Merge "Release 1.0.0.176 QCACLD WLAN Driver"

38 files changed, 1007 insertions, 299 deletions

diff --git a/CORE/CLD_TXRX/HTT/htt_h2t.c b/CORE/CLD_TXRX/HTT/htt_h2t.c
index 70c7aedadab2..78cf63ee2767 100644
--- a/CORE/CLD_TXRX/HTT/htt_h2t.c
+++ b/CORE/CLD_TXRX/HTT/htt_h2t.c
@@ -871,5 +871,59 @@ int htt_h2t_ipa_uc_set_active(struct htt_pdev_t *pdev,
 
     return A_OK;
 }
+
+
+int htt_h2t_ipa_uc_get_stats(struct htt_pdev_t *pdev)
+{
+    struct htt_htc_pkt *pkt;
+    adf_nbuf_t msg;
+    u_int32_t *msg_word;
+
+    pkt = htt_htc_pkt_alloc(pdev);
+    if (!pkt) {
+        return A_NO_MEMORY;
+    }
+
+    /* show that this is not a tx frame download (not required, but helpful) */
+    pkt->msdu_id = HTT_TX_COMPL_INV_MSDU_ID;
+    pkt->pdev_ctxt = NULL; /* not used during send-done callback */
+
+    msg = adf_nbuf_alloc(
+        pdev->osdev,
+        HTT_MSG_BUF_SIZE(HTT_WDI_IPA_OP_REQUEST_SZ),
+        /* reserve room for HTC header */
+        HTC_HEADER_LEN + HTC_HDR_ALIGNMENT_PADDING, 4, FALSE);
+    if (!msg) {
+        htt_htc_pkt_free(pdev, pkt);
+        return A_NO_MEMORY;
+    }
+    /* set the length of the message */
+    adf_nbuf_put_tail(msg, HTT_WDI_IPA_OP_REQUEST_SZ);
+
+    /* fill in the message contents */
+    msg_word = (u_int32_t *) adf_nbuf_data(msg);
+
+    /* rewind beyond alignment pad to get to the HTC header reserved area */
+    adf_nbuf_push_head(msg, HTC_HDR_ALIGNMENT_PADDING);
+
+    *msg_word = 0;
+    HTT_WDI_IPA_OP_REQUEST_OP_CODE_SET(*msg_word,
+         HTT_WDI_IPA_OPCODE_DBG_STATS);
+    HTT_H2T_MSG_TYPE_SET(*msg_word, HTT_H2T_MSG_TYPE_WDI_IPA_OP_REQ);
+
+    SET_HTC_PACKET_INFO_TX(
+        &pkt->htc_pkt,
+        htt_h2t_send_complete_free_netbuf,
+        adf_nbuf_data(msg),
+        adf_nbuf_len(msg),
+        pdev->htc_endpoint,
+        1); /* tag - not relevant here */
+
+    SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
+
+    HTCSendPkt(pdev->htc_pdev, &pkt->htc_pkt);
+
+    return A_OK;
+}
 #endif /* IPA_UC_OFFLOAD */
 
diff --git a/CORE/CLD_TXRX/HTT/htt_t2h.c b/CORE/CLD_TXRX/HTT/htt_t2h.c
index 2593ff29377e..825d0c312075 100644
--- a/CORE/CLD_TXRX/HTT/htt_t2h.c
+++ b/CORE/CLD_TXRX/HTT/htt_t2h.c
@@ -345,6 +345,33 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg )
         break;
     }
 
+#ifdef IPA_UC_OFFLOAD
+    case HTT_T2H_MSG_TYPE_WDI_IPA_OP_RESPONSE:
+        {
+            u_int8_t op_code;
+            u_int16_t len;
+            u_int8_t *op_msg_buffer;
+            u_int8_t *msg_start_ptr;
+
+            msg_start_ptr = (u_int8_t *)msg_word;
+            op_code = HTT_WDI_IPA_OP_RESPONSE_OP_CODE_GET(*msg_word);
+            msg_word++;
+            len = HTT_WDI_IPA_OP_RESPONSE_RSP_LEN_GET(*msg_word);
+
+            op_msg_buffer = adf_os_mem_alloc(NULL,
+                sizeof(struct htt_wdi_ipa_op_response_t) + len);
+            if (!op_msg_buffer) {
+                adf_os_print("OPCODE messsage buffer alloc fail");
+                break;
+            }
+            adf_os_mem_copy(op_msg_buffer,
+                    msg_start_ptr,
+                    sizeof(struct htt_wdi_ipa_op_response_t) + len);
+            ol_txrx_ipa_uc_op_response(pdev->txrx_pdev, op_msg_buffer);
+            break;
+        }
+#endif /* IPA_UC_OFFLOAD */
+
     default:
         break;
     };
@@ -545,17 +572,6 @@ if (adf_os_unlikely(pdev->rx_ring.rx_reset)) {
             break;
      }
 
-#ifdef IPA_UC_OFFLOAD
-    case HTT_T2H_MSG_TYPE_WDI_IPA_OP_RESPONSE:
-        {
-            u_int8_t op_code;
-
-            op_code = HTT_WDI_IPA_OP_RESPONSE_OP_CODE_GET(*msg_word);
-            ol_txrx_ipa_uc_op_response(pdev->txrx_pdev, op_code);
-            break;
-        }
-#endif /* IPA_UC_OFFLOAD */
-
     default:
         htt_t2h_lp_msg_handler(context, htt_t2h_msg);
         return ;
diff --git a/CORE/CLD_TXRX/HTT/htt_tx.c b/CORE/CLD_TXRX/HTT/htt_tx.c
index 286f8a0d499e..bece21d4d906 100644
--- a/CORE/CLD_TXRX/HTT/htt_tx.c
+++ b/CORE/CLD_TXRX/HTT/htt_tx.c
@@ -665,9 +665,6 @@ int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
       *header_ptr = buffer_paddr + 32;
 
       *ring_vaddr = buffer_paddr;
-      printk("TX RING vADD %lx BF pADDR %x buffer_paddr %x buffer_vaddr %lx\n",
-             (unsigned long)ring_vaddr, (unsigned int)(*ring_vaddr),
-             (unsigned int)buffer_paddr, (unsigned long)adf_nbuf_data(buffer_vaddr));
       pdev->ipa_uc_tx_rsc.tx_buf_pool_vaddr_strg[tx_buffer_count] =
             buffer_vaddr;
       /* Memory barrier to ensure actual value updated */
@@ -675,8 +672,6 @@ int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
       ring_vaddr++;
    }
 
-   adf_os_print("%s: Allocated TX buffer count is %d\n",
-                __func__, tx_buffer_count);
    pdev->ipa_uc_tx_rsc.alloc_tx_buf_cnt = tx_buffer_count;
 
    return 0;
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.c b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
index f4c3969c83db..157fc7d1956d 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.c
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
@@ -2433,7 +2433,6 @@ void WLANTL_IpaUcFwOpEventHandler(void *context,
 	void *rxpkt,
 	u_int16_t staid)
 {
-	v_U8_t op_code;
 	struct txrx_tl_shim_ctx *tl_shim = (struct txrx_tl_shim_ctx *)context;
 
 	if (!tl_shim) {
@@ -2441,10 +2440,8 @@ void WLANTL_IpaUcFwOpEventHandler(void *context,
 		return;
 	}
 
-	vos_mem_copy(&op_code, rxpkt, 1);
-	TLSHIM_LOGD("%s, opcode %d", __func__, op_code);
 	if (tl_shim->fw_op_cb) {
-		tl_shim->fw_op_cb(op_code);
+		tl_shim->fw_op_cb(rxpkt, tl_shim->usr_ctxt);
 	}
 }
 
@@ -2468,11 +2465,10 @@ void WLANTL_IpaUcFwOpEventHandler(void *context,
   SIDE EFFECTS
 
 ==============================================================================*/
-void WLANTL_IpaUcOpEventHandler(v_U8_t op_code, void *shim_ctxt)
+void WLANTL_IpaUcOpEventHandler(v_U8_t *op_msg, void *shim_ctxt)
 {
 	pVosSchedContext sched_ctx = get_vos_sched_ctxt();
 	struct VosTlshimPkt *pkt;
-	v_U8_t *op_code_pkt;
 
 	if (unlikely(!sched_ctx))
 		return;
@@ -2483,11 +2479,9 @@ void WLANTL_IpaUcOpEventHandler(v_U8_t op_code, void *shim_ctxt)
 		return;
 	}
 
-	op_code_pkt = (v_U8_t *)vos_mem_malloc(4);
-	vos_mem_copy(op_code_pkt, &op_code, 1);
 	pkt->callback = (vos_tlshim_cb)	WLANTL_IpaUcFwOpEventHandler;
 	pkt->context = shim_ctxt;
-	pkt->Rxpkt = (void *) op_code_pkt;
+	pkt->Rxpkt = (void *)op_msg;
 	pkt->staId = 0;
 	vos_indicate_rxpkt(sched_ctx, pkt);
 }
@@ -2510,7 +2504,7 @@ void WLANTL_IpaUcOpEventHandler(v_U8_t op_code, void *shim_ctxt)
 
 ==============================================================================*/
 void WLANTL_RegisterOPCbFnc(void *vos_ctx,
-	void (*func)(v_U8_t op_code))
+	void (*func)(v_U8_t *op_msg, void *usr_ctxt), void *usr_ctxt)
 {
 	struct txrx_tl_shim_ctx *tl_shim;
 
@@ -2526,6 +2520,7 @@ void WLANTL_RegisterOPCbFnc(void *vos_ctx,
 	}
 
 	tl_shim->fw_op_cb = func;
+	tl_shim->usr_ctxt = usr_ctxt;
 	wdi_in_ipa_uc_register_op_cb(((pVosContextType)vos_ctx)->pdev_txrx_ctx,
 		WLANTL_IpaUcOpEventHandler, (void *)tl_shim);
 }
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.h b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
index 3eedfe3a31f7..100e1edc4b7c 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.h
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
@@ -71,7 +71,7 @@ struct tlshim_session_flow_Control {
 #endif /* QCA_LL_TX_FLOW_CT */
 
 #ifdef IPA_UC_OFFLOAD
-typedef void(*ipa_uc_fw_op_cb)(v_U8_t op_code);
+typedef void(*ipa_uc_fw_op_cb)(v_U8_t *op_msg, void *usr_ctxt);
 #endif /* IPA_UC_OFFLOAD */
 
 struct txrx_tl_shim_ctx {
@@ -103,7 +103,8 @@ struct deferred_iapp_work iapp_work;
 	vos_event_t  *peer_authorized_events;
 #endif
 #ifdef IPA_UC_OFFLOAD
-	ipa_uc_fw_op_cb fw_op_cb;;
+	ipa_uc_fw_op_cb fw_op_cb;
+	void *usr_ctxt;
 #endif /* IPA_UC_OFFLOAD */
 };
 
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c
index b39b0c3d25a8..f3f3ac511d29 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -1387,7 +1387,7 @@ ol_txrx_peer_unref_delete(ol_txrx_peer_handle peer)
      */
 
     if (0 == adf_os_atomic_read(&(peer->ref_cnt)) ) {
-        TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1, "The Peer is not present anymore\n");
+        TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, "The Peer is not present anymore\n");
         adf_os_assert(0);
         return;
     }
@@ -1505,7 +1505,7 @@ ol_txrx_peer_detach(ol_txrx_peer_handle peer)
     /* debug print to dump rx reorder state */
     //htt_rx_reorder_log_print(vdev->pdev->htt_pdev);
 
-    TXRX_PRINT(TXRX_PRINT_LEVEL_INFO2,
+    TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
         "%s:peer %p (%02x:%02x:%02x:%02x:%02x:%02x)\n",
           __func__, peer,
           peer->mac_addr.raw[0], peer->mac_addr.raw[1],
@@ -2096,11 +2096,11 @@ ol_txrx_ipa_uc_set_active(
 void
 ol_txrx_ipa_uc_op_response(
    ol_txrx_pdev_handle pdev,
-   u_int8_t op_code
+   u_int8_t *op_msg
 )
 {
    if (pdev->ipa_uc_op_cb) {
-      pdev->ipa_uc_op_cb(op_code, pdev->osif_dev);
+      pdev->ipa_uc_op_cb(op_msg, pdev->osif_dev);
    }
 }
 
@@ -2113,5 +2113,10 @@ void ol_txrx_ipa_uc_register_op_cb(
    pdev->osif_dev = osif_dev;
 }
 
+void ol_txrx_ipa_uc_get_stat(ol_txrx_pdev_handle pdev)
+{
+   htt_h2t_ipa_uc_get_stats(pdev->htt_pdev);
+}
+
 #endif /* IPA_UC_OFFLOAD */
 
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
index 8c89d21eb69d..5559a67da227 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
@@ -322,7 +322,7 @@ typedef enum _throttle_phase {
 #define THROTTLE_TX_THRESHOLD (100)
 
 #ifdef IPA_UC_OFFLOAD
-typedef void (*ipa_uc_op_cb_type)(u_int8_t op_code, void *osif_ctxt);
+typedef void (*ipa_uc_op_cb_type)(u_int8_t *op_msg, void *osif_ctxt);
 #endif /* IPA_UC_OFFLOAD */
 
