Release 1.0.0.62 QCACLD WLAN Driver

Merge remote-tracking branch 'origin/caf/caf-wlan/master'

* origin/caf/caf-wlan/master:
  Cafstaging Release 1.0.0.62
  wlan: fix format specifier in logs - DFS
  qcacld: Fix of memory leak in wma for WDA_UPDATE_OP_MODE
  Fix assoc response tx fail when max stations are reached
  WMA: Changes adf_os_mem_alloc to vos_mem_malloc
  qcacld: Define new INI item gRegulatoryChangeCountry
  qcacld: Fix of kernel panic in ol_vdev_rx_set_intrabss_fwd
  qcacld: CSR: Process the PNO scan result in all roam states
  qcacld: Add session ID to PNO scan completion event
  qcacld: Fix the kernel warning reported in WLAN
  qcacld: Fix of Memory leak in HIF_PCIDeviceProbed
  qcacld: Fix of memory leak in wma_dfs_attach
  qcacld: hdd: Update WMM status properly

Change-Id: Iae9c84885f9eec920b3193e25ded2d4873f2bbcb

23 files changed, 198 insertions, 205 deletions

diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c
index 23f9cb21e76a..b8dbec773ac7 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -1965,6 +1965,9 @@ ol_vdev_rx_set_intrabss_fwd(
     ol_txrx_vdev_handle vdev,
     a_bool_t val)
 {
+    if (NULL == vdev)
+        return;
+
     vdev->disable_intrabss_fwd = val;
 }
 
diff --git a/CORE/HDD/inc/wlan_hdd_cfg.h b/CORE/HDD/inc/wlan_hdd_cfg.h
index 445a4a06236f..07ea944f6541 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -269,6 +269,11 @@
 #define CFG_ENABLE_ADAPT_RX_DRAIN_DEFAULT   WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STADEF
 
 
+#define CFG_REG_CHANGE_DEF_COUNTRY_NAME          "gRegulatoryChangeCountry"
+#define CFG_REG_CHANGE_DEF_COUNTRY_DEFAULT       ( 0 )
+#define CFG_REG_CHANGE_DEF_COUNTRY_MIN           ( 0 )
+#define CFG_REG_CHANGE_DEF_COUNTRY_MAX           ( 1 )
+
 typedef enum
 {
     eHDD_DOT11_MODE_AUTO = 0, //covers all things we support
@@ -2727,6 +2732,7 @@ typedef struct
    v_BOOL_t                    fDfsPhyerrFilterOffload;
    v_BOOL_t                    gEnableOverLapCh;
    char                        acsAllowedChnls[CFG_MAX_STR_LEN];
+   v_BOOL_t                    fRegChangeDefCountry;
 } hdd_config_t;
 /*---------------------------------------------------------------------------
   Function declarations and documenation
diff --git a/CORE/HDD/src/wlan_hdd_cfg.c b/CORE/HDD/src/wlan_hdd_cfg.c
index 64c77d3c9c0c..fe9255d8b412 100644
--- a/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/CORE/HDD/src/wlan_hdd_cfg.c
@@ -3167,16 +3167,26 @@ REG_VARIABLE( CFG_ENABLE_DFS_PHYERR_FILTEROFFLOAD_NAME, WLAN_PARAM_Integer,
               CFG_ENABLE_DFS_PHYERR_FILTEROFFLOAD_DEFAULT,
               CFG_ENABLE_DFS_PHYERR_FILTEROFFLOAD_MIN,
               CFG_ENABLE_DFS_PHYERR_FILTEROFFLOAD_MAX ),
+
 REG_VARIABLE( CFG_ENABLE_OVERLAP_CH, WLAN_PARAM_Integer,
                hdd_config_t, gEnableOverLapCh,
                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK,
                CFG_ENABLE_OVERLAP_CH_DEFAULT,
                CFG_ENABLE_OVERLAP_CH_MIN,
                CFG_ENABLE_OVERLAP_CH_MAX ),
+
 REG_VARIABLE_STRING( CFG_ONLY_ALLOWED_CHANNELS, WLAN_PARAM_String,
                      hdd_config_t, acsAllowedChnls,
                      VAR_FLAGS_OPTIONAL,
                      (void *)CFG_ONLY_ALLOWED_CHANNELS_DEFAULT),
+
+REG_VARIABLE( CFG_REG_CHANGE_DEF_COUNTRY_NAME, WLAN_PARAM_Integer,
+              hdd_config_t, fRegChangeDefCountry,
+              VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+              CFG_REG_CHANGE_DEF_COUNTRY_DEFAULT,
+              CFG_REG_CHANGE_DEF_COUNTRY_MIN,
+              CFG_REG_CHANGE_DEF_COUNTRY_MAX),
+
 };
 
