Promotion of wlan-cld2.driver.lnx.1.0-00040.

CRs      Change ID                                   Subject
--------------------------------------------------------------------------------------------------------------
978677   Ie1b4b205618d6744a15cd27e2b8f1391f76564c9   qcacld-2.0: Fix RSSI issue during 11R roaming
1028095   Id574e1309db8d8b01b4765e27b3638bb92c3d5a0   qcacld-2.0: Prevent use after free for packet trace buff
1030729   I3e52ec63d8d0f027f0fec953f8728db71c91c235   qcacld-2.0: Fix driver load failure for x86 SDIO platfor
1026420   Ibe24828690ace91338ade10fd00c49fc4acdbd81   qcacld-2.0: Consider ACS override params only if ACS is
688141   Iab8e95eeb2464bf7189d240f8f8834c0bf235a42   Release 4.0.11.108
1027530   I29022ec26d72a5361f152dc20af13783d0dac984   qcacld-2.0: Check HT20 rate set for mcs index if HT40 ra
1007217   I6c582bc0635ecae2c37b98d761f72f222c408d2f   qcacld-2.0: Add new country XA
688141   I867b6007e3ed6d0fc70b0242be668d922e148ab8   Release 4.0.11.109
1033917   Icc606743da144958bc936f5ee22393dc135731bf   qcacld-2.0: Initialize Ramdump Global Pointer before sel
1033277   I8e3d171ac47d8be149df98ae3e30c8df391a15b0   qcacld-2.0: Fix SAP restart failure
1033224   Ida2e20fe08af3c6ed426822a71db1fd6854a0bea   qcacld-2.0: Delete PMF Sta from previous vdev
1023038   I79ad9767b7945af0c567b6294ac07e7697898e9e   qcacld-2.0: Clean up the WLAN_FEATURE_MBSSID flag (phase
1023616   I926288972e17a9276af2744d6a070b82333d5242   qcacld-2.0: Update the MAX Tx Power cap to 30dbm
1033328   I28e86b93a5114f3b76733effe4428a92cf94b441   qcacld-2.0: Fix Beamforming during roaming
1029540   Idc8e1d77d9623daeb98d0c4b7ad8a8d6cfa9c2d2   qcacld-2.0: Fix buffer over read in iwpriv WE_UNIT_TEST_
1031447   I8700621fbef9c9b4867ac698f7f721d4ffb7d967   qcacld-2.0: Initialize vdev_nss in psession when roaming

Change-Id: I36c6ccce21d96346cc2ac85434d1ab33428005cb
CRs-Fixed: 1030729, 1026420, 1027530, 1033917, 1023038, 1023616, 1029540, 1031447, 688141, 978677, 1033277, 1007217, 1028095, 1033224, 1033328

31 files changed, 197 insertions, 356 deletions

diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index d71149c89541..92af328f73ef 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -4003,8 +4003,8 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
                 if((pHddCtx) &&
                    (VOS_TRUE == pHddStaCtx->hdd_ReassocScenario) &&
                    (TRUE == pHddCtx->hdd_wlan_suspended) &&
-                   (eCSR_ROAM_RESULT_NONE == roamResult))
-                {
+                   ((eCSR_ROAM_RESULT_NONE == roamResult)||
+                     (pRoamInfo && pRoamInfo->is11rAssoc))) {
                     /* Send DTIM period to the FW; only if the wlan is already
                        in suspend. This is the case with roaming (reassoc),
                        DELETE_BSS_REQ zeroes out Modulated/Dynamic DTIM sent in
@@ -4029,7 +4029,8 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
                 if ((pHddCtx) &&
                     (FULL_POWER == pmcGetPmcState(pHddCtx->hHal)) &&
                     (VOS_TRUE == pHddStaCtx->hdd_ReassocScenario) &&
-                    (eCSR_ROAM_RESULT_NONE == roamResult)) {
+                    ((eCSR_ROAM_RESULT_NONE == roamResult) ||
+                      (pRoamInfo && pRoamInfo->is11rAssoc))) {
                      hddLog(LOG1,
                            FL("Device in full power, Stop and start traffic timer for roaming"));
                      pmcStopTrafficTimer(pHddCtx->hHal);
@@ -4039,7 +4040,8 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
                          hddLog(LOGP, FL("Cannot start traffic timer"));
                 }
                 halStatus = hdd_RoamSetKeyCompleteHandler( pAdapter, pRoamInfo, roamId, roamStatus, roamResult );
-                if (eCSR_ROAM_RESULT_NONE == roamResult) {
+                if ((eCSR_ROAM_RESULT_NONE == roamResult) ||
+                     (pRoamInfo && pRoamInfo->is11rAssoc)) {
                     pHddStaCtx->hdd_ReassocScenario = VOS_FALSE;
                     hddLog(LOG1,
                            FL("hdd_ReassocScenario set to: %d, set key complete, session: %d"),
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 0e7794f94521..b15735a861bb 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -13520,10 +13520,25 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 
     pConfig->dtim_period = pBeacon->dtim_period;
 
-    if (pHddCtx->acs_policy.acs_channel)
-        pConfig->channel = pHddCtx->acs_policy.acs_channel;
-    mode = pHddCtx->acs_policy.acs_dfs_mode;
-    pConfig->acs_dfs_mode = wlan_hdd_get_dfs_mode(mode);
+    hddLog(VOS_TRACE_LEVEL_INFO_HIGH, FL("acs_mode %d"),
+            pConfig->acs_cfg.acs_mode);
+
+    if (pConfig->acs_cfg.acs_mode == true) {
+        hddLog(VOS_TRACE_LEVEL_INFO_HIGH,
+                FL("acs_channel %d, acs_dfs_mode %d"),
+                pHddCtx->acs_policy.acs_channel,
+                pHddCtx->acs_policy.acs_dfs_mode);
+
+        if (pHddCtx->acs_policy.acs_channel)
+            pConfig->channel = pHddCtx->acs_policy.acs_channel;
+
+        mode = pHddCtx->acs_policy.acs_dfs_mode;
+        pConfig->acs_dfs_mode = wlan_hdd_get_dfs_mode(mode);
+    }
+
+    hddLog(VOS_TRACE_LEVEL_INFO_HIGH,
+            FL("pConfig->channel %d, pConfig->acs_dfs_mode %d"),
+            pConfig->channel, pConfig->acs_dfs_mode);
 
     hddLog(VOS_TRACE_LEVEL_INFO_HIGH,"****pConfig->dtim_period=%d***",
                                       pConfig->dtim_period);
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index 62cb37d28e84..2a806fe8c5ac 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -1569,11 +1569,8 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
             hdd_wlan_green_ap_stop_bss(pHddCtx);
 
             //Free up Channel List incase if it is set
-#ifdef WLAN_FEATURE_MBSSID
+
             sapCleanupChannelList(WLAN_HDD_GET_SAP_CTX_PTR(pHostapdAdapter));
-#else
-            sapCleanupChannelList();
-#endif
 
             pHddApCtx->operatingChannel = 0; //Invalidate the channel info.
 #ifdef IPA_OFFLOAD
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 3650b56c2a2a..77c3338c9ab7 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -867,7 +867,7 @@ static void hdd_smps_force_mode_cb(void *context,
 