 /*
diff --git a/CORE/HDD/inc/qc_sap_ioctl.h b/CORE/HDD/inc/qc_sap_ioctl.h
index 17a27aa01d4b..58400191e95a 100644
--- a/CORE/HDD/inc/qc_sap_ioctl.h
+++ b/CORE/HDD/inc/qc_sap_ioctl.h
@@ -237,7 +237,8 @@ enum {
     QCSAP_GET_ACL,
     QCASAP_TX_CHAINMASK_CMD,
     QCASAP_RX_CHAINMASK_CMD,
-    QCASAP_NSS_CMD
+    QCASAP_NSS_CMD,
+    QCSAP_IPA_UC_STAT
 };
 
 int iw_softap_get_channel_list(struct net_device *dev,
diff --git a/CORE/HDD/inc/wlan_hdd_cfg.h b/CORE/HDD/inc/wlan_hdd_cfg.h
index c62fb1f079f7..87e0f76b3382 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -1404,7 +1404,7 @@ typedef enum
 #define CFG_BAND_CAPABILITY_NAME          "BandCapability"
 #define CFG_BAND_CAPABILITY_MIN           (0)
 #define CFG_BAND_CAPABILITY_MAX           (2)
-#define CFG_BAND_CAPABILITY_DEFAULT       (1)
+#define CFG_BAND_CAPABILITY_DEFAULT       (0)
 
 #define CFG_ENABLE_BEACON_EARLY_TERMINATION_NAME          "enableBeaconEarlyTermination"
 #define CFG_ENABLE_BEACON_EARLY_TERMINATION_MIN           ( 0 )
@@ -2708,6 +2708,11 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
 #define CFG_ENABLE_SELF_RECOVERY_MAX               ( 1 )
 #define CFG_ENABLE_SELF_RECOVERY_DEFAULT           ( 0 )
 
+#define CFG_ENABLE_SAP_SUSPEND                     "gEnableSapSuspend"
+#define CFG_ENABLE_SAP_SUSPEND_MIN                 ( 0 )
+#define CFG_ENABLE_SAP_SUSPEND_MAX                 ( 1 )
+#define CFG_ENABLE_SAP_SUSPEND_DEFAULT             ( 1 )
+
 /*---------------------------------------------------------------------------
   Type declarations
   -------------------------------------------------------------------------*/
@@ -3288,11 +3293,14 @@ typedef struct
 #ifdef WLAN_FEATURE_LPSS
    v_BOOL_t                    enablelpasssupport;
 #endif
+
    v_BOOL_t                    enableSelfRecovery;
 
 #ifdef FEATURE_WLAN_FORCE_SAP_SCC
    v_U8_t                      SapSccChanAvoidance;
 #endif /* FEATURE_WLAN_FORCE_SAP_SCC */
+
+   v_BOOL_t                    enableSapSuspend;
 } hdd_config_t;
 
 #ifdef WLAN_FEATURE_MBSSID
diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index 710e64719fe3..d8c6cb906e4a 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -675,10 +675,6 @@ struct hdd_station_ctx
    tCsrRoamSetKey ibss_enc_key;
    v_BOOL_t hdd_ReassocScenario;
 
-   /* PMKID Cache */
-   tPmkidCacheInfo PMKIDCache[CSR_MAX_PMKID_ALLOWED];
-   tANI_U32 PMKIDCacheIndex;
-
    /* STA ctx debug variables */
    int staDebugState;
 };
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index b839e3b19814..a9f7a22b37b9 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -3640,7 +3640,8 @@ static tANI_S32 hdd_ProcessGENIE(hdd_adapter_t *pAdapter,
             // Finally set the PMKSA ID Cache in CSR
             result = sme_RoamSetPMKIDCache(halHandle,pAdapter->sessionId,
                                            PMKIDCache,
-                                           dot11RSNIE.pmkid_count );
+                                           dot11RSNIE.pmkid_count,
+                                           FALSE);
         }
     }
     else if (gen_ie[0] == DOT11F_EID_WPA)
diff --git a/CORE/HDD/src/wlan_hdd_cfg.c b/CORE/HDD/src/wlan_hdd_cfg.c
index fe1128316cb3..94992b63f38c 100644
--- a/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/CORE/HDD/src/wlan_hdd_cfg.c
@@ -3763,6 +3763,7 @@ REG_TABLE_ENTRY g_registry_table[] =
                CFG_ENABLE_LPASS_SUPPORT_MIN,
                CFG_ENABLE_LPASS_SUPPORT_MAX),
 #endif
+
    REG_VARIABLE( CFG_ENABLE_SELF_RECOVERY, WLAN_PARAM_Integer,
               hdd_config_t, enableSelfRecovery,
               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -3778,6 +3779,13 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_SAP_SCC_CHAN_AVOIDANCE_MIN,
                  CFG_SAP_SCC_CHAN_AVOIDANCE_MAX),
 #endif /* FEATURE_WLAN_FORCE_SAP_SCC */
+
+   REG_VARIABLE( CFG_ENABLE_SAP_SUSPEND, WLAN_PARAM_Integer,
+               hdd_config_t, enableSapSuspend,
+               VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+               CFG_ENABLE_SAP_SUSPEND_DEFAULT,
+               CFG_ENABLE_SAP_SUSPEND_MIN,
+               CFG_ENABLE_SAP_SUSPEND_MAX ),
 };
 
 #ifdef WLAN_FEATURE_MBSSID
@@ -4315,9 +4323,14 @@ void print_hdd_cfg(hdd_context_t *pHddCtx)
             "Name = [gEnableLpassSupport] Value = [%u] ",
             pHddCtx->cfg_ini->enablelpasssupport);
 #endif
+
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
            "Name = [gEnableSelfRecovery] Value = [%u]",
                    pHddCtx->cfg_ini->enableSelfRecovery);
+
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+            "Name = [gEnableSapSuspend] Value = [%u]",
+            pHddCtx->cfg_ini->enableSapSuspend);
 }
 
 #define CFG_VALUE_MAX_LEN 256
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index f075b29c573a..9df38aff3f17 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -11263,14 +11263,12 @@ static int wlan_hdd_cfg80211_add_station(struct wiphy *wiphy,
 static int __wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
             struct cfg80211_pmksa *pmksa)
 {
-    tANI_U32 j=0;
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
-    hdd_station_ctx_t *pHddStaCtx;
+    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     tHalHandle halHandle;
     eHalStatus result = eHAL_STATUS_SUCCESS;
     int status;
-    tANI_U8  BSSIDMatched = 0;
-    hdd_context_t *pHddCtx;
+    tPmkidCacheInfo pmk_id;
 
     if (!pmksa) {
         hddLog(LOGE, FL("pmksa is NULL"));
@@ -11282,10 +11280,10 @@ static int __wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device
                pmksa->bssid, pmksa->pmkid);
         return -EINVAL;
     }
+
     hddLog(VOS_TRACE_LEVEL_DEBUG, FL("set PMKSA for "MAC_ADDRESS_STR),
            MAC_ADDR_ARRAY(pmksa->bssid));
 
-    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     status = wlan_hdd_validate_context(pHddCtx);
 
     if (0 != status) {
@@ -11294,61 +11292,18 @@ static int __wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device
     }
 
     halHandle = WLAN_HDD_GET_HAL_CTX(pAdapter);
-    pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-
-    for (j = 0; j < pHddStaCtx->PMKIDCacheIndex; j++) {
-        if (vos_mem_compare(pHddStaCtx->PMKIDCache[j].BSSID,
-                    pmksa->bssid, VOS_MAC_ADDR_SIZE)) {
-            /* BSSID matched previous entry. Overwrite it. */
-            BSSIDMatched = 1;
-            vos_mem_copy(pHddStaCtx->PMKIDCache[j].BSSID,
-                    pmksa->bssid, VOS_MAC_ADDR_SIZE);
-            vos_mem_copy(pHddStaCtx->PMKIDCache[j].PMKID,
-                    pmksa->pmkid,
-                    CSR_RSN_PMKID_SIZE);
-            hddLog(VOS_TRACE_LEVEL_DEBUG, FL("Reusing cache entry %d"), j);
-            hddLog(VOS_TRACE_LEVEL_INFO, MAC_ADDRESS_STR,
-               MAC_ADDR_ARRAY(pmksa->bssid));
-            dump_pmkid(halHandle, pmksa->pmkid);
-            break;
-        }
-    }
-
-    /* Check we compared all entries,if then take the first slot now */
-    if (j == CSR_MAX_PMKID_ALLOWED) pHddStaCtx->PMKIDCacheIndex = 0;
-
-    if (!BSSIDMatched) {
-        /* Now, we DON'T have a BSSID match, so take a new entry in the cache */
-        vos_mem_copy(pHddStaCtx->PMKIDCache[pHddStaCtx->PMKIDCacheIndex].BSSID,
-                pmksa->bssid, ETHER_ADDR_LEN);
-        vos_mem_copy(pHddStaCtx->PMKIDCache[pHddStaCtx->PMKIDCacheIndex].PMKID,
-                pmksa->pmkid,
-                CSR_RSN_PMKID_SIZE);
-        hddLog(VOS_TRACE_LEVEL_DEBUG,
-               FL("Adding a new cache entry %d"), pHddStaCtx->PMKIDCacheIndex);
-        hddLog(VOS_TRACE_LEVEL_INFO, MAC_ADDRESS_STR,
-               MAC_ADDR_ARRAY(pmksa->bssid));
-        dump_pmkid(halHandle, pmksa->pmkid);
-        /* Increment the HDD Local Cache index */
-        if (pHddStaCtx->PMKIDCacheIndex <= (CSR_MAX_PMKID_ALLOWED - 1))
-            pHddStaCtx->PMKIDCacheIndex++;
-        else
-            pHddStaCtx->PMKIDCacheIndex = 0;
-    }
 
+    vos_mem_copy(pmk_id.BSSID, pmksa->bssid, ETHER_ADDR_LEN);
+    vos_mem_copy(pmk_id.PMKID, pmksa->pmkid, CSR_RSN_PMKID_SIZE);
 
-    /* Calling csrRoamSetPMKIDCache to configure the PMKIDs into the cache */
-    hddLog(VOS_TRACE_LEVEL_DEBUG,
-           FL("Calling sme_RoamSetPMKIDCache with %d cache entries"),
-           pHddStaCtx->PMKIDCacheIndex);
-
-    /* Finally set the PMKSA ID Cache in CSR */
+    /* Add to the PMKSA ID Cache in CSR */
     result = sme_RoamSetPMKIDCache(halHandle,pAdapter->sessionId,
-                                    pHddStaCtx->PMKIDCache,
-                                    pHddStaCtx->PMKIDCacheIndex);
+                                   &pmk_id, 1, FALSE);
+
     MTRACE(vos_trace(VOS_MODULE_ID_HDD,
                      TRACE_CODE_HDD_CFG80211_SET_PMKSA,
                      pAdapter->sessionId, result));
+
     return HAL_STATUS_SUCCESS(result) ? 0 : -EINVAL;
 }
 
@@ -11368,12 +11323,9 @@ static int wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *d
 static int __wlan_hdd_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
              struct cfg80211_pmksa *pmksa)
 {
-    tANI_U32 j = 0;
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
-    hdd_station_ctx_t *pHddStaCtx;
+    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     tHalHandle halHandle;
-    tANI_U8  BSSIDMatched = 0;
-    hdd_context_t *pHddCtx;
     int status = 0;
 
     if (!pmksa) {
@@ -11385,10 +11337,10 @@ static int __wlan_hdd_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device
         hddLog(LOGE, FL("pmksa->bssid is NULL"));
         return -EINVAL;
     }
+
     hddLog(VOS_TRACE_LEVEL_DEBUG, FL("Deleting PMKSA for "MAC_ADDRESS_STR),
            MAC_ADDR_ARRAY(pmksa->bssid));
 
-    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     status = wlan_hdd_validate_context(pHddCtx);
 
     if (0 != status) {
@@ -11397,70 +11349,16 @@ static int __wlan_hdd_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device
     }
 
     halHandle = WLAN_HDD_GET_HAL_CTX(pAdapter);
-    pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-
-    /* In case index is 0,no entry to delete */
-    if (0 == pHddStaCtx->PMKIDCacheIndex) {
-       hddLog(VOS_TRACE_LEVEL_INFO, FL("No entries to delete"));
-       return 0;
-    }
-
-    /* Find the matching PMKSA entry from j=0 to (index-1),
-     * and delete the matched one
-     */
-    for (j = 0; j < pHddStaCtx->PMKIDCacheIndex; j++) {
-          if (vos_mem_compare(pHddStaCtx->PMKIDCache[j].BSSID,
-                             pmksa->bssid,
-                             VOS_MAC_ADDR_SIZE)) {
-             /* BSSID matched entry */
-             BSSIDMatched = 1;
-
-             if (j < pHddStaCtx->PMKIDCacheIndex-1) {
-                 /* Replace the matching entry with the last entry
-                    in HDD local cache */
-                 vos_mem_copy(pHddStaCtx->PMKIDCache[j].BSSID,
-                      pHddStaCtx->PMKIDCache[pHddStaCtx->PMKIDCacheIndex-1].BSSID,
-                      VOS_MAC_ADDR_SIZE);
-                 vos_mem_copy(pHddStaCtx->PMKIDCache[j].PMKID,
-                      pHddStaCtx->PMKIDCache[pHddStaCtx->PMKIDCacheIndex-1].PMKID,
-                      CSR_RSN_PMKID_SIZE);
-              }
 
