Merge "Release 1.0.0.214 QCACLD WLAN Driver"

34 files changed, 253 insertions, 324 deletions

diff --git a/CORE/CLD_TXRX/TXRX/ol_cfg.c b/CORE/CLD_TXRX/TXRX/ol_cfg.c
index 32dff6f7ed22..7c1545381335 100644
--- a/CORE/CLD_TXRX/TXRX/ol_cfg.c
+++ b/CORE/CLD_TXRX/TXRX/ol_cfg.c
@@ -181,6 +181,11 @@ int ol_cfg_tx_free_at_download(ol_pdev_handle pdev)
 	return cfg->tx_free_at_download;
 }
 
+void ol_cfg_set_tx_free_at_download(ol_pdev_handle pdev)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+	cfg->tx_free_at_download = 1;
+}
 u_int16_t ol_cfg_target_tx_credit(ol_pdev_handle pdev)
 {
 	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index eb57e62248f2..d2667e696b98 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -1055,7 +1055,8 @@ int is_driver_dfs_capable(struct wiphy *wiphy, struct wireless_dev *wdev,
     struct sk_buff *temp_skbuff;
     int ret_val;
 
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(3,4,0))
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3,4,0)) || \
+    defined (DFS_MASTER_OFFLOAD_IND_SUPPORT)
     dfs_capability = !!(wiphy->flags & WIPHY_FLAG_DFS_OFFLOAD);
 #endif
 
@@ -4415,7 +4416,8 @@ int wlan_hdd_cfg80211_init(struct device *dev,
     wiphy->vendor_events = wlan_hdd_cfg80211_vendor_events;
     wiphy->n_vendor_events = ARRAY_SIZE(wlan_hdd_cfg80211_vendor_events);
 
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(3,4,0))
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3,4,0)) || \
+    defined (DFS_MASTER_OFFLOAD_IND_SUPPORT)
     if (pCfg->enableDFSMasterCap) {
         wiphy->flags |= WIPHY_FLAG_DFS_OFFLOAD;
     }
diff --git a/CORE/HDD/src/wlan_hdd_ipa.c b/CORE/HDD/src/wlan_hdd_ipa.c
index b2544b82ef5e..d33aaf2fb3f1 100644
--- a/CORE/HDD/src/wlan_hdd_ipa.c
+++ b/CORE/HDD/src/wlan_hdd_ipa.c
@@ -61,6 +61,9 @@ Include Files
 #ifdef IPA_UC_OFFLOAD
 #define HDD_IPA_UC_WLAN_HDR_DES_MAC_OFFSET 12
 #define HDD_IPA_UC_WLAN_8023_HDR_SIZE      14
+/* WDI TX and RX PIPE */
+#define HDD_IPA_UC_NUM_WDI_PIPE            2
+#define HDD_IPA_UC_MAX_PENDING_EVENT       33
 #endif /* IPA_UC_OFFLOAD */
 
 #ifdef IPA_UC_OFFLOAD
@@ -324,6 +327,14 @@ struct ipa_uc_fw_stats {
 	uint32_t rx_reserved;
 };
 
+struct ipa_uc_pending_event {
+	vos_list_node_t node;
+	hdd_adapter_t *adapter;
+	enum ipa_wlan_event type;
+	uint8_t sta_id;
+	uint8_t mac_addr[VOS_MAC_ADDR_SIZE];
+};
+
 static const char *op_string[] = {
 	"TX_SUSPEND",
 	"TX_RESUME",
@@ -383,6 +394,8 @@ struct hdd_ipa_priv {
 	v_BOOL_t resource_unloading;
 	v_BOOL_t pending_cons_req;
 	struct ipa_uc_stas_map  assoc_stas_map[WLAN_MAX_STA_COUNT];
+	vos_list_t pending_event;
+	vos_lock_t event_lock;
 #endif /* IPA_UC_OFFLOAD */
 };
 
@@ -707,18 +720,18 @@ static int hdd_ipa_uc_handle_first_con(struct hdd_ipa_priv *hdd_ipa)
 		if (hdd_ipa_uc_enable_pipes(hdd_ipa)) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
 				"%s: IPA WDI Pipes activate fail", __func__);
+			hdd_ipa->resource_loading = VOS_FALSE;
 			return -EBUSY;
 		}
-		hdd_ipa->resource_loading = VOS_FALSE;
 	} else {
 		/* RM Disabled
 		 * Just enabled all the PIPEs */
 		if (hdd_ipa_uc_enable_pipes(hdd_ipa)) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
 				"%s: IPA WDI Pipes activate fail", __func__);
+			hdd_ipa->resource_loading = VOS_FALSE;
 			return -EBUSY;
 		}
-		hdd_ipa->resource_loading = VOS_FALSE;
 	}
 	return 0;
 }
@@ -755,7 +768,6 @@ void hdd_ipa_uc_rm_notify_handler(void *context,
 	case IPA_RM_RESOURCE_GRANTED:
 		/* Differed RM Granted */
 		hdd_ipa_uc_enable_pipes(hdd_ipa);
-		hdd_ipa->resource_loading = VOS_FALSE;
 		if (hdd_ipa->pending_cons_req) {
 			ipa_rm_notify_completion(IPA_RM_RESOURCE_GRANTED,
 				IPA_RM_RESOURCE_WLAN_CONS);
@@ -808,6 +820,35 @@ void hdd_ipa_uc_rm_notify_defer(void *hdd_ipa, enum ipa_rm_event event)
 	vos_indicate_rxpkt(sched_ctx, pkt);
 }
 
+static int hdd_ipa_uc_proc_pending_event(struct hdd_ipa_priv *hdd_ipa)
+{
+	v_SIZE_t pending_event_count;
+	struct ipa_uc_pending_event *pending_event = NULL;
+
+	vos_list_size(&hdd_ipa->pending_event, &pending_event_count);
+	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
+		"%s, Pending Event Count %d", __func__, pending_event_count);
+	if (!pending_event_count) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
+			"%s, No Pending Event", __func__);
+		return 0;
+	}
+
+	vos_list_remove_front(&hdd_ipa->pending_event,
+			(vos_list_node_t **)&pending_event);
+	while (pending_event != NULL) {
+		hdd_ipa_wlan_evt(pending_event->adapter,
+			pending_event->type,
+			pending_event->sta_id,
+			pending_event->mac_addr);
+		vos_mem_free(pending_event);
+		pending_event = NULL;
+		vos_list_remove_front(&hdd_ipa->pending_event,
+			(vos_list_node_t **)&pending_event);
+	}
+	return 0;
+}
+
 static void hdd_ipa_uc_op_cb(v_U8_t *op_msg, void *usr_ctxt)
 {
 	struct op_msg_type *msg;
@@ -836,23 +877,33 @@ static void hdd_ipa_uc_op_cb(v_U8_t *op_msg, void *usr_ctxt)
 
 	if ((HDD_IPA_UC_OPCODE_TX_RESUME == msg->op_code) ||
 		(HDD_IPA_UC_OPCODE_RX_RESUME == msg->op_code)) {
-		ghdd_ipa->activated_fw_pipe++;
+		vos_lock_acquire(&hdd_ipa->event_lock);
+		hdd_ipa->activated_fw_pipe++;
+		if (HDD_IPA_UC_NUM_WDI_PIPE == hdd_ipa->activated_fw_pipe) {
+			hdd_ipa->resource_loading = VOS_FALSE;
+			hdd_ipa_uc_proc_pending_event(hdd_ipa);
+		}
+		vos_lock_release(&hdd_ipa->event_lock);
 	}
 
