Merge commit '0219ae6' into wlan-cmn.driver.lnx.1.0-dev

Sync up wlan-cmn.driver.lnx.1.0-dev to CAF 5.0.0.160 from 5.0.0.149 release as baseline for subsequent win and mcl convergence refactoring. * commit '0219ae6': (554 commits) Release 5.0.0.160 qcacld-3.0: Add wma handler for vdev delete and peer delete responses Release 5.0.0.159 qcacld-3.0: Fix Compilation error on WLAN_FEATURE_11W disabled qcacld-3.0: Update channel width and center freq qcacld-3.0: Move sta state to not connected after try disconnect qcacld-3.0: Remove #ifdef FEATURE_WLAN_LFR from HDD qcacld-3.0: Remove RRM ie in Assoc Req based on AP capability qcacld-3.0: Fix fw statistics parsing on the host qcacld-3.0: Fix IPA-uc callback in NON-SMP system qcacld-3.0: SAP DFS-3 Feature support in DFS layer qcacld-3.0: SAP DFS-3 Feature support in WMA qcacld-3.0: correct phy_mode in hdd_chan_change_notify qcacld-3.0: move hif_bus_open to hif_open qcacld-3.0: Remove hif_claim_device qcacld-3.0: Remove epping context from cds qcacld-3.0: Enable Tx beamformee in SAP mode qcacld-3.0: Set the IMPS enable/disable based on INI qcacld-3.0: Fix memory leak in case of fw reset stats command qcacld-3.0: Use appropriate API to get total free descriptors ... qcacld-3.0: Enable athdiag debug support for SNOC devices qcacld-3.0: Remove support of power gating parameters qcacld-3.0: Add log in vos_mem_alloc if kzalloc takes more than 3 seconds Change-Id: I903d2b6edfb715570daffbcfcdb46866f04737dc CRs-Fixed: 688141
author: Prakash Dhavali <pdhavali@codeaurora.org> 2016-03-01 09:05:38 -0800
committer: Prakash Dhavali <pdhavali@codeaurora.org> 2016-03-01 09:14:32 -0800
commit: abcec8c47e8ff57bf9ef22d56be4eec50406b6b9 (patch)
tree: b6da6b07b4c4a132c83803c4d9b054fda58579af
parent: 65b41c171a1bbe02fa9bcbbc92006f1a5744c043 (diff)
parent: 0219ae607ac51d3009808a4709cc5c07140586ac (diff)
245 files changed, 15035 insertions, 10255 deletions
diff --git a/Kbuild b/Kbuild
index e21632faec12..3bfa2604faf8 100644
--- a/Kbuild
+++ b/Kbuild
@@ -130,6 +130,9 @@ ifeq ($(KERNEL_BUILD), 0)
 			CONFIG_WLAN_LRO := n
 		endif
 	endif
+
+	# Flag to enable LFR Subnet Detection
+	CONFIG_LFR_SUBNET_DETECTION := y
 endif
 
 ifneq ($(CONFIG_MOBILE_ROUTER), y)
@@ -250,10 +253,6 @@ CONFIG_FEATURE_SECURE_FIRMWARE := 0
 #Flag to enable Stats Ext implementation
 CONFIG_FEATURE_STATS_EXT := 1
 
-#Flag to force the inclusion of the 802.11p channels because support
-#for these channels has not yet been added to the kernel.
-CONFIG_STATICALLY_ADD_11P_CHANNELS := n
-
 ifeq ($(CONFIG_CFG80211),y)
 HAVE_CFG80211 := 1
 else
@@ -338,6 +337,10 @@ ifeq ($(CONFIG_WLAN_FEATURE_MEMDUMP),y)
 HDD_OBJS += $(HDD_SRC_DIR)/wlan_hdd_memdump.o
 endif
 
+ifeq ($(CONFIG_LFR_SUBNET_DETECTION), y)
+HDD_OBJS +=	$(HDD_SRC_DIR)/wlan_hdd_subnet_detect.o
+endif
+
 ########### HOST DIAG LOG ###########
 HOST_DIAG_LOG_DIR :=	core/utils/host_diag_log
 
@@ -907,6 +910,10 @@ CDEFINES += -DADRASTEA_SHADOW_REGISTERS
 CDEFINES += -DADRASTEA_RRI_ON_DDR
 endif
 
+ifneq (y,$(filter y,$(CONFIG_CNSS_EOS) $(CONFIG_ICNSS) $(CONFIG_CNSS_ADRASTEA)))
+CDEFINES += -DQCA_WIFI_2_0
+endif
+
 ifeq ($(CONFIG_WLAN_FASTPATH), y)
 CDEFINES +=	-DWLAN_FEATURE_FASTPATH
 endif
@@ -1266,6 +1273,16 @@ ifeq (y, $(filter y, $(CONFIG_CNSS_ADRASTEA) $(CONFIG_ICNSS)))
 CDEFINES += -DWLAN_FEATURE_RX_FULL_REORDER_OL
 endif
 
+# Enable athdiag procfs debug support for adrastea
+ifeq (y, $(filter y, $(CONFIG_CNSS_ADRASTEA) $(CONFIG_ICNSS)))
+CDEFINES += -DCONFIG_ATH_PROCFS_DIAG_SUPPORT
+endif
+
+# Enable 11AC TX compact feature for adrastea
+ifeq (y, $(filter y, $(CONFIG_CNSS_ADRASTEA) $(CONFIG_ICNSS)))
+CDEFINES += -DATH_11AC_TXCOMPACT
+endif
+
 # NOTE: CONFIG_64BIT_PADDR requires CONFIG_HELIUMPLUS
 ifeq (y,$(filter y,$(CONFIG_CNSS_EOS) $(CONFIG_ICNSS)))
 CONFIG_HELIUMPLUS := y
@@ -1275,6 +1292,7 @@ CONFIG_FEATURE_TSO_DEBUG := y
 ifeq ($(CONFIG_HELIUMPLUS),y)
 CDEFINES += -DHELIUMPLUS_PADDR64
 CDEFINES += -DHELIUMPLUS
+CDEFINES += -DAR900B
 ifeq ($(CONFIG_64BIT_PADDR),y)
 CDEFINES += -DHTT_PADDR64
 endif
@@ -1308,8 +1326,8 @@ ifeq ($(CONFIG_WLAN_FEATURE_MEMDUMP),y)
 CDEFINES += -DWLAN_FEATURE_MEMDUMP
 endif
 
-ifeq ($(CONFIG_STATICALLY_ADD_11P_CHANNELS),y)
-CDEFINES += -DFEATURE_STATICALLY_ADD_11P_CHANNELS
+ifeq ($(CONFIG_LFR_SUBNET_DETECTION), y)
+CDEFINES += -DFEATURE_LFR_SUBNET_DETECTION
 endif
 
 KBUILD_CPPFLAGS += $(CDEFINES)
diff --git a/Kconfig b/Kconfig
index 9cf8e1d9d01e..940ae4dcf1fd 100644
--- a/Kconfig
+++ b/Kconfig
@@ -107,4 +107,8 @@ config WLAN_FEATURE_RX_WAKELOCK
 	bool "Enable RX wake lock feature"
 	default n
 
+config FEATURE_LFR_SUBNET_DETECTION
+	bool "Enable LFR Subnet Change Detection"
+	default n
+
 endif # QCA_CLD_WLAN
diff --git a/config/WCNSS_qcom_cfg.ini b/config/WCNSS_qcom_cfg.ini
index c652d36db4d0..cab58d6c3c77 100644
--- a/config/WCNSS_qcom_cfg.ini
+++ b/config/WCNSS_qcom_cfg.ini
@@ -311,8 +311,6 @@ gEnableDFSChnlScan=1
 gAllowDFSChannelRoam=1
 
 gVhtChannelWidth=2
-gEnableLogp=1
-
 
 # Enable Automatic Tx Power control
 
@@ -369,6 +367,9 @@ gEnableRXLDPC=1
 #Enable/Disable Tx beamforming
 gTxBFEnable=1
 
+#Enable/Disable Tx beamformee in SAP mode
+gEnableTxBFeeSAP=1
+
 # Enable Tx beamforming in VHT20MHz
 # Valid values are 0,1. If commented out, the default value is 0.
 # 0=disable, 1=enable
@@ -420,9 +421,6 @@ gEnablePowerSaveOffload=2
 #Enable firmware uart print
 gEnablefwprint=0
 
-#Enable firmware log
-gEnablefwlog=1
-
 #IPA config
 gIPAConfig=0
 gIPADescSize=800
@@ -464,7 +462,7 @@ isP2pDeviceAddrAdministrated=0
 gEnableRxThread=1
 
 #Enable NAPI
-gEnableNAPI=0
+gEnableNAPI=1
 
 # Set Thermal Power limit
 TxPower2g=10
diff --git a/core/bmi/src/bmi.c b/core/bmi/src/bmi.c
index 7104619faffe..6753f01b1bf2 100644
--- a/core/bmi/src/bmi.c
+++ b/core/bmi/src/bmi.c
@@ -1,5 +1,5 @@
 /*
- * copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -110,9 +110,8 @@ void bmi_cleanup(struct ol_softc *scn)
 CDF_STATUS bmi_done(struct ol_softc *scn)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
-	hif_claim_device(scn, scn);
 
-	if (IHELIUM_NO_BMI)
+	if (NO_BMI)
 		return status;
 
 	status = bmi_done_local(scn);
@@ -175,7 +174,7 @@ CDF_STATUS bmi_download_firmware(struct ol_softc *scn)
 	uint32_t address;
 	int32_t ret;
 
-	if (IHELIUM_NO_BMI)
+	if (NO_BMI)
 		return CDF_STATUS_SUCCESS; /* no BMI for Q6 bring up */
 
 	if (!scn) {
diff --git a/core/bmi/src/bmi_2.c b/core/bmi/src/bmi_2.c
index cd8ce45bcf26..b04f4cbfc159 100644
--- a/core/bmi/src/bmi_2.c
+++ b/core/bmi/src/bmi_2.c
@@ -429,7 +429,7 @@ CDF_STATUS bmi_firmware_download(struct ol_softc *scn)
 {
 	CDF_STATUS status;
 
-	if (IHELIUM_NO_BMI)
+	if (NO_BMI)
 		return CDF_STATUS_SUCCESS;
 
 	status = bmi_init(scn);
diff --git a/core/bmi/src/i_bmi.h b/core/bmi/src/i_bmi.h
index 9df099d02669..a176b4c4ddd2 100644
--- a/core/bmi/src/i_bmi.h
+++ b/core/bmi/src/i_bmi.h
@@ -118,10 +118,10 @@ typedef enum _ATH_BIN_FILE {
 	ATH_SETUP_FILE,
 } ATH_BIN_FILE;
 
-#if defined(QCA_WIFI_3_0_IHELIUM) || defined(QCA_WIFI_3_0_ADRASTEA)
-#define IHELIUM_NO_BMI 1
+#if defined(QCA_WIFI_3_0_ADRASTEA)
+#define NO_BMI 1
 #else
-#define IHELIUM_NO_BMI 0
+#define NO_BMI 0
 #endif
 
 CDF_STATUS bmi_execute(uint32_t address, uint32_t *param,
diff --git a/core/bmi/src/ol_fw.c b/core/bmi/src/ol_fw.c
index 1607010d7dad..ddb08fefce72 100644
--- a/core/bmi/src/ol_fw.c
+++ b/core/bmi/src/ol_fw.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -81,7 +81,7 @@ static int ol_check_fw_hash(const u8 *data, u32 fw_size, ATH_BIN_FILE file)
 		break;
 	case ATH_FIRMWARE_FILE:
 #ifdef QCA_WIFI_FTM
-		if (cds_get_conparam() == CDF_FTM_MODE) {
+		if (cds_get_conparam() == CDF_GLOBAL_FTM_MODE) {
 			hash = fw_hash.utf;
 			break;
 		}
@@ -173,7 +173,7 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 			break;
 		}
 #ifdef QCA_WIFI_FTM
-		if (cds_get_conparam() == CDF_FTM_MODE) {
+		if (cds_get_conparam() == CDF_GLOBAL_FTM_MODE) {
 #if defined(CONFIG_CNSS)
 			filename = scn->fw_files.utf_file;
 #else
@@ -201,7 +201,7 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 		return 0;
 	case ATH_BOARD_DATA_FILE:
 #ifdef QCA_WIFI_FTM
-		if (cds_get_conparam() == CDF_FTM_MODE) {
+		if (cds_get_conparam() == CDF_GLOBAL_FTM_MODE) {
 #if defined(CONFIG_CNSS)
 			filename = scn->fw_files.utf_board_data;
 #else
@@ -225,7 +225,7 @@ static int __ol_transfer_bin_file(struct ol_softc *scn, ATH_BIN_FILE file,
 #endif
 		break;
 	case ATH_SETUP_FILE:
-		if (cds_get_conparam() != CDF_FTM_MODE &&
+		if (cds_get_conparam() != CDF_GLOBAL_FTM_MODE &&
 		    !WLAN_IS_EPPING_ENABLED(cds_get_conparam())) {
 #ifdef CONFIG_CNSS
 			BMI_INFO("%s: no Setup file defined", __func__);
@@ -618,17 +618,17 @@ void ol_target_failure(void *instance, CDF_STATUS status)
 	}
 	scn->target_status = OL_TRGET_STATUS_RESET;
 
-	if (cds_is_logp_in_progress()) {
-		BMI_ERR("%s: LOGP is in progress, ignore!\n", __func__);
+	if (cds_is_driver_recovering()) {
+		BMI_ERR("%s: Recovery in progress, ignore!\n", __func__);
 		return;
 	}
 
-	if (cds_is_load_unload_in_progress()) {
+	if (cds_is_load_or_unload_in_progress()) {
 		BMI_ERR("%s: Loading/Unloading is in progress, ignore!",
 		       __func__);
 		return;
 	}
-	cds_set_logp_in_progress(true);
+	cds_set_recovery_in_progress(true);
 
 #ifdef CONFIG_CNSS
 	ret = hif_check_fw_reg(scn);
diff --git a/core/cdf/inc/cdf_atomic.h b/core/cdf/inc/cdf_atomic.h
index 230d4eda3057..4ae5dc5b9ab7 100644
--- a/core/cdf/inc/cdf_atomic.h
+++ b/core/cdf/inc/cdf_atomic.h
@@ -62,7 +62,7 @@ static inline void cdf_atomic_init(cdf_atomic_t *v)
  *
  * Return: The current value of the variable
  */
-static inline uint32_t cdf_atomic_read(cdf_atomic_t *v)
+static inline int32_t cdf_atomic_read(cdf_atomic_t *v)
 {
 	return __cdf_atomic_read(v);
 }
@@ -102,6 +102,18 @@ static inline void cdf_atomic_add(int i, cdf_atomic_t *v)
 }
 
 /**
+ * cdf_atomic_sub() - Subtract a value from an atomic variable.
+ * @i: the amount by which to decrease the atomic counter
+ * @v: a pointer to an opaque atomic variable
+ *
+ * Return: none
+ */
+static inline void cdf_atomic_sub(int i, cdf_atomic_t *v)
+{
+	__cdf_atomic_sub(i, v);
+}
+
+/**
  * cdf_atomic_dec_and_test() - decrement an atomic variable and check if the
  *				new value is zero
  * @v: A pointer to an opaque atomic variable
@@ -110,7 +122,7 @@ static inline void cdf_atomic_add(int i, cdf_atomic_t *v)
  *    true (non-zero) if the new value is zero,
  *    or false (0) if the new value is non-zero
  */
-static inline uint32_t cdf_atomic_dec_and_test(cdf_atomic_t *v)
+static inline int32_t cdf_atomic_dec_and_test(cdf_atomic_t *v)
 {
 	return __cdf_atomic_dec_and_test(v);
 }
@@ -132,7 +144,7 @@ static inline void cdf_atomic_set(cdf_atomic_t *v, int i)
  *
  * Return: The current value of the variable
  */
-static inline uint32_t cdf_atomic_inc_return(cdf_atomic_t *v)
+static inline int32_t cdf_atomic_inc_return(cdf_atomic_t *v)
 {
 	return __cdf_atomic_inc_return(v);
 }
diff --git a/core/cdf/inc/cdf_defer.h b/core/cdf/inc/cdf_defer.h
index fa527f3b3dbc..829f350f6023 100644
--- a/core/cdf/inc/cdf_defer.h
+++ b/core/cdf/inc/cdf_defer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -96,7 +96,6 @@ static inline void cdf_destroy_bh(cdf_handle_t hdl, cdf_bh_t *bh)
 /**
  * cdf_create_work() - create a work/task queue, This runs in non-interrupt
  *		       context, so can be preempted by H/W & S/W intr
- * @hdl:	OS handle
  * @work:	Work instance
  * @func:	Deferred function to run at bottom half non-interrupt
  *		context
@@ -105,34 +104,20 @@ static inline void cdf_destroy_bh(cdf_handle_t hdl, cdf_bh_t *bh)
  * Return: None
  */
 static inline void
-cdf_create_work(cdf_handle_t hdl, cdf_work_t *work,
+cdf_create_work(cdf_work_t *work,
 		cdf_defer_fn_t func, void *arg)
 {
-	__cdf_init_work(hdl, work, func, arg);
+	__cdf_init_work(work, func, arg);
 }
 
 /**
  * cdf_sched_work() - schedule a deferred task on non-interrupt context
- * @hdl:	OS handle
- * @work:	Work instance
- *
- * Return: None
- */
-static inline void cdf_sched_work(cdf_handle_t hdl, cdf_work_t *work)
-{
-	__cdf_sched_work(hdl, work);
-}
-
-/**
- * cdf_destroy_work() -  destroy the deferred task (synchronous)
- * @hdl:	OS handle
  * @work:	Work instance
  *
  * Return: None
  */
-static inline void cdf_destroy_work(cdf_handle_t hdl, cdf_work_t *work)
+static inline void cdf_schedule_work(cdf_work_t *work)
 {
-	__cdf_disable_work(hdl, work);
+	__cdf_schedule_work(work);
 }
-
 #endif /*__CDF_DEFER_H*/
diff --git a/core/cdf/inc/cdf_lock.h b/core/cdf/inc/cdf_lock.h
index 82fd160959c3..83a5c4164e01 100644
--- a/core/cdf/inc/cdf_lock.h
+++ b/core/cdf/inc/cdf_lock.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -262,6 +262,16 @@ CDF_STATUS cdf_wake_lock_release(cdf_wake_lock_t *pLock, uint32_t reason);
  */
 CDF_STATUS cdf_wake_lock_destroy(cdf_wake_lock_t *pLock);
 
+struct hif_pm_runtime_lock;
+typedef struct hif_pm_runtime_lock *cdf_runtime_lock_t;
+
+CDF_STATUS cdf_runtime_pm_get(void);
+CDF_STATUS cdf_runtime_pm_put(void);
+CDF_STATUS cdf_runtime_pm_prevent_suspend(cdf_runtime_lock_t lock);
+CDF_STATUS cdf_runtime_pm_allow_suspend(cdf_runtime_lock_t lock);
+cdf_runtime_lock_t cdf_runtime_lock_init(const char *name);
+void cdf_runtime_lock_deinit(cdf_runtime_lock_t lock);
+
 /**
  * cdf_spinlock_acquire() - acquires a spin lock
  * @lock:	Spin lock to acquire
diff --git a/core/cdf/inc/cdf_types.h b/core/cdf/inc/cdf_types.h
index 27151417bd03..cdc16edb8125 100644
--- a/core/cdf/inc/cdf_types.h
+++ b/core/cdf/inc/cdf_types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -266,7 +266,7 @@ typedef enum {
 #define cdf_snprint       __cdf_snprint
 
 /**
- * typedef enum tCDF_CON_MODE - Concurrency role.
+ * enum tCDF_ADAPTER_MODE - adapter role.
  *
  * @CDF_STA_MODE: STA mode
  * @CDF_SAP_MODE: SAP mode
@@ -282,18 +282,35 @@ typedef enum {
  * These are generic IDs that identify the various roles
  * in the software system
  */
-typedef enum {
+enum tCDF_ADAPTER_MODE {
 	CDF_STA_MODE = 0,
 	CDF_SAP_MODE = 1,
 	CDF_P2P_CLIENT_MODE,
 	CDF_P2P_GO_MODE,
-	CDF_FTM_MODE = 5,
+	CDF_FTM_MODE,
 	CDF_IBSS_MODE,
 	CDF_P2P_DEVICE_MODE,
 	CDF_EPPING_MODE,
 	CDF_OCB_MODE,
 	CDF_MAX_NO_OF_MODE
-} tCDF_CON_MODE;
+};
+
+/**
+ * enum tCDF_GLOBAL_CON_MODE - global config mode when
+ * driver is loaded.
+ *
+ * @CDF_GLOBAL_MISSION_MODE: mission mode (STA, SAP...)
+ * @CDF_GLOBAL_FTM_MODE: FTM mode
+ * @CDF_GLOBAL_EPPING_MODE: EPPING mode
+ * @CDF_GLOBAL_MAX_MODE: Max place holder
+ */
+enum tCDF_GLOBAL_CON_MODE {
+	CDF_GLOBAL_MISSION_MODE,
+	CDF_GLOBAL_FTM_MODE = 5,
+	CDF_GLOBAL_EPPING_MODE = 8,
+	CDF_GLOBAL_MAX_MODE
+};
+
 
 #ifdef WLAN_OPEN_P2P_INTERFACE
 /* This should match with WLAN_MAX_INTERFACES */
@@ -353,6 +370,7 @@ struct cdf_mac_addr {
 #define CDF_MAC_ADDR_ZERO_INITIALIZER { { 0, 0, 0, 0, 0, 0 } }
 
 #define CDF_IPV4_ADDR_SIZE (4)
+#define CDF_IPV6_ADDR_SIZE (16)
 
 /**
  * struct cdf_tso_frag_t - fragments of a single TCP segment
@@ -490,4 +508,14 @@ struct cdf_tso_info_t {
  */
 #define CDF_CE_TX_PKT_OFFSET_BIT_M	0x0fff0000
 
+/**
+ * enum cdf_suspend_type - type of suspend
+ * CDF_SYSTEM_SUSPEND: System suspend triggered wlan suspend
+ * CDF_RUNTIME_SUSPEND: Runtime pm inactivity timer triggered wlan suspend
+ */
+enum cdf_suspend_type {
+	CDF_SYSTEM_SUSPEND,
+	CDF_RUNTIME_SUSPEND
+};
+
 #endif /* if !defined __CDF_TYPES_H */
diff --git a/core/cdf/inc/cdf_util.h b/core/cdf/inc/cdf_util.h
index 7d9e16a60c03..537b1fd41b3a 100644
--- a/core/cdf/inc/cdf_util.h
+++ b/core/cdf/inc/cdf_util.h
@@ -140,7 +140,7 @@ CDF_INLINE_FN bool cdf_is_macaddr_equal(struct cdf_mac_addr *pMacAddr1,
  *
  *
  * Return:  true if the MacAddress is all Zeros
- *	flase if the MacAddress is not all Zeros.
+ *	false if the MacAddress is not all Zeros.
  *
  */
 CDF_INLINE_FN bool cdf_is_macaddr_zero(struct cdf_mac_addr *pMacAddr)
diff --git a/core/cdf/src/cdf_lock.c b/core/cdf/src/cdf_lock.c
index 283cd510cd05..b57363327a92 100644
--- a/core/cdf/src/cdf_lock.c
+++ b/core/cdf/src/cdf_lock.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -46,6 +46,7 @@
 #include "i_host_diag_core_event.h"
 #include "cds_api.h"
 #include "ani_global.h"
+#include "hif.h"
 
 /* Preprocessor Definitions and Constants */
 #define LINUX_LOCK_COOKIE 0x12345678
@@ -489,3 +490,158 @@ CDF_STATUS cdf_wake_lock_destroy(cdf_wake_lock_t *pLock)
 #endif
 	return CDF_STATUS_SUCCESS;
 }
+
+/**
+ * cdf_runtime_pm_get() - do a get opperation on the device
+ *
+ * A get opperation will prevent a runtime suspend untill a
+ * corresponding put is done.  This api should be used when sending
+ * data.
+ *
+ * CONTRARY TO THE REGULAR RUNTIME PM, WHEN THE BUS IS SUSPENDED,
+ * THIS API WILL ONLY REQUEST THE RESUME AND NOT TO A GET!!!
+ *
+ * return: success if the bus is up and a get has been issued
+ *   otherwise an error code.
+ */
+CDF_STATUS cdf_runtime_pm_get(void)
+{
+	void *ol_sc;
+	int ret;
+
+	ol_sc = cds_get_context(CDF_MODULE_ID_HIF);
+
+	if (ol_sc == NULL) {
+		CDF_ASSERT(0);
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
+				"%s: HIF context is null!", __func__);
+		return CDF_STATUS_E_INVAL;
+	}
+
+	ret = hif_pm_runtime_get(ol_sc);
+
+	if (ret)
+		return CDF_STATUS_E_FAILURE;
+
+	return CDF_STATUS_SUCCESS;
+}
+
+/**
+ * cdf_runtime_pm_put() - do a put opperation on the device
+ *
+ * A put opperation will allow a runtime suspend after a corresponding
+ * get was done.  This api should be used when sending data.
+ *
+ * This api will return a failure if the hif module hasn't been initialized
+ *
+ * return: CDF_STATUS_SUCCESS if the put is performed
+ */
+CDF_STATUS cdf_runtime_pm_put(void)
+{
+	void *ol_sc;
+	int ret;
+
+	ol_sc = cds_get_context(CDF_MODULE_ID_HIF);
+
+	if (ol_sc == NULL) {
+		CDF_ASSERT(0);
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
+				"%s: HIF context is null!", __func__);
+		return CDF_STATUS_E_INVAL;
+	}
+
+	ret = hif_pm_runtime_put(ol_sc);
+
+	if (ret)
+		return CDF_STATUS_E_FAILURE;
+
+	return CDF_STATUS_SUCCESS;
+}
+
+/**
+ * cdf_runtime_pm_prevent_suspend() - prevent a runtime bus suspend
+ * @lock: an opaque context for tracking
+ *
+ * The lock can only be acquired once per lock context and is tracked.
+ *
+ * return: CDF_STATUS_SUCCESS or failure code.
+ */
+CDF_STATUS cdf_runtime_pm_prevent_suspend(cdf_runtime_lock_t lock)
+{
+	void *ol_sc;
+	int ret;
+
+	ol_sc = cds_get_context(CDF_MODULE_ID_HIF);
+
+	if (ol_sc == NULL) {
+		CDF_ASSERT(0);
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
+				"%s: HIF context is null!", __func__);
+		return CDF_STATUS_E_INVAL;
+	}
+
+	ret = hif_pm_runtime_prevent_suspend(ol_sc, lock);
+
+	if (ret)
+		return CDF_STATUS_E_FAILURE;
+
+	return CDF_STATUS_SUCCESS;
+}
+
+/**
+ * cdf_runtime_pm_prevent_suspend() - prevent a runtime bus suspend
+ * @lock: an opaque context for tracking
+ *
+ * The lock can only be acquired once per lock context and is tracked.
+ *
+ * return: CDF_STATUS_SUCCESS or failure code.
+ */
+CDF_STATUS cdf_runtime_pm_allow_suspend(cdf_runtime_lock_t lock)
+{
+	void *ol_sc;
+	int ret;
+
+	ol_sc = cds_get_context(CDF_MODULE_ID_HIF);
+
+	if (ol_sc == NULL) {
+		CDF_ASSERT(0);
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
+				"%s: HIF context is null!", __func__);
+		return CDF_STATUS_E_INVAL;
+	}
+
+	ret = hif_pm_runtime_allow_suspend(ol_sc, lock);
+
+	if (ret)
+		return CDF_STATUS_E_FAILURE;
+
+	return CDF_STATUS_SUCCESS;
+}
+
+/**
+ * cdf_runtime_lock_init() - initialize runtime lock
+ * @name: name of the runtime lock
+ *
+ * Initialize a runtime pm lock.  This lock can be used
+ * to prevent the runtime pm system from putting the bus
+ * to sleep.
+ *
+ * Return: runtime_pm_lock_t
+ */
+cdf_runtime_lock_t cdf_runtime_lock_init(const char *name)
+{
+	return hif_runtime_lock_init(name);
+}
+
+/**
+ * cdf_runtime_lock_deinit() - deinitialize runtime pm lock
+ * @lock: the lock to deinitialize
+ *
+ * Ensures the lock is released. Frees the runtime lock.
+ *
+ * Return: void
+ */
+void cdf_runtime_lock_deinit(cdf_runtime_lock_t lock)
+{
+	hif_runtime_lock_deinit(lock);
+}
diff --git a/core/cdf/src/cdf_mc_timer.c b/core/cdf/src/cdf_mc_timer.c
index 0edc8f3d54d1..896e75fa8ab5 100644
--- a/core/cdf/src/cdf_mc_timer.c
+++ b/core/cdf/src/cdf_mc_timer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -247,7 +247,6 @@ static void cdf_timer_clean(void);
  */
 void cdf_mc_timer_manager_init(void)
 {
-	/* Initalizing the list with maximum size of 60000 */
 	cdf_list_init(&cdf_timer_list, 1000);
 	cdf_spinlock_init(&cdf_timer_list_lock);
 	return;
diff --git a/core/cdf/src/cdf_memory.c b/core/cdf/src/cdf_memory.c
index 71dd46181d40..874f5fb7a8fe 100644
--- a/core/cdf/src/cdf_memory.c
+++ b/core/cdf/src/cdf_memory.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -36,6 +36,7 @@
 #include "cdf_nbuf.h"
 #include "cdf_trace.h"
 #include "cdf_lock.h"
+#include "cdf_mc_timer.h"
 
 #if defined(CONFIG_CNSS)
 #include <net/cnss.h>
@@ -47,6 +48,7 @@
 
 #ifdef MEMORY_DEBUG
 #include <cdf_list.h>
+#include <linux/stacktrace.h>
 
 cdf_list_t cdf_mem_list;
 cdf_spinlock_t cdf_mem_list_lock;
@@ -56,16 +58,23 @@ static uint8_t WLAN_MEM_HEADER[] = { 0x61, 0x62, 0x63, 0x64, 0x65, 0x66,
 static uint8_t WLAN_MEM_TAIL[] = { 0x80, 0x81, 0x82, 0x83, 0x84, 0x85,
 					0x86, 0x87 };
 
+#define CDF_MEM_MAX_STACK_TRACE 16
+
 struct s_cdf_mem_struct {
 	cdf_list_node_t pNode;
 	char *fileName;
 	unsigned int lineNum;
 	unsigned int size;
+#ifdef WLAN_OPEN_SOURCE
+	unsigned long stack_trace[CDF_MEM_MAX_STACK_TRACE];
+	struct stack_trace trace;
+#endif
 	uint8_t header[8];
 };
 #endif
 
 /* Preprocessor Definitions and Constants */
+#define CDF_GET_MEMORY_TIME_THRESHOLD 3000
 
 /* Type Declarations */
 
@@ -73,6 +82,51 @@ struct s_cdf_mem_struct {
 
 /* External Function implementation */
 #ifdef MEMORY_DEBUG
+#ifdef WLAN_OPEN_SOURCE
+/**
+ * cdf_mem_save_stack_trace() - Save stack trace of the caller
+ * @mem_struct: Pointer to the memory structure where to save the stack trace
+ *
+ * Return: None
+ */
+static inline void cdf_mem_save_stack_trace(struct s_cdf_mem_struct *mem_struct)
+{
+	struct stack_trace *trace = &mem_struct->trace;
+
+	trace->nr_entries = 0;
+	trace->max_entries = CDF_MEM_MAX_STACK_TRACE;
+	trace->entries = mem_struct->stack_trace;
+	trace->skip = 2;
+
+	save_stack_trace(trace);
+}
+
+/**
+ * cdf_mem_print_stack_trace() - Print saved stack trace
+ * @mem_struct: Pointer to the memory structure which has the saved stack trace
+ *              to be printed
+ *
+ * Return: None
+ */
+static inline void cdf_mem_print_stack_trace(struct s_cdf_mem_struct
+					     *mem_struct)
+{
+	CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_FATAL,
+		  "Call stack for the source of leaked memory:");
+
+	print_stack_trace(&mem_struct->trace, 1);
+}
+#else
+static inline void cdf_mem_save_stack_trace(struct s_cdf_mem_struct *mem_struct)
+{
+
+}
+static inline void cdf_mem_print_stack_trace(struct s_cdf_mem_struct
+					     *mem_struct)
+{
+
+}
+#endif
 
 /**
  * cdf_mem_init() - initialize cdf memory debug functionality
@@ -142,6 +196,7 @@ void cdf_mem_clean(void)
 					mleak_cnt = 0;
 				}
 				mleak_cnt++;
+				cdf_mem_print_stack_trace(memStruct);
 				kfree((void *)memStruct);
 			}
 		} while (cdf_status == CDF_STATUS_SUCCESS);
@@ -194,6 +249,7 @@ void *cdf_mem_malloc_debug(size_t size, char *fileName, uint32_t lineNum)
 	void *memPtr = NULL;
 	uint32_t new_size;
 	int flags = GFP_KERNEL;
+	unsigned long  time_before_kzalloc;
 
 	if (size > (1024 * 1024) || size == 0) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
@@ -217,8 +273,19 @@ void *cdf_mem_malloc_debug(size_t size, char *fileName, uint32_t lineNum)
 		flags = GFP_ATOMIC;
 
 	new_size = size + sizeof(struct s_cdf_mem_struct) + 8;
-
+	time_before_kzalloc = cdf_mc_timer_get_system_time();
 	memStruct = (struct s_cdf_mem_struct *)kzalloc(new_size, flags);
+	/**
+	 * If time taken by kmalloc is greater than
+	 * CDF_GET_MEMORY_TIME_THRESHOLD msec
+	 */
+	if (cdf_mc_timer_get_system_time() - time_before_kzalloc >=
+					  CDF_GET_MEMORY_TIME_THRESHOLD)
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
+			 "%s: kzalloc took %lu msec for size %zu called from %pS at line %d",
+			 __func__,
+			 cdf_mc_timer_get_system_time() - time_before_kzalloc,
+			 size, (void *)_RET_IP_, lineNum);
 
 	if (memStruct != NULL) {
 		CDF_STATUS cdf_status;
@@ -226,6 +293,7 @@ void *cdf_mem_malloc_debug(size_t size, char *fileName, uint32_t lineNum)
 		memStruct->fileName = fileName;
 		memStruct->lineNum = lineNum;
 		memStruct->size = size;
+		cdf_mem_save_stack_trace(memStruct);
 
 		cdf_mem_copy(&memStruct->header[0],
 			     &WLAN_MEM_HEADER[0], sizeof(WLAN_MEM_HEADER));
@@ -324,9 +392,9 @@ void cdf_mem_free(void *ptr)
 void *cdf_mem_malloc(size_t size)
 {
 	int flags = GFP_KERNEL;
-#ifdef CONFIG_WCNSS_MEM_PRE_ALLOC
-	void *pmem;
-#endif
+	void *memPtr = NULL;
+	unsigned long  time_before_kzalloc;
+
 	if (size > (1024 * 1024) || size == 0) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 			  "%s: called with invalid arg; passed in %zu !!",
@@ -336,6 +404,7 @@ void *cdf_mem_malloc(size_t size)
 
 #if defined(CONFIG_CNSS) && defined(CONFIG_WCNSS_MEM_PRE_ALLOC)
 	if (size > WCNSS_PRE_ALLOC_GET_THRESHOLD) {
+		void *pmem;
 		pmem = wcnss_prealloc_get(size);
 		if (NULL != pmem) {
 			memset(pmem, 0, size);
@@ -346,8 +415,20 @@ void *cdf_mem_malloc(size_t size)
 
 	if (in_interrupt() || irqs_disabled() || in_atomic())
 		flags = GFP_ATOMIC;
-
-	return kzalloc(size, flags);
+	time_before_kzalloc = cdf_mc_timer_get_system_time();
+	memPtr = kzalloc(size, flags);
+	/**
+	 * If time taken by kmalloc is greater than
+	 * CDF_GET_MEMORY_TIME_THRESHOLD msec
+	 */
+	if (cdf_mc_timer_get_system_time() - time_before_kzalloc >=
+					   CDF_GET_MEMORY_TIME_THRESHOLD)
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
+			 "%s: kzalloc took %lu msec for size %zu called from %pS",
+			 __func__,
+			 cdf_mc_timer_get_system_time() - time_before_kzalloc,
+			 size, (void *)_RET_IP_);
+	return memPtr;
 }
 
 /**
diff --git a/core/cdf/src/i_cdf_atomic.h b/core/cdf/src/i_cdf_atomic.h
index f74b7dfd47c7..178c3275b490 100644
--- a/core/cdf/src/i_cdf_atomic.h
+++ b/core/cdf/src/i_cdf_atomic.h
@@ -40,7 +40,7 @@ static inline CDF_STATUS __cdf_atomic_init(__cdf_atomic_t *v)
 	return CDF_STATUS_SUCCESS;
 }
 
-static inline uint32_t __cdf_atomic_read(__cdf_atomic_t *v)
+static inline int32_t __cdf_atomic_read(__cdf_atomic_t *v)
 {
 	return atomic_read(v);
 }
@@ -60,7 +60,19 @@ static inline void __cdf_atomic_add(int i, __cdf_atomic_t *v)
 	atomic_add(i, v);
 }
 
-static inline uint32_t __cdf_atomic_dec_and_test(__cdf_atomic_t *v)
+/**
+ * cdf_atomic_sub() - Subtract a value from an atomic variable
+ * @i: the amount by which to decrease the atomic counter
+ * @v: a pointer to an opaque atomic variable
+ *
+ * Return: none
+ */
+static inline void __cdf_atomic_sub(int i, __cdf_atomic_t *v)
+{
+	atomic_sub(i, v);
+}
+
+static inline int32_t __cdf_atomic_dec_and_test(__cdf_atomic_t *v)
 {
 	return atomic_dec_and_test(v);
 }
@@ -70,7 +82,7 @@ static inline void __cdf_atomic_set(__cdf_atomic_t *v, int i)
 	atomic_set(v, i);
 }
 
-static inline uint32_t __cdf_atomic_inc_return(__cdf_atomic_t *v)
+static inline int32_t __cdf_atomic_inc_return(__cdf_atomic_t *v)
 {
 	return atomic_inc_return(v);
 }
diff --git a/core/cdf/src/i_cdf_defer.h b/core/cdf/src/i_cdf_defer.h
index fc9bd7796eae..a21b618f5434 100644
--- a/core/cdf/src/i_cdf_defer.h
+++ b/core/cdf/src/i_cdf_defer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -52,8 +52,7 @@ typedef struct {
 extern void __cdf_defer_func(struct work_struct *work);
 
 static inline CDF_STATUS
-__cdf_init_work(cdf_handle_t hdl,
-		__cdf_work_t *work, cdf_defer_fn_t func, void *arg)
+__cdf_init_work(__cdf_work_t *work, cdf_defer_fn_t func, void *arg)
 {
 	/*Initilize func and argument in work struct */
 	work->fn = func;
@@ -66,18 +65,12 @@ __cdf_init_work(cdf_handle_t hdl,
 	return CDF_STATUS_SUCCESS;
 }
 
-static inline CDF_STATUS __cdf_sched_work(cdf_handle_t hdl, __cdf_work_t *work)
+static inline CDF_STATUS __cdf_schedule_work(__cdf_work_t *work)
 {
 	schedule_work(&work->work);
 	return CDF_STATUS_SUCCESS;
 }
 
-static inline CDF_STATUS
-__cdf_disable_work(cdf_handle_t hdl, __cdf_work_t *work)
-{
-	return CDF_STATUS_SUCCESS;
-}
-
 static inline CDF_STATUS __cdf_init_bh(cdf_handle_t hdl,
 				       struct tasklet_struct *bh,
 				       cdf_defer_fn_t func, void *arg)
diff --git a/core/cds/inc/cds_api.h b/core/cds/inc/cds_api.h
index cb30c6eb0e2b..c88218f8f766 100644
--- a/core/cds/inc/cds_api.h
+++ b/core/cds/inc/cds_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -55,13 +55,139 @@
  */
 #define CDS_WMA_TIMEOUT  (15000)
 
-CDF_STATUS cds_alloc_global_context(v_CONTEXT_t *p_cds_context);
+/**
+ * enum cds_driver_state - Driver state
+ * @CDS_DRIVER_STATE_UNINITIALIZED: Driver is in uninitialized state.
+ * CDS_DRIVER_STATE_LOADED: Driver is loaded and functional.
+ * CDS_DRIVER_STATE_LOADING: Driver probe is in progress.
+ * CDS_DRIVER_STATE_UNLOADING: Driver remove is in progress.
+ * CDS_DRIVER_STATE_RECOVERING: Recovery in progress.
+ */
+enum cds_driver_state {
+	CDS_DRIVER_STATE_UNINITIALIZED	= 0,
+	CDS_DRIVER_STATE_LOADED		= BIT(0),
+	CDS_DRIVER_STATE_LOADING	= BIT(1),
+	CDS_DRIVER_STATE_UNLOADING	= BIT(2),
+	CDS_DRIVER_STATE_RECOVERING	= BIT(3),
+};
+
+#define __CDS_IS_DRIVER_STATE(_state, _mask) (((_state) & (_mask)) == (_mask))
+
+void cds_set_driver_state(enum cds_driver_state);
+void cds_clear_driver_state(enum cds_driver_state);
+enum cds_driver_state cds_get_driver_state(void);
+
+/**
+ * cds_is_driver_loading() - Is driver load in progress
+ *
+ * Return: true if driver is loading and false otherwise.
+ */
+static inline bool cds_is_driver_loading(void)
+{
+	enum cds_driver_state state = cds_get_driver_state();
+
+	return __CDS_IS_DRIVER_STATE(state, CDS_DRIVER_STATE_LOADING);
+}
+
+/**
+ * cds_is_driver_unloading() - Is driver unload in progress
+ *
+ * Return: true if driver is unloading and false otherwise.
+ */
+static inline bool cds_is_driver_unloading(void)
+{
+	enum cds_driver_state state = cds_get_driver_state();
+
+	return __CDS_IS_DRIVER_STATE(state, CDS_DRIVER_STATE_UNLOADING);
+}
 
-CDF_STATUS cds_free_global_context(v_CONTEXT_t *p_cds_context);
+/**
+ * cds_is_driver_recovering() - Is recovery in progress
+ *
+ * Return: true if recovery in progress  and false otherwise.
+ */
+static inline bool cds_is_driver_recovering(void)
+{
+	enum cds_driver_state state = cds_get_driver_state();
+
+	return __CDS_IS_DRIVER_STATE(state, CDS_DRIVER_STATE_RECOVERING);
+}
+
+/**
+ * cds_is_load_or_unload_in_progress() - Is driver load OR unload in progress
+ *
+ * Return: true if driver is loading OR unloading and false otherwise.
+ */
+static inline bool cds_is_load_or_unload_in_progress(void)
+{
+	enum cds_driver_state state = cds_get_driver_state();
+
+	return __CDS_IS_DRIVER_STATE(state, CDS_DRIVER_STATE_LOADING) ||
+		__CDS_IS_DRIVER_STATE(state, CDS_DRIVER_STATE_UNLOADING);
+}
+
+/**
+ * cds_set_recovery_in_progress() - Set recovery in progress
+ * @value: value to set
+ *
+ * Return: none
+ */
+static inline void cds_set_recovery_in_progress(uint8_t value)
+{
+	if (value)
+		cds_set_driver_state(CDS_DRIVER_STATE_RECOVERING);
+	else
+		cds_clear_driver_state(CDS_DRIVER_STATE_RECOVERING);
+}
+
+/**
+ * cds_set_load_in_progress() - Set load in progress
+ * @value: value to set
+ *
+ * Return: none
+ */
+static inline void cds_set_load_in_progress(uint8_t value)
+{
+	if (value)
+		cds_set_driver_state(CDS_DRIVER_STATE_LOADING);
+	else
+		cds_clear_driver_state(CDS_DRIVER_STATE_LOADING);
+}
+
+/**
+ * cds_set_driver_loaded() - Set load completed
+ * @value: value to set
+ *
+ * Return: none
+ */
+static inline void cds_set_driver_loaded(uint8_t value)
+{
+	if (value)
+		cds_set_driver_state(CDS_DRIVER_STATE_LOADED);
+	else
+		cds_clear_driver_state(CDS_DRIVER_STATE_LOADED);
+}
+
+/**
+ * cds_set_unload_in_progress() - Set unload in progress
+ * @value: value to set
+ *
+ * Return: none
+ */
+static inline void cds_set_unload_in_progress(uint8_t value)
+{
+	if (value)
+		cds_set_driver_state(CDS_DRIVER_STATE_UNLOADING);
+	else
+		cds_clear_driver_state(CDS_DRIVER_STATE_UNLOADING);
+}
+
+v_CONTEXT_t cds_init(void);
+void cds_deinit(void);
 
 CDF_STATUS cds_pre_enable(v_CONTEXT_t cds_context);
 
-CDF_STATUS cds_open(v_CONTEXT_t *p_cds_context, uint32_t hddContextSize);
+CDF_STATUS cds_open(void);
 
 CDF_STATUS cds_enable(v_CONTEXT_t cds_context);
 
@@ -77,21 +203,13 @@ void *cds_get_context(CDF_MODULE_ID moduleId);
 
 v_CONTEXT_t cds_get_global_context(void);
 
-uint8_t cds_is_logp_in_progress(void);
-void cds_set_logp_in_progress(uint8_t value);
-
-uint8_t cds_is_load_unload_in_progress(void);
-uint8_t cds_is_unload_in_progress(void);
-
-void cds_set_load_unload_in_progress(uint8_t value);
-
 CDF_STATUS cds_alloc_context(void *p_cds_context, CDF_MODULE_ID moduleID,
 			     void **ppModuleContext, uint32_t size);
 
 CDF_STATUS cds_free_context(void *p_cds_context, CDF_MODULE_ID moduleID,
 			    void *pModuleContext);
 
-CDF_STATUS cds_get_vdev_types(tCDF_CON_MODE mode, uint32_t *type,
+CDF_STATUS cds_get_vdev_types(enum tCDF_ADAPTER_MODE mode, uint32_t *type,
 			      uint32_t *subType);
 
 void cds_flush_work(void *work);
diff --git a/core/cds/inc/cds_concurrency.h b/core/cds/inc/cds_concurrency.h
index 261b97460d3d..7ac1a0736f98 100644
--- a/core/cds/inc/cds_concurrency.h
+++ b/core/cds/inc/cds_concurrency.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -463,138 +463,30 @@ struct cds_conc_connection_info {
 	bool          in_use;
 };
 
-bool cds_is_connection_in_progress(hdd_context_t *hdd_ctx);
-void cds_dump_concurrency_info(hdd_context_t *pHddCtx);
-void cds_set_concurrency_mode(hdd_context_t *pHddCtx, tCDF_CON_MODE mode);
-void cds_clear_concurrency_mode(hdd_context_t *pHddCtx,
-				     tCDF_CON_MODE mode);
-uint32_t cds_get_connection_count(hdd_context_t *hdd_ctx);
-/**
- * cds_is_sta_connection_pending() - This function will check if sta connection
- *                                   is pending or not.
- * @hdd_ctx: pointer to hdd context
- *
- * This function will return the status of flag is_sta_connection_pending
- *
- * Return: true or false
- */
-static inline bool
-cds_is_sta_connection_pending(hdd_context_t *hdd_ctx)
-{
-	bool status;
-	spin_lock(&hdd_ctx->sta_update_info_lock);
-	status = hdd_ctx->is_sta_connection_pending;
-	spin_unlock(&hdd_ctx->sta_update_info_lock);
-	return status;
-}
-
-/**
- * cds_change_sta_conn_pending_status() - This function will change the value
- *                                        of is_sta_connection_pending
- * @hdd_ctx: pointer to hdd context
- * @value: value to set
- *
- * This function will change the value of is_sta_connection_pending
- *
- * Return: none
- */
-static inline void
-cds_change_sta_conn_pending_status(hdd_context_t *hdd_ctx,
-		bool value)
-{
-	spin_lock(&hdd_ctx->sta_update_info_lock);
-	hdd_ctx->is_sta_connection_pending = value;
-	spin_unlock(&hdd_ctx->sta_update_info_lock);
-}
-
-/**
- * cds_is_sap_restart_required() - This function will check if sap restart
- *                                 is pending or not.
- * @hdd_ctx: pointer to hdd context.
- *
- * This function will return the status of flag is_sap_restart_required.
- *
- * Return: true or false
- */
-static inline bool
-cds_is_sap_restart_required(hdd_context_t *hdd_ctx)
-{
-	bool status;
-	spin_lock(&hdd_ctx->sap_update_info_lock);
-	status = hdd_ctx->is_sap_restart_required;
-	spin_unlock(&hdd_ctx->sap_update_info_lock);
-	return status;
-}
-
-/**
- * cds_change_sap_restart_required_status() - This function will change the
- *                                            value of is_sap_restart_required
- * @hdd_ctx: pointer to hdd context
- * @value: value to set
- *
- * This function will change the value of is_sap_restart_required
- *
- * Return: none
- */
-static inline void
-cds_change_sap_restart_required_status(hdd_context_t *hdd_ctx,
-		bool value)
-{
-	spin_lock(&hdd_ctx->sap_update_info_lock);
-	hdd_ctx->is_sap_restart_required = value;
-	spin_unlock(&hdd_ctx->sap_update_info_lock);
-}
-
-/**
- * cds_set_connection_in_progress() - to set the connection in progress flag
- * @hdd_ctx: pointer to hdd context
- * @value: value to set
- *
- * This function will set the passed value to connection in progress flag.
- * If value is previously being set to true then no need to set it again.
- *
- * Return: true if value is being set correctly and false otherwise.
- */
-static inline bool
-cds_set_connection_in_progress(hdd_context_t *hdd_ctx,
-		bool value)
-{
-	bool status = true;
-	spin_lock(&hdd_ctx->connection_status_lock);
-	/*
-	 * if the value is set to true previously and if someone is
-	 * trying to make it true again then it could be some race
-	 * condition being triggered. Avoid this situation by returning
-	 * false
-	 */
-	if (hdd_ctx->connection_in_progress && value)
-		status = false;
-	else
-		hdd_ctx->connection_in_progress = value;
-	spin_unlock(&hdd_ctx->connection_status_lock);
-	return status;
-}
-
-
+bool cds_is_connection_in_progress(void);
+void cds_dump_concurrency_info(void);
+void cds_set_concurrency_mode(enum tCDF_ADAPTER_MODE mode);
+void cds_clear_concurrency_mode(enum tCDF_ADAPTER_MODE mode);
+uint32_t cds_get_connection_count(void);
+bool cds_is_sta_connection_pending(void);
+void cds_change_sta_conn_pending_status(bool value);
+void cds_change_sap_restart_required_status(bool value);
+bool cds_set_connection_in_progress(bool value);
 int cds_cfg80211_get_concurrency_matrix(struct wiphy *wiphy,
 			struct wireless_dev *wdev,
 			const void *data,
 			int data_len);
 uint32_t cds_get_concurrency_mode(void);
-CDF_STATUS cds_check_and_restart_sap(hdd_context_t *hdd_ctx,
-		eCsrRoamResult roam_result,
+CDF_STATUS cds_check_and_restart_sap(eCsrRoamResult roam_result,
 		hdd_station_ctx_t *hdd_sta_ctx);
-void cds_handle_conc_rule1(hdd_context_t *hdd_ctx,
-		hdd_adapter_t *adapter,
+void cds_handle_conc_rule1(hdd_adapter_t *adapter,
 		tCsrRoamProfile *roam_profile);
 #ifdef FEATURE_WLAN_CH_AVOID
-bool cds_handle_conc_rule2(hdd_context_t *hdd_ctx,
-		hdd_adapter_t *adapter,
+bool cds_handle_conc_rule2(hdd_adapter_t *adapter,
 		tCsrRoamProfile *roam_profile,
 		uint32_t *roam_id);
 #else
-static inline bool cds_handle_conc_rule2(hdd_context_t *hdd_ctx,
-		hdd_adapter_t *adapter,
+static inline bool cds_handle_conc_rule2(hdd_adapter_t *adapter,
 		tCsrRoamProfile *roam_profile,
 		uint32_t *roam_id)
 {
@@ -607,10 +499,11 @@ bool cds_check_for_session_conc(uint8_t session_id, uint8_t channel);
 CDF_STATUS cds_handle_conc_multiport(uint8_t session_id, uint8_t channel);
 
 #ifdef FEATURE_WLAN_FORCE_SAP_SCC
-void cds_force_sap_on_scc(hdd_context_t *hdd_ctx, eCsrRoamResult roam_result);
+void cds_force_sap_on_scc(eCsrRoamResult roam_result,
+		uint8_t channel_id);
 #else
-static inline void cds_force_sap_on_scc(hdd_context_t *hdd_ctx,
-		eCsrRoamResult roam_result)
+static inline void cds_force_sap_on_scc(eCsrRoamResult roam_result,
+				uint8_t channel_id)
 {
 
 }
@@ -618,19 +511,17 @@ static inline void cds_force_sap_on_scc(hdd_context_t *hdd_ctx,
 
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
 void cds_check_concurrent_intf_and_restart_sap(
-		hdd_context_t *hdd_ctx,
 		hdd_station_ctx_t *hdd_sta_ctx,
 		hdd_adapter_t *adapter);
 #else
 static inline void cds_check_concurrent_intf_and_restart_sap(
-		hdd_context_t *hdd_ctx,
 		hdd_station_ctx_t *hdd_sta_ctx,
 		hdd_adapter_t *adapter)
 {
 
 }
 #endif /* FEATURE_WLAN_MCC_TO_SCC_SWITCH */
-uint8_t cds_is_mcc_in_24G(hdd_context_t *hdd_ctx);
+uint8_t cds_is_mcc_in_24G(void);
 int32_t cds_set_mas(hdd_adapter_t *adapter, uint8_t mas_value);
 int cds_set_mcc_p2p_quota(hdd_adapter_t *hostapd_adapter,
 		uint32_t set_value);
@@ -651,58 +542,48 @@ static inline void cds_restart_sap(hdd_adapter_t *ap_adapter)
 	*/
 
 #ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
-void cds_check_and_restart_sap_with_non_dfs_acs(hdd_context_t *hdd_ctx);
+void cds_check_and_restart_sap_with_non_dfs_acs(void);
 #else
-static inline void cds_check_and_restart_sap_with_non_dfs_acs(
-							hdd_context_t *hdd_ctx)
+static inline void cds_check_and_restart_sap_with_non_dfs_acs(void)
 {
 
 }
 #endif /* FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE */
-void cds_incr_active_session(hdd_context_t *pHddCtx, tCDF_CON_MODE mode,
+void cds_incr_active_session(enum tCDF_ADAPTER_MODE mode,
 				uint8_t sessionId);
-void cds_decr_active_session(hdd_context_t *pHddCtx, tCDF_CON_MODE mode,
+void cds_decr_active_session(enum tCDF_ADAPTER_MODE mode,
 				uint8_t sessionId);
-void cds_decr_session_set_pcl(hdd_context_t *hdd_ctx,
-		tCDF_CON_MODE mode,
+void cds_decr_session_set_pcl(enum tCDF_ADAPTER_MODE mode,
 		uint8_t session_id);
-CDF_STATUS cds_init_policy_mgr(hdd_context_t *hdd_ctx);
-CDF_STATUS cds_get_pcl(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
+CDF_STATUS cds_init_policy_mgr(void);
+CDF_STATUS cds_deinit_policy_mgr(void);
+CDF_STATUS cds_get_pcl(enum cds_con_mode mode,
 				uint8_t *pcl_Channels, uint32_t *len);
-bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
+bool cds_allow_concurrency(enum cds_con_mode mode,
 				uint8_t channel, enum hw_mode_bandwidth bw);
-enum cds_conc_priority_mode cds_get_first_connection_pcl_table_index(
-				hdd_context_t *hdd_ctx);
-enum cds_one_connection_mode cds_get_second_connection_pcl_table_index(
-				hdd_context_t *hdd_ctx);
-enum cds_two_connection_mode cds_get_third_connection_pcl_table_index(
-				hdd_context_t *hdd_ctx);
-CDF_STATUS cds_mode_switch_dbs_to_mcc(hdd_context_t *hdd_ctx);
-CDF_STATUS cds_mode_switch_mcc_to_dbs(hdd_context_t *hdd_ctx);
-CDF_STATUS cds_incr_connection_count(hdd_context_t *hdd_ctx,
-					  uint32_t vdev_id);
-CDF_STATUS cds_update_connection_info(hdd_context_t *hdd_ctx,
-					   uint32_t vdev_id);
-CDF_STATUS cds_decr_connection_count(hdd_context_t *hdd_ctx,
-					  uint32_t vdev_id);
+enum cds_conc_priority_mode cds_get_first_connection_pcl_table_index(void);
+enum cds_one_connection_mode cds_get_second_connection_pcl_table_index(void);
+enum cds_two_connection_mode cds_get_third_connection_pcl_table_index(void);
+CDF_STATUS cds_incr_connection_count(uint32_t vdev_id);
+CDF_STATUS cds_update_connection_info(uint32_t vdev_id);
+CDF_STATUS cds_decr_connection_count(uint32_t vdev_id);
 CDF_STATUS cds_current_connections_update(uint32_t session_id,
 				uint8_t channel,
 				enum cds_conn_update_reason);
+bool cds_is_ibss_conn_exist(uint8_t *ibss_channel);
 #ifdef MPC_UT_FRAMEWORK
-CDF_STATUS cds_incr_connection_count_utfw(hdd_context_t *hdd_ctx,
+CDF_STATUS cds_incr_connection_count_utfw(
 		uint32_t vdev_id, uint32_t tx_streams, uint32_t rx_streams,
 		uint32_t chain_mask, uint32_t type, uint32_t sub_type,
 		uint32_t channelid, uint32_t mac_id);
-CDF_STATUS cds_update_connection_info_utfw(hdd_context_t *hdd_ctx,
+CDF_STATUS cds_update_connection_info_utfw(
 		uint32_t vdev_id, uint32_t tx_streams, uint32_t rx_streams,
 		uint32_t chain_mask, uint32_t type, uint32_t sub_type,
 		uint32_t channelid, uint32_t mac_id);
-CDF_STATUS cds_decr_connection_count_utfw(hdd_context_t *hdd_ctx,
+CDF_STATUS cds_decr_connection_count_utfw(
 		uint32_t del_all, uint32_t vdev_id);
-struct cds_conc_connection_info *cds_get_conn_info(hdd_context_t *hdd_ctx,
-	uint32_t *len);
-enum cds_pcl_type get_pcl_from_first_conn_table(
-		enum cds_con_mode type,
+struct cds_conc_connection_info *cds_get_conn_info(uint32_t *len);
+enum cds_pcl_type get_pcl_from_first_conn_table(enum cds_con_mode type,
 		enum cds_conc_priority_mode sys_pref);
 enum cds_pcl_type get_pcl_from_second_conn_table(
 	enum cds_one_connection_mode idx, enum cds_con_mode type,
@@ -711,39 +592,33 @@ enum cds_pcl_type get_pcl_from_third_conn_table(
 	enum cds_two_connection_mode idx, enum cds_con_mode type,
 	enum cds_conc_priority_mode sys_pref, uint8_t dbs_capable);
 #else
-static inline CDF_STATUS cds_incr_connection_count_utfw(
-		hdd_context_t *hdd_ctx, uint32_t vdev_id,
+static inline CDF_STATUS cds_incr_connection_count_utfw(uint32_t vdev_id,
 		uint32_t tx_streams, uint32_t rx_streams,
 		uint32_t chain_mask, uint32_t type, uint32_t sub_type,
 		uint32_t channelid, uint32_t mac_id)
 {
 	return CDF_STATUS_SUCCESS;
 }
-static inline CDF_STATUS cds_update_connection_info_utfw(
-		hdd_context_t *hdd_ctx, uint32_t vdev_id,
+static inline CDF_STATUS cds_update_connection_info_utfw(uint32_t vdev_id,
 		uint32_t tx_streams, uint32_t rx_streams,
 		uint32_t chain_mask, uint32_t type, uint32_t sub_type,
 		uint32_t channelid, uint32_t mac_id)
 {
 	return CDF_STATUS_SUCCESS;
 }
-static inline CDF_STATUS cds_decr_connection_count_utfw(
-		hdd_context_t *hdd_ctx,
-		uint32_t del_all, uint32_t vdev_id)
+static inline CDF_STATUS cds_decr_connection_count_utfw(uint32_t del_all,
+		uint32_t vdev_id)
 {
 	return CDF_STATUS_SUCCESS;
 }
-static inline struct cds_conc_connection_info *cds_get_conn_info(
-		hdd_context_t *hdd_ctx, uint32_t *len)
+static inline struct cds_conc_connection_info *cds_get_conn_info(uint32_t *len)
 {
 	return NULL;
 }
 #endif
 enum cds_con_mode cds_convert_device_mode_to_hdd_type(
 				device_mode_t device_mode);
-uint32_t cds_get_connection_count(hdd_context_t *hdd_ctx);
-CDF_STATUS cds_soc_set_hw_mode(hdd_context_t *hdd_ctx,
-		uint32_t session_id,
+CDF_STATUS cds_soc_set_hw_mode(uint32_t session_id,
 		enum hw_mode_ss_config mac0_ss,
 		enum hw_mode_bandwidth mac0_bw,
 		enum hw_mode_ss_config mac1_ss,
@@ -751,43 +626,30 @@ CDF_STATUS cds_soc_set_hw_mode(hdd_context_t *hdd_ctx,
 		enum hw_mode_dbs_capab dbs,
 		enum hw_mode_agile_dfs_capab dfs,
 		enum cds_conn_update_reason reason);
-enum cds_conc_next_action cds_need_opportunistic_upgrade(
-		hdd_context_t *hdd_ctx);
-CDF_STATUS cds_next_actions(
-		hdd_context_t *hdd_ctx, uint32_t session_id,
+enum cds_conc_next_action cds_need_opportunistic_upgrade(void);
+CDF_STATUS cds_next_actions(uint32_t session_id,
 		enum cds_conc_next_action action,
 		enum cds_conn_update_reason reason);
-void cds_set_dual_mac_scan_config(hdd_context_t *hdd_ctx,
-		uint8_t dbs_val,
+void cds_set_dual_mac_scan_config(uint8_t dbs_val,
 		uint8_t dbs_plus_agile_scan_val,
 		uint8_t single_mac_scan_with_dbs_val);
-void cds_set_dual_mac_fw_mode_config(hdd_context_t *hdd_ctx,
-		uint8_t dbs,
+void cds_set_dual_mac_fw_mode_config(uint8_t dbs,
 		uint8_t dfs);
 void cds_soc_set_dual_mac_cfg_cb(enum set_hw_mode_status status,
 		uint32_t scan_config,
 		uint32_t fw_mode_config);
-bool cds_map_concurrency_mode(hdd_context_t *hdd_ctx,
-		tCDF_CON_MODE *old_mode, enum cds_con_mode *new_mode);
+bool cds_map_concurrency_mode(enum tCDF_ADAPTER_MODE *old_mode,
+		enum cds_con_mode *new_mode);
 CDF_STATUS cds_get_channel_from_scan_result(hdd_adapter_t *adapter,
 		tCsrRoamProfile *roam_profile, uint8_t *channel);
 
-tCDF_CON_MODE cds_get_conparam(void);
+enum tCDF_GLOBAL_CON_MODE cds_get_conparam(void);
 bool cds_concurrent_open_sessions_running(void);
 bool cds_max_concurrent_connections_reached(void);
 void cds_clear_concurrent_session_count(void);
 bool cds_is_multiple_active_sta_sessions(void);
 bool cds_is_sta_active_connection_exists(void);
-
-#ifdef WLAN_FEATURE_MBSSID
 bool cds_concurrent_beaconing_sessions_running(void);
-#else
-static inline bool cds_concurrent_beaconing_sessions_running(void)
-{
-	return true;
-}
-#endif
-
 CDF_STATUS cdf_wait_for_connection_update(void);
 CDF_STATUS cdf_reset_connection_update(void);
 CDF_STATUS cdf_set_connection_update(void);
diff --git a/core/cds/inc/cds_packet.h b/core/cds/inc/cds_packet.h
index f3a87d3e645c..1fb7de36ab25 100644
--- a/core/cds/inc/cds_packet.h
+++ b/core/cds/inc/cds_packet.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -109,6 +109,9 @@ void cds_pkt_proto_trace_init(void);
 
    ---------------------------------------------------------------------------*/
 void cds_pkt_proto_trace_close(void);
+#else
+static inline void cds_pkt_proto_trace_init(void) { }
+static inline void cds_pkt_proto_trace_close(void) {}
 #endif /* QCA_PKT_PROTO_TRACE */
 
 /**
diff --git a/core/cds/inc/cds_reg_service.h b/core/cds/inc/cds_reg_service.h
index 02a6965c5c4c..5bc32ea79c55 100644
--- a/core/cds/inc/cds_reg_service.h
+++ b/core/cds/inc/cds_reg_service.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,7 +39,35 @@
 #include "cdf_status.h"
 
 #define CDS_COUNTRY_CODE_LEN  2
-#define CDS_MAC_ADDRESS_LEN   6
+#define CDS_MAC_ADDRESS_LEN 6
+
+#define CDS_CHANNEL_STATE(chan_enum) reg_channels[chan_enum].state
+#define CDS_CHANNEL_NUM(chan_enum) chan_mapping[chan_enum].chan_num
+#define CDS_CHANNEL_FREQ(chan_enum) chan_mapping[chan_enum].center_freq
+#define CDS_IS_DFS_CH(chan_num) (cds_get_channel_state((chan_num)) == \
+				CHANNEL_STATE_DFS)
+
+#define CDS_IS_PASSIVE_OR_DISABLE_CH(chan_num) \
+	(cds_get_channel_state(chan_num) != CHANNEL_STATE_ENABLE)
+
+#define CDS_MIN_24GHZ_CHANNEL_NUMBER chan_mapping[MIN_24GHZ_CHANNEL].chan_num
+#define CDS_MAX_24GHZ_CHANNEL_NUMBER chan_mapping[MAX_24GHZ_CHANNEL].chan_num
+#define CDS_MIN_5GHZ_CHANNEL_NUMBER chan_mapping[MIN_5GHZ_CHANNEL].chan_num
+#define CDS_MAX_5GHZ_CHANNEL_NUMBER chan_mapping[MAX_5GHZ_CHANNEL].chan_num
+
+#define CDS_IS_CHANNEL_5GHZ(chan_num) \
+	((chan_num >= CDS_MIN_5GHZ_CHANNEL_NUMBER) && \
+	 (chan_num <= CDS_MAX_5GHZ_CHANNEL_NUMBER))
+
+#define CDS_IS_CHANNEL_24GHZ(chan_num) \
+	((chan_num >= CDS_MIN_24GHZ_CHANNEL_NUMBER) && \
+	 (chan_num <= CDS_MAX_24GHZ_CHANNEL_NUMBER))
+
+#define CDS_IS_SAME_BAND_CHANNELS(chan_num1, chan_num2) \
+	(chan_num1 && chan_num2 && \
+	(CDS_IS_CHANNEL_5GHZ(chan_num1) == CDS_IS_CHANNEL_5GHZ(chan_num2)))
+
+#define CDS_MIN_11P_CHANNEL chan_mapping[MIN_59GHZ_CHANNEL].chan_num
 
 typedef enum {
 	REGDOMAIN_FCC,
@@ -49,8 +77,7 @@ typedef enum {
 	REGDOMAIN_COUNT
 } v_REGDOMAIN_t;
 
-typedef enum {
-	/* 2.4GHz Band */
+enum channel_enum {
 	RF_CHAN_1 = 0,
 	RF_CHAN_2,
 	RF_CHAN_3,
@@ -66,16 +93,6 @@ typedef enum {
 	RF_CHAN_13,
 	RF_CHAN_14,
 
-	/* 4.9GHz Band */
-	RF_CHAN_240,
-	RF_CHAN_244,
-	RF_CHAN_248,
-	RF_CHAN_252,
-	RF_CHAN_208,
-	RF_CHAN_212,
-	RF_CHAN_216,
-
-	/* 5GHz Low & Mid U-NII Band */
 	RF_CHAN_36,
 	RF_CHAN_40,
 	RF_CHAN_44,
@@ -85,7 +102,6 @@ typedef enum {
 	RF_CHAN_60,
 	RF_CHAN_64,
 
-	/* 5GHz Mid Band - ETSI & FCC */
 	RF_CHAN_100,
 	RF_CHAN_104,
 	RF_CHAN_108,
@@ -97,17 +113,14 @@ typedef enum {
 	RF_CHAN_132,
 	RF_CHAN_136,
 	RF_CHAN_140,
-
 	RF_CHAN_144,
 
-	/* 5GHz High U-NII Band */
 	RF_CHAN_149,
 	RF_CHAN_153,
 	RF_CHAN_157,
 	RF_CHAN_161,
 	RF_CHAN_165,
 
-	/* 802.11p */
 	RF_CHAN_170,
 	RF_CHAN_171,
 	RF_CHAN_172,
@@ -134,19 +147,14 @@ typedef enum {
 	RF_CHAN_BOND_9,
 	RF_CHAN_BOND_10,
 	RF_CHAN_BOND_11,
-	RF_CHAN_BOND_242,       /* 4.9GHz Band */
-	RF_CHAN_BOND_246,
-	RF_CHAN_BOND_250,
-	RF_CHAN_BOND_210,
-	RF_CHAN_BOND_214,
-	RF_CHAN_BOND_38,        /* 5GHz Low & Mid U-NII Band */
+	RF_CHAN_BOND_38,
 	RF_CHAN_BOND_42,
 	RF_CHAN_BOND_46,
 	RF_CHAN_BOND_50,
 	RF_CHAN_BOND_54,
 	RF_CHAN_BOND_58,
 	RF_CHAN_BOND_62,
-	RF_CHAN_BOND_102,       /* 5GHz Mid Band - ETSI & FCC */
+	RF_CHAN_BOND_102,
 	RF_CHAN_BOND_106,
 	RF_CHAN_BOND_110,
 	RF_CHAN_BOND_114,
@@ -156,21 +164,19 @@ typedef enum {
 	RF_CHAN_BOND_130,
 	RF_CHAN_BOND_134,
 	RF_CHAN_BOND_138,
-
 	RF_CHAN_BOND_142,
-
-	RF_CHAN_BOND_151,       /* 5GHz High U-NII Band */
+	RF_CHAN_BOND_151,
 	RF_CHAN_BOND_155,
 	RF_CHAN_BOND_159,
 	RF_CHAN_BOND_163,
 
 	NUM_RF_CHANNELS,
 
-	MIN_2_4GHZ_CHANNEL = RF_CHAN_1,
-	MAX_2_4GHZ_CHANNEL = RF_CHAN_14,
-	NUM_24GHZ_CHANNELS = (MAX_2_4GHZ_CHANNEL - MIN_2_4GHZ_CHANNEL + 1),
+	MIN_24GHZ_CHANNEL = RF_CHAN_1,
+	MAX_24GHZ_CHANNEL = RF_CHAN_14,
+	NUM_24GHZ_CHANNELS = (MAX_24GHZ_CHANNEL - MIN_24GHZ_CHANNEL + 1),
 
-	MIN_5GHZ_CHANNEL = RF_CHAN_240,
+	MIN_5GHZ_CHANNEL = RF_CHAN_36,
 	MAX_5GHZ_CHANNEL = RF_CHAN_184,
 	NUM_5GHZ_CHANNELS = (MAX_5GHZ_CHANNEL - MIN_5GHZ_CHANNEL + 1),
 
@@ -184,49 +190,108 @@ typedef enum {
 	NUM_40MHZ_RF_CHANNELS =
 		(MAX_40MHZ_RF_CHANNEL - MIN_40MHZ_RF_CHANNEL + 1),
 
-	MIN_5_9GHZ_CHANNEL = RF_CHAN_170,
-	MAX_5_9GHZ_CHANNEL = RF_CHAN_184,
+	MIN_59GHZ_CHANNEL = RF_CHAN_170,
+	MAX_59GHZ_CHANNEL = RF_CHAN_184,
 
 	INVALID_RF_CHANNEL = 0xBAD,
 	RF_CHANNEL_INVALID_MAX_FIELD = 0x7FFFFFFF
-} eRfChannels;
+};
 
-typedef enum {
+/**
+ * enum channel_state: channel state
+ *
+ * @CHANNEL_STATE_DISABLE: channel disabled
+ * @CHANNEL_STATE_ENABLE: tx/rx enabled
+ * @CHANNEL_STATE_DFS: rx enabled, tx DFS
+ * @CHANNEL_STATE_INVALID: not a valid channel
+ */
+enum channel_state {
 	CHANNEL_STATE_DISABLE,
 	CHANNEL_STATE_ENABLE,
 	CHANNEL_STATE_DFS,
 	CHANNEL_STATE_INVALID
-} CHANNEL_STATE;
-
-typedef int8_t tPowerdBm;
+};
 
-typedef struct {
-	uint32_t enabled:4;
+/**
+ * struct regulatory_channel: regulatory channel
+ *
+ * @state: channel state
+ * @flags: channel flags
+ * @pwr_limit: channel tx power limit
+ */
+struct regulatory_channel {
+	uint32_t state:4;
 	uint32_t flags:28;
-	tPowerdBm pwrLimit;
-} sRegulatoryChannel;
+	int8_t pwr_limit;
+};
 
-typedef struct {
-	sRegulatoryChannel channels[NUM_RF_CHANNELS];
-} sRegulatoryDomain;
+/**
+ * struct chan_map: channel mapping
+ *
+ * @center_freq: channel center freq
+ * @chan_num: channel number
+ */
+struct chan_map {
+	uint16_t center_freq;
+	uint16_t chan_num;
+};
 
-typedef struct {
-	uint16_t targetFreq;
-	uint16_t channelNum;
-} tRfChannelProps;
+/**
+ * struct channel_power: channel power
+ *
+ * @chan_num: channel number
+ * @power: tx power
+ */
+struct channel_power {
+	uint8_t chan_num;
+	int8_t power;
+};
 
-typedef struct {
-	uint8_t chanId;
-	tPowerdBm pwr;
-} tChannelListWithPower;
+/**
+ * enum country_src: country source
+ *
+ * @SOURCE_QUERY: source query
+ * @SOURCE_CORE: source regulatory core
+ * @SOURCE_DRIVER: source driver
+ * @SOURCE_USERSPACE: source userspace
+ * @SOURCE_11D: source 11D
+ */
+enum country_src {
+	SOURCE_QUERY,
+	SOURCE_CORE,
+	SOURCE_DRIVER,
+	SOURCE_USERSPACE,
+	SOURCE_11D
+};
 
-typedef enum {
-	COUNTRY_INIT,
-	COUNTRY_IE,
-	COUNTRY_USER,
-	COUNTRY_QUERY,
-	COUNTRY_MAX = COUNTRY_QUERY
-} v_CountryInfoSource_t;
+/**
+ * struct regulatory: regulatory information
+ *
+ * @reg_domain: regulatory domain pair
+ * @eeprom_rd_ext: eeprom value
+ * @country_code: current country in integer
+ * @alpha2: current alpha2
+ * @def_country: default country alpha2
+ * @def_region: DFS region
+ * @ctl_2g: 2G CTL value
+ * @ctl_5g: 5G CTL value
+ * @reg_pair: pointer to regulatory pair
+ * @cc_src: country code src
+ * @reg_flags: kernel regulatory flags
+ */
+struct regulatory {
+	uint32_t reg_domain;
+	uint32_t eeprom_rd_ext;
+	uint16_t country_code;
+	uint8_t alpha2[CDS_COUNTRY_CODE_LEN + 1];
+	uint8_t def_country[CDS_COUNTRY_CODE_LEN + 1];
+	uint8_t dfs_region;
+	uint8_t ctl_2g;
+	uint8_t ctl_5g;
+	const void *regpair;
+	enum country_src cc_src;
+	uint32_t reg_flags;
+};
 
 /**
  * enum chan_width: channel width
@@ -249,62 +314,33 @@ enum channel_width {
 	CHAN_WIDTH_160MHZ
 };
 
-/**
- * @country_code_t : typedef for country code. One extra
- * char for holding null character
- */
-typedef uint8_t country_code_t[CDS_COUNTRY_CODE_LEN + 1];
-
-typedef struct {
-	sRegulatoryDomain regDomains[REGDOMAIN_COUNT];
-	country_code_t default_country;
-} t_reg_table;
 
+extern struct regulatory_channel reg_channels[NUM_RF_CHANNELS];
+extern const struct chan_map chan_mapping[NUM_RF_CHANNELS];
 
 CDF_STATUS cds_get_reg_domain_from_country_code(v_REGDOMAIN_t *pRegDomain,
-						const country_code_t countryCode,
-						v_CountryInfoSource_t source);
-
-CDF_STATUS cds_read_default_country(country_code_t default_country);
-
-CDF_STATUS cds_get_channel_list_with_power(tChannelListWithPower
-					   *pChannels20MHz,
-					   uint8_t *pNum20MHzChannelsFound,
-					   tChannelListWithPower
-					   *pChannels40MHz,
-					   uint8_t *pNum40MHzChannelsFound);
-
-CDF_STATUS cds_set_reg_domain(void *clientCtxt, v_REGDOMAIN_t regId);
-
-CHANNEL_STATE cds_get_channel_state(uint32_t rfChannel);
-
-#define CDS_IS_DFS_CH(channel) (cds_get_channel_state((channel)) == \
-				CHANNEL_STATE_DFS)
-
-#define CDS_IS_PASSIVE_OR_DISABLE_CH(channel) \
-    (cds_get_channel_state((channel)) != CHANNEL_STATE_ENABLE)
+						const uint8_t *country_alpha2,
+						enum country_src source);
 
-#define CDS_MAX_24GHz_CHANNEL_NUMBER \
-    (rf_channels[MAX_2_4GHZ_CHANNEL].channelNum)
-#define CDS_MIN_5GHz_CHANNEL_NUMBER  (rf_channels[RF_CHAN_36].channelNum)
-#define CDS_MAX_5GHz_CHANNEL_NUMBER  (rf_channels[MAX_5GHZ_CHANNEL].channelNum)
+CDF_STATUS cds_read_default_country(uint8_t *default_country);
 
-#define CDS_IS_CHANNEL_5GHZ(chnNum) \
-	(((chnNum) >= CDS_MIN_5GHz_CHANNEL_NUMBER) && ((chnNum) <= CDS_MAX_5GHz_CHANNEL_NUMBER))
+CDF_STATUS cds_get_channel_list_with_power(struct channel_power
+					   *base_channels,
+					   uint8_t *num_base_channels,
+					   struct channel_power
+					   *channel_40mhz,
+					   uint8_t *num_channels_40mhz);
 
-#define CDS_IS_CHANNEL_24GHZ(chnNum) \
-	(((chnNum) > 0) && ((chnNum) <= CDS_MAX_24GHz_CHANNEL_NUMBER))
+CDF_STATUS cds_set_reg_domain(void *client_ctxt, v_REGDOMAIN_t reg_domain);
 
-#define CDS_IS_SAME_BAND_CHANNELS(ch1, ch2) \
-	(ch1 && ch2 && \
-	(CDS_IS_CHANNEL_5GHZ(ch1) == CDS_IS_CHANNEL_5GHZ(ch2)))
+enum channel_state cds_get_channel_state(uint32_t chan_num);
 
 CDF_STATUS cds_regulatory_init(void);
 CDF_STATUS cds_get_dfs_region(uint8_t *dfs_region);
 CDF_STATUS cds_set_dfs_region(uint8_t dfs_region);
 bool cds_is_dsrc_channel(uint16_t);
-CHANNEL_STATE cds_get_bonded_channel_state(uint32_t chan_num,
-					   enum channel_width ch_width);
+enum channel_state cds_get_bonded_channel_state(uint32_t chan_num,
+					   enum channel_width chan_width);
 enum channel_width cds_get_max_channel_bw(uint32_t chan_num);
 
 #endif /* __CDS_REG_SERVICE_H */
diff --git a/core/cds/inc/cds_regdomain.h b/core/cds/inc/cds_regdomain.h
index 262677f201a1..7f40344e46ae 100644
--- a/core/cds/inc/cds_regdomain.h
+++ b/core/cds/inc/cds_regdomain.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -301,24 +301,6 @@ typedef struct {
 	uint8_t pwrlvl;
 } COMMON_MODE_POWER;
 
-typedef enum {
-	COUNTRY_CODE_SET_BY_CORE,
-	COUNTRY_CODE_SET_BY_DRIVER,
-	COUNTRY_CODE_SET_BY_USER
-} COUNTRY_CODE_SOURCE;
-
-struct regulatory {
-	uint32_t reg_domain;
-	uint32_t eeprom_rd_ext;
-	uint16_t country_code;
-	uint8_t alpha2[3];
-	uint8_t dfs_region;
-	uint8_t ctl_2g;
-	uint8_t ctl_5g;
-	const void *regpair;
-	COUNTRY_CODE_SOURCE cc_src;
-	uint32_t reg_flags;
-};
 /* Multi-Device RegDomain Support */
 typedef struct ath_hal_reg_dmn_tables {
 	/* regDomainPairs: Map of 8-bit regdomain values to unitary reg domain */
@@ -1094,5 +1076,7 @@ int32_t cds_get_country_from_alpha2(uint8_t *alpha2);
 void cds_fill_send_ctl_info_to_fw(struct regulatory *reg, uint32_t modesAvail,
 				  uint32_t modeSelect);
 void cds_set_wma_dfs_region(struct regulatory *reg);
+void cds_set_ch_params(uint8_t ch, uint32_t phy_mode,
+		chan_params_t *ch_params);
 
 #endif /* REGULATORY_H */
diff --git a/core/cds/inc/cds_sched.h b/core/cds/inc/cds_sched.h
index c9acbdce02e7..3d8d367d3d5e 100644
--- a/core/cds/inc/cds_sched.h
+++ b/core/cds/inc/cds_sched.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -250,14 +250,9 @@ typedef struct _cds_context_type {
 	/* MAC Module Context  */
 	void *pMACContext;
 
-#ifndef WLAN_FEATURE_MBSSID
-	/* SAP Context */
-	void *pSAPContext;
-#endif
-
 	cdf_event_t ProbeEvent;
 
-	volatile uint8_t isLogpInProgress;
+	uint32_t driver_state;
 
 	cdf_event_t wmaCompleteEvent;
 
@@ -268,7 +263,6 @@ typedef struct _cds_context_type {
 
 	void *htc_ctx;
 
-	void *epping_ctx;
 	/*
 	 * cdf_ctx will be used by cdf
 	 * while allocating dma memory
@@ -281,8 +275,6 @@ typedef struct _cds_context_type {
 	/* Configuration handle used to get system configuration */
 	void *cfg_ctx;
 
-	volatile uint8_t isLoadUnloadInProgress;
-
 	bool is_wakelock_log_enabled;
 	uint32_t wakelock_log_level;
 	uint32_t connectivity_log_level;
@@ -292,6 +284,7 @@ typedef struct _cds_context_type {
 	struct cds_log_complete log_complete;
 	cdf_spinlock_t bug_report_lock;
 	cdf_event_t connection_update_done_evt;
+	cdf_mutex_t cdf_conc_list_lock;
 
 } cds_context_type, *p_cds_contextType;
 
@@ -444,8 +437,7 @@ void cdf_timer_module_init(void);
 void cds_ssr_protect_init(void);
 void cds_ssr_protect(const char *caller_func);
 void cds_ssr_unprotect(const char *caller_func);
-bool cds_is_ssr_ready(const char *caller_func);
-
-#define cds_wait_for_work_thread_completion(func) cds_is_ssr_ready(func)
+bool cds_wait_for_external_threads_completion(const char *caller_func);
+int cds_get_gfp_flags(void);
 
 #endif /* #if !defined __CDS_SCHED_H */
diff --git a/core/cds/src/cds_api.c b/core/cds/src/cds_api.c
index 1fcdf449d19c..448aee02073d 100644
--- a/core/cds/src/cds_api.c
+++ b/core/cds/src/cds_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,7 +40,6 @@
 #include "sme_api.h"
 #include "mac_init_api.h"
 #include "wlan_qct_sys.h"
-#include "wlan_hdd_misc.h"
 #include "i_cds_packet.h"
 #include "cds_reg_service.h"
 #include "wma_types.h"
@@ -80,70 +79,56 @@ static uint8_t cds_multicast_logging;
 void cds_sys_probe_thread_cback(void *pUserData);
 
 /**
- * cds_alloc_global_context() - allocate CDS global context
- * @p_cds_context: A pointer to where to store the CDS Context
+ * cds_init() - Initialize CDS
  *
- * cds_alloc_global_context() function allocates the CDS global Context,
- * but does not initialize all the members. This overal initialization will
- * happen at cds_open().
+ * This function allocates the resource required for CDS, but does not
+ * initialize all the members. This overall initialization will happen at
+ * cds_open().
  *
- * Return: CDF status
+ * Return: Global context on success and NULL on failure.
  */
-CDF_STATUS cds_alloc_global_context(v_CONTEXT_t *p_cds_context)
+v_CONTEXT_t cds_init(void)
 {
-	if (p_cds_context == NULL)
-		return CDF_STATUS_E_FAILURE;
+	cdf_mc_timer_manager_init();
+	cdf_mem_init();
 
-	/* allocate the CDS Context */
-	*p_cds_context = NULL;
 	gp_cds_context = &g_cds_context;
 
-	cdf_mem_zero(gp_cds_context, sizeof(cds_context_type));
-	*p_cds_context = gp_cds_context;
-
 	gp_cds_context->cdf_ctx = &g_cdf_ctx;
 	cdf_mem_zero(&g_cdf_ctx, sizeof(g_cdf_ctx));
 
-	/* initialize the spinlock */
 	cdf_trace_spin_lock_init();
-	/* it is the right time to initialize MTRACE structures */
+
 #if defined(TRACE_RECORD)
 	cdf_trace_init();
 #endif
-
 	cdf_dp_trace_init();
-	return CDF_STATUS_SUCCESS;
-} /* cds_alloc_global_context() */
+
+	cds_ssr_protect_init();
+
+	return gp_cds_context;
+}
 
 /**
- * cds_free_global_context() - free CDS global context
- * @p_cds_context: A pointer to where the CDS Context was stored
- *
- * cds_free_global_context() function frees the CDS Context.
+ * cds_deinit() - Deinitialize CDS
  *
- * Return: CDF status
+ * This function frees the CDS resources
  */
-CDF_STATUS cds_free_global_context(v_CONTEXT_t *p_cds_context)
+void cds_deinit(void)
 {
-	CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_INFO,
-		  "%s: De-allocating the CDS Context", __func__);
-
-	if ((p_cds_context == NULL) || (*p_cds_context == NULL)) {
-		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "%s: vOS Context is Null", __func__);
-		return CDF_STATUS_E_FAILURE;
-	}
+	if (gp_cds_context == NULL)
+		return;
 
-	if (gp_cds_context != *p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "%s: Context mismatch", __func__);
-		return CDF_STATUS_E_FAILURE;
-	}
 	gp_cds_context->cdf_ctx = NULL;
-	*p_cds_context = gp_cds_context = NULL;
+	gp_cds_context = NULL;
 
-	return CDF_STATUS_SUCCESS;
-} /* cds_free_global_context() */
+	cdf_mem_zero(&g_cds_context, sizeof(g_cds_context));
+
+	cdf_mc_timer_exit();
+	cdf_mem_exit();
+
+	return;
+}
 
 #ifdef WLAN_FEATURE_NAN
 /**
@@ -167,8 +152,6 @@ static void cds_set_nan_enable(tMacOpenParameters *param,
 
 /**
  * cds_open() - open the CDS Module
- * @p_cds_context: A pointer to where the CDS Context was stored
- * @hddContextSize: Size of the HDD context to allocate.
  *
  * cds_open() function opens the CDS Scheduler
  * Upon successful initialization:
@@ -181,7 +164,7 @@ static void cds_set_nan_enable(tMacOpenParameters *param,
  *
  * Return: CDF status
  */
-CDF_STATUS cds_open(v_CONTEXT_t *p_cds_context, uint32_t hddContextSize)
+CDF_STATUS cds_open(void)
 {
 	CDF_STATUS cdf_status = CDF_STATUS_SUCCESS;
 	int iter = 0;
@@ -462,8 +445,6 @@ CDF_STATUS cds_open(v_CONTEXT_t *p_cds_context, uint32_t hddContextSize)
 	CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "%s: CDS successfully Opened", __func__);
 
-	*p_cds_context = gp_cds_context;
-
 	return CDF_STATUS_SUCCESS;
 
 err_sme_close:
@@ -851,6 +832,9 @@ CDF_STATUS cds_close(v_CONTEXT_t cds_context)
 	}
 
 	cds_deinit_log_completion();
+
+	gp_cds_context->pHDDContext = NULL;
+
 	return CDF_STATUS_SUCCESS;
 }
 
@@ -878,14 +862,6 @@ void *cds_get_context(CDF_MODULE_ID moduleId)
 	}
 
 	switch (moduleId) {
-#ifndef WLAN_FEATURE_MBSSID
-	case CDF_MODULE_ID_SAP:
-	{
-		pModContext = gp_cds_context->pSAPContext;
-		break;
-	}
-#endif
-
 	case CDF_MODULE_ID_HDD:
 	{
 		pModContext = gp_cds_context->pHDDContext;
@@ -983,113 +959,67 @@ v_CONTEXT_t cds_get_global_context(void)
 } /* cds_get_global_context() */
 
 /**
- * cds_is_logp_in_progress() - check if ssr/self recovery is going on
+ * cds_get_driver_state() - Get current driver state
  *
- * Return: true if ssr/self recvoery is going on else false
- */
-uint8_t cds_is_logp_in_progress(void)
-{
-	if (gp_cds_context == NULL) {
-		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "%s: global cds context is NULL", __func__);
-		return 1;
-	}
-
-	return gp_cds_context->isLogpInProgress;
-}
-
-/**
- * cds_set_logp_in_progress() - set ssr/self recovery in progress
- * @value: value to set
+ * This API returns current driver state stored in global context.
  *
- * Return: none
+ * Return: Driver state enum
  */
-void cds_set_logp_in_progress(uint8_t value)
+enum cds_driver_state cds_get_driver_state(void)
 {
-	hdd_context_t *pHddCtx = NULL;
-
 	if (gp_cds_context == NULL) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 			  "%s: global cds context is NULL", __func__);
-		return;
-	}
-	gp_cds_context->isLogpInProgress = value;
 
-	/* HDD uses it's own context variable to check if SSR in progress,
-	 * instead of modifying all HDD APIs set the HDD context variable
-	 * here
-	 */
-	pHddCtx = cds_get_context(CDF_MODULE_ID_HDD);
-	if (!pHddCtx) {
-		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_FATAL,
-			  "%s: HDD context is Null", __func__);
-		return;
+		return CDS_DRIVER_STATE_UNINITIALIZED;
 	}
-	pHddCtx->isLogpInProgress = value;
-}
 
-/**
- * cds_is_load_unload_in_progress() - check if driver load/unload in progress
- *
- * Return: true if load/unload is going on else false
- */
-uint8_t cds_is_load_unload_in_progress(void)
-{
-	if (gp_cds_context == NULL) {
-		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "%s: global cds context is NULL", __func__);
-		return 0;
-	}
-
-	return gp_cds_context->isLoadUnloadInProgress;
+	return gp_cds_context->driver_state;
 }
 
 /**
- * cds_is_unload_in_progress() - check if driver unload in
- * progress
+ * cds_set_driver_state() - Set current driver state
+ * @state:	Driver state to be set to.
+ *
+ * This API sets driver state to state. This API only sets the state and doesn't
+ * clear states, please make sure to use cds_clear_driver_state to clear any
+ * state if required.
  *
- * Return: true if unload is going on else false
+ * Return: None
  */
-uint8_t cds_is_unload_in_progress(void)
+void cds_set_driver_state(enum cds_driver_state state)
 {
-	hdd_context_t *hdd_ctx = NULL;
 	if (gp_cds_context == NULL) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "%s: global cds context is NULL", __func__);
-		return 0;
-	}
-	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+			  "%s: global cds context is NULL: %x", __func__,
+			  state);
 
-	if (hdd_ctx == NULL) {
-		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "%s: HDD context is NULL", __func__);
-		return 0;
+		return;
 	}
 
-	return hdd_ctx->isUnloadInProgress;
+	gp_cds_context->driver_state |= state;
 }
 
 /**
- * cds_set_load_unload_in_progress() - set load/unload in progress
- * @value: value to set
+ * cds_clear_driver_state() - Clear current driver state
+ * @state:	Driver state to be cleared.
  *
- * Return: none
+ * This API clears driver state. This API only clears the state, please make
+ * sure to use cds_set_driver_state to set any new states.
+ *
+ * Return: None
  */
-void cds_set_load_unload_in_progress(uint8_t value)
+void cds_clear_driver_state(enum cds_driver_state state)
 {
 	if (gp_cds_context == NULL) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "%s: global cds context is NULL", __func__);
+			  "%s: global cds context is NULL: %x", __func__,
+			  state);
+
 		return;
 	}
-	gp_cds_context->isLoadUnloadInProgress = value;
 
