Release 1.0.0.240 QCACLD WLAN Driver

Merge remote-tracking branch 'origin/caf/caf-wlan/master'

* origin/caf/caf-wlan/master:
  Cafstaging Release 1.0.0.240
  copyright fix:qcacld: HDD: Support Multicast Domain Name System Offload
  qcacld: hdd/ipa lower the logging level
  qcacld: SME: Modify the value of SIR_HAL_SET_MDNS_XXX
  qca-cld:sap: Fix ACS channel selection for HT40 and VHT80 cases
  qcacld: Allow Tx frame when restart concurrent SAP in DFS channel
  qcacld SAP: Fail SAP Start BSS on ACS fail
  wlan: Disable HT40 in 2.4GHz station mode
  wlan: HTT: Fix issues reported in static analysis tool
  qcacld: UMAC: Fix issues reported by static analysis tool
  qcacld: avoid un pause of tx queues in reassociating state

Change-Id: If22c44d420c6895e169ec7c73199dae1f22af09d

16 files changed, 140 insertions, 83 deletions

diff --git a/CORE/CLD_TXRX/HTT/htt_rx.c b/CORE/CLD_TXRX/HTT/htt_rx.c
index 77a70faf893f..f0b7ef03a5f8 100644
--- a/CORE/CLD_TXRX/HTT/htt_rx.c
+++ b/CORE/CLD_TXRX/HTT/htt_rx.c
@@ -2360,6 +2360,10 @@ htt_rx_hash_deinit(struct htt_pdev_t *pdev)
     struct htt_rx_hash_entry * hash_entry;
     htt_list_node * list_iter = NULL;
 
+    if (NULL == pdev->rx_ring.hash_table) {
+        return;
+    }
+
     for (i = 0; i < RX_NUM_HASH_BUCKETS; i++) {
         /* Free the hash entries in hash bucket i */
         list_iter = pdev->rx_ring.hash_table[i].listhead.next;
diff --git a/CORE/HDD/inc/wlan_hdd_mdns_offload.h b/CORE/HDD/inc/wlan_hdd_mdns_offload.h
index 4b4100cd4b96..5b5d8e817a95 100644
--- a/CORE/HDD/inc/wlan_hdd_mdns_offload.h
+++ b/CORE/HDD/inc/wlan_hdd_mdns_offload.h
@@ -1,8 +1,28 @@
 /*
- * Copyright (c) 2014 Qualcomm Atheros, Inc.
- * All Rights Reserved.
- * Qualcomm Atheros Confidential and Proprietary.
+ * Copyright (c) 2014 The Linux Foundation. All rights reserved.
  *
+ * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+ *
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This file was originally distributed by Qualcomm Atheros, Inc.
+ * under proprietary terms before Copyright ownership was assigned
+ * to the Linux Foundation.
  */
 
 #ifndef __WLAN_HDD_MDNS_OFFLOAD_H__
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index dfc63e1e6d10..d7035d4e7751 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -3168,6 +3168,9 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
             }
             pHddStaCtx->ft_carrier_on = FALSE;
             pHddStaCtx->hdd_ReassocScenario = FALSE;
+            hddLog(LOG1,
+                   FL("hdd_ReassocScenario set to: %d, ReAssoc Failed, session: %d"),
+                   pHddStaCtx->hdd_ReassocScenario, pAdapter->sessionId);
             break;
 
         case eCSR_ROAM_FT_START:
@@ -3205,6 +3208,9 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
             }
             pHddStaCtx->ft_carrier_on = TRUE;
             pHddStaCtx->hdd_ReassocScenario = VOS_TRUE;
+            hddLog(LOG1,
+                   FL("hdd_ReassocScenario set to: %d due to eCSR_ROAM_FT_START, session: %d"),
+                   pHddStaCtx->hdd_ReassocScenario, pAdapter->sessionId);
             break;
 #endif
 