 	if ((HDD_IPA_UC_OPCODE_TX_SUSPEND == msg->op_code) ||
 		(HDD_IPA_UC_OPCODE_RX_SUSPEND == msg->op_code)) {
-		ghdd_ipa->activated_fw_pipe--;
-		if (!ghdd_ipa->activated_fw_pipe) {
-			hdd_ipa_uc_disable_pipes(ghdd_ipa);
-			if ((hdd_ipa_is_rm_enabled(ghdd_ipa)) &&
+		vos_lock_acquire(&hdd_ipa->event_lock);
+		hdd_ipa->activated_fw_pipe--;
+		if (!hdd_ipa->activated_fw_pipe) {
+			hdd_ipa_uc_disable_pipes(hdd_ipa);
+			if ((hdd_ipa_is_rm_enabled(hdd_ipa)) &&
 			(!ipa_rm_release_resource(IPA_RM_RESOURCE_WLAN_PROD))) {
 				/* Sync return success from IPA
 				 * Enable/resume all the PIPEs */
-				ghdd_ipa->resource_unloading = VOS_FALSE;
+				hdd_ipa->resource_unloading = VOS_FALSE;
+				hdd_ipa_uc_proc_pending_event(hdd_ipa);
 			} else {
-				ghdd_ipa->resource_unloading = VOS_FALSE;
+				hdd_ipa->resource_unloading = VOS_FALSE;
+				hdd_ipa_uc_proc_pending_event(hdd_ipa);
 			}
 		}
+		vos_lock_release(&hdd_ipa->event_lock);
 	}
 
 	if (HDD_IPA_UC_OPCODE_STATS == msg->op_code) {
@@ -1053,6 +1104,9 @@ static VOS_STATUS hdd_ipa_uc_ol_init(hdd_context_t *hdd_ctx)
 	vos_mem_zero(&pipe_in, sizeof(struct ipa_wdi_in_params));
 	vos_mem_zero(&pipe_out, sizeof(struct ipa_wdi_out_params));
 
+	vos_list_init(&ipa_ctxt->pending_event);
+	vos_lock_init(&ipa_ctxt->event_lock);
+
 	/* TX PIPE */
 	pipe_in.sys.ipa_ep_cfg.nat.nat_en = IPA_BYPASS_NAT;
 	pipe_in.sys.ipa_ep_cfg.hdr.hdr_len = HDD_IPA_UC_WLAN_TX_HDR_LEN;
@@ -2659,6 +2713,32 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 		(WLAN_HDD_SOFTAP != adapter->device_mode)) {
 		return 0;
 	}
+	/* During IPA UC resource loading/unloading
+	 * new event issued.
+	 * Store event seperatly and handle later */
+	if (hdd_ipa_uc_is_enabled(hdd_ipa) &&
+		((hdd_ipa->resource_loading) ||
+		(hdd_ipa->resource_unloading))) {
+		struct ipa_uc_pending_event *pending_evet = NULL;
+
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"%s, RL/RUL inprogress", __func__);
+		pending_evet = (struct ipa_uc_pending_event *)vos_mem_malloc(
+			sizeof(struct ipa_uc_pending_event));
+		if (!pending_evet) {
+			HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+				"Pending event memory alloc fail");
+			return -ENOMEM;
+		}
+		pending_evet->adapter = adapter;
+		pending_evet->sta_id = sta_id;
+		pending_evet->type = type;
+		vos_mem_copy(pending_evet->mac_addr,
+			mac_addr,
+			VOS_MAC_ADDR_SIZE);
+		vos_list_insert_back(&hdd_ipa->pending_event,
+				&pending_evet->node);
+	}
 #endif /* IPA_UC_OFFLOAD */
 
 	hdd_ipa->stats.event[type]++;
@@ -2722,12 +2802,14 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 				"%s: Evt: %d, IPA UC OFFLOAD NOT ENABLED",
 				msg_ex->name, meta.msg_type);
 		} else {
+			vos_lock_acquire(&hdd_ipa->event_lock);
 			if (hdd_ipa_uc_find_add_assoc_sta(hdd_ipa,
 					VOS_TRUE,
 					sta_id)) {
 				HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
 					"%s: STA ID %d found, not valid",
 					msg_ex->name, sta_id);
+				vos_lock_release(&hdd_ipa->event_lock);
 				return 0;
 			}
 			hdd_ipa->sap_num_connected_sta++;
@@ -2741,6 +2823,7 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 						msg_ex->name, ret);
 				}
 			}
+			vos_lock_release(&hdd_ipa->event_lock);
 		}
 #endif /* IPA_UC_OFFLOAD */
 		return ret;
@@ -2754,12 +2837,14 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 			return 0;
 		}
 
+		vos_lock_acquire(&hdd_ipa->event_lock);
 		if (!hdd_ipa_uc_find_add_assoc_sta(hdd_ipa,
 					VOS_FALSE,
 					sta_id)) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
 				"%s: STA ID %d NOT found, not valid",
 				msg_ex->name, sta_id);
+			vos_lock_release(&hdd_ipa->event_lock);
 			return 0;
 		}
 		hdd_ipa->sap_num_connected_sta--;
@@ -2767,6 +2852,7 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 		if (!hdd_ipa->sap_num_connected_sta) {
 			hdd_ipa_uc_handle_last_discon(hdd_ipa);
 		}
+		vos_lock_release(&hdd_ipa->event_lock);
 #endif /* IPA_UC_OFFLOAD */
 		break;
 