-#ifdef CONFIG_CNSS
-	if (value)
-		cnss_set_driver_status(CNSS_LOAD_UNLOAD);
-	else
-		cnss_set_driver_status(CNSS_INITIALIZED);
-#endif
+	gp_cds_context->driver_state &= ~state;
 }
 
 /**
@@ -1125,15 +1055,6 @@ CDF_STATUS cds_alloc_context(void *p_cds_context, CDF_MODULE_ID moduleID,
 	}
 
 	switch (moduleID) {
-
-#ifndef WLAN_FEATURE_MBSSID
-	case CDF_MODULE_ID_SAP:
-	{
-		pGpModContext = &(gp_cds_context->pSAPContext);
-		break;
-	}
-#endif
-
 	case CDF_MODULE_ID_WMA:
 	{
 		pGpModContext = &(gp_cds_context->pWMAContext);
@@ -1147,10 +1068,6 @@ CDF_STATUS cds_alloc_context(void *p_cds_context, CDF_MODULE_ID moduleID,
 	}
 
 	case CDF_MODULE_ID_EPPING:
-	{
-		pGpModContext = &(gp_cds_context->epping_ctx);
-		break;
-	}
 	case CDF_MODULE_ID_SME:
 	case CDF_MODULE_ID_PE:
 	case CDF_MODULE_ID_HDD:
@@ -1221,14 +1138,6 @@ CDF_STATUS cds_free_context(void *p_cds_context, CDF_MODULE_ID moduleID,
 	}
 
 	switch (moduleID) {
-#ifndef WLAN_FEATURE_MBSSID
-	case CDF_MODULE_ID_SAP:
-	{
-		pGpModContext = &(gp_cds_context->pSAPContext);
-		break;
-	}
-#endif
-
 	case CDF_MODULE_ID_WMA:
 	{
 		pGpModContext = &(gp_cds_context->pWMAContext);
@@ -1241,18 +1150,13 @@ CDF_STATUS cds_free_context(void *p_cds_context, CDF_MODULE_ID moduleID,
 		break;
 	}
 
-	case CDF_MODULE_ID_EPPING:
-	{
-		pGpModContext = &(gp_cds_context->epping_ctx);
-		break;
-	}
-
 	case CDF_MODULE_ID_TXRX:
 	{
 		pGpModContext = &(gp_cds_context->pdev_txrx_ctx);
 		break;
 	}
 
+	case CDF_MODULE_ID_EPPING:
 	case CDF_MODULE_ID_HDD:
 	case CDF_MODULE_ID_SME:
 	case CDF_MODULE_ID_PE:
@@ -1568,7 +1472,7 @@ CDF_STATUS cds_shutdown(v_CONTEXT_t cds_context)
  *
  * Return: WMI vdev type
  */
-CDF_STATUS cds_get_vdev_types(tCDF_CON_MODE mode, uint32_t *type,
+CDF_STATUS cds_get_vdev_types(enum tCDF_ADAPTER_MODE mode, uint32_t *type,
 			      uint32_t *sub_type)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
@@ -1598,7 +1502,8 @@ CDF_STATUS cds_get_vdev_types(tCDF_CON_MODE mode, uint32_t *type,
 		*type = WMI_VDEV_TYPE_OCB;
 		break;
 	default:
-		hddLog(CDF_TRACE_LEVEL_ERROR, "Invalid device mode %d", mode);
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
+			  "Invalid device mode %d", mode);
 		status = CDF_STATUS_E_INVAL;
 		break;
 	}
@@ -1679,12 +1584,12 @@ void cds_trigger_recovery(void)
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 			"CRASH_INJECT command is timed out!");
  #ifdef CONFIG_CNSS
-		if (cds_is_logp_in_progress()) {
+		if (cds_is_driver_recovering()) {
 			CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-				"LOGP is in progress, ignore!");
+				"Recovery is in progress, ignore!");
 			return;
 		}
-		cds_set_logp_in_progress(true);
+		cds_set_recovery_in_progress(true);
 		cnss_schedule_recovery_work();
  #endif
 
@@ -1726,7 +1631,7 @@ void cds_set_wakelock_logging(bool value)
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"cds context is Invald");
 		return;
 	}
@@ -1747,7 +1652,7 @@ bool cds_is_wakelock_enabled(void)
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"cds context is Invald");
 		return false;
 	}
@@ -1771,7 +1676,7 @@ void cds_set_ring_log_level(uint32_t ring_id, uint32_t log_level)
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: cds context is Invald", __func__);
 		return;
 	}
@@ -1824,7 +1729,7 @@ enum wifi_driver_log_level cds_get_ring_log_level(uint32_t ring_id)
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: cds context is Invald", __func__);
 		return WLAN_LOG_LEVEL_OFF;
 	}
@@ -1886,7 +1791,7 @@ void cds_init_log_completion(void)
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: cds context is Invalid", __func__);
 		return;
 	}
@@ -1915,7 +1820,7 @@ void cds_deinit_log_completion(void)
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: cds context is Invalid", __func__);
 		return;
 	}
@@ -1942,7 +1847,7 @@ CDF_STATUS cds_set_log_completion(uint32_t is_fatal,
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: cds context is Invalid", __func__);
 		return CDF_STATUS_E_FAILURE;
 	}
@@ -1974,7 +1879,7 @@ void cds_get_log_completion(uint32_t *is_fatal,
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: cds context is Invalid", __func__);
 		return;
 	}
@@ -2000,7 +1905,7 @@ bool cds_is_log_report_in_progress(void)
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: cds context is Invalid", __func__);
 		return true;
 	}
@@ -2030,13 +1935,13 @@ CDF_STATUS cds_flush_logs(uint32_t is_fatal,
 
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: cds context is Invalid", __func__);
 		return CDF_STATUS_E_FAILURE;
 	}
 
 	if (cds_is_log_report_in_progress() == true) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: Bug report already in progress - dropping! type:%d, indicator=%d reason_code=%d",
 				__func__, is_fatal, indicator, reason_code);
 		return CDF_STATUS_E_FAILURE;
@@ -2044,18 +1949,18 @@ CDF_STATUS cds_flush_logs(uint32_t is_fatal,
 
 	status = cds_set_log_completion(is_fatal, indicator, reason_code);
 	if (CDF_STATUS_SUCCESS != status) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 			"%s: Failed to set log trigger params", __func__);
 		return CDF_STATUS_E_FAILURE;
 	}
 
-	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO,
+	CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_INFO,
 			"%s: Triggering bug report: type:%d, indicator=%d reason_code=%d",
 			__func__, is_fatal, indicator, reason_code);
 
 	ret = sme_send_flush_logs_cmd_to_fw(p_cds_context->pMACContext);
 	if (0 != ret) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 				"%s: Failed to send flush FW log", __func__);
 		cds_init_log_completion();
 		return CDF_STATUS_E_FAILURE;
diff --git a/core/cds/src/cds_concurrency.c b/core/cds/src/cds_concurrency.c
index afd6f9160d9e..39b2f0a1cb30 100644
--- a/core/cds/src/cds_concurrency.c
+++ b/core/cds/src/cds_concurrency.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1817,10 +1817,10 @@ next_action_two_connection_table[CDS_MAX_ONE_CONNECTION_MODE][CDS_MAX_BAND] = {
 	[CDS_SAP_24_2x2] = {CDS_NOP,             CDS_DBS_DOWNGRADE},
 	[CDS_SAP_5_1x1] = {CDS_DBS,             CDS_NOP},
 	[CDS_SAP_5_2x2] = {CDS_DBS_DOWNGRADE,   CDS_NOP},
-	[CDS_IBSS_24_1x1] = {CDS_NOP,             CDS_NOP},
-	[CDS_IBSS_24_2x2] = {CDS_NOP,             CDS_NOP},
-	[CDS_IBSS_5_1x1] = {CDS_NOP,             CDS_NOP},
-	[CDS_IBSS_5_2x2] = {CDS_NOP,             CDS_NOP},
+	[CDS_IBSS_24_1x1] = {CDS_NOP,             CDS_DBS},
+	[CDS_IBSS_24_2x2] = {CDS_NOP,             CDS_DBS_DOWNGRADE},
+	[CDS_IBSS_5_1x1] = {CDS_DBS,            CDS_NOP},
+	[CDS_IBSS_5_2x2] = {CDS_DBS_DOWNGRADE,  CDS_NOP},
 };
 
 /**
@@ -1909,6 +1909,139 @@ next_action_three_connection_table[CDS_MAX_TWO_CONNECTION_MODE]
 };
 
 /**
+ * cds_is_sta_connection_pending() - This function will check if sta connection
+ *                                   is pending or not.
+ *
+ * This function will return the status of flag is_sta_connection_pending
+ *
+ * Return: true or false
+ */
+bool cds_is_sta_connection_pending(void)
+{
+	bool status;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return false;
+	}
+
+	spin_lock(&hdd_ctx->sta_update_info_lock);
+	status = hdd_ctx->is_sta_connection_pending;
+	spin_unlock(&hdd_ctx->sta_update_info_lock);
+	return status;
+}
+
+/**
+ * cds_change_sta_conn_pending_status() - This function will change the value
+ *                                        of is_sta_connection_pending
+ * @value: value to set
+ *
+ * This function will change the value of is_sta_connection_pending
+ *
+ * Return: none
+ */
+void cds_change_sta_conn_pending_status(bool value)
+{
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
+	spin_lock(&hdd_ctx->sta_update_info_lock);
+	hdd_ctx->is_sta_connection_pending = value;
+	spin_unlock(&hdd_ctx->sta_update_info_lock);
+}
+
+/**
+ * cds_is_sap_restart_required() - This function will check if sap restart
+ *                                 is pending or not.
+ *
+ * This function will return the status of flag is_sap_restart_required.
+ *
+ * Return: true or false
+ */
+static bool cds_is_sap_restart_required(void)
+{
+	bool status;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return false;
+	}
+
+	spin_lock(&hdd_ctx->sap_update_info_lock);
+	status = hdd_ctx->is_sap_restart_required;
+	spin_unlock(&hdd_ctx->sap_update_info_lock);
+	return status;
+}
+
+/**
+ * cds_change_sap_restart_required_status() - This function will change the
+ *                                            value of is_sap_restart_required
+ * @value: value to set
+ *
+ * This function will change the value of is_sap_restart_required
+ *
+ * Return: none
+ */
+void cds_change_sap_restart_required_status(bool value)
+{
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
+	spin_lock(&hdd_ctx->sap_update_info_lock);
+	hdd_ctx->is_sap_restart_required = value;
+	spin_unlock(&hdd_ctx->sap_update_info_lock);
+}
+
+/**
+ * cds_set_connection_in_progress() - to set the connection in progress flag
+ * @value: value to set
+ *
+ * This function will set the passed value to connection in progress flag.
+ * If value is previously being set to true then no need to set it again.
+ *
+ * Return: true if value is being set correctly and false otherwise.
+ */
+bool cds_set_connection_in_progress(bool value)
+{
+	bool status = true;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return false;
+	}
+
+	cdf_spin_lock(&hdd_ctx->connection_status_lock);
+	/*
+	 * if the value is set to true previously and if someone is
+	 * trying to make it true again then it could be some race
+	 * condition being triggered. Avoid this situation by returning
+	 * false
+	 */
+	if (hdd_ctx->connection_in_progress && value)
+		status = false;
+	else
+		hdd_ctx->connection_in_progress = value;
+	cdf_spin_unlock(&hdd_ctx->connection_status_lock);
+	return status;
+}
+
+/**
  * cds_update_conc_list() - Update the concurrent connection list
  * @conn_index: Connection index
  * @mode: Mode
@@ -1954,7 +2087,6 @@ static void cds_update_conc_list(uint32_t conn_index,
 /**
  * cds_mode_specific_connection_count() - provides the
  * count of connections of specific mode
- * @hdd_ctx:	HDD Context
  * @mode: type of connection
  * @list: To provide the indices on conc_connection_list
  *	(optional)
@@ -1963,9 +2095,8 @@ static void cds_update_conc_list(uint32_t conn_index,
  *
  * Return: connection count of specific type
  */
-static uint32_t cds_mode_specific_connection_count(hdd_context_t *hdd_ctx,
-						 enum cds_con_mode mode,
-						 uint32_t *list)
+static uint32_t cds_mode_specific_connection_count(enum cds_con_mode mode,
+						uint32_t *list)
 {
 	uint32_t conn_index = 0, count = 0;
 	for (conn_index = 0; conn_index < MAX_NUMBER_OF_CONC_CONNECTIONS;
@@ -1982,7 +2113,6 @@ static uint32_t cds_mode_specific_connection_count(hdd_context_t *hdd_ctx,
 
 /**
  * cds_store_and_del_conn_info() - Store and del a connection info
- * @hdd_ctx: HDD context
  * @mode: Mode whose entry has to be deleted
  * @info: Struture pointer where the connection info will be saved
  *
@@ -1992,9 +2122,8 @@ static uint32_t cds_mode_specific_connection_count(hdd_context_t *hdd_ctx,
  *
  * Return: None
  */
-static void cds_store_and_del_conn_info(hdd_context_t *hdd_ctx,
-				      enum cds_con_mode mode,
-				      struct cds_conc_connection_info *info)
+static void cds_store_and_del_conn_info(enum cds_con_mode mode,
+				struct cds_conc_connection_info *info)
 {
 	uint32_t conn_index = 0;
 	bool found = false;
@@ -2016,7 +2145,7 @@ static void cds_store_and_del_conn_info(hdd_context_t *hdd_ctx,
 	*info = conc_connection_list[conn_index];
 
 	/* Deleting the STA entry */
-	cds_decr_connection_count(hdd_ctx, info->vdev_id);
+	cds_decr_connection_count(info->vdev_id);
 
 	cds_info("Stored %d (%d), deleted STA entry with vdev id %d, index %d",
 		info->vdev_id, info->mode, info->vdev_id, conn_index);
@@ -2026,7 +2155,6 @@ static void cds_store_and_del_conn_info(hdd_context_t *hdd_ctx,
 
 /**
  * cds_restore_deleted_conn_info() - Restore connection info
- * @hdd_ctx: HDD context
  * @info: Saved connection info that is to be restored
  *
  * Restores the connection info of STA that was saved before
@@ -2034,12 +2162,12 @@ static void cds_store_and_del_conn_info(hdd_context_t *hdd_ctx,
  *
  * Return: None
  */
-static void cds_restore_deleted_conn_info(hdd_context_t *hdd_ctx,
+static void cds_restore_deleted_conn_info(
 					struct cds_conc_connection_info *info)
 {
 	uint32_t conn_index;
 
-	conn_index = cds_get_connection_count(hdd_ctx);
+	conn_index = cds_get_connection_count();
 	if (MAX_NUMBER_OF_CONC_CONNECTIONS <= conn_index) {
 		cds_err("Failed to restore the deleted information %d/%d",
 			conn_index, MAX_NUMBER_OF_CONC_CONNECTIONS);
@@ -2067,15 +2195,15 @@ static void cds_update_hw_mode_conn_info(uint32_t num_vdev_mac_entries,
 				       struct sir_hw_mode_params hw_mode)
 {
 	uint32_t i, conn_index, found;
-	hdd_context_t *hdd_ctx;
+	cds_context_type *cds_ctx;
 
-	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
-	if (0 != wlan_hdd_validate_context(hdd_ctx)) {
-		cds_err("Invalid HDD Context");
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
 		return;
 	}
 
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
 	for (i = 0; i < num_vdev_mac_entries; i++) {
 		conn_index = 0;
 		found = 0;
@@ -2108,7 +2236,7 @@ static void cds_update_hw_mode_conn_info(uint32_t num_vdev_mac_entries,
 			  conc_connection_list[conn_index].rx_spatial_stream);
 		}
 	}
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 }
 
 /**
@@ -2131,7 +2259,6 @@ void cds_soc_set_dual_mac_cfg_cb(enum set_hw_mode_status status,
 
 /**
  * cds_set_dual_mac_scan_config() - Set the dual MAC scan config
- * @hdd_ctx: HDD context
  * @dbs_val: Value of DBS bit
  * @dbs_plus_agile_scan_val: Value of DBS plus agile scan bit
  * @single_mac_scan_with_dbs_val: Value of Single MAC scan with DBS
@@ -2141,14 +2268,15 @@ void cds_soc_set_dual_mac_cfg_cb(enum set_hw_mode_status status,
  *
  * Return: None
  */
-void cds_set_dual_mac_scan_config(hdd_context_t *hdd_ctx,
-		uint8_t dbs_val,
+void cds_set_dual_mac_scan_config(uint8_t dbs_val,
 		uint8_t dbs_plus_agile_scan_val,
 		uint8_t single_mac_scan_with_dbs_val)
 {
 	struct sir_dual_mac_config cfg;
 	CDF_STATUS status;
+	hdd_context_t *hdd_ctx;
 
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
 	if (!hdd_ctx) {
 		cds_err("HDD context is NULL");
 		return;
@@ -2193,7 +2321,6 @@ void cds_set_dual_mac_scan_config(hdd_context_t *hdd_ctx,
 
 /**
  * cds_set_dual_mac_fw_mode_config() - Set the dual mac FW mode config
- * @hdd_ctx: HDD context
  * @dbs: DBS bit
  * @dfs: Agile DFS bit
  *
@@ -2202,13 +2329,13 @@ void cds_set_dual_mac_scan_config(hdd_context_t *hdd_ctx,
  *
  * Return: None
  */
-void cds_set_dual_mac_fw_mode_config(hdd_context_t *hdd_ctx,
-		uint8_t dbs,
-		uint8_t dfs)
+void cds_set_dual_mac_fw_mode_config(uint8_t dbs, uint8_t dfs)
 {
 	struct sir_dual_mac_config cfg;
 	CDF_STATUS status;
+	hdd_context_t *hdd_ctx;
 
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
 	if (!hdd_ctx) {
 		cds_err("HDD context is NULL");
 		return;
@@ -2369,7 +2496,6 @@ static void cds_hw_mode_transition_cb(uint32_t old_hw_mode_index,
 
 /**
  * cds_soc_set_hw_mode() - Set HW mode command to SME
- * @hdd_ctx: HDD context
  * @session_id: Session ID
  * @mac0_ss: MAC0 spatial stream configuration
  * @mac0_bw: MAC0 bandwidth configuration
@@ -2397,8 +2523,7 @@ static void cds_hw_mode_transition_cb(uint32_t old_hw_mode_index,
  *
  * Return: Success if the message made it down to the next layer
  */
-CDF_STATUS cds_soc_set_hw_mode(hdd_context_t *hdd_ctx,
-		uint32_t session_id,
+CDF_STATUS cds_soc_set_hw_mode(uint32_t session_id,
 		enum hw_mode_ss_config mac0_ss,
 		enum hw_mode_bandwidth mac0_bw,
 		enum hw_mode_ss_config mac1_ss,
@@ -2410,7 +2535,9 @@ CDF_STATUS cds_soc_set_hw_mode(hdd_context_t *hdd_ctx,
 	int8_t hw_mode_index;
 	struct sir_hw_mode msg;
 	CDF_STATUS status;
+	hdd_context_t *hdd_ctx;
 
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
 	if (!hdd_ctx) {
 		cds_err("Invalid HDD context");
 		return CDF_STATUS_E_FAILURE;
@@ -2448,7 +2575,7 @@ CDF_STATUS cds_soc_set_hw_mode(hdd_context_t *hdd_ctx,
  *
  * Return: true if connection is in progress else false
  */
-bool cds_is_connection_in_progress(hdd_context_t *hdd_ctx)
+bool cds_is_connection_in_progress(void)
 {
 	hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
 	hdd_station_ctx_t *hdd_sta_ctx = NULL;
@@ -2456,6 +2583,13 @@ bool cds_is_connection_in_progress(hdd_context_t *hdd_ctx)
 	CDF_STATUS status = 0;
 	uint8_t sta_id = 0;
 	uint8_t *sta_mac = NULL;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return false;
+	}
 
 	if (true == hdd_ctx->btCoexModeSet) {
 		cds_info("BTCoex Mode operation in progress");
@@ -2538,7 +2672,6 @@ end:
 /**
  * cds_dump_current_concurrency_one_connection() - To dump the
  * current concurrency info with one connection
- * @hdd_ctx: HDD context
  * @cc_mode: connection string
  * @length: Maximum size of the string
  *
@@ -2546,8 +2679,8 @@ end:
  *
  * Return: length of the string
  */
-static uint32_t cds_dump_current_concurrency_one_connection(
-			hdd_context_t *hdd_ctx, char *cc_mode, uint32_t length)
+static uint32_t cds_dump_current_concurrency_one_connection(char *cc_mode,
+			uint32_t length)
 {
 	uint32_t count = 0;
 
@@ -2583,7 +2716,6 @@ static uint32_t cds_dump_current_concurrency_one_connection(
 /**
  * cds_dump_current_concurrency_two_connection() - To dump the
  * current concurrency info with two connections
- * @hdd_ctx: HDD context
  * @cc_mode: connection string
  * @length: Maximum size of the string
  *
@@ -2591,39 +2723,39 @@ static uint32_t cds_dump_current_concurrency_one_connection(
  *
  * Return: length of the string
  */
-static uint32_t cds_dump_current_concurrency_two_connection(
-			hdd_context_t *hdd_ctx, char *cc_mode, uint32_t length)
+static uint32_t cds_dump_current_concurrency_two_connection(char *cc_mode,
+			uint32_t length)
 {
 	uint32_t count = 0;
 
 	switch (conc_connection_list[1].mode) {
 	case CDS_STA_MODE:
 		count = cds_dump_current_concurrency_one_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+STA",
 					length);
 		break;
 	case CDS_SAP_MODE:
 		count = cds_dump_current_concurrency_one_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+SAP",
 					length);
 		break;
 	case CDS_P2P_CLIENT_MODE:
 		count = cds_dump_current_concurrency_one_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+P2P CLI",
 					length);
 		break;
 	case CDS_P2P_GO_MODE:
 		count = cds_dump_current_concurrency_one_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+P2P GO",
 					length);
 		break;
 	case CDS_IBSS_MODE:
 		count = cds_dump_current_concurrency_one_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+IBSS",
 					length);
 		break;
@@ -2638,7 +2770,6 @@ static uint32_t cds_dump_current_concurrency_two_connection(
 /**
  * cds_dump_current_concurrency_three_connection() - To dump the
  * current concurrency info with three connections
- * @hdd_ctx: HDD context
  * @cc_mode: connection string
  * @length: Maximum size of the string
  *
@@ -2646,39 +2777,39 @@ static uint32_t cds_dump_current_concurrency_two_connection(
  *
  * Return: length of the string
  */
-static uint32_t cds_dump_current_concurrency_three_connection(
-			hdd_context_t *hdd_ctx, char *cc_mode, uint32_t length)
+static uint32_t cds_dump_current_concurrency_three_connection(char *cc_mode,
+			uint32_t length)
 {
 	uint32_t count = 0;
 
 	switch (conc_connection_list[2].mode) {
 	case CDS_STA_MODE:
 		count = cds_dump_current_concurrency_two_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+STA",
 					length);
 		break;
 	case CDS_SAP_MODE:
 		count = cds_dump_current_concurrency_two_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+SAP",
 					length);
 		break;
 	case CDS_P2P_CLIENT_MODE:
 		count = cds_dump_current_concurrency_two_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+P2P CLI",
 					length);
 		break;
 	case CDS_P2P_GO_MODE:
 		count = cds_dump_current_concurrency_two_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+P2P GO",
 					length);
 		break;
 	case CDS_IBSS_MODE:
 		count = cds_dump_current_concurrency_two_connection(
-				hdd_ctx, cc_mode, length);
+				cc_mode, length);
 		count += strlcat(cc_mode, "+IBSS",
 					length);
 		break;
@@ -2749,29 +2880,28 @@ static void cds_dump_dbs_concurrency(char *cc_mode, uint32_t length)
 /**
  * cds_dump_current_concurrency() - To dump the current
  * concurrency combination
- * @hdd_ctx: HDD context
  *
  * This routine is called to dump the concurrency info
  *
  * Return: None
  */
-static void cds_dump_current_concurrency(hdd_context_t *hdd_ctx)
+static void cds_dump_current_concurrency(void)
 {
 	uint32_t num_connections = 0;
 	char cc_mode[CDS_MAX_CON_STRING_LEN] = {0};
 	uint32_t count = 0;
 
-	num_connections = cds_get_connection_count(hdd_ctx);
+	num_connections = cds_get_connection_count();
 
 	switch (num_connections) {
 	case 1:
-		cds_dump_current_concurrency_one_connection(hdd_ctx, cc_mode,
+		cds_dump_current_concurrency_one_connection(cc_mode,
 					sizeof(cc_mode));
 		cds_err("%s Standalone", cc_mode);
 		break;
 	case 2:
 		count = cds_dump_current_concurrency_two_connection(
-			hdd_ctx, cc_mode, sizeof(cc_mode));
+			cc_mode, sizeof(cc_mode));
 		if (conc_connection_list[0].chan ==
 			conc_connection_list[1].chan) {
 			strlcat(cc_mode, " SCC", sizeof(cc_mode));
@@ -2784,7 +2914,7 @@ static void cds_dump_current_concurrency(hdd_context_t *hdd_ctx)
 		break;
 	case 3:
 		count = cds_dump_current_concurrency_three_connection(
-			hdd_ctx, cc_mode, sizeof(cc_mode));
+			cc_mode, sizeof(cc_mode));
 		if ((conc_connection_list[0].chan ==
 			conc_connection_list[1].chan) &&
 			(conc_connection_list[0].chan ==
@@ -2815,18 +2945,17 @@ static void cds_dump_current_concurrency(hdd_context_t *hdd_ctx)
 /**
  * cds_current_concurrency_is_scc() - To check the current
  * concurrency combination if it is doing SCC
- * @hdd_ctx: HDD context
  *
  * This routine is called to check if it is doing SCC
  *
  * Return: True - SCC, False - Otherwise
  */
-static bool cds_current_concurrency_is_scc(hdd_context_t *hdd_ctx)
+static bool cds_current_concurrency_is_scc(void)
 {
 	uint32_t num_connections = 0;
 	bool is_scc = false;
 
-	num_connections = cds_get_connection_count(hdd_ctx);
+	num_connections = cds_get_connection_count();
 
 	switch (num_connections) {
 	case 1:
@@ -2859,7 +2988,6 @@ static bool cds_current_concurrency_is_scc(hdd_context_t *hdd_ctx)
 /**
  * cds_dump_legacy_concurrency() - To dump the current
  * concurrency combination
- * @hdd_ctx: HDD context
  * @sta_channel: Channel STA connection has come up
  * @ap_channel: Channel SAP connection has come up
  * @p2p_channel: Channel P2P connection has come up
@@ -2872,13 +3000,25 @@ static bool cds_current_concurrency_is_scc(hdd_context_t *hdd_ctx)
  *
  * Return: None
  */
-static void cds_dump_legacy_concurrency(hdd_context_t *hdd_ctx,
+static void cds_dump_legacy_concurrency(
 		uint8_t sta_channel, uint8_t ap_channel, uint8_t p2p_channel,
 		struct cdf_mac_addr sta_bssid, struct cdf_mac_addr p2p_bssid,
 		struct cdf_mac_addr ap_bssid, const char *p2p_mode)
 {
 	const char *cc_mode = "Standalone";
+	hdd_context_t *hdd_ctx;
 
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
+	if ((sta_channel == 0) && (ap_channel == 0) && (p2p_channel == 0)) {
+		cds_err("IBSS standalone");
+		hdd_ctx->mcc_mode = 0;
+		return;
+	}
 	if (sta_channel > 0) {
 		if (ap_channel > 0) {
 			if (p2p_channel > 0) {
@@ -2936,13 +3076,12 @@ static void cds_dump_legacy_concurrency(hdd_context_t *hdd_ctx,
 
 /**
  * cds_dump_concurrency_info() - To dump concurrency info
- * @hdd_ctx: HDD context
  *
  * This routine is called to dump the concurrency info
  *
  * Return: None
  */
-void cds_dump_concurrency_info(hdd_context_t *hdd_ctx)
+void cds_dump_concurrency_info(void)
 {
 	hdd_adapter_list_node_t *adapterNode = NULL, *pNext = NULL;
 	CDF_STATUS status;
@@ -2955,7 +3094,7 @@ void cds_dump_concurrency_info(hdd_context_t *hdd_ctx)
 	struct cdf_mac_addr apBssid = CDF_MAC_ADDR_ZERO_INITIALIZER;
 	uint8_t staChannel = 0, p2pChannel = 0, apChannel = 0;
 	const char *p2pMode = "DEV";
-
+	hdd_context_t *hdd_ctx;
 #ifdef QCA_LL_LEGACY_TX_FLOW_CONTROL
 	uint8_t targetChannel = 0;
 	uint8_t preAdapterChannel = 0;
@@ -2966,6 +3105,12 @@ void cds_dump_concurrency_info(hdd_context_t *hdd_ctx)
 	hdd_adapter_t *adapter5 = NULL;
 #endif /* QCA_LL_LEGACY_TX_FLOW_CONTROL */
 
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
 	status = hdd_get_front_adapter(hdd_ctx, &adapterNode);
 	while (NULL != adapterNode && CDF_STATUS_SUCCESS == status) {
 		adapter = adapterNode->pAdapter;
@@ -3027,7 +3172,6 @@ void cds_dump_concurrency_info(hdd_context_t *hdd_ctx)
 			}
 			break;
 		case WLAN_HDD_IBSS:
-			return; /* skip printing station message below */
 		default:
 			break;
 		}
@@ -3213,13 +3357,13 @@ void cds_dump_concurrency_info(hdd_context_t *hdd_ctx)
 		adapterNode = pNext;
 	}
 	if (hdd_ctx->config->policy_manager_enabled) {
-		cds_dump_current_concurrency(hdd_ctx);
-		hdd_ctx->mcc_mode = !cds_current_concurrency_is_scc(hdd_ctx);
+		cds_dump_current_concurrency();
+		hdd_ctx->mcc_mode = !cds_current_concurrency_is_scc();
 	} else {
 		/* hdd_ctx->mcc_mode gets updated inside below function, which
 		 *  gets used by IPA
 		 */
-		cds_dump_legacy_concurrency(hdd_ctx,
+		cds_dump_legacy_concurrency(
 			staChannel, apChannel, p2pChannel,
 			staBssid, p2pBssid, apBssid, p2pMode);
 	}
@@ -3227,20 +3371,28 @@ void cds_dump_concurrency_info(hdd_context_t *hdd_ctx)
 
 /**
  * cds_set_concurrency_mode() - To set concurrency mode
- * @hdd_ctx: HDD context
- * @mode: Concurrency mode
+ * @mode: adapter mode
  *
  * This routine is called to set the concurrency mode
  *
  * Return: NONE
  */
-void cds_set_concurrency_mode(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode)
+void cds_set_concurrency_mode(enum tCDF_ADAPTER_MODE mode)
 {
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
 	switch (mode) {
 	case CDF_STA_MODE:
 	case CDF_P2P_CLIENT_MODE:
 	case CDF_P2P_GO_MODE:
 	case CDF_SAP_MODE:
+	case CDF_IBSS_MODE:
 		hdd_ctx->concurrency_mode |= (1 << mode);
 		hdd_ctx->no_of_open_sessions[mode]++;
 		break;
@@ -3254,16 +3406,22 @@ void cds_set_concurrency_mode(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode)
 
 /**
  * cds_clear_concurrency_mode() - To clear concurrency mode
- * @hdd_ctx: HDD context
- * @mode: Concurrency mode
+ * @mode: adapter mode
  *
  * This routine is called to clear the concurrency mode
  *
  * Return: NONE
  */
-void cds_clear_concurrency_mode(hdd_context_t *hdd_ctx,
-				     tCDF_CON_MODE mode)
+void cds_clear_concurrency_mode(enum tCDF_ADAPTER_MODE mode)
 {
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
 	switch (mode) {
 	case CDF_STA_MODE:
 	case CDF_P2P_CLIENT_MODE:
@@ -3283,8 +3441,7 @@ void cds_clear_concurrency_mode(hdd_context_t *hdd_ctx,
 
 /**
  * cds_soc_set_pcl() - Sets PCL to FW
- * @hdd_ctx: HDD context
- * @mode: Connection mode
+ * @mode: adapter mode
  *
  * Fetches the PCL and sends the PCL to SME
  * module which in turn will send the WMI
@@ -3292,11 +3449,18 @@ void cds_clear_concurrency_mode(hdd_context_t *hdd_ctx,
  *
  * Return: None
  */
-static void cds_soc_set_pcl(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode)
+static void cds_soc_set_pcl(enum tCDF_ADAPTER_MODE mode)
 {
 	CDF_STATUS status;
 	enum cds_con_mode con_mode;
 	struct sir_pcl_list pcl;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
 	pcl.pcl_len = 0;
 
 	switch (mode) {
@@ -3322,7 +3486,7 @@ static void cds_soc_set_pcl(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode)
 
 	cds_debug("get pcl to set it to the FW");
 
-	status = cds_get_pcl(hdd_ctx, con_mode,
+	status = cds_get_pcl(con_mode,
 			pcl.pcl_list, &pcl.pcl_len);
 	if (status != CDF_STATUS_SUCCESS) {
 		cds_err("Unable to set PCL to FW, Get PCL failed");
@@ -3338,8 +3502,7 @@ static void cds_soc_set_pcl(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode)
 
 /**
  * cds_incr_active_session() - increments the number of active sessions
- * @hdd_ctx:	HDD Context
- * @mode:	Device mode
+ * @mode:	Adapter mode
  * @session_id: session ID for the connection session
  *
  * This function increments the number of active sessions maintained per device
@@ -3348,14 +3511,35 @@ static void cds_soc_set_pcl(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode)
  *
  * Return: None
  */
-void cds_incr_active_session(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode,
+void cds_incr_active_session(enum tCDF_ADAPTER_MODE mode,
 				  uint8_t session_id)
 {
+	hdd_context_t *hdd_ctx;
+	cds_context_type *cds_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return;
+	}
+
+	/*
+	 * Need to aquire mutex as entire functionality in this function
+	 * is in critical section
+	 */
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
 	switch (mode) {
 	case CDF_STA_MODE:
 	case CDF_P2P_CLIENT_MODE:
 	case CDF_P2P_GO_MODE:
 	case CDF_SAP_MODE:
+	case CDF_IBSS_MODE:
 		hdd_ctx->no_of_active_sessions[mode]++;
 		break;
 	default:
@@ -3368,33 +3552,38 @@ void cds_incr_active_session(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode,
 	 * Let us set the PCL to the FW before updating the connection
 	 * info structure about the new connection.
 	 */
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
 	if (mode == CDF_STA_MODE) {
 		/* Set PCL of STA to the FW */
-		cds_soc_set_pcl(hdd_ctx, mode);
+		cds_soc_set_pcl(mode);
 		cds_info("Set PCL of STA to FW");
 	}
-	cds_incr_connection_count(hdd_ctx, session_id);
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cds_incr_connection_count(session_id);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 }
 
 /**
  * cds_need_opportunistic_upgrade() - Tells us if we really
  * need an upgrade to 2x2
- * @hdd_ctx: HDD context
  *
  * This function returns if updrade to 2x2 is needed
  *
  * Return: CDS_NOP = upgrade is not needed, otherwise upgrade is
  * needed
  */
-enum cds_conc_next_action cds_need_opportunistic_upgrade(
-		hdd_context_t *hdd_ctx)
+enum cds_conc_next_action cds_need_opportunistic_upgrade(void)
 {
 	uint32_t conn_index;
 	enum cds_conc_next_action upgrade = CDS_NOP;
 	uint8_t mac = 0;
+#ifdef QCA_WIFI_3_0_EMU
+	hdd_context_t *hdd_ctx;
 
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return upgrade;
+	}
+#endif
 	if (wma_is_hw_dbs_capable() == false) {
 		cds_err("driver isn't dbs capable, no further action needed");
 		return upgrade;
@@ -3416,8 +3605,9 @@ enum cds_conc_next_action cds_need_opportunistic_upgrade(
 		}
 	}
 #ifdef QCA_WIFI_3_0_EMU
-	/* For emulation only: if we have a connection on 2.4, stay in DBS */
-	if (CDS_IS_CHANNEL_24GHZ(conc_connection_list[0].chan))
+	/* For M2M emulation only: if we have a connection on 2.4, stay in DBS */
+	if (hdd_ctx->config->enable_m2m_limitation &&
+		CDS_IS_CHANNEL_24GHZ(conc_connection_list[0].chan))
 		goto done;
 #endif
 	/* Let's request for single MAC mode */
@@ -3439,18 +3629,16 @@ done:
 
 /**
  * cds_set_pcl_for_existing_combo() - Set PCL for existing connection
- * @hdd_ctx: HDD context
  * @mode: Connection mode of type 'cds_con_mode'
  *
  * Set the PCL for an existing connection
  *
  * Return: None
  */
-static void cds_set_pcl_for_existing_combo(hdd_context_t *hdd_ctx,
-		enum cds_con_mode mode)
+static void cds_set_pcl_for_existing_combo(enum cds_con_mode mode)
 {
 	struct cds_conc_connection_info info;
-	tCDF_CON_MODE pcl_mode;
+	enum tCDF_ADAPTER_MODE pcl_mode;
 
 	switch (mode) {
 	case CDS_STA_MODE:
@@ -3473,23 +3661,20 @@ static void cds_set_pcl_for_existing_combo(hdd_context_t *hdd_ctx,
 		return;
 	};
 
-	if (cds_mode_specific_connection_count(
-				hdd_ctx, mode, NULL) > 0) {
+	if (cds_mode_specific_connection_count(mode, NULL) > 0) {
 		/* Check, store and temp delete the mode's parameter */
-		cds_store_and_del_conn_info(hdd_ctx, mode,
-				&info);
+		cds_store_and_del_conn_info(mode, &info);
 		/* Set the PCL to the FW since connection got updated */
-		cds_soc_set_pcl(hdd_ctx, pcl_mode);
+		cds_soc_set_pcl(pcl_mode);
 		cds_info("Set PCL to FW for mode:%d", mode);
 		/* Restore the connection info */
-		cds_restore_deleted_conn_info(hdd_ctx, &info);
+		cds_restore_deleted_conn_info(&info);
 	}
 }
 
 /**
  * cds_decr_session_set_pcl() - Decrement session count and set PCL
- * @hdd_ctx: HDD context
- * @mode: Connection mode
+ * @mode: Adapter mode
  * @session_id: Session id
  *
  * Decrements the active session count and sets the PCL if a STA connection
@@ -3497,14 +3682,26 @@ static void cds_set_pcl_for_existing_combo(hdd_context_t *hdd_ctx,
  *
  * Return: None
  */
-void cds_decr_session_set_pcl(hdd_context_t *hdd_ctx,
-						tCDF_CON_MODE mode,
+void cds_decr_session_set_pcl(enum tCDF_ADAPTER_MODE mode,
 						uint8_t session_id)
 {
 	CDF_STATUS cdf_status;
+	hdd_context_t *hdd_ctx;
+	cds_context_type *cds_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return;
+	}
 
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
-	cds_decr_active_session(hdd_ctx, mode, session_id);
+	cds_decr_active_session(mode, session_id);
 	/*
 	 * After the removal of this connection, we need to check if
 	 * a STA connection still exists. The reason for this is that
@@ -3519,9 +3716,10 @@ void cds_decr_session_set_pcl(hdd_context_t *hdd_ctx,
 	 * given to the FW. After setting the PCL, we need to restore
 	 * the entry that we have saved before.
 	 */
-	cds_set_pcl_for_existing_combo(hdd_ctx, CDS_STA_MODE);
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
+	cds_set_pcl_for_existing_combo(CDS_STA_MODE);
 	/* do we need to change the HW mode */
-	if (cds_need_opportunistic_upgrade(hdd_ctx)) {
+	if (cds_need_opportunistic_upgrade()) {
 		/* let's start the timer */
 		cdf_mc_timer_stop(&hdd_ctx->dbs_opportunistic_timer);
 		cdf_status = cdf_mc_timer_start(
@@ -3531,7 +3729,7 @@ void cds_decr_session_set_pcl(hdd_context_t *hdd_ctx,
 		if (!CDF_IS_STATUS_SUCCESS(cdf_status))
 			cds_err("Failed to start dbs opportunistic timer");
 	}
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 
 	return;
 }
@@ -3539,8 +3737,7 @@ void cds_decr_session_set_pcl(hdd_context_t *hdd_ctx,
 
 /**
  * cds_decr_active_session() - decrements the number of active sessions
- * @hdd_ctx:	HDD Context
- * @mode:	Device mode
+ * @mode: Adapter mode
  * @session_id: session ID for the connection session
  *
  * This function decrements the number of active sessions maintained per device
@@ -3549,14 +3746,35 @@ void cds_decr_session_set_pcl(hdd_context_t *hdd_ctx,
  *
  * Return: None
  */
-void cds_decr_active_session(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode,
+void cds_decr_active_session(enum tCDF_ADAPTER_MODE mode,
 				  uint8_t session_id)
 {
+	hdd_context_t *hdd_ctx;
+	cds_context_type *cds_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return;
+	}
+
+	/*
+	 * Need to aquire mutex as entire functionality in this function
+	 * is in critical section
+	 */
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
 	switch (mode) {
 	case CDF_STA_MODE:
 	case CDF_P2P_CLIENT_MODE:
 	case CDF_P2P_GO_MODE:
 	case CDF_SAP_MODE:
+	case CDF_IBSS_MODE:
 		if (hdd_ctx->no_of_active_sessions[mode])
 			hdd_ctx->no_of_active_sessions[mode]--;
 		break;
@@ -3565,7 +3783,8 @@ void cds_decr_active_session(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode,
 	}
 	cds_info("No.# of active sessions for mode %d = %d",
 		mode, hdd_ctx->no_of_active_sessions[mode]);
-	cds_decr_connection_count(hdd_ctx, session_id);
+	cds_decr_connection_count(session_id);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 }
 
 /**
@@ -3579,42 +3798,81 @@ void cds_decr_active_session(hdd_context_t *hdd_ctx, tCDF_CON_MODE mode,
  */
 void cds_dbs_opportunistic_timer_handler(void *data)
 {
-	hdd_context_t *hdd_ctx = (hdd_context_t *) data;
 	enum cds_conc_next_action action = CDS_NOP;
+	cds_context_type *cds_ctx;
 
-	if (NULL == hdd_ctx) {
-		cds_err("hdd_ctx is NULL");
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
 		return;
 	}
 
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
 	/* if we still need it */
-	action = cds_need_opportunistic_upgrade(hdd_ctx);
+	action = cds_need_opportunistic_upgrade();
 	if (action) {
 		/* lets call for action */
 		/* session id is being used only
 		 * in hidden ssid case for now.
 		 * So, session id 0 is ok here.
 		 */
-		cds_next_actions(hdd_ctx, 0, action,
+		cds_next_actions(0, action,
 				CDS_UPDATE_REASON_OPPORTUNISTIC);
 	}
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
+
+}
+
+/**
+ * cds_deinit_policy_mgr() - Deinitialize the policy manager
+ * related data structures
+ *
+ * Deinitialize the policy manager related data structures
+ *
+ * Return: Success if the policy manager is deinitialized completely
+ */
+CDF_STATUS cds_deinit_policy_mgr(void)
+{
+	cds_context_type *cds_ctx;
 
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return CDF_STATUS_E_FAILURE;
+	}
+	if (!CDF_IS_STATUS_SUCCESS(cdf_mutex_destroy(
+					&cds_ctx->cdf_conc_list_lock))) {
+		cds_err("Failed to destroy cdf_conc_list_lock");
+		return CDF_STATUS_E_FAILURE;
+	}
+	return CDF_STATUS_SUCCESS;
 }
 
 /**
  * cds_init_policy_mgr() - Initialize the policy manager
  * related data structures
- * @hdd_ctx:	HDD Context
  *
  * Initialize the policy manager related data structures
  *
  * Return: Success if the policy manager is initialized completely
  */
-CDF_STATUS cds_init_policy_mgr(hdd_context_t *hdd_ctx)
+CDF_STATUS cds_init_policy_mgr(void)
 {
 	CDF_STATUS status;
+	hdd_context_t *hdd_ctx;
+	cds_context_type *cds_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return CDF_STATUS_E_FAILURE;
+	}
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return CDF_STATUS_E_FAILURE;
+	}
 
 	cds_debug("Initializing the policy manager");
 
@@ -3622,8 +3880,8 @@ CDF_STATUS cds_init_policy_mgr(hdd_context_t *hdd_ctx)
 	cdf_mem_zero(conc_connection_list, sizeof(conc_connection_list));
 
 	if (!CDF_IS_STATUS_SUCCESS(cdf_mutex_init(
-					&hdd_ctx->hdd_conc_list_lock))) {
-		cds_err("Failed to init hdd_conc_list_lock");
+					&cds_ctx->cdf_conc_list_lock))) {
+		cds_err("Failed to init cdf_conc_list_lock");
 		/* Lets us not proceed further */
 		return CDF_STATUS_E_FAILURE;
 	}
@@ -3651,7 +3909,6 @@ CDF_STATUS cds_init_policy_mgr(hdd_context_t *hdd_ctx)
 /**
  * cds_get_connection_for_vdev_id() - provides the
  * perticular connection with the requested vdev id
- * @hdd_ctx:	HDD Context
  * @vdev_id: vdev id of the connection
  *
  * This function provides the specific connection with the
@@ -3659,8 +3916,7 @@ CDF_STATUS cds_init_policy_mgr(hdd_context_t *hdd_ctx)
  *
  * Return: index in the connection table
  */
-uint32_t cds_get_connection_for_vdev_id(hdd_context_t *hdd_ctx,
-						uint32_t vdev_id)
+uint32_t cds_get_connection_for_vdev_id(uint32_t vdev_id)
 {
 	uint32_t conn_index = 0;
 	for (conn_index = 0; conn_index < MAX_NUMBER_OF_CONC_CONNECTIONS;
@@ -3677,14 +3933,13 @@ uint32_t cds_get_connection_for_vdev_id(hdd_context_t *hdd_ctx,
 /**
  * cds_get_connection_count() - provides the count of
  * current connections
- * @hdd_ctx:	HDD Context
  *
  *
  * This function provides the count of current connections
  *
  * Return: connection count
  */
-uint32_t cds_get_connection_count(hdd_context_t *hdd_ctx)
+uint32_t cds_get_connection_count(void)
 {
 	uint32_t conn_index, count = 0;
 	for (conn_index = 0; conn_index < MAX_NUMBER_OF_CONC_CONNECTIONS;
@@ -3749,7 +4004,7 @@ enum cds_con_mode cds_get_mode(uint8_t type, uint8_t subtype)
 /**
  * cds_incr_connection_count() - adds the new connection to
  * the current connections list
- * @hdd_ctx:	HDD Context
+ * @vdev_id: vdev id
  *
  *
  * This function adds the new connection to the current
@@ -3757,14 +4012,27 @@ enum cds_con_mode cds_get_mode(uint8_t type, uint8_t subtype)
  *
  * Return: CDF_STATUS
  */
-CDF_STATUS cds_incr_connection_count(hdd_context_t *hdd_ctx,
-					  uint32_t vdev_id)
+CDF_STATUS cds_incr_connection_count(uint32_t vdev_id)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 	uint32_t conn_index;
 	struct wma_txrx_node *wma_conn_table_entry;
+	hdd_context_t *hdd_ctx;
+	cds_context_type *cds_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return status;
+	}
 
-	conn_index = cds_get_connection_count(hdd_ctx);
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return status;
+	}
+
+	conn_index = cds_get_connection_count();
 	if (hdd_ctx->config->gMaxConcurrentActiveSessions < conn_index) {
 		/* err msg */
 		cds_err("exceeded max connection limit %d",
@@ -3803,7 +4071,7 @@ CDF_STATUS cds_incr_connection_count(hdd_context_t *hdd_ctx,
 /**
  * cds_update_connection_info() - updates the existing
  * connection in the current connections list
- * @hdd_ctx:	HDD Context
+ * @vdev_id: vdev id
  *
  *
  * This function adds the new connection to the current
@@ -3811,15 +4079,21 @@ CDF_STATUS cds_incr_connection_count(hdd_context_t *hdd_ctx,
  *
  * Return: CDF_STATUS
  */
-CDF_STATUS cds_update_connection_info(hdd_context_t *hdd_ctx,
-					   uint32_t vdev_id)
+CDF_STATUS cds_update_connection_info(uint32_t vdev_id)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 	uint32_t conn_index = 0;
 	bool found = false;
 	struct wma_txrx_node *wma_conn_table_entry;
+	cds_context_type *cds_ctx;
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return status;
+	}
 
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
 	while (CONC_CONNECTION_LIST_VALID_INDEX(conn_index)) {
 		if (vdev_id == conc_connection_list[conn_index].vdev_id) {
 			/* debug msg */
@@ -3830,7 +4104,7 @@ CDF_STATUS cds_update_connection_info(hdd_context_t *hdd_ctx,
 	}
 	if (!found) {
 		/* err msg */
-		cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+		cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 		cds_err("can't find vdev_id %d in conc_connection_list",
 			vdev_id);
 		return status;
@@ -3840,7 +4114,7 @@ CDF_STATUS cds_update_connection_info(hdd_context_t *hdd_ctx,
 
 	if (NULL == wma_conn_table_entry) {
 		/* err msg*/
-		cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+		cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 		cds_err("can't find vdev_id %d in WMA table", vdev_id);
 		return status;
 	}
@@ -3855,14 +4129,13 @@ CDF_STATUS cds_update_connection_info(hdd_context_t *hdd_ctx,
 			wma_conn_table_entry->tx_streams,
 			wma_conn_table_entry->rx_streams,
 			wma_conn_table_entry->nss, vdev_id, true);
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 	return CDF_STATUS_SUCCESS;
 }
 
 /**
  * cds_decr_connection_count() - remove the old connection
  * from the current connections list
- * @hdd_ctx:	HDD Context
  * @vdev_id: vdev id of the old connection
  *
  *
@@ -3871,8 +4144,7 @@ CDF_STATUS cds_update_connection_info(hdd_context_t *hdd_ctx,
  *
  * Return: CDF_STATUS
  */
-CDF_STATUS cds_decr_connection_count(hdd_context_t *hdd_ctx,
-					  uint32_t vdev_id)
+CDF_STATUS cds_decr_connection_count(uint32_t vdev_id)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 	uint32_t conn_index = 0, next_conn_index = 0;
@@ -3925,7 +4197,6 @@ CDF_STATUS cds_decr_connection_count(hdd_context_t *hdd_ctx,
 /**
  * cds_get_connection_channels() - provides the channel(s)
  * on which current connection(s) is
- * @hdd_ctx:	HDD Context
  * @channels:	the channel(s) on which current connection(s) is
  * @len:	Number of channels
  * @order:	no order OR 2.4 Ghz channel followed by 5 Ghz
@@ -3937,19 +4208,12 @@ CDF_STATUS cds_decr_connection_count(hdd_context_t *hdd_ctx,
  *
  * Return: CDF_STATUS
  */
-CDF_STATUS cds_get_connection_channels(hdd_context_t *hdd_ctx,
-			uint8_t *channels, uint32_t *len, uint8_t order)
+CDF_STATUS cds_get_connection_channels(uint8_t *channels,
+			uint32_t *len, uint8_t order)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	uint32_t conn_index = 0, num_channels = 0;
 
-	if (NULL == hdd_ctx) {
-		/* err msg*/
-		cds_err("hdd_ctx is NULL");
-		status = CDF_STATUS_E_FAILURE;
-		return status;
-	}
-
 	if ((NULL == channels) || (NULL == len)) {
 		/* err msg*/
 		cds_err("channels or len is NULL");
@@ -4011,7 +4275,6 @@ CDF_STATUS cds_get_connection_channels(hdd_context_t *hdd_ctx,
 /**
  * cds_update_with_safe_channel_list() - provides the safe
  * channel list
- * @hdd_ctx:	HDD Context
  * @pcl_channels: channel list
  * @len: length of the list
  *
@@ -4021,8 +4284,7 @@ CDF_STATUS cds_get_connection_channels(hdd_context_t *hdd_ctx,
  * Return: None
  */
 #ifdef CONFIG_CNSS
-void cds_update_with_safe_channel_list(hdd_context_t *hdd_ctx,
-			uint8_t *pcl_channels, uint32_t *len)
+void cds_update_with_safe_channel_list(uint8_t *pcl_channels, uint32_t *len)
 {
 	uint16_t unsafe_channel_list[MAX_NUM_CHAN];
 	uint8_t current_channel_list[MAX_NUM_CHAN];
@@ -4070,8 +4332,7 @@ void cds_update_with_safe_channel_list(hdd_context_t *hdd_ctx,
 	return;
 }
 #else
-void cds_update_with_safe_channel_list(hdd_context_t *hdd_ctx,
-			uint8_t *pcl_channels, uint32_t *len)
+void cds_update_with_safe_channel_list(uint8_t *pcl_channels, uint32_t *len)
 {
 	return;
 }
@@ -4090,8 +4351,7 @@ void cds_update_with_safe_channel_list(hdd_context_t *hdd_ctx,
  *
  * Return: Channel List
  */
-CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
-			enum cds_pcl_type pcl,
+CDF_STATUS cds_get_channel_list(enum cds_pcl_type pcl,
 			uint8_t *pcl_channels, uint32_t *len)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
@@ -4100,10 +4360,11 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 	uint8_t channel_list[MAX_NUM_CHAN] = {0};
 	uint8_t channel_list_24[MAX_NUM_CHAN] = {0};
 	uint8_t channel_list_5[MAX_NUM_CHAN] = {0};
+	hdd_context_t *hdd_ctx;
 
-	if (NULL == hdd_ctx) {
-		/* err msg*/
-		cds_err("hdd_ctx is NULL");
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
 		return status;
 	}
 
@@ -4166,7 +4427,7 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		break;
 	case CDS_SCC_CH:
 	case CDS_MCC_CH:
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 0);
 		cdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
@@ -4174,7 +4435,7 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		break;
 	case CDS_SCC_CH_24G:
 	case CDS_MCC_CH_24G:
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 0);
 		cdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
@@ -4185,7 +4446,7 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		break;
 	case CDS_SCC_CH_5G:
 	case CDS_MCC_CH_5G:
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 0);
 		cdf_mem_copy(pcl_channels, channel_list,
 			num_channels);
@@ -4200,7 +4461,7 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		cdf_mem_copy(pcl_channels, channel_list_24,
 			chan_index_24);
 		*len = chan_index_24;
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 0);
 		cdf_mem_copy(&pcl_channels[chan_index_24],
 			channel_list, num_channels);
@@ -4212,7 +4473,7 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		cdf_mem_copy(pcl_channels, channel_list_5,
 			chan_index_5);
 		*len = chan_index_5;
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 0);
 		cdf_mem_copy(&pcl_channels[chan_index_5],
 			channel_list, num_channels);
@@ -4220,7 +4481,7 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		status = CDF_STATUS_SUCCESS;
 		break;
 	case CDS_SCC_ON_24_SCC_ON_5:
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 1);
 		cdf_mem_copy(pcl_channels, channel_list,
 			num_channels);
@@ -4228,14 +4489,14 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		status = CDF_STATUS_SUCCESS;
 		break;
 	case CDS_SCC_ON_5_SCC_ON_24:
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 2);
 		cdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
 		status = CDF_STATUS_SUCCESS;
 		break;
 	case CDS_SCC_ON_24_SCC_ON_5_24G:
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 1);
 		cdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
@@ -4245,7 +4506,7 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		status = CDF_STATUS_SUCCESS;
 		break;
 	case CDS_SCC_ON_24_SCC_ON_5_5G:
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 1);
 		cdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
@@ -4255,7 +4516,7 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		status = CDF_STATUS_SUCCESS;
 		break;
 	case CDS_SCC_ON_5_SCC_ON_24_24G:
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 2);
 		cdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
@@ -4265,7 +4526,7 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 		status = CDF_STATUS_SUCCESS;
 		break;
 	case CDS_SCC_ON_5_SCC_ON_24_5G:
-		cds_get_connection_channels(hdd_ctx,
+		cds_get_connection_channels(
 			channel_list, &num_channels, 2);
 		cdf_mem_copy(pcl_channels, channel_list, num_channels);
 		*len = num_channels;
@@ -4281,31 +4542,25 @@ CDF_STATUS cds_get_channel_list(hdd_context_t *hdd_ctx,
 	}
 
 	/* check the channel avoidance list */
-	cds_update_with_safe_channel_list(hdd_ctx, pcl_channels, len);
+	cds_update_with_safe_channel_list(pcl_channels, len);
 
 	return status;
 }
 
 /**
  * cds_map_concurrency_mode() - to map concurrency mode between sme and hdd
- * @hdd_ctx: hdd context
- * @old_mode: sme provided concurrency mode
+ * @old_mode: sme provided adapter mode
  * @new_mode: hdd provided concurrency mode
  *
  * This routine will map concurrency mode between sme and hdd
  *
  * Return: true or false
  */
-bool cds_map_concurrency_mode(hdd_context_t *hdd_ctx,
-	tCDF_CON_MODE *old_mode, enum cds_con_mode *new_mode)
+bool cds_map_concurrency_mode(enum tCDF_ADAPTER_MODE *old_mode,
+	enum cds_con_mode *new_mode)
 {
 	bool status = true;
 
-	if (!hdd_ctx) {
-		cds_err("HDD context is NULL");
-		return false;
-	}
-
 	switch (*old_mode) {
 
 	case CDF_STA_MODE:
@@ -4334,7 +4589,6 @@ bool cds_map_concurrency_mode(hdd_context_t *hdd_ctx,
 /**
  * cds_get_pcl() - provides the preferred channel list for
  * new connection
- * @hdd_ctx:	HDD Context
  * @mode:	Device mode
  * @pcl_channels: PCL channels
  * @len: lenght of the PCL
@@ -4346,7 +4600,7 @@ bool cds_map_concurrency_mode(hdd_context_t *hdd_ctx,
  *
  * Return: CDF_STATUS
  */
-CDF_STATUS cds_get_pcl(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
+CDF_STATUS cds_get_pcl(enum cds_con_mode mode,
 			uint8_t *pcl_channels, uint32_t *len)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
@@ -4356,8 +4610,16 @@ CDF_STATUS cds_get_pcl(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 	enum cds_two_connection_mode third_index = 0;
 	enum cds_pcl_type pcl = CDS_NONE;
 	enum cds_conc_priority_mode conc_system_pref = 0;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return status;
+	}
+
 	/* find the current connection state from conc_connection_list*/
-	num_connections = cds_get_connection_count(hdd_ctx);
+	num_connections = cds_get_connection_count();
 	cds_debug("connections:%d pref:%d requested mode:%d",
 		num_connections, hdd_ctx->config->conc_system_pref, mode);
 
@@ -4381,12 +4643,12 @@ CDF_STATUS cds_get_pcl(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 	switch (num_connections) {
 	case 0:
 		first_index =
-			cds_get_first_connection_pcl_table_index(hdd_ctx);
+			cds_get_first_connection_pcl_table_index();
 		pcl = first_connection_pcl_table[mode][first_index];
 		break;
 	case 1:
 		second_index =
-			cds_get_second_connection_pcl_table_index(hdd_ctx);
+			cds_get_second_connection_pcl_table_index();
 		if (CDS_MAX_ONE_CONNECTION_MODE == second_index) {
 			/* err msg */
 			cds_err("couldn't find index for 2nd connection pcl table");
@@ -4403,7 +4665,7 @@ CDF_STATUS cds_get_pcl(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 		break;
 	case 2:
 		third_index =
-			cds_get_third_connection_pcl_table_index(hdd_ctx);
+			cds_get_third_connection_pcl_table_index();
 		if (CDS_MAX_TWO_CONNECTION_MODE == third_index) {
 			/* err msg */
 			cds_err("couldn't find index for 3rd connection pcl table");
@@ -4431,7 +4693,7 @@ CDF_STATUS cds_get_pcl(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 	/* once the PCL enum is obtained find out the exact channel list with
 	 * help from sme_get_cfg_valid_channels
 	 */
-	status = cds_get_channel_list(hdd_ctx, pcl, pcl_channels, len);
+	status = cds_get_channel_list(pcl, pcl_channels, len);
 	if (status == CDF_STATUS_SUCCESS) {
 		uint32_t i;
 		cds_debug("pcl len:%d", *len);
@@ -4445,7 +4707,6 @@ CDF_STATUS cds_get_pcl(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 /**
  * cds_disallow_mcc() - Check for mcc
  *
- * @hdd_ctx:	HDD Context
  * @channel: channel on which new connection is coming up
  *
  * When a new connection is about to come up check if current
@@ -4454,7 +4715,7 @@ CDF_STATUS cds_get_pcl(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
  *
  * Return: True/False
  */
-bool cds_disallow_mcc(hdd_context_t *hdd_ctx, uint8_t channel)
+bool cds_disallow_mcc(uint8_t channel)
 {
 	uint32_t index = 0;
 	bool match = false;
@@ -4480,8 +4741,6 @@ bool cds_disallow_mcc(hdd_context_t *hdd_ctx, uint8_t channel)
 /**
  * cds_allow_new_home_channel() - Check for allowed number of
  * home channels
- *
- * @hdd_ctx:	HDD Context
  * @channel: channel on which new connection is coming up
  * @num_connections: number of current connections
  *
@@ -4491,10 +4750,18 @@ bool cds_disallow_mcc(hdd_context_t *hdd_ctx, uint8_t channel)
  *
  * Return: True/False
  */
-bool cds_allow_new_home_channel(hdd_context_t *hdd_ctx,
-			uint8_t channel, uint32_t num_connections)
+bool cds_allow_new_home_channel(uint8_t channel, uint32_t num_connections)
 {
 	bool status = true;
+#ifdef QCA_WIFI_3_0_EMU
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return false;
+	}
+#endif
 
 	if ((num_connections == 2) &&
 		(conc_connection_list[0].chan != conc_connection_list[1].chan)
@@ -4524,7 +4791,8 @@ bool cds_allow_new_home_channel(hdd_context_t *hdd_ctx,
 #ifndef QCA_WIFI_3_0_EMU
 	}
 #else
-	} else if ((num_connections == 1) &&
+	} else if (hdd_ctx->config->enable_m2m_limitation &&
+		(num_connections == 1) &&
 		(conc_connection_list[0].chan != channel)) {
 		if (((CDS_IS_CHANNEL_24GHZ(channel)) &&
 			(CDS_IS_CHANNEL_24GHZ
@@ -4542,10 +4810,43 @@ bool cds_allow_new_home_channel(hdd_context_t *hdd_ctx,
 }
 
 /**
+ * cds_is_ibss_conn_exist() - to check if IBSS connection already present
+ * @hdd_ctx: pointer to hdd context
+ * @ibss_channel: pointer to ibss channel which needs to be filled
+ *
+ * this routine will check if IBSS connection already exist or no. If it
+ * exist then this routine will return true and fill the ibss_channel value.
+ *
+ * Return: true if ibss connection exist else false
+ */
+bool cds_is_ibss_conn_exist(uint8_t *ibss_channel)
+{
+	uint32_t count = 0, index = 0;
+	uint32_t list[MAX_NUMBER_OF_CONC_CONNECTIONS];
+	bool status = false;
+
+	if (NULL == ibss_channel) {
+		cds_err("Null pointer error");
+		return false;
+	}
+	count = cds_mode_specific_connection_count(CDS_IBSS_MODE, list);
+	if (count == 0) {
+		/* No IBSS connection */
+		status = false;
+	} else if (count == 1) {
+		*ibss_channel = conc_connection_list[list[index]].chan;
+		status = true;
+	} else {
+		*ibss_channel = conc_connection_list[list[index]].chan;
+		cds_notice("Multiple IBSS connections, picking first one");
+		status = true;
+	}
+	return status;
+}
+
+/**
  * cds_allow_concurrency() - Check for allowed concurrency
  * combination
- *
- * @hdd_ctx:	HDD Context
  * @mode:	new connection mode
  * @channel: channel on which new connection is coming up
  * @bw: Bandwidth requested by the connection (optional)
@@ -4556,16 +4857,30 @@ bool cds_allow_new_home_channel(hdd_context_t *hdd_ctx,
  *
  * Return: True/False
  */
-bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
+bool cds_allow_concurrency(enum cds_con_mode mode,
 				uint8_t channel, enum hw_mode_bandwidth bw)
 {
 	uint32_t num_connections = 0, count = 0, index = 0;
 	bool status = false, match = false;
 	uint32_t list[MAX_NUMBER_OF_CONC_CONNECTIONS];
+	hdd_context_t *hdd_ctx;
+	cds_context_type *cds_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return status;
+	}
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return status;
+	}
 
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
 	/* find the current connection state from conc_connection_list*/
-	num_connections = cds_get_connection_count(hdd_ctx);
+	num_connections = cds_get_connection_count();
 
 	if (cds_max_concurrent_connections_reached()) {
 		cds_err("Reached max concurrent connections: %d",
@@ -4575,14 +4890,14 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 
 	if (channel) {
 		/* don't allow 3rd home channel on same MAC */
-		if (!cds_allow_new_home_channel(hdd_ctx, channel,
+		if (!cds_allow_new_home_channel(channel,
 			num_connections))
 				goto done;
 
 		/* don't allow MCC if SAP/GO on DFS channel or about to come up
 		* on DFS channel
 		*/
-		count = cds_mode_specific_connection_count(hdd_ctx,
+		count = cds_mode_specific_connection_count(
 				CDS_P2P_GO_MODE, list);
 		while (index < count) {
 			if ((CDS_IS_DFS_CH(
@@ -4598,7 +4913,7 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 		}
 
 		index = 0;
-		count = cds_mode_specific_connection_count(hdd_ctx,
+		count = cds_mode_specific_connection_count(
 				CDS_SAP_MODE, list);
 		while (index < count) {
 			if ((CDS_IS_DFS_CH(
@@ -4616,7 +4931,7 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 		index = 0;
 		if ((CDS_P2P_GO_MODE == mode) || (CDS_SAP_MODE == mode)) {
 			if (CDS_IS_DFS_CH(channel))
-				match = cds_disallow_mcc(hdd_ctx, channel);
+				match = cds_disallow_mcc(channel);
 		}
 		if (true == match) {
 			cds_err("No MCC, SAP/GO about to come up on DFS channel");
@@ -4626,10 +4941,10 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 
 	/* don't allow IBSS + STA MCC */
 	/* don't allow IBSS + STA SCC if IBSS is on DFS channel */
-	count = cds_mode_specific_connection_count(hdd_ctx,
+	count = cds_mode_specific_connection_count(
 			CDS_STA_MODE, list);
 	if ((CDS_IBSS_MODE == mode) &&
-		(cds_mode_specific_connection_count(hdd_ctx,
+		(cds_mode_specific_connection_count(
 		CDS_IBSS_MODE, list)) && count) {
 		/* err msg */
 		cds_err("No 2nd IBSS, we already have STA + IBSS");
@@ -4648,11 +4963,25 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 				cds_err("No IBSS, we have concurrent connections already");
 				goto done;
 			}
+#ifndef QCA_WIFI_3_0_EMU
 			if (CDS_STA_MODE != conc_connection_list[0].mode) {
 				/* err msg */
-				cds_err("No IBSS, we have a non STA connection");
+				cds_err("No IBSS, we've a non-STA connection");
 				goto done;
 			}
+#else
+			if (CDS_STA_MODE != conc_connection_list[0].mode &&
+				CDS_SAP_MODE != conc_connection_list[0].mode) {
+				/* err msg */
+				cds_err("No IBSS, we've a non-STA/SAP conn");
+				goto done;
+			}
+#endif
+			/*
+			 * This logic protects STA and IBSS to come up on same
+			 * band. If requirement changes then this condition
+			 * needs to be removed
+			 */
 			if (channel &&
 				(conc_connection_list[0].chan != channel) &&
 				CDS_IS_SAME_BAND_CHANNELS(
@@ -4667,10 +4996,9 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 			goto done;
 		}
 	}
-	count = cds_mode_specific_connection_count(hdd_ctx,
-			CDS_STA_MODE, list);
+	count = cds_mode_specific_connection_count(CDS_STA_MODE, list);
 	if ((CDS_STA_MODE == mode) &&
-		(cds_mode_specific_connection_count(hdd_ctx,
+		(cds_mode_specific_connection_count(
 		CDS_IBSS_MODE, list)) && count) {
 		/* err msg */
 		cds_err("No 2nd STA, we already have STA + IBSS");
@@ -4678,8 +5006,7 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 	}
 
 	if ((CDS_STA_MODE == mode) &&
-		(cds_mode_specific_connection_count(hdd_ctx,
-		CDS_IBSS_MODE, list))) {
+		(cds_mode_specific_connection_count(CDS_IBSS_MODE, list))) {
 		if (wma_is_hw_dbs_capable() == true) {
 			if (num_connections > 1) {
 				/* err msg */
@@ -4693,6 +5020,11 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 				cds_err("No IBSS + STA SCC/MCC, IBSS is on DFS channel");
 				goto done;
 			}
+			/*
+			 * This logic protects STA and IBSS to come up on same
+			 * band. If requirement changes then this condition
+			 * needs to be removed
+			 */
 			if ((conc_connection_list[0].chan != channel) &&
 				CDS_IS_SAME_BAND_CHANNELS(
 				conc_connection_list[0].chan, channel)) {
@@ -4718,7 +5050,7 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 	/* don't allow two P2P GO on same band */
 	if (channel && (mode == CDS_P2P_GO_MODE) && num_connections) {
 		index = 0;
-		count = cds_mode_specific_connection_count(hdd_ctx,
+		count = cds_mode_specific_connection_count(
 						CDS_P2P_GO_MODE, list);
 		while (index < count) {
 			if (CDS_IS_SAME_BAND_CHANNELS(channel,
@@ -4733,7 +5065,7 @@ bool cds_allow_concurrency(hdd_context_t *hdd_ctx, enum cds_con_mode mode,
 	status = true;
 
 done:
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 	return status;
 }
 
@@ -4741,16 +5073,22 @@ done:
  * cds_get_first_connection_pcl_table_index() - provides the
  * row index to firstConnectionPclTable to get to the correct
  * pcl
- * @hdd_ctx:	HDD Context
  *
  * This function provides the row index to
  * firstConnectionPclTable. The index is the preference config.
  *
  * Return: table index
  */
-enum cds_conc_priority_mode cds_get_first_connection_pcl_table_index(
-					hdd_context_t *hdd_ctx)
+enum cds_conc_priority_mode cds_get_first_connection_pcl_table_index(void)
 {
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return CDS_THROUGHPUT;
+	}
+
 	if (hdd_ctx->config->conc_system_pref >= CDS_MAX_CONC_PRIORITY_MODE)
 		return CDS_THROUGHPUT;
 	return hdd_ctx->config->conc_system_pref;
@@ -4760,7 +5098,6 @@ enum cds_conc_priority_mode cds_get_first_connection_pcl_table_index(
  * cds_get_second_connection_pcl_table_index() - provides the
  * row index to secondConnectionPclTable to get to the correct
  * pcl
- * @hdd_ctx:	HDD Context
  *
  * This function provides the row index to
  * secondConnectionPclTable. The index is derived based on
@@ -4769,8 +5106,7 @@ enum cds_conc_priority_mode cds_get_first_connection_pcl_table_index(
  *
  * Return: table index
  */
-enum cds_one_connection_mode cds_get_second_connection_pcl_table_index(
-					hdd_context_t *hdd_ctx)
+enum cds_one_connection_mode cds_get_second_connection_pcl_table_index(void)
 {
 	enum cds_one_connection_mode index = CDS_MAX_ONE_CONNECTION_MODE;
 
@@ -4847,7 +5183,6 @@ enum cds_one_connection_mode cds_get_second_connection_pcl_table_index(
  * cds_get_third_connection_pcl_table_index() - provides the
  * row index to thirdConnectionPclTable to get to the correct
  * pcl
- * @hdd_ctx:	HDD Context
  *
  * This function provides the row index to
  * thirdConnectionPclTable. The index is derived based on
@@ -4856,8 +5191,7 @@ enum cds_one_connection_mode cds_get_second_connection_pcl_table_index(
  *
  * Return: table index
  */
-enum cds_two_connection_mode cds_get_third_connection_pcl_table_index(
-	hdd_context_t *hdd_ctx)
+enum cds_two_connection_mode cds_get_third_connection_pcl_table_index(void)
 {
 	enum cds_one_connection_mode index = CDS_MAX_TWO_CONNECTION_MODE;
 
@@ -5191,40 +5525,6 @@ enum cds_two_connection_mode cds_get_third_connection_pcl_table_index(
 }
 
 /**
- * cds_mode_switch_dbs_to_mcc() - initiates a mode switch
- * from DBS to MCC
- * @hdd_ctx:	HDD Context
- *
- * This function initiates a mode switch from DBS to MCC if any
- * change in concurrency scenario or some other external entity
- * (looking for range, thermal mitigation etc.) made an explicit
- * request. Notifies FW as well
- *
- * Return: CDF_STATUS enum
- */
-CDF_STATUS cds_mode_switch_dbs_to_mcc(hdd_context_t *hdd_ctx)
-{
-	return CDF_STATUS_SUCCESS;
-}
-
-/**
- * cds_mode_switch_mcc_to_dbs() - initiates a mode switch
- * from MCC to DBS
- * @hdd_ctx:	HDD Context
- *
- * This function initiates a mode switch from MCC to DBS if any
- * change in concurrency scenario or some other external entity
- * (powersave, thermal mitigation etc.) made an explicit
- * request. Notifies FW as well
- *
- * Return: CDF_STATUS enum
- */
-CDF_STATUS cds_mode_switch_mcc_to_dbs(hdd_context_t *hdd_ctx)
-{
-	return CDF_STATUS_SUCCESS;
-}
-
-/**
  * cds_current_connections_update() - initiates actions
  * needed on current connections once channel has been decided
  * for the new connection
@@ -5247,9 +5547,16 @@ CDF_STATUS cds_current_connections_update(uint32_t session_id,
 	enum cds_one_connection_mode second_index = 0;
 	enum cds_two_connection_mode third_index = 0;
 	enum cds_band band;
+	cds_context_type *cds_ctx;
 	hdd_context_t *hdd_ctx;
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return status;
+	}
+
 	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
 	if (!hdd_ctx) {
 		cds_err("Invalid HDD context");
@@ -5265,8 +5572,8 @@ CDF_STATUS cds_current_connections_update(uint32_t session_id,
 	else
 		band = CDS_BAND_5;
 
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
-	num_connections = cds_get_connection_count(hdd_ctx);
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
+	num_connections = cds_get_connection_count();
 
 	cds_debug("num_connections=%d channel=%d",
 		num_connections, channel);
@@ -5275,16 +5582,17 @@ CDF_STATUS cds_current_connections_update(uint32_t session_id,
 	case 0:
 		next_action = CDS_NOP;
 #ifdef QCA_WIFI_3_0_EMU
-		/* For emulation only: if it is a connection on 2.4,
+		/* For M2M emulation only: if it is a connection on 2.4,
 		 * request DBS
 		 */
-		if (CDS_IS_CHANNEL_24GHZ(channel))
+		if (hdd_ctx->config->enable_m2m_limitation &&
+			CDS_IS_CHANNEL_24GHZ(channel))
 			next_action = CDS_DBS;
 #endif
 		break;
 	case 1:
 		second_index =
-			cds_get_second_connection_pcl_table_index(hdd_ctx);
+			cds_get_second_connection_pcl_table_index();
 		if (CDS_MAX_ONE_CONNECTION_MODE == second_index) {
 			/* err msg */
 			cds_err("couldn't find index for 2nd connection next action table");
@@ -5295,7 +5603,7 @@ CDF_STATUS cds_current_connections_update(uint32_t session_id,
 		break;
 	case 2:
 		third_index =
-			cds_get_third_connection_pcl_table_index(hdd_ctx);
+			cds_get_third_connection_pcl_table_index();
 		if (CDS_MAX_TWO_CONNECTION_MODE == third_index) {
 			/* err msg */
 			cds_err("couldn't find index for 3rd connection next action table");
@@ -5311,7 +5619,7 @@ CDF_STATUS cds_current_connections_update(uint32_t session_id,
 	}
 
 	if (CDS_NOP != next_action)
-		status = cds_next_actions(hdd_ctx, session_id,
+		status = cds_next_actions(session_id,
 						next_action, reason);
 	else
 		status = CDF_STATUS_E_NOSUPPORT;
@@ -5321,7 +5629,7 @@ CDF_STATUS cds_current_connections_update(uint32_t session_id,
 		reason, session_id);
 
 done:
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 	return status;
 }
 
@@ -5329,7 +5637,6 @@ done:
  * cds_wait_for_nss_update() - finds out if we need to wait
  * for all nss update to finish before requesting for HW mode
  * update
- * @hdd_ctx:	HDD Context
  * @action: next action to happen at policy mgr after
  *		beacon update
  *
@@ -5340,7 +5647,7 @@ done:
  * Return: boolean. True = wait for nss update, False = go ahead
  * with HW mode update
  */
-bool cds_wait_for_nss_update(hdd_context_t *hdd_ctx, uint8_t action)
+bool cds_wait_for_nss_update(uint8_t action)
 {
 	uint32_t conn_index = 0;
 	bool wait = false;
@@ -5396,7 +5703,7 @@ bool cds_wait_for_nss_update(hdd_context_t *hdd_ctx, uint8_t action)
 void cds_nss_update_cb(void *context, uint8_t tx_status, uint8_t vdev_id,
 				uint8_t next_action)
 {
-	hdd_context_t *hdd_ctx = (hdd_context_t *)context;
+	cds_context_type *cds_ctx;
 	uint32_t conn_index = 0;
 	bool wait = true;
 
@@ -5404,18 +5711,20 @@ void cds_nss_update_cb(void *context, uint8_t tx_status, uint8_t vdev_id,
 		cds_err("nss update failed for vdev %d", vdev_id);
 		return;
 	}
-	if (NULL == hdd_ctx) {
-		cds_err("NULL hdd_ctx");
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
 		return;
 	}
 
-	/**
+	/*
 	 * Check if we are ok to request for HW mode change now
 	 */
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
-	conn_index = cds_get_connection_for_vdev_id(hdd_ctx, vdev_id);
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
+	conn_index = cds_get_connection_for_vdev_id(vdev_id);
 	if (MAX_NUMBER_OF_CONC_CONNECTIONS == conn_index) {
-		cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+		cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 		cds_err("connection not found for vdev %d", vdev_id);
 		return;
 	}
@@ -5423,22 +5732,22 @@ void cds_nss_update_cb(void *context, uint8_t tx_status, uint8_t vdev_id,
 	case CDS_DBS:
 		conc_connection_list[conn_index].tx_spatial_stream = 1;
 		conc_connection_list[conn_index].rx_spatial_stream = 1;
-		wait = cds_wait_for_nss_update(hdd_ctx, next_action);
+		wait = cds_wait_for_nss_update(next_action);
 		break;
 	case CDS_MCC:
 		conc_connection_list[conn_index].tx_spatial_stream = 2;
 		conc_connection_list[conn_index].rx_spatial_stream = 2;
-		wait = cds_wait_for_nss_update(hdd_ctx, next_action);
+		wait = cds_wait_for_nss_update(next_action);
 		break;
 	default:
 		cds_err("unexpected action %d", next_action);
 		break;
 	}
 	if (!wait)
-		cds_next_actions(hdd_ctx, vdev_id,
+		cds_next_actions(vdev_id,
 				next_action,
 				CDS_UPDATE_REASON_NSS_UPDATE);
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 	return;
 }
 
@@ -5446,7 +5755,6 @@ void cds_nss_update_cb(void *context, uint8_t tx_status, uint8_t vdev_id,
  * cds_complete_action() - initiates actions needed on
  * current connections once channel has been decided for the new
  * connection
- * @hdd_ctx:	HDD Context
  * @new_nss: the new nss value
  * @next_action: next action to happen at policy mgr after
  *		beacon update
@@ -5459,8 +5767,7 @@ void cds_nss_update_cb(void *context, uint8_t tx_status, uint8_t vdev_id,
  *
  * Return: CDF_STATUS enum
  */
-CDF_STATUS cds_complete_action(hdd_context_t *hdd_ctx,
-				uint8_t  new_nss, uint8_t next_action,
+CDF_STATUS cds_complete_action(uint8_t  new_nss, uint8_t next_action,
 				enum cds_conn_update_reason reason,
 				uint32_t session_id)
 {
@@ -5468,6 +5775,13 @@ CDF_STATUS cds_complete_action(hdd_context_t *hdd_ctx,
 	uint32_t index = 0, count = 0;
 	uint32_t list[MAX_NUMBER_OF_CONC_CONNECTIONS];
 	uint32_t conn_index = 0;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return status;
+	}
 
 	if (wma_is_hw_dbs_capable() == false) {
 		cds_err("driver isn't dbs capable, no further action needed");
@@ -5479,10 +5793,10 @@ CDF_STATUS cds_complete_action(hdd_context_t *hdd_ctx,
 	 * protection. So, not taking any lock inside cds_complete_action()
 	 * during conc_connection_list access.
 	 */
-	count = cds_mode_specific_connection_count(hdd_ctx,
+	count = cds_mode_specific_connection_count(
 			CDS_P2P_GO_MODE, list);
 	while (index < count) {
-		conn_index = cds_get_connection_for_vdev_id(hdd_ctx,
+		conn_index = cds_get_connection_for_vdev_id(
 				conc_connection_list[list[index]].vdev_id);
 		if (MAX_NUMBER_OF_CONC_CONNECTIONS == conn_index) {
 			cds_err("connection not found for vdev %d",
@@ -5505,7 +5819,7 @@ CDF_STATUS cds_complete_action(hdd_context_t *hdd_ctx,
 	}
 
 	index = 0;
-	count = cds_mode_specific_connection_count(hdd_ctx,
+	count = cds_mode_specific_connection_count(
 			CDS_SAP_MODE, list);
 	while (index < count) {
 		if (1 == conc_connection_list[list[index]].original_nss) {
@@ -5522,7 +5836,7 @@ CDF_STATUS cds_complete_action(hdd_context_t *hdd_ctx,
 		index++;
 	}
 	if (!CDF_IS_STATUS_SUCCESS(status))
-		status = cds_next_actions(hdd_ctx, session_id,
+		status = cds_next_actions(session_id,
 						next_action, reason);
 
 	return status;
@@ -5532,7 +5846,6 @@ CDF_STATUS cds_complete_action(hdd_context_t *hdd_ctx,
  * cds_next_actions() - initiates actions needed on current
  * connections once channel has been decided for the new
  * connection
- * @hdd_ctx:	HDD Context
  * @session_id: Session id
  * @action: action to be executed
  * @reason: Reason for connection update
@@ -5543,8 +5856,7 @@ CDF_STATUS cds_complete_action(hdd_context_t *hdd_ctx,
  *
  * Return: CDF_STATUS enum
  */
-CDF_STATUS cds_next_actions(hdd_context_t *hdd_ctx,
-				uint32_t session_id,
+CDF_STATUS cds_next_actions(uint32_t session_id,
 				enum cds_conc_next_action action,
 				enum cds_conn_update_reason reason)
 {
@@ -5583,11 +5895,11 @@ CDF_STATUS cds_next_actions(hdd_context_t *hdd_ctx,
 		* update the beacon template & notify FW. Once FW confirms
 		*  beacon updated, send down the HW mode change req
 		*/
-		status = cds_complete_action(hdd_ctx, 1, CDS_DBS, reason,
+		status = cds_complete_action(1, CDS_DBS, reason,
 						session_id);
 		break;
 	case CDS_DBS:
-		status = cds_soc_set_hw_mode(hdd_ctx, session_id,
+		status = cds_soc_set_hw_mode(session_id,
 						HW_MODE_SS_1x1,
 						HW_MODE_80_MHZ,
 						HW_MODE_SS_1x1, HW_MODE_40_MHZ,
@@ -5601,11 +5913,11 @@ CDF_STATUS cds_next_actions(hdd_context_t *hdd_ctx,
 		* intially. If yes, update the beacon template & notify FW.
 		* Once FW confirms beacon updated, send the HW mode change req
 		*/
-		status = cds_complete_action(hdd_ctx, 0, CDS_MCC, reason,
+		status = cds_complete_action(0, CDS_MCC, reason,
 						session_id);
 		break;
 	case CDS_MCC:
-		status = cds_soc_set_hw_mode(hdd_ctx, session_id,
+		status = cds_soc_set_hw_mode(session_id,
 						HW_MODE_SS_2x2,
 						HW_MODE_80_MHZ,
 						HW_MODE_SS_0x0, HW_MODE_BW_NONE,
@@ -5648,7 +5960,7 @@ static int __cds_cfg80211_get_concurrency_matrix(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		cds_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -5781,13 +6093,12 @@ static void cds_sap_restart_handle(struct work_struct *work)
 	}
 	wlan_hdd_start_sap(sap_adapter);
 
-	cds_change_sap_restart_required_status(hdd_ctx, false);
+	cds_change_sap_restart_required_status(false);
 	cds_ssr_unprotect(__func__);
 }
 
 /**
  * cds_check_and_restart_sap() - Check and restart sap if required
- * @hdd_ctx: pointer to HDD context
  * @roam_result: Roam result
  * @hdd_sta_ctx: HDD station context
  *
@@ -5795,16 +6106,22 @@ static void cds_sap_restart_handle(struct work_struct *work)
  *
  * Return: CDF_STATUS
  */
-CDF_STATUS cds_check_and_restart_sap(hdd_context_t *hdd_ctx,
-			eCsrRoamResult roam_result,
+CDF_STATUS cds_check_and_restart_sap(eCsrRoamResult roam_result,
 			hdd_station_ctx_t *hdd_sta_ctx)
 {
 	hdd_adapter_t *sap_adapter = NULL;
 	hdd_ap_ctx_t *hdd_ap_ctx = NULL;
 	uint8_t default_sap_channel = 6;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return CDF_STATUS_E_FAILURE;
+	}
 
 	if (!(hdd_ctx->config->conc_custom_rule1 &&
-			(true == cds_is_sap_restart_required(hdd_ctx))))
+			(true == cds_is_sap_restart_required())))
 		return CDF_STATUS_SUCCESS;
 
 	sap_adapter = hdd_get_adapter(hdd_ctx, WLAN_HDD_SOFTAP);
@@ -5864,7 +6181,6 @@ CDF_STATUS cds_check_and_restart_sap(hdd_context_t *hdd_ctx,
 /**
  * cds_sta_sap_concur_handle() - This function will handle Station and sap
  * concurrency.
- * @hdd_ctx: pointer to hdd context.
  * @sta_adapter: pointer to station adapter.
  * @roam_profile: pointer to station's roam profile.
  *
@@ -5874,16 +6190,22 @@ CDF_STATUS cds_check_and_restart_sap(hdd_context_t *hdd_ctx,
  *
  * Return: true or false based on function's overall success.
  */
-static bool cds_sta_sap_concur_handle(hdd_context_t *hdd_ctx,
-		hdd_adapter_t *sta_adapter,
+static bool cds_sta_sap_concur_handle(hdd_adapter_t *sta_adapter,
 		tCsrRoamProfile *roam_profile)
 {
-	hdd_adapter_t *ap_adapter = hdd_get_adapter(hdd_ctx,
-			WLAN_HDD_SOFTAP);
+	hdd_adapter_t *ap_adapter;
 	bool are_cc_channels_same = false;
 	tScanResultHandle scan_cache = NULL;
 	CDF_STATUS status;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return are_cc_channels_same;
+	}
 
+	ap_adapter = hdd_get_adapter(hdd_ctx, WLAN_HDD_SOFTAP);
 	if ((ap_adapter != NULL) &&
 		test_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags)) {
 		status =
@@ -5911,7 +6233,7 @@ static bool cds_sta_sap_concur_handle(hdd_context_t *hdd_ctx,
 		if (false == are_cc_channels_same) {
 			cds_info("Stop AP due to mismatch with STA channel");
 			wlan_hdd_stop_sap(ap_adapter);
-			cds_change_sap_restart_required_status(hdd_ctx, true);
+			cds_change_sap_restart_required_status(true);
 			return false;
 		} else {
 			cds_info("sap channels are same");
@@ -5924,7 +6246,6 @@ static bool cds_sta_sap_concur_handle(hdd_context_t *hdd_ctx,
 /**
  * cds_sta_p2pgo_concur_handle() - This function will handle Station and GO
  * concurrency.
- * @hdd_ctx: pointer to hdd context.
  * @sta_adapter: pointer to station adapter.
  * @roam_profile: pointer to station's roam profile.
  * @roam_id: reference to roam_id variable being passed.
@@ -5936,20 +6257,25 @@ static bool cds_sta_sap_concur_handle(hdd_context_t *hdd_ctx,
  *
  * Return: true or false based on function's overall success.
  */
-static bool cds_sta_p2pgo_concur_handle(hdd_context_t *hdd_ctx,
-		hdd_adapter_t *sta_adapter,
+static bool cds_sta_p2pgo_concur_handle(hdd_adapter_t *sta_adapter,
 		tCsrRoamProfile *roam_profile,
 		uint32_t *roam_id)
 {
-	hdd_adapter_t *p2pgo_adapter = hdd_get_adapter(hdd_ctx,
-			WLAN_HDD_P2P_GO);
+	hdd_adapter_t *p2pgo_adapter;
 	bool are_cc_channels_same = false;
 	tScanResultHandle scan_cache = NULL;
 	uint32_t p2pgo_channel_num, freq;
 	tHddAvoidFreqList hdd_avoid_freq_list;
 	CDF_STATUS status;
 	bool ret;
+	hdd_context_t *hdd_ctx;
 
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return are_cc_channels_same;
+	}
+	p2pgo_adapter = hdd_get_adapter(hdd_ctx, WLAN_HDD_P2P_GO);
 	if ((p2pgo_adapter != NULL) &&
 		test_bit(SOFTAP_BSS_STARTED, &p2pgo_adapter->event_flags)) {
 		status =
@@ -5965,7 +6291,7 @@ static bool cds_sta_p2pgo_concur_handle(hdd_context_t *hdd_ctx,
 		 * channel is different or STA channel is zero.
 		 */
 		if (false == are_cc_channels_same) {
-			if (true == cds_is_sta_connection_pending(hdd_ctx)) {
+			if (true == cds_is_sta_connection_pending()) {
 				MTRACE(cdf_trace(CDF_MODULE_ID_HDD,
 					TRACE_CODE_HDD_CLEAR_JOIN_REQ,
 					sta_adapter->sessionId, *roam_id));
@@ -5976,8 +6302,7 @@ static bool cds_sta_p2pgo_concur_handle(hdd_context_t *hdd_ctx,
 					cds_err("sme_clear_joinreq_param failed");
 					/* Not returning */
 				}
-				cds_change_sta_conn_pending_status(hdd_ctx,
-						false);
+				cds_change_sta_conn_pending_status(false);
 				cds_info("===>Clear pending join req");
 			}
 			MTRACE(cdf_trace(CDF_MODULE_ID_HDD,
@@ -5994,7 +6319,7 @@ static bool cds_sta_p2pgo_concur_handle(hdd_context_t *hdd_ctx,
 				cds_err("sme_store_joinreq_param failed");
 				/* Not returning */
 			}
-			cds_change_sta_conn_pending_status(hdd_ctx, true);
+			cds_change_sta_conn_pending_status(true);
 			/*
 			 * fill frequency avoidance event and send it up, so
 			 * p2pgo stop event should get trigger from upper layer
@@ -6039,7 +6364,6 @@ static bool cds_sta_p2pgo_concur_handle(hdd_context_t *hdd_ctx,
 
 /**
  * cds_handle_conc_rule1() - Check if concurrency rule1 is enabled
- * @hdd_ctx: HDD context
  * @adapter: HDD adpater
  * @roam_profile: Profile for connection
  *
@@ -6049,11 +6373,17 @@ static bool cds_sta_p2pgo_concur_handle(hdd_context_t *hdd_ctx,
  *
  * Return: None
  */
-void cds_handle_conc_rule1(hdd_context_t *hdd_ctx,
-		hdd_adapter_t *adapter,
+void cds_handle_conc_rule1(hdd_adapter_t *adapter,
 		tCsrRoamProfile *roam_profile)
 {
 	bool ret;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
 
 	/*
 	 * Custom concurrency rule1: As per this rule if station is
@@ -6063,7 +6393,7 @@ void cds_handle_conc_rule1(hdd_context_t *hdd_ctx,
 	 */
 	if (hdd_ctx->config->conc_custom_rule1 &&
 			(WLAN_HDD_INFRA_STATION == adapter->device_mode)) {
-		ret = cds_sta_sap_concur_handle(hdd_ctx, adapter,
+		ret = cds_sta_sap_concur_handle(adapter,
 				roam_profile);
 		if (true != ret) {
 			cds_err("cds_sta_sap_concur_handle failed");
@@ -6075,7 +6405,6 @@ void cds_handle_conc_rule1(hdd_context_t *hdd_ctx,
 #ifdef FEATURE_WLAN_CH_AVOID
 /**
  * cds_handle_conc_rule2() - Check if concurrency rule2 is enabled
- * @hdd_ctx: HDD context
  * @adapter: HDD adpater
  * @roam_profile: Profile for connection
  *
@@ -6085,11 +6414,18 @@ void cds_handle_conc_rule1(hdd_context_t *hdd_ctx,
  *
  * Return: None
  */
-bool cds_handle_conc_rule2(hdd_context_t *hdd_ctx,
-		hdd_adapter_t *adapter,
+bool cds_handle_conc_rule2(hdd_adapter_t *adapter,
 		tCsrRoamProfile *roam_profile,
 		uint32_t *roam_id)
 {
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return false;
+	}
+
 	/*
 	 * Custom concurrency rule2: As per this rule if station is
 	 * trying to connect to some AP in 5Ghz and P2PGO is already in
@@ -6097,7 +6433,7 @@ bool cds_handle_conc_rule2(hdd_context_t *hdd_ctx,
 	 */
 	if (hdd_ctx->config->conc_custom_rule2 &&
 		(WLAN_HDD_INFRA_STATION == adapter->device_mode)) {
-		if (false == cds_sta_p2pgo_concur_handle(hdd_ctx,
+		if (false == cds_sta_p2pgo_concur_handle(
 					adapter, roam_profile, roam_id)) {
 			cds_err("P2PGO-STA chnl diff, cache join req");
 			return false;
@@ -6172,7 +6508,7 @@ uint8_t cds_search_and_check_for_session_conc(uint8_t session_id,
 	}
 