@@ -3346,8 +3352,13 @@ hdd_smeRoamCallback(void *pContext, tCsrRoamInfo *pRoamInfo, tANI_U32 roamId,
                     }
                 }
                 halStatus = hdd_RoamSetKeyCompleteHandler( pAdapter, pRoamInfo, roamId, roamStatus, roamResult );
-                if (eCSR_ROAM_RESULT_AUTHENTICATED == roamResult)
+                if (eCSR_ROAM_RESULT_AUTHENTICATED == roamResult) {
                     pHddStaCtx->hdd_ReassocScenario = VOS_FALSE;
+                    hddLog(LOG1,
+                           FL("hdd_ReassocScenario set to: %d, set key complete, session: %d"),
+                           pHddStaCtx->hdd_ReassocScenario,
+                           pAdapter->sessionId);
+                }
             }
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
             if (pRoamInfo != NULL)
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index 062bf19a6653..4bd55695028e 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -948,7 +948,8 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
             WLANSAP_Get_Dfs_Ignore_CAC(pHddCtx->hHal, &ignoreCAC);
             if ((NV_CHANNEL_DFS !=
                 vos_nv_getChannelEnabledState(pHddApCtx->operatingChannel))
-                || ignoreCAC)
+                || ignoreCAC
+                || pHddCtx->dev_dfs_cac_status == DFS_CAC_ALREADY_DONE)
             {
                 pHddApCtx->dfs_cac_block_tx = VOS_FALSE;
             }
diff --git a/CORE/HDD/src/wlan_hdd_ipa.c b/CORE/HDD/src/wlan_hdd_ipa.c
index 26278f295b40..05848b490023 100644
--- a/CORE/HDD/src/wlan_hdd_ipa.c
+++ b/CORE/HDD/src/wlan_hdd_ipa.c
@@ -1614,7 +1614,7 @@ static void hdd_ipa_send_skb_to_network(adf_nbuf_t skb, hdd_adapter_t *adapter)
 	struct hdd_ipa_priv *hdd_ipa = ghdd_ipa;
 
 	if (!adapter || adapter->magic != WLAN_HDD_ADAPTER_MAGIC) {
-		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR, "Invalid adapter: 0x%p",
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO_LOW, "Invalid adapter: 0x%p",
 				adapter);
 
 		adf_nbuf_free(skb);
@@ -1756,7 +1756,7 @@ VOS_STATUS hdd_ipa_process_rxt(v_VOID_t *vosContext, adf_nbuf_t rx_buf_list,
 	adapter = hdd_ipa->hdd_ctx->sta_to_adapter[sta_id];
 	if (!adapter || !adapter->ipa_context ||
 			adapter->magic != WLAN_HDD_ADAPTER_MAGIC) {
-		HDD_IPA_LOG(VOS_TRACE_LEVEL_ERROR, "Invalid sta_id: %d",
+		HDD_IPA_LOG(VOS_TRACE_LEVEL_INFO_LOW, "Invalid sta_id: %d",
 				sta_id);
 		goto drop_pkts;
 	}
diff --git a/CORE/HDD/src/wlan_hdd_mdns_offload.c b/CORE/HDD/src/wlan_hdd_mdns_offload.c
index 8be31fecc4a0..c4629a1c2252 100644
--- a/CORE/HDD/src/wlan_hdd_mdns_offload.c
+++ b/CORE/HDD/src/wlan_hdd_mdns_offload.c
@@ -1,10 +1,29 @@
 /*
- * Copyright (c) 2014 Qualcomm Atheros, Inc.
- * All Rights Reserved.
- * Qualcomm Atheros Confidential and Proprietary.
+ * Copyright (c) 2014 The Linux Foundation. All rights reserved.
  *
+ * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+ *
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/*
+ * This file was originally distributed by Qualcomm Atheros, Inc.
+ * under proprietary terms before Copyright ownership was assigned
+ * to the Linux Foundation.
+ */
 
 /**
  * wlan_hdd_mdns_offload.c - WLAN Host Device Driver implementation
diff --git a/CORE/HDD/src/wlan_hdd_tx_rx.c b/CORE/HDD/src/wlan_hdd_tx_rx.c
index bfcd4b7ebf17..4e028b5d364e 100644
--- a/CORE/HDD/src/wlan_hdd_tx_rx.c
+++ b/CORE/HDD/src/wlan_hdd_tx_rx.c
@@ -672,6 +672,7 @@ void hdd_tx_resume_cb(void *adapter_context,
                         v_BOOL_t tx_resume)
 {
    hdd_adapter_t *pAdapter = (hdd_adapter_t *)adapter_context;
+   hdd_station_ctx_t *hdd_sta_ctx = NULL;
 
    if (!pAdapter)
    {
@@ -679,6 +680,8 @@ void hdd_tx_resume_cb(void *adapter_context,
       return;
    }
 
