qcacld: Sessionized Probe Rsp update for AP+AP

For AP+AP, additional IE coming from HDD were passed through
a common wlan_cfg buffer. This will cause wrong values to be
read by consuming modules for multiple session case (AP+AP).
To fix this, additional IE are passed to consumer modules
via sessionized buffer thus avoiding any conflict.

CRs-fixed: 649786
Change-Id: I88ce027d50f6da7825667e735b1f159fd94e2dc1

16 files changed, 455 insertions, 116 deletions

diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index 689de475b3e1..ef6df7325c99 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -614,6 +614,11 @@ typedef __ani_attr_pre_packed struct sSirHtConfig
    tANI_U32 unused:27;
 } __ani_attr_packed tSirHTConfig, *tpSirHTConfig;
 
+typedef __ani_attr_pre_packed struct sSirAddIeParams{
+      tANI_U16       dataLen;
+      tANI_U8       *data_buff;
+} tSirAddIeParams, *tpSirAddIeParams;
+
 /// Definition for kick starting BSS
 /// ---> MAC
 /**
@@ -676,6 +681,7 @@ typedef struct sSirSmeStartBssReq
     tANI_BOOLEAN            pmfRequired;
 #endif
 
+    tSirAddIeParams         addIeParams;
 } tSirSmeStartBssReq, *tpSirSmeStartBssReq;
 
 #define GET_IE_LEN_IN_BSS(lenInBss) ( lenInBss + sizeof(lenInBss) - \
@@ -4884,6 +4890,19 @@ typedef struct sSirStartBeaconIndication
     tANI_U8      bssid[VOS_MAC_ADDR_SIZE];
 }tSirStartBeaconIndication, *tpSirStartBeaconIndication;
 
+
+/* Message format for Update IE message sent to PE  */
+typedef struct sUpdateAIEs
+{
+   tANI_U16       msgType;
+   tANI_U16       msgLen;
+   tSirMacAddr    bssid;
+   tANI_U16       smeSessionId;
+   tANI_U8       *pAdditionIEBuffer;
+   tANI_U16       length;
+   boolean        append;
+}tUpdateAIEs,    *tpUpdateAIEs;
+
 /* Message format for requesting channel switch announcement to lower layers */
 typedef struct sSirDfsCsaIeRequest
 {
diff --git a/CORE/MAC/inc/wniApi.h b/CORE/MAC/inc/wniApi.h
index a7cfb60577b1..79a7fae0335b 100644
--- a/CORE/MAC/inc/wniApi.h
+++ b/CORE/MAC/inc/wniApi.h
@@ -395,6 +395,7 @@ enum eWniMsgTypes
     eWNI_SME_STATS_EXT_EVENT,
     eWNI_SME_LINK_SPEED_IND,//Indicate linkspeed response from WMA
     eWNI_SME_CSA_OFFLOAD_EVENT,
+    eWNI_SME_UPDATE_ADDITIONAL_IES,  // indicates Additional IE from hdd to PE
     eWNI_SME_MSG_TYPES_END
 };
 
diff --git a/CORE/MAC/src/pe/include/limSession.h b/CORE/MAC/src/pe/include/limSession.h
index affda82c8004..649fcf7bb0b6 100644
--- a/CORE/MAC/src/pe/include/limSession.h
+++ b/CORE/MAC/src/pe/include/limSession.h
@@ -423,6 +423,8 @@ typedef struct sPESession           // Added to Support BT-AMP
 #endif
 
     tANI_BOOLEAN isCiscoVendorAP;
+
+    tSirAddIeParams     addIeParams;
 }tPESession, *tpPESession;
 
 #define LIM_MAX_ACTIVE_SESSIONS 4
diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index 077945eef11e..8cb1e9e85dfd 100644
--- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -2176,6 +2176,11 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         limMsg->bodyptr = NULL;
         break;
 
+    case eWNI_SME_UPDATE_ADDITIONAL_IES:
+        limProcessSmeReqMessages(pMac, limMsg);
+        vos_mem_free((v_VOID_t*)limMsg->bodyptr);
+        limMsg->bodyptr = NULL;
+        break;
     default:
         vos_mem_free((v_VOID_t*)limMsg->bodyptr);
         limMsg->bodyptr = NULL;
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index 8d4ab4e003e0..c72038e77ae9 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -101,6 +101,8 @@ static void limProcessSmeStartBeaconReq(tpAniSirGlobal pMac,
                                                  tANI_U32 *pMsg);
 static void limProcessSmeDfsCsaIeRequest(tpAniSirGlobal pMac, tANI_U32 *pMsg);
 