 	/* Take care of 160MHz and 80+80Mhz later */
-	ret = cds_allow_concurrency(hdd_ctx,
+	ret = cds_allow_concurrency(
 		cds_convert_device_mode_to_hdd_type(
 			adapter->device_mode),
 		channel, HW_MODE_20_MHZ);
@@ -6193,8 +6529,7 @@ uint8_t cds_search_and_check_for_session_conc(uint8_t session_id,
  *
  * True if the concurrency is allowed, false otherwise
  */
-bool cds_check_for_session_conc(uint8_t session_id,
-		uint8_t channel)
+bool cds_check_for_session_conc(uint8_t session_id, uint8_t channel)
 {
 	hdd_context_t *hdd_ctx;
 	hdd_adapter_t *adapter;
@@ -6218,7 +6553,7 @@ bool cds_check_for_session_conc(uint8_t session_id,
 	}
 
 	/* Take care of 160MHz and 80+80Mhz later */
-	ret = cds_allow_concurrency(hdd_ctx,
+	ret = cds_allow_concurrency(
 		cds_convert_device_mode_to_hdd_type(
 			adapter->device_mode),
 		channel, HW_MODE_20_MHZ);
@@ -6240,8 +6575,7 @@ bool cds_check_for_session_conc(uint8_t session_id,
  *
  * Return: CDF_STATUS
  */
-CDF_STATUS cds_handle_conc_multiport(uint8_t session_id,
-		uint8_t channel)
+CDF_STATUS cds_handle_conc_multiport(uint8_t session_id, uint8_t channel)
 {
 	CDF_STATUS status;
 
@@ -6270,15 +6604,20 @@ CDF_STATUS cds_handle_conc_multiport(uint8_t session_id,
  * cds_restart_softap() - restart SAP on STA channel to support
  * STA + SAP concurrency.
  *
- * @hdd_ctx: pointer to hdd context
  * @pHostapdAdapter: pointer to hdd adapter
  *
  * Return: None
  */
-void cds_restart_softap(hdd_context_t *hdd_ctx,
-		hdd_adapter_t *pHostapdAdapter)
+void cds_restart_softap(hdd_adapter_t *pHostapdAdapter)
 {
 	tHddAvoidFreqList hdd_avoid_freq_list;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
 
 	/* generate vendor specific event */
 	cdf_mem_zero((void *)&hdd_avoid_freq_list, sizeof(tHddAvoidFreqList));
@@ -6294,17 +6633,25 @@ void cds_restart_softap(hdd_context_t *hdd_ctx,
 
 /**
  * cds_force_sap_on_scc() - Force SAP on SCC
- * @hdd_ctx: Pointer to HDD context
  * @roam_result: Roam result
+ * @channel_id: STA channel id
  *
  * Restarts SAP on SCC if its operating channel is different from that of the
  * STA-AP interface
  *
  * Return: None
  */
-void cds_force_sap_on_scc(hdd_context_t *hdd_ctx, eCsrRoamResult roam_result)
+void cds_force_sap_on_scc(eCsrRoamResult roam_result,
+			 uint8_t channel_id)
 {
 	hdd_adapter_t *hostapd_adapter;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
 
 	if (!(eCSR_ROAM_RESULT_ASSOCIATED == roam_result &&
 		hdd_ctx->config->SapSccChanAvoidance)) {
@@ -6317,18 +6664,17 @@ void cds_force_sap_on_scc(hdd_context_t *hdd_ctx, eCsrRoamResult roam_result)
 		 * from AP channel.
 		 */
 		if (hostapd_adapter->sessionCtx.ap.operatingChannel !=
-				pRoamInfo->pBssDesc->channelId) {
+				channel_id) {
 			cds_err("Restart SAP: SAP channel-%d, STA channel-%d",
 				hostapd_adapter->sessionCtx.ap.operatingChannel,
-				pRoamInfo->pBssDesc->channelId);
-			cds_restart_softap(hdd_ctx, hostapd_adapter);
+				channel_id);
+			cds_restart_softap(hostapd_adapter);
 		}
 	}
 }
 #endif /* FEATURE_WLAN_FORCE_SAP_SCC */
 
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-
 /**
  * cds_check_sta_ap_concurrent_ch_intf() - Restart SAP in STA-AP case
  * @data: Pointer to STA adapter
@@ -6365,11 +6711,8 @@ static void cds_check_sta_ap_concurrent_ch_intf(void *data)
 	if (hal_handle == NULL)
 		return;
 
-#ifdef WLAN_FEATURE_MBSSID
 	intf_ch = wlansap_check_cc_intf(hdd_ap_ctx->sapContext);
-#else
-	intf_ch = wlansap_check_cc_intf(hdd_ctx->pcds_context);
-#endif
+
 	if (intf_ch == 0)
 		return;
 
@@ -6385,15 +6728,22 @@ static void cds_check_sta_ap_concurrent_ch_intf(void *data)
 }
 /**
  * cds_check_concurrent_intf_and_restart_sap() - Check concurrent change intf
- * @hdd_ctx: Pointer to HDD context
  * @hdd_sta_ctx: Pointer to HDD STA context
  *
  * Checks the concurrent change interface and restarts SAP
  * Return: None
  */
-void cds_check_concurrent_intf_and_restart_sap(hdd_context_t *hdd_ctx,
-		hdd_station_ctx_t *hdd_sta_ctx, hdd_adapter_t *adapter)
+void cds_check_concurrent_intf_and_restart_sap(hdd_station_ctx_t *hdd_sta_ctx,
+		hdd_adapter_t *adapter)
 {
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
 	if ((hdd_ctx->config->WlanMccToSccSwitchMode
 				!= CDF_MCC_TO_SCC_SWITCH_DISABLE) &&
 			((0 == hdd_ctx->config->conc_custom_rule1) &&
@@ -6403,10 +6753,10 @@ void cds_check_concurrent_intf_and_restart_sap(hdd_context_t *hdd_ctx,
 				operationChannel)
 #endif
 	   ) {
-		cdf_create_work(0, &hdd_ctx->sta_ap_intf_check_work,
+		cdf_create_work(&hdd_ctx->sta_ap_intf_check_work,
 				cds_check_sta_ap_concurrent_ch_intf,
 				(void *)adapter);
-		cdf_sched_work(0, &hdd_ctx->sta_ap_intf_check_work);
+		cdf_schedule_work(&hdd_ctx->sta_ap_intf_check_work);
 		cds_info("Checking for Concurrent Change interference");
 	}
 }
@@ -6414,7 +6764,6 @@ void cds_check_concurrent_intf_and_restart_sap(hdd_context_t *hdd_ctx,
 
 /**
  * cds_is_mcc_in_24G() - Function to check for MCC in 2.4GHz
- * @hdd_ctx:    Pointer to HDD context
  *
  * This function is used to check for MCC operation in 2.4GHz band.
  * STA, P2P and SAP adapters are only considered.
@@ -6422,7 +6771,7 @@ void cds_check_concurrent_intf_and_restart_sap(hdd_context_t *hdd_ctx,
  * Return: Non zero value if MCC is detected in 2.4GHz band
  *
  */
-uint8_t cds_is_mcc_in_24G(hdd_context_t *hdd_ctx)
+uint8_t cds_is_mcc_in_24G(void)
 {
 	CDF_STATUS status;
 	hdd_adapter_t *hdd_adapter = NULL;
@@ -6433,6 +6782,13 @@ uint8_t cds_is_mcc_in_24G(hdd_context_t *hdd_ctx)
 	uint8_t ch1 = 0, ch2 = 0;
 	uint8_t channel = 0;
 	hdd_hostapd_state_t *hostapd_state;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return 1;
+	}
 
 	status =  hdd_get_front_adapter(hdd_ctx, &adapter_node);
 
@@ -6702,7 +7058,7 @@ CDF_STATUS cds_change_mcc_go_beacon_interval(hdd_adapter_t *pHostapdAdapter)
 
 	cds_info("UPDATE Beacon Params");
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
+	if (WLAN_HDD_SOFTAP == pHostapdAdapter->device_mode) {
 		hHal = WLAN_HDD_GET_HAL_CTX(pHostapdAdapter);
 		if (NULL == hHal) {
 			cds_err("Hal ctx is null");
@@ -6896,9 +7252,7 @@ void cds_set_mcc_latency(hdd_adapter_t *adapter, int set_value)
 #if defined(FEATURE_WLAN_MCC_TO_SCC_SWITCH) || \
 			defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE)
 /**
- * cds_restart_sap() - This function is used to restart SAP in
- *                          driver internally
- *
+ * cds_restart_sap() - to restart SAP in driver internally
  * @ap_adapter: Pointer to SAP hdd_adapter_t structure
  *
  * Return: None
@@ -6913,9 +7267,11 @@ void cds_restart_sap(hdd_adapter_t *ap_adapter)
 	struct tagCsrDelStaParams delStaParams;
 #endif
 	tsap_Config_t *sap_config;
+	void *sap_ctx;
 
 	hdd_ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(ap_adapter);
-	sap_config = &ap_adapter->sessionCtx.ap.sapConfig;
+	sap_config = &hdd_ap_ctx.sapConfig;
+	sap_ctx = hdd_ap_ctx->sapContext;
 
 	mutex_lock(&hdd_ctx->sap_lock);
 	if (test_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags)) {
@@ -6933,13 +7289,7 @@ void cds_restart_sap(hdd_adapter_t *ap_adapter)
 		hdd_cleanup_actionframe(hdd_ctx, ap_adapter);
 		hostapd_state = WLAN_HDD_GET_HOSTAP_STATE_PTR(ap_adapter);
 		cdf_event_reset(&hostapd_state->cdf_stop_bss_event);
-		if (CDF_STATUS_SUCCESS == wlansap_stop_bss(
-#ifdef WLAN_FEATURE_MBSSID
-					hdd_ap_ctx->sapContext
-#else
-					hdd_ctx->pcds_context
-#endif
-					)) {
+		if (CDF_STATUS_SUCCESS == wlansap_stop_bss(sap_ctx)) {
 			cdf_status =
 				cdf_wait_single_event(&hostapd_state->
 						cdf_stop_bss_event,
@@ -6951,7 +7301,7 @@ void cds_restart_sap(hdd_adapter_t *ap_adapter)
 			}
 		}
 		clear_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags);
-		cds_decr_session_set_pcl(hdd_ctx,
+		cds_decr_session_set_pcl(
 			ap_adapter->device_mode, ap_adapter->sessionId);
 		cds_err("SAP Stop Success");
 
@@ -6962,16 +7312,9 @@ void cds_restart_sap(hdd_adapter_t *ap_adapter)
 			goto end;
 		}
 
-		if (wlansap_start_bss(
-#ifdef WLAN_FEATURE_MBSSID
-					hdd_ap_ctx->sapContext,
-#else
-					hdd_ctx->pcds_context,
-#endif
-					hdd_hostapd_sap_event_cb,
-					&hdd_ap_ctx->sapConfig,
-					ap_adapter->dev) !=
-				CDF_STATUS_SUCCESS) {
+		if (wlansap_start_bss(sap_ctx, hdd_hostapd_sap_event_cb,
+				      sap_config,
+				      ap_adapter->dev) != CDF_STATUS_SUCCESS) {
 			cds_err("SAP Start Bss fail");
 			goto end;
 		}
@@ -6986,7 +7329,7 @@ void cds_restart_sap(hdd_adapter_t *ap_adapter)
 		}
 		cds_err("SAP Start Success");
 		set_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags);
-		cds_incr_active_session(hdd_ctx, ap_adapter->device_mode,
+		cds_incr_active_session(ap_adapter->device_mode,
 					 ap_adapter->sessionId);
 		hostapd_state->bCommit = true;
 	}
@@ -6999,15 +7342,28 @@ end:
 #ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
 /**
  * cds_check_and_restart_sap_with_non_dfs_acs() - Restart SAP with non dfs acs
- * @hdd_ctx: HDD context
  *
  * Restarts SAP in non-DFS ACS mode when STA-AP mode DFS is not supported
  *
  * Return: None
  */
-void cds_check_and_restart_sap_with_non_dfs_acs(hdd_context_t *hdd_ctx)
+void cds_check_and_restart_sap_with_non_dfs_acs(void)
 {
 	hdd_adapter_t *ap_adapter;
+	hdd_context_t *hdd_ctx;
+	cds_context_type *cds_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return;
+	}
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return;
+	}
 
 	if (cds_get_concurrency_mode() != (CDF_STA_MASK | CDF_SAP_MASK)) {
 		cds_info("Concurrency mode is not SAP");
@@ -7032,15 +7388,22 @@ void cds_check_and_restart_sap_with_non_dfs_acs(hdd_context_t *hdd_ctx)
 }
 #endif
 #ifdef MPC_UT_FRAMEWORK
-CDF_STATUS cds_update_connection_info_utfw(hdd_context_t *hdd_ctx,
+CDF_STATUS cds_update_connection_info_utfw(
 		uint32_t vdev_id, uint32_t tx_streams, uint32_t rx_streams,
 		uint32_t chain_mask, uint32_t type, uint32_t sub_type,
 		uint32_t channelid, uint32_t mac_id)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 	uint32_t conn_index = 0, found = 0;
+	cds_context_type *cds_ctx;
 
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return status;
+	}
+
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
 	while (CONC_CONNECTION_LIST_VALID_INDEX(conn_index)) {
 		if (vdev_id == conc_connection_list[conn_index].vdev_id) {
 			/* debug msg */
@@ -7051,7 +7414,7 @@ CDF_STATUS cds_update_connection_info_utfw(hdd_context_t *hdd_ctx,
 	}
 	if (!found) {
 		/* err msg */
-		cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+		cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 		cds_err("can't find vdev_id %d in conc_connection_list",
 			vdev_id);
 		return status;
@@ -7062,24 +7425,38 @@ CDF_STATUS cds_update_connection_info_utfw(hdd_context_t *hdd_ctx,
 			cds_get_mode(type, sub_type),
 			channelid, mac_id, chain_mask, tx_streams,
 			rx_streams, 0, vdev_id, true);
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 
 	return CDF_STATUS_SUCCESS;
 }
 
-CDF_STATUS cds_incr_connection_count_utfw(hdd_context_t *hdd_ctx,
+CDF_STATUS cds_incr_connection_count_utfw(
 		uint32_t vdev_id, uint32_t tx_streams, uint32_t rx_streams,
 		uint32_t chain_mask, uint32_t type, uint32_t sub_type,
 		uint32_t channelid, uint32_t mac_id)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 	uint32_t conn_index = 0;
+	hdd_context_t *hdd_ctx;
+	cds_context_type *cds_ctx;
 
-	cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
-	conn_index = cds_get_connection_count(hdd_ctx);
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		cds_err("HDD context is NULL");
+		return status;
+	}
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return status;
+	}
+
+	cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
+	conn_index = cds_get_connection_count();
 	if (MAX_NUMBER_OF_CONC_CONNECTIONS <= conn_index) {
 		/* err msg */
-		cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+		cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 		cds_err("exceeded max connection limit %d",
 			MAX_NUMBER_OF_CONC_CONNECTIONS);
 		return status;
@@ -7090,33 +7467,39 @@ CDF_STATUS cds_incr_connection_count_utfw(hdd_context_t *hdd_ctx,
 			     cds_get_mode(type, sub_type),
 			     channelid, mac_id, chain_mask, tx_streams,
 			     rx_streams, 0, vdev_id, true);
-	cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+	cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 
 	return CDF_STATUS_SUCCESS;
 }
 
-CDF_STATUS cds_decr_connection_count_utfw(hdd_context_t *hdd_ctx,
-	uint32_t del_all, uint32_t vdev_id)
+CDF_STATUS cds_decr_connection_count_utfw(uint32_t del_all,
+	uint32_t vdev_id)
 {
 	CDF_STATUS status;
+	cds_context_type *cds_ctx;
+
+	cds_ctx = cds_get_context(CDF_MODULE_ID_CDF);
+	if (!cds_ctx) {
+		cds_err("Invalid CDS Context");
+		return CDF_STATUS_E_FAILURE;
+	}
 
 	if (del_all) {
-		status = cds_init_policy_mgr(hdd_ctx);
+		status = cds_init_policy_mgr();
 		if (!CDF_IS_STATUS_SUCCESS(status)) {
 			cds_err("Policy manager initialization failed");
 			return CDF_STATUS_E_FAILURE;
 		}
 	} else {
-		cdf_mutex_acquire(&hdd_ctx->hdd_conc_list_lock);
-		cds_decr_connection_count(hdd_ctx, vdev_id);
-		cdf_mutex_release(&hdd_ctx->hdd_conc_list_lock);
+		cdf_mutex_acquire(&cds_ctx->cdf_conc_list_lock);
+		cds_decr_connection_count(vdev_id);
+		cdf_mutex_release(&cds_ctx->cdf_conc_list_lock);
 	}
 
 	return CDF_STATUS_SUCCESS;
 }
 
-struct cds_conc_connection_info *cds_get_conn_info(hdd_context_t *hdd_ctx,
-		uint32_t *len)
+struct cds_conc_connection_info *cds_get_conn_info(uint32_t *len)
 {
 	struct cds_conc_connection_info *conn_ptr = &conc_connection_list[0];
 	*len = MAX_NUMBER_OF_CONC_CONNECTIONS;
@@ -7124,8 +7507,7 @@ struct cds_conc_connection_info *cds_get_conn_info(hdd_context_t *hdd_ctx,
 	return conn_ptr;
 }
 
-enum cds_pcl_type get_pcl_from_first_conn_table(
-		enum cds_con_mode type,
+enum cds_pcl_type get_pcl_from_first_conn_table(enum cds_con_mode type,
 		enum cds_conc_priority_mode sys_pref)
 {
 	if ((sys_pref >= CDS_MAX_CONC_PRIORITY_MODE) ||
@@ -7206,11 +7588,11 @@ enum cds_con_mode cds_convert_device_mode_to_hdd_type(
  * Return the connection mode parameter set by insmod or set during statically
  * linked driver
  *
- * Return: tCDF_CON_MODE
+ * Return: enum tCDF_GLOBAL_CON_MODE
  */
-tCDF_CON_MODE cds_get_conparam(void)
+enum tCDF_GLOBAL_CON_MODE cds_get_conparam(void)
 {
-	tCDF_CON_MODE con_mode;
+	enum tCDF_GLOBAL_CON_MODE con_mode;
 	con_mode = hdd_get_conparam();
 	return con_mode;
 }
@@ -7238,7 +7620,6 @@ bool cds_concurrent_open_sessions_running(void)
 	return j > 1;
 }
 
-#ifdef WLAN_FEATURE_MBSSID
 /**
  * cds_concurrent_beaconing_sessions_running() - Checks for concurrent beaconing
  * entities
@@ -7261,7 +7642,7 @@ bool cds_concurrent_beaconing_sessions_running(void)
 	}
 	return i > 1;
 }
-#endif
+
 
 /**
  * cds_max_concurrent_connections_reached() - Check if max conccurrency is
diff --git a/core/cds/src/cds_packet.c b/core/cds/src/cds_packet.c
index 70e5fc10732a..3f0ce95ae657 100644
--- a/core/cds/src/cds_packet.c
+++ b/core/cds/src/cds_packet.c
@@ -259,12 +259,9 @@ void cds_pkt_proto_trace_init(void)
 	/* Init spin lock to protect global memory */
 	cdf_spinlock_init(&trace_buffer_lock);
 	trace_buffer_order = 0;
-	trace_buffer =
-		cdf_mem_malloc(CDS_PKT_TRAC_MAX_TRACE_BUF *
-			       sizeof(cds_pkt_proto_trace_t));
-	cdf_mem_zero((void *)trace_buffer,
-		     CDS_PKT_TRAC_MAX_TRACE_BUF *
-		     sizeof(cds_pkt_proto_trace_t));
+
+	trace_buffer = cdf_mem_malloc(CDS_PKT_TRAC_MAX_TRACE_BUF *
+				      sizeof(cds_pkt_proto_trace_t));
 
 	/* Register callback function to NBUF
 	 * Lower layer event also will be reported to here */
diff --git a/core/cds/src/cds_reg_service.c b/core/cds/src/cds_reg_service.c
index f439c5971efc..b4aa41aa7b24 100644
--- a/core/cds/src/cds_reg_service.c
+++ b/core/cds/src/cds_reg_service.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -42,30 +42,20 @@
 
 #define WORLD_SKU_MASK          0x00F0
 #define WORLD_SKU_PREFIX        0x0060
-#define MAX_COUNTRY_COUNT       300
+#define REG_WAIT_TIME           50
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) || defined(WITH_BACKPORTS)
 #define IEEE80211_CHAN_PASSIVE_SCAN IEEE80211_CHAN_NO_IR
 #define IEEE80211_CHAN_NO_IBSS IEEE80211_CHAN_NO_IR
 #endif
 
-static v_REGDOMAIN_t temp_reg_domain = REGDOMAIN_COUNT;
-
-/* true if init happens thru init time driver hint */
-static bool init_by_driver = false;
-/* true if init happens thru init time  callback from regulatory core.
-   this should be set to true during driver reload */
-static bool init_by_reg_core = false;
-
-#define REG_WAIT_TIME            50
-
 #define REG_RULE_2412_2462    REG_RULE(2412-10, 2462+10, 40, 0, 20, 0)
 
 #define REG_RULE_2467_2472    REG_RULE(2467-10, 2472+10, 40, 0, 20, \
 			      NL80211_RRF_PASSIVE_SCAN)
 
 #define REG_RULE_2484         REG_RULE(2484-10, 2484+10, 40, 0, 20, \
-		       NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_OFDM)
+		NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_OFDM)
 
 #define REG_RULE_5180_5320    REG_RULE(5180-10, 5320+10, 80, 0, 20, \
 		NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS)
@@ -133,162 +123,7 @@ static const struct ieee80211_regdomain cds_world_regdom_67_68_6A_6C = {
 	}
 };
 
-typedef struct {
-	uint8_t regDomain;
-	country_code_t countryCode;
-} CountryInfo_t;
-
-typedef struct {
-	uint16_t countryCount;
-	CountryInfo_t countryInfo[MAX_COUNTRY_COUNT];
-} CountryInfoTable_t;
-
-static CountryInfoTable_t country_info_table = {
-	/* the first entry in the table is always the world domain */
-	138,
-	{
-		{REGDOMAIN_WORLD, {'0', '0'}}, /* WORLD DOMAIN */
-		{REGDOMAIN_FCC, {'A', 'D'}}, /* ANDORRA */
-		{REGDOMAIN_ETSI, {'A', 'E'}}, /* UAE */
-		{REGDOMAIN_ETSI, {'A', 'L'}}, /* ALBANIA */
-		{REGDOMAIN_ETSI, {'A', 'M'}}, /* ARMENIA */
-		{REGDOMAIN_ETSI, {'A', 'N'}}, /* NETHERLANDS ANTILLES */
-		{REGDOMAIN_FCC, {'A', 'R'}}, /* ARGENTINA */
-		{REGDOMAIN_FCC, {'A', 'S'}}, /* AMERICAN SOMOA */
-		{REGDOMAIN_ETSI, {'A', 'T'}}, /* AUSTRIA */
-		{REGDOMAIN_FCC, {'A', 'U'}}, /* AUSTRALIA */
-		{REGDOMAIN_ETSI, {'A', 'W'}}, /* ARUBA */
-		{REGDOMAIN_ETSI, {'A', 'Z'}}, /* AZERBAIJAN */
-		{REGDOMAIN_ETSI, {'B', 'A'}}, /* BOSNIA AND HERZEGOVINA */
-		{REGDOMAIN_FCC, {'B', 'B'}}, /* BARBADOS */
-		{REGDOMAIN_ETSI, {'B', 'D'}}, /* BANGLADESH */
-		{REGDOMAIN_ETSI, {'B', 'E'}}, /* BELGIUM */
-		{REGDOMAIN_ETSI, {'B', 'G'}}, /* BULGARIA */
-		{REGDOMAIN_ETSI, {'B', 'H'}}, /* BAHRAIN */
-		{REGDOMAIN_ETSI, {'B', 'L'}}, /* */
-		{REGDOMAIN_FCC, {'B', 'M'}}, /* BERMUDA */
-		{REGDOMAIN_ETSI, {'B', 'N'}}, /* BRUNEI DARUSSALAM */
-		{REGDOMAIN_ETSI, {'B', 'O'}}, /* BOLIVIA */
-		{REGDOMAIN_ETSI, {'B', 'R'}}, /* BRAZIL */
-		{REGDOMAIN_FCC, {'B', 'S'}}, /* BAHAMAS */
-		{REGDOMAIN_ETSI, {'B', 'Y'}}, /* BELARUS */
-		{REGDOMAIN_ETSI, {'B', 'Z'}}, /* BELIZE */
-		{REGDOMAIN_FCC, {'C', 'A'}}, /* CANADA */
-		{REGDOMAIN_ETSI, {'C', 'H'}}, /* SWITZERLAND */
-		{REGDOMAIN_ETSI, {'C', 'L'}}, /* CHILE */
-		{REGDOMAIN_FCC, {'C', 'N'}}, /* CHINA */
-		{REGDOMAIN_FCC, {'C', 'O'}}, /* COLOMBIA */
-		{REGDOMAIN_ETSI, {'C', 'R'}}, /* COSTA RICA */
-		{REGDOMAIN_ETSI, {'C', 'S'}},
-		{REGDOMAIN_ETSI, {'C', 'Y'}}, /* CYPRUS */
-		{REGDOMAIN_ETSI, {'C', 'Z'}}, /* CZECH REPUBLIC */
-		{REGDOMAIN_ETSI, {'D', 'E'}}, /* GERMANY */
-		{REGDOMAIN_ETSI, {'D', 'K'}}, /* DENMARK */
-		{REGDOMAIN_FCC, {'D', 'O'}}, /* DOMINICAN REPUBLIC */
-		{REGDOMAIN_ETSI, {'D', 'Z'}}, /* ALGERIA */
-		{REGDOMAIN_ETSI, {'E', 'C'}}, /* ECUADOR */
-		{REGDOMAIN_ETSI, {'E', 'E'}}, /* ESTONIA */
-		{REGDOMAIN_ETSI, {'E', 'G'}}, /* EGYPT */
-		{REGDOMAIN_ETSI, {'E', 'S'}}, /* SPAIN */
-		{REGDOMAIN_ETSI, {'F', 'I'}}, /* FINLAND */
-		{REGDOMAIN_ETSI, {'F', 'R'}}, /* FRANCE */
-		{REGDOMAIN_ETSI, {'G', 'B'}}, /* UNITED KINGDOM */
-		{REGDOMAIN_FCC, {'G', 'D'}}, /* GRENADA */
-		{REGDOMAIN_ETSI, {'G', 'E'}}, /* GEORGIA */
-		{REGDOMAIN_ETSI, {'G', 'F'}}, /* FRENCH GUIANA */
-		{REGDOMAIN_ETSI, {'G', 'L'}}, /* GREENLAND */
-		{REGDOMAIN_ETSI, {'G', 'P'}}, /* GUADELOUPE */
-		{REGDOMAIN_ETSI, {'G', 'R'}}, /* GREECE */
-		{REGDOMAIN_FCC, {'G', 'T'}}, /* GUATEMALA */
-		{REGDOMAIN_FCC, {'G', 'U'}}, /* GUAM */
-		{REGDOMAIN_ETSI, {'H', 'U'}}, /* HUNGARY */
-		{REGDOMAIN_FCC, {'I', 'D'}}, /* INDONESIA */
-		{REGDOMAIN_ETSI, {'I', 'E'}}, /* IRELAND */
-		{REGDOMAIN_ETSI, {'I', 'L'}}, /* ISRAEL */
-		{REGDOMAIN_ETSI, {'I', 'N'}}, /* INDIA */
-		{REGDOMAIN_ETSI, {'I', 'R'}}, /* IRAN, ISLAMIC REPUBLIC OF */
-		{REGDOMAIN_ETSI, {'I', 'S'}}, /* ICELNAD */
-		{REGDOMAIN_ETSI, {'I', 'T'}}, /* ITALY */
-		{REGDOMAIN_FCC, {'J', 'M'}}, /* JAMAICA */
-		{REGDOMAIN_JAPAN, {'J', 'P'}}, /* JAPAN */
-		{REGDOMAIN_ETSI, {'J', 'O'}}, /* JORDAN */
-		{REGDOMAIN_ETSI, {'K', 'E'}}, /* KENYA */
-		{REGDOMAIN_ETSI, {'K', 'H'}}, /* CAMBODIA */
-		{REGDOMAIN_ETSI, {'K', 'P'}}, /* KOREA, DEMOCRATIC PEOPLE's REPUBLIC OF */
-		{REGDOMAIN_ETSI, {'K', 'R'}}, /* KOREA, REPUBLIC OF */
-		{REGDOMAIN_ETSI, {'K', 'W'}}, /* KUWAIT */
-		{REGDOMAIN_ETSI, {'K', 'Z'}}, /* KAZAKHSTAN */
-		{REGDOMAIN_ETSI, {'L', 'B'}}, /* LEBANON */
-		{REGDOMAIN_ETSI, {'L', 'I'}}, /* LIECHTENSTEIN */
-		{REGDOMAIN_ETSI, {'L', 'K'}}, /* SRI-LANKA */
-		{REGDOMAIN_ETSI, {'L', 'T'}}, /* LITHUANIA */
-		{REGDOMAIN_ETSI, {'L', 'U'}}, /* LUXEMBOURG */
-		{REGDOMAIN_ETSI, {'L', 'V'}}, /* LATVIA */
-		{REGDOMAIN_ETSI, {'M', 'A'}}, /* MOROCCO */
-		{REGDOMAIN_ETSI, {'M', 'C'}}, /* MONACO */
-		{REGDOMAIN_ETSI, {'M', 'K'}}, /* MACEDONIA, THE FORMER YUGOSLAV REPUBLIC OF */
-		{REGDOMAIN_FCC, {'M', 'N'}}, /* MONGOLIA */
-		{REGDOMAIN_FCC, {'M', 'O'}}, /* MACAO */
-		{REGDOMAIN_FCC, {'M', 'P'}}, /* NORTHERN MARIANA ISLANDS */
-		{REGDOMAIN_ETSI, {'M', 'Q'}}, /* MARTINIQUE */
-		{REGDOMAIN_FCC, {'M', 'T'}}, /* MALTA */
-		{REGDOMAIN_ETSI, {'M', 'U'}}, /* MAURITIUS */
-		{REGDOMAIN_ETSI, {'M', 'W'}}, /* MALAWI */
-		{REGDOMAIN_FCC, {'M', 'X'}}, /* MEXICO */
-		{REGDOMAIN_ETSI, {'M', 'Y'}}, /* MALAYSIA */
-		{REGDOMAIN_ETSI, {'N', 'G'}}, /* NIGERIA */
-		{REGDOMAIN_FCC, {'N', 'I'}}, /* NICARAGUA */
-		{REGDOMAIN_ETSI, {'N', 'L'}}, /* NETHERLANDS */
-		{REGDOMAIN_ETSI, {'N', 'O'}}, /* NORWAY */
-		{REGDOMAIN_ETSI, {'N', 'P'}}, /* NEPAL */
-		{REGDOMAIN_FCC, {'N', 'Z'}}, /* NEW-ZEALAND */
-		{REGDOMAIN_FCC, {'O', 'M'}}, /* OMAN */
-		{REGDOMAIN_FCC, {'P', 'A'}}, /* PANAMA */
-		{REGDOMAIN_ETSI, {'P', 'E'}}, /* PERU */
-		{REGDOMAIN_ETSI, {'P', 'F'}}, /* FRENCH POLYNESIA */
-		{REGDOMAIN_ETSI, {'P', 'G'}}, /* PAPUA NEW GUINEA */
-		{REGDOMAIN_FCC, {'P', 'H'}}, /* PHILIPPINES */
-		{REGDOMAIN_ETSI, {'P', 'K'}}, /* PAKISTAN */
-		{REGDOMAIN_ETSI, {'P', 'L'}}, /* POLAND */
-		{REGDOMAIN_FCC, {'P', 'R'}}, /* PUERTO RICO */
-		{REGDOMAIN_FCC, {'P', 'S'}}, /* PALESTINIAN TERRITORY, OCCUPIED */
-		{REGDOMAIN_ETSI, {'P', 'T'}}, /* PORTUGAL */
-		{REGDOMAIN_FCC, {'P', 'Y'}}, /* PARAGUAY */
-		{REGDOMAIN_ETSI, {'Q', 'A'}}, /* QATAR */
-		{REGDOMAIN_ETSI, {'R', 'E'}}, /* REUNION */
-		{REGDOMAIN_ETSI, {'R', 'O'}}, /* ROMAINIA */
-		{REGDOMAIN_ETSI, {'R', 'S'}}, /* SERBIA */
-		{REGDOMAIN_ETSI, {'R', 'U'}}, /* RUSSIA */
-		{REGDOMAIN_FCC, {'R', 'W'}}, /* RWANDA */
-		{REGDOMAIN_ETSI, {'S', 'A'}}, /* SAUDI ARABIA */
-		{REGDOMAIN_ETSI, {'S', 'E'}}, /* SWEDEN */
-		{REGDOMAIN_ETSI, {'S', 'G'}}, /* SINGAPORE */
-		{REGDOMAIN_ETSI, {'S', 'I'}}, /* SLOVENNIA */
-		{REGDOMAIN_ETSI, {'S', 'K'}}, /* SLOVAKIA */
-		{REGDOMAIN_ETSI, {'S', 'V'}}, /* EL SALVADOR */
-		{REGDOMAIN_ETSI, {'S', 'Y'}}, /* SYRIAN ARAB REPUBLIC */
-		{REGDOMAIN_ETSI, {'T', 'H'}}, /* THAILAND */
-		{REGDOMAIN_ETSI, {'T', 'N'}}, /* TUNISIA */
-		{REGDOMAIN_ETSI, {'T', 'R'}}, /* TURKEY */
-		{REGDOMAIN_ETSI, {'T', 'T'}}, /* TRINIDAD AND TOBAGO */
-		{REGDOMAIN_FCC, {'T', 'W'}}, /* TAIWAN, PRIVINCE OF CHINA */
-		{REGDOMAIN_FCC, {'T', 'Z'}}, /* TANZANIA, UNITED REPUBLIC OF */
-		{REGDOMAIN_ETSI, {'U', 'A'}}, /* UKRAINE */
-		{REGDOMAIN_ETSI, {'U', 'G'}}, /* UGANDA */
-		{REGDOMAIN_FCC, {'U', 'S'}}, /* USA */
-		{REGDOMAIN_ETSI, {'U', 'Y'}}, /* URUGUAY */
-		{REGDOMAIN_FCC, {'U', 'Z'}}, /* UZBEKISTAN */
-		{REGDOMAIN_ETSI, {'V', 'E'}}, /* VENEZUELA */
-		{REGDOMAIN_FCC, {'V', 'I'}}, /* VIRGIN ISLANDS, US */
-		{REGDOMAIN_ETSI, {'V', 'N'}}, /* VIETNAM */
-		{REGDOMAIN_ETSI, {'Y', 'E'}}, /* YEMEN */
-		{REGDOMAIN_ETSI, {'Y', 'T'}}, /* MAYOTTE */
-		{REGDOMAIN_ETSI, {'Z', 'A'}}, /* SOUTH AFRICA */
-		{REGDOMAIN_ETSI, {'Z', 'W'}}, /* ZIMBABWE */
-	}
-};
-
-const tRfChannelProps rf_channels[NUM_RF_CHANNELS] = {
+const struct chan_map chan_mapping[NUM_RF_CHANNELS] = {
 	{2412, 1},
 	{2417, 2},
 	{2422, 3},
@@ -303,13 +138,6 @@ const tRfChannelProps rf_channels[NUM_RF_CHANNELS] = {
 	{2467, 12},
 	{2472, 13},
 	{2484, 14},
-	{4920, 240},
-	{4940, 244},
-	{4960, 248},
-	{4980, 252},
-	{5040, 208},
-	{5060, 212},
-	{5080, 216},
 	{5180, 36},
 	{5200, 40},
 	{5220, 44},
@@ -359,11 +187,6 @@ const tRfChannelProps rf_channels[NUM_RF_CHANNELS] = {
 	{2452, 9},
 	{2457, 10},
 	{2462, 11},
-	{4930, 242},
-	{4950, 246},
-	{4970, 250},
-	{5050, 210},
-	{5070, 214},
 	{5190, 38},
 	{5210, 42},
 	{5230, 46},
@@ -385,27 +208,12 @@ const tRfChannelProps rf_channels[NUM_RF_CHANNELS] = {
 	{5755, 151},
 	{5775, 155},
 	{5795, 159},
-	{5815, 163,                },
+	{5815, 163},
 };
 
-static t_reg_table reg_table;
-
-const sRegulatoryChannel *reg_channels =
-	reg_table.regDomains[0].channels;
-
-
-/**
- * cds_is_wwr_sku() - is regdomain world sku
- * @regd: integer regulatory domain
- *
- * Return: bool
- */
-static inline bool cds_is_wwr_sku(u16 regd)
-{
-	return ((regd & COUNTRY_ERD_FLAG) != COUNTRY_ERD_FLAG) &&
-	       (((regd & WORLD_SKU_MASK) == WORLD_SKU_PREFIX) ||
-		(regd == WORLD));
-}
+struct regulatory_channel reg_channels[NUM_RF_CHANNELS];
+static bool init_by_driver;
+static bool init_by_reg_core;
 
 /**
  * cds_is_world_regdomain() - whether world regdomain
@@ -413,9 +221,14 @@ static inline bool cds_is_wwr_sku(u16 regd)
  *
  * Return: bool
  */
-bool cds_is_world_regdomain(uint32_t regd)
+bool cds_is_world_regdomain(uint32_t reg_domain)
 {
-	return cds_is_wwr_sku(regd & ~WORLDWIDE_ROAMING_FLAG);
+	uint32_t temp_regd = reg_domain & ~WORLDWIDE_ROAMING_FLAG;
+
+	return ((temp_regd & COUNTRY_ERD_FLAG) != COUNTRY_ERD_FLAG) &&
+		(((temp_regd & WORLD_SKU_MASK) == WORLD_SKU_PREFIX) ||
+		 (temp_regd == WORLD));
+
 }
 
 
@@ -546,11 +359,11 @@ static void cds_update_regulatory_info(hdd_context_t *hdd_ctx)
  *
  * Return: CDF_STATUS_SUCCESS
  */
-CDF_STATUS cds_get_channel_list_with_power(tChannelListWithPower *
-					   base_channels,
+CDF_STATUS cds_get_channel_list_with_power(struct channel_power
+					   *base_channels,
 					   uint8_t *num_base_channels,
-					   tChannelListWithPower *
-					   channels_40mhz,
+					   struct channel_power
+					   *channels_40mhz,
 					   uint8_t *num_40mhz_channels)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
@@ -559,19 +372,19 @@ CDF_STATUS cds_get_channel_list_with_power(tChannelListWithPower *
 	if (base_channels && num_base_channels) {
 		count = 0;
 		for (i = 0; i <= RF_CHAN_14; i++) {
-			if (reg_channels[i].enabled) {
-				base_channels[count].chanId =
-					rf_channels[i].channelNum;
-				base_channels[count++].pwr =
-					reg_channels[i].pwrLimit;
+			if (reg_channels[i].state) {
+				base_channels[count].chan_num =
+					chan_mapping[i].chan_num;
+				base_channels[count++].power =
+					reg_channels[i].pwr_limit;
 			}
 		}
 		for (i = RF_CHAN_36; i <= RF_CHAN_184; i++) {
-			if (reg_channels[i].enabled) {
-				base_channels[count].chanId =
-					rf_channels[i].channelNum;
-				base_channels[count++].pwr =
-					reg_channels[i].pwrLimit;
+			if (reg_channels[i].state) {
+				base_channels[count].chan_num =
+					chan_mapping[i].chan_num;
+				base_channels[count++].power =
+					reg_channels[i].pwr_limit;
 			}
 		}
 		*num_base_channels = count;
@@ -581,20 +394,20 @@ CDF_STATUS cds_get_channel_list_with_power(tChannelListWithPower *
 		count = 0;
 
 		for (i = RF_CHAN_BOND_3; i <= RF_CHAN_BOND_11; i++) {
-			if (reg_channels[i].enabled) {
-				channels_40mhz[count].chanId =
-					rf_channels[i].channelNum;
-				channels_40mhz[count++].pwr =
-					reg_channels[i].pwrLimit;
+			if (reg_channels[i].state) {
+				channels_40mhz[count].chan_num =
+					chan_mapping[i].chan_num;
+				channels_40mhz[count++].power =
+					reg_channels[i].pwr_limit;
 			}
 		}
 
 		for (i = RF_CHAN_BOND_38; i <= RF_CHAN_BOND_163; i++) {
-			if (reg_channels[i].enabled) {
-				channels_40mhz[count].chanId =
-					rf_channels[i].channelNum;
-				channels_40mhz[count++].pwr =
-					reg_channels[i].pwrLimit;
+			if (reg_channels[i].state) {
+				channels_40mhz[count].chan_num =
+					chan_mapping[i].chan_num;
+				channels_40mhz[count++].power =
+					reg_channels[i].pwr_limit;
 			}
 		}
 		*num_40mhz_channels = count;
@@ -609,19 +422,27 @@ CDF_STATUS cds_get_channel_list_with_power(tChannelListWithPower *
  *
  * Return: CDF_STATUS
  */
-CDF_STATUS cds_read_default_country(country_code_t default_country)
+CDF_STATUS cds_read_default_country(uint8_t *default_country)
 {
-	CDF_STATUS status = CDF_STATUS_SUCCESS;
+	hdd_context_t *hdd_ctx;
+
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	if (!hdd_ctx) {
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
+			  "invalid hdd_ctx pointer");
+		return CDF_STATUS_E_FAULT;
+	}
 
 	memcpy(default_country,
-	       reg_table.default_country,
-	       sizeof(country_code_t));
+	       hdd_ctx->reg.def_country,
+	       CDS_COUNTRY_CODE_LEN + 1);
 
-	pr_info("DefaultCountry is %c%c\n",
-		default_country[0],
-		default_country[1]);
+	CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_INFO,
+		  "default country is %c%c\n",
+		  default_country[0],
+		  default_country[1]);
 
-	return status;
+	return CDF_STATUS_SUCCESS;
 }
 
 /**
@@ -630,12 +451,12 @@ CDF_STATUS cds_read_default_country(country_code_t default_country)
  *
  * Return: enum for the channel
  */
-static eRfChannels cds_get_channel_enum(uint32_t chan_num)
+static enum channel_enum cds_get_channel_enum(uint32_t chan_num)
 {
 	uint32_t loop;
 
 	for (loop = 0; loop <= RF_CHAN_184; loop++)
-		if (rf_channels[loop].channelNum == chan_num)
+		if (chan_mapping[loop].chan_num == chan_num)
 			return loop;
 
 	CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
@@ -647,19 +468,19 @@ static eRfChannels cds_get_channel_enum(uint32_t chan_num)
 
 /**
  * cds_get_channel_state() - get the channel state
- * @channel_num: channel number
+ * @chan_num: channel number
  *
- * Return: CHANNEL_STATE
+ * Return: channel state
  */
-CHANNEL_STATE cds_get_channel_state(uint32_t chan_num)
+enum channel_state cds_get_channel_state(uint32_t chan_num)
 {
-	eRfChannels chan_enum;
+	enum channel_enum chan_enum;
 
 	chan_enum = cds_get_channel_enum(chan_num);
 	if (INVALID_RF_CHANNEL == chan_enum)
 		return CHANNEL_STATE_INVALID;
 	else
-		return reg_channels[chan_enum].enabled;
+		return reg_channels[chan_enum].state;
 }
 
 
@@ -667,19 +488,19 @@ CHANNEL_STATE cds_get_channel_state(uint32_t chan_num)
  * cds_get_bonded_channel_state() - get the bonded channel state
  * @channel_num: channel number
  *
- * Return: CHANNEL_STATE
+ * Return: channel state
  */
-CHANNEL_STATE cds_get_bonded_channel_state(uint32_t chan_num,
+enum channel_state cds_get_bonded_channel_state(uint32_t chan_num,
 					   enum channel_width ch_width)
 {
-	eRfChannels chan_enum;
+	enum channel_enum chan_enum;
 	bool bw_enabled = false;
 
 	chan_enum = cds_get_channel_enum(chan_num);
 	if (INVALID_RF_CHANNEL == chan_enum)
 		return CHANNEL_STATE_INVALID;
 
-	if (reg_channels[chan_enum].enabled) {
+	if (reg_channels[chan_enum].state) {
 		if (CHAN_WIDTH_5MHZ == ch_width)
 			bw_enabled = 1;
 		else if (CHAN_WIDTH_10MHZ == ch_width)
@@ -700,7 +521,7 @@ CHANNEL_STATE cds_get_bonded_channel_state(uint32_t chan_num,
 	}
 
 	if (bw_enabled)
-		return reg_channels[chan_enum].enabled;
+		return reg_channels[chan_enum].state;
 	else
 		return CHANNEL_STATE_DISABLE;
 }
@@ -713,13 +534,13 @@ CHANNEL_STATE cds_get_bonded_channel_state(uint32_t chan_num,
  */
 enum channel_width cds_get_max_channel_bw(uint32_t chan_num)
 {
-	eRfChannels chan_enum;
+	enum channel_enum chan_enum;
 	enum channel_width chan_bw = CHAN_WIDTH_0MHZ;
 
 	chan_enum = cds_get_channel_enum(chan_num);
 
 	if ((INVALID_RF_CHANNEL != chan_enum) &&
-	    (CHANNEL_STATE_DISABLE != reg_channels[chan_enum].enabled)) {
+	    (CHANNEL_STATE_DISABLE != reg_channels[chan_enum].state)) {
 
 		if (!(reg_channels[chan_enum].flags &
 		      IEEE80211_CHAN_NO_160MHZ))
@@ -755,10 +576,6 @@ static int cds_bw20_ch_index_to_bw40_ch_index(int k)
 		m = k - RF_CHAN_1 + RF_CHAN_BOND_3;
 		if (m > RF_CHAN_BOND_11)
 			m = RF_CHAN_BOND_11;
-	} else if (k >= RF_CHAN_240 && k <= RF_CHAN_216) {
-		m = k - RF_CHAN_240 + RF_CHAN_BOND_242;
-		if (m > RF_CHAN_BOND_214)
-			m = RF_CHAN_BOND_214;
 	} else if (k >= RF_CHAN_36 && k <= RF_CHAN_64) {
 		m = k - RF_CHAN_36 + RF_CHAN_BOND_38;
 		if (m > RF_CHAN_BOND_62)
@@ -786,31 +603,31 @@ static int cds_bw20_ch_index_to_bw40_ch_index(int k)
  */
 CDF_STATUS cds_set_dfs_region(uint8_t dfs_region)
 {
-	hdd_context_t *hdd_ctx_ptr = NULL;
+	hdd_context_t *hdd_ctx;
 
-	hdd_ctx_ptr = cds_get_context(CDF_MODULE_ID_HDD);
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
 
-	if (NULL == hdd_ctx_ptr)
+	if (NULL == hdd_ctx)
 		return CDF_STATUS_E_EXISTS;
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) || defined(WITH_BACKPORTS)
-	hdd_ctx_ptr->reg.dfs_region = dfs_region;
+	hdd_ctx->reg.dfs_region = dfs_region;
 #else
 
 	/* remap the ctl code to dfs region code */
-	switch (hdd_ctx_ptr->reg.ctl_5g) {
+	switch (hdd_ctx->reg.ctl_5g) {
 	case FCC:
-		hdd_ctx_ptr->reg.dfs_region = DFS_FCC_DOMAIN;
+		hdd_ctx->reg.dfs_region = DFS_FCC_DOMAIN;
 		break;
 	case ETSI:
-		hdd_ctx_ptr->reg.dfs_region = DFS_ETSI_DOMAIN;
+		hdd_ctx->reg.dfs_region = DFS_ETSI_DOMAIN;
 		break;
 	case MKK:
-		hdd_ctx_ptr->reg.dfs_region = DFS_MKK4_DOMAIN;
+		hdd_ctx->reg.dfs_region = DFS_MKK4_DOMAIN;
 		break;
 	default:
 		/* set default dfs_region to FCC */
-		hdd_ctx_ptr->reg.dfs_region = DFS_FCC_DOMAIN;
+		hdd_ctx->reg.dfs_region = DFS_FCC_DOMAIN;
 		break;
 	}
 #endif
@@ -826,14 +643,14 @@ CDF_STATUS cds_set_dfs_region(uint8_t dfs_region)
  */
 CDF_STATUS cds_get_dfs_region(uint8_t *dfs_region)
 {
-	hdd_context_t *hdd_ctx_ptr = NULL;
+	hdd_context_t *hdd_ctx;
 
-	hdd_ctx_ptr = cds_get_context(CDF_MODULE_ID_HDD);
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
 
-	if (NULL == hdd_ctx_ptr)
+	if (NULL == hdd_ctx)
 		return CDF_STATUS_E_EXISTS;
 
-	*dfs_region = hdd_ctx_ptr->reg.dfs_region;
+	*dfs_region = hdd_ctx->reg.dfs_region;
 
 	return CDF_STATUS_SUCCESS;
 }
@@ -847,14 +664,11 @@ CDF_STATUS cds_get_dfs_region(uint8_t *dfs_region)
  *         CDF_STATUS_E_EMPTY country table empty
  */
 CDF_STATUS cds_get_reg_domain_from_country_code(v_REGDOMAIN_t *reg_domain_ptr,
-						const country_code_t
-						country_code,
-						v_CountryInfoSource_t source)
+						const uint8_t *country_alpha2,
+						enum country_src source)
 {
-	v_CONTEXT_t cds_context = NULL;
 	hdd_context_t *hdd_ctx = NULL;
 	struct wiphy *wiphy = NULL;
-	int i;
 
 	if (NULL == reg_domain_ptr) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
@@ -862,26 +676,24 @@ CDF_STATUS cds_get_reg_domain_from_country_code(v_REGDOMAIN_t *reg_domain_ptr,
 		return CDF_STATUS_E_FAULT;
 	}
 
-	*reg_domain_ptr = REGDOMAIN_COUNT;
+	*reg_domain_ptr = 0;
 
-	if (NULL == country_code) {
+	if (SOURCE_QUERY == source)
+		return CDF_STATUS_SUCCESS;
+
+	if (NULL == country_alpha2) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 			  ("Country code array is NULL"));
 		return CDF_STATUS_E_FAULT;
 	}
 
-	if (0 == country_info_table.countryCount) {
+	if (cds_is_driver_recovering()) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  ("Reg domain table is empty"));
-		return CDF_STATUS_E_EMPTY;
+			  "SSR in progress, return");
+		return CDF_STATUS_SUCCESS;
 	}
 
-	cds_context = cds_get_global_context();
-
-	if (NULL != cds_context)
-		hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
-	else
-		return CDF_STATUS_E_EXISTS;
+	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
 
 	if (NULL == hdd_ctx) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
@@ -891,51 +703,19 @@ CDF_STATUS cds_get_reg_domain_from_country_code(v_REGDOMAIN_t *reg_domain_ptr,
 
 	wiphy = hdd_ctx->wiphy;
 
-	if (cds_is_logp_in_progress()) {
-		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  "SSR in progress, return");
-		*reg_domain_ptr = temp_reg_domain;
-		return CDF_STATUS_SUCCESS;
-	}
-
-	temp_reg_domain = REGDOMAIN_COUNT;
-	for (i = 0; i < country_info_table.countryCount &&
-	     REGDOMAIN_COUNT == temp_reg_domain; i++) {
-		if (memcmp(country_code,
-			   country_info_table.countryInfo[i].countryCode,
-			    CDS_COUNTRY_CODE_LEN) == 0) {
-
-			temp_reg_domain =
-				country_info_table.countryInfo[i].regDomain;
-			break;
-		}
-	}
-
-	if (REGDOMAIN_COUNT == temp_reg_domain) {
-		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  ("Country does not map to any Regulatory domain"));
-		temp_reg_domain = REGDOMAIN_WORLD;
-	}
-
-	if (COUNTRY_QUERY == source) {
-		*reg_domain_ptr = temp_reg_domain;
-		return CDF_STATUS_SUCCESS;
-	}
-
-	if ((COUNTRY_INIT == source) && (false == init_by_reg_core)) {
+	if ((SOURCE_DRIVER == source) && (false == init_by_reg_core)) {
 		init_by_driver = true;
-		if (('0' != country_code[0]) || ('0' != country_code[1])) {
+		if (('0' != country_alpha2[0]) || ('0' != country_alpha2[1])) {
 			INIT_COMPLETION(hdd_ctx->reg_init);
-			regulatory_hint(wiphy, country_code);
+			regulatory_hint(wiphy, country_alpha2);
 			wait_for_completion_timeout(&hdd_ctx->reg_init,
 					       msecs_to_jiffies(REG_WAIT_TIME));
 		}
-	} else if (COUNTRY_IE == source || COUNTRY_USER == source) {
-		regulatory_hint_user(country_code,
+	} else if (SOURCE_11D == source || SOURCE_USERSPACE == source) {
+		regulatory_hint_user(country_alpha2,
 				     NL80211_USER_REG_HINT_USER);
 	}
 
-	*reg_domain_ptr = temp_reg_domain;
 	return CDF_STATUS_SUCCESS;
 }
 
@@ -948,26 +728,13 @@ CDF_STATUS cds_get_reg_domain_from_country_code(v_REGDOMAIN_t *reg_domain_ptr,
  */
 bool cds_is_dsrc_channel(uint16_t center_freq)
 {
-	switch (center_freq) {
-	case 5852:
-	case 5860:
-	case 5870:
-	case 5880:
-	case 5890:
-	case 5900:
-	case 5910:
-	case 5920:
-	case 5875:
-	case 5905:
+	if (center_freq >= 5852 &&
+	    center_freq <= 5920)
 		return 1;
-	}
+
 	return 0;
 }
 
-#ifdef FEATURE_STATICALLY_ADD_11P_CHANNELS
-#define DEFAULT_11P_POWER (30)
-#endif
-
 /**
  * cds_process_regulatory_data() - process regulatory data
  * @wiphy: wiphy
@@ -976,16 +743,15 @@ bool cds_is_dsrc_channel(uint16_t center_freq)
  * Return: int
  */
 static int cds_process_regulatory_data(struct wiphy *wiphy,
-				       uint8_t band_capability, bool reset)
+				       uint8_t band_capability,
+				       bool reset)
 {
 	int i, j, m;
 	int k = 0, n = 0;
 	hdd_context_t *hdd_ctx;
 	const struct ieee80211_reg_rule *reg_rule;
 	struct ieee80211_channel *chan;
-	sRegulatoryChannel *temp_chan_k;
-	sRegulatoryChannel *temp_chan_n;
-	sRegulatoryChannel *temp_chan;
+	struct regulatory_channel *temp_chan_k, *temp_chan_n, *temp_chan;
 
 	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
 	if (NULL == hdd_ctx) {
@@ -1023,13 +789,8 @@ static int cds_process_regulatory_data(struct wiphy *wiphy,
 			n = cds_bw20_ch_index_to_bw40_ch_index(k);
 
 			chan = &(wiphy->bands[i]->channels[j]);
-			temp_chan_k =
-				&(reg_table.regDomains[temp_reg_domain].
-				  channels[k]);
-
-			temp_chan_n =
-				&(reg_table.regDomains[temp_reg_domain].
-				  channels[n]);
+			temp_chan_k = &(reg_channels[k]);
+			temp_chan_n = &(reg_channels[n]);
 
 			if ((!reset) &&
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) || defined(WITH_BACKPORTS)
@@ -1086,21 +847,12 @@ static int cds_process_regulatory_data(struct wiphy *wiphy,
 				}
 			}
 
-#ifdef FEATURE_STATICALLY_ADD_11P_CHANNELS
-			if (is_dsrc_channel(chan->center_freq)) {
-				temp_chan_k->enabled =
-					CHANNEL_STATE_ENABLE;
-				temp_chan_k->pwrLimit =
-					DEFAULT_11P_POWER;
-				temp_chan_k->flags = chan->flags;
-			} else
-#endif
 			if (chan->flags & IEEE80211_CHAN_DISABLED) {
-				temp_chan_k->enabled =
+				temp_chan_k->state =
 					CHANNEL_STATE_DISABLE;
 				temp_chan_k->flags = chan->flags;
 				if (n != -1) {
-					temp_chan_n->enabled =
+					temp_chan_n->state =
 						CHANNEL_STATE_DISABLE;
 					temp_chan_n->flags = chan->flags;
 				}
@@ -1119,8 +871,8 @@ static int cds_process_regulatory_data(struct wiphy *wiphy,
 					chan->flags |=
 						IEEE80211_CHAN_PASSIVE_SCAN;
 #endif
-				temp_chan_k->enabled = CHANNEL_STATE_DFS;
-				temp_chan_k->pwrLimit =
+				temp_chan_k->state = CHANNEL_STATE_DFS;
+				temp_chan_k->pwr_limit =
 					chan->max_power;
 				temp_chan_k->flags = chan->flags;
 
@@ -1128,12 +880,12 @@ static int cds_process_regulatory_data(struct wiphy *wiphy,
 					if ((chan->flags &
 					     IEEE80211_CHAN_NO_HT40) ==
 					    IEEE80211_CHAN_NO_HT40) {
-						temp_chan_n->enabled =
+						temp_chan_n->state =
 							CHANNEL_STATE_DISABLE;
 					} else {
-						temp_chan_n->enabled =
+						temp_chan_n->state =
 							CHANNEL_STATE_DFS;
-						temp_chan_n->pwrLimit =
+						temp_chan_n->pwr_limit =
 							 chan->max_power-3;
 					}
 					temp_chan_n->flags = chan->flags;
@@ -1142,19 +894,19 @@ static int cds_process_regulatory_data(struct wiphy *wiphy,
 				     IEEE80211_CHAN_NO_80MHZ) == 0)
 					hdd_ctx->isVHT80Allowed = 1;
 			} else {
-				temp_chan_k->enabled = CHANNEL_STATE_ENABLE;
-				temp_chan_k->pwrLimit = chan->max_power;
+				temp_chan_k->state = CHANNEL_STATE_ENABLE;
+				temp_chan_k->pwr_limit = chan->max_power;
 				temp_chan_k->flags = chan->flags;
 				if (n != -1) {
 					if ((chan->flags &
 					     IEEE80211_CHAN_NO_HT40) ==
 					    IEEE80211_CHAN_NO_HT40) {
-						temp_chan_n->enabled =
+						temp_chan_n->state =
 							CHANNEL_STATE_DISABLE;
 					} else {
-						temp_chan_n->enabled =
+						temp_chan_n->state =
 							CHANNEL_STATE_ENABLE;
-						temp_chan_n->pwrLimit =
+						temp_chan_n->pwr_limit =
 							chan->max_power - 3;
 					}
 					temp_chan_n->flags = chan->flags;
@@ -1168,9 +920,8 @@ static int cds_process_regulatory_data(struct wiphy *wiphy,
 
 	if (0 == (hdd_ctx->reg.eeprom_rd_ext &
 		  (1 << WHAL_REG_EXT_FCC_CH_144))) {
-		temp_chan = &(reg_table.regDomains[temp_reg_domain].
-			      channels[RF_CHAN_144]);
-		temp_chan->enabled =
+		temp_chan = &(reg_channels[RF_CHAN_144]);
+		temp_chan->state =
 			CHANNEL_STATE_DISABLE;
 	}
 
@@ -1220,8 +971,6 @@ void __hdd_reg_notifier(struct wiphy *wiphy,
 {
 	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
 	eCsrBand band_capability = eCSR_BAND_ALL;
-	country_code_t country_code;
-	int i;
 	bool vht80_allowed;
 	bool reset = false;
 
@@ -1238,7 +987,7 @@ void __hdd_reg_notifier(struct wiphy *wiphy,
 		return;
 	}
 
-	if (hdd_ctx->isUnloadInProgress || hdd_ctx->isLogpInProgress) {
+	if (cds_is_driver_unloading() || cds_is_driver_recovering()) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 			  "%s: Unloading or SSR in Progress, Ignore!!!",
 			  __func__);
@@ -1279,17 +1028,17 @@ void __hdd_reg_notifier(struct wiphy *wiphy,
 		}
 
 		if (NL80211_REGDOM_SET_BY_CORE == request->initiator) {
-			hdd_ctx->reg.cc_src = COUNTRY_CODE_SET_BY_CORE;
+			hdd_ctx->reg.cc_src = SOURCE_CORE;
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) || defined(WITH_BACKPORTS)
 			if (wiphy->regulatory_flags & REGULATORY_CUSTOM_REG)
 #else
-				if (wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
+			if (wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
 #endif
-					reset = true;
+				reset = true;
 		} else if (NL80211_REGDOM_SET_BY_DRIVER == request->initiator)
-			hdd_ctx->reg.cc_src = COUNTRY_CODE_SET_BY_DRIVER;
+			hdd_ctx->reg.cc_src = SOURCE_DRIVER;
 		else {
-			hdd_ctx->reg.cc_src = COUNTRY_CODE_SET_BY_USER;
+			hdd_ctx->reg.cc_src = SOURCE_USERSPACE;
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0)) && !defined(WITH_BACKPORTS)
 			if ((request->alpha2[0] == '0') &&
 			    (request->alpha2[1] == '0') &&
@@ -1300,31 +1049,11 @@ void __hdd_reg_notifier(struct wiphy *wiphy,
 #endif
 		}
 
-		/* first lookup the country in the local database */
-		country_code[0] = request->alpha2[0];
-		country_code[1] = request->alpha2[1];
-
 		hdd_ctx->reg.alpha2[0] = request->alpha2[0];
 		hdd_ctx->reg.alpha2[1] = request->alpha2[1];
 
 		cds_update_regulatory_info(hdd_ctx);
 
-		temp_reg_domain = REGDOMAIN_COUNT;
-		for (i = 0; i < country_info_table.countryCount &&
-		     REGDOMAIN_COUNT == temp_reg_domain; i++) {
-			if (memcmp(country_code,
-				  country_info_table.countryInfo[i].countryCode,
-				  CDS_COUNTRY_CODE_LEN) == 0) {
-
-				temp_reg_domain =
-				country_info_table.countryInfo[i].regDomain;
-				break;
-			}
-		}
-
-		if (REGDOMAIN_COUNT == temp_reg_domain)
-			temp_reg_domain = REGDOMAIN_WORLD;
-
 		vht80_allowed = hdd_ctx->isVHT80Allowed;
 		if (cds_process_regulatory_data(wiphy, band_capability,
 						reset) == 0) {
@@ -1337,16 +1066,8 @@ void __hdd_reg_notifier(struct wiphy *wiphy,
 		if (NL80211_REGDOM_SET_BY_DRIVER == request->initiator)
 			complete(&hdd_ctx->reg_init);
 
-		if (request->alpha2[0] == '0'
-		    && request->alpha2[1] == '0') {
-			sme_generic_change_country_code(hdd_ctx->hHal,
-							country_code,
-							REGDOMAIN_COUNT);
-		} else {
-			sme_generic_change_country_code(hdd_ctx->hHal,
-							country_code,
-							temp_reg_domain);
-		}
+		sme_generic_change_country_code(hdd_ctx->hHal,
+						hdd_ctx->reg.alpha2);
 
 		cds_fill_and_send_ctl_to_fw(&hdd_ctx->reg);
 
@@ -1381,21 +1102,15 @@ void hdd_reg_notifier(struct wiphy *wiphy,
  */
 CDF_STATUS cds_regulatory_init(void)
 {
-	v_CONTEXT_t cds_context = NULL;
 	hdd_context_t *hdd_ctx = NULL;
 	struct wiphy *wiphy = NULL;
 	int ret_val = 0;
 	struct regulatory *reg_info;
 
-	cds_context = cds_get_global_context();
-
-	if (!cds_context)
-		return CDF_STATUS_E_FAULT;
-
 	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
 	if (!hdd_ctx) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
-			  ("Invalid pHddCtx pointer"));
+			  "invalid hdd_ctx pointer");
 		return CDF_STATUS_E_FAULT;
 	}
 
@@ -1405,8 +1120,6 @@ CDF_STATUS cds_regulatory_init(void)
 
 	cds_regulatory_wiphy_init(hdd_ctx, reg_info, wiphy);
 
-	temp_reg_domain = REGDOMAIN_WORLD;
-
 	if (cds_process_regulatory_data(wiphy,
 					hdd_ctx->config->
 					nBandCapability, true) != 0) {
@@ -1415,7 +1128,7 @@ CDF_STATUS cds_regulatory_init(void)
 		return CDF_STATUS_E_FAULT;
 	}
 
-	reg_info->cc_src = COUNTRY_CODE_SET_BY_DRIVER;
+	reg_info->cc_src = SOURCE_DRIVER;
 
 	ret_val = cds_fill_some_regulatory_info(reg_info);
 	if (ret_val) {
@@ -1423,8 +1136,8 @@ CDF_STATUS cds_regulatory_init(void)
 		return ret_val;
 	}
 
-	reg_table.default_country[0] = reg_info->alpha2[0];
-	reg_table.default_country[1] = reg_info->alpha2[1];
+	hdd_ctx->reg.def_country[0] = reg_info->alpha2[0];
+	hdd_ctx->reg.def_country[1] = reg_info->alpha2[1];
 
 	init_completion(&hdd_ctx->reg_init);
 
@@ -1449,7 +1162,29 @@ CDF_STATUS cds_set_reg_domain(void *client_ctxt, v_REGDOMAIN_t reg_domain)
 		return CDF_STATUS_E_INVAL;
 	}
 
-	reg_channels = reg_table.regDomains[reg_domain].channels;
-
 	return CDF_STATUS_SUCCESS;
 }
+
+/**
+ * cds_set_ch_params() - set channel parameters
+ * @ch: channel
+ * @phy_mode: physical mode
+ * @ch_param: channel parameters will be returned
+ *
+ * Return: None
+ */
+void cds_set_ch_params(uint8_t ch, uint32_t phy_mode,
+		chan_params_t *ch_params)
+{
+	tHalHandle *hal_ctx = cds_get_context(CDF_MODULE_ID_PE);
+	if (!hal_ctx) {
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
+			("Invalid hal_ctx pointer"));
+		return;
+	}
+	/*
+	 * TODO: remove SME call and move the SME set channel
+	 * param functionality to CDS.
+	 */
+	sme_set_ch_params(hal_ctx, phy_mode, ch, 0, ch_params);
+}
diff --git a/core/cds/src/cds_sched.c b/core/cds/src/cds_sched.c
index 82dfbbc64ce2..a30b031b12cd 100644
--- a/core/cds/src/cds_sched.c
+++ b/core/cds/src/cds_sched.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -120,7 +120,7 @@ cds_cpu_hotplug_notify(struct notifier_block *block,
 	if ((NULL == pSchedContext) || (NULL == pSchedContext->ol_rx_thread))
 		return NOTIFY_OK;
 
-	if (cds_is_load_unload_in_progress())
+	if (cds_is_load_or_unload_in_progress())
 		return NOTIFY_OK;
 
 	num_cpus = num_possible_cpus();
@@ -342,10 +342,6 @@ static int cds_mc_thread(void *Arg)
 	}
 	set_user_nice(current, -2);
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-	daemonize("MC_Thread");
-#endif
-
 	/* Ack back to the context from which the main controller thread
 	 * has been created
 	 */
@@ -357,15 +353,15 @@ static int cds_mc_thread(void *Arg)
 	/* Get the Global CDS Context */
 	p_cds_context = cds_get_global_context();
 	if (!p_cds_context) {
-		hddLog(CDF_TRACE_LEVEL_FATAL, "%s: Global CDS context is Null",
-		       __func__);
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_FATAL,
+			  "%s: Global CDS context is Null", __func__);
 		return 0;
 	}
 
 	pHddCtx = cds_get_context(CDF_MODULE_ID_HDD);
 	if (!pHddCtx) {
-		hddLog(CDF_TRACE_LEVEL_FATAL, "%s: HDD context is Null",
-		       __func__);
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_FATAL,
+			  "%s: HDD context is Null", __func__);
 		return 0;
 	}
 
@@ -1147,7 +1143,7 @@ static void cds_print_external_threads(void)
 
 	while (i < MAX_SSR_PROTECT_LOG) {
 		if (!ssr_protect_log[i].free) {
-			CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+			CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 			"PID %d is stuck at %s", ssr_protect_log[i].pid,
 			ssr_protect_log[i].func);
 		}
@@ -1190,7 +1186,7 @@ void cds_ssr_protect(const char *caller_func)
 	spin_unlock_irqrestore(&ssr_protect_lock, irq_flags);
 
 	if (!status)
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 		"Could not track PID %d call %s: log is full",
 		current->pid, caller_func);
 }
@@ -1229,19 +1225,19 @@ void cds_ssr_unprotect(const char *caller_func)
 	spin_unlock_irqrestore(&ssr_protect_lock, irq_flags);
 
 	if (!status)
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
+		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_ERROR,
 			"Untracked call %s", caller_func);
 }
 
 /**
- * cds_is_ssr_ready() - check if the calling execution can proceed with ssr
- *
+ * cds_wait_for_external_threads_completion() - wait for external threads
+ *					completion before proceeding further
  * @caller_func: name of calling function.
  *
  * Return: true if there is no active entry points in driver
  *	   false if there is at least one active entry in driver
  */
-bool cds_is_ssr_ready(const char *caller_func)
+bool cds_wait_for_external_threads_completion(const char *caller_func)
 {
 	int count = MAX_SSR_WAIT_ITERATIONS;
 
@@ -1263,8 +1259,24 @@ bool cds_is_ssr_ready(const char *caller_func)
 		return false;
 	}
 
-	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO,
-		  "Allowing SSR for %s", caller_func);
+	CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_INFO,
+		  "Allowing SSR/Driver unload for %s", caller_func);
 
 	return true;
 }
+
+/**
+ * cds_get_gfp_flags(): get GFP flags
+ *
+ * Based on the scheduled context, return GFP flags
+ * Return: gfp flags
+ */
+int cds_get_gfp_flags(void)
+{
+	int flags = GFP_KERNEL;
+
+	if (in_interrupt() || in_atomic() || irqs_disabled())
+		flags = GFP_ATOMIC;
+
+	return flags;
+}
diff --git a/core/cds/src/i_cds_packet.h b/core/cds/src/i_cds_packet.h
index 23858fedd2bc..0a0e3a69f757 100644
--- a/core/cds/src/i_cds_packet.h
+++ b/core/cds/src/i_cds_packet.h
@@ -42,8 +42,29 @@
    Include Files
    ------------------------------------------------------------------------*/
 #include "cdf_types.h"
-/*
+/**
  * Rx Packet Struct
+ * Buffer for the packet received from WMA has pointers to 802.11
+ * frame fields and additional information based on the type of frame.
+ * @channel: Channel number
+ * @snr: Signal to noise ratio
+ * @rssi: Received signal strength indicator, normalized to -96 dBm as
+ *        normal noise floor by adding -96 to snr. All the configured
+ *        thresholds in the driver assume that noise floor is -96 dBm.
+ * @timestamp: System timestamp when frame was received. Set to jiffies.
+ * @mpdu_hdr_ptr: Pointer to beginning of 802.11 MPDU
+ * @mpdu_data_ptr: Pointer to beginning of payload
+ * @mpdu_len: Length of 802.11 MPDU
+ * @mpdu_hdr_len: Length of 802.11 MPDU header
+ * @mpdu_data_len: Length of 802.11 MPDU payload
+ * @offloadScanLearn: Bit set to 1 for beacons received during roaming scan
+ * @roamCandidateInd: Bit set to 1 when roaming candidate is found by fw
+ * @scan: Bit set to 1 if packet received during scanning
+ * @scan_src: Source of scan
+ * @dpuFeedback: DPU feedback for frame
+ * @sessionId: PE session
+ * @tsf_delta: Delta between tsf in frame and local value of tsf
+ * @rssi_raw: rssi based on actual noise floor in hardware.
  */
 typedef struct {
 	uint8_t channel;
@@ -62,6 +83,7 @@ typedef struct {
 	uint8_t dpuFeedback;
 	uint8_t sessionId;
 	uint32_t tsf_delta;
+	uint32_t rssi_raw;
 } t_packetmeta, *tp_packetmeta;
 
 /* implementation specific cds packet type */
diff --git a/core/dp/htt/htt.c b/core/dp/htt/htt.c
index 3c4d6fd74774..686882b6aead 100644
--- a/core/dp/htt/htt.c
+++ b/core/dp/htt/htt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -43,6 +43,7 @@
 #include <ol_htt_api.h>
 
 #include <htt_internal.h>
+#include <ol_htt_tx_api.h>
 #include "hif.h"
 
 #define HTT_HTC_PKT_POOL_INIT_SIZE 100  /* enough for a large A-MPDU */
@@ -405,6 +406,7 @@ int htt_htc_attach(struct htt_pdev_t *pdev)
 	connect.EpCallbacks.EpTxComplete = htt_h2t_send_complete;
 	connect.EpCallbacks.EpTxCompleteMultiple = NULL;
 	connect.EpCallbacks.EpRecv = htt_t2h_msg_handler;
+	connect.EpCallbacks.ep_resume_tx_queue = htt_tx_resume_handler;
 
 	/* rx buffers currently are provided by HIF, not by EpRecvRefill */
 	connect.EpCallbacks.EpRecvRefill = NULL;
@@ -424,7 +426,7 @@ int htt_htc_attach(struct htt_pdev_t *pdev)
 #endif
 
 	/* connect to control service */
-	connect.ServiceID = HTT_DATA_MSG_SVC;
+	connect.service_id = HTT_DATA_MSG_SVC;
 
 	status = htc_connect_service(pdev->htc_pdev, &connect, &response);
 
diff --git a/core/dp/htt/htt_h2t.c b/core/dp/htt/htt_h2t.c
index ca5f7353cb24..cbfa4a7523d0 100644
--- a/core/dp/htt/htt_h2t.c
+++ b/core/dp/htt/htt_h2t.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -417,7 +417,7 @@ A_STATUS htt_h2t_rx_ring_cfg_msg_ll(struct htt_pdev_t *pdev)
 			       cdf_nbuf_data(msg),
 			       cdf_nbuf_len(msg),
 			       pdev->htc_endpoint,
-			       1); /* tag - not relevant here */
+			       HTC_TX_PACKET_TAG_RUNTIME_PUT);
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
 
@@ -439,6 +439,7 @@ htt_h2t_dbg_stats_get(struct htt_pdev_t *pdev,
 	struct htt_htc_pkt *pkt;
 	cdf_nbuf_t msg;
 	uint32_t *msg_word;
+	uint16_t htc_tag = 1;
 
 	pkt = htt_htc_pkt_alloc(pdev);
 	if (!pkt)
@@ -452,6 +453,9 @@ htt_h2t_dbg_stats_get(struct htt_pdev_t *pdev,
 		return -EINVAL;      /* failure */
 	}
 
+	if (stats_type_reset_mask)
+		htc_tag = HTC_TX_PACKET_TAG_RUNTIME_PUT;
+
 	/* show that this is not a tx frame download
 	 * (not required, but helpful)
 	 */
@@ -503,7 +507,7 @@ htt_h2t_dbg_stats_get(struct htt_pdev_t *pdev,
 			       cdf_nbuf_data(msg),
 			       cdf_nbuf_len(msg),
 			       pdev->htc_endpoint,
-			       1); /* tag - not relevant here */
+			       htc_tag); /* tag - not relevant here */
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
 
@@ -559,7 +563,7 @@ A_STATUS htt_h2t_sync_msg(struct htt_pdev_t *pdev, uint8_t sync_cnt)
 			       cdf_nbuf_data(msg),
 			       cdf_nbuf_len(msg),
 			       pdev->htc_endpoint,
-			       1); /* tag - not relevant here */
+			       HTC_TX_PACKET_TAG_RUNTIME_PUT);
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
 
@@ -626,7 +630,7 @@ htt_h2t_aggr_cfg_msg(struct htt_pdev_t *pdev,
 			       cdf_nbuf_data(msg),
 			       cdf_nbuf_len(msg),
 			       pdev->htc_endpoint,
-			       1); /* tag - not relevant here */
+			       HTC_TX_PACKET_TAG_RUNTIME_PUT);
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
 
@@ -648,6 +652,100 @@ htt_h2t_aggr_cfg_msg(struct htt_pdev_t *pdev,
  * Return: 0 success
  *         A_NO_MEMORY No memory fail
  */
+#ifdef QCA_WIFI_2_0
+/* Rome Support only WDI 1.0 */
+int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
+{
+	struct htt_htc_pkt *pkt;
+	cdf_nbuf_t msg;
+	uint32_t *msg_word;
+
+	pkt = htt_htc_pkt_alloc(pdev);
+	if (!pkt)
+		return A_NO_MEMORY;
+
+	/* show that this is not a tx frame download
+	 * (not required, but helpful)
+	 */
+	pkt->msdu_id = HTT_TX_COMPL_INV_MSDU_ID;
+	pkt->pdev_ctxt = NULL;  /* not used during send-done callback */
+
+	/* reserve room for HTC header */
+	msg = cdf_nbuf_alloc(pdev->osdev, HTT_MSG_BUF_SIZE(HTT_WDI_IPA_CFG_SZ),
+			     HTC_HEADER_LEN + HTC_HDR_ALIGNMENT_PADDING, 4,
+			     false);
+	if (!msg) {
+		htt_htc_pkt_free(pdev, pkt);
+		return A_NO_MEMORY;
+	}
+	/* set the length of the message */
+	cdf_nbuf_put_tail(msg, HTT_WDI_IPA_CFG_SZ);
+
+	/* fill in the message contents */
+	msg_word = (uint32_t *) cdf_nbuf_data(msg);
+
+	/* rewind beyond alignment pad to get to the HTC header reserved area */
+	cdf_nbuf_push_head(msg, HTC_HDR_ALIGNMENT_PADDING);
+
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_TX_PKT_POOL_SIZE_SET(*msg_word,
+				pdev->ipa_uc_tx_rsc.alloc_tx_buf_cnt);
+	HTT_H2T_MSG_TYPE_SET(*msg_word, HTT_H2T_MSG_TYPE_WDI_IPA_CFG);
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_TX_COMP_RING_BASE_ADDR_SET(*msg_word,
+		(unsigned int)pdev->ipa_uc_tx_rsc.tx_comp_base.paddr);
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_TX_COMP_RING_SIZE_SET(*msg_word,
+		(unsigned int)ol_cfg_ipa_uc_tx_max_buf_cnt(pdev->ctrl_pdev));
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_TX_COMP_WR_IDX_ADDR_SET(*msg_word,
+		(unsigned int)pdev->ipa_uc_tx_rsc.tx_comp_idx_paddr);
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_TX_CE_WR_IDX_ADDR_SET(*msg_word,
+		(unsigned int)pdev->ipa_uc_tx_rsc.tx_ce_idx.paddr);
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_IND_RING_BASE_ADDR_SET(*msg_word,
+		(unsigned int)pdev->ipa_uc_rx_rsc.rx_ind_ring_base.paddr);
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_IND_RING_SIZE_SET(*msg_word,
+		(unsigned int)ol_cfg_ipa_uc_rx_ind_ring_size(pdev->ctrl_pdev));
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_IND_RD_IDX_ADDR_SET(*msg_word,
+		(unsigned int)pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.paddr);
+
+	msg_word++;
+	*msg_word = 0;
+	HTT_WDI_IPA_CFG_RX_IND_WR_IDX_ADDR_SET(*msg_word,
+	       (unsigned int)pdev->ipa_uc_rx_rsc.rx_rdy_idx_paddr);
+
+	SET_HTC_PACKET_INFO_TX(&pkt->htc_pkt,
+			       htt_h2t_send_complete_free_netbuf,
+			       cdf_nbuf_data(msg),
+			       cdf_nbuf_len(msg),
+			       pdev->htc_endpoint,
+			       HTC_TX_PACKET_TAG_RUNTIME_PUT);
+
+	SET_HTC_PACKET_NET_BUF_CONTEXT(&pkt->htc_pkt, msg);
+
+	htc_send_pkt(pdev->htc_pdev, &pkt->htc_pkt);
+
+	return A_OK;
+}
+#else
 int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 {
 	struct htt_htc_pkt *pkt;
@@ -791,6 +889,7 @@ int htt_h2t_ipa_uc_rsc_cfg_msg(struct htt_pdev_t *pdev)
 
 	return A_OK;
 }
+#endif
 
 /**
  * htt_h2t_ipa_uc_set_active() - Propagate WDI path enable/disable to firmware
diff --git a/core/dp/htt/htt_internal.h b/core/dp/htt/htt_internal.h
index 5ab0b1a680b0..28b1e08b3da6 100644
--- a/core/dp/htt/htt_internal.h
+++ b/core/dp/htt/htt_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -413,6 +413,7 @@ static inline void htt_print_rx_desc(struct htt_host_rx_desc_base *rx_desc)
 
 #endif
 
+void htt_tx_resume_handler(void *);
 #ifdef ATH_11AC_TXCOMPACT
 #define HTT_TX_SCHED htt_tx_sched
 #else
diff --git a/core/dp/htt/htt_rx.c b/core/dp/htt/htt_rx.c
index 80a1b8c915d8..2eb0d68cfaca 100644
--- a/core/dp/htt/htt_rx.c
+++ b/core/dp/htt/htt_rx.c
@@ -2288,150 +2288,202 @@ fail1:
 }
 
 #ifdef IPA_OFFLOAD
+#ifdef QCA_WIFI_3_0
 /**
- * htt_rx_ipa_uc_attach() - attach htt ipa uc rx resource
+ * htt_rx_ipa_uc_alloc_wdi2_rsc() - Allocate WDI2.0 resources
  * @pdev: htt context
- * @rx_ind_ring_size: rx ring size
+ * @rx_ind_ring_elements: rx ring elements
  *
  * Return: 0 success
  */
-int htt_rx_ipa_uc_attach(struct htt_pdev_t *pdev,
+int htt_rx_ipa_uc_alloc_wdi2_rsc(struct htt_pdev_t *pdev,
 			 unsigned int rx_ind_ring_elements)
 {
-	pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr =
+	/* Allocate RX2 indication ring */
+	/* RX2 IND ring element
+	 *   4bytes: pointer
+	 *   2bytes: VDEV ID
+	 *   2bytes: length */
+	pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr =
 		cdf_os_mem_alloc_consistent(
 			pdev->osdev,
 			rx_ind_ring_elements *
 			sizeof(struct ipa_uc_rx_ring_elem_t),
-			&pdev->ipa_uc_rx_rsc.rx_ind_ring_base.paddr,
+			&pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
-						 rx_ind_ring_base),
+						 rx2_ind_ring_base),
 						memctx));
-	if (!pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr) {
+	if (!pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr) {
 		cdf_print("%s: RX IND RING alloc fail", __func__);
 		return -ENOBUFS;
 	}
 
 	/* RX indication ring size, by bytes */
-	pdev->ipa_uc_rx_rsc.rx_ind_ring_size =
+	pdev->ipa_uc_rx_rsc.rx2_ind_ring_size =
 		rx_ind_ring_elements * sizeof(struct ipa_uc_rx_ring_elem_t);
-	cdf_mem_zero(pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr,
-		pdev->ipa_uc_rx_rsc.rx_ind_ring_size);
+	cdf_mem_zero(pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr,
+		pdev->ipa_uc_rx_rsc.rx2_ind_ring_size);
 
 	/* Allocate RX process done index */
-	pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.vaddr =
+	pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.vaddr =
 		cdf_os_mem_alloc_consistent(
 			pdev->osdev,
 			4,
-			&pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.paddr,
+			&pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
 						 rx_ipa_prc_done_idx),
 						memctx));
-	if (!pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.vaddr) {
+	if (!pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.vaddr) {
 		cdf_print("%s: RX PROC DONE IND alloc fail", __func__);
 		cdf_os_mem_free_consistent(
 			pdev->osdev,
-			pdev->ipa_uc_rx_rsc.rx_ind_ring_size,
-			pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr,
-			pdev->ipa_uc_rx_rsc.rx_ind_ring_base.paddr,
+			pdev->ipa_uc_rx_rsc.rx2_ind_ring_size,
+			pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr,
+			pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
-						 rx_ind_ring_base),
+						 rx2_ind_ring_base),
 						memctx));
 		return -ENOBUFS;
 	}
-	cdf_mem_zero(pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.vaddr, 4);
+	cdf_mem_zero(pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.vaddr, 4);
+	return 0;
+}
+#else
+int htt_rx_ipa_uc_alloc_wdi2_rsc(struct htt_pdev_t *pdev,
+			 unsigned int rx_ind_ring_elements)
+{
+	return 0;
+}
+#endif
 
-	pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr =
+/**
+ * htt_rx_ipa_uc_attach() - attach htt ipa uc rx resource
+ * @pdev: htt context
+ * @rx_ind_ring_size: rx ring size
+ *
+ * Return: 0 success
+ */
+int htt_rx_ipa_uc_attach(struct htt_pdev_t *pdev,
+			 unsigned int rx_ind_ring_elements)
+{
+	int ret = 0;
+	/* Allocate RX indication ring */
+	/* RX IND ring element
+	 *   4bytes: pointer
+	 *   2bytes: VDEV ID
+	 *   2bytes: length */
+	pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr =
 		cdf_os_mem_alloc_consistent(
 			pdev->osdev,
 			rx_ind_ring_elements *
-			sizeof(cdf_dma_addr_t),
-			&pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.paddr,
+			sizeof(struct ipa_uc_rx_ring_elem_t),
+			&pdev->ipa_uc_rx_rsc.rx_ind_ring_base.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
-						 rx2_ind_ring_base),
+						 rx_ind_ring_base),
 						memctx));
-	if (!pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr) {
+	if (!pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr) {
 		cdf_print("%s: RX IND RING alloc fail", __func__);
 		return -ENOBUFS;
 	}
 
 	/* RX indication ring size, by bytes */
-	pdev->ipa_uc_rx_rsc.rx2_ind_ring_size =
-		rx_ind_ring_elements * sizeof(cdf_dma_addr_t);
-	cdf_mem_zero(pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr,
-		pdev->ipa_uc_rx_rsc.rx2_ind_ring_size);
+	pdev->ipa_uc_rx_rsc.rx_ind_ring_size =
+		rx_ind_ring_elements * sizeof(struct ipa_uc_rx_ring_elem_t);
+	cdf_mem_zero(pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr,
+		pdev->ipa_uc_rx_rsc.rx_ind_ring_size);
 
 	/* Allocate RX process done index */
-	pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.vaddr =
+	pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.vaddr =
 		cdf_os_mem_alloc_consistent(
 			pdev->osdev,
 			4,
-			&pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.paddr,
+			&pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
 						 rx_ipa_prc_done_idx),
 						memctx));
-	if (!pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.vaddr) {
+	if (!pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.vaddr) {
 		cdf_print("%s: RX PROC DONE IND alloc fail", __func__);
 		cdf_os_mem_free_consistent(
 			pdev->osdev,
-			pdev->ipa_uc_rx_rsc.rx2_ind_ring_size,
-			pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr,
-			pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.paddr,
+			pdev->ipa_uc_rx_rsc.rx_ind_ring_size,
+			pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr,
+			pdev->ipa_uc_rx_rsc.rx_ind_ring_base.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
-						 rx2_ind_ring_base),
+						 rx_ind_ring_base),
 						memctx));
 		return -ENOBUFS;
 	}
-	cdf_mem_zero(pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.vaddr, 4);
-	return 0;
+	cdf_mem_zero(pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.vaddr, 4);
+
+	ret = htt_rx_ipa_uc_alloc_wdi2_rsc(pdev, rx_ind_ring_elements);
+	return ret;
 }
 
-int htt_rx_ipa_uc_detach(struct htt_pdev_t *pdev)
+#ifdef QCA_WIFI_3_0
+/**
+ * htt_rx_ipa_uc_free_wdi2_rsc() - Free WDI2.0 resources
+ * @pdev: htt context
+ *
+ * Return: None
+ */
+void htt_rx_ipa_uc_free_wdi2_rsc(struct htt_pdev_t *pdev)
 {
-	if (pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr) {
+	if (pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr) {
 		cdf_os_mem_free_consistent(
 			pdev->osdev,
-			pdev->ipa_uc_rx_rsc.rx_ind_ring_size,
-			pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr,
-			pdev->ipa_uc_rx_rsc.rx_ind_ring_base.paddr,
+			pdev->ipa_uc_rx_rsc.rx2_ind_ring_size,
+			pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr,
+			pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
-						 rx_ind_ring_base),
+						 rx2_ind_ring_base),
 						memctx));
 	}
 
-	if (pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.vaddr) {
+	if (pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.vaddr) {
 		cdf_os_mem_free_consistent(
 			pdev->osdev,
 			4,
 			pdev->ipa_uc_rx_rsc.
 			rx_ipa_prc_done_idx.vaddr,
-			pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.paddr,
+			pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
 						 rx_ipa_prc_done_idx),
 						memctx));
 	}
-	if (pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr) {
+}
+#else
+void htt_rx_ipa_uc_free_wdi2_rsc(struct htt_pdev_t *pdev)
+{
+	return;
+}
+#endif
+
+int htt_rx_ipa_uc_detach(struct htt_pdev_t *pdev)
+{
+	if (pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr) {
 		cdf_os_mem_free_consistent(
 			pdev->osdev,
-			pdev->ipa_uc_rx_rsc.rx2_ind_ring_size,
-			pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.vaddr,
-			pdev->ipa_uc_rx_rsc.rx2_ind_ring_base.paddr,
+			pdev->ipa_uc_rx_rsc.rx_ind_ring_size,
+			pdev->ipa_uc_rx_rsc.rx_ind_ring_base.vaddr,
+			pdev->ipa_uc_rx_rsc.rx_ind_ring_base.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
-						 rx2_ind_ring_base),
+						 rx_ind_ring_base),
 						memctx));
 	}
 
-	if (pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.vaddr) {
+	if (pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.vaddr) {
 		cdf_os_mem_free_consistent(
 			pdev->osdev,
 			4,
 			pdev->ipa_uc_rx_rsc.
 			rx_ipa_prc_done_idx.vaddr,
-			pdev->ipa_uc_rx_rsc.rx2_ipa_prc_done_idx.paddr,
+			pdev->ipa_uc_rx_rsc.rx_ipa_prc_done_idx.paddr,
 			cdf_get_dma_mem_context((&pdev->ipa_uc_rx_rsc.
 						 rx2_ipa_prc_done_idx),
 						memctx));
 	}
+
+	htt_rx_ipa_uc_free_wdi2_rsc(pdev);
 	return 0;
 }
 #endif /* IPA_OFFLOAD */
diff --git a/core/dp/htt/htt_t2h.c b/core/dp/htt/htt_t2h.c
index 3ef8cdd8c6f7..639c34506c8a 100644
--- a/core/dp/htt/htt_t2h.c
+++ b/core/dp/htt/htt_t2h.c
@@ -141,6 +141,7 @@ void htt_t2h_lp_msg_handler(void *context, cdf_nbuf_t htt_t2h_msg)
 	switch (msg_type) {
 	case HTT_T2H_MSG_TYPE_VERSION_CONF:
 	{
+		cdf_runtime_pm_put();
 		pdev->tgt_ver.major = HTT_VER_CONF_MAJOR_GET(*msg_word);
 		pdev->tgt_ver.minor = HTT_VER_CONF_MINOR_GET(*msg_word);
 		cdf_print
@@ -287,6 +288,7 @@ void htt_t2h_lp_msg_handler(void *context, cdf_nbuf_t htt_t2h_msg)
 			ol_tx_single_completion_handler(pdev->txrx_pdev,
 							compl_msg->status,
 							compl_msg->desc_id);
+			cdf_runtime_pm_put();
 			HTT_TX_SCHED(pdev);
 		} else {
 			cdf_print("Ignoring HTT_T2H_MSG_TYPE_MGMT_TX_COMPL_IND indication\n");
@@ -302,6 +304,7 @@ void htt_t2h_lp_msg_handler(void *context, cdf_nbuf_t htt_t2h_msg)
 		cookie |= ((uint64_t) (*(msg_word + 2))) << 32;
 
 		stats_info_list = (uint8_t *) (msg_word + 3);
+		cdf_runtime_pm_put();
 		ol_txrx_fw_stats_handler(pdev->txrx_pdev, cookie,
 					 stats_info_list);
 		break;
@@ -357,6 +360,7 @@ void htt_t2h_lp_msg_handler(void *context, cdf_nbuf_t htt_t2h_msg)
 		uint8_t *op_msg_buffer;
 		uint8_t *msg_start_ptr;
 
