Merge 64e012e95359c741bb9017ca3ac8b5612c2062bb on remote branch

Change-Id: Ib0eb8d6294bb2d86dd736992268128da396bd971

35 files changed, 430 insertions, 269 deletions

diff --git a/core/cds/inc/cds_regdomain.h b/core/cds/inc/cds_regdomain.h
index b65995fe663f..664e2ca8ac9c 100644
--- a/core/cds/inc/cds_regdomain.h
+++ b/core/cds/inc/cds_regdomain.h
@@ -559,8 +559,16 @@ void cds_set_wma_dfs_region(uint8_t dfs_region);
 uint16_t cds_reg_dmn_get_opclass_from_channel(uint8_t *country,
 					      uint8_t channel,
 					      uint8_t offset);
-void cds_reg_dmn_get_channel_from_opclass(uint8_t *country,
-					  uint8_t op_class);
+
+/**
+ * cds_reg_dmn_print_channels_in_opclass() - Print channels in given op class
+ *					     and country combination
+ * @country: the country code
+ * @op_class: operating class
+ *
+ * Return: none
+ */
+void cds_reg_dmn_print_channels_in_opclass(uint8_t *country, uint8_t op_class);
 uint16_t cds_reg_dmn_get_chanwidth_from_opclass(uint8_t *country,
 						uint8_t channel,
 						uint8_t opclass);
diff --git a/core/cds/src/cds_regdomain.c b/core/cds/src/cds_regdomain.c
index 9cf377b73445..c7ff801ed3ff 100644
--- a/core/cds/src/cds_regdomain.c
+++ b/core/cds/src/cds_regdomain.c
@@ -62,6 +62,13 @@
 
 static struct reg_dmn_supp_op_classes reg_dmn_curr_supp_opp_classes = { 0 };
 
+enum op_class_table_num {
+	OP_CLASS_US = 1,
+	OP_CLASS_EU,
+	OP_CLASS_JAPAN,
+	OP_CLASS_GLOBAL
+};
+
 static const struct reg_dmn_op_class_map_t global_op_class[] = {
 	{81, 25, BW20, {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13} },
 	{82, 25, BW20, {14} },
@@ -892,14 +899,33 @@ uint16_t cds_reg_dmn_get_opclass_from_channel(uint8_t *country, uint8_t channel,
 	const struct reg_dmn_op_class_map_t *class = NULL;
 	uint16_t i = 0;
 
-	if (!qdf_mem_cmp(country, "US", 2)) {
+	switch (country[2]) {
+	case OP_CLASS_US:
 		class = us_op_class;
-	} else if (!qdf_mem_cmp(country, "EU", 2)) {
+		break;
+
+	case OP_CLASS_EU:
 		class = euro_op_class;
-	} else if (!qdf_mem_cmp(country, "JP", 2)) {
+		break;
+
+	case OP_CLASS_JAPAN:
 		class = japan_op_class;
-	} else {
+		break;
+
+	case OP_CLASS_GLOBAL:
 		class = global_op_class;
+		break;
+
+	default:
+		if (!qdf_mem_cmp(country, "US", 2)) {
+			class = us_op_class;
+		} else if (!qdf_mem_cmp(country, "EU", 2)) {
+			class = euro_op_class;
+		} else if (!qdf_mem_cmp(country, "JP", 2)) {
+			class = japan_op_class;
+		} else {
+			class = global_op_class;
+		}
 	}
 
 	while (class->op_class) {
@@ -917,26 +943,41 @@ uint16_t cds_reg_dmn_get_opclass_from_channel(uint8_t *country, uint8_t channel,
 	return 0;
 }
 
-/**
- * cds_reg_dmn_get_channel_from_opclass() - get channel from operating class
- * @country: the country code
- * @op_class: operating class
- *
- * Return: none
- */
-void cds_reg_dmn_get_channel_from_opclass(uint8_t *country, uint8_t op_class)
+void cds_reg_dmn_print_channels_in_opclass(uint8_t *country, uint8_t op_class)
 {
 	const struct reg_dmn_op_class_map_t *class = NULL;
 	uint16_t i = 0;
 
-	if (!qdf_mem_cmp(country, "US", 2)) {
+	qdf_debug("Country %c%c 0x%x",
+		  country[0], country[1], country[2]);
+
+	switch (country[2]) {
+	case OP_CLASS_US:
 		class = us_op_class;
-	} else if (!qdf_mem_cmp(country, "EU", 2)) {
+		break;
+
+	case OP_CLASS_EU:
 		class = euro_op_class;
-	} else if (!qdf_mem_cmp(country, "JP", 2)) {
+		break;
+
+	case OP_CLASS_JAPAN:
 		class = japan_op_class;
-	} else {
+		break;
+
+	case OP_CLASS_GLOBAL:
 		class = global_op_class;
+		break;
+
+	default:
+		if (!qdf_mem_cmp(country, "US", 2)) {
+			class = us_op_class;
+		} else if (!qdf_mem_cmp(country, "EU", 2)) {
+			class = euro_op_class;
+		} else if (!qdf_mem_cmp(country, "JP", 2)) {
+			class = japan_op_class;
+		} else {
+			class = global_op_class;
+		}
 	}
 
 	while (class->op_class) {
@@ -944,9 +985,7 @@ void cds_reg_dmn_get_channel_from_opclass(uint8_t *country, uint8_t op_class)
 			for (i = 0;
 			     (i < MAX_CHANNELS_PER_OPERATING_CLASS &&
 			      class->channels[i]); i++) {
-				QDF_TRACE(QDF_MODULE_ID_QDF,
-					  QDF_TRACE_LEVEL_ERROR,
-					  "Valid channel(%d) in requested RC(%d)",
+				qdf_debug("Valid channel(%d) in requested RC(%d)",
 					  class->channels[i], op_class);
 			}
 			break;
diff --git a/core/hdd/inc/wlan_hdd_cfg.h b/core/hdd/inc/wlan_hdd_cfg.h
index b629ab45d7d7..7d8cfcc4d4a1 100644
--- a/core/hdd/inc/wlan_hdd_cfg.h
+++ b/core/hdd/inc/wlan_hdd_cfg.h
@@ -12465,7 +12465,12 @@ enum hw_filter_mode {
  *   OUI data Len : 00
  *   Info Mask : 35 - Check for NSS, VHT Caps and Band
  *   Capabilities: 6C - (NSS == 3 or 4) && VHT Caps Preset && Band == 2G
- *
+ * OUI 5 : 001018
+ *   OUI data Len : 06
+ *   OUI Data : 02FF009C0000
+ *   OUI data Mask: BC - 10111100
+ *   Info Mask : 25 - Check for NSS and Band
+ *   Capabilities: 48 - NSS == 4 && Band == 2G
  * This ini is used to specify the AP OUIs with which only 1x1 connection
  * is allowed.
  *
@@ -12478,7 +12483,7 @@ enum hw_filter_mode {
  * </ini>
  */
 #define CFG_ACTION_OUI_CONNECT_1X1_NAME    "gActionOUIConnect1x1"
-#define CFG_ACTION_OUI_CONNECT_1X1_DEFAULT "000C43 00 25 42 001018 06 02FFF02C0000 BC 25 42 001018 06 02FF040C0000 BC 25 42 00037F 00 35 6C"
+#define CFG_ACTION_OUI_CONNECT_1X1_DEFAULT "000C43 00 25 42 001018 06 02FFF02C0000 BC 25 42 001018 06 02FF040C0000 BC 25 42 00037F 00 35 6C 001018 06 02FF009C0000 BC 25 48"
 
 /*
  * <ini>
diff --git a/core/hdd/inc/wlan_hdd_main.h b/core/hdd/inc/wlan_hdd_main.h
index 9b76ac429ecf..ca894fb5fd35 100644
--- a/core/hdd/inc/wlan_hdd_main.h
+++ b/core/hdd/inc/wlan_hdd_main.h
@@ -2259,6 +2259,7 @@ struct hdd_context_s {
 
 	enum sar_version sar_version;
 
+	bool is_ssr_in_progress;
 };
 
 int hdd_validate_channel_and_bandwidth(hdd_adapter_t *adapter,
@@ -3165,15 +3166,6 @@ int hdd_driver_memdump_init(void);
 void hdd_driver_memdump_deinit(void);
 
