Release 1.0.0.251 QCACLD WLAN Driver

Merge remote-tracking branch 'origin/caf/caf-wlan/master' into HEAD

* origin/caf/caf-wlan/master:
  Cafstaging Release 1.0.0.251
  qca_cld: wlan rx thread set affinity build issue fix
  qcacld: Add service check of SAP Authentication offload feature
  qcacld: Fix compilation error with kernel version > (3,11,0)
  ecacld: HDD:Increase the log level of ROC related debug prints
  qcacld: Fix to find correct sap sessionid when STA/SAP/GO are active.
  qcacld: CL 1168505 - update fw common interface files
  qcacld: CL 1166352 - update fw common interface files
  qca-cld2.0: Probable fix and logging enhancements for smeCommandTimeOut

Change-Id: I92dd17d767b59792a1df06743c1d35822ced7c34

14 files changed, 233 insertions, 176 deletions

diff --git a/CORE/HDD/inc/wlan_hdd_tgt_cfg.h b/CORE/HDD/inc/wlan_hdd_tgt_cfg.h
index 0b5863eae2b3..d47a24634f05 100644
--- a/CORE/HDD/inc/wlan_hdd_tgt_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_tgt_cfg.h
@@ -52,6 +52,9 @@ struct hdd_tgt_services {
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
         v_BOOL_t en_roam_offload;
 #endif
+#ifdef SAP_AUTH_OFFLOAD
+        bool sap_auth_offload_service;
+#endif
 };
 
 struct hdd_tgt_ht_cap {
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index 1afea1c7a68f..86d75611224c 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -3156,10 +3156,18 @@ hdd_indicateUnprotMgmtFrame(hdd_adapter_t *pAdapter, tANI_U32 nFrameLength,
 
     /* Get pAdapter from Destination mac address of the frame */
     if (type == SIR_MAC_MGMT_FRAME && subType == SIR_MAC_MGMT_DISASSOC) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+        cfg80211_rx_unprot_mlme_mgmt(pAdapter->dev, pbFrames, nFrameLength);
+#else
         cfg80211_send_unprot_disassoc(pAdapter->dev, pbFrames, nFrameLength);
+#endif
         pAdapter->hdd_stats.hddPmfStats.numUnprotDisassocRx++;
     } else if (type == SIR_MAC_MGMT_FRAME && subType == SIR_MAC_MGMT_DEAUTH) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+        cfg80211_rx_unprot_mlme_mgmt(pAdapter->dev, pbFrames, nFrameLength);
+#else
         cfg80211_send_unprot_deauth(pAdapter->dev, pbFrames, nFrameLength);
+#endif
         pAdapter->hdd_stats.hddPmfStats.numUnprotDeauthRx++;
     } else {
         hddLog(LOGE, FL("Frame type %d and subtype %d are not valid"), type, subType);
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 14ea3adf2724..b3ce9f26aa47 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -7062,6 +7062,10 @@ static void hdd_update_tgt_services(hdd_context_t *hdd_ctx,
     cfg_ini->isRoamOffloadEnabled &= cfg->en_roam_offload;
 #endif
 
+#ifdef SAP_AUTH_OFFLOAD
+    cfg_ini->enable_sap_auth_offload &= cfg->sap_auth_offload_service;
+#endif
+
 }
 
 static void hdd_update_tgt_ht_cap(hdd_context_t *hdd_ctx,
@@ -11512,11 +11516,13 @@ void hdd_cnss_request_bus_bandwidth(hdd_context_t *pHddCtx,
                __func__, next_vote_level, tx_packets, rx_packets);
         pHddCtx->cur_vote_level = next_vote_level;
         cnss_request_bus_bandwidth(next_vote_level);
+#ifdef QCA_CONFIG_SMP
         if (next_vote_level == CNSS_BUS_WIDTH_LOW) {
             vos_sched_handle_throughput_req(VOS_FALSE);
         } else {
             vos_sched_handle_throughput_req(VOS_TRUE);
         }
+#endif /* QCA_CONFIG_SMP */
     }
 