 #if defined (FEATURE_WLAN_MCC_TO_SCC_SWITCH) || defined (FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) || defined (FEATURE_WLAN_CH_AVOID)
 /**
- * wlan_hdd_restart_sap() - This function is used to restart SAP in driver internally
+ * wlan_hdd_restart_sap() - to restart SAP in driver internally
  * @ap_adapter: - Pointer to SAP hdd_adapter_t structure
  *
  * wlan_hdd_restart_sap first delete SAP and do cleanup.
@@ -886,9 +886,11 @@ void wlan_hdd_restart_sap(hdd_adapter_t *ap_adapter)
     struct station_del_parameters delStaParams;
 #endif
     tsap_Config_t *pConfig;
+    void *p_sap_ctx;
 
     pHddApCtx = WLAN_HDD_GET_AP_CTX_PTR(ap_adapter);
-    pConfig = &ap_adapter->sessionCtx.ap.sapConfig;
+    pConfig = &pHddApCtx->sapConfig;
+    p_sap_ctx = pHddApCtx->sapContext;
 
     mutex_lock(&pHddCtx->sap_lock);
     if (test_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags)) {
@@ -907,13 +909,7 @@ void wlan_hdd_restart_sap(hdd_adapter_t *ap_adapter)
         pHostapdState = WLAN_HDD_GET_HOSTAP_STATE_PTR(ap_adapter);
         vos_event_reset(&pHostapdState->stop_bss_event);
 
-        if ( VOS_STATUS_SUCCESS == WLANSAP_StopBss(
-#ifdef WLAN_FEATURE_MBSSID
-            pHddApCtx->sapContext
-#else
-            (WLAN_HDD_GET_CTX(ap_adapter))->pvosContext
-#endif
-        )) {
+        if (VOS_STATUS_SUCCESS == WLANSAP_StopBss(p_sap_ctx)) {
             vos_status = vos_wait_single_event(&pHostapdState->stop_bss_event,
                                                10000);
             if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
@@ -933,13 +929,7 @@ void wlan_hdd_restart_sap(hdd_adapter_t *ap_adapter)
             goto end;
         }
 
-        if (WLANSAP_StartBss(
-#ifdef WLAN_FEATURE_MBSSID
-            pHddApCtx->sapContext,
-#else
-            pHddCtx->pvosContext,
-#endif
-            hdd_hostapd_SAPEventCB, &pHddApCtx->sapConfig,
+        if (WLANSAP_StartBss(p_sap_ctx, hdd_hostapd_SAPEventCB, pConfig,
             (v_PVOID_t)ap_adapter->dev) != VOS_STATUS_SUCCESS) {
             hddLog(LOGE, FL("SAP Start Bss fail"));
             goto end;
@@ -15898,13 +15888,7 @@ static void hdd_driver_exit(void)
    }
 
    vos_wait_for_work_thread_completion(__func__);
-#ifdef QCA_PKT_PROTO_TRACE
-      if (VOS_FTM_MODE != hdd_get_conparam())
-          vos_pkt_proto_trace_close();
-#endif /* QCA_PKT_PROTO_TRACE */
-
    hif_unregister_driver();
-
    vos_preClose( &pVosContext );
 
 #ifdef TIMER_MANAGER
@@ -15918,6 +15902,11 @@ static void hdd_driver_exit(void)
    wlan_logging_sock_deinit_svc();
 #endif
 
+#ifdef QCA_PKT_PROTO_TRACE
+      if (VOS_FTM_MODE != hdd_get_conparam())
+          vos_pkt_proto_trace_close();
+#endif /* QCA_PKT_PROTO_TRACE */
+
 done:
    hdd_wlan_wakelock_destroy();
    pr_info("%s: driver unloaded\n", WLAN_MODULE_NAME);
@@ -17436,13 +17425,8 @@ void wlan_hdd_check_sta_ap_concurrent_ch_intf(void *data)
     if (hHal == NULL)
         return;
 
-#ifdef WLAN_FEATURE_MBSSID
     intf_ch = WLANSAP_CheckCCIntf(pHddApCtx->sapContext);
     vht_channel_width = wlan_sap_get_vht_ch_width(pHddApCtx->sapContext);
-#else
-    intf_ch = WLANSAP_CheckCCIntf(pHddCtx->pvosContext);
-    vht_channel_width = wlan_sap_get_vht_ch_width(pHddApCtx->pvosContext);
-#endif
     if (intf_ch == 0)
         return;
 
@@ -17452,11 +17436,7 @@ void wlan_hdd_check_sta_ap_concurrent_ch_intf(void *data)
                      pHddApCtx->sapConfig.channel,
                      pHddApCtx->sapConfig.sec_ch,
                      &vht_channel_width, pHddApCtx->sapConfig.ch_width_orig);
-#ifdef WLAN_FEATURE_MBSSID
     wlan_sap_set_vht_ch_width(pHddApCtx->sapContext, vht_channel_width);
-#else
-    wlan_sap_set_vht_ch_width(pHddApCtx->pvosContext, vht_channel_width);
-#endif
     wlan_hdd_restart_sap(ap_adapter);
 }
 #endif
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index fd738dac6bce..33d4dfdead53 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -9072,7 +9072,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
                 }
                 if ((apps_args[1] > (WMA_MAX_NUM_ARGS)) ||
                     (apps_args[1] < 0)) {
-                    hddLog(LOGE, FL("Too Many args %d"), apps_args[1]);
+                    hddLog(LOGE, FL("Too Many/Few args %d"), apps_args[1]);
                     return -EINVAL;
                 }
                 unitTestArgs = vos_mem_malloc(sizeof(*unitTestArgs));
@@ -9084,8 +9084,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
                 unitTestArgs->vdev_id            = (int)pAdapter->sessionId;
                 unitTestArgs->module_id          = apps_args[0];
                 unitTestArgs->num_args           = apps_args[1];
-                for (i = 0, j = 2; i < unitTestArgs->num_args - 1;
-                     i++, j++) {
+                for (i = 0, j = 2; i < unitTestArgs->num_args; i++, j++) {
                     unitTestArgs->args[i] = apps_args[j];
                 }
                 msg.type = SIR_HAL_UNIT_TEST_CMD;
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index dd54648443e4..a3ea6db5fbdd 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            11
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            107
+#define QWLAN_VERSION_BUILD            109
 
-#define QWLAN_VERSIONSTR               "4.0.11.107"
+#define QWLAN_VERSIONSTR               "4.0.11.109"
 
 
 #define AR6320_REV1_VERSION             0x5000000
diff --git a/CORE/MAC/src/pe/lim/limFT.c b/CORE/MAC/src/pe/lim/limFT.c
index 30624a82fa1a..f6f86b0340ba 100644
--- a/CORE/MAC/src/pe/lim/limFT.c
+++ b/CORE/MAC/src/pe/lim/limFT.c
@@ -1277,6 +1277,11 @@ void limHandleFTPreAuthRsp(tpAniSirGlobal pMac, tSirRetStatus status,
       pftSessionEntry->limSmeState = eLIM_SME_WT_REASSOC_STATE;
       pftSessionEntry->smpsMode = psessionEntry->smpsMode;
 
+      if (IS_5G_CH(psessionEntry->ftPEContext.pFTPreAuthReq->preAuthchannelNum))
+          pftSessionEntry->vdev_nss = pMac->vdev_type_nss_5g.sta;
+      else
+          pftSessionEntry->vdev_nss = pMac->vdev_type_nss_2g.sta;
+
       PELOGE(limLog(pMac, LOG1, "%s:created session (%p) with id = %d",
                __func__, pftSessionEntry, pftSessionEntry->peSessionId);)
 