@@ -3264,6 +3350,8 @@ VOS_STATUS hdd_ipa_cleanup(hdd_context_t *hdd_ctx)
 		HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
 			"%s: Disconnect RX PIPE", __func__);
 		ipa_disconnect_wdi_pipe(hdd_ipa->rx_pipe_handle);
+		vos_lock_destroy(&hdd_ipa->event_lock);
+		vos_list_destroy(&hdd_ipa->pending_event);
 	} else
 #endif /* IPA_UC_OFFLOAD */
 	{
diff --git a/CORE/MAC/inc/aniCompiler.h b/CORE/MAC/inc/aniCompiler.h
deleted file mode 100644
index 81934142fac4..000000000000
--- a/CORE/MAC/inc/aniCompiler.h
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Copyright (c) 2011-2012 The Linux Foundation. All rights reserved.
- *
- * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
- *
- *
- * Permission to use, copy, modify, and/or distribute this software for
- * any purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
- * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
- * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
- * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
- * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
- * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * This file was originally distributed by Qualcomm Atheros, Inc.
- * under proprietary terms before Copyright ownership was assigned
- * to the Linux Foundation.
- */
-
-/*
- * Compiler abstraction layer
- *
- *
- *
- * This file tries to abstract the differences among compilers.
- * Supported compilers are :
- *
- * - GNU C/C++ compiler
- * - Microsoft C/C++ compiler
- * - Intel C/C++ compiler
- *
- * Written by Ho Lee
- */
-
-#ifndef __ANI_COMPILER_ABSTRACT_H
-#define __ANI_COMPILER_ABSTRACT_H
-
-/*
- * 1. GNU C/C++ Compiler
- *
- * How to detect gcc : __GNUC__
- * How to detect gcc version :
- *   major version : __GNUC__ (2 = 2.x, 3 = 3.x, 4 = 4.x)
- *   minor version : __GNUC_MINOR__
- *
- * 2. Microsoft C/C++ Compiler
- *
- * How to detect msc : _MSC_VER
- * How to detect msc version :
- *   _MSC_VER (1200 = MSVC 6.0, 1300 = MSVC 7.0, ...)
- *
- * 3. Intel C/C++ Compiler
- *
- * How to detect icc : __INTEL_COMPILER, __ICC (legacy), __ECC (legacy)
- * How to detect icc version :
- *   __INTEL_COMPILER, __ICC, __ECC (700 = 7.0, 900 = 9.0, ...)
- *
- * 4. Other compilers (not supported)
- *
- * Borland : __BORLANDC__
- * Greenhills : __ghs
- * Metrowerks : __MWERKS__
- * SGI MIPSpro : __sgi
- */
-
-/*
- * Packing directives : These are used to force compiler to pack bits and
- * bytes in the data structure. C standard does not regulate this strictly,
- * and many things are to compiler implementation. Many compilers support
- * compiler specific directives or options that allow different packing
- * and alignment.
- *
- * Alignment directives : Compiler may think packed data structures have
- * no specific alignment requirement. Then compiler may generate multiple
- * byte accesses to access two byte or four bytes data structures. This
- * affects on performance especially for RISC systems. If some data
- * structure is located on specific alignment always, alignment directives
- * help compiler generate more efficient codes.
- */
-
-#undef __ANI_COMPILER_PRAGMA_PACK_STACK
-#undef __ANI_COMPILER_PRAGMA_PACK
-
-#if defined(_MSC_VER)
-#define __ANI_COMPILER_PRAGMA_PACK_STACK        1
-#define __ANI_COMPILER_PRAGMA_PACK              1
-#define __ani_attr_pre_packed
-#define __ani_attr_packed
-#define __ani_attr_aligned_2
-#define __ani_attr_aligned_4
-#define __ani_attr_aligned_8
-#define __ani_attr_aligned_16
-#define __ani_attr_aligned_32
-#elif defined(__INTEL_COMPILER) || defined(__ICC) || defined(__ECC)
-#define __ANI_COMPILER_PRAGMA_PACK              1
-#define __ani_attr_pre_packed
-#define __ani_attr_packed
-#define __ani_attr_aligned_2
-#define __ani_attr_aligned_4
-#define __ani_attr_aligned_8
-#define __ani_attr_aligned_16
-#define __ani_attr_aligned_32
-#elif defined(__GNUC__)
-#define __ani_attr_pre_packed
-#define __ani_attr_packed                       __packed
-#define __ani_attr_aligned_2                    __attribute__((aligned(2)))
-#define __ani_attr_aligned_4                    __attribute__((aligned(4)))
-#define __ani_attr_aligned_8                    __attribute__((aligned(8)))
-#define __ani_attr_aligned_16                   __attribute__((aligned(16)))
-#define __ani_attr_aligned_32                   __attribute__((aligned(32)))
-#elif defined(ANI_COMPILER_TYPE_RVCT)
-/* Nothing defined so far */
-#define __ani_attr_packed
-#define __ani_attr_pre_packed                   __packed
-#define __ani_attr_aligned_2                    __align(2)
-#define __ani_attr_aligned_4                    __align(4)
-#define __ani_attr_aligned_8                    __align(8)
-#define __ani_attr_aligned_16                   __align(16)
-#define __ani_attr_aligned_32                   __align(32)
-#else
-#error "Unknown compiler"
-#endif
-
-#if defined(ANI_DATAPATH_SECTION)
-#define  __DP_SRC_RX                __attribute__((section(".dpsrcrx")))
-#define  __DP_SRC_TX                __attribute__((section(".dpsrctx")))
-#define  __DP_SRC                   __attribute__((section(".dpsrc")))
-#define  __ANIHDD_MODULE            __attribute__((section(".anihdd")))
-#else
-#define  __DP_SRC_RX
-#define  __DP_SRC_TX
-#define  __DP_SRC
-#define  __ANIHDD_MODULE
-#endif
-
-#endif
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 75547981d24a..6043cb7506b7 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            213
+#define QWLAN_VERSION_BUILD            214
 
-#define QWLAN_VERSIONSTR               "1.0.0.213"
+#define QWLAN_VERSIONSTR               "1.0.0.214"
 
 
 #define AR6320_REV1_VERSION             0x5000000
diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index 0bca93e7eaa2..6b4c3806d098 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -685,7 +685,7 @@ typedef struct sSirBssDescription
     tANI_U16             beaconInterval;
     tANI_U16             capabilityInfo;
     tSirNwType           nwType; // Indicates 11a/b/g
-    tANI_U8              aniIndicator;
+    tANI_U8              reservedPadding0;
     tANI_S8              rssi;
     tANI_S8              sinr;
     //channelId what peer sent in beacon/probersp.
@@ -4779,6 +4779,11 @@ typedef struct sSirSmeHOFailureInd
 {
     tANI_U8  sessionId;
 } tSirSmeHOFailureInd, *tpSirSmeHOFailureInd;
+
+typedef struct sSirRoamOffloadSynchFail
+{
+    tANI_U8 sessionId;
+} tSirRoamOffloadSynchFail, *tpSirRoamOffloadSynchFail;
 #endif
 
 #ifdef FEATURE_WLAN_EXTSCAN
@@ -5541,4 +5546,7 @@ typedef struct
 #define RTT_TIMING_MEAS_CAPABILITY      0x01
 #define RTT_FINE_TIMING_MEAS_CAPABILITY 0x02
 
+/* number of neighbor reports that we can handle in Neighbor Report Response */
+#define MAX_SUPPORTED_NEIGHBOR_RPT 15
+
 #endif /* __SIR_API_H */
diff --git a/CORE/MAC/inc/sirMacPropExts.h b/CORE/MAC/inc/sirMacPropExts.h
index 369619096d4f..05bfb429a8f1 100644
--- a/CORE/MAC/inc/sirMacPropExts.h
+++ b/CORE/MAC/inc/sirMacPropExts.h
@@ -48,10 +48,6 @@
 #define PROP_CAPABILITY_GET(bitname, value) \
         (((value) >> SIR_MAC_PROP_CAPABILITY_ ## bitname) & 1)
 
-
-#define IS_DOT11_MODE_PROPRIETARY(dot11Mode) \
-          ((dot11Mode == WNI_CFG_DOT11_MODE_ALL) ? TRUE: FALSE)
-
 #define IS_DOT11_MODE_HT(dot11Mode) \
         (((dot11Mode == WNI_CFG_DOT11_MODE_11N) || \
           (dot11Mode ==  WNI_CFG_DOT11_MODE_11N_ONLY) || \
@@ -101,8 +97,6 @@ typedef struct sSirMacPropVersion
 // generic proprietary IE structure definition
 typedef struct sSirPropIEStruct
 {
-    tANI_U8                    aniIndicator;
-
     tANI_U8                    propRatesPresent:1;
     tANI_U8                    apNamePresent:1;
     tANI_U8                    loadBalanceInfoPresent:1;
diff --git a/CORE/MAC/inc/sirMacProtDef.h b/CORE/MAC/inc/sirMacProtDef.h
index 97ba0e8afa2c..9dd6542190b9 100644
--- a/CORE/MAC/inc/sirMacProtDef.h
+++ b/CORE/MAC/inc/sirMacProtDef.h
@@ -42,7 +42,6 @@
 #include "palTypes.h"
 #include "sirTypes.h"
 #include "wniCfgSta.h"
-#include "aniCompiler.h"
 
 
 ///Capability information related
diff --git a/CORE/MAC/src/cfg/cfgUtil/dot11f.frms b/CORE/MAC/src/cfg/cfgUtil/dot11f.frms
index 3bc8c951e867..320fef5ec46e 100644
--- a/CORE/MAC/src/cfg/cfgUtil/dot11f.frms
+++ b/CORE/MAC/src/cfg/cfgUtil/dot11f.frms
@@ -139,6 +139,7 @@ const SIR_MAC_PROP_TRIG_STA_BK_SCAN	 =  17;
 const ANI_WDS_INFO_MAX_LENGTH        =  64;
 const SIR_MAC_MAX_NUMBER_OF_RATES    =  12;
 const HT_MAX_SUPPORTED_MCS_SET       =  16;
+const MAX_SUPPORTED_NEIGHBOR_RPT     =  15;
 
