_rcpi_cmd_fixed_param */
+    A_UINT32 tlv_header;
+    /* VDEV identifier */
+    A_UINT32 vdev_id;
+    /* peer MAC address */
+    wmi_mac_addr peer_macaddr;
+    /* measurement type - defined in enum wmi_rcpi_measurement_type */
+    A_UINT32 measurement_type;
+} wmi_request_rcpi_cmd_fixed_param;
+
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_update_rcpi_event_fixed_param */
+    A_UINT32 tlv_header;
+    /* VDEV identifier */
+    A_UINT32 vdev_id;
+    /* peer MAC address */
+    wmi_mac_addr peer_macaddr;
+    /* measurement type - defined in enum wmi_rcpi_measurement_type */
+    A_UINT32 measurement_type;
+    /* Measured RCPI in dBm of the peer requested by host */
+    A_INT32 rcpi;
+    /** status
+     *  0 - Requested peer RCPI available
+     *  1 - Requested peer RCPI not available
+     */
+    A_UINT32 status;
+} wmi_update_rcpi_event_fixed_param;
+
+/* Definition of mask for various package id */
+#define WMI_PKGID_MASK_AUTO 0x00000080
+
+typedef struct {
+    /** TLV tag and len; tag equals*/
+    A_UINT32 tlv_header;
+    /**
+     * The value field is filled with WMI_PKGID_MASK values.
+     * Currently, the only flag used within values is
+     * WMI_PKGID_MASK_AUTO, where bit7=1 for automotive systems.
+     */
+    A_UINT32 value;
+}wmi_pkgid_event_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals
+    WMITLV_TAG_STRUC_wmi_vdev_add_mac_addr_to_rx_filter_cmd_fixed_params */
+    A_UINT32 vdev_id; /* vdev id whose mac to be randomized */
+    /* enable is set to 1 if mac randomization to be enabled */
+    A_UINT32 enable;
+    /* randomization mac address if randomization is enabled */
+    wmi_mac_addr mac_addr;
+    /* To get the PMAC from freq param */
+    A_UINT32 freq;  /* units in MHz */
+} wmi_vdev_add_mac_addr_to_rx_filter_cmd_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals
+    WMITLV_TAG_STRUC_wmi_vdev_add_mac_addr_to_rx_filter_event_fixed_params */
+    A_UINT32 vdev_id; /* vdev of id whose mac address was randomized */
+    A_UINT32 status; /* status is 1 if success and 0 if failed */
+} wmi_vdev_add_mac_addr_to_rx_filter_status_event_fixed_param;
+
+/* Definition of HW data filtering */
+typedef enum {
+    WMI_HW_DATA_FILTER_DROP_NON_ARP_BC = 0x01,
+    WMI_HW_DATA_FILTER_DROP_NON_ICMPV6_MC = 0x02,
+} WMI_HW_DATA_FILTER_BITMAP_TYPE;
+
+typedef struct {
+    A_UINT32 tlv_header;
+    A_UINT32 vdev_id;
+    A_UINT32 enable;  /* 1 . enable, 0- disable */
+    A_UINT32 hw_filter_bitmap; /* see WMI_HW_DATA_FILTER_BITMAP_TYPE */
+} wmi_hw_data_filter_cmd_fixed_param;
+
+/* This command is used whenever host wants to restart multiple
+ * VDEVs using single command and the VDEV that are restarted will
+ * need to have same properties they had before restart except for the
+ * operating channel
+ */
+typedef struct {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_multiple_vdev_restart_request_cmd_fixed_param */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     * In non-DBDC case host should set it to 0
+     */
+    A_UINT32 pdev_id;
+    /** unique id identifying the module, generated by the caller */
+    A_UINT32 requestor_id;
+    /** Disable H/W ack.
+     * During CAC, Our HW shouldn't ack directed frames
+     */
+    A_UINT32 disable_hw_ack;
+    /* Determine the duration of CAC on the given channel 'chan' */
+    A_UINT32 cac_duration_ms;
+    A_UINT32 num_vdevs;
+
+    /* The TLVs follows this structure:
+     * A_UINT32 vdev_ids[]; <--- Array of VDEV ids.
+     * wmi_channel chan; <------ WMI channel
+     */
+} wmi_pdev_multiple_vdev_restart_request_cmd_fixed_param;
+
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_csa_switch_count_status_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     * In non-DBDC case host should set it to 0
+     */
+    A_UINT32 pdev_id;
+    /** CSA switch count value in the last transmitted beacon */
+    A_UINT32 current_switch_count;
+    A_UINT32 num_vdevs;
+
+    /* The TLVs follows this structure:
+     * A_UINT32 vdev_ids[]; <--- Array of VDEV ids.
+     */
+} wmi_pdev_csa_switch_count_status_event_fixed_param;
+
+/* Operation types for packet routing command */
+typedef enum {
+    WMI_PDEV_ADD_PKT_ROUTING,
+    WMI_PDEV_DEL_PKT_ROUTING,
+} wmi_pdev_pkt_routing_op_code;
+
+/* Packet routing types based on specific data types */
+typedef enum {
+    WMI_PDEV_ROUTING_TYPE_ARP_IPV4,
+    WMI_PDEV_ROUTING_TYPE_NS_IPV6,
+    WMI_PDEV_ROUTING_TYPE_IGMP_IPV4,
+    WMI_PDEV_ROUTING_TYPE_MLD_IPV6,
+    WMI_PDEV_ROUTING_TYPE_DHCP_IPV4,
+    WMI_PDEV_ROUTING_TYPE_DHCP_IPV6,
+} wmi_pdev_pkt_routing_type;
+
+/* This command shall be sent only when no VDEV is up.
+ * If the command is sent after any VDEV is up, target will ignore the command
+ */
+typedef struct {
+    /** TLV tag and len; tag equals
+      * WMITLV_TAG_STRUC_wmi_pdev_update_pkt_routing_cmd_fixed_param
+      */
+    A_UINT32 tlv_header;
+    /** Identifies pdev on which routing needs to be applied */
+    A_UINT32 pdev_id;
+    /** Indicates the routing operation type: add/delete */
+    A_UINT32 op_code; /* wmi_pdev_pkt_routing_op_code */
+    /** Bitmap of multiple pkt routing types for a given destination ring
+      * and meta data
+      */
+    A_UINT32 routing_type_bitmap; /* see wmi_pdev_pkt_routing_type */
+    /** 5 bits [4:0] are used to specify the destination ring where the
+      * CCE matched packet needs to be routed.
+      */
+    A_UINT32 dest_ring;
+    /** 16 bits [15:0] meta data can be passed to CCE.
+      * When the superrule matches,
+      * CCE copies this back in RX_MSDU_END_TLV.
+      */
+    A_UINT32 meta_data;
+} wmi_pdev_update_pkt_routing_cmd_fixed_param;
+
+typedef enum {
+    /* The board was calibrated with a meta which did not have this feature */
+    WMI_CALIBRATION_NO_FEATURE = 0,
+    WMI_CALIBRATION_OK,             /* The calibration status is OK */
+    WMI_CALIBRATION_NOT_OK,         /* The calibration status is NOT OK */
+} WMI_CALIBRATION_STATUS;
+
+#define WMI_BOARD_MCN_STRING_MAX_SIZE 19
+
+/**
+ * WMI_BOARD_MCN_STRING_BUF_SIZE : represents the number of elements in board_mcn_detail.
+ * Since board_mcn_detail is of type A_UINT8, the value of WMI_BOARD_MCN_STRING_BUF_SIZE
+ * should be multiple of 4 for alignement reason. And the last byte byte is reserved for
+ * null-terminator
+ */
+#define WMI_BOARD_MCN_STRING_BUF_SIZE (WMI_BOARD_MCN_STRING_MAX_SIZE+1) /* null-terminator */
+
+typedef struct {
+    /* TLV tag and len; tag equals
+     * WMITLV_TAG_STRUC_wmi_pdev_check_cal_version_event_fixed_param
+     */
+    A_UINT32 tlv_header;
+    /* Current software level calibration data version */
+    A_UINT32 software_cal_version;
+    /* Calibration data version programmed on chip */
+    A_UINT32 board_cal_version;
+    /* filled with WMI_CALIBRATION_STATUS enum value */
+    A_UINT32 cal_status;
+
+    /* board_mcn_detail:
+     * Provides board's MCN (Material Control Number) information for the host
+     * to display. This is used to track the Hardware level revisions/versions.
+     * This array carries the ASCII values of the MCN to the host. And host
+     * would just print this in a string format whenever user requests.
+     * Note: On a big-endian host, the 4 bytes within each A_UINT32 portion
+     * of a WMI message will be automatically byteswapped by the copy engine
+     * as the messages are transferred between host and target, to convert
+     * between the target's little-endianness and the host's big-endianness.
+     * Consequently, a big-endian host will have to manually unswap the bytes
+     * within the board_mcn_detail string buffer to get the bytes back into
+     * the desired natural order.
+     */
+    A_UINT8 board_mcn_detail[WMI_BOARD_MCN_STRING_BUF_SIZE];
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+} wmi_pdev_check_cal_version_event_fixed_param;
+
+typedef struct {
+    /** TLV tag and len; tag equals
+      * WMITLV_TAG_STRUC_wmi_pdev_check_cal_version_cmd_fixed_param
+      */
+    A_UINT32 tlv_header;
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+} wmi_pdev_check_cal_version_cmd_fixed_param;
+
+typedef struct {
+    /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_diversity_gain_cmd_fixed_param */
+    A_UINT32 tlv_header;
+    /* Identifies pdev on which diversity gain to be applied */
+    A_UINT32 pdev_id;
+    /* The number of spatial stream */
+    A_UINT32 nss;
+    /* The number of gains */
+    A_UINT32 num_gains;
+    /*
+     * This fixed_param TLV is followed by other TLVs:
+     *    A_UINT8 diversity_gains[num_gains]; (gain is in dB units)
+     */
+} wmi_pdev_set_diversity_gain_cmd_fixed_param;
+
+/* flags for unit_test_event  */
+#define WMI_UNIT_TEST_EVENT_FLAG_STATUS			0   /* 0 = success, 1 = fail */
+#define WMI_UNIT_TEST_EVENT_FLAG_DONE			1   /* 0 = not done, 1 = done  */
+
+/* from bit 2 to bit 31 are reserved */
+
+#define WMI_SET_UNIT_TEST_EVENT_FLAG_STATUS_SUCCESS(flag) do {	\
+        (flag) |= (1 << WMI_UNIT_TEST_EVENT_FLAG_STATUS);	\
+     } while (0)
+
+#define WMI_SET_UNIT_TEST_EVENT_FLAG_STATUS_FAIL(flag) do {	\
+        (flag) &= ~(1 << WMI_UNIT_TEST_EVENT_FLAG_STATUS);	\
+     } while (0)
+
+#define WMI_GET_UNIT_TEST_EVENT_FLAG_STSTUS(flag)		\
+        ((flag) & (1 << WMI_UNIT_TEST_EVENT_FLAG_STATUS))
+
+#define WMI_SET_UNIT_TEST_EVENT_FLAG_DONE(flag) do {		\
+        (flag) |= (1 << WMI_UNIT_TEST_EVENT_FLAG_DONE);		\
+     } while (0)
+
+#define WMI_CLR_UNIT_TEST_EVENT_FLAG_DONE(flag) do {		\
+        (flag) &= ~(1 << WMI_UNIT_TEST_EVENT_FLAG_DONE);	\
+     } while (0)
+
+#define WMI_GET_UNIT_TEST_EVENT_FLAG_DONE(flag)			\
+        ((flag) & (1 << WMI_UNIT_TEST_EVENT_FLAG_DONE))
+
+typedef struct {
+    /* TLV tag and len; tag equals WMI_UNIT_TEST_EVENTID */
+    A_UINT32 tlv_header;
+    /* unique id identifying the VDEV, generated by the caller */
+    A_UINT32 vdev_id;
+    /* Identify the wlan module */
+    A_UINT32 module_id;
+    /* unique id identifying the unit test cmd, generated by the caller */
+    A_UINT32 diag_token;
+    /* flag for the status of the unit_test_cmd */
+    A_UINT32 flag;
+    /* data length number of bytes for current dump */
+    A_UINT32 payload_len;
+    /* TLV/Payload after this structure is sent in little endian
+     * format for the length mentioned in this structure.
+     * A_UINT8 payload[1];
+     */
+} wmi_unit_test_event_fixed_param;
+
+/* Definition of latency levels */
+typedef enum {
+    WMI_WLM_LL_NORMAL = 0x0,
+    WMI_WLM_LL_MODERATE = 0x1,
+    WMI_WLM_LL_LOW = 0x2,
+    WMI_WLM_LL_ULTRA_LOW = 0x3,
+} WMI_WLM_LATENCY_LEVEL;
+
+/*
+* Lay out of flags in wmi_wlm_config_cmd_fixed_param
+*
+* |31  12|  11  |  10  |9    8|7    6|5    4|3    2|  1  |  0  |
+* +------+------+------+------+------+------+------+-----+-----+
+* | RSVD | SSLP | CSLP | RSVD | Roam | RSVD | DWLT | DFS | SUP |
+* +------+-------------+-------------+-------------------------+
+* |  WAL |      PS     |     Roam    |         Scan            |
+*
+*/
+/* bit 0-3 of flags is used for scan operation */
+/* bit 0: WLM_FLAGS_SCAN_SUPPRESS, suppress all scan and other bits would be ignored if bit is set */
+
+#define WLM_FLAGS_SCAN_SUPPRESS  1  /* suppress all scan request */
+
+/* bit 1: WLM_FLAGS_SCAN_SKIP_DFS, skip dfs channel if bit is set */
+
+#define WLM_FLAGS_SCAN_SKIP_DFS  1  /* skip dfs channel operation */
+
+/* bit 2-3: define policy of dwell time/duration of each foreign channel
+   (b2 b3)
+   (0  0 ): Default dwell time
+   (0  1 ): WLM_FLAGS_STICK_SCAN_DWELL_TIME : Stick to original active/passive dwell time, but split
+   foreign channel dwell times into fitting into min (dl_latency, ul_latency). Note it can increase
+   overall scan duration.
+   (1  0 ): WLM_FLAGS_SHRINK_SCAN_DWELL_TIME: Shrink active/passive dwell time to
+   min(dl_latency, ul_latency, dwell_time). It may reduce overall scan duration, but it may decrease
+   the accuracy of scan result.
+   (1  1 ): reserved
+*/
+#define WLM_FLAGS_DEFAULT_SCAN_DWELL_TIME   0 /* Default scan dwell time */
+#define WLM_FLAGS_STICK_SCAN_DWELL_TIME     1 /* Shrink off channel time but extend overall scan duration */
+#define WLM_FLAGS_SHRINK_SCAN_DWELL_TIME    2 /* Shrink scan off channel time */
+
+/* bit 4-5: reserved for scan */
+
+/* bit 6-7 of flags is used for roaming operation */
+/* bit 6-7: define roaming policy:
+   (b6 b7)
+   (0  0 ): WLM_FLAGS_ROAM_ALLOW: Default behavior, allow roaming in all scenarios
+   (0  1 ): WLM_FLAGS_ROAM_SUPPRESS: Disallow all roaming
+   (1  0 ): WLM_FLAGS_ALLOW_FINAL_BMISS_ROAM: Allow final bmiss roaming only
+   (1  1 ): reserved
+*/
+#define WLM_FLAGS_ROAM_ALLOW     0
+#define WLM_FLAGS_ROAM_SUPPRESS  1
+#define WLM_FLAGS_ALLOW_FINAL_BMISS_ROAM 2
+
+/* bit 8-9: reserved for roaming */
+
+/* bit 10-11 of flags is used for powersave operation */
+/* bit 10: WLM_FLAGS_PS_DISABLE_CSS_COLLAPSE, disable css power collapse if bit is set */
+
+#define WLM_FLAGS_PS_DISABLE_CSS_COLLAPSE  1  /* disable css power collapse */
+
+/* bit 11: WLM_FLAGS_PS_DISABLE_SYS_SLEEP, disable sys sleep if bit is set */
+
+#define WLM_FLAGS_PS_DISABLE_SYS_SLEEP  1  /* disable sys sleep */
+
+
+/* bit 12-31 of flags is reserved for powersave and WAL */
+
+#define WLM_FLAGS_SCAN_IS_SUPPRESS(flag)                  WMI_GET_BITS(flag, 0, 1)
+#define WLM_FLAGS_SCAN_SET_SUPPRESS(flag, val)            WMI_SET_BITS(flag, 0, 1, val)
+#define WLM_FLAGS_SCAN_IS_SKIP_DFS(flag)                  WMI_GET_BITS(flag, 1, 1)
+#define WLM_FLAGS_SCAN_SET_SKIP_DFS(flag, val)            WMI_SET_BITS(flag, 1, 1, val)
+#define WLM_FLAGS_SCAN_GET_DWELL_TIME_POLICY(flag)        WMI_GET_BITS(flag, 2, 2)
+#define WLM_FLAGS_SCAN_SET_DWELL_TIME_POLICY(flag, val)   WMI_SET_BITS(flag, 2, 2, val)
+#define WLM_FLAGS_ROAM_GET_POLICY(flag)                   WMI_GET_BITS(flag, 6, 2)
+#define WLM_FLAGS_ROAM_SET_POLICY(flag, val)              WMI_SET_BITS(flag, 6, 2, val)
+#define WLM_FLAGS_PS_IS_CSS_CLPS_DISABLED(flag)           WMI_GET_BITS(flag, 10, 1)
+#define WLM_FLAGS_PS_SET_CSS_CLPS_DISABLE(flag, val)      WMI_SET_BITS(flag, 10, 1, val)
+#define WLM_FLAGS_PS_IS_SYS_SLP_DISABLED(flag)            WMI_GET_BITS(flag, 11, 1)
+#define WLM_FLAGS_PS_SET_SYS_SLP_DISABLE(flag, val)       WMI_SET_BITS(flag, 11, 1, val)
+
+typedef struct {
+    /** TLV tag and len; tag equals
+    * WMI_WLM_CONFIG_CMD_fixed_param */
+    A_UINT32 tlv_header;
+    /* VDEV identifier */
+    A_UINT32 vdev_id;
+    /* Refer to WMI_WLM_LATENCY_LEVEL
+    * Once latency change detected, WLM will notify modules e.g. STAPS or SCAN/ROAM,
+    * who subscribed this event. And subscribers, like SCAN, may disable/cutoff offchan
+    * operation to support lower latency of WLAN.
+    */
+    A_UINT32 latency_level;
+    /* represent uplink latency in ms
+    * This parameter will be used by STAPS module to decide timing parameters, like
+    * ITO or SPEC wakeup interval. For SCAN/ROAM, it may used to calculate offchan
+    * durations.
+    */
+    A_UINT32 ul_latency;
+    /* represent downlink latency in ms
+    * Similar usage as ul_latency
+    */
+    A_UINT32 dl_latency;
+    /* flags for each client of WLM, refer to WLM_FLAGS_ definitions above */
+    A_UINT32 flags;
+} wmi_wlm_config_cmd_fixed_param;
+
 /* ADD NEW DEFS HERE */
 
 /*****************************************************************************
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_unified_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_unified_api.h
index cd9f923beca..2912d471158 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_unified_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_unified_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -69,7 +69,7 @@ wmi_unified_remove_work(struct wmi_unified* wmi_handle);
  *  @return wmi_buf_t.
  */
 wmi_buf_t
-wmi_buf_alloc(wmi_unified_t wmi_handle, u_int16_t len);
+wmi_buf_alloc(wmi_unified_t wmi_handle, uint32_t len);
 
 
 /**
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_version.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_version.h
index ad4e21d9095..10f6f206182 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_version.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/COMMON/wmi_version.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 306
+#define __WMI_REVISION_ 476
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/ath_dfs_structs.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/ath_dfs_structs.h
index 425d0d5f53e..c7c081414c9 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/ath_dfs_structs.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/ath_dfs_structs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -119,7 +119,21 @@ struct  dfs_pulse {
     int32_t      rp_rssimargin;    /* rssi threshold margin. In Turbo Mode HW reports rssi 3dBm */
                                    /* lower than in non TURBO mode. This will be used to offset that diff.*/
     u_int32_t    rp_ignore_pri_window;
-    u_int32_t    rp_pulseid;       /* Unique ID for identifying filter */
+    /**
+     * To reduce false detection use sidx spread.
+     * For HT160, for consistency, push all pulses at center of the channel to
+     * 80MHz ext when both segments are DFS.
+     * Maximum SIDX value spread in a matchedsequence excluding FCC Bin 5.
+     */
+    u_int16_t    rp_sidx_spread;
+    /**
+     * This is mainly used for ETSI Type 4 5MHz chirp pulses which HW cnanot
+     * identify reliably as chirping but can correctly characterize these with
+     * delta_peak non-zero. It is disabled by default currently.
+     * Is delta_peak check required for this filter.
+     */
+    int8_t       rp_check_delta_peak;
+    u_int16_t    rp_pulseid;       /* Unique ID for identifying filter */
 };
 
 struct  dfs_staggered_pulse {
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/dfs.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/dfs.h
index 4824320c269..12ad7437d7b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/dfs.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/dfs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2005-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -230,6 +230,17 @@
 #define DFS_ETSI_TYPE3_WAR_PRI_UPPER_LIMIT 435
 #define DFS_ETSI_WAR_VALID_PULSE_DURATION 15
 
+#define DFS_RADAR_DELAY 500
+#define DFS_RADAR_IGNORE 300
+#define DFS_RADAR_FALSE_PRI_START 5
+#define DFS_RADAR_FLASE_PRI_END   14
+#define DFS_SIDX1_SIDX2_SIZE 0x20
+#define DFS_SIDX1_SIDX2_MASK 0x1f
+#define DFS_SIDX1_SIDX2_TIME_WINDOW 20000
+#define DFS_SIDX1_SIDX2_DR_LIM 10
+
+#define DFS_BIG_SIDX          10000
+
 typedef  adf_os_spinlock_t  dfsq_lock_t;
 
 #ifdef WIN32
@@ -239,6 +250,10 @@ struct dfs_pulseparams {
     u_int64_t  p_time;  /* time for start of pulse in usecs*/
     u_int8_t   p_dur;   /* Duration of pulse in usecs*/
     u_int8_t   p_rssi;  /* Duration of pulse in usecs*/
+    u_int8_t   p_seg_id;
+    int16_t    p_sidx;
+    int8_t     p_delta_peak;
+    u_int32_t  p_seq_num;
 } adf_os_packed;
 #ifdef WIN32
 #pragma pack(pop, dfs_pulseparams)
@@ -247,6 +262,13 @@ struct dfs_pulseparams {
 #ifdef WIN32
 #pragma pack(push, dfs_pulseline, 1)
 #endif
+struct dfs_sidx1_sidx2_pulse_line {
+    /* pl_elems - array of pulses in delay line */
+    struct dfs_pulseparams pl_elems[DFS_SIDX1_SIDX2_SIZE];
+    u_int32_t  pl_firstelem;  /* Index of the first element */
+    u_int32_t  pl_lastelem;   /* Index of the last element */
+    u_int32_t  pl_numelems;   /* Number of elements in the delay line */
+} adf_os_packed;
 struct dfs_pulseline {
     /* pl_elems - array of pulses in delay line */
     struct dfs_pulseparams pl_elems[DFS_MAX_PULSE_BUFFER_SIZE];
@@ -293,7 +315,10 @@ struct dfs_event {
    u_int32_t  re_freq;       /* Centre frequency of event, KHz */
    u_int32_t  re_freq_lo;    /* Lower bounds of frequency, KHz */
    u_int32_t  re_freq_hi;    /* Upper bounds of frequency, KHz */
-   int        sidx;          /* Pulse Index as in radar summary report */
+   int16_t    sidx;          /* Pulse Index as in radar summary report */
+   u_int8_t   re_seg_id;     /* HT80_80/HT160 use */
+   u_int8_t   re_delta_diff;
+   int8_t     re_delta_peak;
    STAILQ_ENTRY(dfs_event) re_list; /* List of radar events */
 } adf_os_packed;
 #ifdef WIN32
@@ -331,6 +356,10 @@ struct dfs_delayelem {
     u_int8_t   de_dur;   /* Duration of pulse in usecs*/
     u_int8_t   de_rssi;  /* rssi of pulse in dB*/
     u_int64_t  de_ts;    /* time stamp for this delay element */
+    u_int8_t   de_seg_id;        /* HT80_80/HT160 use */
+    int16_t    de_sidx;
+    int8_t     de_delta_peak;
+    u_int32_t  de_seq_num;
 } adf_os_packed;
 #ifdef WIN32
 #pragma pack(pop, dfs_delayelem)
@@ -347,6 +376,35 @@ struct dfs_delayline {
    u_int32_t   dl_firstelem;     /* Index of the first element */
    u_int32_t   dl_lastelem;      /* Index of the last element */
    u_int32_t   dl_numelems;      /* Number of elements in the delay line */
+   /**
+    * The following is to handle fractional PRI pulses that can cause false
+    * detection.
+    * sequence number of first pulse that was part of threshold match
+    */
+   u_int32_t   dl_seq_num_start;
+   /* sequence number of last pulse that was part of threshold match */
+   u_int32_t   dl_seq_num_stop;
+   /**
+    * The following is required because the first pulse may or may not be in the
+    * delay line but we will find it in the pulse line using dl_seq_num_second's
+    * diff_ts value
+    * sequence number of sesecond pulse that was part of threshold match
+    */
+   u_int32_t   dl_seq_num_second;
+   /* we need final search PRI to identify possible fractional PRI issue */
+   u_int32_t   dl_search_pri;
+   /**
+    * minimum sidx value of pulses used to match thershold. used for sidx
+    * spread check
+    */
+   int16_t     dl_min_sidx;
+   /**
+    * maximum sidx value of pulses used to match thershold. used for sidx
+    * spread check
+    */
+   int8_t      dl_max_sidx;
+   /* number of pulse in the delay line that had valid delta peak value */
+   u_int8_t    dl_delta_peak_match_count;
 } adf_os_packed;
 #ifdef WIN32
 #pragma pack(pop, dfs_delayline)
@@ -368,6 +426,18 @@ struct dfs_filter {
         u_int32_t       rf_maxdur;      /* Max duration for this radar filter */
         u_int32_t       rf_ignore_pri_window;
         u_int32_t       rf_pulseid;     /* Unique ID corresponding to the original filter ID */
+        /**
+         * To reduce false detection, look at frequency spread. For now we will
+         * use sidx spread. But for HT160 frequency spread will be a better
+         * measure.
+         * Maximum SIDX value spread in a matched sequence excluding FCC Bin 5
+         */
+        u_int16_t       rf_sidx_spread;
+        /**
+         * Minimum allowed delta_peak value for a pulse to be considetred for
+         * this filter's match
+         */
+        int8_t          rf_check_delta_peak;
 } adf_os_packed;
 #ifdef WIN32
 #pragma pack(pop, dfs_filter)
@@ -588,11 +658,14 @@ struct ath_dfs {
     struct dfs_stats     ath_dfs_stats; /* DFS related stats */
     struct dfs_pulseline *pulses;       /* pulse history */
     struct dfs_event     *events;       /* Events structure */
+    struct dfs_sidx1_sidx2_pulse_line sidx1_sidx2_elems;
 
     u_int32_t
         ath_radar_tasksched:1,      /* radar task is scheduled */
         ath_dfswait:1,         /* waiting on channel for radar detect */
-        ath_dfstest:1;        /* Test timer in progress */
+        ath_dfstest:1,        /* Test timer in progress */
+        ath_radar_delaysched:1,    /*radar found event delay*/
+        ath_radar_ignore_after_assoc:1; /*ignore radar 300ms after assoc*/
     struct ath_dfs_caps dfs_caps;
     u_int8_t   ath_dfstest_ieeechan; /* IEEE chan num to return to after
                                      * a dfs mute test */
@@ -605,6 +678,8 @@ struct ath_dfs {
     u_int8_t   dfs_bangradar;
 #endif
     os_timer_t ath_dfs_task_timer;   /* dfs wait timer */
+    vos_timer_t ath_dfs_radar_ignore_timer; /*ignore radar timer*/
+    vos_timer_t ath_dfs_radar_delay_timer;   /*radar found event delay timer*/
     int        dur_multiplier;
 
     u_int16_t  ath_dfs_isdfsregdomain;   /* true when we are DFS domain */
@@ -628,6 +703,19 @@ struct ath_dfs {
      * channel switch is disabled.
      */
     int8_t     disable_dfs_ch_switch;
+    /*
+     * Currently some WiFi chips sends radar, so add war as below
+     * Ignore radar found 500ms before assoc request packet and 300ms after
+     * assoc request packet.
+     * Create new queue and collect radar pulse with pulse index1 and pulse
+     * index2. Save 32 radar pulses for the new queue. Once radar is found,
+     * for radar pulse in the new queue, remove radar pulse that happens 20ms
+     * ago. Find the biggest and smallest dur for the rest radar pulse in the
+     * new queue. If they have more than 10 difference, then ignore this radar
+     * found.
+     */
+    int8_t     dfs_enable_radar_war;
+    u_int32_t  dfs_seq_num;
 };
 
 /* This should match the table from if_ath.c */
@@ -716,6 +804,8 @@ struct dfs_phy_err {
    u_int8_t rssi;    /* pulse RSSI */
    u_int8_t dur;     /* pulse duration, raw (not uS) */
    int sidx; /* Pulse Index as in radar summary report */
+   u_int8_t pulse_delta_diff;
+   int8_t pulse_delta_peak;
 };
 
 /* Attach, detach, handle ioctl prototypes */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/radar_filters.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/radar_filters.h
index 73d3c785adb..f6bdfc89164 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/radar_filters.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/inc/radar_filters.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -61,39 +61,39 @@
 struct dfs_pulse dfs_fcc_radars[] = {
     // FCC NEW TYPE 0
     // {18,  1,  325, 1930, 0,  6,  7,  0,  1, 18,  0, 3,  0}, // 518 to 3066
-    {18,  1,  700, 700, 0,  6,  5,  0,  1, 18,  0, 3,  1, 0},
-    {18,  1,  350, 350, 0,  6,  5,  0,  1, 18,  0, 3,  0, 0},
+    {18,  1,  700, 700, 0,  4,  5,  0,  1, 18,  0, 3,  1, 5, 0, 0},
+    {18,  1,  350, 350, 0,  4,  5,  0,  1, 18,  0, 3,  0, 5, 0, 0},
 
     // FCC TYPE 6
     // {9,   1, 3003, 3003, 1,  7,  5,  0,  1, 18,  0, 0,  1}, // 333 +/- 7 us
-    {9,   1, 3003, 3003, 1,  7,  5,  0,  1, 18,  0, 0,  1, 1},
+    {9,   1, 3003, 3003, 1,  7,  5,  0,  1, 18,  0, 0,  1, 1000, 0, 1},
 
     // FCC TYPE 2
-    {23, 5, 4347, 6666, 0, 18, 8,  0,  7, 22,  0, 3,  0, 2},
+    {23, 5, 4347, 6666, 0, 4, 8,  0,  7, 22,  0, 3,  0, 5, 0, 2},
 
     // FCC TYPE 3
-    {18, 10, 2000, 5000, 0, 23,  6,  6, 13, 20,  0, 3, 0, 5},
+    {18, 10, 2000, 5000, 0, 4,  6,  6, 13, 20,  0, 3, 0, 5, 0, 5},
 
     // FCC TYPE 4
-    {16, 15, 2000, 5000, 0, 25,  5, 11, 23, 20,  0, 3, 0, 11},
+    {16, 15, 2000, 5000, 0, 4,  5, 11, 23, 20,  0, 3, 0, 5, 0, 11},
 
     /*
      * FCC NEW TYPE 1
      * 518us to 938us pulses (min 56 pulses)
      */
-    {57, 1, 1066, 1930, 0, 6, 20,  0,  1, 22,  0, 3,  0, 21},
+    {57, 1, 1066, 1930, 0, 4, 20,  0,  1, 22,  0, 3,  0, 5, 0, 21},
 
     /*
      * FCC NEW TYPE 1
      * 938us to 2000 pulses (min 26 pulses)
      */
-    {27, 1,  500, 1066, 0, 6, 13,  0,  1, 22,  0, 3,  0, 22},
+    {27, 1,  500, 1066, 0, 4, 13,  0,  1, 22,  0, 3,  0, 5, 0, 22},
 
     /*
      * FCC NEW TYPE 1
      * 2000 to 3067us pulses (min 17 pulses)
      */
-    {18, 1,  325,  500, 0, 6,  9,  0,  1, 22,  0, 3,  0, 23},
+    {18, 1,  325,  500, 0, 4, 9,  0,  1, 22,  0, 3,  0, 5, 0, 23},
 
 };
 
@@ -102,33 +102,33 @@ struct dfs_pulse dfs_mkk4_radars[] = {
 //    {18,  1,  720,  720, 1,  6,  6,  0,  1, 18,  0, 3, 17}, // 1389 +/- 6 us
 //    {18,  4,  250,  250, 1, 10,  5,  1,  6, 18,  0, 3, 18}, // 4000 +/- 6 us
 //    {18,  5,  260,  260, 1, 10,  6,  1,  6, 18,  0, 3, 19}, // 3846 +/- 7 us
-    {18,  1,  720,  720, 0,  6,  6,  0,  1, 18,  0, 3, 0, 17}, // 1389 +/- 6 us
-    {18,  4,  250,  250, 0, 10,  5,  1,  6, 18,  0, 3, 0, 18}, // 4000 +/- 6 us
-    {18,  5,  260,  260, 0, 10,  6,  1,  6, 18,  0, 3, 1, 19}, // 3846 +/- 7 us
+    {18, 1, 720, 720, 0, 4, 6, 0, 1, 18, 0, 3, 0, 5, 0, 17}, // 1389 +/- 6 us
+    {18, 4, 250, 250, 0, 4, 5, 1, 6, 18, 0, 3, 0, 5, 0, 18}, // 4000 +/- 6 us
+    {18, 5, 260, 260, 0, 4, 6, 1, 6, 18, 0, 3, 1, 5, 0, 19}, // 3846 +/- 7 us
 
     /* following filters are common to both FCC and JAPAN */
 
     // FCC TYPE 1
     // {18,  1,  325, 1930, 0,  6,  7,  0,  1, 18,  0, 3,  0}, // 518 to 3066
-    {18,  1,  700, 700, 0,  6,  5,  0,  1, 18,  0, 3,  1, 0},
-    {18,  1,  350, 350, 0,  6,  5,  0,  1, 18,  0, 3,  0, 0},
+    {18,  1,  700, 700, 0,  4,  5,  0,  1, 18,  0, 3,  1, 5, 0, 0},
+    {18,  1,  350, 350, 0,  4,  5,  0,  1, 18,  0, 3,  0, 5, 0, 0},
 
     // FCC TYPE 6
     // {9,   1, 3003, 3003, 1,  7,  5,  0,  1, 18,  0, 0,  1}, // 333 +/- 7 us
-    {9,   1, 3003, 3003, 1,  7,  5,  0,  1, 18,  0, 0, 1,  1},
+    {9,   1, 3003, 3003, 1,  7,  5,  0,  1, 18,  0, 0, 1, 1000, 0, 1},
 
     // FCC TYPE 2
-    {23, 5, 4347, 6666, 0, 18, 8,  0,  7, 22,  0, 3,  0, 2},
+    {23, 5, 4347, 6666, 0, 4, 8,  0,  7, 22,  0, 3,  0, 5, 0, 2},
 
     // FCC TYPE 3
-    {18, 10, 2000, 5000, 0, 23,  6,  6, 13, 22,  0, 3, 0, 5},
+    {18, 10, 2000, 5000, 0, 4,  6,  6, 13, 22,  0, 3, 0, 5, 0, 5},
 
     // FCC TYPE 4
-    {16, 15, 2000, 5000, 0, 25,  5, 11, 23, 22,  0, 3, 0, 11},
+    {16, 15, 2000, 5000, 0, 4,  5, 11, 23, 22,  0, 3, 0, 5, 0, 11},
 };
 
 struct dfs_bin5pulse dfs_fcc_bin5pulses[] = {
-        {4, 28, 105, 12, 17, 5},
+        {5, 28, 105, 12, 17, 5},
 };
 
 struct dfs_bin5pulse dfs_jpn_bin5pulses[] = {
@@ -138,24 +138,24 @@ struct dfs_pulse dfs_etsi_radars[] = {
 
     /* TYPE staggered pulse */
     /* 0.8-2us, 2-3 bursts,300-400 PRF, 10 pulses each */
-    {30,  2,  300,  400, 2, 30,  3,  0,  5, 15, 0,   0, 1, 31},   /* Type 5*/
+    {30, 2, 300, 400, 2, 30, 3, 0, 5, 15, 0, 0, 1, 5, 0, 31},   /* Type 5*/
     /* 0.8-2us, 2-3 bursts, 400-1200 PRF, 15 pulses each */
-    {30,  2,  400, 1200, 2, 30,  7,  0,  5, 15, 0,   0, 0, 32},   /* Type 6 */
+    {30, 2, 400, 1200, 2, 30, 7, 0, 5, 15, 0, 0, 0, 5, 0, 32},   /* Type 6 */
 
     /* constant PRF based */
     /* 0.8-5us, 200  300 PRF, 10 pulses */
-    {10, 5,   200,  400, 0, 24,  5,  0,  8, 15, 0,   0, 2, 33},   /* Type 1 */
-    {10, 5,   400,  600, 0, 24,  5,  0,  8, 15, 0,   0, 2, 37},   /* Type 1 */
-    {10, 5,   600,  800, 0, 24,  5,  0,  8, 15, 0,   0, 2, 38},   /* Type 1 */
-    {10, 5,   800, 1000, 0, 24,  5,  0,  8, 15, 0,   0, 2, 39},   /* Type 1 */
+    {10, 5, 200, 400, 0, 4, 5, 0, 8, 15, 0, 0, 2, 5, 0, 33},   /* Type 1 */
+    {10, 5, 400, 600, 0, 4, 5, 0, 8, 15, 0, 0, 2, 5, 0, 37},   /* Type 1 */
+    {10, 5, 600, 800, 0, 4, 5, 0, 8, 15, 0, 0, 2, 5, 0, 38},   /* Type 1 */
+    {10, 5, 800, 1000, 0, 4, 5, 0, 8, 15, 0, 0, 2, 5, 0, 39},   /* Type 1 */
 //  {10, 5,   200, 1000, 0, 24,  5,  0,  8, 15, 0,   0, 2, 33},
 
     /* 0.8-15us, 200-1600 PRF, 15 pulses */
-    {15, 15,  200, 1600, 0, 24, 8,  0, 18, 22, 0,   0, 0, 34},    /* Type 2 */
+    {15, 15, 200, 1600, 0, 4, 8, 0, 18, 22, 0, 0, 0, 5, 0, 34},    /* Type 2 */
 
     /* 0.8-15us, 2300-4000 PRF, 25 pulses*/
-    {25, 15, 2300, 4000,  0, 24, 10, 0, 18, 22, 0,   0, 0, 35},   /* Type 3 */
+    {25, 15, 2300, 4000, 0, 4, 10, 0, 18, 22, 0, 0, 0, 5, 0, 35},  /* Type 3 */
 
     /* 20-30us, 2000-4000 PRF, 20 pulses*/
-    {20, 30, 2000, 4000, 0, 24, 6, 19, 33, 24, 0,   0, 0, 36},    /* Type 4 */
+    {20, 30, 2000, 4000, 0, 4, 6, 19, 33, 24, 0, 0, 0, 24, 0, 36}, /* Type 4 */
 };
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs.c
index 48b461806a9..73884eb001f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2002-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -127,59 +127,109 @@ dfs_channel_mark_radar(struct ath_dfs *dfs, struct ieee80211_channel *chan)
 }
 #endif /* #if 0 */
 
-static OS_TIMER_FUNC(dfs_task)
+/**
+ * dfs_radar_ignore() - ignore radar found event
+ * @data: pointer to struct ieee80211com
+ *
+ * Return: none
+ */
+static void dfs_radar_ignore(void *data)
 {
-    struct ieee80211com *ic;
-    struct ath_dfs *dfs = NULL;
+	struct ieee80211com *ic = (struct ieee80211com *)data;
+	struct ath_dfs *dfs = NULL;
 
-    OS_GET_TIMER_ARG(ic, struct ieee80211com *);
-    dfs = (struct ath_dfs *)ic->ic_dfs;
-    /*
-     * XXX no locking?!
-     */
-    if (dfs_process_radarevent(dfs, ic->ic_curchan)) {
-#ifndef ATH_DFS_RADAR_DETECTION_ONLY
-
-        /*
-         * This marks the channel (and the extension channel, if HT40) as
-         * having seen a radar event.  It marks CHAN_INTERFERENCE and
-         * will add it to the local NOL implementation.
-         *
-         * This is only done for 'usenol=1', as the other two modes
-         * don't do radar notification or CAC/CSA/NOL; it just notes
-         * there was a radar.
-         */
+	dfs = (struct ath_dfs *)ic->ic_dfs;
+	dfs->ath_radar_ignore_after_assoc = false;
+}
 
-        if (dfs->dfs_rinfo.rn_use_nol == 1) {
-            //dfs_channel_mark_radar(dfs, ic->ic_curchan);
-        }
-#endif /* ATH_DFS_RADAR_DETECTION_ONLY */
+/**
+ * dfs_radar_delay() - delay radar found event
+ * @data: pointer to struct ieee80211com
+ *
+ * Return: none
+ */
+static void dfs_radar_delay(void *data)
+{
+	struct ieee80211com *ic = (struct ieee80211com *)data;
+	struct ath_dfs *dfs = NULL;
+
+	dfs = (struct ath_dfs *)ic->ic_dfs;
+
+	/*
+	 * This calls into the umac DFS code, which sets the umac related
+	 * radar flags and begins the channel change machinery.
+	 *
+	 * XXX TODO: the umac NOL code isn't used, but IEEE80211_CHAN_RADAR
+	 * still gets set.  Since the umac NOL code isn't used, that flag
+	 * is never cleared.  This needs to be fixed. See EV 105776.
+	 */
+	if (dfs->dfs_rinfo.rn_use_nol == 1)  {
+		ic->ic_dfs_notify_radar(ic, ic->ic_curchan);
+	} else if (dfs->dfs_rinfo.rn_use_nol == 0) {
+		/*
+		 * For the test mode, don't do a CSA here; but setup the
+		 * test timer so we get a CSA _back_ to the original channel.
+		 */
+		OS_CANCEL_TIMER(&dfs->ath_dfstesttimer);
+		dfs->ath_dfstest = 1;
+		adf_os_spin_lock_bh(&ic->chan_lock);
+		dfs->ath_dfstest_ieeechan = ic->ic_curchan->ic_ieee;
+		adf_os_spin_unlock_bh(&ic->chan_lock);
+		dfs->ath_dfstesttime = 1;   /* 1ms */
+		OS_SET_TIMER(&dfs->ath_dfstesttimer, dfs->ath_dfstesttime);
+	}
+	dfs->ath_radar_delaysched = 0;
+}
 
-        /*
-         * This calls into the umac DFS code, which sets the umac related
-         * radar flags and begins the channel change machinery.
-         *
-         * XXX TODO: the umac NOL code isn't used, but IEEE80211_CHAN_RADAR
-         * still gets set.  Since the umac NOL code isn't used, that flag
-         * is never cleared.  This needs to be fixed. See EV 105776.
-         */
-        if (dfs->dfs_rinfo.rn_use_nol == 1)  {
-            ic->ic_dfs_notify_radar(ic, ic->ic_curchan);
-        } else if (dfs->dfs_rinfo.rn_use_nol == 0) {
-            /*
-             * For the test mode, don't do a CSA here; but setup the
-             * test timer so we get a CSA _back_ to the original channel.
-             */
-            OS_CANCEL_TIMER(&dfs->ath_dfstesttimer);
-            dfs->ath_dfstest = 1;
-            adf_os_spin_lock_bh(&ic->chan_lock);
-            dfs->ath_dfstest_ieeechan = ic->ic_curchan->ic_ieee;
-            adf_os_spin_unlock_bh(&ic->chan_lock);
-            dfs->ath_dfstesttime = 1;   /* 1ms */
-            OS_SET_TIMER(&dfs->ath_dfstesttimer, dfs->ath_dfstesttime);
-        }
-    }
-    dfs->ath_radar_tasksched = 0;
+static OS_TIMER_FUNC(dfs_task)
+{
+	struct ieee80211com *ic;
+	struct ath_dfs *dfs = NULL;
+
+	OS_GET_TIMER_ARG(ic, struct ieee80211com *);
+	dfs = (struct ath_dfs *)ic->ic_dfs;
+
+	if (dfs_process_radarevent(dfs, ic->ic_curchan)) {
+		if (!dfs->dfs_enable_radar_war) {
+			/*
+			 * This calls into the umac DFS code, which sets the
+			 * umac related radar flags and begins the channel
+			 * change machinery.
+			 *
+			 * XXX TODO: the umac NOL code isn't used, but
+			 * IEEE80211_CHAN_RADAR still gets set.  Since the umac
+			 * NOL code isn't used, that flag is never cleared.
+			 * This needs to be fixed. See EV 105776.
+			 */
+			if (dfs->dfs_rinfo.rn_use_nol == 1)  {
+				ic->ic_dfs_notify_radar(ic, ic->ic_curchan);
+			} else if (dfs->dfs_rinfo.rn_use_nol == 0) {
+				/*
+				 * For the test mode, don't do a CSA here; but
+				 * setup the test timer so we get a CSA _back_
+				 * to the original channel.
+				 */
+				OS_CANCEL_TIMER(&dfs->ath_dfstesttimer);
+				dfs->ath_dfstest = 1;
+				adf_os_spin_lock_bh(&ic->chan_lock);
+				dfs->ath_dfstest_ieeechan =
+					ic->ic_curchan->ic_ieee;
+				adf_os_spin_unlock_bh(&ic->chan_lock);
+				dfs->ath_dfstesttime = 1;   /* 1ms */
+				OS_SET_TIMER(&dfs->ath_dfstesttimer,
+					dfs->ath_dfstesttime);
+			}
+		} else {
+			if ((!dfs->ath_radar_delaysched) &&
+				(!dfs->ath_radar_ignore_after_assoc)) {
+				ic->ic_update_dfs_cac_block_tx(true);
+				vos_timer_start(&dfs->ath_dfs_radar_delay_timer,
+					DFS_RADAR_DELAY);
+				dfs->ath_radar_delaysched = 1;
+			}
+		}
+	}
+	dfs->ath_radar_tasksched = 0;
 }
 
 static
@@ -323,6 +373,14 @@ dfs_attach(struct ieee80211com *ic)
     dfs->dfs_event_log_on = 0;
     OS_INIT_TIMER(NULL, &(dfs->ath_dfs_task_timer), dfs_task, (void *) (ic),
            ADF_DEFERRABLE_TIMER);
+    vos_timer_init(&(dfs->ath_dfs_radar_delay_timer), VOS_TIMER_TYPE_SW,
+           dfs_radar_delay, (void *) (ic));
+    vos_timer_init(&(dfs->ath_dfs_radar_ignore_timer), VOS_TIMER_TYPE_SW,
+           dfs_radar_ignore, (void *) (ic));
+
+    dfs->sidx1_sidx2_elems.pl_firstelem = 0;
+    dfs->sidx1_sidx2_elems.pl_lastelem = DFS_SIDX1_SIDX2_MASK;
+    dfs->sidx1_sidx2_elems.pl_numelems = 0;
 #ifndef ATH_DFS_RADAR_DETECTION_ONLY
     OS_INIT_TIMER(NULL, &(dfs->ath_dfstesttimer), dfs_testtimer_task,
         (void *) ic, ADF_DEFERRABLE_TIMER);
@@ -361,7 +419,7 @@ dfs_attach(struct ieee80211com *ic)
     dfs->pulses->pl_lastelem = DFS_MAX_PULSE_BUFFER_MASK;
 
     /* Allocate memory for radar filters */
-    for (n=0; n<DFS_MAX_RADAR_TYPES; n++) {
+    for (n = 0; n < DFS_MAX_RADAR_TYPES; n++) {
       dfs->dfs_radarf[n] = (struct dfs_filtertype *)OS_MALLOC(NULL, sizeof(struct dfs_filtertype),GFP_ATOMIC);
       if (dfs->dfs_radarf[n] == NULL) {
          DFS_PRINTK("%s: cannot allocate memory for radar filter types\n",
@@ -390,14 +448,15 @@ dfs_attach(struct ieee80211com *ic)
     }
 
     /* Allocate memory for radar table */
-    dfs->dfs_radartable = (int8_t **)OS_MALLOC(NULL, 256*sizeof(int8_t *), GFP_ATOMIC);
+    dfs->dfs_radartable = (int8_t **)OS_MALLOC(NULL,
+        MAX_DFS_RADAR_TABLE_TYPE * sizeof(int8_t *), GFP_ATOMIC);
     if (dfs->dfs_radartable == NULL) {
       DFS_PRINTK("%s: cannot allocate memory for radar table\n",
          __func__);
       goto bad4;
     }
-    for (n=0; n<256; n++) {
-      dfs->dfs_radartable[n] = OS_MALLOC(NULL, DFS_MAX_RADAR_OVERLAP*sizeof(int8_t),
+    for (n = 0; n < MAX_DFS_RADAR_TABLE_TYPE; n++) {
+      dfs->dfs_radartable[n] = OS_MALLOC(NULL, DFS_MAX_RADAR_OVERLAP * sizeof(int8_t),
                    GFP_ATOMIC);
       if (dfs->dfs_radartable[n] == NULL) {
          DFS_PRINTK("%s: cannot allocate memory for radar table entry\n",
@@ -464,27 +523,23 @@ dfs_attach(struct ieee80211com *ic)
     return 0;
 
 bad3:
-    if (dfs->dfs_dc_radartable) {
-       for (n = 0; n < MAX_DFS_RADAR_TABLE_TYPE; n++) {
-          if (dfs->dfs_dc_radartable[n]) {
-             OS_FREE(dfs->dfs_dc_radartable[n]);
-             dfs->dfs_dc_radartable[n] = NULL;
-          }
+    for (n = 0; n < MAX_DFS_RADAR_TABLE_TYPE; n++) {
+       if (dfs->dfs_dc_radartable[n]) {
+          OS_FREE(dfs->dfs_dc_radartable[n]);
+          dfs->dfs_dc_radartable[n] = NULL;
        }
-       OS_FREE(dfs->dfs_dc_radartable);
-       dfs->dfs_dc_radartable = NULL;
     }
+    OS_FREE(dfs->dfs_dc_radartable);
+    dfs->dfs_dc_radartable = NULL;
 bad2:
-    if (dfs->dfs_radartable != NULL) {
-       for (n=0; n < DFS_MAX_RADAR_TYPES; n++) {
-          if (dfs->dfs_radartable[n] != NULL) {
-             OS_FREE(dfs->dfs_radartable[n]);
-             dfs->dfs_radartable[n] = NULL;
-          }
+    for (n=0; n < MAX_DFS_RADAR_TABLE_TYPE; n++) {
+       if (dfs->dfs_radartable[n] != NULL) {
+          OS_FREE(dfs->dfs_radartable[n]);
+          dfs->dfs_radartable[n] = NULL;
        }
-       OS_FREE(dfs->dfs_radartable);
-       dfs->dfs_radartable = NULL;
     }
+    OS_FREE(dfs->dfs_radartable);
+    dfs->dfs_radartable = NULL;
 bad4:
     for (n = 0; n < DFS_MAX_RADAR_TYPES; n++) {
         if (dfs->dfs_dc_radarf[n]) {
@@ -536,6 +591,11 @@ dfs_detach(struct ieee80211com *ic)
             dfs->ath_radar_tasksched = 0;
         }
 
+   vos_timer_stop(&dfs->ath_dfs_radar_delay_timer);
+   vos_timer_destroy(&dfs->ath_dfs_radar_delay_timer);
+
+   vos_timer_stop(&dfs->ath_dfs_radar_ignore_timer);
+   vos_timer_destroy(&dfs->ath_dfs_radar_ignore_timer);
    if (dfs->ath_dfstest) {
       OS_CANCEL_TIMER(&dfs->ath_dfstesttimer);
       dfs->ath_dfstest = 0;
@@ -592,7 +652,7 @@ dfs_detach(struct ieee80211com *ic)
 
 
    if (dfs->dfs_radartable != NULL) {
-      for (n=0; n<256; n++) {
+      for (n = 0; n < MAX_DFS_RADAR_TABLE_TYPE; n++) {
          if (dfs->dfs_radartable[n] != NULL) {
             OS_FREE(dfs->dfs_radartable[n]);
             dfs->dfs_radartable[n] = NULL;
@@ -800,7 +860,7 @@ dfs_control(struct ieee80211com *ic, u_int id,
    case DFS_SET_THRESH:
       if (insize < sizeof(struct dfs_ioctl_params) || !indata) {
          DFS_DPRINTK(dfs, ATH_DEBUG_DFS1,
-             "%s: insize=%d, expected=%zu bytes, indata=%p\n",
+             "%s: insize=%d, expected=%zu bytes, indata=%pK\n",
              __func__, insize, sizeof(struct dfs_ioctl_params),
              indata);
          error = -EINVAL;
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_bindetects.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_bindetects.c
index 1c1b903e6e8..c0249a9a112 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_bindetects.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_bindetects.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2002-2013, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -165,6 +165,10 @@ dfs_add_pulse(struct ath_dfs *dfs, struct dfs_filter *rf, struct dfs_event *re,
         window = deltaT;
    dl->dl_elems[index].de_dur = re->re_dur;
    dl->dl_elems[index].de_rssi = re->re_rssi;
+   dl->dl_elems[index].de_seg_id  = re->re_seg_id;
+   dl->dl_elems[index].de_sidx    = re->sidx;
+   dl->dl_elems[index].de_delta_peak    = re->re_delta_peak;
+   dl->dl_elems[index].de_seq_num = dfs->dfs_seq_num;
 
    DFS_DPRINTK(dfs, ATH_DEBUG_DFS2,
        "%s: adding: filter id %d, dur=%d, rssi=%d, ts=%llu\n",
@@ -337,6 +341,9 @@ dfs_bin_pri_check(struct ath_dfs *dfs, struct dfs_filter *rf,
         u_int32_t i, j=0, primargin, durmargin, highscore=score, highscoreindex=0;
         int numpulses=1;  //first pulse in the burst is most likely being filtered out based on maxfilterlen
         int priscorechk=1,numpulsetochk=2,primatch=0;
+        int32_t sidx_min = DFS_BIG_SIDX;
+        int32_t sidx_max = -DFS_BIG_SIDX;
+        u_int8_t delta_peak_match_count = 1;
 
         //Use the adjusted PRI margin to reduce false alarms
         /* For non fixed pattern types, rf->rf_patterntype=0*/
@@ -425,10 +432,21 @@ dfs_bin_pri_check(struct ath_dfs *dfs, struct dfs_filter *rf,
                  }
 
                 if ( primatch && ( deltadur < durmargin) ) {
-         if ( (numpulses == 1)  ) {
-                           numpulses++;
-         } else {
-            delta_time_stamps = dl->dl_elems[delayindex].de_ts - prev_good_timestamp;
+                    if ( (numpulses == 1)  ) {
+                        dl->dl_seq_num_second =
+                                    dl->dl_elems[delayindex].de_seq_num;
+                        /* update sidx min/max for false detection check later*/
+                        numpulses++;
+                        if (sidx_min > dl->dl_elems[delayindex].de_sidx)
+                            sidx_min = dl->dl_elems[delayindex].de_sidx;
+                        if (sidx_max < dl->dl_elems[delayindex].de_sidx)
+                            sidx_max = dl->dl_elems[delayindex].de_sidx;
+                        if ((rf->rf_check_delta_peak) &&
+                                (dl->dl_elems[delayindex].de_delta_peak != 0))
+                            delta_peak_match_count++;
+                    } else {
+                        delta_time_stamps = dl->dl_elems[delayindex].de_ts -
+                            prev_good_timestamp;
                         if ((rf->rf_ignore_pri_window>0)) {
                             numpulsetochk = rf->rf_numpulses;
 
@@ -441,7 +459,21 @@ dfs_bin_pri_check(struct ath_dfs *dfs, struct dfs_filter *rf,
                         for (j = 0; j < numpulsetochk; j++){
                             delta_ts_variance = DFS_DIFF(delta_time_stamps, ((j+1)*fundamentalpri));
                             if ( delta_ts_variance < (2*(j+1)*primargin) ) {
+                                dl->dl_seq_num_stop =
+                                        dl->dl_elems[delayindex].de_seq_num;
                                 numpulses++;
+                                /**
+                                 * update sidx min/max for false detection check
+                                 * later
+                                 */
+                                if (sidx_min > dl->dl_elems[delayindex].de_sidx)
+                                    sidx_min = dl->dl_elems[delayindex].de_sidx;
+                                if (sidx_max < dl->dl_elems[delayindex].de_sidx)
+                                    sidx_max = dl->dl_elems[delayindex].de_sidx;
+                                if ((rf->rf_check_delta_peak) &&
+                                        (dl->dl_elems[delayindex].de_delta_peak
+                                        != 0))
+                                    delta_peak_match_count++;
                                 if (rf->rf_ignore_pri_window>0) {
                                     break;
                                 }
@@ -449,7 +481,10 @@ dfs_bin_pri_check(struct ath_dfs *dfs, struct dfs_filter *rf,
                         }
          }
          prev_good_timestamp = dl->dl_elems[delayindex].de_ts;
-
+         dl->dl_search_pri = searchpri;
+         dl->dl_min_sidx = sidx_min;
+         dl->dl_max_sidx = sidx_max;
+         dl->dl_delta_peak_match_count = delta_peak_match_count;
                         DFS_DPRINTK(dfs, ATH_DEBUG_DFS2,
                         "rf->minpri=%d rf->maxpri=%d searchpri = %d index = %d numpulses = %d deltapri=%d j=%d\n",
                         rf->rf_minpri, rf->rf_maxpri, searchpri, i, numpulses, deltapri, j);
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_fcc_bin5.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_fcc_bin5.c
index 5e9d2cbd5de..cae0abc2556 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_fcc_bin5.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_fcc_bin5.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2002-2013, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -359,7 +359,7 @@ dfs_check_chirping_sowl(struct ath_dfs *dfs, void *buf,
     /* DEBUG - Print relevant portions of the FFT data*/
     for (p=0; p < num_fft_packets; p++) {
 
-        DFS_DPRINTK(dfs, ATH_DEBUG_DFS_BIN5_FFT, "fft_data_ptr=0x%p\t", fft_data_ptr);
+        DFS_DPRINTK(dfs, ATH_DEBUG_DFS_BIN5_FFT, "fft_data_ptr=0x%pK\t", fft_data_ptr);
         DFS_DPRINTK(dfs, ATH_DEBUG_DFS_BIN5_FFT,
           "[66]=%d [69]=%d\n",
           *(fft_data_ptr+FFT_LOWER_BIN_MAX_INDEX_BYTE) >> 2,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_init.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_init.c
index b85b5a8a29a..445027bc4f6 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_init.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_init.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2002-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -86,13 +86,13 @@ void dfs_reset_alldelaylines(struct ath_dfs *dfs)
 
         if (pl == NULL) {
             VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                            "%s[%d]:  pl==NULL, dfs=%p", __func__, __LINE__, dfs);
+                            "%s[%d]:  pl==NULL, dfs=%pK", __func__, __LINE__, dfs);
             return;
         }
 
         if (dfs->dfs_b5radars == NULL) {
             VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-            "%s[%d]: pl==NULL, b5radars=%p", __func__, __LINE__, dfs->dfs_b5radars);
+            "%s[%d]: pl==NULL, b5radars=%pK", __func__, __LINE__, dfs->dfs_b5radars);
             return;
         }
 
@@ -312,6 +312,8 @@ int dfs_init_radar_filters(struct ieee80211com *ic,
 
     rf->rf_numpulses = numpulses;
     rf->rf_patterntype = dfs_radars[p].rp_patterntype;
+    rf->rf_sidx_spread = dfs_radars[p].rp_sidx_spread;
+    rf->rf_check_delta_peak = dfs_radars[p].rp_check_delta_peak;
     rf->rf_pulseid = dfs_radars[p].rp_pulseid;
     rf->rf_mindur = dfs_radars[p].rp_mindur;
     rf->rf_maxdur = dfs_radars[p].rp_maxdur;
@@ -405,6 +407,8 @@ int dfs_init_radar_filters(struct ieee80211com *ic,
 
         rf->rf_numpulses = numpulses;
         rf->rf_patterntype = dfs_radars[p].rp_patterntype;
+        rf->rf_sidx_spread = dfs_radars[p].rp_sidx_spread;
+        rf->rf_check_delta_peak = dfs_radars[p].rp_check_delta_peak;
         rf->rf_pulseid = dfs_radars[p].rp_pulseid;
         rf->rf_mindur = dfs_radars[p].rp_mindur;
         rf->rf_maxdur = dfs_radars[p].rp_maxdur;
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c
index a637484dda7..768493adefa 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -222,7 +222,7 @@ radar_summary_parse(struct ath_dfs *dfs, const char *buf, size_t len,
    OS_MEMCPY(rs, buf, sizeof(rs));
 
         DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR,"%s: two 32 bit values are: %08x %08x", __func__, rs[0], rs[1]);
-// DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR, "%s (p=%p):", __func__, buf);
+// DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR, "%s (p=%pK):", __func__, buf);
 
    /* Populate the fields from the summary report */
    rsu->tsf_offset =
@@ -445,7 +445,7 @@ tlv_calc_freq_info(struct ath_dfs *dfs, struct rx_radar_status *rs)
     * For now, just handle up to VHT80 correctly.
     */
    if (dfs->ic == NULL || dfs->ic->ic_curchan == NULL) {
-      DFS_PRINTK("%s: dfs->ic=%p, that or curchan is null?",
+      DFS_PRINTK("%s: dfs->ic=%pK, that or curchan is null?",
           __func__, dfs->ic);
       return (0);
    }
@@ -584,10 +584,10 @@ tlv_calc_event_freq_chirp(struct ath_dfs *dfs, struct rx_radar_status *rs,
 
    total_bw = delta_peak * (bin_resolution / radar_fft_long_period) *
        pulse_duration;
-
+#if(LINUX_VERSION_CODE >= KERNEL_VERSION(4,5,0))
    DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR | ATH_DEBUG_DFS_PHYERR_SUM,
        "%s: delta_peak=%d, pulse_duration=%d, bin_resolution=%d.%dKHz, "
-           "radar_fft_long_period=%d, total_bw=%d.%ldKHz",
+           "radar_fft_long_period=%d, total_bw=%d.%dKHz",
        __func__,
        delta_peak,
        pulse_duration,
@@ -596,7 +596,19 @@ tlv_calc_event_freq_chirp(struct ath_dfs *dfs, struct rx_radar_status *rs,
        radar_fft_long_period,
        total_bw / 100,
        abs(total_bw % 100));
-
+#else
+   DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR | ATH_DEBUG_DFS_PHYERR_SUM,
+       "%s: delta_peak=%d, pulse_duration=%d, bin_resolution=%d.%dKHz, "
+           "radar_fft_long_period=%d, total_bw=%d.%ldKHz",
+       __func__,
+       delta_peak,
+       pulse_duration,
+       bin_resolution / 1000,
+       bin_resolution % 1000,
+       radar_fft_long_period,
+       total_bw / 100,
+       (long int)abs(total_bw % 100));
+#endif
        total_bw /= 100; /* back to KHz */
 
    /* Grab the channel centre frequency in MHz */
@@ -702,6 +714,8 @@ dfs_process_phyerr_bb_tlv(struct ath_dfs *dfs, void *buf, u_int16_t datalen,
    e->is_ext = 0;
    e->is_dc = 0;
    e->is_early = 0;
+   e->pulse_delta_peak = rs.delta_peak;
+   e->pulse_delta_diff = rs.delta_diff;
    /*
     * XXX TODO: add a "chirp detection enabled" capability or config
     * bit somewhere, in case for some reason the hardware chirp
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_process_phyerr.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_process_phyerr.c
index f61d6628800..ac18b14a639 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_process_phyerr.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_process_phyerr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002-2014,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2002-2014,2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -199,9 +199,10 @@ dfs_process_phyerr_owl(struct ath_dfs *dfs, void *buf, u_int16_t datalen,
    /*
     * This is a spurious event; toss.
     */
-   if (rssi == 0 && dur == 0)
+   if (rssi == 0 && dur == 0) {
       dfs->ath_dfs_stats.datalen_discards++;
       return (0);
+   }
 
    /*
     * Fill out dfs_phy_err with the information we have
@@ -860,6 +861,8 @@ dfs_process_phyerr(struct ieee80211com *ic, void *buf, u_int16_t datalen,
          event->re_ts = (e.rs_tstamp) & DFS_TSMASK;
          event->re_rssi = e.rssi;
          event->sidx = e.sidx;
+         event->re_delta_diff = e.pulse_delta_diff;
+         event->re_delta_peak = e.pulse_delta_peak;
 
          /*
           * Handle chirp flags.
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_process_radarevent.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_process_radarevent.c
index e89800caac8..697e283a08e 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_process_radarevent.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/DFS/src/dfs_process_radarevent.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2002-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -65,6 +65,10 @@
 #define FREQ_5500_MHZ       5500
 
 #define DFS_MAX_FREQ_SPREAD            1375 * 1
+#define DFS_INVALID_PRI_LIMIT 100  /* should we use 135? */
+#define DFS_BIG_SIDX          10000
+
+#define FRAC_PRI_SCORE_ARRAY_SIZE 40
 
 static char debug_dup[33];
 static int debug_dup_cnt;
@@ -107,6 +111,161 @@ dfs_process_pulse_dur(struct ath_dfs *dfs, u_int8_t re_dur)
    return (u_int8_t)dfs_round((int32_t)((dfs->dur_multiplier)*re_dur));
 }
 
+
+/**
+ * dfs_confirm_radar() - more rigid check for radar detection
+ * check for jitter in frequency (sidx) to be within certain limit
+ * introduce a fractional PRI check
+ * add a check to look for chirp in ETSI type 4 radar
+ * @dfs: pointer to dfs structure
+ *
+ * Return: max dur difference in sidx1_sidx2 pulse line
+ */
+static int dfs_confirm_radar(struct ath_dfs *dfs, struct dfs_filter *rf,
+			int ext_chan_flag)
+{
+	int i = 0;
+	int index;
+	struct dfs_delayline *dl = &rf->rf_dl;
+	struct dfs_delayelem *de;
+	u_int64_t target_ts = 0;
+	struct dfs_pulseline *pl;
+	int start_index = 0, current_index, next_index;
+	unsigned char scores[FRAC_PRI_SCORE_ARRAY_SIZE];
+	u_int32_t pri_margin;
+	u_int64_t this_diff_ts;
+	u_int32_t search_bin;
+	unsigned char max_score = 0;
+	int max_score_index = 0;
+
+	pl = dfs->pulses;
+	OS_MEMZERO(scores, sizeof(scores));
+	scores[0] = rf->rf_threshold;
+	pri_margin = dfs_get_pri_margin(dfs, ext_chan_flag,
+					(rf->rf_patterntype == 1));
+
+	/**
+	 * look for the entry that matches dl_seq_num_second
+	 * we need the time stamp and diff_ts from there
+	 */
+	for (i = 0; i < dl->dl_numelems; i++) {
+		index = (dl->dl_firstelem + i) & DFS_MAX_DL_MASK;
+		de = &dl->dl_elems[index];
+		if (dl->dl_seq_num_second == de->de_seq_num)
+			target_ts = de->de_ts - de->de_time;
+	}
+
+	if (dfs->dfs_debug_mask & ATH_DEBUG_DFS2) {
+		dfs_print_delayline(dfs, &rf->rf_dl);
+
+		/* print pulse line */
+		DFS_DPRINTK(dfs, ATH_DEBUG_DFS2, "%s: Pulse Line\n", __func__);
+		for (i = 0; i < pl->pl_numelems; i++) {
+			index =  (pl->pl_firstelem + i) &
+				DFS_MAX_PULSE_BUFFER_MASK;
+			DFS_DPRINTK(dfs, ATH_DEBUG_DFS2,
+				"Elem %u: ts=%llu dur=%u, seq_num=%d, delta_peak=%d\n",
+				i, pl->pl_elems[index].p_time,
+				pl->pl_elems[index].p_dur,
+				pl->pl_elems[index].p_seq_num,
+				pl->pl_elems[index].p_delta_peak);
+		}
+	}
+
+	/**
+	 * walk through the pulse line and find pulse with target_ts
+	 * then continue until we find entry with seq_number dl_seq_num_stop
+	 */
+
+	for (i = 0; i < pl->pl_numelems; i++) {
+		index =  (pl->pl_firstelem + i) & DFS_MAX_PULSE_BUFFER_MASK;
+		if (pl->pl_elems[index].p_time == target_ts) {
+			dl->dl_seq_num_start = pl->pl_elems[index].p_seq_num;
+			/* save for future use */
+			start_index = index;
+		}
+	}
+
+	DFS_DPRINTK(dfs, ATH_DEBUG_DFS2, "%s: target_ts=%llu, dl_seq_num_start=%d, dl_seq_num_second=%d, dl_seq_num_stop=%d\n",
+					__func__, target_ts,
+					dl->dl_seq_num_start,
+					dl->dl_seq_num_second,
+					dl->dl_seq_num_stop);
+
+	current_index = start_index;
+	while (pl->pl_elems[current_index].p_seq_num < dl->dl_seq_num_stop) {
+		next_index = (current_index + 1) & DFS_MAX_PULSE_BUFFER_MASK;
+		this_diff_ts = pl->pl_elems[next_index].p_time -
+				pl->pl_elems[current_index].p_time;
+		/* now update the score for this diff_ts */
+		for (i = 1; i < FRAC_PRI_SCORE_ARRAY_SIZE; i++) {
+			search_bin = dl->dl_search_pri / (i + 1);
+
+			/**
+			 * we do not give score to PRI that is lower then the
+			 * limit
+			 */
+			if (search_bin < DFS_INVALID_PRI_LIMIT)
+				break;
+			/**
+			 * increment the score if this_diff_ts belongs to this
+			 * search_bin +/- margin
+			 */
+			if ((this_diff_ts >= (search_bin - pri_margin)) &&
+				(this_diff_ts <= (search_bin + pri_margin)))
+				/*increment score */
+				scores[i]++;
+		}
+		current_index = next_index;
+	}
+	for (i = 0; i < FRAC_PRI_SCORE_ARRAY_SIZE; i++) {
+		if (scores[i] > max_score) {
+			max_score = scores[i];
+			max_score_index = i;
+		}
+	}
+	if (max_score_index != 0) {
+		VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+			"%s, Rejecting Radar since Fractional PRI detected: searchpri=%d, threshold=%d, fractional PRI=%d, Fractional PRI score=%d\n",
+			__func__, dl->dl_search_pri, scores[0],
+			dl->dl_search_pri/(max_score_index + 1), max_score);
+		DFS_PRINTK("%s: Rejecting Radar since Fractional PRI detected: searchpri=%d, threshold=%d, fractional PRI=%d, Fractional PRI score=%d\n",
+			 __func__, dl->dl_search_pri, scores[0],
+			dl->dl_search_pri/(max_score_index + 1), max_score);
+		return 0;
+	}
+
+	/* check for frequency spread */
+	if (dl->dl_min_sidx > pl->pl_elems[start_index].p_sidx)
+		dl->dl_min_sidx = pl->pl_elems[start_index].p_sidx;
+	if (dl->dl_max_sidx < pl->pl_elems[start_index].p_sidx)
+		dl->dl_max_sidx = pl->pl_elems[start_index].p_sidx;
+	if ((dl->dl_max_sidx - dl->dl_min_sidx) > rf->rf_sidx_spread) {
+		VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+			"%s: Rejecting Radar since frequency spread is too large : min_sidx=%d, max_sidx=%d, rf_sidx_spread=%d\n",
+			__func__, dl->dl_min_sidx, dl->dl_max_sidx,
+			rf->rf_sidx_spread);
+		DFS_PRINTK("%s: Rejecting Radar since frequency spread is too large : min_sidx=%d, max_sidx=%d, rf_sidx_spread=%d\n",
+			__func__, dl->dl_min_sidx, dl->dl_max_sidx,
+			rf->rf_sidx_spread);
+		return 0;
+	}
+
+	if ((rf->rf_check_delta_peak) &&
+		((dl->dl_delta_peak_match_count) < rf->rf_threshold)) {
+		VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+			"%s: Rejecting Radar since delta peak values are invalid : dl_delta_peak_match_count=%d, rf_threshold=%d\n",
+			__func__, dl->dl_delta_peak_match_count,
+			rf->rf_threshold);
+
+		DFS_PRINTK("%s: Rejecting Radar since delta peak values are invalid : dl_delta_peak_match_count=%d, rf_threshold=%d\n",
+			__func__, dl->dl_delta_peak_match_count,
+			rf->rf_threshold);
+		return 0;
+	}
+	return 1;
+}
+
 /*
  * dfs_process_dc_pulse: process dc pulses
  * @dfs: pointer to dfs structure
@@ -117,12 +276,12 @@ dfs_process_pulse_dur(struct ath_dfs *dfs, u_int8_t re_dur)
  * Return: None
  */
 static void dfs_process_dc_pulse(struct ath_dfs *dfs, struct dfs_event *event,
-                                 int *retval, uint64_t this_ts)
+                          int *retval, uint64_t this_ts, int *false_radar_found)
 {
     struct dfs_event re;
     struct dfs_state *rs=NULL;
     struct dfs_filtertype *ft;
-    struct dfs_filter *rf;
+    struct dfs_filter *rf = NULL;
     int found, p, empty;
     int min_pri, miss_pulse_number = 0, deviation = 0;
     u_int32_t tabledepth = 0;
@@ -136,7 +295,7 @@ static void dfs_process_dc_pulse(struct ath_dfs *dfs, struct dfs_event *event,
 
     while ((tabledepth < DFS_MAX_RADAR_OVERLAP) &&
            ((dfs->dfs_dc_radartable[re.re_dur])[tabledepth] != -1) &&
-           (!*retval)) {
+           (!*retval) && (!*false_radar_found)) {
         ft = dfs->dfs_dc_radarf[((dfs->dfs_dc_radartable
                                              [re.re_dur])[tabledepth])];
 
@@ -169,7 +328,8 @@ static void dfs_process_dc_pulse(struct ath_dfs *dfs, struct dfs_event *event,
             tabledepth++;
             continue;
         }
-        for (p = 0, found = 0; (p < ft->ft_numfilters) && (!found); p++) {
+        for (p = 0, found = 0; (p < ft->ft_numfilters) && (!found) &&
+                               (!*false_radar_found); p++) {
             rf = ft->ft_filters[p];
             if ((re.re_dur >= rf->rf_mindur) &&
                 (re.re_dur <= rf->rf_maxdur)) {
@@ -248,9 +408,22 @@ static void dfs_process_dc_pulse(struct ath_dfs *dfs, struct dfs_event *event,
                 if (rf->rf_patterntype == 2)
                     found = dfs_staggered_check(dfs, rf, (uint32_t)deltaT,
                                                 re.re_dur);
-                else
-                    found = dfs_bin_check(dfs, rf, (uint32_t) deltaT,
-                                          re.re_dur, ext_chan_event_flag);
+                else {
+                    if (dfs_bin_check(dfs, rf, (uint32_t) deltaT,
+                                          re.re_dur, ext_chan_event_flag)) {
+                        found = 1;
+                        /**
+                         * do additioal check to conirm radar except for the
+                         * following staggered, chirp FCC Bin 5, frequency
+                         * hopping indicated by rf_patterntype == 1
+                         */
+                        if (rf->rf_patterntype != 1) {
+                            found = dfs_confirm_radar(dfs, rf,
+                                                      ext_chan_event_flag);
+                            *false_radar_found = (found == 1)? 0 : 1;
+                        }
+                    }
+                }
 
                 if (dfs->dfs_debug_mask & ATH_DEBUG_DFS2)
                     dfs_print_delayline(dfs, &rf->rf_dl);
@@ -276,6 +449,44 @@ static void dfs_process_dc_pulse(struct ath_dfs *dfs, struct dfs_event *event,
     }
 }
 
+/**
+ * dfs_cal_sidx1_sidx2_dur_diff() - cal dur difference in sidx1_sidx2
+ * pluse line
+ * @dfs: pointer to dfs structure
+ *
+ * Return: max dur difference in sidx1_sidx2 pulse line
+ */
+static int dfs_cal_sidx1_sidx2_dur_diff(struct ath_dfs *dfs)
+{
+	u_int32_t index, loop;
+	u_int32_t lowdur, highdur;
+	struct dfs_sidx1_sidx2_pulse_line *sidx1_sidx2_p;
+	struct dfs_pulseline *pl;
+
+	if (dfs == NULL) {
+		VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+			"%s[%d]: dfs is NULL", __func__, __LINE__);
+		return 0;
+	}
+	pl = dfs->pulses;
+	sidx1_sidx2_p = &dfs->sidx1_sidx2_elems;
+	lowdur = highdur =
+		sidx1_sidx2_p->pl_elems[sidx1_sidx2_p->pl_lastelem].p_dur;
+	for (loop = 0; loop < sidx1_sidx2_p->pl_numelems; loop++) {
+		index = sidx1_sidx2_p->pl_firstelem + loop;
+		index &= DFS_SIDX1_SIDX2_MASK;
+		if (sidx1_sidx2_p->pl_elems[index].p_time >
+				pl->pl_elems[pl->pl_lastelem].p_time -
+			DFS_SIDX1_SIDX2_TIME_WINDOW) {
+			if (sidx1_sidx2_p->pl_elems[index].p_dur < lowdur)
+				lowdur = sidx1_sidx2_p->pl_elems[index].p_dur;
+			if (sidx1_sidx2_p->pl_elems[index].p_dur > highdur)
+				highdur = sidx1_sidx2_p->pl_elems[index].p_dur;
+		}
+	}
+	return highdur - lowdur;
+}
+
 /*
  * Process a radar event.
  *
@@ -289,18 +500,17 @@ static void dfs_process_dc_pulse(struct ath_dfs *dfs, struct dfs_event *event,
 int
 dfs_process_radarevent(struct ath_dfs *dfs, struct ieee80211_channel *chan)
 {
-//commenting for now to validate radar indication msg to SAP
-//#if 0
     struct dfs_event re,*event;
     struct dfs_state *rs=NULL;
     struct dfs_filtertype *ft;
     struct dfs_filter *rf;
     int found, retval = 0, p, empty;
     int events_processed = 0;
-    u_int32_t tabledepth, index;
+    u_int32_t tabledepth, index, sidx1_sidx2_index;
     u_int64_t deltafull_ts = 0, this_ts, deltaT;
     struct ieee80211_channel *thischan;
     struct dfs_pulseline *pl;
+    struct dfs_sidx1_sidx2_pulse_line *sidx1_sidx2_p;
     static u_int32_t  test_ts  = 0;
     static u_int32_t  diff_ts  = 0;
     int ext_chan_event_flag = 0;
@@ -308,6 +518,7 @@ dfs_process_radarevent(struct ath_dfs *dfs, struct ieee80211_channel *chan)
     int pri_multiplier = 2;
 #endif
     int i;
+    int false_radar_found = 0;
 
    if (dfs == NULL) {
       VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
@@ -315,6 +526,7 @@ dfs_process_radarevent(struct ath_dfs *dfs, struct ieee80211_channel *chan)
       return 0;
    }
     pl = dfs->pulses;
+    sidx1_sidx2_p = &dfs->sidx1_sidx2_elems;
    adf_os_spin_lock_bh(&dfs->ic->chan_lock);
    if ( !(IEEE80211_IS_CHAN_DFS(dfs->ic->ic_curchan))) {
            adf_os_spin_unlock_bh(&dfs->ic->chan_lock);
@@ -378,7 +590,8 @@ dfs_process_radarevent(struct ath_dfs *dfs, struct ieee80211_channel *chan)
    empty = STAILQ_EMPTY(&(dfs->dfs_radarq));
    ATH_DFSQ_UNLOCK(dfs);
 
-   while ((!empty) && (!retval) && (events_processed < MAX_EVENTS)) {
+   while ((!empty) && (!retval) && (events_processed < MAX_EVENTS) &&
+          (!false_radar_found)) {
       ATH_DFSQ_LOCK(dfs);
       event = STAILQ_FIRST(&(dfs->dfs_radarq));
       if (event != NULL)
@@ -540,6 +753,24 @@ dfs_process_radarevent(struct ath_dfs *dfs, struct ieee80211_channel *chan)
                 pl->pl_elems[index].p_time = this_ts;
                 pl->pl_elems[index].p_dur = re.re_dur;
                 pl->pl_elems[index].p_rssi = re.re_rssi;
+                pl->pl_elems[index].p_sidx = re.sidx;
+                pl->pl_elems[index].p_delta_peak = re.re_delta_peak;
+                if (dfs->dfs_enable_radar_war &&
+                            (re.sidx == 1 || re.sidx == 2)) {
+                        sidx1_sidx2_index = (sidx1_sidx2_p->pl_lastelem + 1) &
+                                DFS_SIDX1_SIDX2_MASK;
+                        if (sidx1_sidx2_p->pl_numelems == DFS_SIDX1_SIDX2_SIZE)
+                                sidx1_sidx2_p->pl_firstelem =
+                                        (sidx1_sidx2_p->pl_firstelem + 1) &
+                                        DFS_SIDX1_SIDX2_MASK;
+                        else
+                                sidx1_sidx2_p->pl_numelems++;
+                        sidx1_sidx2_p->pl_lastelem = sidx1_sidx2_index;
+                        sidx1_sidx2_p->pl_elems[sidx1_sidx2_index].p_time =
+                                this_ts;
+                        sidx1_sidx2_p->pl_elems[sidx1_sidx2_index].p_dur =
+                                re.re_dur;
+                }
                 diff_ts = (u_int32_t)this_ts - test_ts;
                 test_ts = (u_int32_t)this_ts;
                 DFS_DPRINTK(dfs, ATH_DEBUG_DFS1,"ts%u %u %u diff %u pl->pl_lastelem.p_time=%llu",(u_int32_t)this_ts, re.re_dur, re.re_rssi, diff_ts, (unsigned long long)pl->pl_elems[index].p_time);
@@ -556,6 +787,8 @@ dfs_process_radarevent(struct ath_dfs *dfs, struct ieee80211_channel *chan)
                     __func__, __LINE__, (u_int32_t)this_ts,
                     re.re_dur, re.re_rssi, diff_ts, re.sidx, re.re_flags,
                     (unsigned long long)pl->pl_elems[index].p_time);
+                dfs->dfs_seq_num++;
+                pl->pl_elems[index].p_seq_num = dfs->dfs_seq_num;
 
                 /* If diff_ts is very small, we might be getting false pulse detects
                  * due to heavy interference. We might be getting spectral splatter
@@ -563,9 +796,24 @@ dfs_process_radarevent(struct ath_dfs *dfs, struct ieee80211_channel *chan)
                  * clear the delay-lines. This might impact positive detections under
                  * harsh environments, but helps with false detects. */
 
-         if (diff_ts < 100) {
+         if (diff_ts < DFS_INVALID_PRI_LIMIT) {
+            dfs->dfs_seq_num = 0;
             dfs_reset_alldelaylines(dfs);
             dfs_reset_radarq(dfs);
+            index = (pl->pl_lastelem + 1) & DFS_MAX_PULSE_BUFFER_MASK;
+            if (pl->pl_numelems == DFS_MAX_PULSE_BUFFER_SIZE)
+                pl->pl_firstelem = (pl->pl_firstelem+1) &
+                                    DFS_MAX_PULSE_BUFFER_MASK;
+            else
+                pl->pl_numelems++;
+            pl->pl_lastelem = index;
+            pl->pl_elems[index].p_time = this_ts;
+            pl->pl_elems[index].p_dur = re.re_dur;
+            pl->pl_elems[index].p_rssi = re.re_rssi;
+            pl->pl_elems[index].p_sidx = re.sidx;
+            pl->pl_elems[index].p_delta_peak = re.re_delta_peak;
+            dfs->dfs_seq_num++;
+            pl->pl_elems[index].p_seq_num = dfs->dfs_seq_num;
          }
 
          found = 0;
@@ -713,14 +961,14 @@ dfs_process_radarevent(struct ath_dfs *dfs, struct ieee80211_channel *chan)
               ((dfs->dfsdomain == DFS_FCC_DOMAIN) ||
                (dfs->dfsdomain == DFS_MKK4_DOMAIN) ||
                (dfs->dfsdomain == DFS_ETSI_DOMAIN && re.re_dur < 18))) {
-          dfs_process_dc_pulse(dfs, &re, &retval, this_ts);
+          dfs_process_dc_pulse(dfs, &re, &retval, this_ts, &false_radar_found);
       }
 
       /* Pulse not at DC position */
       else {
         while ((tabledepth < DFS_MAX_RADAR_OVERLAP) &&
              ((dfs->dfs_radartable[re.re_dur])[tabledepth] != -1) &&
-             (!retval)) {
+             (!retval) && (!false_radar_found)) {
          ft = dfs->dfs_radarf[((dfs->dfs_radartable[re.re_dur])[tabledepth])];
          DFS_DPRINTK(dfs, ATH_DEBUG_DFS2,"  ** RD (%d): ts %x dur %u rssi %u",
                    rs->rs_chan.ic_freq,
@@ -745,7 +993,8 @@ dfs_process_radarevent(struct ath_dfs *dfs, struct ieee80211_channel *chan)
                                 tabledepth++;
             continue;
          }
-         for (p=0, found = 0; (p<ft->ft_numfilters) && (!found); p++) {
+         for (p=0, found = 0; (p<ft->ft_numfilters) && (!found) &&
+                              (!false_radar_found); p++) {
                                     rf = ft->ft_filters[p];
                                     if ((re.re_dur >= rf->rf_mindur) && (re.re_dur <= rf->rf_maxdur)) {
                                         /* The above check is probably not necessary */
@@ -802,9 +1051,30 @@ VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO, "%s[%d]:filterID= %d :: Rejec
                                         if (rf->rf_patterntype == 2) {
                                             found = dfs_staggered_check(dfs, rf, (u_int32_t) deltaT, re.re_dur);
                                         } else {
-                                            found = dfs_bin_check(dfs, rf, (u_int32_t) deltaT, re.re_dur, ext_chan_event_flag);
+                                            if (dfs_bin_check(dfs, rf,
+                                                         (u_int32_t) deltaT,
+                                                         re.re_dur,
+                                                         ext_chan_event_flag)) {
+                                                found = 1;
+                                                /**
+                                                 * do additioal check to conirm
+                                                 * radar except for the
+                                                 * following staggered, chirp
+                                                 * FCC Bin 5, frequency hopping
+                                                 * indicated by
+                                                 * rf_patterntype == 1
+                                                 */
+                                                if (rf->rf_patterntype != 1) {
+                                                    found = dfs_confirm_radar(
+                                                           dfs, rf,
+                                                           ext_chan_event_flag);
+                                                    false_radar_found =
+                                                            (found == 1)? 0 : 1;
+                                                }
+                                            }
                                         }
                                         if (dfs->dfs_debug_mask & ATH_DEBUG_DFS2) {
+                                            if (rf->rf_patterntype != 1)
                                                 dfs_print_delayline(dfs, &rf->rf_dl);
                                         }
                                         rf->rf_dl.dl_last_ts = this_ts;
@@ -830,6 +1100,13 @@ VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO, "%s[%d]:filterID= %d :: Rejec
    }
 dfsfound:
    if (retval) {
+      if (dfs->dfs_enable_radar_war &&
+            (DFS_SIDX1_SIDX2_DR_LIM < dfs_cal_sidx1_sidx2_dur_diff(dfs))) {
+         VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
+            "%s [%d] false detection",__func__,__LINE__);
+         return 0;
+      }
+
       /* Collect stats */
       dfs->ath_dfs_stats.num_radar_detects++;
       thischan = &rs->rs_chan;
@@ -880,8 +1157,15 @@ thischan->ic_freq);
                 dfs->dfs_phyerr_w53_counter  = 0;
    }
         //VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO, "IN FUNC %s[%d]: retval = %d ",__func__,__LINE__,retval);
+   if (false_radar_found) {
+       dfs->dfs_seq_num = 0;
+       dfs_reset_radarq(dfs);
+       dfs_reset_alldelaylines(dfs);
+       dfs->dfs_phyerr_freq_min     = 0x7fffffff;
+       dfs->dfs_phyerr_freq_max     = 0;
+       dfs->dfs_phyerr_w53_counter  = 0;
+   }
    return retval;
-//#endif
 //        return 1;
 }
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/ar9888def.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/ar9888def.h
index b26b1b74f52..5569d16b435 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/ar9888def.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/ar9888def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -26,7 +26,7 @@
  */
 
 #ifndef _AR9888DEF_H_
-#define AR9888__AR9888DEF_H_
+#define _AR9888DEF_H_
 
 /* Base Addresses */
 #define AR9888_RTC_SOC_BASE_ADDRESS                     0x00004000
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine.c
index 9619e93d07f..ebece13f3e0 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014,2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -68,6 +68,48 @@ enum hif_ce_event_type {
 	HIF_TX_DESC_COMPLETION,
 };
 
+static struct hif_pci_softc *hif_sc = NULL;
+/**
+ * target_reset_work_handler() - Work queue handler to reset target
+ * @sc: work queue handle
+ */
+void target_reset_work_handler(struct work_struct *sc)
+{
+	if (hif_sc)
+		vos_device_crashed(hif_sc->dev);
+}
+
+static DECLARE_WORK(target_reset_work, target_reset_work_handler);
+
+/**
+ * ce_target_reset() - Trigger SSR
+ * @sc: hif layer handle
+ *
+ * Once hw error is hit, SSR would be triggered.
+ */
+void ce_target_reset(struct hif_pci_softc *sc)
+{
+	hif_sc = sc;
+	adf_os_warn(1);
+	adf_os_print("Trigger SSR.\n");
+	schedule_work(&target_reset_work);
+}
+
+/**
+ * ce_idx_invalid() - check whether a CE index is valid
+ * @ring: ring handle
+ * @idx: CE idx
+ */
+static bool ce_idx_invalid(struct CE_ring_state *ring, unsigned int idx)
+{
+	if (ring->nentries <= idx) {
+		adf_os_print("hw index %d is not correct.\n", idx);
+		return TRUE;
+	} else {
+		return FALSE;
+	}
+}
+
 #ifdef CONFIG_SLUB_DEBUG_ON
 
 /**
@@ -831,6 +873,9 @@ CE_completed_send_next_nolock(struct CE_state *CE_state,
         A_TARGET_ACCESS_BEGIN_RET(targid);
         src_ring->hw_index = CE_SRC_RING_READ_IDX_GET(targid, ctrl_addr);
         A_TARGET_ACCESS_END_RET(targid);
+
+        if (ce_idx_invalid(src_ring, src_ring->hw_index))
+            return status;
     }
     read_index = src_ring->hw_index;
 
@@ -1043,20 +1088,27 @@ static inline bool ce_is_valid_entries(struct hif_pci_softc *sc,
 {
 	bool status;
 	A_target_id_t targid = TARGID(sc);
+	unsigned int hw_index =
+			CE_DEST_RING_READ_IDX_GET(targid, ce_state->ctrl_addr);
 
 	/* check if difference between hw index and read index is with in
 	* nentries_mask limit.
 	*/
-	if (ring_delta < ce_state->dest_ring->nentries_mask) {
+	if ((ring_delta < ce_state->dest_ring->nentries_mask) &&
+		(hw_index != CE_HW_INDEX_LINK_DOWN)) {
 		adf_os_print("%s: spent more time during rx proceesing for CE%d, allow other CE to process Rx packet.\n",
 				__func__, ce_state->id);
 		status = true;
+	} else if (hw_index  == CE_HW_INDEX_LINK_DOWN) {
+		status = false;
+		adf_os_print("%s: hw index is invalid due to link down \n", __func__);
 	} else {
 		adf_os_print("%s:Potential infinite loop detected during rx processing for CE%d\n",
-		__func__, ce_state->id);
-		VOS_BUG(0);
+			__func__, ce_state->id);
+		ce_target_reset(sc);
 		status = false;
 	}
+
 	adf_os_print("nentries_mask:0x%x sw read_idx:0x%x hw read_idx:0x%x ring_delta:0x%x\n",
 		ce_state->dest_ring->nentries_mask,
 		ce_state->dest_ring->sw_index,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine_api.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine_api.h
index d69641540ab..e48fd63bc11 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -376,6 +376,13 @@ bool CE_get_rx_pending(struct hif_pci_softc *sc);
 
 int get_next_record_index(atomic_t *table_index, int array_size);
 
+/**
+ * ce_target_reset() - Trigger SSR
+ * @sc: hif layer handle
+ *
+ * Once hw error is hit, SSR would be triggered.
+ */
+void ce_target_reset(struct hif_pci_softc *sc);
 
 /* CE_attr.flags values */
 #define CE_ATTR_NO_SNOOP                0x01  /* Use NonSnooping PCIe accesses? */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine_internal.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine_internal.h
index 65d505e4321..08db7ca11f6 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine_internal.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/copy_engine_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -216,6 +216,7 @@ struct CE_sendlist_s {
 
 #define CDC_WAR_MAGIC_STR   0xceef0000
 #define CDC_WAR_DATA_CE     4
+#define CE_HW_INDEX_LINK_DOWN 0xFFFFFFFF
 
 /* Additional internal-only CE_send flags */
 #define CE_SEND_FLAG_GATHER             0x00010000         /* Use Gather */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/hif_pci.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/hif_pci.c
index 498f8d6ef69..508aac9566c 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/hif_pci.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/hif_pci.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -464,10 +464,10 @@ HIF_PCI_CE_send_done(struct CE_handle *copyeng, void *ce_context, void *transfer
             adf_os_spin_unlock(&pipe_info->completion_freeq_lock);
             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
                             ("Out of free buf in hif send completion list, potential hw_index corruption"
-                             "pipe_num:%d num_send_allowed:%d pipe_info:0x%p sw_index:%d hw_index:%d nbytes:%d\n",
+                             "pipe_num:%d num_send_allowed:%d pipe_info:0x%pK sw_index:%d hw_index:%d nbytes:%d\n",
                             pipe_info->pipe_num, pipe_info->num_sends_allowed,
                             pipe_info, sw_idx, hw_idx, nbytes));
-            ASSERT(0);
+            ce_target_reset(hif_state->sc);
             break;
         }
         pipe_info->completion_freeq_head = compl_state->next;
@@ -538,7 +538,13 @@ HIF_PCI_CE_recv_data(struct CE_handle *copyeng, void *ce_context, void *transfer
         hif_pm_runtime_mark_last_busy(sc->dev);
         adf_os_spin_lock(&pipe_info->completion_freeq_lock);
         compl_state = pipe_info->completion_freeq_head;
-        ASSERT(compl_state != NULL);
+
+        if (!compl_state) {
+            adf_os_spin_unlock(&pipe_info->completion_freeq_lock);
+            ce_target_reset(sc);
+            break;
+        }
+
         pipe_info->completion_freeq_head = compl_state->next;
         adf_os_spin_unlock(&pipe_info->completion_freeq_lock);
 
@@ -657,7 +663,7 @@ hif_completion_thread_startup(struct HIF_CE_state *hif_state)
         attr = host_CE_config[pipe_num];
         completions_needed = 0;
         if (attr.src_nentries) { /* pipe used to send to target */
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("pipe_num:%d pipe_info:0x%p\n",
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("pipe_num:%d pipe_info:0x%pK\n",
                             pipe_num, pipe_info));
             CE_send_cb_register(pipe_info->ce_hdl, HIF_PCI_CE_send_done, pipe_info, attr.flags & CE_ATTR_DISABLE_INTR);
             completions_needed += attr.src_nentries;
@@ -857,13 +863,13 @@ hif_completion_thread(struct HIF_CE_state *hif_state)
 				To see the following debug output, enable the HIF_PCI_DEBUG flag in
 				the debug module declaration in this source file
 				*/
-				AR_DEBUG_PRINTF(HIF_PCI_DEBUG,("HIF_PCI_CE_recv_data netbuf=%p  nbytes=%d\n", netbuf, nbytes));
+				AR_DEBUG_PRINTF(HIF_PCI_DEBUG,("HIF_PCI_CE_recv_data netbuf=%pK  nbytes=%d\n", netbuf, nbytes));
                 if (nbytes <= pipe_info->buf_sz) {
                     adf_nbuf_set_pktlen(netbuf, nbytes);
                     msg_callbacks->rxCompletionHandler(msg_callbacks->Context,
                                                        netbuf, pipe_info->pipe_num);
                 } else {
-                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Invalid Rx message netbuf:%p nbytes:%d\n",
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Invalid Rx message netbuf:%pK nbytes:%d\n",
                                                     netbuf, nbytes));
                     adf_nbuf_free(netbuf);
                 }
@@ -1810,8 +1816,9 @@ hif_send_buffer_cleanup_on_pipe(struct HIF_CE_pipe_info *pipe_info)
                 return;
             }
             /* Indicate the completion to higer layer to free the buffer */
-            hif_state->msg_callbacks_current.txCompletionHandler(
-                hif_state->msg_callbacks_current.Context, netbuf, id);
+            if (hif_state->msg_callbacks_current.txCompletionHandler)
+                hif_state->msg_callbacks_current.txCompletionHandler(
+                    hif_state->msg_callbacks_current.Context, netbuf, id);
         }
     }
 }
@@ -2618,7 +2625,8 @@ HIF_PCIDeviceProbed(hif_handle_t hif_hdl)
 	          AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("ath: HIF_PCIDeviceProbed get chip id val (%d)\n", rv));
 		  goto done;
 	     }
-	     if (CHIP_ID_VERSION_GET(chip_id) == 0xD) {
+	     if (CHIP_ID_VERSION_GET(chip_id) == 0xD ||
+                 CHIP_ID_VERSION_GET(chip_id) == 0xF) {
              scn->target_revision = CHIP_ID_REVISION_GET(chip_id);
              switch(CHIP_ID_REVISION_GET(chip_id)) {
              case 0x2: /* ROME 1.3 */
@@ -2632,6 +2640,7 @@ HIF_PCIDeviceProbed(hif_handle_t hif_hdl)
              case 0x8: /* ROME 3.0 */
              case 0x9: /* ROME 3.1 */
              case 0xA: /* ROME 3.2 */
+             case 0xD: /* Naples */
                  banks_switched = 9;
                  break;
              case 0x0: /* ROME 1.0 */
@@ -2857,11 +2866,18 @@ HIFTargetSleepStateAdjust(A_target_id_t targid,
 
                     printk("%s:error, can't wakeup target\n", __func__);
                     hif_msm_pcie_debug_info(sc);
-                    if (!sc->ol_sc->enable_self_recovery)
-                            VOS_BUG(0);
-                    sc->recovery = true;
-                    vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
-                    vos_wlan_pci_link_down();
+
+                    if (!vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
+                        sc->recovery = true;
+                        vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
+                        if (!sc->ol_sc->enable_self_recovery)
+                            vos_device_crashed(sc->dev);
+                        else
+                            vos_wlan_pci_link_down();
+                    } else {
+                        adf_os_print("%s- %d: SSR is in progress!!!!\n",
+                                     __func__, __LINE__);
+                    }
                     return -EACCES;
                 }
 
@@ -3013,7 +3029,7 @@ HIFTargetDumpAccessLog(void)
     for(idx = 0; idx < len; idx++)
     {
         cur_idx = (start_idx + idx) % PCIE_ACCESS_LOG_NUM;
-        printk("idx:%d\t sn:%u wr:%d addr:%p val:%u.\n",
+        printk("idx:%d\t sn:%u wr:%d addr:%pK val:%u.\n",
                idx,
                pcie_access_log[cur_idx].seqnum,
                pcie_access_log[cur_idx].is_write,
@@ -3217,7 +3233,6 @@ int hif_pm_runtime_put(HIF_DEVICE *hif_device)
 	struct hif_pci_softc *sc = hif_state->sc;
 	int ret = 0;
 	int pm_state, usage_count;
-	unsigned long flags;
 
 	pm_state = adf_os_atomic_read(&sc->pm_state);
 	usage_count = atomic_read(&sc->dev->power.usage_count);
@@ -3232,9 +3247,7 @@ int hif_pm_runtime_put(HIF_DEVICE *hif_device)
 
 	if ((pm_state == HIF_PM_RUNTIME_STATE_NONE && usage_count == 1) ||
 					usage_count == 0) {
-		spin_lock_irqsave(&sc->runtime_lock, flags);
 		hif_pci_runtime_pm_warn(sc, "PUT Without a Get Operation");
-		spin_unlock_irqrestore(&sc->runtime_lock, flags);
 		return -EINVAL;
 	}
 
@@ -3344,11 +3357,10 @@ static int __hif_pm_runtime_allow_suspend(struct hif_pci_softc *hif_sc,
 void hif_pci_runtime_pm_timeout_fn(unsigned long data)
 {
 	struct hif_pci_softc *hif_sc = (struct hif_pci_softc *)data;
-	unsigned long flags;
 	unsigned long timer_expires;
 	struct hif_pm_runtime_context *context, *temp;
 
-	spin_lock_irqsave(&hif_sc->runtime_lock, flags);
+	spin_lock_bh(&hif_sc->runtime_lock);
 
 	timer_expires = hif_sc->runtime_timer_expires;
 
@@ -3376,7 +3388,7 @@ void hif_pci_runtime_pm_timeout_fn(unsigned long data)
 		}
 	}
 
-	spin_unlock_irqrestore(&hif_sc->runtime_lock, flags);
+	spin_unlock_bh(&hif_sc->runtime_lock);
 }
 
 int hif_pm_runtime_prevent_suspend(void *ol_sc, void *data)
@@ -3384,7 +3396,6 @@ int hif_pm_runtime_prevent_suspend(void *ol_sc, void *data)
 	struct ol_softc *sc = (struct ol_softc *)ol_sc;
 	struct hif_pci_softc *hif_sc = sc->hif_sc;
 	struct hif_pm_runtime_context *context = data;
-	unsigned long flags;
 
 	if (!sc->enable_runtime_pm)
 		return 0;
@@ -3392,10 +3403,13 @@ int hif_pm_runtime_prevent_suspend(void *ol_sc, void *data)
 	if (!context)
 		return -EINVAL;
 
-	spin_lock_irqsave(&hif_sc->runtime_lock, flags);
+	if (in_irq())
+		WARN_ON(1);
+
+	spin_lock_bh(&hif_sc->runtime_lock);
 	context->timeout = 0;
 	__hif_pm_runtime_prevent_suspend(hif_sc, context);
-	spin_unlock_irqrestore(&hif_sc->runtime_lock, flags);
+	spin_unlock_bh(&hif_sc->runtime_lock);
 
 	return 0;
 }
@@ -3406,15 +3420,16 @@ int hif_pm_runtime_allow_suspend(void *ol_sc, void *data)
 	struct hif_pci_softc *hif_sc = sc->hif_sc;
 	struct hif_pm_runtime_context *context = data;
 
-	unsigned long flags;
-
 	if (!sc->enable_runtime_pm)
 		return 0;
 
 	if (!context)
 		return -EINVAL;
 
-	spin_lock_irqsave(&hif_sc->runtime_lock, flags);
+	if (in_irq())
+		WARN_ON(1);
+
+	spin_lock_bh(&hif_sc->runtime_lock);
 
 	__hif_pm_runtime_allow_suspend(hif_sc, context);
 
@@ -3430,7 +3445,7 @@ int hif_pm_runtime_allow_suspend(void *ol_sc, void *data)
 		hif_sc->runtime_timer_expires = 0;
 	}
 
-	spin_unlock_irqrestore(&hif_sc->runtime_lock, flags);
+	spin_unlock_bh(&hif_sc->runtime_lock);
 
 	return 0;
 }
@@ -3457,7 +3472,6 @@ int hif_pm_runtime_prevent_suspend_timeout(void *ol_sc, void *data,
 	struct hif_pci_softc *hif_sc = sc->hif_sc;
 	int ret = 0;
 	unsigned long expires;
-	unsigned long flags;
 	struct hif_pm_runtime_context *context = data;
 
 	if (vos_is_load_unload_in_progress(VOS_MODULE_ID_HIF, NULL)) {
@@ -3479,6 +3493,9 @@ int hif_pm_runtime_prevent_suspend_timeout(void *ol_sc, void *data,
 	if (!context)
 		return -EINVAL;
 
+	if (in_irq())
+		WARN_ON(1);
+
 	/*
 	 * Don't use internal timer if the timeout is less than auto suspend
 	 * delay.
@@ -3492,7 +3509,7 @@ int hif_pm_runtime_prevent_suspend_timeout(void *ol_sc, void *data,
 	expires = jiffies + msecs_to_jiffies(delay);
 	expires += !expires;
 
-	spin_lock_irqsave(&hif_sc->runtime_lock, flags);
+	spin_lock_bh(&hif_sc->runtime_lock);
 
 	context->timeout = delay;
 	ret = __hif_pm_runtime_prevent_suspend(hif_sc, context);
@@ -3506,7 +3523,7 @@ int hif_pm_runtime_prevent_suspend_timeout(void *ol_sc, void *data,
 		hif_sc->runtime_timer_expires = expires;
 	}
 
-	spin_unlock_irqrestore(&hif_sc->runtime_lock, flags);
+	spin_unlock_bh(&hif_sc->runtime_lock);
 
 	VOS_TRACE(VOS_MODULE_ID_HIF, VOS_TRACE_LEVEL_INFO,
 		  "%s: pm_state: %d delay: %dms ret: %d\n", __func__,
@@ -3549,7 +3566,6 @@ void *hif_runtime_pm_prevent_suspend_init(const char *name)
  */
 void hif_runtime_pm_prevent_suspend_deinit(void *data)
 {
-	unsigned long flags;
 	struct hif_pm_runtime_context *context = data;
 	void *vos_context = vos_get_global_context(VOS_MODULE_ID_HIF, NULL);
 	struct ol_softc *scn =  vos_get_context(VOS_MODULE_ID_HIF,
@@ -3571,9 +3587,9 @@ void hif_runtime_pm_prevent_suspend_deinit(void *data)
 	 * Ensure to delete the context list entry and reduce the usage count
 	 * before freeing the context if context is active.
 	 */
-	spin_lock_irqsave(&sc->runtime_lock, flags);
+	spin_lock_bh(&sc->runtime_lock);
 	__hif_pm_runtime_allow_suspend(sc, context);
-	spin_unlock_irqrestore(&sc->runtime_lock, flags);
+	spin_unlock_bh(&sc->runtime_lock);
 
 	adf_os_mem_free(context);
 }
@@ -3626,3 +3642,29 @@ bool hif_is_80211_fw_wow_required(void)
 {
 	return false;
 }
+
+/* hif_addr_in_boundary() - API to check if addr is with in PCIE BAR range
+ * @hif_device:  context of cd
+ * @offset: offset from PCI BAR mapped base address.
+ *
+ * API determines if address to be accessed is with in range or out
+ * of bound.
+ *
+ * Return: success if address is with in PCI BAR range.
+ */
+int hif_addr_in_boundary(HIF_DEVICE *hif_device, A_UINT32 offset)
+{
+	struct HIF_CE_state *hif_state;
+	struct hif_pci_softc *sc;
+
+	hif_state = (struct HIF_CE_state *)hif_device;
+	sc = hif_state->sc;
+	if (unlikely(offset + sizeof(unsigned int) > sc->mem_len)) {
+		VOS_TRACE(VOS_MODULE_ID_HIF, VOS_TRACE_LEVEL_ERROR,
+			"refusing to read mmio out of bounds at 0x%08x - 0x%08zx (max 0x%08zx)\n",
+			offset, offset + sizeof(unsigned int), sc->mem_len);
+		return -EINVAL;
+	}
+
+	return 0;
+}
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/if_pci.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/if_pci.c
index 17e99b14996..53fb1c2fe0e 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/if_pci.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/if_pci.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -46,6 +46,7 @@
 #include "vos_api.h"
 #include "vos_sched.h"
 #include "wma_api.h"
+#include "wma.h"
 #include "adf_os_atomic.h"
 #include "wlan_hdd_power.h"
 #include "wlan_hdd_main.h"
@@ -60,11 +61,14 @@
 
 #define AR9888_DEVICE_ID (0x003c)
 #define AR6320_DEVICE_ID (0x003e)
+#define QCA9379_DEVICE_ID (0x0042)
+#define QCA9379_DEVICE_REV_ID (0x0043)
 #define AR6320_FW_1_1  (0x11)
 #define AR6320_FW_1_3  (0x13)
 #define AR6320_FW_2_0  (0x20)
 #define AR6320_FW_3_0  (0x30)
 #define AR6320_FW_3_2  (0x32)
+#define QCA9379_FW_3_2  (0x31)
 
 #ifdef CONFIG_SLUB_DEBUG_ON
 #define MAX_NUM_OF_RECEIVES 400 /* Maximum number of Rx buf to process before*
@@ -126,6 +130,8 @@ static void print_config_soc_reg(struct hif_pci_softc *sc)
 static struct pci_device_id hif_pci_id_table[] = {
 	{ 0x168c, 0x003c, PCI_ANY_ID, PCI_ANY_ID },
 	{ 0x168c, 0x003e, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x168c, 0x0042, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x168c, 0x0043, PCI_ANY_ID, PCI_ANY_ID },
 	{ 0 }
 };
 
@@ -805,6 +811,15 @@ wlan_tasklet(unsigned long data)
     CE_per_engine_service_any(sc->irq_event, sc);
     adf_os_atomic_set(&sc->tasklet_from_intr, 0);
     if (CE_get_rx_pending(sc)) {
+        if (vos_is_load_unload_in_progress(VOS_MODULE_ID_HIF, NULL)) {
+            pr_err("%s: Load/Unload in Progress\n", __func__);
+            goto end;
+        }
+        if (vos_is_logp_in_progress(VOS_MODULE_ID_HIF, NULL)) {
+            pr_err("%s: LOGP in progress\n", __func__);
+            goto end;
+        }
+
         /*
          * There are frames pending, schedule tasklet to process them.
          * Enable the interrupt only when there is no pending frames in
@@ -815,6 +830,8 @@ wlan_tasklet(unsigned long data)
 #else
         tasklet_schedule(&sc->intr_tq);
 #endif
+
+end:
         adf_os_atomic_set(&sc->ce_suspend, 1);
         return;
     }
@@ -878,6 +895,7 @@ static void hif_pci_pm_work(struct work_struct *work)
 	msg_callbacks->txResumeAllHandler(msg_callbacks->Context);
 }
 
+#ifdef WLAN_OPEN_SOURCE
 static int hif_pci_autopm_debugfs_show(struct seq_file *s, void *data)
 {
 #define HIF_PCI_AUTOPM_STATS(_s, _sc, _name) \
@@ -887,7 +905,7 @@ static int hif_pci_autopm_debugfs_show(struct seq_file *s, void *data)
 						"SUSPENDED"};
 	unsigned int msecs_age;
 	int pm_state = atomic_read(&sc->pm_state);
-	unsigned long timer_expires, flags;
+	unsigned long timer_expires;
 	struct hif_pm_runtime_context *ctx;
 
 	seq_printf(s, "%30s: %s\n", "Runtime PM state",
@@ -925,9 +943,9 @@ static int hif_pci_autopm_debugfs_show(struct seq_file *s, void *data)
 				msecs_age / 1000, msecs_age % 1000);
 	}
 
-	spin_lock_irqsave(&sc->runtime_lock, flags);
+	spin_lock_bh(&sc->runtime_lock);
 	if (list_empty(&sc->prevent_suspend_list)) {
-		spin_unlock_irqrestore(&sc->runtime_lock, flags);
+		spin_unlock_bh(&sc->runtime_lock);
 		return 0;
 	}
 
@@ -939,7 +957,7 @@ static int hif_pci_autopm_debugfs_show(struct seq_file *s, void *data)
 		seq_puts(s, " ");
 	}
 	seq_puts(s, "\n");
-	spin_unlock_irqrestore(&sc->runtime_lock, flags);
+	spin_unlock_bh(&sc->runtime_lock);
 
 	return 0;
 #undef HIF_PCI_AUTOPM_STATS
@@ -1040,18 +1058,15 @@ void hif_runtime_test_init(struct hif_pci_softc *sc)
 {
 	int i;
 	struct hif_pm_runtime_context *ctx = NULL, *tmp;
-	unsigned long flags;
 
 	for (i = 0; i < MAX_RUNTIME_DEBUG_CONTEXT; i++) {
 		ctx = &rpm_data[i];
 		ctx->active = false;
 		ctx->name = NULL;
-		spin_lock_irqsave(&sc->runtime_lock, flags);
 		list_for_each_entry_safe(ctx, tmp,
 				&sc->prevent_suspend_list, list) {
 			list_del(&ctx->list);
 		}
-		spin_unlock_irqrestore(&sc->runtime_lock, flags);
 	}
 }
 
@@ -1126,6 +1141,52 @@ static ssize_t hif_pci_autopm_write(struct file *fp, const char __user *buf,
 	adf_os_mem_free(pattern);
 	return count;
 }
+#else
+#define HIF_ENABLE_AUTO_PM	1
+#define HIF_DISABLE_AUTO_PM	0
+static bool dynamic_auto_pm_state = HIF_ENABLE_AUTO_PM;
+
+static ssize_t hif_pci_enable_disable_autopm(struct file *fp, const char __user
+					     *buf, size_t count, loff_t *off)
+{
+	int enable_auto_pm;
+	struct seq_file *s;
+	struct hif_pci_softc *hif_sc;
+	int ret;
+	struct hif_pm_runtime_context *ctx;
+	struct ol_softc *sc;
+
+	s = (struct seq_file *)fp->private_data;
+	hif_sc = s->private;
+
+	if (!hif_sc)
+		return -EINVAL;
+
+	sscanf(buf, "%d", &enable_auto_pm);
+
+	if ((enable_auto_pm != HIF_ENABLE_AUTO_PM) && (enable_auto_pm !=
+	    HIF_DISABLE_AUTO_PM)) {
+		pr_err("%s: I/P is invalid:%d Valid: Enable(1), Disable(0)\n",
+		       __func__, enable_auto_pm);
+		return -EINVAL;
+	}
+
+	ctx = hif_sc->dynamic_ctx;
+	sc = hif_sc->ol_sc;
+
+	ret = enable_auto_pm ? hif_pm_runtime_allow_suspend(sc, ctx) :
+		hif_pm_runtime_prevent_suspend(sc, ctx);
+
+	if (ret)
+		return ret;
+
+	pr_info("%s: enable_auto_pm:%d ret:%d \n", __func__, enable_auto_pm,
+		ret);
+
+	dynamic_auto_pm_state = enable_auto_pm;
+
+	return count;
+}
 #endif
 
 static const struct file_operations hif_pci_autopm_fops = {
@@ -1136,8 +1197,11 @@ static const struct file_operations hif_pci_autopm_fops = {
 	.llseek		= seq_lseek,
 #ifdef FEATURE_RUNTIME_PM_UNIT_TEST
 	.write		= hif_pci_autopm_write,
+#else
+	.write		= hif_pci_enable_disable_autopm,
 #endif
 };
+#endif /*WLAN_OPEN_SOURCE*/
 
 static int __hif_pci_runtime_suspend(struct pci_dev *pdev)
 {
@@ -1282,8 +1346,10 @@ static int __hif_pci_runtime_resume(struct pci_dev *pdev)
 
 	ret = __hif_pci_resume(pdev, true);
 
-	if (ret)
-		goto out;
+	if (ret) {
+		hif_pci_runtime_pm_warn(sc, "Link Resume Failed");
+		return ret;
+	}
 
 	ret = wma_runtime_resume_req(temp_module);
 	if (ret)
@@ -1323,14 +1389,38 @@ struct cnss_wlan_runtime_ops runtime_pm_ops = {
 };
 
 #ifdef WLAN_OPEN_SOURCE
+#ifdef FEATURE_RUNTIME_PM_UNIT_TEST
+static void hif_dynamic_auto_pm_init(struct hif_pci_softc *sc)
+{
+}
+static void hif_dynaic_auto_pm_deinit(struct hif_pci_softc *sc)
+{
+}
+#else /* else FEATURE_RUNTIME_PM_UNIT_TEST */
+static void hif_dynamic_auto_pm_init(struct hif_pci_softc *sc)
+{
+	sc->dynamic_ctx = hif_runtime_pm_prevent_suspend_init("dynamic_ctx");
+
+	if (!dynamic_auto_pm_state)
+		hif_pm_runtime_prevent_suspend(sc->ol_sc, sc->dynamic_ctx);
+}
+static void hif_dynaic_auto_pm_deinit(struct hif_pci_softc *sc)
+{
+	hif_runtime_pm_prevent_suspend_deinit(sc->dynamic_ctx);
+}
+#endif /* END FEATURE_RUNTIME_PM_UNIT_TEST */
+
 static inline void hif_pci_pm_debugfs(struct hif_pci_softc *sc, bool init)
 {
-	if (init)
+	if (init) {
 		sc->pm_dentry = debugfs_create_file("cnss_runtime_pm",
 						S_IRUSR, NULL, sc,
 						&hif_pci_autopm_fops);
-	else
+		hif_dynamic_auto_pm_init(sc);
+	} else {
+		hif_dynaic_auto_pm_deinit(sc);
 		debugfs_remove(sc->pm_dentry);
+	}
 }
 #else
 static inline void hif_pci_pm_debugfs(struct hif_pci_softc *sc, bool init)
@@ -1412,7 +1502,6 @@ static void hif_pci_pm_runtime_exit(struct hif_pci_softc *sc)
  */
 static void hif_pci_pm_runtime_post_exit(struct hif_pci_softc *sc)
 {
-	unsigned long flags;
 	struct hif_pm_runtime_context *ctx, *tmp;
 
 	/*
@@ -1420,20 +1509,18 @@ static void hif_pci_pm_runtime_post_exit(struct hif_pci_softc *sc)
 	 * HTT/WMI pkts should get tx complete and driver should
 	 * will increment the usage count to 1 to prevent any suspend
 	 */
-	if (atomic_read(&sc->dev->power.usage_count) != 1) {
-		spin_lock_irqsave(&sc->runtime_lock, flags);
+	if (atomic_read(&sc->dev->power.usage_count) != 1)
 		hif_pci_runtime_pm_warn(sc, "Driver UnLoading");
-		spin_unlock_irqrestore(&sc->runtime_lock, flags);
-	} else
+	else
 		return;
 
-	spin_lock_irqsave(&sc->runtime_lock, flags);
+	spin_lock_bh(&sc->runtime_lock);
 	list_for_each_entry_safe(ctx, tmp, &sc->prevent_suspend_list, list) {
-		spin_unlock_irqrestore(&sc->runtime_lock, flags);
+		spin_unlock_bh(&sc->runtime_lock);
 		hif_runtime_pm_prevent_suspend_deinit(ctx);
-		spin_lock_irqsave(&sc->runtime_lock, flags);
+		spin_lock_bh(&sc->runtime_lock);
 	}
-	spin_unlock_irqrestore(&sc->runtime_lock, flags);
+	spin_unlock_bh(&sc->runtime_lock);
 	/*
 	 * This is totally a preventive measure to ensure Runtime PM
 	 * isn't disabled for life time.
@@ -1460,14 +1547,13 @@ static void hif_pci_pm_runtime_post_exit(struct hif_pci_softc *sc)
  */
 static void hif_pci_pm_runtime_ssr_post_exit(struct hif_pci_softc *sc)
 {
-	unsigned long flags;
 	struct hif_pm_runtime_context *ctx, *tmp;
 
-	spin_lock_irqsave(&sc->runtime_lock, flags);
+	spin_lock_bh(&sc->runtime_lock);
 	list_for_each_entry_safe(ctx, tmp, &sc->prevent_suspend_list, list) {
 		hif_pm_ssr_runtime_allow_suspend(sc, ctx);
 	}
-	spin_unlock_irqrestore(&sc->runtime_lock, flags);
+	spin_unlock_bh(&sc->runtime_lock);
 }
 
 #else
@@ -1479,6 +1565,30 @@ static inline void
 hif_pci_pm_runtime_ssr_post_exit(struct hif_pci_softc *sc) { }
 #endif
 
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+static inline void *hif_pci_get_virt_ramdump_mem(unsigned long *size)
+{
+	size_t length = 0;
+	int flags = GFP_KERNEL;
+
+	length = DRAM_SIZE + IRAM1_SIZE + IRAM2_SIZE + AXI_SIZE + REG_SIZE;
+
+	if (size != NULL)
+		*size = (unsigned long)length;
+
+	if (in_interrupt() || irqs_disabled() || in_atomic())
+		flags = GFP_ATOMIC;
+
+	return kzalloc(length, flags);
+}
+
+static inline void hif_pci_release_ramdump_mem(unsigned long *address)
+{
+	if (address != NULL)
+		kfree(address);
+}
+#endif
+
 int
 hif_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
@@ -1595,6 +1705,7 @@ again:
 
     OS_MEMZERO(sc, sizeof(*sc));
     sc->mem = mem;
+    sc->mem_len = pci_resource_len(pdev, BAR_NUM);
     sc->pdev = pdev;
     sc->dev = &pdev->dev;
 
@@ -1617,6 +1728,8 @@ again:
         break;
 
     case AR6320_DEVICE_ID:
+    case QCA9379_DEVICE_ID:
+    case QCA9379_DEVICE_REV_ID:
         switch(revision_id) {
         case AR6320_FW_1_1:
         case AR6320_FW_1_3:
@@ -1627,6 +1740,7 @@ again:
         case AR6320_FW_2_0:
         case AR6320_FW_3_0:
         case AR6320_FW_3_2:
+        case QCA9379_FW_3_2:
             hif_type = HIF_TYPE_AR6320V2;
             target_type = TARGET_TYPE_AR6320V2;
             break;
@@ -1729,13 +1843,20 @@ again:
 #endif
     ol_sc->max_no_of_peers = 1;
 
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+    ol_sc->ramdump_base = hif_pci_get_virt_ramdump_mem(&ol_sc->ramdump_size);
+#else
     /* Get RAM dump memory address and size */
     ol_sc->ramdump_base = vos_get_virt_ramdump_mem(&pdev->dev,
                                              &ol_sc->ramdump_size);
 
+#endif
     if (ol_sc->ramdump_base == NULL || !ol_sc->ramdump_size) {
         pr_info("%s: Failed to get RAM dump memory address or size!\n",
                 __func__);
+    } else {
+        pr_info("%s: ramdump base 0x%p size %d\n", __func__,
+		ol_sc->ramdump_base, (int)ol_sc->ramdump_size);
     }
 
     adf_os_atomic_init(&sc->tasklet_from_intr);
@@ -1769,6 +1890,10 @@ again:
     return 0;
 
 err_config:
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+    if (sc && sc->ol_sc && sc->ol_sc->ramdump_base)
+        hif_pci_release_ramdump_mem(sc->ol_sc->ramdump_base);
+#endif
     hif_deinit_adf_ctx(ol_sc);
     A_FREE(ol_sc);
 err_attach:
@@ -1829,8 +1954,10 @@ int hif_pci_reinit(struct pci_dev *pdev, const struct pci_device_id *id)
 again:
     ret = 0;
 
-    if (vos_is_load_unload_in_progress(VOS_MODULE_ID_HIF, NULL)) {
-        printk("Load/unload in progress, ignore SSR reinit\n");
+    if (vos_is_load_unload_in_progress(VOS_MODULE_ID_HIF, NULL) &&
+        !vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
+        printk("%s: Load/unload is in progress and SSR is not,"
+               "ignore SSR reinit...\n", __func__);
         return 0;
     }
 
@@ -1953,6 +2080,8 @@ again:
         break;
 
     case AR6320_DEVICE_ID:
+    case QCA9379_DEVICE_ID:
+    case QCA9379_DEVICE_REV_ID:
         switch(revision_id) {
         case AR6320_FW_1_1:
         case AR6320_FW_1_3:
@@ -1963,6 +2092,7 @@ again:
         case AR6320_FW_2_0:
         case AR6320_FW_3_0:
         case AR6320_FW_3_2:
+        case QCA9379_FW_3_2:
             hif_type = HIF_TYPE_AR6320V2;
             target_type = TARGET_TYPE_AR6320V2;
             break;
@@ -2064,9 +2194,13 @@ again:
     ol_sc->max_no_of_peers = 1;
 
     /* Get RAM dump memory address and size */
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+    ol_sc->ramdump_base = hif_pci_get_virt_ramdump_mem(&ol_sc->ramdump_size);
+#else
     ol_sc->ramdump_base = vos_get_virt_ramdump_mem(&pdev->dev,
                                              &ol_sc->ramdump_size);
 
+#endif
     if (ol_sc->ramdump_base == NULL || !ol_sc->ramdump_size) {
         pr_info("%s: Failed to get RAM dump memory address or size!\n",
                 __func__);
@@ -2106,6 +2240,10 @@ again:
     return 0;
 
 err_config:
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+    if (sc && sc->ol_sc && sc->ol_sc->ramdump_base)
+        hif_pci_release_ramdump_mem(sc->ol_sc->ramdump_base);
+#endif
     hif_deinit_adf_ctx(ol_sc);
     A_FREE(ol_sc);
 err_attach:
@@ -2417,6 +2555,10 @@ hif_pci_remove(struct pci_dev *pdev)
 
     scn = sc->ol_sc;
 
+#ifdef CONFIG_NON_QC_PLATFORM_PCI
+    if (sc && sc->ol_sc && sc->ol_sc->ramdump_base)
+        hif_pci_release_ramdump_mem(sc->ol_sc->ramdump_base);
+#endif
 #ifndef REMOVE_PKT_LOG
     if (vos_get_conparam() != VOS_FTM_MODE &&
         !WLAN_IS_EPPING_ENABLED(vos_get_conparam()))
@@ -2469,6 +2611,7 @@ void hif_pci_shutdown(struct pci_dev *pdev)
 
     if (vos_is_load_unload_in_progress(VOS_MODULE_ID_HIF, NULL)) {
         printk("Load/unload in progress, ignore SSR shutdown\n");
+        vos_set_logp_in_progress(VOS_MODULE_ID_HIF, FALSE);
         return;
     }
     /* this is for cases, where shutdown invoked from CNSS */
@@ -2570,13 +2713,42 @@ static void hif_dump_crash_debug_info(struct hif_pci_softc *sc)
 	struct HIF_CE_state *hif_state = (struct HIF_CE_state *)sc->hif_device;
 	struct ol_softc *scn = sc->ol_sc;
 	int ret;
+	tp_wma_handle wma_handle;
+	void *vos_context = vos_get_global_context(VOS_MODULE_ID_HIF, NULL);
 
 	if (!hif_state)
 		return;
+	if (vos_context == NULL) {
+		pr_err("%s: vos context is null\n", __func__);
+		return;
+	}
+	wma_handle = (tp_wma_handle) vos_get_context(
+			VOS_MODULE_ID_WDA, vos_context);
+	if (wma_handle == NULL) {
+		pr_err("%s: wma_handle is null\n", __func__);
+		return;
+	}
+
+	/*
+	 * When kernel panic happen, if WiFi FW is still active,
+	 * it may cause NOC errors/memory corruption when dumping
+	 * target DRAM/IRAM, to avoid this, inject a fw crash first.
+	 * send crash_inject to FW directly, because we are now
+	 * in an atomic context, and preempt has been disabled,
+	 * MCThread won't be scheduled at the moment, at the same
+	 * time, TargetFailure event wont't be received after inject
+	 * crash due to the same reason
+	 */
+	ret = wma_crash_inject(wma_handle, 1, 0);
 
 	adf_os_spin_lock_irqsave(&hif_state->suspend_lock);
 	hif_irq_record(HIF_CRASH, sc);
 	hif_dump_soc_and_ce_registers(sc);
+	if (ret) {
+		pr_err("%s: failed to send crash inject - %d\n",
+				__func__, ret);
+		goto out;
+	}
 
 	ret = ol_copy_ramdump(scn);
 
@@ -2635,6 +2807,43 @@ void hif_pci_crash_shutdown(struct pci_dev *pdev)
 
 #define OL_ATH_PCI_PM_CONTROL 0x44
 
+/**
+ * hif_disable_tasklet_noclient() - API to disable tasklet in D3WOW
+ * @sc: HIF Context
+ * @wma_hdl: WMA Handle
+ *
+ * This API allows to disable the tasklet in D3-wow
+ * cases.
+ *
+ * Return: None
+ */
+static void hif_disable_tasklet_noclient(struct hif_pci_softc *sc,
+			void *wma_hdl)
+{
+	if (!wma_get_client_count(wma_hdl)) {
+		tasklet_disable(&sc->intr_tq);
+		pr_debug("%s: tasklet disabled\n", __func__);
+	}
+}
+
+/**
+ * hif_enable_tasklet_noclient() - API to enable tasklet in D3WOW
+ * @sc: HIF Context
+ * @wma_hdl: WMA Handle
+ *
+ * This API allows to enable the tasklet in D3-wow
+ * cases.
+ *
+ * Return: None
+ */
+static void hif_enable_tasklet_noclient(struct hif_pci_softc *sc, void *wma_hdl)
+{
+	if (!wma_get_client_count(wma_hdl)) {
+		tasklet_enable(&sc->intr_tq);
+		pr_debug("%s: tasklet disabled\n", __func__);
+	}
+}
+
 static int
 __hif_pci_suspend(struct pci_dev *pdev, pm_message_t state, bool runtime_pm)
 {
@@ -2712,6 +2921,7 @@ __hif_pci_suspend(struct pci_dev *pdev, pm_message_t state, bool runtime_pm)
         msleep(10);
     }
 
+    hif_disable_tasklet_noclient(sc, temp_module);
     hif_irq_record(HIF_SUSPEND_AFTER_WOW, sc);
 
 #ifdef FEATURE_WLAN_D0WOW
@@ -2798,6 +3008,39 @@ static int hif_pci_suspend(struct pci_dev *pdev, pm_message_t state)
     return ret;
 }
 
+/**
+ * __hif_check_link_status() - API to check if PCIe link is active/not
+ *
+ * @pdev: PCIe device structure
+ *
+ * API reads the PCIe config space to verify if PCIe link training is
+ * successful or not.
+ *
+ * Return: Success/Failure
+ */
+static int __hif_check_link_status(struct pci_dev *pdev)
+{
+	uint16_t dev_id;
+	struct hif_pci_softc *sc = pci_get_drvdata(pdev);
+
+	if (!sc) {
+		pr_err("%s: HIF Bus Context is Invalid\n", __func__);
+		return -EINVAL;
+	}
+
+	pci_read_config_word(sc->pdev, PCI_DEVICE_ID, &dev_id);
+
+	if (dev_id == sc->devid)
+		return 0;
+
+	pr_err("%s: Invalid PCIe Config Space; PCIe link down dev_id:0x%04x\n",
+	       __func__, dev_id);
+	sc->recovery = true;
+	vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
+	vos_wlan_pci_link_down();
+	return -EACCES;
+}
+
 static int
 __hif_pci_resume(struct pci_dev *pdev, bool runtime_pm)
 {
@@ -2814,6 +3057,10 @@ __hif_pci_resume(struct pci_dev *pdev, bool runtime_pm)
     if (vos_is_logp_in_progress(VOS_MODULE_ID_HIF, NULL))
         return err;
 
+    err = __hif_check_link_status(pdev);
+    if (err)
+       return err;
+
     adf_os_atomic_set(&sc->pci_link_suspended, 0);
     adf_os_atomic_set(&sc->wow_done, 0);
 
@@ -2838,8 +3085,12 @@ __hif_pci_resume(struct pci_dev *pdev, bool runtime_pm)
         if (retry > MAX_REG_READ_RETRIES) {
             pr_err("%s: PCIe link is possible down!\n", __func__);
             print_config_soc_reg(sc);
-            VOS_ASSERT(0);
-            break;
+            adf_os_atomic_set(&sc->pci_link_suspended, 1);
+            adf_os_atomic_set(&sc->wow_done, 1);
+            sc->recovery = true;
+            vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
+            vos_wlan_pci_link_down();
+            return -EACCES;
         }
 
         A_MDELAY(1);
@@ -2900,6 +3151,8 @@ skip:
         goto out;
     }
 
+    hif_enable_tasklet_noclient(sc, temp_module);
+
     if (!wma_is_wow_mode_selected(temp_module))
         err = wma_resume_target(temp_module, runtime_pm);
     else
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/if_pci.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/if_pci.h
index 3204f6101eb..0abd26a6adf 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/if_pci.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/PCIe/if_pci.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -82,7 +82,7 @@ struct hif_pci_pm_stats {
 struct hif_pci_softc {
     void __iomem *mem; /* PCI address. */
                        /* For efficiency, should be first in struct */
-
+    size_t mem_len;
     struct device *dev;
     struct pci_dev *pdev;
     struct _NIC_DEV aps_osdev;
@@ -131,8 +131,11 @@ struct hif_pci_softc {
     unsigned long runtime_timer_expires;
 #ifdef WLAN_OPEN_SOURCE
     struct dentry *pm_dentry;
-#endif
-#endif
+#ifndef FEATURE_RUNTIME_PM_UNIT_TEST
+    struct hif_pm_runtime_context *dynamic_ctx;
+#endif /*FEATURE_RUNTIME_PM_UNIT_TEST*/
+#endif /*WLAN_OPEN_SOURCE*/
+#endif /*FEATURE_RUNTIME_PM*/
 };
 #define TARGID(sc) ((A_target_id_t)(&(sc)->mem))
 #define TARGID_TO_HIF(targid) (((struct hif_pci_softc *)((char *)(targid) - (char *)&(((struct hif_pci_softc *)0)->mem)))->hif_device)
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/ar9888def.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/ar9888def.h
index 3bf2ec2e308..c2fef60bdbc 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/ar9888def.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/ar9888def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -26,7 +26,7 @@
  */
 
 #ifndef _AR9888DEF_H_
-#define AR9888__AR9888DEF_H_
+#define _AR9888DEF_H_
 
 /* Base Addresses */
 #define AR9888_RTC_SOC_BASE_ADDRESS                     0x00004000
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/hif_usb.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/hif_usb.c
index 47bea8324a0..c7eecb70051 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/hif_usb.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/hif_usb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -245,17 +245,25 @@ static A_STATUS HIFSend_internal(HIF_DEVICE *hifDevice, a_uint8_t PipeID,
 	int usb_status;
 	int i;
 	struct HIFSendContext *pSendContext;
-	int frag_count = 0, head_data_len, tmp_frag_count = 0;
+	uint8_t frag_count;
+	uint32_t head_data_len, tmp_frag_count = 0;
 	unsigned char *pData;
 
-	AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_OUT, ("+%s pipe : %d, buf:0x%p\n",
+	AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_OUT, ("+%s pipe : %d, buf:0x%pK\n",
 			__func__, PipeID, buf));
 
 	a_mem_trace(buf);
 
 	frag_count = adf_nbuf_get_num_frags(buf);
-	if (frag_count > 1) {	/* means have extra fragment buf in skb */
-		/* header data length should be total sending length substract
+	if (frag_count == 1) {
+		/*
+		 * | HIFSendContext | netbuf->data
+		 */
+		head_data_len = sizeof(struct HIFSendContext);
+	} else if ((frag_count - 1) <= CVG_NBUF_MAX_EXTRA_FRAGS) {
+		/*
+		 * means have extra fragment buf in skb
+		 * header data length should be total sending length substract
 		 * internal data length of netbuf
 		 * | HIFSendContext | fragments except internal buffer |
 		 * netbuf->data
@@ -268,10 +276,12 @@ static A_STATUS HIFSend_internal(HIF_DEVICE *hifDevice, a_uint8_t PipeID,
 			tmp_frag_count = tmp_frag_count + 1;
 		}
 	} else {
-		/*
-		 * | HIFSendContext | netbuf->data
-		 */
-		head_data_len = sizeof(struct HIFSendContext);
+		/* Extra fragments overflow */
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (
+			"%s Extra fragments count overflow : %d\n",
+			__func__, frag_count));
+		status = A_ERROR;
+		goto exit;
 	}
 
 	/* Check whether head room is enough to save extra head data */
@@ -366,6 +376,7 @@ static A_STATUS HIFSend_internal(HIF_DEVICE *hifDevice, a_uint8_t PipeID,
 
 	} while (FALSE);
 
+exit:
 	if (A_FAILED(status) && (status != A_NO_RESOURCE)) {
 		AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
 				("athusb send failed %d\n", status));
@@ -905,7 +916,7 @@ void HIFDumpInfo(HIF_DEVICE *hif)
 		ep_desc = &iface_desc->endpoint[i].desc;
 		if (ep_desc) {
 			pr_info(
-			     "ep_desc : %p Index : %d: DescType : %d Addr : %d Maxp : %d Atrrib : %d\n",
+			     "ep_desc : %pK Index : %d: DescType : %d Addr : %d Maxp : %d Atrrib : %d\n",
 			     ep_desc, i,
 			     ep_desc->bDescriptorType,
 			     ep_desc->bEndpointAddress, ep_desc->wMaxPacketSize,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/if_usb.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/if_usb.c
index ca8ce185a44..4cde5525c5e 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/if_usb.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/if_usb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -204,7 +204,7 @@ hif_usb_probe(struct usb_interface *interface, const struct usb_device_id *id)
 	if (hif_usb_configure(sc, &ol_sc->hif_hdl, interface))
 		goto err_config;
 
-	ol_sc->enableuartprint = 0;
+	ol_sc->enableuartprint = 1;
 	ol_sc->enablefwlog = 0;
 	ol_sc->enablesinglebinary = FALSE;
 	ol_sc->max_no_of_peers = 1;
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/usbdrv.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/usbdrv.c
index 112cd71565a..e5011302e40 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/usbdrv.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/USB/usbdrv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -381,11 +381,11 @@ static void usb_hif_flush_pending_transfers(HIF_USB_PIPE *pipe)
 					("urb_context is NULL\n"));
 			break;
 		}
-		AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("  pending urb ctxt: 0x%p\n",
+		AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("  pending urb ctxt: 0x%pK\n",
 						urb_context));
 		if (urb_context->urb != NULL) {
 			AR_DEBUG_PRINTF(ATH_DEBUG_TRC,
-					("  killing urb: 0x%p\n",
+					("  killing urb: 0x%pK\n",
 					 urb_context->urb));
 			/* killing the URB will cause the completion routines to
 			 * run
@@ -442,7 +442,7 @@ static void usb_hif_usb_recv_prestart_complete(struct urb *urb)
 	unsigned long flags;
 
 	AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_IN, (
-				"+%s: recv pipe: %d, stat:%d,len:%d urb:0x%p\n",
+				"+%s: recv pipe: %d, stat:%d,len:%d urb:0x%pK\n",
 				__func__,
 				pipe->logical_pipe_num,
 				urb->status, urb->actual_length,
@@ -519,7 +519,7 @@ static void usb_hif_usb_recv_complete(struct urb *urb)
 	HIF_USB_PIPE *pipe = urb_context->pipe;
 
 	AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_IN, (
-			 "+%s: recv pipe: %d, stat:%d,len:%d urb:0x%p\n",
+			 "+%s: recv pipe: %d, stat:%d,len:%d urb:0x%pK\n",
 			 __func__,
 			 pipe->logical_pipe_num,
 			 urb->status, urb->actual_length,
@@ -619,7 +619,7 @@ static void usb_hif_usb_recv_bundle_complete(struct urb *urb)
 	adf_nbuf_t new_skb = NULL;
 
 	AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_IN, (
-			 "+%s: recv pipe: %d, stat:%d,len:%d urb:0x%p\n",
+			 "+%s: recv pipe: %d, stat:%d,len:%d urb:0x%pK\n",
 			 __func__,
 			 pipe->logical_pipe_num,
 			 urb->status, urb->actual_length,
@@ -791,7 +791,7 @@ static void usb_hif_post_recv_prestart_transfers(HIF_USB_PIPE *recv_pipe,
 				  urb_context);
 
 		AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_IN, (
-			"athusb bulk recv submit:%d, 0x%X (ep:0x%2.2X), %d bytes, buf:0x%p\n",
+			"athusb bulk recv submit:%d, 0x%X (ep:0x%2.2X), %d bytes, buf:0x%pK\n",
 			recv_pipe->logical_pipe_num,
 			recv_pipe->usb_pipe_handle,
 			recv_pipe->ep_address, buffer_length,
@@ -854,7 +854,7 @@ static void usb_hif_post_recv_transfers(HIF_USB_PIPE *recv_pipe,
 				  usb_hif_usb_recv_complete, urb_context);
 
 		AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_IN, (
-				 "athusb bulk recv submit:%d, 0x%X (ep:0x%2.2X), %d bytes, buf:0x%p\n",
+				 "athusb bulk recv submit:%d, 0x%X (ep:0x%2.2X), %d bytes, buf:0x%pK\n",
 				 recv_pipe->logical_pipe_num,
 				 recv_pipe->usb_pipe_handle,
 				 recv_pipe->ep_address, buffer_length,
@@ -917,7 +917,7 @@ static void usb_hif_post_recv_bundle_transfers(HIF_USB_PIPE *recv_pipe,
 				  urb_context);
 
 		AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_IN, (
-				 "athusb bulk recv submit:%d, 0x%X (ep:0x%2.2X), %d bytes, buf:0x%p\n",
+				 "athusb bulk recv submit:%d, 0x%X (ep:0x%2.2X), %d bytes, buf:0x%pK\n",
 				 recv_pipe->logical_pipe_num,
 				 recv_pipe->usb_pipe_handle,
 				 recv_pipe->ep_address, buffer_length,
@@ -1120,7 +1120,7 @@ void usb_hif_io_comp_work(struct work_struct *work)
 		a_mem_trace(buf);
 		if (pipe->flags & HIF_USB_PIPE_FLAG_TX) {
 			AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_OUT,
-					("+athusb xmit callback " "buf:0x%p\n",
+					("+athusb xmit callback " "buf:0x%pK\n",
 					 buf));
 			HtcHdr = (HTC_FRAME_HDR *) adf_nbuf_get_frag_vaddr(buf, 0);
 
@@ -1137,7 +1137,7 @@ void usb_hif_io_comp_work(struct work_struct *work)
 					("-athusb xmit callback\n"));
 		} else {
 			AR_DEBUG_PRINTF(USB_HIF_DEBUG_BULK_IN,
-					("+athusb recv callback buf:" "0x%p\n",
+					("+athusb recv callback buf:" "0x%pK\n",
 					 buf));
 			adf_nbuf_peek_header(buf, &data, &len);
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/ath_procfs.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/ath_procfs.c
index 7b653a1dd72..0dca014ab71 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/ath_procfs.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/ath_procfs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -90,14 +90,17 @@ static ssize_t ath_procfs_diag_read(struct file *file, char __user *buf,
 	int rv;
 	A_UINT8 *read_buffer = NULL;
 
+	hif_hdl = get_hif_hdl_from_file(file);
+	if (hif_addr_in_boundary(hif_hdl, (A_UINT32)(*pos)))
+		return -EINVAL;
+
 	read_buffer = (A_UINT8 *)vos_mem_malloc(count);
 	if (NULL == read_buffer) {
 		pr_debug("%s: vos_mem_alloc failed\n", __func__);
 		return -EINVAL;
 	}
 
-	hif_hdl = get_hif_hdl_from_file(file);
-	pr_debug("rd buff 0x%p cnt %zu offset 0x%x buf 0x%p\n",
+	pr_debug("rd buff 0x%pK cnt %zu offset 0x%x buf 0x%pK\n",
 			read_buffer,count,
 			(int)*pos, buf);
 
@@ -110,17 +113,16 @@ static ssize_t ath_procfs_diag_read(struct file *file, char __user *buf,
 					(A_UINT8 *)read_buffer, count);
 	}
 
+	if (rv)
+		return -EIO;
+
 	if(copy_to_user(buf, read_buffer, count)) {
 		vos_mem_free(read_buffer);
 		return -EFAULT;
 	} else
 		vos_mem_free(read_buffer);
 
-	if (rv == 0) {
-		return count;
-	} else {
-		return -EIO;
-	}
+	return count;
 }
 
 static ssize_t ath_procfs_diag_write(struct file *file, const char __user *buf,
@@ -130,6 +132,9 @@ static ssize_t ath_procfs_diag_write(struct file *file, const char __user *buf,
 	int rv;
 	A_UINT8 *write_buffer = NULL;
 
+	hif_hdl = get_hif_hdl_from_file(file);
+	if (hif_addr_in_boundary(hif_hdl, (A_UINT32)(*pos)))
+		return -EINVAL;
 	write_buffer = (A_UINT8 *)vos_mem_malloc(count);
 	if (NULL == write_buffer) {
 		pr_debug("%s: vos_mem_alloc failed\n", __func__);
@@ -140,8 +145,7 @@ static ssize_t ath_procfs_diag_write(struct file *file, const char __user *buf,
 		return -EFAULT;
 	}
 
-	hif_hdl = get_hif_hdl_from_file(file);
-	pr_debug("wr buff 0x%p buf 0x%p cnt %zu offset 0x%x value 0x%x\n",
+	pr_debug("wr buff 0x%pK buf 0x%pK cnt %zu offset 0x%x value 0x%x\n",
 			write_buffer, buf, count,
 			(int)*pos, *((A_UINT32 *)write_buffer));
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/common/hif_bmi_reg_access.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/common/hif_bmi_reg_access.c
index 869b8bc1c0d..2f393c21ff5 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/common/hif_bmi_reg_access.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/common/hif_bmi_reg_access.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014,2016-2017 The Linux Foundation. All rights reserved.
  *
  *Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -295,7 +295,7 @@ A_STATUS HIFRegBasedGetTargetInfo(HIF_DEVICE *device, struct bmi_target_info *ta
         msleep(100);
     }
 
-    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Enter (device: 0x%p)\n", device));
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Enter (device: 0x%pK)\n", device));
     cid = BMI_GET_TARGET_INFO;
 
     status = bmiBufferSend(device, (A_UCHAR *)&cid, sizeof(cid));
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/ar9888def.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/ar9888def.h
index 7c0095bddbc..0a86e605598 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/ar9888def.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/ar9888def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016, The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -26,7 +26,7 @@
  */
 
 #ifndef _AR9888DEF_H_
-#define AR9888__AR9888DEF_H_
+#define _AR9888DEF_H_
 
 /* Base Addresses */
 #define AR9888_RTC_SOC_BASE_ADDRESS                     0x00004000
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/cepci.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/cepci.h
index f5ba19bde89..56196130ec0 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/cepci.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/cepci.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -32,6 +32,7 @@
  * Support for Copy Engine over PCI.
  * Structures shared between Host software and Target firmware.
  */
+#include <a_types.h> /* A_UINT32 */
 
 
 /*
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/hif_sdio_recv.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/hif_sdio_recv.c
index bec447162b1..36682b08112 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/hif_sdio_recv.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/hif_sdio_recv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014,2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,6 +39,7 @@
 #include <adf_os_defer.h>
 #include <adf_os_atomic.h>
 #include <adf_nbuf.h>
+#include <vos_threads.h>
 #include <athdefs.h>
 #include <adf_net_types.h>
 #include <a_types.h>
@@ -51,6 +52,7 @@
 #include "regtable.h"
 #include "if_ath_sdio.h"
 
+#define NBUF_ALLOC_FAIL_WAIT_TIME 100
 
 static void HIFDevDumpRegisters(HIF_SDIO_DEVICE *pDev,
         MBOX_IRQ_PROC_REGISTERS *pIrqProcRegs,
@@ -255,8 +257,15 @@ static A_STATUS HIFDevAllocAndPrepareRxPackets(HIF_SDIO_DEVICE *pDev,
 
     if (A_FAILED(status)) {
         while (!HTC_QUEUE_EMPTY(pQueue)) {
+            adf_nbuf_t netbuf;
+
             pPacket = HTC_PACKET_DEQUEUE(pQueue);
-        }
+            if (pPacket == NULL)
+                break;
+            netbuf = (adf_nbuf_t) pPacket->pNetBufContext;
+            if (netbuf)
+                adf_nbuf_free(netbuf);
+            }
     }
     return status;
 }
@@ -645,6 +654,7 @@ static A_STATUS HIFDevIssueRecvPacketBundle(HIF_SDIO_DEVICE *pDev,
     if (!pPacketRxBundle) {
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: pPacketRxBundle is NULL \n",
             __FUNCTION__));
+        vos_sleep(NBUF_ALLOC_FAIL_WAIT_TIME);  /* 100 msec sleep */
         return A_NO_MEMORY;
     }
     pBundleBuffer = pPacketRxBundle->pBuffer;
@@ -823,6 +833,16 @@ A_STATUS HIFDevRecvMessagePendingHandler(HIF_SDIO_DEVICE *pDev,
                         &pktsFetched,
                         partialBundle);
                 if (A_FAILED(status)) {
+                    while (!HTC_QUEUE_EMPTY(&recvPktQueue)) {
+                        adf_nbuf_t netbuf;
+
+                        pPacket = HTC_PACKET_DEQUEUE(&recvPktQueue);
+                        if (pPacket == NULL)
+                            break;
+                        netbuf = (adf_nbuf_t) pPacket->pNetBufContext;
+                        if (netbuf)
+                            adf_nbuf_free(netbuf);
+                    }
                     break;
                 }
 
@@ -868,6 +888,16 @@ A_STATUS HIFDevRecvMessagePendingHandler(HIF_SDIO_DEVICE *pDev,
                 /* go fetch the packet */
                 status = HIFDevRecvPacket(pDev, pPacket, pPacket->ActualLength, MailBoxIndex);
                 if (A_FAILED(status)) {
+                    while (!HTC_QUEUE_EMPTY(&recvPktQueue)) {
+                        adf_nbuf_t netbuf;
+
+                        pPacket = HTC_PACKET_DEQUEUE(&recvPktQueue);
+                        if (pPacket == NULL)
+                            break;
+                        netbuf = (adf_nbuf_t) pPacket->pNetBufContext;
+                        if (netbuf)
+                            adf_nbuf_free(netbuf);
+                    }
                     break;
                 }
                 /* sent synchronously, queue this packet for synchronous completion */
@@ -897,6 +927,7 @@ A_STATUS HIFDevRecvMessagePendingHandler(HIF_SDIO_DEVICE *pDev,
             status = HIFDevProcessRecvHeader(pDev, pPacket, lookAheads,
                     &NumLookAheads);
             if (A_FAILED(status)) {
+                HTC_PACKET_ENQUEUE_TO_HEAD(&syncCompletedPktsQueue, pPacket);
                 break;
             }
 
@@ -911,7 +942,18 @@ A_STATUS HIFDevRecvMessagePendingHandler(HIF_SDIO_DEVICE *pDev,
                         pipeid);
             }
         }
+
         if (A_FAILED(status)) {
+            while (!HTC_QUEUE_EMPTY(&syncCompletedPktsQueue)) {
+                adf_nbuf_t netbuf;
+
+                pPacket = HTC_PACKET_DEQUEUE(&syncCompletedPktsQueue);
+                if (pPacket == NULL)
+                    break;
+                netbuf = (adf_nbuf_t) pPacket->pNetBufContext;
+                if (netbuf)
+                    adf_nbuf_free(netbuf);
+            }
             break;
         }
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c
index 3786d71036c..24bf785dd0c 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -117,7 +117,7 @@ static inline void *hif_get_virt_ramdump_mem(unsigned long *size)
 	size_t length = 0;
 	int flags = GFP_KERNEL;
 
-	length = DRAM_SIZE + IRAM_SIZE + AXI_SIZE;
+	length = DRAM_SIZE + IRAM_SIZE + AXI_SIZE + REG_SIZE;
 
 	if (size != NULL)
 		*size = (unsigned long)length;
@@ -234,7 +234,7 @@ ath_hif_sdio_probe(void *context, void *hif_handle)
             __func__);
     } else {
         VOS_TRACE(VOS_MODULE_ID_HIF, VOS_TRACE_LEVEL_INFO,
-            "%s: ramdump base 0x%p size %d\n",
+            "%s: ramdump base 0x%pK size %d\n",
             __func__, ol_sc->ramdump_base, (int)ol_sc->ramdump_size);
     }
     init_waitqueue_head(&ol_sc->sc_osdev->event_queue);
@@ -265,6 +265,8 @@ ath_hif_sdio_probe(void *context, void *hif_handle)
 
 err_attach2:
     athdiag_procfs_remove();
+    if (sc->ol_sc->ramdump_base)
+        hif_release_ramdump_mem(sc->ol_sc->ramdump_base);
     hif_deinit_adf_ctx(ol_sc);
 err_attach1:
     A_FREE(ol_sc);
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/native_sdio/include/hif_internal.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/native_sdio/include/hif_internal.h
index 6199746ac33..4b67e17049c 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/native_sdio/include/hif_internal.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/native_sdio/include/hif_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,7 +40,21 @@
 #define HIF_LINUX_MMC_SCATTER_SUPPORT
 #endif
 
-#define BUS_REQUEST_MAX_NUM                64
+/**
+ * struct bus_request_record - basic bus request struct
+ * @request: request info
+ * @address: address of sdio register
+ * @len: length of register that this request will read or write
+ * @time: record time
+ */
+struct bus_request_record {
+	u_int32_t request;
+	u_int32_t address;
+	u_int32_t len;
+	u_int64_t time;
+};
+
+#define BUS_REQUEST_MAX_NUM                105
 
 #define SDIO_CLOCK_FREQUENCY_DEFAULT       25000000
 #define SDWLAN_ENABLE_DISABLE_TIMEOUT      20
@@ -119,6 +133,7 @@ struct hif_device {
     void *htcContext;
     /* mailbox swapping for control and data svc*/
     A_BOOL swap_mailbox;
+    bool ctrl_response_timeout;
 };
 
 #define HIF_DMA_BUFFER_SIZE (4 * 1024)
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c
index 5036a407eff..416a682fed3 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -47,6 +47,25 @@
 #include "a_debug.h"
 #include "vos_sched.h"
 
+#define BUS_REQ_RECORD_SIZE 100
+u_int32_t g_bus_req_buf_idx = 0;
+spinlock_t g_bus_request_record_lock;
+
+struct bus_request_record bus_request_record_buf[BUS_REQ_RECORD_SIZE];
+
+#define BUS_REQUEST_RECORD(r, a, l) { \
+	unsigned long flag; \
+	spin_lock_irqsave(&g_bus_request_record_lock, flag); \
+	if (g_bus_req_buf_idx == BUS_REQ_RECORD_SIZE) \
+		g_bus_req_buf_idx = 0; \
+	bus_request_record_buf[g_bus_req_buf_idx].request = r;  \
+	bus_request_record_buf[g_bus_req_buf_idx].address = a;  \
+	bus_request_record_buf[g_bus_req_buf_idx].len = l; \
+	bus_request_record_buf[g_bus_req_buf_idx].time = adf_get_boottime(); \
+	g_bus_req_buf_idx++; \
+	spin_unlock_irqrestore(&g_bus_request_record_lock, flag); \
+}
+
 #if HIF_USE_DMA_BOUNCE_BUFFER
 /* macro to check if DMA buffer is WORD-aligned and DMA-able.  Most host controllers assume the
  * buffer is DMA'able and will bug-check otherwise (i.e. buffers on the stack).
@@ -124,6 +143,10 @@ unsigned int modstrength = 0;
 module_param(modstrength, uint, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
 MODULE_PARM_DESC(modstrength, "Adjust internal driver strength");
 
+bool dynamic_busreq = 1;
+module_param(dynamic_busreq, bool, S_IRUSR | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(dynamic_busreq, "Using dynamic bus request");
+
 /* ATHENV */
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27) && defined(CONFIG_PM)
 #define dev_to_sdio_func(d) container_of(d, struct sdio_func, dev)
@@ -629,7 +652,7 @@ HIFReadWrite(HIF_DEVICE *device,
     if (device == NULL || device->func == NULL)
         return A_ERROR;
     AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-        ("AR6000: device 0x%p addr 0x%X buffer 0x%p len %d req 0x%X context 0x%p",
+        ("AR6000: device 0x%pK addr 0x%X buffer 0x%pK len %d req 0x%X context 0x%pK",
         device, address, buffer, length, request, context));
 
     /*sdio r/w action is not needed when suspend with cut power,so just return*/
@@ -644,10 +667,11 @@ HIFReadWrite(HIF_DEVICE *device,
                         (request & HIF_ASYNCHRONOUS)?"Async":"Synch"));
             busrequest = hifAllocateBusRequest(device);
             if (busrequest == NULL) {
-                AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
                     ("AR6000: no async bus requests available (%s, addr:0x%X, len:%d) \n",
                         request & HIF_READ ? "READ":"WRITE", address, length));
-                return A_ERROR;
+                BUS_REQUEST_RECORD(request, address, length);
+                return A_ECANCELED;
             }
             busrequest->address = address;
             busrequest->buffer = buffer;
@@ -821,6 +845,7 @@ static int tx_completion_task(void *param)
  */
 static inline void tx_completion_sem_init(HIF_DEVICE *device)
 {
+	spin_lock_init(&device->tx_completion_lock);
 	sema_init(&device->sem_tx_completion, 0);
 }
 
@@ -959,6 +984,7 @@ static int async_task(void *param)
     A_STATUS status;
     unsigned long flags;
 
+    set_user_nice(current, -3);
     device = (HIF_DEVICE *)param;
     AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async task\n"));
     set_current_state(TASK_INTERRUPTIBLE);
@@ -1401,7 +1427,7 @@ HIFShutDownDevice(HIF_DEVICE *device)
         for (i=0; i<MAX_HIF_DEVICES; ++i) {
             if (hif_devices[i] && hif_devices[i]->func == NULL) {
                 AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-                                ("AR6000: Remove pending hif_device %p\n", hif_devices[i]));
+                                ("AR6000: Remove pending hif_device %pK\n", hif_devices[i]));
                 delHifDevice(hif_devices[i]);
                 hif_devices[i] = NULL;
             }
@@ -1509,19 +1535,14 @@ static int hifDeviceInserted(struct sdio_func *func, const struct sdio_device_id
     int i;
     int ret;
     HIF_DEVICE * device = NULL;
-    int count;
 
     AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
             ("AR6000: hifDeviceInserted, Function: 0x%X, Vendor ID: 0x%X, Device ID: 0x%X, block size: 0x%X/0x%X\n",
              func->num, func->vendor, id->device, func->max_blksize, func->cur_blksize));
-    /*
-    dma_mask should not be NULL, otherwise dma_map_single will crash.
-    TODO: check why dma_mask is NULL here
-    */
-    if (func->dev.dma_mask == NULL){
-        static u64 dma_mask = 0xFFFFFFFF;
-        func->dev.dma_mask = &dma_mask;
-    }
+
+    /* dma_mask should be populated here. Use the parent device's setting. */
+    func->dev.dma_mask = mmc_dev(func->card->host)->dma_mask;
+
     for (i=0; i<MAX_HIF_DEVICES; ++i) {
         HIF_DEVICE *hifdevice = hif_devices[i];
         if (hifdevice && hifdevice->powerConfig == HIF_DEVICE_POWER_CUT &&
@@ -1553,7 +1574,7 @@ static int hifDeviceInserted(struct sdio_func *func, const struct sdio_device_id
         }
         if (i==MAX_HIF_DEVICES) {
             AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-                ("AR6000: hifDeviceInserted, No more hif_devices[] slot for %p", device));
+                ("AR6000: hifDeviceInserted, No more hif_devices[] slot for %pK", device));
         }
 
         device->id = id;
@@ -1756,9 +1777,8 @@ TODO: MMC SDIO3.0 Setting should also be modified in ReInit() function when Powe
             sdio_release_host(func);
         }
 
-        spin_lock_init(&device->lock);
-
         spin_lock_init(&device->asynclock);
+        spin_lock_init(&g_bus_request_record_lock);
 
         DL_LIST_INIT(&device->ScatterReqHead);
 
@@ -1770,11 +1790,15 @@ TODO: MMC SDIO3.0 Setting should also be modified in ReInit() function when Powe
         else
             device->scatter_enabled = FALSE;
 
-        /* Initialize the bus requests to be used later */
-        A_MEMZERO(device->busRequest, sizeof(device->busRequest));
-        for (count = 0; count < BUS_REQUEST_MAX_NUM; count ++) {
-            sema_init(&device->busRequest[count].sem_req, 0);
-            hifFreeBusRequest(device, &device->busRequest[count]);
+        if (!dynamic_busreq) {
+            int count;
+
+            /* Initialize the bus requests to be used later */
+            A_MEMZERO(device->busRequest, sizeof(device->busRequest));
+            for (count = 0; count < BUS_REQUEST_MAX_NUM; count ++) {
+                sema_init(&device->busRequest[count].sem_req, 0);
+                hifFreeBusRequest(device, &device->busRequest[count]);
+            }
         }
         sema_init(&device->sem_async, 0);
         tx_completion_sem_init(device);
@@ -1787,7 +1811,19 @@ TODO: MMC SDIO3.0 Setting should also be modified in ReInit() function when Powe
 #endif
 
     ret = hifEnableFunc(device, func);
-    return (ret == A_OK || ret == A_PENDING) ? 0 : -1;
+    if (ret == A_OK || ret == A_PENDING) {
+        return 0;
+    } else {
+        for (i = 0; i < MAX_HIF_DEVICES; ++i) {
+            if (hif_devices[i] == device) {
+                hif_devices[i] = NULL;
+                break;
+            }
+        }
+        sdio_set_drvdata(func, NULL);
+        delHifDevice(device);
+        return -1;
+    }
 }
 
 
@@ -1864,6 +1900,27 @@ void HIFMaskInterrupt(HIF_DEVICE *device)
     EXIT();
 }
 
+void hif_release_bus_requests(HIF_DEVICE *device)
+{
+	BUS_REQUEST *bus_req;
+	unsigned long  flag;
+
+	AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+			("AR6000: Release busrequest queue\n"));
+	spin_lock_irqsave(&device->lock, flag);
+
+	while ((bus_req = device->s_busRequestFreeQueue) != NULL) {
+		device->s_busRequestFreeQueue = bus_req->next;
+		spin_unlock_irqrestore(&device->lock, flag);
+
+		A_FREE(bus_req);
+
+		spin_lock_irqsave(&device->lock, flag);
+	}
+
+	spin_unlock_irqrestore(&device->lock, flag);
+}
+
 BUS_REQUEST *hifAllocateBusRequest(HIF_DEVICE *device)
 {
     BUS_REQUEST *busrequest;
@@ -1879,7 +1936,17 @@ BUS_REQUEST *hifAllocateBusRequest(HIF_DEVICE *device)
     }
     /* Release lock */
     spin_unlock_irqrestore(&device->lock, flag);
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: hifAllocateBusRequest: 0x%p\n", busrequest));
+
+    if (adf_os_unlikely(!busrequest) && dynamic_busreq) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                        ("AR6000: No busrequest in free queue\n"));
+        busrequest = (BUS_REQUEST *)A_MALLOC(sizeof(*busrequest));
+        if (busrequest) {
+            A_MEMZERO(busrequest, sizeof(*busrequest));
+            sema_init(&busrequest->sem_req, 0);
+        }
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: hifAllocateBusRequest: 0x%pK\n", busrequest));
     return busrequest;
 }
 
@@ -1890,7 +1957,7 @@ hifFreeBusRequest(HIF_DEVICE *device, BUS_REQUEST *busrequest)
 
     if (busrequest == NULL)
        return;
-    //AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: hifFreeBusRequest: 0x%p\n", busrequest));
+    //AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: hifFreeBusRequest: 0x%pK\n", busrequest));
     /* Acquire lock */
     spin_lock_irqsave(&device->lock, flag);
 
@@ -1964,11 +2031,16 @@ static A_STATUS hifEnableFunc(HIF_DEVICE *device, struct sdio_func *func)
 {
     int ret = A_OK;
 
-    ENTER("sdio_func 0x%p", func);
+    ENTER("sdio_func 0x%pK", func);
 
     AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifEnableFunc\n"));
     device = getHifDevice(func);
 
+    if (!device) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HIF device is NULL\n"));
+        return A_EINVAL;
+    }
+
     if (device->is_disabled) {
         int setAsyncIRQ = 0;
         __u16 manufacturer_id = device->id->device & MANUFACTURER_ID_AR6K_BASE_MASK;
@@ -2086,16 +2158,23 @@ static A_STATUS hifEnableFunc(HIF_DEVICE *device, struct sdio_func *func)
         ret = osdrvCallbacks.deviceInsertedHandler(
             osdrvCallbacks.context,device);
         /* start  up inform DRV layer */
-        if (ret != A_OK)
+        if (ret != A_OK) {
             AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
                 ("AR6k: Device rejected error:%d \n", ret));
+            /*
+             * Disable the SDIO func & Reset the sdio
+             * for automated tests to move ahead, where
+             * the card does not need to be removed at
+             * the end of the test.
+             */
+            hifDisableFunc(device, func);
+        }
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27) && defined(CONFIG_PM)
     } else {
         AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
              ("AR6k: call devicePwrChangeApi\n"));
         /* start  up inform DRV layer */
-        if (device &&
-            device->claimedContext &&
+        if (device->claimedContext &&
             osdrvCallbacks.devicePowerChangeHandler &&
             ((ret = osdrvCallbacks.devicePowerChangeHandler(
                   device->claimedContext, HIF_DEVICE_POWER_UP)) != A_OK))
@@ -2490,6 +2569,7 @@ A_STATUS hifWaitForPendingRecv(HIF_DEVICE *device)
 static HIF_DEVICE *
 addHifDevice(struct sdio_func *func)
 {
+    int count;
     HIF_DEVICE *hifdevice = NULL;
 #if(LINUX_VERSION_CODE < KERNEL_VERSION(3,15,0)) && !defined(WITH_BACKPORTS)
     int ret = 0;
@@ -2513,6 +2593,29 @@ addHifDevice(struct sdio_func *func)
     hifdevice->func = func;
     hifdevice->powerConfig = HIF_DEVICE_POWER_UP;
     hifdevice->DeviceState = HIF_DEVICE_STATE_ON;
+    spin_lock_init(&hifdevice->lock);
+
+    if (dynamic_busreq) {
+        for (count = 0; count < BUS_REQUEST_MAX_NUM; count++) {
+            BUS_REQUEST *busrequest;
+            busrequest = A_MALLOC(sizeof(*busrequest));
+            if (!busrequest)
+                break;
+            A_MEMZERO(busrequest, sizeof(*busrequest));
+            sema_init(&busrequest->sem_req, 0);
+            hifFreeBusRequest(hifdevice, busrequest);
+        }
+
+        if (!count) {
+            printk(KERN_ERR"AR6000:No bus request resources\n");
+            if (hifdevice->dma_buffer)
+                A_FREE(hifdevice->dma_buffer);
+            A_FREE(hifdevice);
+            EXIT();
+            return NULL;
+        }
+    }
+
 #if(LINUX_VERSION_CODE < KERNEL_VERSION(3,15,0)) && !defined(WITH_BACKPORTS)
     ret = sdio_set_drvdata(func, hifdevice);
     EXIT("status %d", ret);
@@ -2535,7 +2638,11 @@ delHifDevice(HIF_DEVICE * device)
 {
     if (device == NULL)
         return;
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: delHifDevice; 0x%p\n", device));
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: delHifDevice; 0x%pK\n", device));
+
+    if (dynamic_busreq)
+        hif_release_bus_requests(device);
+
     if (device->dma_buffer != NULL) {
         A_FREE(device->dma_buffer);
     }
@@ -2583,9 +2690,59 @@ static void hif_flush_async_task(HIF_DEVICE *device)
     }
 }
 
+/**
+ * hif_reset_target() - Reset target device
+ * @hif_device: pointer to hif_device structure
+ *
+ * Reset the target by invoking power off and power on
+ * sequence to bring back target into active state.
+ * This API shall be called only when driver load/unload
+ * is in progress.
+ *
+ * Return: 0 on success, error for failure case.
+ */
+static int hif_reset_target(HIF_DEVICE *hif_device)
+{
+	int ret;
+
+	if (!hif_device || !hif_device->func|| !hif_device->func->card) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+			("AR6000: %s invalid HIF DEVICE \n", __func__));
+		return -ENODEV;
+	}
+	/* Disable sdio func->pull down WLAN_EN-->pull down DAT_2 line */
+	ret = mmc_power_save_host(hif_device->func->card->host);
+	if(ret) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+			("AR6000: %s Failed to save mmc Power host %d\n",
+			__func__, ret));
+		goto done;
+	}
+
+	/* pull up DAT_2 line->pull up WLAN_EN-->Enable sdio func */
+	ret = mmc_power_restore_host(hif_device->func->card->host);
+	if(ret) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+			("AR6000: %s Failed to restore mmc Power host %d\n",
+			__func__, ret));
+	}
+
+done:
+	return ret;
+}
+
 void HIFDetachHTC(HIF_DEVICE *device)
 {
     hif_flush_async_task(device);
+    if (device->ctrl_response_timeout) {
+        /* Reset the target by invoking power off and power on sequence to
+         * the card to bring back into active state.
+         */
+        if(hif_reset_target(device))
+            VOS_BUG(0);
+        device->ctrl_response_timeout = false;
+    }
+
     A_MEMZERO(&device->htcCallbacks,sizeof(device->htcCallbacks));
 }
 
@@ -2716,12 +2873,23 @@ static int hif_sdio_device_inserted(struct sdio_func *func, const struct sdio_de
 
 static void hif_sdio_device_removed(struct sdio_func *func)
 {
-	if (func != NULL)
-		hifDeviceRemoved(func);
+	HIF_DEVICE * device = NULL;
+
+	if (func != NULL) {
+		device = getHifDevice(func);
+		if (device != NULL)
+			hifDeviceRemoved(func);
+	}
 }
 
 static int hif_sdio_device_reinit(struct sdio_func *func, const struct sdio_device_id * id)
 {
+	if (vos_is_load_unload_in_progress(VOS_MODULE_ID_HIF, NULL) &&
+	    !vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
+		printk("%s: Load/unload is in progress and SSR is not,"
+		       "ignore SSR reinit...\n", __func__);
+		return 0;
+	}
 	if ((func != NULL) && (id != NULL))
 		return hifDeviceInserted(func, id);
 	else
@@ -2733,6 +2901,11 @@ static int hif_sdio_device_reinit(struct sdio_func *func, const struct sdio_devi
 static void hif_sdio_device_shutdown(struct sdio_func *func)
 {
 	vos_set_logp_in_progress(VOS_MODULE_ID_HIF, TRUE);
+	if (vos_is_load_unload_in_progress(VOS_MODULE_ID_HIF, NULL)) {
+		vos_set_logp_in_progress(VOS_MODULE_ID_HIF, FALSE);
+		printk("Load/unload in progress, ignore SSR shutdown\n");
+		return;
+	}
 	vos_set_shutdown_in_progress(VOS_MODULE_ID_HIF, TRUE);
 	if (!vos_is_ssr_ready(__func__))
 		pr_err(" %s Host driver is not ready for SSR, attempting anyway\n", __func__);
@@ -2761,42 +2934,23 @@ static int hif_sdio_device_resume(struct device *dev)
 #endif
 
 /**
- * hif_reset_target() - Reset target device
+ * hif_set_target_reset() - Reset target device
  * @hif_device: pointer to hif_device structure
  *
- * Reset the target by invoking power off and power on
- * sequence to bring back target into active state.
+ * Set the target reset flag.
  * This API shall be called only when driver load/unload
  * is in progress.
  *
  * Return: 0 on success, error for failure case.
  */
-int hif_reset_target(HIF_DEVICE *hif_device)
+int hif_set_target_reset(HIF_DEVICE *hif_device)
 {
-	int ret;
-
 	if (!hif_device || !hif_device->func|| !hif_device->func->card) {
 		AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
 			("AR6000: %s invalid HIF DEVICE \n", __func__));
 		return -ENODEV;
 	}
-	/* Disable sdio func->pull down WLAN_EN-->pull down DAT_2 line */
-	ret = mmc_power_save_host(hif_device->func->card->host);
-	if(ret) {
-		AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-			("AR6000: %s Failed to save mmc Power host %d\n",
-			__func__, ret));
-		goto done;
-	}
+	hif_device->ctrl_response_timeout = true;
 
-	/* pull up DAT_2 line->pull up WLAN_EN-->Enable sdio func */
-	ret = mmc_power_restore_host(hif_device->func->card->host);
-	if(ret) {
-		AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-			("AR6000: %s Failed to restore mmc Power host %d\n",
-			__func__, ret));
-	}
-
-done:
-	return ret;
+	return 0;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc.c
index 80f9f3ab953..09120e5c676 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -36,6 +36,8 @@
 #include "epping_main.h"
 #include "htc_api.h"
 
+#define MAX_HTC_RX_BUNDLE  2
+
 #ifdef WLAN_DEBUG
 static ATH_DEBUG_MASK_DESCRIPTION g_HTCDebugDescription[] = {
     { ATH_DEBUG_SEND , "Send"},
@@ -63,7 +65,7 @@ static void DestroyHTCTxCtrlPacket(HTC_PACKET *pPacket)
 {
     adf_nbuf_t netbuf;
     netbuf = (adf_nbuf_t)GET_HTC_PACKET_NET_BUF_CONTEXT(pPacket);
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("free ctrl netbuf :0x%p \n", netbuf));
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("free ctrl netbuf :0x%pK \n", netbuf));
     if (netbuf != NULL) {
         adf_nbuf_free(netbuf);
     }
@@ -90,7 +92,7 @@ static HTC_PACKET *BuildHTCTxCtrlPacket(adf_os_device_t osdev)
 	        adf_os_print("%s: nbuf alloc failed\n",__func__);
             break;
         }
-        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("alloc ctrl netbuf :0x%p \n", netbuf));
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("alloc ctrl netbuf :0x%pK \n", netbuf));
         SET_HTC_PACKET_NET_BUF_CONTEXT(pPacket, netbuf);
     } while (FALSE);
 
@@ -144,6 +146,7 @@ static void HTCCleanup(HTC_TARGET *target)
 {
     HTC_PACKET *pPacket;
     adf_nbuf_t netbuf;
+    int j;
 
     if (target->hif_dev != NULL) {
         HIFDetachHTC(target->hif_dev);
@@ -207,6 +210,11 @@ static void HTCCleanup(HTC_TARGET *target)
     adf_os_spinlock_destroy(&target->HTCTxLock);
     adf_os_spinlock_destroy(&target->HTCCreditLock);
 
+    for (j = 0; j < ENDPOINT_MAX; j++) {
+        HTC_ENDPOINT *endpoint = &target->EndPoint[j];
+        adf_os_spinlock_destroy(&endpoint->htc_endpoint_rx_lock);
+    }
+
     /* free our instance */
     A_FREE(target);
 }
@@ -218,9 +226,9 @@ HTC_HANDLE HTCCreate(void *ol_sc, HTC_INIT_INFO *pInfo, adf_os_device_t osdev)
     MSG_BASED_HIF_CALLBACKS htcCallbacks;
     HTC_ENDPOINT            *pEndpoint=NULL;
     HTC_TARGET              *target = NULL;
-    int                     i;
+    int                     i, j;
 
-    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("+HTCCreate ..  HIF :%p \n",hHIF));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("+HTCCreate ..  HIF :%pK \n",hHIF));
 
     A_REGISTER_MODULE_DEBUG_INFO(htc);
 
@@ -235,6 +243,11 @@ HTC_HANDLE HTCCreate(void *ol_sc, HTC_INIT_INFO *pInfo, adf_os_device_t osdev)
     adf_os_spinlock_init(&target->HTCRxLock);
     adf_os_spinlock_init(&target->HTCTxLock);
     adf_os_spinlock_init(&target->HTCCreditLock);
+
+    for (j = 0; j < ENDPOINT_MAX; j++) {
+        pEndpoint = &target->EndPoint[j];
+        adf_os_spinlock_init(&pEndpoint->htc_endpoint_rx_lock);
+    }
     target->is_nodrop_pkt = FALSE;
 
     do {
@@ -284,7 +297,7 @@ HTC_HANDLE HTCCreate(void *ol_sc, HTC_INIT_INFO *pInfo, adf_os_device_t osdev)
 
     HTCRecvInit(target);
 
-    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("-HTCCreate (0x%p) \n", target));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("-HTCCreate (0x%pK) \n", target));
 
     return (HTC_HANDLE)target;
 }
@@ -292,7 +305,7 @@ HTC_HANDLE HTCCreate(void *ol_sc, HTC_INIT_INFO *pInfo, adf_os_device_t osdev)
 void  HTCDestroy(HTC_HANDLE HTCHandle)
 {
     HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCDestroy ..  Destroying :0x%p \n",target));
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCDestroy ..  Destroying :0x%pK \n",target));
     HIFStop(HTCGetHifDevice(HTCHandle));
     HTCCleanup(target);
     AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCDestroy \n"));
@@ -309,7 +322,7 @@ void *HTCGetHifDevice(HTC_HANDLE HTCHandle)
 void HTCControlTxComplete(void *Context, HTC_PACKET *pPacket)
 {
     HTC_TARGET *target = (HTC_TARGET *)Context;
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("+-HTCControlTxComplete 0x%p (l:%d) \n",pPacket,pPacket->ActualLength));
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("+-HTCControlTxComplete 0x%pK (l:%d) \n",pPacket,pPacket->ActualLength));
     HTCFreeControlTxPacket(target,pPacket);
 }
 
@@ -523,8 +536,10 @@ A_STATUS HTCWaitTarget(HTC_HANDLE HTCHandle)
     HTC_SERVICE_CONNECT_RESP resp;
     HTC_READY_MSG *rdy_msg;
     A_UINT16 htc_rdy_msg_id;
+    A_UINT8 i = 0;
+    HTC_PACKET *pRxBundlePacket, *pTempBundlePacket;
 
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Enter (target:0x%p) \n", HTCHandle));
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Enter (target:0x%pK) \n", HTCHandle));
     AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("+HWT\n"));
 
     do {
@@ -577,6 +592,20 @@ A_STATUS HTCWaitTarget(HTC_HANDLE HTCHandle)
             status = A_ECOMM;
             break;
         }
+
+        /* Allocate expected number of RX bundle buffer allocation */
+        pTempBundlePacket = NULL;
+        for (i = 0; i < MAX_HTC_RX_BUNDLE; i++) {
+            pRxBundlePacket = AllocateHTCBundleRxPacket(target);
+            if (pRxBundlePacket != NULL) {
+                pRxBundlePacket->ListLink.pNext = (DL_LIST *)pTempBundlePacket;
+            } else {
+                break;
+            }
+            pTempBundlePacket = pRxBundlePacket;
+        }
+        target->pBundleFreeRxList = pTempBundlePacket;
+
             /* done processing */
         target->CtrlResponseProcessing = FALSE;
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_internal.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_internal.h
index 870046d1c61..36646891e6f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_internal.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_internal.h
@@ -147,6 +147,7 @@ typedef struct _HTC_ENDPOINT {
     HTC_ENDPOINT_STATS          EndPointStats;          /* endpoint statistics */
 #endif
     A_BOOL                      TxCreditFlowEnabled;
+    adf_os_spinlock_t           htc_endpoint_rx_lock;
 } HTC_ENDPOINT;
 
 #ifdef HTC_EP_STAT_PROFILING
@@ -231,6 +232,8 @@ typedef struct _HTC_TARGET {
 #define UNLOCK_HTC_TX(t)        adf_os_spin_unlock_bh(&(t)->HTCTxLock);
 #define LOCK_HTC_CREDIT(t)      adf_os_spin_lock_bh(&(t)->HTCCreditLock);
 #define UNLOCK_HTC_CREDIT(t)    adf_os_spin_unlock_bh(&(t)->HTCCreditLock);
+#define LOCK_HTC_ENDPOINT_RX(t) adf_os_spin_lock_bh(&(t)->htc_endpoint_rx_lock);
+#define UNLOCK_HTC_ENDPOINT_RX(t) adf_os_spin_unlock_bh(&(t)->htc_endpoint_rx_lock);
 
 #define GET_HTC_TARGET_FROM_HANDLE(hnd) ((HTC_TARGET *)(hnd))
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_recv.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_recv.c
index e4c1ffcdb6d..8529941858c 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_recv.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_recv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -104,14 +104,17 @@ static void DoRecvCompletion(HTC_ENDPOINT     *pEndpoint,
             /* using legacy EpRecv */
             while (!HTC_QUEUE_EMPTY(pQueueToIndicate)) {
                 pPacket = HTC_PACKET_DEQUEUE(pQueueToIndicate);
+                LOCK_HTC_ENDPOINT_RX(pEndpoint);
                 if (pEndpoint->EpCallBacks.EpRecv == NULL) {
-                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HTC ep %d has NULL recv callback on packet %p\n",
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HTC ep %d has NULL recv callback on packet %pK\n",
                             pEndpoint->Id, pPacket));
+                    UNLOCK_HTC_ENDPOINT_RX(pEndpoint);
                     continue;
                 }
-                AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("HTC calling ep %d recv callback on packet %p\n",
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("HTC calling ep %d recv callback on packet %pK\n",
                         pEndpoint->Id, pPacket));
                 pEndpoint->EpCallBacks.EpRecv(pEndpoint->EpCallBacks.pContext, pPacket);
+                UNLOCK_HTC_ENDPOINT_RX(pEndpoint);
             }
         }
 
@@ -553,7 +556,7 @@ void HTCFlushRxHoldQueue(HTC_TARGET *target, HTC_ENDPOINT *pEndpoint)
         UNLOCK_HTC_RX(target);
         pPacket->Status = A_ECANCELED;
         pPacket->ActualLength = 0;
-        AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("  Flushing RX packet:%p, length:%d, ep:%d \n",
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("  Flushing RX packet:%pK, length:%d, ep:%d \n",
                 pPacket, pPacket->BufferLength, pPacket->Endpoint));
         INIT_HTC_PACKET_QUEUE_AND_ADD(&container,pPacket);
             /* give the packet back */
@@ -582,10 +585,7 @@ A_STATUS HTCWaitRecvCtrlMessage(HTC_TARGET *target)
     /* Wait for BMI request/response transaction to complete */
     if(!adf_os_wait_for_completion_timeout(&target->CtrlResponseValid,
         adf_os_msecs_to_ticks(HTC_CONTROL_RX_TIMEOUT))) {
-        /* Reset the target by invoking power off and power on sequence to
-         * the card to bring back into active state.
-         */
-        if(hif_reset_target(target->hif_dev))
+        if(hif_set_target_reset(target->hif_dev))
             VOS_BUG(0);
         return A_ERROR;
     }
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_send.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_send.c
index 3019ee83f3d..ad47adc79de 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_send.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_send.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -137,7 +137,7 @@ static void DoSendCompletion(HTC_ENDPOINT       *pEndpoint,
             /* using legacy EpTxComplete */
             do {
                 pPacket = HTC_PACKET_DEQUEUE(pQueueToIndicate);
-                AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" HTC calling ep %d send complete callback on packet %p \n",
+                AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" HTC calling ep %d send complete callback on packet %pK \n",
                         pEndpoint->Id, pPacket));
                 pEndpoint->EpCallBacks.EpTxComplete(pEndpoint->EpCallBacks.pContext, pPacket);
             } while (!HTC_QUEUE_EMPTY(pQueueToIndicate));
@@ -406,6 +406,7 @@ static A_STATUS HTCSendBundledNetbuf(HTC_TARGET *target,
             HTC_TX_PACKET_TAG_BUNDLED);
     LOCK_HTC_TX(target);
     HTC_PACKET_ENQUEUE(&pEndpoint->TxLookupQueue, pPacketTx);
+    pEndpoint->ul_outstanding_cnt++;
     UNLOCK_HTC_TX(target);
 #if DEBUG_BUNDLE
     adf_os_print(" Send bundle EP%d buffer size:0x%x, total:0x%x, count:%d.\n",
@@ -429,13 +430,16 @@ static A_STATUS HTCSendBundledNetbuf(HTC_TARGET *target,
     if (status != A_OK){
         adf_os_print("%s:HIFSend_head failed(len=%zu).\n", __FUNCTION__,
                 data_len);
+        LOCK_HTC_TX(target);
+        HTC_PACKET_REMOVE(&pEndpoint->TxLookupQueue, pPacketTx);
+        UNLOCK_HTC_TX(target);
     }
     return status;
 }
 
-static void HTCIssuePacketsBundle(HTC_TARGET *target,
-                                  HTC_ENDPOINT *pEndpoint,
-                                  HTC_PACKET_QUEUE *pPktQueue)
+static A_STATUS HTCIssuePacketsBundle(HTC_TARGET *target,
+                                      HTC_ENDPOINT *pEndpoint,
+                                      HTC_PACKET_QUEUE *pPktQueue)
 {
    int              i, frag_count, nbytes;
    adf_nbuf_t       netbuf, bundleBuf;
@@ -447,6 +451,7 @@ static void HTCIssuePacketsBundle(HTC_TARGET *target,
    int              last_creditPad = 0;
    int              creditPad, creditRemainder,transferLength, bundlesSpaceRemaining = 0;
    HTC_PACKET_QUEUE *pQueueSave = NULL;
+   A_STATUS ret;
 
    bundlesSpaceRemaining = HTC_MAX_MSG_PER_BUNDLE_TX * pEndpoint->TxCreditSize;
 
@@ -456,7 +461,8 @@ static void HTCIssuePacketsBundle(HTC_TARGET *target,
        //good time to panic
        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("AllocateHTCBundleTxPacket failed \n"));
        AR_DEBUG_ASSERT(FALSE);
-       return;
+       ret = A_NO_MEMORY;
+       goto failed1;
    }
    bundleBuf = GET_HTC_PACKET_NET_BUF_CONTEXT(pPacketTx);
    pBundleBuffer = adf_nbuf_data(bundleBuf);
@@ -480,19 +486,30 @@ static void HTCIssuePacketsBundle(HTC_TARGET *target,
 
        if (bundlesSpaceRemaining < transferLength){
            /* send out previous buffer */
-           HTCSendBundledNetbuf(target, pEndpoint,
-                                pBundleBuffer - last_creditPad, pPacketTx);
-           if (HTC_PACKET_QUEUE_DEPTH(pPktQueue) < HTC_MIN_MSG_PER_BUNDLE){
-               return;
+           if (A_OK != HTCSendBundledNetbuf(target, pEndpoint,
+                                pBundleBuffer - last_creditPad, pPacketTx)) {
+               ret = A_EBUSY;
+               HTC_PACKET_ENQUEUE(pQueueSave, pPacket);
+               goto failed2;
+           }
+
+           /* One packet has been dequeued from sending queue when enter
+            * this loop, so need to add 1 back for this checking.
+            */
+           if ((HTC_PACKET_QUEUE_DEPTH(pPktQueue) + 1) < HTC_MIN_MSG_PER_BUNDLE){
+               HTC_PACKET_ENQUEUE_TO_HEAD(pPktQueue, pPacket);
+               goto success;
            }
            bundlesSpaceRemaining = HTC_MAX_MSG_PER_BUNDLE_TX * pEndpoint->TxCreditSize;
            pPacketTx = AllocateHTCBundleTxPacket(target);
            if (!pPacketTx)
            {
+               HTC_PACKET_ENQUEUE_TO_HEAD(pPktQueue, pPacket);
                //good time to panic
                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("AllocateHTCBundleTxPacket failed \n"));
                AR_DEBUG_ASSERT(FALSE);
-               return;
+               ret = A_NO_MEMORY;
+               goto failed1;
            }
            bundleBuf = GET_HTC_PACKET_NET_BUF_CONTEXT(pPacketTx);
            pBundleBuffer = adf_nbuf_data(bundleBuf);
@@ -533,11 +550,27 @@ static void HTCIssuePacketsBundle(HTC_TARGET *target,
    }
    if (pBundleBuffer != adf_nbuf_data(bundleBuf)){
        /* send out remaining buffer */
-       HTCSendBundledNetbuf(target, pEndpoint,
-                            pBundleBuffer - last_creditPad, pPacketTx);
+       if (A_OK != HTCSendBundledNetbuf(target, pEndpoint,
+                            pBundleBuffer - last_creditPad, pPacketTx))
+       {
+           ret = A_EBUSY;
+           goto failed2;
+       }
    } else {
        FreeHTCBundleTxPacket(target, pPacketTx);
    }
+
+success:
+   return A_OK;
+
+failed2:
+    if (!HTC_QUEUE_EMPTY(pQueueSave))
+       HTC_PACKET_QUEUE_TRANSFER_TO_HEAD(pPktQueue, pQueueSave);
+    FreeHTCBundleTxPacket(target, pPacketTx);
+failed1:
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    ("send bundle buffer failed(%d) \n", ret));
+    return ret;
 }
 #endif /* ENABLE_BUNDLE_TX */
 #endif
@@ -553,7 +586,7 @@ static A_STATUS HTCIssuePackets(HTC_TARGET       *target,
     HTC_FRAME_HDR       *pHtcHdr;
     bool                is_tx_runtime_put = false;
 
-    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCIssuePackets: Queue: %p, Pkts %d \n",
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCIssuePackets: Queue: %pK, Pkts %d \n",
                     pPktQueue, HTC_PACKET_QUEUE_DEPTH(pPktQueue)));
     while (TRUE) {
 #if defined(HIF_USB) || defined(HIF_SDIO)
@@ -675,7 +708,7 @@ static A_STATUS HTCIssuePackets(HTC_TARGET       *target,
 
     if (adf_os_unlikely(A_FAILED(status)))
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-            ("htc_issue_packets, failed pkt:0x%p status:%d",
+            ("htc_issue_packets, failed pkt:0x%pK status:%d",
             pPacket, status));
 
     AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCIssuePackets \n"));
@@ -781,7 +814,7 @@ void GetHTCSendPacketsCreditBased(HTC_TARGET        *target,
             break;
         }
 
-        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Got head packet:%p , Queue Depth: %d\n",
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Got head packet:%pK , Queue Depth: %d\n",
                 pPacket, HTC_PACKET_QUEUE_DEPTH(pTxQueue)));
 
         transferLength = pPacket->ActualLength + HTC_HDR_LENGTH;
@@ -897,7 +930,7 @@ void GetHTCSendPackets(HTC_TARGET        *target,
             break;
         }
 
-        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Got packet:%p , New Queue Depth: %d\n",
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Got packet:%pK , New Queue Depth: %d\n",
                 pPacket, HTC_PACKET_QUEUE_DEPTH(pTxQueue)));
         /* For non-credit path the sequence number is already embedded
          * in the constructed HTC header
@@ -944,7 +977,7 @@ static HTC_SEND_QUEUE_RESULT HTCTrySend(HTC_TARGET       *target,
     int                   overflow;
     HTC_SEND_QUEUE_RESULT result = HTC_SEND_QUEUE_OK;
 
-    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HTCTrySend (Queue:%p Depth:%d)\n",
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HTCTrySend (Queue:%pK Depth:%d)\n",
             pCallersSendQueue,
             (pCallersSendQueue == NULL) ? 0 : HTC_PACKET_QUEUE_DEPTH(pCallersSendQueue)));
 
@@ -1006,7 +1039,7 @@ static HTC_SEND_QUEUE_RESULT HTCTrySend(HTC_TARGET       *target,
                 /* walk through the caller's queue and indicate each one to the send full handler */
             ITERATE_OVER_LIST_ALLOW_REMOVE(&pCallersSendQueue->QueueHead, pPacket, HTC_PACKET, ListLink) {
 
-                AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Indicating overflowed TX packet: %p \n",
+                AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Indicating overflowed TX packet: %pK \n",
                                 pPacket));
                 /*
                  * Remove headroom reserved for HTC_FRAME_HDR before giving
@@ -1142,9 +1175,9 @@ static HTC_SEND_QUEUE_RESULT HTCTrySend(HTC_TARGET       *target,
             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
                ("htc_issue_packets, failed status:%d put it back to head of callers SendQueue",
                result));
+            LOCK_HTC_TX(target);
             HTC_PACKET_QUEUE_TRANSFER_TO_HEAD(&pEndpoint->TxQueue,
                              &sendQueue);
-            LOCK_HTC_TX(target);
             break;
         }
 
@@ -1173,7 +1206,7 @@ A_STATUS HTCSendPktsMultiple(HTC_HANDLE HTCHandle, HTC_PACKET_QUEUE *pPktQueue)
     adf_nbuf_t      netbuf;
     HTC_FRAME_HDR       *pHtcHdr;
 
-    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCSendPktsMultiple: Queue: %p, Pkts %d \n",
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCSendPktsMultiple: Queue: %pK, Pkts %d \n",
                     pPktQueue, HTC_PACKET_QUEUE_DEPTH(pPktQueue)));
 
         /* get packet at head to figure out which endpoint these packets will go into */
@@ -1267,7 +1300,7 @@ A_STATUS    HTCSendPkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket)
     }
     a_mem_trace(GET_HTC_PACKET_NET_BUF_CONTEXT(pPacket));
     AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-                    ("+-HTCSendPkt: Enter endPointId: %d, buffer: %p, length: %d \n",
+                    ("+-HTCSendPkt: Enter endPointId: %d, buffer: %pK, length: %d \n",
                     pPacket->Endpoint, pPacket->pBuffer, pPacket->ActualLength));
     INIT_HTC_PACKET_QUEUE_AND_ADD(&queue,pPacket);
     return HTCSendPktsMultiple(HTCHandle, &queue);
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_services.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_services.c
index 0ce50c4a5d8..b72fedb4cba 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_services.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/HTC/htc_services.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -31,6 +31,7 @@
 #if defined(HIF_PCI)
 #include "if_pci.h"
 #endif
+#include <vos_api.h>
 
 extern unsigned int htc_credit_flow;
 
@@ -58,7 +59,7 @@ A_STATUS HTCConnectService(HTC_HANDLE               HTCHandle,
     A_UINT16                            rsp_msg_id, rsp_msg_serv_id, rsp_msg_max_msg_size;
     A_UINT8                             rsp_msg_status, rsp_msg_end_id, rsp_msg_serv_meta_len;
 
-    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCConnectService, target:%p SvcID:0x%X \n",
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCConnectService, target:%pK SvcID:0x%X \n",
                                     target, pConnectReq->ServiceID));
 
     do {
@@ -328,6 +329,25 @@ A_STATUS HTCConnectService(HTC_HANDLE               HTCHandle,
     return status;
 }
 
+void htc_disconnect_service(HTC_ENDPOINT_ID endpoint_id)
+{
+    void *vos_ctx = vos_get_global_context(VOS_MODULE_ID_HTC, NULL);
+    HTC_HANDLE *htc_hdl = vos_get_context(VOS_MODULE_ID_HTC, vos_ctx);
+    HTC_TARGET *target;
+    HTC_ENDPOINT *endpoint;
+
+    if (htc_hdl == NULL)
+        return;
+
+    target = GET_HTC_TARGET_FROM_HANDLE(htc_hdl);
+    endpoint = &target->EndPoint[endpoint_id];
+
+    LOCK_HTC_ENDPOINT_RX(endpoint);
+    endpoint->EpCallBacks.EpRecv = NULL;
+    UNLOCK_HTC_ENDPOINT_RX(endpoint);
+    return;
+}
+
 
 void HTCSetCreditDistribution(HTC_HANDLE               HTCHandle,
                               void                     *pCreditDistContext,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/regdomain.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/regdomain.h
index 6eff5a08715..a28434c1015 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/regdomain.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/regdomain.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -310,7 +310,8 @@ typedef enum
 {
     COUNTRY_CODE_SET_BY_CORE,
     COUNTRY_CODE_SET_BY_DRIVER,
-    COUNTRY_CODE_SET_BY_USER
+    COUNTRY_CODE_SET_BY_USER,
+    COUNTRY_CODE_SET_BY_11D
 } COUNTRY_CODE_SOURCE;
 
 struct regulatory {
@@ -324,6 +325,7 @@ struct regulatory {
     const void *regpair;
     COUNTRY_CODE_SOURCE cc_src;
     uint32_t reg_flags;
+    vos_timer_t reg_set_timer;
 };
 /* Multi-Device RegDomain Support */
 typedef struct ath_hal_reg_dmn_tables {
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.c
index b4b04df3000..ef97c56142b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -59,7 +59,7 @@
 #include "wniApi.h"
 #include "aniGlobal.h"
 #include "wmi_unified.h"
-#include "wniCfgAp.h"
+#include "wni_cfg.h"
 #include "cfgApi.h"
 #include "ol_txrx_ctrl_api.h"
 #if defined(CONFIG_HL_SUPPORT)
@@ -111,6 +111,7 @@
 
 #include "wma_ocb.h"
 #include "wma_nan_datapath.h"
+#include "adf_trace.h"
 
 /* ################### defines ################### */
 /*
@@ -222,6 +223,51 @@ static int wma_nlo_scan_cmp_evt_handler(void *handle, u_int8_t *event,
 #endif
 
 static enum powersave_qpower_mode wma_get_qpower_config(tp_wma_handle wma);
+
+#ifdef FEATURE_WLAN_DIAG_SUPPORT
+/**
+ * wma_wow_wakeup_stats_event()- send wow wakeup stats
+ * tp_wma_handle wma: WOW wakeup packet counter
+ *
+ * This function sends wow wakeup stats diag event
+ *
+ * Return: void.
+ */
+static void wma_wow_wakeup_stats_event(tp_wma_handle wma)
+{
+        WLAN_VOS_DIAG_EVENT_DEF(WowStats,
+                vos_event_wlan_powersave_wow_stats);
+        vos_mem_zero(&WowStats, sizeof(WowStats));
+
+        WowStats.wow_ucast_wake_up_count = wma->wow_ucast_wake_up_count;
+        WowStats.wow_bcast_wake_up_count = wma->wow_bcast_wake_up_count;
+        WowStats.wow_ipv4_mcast_wake_up_count =
+                                        wma->wow_ipv4_mcast_wake_up_count;
+        WowStats.wow_ipv6_mcast_wake_up_count =
+                                        wma->wow_ipv6_mcast_wake_up_count;
+        WowStats.wow_ipv6_mcast_ra_stats = wma->wow_ipv6_mcast_ra_stats;
+        WowStats.wow_ipv6_mcast_ns_stats = wma->wow_ipv6_mcast_ns_stats;
+        WowStats.wow_ipv6_mcast_na_stats = wma->wow_ipv6_mcast_na_stats;
+        WowStats.wow_pno_match_wake_up_count = wma->wow_pno_match_wake_up_count;
+        WowStats.wow_pno_complete_wake_up_count =
+                                        wma->wow_pno_complete_wake_up_count;
+        WowStats.wow_gscan_wake_up_count = wma->wow_gscan_wake_up_count;
+        WowStats.wow_low_rssi_wake_up_count =  wma->wow_low_rssi_wake_up_count;
+        WowStats.wow_rssi_breach_wake_up_count =
+                                        wma->wow_rssi_breach_wake_up_count;
+        WowStats.wow_icmpv4_count = wma->wow_icmpv4_count;
+        WowStats.wow_icmpv6_count = wma->wow_icmpv6_count;
+        WowStats.wow_oem_response_wake_up_count =
+                                        wma->wow_oem_response_wake_up_count;
+        WLAN_VOS_DIAG_EVENT_REPORT(&WowStats, EVENT_WLAN_POWERSAVE_WOW_STATS);
+}
+#else
+static void wma_wow_wakeup_stats_event(tp_wma_handle wma)
+{
+        return;
+}
+#endif
+
 #ifdef FEATURE_WLAN_EXTSCAN
 /**
  * enum extscan_report_events_type - extscan report events type
@@ -245,6 +291,12 @@ enum extscan_report_events_type {
 
 #define WMA_EXTSCAN_CYCLE_WAKE_LOCK_DURATION    (5 * 1000) /* in msec */
 
+/*
+ * Maximum number of entires that could be present in the
+ * WMI_EXTSCAN_HOTLIST_MATCH_EVENT buffer from the firmware
+ */
+#define WMA_EXTSCAN_MAX_HOTLIST_ENTRIES 10
+
 #endif
 
 /* Data rate 100KBPS based on IE Index */
@@ -421,11 +473,15 @@ static VOS_STATUS wma_stop_scan(tp_wma_handle wma_handle,
 		tAbortScanParams *abort_scan_req);
 
 static void wma_set_sap_keepalive(tp_wma_handle wma, u_int8_t vdev_id);
+static void wma_set_vdev_mgmt_rate(tp_wma_handle wma, u_int8_t vdev_id);
 static int wma_smps_force_mode_callback(WMA_HANDLE handle, uint8_t *event_buf,
 				uint32_t len);
 
+static void wma_send_time_stamp_sync_cmd(void *data);
+
 tANI_U8 wma_getCenterChannel(tANI_U8 chan, tANI_U8 chan_offset);
 
+
 /*
  * 802.11n D2.0 defined values for "Minimum MPDU Start Spacing":
  *   0 for no restriction
@@ -492,7 +548,7 @@ static bool wma_is_vdev_in_ap_mode(tp_wma_handle wma, u_int8_t vdev_id)
 {
 	struct wma_txrx_node *intf = wma->interfaces;
 
-	if (vdev_id > wma->max_bssid) {
+	if (vdev_id >= wma->max_bssid) {
 		WMA_LOGP("%s: Invalid vdev_id %hu", __func__, vdev_id);
 		VOS_ASSERT(0);
 		return false;
@@ -518,7 +574,7 @@ static bool wma_is_vdev_in_ibss_mode(tp_wma_handle wma, u_int8_t vdev_id)
 {
 	struct wma_txrx_node *intf = wma->interfaces;
 
-	if (vdev_id > wma->max_bssid) {
+	if (vdev_id >= wma->max_bssid) {
 		WMA_LOGP("%s: Invalid vdev_id %hu", __func__, vdev_id);
 		VOS_ASSERT(0);
 		return false;
@@ -1091,7 +1147,7 @@ static void wma_vdev_start_rsp(tp_wma_handle wma,
 		 wma->interfaces[resp_event->vdev_id].type,
 		 wma->interfaces[resp_event->vdev_id].sub_type);
 
-	WMA_LOGD("%s: Allocated beacon struct %p, template memory %p",
+	WMA_LOGD("%s: Allocated beacon struct %pK, template memory %pK",
 		__func__, bcn, bcn->buf);
 	}
 	add_bss->status = VOS_STATUS_SUCCESS;
@@ -1289,9 +1345,15 @@ static int wma_vdev_start_rsp_ind(tp_wma_handle wma, u_int8_t *buf)
 		return -EINVAL;
 	}
 
+	if (resp_event->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("%s: received invalid vdev_id %d",
+			__func__, resp_event->vdev_id);
+		return -EINVAL;
+	}
+
 	iface = &wma->interfaces[resp_event->vdev_id];
 
-	if ((resp_event->vdev_id <= wma->max_bssid) &&
+	if ((resp_event->vdev_id < wma->max_bssid) &&
 		(adf_os_atomic_read(
 		&wma->interfaces[resp_event->vdev_id].vdev_restart_params.hidden_ssid_restart_in_progress)) &&
 		(wma_is_vdev_in_ap_mode(wma, resp_event->vdev_id) == true)) {
@@ -1416,6 +1478,8 @@ static int wma_vdev_start_rsp_ind(tp_wma_handle wma, u_int8_t *buf)
 	return 0;
 }
 
+#define BIG_ENDIAN_MAX_DEBUG_BUF   500
+
 /* function   : wma_unified_debug_print_event_handler
  * Description :
  * Args       :
@@ -1437,13 +1501,19 @@ static int wma_unified_debug_print_event_handler(void *handle, u_int8_t *datap,
 	datalen = param_buf->num_data;
 
 #ifdef BIG_ENDIAN_HOST
-    {
-	    char dbgbuf[500] = {0};
-	    memcpy(dbgbuf, data, datalen);
-	    SWAPME(dbgbuf, datalen);
-	    WMA_LOGD("FIRMWARE:%s", dbgbuf);
-	    return 0;
-    }
+	{
+		if (datalen > BIG_ENDIAN_MAX_DEBUG_BUF) {
+			WMA_LOGE("%s Invalid data len %d, limiting to max",
+					__func__, datalen);
+			datalen = BIG_ENDIAN_MAX_DEBUG_BUF;
+		}
+
+		char dbgbuf[BIG_ENDIAN_MAX_DEBUG_BUF] = { 0 };
+		memcpy(dbgbuf, data, datalen);
+		SWAPME(dbgbuf, datalen);
+		WMA_LOGD("FIRMWARE:%s", dbgbuf);
+		return 0;
+	}
 #else
 	WMA_LOGD("FIRMWARE:%s", data);
     return 0;
@@ -1571,7 +1641,11 @@ static v_VOID_t wma_set_default_tgt_config(tp_wma_handle wma_handle)
 	}
 	no_of_peers_supported = ol_get_number_of_peers_supported(scn);
 	tgt_cfg.num_peers = no_of_peers_supported + CFG_TGT_NUM_VDEV + 2;
+#if defined(CONFIG_HL_SUPPORT)
+	tgt_cfg.num_tids = 4 * no_of_peers_supported;
+#else
 	tgt_cfg.num_tids = (2 * (no_of_peers_supported + CFG_TGT_NUM_VDEV + 2));
+#endif
 
 	WMITLV_SET_HDR(&tgt_cfg.tlv_header,WMITLV_TAG_STRUC_wmi_resource_config,
 		       WMITLV_GET_STRUCT_TLVLEN(wmi_resource_config));
@@ -1667,17 +1741,14 @@ void wma_remove_peer(tp_wma_handle wma, u_int8_t *bssid,
                     __func__, bssid, vdev_id, wma->interfaces[vdev_id].peer_count);
              return;
         }
-	if (peer)
-		ol_txrx_peer_detach(peer);
 
-	wma->interfaces[vdev_id].peer_count--;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 	if (roam_synch_in_progress) {
-	    WMA_LOGD("%s:LFR3:Removed peer with addr %pM vdevid %d peer_cnt %d",
+	    WMA_LOGE("%s:LFR3:Removing peer with addr %pM vdevid %d peer_cnt %d",
 		__func__, bssid, vdev_id, wma->interfaces[vdev_id].peer_count);
-	    return;
+	    goto peer_detach;
 	} else {
-	    WMA_LOGE("%s: Removed peer with addr %pM vdevid %d peer_count %d",
+	    WMA_LOGI("%s: Removing peer with addr %pM vdevid %d peer_count %d",
 		__func__, bssid, vdev_id, wma->interfaces[vdev_id].peer_count);
 	}
 #endif
@@ -1695,6 +1766,14 @@ void wma_remove_peer(tp_wma_handle wma, u_int8_t *bssid,
 #endif
 
 	wmi_unified_peer_delete_send(wma->wmi_handle, peer_addr, vdev_id);
+
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+peer_detach:
+#endif
+	if (peer)
+		ol_txrx_peer_detach(peer);
+	wma->interfaces[vdev_id].peer_count--;
+
 #undef PEER_ALL_TID_BITMASK
 }
 
@@ -1884,7 +1963,7 @@ static void wma_delete_all_ibss_peers(tp_wma_handle wma, A_UINT32 vdev_id)
 	ol_txrx_vdev_handle vdev;
 	ol_txrx_peer_handle peer, temp;
 
-	if (!wma || vdev_id > wma->max_bssid)
+	if (!wma || vdev_id >= wma->max_bssid)
 		return;
 
 	vdev = wma->interfaces[vdev_id].handle;
@@ -1926,7 +2005,7 @@ static void wma_delete_all_ap_remote_peers(tp_wma_handle wma, A_UINT32 vdev_id)
 	ol_txrx_vdev_handle vdev;
 	ol_txrx_peer_handle peer, temp;
 
-	if (!wma || vdev_id > wma->max_bssid)
+	if (!wma || vdev_id >= wma->max_bssid)
 		return;
 
 	vdev = wma->interfaces[vdev_id].handle;
@@ -1958,67 +2037,6 @@ static void wma_delete_all_ap_remote_peers(tp_wma_handle wma, A_UINT32 vdev_id)
 	adf_os_spin_unlock_bh(&vdev->pdev->peer_ref_mutex);
 }
 
-#ifdef QCA_IBSS_SUPPORT
-static void wma_recreate_ibss_vdev_and_bss_peer(tp_wma_handle wma, u_int8_t vdev_id)
-{
-	ol_txrx_vdev_handle vdev;
-	tDelStaSelfParams del_sta_param;
-	tAddStaSelfParams add_sta_self_param;
-	VOS_STATUS status;
-
-	if (!wma) {
-		WMA_LOGE("%s: Null wma handle", __func__);
-		return;
-	}
-
-	vdev = wma_find_vdev_by_id(wma, vdev_id);
-	if (!vdev) {
-		WMA_LOGE("%s: Can't find vdev with id %d", __func__, vdev_id);
-		return;
-	}
-
-        vos_copy_macaddr((v_MACADDR_t *)&(add_sta_self_param.selfMacAddr),
-			(v_MACADDR_t *)&(vdev->mac_addr));
-	add_sta_self_param.sessionId = vdev_id;
-	add_sta_self_param.type      = WMI_VDEV_TYPE_IBSS;
-	add_sta_self_param.subType   = 0;
-	add_sta_self_param.status    = 0;
-	add_sta_self_param.nss_2g = wma->interfaces[vdev_id].nss_2g;
-	add_sta_self_param.nss_5g = wma->interfaces[vdev_id].nss_5g;
-	add_sta_self_param.tx_aggregation_size =
-				wma->interfaces[vdev_id].tx_aggregation_size;
-	add_sta_self_param.rx_aggregation_size =
-				wma->interfaces[vdev_id].rx_aggregation_size;
-
-	/* delete old ibss vdev */
-	del_sta_param.sessionId   = vdev_id;
-	vos_mem_copy((void *)del_sta_param.selfMacAddr,
-		(void *)&(vdev->mac_addr),
-	VOS_MAC_ADDR_SIZE);
-	wma_vdev_detach(wma, &del_sta_param, 0);
-
-	/* create new vdev for ibss */
-	vdev = wma_vdev_attach(wma, &add_sta_self_param, 0);
-	if (!vdev) {
-		WMA_LOGE("%s: Failed to create vdev", __func__);
-		return;
-	}
-
-	WLANTL_RegisterVdev(wma->vos_context, vdev);
-	/* Register with TxRx Module for Data Ack Complete Cb */
-	wdi_in_data_tx_cb_set(vdev, wma_data_tx_ack_comp_hdlr, wma);
-	WMA_LOGA("new IBSS vdev created with mac %pM", add_sta_self_param.selfMacAddr);
-
-	/* create ibss bss peer */
-	status = wma_create_peer(wma, vdev->pdev, vdev, vdev->mac_addr.raw,
-			WMI_PEER_TYPE_DEFAULT, vdev_id, VOS_FALSE);
-	if (status != VOS_STATUS_SUCCESS)
-		WMA_LOGE("%s: Failed to create IBSS bss peer", __func__);
-	else
-		WMA_LOGA("IBSS BSS peer created with mac %pM", vdev->mac_addr.raw);
-}
-#endif //#ifdef QCA_IBSS_SUPPORT
-
 static int wma_vdev_stop_resp_handler(void *handle, u_int8_t *cmd_param_info,
 				      u32 len)
 {
@@ -2185,7 +2203,7 @@ static int wma_vdev_stop_ind(tp_wma_handle wma, u_int8_t *buf)
 
 	resp_event = (wmi_vdev_stopped_event_fixed_param *)buf;
 
-	if ((resp_event->vdev_id <= wma->max_bssid) &&
+	if ((resp_event->vdev_id < wma->max_bssid) &&
 	(adf_os_atomic_read(&wma->interfaces[resp_event->vdev_id].vdev_restart_params.hidden_ssid_restart_in_progress)) &&
 	((wma->interfaces[resp_event->vdev_id].type == WMI_VDEV_TYPE_AP) &&
 	(wma->interfaces[resp_event->vdev_id].sub_type == 0))) {
@@ -2224,7 +2242,7 @@ static int wma_vdev_stop_ind(tp_wma_handle wma, u_int8_t *buf)
 		tpDeleteBssParams params =
 			(tpDeleteBssParams)req_msg->user_data;
 		struct beacon_info *bcn;
-		if (resp_event->vdev_id > wma->max_bssid) {
+		if (resp_event->vdev_id >= wma->max_bssid) {
 			WMA_LOGE("%s: Invalid vdev_id %d", __func__,
 				resp_event->vdev_id);
 			vos_mem_free(params);
@@ -2241,6 +2259,12 @@ static int wma_vdev_stop_ind(tp_wma_handle wma, u_int8_t *buf)
 			goto free_req_msg;
 		}
 
+		/* Clear arp and ns offload cache */
+		vos_mem_zero(&iface->ns_offload_req,
+			sizeof(iface->ns_offload_req));
+		vos_mem_zero(&iface->arp_offload_req,
+			sizeof(iface->arp_offload_req));
+
 #ifdef QCA_IBSS_SUPPORT
 		if ( wma_is_vdev_in_ibss_mode(wma, resp_event->vdev_id))
 			wma_delete_all_ibss_peers(wma, resp_event->vdev_id);
@@ -2288,8 +2312,8 @@ static int wma_vdev_stop_ind(tp_wma_handle wma, u_int8_t *buf)
 		bcn = wma->interfaces[resp_event->vdev_id].beacon;
 
 		if (bcn) {
-			WMA_LOGD("%s: Freeing beacon struct %p, "
-				 "template memory %p", __func__,
+			WMA_LOGD("%s: Freeing beacon struct %pK, "
+				 "template memory %pK", __func__,
 				 bcn, bcn->buf);
 			if (bcn->dma_mapped)
 				adf_nbuf_unmap_single(pdev->osdev, bcn->buf,
@@ -2299,11 +2323,6 @@ static int wma_vdev_stop_ind(tp_wma_handle wma, u_int8_t *buf)
 			wma->interfaces[resp_event->vdev_id].beacon = NULL;
 		}
 
-#ifdef QCA_IBSS_SUPPORT
-		/* recreate ibss vdev and bss peer for scan purpose */
-		if (wma_is_vdev_in_ibss_mode(wma, resp_event->vdev_id))
-			wma_recreate_ibss_vdev_and_bss_peer(wma, resp_event->vdev_id);
-#endif
 		/* Timeout status means its WMA generated DEL BSS REQ when ADD
 		BSS REQ was timed out to stop the VDEV in this case no need to
 		send response to UMAC */
@@ -2792,17 +2811,11 @@ static void wma_update_peer_stats(tp_wma_handle wma, wmi_peer_stats *peer_stats)
 				 * rate flags */
 				classa_stats->rx_frag_cnt = node->nss;
 				classa_stats->promiscuous_rx_frag_cnt = mcsRateFlags;
-				WMA_LOGD("Computed mcs_idx:%d mcs_rate_flags:%d",
-						classa_stats->mcs_index,
-						mcsRateFlags);
 			}
 			/* FW returns tx power in intervals of 0.5 dBm
 			   Convert it back to intervals of 1 dBm */
 			classa_stats->max_pwr =
 				 roundup(classa_stats->max_pwr, 2) >> 1;
-			WMA_LOGD("peer tx rate flags:%d nss:%d max_txpwr:%d",
-					node->rate_flags, node->nss,
-					classa_stats->max_pwr);
 		}
 	}
 }
@@ -2928,49 +2941,6 @@ static void wma_update_rssi_stats(tp_wma_handle wma,
 	}
 }
 
-#ifdef WLAN_FEATURE_MEMDUMP
-/**
- * wma_fw_mem_dump_rsp() - send fw mem dump response to SME
- *
- * @req_id - request id.
- * @status - copy status from the firmware.
- *
- * This function is called by the memory dump response handler to
- * indicate SME that firmware dump copy is complete
- */
-static VOS_STATUS wma_fw_mem_dump_rsp(uint32_t req_id, uint32_t status)
-{
-	struct fw_dump_rsp *dump_rsp;
-	vos_msg_t sme_msg = {0} ;
-	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
-
-	dump_rsp = vos_mem_malloc(sizeof(*dump_rsp));
-
-	if (!dump_rsp) {
-		WMA_LOGE(FL("Memory allocation failed."));
-		vos_status = VOS_STATUS_E_NOMEM;
-		return vos_status;
-	}
-
-	WMA_LOGI(FL("FW memory dump copy complete status: %d for request: %d"),
-		 status, req_id);
-
-	dump_rsp->request_id = req_id;
-	dump_rsp->dump_complete = status;
-
-	sme_msg.type = eWNI_SME_FW_DUMP_IND;
-	sme_msg.bodyptr = dump_rsp;
-	sme_msg.bodyval = 0;
-
-	vos_status = vos_mq_post_message(VOS_MODULE_ID_SME, &sme_msg);
-	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
-		WMA_LOGE(FL("Fail to post fw mem dump ind msg"));
-		vos_mem_free(dump_rsp);
-	}
-
-	return vos_status;
-}
-#endif /* WLAN_FEATURE_MEMDUMP */
 
 static int wma_link_status_rsp(tp_wma_handle wma, u_int8_t *buf)
 {
@@ -3039,6 +3009,13 @@ static int wma_link_status_event_handler(void *handle, u_int8_t *cmd_param_info,
 	}
 
 	event = param_buf->fixed_param;
+	if (event->num_vdev_stats > ((WMA_SVC_MSG_MAX_SIZE -
+	    sizeof(*event)) / sizeof(wmi_vdev_rate_ht_info))) {
+		WMA_LOGE("%s: excess vdev_stats buffers:%d", __func__,
+			event->num_vdev_stats);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	}
 	buf_size = sizeof(wmi_vdev_rate_stats_event_fixed_param) +
 			sizeof(wmi_vdev_rate_ht_info) * event->num_vdev_stats;
 	buf = vos_mem_malloc(buf_size);
@@ -3189,6 +3166,8 @@ static int wma_stats_event_handler(void *handle, u_int8_t *cmd_param_info,
 	vos_msg_t vos_msg = {0};
 	u_int32_t buf_size, buf_data_size;
 	u_int8_t *buf, *temp;
+	u_int32_t buf_len = 0;
+	bool excess_data = false;
 	bool rssi_stats_support = FALSE;
 
 	param_buf = (WMI_UPDATE_STATS_EVENTID_param_tlvs *)cmd_param_info;
@@ -3197,6 +3176,61 @@ static int wma_stats_event_handler(void *handle, u_int8_t *cmd_param_info,
 		return -EINVAL;
 	}
 	event = param_buf->fixed_param;
+
+	do {
+		if (event->num_pdev_stats > ((WMA_SVC_MSG_MAX_SIZE -
+		    sizeof(*event)) / sizeof(wmi_pdev_stats))) {
+			excess_data = true;
+			break;
+		} else {
+			buf_len += event->num_pdev_stats * sizeof(wmi_pdev_stats);
+		}
+		if (event->num_vdev_stats > ((WMA_SVC_MSG_MAX_SIZE -
+		    sizeof(*event)) / sizeof(wmi_vdev_stats))) {
+			excess_data = true;
+			break;
+		} else {
+			buf_len += event->num_vdev_stats * sizeof(wmi_vdev_stats);
+		}
+		if (event->num_peer_stats > ((WMA_SVC_MSG_MAX_SIZE -
+		    sizeof(*event)) / sizeof(wmi_peer_stats))) {
+			excess_data = true;
+			break;
+		} else {
+			buf_len += event->num_peer_stats * sizeof(wmi_peer_stats);
+		}
+		if (event->num_mib_stats > ((WMA_SVC_MSG_MAX_SIZE -
+		    sizeof(*event)) / sizeof(wmi_mib_stats))) {
+			excess_data = true;
+			break;
+		} else {
+			buf_len += event->num_mib_stats * sizeof(wmi_mib_stats);
+		}
+		rssi_event =
+			(wmi_per_chain_rssi_stats *) param_buf->chain_stats;
+		if (rssi_event) {
+			if ((rssi_event->num_per_chain_rssi_stats >
+			    ((WMA_SVC_MSG_MAX_SIZE - sizeof(*event)) /
+			    sizeof(wmi_rssi_stats)))) {
+				excess_data = true;
+				break;
+			} else {
+				buf_len +=
+					rssi_event->num_per_chain_rssi_stats *
+					sizeof(wmi_rssi_stats);
+			}
+		}
+	} while (0);
+
+	if (excess_data ||
+	    (sizeof(*event) > WMA_SVC_MSG_MAX_SIZE - buf_len)) {
+		WMA_LOGE("excess wmi buffer: stats pdev %d vdev %d peer %d",
+			event->num_pdev_stats, event->num_vdev_stats,
+			event->num_peer_stats);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	}
+
 	buf_size = sizeof(*event) +
 		   (event->num_pdev_stats * sizeof(wmi_pdev_stats)) +
 		   (event->num_vdev_stats * sizeof(wmi_vdev_stats)) +
@@ -3250,6 +3284,306 @@ static int wma_stats_event_handler(void *handle, u_int8_t *cmd_param_info,
 	return 0;
 }
 