+   hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+
    /* Resume TX  */
    if (VOS_TRUE == tx_resume)
    {
@@ -687,7 +690,12 @@ void hdd_tx_resume_cb(void *adapter_context,
        {
           vos_timer_stop(&pAdapter->tx_flow_control_timer);
        }
-      netif_tx_wake_all_queues(pAdapter->dev);
+       if (adf_os_unlikely(hdd_sta_ctx->hdd_ReassocScenario)) {
+           hddLog(LOGW,
+                  FL("flow control, tx queues un-pause avoided as we are in REASSOCIATING state"));
+           return;
+       }
+       netif_tx_wake_all_queues(pAdapter->dev);
    }
 #if defined(CONFIG_PER_VDEV_TX_DESC_POOL)
     else if (VOS_FALSE == tx_resume)  /* Pause TX  */
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 5f7aaeaca320..e2fc849ee23d 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            239
+#define QWLAN_VERSION_BUILD            240
 
-#define QWLAN_VERSIONSTR               "1.0.0.239"
+#define QWLAN_VERSIONSTR               "1.0.0.240"
 
 
 #define AR6320_REV1_VERSION             0x5000000
diff --git a/CORE/MAC/src/include/sirParams.h b/CORE/MAC/src/include/sirParams.h
index c05ae07cb558..a4b3885975c9 100644
--- a/CORE/MAC/src/include/sirParams.h
+++ b/CORE/MAC/src/include/sirParams.h
@@ -676,10 +676,10 @@ typedef struct sSirMbMsgP2p
 #define SIR_HAL_IPA_OFFLOAD_ENABLE_DISABLE (SIR_HAL_ITC_MSG_TYPES_BEGIN + 298)
 
 #ifdef MDNS_OFFLOAD
-#define SIR_HAL_SET_MDNS_OFFLOAD           (SIR_HAL_ITC_MSG_TYPES_BEGIN + 297)
-#define SIR_HAL_SET_MDNS_FQDN              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 298)
-#define SIR_HAL_SET_MDNS_RESPONSE          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 299)
-#define SIR_HAL_GET_MDNS_STATUS            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 300)
+#define SIR_HAL_SET_MDNS_OFFLOAD           (SIR_HAL_ITC_MSG_TYPES_BEGIN + 299)
+#define SIR_HAL_SET_MDNS_FQDN              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 300)
+#define SIR_HAL_SET_MDNS_RESPONSE          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 301)
+#define SIR_HAL_GET_MDNS_STATUS            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 302)
 #endif /* MDNS_OFFLOAD */
 
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
diff --git a/CORE/SAP/src/sapApiLinkCntl.c b/CORE/SAP/src/sapApiLinkCntl.c
index 2f84fe876850..a6970407d638 100644
--- a/CORE/SAP/src/sapApiLinkCntl.c
+++ b/CORE/SAP/src/sapApiLinkCntl.c
@@ -142,10 +142,6 @@ WLANSAP_ScanCallback
     tpAniSirGlobal pMac = NULL;
     v_U32_t vhtChannelWidth;
 #ifdef SOFTAP_CHANNEL_RANGE
-#if !defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) && \
-    !defined(WLAN_FEATURE_MBSSID)
-    v_U32_t operatingBand;
-#endif
     v_U32_t event;
 #endif
 