 /*
diff --git a/CORE/HDD/src/wlan_hdd_wmm.c b/CORE/HDD/src/wlan_hdd_wmm.c
index 49a36b76ebef..d9ac2c1b4c32 100644
--- a/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/CORE/HDD/src/wlan_hdd_wmm.c
@@ -792,6 +792,7 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
                 "%s: Setup Invalid Params, notify TL",
                 __func__);
       // QoS setup failed
+      pAc->wmmAcAccessAllowed = VOS_FALSE;
 
       if (HDD_WMM_HANDLE_IMPLICIT == pQosContext->handle)
       {
@@ -975,7 +976,6 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
       VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
                 "%s: Release is complete",
                 __func__);
-      pAc->wmmAcAccessGranted = VOS_FALSE;
 
       if (pCurrentQosInfo)
       {
@@ -1001,6 +1001,9 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
          // this is the last flow active for this AC so update the AC state
          pAc->wmmAcTspecValid = VOS_FALSE;
 
+         // DELTS is successful, do not allow
+         pAc->wmmAcAccessAllowed = VOS_FALSE;
+
          // need to tell TL to update its UAPSD handling
          hdd_wmm_disable_tl_uapsd(pQosContext);
       }
@@ -1046,6 +1049,8 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
 
       // current TSPEC is no longer valid
       pAc->wmmAcTspecValid = VOS_FALSE;
+      // AP has sent DELTS, do not allow
+      pAc->wmmAcAccessAllowed = VOS_FALSE;
 
       // need to tell TL to update its UAPSD handling
       hdd_wmm_disable_tl_uapsd(pQosContext);
@@ -1211,20 +1216,21 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
       VOS_ASSERT(0);
    }
 
+#ifndef QCA_WIFI_2_0
    // our access to the particular access category may have changed.
    // some of the implicit QoS cases above may have already set this
    // prior to invoking TL (so that we will properly service the
    // Tx queues) but let's consistently handle all cases here
    pAc->wmmAcAccessAllowed = hdd_wmm_is_access_allowed(pAdapter, pAc);
-
-   //hdd_wmm_is_access_allowed returns true for explicit case. This is
-   //not always true. If Access to particular AC fails and if
-   //admission is required for that particular AC, then access is not
-   //allowed to that AC.
-   if ((pAc->wmmAcAccessFailed && pAc->wmmAcAccessRequired) ||
-        !pAc->wmmAcAccessGranted) {
+#else
+   // if Tspec only allows downstream traffic then access is not allowed
+   if (pAc->wmmAcTspecInfo.ts_info.direction == SME_QOS_WMM_TS_DIR_DOWNLINK)
       pAc->wmmAcAccessAllowed = VOS_FALSE;
-   }
+
+   // if ACM bit is not set, allow access
+   if (!(pAc->wmmAcAccessRequired))
+      pAc->wmmAcAccessAllowed = VOS_TRUE;
+#endif
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
              "%s: complete, access for TL AC %d is%sallowed",
diff --git a/CORE/MAC/inc/aniGlobal.h b/CORE/MAC/inc/aniGlobal.h
index ed7d984b0d1a..1529b7b4950a 100644
--- a/CORE/MAC/inc/aniGlobal.h
+++ b/CORE/MAC/inc/aniGlobal.h
@@ -261,7 +261,6 @@ typedef struct sLimTimers
 typedef struct {
     void *pMlmDisassocReq;
     void *pMlmDeauthReq;
-    vos_spin_lock_t deauthDisassocInprogress;
 }tLimDisassocDeauthCnfReq;
 
 typedef struct sAniSirLim
@@ -657,7 +656,7 @@ typedef struct sAniSirLim
 
     // admission control policy information
     tLimAdmitPolicyInfo admitPolicyInfo;
-    vos_spin_lock_t lkPeGlobalLock;
+    vos_lock_t lkPeGlobalLock;
     tANI_U8 disableLDPCWithTxbfAP;
 #ifdef FEATURE_WLAN_TDLS
     tANI_U8 gLimTDLSBufStaEnabled;
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 05d81dc504cf..69dd21b6c149 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            61
+#define QWLAN_VERSION_BUILD            62
 
-#define QWLAN_VERSIONSTR               "1.0.0.61"
+#define QWLAN_VERSIONSTR               "1.0.0.62"
 
 #ifdef QCA_WIFI_2_0
 
diff --git a/CORE/MAC/src/include/sirParams.h b/CORE/MAC/src/include/sirParams.h
index 9d41e7047ae7..cf952d6257cd 100644
--- a/CORE/MAC/src/include/sirParams.h
+++ b/CORE/MAC/src/include/sirParams.h
@@ -661,6 +661,9 @@ typedef struct sSirMbMsgP2p
 
 #define SIR_HAL_MODEM_POWER_STATE_IND      (SIR_HAL_ITC_MSG_TYPES_BEGIN + 254)
 
+#define SIR_HAL_DISASSOC_TX_COMP           (SIR_HAL_ITC_MSG_TYPES_BEGIN + 255)
+#define SIR_HAL_DEAUTH_TX_COMP             (SIR_HAL_ITC_MSG_TYPES_BEGIN + 256)
+
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
 