+/**
+ * wma_fill_peer_info() - fill SIR peer info from WMI peer info struct
+ * @wma: wma interface
+ * @stats_info: WMI peer info pointer
+ * @peer_info: SIR peer info pointer
+ *
+ * This function will fill SIR peer info from WMI peer info struct
+ *
+ * Return: None
+ */
+static void wma_fill_peer_info(tp_wma_handle wma,
+		wmi_peer_stats_info *stats_info,
+		struct sir_peer_info_ext *peer_info)
+{
+	peer_info->tx_packets = stats_info->tx_packets.low_32;
+	peer_info->tx_bytes = stats_info->tx_bytes.high_32;
+	peer_info->tx_bytes <<= 32;
+	peer_info->tx_bytes += stats_info->tx_bytes.low_32;
+	peer_info->rx_packets = stats_info->rx_packets.low_32;
+	peer_info->rx_bytes = stats_info->rx_bytes.high_32;
+	peer_info->rx_bytes <<= 32;
+	peer_info->rx_bytes += stats_info->rx_bytes.low_32;
+	peer_info->tx_retries = stats_info->tx_retries;
+	peer_info->tx_failed = stats_info->tx_failed;
+	peer_info->rssi = stats_info->peer_rssi;
+	peer_info->tx_rate = stats_info->last_tx_bitrate_kbps;
+	peer_info->tx_rate_code = stats_info->last_tx_rate_code;
+	peer_info->rx_rate = stats_info->last_rx_bitrate_kbps;
+	peer_info->rx_rate_code = stats_info->last_rx_rate_code;
+}
+
+/**
+ * wma_peer_info_ext_rsp() - fill SIR peer info from WMI peer info struct
+ * @handle: wma interface
+ * @buf: wmi event buf pointer
+ *
+ * This function will send eWNI_SME_GET_PEER_INFO_EXT_IND to SME
+ *
+ * Return: 0 on success, error code otherwise
+ */
+static VOS_STATUS wma_peer_info_ext_rsp(tp_wma_handle wma, u_int8_t *buf)
+{
+	wmi_peer_stats_info_event_fixed_param *event;
+	wmi_peer_stats_info *stats_info = NULL;
+	struct sir_peer_info_ext_resp *resp;
+	struct sir_peer_info_ext *peer_info;
+	vos_msg_t sme_msg = {0};
+	int i, j = 0;
+	VOS_STATUS vos_status;
+
+	event = (wmi_peer_stats_info_event_fixed_param *)buf;
+	stats_info = (wmi_peer_stats_info *)(buf +
+			sizeof(wmi_peer_stats_info_event_fixed_param));
+
+	if (wma->get_one_peer_info) {
+		resp = vos_mem_malloc(sizeof(struct sir_peer_info_ext_resp) +
+				sizeof(resp->info[0]));
+		if (!resp) {
+			WMA_LOGE(FL("resp allocation failed."));
+			return VOS_STATUS_E_NOMEM;
+		}
+		resp->count = 0;
+		peer_info = &resp->info[0];
+		for (i = 0; i < event->num_peers; i++) {
+			WMI_MAC_ADDR_TO_CHAR_ARRAY(&stats_info->peer_macaddr,
+					peer_info->peer_macaddr);
+
+			if (TRUE == vos_mem_compare(
+					peer_info->peer_macaddr,
+					wma->peer_macaddr.bytes,
+					VOS_MAC_ADDR_SIZE)) {
+				wma_fill_peer_info(wma, stats_info, peer_info);
+				resp->count++;
+				break;
+			}
+
+			stats_info = stats_info + 1;
+		}
+	} else {
+		resp = vos_mem_malloc(sizeof(struct sir_peer_info_ext_resp) +
+				event->num_peers * sizeof(resp->info[0]));
+		if (!resp) {
+			WMA_LOGE(FL("resp allocation failed."));
+			return VOS_STATUS_E_NOMEM;
+		}
+		resp->count = event->num_peers;
+		for (i = 0; i < event->num_peers; i++) {
+			peer_info = &resp->info[j];
+			WMI_MAC_ADDR_TO_CHAR_ARRAY(&stats_info->peer_macaddr,
+					peer_info->peer_macaddr);
+
+			if (TRUE == vos_mem_compare(
+					peer_info->peer_macaddr,
+					wma->myaddr, VOS_MAC_ADDR_SIZE)) {
+				resp->count = resp->count - 1;
+				continue;
+			}
+			wma_fill_peer_info(wma, stats_info, peer_info);
+			stats_info = stats_info + 1;
+			j++;
+		}
+	}
+
+	sme_msg.type = eWNI_SME_GET_PEER_INFO_EXT_IND;
+	sme_msg.bodyptr = resp;
+	sme_msg.bodyval = 0;
+
+	vos_status = vos_mq_post_message(VOS_MODULE_ID_SME, &sme_msg);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+		WMA_LOGE("%s: Fail to post get peer info msg", __func__);
+		vos_mem_free(resp);
+	}
+
+	return vos_status;
+}
+
+/**
+ * dump_peer_stats_info() - dump wmi peer info struct
+ * @event: wmi peer info fixed param pointer
+ * @peer_stats: wmi peer stats info pointer
+ *
+ * This function will dump wmi peer info struct
+ *
+ * Return: None
+ */
+static void dump_peer_stats_info(wmi_peer_stats_info_event_fixed_param *event,
+		wmi_peer_stats_info *peer_stats)
+{
+	int i;
+	wmi_peer_stats_info *stats = peer_stats;
+	char mac[6];
+
+	WMA_LOGI("%s vdev_id %d, num_peers %d more_data %d",
+			__func__, event->vdev_id,
+			event->num_peers, event->more_data);
+
+	for (i = 0; i < event->num_peers; i++) {
+		WMI_MAC_ADDR_TO_CHAR_ARRAY(&stats->peer_macaddr, mac);
+		WMA_LOGI("%s mac %pM", __func__, mac);
+		WMA_LOGI("%s tx_bytes %d %d tx_packets %d %d",
+				__func__,
+				stats->tx_bytes.low_32,
+				stats->tx_bytes.high_32,
+				stats->tx_packets.low_32,
+				stats->tx_packets.high_32);
+		WMA_LOGI("%s rx_bytes %d %d rx_packets %d %d",
+				__func__,
+				stats->rx_bytes.low_32,
+				stats->rx_bytes.high_32,
+				stats->rx_packets.low_32,
+				stats->rx_packets.high_32);
+		WMA_LOGI("%s tx_retries %d tx_failed %d",
+				__func__, stats->tx_retries, stats->tx_failed);
+		WMA_LOGI("%s tx_rate_code %x rx_rate_code %x",
+				__func__,
+				stats->last_tx_rate_code,
+				stats->last_rx_rate_code);
+		WMA_LOGI("%s tx_rate %x rx_rate %x",
+				__func__,
+				stats->last_tx_bitrate_kbps,
+				stats->last_rx_bitrate_kbps);
+		WMA_LOGI("%s peer_rssi %d", __func__, stats->peer_rssi);
+		stats++;
+	}
+}
+
+/**
+ * wma_peer_info_event_handler() - Handler for WMI_PEER_STATS_INFO_EVENTID
+ * @handle: WMA global handle
+ * @cmd_param_info: Command event data
+ * @len: Length of @cmd_param_info
+ *
+ * This function will handle WMI_PEER_STATS_INFO_EVENTID
+ *
+ * Return: 0 on success, error code otherwise
+ */
+static int wma_peer_info_event_handler(void *handle, u_int8_t *cmd_param_info,
+				   u_int32_t len)
+{
+	WMI_PEER_STATS_INFO_EVENTID_param_tlvs *param_buf;
+	wmi_peer_stats_info_event_fixed_param *event;
+	vos_msg_t vos_msg = {0};
+	u_int32_t buf_size;
+	u_int8_t *buf;
+
+	param_buf =
+		(WMI_PEER_STATS_INFO_EVENTID_param_tlvs *)cmd_param_info;
+	if (!param_buf) {
+		WMA_LOGA("%s: Invalid stats event", __func__);
+		return -EINVAL;
+	}
+
+	WMA_LOGI("%s Recv WMI_PEER_STATS_INFO_EVENTID", __func__);
+	event = param_buf->fixed_param;
+	if (event->num_peers >
+		((WMA_SVC_MSG_MAX_SIZE -
+		  sizeof(wmi_peer_stats_info_event_fixed_param))/
+		 sizeof(wmi_peer_stats_info))) {
+		WMA_LOGE("Excess num of peers from fw %d", event->num_peers);
+		return -EINVAL;
+	}
+	buf_size = sizeof(wmi_peer_stats_info_event_fixed_param) +
+		sizeof(wmi_peer_stats_info) * event->num_peers;
+	buf = vos_mem_malloc(buf_size);
+	if (!buf) {
+		WMA_LOGE("%s: Failed alloc memory for buf", __func__);
+		return -ENOMEM;
+	}
+
+	vos_mem_zero(buf, buf_size);
+	vos_mem_copy(buf, param_buf->fixed_param,
+			sizeof(wmi_peer_stats_info_event_fixed_param));
+	vos_mem_copy((buf + sizeof(wmi_peer_stats_info_event_fixed_param)),
+			param_buf->peer_stats_info,
+			sizeof(wmi_peer_stats_info) * event->num_peers);
+	WMA_LOGI("%s dump peer stats info", __func__);
+	dump_peer_stats_info(event, param_buf->peer_stats_info);
+
+	vos_msg.type = WDA_GET_PEER_INFO_EXT_IND;
+	vos_msg.bodyptr = buf;
+	vos_msg.bodyval = 0;
+
+	if (VOS_STATUS_SUCCESS !=
+			vos_mq_post_message(VOS_MQ_ID_WDA, &vos_msg)) {
+		WMA_LOGP("%s: Failed to post WDA_GET_LINK_STATUS_RSP_IND msg",
+				__func__);
+		vos_mem_free(buf);
+		return eHAL_STATUS_FAILURE;
+	}
+	WMA_LOGD("posted WDA_GET_PEER_INFO_EXT_IND");
+
+	return 0;
+}
+
+/**
+ * wma_get_peer_info_ext() - get peer info
+ * @handle: wma interface
+ * @prssi_req: get peer info request information
+ *
+ * This function will send WMI_REQUEST_PEER_STATS_INFO_CMDID to FW
+ *
+ * Return: 0 on success, otherwise error value
+ */
+static VOS_STATUS wma_get_peer_info_ext(WMA_HANDLE handle,
+				struct sir_peer_info_ext_req *peer_info_req)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle)handle;
+	wmi_request_peer_stats_info_cmd_fixed_param *cmd;
+	wmi_buf_t  wmi_buf;
+	uint32_t  len;
+	uint8_t *buf_ptr;
+
+	if (!wma_handle || !wma_handle->wmi_handle) {
+		WMA_LOGE("%s: WMA is closed, can not issue get rssi",
+                        __func__);
+		return VOS_STATUS_E_INVAL;
+	}
+
+	WMA_LOGI("%s send WMI_REQUEST_PEER_STATS_INFO_CMDID", __func__);
+
+	len  = sizeof(wmi_request_peer_stats_info_cmd_fixed_param);
+	wmi_buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+	if (!wmi_buf) {
+		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
+		return VOS_STATUS_E_NOMEM;
+	}
+	buf_ptr = (uint8_t *)wmi_buf_data(wmi_buf);
+
+	cmd = (wmi_request_peer_stats_info_cmd_fixed_param *)buf_ptr;
+	WMITLV_SET_HDR(&cmd->tlv_header,
+	WMITLV_TAG_STRUC_wmi_request_peer_stats_info_cmd_fixed_param,
+	WMITLV_GET_STRUCT_TLVLEN(wmi_request_peer_stats_info_cmd_fixed_param));
+	cmd->vdev_id = peer_info_req->sessionid;
+	cmd->request_type = WMI_REQUEST_ONE_PEER_STATS_INFO;
+	wma_handle->get_one_peer_info = TRUE;
+	WMI_CHAR_ARRAY_TO_MAC_ADDR(peer_info_req->peer_macaddr.bytes,
+			&cmd->peer_macaddr);
+	cmd->reset_after_request = peer_info_req->reset_after_request;
+
+	if (wmi_unified_cmd_send(wma_handle->wmi_handle, wmi_buf, len,
+				WMI_REQUEST_PEER_STATS_INFO_CMDID)) {
+		WMA_LOGE("Failed to send host stats request to fw");
+		wmi_buf_free(wmi_buf);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	WMA_LOGI("%s vdev_id %d, mac %pM, req_type %x, reset %x",
+			__func__,
+			cmd->vdev_id,
+			peer_info_req->peer_macaddr.bytes,
+			cmd->request_type,
+			cmd->reset_after_request);
+
+	vos_mem_copy(&(wma_handle->peer_macaddr),
+					&(peer_info_req->peer_macaddr),
+					VOS_MAC_ADDR_SIZE);
+
+	return VOS_STATUS_SUCCESS;
+}
+
 static VOS_STATUS wma_send_link_speed(u_int32_t link_speed)
 {
 	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
@@ -3298,25 +3632,25 @@ static int wma_link_speed_event_handler(void *handle, u_int8_t *cmd_param_info,
 
 
 /**
- * wma_handle_sta_rssi() - handle rssi information in
+ * wma_handle_sta_peer_info() - handle peer information in
  * peer stats
  * @num_peer_stats: peer number
  * @peer_stats: peer stats received from firmware
  * @peer_macaddr: the specified mac address
  * @sapaddr: sap mac address
  *
- * This function will send eWNI_SME_GET_RSSI_IND
- * to sme with stations' rssi information
+ * This function will send eWNI_SME_GET_PEER_INFO_IND
+ * to sme with stations' information
  *
  */
-static void wma_handle_sta_rssi(uint32_t num_peer_stats,
+static void wma_handle_sta_peer_info(uint32_t num_peer_stats,
 					wmi_peer_stats *peer_stats,
 					v_MACADDR_t peer_macaddr,
 					uint8_t *sapaddr)
 {
 	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
 	wmi_mac_addr temp_addr;
-	struct sir_rssi_resp *sta_rssi;
+	struct sir_peer_info_resp *peer_info;
 	vos_msg_t sme_msg = {0};
 	uint32_t  i = 0;
 	uint32_t  j = 0;
@@ -3334,64 +3668,77 @@ static void wma_handle_sta_rssi(uint32_t num_peer_stats,
 			}
 			peer_stats = peer_stats + 1;
 		}
-		sta_rssi = vos_mem_malloc(sizeof(*sta_rssi) +
-				sizeof(sta_rssi->info[0]));
-		if (NULL == sta_rssi) {
+		peer_info = vos_mem_malloc(sizeof(*peer_info) +
+				sizeof(peer_info->info[0]));
+		if (NULL == peer_info) {
 			WMA_LOGE("%s: Memory allocation failed.", __func__);
 			return;
 		}
 		if (i < num_peer_stats) {
-			sta_rssi->count = 1;
+			peer_info->count = 1;
 			WMI_MAC_ADDR_TO_CHAR_ARRAY(&(peer_stats->peer_macaddr),
-				sta_rssi->info[0].peer_macaddr);
-			sta_rssi->info[0].rssi =
+				peer_info->info[0].peer_macaddr);
+			peer_info->info[0].rssi =
 						peer_stats->peer_rssi;
+			peer_info->info[0].tx_rate = peer_stats->peer_tx_rate;
+			peer_info->info[0].rx_rate = peer_stats->peer_rx_rate;
+			WMA_LOGD("%s peer %pM rssi %d tx_rate %d rx_rate %d",
+					 __func__,
+					 peer_info->info[0].peer_macaddr,
+					 peer_stats->peer_rssi,
+					 peer_stats->peer_tx_rate,
+					 peer_stats->peer_rx_rate);
 		} else {
 			WMA_LOGE("%s: no match mac address", __func__);
-			sta_rssi->count = 0;
+			peer_info->count = 0;
 		}
 	} else {
-		sta_rssi = vos_mem_malloc(sizeof(*sta_rssi) +
-				num_peer_stats * sizeof(sta_rssi->info[0]));
-		if (NULL == sta_rssi) {
+		peer_info = vos_mem_malloc(sizeof(*peer_info) +
+				num_peer_stats * sizeof(peer_info->info[0]));
+		if (NULL == peer_info) {
 			WMA_LOGE("%s: Memory allocation failed.", __func__);
 			return;
 		}
-		sta_rssi->count = num_peer_stats;
+		peer_info->count = num_peer_stats;
 
 		for (i = 0; i < num_peer_stats; i++) {
 			WMI_MAC_ADDR_TO_CHAR_ARRAY(&(peer_stats->peer_macaddr),
-					sta_rssi->info[j].peer_macaddr);
-			sta_rssi->info[j].rssi = peer_stats->peer_rssi;
+					peer_info->info[j].peer_macaddr);
+			peer_info->info[j].rssi = peer_stats->peer_rssi;
+			peer_info->info[j].tx_rate = peer_stats->peer_tx_rate;
+			peer_info->info[j].rx_rate = peer_stats->peer_rx_rate;
+			WMA_LOGD("%s peer %pM rssi %d tx_rate %d rx_rate %d",
+					__func__,
+					peer_info->info[j].peer_macaddr,
+					peer_stats->peer_rssi,
+					peer_stats->peer_tx_rate,
+					peer_stats->peer_rx_rate);
 			if (TRUE == vos_mem_compare(
-				sta_rssi->info[j].peer_macaddr,
+				peer_info->info[j].peer_macaddr,
 				sapaddr, VOS_MAC_ADDR_SIZE)) {
 
-				sta_rssi->count = sta_rssi->count - 1;
+				peer_info->count = peer_info->count - 1;
 			} else {
 				j++;
 			}
 			peer_stats = peer_stats + 1;
 		}
-		WMA_LOGD("WDA send peer num %d", sta_rssi->count);
+		WMA_LOGD("WDA send peer num %d", peer_info->count);
 	}
 
-	sme_msg.type = eWNI_SME_GET_RSSI_IND;
-	sme_msg.bodyptr = sta_rssi;
+	sme_msg.type = eWNI_SME_GET_PEER_INFO_IND;
+	sme_msg.bodyptr = peer_info;
 	sme_msg.bodyval = 0;
 
 	vos_status = vos_mq_post_message(VOS_MODULE_ID_SME, &sme_msg);
 	if (!VOS_IS_STATUS_SUCCESS(vos_status) ) {
 		WMA_LOGE("%s: Fail to post get rssi msg", __func__);
-		vos_mem_free(sta_rssi);
+		vos_mem_free(peer_info);
 	}
 
 	return;
 }
 
-
-
-
 static void wma_fw_stats_ind(tp_wma_handle wma, u_int8_t *buf)
 {
 	wmi_stats_event_fixed_param *event = (wmi_stats_event_fixed_param *)buf;
@@ -3426,10 +3773,8 @@ static void wma_fw_stats_ind(tp_wma_handle wma, u_int8_t *buf)
 	}
 
 	if (event->num_peer_stats > 0) {
-		WMA_LOGD("update get rssi %d",
-                        wma->get_sta_rssi);
-		if (wma->get_sta_rssi == TRUE) {
-			wma_handle_sta_rssi(event->num_peer_stats,
+		if (wma->get_sta_peer_info == TRUE) {
+			wma_handle_sta_peer_info(event->num_peer_stats,
 						(wmi_peer_stats *)temp,
 						wma->peer_macaddr,
 						wma->myaddr);
@@ -3455,8 +3800,6 @@ static void wma_fw_stats_ind(tp_wma_handle wma, u_int8_t *buf)
 			WMITLV_TAG_STRUC_wmi_per_chain_rssi_stats) &&
 		 ((rssi_event->tlv_header & 0x0000FFFF) ==
 			WMITLV_GET_STRUCT_TLVLEN(wmi_per_chain_rssi_stats))) {
-		WMA_LOGD("%s: num_rssi_stats %u", __func__,
-			rssi_event->num_per_chain_rssi_stats);
 		if (rssi_event->num_per_chain_rssi_stats > 0) {
 			temp += sizeof(*rssi_event);
 			for (i = 0; i < rssi_event->num_per_chain_rssi_stats;
@@ -3507,6 +3850,13 @@ static int wma_extscan_rsp_handler(tp_wma_handle wma, uint8_t *buf)
 	}
 
 	event = (wmi_extscan_start_stop_event_fixed_param *)buf;
+
+	if (event->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("%s: max vdev id's %d reached",
+			  __func__, event->vdev_id);
+		return -EINVAL;
+	}
+
 	vdev_id = event->vdev_id;
 	extscan_ind = vos_mem_malloc(sizeof(*extscan_ind));
 	if (!extscan_ind) {
@@ -3760,9 +4110,14 @@ static int wma_extscan_operations_event_handler(void *handle,
 		return -EINVAL;
 	}
 	event = param_buf->fixed_param;
+	if (event->num_buckets > param_buf->num_bucket_id) {
+		WMA_LOGE("FW mesg num_buk %d more than TLV hdr %d",
+			event->num_buckets,
+			param_buf->num_bucket_id);
+		return -EINVAL;
+	}
 	buf_len = sizeof(*buf);
 	buf = vos_mem_malloc(buf_len);
-
 	if (!buf) {
 		WMA_LOGE("%s: extscan memory allocation failed", __func__);
 		return -ENOMEM;
@@ -3902,6 +4257,8 @@ static int wma_extscan_capabilities_event_handler (void *handle,
 				event->num_epno_networks;
 	dest_capab->max_number_of_white_listed_ssid =
 				event->num_roam_ssid_whitelist;
+	dest_capab->max_number_of_black_listed_bssid =
+				event->num_roam_bssid_blacklist;
 	dest_capab->status = 0;
 
 	WMA_LOGD("%s: request_id: %u status: %d",
@@ -3922,11 +4279,13 @@ static int wma_extscan_capabilities_event_handler (void *handle,
 		dest_capab->max_significant_wifi_change_aps);
 	WMA_LOGD("%s: Capabilities: max_hotlist_ssids: %d,"
 		 "max_number_epno_networks: %d, max_number_epno_networks_by_ssid: %d,"
-		 "max_number_of_white_listed_ssid: %d",
+		 "max_number_of_white_listed_ssid: %d,"
+		 "max_number_of_black_listed_bssid: %d ",
 		 __func__, dest_capab->max_hotlist_ssids,
 		dest_capab->max_number_epno_networks,
 		dest_capab->max_number_epno_networks_by_ssid,
-		dest_capab->max_number_of_white_listed_ssid);
+		dest_capab->max_number_of_white_listed_ssid,
+		dest_capab->max_number_of_black_listed_bssid);
 
 	pMac->sme.pExtScanIndCb(pMac->hHdd,
 				eSIR_EXTSCAN_GET_CAPABILITIES_IND,
@@ -3945,8 +4304,9 @@ static int wma_extscan_hotlist_match_event_handler(void *handle,
 	struct extscan_hotlist_match  *dest_hotlist;
 	tSirWifiScanResult      *dest_ap;
 	wmi_extscan_wlan_descriptor    *src_hotlist;
-	int numap, j, ap_found = 0;
-
+	uint32_t numap;
+	int j, ap_found = 0;
+	uint32_t buf_len;
 	tpAniSirGlobal pMac = (tpAniSirGlobal )vos_get_context(
 					VOS_MODULE_ID_PE, wma->vos_context);
 	if (!pMac) {
@@ -3971,6 +4331,18 @@ static int wma_extscan_hotlist_match_event_handler(void *handle,
 		WMA_LOGE("%s: Hotlist AP's list invalid", __func__);
 		return -EINVAL;
 	}
+	if (numap > WMA_EXTSCAN_MAX_HOTLIST_ENTRIES) {
+		WMA_LOGE("%s: Total Entries %u greater than max",
+			  __func__, numap);
+		numap = WMA_EXTSCAN_MAX_HOTLIST_ENTRIES;
+	}
+	buf_len = sizeof(wmi_extscan_hotlist_match_event_fixed_param) +
+			WMI_TLV_HDR_SIZE +
+			(numap * sizeof(wmi_extscan_wlan_descriptor));
+	if (buf_len > len) {
+		WMA_LOGE("Invalid buf len from FW %d numap %d", len, numap);
+		return -EINVAL;
+	}
 	dest_hotlist = vos_mem_malloc(sizeof(*dest_hotlist) +
 					sizeof(*dest_ap) * numap);
 	if (!dest_hotlist) {
@@ -4006,6 +4378,11 @@ static int wma_extscan_hotlist_match_event_handler(void *handle,
 		dest_ap->ieLength = src_hotlist-> ie_length;
 		WMI_MAC_ADDR_TO_CHAR_ARRAY(&src_hotlist->bssid,
 						dest_ap->bssid);
+		if (src_hotlist->ssid.ssid_len > SIR_MAC_MAX_SSID_LENGTH) {
+			WMA_LOGE("%s Invalid SSID len %d, truncating",
+				__func__, src_hotlist->ssid.ssid_len);
+			src_hotlist->ssid.ssid_len = SIR_MAC_MAX_SSID_LENGTH;
+		}
 		vos_mem_copy(dest_ap->ssid, src_hotlist->ssid.ssid,
 					src_hotlist->ssid.ssid_len);
 		dest_ap->ssid[src_hotlist->ssid.ssid_len] = '\0';
@@ -4180,6 +4557,13 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info,
 			WMI_MAC_ADDR_TO_CHAR_ARRAY(&src_hotlist->bssid,
 						ap->bssid);
 
+			if (src_hotlist->ssid.ssid_len >
+			    SIR_MAC_MAX_SSID_LENGTH) {
+				WMA_LOGD("%s Invalid SSID len %d, truncating",
+					 __func__, src_hotlist->ssid.ssid_len);
+				src_hotlist->ssid.ssid_len =
+						SIR_MAC_MAX_SSID_LENGTH;
+			}
 			vos_mem_copy(ap->ssid, src_hotlist->ssid.ssid,
 					src_hotlist->ssid.ssid_len);
 			ap->ssid[src_hotlist->ssid.ssid_len] = '\0';
@@ -4205,6 +4589,8 @@ static int wma_extscan_cached_results_event_handler(void *handle,
 	wmi_extscan_rssi_info  *src_rssi;
 	int numap, i, moredata, scan_ids_cnt;
 	int buf_len;
+	u_int32_t total_len;
+	bool excess_data = false;
 
 	tpAniSirGlobal pMac = (tpAniSirGlobal )vos_get_context(
 					VOS_MODULE_ID_PE, wma->vos_context);
@@ -4253,6 +4639,43 @@ static int wma_extscan_cached_results_event_handler(void *handle,
 	WMA_LOGI("scan_ids_cnt %d", scan_ids_cnt);
 	dest_cachelist->num_scan_ids = scan_ids_cnt;
 
+	if (event->num_entries_in_page >
+		(WMA_SVC_MSG_MAX_SIZE - sizeof(*event))/sizeof(*src_hotlist)) {
+		WMA_LOGE("%s:excess num_entries_in_page %d in WMI event",
+				__func__, event->num_entries_in_page);
+		vos_mem_free(dest_cachelist);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	} else {
+		total_len = sizeof(*event) +
+			(event->num_entries_in_page * sizeof(*src_hotlist));
+	}
+	for (i = 0; i < event->num_entries_in_page; i++) {
+		if (src_hotlist[i].ie_length > WMA_SVC_MSG_MAX_SIZE -
+			total_len) {
+			excess_data = true;
+			break;
+		} else {
+			total_len += src_hotlist[i].ie_length;
+			WMA_LOGD("total len IE: %d", total_len);
+		}
+		if (src_hotlist[i].number_rssi_samples >
+			(WMA_SVC_MSG_MAX_SIZE - total_len)/sizeof(*src_rssi)) {
+			excess_data = true;
+			break;
+		} else {
+			total_len += (src_hotlist[i].number_rssi_samples *
+					sizeof(*src_rssi));
+			WMA_LOGD("total len RSSI samples: %d", total_len);
+		}
+	}
+	if (excess_data) {
+		WMA_LOGE("%s:excess data in WMI event", __func__);
+		vos_mem_free(dest_cachelist);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	}
+
 	buf_len = sizeof(*dest_result) * scan_ids_cnt;
 	dest_cachelist->result = vos_mem_malloc(buf_len);
 	if (!dest_cachelist->result) {
@@ -4305,6 +4728,8 @@ static int wma_extscan_change_results_event_handler(void *handle,
 	int count = 0;
 	int moredata;
 	int rssi_num = 0;
+	u_int32_t buf_len;
+	bool excess_data = false;
 	tpAniSirGlobal pMac = (tpAniSirGlobal )vos_get_context(
 					VOS_MODULE_ID_PE, wma->vos_context);
 	if (!pMac) {
@@ -4339,6 +4764,30 @@ static int wma_extscan_change_results_event_handler(void *handle,
 	else
 		moredata = 0;
 
+	do {
+		if (event->num_entries_in_page >
+			(WMA_SVC_MSG_MAX_SIZE - sizeof(*event))/
+			sizeof(*src_chglist)) {
+			excess_data = true;
+			break;
+		} else {
+			buf_len = sizeof(*event) +
+					(event->num_entries_in_page *
+					sizeof(*src_chglist));
+		}
+		if (rssi_num >
+			(WMA_SVC_MSG_MAX_SIZE - buf_len)/sizeof(int32_t)) {
+			excess_data = true;
+			break;
+		}
+	} while (0);
+
+	if (excess_data) {
+		WMA_LOGE("buffer len exceeds WMI payload,numap:%d, rssi_num:%d",
+				numap, rssi_num);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	}
 	dest_chglist = vos_mem_malloc(sizeof(*dest_chglist) +
 			sizeof(*dest_ap) * numap +
 			sizeof(tANI_S32) * rssi_num);
@@ -4415,6 +4864,21 @@ static int wma_passpoint_match_event_handler(void *handle,
 	event = param_buf->fixed_param;
 	buf_ptr = (uint8_t *)param_buf->fixed_param;
 
+	/*
+	 * All the below lengths are UINT32 and summing up and checking
+	 * against a constant should not be an issue.
+	 */
+	if ((sizeof(*event) + event->ie_length + event->anqp_length) >
+			WMA_SVC_MSG_MAX_SIZE) {
+		WMA_LOGE("IE Length: %d or ANQP Length: %d is huge",
+				event->ie_length, event->anqp_length);
+		return -EINVAL;
+	}
+	if (event->ssid.ssid_len > SIR_MAC_MAX_SSID_LENGTH) {
+		WMA_LOGD("%s: Invalid ssid len %d, truncating",
+			__func__, event->ssid.ssid_len);
+		event->ssid.ssid_len = SIR_MAC_MAX_SSID_LENGTH;
+	}
 	dest_match = vos_mem_malloc(sizeof(*dest_match) +
 				event->ie_length + event->anqp_length);
 	if (!dest_match) {
@@ -4454,102 +4918,6 @@ static int wma_passpoint_match_event_handler(void *handle,
 	return 0;
 }
 
-/**
- * wma_extscan_hotlist_ssid_match_event_handler() -
- *	Handler for SSID hotlist match event from firmware
- * @handle: WMA handle
- * @cmd_param_info: WMI command buffer
- * @len: length of @cmd_param_info
- *
- * Return: 0 on success, non-zero on failure
- */
-static int
-wma_extscan_hotlist_ssid_match_event_handler(void *handle,
-					     uint8_t *cmd_param_info,
-					     uint32_t len)
-{
-	tp_wma_handle wma = (tp_wma_handle) handle;
-	WMI_EXTSCAN_HOTLIST_SSID_MATCH_EVENTID_param_tlvs *param_buf;
-	wmi_extscan_hotlist_ssid_match_event_fixed_param  *event;
-	tSirWifiScanResultEvent  *dest_hotlist;
-	tSirWifiScanResult      *dest_ap;
-	wmi_extscan_wlan_descriptor    *src_hotlist;
-	int numap, j;
-	bool ssid_found = false;
-	tpAniSirGlobal mac =
-		vos_get_context(VOS_MODULE_ID_PE, wma->vos_context);
-
-	if (!mac) {
-		WMA_LOGE("%s: Invalid mac", __func__);
-		return -EINVAL;
-	}
-
-	if (!mac->sme.pExtScanIndCb) {
-		WMA_LOGE("%s: Callback not registered", __func__);
-		return -EINVAL;
-	}
-
-	param_buf = (WMI_EXTSCAN_HOTLIST_SSID_MATCH_EVENTID_param_tlvs *)
-					cmd_param_info;
-	if (!param_buf) {
-		WMA_LOGE("%s: Invalid hotlist match event", __func__);
-		return -EINVAL;
-	}
-
-	event = param_buf->fixed_param;
-	src_hotlist = param_buf->hotlist_ssid_match;
-	numap = event->total_entries;
-	if (!src_hotlist || !numap) {
-		WMA_LOGE("%s: Hotlist AP's list invalid", __func__);
-		return -EINVAL;
-	}
-
-	dest_hotlist = vos_mem_malloc(sizeof(*dest_hotlist) +
-					sizeof(*dest_ap) * numap);
-	if (!dest_hotlist) {
-		WMA_LOGE("%s: Allocation failed for hotlist buffer", __func__);
-		return -EINVAL;
-	}
-
-	dest_ap = &dest_hotlist->ap[0];
-	dest_hotlist->numOfAps = event->total_entries;
-	dest_hotlist->requestId = event->config_request_id;
-
-	if (event->first_entry_index +
-		event->num_entries_in_page < event->total_entries)
-		dest_hotlist->moreData = 1;
-	else
-		dest_hotlist->moreData = 0;
-
-	WMA_LOGD("%s: Hotlist match: requestId: %u, numOfAps: %d", __func__,
-		 dest_hotlist->requestId, dest_hotlist->numOfAps);
-
-	for (j = 0; j < numap; j++) {
-		dest_ap->channel = src_hotlist->channel;
-		dest_ap->ts = src_hotlist->tstamp;
-		ssid_found = src_hotlist->flags & WMI_HOTLIST_FLAG_PRESENCE;
-		dest_ap->rtt = src_hotlist->rtt;
-		dest_ap->rtt_sd = src_hotlist->rtt_sd;
-		dest_ap->beaconPeriod = src_hotlist->beacon_interval;
-		dest_ap->capability = src_hotlist->capabilities;
-		dest_ap->ieLength = src_hotlist-> ie_length;
-		WMI_MAC_ADDR_TO_CHAR_ARRAY(&src_hotlist->bssid,
-						dest_ap->bssid);
-		vos_mem_copy(dest_ap->ssid, src_hotlist->ssid.ssid,
-					src_hotlist->ssid.ssid_len);
-		dest_ap->ssid[src_hotlist->ssid.ssid_len] = '\0';
-		dest_ap++;
-		src_hotlist++;
-	}
-
-	dest_hotlist->ap_found = ssid_found;
-	mac->sme.pExtScanIndCb(mac->hHdd,
-			       eSIR_EXTSCAN_HOTLIST_SSID_MATCH_IND,
-			       dest_hotlist);
-	WMA_LOGD("%s: sending hotlist ssid match event", __func__);
-	vos_mem_free(dest_hotlist);
-	return 0;
-}
 #endif
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -4581,7 +4949,6 @@ static int wma_unified_link_iface_stats_event_handler(void *handle,
 		return -EINVAL;
 	}
 
-	WMA_LOGD("%s: Posting Iface Stats event to HDD", __func__);
 	param_tlvs = (WMI_IFACE_LINK_STATS_EVENTID_param_tlvs *)cmd_param_info;
 	if (!param_tlvs) {
 		WMA_LOGA("%s: Invalid stats event", __func__);
@@ -4602,6 +4969,11 @@ static int wma_unified_link_iface_stats_event_handler(void *handle,
 		WMA_LOGA("%s: Invalid param_tlvs for Iface Stats", __func__);
 		return -EINVAL;
 	}
+	if (link_stats->num_ac >= WIFI_AC_MAX) {
+		WMA_LOGE("%s: Excess data received from firmware num_ac %d",
+			__func__, link_stats->num_ac);
+		return -EINVAL;
+	}
 
 	link_stats_size = sizeof(tSirWifiIfaceStat);
 	iface_info_size = sizeof(tSirWifiInterfaceInfo);
@@ -4616,31 +4988,6 @@ static int wma_unified_link_iface_stats_event_handler(void *handle,
 		return -ENOMEM;
 	}
 
-	WMA_LOGD("Interface stats Fixed Param:");
-	WMA_LOGD("request_id %u vdev_id %u",
-		fixed_param->request_id,fixed_param->vdev_id);
-
-	WMA_LOGD("Iface Stats:");
-	WMA_LOGD("beacon_rx %u mgmt_rx %u mgmt_action_rx %u mgmt_action_tx %u "
-		 "rssi_mgmt %u rssi_data %u rssi_ack %u num_peers %u "
-		 "num_peer_events %u num_ac %u roam_state %u"
-		 " avg_bcn_spread_offset_high %u"
-		 " avg_bcn_spread_offset_low %u"
-		 " is leaky_ap %u"
-		 " avg_rx_frames_leaked %u"
-		 " rx_leak_window %u",
-		 link_stats->beacon_rx, link_stats->mgmt_rx,
-		 link_stats->mgmt_action_rx, link_stats->mgmt_action_tx,
-		 link_stats->rssi_mgmt, link_stats->rssi_data,
-		 link_stats->rssi_ack, link_stats->num_peers,
-		 link_stats->num_peer_events, link_stats->num_ac,
-		 link_stats->roam_state,
-		 link_stats->avg_bcn_spread_offset_high,
-		 link_stats->avg_bcn_spread_offset_low,
-		 link_stats->is_leaky_ap,
-		 link_stats->avg_rx_frms_leaked,
-		 link_stats->rx_leak_window);
-
 	vos_mem_zero(link_stats_results, link_stats_results_size);
 
 	link_stats_results->paramId            = WMI_LINK_STATS_IFACE;
@@ -4668,22 +5015,7 @@ static int wma_unified_link_iface_stats_event_handler(void *handle,
 	next_res_offset = link_stats_size - WIFI_AC_MAX * ac_stats_size;
 	next_ac_offset = WMI_TLV_HDR_SIZE;
 
-        WMA_LOGD("AC Stats:");
 	for (count = 0; count < link_stats->num_ac; count++) {
-		WMA_LOGD("ac_type %u tx_mpdu %u rx_mpdu %u tx_mcast %u "
-			"rx_mcast %u rx_ampdu %u tx_ampdu %u mpdu_lost %u "
-			"retries %u retries_short %u retries_long %u "
-			"contention_time_min %u contention_time_max %u "
-			"contention_time_avg %u contention_num_samples %u",
-			ac_stats->ac_type, ac_stats->tx_mpdu, ac_stats->rx_mpdu,
-			ac_stats->tx_mcast, ac_stats->rx_mcast,
-			ac_stats->rx_ampdu,ac_stats->tx_ampdu,
-			ac_stats->mpdu_lost, ac_stats->retries,
-			ac_stats->retries_short, ac_stats->retries_long,
-			ac_stats->contention_time_min,
-			ac_stats->contention_time_max,
-			ac_stats->contention_time_avg,
-			ac_stats->contention_num_samples);
 		ac_stats++;
 
 		vos_mem_copy(results + next_res_offset,
@@ -4700,7 +5032,6 @@ static int wma_unified_link_iface_stats_event_handler(void *handle,
 	pMac->sme.pLinkLayerStatsIndCallback(pMac->hHdd,
 		WDA_LINK_LAYER_STATS_RESULTS_RSP,
 		link_stats_results);
-	WMA_LOGD("%s: Iface Stats event posted to HDD", __func__);
 	vos_mem_free(link_stats_results);
 
 	return 0;
@@ -4716,10 +5047,13 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 	wmi_rate_stats *rate_stats;
 	tSirLLStatsResults *link_stats_results;
 	u_int8_t *results, *t_peer_stats, *t_rate_stats;
-	u_int32_t count, num_rates=0, rate_cnt;
+	u_int32_t count, rate_cnt;
+	uint32_t total_num_rates = 0;
 	u_int32_t next_res_offset, next_peer_offset, next_rate_offset;
 	size_t peer_info_size, peer_stats_size, rate_stats_size;
 	size_t link_stats_results_size;
+	bool excess_data = false;
+	u_int32_t buf_len;
 
 	tpAniSirGlobal pMac = (tpAniSirGlobal )vos_get_context(VOS_MODULE_ID_PE,
                                 wma_handle->vos_context);
@@ -4734,7 +5068,6 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 		return -EINVAL;
 	}
 
-	WMA_LOGD("%s: Posting Peer Stats event to HDD", __func__);
 	param_tlvs = (WMI_PEER_LINK_STATS_EVENTID_param_tlvs *)cmd_param_info;
 	if (!param_tlvs) {
 		WMA_LOGA("%s: Invalid stats event", __func__);
@@ -4744,8 +5077,8 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 	 * cmd_param_info contains
 	 * wmi_peer_stats_event_fixed_param fixed_param;
 	 * num_peers * size of(struct wmi_peer_link_stats)
-	 * num_rates * size of(struct wmi_rate_stats)
-	 * num_rates is the sum of the rates of all the peers.
+	 * total_num_rates * size of(struct wmi_rate_stats)
+	 * total_num_rates is the sum of the rates of all the peers.
 	 */
 	fixed_param = param_tlvs->fixed_param;
 	peer_stats  = param_tlvs->peer_stats;
@@ -4757,13 +5090,42 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 		return -EINVAL;
 	}
 
-	/*
-	 * num_rates - sum of the rates of all the peers
-	 */
-	temp_peer_stats = (wmi_peer_link_stats*)peer_stats;
-	for (count = 0; count < fixed_param->num_peers; count++) {
-		num_rates += temp_peer_stats->num_rates;
-		temp_peer_stats++;
+	do {
+		if (fixed_param->num_peers >
+			WMA_SVC_MSG_MAX_SIZE/sizeof(wmi_peer_link_stats)) {
+			excess_data = true;
+			break;
+		} else {
+			buf_len = fixed_param->num_peers *
+				sizeof(wmi_peer_link_stats);
+		}
+		temp_peer_stats = (wmi_peer_link_stats *) peer_stats;
+		for (count = 0; count < fixed_param->num_peers; count++) {
+			if (temp_peer_stats->num_rates >
+			    WMA_SVC_MSG_MAX_SIZE / sizeof(wmi_rate_stats)) {
+				excess_data = true;
+				break;
+			} else {
+				total_num_rates += temp_peer_stats->num_rates;
+				if (total_num_rates >
+				    WMA_SVC_MSG_MAX_SIZE /
+				    sizeof(wmi_rate_stats)) {
+					excess_data = true;
+					break;
+				}
+				buf_len += temp_peer_stats->num_rates *
+					sizeof(wmi_rate_stats);
+			}
+			temp_peer_stats++;
+		}
+	} while (0);
+
+	if (excess_data ||
+		(sizeof(*fixed_param) > WMA_SVC_MSG_MAX_SIZE - buf_len)) {
+		WMA_LOGE("excess wmi buffer: rates:%d, peers:%d",
+			peer_stats->num_rates, fixed_param->num_peers);
+		VOS_ASSERT(0);
+		return -EINVAL;
 	}
 
 	peer_stats_size = sizeof(tSirWifiPeerStat);
@@ -4771,7 +5133,7 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 	rate_stats_size = sizeof(tSirWifiRateStat);
 	link_stats_results_size = sizeof(*link_stats_results) + peer_stats_size +
 			(fixed_param->num_peers * peer_info_size) +
-			(num_rates * rate_stats_size);
+			(total_num_rates * rate_stats_size);
 
 	link_stats_results = vos_mem_malloc(link_stats_results_size);
 	if (NULL == link_stats_results ) {
@@ -4780,12 +5142,6 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 		return -ENOMEM;
 	}
 
-	WMA_LOGD("Peer stats from FW event buf");
-	WMA_LOGD("Fixed Param:");
-	WMA_LOGD("request_id %u num_peers %u peer_event_number %u more_data %u",
-			fixed_param->request_id, fixed_param->num_peers,
-			fixed_param->peer_event_number, fixed_param->more_data);
-
 	vos_mem_zero(link_stats_results, link_stats_results_size);
 
 	link_stats_results->paramId            = WMI_LINK_STATS_ALL_PEER;
@@ -4805,11 +5161,6 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 	next_peer_offset = WMI_TLV_HDR_SIZE;
 	next_rate_offset = WMI_TLV_HDR_SIZE;
 	for (rate_cnt = 0; rate_cnt < fixed_param->num_peers; rate_cnt++) {
-		WMA_LOGD("Peer Info:");
-		WMA_LOGD("peer_type %u capabilities %u num_rates %u",
-				peer_stats->peer_type, peer_stats->capabilities,
-				peer_stats->num_rates);
-
 		vos_mem_copy(results + next_res_offset,
 				t_peer_stats + next_peer_offset,
 				peer_info_size);
@@ -4817,14 +5168,6 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 
 		/* Copy rate stats associated with this peer */
 		for (count = 0; count < peer_stats->num_rates; count++) {
-			WMA_LOGD("Rate Stats Info:");
-			WMA_LOGD("rate %u bitrate %u tx_mpdu %u rx_mpdu %u "
-				"mpdu_lost %u retries %u retries_short %u "
-				"retries_long %u", rate_stats->rate,
-				rate_stats->bitrate, rate_stats->tx_mpdu,
-				rate_stats->rx_mpdu, rate_stats->mpdu_lost,
-				rate_stats->retries, rate_stats->retries_short,
-				rate_stats->retries_long);
 			rate_stats++;
 
 			vos_mem_copy(results + next_res_offset,
@@ -4844,7 +5187,6 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 	pMac->sme.pLinkLayerStatsIndCallback(pMac->hHdd,
 	        WDA_LINK_LAYER_STATS_RESULTS_RSP,
 	        link_stats_results);
-	WMA_LOGD("%s: Peer Stats event posted to HDD", __func__);
 	vos_mem_free(link_stats_results);
 
 	return 0;
@@ -4902,19 +5244,31 @@ static int wma_unified_radio_tx_power_level_stats_event_handler(void *handle,
 		return -EINVAL;
 	}
 
+	if (fixed_param->num_tx_power_levels > ((WMA_SVC_MSG_MAX_SIZE -
+	    sizeof(*fixed_param)) / sizeof(uint32_t))) {
+		WMA_LOGE("%s: excess tx_power buffers:%d", __func__,
+			fixed_param->num_tx_power_levels);
+		return -EINVAL;
+	}
+
 	rs_results = (tSirWifiRadioStat *) &link_stats_results->results[0];
 	tx_power_level_values = (uint8 *) param_tlvs->tx_time_per_power_level;
 
-	WMA_LOGD("%s: total_num_tx_power_levels: %u num_tx_power_levels: %u power_level_offset: %u",
-			__func__, fixed_param->total_num_tx_power_levels,
-			 fixed_param->num_tx_power_levels,
-			 fixed_param->power_level_offset);
-
 	rs_results->total_num_tx_power_levels =
 				fixed_param->total_num_tx_power_levels;
 	if (!rs_results->total_num_tx_power_levels)
 		goto post_stats;
-
+	if ((fixed_param->power_level_offset >
+	    rs_results->total_num_tx_power_levels) ||
+	    (fixed_param->num_tx_power_levels >
+	    rs_results->total_num_tx_power_levels -
+	    fixed_param->power_level_offset)) {
+		WMA_LOGE("%s: Invalid offset %d total_num %d num %d",
+			__func__, fixed_param->power_level_offset,
+			rs_results->total_num_tx_power_levels,
+			fixed_param->num_tx_power_levels);
+		return -EINVAL;
+	}
 	if (!rs_results->tx_time_per_power_level) {
 		rs_results->tx_time_per_power_level = vos_mem_malloc(
 				sizeof(uint32_t) *
@@ -4934,9 +5288,6 @@ static int wma_unified_radio_tx_power_level_stats_event_handler(void *handle,
 	   (fixed_param->num_tx_power_levels + fixed_param->power_level_offset))
 		link_stats_results->moreResultToFollow = 0;
 
-	WMA_LOGD("%s: moreResultToFollow: %u",
-			__func__, link_stats_results->moreResultToFollow);
-
 	/* If still data to receive, return from here */
 	if (link_stats_results->moreResultToFollow)
 		return 0;
@@ -4949,7 +5300,6 @@ post_stats:
 	pMac->sme.pLinkLayerStatsIndCallback(pMac->hHdd,
 	        WDA_LINK_LAYER_STATS_RESULTS_RSP,
 	        link_stats_results);
-	WMA_LOGD("%s: Radio Stats event posted to HDD", __func__);
 	vos_mem_free(rs_results->tx_time_per_power_level);
 	rs_results->tx_time_per_power_level = NULL;
 	vos_mem_free(wma_handle->link_stats_results);
@@ -5010,8 +5360,23 @@ static int wma_unified_link_radio_stats_event_handler(void *handle,
 		return -EINVAL;
 	}
 
+	if (radio_stats->num_channels >
+	    NUM_2_4GHZ_CHANNELS + NUM_5GHZ_CHANNELS) {
+		WMA_LOGE("%s: Too many channels %d",
+			 __func__, radio_stats->num_channels);
+		return -EINVAL;
+	}
+
 	radio_stats_size = sizeof(tSirWifiRadioStat);
 	chan_stats_size  = sizeof(tSirWifiChannelStats);
+
+	if (fixed_param->num_radio >
+	    (UINT_MAX - sizeof(*link_stats_results)) / radio_stats_size) {
+		WMA_LOGE("excess num_radio %d is leading to int overflow",
+			 fixed_param->num_radio);
+		return -EINVAL;
+	}
+
 	link_stats_results_size = sizeof(*link_stats_results) +
 			radio_stats_size +
 			(radio_stats->num_channels * chan_stats_size);
@@ -5023,22 +5388,6 @@ static int wma_unified_link_radio_stats_event_handler(void *handle,
 		return -ENOMEM;
 	}
 
-	WMA_LOGD("request_id %u num_radio %u more_radio_events %u",
-			fixed_param->request_id, fixed_param->num_radio,
-			fixed_param->more_radio_events);
-
-	WMA_LOGD("Radio Info: radio_id %u on_time %u tx_time %u rx_time %u on_time_scan %u "
-			"on_time_nbd %u on_time_gscan %u on_time_roam_scan %u "
-			"on_time_pno_scan %u on_time_hs20 %u num_channels %u",
-			radio_stats->radio_id, radio_stats->on_time,
-			radio_stats->tx_time, radio_stats->rx_time,
-			radio_stats->on_time_scan, radio_stats->on_time_nbd,
-			radio_stats->on_time_gscan,
-			radio_stats->on_time_roam_scan,
-			radio_stats->on_time_pno_scan,
-			radio_stats->on_time_hs20,
-			radio_stats->num_channels);
-
 	link_stats_results = wma_handle->link_stats_results;
 	vos_mem_zero(link_stats_results, link_stats_results_size);
 
@@ -5079,14 +5428,7 @@ static int wma_unified_link_radio_stats_event_handler(void *handle,
 
 	chn_results = (tSirWifiChannelStats *) &rs_results->channels[0];
 	next_chan_offset = WMI_TLV_HDR_SIZE;
-	WMA_LOGD("Channel Stats Info");
 	for (count = 0; count < radio_stats->num_channels; count++) {
-		WMA_LOGD("channel_width %u center_freq %u center_freq0 %u "
-			"center_freq1 %u radio_awake_time %u cca_busy_time %u",
-			channel_stats->channel_width, channel_stats->center_freq,
-			channel_stats->center_freq0, channel_stats->center_freq1,
-			channel_stats->radio_awake_time,
-			channel_stats->cca_busy_time);
 		channel_stats++;
 
 		vos_mem_copy(chn_results,
@@ -5105,55 +5447,1203 @@ static int wma_unified_link_radio_stats_event_handler(void *handle,
 	        WDA_LINK_LAYER_STATS_RESULTS_RSP,
 	        link_stats_results);
 	vos_mem_free(wma_handle->link_stats_results);
+	WMA_LOGD(FL("Radio Stats event posted to HDD"));
 	wma_handle->link_stats_results = NULL;
 
 	return 0;
 }
 
-#endif /* WLAN_FEATURE_LINK_LAYER_STATS */
+/**
+ * wma_peer_ps_evt_handler() - handler for PEER power state change.
+ * @handle: wma handle
+ * @event: FW event
+ * @len: length of FW event
+ *
+ * Once peer STA power state changes, an event will be indicated by
+ * FW. This function send a link layer state change msg to HDD. HDD
+ * link layer callback will converts the event to NL msg.
+ *
+ * Return: 0 Success. Others fail.
+ */
+static int wma_peer_ps_evt_handler(void *handle, u_int8_t *event,
+				   u_int32_t len)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle) handle;
+	WMI_PEER_STA_PS_STATECHG_EVENTID_param_tlvs *param_buf;
+	wmi_peer_sta_ps_statechange_event_fixed_param *fixed_param;
+	tSirWifiPeerStat *peer_stat;
+	tSirWifiPeerInfo *peer_info;
+	tSirLLStatsResults *link_stats_results;
+	tSirMacAddr mac_address;
+	uint32_t result_len;
+	tpAniSirGlobal mac;
+	vos_msg_t vos_msg;
+
+	mac = (tpAniSirGlobal)vos_get_context(VOS_MODULE_ID_PE,
+					      wma_handle->vos_context);
+	if (!mac) {
+		WMA_LOGD("%s: NULL mac ptr. Exiting", __func__);
+		return -EINVAL;
+	}
+
+	WMA_LOGD("%s: Posting Peer Stats PS event to HDD", __func__);
+
+	param_buf = (WMI_PEER_STA_PS_STATECHG_EVENTID_param_tlvs *)event;
+	fixed_param = param_buf->fixed_param;
+
+	result_len = sizeof(tSirLLStatsResults) +
+		     sizeof(tSirWifiPeerStat) +
+		     sizeof(tSirWifiPeerInfo);
+	link_stats_results = vos_mem_malloc(result_len);
+	if (link_stats_results == NULL) {
+		WMA_LOGE("%s: Cannot allocate link layer stats.", __func__);
+		return -EINVAL;
+	}
+	vos_mem_zero(link_stats_results, result_len);
+
+	WMI_MAC_ADDR_TO_CHAR_ARRAY(&fixed_param->peer_macaddr, &mac_address[0]);
+	WMA_LOGD("Peer power state change event from FW");
+	WMA_LOGD("Fixed Param:");
+	WMA_LOGD("MAC address: %2x:%2x:%2x:%2x:%2x:%2x, Power state: %d",
+		 mac_address[0], mac_address[1], mac_address[2],
+		 mac_address[3], mac_address[4], mac_address[5],
+		 fixed_param->peer_ps_state);
+
+	link_stats_results->paramId            = WMI_LL_STATS_EXT_PS_CHG;
+	link_stats_results->num_peers          = 1;
+	link_stats_results->peer_event_number  = 1;
+	link_stats_results->moreResultToFollow = 0;
+
+	peer_stat = (tSirWifiPeerStat *)link_stats_results->results;
+	peer_stat->numPeers = 1;
+	peer_info = (tSirWifiPeerInfo *)peer_stat->peerInfo;
+	vos_mem_copy(&peer_info->peerMacAddress,
+		     &mac_address, sizeof(tSirMacAddr));
+	peer_info->power_saving = fixed_param->peer_ps_state;
+
+	vos_msg.type = eWMI_SME_LL_STATS_IND;
+	vos_msg.bodyptr = (void *)link_stats_results;
+	vos_msg.bodyval = 0;
+	if (VOS_STATUS_SUCCESS !=
+			vos_mq_post_message(VOS_MQ_ID_SME, &vos_msg)) {
+		WMA_LOGP(FL("Failed to post peer stat change msg!"));
+		vos_mem_free(link_stats_results);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+#define WMA_FILL_TX_STATS(eve, msg)   do {\
+	(msg)->msdus = (eve)->tx_msdu_cnt;\
+	(msg)->mpdus = (eve)->tx_mpdu_cnt;\
+	(msg)->ppdus = (eve)->tx_ppdu_cnt;\
+	(msg)->bytes = (eve)->tx_bytes;\
+	(msg)->drops = (eve)->tx_msdu_drop_cnt;\
+	(msg)->drop_bytes = (eve)->tx_drop_bytes;\
+	(msg)->retries = (eve)->tx_mpdu_retry_cnt;\
+	(msg)->failed = (eve)->tx_mpdu_fail_cnt;\
+} while (0)
+
+#define WMA_FILL_RX_STATS(eve, msg)       do {\
+	(msg)->mpdus = (eve)->mac_rx_mpdu_cnt;\
+	(msg)->bytes = (eve)->mac_rx_bytes;\
+	(msg)->ppdus = (eve)->phy_rx_ppdu_cnt;\
+	(msg)->ppdu_bytes = (eve)->phy_rx_bytes;\
+	(msg)->mpdu_retry = (eve)->rx_mpdu_retry_cnt;\
+	(msg)->mpdu_dup = (eve)->rx_mpdu_dup_cnt;\
+	(msg)->mpdu_discard = (eve)->rx_mpdu_discard_cnt;\
+} while (0)
 
 /**
- * wma_fw_mem_dump_event_handler() - handles fw memory dump event
+ * __wma_get_ll_stats_ext_buf() - alloc result buffer for MAC counters
+ * @len: buffer length output
+ * @peer_num: peer number
+ * @fixed_param: fixed parameters in WMI event
  *
- * handle - pointer to wma handle.
- * cmd_param_info - pointer to TLV info received in the event.
- * len - length of data in @cmd_param_info
+ * Structure of the stats message
+ * LL_EXT_STATS
+ *  |
+ *  |--Channel stats[1~n]
+ *  |--Peer[1~n]
+ *      |
+ *      +---Signal
+ *      +---TX
+ *      |    +---BE
+ *      |    +---BK
+ *      |    +---VI
+ *      |    +---VO
+ *      |
+ *      +---RX
+ *           +---BE
+ *           +---BK
+ *           +---VI
+ *           +---VO
+ * For each Access Category, the arregation and mcs
+ * stats are as this:
+ *  TX
+ *   +-BE/BK/VI/VO
+ *         +----tx_mpdu_aggr_array
+ *         +----tx_succ_mcs_array
+ *         +----tx_fail_mcs_array
+ *         +----tx_delay_array
+ *  RX
+ *   +-BE/BK/VI/VO
+ *         +----rx_mpdu_aggr_array
+ *         +----rx_mcs_array
  *
- * This function is a handler for firmware memory dump event.
+ * return: Address for result buffer.
  */
-#ifdef WLAN_FEATURE_MEMDUMP
-static int wma_fw_mem_dump_event_handler(void *handle, u_int8_t *cmd_param_info,
-					 u_int32_t len)
+static tSirLLStatsResults *__wma_get_ll_stats_ext_buf(uint32_t *len,
+						      uint32_t peer_num,
+			wmi_report_stats_event_fixed_param *fixed_param)
 {
-	WMI_UPDATE_FW_MEM_DUMP_EVENTID_param_tlvs *param_buf;
-	wmi_update_fw_mem_dump_fixed_param *event;
-	VOS_STATUS status;
+	tSirLLStatsResults *buf;
+	uint32_t buf_len;
+	uint32_t total_array_len, total_peer_len;
+	bool excess_data = false;
 
-	param_buf =
-	    (WMI_UPDATE_FW_MEM_DUMP_EVENTID_param_tlvs *) cmd_param_info;
-	if (!param_buf) {
-		WMA_LOGA("%s: Invalid stats event", __func__);
+	if (!len || !fixed_param) {
+		WMA_LOGE(FL("Invalid input parameters."));
+		return NULL;
+	}
+
+	/*
+	 * Result buffer has a structure like this:
+	 *     ---------------------------------
+	 *     |      trigger_cond_i           |
+	 *     +-------------------------------+
+	 *     |      cca_chgd_bitmap          |
+	 *     +-------------------------------+
+	 *     |      sig_chgd_bitmap          |
+	 *     +-------------------------------+
+	 *     |      tx_chgd_bitmap           |
+	 *     +-------------------------------+
+	 *     |      rx_chgd_bitmap           |
+	 *     +-------------------------------+
+	 *     |      peer_num                 |
+	 *     +-------------------------------+
+	 *     |      channel_num              |
+	 *     +-------------------------------+
+	 *     |      time stamp               |
+	 *     +-------------------------------+
+	 *     |      tx_mpdu_aggr_array_len   |
+	 *     +-------------------------------+
+	 *     |      tx_succ_mcs_array_len    |
+	 *     +-------------------------------+
+	 *     |      tx_fail_mcs_array_len    |
+	 *     +-------------------------------+
+	 *     |      tx_delay_array_len       |
+	 *     +-------------------------------+
+	 *     |      rx_mpdu_aggr_array_len   |
+	 *     +-------------------------------+
+	 *     |      rx_mcs_array_len         |
+	 *     +-------------------------------+
+	 *     |      pointer to CCA stats     |
+	 *     +-------------------------------+
+	 *     |      CCA stats                |
+	 *     +-------------------------------+
+	 *     |      peer_stats               |----+
+	 *     +-------------------------------+    |
+	 *     | TX aggr/mcs parameters array  |    |
+	 *     | Length of this buffer is      |    |
+	 *     | not fixed.                    |<-+ |
+	 *     +-------------------------------+  | |
+	 *     |      per peer tx stats        |--+ |
+	 *     |         BE                    | <--+
+	 *     |         BK                    |    |
+	 *     |         VI                    |    |
+	 *     |         VO                    |    |
+	 *     +-------------------------------+    |
+	 *     | TX aggr/mcs parameters array  |    |
+	 *     | Length of this buffer is      |    |
+	 *     | not fixed.                    |<-+ |
+	 *     +-------------------------------+  | |
+	 *     |      peer peer rx stats       |--+ |
+	 *     |         BE                    | <--+
+	 *     |         BK                    |
+	 *     |         VI                    |
+	 *     |         VO                    |
+	 *     ---------------------------------
+	 */
+	buf_len = sizeof(tSirLLStatsResults) +
+			sizeof(struct sir_wifi_ll_ext_stats);
+
+	do {
+		if (fixed_param->num_chan_cca_stats > (WMA_SVC_MSG_MAX_SIZE /
+		    sizeof(struct sir_wifi_chan_cca_stats))) {
+			excess_data = true;
+			break;
+		}
+		buf_len += (fixed_param->num_chan_cca_stats *
+				sizeof(struct sir_wifi_chan_cca_stats));
+		if (fixed_param->tx_mpdu_aggr_array_len >
+		    WMA_SVC_MSG_MAX_SIZE) {
+			excess_data = true;
+			break;
+		} else {
+			total_array_len = fixed_param->tx_mpdu_aggr_array_len;
+		}
+		if (fixed_param->tx_succ_mcs_array_len >
+		    (WMA_SVC_MSG_MAX_SIZE - total_array_len)) {
+			excess_data = true;
+			break;
+		} else {
+			total_array_len += fixed_param->tx_succ_mcs_array_len;
+		}
+		if (fixed_param->tx_fail_mcs_array_len >
+		    (WMA_SVC_MSG_MAX_SIZE - total_array_len)) {
+			excess_data = true;
+			break;
+		} else {
+			total_array_len += fixed_param->tx_fail_mcs_array_len;
+		}
+		if (fixed_param->tx_ppdu_delay_array_len >
+		    (WMA_SVC_MSG_MAX_SIZE - total_array_len)) {
+			excess_data = true;
+			break;
+		} else {
+			total_array_len += fixed_param->tx_ppdu_delay_array_len;
+		}
+		if (fixed_param->rx_mpdu_aggr_array_len >
+		    (WMA_SVC_MSG_MAX_SIZE - total_array_len)) {
+			excess_data = true;
+			break;
+		} else {
+			total_array_len += fixed_param->rx_mpdu_aggr_array_len;
+		}
+		if (fixed_param->rx_mcs_array_len >
+		    (WMA_SVC_MSG_MAX_SIZE - total_array_len)) {
+			excess_data = true;
+			break;
+		} else {
+			total_array_len += fixed_param->rx_mcs_array_len;
+		}
+
+		if (total_array_len > (WMA_SVC_MSG_MAX_SIZE /
+		    (sizeof(uint16_t) * WLAN_MAX_AC))) {
+			excess_data = true;
+			break;
+		} else {
+			total_peer_len = (sizeof(uint32_t) * WLAN_MAX_AC *
+						total_array_len) +
+						(WLAN_MAX_AC *
+						(sizeof(struct sir_wifi_tx) +
+						sizeof(struct sir_wifi_rx)));
+		}
+		buf_len += peer_num *
+			   (sizeof(struct sir_wifi_ll_ext_peer_stats) +
+			   total_peer_len);
+	} while (0);
+
+	if (excess_data) {
+		WMA_LOGE("%s: excess wmi buffer: peer %d cca %d tx_mpdu %d ",
+			 __func__, peer_num, fixed_param->num_chan_cca_stats,
+			 fixed_param->tx_mpdu_aggr_array_len);
+		WMA_LOGE("tx_succ %d tx_fail %d tx_ppdu %d ",
+			 fixed_param->tx_succ_mcs_array_len,
+			 fixed_param->tx_fail_mcs_array_len,
+			 fixed_param->tx_ppdu_delay_array_len);
+		WMA_LOGE("rx_mpdu %d rx_mcs %d",
+			 fixed_param->rx_mpdu_aggr_array_len,
+			 fixed_param->rx_mcs_array_len);
+		return NULL;
+	}
+
+	buf = (tSirLLStatsResults *)vos_mem_malloc(buf_len);
+	if (buf == NULL) {
+		WMA_LOGE("%s: Cannot allocate link layer stats.", __func__);
+		buf_len = 0;
+		return NULL;
+	}
+
+	vos_mem_zero(buf, buf_len);
+	*len = buf_len;
+	return buf;
+}
+
+/**
+ * __wma_fill_tx_stats() - Fix TX stats into result buffer
+ * @ll_stats: LL stats buffer
+ * @fix_param: parameters with fixed length in WMI event
+ * @param_buf: parameters without fixed length in WMI event
+ * @buf: buffer for TLV parameters
+ */
+static void __wma_fill_tx_stats(struct sir_wifi_ll_ext_stats *ll_stats,
+				wmi_report_stats_event_fixed_param *fix_param,
+				WMI_REPORT_STATS_EVENTID_param_tlvs *param_buf,
+				uint8_t **buf,
+				uint32_t *buf_length)
+{
+	uint8_t *result;
+	uint32_t i, j, k;
+	wmi_peer_ac_tx_stats *wmi_peer_tx;
+	wmi_tx_stats *wmi_tx;
+	struct sir_wifi_tx *tx_stats;
+	struct sir_wifi_ll_ext_peer_stats *peer_stats;
+	uint8_t *counter;
+	uint32_t *tx_mpdu_aggr, *tx_succ_mcs, *tx_fail_mcs, *tx_delay;
+	uint32_t len, dst_len, tx_mpdu_aggr_array_len, tx_succ_mcs_array_len,
+		 tx_fail_mcs_array_len, tx_delay_array_len;
+
+	result = *buf;
+	dst_len = *buf_length;
+	tx_mpdu_aggr_array_len = fix_param->tx_mpdu_aggr_array_len;
+	ll_stats->tx_mpdu_aggr_array_len = tx_mpdu_aggr_array_len;
+	tx_succ_mcs_array_len = fix_param->tx_succ_mcs_array_len;
+	ll_stats->tx_succ_mcs_array_len = tx_succ_mcs_array_len;
+	tx_fail_mcs_array_len = fix_param->tx_fail_mcs_array_len;
+	ll_stats->tx_fail_mcs_array_len = tx_fail_mcs_array_len;
+	tx_delay_array_len = fix_param->tx_ppdu_delay_array_len;
+	ll_stats->tx_delay_array_len = tx_delay_array_len;
+	wmi_peer_tx = param_buf->peer_ac_tx_stats;
+	wmi_tx = param_buf->tx_stats;
+
+	len = fix_param->num_peer_ac_tx_stats *
+		WLAN_MAX_AC * tx_mpdu_aggr_array_len;
+	if (len * sizeof(uint32_t) <= dst_len) {
+		tx_mpdu_aggr = (uint32_t *)result;
+		counter = (uint8_t *)param_buf->tx_mpdu_aggr;
+		for (i = 0; i < len; i++) {
+			result[4 * i] = counter[2 * i];
+			result[4 * i + 1] = counter[2 * i + 1];
+		}
+		result += len * sizeof(uint32_t);
+		dst_len -= len * sizeof(uint32_t);
+	} else {
+		WMA_LOGE(FL("TX_MPDU_AGGR buffer length is wrong."));
+		tx_mpdu_aggr = NULL;
+	}
+
+	len = fix_param->num_peer_ac_tx_stats * WLAN_MAX_AC *
+		tx_succ_mcs_array_len;
+	if (len * sizeof(uint32_t) <= dst_len) {
+		tx_succ_mcs = (uint32_t *)result;
+		counter = (uint8_t *)param_buf->tx_succ_mcs;
+		for (i = 0; i < len; i++) {
+			result[4 * i] = counter[2 * i];
+			result[4 * i + 1] = counter[2 * i + 1];
+		}
+		len *= sizeof(uint32_t);
+		result += len;
+		dst_len -= len;
+	} else {
+		WMA_LOGE(FL("TX_SUCC_MCS buffer length is wrong."));
+		tx_succ_mcs = NULL;
+	}
+
+	len = fix_param->num_peer_ac_tx_stats * WLAN_MAX_AC *
+		tx_fail_mcs_array_len;
+	if (len * sizeof(uint32_t) <= dst_len) {
+		tx_fail_mcs = (uint32_t *)result;
+		counter = (uint8_t *)param_buf->tx_fail_mcs;
+		for (i = 0; i < len; i++) {
+			result[4 * i] = counter[2 * i];
+			result[4 * i + 1] = counter[2 * i + 1];
+		}
+		len *= sizeof(uint32_t);
+		result += len;
+		dst_len -= len;
+	} else {
+		WMA_LOGE(FL("TX_FAIL_MCS buffer length is wrong."));
+		tx_fail_mcs = NULL;
+	}
+
+	len = fix_param->num_peer_ac_tx_stats *
+		WLAN_MAX_AC * tx_delay_array_len;
+	if (len * sizeof(uint32_t) <= dst_len) {
+		tx_delay = (uint32_t *)result;
+		counter = (uint8_t *)param_buf->tx_ppdu_delay;
+		for (i = 0; i < len; i++) {
+			result[4 * i] = counter[2 * i];
+			result[4 * i + 1] = counter[2 * i + 1];
+		}
+		len *= sizeof(uint32_t);
+		result += len;
+		dst_len -= len;
+	} else {
+		WMA_LOGE(FL("TX_DELAY buffer length is wrong."));
+		tx_delay = NULL;
+	}
+
+	/* per peer tx stats */
+	peer_stats = ll_stats->peer_stats;
+
+	for (i = 0; i < fix_param->num_peer_ac_tx_stats; i++) {
+		uint32_t peer_id = wmi_peer_tx[i].peer_id;
+		struct sir_wifi_tx *ac;
+		wmi_tx_stats *wmi_tx_stats;
+
+		for (j = 0; j < ll_stats->peer_num; j++) {
+			peer_stats += j;
+			if (peer_stats->peer_id == WIFI_INVALID_PEER_ID ||
+			    peer_stats->peer_id == peer_id)
+				break;
+		}
+
+		if (j < ll_stats->peer_num) {
+			peer_stats->peer_id = wmi_peer_tx[i].peer_id;
+			peer_stats->vdev_id = wmi_peer_tx[i].vdev_id;
+			tx_stats = (struct sir_wifi_tx *)result;
+			for (k = 0; k < WLAN_MAX_AC; k++) {
+				wmi_tx_stats = &wmi_tx[i * WLAN_MAX_AC + k];
+				ac = &tx_stats[k];
+				WMA_FILL_TX_STATS(wmi_tx_stats, ac);
+				ac->mpdu_aggr_size = tx_mpdu_aggr;
+				ac->aggr_len = tx_mpdu_aggr_array_len *
+							sizeof(uint32_t);
+				ac->success_mcs_len = tx_succ_mcs_array_len *
+							sizeof(uint32_t);
+				ac->success_mcs = tx_succ_mcs;
+				ac->fail_mcs = tx_fail_mcs;
+				ac->fail_mcs_len = tx_fail_mcs_array_len *
+							sizeof(uint32_t);
+				ac->delay = tx_delay;
+				ac->delay_len = tx_delay_array_len *
+							sizeof(uint32_t);
+				peer_stats->ac_stats[k].tx_stats = ac;
+				peer_stats->ac_stats[k].type = k;
+				tx_mpdu_aggr += tx_mpdu_aggr_array_len;
+				tx_succ_mcs += tx_succ_mcs_array_len;
+				tx_fail_mcs += tx_fail_mcs_array_len;
+				tx_delay += tx_delay_array_len;
+			}
+			result += WLAN_MAX_AC * sizeof(struct sir_wifi_tx);
+		} else {
+			/*
+			 * Buffer for Peer TX counter overflow.
+			 * There is peer ID mismatch between TX, RX,
+			 * signal counters.
+			 */
+			WMA_LOGE(FL("One peer TX info is dropped."));
+
+			tx_mpdu_aggr += tx_mpdu_aggr_array_len * WLAN_MAX_AC;
+			tx_succ_mcs += tx_succ_mcs_array_len * WLAN_MAX_AC;
+			tx_fail_mcs += tx_fail_mcs_array_len * WLAN_MAX_AC;
+			tx_delay += tx_delay_array_len * WLAN_MAX_AC;
+		}
+	}
+	*buf = result;
+	*buf_length = dst_len;
+}
+
+/**
+ * __wma_fill_rx_stats() - Fix RX stats into result buffer
+ * @ll_stats: LL stats buffer
+ * @fix_param: parameters with fixed length in WMI event
+ * @param_buf: parameters without fixed length in WMI event
+ * @buf: buffer for TLV parameters
+ */
+static void __wma_fill_rx_stats(struct sir_wifi_ll_ext_stats *ll_stats,
+				wmi_report_stats_event_fixed_param *fix_param,
+				WMI_REPORT_STATS_EVENTID_param_tlvs *param_buf,
+				uint8_t **buf,
+				uint32_t *buf_length)
+{
+	uint8 *result;
+	uint32_t i, j, k;
+	uint32_t *rx_mpdu_aggr, *rx_mcs;
+	wmi_rx_stats *wmi_rx;
+	wmi_peer_ac_rx_stats *wmi_peer_rx;
+	struct sir_wifi_rx *rx_stats;
+	struct sir_wifi_ll_ext_peer_stats *peer_stats;
+	uint32_t len, dst_len, rx_mpdu_aggr_array_len, rx_mcs_array_len;
+	uint8_t *counter;
+
+	rx_mpdu_aggr_array_len = fix_param->rx_mpdu_aggr_array_len;
+	ll_stats->rx_mpdu_aggr_array_len = rx_mpdu_aggr_array_len;
+	rx_mcs_array_len = fix_param->rx_mcs_array_len;
+	ll_stats->rx_mcs_array_len = rx_mcs_array_len;
+	wmi_peer_rx = param_buf->peer_ac_rx_stats;
+	wmi_rx = param_buf->rx_stats;
+
+	result = *buf;
+	dst_len = *buf_length;
+	len = fix_param->num_peer_ac_rx_stats *
+		  WLAN_MAX_AC * rx_mpdu_aggr_array_len;
+	if (len * sizeof(uint32_t) <= dst_len) {
+		rx_mpdu_aggr = (uint32_t *)result;
+		counter = (uint8_t *)param_buf->rx_mpdu_aggr;
+		for (i = 0; i < len; i++) {
+			result[4 * i] = counter[2 * i];
+			result[4 * i + 1] = counter[2 * i + 1];
+		}
+		len *= sizeof(uint32_t);
+		result += len;
+		dst_len -= len;
+	} else {
+		WMA_LOGE(FL("RX_MPDU_AGGR array length is wrong."));
+		rx_mpdu_aggr = NULL;
+	}
+
+	len = fix_param->num_peer_ac_rx_stats *
+		  WLAN_MAX_AC * rx_mcs_array_len;
+	if (len * sizeof(uint32_t) <= dst_len) {
+		rx_mcs = (uint32_t *)result;
+		counter = (uint8_t *)param_buf->rx_mcs;
+		for (i = 0; i < len; i++) {
+			result[4 * i] = counter[2 * i];
+			result[4 * i + 1] = counter[2 * i + 1];
+		}
+		len *= sizeof(uint32_t);
+		result += len;
+		dst_len -= len;
+	} else {
+		WMA_LOGE(FL("RX_MCS array length is wrong."));
+		rx_mcs = NULL;
+	}
+
+	/* per peer rx stats */
+	peer_stats = ll_stats->peer_stats;
+	for (i = 0; i < fix_param->num_peer_ac_rx_stats; i++) {
+		uint32_t peer_id = wmi_peer_rx[i].peer_id;
+		struct sir_wifi_rx *ac;
+		wmi_rx_stats *wmi_rx_stats;
+
+		for (j = 0; j < ll_stats->peer_num; j++) {
+			peer_stats += j;
+			if ((peer_stats->peer_id == WIFI_INVALID_PEER_ID) ||
+			    (peer_stats->peer_id == peer_id))
+				break;
+		}
+
+		if (j < ll_stats->peer_num) {
+			peer_stats->peer_id = wmi_peer_rx[i].peer_id;
+			peer_stats->vdev_id = wmi_peer_rx[i].vdev_id;
+			peer_stats->sta_ps_inds = wmi_peer_rx[i].sta_ps_inds;
+			peer_stats->sta_ps_durs = wmi_peer_rx[i].sta_ps_durs;
+			peer_stats->rx_probe_reqs =
+						wmi_peer_rx[i].rx_probe_reqs;
+			peer_stats->rx_oth_mgmts = wmi_peer_rx[i].rx_oth_mgmts;
+			rx_stats = (struct sir_wifi_rx *)result;
+
+			for (k = 0; k < WLAN_MAX_AC; k++) {
+				wmi_rx_stats = &wmi_rx[i * WLAN_MAX_AC + k];
+				ac = &rx_stats[k];
+				WMA_FILL_RX_STATS(wmi_rx_stats, ac);
+				ac->mpdu_aggr = rx_mpdu_aggr;
+				ac->aggr_len = rx_mpdu_aggr_array_len *
+							sizeof(uint32_t);
+				ac->mcs = rx_mcs;
+				ac->mcs_len = rx_mcs_array_len *
+							sizeof(uint32_t);
+				peer_stats->ac_stats[k].rx_stats = ac;
+				peer_stats->ac_stats[k].type = k;
+				rx_mpdu_aggr += rx_mpdu_aggr_array_len;
+				rx_mcs += rx_mcs_array_len;
+			}
+			result += WLAN_MAX_AC * sizeof(struct sir_wifi_rx);
+		} else {
+			/*
+			 * Buffer for Peer RX counter overflow.
+			 * There is peer ID mismatch between TX, RX,
+			 * signal counters.
+			 */
+			WMA_LOGE(FL("One peer RX info is dropped."));
+			rx_mpdu_aggr += rx_mpdu_aggr_array_len * WLAN_MAX_AC;
+			rx_mcs += rx_mcs_array_len * WLAN_MAX_AC;
+		}
+	}
+	*buf = result;
+	*buf_length = dst_len;
+}
+
+/**
+ * __wma_ll_stats_time_stamp() - log indication timestamp and counting duration
+ * @period - counting period on FW side
+ * @time_stamp - time stamp for user layer
+ *
+ * return: none
+ */
+static void __wma_ll_stats_time_stamp(wmi_stats_period *period,
+				      struct sir_wifi_ll_ext_period *time_stamp)
+{
+	time_stamp->end_time = vos_timer_get_system_time();
+	if (!period) {
+		WMA_LOGE(FL("Period buf is null."));
+		time_stamp->duration = 0;
+		return;
+	}
+	WMA_LOGD(FL("On fw side, start time is %d, start count is %d "),
+		 period->start_low_freq_msec, period->start_low_freq_count);
+	time_stamp->duration = period->end_low_freq_msec -
+				period->start_low_freq_msec;
+}
+
+/**
+ * wma_ll_stats_evt_handler() - handler for MAC layer counters.
+ * @handle - wma handle
+ * @event - FW event
+ * @len - length of FW event
+ *
+ * return: 0 success.
+ */
+static int wma_ll_stats_evt_handler(void *handle, u_int8_t *event,
+				    u_int32_t len)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle) handle;
+	WMI_REPORT_STATS_EVENTID_param_tlvs *param_buf;
+	wmi_report_stats_event_fixed_param *fixed_param;
+	tSirLLStatsResults *link_stats_results;
+	wmi_chan_cca_stats *wmi_cca_stats;
+	wmi_peer_signal_stats *wmi_peer_signal;
+	wmi_peer_ac_rx_stats *wmi_peer_rx;
+	struct sir_wifi_ll_ext_stats *ll_stats;
+	struct sir_wifi_ll_ext_peer_stats *peer_stats;
+	struct sir_wifi_chan_cca_stats *cca_stats;
+	struct sir_wifi_peer_signal_stats *peer_signal;
+	uint8_t *result;
+	uint32_t i, peer_num, result_size, dst_len;
+	tpAniSirGlobal mac;
+	vos_msg_t vos_msg;
+	struct ol_txrx_peer_t *peer;
+	ol_txrx_pdev_handle pdev;
+	wmi_stats_period *period;
+
+	mac = (tpAniSirGlobal)vos_get_context(VOS_MODULE_ID_PE,
+					      wma_handle->vos_context);
+	if (!mac) {
+		WMA_LOGD("%s: NULL mac ptr. Exiting", __func__);
 		return -EINVAL;
 	}
 
-	event = param_buf->fixed_param;
+	if (!mac->sme.link_layer_stats_ext_cb) {
+		WMA_LOGD("%s: HDD callback is null", __func__);
+		return -EINVAL;
+	}
 
-	status = wma_fw_mem_dump_rsp(event->request_id,
-					 event->fw_mem_dump_complete);
-	if (VOS_STATUS_SUCCESS != status) {
+	pdev = vos_get_context(VOS_MODULE_ID_TXRX, wma_handle->vos_context);
+	if (!pdev) {
+		WMA_LOGD("%s: NULL ol_txrx pdev ptr. Exiting", __func__);
+		return -EINVAL;
+	}
+
+	WMA_LOGD("%s: Posting MAC counters event to HDD", __func__);
+
+	param_buf = (WMI_REPORT_STATS_EVENTID_param_tlvs *)event;
+	fixed_param = param_buf->fixed_param;
+	wmi_cca_stats = param_buf->chan_cca_stats;
+	wmi_peer_signal = param_buf->peer_signal_stats;
+	wmi_peer_rx = param_buf->peer_ac_rx_stats;
+	period = param_buf->stats_period;
+	WMA_LOGD("%s: stats period length is %d. ", __func__,
+		 fixed_param->stats_period_array_len);
+
+	/* Get the MAX of three peer numbers */
+	peer_num = fixed_param->num_peer_signal_stats >
+			fixed_param->num_peer_ac_tx_stats ?
+			fixed_param->num_peer_signal_stats :
+			fixed_param->num_peer_ac_tx_stats;
+	peer_num = peer_num > fixed_param->num_peer_ac_rx_stats ?
+			peer_num : fixed_param->num_peer_ac_rx_stats;
+
+	if (peer_num == 0)
+		return -EINVAL;
+
+	link_stats_results = __wma_get_ll_stats_ext_buf(&result_size,
+							peer_num,
+							fixed_param);
+	if (!link_stats_results) {
+		WMA_LOGE("%s: Fail to allocate stats buffer", __func__);
+		return -EINVAL;
+	}
+	link_stats_results->paramId = WMI_LL_STATS_EXT_MAC_COUNTER;
+	link_stats_results->num_peers = peer_num;
+	link_stats_results->peer_event_number = 1;
+	link_stats_results->moreResultToFollow = 0;
+
+	ll_stats = (struct sir_wifi_ll_ext_stats *)link_stats_results->results;
+	ll_stats->trigger_cond_id = fixed_param->trigger_cond_id;
+	ll_stats->cca_chgd_bitmap = fixed_param->cca_chgd_bitmap;
+	ll_stats->sig_chgd_bitmap = fixed_param->sig_chgd_bitmap;
+	ll_stats->tx_chgd_bitmap = fixed_param->tx_chgd_bitmap;
+	ll_stats->rx_chgd_bitmap = fixed_param->rx_chgd_bitmap;
+	ll_stats->channel_num = fixed_param->num_chan_cca_stats;
+	ll_stats->peer_num = peer_num;
+
+	__wma_ll_stats_time_stamp(period, &ll_stats->time_stamp);
+	result = (uint8_t *)ll_stats->stats;
+	peer_stats = (struct sir_wifi_ll_ext_peer_stats *)result;
+	ll_stats->peer_stats = peer_stats;
+
+	for (i = 0; i < peer_num; i++) {
+		peer_stats[i].peer_id = WIFI_INVALID_PEER_ID;
+		peer_stats[i].vdev_id = WIFI_INVALID_VDEV_ID;
+	}
+
+	/* Per peer signal */
+	result_size -= sizeof(struct sir_wifi_ll_ext_stats);
+	dst_len = sizeof(struct sir_wifi_peer_signal_stats);
+	for (i = 0; i < fixed_param->num_peer_signal_stats; i++) {
+		peer_stats[i].peer_id = wmi_peer_signal->peer_id;
+		peer_stats[i].vdev_id = wmi_peer_signal->vdev_id;
+		peer_signal = &peer_stats[i].peer_signal_stats;
+
+		WMA_LOGI("%d antennas for peer %d",
+			 wmi_peer_signal->num_chains_valid,
+			 wmi_peer_signal->peer_id);
+		if (dst_len <= result_size) {
+			peer_signal->vdev_id = wmi_peer_signal->vdev_id;
+			peer_signal->peer_id = wmi_peer_signal->peer_id;
+			peer_signal->num_chain =
+					wmi_peer_signal->num_chains_valid;
+			vos_mem_copy(peer_signal->per_ant_snr,
+				     wmi_peer_signal->per_chain_snr,
+				     sizeof(peer_signal->per_ant_snr));
+			vos_mem_copy(peer_signal->nf,
+				     wmi_peer_signal->per_chain_nf,
+				     sizeof(peer_signal->nf));
+			vos_mem_copy(peer_signal->per_ant_rx_mpdus,
+				     wmi_peer_signal->per_antenna_rx_mpdus,
+				     sizeof(peer_signal->per_ant_rx_mpdus));
+			vos_mem_copy(peer_signal->per_ant_tx_mpdus,
+				     wmi_peer_signal->per_antenna_tx_mpdus,
+				     sizeof(peer_signal->per_ant_tx_mpdus));
+			result_size -= dst_len;
+		} else {
+			WMA_LOGE(FL("Invalid length of PEER signal."));
+		}
+
+		peer = ol_txrx_peer_find_by_id(pdev,
+					       wmi_peer_signal->peer_id);
+		if (!peer) {
+			WMA_LOGE(FL("Invalid Peer ID %d in FW message."),
+				 wmi_peer_signal->peer_id);
+		} else {
+			vos_mem_copy(&peer_stats[i].mac_address,
+				     &peer->mac_addr,
+				     sizeof(peer_stats[i].mac_address));
+			WMA_LOGI("Peer %d mac address is: ",
+				 wmi_peer_signal->peer_id);
+			WMA_LOGI("%2x:%2x:%2x:%2x:%2x:%2x.",
+				 peer->mac_addr.raw[0], peer->mac_addr.raw[1],
+				 peer->mac_addr.raw[2], peer->mac_addr.raw[3],
+				 peer->mac_addr.raw[4], peer->mac_addr.raw[5]);
+		}
+		wmi_peer_signal++;
+	}
+
+	result += peer_num * sizeof(struct sir_wifi_ll_ext_peer_stats);
+	cca_stats = (struct sir_wifi_chan_cca_stats *)result;
+	ll_stats->cca = cca_stats;
+	dst_len = sizeof(struct sir_wifi_chan_cca_stats);
+	for (i = 0; i < ll_stats->channel_num; i++) {
+		if (dst_len <= result_size) {
+			vos_mem_copy(&cca_stats[i], &wmi_cca_stats->vdev_id,
+				     dst_len);
+			result_size -= dst_len;
+		} else {
+			WMA_LOGE(FL("Invalid length of CCA."));
+		}
+	}
+
+	result += i * sizeof(struct sir_wifi_chan_cca_stats);
+	__wma_fill_tx_stats(ll_stats, fixed_param, param_buf,
+			    &result, &result_size);
+	__wma_fill_rx_stats(ll_stats, fixed_param, param_buf,
+			    &result, &result_size);
+	vos_msg.type = eWMI_SME_LL_STATS_IND;
+	vos_msg.bodyptr = (void *)link_stats_results;
+	vos_msg.bodyval = 0;
+	if (VOS_STATUS_SUCCESS !=
+			vos_mq_post_message(VOS_MQ_ID_SME, &vos_msg)) {
+		WMA_LOGP(FL("Failed to post peer stat change msg!"));
+		vos_mem_free(link_stats_results);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int wmi_unified_pdev_set_param(wmi_unified_t wmi_handle,
+				      WMI_PDEV_PARAM param_id,
+				      u_int32_t param_value);
+
+/**
+ * wma_tx_failure_cb() - TX failure callback
+ * @ctx: txrx context
+ * @num_msdu: number of msdu with the same status
+ * @tid: TID number
+ * @status: failure status
+ *    1: TX packet discarded
+ *    2: No ACK
+ *    3: Postpone
+ */
+void wma_tx_failure_cb(void *ctx, uint32_t num_msdu, uint8_t tid, uint32 status)
+{
+	tSirLLStatsResults *results;
+	struct sir_wifi_iface_tx_fail *tx_fail;
+	void *vos_context = vos_get_global_context(VOS_MODULE_ID_WDA, NULL);
+	tpAniSirGlobal mac;
+	uint32_t len;
+	vos_msg_t vos_msg;
+
+	mac = (tpAniSirGlobal)vos_get_context(VOS_MODULE_ID_PE, vos_context);
+	if (!mac) {
+		WMA_LOGD("%s: NULL mac ptr. Exiting", __func__);
+		return;
+	}
+
+	len = sizeof(tSirLLStatsResults) +
+		sizeof(struct sir_wifi_iface_tx_fail);
+	results = vos_mem_malloc(len);
+	if (results == NULL) {
+		WMA_LOGE("%s: Cannot allocate link layer stats.", __func__);
+		return;
+	}
+
+	vos_mem_zero(results, len);
+	results->paramId            = WMI_LL_STATS_EXT_TX_FAIL;
+	results->num_peers          = 1;
+	results->peer_event_number  = 1;
+	results->moreResultToFollow = 0;
+
+	tx_fail = (struct sir_wifi_iface_tx_fail *)results->results;
+	tx_fail->tid = tid;
+	tx_fail->msdu_num = num_msdu;
+	tx_fail->status = status;
+	vos_msg.type = eWMI_SME_LL_STATS_IND;
+	vos_msg.bodyptr = (void *)results;
+	vos_msg.bodyval = 0;
+	if (VOS_STATUS_SUCCESS !=
+			vos_mq_post_message(VOS_MQ_ID_SME, &vos_msg)) {
+		WMA_LOGP(FL("Failed to post tx failure msg!"));
+		vos_mem_free(results);
+	}
+}
+
+/**
+ * void wma_config_stats_ext_threshold - set threthold for MAC counters
+ * @wma: wma handler
+ * @threshold: threhold for MAC counters
+ *
+ * For each MAC layer counter, FW holds two copies. One is the current value.
+ * The other is the last report. Once a current counter's increment is larger
+ * than the threshold, FW will indicate that counter to host even if the
+ * monitoring timer does not expire.
+ */
+void wma_config_stats_ext_threshold(struct wma_handle *wma,
+				    struct sir_ll_ext_stats_threshold *thresh)
+{
+	uint32_t len, tag, hdr_len;
+	uint8_t *buf_ptr;
+	wmi_buf_t buf;
+	wmi_pdev_set_stats_threshold_cmd_fixed_param *cmd;
+	wmi_chan_cca_stats_thresh *cca;
+	wmi_peer_signal_stats_thresh *signal;
+	wmi_tx_stats_thresh *tx;
+	wmi_rx_stats_thresh *rx;
+
+	if (thresh->period != LL_STATS_INVALID_PERIOD) {
+		/*
+		 * only set period,
+		 * otherwise former threshold would be modified.
+		 */
+		if (wmi_unified_pdev_set_param(wma->wmi_handle,
+				       WMI_PDEV_PARAM_STATS_OBSERVATION_PERIOD,
+				       thresh->period))
+			WMA_LOGP(FL("Failed to set MAC counter period."));
+		WMA_LOGD(FL("Mac counter period=%d."), thresh->period);
+		return;
+	}
+
+	len = sizeof(wmi_pdev_set_stats_threshold_cmd_fixed_param) +
+	      sizeof(wmi_chan_cca_stats_thresh) +
+	      sizeof(wmi_peer_signal_stats_thresh) +
+	      sizeof(wmi_tx_stats_thresh) +
+	      sizeof(wmi_rx_stats_thresh) +
+	      5 * WMI_TLV_HDR_SIZE;
+	buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGP("%s: wmi_buf_alloc failed", __func__);
+		return;
+	}
+
+	buf_ptr = (u_int8_t *)wmi_buf_data(buf);
+	tag = WMITLV_TAG_STRUC_wmi_pdev_set_stats_threshold_cmd_fixed_param;
+	hdr_len = WMITLV_GET_STRUCT_TLVLEN(
+			wmi_pdev_set_stats_threshold_cmd_fixed_param);
+	WMA_LOGD(FL("Setting fixed parameters. tag=%d, len=%d"), tag, hdr_len);
+	cmd = (wmi_pdev_set_stats_threshold_cmd_fixed_param *)buf_ptr;
+	WMITLV_SET_HDR(&cmd->tlv_header, tag, hdr_len);
+	cmd->enable_thresh = thresh->enable;
+	cmd->use_thresh_bitmap = thresh->enable_bitmap;
+	cmd->gbl_thresh = thresh->global_threshold;
+	cmd->cca_thresh_enable_bitmap = thresh->cca_bitmap;
+	cmd->signal_thresh_enable_bitmap = thresh->signal_bitmap;
+	cmd->tx_thresh_enable_bitmap = thresh->tx_bitmap;
+	cmd->rx_thresh_enable_bitmap = thresh->rx_bitmap;
+	len = sizeof(wmi_pdev_set_stats_threshold_cmd_fixed_param);
+
+	tag = WMITLV_TAG_STRUC_wmi_chan_cca_stats_thresh,
+	hdr_len = WMITLV_GET_STRUCT_TLVLEN(wmi_chan_cca_stats_thresh);
+	cca = (wmi_chan_cca_stats_thresh *)(buf_ptr + len);
+	WMITLV_SET_HDR(&cca->tlv_header, tag, hdr_len);
+	WMA_LOGD(FL("Setting cca parameters. tag=%d, len=%d"), tag, hdr_len);
+	cca->idle_time = thresh->cca.idle_time;
+	cca->tx_time = thresh->cca.tx_time;
+	cca->rx_in_bss_time = thresh->cca.rx_in_bss_time;
+	cca->rx_out_bss_time = thresh->cca.rx_out_bss_time;
+	cca->rx_busy_time = thresh->cca.rx_busy_time;
+	cca->rx_in_bad_cond_time = thresh->cca.rx_in_bad_cond_time;
+	cca->tx_in_bad_cond_time = thresh->cca.tx_in_bad_cond_time;
+	cca->wlan_not_avail_time = thresh->cca.wlan_not_avail_time;
+	WMA_LOGD(FL("idle time=%d, tx_time=%d, in_bss=%d, out_bss=%d"),
+		 cca->idle_time, cca->tx_time,
+		 cca->rx_in_bss_time, cca->rx_out_bss_time);
+	WMA_LOGD(FL("rx_busy=%d, rx_bad=%d, tx_bad=%d, not_avail=%d"),
+		 cca->rx_busy_time, cca->rx_in_bad_cond_time,
+		 cca->tx_in_bad_cond_time, cca->wlan_not_avail_time);
+	len += sizeof(wmi_chan_cca_stats_thresh);
+
+	signal = (wmi_peer_signal_stats_thresh *)(buf_ptr + len);
+	tag = WMITLV_TAG_STRUC_wmi_peer_signal_stats_thresh;
+	hdr_len = WMITLV_GET_STRUCT_TLVLEN(wmi_peer_signal_stats_thresh);
+	WMA_LOGD(FL("Setting signal parameters. tag=%d, len=%d"), tag, hdr_len);
+	WMITLV_SET_HDR(&signal->tlv_header, tag, hdr_len);
+	signal->per_chain_snr = thresh->signal.snr;
+	signal->per_chain_nf = thresh->signal.nf;
+	WMA_LOGD(FL("snr=%d, nf=%d"), signal->per_chain_snr,
+		 signal->per_chain_nf);
+	len += sizeof(wmi_peer_signal_stats_thresh);
+
+	tx = (wmi_tx_stats_thresh *)(buf_ptr + len);
+	tag = WMITLV_TAG_STRUC_wmi_tx_stats_thresh;
+	hdr_len = WMITLV_GET_STRUCT_TLVLEN(wmi_tx_stats_thresh);
+	WMA_LOGD(FL("Setting TX parameters. tag=%d, len=%d"), tag, len);
+	WMITLV_SET_HDR(&tx->tlv_header, tag, hdr_len);
+	tx->tx_msdu_cnt = thresh->tx.msdu;
+	tx->tx_mpdu_cnt = thresh->tx.mpdu;
+	tx->tx_ppdu_cnt = thresh->tx.ppdu;
+	tx->tx_bytes = thresh->tx.bytes;
+	tx->tx_msdu_drop_cnt = thresh->tx.msdu_drop;
+	tx->tx_drop_bytes = thresh->tx.byte_drop;
+	tx->tx_mpdu_retry_cnt = thresh->tx.mpdu_retry;
+	tx->tx_mpdu_fail_cnt = thresh->tx.mpdu_fail;
+	tx->tx_ppdu_fail_cnt = thresh->tx.ppdu_fail;
+	tx->tx_mpdu_aggr = thresh->tx.aggregation;
+	tx->tx_succ_mcs = thresh->tx.succ_mcs;
+	tx->tx_fail_mcs = thresh->tx.fail_mcs;
+	tx->tx_ppdu_delay = thresh->tx.delay;
+	WMA_LOGD(FL("msdu=%d, mpdu=%d, ppdu=%d, bytes=%d, msdu_drop=%d"),
+		 tx->tx_msdu_cnt, tx->tx_mpdu_cnt, tx->tx_ppdu_cnt,
+		 tx->tx_bytes, tx->tx_msdu_drop_cnt);
+	WMA_LOGD(FL("byte_drop=%d, mpdu_retry=%d, mpdu_fail=%d, ppdu_fail=%d"),
+		 tx->tx_drop_bytes, tx->tx_mpdu_retry_cnt,
+		 tx->tx_mpdu_fail_cnt, tx->tx_ppdu_fail_cnt);
+	WMA_LOGD(FL("aggr=%d, succ_mcs=%d, fail_mcs=%d, delay=%d"),
+		 tx->tx_mpdu_aggr, tx->tx_succ_mcs, tx->tx_fail_mcs,
+		 tx->tx_ppdu_delay);
+	len += sizeof(wmi_tx_stats_thresh);
+
+	rx = (wmi_rx_stats_thresh *)(buf_ptr + len);
+	tag = WMITLV_TAG_STRUC_wmi_rx_stats_thresh,
+	hdr_len = WMITLV_GET_STRUCT_TLVLEN(wmi_rx_stats_thresh);
+	WMITLV_SET_HDR(&rx->tlv_header, tag, hdr_len);
+	WMA_LOGD(FL("Setting RX parameters. tag=%d, len=%d"), tag, hdr_len);
+	rx->mac_rx_mpdu_cnt = thresh->rx.mpdu;
+	rx->mac_rx_bytes = thresh->rx.bytes;
+	rx->phy_rx_ppdu_cnt = thresh->rx.ppdu;
+	rx->phy_rx_bytes = thresh->rx.ppdu_bytes;
+	rx->rx_disorder_cnt = thresh->rx.disorder;
+	rx->rx_mpdu_retry_cnt = thresh->rx.mpdu_retry;
+	rx->rx_mpdu_dup_cnt = thresh->rx.mpdu_dup;
+	rx->rx_mpdu_discard_cnt = thresh->rx.mpdu_discard;
+	rx->rx_mpdu_aggr = thresh->rx.aggregation;
+	rx->rx_mcs = thresh->rx.mcs;
+	rx->sta_ps_inds = thresh->rx.ps_inds;
+	rx->sta_ps_durs = thresh->rx.ps_durs;
+	rx->rx_probe_reqs = thresh->rx.probe_reqs;
+	rx->rx_oth_mgmts = thresh->rx.other_mgmt;
+	WMA_LOGD(FL("rx_mpdu=%d, rx_bytes=%d, rx_ppdu=%d, rx_pbytes=%d"),
+		 rx->mac_rx_mpdu_cnt, rx->mac_rx_bytes,
+		 rx->phy_rx_ppdu_cnt, rx->phy_rx_bytes);
+	WMA_LOGD(FL("disorder=%d, rx_dup=%d, rx_aggr=%d, rx_mcs=%d"),
+		 rx->rx_disorder_cnt, rx->rx_mpdu_dup_cnt,
+		 rx->rx_mpdu_aggr, rx->rx_mcs);
+	WMA_LOGD(FL("rx_ind=%d, rx_dur=%d, rx_probe=%d, rx_mgmt=%d"),
+		 rx->sta_ps_inds, rx->sta_ps_durs,
+		 rx->rx_probe_reqs, rx->rx_oth_mgmts);
+	len += sizeof(wmi_rx_stats_thresh);
+
+	WMA_LOGA("WMA --> WMI_PDEV_SET_STATS_THRESHOLD_CMDID(0x%x), length=%d",
+		 WMI_PDEV_SET_STATS_THRESHOLD_CMDID, len);
+	if (EOK != wmi_unified_cmd_send(wma->wmi_handle,
+					buf, len,
+					WMI_PDEV_SET_STATS_THRESHOLD_CMDID)) {
+		WMA_LOGE("Failed to send WMI_PDEV_SET_STATS_THRESHOLD_CMDID");
+		wmi_buf_free(buf);
+	}
+}
+#else
+/**
+ * wma_tx_failure_cb() - TX failure callback
+ * @ctx: txrx context
+ * @num_msdu: number of msdu with the same status
+ * @tid: TID number
+ * @status: failure status
+ *    1: TX packet discarded
+ *    2: No ACK
+ *    3: Postpone
+ */
+void wma_tx_failure_cb(void *ctx, uint32_t num_msdu, uint8_t tid, uint32 status)
+{
+}
+#endif /* WLAN_FEATURE_LINK_LAYER_STATS */
+
+/**
+ * wma_unified_power_debug_stats_event_handler() - WMA handler function to
+ * handle Power stats event from firmware
+ * @handle: Pointer to wma handle
+ * @cmd_param_info: Pointer to Power stats event TLV
+ * @len: Length of the cmd_param_info
+ *
+ * Return: 0 on success, error number otherwise
+ */
+#ifdef WLAN_POWER_DEBUGFS
+static int wma_unified_power_debug_stats_event_handler(void *handle,
+				uint8_t *cmd_param_info, uint32_t len)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle) handle;
+	WMI_PDEV_CHIP_POWER_STATS_EVENTID_param_tlvs *param_tlvs;
+	struct power_stats_response *power_stats_results;
+	wmi_pdev_chip_power_stats_event_fixed_param *param_buf;
+	uint32_t power_stats_len, stats_registers_len, *debug_registers;
+
+	tpAniSirGlobal mac = (tpAniSirGlobal)vos_get_context(VOS_MODULE_ID_PE,
+						wma_handle->vos_context);
+	param_tlvs =
+		(WMI_PDEV_CHIP_POWER_STATS_EVENTID_param_tlvs *) cmd_param_info;
+
+	param_buf = (wmi_pdev_chip_power_stats_event_fixed_param *)
+				param_tlvs->fixed_param;
+	if (!mac || !mac->sme.power_stats_resp_callback) {
+		WMA_LOGD("%s: NULL mac ptr or HDD callback is null", __func__);
+		return -EINVAL;
+	}
+
+	if (!param_buf) {
+		WMA_LOGD("%s: NULL power stats event fixed param", __func__);
 		return -EINVAL;
 	}
 
-	WMA_LOGI("FW MEM DUMP RSP posted successfully");
+	if (param_buf->num_debug_register > ((WMA_SVC_MSG_MAX_SIZE -
+		sizeof(wmi_pdev_chip_power_stats_event_fixed_param)) /
+		sizeof(uint32_t))) {
+		WMA_LOGE("excess payload: LEN num_debug_register:%u",
+			 param_buf->num_debug_register);
+		return -EINVAL;
+	}
+
+	debug_registers = param_tlvs->debug_registers;
+	stats_registers_len =
+			(sizeof(uint32_t) * param_buf->num_debug_register);
+	power_stats_len = stats_registers_len + sizeof(*power_stats_results);
+	power_stats_results = vos_mem_malloc(power_stats_len);
+	if (NULL == power_stats_results) {
+		WMA_LOGD("%s: could not allocate mem for power stats results",
+				__func__);
+		return -ENOMEM;
+	}
+
+	vos_mem_zero(power_stats_results, power_stats_len);
+	WMA_LOGD("Cumulative sleep time %d cumulative total on time %d deep sleep enter counter %d last deep sleep enter tstamp ts %d debug registers fmt %d num debug register %d",
+		param_buf->cumulative_sleep_time_ms,
+		param_buf->cumulative_total_on_time_ms,
+		param_buf->deep_sleep_enter_counter,
+		param_buf->last_deep_sleep_enter_tstamp_ms,
+		param_buf->debug_register_fmt,
+		param_buf->num_debug_register);
+
+	power_stats_results->cumulative_sleep_time_ms
+			= param_buf->cumulative_sleep_time_ms;
+	power_stats_results->cumulative_total_on_time_ms
+			= param_buf->cumulative_total_on_time_ms;
+	power_stats_results->deep_sleep_enter_counter
+			= param_buf->deep_sleep_enter_counter;
+	power_stats_results->last_deep_sleep_enter_tstamp_ms
+			= param_buf->last_deep_sleep_enter_tstamp_ms;
+	power_stats_results->debug_register_fmt
+			= param_buf->debug_register_fmt;
+	power_stats_results->num_debug_register
+			= param_buf->num_debug_register;
+
+	power_stats_results->debug_registers
+			= (uint32_t *)(power_stats_results + 1);
+
+	vos_mem_copy(power_stats_results->debug_registers,
+			debug_registers, stats_registers_len);
+
+	mac->sme.power_stats_resp_callback(power_stats_results,
+				mac->sme.power_debug_stats_context);
+	vos_mem_free(power_stats_results);
 	return 0;
 }
 #else
-static int wma_fw_mem_dump_event_handler(void *handle, u_int8_t *cmd_param_info,
-					 u_int32_t len)
+static int wma_unified_power_debug_stats_event_handler(void *handle,
+			uint8_t *cmd_param_info, uint32_t len)
 {
 	return 0;
 }
-#endif /* WLAN_FEATURE_MEMDUMP */
+#endif
+
+
+static int wma_pdev_div_info_evt_handler(void *handle, u_int8_t *event_buf,
+	u_int32_t len)
+{
+	tp_wma_handle wma = (tp_wma_handle) handle;
+	WMI_PDEV_DIV_RSSI_ANTID_EVENTID_param_tlvs *param_buf;
+	wmi_pdev_div_rssi_antid_event_fixed_param *event;
+	struct chain_rssi_result chain_rssi_result;
+	u_int32_t i;
+	u_int8_t macaddr[IEEE80211_ADDR_LEN];
+
+	tpAniSirGlobal pmac = (tpAniSirGlobal)vos_get_context(
+					VOS_MODULE_ID_PE, wma->vos_context);
+	if (!pmac) {
+		WMA_LOGE(FL("Invalid pmac"));
+		return -EINVAL;
+	}
+
+	param_buf = (WMI_PDEV_DIV_RSSI_ANTID_EVENTID_param_tlvs *) event_buf;
+	if (!param_buf) {
+		WMA_LOGE(FL("Invalid rssi antid event buffer"));
+		return -EINVAL;
+	}
+
+	event = param_buf->fixed_param;
+	if (!event) {
+		WMA_LOGE(FL("Invalid fixed param"));
+		return -EINVAL;
+	}
+
+	WMI_MAC_ADDR_TO_CHAR_ARRAY(&event->macaddr, macaddr);
+	WMA_LOGD(FL("macaddr: " MAC_ADDRESS_STR), MAC_ADDR_ARRAY(macaddr));
+
+	if (event->num_chains_valid > CHAIN_MAX_NUM) {
+		WMA_LOGD("Sizing down the chains no %d to max",
+			  event->num_chains_valid);
+		event->num_chains_valid = CHAIN_MAX_NUM;
+	}
+
+	WMA_LOGD(FL("num_chains_valid: %d"), event->num_chains_valid);
+	chain_rssi_result.num_chains_valid = event->num_chains_valid;
+
+	for (i = 0; i < CHAIN_MAX_NUM; i++)
+		WMA_LOGD(FL("chain_rssi: %d"), event->chain_rssi[i]);
+	vos_mem_copy(chain_rssi_result.chain_rssi, event->chain_rssi,
+						sizeof(event->chain_rssi));
+	for (i = 0; i < event->num_chains_valid; i++)
+		chain_rssi_result.chain_rssi[i] += WMA_TGT_NOISE_FLOOR_DBM;
+
+	for (i = 0; i < CHAIN_MAX_NUM; i++)
+		WMA_LOGD(FL("ant_id: %d"), event->ant_id[i]);
+	vos_mem_copy(chain_rssi_result.ant_id, event->ant_id,
+						sizeof(event->ant_id));
+
+	pmac->sme.pchain_rssi_ind_cb(pmac->hHdd, &chain_rssi_result);
+
+	return 0;
+}
 
 u_int8_t *wma_add_p2p_ie(u_int8_t *frm)
 {
@@ -5298,7 +6788,6 @@ static void wma_update_probe_resp_noa(tp_wma_handle wma_handle,
 					struct p2p_sub_element_noa *noa_ie)
 {
 	tSirP2PNoaAttr *noa_attr = (tSirP2PNoaAttr *) vos_mem_malloc(sizeof(tSirP2PNoaAttr));
-	WMA_LOGD("Received update NoA event");
 	if (!noa_attr) {
 		WMA_LOGE("Failed to allocate memory for tSirP2PNoaAttr");
 		return;
@@ -5313,7 +6802,6 @@ static void wma_update_probe_resp_noa(tp_wma_handle wma_handle,
 		WMA_LOGD("Zero NoA descriptors");
 	}
 	else {
-		WMA_LOGD("%d NoA descriptors", noa_ie->num_descriptors);
 		noa_attr->uNoa1IntervalCnt =
 			noa_ie->noa_descriptors[0].type_count;
 		noa_attr->uNoa1Duration =
@@ -5333,11 +6821,72 @@ static void wma_update_probe_resp_noa(tp_wma_handle wma_handle,
 				noa_ie->noa_descriptors[1].start_time;
 		}
 	}
-	WMA_LOGI("Sending SIR_HAL_P2P_NOA_ATTR_IND to LIM");
-	wma_send_msg(wma_handle, SIR_HAL_P2P_NOA_ATTR_IND, (void *)noa_attr ,
+	wma_send_msg(wma_handle, SIR_HAL_P2P_NOA_ATTR_IND, (void *)noa_attr,
 			0);
 }
 
+void wma_ignore_radar_soon_after_assoc(void)
+{
+	void *vos_context;
+	tp_wma_handle wma;
+	struct ieee80211com *ic = NULL;
+	struct ath_dfs *dfs = NULL;
+
+	vos_context = vos_get_global_context(VOS_MODULE_ID_VOSS, NULL);
+	if (!vos_context) {
+		WMA_LOGE("%s: VOS context is invald!", __func__);
+		return;
+	}
+
+	wma = (tp_wma_handle)vos_get_context(VOS_MODULE_ID_WDA,
+			vos_context);
+
+	if (!wma) {
+		WMA_LOGE("%s: WMA context is invald!", __func__);
+		return;
+	}
+
+	ic = wma->dfs_ic;
+	if (ic && ic->ic_dfs) {
+		dfs = (struct ath_dfs *)ic->ic_dfs;
+		dfs->ath_radar_ignore_after_assoc = true;
+		vos_timer_start(&dfs->ath_dfs_radar_ignore_timer,
+				DFS_RADAR_IGNORE);
+	}
+}
+
+void wma_stop_radar_delay_timer(void)
+{
+	void *vos_context;
+	tp_wma_handle wma;
+	struct ieee80211com *ic = NULL;
+	struct ath_dfs *dfs = NULL;
+
+	vos_context = vos_get_global_context(VOS_MODULE_ID_VOSS, NULL);
+	if (!vos_context) {
+		WMA_LOGE("%s: VOS context is invald!", __func__);
+		return;
+	}
+
+	wma = (tp_wma_handle)vos_get_context(VOS_MODULE_ID_WDA,
+			vos_context);
+
+	if (!wma) {
+		WMA_LOGE("%s: WMA context is invald!", __func__);
+		return;
+	}
+
+	ic = wma->dfs_ic;
+	if (ic && ic->ic_dfs) {
+		dfs = (struct ath_dfs *)ic->ic_dfs;
+		if (dfs->ath_radar_delaysched) {
+			wma_update_dfs_cac_block_tx(false);
+			vos_timer_stop(&dfs->ath_dfs_radar_delay_timer);
+			dfs->ath_radar_delaysched = 0;
+		}
+	}
+}
+
 static void wma_send_bcn_buf_ll(tp_wma_handle wma,
 				ol_txrx_pdev_handle pdev,
 				u_int8_t vdev_id,
@@ -5361,6 +6910,12 @@ static void wma_send_bcn_buf_ll(tp_wma_handle wma,
 		WMA_LOGE("%s: Invalid beacon buffer", __func__);
 		return;
 	}
+	if (WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(p2p_noa_info) >
+			WMI_P2P_MAX_NOA_DESCRIPTORS) {
+		WMA_LOGE("%s: Too many descriptors %d", __func__,
+			 WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(p2p_noa_info));
+		return;
+	}
 
 	wmi_buf = wmi_buf_alloc(wma->wmi_handle, sizeof(*cmd));
 	if (!wmi_buf) {
@@ -5521,7 +7076,9 @@ static int wma_beacon_swba_handler(void *handle, u_int8_t *event, u_int32_t len)
 		return -EINVAL;
 	}
 
-	for ( ; vdev_map; vdev_id++, vdev_map >>= 1) {
+        WMA_LOGD("vdev_map = %d", vdev_map);
+        for (; vdev_map && vdev_id < wma->max_bssid;
+             vdev_id++, vdev_map >>= 1) {
 		if (!(vdev_map & 0x1))
 			continue;
 		if (!wdi_out_cfg_is_high_latency(pdev->ctrl_pdev))
@@ -5539,6 +7096,7 @@ static int wma_csa_offload_handler(void *handle, u_int8_t *event, u_int32_t len)
 	u_int8_t bssid[IEEE80211_ADDR_LEN];
 	u_int8_t vdev_id = 0;
 	u_int8_t cur_chan = 0;
+	uint8_t cur_sb20_channelwidth = 0;
 	struct ieee80211_channelswitch_ie *csa_ie;
 	tpCSAOffloadParams csa_offload_event;
 	struct ieee80211_extendedchannelswitch_ie *xcsa_ie;
@@ -5591,6 +7149,29 @@ static int wma_csa_offload_handler(void *handle, u_int8_t *event, u_int32_t len)
 		csa_offload_event->new_ch_freq_seg2 = wb_ie->new_ch_freq_seg2;
 	}
 
+	if (csa_event->ies_present_flag & WMI_QSBW_ISE_PRESENT) {
+		struct vendor_ie_sub20_channelwidth sub20width_ie;
+
+		sub20width_ie.elem_id =
+			 WMI_CSA_EVENT_QSBW_ISE_EXTRACT_ID(
+			csa_event->qsbw_ise);
+		sub20width_ie.elem_len =
+			 WMI_CSA_EVENT_QSBW_ISE_EXTRACT_LEN(
+			csa_event->qsbw_ise);
+		sub20width_ie.sub20_capability =
+			 WMI_CSA_EVENT_QSBW_ISE_EXTRACT_CAP(
+			csa_event->qsbw_ise);
+		sub20width_ie.new_sub20_channelwidth =
+			 WMI_CSA_EVENT_QSBW_ISE_EXTRACT_NOTIF(
+			csa_event->qsbw_ise);
+
+		WMA_LOGE("CSA event with sbw_ie capability: %d chwidth:%d",
+			 sub20width_ie.sub20_capability,
+			 sub20width_ie.new_sub20_channelwidth);
+		csa_offload_event->new_sub20_channelwidth =
+			 sub20width_ie.new_sub20_channelwidth;
+	}
+
 	csa_offload_event->ies_present_flag = csa_event->ies_present_flag;
 
 	WMA_LOGD("CSA: New Channel = %d BSSID:%pM",
@@ -5598,12 +7179,17 @@ static int wma_csa_offload_handler(void *handle, u_int8_t *event, u_int32_t len)
 			csa_offload_event->bssId);
 
 	cur_chan = vos_freq_to_chan(intr[vdev_id].mhz);
+
+	cur_sb20_channelwidth =
+		 vos_phy_channel_width_to_sub20(intr[vdev_id].channelwidth);
 	/*
 	 * basic sanity check: requested channel should not be 0
 	 * and equal to home channel
 	 */
 	if( (0 == csa_offload_event->channel) ||
-	    (cur_chan == csa_offload_event->channel) ) {
+	    (cur_chan == csa_offload_event->channel &&
+	     cur_sb20_channelwidth ==
+	     csa_offload_event->new_sub20_channelwidth)) {
 		WMA_LOGE("CSA Event with channel %d. Ignore !!",
 		csa_offload_event->channel);
 		vos_mem_free(csa_offload_event);
@@ -5728,10 +7314,9 @@ static int wma_oem_capability_event_callback(void *handle,
 	 * of data received from target should be 4 bytes less
 	 * then max allowed
 	 */
-	if (datalen > (OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN)) {
-		WMA_LOGE("%s: Received data len (%d) exceeds max value (%d)",
-		         __func__, datalen,
-			(OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN));
+	if (datalen <= 0 ||
+	    datalen > (OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN)) {
+		WMA_LOGE(FL("Invalid data length: %d"), datalen);
 		return -EINVAL;
 	}
 
@@ -5742,19 +7327,12 @@ static int wma_oem_capability_event_callback(void *handle,
 	}
 
 	pStartOemDataRsp->rsp_len = datalen + OEM_MESSAGE_SUBTYPE_LEN;
-	if (pStartOemDataRsp->rsp_len) {
-		pStartOemDataRsp->oem_data_rsp =
-			vos_mem_malloc(pStartOemDataRsp->rsp_len);
-		if (!pStartOemDataRsp->oem_data_rsp) {
-			WMA_LOGE(FL("malloc failed for data"));
-			vos_mem_free(pStartOemDataRsp);
-			return -ENOMEM;
-		}
-	} else {
-		WMA_LOGE(FL("Invalid rsp length: %d"),
-			 pStartOemDataRsp->rsp_len);
+	pStartOemDataRsp->oem_data_rsp =
+				vos_mem_malloc(pStartOemDataRsp->rsp_len);
+	if (!pStartOemDataRsp->oem_data_rsp) {
+		WMA_LOGE(FL("malloc failed for data"));
 		vos_mem_free(pStartOemDataRsp);
-		return -EINVAL;
+		return -ENOMEM;
 	}
 
 	pStartOemDataRsp->target_rsp = true;
@@ -5800,10 +7378,9 @@ static int wma_oem_measurement_report_event_callback(void *handle,
 	 * of data received from target should be 4 bytes less
 	 * then max allowed
 	 */
-	if (datalen > (OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN)) {
-		WMA_LOGE("%s: Received data len (%d) exceeds max value (%d)",
-		         __func__, datalen,
-			(OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN));
+	if (datalen <= 0 ||
+	    datalen > (OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN)) {
+		WMA_LOGE(FL("Invalid data length: %d"), datalen);
 		return -EINVAL;
 	}
 
@@ -5814,19 +7391,12 @@ static int wma_oem_measurement_report_event_callback(void *handle,
 	}
 
 	pStartOemDataRsp->rsp_len = datalen + OEM_MESSAGE_SUBTYPE_LEN;
-	if (pStartOemDataRsp->rsp_len) {
-		pStartOemDataRsp->oem_data_rsp =
+	pStartOemDataRsp->oem_data_rsp =
 			vos_mem_malloc(pStartOemDataRsp->rsp_len);
-		if (!pStartOemDataRsp->oem_data_rsp) {
-			WMA_LOGE(FL("malloc failed for data"));
-			vos_mem_free(pStartOemDataRsp);
-			return -ENOMEM;
-		}
-	} else {
-		WMA_LOGE(FL("Invalid rsp length: %d"),
-			 pStartOemDataRsp->rsp_len);
+	if (!pStartOemDataRsp->oem_data_rsp) {
+		WMA_LOGE(FL("malloc failed for data"));
 		vos_mem_free(pStartOemDataRsp);
-		return -EINVAL;
+		return -ENOMEM;
 	}
 
 	pStartOemDataRsp->target_rsp = true;
@@ -5872,10 +7442,9 @@ static int wma_oem_error_report_event_callback(void *handle,
 	 * of data received from target should be 4 bytes less
 	 * then max allowed
 	 */
-	if (datalen > (OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN)) {
-		WMA_LOGE("%s: Received data len (%d) exceeds max value (%d)",
-		         __func__, datalen,
-			(OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN));
+	if (datalen <= 0 ||
+	    datalen > (OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN)) {
+		WMA_LOGE(FL("Invalid data length: %d"), datalen);
 		return -EINVAL;
 	}
 
@@ -5886,19 +7455,12 @@ static int wma_oem_error_report_event_callback(void *handle,
 	}
 
 	pStartOemDataRsp->rsp_len = datalen + OEM_MESSAGE_SUBTYPE_LEN;
-	if (pStartOemDataRsp->rsp_len) {
-		pStartOemDataRsp->oem_data_rsp =
-			vos_mem_malloc(pStartOemDataRsp->rsp_len);
-		if (!pStartOemDataRsp->oem_data_rsp) {
-			WMA_LOGE(FL("malloc failed for data"));
-			vos_mem_free(pStartOemDataRsp);
-			return -ENOMEM;
-		}
-	} else {
-		WMA_LOGE(FL("Invalid rsp length: %d"),
-			 pStartOemDataRsp->rsp_len);
+	pStartOemDataRsp->oem_data_rsp =
+		vos_mem_malloc(pStartOemDataRsp->rsp_len);
+	if (!pStartOemDataRsp->oem_data_rsp) {
+		WMA_LOGE(FL("malloc failed for data"));
 		vos_mem_free(pStartOemDataRsp);
-		return -EINVAL;
+		return -ENOMEM;
 	}
 
 	pStartOemDataRsp->target_rsp = true;
@@ -5947,9 +7509,8 @@ static int wma_oem_data_response_handler(void *handle,
 		return -EINVAL;
 	}
 
-	if (datalen > OEM_DATA_RSP_SIZE) {
-		WMA_LOGE(FL("Received data len %d exceeds max value %d"),
-			 datalen, OEM_DATA_RSP_SIZE);
+	if (datalen <= 0 || datalen > OEM_DATA_RSP_SIZE) {
+		WMA_LOGE(FL("Invalid data length: %d"), datalen);
 		return -EINVAL;
 	}
 
@@ -5960,17 +7521,11 @@ static int wma_oem_data_response_handler(void *handle,
 	}
 
 	oem_rsp->rsp_len = datalen;
-	if (oem_rsp->rsp_len) {
-		oem_rsp->oem_data_rsp = vos_mem_malloc(oem_rsp->rsp_len);
-		if (!oem_rsp->rsp_len) {
-			WMA_LOGE(FL("malloc failed for data"));
-			vos_mem_free(oem_rsp);
-			return -ENOMEM;
-		}
-	} else {
-		WMA_LOGE(FL("Invalid rsp length: %d"), oem_rsp->rsp_len);
+	oem_rsp->oem_data_rsp = vos_mem_malloc(oem_rsp->rsp_len);
+	if (!oem_rsp->rsp_len) {
+		WMA_LOGE(FL("malloc failed for data"));
 		vos_mem_free(oem_rsp);
-		return -EINVAL;
+		return -ENOMEM;
 	}
 
 	oem_rsp->target_rsp = true;
@@ -6021,6 +7576,12 @@ static int wma_p2p_noa_event_handler(void *handle, u_int8_t *event, u_int32_t le
 		descriptors = WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(p2p_noa_info);
 		noa_ie.num_descriptors = (u_int8_t)descriptors;
 
+		if (noa_ie.num_descriptors > WMA_MAX_NOA_DESCRIPTORS) {
+			WMA_LOGD("Sizing down the no of desc %d to max",
+					noa_ie.num_descriptors);
+			noa_ie.num_descriptors = WMA_MAX_NOA_DESCRIPTORS;
+		}
+
 		WMA_LOGI("%s: index %u, oppPs %u, ctwindow %u, "
 				"num_descriptors = %u", __func__, noa_ie.index,
 				noa_ie.oppPS, noa_ie.ctwindow, noa_ie.num_descriptors);
@@ -6336,6 +7897,13 @@ static int wma_nan_rsp_event_handler(void *handle, u_int8_t *event_buf,
 	buf_ptr = (u_int8_t *)nan_rsp_event_hdr;
 	alloc_len = sizeof(tSirNanEvent);
 	alloc_len += nan_rsp_event_hdr->data_len;
+	if (nan_rsp_event_hdr->data_len > ((WMA_SVC_MSG_MAX_SIZE -
+	    sizeof(*nan_rsp_event_hdr)) / sizeof(u_int8_t)) ||
+	    nan_rsp_event_hdr->data_len > param_buf->num_data)  {
+		WMA_LOGE("excess data length:%d", nan_rsp_event_hdr->data_len);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	}
 	nan_rsp_event = (tSirNanEvent *) vos_mem_malloc(alloc_len);
 	if (NULL == nan_rsp_event) {
 	    WMA_LOGE("%s: Memory allocation failure", __func__);
@@ -6386,6 +7954,8 @@ static int wma_unified_dfs_radar_rx_event_handler(void *handle,
 	WMI_DFS_RADAR_EVENTID_param_tlvs *param_tlvs;
 	wmi_dfs_radar_event_fixed_param *radar_event;
 
+	adf_os_atomic_dec(&wma->dfs_wmi_event_pending);
+
 	ic = wma->dfs_ic;
 	if (NULL == ic) {
 		WMA_LOGE("%s: dfs_ic is  NULL ", __func__);
@@ -6488,8 +8058,15 @@ static int wma_unified_dfs_radar_rx_event_handler(void *handle,
 	event->re_full_ts = (((uint64_t)radar_event->upload_fullts_high) << 32)
 			| radar_event->upload_fullts_low;
 
-	/* Index of peak magnitude */
-	event->sidx = radar_event->peak_sidx;
+	/**
+	 * Index of peak magnitude
+	 * To do
+	 * Need change interface of WMI_DFS_RADAR_EVENTID to get delta_diff and
+	 * delta_peak when DFS Phyerr filtering offload is enabled.
+	 */
+	event->sidx = radar_event->peak_sidx & 0x0000ffff;
+	event->re_delta_diff = 0;
+	event->re_delta_peak = 0;
 	event->re_flags = 0;
 
 	/*
@@ -6639,7 +8216,12 @@ wma_register_ll_stats_event_handler(tp_wma_handle wma_handle)
 	wmi_unified_register_event_handler(wma_handle->wmi_handle,
 			WMI_RADIO_TX_POWER_LEVEL_STATS_EVENTID,
 			wma_unified_radio_tx_power_level_stats_event_handler);
-
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					   WMI_PEER_STA_PS_STATECHG_EVENTID,
+					   wma_peer_ps_evt_handler);
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					   WMI_REPORT_STATS_EVENTID,
+					   wma_ll_stats_evt_handler);
 	return;
 }
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
@@ -6656,6 +8238,7 @@ static int wma_roam_synch_event_handler(void *handle, u_int8_t *event, u_int32_t
 	wmi_key_material *key = NULL;
 	int size=0;
 	tSirRoamOffloadSynchInd *pRoamOffloadSynchInd;
+	uint32_t roam_synch_data_len;
 
 	WMA_LOGD("LFR3:%s", __func__);
 	if (!event) {
@@ -6675,19 +8258,59 @@ static int wma_roam_synch_event_handler(void *handle, u_int8_t *event, u_int32_t
 	 return -EINVAL;
 	}
 
+	if (synch_event->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("%s: received invalid vdev_id %d",
+			 __func__, synch_event->vdev_id);
+		return -EINVAL;
+	}
+
+	DPTRACE(adf_dp_trace_record_event(ADF_DP_TRACE_EVENT_RECORD,
+		synch_event->vdev_id, ADF_PROTO_TYPE_EVENT, ADF_ROAM_SYNCH));
+
 	if(wma->interfaces[synch_event->vdev_id].roam_synch_in_progress ==
 		VOS_TRUE) {
 	  WMA_LOGE("%s: Ignoring RSI since one is already in progress",
 	  __func__);
 	  return -EINVAL;
 	}
+
+	WMA_LOGD("synch payload: LEN bcn:%d, req:%d, rsp:%d",
+		 synch_event->bcn_probe_rsp_len,
+		 synch_event->reassoc_req_len,
+		 synch_event->reassoc_rsp_len);
+
+	if (synch_event->bcn_probe_rsp_len > WMA_SVC_MSG_MAX_SIZE)
+		return -EINVAL;
+	if (synch_event->reassoc_rsp_len >
+	    (WMA_SVC_MSG_MAX_SIZE - synch_event->bcn_probe_rsp_len))
+		return -EINVAL;
+	if (synch_event->reassoc_req_len >
+	    WMA_SVC_MSG_MAX_SIZE - (synch_event->bcn_probe_rsp_len +
+	    synch_event->reassoc_rsp_len))
+		return -EINVAL;
+
+	roam_synch_data_len = synch_event->bcn_probe_rsp_len +
+				synch_event->reassoc_rsp_len +
+				synch_event->reassoc_req_len;
+	/*
+	 * Below is the check for the entire size of the message received from'
+	 * the firmware.
+	 */
+	if (roam_synch_data_len > WMA_SVC_MSG_MAX_SIZE -
+	    (sizeof(*synch_event) + sizeof(wmi_channel) +
+	    sizeof(wmi_key_material) + sizeof(uint32_t)))
+		return -EINVAL;
+
+	if (sizeof(tSirRoamOffloadSynchInd) >
+	    (WMA_SVC_MSG_MAX_SIZE - roam_synch_data_len))
+		return -EINVAL;
+	roam_synch_data_len += sizeof(tSirRoamOffloadSynchInd);
+
 	adf_os_spin_lock_bh(&wma->roam_synch_lock);
 	wma->interfaces[synch_event->vdev_id].roam_synch_in_progress = VOS_TRUE;
 	adf_os_spin_unlock_bh(&wma->roam_synch_lock);
-	len = sizeof(tSirRoamOffloadSynchInd) +
-		synch_event->bcn_probe_rsp_len +
-		synch_event->reassoc_rsp_len;
-	pRoamOffloadSynchInd = (tSirRoamOffloadSynchInd *)vos_mem_malloc(len);
+	pRoamOffloadSynchInd =
+		(tSirRoamOffloadSynchInd *)vos_mem_malloc(roam_synch_data_len);
 	if (!pRoamOffloadSynchInd) {
 	 WMA_LOGE("%s: failed to allocate memory for roam_synch_event", __func__);
 	 return -ENOMEM;
@@ -6789,6 +8412,64 @@ static int wma_rssi_breached_event_handler(void *handle,
 	return 0;
 }
 
+/**
+ * wma_chip_power_save_failure_detected_handler() - chip pwr save fail detected
+ * event handler
+ * @handle: wma handle
+ * @cmd_param_info: event handler data
+ * @len: length of @cmd_param_info
+ *
+ * Return: VOS_STATUS_SUCCESS on success; error code otherwise
+ */
+static int wma_chip_power_save_failure_detected_handler(void *handle,
+				u_int8_t  *cmd_param_info, u_int32_t len)
+{
+	tp_wma_handle wma = (tp_wma_handle)handle;
+	WMI_PDEV_CHIP_POWER_SAVE_FAILURE_DETECTED_EVENTID_param_tlvs *param_buf;
+	wmi_chip_power_save_failure_detected_fixed_param  *event;
+	struct chip_pwr_save_fail_detected_params  pwr_save_fail_params;
+	tpAniSirGlobal mac;
+
+	if (NULL == wma) {
+		WMA_LOGE("%s: wma_handle is NULL", __func__);
+		return VOS_STATUS_E_INVAL;
+	}
+	mac = (tpAniSirGlobal)vos_get_context(
+					VOS_MODULE_ID_PE, wma->vos_context);
+	if (!mac) {
+		WMA_LOGE("%s: Invalid mac context", __func__);
+		return VOS_STATUS_E_INVAL;
+	}
+	if (!mac->sme.chip_power_save_fail_cb) {
+		WMA_LOGE("%s: Callback not registered", __func__);
+		return VOS_STATUS_E_INVAL;
+	}
+	param_buf =
+	(WMI_PDEV_CHIP_POWER_SAVE_FAILURE_DETECTED_EVENTID_param_tlvs *)
+	cmd_param_info;
+	if (!param_buf) {
+		WMA_LOGE("%s: Invalid pwr_save_fail_params breached event",
+			 __func__);
+		return VOS_STATUS_E_INVAL;
+	}
+	event = param_buf->fixed_param;
+
+	pwr_save_fail_params.failure_reason_code =
+			 event->power_save_failure_reason_code;
+	pwr_save_fail_params.wake_lock_bitmap[0] =
+			 event->protocol_wake_lock_bitmap[0];
+	pwr_save_fail_params.wake_lock_bitmap[1] =
+			 event->protocol_wake_lock_bitmap[1];
+	pwr_save_fail_params.wake_lock_bitmap[2] =
+			 event->protocol_wake_lock_bitmap[2];
+	pwr_save_fail_params.wake_lock_bitmap[3] =
+			 event->protocol_wake_lock_bitmap[3];
+
+	mac->sme.chip_power_save_fail_cb(mac->hHdd,
+					     &pwr_save_fail_params);
+	WMA_LOGD("%s: Invoke HDD pwr_save_fail callback", __func__);
+	return VOS_STATUS_SUCCESS;
+}
 /*
  * Send WMI_DFS_PHYERR_FILTER_ENA_CMDID or
  * WMI_DFS_PHYERR_FILTER_DIS_CMDID command
@@ -6907,6 +8588,12 @@ static int wma_unified_bcntx_status_event_handler(void *handle, u_int8_t *cmd_pa
 
    resp_event = param_buf->fixed_param;
 
+   if (resp_event->vdev_id >= wma->max_bssid) {
+        WMA_LOGE("%s: received invalid vdev_id %d",
+                __func__, resp_event->vdev_id);
+        return -EINVAL;
+   }
+
    /* Check for valid handle to ensure session is not deleted in any race */
    if (!wma->interfaces[resp_event->vdev_id].handle) {
       WMA_LOGE("%s: The session does not exist", __func__);
@@ -6990,6 +8677,14 @@ static int wma_stats_ext_event_handler(void *handle, u_int8_t *event_buf,
 	alloc_len = sizeof(tSirStatsExtEvent);
 	alloc_len += stats_ext_info->data_len;
 
+	if (stats_ext_info->data_len > (WMA_SVC_MSG_MAX_SIZE -
+	    sizeof(*stats_ext_info)) ||
+	    stats_ext_info->data_len > param_buf->num_data) {
+		WMA_LOGE("Excess data_len:%d", stats_ext_info->data_len);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	}
+
 	stats_ext_event = (tSirStatsExtEvent *) vos_mem_malloc(alloc_len);
 	if (NULL == stats_ext_event) {
 		WMA_LOGE("%s: Memory allocation failure", __func__);
@@ -7018,6 +8713,74 @@ static int wma_stats_ext_event_handler(void *handle, u_int8_t *event_buf,
 	WMA_LOGD("%s: stats ext event Posted to SME", __func__);
 	return 0;
 }
+
+static int wma_rx_aggr_failure_event_handler(void *handle, u_int8_t *event_buf,
+						u_int32_t len)
+{
+	WMI_REPORT_RX_AGGR_FAILURE_EVENTID_param_tlvs *param_buf;
+	struct sir_sme_rx_aggr_hole_ind *rx_aggr_hole_event;
+	wmi_rx_aggr_failure_event_fixed_param *rx_aggr_failure_info;
+	wmi_rx_aggr_failure_info *hole_info;
+	u_int32_t i, alloc_len;
+	VOS_STATUS status;
+	vos_msg_t vos_msg;
+
+	WMA_LOGD("%s: Posting stats ext event to SME", __func__);
+
+	param_buf = (WMI_REPORT_RX_AGGR_FAILURE_EVENTID_param_tlvs *)event_buf;
+	if (!param_buf) {
+		WMA_LOGE("%s: Invalid stats ext event buf", __func__);
+		return -EINVAL;
+	}
+
+	rx_aggr_failure_info = param_buf->fixed_param;
+	hole_info = param_buf->failure_info;
+
+	if (rx_aggr_failure_info->num_failure_info > ((WMA_SVC_MSG_MAX_SIZE -
+	    sizeof(*rx_aggr_hole_event)) /
+	    sizeof(rx_aggr_hole_event->hole_info_array[0]))) {
+		WMA_LOGE("%s: Excess data from WMI num_failure_info %d",
+			 __func__, rx_aggr_failure_info->num_failure_info);
+		return -EINVAL;
+	}
+
+	alloc_len = sizeof(*rx_aggr_hole_event) +
+		(rx_aggr_failure_info->num_failure_info)*
+		sizeof(rx_aggr_hole_event->hole_info_array[0]);
+	rx_aggr_hole_event = vos_mem_malloc(alloc_len);
+	if (NULL == rx_aggr_hole_event) {
+		WMA_LOGE("%s: Memory allocation failure", __func__);
+		return -ENOMEM;
+	}
+
+	rx_aggr_hole_event->hole_cnt = rx_aggr_failure_info->num_failure_info;
+	WMA_LOGD("aggr holes_sum: %d\n",
+		rx_aggr_failure_info->num_failure_info);
+	for (i = 0; i < rx_aggr_hole_event->hole_cnt; i++) {
+		rx_aggr_hole_event->hole_info_array[i] =
+			hole_info->end_seq - hole_info->start_seq + 1;
+		WMA_LOGD("aggr_index: %d\tstart_seq: %d\tend_seq: %d\t"
+			"hole_info: %d mpdu lost",
+			i, hole_info->start_seq, hole_info->end_seq,
+			rx_aggr_hole_event->hole_info_array[i]);
+		hole_info++;
+	}
+
+	vos_msg.type = eWNI_SME_RX_AGGR_HOLE_IND;
+	vos_msg.bodyptr = rx_aggr_hole_event;
+	vos_msg.bodyval = 0;
+
+	status = vos_mq_post_message(VOS_MQ_ID_SME, &vos_msg);
+	if (status != VOS_STATUS_SUCCESS) {
+		WMA_LOGE("%s: Failed to post stats ext event to SME", __func__);
+		vos_mem_free(rx_aggr_hole_event);
+		return -EINVAL;
+	}
+
+	WMA_LOGD("%s: stats ext event Posted to SME", __func__);
+
+	return 0;
+}
 #endif
 
 /**
@@ -7039,7 +8802,8 @@ wma_chan_info_event_handler(void *handle, u_int8_t *event_buf,
 	wmi_chan_info_event_fixed_param *event;
 	struct scan_chan_info buf;
 	tpAniSirGlobal mac = NULL;
-        struct lim_channel_status *channel_status;
+	struct lim_channel_status *channel_status;
+
 	WMA_LOGD("%s: Enter", __func__);
 
 	if (wma != NULL && wma->vos_context != NULL) {
@@ -7074,24 +8838,26 @@ wma_chan_info_event_handler(void *handle, u_int8_t *event_buf,
 		buf.rx_clear_count = event->rx_clear_count;
 		mac->chan_info_cb(&buf);
 	}
-       if (ACS_FW_REPORT_PARAM_CONFIGURED &&
-	        mac->sme.currDeviceMode == VOS_STA_SAP_MODE) {
-               param_buf = (WMI_CHAN_INFO_EVENTID_param_tlvs *) event_buf;
-               if (!param_buf)  {
-                       WMA_LOGE("Invalid chan info event buffer");
-                       return -EINVAL;
-               }
-               event = param_buf->fixed_param;
-	       		channel_status =
+
+	if (ACS_FW_REPORT_PARAM_CONFIGURED &&
+		 mac->sme.currDeviceMode == VOS_STA_SAP_MODE) {
+		param_buf = (WMI_CHAN_INFO_EVENTID_param_tlvs *) event_buf;
+		if (!param_buf)  {
+			WMA_LOGE("Invalid chan info event buffer");
+			return -EINVAL;
+		}
+		event = param_buf->fixed_param;
+		channel_status =
 			vos_mem_malloc(sizeof(*channel_status));
 		if (!channel_status) {
 			WMA_LOGE(FL("Mem alloc fail"));
 			return -ENOMEM;
- 		}
+		}
 		WMA_LOGI(FL("freq=%d nf=%d rx_cnt=%u cycle_count=%u "
 			    "tx_pwr_range=%d tx_pwr_tput=%d "
 			    "rx_frame_count=%u my_bss_rx_cycle_count=%u "
-			    "rx_11b_mode_data_duration=%d cmd_flags=%d"),
+			    "rx_11b_mode_data_duration=%d "
+			    "tx_frame_cnt=%d mac_clk_mhz=%d cmd_flags=%d"),
 			 event->freq,
 			 event->noise_floor,
 			 event->rx_clear_count,
@@ -7101,6 +8867,8 @@ wma_chan_info_event_handler(void *handle, u_int8_t *event_buf,
 			 event->rx_frame_count,
 			 event->my_bss_rx_cycle_count,
 			 event->rx_11b_mode_data_duration,
+			 event->tx_frame_cnt,
+			 event->mac_clk_mhz,
 			 event->cmd_flags
 			);
 
@@ -7119,6 +8887,10 @@ wma_chan_info_event_handler(void *handle, u_int8_t *event_buf,
 			event->my_bss_rx_cycle_count;
 		channel_status->rx_11b_mode_data_duration =
 			event->rx_11b_mode_data_duration;
+		channel_status->tx_frame_count =
+			event->tx_frame_cnt;
+		channel_status->mac_clk_mhz =
+			event->mac_clk_mhz;
 		channel_status->channel_id =
 			vos_freq_to_chan(event->freq);
 		channel_status->cmd_flags =
@@ -7127,7 +8899,7 @@ wma_chan_info_event_handler(void *handle, u_int8_t *event_buf,
 		wma_send_msg(handle,
 			WDA_RX_CHN_STATUS_EVENT,
 			 (void *) channel_status, 0);
-        } 
+	}
 	return 0;
 }
 
@@ -7169,14 +8941,50 @@ wma_register_extscan_event_handler(tp_wma_handle wma_handle)
 			WMI_PASSPOINT_MATCH_EVENTID,
 			wma_passpoint_match_event_handler);
 
-	wmi_unified_register_event_handler(wma_handle->wmi_handle,
-			WMI_EXTSCAN_HOTLIST_SSID_MATCH_EVENTID,
-			wma_extscan_hotlist_ssid_match_event_handler);
-
 	return;
 
 }
 
+static int wma_antenna_isolation_event_handler(void *handle,
+                   u_int8_t *param, u_int32_t len)
+{
+    tp_wma_handle wma = (tp_wma_handle)handle;
+    wmi_coex_report_isolation_event_fixed_param *event;
+    WMI_COEX_REPORT_ANTENNA_ISOLATION_EVENTID_param_tlvs *param_buf;
+    struct sir_isolation_resp isolation;
+    tpAniSirGlobal mac = NULL;
+    WMA_LOGE("%s: handle %pK param %pK len %d", __func__, handle, param, len);
+
+    if(wma != NULL && wma->vos_context != NULL) {
+        mac = (tpAniSirGlobal)vos_get_context(
+                VOS_MODULE_ID_PE, wma->vos_context);
+    }
+    if (!mac) {
+        WMA_LOGE("%s: Invalid mac context", __func__);
+        return -EINVAL;
+    }
+
+    param_buf =
+        (WMI_COEX_REPORT_ANTENNA_ISOLATION_EVENTID_param_tlvs *)param;
+    if (!param_buf) {
+        WMA_LOGE("%s: Invalid isolation event", __func__);
+        return -EINVAL;
+    }
+    event = param_buf->fixed_param;
+    isolation.isolation_chain0 = event->isolation_chain0;
+    isolation.isolation_chain1 = event->isolation_chain1;
+    isolation.isolation_chain2 = event->isolation_chain2;
+    isolation.isolation_chain3 = event->isolation_chain3;
+
+    printk("\n*********************ANTENNA ISOLATION********************\n");
+
+    WMA_LOGD("%s: chain1 %d chain2 %d chain3 %d chain4 %d", __func__,
+            isolation.isolation_chain0, isolation.isolation_chain1,
+            isolation.isolation_chain2, isolation.isolation_chain3);
+    mac->sme.get_isolation(&isolation, mac->sme.get_isolation_cb_context);
+    return 0;
+}
+
 void wma_wow_tx_complete(void *wma)
 {
 	tp_wma_handle wma_handle = (tp_wma_handle)wma;
@@ -7204,6 +9012,54 @@ static void wma_set_nan_enable(tp_wma_handle wma_handle,
 }
 #endif
 
+#ifdef WLAN_FEATURE_TSF_PLUS
+/**
+ * wma_update_ptp_params() - update bundle params
+ * @olCfg: cfg handle
+ * @mac_params: mac params
+ *
+ * Return: none
+ */
+static
+void wma_update_ptp_params(struct txrx_pdev_cfg_param_t *olCfg,
+		tMacOpenParameters *mac_params)
+{
+	olCfg->is_ptp_enabled = mac_params->is_ptp_enabled;
+}
+#else
+static
+void wma_update_ptp_params(struct txrx_pdev_cfg_param_t *olCfg,
+		tMacOpenParameters *mac_params)
+{
+	return;
+}
+#endif
+
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+/**
+ * cfg_update_del_ack_params() - update del ack parameters
+ * @olCfg: cfg handle
+ * @mac_params: mac params
+ *
+ * Return: none
+ */
+static
+void cfg_update_del_ack_params(struct txrx_pdev_cfg_param_t *olCfg,
+				tMacOpenParameters *mac_params)
+{
+	olCfg->del_ack_enable = mac_params->del_ack_enable;
+	olCfg->del_ack_timer_value = mac_params->del_ack_timer_value;
+	olCfg->del_ack_pkt_count = mac_params->del_ack_pkt_count;
+}
+#else
+static
+void cfg_update_del_ack_params(struct txrx_pdev_cfg_param_t *olCfg,
+				tMacOpenParameters *mac_params)
+{
+}
+#endif
+
+
 #ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
 /**
  * ol_cfg_update_bundle_params() - update bundle params
@@ -7390,6 +9246,59 @@ static void wma_register_debug_callback(void)
 	vos_register_debug_callback(VOS_MODULE_ID_WDA, &wma_state_info_dump);
 }
 
+/**
+ * wma_action_frame_filter_mac_event_handler() - action frame filter evt handler
+ * @handle: wma handle
+ * @event_buf: event handler data
+ * @len: length of @event_buf
+ *
+ * this function will handle the
+ * WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_STATUS_EVENTID
+ *
+ * Return: int
+ */
+static int
+wma_action_frame_filter_mac_event_handler(void *handle, u_int8_t *event_buf,
+						u_int32_t len)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle)handle;
+	WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_STATUS_EVENTID_param_tlvs *param_buf;
+	wmi_vdev_add_mac_addr_to_rx_filter_status_event_fixed_param *event;
+	struct action_frame_random_filter *filter;
+	struct wma_txrx_node *intr;
+	bool status = false;
+
+	WMA_LOGD("%s: Enter", __func__);
+
+	param_buf =
+		(WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_STATUS_EVENTID_param_tlvs *)event_buf;
+	if (!param_buf) {
+		WMA_LOGA(FL("Invalid action frame filter mac event"));
+		return -EINVAL;
+	}
+	event = param_buf->fixed_param;
+	if (!event) {
+		WMA_LOGA(FL("Invalid fixed param"));
+		return -EINVAL;
+	}
+
+	intr = &wma_handle->interfaces[event->vdev_id];
+	/* command is in progess */
+	if(!intr->action_frame_filter) {
+		WMA_LOGE(FL("no action frame req is pending - invalid event"));
+		return -1;
+	}
+	filter = intr->action_frame_filter;
+	if (event->status)
+		status = true;
+
+	(filter->callback)(status, filter->context);
+	intr->action_frame_filter = NULL;
+	vos_mem_free(filter);
+
+	return 0;
+}
+
 struct wma_version_info g_wmi_version_info;
 
 /*
@@ -7398,6 +9307,7 @@ struct wma_version_info g_wmi_version_info;
 VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 		    wda_tgt_cfg_cb tgt_cfg_cb,
 		    wda_dfs_radar_indication_cb radar_ind_cb,
+		    wda_dfs_block_tx_cb dfs_block_tx_cb,
 		    tMacOpenParameters *mac_params)
 {
 	tp_wma_handle wma_handle;
@@ -7443,7 +9353,20 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 		vos_wake_lock_init(&wma_handle->extscan_wake_lock,
 					"wlan_extscan_wl");
 #endif
-		vos_wake_lock_init(&wma_handle->wow_wake_lock, "wlan_wow_wl");
+		vos_wake_lock_init(&wma_handle->wow_wake_lock,
+			"wlan_wow_wl");
+		vos_wake_lock_init(&wma_handle->wow_auth_req_wl,
+			"wlan_auth_req_wl");
+		vos_wake_lock_init(&wma_handle->wow_assoc_req_wl,
+			"wlan_assoc_req_wl");
+		vos_wake_lock_init(&wma_handle->wow_deauth_rec_wl,
+			"wlan_deauth_rec_wl");
+		vos_wake_lock_init(&wma_handle->wow_disassoc_rec_wl,
+			"wlan_disassoc_rec_wl");
+		vos_wake_lock_init(&wma_handle->wow_ap_assoc_lost_wl,
+			"wlan_ap_assoc_lost_wl");
+		vos_wake_lock_init(&wma_handle->wow_auto_shutdown_wl,
+			"wlan_auto_shutdown_wl");
 	}
 
 	/* attach the wmi */
@@ -7490,8 +9413,9 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 #endif
 
 	ol_cfg_update_bundle_params(&olCfg, mac_params);
+	cfg_update_del_ack_params(&olCfg, mac_params);
 	ol_cfg_update_ac_specs_params(&olCfg, mac_params);
-
+ 	wma_update_ptp_params(&olCfg, mac_params);
 	((pVosContextType) vos_context)->cfg_ctx =
 		ol_pdev_cfg_attach(((pVosContextType) vos_context)->adf_ctx, olCfg);
 	if (!(((pVosContextType) vos_context)->cfg_ctx)) {
@@ -7508,6 +9432,12 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 	wdi_in_set_cfg_pakcet_log_enabled((ol_pdev_handle)
 		((pVosContextType)vos_context)->cfg_ctx, (u_int8_t)vos_is_packet_log_enabled());
 
+	/* adjust the ptp rx option default value based on CFG INI setting */
+	wdi_in_set_cfg_ptp_rx_opt_enabled((ol_pdev_handle)
+					  ((pVosContextType)
+					   vos_context)->cfg_ctx,
+					  (u_int8_t)
+					  vos_is_ptp_rx_opt_enabled());
 
 	/* Allocate dfs_ic and initialize DFS */
 	wma_handle->dfs_ic = wma_dfs_attach(wma_handle->dfs_ic);
@@ -7560,6 +9490,8 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 	wma_handle->ssdp = mac_params->ssdp;
 	wma_handle->enable_mc_list = mac_params->enable_mc_list;
 	wma_handle->enable_bcst_ptrn = mac_params->enable_bcst_ptrn;
+	wma_handle->bpf_packet_filter_enable =
+		mac_params->bpf_packet_filter_enable;
 #ifdef FEATURE_WLAN_RA_FILTERING
 	wma_handle->IsRArateLimitEnabled = mac_params->IsRArateLimitEnabled;
 	wma_handle->RArateLimitInterval = mac_params->RArateLimitInterval;
@@ -7588,6 +9520,7 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 
 	wma_handle->tgt_cfg_update_cb = tgt_cfg_cb;
 	wma_handle->dfs_radar_indication_cb = radar_ind_cb;
+	wma_handle->dfs_block_tx_cb = dfs_block_tx_cb;
 
         vos_status = vos_event_init(&wma_handle->wma_ready_event);
 	if (vos_status != VOS_STATUS_SUCCESS) {
@@ -7651,6 +9584,8 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 	adf_os_spinlock_init(&wma_handle->roam_synch_lock);
 #endif
 	adf_os_atomic_init(&wma_handle->is_wow_bus_suspended);
+	adf_os_atomic_init(&wma_handle->dfs_wmi_event_pending);
+	adf_os_atomic_init(&wma_handle->dfs_wmi_event_dropped);
 
 	/* Register vdev start response event handler */
 	wmi_unified_register_event_handler(wma_handle->wmi_handle,
@@ -7671,6 +9606,11 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 	wmi_unified_register_event_handler(wma_handle->wmi_handle,
 					   WMI_UPDATE_STATS_EVENTID,
 					   wma_stats_event_handler);
+	/* register for peer info response event */
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					   WMI_PEER_STATS_INFO_EVENTID,
+					   wma_peer_info_event_handler);
+
 	/* register for linkspeed response event */
 	wmi_unified_register_event_handler(wma_handle->wmi_handle,
 						WMI_PEER_ESTIMATED_LINKSPEED_EVENTID,
@@ -7722,12 +9662,6 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 	wma_register_ll_stats_event_handler(wma_handle);
 
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
-	/* Register event handler to receive firmware mem dump
-	 * copy complete indication
-	 */
-	wmi_unified_register_event_handler(wma_handle->wmi_handle,
-		WMI_UPDATE_FW_MEM_DUMP_EVENTID,
-		wma_fw_mem_dump_event_handler);
 
 	wmi_set_tgt_assert(wma_handle->wmi_handle,
 			   mac_params->force_target_assert_enabled);
@@ -7785,14 +9719,24 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
         wmi_unified_register_event_handler(wma_handle->wmi_handle,
 					   WMI_STATS_EXT_EVENTID,
 					   wma_stats_ext_event_handler);
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					WMI_REPORT_RX_AGGR_FAILURE_EVENTID,
+					wma_rx_aggr_failure_event_handler);
 #endif
 #ifdef FEATURE_WLAN_EXTSCAN
 	wma_register_extscan_event_handler(wma_handle);
 #endif
 
 	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					WMI_PDEV_DIV_RSSI_ANTID_EVENTID,
+					wma_pdev_div_info_evt_handler);
+
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
 					WMI_BPF_CAPABILIY_INFO_EVENTID,
 					wma_get_bpf_caps_event_handler);
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+				WMI_PDEV_CHIP_POWER_STATS_EVENTID,
+				wma_unified_power_debug_stats_event_handler);
 
 	WMA_LOGD("%s: Exit", __func__);
 
@@ -7810,6 +9754,18 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 				WMI_CHAN_INFO_EVENTID,
 				wma_chan_info_event_handler);
 
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+			WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_STATUS_EVENTID,
+			wma_action_frame_filter_mac_event_handler);
+
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+		WMI_PDEV_CHIP_POWER_SAVE_FAILURE_DETECTED_EVENTID,
+		wma_chip_power_save_failure_detected_handler);
+
+     wmi_unified_register_event_handler(wma_handle->wmi_handle,
+                WMI_COEX_REPORT_ANTENNA_ISOLATION_EVENTID,
+                wma_antenna_isolation_event_handler);
+
 	wma_register_debug_callback();
 	wma_ndp_register_all_event_handlers(wma_handle);
 
@@ -7845,6 +9801,12 @@ err_wma_handle:
 		vos_wake_lock_destroy(&wma_handle->extscan_wake_lock);
 #endif
 		vos_wake_lock_destroy(&wma_handle->wow_wake_lock);
+		vos_wake_lock_destroy(&wma_handle->wow_auth_req_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_assoc_req_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_deauth_rec_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_disassoc_rec_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_ap_assoc_lost_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_auto_shutdown_wl);
 	}
 
 	wma_runtime_context_deinit(wma_handle);
@@ -8080,7 +10042,7 @@ void wma_vdev_detach_callback(void *ctx)
 			      vos_get_global_context(VOS_MODULE_ID_WDA, NULL));
 
 	if (!wma || !iface->del_staself_req) {
-		WMA_LOGP("%s: wma %p iface %p", __func__, wma,
+		WMA_LOGP("%s: wma %pK iface %pK", __func__, wma,
 			 iface->del_staself_req);
 		return;
 	}
@@ -8127,8 +10089,9 @@ static VOS_STATUS wma_vdev_detach(tp_wma_handle wma_handle,
 	struct wma_txrx_node *iface = &wma_handle->interfaces[vdev_id];
 	struct wma_target_req *msg;
 
-	if ((iface->type == WMI_VDEV_TYPE_AP) &&
-	    (iface->sub_type == WMI_UNIFIED_VDEV_SUBTYPE_P2P_DEVICE)) {
+	if (((iface->type == WMI_VDEV_TYPE_AP) &&
+	     (iface->sub_type == WMI_UNIFIED_VDEV_SUBTYPE_P2P_DEVICE)) ||
+	    (iface->type == WMI_VDEV_TYPE_MONITOR)) {
 
 		WMA_LOGA("P2P Device: removing self peer %pM",
 				pdel_sta_self_req_param->selfMacAddr);
@@ -8182,7 +10145,7 @@ static VOS_STATUS wma_vdev_detach(tp_wma_handle wma_handle,
         }
 
 
-        WMA_LOGD("vdev_id:%hu vdev_hdl:%p", vdev_id, iface->handle);
+        WMA_LOGD("vdev_id:%hu vdev_hdl:%pK", vdev_id, iface->handle);
         if (!generateRsp) {
                 WMA_LOGE("Call txrx detach w/o callback for vdev %d", vdev_id);
                 ol_txrx_vdev_detach(iface->handle, NULL, NULL);
@@ -8358,8 +10321,8 @@ static void wma_set_sta_keep_alive(tp_wma_handle wma, u_int8_t vdev_id,
 		if ((NULL == hostv4addr) ||
 			(NULL == destv4addr) ||
 			(NULL == destmac)) {
-			WMA_LOGE("%s: received null pointer, hostv4addr:%p "
-			   "destv4addr:%p destmac:%p ", __func__,
+			WMA_LOGE("%s: received null pointer, hostv4addr:%pK "
+			   "destv4addr:%pK destmac:%pK ", __func__,
 			   hostv4addr, destv4addr, destmac);
 			wmi_buf_free(buf);
 			return;
@@ -8416,6 +10379,131 @@ static inline void wma_get_link_probe_timeout(struct sAniSirGlobal *mac,
 	*max_unresponsive_time = *max_inactive_time + keep_alive;
 }
 
+/**
+ * wma_verify_rate_code() - verify if rate code is valid.
+ * @rate_code:     rate code
+ *
+ * Return: verify result
+ */
+static bool wma_verify_rate_code(u_int32_t rate_code)
+{
+	uint8_t preamble, nss, rate;
+	bool valid = true;
+
+	preamble = (rate_code & 0xc0) >> 6;
+	nss = (rate_code & 0x30) >> 4;
+	rate = rate_code & 0xf;
+
+	switch (preamble) {
+	case WMI_RATE_PREAMBLE_CCK:
+		if (nss != 0 || rate > 3)
+			valid = false;
+		break;
+	case WMI_RATE_PREAMBLE_OFDM:
+		if (nss != 0 || rate > 7)
+			valid = false;
+		break;
+	case WMI_RATE_PREAMBLE_HT:
+		if (nss > 1 || rate > 7)
+			valid = false;
+		break;
+	case WMI_RATE_PREAMBLE_VHT:
+		if (nss > 1 || rate > 9)
+			valid = false;
+		break;
+	default:
+		break;
+	}
+	return valid;
+}
+
+#define TX_MGMT_RATE_2G_ENABLE_OFFSET 30
+#define TX_MGMT_RATE_5G_ENABLE_OFFSET 31
+#define TX_MGMT_RATE_2G_OFFSET 0
+#define TX_MGMT_RATE_5G_OFFSET 12
+
+/**
+ * wma_set_mgmt_rate() - set vdev mgmt rate.
+ * @wma:     wma handle
+ * @vdev_id: vdev id
+ *
+ * Return: None
+ */
+static void wma_set_vdev_mgmt_rate(tp_wma_handle wma, u_int8_t vdev_id)
+{
+	uint32_t cfg_val;
+	int ret;
+	uint32_t per_band_mgmt_tx_rate = 0;
+	struct sAniSirGlobal *mac =
+	    (struct sAniSirGlobal*)vos_get_context(VOS_MODULE_ID_PE,
+						       wma->vos_context);
+
+	if (NULL == mac) {
+		WMA_LOGE("%s: Failed to get mac", __func__);
+		return;
+	}
+
+	if (wlan_cfgGetInt(mac, WNI_CFG_RATE_FOR_TX_MGMT,
+			   &cfg_val) == eSIR_SUCCESS) {
+		if ((cfg_val == WNI_CFG_RATE_FOR_TX_MGMT_STADEF) ||
+		    !wma_verify_rate_code(cfg_val)) {
+			WMA_LOGE("invalid rate code, ignore.");
+		} else {
+			ret = wmi_unified_vdev_set_param_send(
+				wma->wmi_handle,
+				vdev_id,
+				WMI_VDEV_PARAM_MGMT_TX_RATE,
+				cfg_val);
+			if (ret)
+				WMA_LOGE("Failed to set "
+					"WMI_VDEV_PARAM_MGMT_TX_RATE");
+		}
+	} else {
+		WMA_LOGE("Failed to get value of "
+			"WNI_CFG_RATE_FOR_TX_MGMT");
+	}
+
+	if (wlan_cfgGetInt(mac, WNI_CFG_RATE_FOR_TX_MGMT_2G,
+			   &cfg_val) == eSIR_SUCCESS) {
+		if ((cfg_val == WNI_CFG_RATE_FOR_TX_MGMT_2G_STADEF) ||
+		    !wma_verify_rate_code(cfg_val)) {
+			per_band_mgmt_tx_rate &=
+			    ~(1 << TX_MGMT_RATE_2G_ENABLE_OFFSET);
+		} else {
+			per_band_mgmt_tx_rate |=
+			    (1 << TX_MGMT_RATE_2G_ENABLE_OFFSET);
+			per_band_mgmt_tx_rate |=
+			    ((cfg_val & 0x7FF) << TX_MGMT_RATE_2G_OFFSET);
+		}
+	} else {
+		WMA_LOGE("Failed to get value of WNI_CFG_RATE_FOR_TX_MGMT_2G");
+	}
+
+	if (wlan_cfgGetInt(mac, WNI_CFG_RATE_FOR_TX_MGMT_5G,
+			   &cfg_val) == eSIR_SUCCESS) {
+		if ((cfg_val == WNI_CFG_RATE_FOR_TX_MGMT_5G_STADEF) ||
+		    !wma_verify_rate_code(cfg_val)) {
+			per_band_mgmt_tx_rate &=
+			    ~(1 << TX_MGMT_RATE_5G_ENABLE_OFFSET);
+		} else {
+			per_band_mgmt_tx_rate |=
+			    (1 << TX_MGMT_RATE_5G_ENABLE_OFFSET);
+			per_band_mgmt_tx_rate |=
+			    ((cfg_val & 0x7FF) << TX_MGMT_RATE_5G_OFFSET);
+		}
+	} else {
+		WMA_LOGE("Failed to get value of WNI_CFG_RATE_FOR_TX_MGMT_5G");
+	}
+
+	ret = wmi_unified_vdev_set_param_send(
+		wma->wmi_handle,
+		vdev_id,
+		WMI_VDEV_PARAM_PER_BAND_MGMT_TX_RATE,
+		per_band_mgmt_tx_rate);
+	if (ret)
+		WMA_LOGE("Failed to set WMI_VDEV_PARAM_PER_BAND_MGMT_TX_RATE");
+}
+
 static void wma_set_sap_keepalive(tp_wma_handle wma, u_int8_t vdev_id)
 {
 	tANI_U32 min_inactive_time, max_inactive_time, max_unresponsive_time;
@@ -8796,7 +10884,7 @@ static ol_txrx_vdev_handle wma_vdev_attach(tp_wma_handle wma_handle,
 						txrx_vdev_type);
 	wma_handle->interfaces[self_sta_req->sessionId].pause_bitmap = 0;
 
-	WMA_LOGD("vdev_id %hu, txrx_vdev_handle = %p", self_sta_req->sessionId,
+	WMA_LOGD("vdev_id %hu, txrx_vdev_handle = %pK", self_sta_req->sessionId,
 			txrx_vdev_handle);
 
 	if (NULL == txrx_vdev_handle) {
@@ -8963,6 +11051,8 @@ static ol_txrx_vdev_handle wma_vdev_attach(tp_wma_handle wma_handle,
 	} else {
 		WMA_LOGE("Failed to get value of HT_CAP, TX STBC unchanged");
 	}
+
+	wma_set_vdev_mgmt_rate(wma_handle, self_sta_req->sessionId);
 	/* Initialize roaming offload state */
 	if ((self_sta_req->type == WMI_VDEV_TYPE_STA) &&
 			(self_sta_req->subType == 0)) {
@@ -9216,6 +11306,8 @@ VOS_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle,
 	u_int8_t SSID_num;
 	int i;
 	int len = sizeof(*cmd);
+	wmi_vendor_oui *voui = NULL;
+	struct vendor_oui *pvoui = NULL;
 	tpAniSirGlobal pMac = (tpAniSirGlobal )vos_get_context(VOS_MODULE_ID_PE,
 				wma_handle->vos_context);
 
@@ -9240,6 +11332,10 @@ VOS_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle,
 	if (scan_req->uIEFieldLen)
 		len += roundup(scan_req->uIEFieldLen, sizeof(u_int32_t));
 
+	len += WMI_TLV_HDR_SIZE; /* Length of TLV for array of wmi_vendor_oui */
+	if (scan_req->num_vendor_oui)
+		len += scan_req->num_vendor_oui * sizeof(wmi_vendor_oui);
+
 	/* Allocate the memory */
 	*buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
         if (!*buf) {
@@ -9334,6 +11430,15 @@ VOS_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle,
 	 */
 	cmd->burst_duration = 0;
 
+	/* mac randomization attributes */
+	if (scan_req->enable_scan_randomization) {
+		cmd->scan_ctrl_flags |= WMI_SCAN_ADD_SPOOFED_MAC_IN_PROBE_REQ |
+					WMI_SCAN_RANDOM_SEQ_NO_IN_PROBE_REQ;
+		WMI_CHAR_ARRAY_TO_MAC_ADDR(scan_req->mac_addr, &cmd->mac_addr);
+		WMI_CHAR_ARRAY_TO_MAC_ADDR(scan_req->mac_addr_mask,
+						&cmd->mac_mask);
+	}
+
 	if (!scan_req->p2pScanType) {
 		WMA_LOGD("Normal Scan request");
 		cmd->scan_ctrl_flags |= WMI_SCAN_ADD_CCK_RATES;
@@ -9341,18 +11446,30 @@ VOS_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle,
                         cmd->scan_ctrl_flags |= WMI_SCAN_ADD_BCAST_PROBE_REQ;
 		if (scan_req->scanType == eSIR_PASSIVE_SCAN)
 			cmd->scan_ctrl_flags |= WMI_SCAN_FLAG_PASSIVE;
-                if (ACS_FW_REPORT_PARAM_CONFIGURED) {
-                       /* add chan stat info report tag */
-	               if (scan_req->bssType == eSIR_INFRA_AP_MODE) {
-                                cmd->scan_ctrl_flags |=
-                                       WMI_SCAN_CHAN_STAT_EVENT;
-                                WMA_LOGI("set ACS ctrl BIT");
-                       }
-                }
+
+		if (ACS_FW_REPORT_PARAM_CONFIGURED) {
+			/* add chan stat info report tag */
+			if (scan_req->bssType == eSIR_INFRA_AP_MODE) {
+				cmd->scan_ctrl_flags |=
+					WMI_SCAN_CHAN_STAT_EVENT;
+				WMA_LOGI("set ACS ctrl BIT");
+			}
+		}
+
 
 		cmd->scan_ctrl_flags |= WMI_SCAN_ADD_TPC_IE_IN_PROBE_REQ;
 		cmd->scan_ctrl_flags |= WMI_SCAN_FILTER_PROBE_REQ;
 
+		if (scan_req->ie_whitelist) {
+			cmd->scan_ctrl_flags |=
+				WMI_SCAN_ENABLE_IE_WHTELIST_IN_PROBE_REQ;
+			for (i = 0; i < PROBE_REQ_BITMAP_LEN; i++)
+				cmd->ie_bitmap[i] =
+					scan_req->probe_req_ie_bitmap[i];
+		}
+
+		cmd->num_vendor_oui = scan_req->num_vendor_oui;
+
 		/*
 		 * Decide burst_duration and dwell_time_active based on
 		 * what type of devices are active.
@@ -9428,8 +11545,14 @@ VOS_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle,
 		    }
 		    if (wma_is_STA_active(wma_handle) ||
 			wma_is_P2P_CLI_active(wma_handle)) {
-			/* Typical background scan. Disable burst scan for now. */
-			cmd->burst_duration = 0;
+			if (scan_req->burst_scan_duration)
+				cmd->burst_duration =
+						scan_req->burst_scan_duration;
+			else
+				/* Typical background scan.
+				 * Disable burst scan for now.
+				 */
+				cmd->burst_duration = 0;
 			break;
 		    }
 		} while (0);
@@ -9552,6 +11675,29 @@ VOS_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle,
 	}
 	buf_ptr += WMI_TLV_HDR_SIZE + ie_len_with_pad;
 
+	/* mac randomization */
+	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		       scan_req->num_vendor_oui *
+		       sizeof(wmi_vendor_oui));
+
+	buf_ptr += WMI_TLV_HDR_SIZE;
+
+	if (cmd->num_vendor_oui != 0) {
+		voui = (wmi_vendor_oui *)buf_ptr;
+		pvoui = (struct vendor_oui *)((u_int8_t *)scan_req +
+			(scan_req->oui_field_offset));
+		for (i = 0; i < cmd->num_vendor_oui; i++) {
+			WMITLV_SET_HDR(&voui[i].tlv_header,
+				WMITLV_TAG_STRUC_wmi_vendor_oui,
+				WMITLV_GET_STRUCT_TLVLEN(
+				wmi_vendor_oui));
+			voui[i].oui_type_subtype = pvoui[i].oui_type |
+						(pvoui[i].oui_subtype << 24);
+		}
+		buf_ptr += cmd->num_vendor_oui *
+				sizeof(wmi_vendor_oui);
+	}
+
 	*buf_len = len;
 	return VOS_STATUS_SUCCESS;
 error:
@@ -9890,16 +12036,17 @@ VOS_STATUS wma_start_scan(tp_wma_handle wma_handle,
 	int len;
 	tSirScanOffloadEvent *scan_event;
 
-	if (scan_req->sessionId > wma_handle->max_bssid) {
+	if (scan_req->sessionId >= wma_handle->max_bssid) {
 		WMA_LOGE("%s: Invalid vdev_id %d, msg_type : 0x%x", __func__,
 			scan_req->sessionId, msg_type);
+		vos_status = VOS_STATUS_E_FAILURE;
 		goto error1;
 	}
 
 	/* Sanity check to find whether vdev id active or not */
-	if (msg_type != WDA_START_SCAN_OFFLOAD_REQ &&
-            !wma_handle->interfaces[scan_req->sessionId].handle) {
-		WMA_LOGA("vdev id [%d] is not active", scan_req->sessionId);
+	if (!wma_handle->interfaces[scan_req->sessionId].handle) {
+		WMA_LOGE("vdev id [%d] is not active", scan_req->sessionId);
+		vos_status = VOS_STATUS_E_FAILURE;
 		goto error1;
 	}
         if (msg_type == WDA_START_SCAN_OFFLOAD_REQ) {
@@ -9923,6 +12070,7 @@ VOS_STATUS wma_start_scan(tp_wma_handle wma_handle,
 
 	if (NULL == buf) {
 		WMA_LOGE("Failed to get buffer for saving current scan info");
+		vos_status = VOS_STATUS_E_NOMEM;
 		goto error0;
 	}
 
@@ -9945,6 +12093,9 @@ VOS_STATUS wma_start_scan(tp_wma_handle wma_handle,
 			cmd->scan_req_id, cmd->vdev_id,
 			scan_req->p2pScanType);
 
+	if (scan_req->p2pScanType)
+		cmd->scan_priority = WMI_SCAN_PRIORITY_MEDIUM;
+
 	WMA_LOGD("scan_id %x, vdev_id %x, scan type %x, msg_type %x",
 			cmd->scan_id, cmd->vdev_id, scan_req->p2pScanType,
 			msg_type);
@@ -9966,8 +12117,6 @@ VOS_STATUS wma_start_scan(tp_wma_handle wma_handle,
 		goto error;
 	}
 
-	WMA_LOGI("WMA --> WMI_START_SCAN_CMDID");
-
 	/* Update the scan parameters for handler */
 	wma_handle->wma_scan_timer_info.vdev_id = vdev_id;
 	wma_handle->wma_scan_timer_info.scan_id = scan_id;
@@ -12428,6 +14577,7 @@ VOS_STATUS wma_switch_channel(tp_wma_handle wma, struct wma_vdev_start_req *req)
 	intr[req->vdev_id].config.gtx_info.gtxBWMask =
 					CFG_TGT_DEFAULT_GTX_BW_MASK;
 	intr[req->vdev_id].mhz = cmd->mhz;
+	intr[req->vdev_id].channelwidth = req->channelwidth;
 
 	WMI_SET_CHANNEL_MODE(cmd, chanmode);
 	cmd->band_center_freq1 = cmd->mhz;
@@ -12451,6 +14601,9 @@ VOS_STATUS wma_switch_channel(tp_wma_handle wma, struct wma_vdev_start_req *req)
 	else if (req->is_quarter_rate)
 		WMI_SET_CHANNEL_FLAG(cmd, WMI_CHAN_FLAG_QUARTER_RATE);
 
+	WMA_LOGE("switch chan width: quarterrate_flag: %d, halfrate_flag: %d",
+		 req->is_quarter_rate, req->is_half_rate);
+
 	/* Find out min, max and regulatory power levels */
 	WMI_SET_CHANNEL_REG_POWER(cmd, req->max_txpow);
 	WMI_SET_CHANNEL_MAX_TX_POWER(cmd, req->max_txpow);
@@ -12583,6 +14736,7 @@ VOS_STATUS wma_vdev_start(tp_wma_handle wma,
 	intr[cmd->vdev_id].config.gtx_info.gtxTPCMin = CFG_TGT_DEFAULT_GTX_TPC_MIN;
 	intr[cmd->vdev_id].config.gtx_info.gtxBWMask = CFG_TGT_DEFAULT_GTX_BW_MASK;
 	intr[cmd->vdev_id].mhz = chan->mhz;
+	intr[req->vdev_id].channelwidth = req->channelwidth;
 
 	WMI_SET_CHANNEL_MODE(chan, chanmode);
 	chan->band_center_freq1 = chan->mhz;
@@ -12607,6 +14761,9 @@ VOS_STATUS wma_vdev_start(tp_wma_handle wma,
 		WMI_SET_CHANNEL_FLAG(chan, WMI_CHAN_FLAG_QUARTER_RATE);
 	}
 
+	WMA_LOGE("BSS chan width: quarterrate_flag: %d, halfrate_flag: %d",
+		 req->is_quarter_rate, req->is_half_rate);
+
 	/*
 	 * If the channel has DFS set, flip on radar reporting.
 	 *
@@ -12672,6 +14829,8 @@ VOS_STATUS wma_vdev_start(tp_wma_handle wma,
 			wma_unified_dfs_phyerr_filter_offload_enable(wma);
 			dfs->disable_dfs_ch_switch =
 				pmac->sap.SapDfsInfo.disable_dfs_ch_switch;
+			dfs->dfs_enable_radar_war =
+				pmac->sap.SapDfsInfo.sap_enable_radar_war;
 		}
 	}
 
@@ -12858,7 +15017,7 @@ void wma_vdev_resp_timer(void *data)
 		struct beacon_info *bcn;
 		struct wma_txrx_node *iface;
 
-		if (tgt_req->vdev_id > wma->max_bssid) {
+		if (tgt_req->vdev_id >= wma->max_bssid) {
 			WMA_LOGE("%s: Invalid vdev_id %d", __func__,
 				tgt_req->vdev_id);
 			vos_mem_free(params);
@@ -12914,8 +15073,8 @@ void wma_vdev_resp_timer(void *data)
 		bcn = wma->interfaces[tgt_req->vdev_id].beacon;
 
 		if (bcn) {
-			WMA_LOGD("%s: Freeing beacon struct %p, "
-				 "template memory %p", __func__,
+			WMA_LOGD("%s: Freeing beacon struct %pK, "
+				 "template memory %pK", __func__,
 				 bcn, bcn->buf);
 			if (bcn->dma_mapped)
 				adf_nbuf_unmap_single(pdev->osdev, bcn->buf,
@@ -12925,11 +15084,6 @@ void wma_vdev_resp_timer(void *data)
 			wma->interfaces[tgt_req->vdev_id].beacon = NULL;
 		}
 
-#ifdef QCA_IBSS_SUPPORT
-		/* recreate ibss vdev and bss peer for scan purpose */
-		if (wma_is_vdev_in_ibss_mode(wma, tgt_req->vdev_id))
-			wma_recreate_ibss_vdev_and_bss_peer(wma, tgt_req->vdev_id);
-#endif
 		params->status = VOS_STATUS_E_TIMEOUT;
 		WMA_LOGA("%s: WDA_DELETE_BSS_REQ timedout", __func__);
 		wma_send_msg(wma, WDA_DELETE_BSS_RSP, (void *)params, 0);
@@ -13036,6 +15190,77 @@ free_tgt_req:
 	adf_os_mem_free(tgt_req);
 }
 
+static void
+wma_update_beacon_interval(tp_wma_handle wma, u_int8_t vdev_id,
+                           u_int16_t beacon_interval);
+/**
+ * wma_vdev_reset_beacon_interval_timer() - reset beacon interval back
+ * to its original value after the channel switch.
+ *
+ * @data: data
+ *
+ * Return: void
+ */
+void wma_vdev_reset_beacon_interval_timer(void *data)
+{
+	tp_wma_handle wma;
+	struct wma_beacon_interval_reset_req *req =
+		(struct wma_beacon_interval_reset_req *)data;
+	void *vos_context =
+		vos_get_global_context(VOS_MODULE_ID_WDA, NULL);
+	uint16_t beacon_interval = req->interval;
+	uint8_t vdev_id = req->vdev_id;
+	wma = (tp_wma_handle)vos_get_context(VOS_MODULE_ID_WDA, vos_context);
+
+	if (NULL == wma) {
+	    WMA_LOGE("%s: Failed to get wma", __func__);
+	    goto end;
+	}
+
+	/* Change the beacon interval back to its original value */
+	WMA_LOGE("%s: Change beacon interval back to %d",
+			__func__, beacon_interval);
+	wma_update_beacon_interval(wma, vdev_id, beacon_interval);
+
+end:
+	vos_timer_stop(&req->event_timeout);
+	vos_timer_destroy(&req->event_timeout);
+	adf_os_mem_free(req);
+}
+
+/**
+ * wma_fill_beacon_interval_reset_req() - req to reset beacon interval
+ *
+ * @wma: wma handle
+ * @vdev_id: vdev id
+ * @beacon_interval: beacon interval
+ * @timeout: timeout val
+ *
+ * Return: status
+ */
+int wma_fill_beacon_interval_reset_req(tp_wma_handle wma, uint8_t vdev_id,
+				uint16_t beacon_interval, uint32_t timeout)
+{
+	struct wma_beacon_interval_reset_req *req;
+
+	req = adf_os_mem_alloc(NULL, sizeof(*req));
+	if (!req) {
+	    WMA_LOGE("%s: Failed to allocate memory"
+			"for beacon_interval_reset_req vdev %d",
+			__func__, vdev_id);
+	    return -ENOMEM;
+	}
+
+	WMA_LOGD("%s: vdev_id %d ", __func__, vdev_id);
+	req->vdev_id = vdev_id;
+	req->interval = beacon_interval;
+	vos_timer_init(&req->event_timeout, VOS_TIMER_TYPE_SW,
+		wma_vdev_reset_beacon_interval_timer, req);
+	vos_timer_start(&req->event_timeout, timeout);
+
+	return 0;
+}
+
 struct wma_target_req *wma_fill_vdev_req(tp_wma_handle wma, u_int8_t vdev_id,
 					 u_int32_t msg_type, u_int8_t type,
 					 void *params, u_int32_t timeout)
@@ -13238,7 +15463,7 @@ void wma_roam_preauth_ind(tp_wma_handle wma_handle, u_int8_t *buf) {
 
 	vdev_id = wmi_event->vdev_id;
 	if (vdev_id >= wma_handle->max_bssid) {
-		WMA_LOGE("%s: Invalid vdev_id %d wmi_event %p", __func__,
+		WMA_LOGE("%s: Invalid vdev_id %d wmi_event %pK", __func__,
 			vdev_id, wmi_event);
 		return;
 	}
@@ -13260,6 +15485,7 @@ static void wma_set_channel(tp_wma_handle wma, tpSwitchChannelParams params)
         ol_txrx_peer_handle peer;
         ol_txrx_pdev_handle pdev;
         struct wma_txrx_node *intr = wma->interfaces;
+        uint16_t beacon_interval_ori;
 
 	WMA_LOGD("%s: Enter", __func__);
         if (!wma_find_vdev_by_addr(wma, params->selfStaMacAddr, &vdev_id)) {
@@ -13300,8 +15526,8 @@ static void wma_set_channel(tp_wma_handle wma, tpSwitchChannelParams params)
 				WMA_ROAM_PREAUTH_CHAN_NONE) {
 				/* Is channel change required?
 				 */
-				if(vos_chan_to_freq(params->channelNumber) !=
-					wma->interfaces[vdev_id].mhz)
+				if(wma_is_mcc_starting(wma,
+				   vos_chan_to_freq(params->channelNumber)))
 				{
 				    status = wma_roam_preauth_chan_set(wma,
 							params, vdev_id);
@@ -13335,6 +15561,13 @@ static void wma_set_channel(tp_wma_handle wma, tpSwitchChannelParams params)
 		goto send_resp;
 	}
 	req.chan = params->channelNumber;
+	req.channelwidth = params->channelwidth;
+
+	if (params->channelwidth == CH_WIDTH_10MHZ)
+		req.is_half_rate = 1;
+	else if (params->channelwidth == CH_WIDTH_5MHZ)
+		req.is_quarter_rate = 1;
+
 	req.chan_offset = params->secondaryChannelOffset;
 	req.vht_capable = params->vhtCapable;
 	req.dot11_mode = params->dot11_mode;
@@ -13355,6 +15588,34 @@ static void wma_set_channel(tp_wma_handle wma, tpSwitchChannelParams params)
 		params->restart_on_chan_switch == VOS_TRUE)
 		wma->interfaces[req.vdev_id].is_channel_switch = VOS_TRUE;
 
+	if ((wma_is_vdev_in_ap_mode(wma, req.vdev_id) == true)) {
+		if (params->reduced_beacon_interval) {
+			/* Reduce the beacon interval just before the channel switch.
+			 * This would help in reducing the downtime on the STA side
+			 * (which is waiting for beacons from the AP to resume back
+			 * transmission). Switch back the beacon_interval to its
+			 * original value after the channel switch based on the
+			 * timeout. This would ensure there are atleast some beacons
+			 * sent with increased frequency.
+			 */
+
+			WMA_LOGD("%s: Changing beacon interval to %d",
+				__func__, params->reduced_beacon_interval);
+
+			/* Add a timer to reset the beacon interval back*/
+			beacon_interval_ori = req.beacon_intval;
+			req.beacon_intval = params->reduced_beacon_interval;
+			if (wma_fill_beacon_interval_reset_req(wma,
+				req.vdev_id,
+				beacon_interval_ori,
+				RESET_BEACON_INTERVAL_TIMEOUT)) {
+
+				WMA_LOGD("%s: Failed to fill beacon"
+					" interval reset req", __func__);
+			}
+		}
+	}
+
 	if ((VOS_MONITOR_MODE == vos_get_conparam()) && wma_is_vdev_up(0)) {
 		status = wma_switch_channel(wma, &req);
 		if (status != VOS_STATUS_SUCCESS)
@@ -13495,6 +15756,58 @@ static void wma_update_txrx_chainmask(int num_rf_chains, int *cmd_value)
 	}
 }
 
+#define CFG_CTRL_MASK              0xFF00
+#define CFG_DATA_MASK              0x00FF
+
+/**
+ * wma_mask_tx_ht_rate() - mask tx ht rate based on config
+ * @wma:     wma handle
+ * @mcs_set  mcs set buffer
+ *
+ * Return: None
+ */
+static void wma_mask_tx_ht_rate(tp_wma_handle wma, uint8_t *mcs_set)
+{
+	uint32_t mcs_limit, i, j;
+	uint8_t *rate_pos = mcs_set;
+
+	/*
+	 * Get MCS limit from ini configure, and map it to rate parameters
+	 * This will limit HT rate upper bound. CFG_CTRL_MASK is used to
+	 * check whether ini config is enabled and CFG_DATA_MASK to get the
+	 * MCS value.
+	 */
+	if (wlan_cfgGetInt(wma->mac_context, WNI_CFG_MAX_HT_MCS_TX_DATA,
+			   &mcs_limit) != eSIR_SUCCESS) {
+		mcs_limit = WNI_CFG_MAX_HT_MCS_TX_DATA_STADEF;
+	}
+
+	if (mcs_limit & CFG_CTRL_MASK) {
+		WMA_LOGD("%s: set mcs_limit %x", __func__, mcs_limit);
+
+		mcs_limit &= CFG_DATA_MASK;
+		for (i = 0, j = 0; i < MAX_SUPPORTED_RATES;) {
+			if (j < mcs_limit / 8) {
+				rate_pos[j] = 0xff;
+				j++;
+				i += 8;
+			} else if (j < mcs_limit / 8 + 1) {
+				if (i <= mcs_limit)
+					rate_pos[i / 8] |= 1 << (i % 8);
+				else
+					rate_pos[i / 8] &= ~(1 << (i % 8));
+				i++;
+
+				if (i >= (j + 1) * 8)
+					j++;
+			} else {
+				rate_pos[j++] = 0;
+				i += 8;
+			}
+		}
+	}
+}
+
 static int32_t wmi_unified_send_peer_assoc(tp_wma_handle wma,
 					   tSirNwType nw_type,
 					   tpAddStaParams params)
@@ -13514,6 +15827,7 @@ static int32_t wmi_unified_send_peer_assoc(tp_wma_handle wma,
 	u_int32_t num_peer_11a_rates=0;
 	u_int32_t phymode;
 	u_int32_t peer_nss=1;
+	u_int32_t disable_abg_rate;
 	struct wma_txrx_node *intr = NULL;
 
 	if (NULL == params) {
@@ -13529,6 +15843,8 @@ static int32_t wmi_unified_send_peer_assoc(tp_wma_handle wma,
 		return -EINVAL;
 	}
 
+	wma_mask_tx_ht_rate(wma, params->supportedRates.supportedMCSSet);
+
 	vos_mem_zero(&peer_legacy_rates, sizeof(wmi_rate_set));
 	vos_mem_zero(&peer_ht_rates, sizeof(wmi_rate_set));
 
@@ -13538,29 +15854,39 @@ static int32_t wmi_unified_send_peer_assoc(tp_wma_handle wma,
 	                           params->vhtCapable,
 	                           params->vhtTxChannelWidthSet);
 
-	/* Legacy Rateset */
-	rate_pos = (u_int8_t *) peer_legacy_rates.rates;
-	for (i = 0; i < SIR_NUM_11B_RATES; i++) {
-		if (!params->supportedRates.llbRates[i])
-			continue;
-		rate_pos[peer_legacy_rates.num_rates++] =
-			params->supportedRates.llbRates[i];
-                num_peer_11b_rates++;
-	}
-	for (i = 0; i < SIR_NUM_11A_RATES; i++) {
-		if (!params->supportedRates.llaRates[i])
-			continue;
-		rate_pos[peer_legacy_rates.num_rates++] =
-			params->supportedRates.llaRates[i];
-                num_peer_11a_rates++;
+	if (wlan_cfgGetInt(wma->mac_context,
+			   WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA,
+			   &disable_abg_rate) != eSIR_SUCCESS)
+		disable_abg_rate = WNI_CFG_DISABLE_ABG_RATE_FOR_TX_DATA_STADEF;
+
+	if (!disable_abg_rate) {
+		/* Legacy Rateset */
+		rate_pos = (u_int8_t *) peer_legacy_rates.rates;
+		for (i = 0; i < SIR_NUM_11B_RATES; i++) {
+			if (!params->supportedRates.llbRates[i])
+				continue;
+			rate_pos[peer_legacy_rates.num_rates++] =
+				params->supportedRates.llbRates[i];
+			num_peer_11b_rates++;
+		}
+		for (i = 0; i < SIR_NUM_11A_RATES; i++) {
+			if (!params->supportedRates.llaRates[i])
+				continue;
+			rate_pos[peer_legacy_rates.num_rates++] =
+				params->supportedRates.llaRates[i];
+			num_peer_11a_rates++;
+		}
 	}
 
-    if ((phymode == MODE_11A && num_peer_11a_rates == 0) ||
-        (phymode == MODE_11B && num_peer_11b_rates == 0)) {
-	WMA_LOGW("%s: Invalid phy rates. phymode 0x%x, 11b_rates %d, 11a_rates %d",
-			__func__, phymode, num_peer_11b_rates, num_peer_11a_rates);
+	if ((phymode == MODE_11A && num_peer_11a_rates == 0) ||
+	    (phymode == MODE_11B && num_peer_11b_rates == 0)) {
+		WMA_LOGW("%s: Invalid phy rates. phymode 0x%x,"
+			 "11b_rates %d, 11a_rates %d",
+			 __func__, phymode,
+			 num_peer_11b_rates,
+			 num_peer_11a_rates);
 		return -EINVAL;
-    }
+	}
 	/* Set the Legacy Rates to Word Aligned */
 	num_peer_legacy_rates = roundup(peer_legacy_rates.num_rates,
 					sizeof(u_int32_t));
@@ -13818,8 +16144,7 @@ static int32_t wmi_unified_send_peer_assoc(tp_wma_handle wma,
 	 * Limit nss to max number of rf chain supported by target
 	 * Otherwise Fw will crash
 	 */
-	if (!wma->per_band_chainmask_supp)
-		wma_update_txrx_chainmask(wma->num_rf_chains, &cmd->peer_nss);
+	wma_update_txrx_chainmask(wma->num_rf_chains, &cmd->peer_nss);
 
 	intr->nss = cmd->peer_nss;
 	cmd->peer_phymode = phymode;
@@ -13928,17 +16253,17 @@ VOS_STATUS wma_get_link_speed(WMA_HANDLE handle,
 
 
 /**
- * wma_get_rssi() - get station's rssi
+ * wma_get_peer_info() - get station's information
  * @handle: wma interface
- * @prssi_req: get rssi request information
+ * @prssi_req: get peer info request information
  *
  * This function will send WMI_REQUEST_STATS_CMDID
  * to wmi
  *
  * Return: 0 on success, otherwise error value
  */
-static VOS_STATUS wma_get_rssi(WMA_HANDLE handle,
-				struct sir_rssi_req *prssi_req)
+static VOS_STATUS wma_get_peer_info(WMA_HANDLE handle,
+				struct sir_peer_info_req *peer_info_req)
 {
 	tp_wma_handle wma_handle = (tp_wma_handle)handle;
 	wmi_request_stats_cmd_fixed_param *cmd;
@@ -13966,8 +16291,8 @@ static VOS_STATUS wma_get_rssi(WMA_HANDLE handle,
 		WMITLV_GET_STRUCT_TLVLEN(wmi_request_stats_cmd_fixed_param));
 
 	cmd->stats_id = WMI_REQUEST_PEER_STAT;
-	cmd->vdev_id = prssi_req->sessionId;
-	wma_handle->get_sta_rssi = TRUE;
+	cmd->vdev_id = peer_info_req->sessionid;
+	wma_handle->get_sta_peer_info = TRUE;
 
 	if (wmi_unified_cmd_send(wma_handle->wmi_handle, wmi_buf, len,
 				WMI_REQUEST_STATS_CMDID)) {
@@ -13977,7 +16302,7 @@ static VOS_STATUS wma_get_rssi(WMA_HANDLE handle,
 	}
 
 	vos_mem_copy(&(wma_handle->peer_macaddr),
-					&(prssi_req->peer_macaddr),
+					&(peer_info_req->peer_macaddr),
 					VOS_MAC_ADDR_SIZE);
 	return VOS_STATUS_SUCCESS;
 }
@@ -14030,7 +16355,7 @@ static int32_t wma_txrx_fw_stats_reset(tp_wma_handle wma_handle,
 	}
 	vos_mem_zero(&req, sizeof(req));
 	req.stats_type_reset_mask = value;
-	ol_txrx_fw_stats_get(vdev, &req);
+	ol_txrx_fw_stats_get(vdev, &req, false);
 
 	return 0;
 }
@@ -14103,7 +16428,7 @@ static int32_t wma_set_txrx_fw_stats_level(tp_wma_handle wma_handle,
 			value);
 		return -EINVAL;
 	}
-	ol_txrx_fw_stats_get(vdev, &req);
+	ol_txrx_fw_stats_get(vdev, &req, true);
 
 	return 0;
 }
@@ -14679,6 +17004,44 @@ static void wma_set_modulated_dtim(tp_wma_handle wma,
 	}
 }
 
+static int32_t wma_send_pdev_monitor_mode_cmd(
+				tp_wma_handle wma,
+				wda_cli_set_cmd_t *privcmd)
+{
+	wmi_pdev_set_rx_filter_promiscuous_cmd_fixed_param *cmd;
+	wmi_buf_t buf;
+	int32_t len = sizeof(*cmd);
+
+	WMA_LOGD("Set pdev monitor mode value %d", privcmd->param_value);
+
+	buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGP("%s: pdev monitor mode Mem Alloc Failed", __func__);
+		return -ENOMEM;
+	}
+
+	cmd = (wmi_pdev_set_rx_filter_promiscuous_cmd_fixed_param *)
+		wmi_buf_data(buf);
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		       WMITLV_TAG_STRUC_wmi_pdev_set_rx_filter_promiscuous_cmd_fixed_param,
+		       WMITLV_GET_STRUCT_TLVLEN(
+			wmi_pdev_set_rx_filter_promiscuous_cmd_fixed_param));
+
+	cmd->pdev_id = 0; /* default 0, pdev id */
+	cmd->rx_filter_promiscuous_enable = privcmd->param_value;
+
+	if (wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+				 WMI_PDEV_SET_RX_FILTER_PROMISCUOUS_CMDID)) {
+		WMA_LOGE("set pdev monitor mode failed, val %d",
+			 privcmd->param_value);
+
+		wmi_buf_free(buf);
+		return -EIO;
+	}
+
+	return 0;
+}
+
 static void wma_process_cli_set_cmd(tp_wma_handle wma,
 				    wda_cli_set_cmd_t *privcmd)
 {
@@ -14725,10 +17088,13 @@ static void wma_process_cli_set_cmd(tp_wma_handle wma,
 		WMA_LOGD("pdev pid %d pval %d", privcmd->param_id,
 				privcmd->param_value);
 		if ((privcmd->param_id == WMI_PDEV_PARAM_RX_CHAIN_MASK) ||
-			(privcmd->param_id == WMI_PDEV_PARAM_TX_CHAIN_MASK)) {
+		   (privcmd->param_id == WMI_PDEV_PARAM_TX_CHAIN_MASK) ||
+		   (privcmd->param_id == WMI_PDEV_PARAM_RX_CHAIN_MASK_2G) ||
+		   (privcmd->param_id == WMI_PDEV_PARAM_TX_CHAIN_MASK_2G) ||
+		   (privcmd->param_id == WMI_PDEV_PARAM_RX_CHAIN_MASK_5G) ||
+		   (privcmd->param_id == WMI_PDEV_PARAM_TX_CHAIN_MASK_5G))
 			wma_update_txrx_chainmask(wma->num_rf_chains,
 						&privcmd->param_value);
-		}
 
 		ret = wmi_unified_pdev_set_param(wma->wmi_handle,
 						privcmd->param_id,
@@ -14802,6 +17168,9 @@ static void wma_process_cli_set_cmd(tp_wma_handle wma,
 		case GEN_PARAM_MODULATED_DTIM:
 			wma_set_modulated_dtim(wma, privcmd);
 			break;
+		case GEN_PDEV_MONITOR_MODE:
+			wma_send_pdev_monitor_mode_cmd(wma, privcmd);
+			break;
 		default:
 			WMA_LOGE("Invalid param id 0x%x", privcmd->param_id);
 			break;
@@ -15164,12 +17533,16 @@ static void wma_process_cli_set_cmd(tp_wma_handle wma,
 			wma->pdevconfig.rxchainmask = privcmd->param_value;
 			break;
 		case WMI_PDEV_PARAM_TX_CHAIN_MASK_2G:
+			wma->pdevconfig.chainmask_2g_tx = privcmd->param_value;
+			break;
 		case WMI_PDEV_PARAM_RX_CHAIN_MASK_2G:
-			wma->pdevconfig.chainmask_2g = privcmd->param_value;
+			wma->pdevconfig.chainmask_2g_rx = privcmd->param_value;
 			break;
 		case WMI_PDEV_PARAM_TX_CHAIN_MASK_5G:
+			wma->pdevconfig.chainmask_5g_tx = privcmd->param_value;
+			break;
 		case WMI_PDEV_PARAM_RX_CHAIN_MASK_5G:
-			wma->pdevconfig.chainmask_5g = privcmd->param_value;
+			wma->pdevconfig.chainmask_5g_rx = privcmd->param_value;
 			break;
 		case WMI_PDEV_PARAM_BURST_ENABLE:
 			wma->pdevconfig.burst_enable = privcmd->param_value;
@@ -15214,6 +17587,13 @@ static void wma_process_cli_set_cmd(tp_wma_handle wma,
 			else
 				WMA_LOGE("Current band is not 5G");
 			break;
+		case WMI_PDEV_PARAM_ENA_ANT_DIV:
+		case WMI_PDEV_PARAM_FORCE_CHAIN_ANT:
+		case WMI_PDEV_PARAM_ANT_DIV_SELFTEST:
+		case WMI_PDEV_PARAM_ANT_DIV_SELFTEST_INTVL:
+		case WMI_PDEV_PARAM_RADIO_CHAN_STATS_ENABLE:
+		case WMI_PDEV_PARAM_RADIO_DIAGNOSIS_ENABLE:
+			break;
 		default:
 			WMA_LOGE("Invalid wda_cli_set pdev command/Not"
 				" yet implemented 0x%x", privcmd->param_id);
@@ -15830,6 +18210,13 @@ static void wma_add_bss_ap_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 	vos_mem_zero(&req, sizeof(req));
 	req.vdev_id = vdev_id;
 	req.chan = add_bss->currentOperChannel;
+	req.channelwidth = add_bss->channelwidth;
+
+	if (add_bss->channelwidth == CH_WIDTH_5MHZ)
+		req.is_quarter_rate = 1;
+	else if (add_bss->channelwidth == CH_WIDTH_10MHZ)
+		req.is_half_rate = 1;
+
 	req.chan_offset = add_bss->currentExtChannel;
         req.vht_capable = add_bss->vhtCapable;
 #if defined WLAN_FEATURE_VOWIFI
@@ -15980,13 +18367,11 @@ static void wma_add_bss_ibss_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 	struct wma_target_req *msg;
 	u_int8_t vdev_id, peer_id;
 	VOS_STATUS status;
-        tDelStaSelfParams del_sta_param;
-        tAddStaSelfParams add_sta_self_param;
 	tSetBssKeyParams key_info;
 	u_int8_t nss_2g, nss_5g;
 
-        WMA_LOGD("%s: add_bss->sessionId = %d", __func__, add_bss->sessionId);
-        vdev_id = add_bss->sessionId;
+	WMA_LOGD("%s: add_bss->sessionId = %d", __func__, add_bss->sessionId);
+	vdev_id = add_bss->sessionId;
 	pdev = vos_get_context(VOS_MODULE_ID_TXRX, wma->vos_context);
 
 	if (NULL == pdev) {
@@ -16010,64 +18395,15 @@ static void wma_add_bss_ibss_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 		goto send_fail_resp;
 	}
 
-	/* only change vdev type to ibss during 1st time join_ibss handling */
-
-        if (FALSE == wma_is_vdev_in_ibss_mode(wma, vdev_id)) {
-
-	        WMA_LOGD("%s: vdev found for vdev id %d. deleting the vdev",
-			__func__, vdev_id);
-
-		/* remove peers on the existing non-ibss vdev */
-                TAILQ_FOREACH(peer, &vdev->peer_list, peer_list_elem) {
-	                WMA_LOGE("%s: peer found for vdev id %d. deleting the peer",
-                                __func__, vdev_id);
-                        wma_remove_peer(wma, (u_int8_t *)&vdev->mac_addr,
-		                vdev_id, peer, VOS_FALSE);
-                }
-
-		/* remove the non-ibss vdev */
-                vos_copy_macaddr((v_MACADDR_t *)&(del_sta_param.selfMacAddr),
-                                 (v_MACADDR_t *)&(vdev->mac_addr));
-                del_sta_param.sessionId   = vdev_id;
-                del_sta_param.status      = 0;
-
-		wma_vdev_detach(wma, &del_sta_param, 0);
-
-		/* create new vdev for ibss */
-		vos_copy_macaddr((v_MACADDR_t *)&(add_sta_self_param.selfMacAddr),
-			(v_MACADDR_t *)&(add_bss->selfMacAddr));
-		add_sta_self_param.sessionId = vdev_id;
-		add_sta_self_param.type      = WMI_VDEV_TYPE_IBSS;
-		add_sta_self_param.subType   = 0;
-		add_sta_self_param.status    = 0;
-		add_sta_self_param.nss_2g    = add_bss->nss_2g;
-		add_sta_self_param.nss_5g    = add_bss->nss_5g;
-		add_sta_self_param.tx_aggregation_size =
-					add_bss->tx_aggregation_size;
-		add_sta_self_param.rx_aggregation_size =
-					add_bss->rx_aggregation_size;
-
-		vdev = wma_vdev_attach(wma, &add_sta_self_param, 0);
-		if (!vdev) {
-			WMA_LOGE("%s: Failed to create vdev", __func__);
-			goto send_fail_resp;
-		}
-
-		WLANTL_RegisterVdev(wma->vos_context, vdev);
-		/* Register with TxRx Module for Data Ack Complete Cb */
-		wdi_in_data_tx_cb_set(vdev, wma_data_tx_ack_comp_hdlr, wma);
-		WMA_LOGA("new IBSS vdev created with mac %pM", add_bss->selfMacAddr);
-
-		/* create ibss bss peer */
-		status = wma_create_peer(wma, pdev, vdev, add_bss->selfMacAddr,
-	                         WMI_PEER_TYPE_DEFAULT, vdev_id,
-				 VOS_FALSE);
-		if (status != VOS_STATUS_SUCCESS) {
+	/* create ibss bss peer */
+	status = wma_create_peer(wma, pdev, vdev, add_bss->selfMacAddr,
+			WMI_PEER_TYPE_DEFAULT, vdev_id,
+			VOS_FALSE);
+	if (status != VOS_STATUS_SUCCESS) {
 			WMA_LOGE("%s: Failed to create peer", __func__);
-			goto send_fail_resp;
-		}
-		WMA_LOGA("IBSS BSS peer created with mac %pM", add_bss->selfMacAddr);
-        }
+		goto send_fail_resp;
+	}
+	WMA_LOGA("IBSS BSS peer created with mac %pM", add_bss->selfMacAddr);
 
 	peer = ol_txrx_find_peer_by_addr(pdev, add_bss->selfMacAddr, &peer_id);
 	if (!peer) {
@@ -16304,6 +18640,13 @@ static void wma_add_bss_sta_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 			req.vdev_id = vdev_id;
 			req.chan = add_bss->currentOperChannel;
 			req.chan_offset = add_bss->currentExtChannel;
+			req.channelwidth = add_bss->channelwidth;
+
+			if (add_bss->channelwidth == CH_WIDTH_5MHZ)
+				req.is_quarter_rate = 1;
+			else if (add_bss->channelwidth == CH_WIDTH_10MHZ)
+				req.is_half_rate = 1;
+
 #if defined WLAN_FEATURE_VOWIFI
 			req.max_txpow = add_bss->maxTxPower;
 #else
@@ -16419,8 +18762,9 @@ static void wma_add_bss_sta_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 send_bss_resp:
 		ol_txrx_find_peer_by_addr(pdev, add_bss->bssId,
 					  &add_bss->staContext.staIdx);
-		add_bss->status = (add_bss->staContext.staIdx < 0) ?
-				VOS_STATUS_E_FAILURE : VOS_STATUS_SUCCESS;
+		add_bss->status =
+			(add_bss->staContext.staIdx == HAL_STA_INVALID_IDX) ?
+			VOS_STATUS_E_FAILURE : VOS_STATUS_SUCCESS;
 		add_bss->bssIdx = add_bss->staContext.smesessionId;
 		vos_mem_copy(add_bss->staContext.staMac, add_bss->bssId,
 				 sizeof(add_bss->staContext.staMac));
@@ -17296,12 +19640,6 @@ static void wma_del_pm_vote(tp_wma_handle wma)
 		vos_pm_control(ENABLE_PCIE_POWER_COLLAPSE);
 	}
 }
-
-int wma_get_client_count(WMA_HANDLE handle)
-{
-	tp_wma_handle wma = (tp_wma_handle)handle;
-	return wma->ap_client_cnt;
-}
 #else
 static void wma_prevent_suspend_check(tp_wma_handle wma)
 {
@@ -17330,6 +19668,12 @@ static void wma_allow_suspend_check(tp_wma_handle wma)
 }
 #endif /* FEATURE_WLAN_D0WOW */
 
+int wma_get_client_count(WMA_HANDLE handle)
+{
+	tp_wma_handle wma = (tp_wma_handle)handle;
+	return wma->ap_client_cnt;
+}
+
 static void wma_add_sta(tp_wma_handle wma, tpAddStaParams add_sta)
 {
 	tANI_U8 oper_mode = BSS_OPERATIONAL_MODE_STA;
@@ -17456,6 +19800,8 @@ static wmi_buf_t wma_setup_install_key_cmd(tp_wma_handle wma_handle,
 	cmd->key_ix = key_params->key_idx;
 	WMI_CHAR_ARRAY_TO_MAC_ADDR(key_params->peer_mac,
 				   &cmd->peer_macaddr);
+	vos_mem_copy(&cmd->key_rsc_counter,
+		&key_params->key_rsc[0], sizeof(uint64_t));
 	if (key_params->unicast)
 		cmd->key_flags |= PAIRWISE_USAGE;
 	else
@@ -17586,6 +19932,9 @@ static wmi_buf_t wma_setup_install_key_cmd(tp_wma_handle wma_handle,
 		 key_params->key_idx, key_params->key_type, key_params->key_len,
 		 key_params->unicast, key_params->peer_mac,
 		 key_params->def_key_idx);
+	WMA_LOGD("keyrsc param key_seq_counter_h:0x%x key_seq_counter_l: 0x%x",
+		cmd->key_rsc_counter.key_seq_counter_h,
+		cmd->key_rsc_counter.key_seq_counter_l);
 
 	return buf;
 }
@@ -17659,6 +20008,10 @@ static void wma_set_bsskey(tp_wma_handle wma_handle, tpSetBssKeyParams key_info)
 			key_params.key_idx = key_info->key[i].keyId;
 
 		key_params.key_len = key_info->key[i].keyLength;
+		vos_mem_copy(key_params.key_rsc,
+			key_info->key[i].keyRsc,
+			SIR_MAC_MAX_KEY_RSC_LEN);
+
 		if (key_info->encType == eSIR_ED_TKIP) {
 			vos_mem_copy(key_params.key_data,
 				     key_info->key[i].key, 16);
@@ -18167,6 +20520,14 @@ static void wma_delete_bss(tp_wma_handle wma, tpDeleteBssParams params)
 		wma->interfaces[params->smesessionId].psnr_req = NULL;
 	}
 
+	if (wma->interfaces[params->smesessionId].action_frame_filter) {
+		struct action_frame_random_filter *action_frame_filter =
+		      wma->interfaces[params->smesessionId].action_frame_filter;
+		wma->interfaces[params->smesessionId].action_frame_filter =
+									NULL;
+		vos_mem_free(action_frame_filter);
+	}
+
         if (wlan_op_mode_ibss == txrx_vdev->opmode) {
                 wma->ibss_started = 0;
         }
@@ -18330,7 +20691,7 @@ static void wma_update_edca_params_for_ac(tSirMacEdcaParamRecord *edca_param,
 	wmm_param->acm = edca_param->aci.acm;
 
 	/* TODO: No ack is not present in EdcaParamRecord */
-	wmm_param->no_ack = 0;
+        wmm_param->no_ack = vos_config_is_no_ack();
 
 	WMA_LOGI("WMM PARAMS AC[%d]: AIFS %d Min %d Max %d TXOP %d ACM %d NOACK %d",
 		 ac,
@@ -18861,6 +21222,16 @@ static int wma_tbttoffset_update_event_handler(void *handle, u_int8_t *event,
 	}
 
 	tbtt_offset_event = param_buf->fixed_param;
+
+	if (param_buf->num_tbttoffset_list >
+			(UINT_MAX - sizeof(u_int32_t) -
+				sizeof(wmi_tbtt_offset_event_fixed_param))/
+			 sizeof(u_int32_t)) {
+		WMA_LOGE("%s: Received offset list  %d greater than maximum limit",
+			 __func__, param_buf->num_tbttoffset_list);
+		return -EINVAL;
+	}
+
 	buf = vos_mem_malloc(sizeof(wmi_tbtt_offset_event_fixed_param) +
 			sizeof (u_int32_t) +
 			(param_buf->num_tbttoffset_list * sizeof (u_int32_t)));
@@ -19019,7 +21390,7 @@ static void wma_send_beacon(tp_wma_handle wma, tpSendbeaconParams bcn_info)
 
 	    if (bcn_info->p2pIeOffset) {
 		    p2p_ie = bcn_info->beacon + bcn_info->p2pIeOffset;
-		    WMA_LOGI(" %s: p2pIe is present - vdev_id %hu, p2p_ie = %p, p2p ie len = %hu",
+		    WMA_LOGI(" %s: p2pIe is present - vdev_id %hu, p2p_ie = %pK, p2p ie len = %hu",
 				    __func__, vdev_id, p2p_ie, p2p_ie[1]);
 		    if (wma_p2p_go_set_beacon_ie(wma, vdev_id, p2p_ie) < 0) {
 			    WMA_LOGE("%s : wmi_unified_bcn_tmpl_send Failed ", __func__);
@@ -19152,7 +21523,7 @@ static int32_t wmi_unified_set_sta_ps(wmi_unified_t wmi_handle,
         if(wmi_unified_cmd_send(wmi_handle, buf, len,
                        WMI_STA_POWERSAVE_MODE_CMDID))
         {
-                WMA_LOGD("Set Sta Mode Ps Failed vdevId %d val %d",
+                WMA_LOGE("Set Sta Mode Ps Failed vdevId %d val %d",
                          vdev_id, val);
                 wmi_buf_free(buf);
                 return -EIO;
@@ -19558,24 +21929,32 @@ static void wma_enable_sta_ps_mode(tp_wma_handle wma, tpEnablePsParams ps_req)
 	}
 	ps_req->status = VOS_STATUS_SUCCESS;
 	iface->dtimPeriod = ps_req->bcnDtimPeriod;
+	iface->in_bmps = true;
 resp:
 	wma_send_msg(wma, WDA_ENTER_BMPS_RSP, ps_req, 0);
 }
 
 static void wma_disable_sta_ps_mode(tp_wma_handle wma, tpDisablePsParams ps_req)
 {
-        int32_t ret;
-        uint32_t vdev_id = ps_req->sessionid;
+	int32_t ret;
+	uint32_t vdev_id = ps_req->sessionid;
+	struct wma_txrx_node *iface = &wma->interfaces[vdev_id];
 
-        WMA_LOGD("Disable Sta Mode Ps vdevId %d", vdev_id);
+	if (!iface) {
+		WMA_LOGE("Invalid vdev id not attched to any iface %d",
+			vdev_id);
+		ps_req->status = VOS_STATUS_E_FAILURE;
+		goto resp;
+	}
 
-        /* Disable Sta Mode Power save */
-        ret = wmi_unified_set_sta_ps(wma->wmi_handle, vdev_id, false);
-        if(ret) {
-                WMA_LOGD("Disable Sta Mode Ps Failed vdevId %d", vdev_id);
-                ps_req->status = VOS_STATUS_E_FAILURE;
-                goto resp;
-        }
+	WMA_LOGD("Disable Sta Mode Ps vdevId %d", vdev_id);
+	/* Disable Sta Mode Power save */
+	ret = wmi_unified_set_sta_ps(wma->wmi_handle, vdev_id, false);
+	if(ret) {
+	        WMA_LOGE("Disable Sta Mode Ps Failed vdevId %d", vdev_id);
+	        ps_req->status = VOS_STATUS_E_FAILURE;
+	        goto resp;
+	}
 
 	/* Disable UAPSD incase if additional Req came */
 	if (eSIR_ADDON_DISABLE_UAPSD == ps_req->psSetting) {
@@ -19592,6 +21971,7 @@ static void wma_disable_sta_ps_mode(tp_wma_handle wma, tpDisablePsParams ps_req)
 	}
 
         ps_req->status = VOS_STATUS_SUCCESS;
+	iface->in_bmps = false;
 resp:
         wma_send_msg(wma, WDA_EXIT_BMPS_RSP, ps_req, 0);
 }
@@ -19899,17 +22279,29 @@ static VOS_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno)
 	u_int8_t *buf_ptr;
 	u_int8_t i;
 	int ret;
+	wmi_vendor_oui *voui = NULL;
+	struct vendor_oui *pvoui = NULL;
+	connected_nlo_rssi_params *nlo_relative_rssi;
+	connected_nlo_bss_band_rssi_pref *nlo_band_rssi;
 
 	WMA_LOGD("PNO Start");
 
 	len = sizeof(*cmd) +
 	      WMI_TLV_HDR_SIZE + /* TLV place holder for array of structures nlo_configured_parameters(nlo_list) */
-	      WMI_TLV_HDR_SIZE; /* TLV place holder for array of uint32 channel_list */
+	      WMI_TLV_HDR_SIZE + /* TLV place holder for array of uint32 channel_list */
+	      WMI_TLV_HDR_SIZE + /* TLV of nlo_channel_prediction_cfg */
+	      WMI_TLV_HDR_SIZE + /* array of wmi_vendor_oui */
+	      WMI_TLV_HDR_SIZE; /* array of connected_nlo_bss_band_rssi_pref */
 
 	len += sizeof(u_int32_t) * MIN(pno->aNetworks[0].ucChannelCount,
 				   WMI_NLO_MAX_CHAN);
 	len += sizeof(nlo_configured_parameters) *
 				MIN(pno->ucNetworksCount, WMI_NLO_MAX_SSIDS);
+	/* Add the fixed length of enlo_candidate_score_params */
+	len += sizeof(enlo_candidate_score_params);
+	len += sizeof(wmi_vendor_oui) * pno->num_vendor_oui;
+	len += sizeof(connected_nlo_rssi_params);
+	len += sizeof(connected_nlo_bss_band_rssi_pref);
 
 	buf = wmi_buf_alloc(wma->wmi_handle, len);
 	if (!buf) {
@@ -19941,6 +22333,27 @@ static VOS_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno)
 			cmd->fast_scan_period, cmd->slow_scan_period);
 	WMA_LOGD("fast_scan_max_cycles: %d", cmd->fast_scan_max_cycles);
 
+	if (pno->enable_pno_scan_randomization) {
+		cmd->flags |= WMI_NLO_CONFIG_SPOOFED_MAC_IN_PROBE_REQ |
+				WMI_NLO_CONFIG_RANDOM_SEQ_NO_IN_PROBE_REQ;
+		WMI_CHAR_ARRAY_TO_MAC_ADDR(pno->mac_addr, &cmd->mac_addr);
+		WMI_CHAR_ARRAY_TO_MAC_ADDR(pno->mac_addr_mask, &cmd->mac_mask);
+	}
+
+	if (pno->ie_whitelist)
+		cmd->flags |= WMI_NLO_CONFIG_ENABLE_IE_WHITELIST_IN_PROBE_REQ;
+	if(pno->relative_rssi_set)
+		cmd->flags |= WMI_NLO_CONFIG_ENABLE_CNLO_RSSI_CONFIG;
+
+	WMA_LOGI("pno flags = %x", cmd->flags);
+
+	cmd->num_vendor_oui = pno->num_vendor_oui;
+
+	if (pno->ie_whitelist) {
+		for (i = 0; i < PROBE_REQ_BITMAP_LEN; i++)
+			cmd->ie_bitmap[i] = pno->probe_req_ie_bitmap[i];
+	}
+
 	buf_ptr += sizeof(wmi_nlo_config_cmd_fixed_param);
 
 	cmd->no_of_ssids = MIN(pno->ucNetworksCount, WMI_NLO_MAX_SSIDS);
@@ -20001,6 +22414,76 @@ static VOS_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno)
 	}
 	buf_ptr += cmd->num_of_channels * sizeof(u_int32_t);
 
+	/*
+	 * For pno start, this is not needed but to get the correct offset of
+	 * wmi_vendor_oui, this is needed
+	 */
+	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC, 0);
+	buf_ptr += WMI_TLV_HDR_SIZE; /* zero no.of nlo_channel_prediction_cfg */
+	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_STRUC_enlo_candidate_score_param,
+			WMITLV_GET_STRUCT_TLVLEN(enlo_candidate_score_params));
+	buf_ptr += sizeof(enlo_candidate_score_params);
+
+	/* ie white list */
+	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		       pno->num_vendor_oui *
+		       sizeof(wmi_vendor_oui));
+
+	buf_ptr += WMI_TLV_HDR_SIZE;
+
+	if (cmd->num_vendor_oui != 0) {
+		voui = (wmi_vendor_oui *)buf_ptr;
+		pvoui = (struct vendor_oui *)((uint8_t *)pno + sizeof(*pno));
+		for (i = 0; i < cmd->num_vendor_oui; i++) {
+			WMITLV_SET_HDR(&voui[i].tlv_header,
+				WMITLV_TAG_STRUC_wmi_vendor_oui,
+				WMITLV_GET_STRUCT_TLVLEN(
+				wmi_vendor_oui));
+			voui[i].oui_type_subtype = pvoui[i].oui_type |
+						(pvoui[i].oui_subtype << 24);
+		}
+		buf_ptr += cmd->num_vendor_oui * sizeof(wmi_vendor_oui);
+	}
+
+	/*
+	 * Firmware calculation using connected PNO params:
+	 * New AP's RSSI >= (Connected AP's RSSI + relative_rssi +/- rssi_pref)
+	 * deduction of rssi_pref for chosen band_pref and
+	 * addition of rssi_pref for remaining bands (other than chosen band).
+	 */
+	nlo_relative_rssi = (connected_nlo_rssi_params *) buf_ptr;
+	WMITLV_SET_HDR(&nlo_relative_rssi->tlv_header,
+		WMITLV_TAG_STRUC_wmi_connected_nlo_rssi_params,
+		WMITLV_GET_STRUCT_TLVLEN(connected_nlo_rssi_params));
+	nlo_relative_rssi->relative_rssi = pno->relative_rssi;
+	WMA_LOGD("relative_rssi %d", nlo_relative_rssi->relative_rssi);
+	buf_ptr += sizeof(*nlo_relative_rssi);
+
+	/*
+	 * As of now Kernel and Host supports one band and rssi preference.
+	 * Firmware supports array of band and rssi preferences
+	 */
+	cmd->num_cnlo_band_pref = 1;
+	WMITLV_SET_HDR(buf_ptr,
+		WMITLV_TAG_ARRAY_STRUC,
+		cmd->num_cnlo_band_pref *
+		sizeof(connected_nlo_bss_band_rssi_pref));
+	buf_ptr += WMI_TLV_HDR_SIZE;
+
+	nlo_band_rssi = (connected_nlo_bss_band_rssi_pref *) buf_ptr;
+	for (i = 0; i < cmd->num_cnlo_band_pref; i++) {
+		WMITLV_SET_HDR(&nlo_band_rssi[i].tlv_header,
+			WMITLV_TAG_STRUC_wmi_connected_nlo_bss_band_rssi_pref,
+			WMITLV_GET_STRUCT_TLVLEN(
+				connected_nlo_bss_band_rssi_pref));
+		nlo_band_rssi[i].band = pno->band_rssi_pref.band;
+		nlo_band_rssi[i].rssi_pref = pno->band_rssi_pref.rssi;
+		WMA_LOGD("band_pref %d, rssi_pref %d",
+			nlo_band_rssi[i].band,
+			nlo_band_rssi[i].rssi_pref);
+	}
+	buf_ptr += cmd->num_cnlo_band_pref * sizeof(*nlo_band_rssi);
+
 	/* TODO: Discrete firmware doesn't have command/option to configure
 	 * App IE which comes from wpa_supplicant as of part PNO start request.
 	 */
@@ -20446,6 +22929,9 @@ static const u8 *wma_wow_wake_reason_str(A_INT32 wake_reason, tp_wma_handle wma)
 	case WOW_REASON_RSSI_BREACH_EVENT:
 		return "WOW_REASON_RSSI_BREACH_EVENT";
 
+	case WOW_REASON_CHIP_POWER_FAILURE_DETECT:
+		return "WOW_REASON_CHIP_POWER_FAILURE_DETECT";
+
 	case WOW_REASON_NLO_SCAN_COMPLETE:
 		return "WOW_REASON_NLO_SCAN_COMPLETE";
 	case WOW_REASON_BPF_ALLOW:
@@ -20668,6 +23154,13 @@ static int wma_log_supported_evt_handler(void *handle,
 	}
 	wmi_event = param_buf->fixed_param;
 	num_of_diag_events_logs = wmi_event->num_of_diag_events_logs;
+	if (num_of_diag_events_logs >
+	    param_buf->num_diag_events_logs_list) {
+		WMA_LOGE("message number of events %d is more than tlv hdr content %d",
+		          num_of_diag_events_logs,
+			  param_buf->num_diag_events_logs_list);
+		return -EINVAL;
+	}
 	evt_args = param_buf->diag_events_logs_list;
 	if (!evt_args) {
 		WMA_LOGE("%s: Event list is empty, num_of_diag_events_logs=%d",
@@ -20678,6 +23171,14 @@ static int wma_log_supported_evt_handler(void *handle,
 	WMA_LOGD("%s: num_of_diag_events_logs=%d",
 			__func__, num_of_diag_events_logs);
 
+	if (num_of_diag_events_logs >
+		(WMA_SVC_MSG_MAX_SIZE / sizeof(uint32_t))) {
+		WMA_LOGE("%s: excess num of logs:%d", __func__,
+			num_of_diag_events_logs);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	}
+
 	/* Free any previous allocation */
 	if (wma->events_logs_list)
 		vos_mem_free(wma->events_logs_list);
@@ -20861,10 +23362,6 @@ static int wma_extscan_get_eventid_from_tlvtag(uint32_t tag)
 		event_id = WMI_EXTSCAN_CAPABILITIES_EVENTID;
 		break;
 
-	case WMITLV_TAG_STRUC_wmi_extscan_hotlist_ssid_match_event_fixed_param:
-		event_id = WMI_EXTSCAN_HOTLIST_SSID_MATCH_EVENTID;
-		break;
-
 	default:
 		event_id = 0;
 		WMA_LOGE("%s: Unknown tag: %d", __func__, tag);
@@ -20949,11 +23446,6 @@ static void wma_extscan_wow_event_callback(void *handle, void *event,
 				wmi_cmd_struct_ptr, len);
 		break;
 
-	case WMITLV_TAG_STRUC_wmi_extscan_hotlist_ssid_match_event_fixed_param:
-		wma_extscan_hotlist_ssid_match_event_handler(handle,
-				wmi_cmd_struct_ptr, len);
-		break;
-
 	default:
 		WMA_LOGE("%s: Unknown tag: %d", __func__, tag);
 		break;
@@ -20972,7 +23464,7 @@ static void wma_extscan_wow_event_callback(void *handle, void *event,
  */
 static void wma_wow_wake_up_stats_display(tp_wma_handle wma)
 {
-	WMA_LOGA("uc %d bc %d v4_mc %d v6_mc %d ra %d ns %d na %d pno_match %d pno_complete %d gscan %d low_rssi %d rssi_breach %d icmp %d icmpv6 %d oem %d",
+	WMA_LOGA("uc %d bc %d v4_mc %d v6_mc %d ra %d ns %d na %d pno_match %d pno_complete %d gscan %d low_rssi %d rssi_breach %d icmp %d icmpv6 %d oem %d chip pwr save fail : %d",
 		wma->wow_ucast_wake_up_count,
 		wma->wow_bcast_wake_up_count,
 		wma->wow_ipv4_mcast_wake_up_count,
@@ -20987,7 +23479,8 @@ static void wma_wow_wake_up_stats_display(tp_wma_handle wma)
 		wma->wow_rssi_breach_wake_up_count,
 		wma->wow_icmpv4_count,
 		wma->wow_icmpv6_count,
-		wma->wow_oem_response_wake_up_count);
+		wma->wow_oem_response_wake_up_count,
+		wma->wow_pwr_save_fail_detected_wake_up_count);
 
 	return;
 }
@@ -21054,14 +23547,16 @@ static void wma_wow_wake_up_stats(tp_wma_handle wma, uint8_t *data,
 	case WOW_REASON_PATTERN_MATCH_FOUND:
 		if (WMA_BCAST_MAC_ADDR == *data) {
 			wma->wow_bcast_wake_up_count++;
-			if (adf_nbuf_data_is_icmp_pkt(data))
+			if (len >= WMA_IPV4_PROTO_GET_MIN_LEN &&
+			    adf_nbuf_data_is_icmp_pkt(data))
 				wma->wow_icmpv4_count++;
 			else if ((len > WMA_ICMP_V6_TYPE_OFFSET) &&
 			    adf_nbuf_data_is_icmpv6_pkt(data))
 				wma->wow_icmpv6_count++;
 		} else if (WMA_MCAST_IPV4_MAC_ADDR == *data) {
 			wma->wow_ipv4_mcast_wake_up_count++;
-			if (WMA_ICMP_PROTOCOL == *(data + WMA_IPV4_PROTOCOL))
+			if (len >= WMA_IPV4_PROTO_GET_MIN_LEN &&
+			    WMA_ICMP_PROTOCOL == *(data + WMA_IPV4_PROTOCOL))
 				wma->wow_icmpv4_count++;
 		} else if (WMA_MCAST_IPV6_MAC_ADDR == *data) {
 			wma->wow_ipv6_mcast_wake_up_count++;
@@ -21071,13 +23566,15 @@ static void wma_wow_wake_up_stats(tp_wma_handle wma, uint8_t *data,
 				WMA_LOGA("ICMP_V6 data len %d", len);
 		} else {
 			wma->wow_ucast_wake_up_count++;
-			if (adf_nbuf_data_is_ipv4_pkt(data)) {
-				if (adf_nbuf_data_is_ipv4_mcast_pkt(data))
-					wma->wow_ipv4_mcast_wake_up_count++;
-				if (WMA_ICMP_PROTOCOL ==
-				    *(data + WMA_IPV4_PROTOCOL))
-					wma->wow_icmpv4_count++;
-			} else if ((len > WMA_ICMP_V6_TYPE_OFFSET) &&
+			if (adf_nbuf_data_is_ipv4_mcast_pkt(data))
+				wma->wow_ipv4_mcast_wake_up_count++;
+			else if (adf_nbuf_data_is_ipv6_mcast_pkt(data))
+				wma->wow_ipv6_mcast_wake_up_count++;
+
+			if (len >= WMA_IPV4_PROTO_GET_MIN_LEN &&
+			    adf_nbuf_data_is_icmp_pkt(data))
+				wma->wow_icmpv4_count++;
+			else if (len > WMA_ICMP_V6_TYPE_OFFSET &&
 			    adf_nbuf_data_is_icmpv6_pkt(data))
 				wma->wow_icmpv6_count++;
 		}
@@ -21113,6 +23610,10 @@ static void wma_wow_wake_up_stats(tp_wma_handle wma, uint8_t *data,
 		wma->wow_oem_response_wake_up_count++;
 		break;
 
+	case WOW_REASON_CHIP_POWER_FAILURE_DETECT:
+		wma->wow_pwr_save_fail_detected_wake_up_count++;
+		break;
+
 	default:
 		WMA_LOGE("Unknown wake up reason");
 		break;
@@ -21218,6 +23719,14 @@ wma_pkt_proto_subtype_to_string(enum adf_proto_subtype proto_subtype)
 		return "ICMPV6 REQUEST";
 	case ADF_PROTO_ICMPV6_RES:
 		return "ICMPV6 RESPONSE";
+	case ADF_PROTO_ICMPV6_RS:
+		return "ICMPV6 RS";
+	case ADF_PROTO_ICMPV6_RA:
+		return "ICMPV6 RA";
+	case ADF_PROTO_ICMPV6_NS:
+		return "ICMPV6 NS";
+	case ADF_PROTO_ICMPV6_NA:
+		return "ICMPV6 NA";
 	case ADF_PROTO_IPV4_UDP:
 		return "IPV4 UDP Packet";
 	case ADF_PROTO_IPV4_TCP:
@@ -21248,22 +23757,20 @@ wma_wow_get_pkt_proto_subtype(uint8_t *data,
 	uint16_t ether_type = (uint16_t)(*(uint16_t *)(data +
 				ADF_NBUF_TRAC_ETH_TYPE_OFFSET));
 