 /////////////////////////////////////////////////////////////////////////////
 //                  Wi-Fi Protected Setup TLV Identifiers                  //
@@ -3689,7 +3690,7 @@ FRAME NeighborReportResponse
    FF     Category;
    FF     Action;
    FF     DialogToken;
-   OPTIE  NeighborReport[1..4];
+   OPTIE  NeighborReport[1..MAX_SUPPORTED_NEIGHBOR_RPT];
 }
 
 FRAME GONegReq
diff --git a/CORE/MAC/src/include/dot11f.h b/CORE/MAC/src/include/dot11f.h
index 631af15eea57..d1fbc18feb48 100644
--- a/CORE/MAC/src/include/dot11f.h
+++ b/CORE/MAC/src/include/dot11f.h
@@ -38,7 +38,7 @@
   *
   *
   * This file was automatically generated by 'framesc'
-  * Wed Sep 24 14:27:36 2014 from the following file(s):
+  * Thu Oct 16 12:45:35 2014 from the following file(s):
   *
   * dot11f.frms
   *
@@ -6579,7 +6579,7 @@ typedef struct sDot11fNeighborReportResponse{
     tDot11fFfAction         Action;
     tDot11fFfDialogToken    DialogToken;
     tANI_U16                num_NeighborReport;
-    tDot11fIENeighborReport NeighborReport[4];
+    tDot11fIENeighborReport NeighborReport[15];
 } tDot11fNeighborReportResponse;
 
 #define DOT11F_NEIGHBORREPORTRESPONSE ( 30 )
diff --git a/CORE/MAC/src/include/dphGlobal.h b/CORE/MAC/src/include/dphGlobal.h
index ac6a2e1caf41..eec04b0515de 100644
--- a/CORE/MAC/src/include/dphGlobal.h
+++ b/CORE/MAC/src/include/dphGlobal.h
@@ -274,10 +274,6 @@ typedef struct sDphHashNode
 
     tANI_U8   staAuthenticated:1;
 
-    /// Whether the peer is ANI or not
-
-    tANI_U8  aniPeer:1;
-
     tANI_U8  fAniCount:1;
 
     tANI_U8   rmfEnabled:1;
@@ -316,11 +312,6 @@ typedef struct sDphHashNode
 
     tSirMacPropVersion version;
 
-    // station proprietary capability
-
-    tANI_U16                propCapability;
-
-
 #ifdef PLM_WDS
 
     tANI_U8  wdsIndex;
diff --git a/CORE/MAC/src/include/sirParams.h b/CORE/MAC/src/include/sirParams.h
index 85cf929a9f63..7da0f18f60b6 100644
--- a/CORE/MAC/src/include/sirParams.h
+++ b/CORE/MAC/src/include/sirParams.h
@@ -668,6 +668,11 @@ typedef struct sSirMbMsgP2p
 #ifdef FEATURE_WLAN_TDLS
 #define SIR_HAL_TDLS_SET_OFFCHAN_MODE      (SIR_HAL_ITC_MSG_TYPES_BEGIN + 295)
 #endif
+
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+#define SIR_HAL_ROAM_OFFLOAD_SYNCH_FAIL    (SIR_HAL_ITC_MSG_TYPES_BEGIN + 296)
+#endif
+
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
 
 // CFG message types
diff --git a/CORE/MAC/src/pe/include/limGlobal.h b/CORE/MAC/src/pe/include/limGlobal.h
index 543b22fc3229..fd4c704bb859 100644
--- a/CORE/MAC/src/pe/include/limGlobal.h
+++ b/CORE/MAC/src/pe/include/limGlobal.h
@@ -453,21 +453,19 @@ struct tLimIbssPeerNode
 {
     tLimIbssPeerNode         *next;
     tSirMacAddr              peerMacAddr;
-    tANI_U8                       aniIndicator:1;
     tANI_U8                       extendedRatesPresent:1;
     tANI_U8                       edcaPresent:1;
     tANI_U8                       wmeEdcaPresent:1;
     tANI_U8                       wmeInfoPresent:1;
     tANI_U8                       htCapable:1;
     tANI_U8                       vhtCapable:1;
-    tANI_U8                       rsvd:1;
+    tANI_U8                       rsvd:2;
     tANI_U8                       htSecondaryChannelOffset;
     tSirMacCapabilityInfo    capabilityInfo;
     tSirMacRateSet           supportedRates;
     tSirMacRateSet           extendedRates;
     tANI_U8                   supportedMCSSet[SIZE_OF_SUPPORTED_MCS_SET];
     tSirMacEdcaParamSetIE    edcaParams;
-    tANI_U16 propCapability;
     tANI_U8  erpIePresent;
 
     //HT Capabilities of IBSS Peer
diff --git a/CORE/MAC/src/pe/lim/limAdmitControl.c b/CORE/MAC/src/pe/lim/limAdmitControl.c
index de3d14f05f2e..c0c37ec85fee 100644
--- a/CORE/MAC/src/pe/lim/limAdmitControl.c
+++ b/CORE/MAC/src/pe/lim/limAdmitControl.c
@@ -62,15 +62,6 @@
 #define LIM_CONVERT_SIZE_BITS(numBytes) ((numBytes) * 8)
 #define LIM_CONVERT_RATE_MBPS(rate)     ((rate)/1000000)
 
-/* ANI sta's support enhanced rates, so the effective medium time used is
- * half that of other stations. This is the same as if they were requesting
- * half the badnwidth - so we adjust ANI sta's accordingly for bandwidth
- * calculations. Also enhanced rates apply only in case of non 11B mode.
- */
-#define LIM_STA_BW_ADJUST(aniPeer, phyMode, bw) \
-            (((aniPeer) && ((phyMode) != WNI_CFG_PHY_MODE_11B)) \
-              ?   ((bw)/2) : (bw))
-
 
 //------------------------------------------------------------------------------
 // local protos
@@ -257,7 +248,7 @@ limComputeMeanBwUsed(
                        ctspec, pTspecInfo->assocId);
                 continue;
             }
-            *pBw += LIM_STA_BW_ADJUST(pSta->aniPeer, phyMode, pTspecInfo->tspec.meanDataRate);
+            *pBw += pTspecInfo->tspec.meanDataRate;
         }
     }
 }
diff --git a/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c b/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c
index 0f2810853782..1a3947d3a883 100644
--- a/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c
+++ b/CORE/MAC/src/pe/lim/limIbssPeerMgmt.c
@@ -293,14 +293,6 @@ ibss_sta_caps_update(
     }
 #endif
 
-    if(IS_DOT11_MODE_PROPRIETARY(psessionEntry->dot11mode) &&
-      pPeerNode->aniIndicator)
-    {
-        pStaDs->aniPeer = pPeerNode->aniIndicator;
-        pStaDs->propCapability = pPeerNode->propCapability;
-    }
-
-
     // peer is 11e capable but is not 11e enabled yet
     // some STA's when joining Airgo IBSS, assert qos capability even when
     // they don't suport qos. however, they do not include the edca parameter
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index cb6a21363066..978271ed4178 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -1128,8 +1128,6 @@ sendIndToSme:
     pStaDs->shortPreambleEnabled = (tANI_U8)pAssocReq->capabilityInfo.shortPreamble;
     pStaDs->shortSlotTimeEnabled = (tANI_U8)pAssocReq->capabilityInfo.shortSlotTime;
 
-    pStaDs->propCapability = 0;
-
     pStaDs->valid                  = 0;
     pStaDs->mlmStaContext.authType = authType;
     pStaDs->staType = STA_ENTRY_PEER;
@@ -1316,9 +1314,6 @@ if (limPopulateMatchingRateSet(pMac,
     // Re/Assoc Response frame to requesting STA
     pStaDs->mlmStaContext.subType = subType;
 