-             /* Clear the last entry in HDD cache ---[index-1] */
-             vos_mem_zero(pHddStaCtx->PMKIDCache[pHddStaCtx->PMKIDCacheIndex-1].BSSID,
-                          VOS_MAC_ADDR_SIZE);
-             vos_mem_zero(pHddStaCtx->PMKIDCache[pHddStaCtx->PMKIDCacheIndex-1].PMKID,
-                          CSR_RSN_PMKID_SIZE);
-
-             /* Reduce the PMKID array index */
-             pHddStaCtx->PMKIDCacheIndex--;
-
-             /* Delete the last PMKID cache in CSR */
-             if (eHAL_STATUS_SUCCESS !=
-                 sme_RoamDelPMKIDfromCache(halHandle,
-                                           pAdapter->sessionId, pmksa->bssid))
-             {
-                hddLog(LOGE, FL("Cannot delete PMKSA %d CONTENT"),
-                             pHddStaCtx->PMKIDCacheIndex);
-                status = -EINVAL;
-             }
-
-             hddLog(VOS_TRACE_LEVEL_INFO, MAC_ADDRESS_STR,
-               MAC_ADDR_ARRAY(pmksa->bssid));
-             dump_pmkid(halHandle,pmksa->pmkid);
-
-             break;
-          }
+    /* Delete the PMKID CSR cache */
+    if (eHAL_STATUS_SUCCESS !=
+        sme_RoamDelPMKIDfromCache(halHandle,
+                                  pAdapter->sessionId, pmksa->bssid, FALSE)) {
+       hddLog(LOGE, FL("Failed to delete PMKSA for "MAC_ADDRESS_STR),
+                      MAC_ADDR_ARRAY(pmksa->bssid));
+       status = -EINVAL;
     }
 
-    /* We compare all entries, but cannot find matching entry */
-    if (j == CSR_MAX_PMKID_ALLOWED && !BSSIDMatched) {
-       hddLog(VOS_TRACE_LEVEL_DEBUG,
-              FL("No such PMKSA entry exists "MAC_ADDRESS_STR),
-              MAC_ADDR_ARRAY(pmksa->bssid));
-       dump_pmkid(halHandle, pmksa->pmkid);
-       return -EINVAL;
-    }
     return status;
 }
 
@@ -11480,12 +11378,9 @@ static int wlan_hdd_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *d
 
 static int __wlan_hdd_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *dev)
 {
-    tANI_U32 j = 0;
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
-    hdd_station_ctx_t *pHddStaCtx;
+    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     tHalHandle halHandle;
-    hdd_context_t *pHddCtx;
-    tANI_U8 *pBSSId;
     int status = 0;
 
     hddLog(VOS_TRACE_LEVEL_DEBUG, FL("Flushing PMKSA"));
@@ -11500,33 +11395,14 @@ static int __wlan_hdd_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_devic
 
     /* Retrieve halHandle */
     halHandle = WLAN_HDD_GET_HAL_CTX(pAdapter);
-    pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-
-    /* In case index is 0,no entry to delete */
-    if (0 == pHddStaCtx->PMKIDCacheIndex)
-    {
-       hddLog(VOS_TRACE_LEVEL_INFO, FL("No entries to flush"));
-       return 0;
-    }
-
-    /* Delete all the PMKSA one by one */
-    for (j = 0; j < pHddStaCtx->PMKIDCacheIndex; j++) {
-          pBSSId =(tANI_U8 *)(pHddStaCtx->PMKIDCache[j].BSSID);
 
-          /* Delete the PMKID in CSR */
-          if (eHAL_STATUS_SUCCESS !=
-              sme_RoamDelPMKIDfromCache(halHandle,
-                                        pAdapter->sessionId, pBSSId)) {
-             hddLog(VOS_TRACE_LEVEL_ERROR, FL("Cannot flush PMKIDCache %d"), j);
-             status = -EINVAL;
-          }
-          /* Clear the entry in HDD cache 0--index-1 */
-          vos_mem_zero(pHddStaCtx->PMKIDCache[j].BSSID, VOS_MAC_ADDR_SIZE);
-          vos_mem_zero(pHddStaCtx->PMKIDCache[j].PMKID, CSR_RSN_PMKID_SIZE);
+    /* Flush the PMKID cache in CSR */
+    if (eHAL_STATUS_SUCCESS !=
+        sme_RoamDelPMKIDfromCache(halHandle, pAdapter->sessionId, NULL, TRUE)) {
+       hddLog(VOS_TRACE_LEVEL_ERROR, FL("Cannot flush PMKIDCache"));
+       status = -EINVAL;
     }
 
-    pHddStaCtx->PMKIDCacheIndex = 0;
-
     return status;
 }
 
@@ -13454,15 +13330,31 @@ int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
      * CAC is done for a SoftAP which is in started state.
      */
     status = hdd_get_front_adapter(pHddCtx, &pAdapterNode);
-
     while (NULL != pAdapterNode && VOS_STATUS_SUCCESS == status) {
         pAdapter = pAdapterNode->pAdapter;
-        if (WLAN_HDD_SOFTAP == pAdapter->device_mode  &&
-              BSS_START == WLAN_HDD_GET_HOSTAP_STATE_PTR(pAdapter)->bssState &&
-              VOS_TRUE == WLAN_HDD_GET_AP_CTX_PTR(pAdapter)->dfs_cac_block_tx) {
-           hddLog(VOS_TRACE_LEVEL_DEBUG,
-                 FL("RADAR detection in progress, do not allow suspend"));
-           return -EAGAIN;
+        if (WLAN_HDD_SOFTAP == pAdapter->device_mode) {
+            if (BSS_START ==
+                    WLAN_HDD_GET_HOSTAP_STATE_PTR(pAdapter)->bssState &&
+                VOS_TRUE ==
+                    WLAN_HDD_GET_AP_CTX_PTR(pAdapter)->dfs_cac_block_tx) {
+                hddLog(VOS_TRACE_LEVEL_DEBUG,
+                    FL("RADAR detection in progress, do not allow suspend"));
+                return -EAGAIN;
+            } else if (!pHddCtx->cfg_ini->enableSapSuspend) {
+                /* return -EOPNOTSUPP if SAP does not support suspend
+                 */
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                    "%s:SAP does not support suspend!!", __func__);
+                return -EOPNOTSUPP;
+            }
+        } else if (WLAN_HDD_P2P_GO == pAdapter->device_mode) {
+            if (!pHddCtx->cfg_ini->enableSapSuspend) {
+                /* return -EOPNOTSUPP if GO does not support suspend
+                 */
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                    "%s:GO does not support suspend!!", __func__);
+                return -EOPNOTSUPP;
+            }
         }
         status = hdd_get_next_adapter(pHddCtx, pAdapterNode, &pNext);
         pAdapterNode = pNext;
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index f4c97819d2d4..6897b439e43f 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -2640,6 +2640,23 @@ static iw_softap_setparam(struct net_device *dev,
                         set_value, VDEV_CMD);
                 break;
             }
+#ifdef IPA_UC_OFFLOAD
+        case QCSAP_IPA_UC_STAT:
+            {
+                /* If input value is non-zero get stats */
+                if (set_value) {
+                    ret = process_wma_set_command(
+                         (int)pHostapdAdapter->sessionId,
+                         (int)WMA_VDEV_TXRX_GET_IPA_UC_FW_STATS_CMDID,
+                          0, VDEV_CMD);
+                }
+                else {
+                    /* place holder for stats clean up
+                     * Stats clean not implemented yet on firmware and ipa */
+                }
+                return ret;
+            }
+#endif /* IPA_UC_OFFLOAD */
         default:
             hddLog(LOGE, FL("Invalid setparam command %d value %d"),
                     sub_cmd, set_value);
@@ -4436,7 +4453,6 @@ int iw_get_softap_linkspeed(struct net_device *dev,
    return 0;
 }
 
-
 static const iw_handler      hostapd_handler[] =
 {
    (iw_handler) NULL,           /* SIOCSIWCOMMIT */
@@ -4685,6 +4701,12 @@ static const struct iw_priv_args hostapd_private_args[] = {
         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
         0,
         "setRadar" },
+#ifdef IPA_UC_OFFLOAD
+    {   QCSAP_IPA_UC_STAT,
+        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+        0,
+        "ipaucstat" },
+#endif /* IPA_UC_OFFLOAD */
 
     {   QCASAP_TX_CHAINMASK_CMD,
         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
diff --git a/CORE/HDD/src/wlan_hdd_ipa.c b/CORE/HDD/src/wlan_hdd_ipa.c
index 053b9e870c57..fdf904944ba5 100644
--- a/CORE/HDD/src/wlan_hdd_ipa.c
+++ b/CORE/HDD/src/wlan_hdd_ipa.c
@@ -69,6 +69,7 @@ typedef enum {
 	HDD_IPA_UC_OPCODE_TX_RESUME  = 1,
 	HDD_IPA_UC_OPCODE_RX_SUSPEND = 2,
 	HDD_IPA_UC_OPCODE_RX_RESUME  = 3,
+	HDD_IPA_UC_OPCODE_STATS      = 4,
 	/* keep this last */
 	HDD_IPA_UC_OPCODE_MAX
 } hdd_ipa_uc_op_code;
@@ -280,8 +281,53 @@ struct hdd_ipa_stats {
 
 	uint64_t num_freeq_empty;
 	uint64_t num_pri_freeq_empty;
+	uint64_t num_rx_excep;
 };
 
+#ifdef IPA_UC_OFFLOAD
+struct op_msg_type {
+	uint8_t msg_t;
+	uint8_t rsvd;
+	uint16_t op_code;
+	uint16_t len;
+	uint16_t rsvd_snd;
+};
+
+struct ipa_uc_fw_stats {
+	uint32_t tx_comp_ring_base;
+	uint32_t tx_comp_ring_size;
+	uint32_t tx_comp_ring_dbell_addr;
+	uint32_t tx_comp_ring_dbell_ind_val;
+	uint32_t tx_comp_ring_dbell_cached_val;
+	uint32_t tx_pkts_enqueued;
+	uint32_t tx_pkts_completed;
+	uint32_t tx_is_suspend;
+	uint32_t tx_reserved;
+	uint32_t rx_ind_ring_base;
+	uint32_t rx_ind_ring_size;
+	uint32_t rx_ind_ring_dbell_addr;
+	uint32_t rx_ind_ring_dbell_ind_val;
+	uint32_t rx_ind_ring_dbell_ind_cached_val;
+	uint32_t rx_ind_ring_rdidx_addr;
+	uint32_t rx_ind_ring_rd_idx_cached_val;
+	uint32_t rx_refill_idx;
+	uint32_t rx_num_pkts_indicated;
+	uint32_t rx_buf_refilled;
+	uint32_t rx_num_ind_drop_no_space;
+	uint32_t rx_num_ind_drop_no_buf;
+	uint32_t rx_is_suspend;
+	uint32_t rx_reserved;
+};
+
+static const char *op_string[] = {
+	"TX_SUSPEND",
+	"TX_RESUME",
+	"RX_SUSPEND",
+	"RX_RESUME",
+	"STATS",
+};
+#endif /* IPA_UC_OFFLOAD */
+
 struct hdd_ipa_priv {
 	struct hdd_ipa_sys_pipe sys_pipe[HDD_IPA_MAX_SYSBAM_PIPE];
 	struct hdd_ipa_iface_context iface_context[HDD_IPA_MAX_IFACE];
@@ -333,15 +379,6 @@ struct hdd_ipa_priv {
 #endif /* IPA_UC_OFFLOAD */
 };
 
-#ifdef IPA_UC_OFFLOAD
-static const char *op_string[] = {
-	"TX_SUSPEND",
-	"TX_RESUME",
-	"RX_SUSPEND",
-	"RX_RESUME",
-};
-#endif /* IPA_UC_OFFLOAD */
-
 static struct hdd_ipa_priv *ghdd_ipa;
 
 #define HDD_IPA_ENABLE_MASK			BIT(0)
@@ -750,15 +787,203 @@ void hdd_ipa_uc_rm_notify_defer(void *hdd_ipa, enum ipa_rm_event event)
 	vos_indicate_rxpkt(sched_ctx, pkt);
 }
 