-	WMA_LOGE("Ether Type: 0x%04x",
+	WMA_LOGD("Ether Type: 0x%04x",
 		adf_os_cpu_to_be16(ether_type));
 
 	if (ADF_NBUF_TRAC_EAPOL_ETH_TYPE ==
 		   adf_os_cpu_to_be16(ether_type)) {
 		if (len >= WMA_EAPOL_SUBTYPE_GET_MIN_LEN)
 			return adf_nbuf_data_get_eapol_subtype(data);
-		VOS_TRACE(VOS_MODULE_ID_WDA,
-			VOS_TRACE_LEVEL_ERROR, "EAPOL Packet");
+		WMA_LOGD("EAPOL Packet");
 		return ADF_PROTO_INVALID;
 	} else if (ADF_NBUF_TRAC_ARP_ETH_TYPE ==
 		   adf_os_cpu_to_be16(ether_type)) {
 		if (len >= WMA_ARP_SUBTYPE_GET_MIN_LEN)
 			return adf_nbuf_data_get_arp_subtype(data);
-		VOS_TRACE(VOS_MODULE_ID_WDA,
-			VOS_TRACE_LEVEL_ERROR, "ARP Packet");
+		WMA_LOGD("ARP Packet");
 		return ADF_PROTO_INVALID;
 	} else if (ADF_NBUF_TRAC_IPV4_ETH_TYPE ==
 		   adf_os_cpu_to_be16(ether_type)) {
@@ -21271,24 +23778,20 @@ wma_wow_get_pkt_proto_subtype(uint8_t *data,
 			uint8_t proto_type;
 
 			proto_type = adf_nbuf_data_get_ipv4_proto(data);
-			WMA_LOGE("IPV4_proto_type: %u", proto_type);
+			WMA_LOGD("IPV4_proto_type: %u", proto_type);
 			if (proto_type == ADF_NBUF_TRAC_ICMP_TYPE) {
 				if (len >= WMA_ICMP_SUBTYPE_GET_MIN_LEN)
 					return adf_nbuf_data_get_icmp_subtype(
 							data);
-				VOS_TRACE(VOS_MODULE_ID_WDA,
-					VOS_TRACE_LEVEL_ERROR, "ICMP Packet");
+				WMA_LOGD("ICMP Packet");
 				return ADF_PROTO_INVALID;
 			} else if (proto_type == ADF_NBUF_TRAC_UDP_TYPE) {
 				if (len >= WMA_IS_DHCP_GET_MIN_LEN) {
-					if (adf_nbuf_data_is_dhcp_pkt(data) ==
-						    A_STATUS_OK) {
+					if (adf_nbuf_data_is_dhcp_pkt(data)) {
 						if (len >=
 						   WMA_DHCP_SUBTYPE_GET_MIN_LEN)
 						  return adf_nbuf_data_get_dhcp_subtype(data);
-						VOS_TRACE(VOS_MODULE_ID_WDA,
-						    VOS_TRACE_LEVEL_ERROR,
-						    "DHCP Packet");
+						WMA_LOGD("DHCP Packet");
 						return ADF_PROTO_INVALID;
 					}
 				}
@@ -21297,8 +23800,7 @@ wma_wow_get_pkt_proto_subtype(uint8_t *data,
 				return ADF_PROTO_IPV4_TCP;
 			}
 		}
-		VOS_TRACE(VOS_MODULE_ID_WDA,
-			VOS_TRACE_LEVEL_ERROR, "IPV4 Packet");
+		WMA_LOGD("IPV4 Packet");
 		return ADF_PROTO_INVALID;
 	} else if (ADF_NBUF_TRAC_IPV6_ETH_TYPE ==
 		   adf_os_cpu_to_be16(ether_type)) {
@@ -21306,13 +23808,12 @@ wma_wow_get_pkt_proto_subtype(uint8_t *data,
 			uint8_t proto_type;
 
 			proto_type = adf_nbuf_data_get_ipv6_proto(data);
-			WMA_LOGE("IPV6_proto_type: %u", proto_type);
+			WMA_LOGD("IPV6_proto_type: %u", proto_type);
 			if (proto_type == ADF_NBUF_TRAC_ICMPV6_TYPE) {
 				if (len >= WMA_ICMPV6_SUBTYPE_GET_MIN_LEN)
 					return adf_nbuf_data_get_icmpv6_subtype(
 							data);
-				VOS_TRACE(VOS_MODULE_ID_WDA,
-					VOS_TRACE_LEVEL_ERROR, "ICMPV6 Packet");
+				WMA_LOGD("ICMPV6 Packet");
 				return ADF_PROTO_INVALID;
 			} else if (proto_type == ADF_NBUF_TRAC_UDP_TYPE) {
 				return ADF_PROTO_IPV6_UDP;
@@ -21320,8 +23821,7 @@ wma_wow_get_pkt_proto_subtype(uint8_t *data,
 				return ADF_PROTO_IPV6_TCP;
 			}
 		}
-		VOS_TRACE(VOS_MODULE_ID_WDA,
-			VOS_TRACE_LEVEL_ERROR, "IPV6 Packet");
+		WMA_LOGD("IPV6 Packet");
 		return ADF_PROTO_INVALID;
 	}
 
@@ -21350,7 +23850,7 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 
 	WMA_LOGD("wow_buf_pkt_len: %u", buf_len);
 	if (buf_len >= ADF_NBUF_TRAC_IPV4_OFFSET)
-		WMA_LOGE("Src_mac: " MAC_ADDRESS_STR " Dst_mac: " MAC_ADDRESS_STR,
+		WMA_LOGD("Src_mac: " MAC_ADDRESS_STR " Dst_mac: " MAC_ADDRESS_STR,
 			MAC_ADDR_ARRAY(data + ADF_NBUF_SRC_MAC_OFFSET),
 			MAC_ADDR_ARRAY(data));
 	else
@@ -21362,14 +23862,14 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 	case ADF_PROTO_EAPOL_M2:
 	case ADF_PROTO_EAPOL_M3:
 	case ADF_PROTO_EAPOL_M4:
-		WMA_LOGE("WOW Wakeup: %s rcvd",
+		WMA_LOGD("WOW Wakeup: %s rcvd",
 			wma_pkt_proto_subtype_to_string(proto_subtype));
 		if (buf_len >= WMA_EAPOL_INFO_GET_MIN_LEN) {
 			pkt_len = (uint16_t)(*(uint16_t *)(data +
 				EAPOL_PKT_LEN_OFFSET));
 			key_len = (uint16_t)(*(uint16_t *)(data +
 				EAPOL_KEY_LEN_OFFSET));
-			WMA_LOGE("Pkt_len: %u, Key_len: %u",
+			WMA_LOGD("Pkt_len: %u, Key_len: %u",
 				adf_os_cpu_to_be16(pkt_len),
 				adf_os_cpu_to_be16(key_len));
 		}
@@ -21383,14 +23883,14 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 	case ADF_PROTO_DHCP_RELEASE:
 	case ADF_PROTO_DHCP_INFORM:
 	case ADF_PROTO_DHCP_DECLINE:
-		WMA_LOGE("WOW Wakeup: %s rcvd",
+		WMA_LOGD("WOW Wakeup: %s rcvd",
 			wma_pkt_proto_subtype_to_string(proto_subtype));
 		if (buf_len >= WMA_DHCP_INFO_GET_MIN_LEN) {
 			pkt_len = (uint16_t)(*(uint16_t *)(data +
 				DHCP_PKT_LEN_OFFSET));
 			transaction_id = (uint32_t)(*(uint32_t *)(data +
 				DHCP_TRANSACTION_ID_OFFSET));
-			WMA_LOGE("Pkt_len: %u, Transaction_id: %u",
+			WMA_LOGD("Pkt_len: %u, Transaction_id: %u",
 				adf_os_cpu_to_be16(pkt_len),
 				adf_os_cpu_to_be32(transaction_id));
 		}
@@ -21398,20 +23898,20 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 
 	case ADF_PROTO_ARP_REQ:
 	case ADF_PROTO_ARP_RES:
-		WMA_LOGE("WOW Wakeup: %s rcvd",
+		WMA_LOGD("WOW Wakeup: %s rcvd",
 			wma_pkt_proto_subtype_to_string(proto_subtype));
 		break;
 
 	case ADF_PROTO_ICMP_REQ:
 	case ADF_PROTO_ICMP_RES:
-		WMA_LOGE("WOW Wakeup: %s rcvd",
+		WMA_LOGD("WOW Wakeup: %s rcvd",
 			wma_pkt_proto_subtype_to_string(proto_subtype));
 		if (buf_len >= WMA_IPV4_PKT_INFO_GET_MIN_LEN) {
 			pkt_len = (uint16_t)(*(uint16_t *)(data +
 				IPV4_PKT_LEN_OFFSET));
 			seq_num = (uint16_t)(*(uint16_t *)(data +
 				ICMP_SEQ_NUM_OFFSET));
-			WMA_LOGE("Pkt_len: %u, Seq_num: %u",
+			WMA_LOGD("Pkt_len: %u, Seq_num: %u",
 				adf_os_cpu_to_be16(pkt_len),
 				adf_os_cpu_to_be16(seq_num));
 		}
@@ -21419,14 +23919,18 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 
 	case ADF_PROTO_ICMPV6_REQ:
 	case ADF_PROTO_ICMPV6_RES:
-		WMA_LOGE("WOW Wakeup: %s rcvd",
+	case ADF_PROTO_ICMPV6_RS:
+	case ADF_PROTO_ICMPV6_RA:
+	case ADF_PROTO_ICMPV6_NS:
+	case ADF_PROTO_ICMPV6_NA:
+		WMA_LOGD("WOW Wakeup: %s rcvd",
 			wma_pkt_proto_subtype_to_string(proto_subtype));
 		if (buf_len >= WMA_IPV6_PKT_INFO_GET_MIN_LEN) {
 			pkt_len = (uint16_t)(*(uint16_t *)(data +
 				IPV6_PKT_LEN_OFFSET));
 			seq_num = (uint16_t)(*(uint16_t *)(data +
 				ICMPV6_SEQ_NUM_OFFSET));
-			WMA_LOGE("Pkt_len: %u, Seq_num: %u",
+			WMA_LOGD("Pkt_len: %u, Seq_num: %u",
 				adf_os_cpu_to_be16(pkt_len),
 				adf_os_cpu_to_be16(seq_num));
 		}
@@ -21434,7 +23938,7 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 
 	case ADF_PROTO_IPV4_UDP:
 	case ADF_PROTO_IPV4_TCP:
-		WMA_LOGE("WOW Wakeup: %s rcvd",
+		WMA_LOGD("WOW Wakeup: %s rcvd",
 			wma_pkt_proto_subtype_to_string(proto_subtype));
 		if (buf_len >= WMA_IPV4_PKT_INFO_GET_MIN_LEN) {
 			pkt_len = (uint16_t)(*(uint16_t *)(data +
@@ -21443,15 +23947,15 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 				IPV4_SRC_PORT_OFFSET));
 			dst_port = (uint16_t)(*(uint16_t *)(data +
 				IPV4_DST_PORT_OFFSET));
-			WMA_LOGE("Pkt_len: %u",
+			WMA_LOGD("Pkt_len: %u",
 				adf_os_cpu_to_be16(pkt_len));
-			WMA_LOGE("src_port: %u, dst_port: %u",
+			WMA_LOGD("src_port: %u, dst_port: %u",
 				adf_os_cpu_to_be16(src_port),
 				adf_os_cpu_to_be16(dst_port));
 			if (proto_subtype == ADF_PROTO_IPV4_TCP) {
 				tcp_seq_num = (uint32_t)(*(uint32_t *)(data +
 					IPV4_TCP_SEQ_NUM_OFFSET));
-				WMA_LOGE("TCP_seq_num: %u",
+				WMA_LOGD("TCP_seq_num: %u",
 					adf_os_cpu_to_be32(tcp_seq_num));
 			}
 		}
@@ -21459,7 +23963,7 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 
 	case ADF_PROTO_IPV6_UDP:
 	case ADF_PROTO_IPV6_TCP:
-		WMA_LOGE("WOW Wakeup: %s rcvd",
+		WMA_LOGD("WOW Wakeup: %s rcvd",
 			wma_pkt_proto_subtype_to_string(proto_subtype));
 		if (buf_len >= WMA_IPV6_PKT_INFO_GET_MIN_LEN) {
 			pkt_len = (uint16_t)(*(uint16_t *)(data +
@@ -21468,15 +23972,15 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 				IPV6_SRC_PORT_OFFSET));
 			dst_port = (uint16_t)(*(uint16_t *)(data +
 				IPV6_DST_PORT_OFFSET));
-			WMA_LOGE("Pkt_len: %u",
+			WMA_LOGD("Pkt_len: %u",
 				adf_os_cpu_to_be16(pkt_len));
-			WMA_LOGE("src_port: %u, dst_port: %u",
+			WMA_LOGD("src_port: %u, dst_port: %u",
 				adf_os_cpu_to_be16(src_port),
 				adf_os_cpu_to_be16(dst_port));
 			if (proto_subtype == ADF_PROTO_IPV6_TCP) {
 				tcp_seq_num = (uint32_t)(*(uint32_t *)(data +
 					IPV6_TCP_SEQ_NUM_OFFSET));
-				WMA_LOGE("TCP_seq_num: %u",
+				WMA_LOGD("TCP_seq_num: %u",
 					adf_os_cpu_to_be32(tcp_seq_num));
 			}
 		}
@@ -21484,8 +23988,8 @@ static void wma_wow_parse_data_pkt_buffer(uint8_t *data,
 
 	default:
 end:
-		WMA_LOGE("wow_buf_pkt_len: %u", buf_len);
-		WMA_LOGE("Unknown Packet or Insufficient packet buffer");
+		WMA_LOGD("wow_buf_pkt_len: %u", buf_len);
+		WMA_LOGD("Unknown Packet or Insufficient packet buffer");
 		break;
 	}
 }
@@ -21587,6 +24091,12 @@ static uint32_t wma_wow_get_wakelock_duration(int wake_reason)
 	case WOW_REASON_DISASSOC_RECVD:
 		wake_lock_duration = WMA_DISASSOC_RECV_WAKE_LOCK_DURATION;
 		break;
+	case WOW_REASON_AP_ASSOC_LOST:
+		wake_lock_duration = WMA_BMISS_EVENT_WAKE_LOCK_DURATION;
+		break;
+	case WOW_REASON_HOST_AUTO_SHUTDOWN:
+		wake_lock_duration = WMA_AUTO_SHUTDOWN_WAKE_LOCK_DURATION;
+		break;
 	default:
 		break;
 	}
@@ -21594,6 +24104,40 @@ static uint32_t wma_wow_get_wakelock_duration(int wake_reason)
 	return wake_lock_duration;
 }
 
+/**
+ * wma_wow_get_wakelock() - return the wakelock
+ *        for some mgmt packets received.
+ * @wma_handle: wma handle
+ * @wake_reason: wow wakeup reason
+ *
+ * This function returns the wakelock for some mgmt packets
+ * received while in wow suspend.
+ *
+ * Return: wakelock
+ */
+static vos_wake_lock_t *wma_wow_get_wakelock(tp_wma_handle wma_handle,
+		int wake_reason)
+{
+
+	switch (wake_reason) {
+	case WOW_REASON_AUTH_REQ_RECV:
+		return &wma_handle->wow_auth_req_wl;
+	case WOW_REASON_ASSOC_REQ_RECV:
+		return &wma_handle->wow_assoc_req_wl;
+	case WOW_REASON_DEAUTH_RECVD:
+		return &wma_handle->wow_deauth_rec_wl;
+	case WOW_REASON_DISASSOC_RECVD:
+		return &wma_handle->wow_disassoc_rec_wl;
+	case WOW_REASON_AP_ASSOC_LOST:
+		return &wma_handle->wow_ap_assoc_lost_wl;
+	case WOW_REASON_HOST_AUTO_SHUTDOWN:
+		return &wma_handle->wow_auto_shutdown_wl;
+	default:
+		return NULL;
+	}
+
+}
+
 /*
  * Handler to catch wow wakeup host event. This event will have
  * reason why the firmware has woken the host.
@@ -21624,15 +24168,29 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 	if ((wake_info->wake_reason != WOW_REASON_UNSPECIFIED) ||
 	    (wake_info->wake_reason == WOW_REASON_UNSPECIFIED &&
 	     !wmi_get_runtime_pm_inprogress(wma->wmi_handle))) {
+		if (wake_info->vdev_id >= wma->max_bssid) {
+			WMA_LOGE("%s: received invalid vdev_id %d",
+				__func__, wake_info->vdev_id);
+			return -EINVAL;
+		}
 		WMA_LOGA("WOW wakeup host event received (reason: %s(%d)) for vdev %d",
 			wma_wow_wake_reason_str(wake_info->wake_reason, wma),
 			wake_info->wake_reason,
 			wake_info->vdev_id);
 		vos_wow_wakeup_host_event(wake_info->wake_reason);
+		wma_wow_wakeup_stats_event(wma);
 	}
 
 	vos_event_set(&wma->wma_resume_event);
-
+	if (param_buf->wow_packet_buffer) {
+		wow_buf_pkt_len = *(uint32_t *)param_buf->wow_packet_buffer;
+		if (wow_buf_pkt_len > (param_buf->num_wow_packet_buffer - 4)) {
+			WMA_LOGE("Invalid wow buf pkt len from firmware, wow_buf_pkt_len: %u, num_wow_packet_buffer: %u",
+					wow_buf_pkt_len,
+					param_buf->num_wow_packet_buffer);
+			return -EINVAL;
+		}
+	}
 	switch (wake_info->wake_reason) {
 	case WOW_REASON_AUTH_REQ_RECV:
 	case WOW_REASON_ASSOC_REQ_RECV:
@@ -21643,12 +24201,7 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 	case WOW_REASON_REASSOC_RES_RECV:
 	case WOW_REASON_BEACON_RECV:
 	case WOW_REASON_ACTION_FRAME_RECV:
-		wake_lock_duration =
-			wma_wow_get_wakelock_duration(wake_info->wake_reason);
 		if (param_buf->wow_packet_buffer) {
-			/* First 4-bytes of wow_packet_buffer is the length */
-			vos_mem_copy((uint8_t *) &wow_buf_pkt_len,
-				param_buf->wow_packet_buffer, 4);
 			if (wow_buf_pkt_len)
 				wma_wow_dump_mgmt_buffer(
 					param_buf->wow_packet_buffer,
@@ -21661,7 +24214,6 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 		break;
 
 	case WOW_REASON_AP_ASSOC_LOST:
-		wake_lock_duration = WMA_BMISS_EVENT_WAKE_LOCK_DURATION;
 		wma_wow_ap_lost_helper(wma, param_buf);
 		break;
 #ifdef FEATURE_WLAN_RA_FILTERING
@@ -21671,7 +24223,6 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 #endif
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
 	case WOW_REASON_HOST_AUTO_SHUTDOWN:
-		wake_lock_duration = WMA_AUTO_SHUTDOWN_WAKE_LOCK_DURATION;
 		WMA_LOGA("Received WOW Auto Shutdown trigger in suspend");
 		if (wma_post_auto_shutdown_msg())
 			return -EINVAL;
@@ -21736,9 +24287,6 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 	case WOW_REASON_PATTERN_MATCH_FOUND:
 		WMA_LOGD("Wake up for Rx packet, dump starting from ethernet hdr");
 		if (param_buf->wow_packet_buffer) {
-		    /* First 4-bytes of wow_packet_buffer is the length */
-		    vos_mem_copy((u_int8_t *) &wow_buf_pkt_len,
-			param_buf->wow_packet_buffer, 4);
 			if (wow_buf_pkt_len) {
 				uint8_t *data;
 
@@ -21775,8 +24323,6 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 		if (param_buf->wow_packet_buffer) {
 		    /* Roam event is embedded in wow_packet_buffer */
 		    WMA_LOGD("Host woken up because of roam event");
-		    vos_mem_copy((u_int8_t *) &wow_buf_pkt_len,
-				param_buf->wow_packet_buffer, 4);
 		    WMA_LOGD("wow_packet_buffer dump");
 				vos_trace_hex_dump(VOS_MODULE_ID_WDA,
 				VOS_TRACE_LEVEL_DEBUG,
@@ -21804,8 +24350,6 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 		if (param_buf->wow_packet_buffer) {
 		    /* station kickout event embedded in wow_packet_buffer */
 		    WMA_LOGD("Host woken up because of sta_kickout event");
-		    vos_mem_copy((u_int8_t *) &wow_buf_pkt_len,
-				param_buf->wow_packet_buffer, 4);
 		    WMA_LOGD("wow_packet_buffer dump");
 				vos_trace_hex_dump(VOS_MODULE_ID_WDA,
 				VOS_TRACE_LEVEL_DEBUG,
@@ -21829,8 +24373,6 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 		WMA_LOGD("Host woken up because of extscan reason");
 		wma_wow_wake_up_stats(wma, NULL, 0, WOW_REASON_EXTSCAN);
 		if (param_buf->wow_packet_buffer) {
-			wow_buf_pkt_len =
-				*(uint32_t *)param_buf->wow_packet_buffer;
 			wma_extscan_wow_event_callback(handle,
 				(u_int8_t *)(param_buf->wow_packet_buffer + 4),
 				wow_buf_pkt_len);
@@ -21847,8 +24389,6 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 			WMA_LOGD("Host woken up because of rssi breach reason");
 			/* rssi breach event is embedded in wow_packet_buffer */
 			if (param_buf->wow_packet_buffer) {
-				vos_mem_copy((u_int8_t *) &wow_buf_pkt_len,
-					param_buf->wow_packet_buffer, 4);
 				if (wow_buf_pkt_len >= sizeof(param)) {
 					param.fixed_param =
 					(wmi_rssi_breach_event_fixed_param *)
@@ -21883,8 +24423,6 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 	case WOW_REASON_NAN_DATA:
 		WMA_LOGD(FL("Host woken up for NAN data event from FW"));
 		if (param_buf->wow_packet_buffer) {
-			wow_buf_pkt_len =
-				*(uint32_t *)param_buf->wow_packet_buffer;
 			WMA_LOGD(FL("wow_packet_buffer dump"));
 			vos_trace_hex_dump(VOS_MODULE_ID_WDA,
 				VOS_TRACE_LEVEL_DEBUG,
@@ -21917,8 +24455,6 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 				WOW_REASON_OEM_RESPONSE_EVENT);
 		if (param_buf->wow_packet_buffer) {
 			WMA_LOGD(FL("Host woken up by OEM Response event"));
-			wow_buf_pkt_len =
-				*(uint32_t *)param_buf->wow_packet_buffer;
 			vos_trace_hex_dump(VOS_MODULE_ID_WDA,
                                 VOS_TRACE_LEVEL_DEBUG,
                                 param_buf->wow_packet_buffer,
@@ -21930,15 +24466,27 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 			WMA_LOGD(FL("No wow_packet_buffer for OEM response"));
 		}
 		break;
-
+	case WOW_REASON_CHIP_POWER_FAILURE_DETECT:
+		{
+			/* Just update stats and exit */
+			wma_wow_wake_up_stats(wma, NULL, 0,
+				WOW_REASON_CHIP_POWER_FAILURE_DETECT);
+			WMA_LOGD("Host woken up because of chip power save failure");
+		}
+		break;
 	default:
 		break;
 	}
 
+	wake_lock_duration =
+		wma_wow_get_wakelock_duration(wake_info->wake_reason);
 	if (wake_lock_duration) {
-		vos_wake_lock_timeout_acquire(&wma->wow_wake_lock,
-					      wake_lock_duration,
-					      WIFI_POWER_EVENT_WAKELOCK_WOW);
+		vos_wake_lock_t *wake_lock = wma_wow_get_wakelock(wma,
+						wake_info->wake_reason);
+		if (wake_lock)
+			vos_wake_lock_timeout_acquire(wake_lock,
+						wake_lock_duration,
+						WIFI_POWER_EVENT_WAKELOCK_WOW);
 		WMA_LOGA("Holding %d msec wake_lock", wake_lock_duration);
 	}
 
@@ -22022,6 +24570,8 @@ static const u8 *wma_wow_wakeup_event_str(WOW_WAKE_EVENT_TYPE event)
 		return "WOW_TDLS_CONN_TRACKER_EVENT";
         case WOW_OEM_RESPONSE_EVENT:
                 return "WOW_OEM_RESPONSE_EVENT";
+	case WOW_CHIP_POWER_FAILURE_DETECT_EVENT:
+		return "WOW_CHIP_POWER_FAILURE_DETECT_EVENT";
 	default:
 		return "UNSPECIFIED_EVENT";
 	}
@@ -22042,12 +24592,22 @@ void wma_add_wow_wakeup_event(tp_wma_handle wma,
 					   WOW_WAKE_EVENT_TYPE event,
 					   bool enable)
 {
+	uint32_t idx, bit_idx;
+
+	if (event == 0) {
+		idx = bit_idx = 0;
+	}
+	else {
+		idx = event / WOW_BITMAP_FIELD_SIZE;
+		bit_idx = event % WOW_BITMAP_FIELD_SIZE;
+	}
+
 	if (enable) {
-		wma->wow_wakeup_enable_mask |= 1 << event;
-		wma->wow_wakeup_disable_mask &= ~(1 << event);
+		wma->wow_wakeup_enable_mask[idx] |= 1 << bit_idx;
+		wma->wow_wakeup_disable_mask[idx] &= ~(1 << bit_idx);
 	} else {
-		wma->wow_wakeup_disable_mask |= 1 << event;
-		wma->wow_wakeup_enable_mask &= ~(1 << event);
+		wma->wow_wakeup_disable_mask[idx] |= 1 << bit_idx;
+		wma->wow_wakeup_enable_mask[idx] &= ~(1 << bit_idx);
 	}
 
 	WMA_LOGD(FL("%s event %s"),
@@ -22091,9 +24651,11 @@ static VOS_STATUS wma_send_wakeup_mask(tp_wma_handle wma, bool enable)
 	cmd->is_add = enable;
 
 	if (cmd->is_add)
-		cmd->event_bitmap = wma->wow_wakeup_enable_mask;
+		vos_mem_copy(cmd->event_bitmaps, wma->wow_wakeup_enable_mask,
+			     WMI_WOW_MAX_EVENT_BM_LEN * sizeof(uint32_t));
 	else
-		cmd->event_bitmap = wma->wow_wakeup_disable_mask;
+		vos_mem_copy(cmd->event_bitmaps, wma->wow_wakeup_disable_mask,
+			     WMI_WOW_MAX_EVENT_BM_LEN * sizeof(uint32_t));
 
 	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
 				   WMI_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID);
@@ -22459,12 +25021,12 @@ int wma_enable_wow_in_fw(WMA_HANDLE handle, int runtime_pm)
 		if (!vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
 #ifdef CONFIG_CNSS
 			if (pMac->sme.enableSelfRecovery) {
-				vos_trigger_recovery();
+				vos_trigger_recovery(false);
 			} else {
-				VOS_BUG(0);
+				vos_force_fw_dump();
 			}
 #else
-			VOS_BUG(0);
+			vos_force_fw_dump();
 #endif
 		} else {
 			WMA_LOGE("%s: LOGP is in progress, ignore!", __func__);
@@ -22894,8 +25456,10 @@ static void wma_update_free_wow_ptrn_id(tp_wma_handle wma)
 	 * wakeup patterns properly to FW.
 	 */
 
-	wma->wow_wakeup_enable_mask = 0;
-	wma->wow_wakeup_disable_mask = 0;
+	vos_mem_zero(wma->wow_wakeup_enable_mask,
+		     sizeof(wma->wow_wakeup_enable_mask));
+	vos_mem_zero(wma->wow_wakeup_disable_mask,
+		     sizeof(wma->wow_wakeup_enable_mask));
 	WMA_LOGD("Total free wow pattern id for default patterns: %d",
 		 wma->wow.total_free_ptrn_id );
 }
@@ -23017,8 +25581,12 @@ static VOS_STATUS wma_feed_allowed_action_frame_patterns(tp_wma_handle wma)
 	wmi_buf_t buf;
 	int ret;
 	int i;
+	uint8_t *buf_ptr;
+	uint32_t *cmd_args;
 
-	len = sizeof(WMI_WOW_SET_ACTION_WAKE_UP_CMD_fixed_param);
+	len = sizeof(WMI_WOW_SET_ACTION_WAKE_UP_CMD_fixed_param) +
+		WMI_TLV_HDR_SIZE + (MAX_SUPPORTED_ACTION_CATEGORY *
+		sizeof(A_UINT32));
 	buf = wmi_buf_alloc(wma->wmi_handle, len);
 	if (!buf) {
 		WMA_LOGE("%s: Failed to allocate buf for wow action frame map",
@@ -23027,6 +25595,7 @@ static VOS_STATUS wma_feed_allowed_action_frame_patterns(tp_wma_handle wma)
 	}
 
 	cmd = (WMI_WOW_SET_ACTION_WAKE_UP_CMD_fixed_param *) wmi_buf_data(buf);
+	buf_ptr = (uint8_t *)cmd;
 	WMITLV_SET_HDR(&cmd->tlv_header,
 		       WMITLV_TAG_STRUC_wmi_wow_set_action_wake_up_cmd_fixed_param,
 		       WMITLV_GET_STRUCT_TLVLEN(
@@ -23045,6 +25614,14 @@ static VOS_STATUS wma_feed_allowed_action_frame_patterns(tp_wma_handle wma)
 			__func__, i, cmd->action_category_map[i]);
 	}
 
+	buf_ptr += sizeof(WMI_WOW_SET_ACTION_WAKE_UP_CMD_fixed_param);
+	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_UINT32,
+			(MAX_SUPPORTED_ACTION_CATEGORY * sizeof(A_UINT32)));
+	buf_ptr += WMI_TLV_HDR_SIZE;
+	cmd_args = (uint32_t *) buf_ptr;
+	for (i = 0; i < MAX_SUPPORTED_ACTION_CATEGORY; i++)
+		cmd_args[i] = wma->allowed_action_frames.action_per_category[i];
+
 	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
 				   WMI_WOW_SET_ACTION_WAKE_UP_CMDID);
 	if (ret) {
@@ -23076,9 +25653,9 @@ static VOS_STATUS wma_feed_wow_config_to_fw(tp_wma_handle wma,
 	bool wps_enable = false;
 
 	if (wma->wow.wow_enable) {
-		WMA_LOGE("Already%s Fatal Error!",
+		WMA_LOGD("Already%s Fatal Error!",
 			runtime_pm ? " runtime suspended" : " cfg suspended");
-		WARN_ON(1);
+		VOS_BUG(0);
 		return VOS_STATUS_E_AGAIN;
 	}
 
@@ -23231,13 +25808,21 @@ static VOS_STATUS wma_feed_wow_config_to_fw(tp_wma_handle wma,
 #endif
 
 	wma_ndp_add_wow_wakeup_event(wma, true);
-
 #ifdef FEATURE_WLAN_TDLS
 	/* configure TDLS based wakeup */
 	wma_add_wow_wakeup_event(wma, WOW_TDLS_CONN_TRACKER_EVENT, TRUE);
 #endif
 
         wma_add_wow_wakeup_event(wma, WOW_OEM_RESPONSE_EVENT, TRUE);
+	/*
+	 * Configure WOW for WOW_CHIP_POWER_FAILURE_DETECT_EVENT
+	 * We will only check vdev 0 to configure WOW wakeup.
+	 */
+	if (wma->interfaces[0].in_bmps == true ||
+	    wma->interfaces[0].in_imps == true)
+		wma_add_wow_wakeup_event(wma,
+					 WOW_CHIP_POWER_FAILURE_DETECT_EVENT,
+					 TRUE);
 
 	/* Enable wow wakeup events in FW */
 	ret = wma_send_wakeup_mask(wma, TRUE);
@@ -23343,7 +25928,7 @@ static VOS_STATUS wma_wow_enter(tp_wma_handle wma,
 
 	WMA_LOGD("wow enable req received for vdev id: %d", info->sessionId);
 
-	if (info->sessionId > wma->max_bssid) {
+	if (info->sessionId >= wma->max_bssid) {
 		WMA_LOGE("Invalid vdev id (%d)", info->sessionId);
 		vos_mem_free(info);
 		return VOS_STATUS_E_INVAL;
@@ -23370,7 +25955,7 @@ static VOS_STATUS wma_wow_exit(tp_wma_handle wma,
 
 	WMA_LOGD("wow disable req received for vdev id: %d", info->sessionId);
 
-	if (info->sessionId > wma->max_bssid) {
+	if (info->sessionId >= wma->max_bssid) {
 		WMA_LOGE("Invalid vdev id (%d)", info->sessionId);
 		vos_mem_free(info);
 		return VOS_STATUS_E_INVAL;
@@ -23403,7 +25988,7 @@ static VOS_STATUS wma_suspend_req(tp_wma_handle wma, tpSirWlanSuspendParam info)
 
 	wma->no_of_suspend_ind++;
 
-	if (info->sessionId > wma->max_bssid) {
+	if (info->sessionId >= wma->max_bssid) {
 		WMA_LOGE("Invalid vdev id (%d)", info->sessionId);
 		vos_mem_free(info);
 		return VOS_STATUS_E_INVAL;
@@ -23437,7 +26022,15 @@ static VOS_STATUS wma_suspend_req(tp_wma_handle wma, tpSirWlanSuspendParam info)
 	 * suspend indication received on last vdev before
 	 * enabling wow in fw.
 	 */
-	if (wma->no_of_suspend_ind < wma_get_vdev_count(wma)) {
+	/*
+	 * While processing suspend indication, there is a possibility of
+	 * vdev(SAP/P2P-GO) deletion due to stop_ap. This may lead, Host to
+	 * send WoW indication twice to FW, as vdev is one but HDD sends
+	 * suspend indication twice to WMA. To fix this race condition check
+	 *  for wow_enable along with vdev count.
+	 */
+	if (wma->no_of_suspend_ind < wma_get_vdev_count(wma) ||
+		wma->wow.wow_enable) {
 		vos_mem_free(info);
 		return VOS_STATUS_SUCCESS;
 	}
@@ -23581,6 +26174,8 @@ static VOS_STATUS wma_send_host_wakeup_ind_to_fw(tp_wma_handle wma)
 	int32_t len;
 	int ret;
 #ifdef CONFIG_CNSS
+	struct ol_softc *scn =
+		vos_get_context(VOS_MODULE_ID_HIF, wma->vos_context);
 	tpAniSirGlobal pMac = (tpAniSirGlobal)vos_get_context(VOS_MODULE_ID_PE,
 				wma->vos_context);
 	if (NULL == pMac) {
@@ -23632,9 +26227,12 @@ static VOS_STATUS wma_send_host_wakeup_ind_to_fw(tp_wma_handle wma)
 #ifdef CONFIG_CNSS
 			if (pMac->sme.enableSelfRecovery) {
 				wmi_tag_crash_inject(wma->wmi_handle, true);
-				vos_trigger_recovery();
+				vos_trigger_recovery(false);
 			} else {
-				VOS_BUG(0);
+				if (scn && scn->adf_dev)
+					vos_device_crashed(scn->adf_dev->dev);
+				else
+					VOS_BUG(0);
 			}
 #else
 			VOS_BUG(0);
@@ -23699,7 +26297,7 @@ VOS_STATUS wma_disable_d0wow_in_fw(tp_wma_handle wma)
 		} else {
 #ifdef CONFIG_CNSS
 			if (pmac->sme.enableSelfRecovery) {
-				vos_trigger_recovery();
+				vos_trigger_recovery(false);
 			} else {
 				VOS_BUG(0);
 			}
@@ -23731,7 +26329,7 @@ VOS_STATUS wma_disable_d0wow_in_fw(tp_wma_handle wma)
 		} else {
 #ifdef CONFIG_CNSS
 			if (pmac->sme.enableSelfRecovery) {
-				vos_trigger_recovery();
+				vos_trigger_recovery(false);
 			} else {
 				VOS_BUG(0);
 			}
@@ -24026,7 +26624,7 @@ static void wma_get_stats_req(WMA_HANDLE handle,
 
 	node->fw_stats_set = 0;
 	node->stats_rsp = pGetPEStatsRspParams;
-	wma_handle->get_sta_rssi = FALSE;
+	wma_handle->get_sta_peer_info = FALSE;
 	cmd = (wmi_request_stats_cmd_fixed_param *)wmi_buf_data(buf);
 	WMITLV_SET_HDR(&cmd->tlv_header,
 			WMITLV_TAG_STRUC_wmi_request_stats_cmd_fixed_param,
@@ -24162,8 +26760,12 @@ static void wma_process_update_rx_nss(tp_wma_handle wma_handle,
 		&wma_handle->interfaces[update_rx_nss->smesessionId];
 	int rxNss = update_rx_nss->rxNss;
 
-	if (wma_handle->per_band_chainmask_supp)
-		wma_update_txrx_chainmask(intr->nss, &rxNss);
+	if (wma_handle->per_band_chainmask_supp) {
+		if (intr->mhz < WMA_2_4_GHZ_MAX_FREQ)
+			wma_update_txrx_chainmask(intr->nss_2g, &rxNss);
+		else
+			wma_update_txrx_chainmask(intr->nss_5g, &rxNss);
+	}
 	else
 		wma_update_txrx_chainmask(wma_handle->num_rf_chains, &rxNss);
 	intr->nss = (tANI_U8) rxNss;
@@ -24875,8 +27477,12 @@ static VOS_STATUS wma_process_mcbc_set_filter_req(tp_wma_handle wma_handle,
 	uint8_t vdev_id = 0;
 	int i;
 
-	if(mcbc_param->ulMulticastAddrCnt <= 0) {
-		WMA_LOGW("Number of multicast addresses is 0");
+	if (mcbc_param->ulMulticastAddrCnt <= 0 ||
+		mcbc_param->ulMulticastAddrCnt >
+			CFG_TGT_MAX_MULTICAST_FILTER_ENTRIES) {
+		WMA_LOGE("Number of multicast addresses: %u",
+				mcbc_param->ulMulticastAddrCnt);
+		WARN_ON(1);
 		return VOS_STATUS_E_FAILURE;
 	}
 
@@ -25053,208 +27659,327 @@ out:
 }
 #endif
 
-/*
- * Function	:	wma_enable_arp_ns_offload
- * Description	:	To configure ARP NS off load data to firmware
- *			when target goes to wow mode.
- * Args		:	@wma - wma handle, @tpSirHostOffloadReq -
- *			pHostOffloadParams,@bool bArpOnly
- * Returns	:	Returns Failure or Success based on WMI cmd.
- * Comments	:	Since firware expects ARP and NS to be configured
- *			at a time, Arp info is cached in wma and send along
- *			with NS info to make both work.
- */
-static VOS_STATUS wma_enable_arp_ns_offload(tp_wma_handle wma, tpSirHostOffloadReq pHostOffloadParams, bool bArpOnly)
+/**
+ * wma_fill_arp_offload_params() - Fill ARP offload data
+ * @wma: wma handle
+ * @tpSirHostOffloadReq: offload request
+ * @buf_ptr: buffer pointer
+ *
+ * To fill ARP offload data to firmware
+ * when target goes to wow mode.
+ *
+ * Return: None
+ */
+static void wma_fill_arp_offload_params(tp_wma_handle wma,
+		tpSirHostOffloadReq hostoffloadreq, uint8_t **buf_ptr)
 {
+
 	int32_t i;
+	WMI_ARP_OFFLOAD_TUPLE *arp_tuple;
+	bool enableOrDisable = hostoffloadreq->enableOrDisable;
+
+	WMITLV_SET_HDR(*buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		(WMI_MAX_ARP_OFFLOADS*sizeof(WMI_ARP_OFFLOAD_TUPLE)));
+	*buf_ptr += WMI_TLV_HDR_SIZE;
+	for (i = 0; i < WMI_MAX_ARP_OFFLOADS; i++) {
+		arp_tuple = (WMI_ARP_OFFLOAD_TUPLE *)*buf_ptr;
+		WMITLV_SET_HDR(&arp_tuple->tlv_header,
+			WMITLV_TAG_STRUC_WMI_ARP_OFFLOAD_TUPLE,
+			WMITLV_GET_STRUCT_TLVLEN(WMI_ARP_OFFLOAD_TUPLE));
+
+		/* Fill data for ARP and NS in the first tupple for LA */
+		if ((enableOrDisable & SIR_OFFLOAD_ENABLE) && (i == 0)) {
+			/* Copy the target ip addr and flags */
+			arp_tuple->flags = WMI_ARPOFF_FLAGS_VALID;
+			A_MEMCPY(&arp_tuple->target_ipaddr,
+					hostoffloadreq->params.hostIpv4Addr,
+					SIR_IPV4_ADDR_LEN);
+			WMA_LOGD("ARPOffload IP4 address: %pI4",
+					hostoffloadreq->params.hostIpv4Addr);
+		}
+		*buf_ptr += sizeof(WMI_ARP_OFFLOAD_TUPLE);
+	}
+}
+
+#ifdef WLAN_NS_OFFLOAD
+/**
+ * wma_fill_ns_offload_params() - Fill NS offload data
+ * @wma: wma handle
+ * @tpSirHostOffloadReq: offload request
+ * @buf_ptr: buffer pointer
+ *
+ * To fill NS offload data to firmware
+ * when target goes to wow mode.
+ *
+ * Return: None
+ */
+static void wma_fill_ns_offload_params(tp_wma_handle wma,
+		tpSirHostOffloadReq hostoffloadreq, uint8_t **buf_ptr)
+{
+
+	int32_t i;
+	WMI_NS_OFFLOAD_TUPLE *ns_tuple;
+	tSirNsOffloadReq ns_req;
+
+	ns_req = hostoffloadreq->nsOffloadInfo;
+	WMITLV_SET_HDR(*buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		(WMI_MAX_NS_OFFLOADS*sizeof(WMI_NS_OFFLOAD_TUPLE)));
+	*buf_ptr += WMI_TLV_HDR_SIZE;
+	for (i = 0; i < WMI_MAX_NS_OFFLOADS; i++) {
+		ns_tuple = (WMI_NS_OFFLOAD_TUPLE *)*buf_ptr;
+		WMITLV_SET_HDR(&ns_tuple->tlv_header,
+			WMITLV_TAG_STRUC_WMI_NS_OFFLOAD_TUPLE,
+			(sizeof(WMI_NS_OFFLOAD_TUPLE) - WMI_TLV_HDR_SIZE));
+
+		/*
+		 * Fill data only for NS offload in the first ARP tuple for LA
+		 */
+		if ((hostoffloadreq->enableOrDisable & SIR_OFFLOAD_ENABLE)) {
+			ns_tuple->flags |= WMI_NSOFF_FLAGS_VALID;
+			/* Copy the target/solicitation/remote ip addr */
+			if (ns_req.targetIPv6AddrValid[i])
+				A_MEMCPY(&ns_tuple->target_ipaddr[0],
+					&ns_req.targetIPv6Addr[i],
+					sizeof(WMI_IPV6_ADDR));
+			A_MEMCPY(&ns_tuple->solicitation_ipaddr,
+				&ns_req.selfIPv6Addr[i],
+				sizeof(WMI_IPV6_ADDR));
+			if (ns_req.target_ipv6_addr_type[i]) {
+				ns_tuple->flags |=
+					WMI_NSOFF_FLAGS_IS_IPV6_ANYCAST;
+			}
+			WMA_LOGD("Index %d NS solicitedIp %pI6, targetIp %pI6",
+				i, &ns_req.selfIPv6Addr[i],
+				&ns_req.targetIPv6Addr[i]);
+
+			/* target MAC is optional, check if it is valid,
+			 * if this is not valid, the target will use the known
+			 * local MAC address rather than the tuple
+			 */
+			WMI_CHAR_ARRAY_TO_MAC_ADDR(
+				ns_req.selfMacAddr,
+				&ns_tuple->target_mac);
+			if ((ns_tuple->target_mac.mac_addr31to0 != 0) ||
+				(ns_tuple->target_mac.mac_addr47to32 != 0)) {
+				ns_tuple->flags |= WMI_NSOFF_FLAGS_MAC_VALID;
+			}
+		}
+		*buf_ptr += sizeof(WMI_NS_OFFLOAD_TUPLE);
+	}
+}
+
+
+/**
+ * wma_fill_nsoffload_ext() - Fill NS offload ext data
+ * @wma: wma handle
+ * @tpSirHostOffloadReq: offload request
+ * @buf_ptr: buffer pointer
+ *
+ * To fill extended NS offload extended data to firmware
+ * when target goes to wow mode.
+ *
+ * Return: None
+ */
+static void wma_fill_nsoffload_ext(tp_wma_handle wma, tpSirHostOffloadReq
+				   hostoffloadreq, uint8_t **buf_ptr)
+{
+	int32_t i;
+	WMI_NS_OFFLOAD_TUPLE *ns_tuple;
+	uint32_t count, num_ns_ext_tuples;
+	tSirNsOffloadReq ns_req;
+
+	ns_req = hostoffloadreq->nsOffloadInfo;
+	count = hostoffloadreq->num_ns_offload_count;
+	num_ns_ext_tuples = hostoffloadreq->num_ns_offload_count -
+		WMI_MAX_NS_OFFLOADS;
+
+	/* Populate extended NS offload tuples */
+	WMITLV_SET_HDR(*buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		(num_ns_ext_tuples * sizeof(WMI_NS_OFFLOAD_TUPLE)));
+	*buf_ptr += WMI_TLV_HDR_SIZE;
+	for (i = WMI_MAX_NS_OFFLOADS; i < count; i++) {
+		ns_tuple = (WMI_NS_OFFLOAD_TUPLE *)*buf_ptr;
+		WMITLV_SET_HDR(&ns_tuple->tlv_header,
+			WMITLV_TAG_STRUC_WMI_NS_OFFLOAD_TUPLE,
+			(sizeof(WMI_NS_OFFLOAD_TUPLE)-WMI_TLV_HDR_SIZE));
+
+		/*
+		 * Fill data only for NS offload in the first ARP tuple for LA
+		 */
+		if ((hostoffloadreq->enableOrDisable & SIR_OFFLOAD_ENABLE)) {
+			ns_tuple->flags |= WMI_NSOFF_FLAGS_VALID;
+			/* Copy the target/solicitation/remote ip addr */
+			if (ns_req.targetIPv6AddrValid[i])
+				A_MEMCPY(&ns_tuple->target_ipaddr[0],
+					&ns_req.targetIPv6Addr[i],
+					sizeof(WMI_IPV6_ADDR));
+			A_MEMCPY(&ns_tuple->solicitation_ipaddr,
+				&ns_req.selfIPv6Addr[i],
+				sizeof(WMI_IPV6_ADDR));
+			if (ns_req.target_ipv6_addr_type[i]) {
+				ns_tuple->flags |=
+					WMI_NSOFF_FLAGS_IS_IPV6_ANYCAST;
+			}
+			WMA_LOGD("Index %d NS solicitedIp %pI6, targetIp %pI6",
+				i, &ns_req.selfIPv6Addr[i],
+				&ns_req.targetIPv6Addr[i]);
+
+			/* target MAC is optional, check if it is valid,
+			 * if this is not valid, the target will use the
+			 * known local MAC address rather than the tuple
+			 */
+			 WMI_CHAR_ARRAY_TO_MAC_ADDR(
+				ns_req.selfMacAddr,
+				&ns_tuple->target_mac);
+			if ((ns_tuple->target_mac.mac_addr31to0 != 0) ||
+				(ns_tuple->target_mac.mac_addr47to32 != 0)) {
+				ns_tuple->flags |= WMI_NSOFF_FLAGS_MAC_VALID;
+			}
+		}
+		*buf_ptr += sizeof(WMI_NS_OFFLOAD_TUPLE);
+	}
+}
+#else
+static inline void wma_fill_ns_offload_params(tp_wma_handle wma,
+		tpSirHostOffloadReq hostoffloadreq, uint8_t **buf_ptr)
+{
+	return;
+}
+
+static inline void wma_fill_nsoffload_ext(tp_wma_handle wma,
+	tpSirHostOffloadReq hostoffloadreq, uint8_t **buf_ptr)
+{
+	return;
+}
+#endif
+
+
+/**
+ * wma_enable_arp_ns_offload() - enable ARP NS offload
+ * @wma: wma handle
+ * @tpSirHostOffloadReq: offload request
+ * @config_arp: flag
+ *
+ * To configure ARP NS off load data to firmware
+ * when target goes to wow mode.
+ *
+ * Return: VOS Status
+ */
+static VOS_STATUS wma_enable_arp_ns_offload(tp_wma_handle wma,
+			tpSirHostOffloadReq hostoffloadreq, bool config_arp)
+{
 	int32_t res;
 	WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param *cmd;
-	WMI_NS_OFFLOAD_TUPLE *ns_tuple;
-	WMI_ARP_OFFLOAD_TUPLE *arp_tuple;
 	A_UINT8* buf_ptr;
 	wmi_buf_t buf;
-	int32_t len;
+	uint32_t len;
+	VOS_STATUS status = VOS_STATUS_SUCCESS;
 	u_int8_t vdev_id;
+	tpSirHostOffloadReq ns_offload_req;
+	tpSirHostOffloadReq arp_offload_req;
 	uint32_t count = 0, num_ns_ext_tuples = 0;
 
 	/* Get the vdev id */
-	if (!wma_find_vdev_by_bssid(wma, pHostOffloadParams->bssId, &vdev_id)) {
-		WMA_LOGE("vdev handle is invalid for %pM", pHostOffloadParams->bssId);
-		vos_mem_free(pHostOffloadParams);
-		return VOS_STATUS_E_INVAL;
+	if (!wma_find_vdev_by_bssid(wma, hostoffloadreq->bssId, &vdev_id)) {
+		WMA_LOGE("Invalid vdev handle for %pM", hostoffloadreq->bssId);
+		status = VOS_STATUS_E_FAILURE;
+		goto err_vdev;
 	}
 
 	if (!wma->interfaces[vdev_id].vdev_up) {
-
 		WMA_LOGE("vdev %d is not up skipping arp/ns offload", vdev_id);
-		vos_mem_free(pHostOffloadParams);
-		return VOS_STATUS_E_FAILURE;
+		status = VOS_STATUS_E_FAILURE;
+		goto err_vdev;
 	}
 
-	if (!bArpOnly)
-		count = pHostOffloadParams->num_ns_offload_count;
+	/*
+	 * config_arp is true means arp request comes from upper layer
+	 * Hence ns request need to used from wma cached request.
+	 */
+	if (config_arp) {
+		arp_offload_req = hostoffloadreq;
+		ns_offload_req = &wma->interfaces[vdev_id].ns_offload_req;
+		count = ns_offload_req->num_ns_offload_count;
+	} else {
+		ns_offload_req = hostoffloadreq;
+		arp_offload_req = &wma->interfaces[vdev_id].arp_offload_req;
+		count = hostoffloadreq->num_ns_offload_count;
+	}
+
+	if (count >= SIR_MAC_NUM_TARGET_IPV6_NS_OFFLOAD_NA) {
+		status = VOS_STATUS_E_INVAL;
+		goto err_vdev;
+	}
 
 	len = sizeof(WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param) +
-		WMI_TLV_HDR_SIZE + // TLV place holder size for array of NS tuples
+		WMI_TLV_HDR_SIZE + /* Add size for array of NS tuples */
 		WMI_MAX_NS_OFFLOADS*sizeof(WMI_NS_OFFLOAD_TUPLE) +
-		WMI_TLV_HDR_SIZE + // TLV place holder size for array of ARP tuples
+		WMI_TLV_HDR_SIZE + /* Add size for array of ARP tuples */
 		WMI_MAX_ARP_OFFLOADS*sizeof(WMI_ARP_OFFLOAD_TUPLE);
 
-	/*
-	 * If there are more than WMI_MAX_NS_OFFLOADS addresses then allocate
-	 * extra length for extended NS offload tuples which follows ARP offload
-	 * tuples. Host needs to fill this structure in following format:
-	 * 2 NS ofload tuples
-	 * 2 ARP offload tuples
-	 * N numbers of extended NS offload tuples if HDD has given more than
-	 * 2 NS offload addresses
-	 */
-	if (!bArpOnly && count > WMI_MAX_NS_OFFLOADS) {
+	if (count > WMI_MAX_NS_OFFLOADS) {
 		num_ns_ext_tuples = count - WMI_MAX_NS_OFFLOADS;
-		len += WMI_TLV_HDR_SIZE + num_ns_ext_tuples *
-					sizeof(WMI_NS_OFFLOAD_TUPLE);
+		len += WMI_TLV_HDR_SIZE + num_ns_ext_tuples
+			   * sizeof(WMI_NS_OFFLOAD_TUPLE);
 	}
 
 	buf = wmi_buf_alloc(wma->wmi_handle, len);
 	if (!buf) {
 		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
-		vos_mem_free(pHostOffloadParams);
-		return VOS_STATUS_E_NOMEM;
+		status = VOS_STATUS_E_NOMEM;
+		goto err_vdev;
 	}
 
 	buf_ptr = (A_UINT8*)wmi_buf_data(buf);
+
 	cmd = (WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param *)buf_ptr;
 	WMITLV_SET_HDR(&cmd->tlv_header,
-			WMITLV_TAG_STRUC_WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param,
-			WMITLV_GET_STRUCT_TLVLEN(WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param));
+		WMITLV_TAG_STRUC_WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param,
+		WMITLV_GET_STRUCT_TLVLEN(
+		WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param));
 	cmd->flags = 0;
 	cmd->vdev_id = vdev_id;
-	if (!bArpOnly)
-		cmd->num_ns_ext_tuples = num_ns_ext_tuples;
-
-	WMA_LOGD("ARP NS Offload vdev_id: %d",cmd->vdev_id);
-
-	/* Have copy of arp info to send along with NS, Since FW expects
-	 * both ARP and NS info in single cmd */
-	if(bArpOnly)
-		vos_mem_copy(&wma->mArpInfo, pHostOffloadParams, sizeof(tSirHostOffloadReq));
+	cmd->num_ns_ext_tuples = num_ns_ext_tuples;
 
 	buf_ptr += sizeof(WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param);
-	WMITLV_SET_HDR(buf_ptr,WMITLV_TAG_ARRAY_STRUC,(WMI_MAX_NS_OFFLOADS*sizeof(WMI_NS_OFFLOAD_TUPLE)));
-	buf_ptr += WMI_TLV_HDR_SIZE;
-	for(i = 0; i < WMI_MAX_NS_OFFLOADS; i++ ){
-		ns_tuple = (WMI_NS_OFFLOAD_TUPLE *)buf_ptr;
-		WMITLV_SET_HDR(&ns_tuple->tlv_header,
-				WMITLV_TAG_STRUC_WMI_NS_OFFLOAD_TUPLE,
-				(sizeof(WMI_NS_OFFLOAD_TUPLE)-WMI_TLV_HDR_SIZE));
-
-		/* Fill data only for NS offload in the first ARP tuple for LA */
-		if (!bArpOnly  &&
-		   ((pHostOffloadParams->enableOrDisable & SIR_OFFLOAD_ENABLE))) {
-			ns_tuple->flags |= WMI_NSOFF_FLAGS_VALID;
-
-#ifdef WLAN_NS_OFFLOAD
-			/*Copy the target/solicitation/remote ip addr */
-			if(pHostOffloadParams->nsOffloadInfo.targetIPv6AddrValid[i])
-				A_MEMCPY(&ns_tuple->target_ipaddr[0],
-				&pHostOffloadParams->nsOffloadInfo.targetIPv6Addr[i], sizeof(WMI_IPV6_ADDR));
-			A_MEMCPY(&ns_tuple->solicitation_ipaddr,
-				&pHostOffloadParams->nsOffloadInfo.selfIPv6Addr[i], sizeof(WMI_IPV6_ADDR));
-			if(pHostOffloadParams->nsOffloadInfo.target_ipv6_addr_type[i])
-				ns_tuple->flags |= WMI_NSOFF_FLAGS_IS_IPV6_ANYCAST;
-			WMA_LOGD("Index %d NS solicitedIp: %pI6, targetIp: %pI6", i,
-				&pHostOffloadParams->nsOffloadInfo.selfIPv6Addr[i],
-				&pHostOffloadParams->nsOffloadInfo.targetIPv6Addr[i]);
-
-			/* target MAC is optional, check if it is valid, if this is not valid,
-			* the target will use the known local MAC address rather than the tuple */
-			WMI_CHAR_ARRAY_TO_MAC_ADDR(pHostOffloadParams->nsOffloadInfo.selfMacAddr,
-					&ns_tuple->target_mac);
-#endif
-			if ((ns_tuple->target_mac.mac_addr31to0 != 0) ||
-				(ns_tuple->target_mac.mac_addr47to32 != 0))
-			{
-				ns_tuple->flags |= WMI_NSOFF_FLAGS_MAC_VALID;
-			}
-		}
-	        buf_ptr += sizeof(WMI_NS_OFFLOAD_TUPLE);
-	}
-
-	WMITLV_SET_HDR(buf_ptr,WMITLV_TAG_ARRAY_STRUC,(WMI_MAX_ARP_OFFLOADS*sizeof(WMI_ARP_OFFLOAD_TUPLE)));
-	buf_ptr += WMI_TLV_HDR_SIZE;
-	for(i = 0; i < WMI_MAX_ARP_OFFLOADS; i++){
-		arp_tuple = (WMI_ARP_OFFLOAD_TUPLE *)buf_ptr;
-		WMITLV_SET_HDR(&arp_tuple->tlv_header,
-				WMITLV_TAG_STRUC_WMI_ARP_OFFLOAD_TUPLE,
-				WMITLV_GET_STRUCT_TLVLEN(WMI_ARP_OFFLOAD_TUPLE));
-
-		/* Fill data for ARP and NS in the first tupple for LA */
-		if ((wma->mArpInfo.enableOrDisable & SIR_OFFLOAD_ENABLE) && (i==0)) {
-			/*Copy the target ip addr and flags*/
-			arp_tuple->flags = WMI_ARPOFF_FLAGS_VALID;
-			A_MEMCPY(&arp_tuple->target_ipaddr,wma->mArpInfo.params.hostIpv4Addr,
-						SIR_IPV4_ADDR_LEN);
-			WMA_LOGD("ARPOffload IP4 address: %pI4",
-					wma->mArpInfo.params.hostIpv4Addr);
-		}
-		buf_ptr += sizeof(WMI_ARP_OFFLOAD_TUPLE);
-	}
-
-	/* Populate extended NS offload tuples */
-	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
-					(num_ns_ext_tuples*sizeof(WMI_NS_OFFLOAD_TUPLE)));
-	buf_ptr += WMI_TLV_HDR_SIZE;
-
-	if (num_ns_ext_tuples) {
-		for(i = WMI_MAX_NS_OFFLOADS; i < count; i++ ){
-			ns_tuple = (WMI_NS_OFFLOAD_TUPLE *)buf_ptr;
-			WMITLV_SET_HDR(&ns_tuple->tlv_header,
-				WMITLV_TAG_STRUC_WMI_NS_OFFLOAD_TUPLE,
-				(sizeof(WMI_NS_OFFLOAD_TUPLE)-WMI_TLV_HDR_SIZE));
-
-			/* Fill data only for NS offload in the first ARP tuple for LA */
-			if (!bArpOnly  &&
-				((pHostOffloadParams->enableOrDisable & SIR_OFFLOAD_ENABLE))) {
-				ns_tuple->flags |= WMI_NSOFF_FLAGS_VALID;
-#ifdef WLAN_NS_OFFLOAD
-				/*Copy the target/solicitation/remote ip addr */
-				if(pHostOffloadParams->nsOffloadInfo.targetIPv6AddrValid[i])
-					A_MEMCPY(&ns_tuple->target_ipaddr[0],
-						&pHostOffloadParams->nsOffloadInfo.targetIPv6Addr[i],
-						sizeof(WMI_IPV6_ADDR));
-				A_MEMCPY(&ns_tuple->solicitation_ipaddr,
-					&pHostOffloadParams->nsOffloadInfo.selfIPv6Addr[i],
-					sizeof(WMI_IPV6_ADDR));
-				if(pHostOffloadParams->nsOffloadInfo.target_ipv6_addr_type[i])
-					ns_tuple->flags |= WMI_NSOFF_FLAGS_IS_IPV6_ANYCAST;
-				WMA_LOGD("Index %d NS solicitedIp: %pI6, targetIp: %pI6", i,
-					&pHostOffloadParams->nsOffloadInfo.selfIPv6Addr[i],
-					&pHostOffloadParams->nsOffloadInfo.targetIPv6Addr[i]);
-
-				/* target MAC is optional, check if it is valid, if this is not valid,
-				 * the target will use the known local MAC address rather than the tuple */
-				 WMI_CHAR_ARRAY_TO_MAC_ADDR(pHostOffloadParams->nsOffloadInfo.selfMacAddr,
-					&ns_tuple->target_mac);
-#endif
-				if ((ns_tuple->target_mac.mac_addr31to0 != 0) ||
-					(ns_tuple->target_mac.mac_addr47to32 != 0)) {
-					ns_tuple->flags |= WMI_NSOFF_FLAGS_MAC_VALID;
-				}
-			}
-			buf_ptr += sizeof(WMI_NS_OFFLOAD_TUPLE);
-		}
-	}
-
-	res = wmi_unified_cmd_send(wma->wmi_handle, buf, len, WMI_SET_ARP_NS_OFFLOAD_CMDID);
-	if(res) {
-		WMA_LOGE("Failed to enable ARP NDP/NSffload");
-		wmi_buf_free(buf);
-		vos_mem_free(pHostOffloadParams);
-		return VOS_STATUS_E_FAILURE;
+	if (config_arp)
+		WMA_LOGD(" %s: ARP Offload vdev_id: %d enable: %d ns_count: %u",
+			__func__, cmd->vdev_id,
+			hostoffloadreq->enableOrDisable,
+			hostoffloadreq->num_ns_offload_count);
+	else
+		WMA_LOGD(" %s: NS Offload vdev_id: %d enable: %d ns_count: %u",
+			__func__, cmd->vdev_id,
+			hostoffloadreq->enableOrDisable,
+			hostoffloadreq->num_ns_offload_count);
+
+	wma_fill_ns_offload_params(wma, ns_offload_req, &buf_ptr);
+	wma_fill_arp_offload_params(wma, arp_offload_req, &buf_ptr);
+	if (count > WMI_MAX_NS_OFFLOADS)
+		wma_fill_nsoffload_ext(wma, ns_offload_req, &buf_ptr);
+
+	res = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+				WMI_SET_ARP_NS_OFFLOAD_CMDID);
+	if (res) {
+		WMA_LOGW("Failed to enable ARP NDP/NSffload");
+		goto err_cmd_send;
+	}
+
+	if (config_arp) {
+		vos_mem_copy(&wma->interfaces[vdev_id].arp_offload_req,
+			hostoffloadreq, sizeof(tSirHostOffloadReq));
+	} else {
+		vos_mem_copy(&wma->interfaces[vdev_id].ns_offload_req,
+			hostoffloadreq, sizeof(tSirHostOffloadReq));
 	}
 
-	vos_mem_free(pHostOffloadParams);
-	return VOS_STATUS_SUCCESS;
+	vos_mem_free(hostoffloadreq);
+	return status;
+err_cmd_send:
+	wmi_buf_free(buf);
+err_vdev:
+	vos_mem_free(hostoffloadreq);
+	return status;
 }
 
 typedef struct {
@@ -26212,6 +28937,133 @@ VOS_STATUS wma_process_rmc_action_period_ind(tp_wma_handle wma)
     return VOS_STATUS_SUCCESS;
 }
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+static VOS_STATUS wma_set_thermal_suspend_params(tp_wma_handle wma)
+{
+
+	wmi_thermal_mgmt_cmd_fixed_param *cmd;
+	wmi_buf_t buf;
+	int status;
+	u_int32_t len;
+
+	len = sizeof(*cmd);
+	buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGE("Failed to allocate buffer to send set key cmd");
+		return eHAL_STATUS_FAILURE;
+	}
+
+	cmd = (wmi_thermal_mgmt_cmd_fixed_param *) wmi_buf_data (buf);
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		   WMITLV_TAG_STRUC_wmi_thermal_mgmt_cmd_fixed_param,
+		   WMITLV_GET_STRUCT_TLVLEN(wmi_thermal_mgmt_cmd_fixed_param));
+
+	cmd->lower_thresh_degreeC =
+		wma->thermal_mgmt_info.thermal_resume_threshold;
+	cmd->threshold_warning_degreeC =
+		wma->thermal_mgmt_info.thermal_warning_threshold;
+	cmd->upper_thresh_degreeC =
+		wma->thermal_mgmt_info.thermal_suspend_threshold;
+	cmd->enable = wma->thermal_mgmt_info.thermal_shutdown_enabled;
+	cmd->action = WMI_THERMAL_MGMT_ACTION_NOTIFY_HOST;
+	cmd->sample_rate_ms = wma->thermal_mgmt_info.thermal_sample_rate;
+
+	WMA_LOGD("thermal shutdown params: resume:%d, warning:%d, suspend:%d, "
+		"enable:%d, action:%d, sample rate:%d ms\n",
+		cmd->lower_thresh_degreeC, cmd->threshold_warning_degreeC,
+		cmd->upper_thresh_degreeC, cmd->enable, cmd->action,
+		cmd->sample_rate_ms);
+
+	status = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+				      WMI_THERMAL_MGMT_CMDID);
+	if (status) {
+		wmi_buf_free(buf);
+		WMA_LOGE("%s:Failed to send thermal mgmt command", __func__);
+		return eHAL_STATUS_FAILURE;
+	}
+
+	return eHAL_STATUS_SUCCESS;
+}
+
+static void wma_thermal_temperature_ind(int32_t degree_c)
+{
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+	vos_msg_t sme_msg = {0};
+
+	sme_msg.type = eWNI_SME_THERMAL_TEMPERATURE_IND;
+	sme_msg.bodyptr = NULL;
+	sme_msg.bodyval = (u_int32_t)degree_c;
+
+	vos_status = vos_mq_post_message(VOS_MODULE_ID_SME, &sme_msg);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status))
+		WMA_LOGE(FL("Fail to post temperature ind msg"));
+}
+
+#define CELSIUS_MIN_DEGREE (-273)
+static bool need_thermal_temperature_ind(tp_thermal_mgmt info, int32_t degree_c)
+{
+	static int32_t t_last = CELSIUS_MIN_DEGREE;
+	int ret = false;
+	int32_t t_curr = degree_c;
+	int32_t t_r = (int32_t)info->thermal_resume_threshold;
+	int32_t t_w = (int32_t)info->thermal_warning_threshold;
+	int32_t t_s = (int32_t)info->thermal_suspend_threshold;
+
+	if ((t_last >= t_r && t_curr < t_r) ||
+	    (t_last < t_w && t_curr >= t_w) ||
+	    (t_last < t_s && t_curr >= t_s) ||
+	    (t_last == CELSIUS_MIN_DEGREE))
+		ret = true;
+
+	t_last = t_curr;
+	return ret;
+}
+#endif /* FEATURE_WLAN_THERMAL_SHUTDOWN */
+
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+static void
+wma_thermal_shutdown_evt_handler(tp_thermal_mgmt info, int32_t degree_c)
+{
+    if (!info->thermal_shutdown_enabled)
+        return;
+
+    if (need_thermal_temperature_ind(info, degree_c))
+        wma_thermal_temperature_ind(degree_c);
+}
+
+static void wma_fetch_set_thermal_params(tp_wma_handle wma,
+					t_thermal_mgmt *pThermalParams)
+{
+	wma->thermal_mgmt_info.thermal_shutdown_enabled =
+		pThermalParams->thermal_shutdown_enabled;
+	wma->thermal_mgmt_info.thermal_shutdown_auto_enabled =
+		pThermalParams->thermal_shutdown_auto_enabled;
+	wma->thermal_mgmt_info.thermal_resume_threshold =
+		pThermalParams->thermal_resume_threshold;
+	wma->thermal_mgmt_info.thermal_warning_threshold =
+		pThermalParams->thermal_warning_threshold;
+	wma->thermal_mgmt_info.thermal_suspend_threshold =
+		pThermalParams->thermal_suspend_threshold;
+	wma->thermal_mgmt_info.thermal_sample_rate =
+		pThermalParams->thermal_sample_rate;
+
+	if (wma->thermal_mgmt_info.thermal_shutdown_enabled)
+		wma_set_thermal_suspend_params(wma);
+}
+#else
+static inline void wma_fetch_set_thermal_params(tp_wma_handle wma,
+						t_thermal_mgmt *pThermalParams)
+{
+	return;
+}
+
+static inline void
+wma_thermal_shutdown_evt_handler(tp_thermal_mgmt info, int32_t degree_c)
+{
+	return;
+}
+#endif
 /* function   : wma_process_init_thermal_info
  * Description : This function initializes the thermal management table in WMA,
                 sends down the initial temperature thresholds to the firmware and
@@ -26242,22 +29094,14 @@ VOS_STATUS wma_process_init_thermal_info(tp_wma_handle wma,
 	WMA_LOGD("TM enable %d period %d", pThermalParams->thermalMgmtEnabled,
 			 pThermalParams->throttlePeriod);
         WMA_LOGD("Throttle Duty Cycle Level in percentage:\n"
-			 "2g 0 %d\n"
-			 "2g 1 %d\n"
-			 "2g 2 %d\n"
-			 "2g 3 %d\n"
-			 "5g 0 %d\n"
-			 "5g 1 %d\n"
-			 "5g 2 %d\n"
-			 "5g 3 %d",
-			 pThermalParams->throttle_duty_cycle_2g_tbl[0],
-			 pThermalParams->throttle_duty_cycle_2g_tbl[1],
-			 pThermalParams->throttle_duty_cycle_2g_tbl[2],
-			 pThermalParams->throttle_duty_cycle_2g_tbl[3],
-			 pThermalParams->throttle_duty_cycle_5g_tbl[0],
-			 pThermalParams->throttle_duty_cycle_5g_tbl[1],
-			 pThermalParams->throttle_duty_cycle_5g_tbl[2],
-			 pThermalParams->throttle_duty_cycle_5g_tbl[3]);
+			 "0 %d\n"
+			 "1 %d\n"
+			 "2 %d\n"
+			 "3 %d",
+			 pThermalParams->throttle_duty_cycle_tbl[0],
+			 pThermalParams->throttle_duty_cycle_tbl[1],
+			 pThermalParams->throttle_duty_cycle_tbl[2],
+			 pThermalParams->throttle_duty_cycle_tbl[3]);
 
 	wma->thermal_mgmt_info.thermalMgmtEnabled =
 		pThermalParams->thermalMgmtEnabled;
@@ -26297,8 +29141,7 @@ VOS_STATUS wma_process_init_thermal_info(tp_wma_handle wma,
 	{
 		ol_tx_throttle_init_period(curr_pdev,
 			pThermalParams->throttlePeriod,
-			&pThermalParams->throttle_duty_cycle_2g_tbl[0],
-			&pThermalParams->throttle_duty_cycle_5g_tbl[0]);
+			&pThermalParams->throttle_duty_cycle_tbl[0]);
 
 		/* Get the temperature thresholds to set in firmware */
 		thermal_params.minTemp = wma->thermal_mgmt_info.
@@ -26317,7 +29160,10 @@ VOS_STATUS wma_process_init_thermal_info(tp_wma_handle wma,
 			WMA_LOGE("Could not send thermal mgmt command to the firmware!");
 		}
 	}
-        return VOS_STATUS_SUCCESS;
+
+	wma_fetch_set_thermal_params(wma, pThermalParams);
+
+	return VOS_STATUS_SUCCESS;
 }
 
 
@@ -27059,12 +29905,6 @@ static VOS_STATUS wma_process_ll_stats_clearReq
 	WMI_CHAR_ARRAY_TO_MAC_ADDR(wma->interfaces[clearReq->staId].addr,
 						&cmd->peer_macaddr);
 
-	WMA_LOGD("LINK_LAYER_STATS - Clear Request Params");
-	WMA_LOGD("StopReq         : %d", cmd->stop_stats_collection_req);
-	WMA_LOGD("Vdev Id         : %d", cmd->vdev_id);
-	WMA_LOGD("Clear Stat Mask : %d", cmd->stats_clear_req_mask);
-	WMA_LOGD("Peer MAC Addr   : %pM", wma->interfaces[clearReq->staId].addr);
-
 	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
 				WMI_CLEAR_LINK_STATS_CMDID);
 	if (ret) {
@@ -27073,7 +29913,6 @@ static VOS_STATUS wma_process_ll_stats_clearReq
 		return VOS_STATUS_E_FAILURE;
 	}
 
-	WMA_LOGD("Clear Link Layer Stats request sent successfully");
 	return VOS_STATUS_SUCCESS;
 }
 
@@ -27174,12 +30013,6 @@ static VOS_STATUS wma_process_ll_stats_getReq
 	WMI_CHAR_ARRAY_TO_MAC_ADDR(wma->interfaces[getReq->staId].addr,
 						&cmd->peer_macaddr);
 
-	WMA_LOGD("LINK_LAYER_STATS - Get Request Params");
-	WMA_LOGD("Request ID      : %d", cmd->request_id);
-	WMA_LOGD("Stats Type      : %d", cmd->stats_type);
-	WMA_LOGD("Vdev ID         : %d", cmd->vdev_id);
-	WMA_LOGD("Peer MAC Addr   : %pM", wma->interfaces[getReq->staId].addr);
-
 	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
 				WMI_REQUEST_LINK_STATS_CMDID);
 	if (ret) {
@@ -27188,7 +30021,6 @@ static VOS_STATUS wma_process_ll_stats_getReq
 		return VOS_STATUS_E_FAILURE;
 	}
 
-	WMA_LOGD("Get Link Layer Stats request sent successfully");
 	return VOS_STATUS_SUCCESS;
 }
 
@@ -27295,9 +30127,8 @@ static VOS_STATUS wma_process_ll_stats_getReq
 	cmd->scan_ctrl_flags = WMI_SCAN_ADD_BCAST_PROBE_REQ |
 				WMI_SCAN_ADD_CCK_RATES |
 				WMI_SCAN_ADD_OFDM_RATES |
-				WMI_SCAN_ADD_SPOOFED_MAC_IN_PROBE_REQ |
 				WMI_SCAN_ADD_DS_IE_IN_PROBE_REQ;
-	cmd->scan_priority = WMI_SCAN_PRIORITY_HIGH;
+	cmd->scan_priority = WMI_SCAN_PRIORITY_VERY_LOW;
 	cmd->num_ssids = 0;
 	cmd->num_bssid = 0;
 	cmd->ie_len = 0;
@@ -27566,7 +30397,7 @@ VOS_STATUS wma_get_buf_extscan_hotlist_cmd(tp_wma_handle wma_handle,
 	int cmd_len = 0;
 	int num_entries = 0;
 	int min_entries = 0;
-	int numap = photlist->numAp;
+	uint32_t numap = photlist->numAp;
 	int len = sizeof(*cmd);
 
 	len += WMI_TLV_HDR_SIZE;
@@ -27575,8 +30406,8 @@ VOS_STATUS wma_get_buf_extscan_hotlist_cmd(tp_wma_handle wma_handle,
 	/* setbssid hotlist expects the bssid list
 	 * to be non zero value
 	 */
-	if (!numap) {
-		WMA_LOGE("%s: Invalid number of bssid's", __func__);
+	if (!numap || (numap > WLAN_EXTSCAN_MAX_HOTLIST_APS)) {
+		WMA_LOGE("%s: Invalid number of APs: %d", __func__, numap);
 		return VOS_STATUS_E_INVAL;
 	}
 	num_entries = wma_get_hotlist_entries_per_page(wma_handle->wmi_handle,
@@ -27751,111 +30582,6 @@ VOS_STATUS wma_extscan_stop_hotlist_monitor(tp_wma_handle wma,
 	return VOS_STATUS_SUCCESS;
 }
 
-/**
- * wma_set_ssid_hotlist() - Handle an SSID hotlist set request
- * @wma: WMA handle
- * @request: SSID hotlist set request from SME
- *
- * Return: VOS_STATUS
- */
-static VOS_STATUS
-wma_set_ssid_hotlist(tp_wma_handle wma,
-		     struct sir_set_ssid_hotlist_request *request)
-{
-	wmi_extscan_configure_hotlist_ssid_monitor_cmd_fixed_param *cmd;
-	wmi_buf_t wmi_buf;
-	uint32_t len;
-	uint32_t array_size;
-	uint8_t *buf_ptr;
-
-	if (!wma || !wma->wmi_handle) {
-		WMA_LOGE("%s: WMA is closed, can not issue hotlist cmd",
-			 __func__);
-		return VOS_STATUS_E_INVAL;
-	}
-	if (!request) {
-		WMA_LOGE("%s: Invalid request buffer",
-			__func__);
-		return VOS_STATUS_E_INVAL;
-	}
-	if (!WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
-				    WMI_SERVICE_EXTSCAN)) {
-		WMA_LOGE("%s: extscan not enabled",
-			__func__);
-		return VOS_STATUS_E_FAILURE;
-	}
-
-	/* length of fixed portion */
-	len = sizeof(*cmd);
-
-	/* length of variable portion */
-	array_size =
-		request->ssid_count * sizeof(wmi_extscan_hotlist_ssid_entry);
-	len += WMI_TLV_HDR_SIZE + array_size;
-
-	wmi_buf = wmi_buf_alloc(wma->wmi_handle, len);
-	if (!wmi_buf) {
-		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
-		return VOS_STATUS_E_NOMEM;
-	}
-
-	buf_ptr = (uint8_t *) wmi_buf_data(wmi_buf);
-	cmd = (wmi_extscan_configure_hotlist_ssid_monitor_cmd_fixed_param *)
-						buf_ptr;
-	WMITLV_SET_HDR
-		(&cmd->tlv_header,
-		 WMITLV_TAG_STRUC_wmi_extscan_configure_hotlist_ssid_monitor_cmd_fixed_param,
-		 WMITLV_GET_STRUCT_TLVLEN
-			(wmi_extscan_configure_hotlist_ssid_monitor_cmd_fixed_param));
-
-	cmd->request_id = request->request_id;
-	cmd->requestor_id = 0;
-	cmd->vdev_id = request->session_id;
-	cmd->table_id = 0;
-	cmd->lost_ap_scan_count = request->lost_ssid_sample_size;
-	cmd->total_entries = request->ssid_count;
-	cmd->num_entries_in_page = request->ssid_count;
-	cmd->first_entry_index = 0;
-
-	buf_ptr += sizeof(*cmd);
-	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC, array_size);
-
-	if (request->ssid_count) {
-		wmi_extscan_hotlist_ssid_entry *entry;
-		int i;
-
-		buf_ptr += WMI_TLV_HDR_SIZE;
-		entry = (wmi_extscan_hotlist_ssid_entry *)buf_ptr;
-		for (i = 0; i < request->ssid_count; i++) {
-			WMITLV_SET_HDR
-				(entry,
-				 WMITLV_TAG_ARRAY_STRUC,
-				 WMITLV_GET_STRUCT_TLVLEN
-					(wmi_extscan_hotlist_ssid_entry));
-			entry->ssid.ssid_len = request->ssids[i].ssid.length;
-			vos_mem_copy(entry->ssid.ssid,
-				     request->ssids[i].ssid.ssId,
-				     request->ssids[i].ssid.length);
-			entry->band = request->ssids[i].band;
-			entry->min_rssi = request->ssids[i].rssi_low;
-			entry->max_rssi = request->ssids[i].rssi_high;
-			entry++;
-		}
-		cmd->mode = WMI_EXTSCAN_MODE_START;
-	} else {
-		cmd->mode = WMI_EXTSCAN_MODE_STOP;
-	}
-
-	if (wmi_unified_cmd_send
-		(wma->wmi_handle, wmi_buf, len,
-		 WMI_EXTSCAN_CONFIGURE_HOTLIST_SSID_MONITOR_CMDID)) {
-		WMA_LOGE("%s: failed to send command", __func__);
-		wmi_buf_free(wmi_buf);
-		return VOS_STATUS_E_FAILURE;
-	}
-	return VOS_STATUS_SUCCESS;
-}
-
 VOS_STATUS wma_get_buf_extscan_change_monitor_cmd(tp_wma_handle wma_handle,
 			tSirExtScanSetSigChangeReqParams *psigchange,
 			wmi_buf_t *buf, int *buf_len)
@@ -27865,12 +30591,12 @@ VOS_STATUS wma_get_buf_extscan_change_monitor_cmd(tp_wma_handle wma_handle,
 	u_int8_t *buf_ptr;
 	int j;
 	int len = sizeof(*cmd);
-	int numap = psigchange->numAp;
+	uint32_t numap = psigchange->numAp;
 	tSirAPThresholdParam  *src_ap = psigchange->ap;
 
-	if (!numap) {
-		WMA_LOGE("%s: Invalid number of bssid's",
-			__func__);
+	if (!numap || (numap > WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS)) {
+		WMA_LOGE("%s: Invalid number of APs: %d",
+			__func__, numap);
 		return VOS_STATUS_E_INVAL;
 	}
 	len += WMI_TLV_HDR_SIZE;
@@ -28630,13 +31356,17 @@ VOS_STATUS  wma_scan_probe_setoui(tp_wma_handle wma,
 	uint32_t   len;
 	u_int8_t *buf_ptr;
 	u_int32_t *oui_buf;
+	uint32_t i = 0;
+	wmi_vendor_oui *voui = NULL;
+	struct vendor_oui *pvoui = NULL;
 
 	if (!wma || !wma->wmi_handle) {
 		WMA_LOGE("%s: WMA is closed, can not issue  cmd",
 			__func__);
 		return VOS_STATUS_E_INVAL;
 	}
-	len  = sizeof(*cmd);
+	len  = sizeof(*cmd) + WMI_TLV_HDR_SIZE +
+               psetoui->num_vendor_oui * sizeof(wmi_vendor_oui);
 	wmi_buf = wmi_buf_alloc(wma->wmi_handle, len);
 	if (!wmi_buf) {
 		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
@@ -28656,6 +31386,44 @@ VOS_STATUS  wma_scan_probe_setoui(tp_wma_handle wma,
 	WMA_LOGD("%s: wma:oui received from hdd %08x", __func__,
 			cmd->prob_req_oui);
 
+	cmd->vdev_id = psetoui->vdev_id;
+	cmd->flags = WMI_SCAN_PROBE_OUI_SPOOFED_MAC_IN_PROBE_REQ;
+	if (psetoui->enb_probe_req_sno_randomization)
+		cmd->flags |= WMI_SCAN_PROBE_OUI_RANDOM_SEQ_NO_IN_PROBE_REQ;
+
+	if (psetoui->ie_whitelist)
+		cmd->flags |=
+			WMI_SCAN_PROBE_OUI_ENABLE_IE_WHITELIST_IN_PROBE_REQ;
+
+	WMA_LOGI(FL("vdev_id = %d, flags = %x"), cmd->vdev_id, cmd->flags);
+
+	cmd->num_vendor_oui = psetoui->num_vendor_oui;
+
+	if (psetoui->ie_whitelist) {
+		for (i = 0; i < PROBE_REQ_BITMAP_LEN; i++)
+			cmd->ie_bitmap[i] = psetoui->probe_req_ie_bitmap[i];
+	}
+
+	buf_ptr += sizeof(*cmd);
+	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		       psetoui->num_vendor_oui *
+		       sizeof(wmi_vendor_oui));
+
+	buf_ptr += WMI_TLV_HDR_SIZE;
+	if (cmd->num_vendor_oui != 0) {
+		voui = (wmi_vendor_oui *)buf_ptr;
+		pvoui = (struct vendor_oui *)((u_int8_t *)psetoui +
+						sizeof(*psetoui));
+		for (i = 0; i < cmd->num_vendor_oui; i++) {
+			WMITLV_SET_HDR(&voui[i].tlv_header,
+				WMITLV_TAG_STRUC_wmi_vendor_oui,
+				WMITLV_GET_STRUCT_TLVLEN(
+				wmi_vendor_oui));
+			voui[i].oui_type_subtype = pvoui[i].oui_type |
+						(pvoui[i].oui_subtype << 24);
+		}
+	}
+
 	if (wmi_unified_cmd_send(wma->wmi_handle, wmi_buf, len,
 		WMI_SCAN_PROB_REQ_OUI_CMDID)) {
 		WMA_LOGE("%s: failed to send command", __func__);
@@ -29247,111 +32015,6 @@ VOS_STATUS wma_config_guard_time(tp_wma_handle wma,
 	return ret;
 }
 
-#ifdef WLAN_FEATURE_MEMDUMP
-/*
- * wma_process_fw_mem_dump_req() - Function to request fw memory dump from
- *				   firmware
- * @wma:                Pointer to WMA handle
- * @mem_dump_req:       Pointer for mem_dump_req
- *
- * This function sends memory dump request to firmware
- *
- * Return: VOS_STATUS_SUCCESS for success otherwise failure
- *
- */
-static VOS_STATUS wma_process_fw_mem_dump_req(tp_wma_handle wma,
-					struct fw_dump_req* mem_dump_req)
-{
-	wmi_get_fw_mem_dump_fixed_param *cmd;
-	wmi_fw_mem_dump *dump_params;
-	struct fw_dump_seg_req *seg_req;
-	int32_t len;
-	wmi_buf_t buf;
-	u_int8_t *buf_ptr;
-	int ret, loop;
-
-	if (!mem_dump_req || !wma) {
-		WMA_LOGE(FL("input pointer is NULL"));
-		return VOS_STATUS_E_FAILURE;
-	}
-
-	/*
-	 * len = sizeof(fixed param) that includes tlv header +
-	 *       tlv header for array of struc +
-	 *       sizeof (each struct)
-	 */
-	len = sizeof(*cmd) + WMI_TLV_HDR_SIZE;
-	len += mem_dump_req->num_seg * sizeof(wmi_fw_mem_dump);
-	buf = wmi_buf_alloc(wma->wmi_handle, len);
-
-	if (!buf) {
-		WMA_LOGE(FL("Failed allocate wmi buffer"));
-		return VOS_STATUS_E_NOMEM;
-        }
-
-	buf_ptr = (u_int8_t *) wmi_buf_data(buf);
-	vos_mem_zero(buf_ptr, len);
-	cmd = (wmi_get_fw_mem_dump_fixed_param *) buf_ptr;
-
-	WMITLV_SET_HDR(&cmd->tlv_header,
-		WMITLV_TAG_STRUC_wmi_get_fw_mem_dump_fixed_param,
-		WMITLV_GET_STRUCT_TLVLEN(wmi_get_fw_mem_dump_fixed_param));
-
-	cmd->request_id = mem_dump_req->request_id;
-	cmd->num_fw_mem_dump_segs = mem_dump_req->num_seg;
-
-	/* TLV indicating array of structures to follow */
-	buf_ptr += sizeof(wmi_get_fw_mem_dump_fixed_param);
-	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
-		       sizeof(wmi_fw_mem_dump) *
-		       cmd->num_fw_mem_dump_segs);
-
-	buf_ptr += WMI_TLV_HDR_SIZE;
-	dump_params = (wmi_fw_mem_dump *) buf_ptr;
-
-	WMA_LOGI(FL("request_id:%d num_seg:%d"),
-		    mem_dump_req->request_id, mem_dump_req->num_seg);
-	for (loop = 0; loop < cmd->num_fw_mem_dump_segs; loop++) {
-		seg_req = (struct fw_dump_seg_req *)
-			  ((uint8_t *)(mem_dump_req->segment) +
-			    loop * sizeof(*seg_req));
-		WMITLV_SET_HDR(&dump_params->tlv_header,
-			    WMITLV_TAG_STRUC_wmi_fw_mem_dump_params,
-			    WMITLV_GET_STRUCT_TLVLEN(wmi_fw_mem_dump));
-		dump_params->seg_id = seg_req->seg_id;
-		dump_params->seg_start_addr_lo = seg_req-> seg_start_addr_lo;
-		dump_params->seg_start_addr_hi = seg_req->seg_start_addr_hi;
-		dump_params->seg_length = seg_req->seg_length;
-		dump_params->dest_addr_lo = seg_req->dst_addr_lo;
-		dump_params->dest_addr_hi = seg_req->dst_addr_hi;
-		WMA_LOGI(FL("seg_number:%d"), loop);
-		WMA_LOGI(FL("seg_id:%d start_addr_lo:0x%x start_addr_hi:0x%x"),
-			 dump_params->seg_id, dump_params->seg_start_addr_lo,
-			 dump_params->seg_start_addr_hi);
-		WMA_LOGI(FL("seg_length:%d dst_addr_lo:0x%x dst_addr_hi:0x%x"),
-			 dump_params->seg_length, dump_params->dest_addr_lo,
-			 dump_params->dest_addr_hi);
-		dump_params++;
-	}
-
-	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
-				   WMI_GET_FW_MEM_DUMP_CMDID);
-        if (ret) {
-		WMA_LOGE(FL("Failed to send get firmware mem dump request"));
-		wmi_buf_free(buf);
-		return VOS_STATUS_E_FAILURE;
-        }
-
-	WMA_LOGI(FL("Get firmware mem dump request sent successfully"));
-	return VOS_STATUS_SUCCESS;
-}
-#else
-static VOS_STATUS wma_process_fw_mem_dump_req(tp_wma_handle wma,
-                                        void *mem_dump_req)
-{
-	return VOS_STATUS_SUCCESS;
-}
-#endif /* WLAN_FEATURE_MEMDUMP */
 
 /*
  * wma_process_set_ie_info() - Function to send IE info to firmware
@@ -30145,7 +32808,6 @@ static VOS_STATUS wma_set_beacon_filter(tp_wma_handle wma,
 		wmi_buf_free(wmi_buf);
 		return VOS_STATUS_E_FAILURE;
 	}
-	WMA_LOGD("added beacon filter = %d", vos_status);
 
 	return vos_status;
 }
@@ -30192,7 +32854,6 @@ static VOS_STATUS wma_remove_beacon_filter(tp_wma_handle wma,
 		wmi_buf_free(buf);
 		return VOS_STATUS_E_FAILURE;
 	}
-	WMA_LOGA("removed beacon filter = %d", vos_status);
 
 	return vos_status;
 }
@@ -30310,6 +32971,16 @@ VOS_STATUS wma_get_wakelock_stats(struct sir_wake_lock_stats *wake_lock_stats)
 	wake_lock_stats->wow_icmpv4_count = wma_handle->wow_icmpv4_count;
 	wake_lock_stats->wow_icmpv6_count =
 			wma_handle->wow_icmpv6_count;
+	wake_lock_stats->wow_rssi_breach_wake_up_count =
+			wma_handle->wow_rssi_breach_wake_up_count;
+	wake_lock_stats->wow_low_rssi_wake_up_count =
+			wma_handle->wow_low_rssi_wake_up_count;
+	wake_lock_stats->wow_gscan_wake_up_count =
+			wma_handle->wow_gscan_wake_up_count;
+	wake_lock_stats->wow_pno_complete_wake_up_count =
+			wma_handle->wow_pno_complete_wake_up_count;
+	wake_lock_stats->wow_pno_match_wake_up_count =
+			wma_handle->wow_pno_match_wake_up_count;
 
 	return VOS_STATUS_SUCCESS;
 }
@@ -30424,6 +33095,35 @@ VOS_STATUS wma_set_tx_rx_aggregation_size
 }
 
 /**
+ * wma_set_powersave_config() - update power save config in wma
+ * @val: new power save value
+ * @vdev_id: vdev id
+ *
+ * This function update qpower value in wma layer
+ *
+ * Return: VOS_STATUS_SUCCESS on success, error number otherwise
+ */
+VOS_STATUS wma_set_powersave_config(uint8_t vdev_id, uint8_t val)
+{
+	tp_wma_handle wma_handle;
+
+	wma_handle = vos_get_context(VOS_MODULE_ID_WDA,
+			vos_get_global_context(VOS_MODULE_ID_WDA, NULL));
+
+	WMA_LOGI("configuring qpower: %d vdev %d", val, vdev_id);
+	if (!wma_handle) {
+		WMA_LOGE("%s: WMA context is invald!", __func__);
+		return VOS_STATUS_E_INVAL;
+	}
+	wma_handle->powersave_mode = val;
+
+	return wmi_unified_set_sta_ps_param(wma_handle->wmi_handle,
+					    vdev_id,
+					    WMI_STA_PS_ENABLE_QPOWER,
+					    wma_get_qpower_config(wma_handle));
+}
+
+/**
  * wma_process_set_allowed_action_frames_ind() - Set bitmap to wma cache
  * @wma_handle: WMI handle
  * @allowed_action_frames: sir_allowed_action_frames parameter
@@ -30450,9 +33150,56 @@ void wma_process_set_allowed_action_frames_ind(tp_wma_handle wma_handle,
 			i, allowed_action_frames->action_category_map[i]);
 	}
 
+	for (i = 0; i < SIR_MAC_ACTION_MAX; i++) {
+		wma_handle->allowed_action_frames.action_per_category[i] =
+				allowed_action_frames->action_per_category[i];
+	}
+
+	WMA_LOGD("Spectrum mgmt action frames drop pattern 0x%x",
+			wma_handle->allowed_action_frames.
+			action_per_category[SIR_MAC_ACTION_SPECTRUM_MGMT]);
 	return;
 }
 
+static VOS_STATUS wma_get_chain_rssi(tp_wma_handle wma_handle,
+		struct get_chain_rssi_req_params *req_params)
+{
+	wmi_pdev_div_get_rssi_antid_fixed_param *cmd;
+	wmi_buf_t wmi_buf;
+	uint32_t len = sizeof(wmi_pdev_div_get_rssi_antid_fixed_param);
+	u_int8_t *buf_ptr;
+
+	if (!wma_handle) {
+		WMA_LOGE(FL("WMA is closed, can not issue cmd"));
+		return VOS_STATUS_E_INVAL;
+	}
+
+	wmi_buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+	if (!wmi_buf) {
+		WMA_LOGE(FL("wmi_buf_alloc failed"));
+		return VOS_STATUS_E_NOMEM;
+	}
+
+	buf_ptr = (u_int8_t *)wmi_buf_data(wmi_buf);
+
+	cmd = (wmi_pdev_div_get_rssi_antid_fixed_param *)buf_ptr;
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		WMITLV_TAG_STRUC_wmi_pdev_div_get_rssi_antid_fixed_param,
+		WMITLV_GET_STRUCT_TLVLEN(wmi_pdev_div_get_rssi_antid_fixed_param));
+	cmd->pdev_id = 0;
+	WMI_CHAR_ARRAY_TO_MAC_ADDR(req_params->peer_macaddr.bytes,
+				&cmd->macaddr);
+
+	if (wmi_unified_cmd_send(wma_handle->wmi_handle, wmi_buf, len,
+		WMI_PDEV_DIV_GET_RSSI_ANTID_CMDID)) {
+		WMA_LOGE(FL("failed to send get chain rssi command"));
+		wmi_buf_free(wmi_buf);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	return VOS_STATUS_SUCCESS;
+}
+
 /**
  * wma_update_tx_fail_cnt_th() - Set threshold for TX pkt fail
  * @wma_handle: WMA handle
@@ -30506,7 +33253,7 @@ static VOS_STATUS wma_update_short_retry_limit(tp_wma_handle wma,
 		struct sme_short_retry_limit *short_retry_limit_th)
 {
 	u_int8_t vdev_id;
-	u_int32_t short_retry_limit;
+	u_int8_t short_retry_limit;
 	int ret = -EIO;
 
 	if (!wma || !wma->wmi_handle) {
@@ -30545,7 +33292,7 @@ static VOS_STATUS wma_update_long_retry_limit(tp_wma_handle wma,
 		struct sme_long_retry_limit  *long_retry_limit_th)
 {
 	u_int8_t vdev_id;
-	u_int32_t long_retry_limit;
+	u_int8_t long_retry_limit;
 	int ret = -EIO;
 
 	if (!wma || !wma->wmi_handle) {
@@ -30554,7 +33301,7 @@ static VOS_STATUS wma_update_long_retry_limit(tp_wma_handle wma,
 	}
 	vdev_id = long_retry_limit_th->session_id;
 	long_retry_limit = long_retry_limit_th->long_retry_limit;
-	WMA_LOGD("Set TX pkt fail count threshold  vdevId %d count %d",
+	WMA_LOGD("Set long retry limit threshold vdevId %d count %d",
 			vdev_id, long_retry_limit);
 
 	ret = wmi_unified_vdev_set_param_send(wma->wmi_handle, vdev_id,
@@ -30624,6 +33371,369 @@ static void wma_update_sta_inactivity_timeout(tp_wma_handle wma,
 	return;
 }
 
+/**
+ * wma_process_power_debug_stats_req() - Process the Chip Power stats collect
+ * request and pass the Power stats request to Fw
+ * @wma_handle: WMA handle
+ *
+ * Return: VOS_STATUS
+ */
+#ifdef WLAN_POWER_DEBUGFS
+static VOS_STATUS wma_process_power_debug_stats_req(tp_wma_handle wma_handle)
+{
+	wmi_pdev_get_chip_power_stats_cmd_fixed_param *cmd;
+	int32_t len;
+	wmi_buf_t buf;
+	uint8_t *buf_ptr;
+	int ret;
+
+	if (!wma_handle) {
+		WMA_LOGE("%s: input pointer is NULL", __func__);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	len = sizeof(*cmd);
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGE("%s: Failed allocate wmi buffer", __func__);
+		return VOS_STATUS_E_NOMEM;
+	}
+
+	buf_ptr = (u_int8_t *) wmi_buf_data(buf);
+	cmd = (wmi_pdev_get_chip_power_stats_cmd_fixed_param *) buf_ptr;
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		WMITLV_TAG_STRUC_wmi_get_chip_power_stats_cmd_fixed_param,
+		WMITLV_GET_STRUCT_TLVLEN(
+			wmi_pdev_get_chip_power_stats_cmd_fixed_param));
+	cmd->pdev_id = 0;
+
+	WMA_LOGD("POWER_DEBUG_STATS - Get Request Params; Pdev id - %d",
+								cmd->pdev_id);
+	ret = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
+			WMI_PDEV_GET_CHIP_POWER_STATS_CMDID);
+	if (ret) {
+		WMA_LOGE("%s: Failed to send power debug stats request",
+				__func__);
+		wmi_buf_free(buf);
+		return VOS_STATUS_E_FAILURE;
+	}
+	return VOS_STATUS_SUCCESS;
+}
+#else
+static VOS_STATUS wma_process_power_debug_stats_req(tp_wma_handle wma_handle)
+{
+	return VOS_STATUS_SUCCESS;
+}
+#endif
+
+/**
+ * wma_set_rx_reorder_timeout_val() - set rx recorder timeout value
+ * @wma_handle: pointer to wma handle
+ * @sir_set_rx_reorder_timeout_val: rx recorder timeout value
+ *
+ * Return: VOS_STATUS_SUCCESS for success or error code.
+ */
+static VOS_STATUS wma_set_rx_reorder_timeout_val(tp_wma_handle wma_handle,
+	struct sir_set_rx_reorder_timeout_val *reorder_timeout)
+{
+	wmi_pdev_set_reorder_timeout_val_cmd_fixed_param *cmd;
+	uint32_t len;
+	wmi_buf_t buf;
+	int ret;
+
+	if (!reorder_timeout) {
+		WMA_LOGE(FL("invalid pointer"));
+		return VOS_STATUS_E_INVAL;
+	}
+
+	if (!wma_handle) {
+		WMA_LOGE(FL("WMA context is invald!"));
+		return VOS_STATUS_E_INVAL;
+	}
+	len = sizeof(*cmd);
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+
+	if (!buf) {
+		WMA_LOGE(FL("Failed allocate wmi buffer"));
+		return VOS_STATUS_E_NOMEM;
+	}
+	cmd = (wmi_pdev_set_reorder_timeout_val_cmd_fixed_param *)
+		wmi_buf_data(buf);
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+	WMITLV_TAG_STRUC_wmi_pdev_set_reorder_timeout_val_cmd_fixed_param,
+	WMITLV_GET_STRUCT_TLVLEN(wmi_pdev_set_reorder_timeout_val_cmd_fixed_param));
+
+	memcpy(cmd->rx_timeout_pri, reorder_timeout->rx_timeout_pri,
+		sizeof(reorder_timeout->rx_timeout_pri));
+
+	WMA_LOGD("rx aggr record timeout: VO: %d, VI: %d, BE: %d, BK: %d",
+		cmd->rx_timeout_pri[0], cmd->rx_timeout_pri[1],
+		cmd->rx_timeout_pri[2], cmd->rx_timeout_pri[3]);
+
+	ret = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
+			WMI_PDEV_SET_REORDER_TIMEOUT_VAL_CMDID);
+	if (ret) {
+		WMA_LOGE(FL("Failed to send aggregation timeout"));
+		wmi_buf_free(buf);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * wma_set_rx_blocksize() - set rx blocksize
+ * @wma_handle: pointer to wma handle
+ * @sir_peer_set_rx_blocksize: rx blocksize for peer mac
+ *
+ * Return: VOS_STATUS_SUCCESS for success or error code.
+ */
+static VOS_STATUS wma_set_rx_blocksize(tp_wma_handle wma_handle,
+	struct sir_peer_set_rx_blocksize *peer_rx_blocksize)
+{
+	wmi_peer_set_rx_blocksize_cmd_fixed_param *cmd;
+	int32_t len;
+	wmi_buf_t buf;
+	u_int8_t *buf_ptr;
+	int ret;
+
+	if (!peer_rx_blocksize) {
+		WMA_LOGE(FL("invalid pointer"));
+		return VOS_STATUS_E_INVAL;
+	}
+
+	if (!wma_handle) {
+		WMA_LOGE(FL(" WMA context is invald!"));
+		return VOS_STATUS_E_INVAL;
+	}
+
+	len = sizeof(*cmd);
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+
+	if (!buf) {
+		WMA_LOGE(FL("Failed allocate wmi buffer"));
+		return VOS_STATUS_E_NOMEM;
+	}
+
+	buf_ptr = (u_int8_t *) wmi_buf_data(buf);
+	cmd = (wmi_peer_set_rx_blocksize_cmd_fixed_param *) buf_ptr;
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+	WMITLV_TAG_STRUC_wmi_peer_set_rx_blocksize_cmd_fixed_param,
+	WMITLV_GET_STRUCT_TLVLEN(wmi_peer_set_rx_blocksize_cmd_fixed_param));
+
+	cmd->vdev_id = peer_rx_blocksize->vdev_id;
+	cmd->rx_block_ack_win_limit =
+		peer_rx_blocksize->rx_block_ack_win_limit;
+	WMI_CHAR_ARRAY_TO_MAC_ADDR(peer_rx_blocksize->peer_macaddr.bytes,
+		&cmd->peer_macaddr);
+
+	WMA_LOGD("rx aggr blocksize: %d", cmd->rx_block_ack_win_limit);
+
+	ret = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
+			WMI_PEER_SET_RX_BLOCKSIZE_CMDID);
+	if (ret) {
+		WMA_LOGE(FL("Failed to send aggregation size command"));
+		wmi_buf_free(buf);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * wma_process_action_frame_random_mac() - set/clear action frame random mac
+ * @wma_handle: pointer to wma handle
+ * @filter: pointer to buffer containing random mac, session_id and callback
+ *
+ * Return: VOS_STATUS_SUCCESS for success or error code.
+ */
+static VOS_STATUS
+wma_process_action_frame_random_mac(tp_wma_handle wma_handle,
+				    struct action_frame_random_filter *filter)
+{
+	wmi_vdev_add_mac_addr_to_rx_filter_cmd_fixed_param *cmd;
+	uint32_t len;
+	wmi_buf_t buf;
+	int ret;
+	struct action_frame_random_filter *filter_bkup = NULL;
+	struct wma_txrx_node *intr = NULL;
+
+	if (!filter) {
+		WMA_LOGE(FL("invalid pointer"));
+		return VOS_STATUS_E_INVAL;
+	}
+
+	if (!wma_handle) {
+		WMA_LOGE(FL("WMA context is invald!"));
+		return VOS_STATUS_E_INVAL;
+	}
+
+	if (filter->filter_type == SME_ACTION_FRAME_RANDOM_MAC_SET) {
+		intr = &wma_handle->interfaces[filter->session_id];
+		/* command is in progess */
+		if(intr->action_frame_filter != NULL) {
+			WMA_LOGE(FL("previous action frame req is pending"));
+			return VOS_STATUS_SUCCESS;
+		}
+
+		filter_bkup = adf_os_mem_alloc(NULL, sizeof(*filter));
+			if (!filter_bkup) {
+				WMA_LOGE(
+				FL("action frame filter mem alloc failed"));
+				return VOS_STATUS_E_FAILURE;
+			}
+
+		adf_os_mem_set(filter_bkup, 0, sizeof(*filter));
+		filter_bkup->session_id = filter->session_id;
+		filter_bkup->callback = filter->callback;
+		filter_bkup->filter_type = filter->filter_type;
+		filter_bkup->context = filter->context;
+
+		vos_mem_copy(filter_bkup->mac_addr, filter->mac_addr,
+			     VOS_MAC_ADDR_SIZE);
+		intr->action_frame_filter = (void *)filter_bkup;
+	}
+
+	len = sizeof(*cmd);
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+
+	if (!buf) {
+		WMA_LOGE(FL("Failed allocate wmi buffer"));
+		return VOS_STATUS_E_NOMEM;
+	}
+	cmd = (wmi_vdev_add_mac_addr_to_rx_filter_cmd_fixed_param *)
+		wmi_buf_data(buf);
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+	WMITLV_TAG_STRUC_wmi_vdev_add_mac_addr_to_rx_filter_cmd_fixed_param,
+	WMITLV_GET_STRUCT_TLVLEN(wmi_vdev_add_mac_addr_to_rx_filter_cmd_fixed_param));
+
+	cmd->vdev_id = filter->session_id;
+	WMI_CHAR_ARRAY_TO_MAC_ADDR(filter->mac_addr, &cmd->mac_addr);
+	if (filter->filter_type == SME_ACTION_FRAME_RANDOM_MAC_SET)
+		cmd->enable = 1;
+	else
+		cmd->enable = 0;
+
+	ret = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
+			WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_CMDID);
+	if (ret) {
+		WMA_LOGE(FL("Failed to send action frame random mac cmd"));
+		wmi_buf_free(buf);
+		if (filter->filter_type == SME_ACTION_FRAME_RANDOM_MAC_SET) {
+			adf_os_mem_free(filter_bkup);
+			intr->action_frame_filter = NULL;
+		}
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	return VOS_STATUS_SUCCESS;
+}
+
+static VOS_STATUS wma_get_isolation(tp_wma_handle wma)
+{
+    tp_wma_handle wma_handle = (tp_wma_handle)wma;
+    wmi_coex_get_antenna_isolation_cmd_fixed_param *cmd;
+    wmi_buf_t  wmi_buf;
+    uint32_t  len;
+    uint8_t *buf_ptr;
+
+    WMA_LOGE("%s: get isolation",
+            __func__);
+
+    if (!wma_handle || !wma_handle->wmi_handle) {
+        WMA_LOGE("%s: WMA is closed, can not issue get isolation",
+                __func__);
+        return VOS_STATUS_E_INVAL;
+    }
+
+    len  = sizeof(wmi_coex_get_antenna_isolation_cmd_fixed_param);
+    wmi_buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+    if (!wmi_buf) {
+        WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
+        return VOS_STATUS_E_NOMEM;
+    }
+    buf_ptr = (uint8_t *)wmi_buf_data(wmi_buf);
+
+    cmd = (wmi_coex_get_antenna_isolation_cmd_fixed_param *)buf_ptr;
+    WMITLV_SET_HDR(&cmd->tlv_header,
+            WMITLV_TAG_STRUC_wmi_coex_get_antenna_isolation_cmd_fixed_param,
+            WMITLV_GET_STRUCT_TLVLEN(wmi_coex_get_antenna_isolation_cmd_fixed_param));
+
+    if (wmi_unified_cmd_send(wma_handle->wmi_handle, wmi_buf, len,
+                WMI_COEX_GET_ANTENNA_ISOLATION_CMDID)) {
+        WMA_LOGE("Failed to get isolation request from fw");
+        wmi_buf_free(wmi_buf);
+        return VOS_STATUS_E_FAILURE;
+    }
+
+    return VOS_STATUS_SUCCESS;
+}
+
+/*
+ * wma_peer_flush_pending() - Flush peer data in fw
+ * @wma_handle: WMA handle
+ * @sta_inactivity_timer: sme_sta_inactivity_timeout
+ *
+ * This function is used to discard pending packets of tids in fw.
+ *
+ * Return: None
+ */
+static void wma_peer_flush_pending(tp_wma_handle wma,
+				   struct sme_flush_pending *flush_pend)
+{
+	u_int8_t ac_to_tid[4][2] = { {0, 3}, {1, 2}, {4, 5}, {6, 7} };
+	u_int8_t vdev_id, peer_id;
+	u_int32_t peer_tid_bitmap = 0;
+	struct wma_txrx_node *iface;
+	u_int8_t i;
+	struct ol_txrx_peer_t *peer;
+	ol_txrx_pdev_handle pdev;
+
+	pdev = vos_get_context(VOS_MODULE_ID_TXRX, wma->vos_context);
+	if (!pdev) {
+		WMA_LOGE("%s: pdev is NULL", __func__);
+		return;
+	}
+
+	peer = ol_txrx_find_peer_by_addr(pdev, flush_pend->peer_addr.bytes,
+					 &peer_id);
+	if (!peer) {
+		WMA_LOGE("PEER [%pM] not found", flush_pend->peer_addr.bytes);
+		return;
+	}
+	WMA_LOGI("PEER [%pM] found", flush_pend->peer_addr.bytes);
+
+	vdev_id = flush_pend->session_id;
+	iface = &wma->interfaces[vdev_id];
+	if (!iface->handle) {
+		WMA_LOGE("%s: Failed to get iface handle: %p",
+			 __func__, iface->handle);
+		return;
+	}
+
+	if (flush_pend->flush_ac) {
+		for (i = 0; i < 4; ++i) {
+			if (((flush_pend->flush_ac & 0x0f) >> i) & 0x01) {
+				peer_tid_bitmap |= (1 << ac_to_tid[i][0]) |
+						   (1 << ac_to_tid[i][1]);
+			}
+		}
+	} else {
+		return;
+	}
+
+	WMA_LOGI("%s: vdevid %d peer_tid_bitmap %08x", __func__,
+		 vdev_id, peer_tid_bitmap);
+
+	wmi_unified_peer_flush_tids_send(wma->wmi_handle,
+					 flush_pend->peer_addr.bytes,
+					 peer_tid_bitmap, vdev_id);
+}
+
 /*
  * function   : wma_mc_process_msg
  * Description :
@@ -31072,8 +34182,12 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 			wma_get_link_speed(wma_handle, msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
-		case WDA_GET_RSSI:
-			wma_get_rssi(wma_handle, msg->bodyptr);
+		case WDA_GET_PEER_INFO:
+			wma_get_peer_info(wma_handle, msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
+		case WDA_GET_PEER_INFO_EXT:
+			wma_get_peer_info_ext(wma_handle, msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
 		case WDA_MODEM_POWER_STATE_IND:
@@ -31151,11 +34265,6 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 			(tSirExtScanResetBssidHotlistReqParams *)msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
-		case WDA_EXTSCAN_SET_SSID_HOTLIST_REQ:
-			wma_set_ssid_hotlist(wma_handle,
-				(struct sir_set_ssid_hotlist_request *)msg->bodyptr);
-			vos_mem_free(msg->bodyptr);
-			break;
 		case WDA_EXTSCAN_SET_SIGNF_CHANGE_REQ:
 			wma_extscan_start_change_monitor(wma_handle,
 				(tSirExtScanSetSigChangeReqParams *)msg->bodyptr);
@@ -31225,6 +34334,11 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 				(tpSirLLStatsGetReq)msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
+		case WDA_LINK_LAYER_STATS_SET_THRESHOLD:
+			wma_config_stats_ext_threshold(wma_handle,
+						       msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
 		case SIR_HAL_UNIT_TEST_CMD:
 			wma_process_unit_test_cmd(wma_handle,
@@ -31268,6 +34382,10 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 			wma_link_status_rsp(wma_handle, msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
+		case WDA_GET_PEER_INFO_EXT_IND:
+			wma_peer_info_ext_rsp(wma_handle, msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
 		case WDA_GET_TEMPERATURE_REQ:
 			wma_get_temperature(wma_handle);
 			vos_mem_free(msg->bodyptr);
@@ -31329,6 +34447,11 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 			vos_mem_free(msg->bodyptr);
 			break;
 #endif /* WLAN_FEATURE_APFIND */
+		case WDA_DSRC_RADIO_CHAN_STATS_REQ:
+			wma_process_radio_chan_stats_req(wma_handle,
+				(struct radio_chan_stats_req *)msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
 		case WDA_OCB_SET_CONFIG_CMD:
 			wma_ocb_set_config_req(wma_handle,
 				(struct sir_ocb_config *)msg->bodyptr);
@@ -31405,11 +34528,6 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 				(struct sir_guard_time_request *)msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
-		case WDA_FW_MEM_DUMP_REQ:
-			wma_process_fw_mem_dump_req(wma_handle,
-				(struct fw_dump_req*)msg->bodyptr);
-			vos_mem_free(msg->bodyptr);
-                        break;
 		case SIR_HAL_START_STOP_LOGGING:
 			wma_set_wifi_start_packet_stats(wma_handle,
 				(struct sir_wifi_start_log *)msg->bodyptr);
@@ -31525,6 +34643,38 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 					msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
+		case SIR_HAL_GET_CHAIN_RSSI_REQ:
+			wma_get_chain_rssi(wma_handle, msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
+		case SIR_HAL_SET_REORDER_TIMEOUT_CMDID:
+			wma_set_rx_reorder_timeout_val(wma_handle,
+							msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
+		case SIR_HAL_SET_RX_BLOCKSIZE_CMDID:
+			wma_set_rx_blocksize(wma_handle, msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
+		case SIR_HAL_POWER_DEBUG_STATS_REQ:
+			wma_process_power_debug_stats_req(wma_handle);
+			break;
+		case WDA_ACTION_FRAME_RANDOM_MAC:
+			wma_process_action_frame_random_mac(wma_handle,
+			     (struct action_frame_random_filter *)msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
+        case WDA_GET_ISOLATION:
+            wma_get_isolation(wma_handle);
+            break;
+		case WDA_PEER_FLUSH_PENDING:
+			wma_peer_flush_pending(wma_handle, msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
+		case WDA_SET_AC_TXQ_OPTIMIZE:
+			wma_set_ac_txq_optimize(wma_handle, msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
 		default:
 			WMA_LOGD("unknow msg type %x", msg->type);
 			/* Do Nothing? MSG Body should be freed at here */
@@ -31549,10 +34699,14 @@ static int wma_scan_event_callback(WMA_HANDLE handle, u_int8_t *data,
 	vos_msg_t vos_msg = {0};
 	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
 
-        param_buf = (WMI_SCAN_EVENTID_param_tlvs *) data;
-        wmi_event = param_buf->fixed_param;
-        vdev_id = wmi_event->vdev_id;
-        scan_id = wma_handle->interfaces[vdev_id].scan_info.scan_id;
+	param_buf = (WMI_SCAN_EVENTID_param_tlvs *) data;
+	wmi_event = param_buf->fixed_param;
+	vdev_id = wmi_event->vdev_id;
+	if (wmi_event->vdev_id >= wma_handle->max_bssid) {
+		WMA_LOGE("Invalid vdev id from firmware");
+		return -EINVAL;
+	}
+	scan_id = wma_handle->interfaces[vdev_id].scan_info.scan_id;
 
 	adf_os_spin_lock_bh(&wma_handle->roam_preauth_lock);
 	if (wma_handle->roam_preauth_scan_id == wmi_event->scan_id) {
@@ -31560,7 +34714,7 @@ static int wma_scan_event_callback(WMA_HANDLE handle, u_int8_t *data,
 		adf_os_spin_unlock_bh(&wma_handle->roam_preauth_lock);
 
 		if (wmi_event->event & WMI_SCAN_FINISH_EVENTS) {
-			WMA_LOGE(" roam scan complete - scan_id %x, vdev_id %x",
+			WMA_LOGD(" roam scan complete - scan_id %x, vdev_id %x",
 					wmi_event->scan_id, vdev_id);
 			wma_reset_scan_info(wma_handle, vdev_id);
 		}
@@ -31643,7 +34797,7 @@ static int wma_scan_event_callback(WMA_HANDLE handle, u_int8_t *data,
         /* Stop the scan completion timeout if the event is WMI_SCAN_EVENT_COMPLETED */
         if (scan_event->event ==
                           (enum sir_scan_event_type) WMI_SCAN_EVENT_COMPLETED) {
-                WMA_LOGE(" scan complete - scan_id %x, vdev_id %x",
+                WMA_LOGD(" scan complete - scan_id %x, vdev_id %x",
 		wmi_event->scan_id, vdev_id);
 		/*
 		 * first stop the timer then reset scan info, else there is a
@@ -31940,6 +35094,14 @@ static int wma_roam_event_callback(WMA_HANDLE handle, u_int8_t *event_buf,
 	WMA_LOGD("%s: Reason %x for vdevid %x, rssi %d",
 		__func__, wmi_event->reason, wmi_event->vdev_id, wmi_event->rssi);
 
+	if (wmi_event->vdev_id >= wma_handle->max_bssid) {
+		WMA_LOGE("Invalid vdev id from firmware");
+		return -EINVAL;
+	}
+
+	DPTRACE(adf_dp_trace_record_event(ADF_DP_TRACE_EVENT_RECORD,
+		wmi_event->vdev_id, ADF_PROTO_TYPE_EVENT, ADF_ROAM_EVENTID));
+
 	switch(wmi_event->reason) {
 	case WMI_ROAM_REASON_BMISS:
 		WMA_LOGD("Beacon Miss for vdevid %x",
@@ -32044,6 +35206,11 @@ static int wma_nlo_match_evt_handler(void *handle, u_int8_t *event,
 	nlo_event = param_buf->fixed_param;
 	WMA_LOGD("PNO match event received for vdev %d",
 		 nlo_event->vdev_id);
+	if (nlo_event->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("Invalid vdev id in the NLO event %d",
+				nlo_event->vdev_id);
+		return -EINVAL;
+	}
 
 	node = &wma->interfaces[nlo_event->vdev_id];
 	if (node)
@@ -32192,7 +35359,8 @@ static int wma_mcc_vdev_tx_pause_evt_handler(void *handle, u_int8_t *event,
 	/* FW mapped vdev from ID
 	 * vdev_map = (1 << vdev_id)
 	 * So, host should unmap to ID */
-	for (vdev_id = 0; vdev_map != 0; vdev_id++)
+	for (vdev_id = 0; vdev_map != 0 && vdev_id < wma->max_bssid;
+	     vdev_id++)
 	{
 		if (!(vdev_map & 0x1))
 		{
@@ -32336,66 +35504,38 @@ u_int8_t wma_thermal_mgmt_get_level(void *handle, u_int32_t temp)
 	return level;
 }
 
-/* function   : wma_thermal_mgmt_evt_handler
- * Description : This function handles the thermal mgmt event from the firmware
- * Args       :
-                wma_handle     : Pointer to WMA handle
- *              event          : Thermal event information
- *              len            :
- * Returns    :
- *              0 for success otherwise failure
- */
-static int wma_thermal_mgmt_evt_handler(void *handle, u_int8_t *event,
-					u_int32_t len)
+static int wma_thermal_throttle_handler(void *handle, u_int32_t degree_c)
 {
-	tp_wma_handle wma;
-	wmi_thermal_mgmt_event_fixed_param *tm_event;
+	tp_wma_handle wma = (tp_wma_handle)handle;
 	u_int8_t thermal_level;
 	t_thermal_cmd_params thermal_params;
-	WMI_THERMAL_MGMT_EVENTID_param_tlvs *param_buf;
 	ol_txrx_pdev_handle curr_pdev;
+	tp_thermal_mgmt info;
 
-	if (NULL == event || NULL == handle) {
-                WMA_LOGE("Invalid thermal mitigation event buffer");
-                return -EINVAL;
-        }
-
-	wma = (tp_wma_handle) handle;
-
-	if (NULL == wma) {
-		WMA_LOGE("%s: Failed to get wma handle", __func__);
-		return -EINVAL;
+	/* Check if thermal mitigation is enabled */
+	if (!wma->thermal_mgmt_info.thermalMgmtEnabled){
+		WMA_LOGD("Thermal mgmt is not enabled, ignoring event");
+		return 0;
 	}
 
-	param_buf = (WMI_THERMAL_MGMT_EVENTID_param_tlvs *) event;
-
 	curr_pdev = vos_get_context(VOS_MODULE_ID_TXRX, wma->vos_context);
 	if (NULL == curr_pdev) {
 		WMA_LOGE("%s: Failed to get pdev", __func__);
 		return -EINVAL;
 	}
 
-	/* Check if thermal mitigation is enabled */
-	if (!wma->thermal_mgmt_info.thermalMgmtEnabled){
-		WMA_LOGE("Thermal mgmt is not enabled, ignoring event");
-		return -EINVAL;
-	}
-
-	tm_event = param_buf->fixed_param;
-	WMA_LOGD("Thermal mgmt event received with temperature %d",
-		 tm_event->temperature_degreeC);
-
 	/* Get the thermal mitigation level for the reported temperature*/
-	thermal_level = wma_thermal_mgmt_get_level(handle, tm_event->temperature_degreeC);
+	thermal_level = wma_thermal_mgmt_get_level(handle, degree_c);
 	WMA_LOGD("Thermal mgmt level  %d", thermal_level);
 
-	if (thermal_level == wma->thermal_mgmt_info.thermalCurrLevel) {
+	info = &wma->thermal_mgmt_info;
+	if (thermal_level == info->thermalCurrLevel) {
 		WMA_LOGD("Current level %d is same as the set level, ignoring",
-				  wma->thermal_mgmt_info.thermalCurrLevel);
+			 info->thermalCurrLevel);
 		return 0;
 	}
 
-	wma->thermal_mgmt_info.thermalCurrLevel = thermal_level;
+	info->thermalCurrLevel = thermal_level;
 
 	/* Inform txrx */
 	ol_tx_throttle_set_level(curr_pdev, thermal_level);
@@ -32405,20 +35545,62 @@ static int wma_thermal_mgmt_evt_handler(void *handle, u_int8_t *event,
 
 	/* Get the temperature thresholds to set in firmware */
 	thermal_params.minTemp =
-		 wma->thermal_mgmt_info.thermalLevels[thermal_level].minTempThreshold;
+		info->thermalLevels[thermal_level].minTempThreshold;
 	thermal_params.maxTemp =
-		 wma->thermal_mgmt_info.thermalLevels[thermal_level].maxTempThreshold;
-	thermal_params.thermalEnable =
-		 wma->thermal_mgmt_info.thermalMgmtEnabled;
+		info->thermalLevels[thermal_level].maxTempThreshold;
+	thermal_params.thermalEnable = info->thermalMgmtEnabled;
 
 	if (VOS_STATUS_SUCCESS != wma_set_thermal_mgmt(wma, thermal_params)) {
-		WMA_LOGE("Could not send thermal mgmt command to the firmware!");
+		WMA_LOGE("Could not send thermal mgmt cmd to the firmware!");
 		return -EINVAL;
 	}
 
 	return 0;
 }
 
+
+/* function   : wma_thermal_mgmt_evt_handler
+ * Description : This function handles the thermal mgmt event from the firmware
+ * Args       :
+                wma_handle     : Pointer to WMA handle
+ *              event          : Thermal event information
+ *              len            :
+ * Returns    :
+ *              0 for success otherwise failure
+ */
+static int wma_thermal_mgmt_evt_handler(void *handle, u_int8_t *event,
+					u_int32_t len)
+{
+	tp_wma_handle wma;
+	wmi_thermal_mgmt_event_fixed_param *tm_event;
+	WMI_THERMAL_MGMT_EVENTID_param_tlvs *param_buf;
+	int ret;
+
+	if (NULL == event || NULL == handle) {
+			WMA_LOGE("Invalid thermal mitigation event buffer");
+			return -EINVAL;
+	}
+
+	wma = (tp_wma_handle) handle;
+	if (NULL == wma) {
+		WMA_LOGE("%s: Failed to get wma handle", __func__);
+		return -EINVAL;
+	}
+
+	param_buf = (WMI_THERMAL_MGMT_EVENTID_param_tlvs *) event;
+	tm_event = param_buf->fixed_param;
+	WMA_LOGD("Thermal mgmt event received with temperature %d",
+		 tm_event->temperature_degreeC);
+
+	ret = wma_thermal_throttle_handler(handle,
+		tm_event->temperature_degreeC);
+
+	wma_thermal_shutdown_evt_handler(&wma->thermal_mgmt_info,
+		tm_event->temperature_degreeC);
+
+	return ret;
+}
+
 #ifdef FEATURE_WLAN_CH_AVOID
 /* Process channel to avoid event comes from FW.
  */
@@ -32582,9 +35764,10 @@ static int wma_ibss_peer_info_event_handler(void *handle, u_int8_t *data,
     }
 
     /*sanity check*/
-    if ((num_peers > 32) || (NULL == peer_info))
+    if ((num_peers > 32) || (num_peers > param_tlvs->num_peer_info) ||
+	(!peer_info))
     {
-       WMA_LOGE("%s: Invalid event data from target num_peers %d peer_info %p",
+       WMA_LOGE("%s: Invalid event data from target num_peers %d peer_info %pK",
            __func__, num_peers, peer_info);
         status = 1;
         goto send_response;
@@ -32658,7 +35841,7 @@ static int wma_fast_tx_fail_event_handler(void *handle, u_int8_t *data,
     }
     else
     {
-       WMA_LOGE("%s: HDD callback is %p", __func__, wma->hddTxFailCb);
+       WMA_LOGE("%s: HDD callback is %pK", __func__, wma->hddTxFailCb);
     }
 
     return 0;
@@ -32741,6 +35924,11 @@ static int wma_sap_ofl_add_sta_handler(void *handle, u_int8_t *data,
 	sta_add_event = param_buf->fixed_param;
 	buf_ptr = (u_int8_t *)param_buf->bufp;
 
+	if (sta_add_event->data_len > MAX_CONNECT_REQ_LENGTH) {
+		WMA_LOGE("%s: Received data_len %d greater than max",
+			 __func__, sta_add_event->data_len);
+		return 0;
+	}
 	add_sta_req = vos_mem_malloc(sizeof(*add_sta_req));
 	if (!add_sta_req) {
 		WMA_LOGE("%s: Failed to alloc memory for sap_ofl_add_sta_event",
@@ -33149,6 +36337,18 @@ VOS_STATUS wma_start(v_VOID_t *vos_ctx)
 		WMA_LOGP("%s: Failed to register tx management", __func__);
 		goto end;
 	}
+	if (VOS_FTM_MODE != vos_get_conparam()) {
+		/* Initialize firmware time stamp sync timer */
+	    vos_status = vos_timer_init(&wma_handle->wma_fw_time_sync_timer,
+	                                VOS_TIMER_TYPE_SW,
+	                                wma_send_time_stamp_sync_cmd,
+	                                wma_handle);
+	    if (vos_status != VOS_STATUS_SUCCESS)
+			WMA_LOGE(FL("Failed to initialize firmware time stamp sync timer"));
+
+	    /* Start firmware time stamp sync timer */
+	    wma_send_time_stamp_sync_cmd(wma_handle);
+	}
 
 	/* Initialize scan completion timeout */
 	vos_status = vos_timer_init(&wma_handle->wma_scan_comp_timer,
@@ -33296,10 +36496,12 @@ VOS_STATUS wma_stop(v_VOID_t *vos_ctx, tANI_U8 reason)
 		WMA_LOGE("Failed to destroy the log completion timer");
 	}
 
-	/* Destroy firmware time stamp sync timer */
-	vos_status = vos_timer_destroy(&wma_handle->wma_fw_time_sync_timer);
-	if (vos_status != VOS_STATUS_SUCCESS)
-		WMA_LOGE(FL("Failed to destroy the fw time sync timer"));
+	if (VOS_FTM_MODE != vos_get_conparam()) {
+		/* Destroy firmware time stamp sync timer */
+		vos_status = vos_timer_destroy(&wma_handle->wma_fw_time_sync_timer);
+		if (vos_status != VOS_STATUS_SUCCESS)
+			WMA_LOGE(FL("Failed to destroy the fw time sync timer"));
+	}
 
 	/* There's no need suspend target which is already down during SSR. */
 	if (!vos_is_logp_in_progress(VOS_MODULE_ID_HIF, NULL)) {
@@ -33517,7 +36719,14 @@ VOS_STATUS wma_close(v_VOID_t *vos_ctx)
 		vos_wake_lock_destroy(&wma_handle->extscan_wake_lock);
 #endif
 		vos_wake_lock_destroy(&wma_handle->wow_wake_lock);
+		vos_wake_lock_destroy(&wma_handle->wow_auth_req_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_assoc_req_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_deauth_rec_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_disassoc_rec_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_ap_assoc_lost_wl);
+		vos_wake_lock_destroy(&wma_handle->wow_auto_shutdown_wl);
 	}
+
 	vos_mem_zero(&wma_handle->wow, sizeof(struct wma_wow));
 	wma_runtime_context_deinit(wma_handle);
 
@@ -33755,6 +36964,9 @@ static inline void wma_update_target_services(tp_wma_handle wh,
 #endif
 	cfg->chain_mask_2g = wh->txrx_chainmask & 0xFF;
 	cfg->chain_mask_5g = (wh->txrx_chainmask >> 16 ) & 0xFF;
+	if (WMI_SERVICE_IS_ENABLED(wh->wmi_service_bitmap,
+				WMI_SERVICE_PEER_STATS_INFO))
+		cfg->get_peer_info_enabled = 1;
 }
 
 static inline void wma_update_target_ht_cap(tp_wma_handle wh,
@@ -33861,6 +37073,20 @@ static inline void wma_update_target_vht_cap(tp_wma_handle wh,
 }
 #endif	/* #ifdef WLAN_FEATURE_11AC */
 
+#ifdef FEATURE_WLAN_RA_FILTERING
+static void wma_update_ra_rate_limit(tp_wma_handle wma_handle,
+				     struct hdd_tgt_cfg *cfg)
+{
+	cfg->is_ra_rate_limit_enabled = wma_handle->IsRArateLimitEnabled;
+}
+#else
+static void wma_update_ra_rate_limit(tp_wma_handle wma_handle,
+				     struct hdd_tgt_cfg *cfg)
+{
+}
+#endif
+
+
 static void wma_update_hdd_cfg(tp_wma_handle wma_handle)
 {
 	struct hdd_tgt_cfg hdd_tgt_cfg;
@@ -33869,6 +37095,7 @@ static void wma_update_hdd_cfg(tp_wma_handle wma_handle)
 
 	hdd_tgt_cfg.reg_domain = wma_handle->reg_cap.eeprom_rd;
 	hdd_tgt_cfg.eeprom_rd_ext = wma_handle->reg_cap.eeprom_rd_ext;
+	hdd_tgt_cfg.sub_20_support = wma_handle->sub_20_support;
 
 	switch (wma_handle->phy_capability) {
 	case WMI_11G_CAPABILITY:
@@ -33907,6 +37134,7 @@ static void wma_update_hdd_cfg(tp_wma_handle wma_handle)
 	hdd_tgt_cfg.wmi_max_len = wmi_get_max_msg_len(wma_handle->wmi_handle)
 					- WMI_TLV_HEADROOM;
 	hdd_tgt_cfg.bpf_enabled = wma_handle->bpf_enabled;
+	wma_update_ra_rate_limit(wma_handle, &hdd_tgt_cfg);
 	wma_update_hdd_cfg_ndp(wma_handle, &hdd_tgt_cfg);
 	wma_setup_egap_support(&hdd_tgt_cfg, wma_handle);
         hdd_tgt_cfg.max_mc_addr_list =
@@ -34088,6 +37316,19 @@ static void wma_send_time_stamp_sync_cmd(void *data)
 		WMA_LOGE("Failed to start the firmware time sync timer");
 }
 
+#ifdef FEATURE_WLAN_RA_FILTERING
+static void wma_update_ra_limit(tp_wma_handle wma_handle)
+{
+	if (wma_handle->bpf_enabled)
+		wma_handle->IsRArateLimitEnabled = false;
+}
+#else
+static void wma_update_ra__limit(tp_wma_handle handle)
+{
+}
+#endif
+
+
 /* Process service ready event and send wmi_init command */
 v_VOID_t wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 {
@@ -34097,7 +37338,6 @@ v_VOID_t wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 	struct wma_target_cap target_cap;
 	WMI_SERVICE_READY_EVENTID_param_tlvs *param_buf;
 	wmi_service_ready_event_fixed_param *ev;
-	VOS_STATUS vos_status;
 	int status;
 
 	WMA_LOGD("%s: Enter", __func__);
@@ -34115,6 +37355,12 @@ v_VOID_t wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 	}
 
 	WMA_LOGA("WMA <-- WMI_SERVICE_READY_EVENTID");
+	if (ev->num_dbs_hw_modes > param_buf->num_wlan_dbs_hw_mode_list) {
+		WMA_LOGE("FW dbs_hw_mode entry %d more than value %d in TLV hdr",
+			ev->num_dbs_hw_modes,
+			param_buf->num_wlan_dbs_hw_mode_list);
+		return;
+	}
 
 	wma_handle->phy_capability = ev->phy_capability;
 	wma_handle->max_frag_entry = ev->max_frag_entry;
@@ -34178,9 +37424,10 @@ v_VOID_t wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 	wma_handle->ap_arpns_support =
 		WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
 					WMI_SERVICE_AP_ARPNS_OFFLOAD);
-	wma_handle->bpf_enabled =
+	wma_handle->bpf_enabled = (wma_handle->bpf_packet_filter_enable &&
 		WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
-					WMI_SERVICE_BPF_OFFLOAD);
+					WMI_SERVICE_BPF_OFFLOAD));
+	wma_update_ra_limit(wma_handle);
 	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
 				WMI_SERVICE_CSA_OFFLOAD)) {
 		WMA_LOGD("%s: FW support CSA offload capability", __func__);
@@ -34263,17 +37510,6 @@ v_VOID_t wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 		wmi_buf_free(buf);
 		return;
 	}
-
-	/* Initialize firmware time stamp sync timer */
-	vos_status = vos_timer_init(&wma_handle->wma_fw_time_sync_timer,
-		VOS_TIMER_TYPE_SW,
-		wma_send_time_stamp_sync_cmd,
-		wma_handle);
-	if (vos_status != VOS_STATUS_SUCCESS)
-		WMA_LOGE(FL("Failed to initialize firmware time stamp sync timer"));
-
-	/* Start firmware time stamp sync timer */
-	wma_send_time_stamp_sync_cmd(wma_handle);
 }
 
 /* function   : wma_rx_ready_event
@@ -34299,6 +37535,11 @@ v_VOID_t wma_rx_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 	WMA_LOGA("WMA <-- WMI_READY_EVENTID");
 
 	ev = param_buf->fixed_param;
+
+	wma_handle->sub_20_support =
+	    WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+	                           WMI_SERVICE_HALF_RATE_QUARTER_RATE_SUPPORT);
+
 	/* Indicate to the waiting thread that the ready
 	 * event was received */
 	wma_handle->wmi_ready = TRUE;
@@ -34912,7 +38153,7 @@ VOS_STATUS WDA_TxPacket(void *wma_context, void *tx_frame, u_int16_t frmLen,
 				vos_flush_logs(WLAN_LOG_TYPE_FATAL,
 					       WLAN_LOG_INDICATOR_HOST_DRIVER,
 					       WLAN_LOG_REASON_MGMT_FRAME_TIMEOUT,
-					       true);
+					       DUMP_VOS_TRACE);
 				wmi_crash_inject(wma_handle->wmi_handle,
 					RECOVERY_SIM_ASSERT, 0);
 			}
@@ -34929,6 +38170,7 @@ VOS_STATUS WDA_TxPacket(void *wma_context, void *tx_frame, u_int16_t frmLen,
 
 error:
 	wma_handle->tx_frm_download_comp_cb = NULL;
+	wma_handle->umac_data_ota_ack_cb = NULL;
 	return VOS_STATUS_E_FAILURE;
 }
 
@@ -35076,7 +38318,7 @@ int wma_suspend_target(WMA_HANDLE handle, int disable_target_intr)
 				 __func__);
 		} else {
 			if (pmac->sme.enableSelfRecovery) {
-				vos_trigger_recovery();
+				vos_trigger_recovery(false);
 			} else {
 				VOS_BUG(0);
 			}
@@ -35109,8 +38351,9 @@ void wma_target_suspend_acknowledge(void *context)
 
 	wma->wow_nack = wow_nack;
 	vos_event_set(&wma->target_suspend);
-	if (wow_nack)
-		vos_wake_lock_timeout_acquire(&wma->wow_wake_lock, WMA_WAKE_LOCK_TIMEOUT,
+	if (wow_nack && !wmi_get_runtime_pm_inprogress(wma->wmi_handle))
+		vos_wake_lock_timeout_acquire(&wma->wow_wake_lock,
+					      WMA_WAKE_LOCK_TIMEOUT,
 					      WIFI_POWER_EVENT_WAKELOCK_WOW);
 }
 
@@ -35337,6 +38580,11 @@ wma_process_utf_event(WMA_HANDLE handle,
 	data = param_buf->data;
 	datalen = param_buf->num_data;
 
+	if (datalen < sizeof(segHdrInfo)) {
+		WMA_LOGE("message size %d is smaller than struct seg_hdr_info",
+			 datalen);
+		return -EINVAL;
+	}
 
 	segHdrInfo = *(SEG_HDR_INFO_STRUCT *)&(data[0]);
 
@@ -35358,6 +38606,14 @@ wma_process_utf_event(WMA_HANDLE handle,
 				 currentSeq);
 	}
 
+	if ((datalen > MAX_UTF_EVENT_LENGTH) ||
+		(wma_handle->utf_event_info.offset >
+		(MAX_UTF_EVENT_LENGTH - datalen))) {
+		WMA_LOGE("Excess data from firmware, offset:%zu, len:%d",
+			wma_handle->utf_event_info.offset, datalen);
+		return -EINVAL;
+	}
+
 	memcpy(&wma_handle->utf_event_info.data[wma_handle->utf_event_info.offset],
 	       &data[sizeof(segHdrInfo)],
                datalen);
@@ -35533,7 +38789,8 @@ VOS_STATUS WDA_SetIdlePsConfig(void *wda_handle, tANI_U32 idle_ps)
 	tp_wma_handle wma = (tp_wma_handle)wda_handle;
 
 	WMA_LOGD("WMA Set Idle Ps Config [1:set 0:clear] val %d", idle_ps);
-
+	/* only use vdev 0 for imps tracking */
+	wma->interfaces[0].in_imps = idle_ps;
 	/* Set Idle Mode Power Save Config */
 	ret = wmi_unified_pdev_set_param(wma->wmi_handle,
 			WMI_PDEV_PARAM_IDLE_PS_CONFIG, idle_ps);
@@ -35577,6 +38834,74 @@ VOS_STATUS wma_set_cts2self_for_p2p_go(void *wda_handle,
 }
 
 /**
+ * wmi_unified_ac_txq_optimize_send() - set command to firmware.
+ * @wmi:                     wmi_unified_t
+ * @ac_txq_optimize:         value needs to set to firmware.
+ *
+ * Return: VOS_STATUS.
+ */
+static int32_t
+wmi_unified_ac_txq_optimize_send(wmi_unified_t wmi, uint8_t *ac_txq_optimize)
+{
+	wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param *cmd;
+	wmi_buf_t buf;
+	int32_t len = sizeof(*cmd);
+
+	buf = wmi_buf_alloc(wmi, len);
+
+	if (!buf) {
+		WMA_LOGP("%s: wmi_buf_alloc failed", __func__);
+		return -ENOMEM;
+	}
+	cmd = (wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param *)
+	       wmi_buf_data(buf);
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		       WMITLV_TAG_STRUC_wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param,
+		       WMITLV_GET_STRUCT_TLVLEN(
+		       wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param));
+
+	cmd->pdev_id = 0;
+	if ((*ac_txq_optimize & 0x0f) < NUM_AC)
+		cmd->ac = *ac_txq_optimize & 0x0f;
+	else
+		return -EINVAL;
+
+	cmd->ac_tx_queue_optimize_enable = 1;
+
+	if (wmi_unified_cmd_send(wmi, buf, len,
+				 WMI_PDEV_SET_AC_TX_QUEUE_OPTIMIZED_CMDID)) {
+		WMA_LOGP("%s: Failed to send AC queue optimize command",
+			 __func__);
+		wmi_buf_free(buf);
+		return -EIO;
+	}
+	WMA_LOGI("%s: ac %d pdev_id %d", __func__, cmd->ac, cmd->pdev_id);
+	return 0;
+}
+
+/**
+ * wma_set_ac_txq_optimize() - set one AC Tx queue optimize command.
+ * @wda_handle:        pointer to wma handle.
+ * @value:             value needs to set to firmware.
+ *
+ * Return: VOS_STATUS.
+ */
+VOS_STATUS wma_set_ac_txq_optimize(void *wda_handle, uint8_t *value)
+{
+	int32_t ret;
+	tp_wma_handle wma = (tp_wma_handle)wda_handle;
+
+	ret = wmi_unified_ac_txq_optimize_send(wma->wmi_handle, value);
+	if (ret) {
+		WMA_LOGE("Fail to Set AC queue, input 0x%02x", *value);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	WMA_LOGI("Successfully Set AC queue, input 0x%02x", *value);
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
  * wma_set_mib_stats_enable() - enable mib stats in FW.
  * @wda_handle: pointer to wma handle.
  * @enable: value needs to set to firmware.
@@ -36335,6 +39660,7 @@ struct ieee80211com* wma_dfs_attach(struct ieee80211com *dfs_ic)
      * and shared DFS code
      */
     dfs_ic->ic_dfs_notify_radar = ieee80211_mark_dfs;
+    dfs_ic->ic_update_dfs_cac_block_tx = ieee80211_update_dfs_cac_block_tx;
     adf_os_spinlock_init(&dfs_ic->chan_lock);
     /* Initializes DFS Data Structures and queues*/
     dfs_attach(dfs_ic);
@@ -36593,6 +39919,27 @@ int wma_get_channels(struct ieee80211_channel *ichan,
 	return chan_list->nchannels;
 }
 
+void wma_update_dfs_cac_block_tx(bool cac_block_tx)
+{
+	tp_wma_handle wma;
+	void *hdd_ctx;
+	void *vos_context;
+
+	vos_context = vos_get_global_context(VOS_MODULE_ID_VOSS, NULL);
+	if (!vos_context) {
+		WMA_LOGE("%s: VOS context is invald!", __func__);
+		return;
+	}
+
+	wma = (tp_wma_handle) vos_get_context(VOS_MODULE_ID_WDA, vos_context);
+
+	if (wma == NULL) {
+		WMA_LOGE("%s: DFS- Invalid wma", __func__);
+		return;
+	}
+	hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, wma->vos_context);
+	wma->dfs_block_tx_cb(hdd_ctx, cac_block_tx);
+}
 
 /*
  * Indicate Radar to SAP/HDD
@@ -36629,20 +39976,12 @@ int wma_dfs_indicate_radar(struct ieee80211com *ic,
 		WMA_LOGE("%s:DFS- Invalid WMA handle", __func__);
 		return -ENOENT;
 	}
-	radar_event = (struct wma_dfs_radar_indication *)
-		vos_mem_malloc(sizeof(struct wma_dfs_radar_indication));
-	if (radar_event == NULL)
-	{
-		WMA_LOGE("%s:DFS- Invalid radar_event", __func__);
-		return -ENOENT;
-	}
 
 	/*
 	 * Do not post multiple Radar events on the same channel.
 	 * But, when DFS test mode is enabled, allow multiple dfs
 	 * radar events to be posted on the same channel.
 	 */
-
 	adf_os_spin_lock_bh(&ic->chan_lock);
 	if (!pmac->sap.SapDfsInfo.disable_dfs_ch_switch)
 		wma->dfs_ic->disable_phy_err_processing = true;
@@ -36650,6 +39989,14 @@ int wma_dfs_indicate_radar(struct ieee80211com *ic,
 	if ((ichan->ic_ieee  != (wma->dfs_ic->last_radar_found_chan)) ||
 	    ( pmac->sap.SapDfsInfo.disable_dfs_ch_switch == VOS_TRUE) )
 	{
+		radar_event = (struct wma_dfs_radar_indication *)
+			vos_mem_malloc(sizeof(*radar_event));
+		if (radar_event == NULL) {
+			WMA_LOGE(FL("Failed to allocate memory for radar_event"));
+			adf_os_spin_unlock_bh(&ic->chan_lock);
+			return -ENOMEM;
+		}
+
 		/* Indicate the radar event to HDD to stop the netif Tx queues*/
 		hdd_radar_event.ieee_chan_number = ichan->ic_ieee;
 		hdd_radar_event.chan_freq = ichan->ic_freq;
@@ -36735,6 +40082,44 @@ VOS_STATUS WMA_GetWcnssSoftwareVersion(v_PVOID_t pvosGCtx,
         return VOS_STATUS_SUCCESS;
 }
 
+#ifdef HL_RX_AGGREGATION_HOLE_DETCTION
+/**
+ * ol_rx_aggregation_hole - ol rx aggregation hole report
+ * @hole_info: hole_info
+ *
+ * Return: void
+ */
+void ol_rx_aggregation_hole(uint32_t hole_info)
+{
+	struct sir_sme_rx_aggr_hole_ind *rx_aggr_hole_event;
+	uint32_t alloc_len;
+	vos_msg_t vos_msg;
+	VOS_STATUS status;
+
+	alloc_len = sizeof(*rx_aggr_hole_event) +
+		sizeof(rx_aggr_hole_event->hole_info_array[0]);
+	rx_aggr_hole_event = vos_mem_malloc(alloc_len);
+	if (NULL == rx_aggr_hole_event) {
+		WMA_LOGE("%s: Memory allocation failure", __func__);
+		return;
+	}
+
+	rx_aggr_hole_event->hole_cnt = 1;
+	rx_aggr_hole_event->hole_info_array[0] = hole_info;
+
+	vos_msg.type = eWNI_SME_RX_AGGR_HOLE_IND;
+	vos_msg.bodyptr = rx_aggr_hole_event;
+	vos_msg.bodyval = 0;
+
+	status = vos_mq_post_message(VOS_MQ_ID_SME, &vos_msg);
+	if (status != VOS_STATUS_SUCCESS) {
+		WMA_LOGE("%s: Failed to post aggr event to SME", __func__);
+		vos_mem_free(rx_aggr_hole_event);
+		return;
+	}
+}
+#endif
+
 void ol_rx_err(ol_pdev_handle pdev, u_int8_t vdev_id,
 	       u_int8_t *peer_mac_addr, int tid, u_int32_t tsf32,
 	       enum ol_rx_err_type err_type, adf_nbuf_t rx_frame,
@@ -36851,11 +40236,11 @@ void WDA_TxAbort(v_U8_t vdev_id)
 
 	iface = &wma->interfaces[vdev_id];
 	if (!iface->handle) {
-		WMA_LOGE("%s: Failed to get iface handle: %p",
+		WMA_LOGE("%s: Failed to get iface handle: %pK",
 			 __func__, iface->handle);
 		return;
 	}
-	WMA_LOGA("%s: vdevid %d bssid %pM", __func__, vdev_id, iface->bssid);
+	WMA_LOGI("%s: vdevid %d bssid %pM", __func__, vdev_id, iface->bssid);
 	iface->pause_bitmap |= (1 << PAUSE_TYPE_HOST);
 	wdi_in_vdev_pause(iface->handle, OL_TXQ_PAUSE_REASON_TX_ABORT);
 
@@ -36875,6 +40260,7 @@ static void wma_set_vdev_suspend_dtim(tp_wma_handle wma, v_U8_t vdev_id)
 		int32_t ret;
 		u_int32_t listen_interval;
 		u_int32_t max_mod_dtim;
+		u_int32_t beacon_interval_mod;
 
 		if (wma->staDynamicDtim) {
 			listen_interval = wma->staDynamicDtim;
@@ -36890,7 +40276,16 @@ static void wma_set_vdev_suspend_dtim(tp_wma_handle wma, v_U8_t vdev_id)
 			  * Else
 			  * Set LI to maxModulatedDTIM * AP_DTIM
 			  */
-			max_mod_dtim = wma->staMaxLIModDtim/iface->dtimPeriod;
+			beacon_interval_mod = iface->beaconInterval/100;
+			if (beacon_interval_mod == 0)
+				beacon_interval_mod = 1;
+
+			max_mod_dtim = wma->staMaxLIModDtim
+				/(iface->dtimPeriod*beacon_interval_mod);
+
+			if (max_mod_dtim <= 0)
+				max_mod_dtim = 1;
+
 			if (max_mod_dtim >= wma->staModDtim) {
 				listen_interval =
 					(wma->staModDtim * iface->dtimPeriod);
@@ -37151,6 +40546,10 @@ void wma_process_roam_synch_complete(WMA_HANDLE handle,
 		wmi_buf_free(wmi_buf);
 		return;
 	}
+
+	DPTRACE(adf_dp_trace_record_event(ADF_DP_TRACE_EVENT_RECORD,
+		synchcnf->sessionId, ADF_PROTO_TYPE_EVENT, ADF_ROAM_COMPLETE));
+
 	return;
 }
 void wma_process_roam_synch_fail(WMA_HANDLE handle,
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.h
index c752a540f72..b5eb6d6466e 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -101,12 +101,14 @@
 
 #define FRAGMENT_SIZE 3072
 
+#define WMA_MAX_MGMT_MPDU_LEN     2000
+
 #define WMA_INVALID_VDEV_ID				0xFF
 #define MAX_MEM_CHUNKS					32
 #define WMA_MAX_VDEV_SIZE				20
 #define WMA_VDEV_TBL_ENTRY_ADD				1
 #define WMA_VDEV_TBL_ENTRY_DEL				0
-
+#define WMA_SVC_MSG_MAX_SIZE                            1536
 
 /* 11A/G channel boundary */
 #define WMA_11A_CHANNEL_BEGIN           34
@@ -467,8 +469,10 @@ typedef struct {
 	u_int32_t txpow5g;
 	u_int32_t burst_enable;
 	u_int32_t burst_dur;
-	u_int32_t chainmask_2g;
-	u_int32_t chainmask_5g;
+	u_int32_t chainmask_2g_tx;
+	u_int32_t chainmask_5g_tx;
+	u_int32_t chainmask_2g_rx;
+	u_int32_t chainmask_5g_rx;
 } pdev_cli_config_t;
 
 typedef struct {
@@ -599,6 +603,10 @@ struct wma_txrx_node {
 	v_BOOL_t vdev_up;
 	u_int64_t tsfadjust;
 	void     *addBssStaContext;
+	/* Have a back up of arp offload req */
+	tSirHostOffloadReq arp_offload_req;
+	/* tSirHostOffloadReq of ns offload req */
+	tSirHostOffloadReq ns_offload_req;
 	tANI_U8 aid;
 	/* Robust Management Frame (RMF) enabled/disabled */
 	tANI_U8 rmfEnabled;
@@ -639,7 +647,10 @@ struct wma_txrx_node {
 
 	uint8_t wep_default_key_idx;
 	bool is_vdev_valid;
-
+	uint16_t channelwidth;
+	struct action_frame_random_filter *action_frame_filter;
+	uint8_t in_bmps;
+	uint8_t in_imps;
 };
 
 #if defined(QCA_WIFI_FTM)
@@ -769,6 +780,7 @@ typedef struct wma_handle {
 	wda_tgt_cfg_cb tgt_cfg_update_cb;
    /*Callback to indicate radar to HDD*/
    wda_dfs_radar_indication_cb dfs_radar_indication_cb;
+	wda_dfs_block_tx_cb dfs_block_tx_cb;
 	HAL_REG_CAPABILITIES reg_cap;
 	u_int32_t scan_id;
 	struct wma_txrx_node *interfaces;
@@ -792,16 +804,12 @@ typedef struct wma_handle {
 	u_int8_t no_of_suspend_ind;
 	u_int8_t no_of_resume_ind;
 
-	/* Have a back up of arp info to send along
-	 * with ns info suppose if ns also enabled
-	 */
-	tSirHostOffloadReq mArpInfo;
 	struct wma_tx_ack_work_ctx *ack_work_ctx;
 	u_int8_t powersave_mode;
 	v_BOOL_t ptrn_match_enable_all_vdev;
 	void* pGetRssiReq;
 	v_S7_t first_rssi;
-	bool get_sta_rssi;
+	bool get_sta_peer_info;
 	v_MACADDR_t peer_macaddr;
 	t_thermal_mgmt thermal_mgmt_info;
         v_BOOL_t  roam_offload_enabled;
@@ -842,9 +850,18 @@ typedef struct wma_handle {
 	vos_wake_lock_t extscan_wake_lock;
 #endif
 	vos_wake_lock_t wow_wake_lock;
+	vos_wake_lock_t wow_auth_req_wl;
+	vos_wake_lock_t wow_assoc_req_wl;
+	vos_wake_lock_t wow_deauth_rec_wl;
+	vos_wake_lock_t wow_disassoc_rec_wl;
+	vos_wake_lock_t wow_ap_assoc_lost_wl;
+	vos_wake_lock_t wow_auto_shutdown_wl;
+
 	int wow_nack;
 	u_int32_t ap_client_cnt;
 	adf_os_atomic_t is_wow_bus_suspended;
+	adf_os_atomic_t dfs_wmi_event_pending;
+	adf_os_atomic_t dfs_wmi_event_dropped;
 
 	vos_timer_t wma_scan_comp_timer;
 	scan_timer_info wma_scan_timer_info;
@@ -907,6 +924,7 @@ typedef struct wma_handle {
 	uint32_t wow_gscan_wake_up_count;
 	uint32_t wow_low_rssi_wake_up_count;
 	uint32_t wow_rssi_breach_wake_up_count;
+	uint32_t wow_pwr_save_fail_detected_wake_up_count;
 	uint32_t wow_ucast_wake_up_count;
 	uint32_t wow_bcast_wake_up_count;
 	uint32_t wow_ipv4_mcast_wake_up_count;
@@ -917,14 +935,15 @@ typedef struct wma_handle {
 	uint32_t wow_icmpv4_count;
 	uint32_t wow_icmpv6_count;
 	uint32_t wow_oem_response_wake_up_count;
-	uint32_t wow_wakeup_enable_mask;
-	uint32_t wow_wakeup_disable_mask;
+	uint32_t wow_wakeup_enable_mask[4];
+	uint32_t wow_wakeup_disable_mask[4];
 	uint16_t max_mgmt_tx_fail_count;
 	uint32_t ccmp_replays_attack_cnt;
 
 	struct wma_runtime_pm_context runtime_context;
 	uint32_t fine_time_measurement_cap;
 	bool bpf_enabled;
+	bool bpf_packet_filter_enable;
 	bool pause_other_vdev_on_mcc_start;
 
 	/* NAN datapath support enabled in firmware */
@@ -933,6 +952,8 @@ typedef struct wma_handle {
 	vos_timer_t wma_fw_time_sync_timer;
 	struct sir_allowed_action_frames allowed_action_frames;
 	tSirAddonPsReq psSetting;
+	bool sub_20_support;
+	bool get_one_peer_info;
 }t_wma_handle, *tp_wma_handle;
 
 struct wma_target_cap {
@@ -1368,6 +1389,7 @@ struct wma_vdev_start_req {
 	bool is_half_rate;
 	bool is_quarter_rate;
 	u_int16_t beacon_tx_rate;
+	uint16_t channelwidth;
 };
 
 struct wma_set_key_params {
@@ -1381,6 +1403,7 @@ struct wma_set_key_params {
 	u_int32_t key_idx;
 	bool unicast;
 	u_int8_t key_data[SIR_MAC_MAX_KEY_LENGTH];
+	u_int8_t key_rsc[SIR_MAC_MAX_KEY_RSC_LEN];
 };
 
 typedef struct {
@@ -1467,6 +1490,8 @@ VOS_STATUS wma_send_snr_request(tp_wma_handle wma_handle, void *pGetRssiReq,
 #define WMA_DISASSOC_RECV_WAKE_LOCK_DURATION	(5 * 1000) /* in msec */
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
 #define WMA_AUTO_SHUTDOWN_WAKE_LOCK_DURATION    (5 * 1000) /* in msec */
+#else
+#define WMA_AUTO_SHUTDOWN_WAKE_LOCK_DURATION 0
 #endif
 #define WMA_BMISS_EVENT_WAKE_LOCK_DURATION      (4 * 1000) /* in msec */
 
@@ -1682,6 +1707,22 @@ int ol_if_dfs_get_mib_cycle_counts_pct(struct ieee80211com *ic,
 u_int16_t ol_if_dfs_usenol(struct ieee80211com *ic);
 void ieee80211_mark_dfs(struct ieee80211com *ic,
                                struct ieee80211_channel *ichan);
+/**
+ * wma_update_dfs_cac_block_tx - to set dfs_cac_block_tx flag
+ * @cac_block_tx: value to be set
+ *
+ * Return: none
+ */
+void wma_update_dfs_cac_block_tx(bool cac_block_tx);
+/**
+ * ieee80211_update_dfs_cac_block_tx() - to set dfs_cac_block_tx flag
+ * @cac_block_tx: value to be set
+ *
+ * Return: none
+ */
+static inline void ieee80211_update_dfs_cac_block_tx(bool cac_block_tx) {
+	wma_update_dfs_cac_block_tx(cac_block_tx);
+}
 int  wma_dfs_indicate_radar(struct ieee80211com *ic,
                                struct ieee80211_channel *ichan);
 u_int16_t   dfs_usenol(struct ieee80211com *ic);
@@ -1793,6 +1834,7 @@ uint32_t wma_get_vht_ch_width(void);
 VOS_STATUS wma_get_wakelock_stats(struct sir_wake_lock_stats *wake_lock_stats);
 VOS_STATUS wma_set_tx_rx_aggregation_size
 	(struct sir_set_tx_rx_aggregation_size *tx_rx_aggregation_size);
+VOS_STATUS wma_set_powersave_config(uint8_t vdev_id, uint8_t val);
 
 /**
  * wma_find_vdev_by_id() - Find vdev handle for given vdev id.
@@ -1855,10 +1897,25 @@ struct wma_version_info {
 	u_int32_t revision;
 };
 
+/**
+ * wma_stop_radar_delay_timer() - stop radar delay found event timer
+ *
+ * Return: none
+ */
+void wma_stop_radar_delay_timer(void);
+
+/**
+ * wma_ignore_radar_soon_after_assoc() - ignore radar found 300ms after assoc
+ *
+ * Return: none
+ */
+void wma_ignore_radar_soon_after_assoc(void);
+
 void wma_remove_peer(tp_wma_handle wma, u_int8_t *bssid,
 			u_int8_t vdev_id, ol_txrx_peer_handle peer,
 			v_BOOL_t roam_synch_in_progress);
 
+#define WOW_BITMAP_FIELD_SIZE 32
 void wma_add_wow_wakeup_event(tp_wma_handle wma, WOW_WAKE_EVENT_TYPE event,
 			bool enable);
 VOS_STATUS wma_create_peer(tp_wma_handle wma, ol_txrx_pdev_handle pdev,
@@ -1868,4 +1925,10 @@ VOS_STATUS wma_create_peer(tp_wma_handle wma, ol_txrx_pdev_handle pdev,
 WLAN_PHY_MODE wma_chan_to_mode(uint8_t chan, ePhyChanBondState chan_offset,
 		uint8_t vht_capable, uint8_t dot11_mode);
 
+#define RESET_BEACON_INTERVAL_TIMEOUT 200
+struct wma_beacon_interval_reset_req {
+	vos_timer_t event_timeout;
+	uint8_t vdev_id;
+	uint16_t interval;
+};
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_dfs_interface.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_dfs_interface.c
index 7cbd1670810..61f161c821a 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_dfs_interface.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_dfs_interface.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013,2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -65,7 +65,7 @@ ol_if_dfs_attach(struct ieee80211com *ic, void *ptr, void *radar_info)
 {
     struct ath_dfs_caps *pCap = (struct ath_dfs_caps *) ptr;
 
-    adf_os_print("%s: called; ptr=%p, radar_info=%p\n",
+    adf_os_print("%s: called; ptr=%pK, radar_info=%pK\n",
                   __func__, ptr, radar_info);
 
     pCap->ath_chip_is_bb_tlv = 1;
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_nan_datapath.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_nan_datapath.c
index f0d85b63946..5680de022f4 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_nan_datapath.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_nan_datapath.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -43,15 +43,15 @@ VOS_STATUS wma_handle_ndp_initiator_req(tp_wma_handle wma_handle, void *req)
 	VOS_STATUS status;
 	int ret;
 	uint16_t len;
-	uint32_t vdev_id, ndp_cfg_len, ndp_app_info_len;
+	uint32_t vdev_id, ndp_cfg_len, ndp_app_info_len, pmk_len;
 	struct ndp_initiator_rsp *rsp = NULL;
-	uint8_t *cfg_info, *app_info;
 	ol_txrx_vdev_handle vdev;
 	wmi_buf_t buf;
 	wmi_ndp_initiator_req_fixed_param *cmd;
 	vos_msg_t pe_msg = {0};
 	struct ndp_initiator_req *ndp_req = req;
 	wmi_channel *ch_tlv;
+	uint8_t *tlv_ptr;
 
 	if (NULL == ndp_req) {
 		WMA_LOGE(FL("Invalid ndp_req."));
@@ -75,9 +75,11 @@ VOS_STATUS wma_handle_ndp_initiator_req(tp_wma_handle wma_handle, void *req)
 	 */
 	ndp_cfg_len = vos_roundup(ndp_req->ndp_config.ndp_cfg_len, 4);
 	ndp_app_info_len = vos_roundup(ndp_req->ndp_info.ndp_app_info_len, 4);
+	pmk_len = vos_roundup(ndp_req->pmk.pmk_len, 4);
 	/* allocated memory for fixed params as well as variable size data */
-	len = sizeof(*cmd) + ndp_cfg_len + ndp_app_info_len +
-		(2 * WMI_TLV_HDR_SIZE) + sizeof(*ch_tlv);
+	len = sizeof(*cmd) + sizeof(*ch_tlv) + (3 * WMI_TLV_HDR_SIZE)
+		+ ndp_cfg_len + ndp_app_info_len + pmk_len;
+
 	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
 	if (!buf) {
 		WMA_LOGE(FL("wmi_buf_alloc failed"));
@@ -96,6 +98,9 @@ VOS_STATUS wma_handle_ndp_initiator_req(tp_wma_handle wma_handle, void *req)
 
 	cmd->ndp_cfg_len = ndp_req->ndp_config.ndp_cfg_len;
 	cmd->ndp_app_info_len = ndp_req->ndp_info.ndp_app_info_len;
+	cmd->ndp_channel_cfg = ndp_req->channel_cfg;
+	cmd->nan_pmk_len = ndp_req->pmk.pmk_len;
+	cmd->nan_csid = ndp_req->ncs_sk_type;
 
 	ch_tlv = (wmi_channel *)&cmd[1];
 	WMITLV_SET_HDR(ch_tlv, WMITLV_TAG_STRUC_wmi_channel,
@@ -103,21 +108,26 @@ VOS_STATUS wma_handle_ndp_initiator_req(tp_wma_handle wma_handle, void *req)
 	ch_tlv->mhz = ndp_req->channel;
 	ch_tlv->band_center_freq1 =
 		vos_chan_to_freq(vos_freq_to_chan(ndp_req->channel));
+	tlv_ptr = (uint8_t *)&ch_tlv[1];
+
+	WMITLV_SET_HDR(tlv_ptr, WMITLV_TAG_ARRAY_BYTE, ndp_cfg_len);
+	vos_mem_copy(&tlv_ptr[WMI_TLV_HDR_SIZE],
+		     ndp_req->ndp_config.ndp_cfg, cmd->ndp_cfg_len);
+	tlv_ptr = tlv_ptr + WMI_TLV_HDR_SIZE + ndp_cfg_len;
 
-	cfg_info = (uint8_t *)&ch_tlv[1];
-	WMITLV_SET_HDR(cfg_info, WMITLV_TAG_ARRAY_BYTE, ndp_cfg_len);
-	vos_mem_copy(&cfg_info[WMI_TLV_HDR_SIZE], ndp_req->ndp_config.ndp_cfg,
-		     cmd->ndp_cfg_len);
+	WMITLV_SET_HDR(tlv_ptr, WMITLV_TAG_ARRAY_BYTE, ndp_app_info_len);
+	vos_mem_copy(&tlv_ptr[WMI_TLV_HDR_SIZE],
+		     ndp_req->ndp_info.ndp_app_info, cmd->ndp_app_info_len);
+	tlv_ptr = tlv_ptr + WMI_TLV_HDR_SIZE + ndp_app_info_len;
 
-	app_info = &cfg_info[WMI_TLV_HDR_SIZE + ndp_cfg_len];
-	WMITLV_SET_HDR(app_info, WMITLV_TAG_ARRAY_BYTE, ndp_app_info_len);
-	vos_mem_copy(&app_info[WMI_TLV_HDR_SIZE],
-		     ndp_req->ndp_info.ndp_app_info,
-		     cmd->ndp_app_info_len);
+	WMITLV_SET_HDR(tlv_ptr, WMITLV_TAG_ARRAY_BYTE, pmk_len);
+	vos_mem_copy(&tlv_ptr[WMI_TLV_HDR_SIZE], ndp_req->pmk.pmk,
+		     cmd->nan_pmk_len);
+	tlv_ptr = tlv_ptr + WMI_TLV_HDR_SIZE + pmk_len;
 
-	WMA_LOGE(FL("vdev_id = %d, transaction_id: %d, service_instance_id, %d channel: %d"),
+	WMA_LOGE(FL("vdev_id = %d, transaction_id: %d, service_instance_id: %d, ch: %d, ch_cfg: %d, csid: %d"),
 		cmd->vdev_id, cmd->transaction_id, cmd->service_instance_id,
-		ch_tlv->mhz);
+		ch_tlv->mhz, cmd->ndp_channel_cfg, cmd->nan_csid);
 	WMA_LOGE(FL("peer mac addr: mac_addr31to0: 0x%x, mac_addr47to32: 0x%x"),
 		cmd->peer_discovery_mac_addr.mac_addr31to0,
 		cmd->peer_discovery_mac_addr.mac_addr47to32);
@@ -132,8 +142,12 @@ VOS_STATUS wma_handle_ndp_initiator_req(tp_wma_handle wma_handle, void *req)
 			   ndp_req->ndp_info.ndp_app_info,
 			   ndp_req->ndp_info.ndp_app_info_len);
 
+	WMA_LOGE(FL("pmk len: %d"), cmd->nan_pmk_len);
+	VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_DEBUG,
+			   ndp_req->pmk.pmk, cmd->nan_pmk_len);
 	WMA_LOGE(FL("sending WMI_NDP_INITIATOR_REQ_CMDID(0x%X)"),
 		WMI_NDP_INITIATOR_REQ_CMDID);
+
 	ret = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
 				   WMI_NDP_INITIATOR_REQ_CMDID);
 	if (ret < 0) {
@@ -229,8 +243,8 @@ VOS_STATUS wma_handle_ndp_responder_req(tp_wma_handle wma_handle,
 {
 	wmi_buf_t buf;
 	ol_txrx_vdev_handle vdev;
-	uint32_t vdev_id = 0, ndp_cfg_len, ndp_app_info_len;
-	uint8_t *cfg_info, *app_info;
+	uint32_t vdev_id = 0, ndp_cfg_len, ndp_app_info_len, pmk_len;
+	uint8_t *tlv_ptr;
 	int ret;
 	wmi_ndp_responder_req_fixed_param *cmd;
 	uint16_t len;
@@ -264,9 +278,11 @@ VOS_STATUS wma_handle_ndp_responder_req(tp_wma_handle wma_handle,
 	 */
 	ndp_cfg_len = vos_roundup(req_params->ndp_config.ndp_cfg_len, 4);
 	ndp_app_info_len = vos_roundup(req_params->ndp_info.ndp_app_info_len, 4);
+	pmk_len = vos_roundup(req_params->pmk.pmk_len, 4);
 	/* allocated memory for fixed params as well as variable size data */
-	len = sizeof(*cmd) + ndp_cfg_len + ndp_app_info_len +
-		(2 * WMI_TLV_HDR_SIZE);
+	len = sizeof(*cmd) + 3*WMI_TLV_HDR_SIZE + ndp_cfg_len + ndp_app_info_len
+		+ pmk_len;
+
 	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
 	if (!buf) {
 		WMA_LOGE(FL("wmi_buf_alloc failed"));
@@ -284,19 +300,29 @@ VOS_STATUS wma_handle_ndp_responder_req(tp_wma_handle wma_handle,
 
 	cmd->ndp_cfg_len = req_params->ndp_config.ndp_cfg_len;
 	cmd->ndp_app_info_len = req_params->ndp_info.ndp_app_info_len;
+	cmd->nan_pmk_len = req_params->pmk.pmk_len;
+	cmd->nan_csid = req_params->ncs_sk_type;
+
+	tlv_ptr = (uint8_t *)&cmd[1];
 
-	cfg_info = (uint8_t *)&cmd[1];
-	/* WMI command expects 4 byte alligned len */
-	WMITLV_SET_HDR(cfg_info, WMITLV_TAG_ARRAY_BYTE, ndp_cfg_len);
-	vos_mem_copy(&cfg_info[WMI_TLV_HDR_SIZE],
-		     req_params->ndp_config.ndp_cfg, cmd->ndp_cfg_len);
+	WMITLV_SET_HDR(tlv_ptr, WMITLV_TAG_ARRAY_BYTE, ndp_cfg_len);
+	vos_mem_copy(&tlv_ptr[WMI_TLV_HDR_SIZE],
+		req_params->ndp_config.ndp_cfg, cmd->ndp_cfg_len);
+	tlv_ptr = tlv_ptr + WMI_TLV_HDR_SIZE + ndp_cfg_len;
 
-	app_info = &cfg_info[WMI_TLV_HDR_SIZE + ndp_cfg_len];
-	/* WMI command expects 4 byte alligned len */
-	WMITLV_SET_HDR(app_info, WMITLV_TAG_ARRAY_BYTE, ndp_app_info_len);
-	vos_mem_copy(&app_info[WMI_TLV_HDR_SIZE],
+	WMITLV_SET_HDR(tlv_ptr, WMITLV_TAG_ARRAY_BYTE, ndp_app_info_len);
+	vos_mem_copy(&tlv_ptr[WMI_TLV_HDR_SIZE],
 		     req_params->ndp_info.ndp_app_info,
 		     req_params->ndp_info.ndp_app_info_len);
+	tlv_ptr = tlv_ptr + WMI_TLV_HDR_SIZE + ndp_app_info_len;
+
+	WMITLV_SET_HDR(tlv_ptr, WMITLV_TAG_ARRAY_BYTE, pmk_len);
+	vos_mem_copy(&tlv_ptr[WMI_TLV_HDR_SIZE], req_params->pmk.pmk,
+		     cmd->nan_pmk_len);
+	tlv_ptr = tlv_ptr + WMI_TLV_HDR_SIZE + pmk_len;
+
+	WMA_LOGE(FL("vdev_id = %d, transaction_id: %d, csid: %d"),
+		cmd->vdev_id, cmd->transaction_id, cmd->nan_csid);
 
 	WMA_LOGD(FL("ndp_config len: %d"),
 		req_params->ndp_config.ndp_cfg_len);
@@ -310,6 +336,12 @@ VOS_STATUS wma_handle_ndp_responder_req(tp_wma_handle wma_handle,
 			req_params->ndp_info.ndp_app_info,
 			req_params->ndp_info.ndp_app_info_len);
 
+	WMA_LOGE(FL("pmk len: %d"), cmd->nan_pmk_len);
+	VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_DEBUG,
+			   req_params->pmk.pmk, cmd->nan_pmk_len);
+
+	WMA_LOGE(FL("sending WMI_NDP_RESPONDER_REQ_CMDID(0x%X)"),
+		WMI_NDP_RESPONDER_REQ_CMDID);
 	ret = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
 				   WMI_NDP_RESPONDER_REQ_CMDID);
 	if (ret < 0) {
@@ -455,6 +487,18 @@ static int wma_ndp_indication_event_handler(void *handle, uint8_t  *event_info,
 	fixed_params =
 		(wmi_ndp_indication_event_fixed_param *)event->fixed_param;
 
+	if (fixed_params->ndp_cfg_len > event->num_ndp_cfg) {
+		WMA_LOGE("FW message ndp cfg length %d larger than TLV hdr %d",
+			 fixed_params->ndp_cfg_len, event->num_ndp_cfg);
+		return -EINVAL;
+	}
+
+	if (fixed_params->ndp_app_info_len > event->num_ndp_app_info) {
+		WMA_LOGE("FW message ndp app info length %d more than TLV hdr %d",
+			 fixed_params->ndp_app_info_len, event->num_ndp_app_info);
+		return -EINVAL;
+	}
+
 	ind_event = vos_mem_malloc(sizeof(*ind_event));
 	if (!ind_event) {
 		WMA_LOGP(FL("Failed to allocate memory"));
@@ -472,11 +516,14 @@ static int wma_ndp_indication_event_handler(void *handle, uint8_t  *event_info,
 	WMI_MAC_ADDR_TO_CHAR_ARRAY(&fixed_params->peer_discovery_mac_addr,
 				ind_event->peer_discovery_mac_addr.bytes);
 
-	WMA_LOGD(FL("WMI_NDP_INDICATION_EVENTID(0x%X) received. vdev %d, service_instance %d, ndp_instance %d, role %d, policy %d, peer_mac_addr: %pM, peer_disc_mac_addr: %pM"),
+	WMA_LOGD(FL("WMI_NDP_INDICATION_EVENTID(0x%X) received. vdev %d, \n"
+		"service_instance %d, ndp_instance %d, role %d, policy %d, \n"
+		"csid: %d, scid_len: %d, peer_mac_addr: %pM, peer_disc_mac_addr: %pM"),
 		 WMI_NDP_INDICATION_EVENTID, fixed_params->vdev_id,
 		 fixed_params->service_instance_id,
 		 fixed_params->ndp_instance_id, fixed_params->self_ndp_role,
 		 fixed_params->accept_policy,
+		 fixed_params->nan_csid, fixed_params->nan_scid_len,
 		 ind_event->peer_mac_addr.bytes,
 		 ind_event->peer_discovery_mac_addr.bytes);
 
@@ -489,6 +536,8 @@ static int wma_ndp_indication_event_handler(void *handle, uint8_t  *event_info,
 			&event->ndp_app_info, fixed_params->ndp_app_info_len);
 	ind_event->ndp_config.ndp_cfg_len = fixed_params->ndp_cfg_len;
 	ind_event->ndp_info.ndp_app_info_len = fixed_params->ndp_app_info_len;
+	ind_event->ncs_sk_type = fixed_params->nan_csid;
+	ind_event->scid.scid_len = fixed_params->nan_scid_len;
 
 	if (ind_event->ndp_config.ndp_cfg_len) {
 		ind_event->ndp_config.ndp_cfg =
@@ -515,6 +564,24 @@ static int wma_ndp_indication_event_handler(void *handle, uint8_t  *event_info,
 			     event->ndp_app_info,
 			     ind_event->ndp_info.ndp_app_info_len);
 	}
+
+	if (ind_event->scid.scid_len) {
+		ind_event->scid.scid =
+			vos_mem_malloc(ind_event->scid.scid_len);
+		if (NULL == ind_event->scid.scid) {
+			WMA_LOGE(FL("malloc failed"));
+			vos_mem_free(ind_event->ndp_config.ndp_cfg);
+			vos_mem_free(ind_event->ndp_info.ndp_app_info);
+			vos_mem_free(ind_event);
+			return VOS_STATUS_E_NOMEM;
+		}
+		vos_mem_copy(ind_event->scid.scid,
+			     event->ndp_scid, ind_event->scid.scid_len);
+		WMA_LOGD(FL("scid hex dump:"));
+		VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_DEBUG,
+			ind_event->scid.scid, ind_event->scid.scid_len);
+	}
+
 	pe_msg.type = SIR_HAL_NDP_INDICATION;
 	pe_msg.bodyptr = ind_event;
 	pe_msg.bodyval = 0;
@@ -525,6 +592,7 @@ static int wma_ndp_indication_event_handler(void *handle, uint8_t  *event_info,
 		WMA_LOGE(FL("fail to post SIR_HAL_NDP_INDICATION msg to PE"));
 		vos_mem_free(ind_event->ndp_config.ndp_cfg);
 		vos_mem_free(ind_event->ndp_info.ndp_app_info);
+		vos_mem_free(ind_event->scid.scid);
 		vos_mem_free(ind_event);
 	}
 
@@ -554,8 +622,15 @@ static int wma_ndp_responder_rsp_event_handler(void *handle,
 	rsp.transaction_id = fixed_params->transaction_id;
 	rsp.reason = fixed_params->reason_code;
 	rsp.status = fixed_params->rsp_status;
+	rsp.create_peer = fixed_params->create_peer;
 	WMI_MAC_ADDR_TO_CHAR_ARRAY(&fixed_params->peer_ndi_mac_addr,
 				rsp.peer_mac_addr.bytes);
+
+	WMA_LOGE(FL("WMI_NDP_RESPONDER_RSP_EVENTID(0x%X) received. vdev_id: %d, peer_mac_addr: %pM, transaction_id: %d, status_code %d, reason_code: %d, create_peer: %d"),
+			WMI_NDP_RESPONDER_RSP_EVENTID, rsp.vdev_id,
+			rsp.peer_mac_addr.bytes, rsp.transaction_id,
+			rsp.status, rsp.reason, rsp.create_peer);
+
 	return wma_send_ndp_responder_rsp(&rsp);
 }
 
@@ -585,10 +660,20 @@ static int wma_ndp_confirm_event_handler(void *handle, uint8_t *event_info,
 		 fixed_params->reason_code,
 		 fixed_params->num_active_ndps_on_peer);
 
+	if (fixed_params->ndp_cfg_len > event->num_ndp_cfg) {
+		WMA_LOGE("FW message ndp cfg length %d larger than TLV hdr %d",
+			 fixed_params->ndp_cfg_len, event->num_ndp_cfg);
+		return -EINVAL;
+	}
 	WMA_LOGE(FL("ndp_cfg - %d bytes"), fixed_params->ndp_cfg_len);
 	VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_DEBUG,
 		&event->ndp_cfg, fixed_params->ndp_cfg_len);
 
+	if (fixed_params->ndp_app_info_len > event->num_ndp_app_info) {
+		WMA_LOGE("FW message ndp app info length %d more than TLV hdr %d",
+			 fixed_params->ndp_app_info_len, event->num_ndp_app_info);
+		return -EINVAL;
+	}
 	WMA_LOGE(FL("ndp_app_info - %d bytes"), fixed_params->ndp_app_info_len);
 	VOS_TRACE_HEX_DUMP(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_DEBUG,
 		&event->ndp_app_info, fixed_params->ndp_app_info_len);
@@ -720,7 +805,12 @@ static int wma_ndp_end_indication_event_handler(void *handle,
 
 	WMA_LOGD(FL("number of ndp instances = %d"),
 		event->num_ndp_end_indication_list);
-
+	if (event->num_ndp_end_indication_list > ((WMA_SVC_MSG_MAX_SIZE -
+		sizeof(*ndp_event_buf)) / sizeof(ndp_event_buf->ndp_map[0]))) {
+			WMA_LOGE("%s: excess data received from fw num_ndp_end_indication_list %d",
+				__func__, event->num_ndp_end_indication_list);
+			return -EINVAL;
+	}
 	buf_size = sizeof(*ndp_event_buf) + event->num_ndp_end_indication_list *
 			sizeof(ndp_event_buf->ndp_map[0]);
 	ndp_event_buf = vos_mem_malloc(buf_size);
@@ -1133,7 +1223,7 @@ void wma_delete_all_nan_remote_peers(tp_wma_handle wma, uint32_t vdev_id)
 	ol_txrx_vdev_handle vdev;
 	ol_txrx_peer_handle peer, temp;
 
-	if (!wma || vdev_id > wma->max_bssid)
+	if (!wma || vdev_id >= wma->max_bssid)
 		return;
 
 	vdev = wma->interfaces[vdev_id].handle;
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_ocb.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_ocb.c
index 2bdfe5102fc..3b633d08e88 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_ocb.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_ocb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -33,7 +33,9 @@
 
 #include "wma_ocb.h"
 #include "wmi_unified_api.h"
-#include "vos_utils.h"
+#include "utilsApi.h"
+
+#define UINT32_MAX (0xFFFFFFFFU)
 
 /**
  * wma_ocb_resp() - send the OCB set config response via callback
@@ -49,48 +51,52 @@ int wma_ocb_set_config_resp(tp_wma_handle wma_handle, uint8_t status)
 	ol_txrx_vdev_handle vdev = (req ?
 		wma_handle->interfaces[req->session_id].handle : 0);
 
-	/*
-	 * If the command was successful, save the channel information in the
-	 * vdev.
-	 */
-	if (status == VOS_STATUS_SUCCESS) {
-		if (vdev && req) {
-			/* Save the channel info in the vdev */
-			if (vdev->ocb_channel_info)
-				vos_mem_free(vdev->ocb_channel_info);
-			vdev->ocb_channel_count =
+	if (status != VOS_STATUS_SUCCESS)
+		goto out;
+
+	/* If config succeeded, save the channel information in the vdev. */
+	if (vdev && req) {
+		if (vdev->ocb_channel_info)
+			vos_mem_free(vdev->ocb_channel_info);
+		vdev->ocb_channel_count = req->channel_count;
+		if (req->channel_count) {
+			int i;
+			int buf_size = sizeof(*vdev->ocb_channel_info) *
 				req->channel_count;
-			if (req->channel_count) {
-				int i;
-				int buf_size = sizeof(*vdev->ocb_channel_info) *
-				    req->channel_count;
-				vdev->ocb_channel_info =
-					vos_mem_malloc(buf_size);
-				if (!vdev->ocb_channel_info)
-					return -ENOMEM;
-				vos_mem_zero(vdev->ocb_channel_info, buf_size);
-				for (i = 0; i < req->channel_count; i++) {
-					vdev->ocb_channel_info[i].chan_freq =
-						req->channels[i].chan_freq;
-					if (req->channels[i].flags &
-					  OCB_CHANNEL_FLAG_DISABLE_RX_STATS_HDR)
-						vdev->ocb_channel_info[i].
+			vdev->ocb_channel_info = vos_mem_malloc(buf_size);
+			if (!vdev->ocb_channel_info)
+				return -ENOMEM;
+			vos_mem_zero(vdev->ocb_channel_info, buf_size);
+			for (i = 0; i < req->channel_count; i++) {
+				vdev->ocb_channel_info[i].chan_freq =
+					req->channels[i].chan_freq;
+				vdev->ocb_channel_info[i].bandwidth =
+					req->channels[i].bandwidth;
+				if (req->channels[i].flags &
+				    OCB_CHANNEL_FLAG_DISABLE_RX_STATS_HDR)
+					vdev->ocb_channel_info[i].
 						disable_rx_stats_hdr = 1;
-				}
-			} else {
-				vdev->ocb_channel_info = 0;
+				vos_mem_copy(
+					vdev->ocb_channel_info[i].mac_address,
+					req->channels[i].mac_address,
+					sizeof(req->channels[i].mac_address));
 			}
+		} else {
+			vdev->ocb_channel_info = 0;
+		}
 
-			/* Default TX parameter */
-			if (!ol_txrx_set_ocb_def_tx_param(vdev,
-				req->def_tx_param, req->def_tx_param_size)) {
-				/* Setting the default param failed */
-				WMA_LOGE(FL("Invalid default TX parameters"));
-				status = VOS_STATUS_E_INVAL;
-			}
+		vdev->ocb_config_flags = req->flags;
+
+		/* Default TX parameter */
+		if (!ol_txrx_set_ocb_def_tx_param(vdev,
+		    req->def_tx_param, req->def_tx_param_size)) {
+			/* Setting the default param failed */
+			WMA_LOGE(FL("Invalid default TX parameters"));
+			status = VOS_STATUS_E_INVAL;
 		}
 	}
 
+out:
 	/* Free the configuration that was saved in wma_ocb_set_config. */
 	vos_mem_free(wma_handle->ocb_config_req);
 	wma_handle->ocb_config_req = 0;
@@ -115,52 +121,6 @@ int wma_ocb_set_config_resp(tp_wma_handle wma_handle, uint8_t status)
 }
 
 /**
- * copy_sir_ocb_config() - deep copy of an OCB config struct
- * @src: pointer to the source struct
- *
- * Return: pointer to the copied struct
- */
-static struct sir_ocb_config *copy_sir_ocb_config(struct sir_ocb_config *src)
-{
-	struct sir_ocb_config *dst;
-	uint32_t length;
-	void *cursor;
-
-	length = sizeof(*src) +
-		src->channel_count * sizeof(*src->channels) +
-		src->schedule_size * sizeof(*src->schedule) +
-		src->dcc_ndl_chan_list_len +
-		src->dcc_ndl_active_state_list_len;
-
-	dst = vos_mem_malloc(length);
-	if (!dst)
-		return NULL;
-
-	*dst = *src;
-
-	cursor = dst;
-	cursor += sizeof(*dst);
-	dst->channels = cursor;
-	cursor += src->channel_count * sizeof(*dst->channels);
-	vos_mem_copy(dst->channels, src->channels,
-		     src->channel_count * sizeof(*dst->channels));
-	dst->schedule = cursor;
-	cursor += src->schedule_size * sizeof(*dst->schedule);
-	vos_mem_copy(dst->schedule, src->schedule,
-		     src->schedule_size * sizeof(*dst->schedule));
-	dst->dcc_ndl_chan_list = cursor;
-	cursor += src->dcc_ndl_chan_list_len;
-	vos_mem_copy(dst->dcc_ndl_chan_list, src->dcc_ndl_chan_list,
-		     src->dcc_ndl_chan_list_len);
-	dst->dcc_ndl_active_state_list = cursor;
-	cursor += src->dcc_ndl_active_state_list_len;
-	vos_mem_copy(dst->dcc_ndl_active_state_list,
-		     src->dcc_ndl_active_state_list,
-		     src->dcc_ndl_active_state_list_len);
-	return dst;
-}
-
-/**
  * wma_ocb_set_config_req() - send the OCB config request
  * @wma_handle: pointer to the WMA handle
  * @config_req: the configuration to be set.
@@ -197,7 +157,7 @@ int wma_ocb_set_config_req(tp_wma_handle wma_handle,
 
 		if (wma_handle->ocb_config_req)
 			vos_mem_free(wma_handle->ocb_config_req);
-		wma_handle->ocb_config_req = copy_sir_ocb_config(config_req);
+		wma_handle->ocb_config_req = sir_copy_sir_ocb_config(config_req);
 
 		status = wma_vdev_start(wma_handle, &req, VOS_FALSE);
 		if (status != VOS_STATUS_SUCCESS) {
@@ -311,6 +271,7 @@ int wma_ocb_set_config(tp_wma_handle wma_handle, struct sir_ocb_config *config)
 	cmd->channel_count = config->channel_count;
 	cmd->schedule_size = config->schedule_size;
 	cmd->flags = config->flags;
+	cmd->ta_max_duration = config->ta_max_duration;
 	buf_ptr += sizeof(*cmd);
 
 	/* Add the wmi_channel info */
@@ -434,7 +395,7 @@ int wma_ocb_set_config(tp_wma_handle wma_handle, struct sir_ocb_config *config)
 	if (wma_handle->ocb_config_req != config) {
 		if (wma_handle->ocb_config_req)
 			vos_mem_free(wma_handle->ocb_config_req);
-		wma_handle->ocb_config_req = copy_sir_ocb_config(config);
+		wma_handle->ocb_config_req = sir_copy_sir_ocb_config(config);
 	}
 
 	ret = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
@@ -806,6 +767,13 @@ int wma_dcc_get_stats_resp_event_handler(void *handle, uint8_t *event_buf,
 	fix_param = param_tlvs->fixed_param;
 
 	/* Allocate and populate the response */
+	if (fix_param->num_channels > ((WMA_SVC_MSG_MAX_SIZE -
+	    sizeof(*fix_param)) / sizeof(wmi_dcc_ndl_stats_per_channel))) {
+		WMA_LOGE("%s: too many channels:%d", __func__,
+			fix_param->num_channels);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	}
 	response = vos_mem_malloc(sizeof(*response) + fix_param->num_channels *
 		sizeof(wmi_dcc_ndl_stats_per_channel));
 	if (response == NULL)
@@ -1051,8 +1019,23 @@ int wma_dcc_stats_event_handler(void *handle, uint8_t *event_buf,
 	param_tlvs = (WMI_DCC_STATS_EVENTID_param_tlvs *)event_buf;
 	fix_param = param_tlvs->fixed_param;
 	/* Allocate and populate the response */
+	if (fix_param->num_channels > ((WMA_SVC_MSG_MAX_SIZE -
+	    sizeof(*fix_param)) / sizeof(wmi_dcc_ndl_stats_per_channel))) {
+		WMA_LOGE("%s: too many channels:%d", __func__,
+			fix_param->num_channels);
+		VOS_ASSERT(0);
+		return -EINVAL;
+	}
+
+	if (fix_param->num_channels > param_tlvs->num_stats_per_channel_list) {
+		WMA_LOGE("FW message num_chan %d more than TLV hdr %d",
+			fix_param->num_channels,
+			param_tlvs->num_stats_per_channel_list);
+		return -EINVAL;
+	}
+
 	response = vos_mem_malloc(sizeof(*response) +
-	    fix_param->num_channels * sizeof(wmi_dcc_ndl_stats_per_channel));
+		fix_param->num_channels * sizeof(wmi_dcc_ndl_stats_per_channel));
 	if (response == NULL)
 		return -ENOMEM;
 	response->vdev_id = fix_param->vdev_id;
@@ -1078,6 +1061,135 @@ int wma_dcc_stats_event_handler(void *handle, uint8_t *event_buf,
 }
 
 /**
+ * wma_process_radio_chan_stats_req() - Send request radio chan stats to FW
+ * @wma_handle: WMI handle
+ * @req: radio channel
+ *
+ * This function is used to reads the incoming @req and fill in the
+ * destination WMI structure, then send radio channel statistics request
+ * command to FW.
+ *
+ * Return: 0 on success; error number otherwise.
+ */
+int wma_process_radio_chan_stats_req(tp_wma_handle wma_handle,
+					struct radio_chan_stats_req *req)
+{
+	VOS_STATUS status;
+	wmi_buf_t buf;
+	wmi_request_radio_chan_stats_cmd_fixed_param *cmd;
+	int len = sizeof(*cmd);
+
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGE(FL("%s: wmi_buf_alloc failed"), __func__);
+		return VOS_STATUS_E_NOMEM;
+	}
+
+	cmd = (wmi_request_radio_chan_stats_cmd_fixed_param *)wmi_buf_data(buf);
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		WMITLV_TAG_STRUC_wmi_request_radio_chan_stats_cmd_fixed_param,
+		WMITLV_GET_STRUCT_TLVLEN(
+			wmi_request_radio_chan_stats_cmd_fixed_param));
+	cmd->request_type = req->req_type;
+	if (cmd->request_type == WMI_REQUEST_ONE_RADIO_CHAN_STATS)
+		cmd->chan_mhz = req->chan_freq;
+	cmd->reset_after_request = (A_UINT32)req->reset_after_req;
+
+	status = wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
+				      WMI_REQUEST_RADIO_CHAN_STATS_CMDID);
+	if (status != EOK) {
+		WMA_LOGE("Failed to send WMI_REQUEST_RADIO_CHAN_STATS_CMDID");
+		wmi_buf_free(buf);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	WMA_LOGI("Sent WMI_REQUEST_RADIO_CHAN_STATS_CMDID to FW");
+	return 0;
+}
+
+/**
+ * wma_radio_chan_stats_event_handler() - handle radio channel statistics event
+ * @handle - pointer to wma handle.
+ * @event - pointer to TLV info received in the event.
+ * @evt_len - length of data in @event.
+ *
+ * This Function is a handler for firmware radio channel statistics event.
+ *
+ * Return: 0 on success, error number otherwise
+ */
+static int wma_radio_chan_stats_event_handler(void *handle, u_int8_t *event,
+					      u_int32_t evt_len)
+{
+	uint8_t *buf;
+	uint32_t i, len;
+	VOS_STATUS vos_status;
+	WMI_RADIO_CHAN_STATS_EVENTID_param_tlvs *param_tlvs;
+	wmi_radio_chan_stats_event_fixed_param *fix_param;
+	wmi_radio_chan_stats *chan_stats;
+	struct radio_chan_stats_rsp *resp;
+	vos_msg_t msg = { 0 };
+
+	param_tlvs = (WMI_RADIO_CHAN_STATS_EVENTID_param_tlvs *) event;
+	if (!param_tlvs) {
+		WMA_LOGE("Invalid radio_chan_stats event buffer");
+		return -EINVAL;
+	}
+
+	fix_param = param_tlvs->fixed_param;
+	chan_stats = param_tlvs->radio_chan_stats;
+	if (!chan_stats) {
+		WMA_LOGE("Invalid radio_chan_stats ptr");
+		return -EINVAL;
+	}
+
+	if (fix_param->num_chans > (UINT32_MAX - sizeof(*resp))/
+	    sizeof(struct radio_chan_stats_info)) {
+		WMA_LOGE("%s: number of channels = %d greater thanmax limit",
+			  __func__,fix_param->num_chans);
+		return -EINVAL;
+	}
+
+	len = sizeof(*resp) +
+		fix_param->num_chans * sizeof(struct radio_chan_stats_info);
+	buf = vos_mem_malloc(len);
+	if (!buf)
+		return -ENOMEM;
+
+	resp = (struct radio_chan_stats_rsp *)buf;
+	buf += sizeof(struct radio_chan_stats_rsp);
+	resp->chan_stats = (struct radio_chan_stats_info *)buf;
+	resp->num_chans = fix_param->num_chans;
+	for (i = 0; i < resp->num_chans; i++) {
+		resp->chan_stats[i].chan_freq = chan_stats[i].chan_mhz;
+		resp->chan_stats[i].measurement_period =
+					(uint64_t)chan_stats[i].measurement_period_us;
+		resp->chan_stats[i].on_chan_us = (uint64_t)chan_stats[i].on_chan_us;
+		resp->chan_stats[i].on_chan_ratio = chan_stats[i].on_chan_ratio;
+		resp->chan_stats[i].tx_duration_us =
+					(uint64_t)chan_stats[i].tx_duration_us;
+		resp->chan_stats[i].rx_duration_us =
+					(uint64_t)chan_stats[i].rx_duration_us;
+		resp->chan_stats[i].chan_busy_ratio =
+					chan_stats[i].chan_busy_ratio;
+		resp->chan_stats[i].tx_mpdus = chan_stats[i].tx_mpdus;
+		resp->chan_stats[i].tx_msdus = chan_stats[i].tx_msdus;
+		resp->chan_stats[i].rx_succ_pkts = chan_stats[i].rx_succ_mpdus;
+		resp->chan_stats[i].rx_fail_pkts = chan_stats[i].rx_fail_mpdus;
+	}
+
+	msg.type = eWNI_SME_RADIO_CHAN_STATS_IND;
+	msg.bodyptr = resp;
+	vos_status = vos_mq_post_message(VOS_MODULE_ID_SME, &msg);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+		WMA_LOGE("Fail to post message to SME");
+		vos_mem_free(resp);
+		return vos_status;
+	}
+
+	return 0;
+}
+
+/**
  * wma_ocb_register_event_handlers() - register handlers for the OCB WMI
  * events
  * @wma_handle: pointer to the WMA handle
@@ -1127,5 +1239,11 @@ int wma_ocb_register_event_handlers(tp_wma_handle wma_handle)
 	if (status)
 		return status;
 
+	status = wmi_unified_register_event_handler(wma_handle->wmi_handle,
+			WMI_RADIO_CHAN_STATS_EVENTID,
+			wma_radio_chan_stats_event_handler);
+	if (status)
+		return status;
+
 	return VOS_STATUS_SUCCESS;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_ocb.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_ocb.h
index dec331cb2f3..d7d0e276a96 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_ocb.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma_ocb.h
@@ -1,4 +1,5 @@
-/*copyright (c) 2015 The Linux Foundation. All rights reserved.
+/*
+ * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -30,6 +31,7 @@
 #include "wma.h"
 #include "sirApi.h"
 
+#ifdef WLAN_FEATURE_DSRC
 int wma_ocb_set_config_resp(tp_wma_handle wma_handle, uint8_t status);
 
 int wma_ocb_set_config_req(tp_wma_handle handle,
@@ -62,6 +64,92 @@ int wma_dcc_clear_stats(tp_wma_handle wma_handle,
 int wma_dcc_update_ndl(tp_wma_handle wma_handle,
 		       struct sir_dcc_update_ndl *update_ndl_param);
 
-int wma_ocb_register_event_handlers(tp_wma_handle wma_handle);
+int wma_process_radio_chan_stats_req(tp_wma_handle wma_handle,
+			struct radio_chan_stats_req *req);
 
+int wma_ocb_register_event_handlers(tp_wma_handle wma_handle);
+#else
+static inline int wma_ocb_set_config_resp(tp_wma_handle wma_handle,
+		uint8_t status)
+{
+	return 0;
+}
+
+static inline int wma_ocb_set_config_req(tp_wma_handle handle,
+		struct sir_ocb_config *config_req)
+{
+	return 0;
+}
+
+static inline int wma_ocb_set_config_event_handler(void *handle,
+		uint8_t *event_buf, uint32_t len)
+{
+	return 0;
+}
+
+static inline int wma_ocb_start_resp_ind_cont(tp_wma_handle wma_handle)
+{
+	return 0;
+}
+
+static inline int wma_ocb_set_config(tp_wma_handle wma_handle,
+		struct sir_ocb_config *config)
+{
+	return 0;
+}
+
+static inline int wma_ocb_set_utc_time(tp_wma_handle wma_handle,
+		struct sir_ocb_utc *utc)
+{
+	return 0;
+}
+
+static inline int wma_ocb_start_timing_advert(tp_wma_handle wma_handle,
+		struct sir_ocb_timing_advert *timing_advert)
+{
+	return 0;
+}
+
+static inline int wma_ocb_stop_timing_advert(tp_wma_handle wma_handle,
+		struct sir_ocb_timing_advert *timing_advert)
+{
+	return 0;
+}
+
+static inline int wma_ocb_get_tsf_timer(tp_wma_handle wma_handle,
+		struct sir_ocb_get_tsf_timer *request)
+{
+	return 0;
+}
+
+static inline int wma_dcc_get_stats(tp_wma_handle wma_handle,
+		struct sir_dcc_get_stats *get_stats_param)
+{
+	return 0 ;
+}
+
+static inline int wma_dcc_clear_stats(tp_wma_handle wma_handle,
+		struct sir_dcc_clear_stats *clear_stats_param)
+{
+	return 0;
+}
+
+static inline int wma_dcc_update_ndl(tp_wma_handle wma_handle,
+		struct sir_dcc_update_ndl *update_ndl_param)
+{
+	return 0;
+}
+
+static inline int wma_process_radio_chan_stats_req(tp_wma_handle wma_handle,
+		struct radio_chan_stats_req *req)
+{
+	return 0;
+}
+
+
+static inline int wma_ocb_register_event_handlers(tp_wma_handle wma_handle)
+{
+	return 0;
+}
+#endif
 #endif /* __WMA_OCB_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_tlv_helper.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_tlv_helper.c
index 2dc7e53e525..7b604c0ee2e 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_tlv_helper.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_tlv_helper.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014,2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -385,6 +385,12 @@ wmitlv_check_and_pad_tlvs(
     }
     /* NOTE: the returned number of TLVs is in "attr_struct_ptr.cmd_num_tlv" */
 
+    if (param_buf_len < WMI_TLV_HDR_SIZE) {
+        wmi_tlv_print_error("%s: ERROR: Incorrect length param buf length\n",
+                           __func__);
+        return -1;
+    }
+
     /* Create base structure of format wmi_cmd_event_id##_param_tlvs */
     len_wmi_cmd_struct_buf = attr_struct_ptr.cmd_num_tlv * sizeof(wmitlv_cmd_param_info);
 #ifndef NO_DYNAMIC_MEM_ALLOC
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_unified.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_unified.c
index a444b3208d7..a66269e3644 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_unified.c
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_unified.c
@@ -51,6 +51,7 @@
 #endif
 
 #define WMI_MIN_HEAD_ROOM 64
+#define RADAR_WMI_EVENT_PENDING_MAX 1000
 
 #ifdef WMI_INTERFACE_EVENT_LOGGING
 /* WMI commands */
@@ -131,7 +132,7 @@ uint16_t wmi_get_max_msg_len(wmi_unified_t wmi_handle)
 }
 
 wmi_buf_t
-wmi_buf_alloc(wmi_unified_t wmi_handle, u_int16_t len)
+wmi_buf_alloc(wmi_unified_t wmi_handle, uint32_t len)
 {
 	wmi_buf_t wmi_buf;
 
@@ -721,6 +722,52 @@ static u_int8_t* get_wmi_cmd_string(WMI_CMD_ID wmi_command)
 		CASE_RETURN_STRING(WMI_REQUEST_WLAN_STATS_CMDID);
 		CASE_RETURN_STRING(WMI_VDEV_ENCRYPT_DECRYPT_DATA_REQ_CMDID);
 		CASE_RETURN_STRING(WMI_SAR_LIMITS_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_DFS_PHYERR_OFFLOAD_ENABLE_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_DFS_PHYERR_OFFLOAD_DISABLE_CMDID);
+		CASE_RETURN_STRING(WMI_VDEV_ADFS_CH_CFG_CMDID);
+		CASE_RETURN_STRING(WMI_VDEV_ADFS_OCAC_ABORT_CMDID);
+		CASE_RETURN_STRING(WMI_REQUEST_RCPI_CMDID);
+		CASE_RETURN_STRING(WMI_REQUEST_PEER_STATS_INFO_CMDID);
+		CASE_RETURN_STRING(WMI_SET_CURRENT_COUNTRY_CMDID);
+		CASE_RETURN_STRING(WMI_11D_SCAN_START_CMDID);
+		CASE_RETURN_STRING(WMI_11D_SCAN_STOP_CMDID);
+		CASE_RETURN_STRING(WMI_REQUEST_RADIO_CHAN_STATS_CMDID);
+		CASE_RETURN_STRING(WMI_ROAM_PER_CONFIG_CMDID);
+		CASE_RETURN_STRING(WMI_VDEV_ADD_MAC_ADDR_TO_RX_FILTER_CMDID);
+		CASE_RETURN_STRING(WMI_BPF_SET_VDEV_ACTIVE_MODE_CMDID);
+		CASE_RETURN_STRING(WMI_HW_DATA_FILTER_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_MULTIPLE_VDEV_RESTART_REQUEST_CMDID);
+		CASE_RETURN_STRING(WMI_LPI_OEM_REQ_CMDID);
+                CASE_RETURN_STRING(WMI_OEM_DMA_RING_CFG_REQ_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_UPDATE_PKT_ROUTING_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_CHECK_CAL_VERSION_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_SET_DIVERSITY_GAIN_CMDID);
+		CASE_RETURN_STRING(WMI_VDEV_SET_ARP_STAT_CMDID);
+		CASE_RETURN_STRING(WMI_VDEV_GET_ARP_STAT_CMDID);
+		CASE_RETURN_STRING(WMI_VDEV_GET_TX_POWER_CMDID);
+		CASE_RETURN_STRING(WMI_OFFCHAN_DATA_TX_SEND_CMDID);
+		CASE_RETURN_STRING(WMI_SET_INIT_COUNTRY_CMDID);
+		CASE_RETURN_STRING(WMI_SET_SCAN_DBS_DUTY_CYCLE_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_DIV_GET_RSSI_ANTID_CMDID);
+                CASE_RETURN_STRING(WMI_PDEV_BSS_CHAN_INFO_REQUEST_CMDID);
+		CASE_RETURN_STRING(WMI_THERM_THROT_SET_CONF_CMDID);
+
+		CASE_RETURN_STRING(WMI_PDEV_UPDATE_FILS_HLP_PKT_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_UPDATE_CTLTABLE_REQUEST_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_CONFIG_VENDOR_OUI_ACTION_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_SET_AC_TX_QUEUE_OPTIMIZED_CMDID);
+		CASE_RETURN_STRING(WMI_VDEV_LIMIT_OFFCHAN_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_SEND_FD_CMDID);
+		CASE_RETURN_STRING(WMI_BCN_OFFLOAD_CTRL_CMDID);
+		CASE_RETURN_STRING(WMI_ROAM_BTM_CONFIG_CMDID);
+		CASE_RETURN_STRING(WMI_ENABLE_FILS_CMDID);
+		CASE_RETURN_STRING(WMI_HB_OIC_PING_OFFLOAD_PARAM_CMDID);
+		CASE_RETURN_STRING(WMI_HB_OIC_PING_OFFLOAD_SET_ENABLE_CMDID);
+		CASE_RETURN_STRING(WMI_HB_DHCP_LEASE_RENEW_OFFLOAD_CMDID);
+		CASE_RETURN_STRING(WMI_WLM_CONFIG_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_UPDATE_PMK_CACHE_CMDID);
+		CASE_RETURN_STRING(WMI_PEER_TID_MSDUQ_QDEPTH_THRESH_UPDATE_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_SET_RX_FILTER_PROMISCUOUS_CMDID);
 	}
 	return "Invalid WMI cmd";
 }
@@ -756,6 +803,8 @@ static uint16_t wmi_tag_sta_powersave_cmd(wmi_unified_t wmi_hdl, wmi_buf_t buf)
 	ps_cmd = (wmi_sta_powersave_param_cmd_fixed_param *)wmi_buf_data(buf);
 
 	switch(ps_cmd->param) {
+	case WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD:
+	case WMI_STA_PS_PARAM_INACTIVITY_TIME:
 	case WMI_STA_PS_ENABLE_QPOWER:
 		return HTC_TX_PACKET_TAG_AUTO_PM;
 	default:
@@ -789,6 +838,12 @@ static uint16_t wmi_tag_fw_hang_cmd(wmi_unified_t wmi_handle)
 {
 	uint16_t tag = 0;
 
+	if (adf_os_atomic_read(&wmi_handle->is_target_suspended)) {
+		pr_err("%s: Target is already suspended, Ignore FW Hang Command\n",
+			__func__);
+		return tag;
+	}
+
 	if (wmi_handle->tag_crash_inject)
 		tag = HTC_TX_PACKET_TAG_AUTO_PM;
 
@@ -848,7 +903,7 @@ int wmi_unified_cmd_send(wmi_unified_t wmi_handle, wmi_buf_t buf, int len,
 	A_UINT16 htc_tag = 0;
 
 	if (vos_is_shutdown_in_progress(VOS_MODULE_ID_WDA, NULL)) {
-		WMA_LOGD("\nERROR: %s: shutdown is in progress so could not send WMI command: %d\n",
+		adf_os_print("\nERROR: %s: shutdown is in progress so could not send WMI command: %d\n",
 			__func__, cmd_id);
 		return -EBUSY;
 	}
@@ -909,10 +964,7 @@ dont_tag:
 					 __func__, __LINE__);
 				return -EBUSY;
 			}
-			vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
-			pr_err("%s- %d: Start collecting ramdump\n",
-				__func__, __LINE__);
-			ol_schedule_ramdump_work(scn);
+			vos_trigger_recovery(true);
 		} else
 			VOS_BUG(0);
 		return -EBUSY;
@@ -1065,13 +1117,25 @@ void wmi_control_rx(void *ctx, HTC_PACKET *htc_packet)
 	int tlv_ok_status = 0;
 	u_int32_t id;
 	u_int8_t *data;
+	tp_wma_handle wma = wmi_handle->scn_handle;
 
 	evt_buf = (wmi_buf_t) htc_packet->pPktContext;
 	id = WMI_GET_FIELD(adf_nbuf_data(evt_buf), WMI_CMD_HDR, COMMANDID);
 	/* TX_PAUSE EVENT should be handled with tasklet context */
-	if ((WMI_TX_PAUSE_EVENTID == id) ||
+	while ((WMI_TX_PAUSE_EVENTID == id) ||
 		(WMI_WOW_WAKEUP_HOST_EVENTID == id) ||
-		(WMI_D0_WOW_DISABLE_ACK_EVENTID == id)) {
+		(WMI_D0_WOW_DISABLE_ACK_EVENTID == id) ||
+		(WMI_DFS_RADAR_EVENTID == id)) {
+		if ((WMI_DFS_RADAR_EVENTID == id) && wma) {
+			if (adf_os_atomic_inc_return(
+					&wma->dfs_wmi_event_pending) <
+					RADAR_WMI_EVENT_PENDING_MAX) {
+				break;
+			} else {
+				adf_os_atomic_inc(&wma->dfs_wmi_event_dropped);
+				adf_os_atomic_dec(&wma->dfs_wmi_event_pending);
+			}
+		}
 		if (adf_nbuf_pull_head(evt_buf, sizeof(WMI_CMD_HDR)) == NULL)
 			return;
 
@@ -1094,8 +1158,9 @@ void wmi_control_rx(void *ctx, HTC_PACKET *htc_packet)
 			adf_nbuf_free(evt_buf);
 			return;
 		}
-		wmi_handle->event_handler[idx](wmi_handle->scn_handle,
-			       wmi_cmd_struct_ptr, len);
+		if (WMI_DFS_RADAR_EVENTID != id)
+			wmi_handle->event_handler[idx](wmi_handle->scn_handle,
+					wmi_cmd_struct_ptr, len);
 		wmitlv_free_allocated_event_tlvs(id, &wmi_cmd_struct_ptr);
 		adf_nbuf_free(evt_buf);
 		return;
@@ -1254,13 +1319,11 @@ wmi_unified_detach(struct wmi_unified* wmi_handle)
 	wmi_buf_t buf;
 
 	vos_flush_work(&wmi_handle->rx_event_work);
-	adf_os_spin_lock_bh(&wmi_handle->eventq_lock);
 	buf = adf_nbuf_queue_remove(&wmi_handle->event_queue);
 	while (buf) {
 		adf_nbuf_free(buf);
 		buf = adf_nbuf_queue_remove(&wmi_handle->event_queue);
 	}
-	adf_os_spin_unlock_bh(&wmi_handle->eventq_lock);
 
 	OS_FREE(wmi_handle);
 }
@@ -1299,6 +1362,8 @@ void wmi_htc_tx_complete(void *ctx, HTC_PACKET *htc_pkt)
 {
 	struct wmi_unified *wmi_handle = (struct wmi_unified *)ctx;
 	wmi_buf_t wmi_cmd_buf = GET_HTC_PACKET_NET_BUF_CONTEXT(htc_pkt);
+	u_int8_t *buf_ptr;
+	u_int32_t len;
 #ifdef WMI_INTERFACE_EVENT_LOGGING
 	u_int32_t cmd_id;
 #endif
@@ -1314,6 +1379,9 @@ void wmi_htc_tx_complete(void *ctx, HTC_PACKET *htc_pkt)
 		((u_int32_t *)adf_nbuf_data(wmi_cmd_buf) + 2));
 	adf_os_spin_unlock_bh(&wmi_handle->wmi_record_lock);
 #endif
+	buf_ptr = (u_int8_t *) wmi_buf_data(wmi_cmd_buf);
+	len = adf_nbuf_len(wmi_cmd_buf);
+	OS_MEMZERO(buf_ptr, len);
 	adf_nbuf_free(wmi_cmd_buf);
 	adf_os_mem_free(htc_pkt);
 	adf_os_atomic_dec(&wmi_handle->pending_cmds);
diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_unified_priv.h b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_unified_priv.h
index 780e49c2695..1a198a18f69 100644
--- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_unified_priv.h
+++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMI/wmi_unified_priv.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,7 +38,7 @@
 #include "adf_os_atomic.h"
 
 #define WMI_UNIFIED_MAX_EVENT 0x100
-#define WMI_MAX_CMDS  128
+#define WMI_MAX_CMDS  256
 
 typedef adf_nbuf_t wmi_buf_t;
 
@@ -98,4 +98,18 @@ struct wmi_unified {
 	A_BOOL tag_crash_inject;
 	void (*wma_wow_tx_complete_cbk)(ol_scn_t scn_handle);
 };
+
+#define ANT_DIV_SET_PERIOD(probe_period, stay_period) \
+	((1<<26)|((probe_period&0x1fff)<<13)|(stay_period&0x1fff))
+
+#define ANT_DIV_SET_SNR_DIFF(snr_diff) \
+	((1<<27)|(snr_diff&0x1fff))
+
+#define ANT_DIV_SET_PROBE_DWELL_TIME(probe_dwell_time) \
+	((1<<28)|(probe_dwell_time&0x1fff))
+
+#define ANT_DIV_SET_WEIGHT(mgmt_snr_weight, data_snr_weight, ack_snr_weight) \
+	((1<<29)|((mgmt_snr_weight&0xff)<<16)|((data_snr_weight&0xff)<<8)| \
+	(ack_snr_weight&0xff))
+
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/ccmApi.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/ccmApi.h
index ddffaf0de08..b28b72077ef 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/ccmApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/ccmApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2012,2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2012,2014,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,7 +39,7 @@
 #ifndef CCMAPI_H__
 #define CCMAPI_H__
 
-#include "wniCfgSta.h"
+#include "wni_cfg.h"
 #include "halTypes.h"
 
 #define CCM_IS_RESULT_SUCCESS(result)   (WNI_CFG_SUCCESS == (result) ||\
@@ -91,7 +91,7 @@ struct ccmlink {
 typedef struct {
     struct ccmlink      reqQ ;
     eCcmState           state ;
-    tCfgReq *           comp[CFG_PARAM_MAX_NUM] ;
+    tCfgReq *           comp[WNI_CFG_MAX] ;
     tCfgReplay          replay ;
     void                *lock;
 } tCcm ;
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/csrApi.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/csrApi.h
index f1d585471a1..6b0b7a7516b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/csrApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/csrApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -35,6 +35,9 @@
 #ifndef CSRAPI_H__
 #define CSRAPI_H__
 
+#ifdef WLAN_FEATURE_FILS_SK
+#include "lim_fils_defs.h"
+#endif
 #include "sirApi.h"
 #include "sirMacProtDef.h"
 #include "csrLinkList.h"
@@ -70,6 +73,12 @@ typedef enum
     eCSR_AUTH_TYPE_RSN_PSK_SHA256,
     eCSR_AUTH_TYPE_RSN_8021X_SHA256,
 #endif
+#ifdef WLAN_FEATURE_FILS_SK
+    eCSR_AUTH_TYPE_FILS_SHA256,
+    eCSR_AUTH_TYPE_FILS_SHA384,
+    eCSR_AUTH_TYPE_FT_FILS_SHA256,
+    eCSR_AUTH_TYPE_FT_FILS_SHA384,
+#endif
     eCSR_NUM_OF_SUPPORT_AUTH_TYPE,
     eCSR_AUTH_TYPE_FAILED = 0xff,
     eCSR_AUTH_TYPE_UNKNOWN = eCSR_AUTH_TYPE_FAILED,
@@ -224,6 +233,7 @@ typedef enum
 
 
 #define CSR_RSN_PMKID_SIZE          16
+#define CSR_RSN_MAX_PMK_LEN         48
 #define CSR_MAX_PMKID_ALLOWED       32
 #define CSR_WEP40_KEY_LEN       5
 #define CSR_WEP104_KEY_LEN      13
@@ -242,7 +252,8 @@ typedef enum
 #ifdef FEATURE_WLAN_ESE
 #define CSR_KRK_KEY_LEN 16
 #endif
-
+/* Cache ID length */
+#define CACHE_ID_LEN 2
 
 typedef struct tagCsrChannelInfo
 {
@@ -310,6 +321,14 @@ typedef struct tagCsrScanRequest
     eCsrRequestType requestType;    //11d scan or full scan
     tANI_BOOLEAN p2pSearch;
     tANI_BOOLEAN skipDfsChnlInP2pSearch;
+
+    uint32_t enable_scan_randomization;
+    uint8_t mac_addr[VOS_MAC_ADDR_SIZE];
+    uint8_t mac_addr_mask[VOS_MAC_ADDR_SIZE];
+    bool ie_whitelist;
+    uint32_t probe_req_ie_bitmap[PROBE_REQ_BITMAP_LEN];
+    uint32_t num_vendor_oui;
+    struct vendor_oui *voui;
 }tCsrScanRequest;
 
 typedef struct tagCsrBGScanRequest
@@ -426,6 +445,11 @@ typedef struct tagCsrScanResultFilter
      * used to support whitelist ssid feature.
      */
     uint8_t scan_filter_for_roam;
+    tCsrBssid bssid_hint;
+#ifdef WLAN_FEATURE_FILS_SK
+    bool realm_check;
+    uint8_t fils_realm[2];
+#endif
 }tCsrScanResultFilter;
 
 
@@ -625,6 +649,7 @@ typedef enum
     eCSR_ROAM_RESULT_ADD_TDLS_PEER,
     eCSR_ROAM_RESULT_UPDATE_TDLS_PEER,
     eCSR_ROAM_RESULT_DELETE_TDLS_PEER,
+    eCSR_ROAM_TDLS_CHECK_BMPS,
     eCSR_ROAM_RESULT_TEARDOWN_TDLS_PEER_IND,
     eCSR_ROAM_RESULT_DELETE_ALL_TDLS_PEER_IND,
     eCSR_ROAM_RESULT_LINK_ESTABLISH_REQ_RSP,
@@ -896,6 +921,11 @@ typedef struct tagPmkidCacheInfo
 {
     tCsrBssid BSSID;
     tANI_U8 PMKID[CSR_RSN_PMKID_SIZE];
+    uint8_t pmk[CSR_RSN_MAX_PMK_LEN];
+    uint8_t pmk_len;
+    uint8_t ssid_len;
+    uint8_t ssid[SIR_MAC_MAX_SSID_LENGTH];
+    uint8_t cache_id[CACHE_ID_LEN];
 }tPmkidCacheInfo;
 
 #ifdef FEATURE_WLAN_WAPI
@@ -1020,6 +1050,13 @@ typedef struct tagCsrRoamProfile
     uint16_t beacon_tx_rate;
     tSirMacRateSet  supported_rates;
     tSirMacRateSet  extended_rates;
+    uint8_t sub20_channelwidth;
+    bool force_24ghz_in_ht20;
+    tCsrBssid bssid_hint;
+#ifdef WLAN_FEATURE_FILS_SK
+    bool fils_connection;
+    struct cds_fils_connection_info *fils_con_info;
+#endif
 }tCsrRoamProfile;
 
 
@@ -1146,6 +1183,7 @@ enum sta_roam_policy_dfs_mode {
 struct csr_sta_roam_policy_params {
 	enum sta_roam_policy_dfs_mode dfs_mode;
 	bool skip_unsafe_channels;
+	uint8_t sap_operating_band;
 };
 
 typedef struct tagCsrConfigParam
@@ -1164,6 +1202,7 @@ typedef struct tagCsrConfigParam
     tANI_U32 bgScanInterval;
     tANI_U16 TxRate;
     eCsrRoamWmmUserModeType WMMSupportMode;
+    tANI_U8 gStaLocalEDCAEnable;
     tANI_BOOLEAN Is11eSupportEnabled;
     tANI_BOOLEAN Is11dSupportEnabled;
     tANI_BOOLEAN Is11dSupportEnabledOriginal;
@@ -1221,10 +1260,6 @@ typedef struct tagCsrConfigParam
     tANI_U32  nActiveMinChnTimeConc;     //in units of milliseconds
     tANI_U32  nActiveMaxChnTimeConc;     //in units of milliseconds
     tANI_U32  nRestTimeConc;             //in units of milliseconds
-    tANI_U8   nNumStaChanCombinedConc;   //number of channels combined for
-                                         //STA in each split scan operation
-    tANI_U8   nNumP2PChanCombinedConc;   //number of channels combined for
-                                         //P2P in each split scan operation
 #endif
     /*In units of milliseconds*/
     uint32_t       min_rest_time_conc;
@@ -1329,6 +1364,11 @@ typedef struct tagCsrConfigParam
     eCsrBand  scanBandPreference;
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
     tANI_U8  cc_switch_mode;
+    bool     band_switch_enable;
+    bool     ap_p2pgo_concurrency_enable;
+    bool     ap_p2pclient_concur_enable;
+    uint16_t ch_width_24g_orig;
+    uint16_t ch_width_5g_orig;
 #endif
     tANI_U8  allowDFSChannelRoam;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
@@ -1362,6 +1402,10 @@ typedef struct tagCsrConfigParam
     uint32_t edca_bk_aifs;
     uint32_t edca_be_aifs;
     struct csr_sta_roam_policy_params sta_roam_policy_params;
+    uint32_t sta_auth_retries_for_code17;
+#ifdef WLAN_FEATURE_FILS_SK
+    uint8_t fils_max_chan_guard_time;
+#endif
 }tCsrConfigParam;
 
 //Tush
@@ -1489,6 +1533,30 @@ typedef struct tagCsrRoamInfo
         struct ndi_delete_rsp ndi_delete_params;
     } ndp;
 #endif
+    tDot11fIEHTCaps ht_caps;
+    tDot11fIEVHTCaps vht_caps;
+    tDot11fIEhs20vendor_ie hs20vendor_ie;
+    tDot11fIEVHTOperation vht_operation;
+    tDot11fIEHTInfo ht_operation;
+    bool reassoc;
+    /* Extended capabilities of STA */
+    uint8_t ecsa_capable;
+    bool                 ampdu;
+    bool                 sgi_enable;
+    bool                 tx_stbc;
+    bool                 rx_stbc;
+    tSirMacHTChannelWidth ch_width;
+    enum sir_sme_phy_mode mode;
+    uint8_t              max_supp_idx;
+    uint8_t              max_ext_idx;
+    uint8_t              max_mcs_idx;
+    uint8_t              rx_mcs_map;
+    uint8_t              tx_mcs_map;
+#ifdef WLAN_FEATURE_FILS_SK
+    bool is_fils_connection;
+    uint16_t fils_seq_num;
+    struct fils_join_rsp_params *fils_join_rsp;
+#endif
 }tCsrRoamInfo;
 
 
@@ -1519,6 +1587,19 @@ typedef struct sSirSmeAssocIndToUpperLayerCnf
     /* Timing and fine Timing measurement capability clubbed together */
     tANI_U8              timingMeasCap;
     tSirSmeChanInfo      chan_info;
+    /* Extended capabilities of STA */
+    uint8_t              ecsa_capable;
+    bool                 ampdu;
+    bool                 sgi_enable;
+    bool                 tx_stbc;
+    tSirMacHTChannelWidth ch_width;
+    enum sir_sme_phy_mode mode;
+    bool                 rx_stbc;
+    uint8_t              max_supp_idx;
+    uint8_t              max_ext_idx;
+    uint8_t              max_mcs_idx;
+    uint8_t              rx_mcs_map;
+    uint8_t              tx_mcs_map;
 } tSirSmeAssocIndToUpperLayerCnf, *tpSirSmeAssocIndToUpperLayerCnf;
 
 typedef struct tagCsrSummaryStatsInfo
@@ -1720,6 +1801,17 @@ struct tagCsrDelStaParams
 };
 
 /**
+ * struct csr_set_tx_max_pwr_per_band - Req params to
+ * set max tx power per band
+ * @band: band for which power to be set
+ * @power: power to set in dB
+ */
+struct csr_set_tx_max_pwr_per_band {
+	eCsrBand band;
+	tPowerdBm power;
+};
+
+/**
  * struct wep_update_default_key_idx: wep default key index structure
  *
  * @session_id: session ID for the connection session
@@ -1965,8 +2057,30 @@ typedef void (*csr_mib_stats_callback)
  */
 typedef void (*tcsr_fw_state_callback)(void *context);
 void csr_packetdump_timer_stop(void);
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+typedef struct _session_info{
+	tVOS_CON_MODE con_mode;
+	eCsrBand band;
+	v_U16_t och;
+	v_U16_t lfreq;
+	v_U16_t hfreq;
+	v_U16_t cfreq;
+	v_U16_t hbw;
+}session_info_t;
+tANI_BOOLEAN csr_find_all_session_info(
+	tHalHandle hHal,
+	session_info_t *session_info,
+	v_U8_t * session_count);
+tANI_BOOLEAN csr_find_sta_session_info(
+	tHalHandle hHal,
+	session_info_t *info);
+tANI_BOOLEAN csr_create_sap_session_info(
+	tHalHandle hHal,
+	eCsrPhyMode sap_phymode,
+	v_U16_t sap_ch,
+	session_info_t *session_info);
+#endif
 struct lim_channel_status *csr_get_channel_status(
-       void *p_mac, uint32_t channel_id);
+	void *p_mac, uint32_t channel_id);
 void csr_clear_channel_status(void *p_mac);
-
 #endif
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/csrInternal.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/csrInternal.h
index b5e91a46c0b..8ac1883f220 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/csrInternal.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/csrInternal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -397,7 +397,6 @@ typedef struct tagScanCmd
     csrScanCompleteCallback callback;
     void                    *pContext;
     eCsrScanReason          reason;
-    eCsrRoamState           lastRoamState[CSR_ROAM_SESSION_MAX];
     tCsrRoamProfile         *pToRoamProfile;
     tANI_U32                roamId;    //this is the ID related to the pToRoamProfile
     union
@@ -549,6 +548,7 @@ typedef struct tagCsrConfig
     tANI_U32 bgScanInterval;
     eCsrCBChoice cbChoice;
     eCsrBand bandCapability;     //indicate hw capability
+    tANI_U8 gStaLocalEDCAEnable;
     eCsrRoamWmmUserModeType WMMSupportMode;
     tANI_BOOLEAN Is11eSupportEnabled;
     tANI_BOOLEAN Is11dSupportEnabled;
@@ -613,10 +613,6 @@ typedef struct tagCsrConfig
     /* In units of milliseconds */
     tANI_U32  idle_time_conc;
 
