Merge "Merge remote-tracking branch 'origin/caf/caf-wlan/master'"

39 files changed, 1233 insertions, 245 deletions

diff --git a/CORE/CLD_TXRX/TXRX/ol_tx.c b/CORE/CLD_TXRX/TXRX/ol_tx.c
index 12df8f97aead..4f8aee6f6b3c 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_tx.c
@@ -197,13 +197,13 @@ ol_tx_vdev_pause_queue_append(
     if (vdev->ll_pause.txq.tail) {
         adf_nbuf_set_next(vdev->ll_pause.txq.tail, NULL);
     }
-    adf_os_spin_unlock_bh(&vdev->ll_pause.mutex);
 
     if (start_timer) {
         adf_os_timer_cancel(&vdev->ll_pause.timer);
         adf_os_timer_start(
                 &vdev->ll_pause.timer, OL_TX_VDEV_PAUSE_QUEUE_SEND_PERIOD_MS);
     }
+    adf_os_spin_unlock_bh(&vdev->ll_pause.mutex);
 
     return msdu_list;
 }
@@ -248,7 +248,7 @@ ol_tx_pdev_ll_pause_queue_send_all(struct ol_txrx_pdev_t *pdev)
 {
     int max_to_send; /* tracks how many frames have been sent*/
     adf_nbuf_t tx_msdu;
-    struct ol_txrx_vdev_t *vdev;
+    struct ol_txrx_vdev_t *vdev = NULL;
     u_int8_t more;
 
     if (NULL == pdev) {
@@ -273,14 +273,24 @@ ol_tx_pdev_ll_pause_queue_send_all(struct ol_txrx_pdev_t *pdev)
         more = 0;
         TAILQ_FOREACH(vdev, &pdev->vdev_list, vdev_list_elem) {
 
+            adf_os_spin_lock_bh(&vdev->ll_pause.mutex);
             if (vdev->ll_pause.txq.depth) {
                 if ( vdev->ll_pause.is_paused == A_TRUE ) {
+                    adf_os_spin_unlock_bh(&vdev->ll_pause.mutex);
+                    continue;
+                }
+
+                tx_msdu = vdev->ll_pause.txq.head;
+                if (NULL == tx_msdu) {
+                    adf_os_spin_unlock_bh(&vdev->ll_pause.mutex);
                     continue;
                 }
+
                 max_to_send--;
                 vdev->ll_pause.txq.depth--;
-                tx_msdu = vdev->ll_pause.txq.head;
+
                 vdev->ll_pause.txq.head = adf_nbuf_next(tx_msdu);
+
                 if (NULL == vdev->ll_pause.txq.head) {
                     vdev->ll_pause.txq.tail = NULL;
                 }
@@ -302,16 +312,21 @@ ol_tx_pdev_ll_pause_queue_send_all(struct ol_txrx_pdev_t *pdev)
             if (vdev->ll_pause.txq.depth) {
                 more = 1;
             }
+            adf_os_spin_unlock_bh(&vdev->ll_pause.mutex);
         }
     } while(more && max_to_send);
 
+    vdev = NULL;
     TAILQ_FOREACH(vdev, &pdev->vdev_list, vdev_list_elem) {
+        adf_os_spin_lock_bh(&vdev->ll_pause.mutex);
         if (vdev->ll_pause.txq.depth) {
             adf_os_timer_cancel(&pdev->tx_throttle_ll.tx_timer);
             adf_os_timer_start(&pdev->tx_throttle_ll.tx_timer,
                                OL_TX_VDEV_PAUSE_QUEUE_SEND_PERIOD_MS);
-            break;
+            adf_os_spin_unlock_bh(&vdev->ll_pause.mutex);
+            return;
         }
+        adf_os_spin_unlock_bh(&vdev->ll_pause.mutex);
     }
 }
 #endif
diff --git a/CORE/HDD/inc/wlan_hdd_assoc.h b/CORE/HDD/inc/wlan_hdd_assoc.h
index 0abaa40c3fcd..c23fa9221f76 100644
--- a/CORE/HDD/inc/wlan_hdd_assoc.h
+++ b/CORE/HDD/inc/wlan_hdd_assoc.h
@@ -123,6 +123,13 @@ typedef struct hdd_station_ctx hdd_station_ctx_t;
 typedef struct hdd_ap_ctx_s  hdd_ap_ctx_t;
 typedef struct hdd_mon_ctx_s  hdd_mon_ctx_t;
 
+#ifdef QCA_WIFI_2_0
+typedef enum
+{
+   ePeerConnected = 1,
+   ePeerDisconnected
+}ePeerStatus;
+#endif /* QCA_WIFI_2_0 */
 
 extern v_BOOL_t hdd_connIsConnected( hdd_station_ctx_t *pHddStaCtx );
 extern eHalStatus hdd_smeRoamCallback( void *pContext, tCsrRoamInfo *pRoamInfo, v_U32_t roamId, 
@@ -139,4 +146,12 @@ int hdd_set_csr_auth_type( hdd_adapter_t *pAdapter, eCsrAuthType RSNAuthType );
 VOS_STATUS hdd_roamRegisterTDLSSTA( hdd_adapter_t *pAdapter,
                                     tANI_U8 *peerMac, tANI_U16 staId, tANI_U8 ucastSig);
 void hdd_PerformRoamSetKeyComplete(hdd_adapter_t *pAdapter);
+
+#ifdef QCA_WIFI_2_0
+void hdd_SendPeerStatusIndToOemApp(v_MACADDR_t *peerMac,
+                                   tANI_U8 peerStatus,
+                                   tANI_U8 peerTimingMeasCap,
+                                   tANI_U8 sessionId,
+                                   tANI_U8 chanId);
+#endif /* QCA_WIFI_2_0 */
 #endif
diff --git a/CORE/HDD/inc/wlan_hdd_cfg.h b/CORE/HDD/inc/wlan_hdd_cfg.h
index 4f7a8c7debfa..2137fbd00d72 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -1215,6 +1215,28 @@ typedef enum
 #define CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_MAX       (120)
 #define CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_DEFAULT   (78)
 
+/*
+ * This parameter is the drop in RSSI value that will trigger a precautionary
+ * scan by firmware.
+ * MAX value is choose so that this type of scan can be disabled by user.
+ */
+#define CFG_ROAM_RESCAN_RSSI_DIFF_NAME                  "gRoamRescanRssiDiff"
+#define CFG_ROAM_RESCAN_RSSI_DIFF_MIN                   (0)
+#define CFG_ROAM_RESCAN_RSSI_DIFF_MAX                   (100)
+#define CFG_ROAM_RESCAN_RSSI_DIFF_DEFAULT               (5)
+
+/*
+ * This parameter is the RSSI diff above neighbor lookup threshold, when
+ * opportunistic scan should be triggered.
+ * MAX value is choose so that this type of scan can be always enabled by user.
+ * MIN value will cause opportunistic scan to be triggered in neighbor lookup
+ * RSSI range.
+ */
+#define CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_NAME            "gOpportunisticThresholdDiff"
+#define CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_MIN             (0)
+#define CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_MAX             (127)
+#define CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_DEFAULT         (30)
+
 #define CFG_NEIGHBOR_SCAN_CHAN_LIST_NAME                      "gNeighborScanChannelList"
 #define CFG_NEIGHBOR_SCAN_CHAN_LIST_DEFAULT                   ""
 
@@ -2303,6 +2325,8 @@ typedef struct
    v_U16_t       nNeighborScanPeriod;
    v_U8_t        nNeighborReassocRssiThreshold;
    v_U8_t        nNeighborLookupRssiThreshold;
+   v_U8_t        nOpportunisticThresholdDiff;
+   v_U8_t        nRoamRescanRssiDiff;
    v_U8_t        neighborScanChanList[WNI_CFG_VALID_CHANNEL_LIST_LEN];
    v_U16_t       nNeighborScanMinChanTime;
    v_U16_t       nNeighborScanMaxChanTime;
diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index d19d2d6fa526..be1c3b19b7ff 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -762,7 +762,7 @@ typedef struct
     /*BSSID*/
     tANI_U8  bssid[SIR_MAC_ADDR_LEN];
     /*SSID*/
-    tANI_U8  ssid[SIR_MAX_SSID_SIZE];
+    tANI_U8  ssid[SIR_MAX_SSID_SIZE + 1];
     /*Channel*/
     tANI_U8  ch;
     /*RSSI or Level*/
diff --git a/CORE/HDD/inc/wlan_hdd_oemdata.h b/CORE/HDD/inc/wlan_hdd_oemdata.h
index 4b7a46782dcd..dffc16556baa 100644
--- a/CORE/HDD/inc/wlan_hdd_oemdata.h
+++ b/CORE/HDD/inc/wlan_hdd_oemdata.h
@@ -61,6 +61,8 @@
 #define OEM_TARGET_SIGNATURE_LEN   8
 #define OEM_TARGET_SIGNATURE       "QUALCOMM"
 
+#define OEM_CAP_MAX_NUM_CHANNELS   128
+
 typedef enum
 {
   /* Error null context */
@@ -87,7 +89,7 @@ int oem_activate_service(void *pAdapter);
 int iw_get_oem_data_cap(struct net_device *dev, struct iw_request_info *info,
                         union iwreq_data *wrqu, char *extra);
 
-typedef struct sDriverVersion
+typedef PACKED_PRE struct PACKED_POST
 {
   tANI_U8 major;
   tANI_U8 minor;
@@ -95,7 +97,7 @@ typedef struct sDriverVersion
   tANI_U8 build;
 } tDriverVersion;
 
-struct iw_oem_data_cap
+typedef PACKED_PRE struct PACKED_POST
 {
     /* Signature of chipset vendor, e.g. QUALCOMM */
     tANI_U8 oem_target_signature[OEM_TARGET_SIGNATURE_LEN];
@@ -106,10 +108,58 @@ struct iw_oem_data_cap
     tANI_U16 allowed_dwell_time_max;  /* Channel dwell time - allowed max */
     tANI_U16 curr_dwell_time_min;     /* Channel dwell time - current min */
     tANI_U16 curr_dwell_time_max;     /* Channel dwell time - current max */
-    tANI_U8 supported_bands;          /* 2.4G or 5G Hz */
-    tANI_U8 num_channels;             /* Num of channels IDs to follow */
-    tANI_U8 *channel_list;            /* List of channel IDs */
-};
+    tANI_U16 supported_bands;          /* 2.4G or 5G Hz */
+    tANI_U16 num_channels;             /* Num of channels IDs to follow */
+    tANI_U8 channel_list[OEM_CAP_MAX_NUM_CHANNELS];  /* List of channel IDs */
+} t_iw_oem_data_cap;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    /* channel id */
+    tANI_U32 chan_id;
+
+    /* reserved0 */
+    tANI_U32 reserved0;
+
+    /* primary 20 MHz channel frequency in mhz */
+    tANI_U32 mhz;
+
+    /* Center frequency 1 in MHz */
+    tANI_U32 band_center_freq1;
+
+    /* Center frequency 2 in MHz - valid only for 11acvht 80plus80 mode */
+    tANI_U32 band_center_freq2;
+
+    /* channel info described below */
+    tANI_U32 info;
+
+    /* contains min power, max power, reg power and reg class id */
+    tANI_U32 reg_info_1;
+
+    /* contains antennamax */
+    tANI_U32 reg_info_2;
+} tHddChannelInfo;
+
+typedef PACKED_PRE struct PACKED_POST
+{
+    /* peer mac address */
+    tANI_U8 peer_mac_addr[6];
+
+    /* peer status: 1: CONNECTED, 2: DISCONNECTED */
+    tANI_U8 peer_status;
+
+    /* vdev_id for the peer mac */
+    tANI_U8 vdev_id;
+
+    /* peer capability: 0: RTT/RTT2, 1: RTT3. Default is 0 */
+    tANI_U32 peer_capability;
+
+    /* reserved0 */
+    tANI_U32 reserved0;
+
+    /* channel info on which peer is connected */
+    tHddChannelInfo peer_chan_info;
+} tPeerStatusInfo;
 #endif /* QCA_WIFI_2_0 */
 
 struct iw_oem_data_req
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index be1a9f3f2b50..1431cb589e0c 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -602,6 +602,9 @@ static void hdd_SendAssociationEvent(struct net_device *dev,tCsrRoamInfo *pCsrRo
     int we_event;
     char *msg;
     int type = -1;
+#ifdef QCA_WIFI_2_0
+    v_MACADDR_t peerMacAddr;
+#endif
 
 #if defined (WLAN_FEATURE_VOWIFI_11R)
     // Added to find the auth type on the fly at run time
@@ -662,6 +665,18 @@ static void hdd_SendAssociationEvent(struct net_device *dev,tCsrRoamInfo *pCsrRo
             hdd_SendFTAssocResponse(dev, pAdapter, pCsrRoamInfo);
         }
 #endif
+#ifdef QCA_WIFI_2_0
+        if (pAdapter->device_mode == WLAN_HDD_P2P_CLIENT)
+        {
+            vos_mem_copy(peerMacAddr.bytes, pHddStaCtx->conn_info.bssId,
+                         sizeof(pHddStaCtx->conn_info.bssId));
+
+            /* send peer status indication to oem app */
+            hdd_SendPeerStatusIndToOemApp(&peerMacAddr, ePeerConnected,
+                                   0, pAdapter->sessionId,
+                                   pHddStaCtx->conn_info.operationChannel);
+        }
+#endif
     }
     else if (eConnectionState_IbssConnected == pHddStaCtx->conn_info.connState) // IBss Associated
     {
@@ -680,6 +695,18 @@ static void hdd_SendAssociationEvent(struct net_device *dev,tCsrRoamInfo *pCsrRo
         pr_info("wlan: disconnected\n");
         type = WLAN_STA_DISASSOC_DONE_IND;
         memset(wrqu.ap_addr.sa_data,'\0',ETH_ALEN);
+#ifdef QCA_WIFI_2_0
+        if (pAdapter->device_mode == WLAN_HDD_P2P_CLIENT)
+        {
+            vos_mem_copy(peerMacAddr.bytes, pHddStaCtx->conn_info.bssId,
+                         sizeof(pHddStaCtx->conn_info.bssId));
+
+            /* send peer status indication to oem app */
+            hdd_SendPeerStatusIndToOemApp(&peerMacAddr, ePeerDisconnected,
+                                     0, pAdapter->sessionId,
+                                     pHddStaCtx->conn_info.operationChannel);
+        }
+#endif
     }
     hdd_dump_concurrency_info(pHddCtx);
 
diff --git a/CORE/HDD/src/wlan_hdd_cfg.c b/CORE/HDD/src/wlan_hdd_cfg.c
index a2e7f6ca6e23..943d40c3a808 100644
--- a/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/CORE/HDD/src/wlan_hdd_cfg.c
@@ -159,6 +159,28 @@ static void cbNotifySetFwRssiMonitoring(hdd_context_t *pHddCtx, unsigned long No
 }
 
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
+static void cbNotifySetOpportunisticScanThresholdDiff(hdd_context_t *pHddCtx,
+                                                      unsigned long NotifyId)
+{
+    /*
+     * at the point this routine is called, the value in the cfg_ini table
+     * has already been updated
+     */
+    sme_SetRoamOpportunisticScanThresholdDiff((tHalHandle)(pHddCtx->hHal),
+                          pHddCtx->cfg_ini->nOpportunisticThresholdDiff );
+}
+
+static void cbNotifySetRoamRescanRssiDiff(hdd_context_t *pHddCtx,
+                                          unsigned long NotifyId)
+{
+    /*
+     * at the point this routine is called, the value in the cfg_ini table
+     * has already been updated
+     */
+    sme_SetRoamRescanRssiDiff((tHalHandle)(pHddCtx->hHal),
+                              pHddCtx->cfg_ini->nRoamRescanRssiDiff);
+}
+
 static void cbNotifySetNeighborLookupRssiThreshold(hdd_context_t *pHddCtx, unsigned long NotifyId)
 {
     // at the point this routine is called, the value in the cfg_ini table has already been updated
@@ -1859,6 +1881,22 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_NEIGHBOR_LOOKUP_RSSI_THRESHOLD_MAX,
                  cbNotifySetNeighborLookupRssiThreshold, 0 ),
 