+static void limProcessUpdateAddIEs(tpAniSirGlobal pMac, tANI_U32 *pMsg);
+
 void __limProcessSmeAssocCnfNew(tpAniSirGlobal, tANI_U32, tANI_U32 *);
 
 extern void peRegisterTLHandle(tpAniSirGlobal pMac);
@@ -575,7 +577,28 @@ __limHandleSmeStartBssRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
                 retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
                 goto free;
             }
+        }
+
+        if (pSmeStartBssReq->addIeParams.dataLen > 0 &&
+            pSmeStartBssReq->addIeParams.data_buff != NULL)
+        {
+            psessionEntry->addIeParams.dataLen =
+                pSmeStartBssReq->addIeParams.dataLen;
+
+            psessionEntry->addIeParams.data_buff =
+                vos_mem_malloc(psessionEntry->addIeParams.dataLen);
 
+           if ( NULL == psessionEntry->addIeParams.data_buff  )
+           {
+                PELOGE(limLog(pMac, LOGE, FL("AllocateMemory failed for "
+                    "psessionEntry->addIeParams.data_buff "));)
+                // Send failure response to host
+                retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
+                goto end;
+           }
+           vos_mem_copy(psessionEntry->addIeParams.data_buff,
+                pSmeStartBssReq->addIeParams.data_buff,
+                psessionEntry->addIeParams.dataLen);
         }
 
         /* Store the session related parameters in newly created session */
@@ -3726,6 +3749,11 @@ __limHandleSmeStopBssRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
             limSendDisassocMgmtFrame(pMac, eSIR_MAC_DEAUTH_LEAVING_BSS_REASON, bcAddr, psessionEntry, FALSE);
     }
 
+    /* Free the buffer allocated in START_BSS_REQ */
+    vos_mem_free(psessionEntry->addIeParams.data_buff);
+    psessionEntry->addIeParams.dataLen = 0;
+    psessionEntry->addIeParams.data_buff = NULL;
+
     //limDelBss is also called as part of coalescing, when we send DEL BSS followed by Add Bss msg.
     pMac->lim.gLimIbssCoalescingHappened = false;
 
@@ -5942,6 +5970,10 @@ limProcessSmeReqMessages(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
             limProcessSmeDfsCsaIeRequest(pMac, pMsgBuf);
             break;
 
+        case eWNI_SME_UPDATE_ADDITIONAL_IES:
+            limProcessUpdateAddIEs(pMac, pMsgBuf);
+            break;
+
         default:
             vos_mem_free((v_VOID_t*)pMsg->bodyptr);
             pMsg->bodyptr = NULL;
@@ -6142,6 +6174,108 @@ limProcessSmeChannelChangeRequest(tpAniSirGlobal pMac, tANI_U32 *pMsg)
     }
 }
 