     pHddCtx->prev_rx = rx_packets;
diff --git a/CORE/HDD/src/wlan_hdd_p2p.c b/CORE/HDD/src/wlan_hdd_p2p.c
index d01303366506..94f760df3f2e 100644
--- a/CORE/HDD/src/wlan_hdd_p2p.c
+++ b/CORE/HDD/src/wlan_hdd_p2p.c
@@ -268,20 +268,20 @@ void wlan_hdd_cancel_existing_remain_on_channel(hdd_adapter_t *pAdapter)
     mutex_lock(&cfgState->remain_on_chan_ctx_lock);
     if(cfgState->remain_on_chan_ctx != NULL)
     {
-        hddLog( LOG1, "Cancel Existing Remain on Channel");
+        hddLog(LOGE, "Cancel Existing Remain on Channel");
 
         vos_timer_stop(&cfgState->remain_on_chan_ctx->hdd_remain_on_chan_timer);
         pRemainChanCtx = cfgState->remain_on_chan_ctx;
         if (pRemainChanCtx->hdd_remain_on_chan_cancel_in_progress == TRUE)
         {
             mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
-            hddLog( LOG1,
+            hddLog(LOGE,
                     "ROC timer cancellation in progress,"
                     " wait for completion");
             rc = wait_for_completion_timeout(&pAdapter->cancel_rem_on_chan_var,
                                msecs_to_jiffies(WAIT_CANCEL_REM_CHAN));
             if (!rc) {
-                hddLog( LOGE,
+                hddLog(LOGE,
                         "%s:wait on cancel_rem_on_chan_var timed out",
                          __func__);
             }
@@ -914,6 +914,7 @@ void hdd_remainChanReadyHandler( hdd_adapter_t *pAdapter )
         // Check for cached action frame
         if(pRemainChanCtx->action_pkt_buff.frame_length != 0)
         {
+          hddLog(LOGE, "%s: Sent cached action frame to supplicant", __func__);
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,12,0))
           cfg80211_rx_mgmt(pAdapter->dev->ieee80211_ptr,
                       pRemainChanCtx->action_pkt_buff.freq, 0,
@@ -937,7 +938,6 @@ void hdd_remainChanReadyHandler( hdd_adapter_t *pAdapter )
                       GFP_ATOMIC );
 #endif /* LINUX_VERSION_CODE */
 
-          hddLog( LOGE,"%s: Sent cached action frame to supplicant", __func__);
           vos_mem_free(pRemainChanCtx->action_pkt_buff.frame_ptr);
           pRemainChanCtx->action_pkt_buff.frame_length = 0;
           pRemainChanCtx->action_pkt_buff.freq = 0;
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 72dda0d0b25f..16e42ceaa41a 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            250
+#define QWLAN_VERSION_BUILD            251
 
-#define QWLAN_VERSIONSTR               "1.0.0.250"
+#define QWLAN_VERSIONSTR               "1.0.0.251"
 
 
 #define AR6320_REV1_VERSION             0x5000000
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index 3dd565194815..61aa2ed94d62 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -124,6 +124,7 @@ limSetChannel(tpAniSirGlobal pMac, tANI_U8 channel, tANI_U8 secChannelOffset, tP
 void
 limProcessMlmReqMessages(tpAniSirGlobal pMac, tpSirMsgQ Msg)
 {
+    MTRACE(macTraceMsgRx(pMac, NO_SESSION, Msg->type));
     switch (Msg->type)
     {
         case LIM_MLM_START_REQ:             limProcessMlmStartReq(pMac, Msg->bodyptr);   break;
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index 7befe6556f71..93b8e3fb2efe 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -2956,17 +2956,13 @@ __limProcessSmeDeauthReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
 
     if ((status == eSIR_FAILURE) || (!limIsSmeDeauthReqValid(pMac, &smeDeauthReq, psessionEntry)))
     {
-        PELOGE(limLog(pMac, LOGW,FL("received invalid SME_DEAUTH_REQ message"));)
-        if (pMac->lim.gLimRspReqd)
-        {
-            pMac->lim.gLimRspReqd = false;
+        PELOGE(limLog(pMac, LOGE,FL
+                   ("received invalid SME_DEAUTH_REQ message"));)
+        pMac->lim.gLimRspReqd = false;
 