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 4d6fb1f821bb..cc24b8f76fae 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -156,20 +156,22 @@ limConvertSupportedChannels(tpAniSirGlobal pMac,
         pMlmAssocInd->supportedChannels.numChnl);)
 }
 
-/**---------------------------------------------------------------
-\fn     lim_check_sta_in_pe_entries
-\brief  This function is called by limProcessAssocReqFrame()
-\       to check if STA entry already exists in any of the
-\       PE entries of the AP. If it exists, deauth will be
-\       sent on that session and the STA deletion will
-\       happen. After this, the ASSOC request will be
-\       processed
-\
-\param pMac - A pointer to Global MAC structure
-\param pHdr - A pointer to the MAC header
-\return None
-------------------------------------------------------------------*/
-void lim_check_sta_in_pe_entries(tpAniSirGlobal pMac, tpSirMacMgmtHdr pHdr)
+/**
+ * lim_check_sta_in_pe_entries() - to check if sta entry already exists
+ * @pMac - A pointer to Global MAC structure
+ * @pHdr - A pointer to the MAC header
+ * @sessionid - session id for which session is initiated
+ *
+ * This function is called by limProcessAssocReqFrame()
+ * to check if STA entry already exists in any of the
+ * PE entries of the AP. If it exists, deauth will be
+ * sent on that session and the STA deletion will
+ * happen. After this, the ASSOC request will be processed
+ *
+ * Return: None
+ */
+void lim_check_sta_in_pe_entries(tpAniSirGlobal pMac, tpSirMacMgmtHdr pHdr,
+                                 uint16_t sessionid)
 {
     tANI_U8 i;
     tANI_U16 assocId = 0;
@@ -188,7 +190,8 @@ void lim_check_sta_in_pe_entries(tpAniSirGlobal pMac, tpSirMacMgmtHdr pHdr)
                             &psessionEntry->dph.dphHashTable);
             if (pStaDs
 #ifdef WLAN_FEATURE_11W
-                && !pStaDs->rmfEnabled
+                && (!pStaDs->rmfEnabled ||
+                    (sessionid != psessionEntry->peSessionId))
 #endif
                ) {
                 limLog(pMac, LOGE,
@@ -321,7 +324,7 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
         }
     }
 
-    lim_check_sta_in_pe_entries(pMac, pHdr);
+    lim_check_sta_in_pe_entries(pMac, pHdr, psessionEntry->peSessionId);
 
     // Get pointer to Re/Association Request frame body
     pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
diff --git a/CORE/MAC/src/pe/lim/limProcessAuthFrame.c b/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
index 61028eca0667..1fcaab0ceb13 100644
--- a/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
@@ -661,7 +661,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                                     eLIM_AUTH_RSP_TIMER,
                                                     pAuthNode->authNodeIdx);
                     }
-                    PELOGE(limLog(pMac, LOGE, FL("STA is initiating brand-new Authentication ..."));)
+                    limLog(pMac, LOGW, FL("STA is initiating brand-new Authentication ..."));
                     limDeletePreAuthNode(pMac,
                                          pHdr->sa);
                     /**
@@ -710,7 +710,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                      * but ACK lost at STA side, in this case 2nd auth frame is already
                      * in transmission queue
                      * */
-                    PELOGE(limLog(pMac, LOGE, FL("STA is initiating Authentication after ACK lost..."));)
+                    limLog(pMac, LOGW, FL("STA is initiating Authentication after ACK lost..."));
                     return;
                 }
             }
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index d441a8e29531..c03a833856ae 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -2477,6 +2477,45 @@ __limProcessSmeReassocReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
     psessionEntry->dot11mode = pReassocReq->dot11mode;
     psessionEntry->vhtCapability = IS_DOT11_MODE_VHT(pReassocReq->dot11mode);
 
+#ifdef WLAN_FEATURE_11AC
+        if (psessionEntry->vhtCapability) {
+            if (psessionEntry->pePersona == VOS_STA_MODE)
+                psessionEntry->txBFIniFeatureEnabled =
+                      pReassocReq->txBFIniFeatureEnabled;
+            else
+                psessionEntry->txBFIniFeatureEnabled = 0;
+
+            psessionEntry->txMuBformee = pReassocReq->txMuBformee;
+            psessionEntry->enableVhtpAid = pReassocReq->enableVhtpAid;
+            psessionEntry->enableVhtGid = pReassocReq->enableVhtGid;
+            if (psessionEntry->txBFIniFeatureEnabled) {
+                if (cfgSetInt(pMac, WNI_CFG_VHT_SU_BEAMFORMEE_CAP,
+                                 psessionEntry->txBFIniFeatureEnabled)
+                                                      != eSIR_SUCCESS) {
+                    limLog(pMac, LOGE, FL("could not set  "
+                                "WNI_CFG_VHT_SU_BEAMFORMEE_CAP at CFG"));
+                    retCode = eSIR_LOGP_EXCEPTION;
+                    goto end;
+                }
+                if (cfgSetInt(pMac, WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED,
+                                              pReassocReq->txBFCsnValue)
+                                                       != eSIR_SUCCESS) {
+                    limLog(pMac, LOGE, FL("could not set "
+                     "WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED at CFG"));
+                    retCode = eSIR_LOGP_EXCEPTION;
+                    goto end;
+                }
+            }
+        }
+        limLog(pMac, LOG1,
+               FL("vhtCapability: %d txBFIniFeatureEnabled: %d"
+                 "txBFCsnValue: %d txMuBformee: %d"),
+               psessionEntry->vhtCapability,
+               psessionEntry->txBFIniFeatureEnabled,
+               pReassocReq->txBFCsnValue,
+               psessionEntry->txMuBformee);
+#endif
+
     psessionEntry->enableHtSmps = pReassocReq->enableHtSmps;
     psessionEntry->htSmpsvalue = pReassocReq->htSmps;
     limLog(pMac, LOG1, FL("enableHtSmps: %d htSmps: %d supported nss 1x1: %d"),
diff --git a/CORE/MAC/src/pe/sch/schBeaconProcess.c b/CORE/MAC/src/pe/sch/schBeaconProcess.c
index cd18335a60a4..a28f2bebdc66 100644
--- a/CORE/MAC/src/pe/sch/schBeaconProcess.c
+++ b/CORE/MAC/src/pe/sch/schBeaconProcess.c
@@ -723,19 +723,11 @@ fail:
 
 
 /**
- * schBeaconProcess
+ * schBeaconProcess() - process the received beacon frame
+ * @pMac:        mac global context
+ * @pRxPacketInfo:  pointer to buffer descriptor
  *
- * FUNCTION:
- * Process the received beacon frame
- *
- * LOGIC:
-  *
- * ASSUMPTIONS:
- *
- * NOTE:
- *
- * @param pRxPacketInfo pointer to buffer descriptor
- * @return None
+ * Return: none
  */
 
 void schBeaconProcess(tpAniSirGlobal pMac, tANI_U8* pRxPacketInfo, tpPESession psessionEntry)
@@ -743,9 +735,7 @@ void schBeaconProcess(tpAniSirGlobal pMac, tANI_U8* pRxPacketInfo, tpPESession p
     static tSchBeaconStruct beaconStruct;
     tUpdateBeaconParams beaconParams;
     tpPESession pAPSession = NULL;
-#ifdef WLAN_FEATURE_MBSSID
     tANI_U8 i;
-#endif
 
     vos_mem_zero(&beaconParams, sizeof(tUpdateBeaconParams));
     beaconParams.paramChangeBitmap = 0;
@@ -781,7 +771,6 @@ void schBeaconProcess(tpAniSirGlobal pMac, tANI_U8* pRxPacketInfo, tpPESession p
     *
     */
 
