wlan: qcacld: Complete PMF (802.11w) support for Soft AP

These changes complete Protected Management Frames (802.11w)
support for the device in Soft AP mode.

The changes allow support for this feature without any changes
needed in hostapd or the cfg80211/nl80211 interface.  Support
is completely done within the driver.

Note: dot11f.h and dot11f.c changes are already merged via clean
up gerrit for this project.

CRs-Fixed: 645347

Change-Id: I267ae701d9a3e7a6fc0276dd1c226ed1cc700461

27 files changed, 602 insertions, 56 deletions

diff --git a/CORE/HDD/inc/wlan_hdd_hostapd.h b/CORE/HDD/inc/wlan_hdd_hostapd.h
index 3b084a365ce9..3d957a8ccacc 100644
--- a/CORE/HDD/inc/wlan_hdd_hostapd.h
+++ b/CORE/HDD/inc/wlan_hdd_hostapd.h
@@ -83,6 +83,8 @@ int hdd_softap_unpackIE( tHalHandle halHandle,
                 eCsrEncryptionType *pEncryptType,
                 eCsrEncryptionType *mcEncryptType,
                 eCsrAuthType *pAuthType,
+                v_BOOL_t *pMFPCapable,
+                v_BOOL_t *pMFPRequired,
                 u_int16_t gen_ie_len,
                 u_int8_t *gen_ie );
 
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 068ca5bfeb22..ae8676bd3e33 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -1180,13 +1180,6 @@ void wlan_hdd_cfg80211_post_voss_start(hdd_adapter_t* pAdapter)
     sme_RegisterMgmtFrame(hHal, HDD_SESSION_ID_ANY, type,
                          (v_U8_t*)WNM_BSS_ACTION_FRAME,
                                   WNM_BSS_ACTION_FRAME_SIZE );
-
-#ifdef WLAN_FEATURE_11W
-    /* SA Query Response Action Frame */
-    sme_RegisterMgmtFrame(hHal, HDD_SESSION_ID_ANY, type,
-                         (v_U8_t*)SA_QUERY_FRAME_RSP,
-                                  SA_QUERY_FRAME_RSP_SIZE );
-#endif /* WLAN_FEATURE_11W */
 }
 
 void wlan_hdd_cfg80211_pre_voss_stop(hdd_adapter_t* pAdapter)
@@ -2093,6 +2086,8 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
     hdd_config_t *iniConfig;
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pHostapdAdapter);
     tSmeConfigParams *psmeConfig;
+    v_BOOL_t MFPCapable;
+    v_BOOL_t MFPRequired;
 
     ENTER();
 
@@ -2241,6 +2236,8 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
                         &RSNEncryptType,
                         &mcRSNEncryptType,
                         &RSNAuthType,
+                        &MFPCapable,
+                        &MFPRequired,
                         pConfig->pRSNWPAReqIE[1]+2,
                         pConfig->pRSNWPAReqIE );
 
@@ -2280,6 +2277,8 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
                           &RSNEncryptType,
                           &mcRSNEncryptType,
                           &RSNAuthType,
+                          &MFPCapable,
+                          &MFPRequired,
                           pConfig->pRSNWPAReqIE[1]+2,
                           pConfig->pRSNWPAReqIE );
 
@@ -2466,6 +2465,13 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
     pConfig->obssProtEnabled =
            (WLAN_HDD_GET_CTX(pHostapdAdapter))->cfg_ini->apOBSSProtEnabled;
 
+#ifdef WLAN_FEATURE_11W
+    pConfig->mfpCapable = MFPCapable;
+    pConfig->mfpRequired = MFPRequired;
+    hddLog(LOG1, FL("Soft AP MFP capable %d, MFP required %d\n"),
+           pConfig->mfpCapable, pConfig->mfpRequired);
+#endif
+
     hddLog(LOGW, FL("SOftAP macaddress : "MAC_ADDRESS_STR),
                  MAC_ADDR_ARRAY(pHostapdAdapter->macAddressCurrent.bytes));
     hddLog(LOGW,FL("ssid =%s, beaconint=%d, channel=%d"),
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index dad35ca71485..217f962e8757 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -1190,11 +1190,14 @@ stopbss :
     }
     return VOS_STATUS_SUCCESS;
 }
+
 int hdd_softap_unpackIE(
                 tHalHandle halHandle,
                 eCsrEncryptionType *pEncryptType,
                 eCsrEncryptionType *mcEncryptType,
                 eCsrAuthType *pAuthType,
+                v_BOOL_t *pMFPCapable,
+                v_BOOL_t *pMFPRequired,
                 u_int16_t gen_ie_len,
                 u_int8_t *gen_ie )
 {
@@ -1247,7 +1250,8 @@ int hdd_softap_unpackIE(
         //dot11RSNIE.gp_cipher_suite_count
         *mcEncryptType = hdd_TranslateRSNToCsrEncryptionType(dot11RSNIE.gp_cipher_suite);
         // Set the PMKSA ID Cache for this interface
-
+        *pMFPCapable = 0 != (dot11RSNIE.RSN_Cap[0] & 0x80);
+        *pMFPRequired = 0 != (dot11RSNIE.RSN_Cap[0] & 0x40);
         // Calling csrRoamSetPMKIDCache to configure the PMKIDs into the cache
     } else
     if (gen_ie[0] == DOT11F_EID_WPA)
@@ -1279,6 +1283,8 @@ int hdd_softap_unpackIE(
         *pEncryptType = hdd_TranslateWPAToCsrEncryptionType(dot11WPAIE.unicast_ciphers[0]);
         //dot11WPAIE.unicast_cipher_count
         *mcEncryptType = hdd_TranslateWPAToCsrEncryptionType(dot11WPAIE.multicast_cipher);
+        *pMFPCapable = VOS_FALSE;
+        *pMFPRequired = VOS_FALSE;
     }
     else
     {
@@ -2522,6 +2528,8 @@ static iw_softap_commit(struct net_device *dev,
     eCsrAuthType RSNAuthType;
     eCsrEncryptionType RSNEncryptType;
     eCsrEncryptionType mcRSNEncryptType;
+    v_BOOL_t MFPCapable = VOS_FALSE;
+    v_BOOL_t MFPRequired = VOS_FALSE;
 
     pHostapdState = WLAN_HDD_GET_HOSTAP_STATE_PTR(pHostapdAdapter);
     pCommitConfig = (s_CommitConfig_t *)extra;
@@ -2588,6 +2596,8 @@ static iw_softap_commit(struct net_device *dev,
                                   &RSNEncryptType,
                                   &mcRSNEncryptType,
                                   &RSNAuthType,
+                                  &MFPCapable,
+                                  &MFPRequired,
                                   pConfig->pRSNWPAReqIE[1]+2,
                                   pConfig->pRSNWPAReqIE );
 
diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index f0d1f79825a8..744e1ad9939a 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -662,6 +662,12 @@ typedef struct sSirSmeStartBssReq
     tSirMacRateSet          operationalRateSet;// Has 11a or 11b rates
     tSirMacRateSet          extendedRateSet;    // Has 11g rates
     tSirHTConfig            htConfig;
+
+#ifdef WLAN_FEATURE_11W
+    tANI_BOOLEAN            pmfCapable;
+    tANI_BOOLEAN            pmfRequired;
+#endif
+
 } tSirSmeStartBssReq, *tpSirSmeStartBssReq;
 