-            retCode       = eSIR_SME_INVALID_PARAMETERS;
-            deauthTrigger = eLIM_HOST_DEAUTH;
-            goto sendDeauth;
-        }
-
-        return;
+        retCode       = eSIR_SME_INVALID_PARAMETERS;
+        deauthTrigger = eLIM_HOST_DEAUTH;
+        goto sendDeauth;
     }
     limLog(pMac, LOG1,FL("received DEAUTH_REQ message on sessionid %d "
       "Systemrole %d with reasoncode %u in limSmestate %d from "
@@ -5593,6 +5589,7 @@ limProcessSmeReqMessages(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
      * want to insert NOA before processing those msgs. These msgs will be processed later when
      * start event happens
      */
+    MTRACE(macTraceMsgRx(pMac, NO_SESSION, pMsg->type));
     switch (pMsg->type)
     {
         case eWNI_SME_SCAN_REQ:
diff --git a/CORE/MAC/src/pe/lim/limTrace.c b/CORE/MAC/src/pe/lim/limTrace.c
index 7270535ae5cc..e1b06b15ba89 100644
--- a/CORE/MAC/src/pe/lim/limTrace.c
+++ b/CORE/MAC/src/pe/lim/limTrace.c
@@ -273,6 +273,9 @@ void macTraceMsgTx(tpAniSirGlobal pMac, tANI_U8 session, tANI_U32 data)
         case SIR_CFG_MODULE_ID:
             macTrace(pMac, TRACE_CODE_TX_CFG_MSG, session, data);
             break;
+        default:
+            macTrace(pMac, moduleId, session, data);
+            break;
     }
 }
 
@@ -296,6 +299,9 @@ void macTraceMsgTxNew(tpAniSirGlobal pMac, tANI_U8 module, tANI_U8 session, tANI
         case SIR_CFG_MODULE_ID:
             macTraceNew(pMac, module, TRACE_CODE_TX_CFG_MSG, session, data);
             break;
+        default:
+            macTrace(pMac, moduleId, session, data);
+            break;
         }
 }
 
@@ -323,6 +329,9 @@ void macTraceMsgRx(tpAniSirGlobal pMac, tANI_U8 session, tANI_U32 data)
         case SIR_CFG_MODULE_ID:
             macTrace(pMac, TRACE_CODE_RX_CFG_MSG, session, data);
             break;
+        default:
+            macTrace(pMac, moduleId, session, data);
+            break;
         }
 }
 
@@ -352,6 +361,9 @@ void macTraceMsgRxNew(tpAniSirGlobal pMac, tANI_U8 module, tANI_U8 session, tANI
         case SIR_CFG_MODULE_ID:
             macTraceNew(pMac, module, TRACE_CODE_RX_CFG_MSG, session, data);
             break;
+        default:
+            macTrace(pMac, moduleId, session, data);
+            break;
         }
 }
 
diff --git a/CORE/SERVICES/COMMON/wmi_services.h b/CORE/SERVICES/COMMON/wmi_services.h
index 461c77548e3a..1ed0096c6666 100644
--- a/CORE/SERVICES/COMMON/wmi_services.h
+++ b/CORE/SERVICES/COMMON/wmi_services.h
@@ -115,6 +115,7 @@ typedef  enum  {
     WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT, /* STA RX DATA offload to IPA support */
     WMI_SERVICE_MDNS_OFFLOAD,         /* mDNS responder offload support */
     WMI_SERVICE_SAP_AUTH_OFFLOAD,     /* softap auth offload */
+    WMI_SERVICE_DUAL_BAND_SIMULTANEOUS_SUPPORT, /* Dual Band Simultaneous support */
     WMI_MAX_SERVICE=128               /* max service */
 } WMI_SERVICE;
 
diff --git a/CORE/SERVICES/COMMON/wmi_unified.h b/CORE/SERVICES/COMMON/wmi_unified.h
index 045f16d045e4..67e639e5eddd 100644
--- a/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/CORE/SERVICES/COMMON/wmi_unified.h
@@ -1220,6 +1220,11 @@ typedef struct {
     A_UINT32 hw_bd_id;
     A_UINT32 hw_bd_info[HW_BD_INFO_SIZE]; /* Board specific information. Invalid if hw_hd_id is zero. */
 
+    /*
+     * Number of MACs supported, i.e. a DBS-capable device will return 2
+     */
+    A_UINT32 max_supported_macs;
+
     /* The TLVs for hal_reg_capabilities, wmi_service_bitmap and mem_reqs[] will follow this TLV.
          *     HAL_REG_CAPABILITIES   hal_reg_capabilities;
          *     A_UINT32 wmi_service_bitmap[WMI_SERVICE_BM_SIZE];
@@ -1633,7 +1638,7 @@ typedef struct {
 