-static void hdd_ipa_uc_op_cb(v_U8_t op_code)
+static void hdd_ipa_uc_op_cb(v_U8_t *op_msg, void *usr_ctxt)
 {
-	if (HDD_IPA_UC_OPCODE_MAX <= op_code) {
+	struct op_msg_type *msg;
+	struct ipa_uc_fw_stats *uc_fw_stat;
+	struct IpaHwStatsWDIInfoData_t ipa_stat;
+	struct hdd_ipa_priv *hdd_ipa;
+	hdd_context_t *hdd_ctx;
+
+	if (!op_msg || !usr_ctxt) {
 		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
-			"%s, INVALID OPCODE %d", __func__, op_code);
+			"%s, INVALID ARG", __func__);
 		return;
 	}
+
+	msg = (struct op_msg_type *)op_msg;
+	if (HDD_IPA_UC_OPCODE_MAX <= msg->op_code) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"%s, INVALID OPCODE %d", __func__, msg->op_code);
+		return;
+	}
+
+	hdd_ctx = (hdd_context_t *)usr_ctxt;
+	hdd_ipa = (struct hdd_ipa_priv *)hdd_ctx->hdd_ipa;
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_DEBUG,
-		"%s, OPCODE %s", __func__, op_string[op_code]);
+		"%s, OPCODE %s", __func__, op_string[msg->op_code]);
+	if (HDD_IPA_UC_OPCODE_STATS == msg->op_code) {
+
+		/* STATs from host */
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"==== IPA_UC WLAN_HOST CE ====\n"
+			"CE RING BASE: 0x%x\n"
+			"CE RING SIZE: %d\n"
+			"CE REG ADDR : 0x%x",
+			hdd_ctx->ce_sr_base_paddr,
+			hdd_ctx->ce_sr_ring_size,
+			hdd_ctx->ce_reg_paddr);
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"==== IPA_UC WLAN_HOST TX ====\n"
+			"COMP RING BASE: 0x%x\n"
+			"COMP RING SIZE: %d\n"
+			"NUM ALLOC BUF: %d\n"
+			"COMP RING DBELL : 0x%x",
+			hdd_ctx->tx_comp_ring_base_paddr,
+			hdd_ctx->tx_comp_ring_size,
+			hdd_ctx->tx_num_alloc_buffer,
+			hdd_ctx->tx_comp_doorbell_paddr);
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"==== IPA_UC WLAN_HOST RX ====\n"
+			"IND RING BASE: 0x%x\n"
+			"IND RING SIZE: %d\n"
+			"IND RING DBELL : 0x%x\n"
+			"PROC DONE IND ADDR : 0x%x\n"
+			"NUM EXCP PKT : %llu",
+			hdd_ctx->rx_rdy_ring_base_paddr,
+			hdd_ctx->rx_rdy_ring_size,
+			hdd_ctx->rx_ready_doorbell_paddr,
+			hdd_ctx->rx_proc_done_idx_paddr,
+			hdd_ipa->stats.num_rx_excep);
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"==== IPA_UC WLAN_HOST CONTROL ====\n"
+			"NUM STAs: %d\n"
+			"TX PIPE HDL: %d\n"
+			"RX PIPE HDL : %d\n"
+			"RSC LOADING : %d\n"
+			"RSC UNLOADING : %d\n"
+			"PNDNG CNS RQT : %d",
+			hdd_ipa->sap_num_connected_sta,
+			hdd_ipa->tx_pipe_handle,
+			hdd_ipa->rx_pipe_handle,
+			(unsigned int)hdd_ipa->resource_loading,
+			(unsigned int)hdd_ipa->resource_unloading,
+			(unsigned int)hdd_ipa->pending_cons_req);
+
+		/* STATs from FW */
+		uc_fw_stat = (struct ipa_uc_fw_stats *)
+			(op_msg + sizeof(struct op_msg_type));
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"==== IPA_UC WLAN_FW TX ====\n"
+			"COMP RING BASE: 0x%x\n"
+			"COMP RING SIZE: %d\n"
+			"COMP RING DBELL : 0x%x\n"
+			"COMP RING DBELL IND VAL : %d\n"
+			"COMP RING DBELL CACHED VAL : %d\n"
+			"COMP RING DBELL CACHED VAL : %d\n"
+			"PKTS ENQ : %d\n"
+			"PKTS COMP : %d\n"
+			"IS SUSPEND : %d\n"
+			"RSVD : 0x%x",
+			uc_fw_stat->tx_comp_ring_base,
+			uc_fw_stat->tx_comp_ring_size,
+			uc_fw_stat->tx_comp_ring_dbell_addr,
+			uc_fw_stat->tx_comp_ring_dbell_ind_val,
+			uc_fw_stat->tx_comp_ring_dbell_cached_val,
+			uc_fw_stat->tx_comp_ring_dbell_cached_val,
+			uc_fw_stat->tx_pkts_enqueued,
+			uc_fw_stat->tx_pkts_completed,
+			uc_fw_stat->tx_is_suspend,
+			uc_fw_stat->tx_reserved);
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"==== IPA_UC WLAN_FW RX ====\n"
+			"IND RING BASE: 0x%x\n"
+			"IND RING SIZE: %d\n"
+			"IND RING DBELL : 0x%x\n"
+			"IND RING DBELL IND VAL : %d\n"
+			"IND RING DBELL CACHED VAL : %d\n"
+			"RDY IND ADDR : 0x%x\n"
+			"RDY IND CACHE VAL : %d\n"
+			"RFIL IND : %d\n"
+			"NUM PKT INDICAT : %d\n"
+			"BUF REFIL : %d\n"
+			"NUM DROP NO SPC : %d\n"
+			"NUM DROP NO BUF : %d\n"
+			"IS SUSPND : %d\n"
+			"RSVD : 0x%x\n",
+			uc_fw_stat->rx_ind_ring_base,
+			uc_fw_stat->rx_ind_ring_size,
+			uc_fw_stat->rx_ind_ring_dbell_addr,
+			uc_fw_stat->rx_ind_ring_dbell_ind_val,
+			uc_fw_stat->rx_ind_ring_dbell_ind_cached_val,
+			uc_fw_stat->rx_ind_ring_rdidx_addr,
+			uc_fw_stat->rx_ind_ring_rd_idx_cached_val,
+			uc_fw_stat->rx_refill_idx,
+			uc_fw_stat->rx_num_pkts_indicated,
+			uc_fw_stat->rx_buf_refilled,
+			uc_fw_stat->rx_num_ind_drop_no_space,
+			uc_fw_stat->rx_num_ind_drop_no_buf,
+			uc_fw_stat->rx_is_suspend,
+			uc_fw_stat->rx_reserved);
+		/* STATs from IPA */
+		ipa_get_wdi_stats(&ipa_stat);
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"==== IPA_UC IPA TX ====\n"
+			"NUM PROCD : %d\n"
+			"CE DBELL : 0x%x\n"
+			"NUM DBELL FIRED : %d\n"
+			"COMP RNG FULL : %d\n"
+			"COMP RNG EMPT : %d\n"
+			"COMP RNG USE HGH : %d\n"
+			"COMP RNG USE LOW : %d\n"
+			"BAM FIFO FULL : %d\n"
+			"BAM FIFO EMPT : %d\n"
+			"BAM FIFO USE HGH : %d\n"
+			"BAM FIFO USE LOW : %d\n"
+			"NUM DBELL : %d\n"
+			"NUM UNEXP DBELL : %d\n"
+			"NUM BAM INT HDL : 0x%x\n"
+			"NUM BAM INT NON-RUN : 0x%x\n"
+			"NUM QMB INT HDL : 0x%x",
+			ipa_stat.tx_ch_stats.num_pkts_processed,
+			ipa_stat.tx_ch_stats.copy_engine_doorbell_value,
+			ipa_stat.tx_ch_stats.num_db_fired,
+			ipa_stat.tx_ch_stats.tx_comp_ring_stats.ringFull,
+			ipa_stat.tx_ch_stats.tx_comp_ring_stats.ringEmpty,
+			ipa_stat.tx_ch_stats.tx_comp_ring_stats.ringUsageHigh,
+			ipa_stat.tx_ch_stats.tx_comp_ring_stats.ringUsageLow,
+			ipa_stat.tx_ch_stats.bam_stats.bamFifoFull,
+			ipa_stat.tx_ch_stats.bam_stats.bamFifoEmpty,
+			ipa_stat.tx_ch_stats.bam_stats.bamFifoUsageHigh,
+			ipa_stat.tx_ch_stats.bam_stats.bamFifoUsageLow,
+			ipa_stat.tx_ch_stats.num_db,
+			ipa_stat.tx_ch_stats.num_unexpected_db,
+			ipa_stat.tx_ch_stats.num_bam_int_handled,
+			ipa_stat.tx_ch_stats.num_bam_int_in_non_runnning_state,
+			ipa_stat.tx_ch_stats.num_qmb_int_handled);
+
+		VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+			"==== IPA_UC IPA RX ====\n"
+			"MAX OST PKT : %d\n"
+			"NUM PKT PRCSD : %d\n"
+			"RNG RP : 0x%x\n"
+			"COMP RNG FULL : %d\n"
+			"COMP RNG EMPT : %d\n"
+			"COMP RNG USE HGH : %d\n"
+			"COMP RNG USE LOW : %d\n"
+			"BAM FIFO FULL : %d\n"
+			"BAM FIFO EMPT : %d\n"
+			"BAM FIFO USE HGH : %d\n"
+			"BAM FIFO USE LOW : %d\n"
+			"NUM DB : %d\n"
+			"NUM UNEXP DB : %d\n"
+			"NUM BAM INT HNDL : 0x%x\n",
+			ipa_stat.rx_ch_stats.max_outstanding_pkts,
+			ipa_stat.rx_ch_stats.num_pkts_processed,
+			ipa_stat.rx_ch_stats.rx_ring_rp_value,
+			ipa_stat.rx_ch_stats.rx_ind_ring_stats.ringFull,
+			ipa_stat.rx_ch_stats.rx_ind_ring_stats.ringEmpty,
+			ipa_stat.rx_ch_stats.rx_ind_ring_stats.ringUsageHigh,
+			ipa_stat.rx_ch_stats.rx_ind_ring_stats.ringUsageLow,
+			ipa_stat.rx_ch_stats.bam_stats.bamFifoFull,
+			ipa_stat.rx_ch_stats.bam_stats.bamFifoEmpty,
+			ipa_stat.rx_ch_stats.bam_stats.bamFifoUsageHigh,
+			ipa_stat.rx_ch_stats.bam_stats.bamFifoUsageLow,
+			ipa_stat.rx_ch_stats.num_db,
+			ipa_stat.rx_ch_stats.num_unexpected_db,
+			ipa_stat.rx_ch_stats.num_bam_int_handled);
+	}
+	vos_mem_free(op_msg);
 }
 
 static hdd_adapter_t *hdd_ipa_uc_get_adapter(struct hdd_ipa_priv *hdd_ipa,
@@ -810,12 +1035,6 @@ static VOS_STATUS hdd_ipa_uc_ol_init(hdd_context_t *hdd_ctx)
 	pipe_in.u.dl.ce_door_bell_pa = hdd_ctx->ce_reg_paddr;
 	pipe_in.u.dl.ce_ring_size = hdd_ctx->ce_sr_ring_size * 8;
 	pipe_in.u.dl.num_tx_buffers  = hdd_ctx->tx_num_alloc_buffer;
-	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO_HIGH,
-		"MAX TX COMP ELEMENT %d",
-		(unsigned int)hdd_ctx->cfg_ini->IpaUcTxBufCount);
-	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO_HIGH,
-		"TX COMP RING SIZE %d",
-		(unsigned int)pipe_in.u.dl.comp_ring_size);
 
 	/* Connect WDI IPA PIPE */
 	ipa_connect_wdi_pipe(&pipe_in, &pipe_out);
@@ -824,7 +1043,14 @@ static VOS_STATUS hdd_ipa_uc_ol_init(hdd_context_t *hdd_ctx)
 	/* WLAN TX PIPE Handle */
 	ipa_ctxt->tx_pipe_handle = pipe_out.clnt_hdl;
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO_HIGH,
-		"TX COMP IPA DOORBELL %x",
+		"TX : CRBPA 0x%x, CRS %d, CERBPA 0x%x, CEDPA 0x%x,"
+		" CERZ %d, NB %d, CDBPAD 0x%x",
+		(unsigned int)pipe_in.u.dl.comp_ring_base_pa,
+		pipe_in.u.dl.comp_ring_size,
+		(unsigned int)pipe_in.u.dl.ce_ring_base_pa,
+		(unsigned int)pipe_in.u.dl.ce_door_bell_pa,
+		pipe_in.u.dl.ce_ring_size,
+		pipe_in.u.dl.num_tx_buffers,
 		(unsigned int)hdd_ctx->tx_comp_doorbell_paddr);
 
 	/* RX PIPE */
@@ -846,15 +1072,16 @@ static VOS_STATUS hdd_ipa_uc_ol_init(hdd_context_t *hdd_ctx)
 	pipe_in.u.ul.rdy_ring_base_pa = hdd_ctx->rx_rdy_ring_base_paddr;
 	pipe_in.u.ul.rdy_ring_size = hdd_ctx->rx_rdy_ring_size;
 	pipe_in.u.ul.rdy_ring_rp_pa = hdd_ctx->rx_proc_done_idx_paddr;
-	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO_HIGH,
-		"RX RING SIZE %d",
-		(unsigned int)pipe_in.u.ul.rdy_ring_size);
+
 
 	ipa_connect_wdi_pipe(&pipe_in, &pipe_out);
 	hdd_ctx->rx_ready_doorbell_paddr = pipe_out.uc_door_bell_pa;
 	ipa_ctxt->rx_pipe_handle = pipe_out.clnt_hdl;
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO_HIGH,
-		"RX READY IPA DOORBELL %x",
+		"RX : RRBPA 0x%x, RRS %d, PDIPA 0x%x, RDY_DB_PAD 0x%x",
+		(unsigned int)pipe_in.u.ul.rdy_ring_base_pa,
+		pipe_in.u.ul.rdy_ring_size,
+		(unsigned int)pipe_in.u.ul.rdy_ring_rp_pa,
 		(unsigned int)hdd_ctx->rx_ready_doorbell_paddr);
 