 // CFG message types
diff --git a/CORE/MAC/src/pe/lim/limApi.c b/CORE/MAC/src/pe/lim/limApi.c
index 850f84c9aa7b..754644abbdd1 100644
--- a/CORE/MAC/src/pe/lim/limApi.c
+++ b/CORE/MAC/src/pe/lim/limApi.c
@@ -1027,18 +1027,11 @@ tSirRetStatus peOpen(tpAniSirGlobal pMac, tMacOpenParameters *pMacOpenParam)
     pMac->lim.mgmtFrameSessionId = 0xff;
     pMac->lim.deferredMsgCnt = 0;
 
-    if( !VOS_IS_STATUS_SUCCESS( vos_spin_lock_init( &pMac->lim.lkPeGlobalLock ) ) )
+    if( !VOS_IS_STATUS_SUCCESS( vos_lock_init( &pMac->lim.lkPeGlobalLock ) ) )
     {
         PELOGE(limLog(pMac, LOGE, FL("pe lock init failed!"));)
         return eSIR_FAILURE;
     }
-
-    if (!VOS_IS_STATUS_SUCCESS(
-        vos_spin_lock_init(&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL("deauth/disassoc process lock init failed!"));)
-        return eSIR_FAILURE;
-    }
     pMac->lim.deauthMsgCnt = 0;
     return eSIR_SUCCESS;
 }
@@ -1081,14 +1074,8 @@ tSirRetStatus peClose(tpAniSirGlobal pMac)
     */
     vos_mem_free(pMac->pmm.gPmmTim.pTim);
     pMac->pmm.gPmmTim.pTim = NULL;
-    if( !VOS_IS_STATUS_SUCCESS( vos_spin_lock_destroy( &pMac->lim.lkPeGlobalLock ) ) )
-    {
-        return eSIR_FAILURE;
-    }
-    if (!VOS_IS_STATUS_SUCCESS(
-        vos_spin_lock_destroy(&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
+    if( !VOS_IS_STATUS_SUCCESS( vos_lock_destroy( &pMac->lim.lkPeGlobalLock ) ) )
     {
-        PELOGE(limLog(pMac, LOGE, FL("deauth/disassoc process lock destroy failed!"));)
         return eSIR_FAILURE;
     }
     return eSIR_SUCCESS;
@@ -2384,7 +2371,7 @@ eHalStatus pe_AcquireGlobalLock( tAniSirLim *psPe)
 
     if(psPe)
     {
-        if( VOS_IS_STATUS_SUCCESS( vos_spin_lock_acquire( &psPe->lkPeGlobalLock) ) )
+        if( VOS_IS_STATUS_SUCCESS( vos_lock_acquire( &psPe->lkPeGlobalLock) ) )
         {
             status = eHAL_STATUS_SUCCESS;
         }
@@ -2396,7 +2383,7 @@ eHalStatus pe_ReleaseGlobalLock( tAniSirLim *psPe)
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
     if(psPe)
     {
-        if( VOS_IS_STATUS_SUCCESS( vos_spin_lock_release( &psPe->lkPeGlobalLock) ) )
+        if( VOS_IS_STATUS_SUCCESS( vos_lock_release( &psPe->lkPeGlobalLock) ) )
         {
             status = eHAL_STATUS_SUCCESS;
         }
diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index 381534be6bc2..663490708222 100644
--- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -2086,6 +2086,14 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         limMsg->bodyptr = NULL;
         break;
 
+    case WDA_DISASSOC_TX_COMP:
+        limDisassocTxCompleteCnf(pMac , limMsg->bodyval);
+        break;
+
+    case WDA_DEAUTH_TX_COMP:
+        limDeauthTxCompleteCnf(pMac, limMsg->bodyval);
+        break;
+
     case eWNI_SME_DFS_BEACON_CHAN_SW_IE_REQ:
         limProcessSmeReqMessages(pMac, limMsg);
         vos_mem_free((v_VOID_t*)limMsg->bodyptr);
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index b1281419aab6..04bef5d98ac1 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -2923,21 +2923,7 @@ limProcessMlmDisassocReqNtf(tpAniSirGlobal pMac, eHalStatus suspendStatus, tANI_
                                  psessionEntry, FALSE);
 
              /* Send Disassoc CNF and receive path cleanup */
-             if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-                 (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-             {
-                 PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-                 return;
-             }
              limSendDisassocCnf(pMac);
-             if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-                 (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-             {
-                 PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-                 return;
-             }
         }
         else
         {
@@ -3062,21 +3048,7 @@ void limCleanUpDisassocDeauthReq(tpAniSirGlobal pMac,
 
 void limProcessDisassocAckTimeout(tpAniSirGlobal pMac)
 {
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-        return;
-    }
     limSendDisassocCnf(pMac);
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-        return;
-    }
 }
 
 /**
@@ -3355,21 +3327,7 @@ end:
 
 void limProcessDeauthAckTimeout(tpAniSirGlobal pMac)
 {
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-        return;
-    }
     limSendDeauthCnf(pMac);
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-        return;
-    }
 }
 