 #define WLAN_SCAN_PARAMS_MAX_SSID    16
 #define WLAN_SCAN_PARAMS_MAX_BSSID   4
-#define WLAN_SCAN_PARAMS_MAX_IE_LEN  256
+#define WLAN_SCAN_PARAMS_MAX_IE_LEN  512
 
 typedef struct {
     A_UINT32 tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_start_scan_cmd_fixed_param */
@@ -1685,7 +1690,7 @@ typedef struct {
     A_UINT32 num_bssid;
     /** number of ssid. In the TLV ssid_list[] */
     A_UINT32     num_ssids;
-    /** number of bytes in ie data. In the TLV ie_data[] */
+    /** number of bytes in ie data. In the TLV ie_data[]. Max len is defined by WLAN_SCAN_PARAMS_MAX_IE_LEN */
     A_UINT32 ie_len;
     /** Max number of probes to be sent */
     A_UINT32 n_probes;
@@ -3320,6 +3325,13 @@ typedef struct {
     /** Disable H/W ack. This used by WMI_VDEV_RESTART_REQUEST_CMDID.
           During CAC, Our HW shouldn't ack ditected frames */
     A_UINT32  disable_hw_ack;
+    /** This field will be invalid unless the Dual Band Simultaneous (DBS) feature is enabled. */
+    /** The DBS policy manager indicates the preferred number of transmit streams. */
+    A_UINT32 preferred_tx_streams;
+    /** This field will be invalid unless the Dual Band Simultaneous (DBS) feature is enabled. */
+    /** the DBS policy manager indicates the preferred number of receive streams. */
+    A_UINT32 preferred_rx_streams;
+
     /* The TLVs follows this structure:
          *     wmi_channel chan;   //WMI channel
          *     wmi_p2p_noa_descriptor  noa_descriptors[]; //actual p2p NOA descriptor from scan entry
@@ -3712,129 +3724,131 @@ WMI_VDEV_PARAM_ROAM_FW_OFFLOAD WMI_VDEV_PARAM **/
         #define WMI_VDEV_PREAMBLE_SHORT                                  0x2
 
 /** the definition of different START/RESTART Event response  */
-    typedef enum {
-        /* Event respose of START CMD */
-        WMI_VDEV_START_RESP_EVENT = 0,
-        /* Event respose of RESTART CMD */
-        WMI_VDEV_RESTART_RESP_EVENT,
-    } WMI_START_EVENT_PARAM;
-
-        typedef struct {
-            A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_start_response_event_fixed_param  */
-            /** unique id identifying the VDEV, generated by the caller */
-            A_UINT32 vdev_id;
-            /** requestor id that requested the VDEV start request */
-            A_UINT32 requestor_id;
-            /* Respose of Event type START/RESTART */
-            WMI_START_EVENT_PARAM resp_type;
-            /** status of the response */
-            A_UINT32 status;
-            /** Vdev chain mask */
-            A_UINT32 chain_mask;
-            /** Vdev mimo power save mode */
-            A_UINT32 smps_mode;
-        } wmi_vdev_start_response_event_fixed_param;
-
-        typedef struct {
-            A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_stopped_event_fixed_param  */
-            /** unique id identifying the VDEV, generated by the caller */
-            A_UINT32 vdev_id;
-        } wmi_vdev_stopped_event_fixed_param;
+typedef enum {
+    /* Event respose of START CMD */
+    WMI_VDEV_START_RESP_EVENT = 0,
+    /* Event respose of RESTART CMD */
+    WMI_VDEV_RESTART_RESP_EVENT,
+} WMI_START_EVENT_PARAM;
 
-        /** common structure used for simple events (stopped, resume_req, standby response) */
-        typedef struct {
-            A_UINT32    tlv_header;     /* TLV tag and len; tag would be equivalent to actual event  */
-            /** unique id identifying the VDEV, generated by the caller */
-            A_UINT32 vdev_id;
-        } wmi_vdev_simple_event_fixed_param;
+typedef struct {
+    A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_start_response_event_fixed_param  */
+    /** unique id identifying the VDEV, generated by the caller */
+    A_UINT32 vdev_id;
+    /** requestor id that requested the VDEV start request */
+    A_UINT32 requestor_id;
+    /* Respose of Event type START/RESTART */
+    WMI_START_EVENT_PARAM resp_type;
+    /** status of the response */
+    A_UINT32 status;
+    /** Vdev chain mask */
+    A_UINT32 chain_mask;
+    /** Vdev mimo power save mode */
+    A_UINT32 smps_mode;
+    /** mac_id field contains the MAC identifier that the VDEV is bound to. The valid range is 0 to (num_macs-1). */
+    A_UINT32 mac_id;
+} wmi_vdev_start_response_event_fixed_param;
 