+   REG_DYNAMIC_VARIABLE( CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, nOpportunisticThresholdDiff,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_DEFAULT,
+                 CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_MIN,
+                 CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_MAX,
+                 cbNotifySetOpportunisticScanThresholdDiff, 0 ),
+
+   REG_DYNAMIC_VARIABLE( CFG_ROAM_RESCAN_RSSI_DIFF_NAME, WLAN_PARAM_Integer,
+                 hdd_config_t, nRoamRescanRssiDiff,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_ROAM_RESCAN_RSSI_DIFF_DEFAULT,
+                 CFG_ROAM_RESCAN_RSSI_DIFF_MIN,
+                 CFG_ROAM_RESCAN_RSSI_DIFF_MAX,
+                 cbNotifySetRoamRescanRssiDiff, 0 ),
+
    REG_VARIABLE_STRING( CFG_NEIGHBOR_SCAN_CHAN_LIST_NAME, WLAN_PARAM_String,
                         hdd_config_t, neighborScanChanList,
                         VAR_FLAGS_OPTIONAL,
@@ -3376,6 +3414,12 @@ static void print_hdd_cfg(hdd_context_t *pHddCtx)
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [nNeighborReassocRssiThreshold] Value = [%u] ",pHddCtx->cfg_ini->nNeighborReassocRssiThreshold);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [nNeighborLookupRssiThreshold] Value = [%u] ",pHddCtx->cfg_ini->nNeighborLookupRssiThreshold);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+            "Name = [nOpportunisticThresholdDiff] Value = [%u] ",
+            pHddCtx->cfg_ini->nOpportunisticThresholdDiff);
+  VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+            "Name = [nRoamRescanRssiDiff] Value = [%u] ",
+            pHddCtx->cfg_ini->nRoamRescanRssiDiff);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [nNeighborScanMinChanTime] Value = [%u] ",pHddCtx->cfg_ini->nNeighborScanMinChanTime);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [nNeighborScanMaxChanTime] Value = [%u] ",pHddCtx->cfg_ini->nNeighborScanMaxChanTime);
   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, "Name = [nMaxNeighborRetries] Value = [%u] ",pHddCtx->cfg_ini->nMaxNeighborReqTries);
@@ -4960,6 +5004,10 @@ VOS_STATUS hdd_set_sme_config( hdd_context_t *pHddCtx )
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
    smeConfig.csrConfig.neighborRoamConfig.nNeighborReassocRssiThreshold = pConfig->nNeighborReassocRssiThreshold;
    smeConfig.csrConfig.neighborRoamConfig.nNeighborLookupRssiThreshold = pConfig->nNeighborLookupRssiThreshold;
+   smeConfig.csrConfig.neighborRoamConfig.nOpportunisticThresholdDiff =
+       pConfig->nOpportunisticThresholdDiff;
+   smeConfig.csrConfig.neighborRoamConfig.nRoamRescanRssiDiff =
+       pConfig->nRoamRescanRssiDiff;
    smeConfig.csrConfig.neighborRoamConfig.nNeighborScanMaxChanTime = pConfig->nNeighborScanMaxChanTime;
    smeConfig.csrConfig.neighborRoamConfig.nNeighborScanMinChanTime = pConfig->nNeighborScanMinChanTime;
    smeConfig.csrConfig.neighborRoamConfig.nNeighborScanTimerPeriod = pConfig->nNeighborScanPeriod;
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 571d0b0e7674..22cfc32b9aa0 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -2190,7 +2190,10 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
          ((WLAN_HDD_GET_CTX(pHostapdAdapter))->cfg_ini->dot11Mode == eHDD_DOT11_MODE_11ac) ||
          ((WLAN_HDD_GET_CTX(pHostapdAdapter))->cfg_ini->dot11Mode == eHDD_DOT11_MODE_11ac_ONLY)) )
     {
-        pConfig->SapHw_mode = eSAP_DOT11_MODE_11ac;
+        if ((WLAN_HDD_GET_CTX(pHostapdAdapter))->cfg_ini->dot11Mode == eHDD_DOT11_MODE_11ac_ONLY)
+            pConfig->SapHw_mode = eSAP_DOT11_MODE_11ac_ONLY;
+        else
+            pConfig->SapHw_mode = eSAP_DOT11_MODE_11ac;
 
         /* Disable VHT support in 2.4 GHz band */
         if (pConfig->channel <= 14 &&
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index 2ae96c3601a5..95e5b7f535b3 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -715,7 +715,16 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
             {
                 hdd_abort_mac_scan(pHddCtx, pHostapdAdapter->sessionId);
             }
-
+#ifdef QCA_WIFI_2_0
+            if (pHostapdAdapter->device_mode == WLAN_HDD_P2P_GO)
+            {
+                /* send peer status indication to oem app */
+                hdd_SendPeerStatusIndToOemApp(
+                  &pSapEvent->sapevt.sapStationAssocReassocCompleteEvent.staMac,
+                  ePeerConnected, 0,
+                  pHostapdAdapter->sessionId, pHddApCtx->operatingChannel);
+            }
+#endif
             break;
         case eSAP_STA_DISASSOC_EVENT:
             memcpy(wrqu.addr.sa_data, &pSapEvent->sapevt.sapStationDisassocCompleteEvent.staMac,
@@ -772,6 +781,16 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
 #endif
             //Update the beacon Interval if it is P2P GO
             hdd_change_mcc_go_beacon_interval(pHostapdAdapter);
+#ifdef QCA_WIFI_2_0
+            if (pHostapdAdapter->device_mode == WLAN_HDD_P2P_GO)
+            {
+                /* send peer status indication to oem app */
+                hdd_SendPeerStatusIndToOemApp(
+                  &pSapEvent->sapevt.sapStationDisassocCompleteEvent.staMac,
+                  ePeerDisconnected, 0,
+                  pHostapdAdapter->sessionId, pHddApCtx->operatingChannel);
+            }
+#endif
             break;
         case eSAP_WPS_PBC_PROBE_REQ_EVENT:
         {
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 5f7812f934d1..d311e4c4b0da 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -1168,6 +1168,7 @@ static void hdd_batch_scan_result_ind_callback
          VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
             "%s: pBatchScanRsp is %p pReq %p", __func__, pBatchScanRsp, pReq);
             isLastAp = TRUE;
+         pAdapter->numScanList = 0;
          goto done;
     }
 
@@ -3217,6 +3218,89 @@ int hdd_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                goto exit;
            }
        }
+       else if (strncmp(command, "SETOPPORTUNISTICRSSIDIFF", 24) == 0)
+       {
+           tANI_U8 *value = command;
+           tANI_U8 nOpportunisticThresholdDiff = CFG_OPPORTUNISTIC_SCAN_THRESHOLD_DIFF_DEFAULT;
+
+           /* Move pointer to ahead of SETOPPORTUNISTICRSSIDIFF<delimiter> */
+           value = value + 25;
+           /* Convert the value from ascii to integer */
+           ret = kstrtou8(value, 10, &nOpportunisticThresholdDiff);
+           if (ret < 0)
+           {
+               /* If the input value is greater than max value of datatype, then also
+                  kstrtou8 fails */
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "%s: kstrtou8 failed.", __func__);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                      "%s: Received Command to Set Opportunistic Threshold diff = %d",
+                      __func__,
+                      nOpportunisticThresholdDiff);
+
+           sme_SetRoamOpportunisticScanThresholdDiff((tHalHandle)(pHddCtx->hHal),
+                                                        nOpportunisticThresholdDiff);
+       }
+       else if (strncmp(priv_data.buf, "GETOPPORTUNISTICRSSIDIFF", 24) == 0)
+       {
+           tANI_S8 val = sme_GetRoamOpportunisticScanThresholdDiff((tHalHandle)(pHddCtx->hHal));
+           char extra[32];
+           tANI_U8 len = 0;
+
+           len = scnprintf(extra, sizeof(extra), "%s %d", command, val);
+           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: failed to copy data to user buffer", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+       }
+       else if (strncmp(command, "SETROAMRESCANRSSIDIFF", 21) == 0)
+       {
+           tANI_U8 *value = command;
+           tANI_U8 nRoamRescanRssiDiff = CFG_ROAM_RESCAN_RSSI_DIFF_DEFAULT;
+
+           /* Move pointer to ahead of SETROAMRESCANRSSIDIFF<delimiter> */
+           value = value + 22;
+           /* Convert the value from ascii to integer */
+           ret = kstrtou8(value, 10, &nRoamRescanRssiDiff);
+           if (ret < 0)
+           {
+               /* If the input value is greater than max value of datatype, then also
+                  kstrtou8 fails */
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                      "%s: kstrtou8 failed.", __func__);
+               ret = -EINVAL;
+               goto exit;
+           }
+
+           VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                      "%s: Received Command to Set Roam Rescan RSSI Diff = %d",
+                      __func__,
+                      nRoamRescanRssiDiff);
+           sme_SetRoamRescanRssiDiff((tHalHandle)(pHddCtx->hHal),
+                                     nRoamRescanRssiDiff);
+       }
+       else if (strncmp(priv_data.buf, "GETROAMRESCANRSSIDIFF", 21) == 0)
+       {
+           tANI_U8 val = sme_GetRoamRescanRssiDiff((tHalHandle)(pHddCtx->hHal));
+           char extra[32];
+           tANI_U8 len = 0;
+
+           len = scnprintf(extra, sizeof(extra), "%s %d", command, val);
+           if (copy_to_user(priv_data.buf, &extra, len + 1))
+           {
+               VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: failed to copy data to user buffer", __func__);
+               ret = -EFAULT;
+               goto exit;
+           }
+       }
 #endif /* WLAN_FEATURE_VOWIFI_11R || FEATURE_WLAN_CCX || FEATURE_WLAN_LFR */
 #ifdef FEATURE_WLAN_LFR
        else if (strncmp(command, "SETFASTROAM", 11) == 0)
diff --git a/CORE/HDD/src/wlan_hdd_oemdata.c b/CORE/HDD/src/wlan_hdd_oemdata.c
index ea587a5e42ae..9ad0a6657499 100644
--- a/CORE/HDD/src/wlan_hdd_oemdata.c
+++ b/CORE/HDD/src/wlan_hdd_oemdata.c
@@ -251,7 +251,7 @@ static int oem_msg_callback(struct sk_buff *skb);
   and Response.
 
   \param - dev  - Pointer to the net device
-         - info - Pointer to the iw_oem_data_cap
+         - info - Pointer to the t_iw_oem_data_cap
          - wrqu - Pointer to the iwreq data
          - extra - Pointer to the data
 
@@ -265,11 +265,14 @@ int iw_get_oem_data_cap(
         char *extra)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
-    struct iw_oem_data_cap oemDataCap;
-    struct iw_oem_data_cap *pHddOemDataCap;
+    t_iw_oem_data_cap oemDataCap;
+    t_iw_oem_data_cap *pHddOemDataCap;
     hdd_adapter_t *pAdapter = (netdev_priv(dev));
     hdd_context_t *pHddContext;
     hdd_config_t *pConfig;
+    tANI_U32 numChannels;
+    tANI_U8 chanList[OEM_CAP_MAX_NUM_CHANNELS];
+    tANI_U32 i;
 
     ENTER();
 
@@ -305,6 +308,7 @@ int iw_get_oem_data_cap(
 
     do
     {
+       vos_mem_zero(&oemDataCap, sizeof(oemDataCap));
        strlcpy(oemDataCap.oem_target_signature, OEM_TARGET_SIGNATURE,
                OEM_TARGET_SIGNATURE_LEN);
        oemDataCap.oem_target_type = pHddContext->target_type;
@@ -321,19 +325,37 @@ int iw_get_oem_data_cap(
                sme_getNeighborScanMaxChanTime(pHddContext->hHal);
        oemDataCap.supported_bands = pConfig->nBandCapability;
 
-       status = sme_getValidChannelList(pHddContext->hHal,
-                                        &oemDataCap.num_channels,
-                                        &oemDataCap.channel_list);
-       if (eHAL_STATUS_SUCCESS == status)
+       /* request for max num of channels */
+       numChannels = WNI_CFG_VALID_CHANNEL_LIST_LEN;
+       status = sme_GetCfgValidChannels(pHddContext->hHal,
+                                        &chanList[0],
+                                        &numChannels);
+       if (eHAL_STATUS_SUCCESS != status)
        {
          VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                    "%s:failed to get valid channel list", __func__);
          return -ENOENT;
        }
+       else
+       {
+         /* make sure num channels is not more than chan list array */
+         if (numChannels > OEM_CAP_MAX_NUM_CHANNELS)
+         {
+           VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                     "%s:Num of channels(%d) more than length(%d) of chanlist",
+                     __func__, numChannels, OEM_CAP_MAX_NUM_CHANNELS);
+           return -ENOMEM;
+         }
 
-       pHddOemDataCap = (struct iw_oem_data_cap *)(extra);
-       vos_mem_copy(pHddOemDataCap, &oemDataCap,
-                    sizeof(struct iw_oem_data_cap));
+         oemDataCap.num_channels = numChannels;
+         for (i = 0; i < numChannels; i++)
+         {
+           oemDataCap.channel_list[i] = chanList[i];
+         }
+       }
+
+       pHddOemDataCap = (t_iw_oem_data_cap *)(extra);
+       vos_mem_copy(pHddOemDataCap, &oemDataCap, sizeof(*pHddOemDataCap));
     } while(0);
 
     EXIT();
@@ -624,8 +646,9 @@ int oem_process_channel_info_req_msg(int numOfChannels, char *chanList)
    struct sk_buff *skb;
    struct nlmsghdr *nlh;
    tAniMsgHdr *aniHdr;
-   tSmeChannelInfo *pChanInfo;
-   tSmeChannelInfo chanInfo;
+   tHddChannelInfo *pHddChanInfo;
+   tHddChannelInfo hddChanInfo;
+   tSmeChannelInfo smeChanInfo;
    tANI_U8 chanId;
    eHalStatus status = eHAL_STATUS_FAILURE;
    int i;
@@ -640,7 +663,7 @@ int oem_process_channel_info_req_msg(int numOfChannels, char *chanList)
    }
 
    skb = alloc_skb(NLMSG_SPACE(sizeof(tAniMsgHdr) + sizeof(tANI_U8) +
-                   numOfChannels * sizeof(tSmeChannelInfo)), GFP_KERNEL);
+                   numOfChannels * sizeof(tHddChannelInfo)), GFP_KERNEL);
    if (skb == NULL)
    {
       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
@@ -656,7 +679,7 @@ int oem_process_channel_info_req_msg(int numOfChannels, char *chanList)
    aniHdr = NLMSG_DATA(nlh);
    aniHdr->type = ANI_MSG_CHANNEL_INFO_RSP;
 
-   aniHdr->length = sizeof(tANI_U8) + numOfChannels * sizeof(tSmeChannelInfo);
+   aniHdr->length = sizeof(tANI_U8) + numOfChannels * sizeof(tHddChannelInfo);
    nlh->nlmsg_len = NLMSG_LENGTH((sizeof(tAniMsgHdr) + aniHdr->length));
 
    /* First byte of message body will have num of channels */
@@ -669,12 +692,24 @@ int oem_process_channel_info_req_msg(int numOfChannels, char *chanList)
     */
    for (i = 0 ; i < numOfChannels; i++)
    {
-      pChanInfo = (tSmeChannelInfo *) ((char *) buf +
-                                        i * sizeof(tSmeChannelInfo));
+      pHddChanInfo = (tHddChannelInfo *) ((char *) buf +
+                                        i * sizeof(tHddChannelInfo));
 
       chanId = chanList[i];
-      status = sme_getChannelInfo(pHddCtx->hHal, chanId, &chanInfo);
-      if (eHAL_STATUS_SUCCESS != status)
+      status = sme_getChannelInfo(pHddCtx->hHal, chanId, &smeChanInfo);
+      if (eHAL_STATUS_SUCCESS == status)
+      {
+         /* copy into hdd chan info struct */
+         hddChanInfo.chan_id = smeChanInfo.chan_id;
+         hddChanInfo.reserved0 = 0;
+         hddChanInfo.mhz = smeChanInfo.mhz;
+         hddChanInfo.band_center_freq1 = smeChanInfo.band_center_freq1;
+         hddChanInfo.band_center_freq2 = smeChanInfo.band_center_freq2;
+         hddChanInfo.info = smeChanInfo.info;
+         hddChanInfo.reg_info_1 = smeChanInfo.reg_info_1;
+         hddChanInfo.reg_info_2 = smeChanInfo.reg_info_2;
+      }
+      else
       {
          /* channel info is not returned, fill in zeros in channel
           * info struct
@@ -682,15 +717,16 @@ int oem_process_channel_info_req_msg(int numOfChannels, char *chanList)
          VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                    "%s: sme_getChannelInfo failed for chan (%d), return info 0",
                    __func__, chanId);
-         chanInfo.chan_id = chanId;
-         chanInfo.mhz = 0;
-         chanInfo.band_center_freq1 = 0;
-         chanInfo.band_center_freq2 = 0;
-         chanInfo.info = 0;
-         chanInfo.reg_info_1 = 0;
-         chanInfo.reg_info_2 = 0;
+         hddChanInfo.chan_id = chanId;
+         hddChanInfo.reserved0 = 0;
+         hddChanInfo.mhz = 0;
+         hddChanInfo.band_center_freq1 = 0;
+         hddChanInfo.band_center_freq2 = 0;
+         hddChanInfo.info = 0;
+         hddChanInfo.reg_info_1 = 0;
+         hddChanInfo.reg_info_2 = 0;
       }
-      vos_mem_copy(pChanInfo, &chanInfo, sizeof(tSmeChannelInfo));
+      vos_mem_copy(pHddChanInfo, &hddChanInfo, sizeof(tHddChannelInfo));
    }
 
    skb_put(skb, NLMSG_SPACE((sizeof(tAniMsgHdr) + aniHdr->length)));
@@ -706,6 +742,112 @@ int oem_process_channel_info_req_msg(int numOfChannels, char *chanList)
 