 #define GET_IE_LEN_IN_BSS(lenInBss) ( lenInBss + sizeof(lenInBss) - \
diff --git a/CORE/MAC/inc/sirMacProtDef.h b/CORE/MAC/inc/sirMacProtDef.h
index 177bf1b64a90..6ef52af97d93 100644
--- a/CORE/MAC/inc/sirMacProtDef.h
+++ b/CORE/MAC/inc/sirMacProtDef.h
@@ -680,7 +680,9 @@ typedef enum eSirMacStatusCodes
     eSIR_MAC_SHORT_SLOT_NOT_SUPORTED_STATUS       = 25, //Association denied due to requesting station not supporting the Short Slot Time
                                                         //option
     eSIR_MAC_DSSS_OFDM_NOT_SUPPORTED_STATUS       = 26, //Association denied due to requesting station not supporting the DSSS-OFDM option
-    // reserved                                     27-31
+    // reserved                                     27-29
+    eSIR_MAC_TRY_AGAIN_LATER                      = 30, //Association request rejected temporarily, try again later
+    // reserved                                     31
     eSIR_MAC_QOS_UNSPECIFIED_FAILURE_STATUS       = 32, //Unspecified, QoS-related failure
     eSIR_MAC_QAP_NO_BANDWIDTH_STATUS              = 33, //Association denied because QoS AP has insufficient bandwidth to handle another
                                                         //QoS STA
@@ -2846,6 +2848,11 @@ typedef __ani_attr_pre_packed struct sSirPhy11aHdr
 
 #define SIR_MAC_MIN_IE_LEN 2 // Minimum IE length for IE validation
 
+
+#define SIR_MAC_TI_TYPE_REASSOC_DEADLINE        1
+#define SIR_MAC_TI_TYPE_KEY_LIFETIME            2
+#define SIR_MAC_TI_TYPE_ASSOC_COMEBACK          3
+
 #define SIR_MAC_VHT_CAP_MAX_MPDU_LEN              0
 #define SIR_MAC_VHT_CAP_SUPP_CH_WIDTH_SET         2
 #define SIR_MAC_VHT_CAP_LDPC_CODING_CAP           4
diff --git a/CORE/MAC/inc/wniCfgAp.h b/CORE/MAC/inc/wniCfgAp.h
index e815cc0c7ed0..3db433b97cec 100644
--- a/CORE/MAC/inc/wniCfgAp.h
+++ b/CORE/MAC/inc/wniCfgAp.h
@@ -346,13 +346,15 @@
 #define WNI_CFG_TDLS_BUF_STA_ENABLED    299
 #define WNI_CFG_TDLS_PUAPSD_INACT_TIME    300
 #define WNI_CFG_TDLS_RX_FRAME_THRESHOLD    301
-#define WNI_CFG_ENABLE_ADAPT_RX_DRAIN    302
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR    303
-#define WNI_CFG_ANTENNA_DIVESITY    304
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT    305
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY    306
-#define WNI_CFG_CURRENT_RSSI    307
-#define WNI_CFG_RTT3_ENABLE    308
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES    302
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL    303
+#define WNI_CFG_ENABLE_ADAPT_RX_DRAIN    304
+#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR    305
+#define WNI_CFG_ANTENNA_DIVESITY    306
+#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT    307
+#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY    308
+#define WNI_CFG_CURRENT_RSSI    309
+#define WNI_CFG_RTT3_ENABLE    310
 
 /*
  * String parameter lengths
@@ -2524,6 +2526,22 @@
 #define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_APMAX    20
 #define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_APDEF    10
 
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_STAMIN    0
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_STAMAX    20
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_STADEF    5
+
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_APMIN    0
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_APMAX    20
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_APDEF    5
+
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STAMIN    0
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STAMAX    2000
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STADEF    200
+
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_APMIN    0
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_APMAX    2000
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_APDEF    200
+
 #define WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STAMIN    0
 #define WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STAMAX    1
 #define WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STADEF    1
@@ -2576,10 +2594,10 @@
 #define WNI_CFG_RTT3_ENABLE_APMAX    1
 #define WNI_CFG_RTT3_ENABLE_APDEF    1
 
-#define CFG_PARAM_MAX_NUM         309
-#define CFG_AP_IBUF_MAX_SIZE      248
+#define CFG_PARAM_MAX_NUM         311
+#define CFG_AP_IBUF_MAX_SIZE      250
 #define CFG_AP_SBUF_MAX_SIZE      3422
-#define CFG_STA_IBUF_MAX_SIZE     243
+#define CFG_STA_IBUF_MAX_SIZE     245
 #define CFG_STA_SBUF_MAX_SIZE     3388
 #define CFG_SEM_MAX_NUM           19
 
diff --git a/CORE/MAC/inc/wniCfgSta.h b/CORE/MAC/inc/wniCfgSta.h
index d0ec7121942c..e83788549c54 100644
--- a/CORE/MAC/inc/wniCfgSta.h
+++ b/CORE/MAC/inc/wniCfgSta.h
@@ -340,13 +340,15 @@
 #define WNI_CFG_TDLS_BUF_STA_ENABLED    299
 #define WNI_CFG_TDLS_PUAPSD_INACT_TIME    300
 #define WNI_CFG_TDLS_RX_FRAME_THRESHOLD    301
-#define WNI_CFG_ENABLE_ADAPT_RX_DRAIN    302
-#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR    303
-#define WNI_CFG_ANTENNA_DIVESITY    304
-#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT    305
-#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY    306
-#define WNI_CFG_CURRENT_RSSI    307
-#define WNI_CFG_RTT3_ENABLE    308
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES    302
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL    303
+#define WNI_CFG_ENABLE_ADAPT_RX_DRAIN    304
+#define WNI_CFG_FLEX_CONNECT_POWER_FACTOR    305
+#define WNI_CFG_ANTENNA_DIVESITY    306
+#define WNI_CFG_GO_LINK_MONITOR_TIMEOUT    307
+#define WNI_CFG_RMC_ACTION_PERIOD_FREQUENCY    308
+#define WNI_CFG_CURRENT_RSSI    309
+#define WNI_CFG_RTT3_ENABLE    310
 
 /*
  * String parameter lengths
@@ -1637,6 +1639,14 @@
 #define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_STAMAX    20
 #define WNI_CFG_TDLS_RX_FRAME_THRESHOLD_STADEF    10
 