+/******************************************************************************
+ * limProcessUpdateAddIEs()
+ *
+ *FUNCTION:
+ * This function is called by limProcessMessageQueue(). This
+ * function update the PE buffers for additional IEs.
+ *
+ *LOGIC:
+ *
+ *ASSUMPTIONS:
+ *
+ *NOTE:
+ *
+ * @param  pMac      Pointer to Global MAC structure
+ * @param  *pMsgBuf  A pointer to the SME message buffer
+******************************************************************************/
+static void
+limProcessUpdateAddIEs(tpAniSirGlobal pMac, tANI_U32 *pMsg)
+{
+    tpUpdateAIEs pUpdateAIEs = (tpUpdateAIEs)pMsg;
+    tANI_U8      sessionId;
+    /* incoming message has smeSession, use BSSID to find PE session*/
+    tpPESession  psessionEntry = peFindSessionByBssid(pMac,
+                                                      pUpdateAIEs->bssid,
+                                                      &sessionId);
+
+    if (NULL != psessionEntry) {
+        /* if len is 0, upper layer requested freeing of buffer */
+        if (0 == pUpdateAIEs->length) {
+            /* free old buffer */
+            vos_mem_free(psessionEntry->addIeParams.data_buff);
+            psessionEntry->addIeParams.data_buff = NULL;
+            psessionEntry->addIeParams.dataLen = 0;
+            return;
+        }
+
+        if (pUpdateAIEs->append) {
+            /* In case of append, allocate new memory with combined length */
+            tANI_U16 new_length = pUpdateAIEs->length +
+                                      psessionEntry->addIeParams.dataLen;
+            tANI_U8 *new_ptr = vos_mem_malloc(new_length);
+            if (NULL == new_ptr) {
+                limLog(pMac, LOGE, FL("Memory allocation failed."));
+                /* free incoming buffer in message */
+                vos_mem_free(pUpdateAIEs->pAdditionIEBuffer);
+                return;
+            }
+            /* append buffer to end of local buffers */
+            vos_mem_copy(new_ptr,
+                         psessionEntry->addIeParams.data_buff,
+                         psessionEntry->addIeParams.dataLen);
+            vos_mem_copy(&new_ptr[psessionEntry->addIeParams.dataLen],
+                         pUpdateAIEs->pAdditionIEBuffer,
+                         pUpdateAIEs->length);
+            /* free old memory*/
+            vos_mem_free(psessionEntry->addIeParams.data_buff);
+            /* adjust length accordingly */
+            psessionEntry->addIeParams.dataLen = new_length;
+            /* save refernece of local buffer in PE session */
+            psessionEntry->addIeParams.data_buff = new_ptr;
+            /* free incoming buffer in message */
+            vos_mem_free(pUpdateAIEs->pAdditionIEBuffer);
+            return;
+        }
+
+        if (pUpdateAIEs->length > psessionEntry->addIeParams.dataLen) {
+            psessionEntry->addIeParams.dataLen = pUpdateAIEs->length;
+            /* free old buffer */
+            vos_mem_free(psessionEntry->addIeParams.data_buff);
+            /* allocate a new */
+            psessionEntry->addIeParams.data_buff =
+                vos_mem_malloc(psessionEntry->addIeParams.dataLen);
+
+            if (NULL == psessionEntry->addIeParams.data_buff) {
+                limLog(pMac, LOGE, FL("Memory allocation failed."));
+                /* free incoming buffer in message */
+                vos_mem_free(pUpdateAIEs->pAdditionIEBuffer);
+                psessionEntry->addIeParams.dataLen = 0;
+                return;
+            }
+        }
+
+        /*
+         * copy the content of addition IE buffer in local buffer in
+         * PE session
+         */
+        psessionEntry->addIeParams.dataLen = pUpdateAIEs->length;
+        vos_mem_copy(psessionEntry->addIeParams.data_buff,
+                     pUpdateAIEs->pAdditionIEBuffer,
+                     psessionEntry->addIeParams.dataLen);
+        /* free incoming buffer in message */
+        vos_mem_free(pUpdateAIEs->pAdditionIEBuffer);
+    }
+    else
+    {
+        /* free incoming buffer in message */
+        vos_mem_free(pUpdateAIEs->pAdditionIEBuffer);
+        pUpdateAIEs->pAdditionIEBuffer = NULL;
+        limLog(pMac, LOGE, FL("Session not found for given bssid."));
+    }
+}
+
 /**
  * limProcessSmeDfsCsaIeRequest()
  *
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index 82c0966d9a50..1cb226e42a3c 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -740,10 +740,8 @@ limSendProbeRspMgmtFrame(tpAniSirGlobal pMac,
     tANI_U8             *pFrame;
     void                *pPacket;
     eHalStatus           halstatus;
-    tANI_U32             addnIEPresent;
-    tANI_U32             addnIE1Len=0;
-    tANI_U32             addnIE2Len=0;
-    tANI_U32             addnIE3Len=0;
+    tANI_U32             addnIEPresent = VOS_FALSE;
+
     tANI_U16             totalAddnIeLen = 0;
     tANI_U32             wpsApEnable=0, tmp;
     tANI_U8              txFlag = 0;
@@ -912,7 +910,6 @@ limSendProbeRspMgmtFrame(tpAniSirGlobal pMac,
 
     nBytes = nPayload + sizeof( tSirMacMgmtHdr );
 
-    addnIEPresent = false;
 
     if( pMac->lim.gpLimRemainOnChanReq )
     {
@@ -922,20 +919,13 @@ limSendProbeRspMgmtFrame(tpAniSirGlobal pMac,
     //In listening mode, probe rsp IEs is passed in the message from SME to PE
     else
     {
-
-        if (wlan_cfgGetInt(pMac, WNI_CFG_PROBE_RSP_ADDNIE_FLAG,
-                           &addnIEPresent) != eSIR_SUCCESS)
-        {
-            limLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_FLAG"));
-            vos_mem_free(pFrm);
-            return;
-        }
+        addnIEPresent = (psessionEntry->addIeParams.dataLen != 0);
     }
 
     if (addnIEPresent)
     {
 
-        addIE = vos_mem_malloc(WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN*3);
+        addIE = vos_mem_malloc(psessionEntry->addIeParams.dataLen);
         if ( NULL == addIE )
         {
             PELOGE(limLog(pMac, LOGE,
@@ -944,79 +934,9 @@ limSendProbeRspMgmtFrame(tpAniSirGlobal pMac,
             return;
         }
 