 /**
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index b9637a6b31b7..c000ece0653c 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -1386,7 +1386,7 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
     tANI_BOOLEAN         isVHTEnabled = eANI_BOOLEAN_FALSE;
     tANI_U16             addStripoffIELen = 0;
     tDot11fIEExtCap      extractedExtCap;
-    tANI_BOOLEAN         extractedExtCapFlag = eANI_BOOLEAN_TRUE;
+    tANI_BOOLEAN         extractedExtCapFlag = eANI_BOOLEAN_FALSE;
     if(NULL == psessionEntry)
     {
         return;
@@ -1575,13 +1575,16 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
                                       &addIE[0],
                                       &addStripoffIELen,
                                       &extractedExtCap );
-                    addnIELen = addStripoffIELen;
                     if(eSIR_SUCCESS != nSirStatus)
                     {
-                        extractedExtCapFlag = eANI_BOOLEAN_FALSE;
                         limLog(pMac, LOG1,
                             FL("Unable to Stripoff ExtCap IE from Assoc Rsp"));
                     }
+                    else
+                    {
+                        addnIELen = addStripoffIELen;
+                        extractedExtCapFlag = eANI_BOOLEAN_TRUE;
+                    }
                     nBytes = nBytes + addnIELen;
                 }
             }
@@ -3853,46 +3856,12 @@ end:
 
 eHalStatus limDisassocTxCompleteCnf(tpAniSirGlobal pMac, tANI_U32 txCompleteSuccess)
 {
-    eHalStatus status = eHAL_STATUS_FAILURE;
-
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-        return status;
-    }
-    status = limSendDisassocCnf(pMac);
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-        return eHAL_STATUS_FAILURE;
-    }
-    return status;
+    return limSendDisassocCnf(pMac);
 }
 
 eHalStatus limDeauthTxCompleteCnf(tpAniSirGlobal pMac, tANI_U32 txCompleteSuccess)
 {
-    eHalStatus status = eHAL_STATUS_FAILURE;
-
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-        return status;
-    }
-    status = limSendDeauthCnf(pMac);
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-        return eHAL_STATUS_FAILURE;
-    }
-    return status;
+    return limSendDeauthCnf(pMac);
 }
 
 /**
diff --git a/CORE/MAC/src/pe/lim/limTypes.h b/CORE/MAC/src/pe/lim/limTypes.h
index 3a00a8fc5167..8b06fac3d11f 100644
--- a/CORE/MAC/src/pe/lim/limTypes.h
+++ b/CORE/MAC/src/pe/lim/limTypes.h
@@ -1089,6 +1089,10 @@ void limProcessDisassocAckTimeout(tpAniSirGlobal pMac);
 void limProcessDeauthAckTimeout(tpAniSirGlobal pMac);
 eHalStatus limSendDisassocCnf(tpAniSirGlobal pMac);
 eHalStatus limSendDeauthCnf(tpAniSirGlobal pMac);
+eHalStatus limDisassocTxCompleteCnf(tpAniSirGlobal pMac,
+                tANI_U32 txCompleteSuccess);
+eHalStatus limDeauthTxCompleteCnf(tpAniSirGlobal pMac,
+                tANI_U32 txCompleteSuccess);
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
 typedef struct sSetLinkCbackParams
diff --git a/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c b/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c
index bbdcf8d6d463..c9049c31471a 100644
--- a/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c
+++ b/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c
@@ -175,7 +175,7 @@ radar_summary_parse(struct ath_dfs *dfs, const char *buf, size_t len,
    if (len < sizeof(rs)) {
       DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR |
           ATH_DEBUG_DFS_PHYERR_SUM,
-          "%s: len (%d) < expected (%zu)!",
+          "%s: len (%zu) < expected (%zu)!",
           __func__,
           len,
           sizeof(rs));
@@ -223,7 +223,7 @@ radar_fft_search_report_parse(struct ath_dfs *dfs, const char *buf, size_t len,
    if (len < sizeof(rs)) {
       DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR |
           ATH_DEBUG_DFS_PHYERR_SUM,
-          "%s: len (%d) < expected (%zu)!",
+          "%s: len (%zu) < expected (%zu)!",
           __func__,
           len,
           sizeof(rs));
@@ -282,7 +282,7 @@ tlv_parse_frame(struct ath_dfs *dfs, struct rx_radar_status *rs,
       if ((len - i) < sizeof(tlv_hdr)) {
          DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR |
              ATH_DEBUG_DFS_PHYERR_SUM,
-             "%s: ran out of bytes, len=%d, i=%d",
+             "%s: ran out of bytes, len=%zu, i=%d",
              __func__, len, i);
          return (0);
       }
@@ -309,7 +309,7 @@ tlv_parse_frame(struct ath_dfs *dfs, struct rx_radar_status *rs,
        */
       if (MS(tlv_hdr[TLV_REG], TLV_LEN) + i >= len) {
          DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR,
-             "%s: TLV oversize: TLV LEN=%d, available=%d, "
+             "%s: TLV oversize: TLV LEN=%zu, available=%d, "
              "i=%d",
              __func__,
              MS(tlv_hdr[TLV_REG], TLV_LEN),
diff --git a/CORE/SERVICES/HIF/PCIe/if_pci.c b/CORE/SERVICES/HIF/PCIe/if_pci.c
index 9f11d8d3c074..b9be432a0b9f 100644
--- a/CORE/SERVICES/HIF/PCIe/if_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/if_pci.c
@@ -1459,6 +1459,7 @@ hif_pci_remove(struct pci_dev *pdev)
 