 /**
- * hdd_is_cli_iface_up() - check if there is any cli iface up
- * @hdd_ctx: HDD context
- *
- * Return: return true if there is any cli iface(STA/P2P_CLI) is up
- *         else return false
- */
-bool hdd_is_cli_iface_up(hdd_context_t *hdd_ctx);
-
-/**
  * wlan_hdd_free_cache_channels() - Free the cache channels list
  * @hdd_ctx: Pointer to HDD context
  *
diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c
index 6c918ea58792..82176d586793 100644
--- a/core/hdd/src/wlan_hdd_assoc.c
+++ b/core/hdd/src/wlan_hdd_assoc.c
@@ -132,7 +132,6 @@ uint8_t ccp_rsn_oui_90[HDD_RSN_OUI_SIZE] = {0x00, 0x0F, 0xAC, 0x09};
 #define FT_ASSOC_RSP_IES_OFFSET 6  /* Capability(2) + AID(2) + Status Code(2) */
 #define FT_ASSOC_REQ_IES_OFFSET 4  /* Capability(2) + LI(2) */
 
-#define BEACON_FRAME_IES_OFFSET 12
 #define HDD_PEER_AUTHORIZE_WAIT 10
 
 /**
diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c
index a8bb76e62349..51688c5373cd 100644
--- a/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/core/hdd/src/wlan_hdd_cfg80211.c
@@ -9277,6 +9277,8 @@ static int hdd_validate_avoid_freq_chanlist(hdd_context_t *hdd_ctx,
 		for (ch_idx = channel_list->avoidFreqRange[range_idx].startFreq;
 		     ch_idx <= channel_list->avoidFreqRange[range_idx].endFreq;
 		     ch_idx++) {
+			 if (INVALID_CHANNEL == cds_get_channel_enum(ch_idx))
+				continue;
 			for (unsafe_channel_index = 0;
 			     unsafe_channel_index < unsafe_channel_count;
 			     unsafe_channel_index++) {
diff --git a/core/hdd/src/wlan_hdd_driver_ops.c b/core/hdd/src/wlan_hdd_driver_ops.c
index 7fed1ccfb0f4..ffa23a1b8c54 100644
--- a/core/hdd/src/wlan_hdd_driver_ops.c
+++ b/core/hdd/src/wlan_hdd_driver_ops.c
@@ -459,15 +459,19 @@ static inline void hdd_pld_driver_unloading(struct device *dev)
  */
 static void wlan_hdd_remove(struct device *dev)
 {
+	hdd_context_t *hdd_ctx;
+
 	pr_info("%s: Removing driver v%s\n", WLAN_MODULE_NAME,
 		QWLAN_VERSIONSTR);
-
+	hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD);
 	cds_set_driver_loaded(false);
 	cds_set_unload_in_progress(true);
 
 	if (!cds_wait_for_external_threads_completion(__func__))
 		hdd_warn("External threads are still active attempting driver unload anyway");
 
+	qdf_cancel_delayed_work(&hdd_ctx->iface_idle_work);
+
 	if (!hdd_wait_for_debugfs_threads_completion())
 		hdd_warn("Debugfs threads are still active attempting driver unload anyway");
 
diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c
index 6c5ae98d40fd..532f961ca6c3 100644
--- a/core/hdd/src/wlan_hdd_hostapd.c
+++ b/core/hdd/src/wlan_hdd_hostapd.c
@@ -397,10 +397,6 @@ static int __hdd_hostapd_stop(struct net_device *dev)
 	hdd_stop_adapter(hdd_ctx, adapter, true);
 
 	clear_bit(DEVICE_IFACE_OPENED, &adapter->event_flags);
-
-	if (!hdd_is_cli_iface_up(hdd_ctx))
-		sme_scan_flush_result(hdd_ctx->hHal);
-
 	/* Stop all tx queues */
 	hdd_info("Disabling queues");
 	wlan_hdd_netif_queue_control(adapter,
diff --git a/core/hdd/src/wlan_hdd_ipa.c b/core/hdd/src/wlan_hdd_ipa.c
index 1038de15c4e0..d582e6ba8fc3 100644
--- a/core/hdd/src/wlan_hdd_ipa.c
+++ b/core/hdd/src/wlan_hdd_ipa.c
@@ -6849,7 +6849,7 @@ static int __hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 	int ret = 0;
 
 	if (hdd_validate_adapter(adapter)) {
-		HDD_IPA_LOG(QDF_TRACE_LEVEL_ERROR, "Invalid adapter: 0x%pK",
+		HDD_IPA_LOG(QDF_TRACE_LEVEL_DEBUG, "Invalid adapter: 0x%pK",
 			    adapter);
 		return -EINVAL;
 	}
@@ -7004,7 +7004,7 @@ static int __hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 
 		qdf_mutex_release(&hdd_ipa->event_lock);
 
-		HDD_IPA_LOG(QDF_TRACE_LEVEL_INFO, "sta_connected=%d",
+		HDD_IPA_LOG(QDF_TRACE_LEVEL_DEBUG, "sta_connected=%d",
 			    hdd_ipa->sta_connected);
 		break;
 
@@ -7089,7 +7089,7 @@ static int __hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 
 		qdf_mutex_release(&hdd_ipa->event_lock);
 
-		HDD_IPA_LOG(QDF_TRACE_LEVEL_INFO, "sta_connected=%d",
+		HDD_IPA_LOG(QDF_TRACE_LEVEL_DEBUG, "sta_connected=%d",
 			    hdd_ipa->sta_connected);
 		break;
 
diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c
index 0588d2cf53e0..8c4989301e23 100644
--- a/core/hdd/src/wlan_hdd_main.c
+++ b/core/hdd/src/wlan_hdd_main.c
@@ -2705,13 +2705,6 @@ static int __hdd_stop(struct net_device *dev)
 	clear_bit(DEVICE_IFACE_OPENED, &adapter->event_flags);
 
 	/*
-	 * Upon wifi turn off, DUT has to flush the scan results so if
-	 * this is the last cli iface, flush the scan database.
-	 */
-	if (!hdd_is_cli_iface_up(hdd_ctx))
-		sme_scan_flush_result(hdd_ctx->hHal);
-
-	/*
 	 * Find if any iface is up. If any iface is up then can't put device to
 	 * sleep/power save mode
 	 */
@@ -8927,6 +8920,8 @@ static hdd_context_t *hdd_context_create(struct device *dev)
 	wlan_logging_set_log_to_console(hdd_ctx->config->wlanLoggingToConsole);
 	wlan_logging_set_active(hdd_ctx->config->wlanLoggingEnable);
 
+	hdd_ctx->is_ssr_in_progress = false;
+
 	/*
 	 * Update QDF trace levels based upon the code. The multicast
 	 * levels of the code need not be set when the logger thread
@@ -13534,28 +13529,6 @@ void hdd_drv_ops_inactivity_handler(unsigned long arg)
 	cds_trigger_recovery(false);
 }
 
-bool hdd_is_cli_iface_up(hdd_context_t *hdd_ctx)
-{
-	hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
-	hdd_adapter_t *adapter;
-	QDF_STATUS status;
-
-	status = hdd_get_front_adapter(hdd_ctx, &adapter_node);
-	while (NULL != adapter_node && QDF_STATUS_SUCCESS == status) {
-		adapter = adapter_node->pAdapter;
-		if ((adapter->device_mode == QDF_STA_MODE ||
-		     adapter->device_mode == QDF_P2P_CLIENT_MODE) &&
-		    qdf_atomic_test_bit(DEVICE_IFACE_OPENED,
-					&adapter->event_flags)){
-			return true;
-		}
-		status = hdd_get_next_adapter(hdd_ctx, adapter_node, &next);
-		adapter_node = next;
-	}
-
-	return false;
-}
-
 /* Register the module init/exit functions */
 module_init(hdd_module_init);
 module_exit(hdd_module_exit);
diff --git a/core/hdd/src/wlan_hdd_ocb.c b/core/hdd/src/wlan_hdd_ocb.c
index 9ca0327927c2..034fbecfa539 100644
--- a/core/hdd/src/wlan_hdd_ocb.c
+++ b/core/hdd/src/wlan_hdd_ocb.c
@@ -1915,6 +1915,12 @@ static int __wlan_hdd_cfg80211_dcc_update_ndl(struct wiphy *wiphy,
 	ndl_active_state_array = nla_data(
 		tb[QCA_WLAN_VENDOR_ATTR_DCC_UPDATE_NDL_ACTIVE_STATE_ARRAY]);
 