-    tANI_U8   nNumStaChanCombinedConc;   //number of channels combined for
-                                         //Sta in each split scan operation
-    tANI_U8   nNumP2PChanCombinedConc;   //number of channels combined for
-                                         //P2P in each split scan operation
 #endif
 
     tANI_BOOLEAN IsIdleScanEnabled;
@@ -698,6 +694,9 @@ typedef struct tagCsrConfig
     tANI_U8 isCoalesingInIBSSAllowed;
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
     tANI_U8 cc_switch_mode;
+    bool    band_switch_enable;
+    bool    ap_p2pgo_concurrency_enable;
+    bool    ap_p2pclient_concur_enable;
 #endif
     tANI_U8 allowDFSChannelRoam;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
@@ -771,9 +770,6 @@ typedef struct tagCsrScanStruct
     tANI_BOOLEAN fScanEnable;
     tANI_BOOLEAN fFullScanIssued;
     vos_timer_t hTimerGetResult;
-#ifdef WLAN_AP_STA_CONCURRENCY
-    vos_timer_t hTimerStaApConcTimer;
-#endif
     vos_timer_t hTimerIdleScan;
     //changes on every scan, it is used as a flag for whether 11d info is found on every scan
     tANI_U8 channelOf11dInfo;
@@ -1063,6 +1059,11 @@ typedef struct tagCsrRoamSession
     bool ch_switch_in_progress;
     bool supported_nss_1x1;
     bool disable_hi_rssi;
+    bool dhcp_done;
+#ifdef WLAN_FEATURE_FILS_SK
+    bool is_fils_connection;
+    uint16_t fils_seq_num;
+#endif
 } tCsrRoamSession;
 
 typedef struct tagCsrRoamStruct
@@ -1077,6 +1078,7 @@ typedef struct tagCsrRoamStruct
     tCsrChannel base40MHzChannels;   //center channels for 40MHz channels
     eCsrRoamState curState[CSR_ROAM_SESSION_MAX];
     eCsrRoamSubState curSubState[CSR_ROAM_SESSION_MAX];
+    eCsrRoamState prev_state[CSR_ROAM_SESSION_MAX];
     //This may or may not have the up-to-date valid channel list
     //It is used to get WNI_CFG_VALID_CHANNEL_LIST and not allocate memory all the time
     tSirMacChanNum validChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN];
@@ -1120,6 +1122,8 @@ typedef struct tagCsrRoamStruct
     tANI_U16 reassocRespLen;  /* length of reassociation response */
 #endif
     vos_timer_t packetdump_timer;
+    tANI_BOOLEAN pending_roam_disable;
+    vos_spin_lock_t roam_state_lock;
 }tCsrRoamStruct;
 
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/csrNeighborRoam.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/csrNeighborRoam.h
index c321b084dbf..86f9aba26cd 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/csrNeighborRoam.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/csrNeighborRoam.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -367,6 +367,8 @@ csrNeighborRoamOffloadUpdatePreauthList(tpAniSirGlobal pMac,
         tpSirRoamOffloadSynchInd pSmeRoamOffloadSynchInd,
                    tANI_U8 sessionId);
 #endif
+void csr_neighbor_roam_state_transition(tpAniSirGlobal mac_ctx,
+		uint8_t newstate, uint8_t session);
 #endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
 
 #endif /* CSR_NEIGHBOR_ROAM_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/pmc.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/pmc.h
index be81d8beee5..ef85339fc44 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/pmc.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/pmc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -155,6 +155,8 @@ typedef struct sPmcInfo
     tANI_BOOLEAN bmpsRequestQueued; /*If a enter BMPS request is queued*/
     tANI_BOOLEAN smpsEnabled;  /* TRUE if SMPS is enabled */
     tANI_BOOLEAN remainInPowerActiveTillDHCP;  /* Remain in Power active till DHCP completes */
+    /* Remain in Power active till set key is done */
+    bool full_power_till_set_key;
     tANI_U32 remainInPowerActiveThreshold;  /*Remain in Power active till DHCP threshold*/
     tANI_U32 impsPeriod;  /* amount of time to remain in IMPS */
     void (*impsCallbackRoutine) (void *callbackContext, eHalStatus status);  /* routine to call when IMPS period
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/pmcApi.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/pmcApi.h
index 7b915b99785..82ee15ea3c1 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/pmcApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/pmcApi.h
@@ -556,7 +556,9 @@ eHalStatus PmcOffloadEnableStaModePowerSave(tHalHandle hHal,
                                             tANI_U32 sessionId);
 
 eHalStatus PmcOffloadDisableStaModePowerSave(tHalHandle hHal,
-                                             tANI_U32 sessionId);
+					     FullPowerReqCb callback_routine,
+					     void *callback_context,
+					     tANI_U32 sessionId);
 
 eHalStatus pmcOffloadRequestFullPower(tHalHandle hHal, tANI_U32 sessionId,
                              FullPowerReqCb fullpwrReqCb,void *callbackContext,
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/smeInside.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/smeInside.h
index e8693b6cf40..72ed6bcade7 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/smeInside.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/smeInside.h
@@ -214,6 +214,8 @@ typedef struct tagSmeCmd
         tTdlsCmd  tdlsCmd;
 #endif
         struct s_ani_set_tx_max_pwr set_tx_max_pwr;
+        struct csr_set_tx_max_pwr_per_band set_tx_max_pwr_per_band;
+
 #ifdef WLAN_FEATURE_NAN_DATAPATH
         struct ndp_initiator_req initiator_req;
         struct ndp_responder_req responder_req;
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/smeInternal.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/smeInternal.h
index edcdd4f450a..d63c9a92e49 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/smeInternal.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/smeInternal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -70,6 +70,7 @@ typedef enum eSmeCommandType
     eSmeCommandAddStaSession,
     eSmeCommandDelStaSession,
     eSmeCommandSetMaxTxPower,
+    eSmeCommandSetMaxTxPowerPerBand,
 #ifdef FEATURE_WLAN_TDLS
     //eSmeTdlsCommandMask = 0x80000,  //To identify TDLS commands <TODO>
     //These can be considered as csr commands.
@@ -132,6 +133,16 @@ typedef struct sStatsExtEvent {
     tANI_U8 event_data[];
 } tStatsExtEvent, *tpStatsExtEvent;
 
+/**
+ * struct stats_ext2_event - stats ext2 event
+ * @hole_cnt: hole counter
+ * @hole_info_array: hole informaton
+ */
+struct stats_ext2_event {
+	uint32_t hole_cnt;
+	uint32_t hole_info_array[];
+};
+
 #define MAX_ACTIVE_CMD_STATS    16
 
 typedef struct sActiveCmdStats {
@@ -178,7 +189,14 @@ typedef struct tagSmeStruct
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
     void(*pLinkLayerStatsIndCallback)(void *callbackContext,
                                         int indType, void *pRsp);
+    void (*link_layer_stats_ext_cb)(tSirLLStatsResults *rsp);
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
+
+#ifdef WLAN_POWER_DEBUGFS
+    void *power_debug_stats_context;
+    void(*power_stats_resp_callback)(struct power_stats_response *rsp,
+				    void *callback_context);
+#endif
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
     void (*pAutoShutdownNotificationCb) (void);
 #endif
@@ -188,12 +206,21 @@ typedef struct tagSmeStruct
     /* link speed callback */
     void (*pLinkSpeedIndCb) (tSirLinkSpeedInfo *indParam, void *pDevContext);
     void *pLinkSpeedCbContext;
-    /* get rssi callback */
-    void (*pget_rssi_ind_cb) (struct sir_rssi_resp *param, void *pcontext);
-    void *pget_rssi_cb_context;
+    /* get peer info callback */
+    void (*pget_peer_info_ind_cb) (struct sir_peer_info_resp *param,
+		    void *pcontext);
+    void *pget_peer_info_cb_context;
+    /* get extended peer info callback */
+    void (*pget_peer_info_ext_ind_cb) (struct sir_peer_info_ext_resp *param,
+		    void *pcontext);
+    void *pget_peer_info_ext_cb_context;
+    /* get isolation callback */
+    void (*get_isolation) (struct sir_isolation_resp *param, void *context);
+    void *get_isolation_cb_context;
 #ifdef FEATURE_WLAN_EXTSCAN
     void (*pExtScanIndCb) (void *, const tANI_U16, void *);
 #endif /* FEATURE_WLAN_EXTSCAN */
+    void  (*pchain_rssi_ind_cb)(void *, void *);
 #ifdef WLAN_FEATURE_NAN
     void (*nanCallback) (void*, tSirNanEvent*);
 #endif
@@ -222,11 +249,12 @@ typedef struct tagSmeStruct
     ocb_callback dcc_update_ndl_callback;
     void *dcc_stats_event_context;
     ocb_callback dcc_stats_event_callback;
-#ifdef WLAN_FEATURE_MEMDUMP
-    void (*fw_dump_callback)(void *context, struct fw_dump_rsp *rsp);
-#endif
+    void *radio_chan_stats_context;
+    ocb_callback radio_chan_stats_callback;
     void (*set_thermal_level_cb)(void *hdd_context, uint8_t level);
-
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+    void (*thermal_temp_ind_cb)(void *pContext, uint32_t degree_c);
+#endif
     void (*rssi_threshold_breached_cb)(void *, struct rssi_breach_event *);
     void (*lost_link_info_cb)(void *context,
 			      struct sir_lost_link_info *lost_link_info);
@@ -235,6 +263,9 @@ typedef struct tagSmeStruct
     void (*pbpf_get_offload_cb)(void *context, struct sir_bpf_get_offload *);
     void *mib_stats_context;
     void (*csr_mib_stats_callback) (struct mib_stats_metrics*, void*);
+    void (*stats_ext2_cb)(void *, struct stats_ext2_event *);
+    void (*chip_power_save_fail_cb)(void *,
+			struct chip_pwr_save_fail_detected_params *);
 } tSmeStruct, *tpSmeStruct;
 
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/sme_Api.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/sme_Api.h
index e78df1a59f3..7ed05ff3b5a 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/sme_Api.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/sme_Api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -52,7 +52,7 @@
 #include "sirApi.h"
 #include "vos_nvitem.h"
 #include "p2p_Api.h"
-#include "smeInternal.h" 
+#include "smeInternal.h"
 #include "regdomain.h"
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
@@ -127,6 +127,10 @@ typedef struct _smeConfigParams
     uint32_t      fine_time_meas_cap;
     int8_t        first_scan_bucket_threshold;
     bool          snr_monitor_enabled;
+    uint8_t      sub20_config_info;
+    uint8_t      sub20_channelwidth;
+    uint8_t      sub20_dynamic_channelwidth;
+    bool         sta_change_cc_via_beacon;
 } tSmeConfigParams, *tpSmeConfigParams;
 
 typedef enum
@@ -241,8 +245,16 @@ typedef struct {
     tSmeThermalLevelInfo smeThermalLevels[SME_MAX_THERMAL_LEVELS];
     u_int8_t smeThermalMgmtEnabled;
     u_int32_t smeThrottlePeriod;
-    u_int8_t sme_throttle_duty_cycle_2g_tbl[SME_MAX_THROTTLE_LEVELS];
-    u_int8_t sme_throttle_duty_cycle_5g_tbl[SME_MAX_THROTTLE_LEVELS];
+    u_int8_t sme_throttle_duty_cycle_tbl[SME_MAX_THROTTLE_LEVELS];
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+    uint8_t  thermal_shutdown_enabled;
+    uint8_t  thermal_shutdown_auto_enabled;
+    uint16_t thermal_resume_threshold;
+    uint16_t thermal_warning_threshold;
+    uint16_t thermal_suspend_threshold;
+    uint16_t thermal_sample_rate;
+#endif
+
 } tSmeThermalParams;
 
 #ifdef WLAN_FEATURE_APFIND
@@ -267,6 +279,24 @@ struct sme_oem_capability {
 	uint32_t reserved2;
 };
 
+/*
+ * struct sme_5g_pref_params : 5G preference params to be read from ini
+ * @rssi_boost_threshold_5g: RSSI threshold above which 5 GHz is favored
+ * @rssi_boost_factor_5g: Factor by which 5GHz RSSI is boosted
+ * @max_rssi_boost_5g: Maximum boost that can be applied to 5GHz RSSI
+ * @rssi_penalize_threshold_5g: RSSI threshold below which 5G is not favored
+ * @rssi_penalize_factor_5g: Factor by which 5GHz RSSI is penalized
+ * @max_rssi_penalize_5g: Maximum penalty that can be applied to 5G RSSI
+ */
+struct sme_5g_band_pref_params {
+	int8_t      rssi_boost_threshold_5g;
+	uint8_t     rssi_boost_factor_5g;
+	uint8_t     max_rssi_boost_5g;
+	int8_t      rssi_penalize_threshold_5g;
+	uint8_t     rssi_penalize_factor_5g;
+	uint8_t     max_rssi_penalize_5g;
+};
+
 /*-------------------------------------------------------------------------
   Function declarations and documentation
   ------------------------------------------------------------------------*/
@@ -793,6 +823,13 @@ eHalStatus sme_RoamConnectToLastProfile(tHalHandle hHal, tANI_U8 sessionId);
 eHalStatus sme_RoamDisconnect(tHalHandle hHal, tANI_U8 sessionId, eCsrRoamDisconnectReason reason);
 
 /* ---------------------------------------------------------------------------
+    \fn.sme_dhcp_done_ind
+    \brief a wrapper function to set dhcp done ind  in sme session
+    \retun void.
+---------------------------------------------------------------------------*/
+void sme_dhcp_done_ind(tHalHandle hal, uint8_t session_id);
+
+/* ---------------------------------------------------------------------------
     \fn sme_RoamStopBss
     \brief a wrapper function to request CSR to stop bss
     \param sessionId    - sessionId of SoftAP
@@ -2473,15 +2510,19 @@ tANI_BOOLEAN sme_IsChannelValid(tHalHandle hHal, tANI_U8 channel);
 eHalStatus sme_SetMaxTxPower(tHalHandle hHal, tSirMacAddr pBssid,
                              tSirMacAddr pSelfMacAddress, v_S7_t dB);
 
-/* ---------------------------------------------------------------------------
-    \fn sme_SetMaxTxPowerPerBand
-    \brief  Used to set the Maximum Transmit Power for
-    specific band dynamically. Note: this setting will not persist over reboots
-    \param band
-    \param power to set in dB
-    \- return eHalStatus
-    -------------------------------------------------------------------------*/
-eHalStatus sme_SetMaxTxPowerPerBand(eCsrBand band, v_S7_t db);
+/**
+ * sme_SetMaxTxPowerPerBand() - Set the Maximum Transmit Power
+ * specific to band dynamically
+ * @band: Band for which power needs to be applied
+ * @dB: power to set in dB
+ * @hal: HAL handle
+ *
+ * Set the maximum transmit power dynamically per band
+ *
+ * Return: eHalStatus
+ */
+eHalStatus sme_SetMaxTxPowerPerBand(eCsrBand band, v_S7_t dB,
+				tHalHandle hal);
 
 /* ---------------------------------------------------------------------------
     \fn sme_SetTxPower
@@ -3573,16 +3614,6 @@ eHalStatus sme_AddPeriodicTxPtrn(tHalHandle hHal, tSirAddPeriodicTxPtrn
   ---------------------------------------------------------------------------*/
 eHalStatus sme_DelPeriodicTxPtrn(tHalHandle hHal, tSirDelPeriodicTxPtrn
                                  *delPeriodicTxPtrnParams);
-/*--------------------------------------------------------------------------
-  \brief sme_enable_disable_split_scan() - a wrapper function to set the split
-                                          scan parameter.
-  This is a synchronous call
-  \param hHal - The handle returned by macOpen
-  \return None.
-  \sa
-  --------------------------------------------------------------------------*/
-void sme_enable_disable_split_scan (tHalHandle hHal, tANI_U8 nNumStaChan,
-                                    tANI_U8 nNumP2PChan);
 
 /**
  * sme_enable_rmc() - enable RMC
@@ -3654,7 +3685,7 @@ eHalStatus smeIssueFastRoamNeighborAPEvent (tHalHandle hHal,
 
 eHalStatus sme_RoamDelPMKIDfromCache(tHalHandle hHal,
                                      tANI_U8 sessionId,
-                                     const tANI_U8 *pBSSId,
+                                     tPmkidCacheInfo *pmksa,
                                      tANI_BOOLEAN flush_cache);
 
 void smeGetCommandQStatus( tHalHandle hHal );
@@ -3672,10 +3703,15 @@ eHalStatus sme_set_mib_stats_enable(tHalHandle hal, uint8_t value);
 eHalStatus sme_ConfigEnablePowerSave (tHalHandle hHal, tPmcPowerSavingMode psMode);
 eHalStatus sme_ConfigDisablePowerSave (tHalHandle hHal, tPmcPowerSavingMode psMode);
 eHalStatus sme_PsOffloadEnablePowerSave (tHalHandle hHal, tANI_U32 sessionId);
-eHalStatus sme_PsOffloadDisablePowerSave (tHalHandle hHal, tANI_U32 sessionId);
 eHalStatus sme_PsOffloadEnableDeferredPowerSave (tHalHandle hHal,
                                                  tANI_U32 sessionId,
                                                  tANI_BOOLEAN isReassoc);
+
+eHalStatus sme_PsOffloadDisablePowerSave(tHalHandle hHal,
+					 FullPowerReqCb callback,
+					 void *callback_context,
+					 tANI_U32 sessionId);
+
 eHalStatus sme_PsOffloadDisableDeferredPowerSave (tHalHandle hHal,
                                                   tANI_U32 sessionId);
 
@@ -3809,11 +3845,31 @@ eHalStatus sme_TxpowerLimit( tHalHandle hHal, tSirTxPowerLimit *psmetx);
 eHalStatus sme_GetLinkSpeed(tHalHandle hHal,tSirLinkSpeedInfo *lsReq,void *plsContext,
                             void (*pCallbackfn)(tSirLinkSpeedInfo *indParam, void *pContext) );
 
-eHalStatus sme_get_rssi(tHalHandle hal, struct sir_rssi_req req,
+eHalStatus sme_get_peer_info(tHalHandle hal, struct sir_peer_info_req req,
 			void *context,
-			void (*callbackfn)(struct sir_rssi_resp *param,
+			void (*callbackfn)(struct sir_peer_info_resp *param,
 						void *pcontext));
 
+eHalStatus sme_get_isolation(tHalHandle hal,
+           void *context,
+           void (*callbackfn)(struct sir_isolation_resp *param,
+                       void *pcontext));
+
+/*----------------------------------------------------------------------------
+ \fn  sme_get_peer_info_ext
+ \brief  This function sends msg to get info for remote peer
+ \param  hHal - global structure
+ \param  req - get peer info request pointer
+ \param  context - event handle context
+ \param  callbackfn - callback fn with response
+ \- return Success or failure
+-----------------------------------------------------------------------------*/
+eHalStatus sme_get_peer_info_ext(tHalHandle hal,
+		struct sir_peer_info_ext_req *req,
+		void *context,
+		void (*callbackfn)(struct sir_peer_info_ext_resp *param,
+			void *pcontext));
+
 /*----------------------------------------------------------------------------
  \fn  sme_ModifyAddIE
  \brief  This function sends msg to updates the additional IE buffers in PE
@@ -3885,6 +3941,7 @@ eHalStatus sme_StatsExtEvent (tHalHandle hHal, void* pMsg);
    \param enable_dot11p - 802.11p config param
    \return eHalStatus
 ---------------------------------------------------------------------------*/
+#ifdef WLAN_FEATURE_DSRC
 void sme_set_dot11p_config(tHalHandle hal, bool enable_dot11p);
 
 eHalStatus sme_ocb_set_config(tHalHandle hHal, void *context,
@@ -3920,6 +3977,102 @@ eHalStatus sme_dcc_update_ndl(tHalHandle hHal, void* context,
 eHalStatus sme_register_for_dcc_stats_event(tHalHandle hHal, void* context,
                                             ocb_callback callback);
 
+eHalStatus sme_register_radio_chan_stats_cb(tHalHandle hHal, void *context,
+					    ocb_callback callback);
+
+eHalStatus sme_unregister_radio_chan_stats_cb(tHalHandle hHal);
+
+eHalStatus sme_request_radio_chan_stats(tHalHandle hHal,
+					struct radio_chan_stats_req *req);
+#else
+static inline void sme_set_dot11p_config(tHalHandle hal, bool enable_dot11p)
+{
+	return;
+}
+
+static inline eHalStatus sme_ocb_set_config(tHalHandle hHal, void *context,
+		ocb_callback callback,
+		struct sir_ocb_config *config)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_ocb_set_utc_time(struct sir_ocb_utc *utc)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_ocb_start_timing_advert(
+		struct sir_ocb_timing_advert *timing_advert)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_ocb_stop_timing_advert(struct sir_ocb_timing_advert
+		*timing_advert)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline int sme_ocb_gen_timing_advert_frame(tHalHandle hHal,
+		tSirMacAddr self_addr, uint8_t **buf,
+		uint32_t *timestamp_offset,
+		uint32_t *time_value_offset)
+{
+	return 0;
+}
+
+static inline eHalStatus sme_ocb_get_tsf_timer(tHalHandle hHal, void *context,
+		ocb_callback callback,
+		struct sir_ocb_get_tsf_timer *request)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_dcc_get_stats(tHalHandle hHal, void *context,
+		ocb_callback callback,
+		struct sir_dcc_get_stats *request)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_dcc_clear_stats(uint32_t vdev_id,
+		uint32_t dcc_stats_bitmap)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_dcc_update_ndl(tHalHandle hHal, void* context,
+		ocb_callback callback,
+		struct sir_dcc_update_ndl *request)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_register_for_dcc_stats_event(tHalHandle hHal,
+		void* context, ocb_callback callback)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_register_radio_chan_stats_cb(tHalHandle hHal,
+		void *context, ocb_callback callback)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_unregister_radio_chan_stats_cb(tHalHandle hHal)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+
+static inline eHalStatus sme_request_radio_chan_stats(tHalHandle hHal,
+		struct radio_chan_stats_req *req)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+#endif
+
 /* ---------------------------------------------------------------------------
     \fn sme_UpdateDFSScanMode
     \brief  Update DFS roam scan mode
@@ -4028,10 +4181,6 @@ eHalStatus sme_SetBssHotlist (tHalHandle hHal,
 eHalStatus sme_ResetBssHotlist (tHalHandle hHal,
                              tSirExtScanResetBssidHotlistReqParams *pResetReq);
 
-eHalStatus
-sme_set_ssid_hotlist(tHalHandle hal,
-		     struct sir_set_ssid_hotlist_request *request);
-
 /* ---------------------------------------------------------------------------
     \fn sme_SetSignificantChange
     \brief  SME API to set significant change
@@ -4062,6 +4211,16 @@ eHalStatus sme_ResetSignificantChange (tHalHandle hHal,
 eHalStatus sme_getCachedResults (tHalHandle hHal,
                       tSirExtScanGetCachedResultsReqParams *pCachedResultsReq);
 
+/**
+ * sme_get_chain_rssi - sme api to get chain rssi
+ * @hHal: global hal handle
+ * @input: get chain rssi req params
+ *
+ * Return: eHalStatus enumeration.
+ */
+eHalStatus sme_get_chain_rssi(tHalHandle phal,
+	struct get_chain_rssi_req_params *input);
+
 eHalStatus sme_set_epno_list(tHalHandle hal,
                                 struct wifi_epno_params *req_msg);
 eHalStatus sme_set_passpoint_list(tHalHandle hal,
@@ -4080,6 +4239,16 @@ eHalStatus sme_ExtScanRegisterCallback (tHalHandle hHal,
 
 #endif /* FEATURE_WLAN_EXTSCAN */
 
+/**
+ * sme_chain_rssi_register_callback - chain rssi callback
+ * @hal: global hal handle
+ * @pchain_rssi_ind_cb: callback function pointer
+ *
+ * Return: eHalStatus enumeration.
+ */
+eHalStatus sme_chain_rssi_register_callback(tHalHandle phal,
+			void (*pchain_rssi_ind_cb)(void *, void *));
+
 eHalStatus sme_bpf_offload_register_callback(tHalHandle hal,
 			void (*pbpf_get_offload_cb)(void *,
 			struct sir_bpf_get_offload *));
@@ -4129,6 +4298,9 @@ eHalStatus sme_LLStatsSetReq (tHalHandle hHal,
 eHalStatus sme_LLStatsGetReq (tHalHandle hHal,
                         tSirLLStatsGetReq *pgetStatsReq);
 
+eHalStatus sme_ll_stats_set_thresh(tHalHandle hal,
+				   struct sir_ll_ext_stats_threshold *thresh);
+
 /* ---------------------------------------------------------------------------
     \fn sme_SetLinkLayerStatsIndCB
     \brief  SME API to trigger the stats are available  after get request
@@ -4143,12 +4315,10 @@ eHalStatus sme_SetLinkLayerStatsIndCB
     void (*callbackRoutine) (void *callbackCtx, int indType, void *pRsp)
 );
 
-#endif /* WLAN_FEATURE_LINK_LAYER_STATS */
+eHalStatus sme_set_ll_ext_cb(tHalHandle hal,
+			     void (*ll_stats_ext_cb)(tSirLLStatsResults *rsp));
 
-eHalStatus sme_fw_mem_dump(tHalHandle hHal, void *recvd_req);
-eHalStatus sme_fw_mem_dump_register_cb(tHalHandle hHal,
-    void (*callback_routine)(void *cb_context, struct fw_dump_rsp *rsp));
-eHalStatus sme_fw_mem_dump_unregister_cb(tHalHandle hHal);
+#endif /* WLAN_FEATURE_LINK_LAYER_STATS */
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 /*--------------------------------------------------------------------------
@@ -4422,10 +4592,21 @@ VOS_STATUS sme_set_btc_wlan_conn_params(uint32_t conn_val0,
 VOS_STATUS sme_set_btc_dynamic_bt_wlan_coex(uint32_t dynamic_wlan_bt_coex,
 					uint32_t antenna_isolation);
 
+VOS_STATUS sme_set_btc_bt_wlan_interval_page_p2p_sta(uint32_t bt_interval,
+					uint32_t p2p_sta_interval);
+VOS_STATUS sme_set_btc_bt_wlan_interval_inquiry_sta(uint32_t bt_interval,
+					uint32_t sta_interval);
+VOS_STATUS sme_set_btc_bt_wlan_interval_inquiry_sap(uint32_t bt_interval,
+					uint32_t sap_interval);
+VOS_STATUS sme_set_btc_bt_wlan_interval_inquiry_p2p(uint32_t bt_interval,
+					uint32_t p2p_interval);
+VOS_STATUS sme_set_btc_bt_wlan_interval_inquiry_p2p_sta(uint32_t bt_interval,
+					uint32_t p2p_sta_interval);
+
 VOS_STATUS sme_set_btc_wlan_coex_tx_power(uint32_t coex_tx_power);
 
-#ifdef WMI_COEX_BTC_DUTYCYCLE
-VOS_STATUS sme_set_btc_coex_dutycycle(uint32_t coex_btc_PauseDuration,uint32_t coex_btc_UnPauseDuration);
+#ifdef FEATURE_COEX_PTA_CONFIG_ENABLE
+VOS_STATUS sme_configure_pta_coex(uint8_t coex_pta_config_enable, uint32_t coex_pta_config_param);
 #endif
 
 uint8_t    sme_is_any_session_in_connected_state(tHalHandle h_hal);
@@ -4433,11 +4614,23 @@ uint8_t    sme_is_any_session_in_connected_state(tHalHandle h_hal);
 typedef void ( *tSmeSetThermalLevelCallback)(void *pContext, u_int8_t level);
 void sme_add_set_thermal_level_callback(tHalHandle hHal,
                    tSmeSetThermalLevelCallback callback);
+typedef void (*tSmeThermalTempIndCb)(void *pContext, u_int32_t degree_c);
+/**
+ * sme_add_thermal_temperature_ind_callback() - Set callback fn for thermal
+ * temperature indication
+ * hHal: Handler to HAL
+ * callback: The callback function
+ *
+ * Return: void
+ */
+void sme_add_thermal_temperature_ind_callback(tHalHandle hHal,
+                   tSmeThermalTempIndCb callback);
 
 eHalStatus sme_handle_set_fcc_channel(tHalHandle hHal,
 		bool fcc_constraint,
 		uint32_t scan_pending);
-
+eHalStatus sme_set_sta_chanlist_with_sub20(tHalHandle hal_ptr,
+					   uint8_t chan_width);
 eHalStatus sme_set_rssi_monitoring(tHalHandle hal,
 					struct rssi_monitor_req *input);
 eHalStatus sme_set_rssi_threshold_breached_cb(tHalHandle hal,
@@ -4534,6 +4727,9 @@ eHalStatus sme_delete_all_tdls_peers(tHalHandle hal, uint8_t session_id);
 
 eHalStatus sme_update_txrate(tHalHandle hal, struct sir_txrate_update *req);
 
+eHalStatus sme_peer_flush_pending(tHalHandle hal,
+				  struct sme_flush_pending *req);
+
 void sme_send_disassoc_req_frame(tHalHandle hal, uint8_t session_id,
 		uint8_t *peer_mac, tANI_U16 reason, uint8_t wait_for_ack);
 
@@ -4546,25 +4742,109 @@ eHalStatus sme_remove_bssid_from_scan_list(tHalHandle hal,
 eHalStatus sme_update_sta_roam_policy(tHalHandle hal_handle,
 		enum sta_roam_policy_dfs_mode dfs_mode,
 		bool skip_unsafe_channels,
-		uint8_t session_id);
+		uint8_t session_id,
+		uint8_t sap_operating_band);
 eHalStatus sme_register_p2p_ack_ind_callback(tHalHandle hal,
 					sir_p2p_ack_ind_callback callback);
 
-void sme_set_allowed_action_frames(tHalHandle hal, uint32_t bitmap0);
+void sme_set_allowed_action_frames(tHalHandle hal,
+					uint32_t bitmap0, bool is_sta);
 
 eHalStatus sme_update_access_policy_vendor_ie(tHalHandle hal,
 		uint8_t session_id, uint8_t *vendor_ie, int access_policy);
 eHalStatus sme_update_tx_fail_cnt_threshold(tHalHandle hal_handle,
 		uint8_t session_id, uint32_t tx_fail_count);
 eHalStatus sme_update_short_retry_limit_threshold(tHalHandle hal_handle,
-		uint8_t session_id, uint32_t short_limit_count_th);
+		uint8_t session_id, uint8_t short_limit_count_th);
 eHalStatus sme_update_long_retry_limit_threshold(tHalHandle hal_handle,
-		uint8_t session_id, uint32_t long_limit_count_th);
+		uint8_t session_id, uint8_t long_limit_count_th);
 eHalStatus sme_update_sta_inactivity_timeout(tHalHandle hal_handle,
 		uint8_t session_id, uint32_t sta_inactivity_timeout);
 
 VOS_STATUS sme_set_wakeup_gpio(struct wakeup_gpio_mode *wakeup_gpio_info);
 
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+tANI_BOOLEAN sme_find_sta_session_info(
+	tHalHandle hHal,
+	session_info_t *session_info);
+tANI_BOOLEAN sme_find_all_session_info(
+	tHalHandle hHal,
+	session_info_t *session_info,
+	v_U8_t * session_count);
+tANI_BOOLEAN sme_create_sap_session_info(
+	tHalHandle hHal,
+	eCsrPhyMode sap_phymode,
+	v_U16_t sap_ch,
+	session_info_t *session_info);
+#endif
+
 void sme_set_chan_info_callback(tHalHandle hal_handle,
                            void (*callback)(struct scan_chan_info *chan_info));
+
+void sme_set_5g_band_pref(tHalHandle hal_handle,
+                                struct sme_5g_band_pref_params *pref_params);
+eHalStatus sme_set_reorder_timeout(tHalHandle hal,
+		struct sir_set_rx_reorder_timeout_val *req);
+eHalStatus sme_set_rx_set_blocksize(tHalHandle hal,
+		struct sir_peer_set_rx_blocksize *req);
+eHalStatus sme_register_stats_ext2_callback(tHalHandle hHal,
+		void (*stats_ext2_cb)(void *, struct stats_ext2_event *));
+
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+eHalStatus sme_update_sub20_channel_width(tHalHandle hal_handle,
+                                          uint8_t session_id,
+                                          uint8_t chan_width);
+#else
+static inline
+eHalStatus sme_update_sub20_channel_width(tHalHandle hal_handle,
+                                          uint8_t session_id,
+                                          uint8_t chan_width)
+{
+	return eHAL_STATUS_SUCCESS;
+}
+#endif
+#ifdef WLAN_POWER_DEBUGFS
+eHalStatus sme_power_debug_stats_req(tHalHandle hal, void (*callback_fn)
+			(struct power_stats_response *response,
+			void *context), void *power_stats_context);
+#endif
+
+/**
+ * sme_set_random_mac() - Set random mac address filter
+ * @hal: hal handle for getting global mac struct
+ * @callback: callback to be invoked for response from firmware
+ * @session_id: interface id
+ * @random_mac: random mac address to be set
+ * @context: parameter to callback
+ *
+ * This function is used to set random mac address filter for action frames
+ * which are send with the same address, callback is invoked when corresponding
+ * event from firmware has come.
+ *
+ * Return: eHalStatus enumeration.
+ */
+eHalStatus sme_set_random_mac(tHalHandle hal,
+			      action_frame_random_filter_callback callback,
+			      uint32_t session_id, uint8_t *random_mac,
+			      void *context);
+
+/**
+ * sme_clear_random_mac() - clear random mac address filter
+ * @hal: HAL handle
+ * @session_id: interface id
+ * @random_mac: random mac address to be cleared
+ *
+ * This function is used to clear the randmom mac address filters
+ * which are set with sme_set_random_mac
+ *
+ * Return: eHalStatus enumeration.
+ */
+eHalStatus sme_clear_random_mac(tHalHandle hal, uint32_t session_id,
+				uint8_t *random_mac);
+
+eHalStatus sme_set_chip_pwr_save_fail_cb(tHalHandle hal, void (*cb)( void *,
+				struct chip_pwr_save_fail_detected_params *));
+
+eHalStatus sme_set_ac_txq_optimize(tHalHandle hal_handle, uint8_t *value);
+
 #endif //#if !defined( __SME_API_H )
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/inc/sme_nan_datapath.h b/drivers/staging/qcacld-2.0/CORE/SME/inc/sme_nan_datapath.h
index 43681c8250b..1216789ffc3 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/inc/sme_nan_datapath.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/inc/sme_nan_datapath.h
@@ -87,14 +87,6 @@ eHalStatus sme_ndp_responder_req_handler(tHalHandle hal,
 /* NaN indication response handler */
 VOS_STATUS sme_ndp_end_req_handler(tHalHandle hal, struct ndp_end_req *req);
 
-/* NaN schedule update request handler */
-VOS_STATUS sme_ndp_sched_req_handler(uint32_t session_id,
-				struct ndp_schedule_update_req *req_params);
-
-/* Function to handle NDP messages from lower layers */
-void sme_ndp_message_processor(tpAniSirGlobal mac_ctx, uint16_t msg_type,
-				void *msg);
-
 /* Start NDI BSS */
 VOS_STATUS csr_roam_start_ndi(tpAniSirGlobal mac_ctx, uint32_t session_id,
 			      tCsrRoamProfile *profile);
@@ -125,6 +117,24 @@ void csr_release_ndp_data_end_req(tpAniSirGlobal mac_ctx, tSmeCmd *cmd);
 
 #else
 
+/* NAN initiator request handler */
+static inline eHalStatus sme_ndp_initiator_req_handler(tHalHandle hal,
+					 void *req_params) {
+	return eHAL_STATUS_SUCCESS;
+}
+
+
+/* NAN responder request handler */
+static inline eHalStatus sme_ndp_responder_req_handler(tHalHandle hal,
+					 void *req_params) {
+	return eHAL_STATUS_SUCCESS;
+}
+
+/* NAN indication response handler */
+static inline VOS_STATUS sme_ndp_end_req_handler(tHalHandle hal, void *req) {
+	return VOS_STATUS_SUCCESS;
+}
+
 /* Start NDI BSS */
 static inline VOS_STATUS csr_roam_start_ndi(tpAniSirGlobal mac_ctx,
 					uint32_t session_id,
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/QoS/sme_Qos.c b/drivers/staging/qcacld-2.0/CORE/SME/src/QoS/sme_Qos.c
index 9546f70a9f4..0b567bf7e0f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/QoS/sme_Qos.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/QoS/sme_Qos.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1517,7 +1517,7 @@ sme_QosStatusType sme_QosInternalSetupReq(tpAniSirGlobal pMac,
          pentry->tspec_mask = pACInfo->tspec_mask_status;
          pentry->QoSInfo = Tspec_Info;
          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                   "%s: %d: Creating entry on session %d at %p with flowID %d",
+                   "%s: %d: Creating entry on session %d at %pK with flowID %d",
                    __func__, __LINE__,
                    sessionId, pentry, QosFlowID);
          csrLLInsertTail(&sme_QosCb.flow_list, &pentry->link, VOS_TRUE);
@@ -1835,7 +1835,7 @@ sme_QosStatusType sme_QosInternalSetupReq(tpAniSirGlobal pMac,
          pentry->tspec_mask = tmask;
          pentry->QoSInfo = Tspec_Info;
          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                   "%s: %d: On session %d creating entry at %p with flowID %d",
+                   "%s: %d: On session %d creating entry at %pK with flowID %d",
                    __func__, __LINE__,
                    sessionId, pentry, QosFlowID);
          csrLLInsertTail(&sme_QosCb.flow_list, &pentry->link, VOS_TRUE);
@@ -2110,7 +2110,7 @@ sme_QosStatusType sme_QosInternalModifyReq(tpAniSirGlobal pMac,
       flow_info->reason = SME_QOS_REASON_MODIFY;
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
                 "%s: %d: On session %d creating modified "
-                "entry at %p with flowID %d",
+                "entry at %pK with flowID %d",
                 __func__, __LINE__,
                 sessionId, pNewEntry, pNewEntry->QosFlowID);
       //add the new entry under construction to the Flow List
@@ -2590,7 +2590,7 @@ sme_QosStatusType sme_QosInternalReleaseReq(tpAniSirGlobal pMac,
                   pACInfo->requested_QoSInfo[flow_info->tspec_mask - 1];
                //delete the entry from Flow List
                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                         "%s: %d: Deleting entry at %p with flowID %d",
+                         "%s: %d: Deleting entry at %pK with flowID %d",
                          __func__, __LINE__,
                          flow_info, QosFlowID);
                csrLLRemoveEntry(&sme_QosCb.flow_list, pEntry, VOS_TRUE );
@@ -2635,7 +2635,7 @@ sme_QosStatusType sme_QosInternalReleaseReq(tpAniSirGlobal pMac,
                //delete the entry from Flow List
                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
                          "%s: %d: On session %d deleting entry at "
-                         "%p with flowID %d",
+                         "%pK with flowID %d",
                          __func__, __LINE__,
                          sessionId, flow_info, QosFlowID);
                csrLLRemoveEntry(&sme_QosCb.flow_list, pEntry, VOS_TRUE );
@@ -2807,7 +2807,7 @@ sme_QosStatusType sme_QosInternalReleaseReq(tpAniSirGlobal pMac,
                           flow_info->QosFlowID);
 
             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                      "%s: %d: Deleting entry at %p with flowID %d",
+                      "%s: %d: Deleting entry at %pK with flowID %d",
                       __func__, __LINE__,
                       flow_info, flow_info->QosFlowID);
          }
@@ -2857,7 +2857,7 @@ sme_QosStatusType sme_QosInternalReleaseReq(tpAniSirGlobal pMac,
          pACInfo->num_flows[flow_info->tspec_mask - 1]--;
          //delete the entry from Flow List
          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                   "%s: %d: On session %d deleting entry at %p with flowID %d",
+                   "%s: %d: On session %d deleting entry at %pK with flowID %d",
                    __func__, __LINE__,
                    sessionId, flow_info, QosFlowID);
          csrLLRemoveEntry(&sme_QosCb.flow_list, pEntry, VOS_TRUE );
@@ -3317,7 +3317,7 @@ eHalStatus sme_QosESEProcessReassocTspecRsp(tpAniSirGlobal pMac, v_U8_t sessionI
     }
 
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_WARN,
-             "TspecLen = %d, pbFrames = %p, pTspecIE = %p",
+             "TspecLen = %d, pbFrames = %pK, pTspecIE = %pK",
              tspecIeLen, pCsrConnectedInfo->pbFrames, pTspecIE);
 
     numTspec = (tspecIeLen)/sizeof(tDot11fIEWMMTSPEC);
@@ -5798,7 +5798,6 @@ eHalStatus sme_QosProcessAddTsSuccessRsp(tpAniSirGlobal pMac,
       log_ptr->nominal_msdu_size = pACInfo->curr_QoSInfo[tspec_pending - 1].nominal_msdu_size;
       log_ptr->peak_data_rate = pACInfo->curr_QoSInfo[tspec_pending - 1].peak_data_rate;
       log_ptr->surplus_bw_allowance = pACInfo->curr_QoSInfo[tspec_pending - 1].surplus_bw_allowance;
-      log_ptr->suspension_interval = pACInfo->curr_QoSInfo[tspec_pending - 1].surplus_bw_allowance;
       log_ptr->suspension_interval = pACInfo->curr_QoSInfo[tspec_pending - 1].suspension_interval;
       log_ptr->svc_start_time = pACInfo->curr_QoSInfo[tspec_pending - 1].svc_start_time;
       log_ptr->tsinfo[0] = pACInfo->curr_QoSInfo[tspec_pending - 1].ts_info.direction << 5 |
@@ -6523,7 +6522,7 @@ static eHalStatus sme_QosBufferExistingFlows(tpAniSirGlobal pMac,
          }
          //delete the entry from Flow List
          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                   "%s: %d: Deleting original entry at %p with flowID %d",
+                   "%s: %d: Deleting original entry at %pK with flowID %d",
                    __func__, __LINE__,
                    flow_info, flow_info->QosFlowID);
          csrLLRemoveEntry(&sme_QosCb.flow_list, pEntry, VOS_TRUE );
@@ -6574,7 +6573,7 @@ static eHalStatus sme_QosDeleteExistingFlows(tpAniSirGlobal pMac,
                                    flow_info->QosFlowID);
          }
          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                   "%s: %d: Deleting entry at %p with flowID %d",
+                   "%s: %d: Deleting entry at %pK with flowID %d",
                    __func__, __LINE__,
                    flow_info, flow_info->QosFlowID);
          //delete the entry from Flow List
@@ -6965,7 +6964,7 @@ eHalStatus sme_QosModifyFnp(tpAniSirGlobal pMac, tListElem *pEntry)
    case SME_QOS_REASON_MODIFY:
       //delete the original entry from Flow List
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                "%s: %d: Deleting original entry at %p with flowID %d",
+                "%s: %d: Deleting original entry at %pK with flowID %d",
                 __func__, __LINE__,
                 flow_info, flow_info->QosFlowID);
       csrLLRemoveEntry(&sme_QosCb.flow_list, pEntry, VOS_TRUE );
@@ -7184,7 +7183,7 @@ eHalStatus sme_QosReassocSuccessEvFnp(tpAniSirGlobal pMac, tListElem *pEntry)
    {
       //delete the entry from Flow List
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                "%s: %d: Deleting entry at %p with flowID %d",
+                "%s: %d: Deleting entry at %pK with flowID %d",
                 __func__, __LINE__,
                 flow_info, flow_info->QosFlowID);
       csrLLRemoveEntry(&sme_QosCb.flow_list, pEntry, VOS_TRUE );
@@ -7275,7 +7274,7 @@ eHalStatus sme_QosAddTsFailureFnp(tpAniSirGlobal pMac, tListElem *pEntry)
       }
       //delete the entry from Flow List
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                "%s: %d: Deleting entry at %p with flowID %d",
+                "%s: %d: Deleting entry at %pK with flowID %d",
                 __func__, __LINE__,
                 flow_info, flow_info->QosFlowID);
       csrLLRemoveEntry(&sme_QosCb.flow_list, pEntry, VOS_TRUE );
@@ -7519,7 +7518,7 @@ eHalStatus sme_QosAddTsSuccessFnp(tpAniSirGlobal pMac, tListElem *pEntry)
    if(delete_entry)
    {
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO_HIGH,
-                "%s: %d: Deleting entry at %p with flowID %d",
+                "%s: %d: Deleting entry at %pK with flowID %d",
                 __func__, __LINE__,
                 flow_info, flow_info->QosFlowID);
       //delete the entry from Flow List
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/ccm/ccmApi.c b/drivers/staging/qcacld-2.0/CORE/SME/src/ccm/ccmApi.c
index ec9ea366f08..3d9f3ef2399 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/ccm/ccmApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/ccm/ccmApi.c
@@ -397,7 +397,7 @@ eHalStatus ccmClose(tHalHandle hHal)
     ccmStop(hHal);
 
     /* Go thru comp[] to free all saved requests */
-    for (i = 0 ; i < CFG_PARAM_MAX_NUM ; ++i)
+    for (i = 0 ; i < WNI_CFG_MAX ; ++i)
     {
         if ((req = pMac->ccm.comp[i]) != NULL)
         {
@@ -489,7 +489,7 @@ void ccmCfgCnfMsgHandler(tHalHandle hHal, void *m)
                 /* move the completed req from reqQ to comp[] */
                 if (req->toBeSaved && (CCM_IS_RESULT_SUCCESS(result)))
                 {
-                    if (cfgId < CFG_PARAM_MAX_NUM)
+                    if (cfgId < WNI_CFG_MAX)
                     {
                         if ((old = pMac->ccm.comp[cfgId]) != NULL)
                         {
@@ -603,7 +603,7 @@ eHalStatus ccmCfgGetInt(tHalHandle hHal, tANI_U32 cfgId, tANI_U32 *pValue)
     eHalStatus status = eHAL_STATUS_SUCCESS ;
     tCfgReq *req;
 
-    if (cfgId >= CFG_PARAM_MAX_NUM) {
+    if (cfgId >= WNI_CFG_MAX) {
         smsLog(pMac, LOGE, FL("Invalid cfg id %d"), cfgId);
         return eHAL_STATUS_INVALID_PARAMETER;
     }
@@ -635,7 +635,7 @@ eHalStatus ccmCfgGetStr(tHalHandle hHal, tANI_U32 cfgId, tANI_U8 *pBuf, tANI_U32
 
     hHdd = halHandle2HddHandle(hHal);
 
-    if (cfgId >= CFG_PARAM_MAX_NUM) {
+    if (cfgId >= WNI_CFG_MAX) {
         smsLog(pMac, LOGE, FL("Invalid cfg id %d"), cfgId);
         return eHAL_STATUS_INVALID_PARAMETER;
     }
@@ -687,7 +687,7 @@ static eHalStatus cfgUpdate(tpAniSirGlobal pMac, tHddHandle hHdd, tCcmCfgSetCall
     palSpinLockGive(hHdd, pMac->ccm.lock);
 
     /* Calculate message length */
-    for (i = 0 ; i < CFG_PARAM_MAX_NUM ; ++i)
+    for (i = 0 ; i < WNI_CFG_MAX ; ++i)
     {
         if ((req = pMac->ccm.comp[i]) != NULL)
         {
@@ -726,7 +726,7 @@ static eHalStatus cfgUpdate(tpAniSirGlobal pMac, tHddHandle hHdd, tCcmCfgSetCall
     pl = encodeCfgReq(hHdd, msg->data, CFG_UPDATE_MAGIC_DWORD, 4, NULL, 0, CCM_INTEGER_TYPE) ;
 
     /* Encode the saved cfg requests */
-    for (i = 0 ; i < CFG_PARAM_MAX_NUM ; ++i)
+    for (i = 0 ; i < WNI_CFG_MAX ; ++i)
     {
         if ((req = pMac->ccm.comp[i]) != NULL)
         {
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrApiRoam.c b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrApiRoam.c
index 7090ec3190e..779b1128b98 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrApiRoam.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrApiRoam.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -72,7 +72,7 @@
 #include <wlan_logging_sock_svc.h>
 #include "sme_nan_datapath.h"
 #include "cfgApi.h"
-
+#include "qdf_crypto.h"
 #define MAX_PWR_FCC_CHAN_12 8
 #define MAX_PWR_FCC_CHAN_13 2
 
@@ -105,6 +105,9 @@
 /* packet dump timer duration of 60 secs */
 #define PKT_DUMP_TIMER_DURATION 60
 
+
+int alloc_tfm(uint8_t *type);
+
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 static tANI_BOOLEAN bRoamScanOffloadStarted = VOS_FALSE;
 #endif
@@ -272,6 +275,21 @@ static void csrSerDesUnpackDiassocRsp(tANI_U8 *pBuf, tSirSmeDisassocRsp *pRsp);
 void csrReinitPreauthCmd(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 void csrInitOperatingClasses(tHalHandle hHal);
 
+void csrRoamSubstateChange(tpAniSirGlobal pMac, eCsrRoamSubState NewSubstate,
+                           tANI_U32 sessionId)
+{
+     smsLog(pMac, LOG1, FL("CSR RoamSubstate: [ %s <== %s ]"),
+                macTraceGetcsrRoamSubState(NewSubstate),
+                macTraceGetcsrRoamSubState(pMac->roam.curSubState[sessionId]));
+    if(pMac->roam.curSubState[sessionId] == NewSubstate)
+    {
+       return;
+    }
+    vos_spin_lock_acquire(&pMac->roam.roam_state_lock);
+    pMac->roam.curSubState[sessionId] = NewSubstate;
+    vos_spin_lock_release(&pMac->roam.roam_state_lock);
+}
+
 //Initialize global variables
 static void csrRoamInitGlobals(tpAniSirGlobal pMac)
 {
@@ -536,7 +554,12 @@ eHalStatus csrUpdateChannelList(tpAniSirGlobal pMac)
                         break;
                     }
                 }
-                if (is_unsafe_chan) {
+                if ((is_unsafe_chan) && ((CSR_IS_CHANNEL_24GHZ(channel) &&
+                     pMac->roam.configParam.sta_roam_policy.sap_operating_band ==
+                     eCSR_BAND_24) ||
+                    (CSR_IS_CHANNEL_5GHZ(channel) &&
+                     pMac->roam.configParam.sta_roam_policy.sap_operating_band ==
+                     eCSR_BAND_5G))) {
                     smsLog(pMac, LOG1,
                             FL("ignoring unsafe channel %d"), channel);
                     continue;
@@ -569,6 +592,12 @@ eHalStatus csrUpdateChannelList(tpAniSirGlobal pMac)
                 pChanList->chanParam[num_channel].dfsSet = VOS_FALSE;
             else
                 pChanList->chanParam[num_channel].dfsSet = VOS_TRUE;
+
+            if (pMac->sub20_channelwidth == SUB20_MODE_5MHZ)
+                pChanList->chanParam[num_channel].quarter_rate = VOS_TRUE;
+            else if (pMac->sub20_channelwidth == SUB20_MODE_10MHZ)
+                pChanList->chanParam[num_channel].half_rate = VOS_TRUE;
+
             num_channel++;
         }
     }
@@ -587,6 +616,14 @@ eHalStatus csrUpdateChannelList(tpAniSirGlobal pMac)
                     csrFindChannelPwr(pScan->defaultPowerTable,
                                       social_channel[j]);
                 pChanList->chanParam[num_channel].dfsSet = VOS_FALSE;
+
+                if (pMac->sub20_channelwidth == SUB20_MODE_5MHZ)
+                        pChanList->chanParam[num_channel].quarter_rate =
+                             VOS_TRUE;
+                else if (pMac->sub20_channelwidth == SUB20_MODE_10MHZ)
+                        pChanList->chanParam[num_channel].half_rate =
+                             VOS_TRUE;
+
                 num_channel++;
             }
         }
@@ -733,7 +770,7 @@ eHalStatus csrStop(tpAniSirGlobal pMac, tHalStopType stopType)
 
     for (sessionId = 0; sessionId < CSR_ROAM_SESSION_MAX; sessionId++) {
        csrRoamStateChange(pMac, eCSR_ROAMING_STATE_STOP, sessionId);
-       pMac->roam.curSubState[sessionId] = eCSR_ROAM_SUBSTATE_NONE;
+       csrRoamSubstateChange(pMac, eCSR_ROAM_SUBSTATE_NONE, sessionId);
     }
 
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
@@ -880,6 +917,7 @@ eHalStatus csrRoamOpen(tpAniSirGlobal pMac)
          smsLog(pMac, LOGE, FL("cannot allocate memory for summary Statistics timer"));
          return eHAL_STATUS_FAILURE;
       }
+      vos_spin_lock_init(&pMac->roam.roam_state_lock);
     }while (0);
     return (status);
 }
@@ -897,6 +935,7 @@ eHalStatus csrRoamClose(tpAniSirGlobal pMac)
     vos_timer_destroy(&pMac->roam.tlStatsReqInfo.hTlStatsTimer);
     vos_timer_stop(&pMac->roam.packetdump_timer);
     vos_timer_destroy(&pMac->roam.packetdump_timer);
+    vos_spin_lock_destroy(&pMac->roam.roam_state_lock);
     return (eHAL_STATUS_SUCCESS);
 }
 
@@ -1115,7 +1154,7 @@ void csrAbortCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand, tANI_BOOLEAN fStop
         {
         case eSmeCommandScan:
             // We need to inform the requester before dropping the scan command
-            smsLog( pMac, LOGW, "%s: Drop scan reason %d callback %p",
+            smsLog( pMac, LOGW, "%s: Drop scan reason %d callback %pK",
                     __func__, pCommand->u.scanCmd.reason,
                     pCommand->u.scanCmd.callback);
             if (NULL != pCommand->u.scanCmd.callback)
@@ -1161,18 +1200,6 @@ void csrAbortCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand, tANI_BOOLEAN fStop
     }
 }
 
-void csrRoamSubstateChange( tpAniSirGlobal pMac, eCsrRoamSubState NewSubstate, tANI_U32 sessionId)
-{
-     smsLog(pMac, LOG1, FL("CSR RoamSubstate: [ %s <== %s ]"),
-                           macTraceGetcsrRoamSubState(NewSubstate),
-                           macTraceGetcsrRoamSubState(pMac->roam.curSubState[sessionId]));
-    if(pMac->roam.curSubState[sessionId] == NewSubstate)
-    {
-       return;
-    }
-    pMac->roam.curSubState[sessionId] = NewSubstate;
-}
-
 eCsrRoamState csrRoamStateChange( tpAniSirGlobal pMac, eCsrRoamState NewRoamState, tANI_U8 sessionId)
 {
     eCsrRoamState PreviousState;
@@ -1261,8 +1288,6 @@ static void initConfigParam(tpAniSirGlobal pMac)
     pMac->roam.configParam.nRestTimeConc = CSR_REST_TIME_CONC;
     pMac->roam.configParam.min_rest_time_conc =  CSR_MIN_REST_TIME_CONC;
     pMac->roam.configParam.idle_time_conc = CSR_IDLE_TIME_CONC;
-    pMac->roam.configParam.nNumStaChanCombinedConc = CSR_NUM_STA_CHAN_COMBINED_CONC;
-    pMac->roam.configParam.nNumP2PChanCombinedConc = CSR_NUM_P2P_CHAN_COMBINED_CONC;
 #endif
     pMac->roam.configParam.IsIdleScanEnabled = TRUE; //enable the idle scan by default
     pMac->roam.configParam.nTxPowerCap = CSR_MAX_TX_POWER;
@@ -1876,14 +1901,6 @@ eHalStatus csrChangeDefaultConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pPa
         pMac->roam.configParam.nRestTimeConc = pParam->nRestTimeConc;
         pMac->roam.configParam.min_rest_time_conc = pParam->min_rest_time_conc;
         pMac->roam.configParam.idle_time_conc = pParam->idle_time_conc;
-        if (pParam->nNumStaChanCombinedConc)
-        {
-            pMac->roam.configParam.nNumStaChanCombinedConc = pParam->nNumStaChanCombinedConc;
-        }
-        if (pParam->nNumP2PChanCombinedConc)
-        {
-            pMac->roam.configParam.nNumP2PChanCombinedConc = pParam->nNumP2PChanCombinedConc;
-        }
 #endif
         //if upper layer wants to disable idle scan altogether set it to 0
         if (pParam->impsSleepTime)
@@ -2062,6 +2079,11 @@ eHalStatus csrChangeDefaultConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pPa
                                pParam->isCoalesingInIBSSAllowed;
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
         pMac->roam.configParam.cc_switch_mode = pParam->cc_switch_mode;
+        pMac->roam.configParam.band_switch_enable = pParam->band_switch_enable;
+        pMac->roam.configParam.ap_p2pgo_concurrency_enable =
+                               pParam->ap_p2pgo_concurrency_enable;
+        pMac->roam.configParam.ap_p2pclient_concur_enable =
+                               pParam->ap_p2pclient_concur_enable;
 #endif
         pMac->roam.configParam.allowDFSChannelRoam = pParam->allowDFSChannelRoam;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
@@ -2090,6 +2112,8 @@ eHalStatus csrChangeDefaultConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pPa
         pMac->roam.configParam.rx_aggregation_size =
                                pParam->rx_aggregation_size;
 
+        pMac->roam.configParam.gStaLocalEDCAEnable =
+                               pParam->gStaLocalEDCAEnable;
         pMac->roam.configParam.enable_edca_params =
                                pParam->enable_edca_params;
         pMac->roam.configParam.edca_vo_cwmin = pParam->edca_vo_cwmin;
@@ -2110,6 +2134,8 @@ eHalStatus csrChangeDefaultConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pPa
             pParam->sta_roam_policy_params.dfs_mode;
         pMac->roam.configParam.sta_roam_policy.skip_unsafe_channels =
             pParam->sta_roam_policy_params.skip_unsafe_channels;
+        pMac->roam.configParam.sta_roam_policy.sap_operating_band =
+            pParam->sta_roam_policy_params.sap_operating_band;
     }
 
     return status;
@@ -2154,9 +2180,6 @@ eHalStatus csrGetConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
         pParam->nRestTimeConc = pMac->roam.configParam.nRestTimeConc;
         pParam->min_rest_time_conc = pMac->roam.configParam.min_rest_time_conc;
         pParam->idle_time_conc = pMac->roam.configParam.idle_time_conc;
-
-        pParam->nNumStaChanCombinedConc = pMac->roam.configParam.nNumStaChanCombinedConc;
-        pParam->nNumP2PChanCombinedConc = pMac->roam.configParam.nNumP2PChanCombinedConc;
 #endif
         //Change the unit from microsecond to second
         pParam->impsSleepTime =
@@ -2247,6 +2270,11 @@ eHalStatus csrGetConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
 
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
         pParam->cc_switch_mode = pMac->roam.configParam.cc_switch_mode;
+        pParam->band_switch_enable = pMac->roam.configParam.band_switch_enable;
+        pParam->ap_p2pgo_concurrency_enable =
+                     pMac->roam.configParam.ap_p2pgo_concurrency_enable;
+        pParam->ap_p2pclient_concur_enable =
+                     pMac->roam.configParam.ap_p2pclient_concur_enable;
 #endif
         pParam->enableTxLdpc = pMac->roam.configParam.txLdpcEnable;
 
@@ -3143,7 +3171,7 @@ eHalStatus csrRoamIssueDisassociate( tpAniSirGlobal pMac, tANI_U32 sessionId,
         vos_mem_copy(&bssId, pSession->pConnectBssDesc->bssId, sizeof(tCsrBssid));
     }
 
-        smsLog(pMac, LOG2, FL("CSR Attempting to Disassociate Bssid="MAC_ADDRESS_STR
+        smsLog(pMac, LOG1, FL("CSR Attempting to Disassociate Bssid="MAC_ADDRESS_STR
                               " subState = %s reason=%d"),
                               MAC_ADDR_ARRAY(bssId), macTraceGetcsrRoamSubState(NewSubstate),
                               reasonCode);
@@ -3473,6 +3501,8 @@ eHalStatus csrRoamPrepareBssConfig(tpAniSirGlobal pMac, tCsrRoamProfile *pProfil
                 pBssConfig->uCfgDot11Mode = eCSR_CFG_DOT11_MODE_11A;
             }
         }
+        smsLog(pMac, LOG1, FL("phyMode %d uCfgDot11Mode %d"),
+                              pProfile->phyMode, pBssConfig->uCfgDot11Mode);
         //Qos
         if ((pBssConfig->uCfgDot11Mode != eCSR_CFG_DOT11_MODE_11N) &&
                 (pMac->roam.configParam.WMMSupportMode == eCsrRoamWmmNoQos))
@@ -3553,6 +3583,12 @@ eHalStatus csrRoamPrepareBssConfig(tpAniSirGlobal pMac, tCsrRoamProfile *pProfil
         }
         //validate CB
         pBssConfig->cbMode = csrGetCBModeFromIes(pMac, pBssDesc->channelId, pIes);
+        if (CSR_IS_CHANNEL_24GHZ(pBssDesc->channelId) &&
+            pProfile->force_24ghz_in_ht20) {
+             pBssConfig->cbMode = PHY_SINGLE_CHANNEL_CENTERED;
+             smsLog(pMac, LOG1,
+                    FL("force_24ghz_in_ht20 is set so set cbmode to 0"));
+        }
     }while(0);
     return (status);
 }
@@ -5170,6 +5206,10 @@ eHalStatus csrRoamProcessCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand )
                 {
                     smsLog(pMac, LOGE, FL("csrRoamIssueReassociate failed with status %d"), status);
                     csrReleaseCommandRoam( pMac, pCommand );
+                } else {
+                    csr_neighbor_roam_state_transition(pMac,
+                        eCSR_NEIGHBOR_ROAM_STATE_REASSOCIATING,
+                        sessionId);
                 }
 
                 vos_mem_free(pIes);
@@ -5202,6 +5242,8 @@ eHalStatus csrRoamProcessCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand )
     case eCsrForcedDisassocSta:
        csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINING, sessionId);
        csrRoamSubstateChange( pMac, eCSR_ROAM_SUBSTATE_DISASSOC_REQ, sessionId);
+       smsLog(pMac, LOG1, FL("Disassociate issued with reason: %d"),
+              pCommand->u.roamCmd.reason);
        status = csrSendMBDisassocReqMsg( pMac, sessionId, pCommand->u.roamCmd.peerMac,
                      pCommand->u.roamCmd.reason);
        break;
@@ -5794,6 +5836,153 @@ void csrRoamSynchCleanUp (tpAniSirGlobal pMac, tANI_U8 sessionId)
 }
 #endif
 
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * populate_fils_params_join_rsp() - Copy FILS params from JOIN rsp
+ * @mac_ctx: Global MAC Context
+ * @roam_info: CSR Roam Info
+ * @join_rsp: SME Join response
+ *
+ * Copy the FILS params from the join results
+ *
+ * Return: VOS_STATUS
+ */
+static VOS_STATUS populate_fils_params_join_rsp(tpAniSirGlobal mac_ctx,
+                        tCsrRoamInfo *roam_info,
+                        tSirSmeJoinRsp *join_rsp)
+{
+    VOS_STATUS status = VOS_STATUS_SUCCESS;
+    struct fils_join_rsp_params *roam_fils_info, *fils_join_rsp = join_rsp->fils_join_rsp;
+
+    if (!fils_join_rsp->fils_pmk_len ||
+            !fils_join_rsp->fils_pmk || !fils_join_rsp->tk_len ||
+            !fils_join_rsp->kek_len || !fils_join_rsp->gtk_len) {
+        smsLog(mac_ctx, LOGW, FL("fils join rsp err: pmk len %d tk len %d kek len %d gtk len %d"),
+            fils_join_rsp->fils_pmk_len,
+            fils_join_rsp->tk_len,
+            fils_join_rsp->kek_len,
+            fils_join_rsp->gtk_len);
+        status = VOS_STATUS_E_FAILURE;
+        goto free_fils_join_rsp;
+    }
+
+    roam_info->fils_join_rsp = vos_mem_malloc(sizeof(*fils_join_rsp));
+    if (!roam_info->fils_join_rsp) {
+        smsLog(mac_ctx, LOGE, FL("fils_join_rsp malloc fails!"));
+        status = VOS_STATUS_E_FAILURE;
+        goto free_fils_join_rsp;
+    }
+
+    roam_fils_info = roam_info->fils_join_rsp;
+    if (fils_join_rsp->fils_pmk_len) {
+        roam_fils_info->fils_pmk = vos_mem_malloc(fils_join_rsp->fils_pmk_len);
+        if (!roam_fils_info->fils_pmk) {
+            vos_mem_free(roam_info->fils_join_rsp);
+            roam_info->fils_join_rsp = NULL;
+            smsLog(mac_ctx, LOGE, FL("fils_pmk malloc fails!"));
+            status = VOS_STATUS_E_FAILURE;
+            goto free_fils_join_rsp;
+        }
+    }
+    roam_info->fils_seq_num = join_rsp->fils_seq_num;
+    roam_fils_info->fils_pmk_len = fils_join_rsp->fils_pmk_len;
+    vos_mem_copy(roam_fils_info->fils_pmk,
+             fils_join_rsp->fils_pmk, roam_fils_info->fils_pmk_len);
+
+    vos_mem_copy(roam_fils_info->fils_pmkid,
+             fils_join_rsp->fils_pmkid, PMKID_LEN);
+
+    roam_fils_info->kek_len = fils_join_rsp->kek_len;
+    vos_mem_copy(roam_fils_info->kek,
+             fils_join_rsp->kek, roam_fils_info->kek_len);
+
+    roam_fils_info->tk_len = fils_join_rsp->tk_len;
+    vos_mem_copy(roam_fils_info->tk,
+             fils_join_rsp->tk, fils_join_rsp->tk_len);
+
+    roam_fils_info->gtk_len = fils_join_rsp->gtk_len;
+    vos_mem_copy(roam_fils_info->gtk,
+             fils_join_rsp->gtk, roam_fils_info->gtk_len);
+    smsLog(mac_ctx, LOG1, FL("FILS connect params copied to CSR!"));
+
+free_fils_join_rsp:
+    vos_mem_free(fils_join_rsp->fils_pmk);
+    vos_mem_free(fils_join_rsp);
+    return status;
+}
+
+/**
+ * csr_process_fils_join_rsp() - Process join rsp for FILS connection
+ * @mac_ctx: Global MAC Context
+ * @profile: CSR Roam Profile
+ * @session_id: Session ID
+ * @roam_info: CSR Roam Info
+ * @bss_desc: BSS description
+ * @join_rsp: SME Join rsp
+ *
+ * Process SME join response for FILS connection
+ *
+ * Return: None
+ */
+static void csr_process_fils_join_rsp(tpAniSirGlobal mac_ctx,
+                    tCsrRoamProfile *profile,
+                    uint32_t session_id,
+                    tCsrRoamInfo *roam_info,
+                    tSirBssDescription *bss_desc,
+                    tSirSmeJoinRsp *join_rsp)
+{
+    tSirMacAddr bcast_mac = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+    VOS_STATUS status;
+
+    if (!join_rsp || !join_rsp->fils_join_rsp) {
+        smsLog(mac_ctx, LOGW, FL("Join rsp doesn't have FILS info"));
+        goto process_fils_join_rsp_fail;
+    }
+
+    /* Copy FILS params */
+    status = populate_fils_params_join_rsp(mac_ctx, roam_info, join_rsp);
+    if (!VOS_IS_STATUS_SUCCESS(status)) {
+        smsLog(mac_ctx, LOGW, FL("Copy FILS params join rsp fails"));
+        goto process_fils_join_rsp_fail;
+    }
+
+    status = csrRoamIssueSetContextReq(mac_ctx, session_id,
+                    profile->negotiatedMCEncryptionType,
+                    bss_desc, &bcast_mac, true, false,
+                    eSIR_RX_ONLY, 2,
+                    roam_info->fils_join_rsp->gtk_len,
+                    roam_info->fils_join_rsp->gtk, 0);
+    if (!VOS_IS_STATUS_SUCCESS(status)) {
+        smsLog(mac_ctx, LOGW, FL("Set context for bcast fail"));
+        goto process_fils_join_rsp_fail;
+    }
+
+    status = csrRoamIssueSetContextReq(mac_ctx, session_id,
+                    profile->negotiatedUCEncryptionType,
+                    bss_desc, &(bss_desc->bssId), true,
+                    true, eSIR_TX_RX, 0,
+                    roam_info->fils_join_rsp->tk_len,
+                    roam_info->fils_join_rsp->tk, 0);
+    if (!VOS_IS_STATUS_SUCCESS(status)) {
+        smsLog(mac_ctx, LOGW, FL("Set context for unicast fail"));
+        goto process_fils_join_rsp_fail;
+    }
+    return;
+
+process_fils_join_rsp_fail:
+     csrRoamSubstateChange(mac_ctx, eCSR_ROAM_SUBSTATE_NONE, session_id);
+}
+#else
+
+static inline void csr_process_fils_join_rsp(tpAniSirGlobal mac_ctx,
+                        tCsrRoamProfile *profile,
+                        uint32_t session_id,
+                        tCsrRoamInfo *roam_info,
+                        tSirBssDescription *bss_desc,
+                        tSirSmeJoinRsp *join_rsp)
+{}
+#endif
+
 //Return true means the command can be release, else not
 static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pCommand,
                                        eCsrRoamCompleteResult Result, void *Context )
@@ -5815,7 +6004,9 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
     eHalStatus status;
     tANI_U32 key_timeout_interval = 0;
     tSirSmeStartBssRsp  *pSmeStartBssRsp = NULL;
-
+#ifdef WLAN_FEATURE_FILS_SK
+    tSirSmeJoinRsp *join_rsp;
+#endif
     if(!pSession)
     {
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
@@ -5831,6 +6022,9 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
             // !! fall through to the next CASE statement here is intentional !!
             // !!
         case eCsrReassocSuccess:
+#ifdef WLAN_FEATURE_FILS_SK
+            join_rsp = (tSirSmeJoinRsp *) Context;
+#endif
             if(eCsrReassocSuccess == Result)
             {
                 ind_qos = SME_QOS_CSR_REASSOC_COMPLETE;
@@ -5843,6 +6037,9 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
             // Connected state...
             smsLog(pMac, LOGW, FL("receives association indication"));
             vos_mem_set(&roamInfo, sizeof(roamInfo), 0);
+
+            roamInfo.reassoc = (eCsrReassocSuccess == Result);
+
             //always free the memory here
             if(pSession->pWpaRsnRspIE)
             {
@@ -5863,11 +6060,11 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
             */
             //csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINED );
 
-            /* Reset remainInPowerActiveTillDHCP as it might have been set
+            /* Reset full_power_till_set_key as it might have been set
              * by last failed secured connection.
              * It should be set only for secured connection.
              */
-            pMac->pmc.remainInPowerActiveTillDHCP = FALSE;
+            pMac->pmc.full_power_till_set_key = false;
             if( CSR_IS_INFRASTRUCTURE( pProfile ) )
             {
                 pSession->connectState = eCSR_ASSOC_STATE_TYPE_INFRA_ASSOCIATED;
@@ -5965,8 +6162,15 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
                     csrRoamIssueSetContextReq( pMac, sessionId, pProfile->negotiatedMCEncryptionType,
                                                pSirBssDesc, &BroadcastMac,
                                                FALSE, FALSE, eSIR_TX_RX, 0, 0, NULL, 0 ); // NO keys... these key parameters don't matter.
-                }
-                else
+                } else
+#ifdef WLAN_FEATURE_FILS_SK
+                if (Context && CSR_IS_AUTH_TYPE_FILS(pProfile->negotiatedAuthType)
+                                &&  join_rsp->is_fils_connection) {
+                    roamInfo.is_fils_connection = true;
+                    csr_process_fils_join_rsp(pMac, pProfile, sessionId,
+                                                &roamInfo, pSirBssDesc, join_rsp);
+                } else
+#endif
                 {
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
         if (pSession->roamOffloadSynchParams.bRoamSynchInProgress &&
@@ -6084,30 +6288,32 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
                        roamInfo.tdls_chan_swit_prohibited);
 #endif
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-                    if (pMac->roam.configParam.cc_switch_mode
-                                            != VOS_MCC_TO_SCC_SWITCH_DISABLE) {
-                        pSession->connectedProfile.HTProfile.phymode =
-                            csrRoamdot11modeToPhymode(pJoinRsp->HTProfile.dot11mode);
-                        pSession->connectedProfile.HTProfile.htCapability =
-                                    pJoinRsp->HTProfile.htCapability;
-                        pSession->connectedProfile.HTProfile.htSupportedChannelWidthSet =
-                                    pJoinRsp->HTProfile.htSupportedChannelWidthSet;
-                        pSession->connectedProfile.HTProfile.htRecommendedTxWidthSet =
-                                    pJoinRsp->HTProfile.htRecommendedTxWidthSet;
-                        pSession->connectedProfile.HTProfile.htSecondaryChannelOffset =
-                                    pJoinRsp->HTProfile.htSecondaryChannelOffset;
+                    pSession->connectedProfile.HTProfile.phymode =
+                        csrRoamdot11modeToPhymode(pJoinRsp->HTProfile.dot11mode);
+                    pSession->connectedProfile.HTProfile.htCapability =
+                                pJoinRsp->HTProfile.htCapability;
+                    pSession->connectedProfile.HTProfile.htSupportedChannelWidthSet =
+                                pJoinRsp->HTProfile.htSupportedChannelWidthSet;
+                    pSession->connectedProfile.HTProfile.htRecommendedTxWidthSet =
+                                pJoinRsp->HTProfile.htRecommendedTxWidthSet;
+                    pSession->connectedProfile.HTProfile.htSecondaryChannelOffset =
+                                pJoinRsp->HTProfile.htSecondaryChannelOffset;
 #ifdef WLAN_FEATURE_11AC
-                        pSession->connectedProfile.HTProfile.vhtCapability =
-                                    pJoinRsp->HTProfile.vhtCapability;
-                        pSession->connectedProfile.HTProfile.vhtTxChannelWidthSet =
-                                    pJoinRsp->HTProfile.vhtTxChannelWidthSet;
-                        pSession->connectedProfile.HTProfile.apCenterChan =
-                                    pJoinRsp->HTProfile.apCenterChan;
-                        pSession->connectedProfile.HTProfile.apChanWidth =
-                                    pJoinRsp->HTProfile.apChanWidth;
+                    pSession->connectedProfile.HTProfile.vhtCapability =
+                                pJoinRsp->HTProfile.vhtCapability;
+                    pSession->connectedProfile.HTProfile.vhtTxChannelWidthSet =
+                                pJoinRsp->HTProfile.vhtTxChannelWidthSet;
+                    pSession->connectedProfile.HTProfile.apCenterChan =
+                                pJoinRsp->HTProfile.apCenterChan;
+                    pSession->connectedProfile.HTProfile.apChanWidth =
+                                pJoinRsp->HTProfile.apChanWidth;
 #endif
-                    }
 #endif
+                    roamInfo.vht_caps = pJoinRsp->vht_caps;
+                    roamInfo.ht_caps = pJoinRsp->ht_caps;
+                    roamInfo.hs20vendor_ie = pJoinRsp->hs20vendor_ie;
+                    roamInfo.ht_operation = pJoinRsp->ht_operation;
+                    roamInfo.vht_operation = pJoinRsp->vht_operation;
                 }
                 else
                 {
@@ -6217,15 +6423,14 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
             //enough to let security and DHCP handshake succeed before entry into BMPS
             if (!pMac->psOffloadEnabled && pmcShouldBmpsTimerRun(pMac))
             {
-                /* Set remainInPowerActiveTillDHCP to make sure we wait for
+                /* Set full_power_till_set_key to make sure we wait for
                  * until keys are set before going into BMPS.
                  */
                 if(eANI_BOOLEAN_TRUE == roamInfo.fAuthRequired)
                 {
-                     pMac->pmc.remainInPowerActiveTillDHCP = TRUE;
-                     smsLog(pMac, LOG1, FL("Set remainInPowerActiveTillDHCP "
-                            "to make sure we wait until keys are set before"
-                            " going to BMPS"));
+                     pMac->pmc.full_power_till_set_key = true;
+                     smsLog(pMac, LOG1,
+                       FL("Set full_power_till_set_key to make sure we wait until keys are set before going to BMPS"));
                 }
                 if (pmcStartTrafficTimer(pMac, BMPS_TRAFFIC_TIMER_ALLOW_SECURITY_DHCP)
                     != eHAL_STATUS_SUCCESS)
@@ -6258,6 +6463,8 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
             else
                 pSession->connectState = eCSR_ASSOC_STATE_TYPE_WDS_DISCONNECTED;
 
+            roamInfo.staId = (uint8_t)pSmeStartBssRsp->staId;
+
             if (CSR_IS_NDI(pProfile)) {
                 csrRoamStateChange(pMac, eCSR_ROAMING_STATE_JOINED, sessionId);
                 pSirBssDesc = &pSmeStartBssRsp->bssDescription;
@@ -6391,9 +6598,6 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
                                         &roamStatus, &roamResult, &roamInfo);
                 }
 
-                //Only tell upper layer is we start the BSS because Vista doesn't like multiple connection
-                //indications. If we don't start the BSS ourself, handler of eSIR_SME_JOINED_NEW_BSS will
-                //trigger the connection start indication in Vista
                 roamInfo.statusCode = pSession->joinFailStatusCode.statusCode;
                 roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
                 //We start the IBSS (didn't find any matched IBSS out there)
@@ -6413,29 +6617,26 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
                 }
 
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-                if (pMac->roam.configParam.cc_switch_mode
-                                        != VOS_MCC_TO_SCC_SWITCH_DISABLE) {
-                    pSession->connectedProfile.HTProfile.phymode =
-                            csrRoamdot11modeToPhymode(pSmeStartBssRsp->HTProfile.dot11mode);
-                    pSession->connectedProfile.HTProfile.htCapability =
-                            pSmeStartBssRsp->HTProfile.htCapability;
-                    pSession->connectedProfile.HTProfile.htSupportedChannelWidthSet =
-                            pSmeStartBssRsp->HTProfile.htSupportedChannelWidthSet;
-                    pSession->connectedProfile.HTProfile.htRecommendedTxWidthSet =
-                            pSmeStartBssRsp->HTProfile.htRecommendedTxWidthSet;
-                    pSession->connectedProfile.HTProfile.htSecondaryChannelOffset =
-                            pSmeStartBssRsp->HTProfile.htSecondaryChannelOffset;
+                pSession->connectedProfile.HTProfile.phymode =
+                        csrRoamdot11modeToPhymode(pSmeStartBssRsp->HTProfile.dot11mode);
+                pSession->connectedProfile.HTProfile.htCapability =
+                        pSmeStartBssRsp->HTProfile.htCapability;
+                pSession->connectedProfile.HTProfile.htSupportedChannelWidthSet =
+                        pSmeStartBssRsp->HTProfile.htSupportedChannelWidthSet;
+                pSession->connectedProfile.HTProfile.htRecommendedTxWidthSet =
+                        pSmeStartBssRsp->HTProfile.htRecommendedTxWidthSet;
+                pSession->connectedProfile.HTProfile.htSecondaryChannelOffset =
+                        pSmeStartBssRsp->HTProfile.htSecondaryChannelOffset;
 #ifdef WLAN_FEATURE_11AC
-                    pSession->connectedProfile.HTProfile.vhtCapability =
-                                pSmeStartBssRsp->HTProfile.vhtCapability;
-                    pSession->connectedProfile.HTProfile.vhtTxChannelWidthSet =
-                                pSmeStartBssRsp->HTProfile.vhtTxChannelWidthSet;
-                    pSession->connectedProfile.HTProfile.apCenterChan =
-                                pSmeStartBssRsp->HTProfile.apCenterChan;
-                    pSession->connectedProfile.HTProfile.apChanWidth =
-                                pSmeStartBssRsp->HTProfile.apChanWidth;
+                pSession->connectedProfile.HTProfile.vhtCapability =
+                            pSmeStartBssRsp->HTProfile.vhtCapability;
+                pSession->connectedProfile.HTProfile.vhtTxChannelWidthSet =
+                            pSmeStartBssRsp->HTProfile.vhtTxChannelWidthSet;
+                pSession->connectedProfile.HTProfile.apCenterChan =
+                            pSmeStartBssRsp->HTProfile.apCenterChan;
+                pSession->connectedProfile.HTProfile.apChanWidth =
+                            pSmeStartBssRsp->HTProfile.apChanWidth;
 #endif
-                }
 #endif
                 csrRoamCallCallback( pMac, sessionId, &roamInfo, pCommand->u.roamCmd.roamId, roamStatus, roamResult );
             }
@@ -6545,6 +6746,7 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
             sme_QosCsrEventInd(pMac, (tANI_U8)sessionId, SME_QOS_CSR_REASSOC_FAILURE, NULL);
 #endif
+            break;
         case eCsrJoinWdsFailure:
             smsLog(pMac, LOGW, FL("failed to join WDS"));
             csrFreeConnectBssDesc(pMac, sessionId);
@@ -6585,6 +6787,10 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
             smsLog(pMac, LOGW, FL("receives no association indication"));
             smsLog(pMac, LOG1, FL("Assoc ref count %d"),
                    pSession->bRefAssocStartCnt);
+#ifdef WLAN_FEATURE_FILS_SK
+            smsLog(pMac, LOG1, FL("isFILS %hu seq num %hu"),pSession->is_fils_connection,
+                                                              pSession->fils_seq_num);
+#endif
             if( CSR_IS_INFRASTRUCTURE( &pSession->connectedProfile ) ||
                 CSR_IS_ROAM_SUBSTATE_STOP_BSS_REQ( pMac, sessionId ) )
             {
@@ -6595,6 +6801,14 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
                 csrSetDefaultDot11Mode( pMac );
             }
 
+            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
+#ifdef WLAN_FEATURE_FILS_SK
+            /* Copy FILS sequence number used to be updated to userspace */
+            if (pSession->is_fils_connection) {
+                roamInfo.is_fils_connection = true;
+                roamInfo.fils_seq_num = pSession->fils_seq_num;
+            }
+#endif
             switch( pCommand->u.roamCmd.roamReason )
             {
                 // If this transition is because of an 802.11 OID, then we transition
@@ -6605,7 +6819,6 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
                 case eCsrHddIssued:
                 case eCsrSmeIssuedDisassocForHandoff:
                     csrRoamStateChange( pMac, eCSR_ROAMING_STATE_IDLE, sessionId );
-                    vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
                     roamInfo.pBssDesc = pCommand->u.roamCmd.pLastRoamBss;
                     roamInfo.pProfile = &pCommand->u.roamCmd.roamProfile;
                     roamInfo.statusCode = pSession->joinFailStatusCode.statusCode;
@@ -6727,22 +6940,36 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
                 case eCsrForcedDisassocSta:
                 case eCsrForcedDeauthSta:
                    csrRoamStateChange( pMac, eCSR_ROAMING_STATE_JOINED, sessionId);
-                   if( CSR_IS_SESSION_VALID(pMac, sessionId) )
+                   pSession = CSR_GET_SESSION(pMac, sessionId);
+                   if(pSession)
                    {
-                       pSession = CSR_GET_SESSION(pMac, sessionId);
-
-                       if ( CSR_IS_INFRA_AP(&pSession->connectedProfile) )
-                       {
-                           roamInfo.u.pConnectedProfile = &pSession->connectedProfile;
-                           vos_mem_copy(roamInfo.peerMac,
+                      if( CSR_IS_SESSION_VALID(pMac, sessionId) )
+                      {
+                          if ( CSR_IS_INFRA_AP(&pSession->connectedProfile) )
+                          {
+                               roamInfo.u.pConnectedProfile =
+                                                   &pSession->connectedProfile;
+                               vos_mem_copy(roamInfo.peerMac,
                                         pCommand->u.roamCmd.peerMac,
                                         sizeof(tSirMacAddr));
-                           roamInfo.reasonCode = eCSR_ROAM_RESULT_FORCED;
-                           roamInfo.statusCode = eSIR_SME_SUCCESS;
-                           status = csrRoamCallCallback(pMac, sessionId,
+                               roamInfo.reasonCode = eCSR_ROAM_RESULT_FORCED;
+                               roamInfo.statusCode = eSIR_SME_SUCCESS;
+                               status = csrRoamCallCallback(pMac, sessionId,
                                        &roamInfo, pCommand->u.roamCmd.roamId,
                                        eCSR_ROAM_LOSTLINK, eCSR_ROAM_RESULT_FORCED);
-                       }
+                          }
+                      }
+                      else
+                      {
+                          smsLog(pMac, LOGE, FL("Inactive sessionId %d"),
+                                             sessionId);
+                          return eHAL_STATUS_FAILURE;
+                      }
+                   }
+                   else
+                   {
+                       smsLog(pMac, LOGE, FL("Invalid session"));
+                       return eHAL_STATUS_FAILURE;
                    }
                    break;
                 case eCsrLostLink1:
@@ -6767,6 +6994,40 @@ static tANI_BOOLEAN csrRoamProcessResults( tpAniSirGlobal pMac, tSmeCmd *pComman
     return ( fReleaseCommand );
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+/*
+ * update_profile_fils_info: API to update FILS info from
+ * source profile to destination profile.
+ * @des_profile: pointer to destination profile
+ * @src_profile: pointer to souce profile
+ *
+ * Return: None
+ */
+static inline void update_profile_fils_info(tCsrRoamProfile *des_profile,
+                                        tCsrRoamProfile *src_profile)
+{
+    if (!src_profile->fils_con_info)
+        return;
+
+    if (src_profile->fils_con_info->is_fils_connection) {
+        des_profile->fils_con_info =
+            vos_mem_malloc(sizeof(struct cds_fils_connection_info));
+            if (!des_profile->fils_con_info) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                    FL("failed to allocate memory"));
+                return;
+            }
+            vos_mem_copy(des_profile->fils_con_info,
+                src_profile->fils_con_info,
+                sizeof(struct cds_fils_connection_info));
+    }
+}
+#else
+static inline void update_profile_fils_info(tCsrRoamProfile *des_profile,
+                                        tCsrRoamProfile *src_profile)
+{ }
+#endif
+
 eHalStatus csrRoamCopyProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pDstProfile, tCsrRoamProfile *pSrcProfile)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -6949,6 +7210,8 @@ eHalStatus csrRoamCopyProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pDstProfile,
         pDstProfile->ieee80211d        = pSrcProfile->ieee80211d;
         pDstProfile->sap_dot11mc        = pSrcProfile->sap_dot11mc;
         pDstProfile->do_not_roam       = pSrcProfile->do_not_roam;
+        pDstProfile->force_24ghz_in_ht20 =
+                       pSrcProfile->force_24ghz_in_ht20;
         vos_mem_copy(&pDstProfile->Keys, &pSrcProfile->Keys,
                      sizeof(pDstProfile->Keys));
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -6961,7 +7224,7 @@ eHalStatus csrRoamCopyProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pDstProfile,
         vos_mem_copy(&pDstProfile->addIeParams,
                      &pSrcProfile->addIeParams,
                      sizeof(tSirAddIeParams));
-
+        update_profile_fils_info(pDstProfile, pSrcProfile);
         pDstProfile->beacon_tx_rate = pSrcProfile->beacon_tx_rate;
         if (pSrcProfile->supported_rates.numRates) {
             vos_mem_copy(pDstProfile->supported_rates.rate,
@@ -7327,6 +7590,22 @@ eHalStatus csrRoamConnectWithBSSList(tpAniSirGlobal pMac, tANI_U32 sessionId, tC
     return (status);
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * csr_is_fils_connection() - API to check if FILS connection
+ * @profile: CSR Roam Profile
+ *
+ * Return: true, if fils connection, false otherwise
+ */
+static bool csr_is_fils_connection(tCsrRoamProfile *profile)
+{
+    if (!profile->fils_con_info)
+        return false;
+
+    return profile->fils_con_info->is_fils_connection;
+}
+#endif
+
 eHalStatus csrRoamConnect(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
                           tScanResultHandle hBssListIn, tANI_U32 *pRoamId)
 {
@@ -7349,6 +7628,9 @@ eHalStatus csrRoamConnect(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfi
     }
     /* Initialize the bssid count before proceeding with the Join requests */
     pSession->join_bssid_count = 0;
+#ifdef WLAN_FEATURE_FILS_SK
+    pSession->is_fils_connection = csr_is_fils_connection(pProfile);
+#endif
     smsLog(pMac, LOG1, FL("called  BSSType = %s (%d) authtype = %d "
                                                     "encryType = %d"),
                 sme_bss_type_to_string(pProfile->BSSType),
@@ -8215,6 +8497,12 @@ static void csrRoamJoinRspProcessor( tpAniSirGlobal pMac, tSirSmeJoinRsp *pSmeJo
    {
        pCommand = GET_BASE_ADDR(pEntry, tSmeCmd, Link);
    }
+#ifdef WLAN_FEATURE_FILS_SK
+   /* Copy Sequence Number last used for FILS assoc failure case */
+   if (pSession->is_fils_connection)
+       pSession->fils_seq_num = pSmeJoinRsp->fils_seq_num;
+#endif
+
    if ( eSIR_SME_SUCCESS == pSmeJoinRsp->statusCode )
    {
             if(pCommand && eCsrSmeIssuedAssocToSimilarAP == pCommand->u.roamCmd.roamReason)
@@ -8708,8 +8996,11 @@ static void csrRoamingStateConfigCnfProcessor( tpAniSirGlobal pMac, tANI_U32 res
                         if (csrRoamIsHandoffInProgress(pMac, sessionId) &&
                                            csrRoamIs11rAssoc(pMac, sessionId))
                         {
-                            status = csrRoamIssueReassociate(pMac, sessionId, pBssDesc,
-                                    (tDot11fBeaconIEs *)( pScanResult->Result.pvIes ), &pCommand->u.roamCmd.roamProfile);
+                            status = csrRoamIssueReassociate(pMac,
+                                         sessionId,
+                                         pBssDesc,
+                                         pIesLocal,
+                                         &pCommand->u.roamCmd.roamProfile);
                         }
                         else
 #endif
@@ -8734,9 +9025,12 @@ static void csrRoamingStateConfigCnfProcessor( tpAniSirGlobal pMac, tANI_U32 res
                         // else we are not connected and attempting to Join.  Issue the
                         // Join request.
                         {
-                            status = csrRoamIssueJoin( pMac, sessionId, pBssDesc,
-                                                (tDot11fBeaconIEs *)( pScanResult->Result.pvIes ),
-                                                &pCommand->u.roamCmd.roamProfile, pCommand->u.roamCmd.roamId );
+                            status = csrRoamIssueJoin(pMac,
+                                         sessionId,
+                                         pBssDesc,
+                                         pIesLocal,
+                                         &pCommand->u.roamCmd.roamProfile,
+                                         pCommand->u.roamCmd.roamId );
                         }
                         if(!HAL_STATUS_SUCCESS(status))
                         {
@@ -8834,7 +9128,7 @@ static void csrRoamRoamingStateReassocRspProcessor( tpAniSirGlobal pMac, tpSirSm
         vos_flush_logs(WLAN_LOG_TYPE_FATAL,
                        WLAN_LOG_INDICATOR_HOST_DRIVER,
                        WLAN_LOG_REASON_ROAM_FAIL,
-                       true);
+                       DUMP_VOS_TRACE | DUMP_PACKET_TRACE);
 #if defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
     defined(FEATURE_WLAN_LFR)
         if ((eSIR_SME_FT_REASSOC_TIMEOUT_FAILURE == pSmeJoinRsp->statusCode) ||
@@ -8916,13 +9210,13 @@ void csrRoamRoamingStateDisassocRspProcessor( tpAniSirGlobal pMac, tSirSmeDisass
     tScanResultHandle hBSSList;
     tANI_BOOLEAN fCallCallback, fRemoveCmd;
     eHalStatus status;
-    tCsrRoamInfo roamInfo;
     tCsrScanResultFilter *pScanFilter = NULL;
     tANI_U32 roamId = 0;
     tCsrRoamProfile *pCurRoamProfile = NULL;
     tListElem *pEntry = NULL;
     tSmeCmd *pCommand = NULL;
 #endif
+    tCsrRoamInfo *roam_info;
     tANI_U32 sessionId;
     tCsrRoamSession *pSession;
     tpCsrNeighborRoamControlInfo pNeighborRoamInfo = NULL;
@@ -8935,6 +9229,10 @@ void csrRoamRoamingStateDisassocRspProcessor( tpAniSirGlobal pMac, tSirSmeDisass
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
     FL("csrRoamRoamingStateDisassocRspProcessor sessionId %d"), sessionId);
 
+    roam_info = vos_mem_malloc(sizeof(*roam_info));
+    if (!roam_info)
+        return;
+
     if ( csrIsConnStateInfra( pMac, sessionId ) )
     {
         pMac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED;
@@ -8944,6 +9242,7 @@ void csrRoamRoamingStateDisassocRspProcessor( tpAniSirGlobal pMac, tSirSmeDisass
     if(!pSession)
     {
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+        vos_mem_free(roam_info);
         return;
     }
 
@@ -9052,13 +9351,13 @@ void csrRoamRoamingStateDisassocRspProcessor( tpAniSirGlobal pMac, tSirSmeDisass
         }
 
         /* Notify HDD about handoff and provide the BSSID too */
-        roamInfo.reasonCode = eCsrRoamReasonBetterAP;
+        roam_info->reasonCode = eCsrRoamReasonBetterAP;
 
-        vos_mem_copy(roamInfo.bssid,
+        vos_mem_copy(roam_info->bssid,
                      pNeighborRoamInfo->csrNeighborRoamProfile.BSSIDs.bssid,
                      sizeof(tSirMacAddr));
 
-        csrRoamCallCallback(pMac,sessionId, &roamInfo, 0,
+        csrRoamCallCallback(pMac,sessionId, roam_info, 0,
             eCSR_ROAM_ROAMING_START, eCSR_ROAM_RESULT_NONE);
 
         /* Copy the connected profile to apply the same for this connection as well */
@@ -9085,6 +9384,7 @@ void csrRoamRoamingStateDisassocRspProcessor( tpAniSirGlobal pMac, tSirSmeDisass
             vos_mem_free(pCurRoamProfile);
             csrFreeScanFilter(pMac, pScanFilter);
             vos_mem_free(pScanFilter);
+            vos_mem_free(roam_info);
             return;
         }
 
@@ -9101,9 +9401,9 @@ POST_ROAM_FAILURE:
         csrRoamSynchCleanUp(pMac, sessionId);
 #endif
         /* Inform the upper layers that the reassoc failed */
-        vos_mem_zero(&roamInfo, sizeof(tCsrRoamInfo));
+        vos_mem_zero(roam_info, sizeof(*roam_info));
         csrRoamCallCallback(pMac, sessionId,
-                &roamInfo, 0, eCSR_ROAM_FT_REASSOC_FAILED, eSIR_SME_SUCCESS);
+                roam_info, 0, eCSR_ROAM_FT_REASSOC_FAILED, eSIR_SME_SUCCESS);
 
         /*
          * Issue a disassoc request so that PE/LIM uses this to clean-up the FT session.
@@ -9153,6 +9453,7 @@ POST_ROAM_FAILURE:
         //We are not done yet. Get the data and continue roaming
         csrRoamReissueRoamCommand(pMac);
     }
+    vos_mem_free(roam_info);
 }
 
 static void csrRoamRoamingStateDeauthRspProcessor( tpAniSirGlobal pMac, tSirSmeDeauthRsp *pSmeRsp )
@@ -9387,6 +9688,19 @@ void csrRoamJoinedStateMsgProcessor( tpAniSirGlobal pMac, void *pMsgBuf )
             pRoamInfo->timingMeasCap = pUpperLayerAssocCnf->timingMeasCap;
             vos_mem_copy(&pRoamInfo->chan_info, &pUpperLayerAssocCnf->chan_info,
                                                        sizeof(tSirSmeChanInfo));
+            pRoamInfo->ecsa_capable = pUpperLayerAssocCnf->ecsa_capable;
+            pRoamInfo->ampdu = pUpperLayerAssocCnf->ampdu;
+            pRoamInfo->sgi_enable = pUpperLayerAssocCnf->sgi_enable;
+            pRoamInfo->tx_stbc = pUpperLayerAssocCnf->tx_stbc;
+            pRoamInfo->tx_stbc = pUpperLayerAssocCnf->rx_stbc;
+            pRoamInfo->ch_width = pUpperLayerAssocCnf->ch_width;
+            pRoamInfo->mode = pUpperLayerAssocCnf->mode;
+            pRoamInfo->max_supp_idx = pUpperLayerAssocCnf->max_supp_idx;
+            pRoamInfo->max_ext_idx = pUpperLayerAssocCnf->max_ext_idx;
+            pRoamInfo->max_mcs_idx = pUpperLayerAssocCnf->max_mcs_idx;
+            pRoamInfo->rx_mcs_map = pUpperLayerAssocCnf->rx_mcs_map;
+            pRoamInfo->tx_mcs_map = pUpperLayerAssocCnf->tx_mcs_map;
+
             if(CSR_IS_INFRA_AP(pRoamInfo->u.pConnectedProfile) )
             {
                 pMac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED;
@@ -9876,6 +10190,68 @@ eHalStatus csrRoamSetKey( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamSetKe
     return ( status );
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+/*
+ * csr_create_fils_realm_hash: API to create hash using realm
+ * @fils_con_info: fils connection info obtained from supplicant
+ * @tmp_hash: pointer to new hash
+ *
+ * Return: None
+ */
+static bool
+csr_create_fils_realm_hash(struct cds_fils_connection_info *fils_con_info,
+               uint8_t *tmp_hash)
+{
+    uint8_t hash[SHA256_DIGEST_SIZE] = {0};
+    uint8_t *data[1];
+
+    if (!fils_con_info->realm_len)
+        return false;
+
+    data[0] = fils_con_info->realm;
+
+    if (alloc_tfm(SHA256_CRYPTO_TYPE))
+    {
+        qdf_get_hash(SHA256_CRYPTO_TYPE, 1, data,
+                &fils_con_info->realm_len, hash);
+        vos_trace_hex_dump(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_DEBUG,
+                hash, SHA256_DIGEST_SIZE);
+        vos_mem_copy(tmp_hash, hash, 2);
+        return true;
+    } else
+        return false;
+}
+
+/*
+ * csr_update_fils_scan_filter: update scan filter in case of fils session
+ * @scan_fltr: pointer to scan filer
+ * @profile: csr profile pointer
+ *
+ * Return: None
+ */
+static void csr_update_fils_scan_filter(tCsrScanResultFilter *scan_fltr,
+                tCsrRoamProfile *profile)
+{
+    if (profile->fils_con_info &&
+        profile->fils_con_info->is_fils_connection) {
+        uint8_t realm_hash[2];
+
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+             FL("creating realm based on fils info %d"),
+            profile->fils_con_info->is_fils_connection);
+        scan_fltr->realm_check =  csr_create_fils_realm_hash(
+                profile->fils_con_info, realm_hash);
+        memcpy(scan_fltr->fils_realm, realm_hash,
+            sizeof(uint8_t) * 2);
+    }
+}
+#else
+static void csr_update_fils_scan_filter(tCsrScanResultFilter *scan_fltr,
+                tCsrRoamProfile *profile)
+{ }
+#endif
+
+
 /*
    Prepare a filter base on a profile for parsing the scan results.
    Upon successful return, caller MUST call csrFreeScanFilter on
@@ -9989,7 +10365,7 @@ eHalStatus csrRoamPrepareFilterFromProfile(tpAniSirGlobal pMac, tCsrRoamProfile
                  {
                          smsLog(pMac, LOG1, FL("process a channel (%d) that is invalid"), pProfile->ChannelInfo.ChannelList[index]);
                  }
-            }
+              }
             }
             else
             {
@@ -10043,6 +10419,8 @@ eHalStatus csrRoamPrepareFilterFromProfile(tpAniSirGlobal pMac, tCsrRoamProfile
             pScanFilter->MDID.mobilityDomain = pProfile->MDID.mobilityDomain;
         }
 #endif
+        vos_mem_copy(pScanFilter->bssid_hint,
+            pProfile->bssid_hint, VOS_MAC_ADDR_SIZE);
 
 #ifdef WLAN_FEATURE_11W
         // Management Frame Protection
@@ -10050,7 +10428,7 @@ eHalStatus csrRoamPrepareFilterFromProfile(tpAniSirGlobal pMac, tCsrRoamProfile
         pScanFilter->MFPRequired = pProfile->MFPRequired;
         pScanFilter->MFPCapable = pProfile->MFPCapable;
 #endif
-
+        csr_update_fils_scan_filter(pScanFilter, pProfile);
     }while(0);
 
     if(!HAL_STATUS_SUCCESS(status))
@@ -10304,9 +10682,12 @@ eHalStatus csrSendResetApCapsChanged(tpAniSirGlobal pMac, tSirMacAddr *bssId)
 
 void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
 {
+
+    tCsrRoamInfo *pRoamInfo = NULL;
     tSirSmeAssocInd *pAssocInd;
     tSirSmeDisassocInd *pDisassocInd;
     tSirSmeDeauthInd *pDeauthInd;
+    tSirSmeDisConDoneInd *pDisConDoneInd;
     tSirSmeWmStatusChangeNtf *pStatusChangeMsg;
     tSirSmeNewBssInfo *pNewBss;
     tSmeIbssPeerInd *pIbssPeerInd;
@@ -10314,20 +10695,24 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
     tSirSmeApNewCaps *pApNewCaps;
     eCsrRoamResult result = eCSR_ROAM_RESULT_NONE;
     eRoamCmdStatus roamStatus = eCSR_ROAM_FAILED;
-    tCsrRoamInfo *pRoamInfo = NULL;
-    tCsrRoamInfo roamInfo;
     eHalStatus status;
     tANI_U32 sessionId = CSR_SESSION_ID_INVALID;
     tCsrRoamSession *pSession = NULL;
     tpSirSmeSwitchChannelInd pSwitchChnInd;
     tSmeMaxAssocInd *pSmeMaxAssocInd;
-    tSmeCmd pCommand;
-    vos_mem_set(&roamInfo, sizeof(roamInfo), 0);
+    tSmeCmd *pCommand = NULL;
 
     if (NULL == pSirMsg)
     {   smsLog(pMac, LOGE, FL("pSirMsg is NULL"));
         return;
     }
+
+    pRoamInfo = vos_mem_malloc(sizeof(tCsrRoamInfo));
+    if (!pRoamInfo) {
+        smsLog(pMac, LOGE, FL("pRoamInfo alloc failed"));
+        return;
+    }
+    vos_mem_set(pRoamInfo, sizeof(tCsrRoamInfo), 0);
     switch( pSirMsg->messageType )
     {
         case eWNI_SME_ASSOC_IND:
@@ -10343,11 +10728,12 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                     if(!pSession)
                     {
                         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                        if (pRoamInfo)
+                            vos_mem_free(pRoamInfo);
+
                         return;
                     }
 
-                pRoamInfo = &roamInfo;
-
                 // Required for indicating the frames to upper layer
                 pRoamInfo->assocReqLength = pAssocInd->assocReqLength;
                 pRoamInfo->assocReqPtr = pAssocInd->assocReqPtr;
@@ -10373,6 +10759,7 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                                  sizeof(tCsrBssid));
                     pRoamInfo->wmmEnabledSta = pAssocInd->wmmEnabledSta;
                     pRoamInfo->timingMeasCap = pAssocInd->timingMeasCap;
+                    pRoamInfo->ecsa_capable = pAssocInd->ecsa_capable;
                     vos_mem_copy(&pRoamInfo->chan_info, &pAssocInd->chan_info,
                                  sizeof(tSirSmeChanInfo));
                     if(CSR_IS_WDS_AP( pRoamInfo->u.pConnectedProfile))
@@ -10457,6 +10844,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                 if(!pSession)
                 {
                     smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                    if (pRoamInfo)
+                        vos_mem_free(pRoamInfo);
                     return;
                 }
 
@@ -10471,33 +10860,26 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                 csrRoamIssueWmStatusChange( pMac, sessionId, eCsrDisassociated, pSirMsg );
                 if(CSR_IS_INFRA_AP(&pSession->connectedProfile))
                 {
-
-                    pRoamInfo = &roamInfo;
-
-                    pRoamInfo->statusCode = pDisassocInd->statusCode;
-                    pRoamInfo->reasonCode = pDisassocInd->reasonCode;
-                    pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
-
-                    pRoamInfo->staId = (tANI_U8)pDisassocInd->staId;
-
-                    vos_mem_copy(pRoamInfo->peerMac, pDisassocInd->peerMacAddr,
-                                 sizeof(tSirMacAddr));
-                    vos_mem_copy(&pRoamInfo->bssid, pDisassocInd->bssId,
-                                 sizeof(tCsrBssid));
-
-                    status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_DISASSOC_IND);
-
+                    pCommand = vos_mem_malloc(sizeof(tSmeCmd));
+                    if (!pCommand)
+                    {
+                        smsLog(pMac, LOGE, FL("cannot allocate memory"));
+                        return;
+                    }
+                    vos_mem_set(pCommand, sizeof(tSmeCmd), 0);
                     /*
                     *  STA/P2P client got  disassociated so remove any pending deauth
                     *  commands in sme pending list
                     */
-                    pCommand.command = eSmeCommandRoam;
-                    pCommand.sessionId = (tANI_U8)sessionId;
-                    pCommand.u.roamCmd.roamReason = eCsrForcedDeauthSta;
-                    vos_mem_copy(pCommand.u.roamCmd.peerMac,
+                    pCommand->command = eSmeCommandRoam;
+                    pCommand->sessionId = (tANI_U8)sessionId;
+                    pCommand->u.roamCmd.roamReason = eCsrForcedDeauthSta;
+                    vos_mem_copy(pCommand->u.roamCmd.peerMac,
                                  pDisassocInd->peerMacAddr,
                                  sizeof(tSirMacAddr));
-                    csrRoamRemoveDuplicateCommand(pMac, sessionId, &pCommand, eCsrForcedDeauthSta);
+                    csrRoamRemoveDuplicateCommand(pMac, sessionId, pCommand, eCsrForcedDeauthSta);
+                    vos_mem_free(pCommand);
+                    pCommand = NULL;
                 }
             }
             else
@@ -10542,6 +10924,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                 if(!pSession)
                 {
                     smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                    if (pRoamInfo)
+                        vos_mem_free(pRoamInfo);
                     return;
                 }
 
@@ -10554,27 +10938,40 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
 #endif
                 csrRoamLinkDown(pMac, sessionId);
                 csrRoamIssueWmStatusChange( pMac, sessionId, eCsrDeauthenticated, pSirMsg );
-                if(CSR_IS_INFRA_AP(&pSession->connectedProfile))
-                {
-
-                    pRoamInfo = &roamInfo;
-
-                    pRoamInfo->statusCode = pDeauthInd->statusCode;
-                    pRoamInfo->reasonCode = pDeauthInd->reasonCode;
-                    pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
-
-                    pRoamInfo->staId = (tANI_U8)pDeauthInd->staId;
-
-                    vos_mem_copy(pRoamInfo->peerMac, pDeauthInd->peerMacAddr,
-                                 sizeof(tSirMacAddr));
-                    vos_mem_copy(&pRoamInfo->bssid, pDeauthInd->bssId,
-                                 sizeof(tCsrBssid));
-
-                    status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_DEAUTH_IND);
-                }
             }
             break;
 
+        case eWNI_SME_DISCONNECT_DONE_IND:
+            pDisConDoneInd = (tSirSmeDisConDoneInd *)(pSirMsg);
+            smsLog( pMac, LOG1,
+                    FL("eWNI_SME_DISCONNECT_DONE_IND RC:%d"),
+                        pDisConDoneInd->reasonCode);
+            if (CSR_IS_SESSION_VALID(pMac, pDisConDoneInd->sessionId))
+            {
+                pRoamInfo->reasonCode = pDisConDoneInd->reasonCode;
+                pRoamInfo->statusCode = eSIR_SME_STA_DISASSOCIATED;
+                vos_mem_copy(pRoamInfo->peerMac, pDisConDoneInd->peerMacAddr,
+                             sizeof(tSirMacAddr));
+                status = csrRoamCallCallback(pMac,
+                                             pDisConDoneInd->sessionId,
+                                             pRoamInfo, 0,
+                                             eCSR_ROAM_LOSTLINK,
+                                             eCSR_ROAM_RESULT_DISASSOC_IND);
+                pSession = CSR_GET_SESSION(pMac,
+                                 pDisConDoneInd->sessionId);
+                if (pSession &&
+                   !CSR_IS_INFRA_AP(&pSession->connectedProfile))
+                      csrRoamStateChange(pMac,
+                               eCSR_ROAMING_STATE_IDLE,
+                               pDisConDoneInd->sessionId);
+           }
+           else
+           {
+               smsLog(pMac, LOGE, FL("Inactive session %d"),
+                                    pDisConDoneInd->sessionId);
+           }
+           break;
+
         case eWNI_SME_SWITCH_CHL_REQ:        // in case of STA, the SWITCH_CHANNEL originates from its AP
             smsLog( pMac, LOGW, FL("eWNI_SME_SWITCH_CHL_REQ from SME"));
             pSwitchChnInd = (tpSirSmeSwitchChannelInd)pSirMsg;
@@ -10587,6 +10984,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                 if(!pSession)
                 {
                     smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                    if (pRoamInfo)
+                        vos_mem_free(pRoamInfo);
                     return;
                 }
                 pSession->connectedProfile.operationChannel = (tANI_U8)pSwitchChnInd->newChannelId;
@@ -10607,7 +11006,6 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                     pSession = CSR_GET_SESSION(pMac, sessionId);
                     if ( CSR_IS_INFRA_AP(&pSession->connectedProfile) )
                     {
-                        pRoamInfo = &roamInfo;
                         pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
                         vos_mem_copy(pRoamInfo->peerMac, pDeauthRsp->peerMacAddr,
                                      sizeof(tSirMacAddr));
@@ -10630,7 +11028,6 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                     pSession = CSR_GET_SESSION(pMac, sessionId);
                     if ( CSR_IS_INFRA_AP(&pSession->connectedProfile) )
                     {
-                        pRoamInfo = &roamInfo;
                         pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
                         vos_mem_copy(pRoamInfo->peerMac, pDisassocRsp->peerMacAddr,
                                      sizeof(tSirMacAddr));
@@ -10649,9 +11046,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                 status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pMicInd->bssId, &sessionId );
                 if( HAL_STATUS_SUCCESS( status ) )
                 {
-                    vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
-                    roamInfo.u.pMICFailureInfo = &pMicInd->info;
-                    pRoamInfo = &roamInfo;
+                    vos_mem_set(pRoamInfo, sizeof(tCsrRoamInfo), 0);
+                    pRoamInfo->u.pMICFailureInfo = &pMicInd->info;
                     if(pMicInd->info.multicast)
                     {
                         result = eCSR_ROAM_RESULT_MIC_ERROR_GROUP;
@@ -10670,6 +11066,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                     if(!pSession)
                     {
                         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                        if (pRoamInfo)
+                            vos_mem_free(pRoamInfo);
                         return;
                     }
 
@@ -10696,9 +11094,11 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                 status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pProbeReqInd->bssId, &sessionId );
                 if( HAL_STATUS_SUCCESS( status ) )
                 {
-                    vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
-                    roamInfo.u.pWPSPBCProbeReq = &pProbeReqInd->WPSPBCProbeReq;
-                    csrRoamCallCallback(pMac, sessionId, &roamInfo, 0, eCSR_ROAM_WPS_PBC_PROBE_REQ_IND,
+                    vos_mem_set(pRoamInfo, sizeof(tCsrRoamInfo), 0);
+                    pRoamInfo->u.pWPSPBCProbeReq =
+                        &pProbeReqInd->WPSPBCProbeReq;
+                    csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0,
+                        eCSR_ROAM_WPS_PBC_PROBE_REQ_IND,
                         eCSR_ROAM_RESULT_WPS_PBC_PROBE_REQ_IND);
                 }
             }
@@ -10716,16 +11116,18 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                         if(!pSession)
                         {
                             smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                            if (pRoamInfo)
+                                vos_mem_free(pRoamInfo);
                             return;
                         }
                         pSession->connectState = eCSR_ASSOC_STATE_TYPE_IBSS_CONNECTED;
                         if(pSession->pConnectBssDesc)
                         {
-                            vos_mem_copy(&roamInfo.bssid,
+                            vos_mem_copy(&pRoamInfo->bssid,
                                          pSession->pConnectBssDesc->bssId,
                                          sizeof(tCsrBssid));
-                            roamInfo.u.pConnectedProfile = &pSession->connectedProfile;
-                            pRoamInfo = &roamInfo;
+                            pRoamInfo->u.pConnectedProfile =
+                                    &pSession->connectedProfile;
                         }
                         else
                         {
@@ -10743,6 +11145,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                         if(!pSession)
                         {
                             smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                            if (pRoamInfo)
+                                vos_mem_free(pRoamInfo);
                             return;
                         }
                         pSession->connectState = eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED;
@@ -10758,6 +11162,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                         if(!pSession)
                         {
                             smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                            if (pRoamInfo)
+                                vos_mem_free(pRoamInfo);
                             return;
                         }
                         // update the connection state information
@@ -10802,9 +11208,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                         }
                         result = eCSR_ROAM_RESULT_IBSS_COALESCED;
                         roamStatus = eCSR_ROAM_IBSS_IND;
-                        vos_mem_copy(&roamInfo.bssid, &pNewBss->bssId,
+                        vos_mem_copy(&pRoamInfo->bssid, &pNewBss->bssId,
                                      sizeof(tCsrBssid));
-                        pRoamInfo = &roamInfo;
                         /* This BSSID is the real BSSID, let's save it */
                         if(pSession->pConnectBssDesc)
                         {
@@ -10821,11 +11226,12 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                     status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pApNewCaps->bssId, &sessionId );
                     if( HAL_STATUS_SUCCESS( status ) )
                     {
-                        if ((eCSR_ROAMING_STATE_JOINED == pMac->roam.curState[sessionId]) &&
+                        if (((eCSR_ROAMING_STATE_JOINED == pMac->roam.curState[sessionId]) &&
                                 ((eCSR_ROAM_SUBSTATE_JOINED_REALTIME_TRAFFIC == pMac->roam.curSubState[sessionId]) ||
                                  (eCSR_ROAM_SUBSTATE_NONE == pMac->roam.curSubState[sessionId]) ||
                                  (eCSR_ROAM_SUBSTATE_JOINED_NON_REALTIME_TRAFFIC == pMac->roam.curSubState[sessionId]) ||
-                                 (eCSR_ROAM_SUBSTATE_JOINED_NO_TRAFFIC == pMac->roam.curSubState[sessionId]))
+                                 (eCSR_ROAM_SUBSTATE_JOINED_NO_TRAFFIC == pMac->roam.curSubState[sessionId]))) ||
+                            (eCSR_ROAMING_STATE_SCANNING == pMac->roam.curState[sessionId])
                            )
                         {
                             smsLog(pMac, LOGW, "Calling csrRoamDisconnectInternal");
@@ -10881,64 +11287,59 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                 if(!pSession)
                 {
                     smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                    if (pRoamInfo)
+                        vos_mem_free(pRoamInfo);
                     return;
                 }
             // Issue the set Context request to LIM to establish the Unicast STA context for the new peer...
                 if(pSession->pConnectBssDesc)
                 {
-                    vos_mem_copy(&roamInfo.peerMac, pIbssPeerInd->peerAddr,
+                    vos_mem_copy(&pRoamInfo->peerMac, pIbssPeerInd->peerAddr,
                                  sizeof(tCsrBssid));
-                    vos_mem_copy(&roamInfo.bssid, pSession->pConnectBssDesc->bssId,
+                    vos_mem_copy(&pRoamInfo->bssid,
+                                 pSession->pConnectBssDesc->bssId,
                                  sizeof(tCsrBssid));
                     if(pIbssPeerInd->mesgLen > sizeof(tSmeIbssPeerInd))
                     {
-                        roamInfo.pbFrames = vos_mem_malloc((pIbssPeerInd->mesgLen
-                                                    - sizeof(tSmeIbssPeerInd)));
-                        if ( NULL == roamInfo.pbFrames )
+                        pRoamInfo->pbFrames =
+                                vos_mem_malloc((pIbssPeerInd->mesgLen -
+                                                sizeof(tSmeIbssPeerInd)));
+                        if (NULL == pRoamInfo->pbFrames)
                             status = eHAL_STATUS_FAILURE;
                         else
                             status = eHAL_STATUS_SUCCESS;
                         if (HAL_STATUS_SUCCESS(status))
                         {
-                            roamInfo.nBeaconLength = (pIbssPeerInd->mesgLen - sizeof(tSmeIbssPeerInd));
-                            vos_mem_copy(roamInfo.pbFrames,
+                            pRoamInfo->nBeaconLength =
+                                    (pIbssPeerInd->mesgLen -
+                                     sizeof(tSmeIbssPeerInd));
+                            vos_mem_copy(pRoamInfo->pbFrames,
                                         ((tANI_U8 *)pIbssPeerInd) + sizeof(tSmeIbssPeerInd),
-                                         roamInfo.nBeaconLength);
+                                         pRoamInfo->nBeaconLength);
                         }
-                        roamInfo.staId = (tANI_U8)pIbssPeerInd->staId;
-                        roamInfo.ucastSig = (tANI_U8)pIbssPeerInd->ucastSig;
-                        roamInfo.bcastSig = (tANI_U8)pIbssPeerInd->bcastSig;
-                        roamInfo.pBssDesc = vos_mem_malloc(pSession->pConnectBssDesc->length);
-                        if ( NULL == roamInfo.pBssDesc )
+                        pRoamInfo->staId = (tANI_U8)pIbssPeerInd->staId;
+                        pRoamInfo->ucastSig = (tANI_U8)pIbssPeerInd->ucastSig;
+                        pRoamInfo->bcastSig = (tANI_U8)pIbssPeerInd->bcastSig;
+                        pRoamInfo->pBssDesc =
+                            vos_mem_malloc(pSession->pConnectBssDesc->length);
+                        if (NULL == pRoamInfo->pBssDesc)
                             status = eHAL_STATUS_FAILURE;
                         else
                             status = eHAL_STATUS_SUCCESS;
                         if (HAL_STATUS_SUCCESS(status))
                         {
-                            vos_mem_copy(roamInfo.pBssDesc,
+                            vos_mem_copy(pRoamInfo->pBssDesc,
                                          pSession->pConnectBssDesc,
                                          pSession->pConnectBssDesc->length);
                         }
-                        if(HAL_STATUS_SUCCESS(status))
-                        {
-                            pRoamInfo = &roamInfo;
-                        }
-                        else
+                        if(!HAL_STATUS_SUCCESS(status))
                         {
-                            if(roamInfo.pbFrames)
-                            {
-                                vos_mem_free(roamInfo.pbFrames);
-                            }
-                            if(roamInfo.pBssDesc)
-                            {
-                                vos_mem_free(roamInfo.pBssDesc);
-                            }
+                            if(pRoamInfo->pbFrames)
+                                vos_mem_free(pRoamInfo->pbFrames);
+                            if(pRoamInfo->pBssDesc)
+                                vos_mem_free(pRoamInfo->pBssDesc);
                         }
                     }
-                    else
-                    {
-                        pRoamInfo = &roamInfo;
-                    }
                     if ((eCSR_ENCRYPT_TYPE_NONE ==
                               pSession->connectedProfile.EncryptionType ))
                     {
@@ -10962,14 +11363,10 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                             eCSR_ROAM_CONNECT_STATUS_UPDATE, eCSR_ROAM_RESULT_IBSS_NEW_PEER);
                 if(pRoamInfo)
                 {
-                    if(roamInfo.pbFrames)
-                    {
-                        vos_mem_free(roamInfo.pbFrames);
-                    }
-                    if(roamInfo.pBssDesc)
-                    {
-                        vos_mem_free(roamInfo.pBssDesc);
-                    }
+                    if(pRoamInfo->pbFrames)
+                        vos_mem_free(pRoamInfo->pbFrames);
+                    if(pRoamInfo->pBssDesc)
+                        vos_mem_free(pRoamInfo->pBssDesc);
                 }
             }
             break;
@@ -10996,12 +11393,12 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                 }
 #endif //FEATURE_WLAN_DIAG_SUPPORT_CSR
                 smsLog(pMac, LOGW, "CSR: Peer departed notification from LIM");
-                roamInfo.staId = (tANI_U8)pIbssPeerInd->staId;
-                roamInfo.ucastSig = (tANI_U8)pIbssPeerInd->ucastSig;
-                roamInfo.bcastSig = (tANI_U8)pIbssPeerInd->bcastSig;
-                vos_mem_copy(&roamInfo.peerMac, pIbssPeerInd->peerAddr,
+                pRoamInfo->staId = (tANI_U8)pIbssPeerInd->staId;
+                pRoamInfo->ucastSig = (tANI_U8)pIbssPeerInd->ucastSig;
+                pRoamInfo->bcastSig = (tANI_U8)pIbssPeerInd->bcastSig;
+                vos_mem_copy(&pRoamInfo->peerMac, pIbssPeerInd->peerAddr,
                              sizeof(tCsrBssid));
-                csrRoamCallCallback(pMac, sessionId, &roamInfo, 0,
+                csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0,
                         eCSR_ROAM_CONNECT_STATUS_UPDATE, eCSR_ROAM_RESULT_IBSS_PEER_DEPARTED);
             }
             break;
@@ -11023,6 +11420,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                         if(!pSession)
                         {
                             smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                            if (pRoamInfo)
+                                vos_mem_free(pRoamInfo);
                             return;
                         }
 
@@ -11073,7 +11472,7 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                         }
                         if( eSIR_SME_SUCCESS == pRsp->statusCode )
                         {
-                            vos_mem_copy(&roamInfo.peerMac,
+                            vos_mem_copy(&pRoamInfo->peerMac,
                                          &pRsp->peerMacAddr, sizeof(tCsrBssid));
                                 //Make sure we install the GTK before indicating to HDD as authenticated
                                 //This is to prevent broadcast packets go out after PTK and before GTK.
@@ -11085,9 +11484,20 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                                     {
                                        tpSirSetActiveModeSetBncFilterReq pMsg;
                                        pMsg = vos_mem_malloc(sizeof(tSirSetActiveModeSetBncFilterReq));
+                                       if (!pMsg) {
+                                           smsLog(pMac, LOGE,
+                                               FL("Failed to allocate memory"));
+                                           if (pRoamInfo)
+                                               vos_mem_free(pRoamInfo);
+                                           return;
+                                       }
                                        pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_SET_BCN_FILTER_REQ);
-                                       pMsg->length = pal_cpu_to_be16(sizeof( tANI_U8));
+                                       pMsg->length = pal_cpu_to_be16(sizeof(
+                                           tSirSetActiveModeSetBncFilterReq));
                                        pMsg->seesionId = sessionId;
+                                       vos_mem_copy(pMsg->bssid,
+                                           pSession->connectedProfile.bssid,
+                                           sizeof(tSirMacAddr));
                                        status = palSendMBMessage(pMac->hHdd, pMsg );
                                     }
 #endif
@@ -11097,7 +11507,6 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                                 {
                                     result = eCSR_ROAM_RESULT_NONE;
                                 }
-                            pRoamInfo = &roamInfo;
                         }
                         else
                         {
@@ -11106,10 +11515,12 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                                    "command failed(%d) PeerMac "MAC_ADDRESS_STR,
                                    pRsp->statusCode, MAC_ADDR_ARRAY(pRsp->peerMacAddr));
                         }
-                        roamInfo.is11rAssoc = csrRoamIs11rAssoc(pMac,
+                        pRoamInfo->is11rAssoc = csrRoamIs11rAssoc(pMac,
                                                                   sessionId);
-                        csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.setKeyCmd.roamId,
-                                            eCSR_ROAM_SET_KEY_COMPLETE, result);
+                        csrRoamCallCallback(pMac, sessionId, pRoamInfo,
+                                            pCommand->u.setKeyCmd.roamId,
+                                            eCSR_ROAM_SET_KEY_COMPLETE,
+                                            result);
                         // Indicate SME_QOS that the SET_KEY is completed, so that SME_QOS
                         // can go ahead and initiate the TSPEC if any are pending
                         sme_QosCsrEventInd(pMac, (v_U8_t)sessionId, SME_QOS_CSR_SET_KEY_SUCCESS_IND, NULL);
@@ -11162,6 +11573,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                         if(!pSession)
                         {
                             smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+                            if (pRoamInfo)
+                                vos_mem_free(pRoamInfo);
                             return;
                         }
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
@@ -11187,17 +11600,19 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
 #endif //FEATURE_WLAN_DIAG_SUPPORT_CSR
                         if( eSIR_SME_SUCCESS == pRsp->statusCode )
                         {
-                            vos_mem_copy(&roamInfo.peerMac, &pRsp->peerMacAddr,
+                            vos_mem_copy(&pRoamInfo->peerMac,
+                                         &pRsp->peerMacAddr,
                                          sizeof(tCsrBssid));
                             result = eCSR_ROAM_RESULT_NONE;
-                            pRoamInfo = &roamInfo;
                         }
                         else
                         {
                             result = eCSR_ROAM_RESULT_FAILURE;
                         }
-                        csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.setKeyCmd.roamId,
-                                            eCSR_ROAM_REMOVE_KEY_COMPLETE, result);
+                        csrRoamCallCallback(pMac, sessionId, pRoamInfo,
+                                            pCommand->u.setKeyCmd.roamId,
+                                            eCSR_ROAM_REMOVE_KEY_COMPLETE,
+                                            result);
                         if( csrLLRemoveEntry( &pMac->sme.smeCmdActiveList, pEntry, LL_ACCESS_LOCK ) )
                         {
                             csrReleaseCommandRemoveKey( pMac, pCommand );
@@ -11244,10 +11659,10 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
             pSmeMaxAssocInd = (tSmeMaxAssocInd*)pSirMsg;
             smsLog( pMac, LOG1, FL("send indication that max assoc have been reached and the new peer cannot be accepted"));
             sessionId = pSmeMaxAssocInd->sessionId;
-            roamInfo.sessionId = sessionId;
-            vos_mem_copy(&roamInfo.peerMac, pSmeMaxAssocInd->peerMac,
+            pRoamInfo->sessionId = sessionId;
+            vos_mem_copy(&pRoamInfo->peerMac, pSmeMaxAssocInd->peerMac,
                          sizeof(tCsrBssid));
-            csrRoamCallCallback(pMac, sessionId, &roamInfo, 0,
+            csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0,
                     eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_MAX_ASSOC_EXCEEDED);
             break;
 
@@ -11268,10 +11683,12 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
             csrNeighborRoamHandoffReqHdlr( pMac, pSirMsg );
             break;
 #endif
-
         default:
             break;
     }  // end switch on message type
+
+    if (pRoamInfo)
+        vos_mem_free(pRoamInfo);
 }
 
 void csrCallRoamingCompletionCallback(tpAniSirGlobal pMac, tCsrRoamSession *pSession,
@@ -11475,8 +11892,14 @@ void csrRoamWaitForKeyTimeOutHandler(void *pv)
            macTraceGetcsrRoamSubState(
            pMac->roam.curSubState[pInfo->sessionId]));
 
+    vos_spin_lock_acquire(&pMac->roam.roam_state_lock);
     if( CSR_IS_WAIT_FOR_KEY( pMac, pInfo->sessionId ) )
     {
+        //Change the substate so command queue is unblocked.
+        if (CSR_ROAM_SESSION_MAX > pInfo->sessionId)
+            pMac->roam.curSubState[pInfo->sessionId] =
+                                        eCSR_ROAM_SUBSTATE_NONE;
+        vos_spin_lock_release(&pMac->roam.roam_state_lock);
 #ifdef FEATURE_WLAN_LFR
         if (csrNeighborRoamIsHandoffInProgress(pMac, pInfo->sessionId))
         {
@@ -11494,13 +11917,6 @@ void csrRoamWaitForKeyTimeOutHandler(void *pv)
 #endif
         smsLog(pMac, LOGE, " SME pre-auth state timeout. ");
 
-        //Change the substate so command queue is unblocked.
-        if (CSR_ROAM_SESSION_MAX > pInfo->sessionId)
-        {
-            csrRoamSubstateChange(pMac, eCSR_ROAM_SUBSTATE_NONE,
-                                  pInfo->sessionId);
-        }
-
         if( csrIsConnStateConnectedInfra(pMac, pInfo->sessionId) )
         {
             csrRoamLinkUp(pMac, pSession->connectedProfile.bssid);
@@ -11519,6 +11935,8 @@ void csrRoamWaitForKeyTimeOutHandler(void *pv)
                    __func__, pInfo->sessionId);
         }
     }
+    else
+        vos_spin_lock_release(&pMac->roam.roam_state_lock);
 }
 
 eHalStatus csrRoamStartWaitForKeyTimer(tpAniSirGlobal pMac, tANI_U32 interval)
@@ -11646,17 +12064,7 @@ eHalStatus csrRoamLostLink( tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U32 ty
         result = eCSR_ROAM_RESULT_DEAUTH_IND;
         pDeauthIndMsg = (tSirSmeDeauthInd *)pSirMsg;
         pSession->roamingStatusCode = pDeauthIndMsg->statusCode;
-        /* Convert into proper reason code */
-        if ((pDeauthIndMsg->reasonCode == eSIR_BEACON_MISSED) ||
-            (pDeauthIndMsg->reasonCode ==
-                 eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON))
-            pSession->joinFailStatusCode.reasonCode = 0;
-        else
-            pSession->joinFailStatusCode.reasonCode = pDeauthIndMsg->reasonCode;
-        /*
-         * cfg layer expects 0 as reason code if the driver doesn't know the
-         * reason code eSIR_BEACON_MISSED is defined as locally
-         */
+        pSession->joinFailStatusCode.reasonCode = pDeauthIndMsg->reasonCode;
     }
     else
     {
@@ -11669,9 +12077,6 @@ eHalStatus csrRoamLostLink( tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U32 ty
     if(!CSR_IS_INFRA_AP(&pSession->connectedProfile))
     {
         csrRoamCallCallback(pMac, sessionId, NULL, 0, eCSR_ROAM_LOSTLINK_DETECTED, result);
-        /*Move the state to Idle after disconnection*/
-        csrRoamStateChange( pMac, eCSR_ROAMING_STATE_IDLE, sessionId );
-
     }
 
     if ( eWNI_SME_DISASSOC_IND == type )
@@ -11757,16 +12162,6 @@ eHalStatus csrRoamLostLink( tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U32 ty
     }
     if(!fToRoam)
     {
-        //Tell HDD about the lost link
-        if(!CSR_IS_INFRA_AP(&pSession->connectedProfile))
-        {
-            /* Don't call csrRoamCallCallback for GO/SoftAp case as this indication
-             * was already given as part of eWNI_SME_DISASSOC_IND msg handling in
-             * csrRoamCheckForLinkStatusChange API.
-             */
-            csrRoamCallCallback(pMac, sessionId, &roamInfo, 0, eCSR_ROAM_LOSTLINK, result);
-        }
-
        /*No need to start idle scan in case of IBSS/SAP
          Still enable idle scan for polling in case concurrent sessions are running */
         if(CSR_IS_INFRASTRUCTURE(&pSession->connectedProfile))
@@ -11857,7 +12252,6 @@ void csrRoamWmStatusChangeComplete( tpAniSirGlobal pMac )
     {
         smsLog( pMac, LOGW, "CSR: WmStatusChange Completion called but NO commands are ACTIVE ..." );
     }
-    smeProcessPendingQueue( pMac );
 }
 
 void csrRoamProcessWmStatusChangeCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand )
@@ -12673,7 +13067,7 @@ csr_convert_mode_to_nw_type(eCsrCfgDot11Mode dot11_mode, eCsrBand band)
  *
  * Return: void
  */
-static void csr_populate_supported_rates_from_hostapd(tSirMacRateSet *opr_rates,
+void csr_populate_supported_rates_from_hostapd(tSirMacRateSet *opr_rates,
 		tSirMacRateSet *ext_rates,
 		tCsrRoamProfile *pProfile)
 {
@@ -12700,6 +13094,105 @@ static void csr_populate_supported_rates_from_hostapd(tSirMacRateSet *opr_rates,
 }
 
 /**
+ * csr_merge_supported_and_extended_rates() - merge supported rates and
+ * extended rates
+ * @rates:              merged rates
+ * @supported_rates:    supported rates
+ * @extended_rates:     extended rates
+ *
+ * Return: None
+ */
+static void csr_merge_supported_and_extended_rates(
+		struct merged_mac_rate_set *rates,
+		tSirMacRateSet *supported_rates,
+		tSirMacRateSet *extended_rates)
+{
+	int i;
+
+	vos_mem_copy(rates->rate,
+			supported_rates->rate,
+			supported_rates->numRates);
+	rates->num_rates = supported_rates->numRates;
+
+	vos_mem_copy(rates->rate + rates->num_rates,
+			extended_rates->rate,
+			extended_rates->numRates);
+	rates->num_rates += extended_rates->numRates;
+
+	for (i = 0; i < rates->num_rates; i++)
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+			FL("Merge rate is %2x"), rates->rate[i]);
+}
+
+/**
+ * csr_populate_intersection_driver_and_hostpd_rates() - populate
+ * intersection of driver rates and hostapd rates
+ * @pParam:             csr roam start bss params
+ * @driver_rates:       rates generated by driver
+ * @hostapd_rates:      rates generated by hostapd
+ *
+ * Return: None
+ */
+static void csr_populate_intersection_driver_and_hostpd_rates(
+		tCsrRoamStartBssParams *pParam,
+		struct merged_mac_rate_set *driver_rates,
+		struct merged_mac_rate_set *hostapd_rates)
+{
+	int i, j;
+	struct merged_mac_rate_set rates;
+	uint8_t driver_rate, hostapd_rate;
+	tSirMacRateSet *opr_rates = &pParam->operationalRateSet;
+	tSirMacRateSet *ext_rates = &pParam->extendedRateSet;
+
+	rates.num_rates = 0;
+
+	for (i = 0; i < driver_rates->num_rates; i++) {
+		driver_rate = driver_rates->rate[i];
+		if (CSR_IS_BASIC_RATE(driver_rate))
+			BITS_OFF(driver_rate,
+				CSR_DOT11_BASIC_RATE_MASK);
+
+		for (j = 0; j < hostapd_rates->num_rates; j++) {
+			hostapd_rate = hostapd_rates->rate[j];
+			if (CSR_IS_BASIC_RATE(hostapd_rate))
+				BITS_OFF(hostapd_rate,
+					CSR_DOT11_BASIC_RATE_MASK);
+
+			if (driver_rate == hostapd_rate) {
+				if (CSR_IS_BASIC_RATE(driver_rates->rate[i]) ||
+				    CSR_IS_BASIC_RATE(hostapd_rates->rate[j]))
+					BITS_ON(driver_rate,
+						CSR_DOT11_BASIC_RATE_MASK);
+
+				rates.rate[rates.num_rates++] = driver_rate;
+				break;
+			}
+		}
+	}
+
+	for (i = 0; i < rates.num_rates; i++)
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+			FL("Intersection rate is %2x"), rates.rate[i]);
+
+	opr_rates->numRates = 0;
+	ext_rates->numRates = 0;
+	if (rates.num_rates <= MAX_NUM_SUPPORTED_RATES) {
+		opr_rates->numRates = rates.num_rates;
+		vos_mem_copy(opr_rates->rate,
+				rates.rate,
+				opr_rates->numRates);
+	} else {
+		opr_rates->numRates = MAX_NUM_SUPPORTED_RATES;
+		vos_mem_copy(opr_rates->rate,
+				rates.rate,
+				MAX_NUM_SUPPORTED_RATES);
+		ext_rates->numRates = rates.num_rates - MAX_NUM_SUPPORTED_RATES;
+		vos_mem_copy(ext_rates->rate,
+				rates.rate + MAX_NUM_SUPPORTED_RATES,
+				ext_rates->numRates);
+	}
+}
+/**
  * csrRoamGetBssStartParms() - get bss start param from profile
  * @pMac:          mac global context
  * @pProfile:      roam profile
@@ -12739,21 +13232,7 @@ static void csrRoamGetBssStartParms(tpAniSirGlobal pMac,
 	}
 	nwType = csr_convert_mode_to_nw_type(pParam->uCfgDot11Mode, eBand);
 	pParam->extendedRateSet.numRates = 0;
-	/*
-	 * hostapd.conf will populate its basic and extended rates
-	 * as per hw_mode but if acs in ini is enabled, driver should
-	 * ignore basic and extended rates from hostapd.conf and should
-	 * populate default rates.
-	 */
-	if (pProfile->supported_rates.numRates ||
-	    pProfile->extended_rates.numRates) {
-		csr_populate_supported_rates_from_hostapd(opr_rates,
-				ext_rates, pProfile);
-		pParam->operationChn = operation_channel;
-		pParam->sirNwType = nwType;
-		pParam->vht_channel_width = pProfile->vht_channel_width;
-		return;
-	}
+
 	switch (nwType) {
 	default:
 		smsLog(pMac, LOGE, FL("sees an unknown pSirNwType (%d)"),
@@ -12803,6 +13282,30 @@ static void csrRoamGetBssStartParms(tpAniSirGlobal pMac,
 			channel = operation_channel;
 		break;
 	}
+
+	if (pProfile->supported_rates.numRates ||
+	    pProfile->extended_rates.numRates) {
+		struct merged_mac_rate_set rates_driver, rates_hostapd;
+
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+				"Merge rates driver");
+		csr_merge_supported_and_extended_rates(&rates_driver,
+				opr_rates,
+				ext_rates);
+
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+				"Merge rates hostapd");
+		csr_merge_supported_and_extended_rates(&rates_hostapd,
+				&pProfile->supported_rates,
+				&pProfile->extended_rates);
+
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+				"Populate rates intersection");
+		csr_populate_intersection_driver_and_hostpd_rates(pParam,
+				&rates_driver,
+				&rates_hostapd);
+	}
+
 	pParam->operationChn = channel;
 	pParam->sirNwType = nwType;
 	pParam->vht_channel_width = pProfile->vht_channel_width;
@@ -13168,6 +13671,48 @@ eHalStatus csrRoamSetPSK_PMK(tpAniSirGlobal pMac, tANI_U32 sessionId,
     return eHAL_STATUS_SUCCESS;
 }
 #endif /* WLAN_FEATURE_ROAM_OFFLOAD */
+
+static void csr_update_pmk_cache(tCsrRoamSession *pSession,
+        tPmkidCacheInfo *pmksa)
+{
+    uint16_t cache_idx = pSession->curr_cache_idx;
+
+    /* Add entry to the cache */
+    if (!pmksa->ssid_len) {
+        vos_copy_macaddr(
+                (v_MACADDR_t *)pSession->PmkidCacheInfo[cache_idx].BSSID,
+                (v_MACADDR_t *)pmksa->BSSID);
+        pSession->PmkidCacheInfo[cache_idx].ssid_len = 0;
+    } else {
+        vos_mem_copy(pSession->PmkidCacheInfo[cache_idx].ssid,
+                pmksa->ssid, pmksa->ssid_len);
+        pSession->PmkidCacheInfo[cache_idx].ssid_len =
+            pmksa->ssid_len;
+        vos_mem_copy(pSession->PmkidCacheInfo[cache_idx].cache_id,
+                pmksa->cache_id, CACHE_ID_LEN);
+
+    }
+    vos_mem_copy(
+            pSession->PmkidCacheInfo[cache_idx].PMKID,
+            pmksa->PMKID, CSR_RSN_PMKID_SIZE);
+
+    if (pmksa->pmk_len)
+        vos_mem_copy(pSession->PmkidCacheInfo[cache_idx].pmk,
+                pmksa->pmk, pmksa->pmk_len);
+
+    pSession->PmkidCacheInfo[cache_idx].pmk_len = pmksa->pmk_len;
+
+    /* Increment the CSR local cache index */
+    if (cache_idx < (CSR_MAX_PMKID_ALLOWED - 1))
+        pSession->curr_cache_idx++;
+    else
+        pSession->curr_cache_idx = 0;
+
+    pSession->NumPmkidCache++;
+    if (pSession->NumPmkidCache > CSR_MAX_PMKID_ALLOWED)
+        pSession->NumPmkidCache = CSR_MAX_PMKID_ALLOWED;
+}
+
 eHalStatus csrRoamSetPMKIDCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
                                  tPmkidCacheInfo *pPMKIDCache,
                                  tANI_U32 numItems,
@@ -13220,25 +13765,9 @@ eHalStatus csrRoamSetPMKIDCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
                 pmksa = &pPMKIDCache[i];
 
                 /* Delete the entry if present */
-                csrRoamDelPMKIDfromCache(pMac,sessionId,pmksa->BSSID,FALSE);
-
-                /* Add entry to the cache */
-                vos_mem_copy(
-                   pSession->PmkidCacheInfo[pSession->curr_cache_idx].BSSID,
-                   pmksa->BSSID, ETHER_ADDR_LEN);
-                vos_mem_copy(
-                   pSession->PmkidCacheInfo[pSession->curr_cache_idx].PMKID,
-                   pmksa->PMKID, CSR_RSN_PMKID_SIZE);
-
-                /* Increment the CSR local cache index */
-                if (pSession->curr_cache_idx < (CSR_MAX_PMKID_ALLOWED - 1))
-                    pSession->curr_cache_idx++;
-                else
-                    pSession->curr_cache_idx = 0;
+                csrRoamDelPMKIDfromCache(pMac,sessionId,pmksa,FALSE);
 
-                pSession->NumPmkidCache++;
-                if (pSession->NumPmkidCache > CSR_MAX_PMKID_ALLOWED)
-                    pSession->NumPmkidCache = CSR_MAX_PMKID_ALLOWED;
+                csr_update_pmk_cache(pSession, pmksa);
             }
         }
     }
@@ -13246,7 +13775,7 @@ eHalStatus csrRoamSetPMKIDCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
 }
 
 eHalStatus csrRoamDelPMKIDfromCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
-                                     const tANI_U8 *pBSSId,
+                                     tPmkidCacheInfo *pmksa,
                                      tANI_BOOLEAN flush_cache )
 {
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
@@ -13254,6 +13783,7 @@ eHalStatus csrRoamDelPMKIDfromCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
     tANI_U32 Index;
     uint32_t curr_idx;
     uint32_t i;
+    tPmkidCacheInfo *cached_pmksa;
 
     if(!pSession)
     {
@@ -13269,21 +13799,28 @@ eHalStatus csrRoamDelPMKIDfromCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
 
     if (!flush_cache) {
         for (Index = 0; Index < CSR_MAX_PMKID_ALLOWED; Index++) {
-            if (vos_mem_compare(pSession->PmkidCacheInfo[Index].BSSID,
-                      pBSSId, VOS_MAC_ADDR_SIZE)) {
+            cached_pmksa = &pSession->PmkidCacheInfo[Index];
+            if (((!cached_pmksa->ssid_len) &&
+                    vos_is_macaddr_equal((v_MACADDR_t *)cached_pmksa->BSSID,
+                                         (v_MACADDR_t *)pmksa->BSSID))) {
                 fMatchFound = 1;
 
+            } else if ((!adf_os_mem_cmp(cached_pmksa->ssid,
+                        pmksa->ssid, pmksa->ssid_len)) &&
+                        (!adf_os_mem_cmp(cached_pmksa->cache_id,
+                        pmksa->cache_id, CACHE_ID_LEN)))
+                fMatchFound = 1;
+
+            if(fMatchFound) {
                 /* Clear this - the matched entry */
-                vos_mem_zero(&pSession->PmkidCacheInfo[Index],
+                vos_mem_zero(cached_pmksa,
                              sizeof(tPmkidCacheInfo));
-
                 break;
             }
         }
 
         if (Index == CSR_MAX_PMKID_ALLOWED && !fMatchFound) {
-           smsLog(pMac, LOG1, FL("No such PMKSA entry exists "MAC_ADDRESS_STR),
-                  MAC_ADDR_ARRAY(pBSSId));
+           smsLog(pMac, LOG1, FL("No such PMKSA entry exists "));
         }
         else {
             /* Match Found */
@@ -13700,13 +14237,45 @@ static eHalStatus csrRoamStartWds( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsr
     return( status );
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+/*
+ * csr_update_fils_connection_info: Copy fils connection info to join request
+ * @profile: pointer to profile
+ * @csr_join_req: csr join request
+ *
+ * Return: None
+ */
+static void csr_update_fils_connection_info(tCsrRoamProfile *profile,
+                                            tANI_U8 **pBuf)
+{
+    if (profile->fils_con_info &&
+        profile->fils_con_info->is_fils_connection) {
+            vos_mem_copy(*pBuf,
+                        (tANI_U8 *)profile->fils_con_info,
+                        sizeof(struct cds_fils_connection_info));
+    } else {
+            vos_mem_zero(*pBuf,
+            sizeof(struct cds_fils_connection_info));
+    }
+    *pBuf += sizeof(struct cds_fils_connection_info);
+}
+#else
+static void csr_update_fils_connection_info(tCsrRoamProfile *profile,
+                                            tANI_U8 **pBuf)
+{ }
+#endif
+
+
 ////////////////////Mail box
 
 //pBuf is caller allocated memory point to &(tSirSmeJoinReq->rsnIE.rsnIEdata[ 0 ]) + pMsg->rsnIE.length;
 //or &(tSirSmeReassocReq->rsnIE.rsnIEdata[ 0 ]) + pMsg->rsnIE.length;
-static void csrPrepareJoinReassocReqBuffer( tpAniSirGlobal pMac,
-                                            tSirBssDescription *pBssDescription,
-                                            tANI_U8 *pBuf, tANI_U8 uapsdMask)
+static uint16_t
+csrPrepareJoinReassocReqBuffer(tpAniSirGlobal pMac,
+                               tSirBssDescription *pBssDescription,
+                               tANI_U8 *pBuf, tANI_U8 uapsdMask,
+                               enum eWniMsgTypes messageType,
+                               tCsrRoamProfile *pProfile)
 {
     tCsrChannelSet channelGroup;
     tSirMacCapabilityInfo *pAP_capabilityInfo;
@@ -13715,6 +14284,8 @@ static void csrPrepareJoinReassocReqBuffer( tpAniSirGlobal pMac,
     tANI_U32 size = 0;
     tANI_S8 pwrLimit = 0;
     tANI_U16 i;
+    uint8_t *tmp_ptr = pBuf;
+    uint16_t used_length = 0;
     // 802.11h
     //We can do this because it is in HOST CPU order for now.
     pAP_capabilityInfo = (tSirMacCapabilityInfo *)&pBssDescription->capabilityInfo;
@@ -13767,12 +14338,19 @@ static void csrPrepareJoinReassocReqBuffer( tpAniSirGlobal pMac,
         *pBuf++ = 0;  //tSirSupChnl->numChnl
     }
 
+    if (eWNI_SME_JOIN_REQ == messageType)
+        *pBuf++ = pMac->sub20_channelwidth;
+
+    csr_update_fils_connection_info(pProfile, &pBuf);
+
     *pBuf++ = uapsdMask;
 
     // move the entire BssDescription into the join request.
     vos_mem_copy(pBuf, pBssDescription,
                  pBssDescription->length + sizeof( pBssDescription->length ));
     pBuf += pBssDescription->length + sizeof( pBssDescription->length );   // update to new location
+    used_length = pBuf - tmp_ptr;
+    return used_length;
 }
 
 /*
@@ -13804,6 +14382,7 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
     tANI_U8 txBFCsnValue = 0;
     tpCsrNeighborRoamControlInfo neigh_roam_info;
     eHalStatus packetdump_timer_status;
+    uint16_t used_length = 0;
 
     if(!pSession)
     {
@@ -13905,6 +14484,10 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
             //Need to disable VHT operation in 2.4 GHz band
             ucDot11Mode = WNI_CFG_DOT11_MODE_11N;
         }
+
+        smsLog(pMac, LOG1, FL("dot11mode %d uCfgDot11Mode %d"),
+                              ucDot11Mode, pSession->bssParams.uCfgDot11Mode);
+
         *pBuf = (tANI_U8)ucDot11Mode;
         pBuf++;
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
@@ -13921,9 +14504,13 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
         //CBMode
         *pBuf = (tANI_U8)pSession->bssParams.cbMode;
         pBuf += sizeof(ePhyChanBondState);
+        *pBuf = (tANI_U8)pProfile->force_24ghz_in_ht20;
+        pBuf++;
 
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                  FL("CSR PERSONA=%d CSR CbMode %d"), pProfile->csrPersona, pSession->bssParams.cbMode);
+                  FL("CSR PERSONA=%d CSR CbMode %d force_24ghz_in_ht20 %d "),
+                  pProfile->csrPersona, pSession->bssParams.cbMode,
+                  pProfile->force_24ghz_in_ht20);
 
         // uapsdPerAcBitmask
         *pBuf = pProfile->uapsd_mask;
@@ -14386,23 +14973,21 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
         // txBFIniFeatureEnabled
         *pBuf = (tANI_U8)pMac->roam.configParam.txBFEnable;
         pBuf++;
-
         // txBFCsnValue
         if (IS_BSS_VHT_CAPABLE(pIes->VHTCaps) &&
-			pMac->roam.configParam.txBFEnable) {
-		txBFCsnValue = (tANI_U8)pMac->roam.configParam.txBFCsnValue;
-		if (pIes->VHTCaps.numSoundingDim)
-			txBFCsnValue = MIN(txBFCsnValue,
-					pIes->VHTCaps.numSoundingDim);
-        }
-        else if (IS_BSS_VHT_CAPABLE(pIes->vendor2_ie.VHTCaps) &&
+           pMac->roam.configParam.txBFEnable) {
+            txBFCsnValue =
+              (tANI_U8)pMac->roam.configParam.txBFCsnValue;
+            if (pIes->VHTCaps.csnofBeamformerAntSup)
+                txBFCsnValue = MIN(txBFCsnValue,
+                  pIes->VHTCaps.csnofBeamformerAntSup);
+        } else if (IS_BSS_VHT_CAPABLE(pIes->vendor2_ie.VHTCaps) &&
                        pMac->roam.configParam.txBFEnable) {
-               txBFCsnValue = (tANI_U8)pMac->roam.configParam.txBFCsnValue;
-               if (pIes->vendor2_ie.VHTCaps.numSoundingDim)
-                       txBFCsnValue = MIN(txBFCsnValue,
-                                       pIes->vendor2_ie.VHTCaps.numSoundingDim);
+            txBFCsnValue = (tANI_U8)pMac->roam.configParam.txBFCsnValue;
+            if (pIes->vendor2_ie.VHTCaps.csnofBeamformerAntSup)
+                txBFCsnValue = MIN(txBFCsnValue,
+                   pIes->vendor2_ie.VHTCaps.csnofBeamformerAntSup);
         }
-
         *pBuf = txBFCsnValue;
         pBuf++;
 
@@ -14483,9 +15068,12 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
         pBuf += sizeof(struct rrm_config_param);
 
         //BssDesc
-        csrPrepareJoinReassocReqBuffer( pMac, pBssDescription, pBuf,
-                (tANI_U8)pProfile->uapsd_mask);
+        used_length =
+            csrPrepareJoinReassocReqBuffer(pMac, pBssDescription, pBuf,
+                                           (tANI_U8)pProfile->uapsd_mask,
+                                           messageType, pProfile);
 
+        pBuf += used_length;
         /*
          * conc_custom_rule1:
          * If SAP comes up first and STA comes up later then SAP
@@ -15095,48 +15683,86 @@ eHalStatus csrSendAssocIndToUpperLayerCnfMsg(   tpAniSirGlobal pMac,
         else
             statusCode = (tSirResultCodes)pal_cpu_to_be32(eSIR_SME_ASSOC_REFUSED);
         vos_mem_copy(pBuf, &statusCode, sizeof(tSirResultCodes)) ;
-        pBuf += sizeof(tSirResultCodes);
-        // bssId
+        /* bssId */
+        pBuf = (tANI_U8 *)&pMsg->bssId;
         vos_mem_copy((tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
-        pBuf += sizeof (tSirMacAddr);
-        // peerMacAddr
+        /* peerMacAddr */
+        pBuf = (tANI_U8 *)&pMsg->peerMacAddr;
         vos_mem_copy((tSirMacAddr *)pBuf, pAssocInd->peerMacAddr,
                       sizeof(tSirMacAddr));
-        pBuf += sizeof (tSirMacAddr);
-        // StaId
+        /* StaId */
+        pBuf = (tANI_U8 *)&pMsg->aid;
         wTmp = pal_cpu_to_be16(pAssocInd->staId);
         vos_mem_copy(pBuf, &wTmp, sizeof(tANI_U16));
-        pBuf += sizeof (tANI_U16);
-        // alternateBssId
+        /* alternateBssId */
+        pBuf = (tANI_U8 *)&pMsg->alternateBssId;
         vos_mem_copy((tSirMacAddr *)pBuf, pAssocInd->bssId, sizeof(tSirMacAddr));
-        pBuf += sizeof (tSirMacAddr);
-        // alternateChannelId
+        /* alternateChannelId */
+        pBuf = (tANI_U8 *)&pMsg->alternateChannelId;
         *pBuf = 11;
-        pBuf += sizeof (tANI_U8);
-        // Instead of copying roam Info, we just copy only WmmEnabled, RsnIE information
-        //Wmm
+        /*Instead of copying roam Info,just copy WmmEnabled,RsnIE information*/
+        /* Wmm */
+        pBuf = (tANI_U8 *)&pMsg->wmmEnabledSta;
         *pBuf = pAssocInd->wmmEnabledSta;
-        pBuf += sizeof (tANI_U8);
-        //RSN IE
+        /* RSN IE */
+        pBuf = (tANI_U8 *)&pMsg->rsnIE;
         vos_mem_copy((tSirRSNie *)pBuf, &pAssocInd->rsnIE, sizeof(tSirRSNie));
-        pBuf += sizeof (tSirRSNie);
 #ifdef FEATURE_WLAN_WAPI
-        //WAPI IE
+        /* WAPI IE */
+        pBuf = (tANI_U8 *)&pMsg->wapiIE;
         vos_mem_copy((tSirWAPIie *)pBuf, &pAssocInd->wapiIE,
                         sizeof(tSirWAPIie));
-        pBuf += sizeof (tSirWAPIie);
 #endif
-        //Additional IE
+        /* Additional IE */
+        pBuf = (tANI_U8 *)&pMsg->addIE;
         vos_mem_copy((void *)pBuf, &pAssocInd->addIE, sizeof(tSirAddie));
-        pBuf += sizeof (tSirAddie);
-        //reassocReq
+        /* reassocReq */
+        pBuf = (tANI_U8 *)&pMsg->reassocReq;
         *pBuf = pAssocInd->reassocReq;
-        pBuf += sizeof (tANI_U8);
-        //timingMeasCap
+        /* timingMeasCap */
+        pBuf = (tANI_U8 *)&pMsg->timingMeasCap;
         *pBuf = pAssocInd->timingMeasCap;
-        pBuf += sizeof (tANI_U8);
+        /* chan_info */
+        pBuf = (tANI_U8 *)&pMsg->chan_info;
         vos_mem_copy((void *)pBuf, &pAssocInd->chan_info,
                         sizeof(tSirSmeChanInfo));
+        /* ecsa capable */
+        pBuf = (tANI_U8 *)&pMsg->ecsa_capable;
+        *pBuf = pAssocInd->ecsa_capable;
+        /* ampdu */
+        pBuf = (tANI_U8 *)&pMsg->ampdu;
+        *pBuf = pAssocInd->ampdu;
+        /* sgi_enable */
+        pBuf = (tANI_U8 *)&pMsg->sgi_enable;
+        *pBuf = pAssocInd->sgi_enable;
+        /* tx stbc */
+        pBuf = (tANI_U8 *)&pMsg->tx_stbc;
+        *pBuf = pAssocInd->tx_stbc;
+        /* ch_width */
+        pBuf = (tANI_U8 *)&pMsg->ch_width;
+        *pBuf = pAssocInd->ch_width;
+        /* mode */
+        pBuf = (tANI_U8 *)&pMsg->mode;
+        *pBuf = pAssocInd->mode;
+        /* rx stbc */
+        pBuf = (tANI_U8 *)&pMsg->rx_stbc;
+        *pBuf = pAssocInd->rx_stbc;
+        /* max supported idx */
+        pBuf = (tANI_U8 *)&pMsg->max_supp_idx;
+        *pBuf = pAssocInd->max_supp_idx;
+        /* max extended idx */
+        pBuf = (tANI_U8 *)&pMsg->max_ext_idx;
+        *pBuf = pAssocInd->max_ext_idx;
+        /* max ht mcs idx */
+        pBuf = (tANI_U8 *)&pMsg->max_mcs_idx;
+        *pBuf = pAssocInd->max_mcs_idx;
+        /* vht rx mcs map */
+        pBuf = (tANI_U8 *)&pMsg->rx_mcs_map;
+        *pBuf = pAssocInd->rx_mcs_map;
+        /* vht tx mcs map */
+        pBuf = (tANI_U8 *)&pMsg->tx_mcs_map;
+        *pBuf = pAssocInd->tx_mcs_map;
+
         msgQ.type = eWNI_SME_UPPER_LAYER_ASSOC_CNF;
         msgQ.bodyptr = pMsg;
         msgQ.bodyval = 0;
@@ -15230,12 +15856,7 @@ eHalStatus csrSendMBSetContextReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId,
                 // set pSirKey->keyLength = keyLength;
                 p = pal_set_U16( p, pal_cpu_to_be16(keyLength) );
         if (keyLength && pKey)
-        {
             vos_mem_copy(p, pKey, keyLength);
-            smsLog(pMac, LOG1, FL("SME set keyIndx (%d) encType (%d) key"),
-                                                keyId, edType);
-            sirDumpBuf(pMac, SIR_SMS_MODULE_ID, LOG2, pKey, keyLength);
-        }
         status = palSendMBMessage(pMac->hHdd, pMsg);
     } while( 0 );
     return( status );
@@ -15457,6 +16078,8 @@ eHalStatus csrSendMBStartBssReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, eCs
                 sizeof(pParam->beacon_tx_rate));
         pBuf += sizeof(pParam->beacon_tx_rate);
 
+        *pBuf++ = pMac->sub20_channelwidth;
+
         msgLen = (tANI_U16)(sizeof(tANI_U32 ) + (pBuf - wTmpBuf)); //msg_header + msg
         pMsg->length = pal_cpu_to_be16(msgLen);
 
@@ -17559,6 +18182,13 @@ eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 sessionId,
       smsLog(pMac, LOGE, FL("Supplicant disabled driver roaming"));
       return eHAL_STATUS_FAILURE;
    }
+
+   if (vos_is_mon_enable() && (ROAM_SCAN_OFFLOAD_STOP != command)) {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                 "%s: monitor is enabled, disable roaming", __func__);
+       return eHAL_STATUS_FAILURE;
+   }
+
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
    if (pSession->roamOffloadSynchParams.bRoamSynchInProgress
        && (ROAM_SCAN_OFFLOAD_STOP == command))
@@ -17740,7 +18370,14 @@ eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 sessionId,
                                 break;
                             }
                         }
-                        if (is_unsafe_chan) {
+                        if ((is_unsafe_chan) &&
+                           ((CSR_IS_CHANNEL_24GHZ(*ChannelList) &&
+                             pMac->roam.configParam.sta_roam_policy.sap_operating_band ==
+                             eCSR_BAND_24) ||
+                            (CSR_IS_CHANNEL_5GHZ(*ChannelList) &&
+                             pMac->roam.configParam.sta_roam_policy.sap_operating_band ==
+                             eCSR_BAND_5G))) {
+
                             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
                                     FL("ignoring unsafe channel %d"),
                                     *ChannelList);
@@ -17785,7 +18422,12 @@ eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 sessionId,
                         break;
                     }
                 }
-                if (is_unsafe_chan) {
+                if ((is_unsafe_chan) && ((CSR_IS_CHANNEL_24GHZ(*ChannelList) &&
+                     pMac->roam.configParam.sta_roam_policy.sap_operating_band
+                     == eCSR_BAND_24) ||
+                    (CSR_IS_CHANNEL_5GHZ(*ChannelList) &&
+                     pMac->roam.configParam.sta_roam_policy.sap_operating_band
+                     == eCSR_BAND_5G))) {
                     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
                             FL("ignoring unsafe channel %d"),
                             *ChannelList);
@@ -17852,7 +18494,12 @@ eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 sessionId,
                           break;
                       }
                   }
-                  if (is_unsafe_chan) {
+                  if ((is_unsafe_chan) && (((CSR_IS_CHANNEL_24GHZ(*ChannelList) &&
+                      pMac->roam.configParam.sta_roam_policy.sap_operating_band
+                      == eCSR_BAND_24) ||
+                      (CSR_IS_CHANNEL_5GHZ(*ChannelList) &&
+                      pMac->roam.configParam.sta_roam_policy.sap_operating_band
+                      == eCSR_BAND_5G)))) {
                       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
                               FL("ignoring unsafe channel %d"),
                               *ChannelList);
@@ -17926,13 +18573,19 @@ eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 sessionId,
                     break;
                 }
             }
-            if (is_unsafe_chan) {
+            if ((is_unsafe_chan) && (((CSR_IS_CHANNEL_24GHZ(*ChannelList) &&
+                 pMac->roam.configParam.sta_roam_policy.sap_operating_band
+                 == eCSR_BAND_24) ||
+                (CSR_IS_CHANNEL_5GHZ(*ChannelList) &&
+                pMac->roam.configParam.sta_roam_policy.sap_operating_band
+                == eCSR_BAND_5G)))) {
                 VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                      FL("ignoring unsafe channel %d"),
+                        FL("ignoring unsafe channel %d"),
                         *ChannelList);
                 ChannelList++;
                 continue;
             }
+
         }
         pRequestBuf->ValidChannelList[num_channels++] = *ChannelList;
         ChannelList++;
@@ -18553,6 +19206,10 @@ eHalStatus csrIsFullPowerNeeded( tpAniSirGlobal pMac, tSmeCmd *pCommand,
             case eCsrCapsChange:
                 fNeedFullPower = eANI_BOOLEAN_TRUE;
                 break;
+            case eCsrForcedDisassocSta:
+            case eCsrForcedDeauthSta:
+                fNeedFullPower = eANI_BOOLEAN_FALSE;
+                break;
             default:
                 /*
                  * Check whether the profile is already connected. If so,
@@ -18968,6 +19625,60 @@ eHalStatus csrRoamUpdateWPARSNIEs( tpAniSirGlobal pMac, tANI_U32 sessionId, tSir
     return ( status );
 }
 
+tANI_U32 csrGetdot11Mode(tHalHandle hHal, tANI_U32 sessionId,
+     tpSirBssDescription pBssDescription)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
+    eCsrCfgDot11Mode uCfgDot11Mode, cfgDot11Mode;
+    eHalStatus status;
+    tDot11fBeaconIEs *ies_local = NULL;
+    tANI_U32 dot11mode = 0;
+
+    smsLog(pMac, LOG1, FL("phyMode %d"), pSession->pCurRoamProfile->phyMode);
+
+    /* Get IE's */
+    status = csrGetParsedBssDescriptionIEs(pMac, pBssDescription, &ies_local);
+    if (!HAL_STATUS_SUCCESS(status)) {
+        smsLog(pMac, LOGE,
+               FL("csrGetParsedBssDescriptionIEs failed"));
+        return 0;
+    }
+    if(ies_local == NULL) {
+       smsLog(pMac, LOGE,
+              FL("ies_local is NULL"));
+       return 0;
+    }
+
+    if(csrIsPhyModeMatch(pMac, pSession->pCurRoamProfile->phyMode,
+          pBssDescription, pSession->pCurRoamProfile, &cfgDot11Mode, ies_local))
+       uCfgDot11Mode = cfgDot11Mode;
+    else
+    {
+       smsLog(pMac, LOGE, "Can not find match phy mode");
+       if(CSR_IS_CHANNEL_5GHZ(pBssDescription->channelId))
+            uCfgDot11Mode = eCSR_CFG_DOT11_MODE_11A;
+        else
+            uCfgDot11Mode = eCSR_CFG_DOT11_MODE_11G;
+    }
+
+    /* dot11mode */
+    dot11mode = csrTranslateToWNICfgDot11Mode(pMac, uCfgDot11Mode);
+    smsLog(pMac, LOG1,
+           FL("dot11mode %d uCfgDot11Mode %d"), dot11mode, uCfgDot11Mode);
+
+    if (pBssDescription->channelId <= 14 &&
+        FALSE == pMac->roam.configParam.enableVhtFor24GHz &&
+        WNI_CFG_DOT11_MODE_11AC == dot11mode)
+    {
+        /* Need to disable VHT operation in 2.4 GHz band */
+        dot11mode = WNI_CFG_DOT11_MODE_11N;
+    }
+    vos_mem_free(ies_local);
+    return dot11mode;
+}
+
+
 #ifdef WLAN_FEATURE_VOWIFI_11R
 eHalStatus
 csrRoamIssueFTPreauthReq(tHalHandle hHal, tANI_U32 sessionId,
@@ -19009,6 +19720,14 @@ csrRoamIssueFTPreauthReq(tHalHandle hHal, tANI_U32 sessionId,
     pftPreAuthReq->messageType = pal_cpu_to_be16(eWNI_SME_FT_PRE_AUTH_REQ);
 
     pftPreAuthReq->preAuthchannelNum = pBssDescription->channelId;
+    pftPreAuthReq->dot11mode =
+                   csrGetdot11Mode(hHal, sessionId, pBssDescription);
+    if (!pftPreAuthReq->dot11mode)
+    {
+        smsLog(pMac, LOGE, FL("pftPreAuthReq->dot11mode is zero"));
+        vos_mem_free(pftPreAuthReq);
+        return eHAL_STATUS_FAILURE;
+    }
 
     vos_mem_copy((void *)&pftPreAuthReq->currbssId,
                  (void *)pSession->connectedProfile.bssid, sizeof(tSirMacAddr));
@@ -19396,7 +20115,7 @@ eHalStatus csrRoamReadTSF(tpAniSirGlobal pMac, tANI_U8 *pTimestamp,
                           tANI_U8 sessionId)
 {
     tCsrNeighborRoamBSSInfo handoffNode = {{0}};
-    tANI_U32                timer_diff = 0;
+    uint64_t                timer_diff = 0;
     tANI_U32                timeStamp[2];
     tpSirBssDescription     pBssDescription = NULL;
 
@@ -19405,10 +20124,11 @@ eHalStatus csrRoamReadTSF(tpAniSirGlobal pMac, tANI_U8 *pTimestamp,
         return eHAL_STATUS_FAILURE;
     }
     pBssDescription = handoffNode.pBssDescription;
-    // Get the time diff in milli seconds
-    timer_diff = vos_timer_get_system_time() - pBssDescription->scanSysTimeMsec;
-    // Convert msec to micro sec timer
-    timer_diff = (tANI_U32)(timer_diff * SYSTEM_TIME_MSEC_TO_USEC);
+    // Get the time diff in nano seconds
+    timer_diff = (vos_get_monotonic_boottime_ns() -
+                  pBssDescription->scansystimensec);
+    // Convert nano to micro sec timer
+    timer_diff = vos_do_div(timer_diff, SYSTEM_TIME_NSEC_TO_USEC);
     timeStamp[0] = pBssDescription->timeStamp[0];
     timeStamp[1] = pBssDescription->timeStamp[1];
     UpdateCCKMTSF(&(timeStamp[0]), &(timeStamp[1]), &timer_diff);
@@ -19448,6 +20168,7 @@ csrRoamChannelChangeReq(tpAniSirGlobal pMac, tCsrBssid bssid,
     pMsg->vht_channel_width = pprofile->vht_channel_width;
     pMsg->dot11mode =
        csrTranslateToWNICfgDot11Mode(pMac,pMac->roam.configParam.uCfgDot11Mode);
+    pMsg->sub20_channelwidth = pprofile->sub20_channelwidth;
 
     if (IS_24G_CH(pMsg->targetChannel) &&
        (false == pMac->roam.configParam.enableVhtFor24GHz) &&
@@ -19701,6 +20422,11 @@ csrRoamSendChanSwIERequest(tpAniSirGlobal pMac, tCsrBssid bssid,
     pMsg->csaIeRequired = csaIeReqd;
     vos_mem_copy(pMsg->bssid, bssid, VOS_MAC_ADDR_SIZE);
     pMsg->ch_bandwidth = ch_bandwidth;
+    pMsg->sub20_channelwidth = pMac->sap.SapDfsInfo.new_sub20_channelwidth;
+    pMsg->ch_switch_beacon_cnt = pMac->sap.SapDfsInfo.sap_ch_switch_beacon_cnt;
+    pMsg->ch_switch_mode = pMac->sap.SapDfsInfo.sap_ch_switch_mode;
+    pMsg->dfs_ch_switch_disable = pMac->sap.SapDfsInfo.disable_dfs_ch_switch;
+    pMsg->sub20_switch_mode = pMac->sap.SapDfsInfo.sub20_switch_mode;
 
     status = palSendMBMessage(pMac->hHdd, pMsg);
 
@@ -19870,6 +20596,8 @@ void csrInitOperatingClasses(tHalHandle hHal)
              if (!found) {
                  opClasses[i]= class;
                  i++;
+                 if (i >= SIR_MAC_MAX_SUPP_OPER_CLASSES)
+                     break;
              }
         }
     }
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrApiScan.c b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrApiScan.c
index 352b38d299e..8df864fc35b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrApiScan.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrApiScan.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -74,6 +74,8 @@
 /* Must be less than 100, represent the percentage of new RSSI */
 #define CSR_SCAN_RESULT_RSSI_WEIGHT     80
 
+#define CSR_PURGE_RSSI_THRESHOLD     -70
+
 #define MAX_ACTIVE_SCAN_FOR_ONE_CHANNEL 140
 #define MIN_ACTIVE_SCAN_FOR_ONE_CHANNEL 120
 
@@ -91,9 +93,6 @@ void csrScanGetResultTimerHandler(void *);
 static void csrPurgeScanResultByAge(void *pv);
 void csrScanIdleScanTimerHandler(void *);
 static void csrSetDefaultScanTiming( tpAniSirGlobal pMac, tSirScanType scanType, tCsrScanRequest *pScanRequest);
-#ifdef WLAN_AP_STA_CONCURRENCY
-static void csrStaApConcTimerHandler(void *);
-#endif
 tANI_BOOLEAN csrIsSupportedChannel(tpAniSirGlobal pMac, tANI_U8 channelId);
 eHalStatus csrScanChannels( tpAniSirGlobal pMac, tSmeCmd *pCommand );
 void csrSetCfgValidChannelList( tpAniSirGlobal pMac, tANI_U8 *pChannelList, tANI_U8 NumChannels );
@@ -111,7 +110,7 @@ eHalStatus csrSetBGScanChannelList( tpAniSirGlobal pMac, tANI_U8 *pAdjustChannel
 void csrReleaseCmdSingle(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 tANI_BOOLEAN csrRoamIsValidChannel( tpAniSirGlobal pMac, tANI_U8 channel );
 void csrPruneChannelListForMode( tpAniSirGlobal pMac, tCsrChannel *pChannelList );
-void csr_purge_old_scan_results(tpAniSirGlobal mac_ctx);
+void csr_purge_scan_result(tpAniSirGlobal mac_ctx);
 
 #define CSR_IS_SOCIAL_CHANNEL(channel) (((channel) == 1) || ((channel) == 6) || ((channel) == 11) )
 
@@ -186,14 +185,6 @@ eHalStatus csrScanOpen( tpAniSirGlobal pMac )
             smsLog(pMac, LOGE, FL("cannot allocate memory for getResult timer"));
             break;
         }
-#ifdef WLAN_AP_STA_CONCURRENCY
-        status = vos_timer_init(&pMac->scan.hTimerStaApConcTimer, VOS_TIMER_TYPE_SW, csrStaApConcTimerHandler, pMac);
-        if (!HAL_STATUS_SUCCESS(status))
-        {
-            smsLog(pMac, LOGE, FL("cannot allocate memory for hTimerStaApConcTimer timer"));
-            break;
-        }
-#endif
         status = vos_timer_init(&pMac->scan.hTimerIdleScan, VOS_TIMER_TYPE_SW, csrScanIdleScanTimerHandler, pMac);
         if (!HAL_STATUS_SUCCESS(status))
         {
@@ -224,9 +215,6 @@ eHalStatus csrScanClose( tpAniSirGlobal pMac )
     csrLLClose(&pMac->scan.channelPowerInfoList5G);
     csrScanDisable(pMac);
     vos_timer_destroy(&pMac->scan.hTimerGetResult);
-#ifdef WLAN_AP_STA_CONCURRENCY
-    vos_timer_destroy(&pMac->scan.hTimerStaApConcTimer);
-#endif
     vos_timer_destroy(&pMac->scan.hTimerIdleScan);
     return eHAL_STATUS_SUCCESS;
 }
@@ -320,31 +308,12 @@ eHalStatus csrQueueScanRequest(tpAniSirGlobal pMac, tANI_U8 sessionId,
     tANI_BOOLEAN fNoCmdPending;
     tSmeCmd *pQueueScanCmd=NULL;
     tSmeCmd *pSendScanCmd=NULL;
-    tANI_U8  nNumChanCombinedConc = 0;
     if (NULL == pScanCmd)
     {
         smsLog (pMac, LOGE, FL("Scan Req cmd is NULL"));
         return eHAL_STATUS_FAILURE;
     }
-    /* split scan if any one of the following:
-     * - STA session is connected and the scan is not a P2P search
-     * - any P2P session is connected
-     * Do not split scans if no concurrent infra connections are
-     * active and if the scan is a BG scan triggered by LFR (OR)
-     * any scan if LFR is in the middle of a BG scan. Splitting
-     * the scan is delaying the time it takes for LFR to find
-     * candidates and resulting in disconnects.
-     */
 
-    if(csrIsStaSessionConnected(pMac) &&
-       !csrIsP2pOrSapSessionConnected(pMac))
-    {
-      nNumChanCombinedConc = pMac->roam.configParam.nNumStaChanCombinedConc;
-    }
-    else if(csrIsP2pOrSapSessionConnected(pMac))
-    {
-      nNumChanCombinedConc = pMac->roam.configParam.nNumP2PChanCombinedConc;
-    }
     if ( (csrIsStaSessionConnected(pMac) &&
 #ifdef FEATURE_WLAN_LFR
          (csrIsConcurrentInfraConnected(pMac) ||
@@ -355,10 +324,7 @@ eHalStatus csrQueueScanRequest(tpAniSirGlobal pMac, tANI_U8 sessionId,
          (pScanCmd->u.scanCmd.u.scanRequest.p2pSearch != 1)) ||
             (csrIsP2pOrSapSessionConnected(pMac)))
     {
-        tCsrScanRequest scanReq;
         tANI_U8 numChn = pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels;
-        tCsrChannelInfo *pChnInfo = &scanReq.ChannelInfo;
-        tANI_U8    channelToScan[WNI_CFG_VALID_CHANNEL_LIST_LEN];
         tANI_BOOLEAN bMemAlloc = eANI_BOOLEAN_FALSE;
 
         if (numChn == 0)
@@ -386,98 +352,11 @@ eHalStatus csrQueueScanRequest(tpAniSirGlobal pMac, tANI_U8 sessionId,
             pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = numChn;
         }
 
-        //Whenever we get a scan request with multiple channels we break it up into 2 requests
-        //First request  for first channel to scan and second request to scan remaining channels
-        if ( numChn > nNumChanCombinedConc)
-        {
-            vos_mem_set(&scanReq, sizeof(tCsrScanRequest), 0);
-
-            pQueueScanCmd = csrGetCommandBuffer(pMac); //optimize this to use 2 command buffer only
-            if (!pQueueScanCmd)
-            {
-                if (bMemAlloc)
-                {
-                    vos_mem_free(pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList);
-                    pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = NULL;
-
-                }
-                smsLog( pMac, LOGE, FL(" Failed to get Queue command buffer") );
-                return eHAL_STATUS_FAILURE;
-            }
-            pQueueScanCmd->command = pScanCmd->command;
-            pQueueScanCmd->sessionId = pScanCmd->sessionId;
-            pQueueScanCmd->u.scanCmd.callback = pScanCmd->u.scanCmd.callback;
-            pQueueScanCmd->u.scanCmd.pContext = pScanCmd->u.scanCmd.pContext;
-            pQueueScanCmd->u.scanCmd.reason = pScanCmd->u.scanCmd.reason;
-            pQueueScanCmd->u.scanCmd.scanID = pMac->scan.nextScanID++; //let it wrap around
-
-            /* First copy all the parameters to local variable of scan request */
-            csrScanCopyRequest(pMac, &scanReq, &pScanCmd->u.scanCmd.u.scanRequest);
-
-            /* Now modify the elements of local var scan request required to be modified for split scan */
-            if(scanReq.ChannelInfo.ChannelList != NULL)
-            {
-                vos_mem_free(scanReq.ChannelInfo.ChannelList);
-                scanReq.ChannelInfo.ChannelList = NULL;
-            }
-
-            pChnInfo->numOfChannels = pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels - nNumChanCombinedConc;
-
-            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_WARN,
-                    FL(" &channelToScan %p pScanCmd(%p) pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList(%p)numChn(%d)"),
-                    &channelToScan[0], pScanCmd,
-                    pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList, numChn);
-
-            vos_mem_copy(&channelToScan[0],
-                     &pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[
-                     nNumChanCombinedConc],
-                     pChnInfo->numOfChannels * sizeof(tANI_U8));
-
-            pChnInfo->ChannelList = &channelToScan[0];
-
-            scanReq.BSSType = eCSR_BSS_TYPE_ANY;
-            //Use concurrency values for min/maxChnTime.
-            //We know csrIsAnySessionConnected(pMac) returns TRUE here
-            csrSetDefaultScanTiming(pMac, scanReq.scanType, &scanReq);
-
-            status = csrScanCopyRequest(pMac, &pQueueScanCmd->u.scanCmd.u.scanRequest, &scanReq);
-
-            if(!HAL_STATUS_SUCCESS(status))
-            {
-                if (bMemAlloc)
-                {
-                    vos_mem_free(pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList);
-                    pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = NULL;
-
-                }
-                if( scanReq.pIEField != NULL)
-                {
-                    vos_mem_free(scanReq.pIEField);
-                    scanReq.pIEField = NULL;
-                }
-                smsLog( pMac, LOGE, FL(" Failed to get copy csrScanRequest = %d"), status );
-                return eHAL_STATUS_FAILURE;
-            }
-            /* Clean the local scan variable */
-            scanReq.ChannelInfo.ChannelList = NULL;
-            scanReq.ChannelInfo.numOfChannels = 0;
-            csrScanFreeRequest(pMac, &scanReq);
-
-            /* setup the command to scan 2 channels */
-            pSendScanCmd = pScanCmd;
-            pSendScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = nNumChanCombinedConc;
-            pSendScanCmd->u.scanCmd.u.scanRequest.BSSType = eCSR_BSS_TYPE_ANY;
-            //Use concurrency values for min/maxChnTime.
-            //We know csrIsAnySessionConnected(pMac) returns TRUE here
-            csrSetDefaultScanTiming(pMac, pSendScanCmd->u.scanCmd.u.scanRequest.scanType, &pSendScanCmd->u.scanCmd.u.scanRequest);
-            pSendScanCmd->u.scanCmd.callback = NULL;
-        } else {
-            pSendScanCmd = pScanCmd;
-            pSendScanCmd->u.scanCmd.u.scanRequest.BSSType = eCSR_BSS_TYPE_ANY;
-            //Use concurrency values for min/maxChnTime.
-            //We know csrIsAnySessionConnected(pMac) returns TRUE here
-            csrSetDefaultScanTiming(pMac, pSendScanCmd->u.scanCmd.u.scanRequest.scanType, &pSendScanCmd->u.scanCmd.u.scanRequest);
-        }
+        pSendScanCmd = pScanCmd;
+        pSendScanCmd->u.scanCmd.u.scanRequest.BSSType = eCSR_BSS_TYPE_ANY;
+        //Use concurrency values for min/maxChnTime.
+        //We know csrIsAnySessionConnected(pMac) returns TRUE here
+        csrSetDefaultScanTiming(pMac, pSendScanCmd->u.scanCmd.u.scanRequest.scanType, &pSendScanCmd->u.scanCmd.u.scanRequest);
 
         fNoCmdPending = csrLLIsListEmpty( &pMac->scan.scanCmdPendingList, LL_ACCESS_LOCK );
 
@@ -735,6 +614,12 @@ eHalStatus csrScanRequest(tpAniSirGlobal pMac, tANI_U16 sessionId,
                     {
                         tANI_U32 numChn = pMac->scan.baseChannels.numChannels;
 
+                        if (numChn > WNI_CFG_VALID_CHANNEL_LIST_LEN) {
+                           smsLog(pMac, LOGE,
+                               FL("Invalid number of channels: %d"), numChn);
+                           status = eHAL_STATUS_FAILURE;
+                           break;
+                        }
                         vos_mem_set(&p11dScanCmd->u.scanCmd, sizeof(tScanCmd), 0);
                         pChnInfo->ChannelList = vos_mem_malloc(numChn);
                         if ( NULL == pChnInfo->ChannelList )
@@ -2424,6 +2309,12 @@ eHalStatus csrScanGetResult(tpAniSirGlobal pMac, tCsrScanResultFilter *pFilter,
                 if(csrLLIsListEmpty(&pRetList->List, LL_ACCESS_NOLOCK))
                 {
                     csrLLInsertTail(&pRetList->List, &pResult->Link, LL_ACCESS_NOLOCK);
+                } else if(pFilter &&
+                     vos_mem_compare(pResult->Result.BssDescriptor.bssId,
+                     pFilter->bssid_hint, VOS_MAC_ADDR_SIZE)) {
+                     /* bssid hint AP should be on head */
+                     csrLLInsertHead(&pRetList->List,
+                             &pResult->Link, LL_ACCESS_NOLOCK);
                 }
                 else
                 {
@@ -2435,7 +2326,18 @@ eHalStatus csrScanGetResult(tpAniSirGlobal pMac, tCsrScanResultFilter *pFilter,
                     while(pTmpEntry)
                     {
                         pTmpResult = GET_BASE_ADDR( pTmpEntry, tCsrScanResult, Link );
-                       if(csrIsBetterBss(pMac, pResult, pTmpResult))
+
+                        /* Skip the bssid hint AP, as it should be on head */
+                        if (pFilter &&
+                           vos_mem_compare(
+                           pTmpResult->Result.BssDescriptor.bssId,
+                           pFilter->bssid_hint, VOS_MAC_ADDR_SIZE)) {
+                            pTmpEntry = csrLLNext(&pRetList->List,
+                                           pTmpEntry, LL_ACCESS_NOLOCK);
+                            continue;
+                        }
+
+                        if (csrIsBetterBss(pMac, pResult, pTmpResult))
                         {
                             csrLLInsertEntry(&pRetList->List, pTmpEntry, &pResult->Link, LL_ACCESS_NOLOCK);
                             //To indicate we are done
@@ -2815,81 +2717,150 @@ eHalStatus csrScanCopyResultList(tpAniSirGlobal pMac, tScanResultHandle hIn, tSc
 
 eHalStatus csrScanningStateMsgProcessor( tpAniSirGlobal pMac, void *pMsgBuf )
 {
-    eHalStatus status = eHAL_STATUS_SUCCESS;
-    tSirMbMsg *pMsg = (tSirMbMsg *)pMsgBuf;
-
-    if((eWNI_SME_SCAN_RSP == pMsg->type) || (eWNI_SME_GET_SCANNED_CHANNEL_RSP == pMsg->type))
-    {
-        status = csrScanSmeScanResponse( pMac, pMsgBuf );
-    }
-    else
-    {
-        if(pMsg->type == eWNI_SME_UPPER_LAYER_ASSOC_CNF)
-        {
-            tCsrRoamSession  *pSession;
-            tSirSmeAssocIndToUpperLayerCnf *pUpperLayerAssocCnf;
-            tCsrRoamInfo roamInfo;
-            tCsrRoamInfo *pRoamInfo = NULL;
-            tANI_U32 sessionId;
-            eHalStatus status;
-            smsLog( pMac, LOG1, FL("Scanning : ASSOCIATION confirmation can be given to upper layer "));
-            vos_mem_set(&roamInfo, sizeof(tCsrRoamInfo), 0);
-            pRoamInfo = &roamInfo;
-            pUpperLayerAssocCnf = (tSirSmeAssocIndToUpperLayerCnf *)pMsgBuf;
-            status = csrRoamGetSessionIdFromBSSID( pMac, (tCsrBssid *)pUpperLayerAssocCnf->bssId, &sessionId );
-            pSession = CSR_GET_SESSION(pMac, sessionId);
-
-            if(!pSession)
-            {
-                smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
-                return eHAL_STATUS_FAILURE;
-            }
-
-            pRoamInfo->statusCode = eSIR_SME_SUCCESS; //send the status code as Success
-            pRoamInfo->u.pConnectedProfile = &pSession->connectedProfile;
-            pRoamInfo->staId = (tANI_U8)pUpperLayerAssocCnf->aid;
-            pRoamInfo->rsnIELen = (tANI_U8)pUpperLayerAssocCnf->rsnIE.length;
-            pRoamInfo->prsnIE = pUpperLayerAssocCnf->rsnIE.rsnIEdata;
-            pRoamInfo->addIELen = (tANI_U8)pUpperLayerAssocCnf->addIE.length;
-            pRoamInfo->paddIE = pUpperLayerAssocCnf->addIE.addIEdata;
-            vos_mem_copy(pRoamInfo->peerMac, pUpperLayerAssocCnf->peerMacAddr, sizeof(tSirMacAddr));
-            vos_mem_copy(&pRoamInfo->bssid, pUpperLayerAssocCnf->bssId, sizeof(tCsrBssid));
-            pRoamInfo->wmmEnabledSta = pUpperLayerAssocCnf->wmmEnabledSta;
-            if(CSR_IS_INFRA_AP(pRoamInfo->u.pConnectedProfile) )
-            {
-                pMac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED;
-                pRoamInfo->fReassocReq = pUpperLayerAssocCnf->reassocReq;
-                status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_INFRA_ASSOCIATION_CNF);
-            }
-            if(CSR_IS_WDS_AP( pRoamInfo->u.pConnectedProfile))
-            {
-                vos_sleep( 100 );
-                pMac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_WDS_CONNECTED;//Sta
-                status = csrRoamCallCallback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_WDS_IND, eCSR_ROAM_RESULT_WDS_ASSOCIATION_IND);//Sta
-            }
-
-        }
-        else
-        {
-
-            if( csrIsAnySessionInConnectState( pMac ) )
-            {
-                //In case of we are connected, we need to check whether connect status changes
-                //because scan may also run while connected.
-                csrRoamCheckForLinkStatusChange( pMac, ( tSirSmeRsp * )pMsgBuf );
-            }
-            else
-            {
-                smsLog( pMac, LOGW, "Message [0x%04x] received in state, when expecting Scan Response", pMsg->type );
-            }
-        }
-    }
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	tSirMbMsg *pMsg = (tSirMbMsg *)pMsgBuf;
+	tSirSmeDisConDoneInd *pDisConDoneInd;
+	tCsrRoamInfo roamInfo = {0};
+	tCsrRoamSession  *pSession;
+
+	if ((eWNI_SME_SCAN_RSP == pMsg->type) ||
+	    (eWNI_SME_GET_SCANNED_CHANNEL_RSP == pMsg->type)) {
+		status = csrScanSmeScanResponse( pMac, pMsgBuf );
+	} else {
+		switch (pMsg->type) {
+		case eWNI_SME_UPPER_LAYER_ASSOC_CNF:
+		{
+			tSirSmeAssocIndToUpperLayerCnf *pUpperLayerAssocCnf;
+			tCsrRoamInfo *pRoamInfo = NULL;
+			tANI_U32 sessionId;
+			eHalStatus status;
+
+			smsLog(pMac, LOG1,
+			       FL("Scanning : ASSOCIATION confirmation can be given to upper layer "));
+
+			pRoamInfo = &roamInfo;
+			pUpperLayerAssocCnf =
+				(tSirSmeAssocIndToUpperLayerCnf *)pMsgBuf;
+			status = csrRoamGetSessionIdFromBSSID( pMac,
+					(tCsrBssid *)pUpperLayerAssocCnf->bssId,
+					&sessionId );
+			pSession = CSR_GET_SESSION(pMac, sessionId);
+			if(!pSession) {
+				smsLog(pMac, LOGE,
+					FL("  session %d not found "),
+					sessionId);
+				return eHAL_STATUS_FAILURE;
+			}
+				//send the status code as Success
+			pRoamInfo->statusCode = eSIR_SME_SUCCESS;
+			pRoamInfo->u.pConnectedProfile =
+				&pSession->connectedProfile;
+			pRoamInfo->staId = (tANI_U8)pUpperLayerAssocCnf->aid;
+			pRoamInfo->rsnIELen =
+				(tANI_U8)pUpperLayerAssocCnf->rsnIE.length;
+			pRoamInfo->prsnIE =
+				pUpperLayerAssocCnf->rsnIE.rsnIEdata;
+			pRoamInfo->addIELen =
+				(tANI_U8)pUpperLayerAssocCnf->addIE.length;
+			pRoamInfo->paddIE =
+				pUpperLayerAssocCnf->addIE.addIEdata;
+			vos_mem_copy(pRoamInfo->peerMac,
+				     pUpperLayerAssocCnf->peerMacAddr,
+				     sizeof(tSirMacAddr));
+			vos_mem_copy(&pRoamInfo->bssid,
+				     pUpperLayerAssocCnf->bssId,
+				     sizeof(tCsrBssid));
+			pRoamInfo->wmmEnabledSta =
+				pUpperLayerAssocCnf->wmmEnabledSta;
+			if (CSR_IS_INFRA_AP(pRoamInfo->u.pConnectedProfile)) {
+				pMac->roam.roamSession[sessionId].connectState =
+					eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED;
+				pRoamInfo->fReassocReq =
+					pUpperLayerAssocCnf->reassocReq;
+				status = csrRoamCallCallback(pMac, sessionId,
+					pRoamInfo, 0,
+					eCSR_ROAM_INFRA_IND,
+					eCSR_ROAM_RESULT_INFRA_ASSOCIATION_CNF);
+			}
+			if(CSR_IS_WDS_AP( pRoamInfo->u.pConnectedProfile)) {
+				vos_sleep( 100 );
+				pMac->roam.roamSession[sessionId].connectState =
+					//Sta
+					eCSR_ASSOC_STATE_TYPE_WDS_CONNECTED;
+				status = csrRoamCallCallback(pMac,
+					sessionId, pRoamInfo, 0,
+					eCSR_ROAM_WDS_IND,
+					//Sta
+					eCSR_ROAM_RESULT_WDS_ASSOCIATION_IND);
+			}
+			break;
+		}
+		case eWNI_SME_DISCONNECT_DONE_IND:
+			pDisConDoneInd = (tSirSmeDisConDoneInd *)(pMsg);
+
+			smsLog( pMac, LOG1,
+				FL("eWNI_SME_DISCONNECT_DONE_IND RC:%d"),
+				pDisConDoneInd->reasonCode);
+			pSession = CSR_GET_SESSION(pMac,
+					pDisConDoneInd->sessionId);
+			if (!pSession) {
+				smsLog(pMac, LOGE, FL("Invalid session"));
+				return eHAL_STATUS_FAILURE;
+			}
+			if (CSR_IS_SESSION_VALID(pMac,
+				pDisConDoneInd->sessionId))
+			{
+				roamInfo.reasonCode =
+					pDisConDoneInd->reasonCode;
+				roamInfo.statusCode =
+					eSIR_SME_STA_DISASSOCIATED;
+				vos_mem_copy(roamInfo.peerMac,
+					pDisConDoneInd->peerMacAddr,
+					sizeof(tSirMacAddr));
+				status = csrRoamCallCallback(pMac,
+					pDisConDoneInd->sessionId,
+					&roamInfo, 0,
+					eCSR_ROAM_LOSTLINK,
+					eCSR_ROAM_RESULT_DISASSOC_IND);
+
+				/*
+				 * Update the previous state if
+				 * previous to eCSR_ROAMING_STATE_IDLE
+				 * as we are disconnected and
+				 * currunt state is scanning
+				 */
+				if (!CSR_IS_INFRA_AP(
+				    &pSession->connectedProfile))
+					pMac->roam.prev_state[
+						pDisConDoneInd->sessionId] =
+						eCSR_ROAMING_STATE_IDLE;
+			}
+			else
+			{
+				smsLog(pMac, LOGE, FL("Inactive session %d"),
+					pDisConDoneInd->sessionId);
+				status = eHAL_STATUS_FAILURE;
+			}
+			break;
 
-    return (status);
+		default :
+			if (csrIsAnySessionInConnectState(pMac)) {
+				/* In case of we are connected, we need to check
+				 * whether connect status changes because scan
+				 * may also run while connected.
+				 */
+				csrRoamCheckForLinkStatusChange( pMac,
+							(tSirSmeRsp *)pMsgBuf );
+			} else {
+				smsLog( pMac, LOGW,
+				"Message [0x%04x] received in state, when expecting Scan Response",
+				pMsg->type );
+			}
+		}
+	}
+	return (status);
 }
 
-
-
 void csrCheckNSaveWscIe(tpAniSirGlobal pMac, tSirBssDescription *pNewBssDescr, tSirBssDescription *pOldBssDescr)
 {
     int idx, len;
@@ -2900,8 +2871,7 @@ void csrCheckNSaveWscIe(tpAniSirGlobal pMac, tSirBssDescription *pNewBssDescr, t
        (0 == pNewBssDescr->WscIeLen))
     {
         idx = 0;
-        len = pOldBssDescr->length - sizeof(tSirBssDescription) +
-                sizeof(tANI_U16) + sizeof(tANI_U32) - DOT11F_IE_WSCPROBERES_MIN_LEN - 2;
+        len = GET_IE_LEN_IN_BSS(pOldBssDescr->length) - DOT11F_IE_WSCPROBERES_MIN_LEN - 2;
         pbIe = (tANI_U8 *)pOldBssDescr->ieFields;
         //Save WPS IE if it exists
         pNewBssDescr->WscIeLen = 0;
@@ -3235,7 +3205,7 @@ static void csrMoveTempScanResultsToMainList(tpAniSirGlobal pMac,
           )
         {
             smsLog(pMac, LOG1, FL("########## BSS Limit reached ###########"));
-            csr_purge_old_scan_results(pMac);
+            csr_purge_scan_result(pMac);
         }
         // check for duplicate scan results
         if ( !fDupBss )
@@ -3341,47 +3311,62 @@ end:
 }
 
 /**
- * csr_purge_old_scan_results() - This function removes old scan entries
+ * csr_purge_scan_results() - This function removes scan entry based
+ * on RSSI or AGE
  * @mac_ctx: pointer to Global MAC structure
  *
- * This function removes old scan entries
+ * This function removes scan entry based on RSSI or AGE.
+ * If an scan entry with RSSI less than CSR_PURGE_RSSI_THRESHOLD,
+ * the scan entry is removed else oldest entry is removed.
  *
  * Return: None
  */
 
-void csr_purge_old_scan_results(tpAniSirGlobal mac_ctx)
+void csr_purge_scan_result(tpAniSirGlobal mac_ctx)
 {
 	tListElem *pentry, *tmp_entry;
-	tCsrScanResult *presult, *oldest_bss = NULL;
-    v_TIME_t oldest_entry = 0;
-    v_TIME_t curr_time = vos_timer_get_system_time();
+	tCsrScanResult *presult, *oldest_bss = NULL, *weakest_bss = NULL;
+	v_TIME_t oldest_entry = 0;
+	v_TIME_t curr_time = vos_timer_get_system_time();
+	tANI_S8 weakest_rssi = 0;
 
 	csrLLLock(&mac_ctx->scan.scanResultList);
 	pentry = csrLLPeekHead(&mac_ctx->scan.scanResultList, LL_ACCESS_NOLOCK);
-	while(pentry)
-	{
+	while (pentry) {
 		tmp_entry = csrLLNext(&mac_ctx->scan.scanResultList, pentry,
 			LL_ACCESS_NOLOCK);
 		presult = GET_BASE_ADDR(pentry, tCsrScanResult, Link);
-		if((curr_time - presult->Result.BssDescriptor.nReceivedTime) >
-		    oldest_entry) {
+		if ((curr_time -
+		   presult->Result.BssDescriptor.nReceivedTime) >
+		   oldest_entry) {
 			oldest_entry = curr_time -
 				presult->Result.BssDescriptor.nReceivedTime;
 			oldest_bss = presult;
 		}
+		if (presult->Result.BssDescriptor.rssi < weakest_rssi) {
+			weakest_rssi = presult->Result.BssDescriptor.rssi;
+			weakest_bss = presult;
+		}
 		pentry = tmp_entry;
 	}
 	if (oldest_bss) {
+		tCsrScanResult *bss_to_remove;
+
+		if (weakest_rssi < CSR_PURGE_RSSI_THRESHOLD)
+			bss_to_remove = weakest_bss;
+		else
+			bss_to_remove = oldest_bss;
 		/* Free the old BSS Entries */
-		if(csrLLRemoveEntry(&mac_ctx->scan.scanResultList,
-		   &oldest_bss->Link, LL_ACCESS_NOLOCK)) {
+		if (csrLLRemoveEntry(&mac_ctx->scan.scanResultList,
+		   &bss_to_remove->Link, LL_ACCESS_NOLOCK)) {
 			smsLog(mac_ctx, LOG1,
-				FL("Current time delta (%lu) of BSSID to be removed" MAC_ADDRESS_STR),
-				(curr_time -
-				oldest_bss->Result.BssDescriptor.nReceivedTime),
+				FL("BSSID: "MAC_ADDRESS_STR" Removed, time delta (%lu) RSSI %d"),
 				MAC_ADDR_ARRAY(
-				oldest_bss->Result.BssDescriptor.bssId));
-			csrFreeScanResultEntry(mac_ctx, oldest_bss);
+				bss_to_remove->Result.BssDescriptor.bssId),
+				(curr_time -
+				bss_to_remove->Result.BssDescriptor.nReceivedTime),
+				bss_to_remove->Result.BssDescriptor.rssi);
+			csrFreeScanResultEntry(mac_ctx, bss_to_remove);
 		}
 	}
 	csrLLUnlock(&mac_ctx->scan.scanResultList);
@@ -5111,9 +5096,6 @@ static tANI_BOOLEAN csrScanProcessScanResults( tpAniSirGlobal pMac, tSmeCmd *pCo
     eHalStatus status;
     tANI_U32 cbScanResult = GET_FIELD_OFFSET( tSirSmeScanRsp, bssDescription )
                             + sizeof(tSirBssDescription);    //We need at least one CB
-    tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
-                              &pMac->roam.neighborRoamInfo[pScanRsp->sessionId];
-
     /*
      * Don't consider the scan rsp to be valid if the status code is Scan
      * Failure.  Scan Failure is returned when the scan could not find anything.
@@ -5237,7 +5219,7 @@ static tANI_BOOLEAN csrScanProcessScanResults( tpAniSirGlobal pMac, tSmeCmd *pCo
     }while(0);
     if ( eSIR_SME_MORE_SCAN_RESULTS_FOLLOW != pScanRsp->statusCode )
     {
-        smsLog(pMac, LOGE, "Found %d BSS, statusCode %d",
+        smsLog(pMac, LOGW, "Found %d BSS, statusCode %d",
                            csrLLCount(&pMac->scan.tempScanResults),
                            pScanRsp->statusCode);
         smsLog(pMac, LOG1, "scan reason is %d", pCommand->u.scanCmd.reason);
@@ -5271,46 +5253,6 @@ static tANI_BOOLEAN csrScanProcessScanResults( tpAniSirGlobal pMac, tSmeCmd *pCo
         pMac->scan.defer_update_channel_list = false;
     }
 
-#ifdef WLAN_AP_STA_CONCURRENCY
-    if (pMac->fScanOffload)
-        return fRet;
-
-    if (!csrLLIsListEmpty( &pMac->scan.scanCmdPendingList, LL_ACCESS_LOCK ))
-    {
-        /* Pending scan commands in the list because the previous scan command
-         * was split into a scan command on one channel + a scan command for all
-         * remaining channels.
-         *
-         * Start timer to trigger processing of the next scan command.
-         * NOTE for LFR:
-         * Do not split scans if no concurrent infra connections are
-         * active and if the scan is a BG scan triggered by LFR (OR)
-         * any scan if LFR is in the middle of a BG scan. Splitting
-         * the scan is delaying the time it takes for LFR to find
-         * candidates and resulting in disconnects.
-         */
-        if ((csrIsStaSessionConnected(pMac) &&
-#ifdef FEATURE_WLAN_LFR
-            (csrIsConcurrentInfraConnected(pMac) ||
-            ((pCommand->u.scanCmd.reason != eCsrScanBgScan) &&
-            (pNeighborRoamInfo->neighborRoamState !=
-                       eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN))) &&
-#endif
-            (pCommand->u.scanCmd.u.scanRequest.p2pSearch != 1)) ||
-            (csrIsP2pOrSapSessionConnected(pMac)))
-        {
-            /* if active connected sessions present then continue to split scan
-             * with specified interval between consecutive scans */
-            csrSetDefaultScanTiming(pMac, pCommand->u.scanCmd.u.scanRequest.scanType, &(pCommand->u.scanCmd.u.scanRequest));
-            vos_timer_start(&pMac->scan.hTimerStaApConcTimer,
-                pCommand->u.scanCmd.u.scanRequest.restTime);
-        } else {
-            /* if no connected sessions present then initiate next scan command immediately */
-            /* minimum timer granularity is 10ms */
-            vos_timer_start(&pMac->scan.hTimerStaApConcTimer, 10);
-        }
-    }
-#endif
     return (fRet);
 }
 
@@ -5499,6 +5441,11 @@ eHalStatus csrScanSmeScanResponse( tpAniSirGlobal pMac, void *pMsgBuf )
                 smsLog( pMac, LOGE, "CSR: Unable to store scan results for PNO" );
                 status = eHAL_STATUS_FAILURE;
             }
+            else {
+                /* Purge the scan results based on Aging */
+                if (pMac->scan.scanResultCfgAgingTime)
+                    csrPurgeScanResultByAge(pMac);
+            }
         }
 #endif
         else
@@ -5515,6 +5462,11 @@ eHalStatus csrScanSmeScanResponse( tpAniSirGlobal pMac, void *pMsgBuf )
             smsLog( pMac, LOGE, "CSR: Unable to store scan results for PNO" );
             status = eHAL_STATUS_FAILURE;
         }
+        else {
+            /* Purge the scan results based on Aging */
+            if (pMac->scan.scanResultCfgAgingTime)
+                csrPurgeScanResultByAge(pMac);
+        }
     }
 #endif
     else if (pMac->pnoOffload == FALSE)
@@ -5658,9 +5610,6 @@ tANI_BOOLEAN csrScanAgeOutBss(tpAniSirGlobal pMac, tCsrScanResult *pResult)
     }
     else
     {
-        smsLog(pMac, LOGW, "Aging out BSS "MAC_ADDRESS_STR" Channel %d",
-               MAC_ADDR_ARRAY(pResult->Result.BssDescriptor.bssId),
-               pResult->Result.BssDescriptor.channelId);
         //No need to hold the spin lock because caller should hold the lock for pMac->scan.scanResultList
         if(csrLLRemoveEntry(&pMac->scan.scanResultList, &pResult->Link,
                                  LL_ACCESS_NOLOCK))
@@ -5741,7 +5690,8 @@ eHalStatus csrSendMBScanReq( tpAniSirGlobal pMac, tANI_U16 sessionId,
 
     msgLen = (tANI_U16)(sizeof( tSirSmeScanReq ) - sizeof( pMsg->channelList.channelNumber ) +
                         ( sizeof( pMsg->channelList.channelNumber ) * pScanReq->ChannelInfo.numOfChannels )) +
-                   ( pScanReq->uIEFieldLen ) ;
+                   ( pScanReq->uIEFieldLen ) +
+                   pScanReq->num_vendor_oui * sizeof(struct vendor_oui);
 
     pMsg = vos_mem_malloc(msgLen);
     if ( NULL == pMsg )
@@ -5905,6 +5855,36 @@ eHalStatus csrSendMBScanReq( tpAniSirGlobal pMac, tANI_U16 sessionId,
                 pMsg->backgroundScanMode = eSIR_ROAMING_SCAN;
             }
 
+            pMsg->enable_scan_randomization =
+                                       pScanReq->enable_scan_randomization;
+            if (pMsg->enable_scan_randomization) {
+                vos_mem_copy(pMsg->mac_addr, pScanReq->mac_addr,
+                             VOS_MAC_ADDR_SIZE);
+                vos_mem_copy(pMsg->mac_addr_mask, pScanReq->mac_addr_mask,
+                             VOS_MAC_ADDR_SIZE);
+            }
+
+            pMsg->ie_whitelist = pScanReq->ie_whitelist;
+            if (pMsg->ie_whitelist)
+                vos_mem_copy(pMsg->probe_req_ie_bitmap,
+                             pScanReq->probe_req_ie_bitmap,
+                             PROBE_REQ_BITMAP_LEN * sizeof(uint32_t));
+            pMsg->num_vendor_oui = pScanReq->num_vendor_oui;
+            pMsg->oui_field_len = pScanReq->num_vendor_oui *
+                                  sizeof(struct vendor_oui);
+            pMsg->oui_field_offset = (tANI_U16)(sizeof( tSirSmeScanReq ) -
+                                   sizeof( pMsg->channelList.channelNumber ) +
+                                   (sizeof( pMsg->channelList.channelNumber ) *
+                                   pScanReq->ChannelInfo.numOfChannels )) +
+                                   pScanReq->uIEFieldLen;
+
+            if (pScanReq->num_vendor_oui != 0)
+            {
+                vos_mem_copy((tANI_U8 *)pMsg + pMsg->oui_field_offset,
+                             (uint8_t*)(pScanReq->voui),
+                             pMsg->oui_field_len);
+            }
+
         }while(0);
         smsLog(pMac, LOG1, FL("domainIdCurrent %s (%d) scanType %s (%d)"
                               "bssType %s (%d), requestType %s(%d)"
@@ -6117,21 +6097,21 @@ eHalStatus csrProcessScanCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand )
     {
         for( i = 0; i < CSR_ROAM_SESSION_MAX; i++ )
         {
-            pCommand->u.scanCmd.lastRoamState[i] =
+            pMac->roam.prev_state[i]=
                 csrRoamStateChange( pMac, eCSR_ROAMING_STATE_SCANNING, i);
             smsLog( pMac, LOG3, "starting SCAN command from %d state...."
-                    " reason is %d", pCommand->u.scanCmd.lastRoamState[i],
+                    " reason is %d", pMac->roam.prev_state[i],
                     pCommand->u.scanCmd.reason );
         }
     }
     else
     {
-        pCommand->u.scanCmd.lastRoamState[pCommand->sessionId] =
+        pMac->roam.prev_state[pCommand->sessionId] =
             csrRoamStateChange(pMac, eCSR_ROAMING_STATE_SCANNING,
                                pCommand->sessionId);
         smsLog( pMac, LOG3,
                 "starting SCAN command from %d state.... reason is %d",
-                pCommand->u.scanCmd.lastRoamState[pCommand->sessionId],
+                pMac->roam.prev_state[pCommand->sessionId],
                 pCommand->u.scanCmd.reason );
     }
 
@@ -6385,6 +6365,7 @@ eHalStatus csrScanCopyRequest(tpAniSirGlobal pMac, tCsrScanRequest *pDstReq, tCs
             pDstReq->pIEField = NULL;
             pDstReq->ChannelInfo.ChannelList = NULL;
             pDstReq->SSIDs.SSIDList = NULL;
+            pDstReq->voui = NULL;
 
             if(pSrcReq->uIEFieldLen == 0)
             {
@@ -6525,7 +6506,19 @@ eHalStatus csrScanCopyRequest(tpAniSirGlobal pMac, tCsrScanRequest *pDstReq, tCs
                                             break;
                                         }
                                     }
-                                    if (is_unsafe_chan) {
+                                    if (is_unsafe_chan &&
+                                       ((CSR_IS_CHANNEL_24GHZ(
+                                                    pSrcReq->ChannelInfo.
+                                                    ChannelList[index]) &&
+                                        pMac->roam.configParam.sta_roam_policy.
+                                              sap_operating_band ==
+                                              eCSR_BAND_24) ||
+                                        (CSR_IS_CHANNEL_5GHZ(
+                                                    pSrcReq->ChannelInfo.
+                                                    ChannelList[index]) &&
+                                         pMac->roam.configParam.sta_roam_policy.
+                                              sap_operating_band ==
+                                              eCSR_BAND_5G))) {
                                         smsLog(pMac, LOG2,
                                             FL("ignoring unsafe channel %d"),
                                             pSrcReq->ChannelInfo.
@@ -6615,6 +6608,35 @@ eHalStatus csrScanCopyRequest(tpAniSirGlobal pMac, tCsrScanRequest *pDstReq, tCs
             pDstReq->p2pSearch = pSrcReq->p2pSearch;
             pDstReq->skipDfsChnlInP2pSearch = pSrcReq->skipDfsChnlInP2pSearch;
 
+            if (pSrcReq->num_vendor_oui == 0)
+            {
+                pDstReq->num_vendor_oui = 0;
+                pDstReq->voui = NULL;
+            }
+            else
+            {
+                pDstReq->voui = vos_mem_malloc(pSrcReq->num_vendor_oui *
+                                         sizeof(*pDstReq->voui));
+                if (NULL == pDstReq->voui)
+                        status = eHAL_STATUS_FAILURE;
+                else
+                        status = eHAL_STATUS_SUCCESS;
+
+                if (HAL_STATUS_SUCCESS(status))
+                {
+                    pDstReq->num_vendor_oui = pSrcReq->num_vendor_oui;
+                    vos_mem_copy(pDstReq->voui,
+                                 pSrcReq->voui,
+                                 pSrcReq->num_vendor_oui *
+                                 sizeof(*pDstReq->voui));
+                }
+                else
+                {
+                    pDstReq->num_vendor_oui = 0;
+                    smsLog(pMac, LOGE, FL("No memory for voui"));
+                    break;
+                }
+            }
         }
     }while(0);
 
@@ -6649,6 +6671,13 @@ eHalStatus csrScanFreeRequest(tpAniSirGlobal pMac, tCsrScanRequest *pReq)
     }
     pReq->SSIDs.numOfSSIDs = 0;
 
+    if(pReq->voui)
+    {
+        vos_mem_free(pReq->voui);
+        pReq->voui = NULL;
+    }
+    pReq->num_vendor_oui = 0;
+
     return eHAL_STATUS_SUCCESS;
 }
 
@@ -6658,14 +6687,19 @@ void csrScanCallCallback(tpAniSirGlobal pMac, tSmeCmd *pCommand, eCsrScanStatus
     if(pCommand->u.scanCmd.callback)
     {
         if (pCommand->u.scanCmd.abort_scan_indication) {
-             smsLog(pMac, LOG1, FL("scanDone due to abort"));
-             scanStatus = eCSR_SCAN_ABORT;
+             if ((pCommand->u.scanCmd.reason != eCsrScanForSsid) ||
+                 (scanStatus != eCSR_SCAN_SUCCESS)) {
+                 smsLog( pMac, LOG1, FL("scanDone due to abort"));
+                 scanStatus = eCSR_SCAN_ABORT;
+             }
         }
         pCommand->u.scanCmd.callback(pMac, pCommand->u.scanCmd.pContext,
                                      pCommand->sessionId,
                                      pCommand->u.scanCmd.scanID, scanStatus);
     } else {
-        smsLog( pMac, LOG2, "%s:%d - Callback NULL!!!", __func__, __LINE__);
+        smsLog(pMac, LOG2,
+               FL("Callback NULL cmd reason %d"),
+               pCommand->u.scanCmd.reason);
     }
 }
 
@@ -6709,145 +6743,6 @@ void csrScanGetResultTimerHandler(void *pv)
     vos_timer_start(&pMac->scan.hTimerGetResult, CSR_SCAN_GET_RESULT_INTERVAL/VOS_TIMER_TO_MS_UNIT);
 }
 
-#ifdef WLAN_AP_STA_CONCURRENCY
-static void csrStaApConcTimerHandler(void *pv)
-{
-    tpAniSirGlobal pMac = PMAC_STRUCT( pv );
-    tListElem *pEntry;
-    tSmeCmd *pScanCmd;
-    tANI_U32 sessionId = CSR_SESSION_ID_INVALID;
-
-    csrLLLock(&pMac->scan.scanCmdPendingList);
-
-    if ( NULL != ( pEntry = csrLLPeekHead( &pMac->scan.scanCmdPendingList, LL_ACCESS_NOLOCK) ) )
-    {
-        tCsrScanRequest scanReq;
-        tSmeCmd *pSendScanCmd = NULL;
-        tANI_U8 numChn = 0;
-        tANI_U8 nNumChanCombinedConc = 0;
-        tANI_U8 i, j;
-        tCsrChannelInfo *pChnInfo = &scanReq.ChannelInfo;
-        tANI_U8    channelToScan[WNI_CFG_VALID_CHANNEL_LIST_LEN];
-        eHalStatus status;
-
-        pScanCmd = GET_BASE_ADDR( pEntry, tSmeCmd, Link );
-        numChn = pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels;
-        sessionId = pScanCmd->sessionId;
-
-        /* if any session is connected and the number of channels to scan is
-         * greater than 1 then split the scan into multiple scan operations
-         * on each individual channel else continue to perform scan on all
-         * specified channels */
-
-        /* split scan if number of channels to scan is greater than 1 and
-         * any one of the following:
-         * - STA session is connected and the scan is not a P2P search
-         * - any P2P session is connected
-         * Do not split scans if no concurrent infra connections are
-         * active and if the scan is a BG scan triggered by LFR (OR)
-         * any scan if LFR is in the middle of a BG scan. Splitting
-         * the scan is delaying the time it takes for LFR to find
-         * candidates and resulting in disconnects.
-         */
-
-        if((csrIsStaSessionConnected(pMac) &&
-           !csrIsP2pOrSapSessionConnected(pMac)))
-        {
-           nNumChanCombinedConc = pMac->roam.configParam.nNumStaChanCombinedConc;
-        }
-        else if(csrIsP2pOrSapSessionConnected(pMac))
-        {
-           nNumChanCombinedConc = pMac->roam.configParam.nNumP2PChanCombinedConc;
-        }
-
-        if ( (numChn > nNumChanCombinedConc) &&
-                ((csrIsStaSessionConnected(pMac) &&
-#ifdef FEATURE_WLAN_LFR
-                  (csrIsConcurrentInfraConnected(pMac) ||
-                   ((pScanCmd->u.scanCmd.reason != eCsrScanBgScan) &&
-                    (pMac->roam.neighborRoamInfo[sessionId].neighborRoamState !=
-                     eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN))) &&
-#endif
-                  (pScanCmd->u.scanCmd.u.scanRequest.p2pSearch != 1)) ||
-              (csrIsP2pOrSapSessionConnected(pMac))))
-        {
-             vos_mem_set(&scanReq, sizeof(tCsrScanRequest), 0);
-
-             pSendScanCmd = csrGetCommandBuffer(pMac); //optimize this to use 2 command buffer only
-             if (!pSendScanCmd)
-             {
-                 smsLog( pMac, LOGE, FL(" Failed to get Queue command buffer") );
-                 csrLLUnlock(&pMac->scan.scanCmdPendingList);
-                 return;
-             }
-             pSendScanCmd->command = pScanCmd->command;
-             pSendScanCmd->sessionId = pScanCmd->sessionId;
-             pSendScanCmd->u.scanCmd.callback = NULL;
-             pSendScanCmd->u.scanCmd.pContext = pScanCmd->u.scanCmd.pContext;
-             pSendScanCmd->u.scanCmd.reason = pScanCmd->u.scanCmd.reason;
-             pSendScanCmd->u.scanCmd.scanID = pMac->scan.nextScanID++; //let it wrap around
-
-             /* First copy all the parameters to local variable of scan request */
-             csrScanCopyRequest(pMac, &scanReq, &pScanCmd->u.scanCmd.u.scanRequest);
-
-             /* Now modify the elements of local var scan request required to be modified for split scan */
-             if(scanReq.ChannelInfo.ChannelList != NULL)
-             {
-                 vos_mem_free(scanReq.ChannelInfo.ChannelList);
-                 scanReq.ChannelInfo.ChannelList = NULL;
-             }
-
-             pChnInfo->numOfChannels = nNumChanCombinedConc;
-             vos_mem_copy(&channelToScan[0],
-                          &pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[0],
-                          pChnInfo->numOfChannels * sizeof(tANI_U8));//just send one channel
-             pChnInfo->ChannelList = &channelToScan[0];
-
-             for (i = 0, j = nNumChanCombinedConc; i < (numChn-nNumChanCombinedConc); i++, j++)
-             {
-                 pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[i] =
-                 pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList[j]; //Move all the channels one step
-             }
-
-             pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = numChn - nNumChanCombinedConc; //reduce outstanding # of channels to be scanned
-
-             scanReq.BSSType = eCSR_BSS_TYPE_ANY;
-             //Use concurrency values for min/maxChnTime.
-             csrSetDefaultScanTiming(pMac, scanReq.scanType, &scanReq);
-
-             status = csrScanCopyRequest(pMac, &pSendScanCmd->u.scanCmd.u.scanRequest, &scanReq);
-             if(!HAL_STATUS_SUCCESS(status))
-             {
-                 smsLog( pMac, LOGE, FL(" Failed to get copy csrScanRequest = %d"), status );
-                 csrLLUnlock(&pMac->scan.scanCmdPendingList);
-                 return;
-             }
-             /* Clean the local scan variable */
-             scanReq.ChannelInfo.ChannelList = NULL;
-             scanReq.ChannelInfo.numOfChannels = 0;
-             csrScanFreeRequest(pMac, &scanReq);
-        }
-        else
-        {
-             /* no active connected session present or numChn == 1
-              * scan all remaining channels */
-             pSendScanCmd = pScanCmd;
-             //remove this command from pending list
-             if (csrLLRemoveHead( &pMac->scan.scanCmdPendingList, LL_ACCESS_NOLOCK) == NULL)
-             { //In case between PeekHead and here, the entry got removed by another thread.
-                 smsLog( pMac, LOGE, FL(" Failed to remove entry from scanCmdPendingList"));
-             }
-
-        }
-        csrQueueSmeCommand(pMac, pSendScanCmd, eANI_BOOLEAN_FALSE);
-
-    }
-
-    csrLLUnlock(&pMac->scan.scanCmdPendingList);
-
-}
-#endif
-
 static void csrPurgeScanResultByAge(void *pv)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT( pv );
@@ -6869,8 +6764,10 @@ static void csrPurgeScanResultByAge(void *pv)
 
         if((curTime - pResult->Result.BssDescriptor.nReceivedTime) > ageOutTime)
         {
-            smsLog(pMac, LOG1, FL("age out due to time out for BSSID" MAC_ADDRESS_STR),
-                           MAC_ADDR_ARRAY(pResult->Result.BssDescriptor.bssId));
+            smsLog(pMac, LOG1,
+                   FL("age out for BSSID" MAC_ADDRESS_STR" Channel %d"),
+                   MAC_ADDR_ARRAY(pResult->Result.BssDescriptor.bssId),
+                   pResult->Result.BssDescriptor.channelId);
             csrScanAgeOutBss(pMac, pResult);
         }
         pEntry = tmpEntry;
@@ -7345,12 +7242,13 @@ void csrReleaseScanCommand(tpAniSirGlobal pMac, tSmeCmd *pCommand, eCsrScanStatu
     {
         tANI_U32 i;
         for(i = 0; i < CSR_ROAM_SESSION_MAX; i++)
-            csrRoamStateChange(pMac, pCommand->u.scanCmd.lastRoamState[i], i);
+            csrRoamStateChange(pMac,
+              pMac->roam.prev_state[i], i);
     }
     else
     {
         csrRoamStateChange(pMac,
-                pCommand->u.scanCmd.lastRoamState[pCommand->sessionId],
+                pMac->roam.prev_state[pCommand->sessionId],
                 pCommand->sessionId);
     }
 
@@ -7502,7 +7400,39 @@ eHalStatus csrScanGetBKIDCandidateList(tpAniSirGlobal pMac, tANI_U32 sessionId,
 }
 #endif /* FEATURE_WLAN_WAPI */
 
+/**
+ * csr_ssid_scan_done_callback() - Callback to indicate
+ *                            scan is done for ssid scan
+ * @halHandle: handle to hal
+ * @context: SSID scan context
+ * @scanId: Scan id for the scheduled scan
+ * @status: scan done status
+ *
+ * Return - eHalStatus
+ */
+static eHalStatus csr_ssid_scan_done_callback(tHalHandle halHandle,
+					      void *context,
+					      tANI_U8 sessionId,
+					      tANI_U32 scanId,
+					      eCsrScanStatus status)
+{
+	struct csr_scan_for_ssid_context *scan_context =
+		(struct csr_scan_for_ssid_context *)context;
+
+	if (NULL == scan_context) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				FL("scan for ssid context not found"));
+		return eHAL_STATUS_FAILURE;
+	}
 
+	if (eCSR_SCAN_ABORT == status)
+		csrRoamCallCallback(scan_context->pMac, scan_context->sessionId,
+				NULL, scan_context->roamId,
+				eCSR_ROAM_ASSOCIATION_FAILURE,
+				eCSR_ROAM_RESULT_SCAN_FOR_SSID_FAILURE);
+	vos_mem_free(scan_context);
+	return eHAL_STATUS_SUCCESS;
+}
 
 //This function is usually used for BSSs that suppresses SSID so the profile
 //shall have one and only one SSID
@@ -7515,6 +7445,7 @@ eHalStatus csrScanForSSID(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfi
     tANI_U32 numSsid = pProfile->SSIDs.numOfSSIDs;
     tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
                               &pMac->roam.neighborRoamInfo[sessionId];
+    struct csr_scan_for_ssid_context *context;
 
     smsLog(pMac, LOG2, FL("called"));
     //For WDS, we use the index 0. There must be at least one in there
@@ -7542,13 +7473,23 @@ eHalStatus csrScanForSSID(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfi
             {
                 status = csrRoamCopyProfile(pMac, pScanCmd->u.scanCmd.pToRoamProfile, pProfile);
             }
+            context = vos_mem_malloc(sizeof(*context));
+            if (NULL == context)
+            {
+                smsLog(pMac, LOGE,
+                       "Failed to allocate memory for ssid scan context");
+                status = eHAL_STATUS_FAILED_ALLOC;
+            }
             if(!HAL_STATUS_SUCCESS(status))
                 break;
+            context->pMac = pMac;
+            context->sessionId = sessionId;
+            context->roamId = roamId;
             pScanCmd->u.scanCmd.roamId = roamId;
             pScanCmd->command = eSmeCommandScan;
             pScanCmd->sessionId = (tANI_U8)sessionId;
-            pScanCmd->u.scanCmd.callback = NULL;
-            pScanCmd->u.scanCmd.pContext = NULL;
+            pScanCmd->u.scanCmd.callback = csr_ssid_scan_done_callback;
+            pScanCmd->u.scanCmd.pContext = context;
             pScanCmd->u.scanCmd.reason = eCsrScanForSsid;//Need to check: might need a new reason for SSID scan for LFR during multisession with p2p
             pScanCmd->u.scanCmd.scanID = pMac->scan.nextScanID++; //let it wrap around
             vos_mem_set(&pScanCmd->u.scanCmd.u.scanRequest, sizeof(tCsrScanRequest), 0);
@@ -8564,8 +8505,8 @@ eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
     * of pointer that holds the next BSS description
     */
    pBssDescr->length = (tANI_U16)(
-                     sizeof(tSirBssDescription) - sizeof(tANI_U16) -
-                     sizeof(tANI_U32) + uLen);
+        ((uintptr_t)OFFSET_OF(tSirBssDescription, ieFields))
+        - sizeof(pBssDescr->length) + uLen);
    if (pParsedFrame->dsParamsPresent)
    {
       pBssDescr->channelId = pParsedFrame->channelNumber;
@@ -8630,6 +8571,23 @@ eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
    pBssDescr->capabilityInfo = *((tANI_U16 *)&pParsedFrame->capabilityInfo);
    vos_mem_copy((tANI_U8 *) &pBssDescr->bssId, (tANI_U8 *) macHeader->bssId, sizeof(tSirMacAddr));
    pBssDescr->nReceivedTime = vos_timer_get_system_time();
+#ifdef WLAN_FEATURE_VOWIFI_11R
+   // MobilityDomain
+   pBssDescr->mdie[0] = 0;
+   pBssDescr->mdie[1] = 0;
+   pBssDescr->mdie[2] = 0;
+   pBssDescr->mdiePresent = FALSE;
+   // If mdie is present in the probe resp we fill it in the bss description
+   if (pParsedFrame->mdiePresent) {
+       pBssDescr->mdiePresent = TRUE;
+       pBssDescr->mdie[0] = pParsedFrame->mdie[0];
+       pBssDescr->mdie[1] = pParsedFrame->mdie[1];
+       pBssDescr->mdie[2] = pParsedFrame->mdie[2];
+   }
+   smsLog(pMac, LOG1, FL("mdie=%02x%02x%02x"),
+          (unsigned int)pBssDescr->mdie[0], (unsigned int)pBssDescr->mdie[1],
+          (unsigned int)pBssDescr->mdie[2]);
+#endif
 
    smsLog( pMac, LOG2, "(%s):Bssid= "MAC_ADDRESS_STR
                        " chan= %d, rssi = %d", __func__,
@@ -8839,10 +8797,10 @@ eHalStatus csrScanCreateEntryInScanCache(tpAniSirGlobal pMac, tANI_U32 sessionId
 
