Merge "Release 1.0.0.149 QCACLD WLAN Driver"

25 files changed, 479 insertions, 279 deletions

diff --git a/CORE/CLD_TXRX/HTT/htt_t2h.c b/CORE/CLD_TXRX/HTT/htt_t2h.c
index fc22499891ca..bd0ec60c0632 100644
--- a/CORE/CLD_TXRX/HTT/htt_t2h.c
+++ b/CORE/CLD_TXRX/HTT/htt_t2h.c
@@ -556,6 +556,7 @@ if (adf_os_unlikely(pdev->rx_ring.rx_reset)) {
 
             ol_rx_in_order_indication_handler(pdev->txrx_pdev, htt_t2h_msg,
                                                peer_id, tid, offload_ind);
+            break;
      }
 
 #ifdef IPA_UC_OFFLOAD
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c
index 8acbf44bfbe2..9b7c1a903d9b 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -2096,7 +2096,9 @@ ol_txrx_ipa_uc_op_response(
    u_int8_t op_code
 )
 {
-   pdev->ipa_uc_op_cb(op_code, pdev->osif_dev);
+   if (pdev->ipa_uc_op_cb) {
+      pdev->ipa_uc_op_cb(op_code, pdev->osif_dev);
+   }
 }
 
 void ol_txrx_ipa_uc_register_op_cb(
diff --git a/CORE/EPPING/inc/epping_internal.h b/CORE/EPPING/inc/epping_internal.h
index 961f608351fc..dbb92ad79f85 100644
--- a/CORE/EPPING/inc/epping_internal.h
+++ b/CORE/EPPING/inc/epping_internal.h
@@ -57,7 +57,7 @@
 
 #define EPPING_LOG_MASK (1<<EPPING_CMD_CAPTURE_RECV_CNT)
 #define EPPING_STATS_LOG_COUNT 50000
-#define EPPING_KTID_KILL_WAIT_TIME_US 50000
+#define EPPING_KTID_KILL_WAIT_TIME_MS 50
 /*---------------------------------------------------------------------------
   Preprocessor definitions and constants
   -------------------------------------------------------------------------*/
@@ -139,13 +139,11 @@ typedef struct epping_adapter_s {
    struct net_device *dev;
    v_MACADDR_t macAddressCurrent;
    tANI_U8 sessionId;
-#if !defined(HIF_USB)
    /* for mboxping */
    adf_os_spinlock_t       data_lock;
    adf_nbuf_queue_t        nodrop_queue;
    adf_os_timer_t          epping_timer;
    epping_tx_timer_state_t epping_timer_state;
-#endif
    bool registered;
    bool started;
    struct net_device_stats stats;
diff --git a/CORE/EPPING/src/epping_helper.c b/CORE/EPPING/src/epping_helper.c
index ccee9823695d..193dd3dc6c4f 100644
--- a/CORE/EPPING/src/epping_helper.c
+++ b/CORE/EPPING/src/epping_helper.c
@@ -77,9 +77,7 @@ int epping_cookie_init(epping_context_t*pEpping_ctx)
          vos_mem_malloc(sizeof(struct epping_cookie)*MAX_COOKIE_SLOT_SIZE);
       if (pEpping_ctx->s_cookie_mem == NULL) {
          EPPING_LOG(VOS_TRACE_LEVEL_FATAL,
-            "%s: no mem for cookie (idx = %d, size = %d)",
-            __func__, i,
-            sizeof(struct epping_cookie)*MAX_COOKIE_SLOT_SIZE);
+            "%s: no mem for cookie (idx = %d)", __func__, i);
          goto error;
       }
       vos_mem_zero(pEpping_ctx->s_cookie_mem[i],
@@ -280,7 +278,7 @@ void epping_unregister_tx_copier(HTC_ENDPOINT_ID eid, epping_context_t *pEpping_
    epping_poll->done = true;
    if (epping_poll->inited) {
       epping_tx_copier_schedule(pEpping_ctx, eid, NULL);
-      usleep(EPPING_KTID_KILL_WAIT_TIME_US);
+      msleep(EPPING_KTID_KILL_WAIT_TIME_MS);
    }
    if (epping_poll->skb)
       adf_nbuf_free(epping_poll->skb);
diff --git a/CORE/EPPING/src/epping_tx.c b/CORE/EPPING/src/epping_tx.c
index ef74e28405a3..a00a0ae38f43 100644
--- a/CORE/EPPING/src/epping_tx.c
+++ b/CORE/EPPING/src/epping_tx.c
@@ -355,8 +355,8 @@ void epping_tx_complete_multiple(void *ctx,
          ASSERT(htc_pkt->ActualLength == adf_nbuf_len(pktSkb));
       }
       EPPING_LOG(VOS_TRACE_LEVEL_INFO,
-         "%s skb=0x%x data=0x%x len=0x%x eid=%d ",
-         __func__, (A_UINT32)pktSkb, (A_UINT32)htc_pkt->pBuffer,
+         "%s skb=%p data=%p len=0x%x eid=%d ",
+         __func__, pktSkb, htc_pkt->pBuffer,
          htc_pkt->ActualLength, eid);
 
       if (A_FAILED(status)) {
diff --git a/CORE/HDD/inc/wlan_hdd_cfg.h b/CORE/HDD/inc/wlan_hdd_cfg.h
index 6504a58bbbe6..d4a3768b6211 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -2531,7 +2531,7 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
 #define CFG_LL_TX_HBW_FLOW_HWM_OFFSET              "TxHbwFlowHighWaterMarkOffset"
 #define CFG_LL_TX_HBW_FLOW_HWM_OFFSET_MIN          ( 0 )
 #define CFG_LL_TX_HBW_FLOW_HWM_OFFSET_MAX          ( 300 )
-#define CFG_LL_TX_HBW_FLOW_HWM_OFFSET_DEFAULT      ( 50 )
+#define CFG_LL_TX_HBW_FLOW_HWM_OFFSET_DEFAULT      ( 94 )
 
 #define CFG_LL_TX_HBW_FLOW_MAX_Q_DEPTH             "TxHbwFlowMaxQueueDepth"
 #define CFG_LL_TX_HBW_FLOW_MAX_Q_DEPTH_MIN         ( 400 )
diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index bafc0abdaa23..043865663dbd 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -1597,7 +1597,7 @@ void wlan_hdd_decr_active_session(hdd_context_t *pHddCtx,
 void wlan_hdd_reset_prob_rspies(hdd_adapter_t* pHostapdAdapter);
 void hdd_prevent_suspend(void);
 void hdd_allow_suspend(void);
-void hdd_allow_suspend_timeout(v_U32_t timeout);
+void hdd_prevent_suspend_timeout(v_U32_t timeout);
 bool hdd_is_ssr_required(void);
 void hdd_set_ssr_required(e_hdd_ssr_required value);
 
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 66c7e8c67f3b..84a223657e74 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -8209,7 +8209,7 @@ allow_suspend:
      * immediatly after the driver gets connect request(i.e after scan)
      * from supplicant, this result in app's is suspending and not able
      * to process the connect request to AP */
-    hdd_allow_suspend_timeout(1000);
+    hdd_prevent_suspend_timeout(1000);
 