-        //Probe rsp IE available
-        if ( eSIR_SUCCESS != wlan_cfgGetStrLen(pMac,
-                                  WNI_CFG_PROBE_RSP_ADDNIE_DATA1, &addnIE1Len) )
-        {
-            limLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 length"));
-            vos_mem_free(addIE);
-            vos_mem_free(pFrm);
-            return;
-        }
-        if (addnIE1Len <= WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN && addnIE1Len &&
-                     (nBytes + addnIE1Len) <= SIR_MAX_PACKET_SIZE)
-        {
-            if ( eSIR_SUCCESS != wlan_cfgGetStr(pMac,
-                                     WNI_CFG_PROBE_RSP_ADDNIE_DATA1, &addIE[0],
-                                     &addnIE1Len) )
-            {
-                limLog(pMac, LOGP,
-                     FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 String"));
-                vos_mem_free(addIE);
-                vos_mem_free(pFrm);
-                return;
-            }
-        }
-
-        //Probe rsp IE available
-        if ( eSIR_SUCCESS != wlan_cfgGetStrLen(pMac,
-                                  WNI_CFG_PROBE_RSP_ADDNIE_DATA2, &addnIE2Len) )
-        {
-            limLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA2 length"));
-            vos_mem_free(addIE);
-            vos_mem_free(pFrm);
-            return;
-        }
-        if (addnIE2Len <= WNI_CFG_PROBE_RSP_ADDNIE_DATA2_LEN && addnIE2Len &&
-                     (nBytes + addnIE2Len) <= SIR_MAX_PACKET_SIZE)
-        {
-            if ( eSIR_SUCCESS != wlan_cfgGetStr(pMac,
-                                     WNI_CFG_PROBE_RSP_ADDNIE_DATA2, &addIE[addnIE1Len],
-                                     &addnIE2Len) )
-            {
-                limLog(pMac, LOGP,
-                     FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA2 String"));
-                vos_mem_free(addIE);
-                vos_mem_free(pFrm);
-                return;
-            }
-        }
-
-        //Probe rsp IE available
-        if ( eSIR_SUCCESS != wlan_cfgGetStrLen(pMac,
-                                  WNI_CFG_PROBE_RSP_ADDNIE_DATA3, &addnIE3Len) )
-        {
-            limLog(pMac, LOGP, FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA3 length"));
-            vos_mem_free(addIE);
-            vos_mem_free(pFrm);
-            return;
-        }
-        if (addnIE3Len <= WNI_CFG_PROBE_RSP_ADDNIE_DATA3_LEN && addnIE3Len &&
-                     (nBytes + addnIE3Len) <= SIR_MAX_PACKET_SIZE)
-        {
-            if ( eSIR_SUCCESS != wlan_cfgGetStr(pMac,
-                                     WNI_CFG_PROBE_RSP_ADDNIE_DATA3,
-                                     &addIE[addnIE1Len + addnIE2Len],
-                                     &addnIE3Len) )
-            {
-                limLog(pMac, LOGP,
-                     FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA3 String"));
-                vos_mem_free(addIE);
-                vos_mem_free(pFrm);
-                return;
-            }
-        }
-        totalAddnIeLen = addnIE1Len + addnIE2Len + addnIE3Len;
+        vos_mem_copy(addIE, psessionEntry->addIeParams.data_buff,
+            psessionEntry->addIeParams.dataLen);
+        totalAddnIeLen = psessionEntry->addIeParams.dataLen;
 
         if(eSIR_SUCCESS != limGetAddnIeForProbeResp(pMac, addIE, &totalAddnIeLen, probeReqP2pIe))
         {
diff --git a/CORE/MAC/src/pe/lim/limSerDesUtils.c b/CORE/MAC/src/pe/lim/limSerDesUtils.c
index 1490f76ef796..40d2b83b0eb7 100644
--- a/CORE/MAC/src/pe/lim/limSerDesUtils.c
+++ b/CORE/MAC/src/pe/lim/limSerDesUtils.c
@@ -757,6 +757,11 @@ limStartBssReqSerDes(tpAniSirGlobal pMac, tpSirSmeStartBssReq pStartBssReq, tANI
                  sizeof(tSirHTConfig));
     len -= sizeof(tSirHTConfig);
     pBuf += sizeof(tSirHTConfig);
+
+    vos_mem_copy(&(pStartBssReq->addIeParams), pBuf, sizeof(tSirAddIeParams));
+    len -= sizeof(tSirAddIeParams);
+    pBuf += sizeof(tSirAddIeParams);
+
     if (len)
     {
         limLog(pMac, LOGW, FL("Extra bytes left in SME_START_BSS_REQ, len=%d"), len);
diff --git a/CORE/MAC/src/pe/sch/schApi.c b/CORE/MAC/src/pe/sch/schApi.c
index c0fe657e3a91..481463ec5b07 100644
--- a/CORE/MAC/src/pe/sch/schApi.c
+++ b/CORE/MAC/src/pe/sch/schApi.c
@@ -406,46 +406,28 @@ tANI_U32 limSendProbeRspTemplateToHal(tpAniSirGlobal pMac,tpPESession psessionEn
     nBytes = nPayload + sizeof( tSirMacMgmtHdr );
 