 #ifdef FEATURE_WLAN_ESE
 //  Update the TSF with the difference in system time
-void UpdateCCKMTSF(tANI_U32 *timeStamp0, tANI_U32 *timeStamp1, tANI_U32 *incr)
+void UpdateCCKMTSF(tANI_U32 *timeStamp0, tANI_U32 *timeStamp1, uint64_t *incr)
 {
     tANI_U64 timeStamp64 = ((tANI_U64)*timeStamp1 << 32) | (*timeStamp0);
-    timeStamp64 = (tANI_U64)(timeStamp64 + (tANI_U64)*incr);
+    timeStamp64 = (tANI_U64)(timeStamp64 + (*incr));
     *timeStamp0 = (tANI_U32)(timeStamp64 & 0xffffffff);
     *timeStamp1 = (tANI_U32)((timeStamp64 >> 32) & 0xffffffff);
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrCmdProcess.c b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrCmdProcess.c
index dd3b97fe012..b3ee0ec14d3 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrCmdProcess.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrCmdProcess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -132,7 +132,8 @@ eHalStatus csrMsgProcessor( tpAniSirGlobal pMac,  void *pMsgBuf )
             * workable due to failure or finding the condition meets both SAP and infra/IBSS requirement.
             */
             if( (eWNI_SME_SETCONTEXT_RSP == pSmeRsp->messageType) ||
-                (eWNI_SME_REMOVEKEY_RSP == pSmeRsp->messageType) )
+                (eWNI_SME_REMOVEKEY_RSP == pSmeRsp->messageType) ||
+                (pSmeRsp->messageType == eWNI_SME_FT_PRE_AUTH_RSP))
             {
                 smsLog(pMac, LOGW, FL(" handling msg 0x%X CSR state is %d"), pSmeRsp->messageType, pMac->roam.curState[pSmeRsp->sessionId]);
                 csrRoamCheckForLinkStatusChange(pMac, pSmeRsp);
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrInsideApi.h b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrInsideApi.h
index b2e78095e43..06e9ab88634 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrInsideApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrInsideApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -62,9 +62,6 @@
 #define CSR_MIN_REST_TIME_CONC                  50
 
 #define CSR_IDLE_TIME_CONC                      25
-
-#define CSR_NUM_STA_CHAN_COMBINED_CONC      3
-#define CSR_NUM_P2P_CHAN_COMBINED_CONC      1
 #endif
 
 #define CSR_MAX_NUM_SUPPORTED_CHANNELS 55
@@ -74,6 +71,7 @@
 #define CSR_MAX_BSS_SUPPORT            512
 #define SYSTEM_TIME_MSEC_TO_USEC      1000
 #define SYSTEM_TIME_SEC_TO_MSEC       1000
+#define SYSTEM_TIME_NSEC_TO_USEC      1000
 
 /* This number minus 1 means the number of times a channel is scanned
    before a BSS is removed from cache scan result */
@@ -180,16 +178,17 @@ typedef struct tagCsrScanResult
        we have equal preferValue */
     tANI_U32 capValue;
 
-    /*
-     * This member must be the last in the structure because the end of
-     * tSirBssDescription (inside) is an array with non known size at this time
-     */
-
     eCsrEncryptionType ucEncryptionType; //Preferred Encryption type that matched with profile.
     eCsrEncryptionType mcEncryptionType;
     eCsrAuthType authType; //Preferred auth type that matched with the profile.
 
     tCsrScanResultInfo Result;
+    /*
+     * WARNING - Do not add any element here
+     * This member Result must be the last in the structure because the end
+     * of tSirBssDescription (inside) is an array with nonknown size at
+     * this time.
+     */
 }tCsrScanResult;
 
 typedef struct
@@ -198,8 +197,19 @@ typedef struct
     tListElem *pCurEntry;
 }tScanResultList;
 
-
-
+/**
+ * csr_scan_for_ssid_context() - Callback context for SSID scan
+ *
+ * @pMac: pMac handle
+ * @sessionId: scan session id
+ * @roamId: roam Id
+ */
+struct csr_scan_for_ssid_context
+{
+    tpAniSirGlobal pMac;
+    tANI_U32 sessionId;
+    tANI_U32 roamId;
+};
 
 #define CSR_IS_ROAM_REASON( pCmd, reason ) ( (reason) == (pCmd)->roamCmd.roamReason )
 #define CSR_IS_BETTER_PREFER_VALUE(v1, v2)   ((v1) > (v2))
@@ -210,6 +220,16 @@ typedef struct
 #define CSR_IS_ENC_TYPE_STATIC( encType ) ( ( eCSR_ENCRYPT_TYPE_NONE == (encType) ) || \
                                             ( eCSR_ENCRYPT_TYPE_WEP40_STATICKEY == (encType) ) || \
                                             ( eCSR_ENCRYPT_TYPE_WEP104_STATICKEY == (encType) ) )
+#ifdef WLAN_FEATURE_FILS_SK
+#define CSR_IS_AUTH_TYPE_FILS(auth_type) \
+                ((eCSR_AUTH_TYPE_FILS_SHA256 == auth_type) || \
+                (eCSR_AUTH_TYPE_FILS_SHA384 == auth_type) || \
+                (eCSR_AUTH_TYPE_FT_FILS_SHA256 == auth_type) || \
+                (eCSR_AUTH_TYPE_FT_FILS_SHA384 == auth_type))
+#else
+#define CSR_IS_AUTH_TYPE_FILS(auth_type) 0
+#endif
+
 #define CSR_IS_WAIT_FOR_KEY( pMac, sessionId ) ( CSR_IS_ROAM_JOINED( pMac, sessionId ) && CSR_IS_ROAM_SUBSTATE_WAITFORKEY( pMac, sessionId ) )
 //WIFI has a test case for not using HT rates with TKIP as encryption
 //We may need to add WEP but for now, TKIP only.
@@ -1034,7 +1054,7 @@ void csrEseSendAdjacentApRepMsg(tpAniSirGlobal pMac, tCsrRoamSession *pSession);
 #endif
 
 #if defined(FEATURE_WLAN_ESE)
-void UpdateCCKMTSF(tANI_U32 *timeStamp0, tANI_U32 *timeStamp1, tANI_U32 *incr);
+void UpdateCCKMTSF(tANI_U32 *timeStamp0, tANI_U32 *timeStamp1, uint64_t *incr);
 #endif
 
 eHalStatus csrGetDefaultCountryCodeFrmNv(tpAniSirGlobal pMac, tANI_U8 *pCountry);
@@ -1061,7 +1081,7 @@ eHalStatus csrScanCreateEntryInScanCache(tpAniSirGlobal pMac, tANI_U32 sessionId
 eHalStatus csrUpdateChannelList(tpAniSirGlobal pMac);
 eHalStatus csrRoamDelPMKIDfromCache(tpAniSirGlobal pMac,
                                     tANI_U32 sessionId,
-                                    const tANI_U8 *pBSSId,
+                                    tPmkidCacheInfo *pmksa,
                                     tANI_BOOLEAN flush_cache);
 
 tANI_BOOLEAN csrElectedCountryInfo(tpAniSirGlobal pMac);
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrNeighborRoam.c b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrNeighborRoam.c
index d356c96f2d7..682a0f7eb9d 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrNeighborRoam.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrNeighborRoam.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -121,17 +121,18 @@ v_U8_t *csrNeighborRoamStateToString(v_U8_t state)
 }
 
 /* State Transition macro */
-#define CSR_NEIGHBOR_ROAM_STATE_TRANSITION(newState, sessionId)\
-{\
-    pMac->roam.neighborRoamInfo[sessionId].prevNeighborRoamState = \
-                      pMac->roam.neighborRoamInfo[sessionId].neighborRoamState;\
-    pMac->roam.neighborRoamInfo[sessionId].neighborRoamState = newState;\
-    VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG, \
-       FL("Session id(%d) Neighbor Roam Transition from state %s ==> %s"), \
-       sessionId, \
-       csrNeighborRoamStateToString ( \
-                pMac->roam.neighborRoamInfo[sessionId].prevNeighborRoamState), \
-       csrNeighborRoamStateToString (newState));\
+void csr_neighbor_roam_state_transition(tpAniSirGlobal mac_ctx,
+                uint8_t newstate, uint8_t session)
+{
+	mac_ctx->roam.neighborRoamInfo[session].prevNeighborRoamState =
+		mac_ctx->roam.neighborRoamInfo[session].neighborRoamState;
+	mac_ctx->roam.neighborRoamInfo[session].neighborRoamState = newstate;
+	VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+		FL("Session id(%d) NeighborRoam Transition from %s ==> %s"),
+		session,
+		csrNeighborRoamStateToString (
+		mac_ctx->roam.neighborRoamInfo[session].prevNeighborRoamState),
+		csrNeighborRoamStateToString (newstate));
 }
 
 /* ---------------------------------------------------------------------------
@@ -1454,9 +1455,9 @@ static eHalStatus csrNeighborRoamIssuePreauthReq(tpAniSirGlobal pMac,
     pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries++;
 
     /* Transition the state to preauthenticating */
-    CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+    csr_neighbor_roam_state_transition(pMac,
                                      eCSR_NEIGHBOR_ROAM_STATE_PREAUTHENTICATING,
-                                     sessionId)
+                                     sessionId);
 
     return status;
 }
@@ -1564,9 +1565,9 @@ eHalStatus csrNeighborRoamPreauthRspHandler(tpAniSirGlobal pMac,
         csrLLInsertTail(&pNeighborRoamInfo->FTRoamInfo.preAuthDoneList, &pPreauthRspNode->List, LL_ACCESS_LOCK);
 
         /* Pre-auth completed successfully. Transition to PREAUTH Done state */
-        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+        csr_neighbor_roam_state_transition(pMac,
                                           eCSR_NEIGHBOR_ROAM_STATE_PREAUTH_DONE,
-                                          sessionId)
+                                          sessionId);
         pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries = 0;
 
         /*
@@ -1580,15 +1581,21 @@ eHalStatus csrNeighborRoamPreauthRspHandler(tpAniSirGlobal pMac,
         tpCsrNeighborRoamBSSInfo    pNeighborBssNode = NULL;
         tListElem                   *pEntry;
         bool is_dis_pending = false;
+        uint32_t                    retries;
+
+        retries = pMac->sta_auth_retries_for_code17 >
+                  CSR_NEIGHBOR_ROAM_MAX_NUM_PREAUTH_RETRIES ?
+                        pMac->sta_auth_retries_for_code17 :
+                        CSR_NEIGHBOR_ROAM_MAX_NUM_PREAUTH_RETRIES;
 
         smsLog(pMac, LOGE, FL("Preauth failed retry number %d, status = 0x%x"),
                pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries, limStatus);
 
         /* Preauth failed. Add the bssId to the preAuth failed list MAC Address.
            Also remove the AP from roam able AP list */
-        if ((pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries >=
-             CSR_NEIGHBOR_ROAM_MAX_NUM_PREAUTH_RETRIES) ||
-            (eSIR_LIM_MAX_STA_REACHED_ERROR == limStatus))
+        if ((pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries >= retries) ||
+            ((eSIR_LIM_MAX_STA_REACHED_ERROR == limStatus) &&
+            (pMac->sta_auth_retries_for_code17 == 0)))
         {
             /* We are going to remove the node as it fails for more than MAX tries. Reset this count to 0 */
             pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries = 0;
@@ -1639,7 +1646,17 @@ eHalStatus csrNeighborRoamPreauthRspHandler(tpAniSirGlobal pMac,
            goto abort_preauth;
         }
 
-
+        if (pMac->roam.pending_roam_disable)
+        {
+            smsLog(pMac, LOG1, FL("process pending roam disable"));
+            pMac->roam.configParam.isFastRoamIniFeatureEnabled = FALSE;
+            pMac->roam.pending_roam_disable = FALSE;
+            csrNeighborRoamUpdateFastRoamingEnabled(pMac, sessionId, FALSE);
+            csr_neighbor_roam_state_transition(pMac,
+                               eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
+                               sessionId);
+            goto DEQ_PREAUTH;
+        }
 
         /* Issue preauth request for the same/next entry */
         if (eHAL_STATUS_SUCCESS == csrNeighborRoamIssuePreauthReq(pMac,
@@ -1661,12 +1678,13 @@ abort_preauth:
              csrRoamOffloadScan(pMac, 0, ROAM_SCAN_OFFLOAD_RESTART,
                                 REASON_PREAUTH_FAILED_FOR_ALL);
           }
-          CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
-                                             sessionId);
+          csr_neighbor_roam_state_transition(pMac,
+                eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
+                sessionId);
         } else
         {
 #endif
-          CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+          csr_neighbor_roam_state_transition(pMac,
                                            eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN,
                                            sessionId);
 
@@ -1771,8 +1789,9 @@ csrNeighborRoamOffloadUpdatePreauthList(tpAniSirGlobal pMac,
     csrLLInsertTail(&pNeighborRoamInfo->FTRoamInfo.preAuthDoneList,
                     &pBssInfo->List, LL_ACCESS_LOCK);
 
-    CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_PREAUTH_DONE,
-                                       sessionId)
+    csr_neighbor_roam_state_transition(pMac,
+                                       eCSR_NEIGHBOR_ROAM_STATE_PREAUTH_DONE,
+                                       sessionId);
     pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries = 0;
     VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
                "LFR3:Entry added to Auth Done List");
@@ -2032,12 +2051,19 @@ csrNeighborRoamProcessScanResults(tpAniSirGlobal pMac,
         pScanResultListSaved = pScanResultList;
         while (NULL != (pScanResult = csrScanResultGetNext(pMac,
                                                       *pScanResultList))) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0))
             VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
-                FL("Scan result: BSSID "MAC_ADDRESS_STR" (Rssi %ld, Ch:%d)"),
+                FL("Scan result: BSSID "MAC_ADDRESS_STR" (Rssi %d, Ch:%d)"),
                 MAC_ADDR_ARRAY(pScanResult->BssDescriptor.bssId),
                 abs(pScanResult->BssDescriptor.rssi),
                 pScanResult->BssDescriptor.channelId);
-
+#else
+            VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                FL("Scan result: BSSID "MAC_ADDRESS_STR" (Rssi %ld, Ch:%d)"),
+                MAC_ADDR_ARRAY(pScanResult->BssDescriptor.bssId),
+                (long int)abs(pScanResult->BssDescriptor.rssi),
+                pScanResult->BssDescriptor.channelId);
+#endif
             if ((VOS_TRUE == vos_mem_compare(pScanResult->BssDescriptor.bssId,
                 pNeighborRoamInfo->currAPbssid, sizeof(tSirMacAddr))) ||
                 ((eSME_ROAM_TRIGGER_SCAN == pNeighborRoamInfo->cfgRoamEn) &&
@@ -2088,7 +2114,7 @@ csrNeighborRoamProcessScanResults(tpAniSirGlobal pMac,
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
               && !csrRoamIsRoamOffloadScanEnabled(pMac)
 #endif
-              && ((eSME_ROAM_TRIGGER_SCAN != pNeighborRoamInfo->cfgRoamEn) ||
+              && ((eSME_ROAM_TRIGGER_SCAN != pNeighborRoamInfo->cfgRoamEn) &&
                (eSME_ROAM_TRIGGER_FAST_ROAM != pNeighborRoamInfo->cfgRoamEn))) {
                 /*
                  * If RSSI is lower than the lookup threshold, then continue.
@@ -2293,14 +2319,25 @@ csrNeighborRoamProcessScanResults(tpAniSirGlobal pMac,
                 && !csrRoamIsRoamOffloadScanEnabled(pMac)
 #endif
             ) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0))
                 VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
                            "%s: [INFOLOG] potential candidate to roam "
-                           "immediately (diff=%ld, expected=%d)",
+                           "immediately (diff=%d, expected=%d)",
                            __func__,
                            abs(abs(CurrAPRssi) -
                                 abs(pScanResult->BssDescriptor.rssi)),
                            immediateRoamRssiDiff);
                 roamNow = eANI_BOOLEAN_TRUE;
+#else
+                VOS_TRACE (VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                           "%s: [INFOLOG] potential candidate to roam "
+                           "immediately (diff=%ld, expected=%d)",
+                           __func__,
+                           (long int)abs(abs(CurrAPRssi) -
+                                         abs(pScanResult->BssDescriptor.rssi)),
+                           immediateRoamRssiDiff);
+                roamNow = eANI_BOOLEAN_TRUE;
+#endif
             }
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
             /*
@@ -2464,7 +2501,8 @@ static VOS_STATUS csrNeighborRoamHandleEmptyScanResult(tpAniSirGlobal pMac,
 #endif
 
     /* Transition to CONNECTED state */
-    CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
+    csr_neighbor_roam_state_transition(pMac,
+                                       eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
                                        sessionId);
 
     /* Reset all the necessary variables before transitioning to the CONNECTED state */
@@ -2655,9 +2693,9 @@ static eHalStatus csrNeighborRoamProcessScanComplete (tpAniSirGlobal pMac,
                     if (pNeighborRoamInfo->is11rAssoc) {
                         /* Valid APs are found after scan. Now we can initiate
                            pre-authentication */
-                        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+                        csr_neighbor_roam_state_transition(pMac,
                                            eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN,
-                                           sessionId)
+                                           sessionId);
                     } else
 #endif
 #ifdef FEATURE_WLAN_ESE
@@ -2669,9 +2707,9 @@ static eHalStatus csrNeighborRoamProcessScanComplete (tpAniSirGlobal pMac,
                     if (pNeighborRoamInfo->isESEAssoc) {
                         /* Valid APs are found after scan. Now we can initiate
                            pre-authentication */
-                        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+                        csr_neighbor_roam_state_transition(pMac,
                                            eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN,
-                                           sessionId)
+                                           sessionId);
                     } else
 #endif
 #ifdef FEATURE_WLAN_LFR
@@ -2683,9 +2721,9 @@ static eHalStatus csrNeighborRoamProcessScanComplete (tpAniSirGlobal pMac,
                     if (csrRoamIsFastRoamEnabled(pMac, sessionId)) {
                         /* Valid APs are found after scan. Now we can initiate
                            pre-authentication */
-                        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+                        csr_neighbor_roam_state_transition(pMac,
                                            eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN,
-                                           sessionId)
+                                           sessionId);
                     } else
 #endif
                     {
@@ -2853,7 +2891,7 @@ if (csrRoamIsRoamOffloadScanEnabled(pMac))
                                  REASON_NO_CAND_FOUND_OR_NOT_ROAMING_NOW);
            }
         }
-       CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
+       csr_neighbor_roam_state_transition(pMac, eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
                                           sessionId);
     }
    }
@@ -3188,7 +3226,7 @@ eHalStatus csrNeighborRoamIssueBgScanRequest(tpAniSirGlobal pMac,
     vos_mem_free(scanReq.SSIDs.SSIDList);
     if (1 == pBgScanParams->ChannelInfo.numOfChannels)
         NEIGHBOR_ROAM_DEBUG(pMac, LOG1,
-                FL("Channel List Address = %p, Actual index = %d"),
+                FL("Channel List Address = %pK, Actual index = %d"),
                 &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList[0],
                 pNeighborRoamInfo->roamChannelInfo.currentChanIndex);
 
@@ -3239,7 +3277,7 @@ eHalStatus csrNeighborRoamPerformBgScan(tpAniSirGlobal pMac, tANI_U8 sessionId)
     if (pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList
         &&
      pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.numOfChannels) {
-        NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Channel List Address = %p"), &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList[0]);
+        NEIGHBOR_ROAM_DEBUG(pMac, LOG1, FL("Channel List Address = %pK"), &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList[0]);
     }
     else
     {
@@ -3412,9 +3450,11 @@ void csrNeighborRoamNeighborScanTimerCallback(void *pv)
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, FL("pMac is Null"));
         return;
     }
-    if (CSR_SESSION_ID_INVALID == sessionId)
-    {
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, FL("invalid sessionId"));
+    if ((CSR_SESSION_ID_INVALID == sessionId) ||
+        (CSR_ROAM_SESSION_MAX <= sessionId)) {
+        smsLog(pMac, LOGE,
+               FL("Invalid sessionId/Reached maximum no.of sessions %d"),
+               sessionId);
         return;
     }
 
@@ -3471,9 +3511,11 @@ void csrNeighborRoamEmptyScanRefreshTimerCallback(void *context)
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, FL("pMac is Null"));
         return;
     }
-    if (CSR_SESSION_ID_INVALID == sessionId)
-    {
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, FL("invalid sessionId"));
+    if ((CSR_SESSION_ID_INVALID == sessionId) ||
+        (CSR_ROAM_SESSION_MAX <= sessionId)) {
+        smsLog(pMac, LOGE,
+               FL("Invalid sessionId/Reached maximum no.of sessions %d"),
+               sessionId);
         return;
     }
     pNeighborRoamInfo = &pMac->roam.neighborRoamInfo[sessionId];
@@ -3494,9 +3536,9 @@ void csrNeighborRoamEmptyScanRefreshTimerCallback(void *context)
         /* Increment the neighbor report retry count after sending the neighbor request successfully */
         pNeighborRoamInfo->FTRoamInfo.currentNeighborRptRetryNum++;
         pNeighborRoamInfo->FTRoamInfo.neighborRptPending = eANI_BOOLEAN_TRUE;
-        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+        csr_neighbor_roam_state_transition(pMac,
                                           eCSR_NEIGHBOR_ROAM_STATE_REPORT_QUERY,
-                                          sessionId)
+                                          sessionId);
     } else
 #endif
     {
@@ -3537,9 +3579,11 @@ void csrNeighborRoamResultsRefreshTimerCallback(void *context)
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, FL("pMac is Null"));
         return;
     }
-    if (CSR_SESSION_ID_INVALID == sessionId)
-    {
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, FL("invalid sessionId"));
+    if ((CSR_SESSION_ID_INVALID == sessionId) ||
+        (CSR_ROAM_SESSION_MAX <= sessionId)) {
+        smsLog(pMac, LOGE,
+               FL("Invalid sessionId/Reached maximum no.of sessions %d"),
+               sessionId);
         return;
     }
     pNeighborRoamInfo = &pMac->roam.neighborRoamInfo[sessionId];
@@ -3574,9 +3618,9 @@ void csrNeighborRoamResultsRefreshTimerCallback(void *context)
         /* Increment the neighbor report retry count after sending the neighbor request successfully */
         pNeighborRoamInfo->FTRoamInfo.currentNeighborRptRetryNum++;
         pNeighborRoamInfo->FTRoamInfo.neighborRptPending = eANI_BOOLEAN_TRUE;
-        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+        csr_neighbor_roam_state_transition(pMac,
                                           eCSR_NEIGHBOR_ROAM_STATE_REPORT_QUERY,
-                                          sessionId)
+                                          sessionId);
     }
     else
 #endif
@@ -3837,7 +3881,7 @@ VOS_STATUS csrNeighborRoamCreateChanListFromNeighborReport(tpAniSirGlobal pMac,
                 break;
         }
 
-        if (i == numChannels)
+        if ((i == numChannels) && (numChannels < MAX_BSS_IN_NEIGHBOR_RPT))
         {
             if (pNeighborBssDesc->pNeighborBssDescription->channel)
             {
@@ -3989,8 +4033,9 @@ void csrNeighborRoamRRMNeighborReportResult(void *context, VOS_STATUS vosStatus)
                 }
                 pNeighborRoamInfo->FTRoamInfo.currentNeighborRptRetryNum = 0;
                 /* Neighbor scan timer started. Transition to REPORT_SCAN state */
-                CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN,
-                                                   sessionId)
+                csr_neighbor_roam_state_transition(pMac,
+                                                   eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN,
+                                                   sessionId);
             }
             else
             {
@@ -4388,7 +4433,7 @@ VOS_STATUS csrNeighborRoamTransitToCFGChanScan(tpAniSirGlobal pMac,
             csrNeighborRoamPerformContiguousBgScan(pMac, sessionId);
 
             /* Transition to CFG_CHAN_LIST_SCAN */
-            CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+            csr_neighbor_roam_state_transition(pMac,
                                     eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN,
                                     sessionId);
 
@@ -4594,9 +4639,9 @@ VOS_STATUS csrNeighborRoamTransitToCFGChanScan(tpAniSirGlobal pMac,
     csrNeighborRoamPurgePreauthFailedList(pMac);
 
     /* Transition to CFG_CHAN_LIST_SCAN_STATE */
-    CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+    csr_neighbor_roam_state_transition(pMac,
                                     eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN,
-                                    sessionId)
+                                    sessionId);
 
     return VOS_STATUS_SUCCESS;
 }
@@ -4627,8 +4672,9 @@ VOS_STATUS  csrNeighborRoamNeighborLookupUpEvent(tpAniSirGlobal pMac,
     /* Recheck whether the below check is needed. */
     if ((pNeighborRoamInfo->neighborRoamState != eCSR_NEIGHBOR_ROAM_STATE_CONNECTED)
         && (pNeighborRoamInfo->neighborRoamState != eCSR_NEIGHBOR_ROAM_STATE_REASSOCIATING))
-        CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
-                                           sessionId)
+        csr_neighbor_roam_state_transition(pMac,
+                                           eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
+                                           sessionId);
 #ifdef FEATURE_WLAN_LFR
     if (!csrRoamIsFastRoamEnabled(pMac, sessionId)) {
         smsLog(pMac, LOGE, FL("LookUp event received when fast roam is "
@@ -4733,8 +4779,9 @@ VOS_STATUS  csrNeighborRoamNeighborLookupDownEvent(tpAniSirGlobal pMac,
                 /* Increment the neighbor report retry count after sending the neighbor request successfully */
                 pNeighborRoamInfo->FTRoamInfo.currentNeighborRptRetryNum++;
                 pNeighborRoamInfo->FTRoamInfo.neighborRptPending = eANI_BOOLEAN_TRUE;
-                CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_REPORT_QUERY,
-                                                   sessionId)
+                csr_neighbor_roam_state_transition(pMac,
+                                                   eCSR_NEIGHBOR_ROAM_STATE_REPORT_QUERY,
+                                                   sessionId);
             }
             else
 #endif
@@ -4993,10 +5040,13 @@ eHalStatus csrNeighborRoamIndicateDisconnect(tpAniSirGlobal pMac,
                  * Otherwise, we will be stuck in reassoc state which will
                  * in-turn block scans.
                  */
-                CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+                csr_neighbor_roam_state_transition(pMac,
                                                   eCSR_NEIGHBOR_ROAM_STATE_INIT,
                                                   sessionId);
                 pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+                pNeighborRoamInfo->uOsRequestedHandoff = 0;
+#endif
             }
             break;
 
@@ -5013,8 +5063,9 @@ eHalStatus csrNeighborRoamIndicateDisconnect(tpAniSirGlobal pMac,
             break;
 
         case eCSR_NEIGHBOR_ROAM_STATE_CONNECTED:
-            CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT,
-                                               sessionId)
+            csr_neighbor_roam_state_transition(pMac,
+                                               eCSR_NEIGHBOR_ROAM_STATE_INIT,
+                                               sessionId);
             pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
             csrNeighborRoamResetConnectedStateControlInfo(pMac, sessionId);
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
@@ -5028,11 +5079,13 @@ eHalStatus csrNeighborRoamIndicateDisconnect(tpAniSirGlobal pMac,
             break;
 
         case eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN:
-            CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT,
+            csr_neighbor_roam_state_transition(pMac,
+                                               eCSR_NEIGHBOR_ROAM_STATE_INIT,
                                                sessionId);
             pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
             csrNeighborRoamResetCfgListChanScanControlInfo(pMac, sessionId);
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            pNeighborRoamInfo->uOsRequestedHandoff = 0;
             if (!csrRoamIsRoamOffloadScanEnabled(pMac))
             {
 #endif
@@ -5047,8 +5100,9 @@ eHalStatus csrNeighborRoamIndicateDisconnect(tpAniSirGlobal pMac,
             vos_timer_stop(&pSession->ftSmeContext.preAuthReassocIntvlTimer);
         case eCSR_NEIGHBOR_ROAM_STATE_REPORT_SCAN:
         case eCSR_NEIGHBOR_ROAM_STATE_PREAUTHENTICATING:
-            CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT,
-                                               sessionId)
+            csr_neighbor_roam_state_transition(pMac,
+                                               eCSR_NEIGHBOR_ROAM_STATE_INIT,
+                                               sessionId);
             pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
             csrNeighborRoamResetPreauthControlInfo(pMac, sessionId);
             csrNeighborRoamResetReportScanStateControlInfo(pMac, sessionId);
@@ -5067,9 +5121,13 @@ eHalStatus csrNeighborRoamIndicateDisconnect(tpAniSirGlobal pMac,
                                  macTraceGetNeighbourRoamState(
                                  pNeighborRoamInfo->neighborRoamState));
             NEIGHBOR_ROAM_DEBUG(pMac, LOGW, FL("Transitioning to INIT state"));
-            CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT,
-                                               sessionId)
+            csr_neighbor_roam_state_transition(pMac,
+                                               eCSR_NEIGHBOR_ROAM_STATE_INIT,
+                                               sessionId);
             pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+            pNeighborRoamInfo->uOsRequestedHandoff = 0;
+#endif
             break;
     }
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
@@ -5174,8 +5232,12 @@ eHalStatus csrNeighborRoamIndicateConnect(tpAniSirGlobal pMac,
            }
            pMsg->messageType =
                         pal_cpu_to_be16((tANI_U16)eWNI_SME_SET_BCN_FILTER_REQ);
-           pMsg->length = pal_cpu_to_be16(sizeof( tANI_U8));
+           pMsg->length = pal_cpu_to_be16(sizeof(
+               tSirSetActiveModeSetBncFilterReq));
            pMsg->seesionId = sessionId;
+           vos_mem_copy(pMsg->bssid,
+               pMac->roam.roamSession[sessionId].connectedProfile.bssid,
+               sizeof(tSirMacAddr));
            status = palSendMBMessage(pMac->hHdd, pMsg );
         }
 #endif
@@ -5194,10 +5256,13 @@ eHalStatus csrNeighborRoamIndicateConnect(tpAniSirGlobal pMac,
             if (VOS_STATUS_SUCCESS != vosStatus)
             {
                 /* Just transition the state to INIT state. Rest of the clean up happens when we get next connect indication */
-                CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+                csr_neighbor_roam_state_transition(pMac,
                                                   eCSR_NEIGHBOR_ROAM_STATE_INIT,
-                                                  sessionId)
+                                                  sessionId);
                 pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+                pNeighborRoamInfo->uOsRequestedHandoff = 0;
+#endif
                 break;
             }
             /* Fall through if the status is SUCCESS */
@@ -5213,7 +5278,7 @@ eHalStatus csrNeighborRoamIndicateConnect(tpAniSirGlobal pMac,
             if (eCSR_NEIGHBOR_ROAM_STATE_INIT == pNeighborRoamInfo->neighborRoamState)
                 csrInitOccupiedChannelsList(pMac, sessionId);
 #endif
-            CSR_NEIGHBOR_ROAM_STATE_TRANSITION(
+            csr_neighbor_roam_state_transition(pMac,
                                              eCSR_NEIGHBOR_ROAM_STATE_CONNECTED,
                                              sessionId);
 
@@ -5276,6 +5341,13 @@ eHalStatus csrNeighborRoamIndicateConnect(tpAniSirGlobal pMac,
 
 #endif
 
+            if (pMac->roam.pending_roam_disable)
+            {
+                smsLog(pMac, LOG1, FL("process pending roam disable"));
+                pMac->roam.configParam.isFastRoamIniFeatureEnabled = FALSE;
+                pMac->roam.pending_roam_disable = FALSE;
+            }
+
 #ifdef FEATURE_WLAN_LFR
             // If "Legacy Fast Roaming" is enabled
             if (csrRoamIsFastRoamEnabled(pMac, sessionId))
@@ -5612,10 +5684,15 @@ eHalStatus csrNeighborRoamInit(tpAniSirGlobal pMac, tANI_U8 sessionId)
     /* Initialize this with the current tick count */
     pNeighborRoamInfo->scanRequestTimeStamp = vos_timer_get_system_time();
 
-    CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT, sessionId)
+    csr_neighbor_roam_state_transition(pMac,
+                                       eCSR_NEIGHBOR_ROAM_STATE_INIT,
+                                       sessionId);
     pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
     /* Set the Last Sent Cmd as RSO_STOP */
     pNeighborRoamInfo->lastSentCmd = ROAM_SCAN_OFFLOAD_STOP;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    pNeighborRoamInfo->uOsRequestedHandoff = 0;
+#endif
     return eHAL_STATUS_SUCCESS;
 }
 
@@ -5683,8 +5760,9 @@ void csrNeighborRoamClose(tpAniSirGlobal pMac, tANI_U8 sessionId)
     csrLLClose(&pNeighborRoamInfo->FTRoamInfo.preAuthDoneList);
 #endif /* WLAN_FEATURE_VOWIFI_11R */
 
-    CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_CLOSED,
-                                       sessionId)
+    csr_neighbor_roam_state_transition(pMac,
+                                       eCSR_NEIGHBOR_ROAM_STATE_CLOSED,
+                                       sessionId);
 
     return;
 }
@@ -5742,8 +5820,9 @@ void csrNeighborRoamRequestHandoff(tpAniSirGlobal pMac, tANI_U8 sessionId)
                         eSIR_SME_SUCCESS);
 
     vos_mem_zero(&roamInfo, sizeof(tCsrRoamInfo));
-    CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_REASSOCIATING,
-                                       sessionId)
+    csr_neighbor_roam_state_transition(pMac,
+                                       eCSR_NEIGHBOR_ROAM_STATE_REASSOCIATING,
+                                       sessionId);
 
 #ifdef FEATURE_WLAN_LFR_METRICS
     /* LFR metrics - pre-auth completion metric.
@@ -5964,8 +6043,13 @@ void csrNeighborRoamTranistionPreauthDoneToDisconnected(tpAniSirGlobal pMac,
     vos_timer_stop(&pSession->ftSmeContext.preAuthReassocIntvlTimer);
 
     // Transition to init state
-    CSR_NEIGHBOR_ROAM_STATE_TRANSITION(eCSR_NEIGHBOR_ROAM_STATE_INIT, sessionId)
+    csr_neighbor_roam_state_transition(pMac,
+                                       eCSR_NEIGHBOR_ROAM_STATE_INIT,
+                                       sessionId);
     pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived = eANI_BOOLEAN_FALSE;
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+    pNeighborRoamInfo->uOsRequestedHandoff = 0;
+#endif
 }
 
 /* ---------------------------------------------------------------------------
@@ -6045,7 +6129,7 @@ eHalStatus csrNeighborRoamCandidateFoundIndHdlr(tpAniSirGlobal pMac, void* pMsg)
          * purge non-P2P results from the past */
         csrScanFlushSelectiveResult(pMac, VOS_FALSE);
         /* Once it gets the candidates found indication from PE, will issue
-         * a scan req to PE with ?freshScan? in scanreq structure set
+         * a scan req to PE with “freshScan” in scanreq structure set
          * as follows: 0x42 - Return & purge LFR scan results
          */
         status = csrScanRequestLfrResult(pMac, sessionId,
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrTdlsProcess.c b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrTdlsProcess.c
index f7c2922eefa..44f600cf62b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrTdlsProcess.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrTdlsProcess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -743,8 +743,10 @@ eHalStatus tdlsMsgProcessor(tpAniSirGlobal pMac,  v_U16_t msgType,
             csrRoamCallCallback(pMac, delStaRsp->sessionId, &roamInfo, 0,
                          eCSR_ROAM_TDLS_STATUS_UPDATE,
                                eCSR_ROAM_RESULT_DELETE_TDLS_PEER);
-
-            csrTdlsRemoveSmeCmd(pMac, eSmeCommandTdlsDelPeer) ;
+            csrTdlsRemoveSmeCmd(pMac, eSmeCommandTdlsDelPeer);
+            csrRoamCallCallback(pMac, delStaRsp->sessionId, &roamInfo, 0,
+                            eCSR_ROAM_TDLS_STATUS_UPDATE,
+                            eCSR_ROAM_TDLS_CHECK_BMPS);
         }
         break;
         case eWNI_SME_TDLS_DEL_STA_IND:
@@ -783,6 +785,10 @@ eHalStatus tdlsMsgProcessor(tpAniSirGlobal pMac,  v_U16_t msgType,
         case eWNI_SME_TDLS_LINK_ESTABLISH_RSP:
         {
             tSirTdlsLinkEstablishReqRsp *linkEstablishReqRsp = (tSirTdlsLinkEstablishReqRsp *) pMsgBuf ;
+            vos_mem_copy(&roamInfo.peerMac, linkEstablishReqRsp->peerMac,
+                                            sizeof(tSirMacAddr));
+            roamInfo.staId = (uint8_t)linkEstablishReqRsp->sta_idx;
+            roamInfo.statusCode = linkEstablishReqRsp->statusCode;
             csrRoamCallCallback(pMac, linkEstablishReqRsp->sessionId, &roamInfo, 0,
                          eCSR_ROAM_TDLS_STATUS_UPDATE,
                                eCSR_ROAM_RESULT_LINK_ESTABLISH_REQ_RSP);
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrUtil.c b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrUtil.c
index bb741bde2ab..b29c3671b0c 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrUtil.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/csr/csrUtil.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -71,7 +71,22 @@ tANI_U8 csrRSNOui[][ CSR_RSN_OUI_SIZE ] = {
     { 0x00, 0x40, 0x96, 0x00 }, // CCKM
     { 0x00, 0x0F, 0xAC, 0x06 },  // BIP (encryption type) or RSN-PSK-SHA256 (authentication type)
     /* RSN-8021X-SHA256 (authentication type) */
-    { 0x00, 0x0F, 0xAC, 0x05 }
+    { 0x00, 0x0F, 0xAC, 0x05 },
+#ifdef WLAN_FEATURE_FILS_SK
+#define ENUM_FILS_SHA256 9
+    /* FILS SHA256 */
+    {0x00, 0x0F, 0xAC, 0x0E},
+#define ENUM_FILS_SHA384 10
+    /* FILS SHA384 */
+    {0x00, 0x0F, 0xAC, 0x0F},
+#define ENUM_FT_FILS_SHA256 11
+    /* FILS FT SHA256 */
+    {0x00, 0x0F, 0xAC, 0x10},
+#define ENUM_FT_FILS_SHA384 12
+    /* FILS FT SHA384 */
+    {0x00, 0x0F, 0xAC, 0x11}
+#endif
+    /* define new oui here */
 };
 
 #ifdef FEATURE_WLAN_WAPI
@@ -962,10 +977,13 @@ v_U16_t csrCheckConcurrentChannelOverlap(tpAniSirGlobal pMac, v_U16_t sap_ch,
              intf_ch = 0;
          }
     }
-    else if (intf_ch && sap_ch!= intf_ch &&
+    else if (!pMac->roam.configParam.band_switch_enable &&
+             intf_ch && sap_ch!= intf_ch &&
              cc_switch_mode == VOS_MCC_TO_SCC_SWITCH_FORCE) {
-         if (!((intf_ch < 14 && sap_ch < 14) || (intf_ch > 14 && sap_ch > 14)))
-             intf_ch = 0;
+             if (!((intf_ch < 14 && sap_ch < 14) ||
+                 (intf_ch > 14 && sap_ch > 14))) {
+                 intf_ch = 0;
+             }
     }else if (intf_ch == sap_ch)
          intf_ch = 0;
 
@@ -973,6 +991,215 @@ v_U16_t csrCheckConcurrentChannelOverlap(tpAniSirGlobal pMac, v_U16_t sap_ch,
                          "Not" : "Are" );
   return intf_ch;
 }
+
+/**
+ * csr_create_sap_session_info() - create session info based on
+ *    the input chan and  phymode
+ * @pMac: tpAniSirGlobal ptr
+ * @sap_phymode: requesting phymode.
+ * @sap_ch: requesting channel number
+ * @session_info: information returned.
+ *
+ * Return: TRUE if any session info returned
+ */
+tANI_BOOLEAN csr_create_sap_session_info(
+	tHalHandle hHal,
+	eCsrPhyMode sap_phymode,
+	v_U16_t sap_ch,
+	session_info_t *session_info)
+{
+	tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+	v_U8_t chb = PHY_SINGLE_CHANNEL_CENTERED;
+	v_U16_t sap_hbw = 0, sap_cfreq = 0;
+	v_U16_t sap_lfreq, sap_hfreq, sap_cch;
+
+	sap_cch = sap_ch;
+	sap_hbw = HALF_BW_OF(eCSR_BW_20MHz_VAL);
+
+	if (sap_ch > MAX_2_4GHZ_CHANNEL)
+		chb = pMac->roam.configParam.channelBondingMode5GHz;
+	else
+		chb = pMac->roam.configParam.channelBondingMode24GHz;
+	if (!chb)
+		goto RET;
+
+	if (sap_phymode == eCSR_DOT11_MODE_11n ||
+		sap_phymode == eCSR_DOT11_MODE_11n_ONLY) {
+
+		sap_hbw = HALF_BW_OF(eCSR_BW_40MHz_VAL);
+		if (chb == PHY_DOUBLE_CHANNEL_LOW_PRIMARY)
+			sap_cch = CSR_GET_HT40_PLUS_CCH(sap_ch);
+		else if (chb == PHY_DOUBLE_CHANNEL_HIGH_PRIMARY)
+			sap_cch = CSR_GET_HT40_MINUS_CCH(sap_ch);
+	}
+#ifdef WLAN_FEATURE_11AC
+	else if (sap_phymode == eCSR_DOT11_MODE_11ac ||
+		sap_phymode == eCSR_DOT11_MODE_11ac_ONLY) {
+		/*
+		 * 11AC only 80/40/20 Mhz supported in Rome
+		 */
+		if (pMac->roam.configParam.nVhtChannelWidth ==
+			(WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ + 1)) {
+			sap_hbw = HALF_BW_OF(eCSR_BW_80MHz_VAL);
+			if (chb ==
+				(PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW
+				- 1))
+			    sap_cch = CSR_GET_HT80_PLUS_LL_CCH(sap_ch);
+			else if (chb ==
+				(PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW
+				- 1))
+				sap_cch = CSR_GET_HT80_PLUS_HL_CCH(sap_ch);
+			else if (chb ==
+				(PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH
+				- 1))
+				sap_cch = CSR_GET_HT80_MINUS_LH_CCH(sap_ch);
+			else if (chb ==
+				(PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH
+				- 1))
+				sap_cch = CSR_GET_HT80_MINUS_HH_CCH(sap_ch);
+		} else {
+			sap_hbw = HALF_BW_OF(eCSR_BW_40MHz_VAL);
+			if (chb ==
+				(PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW
+				- 1))
+				sap_cch = CSR_GET_HT40_PLUS_CCH(sap_ch);
+			else if (chb ==
+				(PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW
+				- 1))
+				sap_cch = CSR_GET_HT40_MINUS_CCH(sap_ch);
+			else if (chb ==
+				(PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH
+				- 1))
+				sap_cch = CSR_GET_HT40_PLUS_CCH(sap_ch);
+			else if (chb ==
+				(PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH
+				- 1))
+				sap_cch = CSR_GET_HT40_MINUS_CCH(sap_ch);
+		}
+	}
+#endif
+RET:
+	sap_cfreq = vos_chan_to_freq(sap_cch);
+	sap_lfreq = sap_cfreq - sap_hbw;
+	sap_hfreq = sap_cfreq + sap_hbw;
+	if (sap_ch > MAX_2_4GHZ_CHANNEL)
+		session_info->band = eCSR_BAND_5G;
+	else
+		session_info->band = eCSR_BAND_24;
+	session_info->och = sap_ch;
+	session_info->lfreq = sap_lfreq;
+	session_info->hfreq = sap_hfreq;
+	session_info->cfreq = sap_cfreq;
+	session_info->hbw = sap_hbw;
+	session_info->con_mode = VOS_STA_SAP_MODE;
+	return TRUE;
+}
+/**
+ * csr_find_sta_session_info() - get sta active session info
+ * @pMac: tpAniSirGlobal ptr
+ * @session_info: information returned.
+ *
+ * Return: TRUE if sta session info returned
+ */
+tANI_BOOLEAN csr_find_sta_session_info(
+	tHalHandle hHal,
+	session_info_t *info)
+{
+	tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+	tCsrRoamSession *pSession = NULL;
+	v_U8_t i = 0;
+
+	for( i = 0; i < CSR_ROAM_SESSION_MAX; i++ ) {
+		if( !CSR_IS_SESSION_VALID( pMac, i ) )
+			continue;
+		pSession = CSR_GET_SESSION( pMac, i );
+		if (NULL == pSession->pCurRoamProfile)
+			continue;
+		if (((pSession->pCurRoamProfile->csrPersona ==
+				VOS_STA_MODE) ||
+			 (pSession->pCurRoamProfile->csrPersona ==
+				VOS_P2P_CLIENT_MODE)) &&
+			(pSession->connectState ==
+				eCSR_ASSOC_STATE_TYPE_INFRA_ASSOCIATED)) {
+			info->och =
+				pSession->connectedProfile.operationChannel;
+			csrGetChFromHTProfile(pMac,
+				&pSession->connectedProfile.HTProfile,
+				info->och, &info->cfreq, &info->hbw);
+			info->lfreq = info->cfreq - info->hbw;
+			info->hfreq = info->cfreq + info->hbw;
+			if (info->och > MAX_2_4GHZ_CHANNEL)
+				info->band = eCSR_BAND_5G;
+			else
+				info->band = eCSR_BAND_24;
+			info->con_mode = VOS_STA_MODE;
+			return eANI_BOOLEAN_TRUE;
+		}
+	}
+	return eANI_BOOLEAN_FALSE;
+}
+/**
+ * csr_find_all_session_info() - get all active session info
+ * @pMac: tpAniSirGlobal ptr
+ * @session_info: information returned.
+ * @session_count: number of session
+ *
+ * Return: TRUE if any session info returned
+ */
+tANI_BOOLEAN csr_find_all_session_info(
+	tHalHandle hHal,
+	session_info_t *session_info,
+	v_U8_t *session_count)
+{
+	tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+	tCsrRoamSession *pSession = NULL;
+	v_U8_t i = 0;
+	v_U8_t count = 0;
+
+	for( i = 0; i < CSR_ROAM_SESSION_MAX; i++ ) {
+		if( !CSR_IS_SESSION_VALID( pMac, i ) )
+			continue;
+		pSession = CSR_GET_SESSION( pMac, i );
+		if (NULL == pSession->pCurRoamProfile)
+			continue;
+		if ((((pSession->pCurRoamProfile->csrPersona ==
+				VOS_STA_MODE) ||
+			(pSession->pCurRoamProfile->csrPersona ==
+				VOS_P2P_CLIENT_MODE)) &&
+			(pSession->connectState ==
+				eCSR_ASSOC_STATE_TYPE_INFRA_ASSOCIATED)) ||
+			(((pSession->pCurRoamProfile->csrPersona ==
+				VOS_P2P_GO_MODE) ||
+			(pSession->pCurRoamProfile->csrPersona ==
+				VOS_STA_SAP_MODE)||
+			(pSession->pCurRoamProfile->csrPersona ==
+				VOS_IBSS_MODE)) &&
+			(pSession->connectState !=
+				eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED))) {
+			session_info_t *info = &session_info[count++];
+			info->och =
+				pSession->connectedProfile.operationChannel;
+			csrGetChFromHTProfile(pMac,
+				&pSession->connectedProfile.HTProfile,
+				info->och, &info->cfreq, &info->hbw);
+			info->lfreq = info->cfreq - info->hbw;
+			info->hfreq = info->cfreq + info->hbw;
+			if ((pSession->pCurRoamProfile->csrPersona ==
+					VOS_STA_MODE) ||
+				(pSession->pCurRoamProfile->csrPersona ==
+					VOS_P2P_CLIENT_MODE))
+				info->con_mode = VOS_STA_MODE;
+			else
+				info->con_mode = VOS_STA_SAP_MODE;
+			if (info->och > MAX_2_4GHZ_CHANNEL)
+				info->band = eCSR_BAND_5G;
+			else
+				info->band = eCSR_BAND_24;
+		}
+	}
+	*session_count = count;
+	return count != 0;
+}
 #endif
 
 tANI_BOOLEAN csrIsAllSessionDisconnected( tpAniSirGlobal pMac )
@@ -1472,7 +1699,7 @@ eHalStatus csrParseBssDescriptionIEs(tHalHandle hHal, tSirBssDescription *pBssDe
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-    int ieLen = (int)(pBssDesc->length + sizeof( pBssDesc->length ) - GET_FIELD_OFFSET( tSirBssDescription, ieFields ));
+    int ieLen = (int)GET_IE_LEN_IN_BSS(pBssDesc->length);
 
     if(ieLen > 0 && pIEStruct)
     {
@@ -2125,7 +2352,15 @@ tANI_BOOLEAN csrIsProfileRSN( tCsrRoamProfile *pProfile )
 #endif
             fRSNProfile = TRUE;
             break;
-
+#ifdef WLAN_FEATURE_FILS_SK
+        /* fallthrough */
+        case eCSR_AUTH_TYPE_FILS_SHA256:
+        case eCSR_AUTH_TYPE_FILS_SHA384:
+        case eCSR_AUTH_TYPE_FT_FILS_SHA256:
+        case eCSR_AUTH_TYPE_FT_FILS_SHA384:
+            fRSNProfile = true;
+            break;
+#endif
         default:
             fRSNProfile = FALSE;
             break;
@@ -2161,6 +2396,10 @@ csrIsconcurrentsessionValid(tpAniSirGlobal pMac,tANI_U32 cursessionId,
     tANI_U8 automotive_support_enable =
         (pMac->roam.configParam.conc_custom_rule1 |
          pMac->roam.configParam.conc_custom_rule2);
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+    bool ap_p2pgo_concurrency_enable =
+                 pMac->roam.configParam.ap_p2pgo_concurrency_enable;
+#endif
     tVOS_CON_MODE bss_persona;
     eCsrConnectState connect_state;
 
@@ -2182,13 +2421,27 @@ csrIsconcurrentsessionValid(tpAniSirGlobal pMac,tANI_U32 cursessionId,
                      return eHAL_STATUS_SUCCESS;
 
              case VOS_STA_SAP_MODE:
-                     if (((bss_persona == VOS_P2P_GO_MODE) && (connect_state !=
-                                eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED) &&
-                                (0 == automotive_support_enable)) ||
-                         ((bss_persona == VOS_IBSS_MODE) && (connect_state !=
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+                     if ((VOS_MCC_TO_SCC_SWITCH_FORCE ==
+                             pMac->roam.configParam.cc_switch_mode) &&
+                         (ap_p2pgo_concurrency_enable) &&
+                         (bss_persona == VOS_P2P_GO_MODE) &&
+                         (connect_state !=
+                                eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED)) {
+                         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                             FL("Start AP session concurrency with P2P-GO"));
+                         return eHAL_STATUS_SUCCESS;
+                     } else
+#endif
+                     if (((bss_persona == VOS_P2P_GO_MODE) &&
+                             (0 == automotive_support_enable) &&
+                             (connect_state !=
+                                    eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED)) ||
+                             ((bss_persona == VOS_IBSS_MODE) &&
+                             (connect_state !=
                                 eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED))) {
-                         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                                   FL("Can't start multiple beaconing role"));
+                             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                                 FL("Can't start multiple beaconing role"));
                          return eHAL_STATUS_FAILURE;
                      }
                      break;
@@ -2199,8 +2452,20 @@ csrIsconcurrentsessionValid(tpAniSirGlobal pMac,tANI_U32 cursessionId,
                          VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
                                 FL(" ****P2P GO mode already exists ****"));
                          return eHAL_STATUS_FAILURE;
-
-                     } else if (((bss_persona == VOS_STA_SAP_MODE) &&
+                     }
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+                     else if ((VOS_MCC_TO_SCC_SWITCH_FORCE ==
+                                   pMac->roam.configParam.cc_switch_mode) &&
+                               (ap_p2pgo_concurrency_enable) &&
+                               (bss_persona == VOS_STA_SAP_MODE) &&
+                               (connect_state !=
+                                       eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED)) {
+                         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                                FL("Start P2P-GO session concurrency with AP"));
+                         return eHAL_STATUS_SUCCESS;
+                     }
+#endif
+                     else if (((bss_persona == VOS_STA_SAP_MODE) &&
                                  (connect_state !=
                                   eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED) &&
                                  (0 == automotive_support_enable)) ||
@@ -2462,8 +2727,20 @@ eHalStatus csrValidateMCCBeaconInterval(tpAniSirGlobal pMac, tANI_U8 channelId,
                         if (pMac->roam.roamSession[sessionId].bssParams.operationChn
                                                         != channelId )
                         {
-                            smsLog(pMac, LOGE, FL("***MCC is not enabled for SAP + CLIENT****"));
-                            return eHAL_STATUS_FAILURE;
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+                            if (VOS_MCC_TO_SCC_SWITCH_FORCE ==
+                                            pMac->roam.configParam.cc_switch_mode &&
+                                pMac->roam.configParam.ap_p2pclient_concur_enable)
+                            {
+                                smsLog(pMac, LOG1, FL("SAP + CLIENT for MCC to SCC"));
+                                return eHAL_STATUS_SUCCESS;
+                            } else
+#endif
+                            {
+                                smsLog(pMac, LOGE,
+                                        FL("***MCC is not enabled for SAP + CLIENT****"));
+                                return eHAL_STATUS_FAILURE;
+                            }
                         }
                     }
                     else if (pMac->roam.roamSession[sessionId].bssParams.bssPersona
@@ -2808,6 +3085,76 @@ static tANI_BOOLEAN csrIsAuthRSN8021xSha256(tpAniSirGlobal pMac,
 }
 #endif
 
+#ifdef WLAN_FEATURE_FILS_SK
+/*
+ * csr_is_auth_fils_sha256() - check whether oui is fils sha256
+ * @mac: Global MAC context
+ * @all_suites: pointer to all supported akm suites
+ * @suite_count: all supported akm suites count
+ * @oui: Oui needs to be matched
+ *
+ * Return: True if OUI is FILS SHA256, false otherwise
+ */
+static bool csr_is_auth_fils_sha256(tpAniSirGlobal mac,
+                    uint8_t all_suites[][CSR_RSN_OUI_SIZE],
+                    uint8_t suite_count, uint8_t oui[])
+{
+    return csrIsOuiMatch(mac, all_suites, suite_count,
+                csrRSNOui[ENUM_FILS_SHA256], oui);
+}
+
+/*
+ * csr_is_auth_fils_sha384() - check whether oui is fils sha384
+ * @mac: Global MAC context
+ * @all_suites: pointer to all supported akm suites
+ * @suite_count: all supported akm suites count
+ * @oui: Oui needs to be matched
+ *
+ * Return: True if OUI is FILS SHA384, false otherwise
+ */
+static bool csr_is_auth_fils_sha384(tpAniSirGlobal mac,
+                    uint8_t all_suites[][CSR_RSN_OUI_SIZE],
+                    uint8_t suite_count, uint8_t oui[])
+{
+    return csrIsOuiMatch(mac, all_suites, suite_count,
+                csrRSNOui[ENUM_FILS_SHA384], oui);
+}
+
+/*
+ * csr_is_auth_fils_ft_sha256() - check whether oui is fils ft sha256
+ * @mac: Global MAC context
+ * @all_suites: pointer to all supported akm suites
+ * @suite_count: all supported akm suites count
+ * @oui: Oui needs to be matched
+ *
+ * Return: True if OUI is FT FILS SHA256, false otherwise
+ */
+static bool csr_is_auth_fils_ft_sha256(tpAniSirGlobal mac,
+                    uint8_t all_suites[][CSR_RSN_OUI_SIZE],
+                    uint8_t suite_count, uint8_t oui[])
+{
+    return csrIsOuiMatch(mac, all_suites, suite_count,
+                csrRSNOui[ENUM_FT_FILS_SHA256], oui);
+}
+
+/*
+ * csr_is_auth_fils_ft_sha384() - check whether oui is fils ft sha384
+ * @mac: Global MAC context
+ * @all_suites: pointer to all supported akm suites
+ * @suite_count: all supported akm suites count
+ * @oui: Oui needs to be matched
+ *
+ * Return: True if OUI is FT FILS SHA384, false otherwise
+ */
+static bool csr_is_auth_fils_ft_sha384(tpAniSirGlobal mac,
+                    uint8_t all_suites[][CSR_RSN_OUI_SIZE],
+                    uint8_t suite_count, uint8_t oui[])
+{
+    return csrIsOuiMatch(mac, all_suites, suite_count,
+                csrRSNOui[ENUM_FT_FILS_SHA384], oui);
+}
+#endif
+
 static tANI_BOOLEAN csrIsAuthWpa( tpAniSirGlobal pMac, tANI_U8 AllSuites[][CSR_WPA_OUI_SIZE],
                                 tANI_U8 cAllSuites,
                                 tANI_U8 Oui[] )
@@ -2858,6 +3205,67 @@ tANI_U8 csrGetOUIIndexFromCipher( eCsrEncryptionType enType )
         return OUIIndex;
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * csr_is_fils_auth() - update negotiated auth if matches to FILS auth type
+ * @mac_ctx: pointer to mac context
+ * @authsuites: auth suites
+ * @c_auth_suites: auth suites count
+ * @authentication: authentication
+ * @auth_type: authentication type list
+ * @index: current counter
+ * @neg_authtype: pointer to negotiated auth
+ *
+ * Return: None
+ */
+static void csr_is_fils_auth(tpAniSirGlobal mac_ctx,
+    uint8_t authsuites[][CSR_RSN_OUI_SIZE], uint8_t c_auth_suites,
+    uint8_t authentication[], tCsrAuthList *auth_type,
+    uint8_t index, eCsrAuthType *neg_authtype)
+{
+    /*
+     * TODO Always try with highest security
+     * move this down once sha384 is validated
+     */
+    if (csr_is_auth_fils_sha256(mac_ctx, authsuites,
+                c_auth_suites, authentication)) {
+        if (eCSR_AUTH_TYPE_FILS_SHA256 ==
+                auth_type->authType[index])
+            *neg_authtype = eCSR_AUTH_TYPE_FILS_SHA256;
+    }
+    if ((*neg_authtype == eCSR_AUTH_TYPE_UNKNOWN) &&
+            csr_is_auth_fils_sha384(mac_ctx, authsuites,
+                c_auth_suites, authentication)) {
+        if (eCSR_AUTH_TYPE_FILS_SHA384 ==
+                auth_type->authType[index])
+            *neg_authtype = eCSR_AUTH_TYPE_FILS_SHA384;
+    }
+    if ((*neg_authtype == eCSR_AUTH_TYPE_UNKNOWN) &&
+            csr_is_auth_fils_ft_sha256(mac_ctx, authsuites,
+                c_auth_suites, authentication)) {
+        if (eCSR_AUTH_TYPE_FT_FILS_SHA256 ==
+                auth_type->authType[index])
+            *neg_authtype = eCSR_AUTH_TYPE_FT_FILS_SHA256;
+    }
+    if ((*neg_authtype == eCSR_AUTH_TYPE_UNKNOWN) &&
+            csr_is_auth_fils_ft_sha384(mac_ctx, authsuites,
+                c_auth_suites, authentication)) {
+        if (eCSR_AUTH_TYPE_FT_FILS_SHA384 ==
+                auth_type->authType[index])
+            *neg_authtype = eCSR_AUTH_TYPE_FT_FILS_SHA384;
+    }
+     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+              FL("negotiated auth type is %d"), *neg_authtype);
+}
+#else
+static void csr_is_fils_auth(tpAniSirGlobal mac_ctx,
+    uint8_t authsuites[][CSR_RSN_OUI_SIZE], uint8_t c_auth_suites,
+    uint8_t authentication[], tCsrAuthList *auth_type,
+    uint8_t index, eCsrAuthType *neg_authtype)
+{
+}
+#endif
+
 tANI_BOOLEAN csrGetRSNInformation( tHalHandle hHal, tCsrAuthList *pAuthType, eCsrEncryptionType enType, tCsrEncryptionList *pMCEncryption,
                                    tDot11fIERSN *pRSNIe,
                            tANI_U8 *UnicastCypher,
@@ -2920,9 +3328,13 @@ tANI_BOOLEAN csrGetRSNInformation( tHalHandle hHal, tCsrAuthList *pAuthType, eCs
             for (i = 0 ; i < pAuthType->numEntries; i++)
             {
                 //Ciphers are supported, Match authentication algorithm and pick first matching authtype.
- #ifdef WLAN_FEATURE_VOWIFI_11R
+
+                 /* Set FILS as first preference */
+                csr_is_fils_auth(pMac, AuthSuites, cAuthSuites,
+                                 Authentication, pAuthType, i, &negAuthType);
+#ifdef WLAN_FEATURE_VOWIFI_11R
                 /* Changed the AKM suites according to order of preference */
-                if ( csrIsFTAuthRSN( pMac, AuthSuites, cAuthSuites, Authentication ) )
+                if ( (negAuthType == eCSR_AUTH_TYPE_UNKNOWN) && csrIsFTAuthRSN( pMac, AuthSuites, cAuthSuites, Authentication ) )
                 {
                     if (eCSR_AUTH_TYPE_FT_RSN == pAuthType->authType[i])
                         negAuthType = eCSR_AUTH_TYPE_FT_RSN;
@@ -3118,8 +3530,70 @@ tANI_BOOLEAN csrIsRSNMatch( tHalHandle hHal, tCsrAuthList *pAuthType,
     return( fRSNMatch );
 }
 
+/**
+ * csr_lookup_pmkid_using_ssid() - lookup pmkid using ssid and cache_id
+ * @mac: pointer to mac
+ * @session: sme session pointer
+ * @pmk_cache: pointer to pmk cache
+ * @index: index value needs to be seached
+ *
+ * Return: true if pmkid is found else false
+ */
+static bool csr_lookup_pmkid_using_ssid(tpAniSirGlobal mac,
+                    tCsrRoamSession *session,
+                    tPmkidCacheInfo *pmk_cache,
+                    uint32_t *index)
+{
+    uint32_t i;
+    tPmkidCacheInfo *session_pmk;
+
+    for (i = 0; i < session->NumPmkidCache; i++) {
+        session_pmk = &session->PmkidCacheInfo[i];
+
+        if ((!adf_os_mem_cmp(pmk_cache->ssid, session_pmk->ssid,
+                  pmk_cache->ssid_len)) &&
+            (!adf_os_mem_cmp(session_pmk->cache_id,
+                  pmk_cache->cache_id, CACHE_ID_LEN))) {
+            /* match found */
+            *index = i;
+            return true;
+        }
+    }
 
-tANI_BOOLEAN csrLookupPMKID( tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U8 *pBSSId, tANI_U8 *pPMKId )
+    return false;
+}
+
+/**
+ * csr_lookup_pmkid_using_bssid() - lookup pmkid using bssid
+ * @mac: pointer to mac
+ * @session: sme session pointer
+ * @pmk_cache: pointer to pmk cache
+ * @index: index value needs to be seached
+ *
+ * Return: true if pmkid is found else false
+ */
+static bool csr_lookup_pmkid_using_bssid(tpAniSirGlobal mac,
+                    tCsrRoamSession *session,
+                    tPmkidCacheInfo *pmk_cache,
+                    uint32_t *index)
+{
+    uint32_t i;
+    tPmkidCacheInfo *session_pmk;
+
+    for (i = 0; i < session->NumPmkidCache; i++) {
+        session_pmk = &session->PmkidCacheInfo[i];
+        if (vos_is_macaddr_equal((v_MACADDR_t *)pmk_cache->BSSID,
+                     (v_MACADDR_t *)session_pmk->BSSID)) {
+            /* match found */
+            *index = i;
+            return true;
+        }
+    }
+
+    return false;
+}
+
+tANI_BOOLEAN csrLookupPMKID( tpAniSirGlobal pMac, tANI_U32 sessionId, tPmkidCacheInfo *pmk_cache)
 {
     tANI_BOOLEAN fRC = FALSE, fMatchFound = FALSE;
     tANI_U32 Index;
@@ -3131,33 +3605,101 @@ tANI_BOOLEAN csrLookupPMKID( tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U8 *p
         return FALSE;
     }
 
-    do
-    {
-        for (Index = 0; Index < CSR_MAX_PMKID_ALLOWED; Index++)
-        {
-            smsLog(pMac, LOG2, "match PMKID "MAC_ADDRESS_STR " to ",
-                   MAC_ADDR_ARRAY(pBSSId));
-            if( vos_mem_compare(pBSSId, pSession->PmkidCacheInfo[Index].BSSID, sizeof(tCsrBssid)) )
-            {
-                // match found
-                fMatchFound = TRUE;
-                break;
-            }
-        }
-
-        if( !fMatchFound ) break;
+    if (pmk_cache->ssid_len) {
+        /* Try to find based on cache_id and ssid first */
+        fMatchFound = csr_lookup_pmkid_using_ssid(pMac, pSession,
+                                                  pmk_cache, &Index);
+    }
 
-        vos_mem_copy(pPMKId, pSession->PmkidCacheInfo[Index].PMKID, CSR_RSN_PMKID_SIZE);
+    /* If not able to find using cache id or ssid_len is not present */
+    if (!fMatchFound)
+        fMatchFound = csr_lookup_pmkid_using_bssid(pMac,
+                                        pSession, pmk_cache, &Index);
 
-        fRC = TRUE;
+    if (!fMatchFound) {
+        smsLog(pMac, LOG2, "No PMKID Match Found");
+        return false;
     }
-    while( 0 );
+
+    vos_mem_copy(pmk_cache->PMKID, pSession->PmkidCacheInfo[Index].PMKID, CSR_RSN_PMKID_SIZE);
+    vos_mem_copy(pmk_cache->pmk,
+                 pSession->PmkidCacheInfo[Index].pmk,
+                 pSession->PmkidCacheInfo[Index].pmk_len);
+    pmk_cache->pmk_len = pSession->PmkidCacheInfo[Index].pmk_len;
+
+    fRC = TRUE;
+
     smsLog(pMac, LOG1, "csrLookupPMKID called return match = %d pMac->roam.NumPmkidCache = %d",
         fRC, pSession->NumPmkidCache);
 
     return fRC;
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+/*
+ * csr_update_pmksa_for_cache_id: update tPmkidCacheInfo to lookup using
+ * ssid and cache id
+ * @bss_desc: bss description
+ * @profile: csr roam profile
+ * @pmkid_cache: pmksa cache
+ *
+ * Return: true if cache identifier present else false
+ */
+static bool csr_update_pmksa_for_cache_id(tSirBssDescription *bss_desc,
+                tCsrRoamProfile *profile,
+                tPmkidCacheInfo *pmkid_cache)
+{
+    if (!bss_desc->fils_info_element.is_cache_id_present)
+        return false;
+
+    pmkid_cache->ssid_len =
+        profile->SSIDs.SSIDList[0].SSID.length;
+    vos_mem_copy(pmkid_cache->ssid,
+        profile->SSIDs.SSIDList[0].SSID.ssId,
+        profile->SSIDs.SSIDList[0].SSID.length);
+    vos_mem_copy(pmkid_cache->cache_id,
+        bss_desc->fils_info_element.cache_id,
+        CACHE_ID_LEN);
+    vos_mem_copy(pmkid_cache->BSSID,
+        bss_desc->bssId, VOS_MAC_ADDR_SIZE);
+
+    return true;
+}
+
+/*
+ * csr_update_pmksa_to_profile: update pmk and pmkid to profile which will be
+ * used in case of fils session
+ * @profile: profile
+ * @pmkid_cache: pmksa cache
+ *
+ * Return: None
+ */
+static inline void csr_update_pmksa_to_profile(tCsrRoamProfile *profile,
+        tPmkidCacheInfo *pmkid_cache)
+{
+    if (!profile->fils_con_info)
+        return;
+
+    profile->fils_con_info->pmk_len = pmkid_cache->pmk_len;
+    vos_mem_copy(profile->fils_con_info->pmk,
+            pmkid_cache->pmk, pmkid_cache->pmk_len);
+    vos_mem_copy(profile->fils_con_info->pmkid,
+        pmkid_cache->PMKID, CSR_RSN_PMKID_SIZE);
+
+}
+#else
+static inline bool csr_update_pmksa_for_cache_id(tSirBssDescription *bss_desc,
+                tCsrRoamProfile *profile,
+                tPmkidCacheInfo *pmkid_cache)
+{
+    return false;
+}
+
+static inline void csr_update_pmksa_to_profile(tCsrRoamProfile *profile,
+        tPmkidCacheInfo *pmkid_cache)
+{
+}
+#endif
 
 tANI_U8 csrConstructRSNIe( tHalHandle hHal, tANI_U32 sessionId, tCsrRoamProfile *pProfile,
                             tSirBssDescription *pSirBssDesc, tDot11fBeaconIEs *pIes, tCsrRSNIe *pRSNIe )
@@ -3171,7 +3713,7 @@ tANI_U8 csrConstructRSNIe( tHalHandle hHal, tANI_U32 sessionId, tCsrRoamProfile
     tCsrRSNAuthIe *pAuthSuite;
     tCsrRSNCapabilities RSNCapabilities;
     tCsrRSNPMKIe        *pPMK;
-    tANI_U8 PMKId[CSR_RSN_PMKID_SIZE];
+    tPmkidCacheInfo pmkid_cache;
 #ifdef WLAN_FEATURE_11W
     tANI_U8 *pGroupMgmtCipherSuite;
 #endif
@@ -3232,17 +3774,23 @@ tANI_U8 csrConstructRSNIe( tHalHandle hHal, tANI_U32 sessionId, tCsrRoamProfile
         *(tANI_U16 *)( &pAuthSuite->AuthOui[ 1 ] ) = *((tANI_U16 *)(&RSNCapabilities));
 
         pPMK = (tCsrRSNPMKIe *)( ((tANI_U8 *)(&pAuthSuite->AuthOui[ 1 ])) + sizeof(tANI_U16) );
-
+        if (!csr_update_pmksa_for_cache_id(pSirBssDesc, pProfile, &pmkid_cache))
+            vos_mem_copy((v_MACADDR_t *)pmkid_cache.BSSID,
+                        (v_MACADDR_t *)pSirBssDesc->bssId,
+                         VOS_MAC_ADDR_SIZE);
         // Don't include the PMK SA IDs for CCKM associations.
         if (
 #ifdef FEATURE_WLAN_ESE
                 (eCSR_AUTH_TYPE_CCKM_RSN != negAuthType) &&
 #endif
-              csrLookupPMKID( pMac, sessionId, pSirBssDesc->bssId, &(PMKId[0])))
+              csrLookupPMKID( pMac, sessionId, &pmkid_cache))
         {
             pPMK->cPMKIDs = 1;
 
-            vos_mem_copy(pPMK->PMKIDList[0].PMKID, PMKId, CSR_RSN_PMKID_SIZE);
+            vos_mem_copy(pPMK->PMKIDList[0].PMKID, 
+                         pmkid_cache.PMKID,
+                         CSR_RSN_PMKID_SIZE);
+            csr_update_pmksa_to_profile(pProfile, &pmkid_cache);
         }
         else
         {
@@ -4926,6 +5474,40 @@ static tANI_BOOLEAN csrIsRateSetMatch( tpAniSirGlobal pMac,
 
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+/*
+ * csr_is_fils_realm_match: API to check whether realm in scan filter is
+ * matching with realm in bss info
+ * @bss_descr: bss description
+ * @filter: scan filter
+ *
+ * Return: true if success else false
+ */
+static bool csr_is_fils_realm_match(tSirBssDescription *bss_descr,
+                        tCsrScanResultFilter *filter)
+{
+    int i;
+    bool is_match = true;
+
+    if (filter->realm_check) {
+        is_match = false;
+        for (i = 0; i < bss_descr->fils_info_element.realm_cnt; i++) {
+            if (!adf_os_mem_cmp(filter->fils_realm,
+                    bss_descr->fils_info_element.realm[i],
+                    SIR_REALM_LEN)) {
+                    return true;
+            }
+        }
+    }
+    return is_match;
+}
+#else
+static bool csr_is_fils_realm_match(tSirBssDescription *bss_descr,
+                                    tCsrScanResultFilter *filter)
+{
+    return true;
+}
+#endif
 
 //ppIes can be NULL. If caller want to get the *ppIes allocated by this function, pass in *ppIes = NULL
 tANI_BOOLEAN csrMatchBSS( tHalHandle hHal, tSirBssDescription *pBssDesc, tCsrScanResultFilter *pFilter,
@@ -5066,6 +5648,8 @@ tANI_BOOLEAN csrMatchBSS( tHalHandle hHal, tSirBssDescription *pBssDesc, tCsrSca
         }
 #endif
         fRC = eANI_BOOLEAN_TRUE;
+        if (fRC)
+            fRC = csr_is_fils_realm_match(pBssDesc, pFilter);
 
     } while( 0 );
     if( ppIes )
@@ -5374,6 +5958,19 @@ tANI_U16 csrRatesFindBestRate( tSirMacRateSet *pSuppRates, tSirMacRateSet *pExtR
     return nBest;
 }
 
+#ifdef WLAN_FEATURE_FILS_SK
+static inline void csr_free_fils_profile_info(tCsrRoamProfile *profile)
+{
+    if (profile->fils_con_info) {
+        vos_mem_free(profile->fils_con_info);
+        profile->fils_con_info = NULL;
+    }
+}
+#else
+static inline void csr_free_fils_profile_info(tCsrRoamProfile *profile)
+{ }
+#endif
+
 
 void csrReleaseProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pProfile)
 {
@@ -5423,6 +6020,7 @@ void csrReleaseProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pProfile)
             vos_mem_free(pProfile->ChannelInfo.ChannelList);
             pProfile->ChannelInfo.ChannelList = NULL;
         }
+        csr_free_fils_profile_info(pProfile);
         vos_mem_set(pProfile, sizeof(tCsrRoamProfile), 0);
     }
 }
@@ -5976,25 +6574,25 @@ void csrDisconnectAllActiveSessions(tpAniSirGlobal pMac)
  * Return: chan status info
  */
 struct lim_channel_status *csr_get_channel_status(
-       void *p_mac, uint32_t channel_id)
-{
-       uint8_t i;
-       struct lim_scan_channel_status *channel_status;
-       tpAniSirGlobal mac_ptr = (tpAniSirGlobal)p_mac;
-
-       if (ACS_FW_REPORT_PARAM_CONFIGURED) {
-               channel_status = (struct lim_scan_channel_status *)
-                               &mac_ptr->lim.scan_channel_status;
-               for (i = 0; i < channel_status->total_channel; i++) {
-                       if (channel_status->channel_status_list[i].channel_id
-                                == channel_id)
-                               return &channel_status->channel_status_list[i];
-               }
-               smsLog(mac_ptr, LOGW,
-                        FL("Channel %d status info not exist"),
-                         channel_id);
-       }
-       return NULL;
+	void *p_mac, uint32_t channel_id)
+{
+	uint8_t i;
+	struct lim_scan_channel_status *channel_status;
+	tpAniSirGlobal mac_ptr = (tpAniSirGlobal)p_mac;
+
+	if (ACS_FW_REPORT_PARAM_CONFIGURED) {
+		channel_status = (struct lim_scan_channel_status *)
+				&mac_ptr->lim.scan_channel_status;
+		for (i = 0; i < channel_status->total_channel; i++) {
+			if (channel_status->channel_status_list[i].channel_id
+				 == channel_id)
+				return &channel_status->channel_status_list[i];
+		}
+		smsLog(mac_ptr, LOGW,
+			 FL("Channel %d status info not exist"),
+			  channel_id);
+	}
+	return NULL;
 }
 
 /**
@@ -6005,14 +6603,14 @@ struct lim_channel_status *csr_get_channel_status(
  */
 void csr_clear_channel_status(void *p_mac)
 {
-       tpAniSirGlobal mac_ptr = (tpAniSirGlobal)p_mac;
-       struct lim_scan_channel_status *channel_status;
-       if (ACS_FW_REPORT_PARAM_CONFIGURED) {
-               channel_status = (struct lim_scan_channel_status *)
-                               &mac_ptr->lim.scan_channel_status;
-               channel_status->total_channel = 0;
-       }
-       return;
+	tpAniSirGlobal mac_ptr = (tpAniSirGlobal)p_mac;
+	struct lim_scan_channel_status *channel_status;
+	if (ACS_FW_REPORT_PARAM_CONFIGURED) {
+		channel_status = (struct lim_scan_channel_status *)
+				&mac_ptr->lim.scan_channel_status;
+		channel_status->total_channel = 0;
+	}
+	return;
 }
 
 #ifdef FEATURE_WLAN_LFR
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/nan/nan_datapath_api.c b/drivers/staging/qcacld-2.0/CORE/SME/src/nan/nan_datapath_api.c
index 2a28d1a3026..fc2926f2528 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/nan/nan_datapath_api.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/nan/nan_datapath_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -30,6 +30,46 @@
 #include "sme_nan_datapath.h"
 
 /**
+ * csr_free_ndp_initiator_req() - free resouces from sme command for ndp
+ * initiator request
+ * @cmd: sme command msg
+ *
+ * Return: None
+ */
+void csr_free_ndp_initiator_req(tSmeCmd *cmd)
+{
+	vos_mem_free(cmd->u.initiator_req.ndp_config.ndp_cfg);
+	cmd->u.initiator_req.ndp_config.ndp_cfg = NULL;
+	cmd->u.initiator_req.ndp_config.ndp_cfg_len = 0;
+	vos_mem_free(cmd->u.initiator_req.ndp_info.ndp_app_info);
+	cmd->u.initiator_req.ndp_info.ndp_app_info = NULL;
+	cmd->u.initiator_req.ndp_info.ndp_app_info_len = 0;
+	vos_mem_free(cmd->u.initiator_req.pmk.pmk);
+	cmd->u.initiator_req.pmk.pmk = NULL;
+	cmd->u.initiator_req.pmk.pmk_len = 0;
+}
+
+/**
+ * csr_free_ndp_responder_req() - free resouces from sme command for ndp
+ * responder request
+ * @cmd: sme command msg
+ *
+ * Return: None
+ */
+void csr_free_ndp_responder_req(tSmeCmd *cmd)
+{
+	vos_mem_free(cmd->u.responder_req.ndp_config.ndp_cfg);
+	cmd->u.responder_req.ndp_config.ndp_cfg = NULL;
+	cmd->u.responder_req.ndp_config.ndp_cfg_len = 0;
+	vos_mem_free(cmd->u.responder_req.ndp_info.ndp_app_info);
+	cmd->u.responder_req.ndp_info.ndp_app_info = NULL;
+	cmd->u.responder_req.ndp_info.ndp_app_info_len = 0;
+	vos_mem_free(cmd->u.responder_req.pmk.pmk);
+	cmd->u.responder_req.pmk.pmk = NULL;
+	cmd->u.responder_req.pmk.pmk_len = 0;
+}
+
+/**
  * sme_ndp_initiator_req_handler() - ndp initiator req handler
  * @hal: hal handle
  * @req_params: request parameters
@@ -67,12 +107,13 @@ eHalStatus sme_ndp_initiator_req_handler(tHalHandle hal,
 	/* pointers copied as part of above operation are to be overwritten */
 	cmd->u.initiator_req.ndp_info.ndp_app_info = NULL;
 	cmd->u.initiator_req.ndp_config.ndp_cfg = NULL;
+	cmd->u.initiator_req.pmk.pmk = NULL;
 
 	if (req_params->ndp_info.ndp_app_info_len) {
 		cmd->u.initiator_req.ndp_info.ndp_app_info =
 			vos_mem_malloc(req_params->ndp_info.ndp_app_info_len);
 		if (NULL == cmd->u.initiator_req.ndp_info.ndp_app_info) {
-			csrReleaseCommandRoam(mac_ctx, cmd);
+			csr_release_ndp_initiator_req(mac_ctx, cmd);
 			sme_ReleaseGlobalLock(&mac_ctx->sme);
 			return eHAL_STATUS_FAILED_ALLOC;
 		}
@@ -85,11 +126,8 @@ eHalStatus sme_ndp_initiator_req_handler(tHalHandle hal,
 		cmd->u.initiator_req.ndp_config.ndp_cfg =
 			vos_mem_malloc(req_params->ndp_config.ndp_cfg_len);
 		if (NULL == cmd->u.initiator_req.ndp_config.ndp_cfg) {
-			csrReleaseCommandRoam(mac_ctx, cmd);
+			csr_release_ndp_initiator_req(mac_ctx, cmd);
 			sme_ReleaseGlobalLock(&mac_ctx->sme);
-			vos_mem_free(
-				cmd->u.initiator_req.ndp_info.ndp_app_info);
-			cmd->u.initiator_req.ndp_info.ndp_app_info_len = 0;
 			return eHAL_STATUS_FAILED_ALLOC;
 		}
 		vos_mem_copy(cmd->u.initiator_req.ndp_config.ndp_cfg,
@@ -97,6 +135,18 @@ eHalStatus sme_ndp_initiator_req_handler(tHalHandle hal,
 			req_params->ndp_config.ndp_cfg_len);
 	}
 
+	if (req_params->pmk.pmk_len) {
+		cmd->u.initiator_req.pmk.pmk =
+			vos_mem_malloc(req_params->pmk.pmk_len);
+		if (NULL == cmd->u.initiator_req.pmk.pmk) {
+			csr_release_ndp_initiator_req(mac_ctx, cmd);
+			sme_ReleaseGlobalLock(&mac_ctx->sme);
+			return eHAL_STATUS_FAILED_ALLOC;
+		}
+		vos_mem_copy(cmd->u.initiator_req.pmk.pmk,
+			     req_params->pmk.pmk, req_params->pmk.pmk_len);
+	}
+
 	status = csrQueueSmeCommand(mac_ctx, cmd, TRUE);
 	if (eHAL_STATUS_SUCCESS != status) {
 		smsLog(mac_ctx, LOGE, FL("SME enqueue failed, status:%d"),
@@ -150,12 +200,13 @@ eHalStatus sme_ndp_responder_req_handler(tHalHandle hal,
 	 */
 	cmd->u.responder_req.ndp_info.ndp_app_info = NULL;
 	cmd->u.responder_req.ndp_config.ndp_cfg = NULL;
+	cmd->u.responder_req.pmk.pmk = NULL;
 
 	if (req_params->ndp_info.ndp_app_info_len) {
 		cmd->u.responder_req.ndp_info.ndp_app_info =
 			vos_mem_malloc(req_params->ndp_info.ndp_app_info_len);
 		if (NULL == cmd->u.responder_req.ndp_info.ndp_app_info) {
-			csrReleaseCommandRoam(mac_ctx, cmd);
+			csr_release_ndp_responder_req(mac_ctx, cmd);
 			sme_ReleaseGlobalLock(&mac_ctx->sme);
 			return eHAL_STATUS_FAILED_ALLOC;
 		}
@@ -168,11 +219,8 @@ eHalStatus sme_ndp_responder_req_handler(tHalHandle hal,
 		cmd->u.responder_req.ndp_config.ndp_cfg =
 			vos_mem_malloc(req_params->ndp_config.ndp_cfg_len);
 		if (NULL == cmd->u.responder_req.ndp_config.ndp_cfg) {
-			csrReleaseCommandRoam(mac_ctx, cmd);
+			csr_release_ndp_responder_req(mac_ctx, cmd);
 			sme_ReleaseGlobalLock(&mac_ctx->sme);
-			vos_mem_free(
-				cmd->u.responder_req.ndp_info.ndp_app_info);
-			cmd->u.responder_req.ndp_info.ndp_app_info_len = 0;
 			return eHAL_STATUS_FAILED_ALLOC;
 		}
 		vos_mem_copy(cmd->u.responder_req.ndp_config.ndp_cfg,
@@ -180,6 +228,18 @@ eHalStatus sme_ndp_responder_req_handler(tHalHandle hal,
 			req_params->ndp_config.ndp_cfg_len);
 	}
 
+	if (req_params->pmk.pmk_len) {
+		cmd->u.responder_req.pmk.pmk =
+			vos_mem_malloc(req_params->pmk.pmk_len);
+		if (NULL == cmd->u.responder_req.pmk.pmk) {
+			csr_release_ndp_responder_req(mac_ctx, cmd);
+			sme_ReleaseGlobalLock(&mac_ctx->sme);
+			return eHAL_STATUS_FAILED_ALLOC;
+		}
+		vos_mem_copy(cmd->u.responder_req.pmk.pmk,
+			     req_params->pmk.pmk, req_params->pmk.pmk_len);
+	}
+
 	status = csrQueueSmeCommand(mac_ctx, cmd, TRUE);
 	if (eHAL_STATUS_SUCCESS != status) {
 		smsLog(mac_ctx, LOGE,
@@ -249,19 +309,6 @@ VOS_STATUS sme_ndp_end_req_handler(tHalHandle hal, struct ndp_end_req *req)
 }
 
 /**
- * sme_ndp_sched_req_handler() - ndp schedule request handler
- * @session_id: session id over which the ndp is being created
- * @req_params: request parameters
- *
- * Return: VOS_STATUS_SUCCESS on success; error number otherwise
- */
-VOS_STATUS sme_ndp_sched_req_handler(uint32_t session_id,
-	struct ndp_schedule_update_req *req_params)
-{
-	return VOS_STATUS_SUCCESS;
-}
-
-/**
  * csr_roam_start_ndi() - Start connection for NaN data path
  * @mac_ctx: Global MAC context
  * @session: SME session ID
@@ -375,6 +422,7 @@ void csr_roam_update_ndp_return_params(tpAniSirGlobal mac_ctx,
 	switch (result) {
 	case eCsrStartBssSuccess:
 		roam_info->ndp.ndi_create_params.reason = 0;
+		roam_info->ndp.ndi_create_params.sta_id = roam_info->staId;
 		roam_info->ndp.ndi_create_params.status =
 					NDP_RSP_STATUS_SUCCESS;
 		*roam_status = eCSR_ROAM_NDP_STATUS_UPDATE;
@@ -432,8 +480,10 @@ eHalStatus csr_process_ndp_initiator_request(tpAniSirGlobal mac_ctx,
 
 	msg_len = sizeof(*lim_msg);
 	lim_msg = vos_mem_malloc(msg_len);
-	if (NULL == lim_msg)
-		return eHAL_STATUS_FAILED_ALLOC;
+	if (NULL == lim_msg) {
+		status = eHAL_STATUS_FAILED_ALLOC;
+		goto sme_initiator_req_failed;
+	}
 
 	vos_mem_set(lim_msg, msg_len, 0);
 	lim_msg->msg_type =
@@ -452,18 +502,11 @@ eHalStatus csr_process_ndp_initiator_request(tpAniSirGlobal mac_ctx,
 		MAC_ADDR_ARRAY(self_mac_addr));
 
 	status = palSendMBMessage(mac_ctx->hHdd, lim_msg);
-	if (!HAL_STATUS_SUCCESS(status)) {
-		/*
-		 * If fail, free up the ndp_cfg and ndp_app_info
-		 * allocated in sme.
-		 */
-		vos_mem_free(cmd->u.initiator_req.ndp_info.ndp_app_info);
-		vos_mem_free(cmd->u.initiator_req.ndp_config.ndp_cfg);
-		cmd->u.initiator_req.ndp_info.ndp_app_info_len = 0;
-		cmd->u.initiator_req.ndp_config.ndp_cfg_len = 0;
-		cmd->u.initiator_req.ndp_config.ndp_cfg = NULL;
-		cmd->u.initiator_req.ndp_info.ndp_app_info = NULL;
-	}
+
+sme_initiator_req_failed:
+	/* If fail, free up resources allocated in sme. */
+	if (!HAL_STATUS_SUCCESS(status))
+		csr_free_ndp_initiator_req(cmd);
 	return status;
 }
 
@@ -499,9 +542,9 @@ eHalStatus csr_process_ndp_responder_request(tpAniSirGlobal mac_ctx,
 		pal_cpu_to_be16((uint16_t)eWNI_SME_NDP_RESPONDER_REQ);
 	lim_msg->msg_len = pal_cpu_to_be16(msg_len);
 	/*
-	 * following is being copied from p_cmd->u.initiator_req,
+	 * following is being copied from p_cmd->u.responder_req,
 	 * no need to perform deep copy, as we are going to use memory
-	 * allocated at SME in p_cmd->u.initiator_req and pass it all the way
+	 * allocated at SME in p_cmd->u.responder_req and pass it all the way
 	 * to WMA.
 	 */
 	vos_mem_copy(&lim_msg->req, &cmd->u.responder_req,
@@ -516,18 +559,9 @@ eHalStatus csr_process_ndp_responder_request(tpAniSirGlobal mac_ctx,
 	status = palSendMBMessage(mac_ctx->hHdd, lim_msg);
 
 free_config:
-	if (!HAL_STATUS_SUCCESS(status)) {
-		/*
-		 * If fail, free up the ndp_cfg and ndp_app_info
-		 * allocated in sme.
-		 */
-		vos_mem_free(cmd->u.responder_req.ndp_info.ndp_app_info);
-		vos_mem_free(cmd->u.responder_req.ndp_config.ndp_cfg);
-		cmd->u.responder_req.ndp_info.ndp_app_info_len = 0;
-		cmd->u.responder_req.ndp_config.ndp_cfg_len = 0;
-		cmd->u.responder_req.ndp_config.ndp_cfg = NULL;
-		cmd->u.responder_req.ndp_info.ndp_app_info = NULL;
-	}
+	/* If fail, free up the ndp_cfg and ndp_app_info allocated in sme. */
+	if (!HAL_STATUS_SUCCESS(status))
+		csr_free_ndp_responder_req(cmd);
 	return status;
 }
 
@@ -728,11 +762,10 @@ void sme_ndp_msg_processor(tpAniSirGlobal mac_ctx, vos_msg_t *msg)
 		}
 		break;
 	case eWNI_SME_NDP_INDICATION:
+		vos_mem_free(roam_info.ndp.ndp_indication_params.scid.scid);
+		vos_mem_free(roam_info.ndp.ndp_indication_params.ndp_config.ndp_cfg);
 		vos_mem_free(
-			roam_info.ndp.ndp_indication_params.ndp_config.ndp_cfg);
-		vos_mem_free(
-			roam_info.ndp.ndp_indication_params.
-				ndp_info.ndp_app_info);
+			roam_info.ndp.ndp_indication_params.ndp_info.ndp_app_info);
 		break;
 	case eWNI_SME_NDP_END_RSP:
 		if (cmd &&
@@ -757,6 +790,7 @@ void sme_ndp_msg_processor(tpAniSirGlobal mac_ctx, vos_msg_t *msg)
 
 /**
  * csr_release_ndp_initiator_req() - free resouces from sme command for ndp
+ * and release the cmd
  * initiator request
  * @mac_ctx: Global MAC context
  * @cmd: sme command msg
@@ -765,19 +799,13 @@ void sme_ndp_msg_processor(tpAniSirGlobal mac_ctx, vos_msg_t *msg)
  */
 void csr_release_ndp_initiator_req(tpAniSirGlobal mac_ctx, tSmeCmd *cmd)
 {
-	vos_mem_free(cmd->u.initiator_req.ndp_config.ndp_cfg);
-	cmd->u.initiator_req.ndp_config.ndp_cfg = NULL;
-	cmd->u.initiator_req.ndp_config.ndp_cfg_len = 0;
-	vos_mem_free(cmd->u.initiator_req.ndp_info.ndp_app_info);
-	cmd->u.initiator_req.ndp_info.ndp_app_info = NULL;
-	cmd->u.initiator_req.ndp_info.ndp_app_info_len = 0;
+	csr_free_ndp_initiator_req(cmd);
 	smeReleaseCommand(mac_ctx, cmd);
 }
 
-
 /**
  * csr_release_ndp_responder_req() - free resouces from sme command for ndp
- * responder request
+ * responder request and release the command
  * @mac_ctx: Global MAC context
  * @cmd: sme command msg
  *
@@ -785,16 +813,10 @@ void csr_release_ndp_initiator_req(tpAniSirGlobal mac_ctx, tSmeCmd *cmd)
  */
 void csr_release_ndp_responder_req(tpAniSirGlobal mac_ctx, tSmeCmd *cmd)
 {
-	vos_mem_free(cmd->u.responder_req.ndp_config.ndp_cfg);
-	cmd->u.responder_req.ndp_config.ndp_cfg = NULL;
-	cmd->u.responder_req.ndp_config.ndp_cfg_len = 0;
-	vos_mem_free(cmd->u.responder_req.ndp_info.ndp_app_info);
-	cmd->u.responder_req.ndp_info.ndp_app_info = NULL;
-	cmd->u.responder_req.ndp_info.ndp_app_info_len = 0;
+	csr_free_ndp_responder_req(cmd);
 	smeReleaseCommand(mac_ctx, cmd);
 }
 
-
 /**
  * csr_release_ndp_data_end_req() - free resouces from sme command for ndp
  * data end request
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/oemData/oemDataApi.c b/drivers/staging/qcacld-2.0/CORE/SME/src/oemData/oemDataApi.c
index 9b5e56cc378..fc3f91cf6ba 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/oemData/oemDataApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/oemData/oemDataApi.c
@@ -208,7 +208,6 @@ eHalStatus oemData_SendMBOemDataReq(tpAniSirGlobal pMac, tOemDataReq *pOemDataRe
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSirOemDataReq* pMsg;
-    tANI_U16 msgLen;
     tCsrRoamSession *pSession;
 
     smsLog(pMac, LOGW, "OEM_DATA: entering Function %s", __func__);
@@ -225,9 +224,8 @@ eHalStatus oemData_SendMBOemDataReq(tpAniSirGlobal pMac, tOemDataReq *pOemDataRe
         return eHAL_STATUS_FAILURE;
     }
 
-    msgLen = (uint16_t) (sizeof(*pMsg) + pOemDataReq->data_len);
     pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_OEM_DATA_REQ);
-    pMsg->messageLen = pal_cpu_to_be16(msgLen);
+    pMsg->messageLen = pal_cpu_to_be16((uint16_t) sizeof(*pMsg));
     vos_mem_copy(pMsg->selfMacAddr, pSession->selfMacAddr, sizeof(tSirMacAddr) );
     pMsg->data_len = pOemDataReq->data_len;
     /* Incoming buffer ptr saved, set to null to avoid free by caller */
@@ -324,10 +322,10 @@ eHalStatus sme_HandleOemDataRsp(tHalHandle hHal, tANI_U8* pMsg)
                 if (csrLLRemoveEntry(&pMac->sme.smeCmdActiveList,
                                      &pCommand->Link, LL_ACCESS_LOCK))
                 {
-                    vos_mem_set(&(pCommand->u.oemDataCmd),
-                                sizeof(tOemDataCmd), 0);
                     req = &(pCommand->u.oemDataCmd.oemDataReq);
                     vos_mem_free(req->data);
+                    vos_mem_set(&(pCommand->u.oemDataCmd),
+                                sizeof(tOemDataCmd), 0);
                     smeReleaseCommand(pMac, pCommand);
                 }
             }
@@ -342,6 +340,7 @@ eHalStatus sme_HandleOemDataRsp(tHalHandle hHal, tANI_U8* pMsg)
                                   pOemDataRsp->oem_data_rsp);
             /* free this memory only if rsp is from target */
             vos_mem_free(pOemDataRsp->oem_data_rsp);
+            pOemDataRsp->oem_data_rsp = NULL;
         } else {
             smsLog(pMac, LOG1, FL("received internal oem data resp"));
         }
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/pmc/pmc.c b/drivers/staging/qcacld-2.0/CORE/SME/src/pmc/pmc.c
index ac04c8e30ee..838f9e64e3b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/pmc/pmc.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/pmc/pmc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -982,10 +982,13 @@ void pmcTrafficTimerExpired (tHalHandle hHal)
         return;
     }
 
-    /* Until DHCP is not completed remain in power active */
-    if(pMac->pmc.remainInPowerActiveTillDHCP)
-    {
-        pmcLog(pMac, LOG2, FL("BMPS Traffic Timer expired before DHCP completion ignore enter BMPS"));
+    /* Untill DHCP and set key is not completed remain in power active */
+    if (pMac->pmc.remainInPowerActiveTillDHCP ||
+       pMac->pmc.full_power_till_set_key) {
+        pmcLog(pMac, LOG2,
+          FL("BMPS Traffic Timer expired before DHCP(%d) or set key (%d) completion ignore enter BMPS"),
+          pMac->pmc.remainInPowerActiveTillDHCP,
+          pMac->pmc.full_power_till_set_key);
         pMac->pmc.remainInPowerActiveThreshold++;
         if( pMac->pmc.remainInPowerActiveThreshold >= DHCP_REMAIN_POWER_ACTIVE_THRESHOLD)
         {
@@ -993,6 +996,7 @@ void pmcTrafficTimerExpired (tHalHandle hHal)
                   FL("Remain in power active DHCP threshold reached FALLBACK to enable enter BMPS"));
            /*FALLBACK: reset the flag to make BMPS entry possible*/
            pMac->pmc.remainInPowerActiveTillDHCP = FALSE;
+           pMac->pmc.full_power_till_set_key = false;
            pMac->pmc.remainInPowerActiveThreshold = 0;
         }
         //Activate the Traffic Timer again for entering into BMPS
@@ -3322,9 +3326,14 @@ eHalStatus pmcOffloadExitPowersaveState(tpAniSirGlobal pMac, tANI_U32 sessionId)
      /* Call Full Power Req Cbs */
      pmcOffloadDoFullPowerCallbacks(pMac, sessionId, eHAL_STATUS_SUCCESS);
 
-     if (pmc->configStaPsEnabled || pmc->configDefStaPsEnabled)
+     if (pmc->configStaPsEnabled || pmc->configDefStaPsEnabled) {
+        if (true == vos_is_mon_enable()) {
+           smsLog(pMac, LOGE, FL("Montior is enabled, skip start StaPsTimer"));
+           return eHAL_STATUS_SUCCESS;
+        }
         pmcOffloadStartAutoStaPsTimer(pMac, sessionId,
                                       pmc->autoPsEntryTimerPeriod);
+        }
      else
         smsLog(pMac, LOGE, FL("Master Sta Ps Disabled"));
      return eHAL_STATUS_SUCCESS;
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/pmc/pmcApi.c b/drivers/staging/qcacld-2.0/CORE/SME/src/pmc/pmcApi.c
index 552c65078b5..0bf93a932fd 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/pmc/pmcApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/pmc/pmcApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -204,6 +204,7 @@ eHalStatus pmcStart (tHalHandle hHal)
     pMac->pmc.wowlModeRequired = FALSE;
     pMac->pmc.bmpsRequestedByHdd = FALSE;
     pMac->pmc.remainInPowerActiveTillDHCP = FALSE;
+    pMac->pmc.full_power_till_set_key = false;
     pMac->pmc.remainInPowerActiveThreshold = 0;
 
     /* WLAN Switch initial states. */
@@ -2866,14 +2867,17 @@ eHalStatus pmcSetPreferredNetworkList
         return eHAL_STATUS_FAILURE;
     }
 
-    pRequestBuf = vos_mem_malloc(sizeof(tSirPNOScanReq));
+    pRequestBuf = vos_mem_malloc(sizeof(tSirPNOScanReq) +
+                  (pRequest->num_vendor_oui) *
+                  (sizeof(struct vendor_oui)));
     if (NULL == pRequestBuf)
     {
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR, "%s: Not able to allocate memory for PNO request", __func__);
         return eHAL_STATUS_FAILED_ALLOC;
     }
 
-    vos_mem_copy(pRequestBuf, pRequest, sizeof(tSirPNOScanReq));
+    vos_mem_copy(pRequestBuf, pRequest, sizeof(tSirPNOScanReq) +
+                 (pRequest->num_vendor_oui) * (sizeof(struct vendor_oui)));
 
     /*Must translate the mode first*/
     ucDot11Mode = (tANI_U8) csrTranslateToWNICfgDot11Mode(pMac,
@@ -3144,6 +3148,8 @@ eHalStatus pmcGetFilterMatchCount
 #endif // WLAN_FEATURE_PACKET_FILTERING
 
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
+
+#define GTK_OFFLOAD_DISABLE 1
 /* ---------------------------------------------------------------------------
     \fn pmcSetGTKOffload
     \brief  Set GTK offload feature.
@@ -3184,6 +3190,11 @@ eHalStatus pmcSetGTKOffload (tHalHandle hHal, tpSirGtkOffloadParams pGtkOffload,
 
     vos_mem_copy(pRequestBuf, pGtkOffload, sizeof(tSirGtkOffloadParams));
 
+#ifdef WLAN_FEATURE_FILS_SK
+    if (pSession->is_fils_connection)
+        pRequestBuf->ulFlags = GTK_OFFLOAD_DISABLE;
+#endif
+
     msg.type = WDA_GTK_OFFLOAD_REQ;
     msg.reserved = 0;
     msg.bodyptr = pRequestBuf;
@@ -3605,14 +3616,41 @@ eHalStatus PmcOffloadEnableStaModePowerSave(tHalHandle hHal,
 }
 
 eHalStatus PmcOffloadDisableStaModePowerSave(tHalHandle hHal,
+                                             FullPowerReqCb callback_routine,
+                                             void *callback_context,
                                              tANI_U32 sessionId)
 {
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
     tpPsOffloadPerSessionInfo pmc = &pMac->pmcOffloadInfo.pmc[sessionId];
     eHalStatus status = eHAL_STATUS_SUCCESS;
+    tpPmcOffloadReqFullPowerEntry power_entry;
+    tListElem *pEntry;
 
-    if (pmc->configStaPsEnabled) {
+    if (pmc->configStaPsEnabled ||
+        vos_is_mon_enable()) {
+        if (callback_routine) {
+            /* Allocate entry for Full Power Cb list. */
+            power_entry = vos_mem_malloc(sizeof(*power_entry));
+            if (!power_entry) {
+                smsLog(pMac, LOGE,
+                       FL("Cannot allocate memory for Full Pwr routine list"));
+                return eHAL_STATUS_FAILED_ALLOC;
+            }
+            /* Store routine and context in entry. */
+            power_entry->fullPwrCb = callback_routine;
+            power_entry->callbackContext = callback_context;
+            power_entry->sessionId = sessionId;
+            /* Add entry to list. */
+            csrLLInsertTail(&pmc->fullPowerCbList, &power_entry->link, FALSE);
+        }
         status = pmcOffloadDisableStaPsHandler(pMac, sessionId);
+        if ((eHAL_STATUS_SUCCESS != status) && callback_routine) {
+            pEntry = csrLLRemoveTail(&pmc->fullPowerCbList, TRUE);
+            power_entry = GET_BASE_ADDR(pEntry,
+                    tPmcOffloadReqFullPowerEntry, link);
+            vos_mem_free(power_entry);
+            return eHAL_STATUS_FAILURE;
+        }
     } else {
         /*
          * configStaPsEnabled is the master flag
@@ -3625,8 +3663,9 @@ eHalStatus PmcOffloadDisableStaModePowerSave(tHalHandle hHal,
         /* Stop the Auto Sta Ps Timer if running */
         pmcOffloadStopAutoStaPsTimer(pMac, sessionId);
         pmc->configDefStaPsEnabled = FALSE;
+        return eHAL_STATUS_SUCCESS;
     }
-    return status;
+    return eHAL_STATUS_PMC_PENDING;
 }
 
 eHalStatus pmcOffloadRequestFullPower (tHalHandle hHal, tANI_U32 sessionId,
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_Api.c b/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_Api.c
index 1c7d11843ed..1206f1ba630 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_Api.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_Api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -76,11 +76,11 @@
 #include "schApi.h"
 #include "sme_nan_datapath.h"
 #include "csrApi.h"
+#include "utilsApi.h"
 
 extern tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 
 #define LOG_SIZE 256
-#define READ_MEMORY_DUMP_CMD     9
 #define TL_INIT_STATE            0
 
 static tSelfRecoveryStats gSelfRecoveryStats;
@@ -131,6 +131,9 @@ eHalStatus sme_ProcessChannelChangeResp(tpAniSirGlobal pMac,
                            v_U16_t msg_type,void *pMsgBuf);
 eHalStatus sme_process_set_max_tx_power(tpAniSirGlobal pMac,
 						tSmeCmd *command);
+eHalStatus
+sme_process_set_max_tx_power_per_band(tpAniSirGlobal mac_ctx,
+						tSmeCmd *command);
 
 //Internal SME APIs
 eHalStatus sme_AcquireGlobalLock( tSmeStruct *psSme)
@@ -505,7 +508,7 @@ tSmeCmd *smeGetCommandBuffer( tpAniSirGlobal pMac )
             vos_flush_logs(WLAN_LOG_TYPE_FATAL,
                            WLAN_LOG_INDICATOR_HOST_DRIVER,
                            WLAN_LOG_REASON_SME_OUT_OF_CMD_BUF,
-                           false);
+                           DUMP_NO_TRACE);
         } else {
             /* Trigger SSR */
             vos_wlanRestart();
@@ -997,6 +1000,7 @@ sme_process_cmd:
                         case eSmeCommandWmStatusChange:
                             csrLLUnlock( &pMac->sme.smeCmdActiveList );
                             csrRoamProcessWmStatusChangeCommand(pMac, pCommand);
+                            fContinue = eANI_BOOLEAN_TRUE;
                             break;
 
                         case eSmeCommandSetKey:
@@ -1077,6 +1081,20 @@ sme_process_cmd:
                                         &pCommand->Link, LL_ACCESS_LOCK)) {
                                csrReleaseCommand(pMac, pCommand);
                             }
+                            pMac->max_power_cmd_pending = false;
+                            break;
+                        case eSmeCommandSetMaxTxPowerPerBand:
+                            csrLLUnlock(&pMac->sme.smeCmdActiveList);
+                            sme_process_set_max_tx_power_per_band(pMac,
+                                                                     pCommand);
+                            /* We need to re-run the command */
+                            fContinue = eANI_BOOLEAN_TRUE;
+                            /* No Rsp expected, free cmd from active list */
+                            if (csrLLRemoveEntry(&pMac->sme.smeCmdActiveList,
+                                        &pCommand->Link, LL_ACCESS_LOCK)) {
+                               csrReleaseCommand(pMac, pCommand);
+                            }
+                            pMac->max_power_cmd_pending = false;
                             break;
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
@@ -1092,6 +1110,7 @@ sme_process_cmd:
                         case eSmeCommandNoAUpdate:
                             csrLLUnlock( &pMac->sme.smeCmdActiveList );
                             p2pProcessNoAReq(pMac,pCommand);
+                            break;
                         case eSmeCommandEnterImps:
                         case eSmeCommandExitImps:
                         case eSmeCommandEnterBmps:
@@ -1650,7 +1669,7 @@ eHalStatus sme_SetPlmRequest(tHalHandle hHal, tpSirPlmReq pPlmReq)
     eHalStatus status;
     tANI_BOOLEAN ret = eANI_BOOLEAN_FALSE;
     tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-    tANI_U8 ch_list[WNI_CFG_VALID_CHANNEL_LIST] = {0};
+    tANI_U8 ch_list[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
     tANI_U8 count, valid_count = 0;
     vos_msg_t msg;
 
@@ -1868,6 +1887,16 @@ eHalStatus sme_UpdateConfig(tHalHandle hHal, tpSmeConfigParams pSmeConfigParams)
    pMac->fine_time_meas_cap = pSmeConfigParams->fine_time_meas_cap;
 
    pMac->snr_monitor_enabled = pSmeConfigParams->snr_monitor_enabled;
+   pMac->sub20_config_info = pSmeConfigParams->sub20_config_info;
+   pMac->sub20_channelwidth = pSmeConfigParams->sub20_channelwidth;
+   pMac->sub20_dynamic_channelwidth =
+       pSmeConfigParams->sub20_dynamic_channelwidth;
+
+   pMac->sta_auth_retries_for_code17 =
+         pSmeConfigParams->csrConfig.sta_auth_retries_for_code17;
+
+   pMac->sta_change_cc_via_beacon =
+         pSmeConfigParams->sta_change_cc_via_beacon;
 
    return status;
 }
@@ -2210,6 +2239,8 @@ eHalStatus sme_HDDReadyInd(tHalHandle hHal)
 /**
  * sme_set_allowed_action_frames() - Set allowed action frames to wma
  * @hal: Handler to HAL
+ * @bitmap0: bitmap to set
+ * @is_sta: boolean to indicate sta interface
  *
  * This function conveys the list of action frames that needs to be forwarded
  * to driver by FW. Rest of the action frames can be dropped in FW. Bitmask is
@@ -2217,7 +2248,8 @@ eHalStatus sme_HDDReadyInd(tHalHandle hHal)
  *
  * Return: None
  */
-void sme_set_allowed_action_frames(tHalHandle hal, uint32_t bitmap0)
+void sme_set_allowed_action_frames(tHalHandle hal,
+				   uint32_t bitmap0, bool is_sta)
 {
 	eHalStatus status;
 	tpAniSirGlobal mac = PMAC_STRUCT(hal);
@@ -2252,6 +2284,10 @@ void sme_set_allowed_action_frames(tHalHandle hal, uint32_t bitmap0)
 				(ALLOWED_ACTION_FRAMES_BITMAP6);
 	sir_allowed_action_frames->action_category_map[7] =
 				(ALLOWED_ACTION_FRAMES_BITMAP7);
+	if (is_sta)
+		sir_allowed_action_frames->
+			action_per_category[SIR_MAC_ACTION_SPECTRUM_MGMT] =
+			DROP_SPEC_MGMT_ACTION_FRAME_BITMAP;
 
 	status = sme_AcquireGlobalLock(&mac->sme);
 	if (status == eHAL_STATUS_SUCCESS) {
@@ -2276,6 +2312,30 @@ void sme_set_allowed_action_frames(tHalHandle hal, uint32_t bitmap0)
 	return;
 }
 
+/**
+ * sme_handle_cc_change_ind() - handle new country code
+ * @hal_ptr: Handler to HAL
+ * @msg_buf: contain new country code.
+ *
+ * Return: eHAL_STATUS_SUCCESS on success,
+ * eHAL_STATUS_INVALID_PARAMETER on failure.
+ */
+eHalStatus sme_handle_cc_change_ind(tHalHandle hal_ptr, void *msg_buf)
+{
+	eHalStatus status = eHAL_STATUS_FAILURE;
+	tpAniSirGlobal mac_ptr = PMAC_STRUCT(hal_ptr);
+	v_REGDOMAIN_t domainId;
+	struct sme_change_country_code_ind * change_cc_ind =
+			 (struct sme_change_country_code_ind *)msg_buf;
+
+	status =
+		csrGetRegulatoryDomainForCountry(mac_ptr,
+						 change_cc_ind->country_code,
+						 &domainId, COUNTRY_IE);
+
+	return (status);
+}
+
 /*--------------------------------------------------------------------------
 
   \brief sme_Start() - Put all SME modules at ready state.
@@ -2329,7 +2389,7 @@ eHalStatus sme_Start(tHalHandle hHal)
       pMac->sme.state = SME_STATE_START;
    }while (0);
 
-   sme_set_allowed_action_frames(hHal, ALLOWED_ACTION_FRAMES_BITMAP0_STA);
+   sme_set_allowed_action_frames(hHal, ALLOWED_ACTION_FRAMES_BITMAP0_STA, true);
 
    return status;
 }
@@ -2647,31 +2707,6 @@ eHalStatus sme_SetEseBeaconRequest(tHalHandle hHal, const tANI_U8 sessionId,
 }
 
 #endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
-
-/**
- * sme_process_fw_mem_dump_rsp - process fw memory dump response from WMA
- *
- * @pMac - pointer to MAC handle.
- * @pMsg - pointer to received SME msg.
- *
- * This function process the received SME message and calls the corresponding
- * callback which was already registered with SME.
- */
-#ifdef WLAN_FEATURE_MEMDUMP
-static void sme_process_fw_mem_dump_rsp(tpAniSirGlobal pMac, vos_msg_t* pMsg)
-{
-	if (pMsg->bodyptr) {
-		if (pMac->sme.fw_dump_callback)
-			pMac->sme.fw_dump_callback(pMac->hHdd,
-				(struct fw_dump_rsp*) pMsg->bodyptr);
-		vos_mem_free(pMsg->bodyptr);
-	}
-}
-#else
-static void sme_process_fw_mem_dump_rsp(tpAniSirGlobal pMac, vos_msg_t* pMsg)
-{
-}
-#endif
 eHalStatus sme_IbssPeerInfoResponseHandleer( tHalHandle hHal,
                                       tpSirIbssGetPeerInfoRspParams pIbssPeerInfoParams)
 {
@@ -2957,6 +2992,18 @@ eHalStatus sme_ProcessMsg(tHalHandle hHal, vos_msg_t* pMsg)
                           "(eWNI_SME_PRE_SWITCH_CHL_IND), nothing to process");
                 }
                 break;
+          case eWNI_SME_CC_CHANGE_IND:
+                if(pMsg->bodyptr)
+                {
+                   status = sme_handle_cc_change_ind(pMac,pMsg->bodyptr);
+                   vos_mem_free(pMsg->bodyptr);
+                }
+                else
+                {
+                   smsLog(pMac, LOGE, "Empty rsp message for meas "
+                          "(eWNI_SME_CC_CHANGE_IND), nothing to process");
+                }
+                break;
           case eWNI_SME_POST_SWITCH_CHL_IND:
              {
                 status = sme_HandlePostChannelSwitchInd(pMac);
@@ -3195,10 +3242,16 @@ eHalStatus sme_ProcessMsg(tHalHandle hHal, vos_msg_t* pMsg)
                    vos_mem_free(pMsg->bodyptr);
                }
                break;
-          case eWNI_SME_GET_RSSI_IND:
-               if (pMac->sme.pget_rssi_ind_cb)
-                   pMac->sme.pget_rssi_ind_cb(pMsg->bodyptr,
-                                            pMac->sme.pget_rssi_cb_context);
+          case eWNI_SME_GET_PEER_INFO_IND:
+               if (pMac->sme.pget_peer_info_ind_cb)
+                   pMac->sme.pget_peer_info_ind_cb(pMsg->bodyptr,
+                                        pMac->sme.pget_peer_info_cb_context);
+               vos_mem_free(pMsg->bodyptr);
+               break;
+          case eWNI_SME_GET_PEER_INFO_EXT_IND:
+               if (pMac->sme.pget_peer_info_ext_ind_cb)
+                   pMac->sme.pget_peer_info_ext_ind_cb(pMsg->bodyptr,
+                       pMac->sme.pget_peer_info_ext_cb_context);
                vos_mem_free(pMsg->bodyptr);
                break;
           case eWNI_SME_CSA_OFFLOAD_EVENT:
@@ -3269,7 +3322,22 @@ eHalStatus sme_ProcessMsg(tHalHandle hHal, vos_msg_t* pMsg)
 #ifdef FEATURE_WLAN_EXTSCAN
           case eWNI_SME_EXTSCAN_FULL_SCAN_RESULT_IND:
           {
-		if (pMac->sme.pExtScanIndCb) {
+                tCsrRoamInfo *roam_info;
+                tpSirWifiFullScanResultEvent result =
+                             (tpSirWifiFullScanResultEvent) pMsg->bodyptr;
+
+                roam_info = vos_mem_malloc(sizeof(*roam_info));
+                if (roam_info) {
+                    vos_mem_zero(roam_info, sizeof(*roam_info));
+		    roam_info->pBssDesc = (tSirBssDescription *)(
+		    (uint8_t *)&result->bss_description+result->ap.ieLength);
+                    csrRoamCallCallback(pMac, 0, roam_info, 0,
+                        eCSR_ROAM_UPDATE_SCAN_RESULT, eCSR_ROAM_RESULT_NONE);
+                    vos_mem_free(roam_info);
+                } else
+                  smsLog( pMac, LOGE, FL("vos_mem_malloc failed:"));
+
+                if (pMac->sme.pExtScanIndCb) {
                     pMac->sme.pExtScanIndCb(pMac->hHdd,
                                             eSIR_EXTSCAN_FULL_SCAN_RESULT_IND,
                                             pMsg->bodyptr);
@@ -3277,6 +3345,7 @@ eHalStatus sme_ProcessMsg(tHalHandle hHal, vos_msg_t* pMsg)
                     smsLog(pMac, LOGE,
                            FL("callback not registered to process eWNI_SME_EXTSCAN_FULL_SCAN_RESULT_IND"));
                 }
+
                 vos_mem_free(pMsg->bodyptr);
                 break;
           }
@@ -3364,15 +3433,32 @@ eHalStatus sme_ProcessMsg(tHalHandle hHal, vos_msg_t* pMsg)
                }
                vos_mem_free(pMsg->bodyptr);
                break;
-          case eWNI_SME_FW_DUMP_IND:
-               sme_process_fw_mem_dump_rsp(pMac, pMsg);
+          case eWNI_SME_RADIO_CHAN_STATS_IND:
+               if (pMac->sme.radio_chan_stats_callback) {
+                   pMac->sme.radio_chan_stats_callback(
+                       pMac->sme.radio_chan_stats_context, pMsg->bodyptr);
+               } else {
+                   smsLog(pMac, LOGE, FL(
+                       "Error processing message. The callback is NULL."));
+               }
+               vos_mem_free(pMsg->bodyptr);
                break;
+
           case eWNI_SME_SET_THERMAL_LEVEL_IND:
                if (pMac->sme.set_thermal_level_cb)
                {
                    pMac->sme.set_thermal_level_cb(pMac->hHdd, pMsg->bodyval);
                }
                break;
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+          case eWNI_SME_THERMAL_TEMPERATURE_IND:
+               if (pMac->sme.thermal_temp_ind_cb)
+               {
+                   pMac->sme.thermal_temp_ind_cb(pMac->hHdd, pMsg->bodyval);
+               }
+               break;
+#endif
+
           case eWNI_SME_LOST_LINK_INFO_IND:
                if (pMac->sme.lost_link_info_cb) {
                    pMac->sme.lost_link_info_cb(pMac->hHdd,
@@ -3397,6 +3483,18 @@ eHalStatus sme_ProcessMsg(tHalHandle hHal, vos_msg_t* pMsg)
           case eWNI_SME_NDP_PEER_DEPARTED_IND:
                sme_ndp_msg_processor(pMac, pMsg);
                break;
+          case eWMI_SME_LL_STATS_IND:
+	       if (pMac->sme.link_layer_stats_ext_cb)
+			pMac->sme.link_layer_stats_ext_cb(pMsg->bodyptr);
+	       vos_mem_free(pMsg->bodyptr);
+	       break;
+          case eWNI_SME_RX_AGGR_HOLE_IND:
+               if (pMac->sme.stats_ext2_cb)
+                   pMac->sme.stats_ext2_cb(pMac->hHdd,
+                       (struct stats_ext2_event *)pMsg->bodyptr);
+               vos_mem_free(pMsg->bodyptr);
+               break;
+
           default:
 
              if ( ( pMsg->type >= eWNI_SME_MSG_TYPES_BEGIN )
@@ -4389,6 +4487,28 @@ eHalStatus sme_RoamDisconnect(tHalHandle hHal, tANI_U8 sessionId, eCsrRoamDiscon
    return (status);
 }
 
+/* sme_dhcp_done_ind() - send dhcp done ind
+ * @hal: hal context
+ * @session_id: session id
+ *
+ * Return: void.
+ */
+void sme_dhcp_done_ind(tHalHandle hal, uint8_t session_id)
+{
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
+	tCsrRoamSession *session;
+
+	if (!mac_ctx)
+		return;
+
+	session = CSR_GET_SESSION(mac_ctx, session_id);
+	if (!session) {
+		smsLog(mac_ctx, LOGE, FL("session %d not found"), session_id);
+		return;
+	}
+	session->dhcp_done = true;
+}
+
 /* ---------------------------------------------------------------------------
     \fn sme_RoamStopBss
     \brief To stop BSS for Soft AP. This is an asynchronous API.
@@ -4753,7 +4873,7 @@ eHalStatus sme_RoamSetPMKIDCache( tHalHandle hHal, tANI_U8 sessionId,
 }
 
 eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId,
-                                      const tANI_U8 *pBSSId,
+                                      tPmkidCacheInfo *pmksa,
                                       tANI_BOOLEAN flush_cache )
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
@@ -4766,7 +4886,7 @@ eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId,
       if( CSR_IS_SESSION_VALID( pMac, sessionId ) )
       {
          status = csrRoamDelPMKIDfromCache( pMac, sessionId,
-                                            pBSSId, flush_cache );
+                                            pmksa, flush_cache );
       }
       else
       {
@@ -4993,8 +5113,12 @@ eHalStatus sme_GetConfigParam(tHalHandle hHal, tSmeConfigParams *pParam)
               pMac->roam.configParam.sta_roam_policy.dfs_mode;
       pParam->csrConfig.sta_roam_policy_params.skip_unsafe_channels =
               pMac->roam.configParam.sta_roam_policy.skip_unsafe_channels;
-
-
+      pParam->sub20_config_info = pMac->sub20_config_info;
+      pParam->sub20_channelwidth = pMac->sub20_channelwidth;
+      pParam->sub20_dynamic_channelwidth = pMac->sub20_dynamic_channelwidth;
+      pParam->sta_change_cc_via_beacon = pMac->sta_change_cc_via_beacon;
+      pParam->csrConfig.gStaLocalEDCAEnable =
+              pMac->roam.configParam.gStaLocalEDCAEnable;
       sme_ReleaseGlobalLock( &pMac->sme );
    }
 
@@ -5318,6 +5442,49 @@ eHalStatus sme_process_set_max_tx_power(tpAniSirGlobal pMac,
 	return eHAL_STATUS_SUCCESS;
 }
 
+/**
+ * sme_process_set_max_tx_power_per_band() - Set the Maximum Transmit Power
+ * specific to band dynamically
+ * @mac_ctx: mac context
+ * @command: cmd param containing band, and power in db
+ *
+ * Set the maximum transmit power dynamically per band
+ *
+ * Return: eHalStatus
+ */
+eHalStatus sme_process_set_max_tx_power_per_band(tpAniSirGlobal mac_ctx,
+                  tSmeCmd *command)
+{
+	vos_msg_t msg;
+	tMaxTxPowerPerBandParams *max_tx_params_per_band;
+
+	max_tx_params_per_band =
+		vos_mem_malloc(sizeof(*max_tx_params_per_band));
+	if (max_tx_params_per_band == NULL) {
+		smsLog(mac_ctx, LOGE,
+			   FL("fail to allocate memory"));
+		return eHAL_STATUS_FAILURE;
+	}
+
+	max_tx_params_per_band->bandInfo =
+		command->u.set_tx_max_pwr_per_band.band;
+	max_tx_params_per_band->power =
+			command->u.set_tx_max_pwr_per_band.power;
+
+	msg.type = WDA_SET_MAX_TX_POWER_PER_BAND_REQ;
+	msg.reserved = 0;
+	msg.bodyptr = max_tx_params_per_band;
+
+	if (VOS_STATUS_SUCCESS !=
+			vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)) {
+		smsLog(mac_ctx, LOGE,
+			   FL("Unable to post message to WDA"));
+		vos_mem_free(max_tx_params_per_band);
+		return eHAL_STATUS_FAILURE;
+	}
+	return eHAL_STATUS_SUCCESS;
+}
+
 /* ---------------------------------------------------------------------------
     \fn sme_QueryPowerState
     \brief  Returns the current power state of the device.
@@ -5855,10 +6022,10 @@ eHalStatus sme_RoamSetKey(tHalHandle hHal, tANI_U8 sessionId, tCsrRoamSetKey *pS
       smsLog(pMac, LOGE, FL("Invalid key length %d"), pSetKey->keyLength);
       return eHAL_STATUS_FAILURE;
    }
-   /*Once Setkey is done, we can go in BMPS*/
+   /*Once Setkey is done, we can go in BMPS */
    if(pSetKey->keyLength) {
-     pMac->pmc.remainInPowerActiveTillDHCP = FALSE;
-     smsLog(pMac, LOG1, FL("Reset remainInPowerActiveTillDHCP"
+     pMac->pmc.full_power_till_set_key = false;
+     smsLog(pMac, LOG1, FL("Reset full_power_till_set_key"
                            " to allow BMPS"));
    }
 
@@ -6691,6 +6858,7 @@ eHalStatus sme_DHCPStartInd( tHalHandle hHal,
             sme_ReleaseGlobalLock( &pMac->sme );
             return eHAL_STATUS_FAILURE;
         }
+        pSession->dhcp_done = false;
 
         pMsg = (tAniDHCPInd*)vos_mem_malloc(sizeof(tAniDHCPInd));
         if (NULL == pMsg)
@@ -6763,6 +6931,7 @@ eHalStatus sme_DHCPStopInd( tHalHandle hHal,
             sme_ReleaseGlobalLock( &pMac->sme );
             return eHAL_STATUS_FAILURE;
         }
+        pSession->dhcp_done = false;
 
         pMsg = (tAniDHCPInd*)vos_mem_malloc(sizeof(tAniDHCPInd));
         if (NULL == pMsg)
@@ -8476,6 +8645,86 @@ v_U16_t sme_CheckConcurrentChannelOverlap( tHalHandle hHal, v_U16_t sap_ch,
 
    return (channel);
 }
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+/**
+ * sme_find_sta_session_info() - get sta active session info
+ * @hHal: tHalHandle ptr
+ * @session_info: information returned.
+ *
+ * Return: TRUE if sta session info returned
+ */
+tANI_BOOLEAN sme_find_sta_session_info(
+	tHalHandle hHal,
+	session_info_t *session_info)
+{
+	eHalStatus status = eHAL_STATUS_FAILURE;
+	tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+	tANI_BOOLEAN ret = eANI_BOOLEAN_FALSE;
+
+	status = sme_AcquireGlobalLock( &pMac->sme );
+	if ( HAL_STATUS_SUCCESS( status ) ) {
+		ret = csr_find_sta_session_info(hHal,
+				session_info);
+		sme_ReleaseGlobalLock( &pMac->sme );
+	}
+	return ret;
+}
+/**
+ * sme_find_all_session_info() - get all active session info
+ * @hHal: tHalHandle ptr
+ * @session_info: information returned.
+ * @session_count: number of session
+ *
+ * Return: TRUE if any session info returned
+ */
+tANI_BOOLEAN sme_find_all_session_info(
+	tHalHandle hHal,
+	session_info_t *session_info,
+	v_U8_t * session_count)
+{
+	eHalStatus status = eHAL_STATUS_FAILURE;
+	tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+	tANI_BOOLEAN ret = eANI_BOOLEAN_FALSE;
+
+	status = sme_AcquireGlobalLock( &pMac->sme );
+	if ( HAL_STATUS_SUCCESS( status ) ) {
+		ret = csr_find_all_session_info(hHal,
+				session_info, session_count);
+		sme_ReleaseGlobalLock( &pMac->sme );
+	}
+	return ret;
+}
+/**
+ * sme_create_sap_session_info() - create session info based on
+ *  the input chan and phymode
+ * @hHal: tHalHandle ptr
+ * @sap_phymode: requesting phymode.
+ * @sap_ch: requesting channel number
+ * @session_info: information returned.
+ *
+ * Return: TRUE if any session info returned
+ */
+tANI_BOOLEAN sme_create_sap_session_info(
+	tHalHandle hHal,
+	eCsrPhyMode sap_phymode,
+	v_U16_t sap_ch,
+	session_info_t *session_info)
+{
+	eHalStatus status = eHAL_STATUS_FAILURE;
+	tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+	tANI_BOOLEAN ret = eANI_BOOLEAN_FALSE;
+
+	status = sme_AcquireGlobalLock( &pMac->sme );
+	if ( HAL_STATUS_SUCCESS( status ) ) {
+		ret = csr_create_sap_session_info(hHal,
+			sap_phymode,
+			sap_ch,
+			session_info);
+		sme_ReleaseGlobalLock( &pMac->sme );
+	}
+	return ret;
+}
+#endif
 #endif
 
 #ifdef FEATURE_WLAN_SCAN_PNO
@@ -9095,7 +9344,7 @@ eHalStatus sme_8023MulticastList (tHalHandle hHal, tANI_U8 sessionId, tpSirRcvFl
     tCsrRoamSession         *pSession = NULL;
 
     VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO, "%s: "
-               "ulMulticastAddrCnt=%d, multicastAddr[0]=%p", __func__,
+               "ulMulticastAddrCnt=%d, multicastAddr[0]=%pK", __func__,
                pMulticastAddrs->ulMulticastAddrCnt,
                pMulticastAddrs->multicastAddr[0]);
 
@@ -9553,50 +9802,68 @@ eHalStatus sme_WakeReasonIndCallback (tHalHandle hHal, void* pMsg)
 }
 #endif // WLAN_WAKEUP_EVENTS
 
-
-/* ---------------------------------------------------------------------------
-    \fn sme_SetMaxTxPowerPerBand
-
-    \brief Set the Maximum Transmit Power specific to band dynamically.
-    Note: this setting will not persist over reboots.
-
-    \param band
-    \param power to set in dB
-    \- return eHalStatus
-
-  ----------------------------------------------------------------------------*/
-eHalStatus sme_SetMaxTxPowerPerBand(eCsrBand band, v_S7_t dB)
+/**
+ * sme_SetMaxTxPowerPerBand() - Set the Maximum Transmit Power
+ * specific to band dynamically
+ * @band: Band for which power needs to be applied
+ * @dB: power to set in dB
+ * @hal: HAL handle
+ *
+ * Set the maximum transmit power dynamically per band
+ *
+ * Return: eHalStatus
+ */
+eHalStatus sme_SetMaxTxPowerPerBand(eCsrBand band, v_S7_t dB,
+                  tHalHandle hal)
 {
-    vos_msg_t msg;
-    tpMaxTxPowerPerBandParams pMaxTxPowerPerBandParams = NULL;
+	vos_msg_t msg;
+	eHalStatus status;
+	tSmeCmd *set_max_tx_pwr_per_band;
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
 
-    pMaxTxPowerPerBandParams = vos_mem_malloc(sizeof(tMaxTxPowerPerBandParams));
-    if (NULL == pMaxTxPowerPerBandParams)
-    {
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                  "%s:Not able to allocate memory for pMaxTxPowerPerBandParams",
-                  __func__);
-        return eHAL_STATUS_FAILURE;
-    }
+        if (mac_ctx->max_power_cmd_pending) {
+           smsLog(mac_ctx, LOG1,
+                 FL("set max tx power already in progress"));
+           return eHAL_STATUS_RESOURCES;
+        }
 
-    pMaxTxPowerPerBandParams->power = dB;
-    pMaxTxPowerPerBandParams->bandInfo = band;
+	smsLog(mac_ctx, LOG1,
+		  FL("band : %d power %d dB"),
+		  band, dB);
 
-    msg.type = WDA_SET_MAX_TX_POWER_PER_BAND_REQ;
-    msg.reserved = 0;
-    msg.bodyptr = pMaxTxPowerPerBandParams;
-    MTRACE(vos_trace(VOS_MODULE_ID_SME, TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION,
-                                                          msg.type));
-    if (VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MODULE_ID_WDA, &msg))
-    {
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                  "%s:Not able to post WDA_SET_MAX_TX_POWER_PER_BAND_REQ",
-                  __func__);
-        vos_mem_free(pMaxTxPowerPerBandParams);
-        return eHAL_STATUS_FAILURE;
-    }
+	MTRACE(vos_trace(VOS_MODULE_ID_SME,
+			TRACE_CODE_SME_TX_WDA_MSG, NO_SESSION, msg.type));
 
-    return eHAL_STATUS_SUCCESS;
+	status = sme_AcquireGlobalLock(&mac_ctx->sme);
+	if (HAL_STATUS_SUCCESS(status)) {
+		set_max_tx_pwr_per_band = csrGetCommandBuffer(mac_ctx);
+		if (set_max_tx_pwr_per_band) {
+			set_max_tx_pwr_per_band->command =
+					eSmeCommandSetMaxTxPowerPerBand;
+			set_max_tx_pwr_per_band->u.
+				set_tx_max_pwr_per_band.band = band;
+			set_max_tx_pwr_per_band->u.
+				set_tx_max_pwr_per_band.power = dB;
+                        mac_ctx->max_power_cmd_pending = true;
+			status = csrQueueSmeCommand(mac_ctx,
+						set_max_tx_pwr_per_band,
+						eANI_BOOLEAN_TRUE);
+			if (!HAL_STATUS_SUCCESS(status)) {
+				smsLog(mac_ctx, LOGE,
+					FL("fail to send msg status = %d"),
+						status);
+				csrReleaseCommand(mac_ctx,
+						set_max_tx_pwr_per_band);
+                                mac_ctx->max_power_cmd_pending = false;
+			}
+		} else {
+			smsLog(mac_ctx, LOGE,
+				FL("can not obtain a common buffer"));
+			status = eHAL_STATUS_RESOURCES;
+		}
+	sme_ReleaseGlobalLock(&mac_ctx->sme);
+	}
+	return status;
 }
 
 /**
@@ -9619,6 +9886,12 @@ eHalStatus sme_SetMaxTxPower(tHalHandle hHal, tSirMacAddr bssid,
 	eHalStatus status = eHAL_STATUS_SUCCESS;
 	tSmeCmd *set_max_tx_pwr;
 
+        if (mac_ptr->max_power_cmd_pending) {
+           smsLog(mac_ptr, LOG1,
+                 FL("set max tx power already in progress"));
+           return eHAL_STATUS_RESOURCES;
+        }
+
 	MTRACE(vos_trace(VOS_MODULE_ID_SME,
 		TRACE_CODE_SME_RX_HDD_SET_MAXTXPOW, NO_SESSION, 0));
 	smsLog(mac_ptr, LOG1,
@@ -9635,6 +9908,7 @@ eHalStatus sme_SetMaxTxPower(tHalHandle hHal, tSirMacAddr bssid,
 			vos_mem_copy(set_max_tx_pwr->u.set_tx_max_pwr.self_sta_mac_addr,
 				self_mac_addr, SIR_MAC_ADDR_LENGTH);
 			set_max_tx_pwr->u.set_tx_max_pwr.power = db;
+                        mac_ptr->max_power_cmd_pending = true;
 			status = csrQueueSmeCommand(mac_ptr, set_max_tx_pwr,
 							eANI_BOOLEAN_TRUE);
 			if (!HAL_STATUS_SUCCESS(status)) {
@@ -9642,6 +9916,7 @@ eHalStatus sme_SetMaxTxPower(tHalHandle hHal, tSirMacAddr bssid,
 					FL("fail to send msg status = %d"),
 									status);
 				csrReleaseCommandScan(mac_ptr, set_max_tx_pwr);
+                                mac_ptr->max_power_cmd_pending = false;
 			}
 		}
 		else
@@ -10411,6 +10686,17 @@ eHalStatus sme_UpdateIsFastRoamIniFeatureEnabled
         return eHAL_STATUS_SUCCESS;
     }
 
+  if (smeNeighborMiddleOfRoaming(hHal, sessionId))
+  {
+      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                "%s: In middle of roaming isFastRoamIniFeatureEnabled %d",
+                __func__, isFastRoamIniFeatureEnabled);
+      if (!isFastRoamIniFeatureEnabled)
+          pMac->roam.pending_roam_disable = TRUE;
+
+      return eHAL_STATUS_SUCCESS;
+  }
+
   VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
                      "%s: FastRoamEnabled is changed from %d to %d", __func__,
            pMac->roam.configParam.isFastRoamIniFeatureEnabled,
@@ -12322,19 +12608,19 @@ eHalStatus sme_GetLinkSpeed(tHalHandle hHal, tSirLinkSpeedInfo *lsReq, void *pls
 
 
 /**
- * sme_get_rssi() - get station's rssi
+ * sme_get_peer_info() - get station's info
  * @hal: hal interface
- * @req: get rssi request information
+ * @req: get peer info request information
  * @context: event handle context
  * @pcallbackfn: callback function pointer
  *
- * This function will send WDA_GET_RSSI to WMA
+ * This function will send WDA_GET_PEER_INFO to WMA
  *
  * Return: 0 on success, otherwise error value
  */
-eHalStatus sme_get_rssi(tHalHandle hal, struct sir_rssi_req req,
+eHalStatus sme_get_peer_info(tHalHandle hal, struct sir_peer_info_req req,
 			void *context,
-			void (*callbackfn)(struct sir_rssi_resp *param,
+			void (*callbackfn)(struct sir_peer_info_resp *param,
 						void *pcontext))
 {
 
@@ -12353,8 +12639,8 @@ eHalStatus sme_get_rssi(tHalHandle hal, struct sir_rssi_req req,
 			return eHAL_STATUS_FAILURE;
 		}
 
-		mac->sme.pget_rssi_ind_cb = callbackfn;
-		mac->sme.pget_rssi_cb_context = context;
+		mac->sme.pget_peer_info_ind_cb = callbackfn;
+		mac->sme.pget_peer_info_cb_context = context;
 
 		/* serialize the req through MC thread */
 		vosmessage.bodyptr = vos_mem_malloc(sizeof(req));
@@ -12365,7 +12651,68 @@ eHalStatus sme_get_rssi(tHalHandle hal, struct sir_rssi_req req,
 			return eHAL_STATUS_E_MALLOC_FAILED;
 		}
 		vos_mem_copy(vosmessage.bodyptr, &req, sizeof(req));
-		vosmessage.type    = WDA_GET_RSSI;
+		vosmessage.type    = WDA_GET_PEER_INFO;
+		vosstatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosmessage);
+		if (!VOS_IS_STATUS_SUCCESS(vosstatus)) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				"%s: Post get peer info msg fail", __func__);
+			vos_mem_free(vosmessage.bodyptr);
+			status = eHAL_STATUS_FAILURE;
+		}
+		sme_ReleaseGlobalLock(&mac->sme);
+	}
+	return status;
+}
+
+/**
+ * sme_get_peer_info_ext() - get info for remote peer
+ * @hal: hal interface
+ * @req: get peer info request pointer
+ * @context: event handle context
+ * @callbackfn: callback function pointer
+ *
+ * This function will send WDA_GET_PEER_INFO_EXT to WMA
+ *
+ * Return: 0 on success, otherwise error value
+ */
+eHalStatus sme_get_peer_info_ext(tHalHandle hal,
+		struct sir_peer_info_ext_req *req,
+		void *context,
+		void (*callbackfn)(struct sir_peer_info_ext_resp *param,
+			void *pcontext))
+{
+
+	eHalStatus          status    = eHAL_STATUS_SUCCESS;
+	VOS_STATUS          vosstatus = VOS_STATUS_SUCCESS;
+	tpAniSirGlobal      mac       = PMAC_STRUCT(hal);
+	vos_msg_t           vosmessage;
+
+	status = sme_AcquireGlobalLock(&mac->sme);
+	if (eHAL_STATUS_SUCCESS == status) {
+		if (NULL == callbackfn) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				"%s: Indication Call back is NULL",
+				__func__);
+			sme_ReleaseGlobalLock(&mac->sme);
+			return eHAL_STATUS_FAILURE;
+		}
+
+		mac->sme.pget_peer_info_ext_ind_cb = callbackfn;
+		mac->sme.pget_peer_info_ext_cb_context = context;
+
+		/* serialize the req through MC thread */
+		vosmessage.bodyptr =
+			vos_mem_malloc(sizeof(struct sir_peer_info_ext_req));
+		if (NULL == vosmessage.bodyptr) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				"%s: Memory allocation failed.", __func__);
+			sme_ReleaseGlobalLock(&mac->sme);
+			return eHAL_STATUS_E_MALLOC_FAILED;
+		}
+		vos_mem_copy(vosmessage.bodyptr,
+				req,
+				sizeof(struct sir_peer_info_ext_req));
+		vosmessage.type    = WDA_GET_PEER_INFO_EXT;
 		vosstatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosmessage);
 		if (!VOS_IS_STATUS_SUCCESS(vosstatus)) {
 			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
@@ -12378,6 +12725,45 @@ eHalStatus sme_get_rssi(tHalHandle hal, struct sir_rssi_req req,
 	return status;
 }
 
+eHalStatus sme_get_isolation(tHalHandle hal,
+           void *context,
+           void (*callbackfn)(struct sir_isolation_resp *param,
+                       void *pcontext))
+{
+    eHalStatus          status    = eHAL_STATUS_SUCCESS;
+    VOS_STATUS          vosstatus = VOS_STATUS_SUCCESS;
+    tpAniSirGlobal      mac       = PMAC_STRUCT(hal);
+    vos_msg_t           vosmessage;
+
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+            "%s: get isolation", __func__);
+
+    status = sme_AcquireGlobalLock(&mac->sme);
+    if (eHAL_STATUS_SUCCESS == status) {
+        if (NULL == callbackfn) {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                    "%s: Indication Call back is NULL",
+                    __func__);
+            sme_ReleaseGlobalLock(&mac->sme);
+            return eHAL_STATUS_FAILURE;
+        }
+
+        mac->sme.get_isolation = callbackfn;
+        mac->sme.get_isolation_cb_context = context;
+
+        vosmessage.bodyptr = NULL;
+        vosmessage.type    = WDA_GET_ISOLATION;
+        vosstatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vosmessage);
+        if (!VOS_IS_STATUS_SUCCESS(vosstatus)) {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                    "%s: Post get isolation msg fail", __func__);
+            status = eHAL_STATUS_FAILURE;
+        }
+        sme_ReleaseGlobalLock(&mac->sme);
+    }
+    return status;
+}
+
 /* ---------------------------------------------------------------------------
     \fn sme_IsPmcBmps
     \API to Check if PMC state is BMPS.
@@ -12992,30 +13378,6 @@ eHalStatus sme_LPHBConfigReq
     return(status);
 }
 #endif /* FEATURE_WLAN_LPHB */
-/*--------------------------------------------------------------------------
-  \brief sme_enable_disable_split_scan() - a wrapper function to set the split
-                                          scan parameter.
-  This is a synchronous call
-  \param hHal - The handle returned by macOpen
-  \return NONE.
-  \sa
-  --------------------------------------------------------------------------*/
-void sme_enable_disable_split_scan (tHalHandle hHal, tANI_U8 nNumStaChan,
-                                          tANI_U8 nNumP2PChan)
-{
-    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-
-    pMac->roam.configParam.nNumStaChanCombinedConc = nNumStaChan;
-    pMac->roam.configParam.nNumP2PChanCombinedConc = nNumP2PChan;
-
-    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                 "%s: SCAN nNumStaChanCombinedConc : %d,"
-                           "nNumP2PChanCombinedConc : %d ",
-                 __func__, nNumStaChan, nNumP2PChan);
-
-    return;
-
-}
 
 /**
  * sme_AddPeriodicTxPtrn() - Add Periodic TX Pattern
@@ -13345,7 +13707,7 @@ void smeGetCommandQStatus( tHalHandle hHal )
 
     return;
 }
-
+#ifdef WLAN_FEATURE_DSRC
 /* -------------------------------------------------------------------------
    \fn sme_set_dot11p_config
    \brief API to Set 802.11p config
@@ -13360,60 +13722,6 @@ void sme_set_dot11p_config(tHalHandle hal, bool enable_dot11p)
 }
 
 /**
- * copy_sir_ocb_config() - Performs deep copy of an OCB configuration
- * @src: the source configuration
- *
- * Return: pointer to the copied OCB configuration
- */
-static struct sir_ocb_config *sme_copy_sir_ocb_config(struct sir_ocb_config *src)
-{
-	struct sir_ocb_config *dst;
-	uint32_t length;
-	void *cursor;
-
-	length = sizeof(*src) +
-		src->channel_count * sizeof(*src->channels) +
-		src->schedule_size * sizeof(*src->schedule) +
-		src->dcc_ndl_chan_list_len +
-		src->dcc_ndl_active_state_list_len +
-		src->def_tx_param_size;
-
-	dst = vos_mem_malloc(length);
-	if (!dst)
-		return NULL;
-
-	*dst = *src;
-
-	cursor = dst;
-	cursor += sizeof(*dst);
-	dst->channels = cursor;
-	cursor += src->channel_count * sizeof(*src->channels);
-	vos_mem_copy(dst->channels, src->channels,
-		     src->channel_count * sizeof(*src->channels));
-	dst->schedule = cursor;
-	cursor += src->schedule_size * sizeof(*src->schedule);
-	vos_mem_copy(dst->schedule, src->schedule,
-		     src->schedule_size * sizeof(*src->schedule));
-	dst->dcc_ndl_chan_list = cursor;
-	cursor += src->dcc_ndl_chan_list_len;
-	vos_mem_copy(dst->dcc_ndl_chan_list, src->dcc_ndl_chan_list,
-		     src->dcc_ndl_chan_list_len);
-	dst->dcc_ndl_active_state_list = cursor;
-	cursor += src->dcc_ndl_active_state_list_len;
-	vos_mem_copy(dst->dcc_ndl_active_state_list,
-		     src->dcc_ndl_active_state_list,
-		     src->dcc_ndl_active_state_list_len);
-	cursor += src->dcc_ndl_active_state_list_len;
-	if (src->def_tx_param && src->def_tx_param_size) {
-		dst->def_tx_param = cursor;
-		vos_mem_copy(dst->def_tx_param, src->def_tx_param,
-			     src->def_tx_param_size);
-	}
-
-	return dst;
-}
-
-/**
  * sme_ocb_set_config() - Set the OCB configuration
  * @hHal: reference to the HAL
  * @context: the context of the call
@@ -13443,7 +13751,7 @@ eHalStatus sme_ocb_set_config(tHalHandle hHal, void *context,
 		goto end;
 	}
 
-	msg_body = sme_copy_sir_ocb_config(config);
+	msg_body = sir_copy_sir_ocb_config(config);
 
 	if (!msg_body) {
 		status = eHAL_STATUS_FAILED_ALLOC;
@@ -13861,6 +14169,102 @@ eHalStatus sme_register_for_dcc_stats_event(tHalHandle hHal, void *context,
 	return 0;
 }
 
+/**
+ * sme_register_radio_chan_stats_cb() - Register callback for DSRC radio
+ *	channel statistics event indication.
+ * @hal: reference to the HAL
+ * @context: the context of the call
+ * @callback: the callback to hdd
+ *
+ * Return: eHAL_STATUS_SUCCESS on success, eHAL_STATUS_FAILURE on failure
+ */
+eHalStatus sme_register_radio_chan_stats_cb(tHalHandle hal, void *context,
+					    ocb_callback callback)
+{
+	eHalStatus status = eHAL_STATUS_FAILURE;
+	tpAniSirGlobal mac = PMAC_STRUCT(hal);
+
+	status = sme_AcquireGlobalLock(&mac->sme);
+	if (eHAL_STATUS_SUCCESS == status) {
+		mac->sme.radio_chan_stats_callback = callback;
+		mac->sme.radio_chan_stats_context = context;
+		sme_ReleaseGlobalLock(&mac->sme);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("sme_AcquireGlobalLock error"));
+	}
+
+	return status;
+}
+
+/**
+ * sme_unregister_radio_chan_stats_cb() - Unregister DSRC radio channel
+ *	statistics callback.
+ * @hal: reference to the HAL
+ *
+ * Return: eHAL_STATUS_SUCCESS on success, eHAL_STATUS_FAILURE on failure
+ */
+eHalStatus sme_unregister_radio_chan_stats_cb(tHalHandle hal)
+{
+	eHalStatus status = eHAL_STATUS_FAILURE;
+	tpAniSirGlobal mac = PMAC_STRUCT(hal);
+
+	status = sme_AcquireGlobalLock(&mac->sme);
+	if (eHAL_STATUS_SUCCESS == status) {
+		mac->sme.radio_chan_stats_callback = NULL;
+		mac->sme.radio_chan_stats_context = NULL;
+		sme_ReleaseGlobalLock(&mac->sme);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("sme_AcquireGlobalLock error"));
+	}
+
+	return status;
+}
+
+/**
+ * sme_request_radio_chan_stats() - Set request for DSRC
+ *	radio channel statistics.
+ * @hal: reference to the HAL
+ * @req: request parameters for radio channel stats.
+ *
+ * Return: eHAL_STATUS_SUCCESS on success, eHAL_STATUS_FAILURE on failure
+ */
+eHalStatus sme_request_radio_chan_stats(tHalHandle hal,
+					struct radio_chan_stats_req *req)
+{
+	eHalStatus status = eHAL_STATUS_FAILURE;
+	VOS_STATUS vos_status = VOS_STATUS_E_FAILURE;
+	tpAniSirGlobal mac = PMAC_STRUCT(hal);
+	struct radio_chan_stats_req *msg_body;
+	vos_msg_t msg = { 0 };
+
+	status = sme_AcquireGlobalLock(&mac->sme);
+	if (!HAL_STATUS_SUCCESS(status))
+		return status;
+
+	msg_body = vos_mem_malloc(sizeof(*msg_body));
+	if (!msg_body)
+		return eHAL_STATUS_FAILED_ALLOC;
+
+	vos_mem_copy(msg_body, req, sizeof(*msg_body));
+
+	msg.type = WDA_DSRC_RADIO_CHAN_STATS_REQ;
+	msg.bodyptr = msg_body;
+
+	vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA, &msg);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("Error posting message to WDA: %d"), vos_status);
+		vos_mem_free(msg_body);
+		return eHAL_STATUS_FAILURE;
+	}
+
+	sme_ReleaseGlobalLock(&mac->sme);
+
+	return eHAL_STATUS_SUCCESS;
+}
+#endif
 void sme_getRecoveryStats(tHalHandle hHal) {
     tANI_U8 i;
 
@@ -13948,7 +14352,7 @@ void activeListCmdTimeoutHandle(void *userData)
         vos_flush_logs(WLAN_LOG_TYPE_FATAL,
                        WLAN_LOG_INDICATOR_HOST_DRIVER,
                        WLAN_LOG_REASON_SME_COMMAND_STUCK,
-                       false);
+                       DUMP_NO_TRACE);
     } else {
         vosTraceDumpAll(mac_ctx, 0, 0, 500, 0);
     }
@@ -13963,7 +14367,7 @@ void activeListCmdTimeoutHandle(void *userData)
 
     if (mac_ctx->sme.enableSelfRecovery) {
         sme_SaveActiveCmdStats(hal);
-        vos_trigger_recovery();
+        vos_trigger_recovery(false);
     } else {
         if (!mac_ctx->roam.configParam.enable_fatal_event &&
             !(vos_is_load_unload_in_progress(VOS_MODULE_ID_SME, NULL) ||
@@ -14176,6 +14580,28 @@ eHalStatus sme_set_cts2self_for_p2p_go(tHalHandle hal_handle)
 	return status;
 }
 
+/**
+ * sme_set_ac_txq_optimize() - sme function to set ini parms to FW.
+ * @hal_handle:                    reference to the HAL
+ * @value                          reference to the value
+ * Return: hal_status
+ */
+eHalStatus sme_set_ac_txq_optimize(tHalHandle hal_handle, uint8_t *value)
+{
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	vos_msg_t vos_msg;
+
+	vos_msg.bodyptr = value;
+	vos_msg.type = WDA_SET_AC_TXQ_OPTIMIZE;
+	if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA,
+						       &vos_msg))) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("Failed to post WDA_SET_AC_TXQ_OPTIMIZE to WDA"));
+		status = eHAL_STATUS_FAILURE;
+	}
+	return status;
+}
+
 eHalStatus sme_ConfigEnablePowerSave (tHalHandle hHal, tPmcPowerSavingMode psMode)
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
@@ -14218,7 +14644,10 @@ eHalStatus sme_PsOffloadEnablePowerSave (tHalHandle hHal, tANI_U32 sessionId)
    return (status);
 }
 
-eHalStatus sme_PsOffloadDisablePowerSave (tHalHandle hHal, tANI_U32 sessionId)
+eHalStatus sme_PsOffloadDisablePowerSave(tHalHandle hHal,
+                                         FullPowerReqCb callback_routine,
+                                         void *callback_context,
+                                         tANI_U32 sessionId)
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
@@ -14226,7 +14655,8 @@ eHalStatus sme_PsOffloadDisablePowerSave (tHalHandle hHal, tANI_U32 sessionId)
    status = sme_AcquireGlobalLock(&pMac->sme);
    if(HAL_STATUS_SUCCESS( status ))
    {
-       status =  PmcOffloadDisableStaModePowerSave(hHal, sessionId);
+       status =  PmcOffloadDisableStaModePowerSave(hHal,
+                         callback_routine, callback_context, sessionId);
        sme_ReleaseGlobalLock( &pMac->sme );
    }
    return (status);
@@ -14868,22 +15298,14 @@ eHalStatus sme_InitThermalInfo( tHalHandle hHal,
 
     pWdaParam->thermalMgmtEnabled = thermalParam.smeThermalMgmtEnabled;
     pWdaParam->throttlePeriod = thermalParam.smeThrottlePeriod;
-    pWdaParam->throttle_duty_cycle_2g_tbl[0]=
-        thermalParam.sme_throttle_duty_cycle_2g_tbl[0];
-    pWdaParam->throttle_duty_cycle_2g_tbl[1]=
-        thermalParam.sme_throttle_duty_cycle_2g_tbl[1];
-    pWdaParam->throttle_duty_cycle_2g_tbl[2]=
-        thermalParam.sme_throttle_duty_cycle_2g_tbl[2];
-    pWdaParam->throttle_duty_cycle_2g_tbl[3]=
-        thermalParam.sme_throttle_duty_cycle_2g_tbl[3];
-    pWdaParam->throttle_duty_cycle_5g_tbl[0]=
-        thermalParam.sme_throttle_duty_cycle_5g_tbl[0];
-    pWdaParam->throttle_duty_cycle_5g_tbl[1]=
-        thermalParam.sme_throttle_duty_cycle_5g_tbl[1];
-    pWdaParam->throttle_duty_cycle_5g_tbl[2]=
-        thermalParam.sme_throttle_duty_cycle_5g_tbl[2];
-    pWdaParam->throttle_duty_cycle_5g_tbl[3]=
-        thermalParam.sme_throttle_duty_cycle_5g_tbl[3];
+    pWdaParam->throttle_duty_cycle_tbl[0]=
+        thermalParam.sme_throttle_duty_cycle_tbl[0];
+    pWdaParam->throttle_duty_cycle_tbl[1]=
+        thermalParam.sme_throttle_duty_cycle_tbl[1];
+    pWdaParam->throttle_duty_cycle_tbl[2]=
+        thermalParam.sme_throttle_duty_cycle_tbl[2];
+    pWdaParam->throttle_duty_cycle_tbl[3]=
+        thermalParam.sme_throttle_duty_cycle_tbl[3];
     pWdaParam->thermalLevels[0].minTempThreshold =
         thermalParam.smeThermalLevels[0].smeMinTempThreshold;
     pWdaParam->thermalLevels[0].maxTempThreshold =
@@ -14901,6 +15323,18 @@ eHalStatus sme_InitThermalInfo( tHalHandle hHal,
     pWdaParam->thermalLevels[3].maxTempThreshold =
          thermalParam.smeThermalLevels[3].smeMaxTempThreshold;
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+    pWdaParam->thermal_shutdown_enabled = thermalParam.thermal_shutdown_enabled;
+    pWdaParam->thermal_shutdown_auto_enabled =
+        thermalParam.thermal_shutdown_auto_enabled;
+    pWdaParam->thermal_resume_threshold =thermalParam.thermal_resume_threshold;
+    pWdaParam->thermal_warning_threshold =
+        thermalParam.thermal_warning_threshold;
+    pWdaParam->thermal_suspend_threshold =
+        thermalParam.thermal_suspend_threshold;
+    pWdaParam->thermal_sample_rate = thermalParam.thermal_sample_rate;
+#endif
+
     if (eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock(&pMac->sme))
     {
         msg.type     = WDA_INIT_THERMAL_INFO_CMD;
@@ -14966,6 +15400,29 @@ eHalStatus sme_SetThermalLevel( tHalHandle hHal, tANI_U8 level )
 	return eHAL_STATUS_FAILURE;
 }
 
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+/**
+ * sme_add_thermal_temperature_ind_callback() - Set callback fn for thermal
+ * temperature indication
+ * hHal: Handler to HAL
+ * callback: The callback function
+ *
+ * Return: void
+ */
+void sme_add_thermal_temperature_ind_callback(tHalHandle hHal,
+				   tSmeThermalTempIndCb callback)
+{
+	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+
+	pMac->sme.thermal_temp_ind_cb = callback;
+}
+#else
+inline void sme_add_thermal_temperature_ind_callback(tHalHandle hHal,
+				   tSmeThermalTempIndCb callback)
+{
+	return;
+}
+#endif
 
 /* ---------------------------------------------------------------------------
    \fn sme_TxpowerLimit
@@ -15430,7 +15887,6 @@ VOS_STATUS sme_UpdateDSCPtoUPMapping( tHalHandle hHal,
                    if ((pSession->QosMapSet.dscp_range[i][0] == 255) &&
                                 (pSession->QosMapSet.dscp_range[i][1] == 255))
                    {
-                       dscpmapping[j]= 0;
                        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
                        "%s: User Priority %d is not used in mapping",
                                                              __func__, i);
@@ -15769,52 +16225,6 @@ eHalStatus sme_ResetBssHotlist (tHalHandle hHal,
     return status;
 }
 
-/**
- * sme_set_ssid_hotlist() - Set the SSID hotlist
- * @hal: SME handle
- * @request: set ssid hotlist request
- *
- * Return: eHalStatus
- */
-eHalStatus
-sme_set_ssid_hotlist(tHalHandle hal,
-		     struct sir_set_ssid_hotlist_request *request)
-{
-	eHalStatus status;
-	VOS_STATUS vstatus;
-	tpAniSirGlobal mac = PMAC_STRUCT(hal);
-	vos_msg_t vos_message;
-	struct sir_set_ssid_hotlist_request *set_req;
-
-	set_req = vos_mem_malloc(sizeof(*set_req));
-	if (!set_req) {
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-			  "%s: Not able to allocate memory for WDA_EXTSCAN_SET_SSID_HOTLIST_REQ",
-			  __func__);
-		return eHAL_STATUS_FAILURE;
-	}
-
-	*set_req = *request;
-	status = sme_AcquireGlobalLock(&mac->sme);
-	if (eHAL_STATUS_SUCCESS == status) {
-		/* Serialize the req through MC thread */
-		vos_message.bodyptr = set_req;
-		vos_message.type    = WDA_EXTSCAN_SET_SSID_HOTLIST_REQ;
-		vstatus = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_message);
-		sme_ReleaseGlobalLock(&mac->sme);
-		if (!VOS_IS_STATUS_SUCCESS(vstatus)) {
-			vos_mem_free(set_req);
-			status = eHAL_STATUS_FAILURE;
-		}
-	} else {
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-			  "%s: sme_AcquireGlobalLock error", __func__);
-		vos_mem_free(set_req);
-		status = eHAL_STATUS_FAILURE;
-	}
-	return status;
-}
-
 /* ---------------------------------------------------------------------------
     \fn sme_SetSignificantChange
     \brief  SME API to set significant change
@@ -15906,6 +16316,48 @@ eHalStatus sme_getCachedResults (tHalHandle hHal,
 }
 
 /**
+ * sme_get_chain_rssi - sme api to get chain rssi
+ * @hHal: global hal handle
+ * @input: get chain rssi req params
+ *
+ * Return: eHalStatus enumeration.
+ */
+eHalStatus sme_get_chain_rssi(tHalHandle phal,
+	struct get_chain_rssi_req_params *input)
+{
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+	tpAniSirGlobal pmac = PMAC_STRUCT(phal);
+	vos_msg_t vos_message;
+	struct get_chain_rssi_req_params *req_msg;
+
+	req_msg = vos_mem_malloc(sizeof(*req_msg));
+	if (!req_msg) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+		"%s: Not able to allocate memory", __func__);
+		return eHAL_STATUS_FAILED_ALLOC;
+	}
+
+	*req_msg = *input;
+
+	status = sme_AcquireGlobalLock(&pmac->sme);
+	if (eHAL_STATUS_SUCCESS == status) {
+		/* serialize the req through MC thread */
+		vos_message.bodyptr = req_msg;
+		vos_message.type    = SIR_HAL_GET_CHAIN_RSSI_REQ;
+		vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_message);
+		if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				FL("Post Get Chain Rssi msg fail"));
+			status = eHAL_STATUS_FAILURE;
+		}
+		sme_ReleaseGlobalLock(&pmac->sme);
+	}
+
+	return status;
+}
+
+/**
  * sme_set_epno_list() - set epno network list
  * @hHal: global hal handle
  * @input: request message
@@ -16125,6 +16577,27 @@ eHalStatus sme_ExtScanRegisterCallback (tHalHandle hHal,
 #endif /* FEATURE_WLAN_EXTSCAN */
 
 /**
+ * sme_chain_rssi_register_callback - chain rssi callback
+ * @hal: global hal handle
+ * @pchain_rssi_ind_cb: callback function pointer
+ *
+ * Return: eHalStatus enumeration.
+ */
+eHalStatus sme_chain_rssi_register_callback(tHalHandle phal,
+			void (*pchain_rssi_ind_cb)(void *, void *))
+{
+	eHalStatus status    = eHAL_STATUS_SUCCESS;
+	tpAniSirGlobal pmac  = PMAC_STRUCT(phal);
+
+	status = sme_AcquireGlobalLock(&pmac->sme);
+	if (eHAL_STATUS_SUCCESS == status) {
+		pmac->sme.pchain_rssi_ind_cb = pchain_rssi_ind_cb;
+		sme_ReleaseGlobalLock(&pmac->sme);
+	}
+	return status;
+}
+
+/**
  * sme_set_rssi_threshold_breached_cb() - set rssi threshold breached callback
  * @hal: global hal handle
  * @cb: callback function pointer
@@ -16151,6 +16624,35 @@ eHalStatus sme_set_rssi_threshold_breached_cb(tHalHandle hal,
 	sme_ReleaseGlobalLock(&mac->sme);
 	return status;
 }
+/**
+ * sme_set_chip_pwr_save_fail_cb() - set chip power save failure callback
+ * @hal: global hal handle
+ * @cb: callback function pointer
+ *
+ * This function stores the chip power save failure callback function.
+ *
+ * Return: eHalStatus enumeration.
+ */
+eHalStatus sme_set_chip_pwr_save_fail_cb(tHalHandle hal,
+				void (*cb)(
+				void *,
+				 struct chip_pwr_save_fail_detected_params *))
+{
+	eHalStatus status  = eHAL_STATUS_SUCCESS;
+	tpAniSirGlobal mac = PMAC_STRUCT(hal);
+
+	status = sme_AcquireGlobalLock(&mac->sme);
+	if (status != eHAL_STATUS_SUCCESS) {
+		smsLog(mac, LOGE,
+			FL("sme_AcquireGlobalLock failed!(status=%d)"),
+			status);
+		return status;
+	}
+
+	mac->sme.chip_power_save_fail_cb = cb;
+	sme_ReleaseGlobalLock(&mac->sme);
+	return status;
+}
 
 /**
  * sme_set_rssi_monitoring() - set rssi monitoring
@@ -16351,13 +16853,6 @@ eHalStatus sme_LLStatsGetReq (tHalHandle hHal,
     vos_msg_t vosMessage;
     tSirLLStatsGetReq *get_stats_req;
 
-    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                  "reqId = %u", pgetStatsReq->reqId);
-    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-              "staId = %u", pgetStatsReq->staId);
-    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-              "Stats Type = %u", pgetStatsReq->paramIdMask);
-
     get_stats_req = vos_mem_malloc(sizeof(*get_stats_req));
 
     if (!get_stats_req)
@@ -16401,6 +16896,96 @@ eHalStatus sme_LLStatsGetReq (tHalHandle hHal,
     return status;
 }
 
+#ifdef WLAN_POWER_DEBUGFS
+/**
+ * sme_power_debug_stats_req() - SME API to collect Power debug stats
+ * @callback_fn: Pointer to the callback function for Power stats event
+ * @power_stats_context: Pointer to context
+ *
+ * Return: eHalStatus
+ */
+eHalStatus sme_power_debug_stats_req(tHalHandle hal, void (*callback_fn)
+			(struct power_stats_response *response,
+			void *context), void *power_stats_context)
+{
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+	tpAniSirGlobal mac = PMAC_STRUCT(hal);
+	vos_msg_t vos_message;
+
+	if (eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock(&mac->sme)) {
+		if (NULL == callback_fn) {
+			smsLog(mac, LOGE,
+				FL("Indication callback did not registered"));
+			sme_ReleaseGlobalLock(&mac->sme);
+			return eHAL_STATUS_FAILURE;
+		}
+
+		mac->sme.power_debug_stats_context = power_stats_context;
+		mac->sme.power_stats_resp_callback = callback_fn;
+		vos_message.bodyptr = NULL;
+		vos_message.type    = SIR_HAL_POWER_DEBUG_STATS_REQ;
+		vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_message);
+		if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+			smsLog(mac, LOGE,
+				FL("not able to post WDA_POWER_DEBUG_STATS_REQ"));
+			status = eHAL_STATUS_FAILURE;
+		}
+		sme_ReleaseGlobalLock(&mac->sme);
+	} else {
+		smsLog(mac, LOGE, FL("sme_AcquireGlobalLock error"));
+		status = eHAL_STATUS_FAILURE;
+	}
+	return status;
+}
+#endif
+
+/**
+ * eHalStatus sme_ll_stats_set_thresh - set threshold for mac counters
+ * @hal, hal layer handle
+ * @threshold, threshold for mac counters
+ */
+eHalStatus sme_ll_stats_set_thresh(tHalHandle hal,
+				   struct sir_ll_ext_stats_threshold *threshold)
+{
+	eHalStatus status    = eHAL_STATUS_SUCCESS;
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+	tpAniSirGlobal mac  = PMAC_STRUCT(hal);
+	vos_msg_t message;
+	struct sir_ll_ext_stats_threshold *thresh;
+
+	thresh = vos_mem_malloc(sizeof(*thresh));
+	if (!thresh) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  "%s: Fail to alloc mem", __func__);
+		return eHAL_STATUS_FAILURE;
+	}
+	*thresh = *threshold;
+
+	if (eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock(&mac->sme)) {
+		/* Serialize the req through MC thread */
+		message.bodyptr = thresh;
+		message.type    = WDA_LINK_LAYER_STATS_SET_THRESHOLD;
+		MTRACE(vos_trace(VOS_MODULE_ID_SME, TRACE_CODE_SME_TX_WDA_MSG,
+				 NO_SESSION, message.type));
+		vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &message);
+		if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				  "%s: not able to post WDA_LL_STATS_GET_REQ",
+				  __func__);
+			vos_mem_free(thresh);
+			status = eHAL_STATUS_FAILURE;
+		}
+		sme_ReleaseGlobalLock(&mac->sme);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("sme_AcquireGlobalLock error"));
+		vos_mem_free(thresh);
+		status = eHAL_STATUS_FAILURE;
+	}
+	return status;
+}
+
 /* ---------------------------------------------------------------------------
     \fn sme_SetLinkLayerStatsIndCB
     \brief  SME API to trigger the stats are available  after get request
@@ -16432,78 +17017,33 @@ eHalStatus sme_SetLinkLayerStatsIndCB
     return(status);
 }
 
-#endif /* WLAN_FEATURE_LINK_LAYER_STATS */
-
 /**
- * sme_fw_mem_dump_register_cb() - Register fw memory dump callback
- *
- * @hHal - MAC global handle
- * @callback_routine - callback routine from HDD
- *
- * This API is invoked by HDD to register its callback in SME
+ * sme_set_link_layer_ext_cb() - Register callback for link layer statistics
+ * @hal: Mac global handle
+ * @ll_stats_ext_cb: HDD callback which needs to be invoked after getting
+ *                    status notification from FW
  *
  * Return: eHalStatus
  */
-#ifdef WLAN_FEATURE_MEMDUMP
-eHalStatus sme_fw_mem_dump_register_cb(tHalHandle hal,
-		void (*callback_routine)(void *cb_context,
-					 struct fw_dump_rsp *rsp))
+eHalStatus sme_set_ll_ext_cb(tHalHandle hal,
+			     void (*ll_stats_ext_cb)(tSirLLStatsResults *rsp))
 {
 	eHalStatus status = eHAL_STATUS_SUCCESS;
-	tpAniSirGlobal pmac = PMAC_STRUCT(hal);
+	tpAniSirGlobal mac = PMAC_STRUCT(hal);
 
-	status = sme_AcquireGlobalLock(&pmac->sme);
-	if (eHAL_STATUS_SUCCESS == status) {
-		pmac->sme.fw_dump_callback = callback_routine;
-		sme_ReleaseGlobalLock(&pmac->sme);
+	status = sme_AcquireGlobalLock(&mac->sme);
+	if (status == eHAL_STATUS_SUCCESS) {
+		mac->sme.link_layer_stats_ext_cb = ll_stats_ext_cb;
+		sme_ReleaseGlobalLock(&mac->sme);
 	} else {
 		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
 			  FL("sme_AcquireGlobalLock error"));
 	}
-
 	return status;
 }
-#else
-eHalStatus sme_fw_mem_dump_register_cb(tHalHandle hal,
-		void (*callback_routine)(void *cb_context,
-					 struct fw_dump_rsp *rsp))
-{
-	return eHAL_STATUS_SUCCESS;
-}
-#endif /* WLAN_FEATURE_MEMDUMP */
 
-/**
- * sme_fw_mem_dump_unregister_cb() - Unregister fw memory dump callback
- *
- * @hHal - MAC global handle
- *
- * This API is invoked by HDD to unregister its callback in SME
- *
- * Return: eHalStatus
- */
-#ifdef WLAN_FEATURE_MEMDUMP
-eHalStatus sme_fw_mem_dump_unregister_cb(tHalHandle hal)
-{
-	eHalStatus status;
-	tpAniSirGlobal pmac = PMAC_STRUCT(hal);
-
-	status = sme_AcquireGlobalLock(&pmac->sme);
-	if (eHAL_STATUS_SUCCESS == status) {
-		pmac->sme.fw_dump_callback = NULL;
-		sme_ReleaseGlobalLock(&pmac->sme);
-	} else {
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-			  FL("sme_AcquireGlobalLock error"));
-	}
+#endif /* WLAN_FEATURE_LINK_LAYER_STATS */
 
-	return status;
-}
-#else
-eHalStatus sme_fw_mem_dump_unregister_cb(tHalHandle hal)
-{
-	return eHAL_STATUS_SUCCESS;
-}
-#endif /* WLAN_FEATURE_MEMDUMP */
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 /*--------------------------------------------------------------------------
@@ -17099,80 +17639,6 @@ VOS_STATUS sme_apfind_set_cmd(struct sme_ap_find_request_req *input)
      return VOS_STATUS_SUCCESS;
 }
 #endif /* WLAN_FEATURE_APFIND */
-/**
- * sme_fw_mem_dump() - Get FW memory dump
- *
- * This API is invoked by HDD to indicate FW to start
- * dumping firmware memory.
- *
- * Return: eHalStatus
- */
-#ifdef WLAN_FEATURE_MEMDUMP
-eHalStatus sme_fw_mem_dump(tHalHandle hHal, void *recvd_req)
-{
-	eHalStatus status = eHAL_STATUS_SUCCESS;
-	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
-	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-	vos_msg_t msg;
-	struct fw_dump_req* send_req;
-	struct fw_dump_seg_req seg_req;
-	int loop;
-
-	send_req = vos_mem_malloc(sizeof(*send_req));
-	if(!send_req) {
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-			FL("Memory allocation failed for WDA_FW_MEM_DUMP"));
-		return eHAL_STATUS_FAILURE;
-	}
-	vos_mem_copy(send_req, recvd_req, sizeof(*send_req));
-
-	VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-		  FL("request_id:%d num_seg:%d"),
-		  send_req->request_id, send_req->num_seg);
-        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-		  FL("Segment Information"));
-	for (loop = 0; loop < send_req->num_seg; loop++) {
-		seg_req = send_req->segment[loop];
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-			  FL("seg_number:%d"), loop);
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-			  FL("seg_id:%d start_addr_lo:0x%x start_addr_hi:0x%x"),
-			  seg_req.seg_id, seg_req.seg_start_addr_lo,
-			  seg_req.seg_start_addr_hi);
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-			  FL("seg_length:%d dst_addr_lo:0x%x dst_addr_hi:0x%x"),
-			  seg_req.seg_length, seg_req.dst_addr_lo,
-			  seg_req.dst_addr_hi);
-	}
-
-	if (eHAL_STATUS_SUCCESS == sme_AcquireGlobalLock(&pMac->sme)) {
-		msg.bodyptr = send_req;
-		msg.type = WDA_FW_MEM_DUMP_REQ;
-		msg.reserved = 0;
-
-		vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA, &msg);
-		if (VOS_STATUS_SUCCESS != vos_status) {
-			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-				  FL("Not able to post WDA_FW_MEM_DUMP"));
-			vos_mem_free(send_req);
-			status = eHAL_STATUS_FAILURE;
-		}
-		sme_ReleaseGlobalLock(&pMac->sme);
-	} else {
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-			FL("Failed to acquire SME Global Lock"));
-		vos_mem_free(send_req);
-		status = eHAL_STATUS_FAILURE;
-	}
-
-	return status;
-}
-#else
-eHalStatus sme_fw_mem_dump(tHalHandle hHal, void *recvd_req)
-{
-	return eHAL_STATUS_SUCCESS;
-}
-#endif /* WLAN_FEATURE_MEMDUMP */
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
 /*
  * sme_validate_sap_channel_switch() - validate target channel switch w.r.t
@@ -17683,18 +18149,10 @@ uint8_t sme_is_any_session_in_connected_state(tHalHandle h_hal)
  */
 eHalStatus vos_send_flush_logs_cmd_to_fw(tpAniSirGlobal mac)
 {
-	eHalStatus status;
+	eHalStatus status = eHAL_STATUS_SUCCESS;
 	VOS_STATUS vos_status;
 	vos_msg_t vos_message;
 
-	status = sme_AcquireGlobalLock(&mac->sme);
-	if (status != eHAL_STATUS_SUCCESS) {
-		smsLog(mac, LOGE,
-			FL("sme_AcquireGlobalLock failed!(status=%d)"),
-			status);
-		return status;
-	}
-
 	/* Serialize the req through MC thread */
 	vos_message.bodyptr = NULL;
 	vos_message.type    = SIR_HAL_FLUSH_LOG_TO_FW;
@@ -17705,7 +18163,6 @@ eHalStatus vos_send_flush_logs_cmd_to_fw(tpAniSirGlobal mac)
 			vos_status);
 		status = eHAL_STATUS_FAILURE;
 	}
-	sme_ReleaseGlobalLock(&mac->sme);
 	return status;
 }
 
@@ -17739,6 +18196,33 @@ eHalStatus sme_handle_set_fcc_channel(tHalHandle hal, bool fcc_constraint,
 
 	return status;
 }
+
+/**
+ * sme_set_sta_chanlist_with_sub20()- update channel list with 5/10M
+ * info
+ * @hal_ptr: Hal context pointor
+ * @chan_width: 5/10M channel width info
+ *
+ * Return: eHalStatus
+ */
+eHalStatus
+sme_set_sta_chanlist_with_sub20(tHalHandle hal_ptr, uint8_t chan_width)
+{
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	tpAniSirGlobal mac_ptr  = PMAC_STRUCT(hal_ptr);
+
+	status = sme_AcquireGlobalLock(&mac_ptr->sme);
+
+	if (eHAL_STATUS_SUCCESS == status) {
+		mac_ptr->sub20_channelwidth = chan_width;
+		mac_ptr->sta_sub20_current_channelwidth = chan_width;
+		status = csrUpdateChannelList(mac_ptr);
+	}
+	sme_ReleaseGlobalLock(&mac_ptr->sme);
+
+	return status;
+}
+
 /**
  * sme_enable_phy_error_logs() - Enable DFS phy error logs
  * @hal:        global hal handle
@@ -18549,6 +19033,60 @@ eHalStatus sme_update_txrate(tHalHandle hal,
 }
 
 /**
+ * sme_peer_flush_pending() - sme function to flush peer pending packets
+ * val
+ * @hal:    Handle for Hal layer
+ * @req:    specified flush pending
+ *
+ * Return: Hal status
+ */
+eHalStatus sme_peer_flush_pending(tHalHandle hal,
+				  struct sme_flush_pending *req)
+{
+	eHalStatus          status;
+	VOS_STATUS          vos_status;
+	tpAniSirGlobal      mac_ctx    = PMAC_STRUCT(hal);
+	vos_msg_t           vos_msg;
+	struct sme_flush_pending *flush_pend;
+
+	smsLog(mac_ctx, LOG1, FL("enter"));
+
+	flush_pend = vos_mem_malloc(sizeof(*flush_pend));
+	if (NULL == flush_pend) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("Failed to alloc flush_pend"));
+		return eHAL_STATUS_FAILED_ALLOC;
+	}
+
+	flush_pend->session_id = req->session_id;
+	flush_pend->flush_ac = req->flush_ac;
+	vos_mem_copy(flush_pend->peer_addr.bytes, req->peer_addr.bytes,
+		     VOS_MAC_ADDR_SIZE);
+
+	status = sme_AcquireGlobalLock(&mac_ctx->sme);
+	if (eHAL_STATUS_SUCCESS == status) {
+		/* Serialize the req through MC thread */
+		vos_msg.bodyptr = flush_pend;
+		vos_msg.type = WDA_PEER_FLUSH_PENDING;
+		vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_msg);
+
+		if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				  FL("Post peer flush pending msg fail"));
+			status = eHAL_STATUS_FAILURE;
+			vos_mem_free(flush_pend);
+		}
+		sme_ReleaseGlobalLock(&mac_ctx->sme);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("sme_AcquireGlobalLock failed"));
+		vos_mem_free(flush_pend);
+	}
+	smsLog(mac_ctx, LOG1, FL("exit"));
+	return status;
+}
+
+/**
  * sme_delete_all_tdls_peers: send request to delete tdls peers
  * @hal: handler for HAL
  * @sessionId: session id
@@ -18589,6 +19127,46 @@ eHalStatus sme_delete_all_tdls_peers(tHalHandle hal, uint8_t session_id)
 	return status;
 }
 
+#ifdef FEATURE_COEX_PTA_CONFIG_ENABLE
+/**
+ * sme_configure_pta_coex() - Set coex PTA params
+ * @pta_enable: PTA enable or not
+ * @pta_param: PTA params
+ *
+ * Return: Return VOS_STATUS.
+ */
+VOS_STATUS sme_configure_pta_coex(uint8_t coex_pta_config_enable, uint32_t coex_pta_config_param)
+{
+	vos_msg_t msg = {0};
+	VOS_STATUS vos_status;
+	WMI_COEX_CONFIG_CMD_fixed_param *sme_pta_config;
+
+	sme_pta_config = vos_mem_malloc(sizeof(*sme_pta_config));
+	if (!sme_pta_config) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("Malloc failed"));
+		return VOS_STATUS_E_NOMEM;
+	}
+
+	sme_pta_config->config_type = WMI_COEX_CONFIG_PTA_CONFIG;
+	sme_pta_config->config_arg1 = coex_pta_config_enable;
+	sme_pta_config->config_arg2 = coex_pta_config_param;
+
+	msg.type = WDA_BTC_BT_WLAN_INTERVAL_CMD;
+	msg.reserved = 0;
+	msg.bodyptr = sme_pta_config;
+
+	vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA,&msg);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("Not able to post message to WDA"));
+		vos_mem_free(sme_pta_config);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	return vos_status;
+}
+#endif
 
 /**
  * sme_set_beacon_filter() - set the beacon filter configuration
@@ -18866,45 +19444,57 @@ VOS_STATUS sme_set_btc_dynamic_bt_wlan_coex(uint32_t dynamic_wlan_bt_coex,
 	return vos_status;
 }
 
+
 /**
- * sme_set_btc_coex_tx_power() - Set the btc bt/wlan coex tx power
- * @coex_tx_power: bt/wlan coex tx power
+ * sme_set_btc_bt_wlan_interval_page_p2p_sta() - Set the
+ * btc bt/p2psta interval
+ * @bt_interval: BT Page Interval
+ * @sta_interval: P2P STA Interval
  *
  * Return: Return VOS_STATUS.
  */
-VOS_STATUS sme_set_btc_wlan_coex_tx_power(uint32_t coex_tx_power)
+VOS_STATUS sme_set_btc_bt_wlan_interval_page_p2p_sta(uint32_t bt_interval,
+                        uint32_t p2p_sta_interval)
 {
-	vos_msg_t msg = {0};
-	VOS_STATUS vos_status;
-	WMI_COEX_CONFIG_CMD_fixed_param *sme_interval;
+        vos_msg_t msg = {0};
+        VOS_STATUS vos_status;
+        WMI_COEX_CONFIG_CMD_fixed_param *sme_interval;
 
-	sme_interval = vos_mem_malloc(sizeof(*sme_interval));
-	if (!sme_interval) {
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-			  FL("Malloc failed"));
-		return VOS_STATUS_E_NOMEM;
-	}
+        sme_interval = vos_mem_malloc(sizeof(*sme_interval));
+        if (!sme_interval) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                          FL("Malloc failed"));
+                return VOS_STATUS_E_NOMEM;
+        }
 
-	sme_interval->config_type = WMI_COEX_CONFIG_TX_POWER;
-	sme_interval->config_arg1 = coex_tx_power;
+        sme_interval->config_type = WMI_COEX_CONFIG_PAGE_P2P_STA_TDM;
+        sme_interval->config_arg1 = bt_interval;
+        sme_interval->config_arg2 = p2p_sta_interval;
 
-	msg.type = WDA_BTC_BT_WLAN_INTERVAL_CMD;
-	msg.reserved = 0;
-	msg.bodyptr = sme_interval;
+        msg.type = WDA_BTC_BT_WLAN_INTERVAL_CMD;
+        msg.reserved = 0;
+        msg.bodyptr = sme_interval;
 
-	vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA,&msg);
-	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
-		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-			  FL("Not able to post message to WDA"));
-		vos_mem_free(sme_interval);
-		return VOS_STATUS_E_FAILURE;
-	}
+        vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA,&msg);
+        if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                          FL("Not able to post message to WDA"));
+                vos_mem_free(sme_interval);
+                return VOS_STATUS_E_FAILURE;
+        }
 
-	return vos_status;
+        return vos_status;
 }
 
-#ifdef WMI_COEX_BTC_DUTYCYCLE
-VOS_STATUS sme_set_btc_coex_dutycycle(uint32_t coex_btc_PauseDuration,uint32_t coex_btc_UnPauseDuration)
+/**
+ * sme_set_btc_bt_wlan_interval_inquiry_sta() - Inquiry the btc bt/sta interval
+ * @bt_interval: BT Page Interval
+ * @sta_interval: STA Interval
+ *
+ * Return: Return VOS_STATUS.
+ */
+VOS_STATUS sme_set_btc_bt_wlan_interval_inquiry_sta(uint32_t bt_interval,
+                        uint32_t sta_interval)
 {
         vos_msg_t msg = {0};
         VOS_STATUS vos_status;
@@ -18917,11 +19507,9 @@ VOS_STATUS sme_set_btc_coex_dutycycle(uint32_t coex_btc_PauseDuration,uint32_t c
                 return VOS_STATUS_E_NOMEM;
         }
 
-        sme_interval->config_type = WMI_COEX_CONFIG_BTC_DUTYCYCLE;
-        sme_interval->config_arg1 = coex_btc_PauseDuration;
-       sme_interval->config_arg2 = coex_btc_UnPauseDuration;
-       printk(KERN_ERR "ENTER sme_set_btc_coex_dutycycle = %d",coex_btc_PauseDuration);
-       printk(KERN_ERR "ENTER sme_set_btc_coex_dutycycle =%d",coex_btc_UnPauseDuration);
+        sme_interval->config_type = WMI_COEX_CONFIG_INQUIRY_STA_TDM;
+        sme_interval->config_arg1 = bt_interval;
+        sme_interval->config_arg2 = sta_interval;
 
         msg.type = WDA_BTC_BT_WLAN_INTERVAL_CMD;
         msg.reserved = 0;
@@ -18937,7 +19525,164 @@ VOS_STATUS sme_set_btc_coex_dutycycle(uint32_t coex_btc_PauseDuration,uint32_t c
 
         return vos_status;
 }
-#endif
+
+/**
+ * sme_set_btc_bt_wlan_interval_inquiry_sap() - Inquiry the btc bt/sap interval
+ * @bt_interval: BT Page Interval
+ * @sta_interval: SAP Interval
+ *
+ * Return: Return VOS_STATUS.
+ */
+VOS_STATUS sme_set_btc_bt_wlan_interval_inquiry_sap(uint32_t bt_interval,
+                        uint32_t sap_interval)
+{
+        vos_msg_t msg = {0};
+        VOS_STATUS vos_status;
+        WMI_COEX_CONFIG_CMD_fixed_param *sme_interval;
+
+        sme_interval = vos_mem_malloc(sizeof(*sme_interval));
+        if (!sme_interval) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                          FL("Malloc failed"));
+                return VOS_STATUS_E_NOMEM;
+        }
+
+        sme_interval->config_type = WMI_COEX_CONFIG_INQUIRY_SAP_TDM;
+        sme_interval->config_arg1 = bt_interval;
+        sme_interval->config_arg2 = sap_interval;
+
+        msg.type = WDA_BTC_BT_WLAN_INTERVAL_CMD;
+        msg.reserved = 0;
+        msg.bodyptr = sme_interval;
+
+        vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA,&msg);
+        if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                          FL("Not able to post message to WDA"));
+                vos_mem_free(sme_interval);
+                return VOS_STATUS_E_FAILURE;
+        }
+
+        return vos_status;
+}
+
+ /**
+ * sme_set_btc_bt_wlan_interval_inquiry_p2p() - Inquiry the btc bt/p2p interval
+ * @bt_interval: BT Page Interval
+ * @sta_interval: P2P Interval
+ *
+ * Return: Return VOS_STATUS.
+ */
+VOS_STATUS sme_set_btc_bt_wlan_interval_inquiry_p2p(uint32_t bt_interval,
+                        uint32_t p2p_interval)
+{
+        vos_msg_t msg = {0};
+        VOS_STATUS vos_status;
+        WMI_COEX_CONFIG_CMD_fixed_param *sme_interval;
+
+        sme_interval = vos_mem_malloc(sizeof(*sme_interval));
+        if (!sme_interval) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                          FL("Malloc failed"));
+                return VOS_STATUS_E_NOMEM;
+        }
+
+        sme_interval->config_type = WMI_COEX_CONFIG_INQUIRY_P2P_TDM;
+        sme_interval->config_arg1 = bt_interval;
+        sme_interval->config_arg2 = p2p_interval;
+
+        msg.type = WDA_BTC_BT_WLAN_INTERVAL_CMD;
+        msg.reserved = 0;
+        msg.bodyptr = sme_interval;
+
+        vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA,&msg);
+        if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                          FL("Not able to post message to WDA"));
+                vos_mem_free(sme_interval);
+                return VOS_STATUS_E_FAILURE;
+        }
+
+        return vos_status;
+}
+
+/**
+ * sme_set_btc_bt_wlan_interval_inquiry_p2p_sta() - Inquiry the
+ * btc bt/p2psta interval
+ * @bt_interval: BT Page Interval
+ * @sta_interval: P2P STA Interval
+ *
+ * Return: Return VOS_STATUS.
+ */
+VOS_STATUS sme_set_btc_bt_wlan_interval_inquiry_p2p_sta(uint32_t bt_interval,
+                        uint32_t p2p_sta_interval)
+{
+        vos_msg_t msg = {0};
+        VOS_STATUS vos_status;
+        WMI_COEX_CONFIG_CMD_fixed_param *sme_interval;
+
+        sme_interval = vos_mem_malloc(sizeof(*sme_interval));
+        if (!sme_interval) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                          FL("Malloc failed"));
+                return VOS_STATUS_E_NOMEM;
+        }
+
+        sme_interval->config_type = WMI_COEX_CONFIG_INQUIRY_P2P_STA_TDM;
+        sme_interval->config_arg1 = bt_interval;
+        sme_interval->config_arg2 = p2p_sta_interval;
+
+        msg.type = WDA_BTC_BT_WLAN_INTERVAL_CMD;
+        msg.reserved = 0;
+        msg.bodyptr = sme_interval;
+
+        vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA,&msg);
+        if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                          FL("Not able to post message to WDA"));
+                vos_mem_free(sme_interval);
+                return VOS_STATUS_E_FAILURE;
+        }
+
+        return vos_status;
+}
+
+/**
+ * sme_set_btc_coex_tx_power() - Set the btc bt/wlan coex tx power
+ * @coex_tx_power: bt/wlan coex tx power
+ *
+ * Return: Return VOS_STATUS.
+ */
+VOS_STATUS sme_set_btc_wlan_coex_tx_power(uint32_t coex_tx_power)
+{
+	vos_msg_t msg = {0};
+	VOS_STATUS vos_status;
+	WMI_COEX_CONFIG_CMD_fixed_param *sme_interval;
+
+	sme_interval = vos_mem_malloc(sizeof(*sme_interval));
+	if (!sme_interval) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("Malloc failed"));
+		return VOS_STATUS_E_NOMEM;
+	}
+
+	sme_interval->config_type = WMI_COEX_CONFIG_TX_POWER;
+	sme_interval->config_arg1 = coex_tx_power;
+
+	msg.type = WDA_BTC_BT_WLAN_INTERVAL_CMD;
+	msg.reserved = 0;
+	msg.bodyptr = sme_interval;
+
+	vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA,&msg);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("Not able to post message to WDA"));
+		vos_mem_free(sme_interval);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	return vos_status;
+}
 
 /**
  * sme_send_disassoc_req_frame - send disassoc req
@@ -19176,6 +19921,7 @@ static inline void sme_sta_roam_offload_scan(tHalHandle hal_handle,
  * @skip_unsafe_channels: Param to tell if driver needs to
  * skip unsafe channels or not.
  * @param session_id: sme_session_id
+ * @sap_operating_band: Band on which SAP is operating
  *
  * sme_update_sta_roam_policy update sta rome policies to csr
  * this function will call csrUpdateChannelList as well
@@ -19186,7 +19932,8 @@ static inline void sme_sta_roam_offload_scan(tHalHandle hal_handle,
 eHalStatus sme_update_sta_roam_policy(tHalHandle hal_handle,
 		enum sta_roam_policy_dfs_mode dfs_mode,
 		bool skip_unsafe_channels,
-		uint8_t session_id)
+		uint8_t session_id,
+                uint8_t sap_operating_band)
 {
 	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal_handle);
 	eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -19206,6 +19953,8 @@ eHalStatus sme_update_sta_roam_policy(tHalHandle hal_handle,
 		dfs_mode;
 	sme_config.csrConfig.sta_roam_policy_params.skip_unsafe_channels =
 		skip_unsafe_channels;
+        sme_config.csrConfig.sta_roam_policy_params.sap_operating_band =
+            sap_operating_band;
 
 	sme_UpdateConfig(hal_handle, &sme_config);
 
@@ -19324,7 +20073,7 @@ eHalStatus sme_update_tx_fail_cnt_threshold(tHalHandle hal_handle,
  * Return: VOS_STATUS
  */
 eHalStatus sme_update_short_retry_limit_threshold(tHalHandle hal_handle,
-		uint8_t session_id, uint32_t short_limit_count_th)
+		uint8_t session_id, uint8_t short_limit_count_th)
 {
 	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal_handle);
 	eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -19369,7 +20118,7 @@ eHalStatus sme_update_short_retry_limit_threshold(tHalHandle hal_handle,
  * Return: VOS_STATUS
  */
 eHalStatus sme_update_long_retry_limit_threshold(tHalHandle hal_handle,
-		uint8_t session_id, uint32_t long_limit_count_th)
+		uint8_t session_id, uint8_t long_limit_count_th)
 {
 	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal_handle);
 	eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -19472,3 +20221,314 @@ void sme_set_chan_info_callback(tHalHandle hal_handle,
 
 	mac->chan_info_cb = callback;
 }
+
+/*
+ * sme_set_band_specific_pref(): If 5G preference is enabled,set boost/drop
+ * params from ini.
+ * @hal_handle: Handle returned by mac_open
+ * @5g_pref_params: pref params from ini.
+ */
+void sme_set_5g_band_pref(tHalHandle hal_handle,
+                                struct sme_5g_band_pref_params *pref_params) {
+
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal_handle);
+	struct roam_ext_params *roam_params;
+	eHalStatus status    = eHAL_STATUS_SUCCESS;
+
+	if (!pref_params) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  "Invalid 5G pref params!");
+		return;
+	}
+	status = sme_AcquireGlobalLock( &mac_ctx->sme );
+	if (HAL_STATUS_SUCCESS(status)) {
+		roam_params = &mac_ctx->roam.configParam.roam_params;
+		roam_params->raise_rssi_thresh_5g =
+				pref_params->rssi_boost_threshold_5g;
+		roam_params->raise_factor_5g =
+				pref_params->rssi_boost_factor_5g;
+		roam_params->max_raise_rssi_5g =
+				pref_params->max_rssi_boost_5g;
+		roam_params->drop_rssi_thresh_5g =
+				pref_params->rssi_penalize_threshold_5g;
+		roam_params->drop_factor_5g =
+				pref_params->rssi_penalize_factor_5g;
+		roam_params->max_drop_rssi_5g =
+				pref_params->max_rssi_penalize_5g;
+
+		sme_ReleaseGlobalLock(&mac_ctx->sme);
+	}
+	else
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  "Unable to acquire global sme lock");
+}
+
+/**
+ * sme_set_reorder_timeout() - set reorder timeout value
+ * including Voice,Video,Besteffort,Background parameters
+ * @hal: hal handle for getting global mac struct
+ * @reg: struct sir_set_rx_reorder_timeout_val
+ *
+ * Return: eHAL_STATUS_SUCCESS or non-zero on failure.
+ */
+eHalStatus sme_set_reorder_timeout(tHalHandle hal,
+			struct sir_set_rx_reorder_timeout_val *req)
+{
+	eHalStatus          status     = eHAL_STATUS_SUCCESS;
+	VOS_STATUS          vos_status = VOS_STATUS_SUCCESS;
+	tpAniSirGlobal      mac_ctx    = PMAC_STRUCT(hal);
+	vos_msg_t           vos_msg;
+	struct sir_set_rx_reorder_timeout_val *reorder_timeout;
+
+	smsLog(mac_ctx, LOG1, FL("enter"));
+
+	reorder_timeout = vos_mem_malloc(sizeof(*reorder_timeout));
+	if (NULL == reorder_timeout) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			FL("Failed to alloc txrate_update"));
+		return eHAL_STATUS_FAILED_ALLOC;
+	}
+
+	*reorder_timeout = *req;
+
+	status = sme_AcquireGlobalLock(&mac_ctx->sme);
+	if (eHAL_STATUS_SUCCESS == status) {
+		/* Serialize the req through MC thread */
+		vos_msg.bodyptr = reorder_timeout;
+		vos_msg.type = SIR_HAL_SET_REORDER_TIMEOUT_CMDID;
+		vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_msg);
+
+		if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				FL("Post Update tx_rate msg fail"));
+			status = eHAL_STATUS_FAILURE;
+			vos_mem_free(reorder_timeout);
+		}
+		sme_ReleaseGlobalLock(&mac_ctx->sme);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			FL("sme_AcquireGlobalLock failed"));
+		vos_mem_free(reorder_timeout);
+	}
+	smsLog(mac_ctx, LOG1, FL("exit"));
+	return status;
+}
+
+/**
+ * sme_set_rx_set_blocksize() - set blocksize value
+ * including mac_addr and win_limit parameters
+ * @hal: hal handle for getting global mac struct
+ * @reg: struct sir_peer_set_rx_blocksize
+ *
+ * Return: eHAL_STATUS_SUCCESS or non-zero on failure.
+ */
+eHalStatus sme_set_rx_set_blocksize(tHalHandle hal,
+			struct sir_peer_set_rx_blocksize *req)
+{
+	eHalStatus          status     = eHAL_STATUS_SUCCESS;
+	VOS_STATUS          vos_status = VOS_STATUS_SUCCESS;
+	tpAniSirGlobal      mac_ctx    = PMAC_STRUCT(hal);
+	vos_msg_t           vos_msg;
+	struct sir_peer_set_rx_blocksize *rx_blocksize;
+
+	smsLog(mac_ctx, LOG1, FL("enter"));
+
+	rx_blocksize = vos_mem_malloc(sizeof(*rx_blocksize));
+	if (NULL == rx_blocksize) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			FL("Failed to alloc rx_blocksize"));
+		return eHAL_STATUS_FAILED_ALLOC;
+	}
+
+	*rx_blocksize = *req;
+
+	status = sme_AcquireGlobalLock(&mac_ctx->sme);
+	if (eHAL_STATUS_SUCCESS == status) {
+		/* Serialize the req through MC thread */
+		vos_msg.bodyptr = rx_blocksize;
+		vos_msg.type = SIR_HAL_SET_RX_BLOCKSIZE_CMDID;
+		vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_msg);
+
+		if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				FL("Post Update tx_rate msg fail"));
+			status = eHAL_STATUS_FAILURE;
+			vos_mem_free(rx_blocksize);
+		}
+		sme_ReleaseGlobalLock(&mac_ctx->sme);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			FL("sme_AcquireGlobalLock failed"));
+		vos_mem_free(rx_blocksize);
+	}
+	smsLog(mac_ctx, LOG1, FL("exit"));
+	return status;
+}
+/**
+ * sme_register_stats_ext2_callback() - Register drone callback to SME
+ * @hal_handle: hal handle for getting global mac struct
+ * @stats_ext2_cb: callback to be registered
+ *
+ * This function will register a callback for frame aggregation failure
+ * indications processing.
+ *
+ * Return: eHAL_STATUS_SUCCESS or non-zero on failure.
+ */
+eHalStatus sme_register_stats_ext2_callback(tHalHandle hal_handle,
+			void (*stats_ext2_cb)(void *, struct stats_ext2_event *))
+{
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	tpAniSirGlobal pmac = PMAC_STRUCT(hal_handle);
+
+	status = sme_AcquireGlobalLock(&pmac->sme);
+	if (status == eHAL_STATUS_SUCCESS) {
+		pmac->sme.stats_ext2_cb = stats_ext2_cb;
+		sme_ReleaseGlobalLock(&pmac->sme);
+	}
+	return status;
+}
+
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+/**
+ * sme_update_sub20_channel_width() - update sub 20 channel width
+ * @hal_handle: hal handle for getting global mac struct
+ * @session_id: Session ID on which sub20 channel width needs to be updated
+ * to FW
+ * @chan_width: channel width
+ *
+ * Return: eHAL_STATUS_SUCCESS or non-zero on failure.
+ */
+eHalStatus sme_update_sub20_channel_width(tHalHandle hal_handle,
+                                          uint8_t session_id,
+                                          uint8_t chan_width)
+{
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal_handle);
+	eHalStatus status;
+	struct sme_sub20_chan_width *msg;
+	uint16_t msg_len;
+
+	if (mac_ctx == NULL) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_FATAL,
+			  "%s: mac_ctx is null", __func__);
+		VOS_ASSERT(0);
+		return eHAL_STATUS_FAILURE;
+	}
+
+	if (mac_ctx->sub20_dynamic_channelwidth == 0)
+		return eHAL_STATUS_SUCCESS;
+
+	msg = vos_mem_malloc(sizeof(*msg));
+	if (NULL == msg) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  "%s: mem alloc failed for pSub20ChannelWidth",
+			  __func__);
+		return eHAL_STATUS_FAILURE;
+	}
+
+	msg_len = sizeof(*msg);
+	msg->message_type = pal_cpu_to_be16(eWNI_SME_SET_SUB20_CH_WIDTH);
+	msg->length = pal_cpu_to_be16(msg_len);
+	msg->session_id = session_id;
+	msg->channelwidth = chan_width;
+
+	status = palSendMBMessage(mac_ctx->hHdd, msg);
+	if (eHAL_STATUS_SUCCESS != status)
+		smsLog(mac_ctx, LOGE, FL(
+		       "eWNI_SME_SET_SUB20_CH_WIDTH: msg to PE failed"));
+	return status;
+}
+#endif
+
+eHalStatus sme_set_random_mac(tHalHandle hal,
+			      action_frame_random_filter_callback callback,
+			      uint32_t session_id, uint8_t *random_mac,
+			      void *context)
+{
+
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
+	vos_msg_t vos_msg;
+	struct action_frame_random_filter *filter;
+
+	filter = vos_mem_malloc(sizeof(*filter));
+
+	if (!filter) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("Failed to alloc random mac filter"));
+		return eHAL_STATUS_FAILED_ALLOC;
+	}
+	vos_mem_zero(filter, sizeof(*filter));
+
+	filter->session_id = session_id;
+	filter->filter_type = SME_ACTION_FRAME_RANDOM_MAC_SET;
+	filter->callback = callback;
+	filter->context = context;
+	vos_mem_copy(filter->mac_addr, random_mac, VOS_MAC_ADDR_SIZE);
+
+	status = sme_AcquireGlobalLock(&mac_ctx->sme);
+	if (status == eHAL_STATUS_SUCCESS) {
+		/* Serialize the req through MC thread */
+		vos_msg.bodyptr = filter;
+		vos_msg.type = WDA_ACTION_FRAME_RANDOM_MAC;
+		vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_msg);
+
+		if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				FL("action frame set random mac msg fail"));
+			status = eHAL_STATUS_FAILURE;
+			vos_mem_free(filter);
+		}
+		sme_ReleaseGlobalLock(&mac_ctx->sme);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				FL("sme_AcquireGlobalLock failed"));
+		vos_mem_free(filter);
+	}
+	return status;
+}
+
+eHalStatus sme_clear_random_mac(tHalHandle hal, uint32_t session_id,
+				uint8_t *random_mac)
+{
+
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
+	vos_msg_t vos_msg;
+	struct action_frame_random_filter *filter;
+
+	filter = vos_mem_malloc(sizeof(*filter));
+
+	if (!filter) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("Failed to alloc random mac filter"));
+		return eHAL_STATUS_FAILED_ALLOC;
+	}
+	vos_mem_zero(filter, sizeof(*filter));
+
+	filter->session_id = session_id;
+	filter->filter_type = SME_ACTION_FRAME_RANDOM_MAC_CLEAR;
+	vos_mem_copy(filter->mac_addr, random_mac, VOS_MAC_ADDR_SIZE);
+
+	status = sme_AcquireGlobalLock(&mac_ctx->sme);
+	if (status == eHAL_STATUS_SUCCESS) {
+		/* Serialize the req through MC thread */
+		vos_msg.bodyptr = filter;
+		vos_msg.type = WDA_ACTION_FRAME_RANDOM_MAC;
+		vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_msg);
+
+		if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				FL("action frame clear random mac msg fail"));
+			status = eHAL_STATUS_FAILURE;
+			vos_mem_free(filter);
+		}
+		sme_ReleaseGlobalLock(&mac_ctx->sme);
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				FL("sme_AcquireGlobalLock failed"));
+		vos_mem_free(filter);
+	}
+	return status;
+}
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_FTApi.c b/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_FTApi.c
index 344e3d6d4ab..14416911458 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_FTApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_FTApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -163,6 +163,7 @@ void sme_SetFTIEs(tHalHandle hHal, tANI_U32 sessionId, const tANI_U8 *ft_ies,
    {
       case eFT_START_READY:
       case eFT_AUTH_REQ_READY:
+         smsLog( pMac, LOG1, FL("ft_ies_length: %d"), ft_ies_length);
          if ((pSession->ftSmeContext.auth_ft_ies) &&
                (pSession->ftSmeContext.auth_ft_ies_length))
          {
@@ -171,7 +172,7 @@ void sme_SetFTIEs(tHalHandle hHal, tANI_U32 sessionId, const tANI_U8 *ft_ies,
             pSession->ftSmeContext.auth_ft_ies_length = 0;
             pSession->ftSmeContext.auth_ft_ies = NULL;
          }
-
+         ft_ies_length = MIN(ft_ies_length, MAX_FTIE_SIZE);
          // Save the FT IEs
          pSession->ftSmeContext.auth_ft_ies =
             vos_mem_malloc(ft_ies_length);
@@ -187,9 +188,6 @@ void sme_SetFTIEs(tHalHandle hHal, tANI_U32 sessionId, const tANI_U8 *ft_ies,
                ft_ies,ft_ies_length);
          pSession->ftSmeContext.FTState = eFT_AUTH_REQ_READY;
 
-#if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-         smsLog( pMac, LOG1, "ft_ies_length=%d", ft_ies_length);
-#endif
          break;
 
       case eFT_AUTH_COMPLETE:
@@ -215,7 +213,7 @@ void sme_SetFTIEs(tHalHandle hHal, tANI_U32 sessionId, const tANI_U8 *ft_ies,
 
          // At this juncture we are ready to start sending Re-Assoc Req.
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-         smsLog( pMac, LOG1, "New Reassoc Req=%p in state %d",
+         smsLog( pMac, LOG1, "New Reassoc Req=%pK in state %d",
                ft_ies, pSession->ftSmeContext.FTState);
 #endif
          if ((pSession->ftSmeContext.reassoc_ft_ies) &&
@@ -265,13 +263,9 @@ eHalStatus sme_FTSendUpdateKeyInd(tHalHandle hHal, tANI_U32 sessionId,
    tSirKeyMaterial *keymaterial = NULL;
    tAniEdType edType;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-#if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-   int i = 0;
 
+#if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
    smsLog(pMac, LOG1, FL("keyLength %d"), pFTKeyInfo->keyLength);
-
-   for (i=0; i<pFTKeyInfo->keyLength; i++)
-      smsLog(pMac, LOG1, FL("%02x"), pFTKeyInfo->Key[i]);
 #endif
 
    if(pFTKeyInfo->keyLength > CSR_MAX_KEY_LEN)
@@ -318,24 +312,7 @@ eHalStatus sme_FTSendUpdateKeyInd(tHalHandle hHal, tANI_U32 sessionId,
    keymaterial->key[ 0 ].keyLength = pFTKeyInfo->keyLength;
 
    if (pFTKeyInfo->keyLength)
-   {
       vos_mem_copy(&keymaterial->key[ 0 ].key, pFTKeyInfo->Key, pFTKeyInfo->keyLength);
-      if(pFTKeyInfo->keyLength == 16)
-      {
-         smsLog(pMac, LOG1,
-         "SME Set Update Ind keyIdx (%d) encType(%d) key = "
-         "%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X",
-         pMsg->keyMaterial.key[0].keyId, (tAniEdType)pMsg->keyMaterial.edType,
-         pMsg->keyMaterial.key[0].key[0], pMsg->keyMaterial.key[0].key[1],
-         pMsg->keyMaterial.key[0].key[2], pMsg->keyMaterial.key[0].key[3],
-         pMsg->keyMaterial.key[0].key[4], pMsg->keyMaterial.key[0].key[5],
-         pMsg->keyMaterial.key[0].key[6], pMsg->keyMaterial.key[0].key[7],
-         pMsg->keyMaterial.key[0].key[8], pMsg->keyMaterial.key[0].key[9],
-         pMsg->keyMaterial.key[0].key[10], pMsg->keyMaterial.key[0].key[11],
-         pMsg->keyMaterial.key[0].key[12], pMsg->keyMaterial.key[0].key[13],
-         pMsg->keyMaterial.key[0].key[14], pMsg->keyMaterial.key[0].key[15]);
-      }
-   }
 
    vos_mem_copy( &pMsg->bssId[ 0 ],
          &pFTKeyInfo->peerMac[ 0 ],
@@ -584,7 +561,7 @@ void sme_FTReset(tHalHandle hHal, tANI_U32 sessionId)
    if (NULL != pSession) {
       if (pSession->ftSmeContext.auth_ft_ies != NULL) {
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-          smsLog(pMac, LOG1, FL("Freeing FT Auth IE %p and setting to NULL"),
+          smsLog(pMac, LOG1, FL("Freeing FT Auth IE %pK and setting to NULL"),
                 pSession->ftSmeContext.auth_ft_ies);
 #endif
          vos_mem_free(pSession->ftSmeContext.auth_ft_ies);
@@ -595,7 +572,7 @@ void sme_FTReset(tHalHandle hHal, tANI_U32 sessionId)
       if (pSession->ftSmeContext.reassoc_ft_ies != NULL) {
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
           smsLog(pMac, LOG1,
-                 FL("Freeing FT Reassoc IE %p and setting to NULL"),
+                 FL("Freeing FT Reassoc IE %pK and setting to NULL"),
                  pSession->ftSmeContext.reassoc_ft_ies);
 #endif
          vos_mem_free(pSession->ftSmeContext.reassoc_ft_ies);
@@ -605,7 +582,7 @@ void sme_FTReset(tHalHandle hHal, tANI_U32 sessionId)
 
       if (pSession->ftSmeContext.psavedFTPreAuthRsp != NULL) {
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-          smsLog( pMac, LOG1, FL("Freeing FtPreAuthRsp %p and setting to NULL"),
+          smsLog( pMac, LOG1, FL("Freeing FtPreAuthRsp %pK and setting to NULL"),
                 pSession->ftSmeContext.psavedFTPreAuthRsp);
 #endif
           vos_mem_free(pSession->ftSmeContext.psavedFTPreAuthRsp);
diff --git a/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_Trace.c b/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_Trace.c
index 33491753562..65ae991b41f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_Trace.c
+++ b/drivers/staging/qcacld-2.0/CORE/SME/src/sme_common/sme_Trace.c
@@ -214,28 +214,28 @@ static void smeTraceDump(tpAniSirGlobal pMac, tpvosTraceRecord pRecord,
 {
 	switch (pRecord->code) {
 	case TRACE_CODE_SME_COMMAND:
-		smsLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+		smsLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
 			recIndex, pRecord->time, pRecord->session,
 			"SME COMMAND:",
 			smeTraceGetCommandString(pRecord->data),
 			pRecord->data);
 		break;
 	case TRACE_CODE_SME_TX_WDA_MSG:
-		smsLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+		smsLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
 			recIndex, pRecord->time, pRecord->session,
 			"TX WDA Msg:",
 			macTraceGetWdaMsgString((tANI_U16)pRecord->data),
 			pRecord->data);
 		break;
 	case TRACE_CODE_SME_RX_WDA_MSG:
-		smsLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+		smsLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
 			recIndex, pRecord->time, pRecord->session,
 			"RX WDA Msg:",
 			macTraceGetSmeMsgString((tANI_U16)pRecord->data),
 			pRecord->data);
 		break;
 	default:
-		smsLog(pMac, LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
+		smsLog(pMac, LOG1, "%04d %s S%d %-14s %-30s(0x%x)",
 			recIndex, pRecord->time, pRecord->session,
 			"RX HDD MSG:",
 			smeTraceGetRxMsgString(pRecord->code),
diff --git a/drivers/staging/qcacld-2.0/CORE/SVC/external/wlan_nlink_common.h b/drivers/staging/qcacld-2.0/CORE/SVC/external/wlan_nlink_common.h
index 0dd62647935..0b3604cbc43 100644
--- a/drivers/staging/qcacld-2.0/CORE/SVC/external/wlan_nlink_common.h
+++ b/drivers/staging/qcacld-2.0/CORE/SVC/external/wlan_nlink_common.h
@@ -100,6 +100,7 @@
 #define WLAN_SVC_WLAN_TP_TX_IND     0x10B
 #define WLAN_SVC_WLAN_AUTO_SHUTDOWN_CANCEL_IND 0x10C
 #define WLAN_SVC_WLAN_RADIO_INDEX 0x10D
+#define WLAN_SVC_FW_SHUTDOWN_IND  0x10E
 
 #define WLAN_SVC_MAX_SSID_LEN    32
 #define WLAN_SVC_MAX_BSSID_LEN   6
diff --git a/drivers/staging/qcacld-2.0/CORE/SVC/inc/wlan_nlink_srv.h b/drivers/staging/qcacld-2.0/CORE/SVC/inc/wlan_nlink_srv.h
index ce5b58280ab..d7b7feeda12 100644
--- a/drivers/staging/qcacld-2.0/CORE/SVC/inc/wlan_nlink_srv.h
+++ b/drivers/staging/qcacld-2.0/CORE/SVC/inc/wlan_nlink_srv.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -65,8 +65,15 @@ int nl_srv_register(tWlanNlModTypes msg_type,
 		    nl_srv_msg_callback msg_handler);
 int nl_srv_unregister(tWlanNlModTypes msg_type,
 		       nl_srv_msg_callback msg_handler);
-int nl_srv_ucast(struct sk_buff * skb, int dst_pid, int flag);
-int nl_srv_bcast(struct sk_buff * skb);
+
+#ifdef CNSS_GENL
+int nl_srv_ucast(struct sk_buff *skb, int dst_pid, int flag,
+			int app_id, int mcgroup_id);
+int nl_srv_bcast(struct sk_buff *skb, int mcgroup_id, int app_id);
+#else
+int nl_srv_ucast(struct sk_buff *skb, int dst_pid, int flag);
+int nl_srv_bcast(struct sk_buff *skb);
+#endif
 int nl_srv_is_initialized(void);
 
 #else
diff --git a/drivers/staging/qcacld-2.0/CORE/SVC/inc/wlan_ptt_sock_svc.h b/drivers/staging/qcacld-2.0/CORE/SVC/inc/wlan_ptt_sock_svc.h
index bf4fa61e7cc..bede9141829 100644
--- a/drivers/staging/qcacld-2.0/CORE/SVC/inc/wlan_ptt_sock_svc.h
+++ b/drivers/staging/qcacld-2.0/CORE/SVC/inc/wlan_ptt_sock_svc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -97,13 +97,26 @@
  * Length      : 4 bytes [LEN_PAYLOAD]
  * Payload     : LEN_PAYLOAD bytes
 */
-int ptt_sock_activate_svc(void *pAdapter);
+int ptt_sock_activate_svc(void *hdd_ctx);
 int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid);
 
 typedef struct sAniAppRegReq {
     tAniNlModTypes type;              // module id
     int pid;                          // process id
 } tAniNlAppRegReq;
+
+/**
+ * struct sptt_app_reg_req - PTT register request structure
+ * @radio: Radio ID
+ * @wmsg: ANI header
+ *
+ * payload structure received as nl data from PTT app/user space
+ */
+typedef struct sptt_app_reg_req {
+	int radio;
+	tAniHdr wmsg;
+} ptt_app_reg_req;
+
 typedef struct sAniNlAppRegRsp {
     tAniHdr wniHdr;                   // Generic WNI msg header
     tAniNlAppRegReq regReq;           // The original request msg
diff --git a/drivers/staging/qcacld-2.0/CORE/SVC/src/logging/wlan_logging_sock_svc.c b/drivers/staging/qcacld-2.0/CORE/SVC/src/logging/wlan_logging_sock_svc.c
index 13b2a3a6c28..ff1fca24b36 100644
--- a/drivers/staging/qcacld-2.0/CORE/SVC/src/logging/wlan_logging_sock_svc.c
+++ b/drivers/staging/qcacld-2.0/CORE/SVC/src/logging/wlan_logging_sock_svc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -48,6 +48,9 @@
 #include "limApi.h"
 #include "ol_txrx_api.h"
 #include "csrApi.h"
+#ifdef CNSS_GENL
+#include <net/cnss_nl.h>
+#endif
 
 #define MAX_NUM_PKT_LOG 32
 
@@ -81,7 +84,8 @@ static uint8_t grx_count;
 
 #define ANI_NL_MSG_LOG_TYPE 89
 #define ANI_NL_MSG_READY_IND_TYPE 90
-#define MAX_LOGMSG_LENGTH 4096
+#define MAX_LOGMSG_LENGTH 2048
+#define MAX_SKBMSG_LENGTH 4096
 #define MAX_PKTSTATS_LENGTH 2048
 #define MAX_PKTSTATS_BUFF   16
 
@@ -174,63 +178,6 @@ static struct wlan_logging gwlan_logging;
 static struct log_msg *gplog_msg;
 static struct pkt_stats_msg *gpkt_stats_buffers;
 
-/* PID of the APP to log the message */
-static int gapp_pid = INVALID_PID;
-
-/* Utility function to send a netlink message to an application
- * in user space
- */
-static int wlan_send_sock_msg_to_app(tAniHdr *wmsg, int radio,
-				int src_mod, int pid)
-{
-	int err = -1;
-	int payload_len;
-	int tot_msg_len;
-	tAniNlHdr *wnl = NULL;
-	struct sk_buff *skb;
-	struct nlmsghdr *nlh;
-	int wmsg_length = wmsg->length;
-	static int nlmsg_seq;
-
-	if (radio < 0 || radio > ANI_MAX_RADIOS) {
-		LOGGING_TRACE(VOS_TRACE_LEVEL_ERROR,
-				"%s: invalid radio id [%d]",
-				__func__, radio);
-		return -EINVAL;
-	}
-
-	payload_len = wmsg_length + sizeof(wnl->radio) + sizeof(tAniHdr);
-	tot_msg_len = NLMSG_SPACE(payload_len);
-	skb = dev_alloc_skb(tot_msg_len);
-	if (skb == NULL) {
-		LOGGING_TRACE(VOS_TRACE_LEVEL_ERROR,
-				"%s: dev_alloc_skb() failed for msg size[%d]",
-				__func__, tot_msg_len);
-		return -ENOMEM;
-	}
-	nlh = nlmsg_put(skb, pid, nlmsg_seq++, src_mod, payload_len,
-		NLM_F_REQUEST);
-	if (NULL == nlh) {
-		LOGGING_TRACE(VOS_TRACE_LEVEL_ERROR,
-				"%s: nlmsg_put() failed for msg size[%d]",
-				__func__, tot_msg_len);
-		kfree_skb(skb);
-		return -ENOMEM;
-	}
-
-	wnl = (tAniNlHdr *) nlh;
-	wnl->radio = radio;
-	memcpy(&wnl->wmsg, wmsg, wmsg_length);
-	err = nl_srv_ucast(skb, pid, MSG_DONTWAIT);
-	if (err) {
-		LOGGING_TRACE(VOS_TRACE_LEVEL_INFO,
-				"%s: Failed sending Msg Type [0x%X] to pid[%d]\n",
-				__func__, wmsg->type, pid);
-	}
-
-	return err;
-}
-
 /**
  * is_data_path_module() - To check for a Datapath module
  * @mod_id: Module id
@@ -435,7 +382,7 @@ int wlan_log_to_user(VOS_TRACE_LEVEL log_level, char *to_be_sent, int length)
 		if (gwlan_logging.log_fe_to_console
 			&& ((VOS_TRACE_LEVEL_FATAL == log_level)
 			|| (VOS_TRACE_LEVEL_ERROR == log_level))) {
-			pr_info("%s\n", to_be_sent);
+			pr_info("%s %s\n", tbuf, to_be_sent);
 		}
 	}
 	return 0;
@@ -466,7 +413,7 @@ static int pkt_stats_fill_headers(struct sk_buff *skb)
 				vos_pkt_size);
 
 	if (unlikely(skb_headroom(skb) < vos_pkt_size)) {
-		pr_err("VPKT [%d]: Insufficient headroom, head[%p], data[%p], req[%zu]",
+		pr_err("VPKT [%d]: Insufficient headroom, head[%pK], data[%pK], req[%zu]",
 			__LINE__, skb->head, skb->data, sizeof(msg_header));
 		return -EIO;
 	}
@@ -475,7 +422,7 @@ static int pkt_stats_fill_headers(struct sk_buff *skb)
 			&vos_pktlog, vos_pkt_size);
 
 	if (unlikely(skb_headroom(skb) < sizeof(int))) {
-		pr_err("VPKT [%d]: Insufficient headroom, head[%p], data[%p], req[%zu]",
+		pr_err("VPKT [%d]: Insufficient headroom, head[%pK], data[%pK], req[%zu]",
 			__LINE__, skb->head, skb->data, sizeof(int));
 		return -EIO;
 	}
@@ -496,7 +443,7 @@ static int pkt_stats_fill_headers(struct sk_buff *skb)
 	msg_header.wmsg.length = cpu_to_be16(skb->len);
 
 	if (unlikely(skb_headroom(skb) < sizeof(msg_header))) {
-		pr_err("VPKT [%d]: Insufficient headroom, head[%p], data[%p], req[%zu]",
+		pr_err("VPKT [%d]: Insufficient headroom, head[%pK], data[%pK], req[%zu]",
 			__LINE__, skb->head, skb->data, sizeof(msg_header));
 		return -EIO;
 	}
@@ -508,6 +455,42 @@ static int pkt_stats_fill_headers(struct sk_buff *skb)
 }
 
 /**
+ * nl_srv_bcast_diag() - Wrapper to send bcast msgs to diag events mcast grp
+ * @skb: sk buffer pointer
+ *
+ * Sends the bcast message to diag events multicast group with generic nl socket
+ * if CNSS_GENL is enabled. Else, use the legacy netlink socket to send.
+ *
+ * Return: zero on success, error code otherwise
+ */
+static int nl_srv_bcast_diag(struct sk_buff *skb)
+{
+#ifdef CNSS_GENL
+	return nl_srv_bcast(skb, CLD80211_MCGRP_DIAG_EVENTS, ANI_NL_MSG_PUMAC);
+#else
+	return nl_srv_bcast(skb);
+#endif
+}
+
+/**
+ * nl_srv_bcast_host_logs() - Wrapper to send bcast msgs to host logs mcast grp
+ * @skb: sk buffer pointer
+ *
+ * Sends the bcast message to host logs multicast group with generic nl socket
+ * if CNSS_GENL is enabled. Else, use the legacy netlink socket to send.
+ *
+ * Return: zero on success, error code otherwise
+ */
+static int nl_srv_bcast_host_logs(struct sk_buff *skb)
+{
+#ifdef CNSS_GENL
+	return nl_srv_bcast(skb, CLD80211_MCGRP_HOST_LOGS, ANI_NL_MSG_LOG);
+#else
+	return nl_srv_bcast(skb);
+#endif
+}
+
+/**
  * pktlog_send_per_pkt_stats_to_user() - This function is used to send the per
  * packet statistics to the user
  *
@@ -527,11 +510,11 @@ int pktlog_send_per_pkt_stats_to_user(void)
 
 	while (!list_empty(&gwlan_logging.pkt_stat_filled_list)
 		&& !gwlan_logging.exit) {
-		skb_new = dev_alloc_skb(MAX_PKTSTATS_LENGTH);
+		skb_new = dev_alloc_skb(MAX_SKBMSG_LENGTH);
 		if (skb_new == NULL) {
 			if (!rate_limit) {
 				pr_err("%s: dev_alloc_skb() failed for msg size[%d] drop count = %u\n",
-					__func__, MAX_LOGMSG_LENGTH,
+					__func__, MAX_SKBMSG_LENGTH,
 					gwlan_logging.drop_count);
 			}
 			rate_limit = 1;
@@ -552,7 +535,8 @@ int pktlog_send_per_pkt_stats_to_user(void)
 			free_old_skb = true;
 			goto err;
 		}
-		ret = nl_srv_bcast(pstats_msg->skb);
+
+		ret = nl_srv_bcast_diag(pstats_msg->skb);
 		if ((ret < 0) && (ret != -ESRCH)) {
 			pr_info("%s: Send Failed %d drop_count = %u\n",
 				__func__, ret,
@@ -650,7 +634,7 @@ static int send_filled_buffers_to_user(void)
 				&gwlan_logging.free_list);
 		spin_unlock_irqrestore(&gwlan_logging.spin_lock, flags);
 
-		ret = nl_srv_bcast(skb);
+		ret = nl_srv_bcast_host_logs(skb);
 		/* print every 64th drop count */
 		if (ret < 0 && (!(gwlan_logging.drop_count % 0x40))) {
 			pr_err("%s: Send Failed %d drop_count = %u\n",
@@ -712,7 +696,7 @@ void send_flush_completion_to_user(void)
 
 	wlan_report_log_completion(is_fatal, indicator, reason_code);
 	if (is_ssr_needed)
-		vos_trigger_recovery();
+		vos_trigger_recovery(false);
 }
 
 /**
@@ -810,72 +794,12 @@ static int wlan_logging_thread(void *Arg)
 	return 0;
 }
 
-/*
- * Process all the Netlink messages from Logger Socket app in user space
- */
-static int wlan_logging_proc_sock_rx_msg(struct sk_buff *skb)
-{
-	tAniNlHdr *wnl;
-	int radio;
-	int type;
-	int ret;
-
-	wnl = (tAniNlHdr *) skb->data;
-	radio = wnl->radio;
-	type = wnl->nlh.nlmsg_type;
-
-	if (radio < 0 || radio > ANI_MAX_RADIOS) {
-		LOGGING_TRACE(VOS_TRACE_LEVEL_ERROR,
-				"%s: invalid radio id [%d]\n",
-				__func__, radio);
-		return -EINVAL;
-	}
-
-	if (wnl->wmsg.length > skb->data_len) {
-		LOGGING_TRACE(VOS_TRACE_LEVEL_ERROR,
-			"%s: invalid length msgLen:%x skb data_len:%x\n",
-			__func__, wnl->wmsg.length, skb->data_len);
-		return -EINVAL;
-	}
-
-	if (gapp_pid != INVALID_PID) {
-		if (wnl->nlh.nlmsg_pid > gapp_pid) {
-			gapp_pid = wnl->nlh.nlmsg_pid;
-		}
-
-		spin_lock_bh(&gwlan_logging.spin_lock);
-		if (gwlan_logging.pcur_node->filled_length) {
-			wlan_queue_logmsg_for_app();
-		}
-		spin_unlock_bh(&gwlan_logging.spin_lock);
-		set_bit(HOST_LOG_DRIVER_MSG, &gwlan_logging.eventFlag);
-		wake_up_interruptible(&gwlan_logging.wait_queue);
-	} else {
-		/* This is to set the default levels (WLAN logging
-		 * default values not the VOS trace default) when
-		 * logger app is registered for the first time.
-		 */
-		gapp_pid = wnl->nlh.nlmsg_pid;
-	}
-
-	ret = wlan_send_sock_msg_to_app(&wnl->wmsg, 0,
-			ANI_NL_MSG_LOG, wnl->nlh.nlmsg_pid);
-	if (ret < 0) {
-		LOGGING_TRACE(VOS_TRACE_LEVEL_ERROR,
-				"wlan_send_sock_msg_to_app: failed");
-	}
-
-	return ret;
-}
 
 int wlan_logging_sock_activate_svc(int log_fe_to_console, int num_buf)
 {
 	int i, j, pkt_stats_size;
 	unsigned long irq_flag;
 
-
-	gapp_pid = INVALID_PID;
-
 	gplog_msg = (struct log_msg *) vmalloc(
 			num_buf * sizeof(struct log_msg));
 	if (!gplog_msg) {
@@ -958,8 +882,6 @@ int wlan_logging_sock_activate_svc(int log_fe_to_console, int num_buf)
 	gwlan_logging.is_active = true;
 	gwlan_logging.is_flush_complete = false;
 
-	nl_srv_register(ANI_NL_MSG_LOG, wlan_logging_proc_sock_rx_msg);
-
 	return 0;
 
 err3:
@@ -989,9 +911,7 @@ int wlan_logging_sock_deactivate_svc(void)
 	if (!gplog_msg)
 		return 0;
 
-	nl_srv_unregister(ANI_NL_MSG_LOG, wlan_logging_proc_sock_rx_msg);
 	clear_default_logtoapp_log_level();
-	gapp_pid = INVALID_PID;
 