 #ifdef FEATURE_WLAN_TDLS
     wlan_hdd_tdls_scan_done_callback(pAdapter);
@@ -13638,10 +13638,17 @@ int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
         pAdapter = pAdapterNode->pAdapter;
         if ((NULL != pAdapter) &&
             (WLAN_HDD_INFRA_STATION == pAdapter->device_mode)) {
-            if (0 != wlan_hdd_cfg80211_update_bss(pHddCtx->wiphy, pAdapter))
+            if (0 != wlan_hdd_cfg80211_update_bss(pHddCtx->wiphy, pAdapter)) {
                 hddLog(LOGW, FL("NO SCAN result"));
-            else
+            } else {
+                /* Acquire wakelock to handle the case where APP's tries to
+                 * suspend immediately after updating the scan results. Whis
+                 * results in app's is in suspended state and not able to
+                 * process the connect request to AP
+                 */
+                hdd_prevent_suspend_timeout(2000);
                 cfg80211_sched_scan_results(pHddCtx->wiphy);
+            }
 
             hddLog(LOG1, FL("cfg80211 scan result database updated"));
 
diff --git a/CORE/HDD/src/wlan_hdd_ipa.c b/CORE/HDD/src/wlan_hdd_ipa.c
index 066fc832eb61..efc3118306d4 100644
--- a/CORE/HDD/src/wlan_hdd_ipa.c
+++ b/CORE/HDD/src/wlan_hdd_ipa.c
@@ -349,6 +349,8 @@ static void hdd_ipa_i2w_cb(void *priv, enum ipa_dp_evt_type evt,
 		unsigned long data);
 static void hdd_ipa_w2i_cb(void *priv, enum ipa_dp_evt_type evt,
 		unsigned long data);
+static void hdd_ipa_msg_free_fn(void *buff, uint32_t len, uint32_t type);
+
 #ifdef IPA_UC_OFFLOAD
 static void hdd_ipa_uc_rm_notify_handler(void *context,
 	void *rxpkt,
@@ -469,6 +471,8 @@ static bool hdd_ipa_can_send_to_ipa(hdd_adapter_t *adapter, struct hdd_ipa_priv
 static int hdd_ipa_uc_enable_pipes(struct hdd_ipa_priv *hdd_ipa)
 {
 	int result;
+	struct ipa_msg_meta meta;
+	struct ipa_wlan_msg *msg;
 
 	/* ACTIVATE TX PIPE */
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
@@ -510,12 +514,54 @@ static int hdd_ipa_uc_enable_pipes(struct hdd_ipa_priv *hdd_ipa)
 	WLANTL_SetUcActive(hdd_ipa->hdd_ctx->pvosContext,
 		VOS_TRUE, VOS_FALSE);
 
+	/* This should be handled async manner */
+	meta.msg_len = sizeof(struct ipa_wlan_msg);
+	msg = adf_os_mem_alloc(NULL, meta.msg_len);
+	if (msg == NULL) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"msg allocation failed");
+		return -ENOMEM;
+	}
+
+	meta.msg_type = SW_ROUTING_ENABLE;
+	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO, "%s: Evt: %d",
+		msg->name, meta.msg_type);
+	result = ipa_send_msg(&meta, msg, hdd_ipa_msg_free_fn);
+	if (result) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_FATAL,
+			"%s: Evt: %d fail:%d",
+			msg->name, meta.msg_type,  result);
+		adf_os_mem_free(msg);
+		return result;
+	}
 	return 0;
 }
 
 static int hdd_ipa_uc_disable_pipes(struct hdd_ipa_priv *hdd_ipa)
 {
 	int result;
+	struct ipa_msg_meta meta;
+	struct ipa_wlan_msg *msg;
+
+	meta.msg_len = sizeof(struct ipa_wlan_msg);
+	msg = adf_os_mem_alloc(NULL, meta.msg_len);
+	if (msg == NULL) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"msg allocation failed");
+		return -ENOMEM;
+	}
+
+	meta.msg_type = SW_ROUTING_DISABLE;
+	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO, "%s: Evt: %d",
+		msg->name, meta.msg_type);
+
+	result = ipa_send_msg(&meta, msg, hdd_ipa_msg_free_fn);
+	if (result) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO, "%s: Evt: %d fail:%d",
+			msg->name, meta.msg_type,  result);
+		adf_os_mem_free(msg);
+		return result;
+	}
 
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO,
 		"%s: Disable RX PIPE", __func__);
@@ -675,6 +721,11 @@ void hdd_ipa_uc_rm_notify_defer(void *hdd_ipa, enum ipa_rm_event event)
 
 static void hdd_ipa_uc_op_cb(v_U8_t op_code)
 {
+	if (HDD_IPA_UC_OPCODE_MAX <= op_code) {
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
+			"%s, INVALID OPCODE %d", __func__, op_code);
+		return;
+	}
 	HDD_IPA_LOG(VOS_TRACE_LEVEL_DEBUG,
 		"%s, OPCODE %s", __func__, op_string[op_code]);
 }
@@ -2200,8 +2251,8 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 #ifdef IPA_UC_OFFLOAD
 		if (!hdd_ipa_uc_is_enabled(hdd_ipa)) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR,
-				"%s: Evt: %d, IPA UC OFFLOAD NOT ENABLED",
-				msg_ex->name, meta.msg_type);
+				"%s: IPA UC OFFLOAD NOT ENABLED",
+				msg_ex->name);
 			return 0;
 		}
 		hdd_ipa->sap_num_connected_sta--;
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 519880b16c00..afd0756143ee 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -608,6 +608,7 @@ static void wlan_hdd_restart_sap(hdd_adapter_t *ap_adapter)
             }
         }
         clear_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags);
+        wlan_hdd_decr_active_session(pHddCtx, ap_adapter->device_mode);
         hddLog(LOGE, FL("SAP Stop Success"));
 
         if (WLANSAP_StartBss(
@@ -630,6 +631,7 @@ static void wlan_hdd_restart_sap(hdd_adapter_t *ap_adapter)
         }
         hddLog(LOGE, FL("SAP Start Success"));
         set_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags);
+        wlan_hdd_incr_active_session(pHddCtx, ap_adapter->device_mode);
         pHostapdState->bCommit = TRUE;
     }
 end:
@@ -10784,7 +10786,7 @@ void hdd_allow_suspend(void)
     vos_wake_lock_release(&wlan_wake_lock);
 }
 
-void hdd_allow_suspend_timeout(v_U32_t timeout)
+void hdd_prevent_suspend_timeout(v_U32_t timeout)
 {
     vos_wake_lock_timeout_acquire(&wlan_wake_lock, timeout);
 }
@@ -11680,6 +11682,11 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
       }
    }
 
+#ifdef IPA_OFFLOAD
+   if (hdd_ipa_init(pHddCtx) == VOS_STATUS_E_FAILURE)
+	goto err_wiphy_unregister;
+#endif
+
    /*Start VOSS which starts up the SME/MAC/HAL modules and everything else */
    status = vos_start( pHddCtx->pvosContext );
    if ( !VOS_IS_STATUS_SUCCESS( status ) )
@@ -12051,10 +12058,6 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
    {
       hdd_set_idle_ps_config(pHddCtx, TRUE);
    }
-#ifdef IPA_OFFLOAD
-   if (hdd_ipa_init(pHddCtx) == VOS_STATUS_E_FAILURE)
-	goto err_nl_srv;
-#endif
 