+		cdf_runtime_pm_put();
 		msg_start_ptr = (uint8_t *) msg_word;
 		op_code =
 			HTT_WDI_IPA_OP_RESPONSE_OP_CODE_GET(*msg_word);
@@ -475,6 +479,11 @@ void htt_t2h_msg_handler(void *context, HTC_PACKET *pkt)
 		peer_id = HTT_RX_IND_PEER_ID_GET(*msg_word);
 		tid = HTT_RX_IND_EXT_TID_GET(*msg_word);
 
+		if (tid >= OL_TXRX_NUM_EXT_TIDS) {
+			cdf_print("HTT_T2H_MSG_TYPE_RX_IND, invalid tid %d\n",
+				tid);
+			break;
+		}
 		num_msdu_bytes =
 			HTT_RX_IND_FW_RX_DESC_BYTES_GET(
 				*(msg_word + 2 + HTT_RX_PPDU_DESC_SIZE32));
diff --git a/core/dp/htt/htt_tx.c b/core/dp/htt/htt_tx.c
index 57cd62a8c6dc..1aa28f9ce202 100644
--- a/core/dp/htt/htt_tx.c
+++ b/core/dp/htt/htt_tx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -252,8 +252,6 @@ static inline void htt_tx_desc_get_size(struct htt_pdev_t *pdev)
 		+ (ol_cfg_netbuf_frags_max(pdev->ctrl_pdev) + 1) * 8
 		   /* 2x uint32_t */
 		+ 4; /* uint32_t fragmentation list terminator */
-	if (pdev->tx_descs.size < sizeof(uint32_t *))
-		pdev->tx_descs.size = sizeof(uint32_t *);
 }
 
 /**
@@ -320,6 +318,7 @@ int htt_tx_attach(struct htt_pdev_t *pdev, int desc_pool_elems)
 	uint16_t num_page, num_desc_per_page;
 
 	htt_tx_desc_get_size(pdev);
+
 	/*
 	 * Make sure tx_descs.size is a multiple of 4-bytes.
 	 * It should be, but round up just to be sure.
@@ -626,6 +625,24 @@ int htt_tx_send_std(htt_pdev_handle pdev, cdf_nbuf_t msdu, uint16_t msdu_id)
 
 }
 
+#ifdef FEATURE_RUNTIME_PM
+/**
+ * htt_tx_resume_handler() - resume callback for the htt endpoint
+ * @context: a pointer to the htt context
+ *
+ * runs htt_tx_sched.
+ */
+void htt_tx_resume_handler(void *context)
+{
+	struct htt_pdev_t *pdev =  (struct htt_pdev_t *) context;
+
+	htt_tx_sched(pdev);
+}
+#else
+void
+htt_tx_resume_handler(void *context) { }
+#endif
+
 cdf_nbuf_t
 htt_tx_send_batch(htt_pdev_handle pdev, cdf_nbuf_t head_msdu, int num_msdus)
 {
@@ -833,17 +850,19 @@ void htt_tx_desc_display(void *tx_desc)
 #endif
 
 #ifdef IPA_OFFLOAD
+#ifdef QCA_WIFI_2_0
 /**
- * htt_tx_ipa_uc_attach() - attach htt ipa uc tx resource
+ * htt_tx_ipa_uc_wdi_tx_buf_alloc() - Alloc WDI TX buffers
  * @pdev: htt context
- * @uc_tx_buf_sz: single tx buffer size
- * @uc_tx_buf_cnt: total tx buffer count
- * @uc_tx_partition_base: tx buffer partition start
+ * @uc_tx_buf_sz: TX buffer size
+ * @uc_tx_buf_cnt: TX Buffer count
+ * @uc_tx_partition_base: IPA UC TX partition base value
+ *
+ * Allocate WDI TX buffers. Also note Rome supports only WDI 1.0.
  *
  * Return: 0 success
- *         ENOBUFS No memory fail
  */
-int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
+int htt_tx_ipa_uc_wdi_tx_buf_alloc(struct htt_pdev_t *pdev,
 			 unsigned int uc_tx_buf_sz,
 			 unsigned int uc_tx_buf_cnt,
 			 unsigned int uc_tx_partition_base)
@@ -853,52 +872,68 @@ int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
 	cdf_dma_addr_t buffer_paddr;
 	uint32_t *header_ptr;
 	uint32_t *ring_vaddr;
-	int return_code = 0;
-	unsigned int tx_comp_ring_size;
+#define IPA_UC_TX_BUF_FRAG_DESC_OFFSET 16
+#define IPA_UC_TX_BUF_FRAG_HDR_OFFSET 32
 
-	/* Allocate CE Write Index WORD */
-	pdev->ipa_uc_tx_rsc.tx_ce_idx.vaddr =
-		cdf_os_mem_alloc_consistent(
-			pdev->osdev,
-			4,
-			&pdev->ipa_uc_tx_rsc.tx_ce_idx.paddr,
-			cdf_get_dma_mem_context(
-				(&pdev->ipa_uc_tx_rsc.tx_ce_idx),
-				memctx));
-	if (!pdev->ipa_uc_tx_rsc.tx_ce_idx.vaddr) {
-		cdf_print("%s: CE Write Index WORD alloc fail", __func__);
-		return -ENOBUFS;
-	}
+	ring_vaddr = pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr;
+	/* Allocate TX buffers as many as possible */
+	for (tx_buffer_count = 0;
+	     tx_buffer_count < (uc_tx_buf_cnt - 1); tx_buffer_count++) {
+		buffer_vaddr = cdf_nbuf_alloc(pdev->osdev,
+					      uc_tx_buf_sz, 0, 4, false);
+		if (!buffer_vaddr) {
+			cdf_print("%s: TX BUF alloc fail, loop index: %d",
+				  __func__, tx_buffer_count);
+			return tx_buffer_count;
+		}
 
-	/* Allocate TX COMP Ring */
-	tx_comp_ring_size = uc_tx_buf_cnt * sizeof(cdf_nbuf_t);
-	pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr =
-		cdf_os_mem_alloc_consistent(
-			pdev->osdev,
-			tx_comp_ring_size,
-			&pdev->ipa_uc_tx_rsc.tx_comp_base.paddr,
-			cdf_get_dma_mem_context((&pdev->ipa_uc_tx_rsc.
-						 tx_comp_base),
-						memctx));
-	if (!pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr) {
-		cdf_print("%s: TX COMP ring alloc fail", __func__);
-		return_code = -ENOBUFS;
-		goto free_tx_ce_idx;
-	}
+		/* Init buffer */
+		cdf_mem_zero(cdf_nbuf_data(buffer_vaddr), uc_tx_buf_sz);
+		header_ptr = (uint32_t *) cdf_nbuf_data(buffer_vaddr);
 
-	cdf_mem_zero(pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr, tx_comp_ring_size);
+		/* HTT control header */
+		*header_ptr = HTT_IPA_UC_OFFLOAD_TX_HEADER_DEFAULT;
+		header_ptr++;
 
-	/* Allocate TX BUF vAddress Storage */
-	pdev->ipa_uc_tx_rsc.tx_buf_pool_vaddr_strg =
-		(cdf_nbuf_t *) cdf_mem_malloc(uc_tx_buf_cnt *
-					      sizeof(cdf_nbuf_t));
-	if (!pdev->ipa_uc_tx_rsc.tx_buf_pool_vaddr_strg) {
-		cdf_print("%s: TX BUF POOL vaddr storage alloc fail", __func__);
-		return_code = -ENOBUFS;
-		goto free_tx_comp_base;
+		/* PKT ID */
+		*header_ptr |= ((uint16_t) uc_tx_partition_base +
+				tx_buffer_count) << 16;
+
+		cdf_nbuf_map(pdev->osdev, buffer_vaddr, CDF_DMA_BIDIRECTIONAL);
+		buffer_paddr = cdf_nbuf_get_frag_paddr_lo(buffer_vaddr, 0);
+		header_ptr++;
+		*header_ptr = (uint32_t) (buffer_paddr +
+						IPA_UC_TX_BUF_FRAG_DESC_OFFSET);
+		header_ptr++;
+		*header_ptr = 0xFFFFFFFF;
+
+		/* FRAG Header */
+		header_ptr++;
+		*header_ptr = buffer_paddr + IPA_UC_TX_BUF_FRAG_HDR_OFFSET;
+
+		*ring_vaddr = buffer_paddr;
+		pdev->ipa_uc_tx_rsc.tx_buf_pool_vaddr_strg[tx_buffer_count] =
+			buffer_vaddr;
+		/* Memory barrier to ensure actual value updated */
+
+		ring_vaddr++;
 	}
-	cdf_mem_zero(pdev->ipa_uc_tx_rsc.tx_buf_pool_vaddr_strg,
-		     uc_tx_buf_cnt * sizeof(cdf_nbuf_t));
+	return tx_buffer_count;
+}
+#else
+int htt_tx_ipa_uc_wdi_tx_buf_alloc(struct htt_pdev_t *pdev,
+			 unsigned int uc_tx_buf_sz,
+			 unsigned int uc_tx_buf_cnt,
+			 unsigned int uc_tx_partition_base)
+{
+	unsigned int tx_buffer_count;
+	cdf_nbuf_t buffer_vaddr;
+	uint32_t buffer_paddr;
+	uint32_t *header_ptr;
+	uint32_t *ring_vaddr;
+#define IPA_UC_TX_BUF_FRAG_DESC_OFFSET 20
+#define IPA_UC_TX_BUF_FRAG_HDR_OFFSET 64
+#define IPA_UC_TX_BUF_TSO_HDR_SIZE 6
 
 	ring_vaddr = pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr;
 	/* Allocate TX buffers as many as possible */
@@ -909,7 +944,7 @@ int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
 		if (!buffer_vaddr) {
 			cdf_print("%s: TX BUF alloc fail, loop index: %d",
 				  __func__, tx_buffer_count);
-			return 0;
+			return tx_buffer_count;
 		}
 
 		/* Init buffer */
@@ -930,7 +965,8 @@ int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
 
 		/* Frag Desc Pointer */
 		/* 64bits descriptor, Low 32bits */
-		*header_ptr = (uint32_t) (buffer_paddr + 20);
+		*header_ptr = (uint32_t) (buffer_paddr +
+						IPA_UC_TX_BUF_FRAG_DESC_OFFSET);
 		header_ptr++;
 
 		/* 64bits descriptor, high 32bits */
@@ -943,8 +979,8 @@ int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
 
 		/* FRAG Header */
 		/* 6 words TSO header */
-		header_ptr += 6;
-		*header_ptr = buffer_paddr + 64;
+		header_ptr += IPA_UC_TX_BUF_TSO_HDR_SIZE;
+		*header_ptr = buffer_paddr + IPA_UC_TX_BUF_FRAG_HDR_OFFSET;
 
 		*ring_vaddr = buffer_paddr;
 		pdev->ipa_uc_tx_rsc.tx_buf_pool_vaddr_strg[tx_buffer_count] =
@@ -953,8 +989,75 @@ int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
 
 		ring_vaddr += 2;
 	}
+	return tx_buffer_count;
+}
+#endif
+
+/**
+ * htt_tx_ipa_uc_attach() - attach htt ipa uc tx resource
+ * @pdev: htt context
+ * @uc_tx_buf_sz: single tx buffer size
+ * @uc_tx_buf_cnt: total tx buffer count
+ * @uc_tx_partition_base: tx buffer partition start
+ *
+ * Return: 0 success
+ *         ENOBUFS No memory fail
+ */
+int htt_tx_ipa_uc_attach(struct htt_pdev_t *pdev,
+			 unsigned int uc_tx_buf_sz,
+			 unsigned int uc_tx_buf_cnt,
+			 unsigned int uc_tx_partition_base)
+{
+	int return_code = 0;
+	unsigned int tx_comp_ring_size;
+
+	/* Allocate CE Write Index WORD */
+	pdev->ipa_uc_tx_rsc.tx_ce_idx.vaddr =
+		cdf_os_mem_alloc_consistent(
+			pdev->osdev,
+			4,
+			&pdev->ipa_uc_tx_rsc.tx_ce_idx.paddr,
+			cdf_get_dma_mem_context(
+				(&pdev->ipa_uc_tx_rsc.tx_ce_idx),
+				memctx));
+	if (!pdev->ipa_uc_tx_rsc.tx_ce_idx.vaddr) {
+		cdf_print("%s: CE Write Index WORD alloc fail", __func__);
+		return -ENOBUFS;
+	}
+
+	/* Allocate TX COMP Ring */
+	tx_comp_ring_size = uc_tx_buf_cnt * sizeof(cdf_nbuf_t);
+	pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr =
+		cdf_os_mem_alloc_consistent(
+			pdev->osdev,
+			tx_comp_ring_size,
+			&pdev->ipa_uc_tx_rsc.tx_comp_base.paddr,
+			cdf_get_dma_mem_context((&pdev->ipa_uc_tx_rsc.
+						 tx_comp_base),
+						memctx));
+	if (!pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr) {
+		cdf_print("%s: TX COMP ring alloc fail", __func__);
+		return_code = -ENOBUFS;
+		goto free_tx_ce_idx;
+	}
+
+	cdf_mem_zero(pdev->ipa_uc_tx_rsc.tx_comp_base.vaddr, tx_comp_ring_size);
+
+	/* Allocate TX BUF vAddress Storage */
+	pdev->ipa_uc_tx_rsc.tx_buf_pool_vaddr_strg =
+		(cdf_nbuf_t *) cdf_mem_malloc(uc_tx_buf_cnt *
+					      sizeof(cdf_nbuf_t));
+	if (!pdev->ipa_uc_tx_rsc.tx_buf_pool_vaddr_strg) {
+		cdf_print("%s: TX BUF POOL vaddr storage alloc fail", __func__);
+		return_code = -ENOBUFS;
+		goto free_tx_comp_base;
+	}
+	cdf_mem_zero(pdev->ipa_uc_tx_rsc.tx_buf_pool_vaddr_strg,
+		     uc_tx_buf_cnt * sizeof(cdf_nbuf_t));
+
+	pdev->ipa_uc_tx_rsc.alloc_tx_buf_cnt = htt_tx_ipa_uc_wdi_tx_buf_alloc(
+		pdev, uc_tx_buf_sz, uc_tx_buf_cnt, uc_tx_partition_base);
 
-	pdev->ipa_uc_tx_rsc.alloc_tx_buf_cnt = tx_buffer_count;
 
 	return 0;
 
diff --git a/core/dp/ol/inc/ol_txrx_dbg.h b/core/dp/ol/inc/ol_txrx_dbg.h
index 035010936527..138e1ed0df21 100644
--- a/core/dp/ol/inc/ol_txrx_dbg.h
+++ b/core/dp/ol/inc/ol_txrx_dbg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -82,7 +82,7 @@ struct ol_txrx_stats_req {
 
 #define ol_txrx_debug(vdev, debug_specs) 0
 #define ol_txrx_fw_stats_cfg(vdev, type, val) 0
-#define ol_txrx_fw_stats_get(vdev, req) 0
+#define ol_txrx_fw_stats_get(vdev, req, response_expected) 0
 #define ol_txrx_aggr_cfg(vdev, max_subfrms_ampdu, max_subfrms_amsdu) 0
 
 #else /*---------------------------------------------------------------------*/
@@ -95,7 +95,8 @@ void ol_txrx_fw_stats_cfg(ol_txrx_vdev_handle vdev,
 			  uint8_t cfg_stats_type, uint32_t cfg_val);
 
 int ol_txrx_fw_stats_get(ol_txrx_vdev_handle vdev,
-			 struct ol_txrx_stats_req *req);
+			 struct ol_txrx_stats_req *req,
+			 bool response_expected);
 
 int ol_txrx_aggr_cfg(ol_txrx_vdev_handle vdev,
 		     int max_subfrms_ampdu, int max_subfrms_amsdu);
diff --git a/core/dp/txrx/ol_cfg.c b/core/dp/txrx/ol_cfg.c
index 2e6a8e767fc6..c921e2dddaf9 100644
--- a/core/dp/txrx/ol_cfg.c
+++ b/core/dp/txrx/ol_cfg.c
@@ -56,6 +56,20 @@ void ol_tx_set_flow_control_parameters(struct txrx_pdev_cfg_t *cfg_ctx,
 }
 #endif
 
+#if CFG_TGT_DEFAULT_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK
+static inline
+uint8_t ol_defrag_timeout_check(void)
+{
+	return 1;
+}
+#else
+static inline
+uint8_t ol_defrag_timeout_check(void)
+{
+	return 0;
+}
+#endif
+
 /* FIX THIS -
  * For now, all these configuration parameters are hardcoded.
  * Many of these should actually be determined dynamically instead.
@@ -79,9 +93,7 @@ ol_pdev_handle ol_pdev_cfg_attach(cdf_device_t osdev,
 	cfg_ctx->tx_download_size = 16;
 	/* temporarily diabled PN check for Riva/Pronto */
 	cfg_ctx->rx_pn_check = 1;
-#if CFG_TGT_DEFAULT_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK
-	cfg_ctx->defrag_timeout_check = 1;
-#endif
+	cfg_ctx->defrag_timeout_check = ol_defrag_timeout_check();
 	cfg_ctx->max_peer_id = 511;
 	cfg_ctx->max_vdev = CFG_TGT_NUM_VDEV;
 	cfg_ctx->pn_rx_fwd_check = 1;
diff --git a/core/dp/txrx/ol_rx.c b/core/dp/txrx/ol_rx.c
index 7d007aaab897..19db13998ccc 100644
--- a/core/dp/txrx/ol_rx.c
+++ b/core/dp/txrx/ol_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -98,7 +98,7 @@ void ol_rx_trigger_restore(htt_pdev_handle htt_pdev, cdf_nbuf_t head_msdu,
 	}
 
 	if (!htt_pdev->rx_ring.htt_rx_restore) {
-		cds_set_logp_in_progress(true);
+		cds_set_recovery_in_progress(true);
 		htt_pdev->rx_ring.htt_rx_restore = 1;
 		schedule_work(&ol_rx_restore_work);
 	}
diff --git a/core/dp/txrx/ol_tx_send.c b/core/dp/txrx/ol_tx_send.c
index f6dc650cb837..bc762694cecf 100644
--- a/core/dp/txrx/ol_tx_send.c
+++ b/core/dp/txrx/ol_tx_send.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -504,6 +504,7 @@ ol_tx_completion_handler(ol_txrx_pdev_handle pdev,
 		tx_desc->status = status;
 		netbuf = tx_desc->netbuf;
 
+		cdf_runtime_pm_put();
 		cdf_nbuf_trace_update(netbuf, trace_str);
 		/* Per SDU update of byte count */
 		byte_cnt += cdf_nbuf_len(netbuf);
diff --git a/core/dp/txrx/ol_txrx.c b/core/dp/txrx/ol_txrx.c
index fa9f7d8fd369..f1aa269bccee 100644
--- a/core/dp/txrx/ol_txrx.c
+++ b/core/dp/txrx/ol_txrx.c
@@ -313,9 +313,11 @@ void ol_tx_set_desc_global_pool_size(uint32_t num_msdu_desc)
 		cdf_print("%s: pdev is NULL\n", __func__);
 		return;
 	}
-	pdev->num_msdu_desc = num_msdu_desc + TX_FLOW_MGMT_POOL_SIZE;
-	TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, "Global pool size: %d = %d + %d\n",
-		pdev->num_msdu_desc, num_msdu_desc, TX_FLOW_MGMT_POOL_SIZE);
+	pdev->num_msdu_desc = num_msdu_desc;
+	if (!ol_tx_get_is_mgmt_over_wmi_enabled())
+		pdev->num_msdu_desc += TX_FLOW_MGMT_POOL_SIZE;
+	TXRX_PRINT(TXRX_PRINT_LEVEL_ERR, "Global pool size: %d\n",
+		pdev->num_msdu_desc);
 	return;
 }
 
@@ -330,6 +332,32 @@ uint32_t ol_tx_get_desc_global_pool_size(struct ol_txrx_pdev_t *pdev)
 {
 	return pdev->num_msdu_desc;
 }
+
+/**
+ * ol_tx_get_total_free_desc() - get total free descriptors
+ * @pdev: pdev handle
+ *
+ * Return: total free descriptors
+ */
+static inline
+uint32_t ol_tx_get_total_free_desc(struct ol_txrx_pdev_t *pdev)
+{
+	struct ol_tx_flow_pool_t *pool = NULL;
+	uint32_t free_desc;
+
+	free_desc = pdev->tx_desc.num_free;
+	cdf_spin_lock_bh(&pdev->tx_desc.flow_pool_list_lock);
+	TAILQ_FOREACH(pool, &pdev->tx_desc.flow_pool_list,
+					 flow_pool_list_elem) {
+		cdf_spin_lock_bh(&pool->flow_pool_lock);
+		free_desc += pool->avail_desc;
+		cdf_spin_unlock_bh(&pool->flow_pool_lock);
+	}
+	cdf_spin_unlock_bh(&pdev->tx_desc.flow_pool_list_lock);
+
+	return free_desc;
+}
+
 #else
 /**
  * ol_tx_get_desc_global_pool_size() - get global pool size
@@ -342,6 +370,19 @@ uint32_t ol_tx_get_desc_global_pool_size(struct ol_txrx_pdev_t *pdev)
 {
 	return ol_cfg_target_tx_credit(pdev->ctrl_pdev);
 }
+
+/**
+ * ol_tx_get_total_free_desc() - get total free descriptors
+ * @pdev: pdev handle
+ *
+ * Return: total free descriptors
+ */
+static inline
+uint32_t ol_tx_get_total_free_desc(struct ol_txrx_pdev_t *pdev)
+{
+	return pdev->tx_desc.num_free;
+}
+
 #endif
 
 /**
@@ -1643,11 +1684,6 @@ void ol_txrx_peer_unref_delete(ol_txrx_peer_handle peer)
 		/* check whether the parent vdev has no peers left */
 		if (TAILQ_EMPTY(&vdev->peer_list)) {
 			/*
-			 * Now that there are no references to the peer, we can
-			 * release the peer reference lock.
-			 */
-			cdf_spin_unlock_bh(&pdev->peer_ref_mutex);
-			/*
 			 * Check if the parent vdev was waiting for its peers
 			 * to be deleted, in order for it to be deleted too.
 			 */
@@ -1657,6 +1693,12 @@ void ol_txrx_peer_unref_delete(ol_txrx_peer_handle peer)
 				void *vdev_delete_context =
 					vdev->delete.context;
 
+				/*
+				 * Now that there are no references to the peer,
+				 * we can release the peer reference lock.
+				 */
+				cdf_spin_unlock_bh(&pdev->peer_ref_mutex);
+
 				TXRX_PRINT(TXRX_PRINT_LEVEL_INFO1,
 					   "%s: deleting vdev object %p "
 					   "(%02x:%02x:%02x:%02x:%02x:%02x)"
@@ -1672,9 +1714,12 @@ void ol_txrx_peer_unref_delete(ol_txrx_peer_handle peer)
 				cdf_mem_free(vdev);
 				if (vdev_delete_cb)
 					vdev_delete_cb(vdev_delete_context);
+			} else {
+				cdf_spin_unlock_bh(&pdev->peer_ref_mutex);
 			}
-		} else
+		} else {
 			cdf_spin_unlock_bh(&pdev->peer_ref_mutex);
+		}
 
 		/*
 		 * 'array' is allocated in addba handler and is supposed to be
@@ -1853,7 +1898,7 @@ int ol_txrx_get_tx_pending(ol_txrx_pdev_handle pdev_handle)
 
 	total = ol_tx_get_desc_global_pool_size(pdev);
 
-	return total - pdev->tx_desc.num_free;
+	return total - ol_tx_get_total_free_desc(pdev);
 }
 
 void ol_txrx_discard_tx_pending(ol_txrx_pdev_handle pdev_handle)
@@ -1920,7 +1965,8 @@ ol_txrx_fw_stats_cfg(ol_txrx_vdev_handle vdev,
 }
 
 A_STATUS
-ol_txrx_fw_stats_get(ol_txrx_vdev_handle vdev, struct ol_txrx_stats_req *req)
+ol_txrx_fw_stats_get(ol_txrx_vdev_handle vdev, struct ol_txrx_stats_req *req,
+			bool response_expected)
 {
 	struct ol_txrx_pdev_t *pdev = vdev->pdev;
 	uint64_t cookie;
@@ -1961,6 +2007,9 @@ ol_txrx_fw_stats_get(ol_txrx_vdev_handle vdev, struct ol_txrx_stats_req *req)
 		while (cdf_semaphore_acquire(pdev->osdev, req->wait.sem_ptr))
 			;
 
+	if (response_expected == false)
+		cdf_mem_free(non_volatile_req);
+
 	return A_OK;
 }
 #endif
@@ -2728,16 +2777,20 @@ void ol_txrx_ipa_uc_fw_op_event_handler(void *context,
 	if (cdf_unlikely(!pdev)) {
 		CDF_TRACE(CDF_MODULE_ID_TXRX, CDF_TRACE_LEVEL_ERROR,
 			      "%s: Invalid context", __func__);
+		cdf_mem_free(rxpkt);
 		return;
 	}
 
-	if (pdev->ipa_uc_op_cb)
+	if (pdev->ipa_uc_op_cb) {
 		pdev->ipa_uc_op_cb(rxpkt, pdev->osif_dev);
-	else
+	} else {
 		CDF_TRACE(CDF_MODULE_ID_TXRX, CDF_TRACE_LEVEL_ERROR,
 			      "%s: ipa_uc_op_cb NULL", __func__);
+		cdf_mem_free(rxpkt);
+	}
 }
 
+#ifdef QCA_CONFIG_SMP
 /**
  * ol_txrx_ipa_uc_op_response() - Handle OP command response from firmware
  * @pdev: handle to the HTT instance
@@ -2766,6 +2819,20 @@ void ol_txrx_ipa_uc_op_response(ol_txrx_pdev_handle pdev, uint8_t *op_msg)
 	pkt->staId = 0;
 	cds_indicate_rxpkt(sched_ctx, pkt);
 }
+#else
+void ol_txrx_ipa_uc_op_response(ol_txrx_pdev_handle pdev,
+				uint8_t *op_msg)
+{
+	if (pdev->ipa_uc_op_cb) {
+		pdev->ipa_uc_op_cb(op_msg, pdev->osif_dev);
+	} else {
+		CDF_TRACE(CDF_MODULE_ID_TXRX, CDF_TRACE_LEVEL_ERROR,
+		    "%s: IPA callback function is not registered", __func__);
+		cdf_mem_free(op_msg);
+		return;
+	}
+}
+#endif
 
 /**
  * ol_txrx_ipa_uc_register_op_cb() - Register OP handler function
diff --git a/core/dp/txrx/ol_txrx_flow_control.c b/core/dp/txrx/ol_txrx_flow_control.c
index 21d49908053f..77fd41ee1ed4 100644
--- a/core/dp/txrx/ol_txrx_flow_control.c
+++ b/core/dp/txrx/ol_txrx_flow_control.c
@@ -430,6 +430,9 @@ int ol_tx_delete_flow_pool(struct ol_tx_flow_pool_t *pool)
 		cdf_spin_unlock_bh(&pool->flow_pool_lock);
 
 		pdev->tx_desc.num_invalid_bin++;
+		TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+			"%s: invalid pool created %d\n",
+			 __func__, pdev->tx_desc.num_invalid_bin);
 		if (pdev->tx_desc.num_invalid_bin > MAX_INVALID_BIN)
 			ASSERT(0);
 
@@ -477,6 +480,9 @@ int ol_tx_free_invalid_flow_pool(struct ol_tx_flow_pool_t *pool)
 	cdf_spin_unlock_bh(&pool->flow_pool_lock);
 
 	pdev->tx_desc.num_invalid_bin--;
+	TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+		"%s: invalid pool deleted %d\n",
+		 __func__, pdev->tx_desc.num_invalid_bin);
 
 	return ol_tx_delete_flow_pool(pool);
 }
diff --git a/core/hdd/inc/qc_sap_ioctl.h b/core/hdd/inc/qc_sap_ioctl.h
index 6983a7a96ff1..d5b8259a7335 100644
--- a/core/hdd/inc/qc_sap_ioctl.h
+++ b/core/hdd/inc/qc_sap_ioctl.h
@@ -109,7 +109,7 @@ struct sQcSapreq_wscie {
  * Retrieve the WPS PBC Probe Request IEs.
  */
 typedef struct sQcSapreq_WPSPBCProbeReqIES {
-	uint8_t macaddr[QCSAP_ADDR_LEN];
+	struct cdf_mac_addr macaddr;
 	uint16_t probeReqIELen;
 	uint8_t probeReqIE[512];
 } sQcSapreq_WPSPBCProbeReqIES_t;
diff --git a/core/hdd/inc/wlan_hdd_assoc.h b/core/hdd/inc/wlan_hdd_assoc.h
index 190e756a7cb8..3549c7b2d5e1 100644
--- a/core/hdd/inc/wlan_hdd_assoc.h
+++ b/core/hdd/inc/wlan_hdd_assoc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -51,10 +51,6 @@
 /* Timeout (in ms) for Link to Up before Registering Station */
 #define ASSOC_LINKUP_TIMEOUT 60
 
-/* In pronto case, IBSS owns the first peer for bss peer.
-   In Rome case, IBSS uses the 2nd peer as bss peer */
-#define IBSS_BROADCAST_STAID 1
-
 /* Type Declarations */
 /**
  * typedef eConnectionState - Connection states
@@ -256,4 +252,13 @@ CDF_STATUS hdd_change_peer_state(hdd_adapter_t *pAdapter,
 				 uint8_t sta_id,
 				 enum ol_txrx_peer_state sta_state,
 				 bool roam_synch_in_progress);
+#ifdef WLAN_FEATURE_ROAM_OFFLOAD
+bool hdd_is_roam_sync_in_progress(tCsrRoamInfo *roaminfo);
+#else
+static inline bool hdd_is_roam_sync_in_progress(tCsrRoamInfo *roaminfo)
+{
+	return false;
+}
+#endif
+
 #endif
diff --git a/core/hdd/inc/wlan_hdd_cfg.h b/core/hdd/inc/wlan_hdd_cfg.h
index 56522889e4c4..10b5077bbe84 100644
--- a/core/hdd/inc/wlan_hdd_cfg.h
+++ b/core/hdd/inc/wlan_hdd_cfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -138,6 +138,21 @@
 #define CFG_MAX_RX_AMPDU_FACTOR_MAX            WNI_CFG_MAX_RX_AMPDU_FACTOR_STAMAX
 #define CFG_MAX_RX_AMPDU_FACTOR_DEFAULT        WNI_CFG_MAX_RX_AMPDU_FACTOR_STADEF
 
+/* Configuration option for HT MPDU density (Table 8-125 802.11-2012)
+ * 0 for no restriction
+ * 1 for 1/4 micro sec
+ * 2 for 1/2 micro sec
+ * 3 for 1 micro sec
+ * 4 for 2 micro sec
+ * 5 for 4 micro sec
+ * 6 for 8 micro sec
+ * 7 for 16 micro sec
+ */
+#define CFG_HT_MPDU_DENSITY_NAME               "ght_mpdu_density"
+#define CFG_HT_MPDU_DENSITY_MIN                WNI_CFG_MPDU_DENSITY_STAMIN
+#define CFG_HT_MPDU_DENSITY_MAX                WNI_CFG_MPDU_DENSITY_STAMAX
+#define CFG_HT_MPDU_DENSITY_DEFAULT            WNI_CFG_MPDU_DENSITY_STADEF
+
 /* Configuration added to enable/disable CTS2SELF in */
 /* Adaptive RX drain feature */
 #define CFG_ENABLE_ADAPT_RX_DRAIN_NAME     "gEnableAdaptRxDrain"
@@ -230,7 +245,6 @@ typedef enum {
 #define CFG_RSSI_CATEGORY_GAP_MAX              (100)
 #define CFG_RSSI_CATEGORY_GAP_DEFAULT          (5)
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 #define CFG_ROAM_PREFER_5GHZ                   "gRoamPrefer5GHz"
 #define CFG_ROAM_PREFER_5GHZ_MIN              (0)
 #define CFG_ROAM_PREFER_5GHZ_MAX              (1)
@@ -244,7 +258,6 @@ typedef enum {
 #define CFG_ROAM_INTRA_BAND_MIN               (0)
 #define CFG_ROAM_INTRA_BAND_MAX               (1)
 #define CFG_ROAM_INTRA_BAND_DEFAULT           (0)
-#endif
 
 #define CFG_SHORT_PREAMBLE_NAME                "gShortPreamble"
 #define CFG_SHORT_PREAMBLE_MIN                 WNI_CFG_SHORT_PREAMBLE_STAMIN
@@ -618,7 +631,6 @@ typedef enum {
 #define CFG_ESE_FEATURE_ENABLED_DEFAULT                     (0) /* disabled */
 #endif /* FEATURE_WLAN_ESE */
 
-#ifdef FEATURE_WLAN_LFR
 #define CFG_LFR_FEATURE_ENABLED_NAME                       "FastRoamEnabled"
 #define CFG_LFR_FEATURE_ENABLED_MIN                         (0)
 #define CFG_LFR_FEATURE_ENABLED_MAX                         (1)
@@ -628,9 +640,7 @@ typedef enum {
 #define CFG_LFR_MAWC_FEATURE_ENABLED_MIN                    (0)
 #define CFG_LFR_MAWC_FEATURE_ENABLED_MAX                    (1)
 #define CFG_LFR_MAWC_FEATURE_ENABLED_DEFAULT                (0) /* disabled */
-#endif /* FEATURE_WLAN_LFR */
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 /* This flag will control fasttransition in case of 11r and ese. */
 /* Basically with this the whole neighbor roam, pre-auth, reassoc */
 /* can be turned ON/OFF. */
@@ -670,8 +680,6 @@ typedef enum {
 #define CFG_ROAM_SCAN_HOME_AWAY_TIME_DEFAULT                (CFG_ROAM_SCAN_HOME_AWAY_TIME_MIN)
 /* disabled by default */
 
-#endif /* (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR) */
-
 #ifdef FEATURE_WLAN_OKC
 #define CFG_OKC_FEATURE_ENABLED_NAME                       "OkcEnabled"
 #define CFG_OKC_FEATURE_ENABLED_MIN                        (0)
@@ -832,11 +840,6 @@ typedef enum {
 #define CFG_QOS_IMPLICIT_SETUP_ENABLED_MAX                  (1)
 #define CFG_QOS_IMPLICIT_SETUP_ENABLED_DEFAULT              (1)
 
-#define CFG_ENABLE_LOGP_NAME                                "gEnableLogp"
-#define CFG_ENABLE_LOGP_MIN                                 (0)
-#define CFG_ENABLE_LOGP_MAX                                 (1)
-#define CFG_ENABLE_LOGP_DEFAULT                             (0)
-
 #if defined WLAN_FEATURE_VOWIFI_11R
 #define CFG_FT_RESOURCE_REQ_NAME                        "gFTResourceReqSupported"
 #define CFG_FT_RESOURCE_REQ_MIN                         (0)
@@ -869,7 +872,6 @@ typedef enum {
 #define CFG_BCN_EARLY_TERM_WAKE_MAX                  (255)
 #define CFG_BCN_EARLY_TERM_WAKE_DEFAULT              (3)
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 #define CFG_NEIGHBOR_SCAN_TIMER_PERIOD_NAME             "gNeighborScanTimerPeriod"
 #define CFG_NEIGHBOR_SCAN_TIMER_PERIOD_MIN              (3)
 #define CFG_NEIGHBOR_SCAN_TIMER_PERIOD_MAX              (300)
@@ -949,7 +951,6 @@ typedef enum {
 #define CFG_ROAM_BEACON_RSSI_WEIGHT_MIN                 (0)
 #define CFG_ROAM_BEACON_RSSI_WEIGHT_MAX                 (16)
 #define CFG_ROAM_BEACON_RSSI_WEIGHT_DEFAULT             (14)
-#endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
 
 #define CFG_QOS_WMM_BURST_SIZE_DEFN_NAME                        "burstSizeDefinition"
 #define CFG_QOS_WMM_BURST_SIZE_DEFN_MIN                         (0)
@@ -1246,6 +1247,29 @@ typedef enum {
 #define CFG_ENABLE_GREEN_AP_FEATURE_MIN     (0)
 #define CFG_ENABLE_GREEN_AP_FEATURE_MAX     (1)
 #define CFG_ENABLE_GREEN_AP_FEATURE_DEFAULT (1)
+
+/* Enhanced Green AP (EGAP) flags/params */
+#define CFG_ENABLE_EGAP_ENABLE_FEATURE             "gEnableEGAP"
+#define CFG_ENABLE_EGAP_ENABLE_FEATURE_MIN         (0)
+#define CFG_ENABLE_EGAP_ENABLE_FEATURE_MAX         (1)
+#define CFG_ENABLE_EGAP_ENABLE_FEATURE_DEFAULT     (0)
+
+#define CFG_ENABLE_EGAP_INACT_TIME_FEATURE         "gEGAPInactTime"
+#define CFG_ENABLE_EGAP_INACT_TIME_FEATURE_MIN     (0)
+#define CFG_ENABLE_EGAP_INACT_TIME_FEATURE_MAX     (5000)
+#define CFG_ENABLE_EGAP_INACT_TIME_FEATURE_DEFAULT (1000)
+
+#define CFG_ENABLE_EGAP_WAIT_TIME_FEATURE          "gEGAPWaitTime"
+#define CFG_ENABLE_EGAP_WAIT_TIME_FEATURE_MIN      (0)
+#define CFG_ENABLE_EGAP_WAIT_TIME_FEATURE_MAX      (5000)
+#define CFG_ENABLE_EGAP_WAIT_TIME_FEATURE_DEFAULT  (100)
+
+#define CFG_ENABLE_EGAP_FLAGS_FEATURE              "gEGAPFeatures"
+#define CFG_ENABLE_EGAP_FLAGS_FEATURE_MIN          (0)
+#define CFG_ENABLE_EGAP_FLAGS_FEATURE_MAX          (15)
+#define CFG_ENABLE_EGAP_FLAGS_FEATURE_DEFAULT      (7)
+/* end Enhanced Green AP flags/params */
+
 #endif
 
 #ifdef FEATURE_WLAN_FORCE_SAP_SCC
@@ -1538,22 +1562,35 @@ typedef enum {
 #define CFG_TDLS_TX_STATS_PERIOD                    "gTDLSTxStatsPeriod"
 #define CFG_TDLS_TX_STATS_PERIOD_MIN                (10)
 #define CFG_TDLS_TX_STATS_PERIOD_MAX                (4294967295UL)
-#define CFG_TDLS_TX_STATS_PERIOD_DEFAULT            (5000)
+#define CFG_TDLS_TX_STATS_PERIOD_DEFAULT            (500)
 
 #define CFG_TDLS_TX_PACKET_THRESHOLD                "gTDLSTxPacketThreshold"
 #define CFG_TDLS_TX_PACKET_THRESHOLD_MIN            (0)
 #define CFG_TDLS_TX_PACKET_THRESHOLD_MAX            (4294967295UL)
-#define CFG_TDLS_TX_PACKET_THRESHOLD_DEFAULT        (100)
+#define CFG_TDLS_TX_PACKET_THRESHOLD_DEFAULT        (10)
 
 #define CFG_TDLS_MAX_DISCOVERY_ATTEMPT              "gTDLSMaxDiscoveryAttempt"
 #define CFG_TDLS_MAX_DISCOVERY_ATTEMPT_MIN          (1)
 #define CFG_TDLS_MAX_DISCOVERY_ATTEMPT_MAX          (100)
 #define CFG_TDLS_MAX_DISCOVERY_ATTEMPT_DEFAULT      (5)
 
+/*  teardown notification interval (gTDLSIdleTimeout) should be multiple of
+ *  setup notification (gTDLSTxStatsPeriod) interval.
+ *  e.g.
+ *       if setup notification (gTDLSTxStatsPeriod) interval = 500, then
+ *       teardown notification (gTDLSIdleTimeout) interval should be 1000,
+ *       1500, 2000, 2500...
+ */
+#define CFG_TDLS_IDLE_TIMEOUT                       "gTDLSIdleTimeout"
+#define CFG_TDLS_IDLE_TIMEOUT_MIN                   (500)
+#define CFG_TDLS_IDLE_TIMEOUT_MAX                   (40000)
+#define CFG_TDLS_IDLE_TIMEOUT_DEFAULT               (5000)
+
+
 #define CFG_TDLS_IDLE_PACKET_THRESHOLD              "gTDLSIdlePacketThreshold"
 #define CFG_TDLS_IDLE_PACKET_THRESHOLD_MIN          (0)
 #define CFG_TDLS_IDLE_PACKET_THRESHOLD_MAX          (40000)
-#define CFG_TDLS_IDLE_PACKET_THRESHOLD_DEFAULT      (5)
+#define CFG_TDLS_IDLE_PACKET_THRESHOLD_DEFAULT      (3)
 
 #define CFG_TDLS_RSSI_TRIGGER_THRESHOLD             "gTDLSRSSITriggerThreshold"
 #define CFG_TDLS_RSSI_TRIGGER_THRESHOLD_MIN         (-120)
@@ -1641,6 +1678,20 @@ typedef enum {
 #define CFG_TDLS_SCAN_ENABLE_MIN                   (0)
 #define CFG_TDLS_SCAN_ENABLE_MAX                   (1)
 #define CFG_TDLS_SCAN_ENABLE_DEFAULT               (0)
+
+/* TDLS peer kickout threshold to fw
+ *     Firmware will use this value to determine, when to send TDLS
+ *     peer kick out event to host.
+ *     E.g.
+ *        if peer kick out threshold is 10, then firmware will wait for 10
+ *        consecutive packet failures and then send TDLS kickout
+ *        notification to host driver
+ */
+#define CFG_TDLS_PEER_KICKOUT_THRESHOLD            "gTDLSPeerKickoutThreshold"
+#define CFG_TDLS_PEER_KICKOUT_THRESHOLD_MIN        (10)
+#define CFG_TDLS_PEER_KICKOUT_THRESHOLD_MAX        (5000)
+#define CFG_TDLS_PEER_KICKOUT_THRESHOLD_DEFAULT    (96)
+
 #endif
 
 /* Enable/Disable LPWR Image(cMEM uBSP) Transition */
@@ -1681,6 +1732,15 @@ typedef enum {
 #define CFG_VHT_SU_BEAMFORMEE_CAP_FEATURE_MAX     (WNI_CFG_VHT_SU_BEAMFORMEE_CAP_STAMAX)
 #define CFG_VHT_SU_BEAMFORMEE_CAP_FEATURE_DEFAULT (WNI_CFG_VHT_SU_BEAMFORMEE_CAP_STADEF)
 
+/*
+ * Enable / Disable Tx beamformee in SAP mode
+ * Default: Disable
+ */
+#define CFG_VHT_ENABLE_TXBF_SAP_MODE         "gEnableTxBFeeSAP"
+#define CFG_VHT_ENABLE_TXBF_SAP_MODE_MIN     (0)
+#define CFG_VHT_ENABLE_TXBF_SAP_MODE_MAX     (1)
+#define CFG_VHT_ENABLE_TXBF_SAP_MODE_DEFAULT (0)
+
 #define CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED         "gTxBFCsnValue"
 #define CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_MIN     (WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_STAMIN)
 #define CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_MAX     (WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED_STAMAX - 1)
@@ -1887,7 +1947,11 @@ typedef enum {
 #define CFG_ENABLE_FW_LOG_NAME                   "gEnablefwlog"
 #define CFG_ENABLE_FW_LOG_DISABLE                (0)
 #define CFG_ENABLE_FW_LOG_ENABLE                 (1)
+#ifdef QCA_WIFI_3_0_ADRASTEA
 #define CFG_ENABLE_FW_LOG_DEFAULT                (CFG_ENABLE_FW_LOG_DISABLE)
+#else
+#define CFG_ENABLE_FW_LOG_DEFAULT                (CFG_ENABLE_FW_LOG_ENABLE)
+#endif
 
 /*
  * Enable/Disable SSR for USB
@@ -2776,6 +2840,43 @@ enum dot11p_mode {
 #define CFG_FIRST_SCAN_BUCKET_THRESHOLD_MAX       (-30)
 #define CFG_FIRST_SCAN_BUCKET_THRESHOLD_DEFAULT   (-30)
 
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+/*
+ * Enable IP subnet detection during legacy fast roming version 3.
+ * Legacy fast roaming could roam across IP subnets without host
+ * processors' knowledge. This feature enables firmware to wake up
+ * the host processor if it successfully determines change in the IP subnet.
+ * Change in IP subnet could potentially cause disruption in IP connnectivity
+ * if IP address is not refreshed.
+ */
+#define CFG_ENABLE_LFR_SUBNET_DETECTION    "gLFRSubnetDetectionEnable"
+#define CFG_ENABLE_LFR_SUBNET_MIN          (0)
+#define CFG_ENABLE_LFR_SUBNET_MAX          (1)
+#define CFG_ENABLE_LFR_SUBNET_DEFAULT      (1)
+#endif /* FEATURE_LFR_SUBNET_DETECTION */
+/* Option to report rssi in cfg80211_inform_bss_frame()
+ * 0 = use rssi value based on noise floor = -96 dBm
+ * 1 = use rssi value based on actual noise floor in hardware
+ */
+#define CFG_INFORM_BSS_RSSI_RAW_NAME               "gInformBssRssiRaw"
+#define CFG_INFORM_BSS_RSSI_RAW_MIN                (0)
+#define CFG_INFORM_BSS_RSSI_RAW_MAX                (1)
+#define CFG_INFORM_BSS_RSSI_RAW_DEFAULT            (1)
+
+#ifdef QCA_WIFI_3_0_EMU
+/*
+ * On M2M emulation platform we have a fixed mapping between macs, hence
+ * vdev transition & MCC support is not possible on this platform. But MPR
+ * platform doesn't have these limitations. This config allows at runtime
+ * enable/disable vdev transition & MCC support depending on the platform
+ * it is running on
+ */
+#define CFG_ENABLE_M2M_LIMITATION              "gEnableM2MLimitation"
+#define CFG_ENABLE_M2M_LIMITATION_MIN          (0)
+#define CFG_ENABLE_M2M_LIMITATION_MAX          (1)
+#define CFG_ENABLE_M2M_LIMITATION_DEFAULT      (1)
+#endif /* QCA_WIFI_3_0_EMU */
+
 /*---------------------------------------------------------------------------
    Type declarations
    -------------------------------------------------------------------------*/
@@ -2794,7 +2895,6 @@ struct hdd_config {
 	bool fSupplicantCountryCodeHasPriority;
 	uint32_t HeartbeatThresh24;
 	char PowerUsageControl[4];
-	bool fIsLogpEnabled;
 	bool fIsImpsEnabled;
 	bool is_ps_enabled;
 	uint32_t nBmpsModListenInterval;
@@ -2850,7 +2950,6 @@ struct hdd_config {
 	bool fFTResourceReqSupported;
 #endif
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	uint16_t nNeighborScanPeriod;
 	uint8_t nNeighborLookupRssiThreshold;
 	uint8_t delay_before_vdev_stop;
@@ -2869,7 +2968,6 @@ struct hdd_config {
 	uint32_t nhi_rssi_scan_rssi_delta;
 	uint32_t nhi_rssi_scan_delay;
 	int32_t nhi_rssi_scan_rssi_ub;
-#endif
 
 	/* Additional Handoff params */
 	uint32_t nRoamingTime;
@@ -2922,19 +3020,15 @@ struct hdd_config {
 	uint32_t InfraUapsdBeSuspIntv;
 	uint32_t InfraUapsdBkSrvIntv;
 	uint32_t InfraUapsdBkSuspIntv;
-#ifdef FEATURE_WLAN_LFR
 	bool isFastRoamIniFeatureEnabled;
 	bool MAWCEnabled;
-#endif
 #ifdef FEATURE_WLAN_ESE
 	uint32_t InfraInactivityInterval;
 	bool isEseIniFeatureEnabled;
 #endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	bool isFastTransitionEnabled;
 	uint8_t RoamRssiDiff;
 	bool isWESModeEnabled;
-#endif
 #ifdef FEATURE_WLAN_OKC
 	bool isOkcIniFeatureEnabled;
 #endif
@@ -3043,12 +3137,10 @@ struct hdd_config {
 	int32_t linkSpeedRssiHigh;
 	int32_t linkSpeedRssiMid;
 	int32_t linkSpeedRssiLow;
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	bool nRoamPrefer5GHz;
 	bool nRoamIntraBand;
 	uint8_t nProbes;
 	uint16_t nRoamScanHomeAwayTime;
-#endif
 	uint8_t enableMCC;
 	uint8_t allowMCCGODiffBI;
 	bool isP2pDeviceAddrAdministrated;
@@ -3058,6 +3150,7 @@ struct hdd_config {
 	uint8_t vhtRxMCS;
 	uint8_t vhtTxMCS;
 	bool enableTxBF;
+	bool enable_txbf_sap_mode;
 	uint8_t txBFCsnValue;
 	bool enable_su_tx_bformer;
 	uint8_t vhtRxMCS2x2;
@@ -3087,6 +3180,7 @@ struct hdd_config {
 	uint32_t fTDLSTxStatsPeriod;
 	uint32_t fTDLSTxPacketThreshold;
 	uint32_t fTDLSMaxDiscoveryAttempt;
+	uint32_t tdls_idle_timeout;
 	uint32_t fTDLSIdlePacketThreshold;
 	int32_t fTDLSRSSITriggerThreshold;
 	int32_t fTDLSRSSITeardownThreshold;
@@ -3104,6 +3198,7 @@ struct hdd_config {
 	uint8_t fTDLSPrefOffChanNum;
 	uint8_t fTDLSPrefOffChanBandwidth;
 	uint8_t enable_tdls_scan;
+	uint32_t tdls_peer_kickout_threshold;
 #endif
 #ifdef WLAN_SOFTAP_VSTA_FEATURE
 	bool fEnableVSTASupport;
@@ -3247,6 +3342,10 @@ struct hdd_config {
 
 #ifdef FEATURE_GREEN_AP
 	bool enableGreenAP;
+	bool enable_egap;
+	uint32_t egap_feature_flag;
+	uint32_t egap_inact_time;
+	uint32_t egap_wait_time;
 #endif
 	uint8_t force_sap_acs;
 	uint8_t force_sap_acs_st_ch;
@@ -3355,6 +3454,14 @@ struct hdd_config {
 	int8_t early_stop_scan_min_threshold;
 	int8_t early_stop_scan_max_threshold;
 	int8_t first_scan_bucket_threshold;
+	uint8_t ht_mpdu_density;
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+	bool enable_lfr_subnet_detection;
+#endif
+	uint8_t inform_bss_rssi_raw;
+#ifdef QCA_WIFI_3_0_EMU
+	bool enable_m2m_limitation;
+#endif
 };
 
 #define VAR_OFFSET(_Struct, _Var) (offsetof(_Struct, _Var))
@@ -3444,7 +3551,7 @@ typedef enum {
 typedef struct tREG_TABLE_ENTRY {
 
 	char *RegName;          /* variable name in the qcom_cfg.ini file */
-	WLAN_PARAMETER_TYPE RegType;    /* variable type in the hdd_config_t structure */
+	WLAN_PARAMETER_TYPE RegType;    /* variable type in hdd_config struct */
 	unsigned long Flags;    /* Specify optional parms and if RangeCheck is performed */
 	unsigned short VarOffset;       /* offset to field from the base address of the structure */
 	unsigned short VarSize; /* size (in bytes) of the field */
diff --git a/core/hdd/inc/wlan_hdd_host_offload.h b/core/hdd/inc/wlan_hdd_host_offload.h
index 515a8285510a..e0b4b4e99cb3 100644
--- a/core/hdd/inc/wlan_hdd_host_offload.h
+++ b/core/hdd/inc/wlan_hdd_host_offload.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -51,8 +51,8 @@ typedef struct {
 	uint8_t offloadType;
 	uint8_t enableOrDisable;
 	union {
-		uint8_t hostIpv4Addr[4];
-		uint8_t hostIpv6Addr[16];
+		uint8_t hostIpv4Addr[SIR_IPV4_ADDR_LEN];
+		uint8_t hostIpv6Addr[SIR_MAC_IPV6_ADDR_LEN];
 	} params;
 	struct cdf_mac_addr bssId;
 } tHostOffloadRequest, *tpHostOffloadRequest;
diff --git a/core/hdd/inc/wlan_hdd_main.h b/core/hdd/inc/wlan_hdd_main.h
index 48a27c97e7ea..1e0e388c8087 100644
--- a/core/hdd/inc/wlan_hdd_main.h
+++ b/core/hdd/inc/wlan_hdd_main.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -156,8 +156,9 @@
 
 #define WLAN_CHIP_VERSION   "WCNSS"
 
+#ifndef HDD_DISALLOW_LEGACY_HDDLOG
 #define hddLog(level, args ...) CDF_TRACE(CDF_MODULE_ID_HDD, level, ## args)
-
+#endif
 #define hdd_log(level, args...) CDF_TRACE(CDF_MODULE_ID_HDD, level, ## args)
 #define hdd_logfl(level, format, args...) hdd_log(level, FL(format), ## args)
 
@@ -529,14 +530,23 @@ typedef struct beacon_data_s {
 	int dtim_period;
 } beacon_data_t;
 
-/* MAINTAIN 1 - 1 CORRESPONDENCE WITH tCDF_CON_MODE */
+/**
+ * enum device_mode: Maintain one to one correspondence with tCDF_ADAPTER_MODE
+ * @WLAN_HDD_INFRA_STATION: station mode
+ * @WLAN_HDD_SOFTAP: sap mode
+ * @WLAN_HDD_P2P_CLIENT: p2p client mode
+ * @WLAN_HDD_P2P_GO: p2p go mode
+ * @WLAN_HDD_FTM: ftm mode
+ * @WLAN_HDD_IBSS: ibss mode
+ * @WLAN_HDD_P2P_DEVICE: p2p device mode
+ * @WLAN_HDD_OCB: ocb mode
+ */
 typedef enum device_mode {
 	WLAN_HDD_INFRA_STATION,
 	WLAN_HDD_SOFTAP,
 	WLAN_HDD_P2P_CLIENT,
 	WLAN_HDD_P2P_GO,
-	/* Mode 5 is reserved for FTM */
-	WLAN_HDD_FTM = 5,
+	WLAN_HDD_FTM,
 	WLAN_HDD_IBSS,
 	WLAN_HDD_P2P_DEVICE,
 	WLAN_HDD_OCB
@@ -623,12 +633,6 @@ typedef struct hdd_cfg80211_state_s {
 	eP2PActionFrameState actionFrmState;
 } hdd_cfg80211_state_t;
 
-typedef enum {
-	HDD_SSR_NOT_REQUIRED,
-	HDD_SSR_REQUIRED,
-	HDD_SSR_DISABLED,
-} e_hdd_ssr_required;
-
 struct hdd_station_ctx {
 	/** Handle to the Wireless Extension State */
 	hdd_wext_state_t WextState;
@@ -642,9 +646,7 @@ struct hdd_station_ctx {
 
 	roaming_info_t roam_info;
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	int ft_carrier_on;
-#endif
 
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 	tSirGtkOffloadParams gtkOffloadReqParams;
@@ -662,6 +664,8 @@ struct hdd_station_ctx {
 
 	/* STA ctx debug variables */
 	int staDebugState;
+
+	uint8_t broadcast_ibss_staid;
 };
 
 #define BSS_STOP    0
@@ -813,13 +817,20 @@ struct hdd_netif_queue_history {
 
 
 struct hdd_adapter_s {
-	void *pHddCtx;
+	/* Magic cookie for adapter sanity verification.  Note that this
+	 * needs to be at the beginning of the private data structure so
+	 * that it will exists at the beginning of dev->priv and hence
+	 * will always be in mapped memory
+	 */
+	uint32_t magic;
 
-	device_mode_t device_mode;
+	void *pHddCtx;
 
 	/** Handle to the network device */
 	struct net_device *dev;
 
+	device_mode_t device_mode;
+
 	/** IPv4 notifier callback for handling ARP offload on change in IP */
 	struct work_struct ipv4NotifierWorkQueue;
 #ifdef WLAN_NS_OFFLOAD
@@ -939,8 +950,6 @@ struct hdd_adapter_s {
 #endif
 	uint8_t addr_filter_pattern;
 
-	/* Magic cookie for adapter sanity verification */
-	uint32_t magic;
 	bool higherDtimTransition;
 	bool survey_idx;
 
@@ -1127,12 +1136,6 @@ struct hdd_context_s {
 	bool is_ol_rx_thread_suspended;
 #endif
 
-	volatile bool isLogpInProgress;
-
-	bool isLoadInProgress;
-
-	bool isUnloadInProgress;
-
 	/* Track whether Mcast/Bcast Filter is enabled. */
 	bool hdd_mcastbcast_filter_set;
 
@@ -1142,10 +1145,6 @@ struct hdd_context_s {
 	/* Lock to avoid race condition during start/stop bss */
 	struct mutex sap_lock;
 
-#ifdef WLAN_KD_READY_NOTIFIER
-	bool kd_nl_init;
-#endif /* WLAN_KD_READY_NOTIFIER */
-
 #ifdef FEATURE_OEM_DATA_SUPPORT
 	/* OEM App registered or not */
 	bool oem_app_registered;
@@ -1203,7 +1202,7 @@ struct hdd_context_s {
 	/* Use below lock to protect access to isSchedScanUpdatePending
 	 * since it will be accessed in two different contexts.
 	 */
-	spinlock_t schedScan_lock;
+	cdf_spinlock_t sched_scan_lock;
 
 	/* Flag keeps track of wiphy suspend/resume */
 	bool isWiphySuspended;
@@ -1320,8 +1319,7 @@ struct hdd_context_s {
 
 	cdf_mc_timer_t dbs_opportunistic_timer;
 	bool connection_in_progress;
-	spinlock_t connection_status_lock;
-	cdf_mutex_t hdd_conc_list_lock;
+	cdf_spinlock_t connection_status_lock;
 
 	uint16_t hdd_txrx_hist_idx;
 	struct hdd_tx_rx_histogram hdd_txrx_hist[NUM_TX_RX_HISTOGRAM];
@@ -1336,6 +1334,9 @@ struct hdd_context_s {
 /*---------------------------------------------------------------------------
    Function declarations and documentation
    -------------------------------------------------------------------------*/
+int hdd_validate_channel_and_bandwidth(hdd_adapter_t *adapter,
+				uint32_t chan_number,
+				phy_ch_width chan_bw);
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
 void wlan_hdd_check_sta_ap_concurrent_ch_intf(void *sta_pAdapter);
 #endif
@@ -1363,10 +1364,10 @@ CDF_STATUS hdd_add_adapter_front(hdd_context_t *pHddCtx,
 
 hdd_adapter_t *hdd_open_adapter(hdd_context_t *pHddCtx, uint8_t session_type,
 				const char *name, tSirMacAddr macAddr,
-				uint8_t rtnl_held);
+				bool rtnl_held);
 CDF_STATUS hdd_close_adapter(hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter,
-			     uint8_t rtnl_held);
-CDF_STATUS hdd_close_all_adapters(hdd_context_t *pHddCtx);
+			     bool rtnl_held);
+CDF_STATUS hdd_close_all_adapters(hdd_context_t *pHddCtx, bool rtnl_held);
 CDF_STATUS hdd_stop_all_adapters(hdd_context_t *pHddCtx);
 CDF_STATUS hdd_reset_all_adapters(hdd_context_t *pHddCtx);
 CDF_STATUS hdd_start_all_adapters(hdd_context_t *pHddCtx);
@@ -1385,8 +1386,8 @@ uint8_t *wlan_hdd_get_intf_addr(hdd_context_t *pHddCtx);
 void wlan_hdd_release_intf_addr(hdd_context_t *pHddCtx, uint8_t *releaseAddr);
 uint8_t hdd_get_operating_channel(hdd_context_t *pHddCtx, device_mode_t mode);
 
-void hdd_set_conparam(uint32_t newParam);
-tCDF_CON_MODE hdd_get_conparam(void);
+void hdd_set_conparam(uint32_t con_param);
+enum tCDF_GLOBAL_CON_MODE hdd_get_conparam(void);
 
 void hdd_abort_mac_scan(hdd_context_t *pHddCtx, uint8_t sessionId,
 			eCsrAbortReason reason);
@@ -1397,8 +1398,6 @@ void wlan_hdd_reset_prob_rspies(hdd_adapter_t *pHostapdAdapter);
 void hdd_prevent_suspend(uint32_t reason);
 void hdd_allow_suspend(uint32_t reason);
 void hdd_prevent_suspend_timeout(uint32_t timeout, uint32_t reason);
-bool hdd_is_ssr_required(void);
-void hdd_set_ssr_required(e_hdd_ssr_required value);
 
 void wlan_hdd_cfg80211_update_wiphy_caps(struct wiphy *wiphy);
 CDF_STATUS hdd_set_ibss_power_save_params(hdd_adapter_t *pAdapter);
@@ -1425,6 +1424,9 @@ static inline void hdd_stop_bus_bw_computer_timer(hdd_adapter_t *pAdapter)
 }
 #endif
 
+int hdd_init(void);
+void hdd_deinit(void);
+
 int hdd_wlan_startup(struct device *dev, void *hif_sc);
 void __hdd_wlan_exit(void);
 int hdd_wlan_notify_modem_power_state(int state);
@@ -1453,23 +1455,6 @@ bool hdd_is_5g_supported(hdd_context_t *pHddCtx);
 
 int wlan_hdd_scan_abort(hdd_adapter_t *pAdapter);
 
-#ifdef WLAN_FEATURE_STATS_EXT
-void wlan_hdd_cfg80211_stats_ext_init(hdd_context_t *pHddCtx);
-#endif
-
-#ifdef WLAN_FEATURE_LINK_LAYER_STATS
-void wlan_hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx);
-static inline bool hdd_link_layer_stats_supported(void)
-{
-	return true;
-}
-#else
-static inline bool hdd_link_layer_stats_supported(void)
-{
-	return false;
-}
-#endif /* WLAN_FEATURE_LINK_LAYER_STATS */
-
 void hdd_get_fw_version(hdd_context_t *hdd_ctx,
 			uint32_t *major_spid, uint32_t *minor_spid,
 			uint32_t *siid, uint32_t *crmid);
@@ -1496,10 +1481,8 @@ static inline bool hdd_is_memdump_supported(void)
 
 void hdd_update_macaddr(struct hdd_config *config,
 			struct cdf_mac_addr hw_macaddr);
-#if defined(FEATURE_WLAN_LFR)
 void wlan_hdd_disable_roaming(hdd_adapter_t *pAdapter);
 void wlan_hdd_enable_roaming(hdd_adapter_t *pAdapter);
-#endif
 
 CDF_STATUS hdd_post_cds_enable_config(hdd_context_t *pHddCtx);
 
@@ -1517,7 +1500,6 @@ void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter);
 static inline void wlan_hdd_stop_sap(hdd_adapter_t *ap_adapter) {}
 static inline void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter) {}
 #endif
-cdf_wake_lock_t *hdd_wlan_get_wake_lock_ptr(void);
 
 #ifdef QCA_CONFIG_SMP
 int wlan_hdd_get_cpu(void);
@@ -1537,7 +1519,10 @@ void wlan_hdd_clear_tx_rx_histogram(hdd_context_t *pHddCtx);
 void wlan_hdd_display_netif_queue_history(hdd_context_t *hdd_ctx);
 void wlan_hdd_clear_netif_queue_history(hdd_context_t *hdd_ctx);
 const char *hdd_get_fwpath(void);
-
+void hdd_indicate_mgmt_frame(tSirSmeMgmtFrameInd *frame_ind);
+hdd_adapter_t *hdd_get_adapter_by_sme_session_id(hdd_context_t *hdd_ctx,
+						uint32_t sme_session_id);
+phy_ch_width hdd_map_nl_chan_width(enum nl80211_chan_width ch_width);
 uint8_t wlan_hdd_find_opclass(tHalHandle hal, uint8_t channel,
 			uint8_t bw_offset);
 
diff --git a/core/hdd/inc/wlan_hdd_oemdata.h b/core/hdd/inc/wlan_hdd_oemdata.h
index 9107dc315afe..82ea3e18263c 100644
--- a/core/hdd/inc/wlan_hdd_oemdata.h
+++ b/core/hdd/inc/wlan_hdd_oemdata.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -25,8 +25,6 @@
  * to the Linux Foundation.
  */
 
-#ifdef FEATURE_OEM_DATA_SUPPORT
-
 /**
  * DOC: wlan_hdd_oemdata.h
  *
@@ -36,6 +34,8 @@
 #ifndef __WLAN_HDD_OEM_DATA_H__
 #define __WLAN_HDD_OEM_DATA_H__
 
+#ifdef FEATURE_OEM_DATA_SUPPORT
+
 #ifndef OEM_DATA_REQ_SIZE
 #define OEM_DATA_REQ_SIZE 280
 #endif
@@ -166,7 +166,10 @@ int iw_get_oem_data_cap(struct net_device *dev, struct iw_request_info *info,
 int oem_activate_service(struct hdd_context_s *hdd_ctx);
 
 void hdd_send_oem_data_rsp_msg(int length, uint8_t *oemDataRsp);
-
-#endif /* __WLAN_HDD_OEM_DATA_H__ */
-
+#else
+static inline int oem_activate_service(struct hdd_context_s *hdd_ctx)
+{
+	return 0;
+}
 #endif /* FEATURE_OEM_DATA_SUPPORT */
+#endif /* __WLAN_HDD_OEM_DATA_H__ */
diff --git a/core/hdd/inc/wlan_hdd_p2p.h b/core/hdd/inc/wlan_hdd_p2p.h
index b9ef3445f627..cfd9aaf686d1 100644
--- a/core/hdd/inc/wlan_hdd_p2p.h
+++ b/core/hdd/inc/wlan_hdd_p2p.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -38,7 +38,6 @@
 #define WAIT_CANCEL_REM_CHAN    1000
 #define WAIT_REM_CHAN_READY     1000
 #define WAIT_CHANGE_CHANNEL_FOR_OFFCHANNEL_TX 3000
-#define ESTIMATED_ROC_DUR_REQD_FOR_ACTION_TX 20
 #define COMPLETE_EVENT_PROPOGATE_TIME 10
 
 #ifdef QCA_WIFI_3_0_EMU
@@ -61,19 +60,9 @@
 #define P2P_ROC_DURATION_MULTIPLIER_GO_ABSENT    5
 #endif
 
-#ifdef WLAN_FEATURE_11W
-#define WLAN_HDD_SET_WEP_FRM_FC(__fc__)     ((__fc__) = ((__fc__) | 0x40))
-#endif /* WLAN_FEATURE_11W */
-
 #define HDD_P2P_MAX_ROC_DURATION 1000
 #define MAX_ROC_REQ_QUEUE_ENTRY 10
 
-enum hdd_rx_flags {
-	HDD_RX_FLAG_DECRYPTED = 1 << 0,
-	HDD_RX_FLAG_MMIC_STRIPPED = 1 << 1,
-	HDD_RX_FLAG_IV_STRIPPED = 1 << 2,
-};
-
 #define P2P_POWER_SAVE_TYPE_OPPORTUNISTIC        (1 << 0)
 #define P2P_POWER_SAVE_TYPE_PERIODIC_NOA         (1 << 1)
 #define P2P_POWER_SAVE_TYPE_SINGLE_NOA           (1 << 2)
@@ -103,38 +92,23 @@ typedef struct p2p_app_setP2pPs {
 } p2p_app_setP2pPs_t;
 
 int wlan_hdd_cfg80211_remain_on_channel(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 					struct wireless_dev *wdev,
-#else
-					struct net_device *dev,
-#endif
 					struct ieee80211_channel *chan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-					enum nl80211_channel_type channel_type,
-#endif
 					unsigned int duration, u64 *cookie);
 
 int wlan_hdd_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 					       struct wireless_dev *wdev,
-#else
-					       struct net_device *dev,
-#endif
 					       u64 cookie);
 
 int wlan_hdd_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 					  struct wireless_dev *wdev,
-#else
-					  struct net_device *dev,
-#endif
 					  u64 cookie);
 
 int hdd_set_p2p_ps(struct net_device *dev, void *msgData);
 int hdd_set_p2p_opps(struct net_device *dev, uint8_t *command);
 int hdd_set_p2p_noa(struct net_device *dev, uint8_t *command);
 
-void hdd_indicate_mgmt_frame(hdd_adapter_t *pAdapter,
+void __hdd_indicate_mgmt_frame(hdd_adapter_t *pAdapter,
 			     uint32_t nFrameLength, uint8_t *pbFrames,
 			     uint8_t frameType, uint32_t rxChan, int8_t rxRssi);
 
@@ -147,54 +121,22 @@ void wlan_hdd_cancel_existing_remain_on_channel(hdd_adapter_t *pAdapter);
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
 int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		     struct cfg80211_mgmt_tx_params *params, u64 *cookie);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+#else
 int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		     struct ieee80211_channel *chan, bool offchan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-		     enum nl80211_channel_type channel_type,
-		     bool channel_type_valid,
-#endif
 		     unsigned int wait,
 		     const u8 *buf, size_t len, bool no_cck,
 		     bool dont_wait_for_ack, u64 *cookie);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
-int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
-		     struct ieee80211_channel *chan, bool offchan,
-		     enum nl80211_channel_type channel_type,
-		     bool channel_type_valid, unsigned int wait,
-		     const u8 *buf, size_t len, bool no_cck,
-		     bool dont_wait_for_ack, u64 *cookie);
-#else
-int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
-		     struct ieee80211_channel *chan, bool offchan,
-		     enum nl80211_channel_type channel_type,
-		     bool channel_type_valid, unsigned int wait,
-		     const u8 *buf, size_t len, u64 *cookie);
 #endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
 struct wireless_dev *wlan_hdd_add_virtual_intf(struct wiphy *wiphy,
 					       const char *name,
 					       enum nl80211_iftype type,
 					       u32 *flags,
 					       struct vif_params *params);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
-struct wireless_dev *wlan_hdd_add_virtual_intf(struct wiphy *wiphy, char *name,
-					       enum nl80211_iftype type,
-					       u32 *flags,
-					       struct vif_params *params);
-#else
-struct net_device *wlan_hdd_add_virtual_intf(struct wiphy *wiphy, char *name,
-					     enum nl80211_iftype type,
-					     u32 *flags,
-					     struct vif_params *params);
-#endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 int wlan_hdd_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev);
-#else
-int wlan_hdd_del_virtual_intf(struct wiphy *wiphy, struct net_device *dev);
-#endif
+
 
 void wlan_hdd_cleanup_remain_on_channel_ctx(hdd_adapter_t *pAdapter);
 
diff --git a/core/hdd/inc/wlan_hdd_power.h b/core/hdd/inc/wlan_hdd_power.h
index c6157f037516..df3a0d0ba3e8 100644
--- a/core/hdd/inc/wlan_hdd_power.h
+++ b/core/hdd/inc/wlan_hdd_power.h
@@ -39,18 +39,6 @@
 #ifdef WLAN_FEATURE_PACKET_FILTERING
 
 #define HDD_MAX_CMP_PER_PACKET_FILTER     5
-#define HDD_FILTER_IPV6_MC_UC             1
-#define HDD_FILTER_IPV6_MC                0
-#define HDD_FILTER_ID_IPV6_MC             10
-#define HDD_FILTER_ID_IPV6_UC             11
-
-#define HDD_IPV6_MC_CMP_DATA              0x33
-#define HDD_IPV6_UC_CMP_DATA              0x01
-#define HDD_IPV6_CMP_DATA_0               0x86
-#define HDD_IPV6_CMP_DATA_1               0xDD
-
-#define HDD_WLAN_MAC_ADDR_LEN             6
-#define HDD_MAX_NUM_MULTICAST_ADDRESS     10
 
 /**
  * enum pkt_filter_protocol_layer - packet filter protocol layer
@@ -167,14 +155,10 @@ void hdd_ipv6_notifier_work_queue(struct work_struct *work);
 #endif
 
 int wlan_hdd_cfg80211_get_txpower(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 				  struct wireless_dev *wdev,
-#endif
 				  int *dbm);
 int wlan_hdd_cfg80211_set_txpower(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 				  struct wireless_dev *wdev,
-#endif
 				  enum nl80211_tx_power_setting type,
 				  int dbm);
 int wlan_hdd_cfg80211_set_power_mgmt(struct wiphy *wiphy,
diff --git a/core/hdd/inc/wlan_hdd_tdls.h b/core/hdd/inc/wlan_hdd_tdls.h
index 33557fc20901..db275de7c946 100644
--- a/core/hdd/inc/wlan_hdd_tdls.h
+++ b/core/hdd/inc/wlan_hdd_tdls.h
@@ -34,20 +34,6 @@
 
 #ifdef FEATURE_WLAN_TDLS
 
-#define TDLS_SUB_DISCOVERY_PERIOD   100
-
-#define TDLS_MAX_DISCOVER_REQS_PER_TIMER 1
-
-#define TDLS_DISCOVERY_PERIOD       3600000
-
-#define TDLS_TX_STATS_PERIOD        3600000
-
-#define TDLS_IMPLICIT_TRIGGER_PKT_THRESHOLD     100
-
-#define TDLS_RX_IDLE_TIMEOUT        5000
-
-#define TDLS_RSSI_TRIGGER_HYSTERESIS 50
-
 /*
  * Before UpdateTimer expires, we want to timeout discovery response
  * should not be more than 2000.
@@ -115,9 +101,6 @@ typedef struct {
  */
 typedef struct {
 	struct wiphy *wiphy;
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-	struct net_device *dev;
-#endif
 	struct cfg80211_scan_request *scan_request;
 	int magic;
 	int attempt;
@@ -134,12 +117,15 @@ typedef struct {
  * @eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY: suppress implicit trigger,
  *			but respond to the peer
  * @eTDLS_SUPPORT_ENABLED: implicit trigger
+ * @eTDLS_SUPPORT_EXTERNAL_CONTROL: External control means implicit
+ *     trigger but only to a peer mac configured by user space.
  */
 typedef enum {
 	eTDLS_SUPPORT_NOT_ENABLED = 0,
 	eTDLS_SUPPORT_DISABLED,
 	eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY,
 	eTDLS_SUPPORT_ENABLED,
+	eTDLS_SUPPORT_EXTERNAL_CONTROL,
 } eTDLSSupportMode;
 
 /**
@@ -394,6 +380,9 @@ typedef struct {
  * @puapsd_mask: puapsd mask
  * @puapsd_inactivity_time: puapsd inactivity time
  * @puapsd_rx_frame_threshold: puapsd rx frame threshold
+ * @teardown_notification_ms: tdls teardown notification interval
+ * @tdls_peer_kickout_threshold: tdls packets threshold
+ *    for peer kickout operation
  */
 typedef struct {
 	uint32_t vdev_id;
@@ -409,6 +398,8 @@ typedef struct {
 	uint32_t puapsd_mask;
 	uint32_t puapsd_inactivity_time;
 	uint32_t puapsd_rx_frame_threshold;
+	uint32_t teardown_notification_ms;
+	uint32_t tdls_peer_kickout_threshold;
 } tdlsInfo_t;
 
 int wlan_hdd_tdls_init(hdd_adapter_t *pAdapter);
@@ -492,15 +483,9 @@ hddTdlsPeer_t *wlan_hdd_tdls_is_progress(hdd_context_t *pHddCtx,
 
 int wlan_hdd_tdls_copy_scan_context(hdd_context_t *pHddCtx,
 				    struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-				    struct net_device *dev,
-#endif
 				    struct cfg80211_scan_request *request);
 
 int wlan_hdd_tdls_scan_callback(hdd_adapter_t *pAdapter, struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-				struct net_device *dev,
-#endif
 				struct cfg80211_scan_request *request);
 
 void wlan_hdd_tdls_scan_done_callback(hdd_adapter_t *pAdapter);
@@ -523,6 +508,10 @@ int wlan_hdd_tdls_set_extctrl_param(hdd_adapter_t *pAdapter,
 int wlan_hdd_tdls_set_force_peer(hdd_adapter_t *pAdapter, const uint8_t *mac,
 				 bool forcePeer);
 
+int wlan_hdd_tdls_update_peer_mac(hdd_adapter_t *adapter,
+				const uint8_t *mac,
+				uint32_t peer_state);
+
 int wlan_hdd_tdls_extctrl_deconfig_peer(hdd_adapter_t *pAdapter,
 					const uint8_t *peer);
 int wlan_hdd_tdls_extctrl_config_peer(hdd_adapter_t *pAdapter,
@@ -618,6 +607,7 @@ int hdd_set_tdls_offchannel(hdd_context_t *hdd_ctx, int offchannel);
 int hdd_set_tdls_secoffchanneloffset(hdd_context_t *hdd_ctx, int offchanoffset);
 int hdd_set_tdls_offchannelmode(hdd_adapter_t *adapter, int offchanmode);
 int hdd_set_tdls_scan_type(hdd_context_t *hdd_ctx, int val);
+void hdd_tdls_pre_init(hdd_context_t *hdd_ctx);
 
 #else
 static inline void hdd_tdls_notify_mode_change(hdd_adapter_t *adapter,
@@ -631,6 +621,8 @@ wlan_hdd_tdls_disable_offchan_and_teardown_links(hdd_context_t *hddctx)
 static inline void wlan_hdd_tdls_exit(hdd_adapter_t *adapter)
 {
 }
+
+static inline void hdd_tdls_pre_init(hdd_context_t *hdd_ctx) { }
 #endif /* End of FEATURE_WLAN_TDLS */
 
 #endif /* __HDD_TDLS_H */
diff --git a/core/hdd/inc/wlan_hdd_trace.h b/core/hdd/inc/wlan_hdd_trace.h
index 12e25d5b1a46..0703b2e8847e 100644
--- a/core/hdd/inc/wlan_hdd_trace.h
+++ b/core/hdd/inc/wlan_hdd_trace.h
@@ -108,7 +108,8 @@
 	ENUM(TRACE_CODE_HDD_CFG80211_SUSPEND_WLAN) \
 	ENUM(TRACE_CODE_HDD_CFG80211_SET_MAC_ACL) \
 	ENUM(TRACE_CODE_HDD_CFG80211_TESTMODE) \
-	ENUM(TRACE_CODE_HDD_CFG80211_DUMP_SURVEY)
+	ENUM(TRACE_CODE_HDD_CFG80211_DUMP_SURVEY) \
+	ENUM(TRACE_CODE_HDD_RX_SME_MSG)
 
 enum {
 #undef ENUM
diff --git a/core/hdd/inc/wlan_hdd_tx_rx.h b/core/hdd/inc/wlan_hdd_tx_rx.h
index b4b29cca5adf..fc80851a1430 100644
--- a/core/hdd/inc/wlan_hdd_tx_rx.h
+++ b/core/hdd/inc/wlan_hdd_tx_rx.h
@@ -42,25 +42,10 @@
 
 #define HDD_ETHERTYPE_802_1_X              0x888E
 #define HDD_ETHERTYPE_802_1_X_FRAME_OFFSET 12
-#define HDD_ETHERTYPE_802_1_X_SIZE         2
 #ifdef FEATURE_WLAN_WAPI
 #define HDD_ETHERTYPE_WAI                  0x88b4
 #endif
 
-#define HDD_80211_HEADER_LEN      24
-#define HDD_80211_HEADER_QOS_CTL  2
-#define HDD_LLC_HDR_LEN           6
-#define HDD_FRAME_TYPE_MASK       0x0c
-#define HDD_FRAME_SUBTYPE_MASK    0xf0
-#define HDD_FRAME_TYPE_DATA       0x08
-#define HDD_FRAME_TYPE_MGMT       0x00
-#define HDD_FRAME_SUBTYPE_QOSDATA 0x80
-#define HDD_FRAME_SUBTYPE_DEAUTH  0xC0
-#define HDD_FRAME_SUBTYPE_DISASSOC 0xA0
-#define HDD_DEST_ADDR_OFFSET      6
-
-#define HDD_MAC_HDR_SIZE          6
-
 #define HDD_PSB_CFG_INVALID                   0xFF
 #define HDD_PSB_CHANGED                       0xFF
 #define SME_QOS_UAPSD_CFG_BK_CHANGED_MASK     0xF1
@@ -68,8 +53,6 @@
 #define SME_QOS_UAPSD_CFG_VI_CHANGED_MASK     0xF4
 #define SME_QOS_UAPSD_CFG_VO_CHANGED_MASK     0xF8
 
-#define HDD_ETH_HEADER_LEN     14
-
 int hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev);
 void hdd_tx_timeout(struct net_device *dev);
 CDF_STATUS hdd_init_tx_rx(hdd_adapter_t *pAdapter);
diff --git a/core/hdd/inc/wlan_hdd_wext.h b/core/hdd/inc/wlan_hdd_wext.h
index 0636c3262fe4..428e4f76160c 100644
--- a/core/hdd/inc/wlan_hdd_wext.h
+++ b/core/hdd/inc/wlan_hdd_wext.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -143,12 +143,6 @@ typedef enum {
 /** Maximum Length of WPA/RSN IE */
 #define MAX_WPA_RSN_IE_LEN 40
 
-/** Maximum Number of WEP KEYS */
-#define MAX_WEP_KEYS 4
-
-/** Ether Address Length */
-#define ETHER_ADDR_LEN 6
-
 /** Enable 11d */
 #define ENABLE_11D  1
 
diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c
index 0c87577ea7fd..7e211981946f 100644
--- a/core/hdd/src/wlan_hdd_assoc.c
+++ b/core/hdd/src/wlan_hdd_assoc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -36,6 +36,7 @@
 #include <ani_global.h>
 #include "dot11f.h"
 #include "wlan_hdd_power.h"
+#include "wlan_hdd_trace.h"
 #include <linux/ieee80211.h>
 #include <linux/wireless.h>
 #include <linux/etherdevice.h>
@@ -729,8 +730,9 @@ static void hdd_send_association_event(struct net_device *dev,
 			return;
 		}
 
-		cds_incr_active_session(pHddCtx, pAdapter->device_mode,
-						pAdapter->sessionId);
+		if (!hdd_is_roam_sync_in_progress(pCsrRoamInfo))
+			cds_incr_active_session(pAdapter->device_mode,
+					pAdapter->sessionId);
 		memcpy(wrqu.ap_addr.sa_data, pCsrRoamInfo->pBssDesc->bssId,
 		       sizeof(pCsrRoamInfo->pBssDesc->bssId));
 
@@ -814,8 +816,7 @@ static void hdd_send_association_event(struct net_device *dev,
 #endif
 	} else if (eConnectionState_IbssConnected ==    /* IBss Associated */
 			pHddStaCtx->conn_info.connState) {
-		cds_incr_active_session(pHddCtx, pAdapter->device_mode,
-						pAdapter->sessionId);
+		cds_update_connection_info(pAdapter->sessionId);
 		memcpy(wrqu.ap_addr.sa_data, pHddStaCtx->conn_info.bssId.bytes,
 		       ETH_ALEN);
 		pr_info("wlan: new IBSS connection to " MAC_ADDRESS_STR "\n",
@@ -825,11 +826,9 @@ static void hdd_send_association_event(struct net_device *dev,
 		pr_info("wlan: disconnected\n");
 		memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
 		cds_decr_session_set_pcl(
-						pHddCtx, pAdapter->device_mode,
+						pAdapter->device_mode,
 						pAdapter->sessionId);
-#if defined(FEATURE_WLAN_LFR)
 		wlan_hdd_enable_roaming(pAdapter);
-#endif
 
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
 		wlan_hdd_auto_shutdown_enable(pHddCtx, true);
@@ -871,15 +870,14 @@ static void hdd_send_association_event(struct net_device *dev,
 		hdd_stop_bus_bw_compute_timer(pAdapter);
 #endif
 	}
-	cds_dump_concurrency_info(pHddCtx);
+	cds_dump_concurrency_info();
 	/* Send SCC/MCC Switching event to IPA */
 	hdd_ipa_send_mcc_scc_msg(pHddCtx, pHddCtx->mcc_mode);
 
 	msg = NULL;
 	/*During the WLAN uninitialization,supplicant is stopped before the
 	   driver so not sending the status of the connection to supplicant */
-	if ((pHddCtx->isLoadInProgress != true) &&
-	    (pHddCtx->isUnloadInProgress != true)) {
+	if (cds_is_load_or_unload_in_progress()) {
 		wireless_send_event(dev, we_event, &wrqu, msg);
 #ifdef FEATURE_WLAN_ESE
 		if (eConnectionState_Associated ==
@@ -1046,15 +1044,19 @@ static CDF_STATUS hdd_dis_connect_handler(hdd_adapter_t *pAdapter,
 			 * To avoid wpa_supplicant sending "HANGED" CMD
 			 * to ICS UI.
 			 */
-			if (eCSR_ROAM_LOSTLINK == roamStatus)
+			if (eCSR_ROAM_LOSTLINK == roamStatus) {
+				if (pRoamInfo->reasonCode ==
+				    eSIR_MAC_PEER_STA_REQ_LEAVING_BSS_REASON)
+					pr_info("wlan: disconnected due to poor signal, rssi is %d dB\n", pRoamInfo->rxRssi);
 				cfg80211_disconnected(dev, pRoamInfo->
 						      reasonCode, NULL,
 						      0, GFP_KERNEL);
-			else
+			} else {
 				cfg80211_disconnected(dev,
 					      WLAN_REASON_UNSPECIFIED,
 					      NULL, 0,
 					      GFP_KERNEL);
+			}
 
 			hdd_info("sent disconnected event to nl80211, rssi: %d",
 				pAdapter->rssi);
@@ -1064,8 +1066,7 @@ static CDF_STATUS hdd_dis_connect_handler(hdd_adapter_t *pAdapter,
 		 * before the driver so not sending the status of the
 		 * connection to supplicant.
 		 */
-		if ((pHddCtx->isLoadInProgress != true) &&
-		    (pHddCtx->isUnloadInProgress != true)) {
+		if (cds_is_load_or_unload_in_progress()) {
 #ifdef WLAN_FEATURE_P2P_DEBUG
 			if (pAdapter->device_mode == WLAN_HDD_P2P_CLIENT) {
 				if (global_p2p_connection_status ==
@@ -1093,12 +1094,11 @@ static CDF_STATUS hdd_dis_connect_handler(hdd_adapter_t *pAdapter,
 #endif
 	if (eCSR_ROAM_IBSS_LEAVE == roamStatus) {
 		uint8_t i;
-		sta_id = IBSS_BROADCAST_STAID;
+		sta_id = pHddStaCtx->broadcast_ibss_staid;
 		vstatus = hdd_roam_deregister_sta(pAdapter, sta_id);
 		if (!CDF_IS_STATUS_SUCCESS(vstatus)) {
-			hddLog(LOGE,
-				FL("hdd_roam_deregister_sta() failed for staID %d Status=%d [0x%x]"),
-				sta_id, status, status);
+			hdd_err("hdd_roam_deregister_sta() failed for staID %d Status=%d [0x%x]",
+					sta_id, status, status);
 			status = CDF_STATUS_E_FAILURE;
 		}
 		pHddCtx->sta_to_adapter[sta_id] = NULL;
@@ -1364,6 +1364,7 @@ static void hdd_send_re_assoc_event(struct net_device *dev,
 	unsigned int len = 0;
 	u8 *pFTAssocRsp = NULL;
 	uint8_t *rspRsnIe = kmalloc(IW_GENERIC_IE_MAX, GFP_KERNEL);
+	uint8_t *assoc_req_ies = kmalloc(IW_GENERIC_IE_MAX, GFP_KERNEL);
 	uint32_t rspRsnLength = 0;
 	struct ieee80211_channel *chan;
 	hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
@@ -1376,9 +1377,13 @@ static void hdd_send_re_assoc_event(struct net_device *dev,
 
 	if (!rspRsnIe) {
 		hddLog(LOGE, FL("Unable to allocate RSN IE"));
-		return;
+		goto done;
 	}
 
+	if (!assoc_req_ies) {
+		hdd_err("Unable to allocate Assoc Req IE");
+		goto done;
+	}
 	if (pCsrRoamInfo == NULL) {
 		hddLog(LOGE, FL("Invalid CSR roam info"));
 		goto done;
@@ -1409,9 +1414,10 @@ static void hdd_send_re_assoc_event(struct net_device *dev,
 	 * active session count should still be the same and hence upon
 	 * successful reassoc decrement the active session count here.
 	 */
-	cds_decr_session_set_pcl(
-					pHddCtx, pAdapter->device_mode,
-					pAdapter->sessionId);
+	if (!hdd_is_roam_sync_in_progress(pCsrRoamInfo))
+		cds_decr_session_set_pcl(
+				pAdapter->device_mode,
+				pAdapter->sessionId);
 
 	/* Send the Assoc Resp, the supplicant needs this for initial Auth */
 	len = pCsrRoamInfo->nAssocRspLength - FT_ASSOC_RSP_IES_OFFSET;
@@ -1439,8 +1445,9 @@ static void hdd_send_re_assoc_event(struct net_device *dev,
 	cdf_mem_copy(buf_ptr, &roam_profile.SSID.ssId[0],
 			roam_profile.SSID.length);
 	ssid_ie_len = 2 + roam_profile.SSID.length;
-	hddLog(LOG2, FL("SSIDIE:"));
-	hddLog(CDF_TRACE_LEVEL_DEBUG, buf_ssid_ie, ssid_ie_len);
+	hdd_notice("SSIDIE:");
+	CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_DEBUG,
+			   buf_ssid_ie, ssid_ie_len);
 	final_req_ie = kmalloc(IW_GENERIC_IE_MAX, GFP_KERNEL);
 	if (final_req_ie == NULL)
 		goto done;
@@ -1451,37 +1458,46 @@ static void hdd_send_re_assoc_event(struct net_device *dev,
 	cdf_mem_copy(rspRsnIe, pFTAssocRsp, len);
 	cdf_mem_zero(final_req_ie + (ssid_ie_len + reqRsnLength),
 		IW_GENERIC_IE_MAX - (ssid_ie_len + reqRsnLength));
-	hddLog(LOG2, FL("Req RSN IE:"));
-	hddLog(CDF_TRACE_LEVEL_DEBUG, final_req_ie,
-		(ssid_ie_len + reqRsnLength));
+	hdd_notice("Req RSN IE:");
+	CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_DEBUG,
+			   final_req_ie, (ssid_ie_len + reqRsnLength));
 	cfg80211_roamed_bss(dev, bss,
 			final_req_ie, (ssid_ie_len + reqRsnLength),
 			rspRsnIe, rspRsnLength, GFP_KERNEL);
 
+	cdf_mem_copy(assoc_req_ies,
+		(u8 *)pCsrRoamInfo->pbFrames + pCsrRoamInfo->nBeaconLength,
+		pCsrRoamInfo->nAssocReqLength);
+
+	hdd_notice("ReAssoc Req IE dump");
+	CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_DEBUG,
+		assoc_req_ies, pCsrRoamInfo->nAssocReqLength);
+
 	wlan_hdd_send_roam_auth_event(pHddCtx, pCsrRoamInfo->bssid.bytes,
-			reqRsnIe, reqRsnLength, rspRsnIe, rspRsnLength,
+			assoc_req_ies, pCsrRoamInfo->nAssocReqLength,
+			rspRsnIe, rspRsnLength,
 			pCsrRoamInfo);
 done:
-	sme_roam_free_connect_profile(hal_handle, &roam_profile);
+	sme_roam_free_connect_profile(&roam_profile);
 	if (final_req_ie)
 		kfree(final_req_ie);
 	kfree(rspRsnIe);
+	kfree(assoc_req_ies);
 }
 
 /**
  * hdd_is_roam_sync_in_progress()- Check if roam offloaded
+ * @roaminfo - Roaming Information
  *
  * Return: roam sync status if roaming offloaded else false
  */
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-static inline bool hdd_is_roam_sync_in_progress(tCsrRoamInfo *roaminfo)
-{
-	return roaminfo->roamSynchInProgress;
-}
-#else
-static inline bool hdd_is_roam_sync_in_progress(tCsrRoamInfo *roaminfo)
+bool hdd_is_roam_sync_in_progress(tCsrRoamInfo *roaminfo)
 {
-	return false;
+	if (roaminfo)
+		return roaminfo->roamSynchInProgress;
+	else
+		return false;
 }
 #endif
 
@@ -1697,10 +1713,7 @@ static CDF_STATUS hdd_association_completion_handler(hdd_adapter_t *pAdapter,
 	CDF_STATUS cdf_status = CDF_STATUS_E_FAILURE;
 	uint8_t reqRsnIe[DOT11F_IE_RSN_MAX_LEN];
 	uint32_t reqRsnLength = DOT11F_IE_RSN_MAX_LEN;
-#if  defined(FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR) || \
-defined(WLAN_FEATURE_VOWIFI_11R)
 	int ft_carrier_on = false;
-#endif
 	bool hddDisconInProgress = false;
 	unsigned long rc;
 
@@ -1709,13 +1722,6 @@ defined(WLAN_FEATURE_VOWIFI_11R)
 		return CDF_STATUS_E_FAILURE;
 	}
 
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	if (pRoamInfo && pRoamInfo->roamSynchInProgress) {
-		/* change logging before release */
-		hddLog(LOG3, "LFR3:hdd_association_completion_handler");
-	}
-#endif
-
 	/* HDD has initiated disconnect, do not send connect result indication
 	 * to kernel as it will be handled by __cfg80211_disconnect.
 	 */
@@ -1753,7 +1759,7 @@ defined(WLAN_FEATURE_VOWIFI_11R)
 		/* Indicate 'connect' status to user space */
 		hdd_send_association_event(dev, pRoamInfo);
 