+typedef struct {
+    A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_stopped_event_fixed_param  */
+    /** unique id identifying the VDEV, generated by the caller */
+    A_UINT32 vdev_id;
+} wmi_vdev_stopped_event_fixed_param;
 
-        /** VDEV start response status codes */
-        #define WMI_VDEV_START_RESPONSE_STATUS_SUCCESS 0x0  /** VDEV succesfully started */
-        #define WMI_VDEV_START_RESPONSE_INVALID_VDEVID  0x1  /** requested VDEV not found */
-        #define WMI_VDEV_START_RESPONSE_NOT_SUPPORTED  0x2  /** unsupported VDEV combination */
+/** common structure used for simple events (stopped, resume_req, standby response) */
+typedef struct {
+    A_UINT32    tlv_header;     /* TLV tag and len; tag would be equivalent to actual event  */
+    /** unique id identifying the VDEV, generated by the caller */
+    A_UINT32 vdev_id;
+} wmi_vdev_simple_event_fixed_param;
 
-        /** Beacon processing related command and event structures */
-        typedef struct {
-            A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_bcn_tx_hdr */
-            /** unique id identifying the VDEV, generated by the caller */
-            A_UINT32 vdev_id;
-            /** xmit rate */
-            A_UINT32 tx_rate;
-            /** xmit power */
-            A_UINT32 txPower;
-            /** beacon buffer length in bytes */
-            A_UINT32 buf_len;
-            /* This TLV is followed by array of bytes:
-                       * // beacon frame buffer
-                       *   A_UINT8 bufp[];
-                       */
-        } wmi_bcn_tx_hdr;
 
-        /* Beacon filter */
-        #define WMI_BCN_FILTER_ALL   0 /* Filter all beacons */
-        #define WMI_BCN_FILTER_NONE  1 /* Pass all beacons */
-        #define WMI_BCN_FILTER_RSSI  2 /* Pass Beacons RSSI >= RSSI threshold */
-        #define WMI_BCN_FILTER_BSSID 3 /* Pass Beacons with matching BSSID */
-        #define WMI_BCN_FILTER_SSID  4 /* Pass Beacons with matching SSID */
+/** VDEV start response status codes */
+#define WMI_VDEV_START_RESPONSE_STATUS_SUCCESS 0x0  /** VDEV succesfully started */
+#define WMI_VDEV_START_RESPONSE_INVALID_VDEVID  0x1  /** requested VDEV not found */
+#define WMI_VDEV_START_RESPONSE_NOT_SUPPORTED  0x2  /** unsupported VDEV combination */
 