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
     if (pHddCtx->cfg_ini->WlanAutoShutdown != 0) {
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index c4a8487995fe..4febfc09f9d4 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            148
+#define QWLAN_VERSION_BUILD            149
 
-#define QWLAN_VERSIONSTR               "1.0.0.148A"
+#define QWLAN_VERSIONSTR               "1.0.0.149"
 
 #ifdef QCA_WIFI_2_0
 
diff --git a/CORE/SAP/src/sapApiLinkCntl.c b/CORE/SAP/src/sapApiLinkCntl.c
index 2e22192b4489..f5c986c3fe6c 100644
--- a/CORE/SAP/src/sapApiLinkCntl.c
+++ b/CORE/SAP/src/sapApiLinkCntl.c
@@ -153,7 +153,7 @@ WLANSAP_ScanCallback
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, CSR scanStatus = %s (%d)", __func__, "eCSR_SCAN_SUCCESS", scanStatus);
 
             // Get scan results, Run channel selection algorithm, select channel and keep in pSapContext->Channel
-            scanGetResultStatus = sme_ScanGetResult(halHandle, 0, NULL, &pResult);
+            scanGetResultStatus = sme_ScanGetResult(halHandle, psapContext->sessionId, NULL, &pResult);
 
             if ((scanGetResultStatus != eHAL_STATUS_SUCCESS)&& (scanGetResultStatus != eHAL_STATUS_E_NULL_VALUE))
             {
@@ -166,6 +166,7 @@ WLANSAP_ScanCallback
             operChannel = sapSelectChannel(halHandle, psapContext, pResult);
 
             sme_ScanResultPurge(halHandle, pResult);
+            sme_ScanFlushResult(halHandle, psapContext->sessionId);
             event = eSAP_MAC_SCAN_COMPLETE;
             break;
 
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 62a7c28516a9..2d3f36f33e21 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -484,9 +484,9 @@ sapGotoChannelSel
     if (vos_concurrent_sap_sessions_running()) {
         v_U16_t con_sap_ch = sme_GetConcurrentOperationChannel(hHal);
 
-        if (sapContext->channel == AUTO_CHANNEL_SELECT)
+        if (con_sap_ch && sapContext->channel == AUTO_CHANNEL_SELECT) {
             sapContext->dfs_ch_disable = VOS_TRUE;
-        else if (con_sap_ch && sapContext->channel != con_sap_ch &&
+        } else if (con_sap_ch && sapContext->channel != con_sap_ch &&
                  VOS_IS_DFS_CH(sapContext->channel)) {
             VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_WARN,
                        "In %s, MCC DFS not supported in AP_AP Mode", __func__);
diff --git a/CORE/SERVICES/BMI/ol_fw.c b/CORE/SERVICES/BMI/ol_fw.c
index bb2fb2ce53b2..5d44d4952bb0 100644
--- a/CORE/SERVICES/BMI/ol_fw.c
+++ b/CORE/SERVICES/BMI/ol_fw.c
@@ -729,28 +729,16 @@ static struct ol_softc *ramdump_scn;
 
 int ol_copy_ramdump(struct ol_softc *scn)
 {
-	void __iomem *ramdump_base;
-	unsigned long address;
-	unsigned long size;
 	int ret;
 
-	/* Get RAM dump memory address and size */
-	if (cnss_get_ramdump_mem(&address, &size)) {
-		printk("No RAM dump will be collected since failed to get "
-			"memory address or size!\n");
+	if (!scn->ramdump_base || !scn->ramdump_size) {
+		pr_info("%s: No RAM dump will be collected since ramdump_base "
+			"is NULL or ramdump_size is 0!\n", __func__);
 		ret = -EACCES;
 		goto out;
 	}
 
-	ramdump_base = ioremap(address, size);
-	if (!ramdump_base) {
-		printk("No RAM dump will be collected since ramdump_base is NULL!\n");
-		ret = -EACCES;
-		goto out;
-	}
-
-	ret = ol_target_coredump(scn, ramdump_base, size);
-	iounmap(ramdump_base);
+	ret = ol_target_coredump(scn, scn->ramdump_base, scn->ramdump_size);
 
 out:
 	return ret;
diff --git a/CORE/SERVICES/COMMON/ol_if_athvar.h b/CORE/SERVICES/COMMON/ol_if_athvar.h
index e5993250431b..c401d6231a7e 100644
--- a/CORE/SERVICES/COMMON/ol_if_athvar.h
+++ b/CORE/SERVICES/COMMON/ol_if_athvar.h
@@ -234,6 +234,11 @@ struct ol_softc {
 #elif defined(HIF_SDIO)
     struct ol_fw_files fw_files;
 #endif
+#ifdef CONFIG_CNSS
+    void __iomem *ramdump_base;
+    unsigned long ramdump_address;
+    unsigned long ramdump_size;
+#endif
 };
 
 #ifdef PERE_IP_HDR_ALIGNMENT_WAR
diff --git a/CORE/SERVICES/HIF/PCIe/if_pci.c b/CORE/SERVICES/HIF/PCIe/if_pci.c
index ea4d66262c94..247d2b76ca32 100644
--- a/CORE/SERVICES/HIF/PCIe/if_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/if_pci.c
@@ -924,6 +924,21 @@ again:
 #endif
     ol_sc->max_no_of_peers = 1;
 
+#ifdef CONFIG_CNSS
+    /* Get RAM dump memory address and size */
+    if (!cnss_get_ramdump_mem(&ol_sc->ramdump_address, &ol_sc->ramdump_size)) {
+        ol_sc->ramdump_base = ioremap(ol_sc->ramdump_address,
+            ol_sc->ramdump_size);
+        if (!ol_sc->ramdump_base) {
+            pr_err("%s: Cannot map ramdump_address 0x%lx!\n",
+                __func__, ol_sc->ramdump_address);
+        }
+    } else {
+        pr_info("%s: Failed to get RAM dump memory address or size!\n",
+            __func__);
+    }
+#endif
+
     adf_os_atomic_init(&sc->tasklet_from_intr);
     adf_os_atomic_init(&sc->wow_done);
     adf_os_atomic_init(&sc->ce_suspend);
@@ -1252,6 +1267,21 @@ again:
 #endif
     ol_sc->max_no_of_peers = 1;
 
