Release 1.0.0.142 QCACLD WLAN Driver

Merge remote-tracking branch 'origin/caf/caf-wlan/master'

* origin/caf/caf-wlan/master:
  Cafstaging Release 1.0.0.142
  WLAN:WMA:Add support for init params for roam offload
  QCACLD: HDD: Update for AP-AP Mode DFS Restrictions
  QCACLD: SAP: Update for AP-AP Mode DFS Restrictions
  qcacld: Replace pMac->pAdapter with pMac->hHdd
  qcacld:Modify target tx descriptors for SDIO
  wlan: Consider Short Preamble and Immediate Block Ack peer capability
  CLD: Add support to disable STA-AP mode DFS

Change-Id: I6a2a254a75f369c8ec50eaf46b339f11bea499df

22 files changed, 752 insertions, 180 deletions

diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index b4ca03f5a293..a41aa5cfa7fd 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -1494,6 +1494,8 @@ struct hdd_context_s
     adf_os_work_t  sta_ap_intf_check_work;
 #endif
 
+    v_U8_t dev_dfs_cac_status;
+
     v_BOOL_t btCoexModeSet;
 #ifdef FEATURE_GREEN_AP
     hdd_green_ap_ctx_t *green_ap_ctx;
@@ -1501,8 +1503,6 @@ struct hdd_context_s
     fw_log_info fw_log_settings;
 };
 
-
-
 /*---------------------------------------------------------------------------
   Function declarations and documenation
   -------------------------------------------------------------------------*/
@@ -1690,6 +1690,10 @@ void wlan_hdd_send_svc_nlink_msg(int type, void *data, int len);
 void wlan_hdd_auto_shutdown_enable(hdd_context_t *hdd_ctx, v_U8_t enable);
 #endif
 
+#ifdef WLAN_FEATURE_MBSSID
+hdd_adapter_t *hdd_get_con_sap_adapter(hdd_adapter_t *this_sap_adapter);
+#endif
+
 boolean hdd_is_5g_supported(hdd_context_t * pHddCtx);
 
 #ifdef FEATURE_GREEN_AP
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index 8c8db1e02ead..2c4b04887d2a 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -1444,7 +1444,11 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
 
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
         if (pHddCtx->cfg_ini->WlanMccToSccSwitchMode
-                != VOS_MCC_TO_SCC_SWITCH_DISABLE) {
+                != VOS_MCC_TO_SCC_SWITCH_DISABLE
+#ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
+            && !VOS_IS_DFS_CH(pHddStaCtx->conn_info.operationChannel)
+#endif
+           ) {
             adf_os_create_work(0, &pHddCtx->sta_ap_intf_check_work,
                 wlan_hdd_check_sta_ap_concurrent_ch_intf, (void *)pAdapter);
             adf_os_sched_work(0, &pHddCtx->sta_ap_intf_check_work);
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 223e5600e716..e3775aebc4bd 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -4635,6 +4635,39 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
             pConfig->countryCode[1] = pHddCtx->reg.alpha2[1];
             pConfig->ieee80211d = 0;
         }
+
+#ifdef WLAN_FEATURE_MBSSID
+        if (!vos_concurrent_sap_sessions_running()) {
+            /* Single AP Mode */
+            if (VOS_IS_DFS_CH(pConfig->channel))
+                 pHddCtx->dev_dfs_cac_status = DFS_CAC_NEVER_DONE;
+        } else {
+            /* MBSSID Mode */
+            hdd_adapter_t *con_sap_adapter;
+            v_U16_t con_ch;
+
+            con_sap_adapter = hdd_get_con_sap_adapter(pHostapdAdapter);
+            if (con_sap_adapter) {
+                /* we have active SAP running */
+                con_ch = con_sap_adapter->sessionCtx.ap.operatingChannel;
+                /* If this SAP is configured for ACS use CC_SAP's DFS channel */
+                if (pConfig->channel == AUTO_CHANNEL_SELECT) {
+                    if (con_ch != 0 && VOS_IS_DFS_CH(con_ch))
+                        pConfig->channel = con_ch;
+                } else if (VOS_IS_DFS_CH(con_ch) &&
+                           (pConfig->channel != con_ch)) {
+                    hddLog(VOS_TRACE_LEVEL_ERROR,
+                               "%s: Only SCC AP-AP DFS Permitted (ch=%d, con_ch=%d) !!", __func__, pConfig->channel, con_ch);
+                    return -EINVAL;
+                }
+            } else {
+                /* We have idle AP interface (no active SAP running on it
+                 * When one SAP is stopped then also this condition applies */
+                if (VOS_IS_DFS_CH(pConfig->channel))
+                     pHddCtx->dev_dfs_cac_status = DFS_CAC_NEVER_DONE;
+            }
+        }
+#endif
         /*
         * If auto channel is configured i.e. channel is 0,
         * so skip channel validation.
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index bdd7b6470fe9..e53abcf72f68 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -629,6 +629,10 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
     hdd_config_t *cfg = NULL;
     struct wlan_dfs_info dfs_info;
     v_U8_t cc_len = WLAN_SVC_COUNTRY_CODE_LEN;
+
+#ifdef WLAN_FEATURE_MBSSID
+    hdd_adapter_t *con_sap_adapter;
+#endif
 #ifdef MSM_PLATFORM
     unsigned long flags;
 #endif
@@ -887,22 +891,39 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                 }
             }
 #endif
+#ifdef WLAN_FEATURE_MBSSID
+            con_sap_adapter = hdd_get_con_sap_adapter(pHostapdAdapter);
+            if (con_sap_adapter) {
+                if (!VOS_IS_DFS_CH(
+                                con_sap_adapter->sessionCtx.ap.operatingChannel))
+                    pHddCtx->dev_dfs_cac_status = DFS_CAC_NEVER_DONE;
+            }
+#endif
             goto stopbss;
 
         case eSAP_DFS_CAC_START:
             wlan_hdd_send_svc_nlink_msg(WLAN_SVC_DFS_CAC_START_IND,
                                       &dfs_info, sizeof(struct wlan_dfs_info));
+#ifdef WLAN_FEATURE_MBSSID
+            pHddCtx->dev_dfs_cac_status = DFS_CAC_IN_PROGRESS;
+#endif
             break;
 
         case eSAP_DFS_CAC_END:
             wlan_hdd_send_svc_nlink_msg(WLAN_SVC_DFS_CAC_END_IND,
                                       &dfs_info, sizeof(struct wlan_dfs_info));
             pHddApCtx->dfs_cac_block_tx = VOS_FALSE;
+#ifdef WLAN_FEATURE_MBSSID
+            pHddCtx->dev_dfs_cac_status = DFS_CAC_ALREADY_DONE;
+#endif
             break;
 
         case eSAP_DFS_RADAR_DETECT:
             wlan_hdd_send_svc_nlink_msg(WLAN_SVC_DFS_RADAR_DETECT_IND,
                                       &dfs_info, sizeof(struct wlan_dfs_info));
+#ifdef WLAN_FEATURE_MBSSID
+            pHddCtx->dev_dfs_cac_status = DFS_CAC_NEVER_DONE;
+#endif
             break;
 
         case eSAP_STA_SET_KEY_EVENT:
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index ad4f13e64c11..28893dd34f93 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -556,6 +556,79 @@ done:
 
 #endif /* FEATURE_GREEN_AP */
 
+#if defined (FEATURE_WLAN_MCC_TO_SCC_SWITCH) || defined (FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE)
+/**---------------------------------------------------------------------------
+
+  \brief wlan_hdd_restart_sap() - This function is used to restart SAP in
+                                  driver internally
+
+  \param  - ap_adapter - Pointer to SAP hdd_adapter_t structure
+
+  \return - void
+
+  --------------------------------------------------------------------------*/
+
+static void wlan_hdd_restart_sap(hdd_adapter_t *ap_adapter)
+{
+    hdd_ap_ctx_t *pHddApCtx;
+    hdd_hostapd_state_t *pHostapdState;
+    VOS_STATUS vos_status;
+    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(ap_adapter);
+
+    pHddApCtx = WLAN_HDD_GET_AP_CTX_PTR(ap_adapter);
+
+    mutex_lock(&pHddCtx->sap_lock);
+    if (test_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags)) {
+        wlan_hdd_cfg80211_del_station(ap_adapter->wdev.wiphy, ap_adapter->dev,
+                                                                          NULL);
+        hdd_cleanup_actionframe(pHddCtx, ap_adapter);
+
+        pHostapdState = WLAN_HDD_GET_HOSTAP_STATE_PTR(ap_adapter);
+        if ( VOS_STATUS_SUCCESS == WLANSAP_StopBss(
+#ifdef WLAN_FEATURE_MBSSID
+            pHddApCtx->sapContext
+#else
+            (WLAN_HDD_GET_CTX(ap_adapter))->pvosContext
+#endif
+        )) {
+            vos_status = vos_wait_single_event(&pHostapdState->vosEvent, 10000);
+
+            if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+                hddLog(LOGE, FL("SAP Stop Failed"));
+                goto end;
+            }
+        }
+        clear_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags);
+        hddLog(LOGE, FL("SAP Stop Success"));
+
+        if (WLANSAP_StartBss(
+#ifdef WLAN_FEATURE_MBSSID
+            pHddApCtx->sapContext,
+#else
+            pHddCtx->pvosContext,
+#endif
+            hdd_hostapd_SAPEventCB, &pHddApCtx->sapConfig,
+            (v_PVOID_t)ap_adapter->dev) != VOS_STATUS_SUCCESS) {
+            hddLog(LOGE, FL("SAP Start Bss fail"));
+            goto end;
+        }
+
+        hddLog(LOG1, FL("Waiting for SAP to start"));
+        vos_status = vos_wait_single_event(&pHostapdState->vosEvent, 10000);
+        if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+            hddLog(LOGE, FL("SAP Start failed"));
+            goto end;
+        }
+        hddLog(LOGE, FL("SAP Start Success"));
+        set_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags);
+        pHostapdState->bCommit = TRUE;
+    }
+end:
+    mutex_unlock(&pHddCtx->sap_lock);
+    return;
+}
+#endif
+
 static int hdd_netdev_notifier_call(struct notifier_block * nb,
                                          unsigned long state,
                                          void *ndev)
@@ -8620,6 +8693,23 @@ hdd_adapter_t* hdd_open_adapter( hdd_context_t *pHddCtx, tANI_U8 session_type,
 