-#ifdef WLAN_FEATURE_MBSSID
 
     for (i =0; i < pMac->lim.maxBssId; i++)
     {
@@ -817,31 +806,6 @@ void schBeaconProcess(tpAniSirGlobal pMac, tANI_U8* pRxPacketInfo, tpPESession p
         }
     }
 
-#else
-
-    if (((pAPSession = limIsApSessionActive(pMac)) != NULL)
-#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
-          && (!(WDA_GET_OFFLOADSCANLEARN(pRxPacketInfo)))
-#endif
-    )
-    {
-        beaconParams.bssIdx = pAPSession->bssIdx;
-        if (pAPSession->gLimProtectionControl != WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
-            ap_beacon_process(pMac,  pRxPacketInfo, &beaconStruct, &beaconParams, pAPSession);
-
-        if ((VOS_FALSE == pMac->sap.SapDfsInfo.is_dfs_cac_timer_running)
-            && beaconParams.paramChangeBitmap)
-        {
-            //Update the beacons and apply the new settings to HAL
-            schSetFixedBeaconFields(pMac, pAPSession);
-            PELOG1(schLog(pMac, LOG1, FL("Beacon for PE session[%d] got changed.  "), pAPSession->peSessionId);)
-            PELOG1(schLog(pMac, LOG1, FL("sending beacon param change bitmap: 0x%x "), beaconParams.paramChangeBitmap);)
-            limSendBeaconParams(pMac, &beaconParams, pAPSession);
-        }
-    }
-
-#endif
-
     /*
     * Now process the beacon in the context of the BSS which is transmitting the beacons, if one is found
     */
diff --git a/CORE/SAP/inc/sapApi.h b/CORE/SAP/inc/sapApi.h
index 52229f1e71af..eec577d5c3c0 100644
--- a/CORE/SAP/inc/sapApi.h
+++ b/CORE/SAP/inc/sapApi.h
@@ -101,11 +101,7 @@ when           who                what, where, why
 #define       MAX_TEXT_SIZE                32
 
 #define       MAX_CHANNEL_LIST_LEN         256
-#ifdef WLAN_FEATURE_MBSSID
 #define       VOS_MAX_NO_OF_SAP_MODE       2 // max # of SAP
-#else
-#define       VOS_MAX_NO_OF_SAP_MODE       1 // max # of SAP
-#endif
 #define       SAP_MAX_NUM_SESSION          5
 #define       SAP_MAX_OBSS_STA_CNT         1 // max # of OBSS STA
 
@@ -814,11 +810,7 @@ typedef struct
 } sapSafeChannelType;
 #endif //FEATURE_WLAN_CH_AVOID
 
-#ifdef WLAN_FEATURE_MBSSID
 void sapCleanupChannelList(v_PVOID_t sapContext);
-#else
-void sapCleanupChannelList(void);
-#endif
 
 void sapCleanupAllChannelList(void);
 
@@ -971,15 +963,7 @@ typedef v_PVOID_t tSapHandle, *ptSapHandle;
 
   SIDE EFFECTS
 ============================================================================*/
-#ifdef WLAN_FEATURE_MBSSID
-v_PVOID_t
-#else
-VOS_STATUS
-#endif
-WLANSAP_Open
-(
-    v_PVOID_t  pvosGCtx
-);
+v_PVOID_t WLANSAP_Open(v_PVOID_t  pvosGCtx);
 
 /*==========================================================================
   FUNCTION    WLANSAP_Start
diff --git a/CORE/SAP/src/sapChSelect.c b/CORE/SAP/src/sapChSelect.c
index 46cea6ce8d0d..03abb736edcf 100644
--- a/CORE/SAP/src/sapChSelect.c
+++ b/CORE/SAP/src/sapChSelect.c
@@ -414,8 +414,7 @@ void sapUpdateUnsafeChannelList(ptSapContext pSapCtx)
    }
 
    /* Try to find unsafe channel */
-#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) || \
-    defined(WLAN_FEATURE_MBSSID)
+#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE)
    for (i = 0; i < NUM_20MHZ_RF_CHANNELS; i++) {
         if (pSapCtx->dfs_ch_disable == VOS_TRUE) {
             if (VOS_IS_DFS_CH(safeChannels[i].channelNumber)) {
@@ -467,18 +466,8 @@ void sapUpdateUnsafeChannelList(ptSapContext pSapCtx)
     NULL
 ============================================================================*/
 
-void sapCleanupChannelList
-(
-#ifdef WLAN_FEATURE_MBSSID
-    v_PVOID_t pvosGCtx
-#else
-    void
-#endif
-)
+void sapCleanupChannelList(v_PVOID_t pvosGCtx)
 {
-#ifndef WLAN_FEATURE_MBSSID
-    v_PVOID_t pvosGCtx = vos_get_global_context(VOS_MODULE_ID_SAP, NULL);
-#endif
     ptSapContext pSapCtx;
 
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
@@ -629,7 +618,7 @@ v_BOOL_t sapChanSelInit(tHalHandle halHandle,
     pSpectInfoParams->pSpectCh = pSpectCh;
 
     pChans = pMac->scan.base20MHzChannels.channelList;
-#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) || defined(WLAN_FEATURE_MBSSID)
+#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE)
         if (pSapCtx->dfs_ch_disable == VOS_TRUE)
             include_dfs_ch = VOS_FALSE;
 #endif
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 6cd052bccd82..02927477f793 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -2157,10 +2157,9 @@ sapGotoChannelSel
         return VOS_STATUS_E_FAULT;
     }
 
-#ifdef WLAN_FEATURE_MBSSID
     if (vos_concurrent_beaconing_sessions_running()) {
         con_ch = sme_GetConcurrentOperationChannel(hHal);
-
+#ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
         if (con_ch && sapContext->channel == AUTO_CHANNEL_SELECT) {
             sapContext->dfs_ch_disable = VOS_TRUE;
         } else if (con_ch && sapContext->channel != con_ch &&
@@ -2169,8 +2168,19 @@ sapGotoChannelSel
                        "In %s, MCC DFS not supported in AP_AP Mode", __func__);
             return VOS_STATUS_E_ABORTED;
         }
+#endif
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-        if (sapContext->cc_switch_mode != VOS_MCC_TO_SCC_SWITCH_DISABLE) {
+        if (sapContext->cc_switch_mode != VOS_MCC_TO_SCC_SWITCH_DISABLE
+            && sapContext->channel) {
+            /*
+             * For ACS request ,the sapContext->channel is 0, we skip
+             * below overlap checking. When the ACS finish and SAP
+             * BSS start, the sapContext->channel will not be 0. Then
+             * the overlap checking will be reactivated.
+             * If we use sapContext->channel = 0 to perform the overlap
+             * checking, an invalid overlap channel con_ch could be
+             * created. That may cause SAP start failed.
+             */
             con_ch = sme_CheckConcurrentChannelOverlap(hHal,
                                         sapContext->channel,
                                         sapContext->csrRoamProfile.phyMode,
@@ -2184,7 +2194,6 @@ sapGotoChannelSel
         }
 #endif
     }
-#endif
 