+#ifdef CONFIG_CNSS
+    /* Get RAM dump memory address and size */
+    if (!cnss_get_ramdump_mem(&ol_sc->ramdump_address, &ol_sc->ramdump_size)) {
+        ol_sc->ramdump_base = ioremap(ol_sc->ramdump_address,
+            ol_sc->ramdump_size);
+        if (!ol_sc->ramdump_base) {
+            pr_err("%s: Cannot map ramdump_address 0x%lx!\n",
+                __func__, ol_sc->ramdump_address);
+        }
+    } else {
+        pr_info("%s: Failed to get RAM dump memory address or size!\n",
+            __func__);
+    }
+#endif
+
     adf_os_atomic_init(&sc->tasklet_from_intr);
     adf_os_atomic_init(&sc->wow_done);
     adf_os_atomic_init(&sc->ce_suspend);
@@ -1601,6 +1631,12 @@ hif_pci_remove(struct pci_dev *pdev)
     mem = (void __iomem *)sc->mem;
 
     pci_disable_msi(pdev);
+
+#ifdef CONFIG_CNSS
+    if (scn->ramdump_base)
+        iounmap(scn->ramdump_base);
+#endif
+
     A_FREE(scn);
     A_FREE(sc->hif_device);
     A_FREE(sc);
@@ -1656,6 +1692,12 @@ void hif_pci_shutdown(struct pci_dev *pdev)
     mem = (void __iomem *)sc->mem;
 
     pci_disable_msi(pdev);
+
+#ifdef CONFIG_CNSS
+    if (scn->ramdump_base)
+        iounmap(scn->ramdump_base);
+#endif
+
     A_FREE(scn);
     A_FREE(sc);
     pci_set_drvdata(pdev, NULL);
diff --git a/CORE/SERVICES/HTC/htc.c b/CORE/SERVICES/HTC/htc.c
index d432d37be6d8..a1d7024b5dd3 100644
--- a/CORE/SERVICES/HTC/htc.c
+++ b/CORE/SERVICES/HTC/htc.c
@@ -329,60 +329,35 @@ A_STATUS HTCSetupTargetBufferAssignments(HTC_TARGET *target)
     pEntry->CreditAllocation = credits;
 
     if (WLAN_IS_EPPING_ENABLED(vos_get_conparam())) {
+        /* endpoint ping is a testing tool directly on top of HTC in
+         * both target and host sides.
+         * In target side, the endppint ping fw has no wlan stack and the
+         * FW mboxping app directly sits on HTC and it simply drops
+         * or loops back TX packets. For rx perf, FW mboxping app
+         * generates packets and passes packets to HTC to send to host.
+         * There is no WMI mesage exchanges between host and target
+         * in endpoint ping case.
+         * In host side, the endpoint ping driver is a Ethernet driver
+         * and it directly sits on HTC. Only HIF, HTC, VOSS, ADF are
+         * used by the endpoint ping driver. There is no wifi stack
+         * at all in host side also. For tx perf use case,
+         * the user space mboxping app sends the raw packets to endpoint
+         * ping driver and it directly forwards to HTC for transmission
+         * to stress the bus. For the rx perf, HTC passes the received
+         * packets to endpoint ping driver and it is passed to the user
+         * space through the Ethernet interface.
+         * For credit allocation, in SDIO bus case, only BE service is
+         * used for tx/rx perf testing so that all credits are given
+         * to BE service. In PCIe bus case, endpoint ping uses both
+         * BE and BK services to stress the bus so that the total credits
+         * are equally distributed to BE and BK services.
+         */
 #if !defined(HIF_USB)
         pEntry++;
         pEntry->ServiceID = WMI_DATA_BE_SVC;
         pEntry->CreditAllocation = credits;
 #endif
-#if defined(HIF_USB)
-        do {
-            pEntry++;
-            pEntry->ServiceID = WMI_DATA_VI_SVC;
-            pEntry->CreditAllocation = credits / 4;
-            if (pEntry->CreditAllocation == 0) {
-                pEntry->CreditAllocation++;
-            }
-            credits -= (int)pEntry->CreditAllocation;
-            if (credits <= 0) {
-                break;
-            }
-            pEntry++;
-            pEntry->ServiceID = WMI_DATA_VO_SVC;
-            pEntry->CreditAllocation = credits / 3;
-            if (pEntry->CreditAllocation == 0) {
-                pEntry->CreditAllocation++;
-            }
-            credits -= (int)pEntry->CreditAllocation;
-            if (credits <= 0) {
-                break;
-            }
-            pEntry++;
-            pEntry->ServiceID = WMI_DATA_BK_SVC;
-            pEntry->CreditAllocation = credits / 2;
-            credits -= (int)pEntry->CreditAllocation;
-            if (credits <= 0) {
-                break;
-            }
-            /*
-             * HTT_DATA_MSG_SVG is unidirectional from target -> host,
-             * so no target buffers are needed.
-             */
-            pEntry++;
-            pEntry->ServiceID = WMI_DATA_BE_SVC;
-            pEntry->CreditAllocation = credits / 2;
-            credits -= (int)pEntry->CreditAllocation;
-            if (credits <= 0) {
-                break;
-            }
-            /* leftovers go to best effort */
-            pEntry++;
-            pEntry->ServiceID = WMI_CONTROL_SVC;
-            pEntry->CreditAllocation = (A_UINT8)credits;
-            status = A_OK;
-        } while (FALSE);
- #endif
  #if defined(HIF_PCI)
-        //pEntry++;
         pEntry->ServiceID = WMI_DATA_BE_SVC;
         pEntry->CreditAllocation = (credits >> 1);
 
@@ -587,11 +562,6 @@ A_STATUS HTCWaitTarget(HTC_HANDLE HTCHandle)
 
     } while (FALSE);
 
-#if defined(HIF_USB)
-    if (WLAN_IS_EPPING_ENABLED(vos_get_conparam()))
-        HIFStart_INPipe(target->hif_dev);
-#endif
-
     AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Exit (%d)\n",status));
     AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("-HWT\n"));
     return status;
diff --git a/CORE/SERVICES/HTC/htc_recv.c b/CORE/SERVICES/HTC/htc_recv.c
index dad95853b168..03d61842bbdd 100644
--- a/CORE/SERVICES/HTC/htc_recv.c
+++ b/CORE/SERVICES/HTC/htc_recv.c
@@ -424,10 +424,6 @@ A_STATUS HTCRxCompletionHandler(
             netbuf = NULL;
             break;
         }
-#if defined(HIF_USB)
-        if (WLAN_IS_EPPING_ENABLED(vos_get_conparam()))
-            goto _eppingout;
-#endif
 
             /* the current message based HIF architecture allocates net bufs for recv packets
              * since this layer bridges that HIF to upper layers , which expects HTC packets,
@@ -458,9 +454,6 @@ A_STATUS HTCRxCompletionHandler(
 _out:
 #endif
 
-#if defined(HIF_USB)
-_eppingout:
-#endif
     if (netbuf != NULL) {
         adf_nbuf_free(netbuf);
     }
diff --git a/CORE/SERVICES/HTC/htc_send.c b/CORE/SERVICES/HTC/htc_send.c
index bde183eec6f8..4b9257f342ed 100644
--- a/CORE/SERVICES/HTC/htc_send.c
+++ b/CORE/SERVICES/HTC/htc_send.c
@@ -137,41 +137,14 @@ static void DoSendCompletion(HTC_ENDPOINT       *pEndpoint,
 