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_STAMIN    0
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_STAMAX    20
+#define WNI_CFG_PMF_SA_QUERY_MAX_RETRIES_STADEF    5
+
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STAMIN    0
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STAMAX    2000
+#define WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STADEF    200
+
 #define WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STAMIN    0
 #define WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STAMAX    1
 #define WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STADEF    1
@@ -1665,8 +1675,8 @@
 #define WNI_CFG_RTT3_ENABLE_STAMAX    1
 #define WNI_CFG_RTT3_ENABLE_STADEF    1
 
-#define CFG_PARAM_MAX_NUM        309
-#define CFG_STA_IBUF_MAX_SIZE    243
+#define CFG_PARAM_MAX_NUM        311
+#define CFG_STA_IBUF_MAX_SIZE    245
 #define CFG_STA_SBUF_MAX_SIZE    3388
 #define CFG_SEM_MAX_NUM          19
 
diff --git a/CORE/MAC/src/cfg/cfgParamName.c b/CORE/MAC/src/cfg/cfgParamName.c
index 17990e184307..c35f7e266553 100644
--- a/CORE/MAC/src/cfg/cfgParamName.c
+++ b/CORE/MAC/src/cfg/cfgParamName.c
@@ -337,6 +337,8 @@ unsigned char *gCfgParamName[] = {
     (unsigned char *)"TDLS_BUF_STA_ENABLED",
     (unsigned char *)"TDLS_PUAPSD_INACT_TIME",
     (unsigned char *)"TDLS_RX_FRAME_THRESHOLD",
+    (unsigned char *)"PMF_SA_QUERY_MAX_RETRIES",
+    (unsigned char *)"PMF_SA_QUERY_RETRY_INTERVAL",
     (unsigned char *)"ENABLE_ADAPT_RX_DRAIN",
     (unsigned char *)"FLEX_CONNECT_POWER_FACTOR",
     (unsigned char *)"ANTENNA_DIVESITY",
diff --git a/CORE/MAC/src/cfg/cfgUtil/cfg.txt b/CORE/MAC/src/cfg/cfgUtil/cfg.txt
index f0e1521b95b3..49fe19986800 100644
--- a/CORE/MAC/src/cfg/cfgUtil/cfg.txt
+++ b/CORE/MAC/src/cfg/cfgUtil/cfg.txt
@@ -4541,6 +4541,32 @@ LIM
 V    RW    NP
 LIM
 10   20    10
+
+*
+* PMF SA Query Maximum Retries
+*
+
+WNI_CFG_PMF_SA_QUERY_MAX_RETRIES    I    4    1
+V    RO   NP RESTART
+NONE
+0    20   5
+V    RO   NP RESTART
+NONE
+0    20   5
+
+*
+* PMF SA Query Retry Interval (in TUs)
+*
+
+WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL    I    4    1
+V    RO   NP RESTART
+NONE
+0    2000 200
+V    RO   NP RESTART
+NONE
+0    2000 200
+
+
 *
 *MCC ENABLE/DISABLE ADAPTIVE RX Drain feature
 *
diff --git a/CORE/MAC/src/include/dphGlobal.h b/CORE/MAC/src/include/dphGlobal.h
index f7662c12ca1e..37fc1f3c8b8c 100644
--- a/CORE/MAC/src/include/dphGlobal.h
+++ b/CORE/MAC/src/include/dphGlobal.h
@@ -178,6 +178,17 @@
 #define DPH_STA_HASH_INDEX_PEER   1
 
 
+#ifdef WLAN_FEATURE_11W
+//DPH PMF SA Query state for station
+
+#define DPH_SA_QUERY_NOT_IN_PROGRESS      1
+
+#define DPH_SA_QUERY_IN_PROGRESS          2
+
+#define DPH_SA_QUERY_TIMED_OUT            3
+#endif
+
+
 typedef struct sDphRateBasedCtr
 
 {
@@ -603,6 +614,14 @@ typedef struct sDphHashNode
     tANI_U8  vhtBeamFormerCapable;
 #endif
 
+#ifdef WLAN_FEATURE_11W
+    tANI_U8  pmfSaQueryState;
+    tANI_U8  pmfSaQueryRetryCount;
+    tANI_U16 pmfSaQueryCurrentTransId;
+    tANI_U16 pmfSaQueryStartTransId;
+    TX_TIMER pmfSaQueryTimer;
+#endif
+
     tANI_U8 htLdpcCapable;
     tANI_U8 vhtLdpcCapable;
 
diff --git a/CORE/MAC/src/include/parserApi.h b/CORE/MAC/src/include/parserApi.h
index 2d87c4875959..14149588b6f1 100644
--- a/CORE/MAC/src/include/parserApi.h
+++ b/CORE/MAC/src/include/parserApi.h
@@ -889,3 +889,7 @@ PopulateDot11fWiderBWChanSwitchAnn(tpAniSirGlobal pMac,
                                    tDot11fIEWiderBWChanSwitchAnn *pDot11f,
                                    tpPESession psessionEntry);
 #endif
+
+void PopulateDot11fTimeoutInterval( tpAniSirGlobal pMac,
+                                    tDot11fIETimeoutInterval *pDot11f,
+                                    tANI_U8 type, tANI_U32 value );
diff --git a/CORE/MAC/src/pe/lim/limAssocUtils.c b/CORE/MAC/src/pe/lim/limAssocUtils.c
index 3e7595aa444b..c7f230c2f85a 100644
--- a/CORE/MAC/src/pe/lim/limAssocUtils.c
+++ b/CORE/MAC/src/pe/lim/limAssocUtils.c
@@ -446,10 +446,10 @@ limCheckRxRSNIeMatch(tpAniSirGlobal pMac, tDot11fIERSN rxRSNIe,tpPESession pSess
     tDot11fIERSN    *pRSNIe;
     tANI_U8         i, j, match, onlyNonHtCipher = 1;
 #ifdef WLAN_FEATURE_11W
-    tANI_BOOLEAN weRequirePMF;
     tANI_BOOLEAN weArePMFCapable;
-    tANI_BOOLEAN theyRequirePMF;
+    tANI_BOOLEAN weRequirePMF;
     tANI_BOOLEAN theyArePMFCapable;
+    tANI_BOOLEAN theyRequirePMF;
 #endif
 
 
@@ -511,11 +511,12 @@ limCheckRxRSNIeMatch(tpAniSirGlobal pMac, tDot11fIERSN rxRSNIe,tpPESession pSess
     }
 