 /**---------------------------------------------------------------------------
 
+  \brief hdd_SendPeerStatusIndToOemApp()
+
+  This function sends peer status indication to registered oem application
+
+  \param -
+     - peerMac : MAC address of peer
+     - peerStatus : ePeerConnected or ePeerDisconnected
+     - peerTimingMeasCap : 0: RTT/RTT2, 1: RTT3. Default is 0
+     - sessionId : SME session id, i.e. vdev_id
+     - chanId: operating channel id
+
+  \return - None
+
+  --------------------------------------------------------------------------*/
+void hdd_SendPeerStatusIndToOemApp(v_MACADDR_t *peerMac,
+                                     tANI_U8 peerStatus,
+                                     tANI_U8 peerTimingMeasCap,
+                                     tANI_U8 sessionId,
+                                     tANI_U8 chanId)
+{
+   struct sk_buff *skb;
+   struct nlmsghdr *nlh;
+   tAniMsgHdr *aniHdr;
+   tSmeChannelInfo smeChanInfo;
+   tPeerStatusInfo *pPeerInfo;
+   eHalStatus status = eHAL_STATUS_FAILURE;
+
+   if (!pHddCtx || !pHddCtx->hHal)
+   {
+     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+               "%s: Either HDD Ctx is null or Hal Ctx is null", __func__);
+     return;
+   }
+
+   /* check if oem app has registered and pid is valid */
+   if ((!pHddCtx->oem_app_registered) || (pHddCtx->oem_pid == 0))
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: OEM app is not registered(%d) or pid is invalid(%d)",
+                __func__, pHddCtx->oem_app_registered, pHddCtx->oem_pid);
+      return;
+   }
+
+   status = sme_getChannelInfo(pHddCtx->hHal, chanId, &smeChanInfo);
+   if (eHAL_STATUS_SUCCESS != status)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: sme_getChannelInfo failed for chan (%d)",
+                __func__, chanId);
+      return;
+   }
+
+   skb = alloc_skb(NLMSG_SPACE(sizeof(tAniMsgHdr) + sizeof(tPeerStatusInfo)),
+                   GFP_KERNEL);
+   if (skb == NULL)
+   {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                "%s: alloc_skb failed", __func__);
+      return;
+   }
+
+   nlh = (struct nlmsghdr *)skb->data;
+   nlh->nlmsg_pid = 0;  /* from kernel */
+   nlh->nlmsg_flags = 0;
+   nlh->nlmsg_seq = 0;
+   nlh->nlmsg_type = WLAN_NL_MSG_OEM;
+   aniHdr = NLMSG_DATA(nlh);
+   aniHdr->type = ANI_MSG_PEER_STATUS_IND;
+
+   aniHdr->length = sizeof(tPeerStatusInfo);
+   nlh->nlmsg_len = NLMSG_LENGTH((sizeof(tAniMsgHdr) + aniHdr->length));
+
+   pPeerInfo = (tPeerStatusInfo *) ((char *)aniHdr + sizeof(tAniMsgHdr));
+
+   vos_mem_copy(pPeerInfo->peer_mac_addr, peerMac->bytes,
+                sizeof(peerMac->bytes));
+   pPeerInfo->peer_status = peerStatus;
+   pPeerInfo->vdev_id = sessionId;
+   pPeerInfo->peer_capability = peerTimingMeasCap;
+   pPeerInfo->reserved0 = 0;
+
+   pPeerInfo->peer_chan_info.chan_id = smeChanInfo.chan_id;
+   pPeerInfo->peer_chan_info.reserved0 = 0;
+   pPeerInfo->peer_chan_info.mhz = smeChanInfo.mhz;
+   pPeerInfo->peer_chan_info.band_center_freq1 = smeChanInfo.band_center_freq1;
+   pPeerInfo->peer_chan_info.band_center_freq2 = smeChanInfo.band_center_freq2;
+   pPeerInfo->peer_chan_info.info = smeChanInfo.info;
+   pPeerInfo->peer_chan_info.reg_info_1 = smeChanInfo.reg_info_1;
+   pPeerInfo->peer_chan_info.reg_info_2 = smeChanInfo.reg_info_2;
+
+   skb_put(skb, NLMSG_SPACE((sizeof(tAniMsgHdr) + aniHdr->length)));
+
+   VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+             "%s: sending peer "MAC_ADDRESS_STR
+             " status(%d), peerTimingMeasCap(%d), vdevId(%d), chanId(%d)"
+             " to oem app pid(%d)",
+             __func__, MAC_ADDR_ARRAY(peerMac->bytes), peerStatus,
+             peerTimingMeasCap, sessionId, chanId, pHddCtx->oem_pid);
+
+   (void)nl_srv_ucast(skb, pHddCtx->oem_pid);
+
+   return;
+}
+
+/**---------------------------------------------------------------------------
+
   \brief oem_activate_service() - Activate oem message handler
 
   This function registers a handler to receive netlink message from
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index 324405e0ee8e..6cfbe2a4db48 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -325,6 +325,9 @@ static const hdd_freq_chan_map_t freq_chan_map[] = { {2412, 1}, {2417, 2},
 #define WE_GET_STATES        10
 #ifdef QCA_WIFI_2_0
 #define WE_GET_PHYMODE       12
+#ifdef FEATURE_OEM_DATA_SUPPORT
+#define WE_GET_OEM_DATA_CAP  13
+#endif
 #endif
 
 /* Private ioctls and their sub-ioctls */
@@ -426,12 +429,7 @@ static const hdd_freq_chan_map_t freq_chan_map[] = { {2412, 1}, {2417, 2},
 /* Private ioctl to trigger reassociation */
 
 #define WLAN_SET_POWER_PARAMS        (SIOCIWFIRSTPRIV + 29)
-#ifdef FEATURE_OEM_DATA_SUPPORT
-#ifdef QCA_WIFI_2_0
-/* Private ioctl to get capability information for OEM Data Request/Response */
-#define WLAN_PRIV_GET_OEM_DATA_CAP   (SIOCIWFIRSTPRIV + 30)
-#endif
-#endif
+
 #define WLAN_GET_LINK_SPEED          (SIOCIWFIRSTPRIV + 31)
 
 /* Private ioctls and their sub-ioctls */
@@ -1869,20 +1867,34 @@ static int iw_set_genie(struct net_device *dev,
 {
    hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
     hdd_wext_state_t *pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
-    u_int8_t *genie = (u_int8_t *)extra;
+    u_int8_t *genie = NULL;
+    u_int8_t *base_genie = NULL;
     v_U16_t remLen;
 
    ENTER();
-   if(!wrqu->data.length) {
-      hdd_clearRoamProfileIe(pAdapter);
-      EXIT();
-      return 0;
-   }
 
     if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) {
-      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL, "%s:LOGP in Progress. Ignore!!!",__func__);
-      return 0;
-   }
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+                  "%s:LOGP in Progress. Ignore!!!", __func__);
+        return 0;
+    }
+
+    if (!wrqu->data.length) {
+        hdd_clearRoamProfileIe(pAdapter);
+        EXIT();
+        return 0;
+    }
+
+    base_genie = mem_alloc_copy_from_user_helper(wrqu->data.pointer,
+                                                 wrqu->data.length);
+    if (NULL == base_genie)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "mem_alloc_copy_from_user_helper fail");
+        return -ENOMEM;
+    }
+
+    genie = base_genie;
 
     remLen = wrqu->data.length;
 
@@ -1906,7 +1918,10 @@ static int iw_set_genie(struct net_device *dev,
          {
             case IE_EID_VENDOR:
                 if ((IE_LEN_SIZE+IE_EID_SIZE+IE_VENDOR_OUI_SIZE) > eLen) /* should have at least OUI */
-                return -EINVAL;
+                {
+                    kfree(base_genie);
+                    return -EINVAL;
+                }
 
                 if (0 == memcmp(&genie[0], "\x00\x50\xf2\x04", 4))
                 {
@@ -1919,6 +1934,7 @@ static int iw_set_genie(struct net_device *dev,
                        hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. "
                                                       "Need bigger buffer space\n");
                        VOS_ASSERT(0);
+                       kfree(base_genie);
                        return -ENOMEM;
                     }
                     // save to Additional IE ; it should be accumulated to handle WPS IE + other IE
@@ -1944,6 +1960,7 @@ static int iw_set_genie(struct net_device *dev,
                        hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. "
                                                       "Need bigger buffer space\n");
                        VOS_ASSERT(0);
+                       kfree(base_genie);
                        return -ENOMEM;
                     }
                     // save to Additional IE ; it should be accumulated to handle WPS IE + other IE
@@ -1961,12 +1978,14 @@ static int iw_set_genie(struct net_device *dev,
 
          default:
                 hddLog (LOGE, "%s Set UNKNOWN IE %X",__func__, elementId);
+            kfree(base_genie);
             return 0;
     }
         genie += eLen;
         remLen -= eLen;
     }
     EXIT();
+    kfree(base_genie);
     return 0;
 }
 
@@ -2720,7 +2739,7 @@ static int iw_get_linkspeed(struct net_device *dev,
    }
 
   /* a value is being successfully returned */
-   return 0;
+   return rc;
 }
 
 
@@ -2783,7 +2802,7 @@ static int iw_get_rssi(struct net_device *dev,
    }
 
    /* a value is being successfully returned */
-   return 0;
+   return rc;
 }
 
 /*
@@ -3041,13 +3060,23 @@ static int iw_set_priv(struct net_device *dev,
                        union iwreq_data *wrqu, char *extra)
 {
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
-    char *cmd = extra;
+    char *cmd = NULL;
     int cmd_len = wrqu->data.length;
     int ret = 0;
-    int status = 0;
+    int rc = 0;
+    VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
 
     ENTER();
+    cmd = mem_alloc_copy_from_user_helper(wrqu->data.pointer,
+                                          wrqu->data.length);
+    if (NULL == cmd)
+    {
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "mem_alloc_copy_from_user_helper fail");
+        return -ENOMEM;
+    }
 
     if (ioctl_debug)
     {
@@ -3058,27 +3087,32 @@ static int iw_set_priv(struct net_device *dev,
            "%s: ***Received %s cmd from Wi-Fi GUI***", __func__, cmd);
 
     if (pHddCtx->isLogpInProgress) {
-       if (ioctl_debug)
-       {
-          pr_info("%s: RESTART in progress\n", __func__);
-       }
+        if (ioctl_debug)
+        {
+            pr_info("%s: RESTART in progress\n", __func__);
+        }
 
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
                  "%s:LOGP in Progress. Ignore!!!",__func__);
-       return status;
+        kfree(cmd);
+        return -EBUSY;
     }
 
-    if(strncmp(cmd, "CSCAN",5) == 0 )
+    if (strncmp(cmd, "CSCAN", 5) == 0 )
     {
-       status = iw_set_cscan(dev, info, wrqu, extra);
+       if (eHAL_STATUS_SUCCESS != iw_set_cscan(dev, info, wrqu, cmd)) {
+           VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                     "%s: Error in iw_set_scan!", __func__);
+          rc = -EINVAL;
+       }
     }
     else if( strcasecmp(cmd, "start") == 0 ) {
 
         hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "Start command\n");
         /*Exit from Deep sleep or standby if we get the driver START cmd from android GUI*/
-        status = wlan_hdd_exit_lowpower(pHddCtx, pAdapter);
 
-        if(status == VOS_STATUS_SUCCESS)
+        vos_status = wlan_hdd_exit_lowpower(pHddCtx, pAdapter);
+        if (vos_status == VOS_STATUS_SUCCESS)
         {
             union iwreq_data wrqu;
             char buf[10];
@@ -3089,7 +3123,8 @@ static int iw_set_priv(struct net_device *dev,
         }
         else
         {
-            hddLog(VOS_TRACE_LEVEL_FATAL, "%s: START CMD Status %d", __func__, status);
+            hddLog(VOS_TRACE_LEVEL_ERROR, "%s: START CMD Status %d", __func__, vos_status);
+            rc = -EIO;
         }
         goto done;
     }
@@ -3104,7 +3139,6 @@ static int iw_set_priv(struct net_device *dev,
         memset(&wrqu, 0, sizeof(wrqu));
         wrqu.data.length = strlcpy(buf, "STOP", sizeof(buf));
         wireless_send_event(pAdapter->dev, IWEVCUSTOM, &wrqu, buf);
-        status = VOS_STATUS_SUCCESS;
         goto done;
     }
     else if (strcasecmp(cmd, "macaddr") == 0)
@@ -3128,17 +3162,18 @@ static int iw_set_priv(struct net_device *dev,
     }
     else if( strcasecmp(cmd, "linkspeed") == 0 )
     {
-        status = iw_get_linkspeed(dev, info, wrqu, extra);
+        ret = iw_get_linkspeed(dev, info, wrqu, cmd);
     }
     else if( strncasecmp(cmd, "COUNTRY", 7) == 0 ) {
         char *country_code;
         long lrc;
+        eHalStatus eHal_status;
 
         country_code =  cmd + 8;
 
         init_completion(&pAdapter->change_country_code);
 
-        status = (int)sme_ChangeCountryCode(pHddCtx->hHal,
+        eHal_status = sme_ChangeCountryCode(pHddCtx->hHal,
                                             (void *)(tSmeChangeCountryCallback)wlan_hdd_change_country_code_callback,
                                             country_code,
                                             pAdapter,
@@ -3153,19 +3188,20 @@ static int iw_set_priv(struct net_device *dev,
         if (lrc <= 0)
         {
             hddLog(VOS_TRACE_LEVEL_ERROR,"%s: SME %s while setting country code ",
-                 __func__, "Timed out");
+                   __func__, "Timed out");
         }
 
-        if( 0 != status )
+        if (eHAL_STATUS_SUCCESS != eHal_status)
         {
             VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-                       "%s: SME Change Country code fail \n",__func__);
-            return VOS_STATUS_E_FAILURE;
+                       "%s: SME Change Country code fail", __func__);
+            kfree(cmd);
+            return -EIO;
         }
     }
     else if( strncasecmp(cmd, "rssi", 4) == 0 )
     {
-        status = iw_get_rssi(dev, info, wrqu, extra);
+        ret = iw_get_rssi(dev, info, wrqu, cmd);
     }
     else if( strncasecmp(cmd, "powermode", 9) == 0 ) {
         int mode;
@@ -3178,14 +3214,16 @@ static int iw_set_priv(struct net_device *dev,
         }else{
               VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                         "CMD LENGTH %d is not correct",cmd_len);
-              return VOS_STATUS_E_FAILURE;
+              kfree(cmd);
+              return -EINVAL;
         }
 
         if (1 != sscanf(ptr,"%d",&mode))
         {
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                       "powermode input %s is not correct",ptr);
-            return VOS_STATUS_E_FAILURE;
+            kfree(cmd);
+            return -EIO;
         }
 
         if(!pHddCtx->cfg_ini->enablePowersaveOffload)
@@ -3253,21 +3291,23 @@ static int iw_set_priv(struct net_device *dev,
     }
     else if( strncasecmp(cmd, "pno",3) == 0 ) {
 
-        hddLog( VOS_TRACE_LEVEL_INFO, "pno\n");
-        status = iw_set_pno(dev, info, wrqu, extra, 3);
-        return status;
+        hddLog( VOS_TRACE_LEVEL_INFO, "pno");
+        vos_status = iw_set_pno(dev, info, wrqu, cmd, 3);
+        kfree(cmd);
+        return (vos_status == VOS_STATUS_SUCCESS) ? 0 : -EINVAL;
     }
     else if( strncasecmp(cmd, "rssifilter",10) == 0 ) {
-
-        hddLog( VOS_TRACE_LEVEL_INFO, "rssifilter\n");
-        status = iw_set_rssi_filter(dev, info, wrqu, extra, 10);
-        return status;
+        hddLog( VOS_TRACE_LEVEL_INFO, "rssifilter");
+        vos_status = iw_set_rssi_filter(dev, info, wrqu, cmd, 10);
+        kfree(cmd);
+        return (vos_status == VOS_STATUS_SUCCESS) ? 0 : -EINVAL;
     }
 #endif /*FEATURE_WLAN_SCAN_PNO*/
     else if( strncasecmp(cmd, "powerparams",11) == 0 ) {
-      hddLog( VOS_TRACE_LEVEL_INFO, "powerparams\n");
-      status = iw_set_power_params(dev, info, wrqu, extra, 11);
-      return status;
+      hddLog( VOS_TRACE_LEVEL_INFO, "powerparams");
+      vos_status = iw_set_power_params(dev, info, wrqu, cmd, 11);
+      kfree(cmd);
+      return (vos_status == VOS_STATUS_SUCCESS) ? 0 : -EINVAL;
     }
     else if( 0 == strncasecmp(cmd, "CONFIG-TX-TRACKING", 18) ) {
         tSirTxPerTrackingParam tTxPerTrackingParam;
@@ -3279,7 +3319,8 @@ static int iw_set_priv(struct net_device *dev,
         }else{
                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                          "CMD LENGTH %d is not correct",cmd_len);
-               return VOS_STATUS_E_FAILURE;
+               kfree(cmd);
+               return -EINVAL;
         }
 
         if (4 != sscanf(ptr,"%hhu %hhu %hhu %u",
@@ -3290,7 +3331,8 @@ static int iw_set_priv(struct net_device *dev,
         {
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                       "CONFIG-TX-TRACKING %s input is not correct",ptr);
-                      return VOS_STATUS_E_FAILURE;
+                      kfree(cmd);
+                      return -EIO;
         }
 