     if (vos_get_concurrency_mode() == VOS_STA_SAP)
     {
@@ -2198,7 +2207,8 @@ sapGotoChannelSel
         }
 #endif
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-        if (sapContext->cc_switch_mode != VOS_MCC_TO_SCC_SWITCH_DISABLE) {
+        if (sapContext->cc_switch_mode != VOS_MCC_TO_SCC_SWITCH_DISABLE
+            && sapContext->channel) {
              con_ch = sme_CheckConcurrentChannelOverlap(hHal,
                                         sapContext->channel,
                                         sapContext->csrRoamProfile.phyMode,
@@ -3588,7 +3598,6 @@ sapFsm
                          eCSR_DOT11_MODE_11g_ONLY))
                      sapContext->csrRoamProfile.phyMode = eCSR_DOT11_MODE_11a;
 
-#ifdef WLAN_FEATURE_MBSSID
                  /* when AP2 is started while AP1 is performing ACS, we may not
                   * have the AP1 channel yet.So here after the completion of AP2
                   * ACS check if AP1 ACS resulting channel is DFS and if yes
@@ -3601,7 +3610,6 @@ sapFsm
                      if (con_ch && VOS_IS_DFS_CH(con_ch))
                          sapContext->channel = con_ch;
                  }
-#endif
                  /* Transition from eSAP_CH_SELECT to eSAP_STARTING (both without substates) */
                  VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, from state %s => %s",
                             __func__, "eSAP_CH_SELECT", "eSAP_STARTING");
diff --git a/CORE/SAP/src/sapInternal.h b/CORE/SAP/src/sapInternal.h
index d2342d150d84..7a7d7aedbd2e 100644
--- a/CORE/SAP/src/sapInternal.h
+++ b/CORE/SAP/src/sapInternal.h
@@ -95,13 +95,7 @@ when           who        what, where, why
 #define SAP_DEBUG
 // Used to enable or disable security on the BT-AMP link
 #define WLANSAP_SECURITY_ENABLED_STATE VOS_TRUE
-#ifdef WLAN_FEATURE_MBSSID
-// When MBSSID feature is enabled, SAP context is directly passed to SAP APIs
 #define VOS_GET_SAP_CB(ctx) (ptSapContext)(ctx)
-#else
-// How do I get SAP context from voss context?
-#define VOS_GET_SAP_CB(ctx) vos_get_context( VOS_MODULE_ID_SAP, ctx)
-#endif
 
 #define VOS_GET_HAL_CB(ctx) vos_get_context( VOS_MODULE_ID_PE, ctx)
 //MAC Address length
@@ -279,8 +273,7 @@ typedef struct sSapContext {
     v_U8_t             cc_switch_mode;
 #endif
 
-#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) ||\
-    defined(WLAN_FEATURE_MBSSID)
+#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE)
     v_BOOL_t           dfs_ch_disable;
 #endif
     tANI_BOOLEAN       isCacEndNotified;
@@ -313,8 +306,6 @@ typedef struct sSapContext {
 /*----------------------------------------------------------------------------
  *  External declarations for global context
  * -------------------------------------------------------------------------*/
-//  The main per-Physical Link (per WLAN association) context.
-extern ptSapContext  gpSapCtx;
 
 /*----------------------------------------------------------------------------
  *  SAP state machine event definition
diff --git a/CORE/SAP/src/sapModule.c b/CORE/SAP/src/sapModule.c
index 602de18861de..ec75cbf419fe 100644
--- a/CORE/SAP/src/sapModule.c
+++ b/CORE/SAP/src/sapModule.c
@@ -93,9 +93,6 @@
 /*----------------------------------------------------------------------------
  *  External declarations for global context
  * -------------------------------------------------------------------------*/
-//  No!  Get this from VOS.
-//  The main per-Physical Link (per WLAN association) context.
-ptSapContext  gpSapCtx;
 
 /*----------------------------------------------------------------------------
  * Static Variable Definitions
@@ -113,76 +110,32 @@ ptSapContext  gpSapCtx;
  * Function Declarations and Documentation
  * -------------------------------------------------------------------------*/
 
-/*==========================================================================
-  FUNCTION    WLANSAP_Open
-
-  DESCRIPTION
-    Called at driver initialization (vos_open). SAP will initialize
-    all its internal resources and will wait for the call to start to
-    register with the other modules.
-
-  DEPENDENCIES
-
-  PARAMETERS
-
-    IN
-    pvosGCtx    : Pointer to the global vos context; a handle to SAP's
-
-  RETURN VALUE
-    The result code associated with performing the operation
-
-#ifdef WLAN_FEATURE_MBSSID
-    v_PVOID_t   : Pointer to the SAP context
-#else
-    VOS_STATUS_E_FAULT: Pointer to SAP cb is NULL ; access would cause a page
-                         fault
-    VOS_STATUS_SUCCESS: Success
-#endif
-
-  SIDE EFFECTS
-============================================================================*/
-#ifdef WLAN_FEATURE_MBSSID
-v_PVOID_t
-#else
-VOS_STATUS
-#endif
-WLANSAP_Open
-(
-    v_PVOID_t  pvosGCtx
-)
+/**
+ * WLANSAP_Open() - WLAN SAP open function call
+ * @pvosGCtx: Pointer to the global vos context; a handle to SAP's
+ *
+ * Called at driver initialization (vos_open). SAP will initialize
+ * all its internal resources and will wait for the call to start to
+ * register with the other modules.
+ *
+ * Return: Pointer to the SAP context
+ */
+v_PVOID_t WLANSAP_Open(v_PVOID_t  pvosGCtx)
 {
     ptSapContext pSapCtx = NULL;
 
     /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
-#ifdef WLAN_FEATURE_MBSSID
-    // amically allocate the sapContext
+    /* dyamically allocate the sapContext */
     pSapCtx = (ptSapContext)vos_mem_malloc(sizeof(tSapContext));
-#else
-    if (NULL == pvosGCtx)
-    {
-       VOS_ASSERT(pvosGCtx);
-       return VOS_STATUS_E_FAULT;
-    }
-    /*------------------------------------------------------------------------
-         Allocate (and sanity check?!) SAP control block
-       ------------------------------------------------------------------------*/
-    vos_alloc_context(pvosGCtx, VOS_MODULE_ID_SAP, (v_VOID_t **)&pSapCtx, sizeof(tSapContext));
-#endif
 
     if (NULL == pSapCtx)
     {
         VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
                    "%s: Invalid SAP pointer from pvosGCtx", __func__);
-#ifdef WLAN_FEATURE_MBSSID
         return NULL;
-#else
-        return VOS_STATUS_E_FAULT;
-#endif
     }
 
-    /*------------------------------------------------------------------------
-        Clean up SAP control block, initialize all values
-       ------------------------------------------------------------------------*/
+    /* Clean up SAP control block, initialize all values */
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "WLANSAP_Open");
 