     pci_disable_msi(pdev);
     A_FREE(scn);
+    A_FREE(sc->hif_device);
     A_FREE(sc);
     pci_set_drvdata(pdev, NULL);
     pci_iounmap(pdev, mem);
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 3ac974a12531..d835a3df1468 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -835,10 +835,9 @@ static int wma_peer_sta_kickout_event_handler(void *handle, u8 *event, u32 len)
 
 	if (kickout_event->reason == WMI_PEER_STA_KICKOUT_REASON_IBSS_DISCONNECT) {
 		p_inactivity = (tpSirIbssPeerInactivityInd)
-			adf_os_mem_alloc(NULL,
-					 sizeof(tSirIbssPeerInactivityInd));
+			vos_mem_malloc(sizeof(tSirIbssPeerInactivityInd));
 		if (!p_inactivity) {
-			WMA_LOGE("Memory Alloc Failed for tSirIbssPeerInactivity");
+			WMA_LOGE("VOS MEM Alloc Failed for tSirIbssPeerInactivity");
 			return -EINVAL;
 		}
 
@@ -848,10 +847,9 @@ static int wma_peer_sta_kickout_event_handler(void *handle, u8 *event, u32 len)
 	}
 	else {
 		del_sta_ctx =
-			(tpDeleteStaContext)adf_os_mem_alloc(NULL,
-					sizeof(tDeleteStaContext));
+			(tpDeleteStaContext)vos_mem_malloc(sizeof(tDeleteStaContext));
 		if (!del_sta_ctx) {
-			WMA_LOGE("Memory Alloc Failed for tDeleteStaContext");
+			WMA_LOGE("VOS MEM Alloc Failed for tDeleteStaContext");
 			return -EINVAL;
 		}
 
@@ -15289,6 +15287,7 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
                 case WDA_UPDATE_OP_MODE:
                         wma_process_update_opmode(wma_handle,
                                        (tUpdateVHTOpMode *)msg->bodyptr);
+                        vos_mem_free(msg->bodyptr);
                         break;
 #ifdef WLAN_FEATURE_11AC
                 case WDA_UPDATE_MEMBERSHIP:
@@ -15602,6 +15601,29 @@ static void wma_mgmt_tx_ack_work_handler(struct work_struct *ack_work)
 	wma_handle->ack_work_ctx = NULL;
 }
 
+/* function   : wma_mgmt_tx_comp_conf_ind
+ * Descriptin : Post mgmt tx complete indication to PE.
+ * Args       :
+                wma_handle  : Pointer to WMA handle
+ *              sub_type    : Tx mgmt frame sub type
+ *              status      : Mgmt frame tx status
+ * Returns    :
+ */
+static void
+wma_mgmt_tx_comp_conf_ind(tp_wma_handle wma_handle, u_int8_t sub_type,
+							int32_t status)
+{
+	int32_t tx_comp_status;
+
+	tx_comp_status = status ? 0 : 1;
+	if(sub_type == SIR_MAC_MGMT_DISASSOC) {
+		wma_send_msg(wma_handle, WDA_DISASSOC_TX_COMP, NULL, tx_comp_status);
+	}
+	else if(sub_type == SIR_MAC_MGMT_DEAUTH) {
+		wma_send_msg(wma_handle, WDA_DEAUTH_TX_COMP, NULL, tx_comp_status);
+	}
+}
+
 /**
   * wma_mgmt_tx_ack_comp_hdlr - handles tx ack mgmt completion
   * @context: context with which the handler is registered
@@ -15620,20 +15642,27 @@ wma_mgmt_tx_ack_comp_hdlr(void *wma_context,
 	tp_wma_handle wma_handle = (tp_wma_handle)wma_context;
 
 	if(wma_handle && wma_handle->umac_ota_ack_cb[pFc->subType]) {
-		struct wma_tx_ack_work_ctx *ack_work;
+		if((pFc->subType == SIR_MAC_MGMT_DISASSOC) ||
+			(pFc->subType == SIR_MAC_MGMT_DEAUTH)) {
+			wma_mgmt_tx_comp_conf_ind(wma_handle, (u_int8_t)pFc->subType,
+										status);
+		}
+		else {
+			struct wma_tx_ack_work_ctx *ack_work;
 
-		ack_work =
-		adf_os_mem_alloc(NULL, sizeof(struct wma_tx_ack_work_ctx));
+			ack_work =
+			adf_os_mem_alloc(NULL, sizeof(struct wma_tx_ack_work_ctx));
 
-		if(ack_work) {
-			INIT_WORK(&ack_work->ack_cmp_work,
-					wma_mgmt_tx_ack_work_handler);
-			ack_work->wma_handle = wma_handle;
-			ack_work->sub_type = pFc->subType;
-			ack_work->status = status;
+			if(ack_work) {
+				INIT_WORK(&ack_work->ack_cmp_work,
+						wma_mgmt_tx_ack_work_handler);
+				ack_work->wma_handle = wma_handle;
+				ack_work->sub_type = pFc->subType;
+				ack_work->status = status;
 