         // parameters checking
@@ -3298,7 +3340,8 @@ static int iw_set_priv(struct net_device *dev,
         if (0 == tTxPerTrackingParam.ucTxPerTrackingPeriod)
         {
             VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN, "Period input is not correct");
-            return VOS_STATUS_E_FAILURE;
+            kfree(cmd);
+            return -EIO;
         }
 
         // use default value 5 is the input is not reasonable. in unit of 10%
@@ -3315,9 +3358,12 @@ static int iw_set_priv(struct net_device *dev,
             tTxPerTrackingParam.uTxPerTrackingWatermark = TX_PER_TRACKING_DEFAULT_WATERMARK;
         }
 
-        status = sme_SetTxPerTracking(pHddCtx->hHal, hdd_tx_per_hit_cb, (void*)pAdapter, &tTxPerTrackingParam);
-        if(status != eHAL_STATUS_SUCCESS){
+        if (eHAL_STATUS_SUCCESS !=
+            sme_SetTxPerTracking(pHddCtx->hHal,
+                                 hdd_tx_per_hit_cb,
+                                 (void*)pAdapter, &tTxPerTrackingParam)) {
            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_WARN, "Set Tx PER Tracking Failed!");
+            rc = -EIO;
         }
     }
     else {
@@ -3331,7 +3377,7 @@ done:
     if ((ret < 0) || (ret >= cmd_len))
     {
        /* there was an encoding error or overflow */
-       status = -EIO;
+       rc = -EINVAL;
     }
     else if (ret > 0)
     {
@@ -3339,6 +3385,7 @@ done:
        {
           hddLog(VOS_TRACE_LEVEL_ERROR,
                  "%s: failed to copy data to user buffer", __func__);
+          kfree(cmd);
           return -EFAULT;
        }
        wrqu->data.length = ret;
@@ -3347,9 +3394,10 @@ done:
     if (ioctl_debug)
     {
        pr_info("%s: rsp [%s] len [%d] status %d\n",
-               __func__, cmd, wrqu->data.length, status);
+               __func__, cmd, wrqu->data.length, rc);
     }
-    return status;
+    kfree(cmd);
+    return rc;
 }
 
 static int iw_set_nick(struct net_device *dev,
@@ -6647,6 +6695,13 @@ static int iw_get_char_setnone(struct net_device *dev, struct iw_request_info *i
            wrqu->data.length = strlen(extra)+1;
            break;
         }
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+        case WE_GET_OEM_DATA_CAP:
+        {
+            return iw_get_oem_data_cap(dev, info, wrqu, extra);
+        }
+#endif /* FEATURE_OEM_DATA_SUPPORT */
 #endif
         default:
         {
@@ -9295,11 +9350,6 @@ static const iw_handler we_private[] = {
    [WLAN_PRIV_SET_MCBC_FILTER           - SIOCIWFIRSTPRIV]   = iw_set_dynamic_mcbc_filter,
    [WLAN_PRIV_CLEAR_MCBC_FILTER         - SIOCIWFIRSTPRIV]   = iw_clear_dynamic_mcbc_filter,
    [WLAN_SET_POWER_PARAMS               - SIOCIWFIRSTPRIV]   = iw_set_power_params_priv,
-#ifdef FEATURE_OEM_DATA_SUPPORT
-#ifdef QCA_WIFI_2_0
-   [WLAN_PRIV_GET_OEM_DATA_CAP - SIOCIWFIRSTPRIV] = iw_get_oem_data_cap,
-#endif
-#endif
    [WLAN_GET_LINK_SPEED                 - SIOCIWFIRSTPRIV]   = iw_get_linkspeed,
    [WLAN_PRIV_SET_TWO_INT_GET_NONE      - SIOCIWFIRSTPRIV]   = iw_set_two_ints_getnone,
 };
@@ -10078,6 +10128,12 @@ static const struct iw_priv_args we_private_args[] = {
         0,
         IW_PRIV_TYPE_CHAR| WE_MAX_STR_LEN,
         "getphymode" },
+#ifdef FEATURE_OEM_DATA_SUPPORT
+    {   WE_GET_OEM_DATA_CAP,
+        0,
+        IW_PRIV_TYPE_CHAR| WE_MAX_STR_LEN,
+        "getOemDataCap" },
+#endif /* FEATURE_OEM_DATA_SUPPORT */
 #endif
 
     /* handlers for main ioctl */
@@ -10315,15 +10371,6 @@ static const struct iw_priv_args we_private_args[] = {
         IW_PRIV_TYPE_CHAR| WE_MAX_STR_LEN,
         0,
         "setpowerparams" },
-#ifdef FEATURE_OEM_DATA_SUPPORT
-#ifdef QCA_WIFI_2_0
-    {
-        WLAN_PRIV_GET_OEM_DATA_CAP,
-        0,
-        IW_PRIV_TYPE_BYTE | sizeof(struct iw_oem_data_cap),
-        "getOemDataCap" },
-#endif
-#endif
     {
         WLAN_GET_LINK_SPEED,
         IW_PRIV_TYPE_CHAR | 18,
diff --git a/CORE/HDD/src/wlan_hdd_wmm.c b/CORE/HDD/src/wlan_hdd_wmm.c
index 7651a6e4be57..782a53fc986f 100644
--- a/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/CORE/HDD/src/wlan_hdd_wmm.c
@@ -2065,8 +2065,17 @@ VOS_STATUS hdd_wmm_acquire_access( hdd_adapter_t* pAdapter,
                 "%s: Implicit QoS for TL AC %d previously failed",
                 __func__, acType);
 
-      pAdapter->hddWmmStatus.wmmAcStatus[acType].wmmAcAccessAllowed = VOS_FALSE;
-      *pGranted = VOS_FALSE;
+      if (!pAdapter->hddWmmStatus.wmmAcStatus[acType].wmmAcAccessRequired)
+      {
+         pAdapter->hddWmmStatus.wmmAcStatus[acType].wmmAcAccessAllowed = VOS_TRUE;
+         *pGranted = VOS_TRUE;
+      }
+      else
+      {
+         pAdapter->hddWmmStatus.wmmAcStatus[acType].wmmAcAccessAllowed = VOS_FALSE;
+         *pGranted = VOS_FALSE;
+      }
+
       return VOS_STATUS_SUCCESS;
    }
 
diff --git a/CORE/MAC/inc/aniGlobal.h b/CORE/MAC/inc/aniGlobal.h
index 5b637bd24d36..2f28e7acc800 100644
--- a/CORE/MAC/inc/aniGlobal.h
+++ b/CORE/MAC/inc/aniGlobal.h
@@ -916,6 +916,8 @@ tLimMlmOemDataRsp       *gpLimMlmOemDataRsp;
     /* Number of channel switch IEs sent so far */
     tANI_U8 gLimDfsChanSwTxCount;
     tANI_U8 gLimDfsTargetChanNum;
+    tANI_U8 fOffloadScanPending; /*Flag to track offload scan */
+    tANI_U8 fOffloadScanP2PSearch; /*Flag to track the p2p search */
 } tAniSirLim, *tpAniSirLim;
 
 typedef struct sLimMgmtFrameRegistration
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 06538f5504dc..21e2dd92e5d8 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,8 +42,8 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            23
+#define QWLAN_VERSION_BUILD            24
 
-#define QWLAN_VERSIONSTR               "1.0.0.23"
+#define QWLAN_VERSIONSTR               "1.0.0.24"
 
 #endif /* QWLAN_VERSION_H */
diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index ec861cd16c22..9a018334673e 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -3802,6 +3802,8 @@ typedef struct sSirRoamOffloadScanReq
   eAniBoolean RoamScanOffloadEnabled;
   eAniBoolean MAWCEnabled;
   tANI_S8     LookupThreshold;
+  tANI_U8     OpportunisticScanThresholdDiff;
+  tANI_U8     RoamRescanRssiDiff;
   tANI_U8     RoamRssiDiff;
   tANI_U8     ChannelCacheType;
   tANI_U8     Command;
@@ -4662,7 +4664,7 @@ typedef struct
 typedef PACKED_PRE struct PACKED_POST
 {
     tANI_U8   bssid[6];     /* BSSID */
-    tANI_U8   ssid[32];     /* SSID */
+    tANI_U8   ssid[33];     /* SSID */
     tANI_U8   ch;           /* Channel */
     tANI_U8   rssi;         /* RSSI or Level */
     /*Timestamp when Network was found. Used to calculate age based on timestamp
diff --git a/CORE/MAC/src/include/dphGlobal.h b/CORE/MAC/src/include/dphGlobal.h
index 3a6ccaf6d78d..af0cb88ab300 100644
--- a/CORE/MAC/src/include/dphGlobal.h
+++ b/CORE/MAC/src/include/dphGlobal.h
@@ -605,6 +605,11 @@ typedef struct sDphHashNode
     tANI_U8 htLdpcCapable;
     tANI_U8 vhtLdpcCapable;
 
+#ifdef FEATURE_WLAN_TDLS
+    tANI_U16 ht_caps;
+    tANI_U32 vht_caps;
+#endif
+
     /* When a station with already an existing dph entry tries to 
 
      * associate again, the old dph entry will be zeroed out except 
diff --git a/CORE/MAC/src/pe/lim/limAssocUtils.c b/CORE/MAC/src/pe/lim/limAssocUtils.c
index d668a36da4ac..cf1c486c1b7d 100644
--- a/CORE/MAC/src/pe/lim/limAssocUtils.c
+++ b/CORE/MAC/src/pe/lim/limAssocUtils.c
@@ -1581,6 +1581,7 @@ tSirRetStatus limPopulateVhtMcsSet(tpAniSirGlobal pMac,
         if( pPeerVHTCaps != NULL)
         {
             tANI_U16 mcsMapMask = MCSMAPMASK1x1;
+            tANI_U16 mcsMapMask2x2 = 0;
             pRates->vhtTxHighestDataRate = SIR_MIN(pRates->vhtTxHighestDataRate, pPeerVHTCaps->txSupDataRate);
             pRates->vhtRxHighestDataRate = SIR_MIN(pRates->vhtRxHighestDataRate, pPeerVHTCaps->rxHighSupDataRate);
 
@@ -1592,16 +1593,19 @@ tSirRetStatus limPopulateVhtMcsSet(tpAniSirGlobal pMac,
                           (IS_24G_CH(psessionEntry->currentOperChannel)))
                     {
                         if(IS_2X2_CHAIN(psessionEntry->chainMask))
-                                mcsMapMask = MCSMAPMASK2x2;
+                            mcsMapMask2x2 = MCSMAPMASK2x2;
+                        else
+                            PELOGE(limLog(pMac, LOGE, FL("2x2 not enabled %d"),
+                                       psessionEntry->chainMask);)
                     }
                     else
                     {
-                        mcsMapMask = MCSMAPMASK2x2;
+                        mcsMapMask2x2 = MCSMAPMASK2x2;
                     }
                }
                else
                {
-                    mcsMapMask = MCSMAPMASK2x2;
+                    mcsMapMask2x2 = MCSMAPMASK2x2;
                }
             }
 
@@ -1613,6 +1617,32 @@ tSirRetStatus limPopulateVhtMcsSet(tpAniSirGlobal pMac,
                 pRates->vhtTxMCSMap &= ~(mcsMapMask);
                 pRates->vhtTxMCSMap |= (pPeerVHTCaps->txMCSMap & mcsMapMask);
             }
+
+            if (mcsMapMask2x2) {
+
+                tANI_U16 peerMcsMap, selfMcsMap;
+
+                peerMcsMap = pPeerVHTCaps->rxMCSMap & mcsMapMask2x2;
+                selfMcsMap = pRates->vhtRxMCSMap & mcsMapMask2x2;
+
+                if ((selfMcsMap != mcsMapMask2x2) &&
+                        ((peerMcsMap == mcsMapMask2x2) ||
+                            (peerMcsMap < selfMcsMap))) {
+                    pRates->vhtRxMCSMap &= ~mcsMapMask2x2;
+                    pRates->vhtRxMCSMap |= peerMcsMap;
+                }
+
+                peerMcsMap = (pPeerVHTCaps->txMCSMap & mcsMapMask2x2);
+                selfMcsMap = (pRates->vhtTxMCSMap & mcsMapMask2x2);
+
+                if ((selfMcsMap != mcsMapMask2x2) &&
+                        ((peerMcsMap == mcsMapMask2x2) ||
+                            (peerMcsMap < selfMcsMap))) {
+                    pRates->vhtTxMCSMap &= ~mcsMapMask2x2;
+                    pRates->vhtTxMCSMap |= peerMcsMap;
+                }
+            }
+
             limLog( pMac, LOG1, FL("enable2x2 - %d vhtRxMCSMap - %x vhtTxMCSMap - %x\n"), pMac->roam.configParam.enable2x2, pRates->vhtRxMCSMap, pRates->vhtTxMCSMap);
 
         }
@@ -2570,6 +2600,18 @@ limAddSta(
              (vht_caps.reserved1 << SIR_MAC_VHT_CAP_RESERVED2));
     }
 
+#ifdef FEATURE_WLAN_TDLS
+    if (STA_ENTRY_TDLS_PEER == pStaDs->staType)
+    {
+        pAddStaParams->ht_caps = pStaDs->ht_caps;
+        pAddStaParams->vht_caps = pStaDs->vht_caps;
+
+        VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+                  "%s: Sta type is TDLS_PEER, ht_caps: 0x%x, vht_caps: 0x%x",
+                  __func__, pAddStaParams->ht_caps, pAddStaParams->vht_caps);
+    }
+#endif
+
     //Disable BA. It will be set as part of ADDBA negotiation.
     for( i = 0; i < STACFG_MAX_TC; i++ )
     {
diff --git a/CORE/MAC/src/pe/lim/limAssocUtils.h b/CORE/MAC/src/pe/lim/limAssocUtils.h
index 8a3ddb0fb799..d1ccbf359a61 100644
--- a/CORE/MAC/src/pe/lim/limAssocUtils.h
+++ b/CORE/MAC/src/pe/lim/limAssocUtils.h
@@ -116,7 +116,7 @@ tSirRetStatus   limPopulateMatchingRateSet(tpAniSirGlobal,
 
 #ifdef WLAN_FEATURE_11AC
 #define MCSMAPMASK1x1 0x3
-#define MCSMAPMASK2x2 0xF
+#define MCSMAPMASK2x2 0xC
 #endif
 
 tSirRetStatus   limAddSta(tpAniSirGlobal, tpDphHashNode, tANI_U8, tpPESession);
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 6ca8ca045bf8..ebc78d849cbd 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -412,6 +412,15 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
         goto error;
     }//end if PhyMode == 11N_only
 
+    if((psessionEntry->limSystemRole == eLIM_AP_ROLE) &&
+       (psessionEntry->dot11mode == WNI_CFG_DOT11_MODE_11AC_ONLY) &&
+       (!pAssocReq->VHTCaps.present))
+    {
+        limSendAssocRspMgmtFrame( pMac, eSIR_MAC_CAPABILITIES_NOT_SUPPORTED_STATUS,
+                                  1, pHdr->sa, subType, 0, psessionEntry );
+        limLog(pMac, LOGE, FL("SOFTAP was in 11AC only mode, reject"));
+        goto error;
+    }//end if PhyMode == 11AC_only
 
     /* Spectrum Management (11h) specific checks */
     if (localCapabilities.spectrumMgt)
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
index a6872a80508f..f903fe5ff95a 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
@@ -4876,6 +4876,8 @@ void limProcessRxScanEvent(tpAniSirGlobal pMac, void *buf)
             break;
         case SCAN_EVENT_START_FAILED:
         case SCAN_EVENT_COMPLETED:
+            pMac->lim.fOffloadScanPending = 0;
+            pMac->lim.fOffloadScanP2PSearch = 0;
             if (P2P_SCAN_TYPE_LISTEN == pScanEvent->p2pScanType)
             {
                 limSendSmeRsp(pMac, eWNI_SME_REMAIN_ON_CHN_RSP,
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index aa683a63c6fd..6971a2f1eb53 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -1073,6 +1073,9 @@ static eHalStatus limSendHalStartScanOffloadReq(tpAniSirGlobal pMac,
     tANI_U16 i, len;
     tSirRetStatus rc = eSIR_SUCCESS;
 
+    pMac->lim.fOffloadScanPending = 0;
+    pMac->lim.fOffloadScanP2PSearch = 0;
+
     /* The tSirScanOffloadReq will reserve the space for first channel,
        so allocate the memory for (numChannels - 1) and uIEFieldLen */
     len = sizeof(tSirScanOffloadReq) + (pScanReq->channelList.numChannels - 1) +
@@ -1150,6 +1153,10 @@ static eHalStatus limSendHalStartScanOffloadReq(tpAniSirGlobal pMac,
         return eHAL_STATUS_FAILURE;
     }
 