     *pmfConnection = eANI_BOOLEAN_FALSE;
+
 #ifdef WLAN_FEATURE_11W
-    weRequirePMF = (pRSNIe->RSN_Cap[0] >> 6) & 0x1;
-    weArePMFCapable = (pRSNIe->RSN_Cap[0] >> 7) & 0x1;
-    theyRequirePMF = (rxRSNIe.RSN_Cap[0] >> 6) & 0x1;
+    weArePMFCapable = pSessionEntry->pLimStartBssReq->pmfCapable;
+    weRequirePMF = pSessionEntry->pLimStartBssReq->pmfRequired;
     theyArePMFCapable = (rxRSNIe.RSN_Cap[0] >> 7) & 0x1;
+    theyRequirePMF = (rxRSNIe.RSN_Cap[0] >> 6) & 0x1;
 
     if ((theyRequirePMF && theyArePMFCapable && !weArePMFCapable) ||
         (weRequirePMF && !theyArePMFCapable))
@@ -530,6 +531,10 @@ limCheckRxRSNIeMatch(tpAniSirGlobal pMac, tDot11fIERSN rxRSNIe,tpPESession pSess
 
     if(theyArePMFCapable && weArePMFCapable)
         *pmfConnection = eANI_BOOLEAN_TRUE;
+
+    limLog(pMac, LOG1, FL("weAreCapable %d, weRequire %d, theyAreCapable %d, "
+                          "theyRequire %d, PMFconnection %d"),
+           weArePMFCapable, weRequirePMF, theyArePMFCapable, theyRequirePMF, *pmfConnection);
 #endif
 
     return eSIR_SUCCESS;
@@ -3397,6 +3402,10 @@ limDeleteDphHashEntry(tpAniSirGlobal pMac, tSirMacAddr staAddr, tANI_U16 staId,t
                 schSetFixedBeaconFields(pMac,psessionEntry);
                 limSendBeaconParams(pMac, &beaconParams, psessionEntry );
             }
+
+#ifdef WLAN_FEATURE_11W
+            tx_timer_delete(&pStaDs->pmfSaQueryTimer);
+#endif
         }
         if (dphDeleteHashEntry(pMac, staAddr, staId, &psessionEntry->dph.dphHashTable) != eSIR_SUCCESS)
            limLog(pMac, LOGP, FL("error deleting hash entry"));
diff --git a/CORE/MAC/src/pe/lim/limProcessActionFrame.c b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
index a6c5c3626a56..9437dd284b7e 100644
--- a/CORE/MAC/src/pe/lim/limProcessActionFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
@@ -2083,18 +2083,56 @@ static void __limProcessSAQueryResponseActionFrame(tpAniSirGlobal pMac, tANI_U8
 {
     tpSirMacMgmtHdr     pHdr;
     tANI_U32            frameLen;
+    tANI_U8             *pBody;
+    tpDphHashNode       pSta;
+    tANI_U16            aid;
+    tANI_U16            transId;
+    tANI_U8             retryNum;
 
     pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo);
     frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
+    pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
     VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
                          ("SA Query Response received...")) ;
-    /* Forward to the SME to HDD to wpa_supplicant */
-    // type is ACTION
-    limSendSmeMgmtFrameInd(pMac, pHdr->fc.subType,
-       (tANI_U8*)pHdr, frameLen + sizeof(tSirMacMgmtHdr), 0,
-       WDA_GET_RX_CH( pRxPacketInfo ), psessionEntry, 0);
-}
 
+    /* If this is an unprotected SA Query Response, then ignore it. */
+    if (pHdr->fc.wep == 0)
+        return;
+
+    pSta = dphLookupHashEntry(pMac, pHdr->sa, &aid, &psessionEntry->dph.dphHashTable);
+    if (NULL == pSta)
+        return;
+
+    limLog(pMac, LOG1,
+           FL("SA Query Response source addr - %0x:%0x:%0x:%0x:%0x:%0x"),
+           pHdr->sa[0], pHdr->sa[1], pHdr->sa[2], pHdr->sa[3],
+           pHdr->sa[4], pHdr->sa[5]);
+    limLog(pMac, LOG1,
+           FL("SA Query state for station - %d"), pSta->pmfSaQueryState);
+
+    if (DPH_SA_QUERY_IN_PROGRESS != pSta->pmfSaQueryState)
+        return;
+
+    /* Extract 11w trsansId from SA query reponse action frame
+       In SA query response action frame:
+          Category       : 1 byte
+          Action         : 1 byte
+          Transaction ID : 2 bytes */
+    vos_mem_copy(&transId, &pBody[2], 2);
+
+    /* If SA Query is in progress with the station and the station
+       responds then the association request that triggered the SA
+       query is from a rogue station, just go back to initial state. */
+    for (retryNum = 0; retryNum <= pSta->pmfSaQueryRetryCount; retryNum++)
+        if (transId == pSta->pmfSaQueryStartTransId + retryNum)
+        {
+            limLog(pMac, LOG1,
+                   FL("Found matching SA Query Request - transaction ID %d"), transId);
+            tx_timer_deactivate(&pSta->pmfSaQueryTimer);
+            pSta->pmfSaQueryState = DPH_SA_QUERY_NOT_IN_PROGRESS;
+            break;
+        }
+}
 #endif
 
 /**
@@ -2418,7 +2456,7 @@ limProcessActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession ps
                 break;
             case  SIR_MAC_SA_QUERY_RSP:
                 /**11w SA query response action frame received**/
-                /* Forward to the SME to HDD to wpa_supplicant */
+                /* Handle based on the current SA Query state */
                 __limProcessSAQueryResponseActionFrame(pMac,(tANI_U8*) pRxPacketInfo, psessionEntry );
                 break;
             default:
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 9aa69ecd49e5..f8d95b28761f 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -54,6 +54,9 @@
 #include "limAdmitControl.h"
 #include "palApi.h"
 #include "limSessionUtils.h"
+#ifdef WLAN_FEATURE_11W
+#include "wniCfgAp.h"
+#endif
 
 
 #include "vos_types.h"
@@ -191,6 +194,10 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
     tSirMacRateSet  basicRates;
     tANI_U8 i = 0, j = 0;
     tANI_BOOLEAN pmfConnection = eANI_BOOLEAN_FALSE;
+#ifdef WLAN_FEATURE_11W
+    tPmfSaQueryTimerId timerId;
+    tANI_U32 retryInterval;
+#endif
 
     limGetPhyMode(pMac, &phyMode, psessionEntry);
 
@@ -858,9 +865,57 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
             goto error;
         } // if (pStaDs->mlmStaContext.mlmState != eLIM_MLM_LINK_ESTABLISHED_STATE)
 