-		if (cds_is_mcc_in_24G(pHddCtx)) {
+		if (cds_is_mcc_in_24G()) {
 			if (pHddCtx->miracast_value)
 				cds_set_mas(pAdapter, pHddCtx->miracast_value);
 		}
@@ -1770,49 +1776,38 @@ defined(WLAN_FEATURE_VOWIFI_11R)
 		 * will come to know that the device is getting
 		 * activated properly.
 		 */
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-defined(FEATURE_WLAN_LFR)
 		if (pHddStaCtx->ft_carrier_on == false) {
-#endif
-		/*
-		 * Enable Linkup Event Servicing which allows the net device
-		 * notifier to set the linkup event variable.
-		 */
-		pAdapter->isLinkUpSvcNeeded = true;
-
-		/*
-		 * Enable Linkup Event Servicing which allows the net device
-		 * notifier to set the linkup event variable.
-		 */
-		pAdapter->isLinkUpSvcNeeded = true;
+			/*
+			 * Enable Linkup Event Servicing which allows the net
+			 * device notifier to set the linkup event variable.
+			 */
+			pAdapter->isLinkUpSvcNeeded = true;
 
-		/* Switch on the Carrier to activate the device */
-		wlan_hdd_netif_queue_control(pAdapter, WLAN_NETIF_CARRIER_ON,
-					   WLAN_CONTROL_PATH);
+			/* Switch on the Carrier to activate the device */
+			wlan_hdd_netif_queue_control(pAdapter,
+						WLAN_NETIF_CARRIER_ON,
+						WLAN_CONTROL_PATH);
 
-		/*
-		 * Wait for the Link to up to ensure all the queues are set
-		 * properly by the kernel.
-		 */
-		rc = wait_for_completion_timeout(&pAdapter->
-						 linkup_event_var,
-						 msecs_to_jiffies
-						 (ASSOC_LINKUP_TIMEOUT));
-		if (!rc)
-			hddLog(LOGW, FL("Warning:ASSOC_LINKUP_TIMEOUT"));
+			/*
+			 * Wait for the Link to up to ensure all the queues
+			 * are set properly by the kernel.
+			 */
+			rc = wait_for_completion_timeout(
+					&pAdapter->linkup_event_var,
+					msecs_to_jiffies(ASSOC_LINKUP_TIMEOUT)
+					);
+			if (!rc)
+				hdd_warn("Warning:ASSOC_LINKUP_TIMEOUT");
 
-		/*
-		 * Disable Linkup Event Servicing - no more service required
-		 * from the net device notifier call.
-		 */
-		pAdapter->isLinkUpSvcNeeded = false;
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-defined(FEATURE_WLAN_LFR)
-	} else {
-		pHddStaCtx->ft_carrier_on = false;
-		ft_carrier_on = true;
-	}
-#endif
+			/*
+			 * Disable Linkup Event Servicing - no more service
+			 * required from the net device notifier call.
+			 */
+			pAdapter->isLinkUpSvcNeeded = false;
+		} else {
+			pHddStaCtx->ft_carrier_on = false;
+			ft_carrier_on = true;
+		}
 		if ((WLAN_MAX_STA_COUNT + 3) > pRoamInfo->staId)
 			pHddCtx->sta_to_adapter[pRoamInfo->staId] = pAdapter;
 		else
@@ -1830,8 +1825,7 @@ defined(FEATURE_WLAN_LFR)
 		wlan_hdd_auto_shutdown_enable(pHddCtx, false);
 #endif
 
-		cds_check_concurrent_intf_and_restart_sap(pHddCtx,
-							  pHddStaCtx,
+		cds_check_concurrent_intf_and_restart_sap(pHddStaCtx,
 							  pAdapter);
 
 #ifdef FEATURE_WLAN_TDLS
@@ -1947,10 +1941,11 @@ defined(FEATURE_WLAN_LFR)
 						 * decrement the active session
 						 * count here.
 						 */
-						cds_decr_session_set_pcl
-							(pHddCtx,
-							pAdapter->device_mode,
-							pAdapter->sessionId);
+						if (!hdd_is_roam_sync_in_progress
+								(pRoamInfo))
+							cds_decr_session_set_pcl
+								(pAdapter->device_mode,
+								 pAdapter->sessionId);
 						hddLog(LOG1,
 						       FL("ft_carrier_on is %d, sending roamed indication"),
 						       ft_carrier_on);
@@ -1963,6 +1958,15 @@ defined(FEATURE_WLAN_LFR)
 						       "assocReqlen %d assocRsplen %d",
 						       assocReqlen,
 						       assocRsplen);
+
+						hdd_notice(
+							"Reassoc Req IE dump");
+						CDF_TRACE_HEX_DUMP(
+							CDF_MODULE_ID_HDD,
+							CDF_TRACE_LEVEL_DEBUG,
+							pFTAssocReq,
+							assocReqlen);
+
 						cfg80211_roamed(dev, chan,
 								pRoamInfo->
 								bssid.bytes,
@@ -2039,17 +2043,13 @@ defined(FEATURE_WLAN_LFR)
 							    &rspRsnLength,
 							    rspRsnIe);
 				if (!hddDisconInProgress) {
-#if  defined(FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 					if (ft_carrier_on)
 						hdd_send_re_assoc_event(dev,
 									pAdapter,
 									pRoamInfo,
 									reqRsnIe,
 									reqRsnLength);
-					else
-#endif /* FEATURE_WLAN_ESE */
-
-					{
+					else {
 						hddLog(LOG1,
 						       FL("sending connect indication to nl80211:for bssid "
 						       MAC_ADDRESS_STR
@@ -2073,9 +2073,7 @@ defined(FEATURE_WLAN_LFR)
 			}
 			if (!hddDisconInProgress) {
 				cfg80211_put_bss(
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
 					pHddCtx->wiphy,
-#endif
 					bss);
 
 				/*
@@ -2309,11 +2307,17 @@ defined(FEATURE_WLAN_LFR)
 					   WLAN_CONTROL_PATH);
 	}
 
-	if (CDF_STATUS_SUCCESS != cds_check_and_restart_sap(pHddCtx,
+	if (CDF_STATUS_SUCCESS != cds_check_and_restart_sap(
 					roamResult, pHddStaCtx))
 		return CDF_STATUS_E_FAILURE;
 
-	cds_force_sap_on_scc(pHddCtx, roamResult);
+	if (NULL != pRoamInfo && NULL != pRoamInfo->pBssDesc) {
+		cds_force_sap_on_scc(roamResult,
+				pRoamInfo->pBssDesc->channelId);
+	} else {
+		hdd_err("pRoamInfo profile is not set properly");
+		return CDF_STATUS_E_FAILURE;
+	}
 
 	return CDF_STATUS_SUCCESS;
 }
@@ -2348,6 +2352,8 @@ static void hdd_roam_ibss_indication_handler(hdd_adapter_t *pAdapter,
 	{
 		hdd_context_t *pHddCtx =
 			(hdd_context_t *) pAdapter->pHddCtx;
+		hdd_station_ctx_t *hdd_sta_ctx =
+			WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
 		struct cdf_mac_addr broadcastMacAddr =
 			CDF_MAC_ADDR_BROADCAST_INITIALIZER;
 
@@ -2367,10 +2373,13 @@ static void hdd_roam_ibss_indication_handler(hdd_adapter_t *pAdapter,
 		/* notify wmm */
 		hdd_wmm_connect(pAdapter, pRoamInfo,
 				eCSR_BSS_TYPE_IBSS);
-		pHddCtx->sta_to_adapter[IBSS_BROADCAST_STAID] =
+
+		hdd_sta_ctx->broadcast_ibss_staid = pRoamInfo->staId;
+
+		pHddCtx->sta_to_adapter[pRoamInfo->staId] =
 			pAdapter;
 		hdd_roam_register_sta(pAdapter, pRoamInfo,
-				      IBSS_BROADCAST_STAID,
+				      pRoamInfo->staId,
 				      &broadcastMacAddr,
 				      pRoamInfo->pBssDesc);
 
@@ -2426,12 +2435,16 @@ static void hdd_roam_ibss_indication_handler(hdd_adapter_t *pAdapter,
 					     GFP_KERNEL);
 #endif
 			cfg80211_put_bss(
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
 				pHddCtx->wiphy,
-#endif
 				bss);
 		}
-
+		if (eCSR_ROAM_RESULT_IBSS_STARTED == roamResult) {
+			cds_incr_active_session(pAdapter->device_mode,
+					pAdapter->sessionId);
+		} else if (eCSR_ROAM_RESULT_IBSS_JOIN_SUCCESS == roamResult ||
+				eCSR_ROAM_RESULT_IBSS_COALESCED == roamResult) {
+			cds_update_connection_info(pAdapter->sessionId);
+		}
 		break;
 	}
 
@@ -2589,9 +2602,7 @@ static CDF_STATUS roam_ibss_connect_handler(hdd_adapter_t *pAdapter,
 		return CDF_STATUS_E_FAILURE;
 	}
 	cfg80211_put_bss(
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
 		WLAN_HDD_GET_CTX(pAdapter)->wiphy,
-#endif
 		bss);
 
 	return CDF_STATUS_SUCCESS;
@@ -2704,9 +2715,6 @@ roam_roam_connect_status_update_handler(hdd_adapter_t *pAdapter,
 
 		pHddCtx->sta_to_adapter[pRoamInfo->staId] = pAdapter;
 
-		pHddCtx->sta_to_adapter[IBSS_BROADCAST_STAID] =
-			pAdapter;
-
 		/* Register the Station with TL for the new peer. */
 		cdf_status = hdd_roam_register_sta(pAdapter,
 						   pRoamInfo,
@@ -3813,6 +3821,27 @@ hdd_indicate_ese_bcn_report_ind(const hdd_adapter_t *pAdapter,
 #endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 
 /**
+ * hdd_is_8021x_sha256_auth_type() - check authentication type to 8021x_sha256
+ * @pHddStaCtx:	Station Context
+ *
+ * API to check if the connection authentication type is 8021x_sha256.
+ *
+ * Return: bool
+ */
+#ifdef WLAN_FEATURE_11W
+static inline bool hdd_is_8021x_sha256_auth_type(hdd_station_ctx_t *pHddStaCtx)
+{
+	return eCSR_AUTH_TYPE_RSN_8021X_SHA256 ==
+				pHddStaCtx->conn_info.authType;
+}
+#else
+static inline bool hdd_is_8021x_sha256_auth_type(hdd_station_ctx_t *pHddStaCtx)
+{
+	return false;
+}
+#endif
+
+/**
  * hdd_sme_roam_callback() - hdd sme roam callback
  * @pContext: pointer to adapter context
  * @pRoamInfo: pointer to roam info
@@ -3846,14 +3875,15 @@ hdd_sme_roam_callback(void *pContext, tCsrRoamInfo *pRoamInfo, uint32_t roamId,
 	pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
 	pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
 
+	MTRACE(cdf_trace(CDF_MODULE_ID_HDD, TRACE_CODE_HDD_RX_SME_MSG,
+				pAdapter->sessionId, roamStatus));
+
 	switch (roamStatus) {
 	case eCSR_ROAM_SESSION_OPENED:
 		set_bit(SME_SESSION_OPENED, &pAdapter->event_flags);
 		complete(&pAdapter->session_open_comp_var);
 		break;
 
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-defined(FEATURE_WLAN_LFR)
 	/*
 	 * We did pre-auth,then we attempted a 11r or ese reassoc.
 	 * reassoc failed due to failure, timeout, reject from ap
@@ -3894,72 +3924,32 @@ defined(FEATURE_WLAN_LFR)
 		 * doing disassoc at this time. This saves 30-60 msec
 		 * after reassoc.
 		 */
-	{
 		hddLog(LOG1, FL("Disabling queues"));
-		wlan_hdd_netif_queue_control(pAdapter, WLAN_NETIF_TX_DISABLE,
-					   WLAN_CONTROL_PATH);
-		status =
-			hdd_roam_deregister_sta(pAdapter,
-						pHddStaCtx->conn_info.
-						staId[0]);
-		if (!CDF_IS_STATUS_SUCCESS(status)) {
-			hddLog(LOGW,
-				FL
-				("hdd_roam_deregister_sta() failed to for staID %d. Status=%d [0x%x]"),
-				pHddStaCtx->conn_info.staId[0],
-				status, status);
+		wlan_hdd_netif_queue_control(pAdapter,
+				WLAN_NETIF_TX_DISABLE,
+				WLAN_CONTROL_PATH);
+		status = hdd_roam_deregister_sta(pAdapter,
+					pHddStaCtx->conn_info.staId[0]);
+		if (!CDF_IS_STATUS_SUCCESS(status))
 			cdf_ret_status = CDF_STATUS_E_FAILURE;
-		}
-	}
 		pHddStaCtx->ft_carrier_on = true;
 		pHddStaCtx->hdd_ReassocScenario = true;
 		hddLog(LOG1,
 		       FL("hdd_ReassocScenario set to: %d, due to eCSR_ROAM_FT_START, session: %d"),
 		       pHddStaCtx->hdd_ReassocScenario, pAdapter->sessionId);
 		break;
-#endif
 
 	case eCSR_ROAM_SHOULD_ROAM:
-		/* Dont need to do anything */
-	{
-		hdd_station_ctx_t *pHddStaCtx =
-			WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
 		/* notify apps that we can't pass traffic anymore */
 		hddLog(LOG1, FL("Disabling queues"));
 		wlan_hdd_netif_queue_control(pAdapter,
 					   WLAN_NETIF_TX_DISABLE,
 					   WLAN_CONTROL_PATH);
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-defined(FEATURE_WLAN_LFR)
 		if (pHddStaCtx->ft_carrier_on == false) {
-#endif
 			wlan_hdd_netif_queue_control(pAdapter,
 					   WLAN_NETIF_CARRIER_OFF,
 					   WLAN_CONTROL_PATH);
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-defined(FEATURE_WLAN_LFR)
-	}
-#endif
-
-#if  !(defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-defined(FEATURE_WLAN_LFR))
-		/*
-		 * We should clear all sta register with TL, for now, only one.
-		 */
-		status =
-			hdd_roam_deregister_sta(pAdapter,
-						pHddStaCtx->conn_info.
-						staId[0]);
-		if (!CDF_IS_STATUS_SUCCESS(status)) {
-			hddLog(LOGW,
-				FL
-				("hdd_roam_deregister_sta() failed to for staID %d. Status=%d [0x%x]"),
-				pHddStaCtx->conn_info.staId[0],
-				status, status);
-			cdf_ret_status = CDF_STATUS_E_FAILURE;
 		}
-#endif
-	}
 		break;
 	case eCSR_ROAM_LOSTLINK:
 		if (roamResult == eCSR_ROAM_RESULT_LOSTLINK) {
@@ -4086,18 +4076,15 @@ defined(FEATURE_WLAN_LFR))
 		hdd_send_ft_event(pAdapter);
 		break;
 #endif
-#if defined(FEATURE_WLAN_LFR) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
 	case eCSR_ROAM_PMK_NOTIFY:
-		if (eCSR_AUTH_TYPE_RSN == pHddStaCtx->conn_info.authType ||
-			eCSR_AUTH_TYPE_RSN_8021X_SHA256 ==
-					pHddStaCtx->conn_info.authType) {
+		if (eCSR_AUTH_TYPE_RSN == pHddStaCtx->conn_info.authType
+				|| hdd_is_8021x_sha256_auth_type(pHddStaCtx)) {
 			/* notify the supplicant of a new candidate */
 			cdf_ret_status =
 				wlan_hdd_cfg80211_pmksa_candidate_notify(
 						pAdapter, pRoamInfo, 1, false);
 		}
 		break;
-#endif
 
 #ifdef FEATURE_WLAN_LFR_METRICS
 	case eCSR_ROAM_PREAUTH_INIT_NOTIFY:
@@ -4138,14 +4125,6 @@ defined(FEATURE_WLAN_LFR))
 		}
 		break;
 #endif
-
-	case eCSR_ROAM_INDICATE_MGMT_FRAME:
-		hdd_indicate_mgmt_frame(pAdapter,
-					pRoamInfo->nFrameLength,
-					pRoamInfo->pbFrames,
-					pRoamInfo->frameType,
-					pRoamInfo->rxChan, pRoamInfo->rxRssi);
-		break;
 	case eCSR_ROAM_REMAIN_CHAN_READY:
 		hdd_remain_chan_ready_handler(pAdapter, pRoamInfo->roc_scan_id);
 		break;
@@ -4426,7 +4405,7 @@ static int32_t hdd_process_genie(hdd_adapter_t *pAdapter,
 			 * in the bssid.
 			 */
 			cdf_mem_copy(PMKIDCache[i].BSSID.bytes,
-				     bssid, ETHER_ADDR_LEN);
+				     bssid, CDF_MAC_ADDR_SIZE);
 			cdf_mem_copy(PMKIDCache[i].PMKID,
 				     dot11RSNIE.pmkid[i], CSR_RSN_PMKID_SIZE);
 		}
diff --git a/core/hdd/src/wlan_hdd_cfg.c b/core/hdd/src/wlan_hdd_cfg.c
index b0d7e88e7ae3..31810db07d27 100644
--- a/core/hdd/src/wlan_hdd_cfg.c
+++ b/core/hdd/src/wlan_hdd_cfg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -45,7 +45,6 @@
 #include <wlan_hdd_misc.h>
 #include <wlan_hdd_napi.h>
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 static void
 cb_notify_set_roam_prefer5_g_hz(hdd_context_t *pHddCtx, unsigned long notifyId)
 {
@@ -95,7 +94,6 @@ cb_notify_set_roam_scan_home_away_time(hdd_context_t *pHddCtx, unsigned long not
 					    pHddCtx->config->nRoamScanHomeAwayTime,
 					    true);
 }
-#endif
 
 #ifdef FEATURE_WLAN_OKC
 static void
@@ -106,7 +104,6 @@ cb_notify_set_okc_feature_enabled(hdd_context_t *pHddCtx, unsigned long notifyId
 }
 #endif
 
-#ifdef FEATURE_WLAN_LFR
 static void
 notify_is_fast_roam_ini_feature_enabled(hdd_context_t *pHddCtx,
 					unsigned long notifyId)
@@ -126,7 +123,6 @@ notify_is_mawc_ini_feature_enabled(hdd_context_t *pHddCtx, unsigned long notifyI
 	sme_update_is_mawc_ini_feature_enabled(pHddCtx->hHal,
 					       pHddCtx->config->MAWCEnabled);
 }
-#endif
 
 #ifdef FEATURE_WLAN_ESE
 static void
@@ -149,7 +145,6 @@ cb_notify_set_fw_rssi_monitoring(hdd_context_t *pHddCtx, unsigned long notifyId)
 					     fEnableFwRssiMonitoring);
 }
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 static void cb_notify_set_opportunistic_scan_threshold_diff(hdd_context_t *pHddCtx,
 							    unsigned long notifyId)
 {
@@ -275,8 +270,6 @@ cb_notify_set_dfs_scan_mode(hdd_context_t *pHddCtx, unsigned long notifyId)
 				 pHddCtx->config->allowDFSChannelRoam);
 }
 
-#endif
-
 static void cb_notify_set_enable_ssr(hdd_context_t *pHddCtx,
 				     unsigned long notifyId)
 {
@@ -430,13 +423,6 @@ REG_TABLE_ENTRY g_registry_table[] = {
 			    VAR_FLAGS_OPTIONAL,
 			    (void *)CFG_POWER_USAGE_DEFAULT),
 
-	REG_VARIABLE(CFG_ENABLE_LOGP_NAME, WLAN_PARAM_Integer,
-		     struct hdd_config, fIsLogpEnabled,
-		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
-		     CFG_ENABLE_LOGP_DEFAULT,
-		     CFG_ENABLE_LOGP_MIN,
-		     CFG_ENABLE_LOGP_MAX),
-
 	REG_VARIABLE(CFG_ENABLE_IMPS_NAME, WLAN_PARAM_Integer,
 		     struct hdd_config, fIsImpsEnabled,
 		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -500,6 +486,13 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		     CFG_MAX_RX_AMPDU_FACTOR_MIN,
 		     CFG_MAX_RX_AMPDU_FACTOR_MAX),
 
+	REG_VARIABLE(CFG_HT_MPDU_DENSITY_NAME, WLAN_PARAM_Integer,
+		     struct hdd_config, ht_mpdu_density,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK ,
+		     CFG_HT_MPDU_DENSITY_DEFAULT,
+		     CFG_HT_MPDU_DENSITY_MIN,
+		     CFG_HT_MPDU_DENSITY_MAX),
+
 	REG_VARIABLE(CFG_FIXED_RATE_NAME, WLAN_PARAM_Integer,
 		     struct hdd_config, TxRate,
 		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK,
@@ -1021,7 +1014,6 @@ REG_TABLE_ENTRY g_registry_table[] = {
 			     cb_notify_set_ese_feature_enabled, 0),
 #endif /* FEATURE_WLAN_ESE */
 
-#ifdef FEATURE_WLAN_LFR
 	/* flag to turn ON/OFF Legacy Fast Roaming */
 	REG_DYNAMIC_VARIABLE(CFG_LFR_FEATURE_ENABLED_NAME, WLAN_PARAM_Integer,
 			     struct hdd_config, isFastRoamIniFeatureEnabled,
@@ -1043,9 +1035,6 @@ REG_TABLE_ENTRY g_registry_table[] = {
 			     CFG_LFR_MAWC_FEATURE_ENABLED_MAX,
 			     notify_is_mawc_ini_feature_enabled, 0),
 
-#endif /* FEATURE_WLAN_LFR */
-
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	/* flag to turn ON/OFF 11r and ESE FastTransition */
 	REG_DYNAMIC_VARIABLE(CFG_FAST_TRANSITION_ENABLED_NAME,
 			     WLAN_PARAM_Integer,
@@ -1076,7 +1065,6 @@ REG_TABLE_ENTRY g_registry_table[] = {
 			     CFG_ENABLE_WES_MODE_NAME_MIN,
 			     CFG_ENABLE_WES_MODE_NAME_MAX,
 			     cb_notify_set_wes_mode, 0),
-#endif
 #ifdef FEATURE_WLAN_OKC
 	REG_DYNAMIC_VARIABLE(CFG_OKC_FEATURE_ENABLED_NAME, WLAN_PARAM_Integer,
 			     struct hdd_config, isOkcIniFeatureEnabled,
@@ -1343,7 +1331,6 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		     CFG_FT_RESOURCE_REQ_MAX),
 #endif
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	REG_DYNAMIC_VARIABLE(CFG_NEIGHBOR_SCAN_TIMER_PERIOD_NAME,
 			     WLAN_PARAM_Integer,
 			     struct hdd_config, nNeighborScanPeriod,
@@ -1532,8 +1519,6 @@ REG_TABLE_ENTRY g_registry_table[] = {
 			     cb_notify_set_roam_scan_hi_rssi_scan_params,
 			     eCSR_HI_RSSI_SCAN_RSSI_UB_ID),
 
-#endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
-
 	REG_VARIABLE(CFG_QOS_WMM_BURST_SIZE_DEFN_NAME, WLAN_PARAM_Integer,
 		     struct hdd_config, burstSizeDefinition,
 		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -1926,7 +1911,6 @@ REG_TABLE_ENTRY g_registry_table[] = {
 			     CFG_LINK_SPEED_RSSI_LOW_MAX,
 			     NULL, 0),
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	REG_DYNAMIC_VARIABLE(CFG_ROAM_PREFER_5GHZ, WLAN_PARAM_Integer,
 			     struct hdd_config, nRoamPrefer5GHz,
 			     VAR_FLAGS_OPTIONAL |
@@ -1963,8 +1947,6 @@ REG_TABLE_ENTRY g_registry_table[] = {
 			     CFG_ROAM_SCAN_HOME_AWAY_TIME_MAX,
 			     cb_notify_set_roam_scan_home_away_time, 0),
 
-#endif
-
 	REG_VARIABLE(CFG_P2P_DEVICE_ADDRESS_ADMINISTRATED_NAME,
 		     WLAN_PARAM_Integer,
 		     struct hdd_config, isP2pDeviceAddrAdministrated,
@@ -2232,6 +2214,13 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		     CFG_TDLS_MAX_DISCOVERY_ATTEMPT_MIN,
 		     CFG_TDLS_MAX_DISCOVERY_ATTEMPT_MAX),
 
+	REG_VARIABLE(CFG_TDLS_IDLE_TIMEOUT, WLAN_PARAM_Integer,
+		     struct hdd_config, tdls_idle_timeout,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_TDLS_IDLE_TIMEOUT_DEFAULT,
+		     CFG_TDLS_IDLE_TIMEOUT_MIN,
+		     CFG_TDLS_IDLE_TIMEOUT_MAX),
+
 	REG_VARIABLE(CFG_TDLS_IDLE_PACKET_THRESHOLD, WLAN_PARAM_Integer,
 		     struct hdd_config, fTDLSIdlePacketThreshold,
 		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -2344,6 +2333,14 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		     CFG_TDLS_SCAN_ENABLE_DEFAULT,
 		     CFG_TDLS_SCAN_ENABLE_MIN,
 		     CFG_TDLS_SCAN_ENABLE_MAX),
+
+	REG_VARIABLE(CFG_TDLS_PEER_KICKOUT_THRESHOLD, WLAN_PARAM_Integer,
+		     struct hdd_config, tdls_peer_kickout_threshold,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_TDLS_PEER_KICKOUT_THRESHOLD_DEFAULT,
+		     CFG_TDLS_PEER_KICKOUT_THRESHOLD_MIN,
+		     CFG_TDLS_PEER_KICKOUT_THRESHOLD_MAX),
+
 #endif
 
 #ifdef WLAN_SOFTAP_VSTA_FEATURE
@@ -2418,6 +2415,13 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		     CFG_VHT_SU_BEAMFORMEE_CAP_FEATURE_MIN,
 		     CFG_VHT_SU_BEAMFORMEE_CAP_FEATURE_MAX),
 
+	REG_VARIABLE(CFG_VHT_ENABLE_TXBF_SAP_MODE, WLAN_PARAM_Integer,
+		     struct hdd_config, enable_txbf_sap_mode,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_VHT_ENABLE_TXBF_SAP_MODE_DEFAULT,
+		     CFG_VHT_ENABLE_TXBF_SAP_MODE_MIN,
+		     CFG_VHT_ENABLE_TXBF_SAP_MODE_MAX),
+
 	REG_VARIABLE(CFG_VHT_ENABLE_TXBF_IN_20MHZ, WLAN_PARAM_Integer,
 		     struct hdd_config, enableTxBFin20MHz,
 		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
@@ -3093,6 +3097,30 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		     CFG_ENABLE_GREEN_AP_FEATURE_DEFAULT,
 		     CFG_ENABLE_GREEN_AP_FEATURE_MIN,
 		     CFG_ENABLE_GREEN_AP_FEATURE_MAX),
+	REG_VARIABLE(CFG_ENABLE_EGAP_ENABLE_FEATURE, WLAN_PARAM_Integer,
+		     struct hdd_config, enable_egap,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_ENABLE_EGAP_ENABLE_FEATURE_DEFAULT,
+		     CFG_ENABLE_EGAP_ENABLE_FEATURE_MIN,
+		     CFG_ENABLE_EGAP_ENABLE_FEATURE_MAX),
+	REG_VARIABLE(CFG_ENABLE_EGAP_INACT_TIME_FEATURE, WLAN_PARAM_Integer,
+		     struct hdd_config, egap_inact_time,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_ENABLE_EGAP_INACT_TIME_FEATURE_DEFAULT,
+		     CFG_ENABLE_EGAP_INACT_TIME_FEATURE_MIN,
+		     CFG_ENABLE_EGAP_INACT_TIME_FEATURE_MAX),
+	REG_VARIABLE(CFG_ENABLE_EGAP_WAIT_TIME_FEATURE, WLAN_PARAM_Integer,
+		     struct hdd_config, egap_wait_time,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_ENABLE_EGAP_WAIT_TIME_FEATURE_DEFAULT,
+		     CFG_ENABLE_EGAP_WAIT_TIME_FEATURE_MIN,
+		     CFG_ENABLE_EGAP_WAIT_TIME_FEATURE_MAX),
+	REG_VARIABLE(CFG_ENABLE_EGAP_FLAGS_FEATURE, WLAN_PARAM_Integer,
+		     struct hdd_config, egap_feature_flag,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_ENABLE_EGAP_FLAGS_FEATURE_DEFAULT,
+		     CFG_ENABLE_EGAP_FLAGS_FEATURE_MIN,
+		     CFG_ENABLE_EGAP_FLAGS_FEATURE_MAX),
 #endif
 
 	REG_VARIABLE(CFG_IGNORE_CAC_NAME, WLAN_PARAM_Integer,
@@ -3618,6 +3646,31 @@ REG_TABLE_ENTRY g_registry_table[] = {
 		     CFG_FIRST_SCAN_BUCKET_THRESHOLD_MIN,
 		     CFG_FIRST_SCAN_BUCKET_THRESHOLD_MAX),
 
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+	REG_VARIABLE(CFG_ENABLE_LFR_SUBNET_DETECTION, WLAN_PARAM_Integer,
+		     struct hdd_config, enable_lfr_subnet_detection,
+		     VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		     CFG_ENABLE_LFR_SUBNET_DEFAULT,
+		     CFG_ENABLE_LFR_SUBNET_MIN,
+		     CFG_ENABLE_LFR_SUBNET_MAX),
+#endif
+
+	REG_VARIABLE(CFG_INFORM_BSS_RSSI_RAW_NAME, WLAN_PARAM_Integer,
+		struct hdd_config, inform_bss_rssi_raw,
+		VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		CFG_INFORM_BSS_RSSI_RAW_DEFAULT,
+		CFG_INFORM_BSS_RSSI_RAW_MIN,
+		CFG_INFORM_BSS_RSSI_RAW_MAX),
+
+#ifdef QCA_WIFI_3_0_EMU
+	REG_VARIABLE(CFG_ENABLE_M2M_LIMITATION, WLAN_PARAM_Integer,
+		struct hdd_config, enable_m2m_limitation,
+		VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+		CFG_ENABLE_LFR_SUBNET_DEFAULT,
+		CFG_ENABLE_LFR_SUBNET_MIN,
+		CFG_ENABLE_LFR_SUBNET_MAX),
+#endif
+
 };
 
 
@@ -4581,22 +4634,18 @@ void hdd_cfg_print(hdd_context_t *pHddCtx)
 		  "Name = [gTxPowerCap] Value = [%u] dBm ",
 		  pHddCtx->config->nTxPowerCap);
 #endif
-#ifdef FEATURE_WLAN_LFR
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [FastRoamEnabled] Value = [%u] ",
 		  pHddCtx->config->isFastRoamIniFeatureEnabled);
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [MAWCEnabled] Value = [%u] ",
 		  pHddCtx->config->MAWCEnabled);
-#endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [RoamRssiDiff] Value = [%u] ",
 		  pHddCtx->config->RoamRssiDiff);
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [isWESModeEnabled] Value = [%u] ",
 		  pHddCtx->config->isWESModeEnabled);
-#endif
 #ifdef FEATURE_WLAN_OKC
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [OkcEnabled] Value = [%u] ",
@@ -4725,7 +4774,6 @@ void hdd_cfg_print(hdd_context_t *pHddCtx)
 		  pHddCtx->config->fFTResourceReqSupported);
 #endif
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [nNeighborLookupRssiThreshold] Value = [%u] ",
 		  pHddCtx->config->nNeighborLookupRssiThreshold);
@@ -4780,7 +4828,6 @@ void hdd_cfg_print(hdd_context_t *pHddCtx)
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [nhi_rssi_scan_rssi_ub] Value = [%u] ",
 		  pHddCtx->config->nhi_rssi_scan_rssi_ub);
-#endif
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [burstSizeDefinition] Value = [0x%x] ",
 		  pHddCtx->config->burstSizeDefinition);
@@ -5010,6 +5057,18 @@ void hdd_cfg_print(hdd_context_t *pHddCtx)
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "Name = [gEnableGreenAp] Value = [%u] ",
 		  pHddCtx->config->enableGreenAP);
+	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
+		  "Name = [gEenableEGAP] Value = [%u] ",
+		  pHddCtx->config->enable_egap);
+	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
+		  "Name = [gEGAPInactTime] Value = [%u] ",
+		  pHddCtx->config->egap_inact_time);
+	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
+		  "Name = [gEGAPWaitTime] Value = [%u] ",
+		  pHddCtx->config->egap_wait_time);
+	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
+		  "Name = [gEGAPFeatures] Value = [%u] ",
+		  pHddCtx->config->egap_feature_flag);
 #endif
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO_HIGH,
@@ -5167,6 +5226,16 @@ void hdd_cfg_print(hdd_context_t *pHddCtx)
 	hddLog(LOGE, "Name = [%s] Value = [%d]",
 		CFG_FIRST_SCAN_BUCKET_THRESHOLD_NAME,
 		pHddCtx->config->first_scan_bucket_threshold);
+	hddLog(LOGE, "Name = [%s] Value = [%u]",
+		CFG_HT_MPDU_DENSITY_NAME,
+		pHddCtx->config->ht_mpdu_density);
+
+
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+	hddLog(LOGE, "Name = [%s] Value = [%d]",
+		CFG_ENABLE_LFR_SUBNET_DETECTION,
+		pHddCtx->config->enable_lfr_subnet_detection);
+#endif
 }
 
 
@@ -5429,20 +5498,14 @@ eCsrPhyMode hdd_cfg_xlate_to_csr_phy_mode(eHddDot11Mode dot11Mode)
  */
 CDF_STATUS hdd_set_idle_ps_config(hdd_context_t *pHddCtx, uint32_t val)
 {
-	struct hdd_config *pConfig = pHddCtx->config;
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 
 	hddLog(LOG1, "hdd_set_idle_ps_config: Enter Val %d", val);
 
-	if (pConfig->fIsImpsEnabled) {
-		status = sme_set_idle_powersave_config(pHddCtx->pcds_context,
-						pHddCtx->hHal, val);
-		if (CDF_STATUS_SUCCESS != status) {
-			hddLog(LOGE, "Fail to Set Idle PS Config val %d", val);
-		}
-	} else {
-		hddLog(LOG1, "hdd_set_idle_ps_config: IMPS not enabled in ini");
-	}
+	status = sme_set_idle_powersave_config(pHddCtx->pcds_context,
+			pHddCtx->hHal, val);
+	if (CDF_STATUS_SUCCESS != status)
+		hddLog(LOGE, "Fail to Set Idle PS Config val %d", val);
 	return status;
 }
 
@@ -5465,10 +5528,11 @@ static void hdd_set_fine_time_meas_cap(hdd_context_t *hdd_ctx,
 
 	/* Make sure only supported capabilities are enabled in INI */
 	capability &= CFG_FINE_TIME_MEAS_CAPABILITY_MAX;
-	sme_config->fine_time_meas_cap = capability;
+	sme_config->csrConfig.fine_time_meas_cap = capability;
 
 	hddLog(LOG1, FL("fine time meas capability - INI: %04x Enabled: %04x"),
-		config->fine_time_meas_cap, sme_config->fine_time_meas_cap);
+		config->fine_time_meas_cap,
+		sme_config->csrConfig.fine_time_meas_cap);
 
 	return;
 }
@@ -5594,6 +5658,14 @@ bool hdd_update_config_dat(hdd_context_t *pHddCtx)
 		       "Could not pass on WNI_CFG_HT_AMPDU_PARAMS_MAX_RX_AMPDU_FACTOR to CFG");
 	}
 
+	if (sme_cfg_set_int(pHddCtx->hHal, WNI_CFG_MPDU_DENSITY,
+			    pConfig->ht_mpdu_density) ==
+			CDF_STATUS_E_FAILURE) {
+		fStatus = false;
+		hddLog(LOGE,
+		       "Could not pass on WNI_CFG_MPDU_DENSITY to CFG");
+	}
+
 	if (sme_cfg_set_int
 		    (pHddCtx->hHal, WNI_CFG_SHORT_PREAMBLE,
 		     pConfig->fIsShortPreamble) == CDF_STATUS_E_FAILURE) {
@@ -6283,14 +6355,15 @@ bool hdd_update_config_dat(hdd_context_t *pHddCtx)
 void hdd_set_pno_channel_prediction_config(
 		tpSmeConfigParams sme_config, hdd_context_t *hdd_ctx)
 {
-	sme_config->dual_mac_feature_disable =
+	sme_config->csrConfig.dual_mac_feature_disable =
 		hdd_ctx->config->dual_mac_feature_disable;
-	sme_config->pno_channel_prediction =
+	sme_config->csrConfig.pno_channel_prediction =
 		hdd_ctx->config->pno_channel_prediction;
-	sme_config->top_k_num_of_channels =
+	sme_config->csrConfig.top_k_num_of_channels =
 		hdd_ctx->config->top_k_num_of_channels;
-	sme_config->stationary_thresh = hdd_ctx->config->stationary_thresh;
-	sme_config->channel_prediction_full_scan =
+	sme_config->csrConfig.stationary_thresh =
+		hdd_ctx->config->stationary_thresh;
+	sme_config->csrConfig.channel_prediction_full_scan =
 		hdd_ctx->config->channel_prediction_full_scan;
 }
 #endif
@@ -6403,6 +6476,8 @@ CDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 #ifdef WLAN_FEATURE_11AC
 	smeConfig->csrConfig.nVhtChannelWidth = pConfig->vhtChannelWidth;
 	smeConfig->csrConfig.enableTxBF = pConfig->enableTxBF;
+	smeConfig->csrConfig.enable_txbf_sap_mode =
+		pConfig->enable_txbf_sap_mode;
 	smeConfig->csrConfig.txBFCsnValue = pConfig->txBFCsnValue;
 	smeConfig->csrConfig.enable2x2 = pConfig->enable2x2;
 	smeConfig->csrConfig.enableVhtFor24GHz = pConfig->enableVhtFor24GHzBand;
@@ -6429,20 +6504,16 @@ CDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 	smeConfig->csrConfig.nTxPowerCap = pConfig->nTxPowerCap;
 	smeConfig->csrConfig.fEnableBypass11d = pConfig->enableBypass11d;
 	smeConfig->csrConfig.fEnableDFSChnlScan = pConfig->enableDFSChnlScan;
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	smeConfig->csrConfig.nRoamPrefer5GHz = pConfig->nRoamPrefer5GHz;
 	smeConfig->csrConfig.nRoamIntraBand = pConfig->nRoamIntraBand;
 	smeConfig->csrConfig.nProbes = pConfig->nProbes;
 
 	smeConfig->csrConfig.nRoamScanHomeAwayTime =
 		pConfig->nRoamScanHomeAwayTime;
-#endif
 	smeConfig->csrConfig.fFirstScanOnly2GChnl =
 		pConfig->enableFirstScan2GOnly;
 
-	/* FIXME 11d config is hardcoded */
-	if (CDF_SAP_MODE != hdd_get_conparam())
-		smeConfig->csrConfig.Csr11dinfo.Channels.numChannels = 0;
+	smeConfig->csrConfig.Csr11dinfo.Channels.numChannels = 0;
 
 	hdd_set_power_save_offload_config(pHddCtx);
 
@@ -6450,11 +6521,9 @@ CDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 	smeConfig->csrConfig.csr11rConfig.IsFTResourceReqSupported =
 		pConfig->fFTResourceReqSupported;
 #endif
-#ifdef FEATURE_WLAN_LFR
 	smeConfig->csrConfig.isFastRoamIniFeatureEnabled =
 		pConfig->isFastRoamIniFeatureEnabled;
 	smeConfig->csrConfig.MAWCEnabled = pConfig->MAWCEnabled;
-#endif
 #ifdef FEATURE_WLAN_ESE
 	smeConfig->csrConfig.isEseIniFeatureEnabled =
 		pConfig->isEseIniFeatureEnabled;
@@ -6462,12 +6531,10 @@ CDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 		pConfig->isFastTransitionEnabled = true;
 	}
 #endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	smeConfig->csrConfig.isFastTransitionEnabled =
 		pConfig->isFastTransitionEnabled;
 	smeConfig->csrConfig.RoamRssiDiff = pConfig->RoamRssiDiff;
 	smeConfig->csrConfig.isWESModeEnabled = pConfig->isWESModeEnabled;
-#endif
 	smeConfig->csrConfig.isRoamOffloadScanEnabled =
 		pConfig->isRoamOffloadScanEnabled;
 	smeConfig->csrConfig.bFastRoamInConIniFeatureEnabled =
@@ -6477,7 +6544,6 @@ CDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 		/* Disable roaming in concurrency if roam scan offload is disabled */
 		smeConfig->csrConfig.bFastRoamInConIniFeatureEnabled = 0;
 	}
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	smeConfig->csrConfig.neighborRoamConfig.nNeighborLookupRssiThreshold =
 		pConfig->nNeighborLookupRssiThreshold;
 	smeConfig->csrConfig.neighborRoamConfig.delay_before_vdev_stop =
@@ -6518,7 +6584,6 @@ CDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 		pConfig->nhi_rssi_scan_delay;
 	smeConfig->csrConfig.neighborRoamConfig.nhi_rssi_scan_rssi_ub =
 		pConfig->nhi_rssi_scan_rssi_ub;
-#endif
 	smeConfig->csrConfig.addTSWhenACMIsOff = pConfig->AddTSWhenACMIsOff;
 	smeConfig->csrConfig.fValidateList = pConfig->fValidateScanList;
 	smeConfig->csrConfig.allowDFSChannelRoam = pConfig->allowDFSChannelRoam;
@@ -6553,17 +6618,18 @@ CDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 
 #ifdef FEATURE_WLAN_SCAN_PNO
 	/* Update PNO offoad status */
-	smeConfig->pnoOffload = pHddCtx->config->PnoOffload;
+	smeConfig->csrConfig.pnoOffload = pHddCtx->config->PnoOffload;
 #endif
 
 	/* Update maximum interfaces information */
-	smeConfig->max_intf_count = pHddCtx->max_intf_count;
+	smeConfig->csrConfig.max_intf_count = pHddCtx->max_intf_count;
 
-	smeConfig->fEnableDebugLog = pHddCtx->config->gEnableDebugLog;
+	smeConfig->csrConfig.fEnableDebugLog = pHddCtx->config->gEnableDebugLog;
 
-	smeConfig->enable5gEBT = pHddCtx->config->enable5gEBT;
+	smeConfig->csrConfig.enable5gEBT = pHddCtx->config->enable5gEBT;
 
-	smeConfig->enableSelfRecovery = pHddCtx->config->enableSelfRecovery;
+	smeConfig->csrConfig.enableSelfRecovery =
+			pHddCtx->config->enableSelfRecovery;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 	smeConfig->csrConfig.isRoamOffloadEnabled =
 		pHddCtx->config->isRoamOffloadEnabled;
@@ -6575,25 +6641,25 @@ CDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 	smeConfig->csrConfig.is_sta_connection_in_5gz_enabled =
 		pHddCtx->config->is_sta_connection_in_5gz_enabled;
 
-	smeConfig->f_sta_miracast_mcc_rest_time_val =
+	smeConfig->csrConfig.f_sta_miracast_mcc_rest_time_val =
 		pHddCtx->config->sta_miracast_mcc_rest_time_val;
 
 #ifdef FEATURE_AP_MCC_CH_AVOIDANCE
-	smeConfig->sap_channel_avoidance =
+	smeConfig->csrConfig.sap_channel_avoidance =
 		pHddCtx->config->sap_channel_avoidance;
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
-	smeConfig->f_prefer_non_dfs_on_radar =
+	smeConfig->csrConfig.f_prefer_non_dfs_on_radar =
 		pHddCtx->config->prefer_non_dfs_on_radar;
 
-	smeConfig->is_ps_enabled = pHddCtx->config->is_ps_enabled;
+	smeConfig->csrConfig.is_ps_enabled = pHddCtx->config->is_ps_enabled;
 	hdd_set_fine_time_meas_cap(pHddCtx, smeConfig);
 
 	cds_set_multicast_logging(pHddCtx->config->multicast_host_fw_msgs);
 
 	smeConfig->csrConfig.sendDeauthBeforeCon = pConfig->sendDeauthBeforeCon;
 
-	smeConfig->policy_manager_enabled =
+	smeConfig->csrConfig.policy_manager_enabled =
 			pHddCtx->config->policy_manager_enabled;
 	smeConfig->csrConfig.max_scan_count =
 			pHddCtx->config->max_scan_count;
@@ -6603,11 +6669,11 @@ CDF_STATUS hdd_set_sme_config(hdd_context_t *pHddCtx)
 		(pHddCtx->config->dot11p_mode != WLAN_HDD_11P_DISABLED);
 	hdd_set_pno_channel_prediction_config(smeConfig, pHddCtx);
 
-	smeConfig->early_stop_scan_enable =
+	smeConfig->csrConfig.early_stop_scan_enable =
 		pHddCtx->config->early_stop_scan_enable;
-	smeConfig->early_stop_scan_min_threshold =
+	smeConfig->csrConfig.early_stop_scan_min_threshold =
 		pHddCtx->config->early_stop_scan_min_threshold;
-	smeConfig->early_stop_scan_max_threshold =
+	smeConfig->csrConfig.early_stop_scan_max_threshold =
 		pHddCtx->config->early_stop_scan_max_threshold;
 	smeConfig->csrConfig.first_scan_bucket_threshold =
 		pHddCtx->config->first_scan_bucket_threshold;
diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c
index 75944d45d1b7..4f1c1be971c1 100644
--- a/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/core/hdd/src/wlan_hdd_cfg80211.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -87,10 +87,10 @@
 
 #include "wlan_hdd_ocb.h"
 
+#include "wlan_hdd_subnet_detect.h"
+
 #define g_mode_rates_size (12)
 #define a_mode_rates_size (8)
-#define FREQ_BASE_80211G          (2407)
-#define FREQ_BAND_DIFF_80211G     (5)
 #define GET_IE_LEN_IN_BSS_DESC(lenInBss) (lenInBss + sizeof(lenInBss) - \
 					   ((uintptr_t)OFFSET_OF(tSirBssDescription, ieFields)))
 
@@ -138,6 +138,8 @@
 
 #define HDD_CHANNEL_14 14
 
+#define MAX_TXPOWER_SCALE 4
+
 static const u32 hdd_cipher_suites[] = {
 	WLAN_CIPHER_SUITE_WEP40,
 	WLAN_CIPHER_SUITE_WEP104,
@@ -183,13 +185,6 @@ static struct ieee80211_channel hdd_social_channels_2_4_ghz[] = {
 };
 
 static struct ieee80211_channel hdd_channels_5_ghz[] = {
-	HDD5GHZCHAN(4920, 240, 0),
-	HDD5GHZCHAN(4940, 244, 0),
-	HDD5GHZCHAN(4960, 248, 0),
-	HDD5GHZCHAN(4980, 252, 0),
-	HDD5GHZCHAN(5040, 208, 0),
-	HDD5GHZCHAN(5060, 212, 0),
-	HDD5GHZCHAN(5080, 216, 0),
 	HDD5GHZCHAN(5180, 36, 0),
 	HDD5GHZCHAN(5200, 40, 0),
 	HDD5GHZCHAN(5220, 44, 0),
@@ -215,7 +210,6 @@ static struct ieee80211_channel hdd_channels_5_ghz[] = {
 	HDD5GHZCHAN(5785, 157, 0),
 	HDD5GHZCHAN(5805, 161, 0),
 	HDD5GHZCHAN(5825, 165, 0),
-#ifndef FEATURE_STATICALLY_ADD_11P_CHANNELS
 	HDD5GHZCHAN(5852, 170, 0),
 	HDD5GHZCHAN(5855, 171, 0),
 	HDD5GHZCHAN(5860, 172, 0),
@@ -231,7 +225,6 @@ static struct ieee80211_channel hdd_channels_5_ghz[] = {
 	HDD5GHZCHAN(5910, 182, 0),
 	HDD5GHZCHAN(5915, 183, 0),
 	HDD5GHZCHAN(5920, 184, 0),
-#endif
 };
 
 static struct ieee80211_rate g_mode_rates[] = {
@@ -363,7 +356,6 @@ static const struct ieee80211_txrx_stypes
 	},
 };
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
 /* Interface limits and combinations registered by the driver */
 
 /* STA ( + STA ) combination */
@@ -375,6 +367,7 @@ static const struct ieee80211_iface_limit
 	},
 };
 
+#ifndef QCA_WIFI_3_0_EMU
 /* ADHOC (IBSS) limit */
 static const struct ieee80211_iface_limit
 	wlan_hdd_adhoc_iface_limit[] = {
@@ -387,6 +380,20 @@ static const struct ieee80211_iface_limit
 		.types = BIT(NL80211_IFTYPE_ADHOC),
 	},
 };
+#else
+/* ADHOC (IBSS) limit */
+static const struct ieee80211_iface_limit
+	wlan_hdd_adhoc_iface_limit[] = {
+	{
+		.max = 1,
+		.types = BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_AP),
+	},
+	{
+		.max = 1,
+		.types = BIT(NL80211_IFTYPE_ADHOC),
+	},
+};
+#endif
 
 /* AP ( + AP ) combination */
 static const struct ieee80211_iface_limit
@@ -511,7 +518,7 @@ static struct ieee80211_iface_combination
 	/* ADHOC */
 	{
 		.limits = wlan_hdd_adhoc_iface_limit,
-		.num_different_channels = 1,
+		.num_different_channels = 2,
 		.max_interfaces = 2,
 		.n_limits = ARRAY_SIZE(wlan_hdd_adhoc_iface_limit),
 	},
@@ -577,7 +584,6 @@ static struct ieee80211_iface_combination
 		.beacon_int_infra_match = true,
 	},
 };
-#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) */
 
 static struct cfg80211_ops wlan_hdd_cfg80211_ops;
 
@@ -617,14 +623,6 @@ static const struct wiphy_wowlan_support wowlan_support_cfg80211_init = {
 };
 #endif
 
-#ifdef FEATURE_WLAN_TDLS
-
-/* TDLS capabilities params */
-#define PARAM_MAX_TDLS_SESSION \
-		QCA_WLAN_VENDOR_ATTR_TDLS_GET_CAPS_MAX_CONC_SESSIONS
-#define PARAM_TDLS_FEATURE_SUPPORT \
-		QCA_WLAN_VENDOR_ATTR_TDLS_GET_CAPS_FEATURES_SUPPORTED
-
 /**
  * hdd_add_channel_switch_support()- Adds Channel Switch flag if supported
  * @flags: Pointer to the flags to Add channel switch flag.
@@ -646,6 +644,14 @@ static inline void hdd_add_channel_switch_support(uint32_t *flags)
 }
 #endif
 
+#ifdef FEATURE_WLAN_TDLS
+
+/* TDLS capabilities params */
+#define PARAM_MAX_TDLS_SESSION \
+		QCA_WLAN_VENDOR_ATTR_TDLS_GET_CAPS_MAX_CONC_SESSIONS
+#define PARAM_TDLS_FEATURE_SUPPORT \
+		QCA_WLAN_VENDOR_ATTR_TDLS_GET_CAPS_FEATURES_SUPPORTED
+
 /**
  * __wlan_hdd_cfg80211_get_tdls_capabilities() - Provide TDLS Capabilites.
  * @wiphy:    WIPHY structure pointer
@@ -667,7 +673,7 @@ static int __wlan_hdd_cfg80211_get_tdls_capabilities(struct wiphy *wiphy,
 	struct sk_buff *skb;
 	uint32_t set = 0;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -1066,6 +1072,12 @@ static const struct nl80211_vendor_cmd_info wlan_hdd_cfg80211_vendor_events[] =
 		.vendor_id = QCA_NL80211_VENDOR_ID,
 		.subcmd = QCA_NL80211_VENDOR_SUBCMD_DCC_STATS_EVENT
 	},
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+	[QCA_NL80211_VENDOR_SUBCMD_GW_PARAM_CONFIG_INDEX] = {
+		.vendor_id = QCA_NL80211_VENDOR_ID,
+		.subcmd = QCA_NL80211_VENDOR_SUBCMD_GW_PARAM_CONFIG
+	},
+#endif /*FEATURE_LFR_SUBNET_DETECTION */
 };
 
 /**
@@ -1096,14 +1108,12 @@ static int __is_driver_dfs_capable(struct wiphy *wiphy,
 	if (ret_val)
 		return ret_val;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
 
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 4, 0))
 	dfs_capability = !!(wiphy->flags & WIPHY_FLAG_DFS_OFFLOAD);
-#endif
 
 	temp_skbuff = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, sizeof(u32) +
 							  NLMSG_HDRLEN);
@@ -1256,20 +1266,20 @@ static void wlan_hdd_set_acs_ch_range(tsap_Config_t *sap_cfg, bool ht_enabled,
 	int i;
 	if (sap_cfg->acs_cfg.hw_mode == QCA_ACS_MODE_IEEE80211B) {
 		sap_cfg->acs_cfg.hw_mode = eCSR_DOT11_MODE_11b;
-		sap_cfg->acs_cfg.start_ch = rf_channels[RF_CHAN_1].channelNum;
-		sap_cfg->acs_cfg.end_ch = rf_channels[RF_CHAN_14].channelNum;
+		sap_cfg->acs_cfg.start_ch = CDS_CHANNEL_NUM(RF_CHAN_1);
+		sap_cfg->acs_cfg.end_ch = CDS_CHANNEL_NUM(RF_CHAN_14);
 	} else if (sap_cfg->acs_cfg.hw_mode == QCA_ACS_MODE_IEEE80211G) {
 		sap_cfg->acs_cfg.hw_mode = eCSR_DOT11_MODE_11g;
-		sap_cfg->acs_cfg.start_ch = rf_channels[RF_CHAN_1].channelNum;
-		sap_cfg->acs_cfg.end_ch = rf_channels[RF_CHAN_13].channelNum;
+		sap_cfg->acs_cfg.start_ch = CDS_CHANNEL_NUM(RF_CHAN_1);
+		sap_cfg->acs_cfg.end_ch = CDS_CHANNEL_NUM(RF_CHAN_13);
 	} else if (sap_cfg->acs_cfg.hw_mode == QCA_ACS_MODE_IEEE80211A) {
 		sap_cfg->acs_cfg.hw_mode = eCSR_DOT11_MODE_11a;
-		sap_cfg->acs_cfg.start_ch = rf_channels[RF_CHAN_36].channelNum;
-		sap_cfg->acs_cfg.end_ch = rf_channels[RF_CHAN_165].channelNum;
+		sap_cfg->acs_cfg.start_ch = CDS_CHANNEL_NUM(RF_CHAN_36);
+		sap_cfg->acs_cfg.end_ch = CDS_CHANNEL_NUM(RF_CHAN_165);
 	} else if (sap_cfg->acs_cfg.hw_mode == QCA_ACS_MODE_IEEE80211ANY) {
 		sap_cfg->acs_cfg.hw_mode = eCSR_DOT11_MODE_abg;
-		sap_cfg->acs_cfg.start_ch = rf_channels[RF_CHAN_1].channelNum;
-		sap_cfg->acs_cfg.end_ch = rf_channels[RF_CHAN_165].channelNum;
+		sap_cfg->acs_cfg.start_ch = CDS_CHANNEL_NUM(RF_CHAN_1);
+		sap_cfg->acs_cfg.end_ch = CDS_CHANNEL_NUM(RF_CHAN_165);
 	}
 
 	if (ht_enabled)
@@ -1405,7 +1415,7 @@ static int __wlan_hdd_cfg80211_do_acs(struct wiphy *wiphy,
 	 * [QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST] = { .type = NLA_NESTED },
 	 */
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -1518,7 +1528,7 @@ static int __wlan_hdd_cfg80211_do_acs(struct wiphy *wiphy,
 	hdd_debug("get pcl for DO_ACS vendor command");
 
 	/* consult policy manager to get PCL */
-	status = cds_get_pcl(hdd_ctx, CDS_SAP_MODE,
+	status = cds_get_pcl(CDS_SAP_MODE,
 					sap_config->acs_cfg.pcl_channels,
 					&sap_config->acs_cfg.pcl_ch_count);
 	if (CDF_STATUS_SUCCESS != status)
@@ -1794,7 +1804,7 @@ __wlan_hdd_cfg80211_get_supported_features(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -1935,7 +1945,7 @@ __wlan_hdd_cfg80211_set_scanning_mac_oui(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -2060,7 +2070,7 @@ __wlan_hdd_cfg80211_get_features(struct wiphy *wiphy,
 	if (ret_val)
 		return ret_val;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -2179,7 +2189,7 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
 	uint32_t buf_len = 0;
 	int ret;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -2369,11 +2379,11 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
 				hddLog(LOGE, FL("attr mac address failed"));
 				goto fail;
 			}
-			nla_memcpy(roam_params.bssid_favored[i],
+			nla_memcpy(roam_params.bssid_favored[i].bytes,
 				tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_BSSID],
-				sizeof(tSirMacAddr));
-			hddLog(CDF_TRACE_LEVEL_DEBUG, MAC_ADDRESS_STR,
-				MAC_ADDR_ARRAY(roam_params.bssid_favored[i]));
+				CDF_MAC_ADDR_SIZE);
+			hdd_debug(MAC_ADDRESS_STR,
+			    MAC_ADDR_ARRAY(roam_params.bssid_favored[i].bytes));
 			/* Parse and fetch preference factor*/
 			if (!tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_RSSI_MODIFIER]) {
 				hddLog(LOGE, FL("BSSID Preference score failed"));
@@ -2414,12 +2424,12 @@ __wlan_hdd_cfg80211_set_ext_roam_params(struct wiphy *wiphy,
 				hddLog(LOGE, FL("attr blacklist addr failed"));
 				goto fail;
 			}
-			nla_memcpy(roam_params.bssid_avoid_list[i],
+			nla_memcpy(roam_params.bssid_avoid_list[i].bytes,
 				tb2[QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_BSSID],
-				sizeof(tSirMacAddr));
-			hddLog(CDF_TRACE_LEVEL_DEBUG, MAC_ADDRESS_STR,
+				CDF_MAC_ADDR_SIZE);
+			hdd_debug(MAC_ADDRESS_STR,
 				MAC_ADDR_ARRAY(
-				roam_params.bssid_avoid_list[i]));
+				roam_params.bssid_avoid_list[i].bytes));
 			i++;
 		}
 		sme_update_roam_params(pHddCtx->hHal, session_id,
@@ -2709,7 +2719,7 @@ static int __wlan_hdd_cfg80211_keymgmt_set_key(struct wiphy *wiphy,
 	hdd_context_t *hdd_ctx_ptr;
 	int status;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -2798,7 +2808,7 @@ __wlan_hdd_cfg80211_get_wifi_info(struct wiphy *wiphy,
 	int status;
 	struct sk_buff *reply_skb = NULL;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -2895,7 +2905,7 @@ __wlan_hdd_cfg80211_get_logger_supp_feature(struct wiphy *wiphy,
 	uint32_t features;
 	struct sk_buff *reply_skb = NULL;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3006,7 +3016,7 @@ int wlan_hdd_send_roam_auth_event(hdd_context_t *hdd_ctx_ptr, uint8_t *bssid,
 			ETH_ALEN + req_rsn_len + rsp_rsn_len +
 			sizeof(uint8_t) + SIR_REPLAY_CTR_LEN +
 			SIR_KCK_KEY_LEN + SIR_KCK_KEY_LEN +
-			(7 * NLMSG_HDRLEN),
+			sizeof(uint8_t) + (8 * NLMSG_HDRLEN),
 			QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH_INDEX,
 			GFP_KERNEL);
 
@@ -3030,16 +3040,29 @@ int wlan_hdd_send_roam_auth_event(hdd_context_t *hdd_ctx_ptr, uint8_t *bssid,
 	if (roam_info_ptr->synchAuthStatus ==
 			CSR_ROAM_AUTH_STATUS_AUTHENTICATED) {
 		hddLog(CDF_TRACE_LEVEL_DEBUG, FL("Include Auth Params TLV's"));
-		if (nla_put_u8(skb, QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_AUTHORIZED,
-			true) ||
-			nla_put(skb,
-				QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_KEY_REPLAY_CTR,
-				SIR_REPLAY_CTR_LEN, roam_info_ptr->replay_ctr)
-			|| nla_put(skb, QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KCK,
-				SIR_KCK_KEY_LEN, roam_info_ptr->kck)
-			|| nla_put(skb, QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KEK,
-				SIR_KEK_KEY_LEN, roam_info_ptr->kek)) {
-			hddLog(CDF_TRACE_LEVEL_ERROR, FL("nla put fail"));
+		if (nla_put_u8(skb,
+			QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_AUTHORIZED, true)) {
+			hdd_err("nla put fail");
+			goto nla_put_failure;
+		}
+		/* if FT connection: dont send ROAM_AUTH_KEY_REPLAY_CTR */
+		if (roam_info_ptr->u.pConnectedProfile->AuthType !=
+			eCSR_AUTH_TYPE_FT_RSN &&
+		    roam_info_ptr->u.pConnectedProfile->AuthType !=
+			eCSR_AUTH_TYPE_FT_RSN_PSK &&
+		    nla_put(skb, QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_KEY_REPLAY_CTR,
+			SIR_REPLAY_CTR_LEN, roam_info_ptr->replay_ctr)) {
+			hdd_err("non FT connection.");
+			hdd_err("failed to send replay counter.");
+			goto nla_put_failure;
+		}
+		if (nla_put(skb,
+			QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KCK,
+			SIR_KCK_KEY_LEN, roam_info_ptr->kck) ||
+		    nla_put(skb,
+			QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KEK,
+			SIR_KEK_KEY_LEN, roam_info_ptr->kek)) {
+			hdd_err("nla put fail");
 			goto nla_put_failure;
 		}
 	} else {
@@ -3051,6 +3074,24 @@ int wlan_hdd_send_roam_auth_event(hdd_context_t *hdd_ctx_ptr, uint8_t *bssid,
 		}
 	}
 
+	hddLog(CDF_TRACE_LEVEL_DEBUG, FL("Subnet Change Status = %d"),
+		roam_info_ptr->subnet_change_status);
+
+	/*
+	 * Add subnet change status if subnet has changed
+	 * 0 = unchanged
+	 * 1 = changed
+	 * 2 = unknown
+	 */
+	if (roam_info_ptr->subnet_change_status) {
+		if (nla_put_u8(skb,
+				QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_SUBNET_STATUS,
+				roam_info_ptr->subnet_change_status)) {
+			hddLog(CDF_TRACE_LEVEL_ERROR, FL("nla put fail"));
+			goto nla_put_failure;
+		}
+	}
+
 	cfg80211_vendor_event(skb, GFP_KERNEL);
 	return 0;
 
@@ -3098,7 +3139,7 @@ __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 	u32 guard_time;
 	CDF_STATUS status;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3217,7 +3258,7 @@ static int __wlan_hdd_cfg80211_wifi_logger_start(struct wiphy *wiphy,
 	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_START_MAX + 1];
 	struct sir_wifi_start_log start_log;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3341,7 +3382,7 @@ static int __wlan_hdd_cfg80211_wifi_logger_get_ring_data(struct wiphy *wiphy,
 	struct nlattr *tb
 		[QCA_WLAN_VENDOR_ATTR_WIFI_LOGGER_GET_RING_DATA_MAX + 1];
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3735,7 +3776,7 @@ __wlan_hdd_cfg80211_offloaded_packets(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -4063,7 +4104,7 @@ static int __wlan_hdd_cfg80211_get_preferred_freq_list(struct wiphy *wiphy,
 
 	hdd_debug("Userspace requested pref freq list");
 
-	status = cds_get_pcl(hdd_ctx, intf_mode, pcl, &pcl_len);
+	status = cds_get_pcl(intf_mode, pcl, &pcl_len);
 	if (status != CDF_STATUS_SUCCESS) {
 		hdd_err("Get pcl failed");
 		return -EINVAL;
@@ -4187,7 +4228,7 @@ static int __wlan_hdd_cfg80211_set_probable_oper_channel(struct wiphy *wiphy,
 			[QCA_WLAN_VENDOR_ATTR_PROBABLE_OPER_CHANNEL_FREQ]));
 
 	/* check pcl table */
-	if (!cds_allow_concurrency(hdd_ctx, intf_mode,
+	if (!cds_allow_concurrency(intf_mode,
 					channel_hint, HW_MODE_20_MHZ)) {
 		hdd_err("Set channel hint failed due to concurrency check");
 		return -EINVAL;
@@ -4288,7 +4329,7 @@ static int __wlan_hdd_cfg80211_get_link_properties(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -4471,7 +4512,7 @@ static int __wlan_hdd_cfg80211_set_ota_test(struct wiphy *wiphy,
 	CDF_STATUS status;
 	uint32_t current_roam_state;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -4556,6 +4597,161 @@ static int wlan_hdd_cfg80211_set_ota_test(struct wiphy *wiphy,
 	return ret;
 }
 
+/**
+ * __wlan_hdd_cfg80211_txpower_scale () - txpower scaling
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Data length
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int __wlan_hdd_cfg80211_txpower_scale(struct wiphy *wiphy,
+						struct wireless_dev *wdev,
+						const void *data,
+						int data_len)
+{
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct net_device *dev = wdev->netdev;
+	hdd_adapter_t *adapter = NULL;
+	int ret = 0;
+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_MAX + 1];
+	uint8_t scale_value;
+
+	ret = wlan_hdd_validate_context(hdd_ctx);
+	if (ret)
+		return ret;
+
+	adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+
+	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_MAX,
+		      data, data_len, NULL)) {
+		hdd_err("Invalid ATTR");
+		return -EINVAL;
+	}
+
+	if (!tb[QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE]) {
+		hdd_err("attr tx power scale failed");
+		return -EINVAL;
+	}
+
+	scale_value = nla_get_u8(tb
+		    [QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE]);
+
+	if (scale_value > MAX_TXPOWER_SCALE) {
+		hdd_err("Invalid tx power scale level");
+		return -EINVAL;
+	}
+
+	ret = wma_set_tx_power_scale(adapter->sessionId, scale_value);
+
+	if (ret != 0) {
+		hdd_err("Set tx power scale failed");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * wlan_hdd_cfg80211_txpower_scale () - txpower scaling
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Data length
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int wlan_hdd_cfg80211_txpower_scale(struct wiphy *wiphy,
+						struct wireless_dev *wdev,
+						const void *data,
+						int data_len)
+{
+	int ret = 0;
+
+	cds_ssr_protect(__func__);
+	ret = __wlan_hdd_cfg80211_txpower_scale(wiphy, wdev,
+						data, data_len);
+	cds_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+/**
+ * __wlan_hdd_cfg80211_txpower_scale_decr_db () - txpower scaling
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Data length
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int __wlan_hdd_cfg80211_txpower_scale_decr_db(struct wiphy *wiphy,
+						struct wireless_dev *wdev,
+						const void *data,
+						int data_len)
+{
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct net_device *dev = wdev->netdev;
+	hdd_adapter_t *adapter = NULL;
+	int ret = 0;
+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_MAX + 1];
+	uint8_t scale_value;
+
+	ret = wlan_hdd_validate_context(hdd_ctx);
+	if (ret)
+		return ret;
+
+	adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+
+	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_MAX,
+		      data, data_len, NULL)) {
+		hdd_err("Invalid ATTR");
+		return -EINVAL;
+	}
+
+	if (!tb[QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB]) {
+		hdd_err("attr tx power decrease db value failed");
+		return -EINVAL;
+	}
+
+	scale_value = nla_get_u8(tb
+		    [QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB]);
+
+	ret = wma_set_tx_power_scale_decr_db(adapter->sessionId, scale_value);
+
+	if (ret != 0) {
+		hdd_err("Set tx power decrease db failed");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * wlan_hdd_cfg80211_txpower_scale_decr_db () - txpower scaling
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Data length
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int wlan_hdd_cfg80211_txpower_scale_decr_db(struct wiphy *wiphy,
+						struct wireless_dev *wdev,
+						const void *data,
+						int data_len)
+{
+	int ret = 0;
+
+	cds_ssr_protect(__func__);
+	ret = __wlan_hdd_cfg80211_txpower_scale_decr_db(wiphy, wdev,
+						data, data_len);
+	cds_ssr_unprotect(__func__);
+
+	return ret;
+}
+
 const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] = {
 	{
 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
@@ -4984,32 +5180,61 @@ const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] = {
 				 WIPHY_VENDOR_CMD_NEED_RUNNING,
 		.doit = wlan_hdd_cfg80211_set_ota_test
 	},
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+	{
+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
+		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_GW_PARAM_CONFIG,
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+				WIPHY_VENDOR_CMD_NEED_NETDEV |
+				WIPHY_VENDOR_CMD_NEED_RUNNING,
+		.doit = wlan_hdd_cfg80211_set_gateway_params
+	},
+#endif /* FEATURE_LFR_SUBNET_DETECTION */
+	{
+		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE,
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+				 WIPHY_VENDOR_CMD_NEED_NETDEV |
+				 WIPHY_VENDOR_CMD_NEED_RUNNING,
+		.doit = wlan_hdd_cfg80211_txpower_scale
+	},
+	{
+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
+		.info.subcmd =
+			QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB,
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+				 WIPHY_VENDOR_CMD_NEED_NETDEV |
+				 WIPHY_VENDOR_CMD_NEED_RUNNING,
+		.doit = wlan_hdd_cfg80211_txpower_scale_decr_db
+	},
 };
 
-/*
- * FUNCTION: wlan_hdd_cfg80211_wiphy_alloc
- * This function is called by hdd_wlan_startup()
- * during initialization.
- * This function is used to allocate wiphy structure.
+/**
+ * hdd_cfg80211_wiphy_alloc() - Allocate wiphy context
+ * @priv_size:         Size of the hdd context.
+ *
+ * Allocate wiphy context and hdd context.
+ *
+ * Return: hdd context on success and NULL on failure.
  */
-struct wiphy *wlan_hdd_cfg80211_wiphy_alloc(int priv_size)
+hdd_context_t *hdd_cfg80211_wiphy_alloc(int priv_size)
 {
 	struct wiphy *wiphy;
+	hdd_context_t *hdd_ctx;
+
 	ENTER();
 
-	/*
-	 *   Create wiphy device
-	 */
 	wiphy = wiphy_new(&wlan_hdd_cfg80211_ops, priv_size);
 
 	if (!wiphy) {
-		/* Print error and jump into err label and free the memory */
-		hddLog(CDF_TRACE_LEVEL_ERROR, "%s: wiphy init failed",
-		       __func__);
+		hdd_err("wiphy init failed!\n");
 		return NULL;
 	}
 
-	return wiphy;
+	hdd_ctx = wiphy_priv(wiphy);
+
+	hdd_ctx->wiphy = wiphy;
+
+	return hdd_ctx;
 }
 
 /*
@@ -5020,7 +5245,7 @@ struct wiphy *wlan_hdd_cfg80211_wiphy_alloc(int priv_size)
 int wlan_hdd_cfg80211_update_band(struct wiphy *wiphy, eCsrBand eBand)
 {
 	int i, j;
-	CHANNEL_STATE channelEnabledState;
+	enum channel_state channelEnabledState;
 
 	ENTER();
 
@@ -5096,15 +5321,14 @@ int wlan_hdd_cfg80211_init(struct device *dev,
 
 	wiphy->mgmt_stypes = wlan_hdd_txrx_stypes;
 
-	/* This will disable updating of NL channels from passive to
-	 * active if a beacon is received on passive channel. */
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
 	wiphy->regulatory_flags |= REGULATORY_DISABLE_BEACON_HINTS;
+	wiphy->regulatory_flags |= REGULATORY_COUNTRY_IE_IGNORE;
 #else
 	wiphy->flags |= WIPHY_FLAG_DISABLE_BEACON_HINTS;
+	wiphy->country_ie_pref |= NL80211_COUNTRY_IE_IGNORE_CORE;
 #endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
 	wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME
 			| WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD
 			| WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL
@@ -5113,13 +5337,6 @@ int wlan_hdd_cfg80211_init(struct device *dev,
 #endif
 			| WIPHY_FLAG_OFFCHAN_TX;
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
-	wiphy->regulatory_flags = REGULATORY_COUNTRY_IE_IGNORE;
-#else
-	wiphy->country_ie_pref = NL80211_COUNTRY_IE_IGNORE_CORE;
-#endif
-#endif
-
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
 	wiphy->wowlan = &wowlan_support_cfg80211_init;
 #else
@@ -5129,18 +5346,13 @@ int wlan_hdd_cfg80211_init(struct device *dev,
 	wiphy->wowlan.pattern_max_len = WOWL_PTRN_MAX_SIZE;
 #endif
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
-	if (pCfg->isFastTransitionEnabled
-#ifdef FEATURE_WLAN_LFR
-	    || pCfg->isFastRoamIniFeatureEnabled
-#endif
+	if (pCfg->isFastTransitionEnabled || pCfg->isFastRoamIniFeatureEnabled
 #ifdef FEATURE_WLAN_ESE
 	    || pCfg->isEseIniFeatureEnabled
 #endif
 	    ) {
 		wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
 	}
-#endif
 #ifdef FEATURE_WLAN_TDLS
 	wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS
 			| WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
@@ -5158,7 +5370,7 @@ int wlan_hdd_cfg80211_init(struct device *dev,
 #endif /*FEATURE_WLAN_SCAN_PNO */
 
 #if  defined QCA_WIFI_FTM
-	if (cds_get_conparam() != CDF_FTM_MODE) {
+	if (cds_get_conparam() != CDF_GLOBAL_FTM_MODE) {
 #endif
 
 	/* even with WIPHY_FLAG_CUSTOM_REGULATORY,
@@ -5187,7 +5399,6 @@ int wlan_hdd_cfg80211_init(struct device *dev,
 				 | BIT(NL80211_IFTYPE_AP);
 
 	if (pCfg->advertiseConcurrentOperation) {
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
 		if (pCfg->enableMCC) {
 			int i;
 			for (i = 0; i < ARRAY_SIZE(wlan_hdd_iface_combination);
@@ -5200,7 +5411,6 @@ int wlan_hdd_cfg80211_init(struct device *dev,
 		wiphy->n_iface_combinations =
 			ARRAY_SIZE(wlan_hdd_iface_combination);
 		wiphy->iface_combinations = wlan_hdd_iface_combination;
-#endif
 	}
 
 	/* Before registering we need to update the ht capabilitied based
@@ -5265,7 +5475,7 @@ int wlan_hdd_cfg80211_init(struct device *dev,
 	wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
 	wiphy->max_remain_on_channel_duration = MAX_REMAIN_ON_CHANNEL_DURATION;
 
-	if (cds_get_conparam() != CDF_FTM_MODE) {
+	if (cds_get_conparam() != CDF_GLOBAL_FTM_MODE) {
 		wiphy->n_vendor_commands =
 				ARRAY_SIZE(hdd_wiphy_vendor_commands);
 		wiphy->vendor_commands = hdd_wiphy_vendor_commands;
@@ -5275,11 +5485,9 @@ int wlan_hdd_cfg80211_init(struct device *dev,
 				ARRAY_SIZE(wlan_hdd_cfg80211_vendor_events);
 	}
 
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 4, 0))
 	if (pCfg->enableDFSMasterCap) {
 		wiphy->flags |= WIPHY_FLAG_DFS_OFFLOAD;
 	}
-#endif
 
 	wiphy->max_ap_assoc_sta = pCfg->maxNumberOfPeers;
 
@@ -5357,6 +5565,9 @@ void wlan_hdd_cfg80211_register_frames(hdd_adapter_t *pAdapter)
 
 	ENTER();
 
+	/* Register frame indication call back */
+	sme_register_mgmt_frame_ind_callback(hHal, hdd_indicate_mgmt_frame);
+
 	/* Right now we are registering these frame when driver is getting
 	   initialized. Once we will move to 2.6.37 kernel, in which we have
 	   frame register ops, we will move this code as a part of that */
@@ -5550,7 +5761,7 @@ CDF_STATUS wlan_hdd_validate_operation_channel(hdd_adapter_t *pAdapter,
 	if (hdd_pConfig_ini->sapAllowAllChannel) {
 		/* Validate the channel */
 		for (count = RF_CHAN_1; count <= RF_CHAN_165; count++) {
-			if (channel == rf_channels[count].channelNum) {
+			if (channel == CDS_CHANNEL_NUM(count)) {
 				fValidChannel = true;
 				break;
 			}
@@ -5652,7 +5863,7 @@ static int __wlan_hdd_cfg80211_change_bss(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -5744,9 +5955,6 @@ static int wlan_hdd_change_iface_to_sta_mode(struct net_device *ndev,
 			WLAN_HDD_INFRA_STATION : WLAN_HDD_P2P_CLIENT;
 	}
 
-	/* set con_mode to STA only when no SAP concurrency mode */
-	if (!(cds_get_concurrency_mode() & (CDF_SAP_MASK | CDF_P2P_GO_MASK)))
-		hdd_set_conparam(0);
 	memset(&pAdapter->sessionCtx, 0, sizeof(pAdapter->sessionCtx));
 	hdd_set_station_ops(pAdapter->dev);
 	status = hdd_init_station_mode(pAdapter);
@@ -5781,9 +5989,15 @@ void *wlan_hdd_change_country_code_cb(void *pAdapter)
 	return NULL;
 }
 
-/*
- * FUNCTION: __wlan_hdd_cfg80211_change_iface
- * This function is used to set the interface type (INFRASTRUCTURE/ADHOC)
+/**
+ * __wlan_hdd_cfg80211_change_iface() - change interface cfg80211 op
+ * @wiphy: Pointer to the wiphy structure
+ * @ndev: Pointer to the net device
+ * @type: Interface type
+ * @flags: Flags for change interface
+ * @params: Pointer to change interface parameters
+ *
+ * Return: 0 for success, error number on failure.
  */
 static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
 					    struct net_device *ndev,
@@ -5804,7 +6018,7 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -5821,7 +6035,7 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
 	hddLog(CDF_TRACE_LEVEL_INFO, FL("Device_mode = %d, IFTYPE = 0x%x"),
 	       pAdapter->device_mode, type);
 
-	if (!cds_allow_concurrency(pHddCtx,
+	if (!cds_allow_concurrency(
 				wlan_hdd_convert_nl_iftype_to_hdd_type(type),
 				0, HW_MODE_20_MHZ)) {
 		hddLog(CDF_TRACE_LEVEL_DEBUG,
@@ -5833,13 +6047,14 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
 	wdev = ndev->ieee80211_ptr;
 
 	/* Reset the current device mode bit mask */
-	cds_clear_concurrency_mode(pHddCtx, pAdapter->device_mode);
+	cds_clear_concurrency_mode(pAdapter->device_mode);
 
 	hdd_tdls_notify_mode_change(pAdapter, pHddCtx);
 
 	if ((pAdapter->device_mode == WLAN_HDD_INFRA_STATION) ||
 	    (pAdapter->device_mode == WLAN_HDD_P2P_CLIENT) ||
-	    (pAdapter->device_mode == WLAN_HDD_P2P_DEVICE)) {
+	    (pAdapter->device_mode == WLAN_HDD_P2P_DEVICE) ||
+	    (pAdapter->device_mode == WLAN_HDD_IBSS)) {
 		hdd_wext_state_t *pWextState =
 			WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
 
@@ -5881,33 +6096,6 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
 				wlan_hdd_cancel_existing_remain_on_channel
 					(pAdapter);
 			}
-
-			if (NL80211_IFTYPE_AP == type) {
-				/* As Loading WLAN Driver one interface being created for
-				 * p2p device address. This will take one HW STA and the
-				 * max number of clients that can connect to softAP will be
-				 * reduced by one. so while changing the interface type to
-				 * NL80211_IFTYPE_AP (SoftAP) remove p2p0 interface as it is
-				 * not required in SoftAP mode.
-				 */
-
-				/* Get P2P Adapter */
-				hdd_adapter_t *pP2pAdapter = NULL;
-				pP2pAdapter =
-					hdd_get_adapter(pHddCtx,
-							WLAN_HDD_P2P_DEVICE);
-
-				if (pP2pAdapter) {
-					hdd_stop_adapter(pHddCtx,
-							 pP2pAdapter,
-							 true);
-					hdd_deinit_adapter(pHddCtx,
-							   pP2pAdapter, true);
-					hdd_close_adapter(pHddCtx,
-							  pP2pAdapter,
-							  true);
-				}
-			}
 			hdd_stop_adapter(pHddCtx, pAdapter, true);
 
 			/* De-init the adapter */
@@ -5949,7 +6137,6 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
 					       ("Error initializing the ap mode"));
 				return -EINVAL;
 			}
-			hdd_set_conparam(1);
 
 			hdd_register_tx_flow_control(pAdapter,
 				hdd_softap_tx_resume_timer_expired_handler,
@@ -6042,7 +6229,7 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
 
 done:
 	/* Set bitmask based on updated value */
-	cds_set_concurrency_mode(pHddCtx, pAdapter->device_mode);
+	cds_set_concurrency_mode(pAdapter->device_mode);
 
 #ifdef WLAN_FEATURE_LPSS
 	wlan_hdd_send_all_scan_intf_info(pHddCtx);
@@ -6052,9 +6239,15 @@ done:
 	return 0;
 }
 
-/*
- * FUNCTION: wlan_hdd_cfg80211_change_iface
- * wrapper function to protect the actual implementation from SSR.
+/**
+ * wlan_hdd_cfg80211_change_iface() - change interface cfg80211 op
+ * @wiphy: Pointer to the wiphy structure
+ * @ndev: Pointer to the net device
+ * @type: Interface type
+ * @flags: Flags for change interface
+ * @params: Pointer to change interface parameters
+ *
+ * Return: 0 for success, error number on failure.
  */
 static int wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
 					  struct net_device *ndev,
@@ -6120,7 +6313,7 @@ static int __wlan_hdd_change_station(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -6403,7 +6596,7 @@ static int __wlan_hdd_cfg80211_add_key(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -6737,7 +6930,7 @@ static int __wlan_hdd_cfg80211_get_key(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -6889,7 +7082,7 @@ static int __wlan_hdd_cfg80211_set_default_key(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -7118,6 +7311,7 @@ wlan_hdd_cfg80211_inform_bss_frame(hdd_adapter_t *pAdapter,
 #ifdef CONFIG_CNSS
 	struct timespec ts;
 #endif
+	struct hdd_config *cfg_param;
 
 	ENTER();
 
@@ -7126,6 +7320,7 @@ wlan_hdd_cfg80211_inform_bss_frame(hdd_adapter_t *pAdapter,
 	if (0 != status)
 		return NULL;
 
+	cfg_param = pHddCtx->config;
 	mgmt = kzalloc((sizeof(struct ieee80211_mgmt) + ie_length), GFP_KERNEL);
 	if (!mgmt) {
 		hddLog(LOGE, FL("memory allocation failed"));
@@ -7219,8 +7414,15 @@ wlan_hdd_cfg80211_inform_bss_frame(hdd_adapter_t *pAdapter,
 		return NULL;
 	}
 
+	/* Based on .ini configuration, raw rssi can be reported for bss.
+	 * Raw rssi is typically used for estimating power.
+	 */
+
+	rssi = (cfg_param->inform_bss_rssi_raw) ? bss_desc->rssi_raw :
+			bss_desc->rssi;
+
 	/* Supplicant takes the signal strength in terms of mBm(100*dBm) */
-	rssi = (CDF_MIN((bss_desc->rssi + bss_desc->sinr), 0)) * 100;
+	rssi = CDF_MIN(rssi, 0) * 100;
 
 	hddLog(LOG1, FL("BSSID: " MAC_ADDRESS_STR " Channel:%d RSSI:%d"),
 	       MAC_ADDR_ARRAY(mgmt->bssid), chan->center_freq,
@@ -7263,7 +7465,7 @@ struct cfg80211_bss *wlan_hdd_cfg80211_update_bss_db(hdd_adapter_t *pAdapter,
 			hddLog(LOG1,
 				FL("wlan_hdd_cfg80211_inform_bss_frame returned NULL"));
 
-		sme_roam_free_connect_profile(hHal, &roamProfile);
+		sme_roam_free_connect_profile(&roamProfile);
 	} else {
 		hddLog(LOGE, FL("roamProfile.pBssDesc is NULL"));
 	}
@@ -7337,9 +7539,7 @@ int wlan_hdd_cfg80211_update_bss(struct wiphy *wiphy,
 				hdd_info("NULL returned by cfg80211_inform_bss_frame");
 			} else {
 				cfg80211_put_bss(
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
 					wiphy,
-#endif
 					bss_status);
 			}
 		} else {
@@ -7366,7 +7566,6 @@ int wlan_hdd_cfg80211_update_bss(struct wiphy *wiphy,
 	return 0;
 }
 
-#if defined(FEATURE_WLAN_LFR) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
 /**
  * wlan_hdd_cfg80211_pmksa_candidate_notify() - notify a new PMSKA candidate
  * @pAdapter: Pointer to adapter
@@ -7404,7 +7603,6 @@ int wlan_hdd_cfg80211_pmksa_candidate_notify(hdd_adapter_t *pAdapter,
 #endif /* FEATURE_WLAN_OKC */
 	return 0;
 }
-#endif /* FEATURE_WLAN_LFR */
 
 #ifdef FEATURE_WLAN_LFR_METRICS
 /**
@@ -7768,7 +7966,7 @@ int wlan_hdd_cfg80211_connect_start(hdd_adapter_t *pAdapter,
 		}
 
 		if (pHddCtx->config->policy_manager_enabled &&
-			(true == cds_is_connection_in_progress(pHddCtx))) {
+			(true == cds_is_connection_in_progress())) {
 			hdd_err("Connection refused: conn in progress");
 			return -EINVAL;
 		}
@@ -7807,9 +8005,8 @@ int wlan_hdd_cfg80211_connect_start(hdd_adapter_t *pAdapter,
 		 * check for other concurrency rules.
 		 */
 		if (!pHddCtx->config->policy_manager_enabled) {
-			cds_handle_conc_rule1(pHddCtx, pAdapter,
-					pRoamProfile);
-			if (true != cds_handle_conc_rule2(pHddCtx,
+			cds_handle_conc_rule1(pAdapter, pRoamProfile);
+			if (true != cds_handle_conc_rule2(
 					pAdapter, pRoamProfile, &roamId))
 				return 0;
 		}
@@ -8542,48 +8739,62 @@ static int wlan_hdd_try_disconnect(hdd_adapter_t *pAdapter)
 	unsigned long rc;
 	hdd_station_ctx_t *pHddStaCtx;
 	eMib_dot11DesiredBssType connectedBssType;
+	int status, result = 0;
 
 	pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
 
 	hdd_conn_get_connected_bss_type(pHddStaCtx, &connectedBssType);
 
 	if ((eMib_dot11DesiredBssType_independent == connectedBssType) ||
-	    (eConnectionState_Associated == pHddStaCtx->conn_info.connState) ||
-	    (eConnectionState_IbssConnected == pHddStaCtx->conn_info.connState)) {
+	  (eConnectionState_Associated == pHddStaCtx->conn_info.connState) ||
+	  (eConnectionState_Connecting == pHddStaCtx->conn_info.connState) ||
+	  (eConnectionState_IbssConnected == pHddStaCtx->conn_info.connState)) {
 		hdd_conn_set_connection_state(pAdapter,
 						eConnectionState_Disconnecting);
 		/* Issue disconnect to CSR */
 		INIT_COMPLETION(pAdapter->disconnect_comp_var);
-		if (CDF_STATUS_SUCCESS ==
-		    sme_roam_disconnect(WLAN_HDD_GET_HAL_CTX(pAdapter),
-					pAdapter->sessionId,
-					eCSR_DISCONNECT_REASON_UNSPECIFIED)) {
-			rc = wait_for_completion_timeout(&pAdapter->
-							 disconnect_comp_var,
-							 msecs_to_jiffies
-								 (WLAN_WAIT_TIME_DISCONNECT));
-			if (!rc) {
-				hddLog(LOGE,
-				       FL("Sme disconnect event timed out session Id %d staDebugState %d"),
-				       pAdapter->sessionId,
-				       pHddStaCtx->staDebugState);
-				return -EALREADY;
-			}
+
+		status = sme_roam_disconnect(WLAN_HDD_GET_HAL_CTX(pAdapter),
+				pAdapter->sessionId,
+				eCSR_DISCONNECT_REASON_UNSPECIFIED);
+		/*
+		 * Wait here instead of returning directly, this will block the
+		 * next connect command and allow processing of the scan for
+		 * ssid and the previous connect command in CSR. Else we might
+		 * hit some race conditions leading to SME and HDD out of sync.
+		 */
+		if (CDF_STATUS_CMD_NOT_QUEUED == status) {
+			hdd_info("Already disconnected or connect was in sme/roam pending list and removed by disconnect");
+		} else if (0 != status) {
+			hdd_err("csrRoamDisconnect failure, returned %d",
+				(int)status);
+			pHddStaCtx->staDebugState = status;
+			result = -EINVAL;
+			goto disconnected;
+		}
+
+		rc = wait_for_completion_timeout(
+			&pAdapter->disconnect_comp_var,
+			msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
+		if (!rc && (CDF_STATUS_CMD_NOT_QUEUED != status)) {
+			hdd_err("Sme disconnect event timed out session Id %d staDebugState %d",
+				pAdapter->sessionId, pHddStaCtx->staDebugState);
+			result = -ETIMEDOUT;
 		}
 	} else if (eConnectionState_Disconnecting ==
-		   pHddStaCtx->conn_info.connState) {
+				pHddStaCtx->conn_info.connState) {
 		rc = wait_for_completion_timeout(&pAdapter->disconnect_comp_var,
-						 msecs_to_jiffies
-							 (WLAN_WAIT_TIME_DISCONNECT));
+				msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
 		if (!rc) {
-			hddLog(LOGE,
-				FL("Disconnect event timed out session Id %d staDebugState %d"),
+			hdd_err("Disconnect event timed out session Id %d staDebugState %d",
 				pAdapter->sessionId, pHddStaCtx->staDebugState);
-			return -EALREADY;
+			result = -ETIMEDOUT;
 		}
 	}
-
-	return 0;
+disconnected:
+	hdd_info("Set HDD connState to eConnectionState_NotConnected");
+	hdd_conn_set_connection_state(pAdapter, eConnectionState_NotConnected);
+	return result;
 }
 
 /**
@@ -8612,7 +8823,7 @@ static int __wlan_hdd_cfg80211_connect(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -8642,7 +8853,7 @@ static int __wlan_hdd_cfg80211_connect(struct wiphy *wiphy,
 	if (0 != status)
 		return status;
 	if (req->channel) {
-		if (!cds_allow_concurrency(pHddCtx,
+		if (!cds_allow_concurrency(
 				cds_convert_device_mode_to_hdd_type(
 				pAdapter->device_mode),
 				req->channel->hw_value, HW_MODE_20_MHZ)) {
@@ -8650,16 +8861,14 @@ static int __wlan_hdd_cfg80211_connect(struct wiphy *wiphy,
 			return -ECONNREFUSED;
 		}
 	} else {
-		if (!cds_allow_concurrency(pHddCtx,
+		if (!cds_allow_concurrency(
 				cds_convert_device_mode_to_hdd_type(
 				pAdapter->device_mode), 0, HW_MODE_20_MHZ)) {
 			hdd_err("This concurrency combination is not allowed");
 			return -ECONNREFUSED;
 		}
 	}
-#if defined(FEATURE_WLAN_LFR)
 	wlan_hdd_disable_roaming(pAdapter);
-#endif
 
 	/*Try disconnecting if already in connected state */
 	status = wlan_hdd_try_disconnect(pAdapter);
@@ -8749,10 +8958,14 @@ int wlan_hdd_disconnect(hdd_adapter_t *pAdapter, u16 reason)
 
 	status = sme_roam_disconnect(WLAN_HDD_GET_HAL_CTX(pAdapter),
 				     pAdapter->sessionId, reason);
+	/*
+	 * Wait here instead of returning directly, this will block the next
+	 * connect command and allow processing of the scan for ssid and
+	 * the previous connect command in CSR. Else we might hit some
+	 * race conditions leading to SME and HDD out of sync.
+	 */
 	if (CDF_STATUS_CMD_NOT_QUEUED == status) {
-		hddLog(LOG1, FL("status = %d, already disconnected"),
-		       (int)status);
-		goto disconnected;
+		hdd_info("Already disconnected or connect was in sme/roam pending list and removed by disconnect");
 	} else if (0 != status) {
 		hddLog(LOGE,
 			FL("csr_roam_disconnect failure, returned %d"),
@@ -8765,7 +8978,7 @@ int wlan_hdd_disconnect(hdd_adapter_t *pAdapter, u16 reason)
 					 msecs_to_jiffies
 						 (WLAN_WAIT_TIME_DISCONNECT));
 