@@ -204,43 +200,15 @@ WLANSAP_ScanCallback
     if (operChannel == SAP_CHANNEL_NOT_SELECTED)
 #ifdef SOFTAP_CHANNEL_RANGE
     {
-        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
-             "%s: No suitable channel selected",
-             __func__);
+        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+             "%s: No suitable channel selected due to DFS, LTE-Coex and "
+             "Concurrent mode restrictions", __func__);
 
         if ( eCSR_BAND_ALL ==  psapContext->scanBandPreference ||
                      psapContext->allBandScanned == eSAP_TRUE)
         {
-#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) || \
-    defined(WLAN_FEATURE_MBSSID)
-            VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                "%s: ACS failed due to concurrent mode restrictions.. \n"
-                "Setting SAP channel to default ch (%d)", __func__,
-                SAP_DEFAULT_24GHZ_CHANNEL);
-             /* If there is no valid channel in the selected ACS range  select
-              * default 2.4GHz channel only. 5GHz channels were purposely
-              * avoided due to DFS and Concurrent mode restrictions
-              */
-             psapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
-#else
-
-             if(psapContext->channelList != NULL)
-             {
-                 psapContext->channel = psapContext->channelList[0];
-             }
-             else
-             {
-                 /* if the channel list is empty then there is no valid channel
-                    in the selected sub-band so select default channel in the
-                    BAND(2.4GHz/5GHZ) */
-                 ccmCfgGetInt( halHandle,
-                     WNI_CFG_SAP_CHANNEL_SELECT_OPERATING_BAND, &operatingBand);
-                 if(eSAP_RF_SUBBAND_2_4_GHZ == operatingBand )
-                     psapContext->channel = SAP_DEFAULT_24GHZ_CHANNEL;
-                 else
-                     psapContext->channel = SAP_DEFAULT_5GHZ_CHANNEL;
-             }
-#endif
+            psapContext->sapsMachine = eSAP_CH_SELECT;
+            event = eSAP_CHANNEL_SELECTION_FAILED;
         }
         else
         {
@@ -255,7 +223,7 @@ WLANSAP_ScanCallback
             psapContext->allBandScanned = eSAP_TRUE;
             //go back to DISCONNECT state, scan next band
             psapContext->sapsMachine = eSAP_DISCONNECTED;
-            event = eSAP_CHANNEL_SELECTION_FAILED;
+            event = eSAP_CHANNEL_SELECTION_RETRY;
          }
     }
 #else
diff --git a/CORE/SAP/src/sapChSelect.c b/CORE/SAP/src/sapChSelect.c
index 4599d1a441f7..f093bde15efd 100644
--- a/CORE/SAP/src/sapChSelect.c
+++ b/CORE/SAP/src/sapChSelect.c
@@ -1864,6 +1864,7 @@ void sapComputeSpectWeight( tSapChSelSpectInfo* pSpectInfoParams,
         rssi = (v_S7_t)pSpectCh->rssiAgr;
 
         pSpectCh->weight = SAPDFS_NORMALISE_1000 * sapweightRssiCount(rssi, pSpectCh->bssCount);
+        pSpectCh->weight_copy = pSpectCh->weight;
 
         //------ Debug Info ------
         VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
@@ -2014,7 +2015,7 @@ void sapSortChlWeightHT80(tSapChSelSpectInfo *pSpectInfoParams)
                best channel as the selected primary channel, update its
                weightage with the combined weight value */
             for (n=0; n<4; n++)
-                pSpectInfo[j+n].weight = ACS_WEIGHT_MAX;
+                pSpectInfo[j+n].weight = ACS_WEIGHT_MAX * 4;
 
             pSpectInfo[j+minIdx].weight = acsHT80Channels[i].weight;
         }
@@ -2024,11 +2025,11 @@ void sapSortChlWeightHT80(tSapChSelSpectInfo *pSpectInfoParams)
                skip this channel and those in the same HT80 width*/
             pSpectInfo[j].weight = ACS_WEIGHT_MAX;
             if ((pSpectInfo[j].chNum +4) == pSpectInfo[j+1].chNum)
-                pSpectInfo[j+1].weight = ACS_WEIGHT_MAX;
+                pSpectInfo[j+1].weight = ACS_WEIGHT_MAX * 4;
             if ((pSpectInfo[j].chNum +8) == pSpectInfo[j+2].chNum)
-                pSpectInfo[j+2].weight = ACS_WEIGHT_MAX;
+                pSpectInfo[j+2].weight = ACS_WEIGHT_MAX * 4;
             if ((pSpectInfo[j].chNum +12) == pSpectInfo[j+3].chNum)
-                pSpectInfo[j+3].weight = ACS_WEIGHT_MAX;
+                pSpectInfo[j+3].weight = ACS_WEIGHT_MAX * 4;
         }
     }
 