     //Check if probe response IE is present or not
-    if (wlan_cfgGetInt(pMac, WNI_CFG_PROBE_RSP_ADDNIE_FLAG, &addnIEPresent) != eSIR_SUCCESS)
-    {
-        schLog(pMac, LOGE, FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_FLAG"));
-        return retCode;
-    }
-
+    addnIEPresent = (psessionEntry->addIeParams.dataLen != 0);
     if (addnIEPresent)
     {
         //Probe rsp IE available
-        addIE = vos_mem_malloc(WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN);
+        /*need to check the data length*/
+        addIE = vos_mem_malloc(psessionEntry->addIeParams.dataLen);
         if ( NULL == addIE )
         {
              schLog(pMac, LOGE,
                  FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 length"));
              return retCode;
         }
+        addnIELen = psessionEntry->addIeParams.dataLen;
 
-        if (wlan_cfgGetStrLen(pMac, WNI_CFG_PROBE_RSP_ADDNIE_DATA1,
-                                               &addnIELen) != eSIR_SUCCESS)
-        {
-            schLog(pMac, LOGE,
-                FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 length"));
-
-            vos_mem_free(addIE);
-            return retCode;
-        }
 
         if (addnIELen <= WNI_CFG_PROBE_RSP_ADDNIE_DATA1_LEN && addnIELen &&
                                  (nBytes + addnIELen) <= SIR_MAX_PACKET_SIZE)
         {
-            if ( eSIR_SUCCESS != wlan_cfgGetStr(pMac,
-                                    WNI_CFG_PROBE_RSP_ADDNIE_DATA1, &addIE[0],
-                                    &addnIELen) )
-            {
-               schLog(pMac, LOGE,
-                   FL("Unable to get WNI_CFG_PROBE_RSP_ADDNIE_DATA1 String"));
-
-                vos_mem_free(addIE);
-               return retCode;
-            }
+
+
+        vos_mem_copy(addIE, psessionEntry->addIeParams.data_buff,
+            psessionEntry->addIeParams.dataLen);
         }
     }
 
diff --git a/CORE/SAP/inc/sapApi.h b/CORE/SAP/inc/sapApi.h
index a9e5d108e4a1..5542e3fd5bfd 100644
--- a/CORE/SAP/inc/sapApi.h
+++ b/CORE/SAP/inc/sapApi.h
@@ -488,6 +488,8 @@ typedef struct sap_Config {
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
     v_U8_t          cc_switch_mode;
 #endif
+    v_U16_t    addnIEsBufferLen;
+    v_PVOID_t  addnIEsBuffer; /* buffer for addn ies comes from hostapd*/
 } tsap_Config_t;
 
 typedef enum {
@@ -1784,6 +1786,65 @@ WLANSAP_DfsSendCSAIeRequest(v_PVOID_t pSapCtx);
 VOS_STATUS
 WLANSAP_Set_Dfs_Ignore_CAC(v_PVOID_t pvosGCtx, v_U8_t ignore_cac);
 
+
+
+/*==========================================================================
+  FUNCTION    WLANSAP_UpdateSapConfigAddIE
+
+  DESCRIPTION
+   This API is used to set sap config parameter.
+
+  DEPENDENCIES
+   NA.
+
+  PARAMETERS
+  IN OUT
+  pConfig:  Pointer to sap config
+
+  PARAMETERS
+  IN
+  additionIEBuffer - buffer containing addition IE from hostapd
+
+  PARAMETERS
+  IN
+  additionIELength - length of buffer
+
+  RETURN VALUE
+  The VOS_STATUS code associated with performing the operation
+
+  VOS_STATUS_SUCCESS:  Success
+
+  SIDE EFFECTS
+============================================================================*/
+
+VOS_STATUS WLANSAP_UpdateSapConfigAddIE(tsap_Config_t *pConfig,
+                         const tANI_U8 *additionIEBuffer,
+                         tANI_U16 additionIELength);
+
+/*==========================================================================
+  FUNCTION    WLANSAP_ResetSapConfigAddIE
+
+  DESCRIPTION
+   This API is used to reset and clear the buffer in sap config.
+
+  DEPENDENCIES
+   NA.
+
+  PARAMETERS
+  IN OUT
+  pConfig:  Pointer to sap config
+
+  RETURN VALUE
+  The VOS_STATUS code associated with performing the operation
+
+  VOS_STATUS_SUCCESS:  Success
+
+  SIDE EFFECTS
+============================================================================*/
+
+VOS_STATUS WLANSAP_ResetSapConfigAddIE(tsap_Config_t *pConfig );
+
+
 /*==========================================================================
 FUNCTION  sapConvertSapPhyModeToCsrPhyMode
 