 }
 
-#if defined(HIF_USB)
-extern unsigned int txCompleteCounter;
-extern unsigned int txCounter;
-extern NDIS_EVENT   TXcompleteEvent;
-extern unsigned int checkTXcompleteEvent;
-#endif
 static void SendPacketCompletion(HTC_TARGET *target, HTC_PACKET *pPacket)
 {
     HTC_ENDPOINT    *pEndpoint = &target->EndPoint[pPacket->Endpoint];
     HTC_PACKET_QUEUE container;
-#if defined(HIF_USB)
-    EPPING_HEADER   *pktHeader;
-    adf_nbuf_t       nbuf;
-#endif
 
     RestoreTxPacket(target, pPacket);
     INIT_HTC_PACKET_QUEUE_AND_ADD(&container,pPacket);
 
-#if defined(HIF_USB)
-    if (WLAN_IS_EPPING_ENABLED(vos_get_conparam())) {
-        pktHeader = (EPPING_HEADER *)(pPacket->pBuffer);
-        if (IS_EPPING_PACKET(pktHeader))
-        {
-            txCompleteCounter++;
-            if ((txCounter == txCompleteCounter) && (checkTXcompleteEvent)) {
-                checkTXcompleteEvent = 0;
-            }
-        }
-        nbuf = GET_HTC_PACKET_NET_BUF_CONTEXT(pPacket);
-        if (nbuf != NULL) {
-          adf_nbuf_free(nbuf);
-        }
-        A_FREE(pPacket);
-    }
-#endif
     /* do completion */
     DoSendCompletion(pEndpoint,&container);
 }
@@ -410,85 +383,7 @@ static A_STATUS HTCIssuePackets(HTC_TARGET       *target,
 
     AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCIssuePackets: Queue: %p, Pkts %d \n",
                     pPktQueue, HTC_PACKET_QUEUE_DEPTH(pPktQueue)));
-#if defined(HIF_USB)
-    if (htc_bundle_send &&
-        (WLAN_IS_EPPING_ENABLED(vos_get_conparam()) ||
-           pEndpoint->UL_PipeID != 0)) {
-        adf_nbuf_t msg_bundle[HTC_MAX_MSG_PER_BUNDLE];
-        unsigned int  msg_length[HTC_MAX_MSG_PER_BUNDLE];
-        int msgs_to_bundle = 0;
-
-        while ((!HTC_QUEUE_EMPTY(pPktQueue)) &&
-               (msgs_to_bundle < HTC_MAX_MSG_PER_BUNDLE)) {
-            pPacket = HTC_PACKET_DEQUEUE(pPktQueue);
-            if(NULL == pPacket){
-                break;
-            }
-            netbuf = GET_HTC_PACKET_NET_BUF_CONTEXT(pPacket);
-            AR_DEBUG_ASSERT(netbuf);
-            /* Non-credit enabled endpoints have been mapped
-             * and setup by now, so no need to revisit
-             * the HTC headers */
-#if AR6004_HW
-            pPacket->PktInfo.AsTx.SendFlags |= HTC_FLAGS_SEND_BUNDLE;
-#endif
-            if (IS_TX_CREDIT_FLOW_ENABLED(pEndpoint)) {
-                payloadLen = pPacket->ActualLength;
-                /* setup HTC frame header */
-
-                pHtcHdr =
-                    (HTC_FRAME_HDR *) adf_nbuf_get_frag_vaddr(netbuf, 0);
-                AR_DEBUG_ASSERT(pHtcHdr);
-
-                HTC_WRITE32(pHtcHdr, SM(payloadLen,
-                    HTC_FRAME_HDR_PAYLOADLEN) |
-                    SM(pPacket->PktInfo.AsTx.SendFlags,
-                        HTC_FRAME_HDR_FLAGS) |
-                    SM(pPacket->Endpoint, HTC_FRAME_HDR_ENDPOINTID));
-                HTC_WRITE32(((A_UINT32 *)pHtcHdr) + 1,
-                    SM(pPacket->PktInfo.AsTx.SeqNo,
-                    HTC_FRAME_HDR_CONTROLBYTES1));
 
-                /*
-                 * Now that the HTC frame header has been added,
-                 * the netbuf can be mapped.  This only applies to
-                 * non-data frames, since data frames were already
-                 * mapped as they entered into the driver.
-                 * Check the "FIXUP_NETBUF" flag to see
-                 * whether this is a data netbuf that is already mapped,
-                 * or a non-data netbuf that needs to be mapped.
-                 */
-                if ((pPacket->PktInfo.AsTx.Flags &
-                    HTC_TX_PACKET_FLAG_FIXUP_NETBUF)) {
-                    adf_nbuf_map(
-                        target->osdev,
-                        GET_HTC_PACKET_NET_BUF_CONTEXT(pPacket),
-                        ADF_OS_DMA_TO_DEVICE);
-                }
-            }
-            LOCK_HTC_TX(target);
-            /* store in look up queue to match completions */
-            HTC_PACKET_ENQUEUE(&pEndpoint->TxLookupQueue,pPacket);
-            INC_HTC_EP_STAT(pEndpoint,TxIssued,1);
-            sdio_bundling_stats.TxIssued += 1;
-            pEndpoint->ul_outstanding_cnt++;
-            UNLOCK_HTC_TX(target);
-            /* pPktQueue is less than HTC_MAX_MSG_PER_BUNDLE */
-            msg_bundle[msgs_to_bundle] = netbuf;
-            msg_length[msgs_to_bundle] = HTC_HDR_LENGTH +
-                pPacket->ActualLength;
-            msgs_to_bundle++;
-        }
-
-        sdio_bundling_stats.TxPacketsBundled += msgs_to_bundle;
-        sdio_bundling_stats.TxBundles += 1;
-        HIFSendMultiple_head(target->hif_dev,
-            pEndpoint->UL_PipeID, pEndpoint->Id,
-            msg_bundle,
-            msg_length,
-            msgs_to_bundle);
-    } else {
-#endif
     while (TRUE) {
 #if ENABLE_BUNDLE_TX
         if(IS_TX_CREDIT_FLOW_ENABLED(pEndpoint) &&
@@ -580,9 +475,6 @@ static A_STATUS HTCIssuePackets(HTC_TARGET       *target,
         }
 
     }
-#if defined(HIF_USB)
-    }
-#endif
 
     if (adf_os_unlikely(A_FAILED(status))) {
 #if defined(HIF_USB)
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index fe631ac3b87c..69a00830696c 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -657,18 +657,18 @@ static int wma_vdev_start_rsp_ind(tp_wma_handle wma, u_int8_t *buf)
 		params->status = resp_event->status;
 		if (resp_event->resp_type == WMI_VDEV_RESTART_RESP_EVENT &&
 			(iface->type == WMI_VDEV_TYPE_STA)) {
-			wmi_unified_vdev_up_send(wma->wmi_handle,
-				resp_event->vdev_id,
-				iface->aid,
-				iface->bssid);
-		}
-		/*
-		* Marking the VDEV UP STATUS to FALSE
-		* since, VDEV RESTART will do a VDEV DOWN
-		* in the firmware.
-		*/
-		else
-			iface->vdev_up = FALSE;
+			if (wmi_unified_vdev_up_send(wma->wmi_handle,
+				resp_event->vdev_id, iface->aid,
+				iface->bssid)) {
+				WMA_LOGE("%s:vdev_up failed vdev_id %d",
+				__func__, resp_event->vdev_id);
+				wma->interfaces[resp_event->vdev_id].vdev_up =
+									FALSE;
+			} else {
+				wma->interfaces[resp_event->vdev_id].vdev_up =
+									TRUE;
+			}
+                }
 
 		wma_send_msg(wma, WDA_SWITCH_CHANNEL_RSP, (void *)params, 0);
 	} else if (req_msg->msg_type == WDA_ADD_BSS_REQ) {
@@ -8629,17 +8629,28 @@ static VOS_STATUS wma_vdev_start(tp_wma_handle wma,
 		 chan->mhz, req->chan, chanmode, req->is_dfs,
 		 req->beacon_intval, cmd->dtim_period, chan->band_center_freq1);
 