+	/* Check channel count. Per 11p spec, max 2 channels allowed */
+	if (!channel_count || channel_count > TGT_NUM_OCB_CHANNELS) {
+		hdd_err("Invalid channel_count %d", channel_count);
+		return -EINVAL;
+	}
+
 	hdd_request = hdd_request_alloc(&params);
 	if (!hdd_request) {
 		hdd_err("Request allocation failure");
diff --git a/core/hdd/src/wlan_hdd_p2p.c b/core/hdd/src/wlan_hdd_p2p.c
index 3d7955bda2e2..3b6ad6df8477 100644
--- a/core/hdd/src/wlan_hdd_p2p.c
+++ b/core/hdd/src/wlan_hdd_p2p.c
@@ -802,7 +802,9 @@ QDF_STATUS wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void *pCtx,
 	 * Always schedule below work queue only after completing the
 	 * cancel_rem_on_chan_var event.
 	 */
-	schedule_delayed_work(&hdd_ctx->roc_req_work, 0);
+	/* If ssr is inprogress, do not schedule next roc req */
+	if (!hdd_ctx->is_ssr_in_progress)
+		schedule_delayed_work(&hdd_ctx->roc_req_work, 0);
 
 	return QDF_STATUS_SUCCESS;
 }
@@ -957,6 +959,8 @@ static void wlan_hdd_cancel_pending_roc(hdd_adapter_t *adapter)
 	roc_scan_id = roc_ctx->scan_id;
 	mutex_unlock(&cfg_state->remain_on_chan_ctx_lock);
 
+	INIT_COMPLETION(adapter->cancel_rem_on_chan_var);
+
 	if (adapter->device_mode == QDF_P2P_GO_MODE) {
 		void *sap_ctx = WLAN_HDD_GET_SAP_CTX_PTR(adapter);
 
diff --git a/core/hdd/src/wlan_hdd_power.c b/core/hdd/src/wlan_hdd_power.c
index 2e0ac39155e3..09549fb4dd94 100644
--- a/core/hdd/src/wlan_hdd_power.c
+++ b/core/hdd/src/wlan_hdd_power.c
@@ -1475,6 +1475,8 @@ QDF_STATUS hdd_wlan_shutdown(void)
 		return QDF_STATUS_E_FAILURE;
 	}
 
+	pHddCtx->is_ssr_in_progress = true;
+
 	cds_clear_concurrent_session_count();
 
 	hdd_debug("Invoking packetdump deregistration API");
@@ -1691,6 +1693,9 @@ success:
 	if (pHddCtx->config->sap_internal_restart)
 		hdd_ssr_restart_sap(pHddCtx);
 	hdd_is_interface_down_during_ssr(pHddCtx);
+
+	pHddCtx->is_ssr_in_progress = false;
+
 	hdd_wlan_ssr_reinit_event();
 	return QDF_STATUS_SUCCESS;
 }
diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index 6e6d4e5af7fe..184e05bbfe9e 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -32,9 +32,9 @@
 #define QWLAN_VERSION_MAJOR            5
 #define QWLAN_VERSION_MINOR            1
 #define QWLAN_VERSION_PATCH            1
-#define QWLAN_VERSION_EXTRA            ""
+#define QWLAN_VERSION_EXTRA            "P"
 #define QWLAN_VERSION_BUILD            69
 
-#define QWLAN_VERSIONSTR               "5.1.1.69"
+#define QWLAN_VERSIONSTR               "5.1.1.69P"
 
 #endif /* QWLAN_VERSION_H */
diff --git a/core/mac/inc/sir_mac_prot_def.h b/core/mac/inc/sir_mac_prot_def.h
index 18e064e104db..2ff3a26e87f8 100644
--- a/core/mac/inc/sir_mac_prot_def.h
+++ b/core/mac/inc/sir_mac_prot_def.h
@@ -2068,6 +2068,43 @@ typedef struct sSirMacLinkReport {
 } tSirMacLinkReport, *tpSirMacLinkReport;
 
 #define BEACON_REPORT_MAX_IES 224       /* Refer IEEE 802.11k-2008, Table 7-31d */
+/* Max number of beacon reports per channel supported in the driver */
+#define MAX_BEACON_REPORTS 8
+/* Offset of IEs after Fixed Fields in Beacon Frame */
+#define BEACON_FRAME_IES_OFFSET 12
+
+/**
+ * struct bcn_report_frame_body_frag_id - beacon report reported frame body
+ *					  fragment ID sub element params
+ * @id: report ID
+ * @frag_id: fragment ID
+ * @more_frags: more frags present or not present
+ */
+struct bcn_report_frame_body_frag_id {
+	uint8_t id;
+	uint8_t frag_id;
+	bool more_frags;
+};
+
+/**
+ * struct sSirMacBeaconReport - Beacon Report Structure
+ * @regClass: Regulatory Class
+ * @channel: Channel for which the current report is being sent
+ * @measStartTime: RRM scan start time for this report
+ * @measDuration: Scan duration for the current channel
+ * @phyType: Condensed Phy Type
+ * @bcnProbeRsp: Beacon or probe response being reported
+ * @rsni: Received signal-to-noise indication
+ * @rcpi: Received Channel Power indication
+ * @bssid: BSSID of the AP requesting the beacon report
+ * @antennaId: Number of Antennas used for measurement
+ * @parentTSF: measuring STA's TSF timer value
+ * @numIes: Number of IEs included in the beacon frames
+ * @last_bcn_report_ind_support: Support for Last beacon report indication
+ * @is_last_bcn_report: Is the current report last or more reports present
+ * @frame_body_frag_id: Reported Frame Body Frag Id sub-element params
+ * @Ies: IEs included in the beacon report
+ */
 typedef struct sSirMacBeaconReport {
 	uint8_t regClass;
 	uint8_t channel;
@@ -2081,6 +2118,9 @@ typedef struct sSirMacBeaconReport {
 	uint8_t antennaId;
 	uint32_t parentTSF;
 	uint8_t numIes;
+	uint8_t last_bcn_report_ind_support;
+	uint8_t is_last_bcn_report;
+	struct bcn_report_frame_body_frag_id frame_body_frag_id;
 	uint8_t Ies[BEACON_REPORT_MAX_IES];
 
 } tSirMacBeaconReport, *tpSirMacBeaconReport;
diff --git a/core/mac/src/include/dot11f.h b/core/mac/src/include/dot11f.h
index 2be3a3883eee..cc69a0ed216d 100644
--- a/core/mac/src/include/dot11f.h
+++ b/core/mac/src/include/dot11f.h
@@ -26,7 +26,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Tue Sep 18 11:47:29 2018 from the following file(s):
+ * Tue Dec 11 14:40:59 2018 from the following file(s):
  *
  * dot11f.frms
  *
diff --git a/core/mac/src/include/parser_api.h b/core/mac/src/include/parser_api.h
index 9f80d000b3a2..4a65b276bda3 100644
--- a/core/mac/src/include/parser_api.h
+++ b/core/mac/src/include/parser_api.h
@@ -800,7 +800,7 @@ populate_dot11f_ext_supp_rates(tpAniSirGlobal pMac,
  * @pMac: Pointer to the global MAC context
  * @pDot11f: Pointer to the measurement report structure
  * @pBeaconReport: Pointer to the Beacon Report structure
- * @last_beacon_report_params: Last Beacon Report indication params
+ * @is_last_frame: is the current report last or more reports to follow
  *
  * Return: Ret Status
  */
@@ -808,8 +808,7 @@ tSirRetStatus
 populate_dot11f_beacon_report(tpAniSirGlobal pMac,
 			tDot11fIEMeasurementReport *pDot11f,
 			tSirMacBeaconReport *pBeaconReport,
-			struct rrm_beacon_report_last_beacon_params
-			*last_beacon_report_params);
+			bool is_last_frame);
 
 /**
  * \brief Populate a tDot11fIEExtSuppRates
diff --git a/core/mac/src/pe/include/rrm_global.h b/core/mac/src/pe/include/rrm_global.h
index fe4ac201b9a6..8ba4373fd092 100644
--- a/core/mac/src/pe/include/rrm_global.h
+++ b/core/mac/src/pe/include/rrm_global.h
@@ -160,20 +160,6 @@ typedef struct sRRMReq {
 	uint8_t sendEmptyBcnRpt;
 } tRRMReq, *tpRRMReq;
 