       hddLog(VOS_TRACE_LEVEL_DEBUG,"%s: current_intf_count=%d", __func__,
                                     pHddCtx->current_intf_count);
+#ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
+      if (vos_get_concurrency_mode() == VOS_STA_SAP) {
+          hdd_adapter_t *ap_adapter;
+
+          ap_adapter = hdd_get_adapter(pHddCtx, WLAN_HDD_SOFTAP);
+          if (ap_adapter != NULL &&
+              test_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags) &&
+              VOS_IS_DFS_CH(ap_adapter->sessionCtx.ap.operatingChannel)) {
+
+              hddLog(VOS_TRACE_LEVEL_WARN,
+                  "STA-AP Mode DFS not supported. Restart SAP with Non DFS ACS"
+                  );
+              ap_adapter->sessionCtx.ap.sapConfig.channel = AUTO_CHANNEL_SELECT;
+              wlan_hdd_restart_sap(ap_adapter);
+          }
+      }
+#endif
    }
 
 #ifdef QCA_WIFI_2_0
@@ -13534,6 +13624,35 @@ void wlan_hdd_auto_shutdown_enable(hdd_context_t *hdd_ctx, v_BOOL_t enable)
 }
 #endif
 
+#ifdef WLAN_FEATURE_MBSSID
+hdd_adapter_t * hdd_get_con_sap_adapter(hdd_adapter_t *this_sap_adapter)
+{
+    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(this_sap_adapter);
+    hdd_adapter_t *pAdapter, *con_sap_adapter;
+    VOS_STATUS status = VOS_STATUS_SUCCESS;
+    hdd_adapter_list_node_t *pAdapterNode = NULL, *pNext = NULL;
+
+    con_sap_adapter = NULL;
+
+    status = hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
+    while ( NULL != pAdapterNode && VOS_STATUS_SUCCESS == status ) {
+        pAdapter = pAdapterNode->pAdapter;
+        if (pAdapter && pAdapter->device_mode == WLAN_HDD_SOFTAP) {
+            if (test_bit(SOFTAP_BSS_STARTED, &pAdapter->event_flags)) {
+                if (pAdapter != this_sap_adapter) {
+                    con_sap_adapter = pAdapter;
+                    break;
+                }
+            }
+        }
+        status = hdd_get_next_adapter(pHddCtx, pAdapterNode, &pNext );
+        pAdapterNode = pNext;
+    }
+
+    return con_sap_adapter;
+}
+#endif
+
 #ifdef MSM_PLATFORM
 void hdd_start_bus_bw_compute_timer(hdd_adapter_t *pAdapter)
 {
@@ -13592,73 +13711,10 @@ void hdd_stop_bus_bw_compute_timer(hdd_adapter_t *pAdapter)
 
 
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-void wlan_hdd_restart_sap(hdd_adapter_t *ap_pAdapter)
-{
-    hdd_ap_ctx_t *pHddApCtx;
-    hdd_hostapd_state_t *pHostapdState;
-    VOS_STATUS vos_status;
-    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(ap_pAdapter);
-
-    pHddApCtx = WLAN_HDD_GET_AP_CTX_PTR(ap_pAdapter);
-
-    mutex_lock(&pHddCtx->sap_lock);
-    if(test_bit(SOFTAP_BSS_STARTED, &ap_pAdapter->event_flags))
-    {
-        wlan_hdd_cfg80211_del_station(ap_pAdapter->wdev.wiphy, ap_pAdapter->dev,
-                                                                          NULL);
-        hdd_cleanup_actionframe(pHddCtx, ap_pAdapter);
-
-        pHostapdState = WLAN_HDD_GET_HOSTAP_STATE_PTR(ap_pAdapter);
-        if ( VOS_STATUS_SUCCESS == (vos_status = WLANSAP_StopBss(
-#ifdef WLAN_FEATURE_MBSSID
-            pHddApCtx->sapContext
-#else
-            (WLAN_HDD_GET_CTX(ap_pAdapter))->pvosContext
-#endif
-        ))) {
-            vos_status = vos_wait_single_event(&pHostapdState->vosEvent, 10000);
-
-            if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
-                hddLog(LOGE,FL("%s: SAP Stop Failed"), __func__);
-                goto end;
-            }
-        }
-        clear_bit(SOFTAP_BSS_STARTED, &ap_pAdapter->event_flags);
-        wlan_hdd_decr_active_session(pHddCtx, ap_pAdapter->device_mode);
-        hddLog(LOGE,FL("%s: SAP Stop Success"), __func__);
-
-        if (WLANSAP_StartBss(
-#ifdef WLAN_FEATURE_MBSSID
-            pHddApCtx->sapContext,
-#else
-            pHddCtx->pvosContext,
-#endif
-            hdd_hostapd_SAPEventCB, &pHddApCtx->sapConfig,
-            (v_PVOID_t)ap_pAdapter->dev) != VOS_STATUS_SUCCESS) {
-            hddLog(LOGE,FL("%s: SAP Start Bss fail"), __func__);
-            goto end;
-        }
-
-        hddLog(LOG1, FL("%s: Waiting for SAP to start"), __func__);
-        vos_status = vos_wait_single_event(&pHostapdState->vosEvent, 10000);
-        if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
-            hddLog(LOGE,FL("%s: SAP Start failed"), __func__);
-            goto end;
-        }
-        hddLog(LOGE,FL("%s: SAP Start Success"), __func__);
-        set_bit(SOFTAP_BSS_STARTED, &ap_pAdapter->event_flags);
-        wlan_hdd_incr_active_session(pHddCtx, ap_pAdapter->device_mode);
-        pHostapdState->bCommit = TRUE;
-    }
-end:
-    mutex_unlock(&pHddCtx->sap_lock);
-    return;
-}
-
 void wlan_hdd_check_sta_ap_concurrent_ch_intf(void *data)
 {
-    hdd_adapter_t *ap_pAdapter = NULL, *sta_pAdapter = (hdd_adapter_t *)data;
-    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(sta_pAdapter);
+    hdd_adapter_t *ap_adapter = NULL, *sta_adapter = (hdd_adapter_t *)data;
+    hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(sta_adapter);
     tHalHandle hHal;
     hdd_ap_ctx_t *pHddApCtx;
     v_U16_t intf_ch = 0;
@@ -13668,11 +13724,15 @@ void wlan_hdd_check_sta_ap_concurrent_ch_intf(void *data)
        || !(vos_get_concurrency_mode() == VOS_STA_SAP)))
         return;
 
-    ap_pAdapter = hdd_get_adapter(pHddCtx, WLAN_HDD_SOFTAP);
-    if (ap_pAdapter == NULL)
+    ap_adapter = hdd_get_adapter(pHddCtx, WLAN_HDD_SOFTAP);
+    if (ap_adapter == NULL)
         return;
-    pHddApCtx = WLAN_HDD_GET_AP_CTX_PTR(ap_pAdapter);
-    hHal = WLAN_HDD_GET_HAL_CTX(ap_pAdapter);
+
+    if (!test_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags))
+        return;
+
+    pHddApCtx = WLAN_HDD_GET_AP_CTX_PTR(ap_adapter);
+    hHal = WLAN_HDD_GET_HAL_CTX(ap_adapter);
 
     if (hHal == NULL)
         return;
@@ -13689,7 +13749,7 @@ void wlan_hdd_check_sta_ap_concurrent_ch_intf(void *data)
     sme_SelectCBMode(hHal,
             sapConvertSapPhyModeToCsrPhyMode(pHddApCtx->sapConfig.SapHw_mode),
                                              pHddApCtx->sapConfig.channel);
-    wlan_hdd_restart_sap(ap_pAdapter);
+    wlan_hdd_restart_sap(ap_adapter);
 }
 