-   if (isRestart)
-      ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
-				         WMI_VDEV_RESTART_REQUEST_CMDID);
-   else
-      ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
-				         WMI_VDEV_START_REQUEST_CMDID);
-   if (ret < 0) {
-      WMA_LOGP("%s: Failed to send vdev start command", __func__);
-      adf_nbuf_free(buf);
-      return VOS_STATUS_E_FAILURE;
-   }
+
+	if (isRestart) {
+		/*
+		* Marking the VDEV UP STATUS to FALSE
+		* since, VDEV RESTART will do a VDEV DOWN
+		* in the firmware.
+		*/
+		intr[cmd->vdev_id].vdev_up = FALSE;
+
+		ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+					WMI_VDEV_RESTART_REQUEST_CMDID);
+
+	} else {
+		ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+				WMI_VDEV_START_REQUEST_CMDID);
+	}
+
+	if (ret < 0) {
+		WMA_LOGP("%s: Failed to send vdev start command", __func__);
+		adf_nbuf_free(buf);
+		return VOS_STATUS_E_FAILURE;
+	}
 
 	/* Store vdev params in SAP mode which can be used in vdev restart */
 	if (intr[req->vdev_id].type == WMI_VDEV_TYPE_AP &&
diff --git a/CORE/SME/inc/csrApi.h b/CORE/SME/inc/csrApi.h
index c2b55b986776..c2fe8cd0b70d 100644
--- a/CORE/SME/inc/csrApi.h
+++ b/CORE/SME/inc/csrApi.h
@@ -209,6 +209,24 @@ typedef enum
     eCSR_BW_160MHz_VAL = 160
 }eCSR_BW_Val;
 
+typedef enum
+{
+   eCSR_INI_SINGLE_CHANNEL_CENTERED = 0,
+   eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY,
+   eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY,
+#ifdef WLAN_FEATURE_11AC
+   eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED,
+   eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED,
+   eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED,
+   eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW,
+   eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW,
+   eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH,
+   eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH,
+#endif
+   eCSR_INI_CHANNEL_BONDING_STATE_MAX
+}eIniChanBondState;
+
+
 #define CSR_SCAN_TIME_DEFAULT       0
 #define CSR_VALUE_IGNORED           0xFFFFFFFF
 #define CSR_RSN_PMKID_SIZE          16
diff --git a/CORE/SME/inc/smeInside.h b/CORE/SME/inc/smeInside.h
index 55b807d1d850..be17a5892e80 100644
--- a/CORE/SME/inc/smeInside.h
+++ b/CORE/SME/inc/smeInside.h
@@ -264,6 +264,8 @@ eHalStatus csrIsFullPowerNeeded( tpAniSirGlobal pMac, tSmeCmd *pCommand, tReques
                                  tANI_BOOLEAN *pfNeedPower);
 void csrAbortCommand( tpAniSirGlobal pMac, tSmeCmd *pCommand, tANI_BOOLEAN fStopping );
 
+VOS_STATUS csrIsValidChannel(tpAniSirGlobal pMac, tANI_U8 chnNum);
+
 eHalStatus sme_AcquireGlobalLock( tSmeStruct *psSme);
 eHalStatus sme_ReleaseGlobalLock( tSmeStruct *psSme);
 
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index eba31df65e76..feb0d850d0ce 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -1499,37 +1499,37 @@ ePhyChanBondState csrConvertCBIniValueToPhyCBState(v_U32_t cbIniValue)
    ePhyChanBondState phyCbState;
    switch (cbIniValue) {
       // secondary none
-      case 0:
+      case eCSR_INI_SINGLE_CHANNEL_CENTERED:
         phyCbState = PHY_SINGLE_CHANNEL_CENTERED;
         break;
       // secondary LOW
-      case 1:
+      case eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY:
         phyCbState = PHY_DOUBLE_CHANNEL_HIGH_PRIMARY;
         break;
       // secondary HIGH
-      case 2:
+      case eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY:
         phyCbState = PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
         break;
 #ifdef WLAN_FEATURE_11AC
-      case 3:
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED;
         break;
-      case 4:
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED;
         break;
-      case 5:
-        phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED;
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED:
+        phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED;
         break;
-      case 6:
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW;
         break;
-      case 7:
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW;
         break;
-      case 8:
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH;
         break;
-      case 9:
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
         phyCbState = PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH;
         break;
 #endif
@@ -1548,42 +1548,42 @@ v_U32_t csrConvertPhyCBStateToIniValue(ePhyChanBondState phyCbState)
    switch (phyCbState) {
       // secondary none
       case PHY_SINGLE_CHANNEL_CENTERED:
-        cbIniValue = 0;
+        cbIniValue = eCSR_INI_SINGLE_CHANNEL_CENTERED;
         break;
       // secondary LOW
       case PHY_DOUBLE_CHANNEL_HIGH_PRIMARY:
-        cbIniValue = 1;
+        cbIniValue = eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY;
         break;
       // secondary HIGH
       case PHY_DOUBLE_CHANNEL_LOW_PRIMARY:
-        cbIniValue = 2;
+        cbIniValue = eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY;
         break;
 #ifdef WLAN_FEATURE_11AC
       case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED:
-        cbIniValue = 3;
+        cbIniValue = eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED;
         break;
       case PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED:
-        cbIniValue = 4;
+        cbIniValue = eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED;
         break;
       case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED:
-        cbIniValue = 5;
+        cbIniValue = eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED;
         break;
       case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
-        cbIniValue = 6;
+        cbIniValue = eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW;
         break;
       case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
-        cbIniValue = 7;
+        cbIniValue = eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW;
         break;
       case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
-        cbIniValue = 8;
+        cbIniValue = eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH;
         break;
       case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
-        cbIniValue = 9;
+        cbIniValue = eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH;
         break;
 #endif
       default:
         // return some invalid value
-        cbIniValue = 10;
+        cbIniValue = eCSR_INI_CHANNEL_BONDING_STATE_MAX;
         break;
    }
    return cbIniValue;
@@ -2219,17 +2219,48 @@ void csrPruneChannelListForMode( tpAniSirGlobal pMac, tCsrChannel *pChannelList
     }
 }
 #define INFRA_AP_DEFAULT_CHANNEL 6
-eHalStatus csrIsValidChannel(tpAniSirGlobal pMac, tANI_U8 chnNum)
+VOS_STATUS csrIsValidChannel(tpAniSirGlobal pMac, tANI_U8 chnNum)
 {
     tANI_U8 index= 0;
-    eHalStatus status = eHAL_STATUS_FAILURE;
+    VOS_STATUS status = VOS_STATUS_E_NOSUPPORT;
+
+    /* regulatory check */
     for (index=0; index < pMac->scan.base20MHzChannels.numChannels ;index++)
     {
         if(pMac->scan.base20MHzChannels.channelList[ index ] == chnNum){
-            status = eHAL_STATUS_SUCCESS;
+            status = VOS_STATUS_SUCCESS;
             break;
         }
     }
+
+    if (status == VOS_STATUS_SUCCESS)
+    {
+       /* dfs nol */
+       for (index = 0;
+             index < pMac->sap.SapDfsInfo.numCurrentRegDomainDfsChannels;
+             index++)
+       {
+          tSapDfsNolInfo* dfsChan =
+             &pMac->sap.SapDfsInfo.sapDfsChannelNolList[index];
+          if ((dfsChan->dfs_channel_number == chnNum) &&
+                (dfsChan->radar_status_flag == eSAP_DFS_CHANNEL_UNAVAILABLE))
+          {
+             VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                   FL("channel %d is in dfs nol"),
+                   chnNum);
+             status = VOS_STATUS_E_FAILURE;
+             break;
+          }
+       }
+    }
+
+    if (VOS_STATUS_SUCCESS != status)
+    {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+             FL("channel %d is not available"),
+             chnNum);
+    }
+
     return status;
 }
 