-/**
- * rrm_beacon_report_last_beacon_params - Last Beacon Report Indication params
- * @last_beacon_ind: flag for whether last beacon indication is required
- * @report_id: Report ID of the corresponding Beacon Report Request
- * @frag_id: Current fragment's Fragment ID
- * @num_frags: Total number of fragments in the Beacon Report
- */
-struct rrm_beacon_report_last_beacon_params {
-	uint8_t last_beacon_ind;
-	uint8_t report_id;
-	uint8_t frag_id;
-	uint8_t num_frags;
-};
-
 typedef struct sRRMCaps {
 	uint8_t LinkMeasurement:1;
 	uint8_t NeighborRpt:1;
diff --git a/core/mac/src/pe/lim/lim_api.c b/core/mac/src/pe/lim/lim_api.c
index c6bf61be991c..08a5dd1734e8 100644
--- a/core/mac/src/pe/lim/lim_api.c
+++ b/core/mac/src/pe/lim/lim_api.c
@@ -1533,8 +1533,6 @@ lim_detect_change_in_ap_capabilities(tpAniSirGlobal pMac,
 	       SIR_MAC_GET_ESS(psessionEntry->limCurrentBssCaps)) ||
 	      (SIR_MAC_GET_PRIVACY(apNewCaps.capabilityInfo) !=
 	       SIR_MAC_GET_PRIVACY(psessionEntry->limCurrentBssCaps)) ||
-	      (SIR_MAC_GET_SHORT_PREAMBLE(apNewCaps.capabilityInfo) !=
-	       SIR_MAC_GET_SHORT_PREAMBLE(psessionEntry->limCurrentBssCaps)) ||
 	      (SIR_MAC_GET_QOS(apNewCaps.capabilityInfo) !=
 	       SIR_MAC_GET_QOS(psessionEntry->limCurrentBssCaps)) ||
 	      ((newChannel != psessionEntry->currentOperChannel) &&
diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c
index 6b511869818e..392dc1d9dddf 100644
--- a/core/mac/src/pe/lim/lim_send_management_frames.c
+++ b/core/mac/src/pe/lim/lim_send_management_frames.c
@@ -4183,8 +4183,7 @@ tSirRetStatus
 lim_send_radio_measure_report_action_frame(tpAniSirGlobal pMac,
 				uint8_t dialog_token,
 				uint8_t num_report,
-				struct rrm_beacon_report_last_beacon_params
-				*last_beacon_report_params,
+				bool is_last_frame,
 				tpSirMacRadioMeasureReport pRRMReport,
 				tSirMacAddr peer,
 				tpPESession psessionEntry)
@@ -4198,6 +4197,7 @@ lim_send_radio_measure_report_action_frame(tpAniSirGlobal pMac,
 	uint8_t i;
 	uint8_t txFlag = 0;
 	uint8_t smeSessionId = 0;
+	bool is_last_report = false;
 
 	tDot11fRadioMeasurementReport *frm =
 		qdf_mem_malloc(sizeof(tDot11fRadioMeasurementReport));
@@ -4214,8 +4214,8 @@ lim_send_radio_measure_report_action_frame(tpAniSirGlobal pMac,
 
 	smeSessionId = psessionEntry->smeSessionId;
 
-	pe_debug("dialog_token %d num_report %d",
-			dialog_token, num_report);
+	pe_debug("dialog_token %d num_report %d is_last_frame %d",
+		 dialog_token, num_report, is_last_frame);
 
 	frm->Category.category = SIR_MAC_ACTION_RRM;
 	frm->Action.action = SIR_MAC_RRM_RADIO_MEASURE_RPT;
@@ -4232,11 +4232,19 @@ lim_send_radio_measure_report_action_frame(tpAniSirGlobal pMac,
 		frm->MeasurementReport[i].late = 0;     /* IEEE 802.11k section 7.3.22. (always zero in rrm) */
 		switch (pRRMReport[i].type) {
 		case SIR_MAC_RRM_BEACON_TYPE:
+			/*
+			 * Last beacon report indication needs to be set to 1
+			 * only for the last report in the last frame
+			 */
+			if (is_last_frame &&
+			    (i == (frm->num_MeasurementReport - 1)))
+				is_last_report = true;
+
 			populate_dot11f_beacon_report(pMac,
 						     &frm->MeasurementReport[i],
 						     &pRRMReport[i].report.
 						     beaconReport,
-						     last_beacon_report_params);
+						     is_last_report);
 			frm->MeasurementReport[i].incapable =
 				pRRMReport[i].incapable;
 			frm->MeasurementReport[i].refused =
diff --git a/core/mac/src/pe/lim/lim_types.h b/core/mac/src/pe/lim/lim_types.h
index df1316cf3fde..63d03060b192 100644
--- a/core/mac/src/pe/lim/lim_types.h
+++ b/core/mac/src/pe/lim/lim_types.h
@@ -584,7 +584,7 @@ tSirRetStatus lim_send_link_report_action_frame(tpAniSirGlobal, tpSirMacLinkRepo
  * @pMac: pointer to global MAC context
  * @dialog_token: Dialog token to be used in the action frame
  * @num_report: number of reports in pRRMReport
- * @last_beacon_report_params: Last Beacon Report indication params
+ * @is_last_frame: is the current report last or more reports to follow
  * @pRRMReport: Pointer to the RRM report structure
  * @peer: MAC address of the peer
  * @psessionEntry: Pointer to the PE session entry
@@ -595,8 +595,7 @@ tSirRetStatus
 lim_send_radio_measure_report_action_frame(tpAniSirGlobal pMac,
 				uint8_t dialog_token,
 				uint8_t num_report,
-				struct rrm_beacon_report_last_beacon_params
-				*last_beacon_report_params,
+				bool is_last_frame,
 				tpSirMacRadioMeasureReport pRRMReport,
 				tSirMacAddr peer,
 				tpPESession psessionEntry);
diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c
index 03fd19734256..73e1314a670f 100644
--- a/core/mac/src/pe/rrm/rrm_api.c
+++ b/core/mac/src/pe/rrm/rrm_api.c
@@ -689,67 +689,113 @@ rrm_process_beacon_report_req(tpAniSirGlobal pMac,
  * @param pIesMaxSize - Max size of the buffer pIes.
  * @param eids - pointer to array of eids. If NULL, all ies will be populated.
  * @param numEids - number of elements in array eids.
+ * @start_offset: Offset from where the IEs in the bss_desc should be parsed
  * @param pBssDesc - pointer to Bss Description.
- * @return None
+ *
+ * Returns: Remaining length of IEs in current bss_desc which are not included
+ *	    in pIes.
  */
-static void
+static uint8_t
 rrm_fill_beacon_ies(tpAniSirGlobal pMac,
 		    uint8_t *pIes, uint8_t *pNumIes, uint8_t pIesMaxSize,
-		    uint8_t *eids, uint8_t numEids, tpSirBssDescription pBssDesc)
+		    uint8_t *eids, uint8_t numEids, uint8_t start_offset,
+		    tpSirBssDescription pBssDesc)
 {
 	uint8_t len, *pBcnIes, count = 0, i;
-	uint16_t BcnNumIes;
+	uint16_t BcnNumIes, total_ies_len;
+	uint8_t rem_len = 0;
 
 	if ((pIes == NULL) || (pNumIes == NULL) || (pBssDesc == NULL)) {
 		pe_err("Invalid parameters");
-		return;
+		return 0;
 	}
 	/* Make sure that if eid is null, numEids is set to zero. */
 	numEids = (eids == NULL) ? 0 : numEids;
 
+	total_ies_len = GET_IE_LEN_IN_BSS(pBssDesc->length);
+	BcnNumIes = total_ies_len;
+	if (start_offset > BcnNumIes) {
+		pe_err("Invalid start offset %d Bcn IE len %d",
+		       start_offset, total_ies_len);
+		return 0;
+	}
+
 	pBcnIes = (uint8_t *) &pBssDesc->ieFields[0];
-	BcnNumIes = GET_IE_LEN_IN_BSS(pBssDesc->length);
+	pBcnIes += start_offset;
+	BcnNumIes = BcnNumIes - start_offset;
 
 	*pNumIes = 0;
 
-	*((uint32_t *) pIes) = pBssDesc->timeStamp[0];
-	*pNumIes += sizeof(uint32_t);
-	pIes += sizeof(uint32_t);
-	*((uint32_t *) pIes) = pBssDesc->timeStamp[1];
-	*pNumIes += sizeof(uint32_t);
-	pIes += sizeof(uint32_t);
-	*((uint16_t *) pIes) = pBssDesc->beaconInterval;
-	*pNumIes += sizeof(uint16_t);
-	pIes += sizeof(uint16_t);
-	*((uint16_t *) pIes) = pBssDesc->capabilityInfo;
-	*pNumIes += sizeof(uint16_t);
-	pIes += sizeof(uint16_t);
+	/*
+	 * If start_offset is 0, this is the first fragment of the current
+	 * beacon. Include the Beacon Fixed Fields of length 12 bytes
+	 * (BEACON_FRAME_IES_OFFSET) in the first fragment.
+	 */
+	if (start_offset == 0) {
+		*((uint32_t *)pIes) = pBssDesc->timeStamp[0];
+		*pNumIes += sizeof(uint32_t);
+		pIes += sizeof(uint32_t);
+		*((uint32_t *)pIes) = pBssDesc->timeStamp[1];
+		*pNumIes += sizeof(uint32_t);
+		pIes += sizeof(uint32_t);
+		*((uint16_t *)pIes) = pBssDesc->beaconInterval;
+		*pNumIes += sizeof(uint16_t);
+		pIes += sizeof(uint16_t);
+		*((uint16_t *)pIes) = pBssDesc->capabilityInfo;
+		*pNumIes += sizeof(uint16_t);
+		pIes += sizeof(uint16_t);
+	}
 
 	while (BcnNumIes > 0) {
 		len = *(pBcnIes + 1) + 2;       /* element id + length. */
 		pe_debug("EID = %d, len = %d total = %d",
 			*pBcnIes, *(pBcnIes + 1), len);
 