-           /* STA sent association Request frame while already in
-            * 'associated' state and no change in the capability
-            *  so drop the frame */
+        /* STA sent association Request frame while already in
+         * 'associated' state */
+
+#ifdef WLAN_FEATURE_11W
+        limLog(pMac, LOG1, FL("Re/Assoc request from station that is already associated"));
+        limLog(pMac, LOG1, FL("PMF enabled %d, SA Query state %d"), pStaDs->rmfEnabled,
+               pStaDs->pmfSaQueryState);
+        if (pStaDs->rmfEnabled)
+        {
+            switch (pStaDs->pmfSaQueryState)
+            {
+
+            // start SA Query procedure, respond to Association Request
+            // with try again later
+            case DPH_SA_QUERY_NOT_IN_PROGRESS:
+                limSendAssocRspMgmtFrame(pMac, eSIR_MAC_TRY_AGAIN_LATER, 1,
+                                         pHdr->sa, subType, pStaDs, psessionEntry);
+                limSendSaQueryRequestFrame(
+                    pMac, (tANI_U8 *)&(pStaDs->pmfSaQueryCurrentTransId),
+                    pHdr->sa, psessionEntry);
+                pStaDs->pmfSaQueryStartTransId = pStaDs->pmfSaQueryCurrentTransId;
+                pStaDs->pmfSaQueryCurrentTransId++;
+                pStaDs->pmfSaQueryRetryCount = 0;
+
+                // start timer for SA Query retry
+                if (tx_timer_activate(&pStaDs->pmfSaQueryTimer) != TX_SUCCESS)
+                {
+                    limLog(pMac, LOGE, FL("PMF SA Query timer activation failed!"));
+                    goto error;
+                }
+
+                pStaDs->pmfSaQueryState = DPH_SA_QUERY_IN_PROGRESS;
+                goto error;
+
+            // SA Query procedure still going, respond to Association
+            // Request with try again later
+            case DPH_SA_QUERY_IN_PROGRESS:
+                limSendAssocRspMgmtFrame(pMac, eSIR_MAC_TRY_AGAIN_LATER, 1,
+                                         pHdr->sa, subType, 0, psessionEntry);
+                goto error;
+
+            // SA Query procedure timed out, accept Association Request
+            // normally
+             case DPH_SA_QUERY_TIMED_OUT:
+                pStaDs->pmfSaQueryState = DPH_SA_QUERY_NOT_IN_PROGRESS;
+                break;
+            }
+        }
+#endif
+
+        /* no change in the capability so drop the frame */
         if ((VOS_TRUE == vos_mem_compare(&pStaDs->mlmStaContext.capabilityInfo,
                                           &pAssocReq->capabilityInfo,
                                           sizeof(tSirMacCapabilityInfo)))&&
@@ -1223,6 +1278,31 @@ if (limPopulateMatchingRateSet(pMac,
 
 #ifdef WLAN_FEATURE_11W
     pStaDs->rmfEnabled = (pmfConnection) ? 1 : 0;
+    pStaDs->pmfSaQueryState = DPH_SA_QUERY_NOT_IN_PROGRESS;
+    timerId.fields.sessionId = psessionEntry->peSessionId;
+    timerId.fields.peerIdx = peerIdx;
+    if (wlan_cfgGetInt(pMac, WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL,
+                       &retryInterval) != eSIR_SUCCESS)
+    {
+        limLog(pMac, LOGE, FL("Could not retrieve PMF SA Query retry interval value"));
+        limRejectAssociation(pMac, pHdr->sa,
+                             subType, true, authType,
+                             peerIdx, false,
+                             (tSirResultCodes) eSIR_MAC_UNSPEC_FAILURE_STATUS, psessionEntry);
+        goto error;
+    }
+    if (tx_timer_create(&pStaDs->pmfSaQueryTimer, "PMF SA Query timer",
+                        limPmfSaQueryTimerHandler, timerId.value,
+                        SYS_MS_TO_TICKS((retryInterval * 1024) / 1000),
+                        0, TX_NO_ACTIVATE) != TX_SUCCESS)
+    {
+        limLog(pMac, LOGE, FL("could not create PMF SA Query timer"));
+        limRejectAssociation(pMac, pHdr->sa,
+                             subType, true, authType,
+                             peerIdx, false,
+                             (tSirResultCodes) eSIR_MAC_UNSPEC_FAILURE_STATUS, psessionEntry);
+        goto error;
+    }
 #endif
 
     if (pAssocReq->ExtCap.present)
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index 8458fd595f48..bd0bab65622e 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -1707,6 +1707,10 @@ limMlmAddBss (
     pAddBssParams->currentOperChannel   = pMlmStartReq->channelNumber;
     pAddBssParams->currentExtChannel    = pMlmStartReq->cbMode;
 
+#ifdef WLAN_FEATURE_11W
+    pAddBssParams->rmfEnabled           = psessionEntry->limRmfEnabled;
+#endif
+
     /* Update PE sessionId*/
     pAddBssParams->sessionId            = pMlmStartReq->sessionId;
 
@@ -1743,11 +1747,6 @@ limMlmAddBss (
     pAddBssParams->extSetStaKeyParamValid = 0;
 #endif
 
-#ifdef WLAN_FEATURE_11W
-    pAddBssParams->rmfEnabled = (psessionEntry->gStartBssRSNIe.RSN_Cap[0] >> 7) & 0x1;
-    limLog( pMac, LOG1, FL("PMF capable value for BSS is %d"), pAddBssParams->rmfEnabled);
-#endif
-
     //
     // FIXME_GEN4
     // A global counter (dialog token) is required to keep track of
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index 9512b02c16c4..d506ec0eeb69 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -641,6 +641,11 @@ __limHandleSmeStartBssRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         psessionEntry->txLdpcIniFeatureEnabled =
                                     pSmeStartBssReq->txLdpcIniFeatureEnabled;
 
+#ifdef WLAN_FEATURE_11W
+        psessionEntry->limRmfEnabled = pSmeStartBssReq->pmfCapable ? 1 : 0;
+        limLog(pMac, LOG1, FL("Session RMF enabled: %d"), psessionEntry->limRmfEnabled);
+#endif
+
         vos_mem_copy((void*)&psessionEntry->rateSet,
             (void*)&pSmeStartBssReq->operationalRateSet,
             sizeof(tSirMacRateSet));
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index d051ead7d43a..f29b07eba84f 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -50,15 +50,15 @@
 #include "limSendMessages.h"
 #include "limAssocUtils.h"
 #include "limFT.h"
+#ifdef WLAN_FEATURE_11W
+#include "wniCfgAp.h"
+#endif
 
 #if defined WLAN_FEATURE_VOWIFI
 #include "rrmApi.h"
 #endif
 
 #include "wlan_qct_wda.h"
-#ifdef WLAN_FEATURE_11W
-#include "dot11fdefs.h"
-#endif
 
 
 ////////////////////////////////////////////////////////////////////////
@@ -1462,6 +1462,11 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
     tANI_U16             addStripoffIELen = 0;
     tDot11fIEExtCap      extractedExtCap;
     tANI_BOOLEAN         extractedExtCapFlag = eANI_BOOLEAN_FALSE;
+#ifdef WLAN_FEATURE_11W
+    tANI_U32 retryInterval;
+    tANI_U32 maxRetries;
+#endif
+
     if(NULL == psessionEntry)
     {
         limLog( pMac, LOGE, FL("psessionEntry is NULL"));
@@ -1577,8 +1582,24 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
 
     } // End if on non-NULL 'pSta'.
 