-	if (!rc) {
+	if (!rc && (CDF_STATUS_CMD_NOT_QUEUED != status)) {
 		hddLog(LOGE,
 			FL("Failed to disconnect, timed out"));
 		result = -ETIMEDOUT;
@@ -8873,7 +9086,7 @@ static int __wlan_hdd_cfg80211_disconnect(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -8930,7 +9143,6 @@ static int __wlan_hdd_cfg80211_disconnect(struct wiphy *wiphy,
 		hddLog(LOG1,
 			FL("convert to internal reason %d to reasonCode %d"),
 			reason, reasonCode);
-		pHddStaCtx->conn_info.connState = eConnectionState_NotConnected;
 		pScanInfo = &pAdapter->scan_info;
 		if (pScanInfo->mScanPending) {
 			hddLog(LOG1,
@@ -9108,7 +9320,7 @@ static int __wlan_hdd_cfg80211_join_ibss(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -9126,11 +9338,7 @@ static int __wlan_hdd_cfg80211_join_ibss(struct wiphy *wiphy,
 		return status;
 
 	if (NULL !=
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
 		params->chandef.chan)
-#else
-		params->channel)
-#endif
 	{
 		uint32_t numChans = WNI_CFG_VALID_CHANNEL_LIST_LEN;
 		uint8_t validChan[WNI_CFG_VALID_CHANNEL_LIST_LEN];
@@ -9139,16 +9347,10 @@ static int __wlan_hdd_cfg80211_join_ibss(struct wiphy *wiphy,
 
 		/* Get channel number */
 		channelNum = ieee80211_frequency_to_channel(
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
 			params->
 			chandef.
 			chan->
 			center_freq);
-#else
-			params->
-			channel->
-			center_freq);
-#endif
 
 		if (0 != sme_cfg_get_str(hHal, WNI_CFG_VALID_CHANNEL_LIST,
 					 validChan, &numChans)) {
@@ -9168,7 +9370,7 @@ static int __wlan_hdd_cfg80211_join_ibss(struct wiphy *wiphy,
 		}
 	}
 
-	if (!cds_allow_concurrency(pHddCtx, CDS_IBSS_MODE, channelNum,
+	if (!cds_allow_concurrency(CDS_IBSS_MODE, channelNum,
 		HW_MODE_20_MHZ)) {
 		hdd_err("This concurrency combination is not allowed");
 		return -ECONNREFUSED;
@@ -9325,10 +9527,11 @@ static int __wlan_hdd_cfg80211_leave_ibss(struct wiphy *wiphy,
 	hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
 	int status;
 	CDF_STATUS hal_status;
+	unsigned long rc;
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -9369,6 +9572,18 @@ static int __wlan_hdd_cfg80211_leave_ibss(struct wiphy *wiphy,
 		       hal_status);
 		return -EAGAIN;
 	}
+
+	/* wait for mc thread to cleanup and then return to upper stack
+	 * so by the time upper layer calls the change interface, we are
+	 * all set to proceed further
+	 */
+	rc = wait_for_completion_timeout(&pAdapter->disconnect_comp_var,
+			msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
+	if (!rc) {
+		hdd_err("Failed to disconnect, timed out");
+		return -ETIMEDOUT;
+	}
+
 	EXIT();
 	return 0;
 }
@@ -9413,7 +9628,7 @@ static int __wlan_hdd_cfg80211_set_wiphy_params(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -9570,7 +9785,6 @@ static int wlan_hdd_set_default_mgmt_key(struct wiphy *wiphy,
 	return ret;
 }
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
 /**
  * __wlan_hdd_set_txq_params() - dummy implementation of set tx queue params
  * @wiphy: Pointer to wiphy
@@ -9586,21 +9800,6 @@ static int __wlan_hdd_set_txq_params(struct wiphy *wiphy,
 	ENTER();
 	return 0;
 }
-#else
-/**
- * __wlan_hdd_set_txq_params() - dummy implementation of set tx queue params
- * @wiphy: Pointer to wiphy
- * @params: Pointer to tx queue parameters
- *
- * Return: 0
- */
-static int __wlan_hdd_set_txq_params(struct wiphy *wiphy,
-				   struct ieee80211_txq_params *params)
-{
-	ENTER();
-	return 0;
-}
-#endif /* LINUX_VERSION_CODE */
 
 /**
  * wlan_hdd_set_txq_params() - SSR wrapper for wlan_hdd_set_txq_params
@@ -9610,7 +9809,6 @@ static int __wlan_hdd_set_txq_params(struct wiphy *wiphy,
  *
  * Return: 0 on success, error number on failure
  */
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WITH_BACKPORTS)
 static int wlan_hdd_set_txq_params(struct wiphy *wiphy,
 				   struct net_device *dev,
 				   struct ieee80211_txq_params *params)
@@ -9623,19 +9821,6 @@ static int wlan_hdd_set_txq_params(struct wiphy *wiphy,
 
 	return ret;
 }
-#else
-static int wlan_hdd_set_txq_params(struct wiphy *wiphy,
-				   struct ieee80211_txq_params *params)
-{
-	int ret;
-
-	cds_ssr_protect(__func__);
-	ret = __wlan_hdd_set_txq_params(wiphy, params);
-	cds_ssr_unprotect(__func__);
-
-	return ret;
-}
-#endif /* LINUX_VERSION_CODE */
 
 /**
  * __wlan_hdd_cfg80211_del_station() - delete station v2
@@ -9659,7 +9844,7 @@ int __wlan_hdd_cfg80211_del_station(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -9695,7 +9880,7 @@ int __wlan_hdd_cfg80211_del_station(struct wiphy *wiphy,
 						mac,
 						pAdapter->aStaInfo[i].
 							macAddrSTA.bytes,
-						ETHER_ADDR_LEN);
+						CDF_MAC_ADDR_SIZE);
 					if (hdd_ipa_uc_is_enabled(pHddCtx)) {
 						hdd_ipa_wlan_evt(pAdapter,
 							pAdapter->
@@ -9879,7 +10064,7 @@ static int __wlan_hdd_cfg80211_add_station(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -9937,7 +10122,6 @@ static int wlan_hdd_cfg80211_add_station(struct wiphy *wiphy,
 	return ret;
 }
 
-#ifdef FEATURE_WLAN_LFR
 /**
  * __wlan_hdd_cfg80211_set_pmksa() - set pmksa
  * @wiphy: Pointer to wiphy
@@ -9959,7 +10143,7 @@ static int __wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -9985,7 +10169,7 @@ static int __wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy,
 
 	halHandle = WLAN_HDD_GET_HAL_CTX(pAdapter);
 
-	cdf_mem_copy(pmk_id.BSSID.bytes, pmksa->bssid, ETHER_ADDR_LEN);
+	cdf_mem_copy(pmk_id.BSSID.bytes, pmksa->bssid, CDF_MAC_ADDR_SIZE);
 	cdf_mem_copy(pmk_id.PMKID, pmksa->pmkid, CSR_RSN_PMKID_SIZE);
 
 	/* Add to the PMKSA ID Cache in CSR */
@@ -10040,7 +10224,7 @@ static int __wlan_hdd_cfg80211_del_pmksa(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -10120,7 +10304,7 @@ static int __wlan_hdd_cfg80211_flush_pmksa(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -10165,7 +10349,6 @@ static int wlan_hdd_cfg80211_flush_pmksa(struct wiphy *wiphy,
 
 	return ret;
 }
-#endif
 
 #if defined(WLAN_FEATURE_VOWIFI_11R) && defined(KERNEL_SUPPORT_11R_CFG80211)
 /**
@@ -10192,7 +10375,7 @@ __wlan_hdd_cfg80211_update_ft_ies(struct wiphy *wiphy,
 	if (status)
 		return status;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -10325,7 +10508,7 @@ int __wlan_hdd_cfg80211_set_rekey_data(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -10437,7 +10620,7 @@ static int __wlan_hdd_cfg80211_set_mac_acl(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -10829,7 +11012,7 @@ __wlan_hdd_cfg80211_set_ap_channel_width(struct wiphy *wiphy,
 	tSmeConfigParams sme_config;
 	bool cbModeChange;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -10939,6 +11122,7 @@ static int __wlan_hdd_cfg80211_channel_switch(struct wiphy *wiphy,
 	uint8_t channel;
 	uint16_t freq;
 	int ret;
+	phy_ch_width ch_width;
 
 	hddLog(LOG1, FL("Set Freq %d"),
 		  csa_params->chandef.chan->center_freq);
@@ -10956,7 +11140,9 @@ static int __wlan_hdd_cfg80211_channel_switch(struct wiphy *wiphy,
 	freq = csa_params->chandef.chan->center_freq;
 	channel = cds_freq_to_chan(freq);
 
-	ret = hdd_softap_set_channel_change(dev, channel);
+	ch_width = hdd_map_nl_chan_width(csa_params->chandef.width);
+
+	ret = hdd_softap_set_channel_change(dev, channel, ch_width);
 	return ret;
 }
 
@@ -11080,15 +11266,9 @@ static struct cfg80211_ops wlan_hdd_cfg80211_ops = {
 	.del_virtual_intf = wlan_hdd_del_virtual_intf,
 	.change_virtual_intf = wlan_hdd_cfg80211_change_iface,
 	.change_station = wlan_hdd_change_station,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
-	.add_beacon = wlan_hdd_cfg80211_add_beacon,
-	.del_beacon = wlan_hdd_cfg80211_del_beacon,
-	.set_beacon = wlan_hdd_cfg80211_set_beacon,
-#else
 	.start_ap = wlan_hdd_cfg80211_start_ap,
 	.change_beacon = wlan_hdd_cfg80211_change_beacon,
 	.stop_ap = wlan_hdd_cfg80211_stop_ap,
-#endif
 	.change_bss = wlan_hdd_cfg80211_change_bss,
 	.add_key = wlan_hdd_cfg80211_add_key,
 	.get_key = wlan_hdd_cfg80211_get_key,
@@ -11112,11 +11292,9 @@ static struct cfg80211_ops wlan_hdd_cfg80211_ops = {
 	.set_power_mgmt = wlan_hdd_cfg80211_set_power_mgmt,
 	.del_station = wlan_hdd_cfg80211_del_station,
 	.add_station = wlan_hdd_cfg80211_add_station,
-#ifdef FEATURE_WLAN_LFR
 	.set_pmksa = wlan_hdd_cfg80211_set_pmksa,
 	.del_pmksa = wlan_hdd_cfg80211_del_pmksa,
 	.flush_pmksa = wlan_hdd_cfg80211_flush_pmksa,
-#endif
 #if defined(WLAN_FEATURE_VOWIFI_11R) && defined(KERNEL_SUPPORT_11R_CFG80211)
 	.update_ft_ies = wlan_hdd_cfg80211_update_ft_ies,
 #endif
diff --git a/core/hdd/src/wlan_hdd_cfg80211.h b/core/hdd/src/wlan_hdd_cfg80211.h
index 34275409f0bd..c830c06aa0ed 100644
--- a/core/hdd/src/wlan_hdd_cfg80211.h
+++ b/core/hdd/src/wlan_hdd_cfg80211.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -249,6 +249,9 @@ typedef enum {
  * @QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN: venodr scan command
  * @QCA_NL80211_VENDOR_SUBCMD_SCAN_DONE: vendor scan complete
  * @QCA_NL80211_VENDOR_SUBCMD_OTA_TEST: enable OTA test
+ * @QCA_NL80211_VENDOR_SUBCMD_GW_PARAM_CONFIG: set gateway parameters
+ * @QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE: set tx power by percentage
+ * @QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB: reduce tx power by DB
  */
 
 enum qca_nl80211_vendor_subcmds {
@@ -350,6 +353,8 @@ enum qca_nl80211_vendor_subcmds {
 
 	/* subcommand to get link properties */
 	QCA_NL80211_VENDOR_SUBCMD_LINK_PROPERTIES = 101,
+	/* LFR Subnet Detection */
+	QCA_NL80211_VENDOR_SUBCMD_GW_PARAM_CONFIG = 102,
 
 	/* DBS subcommands */
 	QCA_NL80211_VENDOR_SUBCMD_GET_PREFERRED_FREQ_LIST = 103,
@@ -361,6 +366,10 @@ enum qca_nl80211_vendor_subcmds {
 
 	/* OTA test subcommand */
 	QCA_NL80211_VENDOR_SUBCMD_OTA_TEST = 108,
+	/* Tx power scaling subcommands */
+	QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE = 109,
+	/* Tx power scaling in db subcommands */
+	QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB = 115,
 
 };
 
@@ -420,6 +429,8 @@ enum qca_nl80211_vendor_subcmds {
  * @QCA_NL80211_VENDOR_SUBCMD_SCAN_INDEX: vendor scan index
  * @QCA_NL80211_VENDOR_SUBCMD_SCAN_DONE_INDEX:
  *	vendor scan complete event  index
+ * @QCA_NL80211_VENDOR_SUBCMD_GW_PARAM_CONFIG_INDEX:
+ *	update gateway parameters index
  */
 
 enum qca_nl80211_vendor_subcmds_index {
@@ -488,6 +499,7 @@ enum qca_nl80211_vendor_subcmds_index {
 	QCA_NL80211_VENDOR_SUBCMD_DCC_STATS_EVENT_INDEX,
 	QCA_NL80211_VENDOR_SUBCMD_SCAN_INDEX,
 	QCA_NL80211_VENDOR_SUBCMD_SCAN_DONE_INDEX,
+	QCA_NL80211_VENDOR_SUBCMD_GW_PARAM_CONFIG_INDEX,
 };
 
 /**
@@ -1548,6 +1560,7 @@ enum qca_wlan_vendor_attr_set_no_dfs_flag {
  * @QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_KEY_REPLAY_CTR: Replay Counter
  * @QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KCK: KCK of the PTK
  * @QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KEK: KEK of the PTK
+ * @QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_SUBNET_STATUS: subnet change status
  */
 enum qca_wlan_vendor_attr_roam_auth {
 	QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_INVALID = 0,
@@ -1558,6 +1571,7 @@ enum qca_wlan_vendor_attr_roam_auth {
 	QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_KEY_REPLAY_CTR,
 	QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KCK,
 	QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KEK,
+	QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_SUBNET_STATUS,
 	QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_AFTER_LAST,
 	QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_MAX =
 		QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_AFTER_LAST - 1
@@ -2166,6 +2180,23 @@ enum qca_vendor_attr_probable_oper_channel {
 };
 
 /**
+ * enum qca_wlan_vendor_attr_gw_param_config - gateway param config
+ * @QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_INVALID: Invalid
+ * @QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_GW_MAC_ADDR: gateway mac addr
+ * @QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_IPV4_ADDR: ipv4 addr
+ * @QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_IPV6_ADDR: ipv6 addr
+ */
+enum qca_wlan_vendor_attr_gw_param_config {
+	QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_INVALID = 0,
+	QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_GW_MAC_ADDR,
+	QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_IPV4_ADDR,
+	QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_IPV6_ADDR,
+	QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_MAX =
+		QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_AFTER_LAST - 1,
+};
+
+/**
  * enum drv_dbs_capability - DBS capability
  * @DRV_DBS_CAPABILITY_DISABLED: DBS disabled
  * @DRV_DBS_CAPABILITY_1X1: 1x1
@@ -2194,14 +2225,45 @@ enum qca_vendor_attr_ota_test {
 	QCA_WLAN_VENDOR_ATTR_OTA_TEST_AFTER_LAST - 1
 };
 
+/** enum qca_vendor_attr_txpower_scale - vendor sub commands index
+ * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_INVALID: invalid value
+ * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE: scaling value
+ * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_AFTER_LAST: last value
+ * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_MAX: max value
+ */
+enum qca_vendor_attr_txpower_scale {
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_INVALID,
+	/* 8-bit unsigned value to indicate the scaling of tx power */
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE,
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_MAX =
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_AFTER_LAST - 1
+};
+
+/**
+ * enum qca_vendor_attr_txpower_scale_decr_db - vendor sub commands index
+ * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_INVALID: invalid value
+ * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB: scaling value
+ * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_AFTER_LAST: last value
+ * @QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_MAX: max value
+ */
+enum qca_vendor_attr_txpower_scale_decr_db {
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_INVALID,
+	/* 8-bit unsigned value to indicate the scaling of tx power */
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB,
+	/* keep last */
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_AFTER_LAST,
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_MAX =
+	QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB_AFTER_LAST - 1
+};
+
 struct cfg80211_bss *wlan_hdd_cfg80211_update_bss_db(hdd_adapter_t *pAdapter,
 						tCsrRoamInfo *pRoamInfo);
 
-#ifdef FEATURE_WLAN_LFR
 int wlan_hdd_cfg80211_pmksa_candidate_notify(hdd_adapter_t *pAdapter,
 					tCsrRoamInfo *pRoamInfo,
 					int index, bool preauth);
-#endif
 
 #ifdef FEATURE_WLAN_LFR_METRICS
 CDF_STATUS wlan_hdd_cfg80211_roam_metrics_preauth(hdd_adapter_t *pAdapter,
@@ -2222,12 +2284,9 @@ void wlan_hdd_cfg80211_set_key_wapi(hdd_adapter_t *pAdapter, uint8_t key_index,
 				    const uint8_t *mac_addr, const uint8_t *key,
 				    int key_Len);
 #endif
-struct wiphy *wlan_hdd_cfg80211_wiphy_alloc(int priv_size);
+hdd_context_t *hdd_cfg80211_wiphy_alloc(int priv_size);
 
 int wlan_hdd_cfg80211_scan(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-			   struct net_device *dev,
-#endif
 			   struct cfg80211_scan_request *request);
 
 int wlan_hdd_cfg80211_init(struct device *dev,
@@ -2240,13 +2299,8 @@ void wlan_hdd_cfg80211_register_frames(hdd_adapter_t *pAdapter);
 
 void wlan_hdd_cfg80211_deregister_frames(hdd_adapter_t *pAdapter);
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
 void hdd_reg_notifier(struct wiphy *wiphy,
 				 struct regulatory_request *request);
-#else
-int hdd_reg_notifier(struct wiphy *wiphy,
-				struct regulatory_request *request);
-#endif
 
 extern void hdd_conn_set_connection_state(hdd_adapter_t *pAdapter,
 					  eConnectionState connState);
diff --git a/core/hdd/src/wlan_hdd_conc_ut.c b/core/hdd/src/wlan_hdd_conc_ut.c
index 8ed71dd2338f..56470105971e 100644
--- a/core/hdd/src/wlan_hdd_conc_ut.c
+++ b/core/hdd/src/wlan_hdd_conc_ut.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c)2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -633,7 +633,7 @@ void wlan_hdd_one_connection_scenario(hdd_context_t *hdd_ctx)
 	CDF_STATUS ret;
 
 	/* flush the entire table first */
-	ret = cds_init_policy_mgr(hdd_ctx);
+	ret = cds_init_policy_mgr();
 	if (!CDF_IS_STATUS_SUCCESS(ret)) {
 		hdd_err("Policy manager initialization failed");
 		return;
@@ -641,7 +641,7 @@ void wlan_hdd_one_connection_scenario(hdd_context_t *hdd_ctx)
 
 	for (sub_type = 0; sub_type < CDS_MAX_NUM_OF_MODE; sub_type++) {
 		/* validate one connection is created or no */
-		if (cds_get_connection_count(hdd_ctx) != 0) {
+		if (cds_get_connection_count() != 0) {
 			hddLog(LOGE,
 				FL("Test failed - No. of connection is not 0"));
 			return;
@@ -651,7 +651,7 @@ void wlan_hdd_one_connection_scenario(hdd_context_t *hdd_ctx)
 		pcl_type = get_pcl_from_first_conn_table(sub_type, system_pref);
 
 		/* check PCL value for second connection is correct or no */
-		cds_get_pcl(hdd_ctx, sub_type, pcl, &pcl_len);
+		cds_get_pcl(sub_type, pcl, &pcl_len);
 		status = wlan_hdd_validate_pcl(hdd_ctx,
 				pcl_type, pcl, pcl_len, 0, 0,
 				reason, sizeof(reason));
@@ -688,7 +688,7 @@ void wlan_hdd_two_connections_scenario(hdd_context_t *hdd_ctx,
 		type = wlan_hdd_valid_type_of_persona(sub_type);
 
 		/* flush the entire table first */
-		ret = cds_init_policy_mgr(hdd_ctx);
+		ret = cds_init_policy_mgr();
 		if (!CDF_IS_STATUS_SUCCESS(ret)) {
 			hdd_err("Policy manager initialization failed");
 			return;
@@ -697,11 +697,11 @@ void wlan_hdd_two_connections_scenario(hdd_context_t *hdd_ctx,
 		/* sub_type mapping between HDD and WMA are different */
 		wlan_hdd_map_subtypes_hdd_wma(&dummy_type, &sub_type);
 		/* add first connection as STA */
-		cds_incr_connection_count_utfw(hdd_ctx, vdevid, tx_stream,
+		cds_incr_connection_count_utfw(vdevid, tx_stream,
 				rx_stream, chain_mask, type, dummy_type,
 				channel_id, mac_id);
 		/* validate one connection is created or no */
-		if (cds_get_connection_count(hdd_ctx) != 1) {
+		if (cds_get_connection_count() != 1) {
 			hddLog(LOGE,
 				FL("Test failed - No. of connection is not 1"));
 			return;
@@ -710,8 +710,7 @@ void wlan_hdd_two_connections_scenario(hdd_context_t *hdd_ctx,
 		while (next_sub_type < CDS_MAX_NUM_OF_MODE) {
 			/* get the PCL value & check the channels accordingly */
 			second_index =
-				cds_get_second_connection_pcl_table_index(
-						hdd_ctx);
+				cds_get_second_connection_pcl_table_index();
 			if (CDS_MAX_ONE_CONNECTION_MODE == second_index) {
 				/* not valid combination*/
 				hddLog(LOGE, FL("couldn't find index for 2nd connection pcl table"));
@@ -724,7 +723,7 @@ void wlan_hdd_two_connections_scenario(hdd_context_t *hdd_ctx,
 					next_sub_type, system_pref,
 					wma_is_hw_dbs_capable());
 			/* check PCL for second connection is correct or no */
-			cds_get_pcl(hdd_ctx, next_sub_type, pcl, &pcl_len);
+			cds_get_pcl(next_sub_type, pcl, &pcl_len);
 			status = wlan_hdd_validate_pcl(hdd_ctx,
 					pcl_type, pcl, pcl_len, channel_id, 0,
 					reason, sizeof(reason));
@@ -787,7 +786,7 @@ void wlan_hdd_three_connections_scenario(hdd_context_t *hdd_ctx,
 
 		type_1 = wlan_hdd_valid_type_of_persona(sub_type_1);
 		/* flush the entire table first */
-		ret = cds_init_policy_mgr(hdd_ctx);
+		ret = cds_init_policy_mgr();
 		if (!CDF_IS_STATUS_SUCCESS(ret)) {
 			hdd_err("Policy manager initialization failed");
 			return;
@@ -796,11 +795,11 @@ void wlan_hdd_three_connections_scenario(hdd_context_t *hdd_ctx,
 		/* sub_type mapping between HDD and WMA are different */
 		wlan_hdd_map_subtypes_hdd_wma(&dummy_type_1, &sub_type_1);
 		/* add first connection as STA */
-		cds_incr_connection_count_utfw(hdd_ctx, vdevid_1,
+		cds_incr_connection_count_utfw(vdevid_1,
 			tx_stream_1, rx_stream_1, chain_mask_1, type_1,
 			dummy_type_1, channel_id_1, mac_id_1);
 		/* validate one connection is created or no */
-		if (cds_get_connection_count(hdd_ctx) != 1) {
+		if (cds_get_connection_count() != 1) {
 			hddLog(LOGE,
 				FL("Test fail - No. of connection not 1"));
 			return;
@@ -812,11 +811,11 @@ void wlan_hdd_three_connections_scenario(hdd_context_t *hdd_ctx,
 			/* sub_type mapping between HDD and WMA are different */
 			wlan_hdd_map_subtypes_hdd_wma(&dummy_type_2,
 					&sub_type_2);
-			cds_incr_connection_count_utfw(hdd_ctx, vdevid_2,
+			cds_incr_connection_count_utfw(vdevid_2,
 				tx_stream_2, rx_stream_2, chain_mask_2, type_2,
 				dummy_type_2, channel_id_2, mac_id_2);
 			/* validate two connections are created or no */
-			if (cds_get_connection_count(hdd_ctx) != 2) {
+			if (cds_get_connection_count() != 2) {
 				hddLog(LOGE,
 					FL("Test fail - No. connection not 2"));
 				return;
@@ -824,8 +823,7 @@ void wlan_hdd_three_connections_scenario(hdd_context_t *hdd_ctx,
 			next_sub_type = CDS_STA_MODE;
 			while (next_sub_type < CDS_MAX_NUM_OF_MODE) {
 				third_index =
-				  cds_get_third_connection_pcl_table_index(
-								hdd_ctx);
+				  cds_get_third_connection_pcl_table_index();
 				if (CDS_MAX_TWO_CONNECTION_MODE ==
 						third_index) {
 					/* not valid combination */
@@ -839,7 +837,7 @@ void wlan_hdd_three_connections_scenario(hdd_context_t *hdd_ctx,
 					   third_index, next_sub_type,
 					   system_pref,
 					   wma_is_hw_dbs_capable());
-				cds_get_pcl(hdd_ctx, next_sub_type,
+				cds_get_pcl(next_sub_type,
 						pcl, &pcl_len);
 				status = wlan_hdd_validate_pcl(hdd_ctx,
 						pcl_type, pcl, pcl_len,
@@ -858,7 +856,7 @@ void wlan_hdd_three_connections_scenario(hdd_context_t *hdd_ctx,
 				next_sub_type++;
 			}
 			/* remove entry to make a room for next iteration */
-			cds_decr_connection_count(hdd_ctx, vdevid_2);
+			cds_decr_connection_count(vdevid_2);
 		}
 		next_sub_type = CDS_STA_MODE;
 	}
diff --git a/core/hdd/src/wlan_hdd_driver_ops.c b/core/hdd/src/wlan_hdd_driver_ops.c
index 1460850dc538..0627f9e7ae50 100644
--- a/core/hdd/src/wlan_hdd_driver_ops.c
+++ b/core/hdd/src/wlan_hdd_driver_ops.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -25,6 +25,9 @@
  * to the Linux Foundation.
  */
 
+/* denote that this file does not allow legacy hddLog */
+#define HDD_DISALLOW_LEGACY_HDDLOG 1
+
 #include <linux/platform_device.h>
 #include <linux/pci.h>
 #ifdef HIF_PCI
@@ -40,6 +43,7 @@
 #include "cds_sched.h"
 #include "osdep.h"
 #include "hif.h"
+#include "htc.h"
 #include "epping_main.h"
 #include "wlan_hdd_main.h"
 #include "wlan_hdd_power.h"
@@ -47,6 +51,7 @@
 #include "wma_api.h"
 #include "wlan_hdd_napi.h"
 #include "cds_concurrency.h"
+#include "qwlan_version.h"
 
 #ifdef MODULE
 #define WLAN_MODULE_NAME  module_name(THIS_MODULE)
@@ -72,6 +77,112 @@
 #define WLAN_HDD_UNREGISTER_DRIVER(wlan_drv_ops) \
 	icnss_unregister_driver(wlan_drv_ops)
 #endif /* HIF_PCI */
+#define DISABLE_KRAIT_IDLE_PS_VAL	1
+
+/*
+ * In BMI Phase we are only sending small chunk (256 bytes) of the FW image at
+ * a time, and wait for the completion interrupt to start the next transfer.
+ * During this phase, the KRAIT is entering IDLE/StandAlone(SA) Power Save(PS).
+ * The delay incurred for resuming from IDLE/SA PS is huge during driver load.
+ * So prevent APPS IDLE/SA PS durint driver load for reducing interrupt latency.
+ */
+#ifdef CONFIG_CNSS
+static inline void hdd_request_pm_qos(int val)
+{
+	cnss_request_pm_qos(val);
+}
+
+static inline void hdd_remove_pm_qos(void)
+{
+	cnss_remove_pm_qos();
+}
+#else
+static inline void hdd_request_pm_qos(int val)
+{
+}
+
+static inline void hdd_remove_pm_qos(void)
+{
+}
+#endif
+
+/**
+ * hdd_hif_open() - HIF open helper
+ * @dev: wlan device structure
+ * @bdev: bus device structure
+ * @bid: bus identifier for shared busses
+ * @bus_type: underlying bus type
+ * @reinit: true if we are reinitializing the driver during recovery phase
+ *
+ * This function brings-up HIF layer during load/recovery phase.
+ *
+ * Return: 0 on success and errno on failure.
+ */
+static int hdd_hif_open(struct device *dev, void *bdev, const hif_bus_id *bid,
+			enum ath_hal_bus_type bus_type, bool reinit)
+{
+	CDF_STATUS status;
+	int ret = 0;
+	void *hif_ctx;
+
+	status = hif_open(bus_type);
+	if (!CDF_IS_STATUS_SUCCESS(status)) {
+		hdd_err("hif_open error = %d", status);
+		return cdf_status_to_os_return(status);
+	}
+
+	hif_ctx = cds_get_context(CDF_MODULE_ID_HIF);
+
+	ret = hdd_napi_create();
+	if (hdd_napi_enabled(HDD_NAPI_ANY)) {
+		hdd_info("hdd_napi_create returned: %d", status);
+		if (ret <= 0) {
+			hdd_err("NAPI creation error, rc: 0x%x, reinit = %d",
+				status, reinit);
+			ret = -EFAULT;
+			goto err_hif_close;
+		}
+	}
+
+	status = hif_enable(hif_ctx, dev, bdev, bid, bus_type,
+			    (reinit == true) ?  HIF_ENABLE_TYPE_REINIT :
+			    HIF_ENABLE_TYPE_PROBE);
+	if (!CDF_IS_STATUS_SUCCESS(status)) {
+		hdd_err("hif_enable error = %d, reinit = %d",
+			status, reinit);
+		ret = cdf_status_to_os_return(status);
+		goto err_napi_destroy;
+	}
+
+	return 0;
+
+err_napi_destroy:
+	hdd_napi_destroy(true);
+
+err_hif_close:
+	hif_close(hif_ctx);
+
+	return ret;
+
+}
+
+/**
+ * hdd_hif_close() - HIF close helper
+ * @hif_ctx:	HIF context
+ *
+ * Helper function to close HIF
+ */
+static void hdd_hif_close(void *hif_ctx)
+{
+	if (hif_ctx == NULL)
+		return;
+
+	hif_disable(hif_ctx, HIF_DISABLE_TYPE_REMOVE);
+
+	hdd_napi_destroy(true);
+
+	hif_close(hif_ctx);
+}
 
 /**
  * wlan_hdd_probe() - handles probe request
@@ -91,72 +202,90 @@ static int wlan_hdd_probe(struct device *dev, void *bdev, const hif_bus_id *bid,
 {
 	void *hif_ctx;
 	CDF_STATUS status;
-	int ret;
+	int ret = 0;
+
+	pr_info("%s: %sprobing driver v%s\n", WLAN_MODULE_NAME,
+		reinit ? "re-" : "", QWLAN_VERSIONSTR);
+
+	hdd_prevent_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_INIT);
+
+	/*
+	* The Krait is going to Idle/Stand Alone Power Save
+	* more aggressively which is resulting in the longer driver load time.
+	* The Fix is to not allow Krait to enter Idle Power Save during driver
+	* load.
+	*/
+	hdd_request_pm_qos(DISABLE_KRAIT_IDLE_PS_VAL);
+
+	if (reinit) {
+		cds_set_recovery_in_progress(true);
+	} else {
+		ret = hdd_init();
+
+		if (ret)
+			goto out;
+		cds_set_load_in_progress(true);
+	}
 
 	if (WLAN_IS_EPPING_ENABLED(cds_get_conparam())) {
 		status = epping_open();
 		if (status != CDF_STATUS_SUCCESS)
-			return status;
+			goto err_hdd_deinit;
 	}
 
-	status = hif_open();
-	if (status != CDF_STATUS_SUCCESS) {
-		hddLog(LOGE, FL("hif_open error = %d"), status);
-		return -EFAULT;
-	}
-	hif_ctx = cds_get_context(CDF_MODULE_ID_HIF);
-	if (reinit)
-		hdd_napi_destroy(true);
-	status = hdd_napi_create();
-	if (hdd_napi_enabled(HDD_NAPI_ANY)) {
-		hdd_info("hdd_napi_create returned: %d\n", status);
-		if (status <= 0) {
-			hdd_err("NAPI creation error, rc: 0x%x, reinit = %d",
-			status, reinit);
-			ret = -EFAULT;
-			goto end;
-		}
-	}
+	ret = hdd_hif_open(dev, bdev, bid, bus_type, reinit);
 
-	status = hif_enable(hif_ctx, dev, bdev, bid,
-				bus_type, (reinit == true) ?
-				HIF_ENABLE_TYPE_REINIT : HIF_ENABLE_TYPE_PROBE);
-	if (status != CDF_STATUS_SUCCESS) {
-		hdd_err("hif_enable error = %d, reinit = %d",
-			status, reinit);
-		ret = -EIO;
-		goto end;
-	}
+	if (ret)
+		goto err_epping_close;
+
+	hif_ctx = cds_get_context(CDF_MODULE_ID_HIF);
 
 	if (reinit)
 		ret = hdd_wlan_re_init(hif_ctx);
 	else
 		ret = hdd_wlan_startup(dev, hif_ctx);
 
-end:
-	if (ret) {
-		if (WLAN_IS_EPPING_ENABLED(cds_get_conparam())) {
-			hif_pktlogmod_exit(hif_ctx);
-			epping_disable();
-			htc_destroy(cds_get_context(CDF_MODULE_ID_HTC));
-			hif_disable(hif_ctx, (reinit == true) ?
-				HIF_ENABLE_TYPE_REINIT : HIF_ENABLE_TYPE_PROBE);
-			cds_free_context(NULL, CDF_MODULE_ID_HTC, NULL);
-			epping_close();
-		} else {
-			hif_pktlogmod_exit(hif_ctx);
-			__hdd_wlan_exit();
-			hif_disable(hif_ctx, HIF_DISABLE_TYPE_REMOVE);
-		}
-		hif_close(hif_ctx);
+	if (ret)
+		goto err_hif_close;
+
+	hif_enable_power_management(hif_ctx);
+
+	if (reinit) {
+		cds_set_recovery_in_progress(false);
+	} else {
+		cds_set_load_in_progress(false);
+		cds_set_driver_loaded(true);
 	}
 
-	if (reinit)
-		cds_set_logp_in_progress(false);
+	hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_INIT);
+	hdd_remove_pm_qos();
 
+	return 0;
+
+err_hif_close:
+	hdd_hif_close(hif_ctx);
+err_epping_close:
+	if (WLAN_IS_EPPING_ENABLED(cds_get_conparam()))
+		epping_close();
+err_hdd_deinit:
+	cds_set_load_in_progress(false);
+	hdd_deinit();
+out:
+	hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_INIT);
+	hdd_remove_pm_qos();
 	return ret;
 }
 
+#ifdef CONFIG_CNSS
+static inline void hdd_cnss_driver_unloading(void)
+{
+	cnss_set_driver_status(CNSS_LOAD_UNLOAD);
+}
+#else
+static inline void hdd_cnss_driver_unloading(void) { }
+#endif
+
+
 /**
  * wlan_hdd_remove() - wlan_hdd_remove
  *
@@ -168,38 +297,41 @@ end:
 static void wlan_hdd_remove(void)
 {
 	void *hif_ctx;
-	v_CONTEXT_t p_cds_context = NULL;
 
-	/* Get the global cds context */
-	p_cds_context = cds_get_global_context();
+	pr_info("%s: Removing driver v%s\n", WLAN_MODULE_NAME,
+		QWLAN_VERSIONSTR);
+
+	/* Wait for recovery to complete */
+	while (cds_is_driver_recovering()) {
+		hdd_alert("Recovery in progress; wait here!!!");
+		msleep(1000);
+	}
+
+	cds_set_driver_loaded(false);
+	cds_set_unload_in_progress(true);
+
+	if (!cds_wait_for_external_threads_completion(__func__))
+		hdd_err("External threads are still active attempting driver unload anyway");
+
+	hdd_cnss_driver_unloading();
 
 	hif_ctx = cds_get_context(CDF_MODULE_ID_HIF);
 
+	hif_disable_power_management(hif_ctx);
+	hif_pktlogmod_exit(hif_ctx);
+
 	if (WLAN_IS_EPPING_ENABLED(cds_get_conparam())) {
-		hif_pktlogmod_exit(hif_ctx);
 		epping_disable();
-		htc_destroy(cds_get_context(CDF_MODULE_ID_HTC));
-		hif_disable(hif_ctx, HIF_DISABLE_TYPE_REMOVE);
-		cds_free_context(NULL, CDF_MODULE_ID_HTC, NULL);
 		epping_close();
 	} else {
-		hif_pktlogmod_exit(hif_ctx);
 		__hdd_wlan_exit();
-		hif_disable(hif_ctx, HIF_DISABLE_TYPE_REMOVE);
 	}
 
-	hdd_napi_destroy(true);
-	hif_close(hif_ctx);
-
-	cds_free_global_context(&p_cds_context);
-
-#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
-	wlan_logging_sock_deinit_svc();
-#endif
+	hdd_hif_close(hif_ctx);
 
-	cdf_wake_lock_destroy(hdd_wlan_get_wake_lock_ptr());
+	hdd_deinit();
 
-	pr_info("%s: driver unloaded\n", WLAN_MODULE_NAME);
+	pr_info("%s: Driver Removed\n", WLAN_MODULE_NAME);
 }
 
 /**
@@ -214,29 +346,26 @@ static void wlan_hdd_shutdown(void)
 {
 	void *hif_ctx = cds_get_context(CDF_MODULE_ID_HIF);
 
-	if (cds_is_load_unload_in_progress()) {
-		hddLog(LOGE,
-			FL("Load/unload in progress, ignore SSR shutdown"));
+	if (cds_is_load_or_unload_in_progress()) {
+		hdd_err("Load/unload in progress, ignore SSR shutdown");
 		return;
 	}
 	/* this is for cases, where shutdown invoked from CNSS */
-	cds_set_logp_in_progress(true);
+	cds_set_recovery_in_progress(true);
 
-	if (cds_get_conparam() != CDF_FTM_MODE &&
+	if (cds_get_conparam() != CDF_GLOBAL_FTM_MODE &&
 	    !WLAN_IS_EPPING_ENABLED(cds_get_conparam()))
 		hif_pktlogmod_exit(hif_ctx);
 
-	if (!cds_is_ssr_ready(__func__))
-		hddLog(LOGE,
-			FL("Host is not ready for SSR, attempting anyway"));
+	if (!cds_wait_for_external_threads_completion(__func__))
+		hdd_err("Host is not ready for SSR, attempting anyway");
 
 	if (!WLAN_IS_EPPING_ENABLED(cds_get_conparam())) {
 		hif_disable_isr(hif_ctx);
 		hdd_wlan_shutdown();
 	}
 
-	hif_disable(hif_ctx, HIF_DISABLE_TYPE_SHUTDOWN);
-	hif_close(hif_ctx);
+	hdd_hif_close(hif_ctx);
 }
 
 /**
@@ -268,7 +397,7 @@ void wlan_hdd_notify_handler(int state)
 		int ret = 0;
 		ret = hdd_wlan_notify_modem_power_state(state);
 		if (ret < 0)
-			hddLog(LOGE, FL("Fail to send notify"));
+			hdd_err("Fail to send notify");
 	}
 }
 
@@ -364,7 +493,7 @@ static int __wlan_hdd_bus_resume(void)
 	int status = wlan_hdd_validate_context(hdd_ctx);
 
 	if (0 != status) {
-		hddLog(LOGE, FL("HDD context is not valid"));
+		hdd_err("HDD context is not valid");
 		return status;
 	}
 
@@ -400,6 +529,117 @@ static int wlan_hdd_bus_resume(void)
 	return ret;
 }
 
+#ifdef FEATURE_RUNTIME_PM
+/**
+ * __wlan_hdd_runtime_suspend() - suspend the wlan bus without apps suspend
+ *
+ * Each layer is responsible for its own suspend actions.  wma_runtime_suspend
+ * takes care of the parts of the 802.11 suspend that we want to do for runtime
+ * suspend.
+ *
+ * Return: 0 or errno
+ */
+static int __wlan_hdd_runtime_suspend(void)
+{
+	void *hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
+	int status = wlan_hdd_validate_context(hdd_ctx);
+
+	if (0 != status)
+		goto process_failure;
+
+	status = hif_pre_runtime_suspend();
+	if (status)
+		goto process_failure;
+
+	status = htc_runtime_suspend();
+	if (status)
+		goto process_failure;
+
+	status = wma_runtime_suspend();
+	if (status)
+		goto resume_htc;
+
+	status = hif_runtime_suspend();
+	if (status)
+		goto resume_wma;
+
+	status = cnss_auto_suspend();
+	if (status)
+		goto resume_hif;
+
+	hif_process_runtime_suspend_success();
+	return status;
+
+resume_hif:
+	CDF_BUG(!hif_runtime_resume());
+resume_wma:
+	CDF_BUG(!wma_runtime_resume());
+resume_htc:
+	CDF_BUG(!htc_runtime_resume());
+process_failure:
+	hif_process_runtime_suspend_failure();
+	return status;
+}
+
+
+/**
+ * wlan_hdd_runtime_suspend() - suspend the wlan bus without apps suspend
+ *
+ * This function is called by the platform driver to suspend the
+ * wlan bus separately from system suspend
+ *
+ * Return: 0 or errno
+ */
+static int wlan_hdd_runtime_suspend(void)
+{
+	int ret;
+
+	cds_ssr_protect(__func__);
+	ret = __wlan_hdd_runtime_suspend();
+	cds_ssr_unprotect(__func__);
+
+	return ret;
+}
+
+/**
+ * __wlan_hdd_runtime_resume() - resume the wlan bus from runtime suspend
+ *
+ * Sets the runtime pm state and coordinates resume between hif wma and
+ * ol_txrx.
+ *
+ * Return: success since failure is a bug
+ */
+static int __wlan_hdd_runtime_resume(void)
+{
+	hif_pre_runtime_resume();
+	CDF_BUG(!cnss_auto_resume());
+	CDF_BUG(!hif_runtime_resume());
+	CDF_BUG(!wma_runtime_resume());
+	CDF_BUG(!htc_runtime_resume());
+	hif_process_runtime_resume_success();
+	return 0;
+}
+
+/**
+ * wlan_hdd_runtime_resume() - resume the wlan bus from runtime suspend
+ *
+ * This function is called by the platform driver to resume the
+ * wlan bus separately from system suspend
+ *
+ * Return: success since failure is a bug
+ */
+static int wlan_hdd_runtime_resume(void)
+{
+	int ret;
+
+	cds_ssr_protect(__func__);
+	ret = __wlan_hdd_runtime_resume();
+	cds_ssr_unprotect(__func__);
+
+	return ret;
+}
+#endif
+
 #ifdef HIF_PCI
 /**
  * wlan_hdd_pci_probe() - probe callback for pci platform driver
@@ -494,6 +734,32 @@ static int wlan_hdd_pci_resume(struct pci_dev *pdev)
 {
 	return wlan_hdd_bus_resume();
 }
+
+#ifdef FEATURE_RUNTIME_PM
+/**
+ * wlan_hdd_pci_runtime_suspend() - wlan_hdd_pci_suspend
+ * @pdev: pdev
+ * @state: state
+ *
+ * Return: success or errno
+ */
+static int wlan_hdd_pci_runtime_suspend(struct pci_dev *pdev)
+{
+	return wlan_hdd_runtime_suspend();
+}
+
+/**
+ * wlan_hdd_pci_runtime_resume() - runtime resume callback to register with pci
+ * @pdev: pci device id
+ *
+ * Return: success or errno
+ */
+static int wlan_hdd_pci_runtime_resume(struct pci_dev *pdev)
+{
+	return wlan_hdd_runtime_resume();
+}
+#endif
+
 #else
 /**
  * wlan_hdd_snoc_probe() - wlan_hdd_snoc_probe
@@ -585,6 +851,14 @@ static struct pci_device_id wlan_hdd_pci_id_table[] = {
 };
 
 #ifdef CONFIG_CNSS
+
+#ifdef FEATURE_RUNTIME_PM
+struct cnss_wlan_runtime_ops runtime_pm_ops = {
+	.runtime_suspend = wlan_hdd_pci_runtime_suspend,
+	.runtime_resume = wlan_hdd_pci_runtime_resume,
+};
+#endif
+
 struct cnss_wlan_driver wlan_drv_ops = {
 	.name       = "wlan_hdd_pci",
 	.id_table   = wlan_hdd_pci_id_table,
@@ -598,6 +872,9 @@ struct cnss_wlan_driver wlan_drv_ops = {
 	.suspend    = wlan_hdd_pci_suspend,
 	.resume     = wlan_hdd_pci_resume,
 #endif /* ATH_BUS_PM */
+#ifdef FEATURE_RUNTIME_PM
+	.runtime_ops = &runtime_pm_ops,
+#endif
 };
 #else
 MODULE_DEVICE_TABLE(pci, wlan_hdd_pci_id_table);
@@ -610,6 +887,7 @@ struct pci_driver wlan_drv_ops = {
 	.suspend    = wlan_hdd_pci_suspend,
 	.resume     = wlan_hdd_pci_resume,
 #endif /* ATH_BUS_PM */
+
 };
 #endif /* CONFIG_CNSS */
 #else
diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c
index 4071f771848c..f33a6e20eab6 100644
--- a/core/hdd/src/wlan_hdd_ext_scan.c
+++ b/core/hdd/src/wlan_hdd_ext_scan.c
@@ -501,6 +501,9 @@ fail:
  * @ctx: Pointer to hdd context
  * @pData: Pointer to ext scan result event
  *
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
+ *
  * Return: none
  */
 static void
@@ -510,6 +513,7 @@ wlan_hdd_cfg80211_extscan_hotlist_match_ind(void *ctx,
 	hdd_context_t *pHddCtx = ctx;
 	struct sk_buff *skb = NULL;
 	uint32_t i, index;
+	int flags = cds_get_gfp_flags();
 
 	ENTER();
 
@@ -529,7 +533,7 @@ wlan_hdd_cfg80211_extscan_hotlist_match_ind(void *ctx,
 		  pHddCtx->wiphy,
 		  NULL,
 		  EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-		  index, GFP_KERNEL);
+		  index, flags);
 
 	if (!skb) {
 		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
@@ -618,7 +622,7 @@ wlan_hdd_cfg80211_extscan_hotlist_match_ind(void *ctx,
 			goto fail;
 	}
 
-	cfg80211_vendor_event(skb, GFP_KERNEL);
+	cfg80211_vendor_event(skb, flags);
 	EXIT();
 	return;
 
@@ -633,6 +637,9 @@ fail:
  * @ctx: Pointer to hdd context
  * @pData: Pointer to signif wifi change event
  *
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
+ *
  * Return: none
  */
 static void
@@ -645,6 +652,7 @@ wlan_hdd_cfg80211_extscan_signif_wifi_change_results_ind(
 	tSirWifiSignificantChange *ap_info;
 	int32_t *rssi;
 	uint32_t i, j;
+	int flags = cds_get_gfp_flags();
 
 	ENTER();
 
@@ -660,7 +668,7 @@ wlan_hdd_cfg80211_extscan_signif_wifi_change_results_ind(
 		NULL,
 		EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
 		QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SIGNIFICANT_CHANGE_INDEX,
-		GFP_KERNEL);
+		flags);
 
 	if (!skb) {
 		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
@@ -738,7 +746,7 @@ wlan_hdd_cfg80211_extscan_signif_wifi_change_results_ind(
 			goto fail;
 	}
 
-	cfg80211_vendor_event(skb, GFP_KERNEL);
+	cfg80211_vendor_event(skb, flags);
 	return;
 
 fail:
@@ -752,6 +760,9 @@ fail:
  * @ctx: Pointer to hdd context
  * @pData: Pointer to full scan result event
  *
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
+ *
  * Return: none
  */
 static void
@@ -764,6 +775,7 @@ wlan_hdd_cfg80211_extscan_full_scan_result_event(void *ctx,
 #ifdef CONFIG_CNSS
 	struct timespec ts;
 #endif
+	int flags = cds_get_gfp_flags();
 
 	ENTER();
 
@@ -784,7 +796,7 @@ wlan_hdd_cfg80211_extscan_full_scan_result_event(void *ctx,
 		  NULL,
 		  EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
 		  QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_FULL_SCAN_RESULT_INDEX,
-		  GFP_KERNEL);
+		  flags);
 
 	if (!skb) {
 		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
@@ -867,7 +879,7 @@ wlan_hdd_cfg80211_extscan_full_scan_result_event(void *ctx,
 			goto nla_put_failure;
 	}
 
-	cfg80211_vendor_event(skb, GFP_KERNEL);
+	cfg80211_vendor_event(skb, flags);
 	EXIT();
 	return;
 
@@ -881,6 +893,9 @@ nla_put_failure:
  * @ctx: Pointer to hdd context
  * @pData: Pointer to scan results available indication param
  *
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
+ *
  * Return: none
  */
 static void
@@ -890,6 +905,7 @@ wlan_hdd_cfg80211_extscan_scan_res_available_event(
 {
 	hdd_context_t *pHddCtx = (hdd_context_t *) ctx;
 	struct sk_buff *skb = NULL;
+	int flags = cds_get_gfp_flags();
 
 	ENTER();
 
@@ -905,7 +921,7 @@ wlan_hdd_cfg80211_extscan_scan_res_available_event(
 		 NULL,
 		 EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
 		 QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SCAN_RESULTS_AVAILABLE_INDEX,
-		 GFP_KERNEL);
+		 flags);
 
 	if (!skb) {
 		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
@@ -924,7 +940,7 @@ wlan_hdd_cfg80211_extscan_scan_res_available_event(
 		goto nla_put_failure;
 	}
 
-	cfg80211_vendor_event(skb, GFP_KERNEL);
+	cfg80211_vendor_event(skb, flags);
 	EXIT();
 	return;
 
@@ -938,6 +954,9 @@ nla_put_failure:
  * @ctx: Pointer to hdd context
  * @pData: Pointer to scan event indication param
  *
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
+ *
  * Return: none
  */
 static void
@@ -947,6 +966,7 @@ wlan_hdd_cfg80211_extscan_scan_progress_event(void *ctx,
 {
 	hdd_context_t *pHddCtx = (hdd_context_t *) ctx;
 	struct sk_buff *skb = NULL;
+	int flags = cds_get_gfp_flags();
 
 	ENTER();
 
@@ -962,7 +982,7 @@ wlan_hdd_cfg80211_extscan_scan_progress_event(void *ctx,
 			NULL,
 			EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
 			QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SCAN_EVENT_INDEX,
-			GFP_KERNEL);
+			flags);
 
 	if (!skb) {
 		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
@@ -983,7 +1003,7 @@ wlan_hdd_cfg80211_extscan_scan_progress_event(void *ctx,
 		goto nla_put_failure;
 	}
 
-	cfg80211_vendor_event(skb, GFP_KERNEL);
+	cfg80211_vendor_event(skb, flags);
 	EXIT();
 	return;
 
@@ -999,6 +1019,8 @@ nla_put_failure:
  *
  * This function reads the matched network data and fills NL vendor attributes
  * and send it to upper layer.
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
  *
  * Return: 0 on success, error number otherwise
  */
@@ -1009,6 +1031,7 @@ wlan_hdd_cfg80211_extscan_epno_match_found(void *ctx,
 	hdd_context_t *pHddCtx  = (hdd_context_t *)ctx;
 	struct sk_buff *skb     = NULL;
 	uint32_t len, i;
+	int flags = cds_get_gfp_flags();
 
 	ENTER();
 
@@ -1037,7 +1060,7 @@ wlan_hdd_cfg80211_extscan_epno_match_found(void *ctx,
 		  NULL,
 		  EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
 		QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_NETWORK_FOUND_INDEX,
-		  GFP_KERNEL);
+		  flags);
 
 	if (!skb) {
 		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
@@ -1095,7 +1118,7 @@ wlan_hdd_cfg80211_extscan_epno_match_found(void *ctx,
 		nla_nest_end(skb, nla_aps);
 	}
 
-	cfg80211_vendor_event(skb, GFP_KERNEL);
+	cfg80211_vendor_event(skb, flags);
 	return;
 
 fail:
@@ -1110,6 +1133,8 @@ fail:
  *
  * This function reads the match network %data and fill in the skb with
  * NL attributes and send up the NL event
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
  *
  * Return: none
  */
@@ -1120,8 +1145,8 @@ wlan_hdd_cfg80211_passpoint_match_found(void *ctx,
 	hdd_context_t *pHddCtx  = ctx;
 	struct sk_buff *skb     = NULL;
 	uint32_t len, i, num_matches = 1, more_data = 0;
-	struct nlattr *nla_aps;
-	struct nlattr *nla_bss;
+	struct nlattr *nla_aps, *nla_bss;
+	int flags = cds_get_gfp_flags();
 
 	ENTER();
 
@@ -1142,7 +1167,7 @@ wlan_hdd_cfg80211_passpoint_match_found(void *ctx,
 		  NULL,
 		  EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
 		  QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_PASSPOINT_NETWORK_FOUND_INDEX,
-		  GFP_KERNEL);
+		  flags);
 
 	if (!skb) {
 		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
@@ -1225,7 +1250,7 @@ wlan_hdd_cfg80211_passpoint_match_found(void *ctx,
 	}
 	nla_nest_end(skb, nla_aps);
 
-	cfg80211_vendor_event(skb, GFP_KERNEL);
+	cfg80211_vendor_event(skb, flags);
 	return;
 
 fail:
@@ -1242,6 +1267,8 @@ fail:
  * This function will take an SSID match event that was generated by
  * firmware and will convert it into a cfg80211 vendor event which is
  * sent to userspace.
+ * This callback execute in atomic context and must not invoke any
+ * blocking calls.
  *
  * Return: none
  */
@@ -1252,6 +1279,7 @@ wlan_hdd_cfg80211_extscan_hotlist_ssid_match_ind(void *ctx,
 	hdd_context_t *hdd_ctx = ctx;
 	struct sk_buff *skb;
 	uint32_t i, index;
+	int flags = cds_get_gfp_flags();
 
 	ENTER();
 
@@ -1273,8 +1301,7 @@ wlan_hdd_cfg80211_extscan_hotlist_ssid_match_ind(void *ctx,
 	skb = cfg80211_vendor_event_alloc(hdd_ctx->wiphy,
 		NULL,
 		EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-		index,
-		GFP_KERNEL);
+		index, flags);
 
 	if (!skb) {
 		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
@@ -1367,7 +1394,7 @@ wlan_hdd_cfg80211_extscan_hotlist_ssid_match_ind(void *ctx,
 		}
 	}
 
-	cfg80211_vendor_event(skb, GFP_KERNEL);
+	cfg80211_vendor_event(skb, flags);
 	return;
 
 fail:
@@ -1691,7 +1718,7 @@ static int __wlan_hdd_cfg80211_extscan_get_capabilities(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -1825,7 +1852,7 @@ static int __wlan_hdd_cfg80211_extscan_get_cached_results(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -1973,7 +2000,7 @@ __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -2170,7 +2197,7 @@ __wlan_hdd_cfg80211_extscan_set_significant_change(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -2452,7 +2479,7 @@ __wlan_hdd_cfg80211_extscan_get_valid_channels(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3117,7 +3144,7 @@ __wlan_hdd_cfg80211_extscan_start(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3327,7 +3354,7 @@ __wlan_hdd_cfg80211_extscan_stop(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3454,7 +3481,7 @@ __wlan_hdd_cfg80211_extscan_reset_bssid_hotlist(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3579,7 +3606,7 @@ __wlan_hdd_cfg80211_extscan_reset_significant_change(struct wiphy
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3795,7 +3822,7 @@ static int __wlan_hdd_cfg80211_set_epno_list(struct wiphy *wiphy,
 	if (ret_val)
 		return ret_val;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -4001,7 +4028,7 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy,
 	if (ret)
 		return ret;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -4117,7 +4144,7 @@ static int __wlan_hdd_cfg80211_reset_passpoint_list(struct wiphy *wiphy,
 	if (ret)
 		return ret;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -4243,7 +4270,7 @@ __wlan_hdd_cfg80211_extscan_set_ssid_hotlist(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -4463,7 +4490,7 @@ __wlan_hdd_cfg80211_extscan_reset_ssid_hotlist(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
diff --git a/core/hdd/src/wlan_hdd_ftm.c b/core/hdd/src/wlan_hdd_ftm.c
index bf285c00975d..87785387357d 100644
--- a/core/hdd/src/wlan_hdd_ftm.c
+++ b/core/hdd/src/wlan_hdd_ftm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -659,7 +659,7 @@ int wlan_hdd_ftm_close(hdd_context_t *hdd_ctx)
 		wlan_ftm_stop(hdd_ctx);
 	}
 
-	hdd_close_all_adapters(hdd_ctx);
+	hdd_close_all_adapters(hdd_ctx, false);
 
 	cdf_status = cds_sched_close(cds_context);
 	if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
diff --git a/core/hdd/src/wlan_hdd_green_ap.c b/core/hdd/src/wlan_hdd_green_ap.c
index 7cf2c23212f6..fed68aa1ae29 100644
--- a/core/hdd/src/wlan_hdd_green_ap.c
+++ b/core/hdd/src/wlan_hdd_green_ap.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -26,6 +26,9 @@
  *
  */
 
+/* denote that this file does not allow legacy hddLog */
+#define HDD_DISALLOW_LEGACY_HDDLOG 1
+
 /* Include Files */
 #include <wlan_hdd_main.h>
 #include <wlan_hdd_misc.h>
@@ -77,6 +80,7 @@ enum hdd_green_ap_event {
  * @ps_state: Current state
  * @ps_event: Event to trigger when timer expires
  * @ps_timer: Event timer
+ * @egap_support: Enhanced Green AP support flag
  */
 struct hdd_green_ap_ctx {
 	uint8_t ps_enable;
@@ -88,6 +92,8 @@ struct hdd_green_ap_ctx {
 	enum hdd_green_ap_event ps_event;
 
 	cdf_mc_timer_t ps_timer;
+
+	bool egap_support;
 };
 
 /**
@@ -120,7 +126,7 @@ static int hdd_wlan_green_ap_enable(hdd_adapter_t *adapter,
 {
 	int ret;
 
-	hddLog(LOG1, FL("Set Green-AP val: %d"), enable);
+	hdd_notice("Set Green-AP val: %d", enable);
 
 	ret = wma_cli_set_command(adapter->sessionId,
 				  WMI_PDEV_GREEN_AP_PS_ENABLE_CMDID,
@@ -146,8 +152,8 @@ static void hdd_wlan_green_ap_mc(struct hdd_context_s *hdd_ctx,
 	if (green_ap == NULL)
 		return;
 
-	hddLog(LOG1, FL("Green-AP event: %d, state: %d, num_nodes: %d"),
-	       event, green_ap->ps_state, green_ap->num_nodes);
+	hdd_notice("Green-AP event: %d, state: %d, num_nodes: %d",
+		   event, green_ap->ps_state, green_ap->num_nodes);
 
 	/* handle the green ap ps event */
 	switch (event) {
@@ -174,13 +180,13 @@ static void hdd_wlan_green_ap_mc(struct hdd_context_s *hdd_ctx,
 		break;
 
 	default:
-		hddLog(LOGE, FL("invalid event %d"), event);
+		hdd_err("invalid event %d", event);
 		break;
 	}
 
 	/* Confirm that power save is enabled before doing state transitions */
 	if (!green_ap->ps_enable) {
-		hddLog(CDF_TRACE_LEVEL_INFO, FL("Green-AP is disabled"));
+		hdd_notice("Green-AP is disabled");
 		hdd_wlan_green_ap_update(hdd_ctx,
 					 GREEN_AP_PS_IDLE_STATE,
 					 GREEN_AP_PS_WAIT_EVENT);
@@ -189,7 +195,7 @@ static void hdd_wlan_green_ap_mc(struct hdd_context_s *hdd_ctx,
 
 	adapter = hdd_get_adapter(hdd_ctx, WLAN_HDD_SOFTAP);
 	if (adapter == NULL) {
-		hddLog(LOGE, FL("Green-AP no SAP adapter"));
+		hdd_err("Green-AP no SAP adapter");
 		goto done;
 	}
 
@@ -236,7 +242,7 @@ static void hdd_wlan_green_ap_mc(struct hdd_context_s *hdd_ctx,
 	case GREEN_AP_PS_ON_STATE:
 		if (green_ap->num_nodes) {
 			if (hdd_wlan_green_ap_enable(adapter, 0)) {
-				hddLog(LOGE, FL("FAILED TO SET GREEN-AP mode"));
+				hdd_err("FAILED TO SET GREEN-AP mode");
 				goto done;
 			}
 			hdd_wlan_green_ap_update(hdd_ctx,
@@ -251,7 +257,7 @@ static void hdd_wlan_green_ap_mc(struct hdd_context_s *hdd_ctx,
 						 GREEN_AP_PS_ON_EVENT);
 
 			if (hdd_wlan_green_ap_enable(adapter, 0)) {
-				hddLog(LOGE, FL("FAILED TO SET GREEN-AP mode"));
+				hdd_err("FAILED TO SET GREEN-AP mode");
 				goto done;
 			}
 
@@ -261,7 +267,7 @@ static void hdd_wlan_green_ap_mc(struct hdd_context_s *hdd_ctx,
 		break;
 
 	default:
-		hddLog(LOGE, FL("invalid state %d"), green_ap->ps_state);
+		hdd_err("invalid state %d", green_ap->ps_state);
 		hdd_wlan_green_ap_update(hdd_ctx, GREEN_AP_PS_OFF_STATE,
 					 GREEN_AP_PS_WAIT_EVENT);
 		break;
@@ -283,7 +289,7 @@ static void hdd_wlan_green_ap_timer_fn(void *ctx)
 	struct hdd_green_ap_ctx *green_ap;
 
 	if (0 != wlan_hdd_validate_context(hdd_ctx)) {
-		hddLog(CDF_TRACE_LEVEL_ERROR, FL("HDD context is not valid"));
+		hdd_err("HDD context is not valid");
 		return;
 	}
 
@@ -307,7 +313,7 @@ static CDF_STATUS hdd_wlan_green_ap_attach(struct hdd_context_s *hdd_ctx)
 
 	green_ap = cdf_mem_malloc(sizeof(*green_ap));
 	if (!green_ap) {
-		hddLog(LOGP, FL("Memory allocation for Green-AP failed!"));
+		hdd_alert("Memory allocation for Green-AP failed!");
 		status = CDF_STATUS_E_NOMEM;
 		goto error;
 	}
@@ -344,7 +350,7 @@ static CDF_STATUS hdd_wlan_green_ap_deattach(struct hdd_context_s *hdd_ctx)
 	ENTER();
 
 	if (green_ap == NULL) {
-		hddLog(LOG1, FL("Green-AP is not enabled"));
+		hdd_notice("Green-AP is not enabled");
 		status = CDF_STATUS_E_NOSUPPORT;
 		goto done;
 	}
@@ -356,7 +362,7 @@ static CDF_STATUS hdd_wlan_green_ap_deattach(struct hdd_context_s *hdd_ctx)
 
 	/* Destroy the Green AP timer */
 	if (!CDF_IS_STATUS_SUCCESS(cdf_mc_timer_destroy(&green_ap->ps_timer)))
-		hddLog(LOG1, FL("Cannot deallocate Green-AP's timer"));
+		hdd_notice("Cannot deallocate Green-AP's timer");
 
 	/* release memory */
 	cdf_mem_zero(green_ap, sizeof(*green_ap));
@@ -378,7 +384,7 @@ done:
 void hdd_wlan_green_ap_init(struct hdd_context_s *hdd_ctx)
 {
 	if (!CDF_IS_STATUS_SUCCESS(hdd_wlan_green_ap_attach(hdd_ctx)))
-		hddLog(LOGE, FL("Failed to allocate Green-AP resource"));
+		hdd_err("Failed to allocate Green-AP resource");
 }
 
 /**
@@ -390,7 +396,7 @@ void hdd_wlan_green_ap_init(struct hdd_context_s *hdd_ctx)
 void hdd_wlan_green_ap_deinit(struct hdd_context_s *hdd_ctx)
 {
 	if (!CDF_IS_STATUS_SUCCESS(hdd_wlan_green_ap_deattach(hdd_ctx)))
-		hddLog(LOGE, FL("Cannot deallocate Green-AP resource"));
+		hdd_err("Cannot deallocate Green-AP resource");
 }
 
 /**
@@ -403,16 +409,38 @@ void hdd_wlan_green_ap_start_bss(struct hdd_context_s *hdd_ctx)
 {
 	struct hdd_config *cfg = hdd_ctx->config;
 
+	/* check if the firmware and ini are both enabled the egap,
+	 * and also the feature_flag enable, then we enable the egap
+	 */
+	if (hdd_ctx->green_ap_ctx->egap_support && cfg->enable_egap &&
+	    cfg->egap_feature_flag) {
+		hdd_notice("Set EGAP - enabled: %d, flag: %x, inact_time: %d, wait_time: %d",
+			   cfg->enable_egap, cfg->egap_feature_flag,
+			   cfg->egap_inact_time, cfg->egap_wait_time);
+		if (!sme_send_egap_conf_params(cfg->enable_egap,
+					       cfg->egap_inact_time,
+					       cfg->egap_wait_time,
+					       cfg->egap_feature_flag)) {
+			/* EGAP is enabled, disable host GAP */
+			hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_PS_STOP_EVENT);
+			goto exit;
+		}
+		/* fall through, if send_egap_conf_params() failed,
+		 * then check host GAP and enable it accordingly
+		 */
+	}
+
 	if (!(CDF_STA_MASK & hdd_ctx->concurrency_mode) &&
 	    cfg->enable2x2 && cfg->enableGreenAP) {
 		hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_PS_START_EVENT);
 	} else {
 		hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_PS_STOP_EVENT);
-		hddLog(LOG1,
-		       "Green-AP: is disabled, due to sta_concurrency: %d, enable2x2: %d, enableGreenAP: %d",
-		       CDF_STA_MASK & hdd_ctx->concurrency_mode,
-		       cfg->enable2x2, cfg->enableGreenAP);
+		hdd_notice("Green-AP: is disabled, due to sta_concurrency: %d, enable2x2: %d, enableGreenAP: %d",
+			   CDF_STA_MASK & hdd_ctx->concurrency_mode,
+			   cfg->enable2x2, cfg->enableGreenAP);
 	}
+exit:
+	return;
 }
 
 /**
@@ -447,3 +475,18 @@ void hdd_wlan_green_ap_del_sta(struct hdd_context_s *hdd_ctx)
 {
 	hdd_wlan_green_ap_mc(hdd_ctx, GREEN_AP_DEL_STA_EVENT);
 }
+
+/**
+ * hdd_wlan_set_egap_support() - helper function to set egap support flag
+ * @hdd_ctx:   pointer to hdd context
+ * @param:     pointer to target configuration
+ *
+ * Return:     None
+ */
+void hdd_wlan_set_egap_support(hdd_context_t *hdd_ctx, void *param)
+{
+	struct wma_tgt_cfg *cfg = (struct wma_tgt_cfg *) param;
+
+	if (hdd_ctx && cfg)
+		hdd_ctx->green_ap_ctx->egap_support = cfg->egap_support;
+}
diff --git a/core/hdd/src/wlan_hdd_green_ap.h b/core/hdd/src/wlan_hdd_green_ap.h
index 8844d71d870b..a688ba0222b4 100644
--- a/core/hdd/src/wlan_hdd_green_ap.h
+++ b/core/hdd/src/wlan_hdd_green_ap.h
@@ -43,6 +43,7 @@ void hdd_wlan_green_ap_start_bss(struct hdd_context_s *hdd_ctx);
 void hdd_wlan_green_ap_stop_bss(struct hdd_context_s *hdd_ctx);
 void hdd_wlan_green_ap_add_sta(struct hdd_context_s *hdd_ctx);
 void hdd_wlan_green_ap_del_sta(struct hdd_context_s *hdd_ctx);
+void hdd_wlan_set_egap_support(struct hdd_context_s *hdd_ctx, void *param);
 #else
 static inline void hdd_wlan_green_ap_init(struct hdd_context_s *hdd_ctx) {}
 static inline void hdd_wlan_green_ap_deinit(struct hdd_context_s *hdd_ctx) {}
@@ -50,5 +51,8 @@ static inline void hdd_wlan_green_ap_start_bss(struct hdd_context_s *hdd_ctx) {}
 static inline void hdd_wlan_green_ap_stop_bss(struct hdd_context_s *hdd_ctx) {}
 static inline void hdd_wlan_green_ap_add_sta(struct hdd_context_s *hdd_ctx) {}
 static inline void hdd_wlan_green_ap_del_sta(struct hdd_context_s *hdd_ctx) {}
+static inline void hdd_wlan_set_egap_support(struct hdd_context_s *hdd_ctx,
+					     void *param) {}
+
 #endif /* FEATURE_GREEN_AP */
 #endif /* __WLAN_HDD_GREEN_AP_H */
diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c
index 357c6be68f7e..97a3142d0fc8 100644
--- a/core/hdd/src/wlan_hdd_hostapd.c
+++ b/core/hdd/src/wlan_hdd_hostapd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -222,12 +222,12 @@ static int __hdd_hostapd_open(struct net_device *dev)
 	MTRACE(cdf_trace(CDF_MODULE_ID_HDD,
 			 TRACE_CODE_HDD_HOSTAPD_OPEN_REQUEST, NO_SESSION, 0));
 
-	if (WLAN_HDD_GET_CTX(pAdapter)->isLoadInProgress ||
-		WLAN_HDD_GET_CTX(pAdapter)->isUnloadInProgress) {
-		hddLog(LOGE,
-		       FL("Driver load/unload in progress, ignore adapter open"));
+	if (cds_is_load_or_unload_in_progress()) {
+		hdd_err("Driver load/unload in progress, ignore, state: 0x%x",
+			cds_get_driver_state());
 		goto done;
 	}
+
 	/* Enable all Tx queues */
 	hddLog(LOG1, FL("Enabling queues"));
 	wlan_hdd_netif_queue_control(pAdapter,
@@ -556,8 +556,7 @@ static int hdd_stop_bss_link(hdd_adapter_t *pHostapdAdapter,
 			hddLog(LOGE, FL("Deleting SAP/P2P link!!!!!!"));
 
 		clear_bit(SOFTAP_BSS_STARTED, &pHostapdAdapter->event_flags);
-		cds_decr_session_set_pcl(pHddCtx,
-					     pHostapdAdapter->device_mode,
+		cds_decr_session_set_pcl(pHostapdAdapter->device_mode,
 					     pHostapdAdapter->sessionId);
 	}
 	EXIT();
@@ -589,7 +588,7 @@ static void hdd_issue_stored_joinreq(hdd_adapter_t *sta_adapter,
 	}
 	hal_handle = WLAN_HDD_GET_HAL_CTX(sta_adapter);
 
-	if (true ==  cds_is_sta_connection_pending(hdd_ctx)) {
+	if (true ==  cds_is_sta_connection_pending()) {
 		MTRACE(cdf_trace(CDF_MODULE_ID_HDD,
 				TRACE_CODE_HDD_ISSUE_JOIN_REQ,
 				sta_adapter->sessionId, roam_id));
@@ -601,9 +600,95 @@ static void hdd_issue_stored_joinreq(hdd_adapter_t *sta_adapter,
 			hdd_conn_set_connection_state(sta_adapter,
 				eConnectionState_NotConnected);
 		}
-		cds_change_sta_conn_pending_status(hdd_ctx, false);
+		cds_change_sta_conn_pending_status(false);
+	}
+}
+
+#ifdef WLAN_FEATURE_MBSSID
+static eCsrPhyMode
+hdd_sap_get_phymode(hdd_adapter_t *hostapd_adapter)
+{
+	return wlansap_get_phymode(WLAN_HDD_GET_SAP_CTX_PTR(hostapd_adapter));
+}
+#else
+static eCsrPhyMode
+hdd_sap_get_phymode(hdd_adapter_t *hostapd_adapter)
+{
+	return wlansap_get_phymode(
+		(WLAN_HDD_GET_CTX(hostapd_adapter))->pcds_context);
+}
+#endif
+
+/**
+ * hdd_update_chandef() - Function to update channel width and center freq
+ * @hostapd_adapter:	hostapd adapter
+ * @chandef:		cfg80211 chan def
+ * @cb_mode:		chan offset
+ *
+ * This function will be called to update channel width and center freq
+ *
+ * Return: None
+ */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)) || defined(WITH_BACKPORTS)
+static inline void
+hdd_update_chandef(hdd_adapter_t *hostapd_adapter,
+		struct cfg80211_chan_def *chandef,
+		ePhyChanBondState cb_mode)
+{
+	uint16_t   ch_width;
+	hdd_ap_ctx_t *phdd_ap_ctx;
+	uint8_t  center_chan, chan;
+
+	phdd_ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(hostapd_adapter);
+	ch_width = phdd_ap_ctx->sapConfig.acs_cfg.ch_width;
+
+	switch (ch_width) {
+	case eHT_CHANNEL_WIDTH_20MHZ:
+	case eHT_CHANNEL_WIDTH_40MHZ:
+		hdd_info("ch_width %d, won't update", ch_width);
+		break;
+	case eHT_CHANNEL_WIDTH_80MHZ:
+		chan = cds_freq_to_chan(chandef->chan->center_freq);
+		chandef->width = NL80211_CHAN_WIDTH_80;
+
+		switch (cb_mode) {
+		case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED:
+		case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
+			center_chan = chan + 2;
+			break;
+		case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
+			center_chan = chan + 6;
+			break;
+		case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
+		case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED:
+			center_chan = chan - 2;
+			break;
+		case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
+			center_chan = chan - 6;
+			break;
+		default:
+			center_chan = chan;
+			break;
+		}
+
+		chandef->center_freq1 = cds_chan_to_freq(center_chan);
+		break;
+	case eHT_CHANNEL_WIDTH_160MHZ:
+	default:
+		/* Todo, please add related codes if support 160MHZ or others */
+		hdd_err("unsupport ch_width %d", ch_width);
+		break;
 	}
+
 }
+#else
+static inline void
+hdd_update_chandef(hdd_adapter_t *hostapd_adapter,
+		struct cfg80211_chan_def *chandef,
+		ePhyChanBondState cb_mode)
+{
+}
+#endif
 
 /**
  * hdd_chan_change_notify() - Function to notify hostapd about channel change
@@ -642,7 +727,7 @@ CDF_STATUS hdd_chan_change_notify(hdd_adapter_t *hostapd_adapter,
 		return CDF_STATUS_E_FAILURE;
 	}
 
-	phy_mode = sme_get_phy_mode(hal);
+	phy_mode = hdd_sap_get_phymode(hostapd_adapter);
 
 	if (oper_chan <= 14)
 		cb_mode = sme_get_cb_phy_state_from_cb_ini_value(
@@ -670,8 +755,15 @@ CDF_STATUS hdd_chan_change_notify(hdd_adapter_t *hostapd_adapter,
 		break;
 	}
 
+	hdd_info("%s: phy_mode %d cb_mode %d chann_type %d oper_chan %d",
+		__func__, phy_mode, cb_mode, channel_type, oper_chan);
+
 	cfg80211_chandef_create(&chandef, chan, channel_type);
 
+	if ((phy_mode == eCSR_DOT11_MODE_11ac) ||
+	    (phy_mode == eCSR_DOT11_MODE_11ac_ONLY))
+		hdd_update_chandef(hostapd_adapter, &chandef, cb_mode);
+
 	cfg80211_ch_switch_notify(dev, &chandef);
 
 	return CDF_STATUS_SUCCESS;
@@ -999,7 +1091,7 @@ CDF_STATUS hdd_hostapd_sap_event_cb(tpSap_Event pSapEvent,
 		wrqu.data.length = strlen(startBssEvent);
 		we_event = IWEVCUSTOM;
 		we_custom_event_generic = we_custom_start_event;
-		cds_dump_concurrency_info(pHddCtx);
+		cds_dump_concurrency_info();
 		/* Send SCC/MCC Switching event to IPA */
 		hdd_ipa_send_mcc_scc_msg(pHddCtx, pHddCtx->mcc_mode);
 		break;          /* Event will be sent after Switch-Case stmt */
@@ -1309,9 +1401,7 @@ CDF_STATUS hdd_hostapd_sap_event_cb(tpSap_Event pSapEvent,
 					(const u8 *)&pSapEvent->sapevt.
 					sapStationAssocReassocCompleteEvent.ies[0];
 				staInfo.assoc_req_ies_len = iesLen;
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 31))
 				staInfo.filled |= STATION_INFO_ASSOC_REQ_IES;
-#endif
 				cfg80211_new_sta(dev,
 						 (const u8 *)&pSapEvent->sapevt.
 						 sapStationAssocReassocCompleteEvent.
@@ -1487,13 +1577,12 @@ CDF_STATUS hdd_hostapd_sap_event_cb(tpSap_Event pSapEvent,
 			     WPSPBCProbeReq.probeReqIE,
 			     pHddApCtx->WPSPBCProbeReq.probeReqIELen);
 
-		cdf_mem_copy(pHddApCtx->WPSPBCProbeReq.peerMacAddr,
-			     pSapEvent->sapevt.sapPBCProbeReqEvent.
-			     WPSPBCProbeReq.peerMacAddr,
-			     CDF_MAC_ADDR_SIZE);
+		cdf_copy_macaddr(&pHddApCtx->WPSPBCProbeReq.peer_macaddr,
+			     &pSapEvent->sapevt.sapPBCProbeReqEvent.
+			     WPSPBCProbeReq.peer_macaddr);
 		hddLog(LOG1, "WPS PBC probe req " MAC_ADDRESS_STR,
 		       MAC_ADDR_ARRAY(pHddApCtx->WPSPBCProbeReq.
-				      peerMacAddr));
+				      peer_macaddr.bytes));
 		memset(&wreq, 0, sizeof(wreq));
 		wreq.data.length = strlen(message);             /* This is length of message */
 		wireless_send_event(dev, IWEVCUSTOM, &wreq,
@@ -1522,17 +1611,6 @@ CDF_STATUS hdd_hostapd_sap_event_cb(tpSap_Event pSapEvent,
 		cdf_mem_free(pSapEvent->sapevt.sapAssocStaListEvent.pAssocStas);        /* Release caller allocated memory here */
 		pSapEvent->sapevt.sapAssocStaListEvent.pAssocStas = NULL;
 		return CDF_STATUS_SUCCESS;
-	case eSAP_INDICATE_MGMT_FRAME:
-		hdd_indicate_mgmt_frame(pHostapdAdapter,
-					pSapEvent->sapevt.sapManagementFrameInfo.
-					nFrameLength,
-					pSapEvent->sapevt.sapManagementFrameInfo.
-					pbFrames,
-					pSapEvent->sapevt.sapManagementFrameInfo.
-					frameType,
-					pSapEvent->sapevt.sapManagementFrameInfo.
-					rxChan, 0);
-		return CDF_STATUS_SUCCESS;
 	case eSAP_REMAIN_CHAN_READY:
 		hdd_remain_chan_ready_handler(pHostapdAdapter,
 			pSapEvent->sapevt.sap_roc_ind.scan_id);
@@ -1716,7 +1794,8 @@ CDF_STATUS hdd_hostapd_sap_event_cb(tpSap_Event pSapEvent,
 		  FL("Channel change indication from peer for channel %d"),
 				pSapEvent->sapevt.sap_chan_cng_ind.new_chan);
 		if (hdd_softap_set_channel_change(dev,
-			 pSapEvent->sapevt.sap_chan_cng_ind.new_chan))
+			 pSapEvent->sapevt.sap_chan_cng_ind.new_chan,
+			 CH_WIDTH_MAX))
 			return CDF_STATUS_E_FAILURE;
 		else
 			return CDF_STATUS_SUCCESS;
@@ -1795,7 +1874,7 @@ stopbss:
 		we_custom_event_generic = we_custom_event;
 		wireless_send_event(dev, we_event, &wrqu,
 				    (char *)we_custom_event_generic);
-		cds_dump_concurrency_info(pHddCtx);
+		cds_dump_concurrency_info();
 		/* Send SCC/MCC Switching event to IPA */
 		hdd_ipa_send_mcc_scc_msg(pHddCtx, pHddCtx->mcc_mode);
 	}
@@ -1908,10 +1987,13 @@ int hdd_softap_unpack_ie(tHalHandle halHandle,
  *
  * @dev: pointer to the net device.
  * @target_channel: target channel number.
+ * @target_bw: Target bandwidth to move.
+ * If no bandwidth is specified, the value is CH_WIDTH_MAX
  *
  * Return: 0 for success, non zero for failure
  */
-int hdd_softap_set_channel_change(struct net_device *dev, int target_channel)
+int hdd_softap_set_channel_change(struct net_device *dev, int target_channel,
+				 phy_ch_width target_bw)
 {
 	CDF_STATUS status;
 	int ret = 0;
@@ -1932,6 +2014,13 @@ int hdd_softap_set_channel_change(struct net_device *dev, int target_channel)
 		return ret;
 	}
 
+	ret = hdd_validate_channel_and_bandwidth(pHostapdAdapter,
+						target_channel, target_bw);
+	if (ret) {
+		hdd_err("Invalid CH and BW combo");
+		return ret;
+	}
+
 	sta_adapter = hdd_get_adapter(pHddCtx, WLAN_HDD_INFRA_STATION);
 	/*
 	 * conc_custom_rule1:
@@ -1975,12 +2064,13 @@ int hdd_softap_set_channel_change(struct net_device *dev, int target_channel)
 		p_cds_context,
 #endif
 		(uint32_t)
-		target_channel);
+		target_channel,
+		target_bw);
 
 	if (CDF_STATUS_SUCCESS != status) {
 		hddLog(LOGE,
-		       FL("SAP set channel failed for channel = %d"),
-		       target_channel);
+		       FL("SAP set channel failed for channel = %d, bw:%d"),
+		       target_channel, target_bw);
 		/*
 		 * If channel change command fails then clear the
 		 * radar found flag and also restart the netif
@@ -2302,7 +2392,8 @@ static __iw_softap_setparam(struct net_device *dev,
 			hddLog(LOG1,
 			       "SET Channel Change to new channel= %d",
 			       set_value);
-			ret = hdd_softap_set_channel_change(dev, set_value);
+			ret = hdd_softap_set_channel_change(dev, set_value,
+								CH_WIDTH_MAX);
 		} else {
 			hddLog(LOGE,
 			       FL("Channel Change Failed, Device in test mode"));
@@ -3631,10 +3722,10 @@ static int __iw_softap_get_channel_list(struct net_device *dev,
 	       curBand, bandStartChannel, bandEndChannel);
 
 	for (i = bandStartChannel; i <= bandEndChannel; i++) {
-		if ((CHANNEL_STATE_ENABLE == reg_channels[i].enabled) ||
-		    (CHANNEL_STATE_DFS == reg_channels[i].enabled)) {
+		if ((CHANNEL_STATE_ENABLE == CDS_CHANNEL_STATE(i)) ||
+		    (CHANNEL_STATE_DFS == CDS_CHANNEL_STATE(i))) {
 			channel_list->channels[num_channels] =
-				rf_channels[i].channelNum;
+				CDS_CHANNEL_NUM(i);
 			num_channels++;
 		}
 	}
@@ -3766,9 +3857,8 @@ int __iw_get_wpspbc_probe_req_ies(struct net_device *dev,
 	cdf_mem_copy(&WPSPBCProbeReqIEs.probeReqIE,
 		     pHddApCtx->WPSPBCProbeReq.probeReqIE,
 		     WPSPBCProbeReqIEs.probeReqIELen);
-	cdf_mem_copy(&WPSPBCProbeReqIEs.macaddr,
-		     pHddApCtx->WPSPBCProbeReq.peerMacAddr,
-		     CDF_MAC_ADDR_SIZE);
+	cdf_copy_macaddr(&WPSPBCProbeReqIEs.macaddr,
+			 &pHddApCtx->WPSPBCProbeReq.peer_macaddr);
 	if (copy_to_user(wrqu->data.pointer,
 			 (void *)&WPSPBCProbeReqIEs,
 			 sizeof(WPSPBCProbeReqIEs))) {
@@ -3776,8 +3866,8 @@ int __iw_get_wpspbc_probe_req_ies(struct net_device *dev,
 		return -EFAULT;
 	}
 	wrqu->data.length = 12 + WPSPBCProbeReqIEs.probeReqIELen;
-	hddLog(LOG1, FL("Macaddress : " MAC_ADDRESS_STR),
-	       MAC_ADDR_ARRAY(WPSPBCProbeReqIEs.macaddr));
+	hdd_info("Macaddress : " MAC_ADDRESS_STR,
+	       MAC_ADDR_ARRAY(WPSPBCProbeReqIEs.macaddr.bytes));
 	up(&pHddApCtx->semWpsPBCOverlapInd);
 	EXIT();
 	return 0;
@@ -4980,8 +5070,7 @@ __iw_softap_stopbss(struct net_device *dev,
 			}
 		}
 		clear_bit(SOFTAP_BSS_STARTED, &pHostapdAdapter->event_flags);
-		cds_decr_session_set_pcl(hdd_ctx,
-					     pHostapdAdapter->device_mode,
+		cds_decr_session_set_pcl(pHostapdAdapter->device_mode,
 					     pHostapdAdapter->sessionId);
 	}
 	EXIT();
@@ -6386,10 +6475,6 @@ static int wlan_hdd_set_channel(struct wiphy *wiphy,
 					smeConfig.csrConfig.
 						channelBondingMode5GHz =
 					eCSR_INI_SINGLE_CHANNEL_CENTERED;
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-				sap_config->ch_width_orig =
-						eHT_CHANNEL_WIDTH_20MHZ;
-#endif
 				sap_config->sec_ch = 0;
 				break;
 
@@ -6639,19 +6724,6 @@ static void wlan_hdd_add_extra_ie(hdd_adapter_t *pHostapdAdapter,
 	return;
 }
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
-/**
- * wlan_hdd_cfg80211_alloc_new_beacon() - alloc beacon in ap mode
- * @pAdapter: Pointer to hostapd adapter
- * @ppBeacon: Pointer to pointer to beacon data
- * @params: Pointer to beacon parameters
- *
- * Return: 0 for success non-zero for failure
- */
-int wlan_hdd_cfg80211_alloc_new_beacon(hdd_adapter_t *pAdapter,
-				       beacon_data_t **ppBeacon,
-				       struct beacon_parameters *params)
-#else
 /**
  * wlan_hdd_cfg80211_alloc_new_beacon() - alloc beacon in ap mode
  * @pAdapter: Pointer to hostapd adapter
@@ -6665,7 +6737,6 @@ int wlan_hdd_cfg80211_alloc_new_beacon(hdd_adapter_t *pAdapter,
 				       beacon_data_t **ppBeacon,
 				       struct cfg80211_beacon_data *params,
 				       int dtim_period)
-#endif
 {
 	int size;
 	beacon_data_t *beacon = NULL;
@@ -6729,17 +6800,10 @@ int wlan_hdd_cfg80211_alloc_new_beacon(hdd_adapter_t *pAdapter,
 		       FL("Mem allocation for beacon failed"));
 		return -ENOMEM;
 	}
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
-	if (params->dtim_period)
-		beacon->dtim_period = params->dtim_period;
-	else if (old)
-		beacon->dtim_period = old->dtim_period;
-#else
 	if (dtim_period)
 		beacon->dtim_period = dtim_period;
 	else if (old)
 		beacon->dtim_period = old->dtim_period;
-#endif
 	/* -----------------------------------------------
 	 * | head | tail | proberesp_ies | assocresp_ies |
 	 * -----------------------------------------------
@@ -7225,17 +7289,6 @@ setup_acs_overrides:
 	return 0;
 }
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
-/**
- * wlan_hdd_cfg80211_start_bss() - start bss
- * @pHostapdAdapter: Pointer to hostapd adapter
- * @params: Pointer to start bss beacon parameters
- *
- * Return: 0 for success non-zero for failure
- */
-static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
-				       struct beacon_parameters *params)
-#else
 /**
  * wlan_hdd_cfg80211_start_bss() - start bss
  * @pHostapdAdapter: Pointer to hostapd adapter
@@ -7250,7 +7303,6 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 				       struct cfg80211_beacon_data *params,
 				       const u8 *ssid, size_t ssid_len,
 				       enum nl80211_hidden_ssid hidden_ssid)
-#endif
 {
 	tsap_Config_t *pConfig;
 	beacon_data_t *pBeacon = NULL;
@@ -7278,7 +7330,7 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 	uint16_t prev_rsn_length = 0;
 	ENTER();
 
-	if (cds_is_connection_in_progress(pHddCtx)) {
+	if (cds_is_connection_in_progress()) {
 		hdd_err("Can't start BSS: connection is in progress");
 		return -EINVAL;
 	}
@@ -7509,33 +7561,6 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 
 	pConfig->SSIDinfo.ssidHidden = false;
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
-	if (params->ssid != NULL) {
-		cdf_mem_copy(pConfig->SSIDinfo.ssid.ssId, params->ssid,
-			     params->ssid_len);
-		pConfig->SSIDinfo.ssid.length = params->ssid_len;
-
-		switch (params->hidden_ssid) {
-		case NL80211_HIDDEN_SSID_NOT_IN_USE:
-			hddLog(LOG1, "HIDDEN_SSID_NOT_IN_USE");
-			pConfig->SSIDinfo.ssidHidden = eHIDDEN_SSID_NOT_IN_USE;
-			break;
-		case NL80211_HIDDEN_SSID_ZERO_LEN:
-			hddLog(LOG1, "HIDDEN_SSID_ZERO_LEN");
-			pConfig->SSIDinfo.ssidHidden = eHIDDEN_SSID_ZERO_LEN;
-			break;
-		case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
-			hddLog(LOG1, "HIDDEN_SSID_ZERO_CONTENTS");
-			pConfig->SSIDinfo.ssidHidden =
-				eHIDDEN_SSID_ZERO_CONTENTS;
-			break;
-		default:
-			hddLog(LOGE, "Wrong hidden_ssid param %d",
-			       params->hidden_ssid);
-			break;
-		}
-	}
-#else
 	if (ssid != NULL) {
 		cdf_mem_copy(pConfig->SSIDinfo.ssid.ssId, ssid, ssid_len);
 		pConfig->SSIDinfo.ssid.length = ssid_len;
@@ -7559,7 +7584,6 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 			break;
 		}
 	}
-#endif
 
 	cdf_mem_copy(pConfig->self_macaddr.bytes,
 		     pHostapdAdapter->macAddressCurrent.bytes,
@@ -7655,16 +7679,6 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 		sme_config.csrConfig.WMMSupportMode = eCsrRoamWmmNoQos;
 	sme_update_config(pHddCtx->hHal, &sme_config);
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-	/* Linux kernel < 3.8 does not support ch width param. So for
-	 * 11AC get from ch width from ini file only if ht40 is enabled
-	 * VHT80 depends on HT40 config.
-	 */
-	if (pConfig->SapHw_mode == eCSR_DOT11_MODE_11ac)
-		if (pConfig->ch_width_orig == NL80211_CHAN_WIDTH_40)
-			pConfig->ch_width_orig = iniConfig->vhtChannelWidth;
-#endif
-
 	if (pConfig->ch_width_orig == NL80211_CHAN_WIDTH_80P80) {
 		if (pHddCtx->isVHT80Allowed == false)
 			pConfig->ch_width_orig = CH_WIDTH_40MHZ;
@@ -7740,7 +7754,7 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 		return 0;
 	}
 
-	if (!cds_allow_concurrency(pHddCtx,
+	if (!cds_allow_concurrency(
 				cds_convert_device_mode_to_hdd_type(
 				pHostapdAdapter->device_mode),
 				pConfig->channel, HW_MODE_20_MHZ)) {
@@ -7749,7 +7763,7 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 		return -EINVAL;
 	}
 
-	if (!cds_set_connection_in_progress(pHddCtx, true)) {
+	if (!cds_set_connection_in_progress(true)) {
 		hdd_err("Can't start BSS: set connnection in progress failed");
 		return -EINVAL;
 	}
@@ -7772,7 +7786,7 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 		pHostapdAdapter->dev);
 	if (!CDF_IS_STATUS_SUCCESS(status)) {
 		wlansap_reset_sap_config_add_ie(pConfig, eUPDATE_IE_ALL);
-		cds_set_connection_in_progress(pHddCtx, false);
+		cds_set_connection_in_progress(false);
 		hddLog(LOGE, FL("SAP Start Bss fail"));
 		return -EINVAL;
 	}
@@ -7787,7 +7801,7 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 	if (!CDF_IS_STATUS_SUCCESS(status)) {
 		hddLog(LOGE,
 			FL("ERROR: HDD cdf wait for single_event failed!!"));
-		cds_set_connection_in_progress(pHddCtx, false);
+		cds_set_connection_in_progress(false);
 		sme_get_command_q_status(hHal);
 #ifdef WLAN_FEATURE_MBSSID
 		wlansap_stop_bss(WLAN_HDD_GET_SAP_CTX_PTR(pHostapdAdapter));
@@ -7801,7 +7815,7 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 	set_bit(SOFTAP_BSS_STARTED, &pHostapdAdapter->event_flags);
 	/* Initialize WMM configuation */
 	hdd_wmm_init(pHostapdAdapter);
-	cds_incr_active_session(pHddCtx, pHostapdAdapter->device_mode,
+	cds_incr_active_session(pHostapdAdapter->device_mode,
 					 pHostapdAdapter->sessionId);
 #ifdef DHCP_SERVER_OFFLOAD
 	if (iniConfig->enableDHCPServerOffload)
@@ -7822,216 +7836,13 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
 	}
 #endif
 