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 6811f6eb5262..105a8bececd9 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -1692,6 +1692,17 @@ sapconvertToCsrProfile(tsap_Config_t *pconfig_params, eCsrRoamBssType bssType, t
     profile->MFPRequired = pconfig_params->mfpRequired ? 1 : 0;
 #endif
 
+    if (pconfig_params->addnIEsBufferLen > 0 &&
+        pconfig_params->addnIEsBuffer != NULL)
+    {
+        profile->addIeParams.dataLen = pconfig_params->addnIEsBufferLen;
+        profile->addIeParams.data_buff = pconfig_params->addnIEsBuffer;
+    }
+    else
+    {
+        profile->addIeParams.dataLen = 0;
+        profile->addIeParams.data_buff = NULL;
+    }
     return eSAP_STATUS_SUCCESS; /* Success.  */
 }
 
diff --git a/CORE/SAP/src/sapModule.c b/CORE/SAP/src/sapModule.c
index 50bcb2591c8d..a48e1e92ac32 100644
--- a/CORE/SAP/src/sapModule.c
+++ b/CORE/SAP/src/sapModule.c
@@ -2770,6 +2770,52 @@ VOS_STATUS WLANSAP_Set_Dfs_Ignore_CAC(v_PVOID_t pvosGCtx, v_U8_t ignore_cac)
     return VOS_STATUS_SUCCESS;
 }
 
+VOS_STATUS WLANSAP_UpdateSapConfigAddIE(tsap_Config_t *pConfig,
+                         const tANI_U8 *pAdditionIEBuffer,
+                         tANI_U16 additionIELength)
+{
+    VOS_STATUS status = VOS_STATUS_SUCCESS;
+
+    if (NULL == pConfig) {
+        return VOS_STATUS_E_FAULT;
+    }
+    if ( (pAdditionIEBuffer != NULL) && (additionIELength != 0) ) {
+        /* initialize the buffer pointer so that pe can copy*/
+        if (additionIELength > 0) {
+            pConfig->addnIEsBufferLen = additionIELength;
+            pConfig->addnIEsBuffer = vos_mem_malloc(additionIELength);
+            if (NULL == pConfig->addnIEsBuffer) {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                     "%s: Could not copy PROBE_RSP_ADDNIE", __func__);
+                return VOS_STATUS_E_NOMEM;
+            }
+            vos_mem_copy(pConfig->addnIEsBuffer,
+                         pAdditionIEBuffer, additionIELength);
+        }
+    } else {
+        vos_mem_free(pConfig->addnIEsBuffer);
+        pConfig->addnIEsBufferLen = 0;
+        pConfig->addnIEsBuffer = NULL;
+
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+            "%s: No Probe Response IE received in set beacon", __func__);
+    }
+
+    return (status);
+}
+
+
+VOS_STATUS WLANSAP_ResetSapConfigAddIE(tsap_Config_t *pConfig )
+{
+    if (NULL == pConfig) {
+        return VOS_STATUS_E_FAULT;
+    }
+    vos_mem_free( pConfig->addnIEsBuffer);
+    pConfig->addnIEsBufferLen = 0;
+    pConfig->addnIEsBuffer = NULL;
+    return VOS_STATUS_SUCCESS;
+}
+
 /*==========================================================================
   FUNCTION    WLANSAP_Get_DfsNol
 
diff --git a/CORE/SME/inc/csrApi.h b/CORE/SME/inc/csrApi.h
index 2e7f4d8fffde..a3d5fadbedb9 100644
--- a/CORE/SME/inc/csrApi.h
+++ b/CORE/SME/inc/csrApi.h
@@ -927,6 +927,8 @@ typedef struct tagCsrRoamProfile
     tVOS_CON_MODE csrPersona;
 
     tANI_U8 disableDFSChSwitch;
+    /* addIe params */
+    tSirAddIeParams        addIeParams;
 }tCsrRoamProfile;
 
 
diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index f9cf44085ee4..eb053729ac69 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -386,6 +386,9 @@ typedef struct tagCsrRoamStartBssParams
     tANI_BOOLEAN        mfpCapable;
     tANI_BOOLEAN        mfpRequired;
 #endif
+
+    tSirAddIeParams     addIeParams;
+
 }tCsrRoamStartBssParams;
 
