Merge remote-tracking branch 'origin/wlan-cld3.driver.lnx.1.1-dev' into wlan-cld3.driver.lnx.1.1-rel

Sync up CLD3.1 REL branch from SU 5.1.0.2 to 5.1.03A

* origin/wlan-cld3.driver.lnx.1.1-dev: (68 commits)
  Release 5.1.0.3A
  qcacld-3.0: Correct common project header files path
  Release 5.1.0.3
  qcacld-3.0: enable additional two HTT data services
  Release 5.0.0.172
  qcacld-3.0: Revert "qcacld-3.0: Enable LRO"
  qcacld-3.0: Fix incorrect handling of encrypted auth managment frame
  qcacld-3.0: Increase target ready timeouts
  qcacld-3.0: Pass IBSS peer mac address received from target
  qcacld-3.0: Enable MSM_PLATFORM for Kernel 4.4
  qcacld-3.0: Reduce packet loss while roaming
  qcacld-3.0: Enhancement to RRM measurement
  qcacld-3.0: Always send the Beacon measurement report
  qcacld-3.0: Enable LFR3 by default
  qcacld-3.0: Fix missing connection info update after hw mode change
  qcacld-3.0: Fix concurrency action for emulation for 2G channel switch
  qcacld-3.0: Revert the MCC restriction on Adrastea emulation
  qcacld-3.0: disallow concurrency with 160Mhz or 80+80Mhz
  qcacld-3.0: hdd: Refactor wlan_startup (phase 5)
  qcacld-3.0: Add support for beacon filtering
  ...

Change-Id: I182d89d115ef316ccf58488283a3440438e9089f
CRs-Fixed: 688141 992940 982728 1000219 999599 999277 777960 998798 996949 982133 991784 996090 997785 996928 996332 973958 990798 997085 977773 865144 995088 972287 897755 972906 974833 865207 995039 996236 996199 993496 994144 992939 992930 960298 930533 990466 988355 987175 989695 947898 930948

111 files changed, 3348 insertions, 2523 deletions

diff --git a/Android.mk b/Android.mk
index 69e91dc99641..1454e42d94fa 100644
--- a/Android.mk
+++ b/Android.mk
@@ -42,9 +42,8 @@ endif # platform-sdk-version
 ###########################################################
 # This is set once per LOCAL_PATH, not per (kernel) module
 KBUILD_OPTIONS := WLAN_ROOT=$(KERNEL_TO_BUILD_ROOT_OFFSET)$(WLAN_BLD_DIR)/qcacld-3.0
-KBUILD_OPTIONS += WLAN_COMMON_ROOT=../../../opensource/wlan/qca-wifi-host-cmn
-KBUILD_OPTIONS += WLAN_COMMON_INC=../vendor/qcom/opensource/wlan/qca-wifi-host-cmn
-
+KBUILD_OPTIONS += WLAN_COMMON_ROOT=../qca-wifi-host-cmn
+KBUILD_OPTIONS += WLAN_COMMON_INC=$(KERNEL_TO_BUILD_ROOT_OFFSET)$(WLAN_BLD_DIR)/qca-wifi-host-cmn
 
 # We are actually building wlan.ko here, as per the
 # requirement we are specifying <chipset>_wlan.ko as LOCAL_MODULE.
diff --git a/Kbuild b/Kbuild
index 33169715e278..fe20723231d4 100755
--- a/Kbuild
+++ b/Kbuild
@@ -920,7 +920,6 @@ CDEFINES :=	-DANI_LITTLE_BYTE_ENDIAN \
 		-DWLAN_FEATURE_GTK_OFFLOAD \
 		-DWLAN_WAKEUP_EVENTS \
 		-DFEATURE_WLAN_RA_FILTERING\
-	        -DWLAN_KD_READY_NOTIFIER \
 		-DWLAN_NL80211_TESTMODE \
 		-DFEATURE_WLAN_LPHB \
 		-DFEATURE_WLAN_PAL_TIMER_DISABLE \
@@ -946,10 +945,6 @@ CDEFINES += -DADRASTEA_SHADOW_REGISTERS
 CDEFINES += -DADRASTEA_RRI_ON_DDR
 endif
 
-ifneq (y,$(filter y,$(CONFIG_CNSS_EOS) $(CONFIG_ICNSS) $(CONFIG_CNSS_ADRASTEA)))
-CDEFINES += -DQCA_WIFI_2_0
-endif
-
 ifeq ($(CONFIG_WLAN_FASTPATH), y)
 CDEFINES +=	-DWLAN_FEATURE_FASTPATH
 endif
@@ -969,6 +964,10 @@ ifeq ($(CONFIG_ARCH_MSM), y)
 CDEFINES += -DMSM_PLATFORM
 endif
 
+ifeq ($(CONFIG_ARCH_MSMCOBALT), y)
+CDEFINES += -DMSM_PLATFORM
+endif
+
 CDEFINES +=	-DQCA_SUPPORT_TXRX_LOCAL_PEER_ID
 
 ifeq ($(CONFIG_WLAN_TX_FLOW_CONTROL_V2), y)
diff --git a/config/WCNSS_qcom_cfg.ini b/config/WCNSS_qcom_cfg.ini
index d544a4a88f0f..8b05331feb13 100644
--- a/config/WCNSS_qcom_cfg.ini
+++ b/config/WCNSS_qcom_cfg.ini
@@ -547,10 +547,6 @@ gSapSccChanAvoidance=0
 # Inactivity time (in ms) to end TX Service Period while in IBSS power save mode
 gIbssTxSpEndInactivityTime=10
 
-# Enable/Disable Roaming Offload Support (a.k.a Key Management Offload)
-# 0 to disable, 1 to enable
-gRoamOffloadEnabled=0
-
 # Enable support for TDLS
 #  0 - disable
 #  1 - enable
diff --git a/core/cds/inc/cds_concurrency.h b/core/cds/inc/cds_concurrency.h
index 71d61ed720fb..14a5f860d63e 100644
--- a/core/cds/inc/cds_concurrency.h
+++ b/core/cds/inc/cds_concurrency.h
@@ -474,6 +474,7 @@ enum cds_band {
  *
  * @mode: connection type
  * @chan: channel of the connection
+ * @bw: channel bandwidth used for the connection
  * @mac: The HW mac it is running
  * @tx_spatial_stream: Tx spatial stream used by the connection
  * @rx_spatial_stream: Tx spatial stream used by the connection
@@ -484,6 +485,7 @@ enum cds_band {
 struct cds_conc_connection_info {
 	enum cds_con_mode mode;
 	uint8_t       chan;
+	enum hw_mode_bandwidth bw;
 	uint8_t       mac;
 	enum cds_chain_mode chain_mask;
 	uint8_t       tx_spatial_stream;
@@ -587,6 +589,9 @@ QDF_STATUS cds_init_policy_mgr(void);
 QDF_STATUS cds_deinit_policy_mgr(void);
 QDF_STATUS cds_get_pcl(enum cds_con_mode mode,
 				uint8_t *pcl_Channels, uint32_t *len);
+uint8_t cds_get_nondfs_preferred_channel(enum cds_con_mode mode,
+					bool for_existing_conn);
+bool cds_is_any_nondfs_chnl_present(uint8_t *channel);
 bool cds_allow_concurrency(enum cds_con_mode mode,
 				uint8_t channel, enum hw_mode_bandwidth bw);
 enum cds_conc_priority_mode cds_get_first_connection_pcl_table_index(void);
diff --git a/core/cds/inc/cds_reg_service.h b/core/cds/inc/cds_reg_service.h
index 8e858866be05..a0d90db88e82 100644
--- a/core/cds/inc/cds_reg_service.h
+++ b/core/cds/inc/cds_reg_service.h
@@ -77,6 +77,64 @@ typedef enum {
 	REGDOMAIN_COUNT
 } v_REGDOMAIN_t;
 
+
+/**
+ * enum channel_enum: channel enumeration
+ * @CHAN_ENUM_1: channel number 1
+ * @CHAN_ENUM_2: channel number 2
+ * @CHAN_ENUM_3: channel number 3
+ * @CHAN_ENUM_4: channel number 4
+ * @CHAN_ENUM_5: channel number 5
+ * @CHAN_ENUM_6: channel number 6
+ * @CHAN_ENUM_7: channel number 7
+ * @CHAN_ENUM_8: channel number 8
+ * @CHAN_ENUM_9: channel number 9
+ * @CHAN_ENUM_10: channel number 10
+ * @CHAN_ENUM_11: channel number 11
+ * @CHAN_ENUM_12: channel number 12
+ * @CHAN_ENUM_13: channel number 13
+ * @CHAN_ENUM_14: channel number 14
+ * @CHAN_ENUM_36: channel number 36
+ * @CHAN_ENUM_40: channel number 40
+ * @CHAN_ENUM_44: channel number 44
+ * @CHAN_ENUM_48: channel number 48
+ * @CHAN_ENUM_52: channel number 52
+ * @CHAN_ENUM_56: channel number 56
+ * @CHAN_ENUM_60: channel number 60
+ * @CHAN_ENUM_64: channel number 64
+ * @CHAN_ENUM_100: channel number 100
+ * @CHAN_ENUM_104: channel number 104
+ * @CHAN_ENUM_108: channel number 108
+ * @CHAN_ENUM_112: channel number 112
+ * @CHAN_ENUM_116: channel number 116
+ * @CHAN_ENUM_120: channel number 120
+ * @CHAN_ENUM_124: channel number 124
+ * @CHAN_ENUM_128: channel number 128
+ * @CHAN_ENUM_132: channel number 132
+ * @CHAN_ENUM_136: channel number 136
+ * @CHAN_ENUM_140: channel number 140
+ * @CHAN_ENUM_144: channel number 144
+ * @CHAN_ENUM_149: channel number 149
+ * @CHAN_ENUM_153: channel number 153
+ * @CHAN_ENUM_157: channel number 157
+ * @CHAN_ENUM_161: channel number 161
+ * @CHAN_ENUM_165: channel number 165
+ * @CHAN_ENUM_170: channel number 108
+ * @CHAN_ENUM_171: channel number 112
+ * @CHAN_ENUM_172: channel number 116
+ * @CHAN_ENUM_173: channel number 120
+ * @CHAN_ENUM_174: channel number 124
+ * @CHAN_ENUM_175: channel number 128
+ * @CHAN_ENUM_176: channel number 132
+ * @CHAN_ENUM_177: channel number 136
+ * @CHAN_ENUM_178: channel number 140
+ * @CHAN_ENUM_179: channel number 144
+ * @CHAN_ENUM_180: channel number 149
+ * @CHAN_ENUM_181: channel number 153
+ * @CHAN_ENUM_182: channel number 157
+ * @CHAN_ENUM_183: channel number 161
+ * @CHAN_ENUM_184: channel number 165
+ */
 enum channel_enum {
 	CHAN_ENUM_1 = 0,
 	CHAN_ENUM_2,
@@ -155,22 +213,20 @@ enum channel_enum {
 
 /**
  * enum channel_state: channel state
- *
  * @CHANNEL_STATE_DISABLE: channel disabled
- * @CHANNEL_STATE_ENABLE: tx/rx enabled
  * @CHANNEL_STATE_DFS: rx enabled, tx DFS
+ * @CHANNEL_STATE_ENABLE: tx/rx enabled
  * @CHANNEL_STATE_INVALID: not a valid channel
  */
 enum channel_state {
 	CHANNEL_STATE_DISABLE,
-	CHANNEL_STATE_ENABLE,
 	CHANNEL_STATE_DFS,
-	CHANNEL_STATE_INVALID
+	CHANNEL_STATE_ENABLE,
+	CHANNEL_STATE_INVALID,
 };
 
 /**
  * struct regulatory_channel: regulatory channel
- *
  * @state: channel state
  * @flags: channel flags
  * @pwr_limit: channel tx power limit
@@ -183,7 +239,6 @@ struct regulatory_channel {
 
 /**
  * struct chan_map: channel mapping
- *
  * @center_freq: channel center freq
  * @chan_num: channel number
  */
@@ -194,7 +249,6 @@ struct chan_map {
 
 /**
  * struct channel_power: channel power
- *
  * @chan_num: channel number
  * @power: tx power
  */
@@ -205,7 +259,6 @@ struct channel_power {
 
 /**
  * enum country_src: country source
- *
  * @SOURCE_QUERY: source query
  * @SOURCE_CORE: source regulatory core
  * @SOURCE_DRIVER: source driver
@@ -222,7 +275,6 @@ enum country_src {
 
 /**
  * struct regulatory: regulatory information
- *
  * @reg_domain: regulatory domain pair
  * @eeprom_rd_ext: eeprom value
  * @country_code: current country in integer
@@ -248,27 +300,43 @@ struct regulatory {
 };
 
 /**
- * phy_ch_width - channel width
- * @CH_WIDTH_20MHZ: channel width 20 MHz
- * @CH_WIDTH_40MHZ: channel width 40 MHz
- * @CH_WIDTH_80MHZ: channel width 80MHz
- * @CH_WIDTH_160MHZ: channel width 160 MHz
- * @CH_WIDTH_80P80MHZ: channel width 160MHz(80+80)
- * @CH_WIDTH_5MHZ: channel width 5MHz
- * @CH_WIDTH_10MHZ: channel width 10MHz
+ * enum phy_ch_width - physical layer channel width
+ * @CH_WIDTH_20MHZ: channel width 20 mhz
+ * @CH_WIDTH_40MHZ: channel width 40 mhz
+ * @CH_WIDTH_80MHZ: channel width 80 mhz
+ * @CH_WIDTH_160MHZ: channel width 160 mhz
+ * @CH_WIDTH_80P80MHZ: channel width 80+80 mhz
+ * @CH_WIDTH_5MHZ: channel width 5 mhz
+ * @CH_WIDTH_10MHZ: channel width 10 mhz
+ * @CH_WIDTH_INVALID: invalid channel width
+ * @CH_WIDTH_MAX: maximum channel width
  */
 enum phy_ch_width {
 	CH_WIDTH_20MHZ = 0,
-	CH_WIDTH_40MHZ = 1,
-	CH_WIDTH_80MHZ = 2,
-	CH_WIDTH_160MHZ = 3,
-	CH_WIDTH_80P80MHZ = 4,
-	CH_WIDTH_5MHZ = 5,
-	CH_WIDTH_10MHZ = 6,
-	CH_WIDTH_INVALID = 7,
+	CH_WIDTH_40MHZ,
+	CH_WIDTH_80MHZ,
+	CH_WIDTH_160MHZ,
+	CH_WIDTH_80P80MHZ,
+	CH_WIDTH_5MHZ,
+	CH_WIDTH_10MHZ,
+	CH_WIDTH_INVALID,
 	CH_WIDTH_MAX
 };
 
+/**
+ * struct ch_params_s
+ * @ch_width: channel width
+ * @sec_ch_offset: secondary channel offset
+ * @center_freq_seg0: center freq for segment 0
+ * @center_freq_seg1: center freq for segment 1
+ */
+struct ch_params_s {
+	enum phy_ch_width ch_width;
+	uint8_t sec_ch_offset;
+	uint8_t center_freq_seg0;
+	uint8_t center_freq_seg1;
+};
+
 extern const struct chan_map chan_mapping[NUM_CHANNELS];
 extern struct regulatory_channel reg_channels[NUM_CHANNELS];
 
@@ -286,11 +354,16 @@ enum channel_state cds_get_channel_state(uint32_t chan_num);
 QDF_STATUS cds_get_dfs_region(uint8_t *dfs_region);
 QDF_STATUS cds_put_dfs_region(uint8_t dfs_region);
 
-bool cds_is_dsrc_channel(uint16_t);
-enum channel_state cds_get_bonded_channel_state(uint32_t chan_num,
-					   enum phy_ch_width chan_width);
+bool cds_is_dsrc_channel(uint16_t center_freq);
+enum channel_state cds_get_5g_bonded_channel_state(uint16_t chan_num,
+						 enum phy_ch_width chan_width);
+
+enum channel_state cds_get_2g_bonded_channel_state(uint16_t chan_num,
+						   enum phy_ch_width chan_width,
+						   uint16_t sec_ch);
 
-enum phy_ch_width cds_get_max_channel_bw(uint32_t chan_num);
+void cds_set_channel_params(uint16_t oper_ch, uint16_t ht_offset_2g,
+			    struct ch_params_s *ch_params);
 
 QDF_STATUS cds_set_reg_domain(void *client_ctxt, v_REGDOMAIN_t reg_domain);
 QDF_STATUS cds_put_default_country(uint8_t *def_country);
diff --git a/core/cds/inc/cds_regdomain.h b/core/cds/inc/cds_regdomain.h
index 594eea8d7a0a..447eec39821a 100644
--- a/core/cds/inc/cds_regdomain.h
+++ b/core/cds/inc/cds_regdomain.h
@@ -76,6 +76,8 @@
 #define	CTRY_DEFAULT            0
 #define COUNTRY_ERD_FLAG        0x8000
 #define WORLDWIDE_ROAMING_FLAG  0x4000
+#define MIN_TX_PWR_CAP    8
+#define MAX_TX_PWR_CAP    22
 
 enum country_code {
 	CTRY_AFGHANISTAN = 4,
@@ -525,20 +527,6 @@ struct country_code_to_reg_dmn {
 };
 
 /**
- * struct ch_params_s
- * @ch_width: channel width
- * @sec_ch_offset: secondary channel offset
- * @center_freq_seg0: center freq for segment 0
- * @center_freq_seg1: center freq for segment 1
- */
-struct ch_params_s {
-	enum phy_ch_width ch_width;
-	uint8_t sec_ch_offset;
-	uint8_t center_freq_seg0;
-	uint8_t center_freq_seg1;
-};
-
-/**
  * struct reg_dmn: regulatory domain structure
  * @reg_dmn: regulatory domain
  * @conformance_test_limit:  CTL limit
diff --git a/core/cds/inc/cds_utils.h b/core/cds/inc/cds_utils.h
index 66a30b38d587..1bc711484120 100644
--- a/core/cds/inc/cds_utils.h
+++ b/core/cds/inc/cds_utils.h
@@ -56,6 +56,7 @@
 
 #define CDS_24_GHZ_BASE_FREQ   (2407)
 #define CDS_5_GHZ_BASE_FREQ    (5000)
+#define CDS_24_GHZ_CHANNEL_6   (6)
 #define CDS_24_GHZ_CHANNEL_14  (14)
 #define CDS_24_GHZ_CHANNEL_15  (15)
 #define CDS_24_GHZ_CHANNEL_27  (27)
diff --git a/core/cds/src/cds_concurrency.c b/core/cds/src/cds_concurrency.c
index 50e2238a0717..2e8d9002b8ed 100644
--- a/core/cds/src/cds_concurrency.c
+++ b/core/cds/src/cds_concurrency.c
@@ -2046,6 +2046,7 @@ bool cds_set_connection_in_progress(bool value)
  * @conn_index: Connection index
  * @mode: Mode
  * @chan: Channel
+ * @bw: Bandwidth
  * @mac: Mac id
  * @chain_mask: Chain mask
  * @tx_spatial_stream: Tx spatial stream
@@ -2060,6 +2061,7 @@ bool cds_set_connection_in_progress(bool value)
 static void cds_update_conc_list(uint32_t conn_index,
 		enum cds_con_mode mode,
 		uint8_t chan,
+		enum hw_mode_bandwidth bw,
 		uint8_t mac,
 		enum cds_chain_mode chain_mask,
 		uint8_t tx_spatial_stream,
@@ -2075,6 +2077,7 @@ static void cds_update_conc_list(uint32_t conn_index,
 	}
 	conc_connection_list[conn_index].mode = mode;
 	conc_connection_list[conn_index].chan = chan;
+	conc_connection_list[conn_index].bw = bw;
 	conc_connection_list[conn_index].mac = mac;
 	conc_connection_list[conn_index].chain_mask = chain_mask;
 	conc_connection_list[conn_index].tx_spatial_stream = tx_spatial_stream;
@@ -2706,7 +2709,6 @@ static uint32_t cds_dump_current_concurrency_one_connection(char *cc_mode,
 					length);
 		break;
 	default:
-		/* err msg */
 		cds_err("unexpected mode %d", conc_connection_list[0].mode);
 		break;
 	}
@@ -2760,7 +2762,6 @@ static uint32_t cds_dump_current_concurrency_two_connection(char *cc_mode,
 					length);
 		break;
 	default:
-		/* err msg */
 		cds_err("unexpected mode %d", conc_connection_list[1].mode);
 		break;
 	}
@@ -2814,7 +2815,6 @@ static uint32_t cds_dump_current_concurrency_three_connection(char *cc_mode,
 					length);
 		break;
 	default:
-		/* err msg */
 		cds_err("unexpected mode %d", conc_connection_list[2].mode);
 		break;
 	}
@@ -2933,7 +2933,6 @@ static void cds_dump_current_concurrency(void)
 		cds_err("%s", cc_mode);
 		break;
 	default:
-		/* err msg */
 		cds_err("unexpected num_connections value %d",
 			num_connections);
 		break;
@@ -2976,7 +2975,6 @@ static bool cds_current_concurrency_is_scc(void)
 		}
 		break;
 	default:
-		/* err msg */
 		cds_err("unexpected num_connections value %d",
 			num_connections);
 		break;
@@ -4008,9 +4006,10 @@ uint32_t cds_get_connection_count(void)
  *
  * Return: cds_con_mode
  */
-enum cds_con_mode cds_get_mode(uint8_t type, uint8_t subtype)
+static enum cds_con_mode cds_get_mode(uint8_t type, uint8_t subtype)
 {
 	enum cds_con_mode mode = CDS_MAX_NUM_OF_MODE;
+
 	if (type == WMI_VDEV_TYPE_AP) {
 		switch (subtype) {
 		case 0:
@@ -4020,7 +4019,6 @@ enum cds_con_mode cds_get_mode(uint8_t type, uint8_t subtype)
 			mode = CDS_P2P_GO_MODE;
 			break;
 		default:
-		/* err msg*/
 			cds_err("Unknown subtype %d for type %d",
 				subtype, type);
 			break;
@@ -4034,7 +4032,6 @@ enum cds_con_mode cds_get_mode(uint8_t type, uint8_t subtype)
 			mode = CDS_P2P_CLIENT_MODE;
 			break;
 		default:
-		/* err msg*/
 			cds_err("Unknown subtype %d for type %d",
 				subtype, type);
 			break;
@@ -4042,7 +4039,6 @@ enum cds_con_mode cds_get_mode(uint8_t type, uint8_t subtype)
 	} else if (type == WMI_VDEV_TYPE_IBSS) {
 		mode = CDS_IBSS_MODE;
 	} else {
-		/* err msg */
 		cds_err("Unknown type %d", type);
 	}
 
@@ -4050,6 +4046,48 @@ enum cds_con_mode cds_get_mode(uint8_t type, uint8_t subtype)
 }
 
 /**
+ * cds_get_bw() - Get channel bandwidth type used by WMI
+ * @chan_width: channel bandwidth type defined by host
+ *
+ * Get the channel bandwidth type used by WMI
+ *
+ * Return: hw_mode_bandwidth
+ */
+static enum hw_mode_bandwidth cds_get_bw(enum phy_ch_width chan_width)
+{
+	enum hw_mode_bandwidth bw = HW_MODE_BW_NONE;
+
+	switch (chan_width) {
+	case CH_WIDTH_20MHZ:
+		bw = HW_MODE_20_MHZ;
+		break;
+	case CH_WIDTH_40MHZ:
+		bw = HW_MODE_40_MHZ;
+		break;
+	case CH_WIDTH_80MHZ:
+		bw = HW_MODE_80_MHZ;
+		break;
+	case CH_WIDTH_160MHZ:
+		bw = HW_MODE_160_MHZ;
+		break;
+	case CH_WIDTH_80P80MHZ:
+		bw = HW_MODE_80_PLUS_80_MHZ;
+		break;
+	case CH_WIDTH_5MHZ:
+		bw = HW_MODE_5_MHZ;
+		break;
+	case CH_WIDTH_10MHZ:
+		bw = HW_MODE_10_MHZ;
+		break;
+	default:
+		cds_err("Unknown channel BW type %d", chan_width);
+		break;
+	}
+
+	return bw;
+}
+
+/**
  * cds_incr_connection_count() - adds the new connection to
  * the current connections list
  * @vdev_id: vdev id
@@ -4082,7 +4120,6 @@ QDF_STATUS cds_incr_connection_count(uint32_t vdev_id)
 
 	conn_index = cds_get_connection_count();
 	if (hdd_ctx->config->gMaxConcurrentActiveSessions < conn_index) {
-		/* err msg */
 		cds_err("exceeded max connection limit %d",
 			hdd_ctx->config->gMaxConcurrentActiveSessions);
 		return status;
@@ -4091,7 +4128,6 @@ QDF_STATUS cds_incr_connection_count(uint32_t vdev_id)
 	wma_conn_table_entry = wma_get_interface_by_vdev_id(vdev_id);
 
 	if (NULL == wma_conn_table_entry) {
-		/* err msg*/
 		cds_err("can't find vdev_id %d in WMA table", vdev_id);
 		return status;
 	}
@@ -4101,6 +4137,7 @@ QDF_STATUS cds_incr_connection_count(uint32_t vdev_id)
 			cds_get_mode(wma_conn_table_entry->type,
 					wma_conn_table_entry->sub_type),
 			cds_freq_to_chan(wma_conn_table_entry->mhz),
+			cds_get_bw(wma_conn_table_entry->chan_width),
 			wma_conn_table_entry->mac_id,
 			wma_conn_table_entry->chain_mask,
 			wma_conn_table_entry->tx_streams,
@@ -4174,6 +4211,7 @@ QDF_STATUS cds_update_connection_info(uint32_t vdev_id)
 			cds_get_mode(wma_conn_table_entry->type,
 					wma_conn_table_entry->sub_type),
 			cds_freq_to_chan(wma_conn_table_entry->mhz),
+			cds_get_bw(wma_conn_table_entry->chan_width),
 			wma_conn_table_entry->mac_id,
 			wma_conn_table_entry->chain_mask,
 			wma_conn_table_entry->tx_streams,
@@ -4209,7 +4247,6 @@ QDF_STATUS cds_decr_connection_count(uint32_t vdev_id)
 		conn_index++;
 	}
 	if (!found) {
-		/* err msg */
 		cds_err("can't find vdev_id %d in conc_connection_list",
 			vdev_id);
 		return status;
@@ -4251,6 +4288,7 @@ QDF_STATUS cds_decr_connection_count(uint32_t vdev_id)
  * @len:	Number of channels
  * @order:	no order OR 2.4 Ghz channel followed by 5 Ghz
  *	channel OR 5 Ghz channel followed by 2.4 Ghz channel
+ * @skip_dfs_channel: if this flag is true then skip the dfs channel
  *
  *
  * This function provides the channel(s) on which current
@@ -4259,13 +4297,13 @@ QDF_STATUS cds_decr_connection_count(uint32_t vdev_id)
  * Return: QDF_STATUS
  */
 QDF_STATUS cds_get_connection_channels(uint8_t *channels,
-			uint32_t *len, uint8_t order)
+			uint32_t *len, uint8_t order,
+			bool skip_dfs_channel)
 {
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
 	uint32_t conn_index = 0, num_channels = 0;
 
 	if ((NULL == channels) || (NULL == len)) {
-		/* err msg*/
 		cds_err("channels or len is NULL");
 		status = QDF_STATUS_E_FAILURE;
 		return status;
@@ -4273,45 +4311,55 @@ QDF_STATUS cds_get_connection_channels(uint8_t *channels,
 
 	if (0 == order) {
 		while (CONC_CONNECTION_LIST_VALID_INDEX(conn_index)) {
-			channels[num_channels++] =
-				conc_connection_list[conn_index++].chan;
+			if (skip_dfs_channel && CDS_IS_DFS_CH(
+					conc_connection_list[conn_index].chan))
+				conn_index++;
+			else
+				channels[num_channels++] =
+					conc_connection_list[conn_index++].chan;
 		}
 		*len = num_channels;
 	} else if (1 == order) {
 		while (CONC_CONNECTION_LIST_VALID_INDEX(conn_index)) {
 			if (CDS_IS_CHANNEL_24GHZ(
-				conc_connection_list[conn_index].chan)) {
+					conc_connection_list[conn_index].chan))
 				channels[num_channels++] =
 					conc_connection_list[conn_index++].chan;
-			} else
+			else
 				conn_index++;
 		}
 		conn_index = 0;
 		while (CONC_CONNECTION_LIST_VALID_INDEX(conn_index)) {
-			if (CDS_IS_CHANNEL_5GHZ(
-				conc_connection_list[conn_index].chan)) {
+			if (skip_dfs_channel && CDS_IS_DFS_CH(
+					conc_connection_list[conn_index].chan))
+				conn_index++;
+			else if (CDS_IS_CHANNEL_5GHZ(
+					conc_connection_list[conn_index].chan))
 				channels[num_channels++] =
 					conc_connection_list[conn_index++].chan;
-			} else
+			else
 				conn_index++;
 		}
 		*len = num_channels;
 	} else if (2 == order) {
 		while (CONC_CONNECTION_LIST_VALID_INDEX(conn_index)) {
-			if (CDS_IS_CHANNEL_5GHZ(
-				conc_connection_list[conn_index].chan)) {
+			if (skip_dfs_channel && CDS_IS_DFS_CH(
+					conc_connection_list[conn_index].chan))
+				conn_index++;
+			else if (CDS_IS_CHANNEL_5GHZ(
+					conc_connection_list[conn_index].chan))
 				channels[num_channels++] =
 					conc_connection_list[conn_index++].chan;
-			} else
+			else
 				conn_index++;
 		}
 		conn_index = 0;
 		while (CONC_CONNECTION_LIST_VALID_INDEX(conn_index)) {
 			if (CDS_IS_CHANNEL_24GHZ(
-				conc_connection_list[conn_index].chan)) {
+					conc_connection_list[conn_index].chan))
 				channels[num_channels++] =
 					conc_connection_list[conn_index++].chan;
-			} else
+			else
 				conn_index++;
 		}
 		*len = num_channels;
@@ -4319,6 +4367,7 @@ QDF_STATUS cds_get_connection_channels(uint8_t *channels,
 		cds_err("unknown order %d", order);
 		status = QDF_STATUS_E_FAILURE;
 	}
+
 	return status;
 }
 
@@ -4393,7 +4442,8 @@ void cds_update_with_safe_channel_list(uint8_t *pcl_channels, uint32_t *len)
  * @hdd_ctx:	HDD Context
  * @pcl:	The preferred channel list enum
  * @pcl_channels: PCL channels
- * @len: lenght of the PCL
+ * @len: length of the PCL
+ * @mode: concurrency mode for which channel list is requested
  *
  * This function provides the actual channel list based on the
  * current regulatory domain derived using preferred channel
@@ -4402,7 +4452,7 @@ void cds_update_with_safe_channel_list(uint8_t *pcl_channels, uint32_t *len)
  * Return: Channel List
  */
 QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
-			uint8_t *pcl_channels, uint32_t *len)
+		uint8_t *pcl_channels, uint32_t *len, enum cds_con_mode mode)
 {
 	QDF_STATUS status = QDF_STATUS_E_FAILURE;
 	uint32_t num_channels = WNI_CFG_VALID_CHANNEL_LIST_LEN;
@@ -4410,6 +4460,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 	uint8_t channel_list[MAX_NUM_CHAN] = {0};
 	uint8_t channel_list_24[MAX_NUM_CHAN] = {0};
 	uint8_t channel_list_5[MAX_NUM_CHAN] = {0};
+	bool skip_dfs_channel = false;
 	hdd_context_t *hdd_ctx;
 
 	hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD);
@@ -4419,7 +4470,6 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 	}
 
 	if ((NULL == pcl_channels) || (NULL == len)) {
-		/* err msg*/
 		cds_err("pcl_channels or len is NULL");
 		return status;
 	}
@@ -4443,6 +4493,17 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 		cds_err("No valid channel");
 		return status;
 	}
+
+	/*
+	 * if you have atleast one STA connection then don't fill DFS channels
+	 * in the preferred channel list
+	 */
+	if (((mode == CDS_SAP_MODE) || (mode == CDS_P2P_GO_MODE)) &&
+	    (cds_mode_specific_connection_count(CDS_STA_MODE, NULL) > 0)) {
+		cds_info("STA present, skip DFS channels from pcl for SAP/Go");
+		skip_dfs_channel = true;
+	}
+
 	/* Let's divide the list in 2.4 & 5 Ghz lists */
 	while ((channel_list[chan_index] <= 11) &&
 		(chan_index_24 < MAX_NUM_CHAN))
@@ -4457,9 +4518,15 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 					channel_list[chan_index++];
 		}
 	}
-	while ((chan_index < num_channels) &&
-		(chan_index_5 < MAX_NUM_CHAN))
+
+	while ((chan_index < num_channels) && (chan_index_5 < MAX_NUM_CHAN)) {
+		if ((true == skip_dfs_channel) &&
+		    CDS_IS_DFS_CH(channel_list[chan_index])) {
+			chan_index++;
+			continue;
+		}
 		channel_list_5[chan_index_5++] = channel_list[chan_index++];
+	}
 
 	num_channels = 0;
 	switch (pcl) {
@@ -4478,7 +4545,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 	case CDS_SCC_CH:
 	case CDS_MCC_CH:
 		cds_get_connection_channels(
-			channel_list, &num_channels, 0);
+			channel_list, &num_channels, 0, skip_dfs_channel);
 		qdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
 		status = QDF_STATUS_SUCCESS;
@@ -4486,7 +4553,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 	case CDS_SCC_CH_24G:
 	case CDS_MCC_CH_24G:
 		cds_get_connection_channels(
-			channel_list, &num_channels, 0);
+			channel_list, &num_channels, 0, skip_dfs_channel);
 		qdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
 		qdf_mem_copy(&pcl_channels[num_channels],
@@ -4497,7 +4564,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 	case CDS_SCC_CH_5G:
 	case CDS_MCC_CH_5G:
 		cds_get_connection_channels(
-			channel_list, &num_channels, 0);
+			channel_list, &num_channels, 0, skip_dfs_channel);
 		qdf_mem_copy(pcl_channels, channel_list,
 			num_channels);
 		*len = num_channels;
@@ -4512,7 +4579,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 			chan_index_24);
 		*len = chan_index_24;
 		cds_get_connection_channels(
-			channel_list, &num_channels, 0);
+			channel_list, &num_channels, 0, skip_dfs_channel);
 		qdf_mem_copy(&pcl_channels[chan_index_24],
 			channel_list, num_channels);
 		*len += num_channels;
@@ -4524,7 +4591,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 			chan_index_5);
 		*len = chan_index_5;
 		cds_get_connection_channels(
-			channel_list, &num_channels, 0);
+			channel_list, &num_channels, 0, skip_dfs_channel);
 		qdf_mem_copy(&pcl_channels[chan_index_5],
 			channel_list, num_channels);
 		*len += num_channels;
@@ -4532,7 +4599,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 		break;
 	case CDS_SCC_ON_24_SCC_ON_5:
 		cds_get_connection_channels(
-			channel_list, &num_channels, 1);
+			channel_list, &num_channels, 1, skip_dfs_channel);
 		qdf_mem_copy(pcl_channels, channel_list,
 			num_channels);
 		*len = num_channels;
@@ -4540,14 +4607,14 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 		break;
 	case CDS_SCC_ON_5_SCC_ON_24:
 		cds_get_connection_channels(
-			channel_list, &num_channels, 2);
+			channel_list, &num_channels, 2, skip_dfs_channel);
 		qdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
 		status = QDF_STATUS_SUCCESS;
 		break;
 	case CDS_SCC_ON_24_SCC_ON_5_24G:
 		cds_get_connection_channels(
-			channel_list, &num_channels, 1);
+			channel_list, &num_channels, 1, skip_dfs_channel);
 		qdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
 		qdf_mem_copy(&pcl_channels[num_channels],
@@ -4557,7 +4624,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 		break;
 	case CDS_SCC_ON_24_SCC_ON_5_5G:
 		cds_get_connection_channels(
-			channel_list, &num_channels, 1);
+			channel_list, &num_channels, 1, skip_dfs_channel);
 		qdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
 		qdf_mem_copy(&pcl_channels[num_channels],
@@ -4567,7 +4634,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 		break;
 	case CDS_SCC_ON_5_SCC_ON_24_24G:
 		cds_get_connection_channels(
-			channel_list, &num_channels, 2);
+			channel_list, &num_channels, 2, skip_dfs_channel);
 		qdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
 		qdf_mem_copy(&pcl_channels[num_channels],
@@ -4577,7 +4644,7 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 		break;
 	case CDS_SCC_ON_5_SCC_ON_24_5G:
 		cds_get_connection_channels(
-			channel_list, &num_channels, 2);
+			channel_list, &num_channels, 2, skip_dfs_channel);
 		qdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
 		qdf_mem_copy(&pcl_channels[num_channels],
@@ -4586,7 +4653,6 @@ QDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 		status = QDF_STATUS_SUCCESS;
 		break;
 	default:
-		/* err msg */
 		cds_err("unknown pcl value %d", pcl);
 		break;
 	}
@@ -4684,7 +4750,6 @@ QDF_STATUS cds_get_pcl(enum cds_con_mode mode,
 		conc_system_pref = CDS_LATENCY;
 		break;
 	default:
-		/* err msg */
 		cds_err("unknown conc_system_pref value %d",
 			hdd_ctx->config->conc_system_pref);
 		break;
@@ -4700,7 +4765,6 @@ QDF_STATUS cds_get_pcl(enum cds_con_mode mode,
 		second_index =
 			cds_get_second_connection_pcl_table_index();
 		if (CDS_MAX_ONE_CONNECTION_MODE == second_index) {
-			/* err msg */
 			cds_err("couldn't find index for 2nd connection pcl table");
 			return status;
 		}
@@ -4717,7 +4781,6 @@ QDF_STATUS cds_get_pcl(enum cds_con_mode mode,
 		third_index =
 			cds_get_third_connection_pcl_table_index();
 		if (CDS_MAX_TWO_CONNECTION_MODE == third_index) {
-			/* err msg */
 			cds_err("couldn't find index for 3rd connection pcl table");
 			return status;
 		}
@@ -4730,7 +4793,6 @@ QDF_STATUS cds_get_pcl(enum cds_con_mode mode,
 		}
 		break;
 	default:
-		/* err msg */
 		cds_err("unexpected num_connections value %d",
 			num_connections);
 		break;
@@ -4743,7 +4805,7 @@ QDF_STATUS cds_get_pcl(enum cds_con_mode mode,
 	/* once the PCL enum is obtained find out the exact channel list with
 	 * help from sme_get_cfg_valid_channels
 	 */
-	status = cds_get_channel_list(pcl, pcl_channels, len);
+	status = cds_get_channel_list(pcl, pcl_channels, len, mode);
 	if (status == QDF_STATUS_SUCCESS) {
 		uint32_t i;
 		cds_debug("pcl len:%d", *len);
@@ -4820,7 +4882,6 @@ bool cds_allow_new_home_channel(uint8_t channel, uint32_t num_connections)
 		if (wma_is_hw_dbs_capable() == false) {
 			if ((channel != conc_connection_list[0].chan) &&
 				(channel != conc_connection_list[1].chan)) {
-				/* err msg */
 				cds_err("don't allow 3rd home channel on same MAC");
 				status = false;
 			}
@@ -4834,7 +4895,6 @@ bool cds_allow_new_home_channel(uint8_t channel, uint32_t num_connections)
 				(conc_connection_list[0].chan)) &&
 				(CDS_IS_CHANNEL_5GHZ
 				(conc_connection_list[1].chan)))) {
-			/* err msg */
 			cds_err("don't allow 3rd home channel on same MAC");
 			status = false;
 		}
@@ -4850,7 +4910,6 @@ bool cds_allow_new_home_channel(uint8_t channel, uint32_t num_connections)
 			   ((CDS_IS_CHANNEL_5GHZ(channel)) &&
 			(CDS_IS_CHANNEL_5GHZ
 			(conc_connection_list[0].chan)))) {
-			/* err msg */
 			cds_err("don't allow 2nd home channel on same MAC");
 			status = false;
 		}
@@ -4895,6 +4954,35 @@ bool cds_is_ibss_conn_exist(uint8_t *ibss_channel)
 }
 
 /**
+ * cds_vht160_conn_exist() - to check if we have a connection
+ * already using vht160 or vht80+80
+ *
+ * This routine will check if vht160 connection already exist or
+ * no. If it exist then this routine will return true.
+ *
+ * Return: true if vht160 connection exist else false
+ */
+bool cds_vht160_conn_exist(void)
+{
+	uint32_t conn_index;
+	bool status = false;
+
+	for (conn_index = 0; conn_index < MAX_NUMBER_OF_CONC_CONNECTIONS;
+		conn_index++) {
+		if (conc_connection_list[conn_index].in_use &&
+			((conc_connection_list[conn_index].bw ==
+			HW_MODE_80_PLUS_80_MHZ) ||
+			(conc_connection_list[conn_index].bw ==
+			HW_MODE_160_MHZ))) {
+			 status = true;
+			 break;
+		}
+	}
+
+	return status;
+}
+
+/**
  * cds_allow_concurrency() - Check for allowed concurrency
  * combination
  * @mode:	new connection mode
@@ -4944,9 +5032,40 @@ bool cds_allow_concurrency(enum cds_con_mode mode,
 			num_connections))
 				goto done;
 
-		/* don't allow MCC if SAP/GO on DFS channel or about to come up
-		* on DFS channel
-		*/
+		/*
+		 * If you already have STA connection then don't
+		 * allow any other persona to make connection on DFS channel
+		 * because STA might be on non-DFS right now but later on as
+		 * part of roaming if STA connects to DFS channel which happens
+		 * to be different than requested DFS channel then MCC DFS
+		 * scenario will be encountered
+		 */
+		count = cds_mode_specific_connection_count(CDS_STA_MODE,
+								list);
+		if ((count > 0) && CDS_IS_DFS_CH(channel)) {
+			cds_err("STA active, don't allow DFS channel for 2nd connection");
+#ifndef QCA_WIFI_3_0_EMU
+			/*
+			 * REMOVE THIS COMMENT ONCE QCA_WIFI_3_0_EMU
+			 * FLAG GETS REMOVED
+			 * ==================================================
+			 * As on emulation we can support only 2 nodes max, if
+			 * we don't allow STA DFS (ch.100) + SAP DFS (ch.100)
+			 * then we can't test the mechanism on other device
+			 * where corresponding SAP DFS(ch.100) + STA DFS(
+			 * STA is trying to come up and as a result it will push
+			 * SAP on this device to non-dfs through CSA IE)
+			 * will trigger CSA.
+			 * =================================================
+			 */
+			goto done;
+#endif
+		}
+
+		/*
+		 * don't allow MCC if SAP/GO on DFS channel or about to come up
+		 * on DFS channel
+		 */
 		count = cds_mode_specific_connection_count(
 				CDS_P2P_GO_MODE, list);
 		while (index < count) {
@@ -4955,7 +5074,6 @@ bool cds_allow_concurrency(enum cds_con_mode mode,
 				(CDS_IS_CHANNEL_5GHZ(channel)) &&
 				(channel !=
 				conc_connection_list[list[index]].chan)) {
-				/* err msg */
 				cds_err("don't allow MCC if SAP/GO on DFS channel");
 				goto done;
 			}
@@ -4971,7 +5089,6 @@ bool cds_allow_concurrency(enum cds_con_mode mode,
 				(CDS_IS_CHANNEL_5GHZ(channel)) &&
 				(channel !=
 				conc_connection_list[list[index]].chan)) {
-				/* err msg */
 				cds_err("don't allow MCC if SAP/GO on DFS channel");
 				goto done;
 			}
@@ -4996,33 +5113,28 @@ bool cds_allow_concurrency(enum cds_con_mode mode,
 	if ((CDS_IBSS_MODE == mode) &&
 		(cds_mode_specific_connection_count(
 		CDS_IBSS_MODE, list)) && count) {
-		/* err msg */
 		cds_err("No 2nd IBSS, we already have STA + IBSS");
 		goto done;
 	}
 	if ((CDS_IBSS_MODE == mode) &&
 		(CDS_IS_DFS_CH(channel)) && count) {
-		/* err msg */
 		cds_err("No IBSS + STA SCC/MCC, IBSS is on DFS channel");
 		goto done;
 	}
 	if (CDS_IBSS_MODE == mode) {
 		if (wma_is_hw_dbs_capable() == true) {
 			if (num_connections > 1) {
-				/* err msg */
 				cds_err("No IBSS, we have concurrent connections already");
 				goto done;
 			}
 #ifndef QCA_WIFI_3_0_EMU
 			if (CDS_STA_MODE != conc_connection_list[0].mode) {
-				/* err msg */
 				cds_err("No IBSS, we've a non-STA connection");
 				goto done;
 			}
 #else
 			if (CDS_STA_MODE != conc_connection_list[0].mode &&
 				CDS_SAP_MODE != conc_connection_list[0].mode) {
-				/* err msg */
 				cds_err("No IBSS, we've a non-STA/SAP conn");
 				goto done;
 			}
@@ -5036,12 +5148,10 @@ bool cds_allow_concurrency(enum cds_con_mode mode,
 				(conc_connection_list[0].chan != channel) &&
 				CDS_IS_SAME_BAND_CHANNELS(
 				conc_connection_list[0].chan, channel)) {
-				/* err msg */
 				cds_err("No IBSS + STA MCC");
 				goto done;
 			}
 		} else if (num_connections) {
-			/* err msg */
 			cds_err("No IBSS, we have one connection already");
 			goto done;
 		}
@@ -5050,7 +5160,6 @@ bool cds_allow_concurrency(enum cds_con_mode mode,
 	if ((CDS_STA_MODE == mode) &&
 		(cds_mode_specific_connection_count(
 		CDS_IBSS_MODE, list)) && count) {
-		/* err msg */
 		cds_err("No 2nd STA, we already have STA + IBSS");
 		goto done;
 	}
@@ -5059,14 +5168,12 @@ bool cds_allow_concurrency(enum cds_con_mode mode,
 		(cds_mode_specific_connection_count(CDS_IBSS_MODE, list))) {
 		if (wma_is_hw_dbs_capable() == true) {
 			if (num_connections > 1) {
-				/* err msg */
 				cds_err("No 2nd STA, we already have IBSS concurrency");
 				goto done;
 			}
 			if (channel &&
 				(CDS_IS_DFS_CH(conc_connection_list[0].chan))
 				&& (CDS_IS_CHANNEL_5GHZ(channel))) {
-				/* err msg */
 				cds_err("No IBSS + STA SCC/MCC, IBSS is on DFS channel");
 				goto done;
 			}
@@ -5078,25 +5185,27 @@ bool cds_allow_concurrency(enum cds_con_mode mode,
 			if ((conc_connection_list[0].chan != channel) &&
 				CDS_IS_SAME_BAND_CHANNELS(
 				conc_connection_list[0].chan, channel)) {
-				/* err msg */
 				cds_err("No IBSS + STA MCC");
 				goto done;
 			}
 		} else {
-			/* err msg */
 			cds_err("No STA, we have IBSS connection already");
 			goto done;
 		}
 	}
 
-	/* can we allow vht160 */
+	/* don't allow concurrency on vht160 or vht 80+80 */
 	if (num_connections &&
 		((bw == HW_MODE_80_PLUS_80_MHZ) || (bw == HW_MODE_160_MHZ))) {
-		/* err msg */
 		cds_err("No VHT160, we have one connection already");
 		goto done;
 	}
 
+	if (cds_vht160_conn_exist()) {
+		cds_err("VHT160/80+80 connection exists, no concurrency");
+		goto done;
+	}
+
 	/* don't allow two P2P GO on same band */
 	if (channel && (mode == CDS_P2P_GO_MODE) && num_connections) {
 		index = 0;
@@ -5644,7 +5753,6 @@ QDF_STATUS cds_current_connections_update(uint32_t session_id,
 		second_index =
 			cds_get_second_connection_pcl_table_index();
 		if (CDS_MAX_ONE_CONNECTION_MODE == second_index) {
-			/* err msg */
 			cds_err("couldn't find index for 2nd connection next action table");
 			goto done;
 		}
@@ -5655,7 +5763,6 @@ QDF_STATUS cds_current_connections_update(uint32_t session_id,
 		third_index =
 			cds_get_third_connection_pcl_table_index();
 		if (CDS_MAX_TWO_CONNECTION_MODE == third_index) {
-			/* err msg */
 			cds_err("couldn't find index for 3rd connection next action table");
 			goto done;
 		}
@@ -5663,7 +5770,6 @@ QDF_STATUS cds_current_connections_update(uint32_t session_id,
 			next_action_three_connection_table[third_index][band];
 		break;
 	default:
-		/* err msg */
 		cds_err("unexpected num_connections value %d", num_connections);
 		break;
 	}
@@ -5981,7 +6087,6 @@ QDF_STATUS cds_next_actions(uint32_t session_id,
 						reason);
 		break;
 	default:
-		/* err msg */
 		cds_err("unexpected action value %d", action);
 		status = QDF_STATUS_E_FAILURE;
 		break;
@@ -7386,7 +7491,8 @@ QDF_STATUS cds_update_connection_info_utfw(
 
 	cds_update_conc_list(conn_index,
 			cds_get_mode(type, sub_type),
-			channelid, mac_id, chain_mask, tx_streams,
+			channelid, HW_MODE_20_MHZ,
+			mac_id, chain_mask, tx_streams,
 			rx_streams, 0, vdev_id, true);
 	qdf_mutex_release(&cds_ctx->qdf_conc_list_lock);
 
@@ -7427,9 +7533,10 @@ QDF_STATUS cds_incr_connection_count_utfw(
 	cds_info("--> filling entry at index[%d]", conn_index);
 
 	cds_update_conc_list(conn_index,
-			     cds_get_mode(type, sub_type),
-			     channelid, mac_id, chain_mask, tx_streams,
-			     rx_streams, 0, vdev_id, true);
+				cds_get_mode(type, sub_type),
+				channelid, HW_MODE_20_MHZ,
+				mac_id, chain_mask, tx_streams,
+				rx_streams, 0, vdev_id, true);
 	qdf_mutex_release(&cds_ctx->qdf_conc_list_lock);
 
 	return QDF_STATUS_SUCCESS;
@@ -7827,6 +7934,15 @@ enum cds_conc_next_action cds_get_pref_hw_mode_for_chan(uint32_t vdev_id,
 	uint32_t conn_index = 0;
 	bool found = false;
 	uint8_t old_band, new_band;
+#ifdef QCA_WIFI_3_0_EMU
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return CDS_NOP;
+	}
+#endif
 
 	while (CONC_CONNECTION_LIST_VALID_INDEX(conn_index)) {
 		if ((vdev_id == conc_connection_list[conn_index].vdev_id) &&
@@ -7862,6 +7978,14 @@ enum cds_conc_next_action cds_get_pref_hw_mode_for_chan(uint32_t vdev_id,
 
 	switch (num_connections) {
 	case 1:
+#ifdef QCA_WIFI_3_0_EMU
+		/* For M2M emulation only: if it is a connection on 2.4,
+		 * request DBS
+		 */
+		if (hdd_ctx->config->enable_m2m_limitation &&
+				CDS_IS_CHANNEL_24GHZ(target_channel))
+			return CDS_DBS_DOWNGRADE;
+#endif
 		/* The driver would already be in the required hw mode */
 		return CDS_NOP;
 	case 2:
@@ -8068,3 +8192,107 @@ QDF_STATUS cds_register_sap_restart_channel_switch_cb(
 	return QDF_STATUS_SUCCESS;
 }
 #endif
+
+
+
+/**
+ * cds_get_nondfs_preferred_channel() - to get non-dfs preferred channel
+ *                                           for given mode
+ * @mode: mode for which preferred non-dfs channel is requested
+ * @for_existing_conn: flag to indicate if preferred channel is requested
+ *                     for existing connection
+ *
+ * this routine will return non-dfs channel
+ * 1) for getting non-dfs preferred channel, first we check if there are any
+ *    other connection exist whose channel is non-dfs. if yes then return that
+ *    channel so that we can accommodate upto 3 mode concurrency.
+ * 2) if there no any other connection present then query concurrency module
+ *    to give preferred channel list. once we get preferred channel list, loop
+ *    through list to find first non-dfs channel from ascending order.
+ *
+ * Return: uint8_t non-dfs channel
+ */
+uint8_t
+cds_get_nondfs_preferred_channel(enum cds_con_mode mode,
+		bool for_existing_conn)
+{
+	uint8_t pcl_channels[NUM_CHANNELS];
+	/*
+	 * in worst case if we can't find any channel at all
+	 * then return 2.4G channel, so atleast we won't fall
+	 * under 5G MCC scenario
+	 */
+	uint8_t channel = CDS_24_GHZ_CHANNEL_6;
+	uint32_t i, pcl_len;
+
+	if (true == for_existing_conn) {
+		/*
+		 * First try to see if there is any non-dfs channel already
+		 * present in current connection table. If yes then return
+		 * that channel
+		 */
+		if (true == cds_is_any_nondfs_chnl_present(&channel))
+			return channel;
+
+		if (QDF_STATUS_SUCCESS != cds_get_pcl_for_existing_conn(mode,
+					&pcl_channels[0], &pcl_len))
+			return channel;
+	} else {
+		if (QDF_STATUS_SUCCESS != cds_get_pcl(mode,
+					&pcl_channels[0], &pcl_len))
+			return channel;
+	}
+
+	for (i = 0; i < pcl_len; i++) {
+#ifdef QCA_WIFI_3_0_EMU
+		/*
+		 * for Emulation platform MCC is not allowed.
+		 * so better don't return 5G channel as this API mostly
+		 * called when one more persona wants to come up on 5G band
+		 */
+		if (CDS_IS_CHANNEL_5GHZ(pcl_channels[i])) {
+			continue;
+		}
+#endif
+		if (CDS_IS_DFS_CH(pcl_channels[i])) {
+			continue;
+		} else {
+			channel = pcl_channels[i];
+			break;
+		}
+	}
+	return channel;
+}
+/**
+ * cds_is_any_nondfs_chnl_present() - Find any non-dfs channel from conc table
+ * @channel: pointer to channel which needs to be filled
+ *
+ * In-case if any connection is already present whose channel is none dfs then
+ * return that channel
+ *
+ * Return: true up-on finding non-dfs channel else false
+ */
+bool cds_is_any_nondfs_chnl_present(uint8_t *channel)
+{
+	cds_context_type *cds_ctx;
+	bool status = false;
+	uint32_t conn_index = 0;
+	cds_ctx = cds_get_context(QDF_MODULE_ID_QDF);
+
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return false;
+	}
+	qdf_mutex_acquire(&cds_ctx->qdf_conc_list_lock);
+	for (conn_index = 0; conn_index < MAX_NUMBER_OF_CONC_CONNECTIONS;
+			conn_index++) {
+		if (conc_connection_list[conn_index].in_use &&
+		    !CDS_IS_DFS_CH(conc_connection_list[conn_index].chan)) {
+			*channel = conc_connection_list[conn_index].chan;
+			status = true;
+		}
+	}
+	qdf_mutex_release(&cds_ctx->qdf_conc_list_lock);
+	return status;
+}
+
diff --git a/core/cds/src/cds_reg_service.c b/core/cds/src/cds_reg_service.c
index d43acc041225..cd0ed13839c2 100644
--- a/core/cds/src/cds_reg_service.c
+++ b/core/cds/src/cds_reg_service.c
@@ -101,9 +101,58 @@ const struct chan_map chan_mapping[NUM_CHANNELS] = {
 	[CHAN_ENUM_184] = {5920, 184},
 };
 
+/**
+ * struct bonded_chan
+ * @start_ch: start channel
+ * @end_ch: end channel
+ */
+struct bonded_chan {
+	uint16_t start_ch;
+	uint16_t end_ch;
+};
+
+static const struct bonded_chan bonded_chan_40mhz_array[] = {
+	{36, 40},
+	{44, 48},
+	{52, 56},
+	{60, 64},
+	{100, 104},
+	{108, 112},
+	{116, 120},
+	{124, 128},
+	{132, 136},
+	{140, 144},
+	{149, 153},
+	{157, 161}
+};
+
+static const struct bonded_chan bonded_chan_80mhz_array[] = {
+	{36, 48},
+	{52, 64},
+	{100, 112},
+	{116, 128},
+	{132, 144},
+	{149, 161}
+};
+
+static const struct bonded_chan bonded_chan_160mhz_array[] = {
+	{36, 64},
+	{100, 128}
+};
+
+static const enum phy_ch_width next_lower_bw[] = {
+	[CH_WIDTH_80P80MHZ] = CH_WIDTH_160MHZ,
+	[CH_WIDTH_160MHZ] = CH_WIDTH_80MHZ,
+	[CH_WIDTH_80MHZ] = CH_WIDTH_40MHZ,
+	[CH_WIDTH_40MHZ] = CH_WIDTH_20MHZ,
+	[CH_WIDTH_20MHZ] = CH_WIDTH_10MHZ,
+	[CH_WIDTH_10MHZ] = CH_WIDTH_5MHZ,
+	[CH_WIDTH_5MHZ] = CH_WIDTH_INVALID
+};
+
 struct regulatory_channel reg_channels[NUM_CHANNELS];
-uint8_t default_country[CDS_COUNTRY_CODE_LEN + 1];
-uint8_t dfs_region;
+static uint8_t default_country[CDS_COUNTRY_CODE_LEN + 1];
+static uint8_t dfs_region;
 
 /**
  * cds_get_channel_list_with_power() - retrieve channel list with power
@@ -121,15 +170,7 @@ QDF_STATUS cds_get_channel_list_with_power(struct channel_power
 
 	if (base_channels && num_base_channels) {
 		count = 0;
-		for (i = 0; i <= CHAN_ENUM_14; i++) {
-			if (reg_channels[i].state) {
-				base_channels[count].chan_num =
-					chan_mapping[i].chan_num;
-				base_channels[count++].power =
-					reg_channels[i].pwr_limit;
-			}
-		}
-		for (i = CHAN_ENUM_36; i <= CHAN_ENUM_184; i++) {
+		for (i = 0; i < NUM_CHANNELS; i++) {
 			if (reg_channels[i].state) {
 				base_channels[count].chan_num =
 					chan_mapping[i].chan_num;
@@ -203,82 +244,308 @@ enum channel_state cds_get_channel_state(uint32_t chan_num)
 
 
 /**
- * cds_get_bonded_channel_state() - get the bonded channel state
- * @channel_num: channel number
+ * cds_search_5g_bonded_chan_array() - get ptr to bonded channel
+ * @oper_ch: operating channel number
+ * @bonded_chan_ar: bonded channel array
+ * @bonded_chan_ptr_ptr: bonded channel ptr ptr
+ *
+ * Return: bonded channel state
+ */
+static enum channel_state cds_search_5g_bonded_chan_array(uint32_t oper_chan,
+							const struct bonded_chan
+							bonded_chan_ar[],
+							uint16_t array_size,
+							const struct bonded_chan
+							**bonded_chan_ptr_ptr)
+{
+	int i;
+	uint8_t chan_num;
+	const struct bonded_chan *bonded_chan_ptr = NULL;
+	enum channel_state chan_state = CHANNEL_STATE_INVALID;
+	enum channel_state temp_chan_state;
+
+	for (i = 0; i < array_size; i++) {
+		if ((oper_chan >= bonded_chan_ar[i].start_ch) &&
+		    (oper_chan <= bonded_chan_ar[i].end_ch)) {
+			bonded_chan_ptr =  &(bonded_chan_ar[i]);
+			break;
+		}
+	}
+
+	if (NULL == bonded_chan_ptr)
+		return chan_state;
+
+	*bonded_chan_ptr_ptr = bonded_chan_ptr;
+	chan_num =  bonded_chan_ptr->start_ch;
+	while (chan_num <= bonded_chan_ptr->end_ch) {
+		temp_chan_state = cds_get_channel_state(chan_num);
+		if (temp_chan_state < chan_state)
+			chan_state = temp_chan_state;
+		chan_num = chan_num + 4;
+	}
+
+	return chan_state;
+}
+
+/**
+ * cds_search_5g_bonded_channel() - get the 5G bonded channel state
+ * @chan_num: channel number
+ * @ch_width: channel width
+ * @bonded_chan_ptr_ptr: bonded channel ptr ptr
+ *
+ * Return: channel state
+ */
+static enum channel_state cds_search_5g_bonded_channel(uint32_t chan_num,
+						enum phy_ch_width ch_width,
+						const struct bonded_chan
+						**bonded_chan_ptr_ptr)
+{
+
+	if (CH_WIDTH_80P80MHZ == ch_width)
+		return cds_search_5g_bonded_chan_array(chan_num,
+						       bonded_chan_80mhz_array,
+						       QDF_ARRAY_SIZE(bonded_chan_80mhz_array),
+						       bonded_chan_ptr_ptr);
+	else if (CH_WIDTH_160MHZ == ch_width)
+		return cds_search_5g_bonded_chan_array(chan_num,
+						       bonded_chan_160mhz_array,
+						       QDF_ARRAY_SIZE(bonded_chan_160mhz_array),
+						       bonded_chan_ptr_ptr);
+	else if (CH_WIDTH_80MHZ == ch_width)
+		return cds_search_5g_bonded_chan_array(chan_num,
+						       bonded_chan_80mhz_array,
+						       QDF_ARRAY_SIZE(bonded_chan_80mhz_array),
+						       bonded_chan_ptr_ptr);
+	else if (CH_WIDTH_40MHZ == ch_width)
+		return cds_search_5g_bonded_chan_array(chan_num,
+						       bonded_chan_40mhz_array,
+						       QDF_ARRAY_SIZE(bonded_chan_40mhz_array),
+						       bonded_chan_ptr_ptr);
+	else
+		return cds_get_channel_state(chan_num);
+}
+
+/**
+ * cds_get_2g_bonded_channel_state() - get the 2G bonded channel state
+ * @oper_ch: operating channel
+ * @ch_width: channel width
+ * @sec_ch: secondary channel
  *
  * Return: channel state
  */
-enum channel_state cds_get_bonded_channel_state(uint32_t chan_num,
-					   enum phy_ch_width ch_width)
+enum channel_state cds_get_2g_bonded_channel_state(uint16_t oper_ch,
+						  enum phy_ch_width ch_width,
+						  uint16_t sec_ch)
 {
 	enum channel_enum chan_enum;
+	enum channel_state chan_state;
 	bool bw_enabled = false;
+	enum channel_state chan_state2 = CHANNEL_STATE_INVALID;
 