@@ -2037,7 +2038,7 @@ void sapSortChlWeightHT80(tSapChSelSpectInfo *pSpectInfoParams)
     {
         if ( CHANNEL_165 == pSpectInfo[j].chNum )
         {
-            pSpectInfo[j].weight = ACS_WEIGHT_MAX;
+            pSpectInfo[j].weight = ACS_WEIGHT_MAX * 4;
             break;
         }
     }
@@ -2106,15 +2107,15 @@ void sapSortChlWeightHT40_24G(tSapChSelSpectInfo *pSpectInfoParams)
                     if (pSpectInfo[j].weight <= pSpectInfo[j+4].weight)
                     {
                         pSpectInfo[j].weight = tmpWeight1;
-                        pSpectInfo[j+4].weight = ACS_WEIGHT_MAX;
-                        pSpectInfo[j+8].weight = ACS_WEIGHT_MAX;
+                        pSpectInfo[j+4].weight = ACS_WEIGHT_MAX * 2;
+                        pSpectInfo[j+8].weight = ACS_WEIGHT_MAX * 2;
                     }
                     else
                     {
                         pSpectInfo[j+4].weight = tmpWeight1;
                         /* for secondary channel selection */
-                        pSpectInfo[j].weight = ACS_WEIGHT_MAX - 1;
-                        pSpectInfo[j+8].weight = ACS_WEIGHT_MAX;
+                        pSpectInfo[j].weight = ACS_WEIGHT_MAX * 2 - 1;
+                        pSpectInfo[j+8].weight = ACS_WEIGHT_MAX * 2;
                     }
                 }
                 else
@@ -2122,15 +2123,15 @@ void sapSortChlWeightHT40_24G(tSapChSelSpectInfo *pSpectInfoParams)
                     if (pSpectInfo[j+4].weight <= pSpectInfo[j+8].weight)
                     {
                         pSpectInfo[j+4].weight = tmpWeight2;
-                        pSpectInfo[j].weight = ACS_WEIGHT_MAX;
+                        pSpectInfo[j].weight = ACS_WEIGHT_MAX * 2;
                         /* for secondary channel selection */
-                        pSpectInfo[j+8].weight = ACS_WEIGHT_MAX - 1;
+                        pSpectInfo[j+8].weight = ACS_WEIGHT_MAX * 2 - 1;
                     }
                     else
                     {
                         pSpectInfo[j+8].weight = tmpWeight2;
-                        pSpectInfo[j].weight = ACS_WEIGHT_MAX;
-                        pSpectInfo[j+4].weight = ACS_WEIGHT_MAX;
+                        pSpectInfo[j].weight = ACS_WEIGHT_MAX * 2;
+                        pSpectInfo[j+4].weight = ACS_WEIGHT_MAX * 2;
                     }
                 }
             }
@@ -2140,17 +2141,17 @@ void sapSortChlWeightHT40_24G(tSapChSelSpectInfo *pSpectInfoParams)
                 if (pSpectInfo[j].weight <= pSpectInfo[j+4].weight)
                 {
                     pSpectInfo[j].weight = tmpWeight1;
-                    pSpectInfo[j+4].weight = ACS_WEIGHT_MAX;
+                    pSpectInfo[j+4].weight = ACS_WEIGHT_MAX * 2;
                 }
                 else
                 {
                     pSpectInfo[j+4].weight = tmpWeight1;
-                    pSpectInfo[j].weight = ACS_WEIGHT_MAX;
+                    pSpectInfo[j].weight = ACS_WEIGHT_MAX * 2;
                 }
             }
         }
         else
-            pSpectInfo[j].weight = ACS_WEIGHT_MAX;
+            pSpectInfo[j].weight = ACS_WEIGHT_MAX * 2;
     }
 
     sapSortChlWeight(pSpectInfoParams);
@@ -2205,19 +2206,19 @@ void sapSortChlWeightHT40_5G(tSapChSelSpectInfo *pSpectInfoParams)
                 pSpectInfo[j].weight = acsHT40Channels5G[i].weight;
                 /* mark the adjacent channel's weight as max value so
                    that it will be sorted to the bottom */
-                pSpectInfo[j+1].weight = ACS_WEIGHT_MAX;
+                pSpectInfo[j+1].weight = ACS_WEIGHT_MAX * 2;
             }
             else
             {
                 pSpectInfo[j+1].weight = acsHT40Channels5G[i].weight;
                 /* mark the adjacent channel's weight as max value so
                    that it will be sorted to the bottom */
-                pSpectInfo[j].weight = ACS_WEIGHT_MAX;
+                pSpectInfo[j].weight = ACS_WEIGHT_MAX * 2;
             }
 