 	INIT_COMPLETION(gwlan_logging.shutdown_comp);
 	gwlan_logging.exit = true;
@@ -1030,7 +950,6 @@ int wlan_logging_sock_init_svc(void)
 {
 	spin_lock_init(&gwlan_logging.spin_lock);
 	spin_lock_init(&gwlan_logging.pkt_stats_lock);
-	gapp_pid = INVALID_PID;
 	gwlan_logging.pcur_node = NULL;
 	gwlan_logging.pkt_stats_pcur_node = NULL;
 	return 0;
@@ -1040,7 +959,6 @@ int wlan_logging_sock_deinit_svc(void)
 {
 	gwlan_logging.pcur_node = NULL;
 	gwlan_logging.pkt_stats_pcur_node = NULL;
-	gapp_pid = INVALID_PID;
 
        return 0;
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/SVC/src/nlink/wlan_nlink_srv.c b/drivers/staging/qcacld-2.0/CORE/SVC/src/nlink/wlan_nlink_srv.c
index 2a5b2fddbca..57e05b1e4d2 100644
--- a/drivers/staging/qcacld-2.0/CORE/SVC/src/nlink/wlan_nlink_srv.c
+++ b/drivers/staging/qcacld-2.0/CORE/SVC/src/nlink/wlan_nlink_srv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -43,6 +43,13 @@
 #include <wlan_nlink_srv.h>
 #include <vos_trace.h>
 
+#ifdef CNSS_GENL
+#include <vos_memory.h>
+#include <wlan_nlink_common.h>
+#include <net/genetlink.h>
+#include <net/cnss_nl.h>
+#endif
+
 #if defined(CONFIG_CNSS_LOGGER)
 
 #include <net/cnss_logger.h>
@@ -343,6 +350,192 @@ int nl_srv_unregister(tWlanNlModTypes msg_type, nl_srv_msg_callback msg_handler)
    return retcode;
 }
 
+#ifdef CNSS_GENL
+
+/**
+ * nl80211hdr_put() - API to fill genlmsg header
+ * @skb: Sk buffer
+ * @portid: Port ID
+ * @seq: Sequence number
+ * @flags: Flags
+ * @cmd: Command id
+ *
+ * API to fill genl message header for brodcast events to user space
+ *
+ * Return: Pointer to user specific header/payload
+ */
+static inline void *nl80211hdr_put(struct sk_buff *skb, uint32_t portid,
+					uint32_t seq, int flags, uint8_t cmd)
+{
+	struct genl_family *cld80211_fam = cld80211_get_genl_family();
+
+	return genlmsg_put(skb, portid, seq, cld80211_fam, flags, cmd);
+}
+
+/**
+ * cld80211_fill_data() - API to fill payload to nl message
+ * @msg: Sk buffer
+ * @portid: Port ID
+ * @seq: Sequence number
+ * @flags: Flags
+ * @cmd: Command ID
+ * @buf: data buffer/payload to be filled
+ * @len: length of the payload ie. @buf
+ *
+ * API to fill the payload/data of the nl message to be sent
+ *
+ * Return: zero on success
+ */
+static int cld80211_fill_data(struct sk_buff *msg, uint32_t portid,
+					uint32_t seq, int flags, uint8_t cmd,
+					uint8_t *buf, int len)
+{
+	void *hdr;
+	struct nlattr *nest;
+
+	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
+	if (!hdr) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+						"nl80211 hdr put failed");
+		return -EPERM;
+	}
+
+	nest = nla_nest_start(msg, CLD80211_ATTR_VENDOR_DATA);
+	if (!nest) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+						"nla_nest_start failed");
+		goto nla_put_failure;
+	}
+
+	if (nla_put(msg, CLD80211_ATTR_DATA, len, buf)) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+							"nla_put failed");
+		goto nla_put_failure;
+	}
+
+	nla_nest_end(msg, nest);
+	genlmsg_end(msg, hdr);
+
+	return 0;
+nla_put_failure:
+	genlmsg_cancel(msg, hdr);
+	return -EPERM;
+}
+
+/**
+ * send_msg_to_cld80211() - API to send message to user space Application
+ * @mcgroup_id: Multicast group ID
+ * @pid: Port ID
+ * @app_id: Application ID
+ * @buf: Data/payload buffer to be sent
+ * @len: Length of the data ie. @buf
+ *
+ * API to send the nl message to user space application.
+ *
+ * Return: zero on success
+ */
+static int send_msg_to_cld80211(int mcgroup_id, int pid, int app_id,
+						uint8_t *buf, int len)
+{
+	struct sk_buff *msg;
+	struct genl_family *cld80211_fam = cld80211_get_genl_family();
+	int status;
+	int flags = GFP_KERNEL;
+
+	if (in_interrupt() || irqs_disabled() || in_atomic())
+		flags = GFP_ATOMIC;
+
+	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, flags);
+	if (!msg) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+						"nlmsg malloc fails");
+		return -EPERM;
+	}
+
+	status = cld80211_fill_data(msg, pid, 0, 0, app_id, buf, len);
+	if (status) {
+		nlmsg_free(msg);
+		return -EPERM;
+	}
+
+	genlmsg_multicast_netns(cld80211_fam, &init_net, msg, 0,
+						mcgroup_id, flags);
+	return 0;
+}
+
+/**
+ * nl_srv_bcast() - wrapper function to do broadcast events to user space apps
+ * @skb: the socket buffer to send
+ * @mcgroup_id: multicast group id
+ * @app_id: application id
+ *
+ * This function is common wrapper to send broadcast events to different
+ * user space applications.
+ *
+ * return: none
+ */
+int nl_srv_bcast(struct sk_buff *skb, int mcgroup_id, int app_id)
+{
+	struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data;
+	void *msg = NLMSG_DATA(nlh);
+	uint32_t msg_len = nlmsg_len(nlh);
+	uint8_t *tempbuf;
+	int status;
+
+	tempbuf = (uint8_t *)vos_mem_malloc(msg_len);
+	vos_mem_copy(tempbuf, msg, msg_len);
+	status = send_msg_to_cld80211(mcgroup_id, 0, app_id, tempbuf, msg_len);
+	if (status) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"send msg to cld80211 fails for app id %d", app_id);
+		return -EPERM;
+	}
+
+	dev_kfree_skb(skb);
+	vos_mem_free(tempbuf);
+	return 0;
+}
+
+/**
+ * nl_srv_ucast() - wrapper function to do unicast events to user space apps
+ * @skb: the socket buffer to send
+ * @dst_pid: destination process IF
+ * @flag: flags
+ * @app_id: application id
+ * @mcgroup_id: Multicast group ID
+ *
+ * This function is common wrapper to send unicast events to different
+ * user space applications. This internally used broadcast API with multicast
+ * group mcgrp_id. This wrapper serves as a common API in both
+ * new generic netlink infra and legacy implementation.
+ *
+ * return: zero on success, error code otherwise
+ */
+int nl_srv_ucast(struct sk_buff *skb, int dst_pid, int flag,
+					int app_id, int mcgroup_id)
+{
+	struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data;
+	void *msg = NLMSG_DATA(nlh);
+	uint32_t msg_len = nlmsg_len(nlh);
+	uint8_t *tempbuf;
+	int status;
+
+	tempbuf = (uint8_t *)vos_mem_malloc(msg_len);
+	vos_mem_copy(tempbuf, msg, msg_len);
+	status = send_msg_to_cld80211(mcgroup_id, dst_pid, app_id,
+					tempbuf, msg_len);
+	if (status) {
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"send msg to cld80211 fails for app id %d", app_id);
+		return -EPERM;
+	}
+
+	dev_kfree_skb(skb);
+	vos_mem_free(tempbuf);
+	return 0;
+}
+
+#else
 /*
  * Unicast the message to the process in user space identfied
  * by the dst-pid
@@ -371,10 +564,6 @@ int nl_srv_ucast(struct sk_buff *skb, int dst_pid, int flag)
    return err;
 }
 
-/*
- *  Broadcast the message. Broadcast will return an error if
- *  there are no listeners
- */
 int nl_srv_bcast(struct sk_buff *skb)
 {
    int err = 0;
@@ -390,11 +579,11 @@ int nl_srv_bcast(struct sk_buff *skb)
 #endif
    NETLINK_CB(skb).dst_group = WLAN_NLINK_MCAST_GRP_ID; //destination group
 
-   if (nl_srv_sock != NULL) {
+   if (nl_srv_sock != NULL)
        err = netlink_broadcast(nl_srv_sock, skb, 0, WLAN_NLINK_MCAST_GRP_ID, flags);
-   } else {
+   else
        dev_kfree_skb(skb);
-   }
+
    if ((err < 0) && (err != -ESRCH))
    {
       VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
@@ -403,6 +592,8 @@ int nl_srv_bcast(struct sk_buff *skb)
    return err;
 }
 
+#endif
+
 /*
  *  Processes the Netlink socket input queue.
  *  Dequeue skb's from the socket input queue and process
@@ -431,7 +622,7 @@ static void nl_srv_rcv_skb (struct sk_buff *skb)
 
       if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) {
          VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN, "NLINK: Invalid "
-            "Netlink message: skb[%p], len[%d], nlhdr[%p], nlmsg_len[%d]",
+            "Netlink message: skb[%pK], len[%d], nlhdr[%pK], nlmsg_len[%d]",
             skb, skb->len, nlh, nlh->nlmsg_len);
          return;
       }
diff --git a/drivers/staging/qcacld-2.0/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c b/drivers/staging/qcacld-2.0/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
index a96db5833ef..c7b2baf6d1b 100644
--- a/drivers/staging/qcacld-2.0/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
+++ b/drivers/staging/qcacld-2.0/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,6 +40,12 @@
 #include <vos_types.h>
 #include <vos_trace.h>
 #include <wlan_hdd_ftm.h>
+#ifdef CNSS_GENL
+#include <net/cnss_nl.h>
+#else
+
+static struct hdd_context_s *hdd_ctx_handle;
+#endif
 
 #define PTT_SOCK_DEBUG
 #ifdef PTT_SOCK_DEBUG
@@ -48,7 +54,6 @@
 #define PTT_TRACE(level, args...)
 #endif
 // Global variables
-static struct hdd_context_s *pAdapterHandle;
 
 #ifdef PTT_SOCK_DEBUG_VERBOSE
 //Utility function to perform a hex dump
@@ -57,13 +62,53 @@ static void ptt_sock_dump_buf(const unsigned char * pbuf, int cnt)
     int i;
     for (i = 0; i < cnt ; i++) {
         if ((i%16)==0)
-            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,"\n%p:", pbuf);
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,"\n%pK:", pbuf);
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO," %02X", *pbuf);
         pbuf++;
     }
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,"\n");
 }
 #endif
+
+/**
+ * nl_srv_ucast_ptt() - Wrapper function to send ucast msgs to PTT
+ * @skb: sk buffer pointer
+ * @dst_pid: Destination PID
+ * @flag: flags
+ *
+ * Sends the ucast message to PTT with generic nl socket if CNSS_GENL
+ * is enabled. Else, use the legacy netlink socket to send.
+ *
+ * Return: zero on success, error code otherwise
+ */
+static int nl_srv_ucast_ptt(struct sk_buff *skb, int dst_pid, int flag)
+{
+#ifdef CNSS_GENL
+	return nl_srv_ucast(skb, dst_pid, flag, ANI_NL_MSG_PUMAC,
+			CLD80211_MCGRP_DIAG_EVENTS);
+#else
+	return nl_srv_ucast(skb, dst_pid, flag);
+#endif
+}
+
+/**
+ * nl_srv_bcast_ptt() - Wrapper function to send bcast msgs to DIAG mcast group
+ * @skb: sk buffer pointer
+ *
+ * Sends the bcast message to DIAG multicast group with generic nl socket
+ * if CNSS_GENL is enabled. Else, use the legacy netlink socket to send.
+ *
+ * Return: zero on success, error code otherwise
+ */
+static int nl_srv_bcast_ptt(struct sk_buff *skb)
+{
+#ifdef CNSS_GENL
+	return nl_srv_bcast(skb, CLD80211_MCGRP_DIAG_EVENTS, ANI_NL_MSG_PUMAC);
+#else
+	return nl_srv_bcast(skb);
+#endif
+}
+
 //Utility function to send a netlink message to an application in user space
 int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid)
 {
@@ -102,9 +147,9 @@ int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid)
 #endif
 
    if (pid != -1) {
-       err = nl_srv_ucast(skb, pid, MSG_DONTWAIT);
+       err = nl_srv_ucast_ptt(skb, pid, MSG_DONTWAIT);
    } else {
-       err = nl_srv_bcast(skb);
+       err = nl_srv_bcast_ptt(skb);
    }
    if (err) {
        PTT_TRACE(VOS_TRACE_LEVEL_INFO,
@@ -113,6 +158,8 @@ int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid)
    }
    return err;
 }
+
+#ifndef CNSS_GENL
 /*
  * Process tregisteration request and send registration response messages
  * to the PTT Socket App in user space
@@ -128,10 +175,10 @@ static void ptt_sock_proc_reg_req(tAniHdr *wmsg, int radio)
    rspmsg.regReq.type = reg_req->type;
 
    /* Save the pid */
-   pAdapterHandle->ptt_pid = reg_req->pid;
+   hdd_ctx_handle->ptt_pid = reg_req->pid;
    rspmsg.regReq.pid= reg_req->pid;
    rspmsg.wniHdr.type = cpu_to_be16(ANI_MSG_APP_REG_RSP);
-   rspmsg.wniHdr.length = cpu_to_be16(sizeof(rspmsg));
+   rspmsg.wniHdr.length = cpu_to_be16(sizeof(rspmsg.wniHdr));
    if (ptt_sock_send_msg_to_app((tAniHdr *)&rspmsg.wniHdr, radio,
       ANI_NL_MSG_PUMAC, reg_req->pid) < 0)
    {
@@ -139,6 +186,7 @@ static void ptt_sock_proc_reg_req(tAniHdr *wmsg, int radio)
          __func__, reg_req->pid);
    }
 }
+
 /*
  * Process all the messages from the PTT Socket App in user space
  */
@@ -181,12 +229,100 @@ static int ptt_sock_rx_nlink_msg (struct sk_buff * skb)
    }
    return 0;
 }
-int ptt_sock_activate_svc(void *pAdapter)
+#endif
+
+#ifdef CNSS_GENL
+/**
+ * ptt_cmd_handler() - Handler function for PTT commands
+ * @data: Data to be parsed
+ * @data_len: Length of the data received
+ * @ctx: Registered context reference
+ * @pid: Process id of the user space application
+ *
+ * This function handles the command from PTT user space application
+ *
+ * Return: None
+ */
+static void ptt_cmd_handler(const void *data, int data_len, void *ctx, int pid)
 {
-   pAdapterHandle = (struct hdd_context_s*)pAdapter;
-   pAdapterHandle->ptt_pid = INVALID_PID;
+	uint16_t length;
+	ptt_app_reg_req *payload;
+	struct nlattr *tb[CLD80211_ATTR_MAX + 1];
+
+	/*
+	 * audit note: it is ok to pass a NULL policy here since a
+	 * length check on the data is added later already
+	 */
+	if (nla_parse(tb, CLD80211_ATTR_MAX, data, data_len, NULL)) {
+		PTT_TRACE(VOS_TRACE_LEVEL_ERROR, "Invalid ATTR");
+		return;
+	}
+
+	if (!tb[CLD80211_ATTR_DATA]) {
+		PTT_TRACE(VOS_TRACE_LEVEL_ERROR, "attr ATTR_DATA failed");
+		return;
+	}
+
+	if (nla_len(tb[CLD80211_ATTR_DATA]) < sizeof(struct ptt_app_reg_req)) {
+		PTT_TRACE(VOS_TRACE_LEVEL_ERROR, "%s:attr length check fails\n",
+			__func__);
+		return;
+	}
+
+	payload = (ptt_app_reg_req *)(nla_data(tb[CLD80211_ATTR_DATA]));
+	length = be16_to_cpu(payload->wmsg.length);
+	if ((USHRT_MAX - length) < (sizeof(payload->radio) + sizeof(tAniHdr))) {
+		PTT_TRACE(QDF_TRACE_LEVEL_ERROR,
+			"u16 overflow length %d %zu %zu",
+			length,
+			sizeof(payload->radio),
+			sizeof(tAniHdr));
+		return;
+	}
+
+	if (nla_len(tb[CLD80211_ATTR_DATA]) <  (length +
+						sizeof(payload->radio) +
+						sizeof(tAniHdr))) {
+		PTT_TRACE(VOS_TRACE_LEVEL_ERROR, "ATTR_DATA len check failed");
+		return;
+	}
+
+	switch (payload->wmsg.type) {
+	case ANI_MSG_APP_REG_REQ:
+		ptt_sock_send_msg_to_app(&payload->wmsg, payload->radio,
+							ANI_NL_MSG_PUMAC, pid);
+		break;
+	default:
+		PTT_TRACE(VOS_TRACE_LEVEL_ERROR, "Unknown msg type %d",
+							payload->wmsg.type);
+		break;
+	}
+}
+
+/**
+ * ptt_sock_activate_svc() - API to register PTT/PUMAC command handler
+ * @pAdapter: Pointer to adapter
+ *
+ * API to register the PTT/PUMAC command handlers. Argument @pAdapter
+ * is sent for prototype compatibility between new genl and legacy
+ * implementation
+ *
+ * Return: 0
+ */
+int ptt_sock_activate_svc(void *hdd_ctx)
+{
+	register_cld_cmd_cb(ANI_NL_MSG_PUMAC, ptt_cmd_handler, NULL);
+	register_cld_cmd_cb(ANI_NL_MSG_PTT, ptt_cmd_handler, NULL);
+	return 0;
+}
+#else
+int ptt_sock_activate_svc(void *hdd_ctx)
+{
+   hdd_ctx_handle = (struct hdd_context_s *)hdd_ctx;
+   hdd_ctx_handle->ptt_pid = INVALID_PID;
    nl_srv_register(ANI_NL_MSG_PUMAC, ptt_sock_rx_nlink_msg);
    nl_srv_register(ANI_NL_MSG_PTT, ptt_sock_rx_nlink_msg);
    return 0;
 }
+#endif
 #endif // PTT_SOCK_SVC_ENABLE
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/inc/sysDef.h b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/inc/sysDef.h
index 97b5b70d8a6..0b6a1431077 100644
--- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/inc/sysDef.h
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/inc/sysDef.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2013,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -116,15 +116,6 @@
 /// PTT  Message Queue
 # define SYS_NIM_PTT_Q_SIZE   200             // Holds up to 25 messages
 
-/// Semaphore definitions
-// Data Semaphore
-
-# define SYS_DPH_SEM_INITIAL_CNT 0
-
-// Transport Semaphore
-
-# define SYS_BBT_SEM_INITIAL_CNT 0
-
 /// Thread definitions
 // tHAL
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/src/macInitApi.c b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/src/macInitApi.c
index c8c42b55d09..2ad38bc3270 100644
--- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/src/macInitApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/src/macInitApi.c
@@ -124,7 +124,11 @@ tSirRetStatus macStart(tHalHandle hHal, void* pHalMacStartParams)
 tSirRetStatus macStop(tHalHandle hHal, tHalStopType stopType)
 {
     tpAniSirGlobal pMac = (tpAniSirGlobal) hHal;
-    peStop(pMac);
+
+    //In FTM mode,  peStart is not called during driver load.
+    if (pMac->gDriverType != eDRIVER_TYPE_MFG)
+        peStop(pMac);
+
     cfgCleanup( pMac );
     // need to free memory if not called in reset context.
     // in reset context this memory will be freed by HDD.
@@ -261,6 +265,18 @@ tSirRetStatus macClose(tHalHandle hHal)
     if (!pMac)
         return eHAL_STATUS_FAILURE;
 
+    /*
+     * CAC timer will be initiated and started only when SAP starts
+     * on DFS channel and it will be stopped and destroyed immediately
+     * once the radar detected or timedout. So as per design CAC timer
+     * should be destroyed after stop.
+     */
+    if (pMac->sap.SapDfsInfo.is_dfs_cac_timer_running) {
+       vos_timer_stop(&pMac->sap.SapDfsInfo.sap_dfs_cac_timer);
+       pMac->sap.SapDfsInfo.is_dfs_cac_timer_running = 0;
+       vos_timer_destroy(&pMac->sap.SapDfsInfo.sap_dfs_cac_timer);
+    }
+
     peClose(pMac);
     pMac->psOffloadEnabled = FALSE;
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/src/sysEntryFunc.c b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
index 988801b74a9..272aaf6cc4d 100644
--- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -190,8 +190,18 @@ sysBbtProcessMessageCore(tpAniSirGlobal pMac, tpSirMsgQ pMsg, tANI_U32 type,
                        pMac->sys.gSysFrameCount[type][subType]);
             }
 
-            //Post the message to PE Queue
-            ret = (tSirRetStatus) limPostMsgApi(pMac, pMsg);
+            /*
+             * Post the message to PE Queue. Prioritize the
+             * Auth and assoc frames.
+             */
+            if ((subType == SIR_MAC_MGMT_AUTH) ||
+               (subType == SIR_MAC_MGMT_ASSOC_RSP) ||
+               (subType == SIR_MAC_MGMT_REASSOC_RSP) ||
+               (subType == SIR_MAC_MGMT_ASSOC_REQ) ||
+               (subType == SIR_MAC_MGMT_REASSOC_REQ))
+                ret = (tSirRetStatus) lim_post_msg_high_pri(pMac, pMsg);
+            else
+                ret = (tSirRetStatus) limPostMsgApi(pMac, pMsg);
             if (ret != eSIR_SUCCESS)
             {
                 /* Print only one debug failure out of 512 failure messages */
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/dot11f.c b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/dot11f.c
index 2580c43b9be..0d25f085c5e 100644
--- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/dot11f.c
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/dot11f.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -24,18 +24,13 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
-
 /**
   * \file dot11f.c
   *
   * \brief Structures, functions & definitions for
   * working with 802.11 Frames
-  *
-  *
-  *
-  *
   * This file was automatically generated by 'framesc'
-  * Thu Oct  8 17:27:11 2015 from the following file(s):
+  * Thu Dec 28 13:33:15 2017 from the following file(s):
   *
   * dot11f.frms
   *
@@ -84,6 +79,7 @@ typedef struct sIEDefn {
     unsigned char oui[5];
     unsigned char noui;
     tANI_U8   eid;
+    tANI_U8   extn_eid;
     tFRAMES_BOOL  fMandatory;
 } tIEDefn;
 
@@ -239,6 +235,8 @@ static void framesDump(tpAniSirGlobal pCtx, int nSev, tANI_U8 *pBuf, int nBuf)
      framesLog((ctx), (sev), (fmt), (p1), (p2));
 #define FRAMES_LOG3(ctx, sev, fmt, p1, p2, p3) \
      framesLog((ctx), (sev), (fmt), (p1), (p2), (p3));
+#define FRAMES_LOG4(ctx, sev, fmt, p1, p2, p3, p4) \
+     framesLog((ctx), (sev), (fmt), (p1), (p2), (p3), (p4));
 #define FRAMES_DUMP(ctx, sev, p, n) \
      framesDump((ctx), (sev), (p), (n));
 #ifndef FRAMES_SEV_FOR_FRAME
@@ -252,6 +250,7 @@ static void framesDump(tpAniSirGlobal pCtx, int nSev, tANI_U8 *pBuf, int nBuf)
 #   define FRAMES_LOG1(ctx, sev, fmt, p1)
 #   define FRAMES_LOG2(ctx, sev, fmt, p1, p2)
 #   define FRAMES_LOG3(ctx, sev, fmt, p1, p2, p3)
+#   define FRAMES_LOG4(ctx, sev, fmt, p1, p2, p3, p4)
 #   define FRAMES_DUMP(ctx, sev, p, n)
 #   ifndef FRAMES_SEV_FOR_FRAME
 #       define FRAMES_SEV_FOR_FRAME(ctx, sig) FRLOG3
@@ -451,15 +450,22 @@ static const tIEDefn* FindIEDefn(tpAniSirGlobal pCtx,
     (void)pCtx;
 
     pIe = &(IEs[0]);
-    while (0xff != pIe->eid)
+    while (0xff != pIe->eid || pIe->extn_eid)
     {
         if (*pBuf == pIe->eid)
         {
-            if (0 == pIe->noui) return pIe;
-
-            if ( ( nBuf > (tANI_U32)(pIe->noui + 2) ) &&
-                 ( !DOT11F_MEMCMP(pCtx, pBuf + 2, pIe->oui, pIe->noui) ) )
-                return pIe;
+           if (pIe->eid == 0xff) {
+               if ((*(pBuf + 2)) == pIe->extn_eid)
+                   return pIe;
+           } else {
+               if (0 == pIe->noui)
+                   return pIe;
+
+               if ((nBuf > (tANI_U32)(pIe->noui + 2)) &&
+                  (!DOT11F_MEMCMP(pCtx, pBuf + 2, pIe->oui,
+                       pIe->noui)))
+                           return pIe;
+           }
         }
 
         ++pIe;
@@ -476,7 +482,7 @@ static tANI_U32 GetContainerIesLen(tpAniSirGlobal pCtx,
 {
     const tIEDefn *pIe, *pIeFirst;
     tANI_U8 *pBufRemaining = pBuf;
-    tANI_U8 len = 0;
+    tANI_U32 len = 0;
 
     (void)pCtx;
 
@@ -489,7 +495,7 @@ static tANI_U32 GetContainerIesLen(tpAniSirGlobal pCtx,
     len += 2;
     while ( len < nBuf )
     {
-        if( NULL == (pIe =  FindIEDefn(pCtx, pBufRemaining, nBuf + len, IEs)))
+        if( NULL == (pIe =  FindIEDefn(pCtx, pBufRemaining, nBuf - len, IEs)))
              break;
         if( pIe->eid == pIeFirst->eid )
              break;
@@ -497,6 +503,8 @@ static tANI_U32 GetContainerIesLen(tpAniSirGlobal pCtx,
         pBufRemaining += *(pBufRemaining + 1) + 2;
     }
 
+    if ((len > 0xFF) || (len > nBuf))
+        return DOT11F_INTERNAL_ERROR;
     *pnConsumed = len;
     return DOT11F_PARSE_SUCCESS;
 
@@ -1628,6 +1636,20 @@ tANI_U32 dot11fUnpackIeIGTK(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, t
 #define SigIeIGTK ( 0x0003 )
 
 
+tANI_U32 dot11fUnpackIeMccChanInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEMccChanInfo *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    pDst->channel = *pBuf;
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIeMccChanInfo. */
+
+#define SigIeMccChanInfo ( 0x0004 )
+
+
 tANI_U32 dot11fUnpackIeR0KH_ID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIER0KH_ID *pDst)
 {
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
@@ -1645,7 +1667,7 @@ tANI_U32 dot11fUnpackIeR0KH_ID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen
     return status;
 } /* End dot11fUnpackIeR0KH_ID. */
 
-#define SigIeR0KH_ID ( 0x0004 )
+#define SigIeR0KH_ID ( 0x0005 )
 
 
 tANI_U32 dot11fUnpackIeR1KH_ID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIER1KH_ID *pDst)
@@ -1659,7 +1681,24 @@ tANI_U32 dot11fUnpackIeR1KH_ID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen
     return status;
 } /* End dot11fUnpackIeR1KH_ID. */
 
-#define SigIeR1KH_ID ( 0x0005 )
+#define SigIeR1KH_ID ( 0x0006 )
+
+
+tANI_U32 dot11fUnpackIeSub20Info(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESub20Info *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    pDst->capability = *pBuf;
+    pBuf += 1;
+    ielen -= (tANI_U8)1;
+    pDst->csa_chanwidth = *pBuf;
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIeSub20Info. */
+
+#define SigIeSub20Info ( 0x0007 )
 
 
 tANI_U32 dot11fUnpackIeTSFInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETSFInfo *pDst)
@@ -1676,7 +1715,7 @@ tANI_U32 dot11fUnpackIeTSFInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen
     return status;
 } /* End dot11fUnpackIeTSFInfo. */
 
-#define SigIeTSFInfo ( 0x0006 )
+#define SigIeTSFInfo ( 0x0008 )
 
 
 tANI_U32 dot11fUnpackIeAPChannelReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEAPChannelReport *pDst)
@@ -1699,7 +1738,7 @@ tANI_U32 dot11fUnpackIeAPChannelReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_
     return status;
 } /* End dot11fUnpackIeAPChannelReport. */
 
-#define SigIeAPChannelReport ( 0x0007 )
+#define SigIeAPChannelReport ( 0x0009 )
 
 
 tANI_U32 dot11fUnpackIeBcnReportingDetail(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEBcnReportingDetail *pDst)
@@ -1713,7 +1752,7 @@ tANI_U32 dot11fUnpackIeBcnReportingDetail(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tA
     return status;
 } /* End dot11fUnpackIeBcnReportingDetail. */
 
-#define SigIeBcnReportingDetail ( 0x0008 )
+#define SigIeBcnReportingDetail ( 0x000a )
 
 
 tANI_U32 dot11fUnpackIeBeaconReportFrmBody(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEBeaconReportFrmBody *pDst)
@@ -1733,7 +1772,7 @@ tANI_U32 dot11fUnpackIeBeaconReportFrmBody(tpAniSirGlobal pCtx, tANI_U8 *pBuf, t
     return status;
 } /* End dot11fUnpackIeBeaconReportFrmBody. */
 
-#define SigIeBeaconReportFrmBody ( 0x0009 )
+#define SigIeBeaconReportFrmBody ( 0x000b )
 
 
 tANI_U32 dot11fUnpackIeBeaconReporting(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEBeaconReporting *pDst)
@@ -1750,7 +1789,7 @@ tANI_U32 dot11fUnpackIeBeaconReporting(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_
     return status;
 } /* End dot11fUnpackIeBeaconReporting. */
 
-#define SigIeBeaconReporting ( 0x000a )
+#define SigIeBeaconReporting ( 0x000c )
 
 
 tANI_U32 dot11fUnpackIeMeasurementPilot(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEMeasurementPilot *pDst)
@@ -1768,7 +1807,7 @@ tANI_U32 dot11fUnpackIeMeasurementPilot(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI
     return status;
 } /* End dot11fUnpackIeMeasurementPilot. */
 
-#define SigIeMeasurementPilot ( 0x000b )
+#define SigIeMeasurementPilot ( 0x000d )
 
 
 tANI_U32 dot11fUnpackIeMultiBssid(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEMultiBssid *pDst)
@@ -1786,7 +1825,7 @@ tANI_U32 dot11fUnpackIeMultiBssid(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ie
     return status;
 } /* End dot11fUnpackIeMultiBssid. */
 
-#define SigIeMultiBssid ( 0x000c )
+#define SigIeMultiBssid ( 0x000e )
 
 
 tANI_U32 dot11fUnpackIeRICData(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERICData *pDst)
@@ -1806,7 +1845,7 @@ tANI_U32 dot11fUnpackIeRICData(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen
     return status;
 } /* End dot11fUnpackIeRICData. */
 
-#define SigIeRICData ( 0x000d )
+#define SigIeRICData ( 0x000f )
 
 
 tANI_U32 dot11fUnpackIeRICDescriptor(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERICDescriptor *pDst)
@@ -1824,7 +1863,7 @@ tANI_U32 dot11fUnpackIeRICDescriptor(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeRICDescriptor. */
 
-#define SigIeRICDescriptor ( 0x000e )
+#define SigIeRICDescriptor ( 0x0010 )
 
 
 tANI_U32 dot11fUnpackIeRRMEnabledCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERRMEnabledCap *pDst)
@@ -1886,7 +1925,7 @@ tANI_U32 dot11fUnpackIeRRMEnabledCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeRRMEnabledCap. */
 
-#define SigIeRRMEnabledCap ( 0x000f )
+#define SigIeRRMEnabledCap ( 0x0011 )
 
 
 tANI_U32 dot11fUnpackIeRequestedInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERequestedInfo *pDst)
@@ -1901,7 +1940,7 @@ tANI_U32 dot11fUnpackIeRequestedInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeRequestedInfo. */
 
-#define SigIeRequestedInfo ( 0x0010 )
+#define SigIeRequestedInfo ( 0x0012 )
 
 
 tANI_U32 dot11fUnpackIeSSID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESSID *pDst)
@@ -1925,7 +1964,7 @@ tANI_U32 dot11fUnpackIeSSID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, t
     return status;
 } /* End dot11fUnpackIeSSID. */
 
-#define SigIeSSID ( 0x0011 )
+#define SigIeSSID ( 0x0013 )
 
 
 tANI_U32 dot11fUnpackIeSchedule(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESchedule *pDst)
@@ -1956,7 +1995,7 @@ tANI_U32 dot11fUnpackIeSchedule(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iele
     return status;
 } /* End dot11fUnpackIeSchedule. */
 
-#define SigIeSchedule ( 0x0012 )
+#define SigIeSchedule ( 0x0014 )
 
 
 tANI_U32 dot11fUnpackIeTCLAS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETCLAS *pDst)
@@ -2045,10 +2084,10 @@ tANI_U32 dot11fUnpackIeTCLAS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     return status;
 } /* End dot11fUnpackIeTCLAS. */
 
-#define SigIeTCLAS ( 0x0013 )
+#define SigIeTCLAS ( 0x0015 )
 
 
-#define SigIeTCLASSPROC ( 0x0014 )
+#define SigIeTCLASSPROC ( 0x0016 )
 
 
 tANI_U32 dot11fUnpackIeTSDelay(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETSDelay *pDst)
@@ -2062,7 +2101,7 @@ tANI_U32 dot11fUnpackIeTSDelay(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen
     return status;
 } /* End dot11fUnpackIeTSDelay. */
 
-#define SigIeTSDelay ( 0x0015 )
+#define SigIeTSDelay ( 0x0017 )
 
 
 tANI_U32 dot11fUnpackIeTSPEC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETSPEC *pDst)
@@ -2139,7 +2178,7 @@ tANI_U32 dot11fUnpackIeTSPEC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     return status;
 } /* End dot11fUnpackIeTSPEC. */
 
-#define SigIeTSPEC ( 0x0016 )
+#define SigIeTSPEC ( 0x0018 )
 
 
 tANI_U32 dot11fUnpackIeVHTCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEVHTCaps *pDst)
@@ -2192,7 +2231,7 @@ tANI_U32 dot11fUnpackIeVHTCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen
     return status;
 } /* End dot11fUnpackIeVHTCaps. */
 
-#define SigIeVHTCaps ( 0x0017 )
+#define SigIeVHTCaps ( 0x0019 )
 
 
 tANI_U32 dot11fUnpackIeVHTOperation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEVHTOperation *pDst)
@@ -2215,7 +2254,7 @@ tANI_U32 dot11fUnpackIeVHTOperation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeVHTOperation. */
 
-#define SigIeVHTOperation ( 0x0018 )
+#define SigIeVHTOperation ( 0x001a )
 
 
 tANI_U32 dot11fUnpackIeWMMSchedule(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMSchedule *pDst)
@@ -2254,7 +2293,7 @@ tANI_U32 dot11fUnpackIeWMMSchedule(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeWMMSchedule. */
 
-#define SigIeWMMSchedule ( 0x0019 )
+#define SigIeWMMSchedule ( 0x001b )
 
 
 tANI_U32 dot11fUnpackIeWMMTCLAS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMTCLAS *pDst)
@@ -2351,7 +2390,7 @@ tANI_U32 dot11fUnpackIeWMMTCLAS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iele
     return status;
 } /* End dot11fUnpackIeWMMTCLAS. */
 
-#define SigIeWMMTCLAS ( 0x001a )
+#define SigIeWMMTCLAS ( 0x001c )
 
 
 tANI_U32 dot11fUnpackIeWMMTCLASPROC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMTCLASPROC *pDst)
@@ -2373,7 +2412,7 @@ tANI_U32 dot11fUnpackIeWMMTCLASPROC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeWMMTCLASPROC. */
 
-#define SigIeWMMTCLASPROC ( 0x001b )
+#define SigIeWMMTCLASPROC ( 0x001d )
 
 
 tANI_U32 dot11fUnpackIeWMMTSDelay(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMTSDelay *pDst)
@@ -2395,7 +2434,7 @@ tANI_U32 dot11fUnpackIeWMMTSDelay(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ie
     return status;
 } /* End dot11fUnpackIeWMMTSDelay. */
 
-#define SigIeWMMTSDelay ( 0x001c )
+#define SigIeWMMTSDelay ( 0x001e )
 
 
 tANI_U32 dot11fUnpackIeWMMTSPEC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMTSPEC *pDst)
@@ -2480,7 +2519,7 @@ tANI_U32 dot11fUnpackIeWMMTSPEC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iele
     return status;
 } /* End dot11fUnpackIeWMMTSPEC. */
 
-#define SigIeWMMTSPEC ( 0x001d )
+#define SigIeWMMTSPEC ( 0x001f )
 
 
 tANI_U32 dot11fUnpackIeWiderBWChanSwitchAnn(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWiderBWChanSwitchAnn *pDst)
@@ -2500,7 +2539,27 @@ tANI_U32 dot11fUnpackIeWiderBWChanSwitchAnn(tpAniSirGlobal pCtx, tANI_U8 *pBuf,
     return status;
 } /* End dot11fUnpackIeWiderBWChanSwitchAnn. */
 
-#define SigIeWiderBWChanSwitchAnn ( 0x001e )
+#define SigIeWiderBWChanSwitchAnn ( 0x0020 )
+
+
+tANI_U32 dot11fUnpackIevht_transmit_power_env(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEvht_transmit_power_env *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    pDst->num_bytes = (tANI_U8)( ielen );
+    if (ielen > 5){
+        pDst->present = 0;
+        return DOT11F_SKIPPED_BAD_IE;
+    }
+
+    DOT11F_MEMCPY(pCtx, pDst->bytes, pBuf, ( ielen ) );
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIevht_transmit_power_env. */
+
+#define SigIevht_transmit_power_env ( 0x0021 )
 
 
 tANI_U32 dot11fUnpackIeAID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEAID *pDst)
@@ -2514,7 +2573,7 @@ tANI_U32 dot11fUnpackIeAID(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tD
     return status;
 } /* End dot11fUnpackIeAID. */
 
-#define SigIeAID ( 0x001f )
+#define SigIeAID ( 0x0022 )
 
 
 tANI_U32 dot11fUnpackIeCFParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECFParams *pDst)
@@ -2537,7 +2596,7 @@ tANI_U32 dot11fUnpackIeCFParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iele
     return status;
 } /* End dot11fUnpackIeCFParams. */
 
-#define SigIeCFParams ( 0x0020 )
+#define SigIeCFParams ( 0x0023 )
 
 
 tANI_U32 dot11fUnpackIeChallengeText(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEChallengeText *pDst)
@@ -2557,7 +2616,7 @@ tANI_U32 dot11fUnpackIeChallengeText(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeChallengeText. */
 
-#define SigIeChallengeText ( 0x0021 )
+#define SigIeChallengeText ( 0x0024 )
 
 
 tANI_U32 dot11fUnpackIeChanSwitchAnn(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEChanSwitchAnn *pDst)
@@ -2577,7 +2636,7 @@ tANI_U32 dot11fUnpackIeChanSwitchAnn(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeChanSwitchAnn. */
 
-#define SigIeChanSwitchAnn ( 0x0022 )
+#define SigIeChanSwitchAnn ( 0x0025 )
 
 
     static const tFFDefn FFS_ChannelSwitchWrapper[ ] = {
@@ -2585,7 +2644,8 @@ tANI_U32 dot11fUnpackIeChanSwitchAnn(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     };
 
     static const tIEDefn IES_ChannelSwitchWrapper[ ] = {
-        {offsetof(tDot11fIEChannelSwitchWrapper, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, },
+        {offsetof(tDot11fIEChannelSwitchWrapper, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, 0, },
+        {offsetof(tDot11fIEChannelSwitchWrapper, vht_transmit_power_env), offsetof(tDot11fIEvht_transmit_power_env, present), 0, "vht_transmit_power_env" , 0, 4, 7, SigIevht_transmit_power_env, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHT_TRANSMIT_POWER_ENV, 0, 0, },
         {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },
     };
 
@@ -2606,7 +2666,7 @@ tANI_U32 dot11fUnpackIeChannelSwitchWrapper(tpAniSirGlobal pCtx, tANI_U8 *pBuf,
     return status;
 } /* End dot11fUnpackIeChannelSwitchWrapper. */
 
-#define SigIeChannelSwitchWrapper ( 0x0023 )
+#define SigIeChannelSwitchWrapper ( 0x0026 )
 
 
 tANI_U32 dot11fUnpackIeCountry(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIECountry *pDst)
@@ -2637,10 +2697,10 @@ tANI_U32 dot11fUnpackIeCountry(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen
     return status;
 } /* End dot11fUnpackIeCountry. */
 
-#define SigIeCountry ( 0x0024 )
+#define SigIeCountry ( 0x0027 )
 
 
-#define SigIeDSParams ( 0x0025 )
+#define SigIeDSParams ( 0x0028 )
 
 
 tANI_U32 dot11fUnpackIeEDCAParamSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEEDCAParamSet *pDst)
@@ -2725,7 +2785,7 @@ tANI_U32 dot11fUnpackIeEDCAParamSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeEDCAParamSet. */
 
-#define SigIeEDCAParamSet ( 0x0026 )
+#define SigIeEDCAParamSet ( 0x0029 )
 
 
 tANI_U32 dot11fUnpackIeERPInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEERPInfo *pDst)
@@ -2744,7 +2804,7 @@ tANI_U32 dot11fUnpackIeERPInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen
     return status;
 } /* End dot11fUnpackIeERPInfo. */
 
-#define SigIeERPInfo ( 0x0027 )
+#define SigIeERPInfo ( 0x002a )
 
 
 tANI_U32 dot11fUnpackIeESECckmOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEESECckmOpaque *pDst)
@@ -2764,7 +2824,7 @@ tANI_U32 dot11fUnpackIeESECckmOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeESECckmOpaque. */
 
-#define SigIeESECckmOpaque ( 0x0028 )
+#define SigIeESECckmOpaque ( 0x002b )
 
 
 tANI_U32 dot11fUnpackIeESERadMgmtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEESERadMgmtCap *pDst)
@@ -2784,7 +2844,7 @@ tANI_U32 dot11fUnpackIeESERadMgmtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeESERadMgmtCap. */
 
-#define SigIeESERadMgmtCap ( 0x0029 )
+#define SigIeESERadMgmtCap ( 0x002c )
 
 
 tANI_U32 dot11fUnpackIeESETrafStrmMet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEESETrafStrmMet *pDst)
@@ -2804,7 +2864,7 @@ tANI_U32 dot11fUnpackIeESETrafStrmMet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U
     return status;
 } /* End dot11fUnpackIeESETrafStrmMet. */
 
-#define SigIeESETrafStrmMet ( 0x002a )
+#define SigIeESETrafStrmMet ( 0x002d )
 
 
 tANI_U32 dot11fUnpackIeESETrafStrmRateSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEESETrafStrmRateSet *pDst)
@@ -2827,7 +2887,7 @@ tANI_U32 dot11fUnpackIeESETrafStrmRateSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tA
     return status;
 } /* End dot11fUnpackIeESETrafStrmRateSet. */
 
-#define SigIeESETrafStrmRateSet ( 0x002b )
+#define SigIeESETrafStrmRateSet ( 0x002e )
 
 
 tANI_U32 dot11fUnpackIeESETxmitPower(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEESETxmitPower *pDst)
@@ -2844,7 +2904,7 @@ tANI_U32 dot11fUnpackIeESETxmitPower(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeESETxmitPower. */
 
-#define SigIeESETxmitPower ( 0x002c )
+#define SigIeESETxmitPower ( 0x002f )
 
 
 tANI_U32 dot11fUnpackIeESEVersion(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEESEVersion *pDst)
@@ -2858,7 +2918,7 @@ tANI_U32 dot11fUnpackIeESEVersion(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ie
     return status;
 } /* End dot11fUnpackIeESEVersion. */
 
-#define SigIeESEVersion ( 0x002d )
+#define SigIeESEVersion ( 0x0030 )
 
 
 tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEExtCap *pDst)
@@ -2883,7 +2943,7 @@ endUnpackIeExtCap:
     return status;
 } /* End dot11fUnpackIeExtCap. */
 
-#define SigIeExtCap ( 0x002e )
+#define SigIeExtCap ( 0x0031 )
 
 
 tANI_U32 dot11fUnpackIeExtSuppRates(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEExtSuppRates *pDst)
@@ -2911,7 +2971,7 @@ tANI_U32 dot11fUnpackIeExtSuppRates(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeExtSuppRates. */
 
-#define SigIeExtSuppRates ( 0x002f )
+#define SigIeExtSuppRates ( 0x0032 )
 
 
 tANI_U32 dot11fUnpackIeFHParamSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEFHParamSet *pDst)
@@ -2934,7 +2994,7 @@ tANI_U32 dot11fUnpackIeFHParamSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ie
     return status;
 } /* End dot11fUnpackIeFHParamSet. */
 
-#define SigIeFHParamSet ( 0x0030 )
+#define SigIeFHParamSet ( 0x0033 )
 
 
 tANI_U32 dot11fUnpackIeFHParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEFHParams *pDst)
@@ -2951,7 +3011,7 @@ tANI_U32 dot11fUnpackIeFHParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iele
     return status;
 } /* End dot11fUnpackIeFHParams. */
 
-#define SigIeFHParams ( 0x0031 )
+#define SigIeFHParams ( 0x0034 )
 
 
 tANI_U32 dot11fUnpackIeFHPattTable(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEFHPattTable *pDst)
@@ -2983,7 +3043,7 @@ tANI_U32 dot11fUnpackIeFHPattTable(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeFHPattTable. */
 
-#define SigIeFHPattTable ( 0x0032 )
+#define SigIeFHPattTable ( 0x0035 )
 
 
     static const tFFDefn FFS_FTInfo[ ] = {
@@ -2991,10 +3051,10 @@ tANI_U32 dot11fUnpackIeFHPattTable(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     };
 
     static const tIEDefn IES_FTInfo[ ] = {
-        {offsetof(tDot11fIEFTInfo, R1KH_ID), offsetof(tDot11fIER1KH_ID, present), 0, "R1KH_ID" , 0, 8, 8, SigIeR1KH_ID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_R1KH_ID, 0, },
-        {offsetof(tDot11fIEFTInfo, GTK), offsetof(tDot11fIEGTK, present), 0, "GTK" , 0, 18, 45, SigIeGTK, {0, 0, 0, 0, 0}, 0, DOT11F_EID_GTK, 0, },
-        {offsetof(tDot11fIEFTInfo, R0KH_ID), offsetof(tDot11fIER0KH_ID, present), 0, "R0KH_ID" , 0, 3, 50, SigIeR0KH_ID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_R0KH_ID, 0, },
-        {offsetof(tDot11fIEFTInfo, IGTK), offsetof(tDot11fIEIGTK, present), 0, "IGTK" , 0, 35, 35, SigIeIGTK, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IGTK, 0, },
+        {offsetof(tDot11fIEFTInfo, R1KH_ID), offsetof(tDot11fIER1KH_ID, present), 0, "R1KH_ID" , 0, 8, 8, SigIeR1KH_ID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_R1KH_ID, 0, 0, },
+        {offsetof(tDot11fIEFTInfo, GTK), offsetof(tDot11fIEGTK, present), 0, "GTK" , 0, 18, 45, SigIeGTK, {0, 0, 0, 0, 0}, 0, DOT11F_EID_GTK, 0, 0, },
+        {offsetof(tDot11fIEFTInfo, R0KH_ID), offsetof(tDot11fIER0KH_ID, present), 0, "R0KH_ID" , 0, 3, 50, SigIeR0KH_ID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_R0KH_ID, 0, 0, },
+        {offsetof(tDot11fIEFTInfo, IGTK), offsetof(tDot11fIEIGTK, present), 0, "IGTK" , 0, 35, 35, SigIeIGTK, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IGTK, 0, 0, },
         {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },
     };
 
@@ -3030,7 +3090,7 @@ tANI_U32 dot11fUnpackIeFTInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     return status;
 } /* End dot11fUnpackIeFTInfo. */
 
-#define SigIeFTInfo ( 0x0033 )
+#define SigIeFTInfo ( 0x0036 )
 
 
 tANI_U32 dot11fUnpackIeHT2040BSSCoexistence(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEHT2040BSSCoexistence *pDst)
@@ -3051,7 +3111,7 @@ tANI_U32 dot11fUnpackIeHT2040BSSCoexistence(tpAniSirGlobal pCtx, tANI_U8 *pBuf,
     return status;
 } /* End dot11fUnpackIeHT2040BSSCoexistence. */
 
-#define SigIeHT2040BSSCoexistence ( 0x0034 )
+#define SigIeHT2040BSSCoexistence ( 0x0037 )
 
 
 tANI_U32 dot11fUnpackIeHT2040BSSIntolerantReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEHT2040BSSIntolerantReport *pDst)
@@ -3074,7 +3134,7 @@ tANI_U32 dot11fUnpackIeHT2040BSSIntolerantReport(tpAniSirGlobal pCtx, tANI_U8 *p
     return status;
 } /* End dot11fUnpackIeHT2040BSSIntolerantReport. */
 
-#define SigIeHT2040BSSIntolerantReport ( 0x0035 )
+#define SigIeHT2040BSSIntolerantReport ( 0x0038 )
 
 
 tANI_U32 dot11fUnpackIeHTCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEHTCaps *pDst)
@@ -3163,7 +3223,7 @@ tANI_U32 dot11fUnpackIeHTCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     return status;
 } /* End dot11fUnpackIeHTCaps. */
 
-#define SigIeHTCaps ( 0x0036 )
+#define SigIeHTCaps ( 0x0039 )
 
 
 tANI_U32 dot11fUnpackIeHTInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEHTInfo *pDst)
@@ -3218,7 +3278,7 @@ tANI_U32 dot11fUnpackIeHTInfo(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     return status;
 } /* End dot11fUnpackIeHTInfo. */
 
-#define SigIeHTInfo ( 0x0037 )
+#define SigIeHTInfo ( 0x003a )
 
 
 tANI_U32 dot11fUnpackIeIBSSParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEIBSSParams *pDst)
@@ -3232,7 +3292,7 @@ tANI_U32 dot11fUnpackIeIBSSParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ie
     return status;
 } /* End dot11fUnpackIeIBSSParams. */
 
-#define SigIeIBSSParams ( 0x0038 )
+#define SigIeIBSSParams ( 0x003b )
 
 
 tANI_U32 dot11fUnpackIeLinkIdentifier(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIELinkIdentifier *pDst)
@@ -3252,7 +3312,7 @@ tANI_U32 dot11fUnpackIeLinkIdentifier(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U
     return status;
 } /* End dot11fUnpackIeLinkIdentifier. */
 
-#define SigIeLinkIdentifier ( 0x0039 )
+#define SigIeLinkIdentifier ( 0x003c )
 
 
 static const tFFDefn FFS_reportBeacon[ ] = {
@@ -3260,7 +3320,7 @@ static const tFFDefn FFS_reportBeacon[ ] = {
 };
 
 static const tIEDefn IES_reportBeacon[ ] = {
-        {offsetof(tDot11fIEMeasurementReport, report.Beacon.BeaconReportFrmBody), offsetof(tDot11fIEBeaconReportFrmBody, present), 0, "BeaconReportFrmBody" , 0, 2, 226, SigIeBeaconReportFrmBody, {0, 0, 0, 0, 0}, 0, DOT11F_EID_BEACONREPORTFRMBODY, 0, },
+        {offsetof(tDot11fIEMeasurementReport, report.Beacon.BeaconReportFrmBody), offsetof(tDot11fIEBeaconReportFrmBody, present), 0, "BeaconReportFrmBody" , 0, 2, 226, SigIeBeaconReportFrmBody, {0, 0, 0, 0, 0}, 0, DOT11F_EID_BEACONREPORTFRMBODY, 0, 0, },
 {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },
 };
 
@@ -3410,7 +3470,7 @@ tANI_U32 dot11fUnpackIeMeasurementReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tAN
     return status;
 } /* End dot11fUnpackIeMeasurementReport. */
 
-#define SigIeMeasurementReport ( 0x003a )
+#define SigIeMeasurementReport ( 0x003d )
 
 
 static const tFFDefn FFS_measurement_requestBeacon[ ] = {
@@ -3418,11 +3478,11 @@ static const tFFDefn FFS_measurement_requestBeacon[ ] = {
 };
 
 static const tIEDefn IES_measurement_requestBeacon[ ] = {
-        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, },
-        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.BeaconReporting), offsetof(tDot11fIEBeaconReporting, present), 0, "BeaconReporting" , 0, 4, 4, SigIeBeaconReporting, {0, 0, 0, 0, 0}, 0, DOT11F_EID_BEACONREPORTING, 0, },
-        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.BcnReportingDetail), offsetof(tDot11fIEBcnReportingDetail, present), 0, "BcnReportingDetail" , 0, 3, 3, SigIeBcnReportingDetail, {0, 0, 0, 0, 0}, 0, DOT11F_EID_BCNREPORTINGDETAIL, 0, },
-        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.RequestedInfo), offsetof(tDot11fIERequestedInfo, present), 0, "RequestedInfo" , 0, 2, 257, SigIeRequestedInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_REQUESTEDINFO, 0, },
-        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.APChannelReport), offsetof(tDot11fIEAPChannelReport, present), offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.num_APChannelReport), "APChannelReport" , 2, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, },
+        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, 0, },
+        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.BeaconReporting), offsetof(tDot11fIEBeaconReporting, present), 0, "BeaconReporting" , 0, 4, 4, SigIeBeaconReporting, {0, 0, 0, 0, 0}, 0, DOT11F_EID_BEACONREPORTING, 0, 0, },
+        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.BcnReportingDetail), offsetof(tDot11fIEBcnReportingDetail, present), 0, "BcnReportingDetail" , 0, 3, 3, SigIeBcnReportingDetail, {0, 0, 0, 0, 0}, 0, DOT11F_EID_BCNREPORTINGDETAIL, 0, 0, },
+        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.RequestedInfo), offsetof(tDot11fIERequestedInfo, present), 0, "RequestedInfo" , 0, 2, 257, SigIeRequestedInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_REQUESTEDINFO, 0, 0, },
+        {offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.APChannelReport), offsetof(tDot11fIEAPChannelReport, present), offsetof(tDot11fIEMeasurementRequest, measurement_request.Beacon.num_APChannelReport), "APChannelReport" , 2, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, 0, },
 {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },
 };
 
@@ -3515,7 +3575,7 @@ tANI_U32 dot11fUnpackIeMeasurementRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tA
     return status;
 } /* End dot11fUnpackIeMeasurementRequest. */
 
-#define SigIeMeasurementRequest ( 0x003b )
+#define SigIeMeasurementRequest ( 0x003e )
 
 
 tANI_U32 dot11fUnpackIeMobilityDomain(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEMobilityDomain *pDst)
@@ -3536,7 +3596,7 @@ tANI_U32 dot11fUnpackIeMobilityDomain(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U
     return status;
 } /* End dot11fUnpackIeMobilityDomain. */
 
-#define SigIeMobilityDomain ( 0x003c )
+#define SigIeMobilityDomain ( 0x003f )
 
 
     static const tFFDefn FFS_NeighborReport[ ] = {
@@ -3544,11 +3604,11 @@ tANI_U32 dot11fUnpackIeMobilityDomain(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U
     };
 
     static const tIEDefn IES_NeighborReport[ ] = {
-        {offsetof(tDot11fIENeighborReport, TSFInfo), offsetof(tDot11fIETSFInfo, present), 0, "TSFInfo" , 0, 6, 6, SigIeTSFInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSFINFO, 0, },
-        {offsetof(tDot11fIENeighborReport, CondensedCountryStr), offsetof(tDot11fIECondensedCountryStr, present), 0, "CondensedCountryStr" , 0, 4, 4, SigIeCondensedCountryStr, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CONDENSEDCOUNTRYSTR, 0, },
-        {offsetof(tDot11fIENeighborReport, MeasurementPilot), offsetof(tDot11fIEMeasurementPilot, present), 0, "MeasurementPilot" , 0, 3, 258, SigIeMeasurementPilot, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTPILOT, 0, },
-        {offsetof(tDot11fIENeighborReport, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
-        {offsetof(tDot11fIENeighborReport, MultiBssid), offsetof(tDot11fIEMultiBssid, present), 0, "MultiBssid" , 0, 3, 258, SigIeMultiBssid, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MULTIBSSID, 0, },
+        {offsetof(tDot11fIENeighborReport, TSFInfo), offsetof(tDot11fIETSFInfo, present), 0, "TSFInfo" , 0, 6, 6, SigIeTSFInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSFINFO, 0, 0, },
+        {offsetof(tDot11fIENeighborReport, CondensedCountryStr), offsetof(tDot11fIECondensedCountryStr, present), 0, "CondensedCountryStr" , 0, 4, 4, SigIeCondensedCountryStr, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CONDENSEDCOUNTRYSTR, 0, 0, },
+        {offsetof(tDot11fIENeighborReport, MeasurementPilot), offsetof(tDot11fIEMeasurementPilot, present), 0, "MeasurementPilot" , 0, 3, 258, SigIeMeasurementPilot, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTPILOT, 0, 0, },
+        {offsetof(tDot11fIENeighborReport, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, 0, },
+        {offsetof(tDot11fIENeighborReport, MultiBssid), offsetof(tDot11fIEMultiBssid, present), 0, "MultiBssid" , 0, 3, 258, SigIeMultiBssid, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MULTIBSSID, 0, 0, },
         {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },
     };
 
@@ -3603,7 +3663,7 @@ tANI_U32 dot11fUnpackIeNeighborReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U
     return status;
 } /* End dot11fUnpackIeNeighborReport. */
 
-#define SigIeNeighborReport ( 0x003d )
+#define SigIeNeighborReport ( 0x0040 )
 
 
 tANI_U32 dot11fUnpackIeOBSSScanParameters(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEOBSSScanParameters *pDst)
@@ -3635,7 +3695,7 @@ tANI_U32 dot11fUnpackIeOBSSScanParameters(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tA
     return status;
 } /* End dot11fUnpackIeOBSSScanParameters. */
 
-#define SigIeOBSSScanParameters ( 0x003e )
+#define SigIeOBSSScanParameters ( 0x0041 )
 
 
 tANI_U32 dot11fUnpackIeOperatingMode(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEOperatingMode *pDst)
@@ -3654,7 +3714,7 @@ tANI_U32 dot11fUnpackIeOperatingMode(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeOperatingMode. */
 
-#define SigIeOperatingMode ( 0x003f )
+#define SigIeOperatingMode ( 0x0042 )
 
 
     static const tTLVDefn TLVS_P2PAssocReq[ ] = {
@@ -3673,7 +3733,7 @@ tANI_U32 dot11fUnpackIeP2PAssocReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PAssocReq. */
 
-#define SigIeP2PAssocReq ( 0x0040 )
+#define SigIeP2PAssocReq ( 0x0043 )
 
 
     static const tTLVDefn TLVS_P2PAssocRes[ ] = {
@@ -3691,7 +3751,7 @@ tANI_U32 dot11fUnpackIeP2PAssocRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PAssocRes. */
 
-#define SigIeP2PAssocRes ( 0x0041 )
+#define SigIeP2PAssocRes ( 0x0044 )
 
 
     static const tTLVDefn TLVS_P2PBeacon[ ] = {
@@ -3710,7 +3770,7 @@ tANI_U32 dot11fUnpackIeP2PBeacon(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeP2PBeacon. */
 
-#define SigIeP2PBeacon ( 0x0042 )
+#define SigIeP2PBeacon ( 0x0045 )
 
 
     static const tTLVDefn TLVS_P2PBeaconProbeRes[ ] = {
@@ -3732,7 +3792,7 @@ tANI_U32 dot11fUnpackIeP2PBeaconProbeRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tAN
     return status;
 } /* End dot11fUnpackIeP2PBeaconProbeRes. */
 
-#define SigIeP2PBeaconProbeRes ( 0x0043 )
+#define SigIeP2PBeaconProbeRes ( 0x0046 )
 
 
     static const tTLVDefn TLVS_P2PDeAuth[ ] = {
@@ -3749,7 +3809,7 @@ tANI_U32 dot11fUnpackIeP2PDeAuth(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeP2PDeAuth. */
 
-#define SigIeP2PDeAuth ( 0x0044 )
+#define SigIeP2PDeAuth ( 0x0047 )
 
 
     static const tTLVDefn TLVS_P2PDeviceDiscoverabilityReq[ ] = {
@@ -3767,7 +3827,7 @@ tANI_U32 dot11fUnpackIeP2PDeviceDiscoverabilityReq(tpAniSirGlobal pCtx, tANI_U8
     return status;
 } /* End dot11fUnpackIeP2PDeviceDiscoverabilityReq. */
 
-#define SigIeP2PDeviceDiscoverabilityReq ( 0x0045 )
+#define SigIeP2PDeviceDiscoverabilityReq ( 0x0048 )
 
 
     static const tTLVDefn TLVS_P2PDeviceDiscoverabilityRes[ ] = {
@@ -3784,7 +3844,7 @@ tANI_U32 dot11fUnpackIeP2PDeviceDiscoverabilityRes(tpAniSirGlobal pCtx, tANI_U8
     return status;
 } /* End dot11fUnpackIeP2PDeviceDiscoverabilityRes. */
 
-#define SigIeP2PDeviceDiscoverabilityRes ( 0x0046 )
+#define SigIeP2PDeviceDiscoverabilityRes ( 0x0049 )
 
 
     static const tTLVDefn TLVS_P2PDisAssoc[ ] = {
@@ -3801,7 +3861,7 @@ tANI_U32 dot11fUnpackIeP2PDisAssoc(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PDisAssoc. */
 
-#define SigIeP2PDisAssoc ( 0x0047 )
+#define SigIeP2PDisAssoc ( 0x004a )
 
 
     static const tTLVDefn TLVS_P2PGONegCnf[ ] = {
@@ -3822,7 +3882,7 @@ tANI_U32 dot11fUnpackIeP2PGONegCnf(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PGONegCnf. */
 
-#define SigIeP2PGONegCnf ( 0x0048 )
+#define SigIeP2PGONegCnf ( 0x004b )
 
 
     static const tTLVDefn TLVS_P2PGONegReq[ ] = {
@@ -3847,7 +3907,7 @@ tANI_U32 dot11fUnpackIeP2PGONegReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PGONegReq. */
 
-#define SigIeP2PGONegReq ( 0x0049 )
+#define SigIeP2PGONegReq ( 0x004c )
 
 
     static const tTLVDefn TLVS_P2PGONegRes[ ] = {
@@ -3872,7 +3932,7 @@ tANI_U32 dot11fUnpackIeP2PGONegRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PGONegRes. */
 
-#define SigIeP2PGONegRes ( 0x004a )
+#define SigIeP2PGONegRes ( 0x004d )
 
 
     static const tTLVDefn TLVS_P2PGONegWPS[ ] = {
@@ -3890,7 +3950,7 @@ tANI_U32 dot11fUnpackIeP2PGONegWPS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PGONegWPS. */
 
-#define SigIeP2PGONegWPS ( 0x004b )
+#define SigIeP2PGONegWPS ( 0x004e )
 
 
 tANI_U32 dot11fUnpackIeP2PIEOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEP2PIEOpaque *pDst)
@@ -3910,7 +3970,7 @@ tANI_U32 dot11fUnpackIeP2PIEOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PIEOpaque. */
 
-#define SigIeP2PIEOpaque ( 0x004c )
+#define SigIeP2PIEOpaque ( 0x004f )
 
 
     static const tTLVDefn TLVS_P2PInvitationReq[ ] = {
@@ -3933,7 +3993,7 @@ tANI_U32 dot11fUnpackIeP2PInvitationReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI
     return status;
 } /* End dot11fUnpackIeP2PInvitationReq. */
 
-#define SigIeP2PInvitationReq ( 0x004d )
+#define SigIeP2PInvitationReq ( 0x0050 )
 
 
     static const tTLVDefn TLVS_P2PInvitationRes[ ] = {
@@ -3954,7 +4014,7 @@ tANI_U32 dot11fUnpackIeP2PInvitationRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI
     return status;
 } /* End dot11fUnpackIeP2PInvitationRes. */
 
-#define SigIeP2PInvitationRes ( 0x004e )
+#define SigIeP2PInvitationRes ( 0x0051 )
 
 
     static const tTLVDefn TLVS_P2PNoticeOfAbsence[ ] = {
@@ -3971,7 +4031,7 @@ tANI_U32 dot11fUnpackIeP2PNoticeOfAbsence(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tA
     return status;
 } /* End dot11fUnpackIeP2PNoticeOfAbsence. */
 
-#define SigIeP2PNoticeOfAbsence ( 0x004f )
+#define SigIeP2PNoticeOfAbsence ( 0x0052 )
 
 
     static const tTLVDefn TLVS_P2PPresenceResponse[ ] = {
@@ -3989,7 +4049,7 @@ tANI_U32 dot11fUnpackIeP2PPresenceResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, t
     return status;
 } /* End dot11fUnpackIeP2PPresenceResponse. */
 
-#define SigIeP2PPresenceResponse ( 0x0050 )
+#define SigIeP2PPresenceResponse ( 0x0053 )
 
 
     static const tTLVDefn TLVS_P2PProbeReq[ ] = {
@@ -4010,7 +4070,7 @@ tANI_U32 dot11fUnpackIeP2PProbeReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PProbeReq. */
 
-#define SigIeP2PProbeReq ( 0x0051 )
+#define SigIeP2PProbeReq ( 0x0054 )
 
 
     static const tTLVDefn TLVS_P2PProbeRes[ ] = {
@@ -4031,7 +4091,7 @@ tANI_U32 dot11fUnpackIeP2PProbeRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeP2PProbeRes. */
 
-#define SigIeP2PProbeRes ( 0x0052 )
+#define SigIeP2PProbeRes ( 0x0055 )
 
 
     static const tTLVDefn TLVS_P2PProvisionDiscoveryReq[ ] = {
@@ -4050,7 +4110,7 @@ tANI_U32 dot11fUnpackIeP2PProvisionDiscoveryReq(tpAniSirGlobal pCtx, tANI_U8 *pB
     return status;
 } /* End dot11fUnpackIeP2PProvisionDiscoveryReq. */
 
-#define SigIeP2PProvisionDiscoveryReq ( 0x0053 )
+#define SigIeP2PProvisionDiscoveryReq ( 0x0056 )
 
 
     static const tTLVDefn TLVS_P2PWSCProvisionDiscoveryRes[ ] = {
@@ -4067,7 +4127,7 @@ tANI_U32 dot11fUnpackIeP2PWSCProvisionDiscoveryRes(tpAniSirGlobal pCtx, tANI_U8
     return status;
 } /* End dot11fUnpackIeP2PWSCProvisionDiscoveryRes. */
 
-#define SigIeP2PWSCProvisionDiscoveryRes ( 0x0054 )
+#define SigIeP2PWSCProvisionDiscoveryRes ( 0x0057 )
 
 
 tANI_U32 dot11fUnpackIePTIControl(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPTIControl *pDst)
@@ -4084,7 +4144,7 @@ tANI_U32 dot11fUnpackIePTIControl(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ie
     return status;
 } /* End dot11fUnpackIePTIControl. */
 
-#define SigIePTIControl ( 0x0055 )
+#define SigIePTIControl ( 0x0058 )
 
 
 tANI_U32 dot11fUnpackIePUBufferStatus(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPUBufferStatus *pDst)
@@ -4104,7 +4164,7 @@ tANI_U32 dot11fUnpackIePUBufferStatus(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U
     return status;
 } /* End dot11fUnpackIePUBufferStatus. */
 
-#define SigIePUBufferStatus ( 0x0056 )
+#define SigIePUBufferStatus ( 0x0059 )
 
 
 tANI_U32 dot11fUnpackIePowerCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPowerCaps *pDst)
@@ -4121,7 +4181,7 @@ tANI_U32 dot11fUnpackIePowerCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIePowerCaps. */
 
-#define SigIePowerCaps ( 0x0057 )
+#define SigIePowerCaps ( 0x005a )
 
 
 tANI_U32 dot11fUnpackIePowerConstraints(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEPowerConstraints *pDst)
@@ -4135,7 +4195,7 @@ tANI_U32 dot11fUnpackIePowerConstraints(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI
     return status;
 } /* End dot11fUnpackIePowerConstraints. */
 
-#define SigIePowerConstraints ( 0x0058 )
+#define SigIePowerConstraints ( 0x005b )
 
 
 tANI_U32 dot11fUnpackIeQBSSLoad(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQBSSLoad *pDst)
@@ -4155,24 +4215,37 @@ tANI_U32 dot11fUnpackIeQBSSLoad(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iele
     return status;
 } /* End dot11fUnpackIeQBSSLoad. */
 
-#define SigIeQBSSLoad ( 0x0059 )
+#define SigIeQBSSLoad ( 0x005c )
 
 
+    static const tFFDefn FFS_QComVendorIE[ ] = {
+        { NULL, 0, 0, 0,},
+    };
+
+    static const tIEDefn IES_QComVendorIE[ ] = {
+        {offsetof(tDot11fIEQComVendorIE, MccChanInfo), offsetof(tDot11fIEMccChanInfo, present), 0, "MccChanInfo" , 0, 3, 3, SigIeMccChanInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MCCCHANINFO, 0, 0, },
+        {offsetof(tDot11fIEQComVendorIE, Sub20Info), offsetof(tDot11fIESub20Info, present), 0, "Sub20Info" , 0, 4, 4, SigIeSub20Info, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUB20INFO, 0, 0, },
+        {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },
+    };
+
 tANI_U32 dot11fUnpackIeQComVendorIE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQComVendorIE *pDst)
 {
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
     (void) pBuf; (void)ielen; /* Shutup the compiler */
     if (pDst->present) status = DOT11F_DUPLICATE_IE;
     pDst->present = 1;
-    pDst->type = *pBuf;
-    pBuf += 1;
-    ielen -= (tANI_U8)1;
-    pDst->channel = *pBuf;
     (void)pCtx;
+    status |= UnpackCore(pCtx,
+                     pBuf,
+                     ielen,
+                     FFS_QComVendorIE,
+                     IES_QComVendorIE,
+                     ( tANI_U8* )pDst,
+                     sizeof(*pDst));
     return status;
 } /* End dot11fUnpackIeQComVendorIE. */
 
-#define SigIeQComVendorIE ( 0x005a )
+#define SigIeQComVendorIE ( 0x005d )
 
 
 tANI_U32 dot11fUnpackIeQOSCapsAp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQOSCapsAp *pDst)
@@ -4192,7 +4265,7 @@ tANI_U32 dot11fUnpackIeQOSCapsAp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeQOSCapsAp. */
 
-#define SigIeQOSCapsAp ( 0x005b )
+#define SigIeQOSCapsAp ( 0x005e )
 
 
 tANI_U32 dot11fUnpackIeQOSCapsStation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQOSCapsStation *pDst)
@@ -4214,7 +4287,7 @@ tANI_U32 dot11fUnpackIeQOSCapsStation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U
     return status;
 } /* End dot11fUnpackIeQOSCapsStation. */
 
-#define SigIeQOSCapsStation ( 0x005c )
+#define SigIeQOSCapsStation ( 0x005f )
 
 
 tANI_U32 dot11fUnpackIeQosMapSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQosMapSet *pDst)
@@ -4234,7 +4307,7 @@ tANI_U32 dot11fUnpackIeQosMapSet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeQosMapSet. */
 
-#define SigIeQosMapSet ( 0x005d )
+#define SigIeQosMapSet ( 0x0060 )
 
 
 tANI_U32 dot11fUnpackIeQuiet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEQuiet *pDst)
@@ -4257,7 +4330,7 @@ tANI_U32 dot11fUnpackIeQuiet(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     return status;
 } /* End dot11fUnpackIeQuiet. */
 
-#define SigIeQuiet ( 0x005e )
+#define SigIeQuiet ( 0x0061 )
 
 
 tANI_U32 dot11fUnpackIeRCPIIE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERCPIIE *pDst)
@@ -4271,7 +4344,7 @@ tANI_U32 dot11fUnpackIeRCPIIE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     return status;
 } /* End dot11fUnpackIeRCPIIE. */
 
-#define SigIeRCPIIE ( 0x005f )
+#define SigIeRCPIIE ( 0x0062 )
 
 
     static const tFFDefn FFS_RICDataDesc[ ] = {
@@ -4279,18 +4352,18 @@ tANI_U32 dot11fUnpackIeRCPIIE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     };
 
     static const tIEDefn IES_RICDataDesc[ ] = {
-        {offsetof(tDot11fIERICDataDesc, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 1, },
-        {offsetof(tDot11fIERICDataDesc, RICDescriptor), offsetof(tDot11fIERICDescriptor, present), 0, "RICDescriptor" , 0, 3, 258, SigIeRICDescriptor, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDESCRIPTOR, 0, },
-        {offsetof(tDot11fIERICDataDesc, TSPEC), offsetof(tDot11fIETSPEC, present), 0, "TSPEC" , 0, 57, 57, SigIeTSPEC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSPEC, 0, },
-        {offsetof(tDot11fIERICDataDesc, TCLAS), offsetof(tDot11fIETCLAS, present), offsetof(tDot11fIERICDataDesc, num_TCLAS), "TCLAS" , 2, 7, 45, SigIeTCLAS, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLAS, 0, },
-        {offsetof(tDot11fIERICDataDesc, TCLASSPROC), offsetof(tDot11fIETCLASSPROC, present), 0, "TCLASSPROC" , 0, 3, 3, SigIeTCLASSPROC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLASSPROC, 0, },
-        {offsetof(tDot11fIERICDataDesc, TSDelay), offsetof(tDot11fIETSDelay, present), 0, "TSDelay" , 0, 6, 6, SigIeTSDelay, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSDELAY, 0, },
-        {offsetof(tDot11fIERICDataDesc, Schedule), offsetof(tDot11fIESchedule, present), 0, "Schedule" , 0, 16, 16, SigIeSchedule, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SCHEDULE, 0, },
-        {offsetof(tDot11fIERICDataDesc, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, },
-        {offsetof(tDot11fIERICDataDesc, WMMTCLAS), offsetof(tDot11fIEWMMTCLAS, present), offsetof(tDot11fIERICDataDesc, num_WMMTCLAS), "WMMTCLAS" , 2, 13, 51, SigIeWMMTCLAS, {0, 80, 242, 2, 6}, 5, DOT11F_EID_WMMTCLAS, 0, },
-        {offsetof(tDot11fIERICDataDesc, WMMTCLASPROC), offsetof(tDot11fIEWMMTCLASPROC, present), 0, "WMMTCLASPROC" , 0, 9, 9, SigIeWMMTCLASPROC, {0, 80, 242, 2, 7}, 5, DOT11F_EID_WMMTCLASPROC, 0, },
-        {offsetof(tDot11fIERICDataDesc, WMMTSDelay), offsetof(tDot11fIEWMMTSDelay, present), 0, "WMMTSDelay" , 0, 12, 12, SigIeWMMTSDelay, {0, 80, 242, 2, 8}, 5, DOT11F_EID_WMMTSDELAY, 0, },
-        {offsetof(tDot11fIERICDataDesc, WMMSchedule), offsetof(tDot11fIEWMMSchedule, present), 0, "WMMSchedule" , 0, 22, 22, SigIeWMMSchedule, {0, 80, 242, 2, 9}, 5, DOT11F_EID_WMMSCHEDULE, 0, },
+        {offsetof(tDot11fIERICDataDesc, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, 1, },
+        {offsetof(tDot11fIERICDataDesc, RICDescriptor), offsetof(tDot11fIERICDescriptor, present), 0, "RICDescriptor" , 0, 3, 258, SigIeRICDescriptor, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDESCRIPTOR, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, TSPEC), offsetof(tDot11fIETSPEC, present), 0, "TSPEC" , 0, 57, 57, SigIeTSPEC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSPEC, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, TCLAS), offsetof(tDot11fIETCLAS, present), offsetof(tDot11fIERICDataDesc, num_TCLAS), "TCLAS" , 2, 7, 45, SigIeTCLAS, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLAS, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, TCLASSPROC), offsetof(tDot11fIETCLASSPROC, present), 0, "TCLASSPROC" , 0, 3, 3, SigIeTCLASSPROC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLASSPROC, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, TSDelay), offsetof(tDot11fIETSDelay, present), 0, "TSDelay" , 0, 6, 6, SigIeTSDelay, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSDELAY, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, Schedule), offsetof(tDot11fIESchedule, present), 0, "Schedule" , 0, 16, 16, SigIeSchedule, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SCHEDULE, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, WMMTCLAS), offsetof(tDot11fIEWMMTCLAS, present), offsetof(tDot11fIERICDataDesc, num_WMMTCLAS), "WMMTCLAS" , 2, 13, 51, SigIeWMMTCLAS, {0, 80, 242, 2, 6}, 5, DOT11F_EID_WMMTCLAS, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, WMMTCLASPROC), offsetof(tDot11fIEWMMTCLASPROC, present), 0, "WMMTCLASPROC" , 0, 9, 9, SigIeWMMTCLASPROC, {0, 80, 242, 2, 7}, 5, DOT11F_EID_WMMTCLASPROC, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, WMMTSDelay), offsetof(tDot11fIEWMMTSDelay, present), 0, "WMMTSDelay" , 0, 12, 12, SigIeWMMTSDelay, {0, 80, 242, 2, 8}, 5, DOT11F_EID_WMMTSDELAY, 0, 0, },
+        {offsetof(tDot11fIERICDataDesc, WMMSchedule), offsetof(tDot11fIEWMMSchedule, present), 0, "WMMSchedule" , 0, 22, 22, SigIeWMMSchedule, {0, 80, 242, 2, 9}, 5, DOT11F_EID_WMMSCHEDULE, 0, 0, },
         {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },
     };
 
@@ -4311,7 +4384,7 @@ tANI_U32 dot11fUnpackIeRICDataDesc(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeRICDataDesc. */
 
-#define SigIeRICDataDesc ( 0x0060 )
+#define SigIeRICDataDesc ( 0x0063 )
 
 
 tANI_U32 dot11fUnpackIeRSN(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERSN *pDst)
@@ -4414,7 +4487,7 @@ tANI_U32 dot11fUnpackIeRSN(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tD
     return status;
 } /* End dot11fUnpackIeRSN. */
 
-#define SigIeRSN ( 0x0061 )
+#define SigIeRSN ( 0x0064 )
 
 
 tANI_U32 dot11fUnpackIeRSNIIE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERSNIIE *pDst)
@@ -4428,7 +4501,7 @@ tANI_U32 dot11fUnpackIeRSNIIE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     return status;
 } /* End dot11fUnpackIeRSNIIE. */
 
-#define SigIeRSNIIE ( 0x0062 )
+#define SigIeRSNIIE ( 0x0065 )
 
 
 tANI_U32 dot11fUnpackIeRSNOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIERSNOpaque *pDst)
@@ -4448,7 +4521,7 @@ tANI_U32 dot11fUnpackIeRSNOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeRSNOpaque. */
 
-#define SigIeRSNOpaque ( 0x0063 )
+#define SigIeRSNOpaque ( 0x0066 )
 
 
 tANI_U32 dot11fUnpackIeSuppChannels(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESuppChannels *pDst)
@@ -4468,7 +4541,7 @@ tANI_U32 dot11fUnpackIeSuppChannels(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeSuppChannels. */
 
-#define SigIeSuppChannels ( 0x0064 )
+#define SigIeSuppChannels ( 0x0067 )
 
 
 tANI_U32 dot11fUnpackIeSuppOperatingClasses(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESuppOperatingClasses *pDst)
@@ -4488,7 +4561,7 @@ tANI_U32 dot11fUnpackIeSuppOperatingClasses(tpAniSirGlobal pCtx, tANI_U8 *pBuf,
     return status;
 } /* End dot11fUnpackIeSuppOperatingClasses. */
 
-#define SigIeSuppOperatingClasses ( 0x0065 )
+#define SigIeSuppOperatingClasses ( 0x0068 )
 
 
 tANI_U32 dot11fUnpackIeSuppRates(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIESuppRates *pDst)
@@ -4516,7 +4589,7 @@ tANI_U32 dot11fUnpackIeSuppRates(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeSuppRates. */
 
-#define SigIeSuppRates ( 0x0066 )
+#define SigIeSuppRates ( 0x0069 )
 
 
 tANI_U32 dot11fUnpackIeTIM(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETIM *pDst)
@@ -4545,7 +4618,7 @@ tANI_U32 dot11fUnpackIeTIM(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tD
     return status;
 } /* End dot11fUnpackIeTIM. */
 
-#define SigIeTIM ( 0x0067 )
+#define SigIeTIM ( 0x006a )
 
 
 tANI_U32 dot11fUnpackIeTPCReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETPCReport *pDst)
@@ -4562,7 +4635,7 @@ tANI_U32 dot11fUnpackIeTPCReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeTPCReport. */
 
-#define SigIeTPCReport ( 0x0068 )
+#define SigIeTPCReport ( 0x006b )
 
 
 tANI_U32 dot11fUnpackIeTPCRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETPCRequest *pDst)
@@ -4575,7 +4648,7 @@ tANI_U32 dot11fUnpackIeTPCRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ie
     return status;
 } /* End dot11fUnpackIeTPCRequest. */
 
-#define SigIeTPCRequest ( 0x0069 )
+#define SigIeTPCRequest ( 0x006c )
 
 
 tANI_U32 dot11fUnpackIeTimeAdvertisement(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETimeAdvertisement *pDst)
@@ -4595,7 +4668,7 @@ tANI_U32 dot11fUnpackIeTimeAdvertisement(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tAN
     return status;
 } /* End dot11fUnpackIeTimeAdvertisement. */
 
-#define SigIeTimeAdvertisement ( 0x006a )
+#define SigIeTimeAdvertisement ( 0x006d )
 
 
 tANI_U32 dot11fUnpackIeTimeoutInterval(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIETimeoutInterval *pDst)
@@ -4612,7 +4685,7 @@ tANI_U32 dot11fUnpackIeTimeoutInterval(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_
     return status;
 } /* End dot11fUnpackIeTimeoutInterval. */
 
-#define SigIeTimeoutInterval ( 0x006b )
+#define SigIeTimeoutInterval ( 0x006e )
 
 
 tANI_U32 dot11fUnpackIeVHTExtBssLoad(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEVHTExtBssLoad *pDst)
@@ -4638,7 +4711,7 @@ tANI_U32 dot11fUnpackIeVHTExtBssLoad(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeVHTExtBssLoad. */
 
-#define SigIeVHTExtBssLoad ( 0x006c )
+#define SigIeVHTExtBssLoad ( 0x006f )
 
 
 tANI_U32 dot11fUnpackIeVendor1IE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEVendor1IE *pDst)
@@ -4651,7 +4724,7 @@ tANI_U32 dot11fUnpackIeVendor1IE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeVendor1IE. */
 
-#define SigIeVendor1IE ( 0x006d )
+#define SigIeVendor1IE ( 0x0070 )
 
 
 tANI_U32 dot11fUnpackIeVendor3IE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEVendor3IE *pDst)
@@ -4664,7 +4737,7 @@ tANI_U32 dot11fUnpackIeVendor3IE(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeVendor3IE. */
 
-#define SigIeVendor3IE ( 0x006e )
+#define SigIeVendor3IE ( 0x0071 )
 
 
 tANI_U32 dot11fUnpackIeWAPI(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWAPI *pDst)
@@ -4733,7 +4806,7 @@ tANI_U32 dot11fUnpackIeWAPI(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, t
     return status;
 } /* End dot11fUnpackIeWAPI. */
 
-#define SigIeWAPI ( 0x006f )
+#define SigIeWAPI ( 0x0072 )
 
 
 tANI_U32 dot11fUnpackIeWAPIOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWAPIOpaque *pDst)
@@ -4753,7 +4826,7 @@ tANI_U32 dot11fUnpackIeWAPIOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ie
     return status;
 } /* End dot11fUnpackIeWAPIOpaque. */
 
-#define SigIeWAPIOpaque ( 0x0070 )
+#define SigIeWAPIOpaque ( 0x0073 )
 
 
 tANI_U32 dot11fUnpackIeWFATPC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWFATPC *pDst)
@@ -4770,7 +4843,7 @@ tANI_U32 dot11fUnpackIeWFATPC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     return status;
 } /* End dot11fUnpackIeWFATPC. */
 
-#define SigIeWFATPC ( 0x0071 )
+#define SigIeWFATPC ( 0x0074 )
 
 
 tANI_U32 dot11fUnpackIeWFDIEOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWFDIEOpaque *pDst)
@@ -4790,7 +4863,7 @@ tANI_U32 dot11fUnpackIeWFDIEOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeWFDIEOpaque. */
 
-#define SigIeWFDIEOpaque ( 0x0072 )
+#define SigIeWFDIEOpaque ( 0x0075 )
 
 
 tANI_U32 dot11fUnpackIeWMMCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMCaps *pDst)
@@ -4818,7 +4891,7 @@ tANI_U32 dot11fUnpackIeWMMCaps(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen
     return status;
 } /* End dot11fUnpackIeWMMCaps. */
 
-#define SigIeWMMCaps ( 0x0073 )
+#define SigIeWMMCaps ( 0x0076 )
 
 
 tANI_U32 dot11fUnpackIeWMMInfoAp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMInfoAp *pDst)
@@ -4839,7 +4912,7 @@ tANI_U32 dot11fUnpackIeWMMInfoAp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeWMMInfoAp. */
 
-#define SigIeWMMInfoAp ( 0x0074 )
+#define SigIeWMMInfoAp ( 0x0077 )
 
 
 tANI_U32 dot11fUnpackIeWMMInfoStation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMInfoStation *pDst)
@@ -4864,7 +4937,7 @@ tANI_U32 dot11fUnpackIeWMMInfoStation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U
     return status;
 } /* End dot11fUnpackIeWMMInfoStation. */
 
-#define SigIeWMMInfoStation ( 0x0075 )
+#define SigIeWMMInfoStation ( 0x0078 )
 
 
 tANI_U32 dot11fUnpackIeWMMParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWMMParams *pDst)
@@ -4957,7 +5030,7 @@ tANI_U32 dot11fUnpackIeWMMParams(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeWMMParams. */
 
-#define SigIeWMMParams ( 0x0076 )
+#define SigIeWMMParams ( 0x0079 )
 
 
 tANI_U32 dot11fUnpackIeWPA(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWPA *pDst)
@@ -5039,7 +5112,7 @@ tANI_U32 dot11fUnpackIeWPA(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tD
     return status;
 } /* End dot11fUnpackIeWPA. */
 
-#define SigIeWPA ( 0x0077 )
+#define SigIeWPA ( 0x007a )
 
 
 tANI_U32 dot11fUnpackIeWPAOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWPAOpaque *pDst)
@@ -5059,7 +5132,7 @@ tANI_U32 dot11fUnpackIeWPAOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeWPAOpaque. */
 
-#define SigIeWPAOpaque ( 0x0078 )
+#define SigIeWPAOpaque ( 0x007b )
 
 
     static const tTLVDefn TLVS_WSC[ ] = {
@@ -5097,7 +5170,7 @@ tANI_U32 dot11fUnpackIeWSC(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tD
     return status;
 } /* End dot11fUnpackIeWSC. */
 
-#define SigIeWSC ( 0x0079 )
+#define SigIeWSC ( 0x007c )
 
 
     static const tTLVDefn TLVS_WscAssocReq[ ] = {
@@ -5116,7 +5189,7 @@ tANI_U32 dot11fUnpackIeWscAssocReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeWscAssocReq. */
 
-#define SigIeWscAssocReq ( 0x007a )
+#define SigIeWscAssocReq ( 0x007d )
 
 
     static const tTLVDefn TLVS_WscAssocRes[ ] = {
@@ -5135,7 +5208,7 @@ tANI_U32 dot11fUnpackIeWscAssocRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeWscAssocRes. */
 
-#define SigIeWscAssocRes ( 0x007b )
+#define SigIeWscAssocRes ( 0x007e )
 
 
     static const tTLVDefn TLVS_WscBeacon[ ] = {
@@ -5160,7 +5233,7 @@ tANI_U32 dot11fUnpackIeWscBeacon(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 iel
     return status;
 } /* End dot11fUnpackIeWscBeacon. */
 
-#define SigIeWscBeacon ( 0x007c )
+#define SigIeWscBeacon ( 0x007f )
 
 
     static const tTLVDefn TLVS_WscBeaconProbeRes[ ] = {
@@ -5193,7 +5266,7 @@ tANI_U32 dot11fUnpackIeWscBeaconProbeRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tAN
     return status;
 } /* End dot11fUnpackIeWscBeaconProbeRes. */
 
-#define SigIeWscBeaconProbeRes ( 0x007d )
+#define SigIeWscBeaconProbeRes ( 0x0080 )
 
 
 tANI_U32 dot11fUnpackIeWscIEOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEWscIEOpaque *pDst)
@@ -5213,7 +5286,7 @@ tANI_U32 dot11fUnpackIeWscIEOpaque(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeWscIEOpaque. */
 
-#define SigIeWscIEOpaque ( 0x007e )
+#define SigIeWscIEOpaque ( 0x0081 )
 
 
     static const tTLVDefn TLVS_WscProbeReq[ ] = {
@@ -5244,7 +5317,7 @@ tANI_U32 dot11fUnpackIeWscProbeReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeWscProbeReq. */
 
-#define SigIeWscProbeReq ( 0x007f )
+#define SigIeWscProbeReq ( 0x0082 )
 
 
     static const tTLVDefn TLVS_WscProbeRes[ ] = {
@@ -5277,7 +5350,7 @@ tANI_U32 dot11fUnpackIeWscProbeRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 i
     return status;
 } /* End dot11fUnpackIeWscProbeRes. */
 
-#define SigIeWscProbeRes ( 0x0080 )
+#define SigIeWscProbeRes ( 0x0083 )
 
 
     static const tTLVDefn TLVS_WscReassocRes[ ] = {
@@ -5296,7 +5369,7 @@ tANI_U32 dot11fUnpackIeWscReassocRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8
     return status;
 } /* End dot11fUnpackIeWscReassocRes. */
 
-#define SigIeWscReassocRes ( 0x0081 )
+#define SigIeWscReassocRes ( 0x0084 )
 
 
 tANI_U32 dot11fUnpackIeext_chan_switch_ann(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEext_chan_switch_ann *pDst)
@@ -5319,7 +5392,205 @@ tANI_U32 dot11fUnpackIeext_chan_switch_ann(tpAniSirGlobal pCtx, tANI_U8 *pBuf, t
     return status;
 } /* End dot11fUnpackIeext_chan_switch_ann. */
 
-#define SigIeext_chan_switch_ann ( 0x0082 )
+#define SigIeext_chan_switch_ann ( 0x0085 )
+
+
+tANI_U32 dot11fUnpackIefils_assoc_delay_info(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEfils_assoc_delay_info *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    pDst->assoc_delay_info = *pBuf;
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIefils_assoc_delay_info. */
+
+#define SigIefils_assoc_delay_info ( 0x0086 )
+
+
+tANI_U32 dot11fUnpackIefils_hlp_container(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEfils_hlp_container *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    DOT11F_MEMCPY(pCtx, pDst->dest_mac, pBuf, 6);
+    pBuf += 6;
+    ielen -= (tANI_U8)6;
+    DOT11F_MEMCPY(pCtx, pDst->src_mac, pBuf, 6);
+    pBuf += 6;
+    ielen -= (tANI_U8)6;
+    pDst->num_hlp_packet = (tANI_U8)( ielen );
+    DOT11F_MEMCPY(pCtx, pDst->hlp_packet, pBuf, ( ielen ) );
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIefils_hlp_container. */
+
+#define SigIefils_hlp_container ( 0x0087 )
+
+
+tANI_U32 dot11fUnpackIefils_indication(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEfils_indication *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    tANI_U16 tmp70__;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    framesntohs(pCtx, &tmp70__, pBuf, 0);
+    pBuf += 2;
+    ielen -= 2;
+    pDst->public_key_identifiers_cnt = tmp70__ >> 0 & 0x7;
+    pDst->realm_identifiers_cnt = tmp70__ >> 3 & 0x7;
+    pDst->is_ip_config_supported = tmp70__ >> 6 & 0x1;
+    pDst->is_cache_id_present = tmp70__ >> 7 & 0x1;
+    pDst->is_hessid_present = tmp70__ >> 8 & 0x1;
+    pDst->is_fils_sk_auth_supported = tmp70__ >> 9 & 0x1;
+    pDst->is_fils_sk_auth_pfs_supported = tmp70__ >> 10 & 0x1;
+    pDst->is_pk_auth_supported = tmp70__ >> 11 & 0x1;
+    pDst->reserved = tmp70__ >> 12 & 0xf;
+    pDst->num_variable_data = (tANI_U8)( ielen );
+    DOT11F_MEMCPY(pCtx, pDst->variable_data, pBuf, ( ielen ) );
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIefils_indication. */
+
+#define SigIefils_indication ( 0x0088 )
+
+
+tANI_U32 dot11fUnpackIefils_kde(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEfils_kde *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    DOT11F_MEMCPY(pCtx, pDst->key_rsc, pBuf, 8);
+    pBuf += 8;
+    ielen -= (tANI_U8)8;
+    pDst->num_kde_list = (tANI_U8)( ielen );
+    DOT11F_MEMCPY(pCtx, pDst->kde_list, pBuf, ( ielen ) );
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIefils_kde. */
+
+#define SigIefils_kde ( 0x0089 )
+
+
+tANI_U32 dot11fUnpackIefils_key_confirmation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEfils_key_confirmation *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    pDst->num_key_auth = (tANI_U8)( ielen );
+    DOT11F_MEMCPY(pCtx, pDst->key_auth, pBuf, ( ielen ) );
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIefils_key_confirmation. */
+
+#define SigIefils_key_confirmation ( 0x008a )
+
+
+tANI_U32 dot11fUnpackIefils_nonce(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEfils_nonce *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    DOT11F_MEMCPY(pCtx, pDst->nonce, pBuf, 16);
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIefils_nonce. */
+
+#define SigIefils_nonce ( 0x008b )
+
+
+tANI_U32 dot11fUnpackIefils_public_key(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEfils_public_key *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    pDst->key_type = *pBuf;
+    pBuf += 1;
+    ielen -= (tANI_U8)1;
+    pDst->num_public_key = (tANI_U8)( ielen );
+    DOT11F_MEMCPY(pCtx, pDst->public_key, pBuf, ( ielen ) );
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIefils_public_key. */
+
+#define SigIefils_public_key ( 0x008c )
+
+
+tANI_U32 dot11fUnpackIefils_session(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEfils_session *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    DOT11F_MEMCPY(pCtx, pDst->session, pBuf, 8);
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIefils_session. */
+
+#define SigIefils_session ( 0x008d )
+
+
+tANI_U32 dot11fUnpackIefils_wrapped_data(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEfils_wrapped_data *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    pDst->num_wrapped_data = (tANI_U8)( ielen );
+    DOT11F_MEMCPY(pCtx, pDst->wrapped_data, pBuf, ( ielen ) );
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIefils_wrapped_data. */
+
+#define SigIefils_wrapped_data ( 0x008e )
+
+
+tANI_U32 dot11fUnpackIehs20vendor_ie(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEhs20vendor_ie *pDst)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    tANI_U8 tmp71__;
+    (void) pBuf; (void)ielen; /* Shutup the compiler */
+    if (pDst->present) status = DOT11F_DUPLICATE_IE;
+    pDst->present = 1;
+    tmp71__ = *pBuf;
+    pBuf += 1;
+    ielen -= 1;
+    pDst->dgaf_dis = tmp71__ >> 0 & 0x1;
+    pDst->hs_id_present = tmp71__ >> 1 & 0x3;
+    pDst->reserved = tmp71__ >> 3 & 0x1;
+    pDst->release_num = tmp71__ >> 4 & 0xf;
+    if ( ! ielen )
+    {
+        return 0U;
+    }
+    else
+    {
+        switch (pDst->hs_id_present)
+        {
+            case 1:
+                framesntohs(pCtx, &pDst->hs_id.pps_mo.pps_mo_id, pBuf, 0);
+                pBuf += 2;
+                ielen -= (tANI_U8)2;
+            break;
+            case 2:
+                framesntohs(pCtx, &pDst->hs_id.anqp_domain.anqp_domain_id, pBuf, 0);
+                pBuf += 2;
+                ielen -= (tANI_U8)2;
+            break;
+        }
+    }
+    (void)pCtx;
+    return status;
+} /* End dot11fUnpackIehs20vendor_ie. */
+
+#define SigIehs20vendor_ie ( 0x008f )
 
 
 tANI_U32 dot11fUnpackIesec_chan_offset_ele(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEsec_chan_offset_ele *pDst)
@@ -5333,7 +5604,7 @@ tANI_U32 dot11fUnpackIesec_chan_offset_ele(tpAniSirGlobal pCtx, tANI_U8 *pBuf, t
     return status;
 } /* End dot11fUnpackIesec_chan_offset_ele. */
 
-#define SigIesec_chan_offset_ele ( 0x0083 )
+#define SigIesec_chan_offset_ele ( 0x0090 )
 
 
     static const tFFDefn FFS_vendor2_ie[ ] = {
@@ -5341,8 +5612,8 @@ tANI_U32 dot11fUnpackIesec_chan_offset_ele(tpAniSirGlobal pCtx, tANI_U8 *pBuf, t
     };
 
     static const tIEDefn IES_vendor2_ie[ ] = {
-        {offsetof(tDot11fIEvendor2_ie, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fIEvendor2_ie, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
+        {offsetof(tDot11fIEvendor2_ie, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fIEvendor2_ie, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, 0, },
         {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },
     };
 
@@ -5369,7 +5640,7 @@ tANI_U32 dot11fUnpackIevendor2_ie(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ie
     return status;
 } /* End dot11fUnpackIevendor2_ie. */
 
-#define SigIevendor2_ie ( 0x0084 )
+#define SigIevendor2_ie ( 0x0091 )
 
 
     static const tFFDefn FFS_AddBAReq[] = {
@@ -5475,13 +5746,13 @@ tANI_U32 dot11fUnpackAddBARsp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
     };
 
     static const tIEDefn IES_AddTSRequest[] = {
-        {offsetof(tDot11fAddTSRequest, TSPEC), offsetof(tDot11fIETSPEC, present), 0, "TSPEC" , 0, 57, 57, SigIeTSPEC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSPEC, 1, },
-        {offsetof(tDot11fAddTSRequest, TCLAS), offsetof(tDot11fIETCLAS, present), offsetof(tDot11fAddTSRequest, num_TCLAS), "TCLAS" , 2, 7, 45, SigIeTCLAS, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLAS, 0, },
-        {offsetof(tDot11fAddTSRequest, TCLASSPROC), offsetof(tDot11fIETCLASSPROC, present), 0, "TCLASSPROC" , 0, 3, 3, SigIeTCLASSPROC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLASSPROC, 0, },
-        {offsetof(tDot11fAddTSRequest, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, },
-        {offsetof(tDot11fAddTSRequest, WMMTCLAS), offsetof(tDot11fIEWMMTCLAS, present), offsetof(tDot11fAddTSRequest, num_WMMTCLAS), "WMMTCLAS" , 2, 13, 51, SigIeWMMTCLAS, {0, 80, 242, 2, 6}, 5, DOT11F_EID_WMMTCLAS, 0, },
-        {offsetof(tDot11fAddTSRequest, WMMTCLASPROC), offsetof(tDot11fIEWMMTCLASPROC, present), 0, "WMMTCLASPROC" , 0, 9, 9, SigIeWMMTCLASPROC, {0, 80, 242, 2, 7}, 5, DOT11F_EID_WMMTCLASPROC, 0, },
-        {offsetof(tDot11fAddTSRequest, ESETrafStrmRateSet), offsetof(tDot11fIEESETrafStrmRateSet, present), 0, "ESETrafStrmRateSet" , 0, 7, 15, SigIeESETrafStrmRateSet, {0, 64, 150, 8, 0}, 4, DOT11F_EID_ESETRAFSTRMRATESET, 0, },
+        {offsetof(tDot11fAddTSRequest, TSPEC), offsetof(tDot11fIETSPEC, present), 0, "TSPEC" , 0, 57, 57, SigIeTSPEC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSPEC, 0, 1, },
+        {offsetof(tDot11fAddTSRequest, TCLAS), offsetof(tDot11fIETCLAS, present), offsetof(tDot11fAddTSRequest, num_TCLAS), "TCLAS" , 2, 7, 45, SigIeTCLAS, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLAS, 0, 0, },
+        {offsetof(tDot11fAddTSRequest, TCLASSPROC), offsetof(tDot11fIETCLASSPROC, present), 0, "TCLASSPROC" , 0, 3, 3, SigIeTCLASSPROC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLASSPROC, 0, 0, },
+        {offsetof(tDot11fAddTSRequest, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, 0, },
+        {offsetof(tDot11fAddTSRequest, WMMTCLAS), offsetof(tDot11fIEWMMTCLAS, present), offsetof(tDot11fAddTSRequest, num_WMMTCLAS), "WMMTCLAS" , 2, 13, 51, SigIeWMMTCLAS, {0, 80, 242, 2, 6}, 5, DOT11F_EID_WMMTCLAS, 0, 0, },
+        {offsetof(tDot11fAddTSRequest, WMMTCLASPROC), offsetof(tDot11fIEWMMTCLASPROC, present), 0, "WMMTCLASPROC" , 0, 9, 9, SigIeWMMTCLASPROC, {0, 80, 242, 2, 7}, 5, DOT11F_EID_WMMTCLASPROC, 0, 0, },
+        {offsetof(tDot11fAddTSRequest, ESETrafStrmRateSet), offsetof(tDot11fIEESETrafStrmRateSet, present), 0, "ESETrafStrmRateSet" , 0, 7, 15, SigIeESETrafStrmRateSet, {0, 64, 150, 8, 0}, 4, DOT11F_EID_ESETRAFSTRMRATESET, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackAddTSRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fAddTSRequest *pFrm)
@@ -5712,17 +5983,17 @@ tANI_U32 dot11fUnpackAddTSRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 n
     };
 
     static const tIEDefn IES_AddTSResponse[] = {
-        {offsetof(tDot11fAddTSResponse, TSDelay), offsetof(tDot11fIETSDelay, present), 0, "TSDelay" , 0, 6, 6, SigIeTSDelay, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSDELAY, 1, },
-        {offsetof(tDot11fAddTSResponse, TSPEC), offsetof(tDot11fIETSPEC, present), 0, "TSPEC" , 0, 57, 57, SigIeTSPEC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSPEC, 1, },
-        {offsetof(tDot11fAddTSResponse, TCLAS), offsetof(tDot11fIETCLAS, present), offsetof(tDot11fAddTSResponse, num_TCLAS), "TCLAS" , 2, 7, 45, SigIeTCLAS, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLAS, 0, },
-        {offsetof(tDot11fAddTSResponse, TCLASSPROC), offsetof(tDot11fIETCLASSPROC, present), 0, "TCLASSPROC" , 0, 3, 3, SigIeTCLASSPROC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLASSPROC, 0, },
-        {offsetof(tDot11fAddTSResponse, Schedule), offsetof(tDot11fIESchedule, present), 0, "Schedule" , 0, 16, 16, SigIeSchedule, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SCHEDULE, 0, },
-        {offsetof(tDot11fAddTSResponse, WMMTSDelay), offsetof(tDot11fIEWMMTSDelay, present), 0, "WMMTSDelay" , 0, 12, 12, SigIeWMMTSDelay, {0, 80, 242, 2, 8}, 5, DOT11F_EID_WMMTSDELAY, 0, },
-        {offsetof(tDot11fAddTSResponse, WMMSchedule), offsetof(tDot11fIEWMMSchedule, present), 0, "WMMSchedule" , 0, 22, 22, SigIeWMMSchedule, {0, 80, 242, 2, 9}, 5, DOT11F_EID_WMMSCHEDULE, 0, },
-        {offsetof(tDot11fAddTSResponse, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, },
-        {offsetof(tDot11fAddTSResponse, WMMTCLAS), offsetof(tDot11fIEWMMTCLAS, present), offsetof(tDot11fAddTSResponse, num_WMMTCLAS), "WMMTCLAS" , 2, 13, 51, SigIeWMMTCLAS, {0, 80, 242, 2, 6}, 5, DOT11F_EID_WMMTCLAS, 0, },
-        {offsetof(tDot11fAddTSResponse, WMMTCLASPROC), offsetof(tDot11fIEWMMTCLASPROC, present), 0, "WMMTCLASPROC" , 0, 9, 9, SigIeWMMTCLASPROC, {0, 80, 242, 2, 7}, 5, DOT11F_EID_WMMTCLASPROC, 0, },
-        {offsetof(tDot11fAddTSResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, },
+        {offsetof(tDot11fAddTSResponse, TSDelay), offsetof(tDot11fIETSDelay, present), 0, "TSDelay" , 0, 6, 6, SigIeTSDelay, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSDELAY, 0, 1, },
+        {offsetof(tDot11fAddTSResponse, TSPEC), offsetof(tDot11fIETSPEC, present), 0, "TSPEC" , 0, 57, 57, SigIeTSPEC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TSPEC, 0, 1, },
+        {offsetof(tDot11fAddTSResponse, TCLAS), offsetof(tDot11fIETCLAS, present), offsetof(tDot11fAddTSResponse, num_TCLAS), "TCLAS" , 2, 7, 45, SigIeTCLAS, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLAS, 0, 0, },
+        {offsetof(tDot11fAddTSResponse, TCLASSPROC), offsetof(tDot11fIETCLASSPROC, present), 0, "TCLASSPROC" , 0, 3, 3, SigIeTCLASSPROC, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TCLASSPROC, 0, 0, },
+        {offsetof(tDot11fAddTSResponse, Schedule), offsetof(tDot11fIESchedule, present), 0, "Schedule" , 0, 16, 16, SigIeSchedule, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SCHEDULE, 0, 0, },
+        {offsetof(tDot11fAddTSResponse, WMMTSDelay), offsetof(tDot11fIEWMMTSDelay, present), 0, "WMMTSDelay" , 0, 12, 12, SigIeWMMTSDelay, {0, 80, 242, 2, 8}, 5, DOT11F_EID_WMMTSDELAY, 0, 0, },
+        {offsetof(tDot11fAddTSResponse, WMMSchedule), offsetof(tDot11fIEWMMSchedule, present), 0, "WMMSchedule" , 0, 22, 22, SigIeWMMSchedule, {0, 80, 242, 2, 9}, 5, DOT11F_EID_WMMSCHEDULE, 0, 0, },
+        {offsetof(tDot11fAddTSResponse, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, 0, },
+        {offsetof(tDot11fAddTSResponse, WMMTCLAS), offsetof(tDot11fIEWMMTCLAS, present), offsetof(tDot11fAddTSResponse, num_WMMTCLAS), "WMMTCLAS" , 2, 13, 51, SigIeWMMTCLAS, {0, 80, 242, 2, 6}, 5, DOT11F_EID_WMMTCLAS, 0, 0, },
+        {offsetof(tDot11fAddTSResponse, WMMTCLASPROC), offsetof(tDot11fIEWMMTCLASPROC, present), 0, "WMMTCLASPROC" , 0, 9, 9, SigIeWMMTCLASPROC, {0, 80, 242, 2, 7}, 5, DOT11F_EID_WMMTCLASPROC, 0, 0, },
+        {offsetof(tDot11fAddTSResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackAddTSResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fAddTSResponse *pFrm)
@@ -6005,31 +6276,37 @@ tANI_U32 dot11fUnpackAddTSResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
     };
 
     static const tIEDefn IES_AssocRequest[] = {
-        {offsetof(tDot11fAssocRequest, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 1, },
-        {offsetof(tDot11fAssocRequest, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fAssocRequest, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fAssocRequest, PowerCaps), offsetof(tDot11fIEPowerCaps, present), 0, "PowerCaps" , 0, 4, 4, SigIePowerCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCAPS, 0, },
-        {offsetof(tDot11fAssocRequest, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, },
-        {offsetof(tDot11fAssocRequest, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
-        {offsetof(tDot11fAssocRequest, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, },
-        {offsetof(tDot11fAssocRequest, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
-        {offsetof(tDot11fAssocRequest, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fAssocRequest, WPAOpaque), offsetof(tDot11fIEWPAOpaque, present), 0, "WPAOpaque" , 0, 8, 255, SigIeWPAOpaque, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPAOPAQUE, 0, },
-        {offsetof(tDot11fAssocRequest, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fAssocRequest, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, },
-        {offsetof(tDot11fAssocRequest, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, },
-        {offsetof(tDot11fAssocRequest, WscIEOpaque), offsetof(tDot11fIEWscIEOpaque, present), 0, "WscIEOpaque" , 0, 8, 255, SigIeWscIEOpaque, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCIEOPAQUE, 0, },
-        {offsetof(tDot11fAssocRequest, WAPIOpaque), offsetof(tDot11fIEWAPIOpaque, present), 0, "WAPIOpaque" , 0, 8, 255, SigIeWAPIOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPIOPAQUE, 0, },
-        {offsetof(tDot11fAssocRequest, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, },
-        {offsetof(tDot11fAssocRequest, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, },
-        {offsetof(tDot11fAssocRequest, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, },
-        {offsetof(tDot11fAssocRequest, P2PIEOpaque), offsetof(tDot11fIEP2PIEOpaque, present), 0, "P2PIEOpaque" , 0, 8, 255, SigIeP2PIEOpaque, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PIEOPAQUE, 0, },
-        {offsetof(tDot11fAssocRequest, WFDIEOpaque), offsetof(tDot11fIEWFDIEOpaque, present), 0, "WFDIEOpaque" , 0, 8, 255, SigIeWFDIEOpaque, {80, 111, 154, 10, 0}, 4, DOT11F_EID_WFDIEOPAQUE, 0, },
-        {offsetof(tDot11fAssocRequest, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fAssocRequest, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fAssocRequest, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
-        {offsetof(tDot11fAssocRequest, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 0, },
-        {offsetof(tDot11fAssocRequest, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, },
+        {offsetof(tDot11fAssocRequest, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, 1, },
+        {offsetof(tDot11fAssocRequest, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fAssocRequest, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fAssocRequest, PowerCaps), offsetof(tDot11fIEPowerCaps, present), 0, "PowerCaps" , 0, 4, 4, SigIePowerCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCAPS, 0, 0, },
+        {offsetof(tDot11fAssocRequest, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, 0, },
+        {offsetof(tDot11fAssocRequest, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, 0, },
+        {offsetof(tDot11fAssocRequest, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, 0, },
+        {offsetof(tDot11fAssocRequest, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, 0, },
+        {offsetof(tDot11fAssocRequest, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, 0, },
+        {offsetof(tDot11fAssocRequest, WPAOpaque), offsetof(tDot11fIEWPAOpaque, present), 0, "WPAOpaque" , 0, 8, 255, SigIeWPAOpaque, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPAOPAQUE, 0, 0, },
+        {offsetof(tDot11fAssocRequest, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fAssocRequest, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, 0, },
+        {offsetof(tDot11fAssocRequest, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, 0, },
+        {offsetof(tDot11fAssocRequest, WscIEOpaque), offsetof(tDot11fIEWscIEOpaque, present), 0, "WscIEOpaque" , 0, 8, 255, SigIeWscIEOpaque, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCIEOPAQUE, 0, 0, },
+        {offsetof(tDot11fAssocRequest, WAPIOpaque), offsetof(tDot11fIEWAPIOpaque, present), 0, "WAPIOpaque" , 0, 8, 255, SigIeWAPIOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPIOPAQUE, 0, 0, },
+        {offsetof(tDot11fAssocRequest, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, 0, },
+        {offsetof(tDot11fAssocRequest, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, 0, },
+        {offsetof(tDot11fAssocRequest, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, 0, },
+        {offsetof(tDot11fAssocRequest, P2PIEOpaque), offsetof(tDot11fIEP2PIEOpaque, present), 0, "P2PIEOpaque" , 0, 8, 255, SigIeP2PIEOpaque, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PIEOPAQUE, 0, 0, },
+        {offsetof(tDot11fAssocRequest, WFDIEOpaque), offsetof(tDot11fIEWFDIEOpaque, present), 0, "WFDIEOpaque" , 0, 8, 255, SigIeWFDIEOpaque, {80, 111, 154, 10, 0}, 4, DOT11F_EID_WFDIEOPAQUE, 0, 0, },
+        {offsetof(tDot11fAssocRequest, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fAssocRequest, fils_session), offsetof(tDot11fIEfils_session, present), 0, "fils_session" , 0, 10, 10, SigIefils_session, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_SESSION, 4, 0, },
+        {offsetof(tDot11fAssocRequest, fils_public_key), offsetof(tDot11fIEfils_public_key, present), 0, "fils_public_key" , 0, 3, 258, SigIefils_public_key, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_PUBLIC_KEY, 12, 0, },
+        {offsetof(tDot11fAssocRequest, fils_key_confirmation), offsetof(tDot11fIEfils_key_confirmation, present), 0, "fils_key_confirmation" , 0, 2, 257, SigIefils_key_confirmation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_KEY_CONFIRMATION, 3, 0, },
+        {offsetof(tDot11fAssocRequest, fils_hlp_container), offsetof(tDot11fIEfils_hlp_container, present), 0, "fils_hlp_container" , 0, 14, 269, SigIefils_hlp_container, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_HLP_CONTAINER, 5, 0, },
+        {offsetof(tDot11fAssocRequest, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fAssocRequest, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, 0, },
+        {offsetof(tDot11fAssocRequest, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 0, 0, },
+        {offsetof(tDot11fAssocRequest, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, 0, },
+        {offsetof(tDot11fAssocRequest, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 5, 12, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, 0, },
+        {offsetof(tDot11fAssocRequest, hs20vendor_ie), offsetof(tDot11fIEhs20vendor_ie, present), 0, "hs20vendor_ie" , 0, 7, 9, SigIehs20vendor_ie, {80, 111, 154, 16, 0}, 4, DOT11F_EID_HS20VENDOR_IE, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackAssocRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fAssocRequest *pFrm)
@@ -6399,6 +6676,48 @@ tANI_U32 dot11fUnpackAssocRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 n
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("txSupDataRate (13): %d\n"), pFrm->VHTCaps.txSupDataRate);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("reserved3 (3): %d\n"), pFrm->VHTCaps.reserved3);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("fils_session:\n"));
+        if (!pFrm->fils_session.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->fils_session.session, 8);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("fils_public_key:\n"));
+        if (!pFrm->fils_public_key.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->fils_public_key.key_type, 1);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("num_public_key: %d.\n"), pFrm->fils_public_key.num_public_key);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* ) pFrm->fils_public_key.public_key, pFrm->fils_public_key.num_public_key);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("fils_key_confirmation:\n"));
+        if (!pFrm->fils_key_confirmation.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("num_key_auth: %d.\n"), pFrm->fils_key_confirmation.num_key_auth);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* ) pFrm->fils_key_confirmation.key_auth, pFrm->fils_key_confirmation.num_key_auth);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("fils_hlp_container:\n"));
+        if (!pFrm->fils_hlp_container.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->fils_hlp_container.dest_mac, 6);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->fils_hlp_container.src_mac, 6);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("num_hlp_packet: %d.\n"), pFrm->fils_hlp_container.num_hlp_packet);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* ) pFrm->fils_hlp_container.hlp_packet, pFrm->fils_hlp_container.num_hlp_packet);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("ExtCap:\n"));
         if (!pFrm->ExtCap.present)
         {
@@ -6487,6 +6806,54 @@ tANI_U32 dot11fUnpackAssocRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 n
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->vendor2_ie.VHTOperation.basicMCSSet, 2);
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("QComVendorIE:\n"));
+        if (!pFrm->QComVendorIE.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -6501,33 +6868,39 @@ tANI_U32 dot11fUnpackAssocRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 n
     };
 
     static const tIEDefn IES_AssocResponse[] = {
-        {offsetof(tDot11fAssocResponse, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fAssocResponse, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fAssocResponse, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
-        {offsetof(tDot11fAssocResponse, RCPIIE), offsetof(tDot11fIERCPIIE, present), 0, "RCPIIE" , 0, 3, 3, SigIeRCPIIE, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RCPIIE, 0, },
-        {offsetof(tDot11fAssocResponse, RSNIIE), offsetof(tDot11fIERSNIIE, present), 0, "RSNIIE" , 0, 3, 3, SigIeRSNIIE, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNIIE, 0, },
-        {offsetof(tDot11fAssocResponse, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
-        {offsetof(tDot11fAssocResponse, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fAssocResponse, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
-        {offsetof(tDot11fAssocResponse, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fAssocResponse, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, },
-        {offsetof(tDot11fAssocResponse, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, },
-        {offsetof(tDot11fAssocResponse, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, },
-        {offsetof(tDot11fAssocResponse, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fAssocResponse, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, },
-        {offsetof(tDot11fAssocResponse, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, },
-        {offsetof(tDot11fAssocResponse, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, },
-        {offsetof(tDot11fAssocResponse, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, },
-        {offsetof(tDot11fAssocResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, },
-        {offsetof(tDot11fAssocResponse, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, },
-        {offsetof(tDot11fAssocResponse, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), offsetof(tDot11fAssocResponse, num_WMMTSPEC), "WMMTSPEC" , 4, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, },
-        {offsetof(tDot11fAssocResponse, WscAssocRes), offsetof(tDot11fIEWscAssocRes, present), 0, "WscAssocRes" , 0, 6, 37, SigIeWscAssocRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCASSOCRES, 0, },
-        {offsetof(tDot11fAssocResponse, P2PAssocRes), offsetof(tDot11fIEP2PAssocRes, present), 0, "P2PAssocRes" , 0, 6, 17, SigIeP2PAssocRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PASSOCRES, 0, },
-        {offsetof(tDot11fAssocResponse, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fAssocResponse, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
-        {offsetof(tDot11fAssocResponse, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fAssocResponse, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, },
-        {offsetof(tDot11fAssocResponse, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 0, },
-        {offsetof(tDot11fAssocResponse, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, },
+        {offsetof(tDot11fAssocResponse, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fAssocResponse, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fAssocResponse, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, 0, },
+        {offsetof(tDot11fAssocResponse, RCPIIE), offsetof(tDot11fIERCPIIE, present), 0, "RCPIIE" , 0, 3, 3, SigIeRCPIIE, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RCPIIE, 0, 0, },
+        {offsetof(tDot11fAssocResponse, RSNIIE), offsetof(tDot11fIERSNIIE, present), 0, "RSNIIE" , 0, 3, 3, SigIeRSNIIE, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNIIE, 0, 0, },
+        {offsetof(tDot11fAssocResponse, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, 0, },
+        {offsetof(tDot11fAssocResponse, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, 0, },
+        {offsetof(tDot11fAssocResponse, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, 0, },
+        {offsetof(tDot11fAssocResponse, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fAssocResponse, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, 0, },
+        {offsetof(tDot11fAssocResponse, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, 0, },
+        {offsetof(tDot11fAssocResponse, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, 0, },
+        {offsetof(tDot11fAssocResponse, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fAssocResponse, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, 0, },
+        {offsetof(tDot11fAssocResponse, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, 0, },
+        {offsetof(tDot11fAssocResponse, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, 0, },
+        {offsetof(tDot11fAssocResponse, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, 0, },
+        {offsetof(tDot11fAssocResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, 0, },
+        {offsetof(tDot11fAssocResponse, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, 0, },
+        {offsetof(tDot11fAssocResponse, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), offsetof(tDot11fAssocResponse, num_WMMTSPEC), "WMMTSPEC" , 4, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, 0, },
+        {offsetof(tDot11fAssocResponse, WscAssocRes), offsetof(tDot11fIEWscAssocRes, present), 0, "WscAssocRes" , 0, 6, 37, SigIeWscAssocRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCASSOCRES, 0, 0, },
+        {offsetof(tDot11fAssocResponse, P2PAssocRes), offsetof(tDot11fIEP2PAssocRes, present), 0, "P2PAssocRes" , 0, 6, 17, SigIeP2PAssocRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PASSOCRES, 0, 0, },
+        {offsetof(tDot11fAssocResponse, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fAssocResponse, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, 0, },
+        {offsetof(tDot11fAssocResponse, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fAssocResponse, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, 0, },
+        {offsetof(tDot11fAssocResponse, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 0, 0, },
+        {offsetof(tDot11fAssocResponse, fils_session), offsetof(tDot11fIEfils_session, present), 0, "fils_session" , 0, 10, 10, SigIefils_session, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_SESSION, 4, 0, },
+        {offsetof(tDot11fAssocResponse, fils_public_key), offsetof(tDot11fIEfils_public_key, present), 0, "fils_public_key" , 0, 3, 258, SigIefils_public_key, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_PUBLIC_KEY, 12, 0, },
+        {offsetof(tDot11fAssocResponse, fils_key_confirmation), offsetof(tDot11fIEfils_key_confirmation, present), 0, "fils_key_confirmation" , 0, 2, 257, SigIefils_key_confirmation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_KEY_CONFIRMATION, 3, 0, },
+        {offsetof(tDot11fAssocResponse, fils_hlp_container), offsetof(tDot11fIEfils_hlp_container, present), 0, "fils_hlp_container" , 0, 14, 269, SigIefils_hlp_container, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_HLP_CONTAINER, 5, 0, },
+        {offsetof(tDot11fAssocResponse, fils_kde), offsetof(tDot11fIEfils_kde, present), 0, "fils_kde" , 0, 10, 265, SigIefils_kde, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_KDE, 7, 0, },
+        {offsetof(tDot11fAssocResponse, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, 0, },
+        {offsetof(tDot11fAssocResponse, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 5, 12, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackAssocResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fAssocResponse *pFrm)
@@ -7423,6 +7796,59 @@ tANI_U32 dot11fUnpackAssocResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_dscp_exceptions: %d.\n"), pFrm->QosMapSet.num_dscp_exceptions);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->QosMapSet.dscp_exceptions, pFrm->QosMapSet.num_dscp_exceptions);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_session:\n"));
+        if (!pFrm->fils_session.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_session.session, 8);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_public_key:\n"));
+        if (!pFrm->fils_public_key.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_public_key.key_type, 1);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_public_key: %d.\n"), pFrm->fils_public_key.num_public_key);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->fils_public_key.public_key, pFrm->fils_public_key.num_public_key);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_key_confirmation:\n"));
+        if (!pFrm->fils_key_confirmation.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_key_auth: %d.\n"), pFrm->fils_key_confirmation.num_key_auth);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->fils_key_confirmation.key_auth, pFrm->fils_key_confirmation.num_key_auth);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_hlp_container:\n"));
+        if (!pFrm->fils_hlp_container.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_hlp_container.dest_mac, 6);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_hlp_container.src_mac, 6);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_hlp_packet: %d.\n"), pFrm->fils_hlp_container.num_hlp_packet);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->fils_hlp_container.hlp_packet, pFrm->fils_hlp_container.num_hlp_packet);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_kde:\n"));
+        if (!pFrm->fils_kde.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_kde.key_rsc, 8);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_kde_list: %d.\n"), pFrm->fils_kde.num_kde_list);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->fils_kde.kde_list, pFrm->fils_kde.num_kde_list);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("vendor2_ie:\n"));
         if (!pFrm->vendor2_ie.present)
         {
@@ -7479,6 +7905,33 @@ tANI_U32 dot11fUnpackAssocResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->vendor2_ie.VHTOperation.basicMCSSet, 2);
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("QComVendorIE:\n"));
+        if (!pFrm->QComVendorIE.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -7493,12 +7946,16 @@ tANI_U32 dot11fUnpackAssocResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
     };
 
     static const tIEDefn IES_Authentication[] = {
-        {offsetof(tDot11fAuthentication, ChallengeText), offsetof(tDot11fIEChallengeText, present), 0, "ChallengeText" , 0, 3, 255, SigIeChallengeText, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHALLENGETEXT, 0, },
-        {offsetof(tDot11fAuthentication, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
-        {offsetof(tDot11fAuthentication, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fAuthentication, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
-        {offsetof(tDot11fAuthentication, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, },
-        {offsetof(tDot11fAuthentication, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fAuthentication, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, },
+        {offsetof(tDot11fAuthentication, ChallengeText), offsetof(tDot11fIEChallengeText, present), 0, "ChallengeText" , 0, 3, 255, SigIeChallengeText, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHALLENGETEXT, 0, 0, },
+        {offsetof(tDot11fAuthentication, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, 0, },
+        {offsetof(tDot11fAuthentication, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, 0, },
+        {offsetof(tDot11fAuthentication, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, 0, },
+        {offsetof(tDot11fAuthentication, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, 0, },
+        {offsetof(tDot11fAuthentication, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fAuthentication, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, 0, },
+        {offsetof(tDot11fAuthentication, fils_nonce), offsetof(tDot11fIEfils_nonce, present), 0, "fils_nonce" , 0, 18, 18, SigIefils_nonce, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_NONCE, 13, 0, },
+        {offsetof(tDot11fAuthentication, fils_session), offsetof(tDot11fIEfils_session, present), 0, "fils_session" , 0, 10, 10, SigIefils_session, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_SESSION, 4, 0, },
+        {offsetof(tDot11fAuthentication, fils_wrapped_data), offsetof(tDot11fIEfils_wrapped_data, present), 0, "fils_wrapped_data" , 0, 2, 257, SigIefils_wrapped_data, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_WRAPPED_DATA, 8, 0, },
+        {offsetof(tDot11fAuthentication, fils_assoc_delay_info), offsetof(tDot11fIEfils_assoc_delay_info, present), 0, "fils_assoc_delay_info" , 0, 3, 3, SigIefils_assoc_delay_info, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_ASSOC_DELAY_INFO, 1, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackAuthentication(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fAuthentication *pFrm)
@@ -7888,6 +8345,43 @@ tANI_U32 dot11fUnpackAuthentication(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
                 }
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("fils_nonce:\n"));
+        if (!pFrm->fils_nonce.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->fils_nonce.nonce, 16);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("fils_session:\n"));
+        if (!pFrm->fils_session.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->fils_session.session, 8);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("fils_wrapped_data:\n"));
+        if (!pFrm->fils_wrapped_data.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("num_wrapped_data: %d.\n"), pFrm->fils_wrapped_data.num_wrapped_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* ) pFrm->fils_wrapped_data.wrapped_data, pFrm->fils_wrapped_data.num_wrapped_data);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("fils_assoc_delay_info:\n"));
+        if (!pFrm->fils_assoc_delay_info.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->fils_assoc_delay_info.assoc_delay_info, 1);
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -7902,57 +8396,59 @@ tANI_U32 dot11fUnpackAuthentication(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
     };
 
     static const tIEDefn IES_Beacon[] = {
-        {offsetof(tDot11fBeacon, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 1, },
-        {offsetof(tDot11fBeacon, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fBeacon, FHParamSet), offsetof(tDot11fIEFHParamSet, present), 0, "FHParamSet" , 0, 7, 7, SigIeFHParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMSET, 0, },
-        {offsetof(tDot11fBeacon, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, },
-        {offsetof(tDot11fBeacon, CFParams), offsetof(tDot11fIECFParams, present), 0, "CFParams" , 0, 8, 8, SigIeCFParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CFPARAMS, 0, },
-        {offsetof(tDot11fBeacon, IBSSParams), offsetof(tDot11fIEIBSSParams, present), 0, "IBSSParams" , 0, 4, 4, SigIeIBSSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IBSSPARAMS, 0, },
-        {offsetof(tDot11fBeacon, TIM), offsetof(tDot11fIETIM, present), 0, "TIM" , 0, 6, 256, SigIeTIM, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIM, 0, },
-        {offsetof(tDot11fBeacon, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, },
-        {offsetof(tDot11fBeacon, FHParams), offsetof(tDot11fIEFHParams, present), 0, "FHParams" , 0, 4, 4, SigIeFHParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMS, 0, },
-        {offsetof(tDot11fBeacon, FHPattTable), offsetof(tDot11fIEFHPattTable, present), 0, "FHPattTable" , 0, 6, 257, SigIeFHPattTable, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPATTTABLE, 0, },
-        {offsetof(tDot11fBeacon, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, },
-        {offsetof(tDot11fBeacon, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 0, },
-        {offsetof(tDot11fBeacon, ext_chan_switch_ann), offsetof(tDot11fIEext_chan_switch_ann, present), 0, "ext_chan_switch_ann" , 0, 6, 6, SigIeext_chan_switch_ann, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXT_CHAN_SWITCH_ANN, 0, },
-        {offsetof(tDot11fBeacon, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, },
-        {offsetof(tDot11fBeacon, Quiet), offsetof(tDot11fIEQuiet, present), 0, "Quiet" , 0, 8, 8, SigIeQuiet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QUIET, 0, },
-        {offsetof(tDot11fBeacon, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, },
-        {offsetof(tDot11fBeacon, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, },
-        {offsetof(tDot11fBeacon, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fBeacon, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
-        {offsetof(tDot11fBeacon, QBSSLoad), offsetof(tDot11fIEQBSSLoad, present), 0, "QBSSLoad" , 0, 7, 7, SigIeQBSSLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QBSSLOAD, 0, },
-        {offsetof(tDot11fBeacon, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
-        {offsetof(tDot11fBeacon, QOSCapsAp), offsetof(tDot11fIEQOSCapsAp, present), 0, "QOSCapsAp" , 0, 3, 3, SigIeQOSCapsAp, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSAP, 0, },
-        {offsetof(tDot11fBeacon, APChannelReport), offsetof(tDot11fIEAPChannelReport, present), 0, "APChannelReport" , 0, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, },
-        {offsetof(tDot11fBeacon, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
-        {offsetof(tDot11fBeacon, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fBeacon, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, },
-        {offsetof(tDot11fBeacon, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fBeacon, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, },
-        {offsetof(tDot11fBeacon, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, },
-        {offsetof(tDot11fBeacon, WMMInfoAp), offsetof(tDot11fIEWMMInfoAp, present), 0, "WMMInfoAp" , 0, 9, 9, SigIeWMMInfoAp, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOAP, 0, },
-        {offsetof(tDot11fBeacon, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, },
-        {offsetof(tDot11fBeacon, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, },
-        {offsetof(tDot11fBeacon, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, },
-        {offsetof(tDot11fBeacon, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, },
-        {offsetof(tDot11fBeacon, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, },
-        {offsetof(tDot11fBeacon, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, },
-        {offsetof(tDot11fBeacon, WscBeacon), offsetof(tDot11fIEWscBeacon, present), 0, "WscBeacon" , 0, 6, 84, SigIeWscBeacon, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCBEACON, 0, },
-        {offsetof(tDot11fBeacon, P2PBeacon), offsetof(tDot11fIEP2PBeacon, present), 0, "P2PBeacon" , 0, 6, 61, SigIeP2PBeacon, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PBEACON, 0, },
-        {offsetof(tDot11fBeacon, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fBeacon, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
-        {offsetof(tDot11fBeacon, VHTExtBssLoad), offsetof(tDot11fIEVHTExtBssLoad, present), 0, "VHTExtBssLoad" , 0, 7, 7, SigIeVHTExtBssLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTEXTBSSLOAD, 0, },
-        {offsetof(tDot11fBeacon, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fBeacon, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
-        {offsetof(tDot11fBeacon, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, },
-        {offsetof(tDot11fBeacon, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, },
-        {offsetof(tDot11fBeacon, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, },
-        {offsetof(tDot11fBeacon, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, },
-        {offsetof(tDot11fBeacon, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, },
-        {offsetof(tDot11fBeacon, ChannelSwitchWrapper), offsetof(tDot11fIEChannelSwitchWrapper, present), 0, "ChannelSwitchWrapper" , 0, 2, 7, SigIeChannelSwitchWrapper, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANNELSWITCHWRAPPER, 0, },
-        {offsetof(tDot11fBeacon, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 7, 7, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, },
-        {offsetof(tDot11fBeacon, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, },
+        {offsetof(tDot11fBeacon, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, 1, },
+        {offsetof(tDot11fBeacon, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fBeacon, FHParamSet), offsetof(tDot11fIEFHParamSet, present), 0, "FHParamSet" , 0, 7, 7, SigIeFHParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMSET, 0, 0, },
+        {offsetof(tDot11fBeacon, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, 0, },
+        {offsetof(tDot11fBeacon, CFParams), offsetof(tDot11fIECFParams, present), 0, "CFParams" , 0, 8, 8, SigIeCFParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CFPARAMS, 0, 0, },
+        {offsetof(tDot11fBeacon, IBSSParams), offsetof(tDot11fIEIBSSParams, present), 0, "IBSSParams" , 0, 4, 4, SigIeIBSSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IBSSPARAMS, 0, 0, },
+        {offsetof(tDot11fBeacon, TIM), offsetof(tDot11fIETIM, present), 0, "TIM" , 0, 6, 256, SigIeTIM, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIM, 0, 0, },
+        {offsetof(tDot11fBeacon, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, 0, },
+        {offsetof(tDot11fBeacon, FHParams), offsetof(tDot11fIEFHParams, present), 0, "FHParams" , 0, 4, 4, SigIeFHParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMS, 0, 0, },
+        {offsetof(tDot11fBeacon, FHPattTable), offsetof(tDot11fIEFHPattTable, present), 0, "FHPattTable" , 0, 6, 257, SigIeFHPattTable, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPATTTABLE, 0, 0, },
+        {offsetof(tDot11fBeacon, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, 0, },
+        {offsetof(tDot11fBeacon, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 0, 0, },
+        {offsetof(tDot11fBeacon, ext_chan_switch_ann), offsetof(tDot11fIEext_chan_switch_ann, present), 0, "ext_chan_switch_ann" , 0, 6, 6, SigIeext_chan_switch_ann, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXT_CHAN_SWITCH_ANN, 0, 0, },
+        {offsetof(tDot11fBeacon, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, 0, },
+        {offsetof(tDot11fBeacon, Quiet), offsetof(tDot11fIEQuiet, present), 0, "Quiet" , 0, 8, 8, SigIeQuiet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QUIET, 0, 0, },
+        {offsetof(tDot11fBeacon, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, 0, },
+        {offsetof(tDot11fBeacon, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, 0, },
+        {offsetof(tDot11fBeacon, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fBeacon, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, 0, },
+        {offsetof(tDot11fBeacon, QBSSLoad), offsetof(tDot11fIEQBSSLoad, present), 0, "QBSSLoad" , 0, 7, 7, SigIeQBSSLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QBSSLOAD, 0, 0, },
+        {offsetof(tDot11fBeacon, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, 0, },
+        {offsetof(tDot11fBeacon, QOSCapsAp), offsetof(tDot11fIEQOSCapsAp, present), 0, "QOSCapsAp" , 0, 3, 3, SigIeQOSCapsAp, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSAP, 0, 0, },
+        {offsetof(tDot11fBeacon, APChannelReport), offsetof(tDot11fIEAPChannelReport, present), 0, "APChannelReport" , 0, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, 0, },
+        {offsetof(tDot11fBeacon, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, 0, },
+        {offsetof(tDot11fBeacon, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, 0, },
+        {offsetof(tDot11fBeacon, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, 0, },
+        {offsetof(tDot11fBeacon, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fBeacon, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, 0, },
+        {offsetof(tDot11fBeacon, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, 0, },
+        {offsetof(tDot11fBeacon, WMMInfoAp), offsetof(tDot11fIEWMMInfoAp, present), 0, "WMMInfoAp" , 0, 9, 9, SigIeWMMInfoAp, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOAP, 0, 0, },
+        {offsetof(tDot11fBeacon, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, 0, },
+        {offsetof(tDot11fBeacon, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, 0, },
+        {offsetof(tDot11fBeacon, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, 0, },
+        {offsetof(tDot11fBeacon, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, 0, },
+        {offsetof(tDot11fBeacon, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, 0, },
+        {offsetof(tDot11fBeacon, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, 0, },
+        {offsetof(tDot11fBeacon, WscBeacon), offsetof(tDot11fIEWscBeacon, present), 0, "WscBeacon" , 0, 6, 84, SigIeWscBeacon, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCBEACON, 0, 0, },
+        {offsetof(tDot11fBeacon, P2PBeacon), offsetof(tDot11fIEP2PBeacon, present), 0, "P2PBeacon" , 0, 6, 61, SigIeP2PBeacon, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PBEACON, 0, 0, },
+        {offsetof(tDot11fBeacon, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fBeacon, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, 0, },
+        {offsetof(tDot11fBeacon, VHTExtBssLoad), offsetof(tDot11fIEVHTExtBssLoad, present), 0, "VHTExtBssLoad" , 0, 7, 7, SigIeVHTExtBssLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTEXTBSSLOAD, 0, 0, },
+        {offsetof(tDot11fBeacon, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fBeacon, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, 0, },
+        {offsetof(tDot11fBeacon, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, 0, },
+        {offsetof(tDot11fBeacon, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, 0, },
+        {offsetof(tDot11fBeacon, fils_indication), offsetof(tDot11fIEfils_indication, present), 0, "fils_indication" , 0, 7, 259, SigIefils_indication, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_INDICATION, 0, 0, },
+        {offsetof(tDot11fBeacon, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, 0, },
+        {offsetof(tDot11fBeacon, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, 0, },
+        {offsetof(tDot11fBeacon, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, 0, },
+        {offsetof(tDot11fBeacon, hs20vendor_ie), offsetof(tDot11fIEhs20vendor_ie, present), 0, "hs20vendor_ie" , 0, 7, 9, SigIehs20vendor_ie, {80, 111, 154, 16, 0}, 4, DOT11F_EID_HS20VENDOR_IE, 0, 0, },
+        {offsetof(tDot11fBeacon, ChannelSwitchWrapper), offsetof(tDot11fIEChannelSwitchWrapper, present), 0, "ChannelSwitchWrapper" , 0, 2, 14, SigIeChannelSwitchWrapper, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANNELSWITCHWRAPPER, 0, 0, },
+        {offsetof(tDot11fBeacon, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 5, 12, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, 0, },
+        {offsetof(tDot11fBeacon, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackBeacon(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fBeacon *pFrm)
@@ -8816,6 +9312,25 @@ tANI_U32 dot11fUnpackBeacon(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, t
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->OBSSScanParameters.bssWidthChannelTransitionDelayFactor, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->OBSSScanParameters.obssScanActivityThreshold, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("fils_indication:\n"));
+        if (!pFrm->fils_indication.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("public_key_identifiers_cnt (3): %d\n"), pFrm->fils_indication.public_key_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("realm_identifiers_cnt (3): %d\n"), pFrm->fils_indication.realm_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_ip_config_supported (1): %d\n"), pFrm->fils_indication.is_ip_config_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_cache_id_present (1): %d\n"), pFrm->fils_indication.is_cache_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_hessid_present (1): %d\n"), pFrm->fils_indication.is_hessid_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_fils_sk_auth_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_fils_sk_auth_pfs_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_pfs_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_pk_auth_supported (1): %d\n"), pFrm->fils_indication.is_pk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("reserved (4): %d\n"), pFrm->fils_indication.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("num_variable_data: %d.\n"), pFrm->fils_indication.num_variable_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* ) pFrm->fils_indication.variable_data, pFrm->fils_indication.num_variable_data);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Vendor1IE:\n"));
         if (!pFrm->Vendor1IE.present)
         {
@@ -8888,6 +9403,27 @@ tANI_U32 dot11fUnpackBeacon(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, t
         else
         {
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("ChannelSwitchWrapper:\n"));
         if (!pFrm->ChannelSwitchWrapper.present)
         {
@@ -8906,6 +9442,16 @@ tANI_U32 dot11fUnpackBeacon(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, t
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("vht_transmit_power_env:\n"));
+            if (!pFrm->ChannelSwitchWrapper.vht_transmit_power_env.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("num_bytes: %d.\n"), pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* ) pFrm->ChannelSwitchWrapper.vht_transmit_power_env.bytes, pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("QComVendorIE:\n"));
         if (!pFrm->QComVendorIE.present)
@@ -8914,8 +9460,25 @@ tANI_U32 dot11fUnpackBeacon(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, t
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.type, 1);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.channel, 1);
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("ESEVersion:\n"));
         if (!pFrm->ESEVersion.present)
@@ -8940,10 +9503,10 @@ tANI_U32 dot11fUnpackBeacon(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, t
     };
 
     static const tIEDefn IES_Beacon1[] = {
-        {offsetof(tDot11fBeacon1, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 1, },
-        {offsetof(tDot11fBeacon1, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fBeacon1, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, },
-        {offsetof(tDot11fBeacon1, IBSSParams), offsetof(tDot11fIEIBSSParams, present), 0, "IBSSParams" , 0, 4, 4, SigIeIBSSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IBSSPARAMS, 0, },
+        {offsetof(tDot11fBeacon1, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, 1, },
+        {offsetof(tDot11fBeacon1, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fBeacon1, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, 0, },
+        {offsetof(tDot11fBeacon1, IBSSParams), offsetof(tDot11fIEIBSSParams, present), 0, "IBSSParams" , 0, 4, 4, SigIeIBSSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IBSSPARAMS, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackBeacon1(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fBeacon1 *pFrm)
@@ -9029,46 +9592,48 @@ tANI_U32 dot11fUnpackBeacon1(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
     };
 
     static const tIEDefn IES_Beacon2[] = {
-        {offsetof(tDot11fBeacon2, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, },
-        {offsetof(tDot11fBeacon2, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, },
-        {offsetof(tDot11fBeacon2, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 0, },
-        {offsetof(tDot11fBeacon2, ext_chan_switch_ann), offsetof(tDot11fIEext_chan_switch_ann, present), 0, "ext_chan_switch_ann" , 0, 6, 6, SigIeext_chan_switch_ann, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXT_CHAN_SWITCH_ANN, 0, },
-        {offsetof(tDot11fBeacon2, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, },
-        {offsetof(tDot11fBeacon2, Quiet), offsetof(tDot11fIEQuiet, present), 0, "Quiet" , 0, 8, 8, SigIeQuiet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QUIET, 0, },
-        {offsetof(tDot11fBeacon2, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, },
-        {offsetof(tDot11fBeacon2, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, },
-        {offsetof(tDot11fBeacon2, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fBeacon2, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
-        {offsetof(tDot11fBeacon2, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
-        {offsetof(tDot11fBeacon2, APChannelReport), offsetof(tDot11fIEAPChannelReport, present), 0, "APChannelReport" , 0, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, },
-        {offsetof(tDot11fBeacon2, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
-        {offsetof(tDot11fBeacon2, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fBeacon2, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, },
-        {offsetof(tDot11fBeacon2, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fBeacon2, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, },
-        {offsetof(tDot11fBeacon2, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, },
-        {offsetof(tDot11fBeacon2, WMMInfoAp), offsetof(tDot11fIEWMMInfoAp, present), 0, "WMMInfoAp" , 0, 9, 9, SigIeWMMInfoAp, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOAP, 0, },
-        {offsetof(tDot11fBeacon2, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, },
-        {offsetof(tDot11fBeacon2, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, },
-        {offsetof(tDot11fBeacon2, WscBeacon), offsetof(tDot11fIEWscBeacon, present), 0, "WscBeacon" , 0, 6, 84, SigIeWscBeacon, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCBEACON, 0, },
-        {offsetof(tDot11fBeacon2, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, },
-        {offsetof(tDot11fBeacon2, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, },
-        {offsetof(tDot11fBeacon2, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, },
-        {offsetof(tDot11fBeacon2, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, },
-        {offsetof(tDot11fBeacon2, P2PBeacon), offsetof(tDot11fIEP2PBeacon, present), 0, "P2PBeacon" , 0, 6, 61, SigIeP2PBeacon, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PBEACON, 0, },
-        {offsetof(tDot11fBeacon2, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fBeacon2, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
-        {offsetof(tDot11fBeacon2, VHTExtBssLoad), offsetof(tDot11fIEVHTExtBssLoad, present), 0, "VHTExtBssLoad" , 0, 7, 7, SigIeVHTExtBssLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTEXTBSSLOAD, 0, },
-        {offsetof(tDot11fBeacon2, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fBeacon2, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
-        {offsetof(tDot11fBeacon2, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, },
-        {offsetof(tDot11fBeacon2, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, },
-        {offsetof(tDot11fBeacon2, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, },
-        {offsetof(tDot11fBeacon2, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, },
-        {offsetof(tDot11fBeacon2, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, },
-        {offsetof(tDot11fBeacon2, ChannelSwitchWrapper), offsetof(tDot11fIEChannelSwitchWrapper, present), 0, "ChannelSwitchWrapper" , 0, 2, 7, SigIeChannelSwitchWrapper, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANNELSWITCHWRAPPER, 0, },
-        {offsetof(tDot11fBeacon2, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 7, 7, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, },
-        {offsetof(tDot11fBeacon2, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, },
+        {offsetof(tDot11fBeacon2, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, 0, },
+        {offsetof(tDot11fBeacon2, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, 0, },
+        {offsetof(tDot11fBeacon2, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 0, 0, },
+        {offsetof(tDot11fBeacon2, ext_chan_switch_ann), offsetof(tDot11fIEext_chan_switch_ann, present), 0, "ext_chan_switch_ann" , 0, 6, 6, SigIeext_chan_switch_ann, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXT_CHAN_SWITCH_ANN, 0, 0, },
+        {offsetof(tDot11fBeacon2, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, 0, },
+        {offsetof(tDot11fBeacon2, Quiet), offsetof(tDot11fIEQuiet, present), 0, "Quiet" , 0, 8, 8, SigIeQuiet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QUIET, 0, 0, },
+        {offsetof(tDot11fBeacon2, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, 0, },
+        {offsetof(tDot11fBeacon2, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, 0, },
+        {offsetof(tDot11fBeacon2, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fBeacon2, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, 0, },
+        {offsetof(tDot11fBeacon2, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, 0, },
+        {offsetof(tDot11fBeacon2, APChannelReport), offsetof(tDot11fIEAPChannelReport, present), 0, "APChannelReport" , 0, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, 0, },
+        {offsetof(tDot11fBeacon2, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, 0, },
+        {offsetof(tDot11fBeacon2, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, 0, },
+        {offsetof(tDot11fBeacon2, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, 0, },
+        {offsetof(tDot11fBeacon2, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fBeacon2, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, 0, },
+        {offsetof(tDot11fBeacon2, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, 0, },
+        {offsetof(tDot11fBeacon2, WMMInfoAp), offsetof(tDot11fIEWMMInfoAp, present), 0, "WMMInfoAp" , 0, 9, 9, SigIeWMMInfoAp, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOAP, 0, 0, },
+        {offsetof(tDot11fBeacon2, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, 0, },
+        {offsetof(tDot11fBeacon2, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, 0, },
+        {offsetof(tDot11fBeacon2, WscBeacon), offsetof(tDot11fIEWscBeacon, present), 0, "WscBeacon" , 0, 6, 84, SigIeWscBeacon, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCBEACON, 0, 0, },
+        {offsetof(tDot11fBeacon2, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, 0, },
+        {offsetof(tDot11fBeacon2, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, 0, },
+        {offsetof(tDot11fBeacon2, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, 0, },
+        {offsetof(tDot11fBeacon2, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, 0, },
+        {offsetof(tDot11fBeacon2, P2PBeacon), offsetof(tDot11fIEP2PBeacon, present), 0, "P2PBeacon" , 0, 6, 61, SigIeP2PBeacon, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PBEACON, 0, 0, },
+        {offsetof(tDot11fBeacon2, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fBeacon2, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, 0, },
+        {offsetof(tDot11fBeacon2, VHTExtBssLoad), offsetof(tDot11fIEVHTExtBssLoad, present), 0, "VHTExtBssLoad" , 0, 7, 7, SigIeVHTExtBssLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTEXTBSSLOAD, 0, 0, },
+        {offsetof(tDot11fBeacon2, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fBeacon2, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, 0, },
+        {offsetof(tDot11fBeacon2, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, 0, },
+        {offsetof(tDot11fBeacon2, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, 0, },
+        {offsetof(tDot11fBeacon2, fils_indication), offsetof(tDot11fIEfils_indication, present), 0, "fils_indication" , 0, 7, 259, SigIefils_indication, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_INDICATION, 0, 0, },
+        {offsetof(tDot11fBeacon2, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, 0, },
+        {offsetof(tDot11fBeacon2, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, 0, },
+        {offsetof(tDot11fBeacon2, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, 0, },
+        {offsetof(tDot11fBeacon2, hs20vendor_ie), offsetof(tDot11fIEhs20vendor_ie, present), 0, "hs20vendor_ie" , 0, 7, 9, SigIehs20vendor_ie, {80, 111, 154, 16, 0}, 4, DOT11F_EID_HS20VENDOR_IE, 0, 0, },
+        {offsetof(tDot11fBeacon2, ChannelSwitchWrapper), offsetof(tDot11fIEChannelSwitchWrapper, present), 0, "ChannelSwitchWrapper" , 0, 2, 14, SigIeChannelSwitchWrapper, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANNELSWITCHWRAPPER, 0, 0, },
+        {offsetof(tDot11fBeacon2, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 5, 12, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, 0, },
+        {offsetof(tDot11fBeacon2, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackBeacon2(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fBeacon2 *pFrm)
@@ -9780,6 +10345,25 @@ tANI_U32 dot11fUnpackBeacon2(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->OBSSScanParameters.bssWidthChannelTransitionDelayFactor, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->OBSSScanParameters.obssScanActivityThreshold, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("fils_indication:\n"));
+        if (!pFrm->fils_indication.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("public_key_identifiers_cnt (3): %d\n"), pFrm->fils_indication.public_key_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("realm_identifiers_cnt (3): %d\n"), pFrm->fils_indication.realm_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_ip_config_supported (1): %d\n"), pFrm->fils_indication.is_ip_config_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_cache_id_present (1): %d\n"), pFrm->fils_indication.is_cache_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_hessid_present (1): %d\n"), pFrm->fils_indication.is_hessid_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_fils_sk_auth_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_fils_sk_auth_pfs_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_pfs_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_pk_auth_supported (1): %d\n"), pFrm->fils_indication.is_pk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("reserved (4): %d\n"), pFrm->fils_indication.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("num_variable_data: %d.\n"), pFrm->fils_indication.num_variable_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->fils_indication.variable_data, pFrm->fils_indication.num_variable_data);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Vendor1IE:\n"));
         if (!pFrm->Vendor1IE.present)
         {
@@ -9852,6 +10436,27 @@ tANI_U32 dot11fUnpackBeacon2(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
         else
         {
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("ChannelSwitchWrapper:\n"));
         if (!pFrm->ChannelSwitchWrapper.present)
         {
@@ -9870,6 +10475,16 @@ tANI_U32 dot11fUnpackBeacon2(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("vht_transmit_power_env:\n"));
+            if (!pFrm->ChannelSwitchWrapper.vht_transmit_power_env.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("num_bytes: %d.\n"), pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->ChannelSwitchWrapper.vht_transmit_power_env.bytes, pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("QComVendorIE:\n"));
         if (!pFrm->QComVendorIE.present)
@@ -9878,8 +10493,25 @@ tANI_U32 dot11fUnpackBeacon2(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.type, 1);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.channel, 1);
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("ESEVersion:\n"));
         if (!pFrm->ESEVersion.present)
@@ -9901,57 +10533,59 @@ tANI_U32 dot11fUnpackBeacon2(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
     };
 
     static const tIEDefn IES_BeaconIEs[] = {
-        {offsetof(tDot11fBeaconIEs, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 1, },
-        {offsetof(tDot11fBeaconIEs, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fBeaconIEs, FHParamSet), offsetof(tDot11fIEFHParamSet, present), 0, "FHParamSet" , 0, 7, 7, SigIeFHParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMSET, 0, },
-        {offsetof(tDot11fBeaconIEs, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, },
-        {offsetof(tDot11fBeaconIEs, CFParams), offsetof(tDot11fIECFParams, present), 0, "CFParams" , 0, 8, 8, SigIeCFParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CFPARAMS, 0, },
-        {offsetof(tDot11fBeaconIEs, IBSSParams), offsetof(tDot11fIEIBSSParams, present), 0, "IBSSParams" , 0, 4, 4, SigIeIBSSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IBSSPARAMS, 0, },
-        {offsetof(tDot11fBeaconIEs, TIM), offsetof(tDot11fIETIM, present), 0, "TIM" , 0, 6, 256, SigIeTIM, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIM, 0, },
-        {offsetof(tDot11fBeaconIEs, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, },
-        {offsetof(tDot11fBeaconIEs, FHParams), offsetof(tDot11fIEFHParams, present), 0, "FHParams" , 0, 4, 4, SigIeFHParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMS, 0, },
-        {offsetof(tDot11fBeaconIEs, FHPattTable), offsetof(tDot11fIEFHPattTable, present), 0, "FHPattTable" , 0, 6, 257, SigIeFHPattTable, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPATTTABLE, 0, },
-        {offsetof(tDot11fBeaconIEs, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, },
-        {offsetof(tDot11fBeaconIEs, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 0, },
-        {offsetof(tDot11fBeaconIEs, ext_chan_switch_ann), offsetof(tDot11fIEext_chan_switch_ann, present), 0, "ext_chan_switch_ann" , 0, 6, 6, SigIeext_chan_switch_ann, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXT_CHAN_SWITCH_ANN, 0, },
-        {offsetof(tDot11fBeaconIEs, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, },
-        {offsetof(tDot11fBeaconIEs, Quiet), offsetof(tDot11fIEQuiet, present), 0, "Quiet" , 0, 8, 8, SigIeQuiet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QUIET, 0, },
-        {offsetof(tDot11fBeaconIEs, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, },
-        {offsetof(tDot11fBeaconIEs, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, },
-        {offsetof(tDot11fBeaconIEs, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fBeaconIEs, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
-        {offsetof(tDot11fBeaconIEs, QBSSLoad), offsetof(tDot11fIEQBSSLoad, present), 0, "QBSSLoad" , 0, 7, 7, SigIeQBSSLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QBSSLOAD, 0, },
-        {offsetof(tDot11fBeaconIEs, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
-        {offsetof(tDot11fBeaconIEs, QOSCapsAp), offsetof(tDot11fIEQOSCapsAp, present), 0, "QOSCapsAp" , 0, 3, 3, SigIeQOSCapsAp, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSAP, 0, },
-        {offsetof(tDot11fBeaconIEs, APChannelReport), offsetof(tDot11fIEAPChannelReport, present), 0, "APChannelReport" , 0, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, },
-        {offsetof(tDot11fBeaconIEs, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
-        {offsetof(tDot11fBeaconIEs, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fBeaconIEs, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, },
-        {offsetof(tDot11fBeaconIEs, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fBeaconIEs, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, },
-        {offsetof(tDot11fBeaconIEs, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, },
-        {offsetof(tDot11fBeaconIEs, WMMInfoAp), offsetof(tDot11fIEWMMInfoAp, present), 0, "WMMInfoAp" , 0, 9, 9, SigIeWMMInfoAp, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOAP, 0, },
-        {offsetof(tDot11fBeaconIEs, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, },
-        {offsetof(tDot11fBeaconIEs, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, },
-        {offsetof(tDot11fBeaconIEs, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, },
-        {offsetof(tDot11fBeaconIEs, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, },
-        {offsetof(tDot11fBeaconIEs, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, },
-        {offsetof(tDot11fBeaconIEs, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, },
-        {offsetof(tDot11fBeaconIEs, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, },
-        {offsetof(tDot11fBeaconIEs, WscBeaconProbeRes), offsetof(tDot11fIEWscBeaconProbeRes, present), 0, "WscBeaconProbeRes" , 0, 6, 319, SigIeWscBeaconProbeRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCBEACONPROBERES, 0, },
-        {offsetof(tDot11fBeaconIEs, P2PBeaconProbeRes), offsetof(tDot11fIEP2PBeaconProbeRes, present), 0, "P2PBeaconProbeRes" , 0, 6, 1150, SigIeP2PBeaconProbeRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PBEACONPROBERES, 0, },
-        {offsetof(tDot11fBeaconIEs, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fBeaconIEs, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
-        {offsetof(tDot11fBeaconIEs, VHTExtBssLoad), offsetof(tDot11fIEVHTExtBssLoad, present), 0, "VHTExtBssLoad" , 0, 7, 7, SigIeVHTExtBssLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTEXTBSSLOAD, 0, },
-        {offsetof(tDot11fBeaconIEs, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fBeaconIEs, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
-        {offsetof(tDot11fBeaconIEs, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, },
-        {offsetof(tDot11fBeaconIEs, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, },
-        {offsetof(tDot11fBeaconIEs, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, },
-        {offsetof(tDot11fBeaconIEs, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, },
-        {offsetof(tDot11fBeaconIEs, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, },
-        {offsetof(tDot11fBeaconIEs, ChannelSwitchWrapper), offsetof(tDot11fIEChannelSwitchWrapper, present), 0, "ChannelSwitchWrapper" , 0, 2, 7, SigIeChannelSwitchWrapper, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANNELSWITCHWRAPPER, 0, },
-        {offsetof(tDot11fBeaconIEs, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 7, 7, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, },
+        {offsetof(tDot11fBeaconIEs, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, 1, },
+        {offsetof(tDot11fBeaconIEs, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fBeaconIEs, FHParamSet), offsetof(tDot11fIEFHParamSet, present), 0, "FHParamSet" , 0, 7, 7, SigIeFHParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMSET, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, CFParams), offsetof(tDot11fIECFParams, present), 0, "CFParams" , 0, 8, 8, SigIeCFParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CFPARAMS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, IBSSParams), offsetof(tDot11fIEIBSSParams, present), 0, "IBSSParams" , 0, 4, 4, SigIeIBSSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IBSSPARAMS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, TIM), offsetof(tDot11fIETIM, present), 0, "TIM" , 0, 6, 256, SigIeTIM, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIM, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, FHParams), offsetof(tDot11fIEFHParams, present), 0, "FHParams" , 0, 4, 4, SigIeFHParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, FHPattTable), offsetof(tDot11fIEFHPattTable, present), 0, "FHPattTable" , 0, 6, 257, SigIeFHPattTable, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPATTTABLE, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ext_chan_switch_ann), offsetof(tDot11fIEext_chan_switch_ann, present), 0, "ext_chan_switch_ann" , 0, 6, 6, SigIeext_chan_switch_ann, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXT_CHAN_SWITCH_ANN, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, Quiet), offsetof(tDot11fIEQuiet, present), 0, "Quiet" , 0, 8, 8, SigIeQuiet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QUIET, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, QBSSLoad), offsetof(tDot11fIEQBSSLoad, present), 0, "QBSSLoad" , 0, 7, 7, SigIeQBSSLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QBSSLOAD, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, QOSCapsAp), offsetof(tDot11fIEQOSCapsAp, present), 0, "QOSCapsAp" , 0, 3, 3, SigIeQOSCapsAp, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSAP, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, APChannelReport), offsetof(tDot11fIEAPChannelReport, present), 0, "APChannelReport" , 0, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, WMMInfoAp), offsetof(tDot11fIEWMMInfoAp, present), 0, "WMMInfoAp" , 0, 9, 9, SigIeWMMInfoAp, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOAP, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, WscBeaconProbeRes), offsetof(tDot11fIEWscBeaconProbeRes, present), 0, "WscBeaconProbeRes" , 0, 6, 319, SigIeWscBeaconProbeRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCBEACONPROBERES, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, P2PBeaconProbeRes), offsetof(tDot11fIEP2PBeaconProbeRes, present), 0, "P2PBeaconProbeRes" , 0, 6, 1150, SigIeP2PBeaconProbeRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PBEACONPROBERES, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, VHTExtBssLoad), offsetof(tDot11fIEVHTExtBssLoad, present), 0, "VHTExtBssLoad" , 0, 7, 7, SigIeVHTExtBssLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTEXTBSSLOAD, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, fils_indication), offsetof(tDot11fIEfils_indication, present), 0, "fils_indication" , 0, 7, 259, SigIefils_indication, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_INDICATION, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, hs20vendor_ie), offsetof(tDot11fIEhs20vendor_ie, present), 0, "hs20vendor_ie" , 0, 7, 9, SigIehs20vendor_ie, {80, 111, 154, 16, 0}, 4, DOT11F_EID_HS20VENDOR_IE, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, ChannelSwitchWrapper), offsetof(tDot11fIEChannelSwitchWrapper, present), 0, "ChannelSwitchWrapper" , 0, 2, 14, SigIeChannelSwitchWrapper, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANNELSWITCHWRAPPER, 0, 0, },
+        {offsetof(tDot11fBeaconIEs, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 5, 12, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackBeaconIEs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fBeaconIEs *pFrm)
@@ -10923,6 +11557,25 @@ tANI_U32 dot11fUnpackBeaconIEs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->OBSSScanParameters.bssWidthChannelTransitionDelayFactor, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->OBSSScanParameters.obssScanActivityThreshold, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("fils_indication:\n"));
+        if (!pFrm->fils_indication.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("public_key_identifiers_cnt (3): %d\n"), pFrm->fils_indication.public_key_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("realm_identifiers_cnt (3): %d\n"), pFrm->fils_indication.realm_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_ip_config_supported (1): %d\n"), pFrm->fils_indication.is_ip_config_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_cache_id_present (1): %d\n"), pFrm->fils_indication.is_cache_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_hessid_present (1): %d\n"), pFrm->fils_indication.is_hessid_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_fils_sk_auth_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_fils_sk_auth_pfs_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_pfs_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_pk_auth_supported (1): %d\n"), pFrm->fils_indication.is_pk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("reserved (4): %d\n"), pFrm->fils_indication.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("num_variable_data: %d.\n"), pFrm->fils_indication.num_variable_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* ) pFrm->fils_indication.variable_data, pFrm->fils_indication.num_variable_data);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Vendor1IE:\n"));
         if (!pFrm->Vendor1IE.present)
         {
@@ -10995,6 +11648,27 @@ tANI_U32 dot11fUnpackBeaconIEs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf
         else
         {
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("ChannelSwitchWrapper:\n"));
         if (!pFrm->ChannelSwitchWrapper.present)
         {
@@ -11013,6 +11687,16 @@ tANI_U32 dot11fUnpackBeaconIEs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("vht_transmit_power_env:\n"));
+            if (!pFrm->ChannelSwitchWrapper.vht_transmit_power_env.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("num_bytes: %d.\n"), pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* ) pFrm->ChannelSwitchWrapper.vht_transmit_power_env.bytes, pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("QComVendorIE:\n"));
         if (!pFrm->QComVendorIE.present)
@@ -11021,8 +11705,25 @@ tANI_U32 dot11fUnpackBeaconIEs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.type, 1);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.channel, 1);
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
         }
     }
 #   endif // DOT11F_DUMP_FRAMES
@@ -11037,9 +11738,9 @@ tANI_U32 dot11fUnpackBeaconIEs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf
     };
 
     static const tIEDefn IES_ChannelSwitch[] = {
-        {offsetof(tDot11fChannelSwitch, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 1, },
-        {offsetof(tDot11fChannelSwitch, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, },
-        {offsetof(tDot11fChannelSwitch, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, },
+        {offsetof(tDot11fChannelSwitch, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 0, 1, },
+        {offsetof(tDot11fChannelSwitch, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, 0, },
+        {offsetof(tDot11fChannelSwitch, WiderBWChanSwitchAnn), offsetof(tDot11fIEWiderBWChanSwitchAnn, present), 0, "WiderBWChanSwitchAnn" , 0, 5, 5, SigIeWiderBWChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WIDERBWCHANSWITCHANN, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackChannelSwitch(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fChannelSwitch *pFrm)
@@ -11102,7 +11803,7 @@ tANI_U32 dot11fUnpackChannelSwitch(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
     };
 
     static const tIEDefn IES_DeAuth[] = {
-        {offsetof(tDot11fDeAuth, P2PDeAuth), offsetof(tDot11fIEP2PDeAuth, present), 0, "P2PDeAuth" , 0, 6, 10, SigIeP2PDeAuth, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PDEAUTH, 0, },
+        {offsetof(tDot11fDeAuth, P2PDeAuth), offsetof(tDot11fIEP2PDeAuth, present), 0, "P2PDeAuth" , 0, 6, 10, SigIeP2PDeAuth, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PDEAUTH, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackDeAuth(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fDeAuth *pFrm)
@@ -11240,7 +11941,7 @@ tANI_U32 dot11fUnpackDelTS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tD
     };
 
     static const tIEDefn IES_DeviceDiscoverabilityReq[] = {
-        {offsetof(tDot11fDeviceDiscoverabilityReq, P2PDeviceDiscoverabilityReq), offsetof(tDot11fIEP2PDeviceDiscoverabilityReq, present), 0, "P2PDeviceDiscoverabilityReq" , 0, 6, 56, SigIeP2PDeviceDiscoverabilityReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PDEVICEDISCOVERABILITYREQ, 1, },
+        {offsetof(tDot11fDeviceDiscoverabilityReq, P2PDeviceDiscoverabilityReq), offsetof(tDot11fIEP2PDeviceDiscoverabilityReq, present), 0, "P2PDeviceDiscoverabilityReq" , 0, 6, 56, SigIeP2PDeviceDiscoverabilityReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PDEVICEDISCOVERABILITYREQ, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackDeviceDiscoverabilityReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fDeviceDiscoverabilityReq *pFrm)
@@ -11310,7 +12011,7 @@ tANI_U32 dot11fUnpackDeviceDiscoverabilityReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf
     };
 
     static const tIEDefn IES_DeviceDiscoverabilityRes[] = {
-        {offsetof(tDot11fDeviceDiscoverabilityRes, P2PDeviceDiscoverabilityRes), offsetof(tDot11fIEP2PDeviceDiscoverabilityRes, present), 0, "P2PDeviceDiscoverabilityRes" , 0, 6, 10, SigIeP2PDeviceDiscoverabilityRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PDEVICEDISCOVERABILITYRES, 1, },
+        {offsetof(tDot11fDeviceDiscoverabilityRes, P2PDeviceDiscoverabilityRes), offsetof(tDot11fIEP2PDeviceDiscoverabilityRes, present), 0, "P2PDeviceDiscoverabilityRes" , 0, 6, 10, SigIeP2PDeviceDiscoverabilityRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PDEVICEDISCOVERABILITYRES, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackDeviceDiscoverabilityRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fDeviceDiscoverabilityRes *pFrm)
@@ -11365,7 +12066,7 @@ tANI_U32 dot11fUnpackDeviceDiscoverabilityRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf
     };
 
     static const tIEDefn IES_Disassociation[] = {
-        {offsetof(tDot11fDisassociation, P2PDisAssoc), offsetof(tDot11fIEP2PDisAssoc, present), 0, "P2PDisAssoc" , 0, 6, 10, SigIeP2PDisAssoc, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PDISASSOC, 0, },
+        {offsetof(tDot11fDisassociation, P2PDisAssoc), offsetof(tDot11fIEP2PDisAssoc, present), 0, "P2PDisAssoc" , 0, 6, 10, SigIeP2PDisAssoc, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PDISASSOC, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackDisassociation(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fDisassociation *pFrm)
@@ -11454,7 +12155,7 @@ tANI_U32 dot11fUnpackGODiscoverabilityReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tA
     };
 
     static const tIEDefn IES_GONegCnf[] = {
-        {offsetof(tDot11fGONegCnf, P2PGONegCnf), offsetof(tDot11fIEP2PGONegCnf, present), 0, "P2PGONegCnf" , 0, 6, 321, SigIeP2PGONegCnf, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PGONEGCNF, 1, },
+        {offsetof(tDot11fGONegCnf, P2PGONegCnf), offsetof(tDot11fIEP2PGONegCnf, present), 0, "P2PGONegCnf" , 0, 6, 321, SigIeP2PGONegCnf, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PGONEGCNF, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackGONegCnf(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fGONegCnf *pFrm)
@@ -11556,8 +12257,8 @@ tANI_U32 dot11fUnpackGONegCnf(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
     };
 
     static const tIEDefn IES_GONegReq[] = {
-        {offsetof(tDot11fGONegReq, P2PGONegWPS), offsetof(tDot11fIEP2PGONegWPS, present), 0, "P2PGONegWPS" , 0, 6, 17, SigIeP2PGONegWPS, {0, 80, 242, 4, 0}, 4, DOT11F_EID_P2PGONEGWPS, 1, },
-        {offsetof(tDot11fGONegReq, P2PGONegReq), offsetof(tDot11fIEP2PGONegReq, present), 0, "P2PGONegReq" , 0, 6, 364, SigIeP2PGONegReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PGONEGREQ, 1, },
+        {offsetof(tDot11fGONegReq, P2PGONegWPS), offsetof(tDot11fIEP2PGONegWPS, present), 0, "P2PGONegWPS" , 0, 6, 17, SigIeP2PGONegWPS, {0, 80, 242, 4, 0}, 4, DOT11F_EID_P2PGONEGWPS, 0, 1, },
+        {offsetof(tDot11fGONegReq, P2PGONegReq), offsetof(tDot11fIEP2PGONegReq, present), 0, "P2PGONegReq" , 0, 6, 364, SigIeP2PGONegReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PGONEGREQ, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackGONegReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fGONegReq *pFrm)
@@ -11736,8 +12437,8 @@ tANI_U32 dot11fUnpackGONegReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
     };
 
     static const tIEDefn IES_GONegRes[] = {
-        {offsetof(tDot11fGONegRes, P2PGONegWPS), offsetof(tDot11fIEP2PGONegWPS, present), 0, "P2PGONegWPS" , 0, 6, 17, SigIeP2PGONegWPS, {0, 80, 242, 4, 0}, 4, DOT11F_EID_P2PGONEGWPS, 1, },
-        {offsetof(tDot11fGONegRes, P2PGONegRes), offsetof(tDot11fIEP2PGONegRes, present), 0, "P2PGONegRes" , 0, 6, 394, SigIeP2PGONegRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PGONEGRES, 1, },
+        {offsetof(tDot11fGONegRes, P2PGONegWPS), offsetof(tDot11fIEP2PGONegWPS, present), 0, "P2PGONegWPS" , 0, 6, 17, SigIeP2PGONegWPS, {0, 80, 242, 4, 0}, 4, DOT11F_EID_P2PGONEGWPS, 0, 1, },
+        {offsetof(tDot11fGONegRes, P2PGONegRes), offsetof(tDot11fIEP2PGONegRes, present), 0, "P2PGONegRes" , 0, 6, 394, SigIeP2PGONegRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PGONEGRES, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackGONegRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fGONegRes *pFrm)
@@ -11912,8 +12613,8 @@ tANI_U32 dot11fUnpackGONegRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf,
     };
 
     static const tIEDefn IES_HT2040BSSCoexistenceManagementActionFrame[] = {
-        {offsetof(tDot11fHT2040BSSCoexistenceManagementActionFrame, HT2040BSSCoexistence), offsetof(tDot11fIEHT2040BSSCoexistence, present), 0, "HT2040BSSCoexistence" , 0, 3, 3, SigIeHT2040BSSCoexistence, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSCOEXISTENCE, 1, },
-        {offsetof(tDot11fHT2040BSSCoexistenceManagementActionFrame, HT2040BSSIntolerantReport), offsetof(tDot11fIEHT2040BSSIntolerantReport, present), 0, "HT2040BSSIntolerantReport" , 0, 3, 53, SigIeHT2040BSSIntolerantReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSINTOLERANTREPORT, 1, },
+        {offsetof(tDot11fHT2040BSSCoexistenceManagementActionFrame, HT2040BSSCoexistence), offsetof(tDot11fIEHT2040BSSCoexistence, present), 0, "HT2040BSSCoexistence" , 0, 3, 3, SigIeHT2040BSSCoexistence, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSCOEXISTENCE, 0, 1, },
+        {offsetof(tDot11fHT2040BSSCoexistenceManagementActionFrame, HT2040BSSIntolerantReport), offsetof(tDot11fIEHT2040BSSIntolerantReport, present), 0, "HT2040BSSIntolerantReport" , 0, 3, 53, SigIeHT2040BSSIntolerantReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSINTOLERANTREPORT, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackHT2040BSSCoexistenceManagementActionFrame(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fHT2040BSSCoexistenceManagementActionFrame *pFrm)
@@ -11974,7 +12675,7 @@ tANI_U32 dot11fUnpackHT2040BSSCoexistenceManagementActionFrame(tpAniSirGlobal pC
     };
 
     static const tIEDefn IES_InvitationReq[] = {
-        {offsetof(tDot11fInvitationReq, P2PInvitationReq), offsetof(tDot11fIEP2PInvitationReq, present), 0, "P2PInvitationReq" , 0, 6, 385, SigIeP2PInvitationReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PINVITATIONREQ, 1, },
+        {offsetof(tDot11fInvitationReq, P2PInvitationReq), offsetof(tDot11fIEP2PInvitationReq, present), 0, "P2PInvitationReq" , 0, 6, 385, SigIeP2PInvitationReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PINVITATIONREQ, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackInvitationReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fInvitationReq *pFrm)
@@ -12106,7 +12807,7 @@ tANI_U32 dot11fUnpackInvitationReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
     };
 
     static const tIEDefn IES_InvitationRes[] = {
-        {offsetof(tDot11fInvitationRes, P2PInvitationRes), offsetof(tDot11fIEP2PInvitationRes, present), 0, "P2PInvitationRes" , 0, 6, 289, SigIeP2PInvitationRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PINVITATIONRES, 1, },
+        {offsetof(tDot11fInvitationRes, P2PInvitationRes), offsetof(tDot11fIEP2PInvitationRes, present), 0, "P2PInvitationRes" , 0, 6, 289, SigIeP2PInvitationRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PINVITATIONRES, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackInvitationRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fInvitationRes *pFrm)
@@ -12304,7 +13005,7 @@ tANI_U32 dot11fUnpackLinkMeasurementRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf,
     };
 
     static const tIEDefn IES_MeasurementReport[] = {
-        {offsetof(tDot11fMeasurementReport, MeasurementReport), offsetof(tDot11fIEMeasurementReport, present), 0, "MeasurementReport" , 0, 5, 31, SigIeMeasurementReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTREPORT, 1, },
+        {offsetof(tDot11fMeasurementReport, MeasurementReport), offsetof(tDot11fIEMeasurementReport, present), 0, "MeasurementReport" , 0, 5, 31, SigIeMeasurementReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTREPORT, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackMeasurementReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fMeasurementReport *pFrm)
@@ -12400,7 +13101,7 @@ tANI_U32 dot11fUnpackMeasurementReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_
     };
 
     static const tIEDefn IES_MeasurementRequest[] = {
-        {offsetof(tDot11fMeasurementRequest, MeasurementRequest), offsetof(tDot11fIEMeasurementRequest, present), offsetof(tDot11fMeasurementRequest, num_MeasurementRequest), "MeasurementRequest" , 4, 16, 18, SigIeMeasurementRequest, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTREQUEST, 1, },
+        {offsetof(tDot11fMeasurementRequest, MeasurementRequest), offsetof(tDot11fIEMeasurementRequest, present), offsetof(tDot11fMeasurementRequest, num_MeasurementRequest), "MeasurementRequest" , 4, 16, 18, SigIeMeasurementRequest, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTREQUEST, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackMeasurementRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fMeasurementRequest *pFrm)
@@ -12481,7 +13182,7 @@ tANI_U32 dot11fUnpackMeasurementRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI
     };
 
     static const tIEDefn IES_NeighborReportRequest[] = {
-        {offsetof(tDot11fNeighborReportRequest, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, },
+        {offsetof(tDot11fNeighborReportRequest, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackNeighborReportRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fNeighborReportRequest *pFrm)
@@ -12527,7 +13228,7 @@ tANI_U32 dot11fUnpackNeighborReportRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, t
     };
 
     static const tIEDefn IES_NeighborReportResponse[] = {
-        {offsetof(tDot11fNeighborReportResponse, NeighborReport), offsetof(tDot11fIENeighborReport, present), offsetof(tDot11fNeighborReportResponse, num_NeighborReport), "NeighborReport" , 15, 15, 548, SigIeNeighborReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_NEIGHBORREPORT, 0, },
+        {offsetof(tDot11fNeighborReportResponse, NeighborReport), offsetof(tDot11fIENeighborReport, present), offsetof(tDot11fNeighborReportResponse, num_NeighborReport), "NeighborReport" , 15, 15, 548, SigIeNeighborReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_NEIGHBORREPORT, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackNeighborReportResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fNeighborReportResponse *pFrm)
@@ -12671,7 +13372,7 @@ tANI_U32 dot11fUnpackNeighborReportResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf,
     };
 
     static const tIEDefn IES_NoticeOfAbs[] = {
-        {offsetof(tDot11fNoticeOfAbs, P2PNoticeOfAbsence), offsetof(tDot11fIEP2PNoticeOfAbsence, present), 0, "P2PNoticeOfAbsence" , 0, 6, 47, SigIeP2PNoticeOfAbsence, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PNOTICEOFABSENCE, 1, },
+        {offsetof(tDot11fNoticeOfAbs, P2PNoticeOfAbsence), offsetof(tDot11fIEP2PNoticeOfAbsence, present), 0, "P2PNoticeOfAbsence" , 0, 6, 47, SigIeP2PNoticeOfAbsence, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PNOTICEOFABSENCE, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackNoticeOfAbs(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fNoticeOfAbs *pFrm)
@@ -12768,7 +13469,7 @@ tANI_U32 dot11fUnpackOperatingMode(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
     };
 
     static const tIEDefn IES_PresenceReq[] = {
-        {offsetof(tDot11fPresenceReq, P2PNoticeOfAbsence), offsetof(tDot11fIEP2PNoticeOfAbsence, present), 0, "P2PNoticeOfAbsence" , 0, 6, 47, SigIeP2PNoticeOfAbsence, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PNOTICEOFABSENCE, 1, },
+        {offsetof(tDot11fPresenceReq, P2PNoticeOfAbsence), offsetof(tDot11fIEP2PNoticeOfAbsence, present), 0, "P2PNoticeOfAbsence" , 0, 6, 47, SigIeP2PNoticeOfAbsence, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PNOTICEOFABSENCE, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackPresenceReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fPresenceReq *pFrm)
@@ -12827,7 +13528,7 @@ tANI_U32 dot11fUnpackPresenceReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nB
     };
 
     static const tIEDefn IES_PresenceRes[] = {
-        {offsetof(tDot11fPresenceRes, P2PPresenceResponse), offsetof(tDot11fIEP2PPresenceResponse, present), 0, "P2PPresenceResponse" , 0, 6, 51, SigIeP2PPresenceResponse, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PPRESENCERESPONSE, 1, },
+        {offsetof(tDot11fPresenceRes, P2PPresenceResponse), offsetof(tDot11fIEP2PPresenceResponse, present), 0, "P2PPresenceResponse" , 0, 6, 51, SigIeP2PPresenceResponse, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PPRESENCERESPONSE, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackPresenceRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fPresenceRes *pFrm)
@@ -12891,17 +13592,17 @@ tANI_U32 dot11fUnpackPresenceRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nB
     };
 
     static const tIEDefn IES_ProbeRequest[] = {
-        {offsetof(tDot11fProbeRequest, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 1, },
-        {offsetof(tDot11fProbeRequest, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fProbeRequest, RequestedInfo), offsetof(tDot11fIERequestedInfo, present), 0, "RequestedInfo" , 0, 2, 257, SigIeRequestedInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_REQUESTEDINFO, 0, },
-        {offsetof(tDot11fProbeRequest, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fProbeRequest, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, },
-        {offsetof(tDot11fProbeRequest, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fProbeRequest, WscProbeReq), offsetof(tDot11fIEWscProbeReq, present), 0, "WscProbeReq" , 0, 6, 286, SigIeWscProbeReq, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCPROBEREQ, 0, },
-        {offsetof(tDot11fProbeRequest, WFATPC), offsetof(tDot11fIEWFATPC, present), 0, "WFATPC" , 0, 9, 9, SigIeWFATPC, {0, 80, 242, 8, 0}, 5, DOT11F_EID_WFATPC, 0, },
-        {offsetof(tDot11fProbeRequest, P2PProbeReq), offsetof(tDot11fIEP2PProbeReq, present), 0, "P2PProbeReq" , 0, 6, 43, SigIeP2PProbeReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PPROBEREQ, 0, },
-        {offsetof(tDot11fProbeRequest, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fProbeRequest, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
+        {offsetof(tDot11fProbeRequest, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, 1, },
+        {offsetof(tDot11fProbeRequest, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fProbeRequest, RequestedInfo), offsetof(tDot11fIERequestedInfo, present), 0, "RequestedInfo" , 0, 2, 257, SigIeRequestedInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_REQUESTEDINFO, 0, 0, },
+        {offsetof(tDot11fProbeRequest, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fProbeRequest, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, 0, },
+        {offsetof(tDot11fProbeRequest, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fProbeRequest, WscProbeReq), offsetof(tDot11fIEWscProbeReq, present), 0, "WscProbeReq" , 0, 6, 286, SigIeWscProbeReq, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCPROBEREQ, 0, 0, },
+        {offsetof(tDot11fProbeRequest, WFATPC), offsetof(tDot11fIEWFATPC, present), 0, "WFATPC" , 0, 9, 9, SigIeWFATPC, {0, 80, 242, 8, 0}, 5, DOT11F_EID_WFATPC, 0, 0, },
+        {offsetof(tDot11fProbeRequest, P2PProbeReq), offsetof(tDot11fIEP2PProbeReq, present), 0, "P2PProbeReq" , 0, 6, 43, SigIeP2PProbeReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PPROBEREQ, 0, 0, },
+        {offsetof(tDot11fProbeRequest, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fProbeRequest, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackProbeRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fProbeRequest *pFrm)
@@ -13330,53 +14031,55 @@ tANI_U32 dot11fUnpackProbeRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 n
     };
 
     static const tIEDefn IES_ProbeResponse[] = {
-        {offsetof(tDot11fProbeResponse, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 1, },
-        {offsetof(tDot11fProbeResponse, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fProbeResponse, FHParamSet), offsetof(tDot11fIEFHParamSet, present), 0, "FHParamSet" , 0, 7, 7, SigIeFHParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMSET, 0, },
-        {offsetof(tDot11fProbeResponse, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, },
-        {offsetof(tDot11fProbeResponse, CFParams), offsetof(tDot11fIECFParams, present), 0, "CFParams" , 0, 8, 8, SigIeCFParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CFPARAMS, 0, },
-        {offsetof(tDot11fProbeResponse, IBSSParams), offsetof(tDot11fIEIBSSParams, present), 0, "IBSSParams" , 0, 4, 4, SigIeIBSSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IBSSPARAMS, 0, },
-        {offsetof(tDot11fProbeResponse, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, },
-        {offsetof(tDot11fProbeResponse, FHParams), offsetof(tDot11fIEFHParams, present), 0, "FHParams" , 0, 4, 4, SigIeFHParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMS, 0, },
-        {offsetof(tDot11fProbeResponse, FHPattTable), offsetof(tDot11fIEFHPattTable, present), 0, "FHPattTable" , 0, 6, 257, SigIeFHPattTable, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPATTTABLE, 0, },
-        {offsetof(tDot11fProbeResponse, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, },
-        {offsetof(tDot11fProbeResponse, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 0, },
-        {offsetof(tDot11fProbeResponse, ext_chan_switch_ann), offsetof(tDot11fIEext_chan_switch_ann, present), 0, "ext_chan_switch_ann" , 0, 6, 6, SigIeext_chan_switch_ann, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXT_CHAN_SWITCH_ANN, 0, },
-        {offsetof(tDot11fProbeResponse, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, },
-        {offsetof(tDot11fProbeResponse, Quiet), offsetof(tDot11fIEQuiet, present), 0, "Quiet" , 0, 8, 8, SigIeQuiet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QUIET, 0, },
-        {offsetof(tDot11fProbeResponse, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, },
-        {offsetof(tDot11fProbeResponse, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, },
-        {offsetof(tDot11fProbeResponse, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fProbeResponse, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
-        {offsetof(tDot11fProbeResponse, QBSSLoad), offsetof(tDot11fIEQBSSLoad, present), 0, "QBSSLoad" , 0, 7, 7, SigIeQBSSLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QBSSLOAD, 0, },
-        {offsetof(tDot11fProbeResponse, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
-        {offsetof(tDot11fProbeResponse, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
-        {offsetof(tDot11fProbeResponse, APChannelReport), offsetof(tDot11fIEAPChannelReport, present), 0, "APChannelReport" , 0, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, },
-        {offsetof(tDot11fProbeResponse, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fProbeResponse, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, },
-        {offsetof(tDot11fProbeResponse, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fProbeResponse, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, },
-        {offsetof(tDot11fProbeResponse, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, },
-        {offsetof(tDot11fProbeResponse, WMMInfoAp), offsetof(tDot11fIEWMMInfoAp, present), 0, "WMMInfoAp" , 0, 9, 9, SigIeWMMInfoAp, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOAP, 0, },
-        {offsetof(tDot11fProbeResponse, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, },
-        {offsetof(tDot11fProbeResponse, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, },
-        {offsetof(tDot11fProbeResponse, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, },
-        {offsetof(tDot11fProbeResponse, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, },
-        {offsetof(tDot11fProbeResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, },
-        {offsetof(tDot11fProbeResponse, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, },
-        {offsetof(tDot11fProbeResponse, WscProbeRes), offsetof(tDot11fIEWscProbeRes, present), 0, "WscProbeRes" , 0, 6, 319, SigIeWscProbeRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCPROBERES, 0, },
-        {offsetof(tDot11fProbeResponse, P2PProbeRes), offsetof(tDot11fIEP2PProbeRes, present), 0, "P2PProbeRes" , 0, 6, 1141, SigIeP2PProbeRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PPROBERES, 0, },
-        {offsetof(tDot11fProbeResponse, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fProbeResponse, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
-        {offsetof(tDot11fProbeResponse, VHTExtBssLoad), offsetof(tDot11fIEVHTExtBssLoad, present), 0, "VHTExtBssLoad" , 0, 7, 7, SigIeVHTExtBssLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTEXTBSSLOAD, 0, },
-        {offsetof(tDot11fProbeResponse, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fProbeResponse, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, },
-        {offsetof(tDot11fProbeResponse, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, },
-        {offsetof(tDot11fProbeResponse, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, },
-        {offsetof(tDot11fProbeResponse, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, },
-        {offsetof(tDot11fProbeResponse, ChannelSwitchWrapper), offsetof(tDot11fIEChannelSwitchWrapper, present), 0, "ChannelSwitchWrapper" , 0, 2, 7, SigIeChannelSwitchWrapper, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANNELSWITCHWRAPPER, 0, },
-        {offsetof(tDot11fProbeResponse, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 7, 7, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, },
-        {offsetof(tDot11fProbeResponse, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, },
+        {offsetof(tDot11fProbeResponse, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, 1, },
+        {offsetof(tDot11fProbeResponse, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fProbeResponse, FHParamSet), offsetof(tDot11fIEFHParamSet, present), 0, "FHParamSet" , 0, 7, 7, SigIeFHParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMSET, 0, 0, },
+        {offsetof(tDot11fProbeResponse, DSParams), offsetof(tDot11fIEDSParams, present), 0, "DSParams" , 0, 3, 3, SigIeDSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_DSPARAMS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, CFParams), offsetof(tDot11fIECFParams, present), 0, "CFParams" , 0, 8, 8, SigIeCFParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CFPARAMS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, IBSSParams), offsetof(tDot11fIEIBSSParams, present), 0, "IBSSParams" , 0, 4, 4, SigIeIBSSParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_IBSSPARAMS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, 0, },
+        {offsetof(tDot11fProbeResponse, FHParams), offsetof(tDot11fIEFHParams, present), 0, "FHParams" , 0, 4, 4, SigIeFHParams, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPARAMS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, FHPattTable), offsetof(tDot11fIEFHPattTable, present), 0, "FHPattTable" , 0, 6, 257, SigIeFHPattTable, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FHPATTTABLE, 0, 0, },
+        {offsetof(tDot11fProbeResponse, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ChanSwitchAnn), offsetof(tDot11fIEChanSwitchAnn, present), 0, "ChanSwitchAnn" , 0, 5, 5, SigIeChanSwitchAnn, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANSWITCHANN, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ext_chan_switch_ann), offsetof(tDot11fIEext_chan_switch_ann, present), 0, "ext_chan_switch_ann" , 0, 6, 6, SigIeext_chan_switch_ann, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXT_CHAN_SWITCH_ANN, 0, 0, },
+        {offsetof(tDot11fProbeResponse, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, 0, },
+        {offsetof(tDot11fProbeResponse, Quiet), offsetof(tDot11fIEQuiet, present), 0, "Quiet" , 0, 8, 8, SigIeQuiet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QUIET, 0, 0, },
+        {offsetof(tDot11fProbeResponse, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ERPInfo), offsetof(tDot11fIEERPInfo, present), 0, "ERPInfo" , 0, 3, 3, SigIeERPInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_ERPINFO, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fProbeResponse, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, 0, },
+        {offsetof(tDot11fProbeResponse, QBSSLoad), offsetof(tDot11fIEQBSSLoad, present), 0, "QBSSLoad" , 0, 7, 7, SigIeQBSSLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QBSSLOAD, 0, 0, },
+        {offsetof(tDot11fProbeResponse, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, 0, },
+        {offsetof(tDot11fProbeResponse, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, 0, },
+        {offsetof(tDot11fProbeResponse, APChannelReport), offsetof(tDot11fIEAPChannelReport, present), 0, "APChannelReport" , 0, 3, 53, SigIeAPChannelReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_APCHANNELREPORT, 0, 0, },
+        {offsetof(tDot11fProbeResponse, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, 0, },
+        {offsetof(tDot11fProbeResponse, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, 0, },
+        {offsetof(tDot11fProbeResponse, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, 0, },
+        {offsetof(tDot11fProbeResponse, sec_chan_offset_ele), offsetof(tDot11fIEsec_chan_offset_ele, present), 0, "sec_chan_offset_ele" , 0, 3, 3, SigIesec_chan_offset_ele, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SEC_CHAN_OFFSET_ELE, 0, 0, },
+        {offsetof(tDot11fProbeResponse, WMMInfoAp), offsetof(tDot11fIEWMMInfoAp, present), 0, "WMMInfoAp" , 0, 9, 9, SigIeWMMInfoAp, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOAP, 0, 0, },
+        {offsetof(tDot11fProbeResponse, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, 0, },
+        {offsetof(tDot11fProbeResponse, WscProbeRes), offsetof(tDot11fIEWscProbeRes, present), 0, "WscProbeRes" , 0, 6, 319, SigIeWscProbeRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCPROBERES, 0, 0, },
+        {offsetof(tDot11fProbeResponse, P2PProbeRes), offsetof(tDot11fIEP2PProbeRes, present), 0, "P2PProbeRes" , 0, 6, 1141, SigIeP2PProbeRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PPROBERES, 0, 0, },
+        {offsetof(tDot11fProbeResponse, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, 0, },
+        {offsetof(tDot11fProbeResponse, VHTExtBssLoad), offsetof(tDot11fIEVHTExtBssLoad, present), 0, "VHTExtBssLoad" , 0, 7, 7, SigIeVHTExtBssLoad, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTEXTBSSLOAD, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fProbeResponse, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, 0, },
+        {offsetof(tDot11fProbeResponse, fils_indication), offsetof(tDot11fIEfils_indication, present), 0, "fils_indication" , 0, 7, 259, SigIefils_indication, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FILS_INDICATION, 0, 0, },
+        {offsetof(tDot11fProbeResponse, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, 0, },
+        {offsetof(tDot11fProbeResponse, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, 0, },
+        {offsetof(tDot11fProbeResponse, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, 0, },
+        {offsetof(tDot11fProbeResponse, hs20vendor_ie), offsetof(tDot11fIEhs20vendor_ie, present), 0, "hs20vendor_ie" , 0, 7, 9, SigIehs20vendor_ie, {80, 111, 154, 16, 0}, 4, DOT11F_EID_HS20VENDOR_IE, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ChannelSwitchWrapper), offsetof(tDot11fIEChannelSwitchWrapper, present), 0, "ChannelSwitchWrapper" , 0, 2, 14, SigIeChannelSwitchWrapper, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHANNELSWITCHWRAPPER, 0, 0, },
+        {offsetof(tDot11fProbeResponse, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 5, 12, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, 0, },
+        {offsetof(tDot11fProbeResponse, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackProbeResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fProbeResponse *pFrm)
@@ -14294,6 +14997,25 @@ tANI_U32 dot11fUnpackProbeResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->OBSSScanParameters.bssWidthChannelTransitionDelayFactor, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->OBSSScanParameters.obssScanActivityThreshold, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("fils_indication:\n"));
+        if (!pFrm->fils_indication.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("public_key_identifiers_cnt (3): %d\n"), pFrm->fils_indication.public_key_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("realm_identifiers_cnt (3): %d\n"), pFrm->fils_indication.realm_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_ip_config_supported (1): %d\n"), pFrm->fils_indication.is_ip_config_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_cache_id_present (1): %d\n"), pFrm->fils_indication.is_cache_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_hessid_present (1): %d\n"), pFrm->fils_indication.is_hessid_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_fils_sk_auth_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_fils_sk_auth_pfs_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_pfs_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_pk_auth_supported (1): %d\n"), pFrm->fils_indication.is_pk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("reserved (4): %d\n"), pFrm->fils_indication.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("num_variable_data: %d.\n"), pFrm->fils_indication.num_variable_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->fils_indication.variable_data, pFrm->fils_indication.num_variable_data);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Vendor1IE:\n"));
         if (!pFrm->Vendor1IE.present)
         {
@@ -14366,6 +15088,27 @@ tANI_U32 dot11fUnpackProbeResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
         else
         {
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("ChannelSwitchWrapper:\n"));
         if (!pFrm->ChannelSwitchWrapper.present)
         {
@@ -14384,6 +15127,16 @@ tANI_U32 dot11fUnpackProbeResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("vht_transmit_power_env:\n"));
+            if (!pFrm->ChannelSwitchWrapper.vht_transmit_power_env.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("num_bytes: %d.\n"), pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->ChannelSwitchWrapper.vht_transmit_power_env.bytes, pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("QComVendorIE:\n"));
         if (!pFrm->QComVendorIE.present)
@@ -14392,8 +15145,25 @@ tANI_U32 dot11fUnpackProbeResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.type, 1);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.channel, 1);
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("ESEVersion:\n"));
         if (!pFrm->ESEVersion.present)
@@ -14420,7 +15190,7 @@ tANI_U32 dot11fUnpackProbeResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
     };
 
     static const tIEDefn IES_ProvisionDiscoveryReq[] = {
-        {offsetof(tDot11fProvisionDiscoveryReq, P2PProvisionDiscoveryReq), offsetof(tDot11fIEP2PProvisionDiscoveryReq, present), 0, "P2PProvisionDiscoveryReq" , 0, 6, 107, SigIeP2PProvisionDiscoveryReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PPROVISIONDISCOVERYREQ, 1, },
+        {offsetof(tDot11fProvisionDiscoveryReq, P2PProvisionDiscoveryReq), offsetof(tDot11fIEP2PProvisionDiscoveryReq, present), 0, "P2PProvisionDiscoveryReq" , 0, 6, 107, SigIeP2PProvisionDiscoveryReq, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PPROVISIONDISCOVERYREQ, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackProvisionDiscoveryReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fProvisionDiscoveryReq *pFrm)
@@ -14512,7 +15282,7 @@ tANI_U32 dot11fUnpackProvisionDiscoveryReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, t
     };
 
     static const tIEDefn IES_ProvisionDiscoveryRes[] = {
-        {offsetof(tDot11fProvisionDiscoveryRes, P2PWSCProvisionDiscoveryRes), offsetof(tDot11fIEP2PWSCProvisionDiscoveryRes, present), 0, "P2PWSCProvisionDiscoveryRes" , 0, 6, 12, SigIeP2PWSCProvisionDiscoveryRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_P2PWSCPROVISIONDISCOVERYRES, 1, },
+        {offsetof(tDot11fProvisionDiscoveryRes, P2PWSCProvisionDiscoveryRes), offsetof(tDot11fIEP2PWSCProvisionDiscoveryRes, present), 0, "P2PWSCProvisionDiscoveryRes" , 0, 6, 12, SigIeP2PWSCProvisionDiscoveryRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_P2PWSCPROVISIONDISCOVERYRES, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackProvisionDiscoveryRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fProvisionDiscoveryRes *pFrm)
@@ -14568,7 +15338,7 @@ tANI_U32 dot11fUnpackProvisionDiscoveryRes(tpAniSirGlobal pCtx, tANI_U8 *pBuf, t
     };
 
     static const tIEDefn IES_QosMapConfigure[] = {
-        {offsetof(tDot11fQosMapConfigure, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 1, },
+        {offsetof(tDot11fQosMapConfigure, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackQosMapConfigure(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fQosMapConfigure *pFrm)
@@ -14612,7 +15382,7 @@ tANI_U32 dot11fUnpackQosMapConfigure(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U3
     };
 
     static const tIEDefn IES_RadioMeasurementReport[] = {
-        {offsetof(tDot11fRadioMeasurementReport, MeasurementReport), offsetof(tDot11fIEMeasurementReport, present), offsetof(tDot11fRadioMeasurementReport, num_MeasurementReport), "MeasurementReport" , 4, 5, 31, SigIeMeasurementReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTREPORT, 1, },
+        {offsetof(tDot11fRadioMeasurementReport, MeasurementReport), offsetof(tDot11fIEMeasurementReport, present), offsetof(tDot11fRadioMeasurementReport, num_MeasurementReport), "MeasurementReport" , 4, 5, 31, SigIeMeasurementReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTREPORT, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackRadioMeasurementReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fRadioMeasurementReport *pFrm)
@@ -14712,7 +15482,7 @@ tANI_U32 dot11fUnpackRadioMeasurementReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf,
     };
 
     static const tIEDefn IES_RadioMeasurementRequest[] = {
-        {offsetof(tDot11fRadioMeasurementRequest, MeasurementRequest), offsetof(tDot11fIEMeasurementRequest, present), offsetof(tDot11fRadioMeasurementRequest, num_MeasurementRequest), "MeasurementRequest" , 2, 16, 18, SigIeMeasurementRequest, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTREQUEST, 1, },
+        {offsetof(tDot11fRadioMeasurementRequest, MeasurementRequest), offsetof(tDot11fIEMeasurementRequest, present), offsetof(tDot11fRadioMeasurementRequest, num_MeasurementRequest), "MeasurementRequest" , 2, 16, 18, SigIeMeasurementRequest, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MEASUREMENTREQUEST, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackRadioMeasurementRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fRadioMeasurementRequest *pFrm)
@@ -14795,36 +15565,38 @@ tANI_U32 dot11fUnpackRadioMeasurementRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf,
     };
 
     static const tIEDefn IES_ReAssocRequest[] = {
-        {offsetof(tDot11fReAssocRequest, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 1, },
-        {offsetof(tDot11fReAssocRequest, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fReAssocRequest, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fReAssocRequest, PowerCaps), offsetof(tDot11fIEPowerCaps, present), 0, "PowerCaps" , 0, 4, 4, SigIePowerCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCAPS, 0, },
-        {offsetof(tDot11fReAssocRequest, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, },
-        {offsetof(tDot11fReAssocRequest, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
-        {offsetof(tDot11fReAssocRequest, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, },
-        {offsetof(tDot11fReAssocRequest, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
-        {offsetof(tDot11fReAssocRequest, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fReAssocRequest, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
-        {offsetof(tDot11fReAssocRequest, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fReAssocRequest, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, },
-        {offsetof(tDot11fReAssocRequest, WPAOpaque), offsetof(tDot11fIEWPAOpaque, present), 0, "WPAOpaque" , 0, 8, 255, SigIeWPAOpaque, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPAOPAQUE, 0, },
-        {offsetof(tDot11fReAssocRequest, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fReAssocRequest, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, },
-        {offsetof(tDot11fReAssocRequest, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, },
-        {offsetof(tDot11fReAssocRequest, WscIEOpaque), offsetof(tDot11fIEWscIEOpaque, present), 0, "WscIEOpaque" , 0, 8, 255, SigIeWscIEOpaque, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCIEOPAQUE, 0, },
-        {offsetof(tDot11fReAssocRequest, WAPIOpaque), offsetof(tDot11fIEWAPIOpaque, present), 0, "WAPIOpaque" , 0, 8, 255, SigIeWAPIOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPIOPAQUE, 0, },
-        {offsetof(tDot11fReAssocRequest, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, },
-        {offsetof(tDot11fReAssocRequest, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, },
-        {offsetof(tDot11fReAssocRequest, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, },
-        {offsetof(tDot11fReAssocRequest, ESECckmOpaque), offsetof(tDot11fIEESECckmOpaque, present), 0, "ESECckmOpaque" , 0, 12, 26, SigIeESECckmOpaque, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESECCKMOPAQUE, 0, },
-        {offsetof(tDot11fReAssocRequest, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), offsetof(tDot11fReAssocRequest, num_WMMTSPEC), "WMMTSPEC" , 4, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, },
-        {offsetof(tDot11fReAssocRequest, ESETrafStrmRateSet), offsetof(tDot11fIEESETrafStrmRateSet, present), 0, "ESETrafStrmRateSet" , 0, 7, 15, SigIeESETrafStrmRateSet, {0, 64, 150, 8, 0}, 4, DOT11F_EID_ESETRAFSTRMRATESET, 0, },
-        {offsetof(tDot11fReAssocRequest, P2PIEOpaque), offsetof(tDot11fIEP2PIEOpaque, present), 0, "P2PIEOpaque" , 0, 8, 255, SigIeP2PIEOpaque, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PIEOPAQUE, 0, },
-        {offsetof(tDot11fReAssocRequest, WFDIEOpaque), offsetof(tDot11fIEWFDIEOpaque, present), 0, "WFDIEOpaque" , 0, 8, 255, SigIeWFDIEOpaque, {80, 111, 154, 10, 0}, 4, DOT11F_EID_WFDIEOPAQUE, 0, },
-        {offsetof(tDot11fReAssocRequest, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fReAssocRequest, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fReAssocRequest, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
-        {offsetof(tDot11fReAssocRequest, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 0, },
-        {offsetof(tDot11fReAssocRequest, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, },
+        {offsetof(tDot11fReAssocRequest, SSID), offsetof(tDot11fIESSID, present), 0, "SSID" , 0, 2, 34, SigIeSSID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SSID, 0, 1, },
+        {offsetof(tDot11fReAssocRequest, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fReAssocRequest, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, PowerCaps), offsetof(tDot11fIEPowerCaps, present), 0, "PowerCaps" , 0, 4, 4, SigIePowerCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCAPS, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fReAssocRequest, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, WPAOpaque), offsetof(tDot11fIEWPAOpaque, present), 0, "WPAOpaque" , 0, 8, 255, SigIeWPAOpaque, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPAOPAQUE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, WMMCaps), offsetof(tDot11fIEWMMCaps, present), 0, "WMMCaps" , 0, 9, 9, SigIeWMMCaps, {0, 80, 242, 2, 5}, 5, DOT11F_EID_WMMCAPS, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, WscIEOpaque), offsetof(tDot11fIEWscIEOpaque, present), 0, "WscIEOpaque" , 0, 8, 255, SigIeWscIEOpaque, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCIEOPAQUE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, WAPIOpaque), offsetof(tDot11fIEWAPIOpaque, present), 0, "WAPIOpaque" , 0, 8, 255, SigIeWAPIOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPIOPAQUE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, WAPI), offsetof(tDot11fIEWAPI, present), 0, "WAPI" , 0, 14, 112, SigIeWAPI, {0, 0, 0, 0, 0}, 0, DOT11F_EID_WAPI, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, ESEVersion), offsetof(tDot11fIEESEVersion, present), 0, "ESEVersion" , 0, 7, 7, SigIeESEVersion, {0, 64, 150, 3, 0}, 4, DOT11F_EID_ESEVERSION, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, ESECckmOpaque), offsetof(tDot11fIEESECckmOpaque, present), 0, "ESECckmOpaque" , 0, 12, 26, SigIeESECckmOpaque, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESECCKMOPAQUE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), offsetof(tDot11fReAssocRequest, num_WMMTSPEC), "WMMTSPEC" , 4, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, ESETrafStrmRateSet), offsetof(tDot11fIEESETrafStrmRateSet, present), 0, "ESETrafStrmRateSet" , 0, 7, 15, SigIeESETrafStrmRateSet, {0, 64, 150, 8, 0}, 4, DOT11F_EID_ESETRAFSTRMRATESET, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, P2PIEOpaque), offsetof(tDot11fIEP2PIEOpaque, present), 0, "P2PIEOpaque" , 0, 8, 255, SigIeP2PIEOpaque, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PIEOPAQUE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, WFDIEOpaque), offsetof(tDot11fIEWFDIEOpaque, present), 0, "WFDIEOpaque" , 0, 8, 255, SigIeWFDIEOpaque, {80, 111, 154, 10, 0}, 4, DOT11F_EID_WFDIEOPAQUE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 5, 12, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, 0, },
+        {offsetof(tDot11fReAssocRequest, hs20vendor_ie), offsetof(tDot11fIEhs20vendor_ie, present), 0, "hs20vendor_ie" , 0, 7, 9, SigIehs20vendor_ie, {80, 111, 154, 16, 0}, 4, DOT11F_EID_HS20VENDOR_IE, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackReAssocRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fReAssocRequest *pFrm)
@@ -15669,6 +16441,54 @@ tANI_U32 dot11fUnpackReAssocRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->vendor2_ie.VHTOperation.basicMCSSet, 2);
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("QComVendorIE:\n"));
+        if (!pFrm->QComVendorIE.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -15683,34 +16503,35 @@ tANI_U32 dot11fUnpackReAssocRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32
     };
 
     static const tIEDefn IES_ReAssocResponse[] = {
-        {offsetof(tDot11fReAssocResponse, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fReAssocResponse, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fReAssocResponse, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
-        {offsetof(tDot11fReAssocResponse, RCPIIE), offsetof(tDot11fIERCPIIE, present), 0, "RCPIIE" , 0, 3, 3, SigIeRCPIIE, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RCPIIE, 0, },
-        {offsetof(tDot11fReAssocResponse, RSNIIE), offsetof(tDot11fIERSNIIE, present), 0, "RSNIIE" , 0, 3, 3, SigIeRSNIIE, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNIIE, 0, },
-        {offsetof(tDot11fReAssocResponse, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, },
-        {offsetof(tDot11fReAssocResponse, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, },
-        {offsetof(tDot11fReAssocResponse, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, },
-        {offsetof(tDot11fReAssocResponse, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
-        {offsetof(tDot11fReAssocResponse, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fReAssocResponse, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, },
-        {offsetof(tDot11fReAssocResponse, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, },
-        {offsetof(tDot11fReAssocResponse, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, },
-        {offsetof(tDot11fReAssocResponse, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fReAssocResponse, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, },
-        {offsetof(tDot11fReAssocResponse, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, },
-        {offsetof(tDot11fReAssocResponse, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, },
-        {offsetof(tDot11fReAssocResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, },
-        {offsetof(tDot11fReAssocResponse, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, },
-        {offsetof(tDot11fReAssocResponse, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), offsetof(tDot11fReAssocResponse, num_WMMTSPEC), "WMMTSPEC" , 4, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, },
-        {offsetof(tDot11fReAssocResponse, ESETrafStrmRateSet), offsetof(tDot11fIEESETrafStrmRateSet, present), 0, "ESETrafStrmRateSet" , 0, 7, 15, SigIeESETrafStrmRateSet, {0, 64, 150, 8, 0}, 4, DOT11F_EID_ESETRAFSTRMRATESET, 0, },
-        {offsetof(tDot11fReAssocResponse, WscReassocRes), offsetof(tDot11fIEWscReassocRes, present), 0, "WscReassocRes" , 0, 6, 37, SigIeWscReassocRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCREASSOCRES, 0, },
-        {offsetof(tDot11fReAssocResponse, P2PAssocRes), offsetof(tDot11fIEP2PAssocRes, present), 0, "P2PAssocRes" , 0, 6, 17, SigIeP2PAssocRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PASSOCRES, 0, },
-        {offsetof(tDot11fReAssocResponse, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fReAssocResponse, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
-        {offsetof(tDot11fReAssocResponse, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fReAssocResponse, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, },
-        {offsetof(tDot11fReAssocResponse, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 0, },
-        {offsetof(tDot11fReAssocResponse, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, },
+        {offsetof(tDot11fReAssocResponse, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fReAssocResponse, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, RCPIIE), offsetof(tDot11fIERCPIIE, present), 0, "RCPIIE" , 0, 3, 3, SigIeRCPIIE, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RCPIIE, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, RSNIIE), offsetof(tDot11fIERSNIIE, present), 0, "RSNIIE" , 0, 3, 3, SigIeRSNIIE, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNIIE, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, RRMEnabledCap), offsetof(tDot11fIERRMEnabledCap, present), 0, "RRMEnabledCap" , 0, 7, 7, SigIeRRMEnabledCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RRMENABLEDCAP, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fReAssocResponse, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, WPA), offsetof(tDot11fIEWPA, present), 0, "WPA" , 0, 8, 50, SigIeWPA, {0, 80, 242, 1, 0}, 4, DOT11F_EID_WPA, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, ESERadMgmtCap), offsetof(tDot11fIEESERadMgmtCap, present), 0, "ESERadMgmtCap" , 0, 8, 8, SigIeESERadMgmtCap, {0, 64, 150, 1, 0}, 4, DOT11F_EID_ESERADMGMTCAP, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, ESETxmitPower), offsetof(tDot11fIEESETxmitPower, present), 0, "ESETxmitPower" , 0, 8, 8, SigIeESETxmitPower, {0, 64, 150, 0, 0}, 4, DOT11F_EID_ESETXMITPOWER, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), offsetof(tDot11fReAssocResponse, num_WMMTSPEC), "WMMTSPEC" , 4, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, ESETrafStrmRateSet), offsetof(tDot11fIEESETrafStrmRateSet, present), 0, "ESETrafStrmRateSet" , 0, 7, 15, SigIeESETrafStrmRateSet, {0, 64, 150, 8, 0}, 4, DOT11F_EID_ESETRAFSTRMRATESET, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, WscReassocRes), offsetof(tDot11fIEWscReassocRes, present), 0, "WscReassocRes" , 0, 6, 37, SigIeWscReassocRes, {0, 80, 242, 4, 0}, 4, DOT11F_EID_WSCREASSOCRES, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, P2PAssocRes), offsetof(tDot11fIEP2PAssocRes, present), 0, "P2PAssocRes" , 0, 6, 17, SigIeP2PAssocRes, {80, 111, 154, 9, 0}, 4, DOT11F_EID_P2PASSOCRES, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, OBSSScanParameters), offsetof(tDot11fIEOBSSScanParameters, present), 0, "OBSSScanParameters" , 0, 16, 16, SigIeOBSSScanParameters, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OBSSSCANPARAMETERS, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, QosMapSet), offsetof(tDot11fIEQosMapSet, present), 0, "QosMapSet" , 0, 2, 62, SigIeQosMapSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSMAPSET, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, 0, },
+        {offsetof(tDot11fReAssocResponse, QComVendorIE), offsetof(tDot11fIEQComVendorIE, present), 0, "QComVendorIE" , 0, 5, 12, SigIeQComVendorIE, {0, 160, 198, 0, 0}, 3, DOT11F_EID_QCOMVENDORIE, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackReAssocResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fReAssocResponse *pFrm)
@@ -16669,6 +17490,33 @@ tANI_U32 dot11fUnpackReAssocResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U3
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->vendor2_ie.VHTOperation.basicMCSSet, 2);
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("QComVendorIE:\n"));
+        if (!pFrm->QComVendorIE.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
+        }
     }
 #   endif // DOT11F_DUMP_FRAMES
     return status;
@@ -16790,7 +17638,7 @@ tANI_U32 dot11fUnpackSaQueryRsp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBu
     };
 
     static const tIEDefn IES_TDLSDisReq[] = {
-        {offsetof(tDot11fTDLSDisReq, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 1, },
+        {offsetof(tDot11fTDLSDisReq, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSDisReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSDisReq *pFrm)
@@ -16838,19 +17686,19 @@ tANI_U32 dot11fUnpackTDLSDisReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBu
     };
 
     static const tIEDefn IES_TDLSDisRsp[] = {
-        {offsetof(tDot11fTDLSDisRsp, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fTDLSDisRsp, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fTDLSDisRsp, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, },
-        {offsetof(tDot11fTDLSDisRsp, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, },
-        {offsetof(tDot11fTDLSDisRsp, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
-        {offsetof(tDot11fTDLSDisRsp, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fTDLSDisRsp, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
-        {offsetof(tDot11fTDLSDisRsp, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, },
-        {offsetof(tDot11fTDLSDisRsp, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, },
-        {offsetof(tDot11fTDLSDisRsp, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fTDLSDisRsp, HT2040BSSCoexistence), offsetof(tDot11fIEHT2040BSSCoexistence, present), 0, "HT2040BSSCoexistence" , 0, 3, 3, SigIeHT2040BSSCoexistence, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSCOEXISTENCE, 0, },
-        {offsetof(tDot11fTDLSDisRsp, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 1, },
-        {offsetof(tDot11fTDLSDisRsp, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
+        {offsetof(tDot11fTDLSDisRsp, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fTDLSDisRsp, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, HT2040BSSCoexistence), offsetof(tDot11fIEHT2040BSSCoexistence, present), 0, "HT2040BSSCoexistence" , 0, 3, 3, SigIeHT2040BSSCoexistence, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSCOEXISTENCE, 0, 0, },
+        {offsetof(tDot11fTDLSDisRsp, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, 1, },
+        {offsetof(tDot11fTDLSDisRsp, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSDisRsp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSDisRsp *pFrm)
@@ -17166,9 +18014,9 @@ tANI_U32 dot11fUnpackTDLSDisRsp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBu
     };
 
     static const tIEDefn IES_TDLSPeerTrafficInd[] = {
-        {offsetof(tDot11fTDLSPeerTrafficInd, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 1, },
-        {offsetof(tDot11fTDLSPeerTrafficInd, PTIControl), offsetof(tDot11fIEPTIControl, present), 0, "PTIControl" , 0, 5, 5, SigIePTIControl, {0, 0, 0, 0, 0}, 0, DOT11F_EID_PTICONTROL, 0, },
-        {offsetof(tDot11fTDLSPeerTrafficInd, PUBufferStatus), offsetof(tDot11fIEPUBufferStatus, present), 0, "PUBufferStatus" , 0, 3, 3, SigIePUBufferStatus, {0, 0, 0, 0, 0}, 0, DOT11F_EID_PUBUFFERSTATUS, 1, },
+        {offsetof(tDot11fTDLSPeerTrafficInd, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, 1, },
+        {offsetof(tDot11fTDLSPeerTrafficInd, PTIControl), offsetof(tDot11fIEPTIControl, present), 0, "PTIControl" , 0, 5, 5, SigIePTIControl, {0, 0, 0, 0, 0}, 0, DOT11F_EID_PTICONTROL, 0, 0, },
+        {offsetof(tDot11fTDLSPeerTrafficInd, PUBufferStatus), offsetof(tDot11fIEPUBufferStatus, present), 0, "PUBufferStatus" , 0, 3, 3, SigIePUBufferStatus, {0, 0, 0, 0, 0}, 0, DOT11F_EID_PUBUFFERSTATUS, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSPeerTrafficInd(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSPeerTrafficInd *pFrm)
@@ -17238,7 +18086,7 @@ tANI_U32 dot11fUnpackTDLSPeerTrafficInd(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI
     };
 
     static const tIEDefn IES_TDLSPeerTrafficRsp[] = {
-        {offsetof(tDot11fTDLSPeerTrafficRsp, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 1, },
+        {offsetof(tDot11fTDLSPeerTrafficRsp, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSPeerTrafficRsp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSPeerTrafficRsp *pFrm)
@@ -17286,15 +18134,15 @@ tANI_U32 dot11fUnpackTDLSPeerTrafficRsp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI
     };
 
     static const tIEDefn IES_TDLSSetupCnf[] = {
-        {offsetof(tDot11fTDLSSetupCnf, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
-        {offsetof(tDot11fTDLSSetupCnf, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, },
-        {offsetof(tDot11fTDLSSetupCnf, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
-        {offsetof(tDot11fTDLSSetupCnf, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, },
-        {offsetof(tDot11fTDLSSetupCnf, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, },
-        {offsetof(tDot11fTDLSSetupCnf, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, },
-        {offsetof(tDot11fTDLSSetupCnf, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, },
-        {offsetof(tDot11fTDLSSetupCnf, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, },
-        {offsetof(tDot11fTDLSSetupCnf, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, EDCAParamSet), offsetof(tDot11fIEEDCAParamSet, present), 0, "EDCAParamSet" , 0, 20, 20, SigIeEDCAParamSet, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EDCAPARAMSET, 0, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, HTInfo), offsetof(tDot11fIEHTInfo, present), 0, "HTInfo" , 0, 24, 56, SigIeHTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTINFO, 0, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, WMMParams), offsetof(tDot11fIEWMMParams, present), 0, "WMMParams" , 0, 26, 26, SigIeWMMParams, {0, 80, 242, 2, 1}, 5, DOT11F_EID_WMMPARAMS, 0, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, VHTOperation), offsetof(tDot11fIEVHTOperation, present), 0, "VHTOperation" , 0, 7, 7, SigIeVHTOperation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTOPERATION, 0, 0, },
+        {offsetof(tDot11fTDLSSetupCnf, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSSetupCnf(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSSetupCnf *pFrm)
@@ -17560,23 +18408,23 @@ tANI_U32 dot11fUnpackTDLSSetupCnf(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 n
     };
 
     static const tIEDefn IES_TDLSSetupReq[] = {
-        {offsetof(tDot11fTDLSSetupReq, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 1, },
-        {offsetof(tDot11fTDLSSetupReq, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, },
-        {offsetof(tDot11fTDLSSetupReq, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fTDLSSetupReq, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, },
-        {offsetof(tDot11fTDLSSetupReq, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
-        {offsetof(tDot11fTDLSSetupReq, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fTDLSSetupReq, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, },
-        {offsetof(tDot11fTDLSSetupReq, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, },
-        {offsetof(tDot11fTDLSSetupReq, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
-        {offsetof(tDot11fTDLSSetupReq, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, },
-        {offsetof(tDot11fTDLSSetupReq, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, },
-        {offsetof(tDot11fTDLSSetupReq, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fTDLSSetupReq, HT2040BSSCoexistence), offsetof(tDot11fIEHT2040BSSCoexistence, present), 0, "HT2040BSSCoexistence" , 0, 3, 3, SigIeHT2040BSSCoexistence, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSCOEXISTENCE, 0, },
-        {offsetof(tDot11fTDLSSetupReq, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 1, },
-        {offsetof(tDot11fTDLSSetupReq, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, },
-        {offsetof(tDot11fTDLSSetupReq, AID), offsetof(tDot11fIEAID, present), 0, "AID" , 0, 4, 4, SigIeAID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_AID, 0, },
-        {offsetof(tDot11fTDLSSetupReq, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
+        {offsetof(tDot11fTDLSSetupReq, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 1, },
+        {offsetof(tDot11fTDLSSetupReq, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, HT2040BSSCoexistence), offsetof(tDot11fIEHT2040BSSCoexistence, present), 0, "HT2040BSSCoexistence" , 0, 3, 3, SigIeHT2040BSSCoexistence, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSCOEXISTENCE, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, 1, },
+        {offsetof(tDot11fTDLSSetupReq, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, AID), offsetof(tDot11fIEAID, present), 0, "AID" , 0, 4, 4, SigIeAID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_AID, 0, 0, },
+        {offsetof(tDot11fTDLSSetupReq, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSSetupReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSSetupReq *pFrm)
@@ -17945,24 +18793,24 @@ tANI_U32 dot11fUnpackTDLSSetupReq(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 n
     };
 
     static const tIEDefn IES_TDLSSetupRsp[] = {
-        {offsetof(tDot11fTDLSSetupRsp, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, HT2040BSSCoexistence), offsetof(tDot11fIEHT2040BSSCoexistence, present), 0, "HT2040BSSCoexistence" , 0, 3, 3, SigIeHT2040BSSCoexistence, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSCOEXISTENCE, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, AID), offsetof(tDot11fIEAID, present), 0, "AID" , 0, 4, 4, SigIeAID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_AID, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, },
-        {offsetof(tDot11fTDLSSetupRsp, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, SuppRates), offsetof(tDot11fIESuppRates, present), 0, "SuppRates" , 0, 2, 14, SigIeSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPRATES, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, ExtSuppRates), offsetof(tDot11fIEExtSuppRates, present), 0, "ExtSuppRates" , 0, 3, 14, SigIeExtSuppRates, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTSUPPRATES, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, SuppChannels), offsetof(tDot11fIESuppChannels, present), 0, "SuppChannels" , 0, 4, 98, SigIeSuppChannels, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPCHANNELS, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, RSN), offsetof(tDot11fIERSN, present), 0, "RSN" , 0, 8, 116, SigIeRSN, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSN, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, SuppOperatingClasses), offsetof(tDot11fIESuppOperatingClasses, present), 0, "SuppOperatingClasses" , 0, 3, 34, SigIeSuppOperatingClasses, {0, 0, 0, 0, 0}, 0, DOT11F_EID_SUPPOPERATINGCLASSES, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, QOSCapsStation), offsetof(tDot11fIEQOSCapsStation, present), 0, "QOSCapsStation" , 0, 3, 3, SigIeQOSCapsStation, {0, 0, 0, 0, 0}, 0, DOT11F_EID_QOSCAPSSTATION, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, RICData), offsetof(tDot11fIERICData, present), 0, "RICData" , 0, 6, 6, SigIeRICData, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATA, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, HTCaps), offsetof(tDot11fIEHTCaps, present), 0, "HTCaps" , 0, 28, 60, SigIeHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HTCAPS, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, HT2040BSSCoexistence), offsetof(tDot11fIEHT2040BSSCoexistence, present), 0, "HT2040BSSCoexistence" , 0, 3, 3, SigIeHT2040BSSCoexistence, {0, 0, 0, 0, 0}, 0, DOT11F_EID_HT2040BSSCOEXISTENCE, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, WMMInfoStation), offsetof(tDot11fIEWMMInfoStation, present), 0, "WMMInfoStation" , 0, 9, 9, SigIeWMMInfoStation, {0, 80, 242, 2, 0}, 5, DOT11F_EID_WMMINFOSTATION, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, AID), offsetof(tDot11fIEAID, present), 0, "AID" , 0, 4, 4, SigIeAID, {0, 0, 0, 0, 0}, 0, DOT11F_EID_AID, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, VHTCaps), offsetof(tDot11fIEVHTCaps, present), 0, "VHTCaps" , 0, 14, 14, SigIeVHTCaps, {0, 0, 0, 0, 0}, 0, DOT11F_EID_VHTCAPS, 0, 0, },
+        {offsetof(tDot11fTDLSSetupRsp, OperatingMode), offsetof(tDot11fIEOperatingMode, present), 0, "OperatingMode" , 0, 3, 3, SigIeOperatingMode, {0, 0, 0, 0, 0}, 0, DOT11F_EID_OPERATINGMODE, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSSetupRsp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSSetupRsp *pFrm)
@@ -18343,8 +19191,8 @@ tANI_U32 dot11fUnpackTDLSSetupRsp(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 n
     };
 
     static const tIEDefn IES_TDLSTeardown[] = {
-        {offsetof(tDot11fTDLSTeardown, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, },
-        {offsetof(tDot11fTDLSTeardown, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 1, },
+        {offsetof(tDot11fTDLSTeardown, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, 0, },
+        {offsetof(tDot11fTDLSTeardown, LinkIdentifier), offsetof(tDot11fIELinkIdentifier, present), 0, "LinkIdentifier" , 0, 20, 20, SigIeLinkIdentifier, {0, 0, 0, 0, 0}, 0, DOT11F_EID_LINKIDENTIFIER, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTDLSTeardown(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTDLSTeardown *pFrm)
@@ -18449,7 +19297,7 @@ tANI_U32 dot11fUnpackTDLSTeardown(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 n
     };
 
     static const tIEDefn IES_TPCReport[] = {
-        {offsetof(tDot11fTPCReport, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 1, },
+        {offsetof(tDot11fTPCReport, TPCReport), offsetof(tDot11fIETPCReport, present), 0, "TPCReport" , 0, 4, 4, SigIeTPCReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREPORT, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTPCReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTPCReport *pFrm)
@@ -18495,7 +19343,7 @@ tANI_U32 dot11fUnpackTPCReport(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf
     };
 
     static const tIEDefn IES_TPCRequest[] = {
-        {offsetof(tDot11fTPCRequest, TPCRequest), offsetof(tDot11fIETPCRequest, present), 0, "TPCRequest" , 0, 2, 2, SigIeTPCRequest, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREQUEST, 1, },
+        {offsetof(tDot11fTPCRequest, TPCRequest), offsetof(tDot11fIETPCRequest, present), 0, "TPCRequest" , 0, 2, 2, SigIeTPCRequest, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TPCREQUEST, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTPCRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTPCRequest *pFrm)
@@ -18538,13 +19386,13 @@ tANI_U32 dot11fUnpackTPCRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBu
     };
 
     static const tIEDefn IES_TimingAdvertisementFrame[] = {
-        {offsetof(tDot11fTimingAdvertisementFrame, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, },
-        {offsetof(tDot11fTimingAdvertisementFrame, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, },
-        {offsetof(tDot11fTimingAdvertisementFrame, TimeAdvertisement), offsetof(tDot11fIETimeAdvertisement, present), 0, "TimeAdvertisement" , 0, 18, 18, SigIeTimeAdvertisement, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEADVERTISEMENT, 0, },
-        {offsetof(tDot11fTimingAdvertisementFrame, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 10, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, },
-        {offsetof(tDot11fTimingAdvertisementFrame, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, },
-        {offsetof(tDot11fTimingAdvertisementFrame, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, },
-        {offsetof(tDot11fTimingAdvertisementFrame, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, },
+        {offsetof(tDot11fTimingAdvertisementFrame, Country), offsetof(tDot11fIECountry, present), 0, "Country" , 0, 5, 257, SigIeCountry, {0, 0, 0, 0, 0}, 0, DOT11F_EID_COUNTRY, 0, 0, },
+        {offsetof(tDot11fTimingAdvertisementFrame, PowerConstraints), offsetof(tDot11fIEPowerConstraints, present), 0, "PowerConstraints" , 0, 3, 3, SigIePowerConstraints, {0, 0, 0, 0, 0}, 0, DOT11F_EID_POWERCONSTRAINTS, 0, 0, },
+        {offsetof(tDot11fTimingAdvertisementFrame, TimeAdvertisement), offsetof(tDot11fIETimeAdvertisement, present), 0, "TimeAdvertisement" , 0, 18, 18, SigIeTimeAdvertisement, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEADVERTISEMENT, 0, 0, },
+        {offsetof(tDot11fTimingAdvertisementFrame, ExtCap), offsetof(tDot11fIEExtCap, present), 0, "ExtCap" , 0, 3, 11, SigIeExtCap, {0, 0, 0, 0, 0}, 0, DOT11F_EID_EXTCAP, 0, 0, },
+        {offsetof(tDot11fTimingAdvertisementFrame, Vendor1IE), offsetof(tDot11fIEVendor1IE, present), 0, "Vendor1IE" , 0, 5, 5, SigIeVendor1IE, {0, 16, 24, 0, 0}, 3, DOT11F_EID_VENDOR1IE, 0, 0, },
+        {offsetof(tDot11fTimingAdvertisementFrame, vendor2_ie), offsetof(tDot11fIEvendor2_ie, present), 0, "vendor2_ie" , 0, 7, 28, SigIevendor2_ie, {0, 144, 76, 0, 0}, 3, DOT11F_EID_VENDOR2_IE, 0, 0, },
+        {offsetof(tDot11fTimingAdvertisementFrame, Vendor3IE), offsetof(tDot11fIEVendor3IE, present), 0, "Vendor3IE" , 0, 5, 5, SigIeVendor3IE, {0, 22, 50, 0, 0}, 3, DOT11F_EID_VENDOR3IE, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackTimingAdvertisementFrame(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fTimingAdvertisementFrame *pFrm)
@@ -18745,8 +19593,8 @@ tANI_U32 dot11fUnpackVHTGidManagementActionFrame(tpAniSirGlobal pCtx, tANI_U8 *p
     };
 
     static const tIEDefn IES_WMMAddTSRequest[] = {
-        {offsetof(tDot11fWMMAddTSRequest, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 1, },
-        {offsetof(tDot11fWMMAddTSRequest, ESETrafStrmRateSet), offsetof(tDot11fIEESETrafStrmRateSet, present), 0, "ESETrafStrmRateSet" , 0, 7, 15, SigIeESETrafStrmRateSet, {0, 64, 150, 8, 0}, 4, DOT11F_EID_ESETRAFSTRMRATESET, 0, },
+        {offsetof(tDot11fWMMAddTSRequest, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, 1, },
+        {offsetof(tDot11fWMMAddTSRequest, ESETrafStrmRateSet), offsetof(tDot11fIEESETrafStrmRateSet, present), 0, "ESETrafStrmRateSet" , 0, 7, 15, SigIeESETrafStrmRateSet, {0, 64, 150, 8, 0}, 4, DOT11F_EID_ESETRAFSTRMRATESET, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackWMMAddTSRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fWMMAddTSRequest *pFrm)
@@ -18831,8 +19679,8 @@ tANI_U32 dot11fUnpackWMMAddTSRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U3
     };
 
     static const tIEDefn IES_WMMAddTSResponse[] = {
-        {offsetof(tDot11fWMMAddTSResponse, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, },
-        {offsetof(tDot11fWMMAddTSResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, },
+        {offsetof(tDot11fWMMAddTSResponse, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, 0, },
+        {offsetof(tDot11fWMMAddTSResponse, ESETrafStrmMet), offsetof(tDot11fIEESETrafStrmMet, present), 0, "ESETrafStrmMet" , 0, 10, 10, SigIeESETrafStrmMet, {0, 64, 150, 7, 0}, 4, DOT11F_EID_ESETRAFSTRMMET, 0, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackWMMAddTSResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fWMMAddTSResponse *pFrm)
@@ -18917,7 +19765,7 @@ tANI_U32 dot11fUnpackWMMAddTSResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U
     };
 
     static const tIEDefn IES_WMMDelTS[] = {
-        {offsetof(tDot11fWMMDelTS, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 1, },
+        {offsetof(tDot11fWMMDelTS, WMMTSPEC), offsetof(tDot11fIEWMMTSPEC, present), 0, "WMMTSPEC" , 0, 63, 63, SigIeWMMTSPEC, {0, 80, 242, 2, 2}, 5, DOT11F_EID_WMMTSPEC, 0, 1, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackWMMDelTS(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fWMMDelTS *pFrm)
@@ -19032,7 +19880,7 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
     const tIEDefn *pIe;
     tANI_U8   *pBufRemaining;
     tANI_U32  nBufRemaining, status;
-    tANI_U8   eid, len;
+    tANI_U8   eid, len, extn_eid;
     tFRAMES_BOOL  *pfFound;
     tANI_U32  countOffset = 0;
 