+    pMac->lim.fOffloadScanPending = 1;
+    if (pScanReq->p2pSearch)
+        pMac->lim.fOffloadScanP2PSearch = 1;
+
     return eHAL_STATUS_SUCCESS;
 }
 
diff --git a/CORE/MAC/src/pe/lim/limProcessTdls.c b/CORE/MAC/src/pe/lim/limProcessTdls.c
index bca20e832756..7082ee64da26 100644
--- a/CORE/MAC/src/pe/lim/limProcessTdls.c
+++ b/CORE/MAC/src/pe/lim/limProcessTdls.c
@@ -2771,6 +2771,7 @@ static void limTdlsUpdateHashNodeInfo(tpAniSirGlobal pMac, tDphHashNode *pStaDs,
                                                  htCaps->supportedMCSSet);
         pStaDs->baPolicyFlag = 0xFF;
         pMac->lim.gLimTdlsLinkMode = TDLS_LINK_MODE_N ;
+        pStaDs->ht_caps = pTdlsAddStaReq->htCap.capInfo;
     }
     else
     {
@@ -2800,6 +2801,7 @@ static void limTdlsUpdateHashNodeInfo(tpAniSirGlobal pMac, tDphHashNode *pStaDs,
         pStaDs->vhtBeamFormerCapable= pVhtCaps->suBeamFormerCap;
         // TODO , is it necessary , Sunil???
         pMac->lim.gLimTdlsLinkMode = TDLS_LINK_MODE_AC;
+        pStaDs->vht_caps = pTdlsAddStaReq->vhtCap.vhtCapInfo;
     }
     else
     {
diff --git a/CORE/MAC/src/pe/lim/limScanResultUtils.c b/CORE/MAC/src/pe/lim/limScanResultUtils.c
index 3710177c4217..e7f0b6de82bc 100644
--- a/CORE/MAC/src/pe/lim/limScanResultUtils.c
+++ b/CORE/MAC/src/pe/lim/limScanResultUtils.c
@@ -159,7 +159,9 @@ limCollectBssDescription(tpAniSirGlobal pMac,
     /**
      * Drop all the beacons and probe response without P2P IE during P2P search
      */
-    if (NULL != pMac->lim.gpLimMlmScanReq && pMac->lim.gpLimMlmScanReq->p2pSearch)
+    if ((NULL != pMac->lim.gpLimMlmScanReq && pMac->lim.gpLimMlmScanReq->p2pSearch) ||
+            (pMac->fScanOffload && pMac->lim.fOffloadScanPending &&
+             pMac->lim.fOffloadScanP2PSearch))
     {
         if (NULL == limGetP2pIEPtr(pMac, (pBody + SIR_MAC_B_PR_SSID_OFFSET), ieLen))
         {
diff --git a/CORE/SERVICES/COMMON/wlan_tgt_def_config.h b/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
index 866f1b22f29b..132d8971c23f 100644
--- a/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
+++ b/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
@@ -100,7 +100,7 @@
 /*
  * keys per peer node
  */
-#define CFG_TGT_NUM_PEER_KEYS           2
+#define CFG_TGT_NUM_PEER_KEYS           3
 /*
  * total number of data TX and RX TIDs 
  */
diff --git a/CORE/SERVICES/COMMON/wmi_unified.h b/CORE/SERVICES/COMMON/wmi_unified.h
index b6768ee7ddc1..d6fa7f374c0d 100644
--- a/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/CORE/SERVICES/COMMON/wmi_unified.h
@@ -777,6 +777,11 @@ typedef enum {
 #define WMI_OEM_MEASUREMENT_RSP    0x04
 #define WMI_OEM_ERROR_REPORT_RSP   0x05
 
+/* below message subtype is internal to CLD. Target should
+ * never use internal response type
+ */
+#define WMI_OEM_INTERNAL_RSP       0xdeadbeef
+
 #define WMI_CHAN_LIST_TAG 0x1
 #define WMI_SSID_LIST_TAG 0x2
 #define WMI_BSSID_LIST_TAG 0x3
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index bc5b13022b92..dfb99d7e2339 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -543,12 +543,14 @@ static int wma_vdev_start_resp_handler(void *handle, u_int8_t *cmd_param_info,
 		params->chainMask = resp_event->chain_mask;
 		params->smpsMode = host_map_smps_mode(resp_event->smps_mode);
 		params->status = resp_event->status;
+
       /*
        * Marking the VDEV UP STATUS to FALSE
        * since, VDEV RESTART will do a VDEV DOWN
        * in the firmware.
        */
-      iface->vdev_up = FALSE;
+
+		iface->vdev_up = FALSE;
 		wma_send_msg(wma, WDA_SWITCH_CHANNEL_RSP, (void *)params, 0);
 	} else if (req_msg->msg_type == WDA_ADD_BSS_REQ) {
 		tpAddBssParams bssParams = (tpAddBssParams) req_msg->user_data;
@@ -677,6 +679,14 @@ static v_VOID_t wma_set_default_tgt_config(tp_wma_handle wma_handle)
 	tgt_cfg.num_peers = no_of_peers_supported + CFG_TGT_NUM_VDEV + 2;
 	tgt_cfg.num_tids = (2 * (no_of_peers_supported + CFG_TGT_NUM_VDEV + 2));
 
+        /* Set the num of Keys per peer to 3 and 4 for Rome 1.1 and
+         * Rome 1.3 respectively
+         */
+        if (scn->target_version == AR6320_REV1_1_VERSION)
+            tgt_cfg.num_peer_keys = CFG_TGT_NUM_PEER_KEYS;
+        else
+            tgt_cfg.num_peer_keys = CFG_TGT_NUM_PEER_KEYS + 1;
+
 	WMITLV_SET_HDR(&tgt_cfg.tlv_header,WMITLV_TAG_STRUC_wmi_resource_config,
 		       WMITLV_GET_STRUCT_TLVLEN(wmi_resource_config));
 	/* reduce the peer/vdev if CFG_TGT_NUM_MSDU_DESC exceeds 1000 */
@@ -915,7 +925,13 @@ static int wma_vdev_stop_resp_handler(void *handle, u_int8_t *cmd_param_info,
 			WMA_LOGD("%s Failed to find peer %pM\n",
 					__func__, params->bssid);
 		wma_remove_peer(wma, params->bssid, resp_event->vdev_id, peer);
-		wmi_unified_vdev_down_send(wma->wmi_handle, resp_event->vdev_id);
+
+		if (wmi_unified_vdev_down_send(wma->wmi_handle, resp_event->vdev_id) < 0) {
+			WMA_LOGE("Failed to send vdev down cmd: vdev %d",
+				resp_event->vdev_id);
+		} else {
+			wma->interfaces[resp_event->vdev_id].vdev_up = FALSE;
+		}
 		iface = &wma->interfaces[resp_event->vdev_id];
 		if (iface->sub_type == WMI_UNIFIED_VDEV_SUBTYPE_P2P_CLIENT) {
 			WMA_LOGD("%s: P2P BSS is stopped", __func__);
@@ -1758,7 +1774,7 @@ static int wma_oem_measurement_report_event_callback(void *handle,
 	WMA_LOGI("%s: Sending WDA_START_OEM_DATA_RSP, data len (%d)",
 	         __func__, datalen);
 
-	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)data, 0);
+	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)pStartOemDataRsp, 0);
 	return 0;
 }
 
@@ -1810,7 +1826,7 @@ static int wma_oem_error_report_event_callback(void *handle,
 	WMA_LOGI("%s: Sending WDA_START_OEM_DATA_RSP, data len (%d)",
 	         __func__, datalen);
 
-	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)data, 0);
+	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)pStartOemDataRsp, 0);
 	return 0;
 }
 #endif /* FEATURE_OEM_DATA_SUPPORT */
@@ -3205,10 +3221,10 @@ static ol_txrx_vdev_handle wma_vdev_attach(tp_wma_handle wma_handle,
 						self_sta_req->selfMacAddr,
 						self_sta_req->sessionId,
 						txrx_vdev_type);
-#ifdef QCA_SUPPORT_TXRX_VDEV_PAUSE_LL
+#ifdef QCA_SUPPORT_TXRX_VDEV_LL_TXQ
 	WMA_LOGD("LL TX Pause Mutex init");
 	adf_os_spinlock_init(&txrx_vdev_handle->ll_pause.mutex);
-#endif /* QCA_SUPPORT_TXRX_VDEV_PAUSE_LL */
+#endif /* QCA_SUPPORT_TXRX_VDEV_LL_TXQ */
 
 	WMA_LOGA("vdev_id %hu, txrx_vdev_handle = %p", self_sta_req->sessionId,
 			txrx_vdev_handle);
@@ -3767,7 +3783,7 @@ VOS_STATUS wma_start_scan(tp_wma_handle wma_handle,
         if (msg_type == WDA_CHNL_SWITCH_REQ) {
             wma_handle->roam_preauth_scan_id = cmd->scan_id;
         }
-	// WMA_LOGI("WMA --> WMI_START_SCAN_CMDID");
+	WMA_LOGI("WMA --> WMI_START_SCAN_CMDID");
 	return VOS_STATUS_SUCCESS;
 error:
 	wma_reset_scan_info(wma_handle, cmd->vdev_id);
@@ -4324,66 +4340,109 @@ v_VOID_t wma_roam_scan_fill_ap_profile(tp_wma_handle wma_handle, tpAniSirGlobal
  *            : It will be non-NULL if called after assoc.
  * Returns    :
  */
-v_VOID_t wma_roam_scan_fill_scan_params(tp_wma_handle wma_handle, tpAniSirGlobal pMac,
-        tSirRoamOffloadScanReq *roam_req, wmi_start_scan_cmd_fixed_param *scan_params)
-{
-        tANI_U16 max_scan_time, min_scan_time, burst_duration;
-        tANI_U16 nprobes = 1;
-        vos_mem_zero(scan_params, sizeof(wmi_start_scan_cmd_fixed_param));
-        if (roam_req != NULL) {
-                /* Parameters updated after association is complete */
-            WMA_LOGI("%s: Input parameters: NeighborScanChannelMinTime = %d, NeighborScanChannelMaxTime = %d\n",
-                        __func__, roam_req->NeighborScanChannelMinTime, roam_req->NeighborScanChannelMaxTime);
-            WMA_LOGI("%s: Input parameters: NeighborScanTimerPeriod = %d, HomeAwayTime = %d, nProbes = %d\n",
-                        __func__, roam_req->NeighborScanTimerPeriod, roam_req->HomeAwayTime, roam_req->nProbes);
-            /* NeighborScanChannelMinTime = SETROAMSCANCHANNELMINTIME and gNeighborScanChannelMinTime */
-                if (roam_req->HomeAwayTime > (2 * WMA_ROAM_SCAN_CHANNEL_SWITCH_TIME)) {
-                    burst_duration = roam_req->HomeAwayTime - 2 * WMA_ROAM_SCAN_CHANNEL_SWITCH_TIME;
-                    max_scan_time = min(roam_req->NeighborScanChannelMaxTime, burst_duration);
-                } else {
-                    burst_duration = max_scan_time = roam_req->NeighborScanChannelMaxTime;
-                }
-                /* ROME cld firmware have single value and not min, max
-                 * therefore setting both values to same thing.
-                 */
-                min_scan_time = max_scan_time;
-                nprobes = roam_req->nProbes;
-                scan_params->dwell_time_active = min_scan_time;
-
-                /* NeighborScanChannelMaxTime = SETSCANCHANNELTIME and gNeighborScanChannelMaxTime */
-                /* HomeAwayTime = SETSCANHOMEAWAYTIME and gRoamScanHomeAwayTime */
-                /* max_scan_time is for 1 channel, burst_duration is for total for all in a burst */
-                scan_params->dwell_time_passive = max_scan_time;
-
-                /* NeighborScanTimerPeriod = SETSCANHOMETIME and gNeighborScanTimerPeriod */
-                scan_params->min_rest_time = roam_req->NeighborScanTimerPeriod;
-                scan_params->max_rest_time = roam_req->NeighborScanTimerPeriod;
-                scan_params->repeat_probe_time = (nprobes > 0) ? scan_params->dwell_time_active / nprobes : 0;
-                scan_params->probe_spacing_time = 0;
-                scan_params->probe_delay = 0;
-                scan_params->max_scan_time = WMA_HW_DEF_SCAN_MAX_DURATION; /* 30 seconds for full scan cycle */
-                scan_params->idle_time = scan_params->min_rest_time;
-                scan_params->burst_duration = burst_duration;
+v_VOID_t wma_roam_scan_fill_scan_params(tp_wma_handle wma_handle,
+                                   tpAniSirGlobal pMac,
+                                   tSirRoamOffloadScanReq *roam_req,
+                                   wmi_start_scan_cmd_fixed_param *scan_params)
+{
+    tANI_U8 channels_per_burst = 0;
+    vos_mem_zero(scan_params, sizeof(wmi_start_scan_cmd_fixed_param));
+    if (roam_req != NULL) {
+        /* Parameters updated after association is complete */
+        WMA_LOGI("%s: Input parameters: NeighborScanChannelMinTime"
+                 " = %d, NeighborScanChannelMaxTime = %d",
+                 __func__,
+                 roam_req->NeighborScanChannelMinTime,
+                 roam_req->NeighborScanChannelMaxTime);
+        WMA_LOGI("%s: Input parameters: NeighborScanTimerPeriod ="
+                 " %d, HomeAwayTime = %d, nProbes = %d",
+                 __func__,
+                 roam_req->NeighborScanTimerPeriod,
+                 roam_req->HomeAwayTime,
+                 roam_req->nProbes);
+
+        /*
+         * roam_req->NeighborScanChannelMaxTime = SCAN_CHANNEL_TIME
+         * roam_req->HomeAwayTime               = SCAN_HOME_AWAY_TIME
+         * roam_req->NeighborScanTimerPeriod    = SCAN_HOME_TIME
+         *
+         * scan_params->dwell_time_active  = time station stays on channel
+         *                                   and sends probes;
+         * scan_params->dwell_time_passive = time station stays on channel
+         *                                   and listens probes;
+         * scan_params->burst_duration     = time station goes off channel
+         *                                   to scan;
+         */
+
+        /*
+         * Here is the formula,
+         * T(HomeAway) = N * T(dwell) + (N+1) * T(cs)
+         * where N is number of channels scanned in single burst
+         */
+        if (roam_req->HomeAwayTime < 2*WMA_ROAM_SCAN_CHANNEL_SWITCH_TIME) {
+            // clearly we can't follow home away time
+            scan_params->dwell_time_active  = roam_req->NeighborScanChannelMaxTime;
+            scan_params->burst_duration     = scan_params->dwell_time_active;
         } else {
-                /* roam_req = NULL during initial or pre-assoc invocation */
-                scan_params->dwell_time_active = WMA_ROAM_DWELL_TIME_ACTIVE_DEFAULT;
-                scan_params->dwell_time_passive = WMA_ROAM_DWELL_TIME_PASSIVE_DEFAULT;
-                scan_params->min_rest_time = WMA_ROAM_MIN_REST_TIME_DEFAULT;
-                scan_params->max_rest_time = WMA_ROAM_MAX_REST_TIME_DEFAULT;
-                scan_params->repeat_probe_time = 0;
-                scan_params->probe_spacing_time = 0;
-                scan_params->probe_delay = 0;
-                scan_params->max_scan_time = WMA_HW_DEF_SCAN_MAX_DURATION;
-                scan_params->idle_time = scan_params->min_rest_time;
-                scan_params->burst_duration = WMA_ROAM_DWELL_TIME_PASSIVE_DEFAULT;
+            channels_per_burst =
+              (roam_req->HomeAwayTime - WMA_ROAM_SCAN_CHANNEL_SWITCH_TIME)
+              / ( scan_params->dwell_time_active + WMA_ROAM_SCAN_CHANNEL_SWITCH_TIME);
+
+            if (channels_per_burst < 1) {
+                // dwell time and home away time conflicts
+                // we will override dwell time
+                scan_params->dwell_time_active =
+                  roam_req->HomeAwayTime - 2*WMA_ROAM_SCAN_CHANNEL_SWITCH_TIME;
+                scan_params->burst_duration = scan_params->dwell_time_active;
+            } else {
+                scan_params->dwell_time_active =
+                  roam_req->NeighborScanChannelMaxTime;
+                scan_params->burst_duration =
+                  channels_per_burst * scan_params->dwell_time_active;
+            }
         }
-        WMA_LOGI("%s: Rome roam scan parameters: dwell_time_active = %d, dwell_time_passive = %d\n",
-                  __func__, scan_params->dwell_time_active, scan_params->dwell_time_passive);
-        WMA_LOGI("%s: min_rest_time = %d, max_rest_time = %d, repeat_probe_time = %d\n",
-                  __func__, scan_params->min_rest_time, scan_params->max_rest_time, scan_params->repeat_probe_time);
-        WMA_LOGI("%s: max_scan_time = %d, idle_time = %d, burst_duration = %d\n",
-                  __func__, scan_params->max_scan_time, scan_params->idle_time, scan_params->burst_duration);
+
+        scan_params->dwell_time_passive = scan_params->dwell_time_active;
+        scan_params->min_rest_time = roam_req->NeighborScanTimerPeriod;
+        scan_params->max_rest_time = roam_req->NeighborScanTimerPeriod;
+        scan_params->repeat_probe_time = (roam_req->nProbes > 0) ?
+              VOS_MAX(scan_params->dwell_time_active / roam_req->nProbes, 1) : 0;
+        scan_params->probe_spacing_time = 0;
+        scan_params->probe_delay = 0;
+        scan_params->max_scan_time = WMA_HW_DEF_SCAN_MAX_DURATION; /* 30 seconds for full scan cycle */
+        scan_params->idle_time = scan_params->min_rest_time;
+    } else {
+        /* roam_req = NULL during initial or pre-assoc invocation */
+        scan_params->dwell_time_active = WMA_ROAM_DWELL_TIME_ACTIVE_DEFAULT;
+        scan_params->dwell_time_passive = WMA_ROAM_DWELL_TIME_PASSIVE_DEFAULT;
+        scan_params->min_rest_time = WMA_ROAM_MIN_REST_TIME_DEFAULT;
+        scan_params->max_rest_time = WMA_ROAM_MAX_REST_TIME_DEFAULT;
+        scan_params->repeat_probe_time = 0;
+        scan_params->probe_spacing_time = 0;
+        scan_params->probe_delay = 0;
+        scan_params->max_scan_time = WMA_HW_DEF_SCAN_MAX_DURATION;
+        scan_params->idle_time = scan_params->min_rest_time;
+        scan_params->burst_duration = WMA_ROAM_DWELL_TIME_PASSIVE_DEFAULT;
+    }
+    WMA_LOGI("%s: Rome roam scan parameters:"
+             " dwell_time_active = %d, dwell_time_passive = %d",
+             __func__,
+             scan_params->dwell_time_active,
+             scan_params->dwell_time_passive);
+    WMA_LOGI("%s: min_rest_time = %d, max_rest_time = %d,"
+             " repeat_probe_time = %d",
+             __func__,
+             scan_params->min_rest_time,
+             scan_params->max_rest_time,
+             scan_params->repeat_probe_time);
+    WMA_LOGI("%s: max_scan_time = %d, idle_time = %d,"
+             " burst_duration = %d",
+             __func__,
+             scan_params->max_scan_time,
+             scan_params->idle_time,
+             scan_params->burst_duration);
 }
+
 /* function   : wma_roam_scan_offload_ap_profile
  * Descriptin : Send WMI_ROAM_AP_PROFILE TLV to firmware
  * Args       : AP profile parameters are passed in as the structure used in TLV
@@ -4463,11 +4522,12 @@ VOS_STATUS wma_roam_scan_offload_init_connect(tp_wma_handle wma_handle)
      */
     /* rssi_thresh = 10 is low enough */
     vos_status = wma_roam_scan_offload_rssi_thresh(wma_handle, WMA_ROAM_LOW_RSSI_TRIGGER_VERYLOW,
-                                                WMA_ROAM_RSSI_THRESH_DIFF_DEFAULT);
+                                                   pMac->roam.configParam.neighborRoamConfig.nOpportunisticThresholdDiff);
     vos_status = wma_roam_scan_offload_scan_period(wma_handle,
                                                 WMA_ROAM_OPP_SCAN_PERIOD_DEFAULT, WMA_ROAM_OPP_SCAN_AGING_PERIOD_DEFAULT);
     vos_status = wma_roam_scan_offload_rssi_change(wma_handle,
-                                                WMA_ROAM_RSSI_CHANGE_RESCAN_DEFAULT, WMA_ROAM_BEACON_WEIGHT_DEFAULT);
+                                                   pMac->roam.configParam.neighborRoamConfig.nRoamRescanRssiDiff,
+                                                   WMA_ROAM_BEACON_WEIGHT_DEFAULT);
     wma_roam_scan_fill_ap_profile(wma_handle, pMac, NULL, &ap_profile);
 