+#ifdef WLAN_FEATURE_11W
+    if( eSIR_MAC_TRY_AGAIN_LATER == statusCode )
+    {
+        if ( wlan_cfgGetInt(pMac, WNI_CFG_PMF_SA_QUERY_MAX_RETRIES,
+                           &maxRetries ) != eSIR_SUCCESS )
+            limLog( pMac, LOGE, FL("Could not retrieve PMF SA Query maximum retries value") );
+        else
+            if ( wlan_cfgGetInt(pMac, WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL,
+                               &retryInterval ) != eSIR_SUCCESS)
+                limLog( pMac, LOGE, FL("Could not retrieve PMF SA Query timer interval value") );
+            else
+                PopulateDot11fTimeoutInterval(
+                   pMac, &frm.TimeoutInterval, SIR_MAC_TI_TYPE_ASSOC_COMEBACK,
+                   (maxRetries - pSta->pmfSaQueryRetryCount) * retryInterval );
+    }
+#endif
 
-   vos_mem_set(( tANI_U8* )&beaconParams, sizeof( tUpdateBeaconParams), 0);
+    vos_mem_set(( tANI_U8* )&beaconParams, sizeof( tUpdateBeaconParams), 0);
 
     if( psessionEntry->limSystemRole == eLIM_AP_ROLE ){
         if(psessionEntry->gLimProtectionControl != WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
@@ -6353,6 +6374,158 @@ returnAfterError:
 
 #ifdef WLAN_FEATURE_11W
 /**
+ * \brief Send SA query request action frame to peer
+ *
+ * \sa limSendSaQueryRequestFrame
+ *
+ *
+ * \param pMac    The global tpAniSirGlobal object
+ *
+ * \param transId Transaction identifier
+ *
+ * \param peer    The Mac address of the station to which this action frame is addressed
+ *
+ * \param psessionEntry The PE session entry
+ *
+ * \return eSIR_SUCCESS if setup completes successfully
+ *         eSIR_FAILURE is some problem is encountered
+ */
+
+tSirRetStatus limSendSaQueryRequestFrame( tpAniSirGlobal pMac, tANI_U8 *transId,
+                                          tSirMacAddr peer, tpPESession psessionEntry )
+{
+
+   tDot11fSaQueryReq  frm; // SA query request action frame
+   tANI_U8            *pFrame;
+   tSirRetStatus      nSirStatus;
+   tpSirMacMgmtHdr    pMacHdr;
+   tANI_U32           nBytes, nPayload, nStatus;
+   void               *pPacket;
+   eHalStatus         halstatus;
+   tANI_U8            txFlag = 0;
+   tANI_U8          smeSessionId = 0;
+
+   vos_mem_set( ( tANI_U8* )&frm, sizeof( frm ), 0 );
+   frm.Category.category  = SIR_MAC_ACTION_SA_QUERY;
+   /* 11w action  field is :
+    action: 0 --> SA Query Request action frame
+    action: 1 --> SA Query Response action frame */
+   frm.Action.action    = SIR_MAC_SA_QUERY_REQ;
+   /* 11w SA Query Request transId */
+   vos_mem_copy( &frm.TransactionId.transId[0], &transId[0], 2 );
+
+   nStatus = dot11fGetPackedSaQueryReqSize(pMac, &frm, &nPayload);
+   if ( DOT11F_FAILED( nStatus ) )
+   {
+      limLog( pMac, LOGP, FL("Failed to calculate the packed size "
+               "for an SA Query Request (0x%08x)."),
+            nStatus );
+      // We'll fall back on the worst case scenario:
+      nPayload = sizeof( tDot11fSaQueryReq );
+   }
+   else if ( DOT11F_WARNED( nStatus ) )
+   {
+      limLog( pMac, LOGW, FL("There were warnings while calculating "
+               "the packed size for an SA Query Request"
+               " (0x%08x)."), nStatus );
+   }
+
+   nBytes = nPayload + sizeof( tSirMacMgmtHdr );
+   halstatus = palPktAlloc( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,  nBytes, ( void** ) &pFrame, ( void** ) &pPacket );
+   if ( ! HAL_STATUS_SUCCESS ( halstatus ) )
+   {
+      limLog( pMac, LOGP, FL("Failed to allocate %d bytes for a SA Query Request "
+                               "action frame"), nBytes );
+      return eSIR_FAILURE;
+   }
+
+   // Paranoia:
+   vos_mem_set( pFrame, nBytes, 0 );
+
+   // Copy necessary info to BD
+   nSirStatus = limPopulateMacHeader( pMac,
+                                      pFrame,
+                                      SIR_MAC_MGMT_FRAME,
+                                      SIR_MAC_MGMT_ACTION,
+                                      peer, psessionEntry->selfMacAddr );
+   if ( eSIR_SUCCESS != nSirStatus )
+      goto returnAfterError;
+
+   // Update A3 with the BSSID
+   pMacHdr = ( tpSirMacMgmtHdr ) pFrame;
+
+   sirCopyMacAddr( pMacHdr->bssId, psessionEntry->bssId );
+
+   // Since this is a SA Query Request, set the "protect" (aka WEP) bit
+   // in the FC
+   limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
+
+   // Pack 11w SA Query Request frame
+   nStatus = dot11fPackSaQueryReq( pMac,
+         &frm,
+         pFrame + sizeof( tSirMacMgmtHdr ),
+         nPayload,
+         &nPayload );
+
+   if ( DOT11F_FAILED( nStatus ))
+   {
+      limLog( pMac, LOGE,
+            FL( "Failed to pack an SA Query Request (0x%08x)." ),
+            nStatus );
+      // FIXME - Need to convert to tSirRetStatus
+      nSirStatus = eSIR_FAILURE;
+      goto returnAfterError;
+   }
+   else if ( DOT11F_WARNED( nStatus ))
+   {
+      limLog( pMac, LOGW,
+            FL( "There were warnings while packing SA Query Request (0x%08x)." ),
+            nStatus);
+   }
+
+   limLog( pMac, LOG1,
+         FL( "Sending an SA Query Request to " ));
+   limPrintMacAddr( pMac, peer, LOG1 );
+   limLog( pMac, LOG1,
+         FL( "Sending an SA Query Request from " ));
+   limPrintMacAddr( pMac, psessionEntry->selfMacAddr, LOG1 );
+
+   if ( ( SIR_BAND_5_GHZ == limGetRFBand( psessionEntry->currentOperChannel ) )
+#ifdef WLAN_FEATURE_P2P
+        || ( psessionEntry->pePersona == VOS_P2P_CLIENT_MODE ) ||
+        ( psessionEntry->pePersona == VOS_P2P_GO_MODE )
+#endif
+      )
+   {
+      txFlag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
+   }
+   smeSessionId = psessionEntry->smeSessionId;
+
+   halstatus = halTxFrame( pMac,
+                           pPacket,
+                           (tANI_U16) nBytes,
+                           HAL_TXRX_FRM_802_11_MGMT,
+                           ANI_TXDIR_TODS,
+                           7,//SMAC_SWBD_TX_TID_MGMT_HIGH,
+                           limTxComplete,
+                           pFrame, txFlag, smeSessionId);
+   if ( eHAL_STATUS_SUCCESS != halstatus )
+   {
+      PELOGE(limLog( pMac, LOGE, FL( "halTxFrame FAILED! Status [%d]" ), halstatus );)
+      nSirStatus = eSIR_FAILURE;
+      //Pkt will be freed up by the callback
+      return nSirStatus;
+   }
+   else {
+      return eSIR_SUCCESS;
+   }
+
+returnAfterError:
+   palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT, ( void* ) pFrame, ( void* ) pPacket );
+   return nSirStatus;
+} // End limSendSaQueryRequestFrame
+
+/**
  * \brief Send SA query response action frame to peer
  *
  * \sa limSendSaQueryResponseFrame
@@ -6440,10 +6613,7 @@ tSirMacAddr peer,tpPESession psessionEntry)
 