@@ -12129,7 +12160,7 @@ eHalStatus csrRoamIssueStartBss( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRo
     pParam->ssidHidden        = pProfile->SSIDs.SSIDList[0].ssidHidden;
     if (CSR_IS_INFRA_AP(pProfile)&& (pParam->operationChn != 0))
     {
-        if (csrIsValidChannel(pMac, pParam->operationChn) != eHAL_STATUS_SUCCESS)
+        if (csrIsValidChannel(pMac, pParam->operationChn) != VOS_STATUS_SUCCESS)
         {
             pParam->operationChn = INFRA_AP_DEFAULT_CHANNEL;
         }
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index eaae22bea44c..7ace56073b8b 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -11158,6 +11158,172 @@ void sme_UpdateEnableSSR(tHalHandle hHal, tANI_BOOLEAN enableSSR)
 }
 
 /*
+ * SME API to stringify bonding mode. (hostapd convention)
+ */
+
+static const char* sme_CBMode2String( tANI_U32 mode)
+{
+   switch (mode)
+   {
+      case eCSR_INI_SINGLE_CHANNEL_CENTERED:
+         return "HT20";
+      case eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY:
+         return "HT40-"; /* lower secondary channel */
+      case eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY:
+         return "HT40+"; /* upper secondary channel */
+#ifdef WLAN_FEATURE_11AC
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
+         return "VHT80+40+"; /* upper secondary channels */
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
+         return "VHT80+40-"; /* 1 lower and 2 upper secondary channels */
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
+         return "VHT80-40+"; /* 2 lower and 1 upper secondary channels */
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
+         return "VHT80-40-"; /* lower secondary channels */
+#endif
+      default:
+         VOS_ASSERT(0);
+         return "Unknown";
+   }
+}
+
+/*
+ * SME API to adjust bonding mode to regulatory, dfs nol .. etc.
+ *
+ */
+static VOS_STATUS sme_AdjustCBMode(tAniSirGlobal* pMac,
+      tSmeConfigParams  *smeConfig,
+      tANI_U8 channel)
+{
+
+   const tANI_U8 step = 4;
+   tANI_U8 i, startChan = channel, chanCnt = 0, chanBitmap = 0;
+   tANI_BOOLEAN violation = VOS_FALSE;
+   tANI_U32 newMode, mode;
+
+   /* get the bonding mode */
+   mode = (channel <= 14) ? smeConfig->csrConfig.channelBondingMode24GHz :
+                        smeConfig->csrConfig.channelBondingMode5GHz;
+   newMode = mode;
+
+   /* get the channels */
+   switch (mode)
+   {
+      case eCSR_INI_SINGLE_CHANNEL_CENTERED:
+         startChan = channel;
+         chanCnt = 1;
+         break;
+      case eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY:
+         startChan = channel - step;
+         chanCnt = 2;
+         break;
+      case eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY:
+         startChan = channel;
+         chanCnt=2;
+         break;
+#ifdef WLAN_FEATURE_11AC
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
+         startChan = channel;
+         chanCnt = 4;
+         break;
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
+         startChan = channel - step;
+         chanCnt = 4;
+         break;
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
+         startChan = channel - 2*step;
+         chanCnt = 4;
+         break;
+      case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
+         startChan = channel - 3*step;
+         chanCnt = 4;
+         break;
+#endif
+      default:
+         VOS_ASSERT(0);
+         return VOS_STATUS_E_FAILURE;
+   }
+
+   /* find violation; also map valid channels to a bitmap */
+   for (i = 0; i < chanCnt; i++)
+   {
+      if (csrIsValidChannel(pMac, (startChan + (i * step))) ==
+            VOS_STATUS_SUCCESS)
+         chanBitmap = chanBitmap | 1 << i;
+      else
+         violation = VOS_TRUE;
+   }
+
+   /* no channels are valid */
+   if (chanBitmap == 0)
+   {
+      /* never be in this case */
+      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+            FL("channel %d %s is not supported"),
+            channel,
+            sme_CBMode2String(mode));
+      return VOS_STATUS_E_INVAL;
+   }
+
+   /* fix violation */
+   if (violation)
+   {
+      const tANI_U8 lowerMask = 0x03, upperMask = 0x0c;
+      /* fall back to single channel in all exception cases */
+      newMode = eCSR_INI_SINGLE_CHANNEL_CENTERED;
+
+      switch (mode)
+      {
+         case eCSR_INI_SINGLE_CHANNEL_CENTERED:
+            /* fall thru */
+         case eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY:
+            /* fall thru */
+         case eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY:
+            break;
+#ifdef WLAN_FEATURE_11AC
+         case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
+            if ((chanBitmap & lowerMask) == lowerMask)
+               newMode = eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY;
+            break;
+         case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
+            if ((chanBitmap & lowerMask) == lowerMask)
+               newMode = eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY;
+            break;
+         case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
+            if ((chanBitmap & upperMask) == upperMask)
+               newMode = eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY;
+            break;
+         case eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
+            if ((chanBitmap & upperMask) == upperMask)
+               newMode = eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY;
+            break;
+#endif
+         default:
+            return VOS_STATUS_E_NOSUPPORT;
+            break;
+      }
+
+      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_WARN,
+            FL("bonding mode adjust: %s to %s"),
+            sme_CBMode2String(mode),
+            sme_CBMode2String(newMode));
+
+   }
+
+   /* check for mode change */
+   if (newMode != mode)
+   {
+      if (channel <= 14)
+          smeConfig->csrConfig.channelBondingMode24GHz = newMode;
+      else
+          smeConfig->csrConfig.channelBondingMode5GHz = newMode;
+   }
+
+   return VOS_STATUS_SUCCESS;
+
+}
+
+/*
  * SME API to determine the channel bonding mode
  */
 VOS_STATUS sme_SelectCBMode(tHalHandle hHal, eCsrPhyMode eCsrPhyMode, tANI_U8 channel)
@@ -11200,47 +11366,53 @@ VOS_STATUS sme_SelectCBMode(tHalHandle hHal, eCsrPhyMode eCsrPhyMode, tANI_U8 ch
                 channel == 116 || channel == 149 )
           {
              smeConfig.csrConfig.channelBondingMode5GHz =
-                PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW - 1;
+                eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW;
           }
           else if ( channel == 40 || channel == 56 || channel == 104 ||
                 channel == 120 || channel == 153 )
           {
              smeConfig.csrConfig.channelBondingMode5GHz =
-                PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW - 1;
+                eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW;
           }
           else if ( channel == 44 || channel == 60 || channel == 108 ||
                 channel == 124 || channel == 157 )
           {
              smeConfig.csrConfig.channelBondingMode5GHz =
-                PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH -1;
+                eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH;
           }
           else if ( channel == 48 || channel == 64 || channel == 112 ||
                 channel == 128 || channel == 161 )
           {
              smeConfig.csrConfig.channelBondingMode5GHz =
-                PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH - 1;
+                eCSR_INI_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH;
           }
           else if ( channel == 165 || channel == 140 )
           {
-             smeConfig.csrConfig.channelBondingMode5GHz = 0;
+             smeConfig.csrConfig.channelBondingMode5GHz =
+                eCSR_INI_SINGLE_CHANNEL_CENTERED;
           }
           else if ( channel == 132 )
           {
-             smeConfig.csrConfig.channelBondingMode5GHz = 2;
+             smeConfig.csrConfig.channelBondingMode5GHz =
+                eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY;
           }
           else if ( channel == 136 )
           {
-             smeConfig.csrConfig.channelBondingMode5GHz = 1;
+             smeConfig.csrConfig.channelBondingMode5GHz =
+                eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY;
           }
       }
       /*TODO: Set HT40+ / HT40- for channel 5-7 based on ACS */
       if (pMac->roam.configParam.channelBondingMode24GHz) {
           if (channel >= 1 && channel <= 5)
-             smeConfig.csrConfig.channelBondingMode24GHz = 2;
+             smeConfig.csrConfig.channelBondingMode24GHz =
+                eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY;
           else if (channel >= 6 && channel <= 13)
-             smeConfig.csrConfig.channelBondingMode24GHz = 1;
+             smeConfig.csrConfig.channelBondingMode24GHz =
+                eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY;
           else if (channel ==14)
-             smeConfig.csrConfig.channelBondingMode24GHz = 0;
+             smeConfig.csrConfig.channelBondingMode24GHz =
+                eCSR_INI_SINGLE_CHANNEL_CENTERED;
       }
 