 
@@ -1488,4 +1491,24 @@ eHalStatus csrRoamStartBeaconReq( tpAniSirGlobal pMac,
 eHalStatus
 csrRoamSendChanSwIERequest(tpAniSirGlobal pMac, tCsrBssid bssid,
                      tANI_U8 targetChannel, tANI_U8 csaIeReqd);
+
+/*----------------------------------------------------------------------------
+ \fn csrRoamUpdateAddIEs
+ \brief  This function sends msg to updates the additional IE buffers in PE
+ \param  pMac - pMac global structure
+ \param  sessionId - SME session id
+ \param  bssid - BSSID
+ \param  additionIEBuffer - buffer containing addition IE from hostapd
+ \param  length - length of buffer
+ \param  append - append or replace completely
+ \- return Success or failure
+-----------------------------------------------------------------------------*/
+eHalStatus
+csrRoamUpdateAddIEs(tpAniSirGlobal pMac,
+                  tANI_U8 sessionId,
+                  tSirMacAddr bssid,
+                  tANI_U8 *additionIEBuffer,
+                  tANI_U16 length,
+                  boolean append);
+
 #endif
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index c0852e9db205..ebc6f933c298 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -3577,6 +3577,25 @@ eHalStatus sme_TxpowerLimit( tHalHandle hHal, tSirTxPowerLimit *psmetx);
 eHalStatus sme_GetLinkSpeed(tHalHandle hHal,tSirLinkSpeedInfo *lsReq,void *plsContext,
                             void (*pCallbackfn)(tSirLinkSpeedInfo *indParam, void *pContext) );
 #endif
+
+/*----------------------------------------------------------------------------
+ \fn  sme_UpdateAddIE
+ \brief  This function sends msg to updates the additional IE buffers in PE
+ \param  hHal - global structure
+ \param  sessionId - SME session id
+ \param  bssid - BSSID
+ \param  additionIEBuffer - buffer containing addition IE from hostapd
+ \param  length - length of buffer
+ \param  append - append or replace completely
+ \- return Success or failure
+-----------------------------------------------------------------------------*/
+eHalStatus sme_UpdateAddIE(tHalHandle hHal,
+                         tANI_U8 sessionId,
+                         tSirMacAddr bssid,
+                         tANI_U8 *additionIEBuffer,
+                         tANI_U16 length,
+                         boolean append);
+
 eHalStatus sme_UpdateConnectDebug(tHalHandle hHal, tANI_U32 set_value);
 eHalStatus sme_ApDisableIntraBssFwd(tHalHandle hHal, tANI_U8 sessionId,
                                     tANI_BOOLEAN disablefwd);
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index 58b5856e33c3..6d8a9b9ff4ef 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -6378,6 +6378,9 @@ eHalStatus csrRoamCopyProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pDstProfile,
             pDstProfile->MDID.mobilityDomain = pSrcProfile->MDID.mobilityDomain;
         }
 #endif
+        vos_mem_copy(&pDstProfile->addIeParams,
+                     &pSrcProfile->addIeParams,
+                     sizeof(tSirAddIeParams));
     }while(0);
 
     if(!HAL_STATUS_SUCCESS(status))
@@ -6388,6 +6391,7 @@ eHalStatus csrRoamCopyProfile(tpAniSirGlobal pMac, tCsrRoamProfile *pDstProfile,
 
     return (status);
 }
+
 eHalStatus csrRoamCopyConnectedProfile(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfile *pDstProfile )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -11976,6 +11980,9 @@ eHalStatus csrRoamIssueStartBss( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRo
     pParam->mfpRequired = (0 != pProfile->MFPRequired);
 #endif
 
+    pParam->addIeParams.dataLen = pProfile->addIeParams.dataLen;
+    pParam->addIeParams.data_buff = pProfile->addIeParams.data_buff;
+
     // When starting an IBSS, start on the channel from the Profile.
     status = csrSendMBStartBssReqMsg( pMac, sessionId, pProfile->BSSType, pParam, pBssDesc );
     return (status);
@@ -14216,9 +14223,13 @@ eHalStatus csrSendMBStartBssReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, eCs
         }
 
         //HT Config
-		  vos_mem_copy(pBuf, &pSession->htConfig,
-				  sizeof(tSirHTConfig));
-		  pBuf += sizeof(tSirHTConfig);
+        vos_mem_copy(pBuf, &pSession->htConfig,
+          sizeof(tSirHTConfig));
+          pBuf += sizeof(tSirHTConfig);
+
+        vos_mem_copy(pBuf, &pParam->addIeParams, sizeof( pParam->addIeParams ));
+        pBuf += sizeof(pParam->addIeParams);
+
         msgLen = (tANI_U16)(sizeof(tANI_U32 ) + (pBuf - wTmpBuf)); //msg_header + msg
         pMsg->length = pal_cpu_to_be16(msgLen);
 
@@ -17832,6 +17843,70 @@ eHalStatus csrRoamStartBeaconReq( tpAniSirGlobal pMac, tCsrBssid bssid,
     return ( status );
 }
 