    // Since this is a SA Query Response, set the "protect" (aka WEP) bit
    // in the FC
-   if ( psessionEntry->limRmfEnabled )
-   {
-       pMacHdr->fc.wep = 1;
-   }
+   limSetProtectedBit(pMac, psessionEntry, peer, pMacHdr);
 
    // Pack 11w SA query response frame
    nStatus = dot11fPackSaQueryRsp( pMac,
diff --git a/CORE/MAC/src/pe/lim/limSerDesUtils.c b/CORE/MAC/src/pe/lim/limSerDesUtils.c
index e7e4c0b54e74..05cd4ab88aa4 100644
--- a/CORE/MAC/src/pe/lim/limSerDesUtils.c
+++ b/CORE/MAC/src/pe/lim/limSerDesUtils.c
@@ -665,6 +665,17 @@ limStartBssReqSerDes(tpAniSirGlobal pMac, tpSirSmeStartBssReq pStartBssReq, tANI
     if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
         return eSIR_FAILURE;
 
+#ifdef WLAN_FEATURE_11W
+    // Extract MFP capable/required
+    pStartBssReq->pmfCapable = *pBuf++;
+    len--;
+    if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
+       return eSIR_FAILURE;
+    pStartBssReq->pmfRequired = *pBuf++;
+    len--;
+    if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
+       return eSIR_FAILURE;
+#endif
 
     // Extract rsnIe
     pStartBssReq->rsnIE.length = limGetU16(pBuf);
diff --git a/CORE/MAC/src/pe/lim/limTypes.h b/CORE/MAC/src/pe/lim/limTypes.h
index 30d9e90aa402..20419ece5474 100644
--- a/CORE/MAC/src/pe/lim/limTypes.h
+++ b/CORE/MAC/src/pe/lim/limTypes.h
@@ -862,7 +862,11 @@ void limProcessMlmHalBADeleteInd( tpAniSirGlobal pMac,
 void limProcessMlmRemoveKeyRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ );
 
 void limProcessLearnIntervalTimeout(tpAniSirGlobal pMac);
+
 #ifdef WLAN_FEATURE_11W
+//11w send SA query request action frame
+tSirRetStatus limSendSaQueryRequestFrame( tpAniSirGlobal pMac, tANI_U8 *transId,
+                                          tSirMacAddr peer, tpPESession psessionEntry );
 //11w SA query request action frame handler
 tSirRetStatus limSendSaQueryResponseFrame( tpAniSirGlobal pMac,
                    tANI_U8 *transId, tSirMacAddr peer,tpPESession psessionEntry);
diff --git a/CORE/MAC/src/pe/lim/limUtils.c b/CORE/MAC/src/pe/lim/limUtils.c
index 56ee50dbb01b..3dbf17cdc647 100644
--- a/CORE/MAC/src/pe/lim/limUtils.c
+++ b/CORE/MAC/src/pe/lim/limUtils.c
@@ -57,6 +57,9 @@
 #include "vos_nvitem.h"
 
 #include "pmmApi.h"
+#ifdef WLAN_FEATURE_11W
+#include "wniCfgAp.h"
+#endif
 
 /* Static global used to mark situations where pMac->lim.gLimTriggerBackgroundScanDuringQuietBss is SET
  * and limTriggerBackgroundScanDuringQuietBss() returned failure.  In this case, we will stop data
@@ -7726,6 +7729,68 @@ tANI_BOOLEAN limIsconnectedOnDFSChannel(tANI_U8 currentChannel)
     }
 }
 
+#ifdef WLAN_FEATURE_11W
+void limPmfSaQueryTimerHandler(void *pMacGlobal, tANI_U32 param)
+{
+    tpAniSirGlobal pMac = (tpAniSirGlobal)pMacGlobal;
+    tPmfSaQueryTimerId timerId;
+    tpPESession psessionEntry;
+    tpDphHashNode pSta;
+    tANI_U32 maxRetries;
+
+    limLog(pMac, LOG1, FL("SA Query timer fires"));
+    timerId.value = param;
+
+    // Check that SA Query is in progress
+    if ((psessionEntry = peFindSessionBySessionId(
+        pMac, timerId.fields.sessionId)) == NULL)
+    {
+        limLog(pMac, LOGE, FL("Session does not exist for given session ID %d"),
+               timerId.fields.sessionId);
+        pSta->pmfSaQueryState = DPH_SA_QUERY_NOT_IN_PROGRESS;
+        return;
+    }
+    if ((pSta = dphGetHashEntry(pMac, timerId.fields.peerIdx,
+                                &psessionEntry->dph.dphHashTable)) == NULL)
+    {
+        limLog(pMac, LOGE, FL("Entry does not exist for given peer index %d"),
+               timerId.fields.peerIdx);
+        pSta->pmfSaQueryState = DPH_SA_QUERY_NOT_IN_PROGRESS;
+        return;
+    }
+    if (DPH_SA_QUERY_IN_PROGRESS != pSta->pmfSaQueryState)
+        return;
+
+    // Increment the retry count, check if reached maximum
+    if (wlan_cfgGetInt(pMac, WNI_CFG_PMF_SA_QUERY_MAX_RETRIES,
+                       &maxRetries) != eSIR_SUCCESS)
+    {
+        limLog(pMac, LOGE, FL("Could not retrieve PMF SA Query maximum retries value"));
+        pSta->pmfSaQueryState = DPH_SA_QUERY_NOT_IN_PROGRESS;
+        return;
+    }
+    pSta->pmfSaQueryRetryCount++;
+    if (pSta->pmfSaQueryRetryCount >= maxRetries)
+    {
+        limLog(pMac, LOGE, FL("SA Query timed out"));
+        pSta->pmfSaQueryState = DPH_SA_QUERY_TIMED_OUT;
+        return;
+    }
+
+    // Retry SA Query
+    limSendSaQueryRequestFrame(pMac, (tANI_U8 *)&(pSta->pmfSaQueryCurrentTransId),
+                               pSta->staAddr, psessionEntry);
+    pSta->pmfSaQueryCurrentTransId++;
+    limLog(pMac, LOGE, FL("Starting SA Query retry %d"), pSta->pmfSaQueryRetryCount);
+    if (tx_timer_activate(&pSta->pmfSaQueryTimer) != TX_SUCCESS)
+    {
+        limLog(pMac, LOGE, FL("PMF SA Query timer activation failed!"));
+        pSta->pmfSaQueryState = DPH_SA_QUERY_NOT_IN_PROGRESS;
+    }
+}
+#endif
+
+
 #ifdef WLAN_FEATURE_11AC
 tANI_BOOLEAN limCheckVHTOpModeChange( tpAniSirGlobal pMac, tpPESession psessionEntry, tANI_U8 chanWidth, tANI_U8 staId)
 {
diff --git a/CORE/MAC/src/pe/lim/limUtils.h b/CORE/MAC/src/pe/lim/limUtils.h
index 6fea9f84ca11..55892de81731 100644
--- a/CORE/MAC/src/pe/lim/limUtils.h
+++ b/CORE/MAC/src/pe/lim/limUtils.h
@@ -84,6 +84,18 @@ typedef struct sAddBaCandidate
     tAddBaInfo baInfo[STACFG_MAX_TC];
 }tAddBaCandidate, *tpAddBaCandidate;
 