-	chan_enum = cds_get_channel_enum(chan_num);
-	if (INVALID_CHANNEL == chan_enum)
+	if (CH_WIDTH_40MHZ < ch_width)
 		return CHANNEL_STATE_INVALID;
 
-	if (reg_channels[chan_enum].state) {
-		if (CH_WIDTH_5MHZ == ch_width)
-			bw_enabled = 1;
-		else if (CH_WIDTH_10MHZ == ch_width)
-			bw_enabled = !(reg_channels[chan_enum].flags &
-				       IEEE80211_CHAN_NO_10MHZ);
-		else if (CH_WIDTH_20MHZ == ch_width)
-			bw_enabled = !(reg_channels[chan_enum].flags &
-				       IEEE80211_CHAN_NO_20MHZ);
-		else if (CH_WIDTH_40MHZ == ch_width)
-			bw_enabled = !(reg_channels[chan_enum].flags &
-				       IEEE80211_CHAN_NO_HT40);
-		else if (CH_WIDTH_80MHZ == ch_width)
-			bw_enabled = !(reg_channels[chan_enum].flags &
-				       IEEE80211_CHAN_NO_80MHZ);
-		else if (CH_WIDTH_160MHZ == ch_width)
-			bw_enabled = !(reg_channels[chan_enum].flags &
-				       IEEE80211_CHAN_NO_160MHZ);
+	if (CH_WIDTH_40MHZ == ch_width) {
+		if ((sec_ch + 4 != oper_ch) ||
+		    (oper_ch + 4 != sec_ch))
+			return CHANNEL_STATE_INVALID;
+		chan_state2 = cds_get_channel_state(sec_ch);
+		if (CHANNEL_STATE_INVALID == chan_state2)
+			return chan_state2;
 	}
 
+	chan_state = cds_get_channel_state(oper_ch);
+	if (chan_state2 < chan_state)
+		chan_state = chan_state2;
+
+	if ((CHANNEL_STATE_INVALID == chan_state) ||
+	    (CHANNEL_STATE_DISABLE == chan_state))
+		return chan_state;
+
+	chan_enum = cds_get_channel_enum(oper_ch);
+	if (CH_WIDTH_5MHZ == ch_width)
+		bw_enabled = true;
+	else if (CH_WIDTH_10MHZ == ch_width)
+		bw_enabled = !(reg_channels[chan_enum].flags &
+			       IEEE80211_CHAN_NO_10MHZ);
+	else if (CH_WIDTH_20MHZ == ch_width)
+		bw_enabled = !(reg_channels[chan_enum].flags &
+			       IEEE80211_CHAN_NO_20MHZ);
+	else if (CH_WIDTH_40MHZ == ch_width)
+		bw_enabled = !(reg_channels[chan_enum].flags &
+			       IEEE80211_CHAN_NO_HT40);
+
 	if (bw_enabled)
-		return reg_channels[chan_enum].state;
+		return chan_state;
 	else
 		return CHANNEL_STATE_DISABLE;
 }
 
 /**
- * cds_get_max_channel_bw() - get the max channel bandwidth
- * @channel_num: channel number
+ * cds_get_5g_bonded_channel_state() - get the 5G bonded channel state
+ * @chan_num: channel number
+ * @ch_width: channel width
  *
- * Return: channel_width
+ * Return: channel state
  */
-enum phy_ch_width cds_get_max_channel_bw(uint32_t chan_num)
+enum channel_state cds_get_5g_bonded_channel_state(
+	uint16_t chan_num,
+	enum phy_ch_width ch_width)
 {
 	enum channel_enum chan_enum;
-	enum phy_ch_width chan_bw = CH_WIDTH_INVALID;
+	enum channel_state chan_state;
+	bool bw_enabled = false;
+	const struct bonded_chan *bonded_chan_ptr = NULL;
+
+	if (CH_WIDTH_80P80MHZ < ch_width)
+		return CHANNEL_STATE_INVALID;
+
+	chan_state = cds_search_5g_bonded_channel(chan_num, ch_width,
+						  &bonded_chan_ptr);
+
+	if ((CHANNEL_STATE_INVALID == chan_state) ||
+	    (CHANNEL_STATE_DISABLE == chan_state))
+		return chan_state;
 
 	chan_enum = cds_get_channel_enum(chan_num);
+	if (CH_WIDTH_5MHZ == ch_width)
+		bw_enabled = true;
+	else if (CH_WIDTH_10MHZ == ch_width)
+		bw_enabled = !(reg_channels[chan_enum].flags &
+			       IEEE80211_CHAN_NO_10MHZ);
+	else if (CH_WIDTH_20MHZ == ch_width)
+		bw_enabled = !(reg_channels[chan_enum].flags &
+			       IEEE80211_CHAN_NO_20MHZ);
+	else if (CH_WIDTH_40MHZ == ch_width)
+		bw_enabled = !(reg_channels[chan_enum].flags &
+			       IEEE80211_CHAN_NO_HT40);
+	else if (CH_WIDTH_80MHZ == ch_width)
+		bw_enabled = !(reg_channels[chan_enum].flags &
+			       IEEE80211_CHAN_NO_80MHZ);
+	else if (CH_WIDTH_160MHZ == ch_width)
+		bw_enabled = !(reg_channels[chan_enum].flags &
+			       IEEE80211_CHAN_NO_160MHZ);
+	else if (CH_WIDTH_80P80MHZ == ch_width)
+		bw_enabled = !(reg_channels[chan_enum].flags &
+			       IEEE80211_CHAN_NO_80MHZ);
+
+	if (bw_enabled)
+		return chan_state;
+	else
+		return CHANNEL_STATE_DISABLE;
+}
+
+
+/**
+ * cds_set_5g_channel_params() - set the 5G bonded channel parameters
+ * @oper_ch: opetrating channel
+ * @ch_params: channel parameters
+ *
+ * Return: void
+ */
+static void cds_set_5g_channel_params(uint16_t oper_ch,
+				      struct ch_params_s *ch_params)
+{
+	enum channel_state chan_state = CHANNEL_STATE_ENABLE;
+	enum channel_state chan_state2 = CHANNEL_STATE_ENABLE;
+	const struct bonded_chan *bonded_chan_ptr;
+
+	if (CH_WIDTH_MAX >= ch_params->ch_width)
+		ch_params->ch_width = CH_WIDTH_80P80MHZ;
+
+	while (ch_params->ch_width != CH_WIDTH_INVALID) {
+		chan_state = cds_search_5g_bonded_channel(oper_ch,
+							  ch_params->ch_width,
+							  &bonded_chan_ptr);
+
+		chan_state = cds_get_5g_bonded_channel_state(oper_ch,
+							  ch_params->ch_width);
+
+		if (CH_WIDTH_80P80MHZ == ch_params->ch_width)
+			chan_state2 = cds_get_5g_bonded_channel_state(
+				ch_params->center_freq_seg1 - 2,
+				CH_WIDTH_80MHZ);
+
+		if (chan_state2 < chan_state)
+			chan_state = chan_state2;
+		if ((CHANNEL_STATE_ENABLE == chan_state) ||
+		    (CHANNEL_STATE_DFS == chan_state)) {
+			if (CH_WIDTH_20MHZ >= ch_params->ch_width)
+				ch_params->sec_ch_offset
+					= PHY_SINGLE_CHANNEL_CENTERED;
+			else if (CH_WIDTH_40MHZ == ch_params->ch_width) {
+				if (oper_ch == bonded_chan_ptr->start_ch)
+					ch_params->sec_ch_offset =
+						PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
+				else
+					ch_params->sec_ch_offset =
+						PHY_DOUBLE_CHANNEL_HIGH_PRIMARY;
+			}
+
+			ch_params->center_freq_seg0 =
+				(bonded_chan_ptr->start_ch +
+				 bonded_chan_ptr->end_ch)/2;
+			break;
+		}
+
+		ch_params->ch_width = next_lower_bw[ch_params->ch_width];
+	}
+}
+
+/**
+ * cds_set_2g_channel_params() - set the 2.4G bonded channel parameters
+ * @oper_ch: operating channel
+ * @ch_params: channel parameters
+ * @sec_ch_2g: 2.4G secondary channel
+ *
+ * Return: void
+ */
+static void cds_set_2g_channel_params(uint16_t oper_ch,
+			       struct ch_params_s *ch_params,
+			       uint16_t sec_ch_2g)
+{
+	enum channel_state chan_state = CHANNEL_STATE_ENABLE;
+
+	if (CH_WIDTH_MAX >= ch_params->ch_width)
+		ch_params->ch_width = CH_WIDTH_80P80MHZ;
+
+	while (ch_params->ch_width != CH_WIDTH_INVALID) {
+		chan_state = cds_get_2g_bonded_channel_state(oper_ch,
+							    ch_params->ch_width,
+							    sec_ch_2g);
+		if (CHANNEL_STATE_ENABLE == chan_state) {
+			if (CH_WIDTH_40MHZ == ch_params->ch_width) {
+				if (oper_ch < sec_ch_2g)
+					ch_params->sec_ch_offset =
+						PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
+				else
+					ch_params->sec_ch_offset =
+						PHY_DOUBLE_CHANNEL_HIGH_PRIMARY;
+			} else
+				ch_params->sec_ch_offset =
+					PHY_SINGLE_CHANNEL_CENTERED;
+			break;
+		}
 
-	if ((INVALID_CHANNEL != chan_enum) &&
-	    (CHANNEL_STATE_DISABLE != reg_channels[chan_enum].state)) {
-
-		if (!(reg_channels[chan_enum].flags &
-		      IEEE80211_CHAN_NO_160MHZ))
-			chan_bw = CH_WIDTH_160MHZ;
-		else if (!(reg_channels[chan_enum].flags &
-			   IEEE80211_CHAN_NO_80MHZ))
-			chan_bw = CH_WIDTH_80MHZ;
-		else if (!(reg_channels[chan_enum].flags &
-			   IEEE80211_CHAN_NO_HT40))
-			chan_bw = CH_WIDTH_40MHZ;
-		else if (!(reg_channels[chan_enum].flags &
-			   IEEE80211_CHAN_NO_20MHZ))
-			chan_bw = CH_WIDTH_20MHZ;
-		else if (!(reg_channels[chan_enum].flags &
-			   IEEE80211_CHAN_NO_10MHZ))
-			chan_bw = CH_WIDTH_10MHZ;
-		else
-			chan_bw = CH_WIDTH_5MHZ;
+		ch_params->ch_width = next_lower_bw[ch_params->ch_width];
 	}
-	return chan_bw;
+}
+
+/**
+ * cds_set_channel_params() - set the bonded channel parameters
+ * @oper_ch: operating channel
+ * @sec_ch_2g: 2.4G secondary channel
+ * @ch_params: chanel parameters
+ *
+ * Return: void
+ */
+void cds_set_channel_params(uint16_t oper_ch, uint16_t sec_ch_2g,
+			    struct ch_params_s *ch_params)
+{
+	if (CDS_IS_CHANNEL_5GHZ(oper_ch))
+		cds_set_5g_channel_params(oper_ch, ch_params);
+	else if  (CDS_IS_CHANNEL_24GHZ(oper_ch))
+		cds_set_2g_channel_params(oper_ch, ch_params, sec_ch_2g);
 }
 
 /**
@@ -347,9 +614,9 @@ bool cds_is_dsrc_channel(uint16_t center_freq)
 {
 	if (center_freq >= 5852 &&
 	    center_freq <= 5920)
-		return 1;
+		return true;
 
-	return 0;
+	return false;
 }
 
 /**
diff --git a/core/cds/src/cds_sched.c b/core/cds/src/cds_sched.c
index cf0983c0f94f..bbf9b754d775 100644
--- a/core/cds/src/cds_sched.c
+++ b/core/cds/src/cds_sched.c
@@ -564,11 +564,10 @@ static int cds_mc_thread(void *Arg)
 				clear_bit(MC_SUSPEND_EVENT_MASK,
 					  &pSchedContext->mcEventFlag);
 				spin_lock(&pSchedContext->McThreadLock);
-
+				INIT_COMPLETION(pSchedContext->ResumeMcEvent);
 				/* Mc Thread Suspended */
 				complete(&pHddCtx->mc_sus_event_var);
 
-				INIT_COMPLETION(pSchedContext->ResumeMcEvent);
 				spin_unlock(&pSchedContext->McThreadLock);
 
 				/* Wait foe Resume Indication */
@@ -866,9 +865,9 @@ static int cds_ol_rx_thread(void *arg)
 				clear_bit(RX_SUSPEND_EVENT_MASK,
 					  &pSchedContext->ol_rx_event_flag);
 				spin_lock(&pSchedContext->ol_rx_thread_lock);
-				complete(&pSchedContext->ol_suspend_rx_event);
 				INIT_COMPLETION
 					(pSchedContext->ol_resume_rx_event);
+				complete(&pSchedContext->ol_suspend_rx_event);
 				spin_unlock(&pSchedContext->ol_rx_thread_lock);
 				wait_for_completion_interruptible
 					(&pSchedContext->ol_resume_rx_event);
diff --git a/core/dp/htt/htt.c b/core/dp/htt/htt.c
index 8b6afd1f9b59..58860948dd5e 100644
--- a/core/dp/htt/htt.c
+++ b/core/dp/htt/htt.c
@@ -44,6 +44,7 @@
 
 #include <htt_internal.h>
 #include <ol_htt_tx_api.h>
+#include <cds_api.h>
 #include "hif.h"
 
 #define HTT_HTC_PKT_POOL_INIT_SIZE 100  /* enough for a large A-MPDU */
@@ -193,10 +194,19 @@ htt_pdev_alloc(ol_txrx_pdev_handle txrx_pdev,
 	 */
 /* AR6004 don't need HTT layer. */
 #ifndef AR6004_HW
-	if (htt_htc_attach(pdev))
+	if (htt_htc_attach(pdev, HTT_DATA_MSG_SVC))
 		goto fail2;
+	if (htt_htc_attach(pdev, HTT_DATA2_MSG_SVC))
+		;
+	/* TODO: enable the following line once FW is ready */
+	/* goto fail2; */
+	if (htt_htc_attach(pdev, HTT_DATA3_MSG_SVC))
+		;
+	/* TODO: enable the following line once FW is ready */
+	/* goto fail2; */
 	if (hif_ce_fastpath_cb_register(htt_t2h_msg_handler_fast, pdev))
 		qdf_print("failed to register fastpath callback\n");
+
 #endif
 
 	return pdev;
@@ -393,7 +403,43 @@ int htt_pkt_dl_len_get(struct htt_pdev_t *htt_dev)
 }
 #endif
 
-int htt_htc_attach(struct htt_pdev_t *pdev)
+static inline
+int htt_update_endpoint(struct htt_pdev_t *pdev,
+			uint16_t service_id, HTC_ENDPOINT_ID ep)
+{
+	struct hif_opaque_softc *hif_ctx;
+	uint8_t ul = 0xff, dl = 0xff;
+	int     ul_polled, dl_polled;
+	int     tx_service = 0;
+	int     rc = 0;
+
+	hif_ctx = cds_get_context(QDF_MODULE_ID_HIF);
+	if (qdf_unlikely(NULL == hif_ctx)) {
+		QDF_ASSERT(NULL != hif_ctx);
+		qdf_print("%s:%d: assuming non-tx service.",
+			  __func__, __LINE__);
+	} else {
+		ul = dl = 0xff;
+		if (QDF_STATUS_SUCCESS !=
+		    hif_map_service_to_pipe(hif_ctx, service_id,
+					    &ul, &dl,
+					    &ul_polled, &dl_polled))
+			qdf_print("%s:%d: assuming non-tx srv.",
+				  __func__, __LINE__);
+		else
+			tx_service = (ul != 0xff);
+	}
+	if (tx_service) {
+		/* currently we have only one OUT htt tx service */
+		QDF_BUG(service_id == HTT_DATA_MSG_SVC);
+
+		pdev->htc_tx_endpoint = ep;
+		rc = 1;
+	}
+		return rc;
+}
+
+int htt_htc_attach(struct htt_pdev_t *pdev, uint16_t service_id)
 {
 	HTC_SERVICE_CONNECT_REQ connect;
 	HTC_SERVICE_CONNECT_RESP response;
@@ -428,14 +474,14 @@ int htt_htc_attach(struct htt_pdev_t *pdev)
 #endif
 
 	/* connect to control service */
-	connect.service_id = HTT_DATA_MSG_SVC;
+	connect.service_id = service_id;
 
 	status = htc_connect_service(pdev->htc_pdev, &connect, &response);
 
 	if (status != A_OK)
 		return -EIO;       /* failure */
 
-	pdev->htc_endpoint = response.Endpoint;
+	htt_update_endpoint(pdev, service_id, response.Endpoint);
 
 	return 0;               /* success */
 }
diff --git a/core/dp/htt/htt_h2t.c b/core/dp/htt/htt_h2t.c
index 2246e7fda1b8..a1c020279d4c 100644
--- a/core/dp/htt/htt_h2t.c
+++ b/core/dp/htt/htt_h2t.c
@@ -136,7 +136,7 @@ A_STATUS htt_h2t_frag_desc_bank_cfg_msg(struct htt_pdev_t *pdev)
 	/* fill in the message contents */
 	msg_word = (u_int32_t *) qdf_nbuf_data(msg);
 
-	memset(msg_word, 0 , sizeof(struct htt_tx_frag_desc_bank_cfg_t));
+	memset(msg_word, 0, sizeof(struct htt_tx_frag_desc_bank_cfg_t));
 	/* rewind beyond alignment pad to get to the HTC header reserved area */
 	qdf_nbuf_push_head(msg, HTC_HDR_ALIGNMENT_PADDING);
 
@@ -172,7 +172,7 @@ A_STATUS htt_h2t_frag_desc_bank_cfg_msg(struct htt_pdev_t *pdev)
 		htt_h2t_send_complete_free_netbuf,
 		qdf_nbuf_data(msg),
 		qdf_nbuf_len(msg),
-		pdev->htc_endpoint,
+		pdev->htc_tx_endpoint,
 		1); /* tag - not relevant here */
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
@@ -229,7 +229,7 @@ A_STATUS htt_h2t_ver_req_msg(struct htt_pdev_t *pdev)
 	SET_HTC_PACKET_INFO_TX(&pkt->htc_pkt,
 			       htt_h2t_send_complete_free_netbuf,
 			       qdf_nbuf_data(msg), qdf_nbuf_len(msg),
-			       pdev->htc_endpoint,
+			       pdev->htc_tx_endpoint,
 			       1); /* tag - not relevant here */
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
@@ -414,7 +414,7 @@ A_STATUS htt_h2t_rx_ring_cfg_msg_ll(struct htt_pdev_t *pdev)
 			       htt_h2t_send_complete_free_netbuf,
 			       qdf_nbuf_data(msg),
 			       qdf_nbuf_len(msg),
-			       pdev->htc_endpoint,
+			       pdev->htc_tx_endpoint,
 			       HTC_TX_PACKET_TAG_RUNTIME_PUT);
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
@@ -504,7 +504,7 @@ htt_h2t_dbg_stats_get(struct htt_pdev_t *pdev,
 			       htt_h2t_send_complete_free_netbuf,
 			       qdf_nbuf_data(msg),
 			       qdf_nbuf_len(msg),
-			       pdev->htc_endpoint,
+			       pdev->htc_tx_endpoint,
 			       htc_tag); /* tag - not relevant here */
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
@@ -560,7 +560,7 @@ A_STATUS htt_h2t_sync_msg(struct htt_pdev_t *pdev, uint8_t sync_cnt)
 			       htt_h2t_send_complete_free_netbuf,
 			       qdf_nbuf_data(msg),
 			       qdf_nbuf_len(msg),
-			       pdev->htc_endpoint,
+			       pdev->htc_tx_endpoint,
 			       HTC_TX_PACKET_TAG_RUNTIME_PUT);
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
@@ -627,7 +627,7 @@ htt_h2t_aggr_cfg_msg(struct htt_pdev_t *pdev,
 			       htt_h2t_send_complete_free_netbuf,
 			       qdf_nbuf_data(msg),
 			       qdf_nbuf_len(msg),
-			       pdev->htc_endpoint,
+			       pdev->htc_tx_endpoint,
 			       HTC_TX_PACKET_TAG_RUNTIME_PUT);
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
@@ -650,8 +650,7 @@ htt_h2t_aggr_cfg_msg(struct htt_pdev_t *pdev,
  * Return: 0 success
  *         A_NO_MEMORY No memory fail
  */
-#ifdef QCA_WIFI_2_0
-/* Rome Support only WDI 1.0 */
+#ifdef QCA_WIFI_3_0
 int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 {
 	struct htt_htc_pkt *pkt;
@@ -660,7 +659,7 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 
 	pkt = htt_htc_pkt_alloc(pdev);
 	if (!pkt)
-		return A_NO_MEMORY;
+		return -A_NO_MEMORY;
 
 	/* show that this is not a tx frame download
 	 * (not required, but helpful)
@@ -674,7 +673,7 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 			     false);
 	if (!msg) {
 		htt_htc_pkt_free(pdev, pkt);
-		return A_NO_MEMORY;
+		return -A_NO_MEMORY;
 	}
 	/* set the length of the message */
 	qdf_nbuf_put_tail(msg, HTT_WDI_IPA_CFG_SZ);
@@ -687,13 +686,17 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 
 	*msg_word = 0;
 	HTT_WDI_IPA_CFG_TX_PKT_POOL_SIZE_SET(*msg_word,
-				pdev->ipa_uc_tx_rsc.alloc_tx_buf_cnt);
+		pdev->ipa_uc_tx_rsc.alloc_tx_buf_cnt);
 	HTT_H2T_MSG_TYPE_SET(*msg_word, HTT_H2T_MSG_TYPE_WDI_IPA_CFG);
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_TX_COMP_RING_BASE_ADDR_SET(*msg_word,
+	/* TX COMP RING BASE LO */
+	HTT_WDI_IPA_CFG_TX_COMP_RING_BASE_ADDR_LO_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_tx_rsc.tx_comp_base.paddr);
+	msg_word++;
+	*msg_word = 0;
+	/* TX COMP RING BASE HI, NONE */
 
 	msg_word++;
 	*msg_word = 0;
@@ -702,18 +705,26 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_TX_COMP_WR_IDX_ADDR_SET(*msg_word,
+	HTT_WDI_IPA_CFG_TX_COMP_WR_IDX_ADDR_LO_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_tx_rsc.tx_comp_idx_paddr);
+	msg_word++;
+	*msg_word = 0;
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_TX_CE_WR_IDX_ADDR_SET(*msg_word,
+	HTT_WDI_IPA_CFG_TX_CE_WR_IDX_ADDR_LO_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_tx_rsc.tx_ce_idx.paddr);
+	msg_word++;
+	*msg_word = 0;
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_IND_RING_BASE_ADDR_SET(*msg_word,
+	HTT_WDI_IPA_CFG_RX_IND_RING_BASE_ADDR_LO_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_rx_rsc.rx_ind_ring_base.paddr);
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_IND_RING_BASE_ADDR_HI_SET(*msg_word,
+		0);
 
 	msg_word++;
 	*msg_word = 0;
@@ -722,19 +733,59 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_IND_RD_IDX_ADDR_SET(*msg_word,
+	HTT_WDI_IPA_CFG_RX_IND_RD_IDX_ADDR_LO_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.paddr);
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_IND_RD_IDX_ADDR_HI_SET(*msg_word,
+		0);
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_IND_WR_IDX_ADDR_SET(*msg_word,
-	       (unsigned int)pdev->ipa_uc_rx_rsc.rx_rdy_idx_paddr);
+	HTT_WDI_IPA_CFG_RX_IND_WR_IDX_ADDR_LO_SET(*msg_word,
+		(unsigned int)pdev->ipa_uc_rx_rsc.rx_rdy_idx_paddr);
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_IND_WR_IDX_ADDR_HI_SET(*msg_word,
+		0);
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_RING2_BASE_ADDR_LO_SET(*msg_word,
+		(unsigned int)pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.paddr);
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_RING2_BASE_ADDR_HI_SET(*msg_word,
+		0);
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_RING2_SIZE_SET(*msg_word,
+		(unsigned int)ol_cfg_ipa_uc_rx_ind_ring_size(pdev->ctrl_pdev));
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_RING2_RD_IDX_ADDR_LO_SET(*msg_word,
+		(unsigned int)pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.paddr);
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_RING2_RD_IDX_ADDR_HI_SET(*msg_word,
+		0);
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_RING2_WR_IDX_ADDR_LO_SET(*msg_word,
+		(unsigned int)pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.paddr);
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_RING2_WR_IDX_ADDR_HI_SET(*msg_word,
+		0);
 
 	SET_HTC_PACKET_INFO_TX(&pkt->htc_pkt,
 			       htt_h2t_send_complete_free_netbuf,
 			       qdf_nbuf_data(msg),
 			       qdf_nbuf_len(msg),
-			       pdev->htc_endpoint,
+			       pdev->htc_tx_endpoint,
 			       HTC_TX_PACKET_TAG_RUNTIME_PUT);
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
@@ -744,6 +795,7 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 	return A_OK;
 }
 #else
+/* Rome Support only WDI 1.0 */
 int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 {
 	struct htt_htc_pkt *pkt;
@@ -752,7 +804,7 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 
 	pkt = htt_htc_pkt_alloc(pdev);
 	if (!pkt)
-		return -A_NO_MEMORY;
+		return A_NO_MEMORY;
 
 	/* show that this is not a tx frame download
 	 * (not required, but helpful)
@@ -766,7 +818,7 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 			     false);
 	if (!msg) {
 		htt_htc_pkt_free(pdev, pkt);
-		return -A_NO_MEMORY;
+		return A_NO_MEMORY;
 	}
 	/* set the length of the message */
 	qdf_nbuf_put_tail(msg, HTT_WDI_IPA_CFG_SZ);
@@ -779,45 +831,34 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 
 	*msg_word = 0;
 	HTT_WDI_IPA_CFG_TX_PKT_POOL_SIZE_SET(*msg_word,
-		pdev->ipa_uc_tx_rsc.alloc_tx_buf_cnt);
+				pdev->ipa_uc_tx_rsc.alloc_tx_buf_cnt);
 	HTT_H2T_MSG_TYPE_SET(*msg_word, HTT_H2T_MSG_TYPE_WDI_IPA_CFG);
 
 	msg_word++;
 	*msg_word = 0;
-	/* TX COMP RING BASE LO */
-	HTT_WDI_IPA_CFG_TX_COMP_RING_BASE_ADDR_LO_SET(*msg_word,
+	HTT_WDI_IPA_CFG_TX_COMP_RING_BASE_ADDR_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_tx_rsc.tx_comp_base.paddr);
-	msg_word++;
-	*msg_word = 0;
-	/* TX COMP RING BASE HI, NONE */
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_TX_COMP_RING_SIZE_SET(*msg_word,
+	HTT_WDI_IPA_CFG_TX_COMP_RING_SIZE_SET(
+		*msg_word,
 		(unsigned int)ol_cfg_ipa_uc_tx_max_buf_cnt(pdev->ctrl_pdev));
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_TX_COMP_WR_IDX_ADDR_LO_SET(*msg_word,
+	HTT_WDI_IPA_CFG_TX_COMP_WR_IDX_ADDR_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_tx_rsc.tx_comp_idx_paddr);
-	msg_word++;
-	*msg_word = 0;
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_TX_CE_WR_IDX_ADDR_LO_SET(*msg_word,
+	HTT_WDI_IPA_CFG_TX_CE_WR_IDX_ADDR_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_tx_rsc.tx_ce_idx.paddr);
-	msg_word++;
-	*msg_word = 0;
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_IND_RING_BASE_ADDR_LO_SET(*msg_word,
+	HTT_WDI_IPA_CFG_RX_IND_RING_BASE_ADDR_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_rx_rsc.rx_ind_ring_base.paddr);
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_IND_RING_BASE_ADDR_HI_SET(*msg_word,
-		0);
 
 	msg_word++;
 	*msg_word = 0;
@@ -826,60 +867,20 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_IND_RD_IDX_ADDR_LO_SET(*msg_word,
+	HTT_WDI_IPA_CFG_RX_IND_RD_IDX_ADDR_SET(*msg_word,
 		(unsigned int)pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.paddr);
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_IND_RD_IDX_ADDR_HI_SET(*msg_word,
-		0);
-
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_IND_WR_IDX_ADDR_LO_SET(*msg_word,
-		(unsigned int)pdev->ipa_uc_rx_rsc.rx_rdy_idx_paddr);
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_IND_WR_IDX_ADDR_HI_SET(*msg_word,
-		0);
 
 	msg_word++;
 	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_RING2_BASE_ADDR_LO_SET(*msg_word,
-		(unsigned int)pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.paddr);
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_RING2_BASE_ADDR_HI_SET(*msg_word,
-		0);
-
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_RING2_SIZE_SET(*msg_word,
-		(unsigned int)ol_cfg_ipa_uc_rx_ind_ring_size(pdev->ctrl_pdev));
-
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_RING2_RD_IDX_ADDR_LO_SET(*msg_word,
-		(unsigned int)pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.paddr);
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_RING2_RD_IDX_ADDR_HI_SET(*msg_word,
-		0);
-
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_RING2_WR_IDX_ADDR_LO_SET(*msg_word,
-		(unsigned int)pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.paddr);
-	msg_word++;
-	*msg_word = 0;
-	HTT_WDI_IPA_CFG_RX_RING2_WR_IDX_ADDR_HI_SET(*msg_word,
-		0);
+	HTT_WDI_IPA_CFG_RX_IND_WR_IDX_ADDR_SET(*msg_word,
+	       (unsigned int)pdev->ipa_uc_rx_rsc.rx_rdy_idx_paddr);
 
 	SET_HTC_PACKET_INFO_TX(&pkt->htc_pkt,
 			       htt_h2t_send_complete_free_netbuf,
 			       qdf_nbuf_data(msg),
 			       qdf_nbuf_len(msg),
-			       pdev->htc_endpoint,
-			       1); /* tag - not relevant here */
+			       pdev->htc_tx_endpoint,
+			       HTC_TX_PACKET_TAG_RUNTIME_PUT);
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
 
@@ -951,7 +952,7 @@ int htt_h2t_ipa_uc_set_active(struct htt_pdev_t *pdev,
 			       htt_h2t_send_complete_free_netbuf,
 			       qdf_nbuf_data(msg),
 			       qdf_nbuf_len(msg),
-			       pdev->htc_endpoint,
+			       pdev->htc_tx_endpoint,
 			       1); /* tag - not relevant here */
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
@@ -1011,7 +1012,7 @@ int htt_h2t_ipa_uc_get_stats(struct htt_pdev_t *pdev)
 			       htt_h2t_send_complete_free_netbuf,
 			       qdf_nbuf_data(msg),
 			       qdf_nbuf_len(msg),
-			       pdev->htc_endpoint,
+			       pdev->htc_tx_endpoint,
 			       1); /* tag - not relevant here */
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
diff --git a/core/dp/htt/htt_internal.h b/core/dp/htt/htt_internal.h
index 5b8b167260c7..7d3ffbddafcb 100644
--- a/core/dp/htt/htt_internal.h
+++ b/core/dp/htt/htt_internal.h
@@ -428,7 +428,7 @@ int htt_rx_attach(struct htt_pdev_t *pdev);
 
 void htt_rx_detach(struct htt_pdev_t *pdev);
 
-int htt_htc_attach(struct htt_pdev_t *pdev);
+int htt_htc_attach(struct htt_pdev_t *pdev, uint16_t service_id);
 
 void htt_t2h_msg_handler(void *context, HTC_PACKET *pkt);
 #ifdef WLAN_FEATURE_FASTPATH
diff --git a/core/dp/htt/htt_rx.c b/core/dp/htt/htt_rx.c
index 5e7231584ad4..0064a8f282d6 100644
--- a/core/dp/htt/htt_rx.c
+++ b/core/dp/htt/htt_rx.c
@@ -2294,7 +2294,7 @@ int htt_rx_ipa_uc_alloc_wdi2_rsc(struct htt_pdev_t *pdev,
 		qdf_mem_alloc_consistent(
 			pdev->osdev, pdev->osdev->dev,
 			rx_ind_ring_elements *
-			sizeof(struct ipa_uc_rx_ring_elem_t),
+			sizeof(qdf_dma_addr_t),
 			&pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.paddr);
 	if (!pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr) {
 		qdf_print("%s: RX IND RING alloc fail", __func__);
@@ -2303,7 +2303,7 @@ int htt_rx_ipa_uc_alloc_wdi2_rsc(struct htt_pdev_t *pdev,
 
 	/* RX indication ring size, by bytes */
 	pdev->ipa_uc_rx_rsc.rx2_ind_ring_size =
-		rx_ind_ring_elements * sizeof(struct ipa_uc_rx_ring_elem_t);
+		rx_ind_ring_elements * sizeof(qdf_dma_addr_t);
 	qdf_mem_zero(pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr,
 		pdev->ipa_uc_rx_rsc.rx2_ind_ring_size);
 
diff --git a/core/dp/htt/htt_tx.c b/core/dp/htt/htt_tx.c
index ac81810b6117..0dcdb52e3beb 100644
--- a/core/dp/htt/htt_tx.c
+++ b/core/dp/htt/htt_tx.c
@@ -573,7 +573,7 @@ void htt_tx_sched(htt_pdev_handle pdev)
 
 		not_accepted =
 			htc_send_data_pkt(pdev->htc_pdev, msdu,
-					  pdev->htc_endpoint,
+					  pdev->htc_tx_endpoint,
 					  download_len);
 		if (not_accepted) {
 			HTT_TX_NBUF_QUEUE_INSERT_HEAD(pdev, msdu);
@@ -616,8 +616,8 @@ int htt_tx_send_std(htt_pdev_handle pdev, qdf_nbuf_t msdu, uint16_t msdu_id)
 	}
 
 	qdf_nbuf_trace_update(msdu, "HT:T:");
-	if (htc_send_data_pkt
-		    (pdev->htc_pdev, msdu, pdev->htc_endpoint, download_len)) {
+	if (htc_send_data_pkt(pdev->htc_pdev, msdu,
+			      pdev->htc_tx_endpoint, download_len)) {
 		HTT_TX_NBUF_QUEUE_ADD(pdev, msdu);
 	}
 
@@ -689,10 +689,10 @@ htt_tx_htt2_get_ep_id(htt_pdev_handle pdev, qdf_nbuf_t msdu)
 	    (qdf_nbuf_len(msdu) < pdev->htc_tx_htt2_max_size))
 		return pdev->htc_tx_htt2_endpoint;
 	else
-		return pdev->htc_endpoint;
+		return pdev->htc_tx_endpoint;
 }
 #else
-#define htt_tx_htt2_get_ep_id(pdev, msdu)     (pdev->htc_endpoint)
+#define htt_tx_htt2_get_ep_id(pdev, msdu)     (pdev->htc_tx_endpoint)
 #endif /* QCA_TX_HTT2_SUPPORT */
 
 static inline int
@@ -847,7 +847,7 @@ void htt_tx_desc_display(void *tx_desc)
 #endif
 
 #ifdef IPA_OFFLOAD
-#ifdef QCA_WIFI_2_0
+#ifdef QCA_WIFI_3_0
 /**
  * htt_tx_ipa_uc_wdi_tx_buf_alloc() - Alloc WDI TX buffers
  * @pdev: htt context
@@ -869,8 +869,9 @@ int htt_tx_ipa_uc_wdi_tx_buf_alloc(struct htt_pdev_t *pdev,
 	qdf_dma_addr_t buffer_paddr;
 	uint32_t *header_ptr;
 	uint32_t *ring_vaddr;
-#define IPA_UC_TX_BUF_FRAG_DESC_OFFSET 16
-#define IPA_UC_TX_BUF_FRAG_HDR_OFFSET 32
+#define IPA_UC_TX_BUF_FRAG_DESC_OFFSET 20
+#define IPA_UC_TX_BUF_FRAG_HDR_OFFSET 64
+#define IPA_UC_TX_BUF_TSO_HDR_SIZE 6
 
 	ring_vaddr = pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr;
 	/* Allocate TX buffers as many as possible */
@@ -899,13 +900,24 @@ int htt_tx_ipa_uc_wdi_tx_buf_alloc(struct htt_pdev_t *pdev,
 		qdf_nbuf_map(pdev->osdev, buffer_vaddr, QDF_DMA_BIDIRECTIONAL);
 		buffer_paddr = qdf_nbuf_get_frag_paddr(buffer_vaddr, 0);
 		header_ptr++;
+
+		/* Frag Desc Pointer */
+		/* 64bits descriptor, Low 32bits */
 		*header_ptr = (uint32_t) (buffer_paddr +
 						IPA_UC_TX_BUF_FRAG_DESC_OFFSET);
 		header_ptr++;
+
+		/* 64bits descriptor, high 32bits */
+		*header_ptr = 0;
+		header_ptr++;
+
+		/* chanreq, peerid */
 		*header_ptr = 0xFFFFFFFF;
+		header_ptr++;
 
 		/* FRAG Header */
-		header_ptr++;
+		/* 6 words TSO header */
+		header_ptr += IPA_UC_TX_BUF_TSO_HDR_SIZE;
 		*header_ptr = buffer_paddr + IPA_UC_TX_BUF_FRAG_HDR_OFFSET;
 
 		*ring_vaddr = buffer_paddr;
@@ -913,7 +925,7 @@ int htt_tx_ipa_uc_wdi_tx_buf_alloc(struct htt_pdev_t *pdev,
 			buffer_vaddr;
 		/* Memory barrier to ensure actual value updated */
 
-		ring_vaddr++;
+		ring_vaddr += 2;
 	}
 	return tx_buffer_count;
 }
@@ -928,9 +940,8 @@ int htt_tx_ipa_uc_wdi_tx_buf_alloc(struct htt_pdev_t *pdev,
 	qdf_dma_addr_t buffer_paddr;
 	uint32_t *header_ptr;
 	uint32_t *ring_vaddr;
-#define IPA_UC_TX_BUF_FRAG_DESC_OFFSET 20
-#define IPA_UC_TX_BUF_FRAG_HDR_OFFSET 64
-#define IPA_UC_TX_BUF_TSO_HDR_SIZE 6
+#define IPA_UC_TX_BUF_FRAG_DESC_OFFSET 16
+#define IPA_UC_TX_BUF_FRAG_HDR_OFFSET 32
 
 	ring_vaddr = pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr;
 	/* Allocate TX buffers as many as possible */
@@ -959,24 +970,13 @@ int htt_tx_ipa_uc_wdi_tx_buf_alloc(struct htt_pdev_t *pdev,
 		qdf_nbuf_map(pdev->osdev, buffer_vaddr, QDF_DMA_BIDIRECTIONAL);
 		buffer_paddr = qdf_nbuf_get_frag_paddr(buffer_vaddr, 0);
 		header_ptr++;
-
-		/* Frag Desc Pointer */
-		/* 64bits descriptor, Low 32bits */
 		*header_ptr = (uint32_t) (buffer_paddr +
 						IPA_UC_TX_BUF_FRAG_DESC_OFFSET);
 		header_ptr++;
-
-		/* 64bits descriptor, high 32bits */
-		*header_ptr = 0;
-		header_ptr++;
-
-		/* chanreq, peerid */
 		*header_ptr = 0xFFFFFFFF;
-		header_ptr++;
 
 		/* FRAG Header */
-		/* 6 words TSO header */
-		header_ptr += IPA_UC_TX_BUF_TSO_HDR_SIZE;
+		header_ptr++;
 		*header_ptr = buffer_paddr + IPA_UC_TX_BUF_FRAG_HDR_OFFSET;
 
 		*ring_vaddr = buffer_paddr;
@@ -984,7 +984,7 @@ int htt_tx_ipa_uc_wdi_tx_buf_alloc(struct htt_pdev_t *pdev,
 			buffer_vaddr;
 		/* Memory barrier to ensure actual value updated */
 
-		ring_vaddr += 2;
+		ring_vaddr++;
 	}
 	return tx_buffer_count;
 }
diff --git a/core/dp/htt/htt_types.h b/core/dp/htt/htt_types.h
index c49a02273338..b0bcf811a926 100644
--- a/core/dp/htt/htt_types.h
+++ b/core/dp/htt/htt_types.h
@@ -217,7 +217,7 @@ struct htt_pdev_t {
 	HTC_HANDLE htc_pdev;
 	qdf_device_t osdev;
 
-	HTC_ENDPOINT_ID htc_endpoint;
+	HTC_ENDPOINT_ID htc_tx_endpoint;
 
 #ifdef QCA_TX_HTT2_SUPPORT
 	HTC_ENDPOINT_ID htc_tx_htt2_endpoint;
@@ -388,7 +388,7 @@ struct htt_pdev_t {
 };
 
 #define HTT_EPID_GET(_htt_pdev_hdl)  \
-	(((struct htt_pdev_t *)(_htt_pdev_hdl))->htc_endpoint)
+	(((struct htt_pdev_t *)(_htt_pdev_hdl))->htc_tx_endpoint)
 
 #if defined(HELIUMPLUS_PADDR64)
 #define HTT_WIFI_IP(pdev, x, y) (((pdev)->wifi_ip_ver.major == (x)) &&	\
diff --git a/core/dp/ol/inc/ol_cfg.h b/core/dp/ol/inc/ol_cfg.h
index 4884794a24c6..7caea62dee17 100644
--- a/core/dp/ol/inc/ol_cfg.h
+++ b/core/dp/ol/inc/ol_cfg.h
@@ -45,6 +45,12 @@ enum wlan_frm_fmt {
 	wlan_frm_fmt_802_3,
 };
 
+/* Throttle period Different level Duty Cycle values*/
+#define THROTTLE_DUTY_CYCLE_LEVEL0 (0)
+#define THROTTLE_DUTY_CYCLE_LEVEL1 (50)
+#define THROTTLE_DUTY_CYCLE_LEVEL2 (75)
+#define THROTTLE_DUTY_CYCLE_LEVEL3 (94)
+
 struct wlan_ipa_uc_rsc_t {
 	u8 uc_offload_enabled;
 	u32 tx_max_buf_cnt;
@@ -70,6 +76,7 @@ struct txrx_pdev_cfg_t {
 	u32 max_vdev;
 	u32 max_nbuf_frags;
 	u32 throttle_period_ms;
+	u8 dutycycle_level[4];
 	enum wlan_frm_fmt frame_type;
 	u8 rx_fwd_disabled;
 	u8 is_packet_log_enabled;
@@ -334,6 +341,16 @@ int ol_cfg_rx_host_defrag_timeout_duplicate_check(ol_pdev_handle pdev);
 int ol_cfg_throttle_period_ms(ol_pdev_handle pdev);
 
 /**
+ * brief Query for the duty cycle in percentage used for throttling for
+ * thermal mitigation
+ *
+ * @param pdev - handle to the physical device
+ * @param level - duty cycle level
+ * @return the duty cycle level in percentage
+ */
+int ol_cfg_throttle_duty_cycle_level(ol_pdev_handle pdev, int level);
+
+/**
  * brief Check whether full reorder offload is
  * enabled/disable by the host
  * @details
diff --git a/core/dp/txrx/ol_cfg.c b/core/dp/txrx/ol_cfg.c
index aaf7b1ce63a5..60adb2aac92d 100644
--- a/core/dp/txrx/ol_cfg.c
+++ b/core/dp/txrx/ol_cfg.c
@@ -114,6 +114,10 @@ ol_pdev_handle ol_pdev_cfg_attach(qdf_device_t osdev,
 	cfg_ctx->vow_config = vow_config;
 	cfg_ctx->target_tx_credit = CFG_TGT_NUM_MSDU_DESC;
 	cfg_ctx->throttle_period_ms = 40;
+	cfg_ctx->dutycycle_level[0] = THROTTLE_DUTY_CYCLE_LEVEL0;
+	cfg_ctx->dutycycle_level[1] = THROTTLE_DUTY_CYCLE_LEVEL1;
+	cfg_ctx->dutycycle_level[2] = THROTTLE_DUTY_CYCLE_LEVEL2;
+	cfg_ctx->dutycycle_level[3] = THROTTLE_DUTY_CYCLE_LEVEL3;
 	cfg_ctx->rx_fwd_disabled = 0;
 	cfg_ctx->is_packet_log_enabled = 0;
 	cfg_ctx->is_full_reorder_offload = cfg_param.is_full_reorder_offload;
@@ -274,6 +278,12 @@ int ol_cfg_throttle_period_ms(ol_pdev_handle pdev)
 	return cfg->throttle_period_ms;
 }
 
+int ol_cfg_throttle_duty_cycle_level(ol_pdev_handle pdev, int level)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+	return cfg->dutycycle_level[level];
+}
+
 int ol_cfg_is_full_reorder_offload(ol_pdev_handle pdev)
 {
 	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
diff --git a/core/dp/txrx/ol_rx.c b/core/dp/txrx/ol_rx.c
index 093383b0b4ac..350d4c7a298d 100644
--- a/core/dp/txrx/ol_rx.c
+++ b/core/dp/txrx/ol_rx.c
@@ -1198,6 +1198,11 @@ void ol_rx_peer_init(struct ol_txrx_pdev_t *pdev, struct ol_txrx_peer_t *peer)
 	peer->security[txrx_sec_ucast].sec_type =
 		peer->security[txrx_sec_mcast].sec_type = htt_sec_type_none;
 	peer->keyinstalled = 0;
+
+	peer->last_assoc_rcvd = 0;
+	peer->last_disassoc_rcvd = 0;
+	peer->last_deauth_rcvd = 0;
+
 	qdf_atomic_init(&peer->fw_pn_check);
 }
 
@@ -1205,6 +1210,9 @@ void
 ol_rx_peer_cleanup(struct ol_txrx_vdev_t *vdev, struct ol_txrx_peer_t *peer)
 {
 	peer->keyinstalled = 0;
+	peer->last_assoc_rcvd = 0;
+	peer->last_disassoc_rcvd = 0;
+	peer->last_deauth_rcvd = 0;
 	ol_rx_reorder_peer_cleanup(vdev, peer);
 }
 
diff --git a/core/dp/txrx/ol_tx_queue.c b/core/dp/txrx/ol_tx_queue.c
index b0cfe07763ac..17030f1772bb 100644
--- a/core/dp/txrx/ol_tx_queue.c
+++ b/core/dp/txrx/ol_tx_queue.c
@@ -413,13 +413,8 @@ void ol_tx_throttle_set_level(struct ol_txrx_pdev_t *pdev, int level)
 		qdf_timer_start(&pdev->tx_throttle.phase_timer, ms);
 }
 
-/* This table stores the duty cycle for each level.
-   Example "on" time for level 2 with duty period 100ms is:
-   "on" time = duty_period_ms >> throttle_duty_cycle_table[2]
-   "on" time = 100 ms >> 2 = 25ms */
-static uint8_t g_throttle_duty_cycle_table[THROTTLE_LEVEL_MAX] = { 0, 1, 2, 4 };
-
-void ol_tx_throttle_init_period(struct ol_txrx_pdev_t *pdev, int period)
+void ol_tx_throttle_init_period(struct ol_txrx_pdev_t *pdev, int period,
+				uint8_t *dutycycle_level)
 {
 	int i;
 
@@ -429,8 +424,9 @@ void ol_tx_throttle_init_period(struct ol_txrx_pdev_t *pdev, int period)
 	TXRX_PRINT(TXRX_PRINT_LEVEL_WARN, "level  OFF  ON\n");
 	for (i = 0; i < THROTTLE_LEVEL_MAX; i++) {
 		pdev->tx_throttle.throttle_time_ms[i][THROTTLE_PHASE_ON] =
-			pdev->tx_throttle.throttle_period_ms >>
-			g_throttle_duty_cycle_table[i];
+			pdev->tx_throttle.throttle_period_ms -
+				((dutycycle_level[i] *
+				  pdev->tx_throttle.throttle_period_ms)/100);
 		pdev->tx_throttle.throttle_time_ms[i][THROTTLE_PHASE_OFF] =
 			pdev->tx_throttle.throttle_period_ms -
 			pdev->tx_throttle.throttle_time_ms[
@@ -446,6 +442,8 @@ void ol_tx_throttle_init_period(struct ol_txrx_pdev_t *pdev, int period)
 void ol_tx_throttle_init(struct ol_txrx_pdev_t *pdev)
 {
 	uint32_t throttle_period;
+	uint8_t dutycycle_level[THROTTLE_LEVEL_MAX];
+	int i;
 
 	pdev->tx_throttle.current_throttle_level = THROTTLE_LEVEL_0;
 	pdev->tx_throttle.current_throttle_phase = THROTTLE_PHASE_OFF;
@@ -453,7 +451,11 @@ void ol_tx_throttle_init(struct ol_txrx_pdev_t *pdev)
 
 	throttle_period = ol_cfg_throttle_period_ms(pdev->ctrl_pdev);
 
-	ol_tx_throttle_init_period(pdev, throttle_period);
+	for (i = 0; i < THROTTLE_LEVEL_MAX; i++)
+		dutycycle_level[i] =
+			ol_cfg_throttle_duty_cycle_level(pdev->ctrl_pdev, i);
+
+	ol_tx_throttle_init_period(pdev, throttle_period, &dutycycle_level[0]);
 
 	qdf_timer_init(pdev->osdev,
 			       &pdev->tx_throttle.phase_timer,
diff --git a/core/dp/txrx/ol_txrx_types.h b/core/dp/txrx/ol_txrx_types.h
index 43e2461a9115..a36346e63f1c 100644
--- a/core/dp/txrx/ol_txrx_types.h
+++ b/core/dp/txrx/ol_txrx_types.h
@@ -1000,6 +1000,9 @@ struct ol_txrx_peer_t {
 	uint32_t last_pkt_tsf;
 	uint8_t last_pkt_tid;
 	uint16_t last_pkt_center_freq;
+	qdf_time_t last_assoc_rcvd;
+	qdf_time_t last_disassoc_rcvd;
+	qdf_time_t last_deauth_rcvd;
 };
 
 enum ol_rx_err_type {
diff --git a/core/hdd/inc/wlan_hdd_cfg.h b/core/hdd/inc/wlan_hdd_cfg.h
index 93ceda3bb05b..2d7795fa264c 100644
--- a/core/hdd/inc/wlan_hdd_cfg.h
+++ b/core/hdd/inc/wlan_hdd_cfg.h
@@ -1476,6 +1476,32 @@ typedef enum {
 #define CFG_THROTTLE_PERIOD_MAX                (10000)
 #define CFG_THROTTLE_PERIOD_DEFAULT            (4000)
 
+/*
+ * Configure Throttle Period Different Level Duty Cycle in percentage
+ * When temperature measured is greater than threshold at particular level,
+ * then throtling level will get increased by one level and
+ * will reduce TX duty by the given percentage
+ */
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_NAME    "gThrottleDutyCycleLevel0"
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_MIN     (0)
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_MAX     (0)
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL0_DEFAULT (0)
+
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_NAME    "gThrottleDutyCycleLevel1"
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_MIN     (0)
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_MAX     (100)
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL1_DEFAULT (50)
+
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_NAME    "gThrottleDutyCycleLevel2"
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_MIN     (0)
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_MAX     (100)
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL2_DEFAULT (75)
+
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_NAME    "gThrottleDutyCycleLevel3"
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_MIN     (0)
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_MAX     (100)
+#define CFG_THROTTLE_DUTY_CYCLE_LEVEL3_DEFAULT (94)
+
 #define CFG_THERMAL_TEMP_MIN_LEVEL0_NAME      "gThermalTempMinLevel0"
 #define CFG_THERMAL_TEMP_MIN_LEVEL0_MIN       (0)
 #define CFG_THERMAL_TEMP_MIN_LEVEL0_MAX       (1000)
@@ -2264,6 +2290,17 @@ typedef enum {
 #define CFG_BUS_BANDWIDTH_COMPUTE_INTERVAL_MIN     (0)
 #define CFG_BUS_BANDWIDTH_COMPUTE_INTERVAL_MAX     (10000)
 
+/*
+ * Dynamic configuration of tcp delack is enabled by default.
+ * User can set gTcpDelAckEnable flag to 0 in the INI file to disable dynamic
+ * reconfiguration of tcp delack. This does not disable the update of receive
+ * histogram
+ */
+#define CFG_ENABLE_TCP_DELACK                      "gTcpDelAckEnable"
+#define CFG_ENABLE_TCP_DELACK_DEFAULT              (1)
+#define CFG_ENABLE_TCP_DELACK_MIN                  (0)
+#define CFG_ENABLE_TCP_DELACK_MAX                  (1)
+
 #define CFG_TCP_DELACK_THRESHOLD_HIGH              "gTcpDelAckThresholdHigh"
 #define CFG_TCP_DELACK_THRESHOLD_HIGH_DEFAULT      (500)
 #define CFG_TCP_DELACK_THRESHOLD_HIGH_MIN          (0)
@@ -2327,7 +2364,7 @@ typedef enum {
 #define CFG_ROAMING_OFFLOAD_NAME                "gRoamOffloadEnabled"
 #define CFG_ROAMING_OFFLOAD_MIN                 (0)
 #define CFG_ROAMING_OFFLOAD_MAX                 (1)
-#define CFG_ROAMING_OFFLOAD_DEFAULT             (0)
+#define CFG_ROAMING_OFFLOAD_DEFAULT             (1)
 #endif
 
 #define CFG_IPA_UC_TX_BUF_COUNT_NAME               "IpaUcTxBufCount"
@@ -2905,7 +2942,7 @@ enum dot11p_mode {
 #define CFG_ENABLE_M2M_LIMITATION              "gEnableM2MLimitation"
 #define CFG_ENABLE_M2M_LIMITATION_MIN          (0)
 #define CFG_ENABLE_M2M_LIMITATION_MAX          (1)
-#define CFG_ENABLE_M2M_LIMITATION_DEFAULT      (1)
+#define CFG_ENABLE_M2M_LIMITATION_DEFAULT      (0)
 #endif /* QCA_WIFI_3_0_EMU */
 
 /*
@@ -2930,6 +2967,15 @@ enum dot11p_mode {
 #define CFG_ROAM_DENSE_RSSI_THRE_OFFSET_DEFAULT (0)
 
 /*
+ * Enabling gignore_peer_ht_opmode will enable 11g
+ * protection only when there is a 11g AP in vicinity.
+ */
+#define CFG_IGNORE_PEER_HT_MODE_NAME       "gignore_peer_ht_opmode"
+#define CFG_IGNORE_PEER_HT_MODE_MIN        (0)
+#define CFG_IGNORE_PEER_HT_MODE_MAX        (1)
+#define CFG_IGNORE_PEER_HT_MODE_DEFAULT    (0)
+
+/*
  * Dense Roam Min APs
  * minimum number of AP required for dense roam
  * FW will consider environment as dense once it detects #APs
@@ -3211,6 +3257,10 @@ struct hdd_config {
 	bool isP2pDeviceAddrAdministrated;
 	uint8_t thermalMitigationEnable;
 	uint32_t throttlePeriod;
+	uint32_t throttle_dutycycle_level0;
+	uint32_t throttle_dutycycle_level1;
+	uint32_t throttle_dutycycle_level2;
+	uint32_t throttle_dutycycle_level3;
 	uint8_t vhtChannelWidth;
 	uint8_t vhtRxMCS;
 	uint8_t vhtTxMCS;
@@ -3383,6 +3433,7 @@ struct hdd_config {
 	uint32_t busBandwidthMediumThreshold;
 	uint32_t busBandwidthLowThreshold;
 	uint32_t busBandwidthComputeInterval;
+	uint32_t enable_tcp_delack;
 	uint32_t tcpDelackThresholdHigh;
 	uint32_t tcpDelackThresholdLow;
 	uint32_t tcp_tx_high_tput_thres;
@@ -3530,6 +3581,7 @@ struct hdd_config {
 #endif
 	uint32_t roam_dense_traffic_thresh;
 	uint32_t roam_dense_rssi_thresh_offset;
+	bool ignore_peer_ht_opmode;
 	uint32_t roam_dense_min_aps;
 };
 
diff --git a/core/hdd/inc/wlan_hdd_main.h b/core/hdd/inc/wlan_hdd_main.h
index ffa86e6c1376..39fe7e1a7d97 100644
--- a/core/hdd/inc/wlan_hdd_main.h
+++ b/core/hdd/inc/wlan_hdd_main.h
@@ -627,29 +627,6 @@ typedef struct hdd_cfg80211_state_s {
 	eP2PActionFrameState actionFrmState;
 } hdd_cfg80211_state_t;
 
-
-/*---------------------------------------------------------------------------
-   hdd_ibss_peer_info_params_t
-   ---------------------------------------------------------------------------*/
-typedef struct {
-	uint8_t staIdx;         /* StaIdx */
-	uint32_t txRate;        /* Current Tx Rate */
-	uint32_t mcsIndex;      /* MCS Index */
-	uint32_t txRateFlags;   /* TxRate Flags */
-	int8_t rssi;            /* RSSI */
-} hdd_ibss_peer_info_params_t;
-
-typedef struct {
-	/** Request status */
-	uint32_t status;
-
-	/** Number of peers */
-	uint8_t numIBSSPeers;
-
-	/** Peer Info parameters */
-	hdd_ibss_peer_info_params_t ibssPeerList[MAX_IBSS_PEERS];
-} hdd_ibss_peer_info_t;
-
 struct hdd_station_ctx {
 	/** Handle to the Wireless Extension State */
 	hdd_wext_state_t WextState;
@@ -676,7 +653,7 @@ struct hdd_station_ctx {
 
 	/*Save the wep/wpa-none keys */
 	tCsrRoamSetKey ibss_enc_key;
-	hdd_ibss_peer_info_t ibss_peer_info;
+	tSirPeerInfoRspParams ibss_peer_info;
 
 	bool hdd_ReassocScenario;
 
@@ -1658,4 +1635,7 @@ static inline bool roaming_offload_enabled(hdd_context_t *hdd_ctx)
 }
 #endif
 
+void hdd_get_ibss_peer_info_cb(void *pUserData,
+				tSirPeerInfoRspParams *pPeerInfo);
+
 #endif /* end #if !defined(WLAN_HDD_MAIN_H) */
diff --git a/core/hdd/inc/wlan_hdd_oemdata.h b/core/hdd/inc/wlan_hdd_oemdata.h
index c17ddedad5c2..61f3f5116a6e 100644
--- a/core/hdd/inc/wlan_hdd_oemdata.h
+++ b/core/hdd/inc/wlan_hdd_oemdata.h
@@ -37,7 +37,7 @@
 #ifdef FEATURE_OEM_DATA_SUPPORT
 
 #ifndef OEM_DATA_REQ_SIZE
-#define OEM_DATA_REQ_SIZE 280
+#define OEM_DATA_REQ_SIZE 500
 #endif
 
 #ifndef OEM_DATA_RSP_SIZE
diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c
index e090491c0a69..cad7ae03bc89 100644
--- a/core/hdd/src/wlan_hdd_assoc.c
+++ b/core/hdd/src/wlan_hdd_assoc.c
@@ -110,6 +110,19 @@ uint8_t ccp_rsn_oui08[HDD_RSN_OUI_SIZE] = { 0x00, 0x0F, 0xAC, 0x05 };
 #define HDD_PEER_AUTHORIZE_WAIT 10
 
 /**
+ * beacon_filter_table - table of IEs used for beacon filtering
+ */
+static const int beacon_filter_table[] = {
+	SIR_MAC_DS_PARAM_SET_EID,
+	SIR_MAC_ERP_INFO_EID,
+	SIR_MAC_EDCA_PARAM_SET_EID,
+	SIR_MAC_QOS_CAPABILITY_EID,
+	SIR_MAC_HT_INFO_EID,
+	SIR_MAC_VHT_OPMODE_EID,
+	SIR_MAC_VHT_OPERATION_EID,
+};
+
+/**
  * hdd_conn_set_authenticated() - set authentication state
  * @pAdapter: pointer to the adapter
  * @authState: authentication state
@@ -313,6 +326,53 @@ hdd_conn_save_connected_bss_type(hdd_station_ctx_t *pHddStaCtx,
 }
 