 	WLANTL_SetUcDoorbellPaddr((pVosContextType)(hdd_ctx->pvosContext),
@@ -862,7 +1089,7 @@ static VOS_STATUS hdd_ipa_uc_ol_init(hdd_context_t *hdd_ctx)
 			(v_U32_t)hdd_ctx->rx_ready_doorbell_paddr);
 
 	WLANTL_RegisterOPCbFnc((pVosContextType)(hdd_ctx->pvosContext),
-			hdd_ipa_uc_op_cb);
+			hdd_ipa_uc_op_cb, (void *)hdd_ctx);
 
 	return VOS_STATUS_SUCCESS;
 }
@@ -1595,6 +1822,7 @@ static void hdd_ipa_w2i_cb(void *priv, enum ipa_dp_evt_type evt,
 				8);
 #ifdef IPA_UC_OFFLOAD
 		if (hdd_ipa_uc_is_enabled(hdd_ipa)) {
+			hdd_ipa->stats.num_rx_excep++;
 			skb_pull(skb, HDD_IPA_UC_WLAN_CLD_HDR_LEN);
 		} else
 #endif /* IPA_UC_OFFLOAD */
@@ -2351,7 +2579,8 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 	int ret;
 
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO, "%s: %s evt, MAC: %pM sta_id: %d",
-			adapter->dev->name, hdd_ipa_wlan_event_to_str(type), mac_addr,
+			adapter->dev->name, hdd_ipa_wlan_event_to_str(type),
+			mac_addr,
 			sta_id);
 
 	if (type >= IPA_WLAN_EVENT_MAX)
@@ -2360,6 +2589,13 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 	if (WARN_ON(is_zero_ether_addr(mac_addr)))
 		return -EINVAL;
 
+#ifdef IPA_UC_OFFLOAD
+	if (hdd_ipa_uc_is_enabled(hdd_ipa) &&
+		(WLAN_HDD_SOFTAP != adapter->device_mode)) {
+		return 0;
+	}
+#endif /* IPA_UC_OFFLOAD */
+
 	hdd_ipa->stats.event[type]++;
 
 	switch (type) {
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 781f57ac6761..4c6e2aa50f72 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -6641,8 +6641,26 @@ void hdd_update_tgt_cfg(void *context, void *param)
 {
     hdd_context_t *hdd_ctx = (hdd_context_t *)context;
     struct hdd_tgt_cfg *cfg = (struct hdd_tgt_cfg *)param;
+    tANI_U8 temp_band_cap;
+
+    /* first store the INI band capability */
+    temp_band_cap = hdd_ctx->cfg_ini->nBandCapability;
+
     hdd_ctx->cfg_ini->nBandCapability = cfg->band_cap;
 
+    /* now overwrite the target band capability with INI
+       setting if INI setting is a subset */
+
+    if ((hdd_ctx->cfg_ini->nBandCapability == eCSR_BAND_ALL) &&
+        (temp_band_cap != eCSR_BAND_ALL))
+        hdd_ctx->cfg_ini->nBandCapability = temp_band_cap;
+    else if ((hdd_ctx->cfg_ini->nBandCapability != eCSR_BAND_ALL) &&
+             (temp_band_cap != eCSR_BAND_ALL) &&
+             (hdd_ctx->cfg_ini->nBandCapability != temp_band_cap)) {
+        hddLog(VOS_TRACE_LEVEL_WARN,
+               FL("ini BandCapability not supported by the target"));
+    }
+
     hdd_ctx->reg.reg_domain = cfg->reg_domain;
     hdd_ctx->reg.eeprom_rd_ext = cfg->eeprom_rd_ext;
 
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 071c2fc07e86..139e7b7d94d9 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            175
+#define QWLAN_VERSION_BUILD            176
 
-#define QWLAN_VERSIONSTR               "1.0.0.175A"
+#define QWLAN_VERSIONSTR               "1.0.0.176"
 
 
 #define AR6320_REV1_VERSION             0x5000000
diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index 31e790cb95a7..47a457e29967 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -742,6 +742,7 @@ typedef struct sSirBssDescription
 #ifdef FEATURE_WLAN_ESE
     tANI_U16             QBSSLoad_present;
     tANI_U16             QBSSLoad_avail;
+    tANI_U32             reservedPadding5; // To achieve 8-byte alignment with ESE enabled
 #endif
     // Please keep the structure 4 bytes aligned above the ieFields
 
diff --git a/CORE/MAC/src/pe/rrm/rrmApi.c b/CORE/MAC/src/pe/rrm/rrmApi.c
index 271802d0682e..c0975debfe2f 100644
--- a/CORE/MAC/src/pe/rrm/rrmApi.c
+++ b/CORE/MAC/src/pe/rrm/rrmApi.c
@@ -667,7 +667,8 @@ rrmFillBeaconIes( tpAniSirGlobal pMac,
                   tANI_U8 *eids, tANI_U8 numEids,
                   tpSirBssDescription pBssDesc )
 {
-   tANI_U8 len, *pBcnIes, BcnNumIes, count = 0, i;
+   tANI_U8 len, *pBcnIes, count = 0, i;
+   tANI_S8 BcnNumIes;
 
    if( (pIes == NULL) || (pNumIes == NULL) || (pBssDesc == NULL) )
    {
@@ -679,7 +680,7 @@ rrmFillBeaconIes( tpAniSirGlobal pMac,
    numEids = (eids == NULL) ? 0 : numEids;
 
    pBcnIes = (tANI_U8*) &pBssDesc->ieFields[0];
-   BcnNumIes = (tANI_U8)GET_IE_LEN_IN_BSS( pBssDesc->length );
+   BcnNumIes = (tANI_S8)GET_IE_LEN_IN_BSS( pBssDesc->length );
 
    *pNumIes = 0;
 
diff --git a/CORE/SERVICES/COMMON/dbglog.h b/CORE/SERVICES/COMMON/dbglog.h
index afc3bb0e02eb..c7ac9e963b31 100644
--- a/CORE/SERVICES/COMMON/dbglog.h
+++ b/CORE/SERVICES/COMMON/dbglog.h
@@ -87,6 +87,49 @@ extern "C" {
     ((arg & DBGLOG_TIMESTAMP_MASK) >> DBGLOG_TIMESTAMP_OFFSET)
 
 
+#define DIAG_FWID_OFFSET            24
+#define DIAG_FWID_MASK              0xFF000000 /* Bit 24-31 */
+
+#define DIAG_TIMESTAMP_OFFSET       0
+#define DIAG_TIMESTAMP_MASK         0x00FFFFFF /* Bit 0-23 */
+
+#define DIAG_ID_OFFSET              16
+#define DIAG_ID_MASK                0xFFFF0000 /* Bit 16-31 */
+
+#define DIAG_VDEVID_OFFSET          11
+#define DIAG_VDEVID_MASK            0x0000F800 /* Bit 11-15 */
+#define DIAG_VDEVID_NUM_MAX         16
+
+#define DIAG_VDEVLEVEL_OFFSET       8
+#define DIAG_VDEVLEVEL_MASK         0x00000700 /* Bit 8-10 */
+
+#define DIAG_PAYLEN_OFFSET          0
+#define DIAG_PAYLEN_MASK            0x000000FF /* Bit 0-7 */
+
+#define DIAG_PAYLEN_OFFSET16        0
+#define DIAG_PAYLEN_MASK16          0x0000FFFF /* Bit 0-16 */
+
+#define DIAG_GET_TYPE(arg) \
+    ((arg & DIAG_FWID_MASK) >> DIAG_FWID_OFFSET)
+
+#define DIAG_GET_TIME_STAMP(arg) \
+    ((arg & DIAG_TIMESTAMP_MASK) >> DIAG_TIMESTAMP_OFFSET)
+
+#define DIAG_GET_ID(arg) \
+    ((arg & DIAG_ID_MASK) >> DIAG_ID_OFFSET)
+
+#define DIAG_GET_VDEVID(arg) \
+    ((arg & DIAG_VDEVID_MASK) >> DIAG_VDEVID_OFFSET)
+
+#define DIAG_GET_VDEVLEVEL(arg) \
+    ((arg & DIAG_VDEVLEVEL_MASK) >> DIAG_VDEVLEVEL_OFFSET)
+
+#define DIAG_GET_PAYLEN(arg) \
+    ((arg & DIAG_PAYLEN_MASK) >> DIAG_PAYLEN_OFFSET)
+
+#define DIAG_GET_PAYLEN16(arg) \
+    ((arg & DIAG_PAYLEN_MASK16) >> DIAG_PAYLEN_OFFSET16)
+
 /* Debug Log levels*/
 
 typedef enum {
diff --git a/CORE/SERVICES/COMMON/dbglog_host.h b/CORE/SERVICES/COMMON/dbglog_host.h
index 47939ee8221e..247cb7c35472 100644
--- a/CORE/SERVICES/COMMON/dbglog_host.h
+++ b/CORE/SERVICES/COMMON/dbglog_host.h
@@ -68,6 +68,18 @@ extern "C" {
 
 #define CNSS_DIAG_SLEEP_INTERVAL    5 /* In secs */
 
+#define SIZEOF_NL_MSG_LOAD     28 /* sizeof nlmsg and load length */
+#define SIZEOF_NL_MSG_UNLOAD   28 /* sizeof nlmsg and Unload length */
+#define SIZEOF_NL_MSG_DBG_MSG  1532
+#define ATH6KL_FWLOG_MAX_ENTRIES   20
+#define ATH6KL_FWLOG_PAYLOAD_SIZE  1500
+
+#define DIAG_WLAN_DRIVER_UNLOADED 6
+#define DIAG_WLAN_DRIVER_LOADED   7
+#define DIAG_TYPE_LOGS   1
+#define DIAG_TYPE_EVENTS 2
+
+
 typedef enum {
     DBGLOG_PROCESS_DEFAULT = 0,
     DBGLOG_PROCESS_PRINT_RAW, /* print them in debug view */
@@ -77,14 +89,27 @@ typedef enum {
 } dbglog_process_t;
 
 enum cnss_diag_type {
-    DIAG_TYPE_FW_EVENT,
-    DIAG_TYPE_FW_LOG,
-    DIAG_TYPE_FW_DEBUG_MSG
+    DIAG_TYPE_FW_EVENT,     /* send fw event- to diag*/
+    DIAG_TYPE_FW_LOG,       /* send log event- to diag*/
+    DIAG_TYPE_FW_DEBUG_MSG, /* send dbg message- to diag*/
+    DIAG_TYPE_INIT_REQ,     /* cnss_diag nitialization- from diag */
+    DIAG_TYPE_FW_MSG,       /* fw msg command-to diag */
+    DIAG_TYPE_HOST_MSG,     /* host command-to diag */
+    DIAG_TYPE_CRASH_INJECT, /*crash inject-from diag */
+    DIAG_TYPE_DBG_LEVEL,    /* DBG LEVEL-from diag */
 };
 
-#define SIZEOF_NL_MSG_LOAD     28 /* sizeof nlmsg and load length */
-#define SIZEOF_NL_MSG_UNLOAD   28 /* sizeof nlmsg and Unload length */
-#define SIZEOF_NL_MSG_DBG_MSG  1532
+enum wlan_diag_config_type {
+    DIAG_VERSION_INFO,
+};
+
+enum wlan_diag_frame_type {
+    WLAN_DIAG_TYPE_CONFIG,
+    WLAN_DIAG_TYPE_EVENT,
+    WLAN_DIAG_TYPE_LOG,
+    WLAN_DIAG_TYPE_MSG,
+    WLAN_DIAG_TYPE_LEGACY_MSG,
+};
 
 /* log/event are always 32-bit aligned. Padding is inserted after
  * optional payload to satisify this requirement */
@@ -105,10 +130,21 @@ struct dbglog_slot {
     u_int8_t payload[0];
 }__packed;
 
-
-#define ATH6KL_FWLOG_MAX_ENTRIES                20
-
-#define ATH6KL_FWLOG_PAYLOAD_SIZE              1500
+typedef struct event_report_s {
+    unsigned int diag_type;
+    unsigned short event_id;
+    unsigned short length;
+} event_report_t;
+
+typedef struct wlan_bringup_s {
+    unsigned short wlanStatus;
+    char driverVersion[10];
+} wlan_bringup_t;
+
+static inline unsigned int get_32(const unsigned char *pos)
+{
+    return pos[0] | (pos[1] << 8) | (pos[2] << 16) | (pos[3] << 24);
+}
 
 /*
  * set the dbglog parser type
diff --git a/CORE/SERVICES/COMMON/ol_htt_api.h b/CORE/SERVICES/COMMON/ol_htt_api.h
index 5e26c0d089e1..3df24b466b39 100644
--- a/CORE/SERVICES/COMMON/ol_htt_api.h
+++ b/CORE/SERVICES/COMMON/ol_htt_api.h
@@ -289,6 +289,14 @@ htt_h2t_ipa_uc_set_active(struct htt_pdev_t *pdev,
    a_bool_t is_tx);
 