+		if (!len) {
+			pe_err("Invalid length");
+			break;
+		}
+
 		i = 0;
 		do {
-			if (((eids == NULL) || (*pBcnIes == eids[i])) &&
-			    ((*pNumIes) + len) < pIesMaxSize) {
-				pe_debug("Adding Eid %d, len=%d",
-					*pBcnIes, len);
-
-				qdf_mem_copy(pIes, pBcnIes, len);
-				pIes += len;
-				*pNumIes += len;
-				count++;
+			if ((!eids) || (*pBcnIes == eids[i])) {
+				if (((*pNumIes) + len) < pIesMaxSize) {
+					pe_debug("Adding Eid %d, len=%d",
+						 *pBcnIes, len);
+
+					qdf_mem_copy(pIes, pBcnIes, len);
+					pIes += len;
+					*pNumIes += len;
+					count++;
+				} else {
+					/*
+					 * If max size of fragment is reached,
+					 * calculate the remaining length and
+					 * break. For first fragment, account
+					 * for the fixed fields also.
+					 */
+					rem_len = total_ies_len - *pNumIes;
+					if (start_offset == 0)
+						rem_len = rem_len +
+						BEACON_FRAME_IES_OFFSET;
+					pe_debug("rem_len %d ies added %d",
+						 rem_len, *pNumIes);
+				}
 				break;
 			}
 			i++;
 		} while (i < numEids);
 
+		if (rem_len)
+			break;
+
 		pBcnIes += len;
 		BcnNumIes -= len;
 	}
-	pe_debug("Total length of Ies added = %d", *pNumIes);
+	pe_debug("Total length of Ies added = %d rem_len %d",
+		 *pNumIes, rem_len);
+
+	return rem_len;
 }
 
 /**
@@ -771,10 +817,13 @@ rrm_process_beacon_report_xmit(tpAniSirGlobal mac_ctx,
 	tpSirBssDescription bss_desc;
 	tpRRMReq curr_req = mac_ctx->rrm.rrmPEContext.pCurrentReq;
 	tpPESession session_entry;
-	struct rrm_beacon_report_last_beacon_params last_beacon_report_params;
 	uint8_t session_id, counter;
+	uint8_t i, j, offset = 0;
 	uint8_t bss_desc_count = 0;
 	uint8_t report_index = 0;
+	uint8_t rem_len = 0;
+	uint8_t frag_id = 0;
+	uint8_t num_frames, num_reports_in_frame;
 
 	pe_debug("Received beacon report xmit indication");
 
@@ -802,8 +851,7 @@ rrm_process_beacon_report_xmit(tpAniSirGlobal mac_ctx,
 			goto end;
 		}
 
-		report = qdf_mem_malloc(beacon_xmit_ind->numBssDesc *
-			 sizeof(*report));
+		report = qdf_mem_malloc(MAX_BEACON_REPORTS * sizeof(*report));
 
 		if (NULL == report) {
 			pe_err("RRM Report is NULL, allocation failed");
@@ -811,22 +859,23 @@ rrm_process_beacon_report_xmit(tpAniSirGlobal mac_ctx,
 			goto end;
 		}
 
-		for (bss_desc_count = 0; bss_desc_count <
-		     beacon_xmit_ind->numBssDesc; bss_desc_count++) {
+		for (i = 0; i < MAX_BEACON_REPORTS &&
+		     bss_desc_count < beacon_xmit_ind->numBssDesc; i++) {
 			beacon_report =
-				&report[bss_desc_count].report.beaconReport;
+				&report[i].report.beaconReport;
 			/*
 			 * If the scan result is NULL then send report request
 			 * with option subelement as NULL.
 			 */
+			pe_debug("report %d bss %d", i, bss_desc_count);
 			bss_desc = beacon_xmit_ind->
 				   pBssDescription[bss_desc_count];
 			/* Prepare the beacon report and send it to the peer.*/
-			report[bss_desc_count].token =
+			report[i].token =
 				beacon_xmit_ind->uDialogToken;
-			report[bss_desc_count].refused = 0;
-			report[bss_desc_count].incapable = 0;
-			report[bss_desc_count].type = SIR_MAC_RRM_BEACON_TYPE;
+			report[i].refused = 0;
+			report[i].incapable = 0;
+			report[i].type = SIR_MAC_RRM_BEACON_TYPE;
 
 			/*
 			 * Valid response is included if the size of
@@ -861,68 +910,88 @@ rrm_process_beacon_report_xmit(tpAniSirGlobal mac_ctx,
 				/* 1: Include all FFs and Requested Ies. */
 				pe_debug("Only requested IEs in reporting detail requested");
 
-				if (bss_desc) {
-					rrm_fill_beacon_ies(mac_ctx,
-					    (uint8_t *) &beacon_report->Ies[0],
-					    (uint8_t *) &beacon_report->numIes,
+				if (!bss_desc)
+					break;
+
+				rem_len = rrm_fill_beacon_ies(mac_ctx,
+					    (uint8_t *)&beacon_report->Ies[0],
+					    (uint8_t *)&beacon_report->numIes,
 					    BEACON_REPORT_MAX_IES,
 					    curr_req->request.Beacon.reqIes.
 					    pElementIds,
 					    curr_req->request.Beacon.reqIes.num,
-					    bss_desc);
-				}
+					    offset, bss_desc);
 				break;
 			case BEACON_REPORTING_DETAIL_ALL_FF_IE:
 				/* 2: default - Include all FFs and all Ies. */
 			default:
 				pe_debug("Default all IEs and FFs");
-				if (bss_desc) {
-					rrm_fill_beacon_ies(mac_ctx,
+				if (!bss_desc)
+					break;
+
+				rem_len = rrm_fill_beacon_ies(mac_ctx,
 					    (uint8_t *) &beacon_report->Ies[0],
 					    (uint8_t *) &beacon_report->numIes,
 					    BEACON_REPORT_MAX_IES,
 					    NULL,
 					    0,
-					    bss_desc);
-				}
+					    offset, bss_desc);
 				break;
 			}
+			beacon_report->frame_body_frag_id.id = bss_desc_count;
+			beacon_report->frame_body_frag_id.frag_id = frag_id;
+			/*
+			 * If remaining length is non-zero, the beacon needs to
+			 * be fragmented only if the current request supports
+			 * last beacon report indication.
+			 * If last beacon report indication is not supported,
+			 * truncate and move on to the next beacon.
+			 */
+			if (rem_len &&
+			    curr_req->request.Beacon.
+			    last_beacon_report_indication) {
+				offset = GET_IE_LEN_IN_BSS(
+						bss_desc->length) - rem_len;
+				pe_debug("offset %d ie_len %lu rem_len %d frag_id %d",
+					 offset,
+					 GET_IE_LEN_IN_BSS(bss_desc->length),
+					 rem_len, frag_id);
+				frag_id++;
+				beacon_report->frame_body_frag_id.more_frags =
+									true;
+			} else {
+				offset = 0;
+				beacon_report->frame_body_frag_id.more_frags =
+									false;
+				frag_id = 0;
+				bss_desc_count++;
+				pe_debug("No remaining IEs");
+			}
+
+			if (curr_req->request.Beacon.
+			    last_beacon_report_indication) {
+				pe_debug("Setting last beacon report support");
+				beacon_report->last_bcn_report_ind_support = 1;
+			}
 		}
 
-		qdf_mem_zero(&last_beacon_report_params,
-			sizeof(last_beacon_report_params));
-		/*
-		 * Each frame can hold RADIO_REPORTS_MAX_IN_A_FRAME reports.
-		 * Multiple frames may be sent if bss_desc_count is larger.
-		 * Count the total number of frames to be sent first
-		 */
+		pe_debug("Total reports filled %d", i);
+		num_frames = i / RADIO_REPORTS_MAX_IN_A_FRAME;
+		if (i % RADIO_REPORTS_MAX_IN_A_FRAME)
+			num_frames++;
+
+		for (j = 0; j < num_frames; j++) {
+			num_reports_in_frame = QDF_MIN((i - report_index),
+						RADIO_REPORTS_MAX_IN_A_FRAME);
 