-    if (pAssocReq->propIEinfo.aniIndicator)
-        pStaDs->aniPeer = 1;
-
 #ifdef WLAN_FEATURE_11W
     pStaDs->rmfEnabled = (pmfConnection) ? 1 : 0;
     pStaDs->pmfSaQueryState = DPH_SA_QUERY_NOT_IN_PROGRESS;
@@ -1761,9 +1756,6 @@ void limSendMlmAssocInd(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tpPESession p
         vos_mem_copy((tANI_U8 *)&pMlmReassocInd->ssId,
                      (tANI_U8 *)&(pAssocReq->ssId), pAssocReq->ssId.length + 1);
 
-        if (pAssocReq->propIEinfo.aniIndicator)
-            pStaDs->aniPeer = 1;
-
         pMlmReassocInd->capabilityInfo = pAssocReq->capabilityInfo;
         pMlmReassocInd->rsnIE.length = 0;
 
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index 2318059e4620..9b8f3e22d6fd 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -2511,8 +2511,11 @@ __limProcessSmeReassocReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
     return;
 
 end:
-    if (pReassocReq)
+    if (pReassocReq) {
         vos_mem_free( pReassocReq);
+        if (psessionEntry)
+            psessionEntry->pLimReAssocReq = NULL;
+    }
 
     if (psessionEntry)
     {
diff --git a/CORE/MAC/src/pe/lim/limPropExtsUtils.c b/CORE/MAC/src/pe/lim/limPropExtsUtils.c
index b5bd84ec07db..43cbc88b6396 100644
--- a/CORE/MAC/src/pe/lim/limPropExtsUtils.c
+++ b/CORE/MAC/src/pe/lim/limPropExtsUtils.c
@@ -109,8 +109,7 @@ limExtractApCapability(tpAniSirGlobal pMac, tANI_U8 *pIE, tANI_U16 ieLen,
             LIM_BSS_CAPS_SET(WME, *qosCap);
         if (LIM_BSS_CAPS_GET(WME, *qosCap) && pBeaconStruct->wsmCapablePresent)
             LIM_BSS_CAPS_SET(WSM, *qosCap);
-        if (pBeaconStruct->propIEinfo.aniIndicator &&
-            pBeaconStruct->propIEinfo.capabilityPresent)
+        if (pBeaconStruct->propIEinfo.capabilityPresent)
             *propCap = pBeaconStruct->propIEinfo.capability;
         if (pBeaconStruct->HTCaps.present)
             pMac->lim.htCapabilityPresentInBeacon = 1;
@@ -244,9 +243,7 @@ ePhyChanBondState  limGetHTCBState(ePhyChanBondState aniCBMode)
  * limGetStaPeerType
  *
  *FUNCTION:
- * Based on a combination of the following -
- * 2) tDphHashNode.propCapability
- * this API determines if a given STA is an ANI peer or not
+ * This API returns STA peer type
  *
  *LOGIC:
  *
diff --git a/CORE/MAC/src/pe/lim/limScanResultUtils.c b/CORE/MAC/src/pe/lim/limScanResultUtils.c
index 69789ffdbcfa..995e30d05804 100644
--- a/CORE/MAC/src/pe/lim/limScanResultUtils.c
+++ b/CORE/MAC/src/pe/lim/limScanResultUtils.c
@@ -239,8 +239,6 @@ limCollectBssDescription(tpAniSirGlobal pMac,
     channelNum = pBssDescr->channelId;
     pBssDescr->nwType = limGetNwType(pMac, channelNum, SIR_MAC_MGMT_FRAME, pBPR);
 
-    pBssDescr->aniIndicator = pBPR->propIEinfo.aniIndicator;
-
     // Copy RSSI & SINR from BD
 
     PELOG4(limLog(pMac, LOG4, "***********BSS Description for BSSID:*********** ");
@@ -297,10 +295,9 @@ limCollectBssDescription(tpAniSirGlobal pMac,
     pBPR->channelNumber = pBssDescr->channelId;
 
     limLog( pMac, LOG3,
-        FL("Collected BSS Description for Channel(%1d), length(%u), aniIndicator(%d), IE Fields(%u)"),
+        FL("Collected BSS Description for Channel(%1d), length(%u), IE Fields(%u)"),
         pBssDescr->channelId,
         pBssDescr->length,
-        pBssDescr->aniIndicator,
         ieLen );
 
     return eHAL_STATUS_SUCCESS;
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index ff4a1710f17b..ced3f8bff9ba 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -2303,7 +2303,6 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
     if (psessionEntry->htCapability &&
             pMac->lim.htCapabilityPresentInBeacon) {
         PopulateDot11fHTCaps(pMac, psessionEntry, &pFrm->HTCaps);
-
     }
 #ifdef WLAN_FEATURE_11AC
     if ( psessionEntry->vhtCapability &&
diff --git a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
index c608aac6017d..8d86483acf66 100644
--- a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
@@ -642,7 +642,6 @@ limSendSmeStartBssRsp(tpAniSirGlobal pMac,
                 limGetPhyMode(pMac, (tANI_U32 *)&pSirSmeRsp->bssDescription.nwType, psessionEntry);
 
                 pSirSmeRsp->bssDescription.channelId = psessionEntry->currentOperChannel;
-                pSirSmeRsp->bssDescription.aniIndicator = 1;
 
                 curLen = psessionEntry->schBeaconOffsetBegin - ieOffset;
                 vos_mem_copy( (tANI_U8 *) &pSirSmeRsp->bssDescription.ieFields,
diff --git a/CORE/MAC/src/pe/lim/limSerDesUtils.c b/CORE/MAC/src/pe/lim/limSerDesUtils.c
index 2c1d883cf0d3..09be983cd5e2 100644
--- a/CORE/MAC/src/pe/lim/limSerDesUtils.c
+++ b/CORE/MAC/src/pe/lim/limSerDesUtils.c
@@ -162,9 +162,9 @@ limGetBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pBssDescription,
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
-    // Extract aniIndicator
-    pBssDescription->aniIndicator = *pBuf++;
-    len --;
+    /* 1 reserved byte for padding */
+    pBuf += sizeof(pBssDescription->reservedPadding0);
+    len -= sizeof(pBssDescription->reservedPadding0);
 
     // Extract rssi
     pBssDescription->rssi = (tANI_S8) *pBuf++;
@@ -303,95 +303,6 @@ limGetBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pBssDescription,
 } /*** end limGetBssDescription() ***/
 