 /**
+ * hdd_remove_beacon_filter() - remove beacon filter
+ * @adapter: Pointer to the hdd adapter
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int hdd_remove_beacon_filter(hdd_adapter_t *adapter)
+{
+	QDF_STATUS status;
+	hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+
+	status = sme_remove_beacon_filter(hdd_ctx->hHal,
+				adapter->sessionId);
+	if (!QDF_IS_STATUS_SUCCESS(status)) {
+		hdd_err("sme_remove_beacon_filter() failed");
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+/**
+ * hdd_add_beacon_filter() - add beacon filter
+ * @adapter: Pointer to the hdd adapter
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int hdd_add_beacon_filter(hdd_adapter_t *adapter)
+{
+	int i;
+	uint32_t ie_map[SIR_BCN_FLT_MAX_ELEMS_IE_LIST] = {0};
+	QDF_STATUS status;
+	hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+
+	for (i = 0; i < ARRAY_SIZE(beacon_filter_table); i++)
+		qdf_set_bit((beacon_filter_table[i] - 1),
+				(unsigned long int *)ie_map);
+
+	status = sme_add_beacon_filter(hdd_ctx->hHal,
+				adapter->sessionId, ie_map);
+	if (!QDF_IS_STATUS_SUCCESS(status)) {
+		hdd_err("sme_add_beacon_filter() failed");
+		return -EFAULT;
+	}
+	return 0;
+}
+
+/**
  * hdd_conn_save_connect_info() - save current connection information
  * @pAdapter: pointer to adapter
  * @pRoamInfo: pointer to roam info
@@ -1086,6 +1146,9 @@ static QDF_STATUS hdd_dis_connect_handler(hdd_adapter_t *pAdapter,
 
 	hdd_wmm_adapter_clear(pAdapter);
 	sme_ft_reset(WLAN_HDD_GET_HAL_CTX(pAdapter), pAdapter->sessionId);
+	if (hdd_remove_beacon_filter(pAdapter) != 0)
+		hdd_err("hdd_remove_beacon_filter() failed");
+
 	if (eCSR_ROAM_IBSS_LEAVE == roamStatus) {
 		uint8_t i;
 		sta_id = pHddStaCtx->broadcast_ibss_staid;
@@ -1775,6 +1838,9 @@ static QDF_STATUS hdd_association_completion_handler(hdd_adapter_t *pAdapter,
 		/* Save the connection info from CSR... */
 		hdd_conn_save_connect_info(pAdapter, pRoamInfo,
 					   eCSR_BSS_TYPE_INFRASTRUCTURE);
+
+		if (hdd_add_beacon_filter(pAdapter) != 0)
+			hdd_err("hdd_add_beacon_filter() failed");
 #ifdef FEATURE_WLAN_WAPI
 		if (pRoamInfo->u.pConnectedProfile->AuthType ==
 		    eCSR_AUTH_TYPE_WAPI_WAI_CERTIFICATE
@@ -3972,6 +4038,18 @@ hdd_sme_roam_callback(void *pContext, tCsrRoamInfo *pRoamInfo, uint32_t roamId,
 		       FL("hdd_ReassocScenario set to: %d, due to eCSR_ROAM_FT_START, session: %d"),
 		       pHddStaCtx->hdd_ReassocScenario, pAdapter->sessionId);
 		break;
+	case eCSR_ROAM_DISABLE_QUEUES:
+		hdd_info("Disabling queues");
+		wlan_hdd_netif_queue_control(pAdapter,
+				WLAN_NETIF_TX_DISABLE,
+				WLAN_CONTROL_PATH);
+		break;
+	case eCSR_ROAM_ENABLE_QUEUES:
+		hdd_info("Enabling queues");
+		wlan_hdd_netif_queue_control(pAdapter,
+				WLAN_WAKE_ALL_NETIF_QUEUE,
+				WLAN_CONTROL_PATH);
+		break;
 
 	case eCSR_ROAM_SHOULD_ROAM:
 		/* notify apps that we can't pass traffic anymore */
diff --git a/core/hdd/src/wlan_hdd_cfg.c b/core/hdd/src/wlan_hdd_cfg.c
index 5d3b5d6d69b3..eba3d85c8a67 100644
--- a/core/hdd/src/wlan_hdd_cfg.c
+++ b/core/hdd/src/wlan_hdd_cfg.c
@@ -1996,6 +1996,34 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		     CFG_THROTTLE_PERIOD_MIN,
 		     CFG_THROTTLE_PERIOD_MAX),
 
+	REG_VARIABLE(CFG_THROTTLE_DUTY_CYCLE_LEVEL0_NAME, WLAN_PARAM_Integer,
+		     struct hdd_config, throttle_dutycycle_level0,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL0_DEFAULT,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL0_MIN,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL0_MAX),
+
+	REG_VARIABLE(CFG_THROTTLE_DUTY_CYCLE_LEVEL1_NAME, WLAN_PARAM_Integer,
+		     struct hdd_config, throttle_dutycycle_level1,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL1_DEFAULT,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL1_MIN,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL1_MAX),
+
+	REG_VARIABLE(CFG_THROTTLE_DUTY_CYCLE_LEVEL2_NAME, WLAN_PARAM_Integer,
+		     struct hdd_config, throttle_dutycycle_level2,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL2_DEFAULT,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL2_MIN,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL2_MAX),
+
+	REG_VARIABLE(CFG_THROTTLE_DUTY_CYCLE_LEVEL3_NAME, WLAN_PARAM_Integer,
+		     struct hdd_config, throttle_dutycycle_level3,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL3_DEFAULT,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL3_MIN,
+		     CFG_THROTTLE_DUTY_CYCLE_LEVEL3_MAX),
+
 	REG_VARIABLE(CFG_ENABLE_MODULATED_DTIM_NAME, WLAN_PARAM_Integer,
 		     struct hdd_config, enableModulatedDTIM,
 		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -3030,12 +3058,21 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		     CFG_BUS_BANDWIDTH_COMPUTE_INTERVAL_DEFAULT,
 		     CFG_BUS_BANDWIDTH_COMPUTE_INTERVAL_MIN,
 		     CFG_BUS_BANDWIDTH_COMPUTE_INTERVAL_MAX),
+
+	REG_VARIABLE(CFG_ENABLE_TCP_DELACK, WLAN_PARAM_Integer,
+		     struct hdd_config, enable_tcp_delack,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_ENABLE_TCP_DELACK_DEFAULT,
+		     CFG_ENABLE_TCP_DELACK_MIN,
+		     CFG_ENABLE_TCP_DELACK_MAX),
+
 	REG_VARIABLE(CFG_TCP_DELACK_THRESHOLD_HIGH, WLAN_PARAM_Integer,
 		     struct hdd_config, tcpDelackThresholdHigh,
 		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
 		     CFG_TCP_DELACK_THRESHOLD_HIGH_DEFAULT,
 		     CFG_TCP_DELACK_THRESHOLD_HIGH_MIN,
 		     CFG_TCP_DELACK_THRESHOLD_HIGH_MAX),
+
 	REG_VARIABLE(CFG_TCP_DELACK_THRESHOLD_LOW, WLAN_PARAM_Integer,
 		     struct hdd_config, tcpDelackThresholdLow,
 		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -3711,6 +3748,14 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		CFG_ROAM_DENSE_RSSI_THRE_OFFSET_MIN,
 		CFG_ROAM_DENSE_RSSI_THRE_OFFSET_MAX),
 
+	REG_VARIABLE(CFG_IGNORE_PEER_HT_MODE_NAME, WLAN_PARAM_Integer,
+			struct hdd_config, ignore_peer_ht_opmode,
+			VAR_FLAGS_OPTIONAL |
+			VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+			CFG_IGNORE_PEER_HT_MODE_DEFAULT,
+			CFG_IGNORE_PEER_HT_MODE_MIN,
+			CFG_IGNORE_PEER_HT_MODE_MAX),
+
 	REG_VARIABLE(CFG_ROAM_DENSE_MIN_APS, WLAN_PARAM_Integer,
 		struct hdd_config, roam_dense_min_aps,
 		VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -5091,6 +5136,10 @@ void hdd_cfg_print(hdd_context_t *pHddCtx)
 		  "Name = [gbusBandwidthComputeInterval] Value = [%u] ",
 		  pHddCtx->config->busBandwidthComputeInterval);
 	QDF_TRACE(QDF_MODULE_ID_HDD, QDF_TRACE_LEVEL_INFO_HIGH,
+		  "Name = [%s] Value = [%u] ",
+		  CFG_ENABLE_TCP_DELACK,
+		  pHddCtx->config->enable_tcp_delack);
+	QDF_TRACE(QDF_MODULE_ID_HDD, QDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [gTcpDelAckThresholdHigh] Value = [%u] ",
 		  pHddCtx->config->tcpDelackThresholdHigh);
 	QDF_TRACE(QDF_MODULE_ID_HDD, QDF_TRACE_LEVEL_INFO_HIGH,
@@ -5302,6 +5351,9 @@ void hdd_cfg_print(hdd_context_t *pHddCtx)
 		CFG_ROAM_DENSE_RSSI_THRE_OFFSET,
 		pHddCtx->config->roam_dense_rssi_thresh_offset);
 	hdd_info("Name = [%s] Value = [%u]",
+		CFG_IGNORE_PEER_HT_MODE_NAME,
+		pHddCtx->config->ignore_peer_ht_opmode);
+	hdd_info("Name = [%s] Value = [%u]",
 		CFG_ROAM_DENSE_MIN_APS,
 		pHddCtx->config->roam_dense_min_aps);
 }
@@ -6745,6 +6797,8 @@ QDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 			pHddCtx->config->obss_active_dwelltime;
 	smeConfig->csrConfig.obss_passive_dwelltime =
 			pHddCtx->config->obss_passive_dwelltime;
+	smeConfig->csrConfig.ignore_peer_ht_opmode =
+			pConfig->ignore_peer_ht_opmode;
 
 	status = sme_update_config(pHddCtx->hHal, smeConfig);
 	if (!QDF_IS_STATUS_SUCCESS(status)) {
diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c
index 2a2c9940a53a..7db20291e808 100644
--- a/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/core/hdd/src/wlan_hdd_cfg80211.c
@@ -7902,6 +7902,107 @@ void hdd_select_cbmode(hdd_adapter_t *pAdapter, uint8_t operationChannel)
 				&ch_params);
 }
 
+/**
+ * wlan_hdd_handle_sap_sta_dfs_conc() - to handle SAP STA DFS conc
+ * @adapter: STA adapter
+ * @roam_profile: STA roam profile
+ *
+ * This routine will move SAP from dfs to non-dfs, if sta is coming up.
+ *
+ * Return: false if sta-sap conc is not allowed, else return true
+ */
+static bool wlan_hdd_handle_sap_sta_dfs_conc(hdd_adapter_t *adapter,
+						tCsrRoamProfile *roam_profile)
+{
+	hdd_context_t *hdd_ctx;
+	hdd_adapter_t *ap_adapter;
+	hdd_ap_ctx_t *hdd_ap_ctx;
+	hdd_hostapd_state_t *hostapd_state;
+	uint8_t channel = 0;
+	QDF_STATUS status;
+
+	hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		hdd_err("HDD context is NULL");
+		return true;
+	}
+
+	ap_adapter = hdd_get_adapter(hdd_ctx, QDF_SAP_MODE);
+	/* probably no sap running, no handling required */
+	if (ap_adapter == NULL)
+		return true;
+
+	/*
+	 * sap is not in started state, so it is fine to go ahead with sta.
+	 * if sap is currently doing CAC then don't allow sta to go further.
+	 */
+	if (!test_bit(SOFTAP_BSS_STARTED, &(ap_adapter)->event_flags) &&
+	    (hdd_ctx->dev_dfs_cac_status != DFS_CAC_IN_PROGRESS))
+		return true;
+
+	if (hdd_ctx->dev_dfs_cac_status == DFS_CAC_IN_PROGRESS) {
+		hdd_err("Concurrent SAP is in CAC state, STA is not allowed");
+		return false;
+	}
+
+	/*
+	 * log and return error, if we allow STA to go through, we don't
+	 * know what is going to happen better stop sta connection
+	 */
+	hdd_ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(ap_adapter);
+	if (NULL == hdd_ap_ctx) {
+		hdd_err("AP context not found");
+		return false;
+	}
+
+	/* sap is on non-dfs channel, nothing to handle */
+	if (!CDS_IS_DFS_CH(hdd_ap_ctx->operatingChannel)) {
+		hdd_info("sap is on non-dfs channel, sta is allowed");
+		return true;
+	}
+	/*
+	 * find out by looking in to scan cache where sta is going to
+	 * connect by passing its roam_profile. if channel is 0 or DFS then
+	 * better to call pcl and find out the best channel. if channel
+	 * is non-dfs then better move SAP to STA's channel to make
+	 * scc, so we have room for 3port MCC scenario
+	 */
+	status = cds_get_channel_from_scan_result(adapter,
+			roam_profile, &channel);
+
+	if ((QDF_STATUS_SUCCESS != status) || (0 == channel) ||
+	    CDS_IS_DFS_CH(channel))
+		channel = cds_get_nondfs_preferred_channel(CDS_SAP_MODE,
+								true);
+
+	hostapd_state = WLAN_HDD_GET_HOSTAP_STATE_PTR(ap_adapter);
+	qdf_event_reset(&hostapd_state->qdf_event);
+	status = wlansap_set_channel_change_with_csa(
+			WLAN_HDD_GET_SAP_CTX_PTR(ap_adapter), channel,
+			hdd_ap_ctx->sapConfig.ch_width_orig);
+
+	if (QDF_STATUS_SUCCESS != status) {
+		hdd_err("Set channel with CSA IE failed, can't allow STA");
+		return false;
+	}
+
+	/*
+	 * wait here for SAP to finish the channel switch. When channel
+	 * switch happens, SAP sends few beacons with CSA_IE. After
+	 * successfully Transmission of those beacons, it will move its
+	 * state from started to disconnected and move to new channel.
+	 * once it moves to new channel, sap again moves its state
+	 * machine from disconnected to started and set this event.
+	 * wait for 10 secs to finish this.
+	 */
+	status = qdf_wait_single_event(&hostapd_state->qdf_event, 10000);
+	if (!QDF_IS_STATUS_SUCCESS(status)) {
+		hdd_err("wait for qdf_event failed, STA not allowed!!");
+		return false;
+	}
+
+	return true;
+}
 
 /*
  * FUNCTION: wlan_hdd_cfg80211_connect_start
@@ -8130,9 +8231,20 @@ int wlan_hdd_cfg80211_connect_start(hdd_adapter_t *pAdapter,
 				return 0;
 		}
 
+		if (pHddCtx->config->policy_manager_enabled &&
+			(false == wlan_hdd_handle_sap_sta_dfs_conc(pAdapter,
+				pRoamProfile))) {
+			hdd_err("sap-sta conc will fail, can't allow sta");
+			hdd_conn_set_connection_state(pAdapter,
+					eConnectionState_NotConnected);
+			return -ENOMEM;
+		}
+
 		sme_config = qdf_mem_malloc(sizeof(*sme_config));
 		if (!sme_config) {
 			hdd_err("unable to allocate sme_config");
+			hdd_conn_set_connection_state(pAdapter,
+					eConnectionState_NotConnected);
 			return -ENOMEM;
 		}
 		qdf_mem_zero(sme_config, sizeof(*sme_config));
diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c
index d98a6cf6adf9..fc3f3d1d6ff0 100644
--- a/core/hdd/src/wlan_hdd_ioctl.c
+++ b/core/hdd/src/wlan_hdd_ioctl.c
@@ -423,21 +423,20 @@ static int hdd_parse_setrmcrate_command(uint8_t *pValue,
 }
 
 /**
- * hdd_cfg80211_get_ibss_peer_info_cb() - Callback function for IBSS
- * Peer Info request
- * @pUserData:		Adapter private data
- * @pPeerInfoRsp:	Peer info response
+ * hdd_get_ibss_peer_info_cb() - IBSS peer Info request callback
+ * @UserData: Adapter private data
+ * @pPeerInfoRsp: Peer info response
  *
  * This is an asynchronous callback function from SME when the peer info
  * is received
  *
  * Return: 0 for success non-zero for failure
  */
-static void
-hdd_cfg80211_get_ibss_peer_info_cb(void *pUserData, void *pPeerInfoRsp)
+void
+hdd_get_ibss_peer_info_cb(void *pUserData,
+				tSirPeerInfoRspParams *pPeerInfo)
 {
 	hdd_adapter_t *adapter = (hdd_adapter_t *) pUserData;
-	hdd_ibss_peer_info_t *pPeerInfo = (hdd_ibss_peer_info_t *)pPeerInfoRsp;
 	hdd_station_ctx_t *pStaCtx;
 	uint8_t i;
 
@@ -451,21 +450,19 @@ hdd_cfg80211_get_ibss_peer_info_cb(void *pUserData, void *pPeerInfoRsp)
 
 	pStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
 	if (NULL != pPeerInfo && QDF_STATUS_SUCCESS == pPeerInfo->status) {
-		pStaCtx->ibss_peer_info.status = pPeerInfo->status;
-		pStaCtx->ibss_peer_info.numIBSSPeers = pPeerInfo->numIBSSPeers;
-
-		/* Paranoia check */
-		if (pPeerInfo->numIBSSPeers < MAX_IBSS_PEERS) {
-			for (i = 0; i < pPeerInfo->numIBSSPeers; i++) {
-				memcpy(&pStaCtx->ibss_peer_info.ibssPeerList[i],
-				       &pPeerInfo->ibssPeerList[i],
-				       sizeof(hdd_ibss_peer_info_params_t));
+		/* validate number of peers */
+		if (pPeerInfo->numPeers < SIR_MAX_NUM_STA_IN_IBSS) {
+			pStaCtx->ibss_peer_info.status = pPeerInfo->status;
+			pStaCtx->ibss_peer_info.numPeers = pPeerInfo->numPeers;
+
+			for (i = 0; i < pPeerInfo->numPeers; i++) {
+				pStaCtx->ibss_peer_info.peerInfoParams[i] =
+					pPeerInfo->peerInfoParams[i];
 			}
-			hddLog(LOG1, FL("Peer Info copied in HDD"));
+			hdd_info("Peer Info copied in HDD");
 		} else {
-			hddLog(LOG1,
-			       FL("Number of peers %d returned is more than limit %d"),
-			       pPeerInfo->numIBSSPeers, MAX_IBSS_PEERS);
+			hdd_info("Number of peers %d returned is more than limit %d",
+				pPeerInfo->numPeers, SIR_MAX_NUM_STA_IN_IBSS);
 		}
 	} else {
 		hddLog(LOG1, FL("peerInfo returned is NULL"));
@@ -492,7 +489,7 @@ QDF_STATUS hdd_cfg80211_get_ibss_peer_info_all(hdd_adapter_t *adapter)
 	INIT_COMPLETION(adapter->ibss_peer_info_comp);
 
 	retStatus = sme_request_ibss_peer_info(hHal, adapter,
-					hdd_cfg80211_get_ibss_peer_info_cb,
+					hdd_get_ibss_peer_info_cb,
 					true, 0xFF);
 
 	if (QDF_STATUS_SUCCESS == retStatus) {
@@ -536,7 +533,7 @@ hdd_cfg80211_get_ibss_peer_info(hdd_adapter_t *adapter, uint8_t staIdx)
 	INIT_COMPLETION(adapter->ibss_peer_info_comp);
 
 	retStatus = sme_request_ibss_peer_info(hHal, adapter,
-				hdd_cfg80211_get_ibss_peer_info_cb,
+				hdd_get_ibss_peer_info_cb,
 				false, staIdx);
 
 	if (QDF_STATUS_SUCCESS == retStatus) {
@@ -5328,8 +5325,7 @@ static int drv_cmd_get_ibss_peer_info_all(hdd_adapter_t *adapter,
 	char *extra = NULL;
 	int idx = 0;
 	int length = 0;
-	struct qdf_mac_addr *macAddr;
-	uint32_t txRateMbps = 0;
+	uint8_t mac_addr[QDF_MAC_ADDR_SIZE];
 	uint32_t numOfBytestoPrint = 0;
 
 	if (QDF_IBSS_MODE != adapter->device_mode) {
@@ -5366,51 +5362,34 @@ static int drv_cmd_get_ibss_peer_info_all(hdd_adapter_t *adapter,
 
 		/* Copy number of stations */
 		length = scnprintf(extra, WLAN_MAX_BUF_SIZE, "%d ",
-				   pHddStaCtx->ibss_peer_info.
-				   numIBSSPeers);
+				   pHddStaCtx->ibss_peer_info.numPeers);
 		numOfBytestoPrint = length;
-		for (idx = 0; idx < pHddStaCtx->ibss_peer_info.numIBSSPeers;
-		     idx++) {
-			macAddr = hdd_wlan_get_ibss_mac_addr_from_staid
-					(adapter,
-					 pHddStaCtx->ibss_peer_info.
-					 ibssPeerList[idx].staIdx);
-			if (NULL != macAddr) {
-				txRateMbps = ((pHddStaCtx->
-					ibss_peer_info.
-						ibssPeerList[idx].txRate)
-						* 500 * 1000) / 1000000;
-				length += scnprintf((extra + length),
-						WLAN_MAX_BUF_SIZE - length,
-						"%02x:%02x:%02x:%02x:%02x:%02x %d %d ",
-						macAddr->bytes[0],
-						macAddr->bytes[1],
-						macAddr->bytes[2],
-						macAddr->bytes[3],
-						macAddr->bytes[4],
-						macAddr->bytes[5],
-						(int)txRateMbps,
-						(int)pHddStaCtx->
-							ibss_peer_info.
-							ibssPeerList[idx].
-								rssi);
-			} else {
-				QDF_TRACE(QDF_MODULE_ID_HDD,
-					  QDF_TRACE_LEVEL_ERROR,
-					  "%s: MAC ADDR is NULL for staIdx: %d",
-					  __func__,
-					  pHddStaCtx->
-						ibss_peer_info.
-							ibssPeerList[idx].
-								staIdx);
-			}
-
+		for (idx = 0; idx < pHddStaCtx->ibss_peer_info.numPeers;
+								idx++) {
+			int8_t rssi;
+			uint32_t tx_rate;
+
+			qdf_mem_copy(mac_addr,
+				pHddStaCtx->ibss_peer_info.peerInfoParams[idx].
+				mac_addr, sizeof(mac_addr));
+
+			tx_rate =
+				pHddStaCtx->ibss_peer_info.peerInfoParams[idx].
+									txRate;
+			rssi = pHddStaCtx->ibss_peer_info.peerInfoParams[idx].
+									rssi;
+
+			length += scnprintf((extra + length),
+				WLAN_MAX_BUF_SIZE - length,
+				"%02x:%02x:%02x:%02x:%02x:%02x %d %d ",
+				mac_addr[0], mac_addr[1], mac_addr[2],
+				mac_addr[3], mac_addr[4], mac_addr[5],
+				tx_rate, rssi);
 			/*
-			 * QDF_TRACE() macro has limitation of 512 bytes
-			 * for the print buffer. Hence printing the data
-			 * in two chunks. The first chunk will have the data
-			 * for 16 devices and the second chunk will
-			 * have the rest.
+			 * cdf_trace_msg has limitation of 512 bytes for the
+			 * print buffer. Hence printing the data in two chunks.
+			 * The first chunk will have the data for 16 devices
+			 * and the second chunk will have the rest.
 			 */
 			if (idx < NUM_OF_STA_DATA_TO_PRINT)
 				numOfBytestoPrint = length;
@@ -5484,8 +5463,6 @@ static int drv_cmd_get_ibss_peer_info(hdd_adapter_t *adapter,
 	char extra[128] = { 0 };
 	uint32_t length = 0;
 	uint8_t staIdx = 0;
-	uint32_t txRateMbps = 0;
-	uint32_t txRate;
 	struct qdf_mac_addr peerMacAddr;
 
 	if (QDF_IBSS_MODE != adapter->device_mode) {
@@ -5523,7 +5500,7 @@ static int drv_cmd_get_ibss_peer_info(hdd_adapter_t *adapter,
 		goto exit;
 	}
 
-	/* Get station index for the peer mac address */
+	/* Get station index for the peer mac address and sanitize it */
 	hdd_ibss_get_sta_id(pHddStaCtx, &peerMacAddr, &staIdx);
 
 	if (staIdx > MAX_IBSS_PEERS) {
@@ -5538,13 +5515,13 @@ static int drv_cmd_get_ibss_peer_info(hdd_adapter_t *adapter,
 	/* Handle the command */
 	status = hdd_cfg80211_get_ibss_peer_info(adapter, staIdx);
 	if (QDF_STATUS_SUCCESS == status) {
-		txRate = pHddStaCtx->ibss_peer_info.ibssPeerList[0].txRate;
-		txRateMbps = (txRate * 500 * 1000) / 1000000;
+		uint32_t txRate =
+			pHddStaCtx->ibss_peer_info.peerInfoParams[0].txRate;
 
 		length = scnprintf(extra, sizeof(extra), "%d %d",
-				   (int)txRateMbps,
-				   (int)pHddStaCtx->ibss_peer_info.
-				   ibssPeerList[0].rssi);
+				(int)txRate,
+				(int)pHddStaCtx->ibss_peer_info.
+				peerInfoParams[0].rssi);
 
 		/* Copy the data back into buffer */
 		if (copy_to_user(priv_data->buf, &extra, length + 1)) {
diff --git a/core/hdd/src/wlan_hdd_ipa.c b/core/hdd/src/wlan_hdd_ipa.c
index 19f55055d60c..84cc0e37cb38 100644
--- a/core/hdd/src/wlan_hdd_ipa.c
+++ b/core/hdd/src/wlan_hdd_ipa.c
@@ -451,7 +451,7 @@ struct hdd_ipa_priv {
 };
 
 /**
- * FIXME: The following conversion routines will are just stubs.
+ * FIXME: The following conversion routines are just stubs.
  *        They will be implemented fully by another update.
  *        The stubs will let the compile go ahead, and functionality
  *        is broken.
diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c
index ae1e9d00109c..acf6f9de0335 100644
--- a/core/hdd/src/wlan_hdd_main.c
+++ b/core/hdd/src/wlan_hdd_main.c
@@ -3770,6 +3770,82 @@ static inline int hdd_logging_sock_deactivate_svc(hdd_context_t *hdd_ctx)
 #endif
 
 /**
+ * hdd_exit_netlink_services - Exit netlink services
+ * @hdd_ctx: HDD context
+ *
+ * Exit netlink services like cnss_diag, cesium netlink socket, ptt socket and
+ * nl service.
+ *
+ * Return: None.
+ */
+static void hdd_exit_netlink_services(hdd_context_t *hdd_ctx)
+{
+	cnss_diag_notify_wlan_close();
+
+	hdd_close_cesium_nl_sock();
+
+	ptt_sock_deactivate_svc();
+
+	nl_srv_exit();
+}
+
+/**
+ * hdd_init_netlink_services- Init netlink services
+ * @hdd_ctx: HDD context
+ *
+ * Init netlink services like cnss_diag, cesium netlink socket, ptt socket and
+ * nl service.
+ *
+ * Return: 0 on success and errno on failure.
+ */
+static int hdd_init_netlink_services(hdd_context_t *hdd_ctx)
+{
+	int ret;
+
+	ret = nl_srv_init();
+	if (ret) {
+		hdd_alert("nl_srv_init failed: %d", ret);
+		goto out;
+	}
+
+	ret = oem_activate_service(hdd_ctx);
+	if (ret) {
+		hdd_alert("oem_activate_service failed: %d", ret);
+		goto err_nl_srv;
+	}
+
+	ret = ptt_sock_activate_svc();
+	if (ret) {
+		hdd_alert("ptt_sock_activate_svc failed: %d", ret);
+		goto err_nl_srv;
+	}
+
+	ret = hdd_open_cesium_nl_sock();
+	if (ret) {
+		hdd_alert("hdd_open_cesium_nl_sock failed");
+		goto err_ptt_deactivate;
+	}
+
+	ret = cnss_diag_activate_service();
+	if (ret) {
+		hdd_alert("cnss_diag_activate_service failed: %d", ret);
+		goto err_close_cesium;
+	}
+
+	return 0;
+
+err_close_cesium:
+	hdd_close_cesium_nl_sock();
+err_ptt_deactivate:
+	ptt_sock_deactivate_svc();
+err_nl_srv:
+	nl_srv_exit();
+out:
+	return ret;
+}
+
+
+/**
  * hdd_free_context - Free HDD context
  * @hdd_ctx:	HDD context to be freed.
  *
@@ -3914,16 +3990,10 @@ void hdd_wlan_exit(hdd_context_t *hdd_ctx)
 
 	hdd_wlan_green_ap_deinit(hdd_ctx);
 
-#ifdef WLAN_KD_READY_NOTIFIER
-	cnss_diag_notify_wlan_close();
-	ptt_sock_deactivate_svc();
-#endif /* WLAN_KD_READY_NOTIFIER */
-	nl_srv_exit();
+	hdd_exit_netlink_services(hdd_ctx);
 
 	hdd_close_all_adapters(hdd_ctx, false);
 
-	hdd_close_cesium_nl_sock();
-
 	hdd_ipa_cleanup(hdd_ctx);
 
 	/* Free up RoC request queue and flush workqueue */
@@ -4309,6 +4379,17 @@ static int hdd_wiphy_init(hdd_context_t *hdd_ctx)
 	return ret_val;
 }
 
+/**
+ * hdd_cnss_request_bus_bandwidth() - Function to control bus bandwidth
+ * @hdd_ctx - handle to hdd context
+ * @tx_packets - transmit packet count
+ * @rx_packets - receive packet count
+ *
+ * The function controls the bus bandwidth and dynamic control of
+ * tcp delayed ack configuration
+ *
+ * Returns: None
+ */
 #ifdef MSM_PLATFORM
 void hdd_cnss_request_bus_bandwidth(hdd_context_t *hdd_ctx,
 			const uint64_t tx_packets, const uint64_t rx_packets)
@@ -4335,11 +4416,8 @@ void hdd_cnss_request_bus_bandwidth(hdd_context_t *hdd_ctx,
 							next_vote_level;
 
 	if (hdd_ctx->cur_vote_level != next_vote_level) {
-		hddLog(QDF_TRACE_LEVEL_DEBUG,
-		       FL(
-			  "trigger level %d, tx_packets: %lld, rx_packets: %lld"
-			 ),
-		       next_vote_level, tx_packets, rx_packets);
+		hdd_debug("trigger level %d, tx_packets: %lld, rx_packets: %lld",
+			 next_vote_level, tx_packets, rx_packets);
 		hdd_ctx->cur_vote_level = next_vote_level;
 		cnss_request_bus_bandwidth(next_vote_level);
 	}
@@ -4357,11 +4435,16 @@ void hdd_cnss_request_bus_bandwidth(hdd_context_t *hdd_ctx,
 								next_rx_level;
 
 	if (hdd_ctx->cur_rx_level != next_rx_level) {
-		hddLog(QDF_TRACE_LEVEL_DEBUG,
-		       FL("TCP DELACK trigger level %d, average_rx: %llu"),
+		hdd_debug("TCP DELACK trigger level %d, average_rx: %llu",
 		       next_rx_level, temp_rx);
 		hdd_ctx->cur_rx_level = next_rx_level;
-		wlan_hdd_send_svc_nlink_msg(WLAN_SVC_WLAN_TP_IND,
+		/* Send throughput indication only if it is enabled.
+		 * Disabling tcp_del_ack will revert the tcp stack behavior
+		 * to default delayed ack. Note that this will disable the
+		 * dynamic delayed ack mechanism across the system
+		 */
+		if (hdd_ctx->config->enable_tcp_delack)
+			wlan_hdd_send_svc_nlink_msg(WLAN_SVC_WLAN_TP_IND,
 					    &next_rx_level,
 					    sizeof(next_rx_level));
 	}
@@ -5253,6 +5336,7 @@ hdd_context_t *hdd_init_context(struct device *dev, void *hif_sc)
 
 	hdd_tdls_pre_init(hdd_ctx);
 	mutex_init(&hdd_ctx->dfs_lock);
+	mutex_init(&hdd_ctx->sap_lock);
 
 	init_completion(&hdd_ctx->set_antenna_mode_cmpl);
 
@@ -5495,6 +5579,15 @@ static int hdd_init_thermal_info(hdd_context_t *hdd_ctx)
 		hdd_ctx->config->thermalMitigationEnable;
 	thermal_param.smeThrottlePeriod = hdd_ctx->config->throttlePeriod;
 
+	thermal_param.sme_throttle_duty_cycle_tbl[0] =
+		hdd_ctx->config->throttle_dutycycle_level0;
+	thermal_param.sme_throttle_duty_cycle_tbl[1] =
+		hdd_ctx->config->throttle_dutycycle_level1;
+	thermal_param.sme_throttle_duty_cycle_tbl[2] =
+		hdd_ctx->config->throttle_dutycycle_level2;
+	thermal_param.sme_throttle_duty_cycle_tbl[3] =
+		hdd_ctx->config->throttle_dutycycle_level3;
+
 	thermal_param.smeThermalLevels[0].smeMinTempThreshold =
 		hdd_ctx->config->thermalTempMinLevel0;
 	thermal_param.smeThermalLevels[0].smeMaxTempThreshold =
@@ -5763,7 +5856,7 @@ int hdd_wlan_startup(struct device *dev, void *hif_sc)
 	ret = hdd_update_country_code(hdd_ctx, adapter);
 
 	if (ret)
-		goto err_cds_disable;
+		goto err_close_adapter;
 
 	sme_register11d_scan_done_callback(hdd_ctx->hHal, hdd_11d_scan_done);
 
@@ -5773,34 +5866,10 @@ int hdd_wlan_startup(struct device *dev, void *hif_sc)
 	/* FW capabilities received, Set the Dot11 mode */
 	sme_setdef_dot11mode(hdd_ctx->hHal);
 
-	/* Initialize the nlink service */
-	if (nl_srv_init() != 0) {
-		hddLog(QDF_TRACE_LEVEL_FATAL, FL("nl_srv_init failed"));
-		goto err_close_adapter;
-	}
-
-	ret = oem_activate_service(hdd_ctx);
-	if (ret) {
-		hdd_alert("oem_activate_service failed: %d", ret);
-		goto err_nl_srv;
-	}
-
-	ret = ptt_sock_activate_svc();
-	if (ret) {
-		hdd_alert("ptt_sock_activate_svc failed: %d", ret);
-		goto err_nl_srv;
-	}
-
-	ret = cnss_diag_activate_service();
-	if (ret) {
-		hdd_alert("cnss_diag_activate_service failed: %d", ret);
-		goto err_nl_srv;
-	}
+	ret = hdd_init_netlink_services(hdd_ctx);
 
-	if (hdd_open_cesium_nl_sock() < 0) {
-		hdd_alert("hdd_open_cesium_nl_sock failed");
-		goto err_nl_srv;
-	}
+	if (ret)
+		goto err_debugfs_exit;
 
 	/*
 	 * Action frame registered in one adapter which will
@@ -5808,15 +5877,13 @@ int hdd_wlan_startup(struct device *dev, void *hif_sc)
 	 */
 	wlan_hdd_cfg80211_register_frames(adapter);
 
-	mutex_init(&hdd_ctx->sap_lock);
-
 	hdd_release_rtnl_lock();
 	rtnl_held = false;
 
 	ret = register_netdevice_notifier(&hdd_netdev_notifier);
 	if (ret < 0) {
 		hdd_err("register_netdevice_notifier failed: %d", ret);
-		goto err_nl_srv;
+		goto err_exit_nl_srv;
 	}
 
 #ifdef WLAN_FEATURE_HOLD_RX_WAKELOCK
@@ -5856,14 +5923,14 @@ int hdd_wlan_startup(struct device *dev, void *hif_sc)
 	status = cds_init_policy_mgr();
 	if (!QDF_IS_STATUS_SUCCESS(status)) {
 		hdd_err("Policy manager initialization failed");
-		goto err_unreg_netdev_notifier;
+		goto err_exit_nl_srv;
 	}
 
 	ret = hdd_init_thermal_info(hdd_ctx);
 
 	if (ret) {
 		hdd_err("Error while initializing thermal information");
-		goto err_unreg_netdev_notifier;
+		goto err_exit_nl_srv;
 	}
 
 	if (0 != hdd_lro_init(hdd_ctx))
@@ -5947,19 +6014,16 @@ int hdd_wlan_startup(struct device *dev, void *hif_sc)
 err_unreg_netdev_notifier:
 	unregister_netdevice_notifier(&hdd_netdev_notifier);
 
-err_nl_srv:
-#ifdef WLAN_KD_READY_NOTIFIER
-	cnss_diag_notify_wlan_close();
-	ptt_sock_deactivate_svc();
-#endif /* WLAN_KD_READY_NOTIFIER */
-	nl_srv_exit();
+err_exit_nl_srv:
+	hdd_exit_netlink_services(hdd_ctx);
 
 	if (!QDF_IS_STATUS_SUCCESS(cds_deinit_policy_mgr())) {
 		hdd_err("Failed to deinit policy manager");
 		/* Proceed and complete the clean up */
 	}
 
-	hdd_close_cesium_nl_sock();
+err_debugfs_exit:
+	hdd_debugfs_exit(adapter);
 
 err_close_adapter:
 	hdd_release_rtnl_lock();
diff --git a/core/hdd/src/wlan_hdd_oemdata.c b/core/hdd/src/wlan_hdd_oemdata.c
index 0112f694fe0c..ffe9de13be38 100644
--- a/core/hdd/src/wlan_hdd_oemdata.c
+++ b/core/hdd/src/wlan_hdd_oemdata.c
@@ -58,7 +58,7 @@ static struct hdd_context_s *p_hdd_ctx;
 static int populate_oem_data_cap(hdd_adapter_t *adapter,
 				 t_iw_oem_data_cap *data_cap)
 {
-	QDF_STATUS status = QDF_STATUS_E_FAILURE;
+	QDF_STATUS status;
 	struct hdd_config *config;
 	uint32_t num_chan;
 	uint8_t *chan_list;
@@ -94,7 +94,7 @@ static int populate_oem_data_cap(hdd_adapter_t *adapter,
 	data_cap->supported_bands = config->nBandCapability;
 
 	/* request for max num of channels */
-	num_chan = WNI_CFG_VALID_CHANNEL_LIST_LEN;
+	num_chan = OEM_CAP_MAX_NUM_CHANNELS;
 	status = sme_get_cfg_valid_channels(hdd_ctx->hHal,
 					    &chan_list[0], &num_chan);
 	if (QDF_STATUS_SUCCESS != status) {
diff --git a/core/hdd/src/wlan_hdd_power.c b/core/hdd/src/wlan_hdd_power.c
index 8863e8486f71..7961eb5a626d 100644
--- a/core/hdd/src/wlan_hdd_power.c
+++ b/core/hdd/src/wlan_hdd_power.c
@@ -1622,10 +1622,9 @@ err_cds_close:
 	if (pHddCtx) {
 		/* Unregister the Net Device Notifier */
 		unregister_netdevice_notifier(&hdd_netdev_notifier);
-#ifdef WLAN_KD_READY_NOTIFIER
 		cnss_diag_notify_wlan_close();
 		ptt_sock_deactivate_svc();
-#endif /* WLAN_KD_READY_NOTIFIER */
+
 		nl_srv_exit();
 
 		/* Free up dynamically allocated members inside HDD Adapter */
diff --git a/core/hdd/src/wlan_hdd_regulatory.c b/core/hdd/src/wlan_hdd_regulatory.c
index 67ecde1c18f3..e0570b943f4f 100644
--- a/core/hdd/src/wlan_hdd_regulatory.c
+++ b/core/hdd/src/wlan_hdd_regulatory.c
@@ -51,15 +51,16 @@
 #define REG_RULE_2412_2462    REG_RULE(2412-10, 2462+10, 40, 0, 20, 0)
 
 #define REG_RULE_2467_2472    REG_RULE(2467-10, 2472+10, 40, 0, 20, \
-			      NL80211_RRF_PASSIVE_SCAN)
+		NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS)
 
-#define REG_RULE_2484         REG_RULE(2484-10, 2484+10, 40, 0, 20, \
-		NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_OFDM)
+#define REG_RULE_2484         REG_RULE(2484-10, 2484+10, 20, 0, 20, \
+		NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS | \
+				       NL80211_RRF_NO_OFDM)
 
-#define REG_RULE_5180_5320    REG_RULE(5180-10, 5320+10, 80, 0, 20, \
+#define REG_RULE_5180_5320    REG_RULE(5180-10, 5320+10, 160, 0, 20, \
 		NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS)
 
-#define REG_RULE_5500_5720    REG_RULE(5500-10, 5720+10, 80, 0, 20, \
+#define REG_RULE_5500_5720    REG_RULE(5500-10, 5720+10, 160, 0, 20, \
 		NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS)
 
 #define REG_RULE_5745_5925    REG_RULE(5745-10, 5925+10, 80, 0, 20, \
@@ -399,6 +400,7 @@ static void hdd_process_regulatory_data(hdd_context_t *hdd_ctx,
 			}
 			cds_chan->pwr_limit = wiphy_chan->max_power;
 			cds_chan->flags = wiphy_chan->flags;
+
 		}
 	}
 
diff --git a/core/hdd/src/wlan_hdd_scan.c b/core/hdd/src/wlan_hdd_scan.c
index 561290eb2c81..d35f21bd0d0f 100644
--- a/core/hdd/src/wlan_hdd_scan.c
+++ b/core/hdd/src/wlan_hdd_scan.c
@@ -505,6 +505,48 @@ static int hdd_indicate_scan_result(hdd_scan_info_t *scanInfo,
 	return 0;
 }
 
+/**
+ * wlan_hdd_is_scan_pending() - Utility function to check pending scans
+ * @adapter: Pointer to the adapter
+ *
+ * Utility function to check pending scans on a particular adapter
+ *
+ * Return: true if scans are pending, false otherwise
+ */
+static bool wlan_hdd_is_scan_pending(hdd_adapter_t *adapter)
+{
+	hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+	qdf_list_node_t *pnode = NULL, *ppnode = NULL;
+	struct hdd_scan_req *hdd_scan_req;
+
+	qdf_spin_lock(&hdd_ctx->hdd_scan_req_q_lock);
+
+	if (qdf_list_empty(&hdd_ctx->hdd_scan_req_q)) {
+		qdf_spin_unlock(&hdd_ctx->hdd_scan_req_q_lock);
+		return false;
+	}
+
+	if (QDF_STATUS_SUCCESS != qdf_list_peek_front(&hdd_ctx->hdd_scan_req_q,
+							&ppnode)) {
+		qdf_spin_unlock(&hdd_ctx->hdd_scan_req_q_lock);
+		hdd_err("Failed to remove Scan Req from queue");
+		return false;
+	}
+
+	do {
+		pnode = ppnode;
+		hdd_scan_req = (struct hdd_scan_req *)pnode;
+		/* Any scan pending on the adapter */
+		if (adapter == hdd_scan_req->adapter) {
+			qdf_spin_unlock(&hdd_ctx->hdd_scan_req_q_lock);
+			return true;
+		}
+	} while (QDF_STATUS_SUCCESS ==
+		qdf_list_peek_next(&hdd_ctx->hdd_scan_req_q, pnode, &ppnode));
+
+	qdf_spin_unlock(&hdd_ctx->hdd_scan_req_q_lock);
+	return false;
+}
 
 /**
  * wlan_hdd_scan_request_enqueue() - enqueue Scan Request
@@ -647,7 +689,6 @@ hdd_scan_request_callback(tHalHandle halHandle, void *pContext,
 	uint8_t source;
 	struct cfg80211_scan_request *req;
 	uint32_t timestamp;
-	uint32_t size = 0;
 
 	ENTER();
 	hddLog(LOGW,
@@ -673,12 +714,9 @@ hdd_scan_request_callback(tHalHandle halHandle, void *pContext,
 		hdd_err("Got unexpected request struct for Scan id %d",
 			scanId);
 
-	qdf_spin_lock(&hddctx->hdd_scan_req_q_lock);
-	size = qdf_list_size(&(hddctx->hdd_scan_req_q));
-	if (!size)
-		/* Scan is no longer pending */
+	/* Scan is no longer pending */
+	if (!wlan_hdd_is_scan_pending(pAdapter))
 		pAdapter->scan_info.mScanPending = false;
-	qdf_spin_unlock(&hddctx->hdd_scan_req_q_lock);
 
 	/* notify any applications that may be interested */
 	memset(&wrqu, '\0', sizeof(wrqu));
@@ -1138,14 +1176,12 @@ static QDF_STATUS hdd_cfg80211_scan_done_callback(tHalHandle halHandle,
 		aborted = true;
 	}
 
-	qdf_spin_lock(&hddctx->hdd_scan_req_q_lock);
-	size = qdf_list_size(&(hddctx->hdd_scan_req_q));
-	if (!size) {
+	if (!wlan_hdd_is_scan_pending(pAdapter)) {
 		/* Scan is no longer pending */
 		pScanInfo->mScanPending = false;
 		complete(&pScanInfo->abortscan_event_var);
 	}
-	qdf_spin_unlock(&hddctx->hdd_scan_req_q_lock);
+
 	/*
 	 * Scan can be triggred from NL or vendor scan
 	 * - If scan is triggered from NL then cfg80211 scan done should be
@@ -1159,7 +1195,10 @@ static QDF_STATUS hdd_cfg80211_scan_done_callback(tHalHandle halHandle,
 		hdd_vendor_scan_callback(pAdapter, req, aborted);
 
 allow_suspend:
+	qdf_spin_lock(&hddctx->hdd_scan_req_q_lock);
+	size = qdf_list_size(&hddctx->hdd_scan_req_q);
 	if (!size) {
+		qdf_spin_unlock(&hddctx->hdd_scan_req_q_lock);
 		/* release the wake lock at the end of the scan */
 		hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_SCAN);
 
@@ -1171,6 +1210,9 @@ allow_suspend:
 		 */
 		hdd_prevent_suspend_timeout(1000,
 			WIFI_POWER_EVENT_WAKELOCK_SCAN);
+	} else {
+		/* Release the spin lock */
+		qdf_spin_unlock(&hddctx->hdd_scan_req_q_lock);
 	}
 
 #ifdef FEATURE_WLAN_TDLS
@@ -1274,7 +1316,7 @@ static int __wlan_hdd_cfg80211_scan(struct wiphy *wiphy,
 			con_dfs_ch =
 				con_sap_adapter->sessionCtx.ap.operatingChannel;
 
-		if (CDS_IS_DFS_CH(con_dfs_ch)) {
+		if (!wma_is_hw_dbs_capable() && CDS_IS_DFS_CH(con_dfs_ch)) {
 			/* Provide empty scan result during DFS operation since
 			 * scanning not supported during DFS. Reason is
 			 * following case:
diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c
index d7152da246b7..124d601a2cdb 100644
--- a/core/hdd/src/wlan_hdd_wext.c
+++ b/core/hdd/src/wlan_hdd_wext.c
@@ -766,36 +766,6 @@ error:
 }
 
 /**
- * hdd_get_ibss_peer_info_cb() - IBSS Peer Info Callback
- * @pUserData: user context originally passed to SME; we pass hdd adapter
- * @pPeerInfoRsp: IBSS Peer information
- *
- * Return: None
- */
-void hdd_get_ibss_peer_info_cb(void *pUserData, void *pPeerInfoRsp)
-{
-	hdd_adapter_t *pAdapter = (hdd_adapter_t *) pUserData;
-	hdd_ibss_peer_info_t *pPeerInfo = (hdd_ibss_peer_info_t *) pPeerInfoRsp;
-	hdd_station_ctx_t *pStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-	uint8_t i;
-
-	if (NULL != pPeerInfo && QDF_STATUS_SUCCESS == pPeerInfo->status) {
-		pStaCtx->ibss_peer_info.status = pPeerInfo->status;
-		pStaCtx->ibss_peer_info.numIBSSPeers = pPeerInfo->numIBSSPeers;
-		for (i = 0; i < pPeerInfo->numIBSSPeers; i++) {
-			memcpy(&pStaCtx->ibss_peer_info.ibssPeerList[i],
-			       &pPeerInfo->ibssPeerList[i],
-			       sizeof(hdd_ibss_peer_info_params_t));
-		}
-	} else {
-		QDF_TRACE(QDF_MODULE_ID_HDD, QDF_TRACE_LEVEL_INFO,
-			  "%s] PEER_INFO_CMD_STATUS is not SUCCESS", __func__);
-	}
-
-	complete(&pAdapter->ibss_peer_info_comp);
-}
-
-/**
  * hdd_wlan_get_ibss_mac_addr_from_staid() - Get IBSS MAC address
  * @pAdapter: Adapter upon which the IBSS client is active
  * @staIdx: Station index of the IBSS peer
@@ -832,7 +802,7 @@ QDF_STATUS hdd_wlan_get_ibss_peer_info(hdd_adapter_t *pAdapter, uint8_t staIdx)
 	QDF_STATUS status = QDF_STATUS_E_FAILURE;
 	tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
 	hdd_station_ctx_t *pStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-	hdd_ibss_peer_info_t *pPeerInfo = &pStaCtx->ibss_peer_info;
+	tSirPeerInfoRspParams *pPeerInfo = &pStaCtx->ibss_peer_info;
 
 	status =
 		sme_request_ibss_peer_info(hHal, pAdapter, hdd_get_ibss_peer_info_cb,
@@ -852,29 +822,16 @@ QDF_STATUS hdd_wlan_get_ibss_peer_info(hdd_adapter_t *pAdapter, uint8_t staIdx)
 		}
 
 		/** Print the peer info */
-		pr_info("pPeerInfo->numIBSSPeers = %d ",
-			pPeerInfo->numIBSSPeers);
-		pr_info
-			("============================================================");
+		hdd_info("pPeerInfo->numIBSSPeers = %d ", pPeerInfo->numPeers);
 		{
-			struct qdf_mac_addr *macAddr =
-				hdd_wlan_get_ibss_mac_addr_from_staid(pAdapter,
-								      staIdx);
-			uint32_t txRateMbps =
-				((pPeerInfo->ibssPeerList[0].txRate) * 500 * 1000) /
-				1000000;
-
-			if (NULL != macAddr) {
-				pr_info("PEER ADDR :" MAC_ADDRESS_STR
-					" TxRate: %d Mbps  RSSI: %d",
-					MAC_ADDR_ARRAY(macAddr->bytes),
-					(int)txRateMbps,
-					(int)pPeerInfo->ibssPeerList[0].rssi);
-			} else {
-				QDF_TRACE(QDF_MODULE_ID_HDD,
-					  QDF_TRACE_LEVEL_ERROR,
-					  " ERROR: PEER MAC ADDRESS NOT FOUND ");
-			}
+			uint8_t mac_addr[QDF_MAC_ADDR_SIZE];
+			uint32_t tx_rate = pPeerInfo->peerInfoParams[0].txRate;
+
+			qdf_mem_copy(mac_addr, pPeerInfo->peerInfoParams[0].
+					mac_addr, sizeof(mac_addr));
+			hdd_info("PEER ADDR : %pM TxRate: %d Mbps  RSSI: %d",
+				mac_addr, (int)tx_rate,
+				(int)pPeerInfo->peerInfoParams[0].rssi);
 		}
 	} else {
 		hddLog(QDF_TRACE_LEVEL_WARN,
@@ -897,7 +854,7 @@ QDF_STATUS hdd_wlan_get_ibss_peer_info_all(hdd_adapter_t *pAdapter)
 	QDF_STATUS status = QDF_STATUS_E_FAILURE;
 	tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
 	hdd_station_ctx_t *pStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-	hdd_ibss_peer_info_t *pPeerInfo = &pStaCtx->ibss_peer_info;
+	tSirPeerInfoRspParams *pPeerInfo = &pStaCtx->ibss_peer_info;
 	int i;
 
 	status =
@@ -917,32 +874,20 @@ QDF_STATUS hdd_wlan_get_ibss_peer_info_all(hdd_adapter_t *pAdapter)
 		}
 
 		/** Print the peer info */
-		pr_info("pPeerInfo->numIBSSPeers = %d ",
-			(int)pPeerInfo->numIBSSPeers);
-		pr_info
-			("============================================================");
-		for (i = 0; i < pPeerInfo->numIBSSPeers; i++) {
-			uint8_t staIdx = pPeerInfo->ibssPeerList[i].staIdx;
-			struct qdf_mac_addr *macAddr =
-				hdd_wlan_get_ibss_mac_addr_from_staid(pAdapter,
-								      staIdx);
-			uint32_t txRateMbps =
-				((pPeerInfo->ibssPeerList[0].txRate) * 500 * 1000) /
-				1000000;
-
-			pr_info("STAIDX:%d ",
-				(int)pPeerInfo->ibssPeerList[i].staIdx);
-			if (NULL != macAddr) {
-				pr_info(" PEER ADDR :" MAC_ADDRESS_STR
-					" TxRate: %d Mbps RSSI: %d",
-					MAC_ADDR_ARRAY(macAddr->bytes),
-					(int)txRateMbps,
-					(int)pPeerInfo->ibssPeerList[i].rssi);
-			} else {
-				QDF_TRACE(QDF_MODULE_ID_HDD,
-					  QDF_TRACE_LEVEL_ERROR,
-					  " ERROR: PEER MAC ADDRESS NOT FOUND ");
-			}
+		hdd_info("pPeerInfo->numIBSSPeers = %d ",
+			(int)pPeerInfo->numPeers);
+		for (i = 0; i < pPeerInfo->numPeers; i++) {
+			uint8_t mac_addr[QDF_MAC_ADDR_SIZE];
+			uint32_t tx_rate;
+
+			tx_rate = pPeerInfo->peerInfoParams[i].txRate;
+			qdf_mem_copy(mac_addr,
+				pPeerInfo->peerInfoParams[i].mac_addr,
+				sizeof(mac_addr));
+
+			hdd_info(" PEER ADDR : %pM TxRate: %d Mbps RSSI: %d",
+				mac_addr, (int)tx_rate,
+				(int)pPeerInfo->peerInfoParams[i].rssi);
 		}
 	} else {
 		hddLog(QDF_TRACE_LEVEL_WARN,
@@ -7021,6 +6966,11 @@ static int __iw_set_three_ints_getnone(struct net_device *dev,
 
 	ENTER_DEV(dev);
 
+	if (!capable(CAP_NET_ADMIN)) {
+		hddLog(LOGE, FL("permission check failed"));
+		return -EPERM;
+	}
+
 	ret = wlan_hdd_validate_context(hdd_ctx);
 	if (0 != ret)
 		return ret;
@@ -8010,6 +7960,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 			pr_info("|\t|chain_mask - %d\t\t|\n",
 						conn_info->chain_mask);
 			pr_info("|\t|chan - %d\t\t|\n", conn_info->chan);
+			pr_info("|\t|bw - %d\t\t|\n", conn_info->bw);
 			pr_info("|\t|mode - %d\t\t|\n", conn_info->mode);
 			pr_info("|\t|mac - %d\t\t|\n", conn_info->mac);
 			pr_info("|\t|in_use - %d\t\t|\n", conn_info->in_use);
@@ -8916,6 +8867,13 @@ static int wlan_hdd_set_filter(hdd_context_t *hdd_ctx,
 				request->params_data[i].data_offset,
 				request->params_data[i].data_length);
 
+			if (sizeof(packetFilterSetReq.paramsData[i].compareData)
+				< (request->params_data[i].data_length)) {
+				hdd_err("Error invalid data length %d",
+					request->params_data[i].data_length);
+				return -EINVAL;
+			}
+
 			memcpy(&packetFilterSetReq.paramsData[i].compareData,
 			       request->params_data[i].compare_data,
 			       request->params_data[i].data_length);
diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index e473452593ef..494519e7cc59 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -41,9 +41,10 @@
 #define QWLAN_VERSION_MAJOR            5
 #define QWLAN_VERSION_MINOR            1
 #define QWLAN_VERSION_PATCH            0
-#define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            2
+#define QWLAN_VERSION_EXTRA            "A"
+#define QWLAN_VERSION_BUILD            3
 
-#define QWLAN_VERSIONSTR               "5.1.0.2"
+#define QWLAN_VERSIONSTR               "5.1.0.3A"
+/* 172 */
 
 #endif /* QWLAN_VERSION_H */
diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h
index e6d13f0219da..cf0870c5f891 100644
--- a/core/mac/inc/sir_api.h
+++ b/core/mac/inc/sir_api.h
@@ -170,11 +170,22 @@ typedef enum {
 #define SIR_UAPSD_FLAG_ACBE     (1 << SIR_UAPSD_BITOFFSET_ACBE)
 #define SIR_UAPSD_GET(ac, mask)      (((mask) & (SIR_UAPSD_FLAG_ ## ac)) >> SIR_UAPSD_BITOFFSET_ ## ac)
 
-#define ROAM_SYNCH_PROPAGATION 1
-#define ROAMING_TX_QUEUE_DISABLE 2
 #endif
 
 /**
+ * enum sir_roam_op_code - Operation to be done by the callback.
+ * @SIR_ROAM_SYNCH_PROPAGATION: Propagate the new BSS info after roaming.
+ * @SIR_ROAMING_DEREGISTER_STA: Deregister the old STA after roaming.
+ * @SIR_ROAMING_TX_QUEUE_DISABLE: Disable the network queues while roaming.
+ * @SIR_ROAMING_TX_QUEUE_ENABLE: Enable back the n/w queues in case roam fails.
+ */
+enum sir_roam_op_code {
+	SIR_ROAM_SYNCH_PROPAGATION = 1,
+	SIR_ROAMING_DEREGISTER_STA,
+	SIR_ROAMING_TX_QUEUE_DISABLE,
+	SIR_ROAMING_TX_QUEUE_ENABLE,
+};
+/**
  * Module ID definitions.
  */
 enum {
@@ -482,8 +493,6 @@ typedef enum eSirBssType {
 	eSIR_INFRASTRUCTURE_MODE,
 	eSIR_INFRA_AP_MODE,     /* Added for softAP support */
 	eSIR_IBSS_MODE,
-	eSIR_BTAMP_STA_MODE,    /* Added for BT-AMP support */
-	eSIR_BTAMP_AP_MODE,     /* Added for BT-AMP support */
 	eSIR_AUTO_MODE,
 	eSIR_DONOT_USE_BSS_TYPE = SIR_MAX_ENUM_SIZE
 } tSirBssType;
@@ -847,13 +856,6 @@ typedef struct sSirSmeScanChanReq {
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
 
-#ifndef OEM_DATA_REQ_SIZE
-#define OEM_DATA_REQ_SIZE 280
-#endif
-#ifndef OEM_DATA_RSP_SIZE
-#define OEM_DATA_RSP_SIZE 1724
-#endif
-
 typedef struct sSirOemDataReq {
 	uint16_t messageType;   /* eWNI_SME_OEM_DATA_REQ */
 	uint16_t messageLen;
@@ -3570,31 +3572,31 @@ typedef struct sSirScanOffloadReq {
 } tSirScanOffloadReq, *tpSirScanOffloadReq;
 
 /**
- * lim_scan_event_type - scan event types used in LIM
- * @LIM_SCAN_EVENT_STARTED - scan command accepted by FW
- * @LIM_SCAN_EVENT_COMPLETED - scan has been completed by FW
- * @LIM_SCAN_EVENT_BSS_CHANNEL - FW is going to move to HOME channel
- * @LIM_SCAN_EVENT_FOREIGN_CHANNEL - FW is going to move to FORIEGN channel
- * @LIM_SCAN_EVENT_DEQUEUED - scan request got dequeued
- * @LIM_SCAN_EVENT_PREEMPTED - preempted by other high priority scan
- * @LIM_SCAN_EVENT_START_FAILED - scan start failed
- * @LIM_SCAN_EVENT_RESTARTED - scan restarted
- * @LIM_SCAN_EVENT_MAX - max value for event type
+ * sir_scan_event_type - scan event types used in LIM
+ * @SIR_SCAN_EVENT_STARTED - scan command accepted by FW
+ * @SIR_SCAN_EVENT_COMPLETED - scan has been completed by FW
+ * @SIR_SCAN_EVENT_BSS_CHANNEL - FW is going to move to HOME channel
+ * @SIR_SCAN_EVENT_FOREIGN_CHANNEL - FW is going to move to FORIEGN channel
+ * @SIR_SCAN_EVENT_DEQUEUED - scan request got dequeued
+ * @SIR_SCAN_EVENT_PREEMPTED - preempted by other high priority scan
+ * @SIR_SCAN_EVENT_START_FAILED - scan start failed
+ * @SIR_SCAN_EVENT_RESTARTED - scan restarted
+ * @SIR_SCAN_EVENT_MAX - max value for event type
 */
-enum lim_scan_event_type {
-	LIM_SCAN_EVENT_STARTED = 0x1,
-	LIM_SCAN_EVENT_COMPLETED = 0x2,
-	LIM_SCAN_EVENT_BSS_CHANNEL = 0x4,
-	LIM_SCAN_EVENT_FOREIGN_CHANNEL = 0x8,
-	LIM_SCAN_EVENT_DEQUEUED = 0x10,
-	LIM_SCAN_EVENT_PREEMPTED = 0x20,
-	LIM_SCAN_EVENT_START_FAILED = 0x40,
-	LIM_SCAN_EVENT_RESTARTED = 0x80,
-	LIM_SCAN_EVENT_MAX = 0x8000
+enum sir_scan_event_type {
+	SIR_SCAN_EVENT_STARTED = 0x1,
+	SIR_SCAN_EVENT_COMPLETED = 0x2,
+	SIR_SCAN_EVENT_BSS_CHANNEL = 0x4,
+	SIR_SCAN_EVENT_FOREIGN_CHANNEL = 0x8,
+	SIR_SCAN_EVENT_DEQUEUED = 0x10,
+	SIR_SCAN_EVENT_PREEMPTED = 0x20,
+	SIR_SCAN_EVENT_START_FAILED = 0x40,
+	SIR_SCAN_EVENT_RESTARTED = 0x80,
+	SIR_SCAN_EVENT_MAX = 0x8000
 };
 
 typedef struct sSirScanOffloadEvent {
-	enum lim_scan_event_type event;
+	enum sir_scan_event_type event;
 	tSirResultCodes reasonCode;
 	uint32_t chanFreq;
 	uint32_t requestor;
@@ -3742,15 +3744,20 @@ typedef struct {
 	/* of peer with staIdx is reported */
 } tSirIbssGetPeerInfoReqParams, *tpSirIbssGetPeerInfoReqParams;
 