-		last_beacon_report_params.last_beacon_ind =
-			curr_req->request.Beacon.last_beacon_report_indication;
-		last_beacon_report_params.num_frags =
-			(bss_desc_count / RADIO_REPORTS_MAX_IN_A_FRAME);
-		if (bss_desc_count % RADIO_REPORTS_MAX_IN_A_FRAME)
-			last_beacon_report_params.num_frags++;
-
-		pe_debug("last_beacon_report_ind required %d num_frags %d bss_count %d",
-			last_beacon_report_params.last_beacon_ind,
-			last_beacon_report_params.num_frags,
-			bss_desc_count);
-
-		while (report_index < bss_desc_count) {
-			int m_count;
-
-			m_count = QDF_MIN((bss_desc_count - report_index),
-					RADIO_REPORTS_MAX_IN_A_FRAME);
-			pe_debug("Sending Action frame with %d bss info frag_id %d",
-				m_count, last_beacon_report_params.frag_id);
+			pe_debug("Sending Action frame number %d",
+				 num_reports_in_frame);
 			lim_send_radio_measure_report_action_frame(mac_ctx,
-				curr_req->dialog_token, m_count,
-				&last_beacon_report_params,
+				curr_req->dialog_token, num_reports_in_frame,
+				(j == num_frames - 1) ? true : false,
 				&report[report_index],
 				beacon_xmit_ind->bssId, session_entry);
-			report_index += m_count;
-			last_beacon_report_params.frag_id++;
+			report_index += num_reports_in_frame;
 		}
 		curr_req->sendEmptyBcnRpt = false;
 	}
@@ -976,7 +1045,7 @@ static void rrm_process_beacon_request_failure(tpAniSirGlobal pMac,
 
 	lim_send_radio_measure_report_action_frame(pMac,
 						   pCurrentReq->dialog_token,
-						   1, NULL,
+						   1, true,
 						   pReport, peer,
 						   pSessionEntry);
 
@@ -1131,7 +1200,7 @@ rrm_process_radio_measurement_request(tpAniSirGlobal mac_ctx,
 		report->incapable = 1;
 		num_report = 1;
 		lim_send_radio_measure_report_action_frame(mac_ctx,
-			rrm_req->DialogToken.token, num_report, NULL,
+			rrm_req->DialogToken.token, num_report, true,
 			report, peer, session_entry);
 		qdf_mem_free(report);
 		return eSIR_FAILURE;
@@ -1184,7 +1253,7 @@ rrm_process_radio_measurement_request(tpAniSirGlobal mac_ctx,
 end:
 	if (report) {
 		lim_send_radio_measure_report_action_frame(mac_ctx,
-			rrm_req->DialogToken.token, num_report, NULL,
+			rrm_req->DialogToken.token, num_report, true,
 			report, peer, session_entry);
 		qdf_mem_free(report);
 	}
diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
index 65d29ae9a82d..fa57865abc1e 100644
--- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c
+++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
@@ -24,7 +24,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Tue Sep 18 11:47:29 2018 from the following file(s):
+ * Tue Dec 11 14:40:59 2018 from the following file(s):
  *
  * dot11f.frms
  *
@@ -12083,20 +12083,25 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
 		}
 
 		if (pIe) {
-			if ((nBufRemaining < pIe->minSize - pIe->noui - 2U) ||
-			    (len < pIe->minSize - pIe->noui - 2U)) {
-				FRAMES_LOG4(pCtx, FRLOGW, FRFL("The IE %s must "
+			if ((nBufRemaining < pIe->minSize - pIe->noui - 2U)) {
+				FRAMES_LOG3(pCtx, FRLOGW, FRFL("The IE %s must "
 					"be at least %d bytes in size, but "
 					"there are only %d bytes remaining in "
-					"this frame or the IE reports a size "
-					"of %d bytes.\n"),
-					pIe->name, pIe->minSize, nBufRemaining,
-					(len + pIe->noui + 2U));
+					"this frame\n"),
+					pIe->name, pIe->minSize, nBufRemaining);
 				FRAMES_DUMP(pCtx, FRLOG1, pBuf, nBuf);
 				status |= DOT11F_INCOMPLETE_IE;
 				FRAMES_DBG_BREAK();
 				goto MandatoryCheck;
 			} else {
+				if (len < pIe->minSize - pIe->noui - 2U) {
+					FRAMES_LOG3(pCtx, FRLOGW, FRFL("The IE %s must "
+							"be at least %d bytes in size, but "
+							"there are only %d bytes in the IE\n"),
+							pIe->name, pIe->minSize, (len + pIe->noui + 2U));
+					goto skip_ie;
+				}
+
 				if (len > pIe->maxSize - pIe->noui - 2U) {
 				FRAMES_LOG1(pCtx, FRLOGW, FRFL("The IE %s reports "
 					"an unexpectedly large size; it is presumably "
@@ -12110,7 +12115,7 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
 						(*(uint16_t *)(pFrm + pIe->countOffset)));
 				if (0 != pIe->arraybound && countOffset >= pIe->arraybound) {
 					status |= DOT11F_DUPLICATE_IE;
-					goto skip_dup_ie;
+					goto skip_ie;
 				}
 				switch (pIe->sig) {
 				case SigIeGTK:
@@ -13572,7 +13577,7 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
 			status |= DOT11F_UNKNOWN_IES;
 		}
 
-skip_dup_ie:
+skip_ie:
 		pBufRemaining += len;
 
 		if (len > nBufRemaining) {
diff --git a/core/mac/src/sys/legacy/src/utils/src/parser_api.c b/core/mac/src/sys/legacy/src/utils/src/parser_api.c
index 622dbbd00f8b..1513d45df870 100644
--- a/core/mac/src/sys/legacy/src/utils/src/parser_api.c
+++ b/core/mac/src/sys/legacy/src/utils/src/parser_api.c
@@ -5944,9 +5944,9 @@ tSirRetStatus populate_dot11f_wfatpc(tpAniSirGlobal pMac,
 tSirRetStatus populate_dot11f_beacon_report(tpAniSirGlobal pMac,
 				tDot11fIEMeasurementReport *pDot11f,
 				tSirMacBeaconReport *pBeaconReport,
-				struct rrm_beacon_report_last_beacon_params
-				*last_beacon_report_params)
+				bool is_last_frame)
 {
+	tDot11fIEbeacon_report_frm_body_fragment_id *frm_body_frag_id;
 
 	pDot11f->report.Beacon.regClass = pBeaconReport->regClass;
 	pDot11f->report.Beacon.channel = pBeaconReport->channel;
@@ -5973,35 +5973,29 @@ tSirRetStatus populate_dot11f_beacon_report(tpAniSirGlobal pMac,
 			pBeaconReport->numIes;
 	}
 
-	if (last_beacon_report_params &&
-	    last_beacon_report_params->last_beacon_ind) {
-		pe_debug("Including Last Beacon Report in RRM Frame, report_id %d, frag_id %d",
-			last_beacon_report_params->report_id,
-			last_beacon_report_params->frag_id);
-		pDot11f->report.Beacon.beacon_report_frm_body_fragment_id.
-			present = 1;
-		pDot11f->report.Beacon.beacon_report_frm_body_fragment_id.
-			beacon_report_id = last_beacon_report_params->report_id;
-		pDot11f->report.Beacon.beacon_report_frm_body_fragment_id.
-			fragment_id_number = last_beacon_report_params->frag_id;
-
-		pDot11f->report.Beacon.last_beacon_report_indication.present = 1;
-
-		if (last_beacon_report_params->frag_id ==
-		    (last_beacon_report_params->num_frags - 1)) {
-			pDot11f->report.Beacon.
-				beacon_report_frm_body_fragment_id.
-				more_fragments = 0;
-			pDot11f->report.Beacon.last_beacon_report_indication.
-				last_fragment = 1;
-			pe_debug("Last Fragment");
-		} else {
-			pDot11f->report.Beacon.
-				beacon_report_frm_body_fragment_id.
-				more_fragments = 1;
-			pDot11f->report.Beacon.last_beacon_report_indication.
-				last_fragment = 0;
-		}
+	if (pBeaconReport->last_bcn_report_ind_support) {
+		pe_debug("Including Last Beacon Report in RRM Frame");
+		frm_body_frag_id = &pDot11f->report.Beacon.
+			beacon_report_frm_body_fragment_id;
+
+		frm_body_frag_id->present = 1;
+		frm_body_frag_id->beacon_report_id =
+			pBeaconReport->frame_body_frag_id.id;
+		frm_body_frag_id->fragment_id_number =
+			pBeaconReport->frame_body_frag_id.frag_id;
+		frm_body_frag_id->more_fragments =
+			pBeaconReport->frame_body_frag_id.more_frags;
+
+		pDot11f->report.Beacon.last_beacon_report_indication.present =
+			1;
+
+		pDot11f->report.Beacon.last_beacon_report_indication.
+			last_fragment = is_last_frame;
+		pe_debug("id %d frag_id %d more_frags %d is_last_frame %d",
+			 frm_body_frag_id->beacon_report_id,
+			 frm_body_frag_id->fragment_id_number,
+			 frm_body_frag_id->more_fragments,
+			 is_last_frame);
 	}
 	return eSIR_SUCCESS;
 
diff --git a/core/sap/src/sap_fsm.c b/core/sap/src/sap_fsm.c
index b77013b61aa7..17a93d3e85b7 100644
--- a/core/sap/src/sap_fsm.c
+++ b/core/sap/src/sap_fsm.c
@@ -4312,17 +4312,9 @@ static QDF_STATUS sap_fsm_state_disconnecting(ptSapContext sap_ctx,
 			  "eSAP_DISCONNECTING", "eSAP_DISCONNECTED");
 		sap_ctx->sapsMachine = eSAP_DISCONNECTED;
 