     WLANSAP_CleanCB(pSapCtx, 0 /*do not empty*/);
@@ -190,18 +143,7 @@ WLANSAP_Open
     // Setup the "link back" to the VOSS context
     pSapCtx->pvosGCtx = pvosGCtx;
 
-    // Store a pointer to the SAP context provided by VOSS
-    gpSapCtx = pSapCtx;
-
-    /*------------------------------------------------------------------------
-        Allocate internal resources
-       ------------------------------------------------------------------------*/
-
-#ifdef WLAN_FEATURE_MBSSID
     return pSapCtx;
-#else
-    return VOS_STATUS_SUCCESS;
-#endif
 }// WLANSAP_Open
 
 /*==========================================================================
@@ -325,10 +267,7 @@ WLANSAP_Stop
 {
     ptSapContext pSapCtx = NULL;
 
-    /*------------------------------------------------------------------------
-        Sanity check
-        Extract SAP control block
-    ------------------------------------------------------------------------*/
+    /* Sanity check - Extract SAP control block */
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                 "WLANSAP_Stop invoked successfully ");
 
@@ -348,9 +287,6 @@ WLANSAP_Stop
                  "WLANSAP_Stop failed destroy lock");
         return VOS_STATUS_E_FAULT;
     }
-    /*------------------------------------------------------------------------
-        Stop SAP (de-register RSN handler!?)
-    ------------------------------------------------------------------------*/
 
     return VOS_STATUS_SUCCESS;
 }/* WLANSAP_Stop */
@@ -389,12 +325,7 @@ WLANSAP_Close
 {
     ptSapContext pSapCtx = NULL;
 
-    /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
-
-    /*------------------------------------------------------------------------
-        Sanity check
-        Extract SAP control block
-    ------------------------------------------------------------------------*/
+    /* Sanity check - Extract SAP control block */
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                  "WLANSAP_Close invoked");
 
@@ -407,26 +338,13 @@ WLANSAP_Close
         return VOS_STATUS_E_FAULT;
     }
 
-    /*------------------------------------------------------------------------
-        Cleanup SAP control block.
-    ------------------------------------------------------------------------*/
+    /* Cleanup SAP control block. */
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "WLANSAP_Close");
-#ifdef WLAN_FEATURE_MBSSID
     sapCleanupChannelList(pCtx);
-#else
-    sapCleanupChannelList();
-#endif
 
     WLANSAP_CleanCB(pSapCtx, VOS_TRUE /* empty queues/lists/pkts if any*/);
 
-#ifdef WLAN_FEATURE_MBSSID
     vos_mem_free(pSapCtx);
-#else
-    /*------------------------------------------------------------------------
-        Free SAP context from VOSS global
-    ------------------------------------------------------------------------*/
-    vos_free_context(pCtx, VOS_MODULE_ID_SAP, pSapCtx);
-#endif
 
     return VOS_STATUS_SUCCESS;
 }/* WLANSAP_Close */
diff --git a/CORE/SERVICES/BMI/ol_fw.c b/CORE/SERVICES/BMI/ol_fw.c
index 7b194bab0e73..378ffa3d17c0 100644
--- a/CORE/SERVICES/BMI/ol_fw.c
+++ b/CORE/SERVICES/BMI/ol_fw.c
@@ -1150,23 +1150,34 @@ void ol_schedule_ramdump_work(struct ol_softc *scn)
 	schedule_work(&ramdump_work);
 }
 
+#ifndef HIF_USB
 static void fw_indication_work_handler(struct work_struct *fw_indication)
 {
-#ifndef HIF_USB
 	struct device *dev = NULL;
 
 	if (ramdump_scn && ramdump_scn->adf_dev
 			&& ramdump_scn->adf_dev->dev)
 		dev = ramdump_scn->adf_dev->dev;
 
+	if (!dev) {
+		pr_err("%s Device is Invalid\n", __func__);
+		return;
+	}
+
 	vos_device_self_recovery(dev);
-#endif
 }
+#else
+static void fw_indication_work_handler(struct work_struct *fw_indication)
+{
+}
+#endif
+
 
 static DECLARE_WORK(fw_indication_work, fw_indication_work_handler);
 
 void ol_schedule_fw_indication_work(struct ol_softc *scn)
 {
+	ramdump_scn = scn;
 	schedule_work(&fw_indication_work);
 }
 #endif
diff --git a/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c b/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c
index 07f5de1bf91e..b3c8ed7ea4fb 100644
--- a/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c
+++ b/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c
@@ -2757,6 +2757,9 @@ static int hif_sdio_device_resume(struct device *dev)
 	return hifDeviceResume(dev);
 }
 
+#endif
+#endif
+
 /**
  * hif_reset_target() - Reset target device
  * @hif_device: pointer to hif_device structure
@@ -2796,6 +2799,4 @@ int hif_reset_target(HIF_DEVICE *hif_device)
 
 done:
 	return ret;
-}
-#endif
-#endif
+}
\ No newline at end of file
diff --git a/CORE/SERVICES/WMA/regdomain.h b/CORE/SERVICES/WMA/regdomain.h
index 516a3afe2b46..6eff5a08715c 100644
--- a/CORE/SERVICES/WMA/regdomain.h
+++ b/CORE/SERVICES/WMA/regdomain.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -884,6 +884,9 @@ typedef struct ath_hal_reg_dmn_tables {
  *        - country definition: CTRY_ZIMBABWE
  *            - country string: ZW
  *            - country ID: 716
+ *        - country definition: CTRY_XA
+ *            - country string: XA
+ *            - country ID: 4100
  */
 enum CountryCode {
     CTRY_ALBANIA              = 8,       /* Albania */
@@ -1083,6 +1086,7 @@ enum CountryCode {
     CTRY_JAPAN57              = 4057,    /* Japan (J57) */
     CTRY_JAPAN58              = 4058,    /* Japan (J58) */
     CTRY_JAPAN59              = 4059,    /* Japan (J59) */
+    CTRY_XA                   = 4100,    /* Japan KDDI */
 
     /*
     ** "Special" codes for multiply defined countries, with the exception
diff --git a/CORE/SERVICES/WMA/regdomain_common.h b/CORE/SERVICES/WMA/regdomain_common.h
index baeb8f2de0f1..f660315d22dc 100644
--- a/CORE/SERVICES/WMA/regdomain_common.h
+++ b/CORE/SERVICES/WMA/regdomain_common.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -463,6 +463,7 @@ static const REG_DMN_PAIR_MAPPING ahCmnRegDomainPairs[] = {
 
 	{MKK14_MKKA1,   MKK14,      MKKA,       DISALLOW_ADHOC_11A_TURB | NEED_NFC | LIMIT_FRAME_4MS, NEED_NFC, PSCAN_MKK1 | PSCAN_MKKA1 | PSCAN_MKKA1_G, CTRY_JAPAN58 },
 	{MKK15_MKKA1,   MKK15,      MKKA,       DISALLOW_ADHOC_11A_TURB | NEED_NFC | LIMIT_FRAME_4MS, NEED_NFC, PSCAN_MKK1 | PSCAN_MKK3 | PSCAN_MKKA1 | PSCAN_MKKA1_G, CTRY_JAPAN59 },
+	{MKK5_MKKA2,    MKK5,       MKKA,       DISALLOW_ADHOC_11A_TURB | NEED_NFC | LIMIT_FRAME_4MS, NEED_NFC, PSCAN_MKK3 | PSCAN_MKKA2 | PSCAN_MKKA2_G, CTRY_XA },
 