-/*---------------------------------------------------------------------------
-* tSirIbssGetPeerInfoParams
-*--------------------------------------------------------------------------*/
+/**
+ * typedef struct - tSirIbssGetPeerInfoParams
+ * @mac_addr: mac address received from target
+ * @txRate: TX rate
+ * @mcsIndex: MCS index
+ * @txRateFlags: TX rate flags
+ * @rssi: RSSI
+ */
 typedef struct {
-	uint8_t staIdx;         /* StaIdx */
-	uint32_t txRate;        /* Tx Rate */
-	uint32_t mcsIndex;      /* MCS Index */
-	uint32_t txRateFlags;   /* TxRate Flags */
-	int8_t rssi;            /* RSSI */
+	uint8_t  mac_addr[QDF_MAC_ADDR_SIZE];
+	uint32_t txRate;
+	uint32_t mcsIndex;
+	uint32_t txRateFlags;
+	int8_t  rssi;
 } tSirIbssPeerInfoParams;
 
 typedef struct {
@@ -3972,12 +3979,15 @@ typedef enum {
 	WLAN_WMA_MAX_THERMAL_LEVELS
 } t_thermal_level;
 
+#define WLAN_THROTTLE_DUTY_CYCLE_LEVEL_MAX (4)
+
 typedef struct {
 	/* Array of thermal levels */
 	t_thermal_level_info thermalLevels[WLAN_WMA_MAX_THERMAL_LEVELS];
 	uint8_t thermalCurrLevel;
 	uint8_t thermalMgmtEnabled;
 	uint32_t throttlePeriod;
+	uint8_t throttle_duty_cycle_tbl[WLAN_THROTTLE_DUTY_CYCLE_LEVEL_MAX];
 } t_thermal_mgmt, *tp_thermal_mgmt;
 
 typedef struct sSirTxPowerLimit {
@@ -5547,6 +5557,18 @@ struct egap_conf_params {
 	uint32_t   flags;
 };
 
+#define SIR_BCN_FLT_MAX_ELEMS_IE_LIST 8
+/**
+ * struct beacon_filter_param - parameters for beacon filtering
+ * @vdev_id: vdev id
+ * @ie_map: bitwise map of IEs that needs to be filtered
+ *
+ */
+struct beacon_filter_param {
+	uint32_t   vdev_id;
+	uint32_t   ie_map[SIR_BCN_FLT_MAX_ELEMS_IE_LIST];
+};
+
 /**
  * struct csa_offload_params - CSA offload request parameters
  * @channel: channel
diff --git a/core/mac/inc/sir_mac_prot_def.h b/core/mac/inc/sir_mac_prot_def.h
index c675af7c0758..2585a4fa3445 100644
--- a/core/mac/inc/sir_mac_prot_def.h
+++ b/core/mac/inc/sir_mac_prot_def.h
@@ -128,6 +128,7 @@
 #define SIR_MAC_ACTION_SPECTRUM_MGMT   0
 #define SIR_MAC_ACTION_QOS_MGMT        1
 #define SIR_MAC_ACTION_DLP             2
+#define SIR_MAC_ACTION_BLKACK          3
 #define SIR_MAC_ACTION_PUBLIC_USAGE    4
 #define SIR_MAC_ACTION_RRM             5
 #define SIR_MAC_ACTION_FAST_BSS_TRNST  6
diff --git a/core/mac/src/cfg/cfg_api.c b/core/mac/src/cfg/cfg_api.c
index 78c0018055aa..18c7afe7b8eb 100644
--- a/core/mac/src/cfg/cfg_api.c
+++ b/core/mac/src/cfg/cfg_api.c
@@ -725,8 +725,6 @@ tSirRetStatus cfg_get_capability_info(tpAniSirGlobal pMac, uint16_t *pCap,
 	if (LIM_IS_IBSS_ROLE(sessionEntry))
 		pCapInfo->ibss = 1;     /* IBSS bit */
 	else if (LIM_IS_AP_ROLE(sessionEntry) ||
-		LIM_IS_BT_AMP_AP_ROLE(sessionEntry) ||
-		LIM_IS_BT_AMP_STA_ROLE(sessionEntry) ||
 		LIM_IS_STA_ROLE(sessionEntry))
 		pCapInfo->ess = 1;      /* ESS bit */
 	else if (LIM_IS_P2P_DEVICE_ROLE(sessionEntry)) {
diff --git a/core/mac/src/include/sir_params.h b/core/mac/src/include/sir_params.h
index c9d78ddaeb69..b1e08297c0ed 100644
--- a/core/mac/src/include/sir_params.h
+++ b/core/mac/src/include/sir_params.h
@@ -109,21 +109,6 @@ typedef enum eSriLinkState {
 	eSIR_LINK_POSTASSOC_STATE = 2,
 	eSIR_LINK_AP_STATE = 3,
 	eSIR_LINK_IBSS_STATE = 4,
-	/* BT-AMP Case */
-	eSIR_LINK_BTAMP_PREASSOC_STATE = 5,
-	eSIR_LINK_BTAMP_POSTASSOC_STATE = 6,
-	eSIR_LINK_BTAMP_AP_STATE = 7,
-	eSIR_LINK_BTAMP_STA_STATE = 8,
-
-	/* Reserved for HAL internal use */
-	eSIR_LINK_LEARN_STATE = 9,
-	eSIR_LINK_SCAN_STATE = 10,
-	eSIR_LINK_FINISH_SCAN_STATE = 11,
-	eSIR_LINK_INIT_CAL_STATE = 12,
-	eSIR_LINK_FINISH_CAL_STATE = 13,
-	eSIR_LINK_LISTEN_STATE = 14,
-	eSIR_LINK_SEND_ACTION_STATE = 15,
-	eSIR_LINK_DOWN_STATE = 16,
 } tSirLinkState;
 
 /* / Message queue structure used across Sirius project. */
@@ -613,6 +598,10 @@ typedef struct sSirMbMsgP2p {
 
 #define SIR_HAL_SET_EGAP_CONF_PARAMS        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 336)
 #define SIR_HAL_HT40_OBSS_SCAN_IND          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 337)
+
+#define SIR_HAL_ADD_BCN_FILTER_CMDID        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 339)
+#define SIR_HAL_REMOVE_BCN_FILTER_CMDID     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 340)
+
 #define SIR_HAL_MSG_TYPES_END                (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
 
 /* CFG message types */
diff --git a/core/mac/src/pe/include/lim_api.h b/core/mac/src/pe/include/lim_api.h
index 126f2aa1baa8..e66de6befda7 100644
--- a/core/mac/src/pe/include/lim_api.h
+++ b/core/mac/src/pe/include/lim_api.h
@@ -60,8 +60,6 @@
 #define LIM_IS_STA_ROLE(psessionEntry)          (GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_STA_ROLE)
 #define LIM_IS_IBSS_ROLE(psessionEntry)         (GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_STA_IN_IBSS_ROLE)
 #define LIM_IS_UNKNOWN_ROLE(psessionEntry)      (GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_UNKNOWN_ROLE)
-#define LIM_IS_BT_AMP_AP_ROLE(psessionEntry)    (GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_BT_AMP_AP_ROLE)
-#define LIM_IS_BT_AMP_STA_ROLE(psessionEntry)   (GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_BT_AMP_STA_ROLE)
 #define LIM_IS_P2P_DEVICE_ROLE(psessionEntry)   (GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_P2P_DEVICE_ROLE)
 #define LIM_IS_P2P_DEVICE_GO(psessionEntry)     (GET_LIM_SYSTEM_ROLE(psessionEntry) == eLIM_P2P_DEVICE_GO)
 /* gLimSmeState */
@@ -162,10 +160,6 @@ void lim_send_heart_beat_timeout_ind(tpAniSirGlobal pMac, tpPESession psessionEn
 tMgmtFrmDropReason lim_is_pkt_candidate_for_drop(tpAniSirGlobal pMac,
 						 uint8_t *pRxPacketInfo,
 						 uint32_t subType);
-bool lim_is_deauth_diassoc_for_drop(tpAniSirGlobal mac, uint8_t *rx_pkt_info);
-#ifdef WLAN_FEATURE_11W
-bool lim_is_assoc_req_for_drop(tpAniSirGlobal mac, uint8_t *rx_pkt_info);
-#endif
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 QDF_STATUS pe_roam_synch_callback(tpAniSirGlobal mac_ctx,
 	struct sSirSmeRoamOffloadSynchInd *roam_sync_ind_ptr,
diff --git a/core/mac/src/pe/include/lim_ft.h b/core/mac/src/pe/include/lim_ft.h
index 01307d77f5a3..e4751139a6f2 100644
--- a/core/mac/src/pe/include/lim_ft.h
+++ b/core/mac/src/pe/include/lim_ft.h
@@ -67,7 +67,7 @@ void lim_process_sta_mlm_add_bss_rsp_ft(tpAniSirGlobal pMac,
 		tpSirMsgQ limMsgQ, tpPESession psessionEntry);
 void lim_process_mlm_reassoc_req(tpAniSirGlobal mac_ctx, uint32_t *msg);
 void lim_preauth_scan_event_handler(tpAniSirGlobal mac_ctx,
-				enum lim_scan_event_type event,
+				enum sir_scan_event_type event,
 				uint8_t session_id,
 				uint32_t scan_id);
 QDF_STATUS lim_send_preauth_scan_offload(tpAniSirGlobal mac_ctx,
@@ -95,7 +95,7 @@ static inline void lim_process_mlm_reassoc_req(tpAniSirGlobal mac_ctx,
 		uint32_t *msg)
 {}
 static inline void lim_preauth_scan_event_handler(tpAniSirGlobal mac_ctx,
-		enum lim_scan_event_type event,
+		enum sir_scan_event_type event,
 		uint8_t session_id, uint32_t scan_id)
 {}
 static inline int lim_process_ft_pre_auth_req(tpAniSirGlobal pMac,
diff --git a/core/mac/src/pe/include/lim_global.h b/core/mac/src/pe/include/lim_global.h
index e1efe10930f0..5529f6bbc70f 100644
--- a/core/mac/src/pe/include/lim_global.h
+++ b/core/mac/src/pe/include/lim_global.h
@@ -81,8 +81,6 @@ typedef enum eLimSystemRole {
 	eLIM_AP_ROLE,
 	eLIM_STA_IN_IBSS_ROLE,
 	eLIM_STA_ROLE,
-	eLIM_BT_AMP_STA_ROLE,
-	eLIM_BT_AMP_AP_ROLE,
 	eLIM_P2P_DEVICE_ROLE,
 	eLIM_P2P_DEVICE_GO,
 	eLIM_P2P_DEVICE_CLIENT
@@ -289,13 +287,6 @@ struct tLimScanResultNode {
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
 
-#ifndef OEM_DATA_REQ_SIZE
-#define OEM_DATA_REQ_SIZE 280
-#endif
-#ifndef OEM_DATA_RSP_SIZE
-#define OEM_DATA_RSP_SIZE 1724
-#endif
-
 /* OEM Data related structure definitions */
 typedef struct sLimMlmOemDataReq {
 	struct qdf_mac_addr selfMacAddr;
diff --git a/core/mac/src/pe/lim/lim_api.c b/core/mac/src/pe/lim/lim_api.c
index 176a318deeed..5912165c93aa 100644
--- a/core/mac/src/pe/lim/lim_api.c
+++ b/core/mac/src/pe/lim/lim_api.c
@@ -1131,134 +1131,6 @@ uint8_t lim_is_system_in_scan_state(tpAniSirGlobal pMac)
 	}
 } /*** end lim_is_system_in_scan_state() ***/
 
-#ifdef WLAN_FEATURE_11W
-/**
- * lim_is_assoc_req_for_drop()- function to decides to drop assoc\reassoc
- *  frames.
- * @mac: pointer to global mac structure
- * @rx_pkt_info: rx packet meta information
- *
- * This function is called before enqueuing the frame to PE queue to
- * drop flooded assoc/reassoc frames getting into PE Queue.
- *
- * Return: true for dropping the frame otherwise false
- */
-
-bool lim_is_assoc_req_for_drop(tpAniSirGlobal mac, uint8_t *rx_pkt_info)
-{
-	uint8_t session_id;
-	uint16_t aid;
-	tpPESession session_entry;
-	tpSirMacMgmtHdr mac_hdr;
-	tpDphHashNode sta_ds;
-
-	mac_hdr = WMA_GET_RX_MAC_HEADER(rx_pkt_info);
-	session_entry = pe_find_session_by_bssid(mac, mac_hdr->bssId,
-				 &session_id);
-	if (!session_entry) {
-		PELOG1(limLog(pMac, LOG1,
-			FL("session does not exist for given STA [%pM]"),
-			mac_hdr->sa););
-		return false;
-	}
-
-	sta_ds = dph_lookup_hash_entry(mac, mac_hdr->sa, &aid,
-				&session_entry->dph.dphHashTable);
-	if (!sta_ds) {
-		PELOG1(limLog(pMac, LOG1, FL("pStaDs is NULL")););
-		return false;
-	}
-
-	if (!sta_ds->rmfEnabled)
-		return false;
-
-	if (sta_ds->pmfSaQueryState == DPH_SA_QUERY_IN_PROGRESS)
-		return true;
-
-	if (sta_ds->last_assoc_received_time &&
-		((qdf_mc_timer_get_system_ticks() -
-			 sta_ds->last_assoc_received_time) < 1000))
-		return true;
-
-	sta_ds->last_assoc_received_time = qdf_mc_timer_get_system_ticks();
-	return false;
-}
-#endif
-
-/**
- * lim_is_deauth_diassoc_for_drop()- function to decides to drop deauth\diassoc
- *  frames.
- * @mac: pointer to global mac structure
- * @rx_pkt_info: rx packet meta information
- *
- * This function is called before enqueuing the frame to PE queue to
- * drop flooded deauth/diassoc frames getting into PE Queue.
- *
- * Return: true for dropping the frame otherwise false
- */
-
-bool lim_is_deauth_diassoc_for_drop(tpAniSirGlobal mac, uint8_t *rx_pkt_info)
-{
-	uint8_t session_id;
-	uint16_t aid;
-	tpPESession session_entry;
-	tpSirMacMgmtHdr mac_hdr;
-	tpDphHashNode   sta_ds;
-
-	mac_hdr = WMA_GET_RX_MAC_HEADER(rx_pkt_info);
-	session_entry = pe_find_session_by_bssid(mac, mac_hdr->bssId,
-			 &session_id);
-	if (!session_entry) {
-		PELOG1(limLog(mac, LOG1,
-			FL("session does not exist for given STA [%pM]"),
-			mac_hdr->sa););
-		return true;
-	}
-
-	sta_ds = dph_lookup_hash_entry(mac, mac_hdr->sa, &aid,
-					&session_entry->dph.dphHashTable);
-	if (!sta_ds) {
-		PELOG1(limLog(mac, LOG1, FL("pStaDs is NULL")););
-		return true;
-	}
-
-#ifdef WLAN_FEATURE_11W
-	if (session_entry->limRmfEnabled) {
-		if ((WMA_GET_RX_DPU_FEEDBACK(rx_pkt_info) &
-			DPU_FEEDBACK_UNPROTECTED_ERROR)) {
-			/* It may be possible that deauth/diassoc frames from a
-			 * spoofy AP is received. So if all further
-			 * deauth/diassoc frmaes are dropped, then it may
-			 * result in lossing deauth/diassoc frames from genuine
-			 * AP. So process all deauth/diassoc frames with
-			 * a time difference of 1 sec.
-			 */
-			if ((qdf_mc_timer_get_system_ticks() -
-				 sta_ds->last_unprot_deauth_disassoc) < 1000)
-				return true;
-
-			sta_ds->last_unprot_deauth_disassoc =
-					qdf_mc_timer_get_system_ticks();
-		} else {
-			/* PMF enabed, Management frames are protected */
-			if (sta_ds->proct_deauh_disassoc_cnt)
-				return true;
-			else
-				sta_ds->proct_deauh_disassoc_cnt++;
-		}
-	} else
-#endif
-	/* PMF disabled */
-	{
-		if (sta_ds->is_disassoc_deauth_in_progress)
-			return true;
-		else
-			sta_ds->is_disassoc_deauth_in_progress++;
-	}
-
-	return false;
-}
-
 /**
  *\brief lim_received_hb_handler()
  *
@@ -2209,18 +2081,6 @@ tMgmtFrmDropReason lim_is_pkt_candidate_for_drop(tpAniSirGlobal pMac,
 		}
 	}
 
-	if ((subType == SIR_MAC_MGMT_DEAUTH ||
-		subType == SIR_MAC_MGMT_DISASSOC) &&
-		lim_is_deauth_diassoc_for_drop(pMac, pRxPacketInfo))
-		return eMGMT_DROP_SPURIOUS_FRAME;
-
-#ifdef WLAN_FEATURE_11W
-	if ((subType == SIR_MAC_MGMT_ASSOC_REQ ||
-		subType == SIR_MAC_MGMT_REASSOC_REQ) &&
-		lim_is_assoc_req_for_drop(pMac, pRxPacketInfo))
-		return eMGMT_DROP_SPURIOUS_FRAME;
-#endif
-
 	framelen = WMA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
 	pBody = WMA_GET_RX_MPDU_DATA(pRxPacketInfo);
 
diff --git a/core/mac/src/pe/lim/lim_assoc_utils.c b/core/mac/src/pe/lim/lim_assoc_utils.c
index 04f13f0cc050..aa704af12e01 100644
--- a/core/mac/src/pe/lim/lim_assoc_utils.c
+++ b/core/mac/src/pe/lim/lim_assoc_utils.c
@@ -109,8 +109,7 @@ lim_compare_capabilities(tpAniSirGlobal pMac,
 {
 	uint32_t val;
 
-	if ((LIM_IS_AP_ROLE(psessionEntry) ||
-	     LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) &&
+	if (LIM_IS_AP_ROLE(psessionEntry) &&
 	    (pAssocReq->capabilityInfo.ibss)) {
 		/* Requesting STA asserting IBSS capability. */
 		lim_log(pMac, LOG1,
@@ -152,8 +151,7 @@ lim_compare_capabilities(tpAniSirGlobal pMac,
 	 * then AP must reject any station that does not support
 	 * shortSlot
 	 */
-	if ((LIM_IS_AP_ROLE(psessionEntry) ||
-	     LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) &&
+	if (LIM_IS_AP_ROLE(psessionEntry) &&
 	    (pLocalCapabs->shortSlotTime == 1)) {
 		if (wlan_cfg_get_int
 			    (pMac, WNI_CFG_ACCEPT_SHORT_SLOT_ASSOC_ONLY,
@@ -586,8 +584,7 @@ lim_cleanup_rx_path(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 			 * There is no context at Polaris to delete.
 			 * Release our assigned AID back to the free pool
 			 */
-			if (LIM_IS_AP_ROLE(psessionEntry) ||
-			    LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
+			if (LIM_IS_AP_ROLE(psessionEntry)) {
 				lim_release_peer_idx(pMac, pStaDs->assocId,
 						     psessionEntry);
 			}
@@ -612,8 +609,7 @@ lim_cleanup_rx_path(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 		return eSIR_SUCCESS;
 	pStaDs->mlmStaContext.mlmState = eLIM_MLM_WT_DEL_STA_RSP_STATE;
 
-	if (LIM_IS_STA_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+	if (LIM_IS_STA_ROLE(psessionEntry)) {
 		MTRACE(mac_trace
 		       (pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId,
 		       eLIM_MLM_WT_DEL_STA_RSP_STATE));
@@ -671,8 +667,7 @@ lim_send_del_sta_cnf(tpAniSirGlobal pMac, struct qdf_mac_addr sta_dsaddr,
 		mlmStaContext.cleanupTrigger, statusCode,
 		MAC_ADDR_ARRAY(sta_dsaddr.bytes));
 
-	if (LIM_IS_STA_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+	if (LIM_IS_STA_ROLE(psessionEntry)) {
 		/* Set BSSID at CFG to null */
 		tSirMacAddr nullAddr = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 
@@ -2115,8 +2110,7 @@ lim_add_sta(tpAniSirGlobal mac_ctx,
 	}
 	qdf_mem_set((uint8_t *) add_sta_params, sizeof(tAddStaParams), 0);
 
-	if (LIM_IS_AP_ROLE(session_entry) || LIM_IS_IBSS_ROLE(session_entry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(session_entry))
+	if (LIM_IS_AP_ROLE(session_entry) || LIM_IS_IBSS_ROLE(session_entry))
 		sta_Addr = &sta_ds->staAddr;
 #ifdef FEATURE_WLAN_TDLS
 	/* SystemRole shouldn't be matter if staType is TDLS peer */
@@ -2188,7 +2182,6 @@ lim_add_sta(tpAniSirGlobal mac_ctx,
 	/* Update HT Capability */
 
 	if (LIM_IS_AP_ROLE(session_entry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(session_entry) ||
 	    LIM_IS_IBSS_ROLE(session_entry)) {
 		add_sta_params->htCapable = sta_ds->mlmStaContext.htCapability;
 		add_sta_params->vhtCapable =
@@ -2532,12 +2525,10 @@ lim_del_sta(tpAniSirGlobal pMac,
 	/* */
 
 #ifdef FEATURE_WLAN_TDLS
-	if ((LIM_IS_STA_ROLE(psessionEntry) &&
-	    (pStaDs->staType != STA_ENTRY_TDLS_PEER)) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry))
+	if (LIM_IS_STA_ROLE(psessionEntry) &&
+	    (pStaDs->staType != STA_ENTRY_TDLS_PEER))
 #else
-	if (LIM_IS_STA_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry))
+	if (LIM_IS_STA_ROLE(psessionEntry))
 #endif
 		pDelStaParams->staIdx = psessionEntry->staId;
 
@@ -2560,8 +2551,7 @@ lim_del_sta(tpAniSirGlobal pMac,
 			SET_LIM_STA_CONTEXT_MLM_STATE(pStaDs,
 						      eLIM_MLM_WT_DEL_STA_RSP_STATE);
 		}
-		if (LIM_IS_STA_ROLE(psessionEntry) ||
-		    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+		if (LIM_IS_STA_ROLE(psessionEntry)) {
 			MTRACE(mac_trace
 				       (pMac, TRACE_CODE_MLM_STATE,
 				       psessionEntry->peSessionId,
@@ -2982,8 +2972,7 @@ void lim_handle_cnf_wait_timeout(tpAniSirGlobal pMac, uint16_t staId)
 		       )
 		lim_print_mac_addr(pMac, pStaDs->staAddr, LOGW);
 
-		if (LIM_IS_AP_ROLE(psessionEntry) ||
-		    LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
+		if (LIM_IS_AP_ROLE(psessionEntry)) {
 			lim_reject_association(pMac, pStaDs->staAddr,
 					       pStaDs->mlmStaContext.subType,
 					       true,
@@ -3144,8 +3133,7 @@ lim_check_and_announce_join_success(tpAniSirGlobal mac_ctx,
 		return;
 	}
 
-	if (!(LIM_IS_BT_AMP_STA_ROLE(session_entry) ||
-		LIM_IS_STA_ROLE(session_entry)))
+	if (!LIM_IS_STA_ROLE(session_entry))
 		return;
 
 	lim_log(mac_ctx, LOG1,
@@ -3545,11 +3533,7 @@ tSirRetStatus lim_sta_send_add_bss(tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
 	lim_log(pMac, LOG1, FL("BSSID: " MAC_ADDRESS_STR),
 		MAC_ADDR_ARRAY(pAddBssParams->bssId));
 
-	if (psessionEntry->bssType == eSIR_BTAMP_AP_MODE) {
-		pAddBssParams->bssType = eSIR_BTAMP_AP_MODE;
-	} else {
-		pAddBssParams->bssType = eSIR_INFRASTRUCTURE_MODE;
-	}
+	pAddBssParams->bssType = eSIR_INFRASTRUCTURE_MODE;
 
 	pAddBssParams->operMode = BSS_OPERATIONAL_MODE_STA;
 
@@ -4593,15 +4577,13 @@ lim_prepare_and_send_del_sta_cnf(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 		     pStaDs->staAddr, QDF_MAC_ADDR_SIZE);
 
 	mlmStaContext = pStaDs->mlmStaContext;
-	if (LIM_IS_AP_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
+	if (LIM_IS_AP_ROLE(psessionEntry))
 		lim_release_peer_idx(pMac, pStaDs->assocId, psessionEntry);
-	}
+
 	lim_delete_dph_hash_entry(pMac, pStaDs->staAddr, pStaDs->assocId,
 				  psessionEntry);
 
-	if (LIM_IS_STA_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+	if (LIM_IS_STA_ROLE(psessionEntry)) {
 		psessionEntry->limMlmState = eLIM_MLM_IDLE_STATE;
 		MTRACE(mac_trace(pMac, TRACE_CODE_MLM_STATE,
 				 psessionEntry->peSessionId,
diff --git a/core/mac/src/pe/lim/lim_ft.c b/core/mac/src/pe/lim/lim_ft.c
index 01a2afc88750..a85e9d6ef340 100644
--- a/core/mac/src/pe/lim/lim_ft.c
+++ b/core/mac/src/pe/lim/lim_ft.c
@@ -615,10 +615,8 @@ void lim_fill_ft_session(tpAniSirGlobal pMac,
 
 	if (pftSessionEntry->bssType == eSIR_INFRASTRUCTURE_MODE) {
 		pftSessionEntry->limSystemRole = eLIM_STA_ROLE;
-	} else if (pftSessionEntry->bssType == eSIR_BTAMP_AP_MODE) {
-		pftSessionEntry->limSystemRole = eLIM_BT_AMP_STA_ROLE;
 	} else {
-		/* Throw an error and return and make sure to delete the session. */
+		/* Throw an error & return & make sure to delete the session */
 		lim_log(pMac, LOGE, FL("Invalid bss type"));
 	}
 
diff --git a/core/mac/src/pe/lim/lim_ft_preauth.c b/core/mac/src/pe/lim/lim_ft_preauth.c
index 0bc94f9c1fbb..1cb55a9b38da 100644
--- a/core/mac/src/pe/lim/lim_ft_preauth.c
+++ b/core/mac/src/pe/lim/lim_ft_preauth.c
@@ -457,8 +457,6 @@ void lim_handle_ft_pre_auth_rsp(tpAniSirGlobal pMac, tSirRetStatus status,
 
 		if (pftSessionEntry->bssType == eSIR_INFRASTRUCTURE_MODE)
 			pftSessionEntry->limSystemRole = eLIM_STA_ROLE;
-		else if (pftSessionEntry->bssType == eSIR_BTAMP_AP_MODE)
-			pftSessionEntry->limSystemRole = eLIM_BT_AMP_STA_ROLE;
 		else
 			lim_log(pMac, LOGE, FL("Invalid bss type"));
 		pftSessionEntry->limPrevSmeState = pftSessionEntry->limSmeState;
@@ -738,7 +736,7 @@ QDF_STATUS lim_send_preauth_scan_offload(tpAniSirGlobal mac_ctx,
  */
 
 void lim_preauth_scan_event_handler(tpAniSirGlobal mac_ctx,
-				enum lim_scan_event_type event,
+				enum sir_scan_event_type event,
 				uint8_t session_id,
 				uint32_t scan_id)
 {
@@ -752,14 +750,14 @@ void lim_preauth_scan_event_handler(tpAniSirGlobal mac_ctx,
 	}
 
 	switch (event) {
-	case LIM_SCAN_EVENT_START_FAILED:
+	case SIR_SCAN_EVENT_START_FAILED:
 		/* Scan command is rejected by firmware */
 		lim_log(mac_ctx, LOGE, FL("Failed to start preauth scan"));
 		lim_post_ft_pre_auth_rsp(mac_ctx, eSIR_FAILURE, NULL, 0,
 					 session_entry);
 		return;
 
-	case LIM_SCAN_EVENT_COMPLETED:
+	case SIR_SCAN_EVENT_COMPLETED:
 		/*
 		 * Scan either completed succesfully or or got terminated
 		 * after successful auth, or timed out. Either way, STA
@@ -769,7 +767,7 @@ void lim_preauth_scan_event_handler(tpAniSirGlobal mac_ctx,
 			session_entry);
 		break;
 
-	case LIM_SCAN_EVENT_FOREIGN_CHANNEL:
+	case SIR_SCAN_EVENT_FOREIGN_CHANNEL:
 		/* Sta is on candidate channel. Send auth */
 		lim_perform_ft_pre_auth(mac_ctx, QDF_STATUS_SUCCESS, NULL,
 					session_entry);
diff --git a/core/mac/src/pe/lim/lim_link_monitoring_algo.c b/core/mac/src/pe/lim/lim_link_monitoring_algo.c
index 7aefc449485a..8809210ac503 100644
--- a/core/mac/src/pe/lim/lim_link_monitoring_algo.c
+++ b/core/mac/src/pe/lim/lim_link_monitoring_algo.c
@@ -102,8 +102,7 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg,
 		return;
 	}
 
-	if (LIM_IS_BT_AMP_AP_ROLE(session_entry) ||
-	    LIM_IS_AP_ROLE(session_entry)) {
+	if (LIM_IS_AP_ROLE(session_entry)) {
 		lim_log(mac_ctx, LOG1,
 			FL("Delete Station staId: %d, assocId: %d"),
 			msg->staId, msg->assocId);
@@ -432,8 +431,7 @@ void lim_handle_heart_beat_failure(tpAniSirGlobal mac_ctx,
 	/* Ensure HB Status for the session has been reseted */
 	session->LimHBFailureStatus = false;
 
-	if ((LIM_IS_STA_ROLE(session) ||
-	     LIM_IS_BT_AMP_STA_ROLE(session)) &&
+	if (LIM_IS_STA_ROLE(session) &&
 	    (session->limMlmState == eLIM_MLM_LINK_ESTABLISHED_STATE) &&
 	    (session->limSmeState != eLIM_SME_WT_DISASSOC_STATE) &&
 	    (session->limSmeState != eLIM_SME_WT_DEAUTH_STATE)) {
diff --git a/core/mac/src/pe/lim/lim_p2p.c b/core/mac/src/pe/lim/lim_p2p.c
index 476d9d944e10..7d12e612fb2b 100644
--- a/core/mac/src/pe/lim/lim_p2p.c
+++ b/core/mac/src/pe/lim/lim_p2p.c
@@ -686,59 +686,36 @@ void lim_send_p2p_action_frame(tpAniSirGlobal mac_ctx,
 	}
 
 #ifdef WLAN_FEATURE_11W
-	action_hdr = (tpSirMacActionFrameHdr) (frame + sizeof(tSirMacMgmtHdr));
+	action_hdr = (tpSirMacActionFrameHdr)
+		(frame + sizeof(tSirMacMgmtHdr));
+	mac_hdr = (tpSirMacMgmtHdr) frame;
+	session_entry = pe_find_session_by_bssid(mac_ctx,
+		(uint8_t *) mb_msg->data + BSSID_OFFSET,
+		&session_id);
 
 	/*
-	 * Setting Protected bit for SA_QUERY Action Frame
-	 * This has to be based on the current Connection with the
-	 * station lim_set_protected_bit API will set the protected bit
-	 * if PMF
+	 * Check for session corresponding to ADDR2 as supplicant
+	 * is filling ADDR2  with BSSID
 	 */
-	if ((SIR_MAC_MGMT_ACTION == fc->subType) &&
-		(SIR_MAC_ACTION_SA_QUERY == action_hdr->category)) {
-		mac_hdr = (tpSirMacMgmtHdr) frame;
+	if (NULL == session_entry) {
 		session_entry = pe_find_session_by_bssid(mac_ctx,
-			(uint8_t *) mb_msg->data + BSSID_OFFSET,
-			&session_id);
-
-		/*
-		 * Check for session corresponding to ADDR2 ss supplicant
-		 * is filling ADDR2  with BSSID
-		 */
-		if (NULL == session_entry) {
-			session_entry = pe_find_session_by_bssid(mac_ctx,
-				(uint8_t *) mb_msg->data + ADDR2_OFFSET,
-				 &session_id);
-		}
-
-		if (NULL != session_entry) {
-			lim_set_protected_bit(mac_ctx, session_entry,
-			mac_hdr->da, mac_hdr);
-		} else {
-			lim_log(mac_ctx, LOGE,
-				FL("Dropping SA Query - PE Session not found"));
-			lim_send_sme_rsp(mac_ctx,
-				eWNI_SME_ACTION_FRAME_SEND_CNF,
-				QDF_STATUS_E_FAILURE, mb_msg->sessionId, 0);
-			cds_packet_free((void *)packet);
-			return;
-		}
-
-		/*
-		 * If wep bit is not set in MAC header then we are trying to
-		 * send SA Query via non PMF connection. Drop the packet.
-		 */
-		if (0 == mac_hdr->fc.wep) {
-			lim_log(mac_ctx, LOGE,
-				FL("Dropping SA Query due to non PMF conne."));
-			lim_send_sme_rsp(mac_ctx,
-				eWNI_SME_ACTION_FRAME_SEND_CNF,
-				QDF_STATUS_E_FAILURE, mb_msg->sessionId, 0);
-			cds_packet_free((void *)packet);
-			return;
-		}
+			(uint8_t *) mb_msg->data + ADDR2_OFFSET,
+			 &session_id);
 	}
+	/*
+	 * Setting Protected bit only for Robust Action Frames
+	 * This has to be based on the current Connection with the
+	 * station. lim_set_protected_bit API will set the protected
+	 * bit if connection is PMF
+	 */
+	if (session_entry && (SIR_MAC_MGMT_ACTION == fc->subType) &&
+		session_entry->limRmfEnabled &&
+		(!lim_is_group_addr(mac_hdr->da)) &&
+		lim_is_robust_mgmt_action_frame(action_hdr->category))
+		lim_set_protected_bit(mac_ctx, session_entry,
+					mac_hdr->da, mac_hdr);
 #endif
+
 	lim_tx_action_frame(mac_ctx, mb_msg, msg_len, packet, frame);
 	return;
 }
diff --git a/core/mac/src/pe/lim/lim_process_action_frame.c b/core/mac/src/pe/lim/lim_process_action_frame.c
index bc4ccaff45db..e2f13bb66709 100644
--- a/core/mac/src/pe/lim/lim_process_action_frame.c
+++ b/core/mac/src/pe/lim/lim_process_action_frame.c
@@ -717,8 +717,7 @@ static void __lim_process_add_ts_rsp(tpAniSirGlobal mac_ctx,
 	frameLen = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info);
 
 	lim_log(mac_ctx, LOGW, "Recv AddTs Response");
-	if (LIM_IS_AP_ROLE(session) ||
-	    LIM_IS_BT_AMP_AP_ROLE(session)) {
+	if (LIM_IS_AP_ROLE(session)) {
 		lim_log(mac_ctx, LOGW,
 			FL("AddTsRsp recvd at AP: ignoring"));
 		return;
@@ -1015,8 +1014,7 @@ static void __lim_process_del_ts_req(tpAniSirGlobal mac_ctx,
 		}
 	}
 
-	if (!LIM_IS_AP_ROLE(session) &&
-	    !LIM_IS_BT_AMP_AP_ROLE(session))
+	if (!LIM_IS_AP_ROLE(session))
 		lim_send_sme_delts_ind(mac_ctx, &delts, aid, session);
 
 	/* try to delete the TS */
@@ -1680,8 +1678,7 @@ lim_drop_unprotected_action_frame(tpAniSirGlobal pMac, tpPESession psessionEntry
 	tpDphHashNode pStaDs;
 	bool rmfConnection = false;
 
-	if (LIM_IS_AP_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
+	if (LIM_IS_AP_ROLE(psessionEntry)) {
 		pStaDs =
 			dph_lookup_hash_entry(pMac, pHdr->sa, &aid,
 					      &psessionEntry->dph.dphHashTable);
@@ -1692,11 +1689,8 @@ lim_drop_unprotected_action_frame(tpAniSirGlobal pMac, tpPESession psessionEntry
 		rmfConnection = true;
 
 	if (rmfConnection && (pHdr->fc.wep == 0)) {
-		PELOGE(lim_log
-			       (pMac, LOGE,
-			       FL("Dropping unprotected Action category %d frame "
-				  "since RMF is enabled."), category);
-		       )
+		lim_log(pMac, LOGE,
+			       FL("Dropping unprotected Action category %d frame since RMF is enabled."), category);
 		return true;
 	} else
 		return false;
@@ -1730,15 +1724,17 @@ void lim_process_action_frame(tpAniSirGlobal mac_ctx,
 	tpSirMacVendorSpecificPublicActionFrameHdr pub_action;
 	uint8_t p2p_oui[] = { 0x50, 0x6F, 0x9A, 0x09 };
 
+#ifdef WLAN_FEATURE_11W
+	if (lim_is_robust_mgmt_action_frame(action_hdr->category) &&
+	   lim_drop_unprotected_action_frame(mac_ctx, session,
+			mac_hdr_11w, action_hdr->category))
+		return;
+#endif
+
 	frame_len = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info);
 
 	switch (action_hdr->category) {
 	case SIR_MAC_ACTION_QOS_MGMT:
-#ifdef WLAN_FEATURE_11W
-		if (lim_drop_unprotected_action_frame(mac_ctx, session,
-					mac_hdr_11w, action_hdr->category))
-			break;
-#endif
 		if ((session->limQosEnabled) ||
 		    (action_hdr->actionID == SIR_MAC_QOS_MAP_CONFIGURE)) {
 			switch (action_hdr->actionID) {
@@ -1776,11 +1772,6 @@ void lim_process_action_frame(tpAniSirGlobal mac_ctx,
 		break;
 
 	case SIR_MAC_ACTION_SPECTRUM_MGMT:
-#ifdef WLAN_FEATURE_11W
-		if (lim_drop_unprotected_action_frame(mac_ctx, session,
-				mac_hdr_11w, action_hdr->category))
-			break;
-#endif
 		switch (action_hdr->actionID) {
 #ifdef ANI_SUPPORT_11H
 		case SIR_MAC_ACTION_MEASURE_REQUEST_ID:
@@ -1864,14 +1855,6 @@ void lim_process_action_frame(tpAniSirGlobal mac_ctx,
 		break;
 
 	case SIR_MAC_ACTION_WNM:
-#ifdef WLAN_FEATURE_11W
-		if ((session->limRmfEnabled) && (mac_hdr_11w->fc.wep == 0)) {
-			lim_log(mac_ctx, LOG1,
-				FL("Dropping unprot action %d frm (PMF on)"),
-				action_hdr->category);
-			break;
-		}
-#endif
 		lim_log(mac_ctx, LOG1,
 			FL("WNM Action category %d action %d."),
 			action_hdr->category, action_hdr->actionID);
@@ -1901,11 +1884,6 @@ void lim_process_action_frame(tpAniSirGlobal mac_ctx,
 		break;
 
 	case SIR_MAC_ACTION_RRM:
-#ifdef WLAN_FEATURE_11W
-		if (lim_drop_unprotected_action_frame(mac_ctx, session,
-					mac_hdr_11w, action_hdr->category))
-			break;
-#endif
 		if (mac_ctx->rrm.rrmPEContext.rrmEnable) {
 			switch (action_hdr->actionID) {
 			case SIR_MAC_RRM_RADIO_MEASURE_REQ:
@@ -2064,9 +2042,6 @@ void lim_process_action_frame(tpAniSirGlobal mac_ctx,
 		lim_log(mac_ctx, LOG1,
 			FL("SA Query Action category %d action %d."),
 			action_hdr->category, action_hdr->actionID);
-		if (lim_drop_unprotected_action_frame(mac_ctx, session,
-			mac_hdr_11w, action_hdr->category))
-			break;
 		switch (action_hdr->actionID) {
 		case SIR_MAC_SA_QUERY_REQ:
 			/**11w SA query request action frame received**/
diff --git a/core/mac/src/pe/lim/lim_process_assoc_req_frame.c b/core/mac/src/pe/lim/lim_process_assoc_req_frame.c
index 025e1a5e99f2..4540bc132840 100644
--- a/core/mac/src/pe/lim/lim_process_assoc_req_frame.c
+++ b/core/mac/src/pe/lim/lim_process_assoc_req_frame.c
@@ -1740,7 +1740,7 @@ void lim_process_assoc_req_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 		session->peSessionId, GET_LIM_SYSTEM_ROLE(session),
 		session->limMlmState, MAC_ADDR_ARRAY(hdr->sa));
 
-	if (LIM_IS_STA_ROLE(session) || LIM_IS_BT_AMP_STA_ROLE(session)) {
+	if (LIM_IS_STA_ROLE(session)) {
 		lim_log(mac_ctx, LOGE,
 			FL("Rcvd unexpected ASSOC REQ, sessionid: %d sys sub_type=%d for role=%d from: "
 			   MAC_ADDRESS_STR),
diff --git a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
index 03577a99d285..9d121546a064 100644
--- a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
+++ b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
@@ -573,8 +573,7 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
 		return;
 	}
 
-	if (LIM_IS_AP_ROLE(session_entry) ||
-		LIM_IS_BT_AMP_AP_ROLE(session_entry)) {
+	if (LIM_IS_AP_ROLE(session_entry)) {
 		/*
 		 * Should not have received Re/Association
 		 * Response frame on AP. Log error
@@ -842,10 +841,7 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
 		return;
 	}
 #endif
-	if (!((session_entry->bssType == eSIR_BTAMP_STA_MODE) ||
-		((session_entry->bssType == eSIR_BTAMP_AP_MODE) &&
-		LIM_IS_BT_AMP_STA_ROLE(session_entry)) ||
-		lim_is_roam_synch_in_progress(session_entry))) {
+	if (!lim_is_roam_synch_in_progress(session_entry)) {
 		if (lim_set_link_state
 			(mac_ctx, eSIR_LINK_POSTASSOC_STATE,
 			session_entry->bssId,
diff --git a/core/mac/src/pe/lim/lim_process_auth_frame.c b/core/mac/src/pe/lim/lim_process_auth_frame.c
index 5eb8084520d2..b996942bd40b 100644
--- a/core/mac/src/pe/lim/lim_process_auth_frame.c
+++ b/core/mac/src/pe/lim/lim_process_auth_frame.c
@@ -83,14 +83,12 @@ static inline unsigned int is_auth_valid(tpAniSirGlobal pMac,
 
 	if (((auth->authTransactionSeqNumber == SIR_MAC_AUTH_FRAME_1) ||
 	    (auth->authTransactionSeqNumber == SIR_MAC_AUTH_FRAME_3)) &&
-	    (LIM_IS_STA_ROLE(sessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(sessionEntry)))
+	    (LIM_IS_STA_ROLE(sessionEntry)))
 		valid = 0;
 
 	if (((auth->authTransactionSeqNumber == SIR_MAC_AUTH_FRAME_2) ||
 	    (auth->authTransactionSeqNumber == SIR_MAC_AUTH_FRAME_4)) &&
-	    (LIM_IS_AP_ROLE(sessionEntry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(sessionEntry)))
+	    (LIM_IS_AP_ROLE(sessionEntry)))
 		valid = 0;
 
 	if (((auth->authTransactionSeqNumber == SIR_MAC_AUTH_FRAME_3) ||
@@ -521,8 +519,7 @@ static void lim_process_auth_frame_type2(tpAniSirGlobal mac_ctx,
 		 * Check if a Reassociation is in progress and this is a
 		 * Pre-Auth frame
 		 */
-		if ((LIM_IS_STA_ROLE(pe_session) ||
-		     LIM_IS_BT_AMP_STA_ROLE(pe_session)) &&
+		if (LIM_IS_STA_ROLE(pe_session) &&
 		    (pe_session->limSmeState == eLIM_SME_WT_REASSOC_STATE) &&
 		    (rx_auth_frm_body->authStatusCode ==
 				eSIR_MAC_SUCCESS_STATUS) &&
@@ -783,7 +780,6 @@ static void lim_process_auth_frame_type3(tpAniSirGlobal mac_ctx,
 	}
 
 	if (LIM_IS_AP_ROLE(pe_session) ||
-			LIM_IS_BT_AMP_AP_ROLE(pe_session) ||
 			LIM_IS_IBSS_ROLE(pe_session)) {
 		/*
 		 * Check if wep bit was set in FC. If not set,
@@ -1149,8 +1145,7 @@ lim_process_auth_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 		 * of wep bit (this status code does not exist though) or
 		 * Out-of-sequence-Authentication-Frame status code.
 		 */
-		if (LIM_IS_STA_ROLE(pe_session) ||
-				LIM_IS_BT_AMP_STA_ROLE(pe_session)) {
+		if (LIM_IS_STA_ROLE(pe_session)) {
 			auth_frame.authAlgoNumber = eSIR_SHARED_KEY;
 			auth_frame.authTransactionSeqNumber =
 				SIR_MAC_AUTH_FRAME_4;
@@ -1348,6 +1343,28 @@ lim_process_auth_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 		(uint32_t) rx_auth_frm_body->authStatusCode,
 		(uint32_t) mac_ctx->lim.gLimNumPreAuthContexts);
 
+	/*
+	 * IOT Workaround: with invalid WEP key, some APs reply
+	 * AuthFrame 4 with invalid seqNumber. This AuthFrame
+	 * will be dropped by driver, thus driver sends the
+	 * generic status code instead of protocol status code.
+	 * As a workaround, override AuthFrame 4's seqNumber.
+	 */
+	if ((pe_session->limMlmState ==
+		eLIM_MLM_WT_AUTH_FRAME4_STATE) &&
+		(rx_auth_frm_body->authTransactionSeqNumber !=
+		SIR_MAC_AUTH_FRAME_1) &&
+		(rx_auth_frm_body->authTransactionSeqNumber !=
+		SIR_MAC_AUTH_FRAME_2) &&
+		(rx_auth_frm_body->authTransactionSeqNumber !=
+		SIR_MAC_AUTH_FRAME_3)) {
+		lim_log(mac_ctx, LOGW,
+			FL("Override AuthFrame 4's seqNumber to 4."));
+		rx_auth_frm_body->authTransactionSeqNumber =
+			SIR_MAC_AUTH_FRAME_4;
+	}
+
+
 	switch (rx_auth_frm_body->authTransactionSeqNumber) {
 	case SIR_MAC_AUTH_FRAME_1:
 		lim_process_auth_frame_type1(mac_ctx,
diff --git a/core/mac/src/pe/lim/lim_process_cfg_updates.c b/core/mac/src/pe/lim/lim_process_cfg_updates.c
index 65bcd4bcadd0..d8f8dad24c6d 100644
--- a/core/mac/src/pe/lim/lim_process_cfg_updates.c
+++ b/core/mac/src/pe/lim/lim_process_cfg_updates.c
@@ -540,9 +540,7 @@ void lim_apply_configuration(tpAniSirGlobal pMac, tpPESession psessionEntry)
 
 	/* Added for BT - AMP Support */
 	if (LIM_IS_AP_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(psessionEntry) ||
-	    LIM_IS_IBSS_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+	    LIM_IS_IBSS_ROLE(psessionEntry)) {
 		/* This check is required to ensure the beacon generation is not done
 		   as a part of join request for a BT-AMP station */
 
diff --git a/core/mac/src/pe/lim/lim_process_deauth_frame.c b/core/mac/src/pe/lim/lim_process_deauth_frame.c
index ba26a694cfe3..b77a7c75e77f 100644
--- a/core/mac/src/pe/lim/lim_process_deauth_frame.c
+++ b/core/mac/src/pe/lim/lim_process_deauth_frame.c
@@ -190,8 +190,7 @@ lim_process_deauth_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 		return;
 	}
 
-	if (LIM_IS_AP_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
+	if (LIM_IS_AP_ROLE(psessionEntry)) {
 		switch (reasonCode) {
 		case eSIR_MAC_UNSPEC_FAILURE_REASON:
 		case eSIR_MAC_DEAUTH_LEAVING_BSS_REASON:
@@ -210,8 +209,7 @@ lim_process_deauth_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 
 			break;
 		}
-	} else if (LIM_IS_STA_ROLE(psessionEntry) ||
-		   LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+	} else if (LIM_IS_STA_ROLE(psessionEntry)) {
 		switch (reasonCode) {
 		case eSIR_MAC_UNSPEC_FAILURE_REASON:
 		case eSIR_MAC_PREV_AUTH_NOT_VALID_REASON:
@@ -342,7 +340,6 @@ lim_process_deauth_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 	/* Check for pre-assoc states */
 	switch (GET_LIM_SYSTEM_ROLE(psessionEntry)) {
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
 		switch (psessionEntry->limMlmState) {
 		case eLIM_MLM_WT_AUTH_FRAME2_STATE:
 			/**
@@ -516,7 +513,7 @@ lim_process_deauth_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 	case eLIM_AP_ROLE:
 		break;
 
-	default:                /* eLIM_AP_ROLE or eLIM_BT_AMP_AP_ROLE */
+	default:
 
 		return;
 	} /* end switch (pMac->lim.gLimSystemRole) */
diff --git a/core/mac/src/pe/lim/lim_process_disassoc_frame.c b/core/mac/src/pe/lim/lim_process_disassoc_frame.c
index 699b02cf5c9c..80a06c80bac2 100644
--- a/core/mac/src/pe/lim/lim_process_disassoc_frame.c
+++ b/core/mac/src/pe/lim/lim_process_disassoc_frame.c
@@ -237,8 +237,7 @@ lim_process_disassoc_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 		}
 	}
 
-	if (LIM_IS_AP_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
+	if (LIM_IS_AP_ROLE(psessionEntry)) {
 		switch (reasonCode) {
 		case eSIR_MAC_UNSPEC_FAILURE_REASON:
 		case eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON:
@@ -261,8 +260,7 @@ lim_process_disassoc_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 			       )
 			break;
 		}
-	} else if ((LIM_IS_STA_ROLE(psessionEntry) ||
-		   LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) &&
+	} else if (LIM_IS_STA_ROLE(psessionEntry) &&
 		   ((psessionEntry->limSmeState != eLIM_SME_WT_JOIN_STATE) &&
 		   (psessionEntry->limSmeState != eLIM_SME_WT_AUTH_STATE) &&
 		   (psessionEntry->limSmeState != eLIM_SME_WT_ASSOC_STATE) &&
diff --git a/core/mac/src/pe/lim/lim_process_message_queue.c b/core/mac/src/pe/lim/lim_process_message_queue.c
index b239c8529c6b..27d6a4159760 100644
--- a/core/mac/src/pe/lim/lim_process_message_queue.c
+++ b/core/mac/src/pe/lim/lim_process_message_queue.c
@@ -803,6 +803,17 @@ lim_handle80211_frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, uint8_t *pDeferMsg
 	isFrmFt = WMA_GET_RX_FT_DONE(pRxPacketInfo);
 	fc = pHdr->fc;
 
+	if (pMac->sap.SapDfsInfo.is_dfs_cac_timer_running) {
+		psessionEntry = pe_find_session_by_bssid(pMac,
+					pHdr->bssId, &sessionId);
+		if (psessionEntry &&
+		    (QDF_SAP_MODE == psessionEntry->pePersona)) {
+			lim_log(pMac, LOG1,
+				FL("CAC timer running - drop the frame"));
+			goto end;
+		}
+	}
+
 #ifdef WLAN_DUMP_MGMTFRAMES
 	lim_log(pMac, LOGE,
 		FL("ProtVersion %d, Type %d, Subtype %d rateIndex=%d"),
@@ -930,8 +941,7 @@ lim_handle80211_frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, uint8_t *pDeferMsg
 		switch (fc.subType) {
 		case SIR_MAC_MGMT_ASSOC_REQ:
 			/* Make sure the role supports Association */
-			if (LIM_IS_BT_AMP_AP_ROLE(psessionEntry) ||
-			    LIM_IS_AP_ROLE(psessionEntry))
+			if (LIM_IS_AP_ROLE(psessionEntry))
 				lim_process_assoc_req_frame(pMac,
 							    pRxPacketInfo,
 							    LIM_ASSOC,
@@ -955,8 +965,7 @@ lim_handle80211_frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, uint8_t *pDeferMsg
 
 		case SIR_MAC_MGMT_REASSOC_REQ:
 			/* Make sure the role supports Reassociation */
-			if (LIM_IS_BT_AMP_AP_ROLE(psessionEntry) ||
-			    LIM_IS_AP_ROLE(psessionEntry)) {
+			if (LIM_IS_AP_ROLE(psessionEntry)) {
 				lim_process_assoc_req_frame(pMac,
 							    pRxPacketInfo,
 							    LIM_REASSOC,
@@ -2145,8 +2154,6 @@ static void lim_process_normal_hdd_msg(tpAniSirGlobal mac_ctx, tSirMsgQ *msg,
 
 	/* Added For BT-AMP Support */
 	if ((mac_ctx->lim.gLimSystemRole == eLIM_AP_ROLE)
-		|| (mac_ctx->lim.gLimSystemRole == eLIM_BT_AMP_AP_ROLE)
-		|| (mac_ctx->lim.gLimSystemRole == eLIM_BT_AMP_STA_ROLE)
 		|| (mac_ctx->lim.gLimSystemRole == eLIM_UNKNOWN_ROLE)) {
 		/*
 		 * This check is required only for the AP and in 2 cases.
diff --git a/core/mac/src/pe/lim/lim_process_mlm_host_roam.c b/core/mac/src/pe/lim/lim_process_mlm_host_roam.c
index 5fcea0264fbc..9a8fa2135170 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_host_roam.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_host_roam.c
@@ -87,8 +87,7 @@ void lim_process_mlm_reassoc_req(tpAniSirGlobal mac_ctx, uint32_t *msg)
 		reassoc_req->sessionId, GET_LIM_SYSTEM_ROLE(session),
 		session->limMlmState, MAC_ADDR_ARRAY(reassoc_req->peerMacAddr));
 
-	if ((LIM_IS_AP_ROLE(session) ||
-		LIM_IS_BT_AMP_AP_ROLE(session)) ||
+	if (LIM_IS_AP_ROLE(session) ||
 		(session->limMlmState !=
 		eLIM_MLM_LINK_ESTABLISHED_STATE)) {
 		/*
@@ -262,7 +261,7 @@ void lim_process_mlm_reassoc_cnf(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		return;
 	}
 	if ((session->limSmeState != eLIM_SME_WT_REASSOC_STATE) ||
-	    LIM_IS_AP_ROLE(session) || LIM_IS_BT_AMP_AP_ROLE(session)) {
+	    LIM_IS_AP_ROLE(session)) {
 		/*
 		 * Should not have received Reassocication confirm
 		 * from MLM in other states OR on AP.
diff --git a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
index 29bc4c61c773..d57a1ca3735e 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
@@ -604,9 +604,7 @@ lim_mlm_add_bss(tpAniSirGlobal mac_ctx,
 		     session->selfMacAddr, sizeof(tSirMacAddr));
 
 	addbss_param->bssType = mlm_start_req->bssType;
-	if ((mlm_start_req->bssType == eSIR_IBSS_MODE) ||
-	    (mlm_start_req->bssType == eSIR_BTAMP_AP_MODE) ||
-	    (mlm_start_req->bssType == eSIR_BTAMP_STA_MODE)) {
+	if ((mlm_start_req->bssType == eSIR_IBSS_MODE)) {
 		addbss_param->operMode = BSS_OPERATIONAL_MODE_STA;
 	} else if (mlm_start_req->bssType == eSIR_INFRA_AP_MODE) {
 		addbss_param->operMode = BSS_OPERATIONAL_MODE_AP;
@@ -962,8 +960,7 @@ lim_process_mlm_post_join_suspend_link(tpAniSirGlobal mac_ctx,
 	mac_ctx->lim.limTimers.gLimJoinFailureTimer.sessionId =
 		session->peSessionId;
 
-	lnk_state = (LIM_IS_BT_AMP_STA_ROLE(session) ?
-		eSIR_LINK_BTAMP_PREASSOC_STATE : eSIR_LINK_PREASSOC_STATE);
+	lnk_state = eSIR_LINK_PREASSOC_STATE;
 	lim_log(mac_ctx, LOG1, FL("[lim_process_mlm_join_req]: lnk_state:%d"),
 		lnk_state);
 
@@ -1034,8 +1031,7 @@ static void lim_process_mlm_join_req(tpAniSirGlobal mac_ctx, uint32_t *msg)
 		goto error;
 	}
 
-	if ((!LIM_IS_AP_ROLE(session) &&
-	     !LIM_IS_BT_AMP_AP_ROLE(session)) &&
+	if (!LIM_IS_AP_ROLE(session) &&
 	     ((session->limMlmState == eLIM_MLM_IDLE_STATE) ||
 	     (session->limMlmState == eLIM_MLM_JOINED_STATE)) &&
 	     (SIR_MAC_GET_ESS
@@ -1126,8 +1122,7 @@ static bool lim_is_auth_req_expected(tpAniSirGlobal mac_ctx,
 	 * supported.
 	 */
 
-	flag = ((((LIM_IS_STA_ROLE(session) ||
-		   LIM_IS_BT_AMP_STA_ROLE(session)) &&
+	flag = (((LIM_IS_STA_ROLE(session) &&
 		 ((session->limMlmState == eLIM_MLM_JOINED_STATE) ||
 		  (session->limMlmState ==
 					eLIM_MLM_LINK_ESTABLISHED_STATE))) ||
@@ -1169,7 +1164,7 @@ static bool lim_is_preauth_ctx_exists(tpAniSirGlobal mac_ctx,
 	preauth_node = lim_search_pre_auth_list(mac_ctx,
 				mac_ctx->lim.gpLimMlmAuthReq->peerMacAddr);
 
-	fl = (((LIM_IS_STA_ROLE(session) || LIM_IS_BT_AMP_STA_ROLE(session)) &&
+	fl = (((LIM_IS_STA_ROLE(session)) &&
 	       (session->limMlmState == eLIM_MLM_LINK_ESTABLISHED_STATE) &&
 	      ((stads != NULL) &&
 	       (mac_ctx->lim.gpLimMlmAuthReq->authType ==
@@ -1372,8 +1367,7 @@ static void lim_process_mlm_assoc_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 
 	sir_copy_mac_addr(curr_bssId, session_entry->bssId);
 
-	if (!((!LIM_IS_AP_ROLE(session_entry) &&
-	    !LIM_IS_BT_AMP_AP_ROLE(session_entry)) &&
+	if (!(!LIM_IS_AP_ROLE(session_entry) &&
 		(session_entry->limMlmState == eLIM_MLM_AUTHENTICATED_STATE ||
 		 session_entry->limMlmState == eLIM_MLM_JOINED_STATE) &&
 		(!qdf_mem_cmp(mlm_assoc_req->peerMacAddr,
@@ -1422,19 +1416,6 @@ static void lim_process_mlm_assoc_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 	/* Prepare and send Association request frame */
 	lim_send_assoc_req_mgmt_frame(mac_ctx, mlm_assoc_req, session_entry);
 
-	/*
-	 * Set the link state to postAssoc, so HW can start receiving frames
-	 * from AP.
-	 */
-	if ((session_entry->bssType == eSIR_BTAMP_STA_MODE) ||
-	    ((session_entry->bssType == eSIR_BTAMP_AP_MODE)
-	     && LIM_IS_BT_AMP_STA_ROLE(session_entry))) {
-		if (lim_set_link_state(mac_ctx, eSIR_LINK_BTAMP_POSTASSOC_STATE,
-					curr_bssId, session_entry->selfMacAddr,
-					NULL, NULL) != eSIR_SUCCESS)
-			lim_log(mac_ctx, LOGE,
-				FL("Failed to set the LinkState"));
-	}
 	/* Start association failure timer */
 	MTRACE(mac_trace(mac_ctx, TRACE_CODE_TIMER_ACTIVATE,
 			 session_entry->peSessionId, eLIM_ASSOC_FAIL_TIMER));
@@ -1509,7 +1490,6 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 
 	switch (GET_LIM_SYSTEM_ROLE(session)) {
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
 		if (!qdf_is_macaddr_equal(&mlm_disassocreq->peer_macaddr,
 				     &curr_bssid)) {
 			lim_log(mac_ctx, LOGW,
@@ -1852,7 +1832,6 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 
 	switch (GET_LIM_SYSTEM_ROLE(session)) {
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
 		switch (session->limMlmState) {
 		case eLIM_MLM_IDLE_STATE:
 			/*
@@ -2157,7 +2136,6 @@ lim_process_mlm_set_keys_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 
 	switch (GET_LIM_SYSTEM_ROLE(session)) {
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
 		/*
 		 * In case of TDLS, peerMac address need not be BssId. Skip this
 		 * check if TDLS is enabled.
@@ -2727,7 +2705,7 @@ lim_process_assoc_failure_timeout(tpAniSirGlobal mac_ctx, uint32_t msg_type)
 	lim_log(mac_ctx, LOG1,
 		FL("Re/Association Response not received before timeout "));
 