-		/* Close the SME session */
-		if (true == sap_ctx->isSapSessionOpen) {
-			sap_ctx->isSapSessionOpen = false;
-			qdf_status = sap_close_session(hal, sap_ctx,
-					sap_roam_session_close_callback, true);
-			if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
-				qdf_status = sap_signal_hdd_event(sap_ctx, NULL,
-						eSAP_STOP_BSS_EVENT,
-						(void *)eSAP_STATUS_SUCCESS);
-			}
-		}
+		qdf_status = sap_signal_hdd_event(sap_ctx, NULL,
+						  eSAP_STOP_BSS_EVENT,
+						  (void *)eSAP_STATUS_SUCCESS);
 	} else if (msg == eWNI_SME_CHANNEL_CHANGE_REQ) {
 		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_MED,
 			  FL("sapdfs: Send channel change request on sapctx[%pK]"),
diff --git a/core/sme/inc/csr_api.h b/core/sme/inc/csr_api.h
index ebf87f4b1961..9da0338cbae4 100644
--- a/core/sme/inc/csr_api.h
+++ b/core/sme/inc/csr_api.h
@@ -1038,6 +1038,7 @@ typedef struct tagCsrRoamConnectedProfile {
 	eCsrEncryptionType mcEncryptionType;
 	tCsrEncryptionList mcEncryptionInfo;
 	uint8_t operationChannel;
+	uint8_t countryCode[WNI_CFG_COUNTRY_CODE_LEN];
 	uint32_t vht_channel_width;
 	uint16_t beaconInterval;
 	tCsrKeys Keys;
diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c
index 665ba336e4dd..bbbdcda092b9 100644
--- a/core/sme/src/common/sme_api.c
+++ b/core/sme/src/common/sme_api.c
@@ -13938,7 +13938,7 @@ QDF_STATUS sme_update_dsc_pto_up_mapping(tHalHandle hHal,
 				&& (pSession->QosMapSet.dscp_range[i][1] ==
 							255)) {
 				QDF_TRACE(QDF_MODULE_ID_SME,
-					QDF_TRACE_LEVEL_ERROR,
+					QDF_TRACE_LEVEL_DEBUG,
 					FL("User Priority %d isn't used"), i);
 				break;
 			}
diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index e993a3b27375..175d4ae9b3ad 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -9430,6 +9430,11 @@ QDF_STATUS csr_roam_save_connected_infomation(tpAniSirGlobal pMac,
 							    proxy_arp_service;
 		}
 
+		if (pIesTemp->Country.present)
+			qdf_mem_copy(pConnectProfile->countryCode,
+				     pIesTemp->Country.country,
+				     WNI_CFG_COUNTRY_CODE_LEN);
+
 		if (NULL == pIes)
 			/* Free memory if it allocated locally */
 			qdf_mem_free(pIesTemp);
@@ -15815,14 +15820,10 @@ QDF_STATUS csr_send_join_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
 	}
 	neigh_roam_info = &pMac->roam.neighborRoamInfo[sessionId];
 	if ((eWNI_SME_REASSOC_REQ == messageType) ||
-		CDS_IS_CHANNEL_5GHZ(pBssDescription->channelId) ||
-		(abs(pBssDescription->rssi) <
-		 (neigh_roam_info->cfgParams.neighborLookupThreshold -
-		  neigh_roam_info->cfgParams.hi_rssi_scan_rssi_delta))) {
+	    CDS_IS_CHANNEL_5GHZ(pBssDescription->channelId)) {
 		pSession->disable_hi_rssi = true;
-		sme_debug(
-			"Disabling HI_RSSI feature, AP channel=%d, rssi=%d",
-			pBssDescription->channelId, pBssDescription->rssi);
+		sme_debug("Disabling HI_RSSI, AP channel=%d, rssi=%d",
+			  pBssDescription->channelId, pBssDescription->rssi);
 	} else {
 		pSession->disable_hi_rssi = false;
 	}
@@ -22730,8 +22731,17 @@ static QDF_STATUS csr_process_roam_sync_callback(tpAniSirGlobal mac_ctx,
 		cds_set_connection_in_progress(false);
 		session->roam_synch_in_progress = false;
 		cds_check_concurrent_intf_and_restart_sap(session->pContext);
+
+		if (CDS_IS_CHANNEL_5GHZ(bss_desc->channelId)) {
+			session->disable_hi_rssi = true;
+			sme_debug("Disabling HI_RSSI, AP channel=%d, rssi=%d",
+				  bss_desc->channelId, bss_desc->rssi);
+		} else {
+			session->disable_hi_rssi = false;
+		}
+
 		csr_roam_offload_scan(mac_ctx, session_id,
-				ROAM_SCAN_OFFLOAD_START,
+				ROAM_SCAN_OFFLOAD_UPDATE_CFG,
 				REASON_CONNECT);
 		return status;
 	default:
diff --git a/core/sme/src/qos/sme_qos.c b/core/sme/src/qos/sme_qos.c
index 3bd882426ca2..184715046dea 100644
--- a/core/sme/src/qos/sme_qos.c
+++ b/core/sme/src/qos/sme_qos.c
@@ -4515,7 +4515,7 @@ static QDF_STATUS sme_qos_process_reassoc_req_ev(tpAniSirGlobal pMac, uint8_t
 		 */
 		entry = csr_ll_peek_head(&sme_qos_cb.flow_list, false);
 		if (!entry) {
-			QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_WARN,
+			QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG,
 				FL("Flow List empty, nothing to update"));
 			return QDF_STATUS_E_FAILURE;
 		}
diff --git a/core/sme/src/rrm/sme_rrm.c b/core/sme/src/rrm/sme_rrm.c
index 7ea530e3ea92..4f6dfa4331f3 100644
--- a/core/sme/src/rrm/sme_rrm.c
+++ b/core/sme/src/rrm/sme_rrm.c
@@ -926,10 +926,40 @@ QDF_STATUS sme_rrm_process_beacon_report_req_ind(tpAniSirGlobal pMac,
 	uint32_t len = 0, i = 0;
 	uint8_t temp = 0;
 	uint32_t total_rrm_scan_time;
+	uint8_t *country;
+	uint32_t session_id;
+	tCsrRoamSession *session;
+	struct qdf_mac_addr req_bssid;
+	QDF_STATUS status;
+
+	qdf_mem_copy(&req_bssid.bytes, pBeaconReq->bssId, sizeof(tSirMacAddr));
+	status = csr_roam_get_session_id_from_bssid(pMac,
+						    &req_bssid,
+						    &session_id);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		sme_err("sme session ID not found for bssid = " MAC_ADDRESS_STR,
+			MAC_ADDR_ARRAY(pBeaconReq->bssId));
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	session = CSR_GET_SESSION(pMac, session_id);
+	if (!session) {
+		sme_err("Invalid session id %d", session_id);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	if (session->connectedProfile.countryCode[0])
+		country = session->connectedProfile.countryCode;
+	else
+		country = pMac->scan.countryCodeCurrent;
 
 	sme_debug("Received Beacon report request ind Channel = %d",
 		pBeaconReq->channelInfo.channelNum);
 
+	sme_debug("Request Reg class %d, AP's country code %c%c 0x%x",
+		  pBeaconReq->channelInfo.regulatoryClass,
+		  country[0], country[1], country[2]);
+
 	if (pBeaconReq->channelList.numChannels >
 	    SIR_ESE_MAX_MEAS_IE_REQS) {
 		sme_err("Beacon report request numChannels:%u exceeds max num channels",
@@ -952,13 +982,11 @@ QDF_STATUS sme_rrm_process_beacon_report_req_ind(tpAniSirGlobal pMac,
 		csr_get_cfg_valid_channels(pMac, pSmeRrmContext->channelList.
 					ChannelList, &len);
 		/* List all the channels in the requested RC */
-		cds_reg_dmn_get_channel_from_opclass(
-				pMac->scan.countryCodeCurrent,
+		cds_reg_dmn_print_channels_in_opclass(country,
 				pBeaconReq->channelInfo.regulatoryClass);
 
 		for (i = 0; i < len; i++) {
-			if (cds_reg_dmn_get_opclass_from_channel(
-			    pMac->scan.countryCodeCurrent,
+			if (cds_reg_dmn_get_opclass_from_channel(country,
 			    pSmeRrmContext->channelList.ChannelList[i],
 			    BWALL) ==
 			    pBeaconReq->channelInfo.regulatoryClass) {
diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c
index 592f64e11b00..3f56f0813443 100644
--- a/core/wma/src/wma_dev_if.c
+++ b/core/wma/src/wma_dev_if.c
@@ -1402,11 +1402,6 @@ QDF_STATUS wma_create_peer(tp_wma_handle wma, ol_txrx_pdev_handle pdev,
 	struct peer_create_params param = {0};
 	uint8_t *mac_addr_raw;
 