@@ -19045,7 +19893,7 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
     nBufRemaining = nBuf;
 
     pIe = &IEs[0];
-    while (0xff != pIe->eid)
+    while (0xff != pIe->eid || pIe->extn_eid)
     {
         pfFound = (tFRAMES_BOOL*)(pFrm + pIe->offset +
                                   pIe->presenceOffset);
@@ -19211,14 +20059,18 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
 
         eid = *pBufRemaining++; --nBufRemaining;
         len = *pBufRemaining++; --nBufRemaining;
+        if (pIe && pIe->extn_eid) {
+            extn_eid = *pBufRemaining++; --nBufRemaining;
+            len--;
+        }
 
         if (pIe && pIe->noui)
         {
             if (pIe->noui > nBufRemaining)
             {
-                FRAMES_LOG3(pCtx, FRLOGW, FRFL("IE %d reports "
+                FRAMES_LOG4(pCtx, FRLOGW, FRFL("IE %d extn id %d reports "
                     "length %d, but it has an OUI of %d bytes.\n"),
-                    eid, len, pIe->noui);
+                    eid, extn_eid, len, pIe->noui);
                 FRAMES_DUMP(pCtx, FRLOG1, pBuf, nBuf);
                 FRAMES_LOG2(pCtx, FRLOG1, FRFL("We've parsed %d by"
                     "tes of this buffer, and show %d left.\n"),                    pBufRemaining - pBuf, nBufRemaining);
@@ -19233,9 +20085,9 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
 
         if (len > nBufRemaining)
         {
-            FRAMES_LOG3(pCtx, FRLOGW, FRFL("IE %d reports length %"
+            FRAMES_LOG4(pCtx, FRLOGW, FRFL("IE %d extn id %d reports length %"
                 "d, but there are only %d bytes remaining in this"
-                " frame.\n"), eid, len, nBufRemaining);
+                " frame.\n"), eid, extn_eid, len, nBufRemaining);
             FRAMES_DUMP(pCtx, FRLOG1, pBuf, nBuf);
             FRAMES_LOG2(pCtx, FRLOG1, FRFL("We've parsed %d by"
                 "tes of this buffer, and show %d left.\n"),                pBufRemaining - pBuf, nBufRemaining);
@@ -19246,12 +20098,16 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
 
         if (pIe)
         {
-            if (nBufRemaining < pIe->minSize - pIe->noui - 2U)
+            if ((nBufRemaining < pIe->minSize - pIe->noui - 2U) ||
+                (len < pIe->minSize - pIe->noui - 2U))
             {
-                FRAMES_LOG3(pCtx, FRLOGW, FRFL("The IE %s must be "
-                    "at least %d bytes in size, but there are onl"
-                    "y %d bytes remaining in this frame.\n"),
-                    pIe->name, pIe->minSize, nBufRemaining);
+                FRAMES_LOG4(pCtx, FRLOGW, FRFL("The IE %s must "
+                   "be at least %d bytes in size, but "
+                   "there are only %d bytes remaining in "
+                   "this frame or the IE reports a size "
+                   "of %d bytes.\n"),
+                    pIe->name, pIe->minSize, nBufRemaining,
+                    (len + pIe->noui + 2U));
                 FRAMES_DUMP(pCtx, FRLOG1, pBuf, nBuf);
                 status |= DOT11F_INCOMPLETE_IE;
                 FRAMES_DBG_BREAK();
@@ -19269,6 +20125,10 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
                 }
 
         countOffset = ( (0 != pIe->arraybound) * ( *(tANI_U16* )(pFrm + pIe->countOffset)));
+        if (0 != pIe->arraybound && countOffset >= pIe->arraybound) {
+            status |= DOT11F_DUPLICATE_IE;
+            goto skip_dup_ie;
+        }
                 switch (pIe->sig)
                 {
                 case SigIeCondensedCountryStr:
@@ -19280,12 +20140,18 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
                 case SigIeIGTK:
                         status |= dot11fUnpackIeIGTK(pCtx, pBufRemaining, len, ( tDot11fIEIGTK* )(pFrm + pIe->offset + sizeof(tDot11fIEIGTK)*countOffset) );
                             break;
+                case SigIeMccChanInfo:
+                        status |= dot11fUnpackIeMccChanInfo(pCtx, pBufRemaining, len, ( tDot11fIEMccChanInfo* )(pFrm + pIe->offset + sizeof(tDot11fIEMccChanInfo)*countOffset) );
+                            break;
                 case SigIeR0KH_ID:
                         status |= dot11fUnpackIeR0KH_ID(pCtx, pBufRemaining, len, ( tDot11fIER0KH_ID* )(pFrm + pIe->offset + sizeof(tDot11fIER0KH_ID)*countOffset) );
                             break;
                 case SigIeR1KH_ID:
                         status |= dot11fUnpackIeR1KH_ID(pCtx, pBufRemaining, len, ( tDot11fIER1KH_ID* )(pFrm + pIe->offset + sizeof(tDot11fIER1KH_ID)*countOffset) );
                             break;
+                case SigIeSub20Info:
+                        status |= dot11fUnpackIeSub20Info(pCtx, pBufRemaining, len, ( tDot11fIESub20Info* )(pFrm + pIe->offset + sizeof(tDot11fIESub20Info)*countOffset) );
+                            break;
                 case SigIeTSFInfo:
                         status |= dot11fUnpackIeTSFInfo(pCtx, pBufRemaining, len, ( tDot11fIETSFInfo* )(pFrm + pIe->offset + sizeof(tDot11fIETSFInfo)*countOffset) );
                             break;
@@ -19363,6 +20229,9 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
                 case SigIeWiderBWChanSwitchAnn:
                         status |= dot11fUnpackIeWiderBWChanSwitchAnn(pCtx, pBufRemaining, len, ( tDot11fIEWiderBWChanSwitchAnn* )(pFrm + pIe->offset + sizeof(tDot11fIEWiderBWChanSwitchAnn)*countOffset) );
                             break;
+                case SigIevht_transmit_power_env:
+                        status |= dot11fUnpackIevht_transmit_power_env(pCtx, pBufRemaining, len, ( tDot11fIEvht_transmit_power_env* )(pFrm + pIe->offset + sizeof(tDot11fIEvht_transmit_power_env)*countOffset) );
+                            break;
                 case SigIeAID:
                         status |= dot11fUnpackIeAID(pCtx, pBufRemaining, len, ( tDot11fIEAID* )(pFrm + pIe->offset + sizeof(tDot11fIEAID)*countOffset) );
                             break;
@@ -19679,6 +20548,36 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
                 case SigIeext_chan_switch_ann:
                         status |= dot11fUnpackIeext_chan_switch_ann(pCtx, pBufRemaining, len, ( tDot11fIEext_chan_switch_ann* )(pFrm + pIe->offset + sizeof(tDot11fIEext_chan_switch_ann)*countOffset) );
                             break;
+                case SigIefils_assoc_delay_info:
+                        status |= dot11fUnpackIefils_assoc_delay_info(pCtx, pBufRemaining, len, ( tDot11fIEfils_assoc_delay_info* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_assoc_delay_info)*countOffset) );
+                            break;
+                case SigIefils_hlp_container:
+                        status |= dot11fUnpackIefils_hlp_container(pCtx, pBufRemaining, len, ( tDot11fIEfils_hlp_container* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_hlp_container)*countOffset) );
+                            break;
+                case SigIefils_indication:
+                        status |= dot11fUnpackIefils_indication(pCtx, pBufRemaining, len, ( tDot11fIEfils_indication* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_indication)*countOffset) );
+                            break;
+                case SigIefils_kde:
+                        status |= dot11fUnpackIefils_kde(pCtx, pBufRemaining, len, ( tDot11fIEfils_kde* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_kde)*countOffset) );
+                            break;
+                case SigIefils_key_confirmation:
+                        status |= dot11fUnpackIefils_key_confirmation(pCtx, pBufRemaining, len, ( tDot11fIEfils_key_confirmation* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_key_confirmation)*countOffset) );
+                            break;
+                case SigIefils_nonce:
+                        status |= dot11fUnpackIefils_nonce(pCtx, pBufRemaining, len, ( tDot11fIEfils_nonce* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_nonce)*countOffset) );
+                            break;
+                case SigIefils_public_key:
+                        status |= dot11fUnpackIefils_public_key(pCtx, pBufRemaining, len, ( tDot11fIEfils_public_key* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_public_key)*countOffset) );
+                            break;
+                case SigIefils_session:
+                        status |= dot11fUnpackIefils_session(pCtx, pBufRemaining, len, ( tDot11fIEfils_session* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_session)*countOffset) );
+                            break;
+                case SigIefils_wrapped_data:
+                        status |= dot11fUnpackIefils_wrapped_data(pCtx, pBufRemaining, len, ( tDot11fIEfils_wrapped_data* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_wrapped_data)*countOffset) );
+                            break;
+                case SigIehs20vendor_ie:
+                        status |= dot11fUnpackIehs20vendor_ie(pCtx, pBufRemaining, len, ( tDot11fIEhs20vendor_ie* )(pFrm + pIe->offset + sizeof(tDot11fIEhs20vendor_ie)*countOffset) );
+                            break;
                 case SigIesec_chan_offset_ele:
                         status |= dot11fUnpackIesec_chan_offset_ele(pCtx, pBufRemaining, len, ( tDot11fIEsec_chan_offset_ele* )(pFrm + pIe->offset + sizeof(tDot11fIEsec_chan_offset_ele)*countOffset) );
                             break;
@@ -19700,12 +20599,13 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
         }
         else
         {
-            FRAMES_LOG2(pCtx, FRLOG3, FRFL("Skipping unknown IE %d"
-                " (length %d)\n"), eid, len);
+            FRAMES_LOG3(pCtx, FRLOG3, FRFL("Skipping unknown IE %d extn ID %d"
+                " (length %d)\n"), eid, extn_eid, len);
             FRAMES_DUMP(pCtx, FRLOG3, pBufRemaining - 2, len);
             status |= DOT11F_UNKNOWN_IES;
         }
 
+skip_dup_ie:
         pBufRemaining += len;
 
          if (len > nBufRemaining)
@@ -19725,7 +20625,7 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
 
 MandatoryCheck:
     pIe = &IEs[0];
-    while (0xff != pIe->eid)
+    while (0xff != pIe->eid || pIe->extn_eid)
     {
         if (pIe->fMandatory)
         {
@@ -20603,6 +21503,18 @@ tANI_U32 dot11fGetPackedIEP2PWSCProvisionDiscoveryRes(tpAniSirGlobal pCtx, tDot1
     return status;
 } /* End dot11fGetPackedIEP2PWSCProvisionDiscoveryRes. */
 
+tANI_U32 dot11fGetPackedIEQComVendorIE(tpAniSirGlobal pCtx, tDot11fIEQComVendorIE *pIe, tANI_U32 *pnNeeded)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void)pCtx;
+    while ( pIe->present )
+    {
+        status = GetPackedSizeCore(pCtx, ( tANI_U8* )pIe, pnNeeded, IES_QComVendorIE);
+        break;
+    }
+    return status;
+} /* End dot11fGetPackedIEQComVendorIE. */
+
 tANI_U32 dot11fGetPackedIERICDataDesc(tpAniSirGlobal pCtx, tDot11fIERICDataDesc *pIe, tANI_U32 *pnNeeded)
 {
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
@@ -20810,6 +21722,31 @@ tANI_U32 dot11fGetPackedIEWscReassocRes(tpAniSirGlobal pCtx, tDot11fIEWscReassoc
     return status;
 } /* End dot11fGetPackedIEWscReassocRes. */
 
+tANI_U32 dot11fGetPackedIEhs20vendor_ie(tpAniSirGlobal pCtx, tDot11fIEhs20vendor_ie *pIe, tANI_U32 *pnNeeded)
+{
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    (void)pCtx;
+    while ( pIe->present )
+    {
+        *pnNeeded += 1;
+        if ( pIe->hs_id_present )
+        {
+            switch (pIe->hs_id_present)
+            {
+                case 1:
+                    *pnNeeded += 2;
+                break;
+                case 2:
+                    *pnNeeded += 2;
+                break;
+            }
+        }
+        else break;
+        break;
+    }
+    return status;
+} /* End dot11fGetPackedIEhs20vendor_ie. */
+
 tANI_U32 dot11fGetPackedIEvendor2_ie(tpAniSirGlobal pCtx, tDot11fIEvendor2_ie *pIe, tANI_U32 *pnNeeded)
 {
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
@@ -21347,7 +22284,7 @@ static tANI_U32 GetPackedSizeCore(tpAniSirGlobal pCtx,
     (void)pCtx; /* Shutup the compiler if we have no FFs nor IEs... */
     i=0; n=0;
     pIe = &( IEs[0] );
-    while ( 0xff != pIe->eid )
+    while ( 0xff != pIe->eid || pIe->extn_eid)
     {
         pfFound = (tFRAMES_BOOL*)(pFrm + pIe->offset +
                                   pIe->presenceOffset);
@@ -21357,6 +22294,8 @@ static tANI_U32 GetPackedSizeCore(tpAniSirGlobal pCtx,
             for (i = 0U; i < countOffset; ++i)
             {
                *pnNeeded += 2U + pIe->noui;
+                if (pIe->extn_eid)
+                    (*pnNeeded)++;
                byteCount = 0;
                switch (pIe->sig)
                {
@@ -21375,6 +22314,11 @@ static tANI_U32 GetPackedSizeCore(tpAniSirGlobal pCtx,
                             byteCount = 33;
                             pIePresent = ( (tDot11fIEIGTK* )(pFrm + pIe->offset + offset * i  ))->present;
                             break;
+                case SigIeMccChanInfo:
+                            offset = sizeof(tDot11fIEMccChanInfo);
+                            byteCount = 1;
+                            pIePresent = ( (tDot11fIEMccChanInfo* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
                 case SigIeR0KH_ID:
                             offset = sizeof(tDot11fIER0KH_ID);
                             byteCount = ((tDot11fIER0KH_ID* )(pFrm + pIe->offset + sizeof(tDot11fIER0KH_ID) * i ))->num_PMK_R0_ID;
@@ -21385,6 +22329,11 @@ static tANI_U32 GetPackedSizeCore(tpAniSirGlobal pCtx,
                             byteCount = 6;
                             pIePresent = ( (tDot11fIER1KH_ID* )(pFrm + pIe->offset + offset * i  ))->present;
                             break;
+                case SigIeSub20Info:
+                            offset = sizeof(tDot11fIESub20Info);
+                            byteCount = 2;
+                            pIePresent = ( (tDot11fIESub20Info* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
                 case SigIeTSFInfo:
                             offset = sizeof(tDot11fIETSFInfo);
                             byteCount = 4;
@@ -21508,6 +22457,11 @@ static tANI_U32 GetPackedSizeCore(tpAniSirGlobal pCtx,
                             byteCount = 3;
                             pIePresent = ( (tDot11fIEWiderBWChanSwitchAnn* )(pFrm + pIe->offset + offset * i  ))->present;
                             break;
+                case SigIevht_transmit_power_env:
+                            offset = sizeof(tDot11fIEvht_transmit_power_env);
+                            byteCount = ((tDot11fIEvht_transmit_power_env* )(pFrm + pIe->offset + sizeof(tDot11fIEvht_transmit_power_env) * i ))->num_bytes;
+                            pIePresent = ( (tDot11fIEvht_transmit_power_env* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
                 case SigIeAID:
                             offset = sizeof(tDot11fIEAID);
                             byteCount = 2;
@@ -21779,8 +22733,7 @@ static tANI_U32 GetPackedSizeCore(tpAniSirGlobal pCtx,
                             break;
                 case SigIeQComVendorIE:
                             offset = sizeof(tDot11fIEQComVendorIE);
-                            byteCount = 2;
-                            pIePresent = ( (tDot11fIEQComVendorIE* )(pFrm + pIe->offset + offset * i  ))->present;
+                            status |= dot11fGetPackedIEQComVendorIE(pCtx, ( tDot11fIEQComVendorIE* )(pFrm + pIe->offset + offset * i ), pnNeeded);
                             break;
                 case SigIeQOSCapsAp:
                             offset = sizeof(tDot11fIEQOSCapsAp);
@@ -21971,6 +22924,55 @@ static tANI_U32 GetPackedSizeCore(tpAniSirGlobal pCtx,
                             byteCount = 4;
                             pIePresent = ( (tDot11fIEext_chan_switch_ann* )(pFrm + pIe->offset + offset * i  ))->present;
                             break;
+                case SigIefils_assoc_delay_info:
+                            offset = sizeof(tDot11fIEfils_assoc_delay_info);
+                            byteCount = 1;
+                            pIePresent = ( (tDot11fIEfils_assoc_delay_info* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
+                case SigIefils_hlp_container:
+                            offset = sizeof(tDot11fIEfils_hlp_container);
+                            byteCount = ((tDot11fIEfils_hlp_container* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_hlp_container) * i ))->num_hlp_packet + 12;
+                            pIePresent = ( (tDot11fIEfils_hlp_container* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
+                case SigIefils_indication:
+                            offset = sizeof(tDot11fIEfils_indication);
+                            byteCount = ((tDot11fIEfils_indication* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_indication) * i ))->num_variable_data + 2;
+                            pIePresent = ( (tDot11fIEfils_indication* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
+                case SigIefils_kde:
+                            offset = sizeof(tDot11fIEfils_kde);
+                            byteCount = ((tDot11fIEfils_kde* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_kde) * i ))->num_kde_list + 8;
+                            pIePresent = ( (tDot11fIEfils_kde* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
+                case SigIefils_key_confirmation:
+                            offset = sizeof(tDot11fIEfils_key_confirmation);
+                            byteCount = ((tDot11fIEfils_key_confirmation* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_key_confirmation) * i ))->num_key_auth;
+                            pIePresent = ( (tDot11fIEfils_key_confirmation* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
+                case SigIefils_nonce:
+                            offset = sizeof(tDot11fIEfils_nonce);
+                            byteCount = 16;
+                            pIePresent = ( (tDot11fIEfils_nonce* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
+                case SigIefils_public_key:
+                            offset = sizeof(tDot11fIEfils_public_key);
+                            byteCount = ((tDot11fIEfils_public_key* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_public_key) * i ))->num_public_key + 1;
+                            pIePresent = ( (tDot11fIEfils_public_key* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
+                case SigIefils_session:
+                            offset = sizeof(tDot11fIEfils_session);
+                            byteCount = 8;
+                            pIePresent = ( (tDot11fIEfils_session* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
+                case SigIefils_wrapped_data:
+                            offset = sizeof(tDot11fIEfils_wrapped_data);
+                            byteCount = ((tDot11fIEfils_wrapped_data* )(pFrm + pIe->offset + sizeof(tDot11fIEfils_wrapped_data) * i ))->num_wrapped_data;
+                            pIePresent = ( (tDot11fIEfils_wrapped_data* )(pFrm + pIe->offset + offset * i  ))->present;
+                            break;
+                case SigIehs20vendor_ie:
+                            offset = sizeof(tDot11fIEhs20vendor_ie);
+                            status |= dot11fGetPackedIEhs20vendor_ie(pCtx, ( tDot11fIEhs20vendor_ie* )(pFrm + pIe->offset + offset * i ), pnNeeded);
+                            break;
                 case SigIesec_chan_offset_ele:
                             offset = sizeof(tDot11fIEsec_chan_offset_ele);
                             byteCount = 1;
@@ -22232,13 +23234,13 @@ void dot11fPackFfAddBAParameterSet(tpAniSirGlobal pCtx,
                                    tDot11fFfAddBAParameterSet *pSrc,
                                    tANI_U8 *pBuf)
 {
-    tANI_U16 tmp70__;
-    tmp70__ = 0U;
-    tmp70__ |= ( pSrc->amsduSupported << 0 );
-    tmp70__ |= ( pSrc->policy << 1 );
-    tmp70__ |= ( pSrc->tid << 2 );
-    tmp70__ |= ( pSrc->bufferSize << 6 );
-    frameshtons(pCtx, pBuf, tmp70__, 0);
+    tANI_U16 tmp72__;
+    tmp72__ = 0U;
+    tmp72__ |= ( pSrc->amsduSupported << 0 );
+    tmp72__ |= ( pSrc->policy << 1 );
+    tmp72__ |= ( pSrc->tid << 2 );
+    tmp72__ |= ( pSrc->bufferSize << 6 );
+    frameshtons(pCtx, pBuf, tmp72__, 0);
     (void)pCtx;
 } /* End dot11fPackFfAddBAParameterSet. */
 
@@ -22262,11 +23264,11 @@ void dot11fPackFfBAStartingSequenceControl(tpAniSirGlobal pCtx,
                                            tDot11fFfBAStartingSequenceControl *pSrc,
                                            tANI_U8 *pBuf)
 {
-    tANI_U16 tmp71__;
-    tmp71__ = 0U;
-    tmp71__ |= ( pSrc->fragNumber << 0 );
-    tmp71__ |= ( pSrc->ssn << 4 );
-    frameshtons(pCtx, pBuf, tmp71__, 0);
+    tANI_U16 tmp73__;
+    tmp73__ = 0U;
+    tmp73__ |= ( pSrc->fragNumber << 0 );
+    tmp73__ |= ( pSrc->ssn << 4 );
+    frameshtons(pCtx, pBuf, tmp73__, 0);
     (void)pCtx;
 } /* End dot11fPackFfBAStartingSequenceControl. */
 
@@ -22290,25 +23292,25 @@ void dot11fPackFfCapabilities(tpAniSirGlobal pCtx,
                               tDot11fFfCapabilities *pSrc,
                               tANI_U8 *pBuf)
 {
-    tANI_U16 tmp72__;
-    tmp72__ = 0U;
-    tmp72__ |= ( pSrc->ess << 0 );
-    tmp72__ |= ( pSrc->ibss << 1 );
-    tmp72__ |= ( pSrc->cfPollable << 2 );
-    tmp72__ |= ( pSrc->cfPollReq << 3 );
-    tmp72__ |= ( pSrc->privacy << 4 );
-    tmp72__ |= ( pSrc->shortPreamble << 5 );
-    tmp72__ |= ( pSrc->pbcc << 6 );
-    tmp72__ |= ( pSrc->channelAgility << 7 );
-    tmp72__ |= ( pSrc->spectrumMgt << 8 );
-    tmp72__ |= ( pSrc->qos << 9 );
-    tmp72__ |= ( pSrc->shortSlotTime << 10 );
-    tmp72__ |= ( pSrc->apsd << 11 );
-    tmp72__ |= ( pSrc->rrm << 12 );
-    tmp72__ |= ( pSrc->dsssOfdm << 13 );
-    tmp72__ |= ( pSrc->delayedBA << 14 );
-    tmp72__ |= ( pSrc->immediateBA << 15 );
-    frameshtons(pCtx, pBuf, tmp72__, 0);
+    tANI_U16 tmp74__;
+    tmp74__ = 0U;
+    tmp74__ |= ( pSrc->ess << 0 );
+    tmp74__ |= ( pSrc->ibss << 1 );
+    tmp74__ |= ( pSrc->cfPollable << 2 );
+    tmp74__ |= ( pSrc->cfPollReq << 3 );
+    tmp74__ |= ( pSrc->privacy << 4 );
+    tmp74__ |= ( pSrc->shortPreamble << 5 );
+    tmp74__ |= ( pSrc->pbcc << 6 );
+    tmp74__ |= ( pSrc->channelAgility << 7 );
+    tmp74__ |= ( pSrc->spectrumMgt << 8 );
+    tmp74__ |= ( pSrc->qos << 9 );
+    tmp74__ |= ( pSrc->shortSlotTime << 10 );
+    tmp74__ |= ( pSrc->apsd << 11 );
+    tmp74__ |= ( pSrc->rrm << 12 );
+    tmp74__ |= ( pSrc->dsssOfdm << 13 );
+    tmp74__ |= ( pSrc->delayedBA << 14 );
+    tmp74__ |= ( pSrc->immediateBA << 15 );
+    frameshtons(pCtx, pBuf, tmp74__, 0);
     (void)pCtx;
 } /* End dot11fPackFfCapabilities. */
 
@@ -22332,12 +23334,12 @@ void dot11fPackFfDelBAParameterSet(tpAniSirGlobal pCtx,
                                    tDot11fFfDelBAParameterSet *pSrc,
                                    tANI_U8 *pBuf)
 {
-    tANI_U16 tmp73__;
-    tmp73__ = 0U;
-    tmp73__ |= ( pSrc->reserved << 0 );
-    tmp73__ |= ( pSrc->initiator << 11 );
-    tmp73__ |= ( pSrc->tid << 12 );
-    frameshtons(pCtx, pBuf, tmp73__, 0);
+    tANI_U16 tmp75__;
+    tmp75__ = 0U;
+    tmp75__ |= ( pSrc->reserved << 0 );
+    tmp75__ |= ( pSrc->initiator << 11 );
+    tmp75__ |= ( pSrc->tid << 12 );
+    frameshtons(pCtx, pBuf, tmp75__, 0);
     (void)pCtx;
 } /* End dot11fPackFfDelBAParameterSet. */
 
@@ -22385,13 +23387,13 @@ void dot11fPackFfOperatingMode(tpAniSirGlobal pCtx,
                                tDot11fFfOperatingMode *pSrc,
                                tANI_U8 *pBuf)
 {
-    tANI_U8 tmp74__;
-    tmp74__ = 0U;
-    tmp74__ |= ( pSrc->chanWidth << 0 );
-    tmp74__ |= ( pSrc->reserved << 2 );
-    tmp74__ |= ( pSrc->rxNSS << 4 );
-    tmp74__ |= ( pSrc->rxNSSType << 7 );
-    *pBuf = tmp74__;
+    tANI_U8 tmp76__;
+    tmp76__ = 0U;
+    tmp76__ |= ( pSrc->chanWidth << 0 );
+    tmp76__ |= ( pSrc->reserved << 2 );
+    tmp76__ |= ( pSrc->rxNSS << 4 );
+    tmp76__ |= ( pSrc->rxNSSType << 7 );
+    *pBuf = tmp76__;
     (void)pCtx;
 } /* End dot11fPackFfOperatingMode. */
 
@@ -22447,12 +23449,12 @@ void dot11fPackFfSMPowerModeSet(tpAniSirGlobal pCtx,
                                 tDot11fFfSMPowerModeSet *pSrc,
                                 tANI_U8 *pBuf)
 {
-    tANI_U8 tmp75__;
-    tmp75__ = 0U;
-    tmp75__ |= ( pSrc->PowerSave_En << 0 );
-    tmp75__ |= ( pSrc->Mode << 1 );
-    tmp75__ |= ( pSrc->reserved << 2 );
-    *pBuf = tmp75__;
+    tANI_U8 tmp77__;
+    tmp77__ = 0U;
+    tmp77__ |= ( pSrc->PowerSave_En << 0 );
+    tmp77__ |= ( pSrc->Mode << 1 );
+    tmp77__ |= ( pSrc->reserved << 2 );
+    *pBuf = tmp77__;
     (void)pCtx;
 } /* End dot11fPackFfSMPowerModeSet. */
 
@@ -22492,19 +23494,19 @@ void dot11fPackFfTSInfo(tpAniSirGlobal pCtx,
                         tDot11fFfTSInfo *pSrc,
                         tANI_U8 *pBuf)
 {
-    tANI_U32 tmp76__;
-    tmp76__ = 0U;
-    tmp76__ |= ( pSrc->traffic_type << 0 );
-    tmp76__ |= ( pSrc->tsid << 1 );
-    tmp76__ |= ( pSrc->direction << 5 );
-    tmp76__ |= ( pSrc->access_policy << 7 );
-    tmp76__ |= ( pSrc->aggregation << 9 );
-    tmp76__ |= ( pSrc->psb << 10 );
-    tmp76__ |= ( pSrc->user_priority << 11 );
-    tmp76__ |= ( pSrc->tsinfo_ack_pol << 14 );
-    tmp76__ |= ( pSrc->schedule << 16 );
-    tmp76__ |= ( pSrc->unused << 17 );
-    frameshtonl(pCtx, pBuf, tmp76__, 0);
+    tANI_U32 tmp78__;
+    tmp78__ = 0U;
+    tmp78__ |= ( pSrc->traffic_type << 0 );
+    tmp78__ |= ( pSrc->tsid << 1 );
+    tmp78__ |= ( pSrc->direction << 5 );
+    tmp78__ |= ( pSrc->access_policy << 7 );
+    tmp78__ |= ( pSrc->aggregation << 9 );
+    tmp78__ |= ( pSrc->psb << 10 );
+    tmp78__ |= ( pSrc->user_priority << 11 );
+    tmp78__ |= ( pSrc->tsinfo_ack_pol << 14 );
+    tmp78__ |= ( pSrc->schedule << 16 );
+    tmp78__ |= ( pSrc->unused << 17 );
+    frameshtonl(pCtx, pBuf, tmp78__, 0);
     (void)pCtx;
 } /* End dot11fPackFfTSInfo. */
 
@@ -22560,13 +23562,13 @@ void dot11fPackFfext_chan_switch_ann_action(tpAniSirGlobal pCtx,
                                             tDot11fFfext_chan_switch_ann_action *pSrc,
                                             tANI_U8 *pBuf)
 {
-    tANI_U32 tmp77__;
-    tmp77__ = 0U;
-    tmp77__ |= ( pSrc->switch_mode << 0 );
-    tmp77__ |= ( pSrc->op_class << 8 );
-    tmp77__ |= ( pSrc->new_channel << 16 );
-    tmp77__ |= ( pSrc->switch_count << 24 );
-    frameshtonl(pCtx, pBuf, tmp77__, 0);
+    tANI_U32 tmp79__;
+    tmp79__ = 0U;
+    tmp79__ |= ( pSrc->switch_mode << 0 );
+    tmp79__ |= ( pSrc->op_class << 8 );
+    tmp79__ |= ( pSrc->new_channel << 16 );
+    tmp79__ |= ( pSrc->switch_count << 24 );
+    frameshtonl(pCtx, pBuf, tmp79__, 0);
     (void)pCtx;
 } /* End dot11fPackFfext_chan_switch_ann_action. */
 
@@ -22639,7 +23641,7 @@ tANI_U32 dot11fPackTlvVersion2(tpAniSirGlobal pCtx,
     tANI_U8* pTlvLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp78__;
+    tANI_U8 tmp80__;
     nNeeded += 3;
     if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
     while ( pSrc->present )
@@ -22648,10 +23650,10 @@ tANI_U32 dot11fPackTlvVersion2(tpAniSirGlobal pCtx,
         pBuf += 1; *pnConsumed += 1;
         pTlvLen = pBuf;
         pBuf += 1; *pnConsumed += 1;
-        tmp78__ = 0U;
-        tmp78__ |= ( pSrc->minor << 0 );
-        tmp78__ |= ( pSrc->major << 4 );
-        *pBuf = tmp78__;
+        tmp80__ = 0U;
+        tmp80__ |= ( pSrc->minor << 0 );
+        tmp80__ |= ( pSrc->major << 4 );
+        *pBuf = tmp80__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
@@ -23860,7 +24862,7 @@ tANI_U32 dot11fPackTlvVersion(tpAniSirGlobal pCtx,
     tANI_U8* pTlvLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp79__;
+    tANI_U8 tmp81__;
     nNeeded += 5;
     if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
     while ( pSrc->present )
@@ -23869,10 +24871,10 @@ tANI_U32 dot11fPackTlvVersion(tpAniSirGlobal pCtx,
         pBuf += 2; *pnConsumed += 2;
         pTlvLen = pBuf;
         pBuf += 2; *pnConsumed += 2;
-        tmp79__ = 0U;
-        tmp79__ |= ( pSrc->minor << 0 );
-        tmp79__ |= ( pSrc->major << 4 );
-        *pBuf = tmp79__;
+        tmp81__ = 0U;
+        tmp81__ |= ( pSrc->minor << 0 );
+        tmp81__ |= ( pSrc->major << 4 );
+        *pBuf = tmp81__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
@@ -24015,7 +25017,7 @@ tANI_U32 dot11fPackIeGTK(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U16 tmp80__;
+    tANI_U16 tmp82__;
     nNeeded  +=  (pSrc->num_key + 11);
     while ( pSrc->present )
     {
@@ -24024,10 +25026,10 @@ tANI_U32 dot11fPackIeGTK(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp80__ = 0U;
-        tmp80__ |= ( pSrc->keyId << 0 );
-        tmp80__ |= ( pSrc->reserved << 2 );
-        frameshtons(pCtx, pBuf, tmp80__, 0);
+        tmp82__ = 0U;
+        tmp82__ |= ( pSrc->keyId << 0 );
+        tmp82__ |= ( pSrc->reserved << 2 );
+        frameshtons(pCtx, pBuf, tmp82__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
@@ -24089,6 +25091,36 @@ tANI_U32 dot11fPackIeIGTK(tpAniSirGlobal pCtx,
     return DOT11F_PARSE_SUCCESS;
 } /* End dot11fPackIeIGTK. */
 
+tANI_U32 dot11fPackIeMccChanInfo(tpAniSirGlobal pCtx,
+                                 tDot11fIEMccChanInfo *pSrc,
+                                 tANI_U8 *pBuf,
+                                 tANI_U32 nBuf,
+                                 tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  += 1;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 1;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = pSrc->channel;
+        *pnConsumed += 1;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIeMccChanInfo. */
+
 tANI_U32 dot11fPackIeR0KH_ID(tpAniSirGlobal pCtx,
                              tDot11fIER0KH_ID *pSrc,
                              tANI_U8 *pBuf,
@@ -24149,6 +25181,39 @@ tANI_U32 dot11fPackIeR1KH_ID(tpAniSirGlobal pCtx,
     return DOT11F_PARSE_SUCCESS;
 } /* End dot11fPackIeR1KH_ID. */
 
+tANI_U32 dot11fPackIeSub20Info(tpAniSirGlobal pCtx,
+                               tDot11fIESub20Info *pSrc,
+                               tANI_U8 *pBuf,
+                               tANI_U32 nBuf,
+                               tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  += 2;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 2;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = pSrc->capability;
+        *pnConsumed += 1;
+        pBuf += 1;
+        *pBuf = pSrc->csa_chanwidth;
+        *pnConsumed += 1;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIeSub20Info. */
+
 tANI_U32 dot11fPackIeTSFInfo(tpAniSirGlobal pCtx,
                              tDot11fIETSFInfo *pSrc,
                              tANI_U8 *pBuf,
@@ -24452,11 +25517,11 @@ tANI_U32 dot11fPackIeRRMEnabledCap(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp81__;
-    tANI_U8 tmp82__;
     tANI_U8 tmp83__;
     tANI_U8 tmp84__;
     tANI_U8 tmp85__;
+    tANI_U8 tmp86__;
+    tANI_U8 tmp87__;
     nNeeded  += 5;
     while ( pSrc->present )
     {
@@ -24465,60 +25530,60 @@ tANI_U32 dot11fPackIeRRMEnabledCap(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp81__ = 0U;
-        tmp81__ |= ( pSrc->LinkMeasurement << 0 );
-        tmp81__ |= ( pSrc->NeighborRpt << 1 );
-        tmp81__ |= ( pSrc->parallel << 2 );
-        tmp81__ |= ( pSrc->repeated << 3 );
-        tmp81__ |= ( pSrc->BeaconPassive << 4 );
-        tmp81__ |= ( pSrc->BeaconActive << 5 );
-        tmp81__ |= ( pSrc->BeaconTable << 6 );
-        tmp81__ |= ( pSrc->BeaconRepCond << 7 );
-        *pBuf = tmp81__;
-        *pnConsumed += 1;
-        pBuf += 1;
-        nBuf -=  1 ;
-        tmp82__ = 0U;
-        tmp82__ |= ( pSrc->FrameMeasurement << 0 );
-        tmp82__ |= ( pSrc->ChannelLoad << 1 );
-        tmp82__ |= ( pSrc->NoiseHistogram << 2 );
-        tmp82__ |= ( pSrc->statistics << 3 );
-        tmp82__ |= ( pSrc->LCIMeasurement << 4 );
-        tmp82__ |= ( pSrc->LCIAzimuth << 5 );
-        tmp82__ |= ( pSrc->TCMCapability << 6 );
-        tmp82__ |= ( pSrc->triggeredTCM << 7 );
-        *pBuf = tmp82__;
-        *pnConsumed += 1;
-        pBuf += 1;
-        nBuf -=  1 ;
         tmp83__ = 0U;
-        tmp83__ |= ( pSrc->APChanReport << 0 );
-        tmp83__ |= ( pSrc->RRMMIBEnabled << 1 );
-        tmp83__ |= ( pSrc->operatingChanMax << 2 );
-        tmp83__ |= ( pSrc->nonOperatinChanMax << 5 );
+        tmp83__ |= ( pSrc->LinkMeasurement << 0 );
+        tmp83__ |= ( pSrc->NeighborRpt << 1 );
+        tmp83__ |= ( pSrc->parallel << 2 );
+        tmp83__ |= ( pSrc->repeated << 3 );
+        tmp83__ |= ( pSrc->BeaconPassive << 4 );
+        tmp83__ |= ( pSrc->BeaconActive << 5 );
+        tmp83__ |= ( pSrc->BeaconTable << 6 );
+        tmp83__ |= ( pSrc->BeaconRepCond << 7 );
         *pBuf = tmp83__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
         tmp84__ = 0U;
-        tmp84__ |= ( pSrc->MeasurementPilot << 0 );
-        tmp84__ |= ( pSrc->MeasurementPilotEnabled << 3 );
-        tmp84__ |= ( pSrc->NeighborTSFOffset << 4 );
-        tmp84__ |= ( pSrc->RCPIMeasurement << 5 );
-        tmp84__ |= ( pSrc->RSNIMeasurement << 6 );
-        tmp84__ |= ( pSrc->BssAvgAccessDelay << 7 );
+        tmp84__ |= ( pSrc->FrameMeasurement << 0 );
+        tmp84__ |= ( pSrc->ChannelLoad << 1 );
+        tmp84__ |= ( pSrc->NoiseHistogram << 2 );
+        tmp84__ |= ( pSrc->statistics << 3 );
+        tmp84__ |= ( pSrc->LCIMeasurement << 4 );
+        tmp84__ |= ( pSrc->LCIAzimuth << 5 );
+        tmp84__ |= ( pSrc->TCMCapability << 6 );
+        tmp84__ |= ( pSrc->triggeredTCM << 7 );
         *pBuf = tmp84__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
         tmp85__ = 0U;
-        tmp85__ |= ( pSrc->BSSAvailAdmission << 0 );
-        tmp85__ |= ( pSrc->AntennaInformation << 1 );
-        tmp85__ |= ( pSrc->fine_time_meas_rpt << 2 );
-        tmp85__ |= ( pSrc->lci_capability << 3 );
-        tmp85__ |= ( pSrc->reserved << 4 );
+        tmp85__ |= ( pSrc->APChanReport << 0 );
+        tmp85__ |= ( pSrc->RRMMIBEnabled << 1 );
+        tmp85__ |= ( pSrc->operatingChanMax << 2 );
+        tmp85__ |= ( pSrc->nonOperatinChanMax << 5 );
         *pBuf = tmp85__;
         *pnConsumed += 1;
+        pBuf += 1;
+        nBuf -=  1 ;
+        tmp86__ = 0U;
+        tmp86__ |= ( pSrc->MeasurementPilot << 0 );
+        tmp86__ |= ( pSrc->MeasurementPilotEnabled << 3 );
+        tmp86__ |= ( pSrc->NeighborTSFOffset << 4 );
+        tmp86__ |= ( pSrc->RCPIMeasurement << 5 );
+        tmp86__ |= ( pSrc->RSNIMeasurement << 6 );
+        tmp86__ |= ( pSrc->BssAvgAccessDelay << 7 );
+        *pBuf = tmp86__;
+        *pnConsumed += 1;
+        pBuf += 1;
+        nBuf -=  1 ;
+        tmp87__ = 0U;
+        tmp87__ |= ( pSrc->BSSAvailAdmission << 0 );
+        tmp87__ |= ( pSrc->AntennaInformation << 1 );
+        tmp87__ |= ( pSrc->fine_time_meas_rpt << 2 );
+        tmp87__ |= ( pSrc->lci_capability << 3 );
+        tmp87__ |= ( pSrc->reserved << 4 );
+        *pBuf = tmp87__;
+        *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
         break;
@@ -24600,7 +25665,7 @@ tANI_U32 dot11fPackIeSchedule(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U16 tmp86__;
+    tANI_U16 tmp88__;
     nNeeded  += 14;
     while ( pSrc->present )
     {
@@ -24609,12 +25674,12 @@ tANI_U32 dot11fPackIeSchedule(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp86__ = 0U;
-        tmp86__ |= ( pSrc->aggregation << 0 );
-        tmp86__ |= ( pSrc->tsid << 1 );
-        tmp86__ |= ( pSrc->direction << 5 );
-        tmp86__ |= ( pSrc->reserved << 7 );
-        frameshtons(pCtx, pBuf, tmp86__, 0);
+        tmp88__ = 0U;
+        tmp88__ |= ( pSrc->aggregation << 0 );
+        tmp88__ |= ( pSrc->tsid << 1 );
+        tmp88__ |= ( pSrc->direction << 5 );
+        tmp88__ |= ( pSrc->reserved << 7 );
+        frameshtons(pCtx, pBuf, tmp88__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
@@ -24814,9 +25879,9 @@ tANI_U32 dot11fPackIeTSPEC(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U16 tmp87__;
-    tANI_U8 tmp88__;
     tANI_U16 tmp89__;
+    tANI_U8 tmp90__;
+    tANI_U16 tmp91__;
     nNeeded  += 55;
     while ( pSrc->present )
     {
@@ -24825,30 +25890,30 @@ tANI_U32 dot11fPackIeTSPEC(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp87__ = 0U;
-        tmp87__ |= ( pSrc->traffic_type << 0 );
-        tmp87__ |= ( pSrc->tsid << 1 );
-        tmp87__ |= ( pSrc->direction << 5 );
-        tmp87__ |= ( pSrc->access_policy << 7 );
-        tmp87__ |= ( pSrc->aggregation << 9 );
-        tmp87__ |= ( pSrc->psb << 10 );
-        tmp87__ |= ( pSrc->user_priority << 11 );
-        tmp87__ |= ( pSrc->tsinfo_ack_pol << 14 );
-        frameshtons(pCtx, pBuf, tmp87__, 0);
+        tmp89__ = 0U;
+        tmp89__ |= ( pSrc->traffic_type << 0 );
+        tmp89__ |= ( pSrc->tsid << 1 );
+        tmp89__ |= ( pSrc->direction << 5 );
+        tmp89__ |= ( pSrc->access_policy << 7 );
+        tmp89__ |= ( pSrc->aggregation << 9 );
+        tmp89__ |= ( pSrc->psb << 10 );
+        tmp89__ |= ( pSrc->user_priority << 11 );
+        tmp89__ |= ( pSrc->tsinfo_ack_pol << 14 );
+        frameshtons(pCtx, pBuf, tmp89__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
-        tmp88__ = 0U;
-        tmp88__ |= ( pSrc->schedule << 0 );
-        tmp88__ |= ( pSrc->unused << 1 );
-        *pBuf = tmp88__;
+        tmp90__ = 0U;
+        tmp90__ |= ( pSrc->schedule << 0 );
+        tmp90__ |= ( pSrc->unused << 1 );
+        *pBuf = tmp90__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
-        tmp89__ = 0U;
-        tmp89__ |= ( pSrc->size << 0 );
-        tmp89__ |= ( pSrc->fixed << 15 );
-        frameshtons(pCtx, pBuf, tmp89__, 0);
+        tmp91__ = 0U;
+        tmp91__ |= ( pSrc->size << 0 );
+        tmp91__ |= ( pSrc->fixed << 15 );
+        frameshtons(pCtx, pBuf, tmp91__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
@@ -24913,9 +25978,9 @@ tANI_U32 dot11fPackIeVHTCaps(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U32 tmp90__;
-    tANI_U16 tmp91__;
-    tANI_U16 tmp92__;
+    tANI_U32 tmp92__;
+    tANI_U16 tmp93__;
+    tANI_U16 tmp94__;
     nNeeded  += 12;
     while ( pSrc->present )
     {
@@ -24924,48 +25989,48 @@ tANI_U32 dot11fPackIeVHTCaps(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp90__ = 0U;
-        tmp90__ |= ( pSrc->maxMPDULen << 0 );
-        tmp90__ |= ( pSrc->supportedChannelWidthSet << 2 );
-        tmp90__ |= ( pSrc->ldpcCodingCap << 4 );
-        tmp90__ |= ( pSrc->shortGI80MHz << 5 );
-        tmp90__ |= ( pSrc->shortGI160and80plus80MHz << 6 );
-        tmp90__ |= ( pSrc->txSTBC << 7 );
-        tmp90__ |= ( pSrc->rxSTBC << 8 );
-        tmp90__ |= ( pSrc->suBeamFormerCap << 11 );
-        tmp90__ |= ( pSrc->suBeamformeeCap << 12 );
-        tmp90__ |= ( pSrc->csnofBeamformerAntSup << 13 );
-        tmp90__ |= ( pSrc->numSoundingDim << 16 );
-        tmp90__ |= ( pSrc->muBeamformerCap << 19 );
-        tmp90__ |= ( pSrc->muBeamformeeCap << 20 );
-        tmp90__ |= ( pSrc->vhtTXOPPS << 21 );
-        tmp90__ |= ( pSrc->htcVHTCap << 22 );
-        tmp90__ |= ( pSrc->maxAMPDULenExp << 23 );
-        tmp90__ |= ( pSrc->vhtLinkAdaptCap << 26 );
-        tmp90__ |= ( pSrc->rxAntPattern << 28 );
-        tmp90__ |= ( pSrc->txAntPattern << 29 );
-        tmp90__ |= ( pSrc->reserved1 << 30 );
-        frameshtonl(pCtx, pBuf, tmp90__, 0);
+        tmp92__ = 0U;
+        tmp92__ |= ( pSrc->maxMPDULen << 0 );
+        tmp92__ |= ( pSrc->supportedChannelWidthSet << 2 );
+        tmp92__ |= ( pSrc->ldpcCodingCap << 4 );
+        tmp92__ |= ( pSrc->shortGI80MHz << 5 );
+        tmp92__ |= ( pSrc->shortGI160and80plus80MHz << 6 );
+        tmp92__ |= ( pSrc->txSTBC << 7 );
+        tmp92__ |= ( pSrc->rxSTBC << 8 );
+        tmp92__ |= ( pSrc->suBeamFormerCap << 11 );
+        tmp92__ |= ( pSrc->suBeamformeeCap << 12 );
+        tmp92__ |= ( pSrc->csnofBeamformerAntSup << 13 );
+        tmp92__ |= ( pSrc->numSoundingDim << 16 );
+        tmp92__ |= ( pSrc->muBeamformerCap << 19 );
+        tmp92__ |= ( pSrc->muBeamformeeCap << 20 );
+        tmp92__ |= ( pSrc->vhtTXOPPS << 21 );
+        tmp92__ |= ( pSrc->htcVHTCap << 22 );
+        tmp92__ |= ( pSrc->maxAMPDULenExp << 23 );
+        tmp92__ |= ( pSrc->vhtLinkAdaptCap << 26 );
+        tmp92__ |= ( pSrc->rxAntPattern << 28 );
+        tmp92__ |= ( pSrc->txAntPattern << 29 );
+        tmp92__ |= ( pSrc->reserved1 << 30 );
+        frameshtonl(pCtx, pBuf, tmp92__, 0);
         *pnConsumed += 4;
         pBuf += 4;
         nBuf -=  4 ;
         frameshtons(pCtx, pBuf, pSrc->rxMCSMap, 0);
         *pnConsumed += 2;
         pBuf += 2;
-        tmp91__ = 0U;
-        tmp91__ |= ( pSrc->rxHighSupDataRate << 0 );
-        tmp91__ |= ( pSrc->reserved2 << 13 );
-        frameshtons(pCtx, pBuf, tmp91__, 0);
+        tmp93__ = 0U;
+        tmp93__ |= ( pSrc->rxHighSupDataRate << 0 );
+        tmp93__ |= ( pSrc->reserved2 << 13 );
+        frameshtons(pCtx, pBuf, tmp93__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
         frameshtons(pCtx, pBuf, pSrc->txMCSMap, 0);
         *pnConsumed += 2;
         pBuf += 2;
-        tmp92__ = 0U;
-        tmp92__ |= ( pSrc->txSupDataRate << 0 );
-        tmp92__ |= ( pSrc->reserved3 << 13 );
-        frameshtons(pCtx, pBuf, tmp92__, 0);
+        tmp94__ = 0U;
+        tmp94__ |= ( pSrc->txSupDataRate << 0 );
+        tmp94__ |= ( pSrc->reserved3 << 13 );
+        frameshtons(pCtx, pBuf, tmp94__, 0);
         *pnConsumed += 2;
         // fieldsEndFlag  = 1
         nBuf -=  2 ;
@@ -25027,7 +26092,7 @@ tANI_U32 dot11fPackIeWMMSchedule(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U16 tmp93__;
+    tANI_U16 tmp95__;
     nNeeded  += 15;
     while ( pSrc->present )
     {
@@ -25049,12 +26114,12 @@ tANI_U32 dot11fPackIeWMMSchedule(tpAniSirGlobal pCtx,
         *pBuf = pSrc->version;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp93__ = 0U;
-        tmp93__ |= ( pSrc->aggregation << 0 );
-        tmp93__ |= ( pSrc->tsid << 1 );
-        tmp93__ |= ( pSrc->direction << 5 );
-        tmp93__ |= ( pSrc->reserved << 7 );
-        frameshtons(pCtx, pBuf, tmp93__, 0);
+        tmp95__ = 0U;
+        tmp95__ |= ( pSrc->aggregation << 0 );
+        tmp95__ |= ( pSrc->tsid << 1 );
+        tmp95__ |= ( pSrc->direction << 5 );
+        tmp95__ |= ( pSrc->reserved << 7 );
+        frameshtons(pCtx, pBuf, tmp95__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
@@ -25293,9 +26358,9 @@ tANI_U32 dot11fPackIeWMMTSPEC(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U16 tmp94__;
-    tANI_U8 tmp95__;
     tANI_U16 tmp96__;
+    tANI_U8 tmp97__;
+    tANI_U16 tmp98__;
     nNeeded  += 38;
     while ( pSrc->present )
     {
@@ -25317,30 +26382,30 @@ tANI_U32 dot11fPackIeWMMTSPEC(tpAniSirGlobal pCtx,
         *pBuf = pSrc->version;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp94__ = 0U;
-        tmp94__ |= ( pSrc->traffic_type << 0 );
-        tmp94__ |= ( pSrc->tsid << 1 );
-        tmp94__ |= ( pSrc->direction << 5 );
-        tmp94__ |= ( pSrc->access_policy << 7 );
-        tmp94__ |= ( pSrc->aggregation << 9 );
-        tmp94__ |= ( pSrc->psb << 10 );
-        tmp94__ |= ( pSrc->user_priority << 11 );
-        tmp94__ |= ( pSrc->tsinfo_ack_pol << 14 );
-        frameshtons(pCtx, pBuf, tmp94__, 0);
+        tmp96__ = 0U;
+        tmp96__ |= ( pSrc->traffic_type << 0 );
+        tmp96__ |= ( pSrc->tsid << 1 );
+        tmp96__ |= ( pSrc->direction << 5 );
+        tmp96__ |= ( pSrc->access_policy << 7 );
+        tmp96__ |= ( pSrc->aggregation << 9 );
+        tmp96__ |= ( pSrc->psb << 10 );
+        tmp96__ |= ( pSrc->user_priority << 11 );
+        tmp96__ |= ( pSrc->tsinfo_ack_pol << 14 );
+        frameshtons(pCtx, pBuf, tmp96__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
-        tmp95__ = 0U;
-        tmp95__ |= ( pSrc->tsinfo_rsvd << 0 );
-        tmp95__ |= ( pSrc->burst_size_defn << 7 );
-        *pBuf = tmp95__;
+        tmp97__ = 0U;
+        tmp97__ |= ( pSrc->tsinfo_rsvd << 0 );
+        tmp97__ |= ( pSrc->burst_size_defn << 7 );
+        *pBuf = tmp97__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
-        tmp96__ = 0U;
-        tmp96__ |= ( pSrc->size << 0 );
-        tmp96__ |= ( pSrc->fixed << 15 );
-        frameshtons(pCtx, pBuf, tmp96__, 0);
+        tmp98__ = 0U;
+        tmp98__ |= ( pSrc->size << 0 );
+        tmp98__ |= ( pSrc->fixed << 15 );
+        frameshtons(pCtx, pBuf, tmp98__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
@@ -25432,6 +26497,36 @@ tANI_U32 dot11fPackIeWiderBWChanSwitchAnn(tpAniSirGlobal pCtx,
     return DOT11F_PARSE_SUCCESS;
 } /* End dot11fPackIeWiderBWChanSwitchAnn. */
 
+tANI_U32 dot11fPackIevht_transmit_power_env(tpAniSirGlobal pCtx,
+                                            tDot11fIEvht_transmit_power_env *pSrc,
+                                            tANI_U8 *pBuf,
+                                            tANI_U32 nBuf,
+                                            tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  +=  pSrc->num_bytes;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 195;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->bytes ), pSrc->num_bytes);
+        *pnConsumed += pSrc->num_bytes;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIevht_transmit_power_env. */
+
 tANI_U32 dot11fPackIeAID(tpAniSirGlobal pCtx,
                          tDot11fIEAID *pSrc,
                          tANI_U8 *pBuf,
@@ -25680,14 +26775,14 @@ tANI_U32 dot11fPackIeEDCAParamSet(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp97__;
-    tANI_U8 tmp98__;
     tANI_U8 tmp99__;
     tANI_U8 tmp100__;
     tANI_U8 tmp101__;
     tANI_U8 tmp102__;
     tANI_U8 tmp103__;
     tANI_U8 tmp104__;
+    tANI_U8 tmp105__;
+    tANI_U8 tmp106__;
     nNeeded  += 18;
     while ( pSrc->present )
     {
@@ -25702,79 +26797,79 @@ tANI_U32 dot11fPackIeEDCAParamSet(tpAniSirGlobal pCtx,
         *pBuf = pSrc->reserved;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp97__ = 0U;
-        tmp97__ |= ( pSrc->acbe_aifsn << 0 );
-        tmp97__ |= ( pSrc->acbe_acm << 4 );
-        tmp97__ |= ( pSrc->acbe_aci << 5 );
-        tmp97__ |= ( pSrc->unused1 << 7 );
-        *pBuf = tmp97__;
-        *pnConsumed += 1;
-        pBuf += 1;
-        nBuf -=  1 ;
-        tmp98__ = 0U;
-        tmp98__ |= ( pSrc->acbe_acwmin << 0 );
-        tmp98__ |= ( pSrc->acbe_acwmax << 4 );
-        *pBuf = tmp98__;
-        *pnConsumed += 1;
-        pBuf += 1;
-        nBuf -=  1 ;
-        frameshtons(pCtx, pBuf, pSrc->acbe_txoplimit, 0);
-        *pnConsumed += 2;
-        pBuf += 2;
         tmp99__ = 0U;
-        tmp99__ |= ( pSrc->acbk_aifsn << 0 );
-        tmp99__ |= ( pSrc->acbk_acm << 4 );
-        tmp99__ |= ( pSrc->acbk_aci << 5 );
-        tmp99__ |= ( pSrc->unused2 << 7 );
+        tmp99__ |= ( pSrc->acbe_aifsn << 0 );
+        tmp99__ |= ( pSrc->acbe_acm << 4 );
+        tmp99__ |= ( pSrc->acbe_aci << 5 );
+        tmp99__ |= ( pSrc->unused1 << 7 );
         *pBuf = tmp99__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
         tmp100__ = 0U;
-        tmp100__ |= ( pSrc->acbk_acwmin << 0 );
-        tmp100__ |= ( pSrc->acbk_acwmax << 4 );
+        tmp100__ |= ( pSrc->acbe_acwmin << 0 );
+        tmp100__ |= ( pSrc->acbe_acwmax << 4 );
         *pBuf = tmp100__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
-        frameshtons(pCtx, pBuf, pSrc->acbk_txoplimit, 0);
+        frameshtons(pCtx, pBuf, pSrc->acbe_txoplimit, 0);
         *pnConsumed += 2;
         pBuf += 2;
         tmp101__ = 0U;
-        tmp101__ |= ( pSrc->acvi_aifsn << 0 );
-        tmp101__ |= ( pSrc->acvi_acm << 4 );
-        tmp101__ |= ( pSrc->acvi_aci << 5 );
-        tmp101__ |= ( pSrc->unused3 << 7 );
+        tmp101__ |= ( pSrc->acbk_aifsn << 0 );
+        tmp101__ |= ( pSrc->acbk_acm << 4 );
+        tmp101__ |= ( pSrc->acbk_aci << 5 );
+        tmp101__ |= ( pSrc->unused2 << 7 );
         *pBuf = tmp101__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
         tmp102__ = 0U;
-        tmp102__ |= ( pSrc->acvi_acwmin << 0 );
-        tmp102__ |= ( pSrc->acvi_acwmax << 4 );
+        tmp102__ |= ( pSrc->acbk_acwmin << 0 );
+        tmp102__ |= ( pSrc->acbk_acwmax << 4 );
         *pBuf = tmp102__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
-        frameshtons(pCtx, pBuf, pSrc->acvi_txoplimit, 0);
+        frameshtons(pCtx, pBuf, pSrc->acbk_txoplimit, 0);
         *pnConsumed += 2;
         pBuf += 2;
         tmp103__ = 0U;
-        tmp103__ |= ( pSrc->acvo_aifsn << 0 );
-        tmp103__ |= ( pSrc->acvo_acm << 4 );
-        tmp103__ |= ( pSrc->acvo_aci << 5 );
-        tmp103__ |= ( pSrc->unused4 << 7 );
+        tmp103__ |= ( pSrc->acvi_aifsn << 0 );
+        tmp103__ |= ( pSrc->acvi_acm << 4 );
+        tmp103__ |= ( pSrc->acvi_aci << 5 );
+        tmp103__ |= ( pSrc->unused3 << 7 );
         *pBuf = tmp103__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
         tmp104__ = 0U;
-        tmp104__ |= ( pSrc->acvo_acwmin << 0 );
-        tmp104__ |= ( pSrc->acvo_acwmax << 4 );
+        tmp104__ |= ( pSrc->acvi_acwmin << 0 );
+        tmp104__ |= ( pSrc->acvi_acwmax << 4 );
         *pBuf = tmp104__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
+        frameshtons(pCtx, pBuf, pSrc->acvi_txoplimit, 0);
+        *pnConsumed += 2;
+        pBuf += 2;
+        tmp105__ = 0U;
+        tmp105__ |= ( pSrc->acvo_aifsn << 0 );
+        tmp105__ |= ( pSrc->acvo_acm << 4 );
+        tmp105__ |= ( pSrc->acvo_aci << 5 );
+        tmp105__ |= ( pSrc->unused4 << 7 );
+        *pBuf = tmp105__;
+        *pnConsumed += 1;
+        pBuf += 1;
+        nBuf -=  1 ;
+        tmp106__ = 0U;
+        tmp106__ |= ( pSrc->acvo_acwmin << 0 );
+        tmp106__ |= ( pSrc->acvo_acwmax << 4 );
+        *pBuf = tmp106__;
+        *pnConsumed += 1;
+        pBuf += 1;
+        nBuf -=  1 ;
         frameshtons(pCtx, pBuf, pSrc->acvo_txoplimit, 0);
         *pnConsumed += 2;
         // fieldsEndFlag = 1
@@ -25797,7 +26892,7 @@ tANI_U32 dot11fPackIeERPInfo(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp105__;
+    tANI_U8 tmp107__;
     nNeeded  += 1;
     while ( pSrc->present )
     {
@@ -25806,12 +26901,12 @@ tANI_U32 dot11fPackIeERPInfo(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp105__ = 0U;
-        tmp105__ |= ( pSrc->non_erp_present << 0 );
-        tmp105__ |= ( pSrc->use_prot << 1 );
-        tmp105__ |= ( pSrc->barker_preamble << 2 );
-        tmp105__ |= ( pSrc->unused << 3 );
-        *pBuf = tmp105__;
+        tmp107__ = 0U;
+        tmp107__ |= ( pSrc->non_erp_present << 0 );
+        tmp107__ |= ( pSrc->use_prot << 1 );
+        tmp107__ |= ( pSrc->barker_preamble << 2 );
+        tmp107__ |= ( pSrc->unused << 3 );
+        *pBuf = tmp107__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -25872,7 +26967,7 @@ tANI_U32 dot11fPackIeESERadMgmtCap(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp106__;
+    tANI_U8 tmp108__;
     nNeeded  += 2;
     while ( pSrc->present )
     {
@@ -25892,10 +26987,10 @@ tANI_U32 dot11fPackIeESERadMgmtCap(tpAniSirGlobal pCtx,
         *pBuf = pSrc->mgmt_state;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp106__ = 0U;
-        tmp106__ |= ( pSrc->mbssid_mask << 0 );
-        tmp106__ |= ( pSrc->reserved << 3 );
-        *pBuf = tmp106__;
+        tmp108__ = 0U;
+        tmp108__ |= ( pSrc->mbssid_mask << 0 );
+        tmp108__ |= ( pSrc->reserved << 3 );
+        *pBuf = tmp108__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -26256,7 +27351,7 @@ tANI_U32 dot11fPackIeFTInfo(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U16 tmp107__;
+    tANI_U16 tmp109__;
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
     status = dot11fGetPackedIEFTInfo(pCtx, pSrc, &nNeeded);
     if ( ! DOT11F_SUCCEEDED( status ) ) return status;
@@ -26267,10 +27362,10 @@ tANI_U32 dot11fPackIeFTInfo(tpAniSirGlobal pCtx,
         ++pBuf; --nBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; --nBuf; ++(*pnConsumed);
-        tmp107__ = 0U;
-        tmp107__ |= ( pSrc->reserved << 0 );
-        tmp107__ |= ( pSrc->IECount << 8 );
-        frameshtons(pCtx, pBuf, tmp107__, 0);
+        tmp109__ = 0U;
+        tmp109__ |= ( pSrc->reserved << 0 );
+        tmp109__ |= ( pSrc->IECount << 8 );
+        frameshtons(pCtx, pBuf, tmp109__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
@@ -26309,7 +27404,7 @@ tANI_U32 dot11fPackIeHT2040BSSCoexistence(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp108__;
+    tANI_U8 tmp110__;
     nNeeded  += 1;
     while ( pSrc->present )
     {
@@ -26318,14 +27413,14 @@ tANI_U32 dot11fPackIeHT2040BSSCoexistence(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp108__ = 0U;
-        tmp108__ |= ( pSrc->infoRequest << 0 );
-        tmp108__ |= ( pSrc->fortyMHzIntolerant << 1 );
-        tmp108__ |= ( pSrc->twentyMHzBssWidthReq << 2 );
-        tmp108__ |= ( pSrc->obssScanExemptionReq << 3 );
-        tmp108__ |= ( pSrc->obssScanExemptionGrant << 4 );
-        tmp108__ |= ( pSrc->unused << 5 );
-        *pBuf = tmp108__;
+        tmp110__ = 0U;
+        tmp110__ |= ( pSrc->infoRequest << 0 );
+        tmp110__ |= ( pSrc->fortyMHzIntolerant << 1 );
+        tmp110__ |= ( pSrc->twentyMHzBssWidthReq << 2 );
+        tmp110__ |= ( pSrc->obssScanExemptionReq << 3 );
+        tmp110__ |= ( pSrc->obssScanExemptionGrant << 4 );
+        tmp110__ |= ( pSrc->unused << 5 );
+        *pBuf = tmp110__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -26381,11 +27476,11 @@ tANI_U32 dot11fPackIeHTCaps(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U16 tmp109__;
-    tANI_U8 tmp110__;
     tANI_U16 tmp111__;
-    tANI_U32 tmp112__;
-    tANI_U8 tmp113__;
+    tANI_U8 tmp112__;
+    tANI_U16 tmp113__;
+    tANI_U32 tmp114__;
+    tANI_U8 tmp115__;
     nNeeded  +=  (pSrc->num_rsvd + 26);
     while ( pSrc->present )
     {
@@ -26394,77 +27489,77 @@ tANI_U32 dot11fPackIeHTCaps(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp109__ = 0U;
-        tmp109__ |= ( pSrc->advCodingCap << 0 );
-        tmp109__ |= ( pSrc->supportedChannelWidthSet << 1 );
-        tmp109__ |= ( pSrc->mimoPowerSave << 2 );
-        tmp109__ |= ( pSrc->greenField << 4 );
-        tmp109__ |= ( pSrc->shortGI20MHz << 5 );
-        tmp109__ |= ( pSrc->shortGI40MHz << 6 );
-        tmp109__ |= ( pSrc->txSTBC << 7 );
-        tmp109__ |= ( pSrc->rxSTBC << 8 );
-        tmp109__ |= ( pSrc->delayedBA << 10 );
-        tmp109__ |= ( pSrc->maximalAMSDUsize << 11 );
-        tmp109__ |= ( pSrc->dsssCckMode40MHz << 12 );
-        tmp109__ |= ( pSrc->psmp << 13 );
-        tmp109__ |= ( pSrc->stbcControlFrame << 14 );
-        tmp109__ |= ( pSrc->lsigTXOPProtection << 15 );
-        frameshtons(pCtx, pBuf, tmp109__, 0);
+        tmp111__ = 0U;
+        tmp111__ |= ( pSrc->advCodingCap << 0 );
+        tmp111__ |= ( pSrc->supportedChannelWidthSet << 1 );
+        tmp111__ |= ( pSrc->mimoPowerSave << 2 );
+        tmp111__ |= ( pSrc->greenField << 4 );
+        tmp111__ |= ( pSrc->shortGI20MHz << 5 );
+        tmp111__ |= ( pSrc->shortGI40MHz << 6 );
+        tmp111__ |= ( pSrc->txSTBC << 7 );
+        tmp111__ |= ( pSrc->rxSTBC << 8 );
+        tmp111__ |= ( pSrc->delayedBA << 10 );
+        tmp111__ |= ( pSrc->maximalAMSDUsize << 11 );
+        tmp111__ |= ( pSrc->dsssCckMode40MHz << 12 );
+        tmp111__ |= ( pSrc->psmp << 13 );
+        tmp111__ |= ( pSrc->stbcControlFrame << 14 );
+        tmp111__ |= ( pSrc->lsigTXOPProtection << 15 );
+        frameshtons(pCtx, pBuf, tmp111__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
-        tmp110__ = 0U;
-        tmp110__ |= ( pSrc->maxRxAMPDUFactor << 0 );
-        tmp110__ |= ( pSrc->mpduDensity << 2 );
-        tmp110__ |= ( pSrc->reserved1 << 5 );
-        *pBuf = tmp110__;
+        tmp112__ = 0U;
+        tmp112__ |= ( pSrc->maxRxAMPDUFactor << 0 );
+        tmp112__ |= ( pSrc->mpduDensity << 2 );
+        tmp112__ |= ( pSrc->reserved1 << 5 );
+        *pBuf = tmp112__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
         DOT11F_MEMCPY(pCtx, pBuf, pSrc->supportedMCSSet, 16);
         *pnConsumed += 16;
         pBuf += 16;
-        tmp111__ = 0U;
-        tmp111__ |= ( pSrc->pco << 0 );
-        tmp111__ |= ( pSrc->transitionTime << 1 );
-        tmp111__ |= ( pSrc->reserved2 << 3 );
-        tmp111__ |= ( pSrc->mcsFeedback << 8 );
-        tmp111__ |= ( pSrc->reserved3 << 10 );
-        frameshtons(pCtx, pBuf, tmp111__, 0);
+        tmp113__ = 0U;
+        tmp113__ |= ( pSrc->pco << 0 );
+        tmp113__ |= ( pSrc->transitionTime << 1 );
+        tmp113__ |= ( pSrc->reserved2 << 3 );
+        tmp113__ |= ( pSrc->mcsFeedback << 8 );
+        tmp113__ |= ( pSrc->reserved3 << 10 );
+        frameshtons(pCtx, pBuf, tmp113__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
-        tmp112__ = 0U;
-        tmp112__ |= ( pSrc->txBF << 0 );
-        tmp112__ |= ( pSrc->rxStaggeredSounding << 1 );
-        tmp112__ |= ( pSrc->txStaggeredSounding << 2 );
-        tmp112__ |= ( pSrc->rxZLF << 3 );
-        tmp112__ |= ( pSrc->txZLF << 4 );
-        tmp112__ |= ( pSrc->implicitTxBF << 5 );
-        tmp112__ |= ( pSrc->calibration << 6 );
-        tmp112__ |= ( pSrc->explicitCSITxBF << 8 );
-        tmp112__ |= ( pSrc->explicitUncompressedSteeringMatrix << 9 );
-        tmp112__ |= ( pSrc->explicitBFCSIFeedback << 10 );
-        tmp112__ |= ( pSrc->explicitUncompressedSteeringMatrixFeedback << 13 );
-        tmp112__ |= ( pSrc->explicitCompressedSteeringMatrixFeedback << 16 );
-        tmp112__ |= ( pSrc->csiNumBFAntennae << 19 );
-        tmp112__ |= ( pSrc->uncompressedSteeringMatrixBFAntennae << 21 );
-        tmp112__ |= ( pSrc->compressedSteeringMatrixBFAntennae << 23 );
-        tmp112__ |= ( pSrc->reserved4 << 25 );
-        frameshtonl(pCtx, pBuf, tmp112__, 0);
+        tmp114__ = 0U;
+        tmp114__ |= ( pSrc->txBF << 0 );
+        tmp114__ |= ( pSrc->rxStaggeredSounding << 1 );
+        tmp114__ |= ( pSrc->txStaggeredSounding << 2 );
+        tmp114__ |= ( pSrc->rxZLF << 3 );
+        tmp114__ |= ( pSrc->txZLF << 4 );
+        tmp114__ |= ( pSrc->implicitTxBF << 5 );
+        tmp114__ |= ( pSrc->calibration << 6 );
+        tmp114__ |= ( pSrc->explicitCSITxBF << 8 );
+        tmp114__ |= ( pSrc->explicitUncompressedSteeringMatrix << 9 );
+        tmp114__ |= ( pSrc->explicitBFCSIFeedback << 10 );
+        tmp114__ |= ( pSrc->explicitUncompressedSteeringMatrixFeedback << 13 );
+        tmp114__ |= ( pSrc->explicitCompressedSteeringMatrixFeedback << 16 );
+        tmp114__ |= ( pSrc->csiNumBFAntennae << 19 );
+        tmp114__ |= ( pSrc->uncompressedSteeringMatrixBFAntennae << 21 );
+        tmp114__ |= ( pSrc->compressedSteeringMatrixBFAntennae << 23 );
+        tmp114__ |= ( pSrc->reserved4 << 25 );
+        frameshtonl(pCtx, pBuf, tmp114__, 0);
         *pnConsumed += 4;
         pBuf += 4;
         nBuf -=  4 ;
-        tmp113__ = 0U;
-        tmp113__ |= ( pSrc->antennaSelection << 0 );
-        tmp113__ |= ( pSrc->explicitCSIFeedbackTx << 1 );
-        tmp113__ |= ( pSrc->antennaIndicesFeedbackTx << 2 );
-        tmp113__ |= ( pSrc->explicitCSIFeedback << 3 );
-        tmp113__ |= ( pSrc->antennaIndicesFeedback << 4 );
-        tmp113__ |= ( pSrc->rxAS << 5 );
-        tmp113__ |= ( pSrc->txSoundingPPDUs << 6 );
-        tmp113__ |= ( pSrc->reserved5 << 7 );
-        *pBuf = tmp113__;
+        tmp115__ = 0U;
+        tmp115__ |= ( pSrc->antennaSelection << 0 );
+        tmp115__ |= ( pSrc->explicitCSIFeedbackTx << 1 );
+        tmp115__ |= ( pSrc->antennaIndicesFeedbackTx << 2 );
+        tmp115__ |= ( pSrc->explicitCSIFeedback << 3 );
+        tmp115__ |= ( pSrc->antennaIndicesFeedback << 4 );
+        tmp115__ |= ( pSrc->rxAS << 5 );
+        tmp115__ |= ( pSrc->txSoundingPPDUs << 6 );
+        tmp115__ |= ( pSrc->reserved5 << 7 );
+        *pBuf = tmp115__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
@@ -26490,9 +27585,9 @@ tANI_U32 dot11fPackIeHTInfo(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp114__;
-    tANI_U16 tmp115__;
-    tANI_U16 tmp116__;
+    tANI_U8 tmp116__;
+    tANI_U16 tmp117__;
+    tANI_U16 tmp118__;
     nNeeded  +=  (pSrc->num_rsvd + 22);
     while ( pSrc->present )
     {
@@ -26504,35 +27599,35 @@ tANI_U32 dot11fPackIeHTInfo(tpAniSirGlobal pCtx,
         *pBuf = pSrc->primaryChannel;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp114__ = 0U;
-        tmp114__ |= ( pSrc->secondaryChannelOffset << 0 );
-        tmp114__ |= ( pSrc->recommendedTxWidthSet << 2 );
-        tmp114__ |= ( pSrc->rifsMode << 3 );
-        tmp114__ |= ( pSrc->controlledAccessOnly << 4 );
-        tmp114__ |= ( pSrc->serviceIntervalGranularity << 5 );
-        *pBuf = tmp114__;
+        tmp116__ = 0U;
+        tmp116__ |= ( pSrc->secondaryChannelOffset << 0 );
+        tmp116__ |= ( pSrc->recommendedTxWidthSet << 2 );
+        tmp116__ |= ( pSrc->rifsMode << 3 );
+        tmp116__ |= ( pSrc->controlledAccessOnly << 4 );
+        tmp116__ |= ( pSrc->serviceIntervalGranularity << 5 );
+        *pBuf = tmp116__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
-        tmp115__ = 0U;
-        tmp115__ |= ( pSrc->opMode << 0 );
-        tmp115__ |= ( pSrc->nonGFDevicesPresent << 2 );
-        tmp115__ |= ( pSrc->transmitBurstLimit << 3 );
-        tmp115__ |= ( pSrc->obssNonHTStaPresent << 4 );
-        tmp115__ |= ( pSrc->reserved << 5 );
-        frameshtons(pCtx, pBuf, tmp115__, 0);
+        tmp117__ = 0U;
+        tmp117__ |= ( pSrc->opMode << 0 );
+        tmp117__ |= ( pSrc->nonGFDevicesPresent << 2 );
+        tmp117__ |= ( pSrc->transmitBurstLimit << 3 );
+        tmp117__ |= ( pSrc->obssNonHTStaPresent << 4 );
+        tmp117__ |= ( pSrc->reserved << 5 );
+        frameshtons(pCtx, pBuf, tmp117__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
-        tmp116__ = 0U;
-        tmp116__ |= ( pSrc->basicSTBCMCS << 0 );
-        tmp116__ |= ( pSrc->dualCTSProtection << 7 );
-        tmp116__ |= ( pSrc->secondaryBeacon << 8 );
-        tmp116__ |= ( pSrc->lsigTXOPProtectionFullSupport << 9 );
-        tmp116__ |= ( pSrc->pcoActive << 10 );
-        tmp116__ |= ( pSrc->pcoPhase << 11 );
-        tmp116__ |= ( pSrc->reserved2 << 12 );
-        frameshtons(pCtx, pBuf, tmp116__, 0);
+        tmp118__ = 0U;
+        tmp118__ |= ( pSrc->basicSTBCMCS << 0 );
+        tmp118__ |= ( pSrc->dualCTSProtection << 7 );
+        tmp118__ |= ( pSrc->secondaryBeacon << 8 );
+        tmp118__ |= ( pSrc->lsigTXOPProtectionFullSupport << 9 );
+        tmp118__ |= ( pSrc->pcoActive << 10 );
+        tmp118__ |= ( pSrc->pcoPhase << 11 );
+        tmp118__ |= ( pSrc->reserved2 << 12 );
+        frameshtons(pCtx, pBuf, tmp118__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
@@ -26627,9 +27722,9 @@ tANI_U32 dot11fPackIeMeasurementReport(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp117__;
-    tANI_U8 tmp118__;
     tANI_U8 tmp119__;
+    tANI_U8 tmp120__;
+    tANI_U8 tmp121__;
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
     status = dot11fGetPackedIEMeasurementReport(pCtx, pSrc, &nNeeded);
     if ( ! DOT11F_SUCCEEDED( status ) ) return status;
@@ -26643,12 +27738,12 @@ tANI_U32 dot11fPackIeMeasurementReport(tpAniSirGlobal pCtx,
         *pBuf = pSrc->token;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp117__ = 0U;
-        tmp117__ |= ( pSrc->late << 0 );
-        tmp117__ |= ( pSrc->incapable << 1 );
-        tmp117__ |= ( pSrc->refused << 2 );
-        tmp117__ |= ( pSrc->unused << 3 );
-        *pBuf = tmp117__;
+        tmp119__ = 0U;
+        tmp119__ |= ( pSrc->late << 0 );
+        tmp119__ |= ( pSrc->incapable << 1 );
+        tmp119__ |= ( pSrc->refused << 2 );
+        tmp119__ |= ( pSrc->unused << 3 );
+        *pBuf = tmp119__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
@@ -26668,14 +27763,14 @@ tANI_U32 dot11fPackIeMeasurementReport(tpAniSirGlobal pCtx,
                     frameshtons(pCtx, pBuf, pSrc->report.Basic.meas_duration, 0);
                     *pnConsumed += 2;
                     pBuf += 2;
-                    tmp118__ = 0U;
-                    tmp118__ |= ( pSrc->report.Basic.bss << 0 );
-                    tmp118__ |= ( pSrc->report.Basic.ofdm_preamble << 1 );
-                    tmp118__ |= ( pSrc->report.Basic.unid_signal << 2 );
-                    tmp118__ |= ( pSrc->report.Basic.rader << 3 );
-                    tmp118__ |= ( pSrc->report.Basic.unmeasured << 4 );
-                    tmp118__ |= ( pSrc->report.Basic.unused << 5 );
-                    *pBuf = tmp118__;
+                    tmp120__ = 0U;
+                    tmp120__ |= ( pSrc->report.Basic.bss << 0 );
+                    tmp120__ |= ( pSrc->report.Basic.ofdm_preamble << 1 );
+                    tmp120__ |= ( pSrc->report.Basic.unid_signal << 2 );
+                    tmp120__ |= ( pSrc->report.Basic.rader << 3 );
+                    tmp120__ |= ( pSrc->report.Basic.unmeasured << 4 );
+                    tmp120__ |= ( pSrc->report.Basic.unused << 5 );
+                    *pBuf = tmp120__;
                     *pnConsumed += 1;
                     // fieldsEndFlag  = 1
                     nBuf -=  1 ;
@@ -26742,10 +27837,10 @@ tANI_U32 dot11fPackIeMeasurementReport(tpAniSirGlobal pCtx,
                     frameshtons(pCtx, pBuf, pSrc->report.Beacon.meas_duration, 0);
                     *pnConsumed += 2;
                     pBuf += 2;
-                    tmp119__ = 0U;
-                    tmp119__ |= ( pSrc->report.Beacon.condensed_PHY << 0 );
-                    tmp119__ |= ( pSrc->report.Beacon.reported_frame_type << 7 );
-                    *pBuf = tmp119__;
+                    tmp121__ = 0U;
+                    tmp121__ |= ( pSrc->report.Beacon.condensed_PHY << 0 );
+                    tmp121__ |= ( pSrc->report.Beacon.reported_frame_type << 7 );
+                    *pBuf = tmp121__;
                     *pnConsumed += 1;
                     pBuf += 1;
                     nBuf -=  1 ;
@@ -26794,7 +27889,7 @@ tANI_U32 dot11fPackIeMeasurementRequest(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp120__;
+    tANI_U8 tmp122__;
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
     status = dot11fGetPackedIEMeasurementRequest(pCtx, pSrc, &nNeeded);
     if ( ! DOT11F_SUCCEEDED( status ) ) return status;
@@ -26808,14 +27903,14 @@ tANI_U32 dot11fPackIeMeasurementRequest(tpAniSirGlobal pCtx,
         *pBuf = pSrc->measurement_token;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp120__ = 0U;
-        tmp120__ |= ( pSrc->parallel << 0 );
-        tmp120__ |= ( pSrc->enable << 1 );
-        tmp120__ |= ( pSrc->request << 2 );
-        tmp120__ |= ( pSrc->report << 3 );
-        tmp120__ |= ( pSrc->durationMandatory << 4 );
-        tmp120__ |= ( pSrc->unused << 5 );
-        *pBuf = tmp120__;
+        tmp122__ = 0U;
+        tmp122__ |= ( pSrc->parallel << 0 );
+        tmp122__ |= ( pSrc->enable << 1 );
+        tmp122__ |= ( pSrc->request << 2 );
+        tmp122__ |= ( pSrc->report << 3 );
+        tmp122__ |= ( pSrc->durationMandatory << 4 );
+        tmp122__ |= ( pSrc->unused << 5 );
+        *pBuf = tmp122__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
@@ -26904,7 +27999,7 @@ tANI_U32 dot11fPackIeMobilityDomain(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp121__;
+    tANI_U8 tmp123__;
     nNeeded  += 3;
     while ( pSrc->present )
     {
@@ -26916,11 +28011,11 @@ tANI_U32 dot11fPackIeMobilityDomain(tpAniSirGlobal pCtx,
         frameshtons(pCtx, pBuf, pSrc->MDID, 0);
         *pnConsumed += 2;
         pBuf += 2;
-        tmp121__ = 0U;
-        tmp121__ |= ( pSrc->overDSCap << 0 );
-        tmp121__ |= ( pSrc->resourceReqCap << 1 );
-        tmp121__ |= ( pSrc->reserved << 2 );
-        *pBuf = tmp121__;
+        tmp123__ = 0U;
+        tmp123__ |= ( pSrc->overDSCap << 0 );
+        tmp123__ |= ( pSrc->resourceReqCap << 1 );
+        tmp123__ |= ( pSrc->reserved << 2 );
+        *pBuf = tmp123__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -26943,8 +28038,8 @@ tANI_U32 dot11fPackIeNeighborReport(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp122__;
-    tANI_U8 tmp123__;
+    tANI_U8 tmp124__;
+    tANI_U8 tmp125__;
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
     status = dot11fGetPackedIENeighborReport(pCtx, pSrc, &nNeeded);
     if ( ! DOT11F_SUCCEEDED( status ) ) return status;
@@ -26958,24 +28053,24 @@ tANI_U32 dot11fPackIeNeighborReport(tpAniSirGlobal pCtx,
         DOT11F_MEMCPY(pCtx, pBuf, pSrc->bssid, 6);
         *pnConsumed += 6;
         pBuf += 6;
-        tmp122__ = 0U;
-        tmp122__ |= ( pSrc->APReachability << 0 );
-        tmp122__ |= ( pSrc->Security << 2 );
-        tmp122__ |= ( pSrc->KeyScope << 3 );
-        tmp122__ |= ( pSrc->SpecMgmtCap << 4 );
-        tmp122__ |= ( pSrc->QosCap << 5 );
-        tmp122__ |= ( pSrc->apsd << 6 );
-        tmp122__ |= ( pSrc->rrm << 7 );
-        *pBuf = tmp122__;
+        tmp124__ = 0U;
+        tmp124__ |= ( pSrc->APReachability << 0 );
+        tmp124__ |= ( pSrc->Security << 2 );
+        tmp124__ |= ( pSrc->KeyScope << 3 );
+        tmp124__ |= ( pSrc->SpecMgmtCap << 4 );
+        tmp124__ |= ( pSrc->QosCap << 5 );
+        tmp124__ |= ( pSrc->apsd << 6 );
+        tmp124__ |= ( pSrc->rrm << 7 );
+        *pBuf = tmp124__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
-        tmp123__ = 0U;
-        tmp123__ |= ( pSrc->DelayedBA << 0 );
-        tmp123__ |= ( pSrc->ImmBA << 1 );
-        tmp123__ |= ( pSrc->MobilityDomain << 2 );
-        tmp123__ |= ( pSrc->reserved << 3 );
-        *pBuf = tmp123__;
+        tmp125__ = 0U;
+        tmp125__ |= ( pSrc->DelayedBA << 0 );
+        tmp125__ |= ( pSrc->ImmBA << 1 );
+        tmp125__ |= ( pSrc->MobilityDomain << 2 );
+        tmp125__ |= ( pSrc->reserved << 3 );
+        *pBuf = tmp125__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
@@ -27065,7 +28160,7 @@ tANI_U32 dot11fPackIeOperatingMode(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp124__;
+    tANI_U8 tmp126__;
     nNeeded  += 1;
     while ( pSrc->present )
     {
@@ -27074,12 +28169,12 @@ tANI_U32 dot11fPackIeOperatingMode(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp124__ = 0U;
-        tmp124__ |= ( pSrc->chanWidth << 0 );
-        tmp124__ |= ( pSrc->reserved << 2 );
-        tmp124__ |= ( pSrc->rxNSS << 4 );
-        tmp124__ |= ( pSrc->rxNSSType << 7 );
-        *pBuf = tmp124__;
+        tmp126__ = 0U;
+        tmp126__ |= ( pSrc->chanWidth << 0 );
+        tmp126__ |= ( pSrc->reserved << 2 );
+        tmp126__ |= ( pSrc->rxNSS << 4 );
+        tmp126__ |= ( pSrc->rxNSSType << 7 );
+        *pBuf = tmp126__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -28033,7 +29128,7 @@ tANI_U32 dot11fPackIePUBufferStatus(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp125__;
+    tANI_U8 tmp127__;
     nNeeded  += 1;
     while ( pSrc->present )
     {
@@ -28042,13 +29137,13 @@ tANI_U32 dot11fPackIePUBufferStatus(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp125__ = 0U;
-        tmp125__ |= ( pSrc->ac_bk_traffic_aval << 0 );
-        tmp125__ |= ( pSrc->ac_be_traffic_aval << 1 );
-        tmp125__ |= ( pSrc->ac_vi_traffic_aval << 2 );
-        tmp125__ |= ( pSrc->ac_vo_traffic_aval << 3 );
-        tmp125__ |= ( pSrc->reserved << 4 );
-        *pBuf = tmp125__;
+        tmp127__ = 0U;
+        tmp127__ |= ( pSrc->ac_bk_traffic_aval << 0 );
+        tmp127__ |= ( pSrc->ac_be_traffic_aval << 1 );
+        tmp127__ |= ( pSrc->ac_vi_traffic_aval << 2 );
+        tmp127__ |= ( pSrc->ac_vo_traffic_aval << 3 );
+        tmp127__ |= ( pSrc->reserved << 4 );
+        *pBuf = tmp127__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -28170,26 +29265,29 @@ tANI_U32 dot11fPackIeQComVendorIE(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    nNeeded  += 2;
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    status = dot11fGetPackedIEQComVendorIE(pCtx, pSrc, &nNeeded);
+    if ( ! DOT11F_SUCCEEDED( status ) ) return status;
     while ( pSrc->present )
     {
         if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
         *pBuf = 221;
-        ++pBuf; ++(*pnConsumed);
+        ++pBuf; --nBuf; ++(*pnConsumed);
         pIeLen = pBuf;
-        ++pBuf; ++(*pnConsumed);
+        ++pBuf; --nBuf; ++(*pnConsumed);
         *pBuf = 0x0;
-        ++pBuf; ++(*pnConsumed);
+        ++pBuf; --nBuf; ++(*pnConsumed);
         *pBuf = 0xa0;
-        ++pBuf; ++(*pnConsumed);
+        ++pBuf; --nBuf; ++(*pnConsumed);
         *pBuf = 0xc6;
-        ++pBuf; ++(*pnConsumed);
-        *pBuf = pSrc->type;
-        *pnConsumed += 1;
-        pBuf += 1;
-        *pBuf = pSrc->channel;
-        *pnConsumed += 1;
-        // fieldsEndFlag = 1
+        ++pBuf; --nBuf; ++(*pnConsumed);
+        status = PackCore(pCtx,
+          (tANI_U8*)pSrc,
+          pBuf,
+          nBuf,
+          pnConsumed,
+          FFS_QComVendorIE,
+          IES_QComVendorIE);
         break;
     }
     (void)pCtx;
@@ -28197,7 +29295,7 @@ tANI_U32 dot11fPackIeQComVendorIE(tpAniSirGlobal pCtx,
     {
         *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
     }
-    return DOT11F_PARSE_SUCCESS;
+    return status;
 } /* End dot11fPackIeQComVendorIE. */
 
 tANI_U32 dot11fPackIeQOSCapsAp(tpAniSirGlobal pCtx,
@@ -28209,7 +29307,7 @@ tANI_U32 dot11fPackIeQOSCapsAp(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp126__;
+    tANI_U8 tmp128__;
     nNeeded  += 1;
     while ( pSrc->present )
     {
@@ -28218,13 +29316,13 @@ tANI_U32 dot11fPackIeQOSCapsAp(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp126__ = 0U;
-        tmp126__ |= ( pSrc->count << 0 );
-        tmp126__ |= ( pSrc->qack << 4 );
-        tmp126__ |= ( pSrc->qreq << 5 );
-        tmp126__ |= ( pSrc->txopreq << 6 );
-        tmp126__ |= ( pSrc->reserved << 7 );
-        *pBuf = tmp126__;
+        tmp128__ = 0U;
+        tmp128__ |= ( pSrc->count << 0 );
+        tmp128__ |= ( pSrc->qack << 4 );
+        tmp128__ |= ( pSrc->qreq << 5 );
+        tmp128__ |= ( pSrc->txopreq << 6 );
+        tmp128__ |= ( pSrc->reserved << 7 );
+        *pBuf = tmp128__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -28247,7 +29345,7 @@ tANI_U32 dot11fPackIeQOSCapsStation(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp127__;
+    tANI_U8 tmp129__;
     nNeeded  += 1;
     while ( pSrc->present )
     {
@@ -28256,15 +29354,15 @@ tANI_U32 dot11fPackIeQOSCapsStation(tpAniSirGlobal pCtx,
         ++pBuf; ++(*pnConsumed);
         pIeLen = pBuf;
         ++pBuf; ++(*pnConsumed);
-        tmp127__ = 0U;
-        tmp127__ |= ( pSrc->acvo_uapsd << 0 );
-        tmp127__ |= ( pSrc->acvi_uapsd << 1 );
-        tmp127__ |= ( pSrc->acbk_uapsd << 2 );
-        tmp127__ |= ( pSrc->acbe_uapsd << 3 );
-        tmp127__ |= ( pSrc->qack << 4 );
-        tmp127__ |= ( pSrc->max_sp_length << 5 );
-        tmp127__ |= ( pSrc->more_data_ack << 7 );
-        *pBuf = tmp127__;
+        tmp129__ = 0U;
+        tmp129__ |= ( pSrc->acvo_uapsd << 0 );
+        tmp129__ |= ( pSrc->acvi_uapsd << 1 );
+        tmp129__ |= ( pSrc->acbk_uapsd << 2 );
+        tmp129__ |= ( pSrc->acbe_uapsd << 3 );
+        tmp129__ |= ( pSrc->qack << 4 );
+        tmp129__ |= ( pSrc->max_sp_length << 5 );
+        tmp129__ |= ( pSrc->more_data_ack << 7 );
+        *pBuf = tmp129__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -28912,7 +30010,7 @@ tANI_U32 dot11fPackIeWAPI(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U16 tmp128__;
+    tANI_U16 tmp130__;
     tANI_U32 status = DOT11F_PARSE_SUCCESS;
     status = dot11fGetPackedIEWAPI(pCtx, pSrc, &nNeeded);
     if ( ! DOT11F_SUCCEEDED( status ) ) return status;
@@ -28941,10 +30039,10 @@ tANI_U32 dot11fPackIeWAPI(tpAniSirGlobal pCtx,
         DOT11F_MEMCPY(pCtx, pBuf, pSrc->multicast_cipher_suite, 4);
         *pnConsumed += 4;
         pBuf += 4;
-        tmp128__ = 0U;
-        tmp128__ |= ( pSrc->preauth << 0 );
-        tmp128__ |= ( pSrc->reserved << 1 );
-        frameshtons(pCtx, pBuf, tmp128__, 0);
+        tmp130__ = 0U;
+        tmp130__ |= ( pSrc->preauth << 0 );
+        tmp130__ |= ( pSrc->reserved << 1 );
+        frameshtons(pCtx, pBuf, tmp130__, 0);
         *pnConsumed += 2;
         pBuf += 2;
         nBuf -=  2 ;
@@ -29087,7 +30185,7 @@ tANI_U32 dot11fPackIeWMMCaps(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp129__;
+    tANI_U8 tmp131__;
     nNeeded  += 2;
     while ( pSrc->present )
     {
@@ -29109,13 +30207,13 @@ tANI_U32 dot11fPackIeWMMCaps(tpAniSirGlobal pCtx,
         *pBuf = pSrc->version;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp129__ = 0U;
-        tmp129__ |= ( pSrc->reserved << 0 );
-        tmp129__ |= ( pSrc->qack << 4 );
-        tmp129__ |= ( pSrc->queue_request << 5 );
-        tmp129__ |= ( pSrc->txop_request << 6 );
-        tmp129__ |= ( pSrc->more_ack << 7 );
-        *pBuf = tmp129__;
+        tmp131__ = 0U;
+        tmp131__ |= ( pSrc->reserved << 0 );
+        tmp131__ |= ( pSrc->qack << 4 );
+        tmp131__ |= ( pSrc->queue_request << 5 );
+        tmp131__ |= ( pSrc->txop_request << 6 );
+        tmp131__ |= ( pSrc->more_ack << 7 );
+        *pBuf = tmp131__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -29138,7 +30236,7 @@ tANI_U32 dot11fPackIeWMMInfoAp(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp130__;
+    tANI_U8 tmp132__;
     nNeeded  += 2;
     while ( pSrc->present )
     {
@@ -29160,11 +30258,11 @@ tANI_U32 dot11fPackIeWMMInfoAp(tpAniSirGlobal pCtx,
         *pBuf = pSrc->version;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp130__ = 0U;
-        tmp130__ |= ( pSrc->param_set_count << 0 );
-        tmp130__ |= ( pSrc->reserved << 4 );
-        tmp130__ |= ( pSrc->uapsd << 7 );
-        *pBuf = tmp130__;
+        tmp132__ = 0U;
+        tmp132__ |= ( pSrc->param_set_count << 0 );
+        tmp132__ |= ( pSrc->reserved << 4 );
+        tmp132__ |= ( pSrc->uapsd << 7 );
+        *pBuf = tmp132__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -29187,7 +30285,7 @@ tANI_U32 dot11fPackIeWMMInfoStation(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp131__;
+    tANI_U8 tmp133__;
     nNeeded  += 2;
     while ( pSrc->present )
     {
@@ -29209,15 +30307,15 @@ tANI_U32 dot11fPackIeWMMInfoStation(tpAniSirGlobal pCtx,
         *pBuf = pSrc->version;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp131__ = 0U;
-        tmp131__ |= ( pSrc->acvo_uapsd << 0 );
-        tmp131__ |= ( pSrc->acvi_uapsd << 1 );
-        tmp131__ |= ( pSrc->acbk_uapsd << 2 );
-        tmp131__ |= ( pSrc->acbe_uapsd << 3 );
-        tmp131__ |= ( pSrc->reserved1 << 4 );
-        tmp131__ |= ( pSrc->max_sp_length << 5 );
-        tmp131__ |= ( pSrc->reserved2 << 7 );
-        *pBuf = tmp131__;
+        tmp133__ = 0U;
+        tmp133__ |= ( pSrc->acvo_uapsd << 0 );
+        tmp133__ |= ( pSrc->acvi_uapsd << 1 );
+        tmp133__ |= ( pSrc->acbk_uapsd << 2 );
+        tmp133__ |= ( pSrc->acbe_uapsd << 3 );
+        tmp133__ |= ( pSrc->reserved1 << 4 );
+        tmp133__ |= ( pSrc->max_sp_length << 5 );
+        tmp133__ |= ( pSrc->reserved2 << 7 );
+        *pBuf = tmp133__;
         *pnConsumed += 1;
         // fieldsEndFlag  = 1
         nBuf -=  1 ;
@@ -29240,14 +30338,14 @@ tANI_U32 dot11fPackIeWMMParams(tpAniSirGlobal pCtx,
     tANI_U8* pIeLen = 0;
     tANI_U32 nConsumedOnEntry = *pnConsumed;
     tANI_U32 nNeeded = 0U;
-    tANI_U8 tmp132__;
-    tANI_U8 tmp133__;
     tANI_U8 tmp134__;
     tANI_U8 tmp135__;
     tANI_U8 tmp136__;
     tANI_U8 tmp137__;
     tANI_U8 tmp138__;
     tANI_U8 tmp139__;
+    tANI_U8 tmp140__;
+    tANI_U8 tmp141__;
     nNeeded  += 19;
     while ( pSrc->present )
     {
@@ -29275,79 +30373,79 @@ tANI_U32 dot11fPackIeWMMParams(tpAniSirGlobal pCtx,
         *pBuf = pSrc->reserved2;
         *pnConsumed += 1;
         pBuf += 1;
-        tmp132__ = 0U;
-        tmp132__ |= ( pSrc->acbe_aifsn << 0 );
-        tmp132__ |= ( pSrc->acbe_acm << 4 );
-        tmp132__ |= ( pSrc->acbe_aci << 5 );
-        tmp132__ |= ( pSrc->unused1 << 7 );
-        *pBuf = tmp132__;
-        *pnConsumed += 1;
-        pBuf += 1;
-        nBuf -=  1 ;
-        tmp133__ = 0U;
-        tmp133__ |= ( pSrc->acbe_acwmin << 0 );
-        tmp133__ |= ( pSrc->acbe_acwmax << 4 );
-        *pBuf = tmp133__;
-        *pnConsumed += 1;
-        pBuf += 1;
-        nBuf -=  1 ;
-        frameshtons(pCtx, pBuf, pSrc->acbe_txoplimit, 0);
-        *pnConsumed += 2;
-        pBuf += 2;
         tmp134__ = 0U;
-        tmp134__ |= ( pSrc->acbk_aifsn << 0 );
-        tmp134__ |= ( pSrc->acbk_acm << 4 );
-        tmp134__ |= ( pSrc->acbk_aci << 5 );
-        tmp134__ |= ( pSrc->unused2 << 7 );
+        tmp134__ |= ( pSrc->acbe_aifsn << 0 );
+        tmp134__ |= ( pSrc->acbe_acm << 4 );
+        tmp134__ |= ( pSrc->acbe_aci << 5 );
+        tmp134__ |= ( pSrc->unused1 << 7 );
         *pBuf = tmp134__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
         tmp135__ = 0U;
-        tmp135__ |= ( pSrc->acbk_acwmin << 0 );
-        tmp135__ |= ( pSrc->acbk_acwmax << 4 );
+        tmp135__ |= ( pSrc->acbe_acwmin << 0 );
+        tmp135__ |= ( pSrc->acbe_acwmax << 4 );
         *pBuf = tmp135__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
-        frameshtons(pCtx, pBuf, pSrc->acbk_txoplimit, 0);
+        frameshtons(pCtx, pBuf, pSrc->acbe_txoplimit, 0);
         *pnConsumed += 2;
         pBuf += 2;
         tmp136__ = 0U;
-        tmp136__ |= ( pSrc->acvi_aifsn << 0 );
-        tmp136__ |= ( pSrc->acvi_acm << 4 );
-        tmp136__ |= ( pSrc->acvi_aci << 5 );
-        tmp136__ |= ( pSrc->unused3 << 7 );
+        tmp136__ |= ( pSrc->acbk_aifsn << 0 );
+        tmp136__ |= ( pSrc->acbk_acm << 4 );
+        tmp136__ |= ( pSrc->acbk_aci << 5 );
+        tmp136__ |= ( pSrc->unused2 << 7 );
         *pBuf = tmp136__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
         tmp137__ = 0U;
-        tmp137__ |= ( pSrc->acvi_acwmin << 0 );
-        tmp137__ |= ( pSrc->acvi_acwmax << 4 );
+        tmp137__ |= ( pSrc->acbk_acwmin << 0 );
+        tmp137__ |= ( pSrc->acbk_acwmax << 4 );
         *pBuf = tmp137__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
-        frameshtons(pCtx, pBuf, pSrc->acvi_txoplimit, 0);
+        frameshtons(pCtx, pBuf, pSrc->acbk_txoplimit, 0);
         *pnConsumed += 2;
         pBuf += 2;
         tmp138__ = 0U;
-        tmp138__ |= ( pSrc->acvo_aifsn << 0 );
-        tmp138__ |= ( pSrc->acvo_acm << 4 );
-        tmp138__ |= ( pSrc->acvo_aci << 5 );
-        tmp138__ |= ( pSrc->unused4 << 7 );
+        tmp138__ |= ( pSrc->acvi_aifsn << 0 );
+        tmp138__ |= ( pSrc->acvi_acm << 4 );
+        tmp138__ |= ( pSrc->acvi_aci << 5 );
+        tmp138__ |= ( pSrc->unused3 << 7 );
         *pBuf = tmp138__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
         tmp139__ = 0U;
-        tmp139__ |= ( pSrc->acvo_acwmin << 0 );
-        tmp139__ |= ( pSrc->acvo_acwmax << 4 );
+        tmp139__ |= ( pSrc->acvi_acwmin << 0 );
+        tmp139__ |= ( pSrc->acvi_acwmax << 4 );
         *pBuf = tmp139__;
         *pnConsumed += 1;
         pBuf += 1;
         nBuf -=  1 ;
+        frameshtons(pCtx, pBuf, pSrc->acvi_txoplimit, 0);
+        *pnConsumed += 2;
+        pBuf += 2;
+        tmp140__ = 0U;
+        tmp140__ |= ( pSrc->acvo_aifsn << 0 );
+        tmp140__ |= ( pSrc->acvo_acm << 4 );
+        tmp140__ |= ( pSrc->acvo_aci << 5 );
+        tmp140__ |= ( pSrc->unused4 << 7 );
+        *pBuf = tmp140__;
+        *pnConsumed += 1;
+        pBuf += 1;
+        nBuf -=  1 ;
+        tmp141__ = 0U;
+        tmp141__ |= ( pSrc->acvo_acwmin << 0 );
+        tmp141__ |= ( pSrc->acvo_acwmax << 4 );
+        *pBuf = tmp141__;
+        *pnConsumed += 1;
+        pBuf += 1;
+        nBuf -=  1 ;
         frameshtons(pCtx, pBuf, pSrc->acvo_txoplimit, 0);
         *pnConsumed += 2;
         // fieldsEndFlag = 1
@@ -29890,6 +30988,382 @@ tANI_U32 dot11fPackIeext_chan_switch_ann(tpAniSirGlobal pCtx,
     return DOT11F_PARSE_SUCCESS;
 } /* End dot11fPackIeext_chan_switch_ann. */
 
+tANI_U32 dot11fPackIefils_assoc_delay_info(tpAniSirGlobal pCtx,
+                                           tDot11fIEfils_assoc_delay_info *pSrc,
+                                           tANI_U8 *pBuf,
+                                           tANI_U32 nBuf,
+                                           tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  += 1;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 255;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 1;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = pSrc->assoc_delay_info;
+        *pnConsumed += 1;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIefils_assoc_delay_info. */
+
+tANI_U32 dot11fPackIefils_hlp_container(tpAniSirGlobal pCtx,
+                                        tDot11fIEfils_hlp_container *pSrc,
+                                        tANI_U8 *pBuf,
+                                        tANI_U32 nBuf,
+                                        tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  +=  (pSrc->num_hlp_packet + 12);
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 255;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 5;
+        ++pBuf; ++(*pnConsumed);
+        DOT11F_MEMCPY(pCtx, pBuf, pSrc->dest_mac, 6);
+        *pnConsumed += 6;
+        pBuf += 6;
+        DOT11F_MEMCPY(pCtx, pBuf, pSrc->src_mac, 6);
+        *pnConsumed += 6;
+        pBuf += 6;
+        DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->hlp_packet ), pSrc->num_hlp_packet);
+        *pnConsumed += pSrc->num_hlp_packet;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIefils_hlp_container. */
+
+tANI_U32 dot11fPackIefils_indication(tpAniSirGlobal pCtx,
+                                     tDot11fIEfils_indication *pSrc,
+                                     tANI_U8 *pBuf,
+                                     tANI_U32 nBuf,
+                                     tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    tANI_U16 tmp142__;
+    nNeeded  +=  (pSrc->num_variable_data + 2);
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 240;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        tmp142__ = 0U;
+        tmp142__ |= ( pSrc->public_key_identifiers_cnt << 0 );
+        tmp142__ |= ( pSrc->realm_identifiers_cnt << 3 );
+        tmp142__ |= ( pSrc->is_ip_config_supported << 6 );
+        tmp142__ |= ( pSrc->is_cache_id_present << 7 );
+        tmp142__ |= ( pSrc->is_hessid_present << 8 );
+        tmp142__ |= ( pSrc->is_fils_sk_auth_supported << 9 );
+        tmp142__ |= ( pSrc->is_fils_sk_auth_pfs_supported << 10 );
+        tmp142__ |= ( pSrc->is_pk_auth_supported << 11 );
+        tmp142__ |= ( pSrc->reserved << 12 );
+        frameshtons(pCtx, pBuf, tmp142__, 0);
+        *pnConsumed += 2;
+        pBuf += 2;
+        nBuf -=  2 ;
+        DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->variable_data ), pSrc->num_variable_data);
+        *pnConsumed += pSrc->num_variable_data;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIefils_indication. */
+
+tANI_U32 dot11fPackIefils_kde(tpAniSirGlobal pCtx,
+                              tDot11fIEfils_kde *pSrc,
+                              tANI_U8 *pBuf,
+                              tANI_U32 nBuf,
+                              tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  +=  (pSrc->num_kde_list + 8);
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 255;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 7;
+        ++pBuf; ++(*pnConsumed);
+        DOT11F_MEMCPY(pCtx, pBuf, pSrc->key_rsc, 8);
+        *pnConsumed += 8;
+        pBuf += 8;
+        DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->kde_list ), pSrc->num_kde_list);
+        *pnConsumed += pSrc->num_kde_list;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIefils_kde. */
+
+tANI_U32 dot11fPackIefils_key_confirmation(tpAniSirGlobal pCtx,
+                                           tDot11fIEfils_key_confirmation *pSrc,
+                                           tANI_U8 *pBuf,
+                                           tANI_U32 nBuf,
+                                           tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  +=  pSrc->num_key_auth;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 255;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 3;
+        ++pBuf; ++(*pnConsumed);
+        DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->key_auth ), pSrc->num_key_auth);
+        *pnConsumed += pSrc->num_key_auth;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIefils_key_confirmation. */
+
+tANI_U32 dot11fPackIefils_nonce(tpAniSirGlobal pCtx,
+                                tDot11fIEfils_nonce *pSrc,
+                                tANI_U8 *pBuf,
+                                tANI_U32 nBuf,
+                                tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  += 16;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 255;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 13;
+        ++pBuf; ++(*pnConsumed);
+        DOT11F_MEMCPY(pCtx, pBuf, pSrc->nonce, 16);
+        *pnConsumed += 16;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIefils_nonce. */
+
+tANI_U32 dot11fPackIefils_public_key(tpAniSirGlobal pCtx,
+                                     tDot11fIEfils_public_key *pSrc,
+                                     tANI_U8 *pBuf,
+                                     tANI_U32 nBuf,
+                                     tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  +=  (pSrc->num_public_key + 1);
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 255;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 12;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = pSrc->key_type;
+        *pnConsumed += 1;
+        pBuf += 1;
+        DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->public_key ), pSrc->num_public_key);
+        *pnConsumed += pSrc->num_public_key;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIefils_public_key. */
+
+tANI_U32 dot11fPackIefils_session(tpAniSirGlobal pCtx,
+                                  tDot11fIEfils_session *pSrc,
+                                  tANI_U8 *pBuf,
+                                  tANI_U32 nBuf,
+                                  tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  += 8;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 255;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 4;
+        ++pBuf; ++(*pnConsumed);
+        DOT11F_MEMCPY(pCtx, pBuf, pSrc->session, 8);
+        *pnConsumed += 8;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIefils_session. */
+
+tANI_U32 dot11fPackIefils_wrapped_data(tpAniSirGlobal pCtx,
+                                       tDot11fIEfils_wrapped_data *pSrc,
+                                       tANI_U8 *pBuf,
+                                       tANI_U32 nBuf,
+                                       tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    nNeeded  +=  pSrc->num_wrapped_data;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 255;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 8;
+        ++pBuf; ++(*pnConsumed);
+        DOT11F_MEMCPY(pCtx, pBuf, &( pSrc->wrapped_data ), pSrc->num_wrapped_data);
+        *pnConsumed += pSrc->num_wrapped_data;
+        // fieldsEndFlag = 1
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return DOT11F_PARSE_SUCCESS;
+} /* End dot11fPackIefils_wrapped_data. */
+
+tANI_U32 dot11fPackIehs20vendor_ie(tpAniSirGlobal pCtx,
+                                   tDot11fIEhs20vendor_ie *pSrc,
+                                   tANI_U8 *pBuf,
+                                   tANI_U32 nBuf,
+                                   tANI_U32 *pnConsumed)
+{
+    tANI_U8* pIeLen = 0;
+    tANI_U32 nConsumedOnEntry = *pnConsumed;
+    tANI_U32 nNeeded = 0U;
+    tANI_U8 tmp143__;
+    tANI_U32 status = DOT11F_PARSE_SUCCESS;
+    status = dot11fGetPackedIEhs20vendor_ie(pCtx, pSrc, &nNeeded);
+    if ( ! DOT11F_SUCCEEDED( status ) ) return status;
+    while ( pSrc->present )
+    {
+        if ( nNeeded > nBuf ) return DOT11F_BUFFER_OVERFLOW;
+        *pBuf = 221;
+        ++pBuf; ++(*pnConsumed);
+        pIeLen = pBuf;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 0x50;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 0x6f;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 0x9a;
+        ++pBuf; ++(*pnConsumed);
+        *pBuf = 0x10;
+        ++pBuf; ++(*pnConsumed);
+        tmp143__ = 0U;
+        tmp143__ |= ( pSrc->dgaf_dis << 0 );
+        tmp143__ |= ( pSrc->hs_id_present << 1 );
+        tmp143__ |= ( pSrc->reserved << 3 );
+        tmp143__ |= ( pSrc->release_num << 4 );
+        *pBuf = tmp143__;
+        *pnConsumed += 1;
+        pBuf += 1;
+        nBuf -=  1 ;
+        if ( pSrc->hs_id_present )        {
+            switch (pSrc->hs_id_present)
+            {
+                case 1:
+                    frameshtons(pCtx, pBuf, pSrc->hs_id.pps_mo.pps_mo_id, 0);
+                    *pnConsumed += 2;
+                    // fieldsEndFlag = 1
+                break;
+                case 2:
+                    frameshtons(pCtx, pBuf, pSrc->hs_id.anqp_domain.anqp_domain_id, 0);
+                    *pnConsumed += 2;
+                    // fieldsEndFlag = 1
+                break;
+            }
+        }
+        else break;
+        break;
+    }
+    (void)pCtx;
+    if (pIeLen)
+    {
+        *pIeLen = *pnConsumed - nConsumedOnEntry - 2;
+    }
+    return status;
+} /* End dot11fPackIehs20vendor_ie. */
+
 tANI_U32 dot11fPackIesec_chan_offset_ele(tpAniSirGlobal pCtx,
                                          tDot11fIEsec_chan_offset_ele *pSrc,
                                          tANI_U8 *pBuf,
@@ -30899,6 +32373,48 @@ tANI_U32 dot11fPackAssocRequest(tpAniSirGlobal pCtx, tDot11fAssocRequest *pFrm,
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("txSupDataRate (13): %d\n"), pFrm->VHTCaps.txSupDataRate);
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("reserved3 (3): %d\n"), pFrm->VHTCaps.reserved3);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("fils_session:\n"));
+        if (!pFrm->fils_session.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->fils_session.session, 8);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("fils_public_key:\n"));
+        if (!pFrm->fils_public_key.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->fils_public_key.key_type, 1);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("num_public_key: %d.\n"), pFrm->fils_public_key.num_public_key);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* ) pFrm->fils_public_key.public_key, pFrm->fils_public_key.num_public_key);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("fils_key_confirmation:\n"));
+        if (!pFrm->fils_key_confirmation.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("num_key_auth: %d.\n"), pFrm->fils_key_confirmation.num_key_auth);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* ) pFrm->fils_key_confirmation.key_auth, pFrm->fils_key_confirmation.num_key_auth);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("fils_hlp_container:\n"));
+        if (!pFrm->fils_hlp_container.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->fils_hlp_container.dest_mac, 6);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->fils_hlp_container.src_mac, 6);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("num_hlp_packet: %d.\n"), pFrm->fils_hlp_container.num_hlp_packet);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* ) pFrm->fils_hlp_container.hlp_packet, pFrm->fils_hlp_container.num_hlp_packet);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("ExtCap:\n"));
         if (!pFrm->ExtCap.present)
         {
@@ -30987,6 +32503,54 @@ tANI_U32 dot11fPackAssocRequest(tpAniSirGlobal pCtx, tDot11fAssocRequest *pFrm,
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->vendor2_ie.VHTOperation.basicMCSSet, 2);
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("QComVendorIE:\n"));
+        if (!pFrm->QComVendorIE.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCREQUEST), pBuf, nBuf);
     }
@@ -31887,6 +33451,59 @@ tANI_U32 dot11fPackAssocResponse(tpAniSirGlobal pCtx, tDot11fAssocResponse *pFrm
             FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_dscp_exceptions: %d.\n"), pFrm->QosMapSet.num_dscp_exceptions);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->QosMapSet.dscp_exceptions, pFrm->QosMapSet.num_dscp_exceptions);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_session:\n"));
+        if (!pFrm->fils_session.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_session.session, 8);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_public_key:\n"));
+        if (!pFrm->fils_public_key.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_public_key.key_type, 1);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_public_key: %d.\n"), pFrm->fils_public_key.num_public_key);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->fils_public_key.public_key, pFrm->fils_public_key.num_public_key);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_key_confirmation:\n"));
+        if (!pFrm->fils_key_confirmation.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_key_auth: %d.\n"), pFrm->fils_key_confirmation.num_key_auth);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->fils_key_confirmation.key_auth, pFrm->fils_key_confirmation.num_key_auth);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_hlp_container:\n"));
+        if (!pFrm->fils_hlp_container.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_hlp_container.dest_mac, 6);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_hlp_container.src_mac, 6);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_hlp_packet: %d.\n"), pFrm->fils_hlp_container.num_hlp_packet);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->fils_hlp_container.hlp_packet, pFrm->fils_hlp_container.num_hlp_packet);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("fils_kde:\n"));
+        if (!pFrm->fils_kde.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->fils_kde.key_rsc, 8);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("num_kde_list: %d.\n"), pFrm->fils_kde.num_kde_list);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* ) pFrm->fils_kde.kde_list, pFrm->fils_kde.num_kde_list);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("vendor2_ie:\n"));
         if (!pFrm->vendor2_ie.present)
         {
@@ -31943,6 +33560,33 @@ tANI_U32 dot11fPackAssocResponse(tpAniSirGlobal pCtx, tDot11fAssocResponse *pFrm
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->vendor2_ie.VHTOperation.basicMCSSet, 2);
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("QComVendorIE:\n"));
+        if (!pFrm->QComVendorIE.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_ASSOCRESPONSE), pBuf, nBuf);
     }
@@ -32337,6 +33981,43 @@ tANI_U32 dot11fPackAuthentication(tpAniSirGlobal pCtx, tDot11fAuthentication *pF
                 }
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("fils_nonce:\n"));
+        if (!pFrm->fils_nonce.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->fils_nonce.nonce, 16);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("fils_session:\n"));
+        if (!pFrm->fils_session.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->fils_session.session, 8);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("fils_wrapped_data:\n"));
+        if (!pFrm->fils_wrapped_data.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("num_wrapped_data: %d.\n"), pFrm->fils_wrapped_data.num_wrapped_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* ) pFrm->fils_wrapped_data.wrapped_data, pFrm->fils_wrapped_data.num_wrapped_data);
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("fils_assoc_delay_info:\n"));
+        if (!pFrm->fils_assoc_delay_info.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), ( tANI_U8* )&pFrm->fils_assoc_delay_info.assoc_delay_info, 1);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_AUTHENTICATION), pBuf, nBuf);
     }
@@ -33205,6 +34886,25 @@ tANI_U32 dot11fPackBeacon(tpAniSirGlobal pCtx, tDot11fBeacon *pFrm, tANI_U8 *pBu
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->OBSSScanParameters.bssWidthChannelTransitionDelayFactor, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->OBSSScanParameters.obssScanActivityThreshold, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("fils_indication:\n"));
+        if (!pFrm->fils_indication.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("public_key_identifiers_cnt (3): %d\n"), pFrm->fils_indication.public_key_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("realm_identifiers_cnt (3): %d\n"), pFrm->fils_indication.realm_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_ip_config_supported (1): %d\n"), pFrm->fils_indication.is_ip_config_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_cache_id_present (1): %d\n"), pFrm->fils_indication.is_cache_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_hessid_present (1): %d\n"), pFrm->fils_indication.is_hessid_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_fils_sk_auth_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_fils_sk_auth_pfs_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_pfs_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("is_pk_auth_supported (1): %d\n"), pFrm->fils_indication.is_pk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("reserved (4): %d\n"), pFrm->fils_indication.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("num_variable_data: %d.\n"), pFrm->fils_indication.num_variable_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* ) pFrm->fils_indication.variable_data, pFrm->fils_indication.num_variable_data);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Vendor1IE:\n"));
         if (!pFrm->Vendor1IE.present)
         {
@@ -33277,6 +34977,27 @@ tANI_U32 dot11fPackBeacon(tpAniSirGlobal pCtx, tDot11fBeacon *pFrm, tANI_U8 *pBu
         else
         {
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("ChannelSwitchWrapper:\n"));
         if (!pFrm->ChannelSwitchWrapper.present)
         {
@@ -33295,6 +35016,16 @@ tANI_U32 dot11fPackBeacon(tpAniSirGlobal pCtx, tDot11fBeacon *pFrm, tANI_U8 *pBu
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("vht_transmit_power_env:\n"));
+            if (!pFrm->ChannelSwitchWrapper.vht_transmit_power_env.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("num_bytes: %d.\n"), pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* ) pFrm->ChannelSwitchWrapper.vht_transmit_power_env.bytes, pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("QComVendorIE:\n"));
         if (!pFrm->QComVendorIE.present)
@@ -33303,8 +35034,25 @@ tANI_U32 dot11fPackBeacon(tpAniSirGlobal pCtx, tDot11fBeacon *pFrm, tANI_U8 *pBu
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.type, 1);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.channel, 1);
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON), FRFL("ESEVersion:\n"));
         if (!pFrm->ESEVersion.present)
@@ -34110,6 +35858,25 @@ tANI_U32 dot11fPackBeacon2(tpAniSirGlobal pCtx, tDot11fBeacon2 *pFrm, tANI_U8 *p
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->OBSSScanParameters.bssWidthChannelTransitionDelayFactor, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->OBSSScanParameters.obssScanActivityThreshold, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("fils_indication:\n"));
+        if (!pFrm->fils_indication.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("public_key_identifiers_cnt (3): %d\n"), pFrm->fils_indication.public_key_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("realm_identifiers_cnt (3): %d\n"), pFrm->fils_indication.realm_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_ip_config_supported (1): %d\n"), pFrm->fils_indication.is_ip_config_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_cache_id_present (1): %d\n"), pFrm->fils_indication.is_cache_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_hessid_present (1): %d\n"), pFrm->fils_indication.is_hessid_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_fils_sk_auth_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_fils_sk_auth_pfs_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_pfs_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("is_pk_auth_supported (1): %d\n"), pFrm->fils_indication.is_pk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("reserved (4): %d\n"), pFrm->fils_indication.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("num_variable_data: %d.\n"), pFrm->fils_indication.num_variable_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->fils_indication.variable_data, pFrm->fils_indication.num_variable_data);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Vendor1IE:\n"));
         if (!pFrm->Vendor1IE.present)
         {
@@ -34182,6 +35949,27 @@ tANI_U32 dot11fPackBeacon2(tpAniSirGlobal pCtx, tDot11fBeacon2 *pFrm, tANI_U8 *p
         else
         {
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("ChannelSwitchWrapper:\n"));
         if (!pFrm->ChannelSwitchWrapper.present)
         {
@@ -34200,6 +35988,16 @@ tANI_U32 dot11fPackBeacon2(tpAniSirGlobal pCtx, tDot11fBeacon2 *pFrm, tANI_U8 *p
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("vht_transmit_power_env:\n"));
+            if (!pFrm->ChannelSwitchWrapper.vht_transmit_power_env.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("num_bytes: %d.\n"), pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* ) pFrm->ChannelSwitchWrapper.vht_transmit_power_env.bytes, pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("QComVendorIE:\n"));
         if (!pFrm->QComVendorIE.present)
@@ -34208,8 +36006,25 @@ tANI_U32 dot11fPackBeacon2(tpAniSirGlobal pCtx, tDot11fBeacon2 *pFrm, tANI_U8 *p
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.type, 1);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.channel, 1);
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACON2), FRFL("ESEVersion:\n"));
         if (!pFrm->ESEVersion.present)
@@ -35196,6 +37011,25 @@ tANI_U32 dot11fPackBeaconIEs(tpAniSirGlobal pCtx, tDot11fBeaconIEs *pFrm, tANI_U
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->OBSSScanParameters.bssWidthChannelTransitionDelayFactor, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->OBSSScanParameters.obssScanActivityThreshold, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("fils_indication:\n"));
+        if (!pFrm->fils_indication.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("public_key_identifiers_cnt (3): %d\n"), pFrm->fils_indication.public_key_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("realm_identifiers_cnt (3): %d\n"), pFrm->fils_indication.realm_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_ip_config_supported (1): %d\n"), pFrm->fils_indication.is_ip_config_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_cache_id_present (1): %d\n"), pFrm->fils_indication.is_cache_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_hessid_present (1): %d\n"), pFrm->fils_indication.is_hessid_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_fils_sk_auth_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_fils_sk_auth_pfs_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_pfs_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("is_pk_auth_supported (1): %d\n"), pFrm->fils_indication.is_pk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("reserved (4): %d\n"), pFrm->fils_indication.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("num_variable_data: %d.\n"), pFrm->fils_indication.num_variable_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* ) pFrm->fils_indication.variable_data, pFrm->fils_indication.num_variable_data);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Vendor1IE:\n"));
         if (!pFrm->Vendor1IE.present)
         {
@@ -35268,6 +37102,27 @@ tANI_U32 dot11fPackBeaconIEs(tpAniSirGlobal pCtx, tDot11fBeaconIEs *pFrm, tANI_U
         else
         {
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("ChannelSwitchWrapper:\n"));
         if (!pFrm->ChannelSwitchWrapper.present)
         {
@@ -35286,6 +37141,16 @@ tANI_U32 dot11fPackBeaconIEs(tpAniSirGlobal pCtx, tDot11fBeaconIEs *pFrm, tANI_U
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("vht_transmit_power_env:\n"));
+            if (!pFrm->ChannelSwitchWrapper.vht_transmit_power_env.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("num_bytes: %d.\n"), pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* ) pFrm->ChannelSwitchWrapper.vht_transmit_power_env.bytes, pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("QComVendorIE:\n"));
         if (!pFrm->QComVendorIE.present)
@@ -35294,8 +37159,25 @@ tANI_U32 dot11fPackBeaconIEs(tpAniSirGlobal pCtx, tDot11fBeaconIEs *pFrm, tANI_U
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.type, 1);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.channel, 1);
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_BEACONIES), pBuf, nBuf);
@@ -38231,6 +40113,25 @@ tANI_U32 dot11fPackProbeResponse(tpAniSirGlobal pCtx, tDot11fProbeResponse *pFrm
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->OBSSScanParameters.bssWidthChannelTransitionDelayFactor, 2);
             FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->OBSSScanParameters.obssScanActivityThreshold, 2);
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("fils_indication:\n"));
+        if (!pFrm->fils_indication.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("public_key_identifiers_cnt (3): %d\n"), pFrm->fils_indication.public_key_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("realm_identifiers_cnt (3): %d\n"), pFrm->fils_indication.realm_identifiers_cnt);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_ip_config_supported (1): %d\n"), pFrm->fils_indication.is_ip_config_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_cache_id_present (1): %d\n"), pFrm->fils_indication.is_cache_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_hessid_present (1): %d\n"), pFrm->fils_indication.is_hessid_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_fils_sk_auth_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_fils_sk_auth_pfs_supported (1): %d\n"), pFrm->fils_indication.is_fils_sk_auth_pfs_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("is_pk_auth_supported (1): %d\n"), pFrm->fils_indication.is_pk_auth_supported);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("reserved (4): %d\n"), pFrm->fils_indication.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("num_variable_data: %d.\n"), pFrm->fils_indication.num_variable_data);
+            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->fils_indication.variable_data, pFrm->fils_indication.num_variable_data);
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Vendor1IE:\n"));
         if (!pFrm->Vendor1IE.present)
         {
@@ -38303,6 +40204,27 @@ tANI_U32 dot11fPackProbeResponse(tpAniSirGlobal pCtx, tDot11fProbeResponse *pFrm
         else
         {
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("ChannelSwitchWrapper:\n"));
         if (!pFrm->ChannelSwitchWrapper.present)
         {
@@ -38321,6 +40243,16 @@ tANI_U32 dot11fPackProbeResponse(tpAniSirGlobal pCtx, tDot11fProbeResponse *pFrm
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq0, 1);
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->ChannelSwitchWrapper.WiderBWChanSwitchAnn.newCenterChanFreq1, 1);
             }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("vht_transmit_power_env:\n"));
+            if (!pFrm->ChannelSwitchWrapper.vht_transmit_power_env.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("num_bytes: %d.\n"), pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* ) pFrm->ChannelSwitchWrapper.vht_transmit_power_env.bytes, pFrm->ChannelSwitchWrapper.vht_transmit_power_env.num_bytes);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("QComVendorIE:\n"));
         if (!pFrm->QComVendorIE.present)
@@ -38329,8 +40261,25 @@ tANI_U32 dot11fPackProbeResponse(tpAniSirGlobal pCtx, tDot11fProbeResponse *pFrm
         }
         else
         {
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.type, 1);
-            FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.channel, 1);
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
         }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_PROBERESPONSE), FRFL("ESEVersion:\n"));
         if (!pFrm->ESEVersion.present)
@@ -39513,6 +41462,54 @@ tANI_U32 dot11fPackReAssocRequest(tpAniSirGlobal pCtx, tDot11fReAssocRequest *pF
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->vendor2_ie.VHTOperation.basicMCSSet, 2);
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("QComVendorIE:\n"));
+        if (!pFrm->QComVendorIE.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
+        }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("hs20vendor_ie:\n"));
+        if (!pFrm->hs20vendor_ie.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("dgaf_dis (1): %d\n"), pFrm->hs20vendor_ie.dgaf_dis);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("hs_id_present (2): %d\n"), pFrm->hs20vendor_ie.hs_id_present);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("reserved (1): %d\n"), pFrm->hs20vendor_ie.reserved);
+            FRAMES_LOG1(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("release_num (4): %d\n"), pFrm->hs20vendor_ie.release_num);
+            switch (pFrm->hs20vendor_ie.hs_id_present)
+            {
+                case 1:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.pps_mo.pps_mo_id, 2);
+                break;
+                case 2:
+                    FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), ( tANI_U8* )&pFrm->hs20vendor_ie.hs_id.anqp_domain.anqp_domain_id, 2);
+                break;
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCREQUEST), pBuf, nBuf);
     }
@@ -40476,6 +42473,33 @@ tANI_U32 dot11fPackReAssocResponse(tpAniSirGlobal pCtx, tDot11fReAssocResponse *
                 FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->vendor2_ie.VHTOperation.basicMCSSet, 2);
             }
         }
+        FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("QComVendorIE:\n"));
+        if (!pFrm->QComVendorIE.present)
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Not present.\n"));
+        }
+        else
+        {
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("MccChanInfo:\n"));
+            if (!pFrm->QComVendorIE.MccChanInfo.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.MccChanInfo.channel, 1);
+            }
+            FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Sub20Info:\n"));
+            if (!pFrm->QComVendorIE.Sub20Info.present)
+            {
+                FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("Not present.\n"));
+            }
+            else
+            {
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.capability, 1);
+                FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), ( tANI_U8* )&pFrm->QComVendorIE.Sub20Info.csa_chanwidth, 1);
+            }
+        }
         FRAMES_LOG0(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), FRFL("to:\n"));
         FRAMES_DUMP(pCtx, FRAMES_SEV_FOR_FRAME(pCtx, DOT11F_REASSOCRESPONSE), pBuf, nBuf);
     }
@@ -42736,7 +44760,7 @@ static tANI_U32 PackCore(tpAniSirGlobal pCtx,
     }
 
     pIe = &( IEs[0] );
-    while ( 0xff != pIe->eid )
+    while ( 0xff != pIe->eid || pIe->extn_eid)
     {
         pfFound = (tFRAMES_BOOL*)(pSrc + pIe->offset +
                                   pIe->presenceOffset);
@@ -42764,12 +44788,18 @@ static tANI_U32 PackCore(tpAniSirGlobal pCtx,
                     case SigIeIGTK:
                         status |= dot11fPackIeIGTK(pCtx, ( tDot11fIEIGTK* )(pSrc + pIe->offset + sizeof(tDot11fIEIGTK) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
+                    case SigIeMccChanInfo:
+                        status |= dot11fPackIeMccChanInfo(pCtx, ( tDot11fIEMccChanInfo* )(pSrc + pIe->offset + sizeof(tDot11fIEMccChanInfo) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
                     case SigIeR0KH_ID:
                         status |= dot11fPackIeR0KH_ID(pCtx, ( tDot11fIER0KH_ID* )(pSrc + pIe->offset + sizeof(tDot11fIER0KH_ID) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
                     case SigIeR1KH_ID:
                         status |= dot11fPackIeR1KH_ID(pCtx, ( tDot11fIER1KH_ID* )(pSrc + pIe->offset + sizeof(tDot11fIER1KH_ID) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
+                    case SigIeSub20Info:
+                        status |= dot11fPackIeSub20Info(pCtx, ( tDot11fIESub20Info* )(pSrc + pIe->offset + sizeof(tDot11fIESub20Info) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
                     case SigIeTSFInfo:
                         status |= dot11fPackIeTSFInfo(pCtx, ( tDot11fIETSFInfo* )(pSrc + pIe->offset + sizeof(tDot11fIETSFInfo) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
@@ -42845,6 +44875,9 @@ static tANI_U32 PackCore(tpAniSirGlobal pCtx,
                     case SigIeWiderBWChanSwitchAnn:
                         status |= dot11fPackIeWiderBWChanSwitchAnn(pCtx, ( tDot11fIEWiderBWChanSwitchAnn* )(pSrc + pIe->offset + sizeof(tDot11fIEWiderBWChanSwitchAnn) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
+                    case SigIevht_transmit_power_env:
+                        status |= dot11fPackIevht_transmit_power_env(pCtx, ( tDot11fIEvht_transmit_power_env* )(pSrc + pIe->offset + sizeof(tDot11fIEvht_transmit_power_env) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
                     case SigIeAID:
                         status |= dot11fPackIeAID(pCtx, ( tDot11fIEAID* )(pSrc + pIe->offset + sizeof(tDot11fIEAID) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
@@ -43145,6 +45178,36 @@ static tANI_U32 PackCore(tpAniSirGlobal pCtx,
                     case SigIeext_chan_switch_ann:
                         status |= dot11fPackIeext_chan_switch_ann(pCtx, ( tDot11fIEext_chan_switch_ann* )(pSrc + pIe->offset + sizeof(tDot11fIEext_chan_switch_ann) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
+                    case SigIefils_assoc_delay_info:
+                        status |= dot11fPackIefils_assoc_delay_info(pCtx, ( tDot11fIEfils_assoc_delay_info* )(pSrc + pIe->offset + sizeof(tDot11fIEfils_assoc_delay_info) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
+                    case SigIefils_hlp_container:
+                        status |= dot11fPackIefils_hlp_container(pCtx, ( tDot11fIEfils_hlp_container* )(pSrc + pIe->offset + sizeof(tDot11fIEfils_hlp_container) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
+                    case SigIefils_indication:
+                        status |= dot11fPackIefils_indication(pCtx, ( tDot11fIEfils_indication* )(pSrc + pIe->offset + sizeof(tDot11fIEfils_indication) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
+                    case SigIefils_kde:
+                        status |= dot11fPackIefils_kde(pCtx, ( tDot11fIEfils_kde* )(pSrc + pIe->offset + sizeof(tDot11fIEfils_kde) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
+                    case SigIefils_key_confirmation:
+                        status |= dot11fPackIefils_key_confirmation(pCtx, ( tDot11fIEfils_key_confirmation* )(pSrc + pIe->offset + sizeof(tDot11fIEfils_key_confirmation) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
+                    case SigIefils_nonce:
+                        status |= dot11fPackIefils_nonce(pCtx, ( tDot11fIEfils_nonce* )(pSrc + pIe->offset + sizeof(tDot11fIEfils_nonce) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
+                    case SigIefils_public_key:
+                        status |= dot11fPackIefils_public_key(pCtx, ( tDot11fIEfils_public_key* )(pSrc + pIe->offset + sizeof(tDot11fIEfils_public_key) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
+                    case SigIefils_session:
+                        status |= dot11fPackIefils_session(pCtx, ( tDot11fIEfils_session* )(pSrc + pIe->offset + sizeof(tDot11fIEfils_session) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
+                    case SigIefils_wrapped_data:
+                        status |= dot11fPackIefils_wrapped_data(pCtx, ( tDot11fIEfils_wrapped_data* )(pSrc + pIe->offset + sizeof(tDot11fIEfils_wrapped_data) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
+                    case SigIehs20vendor_ie:
+                        status |= dot11fPackIehs20vendor_ie(pCtx, ( tDot11fIEhs20vendor_ie* )(pSrc + pIe->offset + sizeof(tDot11fIEhs20vendor_ie) * i ),  pBufRemaining, nBufRemaining, &len);
+                        break;
                     case SigIesec_chan_offset_ele:
                         status |= dot11fPackIesec_chan_offset_ele(pCtx, ( tDot11fIEsec_chan_offset_ele* )(pSrc + pIe->offset + sizeof(tDot11fIEsec_chan_offset_ele) * i ),  pBufRemaining, nBufRemaining, &len);
                         break;
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/logDump.c b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/logDump.c
index 2d404f48880..62f2a132b7e 100644
--- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/logDump.c
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/logDump.c
@@ -92,14 +92,15 @@ logDump.c
 
 static int debug;
 
-    void
+int
 logPrintf(tpAniSirGlobal pMac, tANI_U32 cmd, tANI_U32 arg1, tANI_U32 arg2, tANI_U32 arg3, tANI_U32 arg4)
 {
     static tANI_U8 buf[MAX_LOGDUMP_SIZE + MAX_OVERFLOW_MSG];
-    tANI_U16 bufLen;
+
     pMac->gCurrentLogSize = 0;
 
-    bufLen = (tANI_U16)logRtaiDump(pMac, cmd, arg1, arg2, arg3, arg4, buf);
+    return logRtaiDump(pMac, cmd, arg1, arg2, arg3, arg4, buf);
+
 }
 
 /**
@@ -298,17 +299,17 @@ char * dump_cfg_group_get( tpAniSirGlobal pMac, tANI_U32 arg1, tANI_U32 arg2, tA
 
     (void) arg3; (void) arg4;
 
-    if (arg1 < CFG_PARAM_MAX_NUM) {
+    if (arg1 < WNI_CFG_MAX) {
         startId = arg1;
     } else {
-        p += log_sprintf( pMac, p, "Start CFGID must be less than %d\n", CFG_PARAM_MAX_NUM);
+        p += log_sprintf( pMac, p, "Start CFGID must be less than %d\n", WNI_CFG_MAX);
         return p;
     }
 
-    if ((arg2 == 0) || (arg2 > CFG_PARAM_MAX_NUM))
+    if ((arg2 == 0) || (arg2 > WNI_CFG_MAX))
         arg2 = 30;
 
-    endId = ((startId + arg2) < CFG_PARAM_MAX_NUM) ? (startId + arg2) : CFG_PARAM_MAX_NUM;
+    endId = ((startId + arg2) < WNI_CFG_MAX) ? (startId + arg2) : WNI_CFG_MAX;
 
     for (i=startId; i < endId; i++)
         Log_getCfg(pMac, (tANI_U16) i);
@@ -436,12 +437,14 @@ int logRtaiDump( tpAniSirGlobal pMac, tANI_U32 cmd, tANI_U32 arg1, tANI_U32 arg2
                        pEntry->func(pMac, arg1, arg2, arg3, arg4, p);
                    } else {
                        p += log_sprintf( pMac,p, "Cmd not supported\n");
+                       return -1;
                    }
                    break;
                }
            }
        } else {
            p += log_sprintf( pMac,p, "Cmd not found \n");
+           return -1;
        }
     }
     if (debug)
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/macTrace.c b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/macTrace.c
index abe5cf27ecf..213c3da7ac6 100644
--- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/macTrace.c
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/macTrace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -355,7 +355,6 @@ tANI_U8* macTraceGetSmeMsgString(tANI_U16 smeMsg)
 	CASE_RETURN_STRING(eWNI_SME_SWITCH_CHL_RSP);
 	CASE_RETURN_STRING(eWNI_SME_STOP_BSS_REQ);
 	CASE_RETURN_STRING(eWNI_SME_STOP_BSS_RSP);
-	CASE_RETURN_STRING(eWNI_SME_DEL_BA_PEER_IND);
 	CASE_RETURN_STRING(eWNI_SME_DEFINE_QOS_REQ);
 	CASE_RETURN_STRING(eWNI_SME_DEFINE_QOS_RSP);
 	CASE_RETURN_STRING(eWNI_SME_DELETE_QOS_REQ);
@@ -504,6 +503,7 @@ tANI_U8* macTraceGetSmeMsgString(tANI_U16 smeMsg)
 	CASE_RETURN_STRING(eWNI_SME_TX_PER_HIT_IND);
 	CASE_RETURN_STRING(eWNI_SME_CHANGE_COUNTRY_CODE);
 	CASE_RETURN_STRING(eWNI_SME_GENERIC_CHANGE_COUNTRY_CODE);
+	CASE_RETURN_STRING(eWNI_SME_CC_CHANGE_IND);
 	CASE_RETURN_STRING(eWNI_SME_PRE_SWITCH_CHL_IND);
 	CASE_RETURN_STRING(eWNI_SME_POST_SWITCH_CHL_IND);
 	CASE_RETURN_STRING(eWNI_SME_MAX_ASSOC_EXCEEDED);
@@ -565,18 +565,22 @@ tANI_U8* macTraceGetSmeMsgString(tANI_U16 smeMsg)
 	CASE_RETURN_STRING(eWNI_SME_EPNO_NETWORK_FOUND_IND);
 #endif
 	CASE_RETURN_STRING(eWNI_SME_SET_THERMAL_LEVEL_IND);
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+	CASE_RETURN_STRING(eWNI_SME_THERMAL_TEMPERATURE_IND);
+#endif
 	CASE_RETURN_STRING(eWNI_SME_OCB_SET_CONFIG_RSP);
 	CASE_RETURN_STRING(eWNI_SME_OCB_GET_TSF_TIMER_RSP);
 	CASE_RETURN_STRING(eWNI_SME_DCC_GET_STATS_RSP);
 	CASE_RETURN_STRING(eWNI_SME_DCC_UPDATE_NDL_RSP);
 	CASE_RETURN_STRING(eWNI_SME_DCC_STATS_EVENT);
+	CASE_RETURN_STRING(eWNI_SME_RADIO_CHAN_STATS_IND);
 	CASE_RETURN_STRING(eWNI_SME_TSF_EVENT);
-	CASE_RETURN_STRING(eWNI_SME_FW_DUMP_IND);
 	CASE_RETURN_STRING(eWNI_SME_PDEV_SET_HT_VHT_IE);
 	CASE_RETURN_STRING(eWNI_SME_EXT_CHANGE_CHANNEL);
 	CASE_RETURN_STRING(eWNI_SME_EXT_CHANGE_CHANNEL_IND);
 	CASE_RETURN_STRING(eWNI_SME_LOST_LINK_INFO_IND);
-	CASE_RETURN_STRING(eWNI_SME_GET_RSSI_IND);
+	CASE_RETURN_STRING(eWNI_SME_GET_PEER_INFO_IND);
+	CASE_RETURN_STRING(eWNI_SME_GET_PEER_INFO_EXT_IND);
 	CASE_RETURN_STRING(eWNI_SME_ROAM_SCAN_OFFLOAD_REQ);
 	CASE_RETURN_STRING(eWNI_SME_SMPS_FORCE_MODE_IND);
 	CASE_RETURN_STRING(eWNI_SME_REGISTER_MGMT_FRAME_CB);
@@ -603,7 +607,6 @@ tANI_U8* macTraceGetWdaMsgString(tANI_U16 wdaMsg)
 	CASE_RETURN_STRING(WDA_HDD_ADDBA_REQ);
 	CASE_RETURN_STRING(WDA_HDD_ADDBA_RSP);
 	CASE_RETURN_STRING(WDA_DELETEBA_IND);
-	CASE_RETURN_STRING(WDA_BA_FAIL_IND);
 	CASE_RETURN_STRING(WDA_TL_FLUSH_AC_REQ);
 	CASE_RETURN_STRING(WDA_TL_FLUSH_AC_RSP);
 
@@ -692,10 +695,6 @@ tANI_U8* macTraceGetWdaMsgString(tANI_U16 wdaMsg)
 	CASE_RETURN_STRING(WDA_SOFTMAC_BULKREGREAD_RESPONSE);
 	CASE_RETURN_STRING(WDA_SOFTMAC_HOSTMESG_MSGPROCESSRESULT);
 
-	CASE_RETURN_STRING(WDA_ADDBA_REQ);
-	CASE_RETURN_STRING(WDA_ADDBA_RSP);
-	CASE_RETURN_STRING(WDA_DELBA_IND);
-	CASE_RETURN_STRING(WDA_DEL_BA_IND);
 	CASE_RETURN_STRING(WDA_MIC_FAILURE_IND);
 
 	CASE_RETURN_STRING(WDA_DELBA_REQ);
@@ -854,7 +853,7 @@ tANI_U8* macTraceGetWdaMsgString(tANI_U16 wdaMsg)
 	CASE_RETURN_STRING(WDA_UPDATE_CHAN_LIST_REQ);
 	CASE_RETURN_STRING(WDA_UPDATE_CHAN_LIST_RSP);
 	CASE_RETURN_STRING(WDA_RX_SCAN_EVENT);
-        CASE_RETURN_STRING(WDA_RX_CHN_STATUS_EVENT);
+	CASE_RETURN_STRING(WDA_RX_CHN_STATUS_EVENT);
 	CASE_RETURN_STRING(WDA_IBSS_PEER_INACTIVITY_IND);
 	CASE_RETURN_STRING(WDA_CLI_SET_CMD);
 	CASE_RETURN_STRING(WDA_CLI_GET_CMD);
@@ -952,7 +951,6 @@ tANI_U8* macTraceGetWdaMsgString(tANI_U16 wdaMsg)
 	CASE_RETURN_STRING(WDA_EXTSCAN_STOP_REQ);
 	CASE_RETURN_STRING(WDA_EXTSCAN_SET_BSSID_HOTLIST_REQ);
 	CASE_RETURN_STRING(WDA_EXTSCAN_RESET_BSSID_HOTLIST_REQ);
-	CASE_RETURN_STRING(WDA_EXTSCAN_SET_SSID_HOTLIST_REQ);
 	CASE_RETURN_STRING(WDA_EXTSCAN_SET_SIGNF_CHANGE_REQ);
 	CASE_RETURN_STRING(WDA_EXTSCAN_RESET_SIGNF_CHANGE_REQ);
 	CASE_RETURN_STRING(WDA_EXTSCAN_GET_CACHED_RESULTS_REQ);
@@ -990,7 +988,6 @@ tANI_U8* macTraceGetWdaMsgString(tANI_U16 wdaMsg)
 	CASE_RETURN_STRING(SIR_HAL_SET_MIRACAST);
 	CASE_RETURN_STRING(SIR_HAL_CONFIG_STATS_FACTOR);
 	CASE_RETURN_STRING(SIR_HAL_CONFIG_GUARD_TIME);
-	CASE_RETURN_STRING(WDA_FW_MEM_DUMP_REQ);
 	CASE_RETURN_STRING(SIR_HAL_START_STOP_LOGGING);
 	CASE_RETURN_STRING(WDA_TSF_GPIO_PIN);
 	CASE_RETURN_STRING(SIR_HAL_FLUSH_LOG_TO_FW);
@@ -999,6 +996,9 @@ tANI_U8* macTraceGetWdaMsgString(tANI_U16 wdaMsg)
 	CASE_RETURN_STRING(WDA_MIB_STATS_REQ);
 	CASE_RETURN_STRING(WDA_SET_MIB_STATS_ENABLE);
 	CASE_RETURN_STRING(WDA_SET_MIB_STATS_DISABLE);
+	CASE_RETURN_STRING(SIR_HAL_POWER_DEBUG_STATS_REQ);
+	CASE_RETURN_STRING(WDA_ACTION_FRAME_RANDOM_MAC);
+	CASE_RETURN_STRING(SIR_HAL_GET_ISOLATION);
 	default:
 		return((tANI_U8*) "UNKNOWN");
 		break;
@@ -1018,10 +1018,7 @@ tANI_U8* macTraceGetLimMsgString(tANI_U16 limMsg)
 	CASE_RETURN_STRING(SIR_LIM_SCH_CLEAN_MSG  );
 	CASE_RETURN_STRING(SIR_LIM_RADAR_DETECT_IND);
 	CASE_RETURN_STRING(SIR_LIM_DEL_TS_IND);
-	CASE_RETURN_STRING(SIR_LIM_ADD_BA_IND );
-	CASE_RETURN_STRING(SIR_LIM_DEL_BA_ALL_IND);
 	CASE_RETURN_STRING(SIR_LIM_DELETE_STA_CONTEXT_IND);
-	CASE_RETURN_STRING(SIR_LIM_DEL_BA_IND );
 	CASE_RETURN_STRING(SIR_LIM_UPDATE_BEACON);
 	CASE_RETURN_STRING(SIR_LIM_MIN_CHANNEL_TIMEOUT);
 	CASE_RETURN_STRING(SIR_LIM_MAX_CHANNEL_TIMEOUT);
@@ -1084,11 +1081,6 @@ tANI_U8* macTraceGetLimMsgString(tANI_U16 limMsg)
 	CASE_RETURN_STRING(LIM_MLM_SETKEYS_REQ);
 	CASE_RETURN_STRING(LIM_MLM_SETKEYS_CNF);
 	CASE_RETURN_STRING(LIM_MLM_PURGE_STA_IND);
-	CASE_RETURN_STRING(LIM_MLM_ADDBA_REQ);
-	CASE_RETURN_STRING(LIM_MLM_ADDBA_CNF);
-	CASE_RETURN_STRING(LIM_MLM_ADDBA_RSP);
-	CASE_RETURN_STRING(LIM_MLM_DELBA_REQ);
-	CASE_RETURN_STRING(LIM_MLM_DELBA_CNF);
 	CASE_RETURN_STRING(LIM_MLM_REMOVEKEY_REQ);
 	CASE_RETURN_STRING(LIM_MLM_REMOVEKEY_CNF);
 #ifdef FEATURE_OEM_DATA_SUPPORT
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parsemactrace.cmm b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parsemactrace.cmm
new file mode 100644
index 00000000000..7aafaa1780d
--- /dev/null
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parsemactrace.cmm
@@ -0,0 +1,973 @@
+;Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+
+;Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+
+;Permission to use, copy, modify, and/or distribute this software for
+;any purpose with or without fee is hereby granted, provided that the
+;above copyright notice and this permission notice appear in all
+;copies.
+
+;THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+;WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+;WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+;AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+;DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+;PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+;TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+;PERFORMANCE OF THIS SOFTWARE.
+
+;This file was originally distributed by Qualcomm Atheros, Inc.
+;under proprietary terms before Copyright ownership was assigned
+;to the Linux Foundation.
+
+;parsemactrace.cmm - This script parses MAC trace table in UMAC layer
+;This script relies on message id's placed in interface header file.
+;If some message ID's are changed later, since they do not use enum, this script
+;might show incorrect data. So message ID's should always be in sync
+;Author:
+;Date:          09/09/2013
+;History:-
+;Date           Modified by    Modification Information
+;--------------------------------------------------------------------
+
+
+ENTRY &FILE
+
+IF "&FILE"==""
+(
+DIALOG.file *.txt
+ENTRY &FILE
+)
+
+OPEN #1 "&FILE" /Create /Write /Append
+
+
+Var.NEW  char [256][50] \halmsgtype
+
+Var.SET \halmsgtype[0x20]="SIR_HAL_RADAR_DETECTED_IND"
+Var.SET \halmsgtype[0x21]="SIR_HAL_WDT_KAM_RSP"
+Var.SET \halmsgtype[0x22]="SIR_HAL_TIMER_TEMP_MEAS_REQ"
+Var.SET \halmsgtype[0x23]="SIR_HAL_TIMER_PERIODIC_STATS_COLLECT_REQ"
+Var.SET \halmsgtype[0x24]="SIR_HAL_CAL_REQ_NTF"
+Var.SET \halmsgtype[0x25]="SIR_HAL_MNT_OPEN_TPC_TEMP_MEAS_REQ"
+Var.SET \halmsgtype[0x26]="SIR_HAL_CCA_MONITOR_INTERVAL_TO"
+Var.SET \halmsgtype[0x27]="SIR_HAL_CCA_MONITOR_DURATION_TO"
+Var.SET \halmsgtype[0x28]="SIR_HAL_CCA_MONITOR_START"
+Var.SET \halmsgtype[0x29]="SIR_HAL_CCA_MONITOR_STOP"
+Var.SET \halmsgtype[0x2A]="SIR_HAL_CCA_CHANGE_MODE"
+Var.SET \halmsgtype[0x2B]="SIR_HAL_TIMER_WRAP_AROUND_STATS_COLLECT_REQ"
+Var.SET \halmsgtype[0x2D]="SIR_HAL_ADD_STA_REQ"
+Var.SET \halmsgtype[0x2E]="SIR_HAL_ADD_STA_RSP"
+Var.SET \halmsgtype[0x2F]="SIR_HAL_DELETE_STA_REQ"
+Var.SET \halmsgtype[0x30]="SIR_HAL_DELETE_STA_RSP"
+Var.SET \halmsgtype[0x31]="SIR_HAL_ADD_BSS_REQ"
+Var.SET \halmsgtype[0x32]="SIR_HAL_ADD_BSS_RSP"
+Var.SET \halmsgtype[0x33]="SIR_HAL_DELETE_BSS_REQ"
+Var.SET \halmsgtype[0x34]="SIR_HAL_DELETE_BSS_RSP"
+Var.SET \halmsgtype[0x35]="SIR_HAL_INIT_SCAN_REQ"
+Var.SET \halmsgtype[0x36]="SIR_HAL_INIT_SCAN_RSP"
+Var.SET \halmsgtype[0x37]="SIR_HAL_START_SCAN_REQ"
+Var.SET \halmsgtype[0x38]="SIR_HAL_START_SCAN_RSP"
+Var.SET \halmsgtype[0x39]="SIR_HAL_END_SCAN_REQ"
+Var.SET \halmsgtype[0x3A]="SIR_HAL_END_SCAN_RSP"
+Var.SET \halmsgtype[0x3B]="SIR_HAL_FINISH_SCAN_REQ"
+Var.SET \halmsgtype[0x3C]="SIR_HAL_FINISH_SCAN_RSP"
+Var.SET \halmsgtype[0x3D]="SIR_HAL_SEND_BEACON_REQ"
+Var.SET \halmsgtype[0x3E]="SIR_HAL_SEND_BEACON_RSP"
+Var.SET \halmsgtype[0x3F]="SIR_HAL_INIT_CFG_REQ"
+Var.SET \halmsgtype[0x40]="SIR_HAL_INIT_CFG_RSP"
+Var.SET \halmsgtype[0x41]="SIR_HAL_INIT_WM_CFG_REQ"
+Var.SET \halmsgtype[0x42]="SIR_HAL_INIT_WM_CFG_RSP"
+Var.SET \halmsgtype[0x43]="SIR_HAL_SET_BSSKEY_REQ"
+Var.SET \halmsgtype[0x44]="SIR_HAL_SET_BSSKEY_RSP"
+Var.SET \halmsgtype[0x45]="SIR_HAL_SET_STAKEY_REQ"
+Var.SET \halmsgtype[0x46]="SIR_HAL_SET_STAKEY_RSP"
+Var.SET \halmsgtype[0x47]="SIR_HAL_DPU_STATS_REQ"
+Var.SET \halmsgtype[0x48]="SIR_HAL_DPU_STATS_RSP"
+Var.SET \halmsgtype[0x49]="SIR_HAL_GET_DPUINFO_REQ"
+Var.SET \halmsgtype[0x4A]="SIR_HAL_GET_DPUINFO_RSP"
+Var.SET \halmsgtype[0x4B]="SIR_HAL_UPDATE_EDCA_PROFILE_IND"
+Var.SET \halmsgtype[0x4D]="SIR_HAL_UPDATE_STARATEINFO_REQ"
+Var.SET \halmsgtype[0x4E]="SIR_HAL_UPDATE_STARATEINFO_RSP"
+Var.SET \halmsgtype[0x4F]="SIR_HAL_UPDATE_BEACON_IND"
+Var.SET \halmsgtype[0x50]="SIR_HAL_UPDATE_CF_IND"
+Var.SET \halmsgtype[0x51]="SIR_HAL_CHNL_SWITCH_REQ"
+Var.SET \halmsgtype[0x52]="SIR_HAL_ADD_TS_REQ"
+Var.SET \halmsgtype[0x53]="SIR_HAL_DEL_TS_REQ"
+Var.SET \halmsgtype[0x54]="SIR_HAL_SOFTMAC_TXSTAT_REPORT"
+Var.SET \halmsgtype[0x5D]="SIR_HAL_MBOX_SENDMSG_COMPLETE_IND"
+Var.SET \halmsgtype[0x55]="SIR_HAL_EXIT_BMPS_REQ"
+Var.SET \halmsgtype[0x56]="SIR_HAL_EXIT_BMPS_RSP"
+Var.SET \halmsgtype[0x57]="SIR_HAL_EXIT_BMPS_IND"
+Var.SET \halmsgtype[0x58]="SIR_HAL_ENTER_BMPS_REQ"
+Var.SET \halmsgtype[0x59]="SIR_HAL_ENTER_BMPS_RSP"
+Var.SET \halmsgtype[0x5A]="SIR_HAL_BMPS_STATUS_IND"
+Var.SET \halmsgtype[0x5B]="SIR_HAL_MISSED_BEACON_IND"
+Var.SET \halmsgtype[0x5C]="SIR_HAL_SWITCH_CHANNEL_RSP"
+Var.SET \halmsgtype[0x5E]="SIR_HAL_PWR_SAVE_CFG"
+Var.SET \halmsgtype[0x5F]="SIR_HAL_REGISTER_PE_CALLBACK"
+Var.SET \halmsgtype[0x60]="SIR_HAL_SOFTMAC_MEM_READREQUEST"
+Var.SET \halmsgtype[0x61]="SIR_HAL_SOFTMAC_MEM_WRITEREQUEST"
+Var.SET \halmsgtype[0x62]="SIR_HAL_SOFTMAC_MEM_READRESPONSE"
+Var.SET \halmsgtype[0x63]="SIR_HAL_SOFTMAC_BULKREGWRITE_CONFIRM"
+Var.SET \halmsgtype[0x64]="SIR_HAL_SOFTMAC_BULKREGREAD_RESPONSE"
+Var.SET \halmsgtype[0x65]="SIR_HAL_SOFTMAC_HOSTMESG_MSGPROCESSRESULT"
+Var.SET \halmsgtype[0x66]="SIR_HAL_ADDBA_REQ"
+Var.SET \halmsgtype[0x67]="SIR_HAL_ADDBA_RSP"
+Var.SET \halmsgtype[0x68]="SIR_HAL_DELBA_IND"
+Var.SET \halmsgtype[0x69]="SIR_HAL_DEL_BA_IND"
+Var.SET \halmsgtype[0x6A]="SIR_HAL_DELBA_REQ"
+Var.SET \halmsgtype[0x6B]="SIR_HAL_IBSS_STA_ADD"
+Var.SET \halmsgtype[0x6C]="SIR_HAL_TIMER_ADJUST_ADAPTIVE_THRESHOLD_IND"
+Var.SET \halmsgtype[0x6D]="SIR_HAL_SET_LINK_STATE"
+Var.SET \halmsgtype[0x6E]="SIR_HAL_ENTER_IMPS_REQ"
+Var.SET \halmsgtype[0x6F]="SIR_HAL_ENTER_IMPS_RSP"
+Var.SET \halmsgtype[0x70]="SIR_HAL_EXIT_IMPS_RSP"
+Var.SET \halmsgtype[0x71]="SIR_HAL_EXIT_IMPS_REQ"
+Var.SET \halmsgtype[0x72]="SIR_HAL_SOFTMAC_HOSTMESG_PS_STATUS_IND"
+Var.SET \halmsgtype[0x73]="SIR_HAL_POSTPONE_ENTER_IMPS_RSP"
+Var.SET \halmsgtype[0x74]="SIR_HAL_STA_STAT_REQ"
+Var.SET \halmsgtype[0x75]="SIR_HAL_GLOBAL_STAT_REQ"
+Var.SET \halmsgtype[0x76]="SIR_HAL_AGGR_STAT_REQ"
+Var.SET \halmsgtype[0x77]="SIR_HAL_STA_STAT_RSP"
+Var.SET \halmsgtype[0x78]="SIR_HAL_GLOBAL_STAT_RSP"
+Var.SET \halmsgtype[0x79]="SIR_HAL_AGGR_STAT_RSP"
+Var.SET \halmsgtype[0x7A]="SIR_HAL_STAT_SUMM_REQ"
+Var.SET \halmsgtype[0x7C]="SIR_HAL_STAT_SUMM_RSP"
+Var.SET \halmsgtype[0x7D]="SIR_HAL_REMOVE_BSSKEY_REQ"
+Var.SET \halmsgtype[0x7E]="SIR_HAL_REMOVE_BSSKEY_RSP"
+Var.SET \halmsgtype[0x7F]="SIR_HAL_REMOVE_STAKEY_REQ"
+Var.SET \halmsgtype[0x80]="SIR_HAL_REMOVE_STAKEY_RSP"
+Var.SET \halmsgtype[0x81]="SIR_HAL_SET_STA_BCASTKEY_REQ"
+Var.SET \halmsgtype[0x82]="SIR_HAL_SET_STA_BCASTKEY_RSP"
+Var.SET \halmsgtype[0x83]="SIR_HAL_REMOVE_STA_BCASTKEY_REQ"
+Var.SET \halmsgtype[0x84]="SIR_HAL_REMOVE_STA_BCASTKEY_RSP"
+Var.SET \halmsgtype[0x85]="SIR_HAL_ADD_TS_RSP"
+Var.SET \halmsgtype[0x86]="SIR_HAL_DPU_MIC_ERROR"
+Var.SET \halmsgtype[0x87]="SIR_HAL_TIMER_BA_ACTIVITY_REQ"
+Var.SET \halmsgtype[0x88]="SIR_HAL_TIMER_CHIP_MONITOR_TIMEOUT"
+Var.SET \halmsgtype[0x89]="SIR_HAL_TIMER_TRAFFIC_ACTIVITY_REQ"
+Var.SET \halmsgtype[0x8A]="SIR_HAL_TIMER_ADC_RSSI_STATS"
+Var.SET \halmsgtype[0x8B]="SIR_HAL_MIC_FAILURE_IND"
+Var.SET \halmsgtype[0x8C]="SIR_HAL_UPDATE_UAPSD_IND"
+Var.SET \halmsgtype[0x8D]="SIR_HAL_SET_MIMOPS_REQ"
+Var.SET \halmsgtype[0x8E]="SIR_HAL_SET_MIMOPS_RSP"
+Var.SET \halmsgtype[0x8F]="SIR_HAL_SYS_READY_IND"
+Var.SET \halmsgtype[0x90]="SIR_HAL_SET_TX_POWER_REQ"
+Var.SET \halmsgtype[0x91]="SIR_HAL_SET_TX_POWER_RSP"
+Var.SET \halmsgtype[0x92]="SIR_HAL_GET_TX_POWER_REQ"
+Var.SET \halmsgtype[0x93]="SIR_HAL_GET_TX_POWER_RSP"
+Var.SET \halmsgtype[0x94]="SIR_HAL_GET_NOISE_REQ"
+Var.SET \halmsgtype[0x95]="SIR_HAL_GET_NOISE_RSP"
+Var.SET \halmsgtype[0x96]="SIR_HAL_TRANSMISSION_CONTROL_IND"
+Var.SET \halmsgtype[0x97]="SIR_HAL_INIT_RADAR_IND"
+Var.SET \halmsgtype[0x98]="SIR_HAL_BEACON_PRE_IND"
+Var.SET \halmsgtype[0x99]="SIR_HAL_ENTER_UAPSD_REQ"
+Var.SET \halmsgtype[0x9A]="SIR_HAL_ENTER_UAPSD_RSP"
+Var.SET \halmsgtype[0x9B]="SIR_HAL_EXIT_UAPSD_REQ"
+Var.SET \halmsgtype[0x9C]="SIR_HAL_EXIT_UAPSD_RSP"
+Var.SET \halmsgtype[0x9D]="SIR_HAL_LOW_RSSI_IND"
+Var.SET \halmsgtype[0x9E]="SIR_HAL_BEACON_FILTER_IND"
+Var.SET \halmsgtype[0x9F]="SIR_HAL_WOWL_ADD_BCAST_PTRN"
+Var.SET \halmsgtype[0xA0]="SIR_HAL_WOWL_DEL_BCAST_PTRN"
+Var.SET \halmsgtype[0xA1]="SIR_HAL_WOWL_ENTER_REQ"
+Var.SET \halmsgtype[0xA2]="SIR_HAL_WOWL_ENTER_RSP"
+Var.SET \halmsgtype[0xA3]="SIR_HAL_WOWL_EXIT_REQ"
+Var.SET \halmsgtype[0xA4]="SIR_HAL_WOWL_EXIT_RSP"
+Var.SET \halmsgtype[0xA5]="SIR_HAL_TX_COMPLETE_IND"
+Var.SET \halmsgtype[0xA6]="SIR_HAL_TIMER_RA_COLLECT_AND_ADAPT"
+Var.SET \halmsgtype[0xA7]="SIR_HAL_GET_STATISTICS_REQ"
+Var.SET \halmsgtype[0xA8]="SIR_HAL_GET_STATISTICS_RSP"
+Var.SET \halmsgtype[0xA9]="SIR_HAL_SET_KEY_DONE"
+Var.SET \halmsgtype[0xAA]="SIR_HAL_BTC_SET_CFG"
+Var.SET \halmsgtype[0xAB]="SIR_HAL_SIGNAL_BT_EVENT"
+Var.SET \halmsgtype[0xAC]="SIR_HAL_HANDLE_FW_MBOX_RSP"
+Var.SET \halmsgtype[0xAD]="SIR_HAL_UPDATE_PROBE_RSP_TEMPLATE_IND"
+Var.SET \halmsgtype[0xAE]="SIR_LIM_ADDR2_MISS_IND"
+Var.SET \halmsgtype[0xAF]="SIR_HAL_START_OEM_DATA_REQ"
+Var.SET \halmsgtype[0xB0]="SIR_HAL_START_OEM_DATA_RSP"
+Var.SET \halmsgtype[0xB1]="SIR_HAL_FINISH_OEM_DATA_REQ"
+Var.SET \halmsgtype[0xB2]="SIR_HAL_SET_MAX_TX_POWER_REQ"
+Var.SET \halmsgtype[0xB3]="SIR_HAL_SET_MAX_TX_POWER_RSP"
+Var.SET \halmsgtype[0xB4]="SIR_HAL_SEND_MSG_COMPLETE"
+Var.SET \halmsgtype[0xB5]="SIR_HAL_SET_HOST_OFFLOAD"
+Var.SET \halmsgtype[0xB6]="SIR_HAL_ADD_STA_SELF_REQ"
+Var.SET \halmsgtype[0xB7]="SIR_HAL_ADD_STA_SELF_RSP"
+Var.SET \halmsgtype[0xB8]="SIR_HAL_DEL_STA_SELF_REQ"
+Var.SET \halmsgtype[0xB9]="SIR_HAL_DEL_STA_SELF_RSP"
+Var.SET \halmsgtype[0xBA]="SIR_HAL_SIGNAL_BTAMP_EVENT"
+Var.SET \halmsgtype[0xBB]="SIR_HAL_CFG_RXP_FILTER_REQ"
+Var.SET \halmsgtype[0xBC]="SIR_HAL_CFG_RXP_FILTER_RSP"
+Var.SET \halmsgtype[0xBD]="SIR_HAL_AGGR_ADD_TS_REQ"
+Var.SET \halmsgtype[0xBE]="SIR_HAL_AGGR_ADD_TS_RSP"
+Var.SET \halmsgtype[0xBF]="SIR_HAL_AGGR_QOS_REQ"
+Var.SET \halmsgtype[0xC0]="SIR_HAL_AGGR_QOS_RSP"
+Var.SET \halmsgtype[0xC1]="SIR_HAL_SET_P2P_GO_NOA_REQ"
+Var.SET \halmsgtype[0xC2]="SIR_HAL_P2P_NOA_ATTR_IND"
+Var.SET \halmsgtype[0xC3]="SIR_HAL_P2P_NOA_START_IND"
+Var.SET \halmsgtype[0xC5]="SIR_HAL_SET_LINK_STATE_RSP"
+Var.SET \halmsgtype[0xC6]="SIR_HAL_WLAN_SUSPEND_IND"
+Var.SET \halmsgtype[0xC7]="SIR_HAL_WLAN_RESUME_REQ"
+Var.SET \halmsgtype[0xC8]="SIR_HAL_SET_KEEP_ALIVE"
+Var.SET \halmsgtype[0xC9]="SIR_HAL_SET_NS_OFFLOAD"
+Var.SET \halmsgtype[0xCA]="SIR_HAL_SET_PNO_REQ"
+Var.SET \halmsgtype[0xCB]="SIR_HAL_SET_PNO_CHANGED_IND"
+Var.SET \halmsgtype[0xCC]="SIR_HAL_UPDATE_SCAN_PARAMS"
+Var.SET \halmsgtype[0xCD]="SIR_HAL_SET_RSSI_FILTER_REQ"
+Var.SET \halmsgtype[0xCE]="SIR_HAL_SET_TX_PER_TRACKING_REQ"
+Var.SET \halmsgtype[0xCF]="SIR_HAL_8023_MULTICAST_LIST_REQ"
+Var.SET \halmsgtype[0xD0]="SIR_HAL_RECEIVE_FILTER_SET_FILTER_REQ"
+Var.SET \halmsgtype[0xD1]="SIR_HAL_PACKET_COALESCING_FILTER_MATCH_COUNT_REQ"
+Var.SET \halmsgtype[0xD2]="SIR_HAL_PACKET_COALESCING_FILTER_MATCH_COUNT_RSP"
+Var.SET \halmsgtype[0xD3]="SIR_HAL_RECEIVE_FILTER_CLEAR_FILTER_REQ"
+Var.SET \halmsgtype[0xD4]="SIR_HAL_SET_POWER_PARAMS_REQ"
+Var.SET \halmsgtype[0xD5]="SIR_HAL_GTK_OFFLOAD_REQ"
+Var.SET \halmsgtype[0xD6]="SIR_HAL_GTK_OFFLOAD_GETINFO_REQ"
+Var.SET \halmsgtype[0xD7]="SIR_HAL_GTK_OFFLOAD_GETINFO_RSP"
+Var.SET \halmsgtype[0xD8]="SIR_HAL_TSM_STATS_REQ"
+Var.SET \halmsgtype[0xD9]="SIR_HAL_TSM_STATS_RSP"
+Var.SET \halmsgtype[0xDA]="SIR_HAL_WAKE_REASON_IND"
+Var.SET \halmsgtype[0xDB]="SIR_HAL_SET_TM_LEVEL_REQ"
+Var.SET \halmsgtype[0xDC]="SIR_HAL_UPDATE_OP_MODE"
+Var.SET \halmsgtype[0xDD]="SIR_HAL_TDLS_LINK_ESTABLISH"
+Var.SET \halmsgtype[0xDE]="SIR_HAL_TDLS_LINK_TEARDOWN"
+Var.SET \halmsgtype[0xE3]="SIR_HAL_TRAFFIC_STATS_IND"
+Var.SET \halmsgtype[0xE5]="SIR_HAL_START_SCAN_OFFLOAD_REQ"
+Var.SET \halmsgtype[0xE6]="SIR_HAL_START_SCAN_OFFLOAD_RSP"
+Var.SET \halmsgtype[0xE7]="SIR_HAL_UPDATE_CHAN_LIST_REQ"
+Var.SET \halmsgtype[0xE8]="SIR_HAL_UPDATE_CHAN_LIST_RSP"
+Var.SET \halmsgtype[0xE9]="SIR_HAL_STOP_SCAN_OFFLOAD_REQ"
+Var.SET \halmsgtype[0xEA]="SIR_HAL_STOP_SCAN_OFFLOAD_RSP"
+Var.SET \halmsgtype[0xEB]="SIR_HAL_RX_SCAN_EVENT"
+Var.SET \halmsgtype[0xEC]="SIR_HAL_DHCP_START_IND"
+Var.SET \halmsgtype[0xED]="SIR_HAL_DHCP_STOP_IND"
+Var.SET \halmsgtype[0xEE]="SIR_HAL_IBSS_PEER_INACTIVITY_IND"
+Var.SET \halmsgtype[0xEF]="SIR_HAL_LPHB_CONF_IND"
+Var.SET \halmsgtype[0xF0]="SIR_HAL_LPHB_WAIT_EXPIRE_IND"
+Var.SET \halmsgtype[0xF1]="SIR_HAL_ADD_PERIODIC_TX_PTRN_IND"
+Var.SET \halmsgtype[0xF2]="SIR_HAL_DEL_PERIODIC_TX_PTRN_IND"
+Var.SET \halmsgtype[0xF3]="SIR_HAL_RMC_BECOME_LEADER"
+Var.SET \halmsgtype[0xF4]="SIR_HAL_RMC_LEADER_SELECT_RESP"
+Var.SET \halmsgtype[0xF5]="SIR_HAL_RMC_LEADER_REQ"
+Var.SET \halmsgtype[0xF6]="SIR_HAL_RMC_UPDATE_IND"
+Var.SET \halmsgtype[0xF7]="SIR_HAL_IBSS_PEER_INFO_REQ"
+Var.SET \halmsgtype[0xF8]="SIR_HAL_IBSS_PEER_INFO_RSP"
+Var.SET \halmsgtype[0xF9]="SIR_HAL_RATE_UPDATE_IND"
+Var.SET \halmsgtype[0xFA]="SIR_HAL_IBSS_ROUTE_TABLE_UPDATE_IND"
+Var.SET \halmsgtype[0xFB]="SIR_HAL_TX_FAIL_MONITOR_IND"
+Var.SET \halmsgtype[0xFC]="SIR_HAL_IBSS_PEER_INFO_RSP"
+Var.SET \halmsgtype[0xFD]="SIR_HAL_RATE_UPDATE_IND"
+
+
+Var.NEW  char [256][100] \tlcodetype
+
+Var.SET \tlcodetype[0x00]="TRACE_CODE_TL_STA_STATE"
+Var.SET \tlcodetype[0x01]="TRACE_CODE_TL_EAPOL_PKT_PENDING"
+Var.SET \tlcodetype[0x02]="TRACE_CODE_TL_GET_FRAMES_EAPOL"
+Var.SET \tlcodetype[0x03]="TRACE_CODE_TL_RX_CONN_EAPOL"
+Var.SET \tlcodetype[0x04]="TRACE_CODE_TL_REGISTER_STA_CLIENT"
+Var.SET \tlcodetype[0x05]="TRACE_CODE_TL_SUSPEND_DATA_TX"
+Var.SET \tlcodetype[0x06]="TRACE_CODE_TL_RESUME_DATA_TX"
+Var.SET \tlcodetype[0x07]="TRACE_CODE_TL_STA_PKT_PENDING"
+Var.SET \tlcodetype[0x08]="TRACE_CODE_TL_QUEUE_CURRENT"
+Var.SET \tlcodetype[0x09]="TRACE_CODE_TL_REORDER_TIMER_EXP_CB"
+Var.SET \tlcodetype[0x0A]="TRACE_CODE_TL_BA_SESSION_DEL"
+Var.SET \tlcodetype[0x0B]="TRACE_CODE_TL_ASSOC_FAILED"
+Var.SET \tlcodetype[0x0C]="TRACE_CODE_TL_FORWARD_CACHED_FRAMES"
+Var.SET \tlcodetype[0x0D]="TRACE_CODE_TL_FLUSH_CACHED_FRAMES"
+Var.SET \tlcodetype[0x0E]="TRACE_CODE_TL_CACHE_FRAME"
+
+Var.NEW  char [256][100] \smecodetype
+
+Var.SET \smecodetype[0x00]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_REQ"
+Var.SET \smecodetype[0x01]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_GET_RESULTS"
+Var.SET \smecodetype[0x02]="TRACE_CODE_SME_RX_HDD_MSG_CONNECT"
+Var.SET \smecodetype[0x03]="TRACE_CODE_SME_RX_HDD_MSG_SET_11DINFO"
+Var.SET \smecodetype[0x04]="TRACE_CODE_SME_RX_HDD_MSG_GET_SOFTAP_DOMAIN"
+Var.SET \smecodetype[0x05]="TRACE_CODE_SME_RX_HDD_MSG_SET_REGINFO"
+Var.SET \smecodetype[0x06]="TRACE_CODE_SME_RX_HDD_MSG_UPDATE_CHANNEL_CONFIG"
+Var.SET \smecodetype[0x07]="TRACE_CODE_SME_RX_HDD_MSG_UPDATE_CONFIG"
+Var.SET \smecodetype[0x08]="TRACE_CODE_SME_RX_HDD_MSG_HDDREADYIND"
+Var.SET \smecodetype[0x09]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_FLUSH_RESULTS"
+Var.SET \smecodetype[0x0A]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_FLUSH_P2PRESULTS"
+Var.SET \smecodetype[0x0B]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_RESULT_GETFIRST"
+Var.SET \smecodetype[0x0C]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_RESULT_GETNEXT"
+Var.SET \smecodetype[0x0D]="TRACE_CODE_SME_RX_HDD_MSG_SCAN_RESULT_PURGE"
+Var.SET \smecodetype[0x0E]="TRACE_CODE_SME_RX_HDD_ROAM_REASSOC"
+Var.SET \smecodetype[0x0F]="TRACE_CODE_SME_RX_HDD_ROAM_DISCONNECT"
+Var.SET \smecodetype[0x10]="TRACE_CODE_SME_RX_HDD_ROAM_GET_CONNECTPROFILE"
+Var.SET \smecodetype[0x11]="TRACE_CODE_SME_RX_HDD_ROAM_FREE_CONNECTPROFILE"
+Var.SET \smecodetype[0x12]="TRACE_CODE_SME_RX_HDD_ROAM_SET_PMKIDCACHE"
+Var.SET \smecodetype[0x13]="TRACE_CODE_SME_RX_HDD_GET_CONFIGPARAM"
+Var.SET \smecodetype[0x14]="TRACE_CODE_SME_RX_HDD_GET_MODPROFFIELDS"
+Var.SET \smecodetype[0x15]="TRACE_CODE_SME_RX_HDD_SET_CONFIG_PWRSAVE"
+Var.SET \smecodetype[0x16]="TRACE_CODE_SME_RX_HDD_GET_CONFIG_PWRSAVE"
+Var.SET \smecodetype[0x17]="TRACE_CODE_SME_RX_HDD_ENABLE_PWRSAVE"
+Var.SET \smecodetype[0x18]="TRACE_CODE_SME_RX_HDD_DISABLE_PWRSAVE"
+Var.SET \smecodetype[0x19]="TRACE_CODE_SME_RX_HDD_START_AUTO_BMPSTIMER"
+Var.SET \smecodetype[0x1A]="TRACE_CODE_SME_RX_HDD_STOP_AUTO_BMPSTIMER"
+Var.SET \smecodetype[0x1B]="TRACE_CODE_SME_RX_HDD_IS_PWRSAVE_ENABLED"
+Var.SET \smecodetype[0x1C]="TRACE_CODE_SME_RX_HDD_REQUEST_FULLPOWER"
+Var.SET \smecodetype[0x1D]="TRACE_CODE_SME_RX_HDD_REQUEST_BMPS"
+Var.SET \smecodetype[0x1E]="TRACE_CODE_SME_RX_HDD_SET_DHCP_FLAG"
+Var.SET \smecodetype[0x1F]="TRACE_CODE_SME_RX_HDD_REQUEST_STANDBY"
+Var.SET \smecodetype[0x20]="TRACE_CODE_SME_RX_HDD_WOWL_ADDBCAST_PATTERN"
+Var.SET \smecodetype[0x21]="TRACE_CODE_SME_RX_HDD_WOWL_DELBCAST_PATTERN"
+Var.SET \smecodetype[0x22]="TRACE_CODE_SME_RX_HDD_ENTER_WOWL"
+Var.SET \smecodetype[0x23]="TRACE_CODE_SME_RX_HDD_EXIT_WOWL"
+Var.SET \smecodetype[0x24]="TRACE_CODE_SME_RX_HDD_SET_KEY"
+Var.SET \smecodetype[0x25]="TRACE_CODE_SME_RX_HDD_REMOVE_KEY"
+Var.SET \smecodetype[0x26]="TRACE_CODE_SME_RX_HDD_GET_STATS"
+Var.SET \smecodetype[0x27]="TRACE_CODE_SME_RX_HDD_GET_CNTRYCODE"
+Var.SET \smecodetype[0x28]="TRACE_CODE_SME_RX_HDD_SET_CNTRYCODE"
+Var.SET \smecodetype[0x29]="TRACE_CODE_SME_RX_HDD_CHANGE_CNTRYCODE"
+Var.SET \smecodetype[0x2A]="TRACE_CODE_SME_RX_HDD_BTC_SIGNALEVENT"
+Var.SET \smecodetype[0x2B]="TRACE_CODE_SME_RX_HDD_BTC_SETCONFIG"
+Var.SET \smecodetype[0x2C]="TRACE_CODE_SME_RX_HDD_BTC_GETCONFIG"
+Var.SET \smecodetype[0x2D]="TRACE_CODE_SME_RX_HDD_SET_CFGPRIVACY"
+Var.SET \smecodetype[0x2E]="TRACE_CODE_SME_RX_HDD_NEIGHBOR_REPORTREQ"
+Var.SET \smecodetype[0x2F]="TRACE_CODE_SME_RX_HDD_DBG_READREG"
+Var.SET \smecodetype[0x30]="TRACE_CODE_SME_RX_HDD_DBG_WRITEREG"
+Var.SET \smecodetype[0x31]="TRACE_CODE_SME_RX_HDD_DBG_READMEM"
+Var.SET \smecodetype[0x32]="TRACE_CODE_SME_RX_HDD_DBG_WRITEMEM"
+Var.SET \smecodetype[0x33]="TRACE_CODE_SME_RX_HDD_OPEN_SESSION"
+Var.SET \smecodetype[0x34]="TRACE_CODE_SME_RX_HDD_CLOSE_SESSION"
+Var.SET \smecodetype[0x35]="TRACE_CODE_SME_RX_HDD_SET_HOSTOFFLOAD"
+Var.SET \smecodetype[0x36]="TRACE_CODE_SME_RX_HDD_SET_GTKOFFLOAD"
+Var.SET \smecodetype[0x37]="TRACE_CODE_SME_RX_HDD_GET_GTKOFFLOAD"
+Var.SET \smecodetype[0x38]="TRACE_CODE_SME_RX_HDD_SET_POWERPARAMS"
+Var.SET \smecodetype[0x39]="TRACE_CODE_SME_RX_HDD_ABORT_MACSCAN"
+Var.SET \smecodetype[0x3A]="TRACE_CODE_SME_RX_HDD_REGISTER_MGMTFR"
+Var.SET \smecodetype[0x3B]="TRACE_CODE_SME_RX_HDD_DEREGISTER_MGMTFR"
+Var.SET \smecodetype[0x3C]="TRACE_CODE_SME_RX_HDD_REMAIN_ONCHAN"
+Var.SET \smecodetype[0x3D]="TRACE_CODE_SME_RX_HDD_SEND_ACTION"
+Var.SET \smecodetype[0x3E]="TRACE_CODE_SME_RX_HDD_CANCEL_REMAIN_ONCHAN"
+Var.SET \smecodetype[0x3F]="TRACE_CODE_SME_RX_HDD_CONFIG_RXPFIL"
+Var.SET \smecodetype[0x40]="TRACE_CODE_SME_RX_HDD_CONFIG_SUSPENDIND"
+Var.SET \smecodetype[0x41]="TRACE_CODE_SME_RX_HDD_CONFIG_RESUMEREQ"
+Var.SET \smecodetype[0x42]="TRACE_CODE_SME_RX_HDD_SET_MAXTXPOW"
+Var.SET \smecodetype[0x43]="TRACE_CODE_SME_RX_HDD_SET_TXPOW"
+Var.SET \smecodetype[0x44]="TRACE_CODE_SME_RX_HDD_SET_TMLEVEL"
+Var.SET \smecodetype[0x45]="TRACE_CODE_SME_RX_HDD_CAPS_EXCH"
+Var.SET \smecodetype[0x46]="TRACE_CODE_SME_RX_HDD_DISABLE_CAP"
+Var.SET \smecodetype[0x47]="TRACE_CODE_SME_RX_HDD_GET_DEFCCNV"
+Var.SET \smecodetype[0x48]="TRACE_CODE_SME_RX_HDD_GET_CURCC"
+Var.SET \smecodetype[0x49]="TRACE_CODE_SME_RX_HDD_RESET_PW5G"
+Var.SET \smecodetype[0x4A]="TRACE_CODE_SME_RX_HDD_UPDATE_RP5G"
+Var.SET \smecodetype[0x4B]="TRACE_CODE_SME_RX_HDD_SET_ROAMIBAND"
+Var.SET \smecodetype[0x4C]="TRACE_CODE_SME_RX_HDD_GET_ROAMIBAND"
+Var.SET \smecodetype[0x4D]="TRACE_CODE_SME_RX_HDD_UPDATE_RSSIDIFF"
+Var.SET \smecodetype[0x4E]="TRACE_CODE_SME_RX_HDD_UPDATE_IMMRSSIDIFF"
+Var.SET \smecodetype[0x4F]="TRACE_CODE_SME_RX_HDD_UPDATE_FTENABLED"
+Var.SET \smecodetype[0x50]="TRACE_CODE_SME_RX_HDD_UPDATE_WESMODE"
+Var.SET \smecodetype[0x51]="TRACE_CODE_SME_RX_HDD_SET_SCANCTRL"
+;deprecated Var.SET \smecodetype[0x52]="TRACE_CODE_SME_RX_HDD_EXTSCAN_GET_CAPABILITIES"
+Var.SET \smecodetype[0x52]="TRACE_CODE_SME_RX_HDD_EXTSCAN_START"
+Var.SET \smecodetype[0x53]="TRACE_CODE_SME_RX_HDD_EXTSCAN_STOP"
+Var.SET \smecodetype[0x54]="TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_BSS_HOTLIST"
+Var.SET \smecodetype[0x55]="TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_BSS_HOTLIST"
+Var.SET \smecodetype[0x56]="TRACE_CODE_SME_RX_HDD_EXTSCAN_GET_CACHED_RESULTS"
+Var.SET \smecodetype[0x57]="TRACE_CODE_SME_RX_HDD_EXTSCAN_SET_SSID_HOTLIST"
+Var.SET \smecodetype[0x58]="TRACE_CODE_SME_RX_HDD_EXTSCAN_RESET_SSID_HOTLIST"
+Var.SET \smecodetype[0x59]="TRACE_CODE_SME_RX_HDD_MSG_DEAUTH_STA"
+;#ifdef FEATURE_WLAN_TDLS	//assuming this flag is enabled by default
+Var.SET \smecodetype[0x5A]="TRACE_CODE_SME_RX_HDD_TDLS_LINK_ESTABLISH_PARAM"
+Var.SET \smecodetype[0x5B]="TRACE_CODE_SME_RX_HDD_TDLS_CHAN_SWITCH_REQ"
+Var.SET \smecodetype[0x5C]="TRACE_CODE_SME_RX_HDD_TDLS_SEND_MGMT_FRAME"
+Var.SET \smecodetype[0x5D]="TRACE_CODE_SME_RX_HDD_TDLS_CHANGE_PEER_STA"
+Var.SET \smecodetype[0x5E]="TRACE_CODE_SME_RX_HDD_TDLS_ADD_PEER_STA"
+Var.SET \smecodetype[0x5F]="TRACE_CODE_SME_RX_HDD_TDLS_DEL_PEER_STA"
+;#endif
+Var.SET \smecodetype[0x60]="TRACE_CODE_SME_RX_HDD_PREF_NET_LIST"
+;#ifdef FEATURE_WLAN_LPHB	//assuming this flag is enabled by default
+Var.SET \smecodetype[0x61]="TRACE_CODE_SME_RX_HDD_LPHB_CONFIG_REQ"
+;#endif /* FEATURE_WLAN_LPHB */
+Var.SET \smecodetype[0x62]="TRACE_CODE_SME_RX_HDD_ROAM_DEL_PMKIDCACHE"
+;From here hardcoded to 250 in host code
+Var.SET \smecodetype[0xFA]="TRACE_CODE_SME_COMMAND"
+Var.SET \smecodetype[0xFB]="TRACE_CODE_SME_TX_WDA_MSG"
+Var.SET \smecodetype[0xFC]="TRACE_CODE_SME_RX_WDA_MSG"
+
+Var.NEW  char [256][50] \cfgmsgtype
+
+Var.SET \cfgmsgtype[0xB0]="SIR_CFG_PARAM_UPDATE_IND"
+Var.SET \cfgmsgtype[0xB1]="SIR_CFG_DOWNLOAD_COMPLETE_IND"
+
+
+Var.NEW  char [256][50] \limmsgtype
+
+Var.SET \limmsgtype[0xB3]="SIR_LIM_RETRY_INTERRUPT_MSG"
+Var.SET \limmsgtype[0xB4]="SIR_BB_XPORT_MGMT_MSG"
+Var.SET \limmsgtype[0xB7]="SIR_LIM_INV_KEY_INTERRUPT_MSG"
+Var.SET \limmsgtype[0xB8]="SIR_LIM_KEY_ID_INTERRUPT_MSG"
+Var.SET \limmsgtype[0xB9]="SIR_LIM_REPLAY_THRES_INTERRUPT_MSG"
+Var.SET \limmsgtype[0xBA]="SIR_LIM_TD_DUMMY_CALLBACK_MSG"
+Var.SET \limmsgtype[0xBB]="SIR_LIM_SCH_CLEAN_MSG"
+Var.SET \limmsgtype[0xBC]="SIR_LIM_RADAR_DETECT_IND"
+Var.SET \limmsgtype[0xBE]="SIR_LIM_DEL_TS_IND"
+Var.SET \limmsgtype[0xBF]="SIR_LIM_ADD_BA_IND"
+Var.SET \limmsgtype[0xC0]="SIR_LIM_DEL_BA_ALL_IND"
+Var.SET \limmsgtype[0xC1]="SIR_LIM_DELETE_STA_CONTEXT_IND"
+Var.SET \limmsgtype[0xC2]="SIR_LIM_DEL_BA_IND"
+Var.SET \limmsgtype[0xC3]="SIR_LIM_UPDATE_BEACON"
+Var.SET \limmsgtype[0xD0]="SIR_LIM_MIN_CHANNEL_TIMEOUT"
+Var.SET \limmsgtype[0xD1]="SIR_LIM_MAX_CHANNEL_TIMEOUT"
+Var.SET \limmsgtype[0xD2]="SIR_LIM_JOIN_FAIL_TIMEOUT"
+Var.SET \limmsgtype[0xD3]="SIR_LIM_AUTH_FAIL_TIMEOUT"
+Var.SET \limmsgtype[0xD4]="SIR_LIM_AUTH_RSP_TIMEOUT"
+Var.SET \limmsgtype[0xD5]="SIR_LIM_ASSOC_FAIL_TIMEOUT"
+Var.SET \limmsgtype[0xD6]="SIR_LIM_REASSOC_FAIL_TIMEOUT"
+Var.SET \limmsgtype[0xD7]="SIR_LIM_HEART_BEAT_TIMEOUT"
+Var.SET \limmsgtype[0xD9]="SIR_LIM_PREAUTH_CLNUP_TIMEOUT"
+Var.SET \limmsgtype[0xDA]="SIR_LIM_CHANNEL_SCAN_TIMEOUT"
+Var.SET \limmsgtype[0xDB]="SIR_LIM_PROBE_HB_FAILURE_TIMEOUT"
+Var.SET \limmsgtype[0xDC]="SIR_LIM_ADDTS_RSP_TIMEOUT"
+Var.SET \limmsgtype[0xE0]="SIR_LIM_MEASUREMENT_IND_TIMEOUT"
+Var.SET \limmsgtype[0xE1]="SIR_LIM_LEARN_INTERVAL_TIMEOUT"
+Var.SET \limmsgtype[0xE2]="SIR_LIM_LEARN_DURATION_TIMEOUT"
+Var.SET \limmsgtype[0xE3]="SIR_LIM_LINK_TEST_DURATION_TIMEOUT"
+Var.SET \limmsgtype[0xE6]="SIR_LIM_HASH_MISS_THRES_TIMEOUT"
+Var.SET \limmsgtype[0xE7]="SIR_LIM_CNF_WAIT_TIMEOUT"
+Var.SET \limmsgtype[0xE8]="SIR_LIM_KEEPALIVE_TIMEOUT"
+Var.SET \limmsgtype[0xE9]="SIR_LIM_UPDATE_OLBC_CACHEL_TIMEOUT"
+Var.SET \limmsgtype[0xEA]="SIR_LIM_CHANNEL_SWITCH_TIMEOUT"
+Var.SET \limmsgtype[0xEB]="SIR_LIM_QUIET_TIMEOUT"
+Var.SET \limmsgtype[0xEC]="SIR_LIM_QUIET_BSS_TIMEOUT"
+Var.SET \limmsgtype[0xED]="SIR_LIM_WPS_OVERLAP_TIMEOUT"
+Var.SET \limmsgtype[0xEE]="SIR_LIM_FT_PREAUTH_RSP_TIMEOUT"
+Var.SET \limmsgtype[0xEF]="SIR_LIM_REMAIN_CHN_TIMEOUT"
+Var.SET \limmsgtype[0xF0]="SIR_LIM_INSERT_SINGLESHOT_NOA_TIMEOUT"
+Var.SET \limmsgtype[0xF1]="SIR_LIM_WMM_APSD_SP_START_MSG_TYPE"
+Var.SET \limmsgtype[0xF2]="SIR_LIM_WMM_APSD_SP_END_MSG_TYPE"
+Var.SET \limmsgtype[0xF3]="SIR_LIM_BEACON_GEN_IND"
+Var.SET \limmsgtype[0xF4]="SIR_LIM_PERIODIC_PROBE_REQ_TIMEOUT"
+Var.SET \limmsgtype[0xF5]="SIR_LIM_CCX_TSM_TIMEOUT"
+Var.SET \limmsgtype[0xF6]="SIR_LIM_DISASSOC_ACK_TIMEOUT"
+Var.SET \limmsgtype[0xF7]="SIR_LIM_DEAUTH_ACK_TIMEOUT"
+Var.SET \limmsgtype[0xF8]="SIR_LIM_PERIODIC_JOIN_PROBE_REQ_TIMEOUT"
+Var.SET \limmsgtype[0xF9]="SIR_LIM_TDLS_DISCOVERY_RSP_WAIT"
+Var.SET \limmsgtype[0xFA]="SIR_LIM_TDLS_LINK_SETUP_RSP_TIMEOUT"
+Var.SET \limmsgtype[0xFB]="SIR_LIM_TDLS_LINK_SETUP_CNF_TIMEOUT"
+Var.SET \limmsgtype[0xFC]="SIR_LIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE"
+Var.SET \limmsgtype[0xFF]="SIR_LIM_MSG_TYPES_END"
+
+
+Var.NEW  char [256][50] \schmsgtype
+
+Var.SET \schmsgtype[0x0]="SIR_SCH_CHANNEL_SWITCH_REQUEST"
+Var.SET \schmsgtype[0x1]="SIR_SCH_START_SCAN_REQ"
+Var.SET \schmsgtype[0x2]="SIR_SCH_START_SCAN_RSP"
+Var.SET \schmsgtype[0x3]="SIR_SCH_END_SCAN_NTF"
+Var.SET \schmsgtype[0xFF]="SIR_SCH_MSG_TYPES_END"
+
+Var.NEW  char [256][50] \pmmmsgtype
+
+Var.SET \pmmmsgtype[0x0]="SIR_PMM_CHANGE_PM_MODE"
+Var.SET \pmmmsgtype[0x1]="SIR_PMM_CHANGE_IMPS_MODE"
+Var.SET \pmmmsgtype[0xFF]="SIR_PMM_MSG_TYPES_END"
+
+
+Var.NEW  char [256][50] \mntmsgtype
+
+Var.SET \mntmsgtype[0x0]="SIR_MNT_RELEASE_BD"
+Var.SET \mntmsgtype[0xFF]="SIR_MNT_MSG_TYPES_END"
+
+Var.NEW  char [256][50] \dvtmsgtype
+
+Var.SET \dvtmsgtype[0xF]="SIR_DVT_ITC_MSG_TYPES_BEGIN"
+
+Var.NEW  char [0x301][50] \pttmsgtype
+
+Var.SET \pttmsgtype[0x0]="SIR_PTT_MSG_TYPES_BEGIN"
+Var.SET \pttmsgtype[0x300]="SIR_PTT_MSG_TYPES_END"
+
+
+Var.NEW  char [18][50] \code
+
+Var.SET \code[0]="TRACE_CODE_MLM_STATE"
+Var.SET \code[1]="TRACE_CODE_SME_STATE"
+Var.SET \code[2]="TRACE_CODE_TX_MGMT"
+Var.SET \code[3]="TRACE_CODE_RX_MGMT"
+Var.SET \code[4]="TRACE_CODE_RX_MGMT_TSF"
+Var.SET \code[5]="TRACE_CODE_TX_COMPLETE"
+Var.SET \code[6]="TRACE_CODE_TX_SME_MSG"
+Var.SET \code[7]="TRACE_CODE_RX_SME_MSG"
+Var.SET \code[8]="TRACE_CODE_TX_WDA_MSG"
+Var.SET \code[9]="TRACE_CODE_RX_WDA_MSG"
+Var.SET \code[10]="TRACE_CODE_TX_LIM_MSG"
+Var.SET \code[11]="TRACE_CODE_RX_LIM_MSG"
+Var.SET \code[12]="TRACE_CODE_TX_CFG_MSG"
+Var.SET \code[13]="TRACE_CODE_RX_CFG_MSG"
+Var.SET \code[14]="TRACE_CODE_RX_MGMT_DROP"
+Var.SET \code[15]="TRACE_CODE_TIMER_ACTIVATE"
+Var.SET \code[16]="TRACE_CODE_TIMER_DEACTIVATE"
+Var.SET \code[17]="TRACE_CODE_INFO_LOG"
+
+
+Var.NEW  char [13][50] \module
+
+
+Var.SET \module[0]="VOS_MODULE_ID_BAP"
+Var.SET \module[1]="VOS_MODULE_ID_TL"
+Var.SET \module[3]="VOS_MODULE_ID_SAL"
+Var.SET \module[4]="VOS_MODULE_ID_SSC"
+Var.SET \module[2]="VOS_MODULE_ID_WDI"
+Var.SET \module[5]="VOS_MODULE_ID_HDD"
+Var.SET \module[6]="VOS_MODULE_ID_SME"
+Var.SET \module[7]="VOS_MODULE_ID_PE"
+Var.SET \module[8]="VOS_MODULE_ID_WDA"
+Var.SET \module[9]="VOS_MODULE_ID_SYS"
+Var.SET \module[10]="VOS_MODULE_ID_VOSS"
+Var.SET \module[11]="VOS_MODULE_ID_SAP"
+Var.SET \module[12]="VOS_MODULE_ID_HDD_SOFTAP"
+
+Var.NEW char [16][50] \mgmttype
+
+Var.SET \mgmttype[0]="SIR_MAC_MGMT_ASSOC_REQ"
+Var.SET \mgmttype[1]="SIR_MAC_MGMT_ASSOC_RSP"
+Var.SET \mgmttype[2]="SIR_MAC_MGMT_REASSOC_REQ"
+Var.SET \mgmttype[3]="SIR_MAC_MGMT_REASSOC_RSP"
+Var.SET \mgmttype[4]="SIR_MAC_MGMT_PROBE_REQ"
+Var.SET \mgmttype[5]="SIR_MAC_MGMT_PROBE_RSP"
+Var.SET \mgmttype[8]="SIR_MAC_MGMT_BEACON"
+Var.SET \mgmttype[9]="SIR_MAC_MGMT_ATIM"
+Var.SET \mgmttype[10]="SIR_MAC_MGMT_DISASSOC"
+Var.SET \mgmttype[11]="SIR_MAC_MGMT_AUTH"
+Var.SET \mgmttype[12]="SIR_MAC_MGMT_DEAUTH"
+Var.SET \mgmttype[13]="SIR_MAC_MGMT_ACTION"
+Var.SET \mgmttype[15]="SIR_MAC_MGMT_RESERVED15"
+
+Var.NEW char [30][50] \limtimertype
+
+Var.SET \limtimertype[0]="eLIM_MIN_CHANNEL_TIMER"
+Var.SET \limtimertype[1]="eLIM_MAX_CHANNEL_TIMER"
+Var.SET \limtimertype[2]="eLIM_JOIN_FAIL_TIMER"
+Var.SET \limtimertype[3]="eLIM_AUTH_FAIL_TIMER"
+Var.SET \limtimertype[4]="eLIM_AUTH_RESP_TIMER"
+Var.SET \limtimertype[5]="eLIM_ASSOC_FAIL_TIMER"
+Var.SET \limtimertype[6]="eLIM_REASSOC_FAIL_TIMER"
+Var.SET \limtimertype[7]="eLIM_PRE_AUTH_CLEANUP_TIMER"
+Var.SET \limtimertype[8]="eLIM_HEART_BEAT_TIMER"
+Var.SET \limtimertype[9]="eLIM_BACKGROUND_SCAN_TIMER"
+Var.SET \limtimertype[10]="eLIM_KEEPALIVE_TIMER"
+Var.SET \limtimertype[11]="eLIM_CNF_WAIT_TIMER"
+Var.SET \limtimertype[12]="eLIM_AUTH_RSP_TIMER"
+Var.SET \limtimertype[13]="eLIM_UPDATE_OLBC_CACHE_TIMER"
+Var.SET \limtimertype[14]="eLIM_PROBE_AFTER_HB_TIMER"
+Var.SET \limtimertype[15]="eLIM_ADDTS_RSP_TIMER"
+Var.SET \limtimertype[16]="eLIM_CHANNEL_SWITCH_TIMER"
+Var.SET \limtimertype[17]="eLIM_LEARN_DURATION_TIMER"
+Var.SET \limtimertype[18]="eLIM_QUIET_TIMER"
+Var.SET \limtimertype[19]="eLIM_QUIET_BSS_TIMER"
+Var.SET \limtimertype[20]="eLIM_WPS_OVERLAP_TIMER"
+Var.SET \limtimertype[21]="eLIM_FT_PREAUTH_RSP_TIMER"
+Var.SET \limtimertype[22]="eLIM_REMAIN_CHN_TIMER"
+Var.SET \limtimertype[23]="eLIM_PERIODIC_PROBE_REQ_TIMER"
+;#ifdef FEATURE_WLAN_CCX
+;Var.SET \limtimertype[0]="eLIM_TSM_TIMER"
+;#endif
+;#ifdef FEATURE_WLAN_TDLS_INTERNAL
+;Var.SET \limtimertype[0]="eLIM_TDLS_DISCOVERY_RSP_WAIT"
+;Var.SET \limtimertype[0]="eLIM_TDLS_LINK_SETUP_RSP_TIMEOUT"
+;Var.SET \limtimertype[0]="eLIM_TDLS_LINK_SETUP_CNF_TIMEOUT"
+;#endif
+Var.SET \limtimertype[25]="eLIM_DISASSOC_ACK_TIMER"
+Var.SET \limtimertype[26]="eLIM_DEAUTH_ACK_TIMER"
+Var.SET \limtimertype[27]="eLIM_PERIODIC_JOIN_PROBE_REQ_TIMER"
+Var.SET \limtimertype[28]="eLIM_INSERT_SINGLESHOT_NOA_TIMER"
+Var.SET \limtimertype[29]="eLIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE"
+
+
+
+Var.NEW  char [256][100] \hddcodetype
+
+Var.SET \hddcodetype[0x00]="TRACE_CODE_HDD_OPEN_REQUEST"
+Var.SET \hddcodetype[0x01]="TRACE_CODE_HDD_STOP_REQUEST"
+Var.SET \hddcodetype[0x02]="TRACE_CODE_HDD_TX_TIMEOUT"
+Var.SET \hddcodetype[0x03]="TRACE_CODE_HDD_P2P_DEV_ADDR_IOCTL"
+Var.SET \hddcodetype[0x04]="TRACE_CODE_HDD_SETSUSPENDMODE_IOCTL"
+Var.SET \hddcodetype[0x05]="TRACE_CODE_HDD_SETROAMTRIGGER_IOCTL"
+Var.SET \hddcodetype[0x06]="TRACE_CODE_HDD_GETROAMTRIGGER_IOCTL"
+Var.SET \hddcodetype[0x07]="TRACE_CODE_HDD_SETROAMSCANPERIOD_IOCTL"
+Var.SET \hddcodetype[0x08]="TRACE_CODE_HDD_GETROAMSCANPERIOD_IOCTL"
+Var.SET \hddcodetype[0x09]="TRACE_CODE_HDD_SETROAMDELTA_IOCTL"
+Var.SET \hddcodetype[0x0A]="TRACE_CODE_HDD_GETROAMDELTA_IOCTL"
+Var.SET \hddcodetype[0x0B]="TRACE_CODE_HDD_GETBAND_IOCTL"
+Var.SET \hddcodetype[0x0C]="TRACE_CODE_HDD_GETCOUNTRYREV_IOCTL"
+Var.SET \hddcodetype[0x0D]="TRACE_CODE_HDD_SETROAMSCANCHANNELS_IOCTL"
+Var.SET \hddcodetype[0x0E]="TRACE_CODE_HDD_GETROAMSCANCHANNELS_IOCTL"
+Var.SET \hddcodetype[0x0F]="TRACE_CODE_HDD_HOSTAPD_OPEN_REQUEST"
+Var.SET \hddcodetype[0x10]="TRACE_CODE_HDD_HOSTAPD_STOP_REQUEST"
+Var.SET \hddcodetype[0x11]="TRACE_CODE_HDD_HOSTAPD_UNINIT_REQUEST"
+Var.SET \hddcodetype[0x12]="TRACE_CODE_HDD_SOFTAP_TX_TIMEOUT"
+Var.SET \hddcodetype[0x13]="TRACE_CODE_HDD_HOSTAPD_SET_MAC_ADDR"
+Var.SET \hddcodetype[0x14]="TRACE_CODE_HDD_HOSTAPD_P2P_SET_NOA_IOCTL"
+Var.SET \hddcodetype[0x15]="TRACE_CODE_HDD_HOSTAPD_P2P_SET_PS_IOCTL"
+Var.SET \hddcodetype[0x16]="TRACE_CODE_HDD_HOSTAPD_SET_SAP_CHANNEL_LIST_IOCTL"
+Var.SET \hddcodetype[0x17]="TRACE_CODE_HDD_ADD_VIRTUAL_INTF"
+Var.SET \hddcodetype[0x18]="TRACE_CODE_HDD_DEL_VIRTUAL_INTF"
+Var.SET \hddcodetype[0x19]="TRACE_CODE_HDD_CHANGE_VIRTUAL_INTF"
+Var.SET \hddcodetype[0x1A]="TRACE_CODE_HDD_CFG80211_START_AP"
+Var.SET \hddcodetype[0x1B]="TRACE_CODE_HDD_CFG80211_CHANGE_BEACON"
+Var.SET \hddcodetype[0x1C]="TRACE_CODE_HDD_CFG80211_STOP_AP"
+Var.SET \hddcodetype[0x1D]="TRACE_CODE_HDD_CFG80211_CHANGE_BSS"
+Var.SET \hddcodetype[0x1E]="TRACE_CODE_HDD_CFG80211_ADD_KEY"
+Var.SET \hddcodetype[0x1F]="TRACE_CODE_HDD_CFG80211_GET_KEY"
+Var.SET \hddcodetype[0x20]="TRACE_CODE_HDD_CFG80211_SET_DEFAULT_KEY"
+Var.SET \hddcodetype[0x21]="TRACE_CODE_HDD_CFG80211_CONNECT"
+Var.SET \hddcodetype[0x22]="TRACE_CODE_HDD_CFG80211_DISCONNECT"
+Var.SET \hddcodetype[0x23]="TRACE_CODE_HDD_CFG80211_JOIN_IBSS"
+Var.SET \hddcodetype[0x24]="TRACE_CODE_HDD_CFG80211_LEAVE_IBSS"
+Var.SET \hddcodetype[0x25]="TRACE_CODE_HDD_CFG80211_SET_WIPHY_PARAMS"
+Var.SET \hddcodetype[0x26]="TRACE_CODE_HDD_CFG80211_SET_TXPOWER"
+Var.SET \hddcodetype[0x27]="TRACE_CODE_HDD_CFG80211_GET_TXPOWER"
+Var.SET \hddcodetype[0x28]="TRACE_CODE_HDD_CFG80211_SET_CHANNEL"
+Var.SET \hddcodetype[0x29]="TRACE_CODE_HDD_CFG80211_ADD_BEACON"
+Var.SET \hddcodetype[0x2A]="TRACE_CODE_HDD_CFG80211_SET_BEACON"
+Var.SET \hddcodetype[0x2B]="TRACE_CODE_HDD_CFG80211_CHANGE_IFACE"
+Var.SET \hddcodetype[0x2C]="TRACE_CODE_HDD_CHANGE_STATION"
+Var.SET \hddcodetype[0x2D]="TRACE_CODE_HDD_CFG80211_UPDATE_BSS"
+Var.SET \hddcodetype[0x2E]="TRACE_CODE_HDD_CFG80211_SCAN"
+Var.SET \hddcodetype[0x2F]="TRACE_CODE_HDD_REMAIN_ON_CHANNEL"
+Var.SET \hddcodetype[0x30]="TRACE_CODE_HDD_REMAINCHANREADYHANDLER"
+Var.SET \hddcodetype[0x31]="TRACE_CODE_HDD_CFG80211_CANCEL_REMAIN_ON_CHANNEL"
+Var.SET \hddcodetype[0x32]="TRACE_CODE_HDD_ACTION"
+Var.SET \hddcodetype[0x33]="TRACE_CODE_HDD_MGMT_TX_CANCEL_WAIT"
+Var.SET \hddcodetype[0x34]="TRACE_CODE_HDD_CFG80211_GET_STA"
+Var.SET \hddcodetype[0x35]="TRACE_CODE_HDD_CFG80211_SET_POWER_MGMT"
+Var.SET \hddcodetype[0x36]="TRACE_CODE_HDD_CFG80211_DEL_STA"
+Var.SET \hddcodetype[0x37]="TRACE_CODE_HDD_CFG80211_ADD_STA"
+Var.SET \hddcodetype[0x38]="TRACE_CODE_HDD_CFG80211_SET_PMKSA"
+Var.SET \hddcodetype[0x39]="TRACE_CODE_HDD_CFG80211_UPDATE_FT_IES"
+Var.SET \hddcodetype[0x3A]="TRACE_CODE_HDD_CFG80211_TDLS_MGMT"
+Var.SET \hddcodetype[0x3B]="TRACE_CODE_HDD_CFG80211_TDLS_OPER"
+Var.SET \hddcodetype[0x3C]="TRACE_CODE_HDD_CFG80211_SET_REKEY_DATA"
+Var.SET \hddcodetype[0x3D]="TRACE_CODE_HDD_UNSUPPORTED_IOCTL"
+Var.SET \hddcodetype[0x3E]="TRACE_CODE_HDD_SETROAMSCANCHANNELMINTIME_IOCTL"
+Var.SET \hddcodetype[0x3F]="TRACE_CODE_HDD_GETROAMSCANCHANNELMINTIME_IOCTL"
+Var.SET \hddcodetype[0x40]="TRACE_CODE_HDD_STOP_NETDEV"
+Var.SET \hddcodetype[0x41]="TRACE_CODE_HDD_WAKE_NETDEV"
+Var.SET \hddcodetype[0x42]="TRACE_CODE_HDD_FLUSH_TX_QUEUES"
+Var.SET \hddcodetype[0x43]="TRACE_CODE_HDD_CFG80211_RESUME_WLAN"
+Var.SET \hddcodetype[0x44]="TRACE_CODE_HDD_CFG80211_SUSPEND_WLAN"
+Var.SET \hddcodetype[0x45]="TRACE_CODE_HDD_CFG80211_SET_MAC_ACL"
+Var.SET \hddcodetype[0x46]="TRACE_CODE_HDD_CFG80211_TESTMODE"
+Var.SET \hddcodetype[0x47]="TRACE_CODE_HDD_CFG80211_DUMP_SURVEY"
+Var.SET \hddcodetype[0x48]="TRACE_CODE_HDD_CFG80211_SCHED_SCAN_START"
+Var.SET \hddcodetype[0x49]="TRACE_CODE_HDD_CFG80211_SCHED_SCAN_STOP"
+Var.SET \hddcodetype[0x4A]="TRACE_CODE_HDD_CFG80211_DEL_PMKSA"
+
+&TRACETYPESIZE=v.value(sizeof(tvosTraceRecord))
+&TRACESIZE=v.value(sizeof(gvosTraceTbl))
+&TRACEMAXINDEX=v.value(&TRACESIZE/&TRACETYPESIZE)
+
+&HEAD=v.value(gvosTraceData.head)
+&TAIL=v.value(gvosTraceData.tail)
+
+IF ((&HEAD>&TRACEMAXINDEX)||(&TAIL>&TRACEMAXINDEX)||(&TAIL==&HEAD))
+(
+  GOTO ENDSCRIPT
+)
+
+&INDEX=&HEAD
+
+TRACESTART:
+
+&TIME=v.value(gvosTraceTbl[&INDEX].time)
+&MODULE=v.value(gvosTraceTbl[&INDEX].module)
+&CODE=v.value(gvosTraceTbl[&INDEX].code)
+&SESSION=v.value(gvosTraceTbl[&INDEX].session)
+&DATA=v.value(gvosTraceTbl[&INDEX].data)
+
+
+  WRITE #1 "TIME: "  &TIME
+  Var.Write #1 %STRING \module[&MODULE]
+
+IF (&MODULE==0x7)
+(
+if (&CODE>=0)&&(&CODE<=0x12)
+(
+    Var.Write #1 %STRING \code[&CODE] " [" %Hex &CODE "]"
+)
+
+   IF (&SESSION==0xFF)
+    (
+      WRITE #1 "NO SESSION"
+    )
+    ELSE
+    (
+      WRITE #1 "SESSION: " &SESSION
+    )
+
+
+;0 TRACE_CODE_MLM_STATE
+IF (&CODE==0x0)
+(
+  Var.NEW  tLimMlmStates \mlmstate
+  Var.Set \mlmstate=&DATA
+  ;Var.Write #1 \mlmstate %Hex &DATA
+)
+
+;1 TRACE_CODE_SME_STATE
+IF (&CODE==0x1)
+(
+  Var.NEW  tLimSmeStates \smestate
+  Var.Set \smestate=&DATA
+  Var.Write #1 \smestate %Hex &DATA
+)
+
+;2 TRACE_CODE_TX_MGMT
+IF (&CODE==0x2)
+(
+  WRITE #1 "DATA: " &DATA
+)
+
+;3 TRACE_CODE_RX_MGMT
+IF (&CODE==0x3)
+(
+  &SERIAL=v.value(&DATA>>16)
+  &SUBTYPE=v.value(&DATA&0xFF)
+  if (&SUBTYPE<=0xF)
+  (
+  Var.Write #1 %STRING \mgmttype[&SUBTYPE]
+  WRITE #1 "SEQ NUM: " &SERIAL
+  )
+  else
+  (
+    WRITE #1 "INCORRECT DATA"
+  )
+)
+
+;4 TRACE_CODE_RX_MGMT_TSF
+IF (&CODE==0x4)
+(
+  WRITE #1 "BEACON TS: " &DATA
+)
+
+;5 TRACE_CODE_TX_COMPLETE
+IF (&CODE==0x5)
+(
+  Var.Write #1 %STRING \mgmttype[&DATA] %Hex &DATA
+)
+
+;14 TRACE_CODE_RX_MGMT_DROP
+IF (&CODE==0xE)
+(
+  Var.NEW  tMgmtFrmDropReason \dropreason
+  Var.Set \dropreason=&DATA
+  Var.Write #1 \dropreason %Hex &DATA
+)
+
+
+;15 TRACE_CODE_TIMER_ACTIVATE/DEACTIVATE
+IF (&CODE==0xF)||(&CODE==0x10)
+(
+  Var.Write #1 %STRING \limtimertype[&DATA] %Hex &DATA
+)
+
+;6 TRACE_CODE_TX_SME_MSG
+IF (&CODE==0x6)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x12)&&(&DATA>=0x12B0)
+(
+Var.Write #1 %STRING \limmsgtype[&MSG] %Hex &MSG
+)
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg %Hex &DATA
+ )
+)
+
+;7 TRACE_CODE_RX_SME_MSG
+IF (&CODE==0x7)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x12)&&(&DATA>=0x12B0)
+(
+Var.Write #1 %STRING \limmsgtype[&MSG]  %Hex &MSG
+)
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg %Hex &DATA
+)
+)
+
+;8 TRACE_CODE_TX_WDA_MSG
+IF (&CODE==0x8)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x10)
+(
+Var.Write #1 %STRING \halmsgtype[&MSG] %Hex &MSG
+)
+)
+
+;9 TRACE_CODE_RX_WDA_MSG
+IF (&CODE==0x9)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x10)
+(
+Var.Write #1 %STRING \halmsgtype[&MSG]  %Hex &MSG
+)
+)
+
+;10 TRACE_CODE_TX_LIM_MSG
+IF (&CODE==0xA)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x12)&&(&DATA>=0x12B0)
+(
+Var.Write #1 %STRING \limmsgtype[&MSG] %Hex &MSG
+)
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg %Hex &DATA
+)
+)
+
+;11 TRACE_CODE_RX_LIM_MSG
+IF (&CODE==0xB)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x12)&&(&DATA>=0x12B0)
+(
+Var.Write #1 %STRING \limmsgtype[&MSG]  %Hex &MSG
+)
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  &DATA=v.value(&DATA&0xFFFF)
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg %Hex &DATA
+)
+)
+
+;12 TRACE_CODE_TX_CFG_MSG
+IF (&CODE==0xC)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x11)&&(&DATA>=0x11B0)
+(
+Var.Write #1 %STRING \cfgmsgtype[&MSG] %Hex &MSG
+)
+)
+
+;13 TRACE_CODE_RX_CFG_MSG
+IF (&CODE==0xD)
+(
+&MOD=v.value(&DATA>>8)
+&MSG=v.value(&DATA&0xFF)
+IF (&MOD==0x11)&&(&DATA>=0x11B0)
+(
+Var.Write #1 %STRING \cfgmsgtype[&MSG] %Hex &MSG
+)
+)
+
+IF (&DATA>=0x1500)
+(
+  Var.NEW  enum eWniMsgTypes \smemsg
+  &DATA=v.value(&DATA&0xFFFF)
+  Var.Set \smemsg=&DATA
+  Var.Write #1 \smemsg  %Hex &DATA
+)
+
+)
+
+IF (&MODULE==0x1)
+(
+  Var.Write #1 %STRING \tlcodetype[&CODE] %Hex &CODE
+  WRITE #1 "DATA: " &DATA
+
+  IF (&SESSION==0xFF)
+  (
+    WRITE #1 "NO SESSION"
+  )
+  ELSE
+  (
+    WRITE #1 "SESSION: " &SESSION
+  )
+)
+
+
+IF (&MODULE==0x6)
+(
+
+  IF ((&CODE>=0x0)&&(&CODE<=0x62))
+  (
+    Var.Write #1 %STRING \smecodetype[&CODE] %Hex &CODE
+  )
+  ELSE
+  (
+    IF ((&CODE>=0xFA)&&(&CODE<=0xFC))
+    (
+      Var.Write #1 %STRING \smecodetype[&CODE] %Hex &CODE
+    )
+    ELSE
+    (
+      WRITE #1 "CODE: " &CODE
+    )
+  )
+  WRITE #1 "DATA: " &DATA
+
+  IF (&SESSION==0xFF)
+  (
+    WRITE #1 "NO SESSION"
+  )
+  ELSE
+  (
+    WRITE #1 "SESSION: " &SESSION
+  )
+)
+
+IF (&MODULE==0x5)
+(
+
+  IF ((&CODE>=0x0)&&(&CODE<=0x4A))
+  (
+    Var.Write #1 %STRING \hddcodetype[&CODE] %Hex &CODE
+  )
+  ELSE
+  (
+    WRITE #1 "CODE: " &CODE
+  )
+  WRITE #1 "DATA: " &DATA
+
+  IF (&SESSION==0xFF)
+  (
+    WRITE #1 "NO SESSION"
+  )
+  ELSE
+  (
+    WRITE #1 "SESSION: " &SESSION
+  )
+)
+
+WRITE #1 " "
+
+&INDEX=v.value((&INDEX+1)%(&TRACEMAXINDEX))
+
+  IF (&INDEX!=&HEAD)
+  (
+    GOTO TRACESTART
+  )
+
+
+
+ENDSCRIPT:
+CLOSE #1
+ENDDO
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parserApi.c b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parserApi.c
index 9b614467978..52f86adbced 100644
--- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parserApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parserApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -51,6 +51,8 @@
 #endif
 
 #include "regdomain_common.h"
+#include "qdf_crypto.h"
+#include "lim_process_fils.h"
 
 #define DOT11F_RSN_VERSION 1    /* current supported version */
 #define DOT11F_RSN_OUI_SIZE 4
@@ -356,16 +358,65 @@ populate_dot11f_avoid_channel_ie(tpAniSirGlobal mac_ctx,
 		return;
 
 	dot11f->present = true;
-	dot11f->type = QCOM_VENDOR_IE_MCC_AVOID_CH;
-	dot11f->channel = pe_session->currentOperChannel;
+	dot11f->MccChanInfo.present = true;
+	dot11f->MccChanInfo.channel = pe_session->currentOperChannel;
 }
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
+#ifdef FEATURE_WLAN_SUB_20_MHZ
+/**
+ * populate_dot11f_sub_20_channel_width_ie() - Populate a sDot11fIEQComVendorIE
+ * @mac_ctx_ptr: Pointer to Global MAC structure
+ * @dot11f_ptr: Pointer to Address of a sDot11fIEQComVendorIE to be filled in
+ * @pe_session: PE session entry
+ *
+ * Return: none
+ */
+void
+populate_dot11f_sub_20_channel_width_ie(
+	tpAniSirGlobal mac_ctx_ptr,
+	tDot11fIEQComVendorIE *dot11f_ptr,
+	tpPESession pe_session)
+{
+	uint8_t  sub20_static_channelwidth;
+	uint8_t  sub20_dynamic_channelwidth;
+	uint8_t  sub20_capability;
+
+	sub20_static_channelwidth = mac_ctx_ptr->sub20_channelwidth;
+	sub20_dynamic_channelwidth = mac_ctx_ptr->sub20_dynamic_channelwidth;
+
+	if (sub20_static_channelwidth == 0 &&
+	    sub20_dynamic_channelwidth == 0)
+		return;
+
+	if (sub20_dynamic_channelwidth != 0)
+		sub20_capability = sub20_dynamic_channelwidth;
+	else
+		sub20_capability = sub20_static_channelwidth;
+
+	if (LIM_IS_AP_ROLE(pe_session) ||
+	    LIM_IS_STA_ROLE(pe_session)) {
+		dot11f_ptr->present = true;
+		dot11f_ptr->Sub20Info.present = true;
+		dot11f_ptr->Sub20Info.capability = sub20_capability;
+	}
+
+	if (LIM_IS_AP_ROLE(pe_session) &&
+	    pe_session->dfsIncludeChanSwIe == VOS_TRUE) {
+		dot11f_ptr->present = true;
+		dot11f_ptr->Sub20Info.present = true;
+		dot11f_ptr->Sub20Info.csa_chanwidth =
+			 pe_session->lim_sub20_channel_switch_bandwidth;
+	}
+}
+#endif
+
 void
 PopulateDot11fChanSwitchWrapper(tpAniSirGlobal pMac,
                             tDot11fIEChannelSwitchWrapper *pDot11f,
                             tpPESession psessionEntry)
 {
+    uint8_t *ie_ptr = NULL;
     /*
      * The new country subelement is present only when
      * 1. AP performs Extended Channel switching to new country.
@@ -395,6 +446,20 @@ PopulateDot11fChanSwitchWrapper(tpAniSirGlobal pMac,
                      psessionEntry->gLimWiderBWChannelSwitch.newCenterChanFreq1;
      pDot11f->WiderBWChanSwitchAnn.present = 1;
 
+     /*
+      * Add the VHT Transmit power Envelope Sublement.
+      */
+     ie_ptr = lim_get_ie_ptr(psessionEntry->addIeParams.probeRespBCNData_buff,
+               psessionEntry->addIeParams.probeRespBCNDataLen,
+               DOT11F_EID_VHT_TRANSMIT_POWER_ENV);
+     if (ie_ptr) {
+         /* Ignore EID field */
+         ie_ptr++;
+         pDot11f->vht_transmit_power_env.present = 1;
+         pDot11f->vht_transmit_power_env.num_bytes = *ie_ptr++;
+         vos_mem_copy(pDot11f->vht_transmit_power_env.bytes,
+            ie_ptr, pDot11f->vht_transmit_power_env.num_bytes);
+     }
 }
 
 #ifdef WLAN_FEATURE_11AC
@@ -678,6 +743,7 @@ PopulateDot11fHTCaps(tpAniSirGlobal           pMac,
 
     uHTCapabilityInfo.nCfgValue16 = nCfgValue & 0xFFFF;
 
+    pDot11f->advCodingCap             = uHTCapabilityInfo.htCapInfo.advCodingCap;
     pDot11f->mimoPowerSave            = uHTCapabilityInfo.htCapInfo.mimoPowerSave;
     pDot11f->greenField               = uHTCapabilityInfo.htCapInfo.greenField;
     pDot11f->delayedBA                = uHTCapabilityInfo.htCapInfo.delayedBA;
@@ -691,7 +757,6 @@ PopulateDot11fHTCaps(tpAniSirGlobal           pMac,
     if (psessionEntry == NULL) // Only in case of NO session
     {
         pDot11f->supportedChannelWidthSet = uHTCapabilityInfo.htCapInfo.supportedChannelWidthSet;
-        pDot11f->advCodingCap = uHTCapabilityInfo.htCapInfo.advCodingCap;
         pDot11f->txSTBC = uHTCapabilityInfo.htCapInfo.txSTBC;
         pDot11f->rxSTBC = uHTCapabilityInfo.htCapInfo.rxSTBC;
         pDot11f->shortGI20MHz             = uHTCapabilityInfo.htCapInfo.shortGI20MHz;
@@ -699,7 +764,6 @@ PopulateDot11fHTCaps(tpAniSirGlobal           pMac,
     }
     else
     {
-        pDot11f->advCodingCap             = psessionEntry->htConfig.ht_rx_ldpc;
         pDot11f->supportedChannelWidthSet = psessionEntry->htSupportedChannelWidthSet;
         pDot11f->txSTBC                   = psessionEntry->htConfig.ht_tx_stbc;
         pDot11f->rxSTBC                   = psessionEntry->htConfig.ht_rx_stbc;
@@ -1226,6 +1290,12 @@ PopulateDot11fExtCap(tpAniSirGlobal   pMac,
 #endif
     p_ext_cap->extChanSwitch = 1;
 
+    if (pDot11f->present)
+    {
+        /* Need to compute the num_bytes based on bits set */
+        pDot11f->num_bytes = lim_compute_ext_cap_ie_length(pDot11f);
+    }
+
     return eSIR_SUCCESS;
 }
 
@@ -2245,6 +2315,124 @@ tSirRetStatus sirvalidateandrectifyies(tpAniSirGlobal pMac,
     return eHAL_STATUS_SUCCESS;
 }
 
+/**
+ * sir_copy_hs20_ie() - Update HS 2.0 Information Element.
+ * @dest: dest HS IE buffer to be updated
+ * @src: src HS IE buffer
+ *
+ * Update HS2.0 IE info from src to dest
+ *
+ * Return: void
+ */
+void sir_copy_hs20_ie(tDot11fIEhs20vendor_ie *dest, tDot11fIEhs20vendor_ie *src)
+{
+	if (src->present) {
+		adf_os_mem_copy(dest,
+				src,
+				sizeof(tDot11fIEhs20vendor_ie) -
+					sizeof(src->hs_id));
+
+		if (src->hs_id_present)
+			adf_os_mem_copy(&dest->hs_id,
+					&src->hs_id,
+					sizeof(src->hs_id));
+	}
+}
+
+#ifdef WLAN_FEATURE_FILS_SK
+void populate_dot11f_fils_params(tpAniSirGlobal mac_ctx,
+        tDot11fAssocRequest *frm,
+        tpPESession pe_session)
+{
+    struct pe_fils_session *fils_info = pe_session->fils_info;
+
+    /* Populate RSN IE with FILS AKM */
+    PopulateDot11fRSNOpaque(mac_ctx, &(pe_session->pLimJoinReq->rsnIE),
+                                &frm->RSNOpaque);
+
+    /* Populate FILS session IE */
+    frm->fils_session.present = true;
+    vos_mem_copy(frm->fils_session.session,
+             fils_info->fils_session, FILS_SESSION_LENGTH);
+
+    /* Populate FILS Key confirmation IE */
+    if (fils_info->key_auth_len) {
+        frm->fils_key_confirmation.present = true;
+        frm->fils_key_confirmation.num_key_auth =
+                        fils_info->key_auth_len;
+
+        vos_mem_copy(frm->fils_key_confirmation.key_auth,
+                 fils_info->key_auth, fils_info->key_auth_len);
+    }
+}
+
+/**
+ * update_fils_data: update fils params from beacon/probe response
+ * @fils_ind: pointer to sir_fils_indication
+ * @fils_indication: pointer to tDot11fIEfils_indication
+ *
+ * Return: None
+ */
+static void update_fils_data(struct sir_fils_indication *fils_ind,
+                 tDot11fIEfils_indication *fils_indication)
+{
+    uint8_t *data;
+
+    data = fils_indication->variable_data;
+    fils_ind->is_present = true;
+    fils_ind->is_ip_config_supported =
+            fils_indication->is_ip_config_supported;
+    fils_ind->is_fils_sk_auth_supported =
+            fils_indication->is_fils_sk_auth_supported;
+    fils_ind->is_fils_sk_auth_pfs_supported =
+            fils_indication->is_fils_sk_auth_pfs_supported;
+    fils_ind->is_pk_auth_supported =
+            fils_indication->is_pk_auth_supported;
+    if (fils_indication->is_cache_id_present) {
+        fils_ind->cache_identifier.is_present = true;
+        vos_mem_copy(fils_ind->cache_identifier.identifier,
+                data, SIR_CACHE_IDENTIFIER_LEN);
+        data = data + SIR_CACHE_IDENTIFIER_LEN;
+    }
+    if (fils_indication->is_hessid_present) {
+        fils_ind->hessid.is_present = true;
+        vos_mem_copy(fils_ind->hessid.hessid,
+                data, SIR_HESSID_LEN);
+        data = data + SIR_HESSID_LEN;
+    }
+    if (fils_indication->realm_identifiers_cnt) {
+        fils_ind->realm_identifier.is_present = true;
+        fils_ind->realm_identifier.realm_cnt =
+            fils_indication->realm_identifiers_cnt;
+        vos_mem_copy(fils_ind->realm_identifier.realm,
+            data, fils_ind->realm_identifier.realm_cnt *
+                    SIR_REALM_LEN);
+    }
+}
+
+/**
+ * sir_convert_fils_data_to_probersp_struct: update fils params from probe resp
+ * @probe_resp: pointer to tpSirProbeRespBeacon
+ * @pr: pointer to tDot11fProbeResponse
+ *
+ * Return: None
+ */
+static void
+sir_convert_fils_data_to_probersp_struct(tpSirProbeRespBeacon probe_resp,
+            tDot11fProbeResponse *pr)
+{
+    if (!pr->fils_indication.present)
+        return;
+
+    update_fils_data(&probe_resp->fils_ind, &pr->fils_indication);
+}
+#else
+static inline void
+sir_convert_fils_data_to_probersp_struct(tpSirProbeRespBeacon probe_resp,
+        tDot11fProbeResponse *pr)
+{
+}
+#endif
 tSirRetStatus sirConvertProbeFrame2Struct(tpAniSirGlobal       pMac,
                                           tANI_U8             *pFrame,
                                           tANI_U32             nFrame,
@@ -2280,13 +2468,6 @@ tSirRetStatus sirConvertProbeFrame2Struct(tpAniSirGlobal       pMac,
         vos_mem_free(pr);
         return eSIR_FAILURE;
     }
-    else if ( DOT11F_WARNED( status ) )
-    {
-      limLog(pMac, LOGW,
-             FL("Warnings while unpacking a Probe Response(0x%08x, %d bytes):"),
-             status, nFrame);
-        PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pFrame, nFrame);)
-    }
 
     // & "transliterate" from a 'tDot11fProbeResponse' to a 'tSirProbeRespBeacon'...
 