-			/* Schedue the Work */
-			schedule_work(&ack_work->ack_cmp_work);
+				/* Schedue the Work */
+				schedule_work(&ack_work->ack_cmp_work);
+			}
 		}
 	}
 }
@@ -15884,8 +15913,10 @@ static int wma_nlo_scan_cmp_evt_handler(void *handle, u_int8_t *event,
 		/* Posting scan completion msg would take scan cache result
 		 * from LIM module and update in scan cache maintained in SME.*/
 		WMA_LOGD("Posting Scan completion to umac");
+		vos_mem_zero(scan_event, sizeof(tSirScanOffloadEvent));
 		scan_event->reasonCode = eSIR_SME_SUCCESS;
 		scan_event->event = SCAN_EVENT_COMPLETED;
+		scan_event->sessionId = nlo_event->vdev_id;
 		wma_send_msg(wma, WDA_RX_SCAN_EVENT,
 			     (void *) scan_event, 0);
 	} else {
@@ -16785,6 +16816,15 @@ VOS_STATUS wma_wmi_service_close(v_VOID_t *vos_ctx)
 }
 
 
+/*
+ * Detach DFS methods
+ */
+static void wma_dfs_detach(struct ieee80211com *dfs_ic)
+{
+	dfs_detach(dfs_ic);
+	OS_FREE(dfs_ic);
+}
+
 /* function   : wma_close
  * Descriptin :
  * Args       :
@@ -16858,6 +16898,11 @@ VOS_STATUS wma_close(v_VOID_t *vos_ctx)
 		wma_utf_detach(wma_handle);
 #endif
 
+	if (NULL != wma_handle->dfs_ic){
+		wma_dfs_detach(wma_handle->dfs_ic);
+		wma_handle->dfs_ic = NULL;
+	}
+
 	WMA_LOGD("%s: Exit", __func__);
 	return VOS_STATUS_SUCCESS;
 }
@@ -19176,9 +19221,7 @@ wma_dfs_indicate_radar(struct ieee80211com *ic,
         return (0);
     }
     radar_event = (struct wma_dfs_radar_indication *)
-                   OS_MALLOC(NULL,
-                             sizeof(struct wma_dfs_radar_indication),
-                             GFP_ATOMIC);
+                   vos_mem_malloc(sizeof(struct wma_dfs_radar_indication));
     if (radar_event == NULL)
     {
         WMA_LOGE("%s:DFS- Invalid radar_event",__func__);
@@ -19285,7 +19328,7 @@ void ol_rx_err(ol_pdev_handle pdev, u_int8_t vdev_id,
 	if (adf_nbuf_len(rx_frame) < sizeof(*eth_hdr))
 		return;
 	eth_hdr = (struct ether_header *) adf_nbuf_data(rx_frame);
-	mic_err_ind = adf_os_mem_alloc(NULL, sizeof(*mic_err_ind));
+	mic_err_ind = vos_mem_malloc(sizeof(*mic_err_ind));
 	if (!mic_err_ind) {
 		WMA_LOGE("%s: Failed to allocate memory for MIC indication message", __func__);
 		return;
diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index d2784584de32..e15b1e3c34fe 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -959,7 +959,7 @@ typedef struct tagCsrRoamSession
     //ht config
     tSirHTConfig        htConfig;
 #ifdef FEATURE_WLAN_SCAN_PNO
-    eCsrRoamState lastRoamStateBeforePno;
+    tANI_BOOLEAN pnoStarted;
 #endif
 } tCsrRoamSession;
 
@@ -1396,7 +1396,6 @@ void csrSetOppositeBandChannelInfo( tpAniSirGlobal pMac );
 void csrConstructCurrentValidChannelList( tpAniSirGlobal pMac, tDblLinkList *pChannelSetList,
                                             tANI_U8 *pChannelList, tANI_U8 bSize, tANI_U8 *pNumChannels );
 #ifdef FEATURE_WLAN_SCAN_PNO
-void csrMoveToScanStateForPno( tpAniSirGlobal pMac, tANI_U8 sessionId );
 eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
             tSirPrefNetworkFoundInd *pPrefNetworkFoundInd);
 #endif
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index f88d31766636..d7293f526292 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -3417,9 +3417,6 @@ ePhyChanBondState sme_GetCBPhyStateFromCBIniValue(tANI_U32 cb_ini_value);
 int sme_UpdateHTConfig(tHalHandle hHal, tANI_U8 sessionId, tANI_U16 htCapab,
                          int value);
 tANI_S16 sme_GetHTConfig(tHalHandle hHal, tANI_U8 session_id, tANI_U16 ht_capab);
-#ifdef FEATURE_WLAN_SCAN_PNO
-eHalStatus sme_MoveCsrToScanStateForPno (tHalHandle hHal, tANI_U8 sessionId);
-#endif
 #ifdef QCA_WIFI_2_0
 eHalStatus sme_getChannelInfo(tHalHandle hHal, tANI_U8 chanId,
                               tSmeChannelInfo *chanInfo);
diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index c8405294d123..b5702aa2cefa 100644
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -5077,14 +5077,6 @@ eHalStatus csrSavePnoScanResults(tpAniSirGlobal pMac, tSirSmeScanRsp *pScanRsp)
                               cbBssDesc );
     }
 