 
-
-/**
- * limCopyBssDescription()
- *
- *FUNCTION:
- * This function is called by various LIM functions to copy
- * BSS description to a tANI_U8 buffer
- *
- *LOGIC:
- *
- *ASSUMPTIONS:
- * NA
- *
- *NOTE:
- * NA
- *
- * @param  *pBuf            Pointer to the destination buffer
- * @param  pBssDescription  Pointer to the BssDescription being copied
- * @return                  Length of BSSdescription written
- */
-
-tANI_U16
-limCopyBssDescription(tpAniSirGlobal pMac, tANI_U8 *pBuf, tSirBssDescription *pBssDescription)
-{
-    tANI_U16 len = 0;
-
-    limCopyU16(pBuf, pBssDescription->length);
-    pBuf       += sizeof(tANI_U16);
-    len        += sizeof(tANI_U16);
-
-    vos_mem_copy(  pBuf,
-                  (tANI_U8 *) pBssDescription->bssId,
-                  sizeof(tSirMacAddr));
-    pBuf       += sizeof(tSirMacAddr);
-    len        += sizeof(tSirMacAddr);
-
-   PELOG3(limLog(pMac, LOG3,
-       FL("Copying BSSdescr:channel is %d, aniInd is %d, bssId is "),
-       pBssDescription->channelId, pBssDescription->aniIndicator);
-    limPrintMacAddr(pMac, pBssDescription->bssId, LOG3);)
-
-    vos_mem_copy( pBuf,
-                  (tANI_U8 *) (&pBssDescription->scanSysTimeMsec),
-                  sizeof(v_TIME_t));
-    pBuf       += sizeof(v_TIME_t);
-    len        += sizeof(v_TIME_t);
-
-    limCopyU32(pBuf, pBssDescription->timeStamp[0]);
-    pBuf       += sizeof(tANI_U32);
-    len        += sizeof(tANI_U32);
-
-    limCopyU32(pBuf, pBssDescription->timeStamp[1]);
-    pBuf       += sizeof(tANI_U32);
-    len        += sizeof(tANI_U32);
-
-    limCopyU16(pBuf, pBssDescription->beaconInterval);
-    pBuf       += sizeof(tANI_U16);
-    len        += sizeof(tANI_U16);
-
-    limCopyU16(pBuf, pBssDescription->capabilityInfo);
-    pBuf       += sizeof(tANI_U16);
-    len        += sizeof(tANI_U16);
-
-    limCopyU32(pBuf, pBssDescription->nwType);
-    pBuf       += sizeof(tANI_U32);
-    len        += sizeof(tANI_U32);
-
-    *pBuf++ = pBssDescription->aniIndicator;
-    len++;
-
-    *pBuf++ = pBssDescription->rssi;
-    len++;
-
-    *pBuf++ = pBssDescription->sinr;
-    len++;
-
-    *pBuf++ = pBssDescription->channelId;
-    len++;
-
-    vos_mem_copy( pBuf, (tANI_U8 *) &(pBssDescription->ieFields),
-                  limGetIElenFromBssDescription(pBssDescription));
-
-    return (len + sizeof(tANI_U16));
-} /*** end limCopyBssDescription() ***/
-
-
-
-
-
 /**
  * limGetKeysInfo()
  *
diff --git a/CORE/SERVICES/BMI/bmi.c b/CORE/SERVICES/BMI/bmi.c
index 02612feaab7b..d487d522dc25 100644
--- a/CORE/SERVICES/BMI/bmi.c
+++ b/CORE/SERVICES/BMI/bmi.c
@@ -233,9 +233,9 @@ A_STATUS bmi_done(struct ol_softc *scn)
     return 0;
 }
 
-void bmi_target_ready(struct ol_softc *scn)
+void bmi_target_ready(struct ol_softc *scn, void *cfg_ctx)
 {
-    ol_target_ready(scn);
+    ol_target_ready(scn, cfg_ctx);
 }
 
 #ifndef HIF_MESSAGE_BASED
diff --git a/CORE/SERVICES/BMI/ol_fw.c b/CORE/SERVICES/BMI/ol_fw.c
index 3a07d8b82ec2..2765cea879cc 100644
--- a/CORE/SERVICES/BMI/ol_fw.c
+++ b/CORE/SERVICES/BMI/ol_fw.c
@@ -2361,7 +2361,10 @@ u_int8_t ol_get_number_of_peers_supported(struct ol_softc *scn)
 
 #ifdef HIF_SDIO
 #define SDIO_SWAP_MAILBOX_FW_ACK	0x10000
+#define SDIO_REDUCE_TX_COMPL_FW_ACK	0X20000
 #define SDIO_SWAP_MAILBOX_SET		0x1
+#define SDIO_REDUCE_TX_COMPL_SET	0x2
+
 /*Setting SDIO block size, mbox ISR yield limit for SDIO based HIF*/
 static A_STATUS
 ol_sdio_extra_initialization(struct ol_softc *scn)
@@ -2443,7 +2446,7 @@ ol_sdio_extra_initialization(struct ol_softc *scn)
 			break;
 		}
 
-		param |= SDIO_SWAP_MAILBOX_SET;
+		param |= (SDIO_SWAP_MAILBOX_SET|SDIO_REDUCE_TX_COMPL_SET);
 		BMIWriteMemory(scn->hif_hdl,
 				host_interest_item_address(scn->target_type,
 				offsetof(struct host_interest_s,
@@ -2456,7 +2459,7 @@ ol_sdio_extra_initialization(struct ol_softc *scn)
 }
 
 void
-ol_target_ready(struct ol_softc *scn)
+ol_target_ready(struct ol_softc *scn, void *cfg_ctx)
 {
 	u_int32_t value = 0;
 	A_STATUS status = EOK;
@@ -2475,5 +2478,11 @@ ol_target_ready(struct ol_softc *scn)
 		printk("MAILBOX SWAP Service is enabled!\n");
 		HIFSetMailboxSwap(scn->hif_hdl);
 	}
+
+	if (value & SDIO_REDUCE_TX_COMPL_FW_ACK) {
+		printk("Reduced Tx Complete service is enabled!\n");
+		ol_cfg_set_tx_free_at_download(cfg_ctx);
+
+	}
 }
 #endif
diff --git a/CORE/SERVICES/BMI/ol_fw.h b/CORE/SERVICES/BMI/ol_fw.h
index 0284bf9a0167..509e3e5b7f13 100644
--- a/CORE/SERVICES/BMI/ol_fw.h
+++ b/CORE/SERVICES/BMI/ol_fw.h
@@ -125,9 +125,9 @@ void ol_target_failure(void *instance, A_STATUS status);
 u_int8_t ol_get_number_of_peers_supported(struct ol_softc *scn);
 
 #if defined(HIF_SDIO)
-void ol_target_ready(struct ol_softc *scn);
+void ol_target_ready(struct ol_softc *scn, void *cfg_ctx);
 #else
-static inline void ol_target_ready(struct ol_softc *scn)
+static inline void ol_target_ready(struct ol_softc *scn, void *cfg_ctx)
 {
 
 }
diff --git a/CORE/SERVICES/COMMON/bmi.h b/CORE/SERVICES/COMMON/bmi.h
index 4e7aac2be59a..f33c4796aff3 100644
--- a/CORE/SERVICES/COMMON/bmi.h
+++ b/CORE/SERVICES/COMMON/bmi.h
@@ -46,7 +46,7 @@ extern "C" {
 #include "ol_if_athvar.h"
 
 A_STATUS bmi_download_firmware(struct ol_softc *scn);
-void bmi_target_ready(struct ol_softc *scn);
+void bmi_target_ready(struct ol_softc *scn, void *cfg_ctx);
 void
 BMICleanup(struct ol_softc *scn);
 
diff --git a/CORE/SERVICES/COMMON/ol_cfg.h b/CORE/SERVICES/COMMON/ol_cfg.h
index 1f76c3277221..af5448db9c32 100644
--- a/CORE/SERVICES/COMMON/ol_cfg.h
+++ b/CORE/SERVICES/COMMON/ol_cfg.h
@@ -265,7 +265,7 @@ int ol_cfg_netbuf_frags_max(ol_pdev_handle pdev);
  *      1 -> free the tx frame as soon as the download completes
  */
 int ol_cfg_tx_free_at_download(ol_pdev_handle pdev);
-
+void ol_cfg_set_tx_free_at_download(ol_pdev_handle pdev);
 