     vos_status = wma_roam_scan_offload_ap_profile(wma_handle, &ap_profile);
@@ -4532,9 +4592,10 @@ VOS_STATUS wma_process_roam_scan_req(tp_wma_handle wma_handle,
             /* First parameter is positive rssi value to trigger rssi based scan.
              * Opportunistic scan is started at 30 dB higher that trigger rssi.
              */
+
             vos_status = wma_roam_scan_offload_rssi_thresh(wma_handle,
-                                                                     (roam_req->LookupThreshold - WMA_NOISE_FLOOR_DBM_DEFAULT),
-                                                                     WMA_ROAM_RSSI_THRESH_DIFF_DEFAULT);
+                                                           (roam_req->LookupThreshold - WMA_NOISE_FLOOR_DBM_DEFAULT),
+                                                           roam_req->OpportunisticScanThresholdDiff);
             if (vos_status != VOS_STATUS_SUCCESS) {
                 break;
             }
@@ -4552,7 +4613,7 @@ VOS_STATUS wma_process_roam_scan_req(tp_wma_handle wma_handle,
              * 2 times the current beacon's rssi.
              */
             vos_status = wma_roam_scan_offload_rssi_change(wma_handle,
-                                      WMA_ROAM_RSSI_CHANGE_RESCAN_DEFAULT,
+                                      roam_req->RoamRescanRssiDiff,
                                       WMA_ROAM_BEACON_WEIGHT_DEFAULT);
             if (vos_status != VOS_STATUS_SUCCESS) {
                 break;
@@ -4625,7 +4686,7 @@ VOS_STATUS wma_process_roam_scan_req(tp_wma_handle wma_handle,
 
             vos_status = wma_roam_scan_offload_rssi_thresh(wma_handle,
                                 (roam_req->LookupThreshold - WMA_NOISE_FLOOR_DBM_DEFAULT),
-                                WMA_ROAM_RSSI_THRESH_DIFF_DEFAULT);
+                                 roam_req->OpportunisticScanThresholdDiff);
             if (vos_status != VOS_STATUS_SUCCESS) {
                 break;
             }
@@ -4638,7 +4699,7 @@ VOS_STATUS wma_process_roam_scan_req(tp_wma_handle wma_handle,
             }
 
             vos_status = wma_roam_scan_offload_rssi_change(wma_handle,
-                                WMA_ROAM_RSSI_CHANGE_RESCAN_DEFAULT,
+                                roam_req->RoamRescanRssiDiff,
                                 WMA_ROAM_BEACON_WEIGHT_DEFAULT);
             if (vos_status != VOS_STATUS_SUCCESS) {
                 break;
@@ -5332,7 +5393,12 @@ void wma_vdev_resp_timer(void *data)
 		struct wma_txrx_node *iface = &wma->interfaces[tgt_req->vdev_id];
 		peer = ol_txrx_find_peer_by_addr(pdev, params->bssid, &peer_id);
 		wma_remove_peer(wma, params->bssid, tgt_req->vdev_id, peer);
-		wmi_unified_vdev_down_send(wma->wmi_handle, tgt_req->vdev_id);
+		if (wmi_unified_vdev_down_send(wma->wmi_handle, tgt_req->vdev_id) < 0) {
+			WMA_LOGE("Failed to send vdev down cmd: vdev %d",
+				tgt_req->vdev_id);
+		} else {
+			wma->interfaces[tgt_req->vdev_id].vdev_up = FALSE;
+		}
 		if (iface->sub_type == WMI_UNIFIED_VDEV_SUBTYPE_P2P_CLIENT) {
 			WMA_LOGD("%s: P2P BSS is stopped", __func__);
 			iface->bss_status = WMA_BSS_STATUS_STOPPED;
@@ -7862,10 +7928,10 @@ static u_int16_t wma_calc_ibss_heart_beat_timer(int16_t peer_num)
            entry value : the heart time threshold value in seconds for
                          detecting ibss peer departure */
         static const u_int16_t heart_beat_timer[HDD_MAX_NUM_IBSS_STA] = {
-                4,   8,   12,  16,  20,  24,  28,  32,
-                36,  40,  44,  48,  52,  56,  60,  64,
-                68,  72,  76,  80,  84,  88,  92,  96,
-                100, 104, 108, 112, 116, 120, 124, 128};
+                4, 4, 4, 4, 4, 4, 4, 4,
+                4, 4, 4, 4, 4, 4, 4, 4,
+                4, 4, 4, 4, 4, 4, 4, 4,
+                4, 4, 4, 4, 4, 4, 4, 4};
 
         if (peer_num < 1 || peer_num > HDD_MAX_NUM_IBSS_STA)
                 return 0;
@@ -8158,6 +8224,9 @@ static void wma_add_sta_req_sta_mode(tp_wma_handle wma, tpAddStaParams params)
 			 params->smesessionId, params->bssId);
 		status = VOS_STATUS_E_FAILURE;
 	}
+	else {
+		wma->interfaces[params->smesessionId].vdev_up = TRUE;
+	}
 
 	if (iface->sub_type == WMI_UNIFIED_VDEV_SUBTYPE_P2P_CLIENT) {
 		WMA_LOGD("%s: P2P BSS is started", __func__);
@@ -11990,12 +12059,14 @@ static void wma_start_oem_data_req(tp_wma_handle wma_handle,
 	wmi_buf_t buf;
 	u_int8_t *cmd;
 	int ret = 0;
+	u_int32_t *msg_subtype;
+	tStartOemDataRsp *pStartOemDataRsp;
 
 	WMA_LOGD("%s: Send OEM Data Request to target", __func__);
 
 	if (!startOemDataReq) {
 		WMA_LOGE("%s: startOemDataReq is null", __func__);
-		return;
+		goto out;
 	}
 
 	if (!wma_handle || !wma_handle->wmi_handle) {
@@ -12007,7 +12078,7 @@ static void wma_start_oem_data_req(tp_wma_handle wma_handle,
 		                   (OEM_DATA_REQ_SIZE + WMI_TLV_HDR_SIZE));
 	if (!buf) {
 		WMA_LOGE("%s:wmi_buf_alloc failed", __func__);
-		return;
+		goto out;
 	}
 
 	cmd = (u_int8_t *)wmi_buf_data(buf);
@@ -12028,9 +12099,31 @@ static void wma_start_oem_data_req(tp_wma_handle wma_handle,
 	if (ret != EOK) {
 		WMA_LOGE("%s:wmi cmd send failed", __func__);
 		adf_nbuf_free(buf);
-		return;
 	}
 
+out:
+	/* Now send data resp back to PE/SME with message sub-type of
+	 * WMI_OEM_INTERNAL_RSP. This is required so that PE/SME clears
+	 * up pending active command. Later when desired oem response(s)
+	 * comes as wmi event from target then those shall be passed
+	 * to oem application
+	 */
+	pStartOemDataRsp = vos_mem_malloc(sizeof(*pStartOemDataRsp));
+	if (!pStartOemDataRsp)
+	{
+	 WMA_LOGE("%s:failed to allocate memory for OEM Data Resp to PE",
+	          __func__);
+	 return;
+	}
+	vos_mem_zero(pStartOemDataRsp, sizeof(tStartOemDataRsp));
+	msg_subtype = (u_int32_t *)(&pStartOemDataRsp->oemDataRsp[0]);
+	*msg_subtype = WMI_OEM_INTERNAL_RSP;
+
+	WMA_LOGI("%s: Sending WDA_START_OEM_DATA_RSP to clear up PE/SME pending cmd",
+	         __func__);
+
+	wma_send_msg(wma_handle, WDA_START_OEM_DATA_RSP, (void *)pStartOemDataRsp, 0);
+
 	return;
 }
 #endif /* FEATURE_OEM_DATA_SUPPORT */
@@ -12683,6 +12776,13 @@ static VOS_STATUS wma_enable_arp_ns_offload(tp_wma_handle wma, tpSirHostOffloadR
 		return VOS_STATUS_E_INVAL;
 	}
 
+	if (!wma->interfaces[vdev_id].vdev_up) {
+
+		WMA_LOGE("vdev %d is not up skipping arp/ns offload", vdev_id);
+		vos_mem_free(pHostOffloadParams);
+		return VOS_STATUS_E_FAILURE;
+	}
+
 	len = sizeof(WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param) +
 		WMI_TLV_HDR_SIZE + // TLV place holder size for array of NS tuples
 		WMI_MAX_NS_OFFLOADS*sizeof(WMI_NS_OFFLOAD_TUPLE) +
@@ -12769,6 +12869,7 @@ static VOS_STATUS wma_enable_arp_ns_offload(tp_wma_handle wma, tpSirHostOffloadR
 		}
 		buf_ptr += sizeof(WMI_ARP_OFFLOAD_TUPLE);
 	}
+
 	res = wmi_unified_cmd_send(wma->wmi_handle, buf, len, WMI_SET_ARP_NS_OFFLOAD_CMDID);
 	if(res) {
 		WMA_LOGE("Failed to enable ARP NDP/NSffload");
@@ -13536,12 +13637,16 @@ VOS_STATUS wma_process_init_thermal_info(tp_wma_handle wma,
 	t_thermal_cmd_params thermal_params;
 	ol_txrx_pdev_handle curr_pdev;
 
-        if (NULL == wma || NULL == pThermalParams) {
-                WMA_LOGE("%s: TM Invalid input", __func__);
-                return VOS_STATUS_E_FAILURE;
-        }
+	if (NULL == wma || NULL == pThermalParams) {
+		WMA_LOGE("TM Invalid input");
+		return VOS_STATUS_E_FAILURE;
+	}
 
 	curr_pdev = vos_get_context(VOS_MODULE_ID_TXRX, wma->vos_context);
+	if (NULL == curr_pdev) {
+		WMA_LOGE("TM Invalid pdev");
+		return VOS_STATUS_E_FAILURE;
+	}
 
 	WMA_LOGD("TM enable %d period %d", pThermalParams->thermalMgmtEnabled,
 			 pThermalParams->throttlePeriod);
@@ -13618,8 +13723,19 @@ VOS_STATUS wma_process_set_thermal_level(tp_wma_handle wma,
 {
 	t_thermal_cmd_params thermal_params;
 	u_int8_t thermal_level = (*pThermalLevel);
-	ol_txrx_pdev_handle curr_pdev =
-		vos_get_context(VOS_MODULE_ID_TXRX, wma->vos_context);
+	ol_txrx_pdev_handle curr_pdev;
+
+	if (NULL == wma || NULL == pThermalLevel) {
+		WMA_LOGE("TM Invalid input");
+		return VOS_STATUS_E_FAILURE;
+	}
+
+    curr_pdev = vos_get_context(VOS_MODULE_ID_TXRX, wma->vos_context);
+
+	if (NULL == curr_pdev) {
+		WMA_LOGE("TM Invalid pdev");
+		return VOS_STATUS_E_FAILURE;
+	}
 
 	WMA_LOGD("TM set level %d", thermal_level);
 
@@ -14523,17 +14639,23 @@ static int wma_thermal_mgmt_evt_handler(void *handle, u_int8_t *event,
 	t_thermal_cmd_params thermal_params;
 	WMI_THERMAL_MGMT_EVENTID_param_tlvs *param_buf =
 		(WMI_THERMAL_MGMT_EVENTID_param_tlvs *) event;
-	ol_txrx_pdev_handle curr_pdev =
-		vos_get_context(VOS_MODULE_ID_TXRX, wma->vos_context);
+	ol_txrx_pdev_handle curr_pdev;
 
-	/* Check if thermal mitigation is enabled */
-	if (!wma->thermal_mgmt_info.thermalMgmtEnabled){
-		WMA_LOGE("Thermal mgmt is not enabled, ignoring event");
+	if (NULL == event || NULL == handle) {
+		WMA_LOGE("Invalid thermal mitigation event buffer");
 		return -EINVAL;
 	}
 
-	if (!param_buf) {
-		WMA_LOGE("Invalid thermal mitigation event buffer");
+	curr_pdev = vos_get_context(VOS_MODULE_ID_TXRX, wma->vos_context);
+
+	if (NULL == curr_pdev) {
+		WMA_LOGE("Invalid pdev");
+		return -EINVAL;
+	}
+
+	/* Check if thermal mitigation is enabled */
+	if (!wma->thermal_mgmt_info.thermalMgmtEnabled){
+		WMA_LOGE("Thermal mgmt is not enabled, ignoring event");
 		return -EINVAL;
 	}
 
@@ -14592,7 +14714,7 @@ wma_batch_scan_result_event_handler
     tSirBatchScanNetworkInfo *pHddApMetaInfo;
     tp_wma_handle wma = (tp_wma_handle) handle;
     u_int32_t nextScanListOffset, nextApMetaInfoOffset;
-    u_int8_t bssid[IEEE80211_ADDR_LEN], ssid[32], *ssid_temp;
+    u_int8_t bssid[IEEE80211_ADDR_LEN], ssid[33], *ssid_temp;
     u_int32_t temp, count1, count2, scan_num, netinfo_num, total_size;
     WMI_BATCH_SCAN_RESULT_EVENTID_param_tlvs *param_tlvs;
     wmi_batch_scan_result_event_fixed_param *fix_param;
@@ -14686,7 +14808,7 @@ wma_batch_scan_result_event_handler
 