@@ -2528,6 +2709,16 @@ tSirRetStatus sirConvertProbeFrame2Struct(tpAniSirGlobal       pMac,
                                 sizeof(tDot11fIEVHTOperation));
     }
 
+    if (pr->QComVendorIE.present &&
+        pr->QComVendorIE.Sub20Info.present) {
+            pProbeResp->vendor_sub20_capability =
+                pr->QComVendorIE.Sub20Info.capability;
+    }
+#ifdef WLAN_FEATURE_FILS_SK
+    sir_convert_fils_data_to_probersp_struct(pProbeResp, pr);
+#endif
+
+    sir_copy_hs20_ie(&pProbeResp->hs20vendor_ie, &pr->hs20vendor_ie);
 
     vos_mem_free(pr);
     return eSIR_SUCCESS;
@@ -2735,10 +2926,8 @@ sirConvertAssocReqFrame2Struct(tpAniSirGlobal pMac,
     if (ar->ExtCap.present)
     {
         struct s_ext_cap *p_ext_cap;
-
-        vos_mem_copy(&pAssocReq->ExtCap.bytes, &ar->ExtCap.bytes,
-                     ar->ExtCap.num_bytes);
-
+        vos_mem_copy( &pAssocReq->ExtCap, &ar->ExtCap,
+                sizeof(tDot11fIEExtCap));
         p_ext_cap = (struct s_ext_cap *)&pAssocReq->ExtCap.bytes;
         limLog(pMac, LOG1,
                FL("ExtCap present, timingMeas: %d Initiator: %d Responder: %d"),
@@ -2761,13 +2950,67 @@ sirConvertAssocReqFrame2Struct(tpAniSirGlobal pMac,
             }
     }
 
+    if (ar->QComVendorIE.present &&
+        ar->QComVendorIE.Sub20Info.present)
+            pAssocReq->vendor_sub20_capability =
+             ar->QComVendorIE.Sub20Info.capability;
+
     vos_mem_free(ar);
     return eSIR_SUCCESS;
 
 } // End sirConvertAssocReqFrame2Struct.
 
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * fils_convert_assoc_rsp_frame2_struct() - Copy FILS IE's to Assoc rsp struct
+ * @ar: frame parser Assoc response struct
+ * @pAssocRsp: LIM Assoc response
+ *
+ * Return: None
+ */
+static void fils_convert_assoc_rsp_frame2_struct(tpAniSirGlobal pMac,
+                         tDot11fAssocResponse *ar,
+                         tpSirAssocRsp pAssocRsp)
+{
+    if (ar->fils_session.present) {
+        limLog(pMac, LOG1, FL("fils session IE present"));
+        pAssocRsp->fils_session.present = true;
+        vos_mem_copy(pAssocRsp->fils_session.session,
+                ar->fils_session.session,
+                DOT11F_IE_FILS_SESSION_MAX_LEN);
+    }
+
+    if (ar->fils_key_confirmation.present) {
+        limLog(pMac, LOG1, FL("fils key conf IE present"));
+        pAssocRsp->fils_key_auth.num_key_auth =
+            ar->fils_key_confirmation.num_key_auth;
+        vos_mem_copy(pAssocRsp->fils_key_auth.key_auth,
+                ar->fils_key_confirmation.key_auth,
+                pAssocRsp->fils_key_auth.num_key_auth);
+    }
+
+    if (ar->fils_kde.present) {
+        limLog(pMac, LOG1,
+                  FL("fils kde IE present %d"),ar->fils_kde.num_kde_list);
+        pAssocRsp->fils_kde.num_kde_list =
+            ar->fils_kde.num_kde_list;
+        vos_mem_copy(pAssocRsp->fils_kde.key_rsc,
+                ar->fils_kde.key_rsc, KEY_RSC_LEN);
+        vos_mem_copy(&pAssocRsp->fils_kde.kde_list,
+                &ar->fils_kde.kde_list,
+                pAssocRsp->fils_kde.num_kde_list);
+    }
+}
+#else
+static inline void fils_convert_assoc_rsp_frame2_struct(tpAniSirGlobal pMac,
+                                 tDot11fAssocResponse *ar,
+                                 tpSirAssocRsp pAssocRsp)
+{ }
+#endif
+
 tSirRetStatus
 sirConvertAssocRespFrame2Struct(tpAniSirGlobal pMac,
+                                tpPESession psessionEntry,
                                 tANI_U8            *pFrame,
                                 tANI_U32            nFrame,
                                 tpSirAssocRsp  pAssocRsp)
@@ -2779,6 +3022,18 @@ sirConvertAssocRespFrame2Struct(tpAniSirGlobal pMac,
     // Zero-init our [out] parameter,
     vos_mem_set( ( tANI_U8* )pAssocRsp, sizeof(tSirAssocRsp), 0 );
 
+#ifdef WLAN_FEATURE_FILS_SK
+    /* decrypt the cipher text using AEAD decryption */
+    if (lim_is_fils_connection(psessionEntry)) {
+        status = aead_decrypt_assoc_rsp(pMac, psessionEntry,
+                        &ar, pFrame, &nFrame);
+        if (!VOS_IS_STATUS_SUCCESS(status)) {
+            limLog(pMac, LOGE,
+                  FL("FILS assoc rsp AEAD decrypt fails"));
+            return eSIR_FAILURE;
+        }
+    }
+#endif
     // delegate to the framesc-generated code,
     status = dot11fUnpackAssocResponse( pMac, pFrame, nFrame, &ar);
     if ( DOT11F_FAILED( status ) )
@@ -2902,7 +3157,7 @@ sirConvertAssocRespFrame2Struct(tpAniSirGlobal pMac,
 #endif
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
-    if (ar.num_RICDataDesc) {
+    if (ar.num_RICDataDesc && ar.num_RICDataDesc <= 2) {
         for (cnt=0; cnt < ar.num_RICDataDesc; cnt++) {
             if (ar.RICDataDesc[cnt].present) {
                 vos_mem_copy( &pAssocRsp->RICData[cnt], &ar.RICDataDesc[cnt],
@@ -2950,9 +3205,8 @@ sirConvertAssocRespFrame2Struct(tpAniSirGlobal pMac,
     if (ar.ExtCap.present)
     {
         struct s_ext_cap *p_ext_cap;
-
-        vos_mem_copy(&pAssocRsp->ExtCap.bytes, &ar.ExtCap.bytes,
-                     ar.ExtCap.num_bytes);
+        vos_mem_copy( &pAssocRsp->ExtCap, &ar.ExtCap,
+                sizeof(tDot11fIEExtCap));
         p_ext_cap = (struct s_ext_cap *)&pAssocRsp->ExtCap.bytes;
         limLog(pMac, LOG1,
                FL("ExtCap present, timingMeas: %d Initiator: %d Responder: %d"),
@@ -2990,6 +3244,12 @@ sirConvertAssocRespFrame2Struct(tpAniSirGlobal pMac,
             limLogVHTOperation(pMac, &pAssocRsp->VHTOperation);
     }
 
+    if (ar.QComVendorIE.present &&
+        ar.QComVendorIE.Sub20Info.present)
+            pAssocRsp->vendor_sub20_capability =
+             ar.QComVendorIE.Sub20Info.capability;
+
+    fils_convert_assoc_rsp_frame2_struct(pMac, &ar, pAssocRsp);
     return eSIR_SUCCESS;
 
 } // End sirConvertAssocRespFrame2Struct.
@@ -3176,8 +3436,8 @@ sirConvertReassocReqFrame2Struct(tpAniSirGlobal pMac,
     {
         struct s_ext_cap *p_ext_cap = (struct s_ext_cap *)
                                        &ar.ExtCap.bytes;
-        vos_mem_copy(&pAssocReq->ExtCap.bytes, &ar.ExtCap.bytes,
-                     ar.ExtCap.num_bytes);
+        vos_mem_copy( &pAssocReq->ExtCap, &ar.ExtCap,
+                sizeof(tDot11fIEExtCap));
         limLog(pMac, LOG1,
                FL("ExtCap present, timingMeas: %d Initiator: %d Responder: %d"),
                p_ext_cap->timingMeas, p_ext_cap->fine_time_meas_initiator,
@@ -3219,6 +3479,8 @@ sirFillBeaconMandatoryIEforEseBcnReport(tpAniSirGlobal   pMac,
         limLog(pMac, LOGE, FL("Failed to allocate memory"));
         return eSIR_FAILURE;
     }
+    vos_mem_zero(pBies, sizeof(tDot11fBeaconIEs));
+
     // delegate to the framesc-generated code,
     status = dot11fUnpackBeaconIEs( pMac, pPayload, nPayload, pBies );
 
@@ -3505,6 +3767,30 @@ err_bcnrep:
 
 #endif /* FEATURE_WLAN_ESE_UPLOAD */
 
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * sir_parse_fils_beacon_ie: update fils params from beacon IEs
+ * @beacon_struct: pointer to tpSirProbeRespBeacon
+ * @beacon_ie: pointer to tDot11fBeaconIEs
+ *
+ * Return: None
+ */
+static void sir_parse_fils_beacon_ie(tpSirProbeRespBeacon beacon_struct,
+                tDot11fBeaconIEs *beacon_ie)
+{
+    if (!beacon_ie->fils_indication.present)
+        return;
+
+    update_fils_data(&beacon_struct->fils_ind,
+            &beacon_ie->fils_indication);
+}
+#else
+static inline void sir_parse_fils_beacon_ie(tpSirProbeRespBeacon beacon_struct,
+            tDot11fBeaconIEs *beacon_ie)
+{
+}
+#endif
+
 tSirRetStatus
 sirParseBeaconIE(tpAniSirGlobal        pMac,
                  tpSirProbeRespBeacon  pBeaconStruct,
@@ -3527,6 +3813,8 @@ sirParseBeaconIE(tpAniSirGlobal        pMac,
         limLog(pMac, LOGE, FL("Failed to allocate memory"));
         return eSIR_FAILURE;
     }
+    vos_mem_zero(pBies, sizeof(tDot11fBeaconIEs));
+
     // delegate to the framesc-generated code,
     status = dot11fUnpackBeaconIEs( pMac, pPayload, nPayload, pBies );
 
@@ -3760,7 +4048,6 @@ sirParseBeaconIE(tpAniSirGlobal        pMac,
     pBeaconStruct->Vendor1IEPresent = pBies->Vendor1IE.present;
     pBeaconStruct->Vendor3IEPresent = pBies->Vendor3IE.present;
     if (pBies->ExtCap.present) {
-        pBeaconStruct->ExtCap.present = 1;
         vos_mem_copy( &pBeaconStruct->ExtCap, &pBies->ExtCap,
                 sizeof(tDot11fIEExtCap));
     }
@@ -3784,10 +4071,47 @@ sirParseBeaconIE(tpAniSirGlobal        pMac,
                                 sizeof(tDot11fIEVHTOperation));
     }
 
+    if (pBies->QComVendorIE.present &&
+        pBies->QComVendorIE.Sub20Info.present)
+            pBeaconStruct->vendor_sub20_capability =
+                       pBies->QComVendorIE.Sub20Info.capability;
+
+#ifdef WLAN_FEATURE_FILS_SK
+    sir_parse_fils_beacon_ie(pBeaconStruct, pBies);
+#endif
+
+    sir_copy_hs20_ie(&pBeaconStruct->hs20vendor_ie, &pBies->hs20vendor_ie);
+
     vos_mem_free(pBies);
     return eSIR_SUCCESS;
 } // End sirParseBeaconIE.
 
+#ifdef WLAN_FEATURE_FILS_SK
+/**
+ * sir_convert_fils_data_to_beacon_struct: update fils params from beacon
+ * @beacon_struct: pointer to tpSirProbeRespBeacon
+ * @beacon: pointer to tDot11fBeacon
+ *
+ * Return: None
+ */
+static void
+sir_convert_fils_data_to_beacon_struct(tpSirProbeRespBeacon beacon_struct,
+                    tDot11fBeacon *beacon)
+{
+    if (!beacon->fils_indication.present)
+        return;
+
+    update_fils_data(&beacon_struct->fils_ind,
+            &beacon->fils_indication);
+}
+#else
+static inline void
+sir_convert_fils_data_to_beacon_struct(tpSirProbeRespBeacon beacon_struct,
+                    tDot11fBeacon *beacon)
+{
+}
+#endif
+
 tSirRetStatus
 sirConvertBeaconFrame2Struct(tpAniSirGlobal       pMac,
                              tANI_U8             *pFrame,
@@ -3835,13 +4159,6 @@ sirConvertBeaconFrame2Struct(tpAniSirGlobal       pMac,
         vos_mem_free(pBeacon);
         return eSIR_FAILURE;
     }
-    else if ( DOT11F_WARNED( status ) )
-    {
-      limLog(pMac, LOGW,
-                 FL("There were warnings while unpacking Beacon IEs (0x%08x, %d bytes):"),
-                 status, nPayload);
-        PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pPayload, nPayload);)
-    }
 
     // & "transliterate" from a 'tDot11fBeacon' to a 'tSirProbeRespBeacon'...
     // Timestamp
@@ -4140,18 +4457,76 @@ sirConvertBeaconFrame2Struct(tpAniSirGlobal       pMac,
     if(pBeacon->QComVendorIE.present) {
         pBeaconStruct->AvoidChannelIE.present =
             pBeacon->QComVendorIE.present;
-        pBeaconStruct->AvoidChannelIE.type =
-            pBeacon->QComVendorIE.type;
-        pBeaconStruct->AvoidChannelIE.channel =
-            pBeacon->QComVendorIE.channel;
+        pBeaconStruct->AvoidChannelIE.MccChanInfo.present =
+            pBeacon->QComVendorIE.MccChanInfo.present;
+        pBeaconStruct->AvoidChannelIE.MccChanInfo.channel =
+            pBeacon->QComVendorIE.MccChanInfo.channel;
     }
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
+    if (pBeacon->QComVendorIE.present &&
+        pBeacon->QComVendorIE.Sub20Info.present &&
+        pBeacon->QComVendorIE.Sub20Info.csa_chanwidth) {
+            pBeaconStruct->vendor_sub20_capability =
+                 pBeacon->QComVendorIE.Sub20Info.capability;
+    }
+
+#ifdef WLAN_FEATURE_FILS_SK
+    sir_convert_fils_data_to_beacon_struct(pBeaconStruct, pBeacon);
+#endif
+
+    sir_copy_hs20_ie(&pBeaconStruct->hs20vendor_ie, &pBeacon->hs20vendor_ie);
+
     vos_mem_free(pBeacon);
     return eSIR_SUCCESS;
 
 } // End sirConvertBeaconFrame2Struct.
 
+#ifdef WLAN_FEATURE_FILS_SK
+/* sir_update_auth_frame2_struct_fils_conf: API to update fils info from auth
+ * packet type 2
+ * @auth: auth packet pointer received from AP
+ * @auth_frame: data structure needs to be updated
+ *
+ * Return: None
+ */
+static void sir_update_auth_frame2_struct_fils_conf(tDot11fAuthentication *auth,
+                tpSirMacAuthFrameBody auth_frame)
+{
+    if (auth->AuthAlgo.algo != eSIR_FILS_SK_WITHOUT_PFS)
+        return;
+
+    if (auth->fils_assoc_delay_info.present)
+        auth_frame->assoc_delay_info =
+            auth->fils_assoc_delay_info.assoc_delay_info;
+
+    if (auth->fils_session.present)
+        vos_mem_copy(auth_frame->session, auth->fils_session.session,
+            SIR_FILS_SESSION_LENGTH);
+
+    if (auth->fils_nonce.present)
+        vos_mem_copy(auth_frame->nonce, auth->fils_nonce.nonce,
+            SIR_FILS_NONCE_LENGTH);
+
+    if (auth->fils_wrapped_data.present) {
+        vos_mem_copy(auth_frame->wrapped_data,
+            auth->fils_wrapped_data.wrapped_data,
+            auth->fils_wrapped_data.num_wrapped_data);
+        auth_frame->wrapped_data_len =
+            auth->fils_wrapped_data.num_wrapped_data;
+    }
+    if (auth->RSNOpaque.present) {
+        vos_mem_copy(auth_frame->rsn_ie.info, auth->RSNOpaque.data,
+            auth->RSNOpaque.num_data);
+        auth_frame->rsn_ie.length = auth->RSNOpaque.num_data;
+    }
+}
+#else
+static void sir_update_auth_frame2_struct_fils_conf(tDot11fAuthentication *auth,
+                tpSirMacAuthFrameBody auth_frame)
+{ }
+#endif
+
 tSirRetStatus
 sirConvertAuthFrame2Struct(tpAniSirGlobal        pMac,
                            tANI_U8                   *pFrame,
@@ -4192,6 +4567,7 @@ sirConvertAuthFrame2Struct(tpAniSirGlobal        pMac,
         pAuth->length = auth.ChallengeText.num_text;
         vos_mem_copy( pAuth->challengeText, auth.ChallengeText.text, auth.ChallengeText.num_text );
     }
+    sir_update_auth_frame2_struct_fils_conf(&auth, pAuth);
 
     return eSIR_SUCCESS;
 
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/utilsApi.c b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/utilsApi.c
index 6bdd50ee5ba..36935faab6f 100644
--- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/utilsApi.c
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/utilsApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -42,27 +42,6 @@
 
 #include "utilsApi.h"
 
-
-
-
-
-// -------------------------------------------------------------------
-/**
- * sirDumpBuf()
- *
- * FUNCTION:
- * This function is called to dump a buffer with a certain level
- *
- * LOGIC:
- *
- * ASSUMPTIONS:
- * None.
- *
- * NOTE:
- *
- * @param pBuf: buffer pointer
- * @return None.
- */
 void
 sirDumpBuf(tpAniSirGlobal pMac, tANI_U8 modId, tANI_U32 level, tANI_U8 *buf, tANI_U32 size)
 {
@@ -97,3 +76,54 @@ sirDumpBuf(tpAniSirGlobal pMac, tANI_U8 modId, tANI_U32 level, tANI_U8 *buf, tAN
     }
 
 }/*** end sirDumpBuf() ***/
+
+#ifdef WLAN_FEATURE_DSRC
+struct sir_ocb_config *
+sir_copy_sir_ocb_config(const struct sir_ocb_config *src)
+{
+	struct sir_ocb_config *dst;
+	uint32_t length;
+	void *cursor;
+
+	length = sizeof(*src) +
+		src->channel_count * sizeof(*src->channels) +
+		src->schedule_size * sizeof(*src->schedule) +
+		src->dcc_ndl_chan_list_len +
+		src->dcc_ndl_active_state_list_len +
+		src->def_tx_param_size;
+
+	dst = vos_mem_malloc(length);
+	if (!dst)
+		return NULL;
+
+	*dst = *src;
+
+	cursor = dst;
+	cursor += sizeof(*dst);
+	dst->channels = cursor;
+	cursor += src->channel_count * sizeof(*src->channels);
+	vos_mem_copy(dst->channels, src->channels,
+		     src->channel_count * sizeof(*src->channels));
+	dst->schedule = cursor;
+	cursor += src->schedule_size * sizeof(*src->schedule);
+	vos_mem_copy(dst->schedule, src->schedule,
+		     src->schedule_size * sizeof(*src->schedule));
+	dst->dcc_ndl_chan_list = cursor;
+	cursor += src->dcc_ndl_chan_list_len;
+	vos_mem_copy(dst->dcc_ndl_chan_list, src->dcc_ndl_chan_list,
+		     src->dcc_ndl_chan_list_len);
+	dst->dcc_ndl_active_state_list = cursor;
+	cursor += src->dcc_ndl_active_state_list_len;
+	vos_mem_copy(dst->dcc_ndl_active_state_list,
+		     src->dcc_ndl_active_state_list,
+		     src->dcc_ndl_active_state_list_len);
+
+	if (src->def_tx_param && src->def_tx_param_size) {
+		dst->def_tx_param = cursor;
+		vos_mem_copy(dst->def_tx_param, src->def_tx_param,
+			     src->def_tx_param_size);
+	}
+
+	return dst;
+}
+#endif /* WLAN_FEATURE_DSRC */
diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/utilsParser.c b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/utilsParser.c
index 6c9993935b4..e64ce33a361 100644
--- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/utilsParser.c
+++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/utilsParser.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2015, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -706,6 +706,8 @@ void ConvertQosMapsetFrame(tpAniSirGlobal pMac, tSirQosMapSet* Qos, tDot11fIEQos
     tANI_U8 i,j=0;
     if (dot11fIE->num_dscp_exceptions > 58)
         dot11fIE->num_dscp_exceptions = 58;
+    if (dot11fIE->num_dscp_exceptions < 16)
+        return;
     Qos->num_dscp_exceptions = (dot11fIE->num_dscp_exceptions - 16)/2;
     for (i = 0; i < Qos->num_dscp_exceptions; i++)
     {
diff --git a/drivers/staging/qcacld-2.0/CORE/TL/inc/wlan_qct_tl.h b/drivers/staging/qcacld-2.0/CORE/TL/inc/wlan_qct_tl.h
index 8f75d1d527b..2665324f7e4 100644
--- a/drivers/staging/qcacld-2.0/CORE/TL/inc/wlan_qct_tl.h
+++ b/drivers/staging/qcacld-2.0/CORE/TL/inc/wlan_qct_tl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -644,6 +644,14 @@ typedef struct
 
 void *tlshim_peer_validity(void *vos_ctx, uint8_t sta_id);
 
+/**
+ * tlshim_selfpeer_vdev() - get vdev of self peer
+ * @vos_ctx		vos context
+ *
+ * Return: on success return vdev, NULL when self peer is invalid/NULL
+ */
+void *tlshim_selfpeer_vdev(void *vos_ctx);
+
 /*==========================================================================
 
   FUNCTION    WLANTL_Open
@@ -900,6 +908,14 @@ WLANTL_ClearSTAClient
 );
 
 /*===========================================================================
+ * tl_shim_flush_cache_rx_queue() - flush cache rx queue frame
+ *
+ *
+ * Return: None
+ ============================================================================*/
+void tl_shim_flush_cache_rx_queue(void);
+
+/*===========================================================================
 
   FUNCTION    WLANTL_ChangeSTAState
 
@@ -2931,7 +2947,38 @@ bool WLANTL_disable_intrabss_fwd(void *vdev);
 VOS_STATUS WLANTL_RegisterOCBPeer(void *vos_ctx, uint8_t *mac_addr,
     uint8_t *peer_id);
 
+/**
+ * tl_register_vir_mon_cb() - register the HDD monitor callback to TL.
+ * @vos_ctx: pointer to vos context
+ * @rxcb: HDD rx callback function
+ *
+ * Return:VOS_STATUS_SUCCESS on success, or others failure.
+ */
+VOS_STATUS
+tl_register_vir_mon_cb(void *vos_ctx, WLANTL_STARxCBType rxcb);
+
+/**
+ * tl_deregister_vir_mon_cb() - deregister the HDD monitor callback to TL.
+ * @vos_ctx: pointer to vos context
+ *
+ * Return:VOS_STATUS_SUCCESS on success, or others failure.
+ */
+VOS_STATUS
+tl_deregister_vir_mon_cb(void *vos_ctx);
+
 void WLANTL_display_datapath_stats(void *vos_ctx, uint16_t bitmap);
 void WLANTL_clear_datapath_stats(void *vos_ctx, uint16_t bitmap);
 
+#ifdef QCA_SUPPORT_TXRX_LOCAL_PEER_ID
+/**
+ * tl_shim_get_sta_id_by_addr() - get peer local id given the MAC address.
+ * @vos_context: pointer to vos context
+ * @mac_addr: pointer to mac address
+ *
+ * Return: local id of the peer given the MAC address.
+ */
+uint16_t tl_shim_get_sta_id_by_addr(void *vos_context, uint8_t *mac_addr);
+#else
+#define tl_shim_get_sta_id_by_addr(vos_context,mac_addr) 0
+#endif
 #endif /* #ifndef WLAN_QCT_WLANTL_H */
diff --git a/drivers/staging/qcacld-2.0/CORE/UTILS/FWLOG/dbglog_host.c b/drivers/staging/qcacld-2.0/CORE/UTILS/FWLOG/dbglog_host.c
index 255e8a2d576..7a7be6ddade 100644
--- a/drivers/staging/qcacld-2.0/CORE/UTILS/FWLOG/dbglog_host.c
+++ b/drivers/staging/qcacld-2.0/CORE/UTILS/FWLOG/dbglog_host.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -42,6 +42,9 @@
 #include <wlan_hdd_wext.h>
 #include <net/sock.h>
 #include <linux/netlink.h>
+#ifdef CNSS_GENL
+#include <net/cnss_nl.h>
+#endif
 
 #ifdef WLAN_OPEN_SOURCE
 #include <linux/debugfs.h>
@@ -1771,12 +1774,6 @@ int dbglog_report_enable(wmi_unified_t  wmi_handle, bool isenable)
 {
     int bitmap[2] = {0};
 
-    if (isenable > TRUE) {
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("dbglog_report_enable:Invalid value %d\n",
-        isenable));
-        return -EINVAL;
-    }
-
     if(isenable){
 	/* set the vap enable bitmap */
         dbglog_set_vap_enable_bitmap(wmi_handle, 0xFFFF);
@@ -1995,6 +1992,24 @@ dbglog_debugfs_raw_data(wmi_unified_t wmi_handle, const u_int8_t *buf, A_UINT32
 }
 #endif /* WLAN_OPEN_SOURCE */
 
+/**
+ * nl_srv_bcast_fw_logs() - Wrapper func to send bcast msgs to FW logs mcast grp
+ * @skb: sk buffer pointer
+ *
+ * Sends the bcast message to FW logs multicast group with generic nl socket
+ * if CNSS_GENL is enabled. Else, use the legacy netlink socket to send.
+ *
+ * Return: zero on success, error code otherwise
+ */
+static int nl_srv_bcast_fw_logs(struct sk_buff *skb)
+{
+#ifdef CNSS_GENL
+	return nl_srv_bcast(skb, CLD80211_MCGRP_FW_LOGS, WLAN_NL_MSG_CNSS_DIAG);
+#else
+	return nl_srv_bcast(skb);
+#endif
+}
+
 /*
  * Package the data from the fw diag WMI event handler.
  * Pass this data to cnss-diag service
@@ -2042,11 +2057,11 @@ send_fw_diag_nl_data(const u_int8_t *buffer,
         /* data buffer should offset after the nlmsg_hdr + sizeof(int) radio */
         memcpy(nlmsg_data(nlh) + sizeof(radio), buffer, len);
 
-        res = nl_srv_bcast(skb_out);
+        res = nl_srv_bcast_fw_logs(skb_out);
         if ((res < 0) && (res != -ESRCH))
         {
             AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,
-                            ("%s: nl_srv_bcast failed 0x%x \n", __func__, res));
+                            ("%s: nl_srv_bcast_fw_logs failed 0x%x \n", __func__, res));
             return res;
         }
     }
@@ -2104,10 +2119,10 @@ send_diag_netlink_data(const u_int8_t *buffer, A_UINT32 len, A_UINT32 cmd)
         slot->dropped = get_version;
         memcpy(slot->payload, buffer, len);
 
-        res = nl_srv_bcast(skb_out);
+        res = nl_srv_bcast_fw_logs(skb_out);
         if ((res < 0) && (res != -ESRCH)) {
             AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,
-                            ("%s: nl_srv_bcast failed 0x%x \n", __func__, res));
+                            ("%s: nl_srv_bcast_fw_logs failed 0x%x \n", __func__, res));
             return res;
         }
     }
@@ -2140,7 +2155,6 @@ dbglog_process_netlink_data(wmi_unified_t wmi_handle, const u_int8_t *buffer,
     if (vos_is_multicast_logging())
     {
         slot_len = sizeof(*slot) + ATH6KL_FWLOG_PAYLOAD_SIZE + sizeof(radio);
-
         skb_out = nlmsg_new(slot_len, GFP_KERNEL);
         if (!skb_out)
         {
@@ -2167,11 +2181,11 @@ dbglog_process_netlink_data(wmi_unified_t wmi_handle, const u_int8_t *buffer,
         slot->dropped = cpu_to_le32(dropped);
         memcpy(slot->payload, buffer, len);
 
-        res = nl_srv_bcast(skb_out);
+        res = nl_srv_bcast_fw_logs(skb_out);
         if ((res < 0) && (res != -ESRCH))
         {
             AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,
-                            ("%s: nl_srv_bcast failed 0x%x \n", __func__, res));
+                            ("%s: nl_srv_bcast_fw_logs failed 0x%x \n", __func__, res));
             return res;
         }
     }
@@ -2190,7 +2204,7 @@ diag_fw_handler(ol_scn_t scn, u_int8_t *data, u_int32_t datalen)
 {
 
     tp_wma_handle wma = (tp_wma_handle)scn;
-    wmitlv_cmd_param_info *param_buf;
+    WMI_DIAG_EVENTID_param_tlvs *param_buf;
     u_int8_t *datap;
     u_int32_t len = 0;
     u_int32_t *buffer;
@@ -2205,22 +2219,37 @@ diag_fw_handler(ol_scn_t scn, u_int8_t *data, u_int32_t datalen)
         len = datalen;
         wma->is_fw_assert = 0;
     } else {
-        param_buf = (wmitlv_cmd_param_info *) data;
+        param_buf = (WMI_DIAG_EVENTID_param_tlvs *) data;
         if (!param_buf) {
             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
                             ("Get NULL point message from FW\n"));
             return -1;
         }
 
-        param_buf = (wmitlv_cmd_param_info *) data;
-        datap = param_buf->tlv_ptr;
-        len = param_buf->num_elements;
+        param_buf = (WMI_DIAG_EVENTID_param_tlvs *) data;
+        datap = param_buf->bufp;
+        len = param_buf->num_bufp;
         if (!get_version) {
+		if (len < 2*(sizeof(uint32_t))) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+				("len is less than expected\n"));
+			return A_ERROR;
+		}
              buffer = (u_int32_t *)datap  ;
              buffer++; /* skip offset */
              if (WLAN_DIAG_TYPE_CONFIG == DIAG_GET_TYPE(*buffer)) {
+			if (len < 3*(sizeof(uint32_t))) {
+				AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+						("len is less than expected\n"));
+				return A_ERROR;
+		}
                  buffer++; /* skip  */
                  if (DIAG_VERSION_INFO == DIAG_GET_ID(*buffer)) {
+			 if (len < 4*(sizeof(uint32_t))) {
+				AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+						("len is less than expected\n"));
+				return A_ERROR;
+			}
                     buffer++; /* skip  */
                     /* get payload */
                     get_version = *buffer;
@@ -2271,19 +2300,22 @@ diag_fw_handler(ol_scn_t scn, u_int8_t *data, u_int32_t datalen)
 static int
 process_fw_diag_event_data(uint8_t *datap, uint32_t num_data)
 {
-	uint32_t i;
 	uint32_t diag_type;
 	uint32_t nl_data_len; /* diag hdr + payload */
 	uint32_t diag_data_len; /* each fw diag payload */
 	struct wlan_diag_data *diag_data;
 
-	for (i = 0; i < num_data; i++) {
+	while (num_data > 0) {
 		diag_data = (struct wlan_diag_data *)datap;
 		diag_type = WLAN_DIAG_0_TYPE_GET(diag_data->word0);
 		diag_data_len = WLAN_DIAG_0_LEN_GET(diag_data->word0);
 		/* Length of diag struct and len of payload */
 		nl_data_len = sizeof(struct wlan_diag_data) + diag_data_len;
-
+		if (nl_data_len > num_data) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+					("processed all the messages\n"));
+			return 0;
+		}
 		switch (diag_type) {
 		case DIAG_TYPE_FW_EVENT:
 			return send_fw_diag_nl_data(datap, nl_data_len,
@@ -2296,6 +2328,7 @@ process_fw_diag_event_data(uint8_t *datap, uint32_t num_data)
 		}
 		/* Move to the next event and send to cnss-diag */
 		datap += nl_data_len;
+		num_data -= nl_data_len;
 	}
 
 	return 0;
@@ -4327,6 +4360,43 @@ int dbglog_debugfs_remove(wmi_unified_t wmi_handle)
 }
 #endif /* WLAN_OPEN_SOURCE */
 
+/**
+ * cnss_diag_handle_crash_inject() - API to handle crash inject command
+ * @slot: pointer to struct dbglog_slot
+ *
+ * API to handle CNSS diag crash inject command
+ *
+ * Return: None
+ */
+static void cnss_diag_handle_crash_inject(struct dbglog_slot *slot)
+{
+	switch (slot->diag_type) {
+	case DIAG_TYPE_CRASH_INJECT:
+		if (slot->length != 2) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("crash_inject cmd error\n"));
+			return;
+		}
+
+		AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+				("%s : DIAG_TYPE_CRASH_INJECT: %d %d\n", __func__,
+				 slot->payload[0], slot->payload[1]));
+		if (!tgt_assert_enable) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+					("%s: tgt Assert Disabled\n", __func__));
+			return;
+		}
+		process_wma_set_command_twoargs(0,
+				(int)GEN_PARAM_CRASH_INJECT,
+				slot->payload[0],
+				slot->payload[1], GEN_CMD);
+		break;
+	default:
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown cmd[%d] error\n",
+						slot->diag_type));
+		break;
+	}
+}
+
 /**---------------------------------------------------------------------------
   \brief cnss_diag_msg_callback() - Call back invoked by netlink service
 
@@ -4340,46 +4410,88 @@ int dbglog_debugfs_remove(wmi_unified_t wmi_handle)
 --------------------------------------------------------------------------*/
 int cnss_diag_msg_callback(struct sk_buff *skb)
 {
-    struct nlmsghdr *nlh;
-    struct dbglog_slot *slot;
-    A_UINT8 *msg;
+	struct nlmsghdr *nlh;
+	A_UINT8 *msg;
+
+	nlh = (struct nlmsghdr *)skb->data;
+	if (!nlh) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Netlink header null \n",
+						__func__));
+		return -1;
+	}
 
-    nlh = (struct nlmsghdr *)skb->data;
-    if (!nlh)
-    {
-       AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Netlink header null \n", __func__));
-       return -1;
-    }
+	msg = NLMSG_DATA(nlh);
+	cnss_diag_handle_crash_inject((struct dbglog_slot *)msg);
 
-    msg = NLMSG_DATA(nlh);
-
-    slot = (struct dbglog_slot *)msg;
-    switch (slot->diag_type) {
-    case DIAG_TYPE_CRASH_INJECT:
-        if (slot->length == 2) {
-            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
-                           ("%s : DIAG_TYPE_CRASH_INJECT: %d %d\n", __func__,
-                           slot->payload[0], slot->payload[1]));
-            if (!tgt_assert_enable) {
-                AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
-                               ("%s: tgt Assert Disabled\n", __func__));
-                return 0;
-            }
-            process_wma_set_command_twoargs(0,
-                                           (int)GEN_PARAM_CRASH_INJECT,
-                                           slot->payload[0],
-                                           slot->payload[1], GEN_CMD);
-        }
-        else
-            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("crash_inject cmd error\n"));
-    break;
-    default:
-    break;
-    }
-    return 0;
+	return 0;
+}
+
+#ifdef CNSS_GENL
+
+/**
+ * cnss_diag_cmd_handler() - API to handle CNSS diag command
+ * @data: Data received
+ * @data_len: length of the data received
+ * @ctx: Pointer to stored context
+ * @pid: Process ID
+ *
+ * API to handle CNSS diag commands from user space
+ *
+ * Return: None
+ */
+static void cnss_diag_cmd_handler(const void *data, int data_len,
+						void *ctx, int pid)
+{
+	struct dbglog_slot *slot = NULL;
+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
+
+	/*
+	 * audit note: it is ok to pass a NULL policy here since a
+	 * length check on the data is added later already
+	 */
+	if (nla_parse(tb, CLD80211_ATTR_MAX, data, data_len, NULL)) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: nla parse fails \n",
+							__func__));
+		return;
+	}
+
+	if (!tb[CLD80211_ATTR_DATA]) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: attr VENDOR_DATA fails \n",
+								__func__));
+		return;
+	}
+
+	if (nla_len(tb[CLD80211_ATTR_DATA]) != sizeof(struct dbglog_slot)) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: attr length check fails\n",
+				__func__));
+		return;
+	}
+	slot = (struct dbglog_slot *)nla_data(tb[CLD80211_ATTR_DATA]);
+
+	if (!slot) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: data NULL \n", __func__));
+		return;
+	}
+
+	cnss_diag_handle_crash_inject(slot);
+	return;
+}
 
+/**
+ * cnss_diag_activate_service() - API to register CNSS diag cmd handler
+ *
+ * API to register the CNSS diag command handler using new genl infra.
+ * Return type is zero to match with legacy prototype
+ *
+ * Return: 0
+ */
+int cnss_diag_activate_service(void)
+{
+	register_cld_cmd_cb(WLAN_NL_MSG_CNSS_DIAG, cnss_diag_cmd_handler, NULL);
+	return 0;
 }
 
+#else
 /**---------------------------------------------------------------------------
   \brief cnss_diag_activate_service() - Activate cnss_diag message handler
 
@@ -4391,7 +4503,7 @@ int cnss_diag_msg_callback(struct sk_buff *skb)
 
   \return - 0 for success, non zero for failure
 --------------------------------------------------------------------------*/
-int cnss_diag_activate_service()
+int cnss_diag_activate_service(void)
 {
     int ret = 0;
 
@@ -4405,6 +4517,7 @@ int cnss_diag_activate_service()
     kd_nl_init = TRUE;
     return 0;
 }
+#endif
 
 A_BOOL
 dbglog_wow_print_handler(
diff --git a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/include/pktlog_ac_api.h b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/include/pktlog_ac_api.h
index a30aaab2b07..5fdc83c575b 100644
--- a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/include/pktlog_ac_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/include/pktlog_ac_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -72,7 +72,7 @@ struct ath_pktlog_info {
 	/* Size of buffer in bytes */
 	int32_t buf_size;
 	spinlock_t log_lock;
-
+	struct mutex pktlog_mutex;
 	/* Threshold of TCP SACK packets for triggered stop */
 	int sack_thr;
 
diff --git a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/linux_ac.c b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/linux_ac.c
index 70f5fc5cff7..0bf7982d53f 100644
--- a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/linux_ac.c
+++ b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/linux_ac.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -82,14 +82,12 @@ static int pktlog_attach(struct ol_softc *sc);
 static void pktlog_detach(struct ol_softc *sc);
 static int pktlog_open(struct inode *i, struct file *f);
 static int pktlog_release(struct inode *i, struct file *f);
-static int pktlog_mmap(struct file *f, struct vm_area_struct *vma);
 static ssize_t pktlog_read(struct file *file, char *buf, size_t nbytes,
 			   loff_t * ppos);
 
 static struct file_operations pktlog_fops = {
 	open:pktlog_open,
 	release:pktlog_release,
-	mmap:pktlog_mmap,
 	read:pktlog_read,
 };
 
@@ -122,6 +120,7 @@ int pktlog_alloc_buf(struct ol_softc *scn)
 	unsigned long vaddr;
 	struct page *vpg;
 	struct ath_pktlog_info *pl_info;
+	struct ath_pktlog_buf *buffer;
 
 	if (!scn || !scn->pdev_txrx_handle->pl_dev) {
 		printk(PKTLOG_TAG
@@ -135,19 +134,28 @@ int pktlog_alloc_buf(struct ol_softc *scn)
 
 	page_cnt = (sizeof(*(pl_info->buf)) + pl_info->buf_size) / PAGE_SIZE;
 
-	if ((pl_info->buf = vmalloc((page_cnt + 2) * PAGE_SIZE)) == NULL) {
+	spin_lock_bh(&pl_info->log_lock);
+	if(pl_info->buf != NULL) {
+		printk("Buffer is already in use\n");
+		spin_unlock_bh(&pl_info->log_lock);
+		return -EINVAL;
+	}
+	spin_unlock_bh(&pl_info->log_lock);
+
+	if ((buffer = vmalloc((page_cnt + 2) * PAGE_SIZE)) == NULL) {
 		printk(PKTLOG_TAG
 		       "%s: Unable to allocate buffer "
 		       "(%d pages)\n", __func__, page_cnt);
 		return -ENOMEM;
 	}
 
-	pl_info->buf = (struct ath_pktlog_buf *)
-			(((unsigned long) (pl_info->buf) + PAGE_SIZE - 1)
+
+	buffer = (struct ath_pktlog_buf *)
+			(((unsigned long) (buffer) + PAGE_SIZE - 1)
 			& PAGE_MASK);
 
-	for (vaddr = (unsigned long) (pl_info->buf);
-	     vaddr < ((unsigned long) (pl_info->buf) + (page_cnt * PAGE_SIZE));
+	for (vaddr = (unsigned long) (buffer);
+	     vaddr < ((unsigned long) (buffer) + (page_cnt * PAGE_SIZE));
 	     vaddr += PAGE_SIZE) {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,25))
 		vpg = vmalloc_to_page((const void *) vaddr);
@@ -157,6 +165,12 @@ int pktlog_alloc_buf(struct ol_softc *scn)
 		SetPageReserved(vpg);
 	}
 
+	spin_lock_bh(&pl_info->log_lock);
+	if(pl_info->buf != NULL)
+		pktlog_release_buf(scn);
+
+	pl_info->buf =  buffer;
+	spin_unlock_bh(&pl_info->log_lock);
 	return 0;
 }
 
@@ -200,6 +214,7 @@ pktlog_cleanup(struct ath_pktlog_info *pl_info)
 {
 	pl_info->log_state = 0;
 	PKTLOG_LOCK_DESTROY(pl_info);
+	mutex_destroy(&pl_info->pktlog_mutex);
 }
 
 /* sysctl procfs handler to enable pktlog */
@@ -548,10 +563,12 @@ static void pktlog_detach(struct ol_softc *scn)
 	pl_info = pl_dev->pl_info;
 	remove_proc_entry(WLANDEV_BASENAME, g_pktlog_pde);
 	pktlog_sysctl_unregister(pl_dev);
-	pktlog_cleanup(pl_info);
 
+	spin_lock_bh(&pl_info->log_lock);
 	if (pl_info->buf)
 		pktlog_release_buf(scn);
+	spin_unlock_bh(&pl_info->log_lock);
+	pktlog_cleanup(pl_info);
 
 	if (pl_dev) {
 		vos_mem_free(pl_info);
@@ -601,12 +618,16 @@ pktlog_read_proc_entry(char *buf, size_t nbytes, loff_t *ppos,
 	int rem_len;
 	int start_offset, end_offset;
 	int fold_offset, ppos_data, cur_rd_offset, cur_wr_offset;
-	struct ath_pktlog_buf *log_buf = pl_info->buf;
+	struct ath_pktlog_buf *log_buf;
+
+	spin_lock_bh(&pl_info->log_lock);
+	log_buf = pl_info->buf;
 
 	*read_complete = false;
 
 	if (log_buf == NULL) {
 		*read_complete = true;
+		spin_unlock_bh(&pl_info->log_lock);
 		return 0;
 	}
 
@@ -709,7 +730,6 @@ rd_done:
 	*ppos += ret_val;
 
 	if (ret_val == 0) {
-		PKTLOG_LOCK(pl_info);
 		/* Write pointer might have been updated during the read.
 		 * So, if some data is written into, lets not reset the pointers.
 		 * We can continue to read from the offset position
@@ -723,14 +743,13 @@ rd_done:
 			pl_info->buf->offset = PKTLOG_READ_OFFSET;
 			*read_complete = true;
 		}
-		PKTLOG_UNLOCK(pl_info);
 	}
-
+	spin_unlock_bh(&pl_info->log_lock);
 	return ret_val;
 }
 
 static ssize_t
-pktlog_read(struct file *file, char *buf, size_t nbytes, loff_t *ppos)
+__pktlog_read(struct file *file, char *buf, size_t nbytes, loff_t *ppos)
 {
 	size_t bufhdr_size;
 	size_t count = 0, ret_val = 0;
@@ -745,10 +764,15 @@ pktlog_read(struct file *file, char *buf, size_t nbytes, loff_t *ppos)
 	struct ath_pktlog_info *pl_info = (struct ath_pktlog_info *)
 					  proc_entry->data;
 #endif
-	struct ath_pktlog_buf *log_buf = pl_info->buf;
+	struct ath_pktlog_buf *log_buf;
+
+	spin_lock_bh(&pl_info->log_lock);
+	log_buf = pl_info->buf;
 
-	if (log_buf == NULL)
+	if (log_buf == NULL) {
+		spin_unlock_bh(&pl_info->log_lock);
 		return 0;
+	}
 
 	if (*ppos == 0 && pl_info->log_state) {
 		pl_info->saved_state = pl_info->log_state;
@@ -763,11 +787,13 @@ pktlog_read(struct file *file, char *buf, size_t nbytes, loff_t *ppos)
 
 	if (*ppos < bufhdr_size) {
 		count = MIN((bufhdr_size - *ppos), rem_len);
+		spin_unlock_bh(&pl_info->log_lock);
 		if (copy_to_user(buf, ((char *)&log_buf->bufhdr) + *ppos,
 				 count))
 			return -EFAULT;
 		rem_len -= count;
 		ret_val += count;
+		spin_lock_bh(&pl_info->log_lock);
 	}
 
 	start_offset = log_buf->rd_offset;
@@ -809,21 +835,25 @@ pktlog_read(struct file *file, char *buf, size_t nbytes, loff_t *ppos)
 			goto rd_done;
 
 		count = MIN(rem_len, (end_offset - ppos_data + 1));
+		spin_unlock_bh(&pl_info->log_lock);
 		if (copy_to_user(buf + ret_val,
 				 log_buf->log_data + ppos_data,
 				 count))
 			return -EFAULT;
 		ret_val += count;
 		rem_len -= count;
+		spin_lock_bh(&pl_info->log_lock);
 	} else {
 		if (ppos_data <= fold_offset) {
 			count = MIN(rem_len, (fold_offset - ppos_data + 1));
+			spin_unlock_bh(&pl_info->log_lock);
 			if (copy_to_user(buf + ret_val,
 					 log_buf->log_data + ppos_data,
 					 count))
 				return -EFAULT;
 			ret_val += count;
 			rem_len -= count;
+			spin_lock_bh(&pl_info->log_lock);
 		}
 
 		if (rem_len == 0)
@@ -835,12 +865,14 @@ pktlog_read(struct file *file, char *buf, size_t nbytes, loff_t *ppos)
 
 		if (ppos_data <= end_offset) {
 			count = MIN(rem_len, (end_offset - ppos_data + 1));
+			spin_unlock_bh(&pl_info->log_lock);
 			if (copy_to_user(buf + ret_val,
 					 log_buf->log_data + ppos_data,
 					 count))
 				return -EFAULT;
 			ret_val += count;
 			rem_len -= count;
+			spin_lock_bh(&pl_info->log_lock);
 		}
 	}
 
@@ -851,6 +883,25 @@ rd_done:
 	}
 	*ppos += ret_val;
 
+	spin_unlock_bh(&pl_info->log_lock);
+	return ret_val;
+}
+
+static ssize_t
+pktlog_read(struct file *file, char *buf, size_t nbytes, loff_t *ppos)
+{
+	size_t ret_val = 0;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)
+	struct ath_pktlog_info *pl_info = (struct ath_pktlog_info *)
+					  PDE_DATA(file->f_path.dentry->d_inode);
+#else
+	struct proc_dir_entry *proc_entry = PDE(file->f_dentry->d_inode);
+	struct ath_pktlog_info *pl_info = (struct ath_pktlog_info *)
+					  proc_entry->data;
+#endif
+	mutex_lock(&pl_info->pktlog_mutex);
+	ret_val = __pktlog_read(file, buf, nbytes, ppos);
+	mutex_unlock(&pl_info->pktlog_mutex);
 	return ret_val;
 }
 
@@ -903,106 +954,6 @@ static volatile void *pktlog_virt_to_logical(volatile void *addr)
 }
 #endif
 
-/* vma operations for mapping vmalloced area to user space */
-static void pktlog_vopen(struct vm_area_struct *vma)
-{
-	PKTLOG_MOD_INC_USE_COUNT;
-}
-
-static void pktlog_vclose(struct vm_area_struct *vma)
-{
-	PKTLOG_MOD_DEC_USE_COUNT;
-}
-
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25)
-int pktlog_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-{
-	unsigned long address = (unsigned long)vmf->virtual_address;
-
-	if (address == 0UL)
-		return VM_FAULT_NOPAGE;
-
-	if (vmf->pgoff > vma->vm_end)
-		return VM_FAULT_SIGBUS;
-
-	get_page(virt_to_page((void *)address));
-	vmf->page = virt_to_page((void *)address);
-	return VM_FAULT_MINOR;
-}
-#else
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-struct page *pktlog_vmmap(struct vm_area_struct *vma, unsigned long addr,
-			  int *type)
-#else
-struct page *pktlog_vmmap(struct vm_area_struct *vma, unsigned long addr,
-			  int write_access)
-#endif
-{
-	unsigned long offset, vaddr;
-	struct proc_dir_entry *proc_entry;
-	struct ath_pktlog_info *pl_info =
-
-	proc_entry = PDE(vma->vm_file->f_dentry->d_inode);
-	pl_info = (struct ath_pktlog_info *)proc_entry->data;
-
-	offset = addr - vma->vm_start + (vma->vm_pgoff << PAGE_SHIFT);
-	vaddr = (unsigned long) pktlog_virt_to_logical(
-					(void *)(pl_info->buf) + offset);
-
-	if (vaddr == 0UL) {
-		printk(PKTLOG_TAG "%s: page fault out of range\n", __func__);
-		return ((struct page *) 0UL);
-	}
-
-	/* increment the usage count of the page */
-	get_page(virt_to_page((void*)vaddr));
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-	if (type)
-		*type = VM_FAULT_MINOR;
-#endif
-
-	return virt_to_page((void *)vaddr);
-}
-#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) */
-
-static struct vm_operations_struct pktlog_vmops = {
-	open:pktlog_vopen,
-	close:pktlog_vclose,
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25)
-	fault:pktlog_fault,
-#else
-	nopage:pktlog_vmmap,
-#endif
-};
-
-static int pktlog_mmap(struct file *file, struct vm_area_struct *vma)
-{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)
-	struct ath_pktlog_info *pl_info = (struct ath_pktlog_info *)
-					  PDE_DATA(file->f_path.dentry->d_inode);
-#else
-	struct proc_dir_entry *proc_entry = PDE(file->f_dentry->d_inode);
-	struct ath_pktlog_info *pl_info = (struct ath_pktlog_info *)
-					  proc_entry->data;
-#endif
-
-	if (vma->vm_pgoff != 0) {
-		/* Entire buffer should be mapped */
-		return -EINVAL;
-	}
-
-	if (!pl_info->buf) {
-		printk(PKTLOG_TAG "%s: Log buffer unavailable\n", __func__);
-		return -ENOMEM;
-	}
-
-	vma->vm_flags |= VM_LOCKED;
-	vma->vm_ops = &pktlog_vmops;
-	pktlog_vopen(vma);
-	return 0;
-}
-
 int pktlogmod_init(void *context)
 {
 	int ret;
diff --git a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_ac.c b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_ac.c
index 3bc0ae1f422..679a78ccfab 100644
--- a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_ac.c
+++ b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_ac.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -280,6 +280,7 @@ pktlog_init(struct ol_softc *scn)
 
 	OS_MEMZERO(pl_info, sizeof(*pl_info));
 	PKTLOG_LOCK_INIT(pl_info);
+	mutex_init(&pl_info->pktlog_mutex);
 
 	pl_info->buf_size = PKTLOG_DEFAULT_BUFSIZE;
 	pl_info->buf = NULL;
@@ -301,8 +302,9 @@ pktlog_init(struct ol_softc *scn)
 	PKTLOG_RCUPDATE_SUBSCRIBER.callback = pktlog_callback;
 }
 
-int
-pktlog_enable(struct ol_softc *scn, int32_t log_state)
+
+static int
+__pktlog_enable(struct ol_softc *scn, int32_t log_state)
 {
 	struct ol_pktlog_dev_t *pl_dev;
 	struct ath_pktlog_info *pl_info;
@@ -312,7 +314,7 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state)
 	if (!scn) {
 		printk("%s: Invalid scn context\n", __func__);
 		ASSERT(0);
-		return -1;
+		return A_ERROR;
 	}
 
 	txrx_pdev = scn->pdev_txrx_handle;
@@ -326,7 +328,7 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state)
 	if (!pl_dev) {
 		printk("%s: Invalid pktlog context\n", __func__);
 		ASSERT(0);
-		return -1;
+		return A_ERROR;
 	}
 
 	pl_info = pl_dev->pl_info;
@@ -345,10 +347,11 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state)
 			if (!pl_info->buf) {
 				printk("%s: pktlog buf alloc failed\n", __func__);
 				ASSERT(0);
-				return -1;
+				return A_ERROR;
 			}
 		}
 
+		spin_lock_bh(&pl_info->log_lock);
 		pl_info->buf->bufhdr.version = CUR_PKTLOG_VER;
 		pl_info->buf->bufhdr.magic_num = PKTLOG_MAGIC_NUM;
 		pl_info->buf->wr_offset = 0;
@@ -357,6 +360,7 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state)
 		pl_info->buf->bytes_written = 0;
 		pl_info->buf->msg_index = 1;
 		pl_info->buf->offset = PKTLOG_READ_OFFSET;
+		spin_unlock_bh(&pl_info->log_lock);
 
 		pl_info->start_time_thruput = OS_GET_TIMESTAMP();
 		pl_info->start_time_per = pl_info->start_time_thruput;
@@ -365,12 +369,13 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state)
 		if (wdi_pktlog_subscribe(txrx_pdev, log_state)) {
 			printk("Unable to subscribe to the WDI %s\n",
 			       __func__);
-			return -1;
+			return A_ERROR;
 		}
 		/* WMI command to enable pktlog on the firmware */
 		if (pktlog_enable_tgt(scn, log_state)) {
-			printk("Device cannot be enabled, %s\n", __func__);
-			return -1;
+			adf_os_print("Device cannot be enabled, %s\n", __func__);
+			wdi_pktlog_unsubscribe(txrx_pdev, pl_info->log_state);
+			return A_ERROR;
 		} else {
 			pl_dev->tgt_pktlog_enabled = true;
 		}
@@ -378,23 +383,63 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state)
 		pl_dev->pl_funcs->pktlog_disable(scn);
 		pl_dev->tgt_pktlog_enabled = false;
 		if (wdi_pktlog_unsubscribe(txrx_pdev, pl_info->log_state)) {
-			printk("Cannot unsubscribe pktlog from the WDI\n");
-			return -1;
+			adf_os_print("%s: Cannot unsubscribe pktlog from the WDI\n",
+				__func__);
+			return A_ERROR;
 		}
 	}
 
 	pl_info->log_state = log_state;
 	return 0;
+
 }
 
-int
-pktlog_setsize(struct ol_softc *scn, int32_t size)
+int pktlog_enable(struct ol_softc *scn, int32_t log_state)
+{
+	struct ol_pktlog_dev_t *pl_dev;
+	struct ath_pktlog_info *pl_info;
+	int error;
+
+	if (!scn) {
+		printk("%s: Invalid scn context\n", __func__);
+		ASSERT(0);
+		return A_ERROR;
+	}
+
+	pl_dev = scn->pdev_txrx_handle->pl_dev;
+	if (!pl_dev) {
+		printk("%s: Invalid pktlog context\n", __func__);
+		ASSERT(0);
+		return A_ERROR;
+	}
+
+	pl_info = pl_dev->pl_info;
+
+	if (!pl_info)
+		return 0;
+
+	mutex_lock(&pl_info->pktlog_mutex);
+	error = __pktlog_enable(scn, log_state);
+	mutex_unlock(&pl_info->pktlog_mutex);
+	return error;
+}
+
+#define ONE_MEGABYTE (1024 * 1024)
+#define MAX_ALLOWED_PKTLOG_SIZE (16 * ONE_MEGABYTE)
+
+static int
+__pktlog_setsize(struct ol_softc *scn, int32_t size)
 {
 	struct ol_pktlog_dev_t *pl_dev = scn->pdev_txrx_handle->pl_dev;
 	struct ath_pktlog_info *pl_info = pl_dev->pl_info;
 
-	if (size < 0)
+	if (size < ONE_MEGABYTE || size > MAX_ALLOWED_PKTLOG_SIZE) {
+		printk("%s: Cannot Set Pktlog Buffer size of %d bytes."
+			"Min required is %d MB and Max allowed is %d MB.\n",
+			__func__, size, (ONE_MEGABYTE/ONE_MEGABYTE),
+			(MAX_ALLOWED_PKTLOG_SIZE/ONE_MEGABYTE));
 		return -EINVAL;
+	}
 
 	if (size == pl_info->buf_size)
 		return 0;
@@ -404,12 +449,35 @@ pktlog_setsize(struct ol_softc *scn, int32_t size)
 		return -EINVAL;
 	}
 
+	spin_lock_bh(&pl_info->log_lock);
 	if (pl_info->buf != NULL)
 		pktlog_release_buf(scn);
 
 	if (size != 0)
 		pl_info->buf_size = size;
+	spin_unlock_bh(&pl_info->log_lock);
 
 	return 0;
 }
+int
+pktlog_setsize(struct ol_softc *scn, int32_t size)
+{
+        struct ol_pktlog_dev_t *pl_dev;
+        struct ath_pktlog_info *pl_info;
+	int status;
+
+	if (!scn) {
+		printk("%s: Invalid scn context\n", __func__);
+		ASSERT(0);
+		return A_ERROR;
+	}
+
+	pl_dev = scn->pdev_txrx_handle->pl_dev;
+	pl_info = pl_dev->pl_info;
+
+	mutex_lock(&pl_info->pktlog_mutex);
+	status = __pktlog_setsize(scn, size);
+	mutex_unlock(&pl_info->pktlog_mutex);
+	return status;
+}
 #endif /* REMOVE_PKT_LOG */
diff --git a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_internal.c b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_internal.c
index a781c26c4e7..ec27459b405 100644
--- a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_internal.c
+++ b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_internal.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -35,6 +35,7 @@
 #include "pktlog_ac_i.h"
 #include "wma_api.h"
 #include "wlan_logging_sock_svc.h"
+#include "ol_txrx.h"
 
 #define TX_DESC_ID_LOW_MASK	0xffff
 #define TX_DESC_ID_LOW_SHIFT	0
@@ -208,6 +209,14 @@ static void process_ieee_hdr(void *data)
 	}
 }
 
+static inline uint16_t get_desc_pool_size(struct ol_txrx_pdev_t *txrx_pdev)
+{
+	if (txrx_pdev->cfg.is_high_latency)
+		return ol_tx_desc_pool_size_hl(txrx_pdev->ctrl_pdev);
+	else
+		return ol_cfg_target_tx_credit(txrx_pdev->ctrl_pdev);
+}
+
 A_STATUS
 process_tx_info(struct ol_txrx_pdev_t *txrx_pdev,
 		void *data)
@@ -314,6 +323,10 @@ process_tx_info(struct ol_txrx_pdev_t *txrx_pdev,
 		 */
 		txctl_log.priv.frm_hdr = frm_hdr;
 		adf_os_assert(txctl_log.priv.txdesc_ctl);
+		adf_os_assert(pl_hdr.size < sizeof(txctl_log.priv.txdesc_ctl));
+		pl_hdr.size = (pl_hdr.size > sizeof(txctl_log.priv.txdesc_ctl))
+			       ? sizeof(txctl_log.priv.txdesc_ctl) :
+			       pl_hdr.size;
 		adf_os_mem_copy((void *)&txctl_log.priv.txdesc_ctl,
 				((void *)data + sizeof(struct ath_pktlog_hdr)),
 				pl_hdr.size);
@@ -381,8 +394,19 @@ process_tx_info(struct ol_txrx_pdev_t *txrx_pdev,
 					     >> TX_DESC_ID_HIGH_SHIFT);
 				msdu_id += 1;
 			}
-			tx_desc = ol_tx_desc_find(txrx_pdev, tx_desc_id);
-			adf_os_assert(tx_desc);
+			if (tx_desc_id >= get_desc_pool_size(txrx_pdev)) {
+				adf_os_print("%s: drop due to invalid msdu id = %x\n",
+						__func__, tx_desc_id);
+				return A_ERROR;
+			}
+
+			tx_desc = ol_tx_desc_find_check(txrx_pdev, tx_desc_id);
+			if (!tx_desc) {
+				adf_os_print("%s: ignore invalid desc_id(%u)\n",
+						__func__, tx_desc_id);
+				return A_ERROR;
+			}
+
 			netbuf = tx_desc->netbuf;
 			htt_tx_desc = (uint32_t *) tx_desc->htt_tx_desc;
 			adf_os_assert(htt_tx_desc);
@@ -391,7 +415,7 @@ process_tx_info(struct ol_txrx_pdev_t *txrx_pdev,
 
 			if (len < (2 * IEEE80211_ADDR_LEN)) {
 				adf_os_print("TX frame does not have a valid address\n");
-				return -1;
+				return A_ERROR;
 			}
 			/* Adding header information for the TX data frames */
 			vdev_id = (u_int8_t)(*(htt_tx_desc +
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/event_defs.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/event_defs.h
index ca570d8e9d1..609b500f10c 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/event_defs.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/event_defs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012, 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1913,6 +1913,10 @@ typedef enum
   EVENT_TDLS_SCAN_BLOCK = 0xAB9,
   EVENT_WLAN_TDLS_TX_RX_MGMT = 0xABA,
   EVENT_WLAN_LOW_RESOURCE_FAILURE = 0xABB,
+  EVENT_WLAN_POWERSAVE_WOW_STATS = 0xB33,
+  EVENT_WLAN_SSR_REINIT_SUBSYSTEM = 0xB3C,
+  EVENT_WLAN_SSR_SHUTDOWN_SUBSYSTEM = 0xB3D,
+
 
   EVENT_NEXT_UNUSED_EVENT,
   EVENT_RSVD_START = 0x0800,
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/log_codes.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/log_codes.h
index a8efe0badae..b10d779f0ec 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/log_codes.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/log_codes.h
@@ -904,7 +904,7 @@ when       who     what, where, why
 /* Call Manager Serving System event log */
 #define LOG_CM_SS_EVENT_C                               (0x34F + LOG_1X_BASE_C)
 
-/* VcTcxo manager’s automatic frequency control log */
+/* VcTcxo manager’s automatic frequency control log */
 #define LOG_TCXOMGR_AFC_DATA_C                          (0x350 + LOG_1X_BASE_C)
 
 /* Clock transactions and general clocks status log */
@@ -1921,7 +1921,7 @@ when       who     what, where, why
 /*DTV CMMB ESSG Program Indication Information*/
 #define LOG_DTV_CMMB_ESG_PROGRAM_INDICATION_INFORMATION    ((0x4C0) + LOG_1X_BASE_C)
 
-/* Sensors ¨C binary output of converted sensor data */
+/* Sensors ¨C binary output of converted sensor data */
 #define LOG_CONVERTED_SENSOR_DATA_C                             ((0x4C1) + LOG_1X_BASE_C)
 
 /* CM Subscription event */
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_api.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_api.h
index 1f9aa6130a6..dc7d90f1afa 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_api.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -339,9 +339,50 @@ v_VOID_t vos_fwDumpReq(tANI_U32 cmd, tANI_U32 arg1, tANI_U32 arg2,
 
 v_BOOL_t vos_is_packet_log_enabled(void);
 
+v_BOOL_t vos_config_is_no_ack(void);
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+bool vos_is_ptp_rx_opt_enabled(void);
+bool vos_is_ptp_tx_opt_enabled(void);
+#else
+static inline bool vos_is_ptp_rx_opt_enabled(void)
+{
+	return false;
+}
+
+static inline bool vos_is_ptp_tx_opt_enabled(void)
+{
+	return false;
+}
+#endif
+
+#ifdef WLAN_FEATURE_DSRC
+bool vos_is_ocb_tx_per_pkt_stats_enabled(void);
+#else
+static inline bool vos_is_ocb_tx_per_pkt_stats_enabled(void)
+{
+	return false;
+}
+#endif
+
 v_U64_t vos_get_monotonic_boottime(void);
 
-void vos_trigger_recovery(void);
+/**
+ * vos_get_monotonic_boottime_ns - Get kenel boottime in ns
+ *
+ * Return: kernel boottime in nano sec
+ */
+v_U64_t vos_get_monotonic_boottime_ns(void);
+
+/**
+ * vos_get_bootbased_boottime_ns - Get kenel boottime in ns
+ * it includes the system suspend time also
+ * Return: kernel boottime in nano sec
+ */
+
+v_U64_t vos_get_bootbased_boottime_ns(void);
+
+void vos_trigger_recovery(bool);
 
 #ifdef FEATURE_WLAN_D0WOW
 v_VOID_t vos_pm_control(v_BOOL_t vote);
@@ -368,7 +409,7 @@ void vos_deinit_log_completion(void);
 VOS_STATUS vos_flush_logs(uint32_t is_fatal,
 		uint32_t indicator,
 		uint32_t reason_code,
-		bool dump_vos_trace);
+		uint32_t dump_vos_trace);
 void vos_wlan_flush_host_logs_for_fatal(void);
 void vos_logging_set_fw_flush_complete(void);
 void vos_probe_threads(void);
@@ -376,5 +417,25 @@ void vos_set_fatal_event(bool value);
 void vos_pkt_stats_to_logger_thread(void *pl_hdr, void *pkt_dump, void *data);
 int vos_get_radio_index(void);
 int vos_set_radio_index(int radio_index);
+void vos_svc_fw_shutdown_ind(struct device *dev);
+uint64_t vos_do_div(uint64_t, uint32_t);
+/**
+ * vos_do_div64() - Do uint64/64 divsion.
+ * @dividend: Dividend value
+ * @divisor: Divisor value
+ *
+ * Return: Quotient
+ */
+uint64_t vos_do_div64(uint64_t dividend, uint64_t divisor);
+VOS_STATUS vos_force_fw_dump(void);
+
+bool vos_is_probe_rsp_offload_enabled(void);
+/**
+ * vos_is_mon_enable - API to check if moniotr mode is on now.
+ *
+ * return - false: monitor mode is off
+ *          true: monitor mode is on
+ */
+bool vos_is_mon_enable(void);
 
 #endif // if !defined __VOS_API_H
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_cnss.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_cnss.h
index 5f345fbbaeb..ed6b8238dd8 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_cnss.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_cnss.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -30,12 +30,15 @@
 #include <net/cnss.h>
 #endif
 
+#define DISABLE_KRAIT_IDLE_PS_VAL    1
+
 #if defined(WLAN_OPEN_SOURCE) && !defined(CONFIG_CNSS)
 #include <linux/device.h>
 #include <linux/pm_wakeup.h>
 #include <linux/jiffies.h>
 #include <linux/workqueue.h>
 #include <linux/sched.h>
+#include <linux/pci.h>
 
 enum cnss_bus_width_type {
 	CNSS_BUS_WIDTH_NONE,
@@ -44,6 +47,12 @@ enum cnss_bus_width_type {
 	CNSS_BUS_WIDTH_HIGH
 };
 
+enum cnss_cc_src {
+	CNSS_SOURCE_CORE,
+	CNSS_SOURCE_11D,
+	CNSS_SOURCE_USER
+};
+
 static inline void vos_wlan_pci_link_down(void){ return; }
 static inline int vos_pcie_shadow_control(struct pci_dev *dev, bool enable)
 {
@@ -231,6 +240,15 @@ static inline int vos_unregister_oob_irq_handler(void *pm_oob)
 static inline void vos_dump_stack (struct task_struct *task)
 {
 }
+
+static inline void vos_set_cc_source(enum cnss_cc_src cc_source)
+{
+}
+
+static inline enum cnss_cc_src vos_get_cc_source(void)
+{
+	return CNSS_SOURCE_USER;
+}
 #else /* END WLAN_OPEN_SOURCE and !CONFIG_CNSS */
 static inline void vos_dump_stack (struct task_struct *task)
 {
@@ -325,6 +343,16 @@ static inline void vos_get_boottime_ts(struct timespec *ts)
         cnss_get_boottime(ts);
 }
 
+static inline void vos_set_cc_source(enum cnss_cc_src cc_source)
+{
+	cnss_set_cc_source(cc_source);
+}
+
+static inline enum cnss_cc_src vos_get_cc_source(void)
+{
+	return cnss_get_cc_source();
+}
+
 #ifdef HIF_SDIO
 static inline void vos_request_pm_qos_type(int latency_type, u32 qos_val)
 {
@@ -422,7 +450,7 @@ static inline void vos_release_pm_sem(void) {}
 #endif
 
 #ifdef FEATURE_BUS_BANDWIDTH
- static inline int vos_request_bus_bandwidth(struct device *dev, int bandwidth)
+static inline int vos_request_bus_bandwidth(struct device *dev, int bandwidth)
 {
 	return cnss_common_request_bus_bandwidth(dev, bandwidth);
 }
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_diag_core_event.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_diag_core_event.h
index 529b09c7419..0c176c3ab4c 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_diag_core_event.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_diag_core_event.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -231,6 +231,32 @@ typedef struct
 } vos_event_wlan_powersave_wow_payload_type;
 
 /*-------------------------------------------------------------------------
+  Event ID: EVENT_WLAN_POWERSAVE_WOW_STATS
+  ------------------------------------------------------------------------*/
+typedef struct
+{
+   uint32_t    wow_ucast_wake_up_count;
+   uint32_t    wow_bcast_wake_up_count;
+   uint32_t    wow_ipv4_mcast_wake_up_count;
+   uint32_t    wow_ipv6_mcast_wake_up_count;
+   uint32_t    wow_ipv6_mcast_ra_stats;
+   uint32_t    wow_ipv6_mcast_ns_stats;
+   uint32_t    wow_ipv6_mcast_na_stats;
+   uint32_t    wow_pno_match_wake_up_count;
+   uint32_t    wow_pno_complete_wake_up_count;
+   uint32_t    wow_gscan_wake_up_count;
+   uint32_t    wow_low_rssi_wake_up_count;
+   uint32_t    wow_rssi_breach_wake_up_count;
+   uint32_t    wow_icmpv4_count;
+   uint32_t    wow_icmpv6_count;
+   uint32_t    wow_oem_response_wake_up_count;
+   uint32_t    Reserved_1;
+   uint32_t    Reserved_2;
+   uint32_t    Reserved_3;
+   uint32_t    Reserved_4;
+} vos_event_wlan_powersave_wow_stats;
+
+/*-------------------------------------------------------------------------
   Event ID: EVENT_WLAN_BTC
   ------------------------------------------------------------------------*/
 typedef struct
@@ -407,6 +433,46 @@ struct vos_event_tdls_tx_rx_mgmt {
 };
 
 /*-------------------------------------------------------------------------
+  Event ID: EVENT_WLAN_SSR_REINIT_SUBSYSTEM
+  ------------------------------------------------------------------------*/
+/**
+ * struct host_event_wlan_css - Holds diag event details
+ * @status: Indicates the status of event
+ *
+ * This structure holds the host diag event related information
+ */
+struct host_event_wlan_ssr_reinit {
+	uint32_t status;
+};
+
+/*-------------------------------------------------------------------------
+  Event ID: EVENT_WLAN_SSR_SHUTDOWN_SUBSYSTEM
+  ------------------------------------------------------------------------*/
+/**
+ * struct host_event_wlan_ssr_shutdown - Holds diag event details
+ * @status: Indicates the status of event
+ *
+ * This structure holds the host diag event related information
+ */
+struct host_event_wlan_ssr_shutdown {
+	uint32_t status;
+};
+
+/*-------------------------------------------------------------------------
+  Function declarations and documenation
+  ------------------------------------------------------------------------*/
+/**
+ * enum_host_ssr_events - Enum containing ssr subtype
+ * @SSR_SUB_SYSTEM_REINIT: Indicate ssr reinit state
+ * @SSR_SUB_SYSTEM_SHUTDOWN: Indicate ssr shutdown status
+ *
+ */
+enum host_ssr_events {
+	SSR_SUB_SYSTEM_SHUTDOWN,
+	SSR_SUB_SYSTEM_REINIT,
+};
+
+/*-------------------------------------------------------------------------
   Function declarations and documenation
   ------------------------------------------------------------------------*/
 
@@ -452,6 +518,9 @@ enum wake_lock_reason {
 	WIFI_POWER_EVENT_WAKELOCK_PNO,
 	WIFI_POWER_EVENT_WAKELOCK_DEL_STA,
 	WIFI_POWER_EVENT_WAKELOCK_DFS,
+#ifdef FEATURE_WLAN_THERMAL_SHUTDOWN
+	WIFI_POWER_EVENT_WAKELOCK_THERMAL,
+#endif
 	WIFI_POWER_EVENT_WAKELOCK_MISC,
 };
 
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_nvitem.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_nvitem.h
index 02e840197bd..7945860d75e 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_nvitem.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_nvitem.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -316,4 +316,16 @@ bool vos_is_dsrc_channel(uint16_t);
 uint32_t vos_nv_get_channel_flags(uint32_t rf_channel);
 int vos_update_band(uint8_t  band);
 void vos_reset_global_reg_params(void);
+bool vos_is_channel_support_sub20(uint16_t operation_channel,
+				  enum phy_ch_width channel_width,
+				  uint16_t secondary_channel);
+uint8_t vos_phy_channel_width_to_sub20(enum phy_ch_width ch_width);
+
+/**
+ * vos_is_etsi_europe_country - check ETSI Europe country or not
+ * @country: country string with two Characters
+ *
+ * Return: true if country in ETSI Europe country list
+ */
+bool vos_is_etsi_europe_country(uint8_t *country);
 #endif // __VOS_NVITEM_H
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_packet.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_packet.h
index 469da0a1a92..6d86b3a2f16 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_packet.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_packet.h
@@ -62,7 +62,9 @@ typedef struct vos_pkt_t vos_pkt_t;
 #define VOS_PKT_TRAC_TYPE_EAPOL   NBUF_PKT_TRAC_TYPE_EAPOL
 #define VOS_PKT_TRAC_TYPE_DHCP    NBUF_PKT_TRAC_TYPE_DHCP
 #define VOS_PKT_TRAC_TYPE_MGMT_ACTION    NBUF_PKT_TRAC_TYPE_MGMT_ACTION /* Managment action frame */
-
+#define VOS_PKT_TRAC_TYPE_ARP     NBUF_PKT_TRAC_TYPE_ARP
+#define VOS_PKT_TRAC_TYPE_NS      NBUF_PKT_TRAC_TYPE_NS
+#define VOS_PKT_TRAC_TYPE_NA      NBUF_PKT_TRAC_TYPE_NA
 #define VOS_PKT_TRAC_DUMP_CMD     9999
 
 /*---------------------------------------------------------------------------
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_timer.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_timer.h
index 8e42742f1e4..e6c18594dd8 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_timer.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_timer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -350,5 +350,22 @@ static inline uint32_t vos_system_ticks_to_msecs(vos_time_t ticks)
 	return __vos_system_ticks_to_msecs(ticks);
 }
 
+/**
+ * vos_system_time_after() - Check if a is later than b
+ * @a: Time stamp value a
+ * @b: Time stamp value b
+ *
+ * Return:
+ * true if a is after b else false
+ */
+static inline bool vos_system_time_after(vos_time_t a, vos_time_t b)
+{
+	return (long)(b) - (long)(a) < 0;
+}
+
 unsigned long vos_get_time_of_the_day_ms(void);
+void vos_get_time_of_the_day_in_hr_min_sec_usec(char *tbuf, int len);
+void vos_process_wd_timer(void);
+void vos_wdthread_init_timer_work(void *callbackptr);
+void vos_wdthread_flush_timer_work(void);
 #endif // #if !defined __VOSS_TIMER_H
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_trace.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_trace.h
index 74a0187f7b1..f5bc981749e 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_trace.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_trace.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -111,12 +111,17 @@ typedef enum
 
 #endif
 
+#define ROW_SIZE 16
+/* Buffer size = data bytes(2 hex chars plus space) + NULL */
+#define BUFFER_SIZE ((ROW_SIZE * 3) + 1)
+
+
 /*--------------------------------------------------------------------------
   Structure definition
   ------------------------------------------------------------------------*/
 typedef struct  svosTraceRecord
 {
-    v_U64_t time;
+    char time[20];
     v_U8_t module;
     v_U8_t code;
     v_U16_t session;
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_types.h b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_types.h
index a9198201600..623b3733398 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_types.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/inc/vos_types.h
@@ -160,8 +160,26 @@ typedef enum
 #ifdef WLAN_OPEN_P2P_INTERFACE
 #define VOS_MAX_CONCURRENCY_PERSONA    4  // This should match with WLAN_MAX_INTERFACES
 #else
+/*
+ * This should match with WLAN_MAX_INTERFACES
+ */
+#ifdef WLAN_4SAP_CONCURRENCY
+#define VOS_MAX_CONCURRENCY_PERSONA    4
+#else
 #define VOS_MAX_CONCURRENCY_PERSONA    3
 #endif
+#endif
+
+/*
+ * MAX concurrency channel count in MCC
+ */
+#define MAX_CONCURRENCY_CHAN_COUNT 2
+
+/*
+ * MAX Session count per channel in MCC
+ */
+#define MAX_SESSSION_PER_CHAN_MCC 2
+
 
 //This is a bit pattern to be set for each mode
 //bit 0 - sta mode
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_api.c b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_api.c
index a1f8bc990ff..0aafa868cf4 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_api.c
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -67,6 +67,7 @@
 #include "vos_nvitem.h"
 #include "wlan_qct_wda.h"
 #include "wlan_hdd_main.h"
+#include "wlan_hdd_tsf.h"
 #include <linux/vmalloc.h>
 #include "wlan_hdd_cfg80211.h"
 #include "vos_cnss.h"
@@ -254,6 +255,27 @@ static inline void vos_fw_hash_check_config(struct ol_softc *scn,
 					hdd_context_t *pHddCtx) { }
 #endif
 
+#ifdef WLAN_FEATURE_TSF_PLUS
+/**
+ * vos_set_ptp_enable() - set ptp enable flag in mac open param
+ * @wma_handle: Pointer to mac open param
+ * @hdd_ctx: Pointer to hdd context
+ *
+ * Return: none
+ */
+static void vos_set_ptp_enable(tMacOpenParameters *param,
+					hdd_context_t *hdd_ctx)
+{
+	param->is_ptp_enabled =
+		(hdd_ctx->cfg_ini->tsf_ptp_options != 0);
+}
+#else
+static void vos_set_ptp_enable(tMacOpenParameters *param,
+					hdd_context_t *pHddCtx)
+{
+}
+#endif
+
 #ifdef WLAN_FEATURE_NAN
 /**
  * vos_set_nan_enable() - set nan enable flag in mac open param
@@ -274,6 +296,22 @@ static void vos_set_nan_enable(tMacOpenParameters *param,
 }
 #endif
 
+#ifdef QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+static void vos_set_del_ack_params(tMacOpenParameters *param,
+					hdd_context_t *hdd_ctx)
+{
+	param->del_ack_enable =
+		hdd_ctx->cfg_ini->del_ack_enable;
+	param->del_ack_timer_value = hdd_ctx->cfg_ini->del_ack_timer_value;
+	param->del_ack_pkt_count = hdd_ctx->cfg_ini->del_ack_pkt_count;
+}
+#else
+static void vos_set_del_ack_params(tMacOpenParameters *param,
+					hdd_context_t *hdd_ctx)
+{
+}
+#endif
+
 #ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
 /**
  * vos_set_bundle_params() - set bundle params in mac open param
@@ -523,7 +561,6 @@ VOS_STATUS vos_open( v_CONTEXT_t *pVosContext, v_SIZE_t hddContextSize )
         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
                   "%s: Failed to Create HTC", __func__);
            goto err_bmi_close;
-           goto err_sched_close;
    }
 
    if (bmi_done(scn)) {
@@ -571,6 +608,8 @@ VOS_STATUS vos_open( v_CONTEXT_t *pVosContext, v_SIZE_t hddContextSize )
   macOpenParms.enable_bcst_ptrn = pHddCtx->cfg_ini->bcastptrn;
   macOpenParms.enable_mc_list = pHddCtx->cfg_ini->fEnableMCAddrList;
 
+  macOpenParms.bpf_packet_filter_enable =
+               pHddCtx->cfg_ini->bpf_packet_filter_enable;
 #ifdef FEATURE_WLAN_RA_FILTERING
    macOpenParms.RArateLimitInterval = pHddCtx->cfg_ini->RArateLimitInterval;
    macOpenParms.IsRArateLimitEnabled = pHddCtx->cfg_ini->IsRArateLimitEnabled;
@@ -642,11 +681,14 @@ VOS_STATUS vos_open( v_CONTEXT_t *pVosContext, v_SIZE_t hddContextSize )
 
    vos_set_nan_enable(&macOpenParms, pHddCtx);
    vos_set_bundle_params(&macOpenParms, pHddCtx);
+   vos_set_del_ack_params(&macOpenParms, pHddCtx);
    vos_set_ac_specs_params(&macOpenParms, pHddCtx);
+   vos_set_ptp_enable(&macOpenParms, pHddCtx);
 
    vStatus = WDA_open( gpVosContext, gpVosContext->pHDDContext,
                        hdd_update_tgt_cfg,
                        hdd_dfs_indicate_radar,
+                       hdd_update_dfs_cac_block_tx_flag,
                        &macOpenParms );
 
    if (!VOS_IS_STATUS_SUCCESS(vStatus))
@@ -1259,6 +1301,8 @@ VOS_STATUS vos_close( v_CONTEXT_t vosContext )
 
   vos_deinit_log_completion();
 
+  vos_wdthread_flush_timer_work();
+
   return VOS_STATUS_SUCCESS;
 }
 
@@ -1443,6 +1487,9 @@ void vos_set_logp_in_progress(VOS_MODULE_ID moduleId, v_U8_t value)
         "%s: global voss context is NULL", __func__);
     return;
   }
+
+  VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_DEBUG,
+           "%s:%pS setting value %d",__func__, (void *)_RET_IP_, value);
   gpVosContext->isLogpInProgress = value;
 
   /* HDD uses it's own context variable to check if SSR in progress,
@@ -1937,7 +1984,7 @@ VOS_STATUS vos_mq_post_message_by_priority(VOS_MQ_ID msgQueueId,
            vos_flush_logs(WLAN_LOG_TYPE_FATAL,
                           WLAN_LOG_INDICATOR_HOST_ONLY,
                           WLAN_LOG_REASON_VOS_MSG_UNDER_RUN,
-                          true);
+                          DUMP_VOS_TRACE);
       }
       if (VOS_WRAPPER_MAX_FAIL_COUNT == debug_count) {
           vos_wlanRestart();
@@ -2095,7 +2142,20 @@ vos_fetch_tl_cfg_parms
 VOS_STATUS vos_shutdown(v_CONTEXT_t vosContext)
 {
   VOS_STATUS vosStatus;
-  tpAniSirGlobal pMac = (((pVosContextType)vosContext)->pMACContext);
+
+  vosStatus = wma_wmi_work_close(vosContext);
+  if (!VOS_IS_STATUS_SUCCESS(vosStatus)) {
+     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+               "%s: Fail to close wma_wmi_work!", __func__);
+     VOS_ASSERT(VOS_IS_STATUS_SUCCESS(vosStatus));
+  }
+
+  if (gpVosContext->htc_ctx)
+  {
+    HTCStop(gpVosContext->htc_ctx);
+    HTCDestroy(gpVosContext->htc_ctx);
+    gpVosContext->htc_ctx = NULL;
+  }
 
   vosStatus = WLANTL_Close(vosContext);
   if (!VOS_IS_STATUS_SUCCESS(vosStatus))
@@ -2113,16 +2173,6 @@ VOS_STATUS vos_shutdown(v_CONTEXT_t vosContext)
      VOS_ASSERT( VOS_IS_STATUS_SUCCESS( vosStatus ) );
   }
 
-  /* CAC timer will be initiated and started only when SAP starts on
-  * DFS channel and it will be stopped and destroyed immediately once the
-  * radar detected or timedout. So as per design CAC timer should be
-  * destroyed after stop.*/
-  if (pMac->sap.SapDfsInfo.is_dfs_cac_timer_running) {
-     vos_timer_stop(&pMac->sap.SapDfsInfo.sap_dfs_cac_timer);
-     pMac->sap.SapDfsInfo.is_dfs_cac_timer_running = 0;
-     vos_timer_destroy(&pMac->sap.SapDfsInfo.sap_dfs_cac_timer);
-  }
-
   vosStatus = macClose( ((pVosContextType)vosContext)->pMACContext);
   if (!VOS_IS_STATUS_SUCCESS(vosStatus))
   {
@@ -2163,20 +2213,6 @@ VOS_STATUS vos_shutdown(v_CONTEXT_t vosContext)
     }
   }
 
-  vosStatus = wma_wmi_work_close(vosContext);
-  if (!VOS_IS_STATUS_SUCCESS(vosStatus)) {
-     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-               "%s: Failed to close wma_wmi_work!", __func__);
-     VOS_ASSERT(VOS_IS_STATUS_SUCCESS(vosStatus));
-  }
-
-  if (gpVosContext->htc_ctx)
-  {
-    HTCStop(gpVosContext->htc_ctx);
-    HTCDestroy(gpVosContext->htc_ctx);
-    gpVosContext->htc_ctx = NULL;
-  }
-
   vosStatus = wma_wmi_service_close(vosContext);
   if (!VOS_IS_STATUS_SUCCESS(vosStatus))
   {
@@ -2185,7 +2221,6 @@ VOS_STATUS vos_shutdown(v_CONTEXT_t vosContext)
                VOS_ASSERT(VOS_IS_STATUS_SUCCESS(vosStatus));
   }
 
-
   vos_mq_deinit(&((pVosContextType)vosContext)->freeVosMq);
 
   vosStatus = vos_event_destroy(&gpVosContext->wdaCompleteEvent);
@@ -2381,6 +2416,9 @@ VOS_STATUS vos_get_vdev_types(tVOS_CON_MODE mode, tANI_U32 *type,
         case VOS_OCB_MODE:
             *type = WMI_VDEV_TYPE_OCB;
             break;
+        case VOS_IBSS_MODE:
+            *type = WMI_VDEV_TYPE_IBSS;
+            break;
         case VOS_NDI_MODE:
             *type = WMI_VDEV_TYPE_NDI;
             break;
@@ -2408,12 +2446,93 @@ v_BOOL_t vos_is_packet_log_enabled(void)
    return pHddCtx->cfg_ini->enablePacketLog;
 }
 
-void vos_trigger_recovery(void)
+v_BOOL_t vos_config_is_no_ack(void)
+{
+   hdd_context_t *pHddCtx;
+
+   pHddCtx = (hdd_context_t*)(gpVosContext->pHDDContext);
+   if((NULL == pHddCtx) ||
+      (NULL == pHddCtx->cfg_ini))
+   {
+     VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+               "%s: Hdd Context is Null", __func__);
+     return FALSE;
+   }
+
+   return pHddCtx->cfg_ini->gEnableNoAck;
+}
+
+#ifdef WLAN_FEATURE_TSF_PLUS
+bool vos_is_ptp_rx_opt_enabled(void)
+{
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = (hdd_context_t *)(gpVosContext->pHDDContext);
+	if ((NULL == hdd_ctx) || (NULL == hdd_ctx->cfg_ini)) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+			  "%s: Hdd Context is Null", __func__);
+		return false;
+	}
+
+	return HDD_TSF_IS_RX_SET(hdd_ctx);
+}
+
+bool vos_is_ptp_tx_opt_enabled(void)
+{
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = (hdd_context_t *)(gpVosContext->pHDDContext);
+	if ((NULL == hdd_ctx) || (NULL == hdd_ctx->cfg_ini)) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+			  "%s: Hdd Context is Null", __func__);
+		return false;
+	}
+
+	return HDD_TSF_IS_TX_SET(hdd_ctx);
+}
+#endif
+
+#ifdef WLAN_FEATURE_DSRC
+bool vos_is_ocb_tx_per_pkt_stats_enabled(void)
+{
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = (hdd_context_t *)(gpVosContext->pHDDContext);
+
+	if ((NULL == hdd_ctx) || (NULL == hdd_ctx->cfg_ini)) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+			  "%s: Hdd Context is Null", __func__);
+		return false;
+	}
+
+	return hdd_ctx->cfg_ini->ocb_tx_per_pkt_stats_enabled;
+}
+#endif
+
+VOS_STATUS vos_config_silent_recovery(pVosContextType vos_context)
 {
-	pVosContextType vos_context;
-	tp_wma_handle wma_handle;
 	struct ol_softc *scn;
 	struct device *dev;
+
+	if (vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+			FL("LOGP is in progress, ignore!"));
+		return VOS_STATUS_E_FAILURE;
+	}
+	vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
+	scn = vos_get_context(VOS_MODULE_ID_HIF, vos_context);
+	if (scn && scn->hif_sc) {
+		dev = scn->hif_sc->dev;
+		if (dev)
+			vos_schedule_recovery_work(dev);
+	}
+	return VOS_STATUS_SUCCESS;
+}
+
+void vos_trigger_recovery(bool skip_crash_inject)
+{
+	pVosContextType vos_context;
+	tp_wma_handle wma_handle;
 	VOS_STATUS status = VOS_STATUS_SUCCESS;
 	void *runtime_context = NULL;
 
@@ -2435,28 +2554,23 @@ void vos_trigger_recovery(void)
 	runtime_context = vos_runtime_pm_prevent_suspend_init("vos_recovery");
 	vos_runtime_pm_prevent_suspend(runtime_context);
 
-	wma_crash_inject(wma_handle, RECOVERY_SIM_SELF_RECOVERY, 0);
+	if (!skip_crash_inject) {
+		wma_crash_inject(wma_handle, RECOVERY_SIM_SELF_RECOVERY, 0);
+		status = vos_wait_single_event(&wma_handle->recovery_event,
+			WMA_CRASH_INJECT_TIMEOUT);
 
-	status = vos_wait_single_event(&wma_handle->recovery_event,
-		WMA_CRASH_INJECT_TIMEOUT);
-
-	if (VOS_STATUS_SUCCESS != status) {
-		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-			"CRASH_INJECT command is timed out!");
-		if (vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
+		if (VOS_STATUS_SUCCESS != status) {
 			VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-				"LOGP is in progress, ignore!");
-			goto out;
-		}
-		vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, TRUE);
-		scn = vos_get_context(VOS_MODULE_ID_HIF, vos_context);
-		if (scn && scn->hif_sc) {
-			dev = scn->hif_sc->dev;
-			if (dev)
-				vos_schedule_recovery_work(dev);
+				"CRASH_INJECT command is timed out!");
+			if (!vos_config_silent_recovery(vos_context))
+				goto out;
 		}
+	} else {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+				FL("trigger silent recovery!"));
+		if (!vos_config_silent_recovery(vos_context))
+			goto out;
 	}
-
 out:
 	vos_runtime_pm_allow_suspend(runtime_context);
 	vos_runtime_pm_prevent_suspend_deinit(runtime_context);
@@ -2648,6 +2762,26 @@ uint8_t vos_is_multicast_logging(void)
 }
 
 /*
+ * vos_reset_log_completion() - Reset log param structure
+ *@vos_context: Pointer to global vos context
+ *
+ * This function is used to reset the logging related
+ * parameters to default.
+ *
+ * Return: None
+ */
+void vos_reset_log_completion(VosContextType *vos_context)
+{
+	/* Vos Context is validated by the caller */
+	vos_spin_lock_acquire(&vos_context->bug_report_lock);
+	vos_context->log_complete.indicator = WLAN_LOG_INDICATOR_UNUSED;
+	vos_context->log_complete.is_fatal = WLAN_LOG_TYPE_NON_FATAL;
+	vos_context->log_complete.is_report_in_progress = false;
+	vos_context->log_complete.reason_code = WLAN_LOG_REASON_CODE_UNUSED;
+	vos_spin_lock_release(&vos_context->bug_report_lock);
+}
+
+/*
  * vos_init_log_completion() - Initialize log param structure
  *
  * This function is used to initialize the logging related
@@ -2670,9 +2804,7 @@ void vos_init_log_completion(void)
 	vos_context->log_complete.indicator = WLAN_LOG_INDICATOR_UNUSED;
 	vos_context->log_complete.reason_code = WLAN_LOG_REASON_CODE_UNUSED;
 	vos_context->log_complete.is_report_in_progress = false;
-	/* Attempting to initialize an already initialized lock
-	 * results in a failure. This must be ok here.
-	 */
+
 	vos_spin_lock_init(&vos_context->bug_report_lock);
 }
 
@@ -2765,17 +2897,15 @@ void vos_get_log_and_reset_completion(uint32_t *is_fatal,
 	if ((WLAN_LOG_INDICATOR_HOST_DRIVER == *indicator) &&
 	    ((WLAN_LOG_REASON_SME_OUT_OF_CMD_BUF == *reason_code) ||
 		 (WLAN_LOG_REASON_SME_COMMAND_STUCK == *reason_code) ||
-		 (WLAN_LOG_REASON_STALE_SESSION_FOUND == *reason_code)))
+		 (WLAN_LOG_REASON_STALE_SESSION_FOUND == *reason_code) ||
+		 (WLAN_LOG_REASON_SCAN_NOT_ALLOWED == *reason_code)))
 		*is_ssr_needed = true;
 	else
 		*is_ssr_needed = false;
 
-	/* reset */
-	vos_context->log_complete.indicator = WLAN_LOG_INDICATOR_UNUSED;
-	vos_context->log_complete.is_fatal = WLAN_LOG_TYPE_NON_FATAL;
-	vos_context->log_complete.is_report_in_progress = false;
-	vos_context->log_complete.reason_code = WLAN_LOG_REASON_CODE_UNUSED;
 	vos_spin_lock_release(&vos_context->bug_report_lock);
+
+	vos_reset_log_completion(vos_context);
 }
 
 /**
@@ -2838,7 +2968,7 @@ uint32_t vos_get_log_indicator(void)
 		vos_context->isLogpInProgress ||
 		vos_context->isReInitInProgress) {
 		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-			  FL("vos context initialization is in progress LoadUnload: %u LogP: %u ReInit: %u"),
+			  FL("In LoadUnload: %u LogP: %u ReInit: %u"),
 			     vos_context->isLoadUnloadInProgress,
 			     vos_context->isLogpInProgress,
 			     vos_context->isReInitInProgress);
@@ -2871,6 +3001,8 @@ void vos_wlan_flush_host_logs_for_fatal(void)
  * @indicator: Source which trigerred the bug report
  * @reason_code: Reason for triggering bug report
  * @dump_vos_trace: If vos trace are needed in logs.
+ * @pkt_trace: flag to indicate when to report packet trace
+ *             dump this info when connection related error occurs
  *
  * This function sets the log related params and send the WMI command to the
  * FW to flush its logs. On receiving the flush completion event from the FW
@@ -2881,7 +3013,7 @@ void vos_wlan_flush_host_logs_for_fatal(void)
 VOS_STATUS vos_flush_logs(uint32_t is_fatal,
 		uint32_t indicator,
 		uint32_t reason_code,
-		bool dump_vos_trace)
+		uint32_t dump_trace)
 {
 	uint32_t ret;
 	VOS_STATUS status;
@@ -2922,14 +3054,15 @@ VOS_STATUS vos_flush_logs(uint32_t is_fatal,
 	}
 
 	VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-			"%s: Triggering bug report: type:%d, indicator=%d reason_code=%d",
-			__func__, is_fatal, indicator, reason_code);
+			"%s: Triggering bug report: type:%d, indicator=%d reason_code=%d dump_trace=0x%x",
+			__func__, is_fatal, indicator, reason_code, dump_trace);
 
-	if (dump_vos_trace)
+	if (dump_trace & DUMP_VOS_TRACE)
 		vosTraceDumpAll(vos_context->pMACContext, 0, 0, 500, 0);
 
 #ifdef QCA_PKT_PROTO_TRACE
-	vos_pkt_trace_buf_dump();
+	if (dump_trace & DUMP_PACKET_TRACE)
+		vos_pkt_trace_buf_dump();
 #endif
 	if (WLAN_LOG_INDICATOR_HOST_ONLY == indicator) {
 		vos_wlan_flush_host_logs_for_fatal();
@@ -2939,7 +3072,7 @@ VOS_STATUS vos_flush_logs(uint32_t is_fatal,
 	if (0 != ret) {
 		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
 			"%s: Failed to send flush FW log", __func__);
-		vos_init_log_completion();
+		vos_reset_log_completion(vos_context);
 		return VOS_STATUS_E_FAILURE;
 	}
 
@@ -3048,3 +3181,142 @@ int vos_set_radio_index(int radio_index)
 	gpVosContext->radio_index = radio_index;
 	return 0;
 }
+
+/**
+ * vos_svc_fw_shutdown_ind() - API to send userspace about FW crash
+ *
+ * @data: Device Pointer
+ *
+ * Return: None
+*/
+void vos_svc_fw_shutdown_ind(struct device *dev)
+{
+	hdd_svc_fw_shutdown_ind(dev);
+}
+
+v_U64_t vos_get_monotonic_boottime_ns(void)
+{
+	struct timespec ts;
+
+	ktime_get_ts(&ts);
+	return timespec_to_ns(&ts);
+}
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 11, 0))
+v_U64_t vos_get_bootbased_boottime_ns(void)
+{
+	return ktime_get_boot_ns();
+}
+
+#else
+v_U64_t vos_get_bootbased_boottime_ns(void)
+{
+	return ktime_to_ns(ktime_get_boottime());
+}
+#endif
+
+/**
+ * vos_do_div() - wrapper function for kernel macro(do_div).
+ *
+ * @dividend: Dividend value
+ * @divisor : Divisor value
+ *
+ * Return: Quotient
+ */
+uint64_t vos_do_div(uint64_t dividend, uint32_t divisor)
+{
+	do_div(dividend, divisor);
+	/*do_div macro updates dividend with Quotient of dividend/divisor */
+	return dividend;
+}
+
+uint64_t vos_do_div64(uint64_t dividend, uint64_t divisor)
+{
+	uint64_t n = dividend;
+	uint64_t base = divisor;
+	if ((base & 0xffffffff00000000ULL) != 0) {
+		n >>= 16;
+		base >>= 16;
+
+		if ((base & 0xffff00000000ULL) != 0) {
+			n >>= 16;
+			base >>= 16;
+		}
+		return vos_do_div(n, (uint32_t)base);
+	} else {
+		return vos_do_div(n, base);
+	}
+}
+
+/**
+ * vos_force_fw_dump() - force target to dump
+ *
+ *return
+ * VOS_STATUS_SUCCESS   - Operation completed successfully.
+ * VOS_STATUS_E_FAILURE - Operation failed.
+ */
+VOS_STATUS vos_force_fw_dump(void)
+{
+	struct ol_softc *scn;
+
+	scn = vos_get_context(VOS_MODULE_ID_HIF, gpVosContext);
+	if (!scn) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+			  "%s: scn is null!", __func__);
+		return VOS_STATUS_E_FAILURE;
+	}
+	VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+		  "%s:enter!", __func__);
+
+	ol_target_failure(scn, A_ERROR);
+
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
+ * vos_is_probe_rsp_offload_enabled - API to check if probe response offload
+ *                                    feature is enabled from ini
+ *
+ * return - false: probe response offload is disabled/any-error
+ *          true: probe response offload is enabled
+ */
+bool vos_is_probe_rsp_offload_enabled(void)
+{
+	hdd_context_t *pHddCtx = NULL;
+
+	if (gpVosContext == NULL) {
+		pr_err("global voss context is NULL\n");
+		return false;
+	}
+
+	pHddCtx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD,
+						   gpVosContext);
+	if (!pHddCtx) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+			  "%s: HDD context is Null", __func__);
+		return false;
+	}
+
+	return pHddCtx->cfg_ini->sap_probe_resp_offload;
+}
+
+bool vos_is_mon_enable(void)
+{
+	hdd_context_t *phdd_ctx = NULL;
+
+	if (gpVosContext == NULL) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+			  "%s: global voss context is NULL", __func__);
+		return false;
+	}
+
+	phdd_ctx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD,
+						   gpVosContext);
+	if (!phdd_ctx) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+			  "%s: HDD context is Null", __func__);
+		return false;
+	}
+
+	return phdd_ctx->is_mon_enable;
+}
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_diag.c b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_diag.c
index c3a5756fed5..74d3a6e0b29 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_diag.c
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_diag.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -295,7 +295,7 @@ void vos_event_report_payload(v_U16_t event_Id, v_U16_t length, v_VOID_t *pPaylo
         vos_mem_copy(pBuf, pPayload, length);
 
         if( ptt_sock_send_msg_to_app(wmsg, 0, ANI_NL_MSG_PUMAC, -1) < 0) {
-            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_DEBUG,
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN,
                        ("Ptt Socket error sending message to the app!!"));
             vos_mem_free((v_VOID_t*)wmsg);
             return;
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_memory.c b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_memory.c
index 901240109a0..4a3ce77cf51 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_memory.c
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_memory.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -465,9 +465,6 @@ v_VOID_t *vos_mem_malloc_debug(v_SIZE_t size, const char *fileName,
       memPtr = (v_VOID_t*)(memStruct + 1);
    }
 
-   if (!memPtr)
-       vos_log_low_resource_failure(WIFI_EVENT_MEMORY_FAILURE);
-
    return memPtr;
 }
 
@@ -560,8 +557,6 @@ v_VOID_t * vos_mem_malloc( v_SIZE_t size )
            __func__,
            vos_timer_get_system_time() - time_before_kmalloc,
            size, (void *)_RET_IP_);
-   if (!memPtr)
-       vos_log_low_resource_failure(WIFI_EVENT_MEMORY_FAILURE);
 
    return memPtr;
 }
@@ -626,7 +621,7 @@ v_VOID_t vos_mem_copy( v_VOID_t *pDst, const v_VOID_t *pSrc, v_SIZE_t numBytes )
    if ((pDst == NULL) || (pSrc==NULL))
    {
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                "%s called with NULL parameter, source:%p destination:%p",
+                "%s called with NULL parameter, source:%pK destination:%pK",
                 __func__, pSrc, pDst);
       VOS_ASSERT(0);
       return;
@@ -645,7 +640,7 @@ v_VOID_t vos_mem_move( v_VOID_t *pDst, const v_VOID_t *pSrc, v_SIZE_t numBytes )
    if ((pDst == NULL) || (pSrc==NULL))
    {
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                "%s called with NULL parameter, source:%p destination:%p",
+                "%s called with NULL parameter, source:%pK destination:%pK",
                 __func__, pSrc, pDst);
       VOS_ASSERT(0);
       return;
@@ -664,7 +659,7 @@ v_BOOL_t vos_mem_compare(const v_VOID_t *pMemory1, const v_VOID_t *pMemory2, v_U
    if ((pMemory1 == NULL) || (pMemory2==NULL))
    {
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                "%s called with NULL parameter, p1:%p p2:%p",
+                "%s called with NULL parameter, p1:%pK p2:%pK",
                 __func__, pMemory1, pMemory2);
       VOS_ASSERT(0);
       return VOS_FALSE;
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_nvitem.c b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_nvitem.c
index d197f29924b..ed7a04823b3 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_nvitem.c
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_nvitem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -52,6 +52,7 @@
 #include <net/cfg80211.h>
 #include "regdomain.h"
 #include "regdomain_common.h"
+#include "vos_cnss.h"
 
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,9,0)) && !defined(WITH_BACKPORTS)
 #define IEEE80211_CHAN_NO_80MHZ		1<<7
@@ -118,6 +119,8 @@ static v_BOOL_t init_by_reg_core = VOS_FALSE;
 #define WORLD_SKU_MASK          0x00F0
 #define WORLD_SKU_PREFIX        0x0060
 
+#define REG_SET_WAIT_MS        100
+
 /**
  * struct bonded_chan
  * @start_ch: start channel
@@ -288,7 +291,7 @@ chan_to_ht_40_index_map chan_to_ht_40_index[NUM_20MHZ_RF_CHANNELS] =
 static CountryInfoTable_t countryInfoTable =
 {
     /* the first entry in the table is always the world domain */
-    138,
+    141,
     {
       {REGDOMAIN_WORLD, {'0', '0'}}, // WORLD DOMAIN
       {REGDOMAIN_FCC, {'A', 'D'}}, // ANDORRA
@@ -327,6 +330,7 @@ static CountryInfoTable_t countryInfoTable =
       {REGDOMAIN_ETSI, {'C', 'Z'}}, //CZECH REPUBLIC
       {REGDOMAIN_ETSI, {'D', 'E'}}, //GERMANY
       {REGDOMAIN_ETSI, {'D', 'K'}}, //DENMARK
+      {REGDOMAIN_FCC, {'D', 'M'}}, //DOMINICA
       {REGDOMAIN_FCC, {'D', 'O'}}, //DOMINICAN REPUBLIC
       {REGDOMAIN_ETSI, {'D', 'Z'}}, //ALGERIA
       {REGDOMAIN_ETSI, {'E', 'C'}}, //ECUADOR
@@ -379,6 +383,7 @@ static CountryInfoTable_t countryInfoTable =
       {REGDOMAIN_ETSI, {'M', 'W'}}, //MALAWI
       {REGDOMAIN_FCC, {'M', 'X'}}, //MEXICO
       {REGDOMAIN_ETSI, {'M', 'Y'}}, //MALAYSIA
+      {REGDOMAIN_ETSI, {'N', 'A'}}, //NAMIBIA
       {REGDOMAIN_ETSI, {'N', 'G'}}, //NIGERIA
       {REGDOMAIN_FCC, {'N', 'I'}}, //NICARAGUA
       {REGDOMAIN_ETSI, {'N', 'L'}}, //NETHERLANDS
@@ -432,6 +437,49 @@ static CountryInfoTable_t countryInfoTable =
     }
 };
 
+/*
+ *  ETSI is updating EN 301 893, which specifies 5 GHz channel access
+ *  in Europe
+ */
+static const v_COUNTRYCODE_t etsi_europe_country[] = {
+	{'A','T'},
+	{'B','E'},
+	{'B','G'},
+	{'C','Z'},
+	{'D','K'},
+	{'E','E'},
+	{'F','R'},
+
+	{'D','E'},
+	{'I','S'},
+	{'I','E'},
+	{'I','T'},
+	{'E','L'},
+	{'E','S'},
+	{'C','Y'},
+
+	{'L','V'},
+	{'L','I'},
+	{'L','T'},
+	{'L','U'},
+	{'H','U'},
+	{'M','T'},
+	{'N','L'},
+
+	{'N','O'},
+	{'P','L'},
+	{'P','T'},
+	{'R','O'},
+	{'S','I'},
+	{'S','K'},
+	{'T','R'},
+
+	{'F','I'},
+	{'S','E'},
+	{'C','H'},
+	{'U','K'},
+	{'H','R'},
+};
 typedef struct nvEFSTable_s
 {
    sHalNv     halnv;
@@ -624,6 +672,17 @@ struct ieee80211_regdomain *vos_world_regdomain(struct regulatory *reg)
    }
 }
 
+bool vos_is_etsi_europe_country(uint8_t *country)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(etsi_europe_country); i++) {
+		if (country[0] == etsi_europe_country[i][0] &&
+		    country[1] == etsi_europe_country[i][1])
+			return true;
+	}
+	return false;
+}
 /**
  * vos_reset_global_reg_params - Reset global static reg params
  *
@@ -697,6 +756,14 @@ static int reg_init_from_eeprom(hdd_context_t *pHddCtx, struct regulatory *reg,
 {
 	int ret_val = 0;
 
+	if((pHddCtx->cfg_ini->overrideCountryCode[0] != '0' )&&
+	   (pHddCtx->cfg_ini->overrideCountryCode[1] != '0')) {
+		reg->alpha2[0] = pHddCtx->cfg_ini->overrideCountryCode[0];
+		reg->alpha2[1] = pHddCtx->cfg_ini->overrideCountryCode[1];
+		reg->reg_domain = COUNTRY_ERD_FLAG;
+		reg->reg_domain |= regdmn_find_ctry_by_name(reg->alpha2);
+	}
+
 	ret_val = regdmn_get_country_alpha2(reg);
 	if (ret_val) {
 		adf_os_print(KERN_ERR "Error in getting country code\n");
@@ -1495,6 +1562,7 @@ VOS_STATUS vos_nv_getRegDomainFromCountryCode( v_REGDOMAIN_t *pRegDomain,
     hdd_context_t *pHddCtx = NULL;
     struct wiphy *wiphy = NULL;
     int i;
+    int wait_result;
 
     /* sanity checks */
     if (NULL == pRegDomain)
@@ -1600,11 +1668,41 @@ VOS_STATUS vos_nv_getRegDomainFromCountryCode( v_REGDOMAIN_t *pRegDomain,
         }
 
     } else if (COUNTRY_IE == source || COUNTRY_USER == source) {
+        if (COUNTRY_USER == source)
+            vos_set_cc_source(CNSS_SOURCE_USER);
+        else
+            vos_set_cc_source(CNSS_SOURCE_11D);
+
+        INIT_COMPLETION(pHddCtx->reg_init);
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0)) || defined(WITH_BACKPORTS)
         regulatory_hint_user(country_code, NL80211_USER_REG_HINT_USER);
 #else
         regulatory_hint_user(country_code);
 #endif
+        wait_result = wait_for_completion_interruptible_timeout(
+                               &pHddCtx->reg_init,
+                               msecs_to_jiffies(REG_WAIT_TIME));
+        /*
+         * if the country information does not exist with the kernel,
+         * then the driver callback would not be called
+         */
+
+        if (wait_result >= 0)
+        {
+           VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+                       "runtime country code : %c%c is found in kernel db",
+                        country_code[0], country_code[1]);
+           *pRegDomain = temp_reg_domain;
+        }
+        else
+        {
+            VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_WARN,
+                       "runtime country code : %c%c is not found"
+                       " in kernel db",
+                        country_code[0], country_code[1]);
+
+            return VOS_STATUS_E_EXISTS;
+        }
     }
 
     *pRegDomain = temp_reg_domain;
@@ -1667,6 +1765,67 @@ bool vos_is_dsrc_channel(uint16_t center_freq)
     }
     return 0;
 }
+
+/**
+ * vos_is_channel_support_sub20() - check channel
+ * support sub20 channel width
+ * @oper_ch: operating channel
+ * @ch_width: channel width
+ * @sec_ch: secondary channel
+ *
+ * Return: true or false
+ */
+bool vos_is_channel_support_sub20(uint16_t operation_channel,
+				  enum phy_ch_width channel_width,
+				  uint16_t secondary_channel)
+{
+	eNVChannelEnabledType channel_state;
+
+	if (VOS_IS_CHANNEL_5GHZ(operation_channel)) {
+		const struct bonded_chan *bonded_chan_ptr = NULL;
+
+		channel_state =
+		    vos_search_5g_bonded_channel(operation_channel,
+						 channel_width,
+						 &bonded_chan_ptr);
+		if (NV_CHANNEL_DISABLE == channel_state)
+			return false;
+
+		channel_state =
+		    vos_get_5g_bonded_channel_state(operation_channel,
+						    channel_width,
+						    bonded_chan_ptr);
+		if (NV_CHANNEL_DISABLE == channel_state)
+			return false;
+
+	} else if (VOS_IS_CHANNEL_24GHZ(operation_channel)) {
+		channel_state =
+		    vos_get_2g_bonded_channel_state(operation_channel,
+						    channel_width,
+						    secondary_channel);
+		if (NV_CHANNEL_DISABLE == channel_state)
+			return false;
+	}
+
+	return true;
+}
+
+/**
+ * vos_phy_channel_width_to_sub20: convert phy channel width
+ * to sub20 channel width
+ * @channel_width:  phy channel width
+ * Return: sub20 channel width
+ */
+uint8_t vos_phy_channel_width_to_sub20(enum phy_ch_width channel_width)
+{
+	if (channel_width == CH_WIDTH_5MHZ)
+		return SUB20_MODE_5MHZ;
+	else if (channel_width == CH_WIDTH_10MHZ)
+		return SUB20_MODE_10MHZ;
+	else
+		return SUB20_MODE_NONE;
+}
+
 /**
  * vos_update_band: Update the band
  * @eBand: Band value
@@ -2107,6 +2266,19 @@ static void restore_custom_reg_settings(struct wiphy *wiphy)
 }
 #endif
 
+static void hdd_debug_cc_timer_expired_handler(void *arg)
+{
+	hdd_context_t *pHddCtx;
+	VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+		  ("%s ENTER "), __func__);
+
+	if (!arg)
+		return;
+	pHddCtx = (hdd_context_t *)arg;
+	vos_timer_destroy(&(pHddCtx->reg.reg_set_timer));
+	regdmn_set_regval(&pHddCtx->reg);
+}
+
 /*
  * Function: wlan_hdd_linux_reg_notifier
  * This function is called from cfg80211 core to provide regulatory settings
@@ -2128,6 +2300,7 @@ int __wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
     int i;
     v_BOOL_t isVHT80Allowed;
     bool reset = false;
+    VOS_TIMER_STATE timer_status;
 
     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
               FL("country: %c%c, initiator %d, dfs_region: %d"),
@@ -2170,6 +2343,16 @@ int __wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
 #endif
     }
 
+    if (pHddCtx->isWiphySuspended == TRUE) {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                  "system/cfg80211 is already suspend");
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,0)) || defined(WITH_BACKPORTS)
+        return;
+#else
+        return 0;
+#endif
+    }
+
     sme_GetFreqBand(pHddCtx->hHal, &nBandCapability);
 
     /* first check if this callback is in response to the driver callback */
@@ -2209,6 +2392,7 @@ int __wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
         }
         if (NL80211_REGDOM_SET_BY_CORE == request->initiator) {
             pHddCtx->reg.cc_src = COUNTRY_CODE_SET_BY_CORE;
+            vos_set_cc_source(CNSS_SOURCE_CORE);
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0)) || defined(WITH_BACKPORTS)
             if (wiphy->regulatory_flags & REGULATORY_CUSTOM_REG)
 #else
@@ -2218,7 +2402,10 @@ int __wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
         } else if (NL80211_REGDOM_SET_BY_DRIVER == request->initiator) {
             pHddCtx->reg.cc_src = COUNTRY_CODE_SET_BY_DRIVER;
         } else {
-            pHddCtx->reg.cc_src = COUNTRY_CODE_SET_BY_USER;
+            if (vos_get_cc_source() == CNSS_SOURCE_11D)
+                pHddCtx->reg.cc_src = COUNTRY_CODE_SET_BY_11D;
+            else
+                pHddCtx->reg.cc_src = COUNTRY_CODE_SET_BY_USER;
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0)) && !defined(WITH_BACKPORTS)
             if ((request->alpha2[0] == '0') &&
                 (request->alpha2[1] == '0') &&
@@ -2270,9 +2457,6 @@ int __wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
         if (pHddCtx->isVHT80Allowed != isVHT80Allowed)
             hdd_checkandupdate_phymode( pHddCtx);
 
-        if (NL80211_REGDOM_SET_BY_DRIVER == request->initiator)
-            complete(&pHddCtx->reg_init);
-
         /* now pass the new country information to sme */
         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
         {
@@ -2285,14 +2469,39 @@ int __wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
                                          temp_reg_domain);
         }
 
-        /* send CTL info to firmware */
-        regdmn_set_regval(&pHddCtx->reg);
+        if (pHddCtx->cfg_ini->sta_change_cc_via_beacon) {
+            /* Due the firmware process, host side need to send
+             * WMI_SCAN_CHAN_LIST_CMDID before WMI_PDEV_SET_REGDOMAIN_CMDID, so
+             * that tx-power setting for operation channel can be applied,
+             * so use timer to postpone SET_REGDOMAIN_CMDID
+             */
+            if (pHddCtx->reg.reg_set_timer.state == 0)
+                timer_status = VOS_TIMER_STATE_UNUSED;
+            else {
+                do {
+                    timer_status =
+                    vos_timer_getCurrentState(&(pHddCtx->reg.reg_set_timer));
+                } while(timer_status != VOS_TIMER_STATE_UNUSED);
+            }
+            vos_timer_init(&(pHddCtx->reg.reg_set_timer), VOS_TIMER_TYPE_SW,
+                           hdd_debug_cc_timer_expired_handler,
+                           (void *)pHddCtx);
+            vos_timer_start(&(pHddCtx->reg.reg_set_timer), REG_SET_WAIT_MS);
+        } else {
+            regdmn_set_regval(&pHddCtx->reg);
+        }
 
         /* set dfs_region info */
         vos_nv_set_dfs_region(request->dfs_region);
 
         regdmn_set_dfs_region(&pHddCtx->reg);
 
+        hdd_set_dfs_regdomain(pHddCtx,false);
+
+        if ((NL80211_REGDOM_SET_BY_DRIVER == request->initiator) ||
+            (NL80211_REGDOM_SET_BY_USER == request->initiator))
+            complete(&pHddCtx->reg_init);
+
     default:
         break;
     }
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_packet.c b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_packet.c
index bd18d371b1c..db8e10dc397 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_packet.c
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_packet.c
@@ -57,6 +57,7 @@
 #define VOS_PKT_TRAC_DHCP_SRV_PORT   67
 #define VOS_PKT_TRAC_DHCP_CLI_PORT   68
 #define VOS_PKT_TRAC_EAPOL_ETH_TYPE  0x888E
+#define VOS_PKT_TRAC_ARP_ETH_TYPE    0x0806
 #ifdef QCA_PKT_PROTO_TRACE
 #define VOS_PKT_TRAC_MAX_STRING_LEN  40
 #define VOS_PKT_TRAC_MAX_TRACE_BUF   50
@@ -73,6 +74,7 @@ typedef struct
 
 vos_pkt_proto_trace_t   *trace_buffer = NULL;
 unsigned int            trace_buffer_order = 0;
+unsigned int trace_dump_order = 0;
 spinlock_t              trace_buffer_lock;
 #endif /* QCA_PKT_PROTO_TRACE */
 
@@ -256,14 +258,11 @@ v_U8_t vos_pkt_get_proto_type
 )
 {
    v_U8_t     pkt_proto_type = 0;
-   v_U16_t    ether_type;
-   v_U16_t    SPort;
-   v_U16_t    DPort;
 
    if (dot11_type)
    {
       if (dot11_type == (VOS_PKT_TRAC_TYPE_MGMT_ACTION & tracking_map))
-         pkt_proto_type |= VOS_PKT_TRAC_TYPE_MGMT_ACTION;
+         pkt_proto_type = VOS_PKT_TRAC_TYPE_MGMT_ACTION;
 
       /* Protocol type map */
       return pkt_proto_type;
@@ -272,26 +271,48 @@ v_U8_t vos_pkt_get_proto_type
    /* EAPOL Tracking enabled */
    if (VOS_PKT_TRAC_TYPE_EAPOL & tracking_map)
    {
-      ether_type = (v_U16_t)(*(v_U16_t *)(skb->data + VOS_PKT_TRAC_ETH_TYPE_OFFSET));
-      if (VOS_PKT_TRAC_EAPOL_ETH_TYPE == VOS_SWAP_U16(ether_type))
-      {
-         pkt_proto_type |= VOS_PKT_TRAC_TYPE_EAPOL;
+      if (adf_nbuf_is_eapol_pkt(skb)) {
+         pkt_proto_type = VOS_PKT_TRAC_TYPE_EAPOL;
+         return pkt_proto_type;
       }
    }
 
    /* DHCP Tracking enabled */
    if (VOS_PKT_TRAC_TYPE_DHCP & tracking_map)
    {
-      SPort = (v_U16_t)(*(v_U16_t *)(skb->data + VOS_PKT_TRAC_IP_OFFSET +
-                                     VOS_PKT_TRAC_IP_HEADER_SIZE));
-      DPort = (v_U16_t)(*(v_U16_t *)(skb->data + VOS_PKT_TRAC_IP_OFFSET +
-                                     VOS_PKT_TRAC_IP_HEADER_SIZE + sizeof(v_U16_t)));
-      if (((VOS_PKT_TRAC_DHCP_SRV_PORT == VOS_SWAP_U16(SPort)) &&
-           (VOS_PKT_TRAC_DHCP_CLI_PORT == VOS_SWAP_U16(DPort))) ||
-          ((VOS_PKT_TRAC_DHCP_CLI_PORT == VOS_SWAP_U16(SPort)) &&
-           (VOS_PKT_TRAC_DHCP_SRV_PORT == VOS_SWAP_U16(DPort))))
-      {
-         pkt_proto_type |= VOS_PKT_TRAC_TYPE_DHCP;
+      if (adf_nbuf_is_dhcp_pkt(skb)) {
+         pkt_proto_type = VOS_PKT_TRAC_TYPE_DHCP;
+         return pkt_proto_type;
+      }
+   }
+
+   /* ARP Tracking enabled */
+   if (VOS_PKT_TRAC_TYPE_ARP & tracking_map) {
+      if (adf_nbuf_is_ipv4_arp_pkt(skb)) {
+          pkt_proto_type = VOS_PKT_TRAC_TYPE_ARP;
+          return pkt_proto_type;
+      }
+   }
+
+   /* IPV6 NS Tracking enabled */
+   if (VOS_PKT_TRAC_TYPE_NS & tracking_map) {
+      if (adf_nbuf_is_icmpv6_pkt(skb)) {
+          if (adf_nbuf_get_icmpv6_subtype(skb) ==
+                   ADF_PROTO_ICMPV6_NS) {
+              pkt_proto_type = VOS_PKT_TRAC_TYPE_NS;
+              return pkt_proto_type;
+          }
+      }
+   }
+
+   /* IPV6 NA Tracking enabled */
+   if (VOS_PKT_TRAC_TYPE_NA & tracking_map) {
+      if (adf_nbuf_is_icmpv6_pkt(skb)) {
+          if (adf_nbuf_get_icmpv6_subtype(skb) ==
+                   ADF_PROTO_ICMPV6_NA) {
+              pkt_proto_type = VOS_PKT_TRAC_TYPE_NA;
+              return pkt_proto_type;
+          }
       }
    }
 
@@ -314,91 +335,95 @@ void vos_pkt_trace_buf_update
 
    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
              "%s %d, %s", __func__, __LINE__, event_string);
-   spin_lock_bh(&trace_buffer_lock);
 
    if (!trace_buffer) {
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
                 "trace_buffer is already free");
-      spin_unlock_bh(&trace_buffer_lock);
       return;
    }
 
+   spin_lock_bh(&trace_buffer_lock);
    slot = trace_buffer_order % VOS_PKT_TRAC_MAX_TRACE_BUF;
    trace_buffer[slot].order = trace_buffer_order;
+   trace_buffer_order++;
+   spin_unlock_bh(&trace_buffer_lock);
    do_gettimeofday(&tv);
    trace_buffer[slot].event_sec_time = tv.tv_sec;
    trace_buffer[slot].event_msec_time = tv.tv_usec;
-   strncpy(trace_buffer[slot].event_string, event_string,
-          (sizeof(trace_buffer[slot].event_string) < strlen(event_string)?
-           sizeof(trace_buffer[slot].event_string) : strlen(event_string)));
-   trace_buffer_order++;
-   spin_unlock_bh(&trace_buffer_lock);
+   strlcpy(trace_buffer[slot].event_string, event_string,
+          sizeof(trace_buffer[slot].event_string));
 
    return;
 }
 
 /**
- * vos_pkt_trace_buf_dump - Dump stored information into kernel log
+ * vos_pkt_trace_dump_slot_buf() - Helper function to dump pkt trace
+ * @slot: index
+ *
+ * Return: none
  */
-void vos_pkt_trace_buf_dump
-(
-   void
-)
+void vos_pkt_trace_dump_slot_buf(int slot)
 {
-   v_U32_t slot, idx;
-   struct rtc_time tm;
-   unsigned long local_time;
-
-   spin_lock_bh(&trace_buffer_lock);
-   if (!trace_buffer) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-                "trace_buffer is already free");
-      spin_unlock_bh(&trace_buffer_lock);
-      return;
-   }
-   VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-             "PACKET TRACE DUMP START Current Timestamp %u",
-              (unsigned int)vos_timer_get_system_time());
-   VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-             "ORDER :          RTC TIME :    EVT");
-
-   if (VOS_PKT_TRAC_MAX_TRACE_BUF > trace_buffer_order)
-   {
-      for (slot = 0 ; slot < trace_buffer_order; slot++)
-      {
-         local_time = (u32)(trace_buffer[slot].event_sec_time -
-                         (sys_tz.tz_minuteswest * 60));
-         rtc_time_to_tm(local_time, &tm);
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-                   "%5d : [%02d:%02d:%02d.%06lu] : %s",
-                   trace_buffer[slot].order,
-                   tm.tm_hour, tm.tm_min, tm.tm_sec,
-                   trace_buffer[slot].event_sec_time,
-                   trace_buffer[slot].event_string);
-      }
-   }
-   else
-   {
-      for (idx = 0 ; idx < VOS_PKT_TRAC_MAX_TRACE_BUF; idx++)
-      {
-         slot = (trace_buffer_order + idx) % VOS_PKT_TRAC_MAX_TRACE_BUF;
-         local_time = (u32)(trace_buffer[slot].event_msec_time -
-                         (sys_tz.tz_minuteswest * 60));
-         rtc_time_to_tm(local_time, &tm);
-         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-                   "%5d : [%02d:%02d:%02d.%06lu] : %s",
-                   trace_buffer[slot].order,
-                   tm.tm_hour, tm.tm_min, tm.tm_sec,
-                   trace_buffer[slot].event_msec_time,
-                   trace_buffer[slot].event_string);
-      }
-   }
-
-   VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-             "PACKET TRACE DUMP END");
-   spin_unlock_bh(&trace_buffer_lock);
+	struct rtc_time tm;
+	unsigned long local_time;
+
+	local_time = (u32)(trace_buffer[slot].event_sec_time -
+		(sys_tz.tz_minuteswest * 60));
+	rtc_time_to_tm(local_time, &tm);
+	VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+		"%5d : [%02d:%02d:%02d.%06lu] : %s",
+		trace_buffer[slot].order,
+		tm.tm_hour, tm.tm_min, tm.tm_sec,
+		trace_buffer[slot].event_sec_time,
+		trace_buffer[slot].event_string);
+}
 
-   return;
+/**
+ * vos_pkt_trace_buf_dump - Dump stored information into kernel log
+ */
+void vos_pkt_trace_buf_dump(void)
+{
+	uint32_t i, latest_idx = trace_buffer_order;
+	int slot;
+
+	if (!trace_buffer || !latest_idx) {
+		VOS_TRACE(VOS_MODULE_ID_SYS, VOS_TRACE_LEVEL_INFO,
+                "trace_buffer is already free trace_buffer_order: %d",
+		trace_buffer_order);
+		return;
+	}
+	VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+		"PACKET TRACE DUMP START Current Timestamp %u",
+		(unsigned int)vos_timer_get_system_time());
+	VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+		"ORDER :          RTC TIME :    EVT");
+
+	if (VOS_PKT_TRAC_MAX_TRACE_BUF > latest_idx) {
+		/*
+		 * Scenario: Number of trace records less than MAX,
+		 * Circular buffer not overwritten.
+		 */
+		for (slot = latest_idx - 1; slot >= 0 &&
+		     slot > trace_dump_order; slot--)
+			vos_pkt_trace_dump_slot_buf(slot);
+	} else {
+		/*
+		 * Scenario: Number of trace records exceeded MAX,
+		 * Circular buffer is overwritten.
+		 */
+		for (i = 0; (i < VOS_PKT_TRAC_MAX_TRACE_BUF) &&
+		     (latest_idx - i - 1 > trace_dump_order); i++) {
+			slot = ((latest_idx - i - 1) %
+				VOS_PKT_TRAC_MAX_TRACE_BUF);
+			vos_pkt_trace_dump_slot_buf(slot);
+		}
+	}
+
+	trace_dump_order = latest_idx - 1;
+	VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+			"PACKET TRACE DUMP END");
+
+	return;
 }
 
 /**
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_sched.c b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_sched.c
index 0df54b0554d..3f24b92563c 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_sched.c
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_sched.c
@@ -670,6 +670,7 @@ VOS_STATUS vos_watchdog_open
   vos_mem_zero(pWdContext, sizeof(VosWatchdogContext));
   pWdContext->pVContext = pVosContext;
   gpVosWatchdogContext = pWdContext;
+  pWdContext->thread_stuck_timer.state = VOS_TIMER_STATE_UNUSED;
 
   //Initialize the helper events and event queues
   init_completion(&pWdContext->WdStartEvent);
@@ -999,23 +1000,22 @@ static void vos_wd_detect_thread_stuck(void)
 		vos_flush_logs(WLAN_LOG_TYPE_FATAL,
 			       WLAN_LOG_INDICATOR_HOST_ONLY,
 			       WLAN_LOG_REASON_THREAD_STUCK,
-			       true);
+			       DUMP_VOS_TRACE);
 		spin_lock_irqsave(&gpVosWatchdogContext->thread_stuck_lock,
 			flags);
 	}
 
-	if (!gpVosWatchdogContext->mc_thread_stuck_count) {
+	/* Increment the thread stuck count for all threads */
+	gpVosWatchdogContext->mc_thread_stuck_count++;
+
+	if (gpVosWatchdogContext->mc_thread_stuck_count <=
+				THREAD_STUCK_THRESHOLD) {
 		spin_unlock_irqrestore(&gpVosWatchdogContext->thread_stuck_lock,
 				flags);
 		vos_probe_threads();
-		spin_lock_irqsave(&gpVosWatchdogContext->thread_stuck_lock,
+	} else
+		spin_unlock_irqrestore(&gpVosWatchdogContext->thread_stuck_lock,
 				flags);
-	}
-
-	/* Increment the thread stuck count for all threads */
-	gpVosWatchdogContext->mc_thread_stuck_count++;
-
-	spin_unlock_irqrestore(&gpVosWatchdogContext->thread_stuck_lock, flags);
 
 	/* Restart the timer */
 	if (VOS_STATUS_SUCCESS !=
@@ -1045,6 +1045,30 @@ static void vos_wd_detect_thread_stuck_cb(void *priv)
 	}
 }
 
+ /**
+ * vos_thread_stuck_timer_init - Initialize thread stuck timer
+ *
+ * @wd_ctx: watchdog context.
+ *
+ * Return: void
+ */
+void vos_thread_stuck_timer_init(pVosWatchdogContext wd_ctx)
+{
+    if (vos_timer_init(&wd_ctx->thread_stuck_timer,
+                       VOS_TIMER_TYPE_SW,
+                       vos_wd_detect_thread_stuck_cb, NULL))
+        hddLog(LOGE, FL("Unable to initialize thread stuck timer"));
+    else
+    {
+        if (VOS_STATUS_SUCCESS !=
+                 vos_timer_start(&wd_ctx->thread_stuck_timer,
+                                 THREAD_STUCK_TIMER_VAL))
+            hddLog(LOGE, FL("Unable to start thread stuck timer"));
+        else
+            hddLog(LOG1, FL("Successfully started thread stuck timer"));
+    }
+}
+
 /**
  * vos_wd_reset_thread_stuck_count()- Callback to
  * probe msg sent to Threads.
@@ -1085,7 +1109,7 @@ VosWDThread
   v_BOOL_t shutdown              = VOS_FALSE;
   int count                      = 0;
   VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
-  set_user_nice(current, -3);
+  set_user_nice(current, -4);
 
   if (Arg == NULL)
   {
@@ -1097,22 +1121,6 @@ VosWDThread
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
   daemonize("WD_Thread");
 #endif
-  /* Initialize the timer to detect thread stuck issues */
-  if (vos_timer_init(&gpVosWatchdogContext->thread_stuck_timer,
-        VOS_TIMER_TYPE_SW, vos_wd_detect_thread_stuck_cb, NULL)) {
-      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                "Unable to initialize thread stuck timer");
-  } else {
-      if (VOS_STATUS_SUCCESS !=
-              vos_timer_start(&gpVosWatchdogContext->thread_stuck_timer,
-                           THREAD_STUCK_TIMER_VAL))
-          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                        "Unable to start thread stuck timer");
-      else
-          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
-                        "Successfully started thread stuck timer");
-  }
-
   /*
   ** Ack back to the context from which the Watchdog thread has been
   ** created.
@@ -1244,7 +1252,10 @@ VosWDThread
     } // while message loop processing
   } // while shutdown
 
-  vos_timer_destroy(&pWdContext->thread_stuck_timer);
+  /* destroy the timer only if intialized */
+  if (pWdContext->thread_stuck_timer.state != VOS_TIMER_STATE_UNUSED) {
+    vos_timer_destroy(&pWdContext->thread_stuck_timer);
+  }
   // If we get here the Watchdog thread must exit
   VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
       "%s: Watchdog Thread exiting !!!!", __func__);
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_sched.h b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_sched.h
index 62f966ba9df..a04573f89e9 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_sched.h
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_sched.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -322,6 +322,20 @@ struct vos_log_complete {
 	bool is_report_in_progress;
 };
 
+/**
+ * struct vos_wdthread_timer_work - Watchdog timer thread structure
+ * @callback: Watchdog timer work call back
+ * @userdata: Input to the timer call back function
+ * @node: wdthread timer work Linklist
+ *
+ * This structure internally stores wdthread timer work related params
+ */
+struct vos_wdthread_timer_work {
+	vos_timer_callback_t callback;
+	void *userdata;
+	struct list_head node;
+};
+
 typedef struct _VosContextType
 {
    /* Messages buffers */
@@ -397,6 +411,10 @@ typedef struct _VosContextType
 
    /* radio index per driver */
    int radio_index;
+   struct vos_wdthread_timer_work wdthread_timer_work;
+   struct list_head wdthread_timer_work_list;
+   struct work_struct wdthread_work;
+   spinlock_t wdthread_work_lock;
 } VosContextType, *pVosContextType;
 
 
@@ -640,6 +658,7 @@ int vos_get_gfp_flags(void);
 void vos_wd_reset_thread_stuck_count(int thread_id);
 bool vos_is_wd_thread(int thread_id);
 int vos_sched_is_mc_thread(int thread_id);
+void vos_thread_stuck_timer_init(pVosWatchdogContext wd_ctx);
 
 #define vos_wait_for_work_thread_completion(func) vos_is_ssr_ready(func)
 
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_timer.c b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_timer.c
index 48e3d57f439..9b0cc8df6f7 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_timer.c
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_timer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013, 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -46,6 +46,7 @@
 #include "wlan_qct_sys.h"
 #include "vos_sched.h"
 #include <linux/rtc.h>
+#include "vos_cnss.h"
 
 /*--------------------------------------------------------------------------
   Preprocessor definitions and constants
@@ -122,6 +123,9 @@ static void vos_linux_timer_callback (unsigned long data)
    v_PVOID_t userData=NULL;
    int threadId;
    VOS_TIMER_TYPE type=VOS_TIMER_TYPE_SW;
+   v_CONTEXT_t vos_context = NULL;
+   pVosContextType vos_global_context;
+   struct vos_wdthread_timer_work *wdthread_timer_work;
 
    VOS_ASSERT(timer);
 
@@ -190,7 +194,27 @@ static void vos_linux_timer_callback (unsigned long data)
    if (vos_is_wd_thread(threadId)) {
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
                 "TIMER callback: running on wd thread");
-      callback(userData);
+      vos_context = vos_get_global_context(VOS_MODULE_ID_HDD, NULL);
+      if (!vos_context) {
+         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                   "%s: Global VOS context is Null", __func__);
+         return;
+      }
+      vos_global_context = (pVosContextType)vos_context;
+      wdthread_timer_work = vos_mem_malloc(sizeof(*wdthread_timer_work));
+      if (NULL == wdthread_timer_work) {
+          VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+                    "%s: No memory available", __func__);
+          return;
+      }
+      wdthread_timer_work->callback = callback;
+      wdthread_timer_work->userdata = userData;
+      spin_lock(&vos_global_context->wdthread_work_lock);
+      list_add(&wdthread_timer_work->node,
+                    &vos_global_context->wdthread_timer_work_list);
+      spin_unlock(&vos_global_context->wdthread_work_lock);
+
+      schedule_work(&vos_global_context->wdthread_work);
       return;
    }
 
@@ -673,7 +697,7 @@ VOS_STATUS vos_timer_start( vos_timer_t *timer, v_U32_t expirationTime )
    unsigned long flags;
 
    VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
-             "Timer Addr inside voss_start : 0x%p ", timer );
+             "Timer Addr inside voss_start : 0x%pK ", timer );
 
    // Check for invalid pointer
    if ( NULL == timer )
@@ -765,7 +789,7 @@ VOS_STATUS vos_timer_stop ( vos_timer_t *timer )
    unsigned long flags;
 
    VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO_HIGH,
-               "%s: Timer Addr inside voss_stop : 0x%p",__func__,timer );
+               "%s: Timer Addr inside voss_stop : 0x%pK",__func__,timer );
 
    // Check for invalid pointer
    if ( NULL == timer )
@@ -869,3 +893,118 @@ unsigned long vos_get_time_of_the_day_ms(void)
 		(tm.tm_min *60 * 1000) + (tm.tm_sec * 1000)+
 		(tv.tv_usec/1000));
 }
+
+void vos_get_time_of_the_day_in_hr_min_sec_usec(char *tbuf, int len)
+{
+       struct timeval tv;
+       struct rtc_time tm;
+       unsigned long local_time;
+
+       /* Format the Log time R#: [hr:min:sec.microsec] */
+       do_gettimeofday(&tv);
+       /* Convert rtc to local time */
+       local_time = (u32)(tv.tv_sec - (sys_tz.tz_minuteswest * 60));
+       rtc_time_to_tm(local_time, &tm);
+       snprintf(tbuf, len,
+               "[%02d:%02d:%02d.%06lu] ",
+               tm.tm_hour, tm.tm_min, tm.tm_sec, tv.tv_usec);
+}
+
+/**
+ * vos_wdthread_init_timer_work() -  Initialize timer work
+ * @callbackptr: timer work callback
+ *
+ * Initialize watchdog thread timer work structure and linked
+ * list.
+ * return - void
+ */
+void vos_wdthread_init_timer_work(void *callbackptr)
+{
+	pVosContextType context;
+
+	context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+	if (!context) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+			"%s: Global VOS context is Null", __func__);
+		return;
+	}
+
+	spin_lock_init(&context->wdthread_work_lock);
+	INIT_LIST_HEAD(&context->wdthread_timer_work_list);
+	vos_init_work(&context->wdthread_work, callbackptr);
+}
+
+/**
+ * vos_wdthread_flush_timer_work() -  Flush timer work
+ *
+ * Flush watchdog thread timer work structure.
+ * return - void
+ */
+void vos_wdthread_flush_timer_work()
+{
+	pVosContextType context;
+
+	context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+	if (!context) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+			"%s: Global VOS context is Null", __func__);
+		return;
+	}
+
+	vos_flush_work(&context->wdthread_work);
+}
+
+/**
+ * __vos_process_wd_timer() -  Handle wathdog thread timer work
+ *
+ * Process watchdog thread timer work.
+ * return - void
+ */
+static void __vos_process_wd_timer(void)
+{
+	v_CONTEXT_t vos_context = NULL;
+	pVosContextType vos_global_context;
+	struct vos_wdthread_timer_work *wdthread_timer_work;
+	struct list_head *pos, *next;
+
+	vos_context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+
+	if (!vos_context) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+			"%s: Global VOS context is Null", __func__);
+		return;
+	}
+
+	vos_global_context = (pVosContextType)vos_context;
+
+	spin_lock(&vos_global_context->wdthread_work_lock);
+	list_for_each_safe(pos, next,
+			&vos_global_context->wdthread_timer_work_list) {
+		wdthread_timer_work = list_entry(pos,
+						struct vos_wdthread_timer_work,
+						node);
+		list_del(pos);
+		spin_unlock(&vos_global_context->wdthread_work_lock);
+		if (NULL != wdthread_timer_work->callback)
+			wdthread_timer_work->callback(
+				wdthread_timer_work->userdata);
+		vos_mem_free(wdthread_timer_work);
+		spin_lock(&vos_global_context->wdthread_work_lock);
+	}
+	spin_unlock(&vos_global_context->wdthread_work_lock);
+
+	return;
+}
+
+/**
+ * vos_process_wd_timer() -  Wrapper function to handle timer work
+ *
+ * Wrapper function to process timer work.
+ * return - void
+ */
+void vos_process_wd_timer(void)
+{
+	vos_ssr_protect(__func__);
+	__vos_process_wd_timer();
+	vos_ssr_unprotect(__func__);
+}
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_trace.c b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_trace.c
index 0cd7dc7f191..b25ef46a6d2 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_trace.c
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_trace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -335,10 +335,6 @@ void vos_trace_display(void)
    }
 }
 
-#define ROW_SIZE 16
-/* Buffer size = data bytes(2 hex chars plus space) + NULL */
-#define BUFFER_SIZE ((ROW_SIZE * 3) + 1)
-
 /*----------------------------------------------------------------------------
 
   \brief vos_trace_hex_dump() - Externally called hex dump function
@@ -503,6 +499,7 @@ void vos_trace(v_U8_t module, v_U8_t code, v_U16_t session, v_U32_t data)
 {
     tpvosTraceRecord rec = NULL;
     unsigned long flags;
+    char time[20];
 
     if (!gvosTraceData.enable)
     {
@@ -514,6 +511,8 @@ void vos_trace(v_U8_t module, v_U8_t code, v_U16_t session, v_U32_t data)
          return;
     }
 
+    vos_get_time_of_the_day_in_hr_min_sec_usec(time, sizeof(time));
+
     /* Aquire the lock so that only one thread at a time can fill the ring buffer */
     spin_lock_irqsave(&ltraceLock, flags);
 
@@ -551,13 +550,12 @@ void vos_trace(v_U8_t module, v_U8_t code, v_U16_t session, v_U32_t data)
 
         gvosTraceData.tail = tail;
     }
-
     rec = &gvosTraceTbl[gvosTraceData.tail];
     rec->code = code;
     rec->session = session;
     rec->data = data;
-    rec->time = adf_get_boottime();
-    rec->module =  module;
+    snprintf(rec->time, sizeof(rec->time), "%s", time);
+    rec->module = module;
     rec->pid = (in_interrupt() ? 0 : current->pid);
     gvosTraceData.numSinceLastDump ++;
     spin_unlock_irqrestore(&ltraceLock, flags);
diff --git a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_utils.c b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_utils.c
index d178b8b709e..fbfb9b41b31 100644
--- a/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_utils.c
+++ b/drivers/staging/qcacld-2.0/CORE/VOSS/src/vos_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -62,7 +62,11 @@
 
 #include <linux/err.h>
 #include <linux/random.h>
+#if(LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0))
+#include <crypto/skcipher.h>
+#else
 #include <linux/crypto.h>
+#endif
 #include <linux/scatterlist.h>
 #include <linux/completion.h>
 #include <linux/ieee80211.h>
@@ -97,7 +101,7 @@
    Function Definitions and Documentation
  * -------------------------------------------------------------------------*/
 #ifndef CONFIG_CNSS
-#if defined(WLAN_FEATURE_11W) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if defined(WLAN_FEATURE_11W) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
 #define CMAC_TLEN 8 /* CMAC TLen = 64 bits (8 octets) */
 
 static inline void xor_128(const u8 *a, const u8 *b, u8 *out)
@@ -399,7 +403,7 @@ vos_attach_mmie(v_U8_t *igtk, v_U8_t *ipn, u_int16_t key_id,
     /*
      * Calculate MIC and then copy
      */
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     tfm = crypto_alloc_cipher( "aes", 0, CRYPTO_ALG_ASYNC);
 #else
     tfm = wcnss_wlan_crypto_alloc_cipher( "aes", 0, CRYPTO_ALG_ASYNC);
@@ -455,7 +459,7 @@ vos_attach_mmie(v_U8_t *igtk, v_U8_t *ipn, u_int16_t key_id,
                 (v_U8_t*)(efrm-(frmLen-sizeof(struct ieee80211_frame))),
                 nBytes - AAD_LEN - CMAC_TLEN);
 
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     cmac_calc_mic(tfm, input, nBytes, mic);
 #else
     wcnss_wlan_cmac_calc_mic(tfm, input, nBytes, mic);
@@ -476,7 +480,7 @@ err_tfm:
     }
 
     if (tfm)
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
        crypto_free_cipher(tfm);
 #else
        wcnss_wlan_crypto_free_cipher(tfm);
@@ -525,7 +529,7 @@ v_BOOL_t vos_is_mmie_valid(v_U8_t *igtk, v_U8_t *ipn,
         return VOS_FALSE;
     }
 
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     tfm = crypto_alloc_cipher( "aes", 0, CRYPTO_ALG_ASYNC);
 #else
     tfm = wcnss_wlan_crypto_alloc_cipher( "aes", 0, CRYPTO_ALG_ASYNC);
@@ -574,7 +578,7 @@ v_BOOL_t vos_is_mmie_valid(v_U8_t *igtk, v_U8_t *ipn,
     vos_mem_copy(input, aad, AAD_LEN);
     vos_mem_copy(input+AAD_LEN, (v_U8_t*)(wh+1), nBytes - AAD_LEN - CMAC_TLEN);
 
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     cmac_calc_mic(tfm, input, nBytes, mic);
 #else
     wcnss_wlan_cmac_calc_mic(tfm, input, nBytes, mic);
@@ -604,7 +608,7 @@ v_BOOL_t vos_is_mmie_valid(v_U8_t *igtk, v_U8_t *ipn,
 
 err_tfm:
     if (tfm)
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
         crypto_free_cipher(tfm);
 #else
         wcnss_wlan_crypto_free_cipher(tfm);
@@ -668,7 +672,7 @@ int hmac_sha1(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
 
     init_completion(&tresult.completion);
 
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     tfm = crypto_alloc_ahash("hmac(sha1)", CRYPTO_ALG_TYPE_AHASH,
                                         CRYPTO_ALG_TYPE_AHASH_MASK);
 #else
@@ -704,7 +708,7 @@ int hmac_sha1(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
 
     if (ksize) {
         crypto_ahash_clear_flags(tfm, ~0);
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
         ret = crypto_ahash_setkey(tfm, key, ksize);
 #else
         ret = wcnss_wlan_crypto_ahash_setkey(tfm, key, ksize);
@@ -717,7 +721,7 @@ int hmac_sha1(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
     }
 
     ahash_request_set_crypt(req, &sg, hash_result, psize);
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     ret = crypto_ahash_digest(req);
 #else
     ret = wcnss_wlan_crypto_ahash_digest(req);
@@ -753,7 +757,7 @@ err_setkey:
 err_hash_buf:
     ahash_request_free(req);
 err_req:
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     crypto_free_ahash(tfm);
 #else
     wcnss_wlan_crypto_free_ahash(tfm);
@@ -841,7 +845,7 @@ int hmac_md5(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
 
     init_completion(&tresult.completion);
 
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     tfm = crypto_alloc_ahash("hmac(md5)", CRYPTO_ALG_TYPE_AHASH,
                                         CRYPTO_ALG_TYPE_AHASH_MASK);
 #else
@@ -877,7 +881,7 @@ int hmac_md5(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
 
     if (ksize) {
         crypto_ahash_clear_flags(tfm, ~0);
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
         ret = crypto_ahash_setkey(tfm, key, ksize);
 #else
         ret = wcnss_wlan_crypto_ahash_setkey(tfm, key, ksize);
@@ -889,7 +893,7 @@ int hmac_md5(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
     }
 
     ahash_request_set_crypt(req, &sg, hash_result, psize);
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     ret = crypto_ahash_digest(req);
 #else
     ret = wcnss_wlan_crypto_ahash_digest(req);
@@ -926,7 +930,7 @@ err_setkey:
 err_hash_buf:
         ahash_request_free(req);
 err_req:
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
         crypto_free_ahash(tfm);
 #else
         wcnss_wlan_crypto_free_ahash(tfm);
@@ -976,7 +980,7 @@ static void ecb_aes_complete(struct crypto_async_request *req, int err)
     complete(&r->completion);
 }
 
-
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0))
 /*--------------------------------------------------------------------------
 
   \brief vos_encrypt_AES() - Generate AES Encrypted byte stream
@@ -1003,7 +1007,90 @@ static void ecb_aes_complete(struct crypto_async_request *req, int err)
 
     ( *** return value not considered yet )
   --------------------------------------------------------------------------*/
+VOS_STATUS vos_encrypt_AES(v_U32_t cryptHandle, /* Handle */
+                           v_U8_t *pPlainText, /* pointer to data stream */
+                           v_U8_t *pCiphertext,
+                           v_U8_t *pKey) /* pointer to authentication key */
+{
+    struct ecb_aes_result result;
+    struct crypto_skcipher *tfm;
+    struct skcipher_request *req;
+    int ret = 0;
+    char iv[IV_SIZE_AES_128];
+    struct scatterlist sg_in;
+    struct scatterlist sg_out;
+
+    init_completion(&result.completion);
+
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
+    tfm =  crypto_alloc_skcipher( "cbc(aes)", 0, 0);
+#else
+    tfm =  wcnss_wlan_crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
+#endif
+    if (IS_ERR(tfm)) {
+        VOS_TRACE(VOS_MODULE_ID_VOSS,VOS_TRACE_LEVEL_ERROR, "crypto_alloc_skcipher failed");
+        ret = PTR_ERR(tfm);
+        goto err_tfm;
+    }
+
+    req = skcipher_request_alloc(tfm, GFP_KERNEL);
+    if (!req) {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "Failed to allocate request for cbc(aes)");
+        ret = -ENOMEM;
+        goto err_req;
+    }
+
+    skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+                                    ecb_aes_complete, &result);
+
+
+    crypto_skcipher_clear_flags(tfm, ~0);
 
+    ret = crypto_skcipher_setkey(tfm, pKey, AES_KEYSIZE_128);
+    if (ret) {
+        VOS_TRACE(VOS_MODULE_ID_VOSS,VOS_TRACE_LEVEL_ERROR, "crypto_skcipher_setkey failed");
+        goto err_setkey;
+    }
+
+    memset(iv, 0, IV_SIZE_AES_128);
+
+    sg_init_one(&sg_in, pPlainText, AES_BLOCK_SIZE);
+
+    sg_init_one(&sg_out, pCiphertext, AES_BLOCK_SIZE);
+
+    skcipher_request_set_crypt(req, &sg_in, &sg_out, AES_BLOCK_SIZE, iv);
+
+    ret = crypto_skcipher_encrypt(req);
+    if (ret == -EINPROGRESS || ret == -EBUSY) {
+        VOS_TRACE(VOS_MODULE_ID_VOSS,VOS_TRACE_LEVEL_ERROR, "crypto_skcipher_encrypt failed ret %d", ret);
+        wait_for_completion(&result.completion);
+        ret = result.err;
+    }
+
+
+// -------------------------------------
+err_setkey:
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
+    skcipher_request_free(req);
+#else
+    wcnss_wlan_ablkcipher_request_free(req);
+#endif
+err_req:
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
+    crypto_free_skcipher(tfm);
+#else
+    wcnss_wlan_crypto_free_ablkcipher(tfm);
+#endif
+err_tfm:
+    //return ret;
+    if (ret != 0) {
+        VOS_TRACE(VOS_MODULE_ID_VOSS,VOS_TRACE_LEVEL_ERROR,"%s() call failed", __func__);
+        return VOS_STATUS_E_FAULT;
+   }
+
+    return VOS_STATUS_SUCCESS;
+}
+#else //(LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0))
 VOS_STATUS vos_encrypt_AES(v_U32_t cryptHandle, /* Handle */
                            v_U8_t *pPlainText, /* pointer to data stream */
                            v_U8_t *pCiphertext,
@@ -1019,7 +1106,7 @@ VOS_STATUS vos_encrypt_AES(v_U32_t cryptHandle, /* Handle */
 
     init_completion(&result.completion);
 
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     tfm =  crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
 #else
     tfm =  wcnss_wlan_crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
@@ -1063,13 +1150,13 @@ VOS_STATUS vos_encrypt_AES(v_U32_t cryptHandle, /* Handle */
 
 // -------------------------------------
 err_setkey:
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     ablkcipher_request_free(req);
 #else
     wcnss_wlan_ablkcipher_request_free(req);
 #endif
 err_req:
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     crypto_free_ablkcipher(tfm);
 #else
     wcnss_wlan_crypto_free_ablkcipher(tfm);
@@ -1083,7 +1170,9 @@ err_tfm:
 
     return VOS_STATUS_SUCCESS;
 }
+#endif //(LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0))
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0))
 /*--------------------------------------------------------------------------
 
   \brief vos_decrypt_AES() - Decrypts an AES Encrypted byte stream
@@ -1110,7 +1199,90 @@ err_tfm:
 
     ( *** return value not considered yet )
   --------------------------------------------------------------------------*/
+VOS_STATUS vos_decrypt_AES(v_U32_t cryptHandle, /* Handle */
+                           v_U8_t *pText, /* pointer to data stream */
+                           v_U8_t *pDecrypted,
+                           v_U8_t *pKey) /* pointer to authentication key */
+{
+//    VOS_STATUS uResult = VOS_STATUS_E_FAILURE;
+    struct ecb_aes_result result;
+    struct skcipher_request *req;
+    struct crypto_skcipher *tfm;
+    int ret = 0;
+    char iv[IV_SIZE_AES_128];
+    struct scatterlist sg_in;
+    struct scatterlist sg_out;
+
+    init_completion(&result.completion);
 
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
+    tfm =  crypto_alloc_skcipher( "cbc(aes)", 0, 0);
+#else
+    tfm =  wcnss_wlan_crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
+#endif
+    if (IS_ERR(tfm)) {
+        VOS_TRACE(VOS_MODULE_ID_VOSS,VOS_TRACE_LEVEL_ERROR, "crypto_alloc_skcipher failed");
+        ret = PTR_ERR(tfm);
+        goto err_tfm;
+    }
+
+    req = skcipher_request_alloc(tfm, GFP_KERNEL);
+    if (!req) {
+        VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "Failed to allocate request for cbc(aes)");
+        ret = -ENOMEM;
+        goto err_req;
+    }
+
+    skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+                                    ecb_aes_complete, &result);
+
+
+    crypto_skcipher_clear_flags(tfm, ~0);
+
+    ret = crypto_skcipher_setkey(tfm, pKey, AES_KEYSIZE_128);
+    if (ret) {
+        VOS_TRACE(VOS_MODULE_ID_VOSS,VOS_TRACE_LEVEL_ERROR, "crypto_cipher_setkey failed");
+        goto err_setkey;
+       }
+
+    memset(iv, 0, IV_SIZE_AES_128);
+
+    sg_init_one(&sg_in, pText, AES_BLOCK_SIZE);
+
+    sg_init_one(&sg_out, pDecrypted, AES_BLOCK_SIZE);
+
+    skcipher_request_set_crypt(req, &sg_in, &sg_out, AES_BLOCK_SIZE, iv);
+
+    ret = crypto_skcipher_decrypt(req);
+    skcipher_request_zero(req);
+    if (ret) {
+        VOS_TRACE(VOS_MODULE_ID_VOSS,VOS_TRACE_LEVEL_ERROR,"AES: failed to decrypt received packet");
+    }
+
+
+// -------------------------------------
+err_setkey:
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
+    skcipher_request_free(req);
+#else
+    wcnss_wlan_ablkcipher_request_free(req);
+#endif
+err_req:
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
+    crypto_free_skcipher(tfm);
+#else
+    wcnss_wlan_crypto_free_ablkcipher(tfm);
+#endif
+err_tfm:
+    //return ret;
+    if (ret != 0) {
+        VOS_TRACE(VOS_MODULE_ID_VOSS,VOS_TRACE_LEVEL_ERROR,"%s() call failed", __func__);
+        return VOS_STATUS_E_FAULT;
+      }
+
+    return VOS_STATUS_SUCCESS;
+}
+#else //LINUX_VERSION_CODE < KERNEL_VERSION(4,8,0)
 VOS_STATUS vos_decrypt_AES(v_U32_t cryptHandle, /* Handle */
                            v_U8_t *pText, /* pointer to data stream */
                            v_U8_t *pDecrypted,
@@ -1127,7 +1299,7 @@ VOS_STATUS vos_decrypt_AES(v_U32_t cryptHandle, /* Handle */
 
     init_completion(&result.completion);
 
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     tfm =  crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
 #else
     tfm =  wcnss_wlan_crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
@@ -1171,13 +1343,13 @@ VOS_STATUS vos_decrypt_AES(v_U32_t cryptHandle, /* Handle */
 
 // -------------------------------------
 err_setkey:
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     ablkcipher_request_free(req);
 #else
     wcnss_wlan_ablkcipher_request_free(req);
 #endif
 err_req:
-#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO))
+#if  !defined(CONFIG_CNSS) && (defined(HIF_USB) || defined(HIF_SDIO) || defined(CONFIG_NON_QC_PLATFORM_PCI))
     crypto_free_ablkcipher(tfm);
 #else
     wcnss_wlan_crypto_free_ablkcipher(tfm);
@@ -1191,6 +1363,7 @@ err_tfm:
 
     return VOS_STATUS_SUCCESS;
 }
+#endif //(LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0))
 
 v_U32_t vos_chan_to_freq(v_U8_t chan)
 {
diff --git a/drivers/staging/qcacld-2.0/CORE/WDA/inc/legacy/halMsgApi.h b/drivers/staging/qcacld-2.0/CORE/WDA/inc/legacy/halMsgApi.h
index baaf24e199d..e5f1861178a 100644
--- a/drivers/staging/qcacld-2.0/CORE/WDA/inc/legacy/halMsgApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/WDA/inc/legacy/halMsgApi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -314,6 +314,7 @@ typedef struct
     tANI_U8  nonRoamReassoc;
     uint32_t nss; /* Number of spatial streams supported */
     tANI_U8  max_amsdu_num;
+    uint8_t  channelwidth;
 } tAddStaParams, *tpAddStaParams;
 
 
@@ -545,6 +546,7 @@ typedef struct
     uint32_t tx_aggregation_size;
     uint32_t rx_aggregation_size;
     uint16_t beacon_tx_rate;
+    uint8_t  channelwidth;
 } tAddBssParams, * tpAddBssParams;
 
 typedef struct
@@ -1037,6 +1039,10 @@ typedef struct
     tANI_U8  dot11_mode;
 
     uint8_t restart_on_chan_switch;
+
+    uint32_t channelwidth;
+
+    uint16_t reduced_beacon_interval;
 }tSwitchChannelParams, *tpSwitchChannelParams;
 
 typedef struct CSAOffloadParams {
@@ -1047,6 +1053,7 @@ typedef struct CSAOffloadParams {
    tANI_U8 new_op_class;       /* New operating class */
    tANI_U8 new_ch_freq_seg1;   /* Channel Center frequency 1 */
    tANI_U8 new_ch_freq_seg2;   /* Channel Center frequency 2 */
+   tANI_U8 new_sub20_channelwidth;  /* 5MHz or 10Mhz channel width */
    tANI_U32 ies_present_flag;   /* WMI_CSA_EVENT_IES_PRESENT_FLAG */
    tSirMacAddr bssId;
 }*tpCSAOffloadParams, tCSAOffloadParams;
@@ -1134,102 +1141,6 @@ typedef struct
 
 eHalStatus halMsg_setPromiscMode(tpAniSirGlobal pMac);
 
-
-//
-// Mesg header is used from tSirMsgQ
-// Mesg Type = SIR_HAL_ADDBA_REQ
-//
-typedef struct sAddBAParams
-{
-
-    // Station Index
-    tANI_U16 staIdx;
-
-    // Peer MAC Address
-    tSirMacAddr peerMacAddr;
-
-    // ADDBA Action Frame dialog token
-    // HAL will not interpret this object
-    tANI_U8 baDialogToken;
-
-    // TID for which the BA is being setup
-    // This identifies the TC or TS of interest
-    tANI_U8 baTID;
-
-    // 0 - Delayed BA (Not supported)
-    // 1 - Immediate BA
-    tANI_U8 baPolicy;
-
-    // Indicates the number of buffers for this TID (baTID)
-    // NOTE - This is the requested buffer size. When this
-    // is processed by HAL and subsequently by HDD, it is
-    // possible that HDD may change this buffer size. Any
-    // change in the buffer size should be noted by PE and
-    // advertized appropriately in the ADDBA response
-    tANI_U16 baBufferSize;
-
-    // BA timeout in TU's
-    // 0 means no timeout will occur
-    tANI_U16 baTimeout;
-
-    // b0..b3 - Fragment Number - Always set to 0
-    // b4..b15 - Starting Sequence Number of first MSDU
-    // for which this BA is setup
-    tANI_U16 baSSN;
-
-    // ADDBA direction
-    // 1 - Originator
-    // 0 - Recipient
-    tANI_U8 baDirection;
-
-    //
-    // Following parameters are for returning status from
-    // HAL to PE via response message. HAL does not read them
-    //
-    // The return status of SIR_HAL_ADDBA_REQ is reported
-    // in the SIR_HAL_ADDBA_RSP message
-    eHalStatus status;
-
-    // Indicating to HAL whether a response message is required.
-    tANI_U8 respReqd;
-    tANI_U8    sessionId; // PE session id for PE<->HAL interface
-                          //  HAL Sends back the PE session
-                          //  id unmodified
-
-} tAddBAParams, * tpAddBAParams;
-
-
-//
-// Mesg header is used from tSirMsgQ
-// Mesg Type = SIR_HAL_DELBA_IND
-//
-typedef struct sDelBAParams
-{
-
-    // Station Index
-    tANI_U16 staIdx;
-
-    // TID for which the BA session is being deleted
-    tANI_U8 baTID;
-
-    // DELBA direction
-    // 1 - Originator
-    // 0 - Recipient
-    tANI_U8 baDirection;
-
-    // FIXME - Do we need a response for this?
-    // Maybe just the IND/REQ will suffice?
-    //
-    // Following parameters are for returning status from
-    // HAL to PE via response message. HAL does not read them
-    //
-    // The return status of SIR_HAL_DELBA_REQ is reported
-    // in the SIR_HAL_DELBA_RSP message
-    //eHalStatus status;
-
-} tDelBAParams, * tpDelBAParams;
-
-
 //
 // Mesg header is used from tSirMsgQ
 // Mesg Type = SIR_HAL_SET_MIMOPS_REQ
@@ -1290,44 +1201,6 @@ typedef struct sExitUapsdParams
     tANI_U8     bssIdx;
 }tExitUapsdParams, *tpExitUapsdParams;
 
-//
-// Mesg header is used from tSirMsgQ
-// Mesg Type = SIR_LIM_DEL_BA_IND
-//
-typedef struct sBADeleteParams
-{
-
-    // Station Index
-    tANI_U16 staIdx;
-
-    // Peer MAC Address, whose BA session has timed out
-    tSirMacAddr peerMacAddr;
-
-    // TID for which a BA session timeout is being triggered
-    tANI_U8 baTID;
-
-    // DELBA direction
-    // 1 - Originator
-    // 0 - Recipient
-    tANI_U8 baDirection;
-
-    tANI_U32 reasonCode;
-
-    tSirMacAddr  bssId; // TO SUPPORT BT-AMP
-                        // HAL copies the sta bssid to this.
-} tBADeleteParams, * tpBADeleteParams;
-
-
-// Mesg Type = SIR_LIM_ADD_BA_IND
-typedef struct sBaActivityInd
-{
-    tANI_U16 baCandidateCnt;
-    //baCandidateCnt is followed by BA Candidate List ( tAddBaCandidate)
-
-    tSirMacAddr  bssId; // TO SUPPORT BT-AMP
-} tBaActivityInd, * tpBaActivityInd;
-
-
 // Mesg Type = SIR_LIM_IBSS_PEER_INACTIVITY_IND
 typedef struct sIbssPeerInactivityInd
 {
diff --git a/drivers/staging/qcacld-2.0/CORE/WDA/inc/legacy/wlan_qct_hal.h b/drivers/staging/qcacld-2.0/CORE/WDA/inc/legacy/wlan_qct_hal.h
index 7091d2e8dd3..05304fc2e0c 100644
--- a/drivers/staging/qcacld-2.0/CORE/WDA/inc/legacy/wlan_qct_hal.h
+++ b/drivers/staging/qcacld-2.0/CORE/WDA/inc/legacy/wlan_qct_hal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -420,100 +420,6 @@ v_BOOL_t WLANHAL_IsHwFrameTxTranslationCapable(v_PVOID_t pVosGCtx, tANI_U8 staId
 #define tHalTxBd    halTxBd_type
 #define tpHalTxBd    pHalTxBd_type
 
-#ifdef BA_PARAM_STRUCTURE
-#else
-#define BA_PARAM_STRUCTURE
-//
-// HAL --> TL
-// Messages indicating the setup and/or teardown of
-// A-MPDU/BA sessions with a given peer HT MAC entity
-//
-
-//
-// A data structure identifying all of the variables
-// in a typical A-MPDU/BA setup
-//
-typedef struct sBAParams
-{
-
-  // A unique BA Session ID that has been assigned by HAL
-  // for the curent BA Session
-  tANI_U16 baSessionID;
-
-  // TID for which the BA session has been setup
-  tANI_U8 baTID;
-
-  // BA Buffer Size allocated for the current BA session   //Should be deleted. needs TL change. use winSize instead
-  tANI_U8 baBufferSize;
-
-  tANI_U16 SSN;
-  tANI_U8 winSize;
-  tANI_U8 STAID;
-
-} tBAParams, *tpBAParams;
-
-//
-// TL -> HAL
-// tSirMsgQ.type = SIR_HAL_HDD_ADDBA_RSP
-//
-typedef struct sAddBARsp
-{
-  // Message Type
-  tANI_U16 mesgType;
-
-  // Message Length
-  tANI_U16 mesgLen;
-
-  //BA session ID
-  tANI_U16 baSessionID;
-
-  tANI_U16 replyWinSize;
-}tAddBARsp, *tpAddBARsp;
-
-//
-// HAL -> TL
-// tSirMsgQ.type = SIR_HAL_ADDBA_IND
-// tSirMsgQ.reserved = 0
-// tSirMsgQ.body = "allocated" instance of tpAddBAInd
-//
-typedef struct sAddBAInd
-{
-
-  // Message Type
-  tANI_U16 mesgType;
-
-  // Message Length
-  tANI_U16 mesgLen;
-
-  tBAParams baSession;
-
-} tAddBAInd, *tpAddBAInd;
-
-//
-// HAL -> TL
-// tSirMsgQ.type = SIR_HAL_DELBA_IND
-// tSirMsgQ.reserved = 0
-// tSirMsgQ.body = "allocated" instance of tpDelBAInd
-//
-// TL -> HAL
-// tSirMsgQ.type = SIR_HAL_BA_FAIL_IND
-// tSirMsgQ.reserved = 0
-// tSirMsgQ.body = "allocated" instance of tpDelBAInd
-//
-typedef struct sDelBAInd
-{
-  tANI_U8 staIdx;
-
-  tANI_U8 baTID;
-  // Message Type
-  tANI_U16 mesgType;
-
-  // Message Length
-  tANI_U16 mesgLen;
-
-} tDelBAInd, *tpDelBAInd;
-#endif
-
 /*===============================================
  *
  *  TL <-> HAL structures
diff --git a/drivers/staging/qcacld-2.0/CORE/WDA/inc/wlan_qct_wda.h b/drivers/staging/qcacld-2.0/CORE/WDA/inc/wlan_qct_wda.h
index 1de98da7099..de561c96ad2 100644
--- a/drivers/staging/qcacld-2.0/CORE/WDA/inc/wlan_qct_wda.h
+++ b/drivers/staging/qcacld-2.0/CORE/WDA/inc/wlan_qct_wda.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -95,12 +95,6 @@ typedef enum
 
 typedef enum
 {
-   WDA_DISABLE_BA,
-   WDA_ENABLE_BA
-}WDA_BaEnableFlags;
-
-typedef enum
-{
    WDA_INVALID_STA_INDEX,
    WDA_VALID_STA_INDEX
 }WDA_ValidStaIndex;
@@ -318,6 +312,8 @@ typedef void (*wda_tgt_cfg_cb) (void *context, void *param);
  */
 typedef bool (*wda_dfs_radar_indication_cb) (void *context, void *param);
 
+typedef void (*wda_dfs_block_tx_cb) (void *context, bool cac_block_tx);
+
 typedef struct
 {
    tANI_U16 ucValidStaIndex ;
@@ -449,6 +445,7 @@ VOS_STATUS WDA_TxPacket(void *pWDA,
 VOS_STATUS WDA_open(v_PVOID_t pVosContext, v_PVOID_t pOSContext,
                           wda_tgt_cfg_cb pTgtUpdCB,
                           wda_dfs_radar_indication_cb radar_ind_cb,
+                          wda_dfs_block_tx_cb dfs_block_tx_cb,
                           tMacOpenParameters *pMacParams ) ;
 
 #define WDA_start wma_start
@@ -580,7 +577,6 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_HDD_ADDBA_REQ  SIR_HAL_HDD_ADDBA_REQ
 #define WDA_HDD_ADDBA_RSP  SIR_HAL_HDD_ADDBA_RSP
 #define WDA_DELETEBA_IND   SIR_HAL_DELETEBA_IND
-#define WDA_BA_FAIL_IND    SIR_HAL_BA_FAIL_IND
 #define WDA_TL_FLUSH_AC_REQ SIR_TL_HAL_FLUSH_AC_REQ
 #define WDA_TL_FLUSH_AC_RSP SIR_HAL_TL_FLUSH_AC_RSP
 
@@ -677,10 +673,6 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_SOFTMAC_BULKREGREAD_RESPONSE      SIR_HAL_SOFTMAC_BULKREGREAD_RESPONSE
 #define WDA_SOFTMAC_HOSTMESG_MSGPROCESSRESULT SIR_HAL_SOFTMAC_HOSTMESG_MSGPROCESSRESULT
 
-#define WDA_ADDBA_REQ                  SIR_HAL_ADDBA_REQ
-#define WDA_ADDBA_RSP                  SIR_HAL_ADDBA_RSP
-#define WDA_DELBA_IND                  SIR_HAL_DELBA_IND
-#define WDA_DEL_BA_IND                 SIR_HAL_DEL_BA_IND
 #define WDA_MIC_FAILURE_IND            SIR_HAL_MIC_FAILURE_IND
 
 //message from sme to initiate delete block ack session.
@@ -897,6 +889,7 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_UPDATE_CHAN_LIST_RSP    SIR_HAL_UPDATE_CHAN_LIST_RSP
 #define WDA_RX_SCAN_EVENT           SIR_HAL_RX_SCAN_EVENT
 #define WDA_RX_CHN_STATUS_EVENT     SIR_HAL_RX_CHN_STATUS_EVENT
+
 #define WDA_IBSS_PEER_INACTIVITY_IND SIR_HAL_IBSS_PEER_INACTIVITY_IND
 
 #define WDA_CLI_SET_CMD             SIR_HAL_CLI_SET_CMD
@@ -967,7 +960,11 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_DEAUTH_TX_COMP         SIR_HAL_DEAUTH_TX_COMP
 #define WDA_GET_LINK_SPEED         SIR_HAL_GET_LINK_SPEED
 
-#define WDA_GET_RSSI               SIR_HAL_GET_RSSI
+#define WDA_GET_PEER_INFO               SIR_HAL_GET_PEER_INFO
+#define WDA_GET_PEER_INFO_EXT      SIR_HAL_GET_PEER_INFO_EXT
+#define WDA_GET_PEER_INFO_EXT_IND  SIR_HAL_GET_PEER_INFO_EXT_IND
+
+#define WDA_GET_ISOLATION          SIR_HAL_GET_ISOLATION
 
 #define WDA_MODEM_POWER_STATE_IND SIR_HAL_MODEM_POWER_STATE_IND
 
@@ -1009,6 +1006,7 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_LINK_LAYER_STATS_SET_REQ          SIR_HAL_LL_STATS_SET_REQ
 #define WDA_LINK_LAYER_STATS_GET_REQ          SIR_HAL_LL_STATS_GET_REQ
 #define WDA_LINK_LAYER_STATS_RESULTS_RSP      SIR_HAL_LL_STATS_RESULTS_RSP
+#define WDA_LINK_LAYER_STATS_SET_THRESHOLD    SIR_HAL_LL_STATS_EXT_SET_THRESHOLD
 #endif /* WLAN_FEATURE_LINK_LAYER_STATS */
 
 #define WDA_LINK_STATUS_GET_REQ SIR_HAL_LINK_STATUS_GET_REQ
@@ -1049,6 +1047,7 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_APFIND_SET_CMD                    SIR_HAL_APFIND_SET_CMD
 #endif /* WLAN_FEATURE_APFIND */
 
+#define WDA_DSRC_RADIO_CHAN_STATS_REQ         SIR_HAL_DSRC_RADIO_CHAN_STATS_REQ
 #define WDA_OCB_SET_CONFIG_CMD                SIR_HAL_OCB_SET_CONFIG_CMD
 #define WDA_OCB_SET_UTC_TIME_CMD              SIR_HAL_OCB_SET_UTC_TIME_CMD
 #define WDA_OCB_START_TIMING_ADVERT_CMD       SIR_HAL_OCB_START_TIMING_ADVERT_CMD
@@ -1069,7 +1068,6 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_UPDATE_Q2Q_IE_IND                 SIR_HAL_UPDATE_Q2Q_IE_IND
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
-#define WDA_FW_MEM_DUMP_REQ                   SIR_HAL_FW_MEM_DUMP_REQ
 #define WDA_TSF_GPIO_PIN                      SIR_HAL_TSF_GPIO_PIN_REQ
 #define WDA_SET_RSSI_MONITOR_REQ              SIR_HAL_SET_RSSI_MONITOR_REQ
 
@@ -1101,8 +1099,12 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_UPDATE_SHORT_RETRY_LIMIT_CNT      SIR_HAL_SHORT_RETRY_LIMIT_CNT
 #define WDA_UPDATE_LONG_RETRY_LIMIT_CNT       SIR_HAL_LONG_RETRY_LIMIT_CNT
 
+#define WDA_PEER_FLUSH_PENDING                SIR_HAL_PEER_FLUSH_PENDING
 
 #define WDA_UPDATE_STA_INACTIVITY_TIMEOUT     SIR_HAL_STA_INACTIVITY_TIMEOUT
+#define WDA_ACTION_FRAME_RANDOM_MAC           SIR_HAL_ACTION_FRAME_RANDOM_MAC
+
+#define WDA_SET_AC_TXQ_OPTIMIZE               SIR_HAL_SET_AC_TXQ_OPTIMIZE
 
 tSirRetStatus wdaPostCtrlMsg(tpAniSirGlobal pMac, tSirMsgQ *pMsg);
 
diff --git a/drivers/staging/qcacld-2.0/Kbuild b/drivers/staging/qcacld-2.0/Kbuild
index 46e641c65b2..ac9611cf108 100644
--- a/drivers/staging/qcacld-2.0/Kbuild
+++ b/drivers/staging/qcacld-2.0/Kbuild
@@ -35,7 +35,7 @@ ifeq ($(KERNEL_BUILD), 0)
 	CONFIG_MOBILE_ROUTER := y
 	endif
 
-	ifeq ($(CONFIG_ARCH_MDMCALIFORNIUM), y)
+	ifeq ($(CONFIG_ARCH_MDM9650), y)
 	CONFIG_MOBILE_ROUTER := y
 	endif
 
@@ -44,6 +44,22 @@ ifeq ($(KERNEL_BUILD), 0)
 	CONFIG_QCOM_LTE_COEX := y
 	endif
 
+	ifeq ($(CONFIG_ARCH_SDX20), y)
+	CONFIG_MOBILE_ROUTER := y
+	endif
+
+	ifeq ($(CONFIG_ARCH_MSM8917), y)
+		ifeq ($(CONFIG_ROME_IF), sdio)
+			CONFIG_WLAN_SYNC_TSF_PLUS := y
+		endif
+	endif
+
+	ifeq ($(CONFIG_ARCH_MSM8909), y)
+		ifeq ($(CONFIG_ROME_IF), sdio)
+			CONFIG_WLAN_SYNC_TSF_PLUS := y
+		endif
+	endif
+
 	# As per target team, build is done as follows:
 	# Defconfig : build with default flags
 	# Slub      : defconfig  + CONFIG_SLUB_DEBUG=y +
@@ -94,6 +110,11 @@ ifeq ($(KERNEL_BUILD), 0)
 	#Flag to enable Fast Transition (11r) feature
 	CONFIG_QCOM_VOWIFI_11R := y
 
+        ifneq ($(KERNELRELEASE), 4.9.11+)
+        #Flag to enable FILS Feature (11ai)
+        CONFIG_WLAN_FEATURE_FILS := n
+        endif
+
 	ifneq ($(CONFIG_QCA_CLD_WLAN),)
         ifeq ($(CONFIG_CNSS),y)
 		#Flag to enable Protected Managment Frames (11w) feature
@@ -132,15 +153,23 @@ ifeq ($(KERNEL_BUILD), 0)
         endif
 
 	ifneq ($(CONFIG_ARCH_MDM9607), y)
-		#Flag to enable memdump feature
-		CONFIG_WLAN_FEATURE_MEMDUMP := y
-
 		#Flag to enable offload packets feature
 		CONFIG_WLAN_OFFLOAD_PACKETS := y
 	endif
 
         #Flag to enable 3 port concurrency feature
         CONFIG_QCA_WIFI_AUTOMOTIVE_CONC := y
+
+	#Enable DSRC feature
+	ifeq ($(CONFIG_QCA_WIFI_SDIO), 1)
+	CONFIG_WLAN_FEATURE_DSRC := y
+	endif
+
+endif
+
+#Enable Power debugfs feature only if debug_fs is enabled
+ifeq ($(CONFIG_DEBUG_FS), y)
+CONFIG_WLAN_POWER_DEBUGFS := y
 endif
 
 ifdef CPTCFG_QCA_CLD_WLAN
@@ -317,6 +346,9 @@ CONFIG_FEATURE_STATS_EXT := 1
 #for these channels has not yet been added to the kernel.
 CONFIG_STATICALLY_ADD_11P_CHANNELS := n
 
+#Enable thermal shutdown
+CONFIG_WLAN_THERMAL_SHUTDOWN := 1
+
 ifeq ($(CONFIG_CFG80211),y)
 HAVE_CFG80211 := 1
 else
@@ -343,6 +375,10 @@ ADF_OBJS :=     $(ADF_DIR)/adf_nbuf.o \
                 $(ADF_DIR)/linux/adf_os_defer_pvt.o \
                 $(ADF_DIR)/linux/adf_os_lock_pvt.o
 
+ifeq ($(CONFIG_WLAN_FEATURE_FILS), y)
+ADF_OBJS +=     $(ADF_DIR)/linux/qdf_crypto.o
+endif
+
 ifeq ($(CONFIG_DPTRACE_ENABLE), y)
 ADF_OBJS +=     $(ADF_DIR)/adf_trace.o
 endif
@@ -404,7 +440,7 @@ HDD_OBJS := 	$(HDD_SRC_DIR)/wlan_hdd_assoc.o \
 		$(HDD_SRC_DIR)/wlan_hdd_ftm.o \
 		$(HDD_SRC_DIR)/wlan_hdd_hostapd.o \
 		$(HDD_SRC_DIR)/wlan_hdd_main.o \
-		$(HDD_SRC_DIR)/wlan_hdd_ocb.o \
+		$(HDD_SRC_DIR)/wlan_hdd_memdump.o \
 		$(HDD_SRC_DIR)/wlan_hdd_oemdata.o \
 		$(HDD_SRC_DIR)/wlan_hdd_scan.o \
 		$(HDD_SRC_DIR)/wlan_hdd_softap_tx_rx.o \
@@ -414,6 +450,11 @@ HDD_OBJS := 	$(HDD_SRC_DIR)/wlan_hdd_assoc.o \
 		$(HDD_SRC_DIR)/wlan_hdd_wmm.o \
 		$(HDD_SRC_DIR)/wlan_hdd_wowl.o
 
+ifeq ($(CONFIG_WLAN_FEATURE_DSRC), y)
+HDD_OBJS+=	$(HDD_SRC_DIR)/wlan_hdd_ocb.o \
+		$(HDD_SRC_DIR)/wlan_hdd_debugfs_ocb.o
+endif
+
 ifeq ($(CONFIG_IPA_OFFLOAD), 1)
 HDD_OBJS +=	$(HDD_SRC_DIR)/wlan_hdd_ipa.o
 endif
@@ -431,12 +472,12 @@ ifeq ($(CONFIG_QCOM_TDLS),y)
 HDD_OBJS +=	$(HDD_SRC_DIR)/wlan_hdd_tdls.o
 endif
 
-ifeq ($(CONFIG_WLAN_SYNC_TSF),y)
-HDD_OBJS +=	$(HDD_SRC_DIR)/wlan_hdd_tsf.o
+ifeq ($(CONFIG_WLAN_SYNC_TSF_PLUS), y)
+CONFIG_WLAN_SYNC_TSF := y
 endif
 
-ifeq ($(CONFIG_WLAN_FEATURE_MEMDUMP),y)
-HDD_OBJS += $(HDD_SRC_DIR)/wlan_hdd_memdump.o
+ifeq ($(CONFIG_WLAN_SYNC_TSF),y)
+HDD_OBJS +=	$(HDD_SRC_DIR)/wlan_hdd_tsf.o
 endif
 
 ifeq ($(CONFIG_WLAN_FEATURE_NAN_DATAPATH),y)
@@ -527,6 +568,10 @@ ifeq ($(CONFIG_QCOM_TDLS),y)
 MAC_LIM_OBJS += $(MAC_SRC_DIR)/pe/lim/limProcessTdls.o
 endif
 
+ifeq ($(CONFIG_WLAN_FEATURE_FILS),y)
+MAC_LIM_OBJS += $(MAC_SRC_DIR)/pe/lim/lim_process_fils.o
+endif
+
 ifeq ($(CONFIG_WLAN_FEATURE_NAN_DATAPATH),y)
 MAC_NDP_OBJS += $(MAC_SRC_DIR)/pe/nan/nan_datapath.o
 endif
@@ -855,9 +900,11 @@ WMA_OBJS :=	$(WMA_DIR)/regdomain.o \
 		$(WMA_DIR)/wlan_nv.o \
 		$(WMA_DIR)/wma.o \
 		$(WMA_DIR)/wma_dfs_interface.o \
-		$(WMA_DIR)/wma_ocb.o \
 		$(WMA_NDP_OBJS)
 
+ifeq ($(CONFIG_WLAN_FEATURE_DSRC), y)
+WMA_OBJS+=	$(WMA_DIR)/wma_ocb.o
+endif
 
 ############ WDA ############
 WDA_DIR :=	CORE/WDA
@@ -1006,9 +1053,24 @@ CDEFINES :=	-DANI_LITTLE_BYTE_ENDIAN \
 		-DFEATURE_WLAN_CH144 \
 		-DHTC_CRP_DEBUG \
 		-DWLAN_VOWIFI_DEBUG \
-		-DQOS_FWD_SUPPORT \
-		-DATH_SUPPORT_DFS \
-		-DWMI_COEX_BTC_DUTYCYCLE
+		-DATH_SUPPORT_DFS
+
+ifeq ($(CONFIG_WLAN_POWER_DEBUGFS), y)
+CDEFINES += -DWLAN_POWER_DEBUGFS
+endif
+
+ifeq ($(CONFIG_FEATURE_COEX_PTA_CONFIG_ENABLE), y)
+CDEFINES += -DFEATURE_COEX_PTA_CONFIG_ENABLE
+endif
+
+ifeq ($(CONFIG_QCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK), y)
+CDEFINES += -DQCA_SUPPORT_TXRX_DRIVER_TCP_DEL_ACK
+CDEFINES += -DFEATURE_BUS_BANDWIDTH
+endif
+
+ifeq ($(CONFIG_WLAN_FEATURE_FILS),y)
+CDEFINES += -DWLAN_FEATURE_FILS_SK
+endif
 
 ifeq ($(CONFIG_SCPC_FEATURE), y)
 CDEFINES += -DWLAN_SCPC_FEATURE
@@ -1026,12 +1088,28 @@ CDEFINES +=     -DCONFIG_HL_SUPPORT \
                 -DCONFIG_AR6320_SUPPORT \
                 -DSDIO_3_0 \
                 -DHIF_SDIO \
-                -DCONFIG_ATH_PROCFS_DIAG_SUPPORT \
                 -DFEATURE_HL_GROUP_CREDIT_FLOW_CONTROL \
-                -DHIF_MBOX_SLEEP_WAR
+                -DHIF_MBOX_SLEEP_WAR \
+                -DDEBUG_HL_LOGGING
+
+ifneq ($(TARGET_BUILD_VARIANT),user)
+CDEFINES +=	-DCONFIG_ATH_PROCFS_DIAG_SUPPORT
+endif
+endif
+
+ifeq ($(CONFIG_WLAN_FEATURE_DSRC), y)
+CDEFINES += -DWLAN_FEATURE_DSRC
 endif
 
-ifeq ($(CONFIG_ARCH_MDMCALIFORNIUM), y)
+ifeq ($(CONFIG_ARCH_MDM9650), y)
+ifeq ($(CONFIG_QCA_WIFI_SDIO), 1)
+ifeq ($(CONFIG_WCNSS_SKB_PRE_ALLOC), y)
+CDEFINES += -DFEATURE_SKB_PRE_ALLOC
+endif
+endif
+endif
+
+ifeq ($(CONFIG_ARCH_SDX20), y)
 ifeq ($(CONFIG_QCA_WIFI_SDIO), 1)
 ifeq ($(CONFIG_WCNSS_SKB_PRE_ALLOC), y)
 CDEFINES += -DFEATURE_SKB_PRE_ALLOC
@@ -1041,7 +1119,6 @@ endif
 
 ifeq ($(CONFIG_ARCH_MDM9607), y)
 ifeq ($(CONFIG_QCA_WIFI_SDIO), 1)
-CDEFINES += -DDEBUG_HL_LOGGING
 CDEFINES += -DHIF_SYNC_READ
 endif
 endif
@@ -1075,7 +1152,7 @@ ifeq ($(CONFIG_MDNS_OFFLOAD_SUPPORT), 1)
 CDEFINES += -DMDNS_OFFLOAD
 endif
 
-ifeq ($(CONFIG_ARCH_MSM), y)
+ifeq (y,$(findstring y,$(CONFIG_ARCH_MSM) $(CONFIG_ARCH_QCOM)))
 CDEFINES += -DMSM_PLATFORM
 ifeq ($(CONFIG_CNSS), y)
 ifeq ($(CONFIG_HIF_PCI), 1)
@@ -1147,6 +1224,10 @@ ifeq ($(CONFIG_QCACLD_WLAN_LFR3),y)
 CDEFINES += -DWLAN_FEATURE_ROAM_OFFLOAD
 endif
 
+ifeq ($(CONFIG_CNSS_GENL), y)
+CDEFINES += -DCNSS_GENL
+endif
+
 ifeq ($(CONFIG_PRIMA_WLAN_OKC),y)
 CDEFINES += -DFEATURE_WLAN_OKC
 endif
@@ -1160,12 +1241,16 @@ CDEFINES += -DFEATURE_WLAN_DIAG_SUPPORT
 CDEFINES += -DFEATURE_WLAN_DIAG_SUPPORT_CSR
 CDEFINES += -DFEATURE_WLAN_DIAG_SUPPORT_LIM
 ifeq ($(CONFIG_HIF_PCI), 1)
+ifneq ($(TARGET_BUILD_VARIANT),user)
 CDEFINES += -DCONFIG_ATH_PROCFS_DIAG_SUPPORT
 endif
 endif
+endif
 
 ifeq ($(CONFIG_HIF_USB), 1)
+ifneq ($(TARGET_BUILD_VARIANT),user)
 CDEFINES += -DCONFIG_ATH_PROCFS_DIAG_SUPPORT
+endif
 CDEFINES += -DQCA_SUPPORT_OL_RX_REORDER_TIMEOUT
 CDEFINES += -DCONFIG_ATH_PCIE_MAX_PERF=0 -DCONFIG_ATH_PCIE_AWAKE_WHILE_DRIVER_LOAD=0 -DCONFIG_DISABLE_CDC_MAX_PERF_WAR=0
 CDEFINES += -DQCA_TX_HTT2_SUPPORT
@@ -1279,6 +1364,10 @@ endif
 ifeq ($(CONFIG_HIF_USB), 1)
 CDEFINES += -DHIF_USB
 CDEFINES += -DCONFIG_HL_SUPPORT
+CDEFINES += -DDEBUG_HL_LOGGING
+ifeq ($(CONFIG_QOS_FWD_SUPPORT), y)
+CDEFINES += -DQOS_FWD_SUPPORT
+endif
 endif
 
 #Enable FW logs through ini
@@ -1356,7 +1445,11 @@ endif
 endif
 endif
 
-ifeq ($(CONFIG_ARCH_MDMCALIFORNIUM), y)
+ifeq ($(CONFIG_ARCH_MDM9650), y)
+CDEFINES += -DSYNC_IPA_READY
+endif
+
+ifeq ($(CONFIG_ARCH_SDX20), y)
 CDEFINES += -DSYNC_IPA_READY
 endif
 
@@ -1504,12 +1597,22 @@ ifeq ($(CONFIG_WLAN_SYNC_TSF),y)
 CDEFINES += -DWLAN_FEATURE_TSF
 endif
 
+ifeq ($(CONFIG_WLAN_SYNC_TSF_PLUS), y)
+CDEFINES += -DWLAN_FEATURE_TSF_PLUS
+endif
+
 # Enable target dump for non-qualcomm platform
 ifeq ($(CONFIG_NON_QC_PLATFORM), y)
 CDEFINES += -DCONFIG_NON_QC_PLATFORM
 CDEFINES += -DTARGET_DUMP_FOR_NON_QC_PLATFORM
 endif
 
+ifeq ($(CONFIG_NON_QC_PLATFORM), y)
+ifeq ($(CONFIG_ROME_IF),pci)
+CDEFINES += -DCONFIG_NON_QC_PLATFORM_PCI
+endif
+endif
+
 ifeq ($(CONFIG_ARCH_MDM9640), y)
 CDEFINES += -DFEATURE_AP_MCC_CH_AVOIDANCE
 endif
@@ -1522,6 +1625,24 @@ endif
 ifeq ($(CONFIG_ARCH_MSM8909), y)
 CDEFINES += -DMSM8976_TCP_PERF
 CDEFINES += -DTX_COMPLETION_THREAD
+CDEFINES += -DACS_FW_REPORT_PARAM
+CDEFINES += -DFEATURE_WLAN_SUB_20_MHZ
+CDEFINES += -DHL_RX_AGGREGATION_HOLE_DETCTION
+CDEFINES += -DMAC_NOTIFICATION_FEATURE
+CDEFINES += -DCHANNEL_HOPPING_ALL_BANDS
+endif
+
+ifeq ($(CONFIG_ARCH_MSM8996), y)
+CDEFINES += -DACS_FW_REPORT_PARAM
+CDEFINES += -DFEATURE_WLAN_SUB_20_MHZ
+CDEFINES += -DMAC_NOTIFICATION_FEATURE
+CDEFINES += -DCHANNEL_HOPPING_ALL_BANDS
+endif
+
+ifeq ($(CONFIG_ARCH_MSM8937), y)
+CDEFINES += -DTX_COMPLETION_THREAD
+CDEFINES += -DMSM8976_TCP_PERF
+CDEFINES += -DACS_FW_REPORT_PARAM
 endif
 
 ifdef CPTCFG_QCA_CLD_WLAN
@@ -1538,10 +1659,6 @@ ifeq ($(CONFIG_STATICALLY_ADD_11P_CHANNELS),y)
 CDEFINES += -DFEATURE_STATICALLY_ADD_11P_CHANNELS
 endif
 
-ifeq ($(CONFIG_WLAN_FEATURE_MEMDUMP),y)
-CDEFINES += -DWLAN_FEATURE_MEMDUMP
-endif
-
 ifeq ($(CONFIG_WLAN_OFFLOAD_PACKETS),y)
 CDEFINES += -DWLAN_FEATURE_OFFLOAD_PACKETS
 endif
@@ -1552,11 +1669,6 @@ CDEFINES += -DWLAN_FEATURE_UDP_RESPONSE_OFFLOAD
 endif
 
 
-ifeq ($(CONFIG_WLAN_FEATURE_RX_WAKELOCK), y)
-CDEFINES += -DWLAN_FEATURE_HOLD_RX_WAKELOCK
-endif
-
-
 ifeq ($(CONFIG_WLAN_WOW_PULSE), y)
 CDEFINES += -DWLAN_FEATURE_WOW_PULSE
 endif
@@ -1573,6 +1685,11 @@ ifeq ($(CONFIG_HIF_PCI), 1)
 CDEFINES += -DFORCE_LEGACY_PCI_INTERRUPTS
 endif
 
+ifeq ($(CONFIG_WLAN_THERMAL_SHUTDOWN), 1)
+CDEFINES += -DFEATURE_WLAN_THERMAL_SHUTDOWN
+CDEFINES += -DFEATURE_WLAN_AUTO_SHUTDOWN
+endif
+
 KBUILD_CPPFLAGS += $(CDEFINES)
 
 # Currently, for versions of gcc which support it, the kernel Makefile
@@ -1583,6 +1700,10 @@ ifeq ($(call cc-option-yn, -Wmaybe-uninitialized),y)
 EXTRA_CFLAGS += -Wmaybe-uninitialized
 endif
 
+ifeq ($(call cc-option-yn, -Wheader-guard),y)
+EXTRA_CFLAGS += -Wheader-guard
+endif
+
 # If the module name is not "wlan", then the define MULTI_IF_NAME to be the
 # same a the QCA CHIP name. The host driver will then append MULTI_IF_NAME to
 # any string that must be unique for all instances of the driver on the system.
diff --git a/include/linux/avtimer_kernel.h b/include/linux/avtimer_kernel.h
index 5eff8ccff4c..688622014de 100644
--- a/include/linux/avtimer_kernel.h
+++ b/include/linux/avtimer_kernel.h
@@ -20,5 +20,6 @@
 int avcs_core_open(void);
 int avcs_core_disable_power_collapse(int disable);/* true or flase */
 int avcs_core_query_timer(uint64_t *avtimer_tick);
+int avcs_core_query_timer_offset(uint64_t *av_offset);
 
 #endif
diff --git a/include/sound/q6asm-v2.h b/include/sound/q6asm-v2.h
index 5ccc7130e36..3fa58da1794 100644
--- a/include/sound/q6asm-v2.h
+++ b/include/sound/q6asm-v2.h
@@ -166,6 +166,11 @@ struct audio_port_data {
 	spinlock_t	    dsp_lock;
 };
 
+struct dsp_timestamp {
+	uint64_t    abs_time_stamp;
+	uint64_t    last_time_stamp;
+};
+
 struct audio_client {
 	int                    session;
 	app_cb		       cb;
@@ -177,6 +182,7 @@ struct audio_client {
 	void		       *priv;
 	uint32_t               io_mode;
 	uint64_t	       time_stamp;
+	struct dsp_timestamp dsp_ts;
 	struct apr_svc         *apr;
 	struct apr_svc         *mmap_apr;
 	struct apr_svc         *apr2;
@@ -230,6 +236,10 @@ int q6asm_open_write_v2(struct audio_client *ac, uint32_t format,
 int q6asm_open_write_v3(struct audio_client *ac, uint32_t format,
 			uint16_t bits_per_sample);
 int q6asm_stream_open_write_v2(struct audio_client *ac, uint32_t format,
+			       uint16_t bits_per_sample, int32_t stream_id,
+			       bool is_gapless_mode);
+
+int q6asm_stream_open_write_v3(struct audio_client *ac, uint32_t format,
 				uint16_t bits_per_sample, int32_t stream_id,
 				bool is_gapless_mode);
 
@@ -358,6 +368,15 @@ int q6asm_media_format_block_pcm_format_support_v2(struct audio_client *ac,
 				uint16_t bits_per_sample, int stream_id,
 				bool use_default_chmap, char *channel_map);
 
+int q6asm_media_format_block_pcm_format_support_v3(struct audio_client *ac,
+						   uint32_t rate,
+						   uint32_t channels,
+						   uint16_t bits_per_sample,
+						   int stream_id,
+						   bool use_default_chmap,
+						   char *channel_map,
+						   uint16_t sample_word_size);
+
 int q6asm_media_format_block_multi_ch_pcm(struct audio_client *ac,
 			uint32_t rate, uint32_t channels,
 			bool use_default_chmap, char *channel_map);
@@ -448,6 +467,7 @@ int q6asm_set_multich_gain(struct audio_client *ac, uint32_t channels,
 int q6asm_set_mute(struct audio_client *ac, int muteflag);
 
 int q6asm_get_session_time(struct audio_client *ac, uint64_t *tstamp);
+int q6asm_get_session_time_v2(struct audio_client *ac, uint64_t *ses_time, uint64_t *abs_time);
 int q6asm_get_session_time_legacy(struct audio_client *ac, uint64_t *tstamp);
 
 int q6asm_send_audio_effects_params(struct audio_client *ac, char *params,
diff --git a/include/uapi/sound/compress_offload.h b/include/uapi/sound/compress_offload.h
index a2f5baa4011..65029ee6de5 100644
--- a/include/uapi/sound/compress_offload.h
+++ b/include/uapi/sound/compress_offload.h
@@ -193,7 +193,7 @@ struct snd_compr_metadata {
 #define SNDRV_COMPRESS_NEXT_TRACK	_IO('C', 0x35)
 #define SNDRV_COMPRESS_PARTIAL_DRAIN	_IO('C', 0x36)
 #define SNDRV_COMPRESS_SET_NEXT_TRACK_PARAM\
-					_IOW('C', 0x37, union snd_codec_options)
+					_IOW('C', 0x38, union snd_codec_options)
 /*
  * TODO
  * 1. add mmap support
@@ -202,6 +202,7 @@ struct snd_compr_metadata {
 #define SND_COMPR_TRIGGER_DRAIN 7 /*FIXME move this to pcm.h */
 #define SND_COMPR_TRIGGER_NEXT_TRACK 8
 #define SND_COMPR_TRIGGER_PARTIAL_DRAIN 9
+#define SNDRV_COMPRESS_DSP_POSITION 10
 
 #define SNDRV_COMPRESS_METADATA_MODE          _IOW('C', 0x99, bool)
 #endif
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index fe57c7d54ff..9762fb278d1 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -532,21 +532,17 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 			retval = -EFAULT;
 			goto out;
 		}
-
 		retval = snd_compress_check_input(params);
 		if (retval)
 			goto out;
-
 		retval = snd_compr_allocate_buffer(stream, params);
 		if (retval) {
 			retval = -ENOMEM;
 			goto out;
 		}
-
 		retval = stream->ops->set_params(stream, params);
 		if (retval)
 			goto out;
-
 		stream->metadata_set = false;
 		stream->next_track = false;
 
@@ -780,9 +776,7 @@ static int snd_compr_set_next_track_param(struct snd_compr_stream *stream,
 		return -EFAULT;
 
 	retval = stream->ops->set_next_track_param(stream, &codec_options);
-	if (retval != 0)
-		return retval;
-	return 0;
+	return retval;
 }
 
 static int snd_compress_simple_ioctls(struct file *file,
diff --git a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
index 189839a00b1..12b437e09d5 100644
--- a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
@@ -20,6 +20,7 @@
 #include <linux/wait.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
+#include <linux/avtimer_kernel.h>
 #include <sound/core.h>
 #include <sound/soc.h>
 #include <sound/soc-dapm.h>
@@ -668,6 +669,45 @@ static void populate_codec_list(struct msm_compr_audio *prtd)
 	prtd->compr_cap.codecs[11] = SND_AUDIOCODEC_APE;
 }
 
+uint16_t get_bitwidth_from_format(uint32_t format)
+{
+uint16_t bit_width;
+	switch (format) {
+	case SNDRV_PCM_FORMAT_S32_LE:
+		bit_width = 32;
+		break;
+	case SNDRV_PCM_FORMAT_S24_LE:
+		bit_width = 24;
+		break;
+	case SNDRV_PCM_FORMAT_S24_3LE:
+		bit_width = 24;
+		break;
+	case SNDRV_PCM_FORMAT_S16_LE:
+	default:
+		bit_width = 16;
+		break;
+	}
+	return bit_width;
+}
+
+uint16_t get_wordsize_from_format(uint32_t format)
+{
+uint16_t sample_word_size;
+	switch (format) {
+	case SNDRV_PCM_FORMAT_S24_LE:
+		sample_word_size = 32;
+		break;
+	case SNDRV_PCM_FORMAT_S24_3LE:
+		sample_word_size = 24;
+		break;
+	case SNDRV_PCM_FORMAT_S16_LE:
+	default:
+		sample_word_size = 16;
+		break;
+	}
+	return sample_word_size;
+}
+
 static int msm_compr_send_media_format_block(struct snd_compr_stream *cstream,
 					     int stream_id,
 					     bool use_gapless_codec_options)
@@ -690,6 +730,7 @@ static int msm_compr_send_media_format_block(struct snd_compr_stream *cstream,
 	uint16_t bit_width = 16;
 	bool use_default_chmap = true;
 	char *chmap = NULL;
+	uint16_t sample_word_size;
 
 	pr_debug("%s: use_gapless_codec_options %d\n",
 			__func__, use_gapless_codec_options);
@@ -713,15 +754,19 @@ static int msm_compr_send_media_format_block(struct snd_compr_stream *cstream,
 			chmap =
 			    pdata->ch_map[rtd->dai_link->be_id]->channel_map;
 		}
-		if (prtd->codec_param.codec.format == SNDRV_PCM_FORMAT_S24_LE)
-			bit_width = 24;
-		ret = q6asm_media_format_block_pcm_format_support_v2(
+
+		bit_width = get_bitwidth_from_format(prtd->codec_param.codec.format);
+		sample_word_size = get_wordsize_from_format(prtd->codec_param.codec.format);
+
+		ret = q6asm_media_format_block_pcm_format_support_v3(
 							prtd->audio_client,
 							prtd->sample_rate,
 							prtd->num_channels,
-							bit_width, stream_id,
+							bit_width,
+							stream_id,
 							use_default_chmap,
-							chmap);
+							chmap,
+							sample_word_size);
 		if (ret < 0)
 			pr_err("%s: CMD Format block failed\n", __func__);
 
@@ -947,11 +992,7 @@ static int msm_compr_configure_dsp(struct snd_compr_stream *cstream)
 	};
 
 	pr_debug("%s: stream_id %d\n", __func__, ac->stream_id);
-	if (prtd->codec_param.codec.format == SNDRV_PCM_FORMAT_S24_LE)
-		bits_per_sample = 24;
-	if (prtd->codec_param.codec.format == SNDRV_PCM_FORMAT_S32_LE)
-		bits_per_sample = 32;
-
+	bits_per_sample = get_wordsize_from_format(prtd->codec_param.codec.format);
 	if (prtd->compr_passthr != LEGACY_PCM) {
 		ret = q6asm_open_write_compressed(ac, prtd->codec,
 						  prtd->compr_passthr);
@@ -972,8 +1013,9 @@ static int msm_compr_configure_dsp(struct snd_compr_stream *cstream)
 			return ret;
 		}
 	} else {
-		pr_debug("%s: stream_id %d\n", __func__, ac->stream_id);
-		ret = q6asm_stream_open_write_v2(ac,
+		pr_debug("%s: stream_id %d bits_per_sample %d\n",
+				__func__, ac->stream_id, bits_per_sample);
+		ret = q6asm_stream_open_write_v3(ac,
 				prtd->codec, bits_per_sample,
 				ac->stream_id,
 				prtd->gapless_state.use_dsp_gapless_mode);
@@ -1503,7 +1545,7 @@ static int msm_compr_trigger(struct snd_compr_stream *cstream, int cmd)
 	unsigned long flags;
 	int stream_id;
 	uint32_t stream_index;
-
+	uint16_t bits_per_sample = 16;
 	if (cstream->direction != SND_COMPRESS_PLAYBACK) {
 		pr_err("%s: Unsupported stream type\n", __func__);
 		return -EINVAL;
@@ -1887,9 +1929,12 @@ static int msm_compr_trigger(struct snd_compr_stream *cstream, int cmd)
 			}
 			break;
 		}
-		pr_debug("%s: open_write stream_id %d", __func__, stream_id);
-		rc = q6asm_stream_open_write_v2(prtd->audio_client,
-				prtd->codec, 16,
+
+		bits_per_sample = get_wordsize_from_format(prtd->codec_param.codec.format);
+		pr_debug("%s: open_write stream_id %d bits_per_sample %d",
+				__func__, stream_id, bits_per_sample);
+		rc = q6asm_stream_open_write_v3(prtd->audio_client,
+				prtd->codec, bits_per_sample,
 				stream_id,
 				prtd->gapless_state.use_dsp_gapless_mode);
 		if (rc < 0) {
@@ -2214,6 +2259,48 @@ static int msm_compr_set_metadata(struct snd_compr_stream *cstream,
 	return 0;
 }
 
+static int msm_compr_get_metadata(struct snd_compr_stream *cstream,
+                                      struct snd_compr_metadata *metadata)
+{
+	struct msm_compr_audio *prtd;
+	struct audio_client *ac;
+	int ret = -EINVAL;
+	uint64_t ses_time = 0, frames = 0, abs_time = 0;
+	uint64_t *val = NULL, *val1 = NULL;
+	int64_t av_offset = 0;
+
+	if (!metadata || !cstream || !cstream->runtime)
+		return ret;
+	if(metadata->key != SNDRV_COMPRESS_DSP_POSITION) {
+		return ret;
+	} else {
+		pr_debug("%s, Got timestamp query", __func__);
+	}
+	prtd = cstream->runtime->private_data;
+	if (!prtd || !prtd->audio_client) {
+		pr_err("%s: prtd or audio client is NULL\n", __func__);
+		return ret;
+	}
+	ac = prtd->audio_client;
+	ret = q6asm_get_session_time_v2(prtd->audio_client, &ses_time, &abs_time);
+	if (ret) {
+		pr_err("%s: get_path_delay failed, ret=%d\n", __func__, ret);
+		return ret;
+	}
+	frames = div64_u64((ses_time * prtd->sample_rate), 1000000);
+
+	ret = avcs_core_query_timer_offset(&av_offset);
+
+	val = (uint64_t *) &metadata->value[0];
+	*val = frames; val1 = val + 1;
+
+	*val1 = abs_time + av_offset;
+	pr_debug("%s, vals f %lld, t %lld, avoff %lld, abst %lld, sess_time %llu sr %d\n",
+			__func__, *val, *val1, av_offset, abs_time, ses_time, prtd->sample_rate);
+	return ret;
+}
+
+
 static int msm_compr_set_next_track_param(struct snd_compr_stream *cstream,
 				union snd_codec_options *codec_options)
 {
@@ -3047,7 +3134,8 @@ static struct snd_compr_ops msm_compr_ops = {
 	.trigger		= msm_compr_trigger,
 	.pointer		= msm_compr_pointer,
 	.set_params		= msm_compr_set_params,
-	.set_metadata		= msm_compr_set_metadata,
+	.set_metadata	= msm_compr_set_metadata,
+	.get_metadata	= msm_compr_get_metadata,
 	.set_next_track_param	= msm_compr_set_next_track_param,
 	.ack			= msm_compr_ack,
 	.copy			= msm_compr_copy,
diff --git a/sound/soc/msm/qdsp6v2/q6asm.c b/sound/soc/msm/qdsp6v2/q6asm.c
index ff65ed8ae08..6ac4dd24e19 100644
--- a/sound/soc/msm/qdsp6v2/q6asm.c
+++ b/sound/soc/msm/qdsp6v2/q6asm.c
@@ -37,6 +37,7 @@
 #include <linux/memory.h>
 
 #include <sound/apr_audio-v2.h>
+#include <sound/adsp_err.h>
 #include <sound/q6asm-v2.h>
 #include <sound/q6core.h>
 #include <sound/q6audio-v2.h>
@@ -1492,12 +1493,18 @@ static void q6asm_process_mtmx_get_param_rsp(struct audio_client *ac,
 		switch (cmdrsp->param_info.param_id) {
 		case ASM_SESSION_MTMX_STRTR_PARAM_SESSION_TIME_V3:
 			time = &cmdrsp->param_data.session_time;
-			dev_vdbg(ac->dev, "%s: GET_TIME_V3, time_lsw=%x, time_msw=%x\n",
+			dev_vdbg(ac->dev, "%s: GET_TIME_V3, time_lsw=%x, time_msw=%x, abs l %x, m %x\n",
 				 __func__, time->session_time_lsw,
-				 time->session_time_msw);
+				 time->session_time_msw, time->absolute_time_lsw, time->absolute_time_msw);
+			ac->dsp_ts.abs_time_stamp = (uint64_t)(((uint64_t)
+							time->absolute_time_msw << 32) |
+							time->absolute_time_lsw);
 			ac->time_stamp = (uint64_t)(((uint64_t)
 					 time->session_time_msw << 32) |
 					 time->session_time_lsw);
+			ac->dsp_ts.last_time_stamp = (uint64_t)(((uint64_t)
+					 time->time_stamp_msw << 32) |
+					 time->time_stamp_lsw);
 			if (time->flags &
 			    ASM_SESSION_MTMX_STRTR_PARAM_STIME_TSTMP_FLG_BMASK)
 				dev_warn_ratelimited(ac->dev,
@@ -3546,6 +3553,87 @@ fail_cmd:
 	return -EINVAL;
 }
 
+static int __q6asm_media_format_block_pcm_v3(struct audio_client *ac,
+					     uint32_t rate, uint32_t channels,
+					     uint16_t bits_per_sample,
+					     int stream_id,
+					     bool use_default_chmap,
+					     char *channel_map,
+					     uint16_t sample_word_size)
+{
+	struct asm_multi_channel_pcm_fmt_blk_param_v3 fmt;
+	u8 *channel_mapping;
+	int rc;
+
+	pr_debug("%s: session[%d]rate[%d]ch[%d]bps[%d]wordsize[%d]\n", __func__,
+		 ac->session, rate, channels,
+		 bits_per_sample, sample_word_size);
+
+	memset(&fmt, 0, sizeof(fmt));
+	q6asm_stream_add_hdr(ac, &fmt.hdr, sizeof(fmt), TRUE, stream_id);
+	atomic_set(&ac->cmd_state, -1);
+	/*
+	 * Updated the token field with stream/session for compressed playback
+	 * Platform driver must know the the stream with which the command is
+	 * associated
+	 */
+	if (ac->io_mode & COMPRESSED_STREAM_IO)
+		fmt.hdr.token = ((ac->session << 8) & 0xFFFF00) |
+				(stream_id & 0xFF);
+
+	pr_debug("%s: token = 0x%x, stream_id  %d, session 0x%x\n",
+		 __func__, fmt.hdr.token, stream_id, ac->session);
+
+	fmt.hdr.opcode = ASM_DATA_CMD_MEDIA_FMT_UPDATE_V2;
+	fmt.fmt_blk.fmt_blk_size = sizeof(fmt) - sizeof(fmt.hdr) -
+					sizeof(fmt.fmt_blk);
+	fmt.param.num_channels = channels;
+	fmt.param.bits_per_sample = bits_per_sample;
+	fmt.param.sample_rate = rate;
+	fmt.param.is_signed = 1;
+	fmt.param.sample_word_size = sample_word_size;
+	channel_mapping = fmt.param.channel_mapping;
+
+	memset(channel_mapping, 0, PCM_FORMAT_MAX_NUM_CHANNEL);
+
+	if (use_default_chmap) {
+		if (q6asm_map_channels(channel_mapping, channels)) {
+			pr_err("%s: map channels failed %d\n",
+			       __func__, channels);
+			rc = -EINVAL;
+			goto fail_cmd;
+		}
+	} else {
+		memcpy(channel_mapping, channel_map,
+			 PCM_FORMAT_MAX_NUM_CHANNEL);
+	}
+
+	rc = apr_send_pkt(ac->apr, (uint32_t *) &fmt);
+	if (rc < 0) {
+		pr_err("%s: Comamnd open failed %d\n", __func__, rc);
+		rc = -EINVAL;
+		goto fail_cmd;
+	}
+	rc = wait_event_timeout(ac->cmd_wait,
+			(atomic_read(&ac->cmd_state) >= 0), 5*HZ);
+	if (!rc) {
+		pr_err("%s: timeout. waited for format update\n", __func__);
+		rc = -ETIMEDOUT;
+		goto fail_cmd;
+	}
+	if (atomic_read(&ac->cmd_state) > 0) {
+		pr_err("%s: DSP returned error[%s]\n",
+			__func__, adsp_err_get_err_str(
+			atomic_read(&ac->cmd_state)));
+		rc = adsp_err_get_lnx_err_code(
+				atomic_read(&ac->cmd_state));
+		goto fail_cmd;
+	}
+	return 0;
+fail_cmd:
+	return rc;
+}
+
 int q6asm_media_format_block_pcm(struct audio_client *ac,
 				uint32_t rate, uint32_t channels)
 {
@@ -3578,6 +3666,41 @@ int q6asm_media_format_block_pcm_format_support_v2(struct audio_client *ac,
 				use_default_chmap, channel_map);
 }
 
+/*
+ * q6asm_media_format_block_pcm_format_support_v3- sends pcm decoder
+ *						    configuration parameters
+ *
+ * @ac: Client session handle
+ * @rate: sample rate
+ * @channels: number of channels
+ * @bits_per_sample: bit width of encoder session
+ * @stream_id: stream id of stream to be associated with this session
+ * @use_default_chmap: true if default channel map  to be used
+ * @channel_map: input channel map
+ * @sample_word_size: Size in bits of the word that holds a sample of a channel
+ */
+int q6asm_media_format_block_pcm_format_support_v3(struct audio_client *ac,
+						   uint32_t rate,
+						   uint32_t channels,
+						   uint16_t bits_per_sample,
+						   int stream_id,
+						   bool use_default_chmap,
+						   char *channel_map,
+						   uint16_t sample_word_size)
+{
+	if (!use_default_chmap && (channel_map == NULL)) {
+		pr_err("%s: No valid chan map and can't use default\n",
+			__func__);
+		return -EINVAL;
+	}
+	return __q6asm_media_format_block_pcm_v3(ac, rate,
+				channels, bits_per_sample, stream_id,
+				use_default_chmap, channel_map,
+				sample_word_size);
+
+}
+EXPORT_SYMBOL(q6asm_media_format_block_pcm_format_support_v3);
+
 static int __q6asm_media_format_block_multi_ch_pcm(struct audio_client *ac,
 				uint32_t rate, uint32_t channels,
 				bool use_default_chmap, char *channel_map,
@@ -5738,7 +5861,7 @@ fail_cmd:
 	return -EINVAL;
 }
 
-int q6asm_get_session_time(struct audio_client *ac, uint64_t *tstamp)
+int q6asm_get_session_time_v2(struct audio_client *ac, uint64_t *ses_time, uint64_t *abs_time)
 {
 	struct asm_mtmx_strtr_get_params mtmx_params;
 	int rc;
@@ -5751,8 +5874,8 @@ int q6asm_get_session_time(struct audio_client *ac, uint64_t *tstamp)
 		pr_err("%s: AC APR handle NULL\n", __func__);
 		return -EINVAL;
 	}
-	if (tstamp == NULL) {
-		pr_err("%s: tstamp NULL\n", __func__);
+	if (ses_time == NULL) {
+		pr_err("%s: tstamp args are NULL\n", __func__);
 		return -EINVAL;
 	}
 
@@ -5788,13 +5911,20 @@ int q6asm_get_session_time(struct audio_client *ac, uint64_t *tstamp)
 		goto fail_cmd;
 	}
 
-	*tstamp = ac->time_stamp;
+	*ses_time = ac->time_stamp;
+	if(abs_time != NULL)
+		*abs_time = ac->dsp_ts.abs_time_stamp;
 	return 0;
 
 fail_cmd:
 	return -EINVAL;
 }
 
+int q6asm_get_session_time(struct audio_client *ac, uint64_t *tstamp)
+{
+	return q6asm_get_session_time_v2(ac, tstamp, NULL);
+}
+
 int q6asm_get_session_time_legacy(struct audio_client *ac, uint64_t *tstamp)
 {
 	struct apr_hdr hdr;