 /**
  * @brief Low water mark for target tx credit.
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 9e81a8390387..7f0dc72f4050 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -335,6 +335,8 @@ wmi_unified_vdev_up_send(wmi_unified_t wmi,
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 void wma_process_roam_synch_complete(WMA_HANDLE handle,
 		tSirSmeRoamOffloadSynchCnf *synchcnf);
+void wma_process_roam_synch_fail(WMA_HANDLE handle,
+		tSirRoamOffloadSynchFail *synchfail);
 #endif
 /* Configure the regulatory domain for DFS radar filter initialization*/
 void wma_set_dfs_regdomain(tp_wma_handle wma);
@@ -22604,6 +22606,11 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 					(t_wma_unit_test_cmd *)msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
+		case WDA_ROAM_OFFLOAD_SYNCH_FAIL:
+			wma_process_roam_synch_fail(wma_handle,
+				(tSirRoamOffloadSynchFail *)msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
 #endif
 #ifdef WLAN_FEATURE_NAN
 		case WDA_NAN_REQUEST:
@@ -27378,4 +27385,16 @@ void wma_process_roam_synch_complete(WMA_HANDLE handle,
 	}
 	return;
 }
+void wma_process_roam_synch_fail(WMA_HANDLE handle,
+		tSirRoamOffloadSynchFail *synchfail)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle) handle;
+	if (!wma_handle || !wma_handle->wmi_handle) {
+		WMA_LOGE("%s: WMA is closed, can not clean-up roam synch",
+				__func__);
+		return;
+	}
+	wma_handle->interfaces[synchfail->sessionId].roam_synch_in_progress =
+		VOS_FALSE;
+}
 #endif
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index 1495e064249e..f3348a88d387 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -5475,6 +5475,35 @@ eHalStatus csrRoamOffloadSendSynchCnf(tpAniSirGlobal pMac, tANI_U8 sessionId)
     pSession->roamOffloadSynchParams.bRoamSynchInProgress = VOS_FALSE;
     return eHAL_STATUS_SUCCESS;
 }
+void csrRoamSynchCleanUp (tpAniSirGlobal pMac, tANI_U8 sessionId)
+{
+    vos_msg_t msg;
+    tpSirRoamOffloadSynchFail pRoamOffloadFailed = NULL;
+    tCsrRoamSession *pSession = &pMac->roam.roamSession[sessionId];
+
+    /*Clean up the roam synch in progress for LFR3 */
+    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+    "%s: Roam Synch Failed, Clean Up", __func__);
+    pSession->roamOffloadSynchParams.bRoamSynchInProgress = VOS_FALSE;
+
+    pRoamOffloadFailed =
+            vos_mem_malloc(sizeof(tSirRoamOffloadSynchFail));
+    if (NULL == pRoamOffloadFailed)
+    {
+        VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+          "%s: unable to allocate memory for roam synch fail" , __func__);
+        return;
+    }
+    pRoamOffloadFailed->sessionId = sessionId;
+    msg.type     = WDA_ROAM_OFFLOAD_SYNCH_FAIL;
+    msg.reserved = 0;
+    msg.bodyptr  = pRoamOffloadFailed;
+    if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg))) {
+          VOS_TRACE(VOS_MODULE_ID_SME,VOS_TRACE_LEVEL_DEBUG,
+          "%s:Unable to post WDA_ROAM_OFFLOAD_SYNCH_FAIL msg to WDA",__func__);
+           vos_mem_free(pRoamOffloadFailed);
+    }
+}
 #endif
 
 //Return true means the command can be release, else not
@@ -8468,6 +8497,9 @@ POST_ROAM_FAILURE:
         if (pCurRoamProfile)
             vos_mem_free(pCurRoamProfile);
 
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+        csrRoamSynchCleanUp(pMac, sessionId);
+#endif
         /* Inform the upper layers that the reassoc failed */
         vos_mem_zero(&roamInfo, sizeof(tCsrRoamInfo));
         csrRoamCallCallback(pMac, sessionId,
@@ -16597,7 +16629,10 @@ eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 sessionId,
     pRequestBuf->MAWCEnabled =
             pMac->roam.configParam.MAWCEnabled;
 #ifdef FEATURE_WLAN_ESE
-    pRequestBuf->IsESEAssoc = csrNeighborRoamIsESEAssoc(pMac, sessionId);
+    pRequestBuf->IsESEAssoc = csrNeighborRoamIsESEAssoc(pMac, sessionId) &&
+    ((pRequestBuf->ConnectedNetwork.authentication ==
+                                            eCSR_AUTH_TYPE_OPEN_SYSTEM)  ||
+    (csrIsAuthTypeESE(pRequestBuf->ConnectedNetwork.authentication)));
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
              "LFR3:%s:IsEseAssoc=%d\n", __func__, pRequestBuf->IsESEAssoc);
 #endif
diff --git a/CORE/SYS/legacy/src/utils/src/dot11f.c b/CORE/SYS/legacy/src/utils/src/dot11f.c
index a0207a7ee12d..d86f17c3cba6 100644
--- a/CORE/SYS/legacy/src/utils/src/dot11f.c
+++ b/CORE/SYS/legacy/src/utils/src/dot11f.c
@@ -35,7 +35,7 @@
   *
   *
   * This file was automatically generated by 'framesc'
-  * Wed Sep 24 14:27:36 2014 from the following file(s):
+  * Thu Oct 16 12:45:35 2014 from the following file(s):
   *
   * dot11f.frms
   *
@@ -2783,6 +2783,9 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     (void) pBuf; (void)ielen; /* Shutup the compiler */
     if (pDst->present) status = DOT11F_DUPLICATE_IE;
     pDst->present = 1;
+
+    if (!ielen) /* Check to ensure copying of ielen bytes */
+        goto endUnpackIeExtCap;
     tmp33__ = *pBuf;
     pBuf += 1;
     ielen -= 1;
@@ -2794,6 +2797,9 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     pDst->reserved3 = tmp33__ >> 5 & 0x1;
     pDst->spsmpCap = tmp33__ >> 6 & 0x1;
     pDst->event = tmp33__ >> 7 & 0x1;
+
+    if (!ielen) /* Check to ensure copying of ielen bytes */
+        goto endUnpackIeExtCap;
     tmp34__ = *pBuf;
     pBuf += 1;
     ielen -= 1;
@@ -2805,6 +2811,9 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     pDst->coLocIntfReporting = tmp34__ >> 5 & 0x1;
     pDst->civicLoc = tmp34__ >> 6 & 0x1;
     pDst->geospatialLoc = tmp34__ >> 7 & 0x1;
+
+    if (!ielen) /* Check to ensure copying of ielen bytes */
+        goto endUnpackIeExtCap;
     tmp35__ = *pBuf;
     pBuf += 1;
     ielen -= 1;
@@ -2816,6 +2825,9 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     pDst->acStaCnt = tmp35__ >> 5 & 0x1;
     pDst->multiBSSID = tmp35__ >> 6 & 0x1;
     pDst->timingMeas = tmp35__ >> 7 & 0x1;
+
+    if (!ielen) /* Check to ensure copying of ielen bytes */
+        goto endUnpackIeExtCap;
     tmp36__ = *pBuf;
     pBuf += 1;
     ielen -= 1;
@@ -2827,6 +2839,9 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     pDst->TDLSPeerPSMSupp = tmp36__ >> 5 & 0x1;
     pDst->TDLSChannelSwitching = tmp36__ >> 6 & 0x1;
     pDst->interworkingService = tmp36__ >> 7 & 0x1;
+
+    if (!ielen) /* Check to ensure copying of ielen bytes */
+        goto endUnpackIeExtCap;
     tmp37__ = *pBuf;
     pBuf += 1;
     ielen -= 1;
@@ -2838,6 +2853,9 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     pDst->TDLSSupport = tmp37__ >> 5 & 0x1;
     pDst->TDLSProhibited = tmp37__ >> 6 & 0x1;
     pDst->TDLSChanSwitProhibited = tmp37__ >> 7 & 0x1;
+
+    if (!ielen) /* Check to ensure copying of ielen bytes */
+        goto endUnpackIeExtCap;
     tmp38__ = *pBuf;
     pBuf += 1;
     ielen -= 1;
@@ -2847,6 +2865,9 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     pDst->uapsdCoexistence = tmp38__ >> 5 & 0x1;
     pDst->wnmNotification = tmp38__ >> 6 & 0x1;
     pDst->QABcapbility = tmp38__ >> 7 & 0x1;
+
+    if (!ielen) /* Check to ensure copying of ielen bytes */
+        goto endUnpackIeExtCap;
     tmp39__ = *pBuf;
     pBuf += 1;
     ielen -= 1;
@@ -2858,6 +2879,9 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     pDst->MeshGCR = tmp39__ >> 5 & 0x1;
     pDst->SCS = tmp39__ >> 6 & 0x1;
     pDst->QLoadReport = tmp39__ >> 7 & 0x1;
+
+    if (!ielen) /* Check to ensure copying of ielen bytes */
+        goto endUnpackIeExtCap;
     tmp40__ = *pBuf;
     pBuf += 1;
     ielen -= 1;
@@ -2869,6 +2893,9 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     pDst->TDLSWiderBW = tmp40__ >> 5 & 0x1;
     pDst->operModeNotification = tmp40__ >> 6 & 0x1;
     pDst->maxNumOfMSDU_bit1 = tmp40__ >> 7 & 0x1;
+
+    if (!ielen) /* Check to ensure copying of ielen bytes */
+        goto endUnpackIeExtCap;
     tmp41__ = *pBuf;
     pDst->maxNumOfMSDU_bit2 = tmp41__ >> 0 & 0x1;
     pDst->ChanSchMgmt = tmp41__ >> 1 & 0x1;
@@ -2878,6 +2905,8 @@ tANI_U32 dot11fUnpackIeExtCap(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen,
     pDst->ChanAvailQuery = tmp41__ >> 5 & 0x1;
     pDst->fineTimingMeas = tmp41__ >> 6 & 0x1;
     pDst->reserved7 = tmp41__ >> 7 & 0x1;
+
+endUnpackIeExtCap:
     (void)pCtx;
     return status;
 } /* End dot11fUnpackIeExtCap. */
@@ -12336,7 +12365,7 @@ tANI_U32 dot11fUnpackNeighborReportRequest(tpAniSirGlobal pCtx, tANI_U8 *pBuf, t
     };
 