-	if ((LIM_IS_AP_ROLE(session) || LIM_IS_BT_AMP_AP_ROLE(session)) ||
+	if ((LIM_IS_AP_ROLE(session)) ||
 	    ((session->limMlmState != eLIM_MLM_WT_ASSOC_RSP_STATE) &&
 	    (session->limMlmState != eLIM_MLM_WT_REASSOC_RSP_STATE) &&
 	    (session->limMlmState != eLIM_MLM_WT_FT_REASSOC_RSP_STATE))) {
diff --git a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
index 82d39cb22dae..4659053ecb90 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
@@ -69,10 +69,8 @@ void lim_process_mlm_disassoc_cnf(tpAniSirGlobal, uint32_t *);
 void lim_process_mlm_deauth_ind(tpAniSirGlobal, uint32_t *);
 void lim_process_mlm_deauth_cnf(tpAniSirGlobal, uint32_t *);
 void lim_process_mlm_purge_sta_ind(tpAniSirGlobal, uint32_t *);
-void lim_get_session_info(tpAniSirGlobal pMac, uint8_t *, uint8_t *, uint16_t *);
-static void
-lim_process_btamp_add_bss_rsp(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,
-			      tpPESession psessionEntry);
+void lim_get_session_info(tpAniSirGlobal pMac, uint8_t *, uint8_t *,
+				uint16_t *);
 /**
  * lim_process_mlm_rsp_messages()
  *
@@ -256,17 +254,12 @@ void lim_process_mlm_start_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 		MTRACE(mac_trace
 			       (pMac, TRACE_CODE_SME_STATE, psessionEntry->peSessionId,
 			       psessionEntry->limSmeState));
-		if (psessionEntry->bssType == eSIR_BTAMP_STA_MODE) {
-			lim_log(pMac, LOG1,
-				FL("*** Started BSS in BT_AMP STA SIDE***"));
-		} else if (psessionEntry->bssType == eSIR_BTAMP_AP_MODE) {
-			lim_log(pMac, LOG1,
-				FL("*** Started BSS in BT_AMP AP SIDE***"));
-		} else if (psessionEntry->bssType == eSIR_INFRA_AP_MODE) {
+		if (psessionEntry->bssType == eSIR_INFRA_AP_MODE) {
 			lim_log(pMac, LOG1,
 				FL("*** Started BSS in INFRA AP SIDE***"));
-		} else
-			PELOG1(lim_log(pMac, LOG1, FL("*** Started BSS ***"));)
+		} else {
+			lim_log(pMac, LOG1, FL("*** Started BSS ***"));
+		}
 	} else {
 		/* Start BSS is a failure */
 		pe_delete_session(pMac, psessionEntry);
@@ -572,8 +565,7 @@ void lim_process_mlm_auth_cnf(tpAniSirGlobal mac_ctx, uint32_t *msg)
 
 	if ((session_entry->limSmeState != eLIM_SME_WT_AUTH_STATE &&
 		session_entry->limSmeState != eLIM_SME_WT_PRE_AUTH_STATE) ||
-		LIM_IS_AP_ROLE(session_entry) ||
-		LIM_IS_BT_AMP_AP_ROLE(session_entry)) {
+		LIM_IS_AP_ROLE(session_entry)) {
 		/**
 		 * Should not have received AUTH confirm
 		 * from MLM in other states or on AP.
@@ -622,15 +614,15 @@ void lim_process_mlm_auth_cnf(tpAniSirGlobal mac_ctx, uint32_t *msg)
 	}
 
 	if ((auth_type == eSIR_AUTO_SWITCH) &&
-		(((tLimMlmAuthCnf *) msg)->authType == eSIR_OPEN_SYSTEM)
+		(((tLimMlmAuthCnf *) msg)->authType ==  eSIR_SHARED_KEY)
 		&& (eSIR_MAC_AUTH_ALGO_NOT_SUPPORTED_STATUS ==
 		((tLimMlmAuthCnf *) msg)->protStatusCode)) {
 		/*
-		 * When Open authentication fails with reason
+		 * When shared authentication fails with reason
 		 * code "13" and authType set to 'auto switch',
-		 * Try with Shared Authentication
+		 * Try with open Authentication
 		 */
-		auth_mode = eSIR_SHARED_KEY;
+		auth_mode = eSIR_OPEN_SYSTEM;
 		/* Trigger MAC based Authentication */
 		auth_req = qdf_mem_malloc(sizeof(tLimMlmAuthReq));
 		if (NULL == auth_req) {
@@ -735,8 +727,7 @@ void lim_process_mlm_assoc_cnf(tpAniSirGlobal mac_ctx,
 		return;
 	}
 	if (session_entry->limSmeState != eLIM_SME_WT_ASSOC_STATE ||
-		 LIM_IS_AP_ROLE(session_entry) ||
-		 LIM_IS_BT_AMP_AP_ROLE(session_entry)) {
+		 LIM_IS_AP_ROLE(session_entry)) {
 		/*
 		 * Should not have received Assocication confirm
 		 * from MLM in other states OR on AP.
@@ -982,13 +973,12 @@ void lim_process_mlm_disassoc_ind(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 	case eLIM_STA_IN_IBSS_ROLE:
 		break;
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
 		psessionEntry->limSmeState = eLIM_SME_WT_DISASSOC_STATE;
 		MTRACE(mac_trace
 			       (pMac, TRACE_CODE_SME_STATE, psessionEntry->peSessionId,
 			       psessionEntry->limSmeState));
 		break;
-	default:        /* eLIM_AP_ROLE //eLIM_BT_AMP_AP_ROLE */
+	default:        /* eLIM_AP_ROLE */
 		PELOG1(lim_log(pMac, LOG1,
 			       FL("*** Peer staId=%d Disassociated ***"),
 			       pMlmDisassocInd->aid);
@@ -1028,8 +1018,7 @@ void lim_process_mlm_disassoc_cnf(tpAniSirGlobal mac_ctx,
 		eLIM_LINK_MONITORING_DISASSOC) ?
 		eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE :
 		disassoc_cnf->resultCode;
-	if (LIM_IS_STA_ROLE(session_entry) ||
-		LIM_IS_BT_AMP_STA_ROLE(session_entry)) {
+	if (LIM_IS_STA_ROLE(session_entry)) {
 		/* Disassociate Confirm from MLM */
 		if ((session_entry->limSmeState != eLIM_SME_WT_DISASSOC_STATE)
 			&& (session_entry->limSmeState !=
@@ -1074,8 +1063,7 @@ void lim_process_mlm_disassoc_cnf(tpAniSirGlobal mac_ctx,
 				disassoc_cnf->aid, session_entry->smeSessionId,
 				session_entry->transactionId, session_entry);
 		}
-	} else if (LIM_IS_AP_ROLE(session_entry) ||
-			LIM_IS_BT_AMP_AP_ROLE(session_entry)) {
+	} else if (LIM_IS_AP_ROLE(session_entry)) {
 		lim_send_sme_disassoc_ntf(mac_ctx, disassoc_cnf->peerMacAddr,
 			result_code, disassoc_cnf->disassocTrigger,
 			disassoc_cnf->aid, session_entry->smeSessionId,
@@ -1119,7 +1107,6 @@ void lim_process_mlm_deauth_ind(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 	case eLIM_STA_IN_IBSS_ROLE:
 		break;
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
 		psessionEntry->limSmeState = eLIM_SME_WT_DEAUTH_STATE;
 		MTRACE(mac_trace
 			       (pMac, TRACE_CODE_SME_STATE, psessionEntry->peSessionId,
@@ -1185,8 +1172,7 @@ void lim_process_mlm_deauth_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 		     eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE :
 		     pMlmDeauthCnf->resultCode;
 	aid = LIM_IS_AP_ROLE(psessionEntry) ? pMlmDeauthCnf->aid : 1;
-	if (LIM_IS_STA_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+	if (LIM_IS_STA_ROLE(psessionEntry)) {
 		/* Deauth Confirm from MLM */
 		if ((psessionEntry->limSmeState != eLIM_SME_WT_DISASSOC_STATE)
 			&& psessionEntry->limSmeState !=
@@ -1267,7 +1253,6 @@ void lim_process_mlm_purge_sta_ind(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 	case eLIM_STA_IN_IBSS_ROLE:
 		break;
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
 	default:        /* eLIM_AP_ROLE */
 		if (LIM_IS_STA_ROLE(psessionEntry) &&
 		   (psessionEntry->limSmeState !=
@@ -1290,8 +1275,7 @@ void lim_process_mlm_purge_sta_ind(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 			       FL("*** Cleanup completed for staId=%d ***"),
 			       pMlmPurgeStaInd->aid);
 		       )
-		if (LIM_IS_STA_ROLE(psessionEntry) ||
-		    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+		if (LIM_IS_STA_ROLE(psessionEntry)) {
 			psessionEntry->limSmeState = eLIM_SME_IDLE_STATE;
 			MTRACE(mac_trace
 				       (pMac, TRACE_CODE_SME_STATE,
@@ -1368,8 +1352,7 @@ void lim_process_mlm_set_keys_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 	*/
 	if (eSIR_SME_SUCCESS == pMlmSetKeysCnf->resultCode) {
 		psessionEntry->is_key_installed = 1;
-		if (LIM_IS_AP_ROLE(psessionEntry) ||
-			LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
+		if (LIM_IS_AP_ROLE(psessionEntry)) {
 			sta_ds = dph_lookup_hash_entry(pMac,
 				pMlmSetKeysCnf->peer_macaddr.bytes,
 				&aid, &psessionEntry->dph.dphHashTable);
@@ -1452,12 +1435,6 @@ error:
 	session_entry->pLimJoinReq = NULL;
 	/* Delete teh session if JOIN failure occurred. */
 	if (result_code != eSIR_SME_SUCCESS) {
-		if (lim_set_link_state(mac_ctx, eSIR_LINK_DOWN_STATE,
-			session_entry->bssId,
-			session_entry->selfMacAddr, NULL, NULL)
-			 != eSIR_SUCCESS)
-			lim_log(mac_ctx, LOGE,
-				FL("Failed to set the DownState."));
 		if (lim_set_link_state
 			(mac_ctx, eSIR_LINK_IDLE_STATE,
 			session_entry->bssId,
@@ -1498,8 +1475,7 @@ void lim_process_mlm_add_sta_rsp(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,
 	/* in the case of nested request the new request initiated from the response will take care of resetting */
 	/* the deffered flag. */
 	SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
-	if (LIM_IS_BT_AMP_AP_ROLE(psessionEntry) ||
-	    LIM_IS_AP_ROLE(psessionEntry)) {
+	if (LIM_IS_AP_ROLE(psessionEntry)) {
 		lim_process_ap_mlm_add_sta_rsp(pMac, limMsgQ, psessionEntry);
 		return;
 	}
@@ -1662,11 +1638,9 @@ void lim_process_mlm_del_bss_rsp(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,
 	SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
 	pMac->sys.gSysFrameCount[SIR_MAC_MGMT_FRAME][SIR_MAC_MGMT_DEAUTH] = 0;
 
-	if ((LIM_IS_BT_AMP_AP_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry) ||
-	    LIM_IS_AP_ROLE(psessionEntry)) &&
+	if (LIM_IS_AP_ROLE(psessionEntry) &&
 	    (psessionEntry->statypeForBss == STA_ENTRY_SELF)) {
-		lim_process_bt_amp_ap_mlm_del_bss_rsp(pMac, limMsgQ, psessionEntry);
+		lim_process_ap_mlm_del_bss_rsp(pMac, limMsgQ, psessionEntry);
 		return;
 	}
 	lim_process_sta_mlm_del_bss_rsp(pMac, limMsgQ, psessionEntry);
@@ -1743,8 +1717,7 @@ end:
 	}
 	if (pStaDs == NULL)
 		return;
-	if ((LIM_IS_STA_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) &&
+	if ((LIM_IS_STA_ROLE(psessionEntry)) &&
 	    (psessionEntry->limSmeState !=
 			eLIM_SME_WT_DISASSOC_STATE &&
 	    psessionEntry->limSmeState !=
@@ -1762,7 +1735,7 @@ end:
 	return;
 }
 
-void lim_process_bt_amp_ap_mlm_del_bss_rsp(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,
+void lim_process_ap_mlm_del_bss_rsp(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,
 					   tpPESession psessionEntry)
 {
 	tSirResultCodes rc = eSIR_SME_SUCCESS;
@@ -1868,9 +1841,8 @@ void lim_process_mlm_del_sta_rsp(tpAniSirGlobal mac_ctx,
 		return;
 	}
 
-	if (LIM_IS_BT_AMP_AP_ROLE(session_entry) ||
-		LIM_IS_AP_ROLE(session_entry)) {
-		lim_process_bt_amp_ap_mlm_del_sta_rsp(mac_ctx, msg,
+	if (LIM_IS_AP_ROLE(session_entry)) {
+		lim_process_ap_mlm_del_sta_rsp(mac_ctx, msg,
 				session_entry);
 		return;
 	}
@@ -1878,16 +1850,16 @@ void lim_process_mlm_del_sta_rsp(tpAniSirGlobal mac_ctx,
 }
 
 /**
- * lim_process_bt_amp_ap_mlm_del_sta_rsp() - Process WMA_DEL_STA_RSP
+ * lim_process_ap_mlm_del_sta_rsp() - Process WMA_DEL_STA_RSP
  * @mac_ctx: Global pointer to MAC context
  * @msg: Received message
  * @session_entry: Session entry
  *
- * Process WMA_DEL_STA_RSP for AP or bt_amp_ap role
+ * Process WMA_DEL_STA_RSP for AP role
  *
  * Retunrn: None
  */
-void lim_process_bt_amp_ap_mlm_del_sta_rsp(tpAniSirGlobal mac_ctx,
+void lim_process_ap_mlm_del_sta_rsp(tpAniSirGlobal mac_ctx,
 					   tpSirMsgQ msg,
 					   tpPESession session_entry)
 {
@@ -2408,9 +2380,9 @@ lim_process_sta_add_bss_rsp_pre_assoc(tpAniSirGlobal mac_ctx,
 			lim_log(mac_ctx, LOGP,
 			FL("could not retrieve AuthType"));
 		}
-		/* Try Open Authentication first */
+		/* Try shared Authentication first */
 		if (cfgAuthType == eSIR_AUTO_SWITCH)
-			authMode = eSIR_OPEN_SYSTEM;
+			authMode = eSIR_SHARED_KEY;
 		else
 			authMode = cfgAuthType;
 
@@ -2718,10 +2690,6 @@ void lim_process_mlm_add_bss_rsp(tpAniSirGlobal mac_ctx,
 				}
 				lim_post_sme_message(mac_ctx, LIM_MLM_START_CNF,
 					(uint32_t *) &mlm_start_cnf);
-			} else if ((bss_type == eSIR_BTAMP_AP_MODE) ||
-					(bss_type == eSIR_BTAMP_STA_MODE)) {
-				lim_process_btamp_add_bss_rsp(mac_ctx, msg,
-					session_entry);
 			} else
 				lim_process_ap_mlm_add_bss_rsp(mac_ctx, msg);
 		} else {
@@ -3029,25 +2997,6 @@ static void lim_process_switch_channel_join_req(
 		goto error;
 	}
 
-	/*
-	 * eSIR_BTAMP_AP_MODE stroed as bss type in session
-	 * Table when join req is received, is to be veified
-	 */
-	if (session_entry->bssType == eSIR_BTAMP_AP_MODE) {
-		if (lim_set_link_state
-			(mac_ctx, eSIR_LINK_BTAMP_PREASSOC_STATE,
-			session_entry->bssId, session_entry->selfMacAddr,
-			NULL, NULL) != eSIR_SUCCESS) {
-			PELOGE(lim_log
-				(mac_ctx, LOGE,
-				FL("Sessionid: %d Set link state "
-				"failed!! BSSID:" MAC_ADDRESS_STR),
-				session_entry->peSessionId,
-				MAC_ADDR_ARRAY(session_entry->bssId));)
-			goto error;
-		}
-	}
-
 	session_entry->limPrevMlmState = session_entry->limMlmState;
 	session_entry->limMlmState = eLIM_MLM_WT_JOIN_BEACON_STATE;
 	lim_log(mac_ctx, LOG1,
@@ -3266,59 +3215,6 @@ void lim_process_switch_channel_rsp(tpAniSirGlobal pMac, void *body)
 	qdf_mem_free(body);
 }
 
-/* Added For BT -AMP Support */
-static void
-lim_process_btamp_add_bss_rsp(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,
-			      tpPESession psessionEntry)
-{
-	tLimMlmStartCnf mlmStartCnf;
-	tpAddBssParams pAddBssParams = (tpAddBssParams) limMsgQ->bodyptr;
-
-	if (NULL == pAddBssParams) {
-		lim_log(pMac, LOGE, FL("Invalid body pointer in message"));
-		goto end;
-	}
-	if (QDF_STATUS_SUCCESS == pAddBssParams->status) {
-		lim_log(pMac, LOG2,
-			FL("WMA_ADD_BSS_RSP returned with QDF_STATUS_SUCCESS"));
-		if (psessionEntry->bssType == eSIR_BTAMP_AP_MODE) {
-			if (lim_set_link_state
-				    (pMac, eSIR_LINK_BTAMP_AP_STATE,
-				    psessionEntry->bssId, psessionEntry->selfMacAddr,
-				    NULL, NULL) != eSIR_SUCCESS)
-				goto end;
-		} else if (psessionEntry->bssType == eSIR_BTAMP_STA_MODE) {
-			if (lim_set_link_state
-				    (pMac, eSIR_LINK_SCAN_STATE, psessionEntry->bssId,
-				    psessionEntry->selfMacAddr, NULL,
-				    NULL) != eSIR_SUCCESS)
-				goto end;
-		}
-		/* Set MLME state */
-		psessionEntry->limMlmState = eLIM_MLM_BSS_STARTED_STATE;
-		psessionEntry->statypeForBss = STA_ENTRY_SELF; /* to know session started for peer or for self */
-		psessionEntry->bssIdx = (uint8_t) pAddBssParams->bssIdx;
-		sch_edca_profile_update(pMac, psessionEntry);
-		lim_init_peer_idxpool(pMac, psessionEntry);
-
-		/* Apply previously set configuration at HW */
-		lim_apply_configuration(pMac, psessionEntry);
-		psessionEntry->staId = pAddBssParams->staContext.staIdx;
-		mlmStartCnf.resultCode = eSIR_SME_SUCCESS;
-	} else {
-		lim_log(pMac, LOGE, FL("WMA_ADD_BSS_REQ failed with status %d"),
-			pAddBssParams->status);
-		mlmStartCnf.resultCode = eSIR_SME_HAL_SEND_MESSAGE_FAIL;
-	}
-	mlmStartCnf.sessionId = psessionEntry->peSessionId;
-	lim_post_sme_message(pMac, LIM_MLM_START_CNF, (uint32_t *) &mlmStartCnf);
-end:
-	if (0 != limMsgQ->bodyptr) {
-		qdf_mem_free(pAddBssParams);
-		limMsgQ->bodyptr = NULL;
-	}
-}
-
 void lim_send_beacon_ind(tpAniSirGlobal pMac, tpPESession psessionEntry)
 {
 	tBeaconGenParams *pBeaconGenParams = NULL;
@@ -3402,10 +3298,10 @@ void lim_process_rx_scan_event(tpAniSirGlobal pMac, void *buf)
 		  "scan_id = %u, scan_requestor_id 0x%x", pScanEvent->scanId,
 		  pScanEvent->requestor);
 	switch (pScanEvent->event) {
-	case LIM_SCAN_EVENT_STARTED:
+	case SIR_SCAN_EVENT_STARTED:
 		break;
-	case LIM_SCAN_EVENT_START_FAILED:
-	case LIM_SCAN_EVENT_COMPLETED:
+	case SIR_SCAN_EVENT_START_FAILED:
+	case SIR_SCAN_EVENT_COMPLETED:
 		if (ROC_SCAN_REQUESTOR_ID == pScanEvent->requestor) {
 			lim_send_sme_roc_rsp(pMac, eWNI_SME_REMAIN_ON_CHN_RSP,
 					 QDF_STATUS_SUCCESS,
@@ -3433,7 +3329,7 @@ void lim_process_rx_scan_event(tpAniSirGlobal pMac, void *buf)
 			lim_send_scan_offload_complete(pMac, pScanEvent);
 		}
 		break;
-	case LIM_SCAN_EVENT_FOREIGN_CHANNEL:
+	case SIR_SCAN_EVENT_FOREIGN_CHANNEL:
 		if (ROC_SCAN_REQUESTOR_ID == pScanEvent->requestor) {
 			/*Send Ready on channel indication to SME */
 			if (pMac->lim.gpLimRemainOnChanReq) {
@@ -3452,9 +3348,9 @@ void lim_process_rx_scan_event(tpAniSirGlobal pMac, void *buf)
 					pScanEvent->scanId);
 		}
 		break;
-	case LIM_SCAN_EVENT_BSS_CHANNEL:
-	case LIM_SCAN_EVENT_DEQUEUED:
-	case LIM_SCAN_EVENT_PREEMPTED:
+	case SIR_SCAN_EVENT_BSS_CHANNEL:
+	case SIR_SCAN_EVENT_DEQUEUED:
+	case SIR_SCAN_EVENT_PREEMPTED:
 	default:
 		QDF_TRACE(QDF_MODULE_ID_PE, QDF_TRACE_LEVEL_DEBUG,
 			  "Received unhandled scan event %u",
diff --git a/core/mac/src/pe/lim/lim_process_probe_req_frame.c b/core/mac/src/pe/lim/lim_process_probe_req_frame.c
index da973a0cf4fd..5b53e5e1edb0 100644
--- a/core/mac/src/pe/lim/lim_process_probe_req_frame.c
+++ b/core/mac/src/pe/lim/lim_process_probe_req_frame.c
@@ -373,8 +373,6 @@ lim_process_probe_req_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 	}
 	mac_hdr = WMA_GET_RX_MAC_HEADER(rx_pkt_info);
 	if (LIM_IS_AP_ROLE(session) ||
-		LIM_IS_BT_AMP_AP_ROLE(session) ||
-		LIM_IS_BT_AMP_STA_ROLE(session) ||
 		(LIM_IS_IBSS_ROLE(session) &&
 			 (WMA_GET_RX_BEACON_SENT(rx_pkt_info)))) {
 		frame_len = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info);
@@ -606,9 +604,7 @@ lim_process_probe_req_frame_multiple_bss(tpAniSirGlobal mac_ctx,
 			lim_indicate_probe_req_to_hdd(mac_ctx,
 					buf_descr, session);
 		if (LIM_IS_AP_ROLE(session) ||
-			LIM_IS_IBSS_ROLE(session) ||
-			LIM_IS_BT_AMP_AP_ROLE(session) ||
-			LIM_IS_BT_AMP_STA_ROLE(session))
+			LIM_IS_IBSS_ROLE(session))
 			lim_process_probe_req_frame(mac_ctx,
 					buf_descr, session);
 	}
diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index a1833859c6a1..026a50a89c0e 100644
--- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -367,17 +367,11 @@ __lim_fresh_scan_reqd(tpAniSirGlobal mac_ctx, uint8_t return_fresh_results)
 			mac_ctx->lim.gpSession[i].limSmeState);
 		if (mac_ctx->lim.gpSession[i].valid == true) {
 			if (!((((mac_ctx->lim.gpSession[i].bssType ==
-					eSIR_INFRASTRUCTURE_MODE) ||
-				(mac_ctx->lim.gpSession[i].limSystemRole ==
-					eLIM_BT_AMP_STA_ROLE)) &&
+					eSIR_INFRASTRUCTURE_MODE)) &&
 				(mac_ctx->lim.gpSession[i].limSmeState ==
 					eLIM_SME_LINK_EST_STATE)) ||
 			      (((mac_ctx->lim.gpSession[i].bssType ==
-					eSIR_IBSS_MODE) ||
-				(mac_ctx->lim.gpSession[i].limSystemRole ==
-					eLIM_BT_AMP_AP_ROLE) ||
-				(mac_ctx->lim.gpSession[i].limSystemRole ==
-					eLIM_BT_AMP_STA_ROLE)) &&
+					eSIR_IBSS_MODE)) &&
 			       (mac_ctx->lim.gpSession[i].limSmeState ==
 					eLIM_SME_NORMAL_STATE)) ||
 			      ((((mac_ctx->lim.gpSession[i].bssType ==
@@ -828,14 +822,6 @@ __lim_handle_sme_start_bss_request(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 
 			break;
 
-		case eSIR_BTAMP_AP_MODE:
-			session->limSystemRole = eLIM_BT_AMP_AP_ROLE;
-			break;
-
-		case eSIR_BTAMP_STA_MODE:
-			session->limSystemRole = eLIM_BT_AMP_STA_ROLE;
-			break;
-
 		/*
 		 * There is one more mode called auto mode.
 		 * which is used no where
@@ -849,23 +835,22 @@ __lim_handle_sme_start_bss_request(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		}
 
 		/*
-		 * BT-AMP: Allocate memory for the array of
+		 * Allocate memory for the array of
 		 * parsed (Re)Assoc request structure
 		 */
-		if ((sme_start_bss_req->bssType == eSIR_BTAMP_AP_MODE) ||
-		    (sme_start_bss_req->bssType == eSIR_INFRA_AP_MODE)) {
+		if (sme_start_bss_req->bssType == eSIR_INFRA_AP_MODE) {
 			session->parsedAssocReq =
 				qdf_mem_malloc(session->dph.dphHashTable.
-					       size * sizeof(tpSirAssocReq));
+						size * sizeof(tpSirAssocReq));
 			if (NULL == session->parsedAssocReq) {
 				lim_log(mac_ctx, LOGW,
-					FL("AllocateMemory() failed"));
+						FL("AllocateMemory() failed"));
 				ret_code = eSIR_SME_RESOURCES_UNAVAILABLE;
 				goto free;
 			}
 			qdf_mem_set(session->parsedAssocReq,
-				(session->dph.dphHashTable.size *
-				sizeof(tpSirAssocReq)), 0);
+					(session->dph.dphHashTable.size *
+					sizeof(tpSirAssocReq)), 0);
 		}
 
 		if (!sme_start_bss_req->channelId) {
@@ -969,9 +954,7 @@ __lim_handle_sme_start_bss_request(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		/* Fill PE session Id from the session Table */
 		mlm_start_req->sessionId = session->peSessionId;
 
-		if ((mlm_start_req->bssType == eSIR_BTAMP_STA_MODE) ||
-		    (mlm_start_req->bssType == eSIR_BTAMP_AP_MODE) ||
-		    (mlm_start_req->bssType == eSIR_INFRA_AP_MODE)) {
+		if (mlm_start_req->bssType == eSIR_INFRA_AP_MODE) {
 			/*
 			 * Copy the BSSId from sessionTable to
 			 * mlmStartReq struct
@@ -1872,8 +1855,6 @@ __lim_process_sme_join_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 
 		if (session->bssType == eSIR_INFRASTRUCTURE_MODE) {
 			session->limSystemRole = eLIM_STA_ROLE;
-		} else if (session->bssType == eSIR_BTAMP_AP_MODE) {
-			session->limSystemRole = eLIM_BT_AMP_STA_ROLE;
 		} else {
 			/*
 			 * Throw an error and return and make
@@ -2473,7 +2454,6 @@ static void __lim_process_sme_disassoc_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
 
 	switch (GET_LIM_SYSTEM_ROLE(psessionEntry)) {
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
 		switch (psessionEntry->limSmeState) {
 		case eLIM_SME_ASSOCIATED_STATE:
 		case eLIM_SME_LINK_EST_STATE:
@@ -2559,7 +2539,6 @@ static void __lim_process_sme_disassoc_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
 		break;
 
 	case eLIM_AP_ROLE:
-	case eLIM_BT_AMP_AP_ROLE:
 		/* Fall through */
 		break;
 
@@ -2676,7 +2655,6 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 
 	switch (GET_LIM_SYSTEM_ROLE(psessionEntry)) {
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:      /* To test reconn */
 		if ((psessionEntry->limSmeState != eLIM_SME_IDLE_STATE) &&
 		    (psessionEntry->limSmeState != eLIM_SME_WT_DISASSOC_STATE)
 		    && (psessionEntry->limSmeState !=
@@ -2811,8 +2789,6 @@ static void __lim_process_sme_deauth_req(tpAniSirGlobal mac_ctx,
 
 	switch (GET_LIM_SYSTEM_ROLE(session_entry)) {
 	case eLIM_STA_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
-
 		switch (session_entry->limSmeState) {
 		case eLIM_SME_ASSOCIATED_STATE:
 		case eLIM_SME_LINK_EST_STATE:
@@ -3023,12 +2999,10 @@ __lim_process_sme_set_context_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 			      session_entry, 0, 0);
 #endif /* FEATURE_WLAN_DIAG_SUPPORT */
 
-	if (((LIM_IS_STA_ROLE(session_entry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(session_entry)) &&
+	if ((LIM_IS_STA_ROLE(session_entry) &&
 	    (session_entry->limSmeState == eLIM_SME_LINK_EST_STATE)) ||
 	    ((LIM_IS_IBSS_ROLE(session_entry) ||
-	    LIM_IS_AP_ROLE(session_entry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(session_entry)) &&
+	    LIM_IS_AP_ROLE(session_entry)) &&
 	    (session_entry->limSmeState == eLIM_SME_NORMAL_STATE))) {
 		/* Trigger MLM_SETKEYS_REQ */
 		mlm_set_key_req = qdf_mem_malloc(sizeof(tLimMlmSetKeysReq));
@@ -3317,9 +3291,7 @@ lim_get_wpspbc_sessions_end:
 static void __lim_counter_measures(tpAniSirGlobal pMac, tpPESession psessionEntry)
 {
 	tSirMacAddr mac = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
-	if (LIM_IS_AP_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry))
+	if (LIM_IS_AP_ROLE(psessionEntry))
 		lim_send_disassoc_mgmt_frame(pMac, eSIR_MAC_MIC_FAILURE_REASON,
 					     mac, psessionEntry, false);
 };
@@ -3429,8 +3401,7 @@ __lim_handle_sme_stop_bss_request(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 	psessionEntry->transactionId = smetransactionId;
 
 	/* BTAMP_STA and STA_IN_IBSS should NOT send Disassoc frame */
-	if (!LIM_IS_IBSS_ROLE(psessionEntry) &&
-	    !LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+	if (!LIM_IS_IBSS_ROLE(psessionEntry)) {
 		tSirMacAddr bcAddr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 		if (stopBssReq.reasonCode == eSIR_SME_MIC_COUNTER_MEASURES)
 			/* Send disassoc all stations associated thru TKIP */
@@ -3577,8 +3548,7 @@ void __lim_process_sme_assoc_cnf_new(tpAniSirGlobal mac_ctx, uint32_t msg_type,
 		goto end;
 	}
 
-	if ((!LIM_IS_AP_ROLE(session_entry) &&
-	    !LIM_IS_BT_AMP_AP_ROLE(session_entry)) ||
+	if ((!LIM_IS_AP_ROLE(session_entry)) ||
 	    ((session_entry->limSmeState != eLIM_SME_NORMAL_STATE) &&
 	    (session_entry->limSmeState !=
 			eLIM_SME_NORMAL_CHANNEL_SCAN_STATE))) {
@@ -3731,8 +3701,7 @@ static void __lim_process_sme_addts_req(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 		       pSirAddts->req.tspec.tsinfo.traffic.userPrio);
 	       )
 
-	if (!LIM_IS_STA_ROLE(psessionEntry) &&
-	    !LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+	if (!LIM_IS_STA_ROLE(psessionEntry)) {
 		PELOGE(lim_log(pMac, LOGE, "AddTs received on AP - ignoring");)
 		lim_send_sme_addts_rsp(pMac, pSirAddts->rspReqd, eSIR_FAILURE,
 				       psessionEntry, pSirAddts->req.tspec,
@@ -3977,8 +3946,7 @@ void lim_process_sme_addts_rsp_timeout(tpAniSirGlobal pMac, uint32_t param)
 		return;
 	}
 
-	if (!LIM_IS_STA_ROLE(psessionEntry) &&
-	    !LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+	if (!LIM_IS_STA_ROLE(psessionEntry)) {
 		lim_log(pMac, LOGW, "AddtsRspTimeout in non-Sta role (%d)",
 			GET_LIM_SYSTEM_ROLE(psessionEntry));
 		pMac->lim.gLimAddtsSent = false;
diff --git a/core/mac/src/pe/lim/lim_reassoc_utils.c b/core/mac/src/pe/lim/lim_reassoc_utils.c
index de92887ac6f0..d9d4024b6371 100644
--- a/core/mac/src/pe/lim/lim_reassoc_utils.c
+++ b/core/mac/src/pe/lim/lim_reassoc_utils.c
@@ -225,8 +225,7 @@ void lim_handle_del_bss_in_re_assoc_context(tpAniSirGlobal pMac,
 		psessionEntry->limSmeState = eLIM_SME_WT_REASSOC_STATE;
 		lim_delete_dph_hash_entry(pMac, pStaDs->staAddr,
 					  pStaDs->assocId, psessionEntry);
-		if (LIM_IS_STA_ROLE(psessionEntry) ||
-		    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
+		if (LIM_IS_STA_ROLE(psessionEntry)) {
 			psessionEntry->limMlmState =
 				eLIM_MLM_IDLE_STATE;
 		}
@@ -416,8 +415,7 @@ bool lim_is_reassoc_in_progress(tpAniSirGlobal pMac, tpPESession psessionEntry)
 {
 	if (psessionEntry == NULL)
 		return false;
-	if ((LIM_IS_STA_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) &&
+	if ((LIM_IS_STA_ROLE(psessionEntry)) &&
 	    ((psessionEntry->limSmeState == eLIM_SME_WT_REASSOC_STATE) ||
 	    (psessionEntry->limSmeState ==
 		      eLIM_SME_WT_REASSOC_LINK_FAIL_STATE)))
diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c
index 46987e92081e..757ffe9d827c 100644
--- a/core/mac/src/pe/lim/lim_send_management_frames.c
+++ b/core/mac/src/pe/lim/lim_send_management_frames.c
@@ -2010,6 +2010,27 @@ lim_send_auth_mgmt_frame(tpAniSirGlobal mac_ctx,
 
 	sme_sessionid = session->smeSessionId;
 
+	if (wep_bit == LIM_WEP_IN_FC) {
+		/*
+		 * Auth frame3 to be sent with encrypted framebody
+		 *
+		 * Allocate buffer for Authenticaton frame of size
+		 * equal to management frame header length plus 2 bytes
+		 * each for auth algorithm number, transaction number,
+		 * status code, 128 bytes for challenge text and
+		 * 4 bytes each for IV & ICV.
+		 */
+		lim_log(mac_ctx, LOG1,
+			FL("Sending encrypted auth frame to " MAC_ADDRESS_STR
+			   "- wait_for_ack %d"), MAC_ADDR_ARRAY(peer_addr),
+			   wait_for_ack);
+
+		frame_len = sizeof(tSirMacMgmtHdr) + LIM_ENCR_AUTH_BODY_LEN;
+		body_len = LIM_ENCR_AUTH_BODY_LEN;
+
+		goto alloc_packet;
+	}
+
 	lim_log(mac_ctx, LOG1,
 		FL("Sending Auth seq# %d status %d (%d) wait_for_ack %d to "
 		MAC_ADDRESS_STR),
@@ -2084,35 +2105,18 @@ lim_send_auth_mgmt_frame(tpAniSirGlobal mac_ctx,
 		break;
 
 	case SIR_MAC_AUTH_FRAME_3:
-		if (wep_bit == LIM_WEP_IN_FC) {
-			/*
-			 * Auth frame3 to be sent with encrypted framebody
-			 *
-			 * Allocate buffer for Authenticaton frame of size
-			 * equal to management frame header length plus 2 bytes
-			 * each for auth algorithm number, transaction number,
-			 * status code, 128 bytes for challenge text and
-			 * 4 bytes each for IV & ICV.
-			 */
-
-			frame_len = sizeof(tSirMacMgmtHdr) +
-					LIM_ENCR_AUTH_BODY_LEN;
-			body_len = LIM_ENCR_AUTH_BODY_LEN;
-		} else {
-
-			/*
-			 * Auth frame3 to be sent without encrypted framebody
-			 *
-			 * Allocate buffer for Authenticaton frame of size equal
-			 * to management frame header length plus 2 bytes each
-			 * for auth algorithm number, transaction number and
-			 * status code.
-			 */
+		/*
+		 * Auth frame3 to be sent without encrypted framebody
+		 *
+		 * Allocate buffer for Authenticaton frame of size equal
+		 * to management frame header length plus 2 bytes each
+		 * for auth algorithm number, transaction number and
+		 * status code.
+		 */
 
-			frame_len = sizeof(tSirMacMgmtHdr) +
-				   SIR_MAC_AUTH_CHALLENGE_OFFSET;
-			body_len = SIR_MAC_AUTH_CHALLENGE_OFFSET;
-		}
+		frame_len = sizeof(tSirMacMgmtHdr) +
+			   SIR_MAC_AUTH_CHALLENGE_OFFSET;
+		body_len = SIR_MAC_AUTH_CHALLENGE_OFFSET;
 		break;
 
 	case SIR_MAC_AUTH_FRAME_4:
@@ -2128,8 +2132,12 @@ lim_send_auth_mgmt_frame(tpAniSirGlobal mac_ctx,
 		body_len = SIR_MAC_AUTH_CHALLENGE_OFFSET;
 
 		break;
+	default:
+		lim_log(mac_ctx, LOGE, FL("Invalid auth transaction seq num."));
+		return;
 	} /* switch (auth_frame->authTransactionSeqNumber) */
 
+alloc_packet:
 	qdf_status = cds_packet_alloc((uint16_t) frame_len, (void **)&frame,
 				 (void **)&packet);
 
@@ -2148,8 +2156,7 @@ lim_send_auth_mgmt_frame(tpAniSirGlobal mac_ctx,
 	mac_hdr->fc.wep = wep_bit;
 
 	/* Prepare BSSId */
-	if (LIM_IS_AP_ROLE(session) ||
-	    LIM_IS_BT_AMP_AP_ROLE(session))
+	if (LIM_IS_AP_ROLE(session))
 		qdf_mem_copy((uint8_t *) mac_hdr->bssId,
 			     (uint8_t *) session->bssId,
 			     sizeof(tSirMacAddr));
@@ -2161,10 +2168,7 @@ lim_send_auth_mgmt_frame(tpAniSirGlobal mac_ctx,
 		qdf_mem_copy(body, (uint8_t *) auth_frame, body_len);
 
 		lim_log(mac_ctx, LOG1,
-			FL("*** Sending Auth seq# 3 status %d (%d) to"
-				MAC_ADDRESS_STR),
-			auth_frame->authStatusCode,
-			(auth_frame->authStatusCode == eSIR_MAC_SUCCESS_STATUS),
+			FL("Sending Auth seq# 3 to " MAC_ADDRESS_STR),
 			MAC_ADDR_ARRAY(mac_hdr->da));
 
 	} else {
diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
index 54eb1f07951c..50719daca663 100644
--- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
@@ -1023,11 +1023,8 @@ lim_send_sme_disassoc_ntf(tpAniSirGlobal pMac,
 
 error:
 	/* Delete the PE session Created */
-	if ((psessionEntry != NULL) &&
-	    (LIM_IS_STA_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry))) {
+	if ((psessionEntry != NULL) && LIM_IS_STA_ROLE(psessionEntry))
 		pe_delete_session(pMac, psessionEntry);
-	}
 
 	if (false == failure)
 		lim_send_sme_disassoc_deauth_ntf(pMac, QDF_STATUS_SUCCESS,
diff --git a/core/mac/src/pe/lim/lim_session.c b/core/mac/src/pe/lim/lim_session.c
index b24be5489d6c..1aa2a6080bf3 100644
--- a/core/mac/src/pe/lim/lim_session.c
+++ b/core/mac/src/pe/lim/lim_session.c
@@ -326,9 +326,7 @@ pe_create_session(tpAniSirGlobal pMac, uint8_t *bssid, uint8_t *sessionId,
 		FL("Create a new PE session(%d), BSSID: "MAC_ADDRESS_STR" Max No. of STA %d"),
 		session_ptr->peSessionId, MAC_ADDR_ARRAY(bssid), numSta);
 
-	if (eSIR_INFRA_AP_MODE == bssType
-	    || eSIR_IBSS_MODE == bssType
-	    || eSIR_BTAMP_AP_MODE == bssType) {
+	if (eSIR_INFRA_AP_MODE == bssType || eSIR_IBSS_MODE == bssType) {
 		session_ptr->pSchProbeRspTemplate =
 			qdf_mem_malloc(SCH_MAX_PROBE_RESP_SIZE);
 		session_ptr->pSchBeaconFrameBegin =
diff --git a/core/mac/src/pe/lim/lim_sme_req_utils.c b/core/mac/src/pe/lim/lim_sme_req_utils.c
index fc2686306209..a4ae8933167f 100644
--- a/core/mac/src/pe/lim/lim_sme_req_utils.c
+++ b/core/mac/src/pe/lim/lim_sme_req_utils.c
@@ -407,10 +407,6 @@ lim_is_sme_start_bss_req_valid(tpAniSirGlobal mac_ctx,
 		break;
 	case eSIR_IBSS_MODE:
 		break;
-	case eSIR_BTAMP_STA_MODE:
-		break;
-	case eSIR_BTAMP_AP_MODE:
-		break;
 	case eSIR_INFRA_AP_MODE:
 		break;
 	default:
diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c
index 0ae1b16cc3ad..45265686cd83 100644
--- a/core/mac/src/pe/lim/lim_utils.c
+++ b/core/mac/src/pe/lim/lim_utils.c
@@ -3049,8 +3049,7 @@ lim_enable_11a_protection(tpAniSirGlobal mac_ctx,
 	 * If we are AP and HT capable, we need to set the HT OP mode
 	 * appropriately.
 	 */
-	if ((LIM_IS_AP_ROLE(pe_session) || LIM_IS_BT_AMP_AP_ROLE(pe_session))
-	    && (true == pe_session->htCapability)) {
+	if (LIM_IS_AP_ROLE(pe_session) && (true == pe_session->htCapability)) {
 		if (overlap) {
 			mac_ctx->lim.gLimOverlap11aParams.protectionEnabled =
 				true;
@@ -3309,46 +3308,8 @@ lim_handle_enable11g_protection_enabled(tpAniSirGlobal mac_ctx,
 						session_entry);
 			}
 		}
-	} else if (LIM_IS_BT_AMP_AP_ROLE(session_entry) &&
-			(true == session_entry->htCapability) && overlap) {
-		session_entry->gLimOlbcParams.protectionEnabled = true;
-		if ((eSIR_HT_OP_MODE_OVERLAP_LEGACY !=
-			mac_ctx->lim.gHTOperMode) &&
-			(eSIR_HT_OP_MODE_MIXED !=
-				mac_ctx->lim.gHTOperMode)) {
-			mac_ctx->lim.gHTOperMode =
-				eSIR_HT_OP_MODE_OVERLAP_LEGACY;
-		}
-		/*
-		 * CR-263021: OBSS bit is not switching back to 0 after
-		 * disabling the overlapping legacy BSS
-		 */
-		/*
-		 * This fixes issue of OBSS bit not set after 11b, 11g station
-		 * leaves
-		 */
-		lim_enable_ht_rifs_protection(mac_ctx, true, overlap,
-				beaconparams, session_entry);
-		/*
-		 * Not processing OBSS bit from other APs, as we are already
-		 * taking care of Protection from overlapping BSS based on erp
-		 * IE or useProtection bit
-		 */
-		lim_enable_ht_obss_protection(mac_ctx, true, overlap,
-				beaconparams, session_entry);
-	} else if (LIM_IS_BT_AMP_AP_ROLE(session_entry) &&
-			(true == session_entry->htCapability) && !overlap) {
-		session_entry->gLim11bParams.protectionEnabled = true;
-		if (eSIR_HT_OP_MODE_MIXED !=
-			mac_ctx->lim.gHTOperMode) {
-			mac_ctx->lim.gHTOperMode =
-				eSIR_HT_OP_MODE_MIXED;
-			lim_enable_ht_rifs_protection(mac_ctx, true,
-					overlap, beaconparams, session_entry);
-			lim_enable_ht_obss_protection(mac_ctx, true,
-					overlap, beaconparams, session_entry);
-		}
 	}
+
 	/* This part is common for staiton as well. */
 	if (false == session_entry->beaconParams.llbCoexist) {
 		lim_log(mac_ctx, LOG1, FL("=> 11G Protection Enabled"));
@@ -3481,99 +3442,8 @@ lim_handle_11g_protection_for_11bcoexist(tpAniSirGlobal mac_ctx,
 				PARAM_llBCOEXIST_CHANGED;
 		}
 	}
-	if (LIM_IS_BT_AMP_AP_ROLE(session_entry) && overlap) {
-		/* Overlap Legacy protection disabled. */
-		session_entry->gLimOlbcParams.protectionEnabled = false;
-
-		/* We need to take care of HT OP mode iff we are HT AP. */
-		if (session_entry->htCapability) {
-			/*
-			 * no HT op mode change if any of the overlap protection
-			 * enabled.
-			 */
-			if (!(mac_ctx->lim.gLimOverlap11gParams.
-					protectionEnabled ||
-				mac_ctx->lim.gLimOverlapHt20Params.
-					protectionEnabled ||
-				mac_ctx->lim.gLimOverlapNonGfParams.
-					protectionEnabled) &&
-				/*
-				 * Check if there is a need to change HT
-				 * OP mode.
-				 */
-				(eSIR_HT_OP_MODE_OVERLAP_LEGACY ==
-						mac_ctx->lim.gHTOperMode)) {
-				lim_enable_ht_rifs_protection(mac_ctx,
-					false, overlap, beaconparams,
-					session_entry);
-				lim_enable_ht_obss_protection(mac_ctx,
-					false, overlap, beaconparams,
-					session_entry);
-				if (session_entry->gLimHt20Params.
-						protectionEnabled)
-					mac_ctx->lim.gHTOperMode =
-					    eSIR_HT_OP_MODE_NO_LEGACY_20MHZ_HT;
-				else
-					mac_ctx->lim.gHTOperMode =
-							eSIR_HT_OP_MODE_PURE;
-			}
-		}
-	} else if (LIM_IS_BT_AMP_AP_ROLE(session_entry) && !overlap) {
-		/* Disable protection from 11B stations. */
-		session_entry->gLim11bParams.protectionEnabled = false;
-		/* Check if any other non-HT protection enabled. */
-		if (!session_entry->gLim11gParams.protectionEnabled) {
-			/* Right now we are in HT OP Mixed mode. */
-			/* Change HT op mode appropriately. */
-			lim_enable_ht_obss_protection(mac_ctx, false,
-					overlap, beaconparams, session_entry);
-			/*
-			 * Change HT OP mode to 01 if any overlap protection
-			 * enabled
-			 */
-			if (session_entry->gLimOlbcParams.protectionEnabled ||
-				mac_ctx->lim.gLimOverlap11gParams.
-					protectionEnabled ||
-				mac_ctx->lim.gLimOverlapHt20Params.
-					protectionEnabled ||
-				mac_ctx->lim.gLimOverlapNonGfParams.
-					protectionEnabled) {
-				mac_ctx->lim.gHTOperMode =
-					eSIR_HT_OP_MODE_OVERLAP_LEGACY;
-				lim_enable_ht_rifs_protection(mac_ctx,
-						true, overlap, beaconparams,
-						session_entry);
-			} else if (session_entry->gLimHt20Params.
-				protectionEnabled) {
-				mac_ctx->lim.gHTOperMode =
-					eSIR_HT_OP_MODE_NO_LEGACY_20MHZ_HT;
-				lim_enable_ht_rifs_protection(mac_ctx,
-						false, overlap, beaconparams,
-						session_entry);
-			} else {
-				mac_ctx->lim.gHTOperMode =
-					eSIR_HT_OP_MODE_PURE;
-				lim_enable_ht_rifs_protection(mac_ctx,
-						false, overlap, beaconparams,
-						session_entry);
-			}
-		}
-	}
-	if (LIM_IS_BT_AMP_AP_ROLE(session_entry)) {
-		if (!session_entry->gLimOlbcParams.protectionEnabled &&
-			!session_entry->gLim11bParams.protectionEnabled) {
-			lim_log(mac_ctx, LOG1,
-				FL("===> 11G Protection Disabled"));
-			beaconparams->llbCoexist =
-				session_entry->beaconParams.llbCoexist =
-								false;
-			beaconparams->paramChangeBitmap |=
-				PARAM_llBCOEXIST_CHANGED;
-		}
-	}
 	/* For station role */
-	if (!LIM_IS_AP_ROLE(session_entry) &&
-			!LIM_IS_BT_AMP_AP_ROLE(session_entry)) {
+	if (!LIM_IS_AP_ROLE(session_entry)) {
 		lim_log(mac_ctx, LOG1, FL("===> 11G Protection Disabled"));
 		beaconparams->llbCoexist =
 			session_entry->beaconParams.llbCoexist = false;
@@ -3656,14 +3526,6 @@ lim_enable_ht_protection_from11g(tpAniSirGlobal pMac, uint8_t enable,
 				       FL("overlap protection from 11g is disabled"));
 			       );
 			return eSIR_SUCCESS;
-		} else if (LIM_IS_BT_AMP_AP_ROLE(psessionEntry) &&
-			  (!pMac->lim.cfgProtection.overlapFromllg)) {
-			/* protection disabled. */
-			PELOG3(lim_log
-				       (pMac, LOG3,
-				       FL("overlap protection from 11g is disabled"));
-			       );
-			return eSIR_SUCCESS;
 		}
 	} else {
 		/* normal protection config check */
@@ -3729,43 +3591,6 @@ lim_enable_ht_protection_from11g(tpAniSirGlobal pMac, uint8_t enable,
 								      psessionEntry);
 				}
 			}
-		} else if (LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
-			if (overlap) {
-				pMac->lim.gLimOverlap11gParams.
-				protectionEnabled = true;
-				/* 11g exists in overlap BSS. */
-				/* need not to change the operating mode to overlap_legacy */
-				/* if higher or same protection operating mode is enabled right now. */
-				if ((eSIR_HT_OP_MODE_OVERLAP_LEGACY !=
-				     pMac->lim.gHTOperMode)
-				    && (eSIR_HT_OP_MODE_MIXED !=
-					pMac->lim.gHTOperMode)) {
-					pMac->lim.gHTOperMode =
-						eSIR_HT_OP_MODE_OVERLAP_LEGACY;
-					lim_enable_ht_rifs_protection(pMac, true,
-								      overlap,
-								      pBeaconParams,
-								      psessionEntry);
-				}
-			} else {
-				/* 11g is associated to an AP operating in 11n mode. */
-				/* Change the HT operating mode to 'mixed mode'. */
-				psessionEntry->gLim11gParams.protectionEnabled =
-					true;
-				if (eSIR_HT_OP_MODE_MIXED !=
-				    pMac->lim.gHTOperMode) {
-					pMac->lim.gHTOperMode =
-						eSIR_HT_OP_MODE_MIXED;
-					lim_enable_ht_rifs_protection(pMac, true,
-								      overlap,
-								      pBeaconParams,
-								      psessionEntry);
-					lim_enable_ht_obss_protection(pMac, true,
-								      overlap,
-								      pBeaconParams,
-								      psessionEntry);
-				}
-			}
 		}
 		/* This part is common for staiton as well. */
 		if (false == psessionEntry->beaconParams.llgCoexist) {
@@ -3901,109 +3726,6 @@ lim_enable_ht_protection_from11g(tpAniSirGlobal pMac, uint8_t enable,
 				pBeaconParams->paramChangeBitmap |=
 					PARAM_llGCOEXIST_CHANGED;
 			}
-		} else if (LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
-			if (overlap) {
-				/* Overlap Legacy protection disabled. */
-				pMac->lim.gLimOverlap11gParams.
-				protectionEnabled = false;
-
-				/* no HT op mode change if any of the overlap protection enabled. */
-				if (!
-				    (psessionEntry->gLimOlbcParams.
-				     protectionEnabled
-				     || psessionEntry->gLimOverlapHt20Params.
-				     protectionEnabled
-				     || psessionEntry->gLimOverlapNonGfParams.
-				     protectionEnabled)) {
-					/* Check if there is a need to change HT OP mode. */
-					if (eSIR_HT_OP_MODE_OVERLAP_LEGACY ==
-					    pMac->lim.gHTOperMode) {
-						lim_enable_ht_rifs_protection(pMac,
-									      false,
-									      overlap,
-									      pBeaconParams,
-									      psessionEntry);
-						lim_enable_ht_obss_protection(pMac,
-									      false,
-									      overlap,
-									      pBeaconParams,
-									      psessionEntry);
-
-						if (psessionEntry->
-						    gLimHt20Params.
-						    protectionEnabled)
-							pMac->lim.gHTOperMode =
-								eSIR_HT_OP_MODE_NO_LEGACY_20MHZ_HT;
-						else
-							pMac->lim.gHTOperMode =
-								eSIR_HT_OP_MODE_PURE;
-					}
-				}
-			} else {
-				/* Disable protection from 11G stations. */
-				psessionEntry->gLim11gParams.protectionEnabled =
-					false;
-				/* Check if any other non-HT protection enabled. */
-				if (!psessionEntry->gLim11bParams.
-				    protectionEnabled) {
-
-					/* Right now we are in HT OP Mixed mode. */
-					/* Change HT op mode appropriately. */
-					lim_enable_ht_obss_protection(pMac, false,
-								      overlap,
-								      pBeaconParams,
-								      psessionEntry);
-
-					/* Change HT OP mode to 01 if any overlap protection enabled */
-					if (psessionEntry->gLimOlbcParams.
-					    protectionEnabled
-					    || pMac->lim.gLimOverlap11gParams.
-					    protectionEnabled
-					    || pMac->lim.gLimOverlapHt20Params.
-					    protectionEnabled
-					    || pMac->lim.gLimOverlapNonGfParams.
-					    protectionEnabled) {
-						pMac->lim.gHTOperMode =
-							eSIR_HT_OP_MODE_OVERLAP_LEGACY;
-						lim_enable_ht_rifs_protection(pMac,
-									      true,
-									      overlap,
-									      pBeaconParams,
-									      psessionEntry);
-					} else if (psessionEntry->
-						   gLimHt20Params.
-						   protectionEnabled) {
-						pMac->lim.gHTOperMode =
-							eSIR_HT_OP_MODE_NO_LEGACY_20MHZ_HT;
-						lim_enable_ht_rifs_protection(pMac,
-									      false,
-									      overlap,
-									      pBeaconParams,
-									      psessionEntry);
-					} else {
-						pMac->lim.gHTOperMode =
-							eSIR_HT_OP_MODE_PURE;
-						lim_enable_ht_rifs_protection(pMac,
-									      false,
-									      overlap,
-									      pBeaconParams,
-									      psessionEntry);
-					}
-				}
-			}
-			if (!pMac->lim.gLimOverlap11gParams.protectionEnabled &&
-			    !psessionEntry->gLim11gParams.protectionEnabled) {
-				PELOG1(lim_log
-					       (pMac, LOG1,
-					       FL
-						       ("===> Protection from 11G Disabled"));
-				       )
-				pBeaconParams->llgCoexist =
-					psessionEntry->beaconParams.llgCoexist =
-						false;
-				pBeaconParams->paramChangeBitmap |=
-					PARAM_llGCOEXIST_CHANGED;
-			}
 		}
 		/* for station role */
 		else {
@@ -4159,28 +3881,6 @@ static void lim_handle_ht20protection_enabled(tpAniSirGlobal mac_ctx,
 			lim_enable_ht_obss_protection(mac_ctx, false,
 				overlap, beaconparams, session_entry);
 		}
-	} else if (LIM_IS_BT_AMP_AP_ROLE(session_entry) && overlap) {
-			mac_ctx->lim.gLimOverlapHt20Params.protectionEnabled =
-				true;
-		if ((eSIR_HT_OP_MODE_OVERLAP_LEGACY !=
-				mac_ctx->lim.gHTOperMode) &&
-			(eSIR_HT_OP_MODE_MIXED !=
-				mac_ctx->lim.gHTOperMode)) {
-			mac_ctx->lim.gHTOperMode =
-				eSIR_HT_OP_MODE_OVERLAP_LEGACY;
-			lim_enable_ht_rifs_protection(mac_ctx, true,
-				overlap, beaconparams, session_entry);
-		}
-	} else if (LIM_IS_BT_AMP_AP_ROLE(session_entry) && !overlap) {
-		session_entry->gLimHt20Params.protectionEnabled = true;
-		if (eSIR_HT_OP_MODE_PURE == mac_ctx->lim.gHTOperMode) {
-			mac_ctx->lim.gHTOperMode =
-				eSIR_HT_OP_MODE_NO_LEGACY_20MHZ_HT;
-			lim_enable_ht_rifs_protection(mac_ctx, false,
-				overlap, beaconparams, session_entry);
-			lim_enable_ht_obss_protection(mac_ctx, false,
-				overlap, beaconparams, session_entry);
-		}
 	}
 	/* This part is common for staiton as well. */
 	if (false == session_entry->beaconParams.ht20Coexist) {
@@ -4275,60 +3975,7 @@ static void lim_handle_ht20coexist_ht20protection(tpAniSirGlobal mac_ctx,
 		beaconparams->paramChangeBitmap |=
 			PARAM_HT20MHZCOEXIST_CHANGED;
 	}
-	if (LIM_IS_BT_AMP_AP_ROLE(session_entry) && overlap) {
-		/* Overlap Legacy protection disabled. */
-		mac_ctx->lim.gLimOverlapHt20Params.protectionEnabled = false;
-		/*
-		 * no HT op mode change if any of the overlap
-		 * protection enabled.
-		 */
-		if (!(session_entry->gLimOlbcParams.protectionEnabled ||
-			mac_ctx->lim.gLimOverlap11gParams.protectionEnabled ||
-			mac_ctx->lim.gLimOverlapHt20Params.protectionEnabled ||
-			mac_ctx->lim.gLimOverlapNonGfParams.protectionEnabled)
-			/*
-			 * Check if there is a need to change
-			 * HT OP mode.
-			 */
-			&& (eSIR_HT_OP_MODE_OVERLAP_LEGACY ==
-				mac_ctx->lim.gHTOperMode)) {
-			if (session_entry->gLimHt20Params.protectionEnabled) {
-				mac_ctx->lim.gHTOperMode =
-					eSIR_HT_OP_MODE_NO_LEGACY_20MHZ_HT;
-				lim_enable_ht_rifs_protection(mac_ctx, false,
-					overlap, beaconparams, session_entry);
-				lim_enable_ht_obss_protection(mac_ctx, false,
-					overlap, beaconparams, session_entry);
-			} else {
-				mac_ctx->lim.gHTOperMode = eSIR_HT_OP_MODE_PURE;
-			}
-		}
-	} else if (LIM_IS_BT_AMP_AP_ROLE(session_entry) && !overlap) {
-		/* Disable protection from 11G stations. */
-		session_entry->gLimHt20Params.protectionEnabled = false;
-
-		/* Change HT op mode appropriately. */
-		if (eSIR_HT_OP_MODE_NO_LEGACY_20MHZ_HT ==
-				mac_ctx->lim.gHTOperMode) {
-			mac_ctx->lim.gHTOperMode =
-				eSIR_HT_OP_MODE_PURE;
-			lim_enable_ht_rifs_protection(mac_ctx, false,
-				overlap, beaconparams, session_entry);
-			lim_enable_ht_obss_protection(mac_ctx, false,
-				overlap, beaconparams, session_entry);
-		}
-	}
-	if (LIM_IS_BT_AMP_AP_ROLE(session_entry)) {
-		lim_log(mac_ctx, LOG1,
-			FL("===> Protection from HT 20 Disabled"));
-		beaconparams->ht20MhzCoexist =
-			session_entry->beaconParams.ht20Coexist = false;
-		beaconparams->paramChangeBitmap |=
-			PARAM_HT20MHZCOEXIST_CHANGED;
-	}
-
-	if (!LIM_IS_AP_ROLE(session_entry) &&
-			!LIM_IS_BT_AMP_AP_ROLE(session_entry)) {
+	if (!LIM_IS_AP_ROLE(session_entry)) {
 		/* For station role */
 		lim_log(mac_ctx, LOG1,
 			FL("===> Protection from HT20 Disabled"));
@@ -5089,8 +4736,7 @@ lim_validate_delts_req(tpAniSirGlobal mac_ctx, tpSirDeltsReq delts_req,
 		return eSIR_FAILURE;
 	}
 
-	if (LIM_IS_STA_ROLE(psession_entry) ||
-		LIM_IS_BT_AMP_STA_ROLE(psession_entry)) {
+	if (LIM_IS_STA_ROLE(psession_entry)) {
 		uint32_t val;
 