 #endif
diff --git a/CORE/MAC/inc/aniGlobal.h b/CORE/MAC/inc/aniGlobal.h
index 84efd06b375b..208f21c783ed 100644
--- a/CORE/MAC/inc/aniGlobal.h
+++ b/CORE/MAC/inc/aniGlobal.h
@@ -1054,15 +1054,6 @@ typedef struct sAniSirGlobal
 {
     tDriverType  gDriverType;
 
-    // we should be able to save this hddHandle in here and deprecate
-    // the pAdapter.  For now, compiles are a problem because there
-    // are dependencides on the header files that are not handling the
-    // compiler very gracefully.
-//    tHddHandle   hHdd;       // Handle to the HDD.
-    //void        *hHdd;
-    void        *pAdapter;   // deprecate this pAdapter pointer eventually...
-                             // all interfaces to the HDD should pass hHdd, which
-                             // is stored in this struct above.....
     tSirMbMsg*   pResetMsg;
     tAniSirCfg   cfg;
     tAniSirLim   lim;
@@ -1070,7 +1061,8 @@ typedef struct sAniSirGlobal
     tAniSirSch   sch;
     tAniSirSys   sys;
     tAniSirUtils utils;
-    // PAL/HDD handle
+
+    /* PAL/HDD handle */
     tHddHandle hHdd;
 
 #ifdef ANI_DVT_DEBUG
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 4f5cac103bdb..bdade53f343c 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            141
+#define QWLAN_VERSION_BUILD            142
 
-#define QWLAN_VERSIONSTR               "1.0.0.141"
+#define QWLAN_VERSIONSTR               "1.0.0.142"
 
 #ifdef QCA_WIFI_2_0
 
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
index 6876ce7422e5..59086acc8c86 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
@@ -717,6 +717,22 @@ limProcessMlmAuthCnf(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
                caps &= (~LIM_RRM_BIT_MASK);
             }
 
+            /* Clear short preamble bit if AP does not support it */
+            if(!(psessionEntry->pLimJoinReq->bssDescription.capabilityInfo &
+                (LIM_SHORT_PREAMBLE_BIT_MASK)))
+            {
+                caps &= (~LIM_SHORT_PREAMBLE_BIT_MASK);
+                limLog(pMac, LOG1, FL("Clearing short preamble:no AP support"));
+            }
+
+            /* Clear immediate block ack bit if AP does not support it */
+            if(!(psessionEntry->pLimJoinReq->bssDescription.capabilityInfo &
+                (LIM_IMMEDIATE_BLOCK_ACK_MASK)))
+            {
+                caps &= (~LIM_IMMEDIATE_BLOCK_ACK_MASK);
+                limLog(pMac, LOG1, FL("Clearing Immed Blk Ack:no AP support"));
+            }
+
             pMlmAssocReq->capabilityInfo = caps;
            PELOG3(limLog(pMac, LOG3,
                FL("Capabilities to be used in AssocReq=0x%X, privacy bit=%x shortSlotTime %x"),
diff --git a/CORE/MAC/src/pe/lim/limUtils.h b/CORE/MAC/src/pe/lim/limUtils.h
index 7206f74c2b30..cba5753ec3a0 100644
--- a/CORE/MAC/src/pe/lim/limUtils.h
+++ b/CORE/MAC/src/pe/lim/limUtils.h
@@ -55,6 +55,8 @@ typedef enum
 #define LIM_AID_MASK                              0xC000
 #define LIM_SPECTRUM_MANAGEMENT_BIT_MASK          0x0100
 #define LIM_RRM_BIT_MASK                          0x1000
+#define LIM_SHORT_PREAMBLE_BIT_MASK               0x0020
+#define LIM_IMMEDIATE_BLOCK_ACK_MASK              0x8000
 #if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 #define LIM_MAX_REASSOC_RETRY_LIMIT            2
 #endif
diff --git a/CORE/SAP/src/sapChSelect.c b/CORE/SAP/src/sapChSelect.c
index af52187c96d2..5a0691352b94 100644
--- a/CORE/SAP/src/sapChSelect.c
+++ b/CORE/SAP/src/sapChSelect.c
@@ -588,8 +588,9 @@ v_U8_t sapSelectPreferredChannelFromChannelList(v_U8_t bestChNum,
   PARAMETERS
 
     IN
+    halHandle          : Pointer to tHalHandle
     *pSpectInfoParams  : Pointer to tSapChSelSpectInfo structure
-    sapContext: SAP Context
+     pSapCtx           : Pointer to SAP Context
 
   RETURN VALUE
     v_BOOL_t:  Success or FAIL
@@ -607,7 +608,7 @@ v_BOOL_t sapChanSelInit(tHalHandle halHandle,
     v_BOOL_t chSafe = VOS_TRUE;
 #ifdef FEATURE_WLAN_CH_AVOID
     v_U16_t i;
-#endif /* FEATURE_WLAN_CH_AVOID */
+#endif
 
     VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s", __func__);
 
@@ -641,6 +642,17 @@ v_BOOL_t sapChanSelInit(tHalHandle halHandle,
             continue;
         }
 
+#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) || defined(WLAN_FEATURE_MBSSID)
+        if (pSapCtx->dfs_ch_disable == VOS_TRUE) {
+            if (VOS_IS_DFS_CH(*pChans)) {
+                chSafe = VOS_FALSE;
+                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+                          "In %s,  DFS Ch %d not considered for ACS", __func__,
+                          *pChans);
+                continue;
+            }
+        }
+#endif
 #ifdef FEATURE_WLAN_CH_AVOID
         for(i = 0; i < NUM_20MHZ_RF_CHANNELS; i++) {
             if((safeChannels[i].channelNumber == *pChans) &&
@@ -2459,7 +2471,7 @@ v_U8_t sapSelectChannel(tHalHandle halHandle, ptSapContext pSapCtx,  tScanResult
     }
 
     // Initialize the structure pointed by pSpectInfoParams
-    if(sapChanSelInit( halHandle, pSpectInfoParams, pSapCtx) != eSAP_TRUE ) {
+    if (sapChanSelInit( halHandle, pSpectInfoParams, pSapCtx ) != eSAP_TRUE ) {
         VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR, "In %s, Ch Select initialization failed", __func__);
         return SAP_CHANNEL_NOT_SELECTED;
     }
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 3adcac0f23cf..62a7c28516a9 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -480,21 +480,47 @@ sapGotoChannelSel
         return VOS_STATUS_E_FAULT;
     }
 
-#ifndef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-    /*If STA-AP concurrency is enabled take the concurrent connected channel first. In other cases wpa_supplicant should take care */
+#ifdef WLAN_FEATURE_MBSSID
+    if (vos_concurrent_sap_sessions_running()) {
+        v_U16_t con_sap_ch = sme_GetConcurrentOperationChannel(hHal);
+
+        if (sapContext->channel == AUTO_CHANNEL_SELECT)
+            sapContext->dfs_ch_disable = VOS_TRUE;
+        else if (con_sap_ch && sapContext->channel != con_sap_ch &&
+                 VOS_IS_DFS_CH(sapContext->channel)) {
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_WARN,
+                       "In %s, MCC DFS not supported in AP_AP Mode", __func__);
+            return VOS_STATUS_E_ABORTED;
+        }
+    }
+#endif
+
     if (vos_get_concurrency_mode() == VOS_STA_SAP)
     {
+#ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
+        if (sapContext->channel == AUTO_CHANNEL_SELECT)
+            sapContext->dfs_ch_disable = VOS_TRUE;
+        else if (VOS_IS_DFS_CH(sapContext->channel)) {
+            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_WARN,
+                       "In %s, DFS not supported in STA_AP Mode", __func__);
+            return VOS_STATUS_E_ABORTED;
+        }
+#endif
+#ifndef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+        /* If STA-AP concurrency is enabled take the concurrent connected
+         * channel first. In other cases wpa_supplicant should take care */
         channel = sme_GetConcurrentOperationChannel(hHal);
         if (channel)
         { /*if a valid channel is returned then use concurrent channel.
                   Else take whatever comes from configuartion*/
             sapContext->channel = channel;
             sme_SelectCBMode(hHal,
-                             sapConvertSapPhyModeToCsrPhyMode(sapContext->csrRoamProfile.phyMode),
-                             channel);
+                             sapConvertSapPhyModeToCsrPhyMode(
+                                 sapContext->csrRoamProfile.phyMode),
+                                 channel);
         }
-    }
 #endif
+    }
 