-    if ( eSIR_SME_SUCCESS == pScanRsp->statusCode )
-    {
-           // PNO is completed, rollback csr to old state
-           csrRoamStateChange(pMac,
-                       pMac->roam.roamSession[pScanRsp->sessionId].lastRoamStateBeforePno,
-                       pScanRsp->sessionId);
-    }
-
     return eHAL_STATUS_SUCCESS;
 }
 #endif
@@ -7995,21 +7987,6 @@ tANI_BOOLEAN csrRoamIsValidChannel( tpAniSirGlobal pMac, tANI_U8 channel )
 }
 
 #ifdef FEATURE_WLAN_SCAN_PNO
-void csrMoveToScanStateForPno( tpAniSirGlobal pMac, tANI_U8 sessionId )
-{
-    tCsrRoamSession *pSession = &pMac->roam.roamSession[sessionId];
-
-    smsLog( pMac, LOG3, "Moving CSR to Scanning state for PNO");
-
-    // Take a back up of previous CSR state before moving to scanning state.
-    // CSR will be moved to previous state from scanning state after PNO
-    // completion.
-    pSession->lastRoamStateBeforePno =
-               csrRoamStateChange(pMac, eCSR_ROAMING_STATE_SCANNING, sessionId);
-}
-#endif
-
-#ifdef FEATURE_WLAN_SCAN_PNO
 eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
             tSirPrefNetworkFoundInd *pPrefNetworkFoundInd)
 {
diff --git a/CORE/SME/src/csr/csrCmdProcess.c b/CORE/SME/src/csr/csrCmdProcess.c
index 49fc5b5a00d0..0c412068760f 100644
--- a/CORE/SME/src/csr/csrCmdProcess.c
+++ b/CORE/SME/src/csr/csrCmdProcess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -48,12 +48,44 @@ eHalStatus csrMsgProcessor( tpAniSirGlobal pMac,  void *pMsgBuf )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSirSmeRsp *pSmeRsp = (tSirSmeRsp *)pMsgBuf;
+#ifdef FEATURE_WLAN_SCAN_PNO
+    tSirMbMsg *pMsg = (tSirMbMsg *)pMsgBuf;
+    tCsrRoamSession *pSession;
+#endif
 
     smsLog( pMac, LOG2, "  Message %d[0x%04X] received in curState %d and substate %d",
                 pSmeRsp->messageType, pSmeRsp->messageType,
                 pMac->roam.curState[pSmeRsp->sessionId],
                 pMac->roam.curSubState[pSmeRsp->sessionId] );
 
+#ifdef FEATURE_WLAN_SCAN_PNO
+    /*
+     * PNO scan responses have to be handled irrespective of CSR roam state.
+     * Check if PNO has been started and only then process the PNO scan results.
+     * Also note that normal scan is not allowed when PNO scan is in progress
+     * and so the scan responses reaching here when PNO is started must be
+     * PNO responses. For normal scan, the PNO started flag will be FALSE and
+     * it will be processed as usual based on the current CSR roam state.
+     */
+    pSession = CSR_GET_SESSION(pMac, pSmeRsp->sessionId);
+    if(!pSession)
+    {
+        smsLog(pMac, LOGE, FL(" session %d not found"), pSmeRsp->sessionId);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    if((eWNI_SME_SCAN_RSP == pMsg->type) && (TRUE == pSession->pnoStarted))
+    {
+        status = csrScanningStateMsgProcessor(pMac, pMsgBuf);
+        if (eHAL_STATUS_SUCCESS != status)
+        {
+            smsLog(pMac, LOGE, FL(" handling PNO scan resp msg 0x%X CSR state is %d"),
+                   pSmeRsp->messageType, pMac->roam.curState[pSmeRsp->sessionId]);
+        }
+        return (status);
+    }
+#endif
+
     // Process the message based on the state of the roaming states...
 
 #if defined( ANI_RTT_DEBUG )
diff --git a/CORE/SME/src/pmc/pmcApi.c b/CORE/SME/src/pmc/pmcApi.c
index b9cb962bd6e2..5139d232915b 100644
--- a/CORE/SME/src/pmc/pmcApi.c
+++ b/CORE/SME/src/pmc/pmcApi.c
@@ -3013,7 +3013,11 @@ eHalStatus pmcSetPreferredNetworkList
     {
        if (pRequestBuf->enable)
        {
-           sme_MoveCsrToScanStateForPno(hHal, sessionId);
+           pSession->pnoStarted = TRUE;
+       }
+       else
+       {
+           pSession->pnoStarted = FALSE;
        }
 
        pRequestBuf->sessionId = sessionId;
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 58f2168a6c9a..fbc1db7e58bc 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -11323,34 +11323,6 @@ int sme_UpdateHTConfig(tHalHandle hHal, tANI_U8 sessionId, tANI_U16 htCapab,
    return 0;
 }
 