 		/* These are super domains */
 	{WOR0_WORLD,	WOR0_WORLD,	WOR0_WORLD,	NO_REQ, NO_REQ, PSCAN_DEFER, 0 },
@@ -602,6 +603,7 @@ static const COUNTRY_CODE_TO_ENUM_RD ahCmnAllCountries[] = {
     {CTRY_JAPAN57,     MKK13_MKKB,    "JP", "JAPAN57",        YES,  NO,  NO, YES, YES, YES, YES, NO, 7000 },
     {CTRY_JAPAN58,     MKK14_MKKA1,   "JP", "JAPAN58",        YES,  NO,  NO, YES, YES, YES, YES, NO, 7000 },
     {CTRY_JAPAN59,     MKK15_MKKA1,   "JP", "JAPAN59",        YES,  NO,  NO, YES, YES, YES, YES, NO, 7000 },
+    {CTRY_XA,          MKK5_MKKA2,    "XA", "JAPAN PASSIVE",  YES,  NO,  NO, YES, YES, YES,  NO, NO, 7000 },
     {CTRY_JORDAN,      ETSI2_WORLD,   "JO", "JORDAN",         YES,  NO, YES, YES, YES, YES, YES, YES, 7000 },
     {CTRY_KAZAKHSTAN,  NULL1_WORLD,   "KZ", "KAZAKHSTAN",     YES,  NO, YES, YES, YES,  NO,  NO, NO, 7000 },
     {CTRY_KENYA,       APL1_WORLD,    "KE", "KENYA",          YES,  NO, YES, YES, YES, YES, YES, YES, 7000 },
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 3930ec242e8a..1886c09950a7 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -695,7 +695,8 @@ static tANI_U8 wma_get_mcs_idx(tANI_U16 maxRate, tANI_U8 rate_flags,
 				goto rate_found;
 			}
 		}
-		if (rate_flags & eHAL_TX_RATE_HT20) {
+		if ((rate_flags & eHAL_TX_RATE_HT20) ||
+			(rate_flags & eHAL_TX_RATE_HT40)) {
 			/* check for ht20 nss1/2 rate set */
 			cur_rate = mcs_rate_match(maxRate, &is_sgi, nss,
 					mcs_nss1[curIdx].ht20_rate[0],
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index 89761bf56a00..cee45d62034e 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -11101,6 +11101,8 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
                                    "command failed(%d) PeerMac "MAC_ADDRESS_STR,
                                    pRsp->statusCode, MAC_ADDR_ARRAY(pRsp->peerMacAddr));
                         }
+                        roamInfo.is11rAssoc = csrRoamIs11rAssoc(pMac,
+                                                                  sessionId);
                         csrRoamCallCallback(pMac, sessionId, &roamInfo, pCommand->u.setKeyCmd.roamId,
                                             eCSR_ROAM_SET_KEY_COMPLETE, result);
                         // Indicate SME_QOS that the SET_KEY is completed, so that SME_QOS
diff --git a/CORE/SME/src/csr/csrUtil.c b/CORE/SME/src/csr/csrUtil.c
index 8dce77e9b8c1..00fc0df624ec 100644
--- a/CORE/SME/src/csr/csrUtil.c
+++ b/CORE/SME/src/csr/csrUtil.c
@@ -2165,16 +2165,6 @@ csrIsconcurrentsessionValid(tpAniSirGlobal pMac,tANI_U32 cursessionId,
                      return eHAL_STATUS_SUCCESS;
 
              case VOS_STA_SAP_MODE:
-#ifndef WLAN_FEATURE_MBSSID
-                     if ((bss_persona == VOS_STA_SAP_MODE) &&
-                         (connect_state !=
-                          eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED)) {
-                         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                                   FL("**SoftAP mode already exists **"));
-                         return eHAL_STATUS_FAILURE;
-                     }
-                     else
-#endif
                      if (((bss_persona == VOS_P2P_GO_MODE) && (connect_state !=
                                 eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED) &&
                                 (0 == automotive_support_enable)) ||
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 30438b7470d7..7fef0610c06a 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -1445,9 +1445,6 @@ eHalStatus sme_Open(tHalHandle hHal)
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-#ifndef WLAN_FEATURE_MBSSID
-   v_PVOID_t pvosGCtx = vos_get_global_context(VOS_MODULE_ID_SAP, NULL);
-#endif
 
    do {
       pMac->sme.state = SME_STATE_STOP;
@@ -1525,21 +1522,6 @@ eHalStatus sme_Open(tHalHandle hHal)
       if(!HAL_STATUS_SUCCESS((status = initSmeCmdList(pMac))))
           break;
 
-#ifndef WLAN_FEATURE_MBSSID
-      if ( NULL == pvosGCtx ){
-         smsLog( pMac, LOGE, "WLANSAP_Open open failed during initialization");
-         status = eHAL_STATUS_FAILURE;
-         break;
-      }
-
-      status = WLANSAP_Open( pvosGCtx );
-      if ( ! HAL_STATUS_SUCCESS( status ) ) {
-          smsLog( pMac, LOGE,
-                  "WLANSAP_Open open failed during initialization with status=%d", status );
-          break;
-      }
-#endif
-
 #if defined WLAN_FEATURE_VOWIFI
       status = rrmOpen(pMac);
       if ( ! HAL_STATUS_SUCCESS( status ) ) {
@@ -2364,15 +2346,6 @@ eHalStatus sme_Start(tHalHandle hHal)
           }
       }
 
-#ifndef WLAN_FEATURE_MBSSID
-      status = WLANSAP_Start(vos_get_global_context(VOS_MODULE_ID_SAP, NULL));
-      if ( ! HAL_STATUS_SUCCESS( status ) ) {
-         smsLog( pMac, LOGE, "WLANSAP_Start failed during smeStart with status=%d",
-                 status );
-         break;
-      }
-#endif
-
       pMac->sme.state = SME_STATE_START;
    }while (0);
 
@@ -3546,15 +3519,6 @@ eHalStatus sme_Stop(tHalHandle hHal, tHalStopType stopType)
    eHalStatus fail_status = eHAL_STATUS_SUCCESS;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
-#ifndef WLAN_FEATURE_MBSSID
-   status = WLANSAP_Stop(vos_get_global_context(VOS_MODULE_ID_SAP, NULL));
-   if ( ! HAL_STATUS_SUCCESS( status ) ) {
-      smsLog( pMac, LOGE, "WLANSAP_Stop failed during smeStop with status=%d",
-                          status );
-      fail_status = status;
-   }
-#endif
-
    p2pStop(hHal);
 
    if(!pMac->psOffloadEnabled)
@@ -3634,15 +3598,6 @@ eHalStatus sme_Close(tHalHandle hHal)
       fail_status = status;
    }
 