     if (sapContext->channel == AUTO_CHANNEL_SELECT)
     {
@@ -1613,18 +1639,19 @@ sapFsm
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
                  if (sapContext->cc_switch_mode != VOS_MCC_TO_SCC_SWITCH_DISABLE)
                  {
-                     v_U16_t cc_ch;
-                     cc_ch = sme_CheckConcurrentChannelOverlap(hHal,
-                         sapContext->channel,
-                         sapConvertSapPhyModeToCsrPhyMode(
-                                            sapContext->csrRoamProfile.phyMode),
-                         sapContext->cc_switch_mode);
-                     if (cc_ch)
+                     v_U16_t con_ch;
+
+                     con_ch = sme_CheckConcurrentChannelOverlap(hHal,
+                                        sapContext->channel,
+                                        sapConvertSapPhyModeToCsrPhyMode(
+                                        sapContext->csrRoamProfile.phyMode),
+                                        sapContext->cc_switch_mode);
+                     if (con_ch)
                      {
                          VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
                              "%s: Override Chosen Ch:%d to %d due to CC Intf!!",
-                            __func__,sapContext->channel, cc_ch);
-                         sapContext->channel = cc_ch;
+                            __func__,sapContext->channel, con_ch);
+                         sapContext->channel = con_ch;
                          sme_SelectCBMode(hHal,
                              sapConvertSapPhyModeToCsrPhyMode(
                                             sapContext->csrRoamProfile.phyMode),
@@ -1656,6 +1683,20 @@ sapFsm
                          eSAP_DOT11_MODE_11g_ONLY))
                      sapContext->csrRoamProfile.phyMode = eSAP_DOT11_MODE_11a;
 
+#ifdef WLAN_FEATURE_MBSSID
+                 /* when AP2 is started while AP1 is performing ACS, we may not
+                  * have the AP1 channel yet.So here after the completion of AP2
+                  * ACS check if AP1 ACS resulting channel is DFS and if yes
+                  * override AP2 ACS scan result with AP1 DFS channel
+                  */
+                 if (vos_concurrent_sap_sessions_running()) {
+                     v_U16_t con_ch;
+
+                     con_ch = sme_GetConcurrentOperationChannel(hHal);
+                     if (con_ch && VOS_IS_DFS_CH(con_ch))
+                         sapContext->channel = con_ch;
+                 }
+#endif
                  /* Transition from eSAP_CH_SELECT to eSAP_STARTING (both without substates) */
                  VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, from state %s => %s",
                             __func__, "eSAP_CH_SELECT", "eSAP_STARTING");
@@ -1788,16 +1829,13 @@ sapFsm
                  /*Action code for transition */
                  vosStatus = sapSignalHDDevent( sapContext, roamInfo, eSAP_START_BSS_EVENT, (v_PVOID_t)eSAP_STATUS_SUCCESS);
 
-                 /* Transition from eSAP_STARTING to eSAP_STARTED (both without substates) */
-                 VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "In %s, from state %s => %s",
-                            __func__, "eSAP_STARTING", "eSAP_STARTED");
-
                   /* The upper layers have been informed that AP is up and
                   * running, however, the AP is still not beaconing, until
                   * CAC is done if the operating channel is DFS
                   */
                  if (NV_CHANNEL_DFS ==
-                     vos_nv_getChannelEnabledState(sapContext->channel))
+                     vos_nv_getChannelEnabledState(sapContext->channel)
+                    )
                  {
                     if ((VOS_FALSE == pMac->sap.SapDfsInfo.ignore_cac) &&
                         (eSAP_DFS_DO_NOT_SKIP_CAC ==
diff --git a/CORE/SAP/src/sapInternal.h b/CORE/SAP/src/sapInternal.h
index d621d69a6c25..9c6f645adf7a 100644
--- a/CORE/SAP/src/sapInternal.h
+++ b/CORE/SAP/src/sapInternal.h
@@ -245,6 +245,10 @@ typedef struct sSapContext {
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
     v_U8_t             cc_switch_mode;
 #endif
+#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) ||\
+    defined(WLAN_FEATURE_MBSSID)
+    v_BOOL_t           dfs_ch_disable;
+#endif
     tANI_BOOLEAN       isCacEndNotified;
     tANI_BOOLEAN       isCacStartNotified;
 } *ptSapContext;
diff --git a/CORE/SAP/src/sapModule.c b/CORE/SAP/src/sapModule.c
index 05a107a91f74..4733f38a7768 100644
--- a/CORE/SAP/src/sapModule.c
+++ b/CORE/SAP/src/sapModule.c
@@ -735,7 +735,6 @@ WLANSAP_StartBss
         vos_mem_copy(pSapCtx->denyMacList, pConfig->deny_mac, sizeof(pConfig->deny_mac));
         pSapCtx->nDenyMac = pConfig->num_deny_mac;
         sapSortMacList(pSapCtx->denyMacList, pSapCtx->nDenyMac);
-
         /* Fill in the event structure for FSM */
         sapEvent.event = eSAP_HDD_START_INFRA_BSS;
         sapEvent.params = 0;//pSapPhysLinkCreate
@@ -875,11 +874,6 @@ WLANSAP_StopBss
         Sanity check
         Extract SAP control block
     ------------------------------------------------------------------------*/
-#ifdef WLAN_FEATURE_MBSSID
-    VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
-                 "WLANSAP_StopBss: sapContext=%p", pSapCtx);
-#endif
-
     if ( NULL == pCtx )
     {
         VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
diff --git a/CORE/SERVICES/COMMON/wlan_tgt_def_config_hl.h b/CORE/SERVICES/COMMON/wlan_tgt_def_config_hl.h
index 1c23a8595600..1016a25dec2a 100644
--- a/CORE/SERVICES/COMMON/wlan_tgt_def_config_hl.h
+++ b/CORE/SERVICES/COMMON/wlan_tgt_def_config_hl.h
@@ -207,8 +207,21 @@
 /*
  * total number of descriptors to use in the target
  */
+#ifndef HIF_SDIO
 #define CFG_TGT_NUM_MSDU_DESC    (32)
-
+#else
+/*
+ * For SDIO Only 16 tx-buffers are hooked onto SDIO MBOX DMA engine
+ * in Firmware. So set the targe number of descriptors to map the
+ * same.
+ * This is only temporary solution.
+ * The better solution is defining CFG_TGT_NUM_MSDU_DESC to be 0
+ * and waiting for an initial TX_TARGET_CREDIT_UPDATE_IND message
+ * from the FW to know how many tx buffers the FW has provided
+ * for the host's downloads.
+ */
+#define CFG_TGT_NUM_MSDU_DESC    (16)
+#endif
 /*
  * Maximum number of frag table entries
  */
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 4e3a81cb3b03..a427e9142a81 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -1852,7 +1852,7 @@ static int wma_extscan_start_stop_event_handler(void *handle,
 		vos_mem_free(extscan_ind);
 		return -EINVAL;
 	}
-	pMac->sme.pExtScanIndCb(pMac->pAdapter,
+	pMac->sme.pExtScanIndCb(pMac->hHdd,
 				event_type, extscan_ind);
 	WMA_LOGD("%s: sending event to umac for requestid %x"
 		"with status %d", __func__,
@@ -1907,7 +1907,7 @@ static int wma_extscan_operations_event_handler(void *handle,
 		vos_mem_free(oprn_ind);
 		return -EINVAL;
 	}
-	pMac->sme.pExtScanIndCb(pMac->pAdapter,
+	pMac->sme.pExtScanIndCb(pMac->hHdd,
 				eSIR_EXTSCAN_SCAN_PROGRESS_EVENT_IND,
 				oprn_ind);
 	WMA_LOGD("%s: sending scan progress event to hdd",
@@ -1949,7 +1949,7 @@ static int wma_extscan_table_usage_event_handler (void *handle,
 	tbl_usg_ind->requestId = event->request_id;
 	tbl_usg_ind->numResultsAvailable = event->maximum_entries;
 
-	pMac->sme.pExtScanIndCb(pMac->pAdapter,
+	pMac->sme.pExtScanIndCb(pMac->hHdd,
 				eSIR_EXTSCAN_SCAN_RES_AVAILABLE_IND,
 				tbl_usg_ind);
 	WMA_LOGD("%s: sending scan_res available event to hdd",
@@ -2009,7 +2009,7 @@ static int wma_extscan_capabilities_event_handler (void *handle,
 		dest_capab->maxHotlistAPs,
 		dest_capab->scanCacheSize);
 