+#ifdef WLAN_FEATURE_11W
+typedef union uPmfSaQueryTimerId
+{
+    struct
+    {
+        tANI_U8 sessionId;
+        tANI_U16 peerIdx;
+    } fields;
+    tANI_U32 value;
+} tPmfSaQueryTimerId, *tpPmfSaQueryTimerId;
+#endif
+
 // LIM utility functions
 void limGetBssidFromPkt(tpAniSirGlobal, tANI_U8 *, tANI_U8 *, tANI_U32 *);
 char * limMlmStateStr(tLimMlmStates state);
@@ -498,6 +510,11 @@ void limCleanUpDisassocDeauthReq(tpAniSirGlobal pMac, tANI_U8 *staMac, tANI_BOOL
 
 tANI_BOOLEAN limCheckDisassocDeauthAckPending(tpAniSirGlobal pMac, tANI_U8 *staMac);
 
+#ifdef WLAN_FEATURE_11W
+void limPmfSaQueryTimerHandler(void *pMacGlobal, tANI_U32 param);
+#endif
+
+
 
 void limUtilsframeshtons(tpAniSirGlobal  pCtx,
                             tANI_U8  *pOut,
diff --git a/CORE/SAP/inc/sapApi.h b/CORE/SAP/inc/sapApi.h
index 72408a9ef18c..f7d4b3193be5 100644
--- a/CORE/SAP/inc/sapApi.h
+++ b/CORE/SAP/inc/sapApi.h
@@ -459,6 +459,11 @@ typedef struct sap_Config {
     v_BOOL_t        enOverLapCh;
     char            acsAllowedChnls[MAX_CHANNEL_LIST_LEN];
     v_U16_t         acsBandSwitchThreshold;
+
+#ifdef WLAN_FEATURE_11W
+    v_BOOL_t        mfpRequired;
+    v_BOOL_t        mfpCapable;
+#endif
 } tsap_Config_t;
 
 typedef enum {
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 5319f4965296..01809af31984 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -1442,6 +1442,12 @@ sapconvertToCsrProfile(tsap_Config_t *pconfig_params, eCsrRoamBssType bssType, t
     //wps config info
     profile->wps_state = pconfig_params->wps_state;
 
+#ifdef WLAN_FEATURE_11W
+    // MFP capable/required
+    profile->MFPCapable = pconfig_params->mfpCapable ? 1 : 0;
+    profile->MFPRequired = pconfig_params->mfpRequired ? 1 : 0;
+#endif
+
     return eSAP_STATUS_SUCCESS; /* Success.  */
 }
 
diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index f0ef3836c054..a837418cd48c 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -382,6 +382,10 @@ typedef struct tagCsrRoamStartBssParams
     tANI_U8             *pRSNIE;     //If not null, it has the IE byte stream for RSN
     tANI_BOOLEAN        updatebeaconInterval; //Flag used to indicate update
                                              // beaconInterval
+#ifdef WLAN_FEATURE_11W
+    tANI_BOOLEAN        mfpCapable;
+    tANI_BOOLEAN        mfpRequired;
+#endif
 }tCsrRoamStartBssParams;
 
 
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index 49395c9cd12e..110b7d2b8a4f 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -11738,6 +11738,12 @@ eHalStatus csrRoamIssueStartBss( tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRo
     pParam->uCfgDot11Mode = csrRoamGetPhyModeBandForBss(pMac, pProfile, pParam->operationChn /* pProfile->operationChannel*/,
                                         &eBand);
     pParam->bssPersona = pProfile->csrPersona;
+
+#ifdef WLAN_FEATURE_11W
+    pParam->mfpCapable = (0 != pProfile->MFPCapable);
+    pParam->mfpRequired = (0 != pProfile->MFPRequired);
+#endif
+
     // When starting an IBSS, start on the channel from the Profile.
     status = csrSendMBStartBssReqMsg( pMac, sessionId, pProfile->BSSType, pParam, pBssDesc );
     return (status);
@@ -13899,6 +13905,14 @@ eHalStatus csrSendMBStartBssReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, eCs
         *pBuf = (tANI_U8)(tANI_U8)pMac->roam.configParam.txLdpcEnable;
         pBuf++;
 
+#ifdef WLAN_FEATURE_11W
+        // Set MFP capable/required
+        *pBuf = (tANI_U8)pParam->mfpCapable;
+        pBuf++;
+        *pBuf = (tANI_U8)pParam->mfpRequired;
+        pBuf++;
+#endif
+
         // set RSN IE
         if( pParam->nRSNIELength > sizeof(pMsg->rsnIE.rsnIEdata) )
         {
diff --git a/CORE/SYS/legacy/src/utils/src/parserApi.c b/CORE/SYS/legacy/src/utils/src/parserApi.c
index 4fd5d4405ad1..e7bdef2e07f2 100644
--- a/CORE/SYS/legacy/src/utils/src/parserApi.c
+++ b/CORE/SYS/legacy/src/utils/src/parserApi.c
@@ -5215,4 +5215,13 @@ void PopulateDot11fAssocRspRates ( tpAniSirGlobal pMac, tDot11fIESuppRates *pSup
      pExt->present = 1;
   }
 }
+
+void PopulateDot11fTimeoutInterval( tpAniSirGlobal pMac,
+                                    tDot11fIETimeoutInterval *pDot11f,
+                                    tANI_U8 type, tANI_U32 value )
+{
+   pDot11f->present = 1;
+   pDot11f->timeoutType = type;
+   pDot11f->timeoutValue = value;
+}
 // parserApi.c ends here.
diff --git a/firmware_bin/WCNSS_cfg.dat b/firmware_bin/WCNSS_cfg.dat
index a4c280d72e0f..91fb0789b06e 100644
--- a/firmware_bin/WCNSS_cfg.dat
+++ b/firmware_bin/WCNSS_cfg.dat