-	cds_set_connection_in_progress(pHddCtx, false);
+	cds_set_connection_in_progress(false);
 	pHostapdState->bCommit = true;
 	EXIT();
 
 	return 0;
 }
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
-/**
- * __wlan_hdd_cfg80211_add_beacon() - add beacon in soft ap mode
- * @wiphy: Pointer to wiphy structure
- * @dev: Pointer to net_device structure
- * @params: Pointer to add beacon parameters
- *
- * Return: 0 for success non-zero for failure
- */
-static int __wlan_hdd_cfg80211_add_beacon(struct wiphy *wiphy,
-					struct net_device *dev,
-					struct beacon_parameters *params)
-{
-	hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
-	hdd_context_t *pHddCtx;
-	int status;
-
-	ENTER();
-
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
-		hddLog(LOGE, FL("Command not allowed in FTM mode"));
-		return -EINVAL;
-	}
-
-	MTRACE(cdf_trace(CDF_MODULE_ID_HDD,
-			 TRACE_CODE_HDD_CFG80211_ADD_BEACON,
-			 pAdapter->sessionId, params->interval));
-	hddLog(LOG2, FL("Device mode %s(%d)"),
-		hdd_device_mode_to_string(pAdapter->device_mode),
-		pAdapter->device_mode);
-
-	pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-	status = wlan_hdd_validate_context(pHddCtx);
-
-	if (0 != status)
-		return status;
-
-	if (!cds_allow_concurrency(pHddCtx,
-				cds_convert_device_mode_to_hdd_type(
-				pAdapter->device_mode), 0, HDD_20_MHZ)) {
-		hddLog(LOGE,
-			FL("This concurrency combination is not allowed"));
-		return -EINVAL;
-	}
-
-	if ((pAdapter->device_mode == WLAN_HDD_SOFTAP) ||
-	    (pAdapter->device_mode == WLAN_HDD_P2P_GO)) {
-		beacon_data_t *old, *new;
-
-		old = pAdapter->sessionCtx.ap.beacon;
-
-		if (old) {
-			hddLog(LOGW,
-				FL("already beacon info added to session(%d)"),
-				pAdapter->sessionId);
-			return -EALREADY;
-		}
-
-		status =
-			wlan_hdd_cfg80211_alloc_new_beacon(pAdapter,
-							   &new, params);
-		if (status != CDF_STATUS_SUCCESS) {
-			hddLog(LOGE,
-				FL("Error!!! Allocating the new beacon"));
-			return -EINVAL;
-		}
-
-		pAdapter->sessionCtx.ap.beacon = new;
-
-		status = wlan_hdd_cfg80211_start_bss(pAdapter, params);
-		if (0 != status) {
-			pAdapter->sessionCtx.ap.beacon = NULL;
-			kfree(new);
-		}
-	}
-
-	EXIT();
-	return status;
-}
-
-/**
- * wlan_hdd_cfg80211_add_beacon() - add beacon in sap mode
- * @wiphy: Pointer to wiphy
- * @dev: Pointer to netdev
- * @param: Pointer to beacon parameters
- *
- * Return: zero for success non-zero for failure
- */
-int wlan_hdd_cfg80211_add_beacon(struct wiphy *wiphy,
-				struct net_device *dev,
-				struct beacon_parameters *params)
-{
-	int ret;
-
-	cds_ssr_protect(__func__);
-	ret = __wlan_hdd_cfg80211_add_beacon(wiphy, dev, params);
-	cds_ssr_unprotect(__func__);
-
-	return ret;
-}
-
-/**
- * __wlan_hdd_cfg80211_set_beacon() - set beacon in soft ap mode
- * @wiphy: Pointer to wiphy structure
- * @dev: Pointer to net_device structure
- * @params: Pointer to set beacon parameters
- *
- * Return: 0 for success non-zero for failure
- */
-static int __wlan_hdd_cfg80211_set_beacon(struct wiphy *wiphy,
-					struct net_device *dev,
-					struct beacon_parameters *params)
-{
-	hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
-	hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
-	hdd_context_t *pHddCtx;
-	int status;
-
-	ENTER();
-
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
-		hddLog(LOGE, FL("Command not allowed in FTM mode"));
-		return -EINVAL;
-	}
-
-	MTRACE(cdf_trace(CDF_MODULE_ID_HDD,
-			 TRACE_CODE_HDD_CFG80211_SET_BEACON,
-			 pAdapter->sessionId, pHddStaCtx->conn_info.authType));
-	hddLog(LOG1, FL("Device_mode %s(%d)"),
-		hdd_device_mode_to_string(pAdapter->device_mode),
-		pAdapter->device_mode);
-
-	pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-	status = wlan_hdd_validate_context(pHddCtx);
-
-	if (0 != status)
-		return status;
-
-	if ((pAdapter->device_mode == WLAN_HDD_SOFTAP) ||
-	    (pAdapter->device_mode == WLAN_HDD_P2P_GO)) {
-		beacon_data_t *old, *new;
-
-		old = pAdapter->sessionCtx.ap.beacon;
-
-		if (!old) {
-			hddLog(LOGE,
-				FL("session(%d) old and new heads points to NULL"),
-				pAdapter->sessionId);
-			return -ENOENT;
-		}
-
-		status =
-			wlan_hdd_cfg80211_alloc_new_beacon(pAdapter,
-							   &new, params);
-
-		if (status != CDF_STATUS_SUCCESS) {
-			hddLog(LOGE,
-				FL("Error!!! Allocating the new beacon"));
-			return -EINVAL;
-		}
-
-		pAdapter->sessionCtx.ap.beacon = new;
-		status = wlan_hdd_cfg80211_start_bss(pAdapter, params);
-	}
-
-	EXIT();
-	return status;
-}
-
-/**
- * wlan_hdd_cfg80211_set_beacon() - set beacon in sap mode
- * @wiphy: Pointer to wiphy
- * @dev: Pointer to netdev
- * @param: Pointer to beacon parameters
- *
- * Return: zero for success non-zero for failure
- */
-int wlan_hdd_cfg80211_set_beacon(struct wiphy *wiphy,
-				struct net_device *dev,
-				struct beacon_parameters *params)
-{
-	int ret;
-
-	cds_ssr_protect(__func__);
-	ret = __wlan_hdd_cfg80211_set_beacon(wiphy, dev, params);
-	cds_ssr_unprotect(__func__);
-
-	return ret;
-}
-
-#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0)) */
-
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
-/**
- * __wlan_hdd_cfg80211_del_beacon() - stop soft ap
- * @wiphy: Pointer to wiphy structure
- * @dev: Pointer to net_device structure
- *
- * Return: 0 for success non-zero for failure
- */
-static int __wlan_hdd_cfg80211_del_beacon(struct wiphy *wiphy,
-					struct net_device *dev)
-#else
 /**
  * __wlan_hdd_cfg80211_stop_ap() - stop soft ap
  * @wiphy: Pointer to wiphy structure
@@ -8041,7 +7852,6 @@ static int __wlan_hdd_cfg80211_del_beacon(struct wiphy *wiphy,
  */
 static int __wlan_hdd_cfg80211_stop_ap(struct wiphy *wiphy,
 					struct net_device *dev)
-#endif
 {
 	hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
 	hdd_context_t *pHddCtx = NULL;
@@ -8057,7 +7867,7 @@ static int __wlan_hdd_cfg80211_stop_ap(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -8166,8 +7976,7 @@ static int __wlan_hdd_cfg80211_stop_ap(struct wiphy *wiphy,
 		}
 		clear_bit(SOFTAP_BSS_STARTED, &pAdapter->event_flags);
 		/*BSS stopped, clear the active sessions for this device mode*/
-		cds_decr_session_set_pcl(pHddCtx,
-						pAdapter->device_mode,
+		cds_decr_session_set_pcl(pAdapter->device_mode,
 						pAdapter->sessionId);
 		pAdapter->sessionCtx.ap.beacon = NULL;
 		kfree(old);
@@ -8211,7 +8020,6 @@ static int __wlan_hdd_cfg80211_stop_ap(struct wiphy *wiphy,
 	return ret;
 }
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
 /**
  * wlan_hdd_get_channel_bw() - get channel bandwidth
  * @width: input channel width in nl80211_chan_width value
@@ -8247,28 +8055,7 @@ static enum hw_mode_bandwidth wlan_hdd_get_channel_bw(
 
 	return ch_bw;
 }
-#endif
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0)) && !defined(WITH_BACKPORTS)
-/**
- * wlan_hdd_cfg80211_del_beacon() - delete beacon in sap mode
- * @wiphy: Pointer to wiphy
- * @dev: Pointer to netdev
- *
- * Return: zero for success non-zero for failure
- */
-int wlan_hdd_cfg80211_del_beacon(struct wiphy *wiphy,
-				struct net_device *dev)
-{
-	int ret;
-
-	cds_ssr_protect(__func__);
-	ret = __wlan_hdd_cfg80211_del_beacon(wiphy, dev);
-	cds_ssr_unprotect(__func__);
-
-	return ret;
-}
-#else
 /**
  * wlan_hdd_cfg80211_stop_ap() - stop sap
  * @wiphy: Pointer to wiphy
@@ -8287,9 +8074,7 @@ int wlan_hdd_cfg80211_stop_ap(struct wiphy *wiphy,
 
 	return ret;
 }
-#endif
 
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 3, 0))
 /**
  * __wlan_hdd_cfg80211_start_ap() - start soft ap mode
  * @wiphy: Pointer to wiphy structure
@@ -8310,7 +8095,7 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -8333,16 +8118,12 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
 	       hdd_device_mode_to_string(pAdapter->device_mode),
 	       pAdapter->device_mode);
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
 	channel_width = wlan_hdd_get_channel_bw(params->chandef.width);
 	channel = ieee80211_frequency_to_channel(
 				params->chandef.chan->center_freq);
-#else
-	channel_width = HW_MODE_20_MHZ;
-	channel = 0;
-#endif
+
 	/* check if concurrency is allowed */
-	if (!cds_allow_concurrency(pHddCtx,
+	if (!cds_allow_concurrency(
 				cds_convert_device_mode_to_hdd_type(
 				pAdapter->device_mode),
 				channel,
@@ -8376,9 +8157,7 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
 	    || (pAdapter->device_mode == WLAN_HDD_P2P_GO)
 	    ) {
 		beacon_data_t *old, *new;
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
 		enum nl80211_channel_type channel_type;
-#endif
 
 		old = pAdapter->sessionCtx.ap.beacon;
 
@@ -8421,10 +8200,8 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
 			pAdapter->sessionCtx.ap.sapConfig.authType =
 				eSAP_AUTO_SWITCH;
 		}
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
 		pAdapter->sessionCtx.ap.sapConfig.ch_width_orig =
 						params->chandef.width;
-#endif
 		status =
 			wlan_hdd_cfg80211_start_bss(pAdapter,
 				&params->beacon,
@@ -8476,7 +8253,7 @@ static int __wlan_hdd_cfg80211_change_beacon(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -8541,5 +8318,3 @@ int wlan_hdd_cfg80211_change_beacon(struct wiphy *wiphy,
 
 	return ret;
 }
-
-#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 3, 0)) */
diff --git a/core/hdd/src/wlan_hdd_hostapd.h b/core/hdd/src/wlan_hdd_hostapd.h
index f4f72c82d658..46dc54ebc8f9 100644
--- a/core/hdd/src/wlan_hdd_hostapd.h
+++ b/core/hdd/src/wlan_hdd_hostapd.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -58,7 +58,8 @@ eCsrAuthType
 hdd_translate_rsn_to_csr_auth_type(uint8_t auth_suite[4]);
 
 int hdd_softap_set_channel_change(struct net_device *dev,
-					  int target_channel);
+				int target_channel,
+				phy_ch_width target_bw);
 
 eCsrEncryptionType
 hdd_translate_rsn_to_csr_encryption_type(uint8_t cipher_suite[4]);
@@ -99,29 +100,13 @@ CDF_STATUS hdd_set_sap_ht2040_mode(hdd_adapter_t *pHostapdAdapter,
 				   uint8_t channel_type);
 #endif
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
-int wlan_hdd_cfg80211_add_beacon(struct wiphy *wiphy,
-				 struct net_device *dev,
-				 struct beacon_parameters *params);
 
-int wlan_hdd_cfg80211_set_beacon(struct wiphy *wiphy,
-				 struct net_device *dev,
-				 struct beacon_parameters *params);
-#endif
-
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
-int wlan_hdd_cfg80211_del_beacon(struct wiphy *wiphy,
-				 struct net_device *dev);
-#else
 int wlan_hdd_cfg80211_stop_ap(struct wiphy *wiphy,
 			      struct net_device *dev);
-#endif
 
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 3, 0))
 int wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
 			       struct net_device *dev,
 			       struct cfg80211_ap_settings *params);
-#endif
 
 int wlan_hdd_cfg80211_change_beacon(struct wiphy *wiphy,
 				    struct net_device *dev,
diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c
index c593a6a00d1a..a81b3d6676da 100644
--- a/core/hdd/src/wlan_hdd_ioctl.c
+++ b/core/hdd/src/wlan_hdd_ioctl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -34,6 +34,7 @@
 #include "wlan_hdd_power.h"
 #include "wlan_hdd_driver_ops.h"
 #include "cds_concurrency.h"
+#include "wlan_hdd_hostapd.h"
 
 #include "wlan_hdd_p2p.h"
 #include <linux/ctype.h>
@@ -260,7 +261,6 @@ CDF_STATUS hdd_get_tsm_stats(hdd_adapter_t *adapter,
 }
 #endif /*FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 static void hdd_get_band_helper(hdd_context_t *hdd_ctx, int *pBand)
 {
 	eCsrBand band = -1;
@@ -520,9 +520,6 @@ static int hdd_parse_reassoc_command_v1_data(const uint8_t *pValue,
 	return 0;
 }
 
-#endif /* WLAN_FEATURE_VOWIFI_11R || FEATURE_WLAN_ESE || FEATURE_WLAN_ESE FEATURE_WLAN_LFR */
-
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 /**
  * hdd_reassoc() - perform a userspace-directed reassoc
  * @adapter:	Adapter upon which the command was received
@@ -695,9 +692,6 @@ static int hdd_parse_reassoc(hdd_adapter_t *adapter, const char *command)
 	return ret;
 }
 
-#endif /* WLAN_FEATURE_VOWIFI_11R || FEATURE_WLAN_ESE || FEATURE_WLAN_ESE FEATURE_WLAN_LFR */
-
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 /**
  * hdd_sendactionframe() - send a userspace-supplied action frame
  * @adapter:	Adapter upon which the command was received
@@ -836,15 +830,9 @@ hdd_sendactionframe(hdd_adapter_t *adapter, const uint8_t *bssid,
 	ret = wlan_hdd_mgmt_tx(NULL, &adapter->wdev, &params, &cookie);
 #else
 	ret = wlan_hdd_mgmt_tx(NULL,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 			       &(adapter->wdev),
-#else
-			       adapter->dev,
-#endif
 			       &chan, 0,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-			       NL80211_CHAN_HT20, 1,
-#endif
+
 			       dwell_time, frame, frame_len, 1, 1, &cookie);
 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
 
@@ -979,9 +967,6 @@ hdd_parse_sendactionframe(hdd_adapter_t *adapter, const char *command)
 	return ret;
 }
 
-#endif /* WLAN_FEATURE_VOWIFI_11R || FEATURE_WLAN_ESE || FEATURE_WLAN_ESE FEATURE_WLAN_LFR */
-
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 /**
  * hdd_parse_channellist() - HDD Parse channel list
  * @pValue:		Pointer to input channel list
@@ -1277,7 +1262,6 @@ hdd_parse_set_roam_scan_channels(hdd_adapter_t *adapter, const char *command)
 
 	return ret;
 }
-#endif /* WLAN_FEATURE_VOWIFI_11R || FEATURE_WLAN_ESE || FEATURE_WLAN_LFR */
 
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 /**
@@ -1723,7 +1707,7 @@ static int hdd_set_app_type1_parser(hdd_adapter_t *adapter,
 	tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(adapter);
 	char id[20], password[20];
 	tSirAppType1Params params;
-	int rc, i;
+	int rc;
 
 	rc = wlan_hdd_validate_context(hdd_ctx);
 	if (0 != rc) {
@@ -1739,9 +1723,7 @@ static int hdd_set_app_type1_parser(hdd_adapter_t *adapter,
 
 	memset(&params, 0, sizeof(tSirAppType1Params));
 	params.vdev_id = adapter->sessionId;
-	for (i = 0; i < ETHER_ADDR_LEN; i++)
-		params.wakee_mac_addr[i] =
-			adapter->macAddressCurrent.bytes[i];
+	cdf_copy_macaddr(&params.wakee_mac_addr, &adapter->macAddressCurrent);
 
 	params.id_length = strlen(id);
 	cdf_mem_copy(params.identification_id, id, params.id_length);
@@ -1750,7 +1732,7 @@ static int hdd_set_app_type1_parser(hdd_adapter_t *adapter,
 
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO,
 		  "%s: %d %pM %.8s %u %.16s %u",
-		  __func__, params.vdev_id, params.wakee_mac_addr,
+		  __func__, params.vdev_id, params.wakee_mac_addr.bytes,
 		  params.identification_id, params.id_length,
 		  params.password, params.pass_length);
 
@@ -1782,7 +1764,7 @@ static int hdd_set_app_type2_parser(hdd_adapter_t *adapter,
 	hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 	tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(adapter);
 	char mac_addr[20], rc4_key[20];
-	unsigned int gateway_mac[6], i;
+	unsigned int gateway_mac[CDF_MAC_ADDR_SIZE];
 	tSirAppType2Params params;
 	int ret;
 
@@ -1831,8 +1813,8 @@ static int hdd_set_app_type2_parser(hdd_adapter_t *adapter,
 		return -EINVAL;
 	}
 
-	for (i = 0; i < ETHER_ADDR_LEN; i++)
-		params.gateway_mac[i] = (uint8_t) gateway_mac[i];
+	cdf_mem_copy(&params.gateway_mac.bytes, (uint8_t *) &gateway_mac,
+			CDF_MAC_ADDR_SIZE);
 
 	params.rc4_key_len = strlen(rc4_key);
 	cdf_mem_copy(params.rc4_key, rc4_key, params.rc4_key_len);
@@ -2120,15 +2102,15 @@ static void hdd_get_link_status_cb(uint8_t status, void *context)
 static int wlan_hdd_get_link_status(hdd_adapter_t *adapter)
 {
 
-	hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 	hdd_station_ctx_t *pHddStaCtx =
 				WLAN_HDD_GET_STATION_CTX_PTR(adapter);
 	struct statsContext context;
 	CDF_STATUS hstatus;
 	unsigned long rc;
 
-	if (hdd_ctx->isLogpInProgress) {
-		hddLog(LOGW, FL("LOGP in Progress. Ignore!!!"));
+	if (cds_is_driver_recovering()) {
+		hdd_warn("Recovery in Progress. State: 0x%x Ignore!!!",
+			 cds_get_driver_state());
 		return 0;
 	}
 
@@ -4669,7 +4651,7 @@ static int drv_cmd_miracast(hdd_adapter_t *adapter,
 		return -EBUSY;
 	}
 
-	if (cds_is_mcc_in_24G(pHddCtx))
+	if (cds_is_mcc_in_24G())
 		return cds_set_mas(adapter, filterType);
 
 exit:
@@ -5308,6 +5290,12 @@ static int drv_cmd_tdls_off_channel(hdd_adapter_t *adapter,
 	if (ret != 1)
 		return -EINVAL;
 
+	if (CDS_IS_DFS_CH(set_value)) {
+		hdd_err("DFS channel %d is passed for hdd_set_tdls_offchannel",
+		    set_value);
+		return -EINVAL;
+	}
+
 	hddLog(LOG1, FL("Tdls offchannel num: %d"), set_value);
 
 	ret = hdd_set_tdls_offchannel(hdd_ctx, set_value);
@@ -5956,6 +5944,123 @@ static int drv_cmd_set_fcc_channel(hdd_adapter_t *adapter,
 	return ret;
 }
 
+/**
+ * hdd_parse_set_channel_switch_command() - Parse and validate CHANNEL_SWITCH
+ * command
+ * @value: Pointer to the command
+ * @chan_number: Pointer to the channel number
+ * @chan_bw: Pointer to the channel bandwidth
+ *
+ * Parses and provides the channel number and channel width from the input
+ * command which is expected to be of the format: CHANNEL_SWITCH <CH> <BW>
+ * <CH> is channel number to move (where 1 = channel 1, 149 = channel 149, ...)
+ * <BW> is bandwidth to move (where 20 = BW 20, 40 = BW 40, 80 = BW 80)
+ *
+ * Return: 0 for success, non-zero for failure
+ */
+static int hdd_parse_set_channel_switch_command(uint8_t *value,
+					 uint32_t *chan_number,
+					 uint32_t *chan_bw)
+{
+	const uint8_t *in_ptr = value;
+	int ret;
+
+	in_ptr = strnchr(value, strlen(value), SPACE_ASCII_VALUE);
+
+	/* no argument after the command */
+	if (NULL == in_ptr) {
+		hdd_err("No argument after the command");
+		return -EINVAL;
+	}
+
+	/* no space after the command */
+	if (SPACE_ASCII_VALUE != *in_ptr) {
+		hdd_err("No space after the command ");
+		return -EINVAL;
+	}
+
+	/* remove empty spaces and move the next argument */
+	while ((SPACE_ASCII_VALUE == *in_ptr) && ('\0' != *in_ptr))
+		in_ptr++;
+
+	/* no argument followed by spaces */
+	if ('\0' == *in_ptr) {
+		hdd_err("No argument followed by spaces");
+		return -EINVAL;
+	}
+
+	/* get the two arguments: channel number and bandwidth */
+	ret = sscanf(in_ptr, "%u %u", chan_number, chan_bw);
+	if (ret != 2) {
+		hdd_err("Arguments retrieval from cmd string failed");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * drv_cmd_set_channel_switch() - Switch SAP/P2P-GO operating channel
+ * @adapter: HDD adapter
+ * @hdd_ctx: HDD context
+ * @command: Pointer to the input command CHANNEL_SWITCH
+ * @command_len: Command len
+ * @priv_data: Private data
+ *
+ * Handles private IOCTL CHANNEL_SWITCH command to switch the operating channel
+ * of SAP/P2P-GO
+ *
+ * Return: 0 for success, non-zero for failure
+ */
+static int drv_cmd_set_channel_switch(hdd_adapter_t *adapter,
+				   hdd_context_t *hdd_ctx,
+				   uint8_t *command,
+				   uint8_t command_len,
+				   hdd_priv_data_t *priv_data)
+{
+	struct net_device *dev = adapter->dev;
+	int status;
+	uint32_t chan_number = 0, chan_bw = 0;
+	uint8_t *value = command;
+	phy_ch_width width;
+
+	if ((adapter->device_mode != WLAN_HDD_P2P_GO) &&
+		(adapter->device_mode != WLAN_HDD_SOFTAP)) {
+		hdd_err("IOCTL CHANNEL_SWITCH not supported for mode %d",
+			adapter->device_mode);
+		return -EINVAL;
+	}
+
+	status = hdd_parse_set_channel_switch_command(value,
+							&chan_number, &chan_bw);
+	if (status) {
+		hdd_err("Invalid CHANNEL_SWITCH command");
+		return status;
+	}
+
+	if ((chan_bw != 20) && (chan_bw != 40) && (chan_bw != 80)) {
+		hdd_err("BW %d is not allowed for CHANNEL_SWITCH", chan_bw);
+		return -EINVAL;
+	}
+
+	if (chan_bw == 80)
+		width = CH_WIDTH_80MHZ;
+	else if (chan_bw == 40)
+		width = CH_WIDTH_40MHZ;
+	else
+		width = CH_WIDTH_20MHZ;
+
+	hdd_info("CH:%d BW:%d", chan_number, chan_bw);
+
+	status = hdd_softap_set_channel_change(dev, chan_number, width);
+	if (status) {
+		hdd_err("Set channel change fail");
+		return status;
+	}
+
+	return 0;
+}
+
 /*
  * The following table contains all supported WLAN HDD
  * IOCTL driver commands and the handler for each of them.
@@ -5971,23 +6076,16 @@ static const hdd_drv_cmd_t hdd_drv_cmds[] = {
 	{"SET_AP_WPS_P2P_IE",         drv_cmd_dummy},
 	{"BTCOEXSCAN",                drv_cmd_dummy},
 	{"RXFILTER",                  drv_cmd_dummy},
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	{"SETROAMTRIGGER",            drv_cmd_set_roam_trigger},
 	{"GETROAMTRIGGER",            drv_cmd_get_roam_trigger},
 	{"SETROAMSCANPERIOD",         drv_cmd_set_roam_scan_period},
 	{"GETROAMSCANPERIOD",         drv_cmd_get_roam_scan_period},
 	{"SETROAMSCANREFRESHPERIOD",  drv_cmd_set_roam_scan_refresh_period},
 	{"GETROAMSCANREFRESHPERIOD",  drv_cmd_get_roam_scan_refresh_period},
-#ifdef FEATURE_WLAN_LFR
 	{"SETROAMMODE",               drv_cmd_set_roam_mode},
 	{"GETROAMMODE",               drv_cmd_get_roam_mode},
-#endif
-#endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	{"SETROAMDELTA",              drv_cmd_set_roam_delta},
 	{"GETROAMDELTA",              drv_cmd_get_roam_delta},
-#endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	{"GETBAND",                   drv_cmd_get_band},
 	{"SETROAMSCANCHANNELS",       drv_cmd_set_roam_scan_channels},
 	{"GETROAMSCANCHANNELS",       drv_cmd_get_roam_scan_channels},
@@ -6015,10 +6113,7 @@ static const hdd_drv_cmd_t hdd_drv_cmds[] = {
 	{"GETOPPORTUNISTICRSSIDIFF",  drv_cmd_get_opportunistic_rssi_diff},
 	{"SETROAMRESCANRSSIDIFF",     drv_cmd_set_roam_rescan_rssi_diff},
 	{"GETROAMRESCANRSSIDIFF",     drv_cmd_get_roam_rescan_rssi_diff},
-#endif /* WLAN_FEATURE_VOWIFI_11R || FEATURE_WLAN_ESE || FEATURE_WLAN_LFR */
-#ifdef FEATURE_WLAN_LFR
 	{"SETFASTROAM",               drv_cmd_set_fast_roam},
-#endif
 #ifdef WLAN_FEATURE_VOWIFI_11R
 	{"SETFASTTRANSITION",         drv_cmd_set_fast_transition},
 	{"FASTREASSOC",               drv_cmd_fast_reassoc},
@@ -6070,6 +6165,7 @@ static const hdd_drv_cmd_t hdd_drv_cmds[] = {
 	{"RXFILTER-REMOVE",           drv_cmd_rx_filter_remove},
 	{"RXFILTER-ADD",              drv_cmd_rx_filter_add},
 	{"SET_FCC_CHANNEL",           drv_cmd_set_fcc_channel},
+	{"CHANNEL_SWITCH",            drv_cmd_set_channel_switch},
 };
 
 /**
@@ -6141,7 +6237,7 @@ static int hdd_driver_command(hdd_adapter_t *adapter,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -6279,7 +6375,7 @@ static int __hdd_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 		goto exit;
 	}
 #if  defined(QCA_WIFI_FTM) && defined(LINUX_QCMBR)
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		if (SIOCIOCTLTX99 == cmd) {
 			ret = wlan_hdd_qcmbr_unified_ioctl(adapter, ifr);
 			goto exit;
diff --git a/core/hdd/src/wlan_hdd_ipa.c b/core/hdd/src/wlan_hdd_ipa.c
index ba20b1f4d07b..5d6cb265c65c 100644
--- a/core/hdd/src/wlan_hdd_ipa.c
+++ b/core/hdd/src/wlan_hdd_ipa.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1237,21 +1237,11 @@ hdd_ipa_uc_rm_notify_handler(void *context, enum ipa_rm_event event)
 			hdd_ipa_uc_enable_pipes(hdd_ipa);
 		}
 		cdf_mutex_release(&hdd_ipa->ipa_lock);
-		if (hdd_ipa->pending_cons_req) {
-			ipa_rm_notify_completion(IPA_RM_RESOURCE_GRANTED,
-						 IPA_RM_RESOURCE_WLAN_CONS);
-		}
-		hdd_ipa->pending_cons_req = false;
 		break;
 
 	case IPA_RM_RESOURCE_RELEASED:
 		/* Differed RM Released */
 		hdd_ipa->resource_unloading = false;
-		if (hdd_ipa->pending_cons_req) {
-			ipa_rm_notify_completion(IPA_RM_RESOURCE_RELEASED,
-						 IPA_RM_RESOURCE_WLAN_CONS);
-		}
-		hdd_ipa->pending_cons_req = false;
 		break;
 
 	default:
@@ -1377,6 +1367,11 @@ static void hdd_ipa_uc_op_cb(struct op_msg_type *op_msg, void *usr_ctxt)
 		if (HDD_IPA_UC_NUM_WDI_PIPE == hdd_ipa->activated_fw_pipe) {
 			hdd_ipa->resource_loading = false;
 			hdd_ipa_uc_proc_pending_event(hdd_ipa);
+			if (hdd_ipa->pending_cons_req)
+				ipa_rm_notify_completion(
+						IPA_RM_RESOURCE_GRANTED,
+						IPA_RM_RESOURCE_WLAN_CONS);
+			hdd_ipa->pending_cons_req = false;
 		}
 		cdf_mutex_release(&hdd_ipa->ipa_lock);
 	}
@@ -1387,16 +1382,14 @@ static void hdd_ipa_uc_op_cb(struct op_msg_type *op_msg, void *usr_ctxt)
 		hdd_ipa->activated_fw_pipe--;
 		if (!hdd_ipa->activated_fw_pipe) {
 			hdd_ipa_uc_disable_pipes(hdd_ipa);
-			if ((hdd_ipa_is_rm_enabled(hdd_ipa->hdd_ctx)) &&
-			(!ipa_rm_release_resource(IPA_RM_RESOURCE_WLAN_PROD))) {
-				/* Sync return success from IPA
-				* Enable/resume all the PIPEs */
-				hdd_ipa->resource_unloading = false;
-				hdd_ipa_uc_proc_pending_event(hdd_ipa);
-			} else {
-				hdd_ipa->resource_unloading = false;
-				hdd_ipa_uc_proc_pending_event(hdd_ipa);
-			}
+			if (hdd_ipa_is_rm_enabled(hdd_ipa->hdd_ctx))
+				ipa_rm_release_resource(
+					IPA_RM_RESOURCE_WLAN_PROD);
+			/* Sync return success from IPA
+			* Enable/resume all the PIPEs */
+			hdd_ipa->resource_unloading = false;
+			hdd_ipa_uc_proc_pending_event(hdd_ipa);
+			hdd_ipa->pending_cons_req = false;
 		}
 		cdf_mutex_release(&hdd_ipa->ipa_lock);
 	}
@@ -1410,19 +1403,19 @@ static void hdd_ipa_uc_op_cb(struct op_msg_type *op_msg, void *usr_ctxt)
 			  "CE RING BASE: 0x%llx\n"
 			  "CE RING SIZE: %d\n"
 			  "CE REG ADDR : 0x%llx",
-			  hdd_ipa->ce_sr_base_paddr,
+			  (unsigned long long)hdd_ipa->ce_sr_base_paddr,
 			  hdd_ipa->ce_sr_ring_size,
-			  hdd_ipa->ce_reg_paddr);
+			  (unsigned long long)hdd_ipa->ce_reg_paddr);
 		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
 			  "==== IPA_UC WLAN_HOST TX ====\n"
 			  "COMP RING BASE: 0x%llx\n"
 			  "COMP RING SIZE: %d\n"
 			  "NUM ALLOC BUF: %d\n"
 			  "COMP RING DBELL : 0x%llx",
-			  hdd_ipa->tx_comp_ring_base_paddr,
+			  (unsigned long long)hdd_ipa->tx_comp_ring_base_paddr,
 			  hdd_ipa->tx_comp_ring_size,
 			  hdd_ipa->tx_num_alloc_buffer,
-			  hdd_ipa->tx_comp_doorbell_paddr);
+			  (unsigned long long)hdd_ipa->tx_comp_doorbell_paddr);
 		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
 			  "==== IPA_UC WLAN_HOST RX ====\n"
 			  "IND RING BASE: 0x%llx\n"
@@ -1432,13 +1425,13 @@ static void hdd_ipa_uc_op_cb(struct op_msg_type *op_msg, void *usr_ctxt)
 			  "NUM EXCP PKT : %llu\n"
 			  "NUM TX BCMC : %llu\n"
 			  "NUM TX BCMC ERR : %llu",
-			  hdd_ipa->rx_rdy_ring_base_paddr,
+			  (unsigned long long)hdd_ipa->rx_rdy_ring_base_paddr,
 			  hdd_ipa->rx_rdy_ring_size,
-			  hdd_ipa->rx_ready_doorbell_paddr,
-			  hdd_ipa->rx_proc_done_idx_paddr,
+			  (unsigned long long)hdd_ipa->rx_ready_doorbell_paddr,
+			  (unsigned long long)hdd_ipa->rx_proc_done_idx_paddr,
 			  hdd_ipa->stats.num_rx_excep,
 			  hdd_ipa->stats.num_tx_bcmc,
-			  hdd_ipa->stats.num_tx_bcmc_err);
+			  (unsigned long long)hdd_ipa->stats.num_tx_bcmc_err);
 		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
 			  "==== IPA_UC WLAN_HOST CONTROL ====\n"
 			  "SAP NUM STAs: %d\n"
@@ -1733,6 +1726,28 @@ end:
 }
 
 /**
+ * hdd_ipa_init_uc_op_work - init ipa uc op work
+ * @work: struct work_struct
+ * @work_handler: work_handler
+ *
+ * Return: none
+ */
+#ifdef CONFIG_CNSS
+static void hdd_ipa_init_uc_op_work(struct work_struct *work,
+					work_func_t work_handler)
+{
+	cnss_init_work(work, work_handler);
+}
+#else
+static void hdd_ipa_init_uc_op_work(struct work_struct *work,
+					work_func_t work_handler)
+{
+	INIT_WORK(work, work_handler);
+}
+#endif
+
+
+/**
  * hdd_ipa_uc_ol_init() - Initialize IPA uC offload
  * @hdd_ctx: Global HDD context
  *
@@ -1835,7 +1850,7 @@ static CDF_STATUS hdd_ipa_uc_ol_init(hdd_context_t *hdd_ctx)
 				  hdd_ipa_uc_op_event_handler, (void *)hdd_ctx);
 
 	for (i = 0; i < HDD_IPA_UC_OPCODE_MAX; i++) {
-		cnss_init_work(&ipa_ctxt->uc_op_work[i].work,
+		hdd_ipa_init_uc_op_work(&ipa_ctxt->uc_op_work[i].work,
 			hdd_ipa_uc_fw_op_event_handler);
 		ipa_ctxt->uc_op_work[i].msg = NULL;
 	}
@@ -2313,6 +2328,27 @@ int hdd_ipa_set_perf_level(hdd_context_t *hdd_ctx, uint64_t tx_packets,
 }
 
 /**
+ * hdd_ipa_init_uc_rm_work - init ipa uc resource manager work
+ * @work: struct work_struct
+ * @work_handler: work_handler
+ *
+ * Return: none
+ */
+#ifdef CONFIG_CNSS
+static void  hdd_ipa_init_uc_rm_work(struct work_struct *work,
+					work_func_t work_handler)
+{
+	cnss_init_work(work, work_handler);
+}
+#else
+static void hdd_ipa_init_uc_rm_work(struct work_struct *work,
+					work_func_t work_handler)
+{
+	INIT_WORK(work, work_handler);
+}
+#endif
+
+/**
  * hdd_ipa_setup_rm() - Setup IPA resource management
  * @hdd_ipa: Global HDD IPA context
  *
@@ -2326,7 +2362,8 @@ static int hdd_ipa_setup_rm(struct hdd_ipa_priv *hdd_ipa)
 	if (!hdd_ipa_is_rm_enabled(hdd_ipa->hdd_ctx))
 		return 0;
 
-	cnss_init_work(&hdd_ipa->uc_rm_work.work, hdd_ipa_uc_rm_notify_defer);
+	hdd_ipa_init_uc_rm_work(&hdd_ipa->uc_rm_work.work,
+		hdd_ipa_uc_rm_notify_defer);
 	memset(&create_params, 0, sizeof(create_params));
 	create_params.name = IPA_RM_RESOURCE_WLAN_PROD;
 	create_params.reg_params.user_data = hdd_ipa;
@@ -2461,7 +2498,7 @@ static void hdd_ipa_send_skb_to_network(cdf_nbuf_t skb,
 		return;
 	}
 
-	if (hdd_ipa->hdd_ctx->isUnloadInProgress) {
+	if (cds_is_driver_unloading()) {
 		HDD_IPA_INCREASE_INTERNAL_DROP_COUNT(hdd_ipa);
 		cdf_nbuf_free(skb);
 		return;
@@ -3752,7 +3789,7 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 		if ((!hdd_ipa->num_iface) &&
 			(HDD_IPA_UC_NUM_WDI_PIPE ==
 				hdd_ipa->activated_fw_pipe)) {
-			if (hdd_ipa->hdd_ctx->isUnloadInProgress) {
+			if (cds_is_driver_unloading()) {
 				/*
 				 * We disable WDI pipes directly here since
 				 * IPA_OPCODE_TX/RX_SUSPEND message will not be
@@ -3795,6 +3832,23 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 			cdf_mutex_release(&hdd_ipa->event_lock);
 			return 0;
 		}
+
+		/* Enable IPA UC Data PIPEs when first STA connected */
+		if ((0 == hdd_ipa->sap_num_connected_sta) &&
+		   (!hdd_ipa_uc_sta_is_enabled(hdd_ipa->hdd_ctx) ||
+		   !hdd_ipa->sta_connected)) {
+			ret = hdd_ipa_uc_handle_first_con(hdd_ipa);
+			if (ret) {
+				cdf_mutex_release(&hdd_ipa->event_lock);
+				HDD_IPA_LOG(CDF_TRACE_LEVEL_ERROR,
+					    "%s: handle 1st con ret %d",
+					    adapter->dev->name, ret);
+				return ret;
+			}
+		}
+
+		hdd_ipa->sap_num_connected_sta++;
+
 		cdf_mutex_release(&hdd_ipa->event_lock);
 
 		meta.msg_type = type;
@@ -3830,27 +3884,6 @@ int hdd_ipa_wlan_evt(hdd_adapter_t *adapter, uint8_t sta_id,
 			return ret;
 		}
 		hdd_ipa->stats.num_send_msg++;
-
-		cdf_mutex_acquire(&hdd_ipa->event_lock);
-		/* Enable IPA UC Data PIPEs when first STA connected */
-		if ((0 == hdd_ipa->sap_num_connected_sta)
-			&& (!hdd_ipa_uc_sta_is_enabled(hdd_ipa->hdd_ctx)
-			|| !hdd_ipa->sta_connected)) {
-			ret = hdd_ipa_uc_handle_first_con(hdd_ipa);
-			if (ret) {
-				cdf_mutex_release(&hdd_ipa->event_lock);
-				HDD_IPA_LOG(CDF_TRACE_LEVEL_ERROR,
-					    "%s: handle 1st con ret %d",
-					    adapter->dev->name, ret);
-				return ret;
-			}
-		}
-
-		hdd_ipa->sap_num_connected_sta++;
-		hdd_ipa->pending_cons_req = false;
-
-		cdf_mutex_release(&hdd_ipa->event_lock);
-
 		return ret;
 
 	case WLAN_CLIENT_DISCONNECT:
diff --git a/core/hdd/src/wlan_hdd_lro.c b/core/hdd/src/wlan_hdd_lro.c
index a84e839b6967..5ff2b9deeddb 100644
--- a/core/hdd/src/wlan_hdd_lro.c
+++ b/core/hdd/src/wlan_hdd_lro.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -30,6 +30,9 @@
  * WLAN HDD LRO interface implementation
  */
 
+/* denote that this file does not allow legacy hddLog */
+#define HDD_DISALLOW_LEGACY_HDDLOG 1
+
 #include <wlan_hdd_includes.h>
 #include <cdf_types.h>
 #include <wlan_hdd_lro.h>
@@ -458,7 +461,7 @@ int hdd_lro_init(hdd_context_t *hdd_ctx)
 	struct wma_lro_config_cmd_t lro_config;
 
 	if (!hdd_ctx->config->lro_enable) {
-		hdd_err(FL("LRO Disabled"));
+		hdd_err("LRO Disabled");
 		return 0;
 	}
 
diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c
index 3edc5ad318c5..53f052808af3 100644
--- a/core/hdd/src/wlan_hdd_main.c
+++ b/core/hdd/src/wlan_hdd_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -104,6 +104,7 @@ extern int hdd_hostapd_stop(struct net_device *dev);
 #include "wma.h"
 #include "cds_concurrency.h"
 #include "wlan_hdd_green_ap.h"
+#include "platform_icnss.h"
 
 #ifdef MODULE
 #define WLAN_MODULE_NAME  module_name(THIS_MODULE)
@@ -123,7 +124,6 @@ extern int hdd_hostapd_stop(struct net_device *dev);
 #define MEMORY_DEBUG_STR ""
 #endif
 
-#define DISABLE_KRAIT_IDLE_PS_VAL	1
 /* the Android framework expects this param even though we don't use it */
 #define BUF_LEN 20
 static char fwpath_buffer[BUF_LEN];
@@ -147,8 +147,6 @@ static int wlan_hdd_inited;
 DEFINE_SPINLOCK(hdd_context_lock);
 
 static cdf_wake_lock_t wlan_wake_lock;
-/* set when SSR is needed after unload */
-static e_hdd_ssr_required is_ssr_required = HDD_SSR_NOT_REQUIRED;
 
 #define WOW_MAX_FILTER_LISTS 1
 #define WOW_MAX_FILTERS_PER_LIST 4
@@ -175,7 +173,6 @@ static const struct wiphy_wowlan_support wowlan_support_reg_init = {
 
 struct sock *cesium_nl_srv_sock;
 
-struct completion wlan_start_comp;
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
 void wlan_hdd_auto_shutdown_cb(void);
 #endif
@@ -235,6 +232,77 @@ const char *hdd_device_mode_to_string(uint8_t device_mode)
 	}
 }
 
+/**
+ * hdd_validate_channel_and_bandwidth() - Validate the channel-bandwidth combo
+ * @adapter: HDD adapter
+ * @chan_number: Channel number
+ * @chan_bw: Bandwidth
+ *
+ * Checks if the given bandwidth is valid for the given channel number.
+ *
+ * Return: 0 for success, non-zero for failure
+ */
+int hdd_validate_channel_and_bandwidth(hdd_adapter_t *adapter,
+		uint32_t chan_number,
+		phy_ch_width chan_bw)
+{
+	uint8_t chan[WNI_CFG_VALID_CHANNEL_LIST_LEN];
+	uint32_t len = WNI_CFG_VALID_CHANNEL_LIST_LEN, i;
+	bool found = false;
+	tHalHandle hal;
+
+	hal = WLAN_HDD_GET_HAL_CTX(adapter);
+	if (!hal) {
+		hdd_err("Invalid HAL context");
+		return -EINVAL;
+	}
+
+	if (0 != sme_cfg_get_str(hal, WNI_CFG_VALID_CHANNEL_LIST, chan, &len)) {
+		hdd_err("No valid channel list");
+		return -EOPNOTSUPP;
+	}
+
+	for (i = 0; i < len; i++) {
+		if (chan[i] == chan_number) {
+			found = true;
+			break;
+		}
+	}
+
+	if (found == false) {
+		hdd_err("Channel not in driver's valid channel list");
+		return -EOPNOTSUPP;
+	}
+
+	if ((!CDS_IS_CHANNEL_24GHZ(chan_number)) &&
+			(!CDS_IS_CHANNEL_5GHZ(chan_number))) {
+		hdd_err("CH %d is not in 2.4GHz or 5GHz", chan_number);
+		return -EINVAL;
+	}
+
+	if (CDS_IS_CHANNEL_24GHZ(chan_number)) {
+		if (chan_bw == CH_WIDTH_80MHZ) {
+			hdd_err("BW80 not possible in 2.4GHz band");
+			return -EINVAL;
+		}
+		if ((chan_bw != CH_WIDTH_20MHZ) && (chan_number == 14) &&
+				(chan_bw != CH_WIDTH_MAX)) {
+			hdd_err("Only BW20 possible on channel 14");
+			return -EINVAL;
+		}
+	}
+
+	if (CDS_IS_CHANNEL_5GHZ(chan_number)) {
+		if ((chan_bw != CH_WIDTH_20MHZ) && (chan_number == 165) &&
+				(chan_bw != CH_WIDTH_MAX)) {
+			hdd_err("Only BW20 possible on channel 165");
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
 static int __hdd_netdev_notifier_call(struct notifier_block *nb,
 				    unsigned long state, void *data)
 {
@@ -268,7 +336,7 @@ static int __hdd_netdev_notifier_call(struct notifier_block *nb,
 		CDF_ASSERT(0);
 		return NOTIFY_DONE;
 	}
-	if (hdd_ctx->isLogpInProgress)
+	if (cds_is_driver_recovering())
 		return NOTIFY_DONE;
 
 	hddLog(CDF_TRACE_LEVEL_INFO, FL("%s New Net Device State = %lu"),
@@ -348,17 +416,42 @@ struct notifier_block hdd_netdev_notifier = {
 
 /* variable to hold the insmod parameters */
 static int con_mode;
-#ifndef MODULE
-/*
- * current con_mode - used only for statically linked driver
- * con_mode is changed by userspace to indicate a mode change which will
- * result in calling the module exit and init functions. The module
- * exit function will clean up based on the value of con_mode prior to it
- * being changed by userspace. So curr_con_mode records the current con_mode
- * for exit when con_mode becomes the next mode for init
- */
+
+/* Variable to hold connection mode including module parameter con_mode */
 static int curr_con_mode;
-#endif
+
+/**
+ * hdd_map_nl_chan_width() - Map NL channel width to internal representation
+ * @ch_width: NL channel width
+ *
+ * Converts the NL channel width to the driver's internal representation
+ *
+ * Return: Converted channel width. In case of non matching NL channel width,
+ * CH_WIDTH_MAX will be returned.
+ */
+phy_ch_width hdd_map_nl_chan_width(enum nl80211_chan_width ch_width)
+{
+	switch (ch_width) {
+	case NL80211_CHAN_WIDTH_20_NOHT:
+	case NL80211_CHAN_WIDTH_20:
+		return CH_WIDTH_20MHZ;
+	case NL80211_CHAN_WIDTH_40:
+		return CH_WIDTH_40MHZ;
+		break;
+	case NL80211_CHAN_WIDTH_80:
+		return CH_WIDTH_80MHZ;
+	case NL80211_CHAN_WIDTH_80P80:
+		return CH_WIDTH_80P80MHZ;
+	case NL80211_CHAN_WIDTH_160:
+		return CH_WIDTH_160MHZ;
+	case NL80211_CHAN_WIDTH_5:
+	case NL80211_CHAN_WIDTH_10:
+	default:
+		hdd_err("Invalid channel width %d, setting to default",
+				ch_width);
+		return CH_WIDTH_MAX;
+	}
+}
 
 /* wlan_hdd_find_opclass() - Find operating class for a channel
  * @hal: handler to HAL
@@ -428,13 +521,15 @@ int wlan_hdd_validate_context(hdd_context_t *hdd_ctx)
 		return -ENODEV;
 	}
 
-	if (hdd_ctx->isLogpInProgress) {
-		hddLog(LOGE, FL("LOGP in Progress. Ignore!!!"));
+	if (cds_is_driver_recovering()) {
+		hdd_err("Recovery in Progress. State: 0x%x Ignore!!!",
+			 cds_get_driver_state());
 		return -EAGAIN;
 	}
 
-	if ((hdd_ctx->isLoadInProgress) || (hdd_ctx->isUnloadInProgress)) {
-		hddLog(LOGE, FL("Unloading/Loading in Progress. Ignore!!!"));
+	if (cds_is_load_or_unload_in_progress()) {
+		hdd_err("Unloading/Loading in Progress. Ignore!!!: 0x%x",
+			cds_get_driver_state());
 		return -EAGAIN;
 	}
 	return 0;
@@ -628,10 +723,6 @@ CDF_STATUS hdd_set_ibss_power_save_params(hdd_adapter_t *adapter)
 	return CDF_STATUS_SUCCESS;
 }
 
-#if defined(WLAN_FEATURE_VOWIFI_11R) ||\
-	defined(FEATURE_WLAN_ESE) ||\
-	defined(FEATURE_WLAN_LFR)
-
 #define INTF_MACADDR_MASK       0x7
 
 /**
@@ -1200,7 +1291,7 @@ void hdd_update_tgt_cfg(void *context, void *param)
 		       FL("ini BandCapability not supported by the target"));
 	}
 
-	if (!cds_is_logp_in_progress()) {
+	if (!cds_is_driver_recovering()) {
 		hdd_ctx->reg.reg_domain = cfg->reg_domain;
 		hdd_ctx->reg.eeprom_rd_ext = cfg->eeprom_rd_ext;
 	}
@@ -1225,6 +1316,8 @@ void hdd_update_tgt_cfg(void *context, void *param)
 	hdd_ctx->lpss_support = cfg->lpss_support;
 #endif
 
+	hdd_wlan_set_egap_support(hdd_ctx, cfg);
+
 	hdd_ctx->ap_arpns_support = cfg->ap_arpns_support;
 	hdd_update_tgt_services(hdd_ctx, &cfg->services);
 
@@ -1293,7 +1386,6 @@ bool hdd_dfs_indicate_radar(void *context, void *param)
 
 	return true;
 }
-#endif
 
 /**
  * hdd_is_valid_mac_address() - validate MAC address
@@ -1628,7 +1720,7 @@ static void __hdd_set_multicast_list(struct net_device *dev)
 	static const uint8_t ipv6_router_solicitation[]
 			= {0x33, 0x33, 0x00, 0x00, 0x00, 0x02};
 
-	if (CDF_FTM_MODE == hdd_get_conparam())
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam())
 		return;
 
 	ENTER();
@@ -1743,11 +1835,7 @@ static struct net_device_ops wlan_drv_ops = {
 	.ndo_set_mac_address = hdd_set_mac_address,
 	.ndo_select_queue = hdd_select_queue,
 #ifdef WLAN_FEATURE_PACKET_FILTERING
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 1, 0))
 	.ndo_set_rx_mode = hdd_set_multicast_list,
-#else
-	.ndo_set_multicast_list = hdd_set_multicast_list,
-#endif /* LINUX_VERSION_CODE */
 #endif
 };
 
@@ -1846,14 +1934,14 @@ static hdd_adapter_t *hdd_alloc_station_adapter(hdd_context_t *hdd_ctx,
 }
 
 CDF_STATUS hdd_register_interface(hdd_adapter_t *adapter,
-				  uint8_t rtnl_lock_held)
+				  bool rtnl_held)
 {
 	struct net_device *pWlanDev = adapter->dev;
 	/* hdd_station_ctx_t *pHddStaCtx = &adapter->sessionCtx.station; */
 	/* hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX( adapter ); */
 	/* CDF_STATUS cdf_ret_status = CDF_STATUS_SUCCESS; */
 
-	if (rtnl_lock_held) {
+	if (rtnl_held) {
 		if (strnchr(pWlanDev->name, strlen(pWlanDev->name), '%')) {
 			if (dev_alloc_name(pWlanDev, pWlanDev->name) < 0) {
 				hddLog(CDF_TRACE_LEVEL_ERROR,
@@ -2073,7 +2161,6 @@ void hdd_cleanup_actionframe(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter)
 
 	if (NULL != cfgState->buf) {
 		unsigned long rc;
-		INIT_COMPLETION(adapter->tx_action_cnf_event);
 		rc = wait_for_completion_timeout(
 			&adapter->tx_action_cnf_event,
 			msecs_to_jiffies(ACTION_FRAME_TX_TIMEOUT));
@@ -2131,12 +2218,6 @@ void hdd_deinit_adapter(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 
 		hdd_unregister_hostapd(adapter, rtnl_held);
 
-		/* set con_mode to STA only when no SAP concurrency mode */
-		if (!
-		    (cds_get_concurrency_mode() &
-		     (CDF_SAP_MASK | CDF_P2P_GO_MASK)))
-			hdd_set_conparam(0);
-
 		break;
 	}
 
@@ -2148,7 +2229,7 @@ void hdd_deinit_adapter(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 }
 
 void hdd_cleanup_adapter(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
-			 uint8_t rtnl_held)
+			 bool rtnl_held)
 {
 	struct net_device *pWlanDev = NULL;
 
@@ -2205,7 +2286,7 @@ CDF_STATUS hdd_check_for_existing_macaddr(hdd_context_t *hdd_ctx,
 }
 hdd_adapter_t *hdd_open_adapter(hdd_context_t *hdd_ctx, uint8_t session_type,
 				const char *iface_name, tSirMacAddr macAddr,
-				uint8_t rtnl_held)
+				bool rtnl_held)
 {
 	hdd_adapter_t *adapter = NULL;
 	hdd_adapter_list_node_t *pHddAdapterNode = NULL;
@@ -2266,10 +2347,8 @@ hdd_adapter_t *hdd_open_adapter(hdd_context_t *hdd_ctx, uint8_t session_type,
 
 		if (WLAN_HDD_P2P_CLIENT == session_type)
 			adapter->wdev.iftype = NL80211_IFTYPE_P2P_CLIENT;
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
 		else if (WLAN_HDD_P2P_DEVICE == session_type)
 			adapter->wdev.iftype = NL80211_IFTYPE_P2P_DEVICE;
-#endif
 		else
 			adapter->wdev.iftype = NL80211_IFTYPE_STATION;
 
@@ -2359,8 +2438,6 @@ hdd_adapter_t *hdd_open_adapter(hdd_context_t *hdd_ctx, uint8_t session_type,
 					   WLAN_NETIF_TX_DISABLE_N_CARRIER,
 					   WLAN_CONTROL_PATH);
 
-		hdd_set_conparam(1);
-
 		break;
 	}
 	case WLAN_HDD_FTM:
@@ -2429,7 +2506,7 @@ hdd_adapter_t *hdd_open_adapter(hdd_context_t *hdd_ctx, uint8_t session_type,
 	}
 
 	if (CDF_STATUS_SUCCESS == status) {
-		cds_set_concurrency_mode(hdd_ctx, session_type);
+		cds_set_concurrency_mode(session_type);
 
 		/* Initialize the WoWL service */
 		if (!hdd_init_wowl(adapter)) {
@@ -2444,10 +2521,10 @@ hdd_adapter_t *hdd_open_adapter(hdd_context_t *hdd_ctx, uint8_t session_type,
 		hddLog(CDF_TRACE_LEVEL_DEBUG, FL("current_intf_count=%d"),
 		       hdd_ctx->current_intf_count);
 
-		cds_check_and_restart_sap_with_non_dfs_acs(hdd_ctx);
+		cds_check_and_restart_sap_with_non_dfs_acs();
 	}
 
-	if ((cds_get_conparam() != CDF_FTM_MODE)
+	if ((cds_get_conparam() != CDF_GLOBAL_FTM_MODE)
 	    && (!hdd_ctx->config->enable2x2)) {
 #define HDD_DTIM_1CHAIN_RX_ID 0x5
 #define HDD_SMPS_PARAM_VALUE_S 29
@@ -2493,7 +2570,7 @@ hdd_adapter_t *hdd_open_adapter(hdd_context_t *hdd_ctx, uint8_t session_type,
 #undef HDD_SMPS_PARAM_VALUE_S
 	}
 
-	if (CDF_FTM_MODE != cds_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE != cds_get_conparam()) {
 		ret = wma_cli_set_command(adapter->sessionId,
 					  WMI_PDEV_PARAM_HYST_EN,
 					  hdd_ctx->config->enableMemDeepSleep,
@@ -2510,7 +2587,7 @@ hdd_adapter_t *hdd_open_adapter(hdd_context_t *hdd_ctx, uint8_t session_type,
 #ifdef CONFIG_FW_LOGS_BASED_ON_INI
 
 	/* Enable FW logs based on INI configuration */
-	if ((CDF_FTM_MODE != cds_get_conparam()) &&
+	if ((CDF_GLOBAL_FTM_MODE != cds_get_conparam()) &&
 	    (hdd_ctx->config->enablefwlog)) {
 		uint8_t count = 0;
 		uint32_t value = 0;
@@ -2591,7 +2668,7 @@ err_free_netdev:
 }
 
 CDF_STATUS hdd_close_adapter(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
-			     uint8_t rtnl_held)
+			     bool rtnl_held)
 {
 	hdd_adapter_list_node_t *adapterNode, *pCurrent, *pNext;
 	CDF_STATUS status;
@@ -2612,7 +2689,7 @@ CDF_STATUS hdd_close_adapter(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 	}
 	adapterNode = pCurrent;
 	if (CDF_STATUS_SUCCESS == status) {
-		cds_clear_concurrency_mode(hdd_ctx, adapter->device_mode);
+		cds_clear_concurrency_mode(adapter->device_mode);
 		hdd_cleanup_adapter(hdd_ctx, adapterNode->pAdapter, rtnl_held);
 
 		hdd_remove_adapter(hdd_ctx, adapterNode);
@@ -2629,7 +2706,16 @@ CDF_STATUS hdd_close_adapter(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 	return CDF_STATUS_E_FAILURE;
 }
 
-CDF_STATUS hdd_close_all_adapters(hdd_context_t *hdd_ctx)
+/**
+ * hdd_close_all_adapters - Close all open adapters
+ * @hdd_ctx:	Hdd context
+ * rtnl_held:	True if RTNL lock held
+ *
+ * Close all open adapters.
+ *
+ * Return: CDF status code
+ */
+CDF_STATUS hdd_close_all_adapters(hdd_context_t *hdd_ctx, bool rtnl_held)
 {
 	hdd_adapter_list_node_t *pHddAdapterNode;
 	CDF_STATUS status;
@@ -2640,7 +2726,7 @@ CDF_STATUS hdd_close_all_adapters(hdd_context_t *hdd_ctx)
 		status = hdd_remove_front_adapter(hdd_ctx, &pHddAdapterNode);
 		if (pHddAdapterNode && CDF_STATUS_SUCCESS == status) {
 			hdd_cleanup_adapter(hdd_ctx, pHddAdapterNode->pAdapter,
-					    false);
+					    rtnl_held);
 			cdf_mem_free(pHddAdapterNode);
 		}
 	} while (NULL != pHddAdapterNode && CDF_STATUS_E_EMPTY != status);
@@ -2811,7 +2897,7 @@ CDF_STATUS hdd_stop_adapter(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 			cds_flush_work(&hdd_ctx->sap_start_work);
 			hddLog(CDF_TRACE_LEVEL_INFO_HIGH,
 			       FL("Canceled the pending SAP restart work"));
-			cds_change_sap_restart_required_status(hdd_ctx, false);
+			cds_change_sap_restart_required_status(false);
 		}
 		/* Any softap specific cleanup here... */
 		if (adapter->device_mode == WLAN_HDD_P2P_GO)
@@ -2822,14 +2908,14 @@ CDF_STATUS hdd_stop_adapter(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 		mutex_lock(&hdd_ctx->sap_lock);
 		if (test_bit(SOFTAP_BSS_STARTED, &adapter->event_flags)) {
 			CDF_STATUS status;
-			hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 
 			/* Stop Bss. */
 #ifdef WLAN_FEATURE_MBSSID
 			status = wlansap_stop_bss(
 					WLAN_HDD_GET_SAP_CTX_PTR(adapter));
 #else
-			status = wlansap_stop_bss(hdd_ctx->pcds_context);
+			status = wlansap_stop_bss(
+				(WLAN_HDD_GET_CTX(adapter))->pcds_context);
 #endif
 
 			if (CDF_IS_STATUS_SUCCESS(status)) {
@@ -2853,7 +2939,7 @@ CDF_STATUS hdd_stop_adapter(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 				hddLog(LOGE, FL("failure in wlansap_stop_bss"));
 			}
 			clear_bit(SOFTAP_BSS_STARTED, &adapter->event_flags);
-			cds_decr_session_set_pcl(hdd_ctx,
+			cds_decr_session_set_pcl(
 						     adapter->device_mode,
 							adapter->sessionId);
 
@@ -2944,8 +3030,7 @@ CDF_STATUS hdd_reset_all_adapters(hdd_context_t *hdd_ctx)
 		adapter->sessionCtx.station.hdd_ReassocScenario = false;
 
 		hdd_deinit_tx_rx(adapter);
-		cds_decr_session_set_pcl(hdd_ctx,
-						adapter->device_mode,
+		cds_decr_session_set_pcl(adapter->device_mode,
 						adapter->sessionId);
 		if (test_bit(WMM_INIT_DONE, &adapter->event_flags)) {
 			hdd_wmm_adapter_close(adapter);
@@ -3061,20 +3146,6 @@ CDF_STATUS hdd_start_all_adapters(hdd_context_t *hdd_ctx)
 	return CDF_STATUS_SUCCESS;
 }
 
-bool hdd_is_ssr_required(void)
-{
-	return is_ssr_required == HDD_SSR_REQUIRED;
-}
-
-/* Once SSR is disabled then it cannot be set. */
-void hdd_set_ssr_required(e_hdd_ssr_required value)
-{
-	if (HDD_SSR_DISABLED == is_ssr_required)
-		return;
-
-	is_ssr_required = value;
-}
-
 CDF_STATUS hdd_get_front_adapter(hdd_context_t *hdd_ctx,
 				 hdd_adapter_list_node_t **padapterNode)
 {
@@ -3195,6 +3266,43 @@ hdd_adapter_t *hdd_get_adapter_by_vdev(hdd_context_t *hdd_ctx,
 	return NULL;
 }
 
+/**
+ * hdd_get_adapter_by_sme_session_id() - Return adapter with
+ * the sessionid
+ * @hdd_ctx: hdd context.
+ * @sme_session_id: sme session is for the adapter to get.
+ *
+ * This function is used to get the adapter with provided session id
+ *
+ * Return: adapter pointer if found
+ *
+ */
+hdd_adapter_t *hdd_get_adapter_by_sme_session_id(hdd_context_t *hdd_ctx,
+						uint32_t sme_session_id)
+{
+	hdd_adapter_list_node_t *adapter_node = NULL, *next = NULL;
+	hdd_adapter_t *adapter;
+	CDF_STATUS cdf_status;
+
+
+	cdf_status = hdd_get_front_adapter(hdd_ctx, &adapter_node);
+
+	while ((NULL != adapter_node) &&
+			(CDF_STATUS_SUCCESS == cdf_status)) {
+		adapter = adapter_node->pAdapter;
+
+		if (adapter &&
+			 adapter->sessionId == sme_session_id)
+			return adapter;
+
+		cdf_status =
+			hdd_get_next_adapter(hdd_ctx,
+				 adapter_node, &next);
+		adapter_node = next;
+	}
+	return NULL;
+}
+
 hdd_adapter_t *hdd_get_adapter(hdd_context_t *hdd_ctx, device_mode_t mode)
 {
 	hdd_adapter_list_node_t *adapterNode = NULL, *pNext = NULL;
@@ -3395,6 +3503,155 @@ static void hdd_wlan_register_ip6_notifier(hdd_context_t *hdd_ctx)
 }
 #endif
 
+#ifdef QCA_WIFI_FTM
+/**
+ * hdd_disable_ftm() - Disable FTM mode
+ * @hdd_ctx:	HDD context
+ *
+ * Helper function to disable FTM mode.
+ *
+ * Return: None.
+ */
+static void hdd_disable_ftm(hdd_context_t *hdd_ctx)
+{
+	hdd_notice("Disabling FTM mode");
+
+	if (hdd_ftm_stop(hdd_ctx)) {
+		hdd_alert("hdd_ftm_stop Failed!");
+		CDF_ASSERT(0);
+	}
+
+	hdd_ctx->ftm.ftm_state = WLAN_FTM_STOPPED;
+
+	wlan_hdd_ftm_close(hdd_ctx);
+
+	return;
+}
+
+/**
+ * hdd_enable_ftm() - Enable FTM mode
+ * @hdd_ctx:	HDD context
+ *
+ * Helper function to enable FTM mode.
+ *
+ * Return: 0 on success and errno on failure.
+ */
+int hdd_enable_ftm(hdd_context_t *hdd_ctx)
+{
+	int ret;
+
+	ret = wlan_hdd_ftm_open(hdd_ctx);
+	if (ret) {
+		hdd_alert("wlan_hdd_ftm_open Failed: %d", ret);
+		goto err_out;
+	}
+
+	ret = hdd_ftm_start(hdd_ctx);
+
+	if (ret) {
+		hdd_alert("hdd_ftm_start Failed: %d", ret);
+		goto err_ftm_close;
+	}
+
+	ret = wiphy_register(hdd_ctx->wiphy);
+	if (ret) {
+		hdd_alert("wiphy register failed: %d", ret);
+		goto err_ftm_stop;
+	}
+
+	hdd_err("FTM driver loaded");
+
+	return 0;
+
+err_ftm_stop:
+	hdd_ftm_stop(hdd_ctx);
+err_ftm_close:
+	wlan_hdd_ftm_close(hdd_ctx);
+err_out:
+	return ret;
+
+}
+#else
+int hdd_enable_ftm(hdd_context_t *hdd_ctx)
+{
+	hdd_err("Driver built without FTM feature enabled!");
+
+	return -ENOTSUPP;
+}
+
+static inline void hdd_disable_ftm(hdd_context_t *hdd_ctx) { }
+#endif
+
+#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
+/**
+ * hdd_logging_sock_activate_svc() - Activate logging
+ * @hdd_ctx: HDD context
+ *
+ * Activates the logging service
+ *
+ * Return: Zero in case of success, negative value otherwise
+ */
+static int hdd_logging_sock_activate_svc(hdd_context_t *hdd_ctx)
+{
+	int ret;
+	struct hdd_config *config = hdd_ctx->config;
+
+	if (!config->wlanLoggingEnable)
+		return 0;
+
+	ret = wlan_logging_sock_activate_svc(config->wlanLoggingFEToConsole,
+					     config->wlanLoggingNumBuf);
+	if (ret)
+		hdd_err("wlan_logging_sock_activate_svc failed: %d", ret);
+	return ret;
+}
+
+/**
+ * wlan_hdd_logging_sock_deactivate_svc() - Deactivate logging
+ * @hdd_ctx: HDD context
+ *
+ * Deactivates the logging service
+ *
+ * Return: 0 on deactivating the logging service
+ */
+static int hdd_logging_sock_deactivate_svc(hdd_context_t *hdd_ctx)
+{
+	if (hdd_ctx && hdd_ctx->config->wlanLoggingEnable)
+		return wlan_logging_sock_deactivate_svc();
+
+	return 0;
+}
+#else
+static inline int hdd_logging_sock_activate_svc(hdd_context_t *hdd_ctx)
+{
+	return 0;
+}
+
+static inline int hdd_logging_sock_deactivate_svc(hdd_context_t *hdd_ctx)
+{
+	return 0;
+}
+#endif
+
+/**
+ * hdd_free_context - Free HDD context
+ * @hdd_ctx:	HDD context to be freed.
+ *
+ * Free config and HDD context.
+ *
+ * Return: None
+ */
+static void hdd_free_context(hdd_context_t *hdd_ctx)
+{
+	if (CDF_GLOBAL_FTM_MODE != hdd_get_conparam())
+		hdd_logging_sock_deactivate_svc(hdd_ctx);
+
+	cdf_mem_free(hdd_ctx->config);
+	hdd_ctx->config = NULL;
+
+	wiphy_free(hdd_ctx->wiphy);
+}
+
 /**
  * hdd_wlan_exit() - HDD WLAN exit function
  * @hdd_ctx:	Pointer to the HDD Context
@@ -3408,7 +3665,6 @@ void hdd_wlan_exit(hdd_context_t *hdd_ctx)
 	v_CONTEXT_t p_cds_context = hdd_ctx->pcds_context;
 	CDF_STATUS cdf_status;
 	struct wiphy *wiphy = hdd_ctx->wiphy;
-	struct hdd_config *pConfig = hdd_ctx->config;
 
 	ENTER();
 
@@ -3419,18 +3675,10 @@ void hdd_wlan_exit(hdd_context_t *hdd_ctx)
 
 	hdd_unregister_wext_all_adapters(hdd_ctx);
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
-		hddLog(CDF_TRACE_LEVEL_INFO, FL("FTM MODE"));
-#if  defined(QCA_WIFI_FTM)
-		if (hdd_ftm_stop(hdd_ctx)) {
-			hddLog(CDF_TRACE_LEVEL_FATAL,
-			       FL("hdd_ftm_stop Failed"));
-			CDF_ASSERT(0);
-		}
-		hdd_ctx->ftm.ftm_state = WLAN_FTM_STOPPED;
-#endif
-		wlan_hdd_ftm_close(hdd_ctx);
-		hddLog(CDF_TRACE_LEVEL_FATAL, FL("FTM driver unloaded"));
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
+		hdd_disable_ftm(hdd_ctx);
+
+		hdd_alert("FTM driver unloaded");
 		goto free_hdd_ctx;
 	}
 
@@ -3543,18 +3791,13 @@ void hdd_wlan_exit(hdd_context_t *hdd_ctx)
 
 	hdd_wlan_green_ap_deinit(hdd_ctx);
 
-#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
-	if (pConfig && pConfig->wlanLoggingEnable) {
-		wlan_logging_sock_deactivate_svc();
-	}
-#endif
 #ifdef WLAN_KD_READY_NOTIFIER
 	cnss_diag_notify_wlan_close();
 	ptt_sock_deactivate_svc();
 #endif /* WLAN_KD_READY_NOTIFIER */
 	nl_srv_exit();
 
-	hdd_close_all_adapters(hdd_ctx);
+	hdd_close_all_adapters(hdd_ctx, false);
 
 	hdd_ipa_cleanup(hdd_ctx);
 
@@ -3563,35 +3806,16 @@ void hdd_wlan_exit(hdd_context_t *hdd_ctx)
 	cdf_list_destroy(&hdd_ctx->hdd_roc_req_q);
 	cdf_list_destroy(&hdd_ctx->hdd_scan_req_q);
 
-	if (!CDF_IS_STATUS_SUCCESS(cdf_mutex_destroy(
-				&hdd_ctx->hdd_conc_list_lock))) {
-		hdd_err("Failed to destroy hdd_conc_list_lock");
+	if (!CDF_IS_STATUS_SUCCESS(cds_deinit_policy_mgr())) {
+		hdd_err("Failed to deinit policy manager");
 		/* Proceed and complete the clean up */
 	}
 
 free_hdd_ctx:
 
-	/* Free up dynamically allocated members inside HDD Adapter */
-	if (hdd_ctx->config) {
-		kfree(hdd_ctx->config);
-		hdd_ctx->config = NULL;
-	}
-
 	wiphy_unregister(wiphy);
-	wiphy_free(wiphy);
-	if (hdd_is_ssr_required()) {
-#ifdef MSM_PLATFORM
-#ifdef CONFIG_CNSS
-		/*
-		 * WDI timeout had happened during unload, so SSR is needed
-		 * here
-		 */
-		subsystem_restart("wcnss");
-#endif
-#endif
-		msleep(5000);
-	}
-	hdd_set_ssr_required(false);
+
+	hdd_free_context(hdd_ctx);
 }
 
 void __hdd_wlan_exit(void)
@@ -3607,21 +3831,18 @@ void __hdd_wlan_exit(void)
 		return;
 	}
 
-	/* module exit should never proceed if SSR is not completed */
-	while (hdd_ctx->isLogpInProgress) {
-		hddLog(CDF_TRACE_LEVEL_FATAL,
-		       FL("SSR in Progress; block rmmod for 1 second!!!"));
-		msleep(1000);
-	}
-
-	hdd_ctx->isUnloadInProgress = true;
-
-	cds_set_load_unload_in_progress(true);
+	/* Check IPA HW Pipe shutdown */
+	hdd_ipa_uc_force_pipe_shutdown(hdd_ctx);
 
 #ifdef WLAN_FEATURE_LPSS
 	wlan_hdd_send_status_pkg(NULL, NULL, 0, 0);
 #endif
 
+	memdump_deinit();
+
+#ifdef QCA_PKT_PROTO_TRACE
+	cds_pkt_proto_trace_close();
+#endif
 	/* Do all the cleanup before deregistering the driver */
 	hdd_wlan_exit(hdd_ctx);
 	EXIT();
@@ -4345,7 +4566,7 @@ static void hdd_enable_fastpath(struct hdd_config *hdd_cfg,
 #if defined(FEATURE_WLAN_CH_AVOID) && defined(CONFIG_CNSS)
 /**
  * hdd_set_thermal_level_cb() - set thermal level callback function
- * @hdd_ctxt:	hdd context pointer
+ * @context:	hdd context pointer
  * @level:	thermal level
  *
  * Change IPA data path to SW path when the thermal throttle level greater
@@ -4353,8 +4574,10 @@ static void hdd_enable_fastpath(struct hdd_config *hdd_cfg,
  *
  * Return: none
  */
-static void hdd_set_thermal_level_cb(hdd_context_t *hdd_ctx, u_int8_t level)
+static void hdd_set_thermal_level_cb(void *context, u_int8_t level)
 {
+	hdd_context_t *hdd_ctx = context;
+
 	/* Change IPA to SW path when throttle level greater than 0 */
 	if (level > THROTTLE_LEVEL_0)
 		hdd_ipa_send_mcc_scc_msg(hdd_ctx, true);
@@ -4399,7 +4622,7 @@ static uint8_t hdd_find_prefd_safe_chnl(hdd_context_t *hdd_ctxt,
 		is_unsafe = 0;
 		for (channel_loop = 0;
 		     channel_loop < unsafe_channel_count; channel_loop++) {
-			if (rf_channels[i].channelNum ==
+			if (CDS_CHANNEL_NUM(i) ==
 			    hdd_ctxt->unsafe_channel_list[channel_loop]) {
 				is_unsafe = 1;
 				break;
@@ -4407,7 +4630,7 @@ static uint8_t hdd_find_prefd_safe_chnl(hdd_context_t *hdd_ctxt,
 		}
 		if (!is_unsafe) {
 			safe_channels[safe_channel_count] =
-				rf_channels[i].channelNum;
+			  CDS_CHANNEL_NUM(i);
 			hddLog(CDF_TRACE_LEVEL_INFO_HIGH,
 			       FL("safe channel %d"),
 			       safe_channels[safe_channel_count]);
@@ -4431,6 +4654,59 @@ static uint8_t hdd_find_prefd_safe_chnl(hdd_context_t *hdd_ctxt,
 	}
 	return 0;
 }
+/**
+ * hdd_indicate_mgmt_frame() - Wrapper to indicate management frame to
+ * user space
+ * @frame_ind: Management frame data to be informed.
+ *
+ * This function is used to indicate management frame to
+ * user space
+ *
+ * Return: None
+ *
+ */
+void hdd_indicate_mgmt_frame(tSirSmeMgmtFrameInd *frame_ind)
+{
+	hdd_context_t *hdd_ctx = NULL;
+	hdd_adapter_t *adapter = NULL;
+	void *cds_context = NULL;
+	int i;
+
+	/* Get the global VOSS context.*/
+	cds_context = cds_get_global_context();
+	if (!cds_context) {
+		hddLog(LOGE, FL("Global VOS context is Null"));
+		return;
+	}
+	/* Get the HDD context.*/
+	hdd_ctx =
+	  (hdd_context_t *)cds_get_context(CDF_MODULE_ID_HDD);
+
+	if (0 != wlan_hdd_validate_context(hdd_ctx))
+		return;
+
+	if (SME_SESSION_ID_ANY == frame_ind->sessionId) {
+		for (i = 0; i < CSR_ROAM_SESSION_MAX; i++) {
+			adapter =
+				hdd_get_adapter_by_sme_session_id(hdd_ctx, i);
+			if (adapter)
+				break;
+		}
+	} else {
+		adapter = hdd_get_adapter_by_sme_session_id(hdd_ctx,
+					frame_ind->sessionId);
+	}
+
+	if ((NULL != adapter) &&
+		(WLAN_HDD_ADAPTER_MAGIC == adapter->magic))
+		__hdd_indicate_mgmt_frame(adapter,
+						frame_ind->frame_len,
+						frame_ind->frameBuf,
+						frame_ind->frameType,
+						frame_ind->rxChan,
+						frame_ind->rxRssi);
+	return;
+}
 
 /**
  * hdd_ch_avoid_cb() - Avoid notified channels from FW handler
@@ -4449,7 +4725,7 @@ static void hdd_ch_avoid_cb(void *hdd_context, void *indi_param)
 	hdd_context_t *hdd_ctxt;
 	tSirChAvoidIndType *ch_avoid_indi;
 	uint8_t range_loop;
-	eRfChannels channel_loop, start_channel_idx = INVALID_RF_CHANNEL,
+	enum channel_enum channel_loop, start_channel_idx = INVALID_RF_CHANNEL,
 					end_channel_idx = INVALID_RF_CHANNEL;
 	uint16_t start_channel;
 	uint16_t end_channel;
@@ -4516,7 +4792,7 @@ static void hdd_ch_avoid_cb(void *hdd_context, void *indi_param)
 
 		for (channel_loop = MIN_20MHZ_RF_CHANNEL; channel_loop <=
 					MAX_20MHZ_RF_CHANNEL; channel_loop++) {
-			if (rf_channels[channel_loop].targetFreq >=
+			if (CDS_CHANNEL_FREQ(channel_loop) >=
 						ch_avoid_indi->avoid_freq_range[
 						range_loop].start_freq) {
 				start_channel_idx = channel_loop;
@@ -4525,11 +4801,11 @@ static void hdd_ch_avoid_cb(void *hdd_context, void *indi_param)
 		}
 		for (channel_loop = MIN_20MHZ_RF_CHANNEL; channel_loop <=
 					MAX_20MHZ_RF_CHANNEL; channel_loop++) {
-			if (rf_channels[channel_loop].targetFreq >=
+			if (CDS_CHANNEL_FREQ(channel_loop) >=
 						ch_avoid_indi->avoid_freq_range[
 						range_loop].end_freq) {
 				end_channel_idx = channel_loop;
-				if (rf_channels[channel_loop].targetFreq >
+				if (CDS_CHANNEL_FREQ(channel_loop) >
 						ch_avoid_indi->avoid_freq_range[
 						range_loop].end_freq)
 					end_channel_idx--;
@@ -4544,8 +4820,8 @@ static void hdd_ch_avoid_cb(void *hdd_context, void *indi_param)
 		for (channel_loop = start_channel_idx; channel_loop <=
 					end_channel_idx; channel_loop++) {
 			hdd_ctxt->unsafe_channel_list[
-					hdd_ctxt->unsafe_channel_count++] =
-					rf_channels[channel_loop].channelNum;
+				hdd_ctxt->unsafe_channel_count++] =
+				CDS_CHANNEL_FREQ(channel_loop);
 			if (hdd_ctxt->unsafe_channel_count >=
 							NUM_20MHZ_RF_CHANNELS) {
 				hddLog(LOGW, FL("LTECoex unsafe ch list full"));
@@ -4670,7 +4946,7 @@ static void hdd_init_channel_avoidance(hdd_context_t *hdd_ctx)
 static void hdd_init_channel_avoidance(hdd_context_t *hdd_ctx)
 {
 }
-static void hdd_set_thermal_level_cb(hdd_context_t *hdd_ctx, u_int8_t level)
+static void hdd_set_thermal_level_cb(void *context, u_int8_t level)
 {
 }
 #endif /* defined(FEATURE_WLAN_CH_AVOID) && defined(CONFIG_CNSS) */
@@ -4710,220 +4986,497 @@ static CDF_STATUS wlan_hdd_disable_all_dual_mac_features(hdd_context_t *hdd_ctx)
 }
 
 /**
- * hdd_wlan_startup() - HDD init function
+ * hdd_override_ini_config - Override INI config
+ * @hdd_ctx: HDD context
+ *
+ * Override INI config based on module parameter.
+ *
+ * Return: None
+ */
+static void hdd_override_ini_config(hdd_context_t *hdd_ctx)
+{
+
+	if (0 == enable_dfs_chan_scan || 1 == enable_dfs_chan_scan) {
+		hdd_ctx->config->enableDFSChnlScan = enable_dfs_chan_scan;
+		hdd_notice("Module enable_dfs_chan_scan set to %d",
+			   enable_dfs_chan_scan);
+	}
+	if (0 == enable_11d || 1 == enable_11d) {
+		hdd_ctx->config->Is11dSupportEnabled = enable_11d;
+		hdd_notice("Module enable_11d set to %d", enable_11d);
+	}
+}
+
+/**
+ * hdd_set_trace_level_for_each - Set trace level for each INI config
+ * @hdd_ctx - HDD context
+ *
+ * Set trace level for each module based on INI config.
+ *
+ * Return: None
+ */
+static void hdd_set_trace_level_for_each(hdd_context_t *hdd_ctx)
+{
+	hdd_cdf_trace_enable(CDF_MODULE_ID_WMI,
+			     hdd_ctx->config->cdf_trace_enable_wdi);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_HDD,
+			     hdd_ctx->config->cdf_trace_enable_hdd);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_SME,
+			     hdd_ctx->config->cdf_trace_enable_sme);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_PE,
+			     hdd_ctx->config->cdf_trace_enable_pe);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_WMA,
+			     hdd_ctx->config->cdf_trace_enable_wma);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_SYS,
+			     hdd_ctx->config->cdf_trace_enable_sys);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_CDF,
+			     hdd_ctx->config->cdf_trace_enable_cdf);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_SAP,
+			     hdd_ctx->config->cdf_trace_enable_sap);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_HDD_SOFTAP,
+			     hdd_ctx->config->cdf_trace_enable_hdd_sap);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_BMI,
+				hdd_ctx->config->cdf_trace_enable_bmi);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_CFG,
+				hdd_ctx->config->cdf_trace_enable_cfg);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_EPPING,
+				hdd_ctx->config->cdf_trace_enable_epping);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_CDF_DEVICE,
+				hdd_ctx->config->cdf_trace_enable_cdf_devices);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_TXRX,
+				hdd_ctx->config->cfd_trace_enable_txrx);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_HTC,
+				hdd_ctx->config->cdf_trace_enable_htc);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_HIF,
+				hdd_ctx->config->cdf_trace_enable_hif);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_HDD_SAP_DATA,
+				hdd_ctx->config->cdf_trace_enable_hdd_sap_data);
+	hdd_cdf_trace_enable(CDF_MODULE_ID_HDD_DATA,
+				hdd_ctx->config->cdf_trace_enable_hdd_data);
+
+	hdd_cfg_print(hdd_ctx);
+}
+
+/**
+ * hdd_init_context - Alloc and initialize HDD context
  * @dev:	Pointer to the underlying device
+ * @hif_sc:	HIF context
  *
- * This is the driver startup code executed once a WLAN device has been detected
+ * Allocate and initialize HDD context. HDD context is allocated as part of
+ * wiphy allocation and then context is initialized.
  *
- * Return:  0 for success, < 0 for failure
+ * Return: HDD context on success and ERR_PTR on failure
  */
-int hdd_wlan_startup(struct device *dev, void *hif_sc)
+hdd_context_t *hdd_init_context(struct device *dev, void *hif_sc)
 {
 	CDF_STATUS status;
-	hdd_adapter_t *adapter = NULL;
-#ifdef WLAN_OPEN_P2P_INTERFACE
-	hdd_adapter_t *pP2adapter = NULL;
-#endif
-	hdd_context_t *hdd_ctx = NULL;
-	v_CONTEXT_t p_cds_context = NULL;
-	int ret;
-	int i;
-	struct wiphy *wiphy;
-	unsigned long rc;
-	tSmeThermalParams thermalParam;
-	tSirTxPowerLimit *hddtxlimit;
-	uint8_t rtnl_lock_enable;
-	uint8_t reg_netdev_notifier_done = false;
-	hdd_adapter_t *dot11_adapter = NULL;
+	int ret = 0;
+	hdd_context_t *hdd_ctx;
+	v_CONTEXT_t p_cds_context;
 
 	ENTER();
 
-	if (WLAN_IS_EPPING_ENABLED(con_mode)) {
-		ret = epping_enable(dev);
-		EXIT();
-		return ret;
+	p_cds_context = cds_get_global_context();
+	if (p_cds_context == NULL) {
+		hdd_alert("Failed to get CDS global context");
+		ret = -EINVAL;
+		goto err_out;
 	}
 
-	/* cfg80211: wiphy allocation */
-	wiphy = wlan_hdd_cfg80211_wiphy_alloc(sizeof(hdd_context_t));
+	hdd_ctx = hdd_cfg80211_wiphy_alloc(sizeof(hdd_context_t));
 
-	if (wiphy == NULL) {
-		hddLog(CDF_TRACE_LEVEL_ERROR, FL("cfg80211 init failed"));
-		return -EIO;
+	if (hdd_ctx == NULL) {
+		ret = -ENOMEM;
+		goto err_out;
 	}
 
-	hdd_ctx = wiphy_priv(wiphy);
-
-	/* Initialize the adapter context to zeros. */
-	cdf_mem_zero(hdd_ctx, sizeof(hdd_context_t));
-
-	hdd_ctx->wiphy = wiphy;
-	hdd_ctx->isLoadInProgress = true;
-	hdd_ctx->ioctl_scan_mode = eSIR_ACTIVE_SCAN;
-	cds_set_wakelock_logging(false);
-
-	cds_set_load_unload_in_progress(true);
-
-	/* Get cds context here bcoz cds_open requires it */
-	p_cds_context = cds_get_global_context();
+	hdd_ctx->pcds_context = p_cds_context;
 
-	if (p_cds_context == NULL) {
-		hddLog(CDF_TRACE_LEVEL_FATAL,
-		       FL("Failed cds_get_global_context"));
+	hdd_ctx->config = cdf_mem_malloc(sizeof(struct hdd_config));
+	if (hdd_ctx->config == NULL) {
+		hdd_alert("Failed to alloc memory for HDD config!");
+		ret = -ENOMEM;
 		goto err_free_hdd_context;
 	}
-	/* Save the Global CDS context in adapter context for future. */
-	hdd_ctx->pcds_context = p_cds_context;
 
-	/* Save the adapter context in global context for future. */
+	/* Read and parse the qcom_cfg.ini file */
+	status = hdd_parse_config_ini(hdd_ctx);
+	if (CDF_STATUS_SUCCESS != status) {
+		hdd_alert("Error (status: %d) parsing INI file: %s", status,
+			  WLAN_INI_FILE);
+		ret = -EINVAL;
+		goto err_free_config;
+	}
+
 	((cds_context_type *) (p_cds_context))->pHDDContext = (void *)hdd_ctx;
 
 	hdd_ctx->parent_dev = dev;
 
+	hdd_ctx->ioctl_scan_mode = eSIR_ACTIVE_SCAN;
+
 	hdd_init_ll_stats_ctx();
 
 	init_completion(&hdd_ctx->mc_sus_event_var);
 	init_completion(&hdd_ctx->ready_to_suspend);
 
-	spin_lock_init(&hdd_ctx->schedScan_lock);
+	cdf_spinlock_init(&hdd_ctx->connection_status_lock);
+	cdf_spinlock_init(&hdd_ctx->sched_scan_lock);
 
 	cdf_spinlock_init(&hdd_ctx->hdd_adapter_lock);
 	cdf_list_init(&hdd_ctx->hddAdapters, MAX_NUMBER_OF_ADAPTERS);
 
 	wlan_hdd_cfg80211_extscan_init(hdd_ctx);
 
-#ifdef FEATURE_WLAN_TDLS
-	/*
-	 * tdls_lock is initialized before an hdd_open_adapter ( which is
-	 * invoked by other instances also) to protect the concurrent
-	 * access for the Adapters by TDLS module.
-	 */
-	mutex_init(&hdd_ctx->tdls_lock);
-#endif
+	hdd_tdls_pre_init(hdd_ctx);
 	mutex_init(&hdd_ctx->dfs_lock);
-	/* store target type and target version info in hdd ctx */
+
 	hdd_ctx->target_type = ((struct ol_softc *)hif_sc)->target_type;
-	hdd_init_offloaded_packets_ctx(hdd_ctx);
-	/* Load all config first as TL config is needed during cds_open */
-	hdd_ctx->config =
-		(struct hdd_config *) kmalloc(sizeof(struct hdd_config), GFP_KERNEL);
-	if (hdd_ctx->config == NULL) {
-		hddLog(CDF_TRACE_LEVEL_FATAL,
-		       FL("Failed kmalloc struct hdd_config"));
-		goto err_config;
-	}
 
-	cdf_mem_zero(hdd_ctx->config, sizeof(struct hdd_config));
+	hdd_init_offloaded_packets_ctx(hdd_ctx);
 
-	/* Read and parse the qcom_cfg.ini file */
-	status = hdd_parse_config_ini(hdd_ctx);
-	if (CDF_STATUS_SUCCESS != status) {
-		hddLog(CDF_TRACE_LEVEL_FATAL, FL("error parsing %s"),
-		       WLAN_INI_FILE);
-		goto err_config;
-	}
+	icnss_set_fw_debug_mode(hdd_ctx->config->enablefwlog);
 
-	hdd_ctx->current_intf_count = 0;
 	hdd_ctx->max_intf_count = CSR_ROAM_SESSION_MAX;
 
-	/*
-	 * INI has been read, initialise the configuredMcastBcastFilter with
-	 * INI value as this will serve as the default value
-	 */
 	hdd_ctx->configuredMcastBcastFilter =
 		hdd_ctx->config->mcastBcastFilterSetting;
-	hddLog(CDF_TRACE_LEVEL_INFO,
-	       FL("Setting configuredMcastBcastFilter: %d"),
-	       hdd_ctx->config->mcastBcastFilterSetting);
 
-	if (false == hdd_is_5g_supported(hdd_ctx)) {
-		/* 5Ghz is not supported. */
-		if (1 != hdd_ctx->config->nBandCapability) {
-			hddLog(CDF_TRACE_LEVEL_INFO,
-			       FL(
-				  "Setting hdd_ctx->config->nBandCapability = 1"
-				 ));
-			hdd_ctx->config->nBandCapability = 1;
-		}
-	}
+	hdd_notice("Setting configuredMcastBcastFilter: %d",
+		   hdd_ctx->config->mcastBcastFilterSetting);
 
-	/*
-	 * cfg80211: Initialization  ...
-	 */
-	if (0 < wlan_hdd_cfg80211_init(dev, wiphy, hdd_ctx->config)) {
-		hddLog(LOGE,
-		       FL("wlan_hdd_cfg80211_init return failure"));
-		goto err_config;
+	hdd_override_ini_config(hdd_ctx);
+
+	ret = wlan_hdd_cfg80211_init(dev, hdd_ctx->wiphy, hdd_ctx->config);
+
+	if (ret) {
+		hdd_err("CFG80211 wiphy init failed: %d", ret);
+		goto err_free_config;
 	}
 
 	hdd_enable_fastpath(hdd_ctx->config, hif_sc);
+
+	/* Uses to enabled logging after SSR */
+	hdd_ctx->fw_log_settings.enable = hdd_ctx->config->enablefwlog;
+
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam())
+		goto skip_multicast_logging;
+
+	cds_set_multicast_logging(hdd_ctx->config->multicast_host_fw_msgs);
+
+	ret = hdd_logging_sock_activate_svc(hdd_ctx);
+	if (ret)
+		goto err_free_config;
+
 	/*
-	 * Initialize struct for saving f/w log setting will be used
-	 * after ssr
+	 * Update CDF trace levels based upon the code. The multicast
+	 * levels of the code need not be set when the logger thread
+	 * is not enabled.
 	 */
-	hdd_ctx->fw_log_settings.enable = hdd_ctx->config->enablefwlog;
-	hdd_ctx->fw_log_settings.dl_type = 0;
-	hdd_ctx->fw_log_settings.dl_report = 0;
-	hdd_ctx->fw_log_settings.dl_loglevel = 0;
-	hdd_ctx->fw_log_settings.index = 0;
-	for (i = 0; i < MAX_MOD_LOGLEVEL; i++) {
-		hdd_ctx->fw_log_settings.dl_mod_loglevel[i] = 0;
-	}
-	/* Update CDF trace levels based upon the cfg.ini */
-	hdd_cdf_trace_enable(CDF_MODULE_ID_WMI,
-			     hdd_ctx->config->cdf_trace_enable_wdi);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_HDD,
-			     hdd_ctx->config->cdf_trace_enable_hdd);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_SME,
-			     hdd_ctx->config->cdf_trace_enable_sme);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_PE,
-			     hdd_ctx->config->cdf_trace_enable_pe);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_WMA,
-			     hdd_ctx->config->cdf_trace_enable_wma);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_SYS,
-			     hdd_ctx->config->cdf_trace_enable_sys);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_CDF,
-			     hdd_ctx->config->cdf_trace_enable_cdf);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_SAP,
-			     hdd_ctx->config->cdf_trace_enable_sap);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_HDD_SOFTAP,
-			     hdd_ctx->config->cdf_trace_enable_hdd_sap);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_BMI,
-				hdd_ctx->config->cdf_trace_enable_bmi);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_CFG,
-				hdd_ctx->config->cdf_trace_enable_cfg);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_EPPING,
-				hdd_ctx->config->cdf_trace_enable_epping);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_CDF_DEVICE,
-				hdd_ctx->config->cdf_trace_enable_cdf_devices);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_TXRX,
-				hdd_ctx->config->cfd_trace_enable_txrx);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_HTC,
-				hdd_ctx->config->cdf_trace_enable_htc);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_HIF,
-				hdd_ctx->config->cdf_trace_enable_hif);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_HDD_SAP_DATA,
-				hdd_ctx->config->cdf_trace_enable_hdd_sap_data);
-	hdd_cdf_trace_enable(CDF_MODULE_ID_HDD_DATA,
-				hdd_ctx->config->cdf_trace_enable_hdd_data);
+	if (cds_is_multicast_logging())
+		wlan_logging_set_log_level();
 