 /**
+ * @brief query uc data path stats
+ *
+ * @param pdev - handle to the HTT instance
+ */
+int
+htt_h2t_ipa_uc_get_stats(struct htt_pdev_t *pdev);
+
+/**
  * @brief Attach IPA UC data path
  *
  * @param pdev - handle to the HTT instance
diff --git a/CORE/SERVICES/COMMON/ol_htt_tx_api.h b/CORE/SERVICES/COMMON/ol_htt_tx_api.h
index 68237dc5f252..6c5d5da75939 100644
--- a/CORE/SERVICES/COMMON/ol_htt_tx_api.h
+++ b/CORE/SERVICES/COMMON/ol_htt_tx_api.h
@@ -401,7 +401,8 @@ htt_tx_desc_init(
     HTT_TX_DESC_VDEV_ID_SET(local_word0, msdu_info->info.vdev_id);
     HTT_TX_DESC_EXT_TID_SET(local_word0, msdu_info->info.ext_tid);
     HTT_TX_DESC_CKSUM_OFFLOAD_SET(local_word0, msdu_info->action.cksum_offload);
-    HTT_TX_DESC_TX_COMP_SET(local_word0, msdu_info->action.tx_comp_req);
+    if (pdev->cfg.is_high_latency)
+        HTT_TX_DESC_TX_COMP_SET(local_word0, msdu_info->action.tx_comp_req);
     HTT_TX_DESC_NO_ENCRYPT_SET(local_word0, msdu_info->action.do_encrypt ? 0 : 1);
     *word0 = local_word0;
 
diff --git a/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h b/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
index 651f15e3140e..730b350ee009 100644
--- a/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
+++ b/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
@@ -1180,7 +1180,7 @@ ol_txrx_ipa_uc_set_active(
 void
 ol_txrx_ipa_uc_op_response(
    ol_txrx_pdev_handle pdev,
-   u_int8_t op_code);
+   u_int8_t *op_msg);
 
 /**
  * @brief callback function registration
@@ -1195,8 +1195,17 @@ ol_txrx_ipa_uc_op_response(
  */
 void ol_txrx_ipa_uc_register_op_cb(
    ol_txrx_pdev_handle pdev,
-   void (*ipa_uc_op_cb_type)(u_int8_t op_code, void *osif_ctxt),
+   void (*ipa_uc_op_cb_type)(u_int8_t *op_msg, void *osif_ctxt),
    void *osif_dev);
+
+/**
+ * @brief query uc data path stats
+ * @details
+ *  Query uc data path stats from firmware
+ *
+ * @param pdev - handle to the HTT instance
+ */
+void ol_txrx_ipa_uc_get_stat(ol_txrx_pdev_handle pdev);
 #else
 #define ol_txrx_ipa_uc_get_resource(          \
    pdev,                                      \
@@ -1222,12 +1231,14 @@ void ol_txrx_ipa_uc_register_op_cb(
 
 #define ol_txrx_ipa_uc_op_response(           \
    pdev,                                      \
-   op_code) /* NO-OP */
+   op_data) /* NO-OP */
 
 #define ol_txrx_ipa_uc_register_op_cb(        \
    pdev,                                      \
    ipa_uc_op_cb_type,                         \
    osif_dev) /* NO-OP */
+
+#define ol_txrx_ipa_uc_get_stat(pdev) /* NO-OP */
 #endif /* IPA_UC_OFFLOAD */
 
 #endif /* _OL_TXRX_CTRL_API__H_ */
diff --git a/CORE/SERVICES/COMMON/wmi_tlv_defs.h b/CORE/SERVICES/COMMON/wmi_tlv_defs.h
index 94a01e9cb167..4068b000795e 100644
--- a/CORE/SERVICES/COMMON/wmi_tlv_defs.h
+++ b/CORE/SERVICES/COMMON/wmi_tlv_defs.h
@@ -502,7 +502,9 @@ typedef enum {
     WMITLV_TAG_STRUC_wmi_lpi_handoff_event_fixed_param,
     WMITLV_TAG_STRUC_wmi_vdev_rate_stats_event_fixed_param,
     WMITLV_TAG_STRUC_wmi_vdev_rate_ht_info,
-    WMITLV_TAG_STRUC_wmi_ric_request_fixed_param
+    WMITLV_TAG_STRUC_wmi_ric_request_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_get_temperature_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_temperature_event_fixed_param
 } WMITLV_TAG_ID;
 
 /*
@@ -687,7 +689,9 @@ typedef enum {
     OP(WMI_EXTWOW_ENABLE_CMDID) \
     OP(WMI_EXTWOW_SET_APP_TYPE1_PARAMS_CMDID) \
     OP(WMI_EXTWOW_SET_APP_TYPE2_PARAMS_CMDID) \
-    OP(WMI_ROAM_SET_RIC_REQUEST_CMDID)
+    OP(WMI_ROAM_SET_RIC_REQUEST_CMDID) \
+    OP(WMI_PDEV_GET_TEMPERATURE_CMDID)
+
 
 
 /*
@@ -776,6 +780,8 @@ typedef enum {
     OP(WMI_LPI_STATUS_EVENTID) \
     OP(WMI_LPI_HANDOFF_EVENTID) \
     OP(WMI_UPDATE_VDEV_RATE_STATS_EVENTID) \
+    OP(WMI_PDEV_TEMPERATURE_EVENTID) \
+    OP(WMI_DIAG_EVENTID)
 
 /* TLV definitions of WMI commands */
 
@@ -1898,6 +1904,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_CHAN_AVOID_UPDATE_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_d0_wow_enable_disable_cmd_fixed_param, wmi_d0_wow_enable_disable_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_D0_WOW_ENABLE_DISABLE_CMDID);
 
+/* Pdev get chip temperature Cmd */
+#define WMITLV_TABLE_WMI_PDEV_GET_TEMPERATURE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_get_temperature_cmd_fixed_param, wmi_pdev_get_temperature_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_GET_TEMPERATURE_CMDID);
+
 /************************** TLV definitions of WMI events *******************************/
 
 /* Service Ready event */
@@ -2115,6 +2126,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_RFKILL_STATE_CHANGE_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_DEBUG_MESG_EVENTID);
 
+/* Diagnostics Event */
+#define WMITLV_TABLE_WMI_DIAG_EVENTID(id,op,buf,len)\
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_DIAG_EVENTID);
+
 /* IGTK Offload Event */
 #define WMITLV_TABLE_WMI_GTK_OFFLOAD_STATUS_EVENTID(id,op,buf,len)\
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_WMI_GTK_OFFLOAD_STATUS_EVENT_fixed_param, WMI_GTK_OFFLOAD_STATUS_EVENT_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2342,6 +2358,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PEER_STATE_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_d0_wow_disable_ack_event_fixed_param, wmi_d0_wow_disable_ack_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_D0_WOW_DISABLE_ACK_EVENTID);
 
+/* Pdev get chip temperature event */
+#define WMITLV_TABLE_WMI_PDEV_TEMPERATURE_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_temperature_event_fixed_param, wmi_pdev_temperature_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_TEMPERATURE_EVENTID);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/CORE/SERVICES/COMMON/wmi_unified.h b/CORE/SERVICES/COMMON/wmi_unified.h
index 7402a59d40b2..10777815896b 100644
--- a/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/CORE/SERVICES/COMMON/wmi_unified.h
@@ -238,6 +238,8 @@ typedef enum {
     WMI_PDEV_DUMP_CMDID,
      /* set LED configuration  */
     WMI_PDEV_SET_LED_CONFIG_CMDID,
+    /* Get Current temprature of chip in Celcius degree*/
+    WMI_PDEV_GET_TEMPERATURE_CMDID,
 
     /* VDEV(virtual device) specific commands */
     /** vdev create */
@@ -702,6 +704,9 @@ typedef enum {
     /** track L1SS entry and residency event */
     WMI_PDEV_L1SS_TRACK_EVENTID,
 
+    /** Report current temprature of the chip in Celcius degree */
+    WMI_PDEV_TEMPERATURE_EVENTID,
+
     /* VDEV specific events */
     /** VDEV started event in response to VDEV_START request */
     WMI_VDEV_START_RESP_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_VDEV),
@@ -870,6 +875,8 @@ typedef enum {
     /*update ht/vht info based on vdev (rx and tx NSS and preamble)*/
     WMI_UPDATE_VDEV_RATE_STATS_EVENTID,
 
+    WMI_DIAG_EVENTID,
+
     /* GPIO Event */
     WMI_GPIO_INPUT_EVENTID=WMI_EVT_GRP_START_ID(WMI_GRP_GPIO),
     /** upload H_CV info WMI event
@@ -1813,6 +1820,14 @@ typedef struct {
     A_UINT32 vdev_id;
 } wmi_scan_event_fixed_param;
 
+/* WMI Diag event */
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag is WMITLV_TAG_STRUC_wmi_diag_event_fixed_param */
+    A_UINT32 time_stamp; /* Reference timestamp. diag frame contains diff value */
+    A_UINT32 count;   /* Number of diag frames added to current event */
+    A_UINT32 dropped;
+    /* followed by WMITLV_TAG_ARRAY_BYTE */
+} wmi_diag_event_fixed_param;
 
 /*
 * If FW has multiple active channels due to MCC(multi channel concurrency),
@@ -8593,6 +8608,16 @@ typedef struct {
      */
 } wmi_debug_log_config_cmd_fixed_param;
 
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_get_temperature_cmd_fixed_param  */
+    A_UINT32 param;     /* Reserved for future use */
+} wmi_pdev_get_temperature_cmd_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_temperature_event_fixed_param */
+    A_INT32  value;     /* temprature value in Celcius degree */
+} wmi_pdev_temperature_event_fixed_param;
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/CORE/SERVICES/COMMON/wmi_version.h b/CORE/SERVICES/COMMON/wmi_version.h
index e3330ce69eb8..9d704fe81922 100644
--- a/CORE/SERVICES/COMMON/wmi_version.h
+++ b/CORE/SERVICES/COMMON/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 61
+#define __WMI_REVISION_ 62
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 51dbbd561af2..6ef2f687b5f9 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -1482,8 +1482,6 @@ static void wma_delete_all_ap_remote_peers(tp_wma_handle wma, A_UINT32 vdev_id)
 		if (temp) {
 			adf_os_spin_unlock_bh(&vdev->pdev->peer_ref_mutex);
 			if (adf_os_atomic_read(&temp->delete_in_progress) == 0){
-				adf_os_atomic_init(&temp->ref_cnt);
-				adf_os_atomic_inc(&temp->ref_cnt);
 				wma_remove_peer(wma, temp->mac_addr.raw,
 					vdev_id, temp, VOS_FALSE);
 			}
@@ -10683,6 +10681,22 @@ static int32_t wma_set_priv_cfg(tp_wma_handle wma_handle,
 	}
 		break;
 
+#ifdef IPA_UC_OFFLOAD
+	case WMA_VDEV_TXRX_GET_IPA_UC_FW_STATS_CMDID:
+	{
+		ol_txrx_pdev_handle pdev;
+
+		pdev = vos_get_context(VOS_MODULE_ID_TXRX,
+			wma_handle->vos_context);
+		if (!pdev) {
+			WMA_LOGE("pdev NULL for uc stat");
+			return -EINVAL;
+		}
+		ol_txrx_ipa_uc_get_stat(pdev);
+	}
+		break;
+#endif /* IPA_UC_OFFLOAD */
+
 	default:
 		WMA_LOGE("Invalid wma config command id:%d",
 			privcmd->param_id);
diff --git a/CORE/SERVICES/WMA/wma.h b/CORE/SERVICES/WMA/wma.h
index 2993760cbfaa..efe014609580 100644
--- a/CORE/SERVICES/WMA/wma.h
+++ b/CORE/SERVICES/WMA/wma.h
@@ -1207,6 +1207,7 @@ enum wma_cfg_cmd_id {
 
 	/* dfs control interface */
 	WMA_VDEV_DFS_CONTROL_CMDID,
+	WMA_VDEV_TXRX_GET_IPA_UC_FW_STATS_CMDID,
 
 	/* Add any new command before this */
 	WMA_CMD_ID_MAX
diff --git a/CORE/SERVICES/WMI/wmi_unified.c b/CORE/SERVICES/WMI/wmi_unified.c
index bf6e80d1cb7b..69ed21cc80bc 100644
--- a/CORE/SERVICES/WMI/wmi_unified.c
+++ b/CORE/SERVICES/WMI/wmi_unified.c
@@ -583,6 +583,7 @@ static u_int8_t* get_wmi_cmd_string(WMI_CMD_ID wmi_command)
 		CASE_RETURN_STRING(WMI_EXTWOW_SET_APP_TYPE2_PARAMS_CMDID);
 		CASE_RETURN_STRING(WMI_UNIT_TEST_CMDID);
 		CASE_RETURN_STRING(WMI_ROAM_SET_RIC_REQUEST_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_GET_TEMPERATURE_CMDID);
 	}
 	return "Invalid WMI cmd";
 }
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index 07d7eac07651..4a5de1c9a67b 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -824,16 +824,21 @@ eHalStatus sme_RoamFreeConnectProfile(tHalHandle hHal,
     \param pPMKIDCache - caller allocated buffer point to an array of
                          tPmkidCacheInfo
     \param numItems - a variable that has the number of tPmkidCacheInfo
-                      allocated when retruning, this is either the number needed
-                      or number of items put into pPMKIDCache
+                      allocated when retruning, this is either the number
+                      needed or number of items put into pPMKIDCache
+    \param update_entire_cache - if TRUE, then it overwrites the entire cache
+                                 with pPMKIDCache, else it updates entry by
+                                 entry without deleting the old entries.
     \return eHalStatus - when fail, it usually means the buffer allocated is not
                          big enough and pNumItems has the number of
                          tPmkidCacheInfo.
     \Note: pNumItems is a number of tPmkidCacheInfo,
            not sizeof(tPmkidCacheInfo) * something
   ---------------------------------------------------------------------------*/
-eHalStatus sme_RoamSetPMKIDCache( tHalHandle hHal, tANI_U8 sessionId, tPmkidCacheInfo *pPMKIDCache,
-                                  tANI_U32 numItems );
+eHalStatus sme_RoamSetPMKIDCache( tHalHandle hHal, tANI_U8 sessionId,
+                                  tPmkidCacheInfo *pPMKIDCache,
+                                  tANI_U32 numItems,
+                                  tANI_BOOLEAN update_entire_cache );
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 /* ---------------------------------------------------------------------------
@@ -3484,7 +3489,9 @@ eHalStatus smeIssueFastRoamNeighborAPEvent (tHalHandle hHal,
                                             tSmeFastRoamTrigger fastRoamTrig,
                                             tANI_U8 sessionId);
 
-eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId, tANI_U8 *pBSSId );
+eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId,
+                                      tANI_U8 *pBSSId,
+                                      tANI_BOOLEAN flush_cache );
 
 void smeGetCommandQStatus( tHalHandle hHal );
 
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index c9bda984760b..87c985a34925 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -12380,19 +12380,22 @@ eHalStatus csrRoamSetPSK_PMK(tpAniSirGlobal pMac, tANI_U32 sessionId,
 }
 #endif /* WLAN_FEATURE_ROAM_OFFLOAD */
 eHalStatus csrRoamSetPMKIDCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
-                                 tPmkidCacheInfo *pPMKIDCache, tANI_U32 numItems )
+                                 tPmkidCacheInfo *pPMKIDCache,
+                                 tANI_U32 numItems,
+                                 tANI_BOOLEAN update_entire_cache )
 {
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
 
-    if(!pSession)
+    if (!pSession)
     {
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
 
     smsLog(pMac, LOGW, "csrRoamSetPMKIDCache called, numItems = %d", numItems);
-    if(numItems <= CSR_MAX_PMKID_ALLOWED)
+
+    if (numItems <= CSR_MAX_PMKID_ALLOWED)
     {
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
         {
@@ -12410,52 +12413,105 @@ eHalStatus csrRoamSetPMKIDCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
             WLAN_VOS_DIAG_EVENT_REPORT(&secEvent, EVENT_WLAN_SECURITY);
         }
 #endif//FEATURE_WLAN_DIAG_SUPPORT_CSR
+
         status = eHAL_STATUS_SUCCESS;
-        //numItems may be 0 to clear the cache
-        pSession->NumPmkidCache = (tANI_U16)numItems;
-        if(numItems && pPMKIDCache)
-        {
-            vos_mem_copy(pSession->PmkidCacheInfo, pPMKIDCache,
-                         sizeof(tPmkidCacheInfo) * numItems);
-            status = eHAL_STATUS_SUCCESS;
+        if (update_entire_cache) {
+            pSession->NumPmkidCache = (tANI_U16)numItems;
+            if (numItems && pPMKIDCache)
+            {
+                vos_mem_copy(pSession->PmkidCacheInfo, pPMKIDCache,
+                             sizeof(tPmkidCacheInfo) * numItems);
+            }
+        } else {
+            tANI_U32 i = 0, j = 0;
+            tANI_U8 BSSIDMatched = 0;
+            tPmkidCacheInfo *pmksa;
+
+            for (i = 0; i < numItems; i++) {
+                pmksa = &pPMKIDCache[i];
+                for (j = 0; j < CSR_MAX_PMKID_ALLOWED; j++) {
+                    if (vos_mem_compare(pSession->PmkidCacheInfo[j].BSSID,
+                                pmksa->BSSID, VOS_MAC_ADDR_SIZE)) {
+                        /* If a matching BSSID found, update it */
+                        BSSIDMatched = 1;
+                        vos_mem_copy(pSession->PmkidCacheInfo[j].PMKID,
+                                     pmksa->PMKID, CSR_RSN_PMKID_SIZE);
+                        break;
+                    }
+                }
+
+                if (!BSSIDMatched) {
+                    vos_mem_copy(
+                       pSession->PmkidCacheInfo[pSession->NumPmkidCache].BSSID,
+                       pmksa->BSSID, ETHER_ADDR_LEN);
+                    vos_mem_copy(
+                       pSession->PmkidCacheInfo[pSession->NumPmkidCache].PMKID,
+                       pmksa->PMKID, CSR_RSN_PMKID_SIZE);
+                    /* Increment the CSR local cache index */
+                    if (pSession->NumPmkidCache < (CSR_MAX_PMKID_ALLOWED - 1))
+                        pSession->NumPmkidCache++;
+                    else
+                        pSession->NumPmkidCache = 0;
+                }
+                BSSIDMatched = 0;
+            }
         }
     }
     return (status);
 }
 
 eHalStatus csrRoamDelPMKIDfromCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
-                                 tANI_U8 *pBSSId )
+                                     tANI_U8 *pBSSId,
+                                     tANI_BOOLEAN flush_cache )
 {
     eHalStatus status = eHAL_STATUS_FAILURE;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
     tANI_BOOLEAN fMatchFound = FALSE;
     tANI_U32 Index;
+
     if(!pSession)
     {
         smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
         return eHAL_STATUS_FAILURE;
     }
-    do
-    {
-        for( Index=0; Index < pSession->NumPmkidCache; Index++ )
-        {
-            smsLog(pMac, LOGW, "Delete PMKID for "
-                   MAC_ADDRESS_STR, MAC_ADDR_ARRAY(pBSSId));
-            if( vos_mem_compare( pBSSId, pSession->PmkidCacheInfo[Index].BSSID, sizeof(tCsrBssid) ) )
-            {
-                fMatchFound = TRUE;
-                break;
-            }
+
+    /* Check if there are no entries to delete */
+    if (0 == pSession->NumPmkidCache) {
+       smsLog(pMac, LOG1, FL("No entries to delete/Flush"));
+       return eHAL_STATUS_SUCCESS;
+    }
+
+    if (!flush_cache) {
+        for (Index = 0; Index < CSR_MAX_PMKID_ALLOWED; Index++) {
+            if (vos_mem_compare(pSession->PmkidCacheInfo[Index].BSSID,
+                      pBSSId, VOS_MAC_ADDR_SIZE)) {
+                fMatchFound = 1;
+
+                /* Clear this - the matched entry */
+                 vos_mem_zero(&pSession->PmkidCacheInfo[Index],
+                              sizeof(tPmkidCacheInfo));
+
+                 status = eHAL_STATUS_SUCCESS;
+                 break;
+              }
         }
-        if( !fMatchFound ) break;
-        vos_mem_set(pSession->PmkidCacheInfo[Index].BSSID, sizeof(tCsrBssid), 0);
-        status = eHAL_STATUS_SUCCESS;
+
+        if (Index == CSR_MAX_PMKID_ALLOWED && !fMatchFound) {
+           smsLog(pMac, LOG1, FL("No such PMKSA entry exists "MAC_ADDRESS_STR),
+                  MAC_ADDR_ARRAY(pBSSId));
+           return status;
+        }
+
+        return status;
+    } else {
+        /* Flush the entire cache */
+        vos_mem_zero(pSession->PmkidCacheInfo,
+                     sizeof(tPmkidCacheInfo) * CSR_MAX_PMKID_ALLOWED);
+        pSession->NumPmkidCache = 0;
+        return eHAL_STATUS_SUCCESS;
     }
-    while( 0 );
-    smsLog(pMac, LOGW, "csrDelPMKID called return match = %d Status = %d",
-        fMatchFound, status);
-    return status;
 }
+
 tANI_U32 csrRoamGetNumPMKIDCache(tpAniSirGlobal pMac, tANI_U32 sessionId)
 {
     return (pMac->roam.roamSession[sessionId].NumPmkidCache);
diff --git a/CORE/SME/src/csr/csrInsideApi.h b/CORE/SME/src/csr/csrInsideApi.h
index 89dc4d72e384..567a71f1bd22 100644
--- a/CORE/SME/src/csr/csrInsideApi.h
+++ b/CORE/SME/src/csr/csrInsideApi.h
@@ -761,7 +761,10 @@ eHalStatus csrRoamReconnect(tpAniSirGlobal pMac, tANI_U32 sessionId);
     has the number of tPmkidCacheInfo.
     \Note: pNumItems is a number of tPmkidCacheInfo, not sizeof(tPmkidCacheInfo) * something
   -------------------------------------------------------------------------------*/
-eHalStatus csrRoamSetPMKIDCache( tpAniSirGlobal pMac, tANI_U32 sessionId, tPmkidCacheInfo *pPMKIDCache, tANI_U32 numItems );
+eHalStatus csrRoamSetPMKIDCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
+                                 tPmkidCacheInfo *pPMKIDCache,
+                                 tANI_U32 numItems,
+                                 tANI_BOOLEAN update_entire_cache );
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 /* ---------------------------------------------------------------------------
@@ -1025,7 +1028,7 @@ eHalStatus csrScanCreateEntryInScanCache(tpAniSirGlobal pMac, tANI_U32 sessionId
 
 eHalStatus csrUpdateChannelList(tpAniSirGlobal pMac);
 eHalStatus csrRoamDelPMKIDfromCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
-                                 tANI_U8 *pBSSId );
+                                     tANI_U8 *pBSSId, tANI_BOOLEAN flush_cache );
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 eHalStatus csrRoamEnqueueRoamOffloadSynch(
     tpAniSirGlobal pMac, tANI_U32 sessionId, tpSirBssDescription pBssDescription,
diff --git a/CORE/SME/src/csr/csrUtil.c b/CORE/SME/src/csr/csrUtil.c
index c7a4b96fa1d2..ac378bb99d50 100644
--- a/CORE/SME/src/csr/csrUtil.c
+++ b/CORE/SME/src/csr/csrUtil.c
@@ -3126,7 +3126,7 @@ tANI_BOOLEAN csrLookupPMKID( tpAniSirGlobal pMac, tANI_U32 sessionId, tANI_U8 *p
 
     do
     {
-        for( Index=0; Index < pSession->NumPmkidCache; Index++ )
+        for (Index = 0; Index < CSR_MAX_PMKID_ALLOWED; Index++)
         {
             smsLog(pMac, LOGW, "match PMKID "MAC_ADDRESS_STR " to ",
                    MAC_ADDR_ARRAY(pBSSId));
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 78b3d253eb07..d7c554f66d52 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -3855,14 +3855,19 @@ eHalStatus sme_RoamFreeConnectProfile(tHalHandle hHal,
     \param numItems - a variable that has the number of tPmkidCacheInfo
                       allocated when retruning, this is either the number needed
                       or number of items put into pPMKIDCache
+    \param update_entire_cache - this bool value specifies if the entire pmkid
+                               cache should be overwritten or should it be
+                               updated entry by entry.
     \return eHalStatus - when fail, it usually means the buffer allocated is not
                          big enough and pNumItems has the number of
                          tPmkidCacheInfo.
     \Note: pNumItems is a number of tPmkidCacheInfo,
            not sizeof(tPmkidCacheInfo) * something
   ---------------------------------------------------------------------------*/
-eHalStatus sme_RoamSetPMKIDCache( tHalHandle hHal, tANI_U8 sessionId, tPmkidCacheInfo *pPMKIDCache,
-                                  tANI_U32 numItems )
+eHalStatus sme_RoamSetPMKIDCache( tHalHandle hHal, tANI_U8 sessionId,
+                                  tPmkidCacheInfo *pPMKIDCache,
+                                  tANI_U32 numItems,
+                                  tANI_BOOLEAN update_entire_cache )
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
@@ -3874,7 +3879,8 @@ eHalStatus sme_RoamSetPMKIDCache( tHalHandle hHal, tANI_U8 sessionId, tPmkidCach
    {
       if( CSR_IS_SESSION_VALID( pMac, sessionId ) )
       {
-         status = csrRoamSetPMKIDCache( pMac, sessionId, pPMKIDCache, numItems );
+         status = csrRoamSetPMKIDCache( pMac, sessionId, pPMKIDCache,
+                                        numItems, update_entire_cache);
       }
       else
       {
@@ -3886,7 +3892,9 @@ eHalStatus sme_RoamSetPMKIDCache( tHalHandle hHal, tANI_U8 sessionId, tPmkidCach
    return (status);
 }
 
-eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId, tANI_U8 *pBSSId )
+eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId,
+                                      tANI_U8 *pBSSId,
+                                      tANI_BOOLEAN flush_cache )
 {
    eHalStatus status = eHAL_STATUS_FAILURE;
    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
@@ -3895,7 +3903,8 @@ eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId, tANI_U
    {
       if( CSR_IS_SESSION_VALID( pMac, sessionId ) )
       {
-         status = csrRoamDelPMKIDfromCache( pMac, sessionId, pBSSId );
+         status = csrRoamDelPMKIDfromCache( pMac, sessionId,
+                                            pBSSId, flush_cache );
       }
       else
       {
diff --git a/CORE/TL/inc/wlan_qct_tl.h b/CORE/TL/inc/wlan_qct_tl.h
index f12ae7752024..186fc8f86dc3 100644
--- a/CORE/TL/inc/wlan_qct_tl.h
+++ b/CORE/TL/inc/wlan_qct_tl.h
@@ -3198,6 +3198,6 @@ void WLANTL_SetUcActive(void *vos_ctx,
 