-	pMac->sme.pExtScanIndCb(pMac->pAdapter,
+	pMac->sme.pExtScanIndCb(pMac->hHdd,
 				eSIR_EXTSCAN_GET_CAPABILITIES_IND,
 				dest_capab);
 	WMA_LOGD("%s: sending capabilities event to hdd", __func__);
@@ -2084,7 +2084,7 @@ static int wma_extscan_hotlist_match_event_handler(void *handle,
 		dest_ap++;
 		src_hotlist++;
 	}
-	pMac->sme.pExtScanIndCb(pMac->pAdapter,
+	pMac->sme.pExtScanIndCb(pMac->hHdd,
 				eSIR_EXTSCAN_HOTLIST_MATCH_IND,
 				dest_hotlist);
 	WMA_LOGD("%s: sending hotlist match event to hdd", __func__);
@@ -2164,7 +2164,7 @@ static int wma_extscan_cached_results_event_handler(void *handle,
 		dest_ap++;
 		src_hotlist++;
 	}
-	pMac->sme.pExtScanIndCb(pMac->pAdapter,
+	pMac->sme.pExtScanIndCb(pMac->hHdd,
 				eSIR_EXTSCAN_CACHED_RESULTS_IND,
 				dest_cachelist);
 	WMA_LOGD("%s: sending cached results event", __func__);
@@ -2251,7 +2251,7 @@ static int wma_extscan_change_results_event_handler(void *handle,
 	dest_chglist->moreData = moredata;
 	dest_chglist->numResults = event->total_entries;
 
-	pMac->sme.pExtScanIndCb(pMac->pAdapter,
+	pMac->sme.pExtScanIndCb(pMac->hHdd,
 				eSIR_EXTSCAN_SIGNIFICANT_WIFI_CHANGE_RESULTS_IND,
 				dest_chglist);
 	WMA_LOGD("%s: sending change monitor results", __func__);
@@ -2396,7 +2396,7 @@ static int wma_unified_link_iface_stats_event_handler(void *handle,
 	 * vdev_id/ifacId in link_stats_results will be
 	 * used to retrieve the correct HDD context
 	 */
-	pMac->sme.pLinkLayerStatsIndCallback(pMac->pAdapter,
+	pMac->sme.pLinkLayerStatsIndCallback(pMac->hHdd,
 		WDA_LINK_LAYER_STATS_RESULTS_RSP,
 		link_stats_results);
 	WMA_LOGD("%s: Iface Stats event posted to HDD", __func__);
@@ -2539,7 +2539,7 @@ static int wma_unified_link_peer_stats_event_handler(void *handle,
 	 * vdev_id/ifacId in link_stats_results will be
 	 * used to retrieve the correct HDD context
 	 */
-	pMac->sme.pLinkLayerStatsIndCallback(pMac->pAdapter,
+	pMac->sme.pLinkLayerStatsIndCallback(pMac->hHdd,
 	        WDA_LINK_LAYER_STATS_RESULTS_RSP,
 	        link_stats_results);
 	WMA_LOGD("%s: Peer Stats event posted to HDD", __func__);
@@ -2668,7 +2668,7 @@ static int wma_unified_link_radio_stats_event_handler(void *handle,
 	 * vdev_id/ifacId in link_stats_results will be
 	 * used to retrieve the correct HDD context
 	 */
-	pMac->sme.pLinkLayerStatsIndCallback(pMac->pAdapter,
+	pMac->sme.pLinkLayerStatsIndCallback(pMac->hHdd,
 	        WDA_LINK_LAYER_STATS_RESULTS_RSP,
 	        link_stats_results);
 	WMA_LOGD("%s: Radio Stats event posted to HDD", __func__);
@@ -6472,62 +6472,399 @@ end:
 	return vos_status;
 }
 