             WMI_MAC_ADDR_TO_CHAR_ARRAY(&network_info->bssid, &bssid[0]);
             vos_mem_copy(pHddApMetaInfo->bssid, bssid, IEEE80211_ADDR_LEN);
-            if (network_info->ssid.ssid_len < 32)
+            if (network_info->ssid.ssid_len <= 32)
             {
                ssid_temp = (u_int8_t *)network_info->ssid.ssid;
                for(temp = 0; temp < network_info->ssid.ssid_len; temp++)
@@ -14695,7 +14817,8 @@ wma_batch_scan_result_event_handler
                   ssid_temp++;
                }
                ssid[temp] = '\0';
-               vos_mem_copy(pHddApMetaInfo->ssid, ssid, 32);
+               vos_mem_copy(pHddApMetaInfo->ssid, ssid,
+                                (network_info->ssid.ssid_len + 1));
                WMA_LOGD("ssid %s",pHddApMetaInfo->ssid);
             }
             else
diff --git a/CORE/SERVICES/WMA/wma.h b/CORE/SERVICES/WMA/wma.h
index a493d0eab50e..3c8a3e1b801c 100644
--- a/CORE/SERVICES/WMA/wma.h
+++ b/CORE/SERVICES/WMA/wma.h
@@ -142,7 +142,7 @@
  * All rssi values are in dB except for WMA_NOISE_FLOOR_DBM_DEFAULT.
  */
 
-#define WMA_ROAM_SCAN_CHANNEL_SWITCH_TIME    (3)
+#define WMA_ROAM_SCAN_CHANNEL_SWITCH_TIME    (2)
 #define WMA_NOISE_FLOOR_DBM_DEFAULT          (-96)
 #define WMA_ROAM_RSSI_DIFF_DEFAULT           (5)
 #define WMA_ROAM_DWELL_TIME_ACTIVE_DEFAULT   (100)
@@ -151,8 +151,6 @@
 #define WMA_ROAM_MAX_REST_TIME_DEFAULT       (500)
 #define WMA_ROAM_LOW_RSSI_TRIGGER_DEFAULT    (20)
 #define WMA_ROAM_LOW_RSSI_TRIGGER_VERYLOW    (10)
-#define WMA_ROAM_RSSI_THRESH_DIFF_DEFAULT    (30)
-#define WMA_ROAM_RSSI_CHANGE_RESCAN_DEFAULT  (5)
 #define WMA_ROAM_BEACON_WEIGHT_DEFAULT       (14)
 #define WMA_ROAM_OPP_SCAN_PERIOD_DEFAULT     (120000)
 #define WMA_ROAM_OPP_SCAN_AGING_PERIOD_DEFAULT (WMA_ROAM_OPP_SCAN_PERIOD_DEFAULT * 5)
diff --git a/CORE/SME/inc/csrApi.h b/CORE/SME/inc/csrApi.h
index 411391e22849..39da69fcbcab 100644
--- a/CORE/SME/inc/csrApi.h
+++ b/CORE/SME/inc/csrApi.h
@@ -968,6 +968,8 @@ typedef struct tagCsrNeighborRoamConfigParams
     tANI_U8        nMaxNeighborRetries;
     tANI_U16       nNeighborResultsRefreshPeriod;
     tANI_U16       nEmptyScanRefreshPeriod;
+    tANI_U8        nOpportunisticThresholdDiff;
+    tANI_U8        nRoamRescanRssiDiff;
 }tCsrNeighborRoamConfigParams;
 #endif
 
diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index 879c119c22de..77b44c364692 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -510,6 +510,8 @@ typedef struct tagCsrNeighborRoamConfig
     tANI_U8        nMaxNeighborRetries;
     tANI_U16       nNeighborResultsRefreshPeriod;
     tANI_U16       nEmptyScanRefreshPeriod;
+    tANI_U8        nOpportunisticThresholdDiff;
+    tANI_U8        nRoamRescanRssiDiff;
 }tCsrNeighborRoamConfig;
 #endif
 
diff --git a/CORE/SME/inc/csrNeighborRoam.h b/CORE/SME/inc/csrNeighborRoam.h
index 1c78207c0667..f0d4f143e140 100644
--- a/CORE/SME/inc/csrNeighborRoam.h
+++ b/CORE/SME/inc/csrNeighborRoam.h
@@ -69,6 +69,8 @@ typedef struct sCsrNeighborRoamCfgParams
     tANI_U32        maxChannelScanTime;
     tANI_U16        neighborResultsRefreshPeriod;
     tANI_U16        emptyScanRefreshPeriod;
+    tANI_U8         nOpportunisticThresholdDiff;
+    tANI_U8         nRoamRescanRssiDiff;
 } tCsrNeighborRoamCfgParams, *tpCsrNeighborRoamCfgParams;
 
 #define CSR_NEIGHBOR_ROAM_INVALID_CHANNEL_INDEX    255
@@ -169,6 +171,8 @@ typedef struct sCsrNeighborRoamControlInfo
     tCsrTimerInfo               neighborScanTimerInfo;
     tCsrNeighborRoamChannelInfo roamChannelInfo;
     tANI_U8                     currentNeighborLookupThreshold;
+    tANI_U8                     currentOpportunisticThresholdDiff;
+    tANI_U8                     currentRoamRescanRssiDiff;
     tANI_BOOLEAN                scanRspPending;
     tANI_TIMESTAMP              scanRequestTimeStamp;
     tDblLinkList                roamableAPList;    // List of current FT candidates
@@ -226,6 +230,12 @@ tANI_BOOLEAN csrNeighborRoamStatePreauthDone(tpAniSirGlobal pMac);
 tANI_BOOLEAN csrNeighborRoamScanRspPending(tHalHandle hHal);
 tANI_BOOLEAN csrNeighborMiddleOfRoaming(tHalHandle hHal);
 VOS_STATUS csrNeighborRoamSetLookupRssiThreshold(tpAniSirGlobal pMac, v_U8_t neighborLookupRssiThreshold);
+VOS_STATUS
+csrNeighborRoamSetOpportunisticScanThresholdDiff(tpAniSirGlobal pMac,
+                                        v_U8_t nOpportunisticThresholdDiff);
+VOS_STATUS
+csrNeighborRoamSetRoamRescanRssiDiff(tpAniSirGlobal pMac,
+                                     v_U8_t nRoamRescanRssiDiff);
 VOS_STATUS csrNeighborRoamUpdateFastRoamingEnabled(tpAniSirGlobal pMac, const v_BOOL_t fastRoamEnabled);
 VOS_STATUS csrNeighborRoamUpdateCcxModeEnabled(tpAniSirGlobal pMac, const v_BOOL_t ccxMode);
 VOS_STATUS csrNeighborRoamChannelsFilterByCurrentBand(
@@ -268,6 +278,8 @@ VOS_STATUS csrNeighborRoamMergeChannelLists(tpAniSirGlobal pMac,
 #define REASON_OS_REQUESTED_ROAMING_NOW             15
 #define REASON_SCAN_CH_TIME_CHANGED                 16
 #define REASON_SCAN_HOME_TIME_CHANGED               17
+#define REASON_OPPORTUNISTIC_THRESH_DIFF_CHANGED    18
+#define REASON_ROAM_RESCAN_RSSI_DIFF_CHANGED        19
 eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 command, tANI_U8 reason);
 eHalStatus csrNeighborRoamCandidateFoundIndHdlr(tpAniSirGlobal pMac, void* pMsg);
 eHalStatus csrNeighborRoamHandoffReqHdlr(tpAniSirGlobal pMac, void* pMsg);
diff --git a/CORE/SME/inc/oemDataApi.h b/CORE/SME/inc/oemDataApi.h
index a2446dcdb439..a89191a9582b 100644
--- a/CORE/SME/inc/oemDataApi.h
+++ b/CORE/SME/inc/oemDataApi.h
@@ -58,6 +58,11 @@
 #endif
 #endif
 
+#ifdef QCA_WIFI_2_0
+/* message subtype for internal purpose */
+#define OEM_MESSAGE_SUBTYPE_INTERNAL   0xdeadbeef
+#endif
+
 /*************************************************************************************************************
   OEM DATA REQ/RSP - DATA STRUCTURES
 *************************************************************************************************************/
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index c51d79e77084..e605b55a3d1e 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -2719,6 +2719,57 @@ eHalStatus sme_UpdateConfigFwRssiMonitoring(tHalHandle hHal,
         v_BOOL_t fEnableFwRssiMonitoring);
 
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
+/* ---------------------------------------------------------------------------
+    \fn     sme_SetRoamRescanRssiDiff
+    \brief  Update Roam Rescan RSSI diff
+            This function is called through dynamic setConfig callback function
+            to configure nRoamRescanRssiDiff
+    \param  hHal - HAL handle for device
+    \param  nRoamRescanRssiDiff - Roam Rescan Rssi Diff
+    \return eHAL_STATUS_SUCCESS - SME update nRoamRescanRssiDiff config
+            successfully.
+            else SME is failed to update nRoamRescanRssiDiff
+    -------------------------------------------------------------------------*/
+
+eHalStatus sme_SetRoamRescanRssiDiff(tHalHandle hHal,
+                                     const v_U8_t nRoamRescanRssiDiff);
+
+/*--------------------------------------------------------------------------
+  \fn    sme_GetRoamRescanRssiDiff
+  \brief gets Roam Rescan RSSI diff
+         This is a synchronous call
+  \param hHal - The handle returned by macOpen
+  \return v_U8_t - nRoamRescanRssiDiff
+  \sa
+  --------------------------------------------------------------------------*/
+v_U8_t sme_GetRoamRescanRssiDiff(tHalHandle hHal);
+
+
+/* ---------------------------------------------------------------------------
+    \fn     sme_SetRoamOpportunisticScanThresholdDiff
+    \brief  Update Opportunistic Scan threshold diff
+            This function is called through dynamic setConfig callback function
+            to configure  nOpportunisticThresholdDiff
+    \param  hHal - HAL handle for device
+    \param  nOpportunisticThresholdDiff - Opportunistic Scan threshold diff
+    \return eHAL_STATUS_SUCCESS - SME update nOpportunisticThresholdDiff config
+            successfully.
+            else SME is failed to update nOpportunisticThresholdDiff.
+    -------------------------------------------------------------------------*/
+
+eHalStatus sme_SetRoamOpportunisticScanThresholdDiff(tHalHandle hHal,
+                            const v_U8_t nOpportunisticThresholdDiff);
+
+/*--------------------------------------------------------------------------
+  \fn    sme_GetRoamOpportunisticScanThresholdDiff()
+  \brief gets Opportunistic Scan threshold diff
+         This is a synchronous call
+  \param hHal - The handle returned by macOpen
+  \return v_U8_t - nOpportunisticThresholdDiff
+  \sa
+  --------------------------------------------------------------------------*/
+v_U8_t sme_GetRoamOpportunisticScanThresholdDiff(tHalHandle hHal);
+
 /*--------------------------------------------------------------------------
   \brief sme_setNeighborLookupRssiThreshold() - update neighbor lookup rssi threshold
   This is a synchronuous call
@@ -3289,8 +3340,6 @@ ePhyChanBondState sme_GetCBPhyStateFromCBIniValue(tANI_U32 cb_ini_value);
 int sme_UpdateHTConfig(tHalHandle hHal, tANI_U8 sessionId, tANI_U16 htCapab,
                          int value);
 tANI_S16 sme_GetHTConfig(tHalHandle hHal, tANI_U8 session_id, tANI_U16 ht_capab);
-eHalStatus sme_getValidChannelList(tHalHandle hHal, tANI_U8 *numChannels,
-                                   tANI_U8 **chanList);
 #ifdef FEATURE_WLAN_SCAN_PNO
 eHalStatus sme_MoveCsrToScanStateForPno (tHalHandle hHal, tANI_U8 sessionId);
 #endif
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index 64fcbc431b83..f794967949a3 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -1079,6 +1079,8 @@ static void initConfigParam(tpAniSirGlobal pMac)
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
     pMac->roam.configParam.neighborRoamConfig.nMaxNeighborRetries = 3;
     pMac->roam.configParam.neighborRoamConfig.nNeighborLookupRssiThreshold = 120;
+    pMac->roam.configParam.neighborRoamConfig.nOpportunisticThresholdDiff = 30;
+    pMac->roam.configParam.neighborRoamConfig.nRoamRescanRssiDiff = 5;
     pMac->roam.configParam.neighborRoamConfig.nNeighborReassocRssiThreshold = 125;
     pMac->roam.configParam.neighborRoamConfig.nNeighborScanMinChanTime = 20;
     pMac->roam.configParam.neighborRoamConfig.nNeighborScanMaxChanTime = 40;
@@ -1754,6 +1756,8 @@ eHalStatus csrChangeDefaultConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pPa
         smsLog( pMac, LOG1, "nNeighborScanTimerPerioid = %d", pMac->roam.configParam.neighborRoamConfig.nNeighborScanTimerPeriod);
         smsLog( pMac, LOG1, "nNeighborReassocRssiThreshold = %d", pMac->roam.configParam.neighborRoamConfig.nNeighborReassocRssiThreshold);
         smsLog( pMac, LOG1, "nNeighborLookupRssiThreshold = %d", pMac->roam.configParam.neighborRoamConfig.nNeighborLookupRssiThreshold);
+        smsLog( pMac, LOG1, "nOpportunisticThresholdDiff = %d", pMac->roam.configParam.neighborRoamConfig.nOpportunisticThresholdDiff);
+        smsLog( pMac, LOG1, "nRoamRescanRssiDiff = %d", pMac->roam.configParam.neighborRoamConfig.nRoamRescanRssiDiff);
         smsLog( pMac, LOG1, "nNeighborScanMinChanTime = %d", pMac->roam.configParam.neighborRoamConfig.nNeighborScanMinChanTime);
         smsLog( pMac, LOG1, "nNeighborScanMaxChanTime = %d", pMac->roam.configParam.neighborRoamConfig.nNeighborScanMaxChanTime);
         smsLog( pMac, LOG1, "nMaxNeighborRetries = %d", pMac->roam.configParam.neighborRoamConfig.nMaxNeighborRetries);
@@ -1891,6 +1895,7 @@ eHalStatus csrGetConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
         pParam->txBFCsnValue = pMac->roam.configParam.txBFCsnValue;
         pParam->enableMuBformee = pMac->roam.configParam.txMuBformee;
         pParam->enableVhtFor24GHz = pMac->roam.configParam.enableVhtFor24GHz;
+        pParam->enable2x2 = pMac->roam.configParam.enable2x2;
 #endif
 #ifdef WLAN_FEATURE_VOWIFI_11R
         vos_mem_copy(&pMac->roam.configParam.csr11rConfig,
@@ -15837,6 +15842,10 @@ eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 command, tANI_U8 reas
             pMac->roam.roamSession[sessionId].connectedProfile.mcEncryptionType;
     pRequestBuf->LookupThreshold =
             (v_S7_t)pNeighborRoamInfo->cfgParams.neighborLookupThreshold * (-1);
+    pRequestBuf->OpportunisticScanThresholdDiff =
+            pNeighborRoamInfo->cfgParams.nOpportunisticThresholdDiff;
+    pRequestBuf->RoamRescanRssiDiff =
+            pNeighborRoamInfo->cfgParams.nRoamRescanRssiDiff;
     pRequestBuf->RoamRssiDiff =
             pMac->roam.configParam.RoamRssiDiff;
     pRequestBuf->Command = command;
diff --git a/CORE/SME/src/csr/csrNeighborRoam.c b/CORE/SME/src/csr/csrNeighborRoam.c
index bbcc8d7730fc..22bdf60b3917 100644
--- a/CORE/SME/src/csr/csrNeighborRoam.c
+++ b/CORE/SME/src/csr/csrNeighborRoam.c
@@ -514,6 +514,112 @@ VOS_STATUS csrNeighborRoamSetLookupRssiThreshold(tpAniSirGlobal pMac, v_U8_t nei
     return vosStatus;
 }
 