         }
         else
-           pSpectInfo[j].weight = ACS_WEIGHT_MAX;
+           pSpectInfo[j].weight = ACS_WEIGHT_MAX * 2;
     }
 
     /* avoid channel 165 by setting its weight to max */
@@ -2226,7 +2227,7 @@ void sapSortChlWeightHT40_5G(tSapChSelSpectInfo *pSpectInfoParams)
     {
         if ( CHANNEL_165  == pSpectInfo[j].chNum )
         {
-            pSpectInfo[j].weight = ACS_WEIGHT_MAX;
+            pSpectInfo[j].weight = ACS_WEIGHT_MAX * 2;
             break;
         }
     }
@@ -2563,7 +2564,7 @@ v_U8_t sapSelectChannel(tHalHandle halHandle, ptSapContext pSapCtx,  tScanResult
                     continue;
                 }
 
-                if (pSpectInfoParams->pSpectCh[count].weight >
+                if (pSpectInfoParams->pSpectCh[count].weight_copy >
                                   pSapCtx->acsBandSwitchThreshold)
                 {
                     /* the best channel exceeds the threshold
@@ -2582,7 +2583,7 @@ v_U8_t sapSelectChannel(tHalHandle halHandle, ptSapContext pSapCtx,  tScanResult
                     {
                         /* all bands are scanned, compare current best channel
                            with channel scanned previously */
-                        if ( pSpectInfoParams->pSpectCh[count].weight >
+                        if ( pSpectInfoParams->pSpectCh[count].weight_copy >
                               pSapCtx->acsBestChannelInfo.weight)
                         {
                             /* previous stored channel is better */
@@ -2592,7 +2593,7 @@ v_U8_t sapSelectChannel(tHalHandle halHandle, ptSapContext pSapCtx,  tScanResult
                         {
                             pSapCtx->acsBestChannelInfo.channelNum = bestChNum;
                             pSapCtx->acsBestChannelInfo.weight =
-                                       pSpectInfoParams->pSpectCh[count].weight;
+                                  pSpectInfoParams->pSpectCh[count].weight_copy;
                         }
                     }
                 }
@@ -2600,7 +2601,7 @@ v_U8_t sapSelectChannel(tHalHandle halHandle, ptSapContext pSapCtx,  tScanResult
                 {
                     pSapCtx->acsBestChannelInfo.channelNum = bestChNum;
                     pSapCtx->acsBestChannelInfo.weight =
-                                   pSpectInfoParams->pSpectCh[count].weight;
+                                  pSpectInfoParams->pSpectCh[count].weight_copy;
                 }
             }
 
@@ -2611,7 +2612,7 @@ v_U8_t sapSelectChannel(tHalHandle halHandle, ptSapContext pSapCtx,  tScanResult
                     /* Give preference to Non-overlap channels */
                     if (sapFilterOverLapCh(pSapCtx,
                             pSpectInfoParams->pSpectCh[count].chNum) &&
-                        (pSpectInfoParams->pSpectCh[count].weight <=
+                        (pSpectInfoParams->pSpectCh[count].weight_copy <=
                                  pSapCtx->acsBestChannelInfo.weight))
                     {
                         tmpChNum = pSpectInfoParams->pSpectCh[count].chNum;
diff --git a/CORE/SAP/src/sapChSelect.h b/CORE/SAP/src/sapChSelect.h
index f4455e2d6e92..1e2d1daf74c0 100644
--- a/CORE/SAP/src/sapChSelect.h
+++ b/CORE/SAP/src/sapChSelect.h
@@ -158,6 +158,7 @@ typedef struct {
     v_U16_t bssCount;   // bss found in scanresult for this channel
     v_S31_t rssiAgr;    // Max value of rssi among all BSS(es) from scanresult for this channel
     v_U32_t weight;     // Weightage of this channel
+    v_U32_t weight_copy; //copy of the orignal weight
     v_BOOL_t valid;     // Is this a valid center frequency for regulatory domain
 } tSapSpectChInfo;//tDfsSpectChInfo;
 