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+VOS_STATUS wma_roam_scan_fill_self_caps(tp_wma_handle wma_handle,
+		wmi_roam_offload_tlv_param *roam_offload_params,
+		tSirRoamOffloadScanReq *roam_req)
+{
+	struct sAniSirGlobal *pMac = NULL;
+	tSirMacCapabilityInfo selfCaps;
+	tANI_U32 val = 0;
+	tANI_U32 nCfgValue;
+	tANI_U16 *pCfgValue16;
+	tANI_U8  nCfgValue8, *pCfgValue8;
+	tSirMacQosInfoStation macQosInfoSta;
+	union {
+		tANI_U16			nCfgValue16;
+		tSirMacHTCapabilityInfo	 htCapInfo;
+		tSirMacExtendedHTCapabilityInfo extHtCapInfo;
+	} uHTCapabilityInfo;
+
+	vos_mem_set(&macQosInfoSta, 0, sizeof(tSirMacQosInfoStation));
+	/* Roaming is done only for INFRA STA type.
+	 * So, ess will be one and ibss will be Zero */
+	pMac = (struct sAniSirGlobal*)vos_get_context(VOS_MODULE_ID_PE,
+				wma_handle->vos_context);
+	if (!pMac) {
+		WMA_LOGE("%s:NULL pMac ptr. Exiting", __func__);
+		VOS_ASSERT(0);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	if (wlan_cfgGetInt(pMac, WNI_CFG_PRIVACY_ENABLED, &val) !=
+							eSIR_SUCCESS){
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_PRIVACY_ENABLED");
+		return VOS_STATUS_E_FAILURE;
+	}
+	selfCaps.ess = 1;
+	selfCaps.ibss = 0;
+	if (val)
+		selfCaps.privacy = 1;
+	if (wlan_cfgGetInt(pMac, WNI_CFG_SHORT_PREAMBLE, &val) !=
+						       eSIR_SUCCESS){
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_SHORT_PREAMBLE");
+		return VOS_STATUS_E_FAILURE;
+	}
+	if (val)
+		selfCaps.shortPreamble = 1;
+
+	selfCaps.pbcc = 0;
+	selfCaps.channelAgility = 0;
+	if (wlan_cfgGetInt(pMac, WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED,
+					  &val) != eSIR_SUCCESS){
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_11G_SHORT_SLOT_TIME_ENABLED");
+		return VOS_STATUS_E_FAILURE;
+	}
+	if (val)
+		selfCaps.shortSlotTime = 1;
+	if (wlan_cfgGetInt(pMac, WNI_CFG_11H_ENABLED, &val) != eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_11H_ENABLED");
+		return VOS_STATUS_E_FAILURE;
+	}
+	if (val)
+		selfCaps.spectrumMgt = 1;
+	if (wlan_cfgGetInt(pMac, WNI_CFG_QOS_ENABLED, &val) != eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_QOS_ENABLED");
+		return VOS_STATUS_E_FAILURE;
+	}
+	if (val)
+		selfCaps.qos = 1;
+	if (wlan_cfgGetInt(pMac, WNI_CFG_APSD_ENABLED, &val) != eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_APSD_ENABLED");
+		return VOS_STATUS_E_FAILURE;
+	}
+	if (val)
+		selfCaps.apsd = 1;
+	if (wlan_cfgGetInt(pMac, WNI_CFG_RRM_ENABLED, &val) != eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_RRM_ENABLED");
+		return VOS_STATUS_E_FAILURE;
+	}
+	if (val)
+		selfCaps.rrm = 1;
+	if (wlan_cfgGetInt(pMac, WNI_CFG_BLOCK_ACK_ENABLED, &val) !=
+							       eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_BLOCK_ACK_ENABLED");
+		return VOS_STATUS_E_FAILURE;
+	}
+	selfCaps.delayedBA =
+		(tANI_U16)((val >> WNI_CFG_BLOCK_ACK_ENABLED_DELAYED) & 1);
+	selfCaps.immediateBA =
+		(tANI_U16)((val >> WNI_CFG_BLOCK_ACK_ENABLED_IMMEDIATE) & 1);
+	pCfgValue16 = (tANI_U16 *)&selfCaps;
+	roam_offload_params->capability = (*pCfgValue16) & 0xFFFF;
+
+	if (wlan_cfgGetInt(pMac, WNI_CFG_HT_CAP_INFO, &nCfgValue) !=
+							    eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_HT_CAP_INFO");
+		return VOS_STATUS_E_FAILURE;
+	}
+	uHTCapabilityInfo.nCfgValue16 = nCfgValue & 0xFFFF;
+	roam_offload_params->ht_caps_info =
+				   uHTCapabilityInfo.nCfgValue16 & 0xFFFF;
+	if (wlan_cfgGetInt(pMac, WNI_CFG_HT_AMPDU_PARAMS, &nCfgValue) !=
+							    eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_HT_AMPDU_PARAMS");
+		return VOS_STATUS_E_FAILURE;
+	}
+	/* tSirMacHTParametersInfo */
+	nCfgValue8 = ( tANI_U8 ) nCfgValue;
+	roam_offload_params->ampdu_param = (nCfgValue8) & 0xFF;
+
+	val = ROAM_OFFLOAD_NUM_MCS_SET;
+	if (wlan_cfgGetStr(pMac, WNI_CFG_SUPPORTED_MCS_SET,
+			(tANI_U8*)roam_offload_params->mcsset,
+				&val) != eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_SUPPORTED_MCS_SET");
+		return VOS_STATUS_E_FAILURE;
+	}
+	if (wlan_cfgGetInt(pMac, WNI_CFG_EXT_HT_CAP_INFO, &nCfgValue) !=
+							       eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_EXT_HT_CAP_INFO");
+		return VOS_STATUS_E_FAILURE;
+	}
+	/* uHTCapabilityInfo.extHtCapInfo */
+	uHTCapabilityInfo.nCfgValue16 = nCfgValue & 0xFFFF;
+	roam_offload_params->ht_ext_cap =
+				   uHTCapabilityInfo.nCfgValue16 & 0xFFFF;
+
+	if (wlan_cfgGetInt(pMac, WNI_CFG_TX_BF_CAP, &nCfgValue) !=
+							  eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_TX_BF_CAP");
+		return VOS_STATUS_E_FAILURE;
+	}
+	/* tSirMacTxBFCapabilityInfo */
+	nCfgValue8 = ( tANI_U8 ) nCfgValue;
+	roam_offload_params->ht_txbf = nCfgValue8 & 0xFF;
+	if (wlan_cfgGetInt(pMac, WNI_CFG_AS_CAP, &nCfgValue) !=
+                                             eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_AS_CAP");
+		return VOS_STATUS_E_FAILURE;
+	}
+	/* tSirMacASCapabilityInfo */
+	nCfgValue8 = ( tANI_U8 ) nCfgValue;
+	roam_offload_params->asel_cap = nCfgValue8 & 0xFF;
+
+	/* QOS Info */
+	if (wlan_cfgGetInt(pMac, WNI_CFG_MAX_SP_LENGTH, &nCfgValue) !=
+							   eSIR_SUCCESS) {
+		VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get WNI_CFG_MAX_SP_LENGTH");
+		return VOS_STATUS_E_FAILURE;
+	}
+	nCfgValue8 = ( tANI_U8 ) nCfgValue;
+	macQosInfoSta.maxSpLen = nCfgValue8;
+	macQosInfoSta.moreDataAck = 0;
+	macQosInfoSta.qack = 0;
+	macQosInfoSta.acbe_uapsd = roam_req->AcUapsd.acbe_uapsd;
+	macQosInfoSta.acbk_uapsd = roam_req->AcUapsd.acbk_uapsd;
+	macQosInfoSta.acvi_uapsd = roam_req->AcUapsd.acvi_uapsd;
+	macQosInfoSta.acvo_uapsd = roam_req->AcUapsd.acvo_uapsd;
+	pCfgValue8 = (tANI_U8 *)&macQosInfoSta;
+	/* macQosInfoSta Only queue_request is set.Refer to
+	 * PopulateDot11fWMMCaps for more details
+	 */
+	roam_offload_params->qos_caps = (*pCfgValue8) & 0xFF;
+	roam_offload_params->wmm_caps = 0x4 & 0xFF;
+	return VOS_STATUS_SUCCESS;
+}
+
+#endif
 /* function   : wma_roam_scan_offload_mode
  * Descriptin : send WMI_ROAM_SCAN_MODE TLV to firmware. It has a piggyback
- *            : of WMI_ROAM_SCAN_MODE.
+ *	    : of WMI_ROAM_SCAN_MODE.
  * Args       : scan_cmd_fp contains the scan parameters.
- *            : mode controls rssi based and periodic scans by roam engine.
+ *	    : mode controls rssi based and periodic scans by roam engine.
  * Returns    :
  */
 VOS_STATUS wma_roam_scan_offload_mode(tp_wma_handle wma_handle,
-        wmi_start_scan_cmd_fixed_param *scan_cmd_fp, u_int32_t mode)
+					wmi_start_scan_cmd_fixed_param *scan_cmd_fp,
+					tSirRoamOffloadScanReq *roam_req,
+					u_int32_t mode)
 {
-    VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
-    wmi_buf_t buf = NULL;
-    int status = 0;
-    int len;
-    wmi_roam_scan_mode_fixed_param *roam_scan_mode_fp;
-    u_int8_t *buf_ptr;
-
-    /* Need to create a buf with roam_scan command at front and piggyback with scan command */
-    len = sizeof(wmi_roam_scan_mode_fixed_param) + sizeof(wmi_start_scan_cmd_fixed_param);
-    buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
-    if (!buf) {
-        WMA_LOGD("%s : wmi_buf_alloc failed", __func__);
-        return VOS_STATUS_E_NOMEM;
-    }
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+	wmi_buf_t buf = NULL;
+	int status = 0;
+	int len;
+	u_int8_t *buf_ptr;
+	wmi_roam_scan_mode_fixed_param *roam_scan_mode_fp;
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+	int auth_mode = WMI_AUTH_NONE;
+	wmi_roam_offload_tlv_param *roam_offload_params;
+	wmi_roam_11i_offload_tlv_param *roam_offload_11i;
+	wmi_roam_11r_offload_tlv_param *roam_offload_11r;
+	wmi_roam_ese_offload_tlv_param *roam_offload_ese;
+	if (roam_req)
+	    auth_mode = eCsrAuthType_to_rsn_authmode
+	    (roam_req->ConnectedNetwork.authentication,
+		 roam_req->ConnectedNetwork.encryption);
+	WMA_LOGD("%s : auth mode = %d",__func__, auth_mode);
+#endif
+	/* Need to create a buf with roam_scan command at
+	 * front and piggyback with scan command */
+	len = sizeof(wmi_roam_scan_mode_fixed_param) +
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+		(2 * WMI_TLV_HDR_SIZE) +
+#endif
+		sizeof(wmi_start_scan_cmd_fixed_param);
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+	if (roam_req && roam_req->RoamOffloadEnabled) {
+		len += sizeof(wmi_roam_offload_tlv_param);
+		len += WMI_TLV_HDR_SIZE;
+		if((auth_mode != WMI_AUTH_NONE) &&
+			(auth_mode != WMI_AUTH_OPEN)){
+			len += WMI_TLV_HDR_SIZE;
+			if(auth_mode == WMI_AUTH_CCKM)
+			len += sizeof(wmi_roam_ese_offload_tlv_param);
+			else if (auth_mode == WMI_AUTH_FT_RSNA ||
+			auth_mode == WMI_AUTH_FT_RSNA_PSK)
+			len += sizeof(wmi_roam_11r_offload_tlv_param);
+			else
+			len += sizeof(wmi_roam_11i_offload_tlv_param);
+		} else {
+			len += WMI_TLV_HDR_SIZE;
+		}
+	} else {
+		if (roam_req)
+		   WMA_LOGD("%s : roam offload = %d",
+			       __func__, roam_req->RoamOffloadEnabled);
+		else
+			WMA_LOGD("%s : roam_req is NULL",__func__);
+		len += (2 * WMI_TLV_HDR_SIZE);
+	}
+	if (roam_req && roam_req->RoamOffloadEnabled) {
+		mode = mode | WMI_ROAM_SCAN_MODE_ROAMOFFLOAD;
+	}
+#endif
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGE("%s : wmi_buf_alloc failed", __func__);
+		return VOS_STATUS_E_NOMEM;
+	}
 