 ==============================================================================*/
 void WLANTL_RegisterOPCbFnc(void *vos_ctx,
-	void (*func)(v_U8_t op_code));
+	void (*func)(v_U8_t *op_msg, void *usr_ctxt), void *usr_ctxt);
 #endif /* IPA_UC_OFFLOAD */
 #endif /* #ifndef WLAN_QCT_WLANTL_H */
diff --git a/CORE/UTILS/FWLOG/dbglog_host.c b/CORE/UTILS/FWLOG/dbglog_host.c
index b8a8369a0dc9..240e8d826c7d 100644
--- a/CORE/UTILS/FWLOG/dbglog_host.c
+++ b/CORE/UTILS/FWLOG/dbglog_host.c
@@ -36,7 +36,8 @@
 #include "wma.h"
 #include "ol_defines.h"
 #include <wlan_nlink_srv.h>
-
+#include "vos_diag_core_event.h"
+#include "qwlan_version.h"
 #include <net/sock.h>
 #include <linux/netlink.h>
 
@@ -54,9 +55,12 @@
 
 #if defined(DEBUG)
 
-bool appstarted = FALSE;
-bool kd_nl_init = FALSE;
-int cnss_diag_pid = 0;
+static bool appstarted = FALSE;
+static bool senddriverstatus = FALSE;
+static bool kd_nl_init = FALSE;
+static int cnss_diag_pid = 0;
+static int get_version = 0;
+static int gprint_limiter = 0;
 
 static ATH_DEBUG_MASK_DESCRIPTION g_fwlogDebugDescription[] = {
     {FWLOG_DEBUG,"fwlog"},
@@ -1670,6 +1674,54 @@ send_fw_diag_nl_data(wmi_unified_t wmi_handle, const u_int8_t *buffer,
     return res;
 }
 
+static int
+send_diag_netlink_data(const u_int8_t *buffer,
+                           A_UINT32 len, A_UINT32 cmd)
+{
+    struct sk_buff *skb_out;
+    struct nlmsghdr *nlh;
+    int res = 0;
+    struct dbglog_slot *slot;
+    size_t slot_len;
+
+    if (WARN_ON(len > ATH6KL_FWLOG_PAYLOAD_SIZE))
+        return -ENODEV;
+
+    /* NL is not ready yet, WLAN KO started first */
+    if ((kd_nl_init) && (!cnss_diag_pid)) {
+        nl_srv_nl_ready_indication();
+    }
+
+    if (cnss_diag_pid) {
+        slot_len = sizeof(*slot) + ATH6KL_FWLOG_PAYLOAD_SIZE;
+
+        skb_out = nlmsg_new(slot_len, 0);
+        if (!skb_out) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                            ("Failed to allocate new skb\n"));
+            return -1;
+        }
+
+        nlh = nlmsg_put(skb_out, 0, 0, NLMSG_DONE, slot_len, 0);
+        slot = (struct dbglog_slot *) nlmsg_data(nlh);
+        slot->diag_type = cmd;
+        slot->timestamp = cpu_to_le32(jiffies);
+        slot->length = cpu_to_le32(len);
+        /* Version mapped to get_version here */
+        slot->dropped = get_version;
+        memcpy(slot->payload, buffer, len);
+        NETLINK_CB(skb_out).dst_group = 0; /* not in mcast group */
+
+        res = nl_srv_ucast(skb_out, cnss_diag_pid, MSG_DONTWAIT);
+        if (res < 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                            ("nl_srv_ucast failed 0x%x \n", res));
+            return res;
+        }
+    }
+    return res;
+}
+
 
 int
 dbglog_process_netlink_data(wmi_unified_t wmi_handle, const u_int8_t *buffer,
@@ -1723,6 +1775,90 @@ dbglog_process_netlink_data(wmi_unified_t wmi_handle, const u_int8_t *buffer,
 
 /*
  * WMI diag data event handler, this function invoked as a CB
+ * when there DIAG_EVENT, DIAG_MSG, DIAG_DBG to be
+ * forwarded from the FW. This is the new implementation for
+ * replacement of fw_dbg and dbg messages
+ */
+
+static int
+diag_fw_handler(ol_scn_t scn, u_int8_t *data, u_int32_t datalen)
+{
+
+    tp_wma_handle wma = (tp_wma_handle)scn;
+    wmitlv_cmd_param_info *param_buf;
+    u_int8_t *datap;
+    u_int32_t len = 0;
+    u_int32_t *buffer;
+
+    if (!wma) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("NULL Pointer assigned\n"));
+        return -1;
+    }
+    /* when fw asser occurs,host can't use TLV format. */
+    if (wma->is_fw_assert) {
+        datap = data;
+        len = datalen;
+        wma->is_fw_assert = 0;
+    } else {
+        param_buf = (wmitlv_cmd_param_info *) data;
+        if (!param_buf) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                            ("Get NULL point message from FW\n"));
+            return -1;
+        }
+
+        param_buf = (wmitlv_cmd_param_info *) data;
+        datap = param_buf->tlv_ptr;
+        len = param_buf->num_elements;
+        if (!get_version) {
+             buffer = (u_int32_t *)datap  ;
+             buffer++; /* skip offset */
+             if (WLAN_DIAG_TYPE_CONFIG == DIAG_GET_TYPE(*buffer)) {
+                 buffer++; /* skip  */
+                 if (DIAG_VERSION_INFO == DIAG_GET_ID(*buffer)) {
+                    buffer++; /* skip  */
+                    /* get payload */
+                    get_version = *buffer;
+                 }
+             }
+        }
+    }
+    if (dbglog_process_type == DBGLOG_PROCESS_PRINT_RAW) {
+        if (!gprint_limiter) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("NOT Supported"
+                            " only supports net link socket\n"));
+            gprint_limiter = TRUE;
+        }
+        return 0;
+    }
+
+    if ( dbglog_process_type == DBGLOG_PROCESS_NET_RAW) {
+         return send_diag_netlink_data((A_UINT8 *)datap,
+                                          len, DIAG_TYPE_FW_MSG);
+    }
+
+#ifdef WLAN_OPEN_SOURCE
+    if (dbglog_process_type == DBGLOG_PROCESS_POOL_RAW) {
+        if (!gprint_limiter) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("NOT Supported"
+                            " only supports net link socket\n"));
+            gprint_limiter = TRUE;
+        }
+        return 0;
+    }
+#endif /* WLAN_OPEN_SOURCE */
+    if (!gprint_limiter) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("NOT Supported"
+                        " only supports net link socket\n"));
+        gprint_limiter = TRUE;
+    }
+    /* Always returns zero */
+    return (0);
+}
+
+
+/*
+ * WMI diag data event handler, this function invoked as a CB
  * when there DIAG_DATA to be forwarded from the FW.
  */
 
@@ -3792,6 +3928,58 @@ int dbglog_debugfs_remove(wmi_unified_t wmi_handle)
 }
 #endif /* WLAN_OPEN_SOURCE */
 
+static void
+cnss_diag_event_report(A_UINT16 event_Id, A_UINT16 length, void *pPayload)
+{
+    A_UINT8 *pBuf, *pBuf1;
+    event_report_t *pEvent_report;
+    A_UINT16 total_len;
+    total_len = sizeof(event_report_t) + length;
+    pBuf = vos_mem_malloc(total_len);
+    if (!pBuf){
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: vos_mem_malloc failed \n", __func__));
+        return;
+    }
+    pBuf1 = pBuf;
+    pEvent_report = (event_report_t*)pBuf;
+    pEvent_report->diag_type = DIAG_TYPE_EVENTS;
+    pEvent_report->event_id = event_Id;
+    pEvent_report->length = length;
+    pBuf += sizeof(event_report_t);
+    memcpy(pBuf, pPayload, length);
+    send_diag_netlink_data((A_UINT8 *) pBuf1, total_len, DIAG_TYPE_HOST_MSG);
+    vos_mem_free((v_VOID_t*)pBuf1);
+    return;
+
+}
+
+static void cnss_diag_send_driver_loaded(void)
+{
+    if (appstarted) {
+        vos_event_wlan_bringup_status_payload_type wlan_bringup_status;
+         /* Send Driver up command */
+        strlcpy(&wlan_bringup_status.driverVersion[0], QWLAN_VERSIONSTR,
+                    sizeof(wlan_bringup_status.driverVersion));
+        wlan_bringup_status.wlanStatus = DIAG_WLAN_DRIVER_LOADED;
+        cnss_diag_event_report(EVENT_WLAN_BRINGUP_STATUS,
+                      sizeof(wlan_bringup_status), &wlan_bringup_status);
+        senddriverstatus = FALSE;
+    }
+    else
+        senddriverstatus = TRUE;
+}
+
+static void cnss_diag_send_driver_unloaded(void)
+{
+    vos_event_wlan_bringup_status_payload_type wlan_bringup_status;
+     /* Send Driver down command */
+    memset(&wlan_bringup_status, 0,
+           sizeof(vos_event_wlan_bringup_status_payload_type));
+    wlan_bringup_status.wlanStatus = DIAG_WLAN_DRIVER_UNLOADED;
+    cnss_diag_event_report(EVENT_WLAN_BRINGUP_STATUS,
+        sizeof(wlan_bringup_status), &wlan_bringup_status);
+}
 /**---------------------------------------------------------------------------
   \brief cnss_diag_msg_callback() - Call back invoked by netlink service
 
@@ -3806,7 +3994,8 @@ int dbglog_debugfs_remove(wmi_unified_t wmi_handle)
 int cnss_diag_msg_callback(struct sk_buff *skb)
 {
     struct nlmsghdr *nlh;
-    tAniMsgHdr *msg_hdr;
+    struct dbglog_slot *slot;
+    A_UINT8 *msg;
 
     nlh = (struct nlmsghdr *)skb->data;
     if (!nlh)
@@ -3815,12 +4004,27 @@ int cnss_diag_msg_callback(struct sk_buff *skb)
        return -1;
     }
 
-    msg_hdr = NLMSG_DATA(nlh);
+    msg = NLMSG_DATA(nlh);
 
-    appstarted = TRUE;
-    cnss_diag_pid = nlh->nlmsg_pid;
-    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+    /* This check added for backward compatability */
+    if (!memcmp(msg, "Hello", 5)) {
+         appstarted = TRUE;
+         cnss_diag_pid = nlh->nlmsg_pid;
+         AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
                    ("%s: registered pid %d \n", __func__, cnss_diag_pid));
+         if (senddriverstatus)
+             cnss_diag_send_driver_loaded();
+         return 0;
+    }
+    else
+       slot = (struct dbglog_slot *)msg;
+    switch (slot->diag_type) {
+    case DIAG_TYPE_CRASH_INJECT:
+         process_wma_set_command(0,(int)GEN_PARAM_CRASH_INJECT, 0, GEN_CMD);
+    break;
+    default:
+    break;
+    }
     return 0;
 
 }
@@ -3839,6 +4043,7 @@ int cnss_diag_notify_wlan_close()
     /* Send nl msg about the wlan close */
     if (0 != cnss_diag_pid)
     {
+        cnss_diag_send_driver_unloaded();
         nl_srv_nl_close_indication(cnss_diag_pid);
         cnss_diag_pid = 0;
     }
@@ -3970,6 +4175,7 @@ int dbglog_parser_type_init(wmi_unified_t wmi_handle, int type)
     }
 
     dbglog_process_type = type;
+    gprint_limiter = FALSE;
 
     return A_OK;
 }
@@ -3999,16 +4205,23 @@ dbglog_init(wmi_unified_t wmi_handle)
     /* Register handler for F3 or debug messages */
     res = wmi_unified_register_event_handler(wmi_handle, WMI_DEBUG_MESG_EVENTID,
                        dbglog_parse_debug_logs);
-    if(res != 0)
+    if (res != 0)
         return res;
 
     /* Register handler for FW diag events */
     res = wmi_unified_register_event_handler(wmi_handle,
                      WMI_DIAG_DATA_CONTAINER_EVENTID,
                      fw_diag_data_event_handler);
-    if(res != 0)
+    if (res != 0)
         return res;
 
+    /* Register handler for new FW diag  Event, LOG, MSG combined */
+    res = wmi_unified_register_event_handler(wmi_handle, WMI_DIAG_EVENTID,
+                                   diag_fw_handler);
+    if (res != 0)
+       return res;
+
+    cnss_diag_send_driver_loaded();
 #ifdef WLAN_OPEN_SOURCE
     /* Initialize the fw debug log queue */
     skb_queue_head_init(&wmi_handle->dbglog.fwlog_queue);
diff --git a/firmware_bin/WCNSS_qcom_cfg.usb.ini b/firmware_bin/WCNSS_qcom_cfg.usb.ini
index fee4e9cb54ce..758b791b065f 100644
--- a/firmware_bin/WCNSS_qcom_cfg.usb.ini
+++ b/firmware_bin/WCNSS_qcom_cfg.usb.ini
@@ -512,6 +512,10 @@ gEnableRxThread=0
 # Currently, It's for USB only.
 # 1=Enable, 0=Disable (default)
 gEnableFwSelfRecovery=0
+
+# Enable or Disable SAP suspend
+# 1=Enable (default), 0=Disable
+gEnableSapSuspend=0
 END
 
 # Note: Configuration parser would not read anything past the END marker