-        typedef struct {
-            /** Filter ID */
-            A_UINT32 bcn_filter_id;
-            /** Filter type - wmi_bcn_filter */
-            A_UINT32 bcn_filter;
-            /** Buffer len */
-            A_UINT32 bcn_filter_len;
-            /** Filter info (threshold, BSSID, RSSI) */
-            A_UINT8 *bcn_filter_buf;
-        } wmi_bcn_filter_rx_cmd;
-
-        /** Capabilities and IEs to be passed to firmware */
-        typedef struct {
-            A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_bcn_prb_info */
-            /** Capabilities */
-            A_UINT32 caps;
-            /** ERP info */
-            A_UINT32 erp;
-            /** Advanced capabilities */
-            /** HT capabilities */
-            /** HT Info */
-            /** ibss_dfs */
-            /** wpa Info */
-            /** rsn Info */
-            /** rrm info */
-            /** ath_ext */
-            /** app IE */
-        } wmi_bcn_prb_info;
-
-         typedef struct {
-             A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_bcn_tmpl_cmd_fixed_param */
-             /** unique id identifying the VDEV, generated by the caller */
-             A_UINT32 vdev_id;
-             /** TIM IE offset from the beginning of the template. */
-             A_UINT32 tim_ie_offset;
-             /** beacon buffer length. data is in TLV data[] */
-             A_UINT32 buf_len;
-             /*
-                         * The TLVs follows:
-                         *    wmi_bcn_prb_info bcn_prb_info; //beacon probe capabilities and IEs
-                         *    A_UINT8  data[]; //Variable length data
-                         */
-        } wmi_bcn_tmpl_cmd_fixed_param;
-
-
-         typedef struct {
-             A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_prb_tmpl_cmd_fixed_param */
-             /** unique id identifying the VDEV, generated by the caller */
-             A_UINT32 vdev_id;
-             /** beacon buffer length. data is in TLV data[] */
-             A_UINT32 buf_len;
-             /*
-                         * The TLVs follows:
-                         *    wmi_bcn_prb_info bcn_prb_info; //beacon probe capabilities and IEs
-                         *    A_UINT8  data[]; //Variable length data
-                         */
-         } wmi_prb_tmpl_cmd_fixed_param;
+/** Beacon processing related command and event structures */
+typedef struct {
+    A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_bcn_tx_hdr */
+    /** unique id identifying the VDEV, generated by the caller */
+    A_UINT32 vdev_id;
+    /** xmit rate */
+    A_UINT32 tx_rate;
+    /** xmit power */
+    A_UINT32 txPower;
+    /** beacon buffer length in bytes */
+    A_UINT32 buf_len;
+    /* This TLV is followed by array of bytes:
+               * // beacon frame buffer
+               *   A_UINT8 bufp[];
+               */
+} wmi_bcn_tx_hdr;
+
+/* Beacon filter */
+#define WMI_BCN_FILTER_ALL   0 /* Filter all beacons */
+#define WMI_BCN_FILTER_NONE  1 /* Pass all beacons */
+#define WMI_BCN_FILTER_RSSI  2 /* Pass Beacons RSSI >= RSSI threshold */
+#define WMI_BCN_FILTER_BSSID 3 /* Pass Beacons with matching BSSID */
+#define WMI_BCN_FILTER_SSID  4 /* Pass Beacons with matching SSID */
+
+typedef struct {
+    /** Filter ID */
+    A_UINT32 bcn_filter_id;
+    /** Filter type - wmi_bcn_filter */
+    A_UINT32 bcn_filter;
+    /** Buffer len */
+    A_UINT32 bcn_filter_len;
+    /** Filter info (threshold, BSSID, RSSI) */
+    A_UINT8 *bcn_filter_buf;
+} wmi_bcn_filter_rx_cmd;
+
+/** Capabilities and IEs to be passed to firmware */
+typedef struct {
+    A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_bcn_prb_info */
+    /** Capabilities */
+    A_UINT32 caps;
+    /** ERP info */
+    A_UINT32 erp;
+    /** Advanced capabilities */
+    /** HT capabilities */
+    /** HT Info */
+    /** ibss_dfs */
+    /** wpa Info */
+    /** rsn Info */
+    /** rrm info */
+    /** ath_ext */
+    /** app IE */
+} wmi_bcn_prb_info;
+
+ typedef struct {
+     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_bcn_tmpl_cmd_fixed_param */
+     /** unique id identifying the VDEV, generated by the caller */
+     A_UINT32 vdev_id;
+     /** TIM IE offset from the beginning of the template. */
+     A_UINT32 tim_ie_offset;
+     /** beacon buffer length. data is in TLV data[] */
+     A_UINT32 buf_len;
+     /*
+                 * The TLVs follows:
+                 *    wmi_bcn_prb_info bcn_prb_info; //beacon probe capabilities and IEs
+                 *    A_UINT8  data[]; //Variable length data
+                 */
+} wmi_bcn_tmpl_cmd_fixed_param;
+
+
+ typedef struct {
+     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_prb_tmpl_cmd_fixed_param */
+     /** unique id identifying the VDEV, generated by the caller */
+     A_UINT32 vdev_id;
+     /** beacon buffer length. data is in TLV data[] */
+     A_UINT32 buf_len;
+     /*
+                 * The TLVs follows:
+                 *    wmi_bcn_prb_info bcn_prb_info; //beacon probe capabilities and IEs
+                 *    A_UINT8  data[]; //Variable length data
+                 */
+ } wmi_prb_tmpl_cmd_fixed_param;
 
 typedef struct {
   /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_offload_bcn_tx_status_event_fixed_param */
@@ -7044,6 +7058,9 @@ typedef struct {
      *  0: disable fw based adaptive ocs
      */
     A_UINT32 enable;
+    /** This field contains the MAC identifier in order to lookup the appropriate OCS instance. */
+    /** The valid range is 0 to (num_macs-1). */
+    A_UINT32 mac_id;
 } wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param;
 