+VOS_STATUS
+csrNeighborRoamSetOpportunisticScanThresholdDiff(tpAniSirGlobal pMac,
+                                   v_U8_t nOpportunisticThresholdDiff)
+{
+    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
+
+    if (eCSR_NEIGHBOR_ROAM_STATE_CONNECTED
+         == pMac->roam.neighborRoamInfo.neighborRoamState)
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac,
+                            LOG2,
+                            FL("Currently in CONNECTED state, so deregister"
+                               " all and re-register for DOWN event again"));
+
+        pMac->roam.neighborRoamInfo.cfgParams.nOpportunisticThresholdDiff =
+           nOpportunisticThresholdDiff;
+        pMac->roam.neighborRoamInfo.currentOpportunisticThresholdDiff =
+           nOpportunisticThresholdDiff;
+
+        /* De-register existing lookup UP/DOWN, Rssi indications */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+        if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+        {
+            csrRoamOffloadScan(pMac,
+                               ROAM_SCAN_OFFLOAD_UPDATE_CFG,
+                               REASON_OPPORTUNISTIC_THRESH_DIFF_CHANGED);
+        }
+#endif
+    }
+    else if (eCSR_NEIGHBOR_ROAM_STATE_INIT
+      == pMac->roam.neighborRoamInfo.neighborRoamState)
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac,
+                            LOG2,
+                            FL("Currently in INIT state, safe to set"
+                               " opportunistic threshold diff"));
+        pMac->roam.neighborRoamInfo.cfgParams.nOpportunisticThresholdDiff =
+            nOpportunisticThresholdDiff;
+        pMac->roam.neighborRoamInfo.currentOpportunisticThresholdDiff =
+            nOpportunisticThresholdDiff;
+    }
+    else
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac,
+                            LOGE,
+                            FL("Unexpected state %d"
+                              " returning failure"),
+                            pMac->roam.neighborRoamInfo.neighborRoamState);
+        vosStatus = VOS_STATUS_E_FAILURE;
+    }
+    return vosStatus;
+}
+
+VOS_STATUS
+csrNeighborRoamSetRoamRescanRssiDiff(tpAniSirGlobal pMac,
+                                     v_U8_t nRoamRescanRssiDiff)
+{
+    VOS_STATUS vosStatus = VOS_STATUS_SUCCESS;
+
+    if (eCSR_NEIGHBOR_ROAM_STATE_CONNECTED
+         == pMac->roam.neighborRoamInfo.neighborRoamState)
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac,
+                            LOG2,
+                            FL("Currently in CONNECTED state, so deregister"
+                               " all and re-register for DOWN event again"));
+
+        pMac->roam.neighborRoamInfo.cfgParams.nRoamRescanRssiDiff =
+            nRoamRescanRssiDiff;
+        pMac->roam.neighborRoamInfo.currentRoamRescanRssiDiff =
+            nRoamRescanRssiDiff;
+
+        /* De-register existing lookup UP/DOWN, Rssi indications */
+#ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
+        if (pMac->roam.configParam.isRoamOffloadScanEnabled)
+        {
+            csrRoamOffloadScan(pMac,
+                               ROAM_SCAN_OFFLOAD_UPDATE_CFG,
+                               REASON_ROAM_RESCAN_RSSI_DIFF_CHANGED);
+        }
+#endif
+    }
+    else if (eCSR_NEIGHBOR_ROAM_STATE_INIT
+      == pMac->roam.neighborRoamInfo.neighborRoamState)
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac,
+                            LOG2,
+                            FL("Currently in INIT state, safe to set"
+                               " roam rescan rssi diff"));
+        pMac->roam.neighborRoamInfo.cfgParams.nRoamRescanRssiDiff =
+            nRoamRescanRssiDiff;
+        pMac->roam.neighborRoamInfo.currentRoamRescanRssiDiff =
+            nRoamRescanRssiDiff;
+    }
+    else
+    {
+        NEIGHBOR_ROAM_DEBUG(pMac,
+                            LOGE,
+                            FL("Unexpected state %d"
+                              " returning failure"),
+                            pMac->roam.neighborRoamInfo.neighborRoamState);
+        vosStatus = VOS_STATUS_E_FAILURE;
+    }
+    return vosStatus;
+}
+
 /* ---------------------------------------------------------------------------
 
     \fn csrNeighborRoamReassocIndCallback
@@ -712,6 +818,10 @@ static void csrNeighborRoamDeregAllRssiIndication(tpAniSirGlobal pMac)
         /* Reset thresholds only after deregistering DOWN event from TL */
         pNeighborRoamInfo->currentNeighborLookupThreshold = 
                 pNeighborRoamInfo->cfgParams.neighborLookupThreshold;
+        pNeighborRoamInfo->currentOpportunisticThresholdDiff =
+                pNeighborRoamInfo->cfgParams.nOpportunisticThresholdDiff;
+        pNeighborRoamInfo->currentRoamRescanRssiDiff =
+                pNeighborRoamInfo->cfgParams.nRoamRescanRssiDiff;
 #ifdef FEATURE_WLAN_LFR
         pNeighborRoamInfo->uEmptyScanCount = 0;
         pNeighborRoamInfo->lookupDOWNRssi = 0;
@@ -4171,6 +4281,10 @@ eHalStatus csrNeighborRoamIndicateConnect(tpAniSirGlobal pMac, tANI_U8 sessionId
             pNeighborRoamInfo->neighborScanTimerInfo.sessionId = sessionId;
             pNeighborRoamInfo->currentNeighborLookupThreshold =
                 pNeighborRoamInfo->cfgParams.neighborLookupThreshold;
+            pNeighborRoamInfo->currentOpportunisticThresholdDiff =
+                pNeighborRoamInfo->cfgParams.nOpportunisticThresholdDiff;
+            pNeighborRoamInfo->currentRoamRescanRssiDiff =
+                pNeighborRoamInfo->cfgParams.nRoamRescanRssiDiff;
 #ifdef FEATURE_WLAN_LFR
             pNeighborRoamInfo->uEmptyScanCount = 0;
             pNeighborRoamInfo->lookupDOWNRssi = 0;
@@ -4356,6 +4470,10 @@ eHalStatus csrNeighborRoamInit(tpAniSirGlobal pMac)
     pNeighborRoamInfo->cfgParams.minChannelScanTime = pMac->roam.configParam.neighborRoamConfig.nNeighborScanMinChanTime;
     pNeighborRoamInfo->cfgParams.maxNeighborRetries = 0;
     pNeighborRoamInfo->cfgParams.neighborLookupThreshold = pMac->roam.configParam.neighborRoamConfig.nNeighborLookupRssiThreshold;
+    pNeighborRoamInfo->cfgParams.nOpportunisticThresholdDiff =
+        pMac->roam.configParam.neighborRoamConfig.nOpportunisticThresholdDiff;
+    pNeighborRoamInfo->cfgParams.nRoamRescanRssiDiff =
+        pMac->roam.configParam.neighborRoamConfig.nRoamRescanRssiDiff;
     pNeighborRoamInfo->cfgParams.neighborReassocThreshold = pMac->roam.configParam.neighborRoamConfig.nNeighborReassocRssiThreshold;
     pNeighborRoamInfo->cfgParams.neighborScanPeriod = pMac->roam.configParam.neighborRoamConfig.nNeighborScanTimerPeriod;
     pNeighborRoamInfo->cfgParams.neighborResultsRefreshPeriod = pMac->roam.configParam.neighborRoamConfig.nNeighborResultsRefreshPeriod;
@@ -4380,6 +4498,10 @@ eHalStatus csrNeighborRoamInit(tpAniSirGlobal pMac)
 
     vos_mem_set(pNeighborRoamInfo->currAPbssid, sizeof(tCsrBssid), 0);
     pNeighborRoamInfo->currentNeighborLookupThreshold = pMac->roam.neighborRoamInfo.cfgParams.neighborLookupThreshold;
+    pNeighborRoamInfo->currentOpportunisticThresholdDiff =
+        pMac->roam.neighborRoamInfo.cfgParams.nOpportunisticThresholdDiff;
+    pNeighborRoamInfo->currentRoamRescanRssiDiff =
+        pMac->roam.neighborRoamInfo.cfgParams.nRoamRescanRssiDiff;
 #ifdef FEATURE_WLAN_LFR
     pNeighborRoamInfo->lookupDOWNRssi = 0;
     pNeighborRoamInfo->uEmptyScanCount = 0;
diff --git a/CORE/SME/src/oemData/oemDataApi.c b/CORE/SME/src/oemData/oemDataApi.c
index 8d332af60470..1b9c0b0f5c9e 100644
--- a/CORE/SME/src/oemData/oemDataApi.c
+++ b/CORE/SME/src/oemData/oemDataApi.c
@@ -110,8 +110,10 @@ eHalStatus oemData_OemDataReqClose(tHalHandle hHal)
   -------------------------------------------------------------------------------*/
 void oemData_ReleaseOemDataReqCommand(tpAniSirGlobal pMac, tSmeCmd *pOemDataCmd, eOemDataReqStatus oemDataReqStatus)
 {
+#ifndef QCA_WIFI_2_0
     //Do the callback
     pOemDataCmd->u.oemDataCmd.callback(pMac, pOemDataCmd->u.oemDataCmd.pContext, pOemDataCmd->u.oemDataCmd.oemDataReqID, oemDataReqStatus);
+#endif
 
     //First take this command out of the active list
     if(csrLLRemoveEntry(&pMac->sme.smeCmdActiveList, &pOemDataCmd->Link, LL_ACCESS_LOCK))
@@ -291,6 +293,10 @@ eHalStatus sme_HandleOemDataRsp(tHalHandle hHal, tANI_U8* pMsg)
     tListElem                          *pEntry = NULL;
     tSmeCmd                            *pCommand = NULL;
     tSirOemDataRsp*                    pOemDataRsp = NULL;
+#ifdef QCA_WIFI_2_0
+    tANI_U32                           *msgSubType;
+#endif
+
     pMac = PMAC_STRUCT(hHal);
 
     smsLog(pMac, LOG1, "%s: OEM_DATA Entering", __func__);
@@ -383,8 +389,20 @@ eHalStatus sme_HandleOemDataRsp(tHalHandle hHal, tANI_U8* pMsg)
 
         pOemDataRsp = (tSirOemDataRsp *)pMsg;
 
-        smsLog(pMac, LOG1, "calling send_oem_data_rsp_msg");
-        send_oem_data_rsp_msg(sizeof(tOemDataRsp), &pOemDataRsp->oemDataRsp[0]);
+        /* check if message is to be forwarded to oem application or not */
+        msgSubType = (tANI_U32 *) (&pOemDataRsp->oemDataRsp[0]);
+        if (*msgSubType != OEM_MESSAGE_SUBTYPE_INTERNAL)
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                      "%s: calling send_oem_data_rsp_msg, msgSubType(0x%x)",
+                      __func__, *msgSubType);
+            send_oem_data_rsp_msg(sizeof(tOemDataRsp),
+                                  &pOemDataRsp->oemDataRsp[0]);
+        }
+        else
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+                      "%s: received internal oem data resp, msgSubType (0x%x)",
+                      __func__, *msgSubType);
 #endif /* QCA_WIFI_2_0 */
     } while(0);
 
diff --git a/CORE/SME/src/rrm/sme_rrm.c b/CORE/SME/src/rrm/sme_rrm.c
index c3af20dbbbcb..9d8c2024de68 100644
--- a/CORE/SME/src/rrm/sme_rrm.c
+++ b/CORE/SME/src/rrm/sme_rrm.c
@@ -425,7 +425,7 @@ static eHalStatus sme_CcxSendBeaconReqScanResults(tpAniSirGlobal pMac,
        pBcnReport->flag = (measurementDone << 1)|((pCurResult)?true:false);
 
        smsLog(pMac, LOG1, "SME Sending BcnRep to HDD numBss(%d)"
-               " msgCounter(%d) bssCounter(%d)",
+               " msgCounter(%d) bssCounter(%d) flag(%d)",
                 pBcnReport->numBss, msgCounter, bssCounter, pBcnReport->flag);
 
        roamInfo.pCcxBcnReportRsp = pBcnReport;
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index d93f7a228829..93c40bc7fe60 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -9182,6 +9182,111 @@ eHalStatus sme_UpdateConfigFwRssiMonitoring(tHalHandle hHal,
 }
 
 #ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
+/* ---------------------------------------------------------------------------
+    \fn     sme_SetRoamOpportunisticScanThresholdDiff
+    \brief  Update Opportunistic Scan threshold diff
+            This function is called through dynamic setConfig callback function
+            to configure  nOpportunisticThresholdDiff
+    \param  hHal - HAL handle for device
+    \param  nOpportunisticThresholdDiff - Opportunistic Scan threshold diff
+    \return eHAL_STATUS_SUCCESS - SME update nOpportunisticThresholdDiff config
+            successfully.
+            else SME is failed to update nOpportunisticThresholdDiff.
+    -------------------------------------------------------------------------*/
+eHalStatus sme_SetRoamOpportunisticScanThresholdDiff(tHalHandle hHal,
+                            const v_U8_t nOpportunisticThresholdDiff)
+{
+    tpAniSirGlobal pMac    = PMAC_STRUCT( hHal );
+    eHalStatus     status  = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        status = csrNeighborRoamSetOpportunisticScanThresholdDiff(pMac,
+                                         nOpportunisticThresholdDiff);
+        if (HAL_STATUS_SUCCESS(status))
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                "LFR runtime successfully set "
+                "opportunistic threshold diff to %d"
+                " - old value is %d - roam state is %d",
+                nOpportunisticThresholdDiff,
+                pMac->roam.configParam.neighborRoamConfig.nOpportunisticThresholdDiff,
+                pMac->roam.neighborRoamInfo.neighborRoamState);
+            pMac->roam.configParam.neighborRoamConfig.nOpportunisticThresholdDiff = nOpportunisticThresholdDiff;
+        }
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    return status;
+}
+
+/*--------------------------------------------------------------------------
+  \fn    sme_GetRoamOpportunisticScanThresholdDiff()
+  \brief gets Opportunistic Scan threshold diff
+         This is a synchronous call
+  \param hHal - The handle returned by macOpen
+  \return v_U8_t - nOpportunisticThresholdDiff
+  \sa
+  --------------------------------------------------------------------------*/
+v_U8_t sme_GetRoamOpportunisticScanThresholdDiff(tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    return pMac->roam.configParam.neighborRoamConfig.nOpportunisticThresholdDiff;
+}
+
+/* ---------------------------------------------------------------------------
+    \fn     sme_SetRoamRescanRssiDiff
+    \brief  Update roam rescan rssi diff
+            This function is called through dynamic setConfig callback function
+            to configure  nRoamRescanRssiDiff
+    \param  hHal - HAL handle for device
+    \param  nRoamRescanRssiDiff - roam rescan rssi diff
+    \return eHAL_STATUS_SUCCESS - SME update nRoamRescanRssiDiff config
+            successfully.
+            else SME is failed to update nRoamRescanRssiDiff.
+    -------------------------------------------------------------------------*/
+eHalStatus sme_SetRoamRescanRssiDiff(tHalHandle hHal,
+                                     const v_U8_t nRoamRescanRssiDiff)
+{
+    tpAniSirGlobal pMac    = PMAC_STRUCT( hHal );
+    eHalStatus     status  = eHAL_STATUS_SUCCESS;
+
+    status = sme_AcquireGlobalLock( &pMac->sme );
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        status = csrNeighborRoamSetRoamRescanRssiDiff(pMac,
+        nRoamRescanRssiDiff);
+        if (HAL_STATUS_SUCCESS(status))
+        {
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                "LFR runtime successfully set "
+                "opportunistic threshold diff to %d"
+                " - old value is %d - roam state is %d",
+                nRoamRescanRssiDiff,
+                pMac->roam.configParam.neighborRoamConfig.nRoamRescanRssiDiff,
+                pMac->roam.neighborRoamInfo.neighborRoamState);
+            pMac->roam.configParam.neighborRoamConfig.nRoamRescanRssiDiff =
+                nRoamRescanRssiDiff;
+        }
+        sme_ReleaseGlobalLock(&pMac->sme);
+    }
+    return status;
+}
+
+/*--------------------------------------------------------------------------
+  \fn    sme_GetRoamRescanRssiDiff
+  \brief gets roam rescan rssi diff
+         This is a synchronous call
+  \param hHal - The handle returned by macOpen
+  \return v_S7_t - nRoamRescanRssiDiff
+  \sa
+  --------------------------------------------------------------------------*/
+v_U8_t sme_GetRoamRescanRssiDiff(tHalHandle hHal)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    return pMac->roam.configParam.neighborRoamConfig.nRoamRescanRssiDiff;
+}
+
 /*--------------------------------------------------------------------------
   \brief sme_setNeighborLookupRssiThreshold() - update neighbor lookup rssi threshold
   This is a synchronous call
@@ -10939,25 +11044,6 @@ eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateP
     return status;
 }
 
-eHalStatus sme_getValidChannelList(tHalHandle hHal, tANI_U8 *numChannels,
-                                   tANI_U8 **chanList)
-{
-    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-    eHalStatus status;
-
-    status = sme_AcquireGlobalLock(&pMac->sme);
-    if (HAL_STATUS_SUCCESS(status))
-    {
-        *numChannels =
-            pMac->roam.neighborRoamInfo.cfgParams.channelInfo.numOfChannels;
-        vos_mem_copy(*chanList,
-            &pMac->roam.neighborRoamInfo.cfgParams.channelInfo.ChannelList,
-            *numChannels);
-        sme_ReleaseGlobalLock(&pMac->sme);
-    }
-    return status;
-}
-
 #ifdef QCA_WIFI_2_0
 eHalStatus sme_getChannelInfo(tHalHandle hHal, tANI_U8 chanId,
                               tSmeChannelInfo *chanInfo)
diff --git a/CORE/SVC/inc/wlan_ptt_sock_svc.h b/CORE/SVC/inc/wlan_ptt_sock_svc.h
index d77645f8c8b3..fdb46679d041 100644
--- a/CORE/SVC/inc/wlan_ptt_sock_svc.h
+++ b/CORE/SVC/inc/wlan_ptt_sock_svc.h
@@ -65,6 +65,7 @@
 #define ANI_MSG_CHANNEL_INFO_REQ    (ANI_DRIVER_MSG_START + 4)
 #define ANI_MSG_CHANNEL_INFO_RSP    (ANI_DRIVER_MSG_START + 5)
 #define ANI_MSG_OEM_ERROR           (ANI_DRIVER_MSG_START + 6)
+#define ANI_MSG_PEER_STATUS_IND     (ANI_DRIVER_MSG_START + 7)
 
 #define ANI_MAX_RADIOS      3
 #define ANI_NL_MSG_OK       0