-	if (!cds_is_target_ready()) {
-		WMA_LOGE(FL("target not ready, drop the request"));
-		return QDF_STATUS_E_BUSY;
-	}
-
 	if (++wma->interfaces[vdev_id].peer_count >
 	    wma->wlan_resource_config.num_peers) {
 		WMA_LOGE("%s, the peer count exceeds the limit %d", __func__,
@@ -3169,11 +3164,6 @@ struct wma_target_req *wma_fill_hold_req(tp_wma_handle wma,
 	struct wma_target_req *req;
 	QDF_STATUS status;
 
-	if (!cds_is_target_ready()) {
-		WMA_LOGE("target not ready, drop the request");
-		return NULL;
-	}
-
 	req = qdf_mem_malloc(sizeof(*req));
 	if (!req) {
 		WMA_LOGE(FL("Failed to allocate memory for msg %d vdev %d"),
@@ -3514,11 +3504,6 @@ struct wma_target_req *wma_fill_vdev_req(tp_wma_handle wma,
 	struct wma_target_req *req;
 	QDF_STATUS status;
 
-	if (!cds_is_target_ready()) {
-		WMA_LOGE("target not ready, drop the request");
-		return NULL;
-	}
-
 	req = qdf_mem_malloc(sizeof(*req));
 	if (!req) {
 		WMA_LOGE("%s: Failed to allocate memory for msg %d vdev %d",
diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c
index 8caa6636500d..4cdbbd8596d0 100644
--- a/core/wma/src/wma_features.c
+++ b/core/wma/src/wma_features.c
@@ -3902,6 +3902,7 @@ static void wma_inc_wow_stats(struct sir_vdev_wow_stats *stats, uint8_t *data,
 
 	case WOW_REASON_BPF_ALLOW:
 	case WOW_REASON_PATTERN_MATCH_FOUND:
+	case WOW_REASON_PACKET_FILTER_MATCH:
 		if (!data || len == 0) {
 			WMA_LOGE("Null data packet for wow reason %s",
 				 wma_wow_wake_reason_str(reason));
@@ -4911,6 +4912,7 @@ int wma_wow_wakeup_host_event(void *handle, uint8_t *event,
 	case WOW_REASON_RA_MATCH:
 #endif /* FEATURE_WLAN_RA_FILTERING */
 	case WOW_REASON_RECV_MAGIC_PATTERN:
+	case WOW_REASON_PACKET_FILTER_MATCH:
 		WMA_LOGD("Wake up for Rx packet, dump starting from ethernet hdr");
 		if (!param_buf->wow_packet_buffer) {
 			WMA_LOGE("No wow packet buffer present");
diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c
index c5eeb84165e7..5b20a609c21e 100644
--- a/core/wma/src/wma_main.c
+++ b/core/wma/src/wma_main.c
@@ -3242,7 +3242,7 @@ static int wma_pdev_set_hw_mode_resp_evt_handler(void *handle,
 	hw_mode_resp->cfgd_hw_mode_index = wmi_event->cfgd_hw_mode_index;
 	hw_mode_resp->num_vdev_mac_entries = wmi_event->num_vdev_mac_entries;
 
-	WMA_LOGE("%s: status:%d cfgd_hw_mode_index:%d num_vdev_mac_entries:%d",
+	WMA_LOGD("%s: status:%d cfgd_hw_mode_index:%d num_vdev_mac_entries:%d",
 			__func__, wmi_event->status,
 			wmi_event->cfgd_hw_mode_index,
 			wmi_event->num_vdev_mac_entries);
@@ -3267,7 +3267,7 @@ static int wma_pdev_set_hw_mode_resp_evt_handler(void *handle,
 		}
 		mac_id = WMA_PDEV_TO_MAC_MAP(vdev_mac_entry[i].pdev_id);
 
-		WMA_LOGE("%s: vdev_id:%d mac_id:%d",
+		WMA_LOGD("%s: vdev_id:%d mac_id:%d",
 			__func__, vdev_id, mac_id);
 
 		hw_mode_resp->vdev_mac_map[i].vdev_id = vdev_id;
@@ -3285,7 +3285,7 @@ static int wma_pdev_set_hw_mode_resp_evt_handler(void *handle,
 		}
 	}
 
-	WMA_LOGE("%s: Updated: old_hw_mode_index:%d new_hw_mode_index:%d",
+	WMA_LOGD("%s: Updated: old_hw_mode_index:%d new_hw_mode_index:%d",
 		__func__, wma->old_hw_mode_index, wma->new_hw_mode_index);
 
 	wma_send_msg(wma, SIR_HAL_PDEV_SET_HW_MODE_RESP,
@@ -3335,7 +3335,7 @@ void wma_process_pdev_hw_mode_trans_ind(void *handle,
 	hw_mode_trans_ind->new_hw_mode_index = fixed_param->new_hw_mode_index;
 	hw_mode_trans_ind->num_vdev_mac_entries =
 					fixed_param->num_vdev_mac_entries;
-	WMA_LOGE("%s: old_hw_mode_index:%d new_hw_mode_index:%d entries=%d",
+	WMA_LOGD("%s: old_hw_mode_index:%d new_hw_mode_index:%d entries=%d",
 		__func__, fixed_param->old_hw_mode_index,
 		fixed_param->new_hw_mode_index,
 		fixed_param->num_vdev_mac_entries);
@@ -3371,7 +3371,7 @@ void wma_process_pdev_hw_mode_trans_ind(void *handle,
 	wma->old_hw_mode_index = fixed_param->old_hw_mode_index;
 	wma->new_hw_mode_index = fixed_param->new_hw_mode_index;
 
-	WMA_LOGE("%s: Updated: old_hw_mode_index:%d new_hw_mode_index:%d",
+	WMA_LOGD("%s: Updated: old_hw_mode_index:%d new_hw_mode_index:%d",
 		__func__, wma->old_hw_mode_index, wma->new_hw_mode_index);
 }
 
@@ -5958,6 +5958,10 @@ static void wma_populate_soc_caps(t_wma_handle *wma_handle,
 		WMA_LOGE("%s: Invalid number of hw modes", __func__);
 		return;
 	}
+	if (NULL == param_buf->hal_reg_caps) {
+		WMA_LOGE("%s: Invalid hal_reg_caps", __func__);
+		return;
+	}
 
 	if ((param_buf->soc_hw_mode_caps->num_hw_modes > MAX_NUM_HW_MODE) ||
 	    (param_buf->soc_hw_mode_caps->num_hw_modes >
diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c
index b4088b899096..e9e6c0b24896 100644
--- a/core/wma/src/wma_scan_roam.c
+++ b/core/wma/src/wma_scan_roam.c
@@ -3087,7 +3087,7 @@ int wma_roam_synch_event_handler(void *handle, uint8_t *event,
 		roam_synch_data_len += sizeof(roam_offload_synch_ind);
 	}
 
-	WMA_LOGI("synch payload: LEN bcn:%d, req:%d, rsp:%d",
+	WMA_LOGD("synch payload: LEN bcn:%d, req:%d, rsp:%d",
 			bcn_probe_rsp_len,
 			reassoc_req_len,
 			reassoc_rsp_len);
diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c
index 0289b78eb9ae..1aeb9dae5ea5 100644
--- a/core/wma/src/wma_utils.c
+++ b/core/wma/src/wma_utils.c
@@ -1544,6 +1544,14 @@ static int wma_unified_radio_tx_power_level_stats_event_handler(void *handle,
 							 fixed_param->radio_id;
 	tx_power_level_values = (uint8_t *) param_tlvs->tx_time_per_power_level;
 
+	if (fixed_param->total_num_tx_power_levels >
+		rs_results->total_num_tx_power_levels) {
+		WMA_LOGE("%s: excess tx_power buffers:%d, total_num_tx_power_levels:%d",
+			 __func__, fixed_param->total_num_tx_power_levels,
+			 rs_results->total_num_tx_power_levels);
+		return -EINVAL;
+	}
+
 	rs_results->total_num_tx_power_levels =
 				fixed_param->total_num_tx_power_levels;
 	if (!rs_results->total_num_tx_power_levels) {