 /* WMI_RESMGR_SET_CHAN_TIME_QUOTA_CMDID */
@@ -7663,7 +7680,7 @@ typedef struct {
     wmi_mac_addr forced_leader_mac_addr;
 } wmi_rmc_config_cmd_fixed_param;
 
-/** Multi-hop forwarding is generally implemented in
+/** MHF is generally implemented in
  *  the kernel. To decrease system power consumption, the
  *  driver can enable offloading this to the chipset. In
  *  order for the offload, the firmware needs the routing table.
@@ -7690,9 +7707,9 @@ typedef struct {
 } wmi_mhf_offload_set_mode_cmd_fixed_param;
 
 enum wmi_mhf_ofl_table_action {
-   /** Create forwarding offload table in FW */
+   /** Create MHF offload table in FW */
    WMI_MHF_OFL_TBL_CREATE = 0,
-   /** Append to existing MFF table */
+   /** Append to existing MHF offload table */
    WMI_MHF_OFL_TBL_APPEND = 1,
    /** Flush entire MHF offload table in FW */
    WMI_MHF_OFL_TBL_FLUSH = 2,
diff --git a/CORE/SERVICES/COMMON/wmi_version.h b/CORE/SERVICES/COMMON/wmi_version.h
index 810b365c5432..0bb68c1a10e5 100644
--- a/CORE/SERVICES/COMMON/wmi_version.h
+++ b/CORE/SERVICES/COMMON/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 84
+#define __WMI_REVISION_ 87
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index e469a7d4277a..1346618c018e 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -22595,6 +22595,12 @@ static int wma_process_sap_auth_offload(tp_wma_handle wma_handle,
 	u_int16_t len, psk_len;
 	int err;
 
+	if (!WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+				WMI_SERVICE_SAP_AUTH_OFFLOAD)) {
+		WMA_LOGE("Firmware not support SAP auth offload feature");
+		return -EIO;
+	}
+
 	psk_len = sap_auth_offload_info->key_len;
 	len = sizeof(*cmd) + WMI_TLV_HDR_SIZE + psk_len;
 	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
@@ -24802,27 +24808,30 @@ VOS_STATUS wma_start(v_VOID_t *vos_ctx)
 	}
 
 #ifdef SAP_AUTH_OFFLOAD
-	/* Initialize the station connect event handler for
-	 * software AP authentication offload feature.
-	 */
-	status = wmi_unified_register_event_handler(wma_handle->wmi_handle,
-				WMI_SAP_OFL_ADD_STA_EVENTID,
-				wma_sap_ofl_add_sta_handler);
-	if (status != VOS_STATUS_SUCCESS) {
-		WMA_LOGE("Failed to register sap offload add_sta event cb");
-		vos_status = VOS_STATUS_E_FAILURE;
-		goto end;
-	}
-	/* Initialize the station disconnect event handler for
-	 * software AP authentication offload feature.
-	 */
-	status = wmi_unified_register_event_handler(wma_handle->wmi_handle,
-				WMI_SAP_OFL_DEL_STA_EVENTID,
-				wma_sap_ofl_del_sta_handler);
-	if (status != VOS_STATUS_SUCCESS) {
-		WMA_LOGE("Failed to register sap offload del_sta event cb");
-		vos_status = VOS_STATUS_E_FAILURE;
-		goto end;
+	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+				WMI_SERVICE_SAP_AUTH_OFFLOAD)) {
+		/* Initialize the station connect event handler for
+		 * software AP authentication offload feature.
+		 */
+		status = wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					WMI_SAP_OFL_ADD_STA_EVENTID,
+					wma_sap_ofl_add_sta_handler);
+		if (status != VOS_STATUS_SUCCESS) {
+			WMA_LOGE("Failed to register sap offload add_sta event cb");
+			vos_status = VOS_STATUS_E_FAILURE;
+			goto end;
+		}
+		/* Initialize the station disconnect event handler for
+		 * software AP authentication offload feature.
+		 */
+		status = wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					WMI_SAP_OFL_DEL_STA_EVENTID,
+					wma_sap_ofl_del_sta_handler);
+		if (status != VOS_STATUS_SUCCESS) {
+			WMA_LOGE("Failed to register sap offload del_sta event cb");
+			vos_status = VOS_STATUS_E_FAILURE;
+			goto end;
+		}
 	}
 #endif /* SAP_AUTH_OFFLOAD */
 