    }
@@ -11255,28 +11427,34 @@ VOS_STATUS sme_SelectCBMode(tHalHandle hHal, eCsrPhyMode eCsrPhyMode, tANI_U8 ch
                 channel == 120 || channel == 128 || channel == 136 ||
                 channel == 153 || channel == 161 )
           {
-             smeConfig.csrConfig.channelBondingMode5GHz = 1;
+             smeConfig.csrConfig.channelBondingMode5GHz =
+                eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY;
           }
           else if ( channel== 36 || channel == 44 || channel == 52 ||
                 channel == 60 || channel == 100 || channel == 108 ||
                 channel == 116 || channel == 124 || channel == 132 ||
                 channel == 149 || channel == 157 )
           {
-             smeConfig.csrConfig.channelBondingMode5GHz = 2;
+             smeConfig.csrConfig.channelBondingMode5GHz =
+                eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY;
           }
           else if ( channel == 165 || channel == 140)
           {
-             smeConfig.csrConfig.channelBondingMode5GHz = 0;
+             smeConfig.csrConfig.channelBondingMode5GHz =
+                eCSR_INI_SINGLE_CHANNEL_CENTERED;
           }
       }
 
       if (pMac->roam.configParam.channelBondingMode24GHz) {
           if (channel >= 1 && channel <= 5)
-             smeConfig.csrConfig.channelBondingMode24GHz = 2;
+             smeConfig.csrConfig.channelBondingMode24GHz =
+                eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY;
           else if (channel >= 6 && channel <= 13)
-             smeConfig.csrConfig.channelBondingMode24GHz = 1;
+             smeConfig.csrConfig.channelBondingMode24GHz =
+                eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY;
           else if (channel ==14)
-             smeConfig.csrConfig.channelBondingMode24GHz = 0;
+             smeConfig.csrConfig.channelBondingMode24GHz =
+                eCSR_INI_SINGLE_CHANNEL_CENTERED;
       }
    }
 
@@ -11291,9 +11469,13 @@ VOS_STATUS sme_SelectCBMode(tHalHandle hHal, eCsrPhyMode eCsrPhyMode, tANI_U8 ch
          eCSR_DOT11_MODE_11a_ONLY == eCsrPhyMode ||
          eCSR_DOT11_MODE_abg == eCsrPhyMode)
    {
-      smeConfig.csrConfig.channelBondingMode5GHz = 0;
+      smeConfig.csrConfig.channelBondingMode5GHz =
+         eCSR_INI_SINGLE_CHANNEL_CENTERED;
    } else if ( eCSR_DOT11_MODE_11g_ONLY == eCsrPhyMode)
-      smeConfig.csrConfig.channelBondingMode24GHz = 0;
+      smeConfig.csrConfig.channelBondingMode24GHz =
+         eCSR_INI_SINGLE_CHANNEL_CENTERED;
+
+   sme_AdjustCBMode(pMac, &smeConfig, channel);
 
    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
          "%s cbmode selected=%d", (channel <= 14) ? "2G" : "5G",
diff --git a/Kbuild b/Kbuild
index 702e64d35001..42d9a6076622 100644
--- a/Kbuild
+++ b/Kbuild
@@ -204,7 +204,8 @@ endif
 
 #Enable IPA offload
 ifeq ($(CONFIG_IPA), y)
-CONFIG_IPA_OFFLOAD := 0
+CONFIG_IPA_OFFLOAD := 1
+CONFIG_IPA_UC_OFFLOAD := 1
 endif
 
 #Enable Signed firmware support for split binary format
@@ -1315,6 +1316,10 @@ ifeq ($(CONFIG_IPA_OFFLOAD), 1)
 CDEFINES += -DIPA_OFFLOAD -DHDD_IPA_USE_IPA_RM_TIMER
 endif
 
+ifeq ($(CONFIG_IPA_UC_OFFLOAD), 1)
+CDEFINES += -DIPA_UC_OFFLOAD
+endif
+
 #Enable GTK Offload
 ifeq ($(CONFIG_GTK_OFFLOAD), 1)
 CDEFINES += -DWLAN_FEATURE_GTK_OFFLOAD