-    buf_ptr = (u_int8_t *) wmi_buf_data(buf);
-    roam_scan_mode_fp = (wmi_roam_scan_mode_fixed_param *) buf_ptr;
-    WMITLV_SET_HDR(&roam_scan_mode_fp->tlv_header,
-               WMITLV_TAG_STRUC_wmi_roam_scan_mode_fixed_param,
-               WMITLV_GET_STRUCT_TLVLEN(wmi_roam_scan_mode_fixed_param));
-
-    roam_scan_mode_fp->roam_scan_mode = mode;
-    roam_scan_mode_fp->vdev_id = wma_handle->roam_offload_vdev_id;
-    /* Fill in scan parameters suitable for roaming scan */
-    buf_ptr += sizeof(wmi_roam_scan_mode_fixed_param);
-    vos_mem_copy(buf_ptr, scan_cmd_fp, sizeof(wmi_start_scan_cmd_fixed_param));
-    /* Ensure there is no additional IEs */
-    scan_cmd_fp->ie_len = 0;
-    WMITLV_SET_HDR(buf_ptr,
-               WMITLV_TAG_STRUC_wmi_start_scan_cmd_fixed_param,
-               WMITLV_GET_STRUCT_TLVLEN(wmi_start_scan_cmd_fixed_param));
-    status = wmi_unified_cmd_send(wma_handle->wmi_handle, buf,
-            len, WMI_ROAM_SCAN_MODE);
-    if (status != EOK) {
-        WMA_LOGE("wmi_unified_cmd_send WMI_ROAM_SCAN_MODE returned Error %d",
-            status);
-        vos_status = VOS_STATUS_E_FAILURE;
-        goto error;
-    }
+	buf_ptr = (u_int8_t *) wmi_buf_data(buf);
+	roam_scan_mode_fp = (wmi_roam_scan_mode_fixed_param *) buf_ptr;
+	WMITLV_SET_HDR(&roam_scan_mode_fp->tlv_header,
+			WMITLV_TAG_STRUC_wmi_roam_scan_mode_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(wmi_roam_scan_mode_fixed_param));
+
+	roam_scan_mode_fp->roam_scan_mode = mode;
+	roam_scan_mode_fp->vdev_id = wma_handle->roam_offload_vdev_id;
+	/* Fill in scan parameters suitable for roaming scan */
+	buf_ptr += sizeof(wmi_roam_scan_mode_fixed_param);
+	vos_mem_copy(buf_ptr, scan_cmd_fp, sizeof(wmi_start_scan_cmd_fixed_param));
+	/* Ensure there is no additional IEs */
+	scan_cmd_fp->ie_len = 0;
+	WMITLV_SET_HDR(buf_ptr,
+			WMITLV_TAG_STRUC_wmi_start_scan_cmd_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(wmi_start_scan_cmd_fixed_param));
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+	buf_ptr += sizeof(wmi_start_scan_cmd_fixed_param);
+	if (roam_req && roam_req->RoamOffloadEnabled) {
+		WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		sizeof(wmi_roam_offload_tlv_param));
+		buf_ptr += WMI_TLV_HDR_SIZE;
+	    roam_offload_params = (wmi_roam_offload_tlv_param *) buf_ptr;
+		 WMITLV_SET_HDR(buf_ptr,
+			WMITLV_TAG_STRUC_wmi_roam_offload_tlv_param,
+			WMITLV_GET_STRUCT_TLVLEN(wmi_roam_offload_tlv_param));
+	    roam_offload_params->prefer_5g = roam_req->Prefer5GHz;
+	    roam_offload_params->rssi_cat_gap = roam_req->RoamRssiCatGap;
+	    roam_offload_params->select_5g_margin = roam_req->Select5GHzMargin;
+	    roam_offload_params->reassoc_failure_timeout =
+		roam_req->ReassocFailureTimeout;
+	    /* Fill the capabilities */
+	    wma_roam_scan_fill_self_caps(wma_handle, roam_offload_params, roam_req);
+	    buf_ptr += sizeof(wmi_roam_offload_tlv_param);
+	    /* The TLV's are in the order of 11i, 11R, ESE. Hence,
+	     * they are filled in the same order.Depending on the
+	     * authentication type, the other mode TLV's are nullified
+	     * and only headers are filled.*/
+	    if ((auth_mode != WMI_AUTH_OPEN) && (auth_mode != WMI_AUTH_NONE)) {
+			if (auth_mode == WMI_AUTH_CCKM){
+				WMITLV_SET_HDR(buf_ptr,WMITLV_TAG_ARRAY_STRUC,
+				WMITLV_GET_STRUCT_TLVLEN(0));
+				buf_ptr += WMI_TLV_HDR_SIZE;
+				WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+				WMITLV_GET_STRUCT_TLVLEN(0));
+				buf_ptr += WMI_TLV_HDR_SIZE;
+				WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+				sizeof(wmi_roam_ese_offload_tlv_param));
+				buf_ptr += WMI_TLV_HDR_SIZE;
+				roam_offload_ese =
+				  (wmi_roam_ese_offload_tlv_param *) buf_ptr;
+				vos_mem_copy (roam_offload_ese->krk, roam_req->KRK,
+							 sizeof(roam_req->KRK));
+				vos_mem_copy (roam_offload_ese->btk, roam_req->BTK,
+							 sizeof(roam_req->BTK));
+				WMITLV_SET_HDR(&roam_offload_ese->tlv_header,
+				WMITLV_TAG_STRUC_wmi_roam_ese_offload_tlv_param,
+				WMITLV_GET_STRUCT_TLVLEN
+				  (wmi_roam_ese_offload_tlv_param));
+				buf_ptr += sizeof(wmi_roam_ese_offload_tlv_param);
+			} else if (auth_mode == WMI_AUTH_FT_RSNA ||
+				auth_mode == WMI_AUTH_FT_RSNA_PSK){
+				WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC, 0);
+				buf_ptr += WMI_TLV_HDR_SIZE;
+				WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+				sizeof(wmi_roam_11r_offload_tlv_param));
+				buf_ptr += WMI_TLV_HDR_SIZE;
+				roam_offload_11r =
+				(wmi_roam_11r_offload_tlv_param *) buf_ptr;
+				roam_offload_11r->r0kh_id = 0;
+				roam_offload_11r->r0kh_id_len = 0;
+				vos_mem_copy (roam_offload_11r->psk_msk, roam_req->PSK_PMK,
+						       sizeof(roam_req->PSK_PMK));
+				WMITLV_SET_HDR(&roam_offload_11r->tlv_header,
+				WMITLV_TAG_STRUC_wmi_roam_11r_offload_tlv_param,
+				WMITLV_GET_STRUCT_TLVLEN
+				    (wmi_roam_11r_offload_tlv_param));
+				buf_ptr += sizeof(wmi_roam_11r_offload_tlv_param);
+				WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+				WMITLV_GET_STRUCT_TLVLEN(0));
+				buf_ptr += WMI_TLV_HDR_SIZE;
+			} else {
+				WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+				sizeof(wmi_roam_11i_offload_tlv_param));
+				buf_ptr += WMI_TLV_HDR_SIZE;
+				roam_offload_11i =
+				(wmi_roam_11i_offload_tlv_param *) buf_ptr;
+				WMI_SET_ROAM_OFFLOAD_OKC_ENABLED(roam_offload_11i->flags);
+				vos_mem_copy (roam_offload_11i->pmk, roam_req->PSK_PMK,
+                                             sizeof(roam_req->PSK_PMK));
+				WMITLV_SET_HDR(&roam_offload_11i->tlv_header,
+				WMITLV_TAG_STRUC_wmi_roam_11i_offload_tlv_param,
+				WMITLV_GET_STRUCT_TLVLEN
+				(wmi_roam_11i_offload_tlv_param) );
+				buf_ptr += sizeof(wmi_roam_11i_offload_tlv_param);
+				WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,0);
+				buf_ptr += WMI_TLV_HDR_SIZE;
+				WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,0);
+				buf_ptr += WMI_TLV_HDR_SIZE;
+			}
+		} else {
+			WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+			WMITLV_GET_STRUCT_TLVLEN(0));
+			buf_ptr += WMI_TLV_HDR_SIZE;
+			WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+			WMITLV_GET_STRUCT_TLVLEN(0));
+			buf_ptr += WMI_TLV_HDR_SIZE;
+			WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+			WMITLV_GET_STRUCT_TLVLEN(0));
+	    }
+	} else {
+		WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		    WMITLV_GET_STRUCT_TLVLEN(0));
+	    buf_ptr += WMI_TLV_HDR_SIZE;
+		WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		    WMITLV_GET_STRUCT_TLVLEN(0));
+	    buf_ptr += WMI_TLV_HDR_SIZE;
+	    WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		    WMITLV_GET_STRUCT_TLVLEN(0));
+	    buf_ptr += WMI_TLV_HDR_SIZE;
+	    WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC,
+		    WMITLV_GET_STRUCT_TLVLEN(0));
+	}
+#endif
+	status = wmi_unified_cmd_send(wma_handle->wmi_handle, buf,
+			len, WMI_ROAM_SCAN_MODE);
+	if (status != EOK) {
+		WMA_LOGE
+		("wmi_unified_cmd_send WMI_ROAM_SCAN_MODE returned Error %d",
+							     status);
+		vos_status = VOS_STATUS_E_FAILURE;
+		goto error;
+	}
 
-    WMA_LOGI("%s: WMA --> WMI_ROAM_SCAN_MODE", __func__);
-    return VOS_STATUS_SUCCESS;
+	WMA_LOGI("%s: WMA --> WMI_ROAM_SCAN_MODE", __func__);
+	return VOS_STATUS_SUCCESS;
 error:
-    wmi_buf_free(buf);
+	wmi_buf_free(buf);
 