@@ -25242,6 +25251,13 @@ static inline void wma_update_target_services(tp_wma_handle wh,
 
 	if (WMI_SERVICE_IS_ENABLED(wh->wmi_service_bitmap, WMI_SERVICE_RTT))
 		gFwWlanFeatCaps |= (1 << RTT);
+
+#ifdef SAP_AUTH_OFFLOAD
+	cfg->sap_auth_offload_service =
+			WMI_SERVICE_IS_ENABLED(wh->wmi_service_bitmap,
+					WMI_SERVICE_SAP_AUTH_OFFLOAD);
+#endif
+
 }
 
 static inline void wma_update_target_ht_cap(tp_wma_handle wh,
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index aaecee69743c..adcdb077a5d8 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -13140,7 +13140,7 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
     tANI_U8 wpaRsnIE[DOT11F_IE_RSN_MAX_LEN];    //RSN MAX is bigger than WPA MAX
     tANI_U32 ucDot11Mode = 0;
     tANI_U8 txBFCsnValue = 0;
-    tANI_U32 sap_sessionId;
+    tANI_U32 sap_session_id;
     tCsrRoamSession *sap_session;
 
     if(!pSession)
@@ -13811,17 +13811,11 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
                 break;
             }
             if (!CSR_IS_CHANNEL_5GHZ(pBssDescription->channelId)) {
-                sap_sessionId = csr_find_sap_session(pMac);
-                if (CSR_SESSION_ID_INVALID != sap_sessionId) {
-                    sap_session = CSR_GET_SESSION( pMac, sessionId );
-                    if(!sap_session) {
-                       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                                 FL("session %d not found"), sap_sessionId);
-                       status = eHAL_STATUS_FAILURE;
-                       break;
-                    }
-                    if ((0 != sap_session->pCurRoamProfile->operationChannel) &&
-                        (sap_session->pCurRoamProfile->operationChannel !=
+                sap_session_id = csr_find_sap_session(pMac);
+                if (CSR_SESSION_ID_INVALID != sap_session_id) {
+                    sap_session = CSR_GET_SESSION(pMac, sap_session_id);
+                    if ((0 != sap_session->bssParams.operationChn) &&
+                        (sap_session->bssParams.operationChn !=
                          pBssDescription->channelId)) {
 
                         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
@@ -18790,9 +18784,7 @@ static tANI_U32 csr_find_sap_session(tpAniSirGlobal mac_ctx)
     for (i = 0; i < CSR_ROAM_SESSION_MAX; i++) {
          if (CSR_IS_SESSION_VALID( mac_ctx, i)){
              session_ptr = CSR_GET_SESSION(mac_ctx, i);
-             if (session_ptr->pCurRoamProfile &&
-                 (eCSR_BSS_TYPE_INFRA_AP ==
-                         session_ptr->connectedProfile.BSSType)) {
+             if (VOS_STA_SAP_MODE == session_ptr->bssParams.bssPersona) {
                  /* Found it */
                  session_id = i;
                  break;
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 3d748344dc90..b6edd2e87987 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -3173,6 +3173,7 @@ VOS_STATUS sme_get_ap_channel_from_scan_cache(tHalHandle hHal,
    tCsrScanResultFilter *scan_filter = NULL;
    tScanResultHandle filtered_scan_result = NULL;
    tSirBssDescription first_ap_profile;
+   VOS_STATUS ret_status = VOS_STATUS_SUCCESS;
 
    if (NULL == pMac) {
        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
@@ -3234,20 +3235,23 @@ VOS_STATUS sme_get_ap_channel_from_scan_cache(tHalHandle hHal,
                *ap_chnl_id = 0;
                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
                          FL("Scan result is empty, setting channel to 0"));
+               ret_status = VOS_STATUS_E_FAILURE;
            }
        } else {
           VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
                     FL("Failed to get scan get result"));
+          ret_status = VOS_STATUS_E_FAILURE;
        }
        sme_ReleaseGlobalLock( &pMac->sme );
    } else {
        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
                     FL("Aquiring lock failed"));
+       ret_status = VOS_STATUS_E_FAILURE;
    }
 
    vos_mem_free(scan_filter);
 
-   return VOS_STATUS_SUCCESS;
+   return ret_status;
 }
 
 /* ---------------------------------------------------------------------------