 		/* station always talks to the AP */
@@ -5974,14 +5620,6 @@ void lim_update_beacon(tpAniSirGlobal mac_ctx)
 					is_dfs_cac_timer_running)
 				lim_send_beacon_ind(mac_ctx,
 						&mac_ctx->lim.gpSession[i]);
-		} else if (((mac_ctx->lim.gpSession[i].limSystemRole ==
-						eLIM_BT_AMP_AP_ROLE) ||
-				(mac_ctx->lim.gpSession[i].limSystemRole ==
-						eLIM_BT_AMP_STA_ROLE)) &&
-				(mac_ctx->lim.gpSession[i].statypeForBss ==
-							STA_ENTRY_SELF)){
-			sch_set_fixed_beacon_fields(mac_ctx,
-						&mac_ctx->lim.gpSession[i]);
 		}
 	}
 }
@@ -6075,10 +5713,8 @@ tpPESession lim_is_ap_session_active(tpAniSirGlobal pMac)
 	uint8_t i;
 
 	for (i = 0; i < pMac->lim.maxBssId; i++) {
-		if ((pMac->lim.gpSession[i].valid) &&
-		    ((pMac->lim.gpSession[i].limSystemRole == eLIM_AP_ROLE) ||
-		     (pMac->lim.gpSession[i].limSystemRole ==
-		      eLIM_BT_AMP_AP_ROLE)))
+		if (pMac->lim.gpSession[i].valid &&
+		    (pMac->lim.gpSession[i].limSystemRole == eLIM_AP_ROLE))
 			return &pMac->lim.gpSession[i];
 	}
 
@@ -6532,8 +6168,7 @@ lim_set_protected_bit(tpAniSirGlobal pMac,
 	uint16_t aid;
 	tpDphHashNode pStaDs;
 
-	if (LIM_IS_AP_ROLE(psessionEntry) ||
-	    LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
+	if (LIM_IS_AP_ROLE(psessionEntry)) {
 
 		pStaDs = dph_lookup_hash_entry(pMac, peer, &aid,
 					       &psessionEntry->dph.dphHashTable);
@@ -7085,8 +6720,6 @@ const char *lim_bss_type_to_string(const uint16_t bss_type)
 	CASE_RETURN_STRING(eSIR_INFRASTRUCTURE_MODE);
 	CASE_RETURN_STRING(eSIR_INFRA_AP_MODE);
 	CASE_RETURN_STRING(eSIR_IBSS_MODE);
-	CASE_RETURN_STRING(eSIR_BTAMP_STA_MODE);
-	CASE_RETURN_STRING(eSIR_BTAMP_AP_MODE);
 	CASE_RETURN_STRING(eSIR_AUTO_MODE);
 	default:
 		return "Unknown bss_type";
@@ -7236,3 +6869,45 @@ void lim_update_obss_scanparams(tpPESession session,
 			scan_params->obssScanActivityThreshold;
 	return;
 }
+
+/**
+ * lim_is_robust_mgmt_action_frame() - Check if action category is
+ * robust action frame
+ * @action_category: Action frame category.
+ *
+ * This function is used to check if given action category is robust
+ * action frame.
+ *
+ * Return: bool
+ */
+bool lim_is_robust_mgmt_action_frame(uint8_t action_category)
+{
+	switch (action_category) {
+	/*
+	 * NOTE: This function doesn't take care of the DMG
+	 * (Directional Multi-Gigatbit) BSS case as 8011ad
+	 * support is not yet added. In future, if the support
+	 * is required then this function need few more arguments
+	 * and little change in logic.
+	 */
+	case SIR_MAC_ACTION_SPECTRUM_MGMT:
+	case SIR_MAC_ACTION_QOS_MGMT:
+	case SIR_MAC_ACTION_DLP:
+	case SIR_MAC_ACTION_BLKACK:
+	case SIR_MAC_ACTION_RRM:
+	case SIR_MAC_ACTION_FAST_BSS_TRNST:
+	case SIR_MAC_ACTION_SA_QUERY:
+	case SIR_MAC_ACTION_PROT_DUAL_PUB:
+	case SIR_MAC_ACTION_WNM:
+	case SIR_MAC_ACITON_MESH:
+	case SIR_MAC_ACTION_MHF:
+	case SIR_MAC_ACTION_FST:
+		return true;
+	default:
+		QDF_TRACE(QDF_MODULE_ID_PE, QDF_TRACE_LEVEL_INFO,
+			FL("non-PMF action category[%d] "),
+			action_category);
+		break;
+	}
+	return false;
+}
diff --git a/core/mac/src/pe/lim/lim_utils.h b/core/mac/src/pe/lim/lim_utils.h
index b96e9b87a049..1f0ffbbc23e1 100644
--- a/core/mac/src/pe/lim/lim_utils.h
+++ b/core/mac/src/pe/lim/lim_utils.h
@@ -50,9 +50,6 @@ typedef enum {
 	TWO_BYTE = 2
 } eSizeOfLenField;
 
-#define MIN_TX_PWR_CAP    8
-#define MAX_TX_PWR_CAP    22
-
 #define LIM_STA_ID_MASK                        0x00FF
 #define LIM_AID_MASK                              0xC000
 #define LIM_SPECTRUM_MANAGEMENT_BIT_MASK          0x0100
@@ -406,11 +403,11 @@ void lim_update_beacon(tpAniSirGlobal pMac);
 
 void lim_process_ap_mlm_add_sta_rsp(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,
 		tpPESession psessionEntry);
-void lim_process_bt_amp_ap_mlm_del_bss_rsp(tpAniSirGlobal pMac,
+void lim_process_ap_mlm_del_bss_rsp(tpAniSirGlobal pMac,
 		tpSirMsgQ limMsgQ,
 		tpPESession psessionEntry);
 
-void lim_process_bt_amp_ap_mlm_del_sta_rsp(tpAniSirGlobal pMac,
+void lim_process_ap_mlm_del_sta_rsp(tpAniSirGlobal pMac,
 		tpSirMsgQ limMsgQ,
 		tpPESession psessionEntry);
 
@@ -602,4 +599,5 @@ static inline void lim_deactivate_and_change_timer_host_roam(
 {}
 #endif
 
+bool lim_is_robust_mgmt_action_frame(uint8_t action_category);
 #endif /* __LIM_UTILS_H */
diff --git a/core/mac/src/pe/sch/sch_beacon_gen.c b/core/mac/src/pe/sch/sch_beacon_gen.c
index d8339aa08e3c..3acbb7d18027 100644
--- a/core/mac/src/pe/sch/sch_beacon_gen.c
+++ b/core/mac/src/pe/sch/sch_beacon_gen.c
@@ -953,8 +953,6 @@ void sch_process_pre_beacon_ind(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
 	switch (GET_LIM_SYSTEM_ROLE(psessionEntry)) {
 
 	case eLIM_STA_IN_IBSS_ROLE:
-	case eLIM_BT_AMP_AP_ROLE:
-	case eLIM_BT_AMP_STA_ROLE:
 		/* generate IBSS parameter set */
 		if (psessionEntry->statypeForBss == STA_ENTRY_SELF)
 			write_beacon_to_memory(pMac, (uint16_t) beaconSize,
diff --git a/core/mac/src/pe/sch/sch_beacon_process.c b/core/mac/src/pe/sch/sch_beacon_process.c
index 157ab11ca8da..be5af48c2ce6 100644
--- a/core/mac/src/pe/sch/sch_beacon_process.c
+++ b/core/mac/src/pe/sch/sch_beacon_process.c
@@ -199,7 +199,8 @@ ap_beacon_process_24_ghz(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 	 * 11b because if that's needed then our operating mode would have
 	 * already been set to legacy in the previous blocks.
 	 */
-	if (eSIR_HT_OP_MODE_OVERLAP_LEGACY == bcn_struct->HTInfo.opMode) {
+	if ((eSIR_HT_OP_MODE_OVERLAP_LEGACY == bcn_struct->HTInfo.opMode) &&
+		!mac_ctx->roam.configParam.ignore_peer_ht_opmode) {
 		if (eSIR_HT_OP_MODE_OVERLAP_LEGACY == mac_ctx->lim.gHTOperMode
 		    || eSIR_HT_OP_MODE_MIXED == mac_ctx->lim.gHTOperMode)
 			return;
@@ -338,7 +339,7 @@ tSirMacHTChannelWidth get_operating_channel_width(tpDphHashNode stads)
 }
 
 /*
- * sch_bcn_process_sta_bt_amp_sta() - Process the received beacon frame for sta,
+ * sch_bcn_process_sta() - Process the received beacon frame for sta,
  * bt_amp_sta
  *
  * @mac_ctx:        mac_ctx
@@ -350,12 +351,12 @@ tSirMacHTChannelWidth get_operating_channel_width(tpDphHashNode stads)
  * @sendProbeReq:   out flag to indicate if probe rsp is to be sent
  * @pMh:            mac header
  *
- * Process the received beacon frame for sta, bt_amp_sta
+ * Process the received beacon frame for sta
  *
  * Return: success of failure of operation
  */
 static bool
-sch_bcn_process_sta_bt_amp_sta(tpAniSirGlobal mac_ctx,
+sch_bcn_process_sta(tpAniSirGlobal mac_ctx,
 			       tpSchBeaconStruct bcn,
 			       uint8_t *rx_pkt_info,
 			       tpPESession session, uint8_t *bssIdx,
@@ -367,7 +368,6 @@ sch_bcn_process_sta_bt_amp_sta(tpAniSirGlobal mac_ctx,
 	/*
 	 *  This handles two cases:
 	 *  -- Infra STA receving beacons from AP
-	 *  -- BTAMP_STA receving beacons from BTAMP_AP
 	 */
 	/* Always save the beacon into LIM's cached scan results */
 	lim_check_and_add_bss_description(mac_ctx, bcn, rx_pkt_info,
@@ -500,7 +500,7 @@ void update_nss(tpAniSirGlobal mac_ctx, tpDphHashNode sta_ds,
 }
 
 /*
- * sch_bcn_process_sta_bt_amp_sta_ibss() - Process the received beacon frame
+ * sch_bcn_process_sta_ibss() - Process the received beacon frame
  * for sta, bt_amp_sta and ibss
  *
  * @mac_ctx:        mac_ctx
@@ -512,12 +512,12 @@ void update_nss(tpAniSirGlobal mac_ctx, tpDphHashNode sta_ds,
  * @sendProbeReq:   out flag to indicate if probe rsp is to be sent
  * @pMh:            mac header
  *
- * Process the received beacon frame for sta, bt_amp_sta and ibss
+ * Process the received beacon frame for sta and ibss
  *
  * Return: void
  */
 static void
-sch_bcn_process_sta_bt_amp_sta_ibss(tpAniSirGlobal mac_ctx,
+sch_bcn_process_sta_ibss(tpAniSirGlobal mac_ctx,
 				    tpSchBeaconStruct bcn,
 				    uint8_t *rx_pkt_info,
 				    tpPESession session, uint8_t *bssIdx,
@@ -684,9 +684,7 @@ sch_bcn_process_sta_bt_amp_sta_ibss(tpAniSirGlobal mac_ctx,
  *     - call lim_handle_ibs_scoalescing with that session context.
  *   Infra STA receving beacons from AP to which it is connected
  *     - call sch_beacon_processFromAP with that session's context.
- *   BTAMP STA receving beacons from BTAMP AP
  *     - call sch_beacon_processFromAP with that session's context.
- *   BTAMP AP receiving beacons from BTAMP STA
  *     (here need to make sure BTAP creates session entry for BT STA)
  *     - just update the beacon count for heart beat purposes for now,
  *       for now, don't process the beacon.
@@ -726,9 +724,8 @@ static void __sch_beacon_process_for_session(tpAniSirGlobal mac_ctx,
 
 	if (LIM_IS_IBSS_ROLE(session)) {
 		lim_handle_ibss_coalescing(mac_ctx, bcn, rx_pkt_info, session);
-	} else if (LIM_IS_STA_ROLE(session)
-	    || LIM_IS_BT_AMP_STA_ROLE(session)) {
-		if (false == sch_bcn_process_sta_bt_amp_sta(mac_ctx, bcn,
+	} else if (LIM_IS_STA_ROLE(session)) {
+		if (false == sch_bcn_process_sta(mac_ctx, bcn,
 				rx_pkt_info, session, &bssIdx,
 				&beaconParams, &sendProbeReq, pMh))
 			return;
@@ -739,7 +736,6 @@ static void __sch_beacon_process_for_session(tpAniSirGlobal mac_ctx,
 						&bcn->HTInfo, bssIdx, session);
 
 	if (LIM_IS_STA_ROLE(session)
-	    || LIM_IS_BT_AMP_STA_ROLE(session)
 	    || LIM_IS_IBSS_ROLE(session)) {
 		/* Channel Switch information element updated */
 		if (bcn->channelSwitchPresent) {
@@ -758,9 +754,8 @@ static void __sch_beacon_process_for_session(tpAniSirGlobal mac_ctx,
 		}
 	}
 	if (LIM_IS_STA_ROLE(session)
-	    || LIM_IS_BT_AMP_STA_ROLE(session)
 	    || LIM_IS_IBSS_ROLE(session))
-		sch_bcn_process_sta_bt_amp_sta_ibss(mac_ctx, bcn,
+		sch_bcn_process_sta_ibss(mac_ctx, bcn,
 					rx_pkt_info, session, &bssIdx,
 					&beaconParams, &sendProbeReq, pMh);
 	/* Obtain the Max Tx power for the current regulatory  */
diff --git a/core/mac/src/sys/common/inc/wlan_qct_sys.h b/core/mac/src/sys/common/inc/wlan_qct_sys.h
index 0ebafee064a4..65f6ff5396be 100644
--- a/core/mac/src/sys/common/inc/wlan_qct_sys.h
+++ b/core/mac/src/sys/common/inc/wlan_qct_sys.h
@@ -76,6 +76,7 @@ typedef enum {
 	SYS_MSG_ID_MC_TIMER,
 	SYS_MSG_ID_MC_STOP,
 	SYS_MSG_ID_FTM_RSP,
+	SYS_MSG_ID_QVIT,
 
 } SYS_MSG_ID;
 
diff --git a/core/mac/src/sys/legacy/src/system/src/sys_entry_func.c b/core/mac/src/sys/legacy/src/system/src/sys_entry_func.c
index 057de0544b15..a337ec605c7f 100644
--- a/core/mac/src/sys/legacy/src/system/src/sys_entry_func.c
+++ b/core/mac/src/sys/legacy/src/system/src/sys_entry_func.c
@@ -109,9 +109,6 @@ sys_bbt_process_message_core(tpAniSirGlobal mac_ctx, tpSirMsgQ msg,
 	cds_pkt_t *vos_pkt = (cds_pkt_t *) msg->bodyptr;
 	QDF_STATUS qdf_status =
 		wma_ds_peek_rx_packet_info(vos_pkt, &bd_ptr, false);
-	uint8_t sessionid;
-	tpPESession pe_session;
-	tpSirMacMgmtHdr mac_hdr;
 
 	mac_ctx->sys.gSysBbtReceived++;
 
@@ -130,19 +127,7 @@ sys_bbt_process_message_core(tpAniSirGlobal mac_ctx, tpSirMsgQ msg,
 	framecount = mac_ctx->sys.gSysFrameCount[type][subtype];
 
 	if (type == SIR_MAC_MGMT_FRAME) {
-		if (true == mac_ctx->sap.SapDfsInfo.is_dfs_cac_timer_running) {
-			mac_hdr = WMA_GET_RX_MAC_HEADER(bd_ptr);
-			pe_session = pe_find_session_by_bssid(mac_ctx,
-					mac_hdr->bssId,
-					&sessionid);
-			if (pe_session &&
-				(pe_session->pePersona == QDF_SAP_MODE)) {
-				QDF_TRACE(QDF_MODULE_ID_SYS,
-					QDF_TRACE_LEVEL_INFO_HIGH,
-					FL("CAC timer is running, dropping the mgmt frame"));
-				goto fail;
-			}
-		}
+		tpSirMacMgmtHdr mac_hdr;
 
 		/*
 		 * Drop beacon frames in deferred state to avoid VOSS run out of
@@ -169,27 +154,26 @@ sys_bbt_process_message_core(tpAniSirGlobal mac_ctx, tpSirMsgQ msg,
 			goto fail;
 		}
 
+		mac_hdr = WMA_GET_RX_MAC_HEADER(bd_ptr);
+		if (subtype == SIR_MAC_MGMT_ASSOC_REQ) {
+			sys_log(mac_ctx, LOG1,
+				FL("ASSOC REQ frame allowed: da: " MAC_ADDRESS_STR ", sa: " MAC_ADDRESS_STR ", bssid: " MAC_ADDRESS_STR ", Assoc Req count so far: %d\n"),
+				MAC_ADDR_ARRAY(mac_hdr->da),
+				MAC_ADDR_ARRAY(mac_hdr->sa),
+				MAC_ADDR_ARRAY(mac_hdr->bssId),
+				mac_ctx->sys.gSysFrameCount[type][subtype]);
+		}
 		if (subtype == SIR_MAC_MGMT_DEAUTH) {
-			tpSirMacMgmtHdr mac_hdr = WMA_GET_RX_MAC_HEADER(bd_ptr);
-			sys_log(mac_ctx, LOGE,
-				FL("DEAUTH frame allowed: "
-					"da: " MAC_ADDRESS_STR ", "
-					"sa: " MAC_ADDRESS_STR ", "
-					"bssid: " MAC_ADDRESS_STR ", "
-					"DEAUTH count so far: %d\n"),
+			sys_log(mac_ctx, LOG1,
+				FL("DEAUTH frame allowed: da: " MAC_ADDRESS_STR ", sa: " MAC_ADDRESS_STR ", bssid: " MAC_ADDRESS_STR ", DEAUTH count so far: %d\n"),
 				MAC_ADDR_ARRAY(mac_hdr->da),
 				MAC_ADDR_ARRAY(mac_hdr->sa),
 				MAC_ADDR_ARRAY(mac_hdr->bssId),
 				mac_ctx->sys.gSysFrameCount[type][subtype]);
 		}
 		if (subtype == SIR_MAC_MGMT_DISASSOC) {
-			tpSirMacMgmtHdr mac_hdr = WMA_GET_RX_MAC_HEADER(bd_ptr);
-			sys_log(mac_ctx, LOGE,
-				FL("DISASSOC frame allowed: "
-					"da: " MAC_ADDRESS_STR ", "
-					"sa: " MAC_ADDRESS_STR ", "
-					"bssid: " MAC_ADDRESS_STR ", "
-					"DISASSOC count so far: %d\n"),
+			sys_log(mac_ctx, LOG1,
+				FL("DISASSOC frame allowed: da: " MAC_ADDRESS_STR ", sa: " MAC_ADDRESS_STR ", bssid: " MAC_ADDRESS_STR ", DISASSOC count so far: %d\n"),
 				MAC_ADDR_ARRAY(mac_hdr->da),
 				MAC_ADDR_ARRAY(mac_hdr->sa),
 				MAC_ADDR_ARRAY(mac_hdr->bssId),
diff --git a/core/sap/src/sap_fsm.c b/core/sap/src/sap_fsm.c
index 815415e67101..fbb94a8b3394 100644
--- a/core/sap/src/sap_fsm.c
+++ b/core/sap/src/sap_fsm.c
@@ -939,7 +939,7 @@ sap_find_target_channel_in_channel_matrix(ptSapContext sapContext,
 }
 
 /**
- * sap_mark_channels_leaking_into_nol() - to mark channel leaking in to nol
+ * sap_mark_leaking_ch() - to mark channel leaking in to nol
  * @sap_ctx: pointer to SAP context
  * @ch_width: channel width
  * @nol: nol info
@@ -954,7 +954,7 @@ sap_find_target_channel_in_channel_matrix(ptSapContext sapContext,
  */
 
 QDF_STATUS
-sap_mark_channels_leaking_into_nol(ptSapContext sap_ctx,
+sap_mark_leaking_ch(ptSapContext sap_ctx,
 		enum phy_ch_width ch_width,
 		tSapDfsNolInfo *nol,
 		uint8_t temp_ch_lst_sz,
@@ -994,7 +994,7 @@ sap_mark_channels_leaking_into_nol(ptSapContext sap_ctx,
 		/*
 		 * following is based on assumption that both temp_ch_lst
 		 * and target channel matrix are in increasing order of
-		 * channelID
+		 * ch_id
 		 */
 		for (j = 0, k = 0; j < temp_ch_lst_sz && k < num_channel;) {
 			if (temp_ch_lst[j] == 0) {
@@ -1100,7 +1100,8 @@ static uint8_t sap_populate_available_channels(chan_bonding_bitmap *bitmap,
 				SAP_40MHZ_MASK_L) == SAP_40MHZ_MASK_L) {
 				avail_chnl[chnl_count++] = start_channel;
 				avail_chnl[chnl_count++] = start_channel + 4;
-			} else if ((bitmap->chanBondingSet[i].channelMap &
+			}
+			if ((bitmap->chanBondingSet[i].channelMap &
 				SAP_40MHZ_MASK_H) == SAP_40MHZ_MASK_H) {
 				avail_chnl[chnl_count++] = start_channel + 8;
 				avail_chnl[chnl_count++] = start_channel + 12;
@@ -1227,73 +1228,50 @@ bool sap_check_in_avoid_ch_list(ptSapContext sap_ctx, uint8_t channel)
 }
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
-/*
- * This function randomly pick up an AVAILABLE channel
+/**
+ * sap_apply_rules() - validates channels in sap_ctx channel list
+ * @sap_ctx: sap context pointer
+ *
+ * This function takes the channel list in sap_ctx and marks invalid channel
+ * based on following rules:
+ * -> invalid due to different reg domain dfs channel list
+ * -> already present in NOL
+ * -> outside ACS range or not
+ * -> not usable due to another SAP operating MCC mode in same channel
+ * -> preferred location is indoors or outdoors
+ *
+ * Return: number of valid channels after applying all the rules
  */
-static uint8_t sap_random_channel_sel(ptSapContext sapContext)
+static uint8_t sap_apply_rules(ptSapContext sap_ctx)
 {
-	uint32_t random_byte = 0;
-	uint8_t available_ch_cnt = 0;
-	uint8_t  avail_dfs_chan_count = 0;
-	uint8_t  avail_non_dfs_chan_count = 0;
-	uint8_t valid_chnl_count = 0;
-	uint8_t availableChannels[WNI_CFG_VALID_CHANNEL_LIST_LEN] = { 0, };
-	uint8_t  avail_dfs_chan_list[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0,};
-	uint8_t  avail_non_dfs_chan_list[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0,};
-	uint8_t target_channel = 0;
-	bool isChannelNol = false;
-	bool isOutOfRange = false;
-	chan_bonding_bitmap channelBitmap;
-	uint8_t i = 0;
-	uint8_t channelID;
-	tHalHandle hHal = CDS_GET_HAL_CB(sapContext->p_cds_gctx);
-	tpAniSirGlobal pMac;
-	enum phy_ch_width ch_width;
-	uint8_t   *tmp_ch_lst = NULL;
-	uint8_t   dfs_region;
+	uint8_t num_valid_ch, dfs_region, i = 0, ch_id;
+	tAll5GChannelList *sap_all_ch = &sap_ctx->SapAllChnlList;
+	bool is_ch_nol = false;
+	bool is_out_of_range = false;
+	tpAniSirGlobal mac_ctx;
+	tHalHandle hal = CDS_GET_HAL_CB(sap_ctx->p_cds_gctx);
+	uint8_t preferred_location;
 
-	if (NULL == hHal) {
+	if (NULL == hal) {
 		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
-			  FL("invalid hHal"));
-		return target_channel;
+			  FL("hal pointer NULL"));
+		return 0;
 	}
 
-	pMac = PMAC_STRUCT(hHal);
-	if (NULL == pMac) {
+	mac_ctx = PMAC_STRUCT(hal);
+	if (NULL == mac_ctx) {
 		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
-			  FL("invalid pMac"));
-		return target_channel;
-	}
-
-	/*
-	 * Retrieve the original one and store it.
-	 * use the stored original value when you call this function next time
-	 * so fall back mechanism always starts with original ini value.
-	 */
-	if (pMac->sap.SapDfsInfo.orig_chanWidth == 0) {
-		pMac->sap.SapDfsInfo.orig_chanWidth =
-					sapContext->ch_width_orig;
-		ch_width = pMac->sap.SapDfsInfo.orig_chanWidth;
-	} else {
-		ch_width = pMac->sap.SapDfsInfo.orig_chanWidth;
-	}
-
-	if (sap_get_5ghz_channel_list(sapContext)) {
-		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
-			  FL("Getting 5Ghz channel list failed"));
-		return target_channel;
+			  FL("mac_ctx pointer NULL"));
+		return 0;
 	}
 
+	preferred_location =
+		mac_ctx->sap.SapDfsInfo.sap_operating_chan_preferred_location;
 	cds_get_dfs_region(&dfs_region);
-
-	/*
-	 * valid_chnl_count will be used to find number of valid channels
-	 * after following for loop ends
-	 */
-	valid_chnl_count = sapContext->SapAllChnlList.numChannel;
 	/* loop to check ACS range or NOL channels */
-	for (i = 0; i < sapContext->SapAllChnlList.numChannel; i++) {
-		channelID = sapContext->SapAllChnlList.channelList[i].channel;
+	num_valid_ch = sap_all_ch->numChannel;
+	for (i = 0; i < sap_all_ch->numChannel; i++) {
+		ch_id = sap_all_ch->channelList[i].channel;
 
 		/*
 		 * IN MKK DFS REGION CHECK IF THE FOLLOWING TWO
@@ -1316,15 +1294,13 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 			/*
 			 * Check for JAPAN W53 Channel operation capability
 			 */
-			if (true == sap_dfs_is_w53_invalid(hHal, channelID)) {
+			if (true == sap_dfs_is_w53_invalid(hal, ch_id)) {
 				QDF_TRACE(QDF_MODULE_ID_SAP,
 					  QDF_TRACE_LEVEL_INFO_LOW,
-					  FL
-					  ("index:%d, Channel=%d Invalid,Japan W53 Disabled"),
-					  i, channelID);
-				sapContext->SapAllChnlList.channelList[i].
-					valid = false;
-				valid_chnl_count--;
+					  FL("index:%d, Channel=%d Invalid,Japan W53 Disabled"),
+					  i, ch_id);
+				sap_all_ch->channelList[i].valid = false;
+				num_valid_ch--;
 				continue;
 			}
 
@@ -1336,384 +1312,428 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 			 * domain to Invalid.
 			 */
 			if (false ==
-			    sap_dfs_is_channel_in_preferred_location(hHal,
-								channelID)) {
+			    sap_dfs_is_channel_in_preferred_location(hal,
+								ch_id)) {
 				QDF_TRACE(QDF_MODULE_ID_SAP,
 					  QDF_TRACE_LEVEL_INFO_LOW,
-					  FL
-					  ("CHAN=%d is invalid,preferred Channel Location %d Only"),
-					  channelID,
-					  pMac->sap.SapDfsInfo.
-					  sap_operating_chan_preferred_location);
-				sapContext->SapAllChnlList.channelList[i].
-					valid = false;
-				valid_chnl_count--;
+					  FL("CHAN=%d is invalid,preferred Channel Location %d Only"),
+					  ch_id, preferred_location);
+				sap_all_ch->channelList[i].valid = false;
+				num_valid_ch--;
 				continue;
 			}
 		}
 
-		if (cds_get_channel_state(channelID) ==
-		    CHANNEL_STATE_DFS) {
-			isChannelNol =
-				sap_dfs_is_channel_in_nol_list(sapContext,
-						channelID,
-						PHY_SINGLE_CHANNEL_CENTERED);
-			if (true == isChannelNol) {
+		if (cds_get_channel_state(ch_id) == CHANNEL_STATE_DFS) {
+			is_ch_nol = sap_dfs_is_channel_in_nol_list(sap_ctx,
+					ch_id, PHY_SINGLE_CHANNEL_CENTERED);
+			if (true == is_ch_nol) {
 				/*
 				 * Mark this channel invalid since it is still
 				 * in DFS Non-Occupancy-Period which is 30 mins.
 				 */
 				QDF_TRACE(QDF_MODULE_ID_SAP,
 					  QDF_TRACE_LEVEL_INFO_LOW,
-					  FL
-					  ("index: %d, Channel = %d Present in NOL LIST"),
-					  i, channelID);
-				sapContext->SapAllChnlList.channelList[i].
-					valid = false;
-				valid_chnl_count--;
+					  FL("index: %d, Channel = %d Present in NOL LIST"),
+					  i, ch_id);
+				sap_all_ch->channelList[i].valid = false;
+				num_valid_ch--;
 				continue;
 			}
 		}
 
 #ifdef FEATURE_AP_MCC_CH_AVOIDANCE
 		/* avoid ch on which another MDM AP in MCC mode is detected */
-		if (pMac->sap.sap_channel_avoidance
-		    && sapContext->sap_detected_avoid_ch_ie.present) {
-			if (sap_check_in_avoid_ch_list(sapContext, channelID)) {
+		if (mac_ctx->sap.sap_channel_avoidance
+		    && sap_ctx->sap_detected_avoid_ch_ie.present) {
+			if (sap_check_in_avoid_ch_list(sap_ctx, ch_id)) {
 				QDF_TRACE(QDF_MODULE_ID_SAP,
 					  QDF_TRACE_LEVEL_INFO_LOW,
 					  FL("index: %d, Channel = %d, avoided due to presence of another AP+AP MCC device in same channel."),
-					  i, channelID);
-				sapContext->SapAllChnlList.channelList[i].
-					valid = false;
+					  i, ch_id);
+				sap_all_ch->channelList[i].valid = false;
 			}
 		}
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
 		/* check if the channel is within ACS channel range */
-		isOutOfRange = sap_acs_channel_check(sapContext, channelID);
-		if (true == isOutOfRange) {
+		is_out_of_range = sap_acs_channel_check(sap_ctx, ch_id);
+		if (true == is_out_of_range) {
 			/*
 			 * mark this channel invalid since it is out of ACS
 			 * channel range
 			 */
 			QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
-				  FL
-				  ("index: %d, Channel = %d out of ACS channel range"),
-				  i, channelID);
-			sapContext->SapAllChnlList.channelList[i].valid = false;
-			valid_chnl_count--;
+				  FL("index: %d, Channel = %d out of ACS channel range"),
+				  i, ch_id);
+			sap_all_ch->channelList[i].valid = false;
+			num_valid_ch--;
 			continue;
 		}
 	} /* end of check for NOL or ACS channels */
+	return num_valid_ch;
+}
 
-	/* valid_chnl_count now have number of valid channels */
-	tmp_ch_lst = qdf_mem_malloc(valid_chnl_count);
-	if (tmp_ch_lst == NULL) {
-		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
-				  FL("sapdfs: memory alloc failed"));
-		return target_channel;
+/**
+ * select_rand_from_lst() - selects random channel from given list
+ * @mac_ctx: mac context pointer
+ * @ch_lst: channel list
+ * @num_ch: number of channels
+ *
+ * Return: new target channel randomly selected
+ */
+static uint8_t select_rand_from_lst(tpAniSirGlobal mac_ctx, uint8_t *ch_lst,
+				    uint8_t num_ch)
+{
+	uint32_t rand_byte = 0;
+	uint8_t i, target_channel, non_dfs_num_ch = 0, dfs_num_ch = 0;
+	uint8_t dfs_ch[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+	uint8_t non_dfs_ch[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+	if (num_ch) {
+		for (i = 0; i < num_ch; i++) {
+			if (CDS_IS_DFS_CH(ch_lst[i]))
+				dfs_ch[dfs_num_ch++] = ch_lst[i];
+			else
+				non_dfs_ch[non_dfs_num_ch++] = ch_lst[i];
+		}
+	} else {
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
+			  FL("No target channel found"));
+		return 0;
 	}
 
-	do {
-		uint8_t   j = 0;
-#ifdef WLAN_ENABLE_CHNL_MATRIX_RESTRICTION
-		tSapDfsNolInfo *nol = pMac->sap.SapDfsInfo.sapDfsChannelNolList;
-#endif
+	cds_rand_get_bytes(0, (uint8_t *)&rand_byte, 1);
 
-		/* prepare temp list of just the valid channels */
-		for (i = 0; i < sapContext->SapAllChnlList.numChannel; i++) {
-			if (sapContext->SapAllChnlList.channelList[i].valid) {
-				QDF_TRACE(QDF_MODULE_ID_SAP,
-					  QDF_TRACE_LEVEL_ERROR,
-					  FL
-					  ("sapdfs: Adding Channel = %d to temp List"),
-					  sapContext->SapAllChnlList.
-						channelList[i].channel);
-				tmp_ch_lst[j++] = sapContext->SapAllChnlList.
-							channelList[i].channel;
-			}
-		}
+	/* Give preference to non-DFS channel */
+	if (!mac_ctx->f_prefer_non_dfs_on_radar) {
+		i = (rand_byte + qdf_mc_timer_get_system_ticks()) % num_ch;
+		target_channel = ch_lst[i];
+	} else if (non_dfs_num_ch) {
+		i = (rand_byte + qdf_mc_timer_get_system_ticks()) %
+							non_dfs_num_ch;
+		target_channel = non_dfs_ch[i];
+	} else {
+		i = (rand_byte + qdf_mc_timer_get_system_ticks()) % dfs_num_ch;
+		target_channel = dfs_ch[i];
+	}
 
-#ifdef WLAN_ENABLE_CHNL_MATRIX_RESTRICTION
-		QDF_TRACE(QDF_MODULE_ID_SAP,
-			  QDF_TRACE_LEVEL_ERROR,
-			  FL
-			  ("sapdfs: Processing temp channel list against NOL.")
-			  );
-		if (QDF_STATUS_SUCCESS !=
-			sap_mark_channels_leaking_into_nol(sapContext,
-							   ch_width,
-							   nol,
-							   valid_chnl_count,
-							   tmp_ch_lst)) {
-			qdf_mem_free(tmp_ch_lst);
-			return target_channel;
-		}
-#endif
-		qdf_mem_zero(availableChannels, sizeof(availableChannels));
-		qdf_mem_zero(&channelBitmap, sizeof(channelBitmap));
-		channelBitmap.chanBondingSet[0].startChannel = 36;
-		channelBitmap.chanBondingSet[1].startChannel = 52;
-		channelBitmap.chanBondingSet[2].startChannel = 100;
-		channelBitmap.chanBondingSet[3].startChannel = 116;
-		channelBitmap.chanBondingSet[3].startChannel = 132;
-		channelBitmap.chanBondingSet[4].startChannel = 149;
-		/* now loop through whatever is left of channel list */
-		QDF_TRACE(QDF_MODULE_ID_SAP,
-			  QDF_TRACE_LEVEL_ERROR,
-			  FL("sapdfs: Moving temp channel list to final."));
-		for (i = 0; i < valid_chnl_count; i++) {
-			/*
-			 * add channel from temp channel list to bitmap or fianl
-			 * channel list (in case of 20MHz width)
-			 */
-			if (tmp_ch_lst[i] != 0) {
-				QDF_TRACE(QDF_MODULE_ID_SAP,
-					  QDF_TRACE_LEVEL_DEBUG,
-					  FL("sapdfs: processing channel: %d "),
-					  tmp_ch_lst[i]);
-				/*
-				 * for 20MHz, directly create available
-				 * channel list
-				 */
-				if (ch_width == CH_WIDTH_20MHZ) {
-					QDF_TRACE(QDF_MODULE_ID_SAP,
-						  QDF_TRACE_LEVEL_DEBUG,
-						  FL
-						  ("sapdfs: Channel=%d added to available list"),
-						  tmp_ch_lst[i]);
-					availableChannels[available_ch_cnt++] =
-						tmp_ch_lst[i];
-				} else {
-					QDF_TRACE(QDF_MODULE_ID_SAP,
-						  QDF_TRACE_LEVEL_DEBUG,
-						  FL("sapdfs: Channel=%d added to bitmap"),
-						  tmp_ch_lst[i]);
-					sap_set_bitmap(&channelBitmap,
-						       tmp_ch_lst[i]);
-				}
-			}
+	QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
+		  FL("sapdfs: New Channel width = %d"),
+		  mac_ctx->sap.SapDfsInfo.new_chanWidth);
+	QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
+		  FL("sapdfs: target_channel = %d"), target_channel);
+
+	return target_channel;
+}
+
+/**
+ * sap_find_ch_wh_fallback() - find given channel width from given list of
+ * channels
+ * @mac_ctx: mac context pointer
+ * @ch_wd: channel width to find
+ * @ch_lst: list of channels
+ * @num_ch: number of channels
+ *
+ * This function tries to find given channel width and returns new target ch.
+ * If not found updates ch_wd to next lower channel width.
+ *
+ * Return: new target channel if successful, 0 otherwise
+ */
+static uint8_t sap_find_ch_wh_fallback(tpAniSirGlobal mac_ctx,
+				       enum phy_ch_width *ch_wd,
+				       uint8_t *ch_lst,
+				       uint8_t num_ch)
+{
+	bool flag = false;
+	uint32_t rand_byte = 0;
+	chan_bonding_bitmap ch_map = { { {0} } };
+	uint8_t count = 0, i, index = 0, final_cnt = 0, target_channel = 0;
+	uint8_t primary_seg_start_ch = 0, sec_seg_ch = 0, new_160_start_ch = 0;
+	uint8_t final_lst[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+
+	/* initialize ch_map for all 80 MHz bands: we have 6 80MHz bands */
+	ch_map.chanBondingSet[0].startChannel = 36;
+	ch_map.chanBondingSet[1].startChannel = 52;
+	ch_map.chanBondingSet[2].startChannel = 100;
+	ch_map.chanBondingSet[3].startChannel = 116;
+	ch_map.chanBondingSet[4].startChannel = 132;
+	ch_map.chanBondingSet[5].startChannel = 149;
+
+	/* now loop through leakage free list */
+	for (i = 0; i < num_ch; i++) {
+		/* add tmp ch to bitmap */
+		if (ch_lst[i] == 0)
+			continue;
+
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_DEBUG,
+			  FL("sapdfs: Channel=%d added to bitmap"),
+			  ch_lst[i]);
+		sap_set_bitmap(&ch_map, ch_lst[i]);
+	}
+
+	/* populate available channel list from bitmap */
+	final_cnt = sap_populate_available_channels(&ch_map, *ch_wd, final_lst);
+	/* If no valid ch bonding found, fallback */
+	if (final_cnt == 0) {
+		if ((*ch_wd == CH_WIDTH_160MHZ) ||
+			(*ch_wd == CH_WIDTH_80P80MHZ) ||
+			(*ch_wd == CH_WIDTH_80MHZ)) {
+			QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_WARN,
+				  FL("sapdfs:Changing chanWidth from [%d] to 40Mhz"),
+				  *ch_wd);
+			*ch_wd = CH_WIDTH_40MHZ;
+		} else if (*ch_wd == CH_WIDTH_40MHZ) {
+			QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_WARN,
+				  FL("sapdfs:No 40MHz cb found, falling to 20MHz"));
+			QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_WARN,
+				  FL("sapdfs:Changing chanWidth from [%d] to [%d]"),
+				  *ch_wd, CH_WIDTH_20MHZ);
+			*ch_wd = CH_WIDTH_20MHZ;
 		}
+		return 0;
+	}
 
+	/* ch count should be > 8 to switch new channel in 160Mhz band */
+	if (((*ch_wd == CH_WIDTH_160MHZ) || (*ch_wd == CH_WIDTH_80P80MHZ)) &&
+			(final_cnt < SIR_DFS_MAX_20M_SUB_CH)) {
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_WARN,
+			FL("sapdfs:Changing chanWidth from [%d] to [%d]"),
+			*ch_wd, CH_WIDTH_80MHZ);
+		*ch_wd = CH_WIDTH_80MHZ;
+		return 0;
+	}
+	if (*ch_wd == CH_WIDTH_160MHZ) {
 		/*
-		 * if 40 MHz or 80 MHz, populate available
-		 * channel list from bitmap
+		 * NA supports only 2 blocks for 160Mhz bandwidth i.e 36-64 &
+		 * 100-128 and all the channels in these blocks are continuous
+		 * and seperated by 4Mhz.
 		 */
-		if (ch_width != CH_WIDTH_20MHZ) {
-			bool flag = false;
-			uint8_t count = 0, new_160_startchannel = 0;
-			uint8_t index = 0, sec_seg_ch = 0;
-			uint8_t primary_seg_start_ch = 0;
-			available_ch_cnt =
-				sap_populate_available_channels(&channelBitmap,
-							ch_width,
-							availableChannels);
-
-			/*
-			 * If no valid channel bonding found,
-			 * fallback to lower bandwidth
-			 */
-			if (available_ch_cnt == 0) {
-				if ((ch_width == CH_WIDTH_160MHZ) ||
-					(ch_width == CH_WIDTH_80P80MHZ) ||
-					(ch_width == CH_WIDTH_80MHZ)) {
-					QDF_TRACE(QDF_MODULE_ID_SAP,
-						  QDF_TRACE_LEVEL_WARN,
-						  FL("sapdfs:Changing chanWidth from [%d] to 40Mhz"),
-						  ch_width);
-					ch_width = CH_WIDTH_40MHZ;
-					continue;
-				} else if (ch_width == CH_WIDTH_40MHZ) {
-					QDF_TRACE(QDF_MODULE_ID_SAP,
-						  QDF_TRACE_LEVEL_WARN,
-						  FL
-						  ("sapdfs:No 40MHz cb found, falling to 20MHz"));
-					QDF_TRACE(QDF_MODULE_ID_SAP,
-						  QDF_TRACE_LEVEL_WARN,
-						  FL
-						  ("sapdfs:Changing chanWidth from [%d] to [%d]"),
-						  ch_width,
-						  CH_WIDTH_20MHZ);
-					ch_width = CH_WIDTH_20MHZ;
-					/* continue to start of do loop */
-					continue;
-				}
+		for (i = 1; ((i < final_cnt)); i++) {
+			if ((final_lst[i] - final_lst[i-1]) == 4)
+				count++;
+			else
+				count = 0;
+			if (count == SIR_DFS_MAX_20M_SUB_CH - 1) {
+				flag = true;
+				new_160_start_ch = final_lst[i-7];
+				break;
 			}
+		}
+	} else if (*ch_wd == CH_WIDTH_80P80MHZ) {
+		flag = true;
+	}
+	if ((flag == false) && (*ch_wd > CH_WIDTH_80MHZ)) {
+		*ch_wd = CH_WIDTH_80MHZ;
+		return 0;
+	}
 
-			/*
-			 * Number of channel count should be more than 8 to
-			 * switch new channel in 160Mhz band
-			 */
-			if (((ch_width == CH_WIDTH_160MHZ) ||
-				(ch_width == CH_WIDTH_80P80MHZ)) &&
-				(available_ch_cnt < SIR_DFS_MAX_20M_SUB_CH)) {
-				QDF_TRACE(QDF_MODULE_ID_SAP,
-					QDF_TRACE_LEVEL_WARN,
-					FL("sapdfs:Changing chanWidth from [%d] to [%d]"),
-					ch_width, CH_WIDTH_80MHZ);
-				ch_width = CH_WIDTH_80MHZ;
-				continue;
-			}
-			if (ch_width == CH_WIDTH_160MHZ) {
-				/*
-				 * NA supports only 2 blocks for 160Mhz
-				 * bandwidth i.e 36-64 & 100-128 and
-				 * all the channels in these blocks are
-				 * continuous and seperated by 4Mhz.
-				 */
-				for (i = 1; ((i < available_ch_cnt)); i++) {
-					if ((availableChannels[i] -
-						availableChannels[i-1]) == 4)
-						count++;
-					else
-						count = 0;
-					if (count ==
-						SIR_DFS_MAX_20M_SUB_CH - 1) {
-						flag = true;
-						new_160_startchannel =
-							availableChannels[i-7];
-						break;
-					}
-				}
-			} else if (ch_width == CH_WIDTH_80P80MHZ) {
-					flag = true;
-			}
-			if ((flag == false) && (ch_width > CH_WIDTH_80MHZ)) {
-				ch_width = CH_WIDTH_80MHZ;
-				continue;
+	if (*ch_wd == CH_WIDTH_160MHZ) {
+		cds_rand_get_bytes(0, (uint8_t *)&rand_byte, 1);
+		rand_byte = (rand_byte + qdf_mc_timer_get_system_ticks())
+				% SIR_DFS_MAX_20M_SUB_CH;
+		target_channel = new_160_start_ch + (rand_byte * 4);
+	} else if (*ch_wd == CH_WIDTH_80P80MHZ) {
+		cds_rand_get_bytes(0, (uint8_t *)&rand_byte, 1);
+		index = (rand_byte + qdf_mc_timer_get_system_ticks()) %
+			final_cnt;
+		target_channel = final_lst[index];
+		index -= (index % 4);
+		primary_seg_start_ch = final_lst[index];
+
+		/* reset channels associate with primary 80Mhz */
+		for (i = 0; i < 4; i++)
+			final_lst[i + index] = 0;
+		/* select and calculate center freq for secondary segement */
+		for (i = 0; i < final_cnt / 4; i++) {
+			if (final_lst[i * 4] &&
+			    (abs(primary_seg_start_ch - final_lst[i * 4]) >
+				(SIR_DFS_MAX_20M_SUB_CH * 2))) {
+				sec_seg_ch = final_lst[i * 4] +
+				SIR_80MHZ_START_CENTER_CH_DIFF;
+				break;
 			}
+		}
+		if (!sec_seg_ch && (final_cnt == SIR_DFS_MAX_20M_SUB_CH))
+			*ch_wd = CH_WIDTH_160MHZ;
+		else if (!sec_seg_ch)
+			*ch_wd = CH_WIDTH_80MHZ;
 
-			if (ch_width == CH_WIDTH_160MHZ) {
-				cds_rand_get_bytes(0, (uint8_t *)&random_byte,
-						   1);
-				random_byte = (random_byte +
-						qdf_mc_timer_get_system_ticks())
-						% SIR_DFS_MAX_20M_SUB_CH;
-				pMac->sap.SapDfsInfo.new_chanWidth = ch_width;
-				target_channel = new_160_startchannel +
-							(random_byte * 4);
-				QDF_TRACE(QDF_MODULE_ID_SAP,
-					QDF_TRACE_LEVEL_INFO_LOW,
-					FL("sapdfs: New Channel width = %d"),
-					pMac->sap.SapDfsInfo.new_chanWidth);
-				QDF_TRACE(QDF_MODULE_ID_SAP,
-					QDF_TRACE_LEVEL_INFO_LOW,
-					FL("sapdfs: target_channel = %d"),
-					target_channel);
-
-				qdf_mem_free(tmp_ch_lst);
-				return target_channel;
-			} else if (ch_width == CH_WIDTH_80P80MHZ) {
-				cds_rand_get_bytes(0,
-						(uint8_t *)&random_byte, 1);
-				index = (random_byte +
-					qdf_mc_timer_get_system_ticks()) %
-					available_ch_cnt;
-				target_channel = availableChannels[index];
-				index -= (index % 4);
-				primary_seg_start_ch = availableChannels[index];
-
-				/* reset channels associate with primary 80Mhz */
-				for (i = 0; i < 4; i++)
-					availableChannels[i + index] = 0;
-				/*
-				 * select and calculate center frequency for
-				 * secondary segement
-				 */
-				for (i = 0; i < available_ch_cnt / 4; i++) {
-					if (availableChannels[i * 4] &&
-					    (abs(primary_seg_start_ch -
-						 availableChannels[i * 4]) >
-						(SIR_DFS_MAX_20M_SUB_CH * 2))) {
-
-						sec_seg_ch =
-						  availableChannels[i * 4] +
-						SIR_80MHZ_START_CENTER_CH_DIFF;
-
-						break;
-					}
-				}
-				if (!sec_seg_ch &&
-					(available_ch_cnt ==
-						SIR_DFS_MAX_20M_SUB_CH))
-					ch_width = CH_WIDTH_160MHZ;
-				else if (!sec_seg_ch)
-					ch_width = CH_WIDTH_80MHZ;
+		mac_ctx->sap.SapDfsInfo.new_ch_params.center_freq_seg1
+								= sec_seg_ch;
 
-				pMac->sap.SapDfsInfo.new_ch_params.center_freq_seg1
-						= sec_seg_ch;
-				pMac->sap.SapDfsInfo.new_chanWidth = ch_width;
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
+			FL("sapdfs: New Center Freq Seg1 = %d"), sec_seg_ch);
+	} else {
+		target_channel = select_rand_from_lst(mac_ctx, final_lst,
+						      final_cnt);
+	}
+	return target_channel;
+}
 
-				QDF_TRACE(QDF_MODULE_ID_SAP,
-					QDF_TRACE_LEVEL_INFO_LOW,
-					FL("sapdfs: New Channel width = %d"),
-					pMac->sap.SapDfsInfo.new_chanWidth);
-				QDF_TRACE(QDF_MODULE_ID_SAP,
-					QDF_TRACE_LEVEL_INFO_LOW,
-					FL("sapdfs: New Center Freq Seg1 = %d"),
-					sec_seg_ch);
-				QDF_TRACE(QDF_MODULE_ID_SAP,
-					QDF_TRACE_LEVEL_INFO_LOW,
-					FL("sapdfs: target_channel = %d"),
-					target_channel);
+/**
+ * sap_random_channel_sel() - This function randomly pick up an available
+ * channel
+ * @sap_ctx:        sap context.
+ *
+ * This function first eliminates invalid channel, then selects random channel
+ * using following algorithm:
+ * PASS: 1 - invalidate ch in sap_ctx->all_ch_lst as per rules
+ * PASS: 2 - now mark channels that will leak into NOL
+ * PASS: 3 - from leakage_adjusted_lst, either select random channel (for 20MHz)
+ *           or find given channel width possible. if not found fallback to
+ *           lower channel width and try again. once given channel width found
+ *           use random channel from give possibilities.
+ * Return: channel number picked
+ */
+static uint8_t sap_random_channel_sel(ptSapContext sap_ctx)
+{
+	uint8_t j = 0, i = 0, final_cnt = 0, target_channel = 0;
+	/* count and ch list after applying all rules */
+	uint8_t rule_adjusted_cnt, *rule_adjusted_lst;
+	/* ch list after invalidating channels leaking into NOL */
+	uint8_t *leakage_adjusted_lst;
+	/* final list of channel from which random channel will be selected */
+	uint8_t final_lst[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+	tAll5GChannelList *all_ch = &sap_ctx->SapAllChnlList;
+	tHalHandle hal = CDS_GET_HAL_CB(sap_ctx->p_cds_gctx);
+	tpAniSirGlobal mac_ctx;
+	/* channel width for current iteration */
+	enum phy_ch_width ch_wd;
+#ifdef WLAN_ENABLE_CHNL_MATRIX_RESTRICTION
+	tSapDfsNolInfo *nol;
+#endif
 
-				qdf_mem_free(tmp_ch_lst);
+	if (NULL == hal) {
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
+			  FL("invalid hal"));
+		return 0;
+	}
 
-				return target_channel;
-			}
+	mac_ctx = PMAC_STRUCT(hal);
+	if (NULL == mac_ctx) {
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
+			  FL("invalid mac_ctx"));
+		return 0;
+	}
+
+	/*
+	 * Retrieve the original one and store it.
+	 * use the stored original value when you call this function next time
+	 * so fall back mechanism always starts with original ini value.
+	 */
+	if (mac_ctx->sap.SapDfsInfo.orig_chanWidth == 0) {
+		ch_wd = sap_ctx->ch_width_orig;
+		mac_ctx->sap.SapDfsInfo.orig_chanWidth = ch_wd;
+	} else {
+		ch_wd = mac_ctx->sap.SapDfsInfo.orig_chanWidth;
+	}
+
+	if (sap_get_5ghz_channel_list(sap_ctx)) {
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
+			  FL("Getting 5Ghz channel list failed"));
+		return 0;
+	}
+
+	/* PASS: 1 - invalidate ch in sap_ctx->all_ch_lst as per rules */
+	rule_adjusted_cnt = sap_apply_rules(sap_ctx);
+	if (0 == rule_adjusted_cnt) {
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
+			  FL("No channels left after applying rules."));
+		return 0;
+	}
+
+	/* this is list we get after applying all rules */
+	rule_adjusted_lst = qdf_mem_malloc(rule_adjusted_cnt);
+
+	/* list adjusted after leakage has been marked */
+	leakage_adjusted_lst = qdf_mem_malloc(rule_adjusted_cnt);
+	if (rule_adjusted_lst == NULL || leakage_adjusted_lst == NULL) {
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
+				  FL("sapdfs: memory alloc failed"));
+		qdf_mem_free(rule_adjusted_lst);
+		qdf_mem_free(leakage_adjusted_lst);
+		return 0;
+	}
+
+	/* copy valid ch from sap_ctx->all_ch_lst into rule_adjusted_lst */
+	for (i = 0, j = 0; i < all_ch->numChannel; i++) {
+		if (!all_ch->channelList[i].valid)
+			continue;
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
+			  FL("sapdfs: Adding Channel = %d to temp List"),
+			  all_ch->channelList[i].channel);
+		rule_adjusted_lst[j++] = all_ch->channelList[i].channel;
+	}
+
+	/*
+	 * do - while loop for fallback mechanism. at each channel width this
+	 * will try to find channel bonding, if not fall back to lower ch width
+	 */
+	do {
+		/* save rules adjusted lst */
+		qdf_mem_copy(leakage_adjusted_lst, rule_adjusted_lst,
+			     rule_adjusted_cnt);
+#ifdef WLAN_ENABLE_CHNL_MATRIX_RESTRICTION
+		nol = mac_ctx->sap.SapDfsInfo.sapDfsChannelNolList;
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
+			  FL("sapdfs: Processing tmp ch list against NOL."));
+		/* PASS: 2 - now mark channels that will leak into NOL */
+		if (sap_mark_leaking_ch(sap_ctx, ch_wd, nol, rule_adjusted_cnt,
+				leakage_adjusted_lst) != QDF_STATUS_SUCCESS) {
+			qdf_mem_free(rule_adjusted_lst);
+			qdf_mem_free(leakage_adjusted_lst);
+			return 0;
+		}
+#endif
+		if (ch_wd == CH_WIDTH_20MHZ) {
 			/*
-			 * by now, available channels list will be populated or
-			 * no channels are avaialbe
+			 * PASS: 3 - from leakage_adjusted_lst, prepare valid
+			 * ch list and use random number from that
 			 */
-			if (available_ch_cnt) {
-				for (i = 0; i < available_ch_cnt; i++) {
-					if (CDS_IS_DFS_CH(availableChannels[i])) {
-						avail_dfs_chan_list[
-							avail_dfs_chan_count++] =
-								availableChannels[i];
-					} else {
-						avail_non_dfs_chan_list[
-							avail_non_dfs_chan_count++] =
-								availableChannels[i];
-					}
-				}
-			} else {
+			for (i = 0; i < rule_adjusted_cnt; i++) {
+				if (leakage_adjusted_lst[i] == 0)
+					continue;
 				QDF_TRACE(QDF_MODULE_ID_SAP,
-						QDF_TRACE_LEVEL_INFO_LOW,
-						FL("No target channel found"));
-			}
-
-			cds_rand_get_bytes(0, (uint8_t *)&random_byte, 1);
-
-			/* Give preference to non-DFS channel */
-			if (!pMac->f_prefer_non_dfs_on_radar) {
-				i = (random_byte + qdf_mc_timer_get_system_ticks()) %
-					available_ch_cnt;
-				target_channel = availableChannels[i];
-			} else if (avail_non_dfs_chan_count) {
-				i = (random_byte + qdf_mc_timer_get_system_ticks()) %
-					avail_non_dfs_chan_count;
-				target_channel = avail_non_dfs_chan_list[i];
-			} else {
-				i = (random_byte + qdf_mc_timer_get_system_ticks()) %
-					avail_dfs_chan_count;
-				target_channel = avail_dfs_chan_list[i];
+					  QDF_TRACE_LEVEL_DEBUG,
+					  FL("sapdfs: Channel=%d added to available list"),
+					  leakage_adjusted_lst[i]);
+				final_lst[final_cnt] = leakage_adjusted_lst[i];
+				final_cnt++;
 			}
+			target_channel = select_rand_from_lst(mac_ctx,
+							final_lst, final_cnt);
+			break;
 		}
-		pMac->sap.SapDfsInfo.new_chanWidth = ch_width;
-		QDF_TRACE(QDF_MODULE_ID_SAP,
-				QDF_TRACE_LEVEL_INFO_LOW,
-				FL("sapdfs: New Channel width = %d"),
-				pMac->sap.SapDfsInfo.new_chanWidth);
-		QDF_TRACE(QDF_MODULE_ID_SAP,
-				QDF_TRACE_LEVEL_INFO_LOW,
-				FL("sapdfs: target_channel = %d"),
-				target_channel);
-		break;
-	/* this loop will iterate at max 3 times */
-	} while (1);
-	qdf_mem_free(tmp_ch_lst);
+
+		/*
+		 * PASS: 3 - following function will check from valid channels
+		 * left if given ch_wd can be supported. if not reduce ch_wd
+		 * (fallback), then continue with reduced ch_wd
+		 */
+		target_channel = sap_find_ch_wh_fallback(mac_ctx, &ch_wd,
+							   leakage_adjusted_lst,
+							   rule_adjusted_cnt);
+		/*
+		 * if target channel is 0, no channel bonding was found
+		 * ch_wd would have been updated for fallback
+		 */
+		if (0 == target_channel)
+			continue;
+		else
+			break;
+	} while (true);
+
+	if (target_channel)
+		mac_ctx->sap.SapDfsInfo.new_chanWidth = ch_wd;
+
+	qdf_mem_free(rule_adjusted_lst);
+	qdf_mem_free(leakage_adjusted_lst);
+	QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
+		FL("sapdfs: New Channel width = %d"),
+		mac_ctx->sap.SapDfsInfo.new_chanWidth);
+	QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_LOW,
+		FL("sapdfs: target_channel = %d"),
+		target_channel);
 	return target_channel;
 }
 
@@ -3329,7 +3349,7 @@ static QDF_STATUS sap_fsm_state_ch_select(ptSapContext sap_ctx,
 		temp_chan = sap_ctx->channel;
 		p_nol = mac_ctx->sap.SapDfsInfo.sapDfsChannelNolList;
 
-		sap_mark_channels_leaking_into_nol(sap_ctx,
+		sap_mark_leaking_ch(sap_ctx,
 			cbmode, p_nol, 1, &temp_chan);
 
 		/*
diff --git a/core/sme/inc/csr_api.h b/core/sme/inc/csr_api.h
index 8a05500d717d..ae0c98749e4f 100644
--- a/core/sme/inc/csr_api.h
+++ b/core/sme/inc/csr_api.h
@@ -142,7 +142,6 @@ typedef enum {
 } eCsrPhyMode;
 
 typedef enum {
-	eCSR_BSS_TYPE_NONE,
 	eCSR_BSS_TYPE_INFRASTRUCTURE,
 	eCSR_BSS_TYPE_INFRA_AP,   /* SoftAP AP */
 	eCSR_BSS_TYPE_IBSS,       /* IBSS network we'll NOT start */
@@ -494,6 +493,8 @@ typedef enum {
 	eCSR_ROAM_DFS_CHAN_SW_NOTIFY,
 	eCSR_ROAM_EXT_CHG_CHNL_IND,
 	eCSR_ROAM_STATUS_UPDATE_HW_MODE,
+	eCSR_ROAM_DISABLE_QUEUES,
+	eCSR_ROAM_ENABLE_QUEUES,
 } eRoamCmdStatus;
 
 /* comment inside indicates what roaming callback gets */
@@ -1220,6 +1221,7 @@ typedef struct tagCsrConfigParam {
 	uint32_t obss_width_interval;
 	uint32_t obss_active_dwelltime;
 	uint32_t obss_passive_dwelltime;
+	bool ignore_peer_ht_opmode;
 } tCsrConfigParam;
 