     static const tIEDefn IES_NeighborReportResponse[] = {
-        {offsetof(tDot11fNeighborReportResponse, NeighborReport), offsetof(tDot11fIENeighborReport, present), offsetof(tDot11fNeighborReportResponse, num_NeighborReport), "NeighborReport" , 4, 15, 548, SigIeNeighborReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_NEIGHBORREPORT, 0, },
+        {offsetof(tDot11fNeighborReportResponse, NeighborReport), offsetof(tDot11fIENeighborReport, present), offsetof(tDot11fNeighborReportResponse, num_NeighborReport), "NeighborReport" , 15, 15, 548, SigIeNeighborReport, {0, 0, 0, 0, 0}, 0, DOT11F_EID_NEIGHBORREPORT, 0, },
     {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },    };
 
 tANI_U32 dot11fUnpackNeighborReportResponse(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U32 nBuf, tDot11fNeighborReportResponse *pFrm)
@@ -19187,7 +19216,11 @@ static tANI_U32 UnpackCore(tpAniSirGlobal pCtx,
                         status |= dot11fUnpackIeMobilityDomain(pCtx, pBufRemaining, len, ( tDot11fIEMobilityDomain* )(pFrm + pIe->offset + sizeof(tDot11fIEMobilityDomain)*countOffset) );
                             break;
                 case SigIeNeighborReport:
-                        status |= dot11fUnpackIeNeighborReport(pCtx, pBufRemaining, len, ( tDot11fIENeighborReport* )(pFrm + pIe->offset + sizeof(tDot11fIENeighborReport)*countOffset) );
+                        if (countOffset < MAX_SUPPORTED_NEIGHBOR_RPT) {
+                            status |= dot11fUnpackIeNeighborReport(pCtx, pBufRemaining, len, ( tDot11fIENeighborReport* )(pFrm + pIe->offset + sizeof(tDot11fIENeighborReport)*countOffset) );
+                        } else {
+                            status |= DOT11F_BUFFER_OVERFLOW;
+                        }
                             break;
                 case SigIeOBSSScanParameters:
                         status |= dot11fUnpackIeOBSSScanParameters(pCtx, pBufRemaining, len, ( tDot11fIEOBSSScanParameters* )(pFrm + pIe->offset + sizeof(tDot11fIEOBSSScanParameters)*countOffset) );
diff --git a/CORE/SYS/legacy/src/utils/src/macTrace.c b/CORE/SYS/legacy/src/utils/src/macTrace.c
index 91e7a4df9afc..59953911756b 100644
--- a/CORE/SYS/legacy/src/utils/src/macTrace.c
+++ b/CORE/SYS/legacy/src/utils/src/macTrace.c
@@ -818,6 +818,7 @@ tANI_U8* macTraceGetWdaMsgString( tANI_U16 wdaMsg )
         CASE_RETURN_STRING(WDA_TBTT_UPDATE_IND);
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
         CASE_RETURN_STRING(WDA_ROAM_OFFLOAD_SYNCH_CNF);
+        CASE_RETURN_STRING(WDA_ROAM_OFFLOAD_SYNCH_FAIL);
 #endif
         CASE_RETURN_STRING(SIR_HAL_SET_BASE_MACADDR_IND);
         CASE_RETURN_STRING(WDA_LINK_STATUS_GET_REQ);
diff --git a/CORE/VOSS/src/vos_api.c b/CORE/VOSS/src/vos_api.c
index daf15abedb82..35bd4525f1bb 100644
--- a/CORE/VOSS/src/vos_api.c
+++ b/CORE/VOSS/src/vos_api.c
@@ -465,7 +465,7 @@ VOS_STATUS vos_open( v_CONTEXT_t *pVosContext, v_SIZE_t hddContextSize )
            goto err_wda_close;
    }
 
-   bmi_target_ready(scn);
+   bmi_target_ready(scn, gpVosContext->cfg_ctx);
    /* Open the SYS module */
    vStatus = sysOpen(gpVosContext);
 
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index 6bb36962885e..1852b6f37c64 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -836,6 +836,7 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 #define WDA_ROAM_OFFLOAD_SYNCH_CNF  SIR_HAL_ROAM_OFFLOAD_SYNCH_CNF
 #define WDA_ROAM_OFFLOAD_SYNCH_IND  SIR_HAL_ROAM_OFFLOAD_SYNCH_IND
+#define WDA_ROAM_OFFLOAD_SYNCH_FAIL SIR_HAL_ROAM_OFFLOAD_SYNCH_FAIL
 #endif
 #ifdef WLAN_WAKEUP_EVENTS
 #define WDA_WAKE_REASON_IND    SIR_HAL_WAKE_REASON_IND
diff --git a/Kbuild b/Kbuild
index 2f829b6c0890..6292990126a7 100644
--- a/Kbuild
+++ b/Kbuild
@@ -920,6 +920,9 @@ ifeq ($(CONFIG_QCA_WIFI_SDIO), 1)
 CDEFINES += -DFEATURE_WLAN_FORCE_SAP_SCC
 CDEFINES += -DDHCP_SERVER_OFFLOAD
 CDEFINES += -DWLAN_FEATURE_GPIO_LED_FLASHING
+ifneq ($(CONFIG_NON_QC_PLATFORM), y)
+CDEFINES += -DDFS_MASTER_OFFLOAD_IND_SUPPORT
+endif
 endif
 
 ifeq ($(CONFIG_ARCH_MSM), y)