-    return vos_status;
+	return vos_status;
 }
 
 /* function   : wma_roam_scan_offload_rssi_threshold
@@ -7164,7 +7501,7 @@ VOS_STATUS wma_roam_scan_offload_init_connect(tp_wma_handle wma_handle)
     vos_status = wma_roam_scan_offload_ap_profile(wma_handle, &ap_profile);
 
     wma_roam_scan_fill_scan_params(wma_handle, pMac, NULL, &scan_params);
-    vos_status = wma_roam_scan_offload_mode(wma_handle, &scan_params,
+    vos_status = wma_roam_scan_offload_mode(wma_handle, &scan_params, NULL,
             WMI_ROAM_SCAN_MODE_PERIODIC);
     return vos_status;
 }
@@ -7191,7 +7528,7 @@ VOS_STATUS wma_roam_scan_offload_end_connect(tp_wma_handle wma_handle)
     if (wma_handle->roam_offload_enabled) {
 
         wma_roam_scan_fill_scan_params(wma_handle, pMac, NULL, &scan_params);
-        vos_status = wma_roam_scan_offload_mode(wma_handle, &scan_params,
+        vos_status = wma_roam_scan_offload_mode(wma_handle, &scan_params, NULL,
                                 WMI_ROAM_SCAN_MODE_NONE);
     }
     return VOS_STATUS_SUCCESS;
@@ -7345,7 +7682,8 @@ VOS_STATUS wma_process_roam_scan_req(tp_wma_handle wma_handle,
 
 
             wma_roam_scan_fill_scan_params(wma_handle, pMac, roam_req, &scan_params);
-            vos_status = wma_roam_scan_offload_mode(wma_handle, &scan_params, mode);
+            vos_status = wma_roam_scan_offload_mode(wma_handle, &scan_params,
+                                                            roam_req, mode);
             break;
 
         case ROAM_SCAN_OFFLOAD_STOP:
@@ -7397,7 +7735,7 @@ VOS_STATUS wma_process_roam_scan_req(tp_wma_handle wma_handle,
             wma_handle->suitable_ap_hb_failure = FALSE;
             wma_roam_scan_fill_scan_params(wma_handle, pMac, roam_req, &scan_params);
             vos_status = wma_roam_scan_offload_mode(wma_handle, &scan_params,
-                                                    WMI_ROAM_SCAN_MODE_NONE);
+                                        roam_req, WMI_ROAM_SCAN_MODE_NONE);
             if (vos_status != VOS_STATUS_SUCCESS) {
                 break;
             }
@@ -7463,7 +7801,8 @@ VOS_STATUS wma_process_roam_scan_req(tp_wma_handle wma_handle,
             }
 
             wma_roam_scan_fill_scan_params(wma_handle, pMac, roam_req, &scan_params);
-            vos_status = wma_roam_scan_offload_mode(wma_handle, &scan_params, mode);
+            vos_status = wma_roam_scan_offload_mode(wma_handle, &scan_params,
+                                                            roam_req, mode);
 
             break;
 
diff --git a/CORE/SERVICES/WMA/wma.h b/CORE/SERVICES/WMA/wma.h
index 95818f37162a..f14538ff02ca 100644
--- a/CORE/SERVICES/WMA/wma.h
+++ b/CORE/SERVICES/WMA/wma.h
@@ -1622,6 +1622,9 @@ enum uapsd_up {
 	UAPSD_UP_MAX
 };
 
+A_UINT32 eCsrAuthType_to_rsn_authmode (eCsrAuthType authtype,
+                                       eCsrEncryptionType encr);
+A_UINT32 eCsrEncryptionType_to_rsn_cipherset (eCsrEncryptionType encr);
 
 #define WMA_TGT_INVALID_SNR (-1)
 #define WMA_DYNAMIC_DTIM_SETTING_THRESHOLD 2
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 1ad613677189..1d5734872f48 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -2606,7 +2606,7 @@ eHalStatus sme_ProcessMsg(tHalHandle hHal, vos_msg_t* pMsg)
           case eWNI_SME_LPHB_IND:
                 if (pMac->sme.pLphbIndCb)
                 {
-                   pMac->sme.pLphbIndCb(pMac->pAdapter, pMsg->bodyptr);
+                   pMac->sme.pLphbIndCb(pMac->hHdd, pMsg->bodyptr);
                 }
                 vos_mem_free(pMsg->bodyptr);
 
@@ -2632,7 +2632,7 @@ eHalStatus sme_ProcessMsg(tHalHandle hHal, vos_msg_t* pMsg)
                 {
                    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
                              "%s: CH avoid notification", __func__);
-                   pMac->sme.pChAvoidNotificationCb(pMac->pAdapter, pMsg->bodyptr);
+                   pMac->sme.pChAvoidNotificationCb(pMac->hHdd, pMsg->bodyptr);
                 }
                 vos_mem_free(pMsg->bodyptr);
                 break;
@@ -12607,7 +12607,7 @@ eHalStatus sme_StatsExtEvent(tHalHandle hHal, void* pMsg)
         smsLog(pMac, LOG2, "SME: entering %s", __func__);
 
         if (pMac->sme.StatsExtCallback) {
-            pMac->sme.StatsExtCallback(pMac->pAdapter, (tpStatsExtEvent)pMsg);
+            pMac->sme.StatsExtCallback(pMac->hHdd, (tpStatsExtEvent)pMsg);
         }
     }
 
diff --git a/CORE/SYS/legacy/src/system/src/macInitApi.c b/CORE/SYS/legacy/src/system/src/macInitApi.c
index ef534675d147..a8431a0882da 100644
--- a/CORE/SYS/legacy/src/system/src/macInitApi.c
+++ b/CORE/SYS/legacy/src/system/src/macInitApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -213,7 +213,6 @@ tSirRetStatus macOpen(tHalHandle *pHalHandle, tHddHandle hHdd, tMacOpenParameter
      * dependant)
      */
     pMac->hHdd      = hHdd;
-    pMac->pAdapter  = hHdd; //This line wil be removed
     *pHalHandle     = (tHalHandle)pMac;
 
     {
diff --git a/CORE/VOSS/inc/vos_getBin.h b/CORE/VOSS/inc/vos_getBin.h
index ff65535ec790..ec3d949bf686 100644
--- a/CORE/VOSS/inc/vos_getBin.h
+++ b/CORE/VOSS/inc/vos_getBin.h
@@ -141,4 +141,7 @@ v_BOOL_t vos_concurrent_open_sessions_running(void);
 v_BOOL_t vos_max_concurrent_connections_reached(void);
 void vos_clear_concurrent_session_count(void);
 
+#ifdef WLAN_FEATURE_MBSSID
+v_BOOL_t vos_concurrent_sap_sessions_running(v_VOID_t);
+#endif
 #endif // !defined __VOS_GETBIN_H
diff --git a/CORE/VOSS/inc/vos_nvitem.h b/CORE/VOSS/inc/vos_nvitem.h
index 05adc57c536c..f8bef51677f9 100644
--- a/CORE/VOSS/inc/vos_nvitem.h
+++ b/CORE/VOSS/inc/vos_nvitem.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -188,6 +188,15 @@ typedef enum
 }
 VNV_TYPE;
 
+typedef enum
+{
+/* DFS Session refers to successful SAP session operating in DFS channel */
+   DFS_CAC_NEVER_DONE,   /* CAC was never done for this current ap / ap-ap */
+   DFS_CAC_IN_PROGRESS,  /* CAC is in progress for this DFS session */
+   DFS_CAC_ALREADY_DONE, /* CAC already for SAP starting this DFS session */
+}
+eDFS_CAC_STATUS;
+
 // country code type
 typedef v_U8_t v_COUNTRYCODE_t[VOS_COUNTRY_CODE_LEN];
 
@@ -703,6 +712,8 @@ eNVChannelEnabledType vos_nv_getChannelEnabledState
 (
    v_U32_t    rfChannel
 );
+#define VOS_IS_DFS_CH(channel) (vos_nv_getChannelEnabledState((channel)) == \
+                                   NV_CHANNEL_DFS)
 
 VOS_STATUS vos_init_wiphy_from_nv_bin(void);
 VOS_STATUS vos_init_wiphy_from_eeprom(void);
diff --git a/CORE/VOSS/src/vos_getBin.c b/CORE/VOSS/src/vos_getBin.c
index c2f2b53b2f1b..345527e652b4 100644
--- a/CORE/VOSS/src/vos_getBin.c
+++ b/CORE/VOSS/src/vos_getBin.c
@@ -163,6 +163,27 @@ v_BOOL_t vos_concurrent_open_sessions_running(void)
     return (j>1);
 }
 
+#ifdef WLAN_FEATURE_MBSSID
+v_BOOL_t vos_concurrent_sap_sessions_running(v_VOID_t)
+{
+    v_U8_t i=0;
+    hdd_context_t *pHddCtx;
+    v_CONTEXT_t pVosContext = vos_get_global_context( VOS_MODULE_ID_HDD, NULL );
+
+    if (NULL != pVosContext)
+    {
+       pHddCtx = vos_get_context( VOS_MODULE_ID_HDD, pVosContext);
+       if (NULL != pHddCtx)
+       {
+             i = pHddCtx->no_of_open_sessions[VOS_STA_SAP_MODE];
+       }
+    }
+
+    return (i>1);
+}
+#endif
+
+
 /**---------------------------------------------------------------------------
  *
  *   \brief vos_max_concurrent_connections_reached()
diff --git a/Kbuild b/Kbuild
index 4bba27efb0c0..f517ec760ad0 100644
--- a/Kbuild
+++ b/Kbuild
@@ -1311,6 +1311,9 @@ CDEFINES += -DFEATURE_GREEN_AP
 #Enable 4address scheme for mdm9630
 CDEFINES += -DFEATURE_WLAN_STA_4ADDR_SCHEME
 
+#Disable STA-AP Mode DFS support
+CDEFINES += -DFEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
+
 #Enable OBSS feature for mdm9630
 CDEFINES += -DQCA_HT_2040_COEX