-#ifndef WLAN_FEATURE_MBSSID
-   status = WLANSAP_Close(vos_get_global_context(VOS_MODULE_ID_SAP, NULL));
-   if ( ! HAL_STATUS_SUCCESS( status ) ) {
-      smsLog( pMac, LOGE, "WLANSAP_close failed during sme close with status=%d",
-              status );
-      fail_status = status;
-   }
-#endif
-
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
    status = btcClose(hHal);
    if ( ! HAL_STATUS_SUCCESS( status ) ) {
diff --git a/CORE/VOSS/inc/vos_getBin.h b/CORE/VOSS/inc/vos_getBin.h
index c267ac1ce619..02ac0bb656be 100644
--- a/CORE/VOSS/inc/vos_getBin.h
+++ b/CORE/VOSS/inc/vos_getBin.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -142,8 +142,5 @@ v_BOOL_t vos_max_concurrent_connections_reached(void);
 void vos_clear_concurrent_session_count(void);
 v_BOOL_t vos_is_multiple_active_sta_sessions (void);
 v_BOOL_t vos_is_sta_active_connection_exists (void);
-
-#ifdef WLAN_FEATURE_MBSSID
 v_BOOL_t vos_concurrent_beaconing_sessions_running(v_VOID_t);
-#endif
 #endif // !defined __VOS_GETBIN_H
diff --git a/CORE/VOSS/src/vos_api.c b/CORE/VOSS/src/vos_api.c
index 0ce823314587..b80c021b9499 100644
--- a/CORE/VOSS/src/vos_api.c
+++ b/CORE/VOSS/src/vos_api.c
@@ -1308,15 +1308,6 @@ v_VOID_t* vos_get_context( VOS_MODULE_ID moduleId,
       break;
     }
 
-
-#ifndef WLAN_FEATURE_MBSSID
-    case VOS_MODULE_ID_SAP:
-    {
-      pModContext = gpVosContext->pSAPContext;
-      break;
-    }
-#endif
-
     case VOS_MODULE_ID_HDD:
     {
       pModContext = gpVosContext->pHDDContext;
@@ -1693,15 +1684,6 @@ VOS_STATUS vos_alloc_context( v_VOID_t *pVosContext, VOS_MODULE_ID moduleID,
       break;
     }
 
-
-#ifndef WLAN_FEATURE_MBSSID
-    case VOS_MODULE_ID_SAP:
-    {
-      pGpModContext = &(gpVosContext->pSAPContext);
-      break;
-    }
-#endif
-
     case VOS_MODULE_ID_WDA:
     {
       pGpModContext = &(gpVosContext->pWDAContext);
@@ -1813,15 +1795,6 @@ VOS_STATUS vos_free_context( v_VOID_t *pVosContext, VOS_MODULE_ID moduleID,
       break;
     }
 
-
-#ifndef WLAN_FEATURE_MBSSID
-    case VOS_MODULE_ID_SAP:
-    {
-      pGpModContext = &(gpVosContext->pSAPContext);
-      break;
-    }
-#endif
-
     case VOS_MODULE_ID_WDA:
     {
       pGpModContext = &(gpVosContext->pWDAContext);
diff --git a/CORE/VOSS/src/vos_getBin.c b/CORE/VOSS/src/vos_getBin.c
index 9d8425994292..bb66602726f5 100644
--- a/CORE/VOSS/src/vos_getBin.c
+++ b/CORE/VOSS/src/vos_getBin.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -154,7 +154,6 @@ v_BOOL_t vos_concurrent_open_sessions_running(void)
     return (j>1);
 }
 
-#ifdef WLAN_FEATURE_MBSSID
 v_BOOL_t vos_concurrent_beaconing_sessions_running(v_VOID_t)
 {
     v_U8_t i=0;
@@ -174,7 +173,6 @@ v_BOOL_t vos_concurrent_beaconing_sessions_running(v_VOID_t)
 
     return (i>1);
 }
-#endif
 
 
 /**---------------------------------------------------------------------------
diff --git a/CORE/VOSS/src/vos_nvitem.c b/CORE/VOSS/src/vos_nvitem.c
index 82afaeb14140..5e2524b639ab 100644
--- a/CORE/VOSS/src/vos_nvitem.c
+++ b/CORE/VOSS/src/vos_nvitem.c
@@ -428,6 +428,7 @@ static CountryInfoTable_t countryInfoTable =
       {REGDOMAIN_ETSI, {'Y', 'T'}}, //MAYOTTE
       {REGDOMAIN_ETSI, {'Z', 'A'}}, //SOUTH AFRICA
       {REGDOMAIN_ETSI, {'Z', 'W'}}, //ZIMBABWE
+      {REGDOMAIN_JAPAN, {'X', 'A'}}, //JAPAN PASSIVE
     }
 };
 
diff --git a/CORE/VOSS/src/vos_packet.c b/CORE/VOSS/src/vos_packet.c
index 9a8179cbdd01..bd18d371b1c6 100644
--- a/CORE/VOSS/src/vos_packet.c
+++ b/CORE/VOSS/src/vos_packet.c
@@ -315,6 +315,14 @@ void vos_pkt_trace_buf_update
    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
              "%s %d, %s", __func__, __LINE__, event_string);
    spin_lock_bh(&trace_buffer_lock);
+
+   if (!trace_buffer) {
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+                "trace_buffer is already free");
+      spin_unlock_bh(&trace_buffer_lock);
+      return;
+   }
+
    slot = trace_buffer_order % VOS_PKT_TRAC_MAX_TRACE_BUF;
    trace_buffer[slot].order = trace_buffer_order;
    do_gettimeofday(&tv);
@@ -342,6 +350,12 @@ void vos_pkt_trace_buf_dump
    unsigned long local_time;
 
    spin_lock_bh(&trace_buffer_lock);
+   if (!trace_buffer) {
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
+                "trace_buffer is already free");
+      spin_unlock_bh(&trace_buffer_lock);
+      return;
+   }
    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_INFO,
              "PACKET TRACE DUMP START Current Timestamp %u",
               (unsigned int)vos_timer_get_system_time());
@@ -423,7 +437,10 @@ void vos_pkt_proto_trace_close
 {
    VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
              "%s %d", __func__, __LINE__);
+   spin_lock_bh(&trace_buffer_lock);
    vos_mem_free(trace_buffer);
+   trace_buffer = NULL;
+   spin_unlock_bh(&trace_buffer_lock);
 
    return;
 }
diff --git a/CORE/VOSS/src/vos_sched.h b/CORE/VOSS/src/vos_sched.h
index 733da4f60a53..ed39240d99f5 100644
--- a/CORE/VOSS/src/vos_sched.h
+++ b/CORE/VOSS/src/vos_sched.h
@@ -347,11 +347,6 @@ typedef struct _VosContextType
    /* MAC Module Context  */
    v_VOID_t           *pMACContext;
 
-#ifndef WLAN_FEATURE_MBSSID
-   /* SAP Context */
-   v_VOID_t           *pSAPContext;
-#endif
-
    vos_event_t         ProbeEvent;
 
    volatile v_U8_t     isLogpInProgress;
diff --git a/CORE/WDA/inc/legacy/halTypes.h b/CORE/WDA/inc/legacy/halTypes.h
index c0bb0359ec92..b38f5d192488 100644
--- a/CORE/WDA/inc/legacy/halTypes.h
+++ b/CORE/WDA/inc/legacy/halTypes.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -349,7 +349,7 @@ typedef enum
  * supported by rome/prima hardware
  */
 #define MIN_TX_PWR_CAP    8
-#define MAX_TX_PWR_CAP    22
+#define MAX_TX_PWR_CAP    30
 
 /* Moving the miscellaneous defination required by UMAC are moved here from
  * volansdefs.h */