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 7241c5a8f4f2..dd78a44146de 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -3224,7 +3224,7 @@ sapFsm
 
                vosStatus = sap_CacStartNotify(hHal);
             }
-            else if (msg == eSAP_CHANNEL_SELECTION_FAILED)
+            else if (msg == eSAP_CHANNEL_SELECTION_RETRY)
             {
                  /* Set SAP device role */
                 sapContext->sapsMachine = eSAP_CH_SELECT;
@@ -3418,6 +3418,12 @@ sapFsm
                  }
                  vosStatus = sapGotoStarting( sapContext, sapEvent, eCSR_BSS_TYPE_INFRA_AP);
             }
+            else if (msg == eSAP_CHANNEL_SELECTION_FAILED) {
+                 sapContext->sapsMachine = eSAP_DISCONNECTED;
+                 VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+                           "\n\n***In %s, Cannot start BSS, ACS Fail***\n\n",
+                             __func__);
+            }
             else
             {
                 VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR, "In %s, in state %s, invalid event msg %d",
diff --git a/CORE/SAP/src/sapFsm_ext.h b/CORE/SAP/src/sapFsm_ext.h
index 58d77e527428..23c806d0de24 100644
--- a/CORE/SAP/src/sapFsm_ext.h
+++ b/CORE/SAP/src/sapFsm_ext.h
@@ -55,6 +55,7 @@ typedef enum
   eSAP_DFS_CHANNEL_CAC_END,
   eSAP_DFS_CHNL_SWITCH_ANNOUNCEMENT_START,
   eSAP_OPERATING_CHANNEL_CHANGED,
+  eSAP_CHANNEL_SELECTION_RETRY,
 
   eSAP_NO_MSG
 }eSapMsg_t;
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index f4d7963ff5d3..aaecee69743c 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -6947,8 +6947,14 @@ eHalStatus csrRoamConnect(tpAniSirGlobal pMac, tANI_U32 sessionId, tCsrRoamProfi
     tANI_U32 roamId = 0;
     tANI_BOOLEAN fCallCallback = eANI_BOOLEAN_FALSE;
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
-    if (NULL == pProfile)
-    {
+
+    if (NULL == pSession) {
+        smsLog(pMac, LOGE,
+               FL("session does not exist for given sessionId:%d"), sessionId);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    if (NULL == pProfile) {
         smsLog(pMac, LOGP, FL("No profile specified"));
         return eHAL_STATUS_FAILURE;
     }
@@ -11735,7 +11741,15 @@ tANI_BOOLEAN csrRoamIsValid40MhzChannel(tpAniSirGlobal pMac, tANI_U8 channel)
     tANI_U32 ChannelBondingMode;
     if(CSR_IS_CHANNEL_24GHZ(primaryChn))
     {
+         /* 'gChannelBondingMode24GHz' configuration item is common for
+          * SAP and STA mode and currently MDM does not support
+          * HT40 in 2.4Ghz STA mode.
+          * So disabling the HT40 in 2.4GHz station mode */
+#ifdef QCA_HT_20_24G_STA_ONLY
+        ChannelBondingMode = WNI_CFG_CHANNEL_BONDING_MODE_DISABLE;
+#else
         ChannelBondingMode = pMac->roam.configParam.channelBondingMode24GHz;
+#endif
     }
     else
     {
diff --git a/Kbuild b/Kbuild
index df6b3b70afa8..095557c03a6b 100644
--- a/Kbuild
+++ b/Kbuild
@@ -1236,6 +1236,9 @@ CDEFINES += -DFEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
 #Enable OBSS feature
 CDEFINES += -DQCA_HT_2040_COEX
 
+#Disable HT40 in 2.4GHZ STA mode
+CDEFINES += -DQCA_HT_20_24G_STA_ONLY
+
 else #CONFIG_MOBILE_ROUTER
 
 #Open P2P device interface only for non-Mobile router use cases