 /* Tush */
diff --git a/core/sme/inc/csr_internal.h b/core/sme/inc/csr_internal.h
index 290584e89be5..15ce478fd687 100644
--- a/core/sme/inc/csr_internal.h
+++ b/core/sme/inc/csr_internal.h
@@ -638,6 +638,7 @@ typedef struct tagCsrConfig {
 	uint32_t obss_width_interval;
 	uint32_t obss_active_dwelltime;
 	uint32_t obss_passive_dwelltime;
+	bool ignore_peer_ht_opmode;
 } tCsrConfig;
 
 typedef struct tagCsrChannelPowerInfo {
diff --git a/core/sme/inc/csr_neighbor_roam.h b/core/sme/inc/csr_neighbor_roam.h
index 1283abf7fe39..b8b8e875a18f 100644
--- a/core/sme/inc/csr_neighbor_roam.h
+++ b/core/sme/inc/csr_neighbor_roam.h
@@ -187,8 +187,6 @@ QDF_STATUS csr_neighbor_roam_prepare_scan_profile_filter(tpAniSirGlobal pMac,
 QDF_STATUS csr_neighbor_roam_preauth_rsp_handler(tpAniSirGlobal pMac,
 		uint8_t sessionId, tSirRetStatus limStatus);
 bool csr_neighbor_roam_is11r_assoc(tpAniSirGlobal pMac, uint8_t sessionId);
-QDF_STATUS csr_neighbor_roam_create_chan_list_from_neighbor_report(
-		tpAniSirGlobal pMac, uint8_t sessionId);
 #ifdef WLAN_FEATURE_HOST_ROAM
 void csr_neighbor_roam_tranistion_preauth_done_to_disconnected(
 		tpAniSirGlobal pMac, uint8_t sessionId);
@@ -366,11 +364,11 @@ QDF_STATUS csr_neighbor_roam_offload_update_preauth_list(tpAniSirGlobal pMac,
 		roam_offload_synch_ind *roam_synch_ind_ptr, uint8_t sessionId);
 void csr_roam_synch_callback(tpAniSirGlobal mac,
 	roam_offload_synch_ind *roam_synch_data,
-	tpSirBssDescription  bss_desc_ptr, uint8_t reason);
+	tpSirBssDescription  bss_desc_ptr, enum sir_roam_op_code reason);
 #else
 static inline void csr_roam_synch_callback(tpAniSirGlobal mac,
 	roam_offload_synch_ind *roam_synch_data,
-	tpSirBssDescription  bss_desc_ptr, uint8_t reason)
+	tpSirBssDescription  bss_desc_ptr, enum sir_roam_op_code reason)
 {}
 #endif
 void csr_neighbor_roam_state_transition(tpAniSirGlobal mac_ctx,
diff --git a/core/sme/inc/oem_data_api.h b/core/sme/inc/oem_data_api.h
index fa1d1f3fe2d7..fcd1fee2009c 100644
--- a/core/sme/inc/oem_data_api.h
+++ b/core/sme/inc/oem_data_api.h
@@ -39,14 +39,6 @@
 #include "sir_mac_prot_def.h"
 #include "csr_link_list.h"
 
-#ifndef OEM_DATA_REQ_SIZE
-#define OEM_DATA_REQ_SIZE 280
-#endif
-
-#ifndef OEM_DATA_RSP_SIZE
-#define OEM_DATA_RSP_SIZE 1724
-#endif
-
 /* message subtype for internal purpose */
 #define OEM_MESSAGE_SUBTYPE_INTERNAL   0xdeadbeef
 #define OEM_MESSAGE_SUBTYPE_LEN 4
@@ -59,7 +51,7 @@ typedef struct tagOemDataReq {
 } tOemDataReq, tOemDataReqConfig;
 
 typedef struct tagOemDataRsp {
-	uint8_t rsp_len;
+	uint32_t rsp_len;
 	uint8_t *oem_data_rsp;
 } tOemDataRsp;
 
diff --git a/core/sme/inc/sme_api.h b/core/sme/inc/sme_api.h
index 3d3f8c8f7394..a41f85b5a9bf 100644
--- a/core/sme/inc/sme_api.h
+++ b/core/sme/inc/sme_api.h
@@ -159,11 +159,14 @@ typedef struct {
 } tSmeThermalLevelInfo;
 
 #define SME_MAX_THERMAL_LEVELS (4)
+#define SME_MAX_THROTTLE_LEVELS (4)
+
 typedef struct {
 	/* Array of thermal levels */
 	tSmeThermalLevelInfo smeThermalLevels[SME_MAX_THERMAL_LEVELS];
 	uint8_t smeThermalMgmtEnabled;
 	uint32_t smeThrottlePeriod;
+	uint8_t sme_throttle_duty_cycle_tbl[SME_MAX_THROTTLE_LEVELS];
 } tSmeThermalParams;
 
 typedef enum {
@@ -801,6 +804,8 @@ QDF_STATUS sme_update_add_ie(tHalHandle hHal,
 		tSirUpdateIE *pUpdateIE, eUpdateIEsType updateType);
 QDF_STATUS sme_update_connect_debug(tHalHandle hHal, uint32_t set_value);
 const char *sme_request_type_to_string(const uint8_t request_type);
+const char *sme_scan_type_to_string(const uint8_t scan_type);
+const char *sme_bss_type_to_string(const uint8_t bss_type);
 QDF_STATUS sme_ap_disable_intra_bss_fwd(tHalHandle hHal, uint8_t sessionId,
 		bool disablefwd);
 uint32_t sme_get_channel_bonding_mode5_g(tHalHandle hHal);
@@ -1098,4 +1103,7 @@ QDF_STATUS sme_update_mimo_power_save(tHalHandle hHal,
 				      bool send_smps_action);
 
 bool sme_is_sta_smps_allowed(tHalHandle hHal, uint8_t session_id);
+QDF_STATUS sme_add_beacon_filter(tHalHandle hal,
+				uint32_t session_id, uint32_t *ie_map);
+QDF_STATUS sme_remove_beacon_filter(tHalHandle hal, uint32_t session_id);
 #endif /* #if !defined( __SME_API_H ) */
diff --git a/core/sme/inc/sme_ft_api.h b/core/sme/inc/sme_ft_api.h
index 57fb60655bb7..3b0ff3aaf19c 100644
--- a/core/sme/inc/sme_ft_api.h
+++ b/core/sme/inc/sme_ft_api.h
@@ -28,8 +28,6 @@
 #if !defined(__SME_FTAPI_H)
 #define __SME_FTAPI_H
 
-#include <lim_ft_defs.h>
-
 typedef enum eFTIEState {
 	eFT_START_READY,        /* Start before and after 11r assoc */
 	eFT_AUTH_REQ_READY,     /* When we have recvd the 1st or nth auth req */
diff --git a/core/sme/inc/sme_internal.h b/core/sme/inc/sme_internal.h
index cca91d596243..9e27ba2d2307 100644
--- a/core/sme/inc/sme_internal.h
+++ b/core/sme/inc/sme_internal.h
@@ -105,7 +105,8 @@ typedef enum eSmeState {
 #define SME_IS_READY(pMac)  (SME_STATE_READY == (pMac)->sme.state)
 
 /* HDD Callback function */
-typedef void (*pIbssPeerInfoCb)(void *pUserData, void *infoParam);
+typedef void (*pIbssPeerInfoCb)(void *pUserData,
+					tSirPeerInfoRspParams *infoParam);
 
 /* Peer info */
 typedef struct tagSmePeerInfoHddCbkInfo {
diff --git a/core/sme/inc/sme_rrm_api.h b/core/sme/inc/sme_rrm_api.h
index c65fb086ace2..049a55899507 100644
--- a/core/sme/inc/sme_rrm_api.h
+++ b/core/sme/inc/sme_rrm_api.h
@@ -56,11 +56,6 @@ QDF_STATUS rrm_change_default_config_param(tpAniSirGlobal pMac,
 QDF_STATUS sme_rrm_neighbor_report_request(tpAniSirGlobal pMac,
 		uint8_t sessionId, tpRrmNeighborReq pNeighborReq,
 		tpRrmNeighborRspCallbackInfo callbackInfo);
-tRrmNeighborReportDesc *sme_rrm_get_first_bss_entry_from_neighbor_cache(
-		tpAniSirGlobal pMac);
-tRrmNeighborReportDesc *sme_rrm_get_next_bss_entry_from_neighbor_cache(
-		tpAniSirGlobal pMac,
-		tpRrmNeighborReportDesc pBssEntry);
 QDF_STATUS sme_rrm_process_beacon_report_req_ind(tpAniSirGlobal pMac,
 		void *pMsgBuf);
 
diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c
index 4c4bdcb744c1..52439872e079 100644
--- a/core/sme/src/common/sme_api.c
+++ b/core/sme/src/common/sme_api.c
@@ -192,86 +192,93 @@ static QDF_STATUS sme_process_set_hw_mode_resp(tpAniSirGlobal mac, uint8_t *msg)
 		command->u.set_hw_mode_cmd.reason,
 		command->u.set_hw_mode_cmd.session_id);
 
-	if (callback) {
-		if (!param) {
-			sms_log(mac, LOGE,
-			    FL("Callback failed since HW mode params is NULL"));
-		} else if (reason == SIR_UPDATE_REASON_HIDDEN_STA) {
-			/* In the case of hidden SSID, connection update
-			 * (set hw mode) is done after the scan with reason
-			 * code eCsrScanForSsid completes. The connect/failure
-			 * needs to be handled after the response of set hw
-			 * mode
-			 */
-			saved_cmd = (tSmeCmd *)mac->sme.saved_scan_cmd;
-			if (!saved_cmd) {
-				sms_log(mac, LOGP,
+	if (!callback) {
+		sms_log(mac, LOGE, FL("Callback does not exist"));
+		goto end;
+	}
+
+	if (!param) {
+		sms_log(mac, LOGE,
+			FL("Callback failed since HW mode params is NULL"));
+		goto end;
+	}
+
+	/* Irrespective of the reason for which the hw mode change request
+	 * was issued, the policy manager connection table needs to be updated
+	 * with the new vdev-mac id mapping, tx/rx spatial streams etc., if the
+	 * set hw mode was successful.
+	 */
+	callback(param->status,
+			param->cfgd_hw_mode_index,
+			param->num_vdev_mac_entries,
+			param->vdev_mac_map);
+
+	if (reason == SIR_UPDATE_REASON_HIDDEN_STA) {
+		/* In the case of hidden SSID, connection update
+		 * (set hw mode) is done after the scan with reason
+		 * code eCsrScanForSsid completes. The connect/failure
+		 * needs to be handled after the response of set hw
+		 * mode
+		 */
+		saved_cmd = (tSmeCmd *)mac->sme.saved_scan_cmd;
+		if (!saved_cmd) {
+			sms_log(mac, LOGP,
 					FL("saved cmd is NULL, Check this"));
-				goto end;
-			}
-			if (param->status == SET_HW_MODE_STATUS_OK) {
-				sms_log(mac, LOG1,
+			goto end;
+		}
+		if (param->status == SET_HW_MODE_STATUS_OK) {
+			sms_log(mac, LOG1,
 					FL("search for ssid success"));
-				csr_scan_handle_search_for_ssid(mac,
+			csr_scan_handle_search_for_ssid(mac,
 					saved_cmd);
-			} else {
-				sms_log(mac, LOG1,
+		} else {
+			sms_log(mac, LOG1,
 					FL("search for ssid failure"));
-				csr_scan_handle_search_for_ssid_failure(mac,
+			csr_scan_handle_search_for_ssid_failure(mac,
 					saved_cmd);
-			}
-			if (saved_cmd->u.roamCmd.pRoamBssEntry)
-				qdf_mem_free(
+		}
+		if (saved_cmd->u.roamCmd.pRoamBssEntry)
+			qdf_mem_free(
 					saved_cmd->u.roamCmd.pRoamBssEntry);
-			if (saved_cmd->u.scanCmd.u.scanRequest.SSIDs.SSIDList)
-				qdf_mem_free(saved_cmd->u.scanCmd.u.
-						scanRequest.SSIDs.SSIDList);
-			if (saved_cmd->u.scanCmd.pToRoamProfile)
-				qdf_mem_free(saved_cmd->u.scanCmd.
-						pToRoamProfile);
-			if (saved_cmd) {
-				qdf_mem_free(saved_cmd);
-				saved_cmd = NULL;
-				mac->sme.saved_scan_cmd = NULL;
-			}
-		} else if (reason == SIR_UPDATE_REASON_CHANNEL_SWITCH) {
-			csr_roam_call_callback(mac,
-					command->u.set_hw_mode_cmd.session_id,
-					&roam_info, 0,
-					eCSR_ROAM_STATUS_UPDATE_HW_MODE,
-					eCSR_ROAM_RESULT_UPDATE_HW_MODE);
-		} else if (reason == SIR_UPDATE_REASON_CHANNEL_SWITCH_STA) {
-			struct sir_saved_csa_params *msg;
-
-			sms_log(mac, LOG1, FL("process channel switch sta"));
-			msg = qdf_mem_malloc(sizeof(*msg));
-			if (!msg) {
-				sms_log(mac, LOGE,
+		if (saved_cmd->u.scanCmd.u.scanRequest.SSIDs.SSIDList)
+			qdf_mem_free(saved_cmd->u.scanCmd.u.
+					scanRequest.SSIDs.SSIDList);
+		if (saved_cmd->u.scanCmd.pToRoamProfile)
+			qdf_mem_free(saved_cmd->u.scanCmd.
+					pToRoamProfile);
+		if (saved_cmd) {
+			qdf_mem_free(saved_cmd);
+			saved_cmd = NULL;
+			mac->sme.saved_scan_cmd = NULL;
+		}
+	} else if (reason == SIR_UPDATE_REASON_CHANNEL_SWITCH) {
+		csr_roam_call_callback(mac,
+				command->u.set_hw_mode_cmd.session_id,
+				&roam_info, 0,
+				eCSR_ROAM_STATUS_UPDATE_HW_MODE,
+				eCSR_ROAM_RESULT_UPDATE_HW_MODE);
+	} else if (reason == SIR_UPDATE_REASON_CHANNEL_SWITCH_STA) {
+		struct sir_saved_csa_params *msg;
+
+		sms_log(mac, LOG1, FL("process channel switch sta"));
+		msg = qdf_mem_malloc(sizeof(*msg));
+		if (!msg) {
+			sms_log(mac, LOGE,
 					FL("memory alloc fail for csa "));
-				goto end;
-			}
+			goto end;
+		}
 
-			msg->message_type = SIR_LIM_CSA_POST_HW_MODE_CHANGE;
-			msg->length = sizeof(*msg);
-			msg->session_id = command->u.set_hw_mode_cmd.session_id;
+		msg->message_type = SIR_LIM_CSA_POST_HW_MODE_CHANGE;
+		msg->length = sizeof(*msg);
+		msg->session_id = command->u.set_hw_mode_cmd.session_id;
 
-			status = cds_send_mb_message_to_mac(msg);
-			if (!QDF_IS_STATUS_SUCCESS(status))
-				sms_log(mac, LOGE,
+		status = cds_send_mb_message_to_mac(msg);
+		if (!QDF_IS_STATUS_SUCCESS(status))
+			sms_log(mac, LOGE,
 					FL("failed to process csa params"));
-			else
-				sms_log(mac, LOG1,
+		else
+			sms_log(mac, LOG1,
 					FL("csa after hw mode change"));
-		} else {
-			sms_log(mac, LOGE,
-			      FL("Calling HDD callback for HW mode response"));
-			callback(param->status,
-				 param->cfgd_hw_mode_index,
-				 param->num_vdev_mac_entries,
-				 param->vdev_mac_map);
-		}
-	} else {
-		sms_log(mac, LOGE, FL("Callback does not exist"));
 	}
 
 end:
@@ -12421,6 +12428,16 @@ QDF_STATUS sme_init_thermal_info(tHalHandle hHal, tSmeThermalParams thermalParam
 
 	pWmaParam->thermalMgmtEnabled = thermalParam.smeThermalMgmtEnabled;
 	pWmaParam->throttlePeriod = thermalParam.smeThrottlePeriod;
+
+	pWmaParam->throttle_duty_cycle_tbl[0] =
+		thermalParam.sme_throttle_duty_cycle_tbl[0];
+	pWmaParam->throttle_duty_cycle_tbl[1] =
+		thermalParam.sme_throttle_duty_cycle_tbl[1];
+	pWmaParam->throttle_duty_cycle_tbl[2] =
+		thermalParam.sme_throttle_duty_cycle_tbl[2];
+	pWmaParam->throttle_duty_cycle_tbl[3] =
+		thermalParam.sme_throttle_duty_cycle_tbl[3];
+
 	pWmaParam->thermalLevels[0].minTempThreshold =
 		thermalParam.smeThermalLevels[0].smeMinTempThreshold;
 	pWmaParam->thermalLevels[0].maxTempThreshold =
@@ -15454,3 +15471,97 @@ bool sme_is_sta_smps_allowed(tHalHandle hal, uint8_t session_id)
 
 	return (csr_session->supported_nss_1x1 == true) ? false : true;
 }
+
+/**
+ * sme_add_beacon_filter() - set the beacon filter configuration
+ * @hal: The handle returned by macOpen
+ * @session_id: session id
+ * @ie_map: bitwise array of IEs
+ *
+ * Return: Return QDF_STATUS, otherwise appropriate failure code
+ */
+QDF_STATUS sme_add_beacon_filter(tHalHandle hal,
+				 uint32_t session_id,
+				 uint32_t *ie_map)
+{
+	cds_msg_t message;
+	QDF_STATUS qdf_status;
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
+	struct beacon_filter_param *filter_param;
+
+	if (!CSR_IS_SESSION_VALID(mac_ctx, session_id)) {
+		sms_log(mac_ctx, LOGE,
+			"CSR session not valid: %d",
+			session_id);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	filter_param = qdf_mem_malloc(sizeof(*filter_param));
+	if (NULL == filter_param) {
+		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+				"%s: fail to alloc filter_param", __func__);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	filter_param->vdev_id = session_id;
+
+	qdf_mem_copy(filter_param->ie_map, ie_map,
+			BCN_FLT_MAX_ELEMS_IE_LIST * sizeof(uint32_t));
+
+	message.type = WMA_ADD_BCN_FILTER_CMDID;
+	message.bodyptr = filter_param;
+	qdf_status = cds_mq_post_message(QDF_MODULE_ID_WMA,
+					&message);
+	if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
+		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+			"%s: Not able to post msg to WDA!",
+			__func__);
+
+		qdf_mem_free(filter_param);
+	}
+	return qdf_status;
+}
+
+/**
+ * sme_remove_beacon_filter() - set the beacon filter configuration
+ * @hal: The handle returned by macOpen
+ * @session_id: session id
+ *
+ * Return: Return QDF_STATUS, otherwise appropriate failure code
+ */
+QDF_STATUS sme_remove_beacon_filter(tHalHandle hal, uint32_t session_id)
+{
+	cds_msg_t message;
+	QDF_STATUS qdf_status;
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
+	struct beacon_filter_param *filter_param;
+
+	if (!CSR_IS_SESSION_VALID(mac_ctx, session_id)) {
+		sms_log(mac_ctx, LOGE,
+			"CSR session not valid: %d",
+			session_id);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	filter_param = qdf_mem_malloc(sizeof(*filter_param));
+	if (NULL == filter_param) {
+		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+				"%s: fail to alloc filter_param", __func__);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	filter_param->vdev_id = session_id;
+
+	message.type = WMA_REMOVE_BCN_FILTER_CMDID;
+	message.bodyptr = filter_param;
+	qdf_status = cds_mq_post_message(QDF_MODULE_ID_WMA,
+					&message);
+	if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
+		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+			"%s: Not able to post msg to WDA!",
+			__func__);
+
+		qdf_mem_free(filter_param);
+	}
+	return qdf_status;
+}
diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index 15c702f328c2..b86916195094 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -35,7 +35,6 @@
 #include "ani_global.h"          /* for tpAniSirGlobal */
 #include "wma_types.h"
 #include "wma_if.h"          /* for STA_INVALID_IDX. */
-#include "lim_utils.h"
 #include "cds_mq.h"
 #include "csr_inside_api.h"
 #include "sms_debug.h"
@@ -91,9 +90,6 @@ static bool b_roam_scan_offload_started;
    ------------------------------------------------------------------------*/
 static tCsrRoamSession csr_roam_roam_session[CSR_ROAM_SESSION_MAX];
 
-/*--------------------------------------------------------------------------
-   Type declarations
-   ------------------------------------------------------------------------*/
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
 int diag_auth_type_from_csr_type(eCsrAuthType authType)
 {
@@ -2347,7 +2343,8 @@ QDF_STATUS csr_change_default_config_param(tpAniSirGlobal pMac,
 
 		pMac->sme.ps_global_info.ps_enabled =
 			pParam->is_ps_enabled;
-
+		pMac->roam.configParam.ignore_peer_ht_opmode =
+			pParam->ignore_peer_ht_opmode;
 		pMac->policy_manager_enabled = pParam->policy_manager_enabled;
 		pMac->fine_time_meas_cap = pParam->fine_time_meas_cap;
 		pMac->dual_mac_feature_disable =
@@ -2538,6 +2535,8 @@ QDF_STATUS csr_get_config_param(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
 		pMac->roam.configParam.obss_active_dwelltime;
 	pParam->obss_passive_dwelltime =
 		pMac->roam.configParam.obss_passive_dwelltime;
+	pParam->ignore_peer_ht_opmode =
+		pMac->roam.configParam.ignore_peer_ht_opmode;
 	pParam->enableHtSmps = pMac->roam.configParam.enableHtSmps;
 	pParam->htSmps = pMac->roam.configParam.htSmps;
 	pParam->send_smps_action = pMac->roam.configParam.send_smps_action;
@@ -7330,7 +7329,7 @@ QDF_STATUS csr_roam_connect(tpAniSirGlobal pMac, uint32_t sessionId,
 	pSession->join_bssid_count = 0;
 	sms_log(pMac, LOG1,
 		FL("called  BSSType = %s (%d) authtype = %d  encryType = %d"),
-		lim_bss_type_to_string(pProfile->BSSType),
+		sme_bss_type_to_string(pProfile->BSSType),
 		pProfile->BSSType, pProfile->AuthType.authType[0],
 		pProfile->EncryptionType.encryptionType[0]);
 	csr_roam_cancel_roaming(pMac, sessionId);
@@ -7526,7 +7525,7 @@ csr_roam_reassoc(tpAniSirGlobal mac_ctx, uint32_t session_id,
 	}
 	sms_log(mac_ctx, LOG1,
 		FL("called  BSSType = %s (%d) authtype = %d  encryType = %d"),
-		lim_bss_type_to_string(profile->BSSType),
+		sme_bss_type_to_string(profile->BSSType),
 		profile->BSSType, profile->AuthType.authType[0],
 		profile->EncryptionType.encryptionType[0]);
 	csr_roam_cancel_roaming(mac_ctx, session_id);
@@ -13448,10 +13447,7 @@ QDF_STATUS csr_send_join_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
 		/* bsstype */
 		dwTmp = csr_translate_bsstype_to_mac_type
 						(pProfile->BSSType);
-		/* Override BssType for BTAMP */
-		if (dwTmp == eSIR_BTAMP_STA_MODE)
-			dwTmp = eSIR_BTAMP_AP_MODE;
-			csr_join_req->bsstype = dwTmp;
+		csr_join_req->bsstype = dwTmp;
 		/* dot11mode */
 		ucDot11Mode =
 			csr_translate_to_wni_cfg_dot11_mode(pMac,
@@ -14785,7 +14781,7 @@ QDF_STATUS csr_process_add_sta_session_command(tpAniSirGlobal pMac,
 
 	add_sta_self_req = qdf_mem_malloc(sizeof(struct add_sta_self_params));
 	if (NULL == add_sta_self_req) {
-		lim_log(pMac, LOGP,
+		sms_log(pMac, LOGP,
 			FL
 			("Unable to allocate memory for tAddSelfStaParams"));
 		return status;
@@ -14803,15 +14799,14 @@ QDF_STATUS csr_process_add_sta_session_command(tpAniSirGlobal pMac,
 	msg.bodyptr = add_sta_self_req;
 	msg.bodyval = 0;
 
-	lim_log(pMac, LOG1,
+	sms_log(pMac, LOG1,
 		 FL
 		 ("Send WMA_ADD_STA_SELF_REQ for selfMac=" MAC_ADDRESS_STR),
 		 MAC_ADDR_ARRAY(add_sta_self_req->self_mac_addr));
-	MTRACE(mac_trace_msg_tx(pMac, NO_SESSION, msg.type));
 	status = wma_post_ctrl_msg(pMac, &msg);
 
 	if (status != QDF_STATUS_SUCCESS) {
-		lim_log(pMac, LOGP, FL("wma_post_ctrl_msg failed"));
+		sms_log(pMac, LOGP, FL("wma_post_ctrl_msg failed"));
 		qdf_mem_free(add_sta_self_req);
 		add_sta_self_req = NULL;
 	}
@@ -15002,7 +14997,7 @@ QDF_STATUS csr_process_del_sta_session_command(tpAniSirGlobal pMac,
 	QDF_STATUS status = QDF_STATUS_E_FAILURE;
 	del_sta_self_req = qdf_mem_malloc(sizeof(struct del_sta_self_params));
 	if (NULL == del_sta_self_req) {
-		lim_log(pMac, LOGP,
+		sms_log(pMac, LOGP,
 			FL(" mem alloc failed for tDelStaSelfParams"));
 		return QDF_STATUS_E_NOMEM;
 	}
@@ -15019,7 +15014,6 @@ QDF_STATUS csr_process_del_sta_session_command(tpAniSirGlobal pMac,
 
 	sms_log(pMac, LOG1,
 		FL("sending WMA_DEL_STA_SELF_REQ"));
-	MTRACE(mac_trace_msg_tx(pMac, NO_SESSION, msg.type));
 	status = wma_post_ctrl_msg(pMac, &msg);
 	if (status != QDF_STATUS_SUCCESS) {
 		sms_log(pMac, LOGP, FL("wma_post_ctrl_msg failed"));
@@ -18699,7 +18693,7 @@ void csr_roam_fill_tdls_info(tCsrRoamInfo *roam_info, tpSirSmeJoinRsp join_rsp)
  */
 void csr_roam_synch_callback(tpAniSirGlobal mac_ctx,
 		roam_offload_synch_ind *roam_synch_data,
-		tpSirBssDescription  bss_desc, uint8_t reason)
+		tpSirBssDescription  bss_desc, enum sir_roam_op_code reason)
 {
 	uint8_t session_id = roam_synch_data->roamedVdevId;
 	tCsrRoamSession *session = CSR_GET_SESSION(mac_ctx, session_id);
@@ -18727,11 +18721,28 @@ void csr_roam_synch_callback(tpAniSirGlobal mac_ctx,
 		return;
 	}
 	session->roam_synch_in_progress = true;
-	if (reason == ROAMING_TX_QUEUE_DISABLE) {
+	switch (reason) {
+	case SIR_ROAMING_DEREGISTER_STA:
 		csr_roam_call_callback(mac_ctx, session_id, NULL, 0,
 				eCSR_ROAM_FT_START, eSIR_SME_SUCCESS);
 		sme_release_global_lock(&mac_ctx->sme);
 		return;
+	case SIR_ROAMING_TX_QUEUE_DISABLE:
+		csr_roam_call_callback(mac_ctx, session_id, NULL, 0,
+				eCSR_ROAM_DISABLE_QUEUES, eSIR_SME_SUCCESS);
+		sme_release_global_lock(&mac_ctx->sme);
+		return;
+	case SIR_ROAMING_TX_QUEUE_ENABLE:
+		csr_roam_call_callback(mac_ctx, session_id, NULL, 0,
+				eCSR_ROAM_ENABLE_QUEUES, eSIR_SME_SUCCESS);
+		sme_release_global_lock(&mac_ctx->sme);
+		return;
+	case SIR_ROAM_SYNCH_PROPAGATION:
+		break;
+	default:
+		sms_log(mac_ctx, LOGE, FL("LFR3: callback reason %d"), reason);
+		sme_release_global_lock(&mac_ctx->sme);
+		return;
 	}
 	session->roam_synch_data = roam_synch_data;
 	if (!QDF_IS_STATUS_SUCCESS(csr_get_parsed_bss_description_ies(mac_ctx,
diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c
index 12a6c8094870..a7cd0987b30c 100644
--- a/core/sme/src/csr/csr_api_scan.c
+++ b/core/sme/src/csr/csr_api_scan.c
@@ -49,7 +49,6 @@
 #include "wma_types.h"
 #include "cds_utils.h"
 #include "cfg_api.h"
-#include "lim_api.h"
 #include "wma.h"
 
 #include "cds_concurrency.h"
@@ -4867,10 +4866,10 @@ QDF_STATUS csr_send_mb_scan_req(tpAniSirGlobal pMac, uint16_t sessionId,
 			pScanReqParam->hiddenSsid);
 		sms_log(pMac, LOG1,
 			FL("scanType = %s (%u) BSSType = %s (%u) numOfSSIDs = %d"
-			   " numOfChannels = %d requestType = %s (%d) p2pSearch = %d\n"),
-			lim_scan_type_to_string(pScanReq->scanType),
+				" numOfChannels = %d requestType = %s (%d) p2pSearch = %d\n"),
+			sme_scan_type_to_string(pScanReq->scanType),
 			pScanReq->scanType,
-			lim_bss_type_to_string(pScanReq->BSSType),
+			sme_bss_type_to_string(pScanReq->BSSType),
 			pScanReq->BSSType,
 			pScanReq->SSIDs.numOfSSIDs,
 			pScanReq->ChannelInfo.numOfChannels,
@@ -5017,8 +5016,8 @@ send_scan_req:
 	sms_log(pMac, LOG1,
 		FL("scanId %d domainIdCurrent %d scanType %s (%d) bssType %s (%d) requestType %s (%d) numChannels %d"),
 		pMsg->scan_id, pMac->scan.domainIdCurrent,
-		lim_scan_type_to_string(pMsg->scanType), pMsg->scanType,
-		lim_bss_type_to_string(pMsg->bssType), pMsg->bssType,
+		sme_scan_type_to_string(pMsg->scanType), pMsg->scanType,
+		sme_bss_type_to_string(pMsg->bssType), pMsg->bssType,
 		sme_request_type_to_string(pScanReq->requestType),
 		pScanReq->requestType, pMsg->channelList.numChannels);
 
diff --git a/core/sme/src/csr/csr_neighbor_roam.c b/core/sme/src/csr/csr_neighbor_roam.c
index 0a26228496d5..4667d82ef3ab 100644
--- a/core/sme/src/csr/csr_neighbor_roam.c
+++ b/core/sme/src/csr/csr_neighbor_roam.c
@@ -971,185 +971,6 @@ QDF_STATUS csr_neighbor_roam_merge_channel_lists(tpAniSirGlobal pMac,
 }
 
 /**
- * csr_neighbor_roam_create_chan_list_from_neighbor_report()
- *
- * @mac_ctx: Pointer to Global MAC structure
- * @session_id: Session ID
- *
- * This function is invoked when neighbor report is received for the
- * neighbor request. Based on the channels present in the neighbor report,
- * it generates channel list which will be used in REPORT_SCAN state to
- * scan for these neighbor APs
- *
- * Return: QDF_STATUS_SUCCESS on success, QDF_STATUS_E_FAILURE otherwise
- */
-QDF_STATUS csr_neighbor_roam_create_chan_list_from_neighbor_report(tpAniSirGlobal pMac,
-								   uint8_t sessionId)
-{
-	tpRrmNeighborReportDesc pNeighborBssDesc;
-	tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
-		&pMac->roam.neighborRoamInfo[sessionId];
-	uint8_t numChannels = 0;
-	uint8_t i = 0;
-	uint8_t channelList[MAX_BSS_IN_NEIGHBOR_RPT];
-	uint8_t mergedOutputNumOfChannels = 0;
-
-	/* This should always start from 0 whenever we create a channel list out of neighbor AP list */
-	pNeighborRoamInfo->FTRoamInfo.numBssFromNeighborReport = 0;
-
-	pNeighborBssDesc = sme_rrm_get_first_bss_entry_from_neighbor_cache(pMac);
-
-	while (pNeighborBssDesc) {
-		if (pNeighborRoamInfo->FTRoamInfo.numBssFromNeighborReport >=
-		    MAX_BSS_IN_NEIGHBOR_RPT)
-			break;
-
-		/* Update the neighbor BSS Info in the 11r FT Roam Info */
-		pNeighborRoamInfo->FTRoamInfo.
-		neighboReportBssInfo[pNeighborRoamInfo->FTRoamInfo.
-				     numBssFromNeighborReport].channelNum =
-			pNeighborBssDesc->pNeighborBssDescription->channel;
-		pNeighborRoamInfo->FTRoamInfo.
-		neighboReportBssInfo[pNeighborRoamInfo->FTRoamInfo.
-				     numBssFromNeighborReport].
-		neighborScore = (uint8_t) pNeighborBssDesc->roamScore;
-		qdf_mem_copy(pNeighborRoamInfo->FTRoamInfo.
-			     neighboReportBssInfo[pNeighborRoamInfo->FTRoamInfo.
-						  numBssFromNeighborReport].
-			     neighborBssId,
-			     pNeighborBssDesc->pNeighborBssDescription->bssId,
-			     sizeof(tSirMacAddr));
-		pNeighborRoamInfo->FTRoamInfo.numBssFromNeighborReport++;
-
-		/* Saving the channel list non-redundantly */
-		for (i = 0; (i < numChannels && i < MAX_BSS_IN_NEIGHBOR_RPT);
-		     i++) {
-			if (pNeighborBssDesc->pNeighborBssDescription->
-			    channel == channelList[i])
-				break;
-		}
-
-		if (i == numChannels) {
-			if (pNeighborBssDesc->pNeighborBssDescription->channel) {
-				if (CSR_IS_ROAM_INTRA_BAND_ENABLED(pMac)) {
-					/* Make sure to add only if its the same band */
-					if (get_rf_band
-						    (pNeighborRoamInfo->
-						    currAPoperationChannel) ==
-					    get_rf_band(pNeighborBssDesc->
-							pNeighborBssDescription->
-							channel)) {
-						QDF_TRACE(QDF_MODULE_ID_SME,
-							  QDF_TRACE_LEVEL_INFO,
-							  "%s: [INFOLOG] Adding %d to Neighbor channel list (Same band)\n",
-							  __func__,
-							  pNeighborBssDesc->
-							  pNeighborBssDescription->
-							  channel);
-						channelList[numChannels] =
-							pNeighborBssDesc->
-							pNeighborBssDescription->
-							channel;
-						numChannels++;
-					}
-				} else {
-					QDF_TRACE(QDF_MODULE_ID_SME,
-						  QDF_TRACE_LEVEL_INFO,
-						  "%s: [INFOLOG] Adding %d to Neighbor channel list\n",
-						  __func__,
-						  pNeighborBssDesc->
-						  pNeighborBssDescription->
-						  channel);
-					channelList[numChannels] =
-						pNeighborBssDesc->
-						pNeighborBssDescription->channel;
-					numChannels++;
-				}
-			}
-		}
-
-		pNeighborBssDesc =
-			sme_rrm_get_next_bss_entry_from_neighbor_cache(pMac,
-								       pNeighborBssDesc);
-	}
-
-	if (pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.
-	    ChannelList) {
-		qdf_mem_free(pNeighborRoamInfo->roamChannelInfo.
-			     currentChannelListInfo.ChannelList);
-	}
-
-	pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.ChannelList =
-		NULL;
-	pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.
-	numOfChannels = 0;
-	/* Store the obtained channel list to the Neighbor Control data structure */
-	if (numChannels)
-		pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.
-		ChannelList =
-			qdf_mem_malloc((numChannels) * sizeof(uint8_t));
-	if (NULL ==
-	    pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.
-	    ChannelList) {
-		sms_log(pMac, LOGE,
-			FL
-				("Memory allocation for Channel list failed.. TL event ignored"));
-		return QDF_STATUS_E_NOMEM;
-	}
-
-	qdf_mem_copy(pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.
-		     ChannelList, channelList, (numChannels) * sizeof(uint8_t));
-	pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.
-	numOfChannels = numChannels;
-	/*
-	 * Create a Union of occupied channel list learnt by the DUT along with the Neighbor
-	 * report Channels. This increases the chances of the DUT to get a candidate AP while
-	 * roaming even if the Neighbor Report is not able to provide sufficient information.
-	 * */
-	if (pMac->scan.occupiedChannels[sessionId].numChannels) {
-		csr_neighbor_roam_merge_channel_lists(pMac,
-						      &pMac->scan.
-						      occupiedChannels[sessionId].
-						      channelList[0],
-						      pMac->scan.
-						      occupiedChannels[sessionId].
-						      numChannels,
-						      &pNeighborRoamInfo->
-						      roamChannelInfo.
-						      currentChannelListInfo.
-						      ChannelList[0],
-						      pNeighborRoamInfo->
-						      roamChannelInfo.
-						      currentChannelListInfo.
-						      numOfChannels,
-						      &mergedOutputNumOfChannels);
-		pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo.
-		numOfChannels = mergedOutputNumOfChannels;
-
-	}
-	/*Indicate the firmware about the update only if any new channels are added.
-	 * Otherwise, the firmware would already be knowing the non-IAPPneighborlist
-	 * channels. There is no need to update.*/
-	if (numChannels) {
-		sms_log(pMac, LOG1,
-			FL("IAPP Neighbor list callback received as expected"
-			   "in state %s."),
-			mac_trace_get_neighbour_roam_state(pNeighborRoamInfo->
-							   neighborRoamState));
-		pNeighborRoamInfo->roamChannelInfo.IAPPNeighborListReceived =
-			true;
-		if (csr_roam_is_roam_offload_scan_enabled(pMac)) {
-			csr_roam_offload_scan(pMac, sessionId,
-					      ROAM_SCAN_OFFLOAD_UPDATE_CFG,
-					      REASON_CHANNEL_LIST_CHANGED);
-		}
-	}
-	pNeighborRoamInfo->roamChannelInfo.currentChanIndex = 0;
-
-	return QDF_STATUS_SUCCESS;
-}
-
-/**
  * csr_neighbor_roam_is_ssid_and_security_match() - to match ssid/security
  * @pMac: Pointer to mac context
  * @pCurProfile: pointer to current roam profile
diff --git a/core/sme/src/csr/csr_util.c b/core/sme/src/csr/csr_util.c
index 720e7c4ff20a..1a3a2b67d7fb 100644
--- a/core/sme/src/csr/csr_util.c
+++ b/core/sme/src/csr/csr_util.c
@@ -5591,6 +5591,42 @@ const char *sme_request_type_to_string(const uint8_t request_type)
 	}
 }
 
+/**
+ * sme_bsstype_to_string() - converts bss type to string.
+ * @bss_type: bss type enum
+ *
+ * Return: printable string for bss type
+ */
+const char *sme_bss_type_to_string(const uint8_t bss_type)
+{
+	switch (bss_type) {
+	CASE_RETURN_STRING(eCSR_BSS_TYPE_INFRASTRUCTURE);
+	CASE_RETURN_STRING(eCSR_BSS_TYPE_INFRA_AP);
+	CASE_RETURN_STRING(eCSR_BSS_TYPE_IBSS);
+	CASE_RETURN_STRING(eCSR_BSS_TYPE_START_IBSS);
+	CASE_RETURN_STRING(eCSR_BSS_TYPE_ANY);
+	default:
+		return "unknown bss type";
+	}
+}
+
+/**
+ * sme_scantype_to_string() - converts scan type to string.
+ * @scan_type: scan type enum
+ *
+ * Return: printable string for scan type
+ */
+const char *sme_scan_type_to_string(const uint8_t scan_type)
+{
+	switch (scan_type) {
+	CASE_RETURN_STRING(eSIR_PASSIVE_SCAN);
+	CASE_RETURN_STRING(eSIR_ACTIVE_SCAN);
+	CASE_RETURN_STRING(eSIR_BEACON_TABLE);
+	default:
+		return "unknown scan type";
+	}
+}
+
 QDF_STATUS csr_add_to_channel_list_front(uint8_t *pChannelList,
 					 int numChannels, uint8_t channel)
 {
diff --git a/core/sme/src/nan/nan_api.c b/core/sme/src/nan/nan_api.c
index 7fc71e0f944e..5398ffa3398c 100644
--- a/core/sme/src/nan/nan_api.c
+++ b/core/sme/src/nan/nan_api.c
@@ -30,8 +30,8 @@
 #include "csr_inside_api.h"
 #include "sme_inside.h"
 #include "nan_api.h"
-#include "lim_api.h"
 #include "cfg_api.h"
+#include "wma_types.h"
 
 /******************************************************************************
  * Function: sme_nan_register_callback
diff --git a/core/sme/src/p2p/p2p_api.c b/core/sme/src/p2p/p2p_api.c
index 9deb1678b48d..43cf2c0075a0 100644
--- a/core/sme/src/p2p/p2p_api.c
+++ b/core/sme/src/p2p/p2p_api.c
@@ -30,7 +30,6 @@
 #include "csr_inside_api.h"
 #include "sme_inside.h"
 #include "p2p_api.h"
-#include "lim_api.h"
 #include "cfg_api.h"
 #include "wma.h"
 
diff --git a/core/sme/src/rrm/sme_rrm.c b/core/sme/src/rrm/sme_rrm.c
index eea4a764fbb0..9570ac731800 100644
--- a/core/sme/src/rrm/sme_rrm.c
+++ b/core/sme/src/rrm/sme_rrm.c
@@ -475,6 +475,7 @@ static QDF_STATUS sme_rrm_send_scan_result(tpAniSirGlobal mac_ctx,
 	if (filter.SSIDs.SSIDList)
 		qdf_mem_free(filter.SSIDs.SSIDList);
 
+	sms_log(mac_ctx, LOG1, FL("RRM Measurement Done %d"), measurementdone);
 	if (NULL == result_handle) {
 		/*
 		 * no scan results
@@ -520,16 +521,27 @@ static QDF_STATUS sme_rrm_send_scan_result(tpAniSirGlobal mac_ctx,
 	counter = 0;
 	while (scan_results) {
 		next_result = sme_scan_result_get_next(mac_ctx, result_handle);
+		sms_log(mac_ctx, LOG1, "Scan res timer:%lu, rrm scan timer:%lu",
+				scan_results->timer, rrm_scan_timer);
 		if (scan_results->timer >= rrm_scan_timer)
 			scanresults_arr[counter++] = scan_results;
 		scan_results = next_result;
 		if (counter >= SIR_BCN_REPORT_MAX_BSS_DESC)
 			break;
 	}
-	if (counter) {
-		sms_log(mac_ctx, LOG1,
-			FL(" Number of BSS Desc with RRM Scan %d "),
+	/*
+	 * The beacon report should be sent whether the counter is zero or
+	 * non-zero. There might be a few scan results in the cache but not
+	 * actually are a result of this scan. During that scenario, the
+	 * counter will be zero. The report should be sent and LIM will further
+	 * cleanup the RRM to accept the further incoming requests
+	 * In case the counter is Zero, the pScanResultsArr will be NULL.
+	 * The next level routine does a check for the measurementDone to
+	 * determine whether to send a report or not.
+	 */
+	sms_log(mac_ctx, LOG1, FL(" Number of BSS Desc with RRM Scan %d "),
 			counter);
+	if (counter || measurementdone) {
 #ifdef FEATURE_WLAN_ESE
 		if (eRRM_MSG_SOURCE_ESE_UPLOAD == rrm_ctx->msgSource)
 			status = sme_ese_send_beacon_req_scan_results(mac_ctx,
@@ -1410,67 +1422,3 @@ QDF_STATUS rrm_change_default_config_param(tpAniSirGlobal pMac,
 	return QDF_STATUS_SUCCESS;
 }
 
-/* ---------------------------------------------------------------------------
-
-    \fn sme_rrm_get_first_bss_entry_from_neighbor_cache()
-
-    \brief  This function returns the first entry from the neighbor cache to the caller
-
-    \param  pMac - The handle returned by mac_open.
-
-    \return VOID
-
-   ---------------------------------------------------------------------------*/
-tRrmNeighborReportDesc *sme_rrm_get_first_bss_entry_from_neighbor_cache(tpAniSirGlobal
-									pMac)
-{
-	tListElem *pEntry;
-	tRrmNeighborReportDesc *pTempBssEntry = NULL;
-	tpRrmSMEContext pSmeRrmContext = &pMac->rrm.rrmSmeContext;
-
-	pEntry =
-		csr_ll_peek_head(&pSmeRrmContext->neighborReportCache, LL_ACCESS_LOCK);
-
-	if (!pEntry || !csr_ll_count(&pSmeRrmContext->neighborReportCache)) {
-		/* list empty */
-		sms_log(pMac, LOGW, FL("List empty"));
-		return NULL;
-	}
-
-	pTempBssEntry = GET_BASE_ADDR(pEntry, tRrmNeighborReportDesc, List);
-
-	return pTempBssEntry;
-}
-
-/**
- * sme_rrm_get_next_bss_entry_from_neighbor_cache() - returns the entry next to
- *                         the given entry
- * @ pMac - The handle returned by mac_open.
- * @pBssEntry- BSS entry
- *
- * This function returns the entry next to the given entry from the
- * neighbor cache to the caller
- *
- * Return: NULL
- */
-tRrmNeighborReportDesc *sme_rrm_get_next_bss_entry_from_neighbor_cache(
-	tpAniSirGlobal pMac, tpRrmNeighborReportDesc pBssEntry)
-{
-	tListElem *pEntry;
-	tRrmNeighborReportDesc *pTempBssEntry = NULL;
-
-	pEntry =
-		csr_ll_next(&pMac->rrm.rrmSmeContext.neighborReportCache,
-			    &pBssEntry->List, LL_ACCESS_LOCK);
-
-	if (!pEntry) {
-		/* list empty */
-		sms_log(pMac, LOGW, FL("List empty"));
-		return NULL;
-	}
-
-	pTempBssEntry = GET_BASE_ADDR(pEntry, tRrmNeighborReportDesc, List);
-
-	return pTempBssEntry;
-}
-
diff --git a/core/utils/epping/inc/epping_main.h b/core/utils/epping/inc/epping_main.h
index d267b714c46e..0dcae3f87676 100644
--- a/core/utils/epping/inc/epping_main.h
+++ b/core/utils/epping/inc/epping_main.h
@@ -39,12 +39,13 @@
    Include files
    -------------------------------------------------------------------------*/
 #include <qdf_lock.h>
+#include <qdf_types.h>
 
 #define WLAN_EPPING_ENABLE_BIT          (1 << 8)
 #define WLAN_EPPING_IRQ_BIT             (1 << 9)
 #define WLAN_EPPING_FW_UART_BIT         (1 << 10)
-#define WLAN_IS_EPPING_ENABLED(x)       (x & WLAN_EPPING_ENABLE_BIT)
-#define WLAN_IS_EPPING_IRQ(x)           (x & WLAN_EPPING_IRQ_BIT)
+#define WLAN_IS_EPPING_ENABLED(x)       (x == QDF_GLOBAL_EPPING_MODE)
+#define WLAN_IS_EPPING_IRQ(x)            1
 #define WLAN_IS_EPPING_FW_UART(x)       (x & WLAN_EPPING_FW_UART_BIT)
 
 /* epping_main signatures */
diff --git a/core/utils/epping/src/epping_rx.c b/core/utils/epping/src/epping_rx.c
index 2718e64e5a32..81e74d3daba1 100644
--- a/core/utils/epping/src/epping_rx.c
+++ b/core/utils/epping/src/epping_rx.c
@@ -142,6 +142,7 @@ void epping_rx(void *ctx, HTC_PACKET *pPacket)
 			pktSkb->protocol = eth_type_trans(pktSkb, pktSkb->dev);
 			++pAdapter->stats.rx_packets;
 			pAdapter->stats.rx_bytes += pktSkb->len;
+			qdf_net_buf_debug_release_skb(pktSkb);
 			if (hdd_napi_enabled(HDD_NAPI_ANY))
 				netif_receive_skb(pktSkb);
 			else
diff --git a/core/utils/epping/src/epping_tx.c b/core/utils/epping/src/epping_tx.c
index ffcf8df36b2e..0954bf2bb2dc 100644
--- a/core/utils/epping/src/epping_tx.c
+++ b/core/utils/epping/src/epping_tx.c
@@ -375,7 +375,7 @@ void epping_tx_complete_multiple(void *ctx, HTC_PACKET_QUEUE *pPacketQueue)
 		pktSkb = qdf_nbuf_queue_remove(&skb_queue);
 		if (pktSkb == NULL)
 			break;
-		qdf_nbuf_free(pktSkb);
+		qdf_nbuf_tx_free(pktSkb, QDF_NBUF_PKT_ERROR);
 		pEpping_ctx->total_tx_acks++;
 	}
 
diff --git a/core/wma/inc/wma.h b/core/wma/inc/wma.h
index bf5933a1a82f..e9553ffe94f6 100644
--- a/core/wma/inc/wma.h
+++ b/core/wma/inc/wma.h
@@ -54,8 +54,8 @@
 
 /* Private */
 
-#define WMA_READY_EVENTID_TIMEOUT          2000
-#define WMA_SERVICE_READY_EXT_TIMEOUT      2000
+#define WMA_READY_EVENTID_TIMEOUT          6000
+#define WMA_SERVICE_READY_EXT_TIMEOUT      6000
 #define WMA_TGT_SUSPEND_COMPLETE_TIMEOUT   6000
 #define WMA_WAKE_LOCK_TIMEOUT              1000
 #define WMA_RESUME_TIMEOUT                 6000
@@ -800,6 +800,7 @@ typedef struct {
  * @vht_capable: VHT capablity flag
  * @ht_capable: HT capablity flag
  * @mhz: channel frequency in KHz
+ * @chan_width: channel bandwidth
  * @vdev_up: is vdev up or not
  * @tsfadjust: TSF adjust
  * @addBssStaContext: add bss context
@@ -863,6 +864,7 @@ struct wma_txrx_node {
 	uint8_t vht_capable;
 	uint8_t ht_capable;
 	A_UINT32 mhz;
+	enum phy_ch_width chan_width;
 	bool vdev_up;
 	uint64_t tsfadjust;
 	void *addBssStaContext;
@@ -1337,7 +1339,8 @@ typedef struct {
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 	void (*csr_roam_synch_cb)(tpAniSirGlobal mac,
 		roam_offload_synch_ind *roam_synch_data,
-		tpSirBssDescription  bss_desc_ptr, uint8_t reason);
+		tpSirBssDescription  bss_desc_ptr,
+		enum sir_roam_op_code reason);
 	QDF_STATUS (*pe_roam_synch_cb)(tpAniSirGlobal mac,
 		roam_offload_synch_ind *roam_synch_data,
 		tpSirBssDescription  bss_desc_ptr);
diff --git a/core/wma/inc/wma_api.h b/core/wma/inc/wma_api.h
index f97eb1b6b6b1..cec1e1e705ab 100644
--- a/core/wma/inc/wma_api.h
+++ b/core/wma/inc/wma_api.h
@@ -223,6 +223,11 @@ int wma_lro_init(struct wma_lro_config_cmd_t *lro_config);
 #endif
 bool wma_is_scan_simultaneous_capable(void);
 
+QDF_STATUS wma_remove_beacon_filter(WMA_HANDLE wma,
+				struct beacon_filter_param *filter_params);
+
+QDF_STATUS wma_add_beacon_filter(WMA_HANDLE wma,
+				struct beacon_filter_param *filter_params);
 #ifdef FEATURE_GREEN_AP
 void wma_setup_egap_support(struct wma_tgt_cfg *tgt_cfg, WMA_HANDLE handle);
 void wma_register_egap_event_handle(WMA_HANDLE handle);
diff --git a/core/wma/inc/wma_if.h b/core/wma/inc/wma_if.h
index 831a9058023f..ea7be4ba6d09 100644
--- a/core/wma/inc/wma_if.h
+++ b/core/wma/inc/wma_if.h
@@ -659,9 +659,6 @@ typedef struct {
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
 
-#ifndef OEM_DATA_REQ_SIZE
-#define OEM_DATA_REQ_SIZE 280
-#endif
 #ifndef OEM_DATA_RSP_SIZE
 #define OEM_DATA_RSP_SIZE 1724
 #endif
diff --git a/core/wma/inc/wma_internal.h b/core/wma/inc/wma_internal.h
index 6d2dd9acb7fc..42c2c9d6fe3f 100644
--- a/core/wma/inc/wma_internal.h
+++ b/core/wma/inc/wma_internal.h
@@ -119,6 +119,9 @@
 #define MAX_ENTRY_HOLD_REQ_QUEUE 2
 #define MAX_ENTRY_VDEV_RESP_QUEUE 10
 
+/* Time(in ms) to detect DOS attack */
+#define WMA_MGMT_FRAME_DETECT_DOS_TIMER 1000
+
 /**
  * struct index_data_rate_type - non vht data rate type
  * @mcs_index: mcs rate index
diff --git a/core/wma/inc/wma_types.h b/core/wma/inc/wma_types.h
index d58167928c1d..c82cfa033a33 100644
--- a/core/wma/inc/wma_types.h
+++ b/core/wma/inc/wma_types.h
@@ -464,6 +464,8 @@
 #define WMA_LRO_CONFIG_CMD                   SIR_HAL_LRO_CONFIG_CMD
 #define WMA_GW_PARAM_UPDATE_REQ              SIR_HAL_GATEWAY_PARAM_UPDATE_REQ
 #define WMA_SET_EGAP_CONF_PARAMS             SIR_HAL_SET_EGAP_CONF_PARAMS
+#define WMA_ADD_BCN_FILTER_CMDID             SIR_HAL_ADD_BCN_FILTER_CMDID
+#define WMA_REMOVE_BCN_FILTER_CMDID          SIR_HAL_REMOVE_BCN_FILTER_CMDID
 
 /* Bit 6 will be used to control BD rate for Management frames */
 #define HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME 0x40
@@ -702,7 +704,8 @@ QDF_STATUS wma_register_roaming_callbacks(void *cds_ctx,
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 		void (*csr_roam_synch_cb)(tpAniSirGlobal mac,
 			roam_offload_synch_ind *roam_synch_data,
-			tpSirBssDescription  bss_desc_ptr, uint8_t reason),
+			tpSirBssDescription  bss_desc_ptr,
+			enum sir_roam_op_code reason),
 		QDF_STATUS (*pe_roam_synch_cb)(tpAniSirGlobal mac,
 			roam_offload_synch_ind *roam_synch_data,
 			tpSirBssDescription  bss_desc_ptr));
@@ -710,7 +713,8 @@ QDF_STATUS wma_register_roaming_callbacks(void *cds_ctx,
 static inline QDF_STATUS wma_register_roaming_callbacks(void *cds_ctx,
 		void (*csr_roam_synch_cb)(tpAniSirGlobal mac,
 			roam_offload_synch_ind *roam_synch_data,
-			tpSirBssDescription  bss_desc_ptr, uint8_t reason),
+			tpSirBssDescription  bss_desc_ptr,
+			enum sir_roam_op_code reason),
 		QDF_STATUS (*pe_roam_synch_cb)(tpAniSirGlobal mac,
 			roam_offload_synch_ind *roam_synch_data,
 			tpSirBssDescription  bss_desc_ptr))
diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c
index 18bc5059501f..42ca332a8646 100644
--- a/core/wma/src/wma_data.c
+++ b/core/wma/src/wma_data.c
@@ -1155,8 +1155,7 @@ void wma_set_linkstate(tp_wma_handle wma, tpLinkStateParams params)
 	params->status = true;
 	WMA_LOGD("%s: state %d selfmac %pM", __func__,
 		 params->state, params->selfMacAddr);
-	if ((params->state != eSIR_LINK_PREASSOC_STATE) &&
-	    (params->state != eSIR_LINK_DOWN_STATE)) {
+	if (params->state != eSIR_LINK_PREASSOC_STATE) {
 		WMA_LOGD("%s: unsupported link state %d",
 			 __func__, params->state);
 		goto out;
@@ -1685,6 +1684,16 @@ QDF_STATUS wma_process_init_thermal_info(tp_wma_handle wma,
 	WMA_LOGD("TM enable %d period %d", pThermalParams->thermalMgmtEnabled,
 		 pThermalParams->throttlePeriod);
 
+	WMA_LOGD("Throttle Duty Cycle Level in percentage:\n"
+		 "0 %d\n"
+		 "1 %d\n"
+		 "2 %d\n"
+		 "3 %d",
+		 pThermalParams->throttle_duty_cycle_tbl[0],
+		 pThermalParams->throttle_duty_cycle_tbl[1],
+		 pThermalParams->throttle_duty_cycle_tbl[2],
+		 pThermalParams->throttle_duty_cycle_tbl[3]);
+
 	wma->thermal_mgmt_info.thermalMgmtEnabled =
 		pThermalParams->thermalMgmtEnabled;
 	wma->thermal_mgmt_info.thermalLevels[0].minTempThreshold =
@@ -1721,7 +1730,8 @@ QDF_STATUS wma_process_init_thermal_info(tp_wma_handle wma,
 
 	if (wma->thermal_mgmt_info.thermalMgmtEnabled) {
 		ol_tx_throttle_init_period(curr_pdev,
-					   pThermalParams->throttlePeriod);
+				pThermalParams->throttlePeriod,
+				&pThermalParams->throttle_duty_cycle_tbl[0]);
 
 		/* Get the temperature thresholds to set in firmware */
 		thermal_params.minTemp =
@@ -1992,13 +2002,12 @@ int wma_ibss_peer_info_event_handler(void *handle, uint8_t *data,
 	cds_msg_t cds_msg;
 	wmi_peer_info *peer_info;
 	ol_txrx_pdev_handle pdev;
-	struct ol_txrx_peer_t *peer;
 	tSirIbssPeerInfoParams *pSmeRsp;
 	uint32_t count, num_peers, status;
 	tSirIbssGetPeerInfoRspParams *pRsp;
 	WMI_PEER_INFO_EVENTID_param_tlvs *param_tlvs;
 	wmi_peer_info_event_fixed_param *fix_param;
-	uint8_t peer_mac[IEEE80211_ADDR_LEN], staIdx;
+	uint8_t peer_mac[IEEE80211_ADDR_LEN];
 
 	pdev = cds_get_context(QDF_MODULE_ID_TXRX);
 	if (NULL == pdev) {
@@ -2034,27 +2043,16 @@ int wma_ibss_peer_info_event_handler(void *handle, uint8_t *data,
 
 		WMI_MAC_ADDR_TO_CHAR_ARRAY(&peer_info->peer_mac_address,
 					   peer_mac);
-		peer = ol_txrx_find_peer_by_addr(pdev, peer_mac, &staIdx);
-		if (NULL == peer) {
-			WMA_LOGE("%s: peer 0x:%2x:0x%2x:0x%2x:0x%2x:0x%2x:0x%2x does not"
-				" exist could not populate response", __func__,
-				peer_mac[0], peer_mac[1], peer_mac[2],
-				peer_mac[3], peer_mac[4], peer_mac[5]);
-
-			pSmeRsp->staIdx = 0xff; /*fill invalid staIdx */
-			peer_info++;
-			continue;
-		}
-		pSmeRsp->staIdx = staIdx;
+		qdf_mem_copy(pSmeRsp->mac_addr, peer_mac,
+			sizeof(pSmeRsp->mac_addr));
 		pSmeRsp->mcsIndex = 0;
 		pSmeRsp->rssi = peer_info->rssi + WMA_TGT_NOISE_FLOOR_DBM;
 		pSmeRsp->txRate = peer_info->data_rate;
 		pSmeRsp->txRateFlags = 0;
 
-		WMA_LOGE("%s: peer 0x:%2x:0x%2x:0x%2x:0x%2x:0x%2x:0x%2x staIdx %d "
-			"rssi %d txRate %d", __func__, peer_mac[0], peer_mac[1],
-			peer_mac[2], peer_mac[3], peer_mac[4], peer_mac[5],
-			staIdx, pSmeRsp->rssi, pSmeRsp->txRate);
+		WMA_LOGE("peer " MAC_ADDRESS_STR "rssi %d txRate %d",
+			MAC_ADDR_ARRAY(peer_mac),
+			pSmeRsp->rssi, pSmeRsp->txRate);
 
 		peer_info++;
 	}
diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c
index 8d367b1e1560..7526499d390c 100644
--- a/core/wma/src/wma_dev_if.c
+++ b/core/wma/src/wma_dev_if.c
@@ -1735,6 +1735,7 @@ QDF_STATUS wma_vdev_start(tp_wma_handle wma,
 	intr[params.vdev_id].config.gtx_info.gtxBWMask =
 		CFG_TGT_DEFAULT_GTX_BW_MASK;
 	intr[params.vdev_id].mhz = params.chan_freq;
+	intr[params.vdev_id].chan_width = req->chan_width;
 
 	temp_chan_info &= 0xffffffc0;
 	temp_chan_info |= params.chan_mode;
diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c
index 669854cce0be..fe9d40f56b34 100644
--- a/core/wma/src/wma_features.c
+++ b/core/wma/src/wma_features.c
@@ -802,6 +802,123 @@ QDF_STATUS wma_get_link_speed(WMA_HANDLE handle, tSirLinkSpeedInfo *pLinkSpeed)
 	return QDF_STATUS_SUCCESS;
 }
 