-#ifdef FEATURE_WLAN_SCAN_PNO
-/*--------------------------------------------------------------------------
-
-  \brief sme_MoveCsrToScanStateForPno() - Request CSR module to be in Scan state
-                                          for PNO operation.
-
-  \param hHal - The handle returned by macOpen.
-  \param sessionId - A previous opened session's ID.
-
-  \return eHAL_STATUS_SUCCESS - CSR moved to Scan state.
-          eHAL_STATUS_INVALID_PARAMETER - Failed to acquire sme lock
-  --------------------------------------------------------------------------*/
-eHalStatus sme_MoveCsrToScanStateForPno (tHalHandle hHal, tANI_U8 sessionId)
-{
-    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-    eHalStatus status;
-
-    status = sme_AcquireGlobalLock( &pMac->sme );
-    if ( HAL_STATUS_SUCCESS( status ) )
-    {
-        csrMoveToScanStateForPno( pMac, sessionId );
-        sme_ReleaseGlobalLock( &pMac->sme );
-    }
-
-    return status;
-}
-#endif
-
 #define HT20_SHORT_GI_MCS7_RATE 722
 /* ---------------------------------------------------------------------------
     \fn sme_SendRateUpdateInd
diff --git a/CORE/VOSS/src/vos_nvitem.c b/CORE/VOSS/src/vos_nvitem.c
index 04c6f189b4a0..2c1a02e0bae8 100644
--- a/CORE/VOSS/src/vos_nvitem.c
+++ b/CORE/VOSS/src/vos_nvitem.c
@@ -821,7 +821,13 @@ bool is_world_regd(u_int32_t regd)
 static const struct ieee80211_regdomain *vos_default_world_regdomain(void)
 {
    /* this is the most restrictive */
-   return &vos_world_regdom_64;
+    return &vos_world_regdom_64;
+}
+
+static const struct ieee80211_regdomain *vos_custom_world_regdomain(void)
+{
+   /* this is the most restrictive */
+    return &vos_world_regdom_60_61_62;
 }
 
 static const
@@ -1028,17 +1034,24 @@ static void vos_reg_apply_world_flags(struct wiphy *wiphy,
    }
 }
 
-static int regd_init_wiphy(struct regulatory *reg,
+static int regd_init_wiphy(hdd_context_t *pHddCtx, struct regulatory *reg,
       struct wiphy *wiphy)
 {
    const struct ieee80211_regdomain *regd;
 
-   if (is_world_regd(reg->reg_domain)) {
-      regd = vos_world_regdomain(reg);
-      wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
-   } else {
-      regd = vos_default_world_regdomain();
-      wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
+   if  (pHddCtx->cfg_ini->fRegChangeDefCountry) {
+       regd = vos_custom_world_regdomain();
+       wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+   }
+   else if (is_world_regd(reg->reg_domain))
+   {
+       regd = vos_world_regdomain(reg);
+       wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+   }
+   else
+   {
+       regd = vos_default_world_regdomain();
+       wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
    }
    wiphy_apply_custom_regulatory(wiphy, regd);
    vos_reg_apply_radar_flags(wiphy);
@@ -1046,7 +1059,7 @@ static int regd_init_wiphy(struct regulatory *reg,
    return 0;
 }
 
-static int reg_init_from_eeprom(struct regulatory *reg,
+static int reg_init_from_eeprom(hdd_context_t *pHddCtx, struct regulatory *reg,
       struct wiphy *wiphy)
 {
    int ret_val = 0;
@@ -1062,7 +1075,7 @@ static int reg_init_from_eeprom(struct regulatory *reg,
    pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[1] =
       reg->alpha2[1];
 
-   regd_init_wiphy(reg, wiphy);
+   regd_init_wiphy(pHddCtx, reg, wiphy);
 
    return ret_val;
 }
@@ -3482,7 +3495,7 @@ VOS_STATUS vos_init_wiphy_from_eeprom(void)
 
    wiphy = pHddCtx->wiphy;
 
-   if (reg_init_from_eeprom(&pHddCtx->reg, wiphy))
+   if (reg_init_from_eeprom(pHddCtx, &pHddCtx->reg, wiphy))
    {
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
             ("Error during regulatory init from EEPROM"));
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index 0afa9f604495..6aa98677253e 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -1331,6 +1331,8 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
  */
 #define WDA_DFS_BEACON_TX_SUCCESS_IND   SIR_HAL_BEACON_TX_SUCCESS_IND
 #define WDA_FW_STATS_IND           SIR_HAL_FW_STATS_IND
+#define WDA_DISASSOC_TX_COMP       SIR_HAL_DISASSOC_TX_COMP
+#define WDA_DEAUTH_TX_COMP         SIR_HAL_DEAUTH_TX_COMP
 
 #define WDA_MODEM_POWER_STATE_IND SIR_HAL_MODEM_POWER_STATE_IND