+
+/*----------------------------------------------------------------------------
+ \fn csrRoamUpdateAddIEs
+ \brief  This function sends msg to updates the additional IE buffers in PE
+ \param  pMac - pMac global structure
+ \param  sessionId - SME session id
+ \param  bssid - BSSID
+ \param  additionIEBuffer - buffer containing addition IE from hostapd
+ \param  length - length of buffer
+ \param  append - append or replace completely
+ \- return Success or failure
+-----------------------------------------------------------------------------*/
+eHalStatus
+csrRoamUpdateAddIEs(tpAniSirGlobal pMac,
+                  tANI_U8 sessionId,
+                  tSirMacAddr bssid,
+                  tANI_U8 *additionIEBuffer,
+                  tANI_U16 length,
+                  boolean append)
+{
+    tpUpdateAIEs pUpdateAIEs = NULL;
+    tANI_U8 *pLocalBuffer = NULL;
+    eHalStatus status;
+    /* following buffer will be freed by consumer (PE) */
+    pLocalBuffer = vos_mem_malloc(length);
+
+    if (NULL == pLocalBuffer)
+    {
+       smsLog(pMac, LOGE, FL("Memory Allocation Failure!!!"));
+       return eHAL_STATUS_FAILED_ALLOC;
+    }
+
+    pUpdateAIEs = vos_mem_malloc(sizeof(tUpdateAIEs));
+    if (NULL == pUpdateAIEs)
+    {
+       smsLog(pMac, LOGE, FL("Memory Allocation Failure!!!"));
+       vos_mem_free(pLocalBuffer);
+       return eHAL_STATUS_FAILED_ALLOC;
+    }
+
+    vos_mem_copy(pLocalBuffer, additionIEBuffer, length);
+    vos_mem_zero(pUpdateAIEs, sizeof(tUpdateAIEs));
+
+    pUpdateAIEs->msgType =
+        pal_cpu_to_be16((tANI_U16)eWNI_SME_UPDATE_ADDITIONAL_IES);
+    pUpdateAIEs->msgLen = sizeof(tUpdateAIEs);
+    vos_mem_copy(pUpdateAIEs->bssid, bssid, sizeof(tSirMacAddr));
+    pUpdateAIEs->smeSessionId = sessionId;
+    pUpdateAIEs->pAdditionIEBuffer = pLocalBuffer;
+    pUpdateAIEs->length = length;
+    pUpdateAIEs->append = append;
+    status = palSendMBMessage(pMac->hHdd, pUpdateAIEs);
+    if (!HAL_STATUS_SUCCESS(status))
+    {
+       smsLog(pMac, LOGE,
+           FL("Failed to send eWNI_SME_UPDATE_ADDTIONAL_IES msg"
+           "!!! status %d"), status);
+       vos_mem_free(pLocalBuffer);
+       vos_mem_free(pUpdateAIEs);
+    }
+    return status;
+}
+
+
 /*----------------------------------------------------------------------------
  \fn csrRoamSendChanSwIERequest
  \brief  This function sends request to transmit channel switch announcement
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index f417fc2b425e..0eb89e086666 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -12387,6 +12387,7 @@ eHalStatus sme_StatsExtEvent(tHalHandle hHal, void* pMsg)
 }
 
 #endif
+
 /* ---------------------------------------------------------------------------
     \fn sme_UpdateDFSScanMode
     \brief  Update DFS roam Mode
@@ -12427,6 +12428,7 @@ eHalStatus sme_UpdateDFSScanMode(tHalHandle hHal, v_BOOL_t isAllowDFSChannelRoam
 
     return status ;
 }
+
 /*--------------------------------------------------------------------------
   \brief sme_GetWESMode() - get WES Mode
   This is a synchronous call
@@ -12439,3 +12441,35 @@ v_BOOL_t sme_GetDFSScanMode(tHalHandle hHal)
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     return pMac->roam.configParam.allowDFSChannelRoam;
 }
+
+/*----------------------------------------------------------------------------
+ \fn  sme_UpdateAIE
+ \brief  This function sends msg to updates the additional IE buffers in PE
+ \param  hHal - global structure
+ \param  sessionId - SME session id
+ \param  bssid - BSSID
+ \param  additionIEBuffer - buffer containing addition IE from hostapd
+ \param  length - length of buffer
+ \param  append - append or replace completely
+ \- return Success or failure
+-----------------------------------------------------------------------------*/
+eHalStatus sme_UpdateAddIE(tHalHandle hHal,
+                         tANI_U8 sessionId,
+                         tSirMacAddr bssid,
+                         tANI_U8 *additionIEBuffer,
+                         tANI_U16 length,
+                         boolean append)
+{
+    eHalStatus status = eHAL_STATUS_FAILURE;
+    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+    status = sme_AcquireGlobalLock( &pMac->sme );
+
+    if ( HAL_STATUS_SUCCESS( status ) )
+    {
+        status = csrRoamUpdateAddIEs(pMac, sessionId, bssid, additionIEBuffer,
+            length, append);
+        sme_ReleaseGlobalLock( &pMac->sme );
+    }
+    return (status);
+}
+