+/**
+* wma_add_beacon_filter() - Issue WMI command to set beacon filter
+* @wma: wma handler
+* @filter_params: beacon_filter_param to set
+*
+* Return: Return QDF_STATUS
+*/
+QDF_STATUS wma_add_beacon_filter(WMA_HANDLE handle,
+				struct beacon_filter_param *filter_params)
+{
+	int i;
+	wmi_buf_t wmi_buf;
+	u_int8_t *buf;
+	A_UINT32 *ie_map;
+	int ret;
+	tp_wma_handle wma = (tp_wma_handle) handle;
+	wmi_add_bcn_filter_cmd_fixed_param *cmd;
+	int len = sizeof(wmi_add_bcn_filter_cmd_fixed_param);
+
+	len += WMI_TLV_HDR_SIZE;
+	len += BCN_FLT_MAX_ELEMS_IE_LIST*sizeof(A_UINT32);
+
+	if (!wma || !wma->wmi_handle) {
+		WMA_LOGE("%s: WMA is closed, can not issue set beacon filter",
+			__func__);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	wmi_buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!wmi_buf) {
+		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
+		return QDF_STATUS_E_NOMEM;
+	}
+
+	buf = (u_int8_t *) wmi_buf_data(wmi_buf);
+
+	cmd = (wmi_add_bcn_filter_cmd_fixed_param *)wmi_buf_data(wmi_buf);
+	cmd->vdev_id = filter_params->vdev_id;
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+			WMITLV_TAG_STRUC_wmi_add_bcn_filter_cmd_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(
+				wmi_add_bcn_filter_cmd_fixed_param));
+
+	buf += sizeof(wmi_add_bcn_filter_cmd_fixed_param);
+
+	WMITLV_SET_HDR(buf, WMITLV_TAG_ARRAY_UINT32,
+			(BCN_FLT_MAX_ELEMS_IE_LIST * sizeof(u_int32_t)));
+
+	ie_map = (A_UINT32 *)(buf + WMI_TLV_HDR_SIZE);
+	for (i = 0; i < BCN_FLT_MAX_ELEMS_IE_LIST; i++) {
+		ie_map[i] = filter_params->ie_map[i];
+		WMA_LOGD("beacon filter ie map = %u", ie_map[i]);
+	}
+
+	ret = wmi_unified_cmd_send(wma->wmi_handle, wmi_buf, len,
+			WMI_ADD_BCN_FILTER_CMDID);
+	if (ret) {
+		WMA_LOGE("Failed to send wmi add beacon filter = %d",
+				ret);
+		wmi_buf_free(wmi_buf);
+		return QDF_STATUS_E_FAILURE;
+	}
+	WMA_LOGD("added beacon filter = %d", ret);
+
+	return QDF_STATUS_SUCCESS;
+}
+
+/**
+* wma_remove_beacon_filter() - Issue WMI command to remove beacon filter
+* @wma: wma handler
+* @filter_params: beacon_filter_params
+*
+* Return: Return QDF_STATUS
+*/
+QDF_STATUS wma_remove_beacon_filter(WMA_HANDLE handle,
+				struct beacon_filter_param *filter_params)
+{
+	wmi_buf_t buf;
+	tp_wma_handle wma = (tp_wma_handle) handle;
+	wmi_rmv_bcn_filter_cmd_fixed_param *cmd;
+	int len = sizeof(wmi_rmv_bcn_filter_cmd_fixed_param);
+	int ret;
+
+	if (!wma || !wma->wmi_handle) {
+		WMA_LOGE("%s: WMA is closed, cannot issue remove beacon filter",
+			__func__);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
+		return QDF_STATUS_E_NOMEM;
+	}
+	cmd = (wmi_rmv_bcn_filter_cmd_fixed_param *)wmi_buf_data(buf);
+	cmd->vdev_id = filter_params->vdev_id;
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+			WMITLV_TAG_STRUC_wmi_rmv_bcn_filter_cmd_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(
+				wmi_rmv_bcn_filter_cmd_fixed_param));
+
+	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+			WMI_RMV_BCN_FILTER_CMDID);
+	if (ret) {
+		WMA_LOGE("Failed to send wmi remove beacon filter = %d",
+				ret);
+		wmi_buf_free(buf);
+		return QDF_STATUS_E_FAILURE;
+	}
+	WMA_LOGD("removed beacon filter = %d", ret);
+
+	return QDF_STATUS_SUCCESS;
+}
+
+
 #ifdef FEATURE_GREEN_AP
 
 /**
@@ -1254,7 +1371,7 @@ int wma_oem_capability_event_callback(void *handle,
 	}
 
 	/*
-	 *  wma puts 4 bytes prefix for msg subtype, so length
+	 * wma puts 4 bytes prefix for msg subtype, so length
 	 * of data received from target should be 4 bytes less
 	 * then max allowed
 	 */
@@ -1269,12 +1386,21 @@ int wma_oem_capability_event_callback(void *handle,
 		WMA_LOGE("%s: Failed to alloc pStartOemDataRsp", __func__);
 		return -ENOMEM;
 	}
+
 	pStartOemDataRsp->rsp_len = datalen + OEM_MESSAGE_SUBTYPE_LEN;
-	pStartOemDataRsp->oem_data_rsp = qdf_mem_malloc(datalen);
-	if (!pStartOemDataRsp->oem_data_rsp) {
-		WMA_LOGE(FL("malloc failed for oem_data_rsp"));
+	if (pStartOemDataRsp->rsp_len) {
+		pStartOemDataRsp->oem_data_rsp =
+				qdf_mem_malloc(pStartOemDataRsp->rsp_len);
+		if (!pStartOemDataRsp->oem_data_rsp) {
+			WMA_LOGE(FL("malloc failed for oem_data_rsp"));
+			qdf_mem_free(pStartOemDataRsp);
+			return -ENOMEM;
+		}
+	} else {
+		WMA_LOGE(FL("Invalid rsp length: %d"),
+			 pStartOemDataRsp->rsp_len);
 		qdf_mem_free(pStartOemDataRsp);
-		return -ENOMEM;
+		return -EINVAL;
 	}
 
 	pStartOemDataRsp->target_rsp = true;
@@ -1340,12 +1466,21 @@ int wma_oem_measurement_report_event_callback(void *handle,
 		WMA_LOGE("%s: Failed to alloc pStartOemDataRsp", __func__);
 		return -ENOMEM;
 	}
+
 	pStartOemDataRsp->rsp_len = datalen + OEM_MESSAGE_SUBTYPE_LEN;
-	pStartOemDataRsp->oem_data_rsp = qdf_mem_malloc(datalen);
-	if (!pStartOemDataRsp->oem_data_rsp) {
-		WMA_LOGE(FL("malloc failed for oem_data_rsp"));
+	if (pStartOemDataRsp->rsp_len) {
+		pStartOemDataRsp->oem_data_rsp =
+				qdf_mem_malloc(pStartOemDataRsp->rsp_len);
+		if (!pStartOemDataRsp->oem_data_rsp) {
+			WMA_LOGE(FL("malloc failed for oem_data_rsp"));
+			qdf_mem_free(pStartOemDataRsp);
+			return -ENOMEM;
+		}
+	} else {
+		WMA_LOGE(FL("Invalid rsp length: %d"),
+			 pStartOemDataRsp->rsp_len);
 		qdf_mem_free(pStartOemDataRsp);
-		return -ENOMEM;
+		return -EINVAL;
 	}
 
 	pStartOemDataRsp->target_rsp = true;
@@ -1353,10 +1488,10 @@ int wma_oem_measurement_report_event_callback(void *handle,
 	*msg_subtype = WMI_OEM_MEASUREMENT_RSP;
 	/* copy data after msg sub type */
 	qdf_mem_copy(pStartOemDataRsp->oem_data_rsp + OEM_MESSAGE_SUBTYPE_LEN,
-		     data, pStartOemDataRsp->rsp_len);
+		     data, datalen);
 
 	WMA_LOGI("%s: Sending WMA_START_OEM_DATA_RSP, data len (%d)",
-		 __func__, datalen);
+		 __func__, pStartOemDataRsp->rsp_len);
 
 	wma_send_msg(wma, WMA_START_OEM_DATA_RSP, (void *)pStartOemDataRsp, 0);
 	return 0;
@@ -1410,12 +1545,21 @@ int wma_oem_error_report_event_callback(void *handle,
 		WMA_LOGE("%s: Failed to alloc pStartOemDataRsp", __func__);
 		return -ENOMEM;
 	}
+
 	pStartOemDataRsp->rsp_len = datalen + OEM_MESSAGE_SUBTYPE_LEN;
-	pStartOemDataRsp->oem_data_rsp = qdf_mem_malloc(datalen);
-	if (!pStartOemDataRsp->oem_data_rsp) {
-		WMA_LOGE(FL("malloc failed for oem_data_rsp"));
+	if (pStartOemDataRsp->rsp_len) {
+		pStartOemDataRsp->oem_data_rsp =
+				qdf_mem_malloc(pStartOemDataRsp->rsp_len);
+		if (!pStartOemDataRsp->oem_data_rsp) {
+			WMA_LOGE(FL("malloc failed for oem_data_rsp"));
+			qdf_mem_free(pStartOemDataRsp);
+			return -ENOMEM;
+		}
+	} else {
+		WMA_LOGE(FL("Invalid rsp length: %d"),
+			 pStartOemDataRsp->rsp_len);
 		qdf_mem_free(pStartOemDataRsp);
-		return -ENOMEM;
+		return -EINVAL;
 	}
 
 	pStartOemDataRsp->target_rsp = true;
@@ -1423,10 +1567,10 @@ int wma_oem_error_report_event_callback(void *handle,
 	*msg_subtype = WMI_OEM_ERROR_REPORT_RSP;
 	/* copy data after msg sub type */
 	qdf_mem_copy(pStartOemDataRsp->oem_data_rsp + OEM_MESSAGE_SUBTYPE_LEN,
-		     data, pStartOemDataRsp->rsp_len);
+		     data, datalen);
 
 	WMA_LOGI("%s: Sending WMA_START_OEM_DATA_RSP, data len (%d)",
-		 __func__, datalen);
+		 __func__, pStartOemDataRsp->rsp_len);
 
 	wma_send_msg(wma, WMA_START_OEM_DATA_RSP, (void *)pStartOemDataRsp, 0);
 	return 0;
@@ -1475,11 +1619,18 @@ int wma_oem_data_response_handler(void *handle,
 		return -ENOMEM;
 	}
 	oem_rsp->rsp_len = datalen;
-	oem_rsp->oem_data_rsp = qdf_mem_malloc(datalen);
-	if (!oem_rsp->rsp_len) {
-		WMA_LOGE(FL("malloc failed for oem_data_rsp"));
+	if (oem_rsp->rsp_len) {
+		oem_rsp->oem_data_rsp = qdf_mem_malloc(oem_rsp->rsp_len);
+		if (!oem_rsp->oem_data_rsp) {
+			WMA_LOGE(FL("malloc failed for oem_data_rsp"));
+			qdf_mem_free(oem_rsp);
+			return -ENOMEM;
+		}
+	} else {
+		WMA_LOGE(FL("Invalid rsp length: %d"),
+			 oem_rsp->rsp_len);
 		qdf_mem_free(oem_rsp);
-		return -ENOMEM;
+		return -EINVAL;
 	}
 
 	oem_rsp->target_rsp = true;
@@ -4013,6 +4164,53 @@ static QDF_STATUS wma_add_clear_mcbc_filter(tp_wma_handle wma_handle,
 }
 
 /**
+ * wma_config_enhance_multicast_offload() - config enhance multicast offload
+ * @wma_handle: wma handle
+ * @vdev_id: vdev id
+ * @action: enable or disable enhance multicast offload
+ *
+ * Return: none
+ */
+static void wma_config_enhance_multicast_offload(tp_wma_handle wma_handle,
+						uint8_t vdev_id,
+						uint8_t action)
+{
+	int status;
+	wmi_buf_t buf;
+	wmi_config_enhanced_mcast_filter_cmd_fixed_param *cmd;
+
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, sizeof(*cmd));
+	if (!buf) {
+		WMA_LOGE("Failed to allocate buffer to send set key cmd");
+		return;
+	}
+
+	cmd = (wmi_config_enhanced_mcast_filter_cmd_fixed_param *)
+							wmi_buf_data(buf);
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		 WMITLV_TAG_STRUC_wmi_config_enhanced_mcast_filter_fixed_param,
+		 WMITLV_GET_STRUCT_TLVLEN(wmi_config_enhanced_mcast_filter_cmd_fixed_param));
+
+	cmd->vdev_id = vdev_id;
+	cmd->enable = ((0 == action) ? ENHANCED_MCAST_FILTER_DISABLED :
+			ENHANCED_MCAST_FILTER_ENABLED);
+
+	WMA_LOGD("%s: config enhance multicast offload action %d for vdev %d",
+		__func__, action, vdev_id);
+
+	status = wmi_unified_cmd_send(wma_handle->wmi_handle, buf,
+			sizeof(*cmd), WMI_CONFIG_ENHANCED_MCAST_FILTER_CMDID);
+	if (status) {
+		qdf_nbuf_free(buf);
+		WMA_LOGE("%s:Failed to send WMI_CONFIG_ENHANCED_MCAST_FILTER_CMDID",
+			__func__);
+	}
+
+	return;
+}
+
+/**
  * wma_process_mcbc_set_filter_req() - process mcbc set filter request
  * @wma_handle: wma handle
  * @mcbc_param: mcbc params
@@ -4036,6 +4234,21 @@ QDF_STATUS wma_process_mcbc_set_filter_req(tp_wma_handle wma_handle,
 			 mcbc_param->bssid.bytes);
 		return QDF_STATUS_E_FAILURE;
 	}
+
+	/*
+	 * Configure enhance multicast offload feature for filtering out
+	 * multicast IP data packets transmitted using unicast MAC address
+	 */
+	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+		WMI_SERVICE_ENHANCED_MCAST_FILTER)) {
+		WMA_LOGD("%s: FW supports enhance multicast offload", __func__);
+		wma_config_enhance_multicast_offload(wma_handle, vdev_id,
+			mcbc_param->action);
+	} else {
+		WMA_LOGD("%s: FW does not support enhance multicast offload",
+		__func__);
+	}
+
 	/* set mcbc_param->action to clear MCList and reset
 	 * to configure the MCList in FW
 	 */
@@ -6138,9 +6351,12 @@ struct dfs_ieee80211_channel *wma_dfs_configure_channel(
 		dfs_ic->ic_curchan->ic_ieee_ext = ext_channel;
 
 		/* verify both the 80MHz are DFS bands or not */
-		if (CHANNEL_STATE_DFS == cds_get_channel_state(req->chan) &&
-		    CHANNEL_STATE_DFS == cds_get_channel_state(ext_channel -
-						WMA_80MHZ_START_CENTER_CH_DIFF))
+		if ((CHANNEL_STATE_DFS ==
+		     cds_get_5g_bonded_channel_state(req->chan ,
+						     CH_WIDTH_80MHZ)) &&
+		    (CHANNEL_STATE_DFS == cds_get_5g_bonded_channel_state(
+			    ext_channel - WMA_80MHZ_START_CENTER_CH_DIFF,
+			    CH_WIDTH_80MHZ)))
 			dfs_ic->ic_curchan->ic_80p80_both_dfs = true;
 		break;
 	case CH_WIDTH_160MHZ:
diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c
index cafc91be6143..06e5da0b548a 100644
--- a/core/wma/src/wma_main.c
+++ b/core/wma/src/wma_main.c
@@ -5250,6 +5250,15 @@ QDF_STATUS wma_mc_process_msg(void *cds_context, cds_msg_t *msg)
 			(struct obss_ht40_scanind *)msg->bodyptr);
 		qdf_mem_free(msg->bodyptr);
 		break;
+	case WMA_ADD_BCN_FILTER_CMDID:
+		wma_add_beacon_filter(wma_handle, msg->bodyptr);
+		qdf_mem_free(msg->bodyptr);
+		break;
+	case WMA_REMOVE_BCN_FILTER_CMDID:
+		wma_remove_beacon_filter(wma_handle, msg->bodyptr);
+		qdf_mem_free(msg->bodyptr);
+		break;
+
 	default:
 		WMA_LOGD("unknow msg type %x", msg->type);
 		/* Do Nothing? MSG Body should be freed at here */
diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c
index 38dcfaf93b31..e9fe6441471c 100644
--- a/core/wma/src/wma_mgmt.c
+++ b/core/wma/src/wma_mgmt.c
@@ -2859,6 +2859,96 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle,
 #endif
 
 /**
+ * wma_is_pkt_drop_candidate() - check if the mgmt frame should be droppped
+ * @wma_handle: wma handle
+ * @peer_addr: peer MAC address
+ * @subtype: Management frame subtype
+ *
+ * This function is used to decide if a particular management frame should be
+ * dropped to prevent DOS attack. Timestamp is used to decide the DOS attack.
+ *
+ * Return: true if the packet should be dropped and false oterwise
+ */
+static bool wma_is_pkt_drop_candidate(tp_wma_handle wma_handle,
+				      uint8_t *peer_addr, uint8_t subtype)
+{
+	struct ol_txrx_peer_t *peer;
+	struct ol_txrx_pdev_t *pdev_ctx;
+	uint8_t peer_id;
+	bool should_drop = false;
+
+	/*
+	 * Currently this function handles only Disassoc,
+	 * Deauth and Assoc req frames. Return false for
+	 * all other frames.
+	 */
+	if (subtype != IEEE80211_FC0_SUBTYPE_DISASSOC &&
+	    subtype != IEEE80211_FC0_SUBTYPE_DEAUTH &&
+	    subtype != IEEE80211_FC0_SUBTYPE_ASSOC_REQ) {
+		should_drop = false;
+		goto end;
+	}
+
+	pdev_ctx = cds_get_context(QDF_MODULE_ID_TXRX);
+	if (!pdev_ctx) {
+		WMA_LOGE(FL("Failed to get the context"));
+		should_drop = true;
+		goto end;
+	}
+
+	peer = ol_txrx_find_peer_by_addr(pdev_ctx, peer_addr, &peer_id);
+	if (!peer) {
+		if (SIR_MAC_MGMT_ASSOC_REQ != subtype) {
+			WMA_LOGI(
+			   FL("Received mgmt frame: %0x from unknow peer: %pM"),
+			   subtype, peer_addr);
+			should_drop = true;
+		}
+		goto end;
+	}
+
+	switch (subtype) {
+	case SIR_MAC_MGMT_ASSOC_REQ:
+		if (peer->last_assoc_rcvd) {
+			if (qdf_get_system_timestamp() - peer->last_assoc_rcvd <
+				WMA_MGMT_FRAME_DETECT_DOS_TIMER) {
+				    WMA_LOGI(FL("Dropping Assoc Req received"));
+				    should_drop = true;
+			}
+		}
+		peer->last_assoc_rcvd = qdf_get_system_timestamp();
+		break;
+	case SIR_MAC_MGMT_DISASSOC:
+		if (peer->last_disassoc_rcvd) {
+			if (qdf_get_system_timestamp() -
+				peer->last_disassoc_rcvd <
+				WMA_MGMT_FRAME_DETECT_DOS_TIMER) {
+				    WMA_LOGI(FL("Dropping DisAssoc received"));
+				    should_drop = true;
+			}
+		}
+		peer->last_disassoc_rcvd = qdf_get_system_timestamp();
+		break;
+	case SIR_MAC_MGMT_DEAUTH:
+		if (peer->last_deauth_rcvd) {
+			if (qdf_get_system_timestamp() -
+				peer->last_deauth_rcvd <
+				WMA_MGMT_FRAME_DETECT_DOS_TIMER) {
+				    WMA_LOGI(FL("Dropping Deauth received"));
+				    should_drop = true;
+			}
+		}
+		peer->last_deauth_rcvd = qdf_get_system_timestamp();
+		break;
+	default:
+		break;
+	}
+
+end:
+	return should_drop;
+}
+
+/**
  * wma_mgmt_rx_process() - process management rx frame.
  * @handle: wma handle
  * @data: rx data
@@ -3028,6 +3118,12 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data,
 #endif /* WLAN_FEATURE_11W */
 	rx_pkt->pkt_meta.sessionId =
 		(vdev_id == WMA_INVALID_VDEV_ID ? 0 : vdev_id);
+
+	if (wma_is_pkt_drop_candidate(wma_handle, wh->i_addr2, mgt_subtype)) {
+		cds_pkt_return_packet(rx_pkt);
+		return -EINVAL;
+	}
+
 	wma_handle->mgmt_rx(wma_handle, rx_pkt);
 	return 0;
 }
@@ -3077,7 +3173,8 @@ QDF_STATUS wma_de_register_mgmt_frm_client(void *cds_ctx)
 QDF_STATUS wma_register_roaming_callbacks(void *cds_ctx,
 	void (*csr_roam_synch_cb)(tpAniSirGlobal mac,
 		roam_offload_synch_ind *roam_synch_data,
-		tpSirBssDescription  bss_desc_ptr, uint8_t reason),
+		tpSirBssDescription  bss_desc_ptr,
+		enum sir_roam_op_code reason),
 	QDF_STATUS (*pe_roam_synch_cb)(tpAniSirGlobal mac,
 		roam_offload_synch_ind *roam_synch_data,
 		tpSirBssDescription  bss_desc_ptr))
diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c
index 6f776835d919..78d57ac32921 100644
--- a/core/wma/src/wma_scan_roam.c
+++ b/core/wma/src/wma_scan_roam.c
@@ -1883,7 +1883,7 @@ void wma_fill_roam_synch_buffer(tp_wma_handle wma,
 	WMI_MAC_ADDR_TO_CHAR_ARRAY(&synch_event->bssid,
 				   roam_synch_ind_ptr->bssid.bytes);
 	wma->csr_roam_synch_cb((tpAniSirGlobal)wma->mac_context,
-		roam_synch_ind_ptr, NULL, ROAMING_TX_QUEUE_DISABLE);
+		roam_synch_ind_ptr, NULL, SIR_ROAMING_DEREGISTER_STA);
 	/* Beacon/Probe Rsp data */
 	roam_synch_ind_ptr->beaconProbeRespOffset =
 		sizeof(roam_offload_synch_ind);
@@ -2088,7 +2088,7 @@ int wma_roam_synch_event_handler(void *handle, uint8_t *event,
 			roam_synch_ind_ptr, bss_desc_ptr);
 	wma_roam_update_vdev(wma, roam_synch_ind_ptr);
 	wma->csr_roam_synch_cb((tpAniSirGlobal)wma->mac_context,
-		roam_synch_ind_ptr, bss_desc_ptr, ROAM_SYNCH_PROPAGATION);
+		roam_synch_ind_ptr, bss_desc_ptr, SIR_ROAM_SYNCH_PROPAGATION);
 	wma_process_roam_synch_complete(wma, synch_event->vdev_id);
 cleanup_label:
 	if (roam_synch_ind_ptr->join_rsp)
@@ -2380,7 +2380,6 @@ void wma_process_unit_test_cmd(WMA_HANDLE handle,
 }
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-
 /**
  * wma_roam_ho_fail_handler() - LFR3.0 roam hand off failed handler
  * @wma: wma handle
@@ -3173,7 +3172,7 @@ int wma_nlo_scan_cmp_evt_handler(void *handle, uint8_t *event,
 				WIFI_POWER_EVENT_WAKELOCK_PNO);
 		qdf_mem_zero(scan_event, sizeof(tSirScanOffloadEvent));
 		scan_event->reasonCode = eSIR_PNO_SCAN_SUCCESS;
-		scan_event->event = LIM_SCAN_EVENT_COMPLETED;
+		scan_event->event = SIR_SCAN_EVENT_COMPLETED;
 		scan_event->sessionId = nlo_event->vdev_id;
 		wma_send_msg(wma, WMA_RX_SCAN_EVENT, (void *)scan_event, 0);
 	} else {
@@ -5248,7 +5247,7 @@ int wma_scan_event_callback(WMA_HANDLE handle, uint8_t *data,
 	if (scan_event->scanId ==
 		wma_handle->interfaces[vdev_id].p2p_scan_info.scan_id) {
 		scan_event->p2pScanType = P2P_SCAN_TYPE_LISTEN;
-		if  (scan_event->event == LIM_SCAN_EVENT_COMPLETED)
+		if  (scan_event->event == SIR_SCAN_EVENT_COMPLETED)
 			wma_reset_p2p_scan_info(wma_handle, vdev_id);
 	}
 	scan_event->sessionId = vdev_id;
@@ -5286,7 +5285,7 @@ int wma_scan_event_callback(WMA_HANDLE handle, uint8_t *data,
 
 	/* Stop scan completion timeout if event is WMI_SCAN_EVENT_COMPLETED */
 	if (scan_event->event ==
-			(enum lim_scan_event_type) WMI_SCAN_EVENT_COMPLETED) {
+			(enum sir_scan_event_type) WMI_SCAN_EVENT_COMPLETED) {
 		WMA_LOGE("scan complete:scan_id 0x%x, requestor 0x%x, vdev %d",
 			 wmi_event->scan_id, wmi_event->requestor, vdev_id);
 	}
@@ -5367,6 +5366,8 @@ int wma_roam_event_callback(WMA_HANDLE handle, uint8_t *event_buf,
 	tp_wma_handle wma_handle = (tp_wma_handle) handle;
 	WMI_ROAM_EVENTID_param_tlvs *param_buf;
 	wmi_roam_event_fixed_param *wmi_event;
+	struct sSirSmeRoamOffloadSynchInd *roam_synch_data;
+	enum sir_roam_op_code op_code = {0};
 
 	param_buf = (WMI_ROAM_EVENTID_param_tlvs *) event_buf;
 	if (!param_buf) {
@@ -5375,9 +5376,9 @@ int wma_roam_event_callback(WMA_HANDLE handle, uint8_t *event_buf,
 	}
 
 	wmi_event = param_buf->fixed_param;
-	WMA_LOGD("%s: Reason %x for vdevid %x, rssi %d",
-		 __func__, wmi_event->reason, wmi_event->vdev_id,
-		 wmi_event->rssi);
+	WMA_LOGD("%s: Reason %x, Notif %x for vdevid %x, rssi %d",
+		 __func__, wmi_event->reason, wmi_event->notif,
+		 wmi_event->vdev_id, wmi_event->rssi);
 
 	switch (wmi_event->reason) {
 	case WMI_ROAM_REASON_BMISS:
@@ -5403,6 +5404,22 @@ int wma_roam_event_callback(WMA_HANDLE handle, uint8_t *event_buf,
 		wma_roam_ho_fail_handler(wma_handle, wmi_event->vdev_id);
 		break;
 #endif
+	case WMI_ROAM_REASON_INVALID:
+		roam_synch_data = qdf_mem_malloc(sizeof(*roam_synch_data));
+		if (NULL == roam_synch_data) {
+			WMA_LOGE("Memory unavailable for roam synch data");
+			return -ENOMEM;
+		}
+		if (wmi_event->notif == WMI_ROAM_NOTIF_ROAM_START)
+			op_code = SIR_ROAMING_TX_QUEUE_DISABLE;
+		if (wmi_event->notif == WMI_ROAM_NOTIF_ROAM_ABORT)
+			op_code = SIR_ROAMING_TX_QUEUE_ENABLE;
+		roam_synch_data->roamedVdevId = wmi_event->vdev_id;
+		wma_handle->csr_roam_synch_cb(
+				(tpAniSirGlobal)wma_handle->mac_context,
+				roam_synch_data, NULL, op_code);
+		qdf_mem_free(roam_synch_data);
+		break;
 	default:
 		WMA_LOGD("%s:Unhandled Roam Event %x for vdevid %x", __func__,
 			 wmi_event->reason, wmi_event->vdev_id);
diff --git a/target/inc/dbglog_id.h b/target/inc/dbglog_id.h
index e6855e74e30b..03bd4b6a8795 100644
--- a/target/inc/dbglog_id.h
+++ b/target/inc/dbglog_id.h
@@ -615,7 +615,8 @@ extern "C" {
 #define SCAN_SEND_PROBE_REQ_INFO                    45
 #define SCAN_SM_CANCEL                              46
 #define SCAN_SM_PROBE_REQ_FRAME_SEND_FAILED         47
-#define SCAN_DBGID_DEFINITION_END                   48
+#define SCAN_SCH_BANNED_MODULE                      48
+#define SCAN_DBGID_DEFINITION_END                   49
 
 #define BEACON_EVENT_SWBA_SEND_FAILED               0
 #define BEACON_EVENT_EARLY_RX_BMISS_STATUS          1
@@ -1245,7 +1246,9 @@ extern "C" {
 #define WLAN_STATS_DBGID_EST_LINKSPEED_CHAN_TIME_END     3
 #define WLAN_STATS_DBGID_EST_LINKSPEED_CALC              4
 #define WLAN_STATS_DBGID_EST_LINKSPEED_UPDATE_HOME_CHAN  5
-#define WLAN_STATS_DBGID_DEFINITION_END                  6
+#define WLAN_STATS_DBGID_RSSI                            6
+#define WLAN_STATS_DBGID_CNE_RSSI                        7
+#define WLAN_STATS_DBGID_DEFINITION_END                  8
 /* NAN DBGIDs */
 #define NAN_DBGID_START                             0
 
@@ -1568,6 +1571,44 @@ extern "C" {
 #define EXTSCAN_CONFIG_WLAN_CHANGE_TABLE                40
 #define EXTSCAN_EVENT_SEND_FAILED                       41
 
+/* ERE DBGIDs */
+#define ERE_DBGID_DEFINITION_START                       0
+#define ERE_DBGID_VDEV_ATTACH                            1
+#define ERE_DBGID_VDEV_DETACH                            2
+#define ERE_DBGID_ENABLE_CMD                             3
+#define ERE_DBGID_STATUS_ENABLED                         4
+#define ERE_DBGID_STATUS_DISABLED                        5
+#define ERE_DBGID_ISROUTE_TABLE_EMPTY                    6
+#define ERE_DBGID_HASH_VALUE                             7
+#define ERE_DBGID_MATCH_REQ                              8
+#define ERE_DBGID_ADD_ROUTE_DBG                          9
+#define ERE_DBGID_ADD_ROUTE_ENTRY                       10
+#define ERE_DBGID_STATS_TX                              11
+#define ERE_DBGID_STATS_RX                              12
+#define ERE_DBGID_DEFINITION_END                        13
+/* IDs 14 - 251 reserved for ERE */
+
+/* Timekeeper debug IDs */
+#define TIMEKEEPER_INIT                                 252
+#define TIMEKEEPER_OPEN                                 253
+#define TIMEKEEPER_CLOSE                                254
+#define TIMEKEEPER_NEGOTIATE                            255
+#define TIMEKEEPER_TMR_HNDLR                            256
+#define TIMEKEEPER_UNITTEST                             257
+#define TIMEKEEPER_LF_TMR_HNDLR                         258
+#define TIMEKEEPER_DEINIT                               259
+#define TIMEKEEPER_SLOTBITMAP                           260
+#define TIMEKEEPER_CANCEL_SLOTBITMAP                    261
+#define TIMEKEEPER_CONFIRM_SLOTBITMAP                   262
+#define TIMEKEEPER_RESOLVE_SLOTBITMAP                   263
+#define TIMEKEEPER_ADD_CHAN_ELEMENT                     264
+#define TIMEKEEPER_REMOVE_CHAN_ELEMENT                  265
+#define TIMEKEEPER_FIND_CHAN_ELEMENT                    266
+#define TIMEKEEPER_QUERY_COMMITTED_SLOTBITMAP           267
+#define TIMEKEEPER_ENCODE_SLOTBITMAP                    268
+#define TIMEKEEPER_SLOT_ARRAY_DBG                       269
+#define TIMEKEEPER_POPULATE_MASTER                      270
+
 /* NLO DBGIDs */
 #define NLO_DBGID_SSID_TO_BE_SCANNED_LIST 0
 #define NLO_DBGID_SSID_TO_BE_SKIPPED_LIST 1
@@ -1630,7 +1671,7 @@ extern "C" {
 #define  DCC_DBGID_RX_PATH                              269
 #define  DCC_DBGID_TX_PATH                              270
 
-/* RSSI Threshold Monitor DBGIDs*/
+/* RSSI Threshold Monitor DBGIDs */
 #define RSSI_MONITOR_DBGID_DEFINITION_START               0
 #define RSSI_MONITOR_VDEV_INIT                            1
 #define RSSI_MONITOR_VDEV_FREE                            2
@@ -1647,6 +1688,12 @@ extern "C" {
 #define RSSI_MONITOR_UPDATE_BEACON_RSSI                  13
 #define RSSI_MONITOR_DBGID_DEFINITION_END                14
 
+/* QBOOST DBGIDs */
+#define WLAN_MODULE_QBOOST_DEFINITION_START               0
+#define WLAN_MODULE_QBOOST_DBGID_WLAN_PEER_NOT_FOUND      1
+#define WLAN_MODULE_QBOOST_DEFINITION_END                 2
+
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/target/inc/wlan_defs.h b/target/inc/wlan_defs.h
index f2e5caeae43e..fda5eb0e9b81 100644
--- a/target/inc/wlan_defs.h
+++ b/target/inc/wlan_defs.h
@@ -152,6 +152,16 @@ typedef enum {
 			   ((mode) == MODE_11AC_VHT80))
 #endif
 
+#define IS_MODE_HE(mode) (((mode) == MODE_11AX_HE20)     || \
+			  ((mode) == MODE_11AX_HE40)     || \
+			  ((mode) == MODE_11AX_HE80)     || \
+			  ((mode) == MODE_11AX_HE80_80)  || \
+			  ((mode) == MODE_11AX_HE160)    || \
+			  ((mode) == MODE_11AX_HE20_2G)  || \
+			  ((mode) == MODE_11AX_HE40_2G)  || \
+			  ((mode) == MODE_11AX_HE80_2G))
+
+
 #define IS_MODE_VHT_2G(mode) (((mode) == MODE_11AC_VHT20_2G) ||	\
 			      ((mode) == MODE_11AC_VHT40_2G) ||	\
 			      ((mode) == MODE_11AC_VHT80_2G))
diff --git a/target/inc/wlan_module_ids.h b/target/inc/wlan_module_ids.h
index c650ef5a524c..29cf8c4b3e3e 100644
--- a/target/inc/wlan_module_ids.h
+++ b/target/inc/wlan_module_ids.h
@@ -89,12 +89,14 @@ typedef enum {
 	WLAN_MODULE_OCB,
 	WLAN_MODULE_RSSI_MONITOR,
 	WLAN_MODULE_WPM,
-	WLAN_MODULE_CSS, /* 0x3a */
-	WLAN_MODULE_PPS, /* 0x3b */
-	WLAN_MODULE_SCAN_CH_PREDICT, /* 0x3c */
+	WLAN_MODULE_CSS,
+	WLAN_MODULE_PPS,
+	WLAN_MODULE_SCAN_CH_PREDICT,
 	WLAN_MODULE_MAWC,
-	WLAN_MODULE_CMC_QMIC, /* 0x3e */
+	WLAN_MODULE_CMC_QMIC,
 	WLAN_MODULE_EGAP, /* 0x3f */
+	WLAN_MODULE_NAN20,
+	WLAN_MODULE_QBOOST,
 
 	WLAN_MODULE_ID_MAX,
 	WLAN_MODULE_ID_INVALID = WLAN_MODULE_ID_MAX,
diff --git a/target/inc/wmi_services.h b/target/inc/wmi_services.h
index 2ea83914a7f9..df9bb8d053a1 100644
--- a/target/inc/wmi_services.h
+++ b/target/inc/wmi_services.h
@@ -162,6 +162,9 @@ typedef enum {
 	WMI_SERVICE_DEPRECATED_REPLACE,
 	WMI_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE, /* FW supports a new mode that allows to run connection tracker in host */
 	WMI_SERVICE_ENHANCED_MCAST_FILTER,/* FW supports enhanced multicast filtering (of mcast IP inside ucast WLAN) */
+	/* periodic channel stats service */
+	WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
+	WMI_SERVICE_MESH_11S,             /* 11s mesh service support */
 
 	WMI_MAX_SERVICE = 128             /* max service */
 } WMI_SERVICE;
diff --git a/target/inc/wmi_tlv_defs.h b/target/inc/wmi_tlv_defs.h
index ba0a43f1e4cf..9b5a559ce298 100644
--- a/target/inc/wmi_tlv_defs.h
+++ b/target/inc/wmi_tlv_defs.h
@@ -690,6 +690,9 @@ typedef enum {
 	WMITLV_TAG_STRUC_WMI_COEX_CONFIG_CMD_fixed_param,
 	WMITLV_TAG_STRUC_wmi_config_enhanced_mcast_filter_fixed_param,
 	WMITLV_TAG_STRUC_WMI_CHAN_AVOID_RPT_ALLOW_CMD_fixed_param,
+	WMITLV_TAG_STRUC_wmi_set_periodic_channel_stats_config_fixed_param,
+	WMITLV_TAG_STRUC_wmi_vdev_set_custom_aggr_size_cmd_fixed_param,
+	WMITLV_TAG_STRUC_wmi_pdev_wal_power_debug_cmd_fixed_param,
 } WMITLV_TAG_ID;
 
 /*
@@ -968,7 +971,10 @@ typedef enum {
 	OP(WMI_VDEV_SET_QUIET_MODE_CMDID) \
 	OP(WMI_COEX_CONFIG_CMDID) \
 	OP(WMI_CONFIG_ENHANCED_MCAST_FILTER_CMDID) \
-	OP(WMI_CHAN_AVOID_RPT_ALLOW_CMDID)
+	OP(WMI_CHAN_AVOID_RPT_ALLOW_CMDID) \
+	OP(WMI_SET_PERIODIC_CHANNEL_STATS_CONFIG_CMDID) \
+	OP(WMI_VDEV_SET_CUSTOM_AGGR_SIZE_CMDID) \
+	OP(WMI_PDEV_WAL_POWER_DEBUG_CMDID)
 
 /*
  * IMPORTANT: Please add _ALL_ WMI Events Here.
@@ -1997,6 +2003,12 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_QUIET_MODE_CMDID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_SET_QUIET_MODE_CMDID);
 
+/* Setting custom aggregation size using command */
+#define WMITLV_TABLE_WMI_VDEV_SET_CUSTOM_AGGR_SIZE_CMDID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_vdev_set_custom_aggr_size_cmd_fixed_param, wmi_vdev_set_custom_aggr_size_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_SET_CUSTOM_AGGR_SIZE_CMDID);
+
 /* Vdev create Cmd */
 #define WMITLV_TABLE_WMI_VDEV_CREATE_CMDID(id, op, buf, len) \
 	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_vdev_create_cmd_fixed_param, wmi_vdev_create_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
@@ -2777,6 +2789,18 @@ WMITLV_CREATE_PARAM_STRUC(WMI_SOC_SET_ANTENNA_MODE_CMDID);
 	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_pdev_set_antenna_mode_cmd_fixed_param, wmi_pdev_set_antenna_mode_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_ANTENNA_MODE_CMDID);
 
+/* enable/disable and set the periodicity of periodic channel stats */
+#define WMITLV_TABLE_WMI_SET_PERIODIC_CHANNEL_STATS_CONFIG_CMDID(id, op, buf, len) \
+    WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_set_periodic_channel_stats_config_fixed_param, wmi_set_periodic_channel_stats_config_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_SET_PERIODIC_CHANNEL_STATS_CONFIG_CMDID);
+
+/* wal power debug command per pdev */
+#define WMITLV_TABLE_WMI_PDEV_WAL_POWER_DEBUG_CMDID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_pdev_wal_power_debug_cmd_fixed_param, wmi_pdev_wal_power_debug_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, args, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_WAL_POWER_DEBUG_CMDID);
+
+
 /************************** TLV definitions of WMI events *******************************/
 
 /* Service Ready event */
diff --git a/target/inc/wmi_unified.h b/target/inc/wmi_unified.h
index c673a9cb9540..d2c5ea6be6cc 100644
--- a/target/inc/wmi_unified.h
+++ b/target/inc/wmi_unified.h
@@ -337,6 +337,10 @@ typedef enum {
 	WMI_PDEV_SET_MAC_CONFIG_CMDID,
 	/** Set per band and per pdev antenna chains */
 	WMI_PDEV_SET_ANTENNA_MODE_CMDID,
+	/** Periodic channel stats request command */
+	WMI_SET_PERIODIC_CHANNEL_STATS_CONFIG_CMDID,
+	/** WMI command for power debug framework */
+	WMI_PDEV_WAL_POWER_DEBUG_CMDID,
 
 	/* VDEV(virtual device) specific commands */
 	/** vdev create */
@@ -388,6 +392,8 @@ typedef enum {
 	WMI_VDEV_FILTER_NEIGHBOR_RX_PACKETS_CMDID,
 	/** set quiet ie parameters. primarily used in AP mode */
 	WMI_VDEV_SET_QUIET_MODE_CMDID,
+	/** To set custom aggregation size for per vdev */
+	WMI_VDEV_SET_CUSTOM_AGGR_SIZE_CMDID,
 
 	/* peer specific commands */
 
@@ -1558,6 +1564,23 @@ typedef enum {
 #define WMI_HE_CAP_TWT_REQUESTER_SUPPORT  0x00000004
 #define WMI_HE_FRAG_SUPPORT_MASK          0x00000018
 #define WMI_HE_FRAG_SUPPORT_SHIFT         3
+
+
+/* fragmentation support field value */
+enum {
+	WMI_HE_FRAG_SUPPORT_LEVEL0, /* No Fragmentation support */
+	/*
+	 * support for fragments within a VHT single MPDU,
+	 * no support for fragments within AMPDU
+	 */
+	WMI_HE_FRAG_SUPPORT_LEVEL1,
+	/* support for up to 1 fragment per MSDU within a single A-MPDU */
+	WMI_HE_FRAG_SUPPORT_LEVEL2,
+	/* support for multiple fragments per MSDU within an A-MPDU */
+	WMI_HE_FRAG_SUPPORT_LEVEL3,
+};
+
+
 /** NOTE: This defs cannot be changed in the future without
  * breaking WMI compatibility
  */
@@ -1841,13 +1864,21 @@ typedef struct {
 	/* which WMI_DBS_FW_MODE_CFG setting the FW is initialized with */
 	A_UINT32 default_fw_config_bits;
 	wmi_ppe_threshold ppet;
-	/* see section 8.4.2.213 from draft r8 of 802.11ax */
+	/*
+	 * see section 8.4.2.213 from draft r8 of 802.11ax;
+	 * see WMI_HE_FRAG_SUPPORT enum
+	 */
 	A_UINT32 he_cap_info;
 	/*
 	 * An HT STA shall not allow transmission of more than one MPDU start
 	 * within the time limit described in the MPDU maximum density field.
 	 */
 	A_UINT32 mpdu_density; /* units are microseconds */
+	/*
+	 * Maximum no of BSSID based RX filters host can program
+	 * Value 0 means FW hasn't given any limit to host.
+	 */
+	A_UINT32 max_bssid_rx_filters;
 } wmi_service_ready_ext_event_fixed_param;
 
 typedef enum {
@@ -1937,6 +1968,7 @@ typedef struct {
 	wmi_abi_version fw_abi_vers;
 	wmi_mac_addr mac_addr;
 	A_UINT32 status;
+	A_UINT32 num_dscp_table;
 } wmi_ready_event_fixed_param;
 
 typedef struct {
@@ -2277,6 +2309,16 @@ typedef struct {
 	 * packet filtering instructions
 	 */
 	A_UINT32 bpf_instruction_size;
+	/**
+	 * Maximum no of BSSID based RX filters host would program
+	 * Value 0 means host doesn't given any limit to FW.
+	 */
+	A_UINT32 max_bssid_rx_filters;
+	/**
+	 * Use PDEV ID instead of MAC ID, added for backward compatibility with
+	 * older host which is using MAC ID. 1 means PDEV ID, 0 means MAC ID.
+	 */
+	A_UINT32 use_pdev_id;
 } wmi_resource_config;
 
 #define WMI_RSRC_CFG_FLAG_SET(word32, flag, value) \
@@ -2762,6 +2804,17 @@ typedef struct {
 	* larger than 32 bits.
 	*/
 	A_UINT32 tsf_delta;
+	/*
+	 * The lower 32 bits of the TSF (rx_tsf_l32) is copied by FW from
+	 * TSF timestamp in the RX MAC descriptor provided by HW.
+	 */
+	A_UINT32 rx_tsf_l32;
+
+	/*
+	 *The Upper 32 bits (rx_tsf_u32) is filled by reading the TSF register
+	 * after the packet is received.
+	 */
+	A_UINT32 rx_tsf_u32;
 	/* This TLV is followed by array of bytes:
 	 * // management frame buffer
 	 *   A_UINT8 bufp[];
@@ -3125,9 +3178,16 @@ typedef struct {
 
 /*Command to set/unset chip in quiet mode*/
 typedef struct {
-	A_UINT32 tlv_header;            /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_quiet_cmd_fixed_param */
-	A_UINT32 reserved0;
-	/** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
+	/*
+	 * TLV tag and len; tag equals
+	 * WMITLV_TAG_STRUC_wmi_pdev_set_quiet_cmd_fixed_param
+	 */
+	A_UINT32 tlv_header;
+	/*
+	 * pdev_id for identifying the MAC, See macros
+	 * starting with WMI_PDEV_ID_ for values.
+	 */
+	A_UINT32 pdev_id;
 	A_UINT32 period;                /*period in TUs */
 	A_UINT32 duration;              /*duration in TUs */
 	A_UINT32 next_start;            /*offset in TUs */
@@ -3146,6 +3206,29 @@ typedef struct {
 	A_UINT32 enabled;    /* enable/disable */
 } wmi_vdev_set_quiet_cmd_fixed_param;
 
+typedef struct {
+	/*
+	 * TLV tag and len; tag equals
+	 * WMITLV_TAG_STRUC_wmi_vdev_set_custom_aggr_size_cmd_fixed_param
+	 */
+	A_UINT32 tlv_header;
+	/*
+	 * vdev id indicating to which the vdev custom aggregation size
+	 * will be applied.
+	 */
+	A_UINT32 vdev_id;
+	/*
+	 * Size for tx aggregation (max MPDUs per A-MPDU) for the vdev
+	 * mentioned in vdev id
+	 */
+	A_UINT32 tx_aggr_size;
+	/*
+	 * Size for rx aggregation (block ack window size limit) for
+	 * the vdev mentioned in vdev id
+	 */
+	A_UINT32 rx_aggr_size;
+} wmi_vdev_set_custom_aggr_size_cmd_fixed_param;
+
 /*
  * Command to enable/disable Green AP Power Save.
  * This helps conserve power during AP operation. When the AP has no
@@ -3862,6 +3945,12 @@ typedef enum {
 	WMI_PKTLOG_EVENT_SMART_ANTENNA = 0x20, /* To support Smart Antenna */
 } WMI_PKTLOG_EVENT;
 
+typedef enum {
+	/* (default) FW will decide under what conditions to enable pktlog */
+	WMI_PKTLOG_ENABLE_AUTO  = 0,
+	WMI_PKTLOG_ENABLE_FORCE = 1, /* pktlog unconditionally enabled */
+} WMI_PKTLOG_ENABLE;
+
 typedef struct {
 	/** TLV tag and len; tag equals
 	 * WMITLV_TAG_STRUC_wmi_pdev_pktlog_enable_cmd_fixed_param
@@ -3871,7 +3960,8 @@ typedef struct {
 	 * See macros starting with WMI_PDEV_ID_ for values.
 	 */
 	A_UINT32 pdev_id;
-	WMI_PKTLOG_EVENT evlist;
+	A_UINT32 evlist; /* WMI_PKTLOG_EVENT */
+	A_UINT32 enable; /* WMI_PKTLOG_ENABLE */
 } wmi_pdev_pktlog_enable_cmd_fixed_param;
 
 typedef struct {
@@ -3969,6 +4059,7 @@ typedef struct {
 	A_UINT32 vdev_id;
 	/** map indicating DSCP to TID conversion */
 	A_UINT32 dscp_to_tid_map[WMI_DSCP_MAP_MAX];
+	A_UINT32 enable_override;
 } wmi_vdev_set_dscp_tid_map_cmd_fixed_param;
 
 /** Fixed rate (rate-code) for broadcast/ multicast data frames */
@@ -4297,6 +4388,12 @@ typedef struct {
 	A_UINT32 cca_busy_time;
 } wmi_channel_stats;
 
+/*
+ * Each step represents 0.5 dB.  The starting value is 0 dBm.
+ * Thus the TPC levels cover 0 dBm to 31.5 dBm inclusive in 0.5 dB steps.
+ */
+#define MAX_TPC_LEVELS 64
+
 /* radio statistics */
 typedef struct {
 	A_UINT32 tlv_header;
@@ -4323,6 +4420,8 @@ typedef struct {
 	A_UINT32 on_time_hs20;
 	/** number of channels */
 	A_UINT32 num_channels;
+	/** tx time (in milliseconds) per TPC level (0.5 dBm) */
+	A_UINT32 tx_time_per_tpc[MAX_TPC_LEVELS];
 } wmi_radio_link_stats;
 
 /** Radio statistics (once started) do not stop or get reset unless wifi_clear_link_stats is invoked */
@@ -4523,14 +4622,21 @@ enum {
 typedef struct {
 	A_UINT32 tlv_header;            /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_suspend_cmd_fixed_param  */
 	/* suspend option sent to target */
-	A_UINT32 reserved0;                          /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
+	/*
+	 * pdev_id for identifying the MAC, See macros
+	 * starting with WMI_PDEV_ID_ for values.
+	 */
+	A_UINT32 pdev_id;
 	A_UINT32 suspend_opt;
 } wmi_pdev_suspend_cmd_fixed_param;
 
 typedef struct {
 	A_UINT32 tlv_header;            /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_resume_cmd_fixed_param  */
-	/** Reserved for future use */
-	A_UINT32 reserved0;
+	/*
+	 * pdev_id for identifying the MAC, See macros
+	 * starting with WMI_PDEV_ID_ for values.
+	 */
+	A_UINT32 pdev_id;
 } wmi_pdev_resume_cmd_fixed_param;
 
 typedef struct {
@@ -4727,9 +4833,14 @@ typedef struct {
 	A_UINT32 vdev_subtype;
 	/** VDEV MAC address */
 	wmi_mac_addr vdev_macaddr;
-	/* Number of configured txrx streams */
+	/** Number of configured txrx streams */
 	A_UINT32 num_cfg_txrx_streams;
 	/*
+	 * pdev_id for identifying the MAC,
+	 * See macros starting with WMI_PDEV_ID_ for values.
+	 */
+	A_UINT32 pdev_id;
+	/*
 	 * This TLV is followed by another TLV of array of structures
 	 * wmi_vdev_txrx_streams cfg_txrx_streams[];
 	*/
@@ -4789,6 +4900,15 @@ typedef struct {
 #define WMI_UNIFIED_VDEV_SUBTYPE_P2P_GO     0x3
 #define WMI_UNIFIED_VDEV_SUBTYPE_PROXY_STA  0x4
 #define WMI_UNIFIED_VDEV_SUBTYPE_MESH       0x5
+/*
+ * new subtype for 11S mesh is required as 11S functionality differs
+ * in many ways from proprietary mesh
+ * 11S uses 6-addr frame format and supports peering between mesh
+ * stations and dynamic best path selection between mesh stations.
+ * While in proprietary mesh, neighboring mesh station MAC is manually
+ * added to AST table for traffic flow between mesh stations
+ */
+#define WMI_UNIFIED_VDEV_SUBTYPE_MESH_11S   0x6
 
 /** values for vdev_start_request flags */
 /** Indicates that AP VDEV uses hidden ssid. only valid for
@@ -5289,6 +5409,13 @@ typedef enum {
 
 	/* VDEV capabilities */
 	WMI_VDEV_PARAM_CAPABILITIES, /* see capabilities defs below */
+	/*
+	 * Increment TSF in micro seconds to avoid beacon collision on mesh VAP
+	 * The host must ensure that either no other vdevs share the TSF with
+	 * this vdev, or else that it is acceptable to apply this TSF adjustment
+	 * to all vdevs sharing the TSF
+	 */
+	WMI_VDEV_PARAM_TSF_INCREMENT,
 } WMI_VDEV_PARAM;
 
 /* vdev capabilities bit mask */
@@ -5778,6 +5905,15 @@ enum wmi_ap_ps_peer_param_max_sp {
 	MAX_WMI_AP_PS_PEER_PARAM_MAX_SP,
 };
 
+/** param values for WMI_AP_PS_PEER_PARAM_SIFS_RESP_FRMTYPE */
+enum wmi_ap_ps_param_sifs_resp_frmtype {
+	WMI_SIFS_RESP_PSPOLL    = (1 << 0),
+	WMI_SIFS_RESP_UAPSD     = (1 << 1),
+	WMI_SIFS_RESP_QBST_EXP  = (1 << 2),
+	WMI_SIFS_RESP_QBST_DATA = (1 << 3),
+	WMI_SIFS_RESP_QBST_BAR  = (1 << 4),
+};
+
 /**
  * AP power save parameter
  * Set a power save specific parameter for a peer station
@@ -5807,7 +5943,10 @@ enum wmi_ap_ps_peer_param {
 
 	/** Time in seconds for aging out buffered frames for STA in power save */
 	WMI_AP_PS_PEER_PARAM_AGEOUT_TIME = 2,
-	/** Specify frame types that are considered SIFS RESP trigger frame */
+	/**
+	 * Specify frame types that are considered SIFS RESP trigger frame
+	 * (see enum wmi_ap_ps_param_sifs_resp_frmtype)
+	 */
 	WMI_AP_PS_PEER_PARAM_SIFS_RESP_FRMTYPE = 3,
 
 	/*
@@ -5828,7 +5967,7 @@ typedef struct {
 	wmi_mac_addr peer_macaddr;
 	/** AP powersave param (see enum wmi_ap_ps_peer_param) */
 	A_UINT32 param;
-	/** AP powersave param value */
+	/** AP powersave param value (see defines) */
 	A_UINT32 value;
 } wmi_ap_ps_peer_cmd_fixed_param;
 
@@ -6717,7 +6856,11 @@ typedef struct {
 	/** channel tx power per throughput */
 	A_UINT32 chan_tx_pwr_tp;
 	/** rx frame count (cumulative) */
-	A_UINT32   rx_frame_count;
+	A_UINT32 rx_frame_count;
+	/** BSS rx cycle count */
+	A_UINT32 my_bss_rx_cycle_count;
+	/** b-mode data rx time (units are microseconds) */
+	A_UINT32 rx_11b_mode_data_duration;
 } wmi_chan_info_event_fixed_param;
 
 /**
@@ -6789,7 +6932,11 @@ typedef struct _wlan_dcs_im_tgt_stats {
 
 	/** CCK phy error count, MAC_PCU_PHY_ERR_CNT_2_ADDRESS */
 	A_UINT32 reg_cck_phyerr_cnt;            /* CCK err count since last reset, read from register */
+	/** Channel noise floor (units are dBm) */
+	A_INT32 chan_nf;
 
+	/** BSS rx cycle count */
+	A_UINT32 my_bss_rx_cycle_count;
 } wlan_dcs_im_tgt_stats_t;
 
 /**
@@ -6808,6 +6955,10 @@ typedef struct {
 	 * Type of the event present, either the cw interference event, or the wlan_im stats
 	 */
 	A_UINT32 interference_type;             /* type of interference, wlan or cw */
+	/** pdev_id for identifying the MAC
+	 * See macros starting with WMI_PDEV_ID_ for values.
+	 */
+	A_UINT32 pdev_id;
 	/*
 	 * Following this struct are these TLVs. Note that they are both array of structures
 	 * but can have at most one element. Which TLV is empty or has one element depends
@@ -7166,10 +7317,14 @@ typedef struct wmi_bcn_send_from_host {
 	A_UINT32 tlv_header;            /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_bcn_send_from_host_cmd_fixed_param  */
 	A_UINT32 vdev_id;
 	A_UINT32 data_len;
-	A_UINT32 frag_ptr;              /* Physical address of the frame */
+	union {
+		A_UINT32 frag_ptr; /* Physical address of the frame */
+		A_UINT32 frag_ptr_lo; /* LSB of physical address of the frame */
+	};
 	A_UINT32 frame_ctrl;            /* farme ctrl to setup PPDU desc */
 	A_UINT32 dtim_flag;             /* to control CABQ traffic */
 	A_UINT32 bcn_antenna;   /* Antenna for beacon transmission */
+	A_UINT32 frag_ptr_hi; /* MSBs of physical address of the frame */
 } wmi_bcn_send_from_host_cmd_fixed_param;
 
 /* cmd to support bcn snd for all vaps at once */
@@ -7322,10 +7477,15 @@ typedef struct {
 	A_UINT32 reason;
 	/** associated AP's rssi calculated by FW when reason code is WMI_ROAM_REASON_LOW_RSSI*/
 	A_UINT32 rssi;
+	/** roam notification */
+	A_UINT32 notif;
 
 } wmi_roam_event_fixed_param;
 
 /* roam_reason: bits 0-3 */
+
+/** invalid reason. Do not interpret reason field */
+#define WMI_ROAM_REASON_INVALID   0x0
 #define WMI_ROAM_REASON_BETTER_AP 0x1 /** found a better AP */
 #define WMI_ROAM_REASON_BMISS     0x2 /** beacon miss detected */
 #define WMI_ROAM_REASON_DEAUTH    0x2 /** deauth/disassoc received */
@@ -7368,6 +7528,14 @@ typedef enum {
 	(((roam_reason) & WMI_ROAM_SUBNET_CHANGE_STATUS_MASK) >> \
 	WMI_ROAM_SUBNET_CHANGE_STATUS_SHIFT)
 
+/* roaming notification */
+/** invalid notification. Do not interpret notif field  */
+#define WMI_ROAM_NOTIF_INVALID     0x0
+/** indicate that roaming is started. sent only in non WOW state */
+#define WMI_ROAM_NOTIF_ROAM_START  0x1
+/** indicate that roaming is aborted. sent only in non WOW state */
+#define WMI_ROAM_NOTIF_ROAM_ABORT  0x2
+
 /**whenever RIC request information change, host driver should pass all ric related information to firmware (now only support tsepc)
  * Once, 11r roaming happens, firmware can generate RIC request in reassoc request based on these informations
  */
@@ -7865,6 +8033,7 @@ typedef enum event_type_e {
 	WOW_NLO_SCAN_COMPLETE_EVENT,
 	WOW_NAN_DATA_EVENT,
 	WOW_NAN_RTT_EVENT,
+	WOW_TDLS_CONN_TRACKER_EVENT,
 } WOW_WAKE_EVENT_TYPE;
 
 typedef enum wake_reason_e {
@@ -7911,6 +8080,7 @@ typedef enum wake_reason_e {
 	WOW_REASON_BPF_ALLOW,
 	WOW_REASON_NAN_DATA,
 	WOW_REASON_NAN_RTT,
+	WOW_REASON_TDLS_CONN_TRACKER_EVENT,
 	WOW_REASON_DEBUG_TEST = 0xFF,
 } WOW_WAKE_REASON_TYPE;
 
@@ -9420,8 +9590,10 @@ typedef struct {
 	 *  WMITLV_TAG_STRUC_wmi_dfs_phyerr_filter_dis_cmd_fixed_param
 	 */
 	A_UINT32 tlv_header;
-	/** Reserved for future use */
-	A_UINT32 reserved0;
+	/** pdev_id for identifying the MAC
+	 * See macros starting with WMI_PDEV_ID_ for values.
+	 */
+	A_UINT32 pdev_id;
 } wmi_dfs_phyerr_filter_dis_cmd_fixed_param;
 
 /** TDLS COMMANDS */
@@ -13530,10 +13702,6 @@ typedef struct {
 	A_UINT32 vdev_id;
 	/* action type, refer to wmi_tsf_tstamp_action */
 	A_UINT32 tsf_action;
-	/* low 32 bits of qtimer */
-	A_UINT32 qtimer_low;
-	/* high 32 bits of qtimer */
-	A_UINT32 qtimer_high;
 } wmi_vdev_tsf_tstamp_action_cmd_fixed_param;
 
 typedef struct {
@@ -13546,6 +13714,10 @@ typedef struct {
 	A_UINT32 tsf_low;
 	/* high 32 bit of tsf */
 	A_UINT32 tsf_high;
+	/* low 32 bits of qtimer */
+	A_UINT32 qtimer_low;
+	/* high 32 bits of qtimer */
+	A_UINT32 qtimer_high;
 } wmi_vdev_tsf_report_event_fixed_param;
 
 typedef struct {
@@ -15071,6 +15243,43 @@ typedef struct {
 	A_UINT32 rpt_allow;
 } WMI_CHAN_AVOID_RPT_ALLOW_CMD_fixed_param;
 
+/*
+ * Periodic channel stats WMI command structure
+ * WMI_SET_PERIODIC_CHANNEL_STATS_CONFIG_CMDID
+ */
+typedef struct {
+	/*
+	 * TLV tag and len; tag equals
+	 * WMITLV_TAG_STRUC_wmi_set_periodic_channel_stats_config_fixed_param
+	 */
+	A_UINT32 tlv_header;
+	/** 1 = enable, 0 = disable */
+	A_UINT32 enable;
+	/** periodic stats duration (units are milliseconds) */
+	A_UINT32 stats_period;
+} wmi_set_periodic_channel_stats_config_fixed_param;
+
+typedef struct {
+	/*
+	 * TLV tag and len; tag equals
+	 * WMITLV_TAG_STRUC_wmi_pdev_wal_power_debug_cmd_fixed_param
+	 */
+	A_UINT32 tlv_header;
+	/*
+	 * pdev_id for identifying the MAC
+	 * See macros starting with WMI_PDEV_ID_ for values.
+	 */
+	A_UINT32 pdev_id;
+	/* Identify the wlan module */
+	A_UINT32 module_id;
+	/* Num of elements in the following args[] array */
+	A_UINT32 num_args;
+/**
+ * Following this structure are the TLVs:
+ *   A_UINT32 args[];
+ **/
+} wmi_pdev_wal_power_debug_cmd_fixed_param;
+
 /* ADD NEW DEFS HERE */
 
 /*****************************************************************************
diff --git a/target/inc/wmi_version.h b/target/inc/wmi_version.h
index acf977788270..4d127a8e6679 100644
--- a/target/inc/wmi_version.h
+++ b/target/inc/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility */
-#define __WMI_REVISION_ 217
+#define __WMI_REVISION_ 230
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work