-	hdd_cfg_print(hdd_ctx);
+skip_multicast_logging:
+	hdd_set_trace_level_for_each(hdd_ctx);
+
+	return hdd_ctx;
+
+err_free_config:
+	cdf_mem_free(hdd_ctx->config);
+
+err_free_hdd_context:
+	wiphy_free(hdd_ctx->wiphy);
+
+err_out:
+	return ERR_PTR(ret);
+}
+
+#ifdef WLAN_OPEN_P2P_INTERFACE
+/**
+ * hdd_open_p2p_interface - Open P2P interface
+ * @hdd_ctx:	HDD context
+ * @rtnl_held:	True if RTNL lock held
+ *
+ * Open P2P interface during probe. This function called to open the P2P
+ * interface at probe along with STA interface.
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int hdd_open_p2p_interface(hdd_context_t *hdd_ctx, bool rtnl_held)
+{
+	hdd_adapter_t *adapter;
+	uint8_t *p2p_dev_addr;
+
+	if (hdd_ctx->config->isP2pDeviceAddrAdministrated &&
+	    !(hdd_ctx->config->intfMacAddr[0].bytes[0] & 0x02)) {
+		cdf_mem_copy(hdd_ctx->p2pDeviceAddress.bytes,
+			     hdd_ctx->config->intfMacAddr[0].bytes,
+			     sizeof(tSirMacAddr));
+
+		/*
+		 * Generate the P2P Device Address.  This consists of
+		 * the device's primary MAC address with the locally
+		 * administered bit set.
+		 */
+		hdd_ctx->p2pDeviceAddress.bytes[0] |= 0x02;
+	} else {
+		p2p_dev_addr = wlan_hdd_get_intf_addr(hdd_ctx);
+		if (p2p_dev_addr == NULL) {
+			hdd_alert("Failed to allocate mac_address for p2p_device");
+			return -ENOSPC;
+		}
+
+		cdf_mem_copy(&hdd_ctx->p2pDeviceAddress.bytes[0], p2p_dev_addr,
+			     CDF_MAC_ADDR_SIZE);
+	}
+
+	adapter = hdd_open_adapter(hdd_ctx, WLAN_HDD_P2P_DEVICE, "p2p%d",
+				   &hdd_ctx->p2pDeviceAddress.bytes[0],
+				   rtnl_held);
+
+	if (NULL == adapter) {
+		hdd_alert("Failed to do hdd_open_adapter for P2P Device Interface");
+		return -ENOSPC;
+	}
+
+	return 0;
+}
+#else
+static inline int hdd_open_p2p_interface(struct hdd_context_t *hdd_ctx,
+					 bool rtnl_held)
+{
+	return 0;
+}
+#endif
+
+/**
+ * hdd_open_interfaces - Open all required interfaces
+ * hdd_ctx:	HDD context
+ * rtnl_held: True if RTNL lock is held
+ *
+ * Open all the interfaces like STA, P2P and OCB based on the configuration.
+ *
+ * Return: Primary adapter on success and PTR_ERR on failure
+ */
+static hdd_adapter_t *hdd_open_interfaces(hdd_context_t *hdd_ctx,
+					  bool rtnl_held)
+{
+	hdd_adapter_t *adapter = NULL;
+	hdd_adapter_t *adapter_11p = NULL;
+	int ret;
+
+	/* Create only 802.11p interface */
+	if (hdd_ctx->config->dot11p_mode == WLAN_HDD_11P_STANDALONE) {
+		adapter = hdd_open_adapter(hdd_ctx, WLAN_HDD_OCB, "wlanocb%d",
+					   wlan_hdd_get_intf_addr(hdd_ctx),
+					   rtnl_held);
+
+		if (adapter == NULL)
+			return ERR_PTR(-ENOSPC);
+
+		return adapter;
+	}
+
+	adapter = hdd_open_adapter(hdd_ctx, WLAN_HDD_INFRA_STATION, "wlan%d",
+				   wlan_hdd_get_intf_addr(hdd_ctx),
+				   rtnl_held);
+
+	if (adapter == NULL)
+		return ERR_PTR(-ENOSPC);
+
+	ret = hdd_open_p2p_interface(hdd_ctx, rtnl_held);
+	if (ret)
+		goto err_close_adapter;
+
+	/* Open 802.11p Interface */
+	if (hdd_ctx->config->dot11p_mode == WLAN_HDD_11P_CONCURRENT) {
+		adapter_11p = hdd_open_adapter(hdd_ctx, WLAN_HDD_OCB,
+					       "wlanocb%d",
+					       wlan_hdd_get_intf_addr(hdd_ctx),
+					       rtnl_held);
+		if (adapter_11p == NULL) {
+			hdd_err("Failed to open 802.11p interface");
+			goto err_close_adapter;
+		}
+	}
+
+	return adapter;
+
+err_close_adapter:
+	hdd_close_all_adapters(hdd_ctx, rtnl_held);
+	return ERR_PTR(ret);
+}
+
+/**
+ * hdd_update_country_code - Update country code
+ * @hdd_ctx: HDD context
+ * @adapter: Primary adapter context
+ *
+ * Update country code based on module parameter country_code at SME and wait
+ * for the settings to take effect.
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int hdd_update_country_code(hdd_context_t *hdd_ctx,
+				  hdd_adapter_t *adapter)
+{
+	CDF_STATUS status;
+	int ret = 0;
+	unsigned long rc;
+
+	if (country_code == NULL)
+		return 0;
+
+	INIT_COMPLETION(adapter->change_country_code);
+
+	status = sme_change_country_code(hdd_ctx->hHal,
+					 wlan_hdd_change_country_code_callback,
+					 country_code, adapter,
+					 hdd_ctx->pcds_context, eSIR_TRUE,
+					 eSIR_TRUE);
+
+
+	if (!CDF_IS_STATUS_SUCCESS(status)) {
+		hdd_err("SME Change Country code from module param fail ret=%d",
+			ret);
+		return -EINVAL;
+	}
+
+	rc = wait_for_completion_timeout(&adapter->change_country_code,
+			 msecs_to_jiffies(WLAN_WAIT_TIME_COUNTRY));
+	if (!rc) {
+		hdd_err("SME while setting country code timed out");
+		ret = -ETIMEDOUT;
+	}
+
+	return ret;
+}
+
+/**
+ * hdd_init_thermal_info - Initialize thermal level
+ * @hdd_ctx:	HDD context
+ *
+ * Initialize thermal level at SME layer and set the thermal level callback
+ * which would be called when a configured thermal threshold is hit.
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int hdd_init_thermal_info(hdd_context_t *hdd_ctx)
+{
+	tSmeThermalParams thermal_param;
+	CDF_STATUS status;
+
+	thermal_param.smeThermalMgmtEnabled =
+		hdd_ctx->config->thermalMitigationEnable;
+	thermal_param.smeThrottlePeriod = hdd_ctx->config->throttlePeriod;
+
+	thermal_param.smeThermalLevels[0].smeMinTempThreshold =
+		hdd_ctx->config->thermalTempMinLevel0;
+	thermal_param.smeThermalLevels[0].smeMaxTempThreshold =
+		hdd_ctx->config->thermalTempMaxLevel0;
+	thermal_param.smeThermalLevels[1].smeMinTempThreshold =
+		hdd_ctx->config->thermalTempMinLevel1;
+	thermal_param.smeThermalLevels[1].smeMaxTempThreshold =
+		hdd_ctx->config->thermalTempMaxLevel1;
+	thermal_param.smeThermalLevels[2].smeMinTempThreshold =
+		hdd_ctx->config->thermalTempMinLevel2;
+	thermal_param.smeThermalLevels[2].smeMaxTempThreshold =
+		hdd_ctx->config->thermalTempMaxLevel2;
+	thermal_param.smeThermalLevels[3].smeMinTempThreshold =
+		hdd_ctx->config->thermalTempMinLevel3;
+	thermal_param.smeThermalLevels[3].smeMaxTempThreshold =
+		hdd_ctx->config->thermalTempMaxLevel3;
+
+	status = sme_init_thermal_info(hdd_ctx->hHal, thermal_param);
+
+	if (!CDF_IS_STATUS_SUCCESS(status))
+		return cdf_status_to_os_return(status);
+
+	sme_add_set_thermal_level_callback(hdd_ctx->hHal,
+					   hdd_set_thermal_level_cb);
+
+	return 0;
+
+}
+
+#if defined(CONFIG_HDD_INIT_WITH_RTNL_LOCK)
+/**
+ * hdd_hold_rtnl_lock - Hold RTNL lock
+ *
+ * Hold RTNL lock
+ *
+ * Return: True if held and false otherwise
+ */
+static inline bool hdd_hold_rtnl_lock(void)
+{
+	rtnl_lock();
+	return true;
+}
+
+/**
+ * hdd_release_rtnl_lock - Release RTNL lock
+ *
+ * Release RTNL lock
+ *
+ * Return: None
+ */
+static inline void hdd_release_rtnl_lock(void)
+{
+	rtnl_unlock();
+}
+#else
+static inline bool hdd_hold_rtnl_lock(void) { return false; }
+static inline void hdd_release_rtnl_lock(void) { }
+#endif
+
+/**
+ * hdd_wlan_startup() - HDD init function
+ * @dev:	Pointer to the underlying device
+ *
+ * This is the driver startup code executed once a WLAN device has been detected
+ *
+ * Return:  0 for success, < 0 for failure
+ */
+int hdd_wlan_startup(struct device *dev, void *hif_sc)
+{
+	CDF_STATUS status;
+	hdd_adapter_t *adapter = NULL;
+	hdd_context_t *hdd_ctx = NULL;
+	int ret;
+	tSirTxPowerLimit hddtxlimit;
+	bool rtnl_held;
+	tSirRetStatus hal_status;
+
+	ENTER();
+
+	if (WLAN_IS_EPPING_ENABLED(con_mode)) {
+		ret = epping_enable(dev);
+		EXIT();
+		return ret;
+	}
+
+	hdd_ctx = hdd_init_context(dev, hif_sc);
 
-	if (CDF_FTM_MODE == hdd_get_conparam())
-		goto ftm_processing;
+	if (IS_ERR(hdd_ctx))
+		return PTR_ERR(hdd_ctx);
 
-	hdd_ctx->isLogpInProgress = false;
-	cds_set_logp_in_progress(false);
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
+		ret = hdd_enable_ftm(hdd_ctx);
 
-	cds_set_connection_in_progress(hdd_ctx, false);
+		if (ret)
+			goto err_hdd_free_context;
 
-	status = cds_open(&p_cds_context, 0);
+		goto success;
+	}
+
+	hdd_wlan_green_ap_init(hdd_ctx);
+
+	status = cds_open();
 	if (!CDF_IS_STATUS_SUCCESS(status)) {
 		hddLog(CDF_TRACE_LEVEL_FATAL, FL("cds_open failed"));
-		goto err_cds_open;
+		goto err_hdd_free_context;
 	}
 
-	wlan_hdd_update_wiphy(wiphy, hdd_ctx->config);
+	wlan_hdd_update_wiphy(hdd_ctx->wiphy, hdd_ctx->config);
 
 	hdd_ctx->hHal = cds_get_context(CDF_MODULE_ID_SME);
 
@@ -4957,18 +5510,6 @@ int hdd_wlan_startup(struct device *dev, void *hif_sc)
 	 */
 	hdd_set_dot11p_config(hdd_ctx);
 
-	if (0 == enable_dfs_chan_scan || 1 == enable_dfs_chan_scan) {
-		hdd_ctx->config->enableDFSChnlScan = enable_dfs_chan_scan;
-		hddLog(CDF_TRACE_LEVEL_INFO,
-		       FL("module enable_dfs_chan_scan set to %d"),
-		       enable_dfs_chan_scan);
-	}
-	if (0 == enable_11d || 1 == enable_11d) {
-		hdd_ctx->config->Is11dSupportEnabled = enable_11d;
-		hddLog(CDF_TRACE_LEVEL_INFO, FL("module enable_11d set to %d"),
-		       enable_11d);
-	}
-
 	/*
 	 * Note that the cds_pre_enable() sequence triggers the cfg download.
 	 * The cfg download must occur before we update the SME config
@@ -5009,27 +5550,19 @@ int hdd_wlan_startup(struct device *dev, void *hif_sc)
 		       FL("can't update mac config, using MAC from ini file"));
 	}
 
-	{
-		CDF_STATUS cdf_ret_status;
-		/*
-		 * Set the MAC Address Currently this is used by HAL to
-		 * add self sta. Remove this once self sta is added as
-		 * part of session open.
-		 */
-		cdf_ret_status = cfg_set_str(hdd_ctx->hHal, WNI_CFG_STA_ID,
-					     (uint8_t *) &hdd_ctx->config->
-					     intfMacAddr[0],
-					     sizeof(hdd_ctx->config->
-						    intfMacAddr[0]));
+	/*
+	 * Set the MAC Address Currently this is used by HAL to add self sta.
+	 * Remove this once self sta is added as part of session open.
+	 */
+	hal_status = cfg_set_str(hdd_ctx->hHal, WNI_CFG_STA_ID,
+				     hdd_ctx->config->intfMacAddr[0].bytes,
+				     sizeof(hdd_ctx->config->intfMacAddr[0]));
 
-		if (!CDF_IS_STATUS_SUCCESS(cdf_ret_status)) {
-			hddLog(CDF_TRACE_LEVEL_ERROR,
-			       FL(
-				  "Failed to set MAC Address. HALStatus is %08d [x%08x]"
-				 ),
-			       cdf_ret_status, cdf_ret_status);
-			goto err_wiphy_unregister;
-		}
+	if (!IS_SIR_STATUS_SUCCESS(hal_status)) {
+		hdd_err("Failed to set MAC Address. HALStatus is %08d [x%08x]",
+			hal_status, hal_status);
+		ret = -EINVAL;
+		goto err_wiphy_unregister;
 	}
 
 	if (hdd_ipa_init(hdd_ctx) == CDF_STATUS_E_FAILURE)
@@ -5042,7 +5575,7 @@ int hdd_wlan_startup(struct device *dev, void *hif_sc)
 	status = cds_enable(hdd_ctx->pcds_context);
 	if (!CDF_IS_STATUS_SUCCESS(status)) {
 		hddLog(CDF_TRACE_LEVEL_FATAL, FL("cds_enable failed"));
-		goto err_wiphy_unregister;
+		goto err_ipa_cleanup;
 	}
 
 	hdd_init_channel_avoidance(hdd_ctx);
@@ -5053,117 +5586,16 @@ int hdd_wlan_startup(struct device *dev, void *hif_sc)
 		       FL("hdd_post_cds_enable_config failed"));
 		goto err_cds_disable;
 	}
-#ifdef QCA_PKT_PROTO_TRACE
-	cds_pkt_proto_trace_init();
-#endif /* QCA_PKT_PROTO_TRACE */
 
-ftm_processing:
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
-		if (CDF_STATUS_SUCCESS != wlan_hdd_ftm_open(hdd_ctx)) {
-			hddLog(CDF_TRACE_LEVEL_FATAL,
-			       FL("wlan_hdd_ftm_open Failed"));
-			goto err_config;
-		}
-#if  defined(QCA_WIFI_FTM)
-		if (hdd_ftm_start(hdd_ctx)) {
-			hddLog(CDF_TRACE_LEVEL_FATAL,
-			       FL("hdd_ftm_start Failed"));
-			goto err_free_ftm_open;
-		}
-#endif
-		/* registration of wiphy dev with cfg80211 */
-		if (0 > wlan_hdd_cfg80211_register(wiphy)) {
-			hddLog(LOGE, FL("wiphy register failed"));
-			goto err_free_ftm_open;
-		}
-
-		cds_set_load_unload_in_progress(false);
-		hdd_ctx->isLoadInProgress = false;
-		hddLog(LOGE, FL("FTM driver loaded"));
-		complete(&wlan_start_comp);
-		return CDF_STATUS_SUCCESS;
-	}
-#if defined(CONFIG_HDD_INIT_WITH_RTNL_LOCK)
-	rtnl_lock();
-	rtnl_lock_enable = true;
-#else
-	rtnl_lock_enable = false;
-#endif
-
-	if (hdd_ctx->config->dot11p_mode == WLAN_HDD_11P_STANDALONE)
-		/* Create only 802.11p interface */
-		adapter = hdd_open_adapter(hdd_ctx, WLAN_HDD_OCB, "wlanocb%d",
-					   wlan_hdd_get_intf_addr(hdd_ctx),
-					   rtnl_lock_enable);
-	else
-		adapter = hdd_open_adapter(hdd_ctx, WLAN_HDD_INFRA_STATION,
-					   "wlan%d",
-					   wlan_hdd_get_intf_addr(hdd_ctx),
-					   rtnl_lock_enable);
-
-#ifdef WLAN_OPEN_P2P_INTERFACE
-	/* Open P2P device interface */
-	if (adapter != NULL) {
-		if (hdd_ctx->config->isP2pDeviceAddrAdministrated &&
-		   !(hdd_ctx->config->intfMacAddr[0].bytes[0] & 0x02)) {
-			cdf_mem_copy(hdd_ctx->p2pDeviceAddress.bytes,
-				     hdd_ctx->config->intfMacAddr[0].bytes,
-				     sizeof(tSirMacAddr));
-
-			/*
-			 * Generate the P2P Device Address.  This consists of
-			 * the device's primary MAC address with the locally
-			 * administered bit set.
-			 */
-			hdd_ctx->p2pDeviceAddress.bytes[0] |= 0x02;
-		} else {
-			uint8_t *p2p_dev_addr = wlan_hdd_get_intf_addr(hdd_ctx);
-			if (p2p_dev_addr != NULL) {
-				cdf_mem_copy(&hdd_ctx->p2pDeviceAddress.
-					     bytes[0], p2p_dev_addr,
-					     CDF_MAC_ADDR_SIZE);
-			} else {
-				hddLog(CDF_TRACE_LEVEL_FATAL,
-				       FL(
-					  "Failed to allocate mac_address for p2p_device"
-					 ));
-				goto err_close_adapter;
-			}
-		}
-
-		pP2adapter =
-			hdd_open_adapter(hdd_ctx, WLAN_HDD_P2P_DEVICE, "p2p%d",
-					 &hdd_ctx->p2pDeviceAddress.bytes[0],
-					 rtnl_lock_enable);
+	cds_pkt_proto_trace_init();
 
-		if (NULL == pP2adapter) {
-			hddLog(CDF_TRACE_LEVEL_FATAL,
-			       FL(
-				  "Failed to do hdd_open_adapter for P2P Device Interface"
-				 ));
-			goto err_close_adapter;
-		}
-	}
-#endif
+	rtnl_held = hdd_hold_rtnl_lock();
 
-	if (adapter == NULL) {
-		hddLog(CDF_TRACE_LEVEL_ERROR, FL("hdd_open_adapter failed"));
-		goto err_close_adapter;
-	}
+	adapter = hdd_open_interfaces(hdd_ctx, rtnl_held);
 
-	/* Open 802.11p Interface */
-	if (adapter != NULL) {
-		if (hdd_ctx->config->dot11p_mode == WLAN_HDD_11P_CONCURRENT) {
-			dot11_adapter = hdd_open_adapter(hdd_ctx, WLAN_HDD_OCB,
-						"wlanocb%d",
-						wlan_hdd_get_intf_addr(hdd_ctx),
-						rtnl_lock_enable);
-			if (dot11_adapter == NULL) {
-				hddLog(LOGE,
-				       FL("failed to open 802.11p Interface"));
-				goto err_close_adapter;
-			}
-		}
+	if (IS_ERR(adapter)) {
+		ret = PTR_ERR(adapter);
+		goto err_cds_disable;
 	}
 
 	/*
@@ -5180,130 +5612,65 @@ ftm_processing:
 	/* pass target_fw_version to HIF layer */
 	hif_set_fw_info(hif_sc, hdd_ctx->target_fw_version);
 
-	if (country_code) {
-		CDF_STATUS ret;
-
-		INIT_COMPLETION(adapter->change_country_code);
+	ret = hdd_update_country_code(hdd_ctx, adapter);
 
-		ret = sme_change_country_code(hdd_ctx->hHal,
-					      wlan_hdd_change_country_code_callback,
-					      country_code, adapter,
-					      hdd_ctx->pcds_context, eSIR_TRUE,
-					      eSIR_TRUE);
-		if (CDF_STATUS_SUCCESS == ret) {
-			rc = wait_for_completion_timeout(
-				&adapter->change_country_code,
-				msecs_to_jiffies(WLAN_WAIT_TIME_COUNTRY));
-			if (!rc) {
-				hddLog(LOGE,
-				       FL("SME while setting country code timed out"));
-			}
-		} else {
-			hddLog(CDF_TRACE_LEVEL_ERROR,
-			       FL(
-				  "SME Change Country code from module param fail ret=%d"
-				 ),
-			       ret);
-			ret = -EINVAL;
-		}
-	}
+	if (ret)
+		goto err_cds_disable;
 
 	sme_register11d_scan_done_callback(hdd_ctx->hHal, hdd_11d_scan_done);
 
-#ifdef FEATURE_OEM_DATA_SUPPORT
 	sme_register_oem_data_rsp_callback(hdd_ctx->hHal,
 					hdd_send_oem_data_rsp_msg);
-#endif
 
-	/* Open debugfs interface */
-	if (CDF_STATUS_SUCCESS != hdd_debugfs_init(adapter)) {
-		hddLog(CDF_TRACE_LEVEL_ERROR,
-		       FL("hdd_debugfs_init failed!"));
-	}
+	status = hdd_debugfs_init(adapter);
+
+	if (CDF_IS_STATUS_SUCCESS(status))
+		hdd_err("hdd_debugfs_init failed: %d!", status);
 
 	/* FW capabilities received, Set the Dot11 mode */
 	sme_setdef_dot11mode(hdd_ctx->hHal);
-#if !defined(CONFIG_HDD_INIT_WITH_RTNL_LOCK)
-	/* register net device notifier for device change notification */
-	ret = register_netdevice_notifier(&hdd_netdev_notifier);
 
-	if (ret < 0) {
-		hddLog(CDF_TRACE_LEVEL_ERROR,
-		       FL("register_netdevice_notifier failed"));
-		goto err_free_power_on_lock;
-	}
-	reg_netdev_notifier_done = true;
-#endif
 	/* Initialize the nlink service */
 	if (nl_srv_init() != 0) {
 		hddLog(CDF_TRACE_LEVEL_FATAL, FL("nl_srv_init failed"));
-		goto err_reg_netdev;
+		goto err_close_adapter;
 	}
-#ifdef WLAN_KD_READY_NOTIFIER
-	hdd_ctx->kd_nl_init = 1;
-#endif /* WLAN_KD_READY_NOTIFIER */
 
-#ifdef FEATURE_OEM_DATA_SUPPORT
-	/* Initialize the OEM service */
-	if (oem_activate_service(hdd_ctx) != 0) {
-		hddLog(CDF_TRACE_LEVEL_FATAL,
-		       FL("oem_activate_service failed"));
+	ret = oem_activate_service(hdd_ctx);
+	if (ret) {
+		hdd_alert("oem_activate_service failed: %d", ret);
 		goto err_nl_srv;
 	}
-#endif
 
-#ifdef PTT_SOCK_SVC_ENABLE
-	/* Initialize the PTT service */
-	if (ptt_sock_activate_svc() != 0) {
-		hddLog(CDF_TRACE_LEVEL_FATAL,
-		       FL("ptt_sock_activate_svc failed"));
+	ret = ptt_sock_activate_svc();
+	if (ret) {
+		hdd_alert("ptt_sock_activate_svc failed: %d", ret);
 		goto err_nl_srv;
 	}
-#endif
 
-	/* Initialize the CNSS-DIAG service */
-	if (cnss_diag_activate_service() < 0) {
-		hddLog(CDF_TRACE_LEVEL_FATAL,
-		       FL("cnss_diag_activate_service failed"));
+	ret = cnss_diag_activate_service();
+	if (ret) {
+		hdd_alert("cnss_diag_activate_service failed: %d", ret);
 		goto err_nl_srv;
 	}
-#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
-	if (hdd_ctx->config->wlanLoggingEnable) {
-		if (wlan_logging_sock_activate_svc
-			    (hdd_ctx->config->wlanLoggingFEToConsole,
-			    hdd_ctx->config->wlanLoggingNumBuf)) {
-			hddLog(CDF_TRACE_LEVEL_ERROR,
-			       FL("wlan_logging_sock_activate_svc failed"));
-			goto err_nl_srv;
-		}
-	}
-#endif
-	if (cds_is_multicast_logging())
-		wlan_logging_set_log_level();
 
-	if (CDF_SAP_MODE != hdd_get_conparam()) {
-		/*
-		 * Action frame registered in one adapter which will
-		 * applicable to all interfaces
-		 */
-		wlan_hdd_cfg80211_register_frames(adapter);
-	}
+	/*
+	 * Action frame registered in one adapter which will
+	 * applicable to all interfaces
+	 */
+	wlan_hdd_cfg80211_register_frames(adapter);
 
 	mutex_init(&hdd_ctx->sap_lock);
 
-#if defined(CONFIG_HDD_INIT_WITH_RTNL_LOCK)
-	if (rtnl_lock_enable == true) {
-		rtnl_lock_enable = false;
-		rtnl_unlock();
-	}
+	hdd_release_rtnl_lock();
+	rtnl_held = false;
+
 	ret = register_netdevice_notifier(&hdd_netdev_notifier);
 	if (ret < 0) {
-		hddLog(CDF_TRACE_LEVEL_ERROR,
-		       FL("register_netdevice_notifier failed"));
+		hdd_err("register_netdevice_notifier failed: %d", ret);
 		goto err_nl_srv;
 	}
-	reg_netdev_notifier_done = true;
-#endif
+
 #ifdef WLAN_FEATURE_HOLD_RX_WAKELOCK
 	/* Initialize the wake lcok */
 	cdf_wake_lock_init(&hdd_ctx->rx_wake_lock, "qcom_rx_wakelock");
@@ -5313,7 +5680,10 @@ ftm_processing:
 
 	hdd_hostapd_channel_wakelock_init(hdd_ctx);
 
-	hdd_set_idle_ps_config(hdd_ctx, true);
+	if (hdd_ctx->config->fIsImpsEnabled)
+		hdd_set_idle_ps_config(hdd_ctx, true);
+	else
+		hdd_set_idle_ps_config(hdd_ctx, false);
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
 	if (hdd_ctx->config->WlanAutoShutdown != 0)
 		if (sme_set_auto_shutdown_cb
@@ -5334,62 +5704,28 @@ ftm_processing:
 		hddLog(LOGE, FL("Failed to init ACS Skip timer"));
 #endif
 
-	hdd_wlan_green_ap_init(hdd_ctx);
 	wlan_hdd_nan_init(hdd_ctx);
-	status = cds_init_policy_mgr(hdd_ctx);
+	status = cds_init_policy_mgr();
 	if (!CDF_IS_STATUS_SUCCESS(status)) {
 		hdd_err("Policy manager initialization failed");
-		goto err_nl_srv;
+		goto err_unreg_netdev_notifier;
 	}
 
-	/* Thermal Mitigation */
-	thermalParam.smeThermalMgmtEnabled =
-		hdd_ctx->config->thermalMitigationEnable;
-	thermalParam.smeThrottlePeriod = hdd_ctx->config->throttlePeriod;
+	ret = hdd_init_thermal_info(hdd_ctx);
 
-	thermalParam.smeThermalLevels[0].smeMinTempThreshold =
-		hdd_ctx->config->thermalTempMinLevel0;
-	thermalParam.smeThermalLevels[0].smeMaxTempThreshold =
-		hdd_ctx->config->thermalTempMaxLevel0;
-	thermalParam.smeThermalLevels[1].smeMinTempThreshold =
-		hdd_ctx->config->thermalTempMinLevel1;
-	thermalParam.smeThermalLevels[1].smeMaxTempThreshold =
-		hdd_ctx->config->thermalTempMaxLevel1;
-	thermalParam.smeThermalLevels[2].smeMinTempThreshold =
-		hdd_ctx->config->thermalTempMinLevel2;
-	thermalParam.smeThermalLevels[2].smeMaxTempThreshold =
-		hdd_ctx->config->thermalTempMaxLevel2;
-	thermalParam.smeThermalLevels[3].smeMinTempThreshold =
-		hdd_ctx->config->thermalTempMinLevel3;
-	thermalParam.smeThermalLevels[3].smeMaxTempThreshold =
-		hdd_ctx->config->thermalTempMaxLevel3;
+	if (ret) {
+		hdd_err("Error while initializing thermal information");
+		goto err_unreg_netdev_notifier;
+	}
 
 	if (0 != hdd_lro_init(hdd_ctx))
 		hdd_err("Unable to initialize LRO in fw");
 
-	if (CDF_STATUS_SUCCESS !=
-	    sme_init_thermal_info(hdd_ctx->hHal, thermalParam)) {
-		hddLog(CDF_TRACE_LEVEL_ERROR,
-		       FL("Error while initializing thermal information"));
-	}
-
-	/* Plug in set thermal level callback */
-	sme_add_set_thermal_level_callback(hdd_ctx->hHal,
-		(sme_set_thermal_level_callback)hdd_set_thermal_level_cb);
-
-	/* SAR power limit */
-	hddtxlimit = cdf_mem_malloc(sizeof(tSirTxPowerLimit));
-	if (!hddtxlimit) {
-		hddLog(CDF_TRACE_LEVEL_ERROR,
-		       FL("Memory allocation for TxPowerLimit failed!"));
-		goto err_nl_srv;
-	}
-	hddtxlimit->txPower2g = hdd_ctx->config->TxPower2g;
-	hddtxlimit->txPower5g = hdd_ctx->config->TxPower5g;
-
-	if (CDF_STATUS_SUCCESS != sme_txpower_limit(hdd_ctx->hHal, hddtxlimit))
-		hddLog(CDF_TRACE_LEVEL_ERROR,
-		       FL("Error setting txlimit in sme"));
+	hddtxlimit.txPower2g = hdd_ctx->config->TxPower2g;
+	hddtxlimit.txPower5g = hdd_ctx->config->TxPower5g;
+	status = sme_txpower_limit(hdd_ctx->hHal, &hddtxlimit);
+	if (CDF_IS_STATUS_SUCCESS(status))
+		hdd_err("Error setting txlimit in sme: %d", status);
 
 #ifdef MSM_PLATFORM
 	spin_lock_init(&hdd_ctx->bus_bw_lock);
@@ -5398,25 +5734,20 @@ ftm_processing:
 			  hdd_bus_bw_compute_cbk, (void *)hdd_ctx);
 #endif
 
-#ifdef WLAN_FEATURE_STATS_EXT
 	wlan_hdd_cfg80211_stats_ext_init(hdd_ctx);
-#endif
-#ifdef FEATURE_WLAN_EXTSCAN
+
 	sme_ext_scan_register_callback(hdd_ctx->hHal,
 				       wlan_hdd_cfg80211_extscan_callback);
-#endif /* FEATURE_WLAN_EXTSCAN */
+
 	sme_set_rssi_threshold_breached_cb(hdd_ctx->hHal,
 				hdd_rssi_threshold_breached);
-#ifdef WLAN_FEATURE_LINK_LAYER_STATS
-	wlan_hdd_cfg80211_link_layer_stats_init(hdd_ctx);
-#endif
 
-#ifdef WLAN_FEATURE_LPSS
+	hdd_cfg80211_link_layer_stats_init(hdd_ctx);
+
 	wlan_hdd_send_all_scan_intf_info(hdd_ctx);
 	wlan_hdd_send_version_pkg(hdd_ctx->target_fw_version,
 				  hdd_ctx->target_hw_version,
 				  hdd_ctx->target_hw_name);
-#endif
 
 	cdf_spinlock_init(&hdd_ctx->hdd_roc_req_q_lock);
 	cdf_list_init((&hdd_ctx->hdd_roc_req_q), MAX_ROC_REQ_QUEUE_ENTRY);
@@ -5452,16 +5783,19 @@ ftm_processing:
 		status = wlan_hdd_disable_all_dual_mac_features(hdd_ctx);
 		if (status != CDF_STATUS_SUCCESS) {
 			hdd_err("Failed to disable dual mac features");
-			goto err_nl_srv;
+			goto err_unreg_netdev_notifier;
 		}
 	}
 
 	hif_enable_power_gating(hif_sc);
-	hdd_ctx->isLoadInProgress = false;
-	cds_set_load_unload_in_progress(false);
-	complete(&wlan_start_comp);
+
+	memdump_init();
+
 	goto success;
 
+err_unreg_netdev_notifier:
+	unregister_netdevice_notifier(&hdd_netdev_notifier);
+
 err_nl_srv:
 #ifdef WLAN_KD_READY_NOTIFIER
 	cnss_diag_notify_wlan_close();
@@ -5469,85 +5803,40 @@ err_nl_srv:
 #endif /* WLAN_KD_READY_NOTIFIER */
 	nl_srv_exit();
 
-	if (!CDF_IS_STATUS_SUCCESS
-			(cdf_mutex_destroy(&hdd_ctx->hdd_conc_list_lock))) {
-		hdd_err("Failed to destroy hdd_conc_list_lock");
+	if (!CDF_IS_STATUS_SUCCESS(cds_deinit_policy_mgr())) {
+		hdd_err("Failed to deinit policy manager");
 		/* Proceed and complete the clean up */
 	}
-err_reg_netdev:
-	if (rtnl_lock_enable == true) {
-		rtnl_lock_enable = false;
-		rtnl_unlock();
-	}
-	if (reg_netdev_notifier_done == true) {
-	unregister_netdevice_notifier(&hdd_netdev_notifier);
-		reg_netdev_notifier_done = false;
-	}
-#if !defined(CONFIG_HDD_INIT_WITH_RTNL_LOCK)
-err_free_power_on_lock:
-#endif
+
 	hdd_debugfs_exit(hdd_ctx);
 
 err_close_adapter:
-#if defined(CONFIG_HDD_INIT_WITH_RTNL_LOCK)
-	if (rtnl_lock_enable == true) {
-		rtnl_lock_enable = false;
-		rtnl_unlock();
-	}
-#endif
-	hdd_close_all_adapters(hdd_ctx);
+	hdd_release_rtnl_lock();
+
+	hdd_close_all_adapters(hdd_ctx, false);
 
 err_cds_disable:
-	cds_disable(p_cds_context);
+	cds_disable(hdd_ctx->pcds_context);
+
+err_ipa_cleanup:
+	hdd_ipa_cleanup(hdd_ctx);
 
 err_wiphy_unregister:
-	wiphy_unregister(wiphy);
+	wiphy_unregister(hdd_ctx->wiphy);
 
 err_cds_close:
-	status = cds_sched_close(p_cds_context);
+	status = cds_sched_close(hdd_ctx->pcds_context);
 	if (!CDF_IS_STATUS_SUCCESS(status)) {
 		hddLog(CDF_TRACE_LEVEL_FATAL,
 		       FL("Failed to close CDS Scheduler"));
 		CDF_ASSERT(CDF_IS_STATUS_SUCCESS(status));
 	}
-	cds_close(p_cds_context);
-
-err_cds_open:
-
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
-#if  defined(QCA_WIFI_FTM)
-err_free_ftm_open:
-		wlan_hdd_ftm_close(hdd_ctx);
-#endif
-	}
-
-err_config:
-	kfree(hdd_ctx->config);
-	hdd_ctx->config = NULL;
+	cds_close(hdd_ctx->pcds_context);
 
-err_free_hdd_context:
-	/* wiphy_free() will free the HDD context so remove global reference */
-	if (p_cds_context)
-		((cds_context_type *) (p_cds_context))->pHDDContext = NULL;
-
-	wiphy_free(wiphy);
-	/* kfree(wdev) ; */
+err_hdd_free_context:
+	hdd_free_context(hdd_ctx);
 	CDF_BUG(1);
 
-	if (hdd_is_ssr_required()) {
-#ifdef MSM_PLATFORM
-#ifdef CONFIG_CNSS
-		/*
-		 * WDI timeout had happened during load, so SSR is needed
-		 * here
-		 */
-		subsystem_restart("wcnss");
-#endif
-#endif
-		msleep(5000);
-	}
-	hdd_set_ssr_required(false);
-
 	return -EIO;
 
 success:
@@ -5555,340 +5844,6 @@ success:
 	return 0;
 }
 
-/*
- * In BMI Phase we are only sending small chunk (256 bytes) of the FW image at
- * a time, and wait for the completion interrupt to start the next transfer.
- * During this phase, the KRAIT is entering IDLE/StandAlone(SA) Power Save(PS).
- * The delay incurred for resuming from IDLE/SA PS is huge during driver load.
- * So prevent APPS IDLE/SA PS durint driver load for reducing interrupt latency.
- */
-
-#ifdef CONFIG_CNSS
-static inline void hdd_request_pm_qos(int val)
-{
-	cnss_request_pm_qos(val);
-}
-
-static inline void hdd_remove_pm_qos(void)
-{
-	cnss_remove_pm_qos();
-}
-#else
-static inline void hdd_request_pm_qos(int val)
-{
-}
-
-static inline void hdd_remove_pm_qos(void)
-{
-}
-#endif
-
-/**
- * hdd_driver_init() - Core Driver Init Function
- *
- * This is the driver entry point - called in different timeline depending
- * on whether the driver is statically or dynamically linked
- *
- * Return: 0 for success, non zero for failure
- */
-static int hdd_driver_init(void)
-{
-	CDF_STATUS status;
-	v_CONTEXT_t p_cds_context = NULL;
-	int ret_status = 0;
-	unsigned long rc;
-
-#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
-	wlan_logging_sock_init_svc();
-#endif
-
-	ENTER();
-
-	cdf_wake_lock_init(&wlan_wake_lock, "wlan");
-	hdd_prevent_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_INIT);
-	/*
-	* The Krait is going to Idle/Stand Alone Power Save
-	* more aggressively which is resulting in the longer driver load time.
-	* The Fix is to not allow Krait to enter Idle Power Save during driver
-	* load.
-	*/
-	hdd_request_pm_qos(DISABLE_KRAIT_IDLE_PS_VAL);
-	cds_ssr_protect_init();
-
-	pr_info("%s: loading driver v%s\n", WLAN_MODULE_NAME,
-		QWLAN_VERSIONSTR TIMER_MANAGER_STR MEMORY_DEBUG_STR);
-
-	do {
-		cdf_mc_timer_manager_init();
-		cdf_mem_init();
-		/* Allocate CDS global context */
-		status = cds_alloc_global_context(&p_cds_context);
-
-		if (!CDF_IS_STATUS_SUCCESS(status)) {
-			hddLog(CDF_TRACE_LEVEL_FATAL,
-			       FL("Failed to preOpen CDS"));
-			ret_status = -1;
-			break;
-		}
-
-		hdd_trace_init();
-
-#ifndef MODULE
-		/*
-		 * For statically linked driver, call hdd_set_conparam to update
-		 * curr_con_mode
-		 */
-		hdd_set_conparam((uint32_t) con_mode);
-#endif
-
-#ifdef QCA_WIFI_3_0_ADRASTEA
-#define HDD_WLAN_START_WAIT_TIME (3600 * 1000)
-#else
-#define HDD_WLAN_START_WAIT_TIME (CDS_WMA_TIMEOUT + 5000)
-#endif
-
-		init_completion(&wlan_start_comp);
-		ret_status = wlan_hdd_register_driver();
-		if (!ret_status) {
-			rc = wait_for_completion_timeout(
-				&wlan_start_comp,
-				msecs_to_jiffies(HDD_WLAN_START_WAIT_TIME));
-			if (!rc) {
-				hddLog(LOGP,
-					FL("timed-out waiting for wlan_hdd_register_driver"));
-				ret_status = -1;
-			} else
-				ret_status = 0;
-		}
-
-		hdd_remove_pm_qos();
-		hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_DRIVER_INIT);
-
-		if (ret_status) {
-			hddLog(LOGP, FL("WLAN Driver Initialization failed"));
-			wlan_hdd_unregister_driver();
-			cds_free_global_context(&p_cds_context);
-			ret_status = -ENODEV;
-			break;
-		} else {
-			pr_info("%s: driver loaded\n", WLAN_MODULE_NAME);
-			memdump_init();
-			return 0;
-		}
-
-	} while (0);
-
-	if (0 != ret_status) {
-		cdf_mc_timer_exit();
-		cdf_mem_exit();
-		cdf_wake_lock_destroy(&wlan_wake_lock);
-
-#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
-		wlan_logging_sock_deinit_svc();
-#endif
-		memdump_deinit();
-		pr_err("%s: driver load failure\n", WLAN_MODULE_NAME);
-	} else {
-		pr_info("%s: driver loaded\n", WLAN_MODULE_NAME);
-	}
-
-	EXIT();
-
-	return ret_status;
-}
-
-/**
- * hdd_module_init() - Init Function
- *
- * This is the driver entry point (invoked when module is loaded using insmod)
- *
- * Return: 0 for success, non zero for failure
- */
-#ifdef MODULE
-static int __init hdd_module_init(void)
-{
-	return hdd_driver_init();
-}
-#else /* #ifdef MODULE */
-static int __init hdd_module_init(void)
-{
-	/* Driver initialization is delayed to fwpath_changed_handler */
-	return 0;
-}
-#endif /* #ifdef MODULE */
-
-/**
- * hdd_driver_exit() - Exit function
- *
- * This is the driver exit point (invoked when module is unloaded using rmmod
- * or con_mode was changed by userspace)
- *
- * Return: None
- */
-static void hdd_driver_exit(void)
-{
-	hdd_context_t *hdd_ctx = NULL;
-	int retry = 0;
-
-	pr_info("%s: unloading driver v%s\n", WLAN_MODULE_NAME,
-		QWLAN_VERSIONSTR);
-
-	hdd_ctx = cds_get_context(CDF_MODULE_ID_HDD);
-	if (!hdd_ctx) {
-		hddLog(CDF_TRACE_LEVEL_FATAL,
-		       FL("module exit called before probe"));
-	} else {
-		/* Check IPA HW Pipe shutdown */
-		hdd_ipa_uc_force_pipe_shutdown(hdd_ctx);
-#ifdef QCA_PKT_PROTO_TRACE
-		cds_pkt_proto_trace_close();
-#endif /* QCA_PKT_PROTO_TRACE */
-		while (hdd_ctx->isLogpInProgress ||
-		       cds_is_logp_in_progress()) {
-			hddLog(CDF_TRACE_LEVEL_FATAL,
-			       FL(
-				  "SSR in Progress; block rmmod for 1 second!!!"
-				  ));
-			msleep(1000);
-
-			if (retry++ == HDD_MOD_EXIT_SSR_MAX_RETRIES) {
-				hddLog(CDF_TRACE_LEVEL_FATAL,
-				       FL("SSR never completed, fatal error"));
-				CDF_BUG(0);
-			}
-		}
-
-		rtnl_lock();
-		hdd_ctx->isUnloadInProgress = true;
-		cds_set_load_unload_in_progress(true);
-		rtnl_unlock();
-	}
-
-	cds_wait_for_work_thread_completion(__func__);
-	memdump_deinit();
-
-	wlan_hdd_unregister_driver();
-	return;
-}
-
-/**
- * hdd_module_exit() - Exit function
- *
- * This is the driver exit point (invoked when module is unloaded using rmmod)
- *
- * Return: None
- */
-static void __exit hdd_module_exit(void)
-{
-	hdd_driver_exit();
-}
-
-#ifdef MODULE
-static int fwpath_changed_handler(const char *kmessage, struct kernel_param *kp)
-{
-	return param_set_copystring(kmessage, kp);
-}
-
-#if !defined(QCA_WIFI_FTM)
-static int con_mode_handler(const char *kmessage, struct kernel_param *kp)
-{
-	return param_set_int(kmessage, kp);
-}
-#endif
-#else /* #ifdef MODULE */
-/**
- * kickstart_driver() - driver entry point
- *
- * This is the driver entry point
- * - delayed driver initialization when driver is statically linked
- * - invoked when module parameter fwpath is modified from userspace to signal
- *   initializing the WLAN driver or when con_mode is modified from userspace
- *   to signal a switch in operating mode
- *
- * Return: 0 for success, non zero for failure
- */
-static int kickstart_driver(void)
-{
-	int ret_status;
-
-	if (!wlan_hdd_inited) {
-		ret_status = hdd_driver_init();
-		wlan_hdd_inited = ret_status ? 0 : 1;
-		return ret_status;
-	}
-
-	hdd_driver_exit();
-
-	msleep(200);
-
-	ret_status = hdd_driver_init();
-	wlan_hdd_inited = ret_status ? 0 : 1;
-	return ret_status;
-}
-
-/**
- * fwpath_changed_handler() - Handler Function
- *
- * Handle changes to the fwpath parameter
- *
- * Return: 0 for success, non zero for failure
- */
-static int fwpath_changed_handler(const char *kmessage, struct kernel_param *kp)
-{
-	int ret;
-
-	ret = param_set_copystring(kmessage, kp);
-	if (0 == ret)
-		ret = kickstart_driver();
-	return ret;
-}
-
-#if !defined(QCA_WIFI_FTM)
-/**
- * con_mode_handler() - handls module param con_mode change
- *
- * Handler function for module param con_mode when it is changed by userspace
- * Dynamically linked - do nothing
- * Statically linked - exit and init driver, as in rmmod and insmod
- *
- * Return -
- */
-static int con_mode_handler(const char *kmessage, struct kernel_param *kp)
-{
-	int ret;
-
-	ret = param_set_int(kmessage, kp);
-	if (0 == ret)
-		ret = kickstart_driver();
-	return ret;
-}
-#endif
-#endif /* #ifdef MODULE */
-
-/**
- * hdd_get_conparam() - driver exit point
- *
- * This is the driver exit point (invoked when module is unloaded using rmmod)
- *
- * Return: tCDF_CON_MODE
- */
-tCDF_CON_MODE hdd_get_conparam(void)
-{
-#ifdef MODULE
-	return (tCDF_CON_MODE) con_mode;
-#else
-	return (tCDF_CON_MODE) curr_con_mode;
-#endif
-}
-
-void hdd_set_conparam(uint32_t newParam)
-{
-	con_mode = newParam;
-#ifndef MODULE
-	curr_con_mode = con_mode;
-#endif
-}
-
 /**
  * hdd_softap_sta_deauth() - handle deauth req from HDD
  * @adapter:	Pointer to the HDD
@@ -6072,7 +6027,6 @@ int wlan_hdd_gen_wlan_version_pack(struct wlan_version_data *data,
 }
 #endif
 
-#if defined(FEATURE_WLAN_LFR)
 /**
  * wlan_hdd_disable_roaming() - disable roaming on all STAs except the input one
  * @adapter:	HDD adapter pointer
@@ -6178,7 +6132,6 @@ void wlan_hdd_enable_roaming(hdd_adapter_t *adapter)
 		}
 	}
 }
-#endif
 
 void wlan_hdd_send_svc_nlink_msg(int type, void *data, int len)
 {
@@ -6253,7 +6206,7 @@ void wlan_hdd_send_status_pkg(hdd_adapter_t *adapter,
 	int ret = 0;
 	struct wlan_status_data data;
 
-	if (CDF_FTM_MODE == hdd_get_conparam())
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam())
 		return;
 
 	memset(&data, 0, sizeof(struct wlan_status_data));
@@ -6285,7 +6238,7 @@ void wlan_hdd_send_version_pkg(uint32_t fw_version,
 		return;
 #endif
 
-	if (CDF_FTM_MODE == hdd_get_conparam())
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam())
 		return;
 
 	memset(&data, 0, sizeof(struct wlan_version_data));
@@ -6331,6 +6284,24 @@ void wlan_hdd_send_all_scan_intf_info(hdd_context_t *hdd_ctx)
 	if (!scan_intf_found)
 		wlan_hdd_send_status_pkg(pDataAdapter, NULL, 1, 0);
 }
+#else
+static inline void wlan_hdd_send_status_pkg(hdd_adapter_t *pAdapter,
+					    hdd_station_ctx_t *pHddStaCtx,
+					    uint8_t is_on, uint8_t is_connected)
+{
+	return;
+}
+
+static inline void wlan_hdd_send_version_pkg(uint32_t fw_version, uint32_t
+					     chip_id, const char *chip_name)
+{
+	return;
+}
+
+static inline void wlan_hdd_send_all_scan_intf_info(hdd_context_t *pHddCtx)
+{
+	return;
+}
 #endif
 
 #ifdef FEATURE_WLAN_AUTO_SHUTDOWN
@@ -6639,8 +6610,7 @@ void wlan_hdd_stop_sap(hdd_adapter_t *ap_adapter)
 			}
 		}
 		clear_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags);
-		cds_decr_session_set_pcl(hdd_ctx,
-						ap_adapter->device_mode,
+		cds_decr_session_set_pcl(ap_adapter->device_mode,
 						ap_adapter->sessionId);
 		hddLog(CDF_TRACE_LEVEL_INFO_HIGH,
 		       FL("SAP Stop Success"));
@@ -6674,6 +6644,11 @@ void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter)
 		return;
 	}
 
+	if (WLAN_HDD_SOFTAP != ap_adapter->device_mode) {
+		hdd_err("SoftAp role has not been enabled");
+		return;
+	}
+
 	hdd_ctx = WLAN_HDD_GET_CTX(ap_adapter);
 	hdd_ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(ap_adapter);
 	hostapd_state = WLAN_HDD_GET_HOSTAP_STATE_PTR(ap_adapter);
@@ -6710,7 +6685,7 @@ void wlan_hdd_start_sap(hdd_adapter_t *ap_adapter)
 	}
 	hddLog(CDF_TRACE_LEVEL_INFO_HIGH, FL("SAP Start Success"));
 	set_bit(SOFTAP_BSS_STARTED, &ap_adapter->event_flags);
-	cds_incr_active_session(hdd_ctx, ap_adapter->device_mode,
+	cds_incr_active_session(ap_adapter->device_mode,
 					ap_adapter->sessionId);
 	hostapd_state->bCommit = true;
 
@@ -6721,18 +6696,6 @@ end:
 #endif
 
 /**
- * hdd_wlan_get_wake_lock_ptr(): get HDD's wake lock pointer
- *
- * This function returns the wake lock pointer to the caller
- *
- * Return: cdf_wake_lock_t
- */
-cdf_wake_lock_t *hdd_wlan_get_wake_lock_ptr(void)
-{
-	return &wlan_wake_lock;
-}
-
-/**
  * hdd_get_fw_version() - Get FW version
  * @hdd_ctx:     pointer to HDD context.
  * @major_spid:  FW version - major spid.
@@ -6782,6 +6745,235 @@ const char *hdd_get_fwpath(void)
 	return fwpath.string;
 }
 
+/**
+ * hdd_init() - Initialize Driver
+ *
+ * This function initilizes CDS global context with the help of cds_init. This
+ * has to be the first function called after probe to get a valid global
+ * context.
+ *
+ * Return: 0 for success, errno on failure
+ */
+int hdd_init(void)
+{
+	v_CONTEXT_t p_cds_context = NULL;
+	int ret = 0;
+
+#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
+	wlan_logging_sock_init_svc();
+#endif
+	p_cds_context = cds_init();
+
+	if (p_cds_context == NULL) {
+		hdd_alert("Failed to allocate CDS context");
+		ret = -ENOMEM;
+		goto err_out;
+	}
+
+	hdd_trace_init();
+
+err_out:
+	return ret;
+}
+
+/**
+ * hdd_deinit() - Deinitialize Driver
+ *
+ * This function frees CDS global context with the help of cds_deinit. This
+ * has to be the last function call in remove callback to free the global
+ * context.
+ */
+void hdd_deinit(void)
+{
+	cds_deinit();
+
+#ifdef WLAN_LOGGING_SOCK_SVC_ENABLE
+	wlan_logging_sock_deinit_svc();
+#endif
+}
+
+#ifdef QCA_WIFI_3_0_ADRASTEA
+#define HDD_WLAN_START_WAIT_TIME (3600 * 1000)
+#else
+#define HDD_WLAN_START_WAIT_TIME (CDS_WMA_TIMEOUT + 5000)
+#endif
+
+/**
+ * __hdd_module_init - Module init helper
+ *
+ * Module init helper function used by both module and static driver.
+ *
+ * Return: 0 for success, errno on failure
+ */
+static int __hdd_module_init(void)
+{
+	int ret = 0;
+
+	pr_info("%s: Loading driver v%s\n", WLAN_MODULE_NAME,
+		QWLAN_VERSIONSTR TIMER_MANAGER_STR MEMORY_DEBUG_STR);
+
+	cdf_wake_lock_init(&wlan_wake_lock, "wlan");
+
+	hdd_set_conparam((uint32_t) con_mode);
+
+	ret = wlan_hdd_register_driver();
+	if (ret) {
+		pr_err("%s: driver load failure\n", WLAN_MODULE_NAME);
+		goto out;
+	}
+
+	pr_info("%s: driver loaded\n", WLAN_MODULE_NAME);
+
+	return 0;
+out:
+	cdf_wake_lock_destroy(&wlan_wake_lock);
+	return ret;
+}
+
+/**
+ * __hdd_module_exit - Module exit helper
+ *
+ * Module exit helper function used by both module and static driver.
+ */
+static void __hdd_module_exit(void)
+{
+	pr_info("%s: Unloading driver v%s\n", WLAN_MODULE_NAME,
+		QWLAN_VERSIONSTR);
+
+	wlan_hdd_unregister_driver();
+
+	cdf_wake_lock_destroy(&wlan_wake_lock);
+
+	return;
+}
+
+/**
+ * hdd_module_init() - Init Function
+ *
+ * This is the driver entry point (invoked when module is loaded using insmod)
+ *
+ * Return: 0 for success, non zero for failure
+ */
+#ifdef MODULE
+static int __init hdd_module_init(void)
+{
+	return __hdd_module_init();
+}
+#else /* #ifdef MODULE */
+static int __init hdd_module_init(void)
+{
+	/* Driver initialization is delayed to fwpath_changed_handler */
+	return 0;
+}
+#endif /* #ifdef MODULE */
+
+/**
+ * hdd_module_exit() - Exit function
+ *
+ * This is the driver exit point (invoked when module is unloaded using rmmod)
+ *
+ * Return: None
+ */
+static void __exit hdd_module_exit(void)
+{
+	__hdd_module_exit();
+}
+
+#ifdef MODULE
+static int fwpath_changed_handler(const char *kmessage, struct kernel_param *kp)
+{
+	return param_set_copystring(kmessage, kp);
+}
+#else /* #ifdef MODULE */
+
+/**
+ * kickstart_driver() - driver entry point
+ *
+ * This is the driver entry point
+ * - delayed driver initialization when driver is statically linked
+ * - invoked when module parameter fwpath is modified from userspace to signal
+ *   initializing the WLAN driver or when con_mode is modified from userspace
+ *   to signal a switch in operating mode
+ *
+ * Return: 0 for success, non zero for failure
+ */
+static int kickstart_driver(void)
+{
+	int ret = 0;
+
+	if (!wlan_hdd_inited) {
+		ret = __hdd_module_init();
+		wlan_hdd_inited = ret ? 0 : 1;
+
+		return ret;
+	}
+
+	__hdd_module_exit();
+
+	msleep(200);
+
+	ret = __hdd_module_init();
+
+	wlan_hdd_inited = ret ? 0 : 1;
+
+	return ret;
+}
+
+/**
+ * fwpath_changed_handler() - Handler Function
+ *
+ * Handle changes to the fwpath parameter
+ *
+ * Return: 0 for success, non zero for failure
+ */
+static int fwpath_changed_handler(const char *kmessage, struct kernel_param *kp)
+{
+	int ret;
+
+	ret = param_set_copystring(kmessage, kp);
+	if (0 == ret)
+		ret = kickstart_driver();
+	return ret;
+}
+
+#ifdef QCA_WIFI_FTM
+/**
+ * con_mode_handler() - Handles module param con_mode change
+ *
+ * Handler function for module param con_mode when it is changed by userspace
+ * Dynamically linked - do nothing
+ * Statically linked - exit and init driver, as in rmmod and insmod
+ *
+ * Return -
+ */
+static int con_mode_handler(const char *kmessage, struct kernel_param *kp)
+{
+	int ret;
+
+	ret = param_set_int(kmessage, kp);
+	if (0 == ret)
+		ret = kickstart_driver();
+	return ret;
+}
+#endif /* QCA_WIFI_FTM */
+#endif /* #ifdef MODULE */
+
+/**
+ * hdd_get_conparam() - driver exit point
+ *
+ * This is the driver exit point (invoked when module is unloaded using rmmod)
+ *
+ * Return: enum tCDF_GLOBAL_CON_MODE
+ */
+enum tCDF_GLOBAL_CON_MODE hdd_get_conparam(void)
+{
+	return (enum tCDF_GLOBAL_CON_MODE) curr_con_mode;
+}
+
+void hdd_set_conparam(uint32_t con_param)
+{
+	curr_con_mode = con_param;
+}
 
 /* Register the module init/exit functions */
 module_init(hdd_module_init);
@@ -6791,11 +6983,11 @@ MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Qualcomm Atheros, Inc.");
 MODULE_DESCRIPTION("WLAN HOST DEVICE DRIVER");
 
-#if  defined(QCA_WIFI_FTM)
-module_param(con_mode, int, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
-#else
+#if !defined(MODULE) && defined(QCA_WIFI_FTM)
 module_param_call(con_mode, con_mode_handler, param_get_int, &con_mode,
 		  S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+#else
+module_param(con_mode, int, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
 #endif
 
 module_param_call(fwpath, fwpath_changed_handler, param_get_string, &fwpath,
diff --git a/core/hdd/src/wlan_hdd_memdump.c b/core/hdd/src/wlan_hdd_memdump.c
index d1ad781ed929..9013e81a77ed 100644
--- a/core/hdd/src/wlan_hdd_memdump.c
+++ b/core/hdd/src/wlan_hdd_memdump.c
@@ -368,7 +368,6 @@ static struct proc_dir_entry *proc_file, *proc_dir;
  *
  * Return: void pointer to hdd_context
  */
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)) || defined(WITH_BACKPORTS)
 static void *memdump_get_file_data(struct file *file)
 {
 	void *hdd_ctx;
@@ -376,15 +375,6 @@ static void *memdump_get_file_data(struct file *file)
 	hdd_ctx = PDE_DATA(file_inode(file));
 	return hdd_ctx;
 }
-#else
-static void *memdump_get_file_data(struct file *file)
-{
-	void *hdd_ctx;
-
-	hdd_ctx = PDE(file->f_path.dentry->d_inode)->data;
-	return hdd_ctx;
-}
-#endif
 
 /**
  * memdump_read() - perform read operation in memory dump proc file
@@ -558,7 +548,7 @@ int memdump_init(void)
 		return -EINVAL;
 	}
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Not initializing memdump in FTM mode"));
 		return -EINVAL;
 	}
@@ -612,7 +602,7 @@ void memdump_deinit(void)
 		return;
 	}
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Not deinitializing memdump in FTM mode"));
 		return;
 	}
diff --git a/core/hdd/src/wlan_hdd_nan.c b/core/hdd/src/wlan_hdd_nan.c
index 4fff12bd158d..7e1e8c613152 100644
--- a/core/hdd/src/wlan_hdd_nan.c
+++ b/core/hdd/src/wlan_hdd_nan.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -25,6 +25,9 @@
  * WLAN Host Device Driver NAN API implementation
  */
 
+/* denote that this file does not allow legacy hddLog */
+#define HDD_DISALLOW_LEGACY_HDDLOG 1
+
 #include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -65,7 +68,7 @@ static int __wlan_hdd_cfg80211_nan_request(struct wiphy *wiphy,
 	if (ret_val)
 		return ret_val;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -131,15 +134,13 @@ static void wlan_hdd_cfg80211_nan_callback(void *ctx, tSirNanEvent *msg)
 	int status;
 
 	if (NULL == msg) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
-			  FL("msg received here is null"));
+		hdd_err("msg received here is null");
 		return;
 	}
 
 	status = wlan_hdd_validate_context(hdd_ctx);
 	if (0 != status) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
-			  FL("HDD context is not valid"));
+		hdd_err("HDD context is not valid");
 		return;
 	}
 
@@ -151,14 +152,12 @@ static void wlan_hdd_cfg80211_nan_callback(void *ctx, tSirNanEvent *msg)
 					    GFP_KERNEL);
 
 	if (!vendor_event) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
-			  FL("cfg80211_vendor_event_alloc failed"));
+		hdd_err("cfg80211_vendor_event_alloc failed");
 		return;
 	}
 	if (nla_put(vendor_event, QCA_WLAN_VENDOR_ATTR_NAN,
 		    msg->event_data_len, msg->event_data)) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
-			  FL("QCA_WLAN_VENDOR_ATTR_NAN put fail"));
+		hdd_err("QCA_WLAN_VENDOR_ATTR_NAN put fail");
 		kfree_skb(vendor_event);
 		return;
 	}
diff --git a/core/hdd/src/wlan_hdd_ocb.c b/core/hdd/src/wlan_hdd_ocb.c
index 881859a074b8..f8df3fbfcd35 100644
--- a/core/hdd/src/wlan_hdd_ocb.c
+++ b/core/hdd/src/wlan_hdd_ocb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -121,113 +121,6 @@ static int dot11p_validate_qos_params(struct sir_qos_params qos_params[])
 	return 0;
 }
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 16, 0)) || \
-				 defined(FEATURE_STATICALLY_ADD_11P_CHANNELS)
-/*
- * If FEATURE_STATICALLY_ADD_11P_CHANNELS
- * is defined, IEEE80211_CHAN_NO_10MHZ,
- * and IEEE80211_CHAN_NO_20MHZ won't
- * be defined.
- */
-#define IEEE80211_CHAN_NO_20MHZ	(1<<11)
-#define IEEE80211_CHAN_NO_10MHZ	(1<<12)
-#endif
-
-#ifdef FEATURE_STATICALLY_ADD_11P_CHANNELS
-
-#define DOT11P_TX_PWR_MAX	30
-#define DOT11P_TX_ANTENNA_MAX	6
-#define NUM_DOT11P_CHANNELS	10
-/**
- * struct chan_info - information for the channel
- * @center_freq: center frequency
- * @max_bandwidth: maximum bandwidth of the channel in MHz
- */
-struct chan_info {
-	uint32_t center_freq;
-	uint32_t max_bandwidth;
-};
-
-struct chan_info valid_dot11p_channels[NUM_DOT11P_CHANNELS] = {
-	{5860, 10},
-	{5870, 10},
-	{5880, 10},
-	{5890, 10},
-	{5900, 10},
-	{5910, 10},
-	{5920, 10},
-	{5875, 20},
-	{5905, 20},
-	{5852, 5}
-};
-
-/**
- * dot11p_validate_channel_static_channels() - validate a DSRC channel
- * @center_freq: the channel's center frequency
- * @bandwidth: the channel's bandwidth
- * @tx_power: transmit power
- * @reg_power: (output) the max tx power from the regulatory domain
- * @antenna_max: (output) the max antenna gain from the regulatory domain
- *
- * This function of the function checks the channel parameters against a
- * hardcoded list of valid channels based on the FCC rules.
- *
- * Return: 0 if the channel is valid, error code otherwise.
- */
-static int dot11p_validate_channel_static_channels(struct wiphy *wiphy,
-	uint32_t channel_freq, uint32_t bandwidth, uint32_t tx_power,
-	uint8_t *reg_power, uint8_t *antenna_max)
-{
-	int i;
-
-	for (i = 0; i < NUM_DOT11P_CHANNELS; i++) {
-		if (channel_freq == valid_dot11p_channels[i].center_freq) {
-			if (reg_power)
-				*reg_power = DOT11P_TX_PWR_MAX;
-			if (antenna_max)
-				*antenna_max = DOT11P_TX_ANTENNA_MAX;
-
-			if (bandwidth == 0)
-				bandwidth =
-					valid_dot11p_channels[i].max_bandwidth;
-			else if (bandwidth >
-				 valid_dot11p_channels[i].max_bandwidth)
-				return -EINVAL;
-
-			if (bandwidth != 5 && bandwidth != 10 &&
-			    bandwidth != 20)
-				return -EINVAL;
-			if (tx_power > DOT11P_TX_PWR_MAX)
-				return -EINVAL;
-
-			return 0;
-		}
-	}
-
-	return -EINVAL;
-}
-#else
-/**
- * dot11p_validate_channel_static_channels() - validate a DSRC channel
- * @center_freq: the channel's center frequency
- * @bandwidth: the channel's bandwidth
- * @tx_power: transmit power
- * @reg_power: (output) the max tx power from the regulatory domain
- * @antenna_max: (output) the max antenna gain from the regulatory domain
- *
- * This function of the function checks the channel parameters against a
- * hardcoded list of valid channels based on the FCC rules.
- *
- * Return: 0 if the channel is valid, error code otherwise.
- */
-static int dot11p_validate_channel_static_channels(struct wiphy *wiphy,
-	uint32_t channel_freq, uint32_t bandwidth, uint32_t tx_power,
-	uint8_t *reg_power, uint8_t *antenna_max)
-{
-	return -EINVAL;
-}
-#endif /* FEATURE_STATICALLY_ADD_11P_CHANNELS */
-
 /**
  * dot11p_validate_channel() - validates a DSRC channel
  * @center_freq: the channel's center frequency
@@ -304,8 +197,7 @@ static int dot11p_validate_channel(struct wiphy *wiphy,
 		}
 	}
 
-	return dot11p_validate_channel_static_channels(wiphy, channel_freq,
-		bandwidth, tx_power, reg_power, antenna_max);
+	return -EINVAL;
 }
 
 /**
diff --git a/core/hdd/src/wlan_hdd_oemdata.c b/core/hdd/src/wlan_hdd_oemdata.c
index 63ae62ef9a27..e23412ac0dff 100644
--- a/core/hdd/src/wlan_hdd_oemdata.c
+++ b/core/hdd/src/wlan_hdd_oemdata.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -48,52 +48,6 @@
 static struct hdd_context_s *p_hdd_ctx;
 
 /**
- * hdd_oem_data_req_callback() - OEM Data request callback handler
- * @hHal: MAC handle
- * @pContext: User context.  For this callback the net device was registered
- * @oemDataReqID: The ID of the request
- * @oemDataReqStatus: Status of the request
- *
- * This function reports the results of the request to user space
- *
- * Return: CDF_STATUS enumeration
- */
-static CDF_STATUS hdd_oem_data_req_callback(tHalHandle hHal,
-					    void *pContext,
-					    uint32_t oemDataReqID,
-					    eOemDataReqStatus oemDataReqStatus)
-{
-	CDF_STATUS status = CDF_STATUS_SUCCESS;
-	struct net_device *dev = (struct net_device *)pContext;
-	union iwreq_data wrqu;
-	char buffer[IW_CUSTOM_MAX + 1];
-
-	memset(&wrqu, '\0', sizeof(wrqu));
-	memset(buffer, '\0', sizeof(buffer));
-
-	if (oemDataReqStatus == eOEM_DATA_REQ_FAILURE) {
-		snprintf(buffer, IW_CUSTOM_MAX, "QCOM: OEM-DATA-REQ-FAILED");
-		hddLog(LOGW, "%s: oem data req %d failed", __func__,
-		       oemDataReqID);
-	} else if (oemDataReqStatus == eOEM_DATA_REQ_INVALID_MODE) {
-		snprintf(buffer, IW_CUSTOM_MAX,
-			 "QCOM: OEM-DATA-REQ-INVALID-MODE");
-		hddLog(LOGW,
-		       "%s: oem data req %d failed because the driver is in invalid mode (IBSS|AP)",
-		       __func__, oemDataReqID);
-	} else {
-		snprintf(buffer, IW_CUSTOM_MAX, "QCOM: OEM-DATA-REQ-SUCCESS");
-	}
-
-	wrqu.data.pointer = buffer;
-	wrqu.data.length = strlen(buffer);
-
-	wireless_send_event(dev, IWEVCUSTOM, &wrqu, buffer);
-
-	return status;
-}
-
-/**
  * iw_get_oem_data_cap() - Get OEM Data Capabilities
  * @dev: net device upon which the request was received
  * @info: ioctl request information
@@ -420,7 +374,14 @@ static CDF_STATUS oem_process_data_req_msg(int oemDataLen, char *oemData)
 
 	cdf_mem_zero(&oemDataReqConfig, sizeof(tOemDataReqConfig));
 
-	cdf_mem_copy((&oemDataReqConfig)->oemDataReq, oemData, oemDataLen);
+	oemDataReqConfig.data = cdf_mem_malloc(oemDataLen);
+	if (!oemDataReqConfig.data) {
+		hddLog(LOGE, FL("malloc failed for data req buffer"));
+		return CDF_STATUS_E_NOMEM;
+	}
+
+	oemDataReqConfig.data_len = oemDataLen;
+	cdf_mem_copy(oemDataReqConfig.data, oemData, oemDataLen);
 
 	CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_INFO,
 		  "%s: calling sme_oem_data_req", __func__);
@@ -428,8 +389,11 @@ static CDF_STATUS oem_process_data_req_msg(int oemDataLen, char *oemData)
 	status = sme_oem_data_req(p_hdd_ctx->hHal,
 				  pAdapter->sessionId,
 				  &oemDataReqConfig,
-				  &oemDataReqID,
-				  &hdd_oem_data_req_callback, pAdapter->dev);
+				  &oemDataReqID);
+
+	cdf_mem_free(oemDataReqConfig.data);
+	oemDataReqConfig.data = NULL;
+
 	return status;
 }
 
diff --git a/core/hdd/src/wlan_hdd_p2p.c b/core/hdd/src/wlan_hdd_p2p.c
index f41d4d97fdd9..6bbf1c625c2d 100644
--- a/core/hdd/src/wlan_hdd_p2p.c
+++ b/core/hdd/src/wlan_hdd_p2p.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -211,19 +211,11 @@ CDF_STATUS wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void *pCtx,
 			       __func__);
 		}
 		cfg80211_remain_on_channel_expired(
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 			pRemainChanCtx->dev->
 			ieee80211_ptr,
-#else
-			pRemainChanCtx->dev,
-#endif
 			pRemainChanCtx->
 			cookie,
 			&pRemainChanCtx->chan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-			pRemainChanCtx->
-			chan_type,
-#endif
 			GFP_KERNEL);
 		pAdapter->last_roc_ts = cdf_mc_timer_get_system_time();
 	}
@@ -827,10 +819,6 @@ void wlan_hdd_roc_request_dequeue(struct work_struct *work)
 static int wlan_hdd_request_remain_on_channel(struct wiphy *wiphy,
 					      struct net_device *dev,
 					      struct ieee80211_channel *chan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-					      enum nl80211_channel_type
-					      channel_type,
-#endif
 					      unsigned int duration,
 					      u64 *cookie,
 					      rem_on_channel_request_type_t
@@ -850,21 +838,14 @@ static int wlan_hdd_request_remain_on_channel(struct wiphy *wiphy,
 	hddLog(LOG1, FL("Device_mode %s(%d)"),
 	       hdd_device_mode_to_string(pAdapter->device_mode),
 	       pAdapter->device_mode);
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-	hddLog(LOG1,
-	       "chan(hw_val)0x%x chan(centerfreq) %d chan type 0x%x, duration %d",
-	       chan->hw_value, chan->center_freq, channel_type, duration);
-#else
 	hddLog(LOG1,
 	       "chan(hw_val)0x%x chan(centerfreq) %d, duration %d",
 	       chan->hw_value, chan->center_freq, duration);
-#endif
 	pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
 	ret = wlan_hdd_validate_context(pHddCtx);
 	if (0 != ret)
 		return ret;
-	if (cds_is_connection_in_progress(
-		(hdd_context_t *) pAdapter->pHddCtx)) {
+	if (cds_is_connection_in_progress()) {
 		hddLog(LOGE, FL("Connection is in progress"));
 		isBusy = true;
 	}
@@ -879,9 +860,6 @@ static int wlan_hdd_request_remain_on_channel(struct wiphy *wiphy,
 	cdf_mem_zero(pRemainChanCtx, sizeof(*pRemainChanCtx));
 	cdf_mem_copy(&pRemainChanCtx->chan, chan,
 		     sizeof(struct ieee80211_channel));
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-	pRemainChanCtx->chan_type = channel_type;
-#endif
 	pRemainChanCtx->duration = duration;
 	pRemainChanCtx->dev = dev;
 	*cookie = (uintptr_t) pRemainChanCtx;
@@ -955,21 +933,11 @@ static int wlan_hdd_request_remain_on_channel(struct wiphy *wiphy,
 }
 
 int __wlan_hdd_cfg80211_remain_on_channel(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 					  struct wireless_dev *wdev,
-#else
-					  struct net_device *dev,
-#endif
 					  struct ieee80211_channel *chan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-					  enum nl80211_channel_type
-					  channel_type,
-#endif
 					  unsigned int duration, u64 *cookie)
 {
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 	struct net_device *dev = wdev->netdev;
-#endif
 	hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
 	hdd_context_t *hdd_ctx;
 	int ret;
@@ -981,7 +949,7 @@ int __wlan_hdd_cfg80211_remain_on_channel(struct wiphy *wiphy,
 	if (0 != ret)
 		return ret;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -989,10 +957,8 @@ int __wlan_hdd_cfg80211_remain_on_channel(struct wiphy *wiphy,
 	MTRACE(cdf_trace(CDF_MODULE_ID_HDD,
 			 TRACE_CODE_HDD_REMAIN_ON_CHANNEL,
 			 pAdapter->sessionId, REMAIN_ON_CHANNEL_REQUEST));
+
 	ret = wlan_hdd_request_remain_on_channel(wiphy, dev, chan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-						  channel_type,
-#endif
 						  duration, cookie,
 						  REMAIN_ON_CHANNEL_REQUEST);
 	EXIT();
@@ -1000,30 +966,16 @@ int __wlan_hdd_cfg80211_remain_on_channel(struct wiphy *wiphy,
 }
 
 int wlan_hdd_cfg80211_remain_on_channel(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 					struct wireless_dev *wdev,
-#else
-					struct net_device *dev,
-#endif
 					struct ieee80211_channel *chan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-					enum nl80211_channel_type channel_type,
-#endif
 					unsigned int duration, u64 *cookie)
 {
 	int ret;
 
 	cds_ssr_protect(__func__);
 	ret = __wlan_hdd_cfg80211_remain_on_channel(wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 						    wdev,
-#else
-						    dev,
-#endif
 						    chan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-						    channel_type,
-#endif
 						    duration, cookie);
 	cds_ssr_unprotect(__func__);
 
@@ -1073,19 +1025,11 @@ void hdd_remain_chan_ready_handler(hdd_adapter_t *pAdapter,
 		if (REMAIN_ON_CHANNEL_REQUEST ==
 		    pRemainChanCtx->rem_on_chan_request) {
 			cfg80211_ready_on_channel(
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 				pAdapter->dev->
 				ieee80211_ptr,
-#else
-				pAdapter->dev,
-#endif
 				(uintptr_t)
 				pRemainChanCtx,
 				&pRemainChanCtx->chan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-				pRemainChanCtx->
-				chan_type,
-#endif
 				pRemainChanCtx->
 				duration, GFP_KERNEL);
 		} else if (OFF_CHANNEL_ACTION_TX ==
@@ -1109,7 +1053,7 @@ void hdd_remain_chan_ready_handler(hdd_adapter_t *pAdapter,
 				pRemainChanCtx->action_pkt_buff.frame_ptr,
 				pRemainChanCtx->action_pkt_buff.frame_length,
 				NL80211_RXMGMT_FLAG_ANSWERED, GFP_ATOMIC);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+#else
 			cfg80211_rx_mgmt(pAdapter->dev->ieee80211_ptr,
 					 pRemainChanCtx->action_pkt_buff.freq,
 					 0,
@@ -1117,21 +1061,6 @@ void hdd_remain_chan_ready_handler(hdd_adapter_t *pAdapter,
 					 frame_ptr,
 					 pRemainChanCtx->action_pkt_buff.
 					 frame_length, GFP_ATOMIC);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
-			cfg80211_rx_mgmt(pAdapter->dev,
-					 pRemainChanCtx->action_pkt_buff.freq,
-					 0,
-					 pRemainChanCtx->action_pkt_buff.
-					 frame_ptr,
-					 pRemainChanCtx->action_pkt_buff.
-					 frame_length, GFP_ATOMIC);
-#else
-			cfg80211_rx_mgmt(pAdapter->dev,
-					 pRemainChanCtx->action_pkt_buff.freq,
-					 pRemainChanCtx->action_pkt_buff.
-					 frame_ptr,
-					 pRemainChanCtx->action_pkt_buff.
-					 frame_length, GFP_ATOMIC);
 #endif /* LINUX_VERSION_CODE */
 
 			cdf_mem_free(pRemainChanCtx->action_pkt_buff.frame_ptr);
@@ -1149,16 +1078,10 @@ void hdd_remain_chan_ready_handler(hdd_adapter_t *pAdapter,
 }
 
 int __wlan_hdd_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 						 struct wireless_dev *wdev,
-#else
-						 struct net_device *dev,
-#endif
 						 u64 cookie)
 {
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 	struct net_device *dev = wdev->netdev;
-#endif
 	hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
 	hdd_cfg80211_state_t *cfgState = WLAN_HDD_GET_CFG_STATE_PTR(pAdapter);
 	hdd_remain_on_chan_ctx_t *pRemainChanCtx;
@@ -1170,7 +1093,7 @@ int __wlan_hdd_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -1243,9 +1166,9 @@ int __wlan_hdd_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
 		       "%s: timeout waiting for remain on channel ready indication",
 		       __func__);
 
-		if (pHddCtx->isLogpInProgress) {
-			CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
-				  "%s: LOGP in Progress. Ignore!!!", __func__);
+		if (cds_is_driver_recovering()) {
+			hdd_err("Recovery in Progress. State: 0x%x Ignore!!!",
+				 cds_get_driver_state());
 			return -EAGAIN;
 		}
 	}
@@ -1294,56 +1217,27 @@ int __wlan_hdd_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
 }
 
 int wlan_hdd_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 					       struct wireless_dev *wdev,
-#else
-					       struct net_device *dev,
-#endif
 					       u64 cookie)
 {
 	int ret;
 
 	cds_ssr_protect(__func__);
 	ret = __wlan_hdd_cfg80211_cancel_remain_on_channel(wiphy,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 							   wdev,
-#else
-							   dev,
-#endif
 							   cookie);
 	cds_ssr_unprotect(__func__);
 
 	return ret;
 }
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		       struct ieee80211_channel *chan, bool offchan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-		       enum nl80211_channel_type channel_type,
-		       bool channel_type_valid,
-#endif
 		       unsigned int wait,
 		       const u8 *buf, size_t len, bool no_cck,
 		       bool dont_wait_for_ack, u64 *cookie)
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
-int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
-		       struct ieee80211_channel *chan, bool offchan,
-		       enum nl80211_channel_type channel_type,
-		       bool channel_type_valid, unsigned int wait,
-		       const u8 *buf, size_t len, bool no_cck,
-		       bool dont_wait_for_ack, u64 *cookie)
-#else
-int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
-		       struct ieee80211_channel *chan, bool offchan,
-		       enum nl80211_channel_type channel_type,
-		       bool channel_type_valid, unsigned int wait,
-		       const u8 *buf, size_t len, u64 *cookie)
-#endif /* LINUX_VERSION_CODE */
 {
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 	struct net_device *dev = wdev->netdev;
-#endif
 	hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
 	hdd_cfg80211_state_t *cfgState = WLAN_HDD_GET_CFG_STATE_PTR(pAdapter);
 	hdd_remain_on_chan_ctx_t *pRemainChanCtx;
@@ -1360,7 +1254,7 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -1413,9 +1307,7 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 	}
 #endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
 	noack = dont_wait_for_ack;
-#endif
 
 	/* If the wait is coming as 0 with off channel set */
 	/* then set the wait to 200 ms */
@@ -1582,9 +1474,6 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 		INIT_COMPLETION(pAdapter->offchannel_tx_event);
 
 		status = wlan_hdd_request_remain_on_channel(wiphy, dev, chan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-							    channel_type,
-#endif
 							    wait, cookie,
 							    req_type);
 		if (0 != status) {
@@ -1654,6 +1543,8 @@ send_frame:
 		current_freq = 0;
 	}
 
+	INIT_COMPLETION(pAdapter->tx_action_cnf_event);
+
 	if ((WLAN_HDD_INFRA_STATION == pAdapter->device_mode) ||
 	    (WLAN_HDD_P2P_CLIENT == pAdapter->device_mode) ||
 	    (WLAN_HDD_P2P_DEVICE == pAdapter->device_mode)
@@ -1713,11 +1604,7 @@ err:
 err_rem_channel:
 	*cookie = (uintptr_t) cfgState;
 	cfg80211_mgmt_tx_status(
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 		pAdapter->dev->ieee80211_ptr,
-#else
-		pAdapter->dev,
-#endif
 		*cookie, buf, len, false, GFP_KERNEL);
 	EXIT();
 	return 0;
@@ -1726,29 +1613,12 @@ err_rem_channel:
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
 int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		     struct cfg80211_mgmt_tx_params *params, u64 *cookie)
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+#else
 int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		     struct ieee80211_channel *chan, bool offchan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-		     enum nl80211_channel_type channel_type,
-		     bool channel_type_valid,
-#endif
 		     unsigned int wait,
 		     const u8 *buf, size_t len, bool no_cck,
 		     bool dont_wait_for_ack, u64 *cookie)
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
-int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
-		     struct ieee80211_channel *chan, bool offchan,
-		     enum nl80211_channel_type channel_type,
-		     bool channel_type_valid, unsigned int wait,
-		     const u8 *buf, size_t len, bool no_cck,
-		     bool dont_wait_for_ack, u64 *cookie)
-#else
-int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
-		     struct ieee80211_channel *chan, bool offchan,
-		     enum nl80211_channel_type channel_type,
-		     bool channel_type_valid, unsigned int wait,
-		     const u8 *buf, size_t len, u64 *cookie)
 #endif /* LINUX_VERSION_CODE */
 {
 	int ret;
@@ -1760,43 +1630,23 @@ int wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 				 params->wait, params->buf, params->len,
 				 params->no_cck, params->dont_wait_for_ack,
 				 cookie);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+#else
 	ret = __wlan_hdd_mgmt_tx(wiphy, wdev, chan, offchan,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-				 channel_type, channel_type_valid,
-#endif
 				 wait, buf, len, no_cck,
 				 dont_wait_for_ack, cookie);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
-	ret = __wlan_hdd_mgmt_tx(wiphy, dev, chan, offchan,
-				 channel_type, channel_type_valid, wait,
-				 buf, len, no_cck, dont_wait_for_ack, cookie);
-#else
-	ret = __wlan_hdd_mgmt_tx(wiphy, dev, chan, offchan,
-				 channel_type, channel_type_valid, wait,
-				 buf, len, cookie);
 #endif /* LINUX_VERSION_CODE */
 	cds_ssr_unprotect(__func__);
 
 	return ret;
 }
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 int __wlan_hdd_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 					    struct wireless_dev *wdev,
 					    u64 cookie)
 {
 	return wlan_hdd_cfg80211_cancel_remain_on_channel(wiphy, wdev, cookie);
 }
-#else
-int __wlan_hdd_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
-					    struct net_device *dev, u64 cookie)
-{
-	return wlan_hdd_cfg80211_cancel_remain_on_channel(wiphy, dev, cookie);
-}
-#endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 int wlan_hdd_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 					  struct wireless_dev *wdev, u64 cookie)
 {
@@ -1808,19 +1658,6 @@ int wlan_hdd_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 
 	return ret;
 }
-#else
-int wlan_hdd_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
-					  struct net_device *dev, u64 cookie)
-{
-	int ret;
-
-	cds_ssr_protect(__func__);
-	ret = __wlan_hdd_cfg80211_mgmt_tx_cancel_wait(wiphy, dev, cookie);
-	cds_ssr_unprotect(__func__);
-
-	return ret;
-}
-#endif
 
 void hdd_send_action_cnf(hdd_adapter_t *pAdapter, bool actionSendSuccess)
 {
@@ -1842,11 +1679,7 @@ void hdd_send_action_cnf(hdd_adapter_t *pAdapter, bool actionSendSuccess)
 	 * data while sending tx ack status.
 	 * */
 	cfg80211_mgmt_tx_status(
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 		pAdapter->dev->ieee80211_ptr,
-#else
-		pAdapter->dev,
-#endif
 		cfgState->action_cookie,
 		cfgState->buf, cfgState->len,
 		actionSendSuccess, GFP_KERNEL);
@@ -2104,24 +1937,11 @@ static uint8_t wlan_hdd_get_session_type(enum nl80211_iftype type)
 	return sessionType;
 }
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
 struct wireless_dev *__wlan_hdd_add_virtual_intf(struct wiphy *wiphy,
 						 const char *name,
 						 enum nl80211_iftype type,
 						 u32 *flags,
 						 struct vif_params *params)
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
-struct wireless_dev *__wlan_hdd_add_virtual_intf(struct wiphy *wiphy,
-						 char *name,
-						 enum nl80211_iftype type,
-						 u32 *flags,
-						 struct vif_params *params)
-#else
-struct net_device *__wlan_hdd_add_virtual_intf(struct wiphy *wiphy, char *name,
-					       enum nl80211_iftype type,
-					       u32 *flags,
-					       struct vif_params *params)
-#endif
 {
 	hdd_context_t *pHddCtx = (hdd_context_t *) wiphy_priv(wiphy);
 	hdd_adapter_t *pAdapter = NULL;
@@ -2131,7 +1951,7 @@ struct net_device *__wlan_hdd_add_virtual_intf(struct wiphy *wiphy, char *name,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return ERR_PTR(-EINVAL);
 	}
@@ -2202,14 +2022,9 @@ struct net_device *__wlan_hdd_add_virtual_intf(struct wiphy *wiphy, char *name,
 		return ERR_PTR(-ENOSPC);
 	}
 	EXIT();
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 	return pAdapter->dev->ieee80211_ptr;
-#else
-	return pAdapter->dev;
-#endif
 }
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
 struct wireless_dev *wlan_hdd_add_virtual_intf(struct wiphy *wiphy,
 					       const char *name,
 					       enum nl80211_iftype type,
@@ -2223,49 +2038,16 @@ struct wireless_dev *wlan_hdd_add_virtual_intf(struct wiphy *wiphy,
 	cds_ssr_unprotect(__func__);
 	return wdev;
 }
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
-struct wireless_dev *wlan_hdd_add_virtual_intf(struct wiphy *wiphy, char *name,
-					       enum nl80211_iftype type,
-					       u32 *flags,
-					       struct vif_params *params)
-{
-	struct wireless_dev *wdev;
-
-	cds_ssr_protect(__func__);
-	wdev = __wlan_hdd_add_virtual_intf(wiphy, name, type, flags, params);
-	cds_ssr_unprotect(__func__);
-	return wdev;
-}
-#else
-struct net_device *wlan_hdd_add_virtual_intf(struct wiphy *wiphy, char *name,
-					     enum nl80211_iftype type,
-					     u32 *flags,
-					     struct vif_params *params)
-{
-	struct net_device *ndev;
 
-	cds_ssr_protect(__func__);
-	ndev = __wlan_hdd_add_virtual_intf(wiphy, name, type, flags, params);
-	cds_ssr_unprotect(__func__);
-	return ndev;
-}
-#endif
-
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 int __wlan_hdd_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
-#else
-int __wlan_hdd_del_virtual_intf(struct wiphy *wiphy, struct net_device *dev)
-#endif
 {
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 	struct net_device *dev = wdev->netdev;
-#endif
 	hdd_context_t *pHddCtx = (hdd_context_t *) wiphy_priv(wiphy);
 	hdd_adapter_t *pVirtAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
 	int status;
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -2291,26 +2073,18 @@ int __wlan_hdd_del_virtual_intf(struct wiphy *wiphy, struct net_device *dev)
 	return 0;
 }
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 int wlan_hdd_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
-#else
-int wlan_hdd_del_virtual_intf(struct wiphy *wiphy, struct net_device *dev)
-#endif
 {
 	int ret;
 
 	cds_ssr_protect(__func__);
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 	ret = __wlan_hdd_del_virtual_intf(wiphy, wdev);
-#else
-	ret = __wlan_hdd_del_virtual_intf(wiphy, dev);
-#endif
 	cds_ssr_unprotect(__func__);
 
 	return ret;
 }
 
-void hdd_indicate_mgmt_frame(hdd_adapter_t *pAdapter,
+void __hdd_indicate_mgmt_frame(hdd_adapter_t *pAdapter,
 			     uint32_t nFrameLength,
 			     uint8_t *pbFrames,
 			     uint8_t frameType, uint32_t rxChan, int8_t rxRssi)
@@ -2614,14 +2388,8 @@ void hdd_indicate_mgmt_frame(hdd_adapter_t *pAdapter,
 	cfg80211_rx_mgmt(pAdapter->dev->ieee80211_ptr, freq, 0, pbFrames,
 			 nFrameLength, NL80211_RXMGMT_FLAG_ANSWERED,
 			 GFP_ATOMIC);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
-	cfg80211_rx_mgmt(pAdapter->dev->ieee80211_ptr, freq, 0,
-			 pbFrames, nFrameLength, GFP_ATOMIC);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
-	cfg80211_rx_mgmt(pAdapter->dev, freq, 0,
-			 pbFrames, nFrameLength, GFP_ATOMIC);
 #else
-	cfg80211_rx_mgmt(pAdapter->dev, freq,
+	cfg80211_rx_mgmt(pAdapter->dev->ieee80211_ptr, freq, 0,
 			 pbFrames, nFrameLength, GFP_ATOMIC);
 #endif /* LINUX_VERSION_CODE */
 }
diff --git a/core/hdd/src/wlan_hdd_power.c b/core/hdd/src/wlan_hdd_power.c
index df5620b51252..0af3ff235a09 100644
--- a/core/hdd/src/wlan_hdd_power.c
+++ b/core/hdd/src/wlan_hdd_power.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -387,8 +387,8 @@ static void hdd_conf_ns_offload(hdd_adapter_t *pAdapter, bool fenable)
 			}
 			offLoadRequest.offloadType =  SIR_IPV6_NS_OFFLOAD;
 			offLoadRequest.enableOrDisable = SIR_OFFLOAD_ENABLE;
-			cdf_mem_copy(&offLoadRequest.nsOffloadInfo.selfMacAddr,
-				&pAdapter->macAddressCurrent.bytes, SIR_MAC_ADDR_LEN);
+			cdf_copy_macaddr(&offLoadRequest.nsOffloadInfo.self_macaddr,
+					 &pAdapter->macAddressCurrent);
 			/* set number of ns offload address count */
 			offLoadRequest.num_ns_offload_count = count;
 			/* Configure the Firmware with this */
@@ -511,16 +511,19 @@ void hdd_conf_hostoffload(hdd_adapter_t *pAdapter, bool fenable)
 
 	hdd_conf_gtk_offload(pAdapter, fenable);
 
-	/* Configure ARP/NS offload during cfg80211 suspend/resume only
-	 * if active mode offload is disabled
+	/* Configure ARP/NS offload during cfg80211 suspend/resume and
+	 * Enable MC address filtering during cfg80211 suspend
+	 * only if active mode offload is disabled
 	 */
 	if (!pHddCtx->config->active_mode_offload) {
+		hdd_info("configuring unconfigured active mode offloads");
 		hdd_conf_arp_offload(pAdapter, fenable);
+		wlan_hdd_set_mc_addr_list(pAdapter, fenable);
+
 		if (pHddCtx->config->fhostNSOffload)
 			hdd_conf_ns_offload(pAdapter, fenable);
 	}
 	EXIT();
-	EXIT();
 	return;
 }
 #endif
@@ -967,6 +970,23 @@ void wlan_hdd_set_mc_addr_list(hdd_adapter_t *pAdapter, uint8_t set)
 #endif
 
 /**
+ * hdd_update_mcastbcast_filter(): cache multi and broadcast filter for suspend
+ * @hdd_ctx: hdd context
+ *
+ * Cache the configured filter to be used in suspend resume.
+ */
+static void hdd_update_mcastbcast_filter(hdd_context_t *hdd_ctx)
+{
+	if (false == hdd_ctx->sus_res_mcastbcast_filter_valid) {
+		hdd_ctx->sus_res_mcastbcast_filter =
+			hdd_ctx->configuredMcastBcastFilter;
+		hdd_ctx->sus_res_mcastbcast_filter_valid = true;
+		hdd_info("configuredMCastBcastFilter saved = %d",
+			hdd_ctx->configuredMcastBcastFilter);
+	}
+}
+
+/**
  * hdd_conf_suspend_ind() - Send Suspend notification
  * @pHddCtx: HDD Global context
  * @pAdapter: adapter being suspended
@@ -975,69 +995,26 @@ void wlan_hdd_set_mc_addr_list(hdd_adapter_t *pAdapter, uint8_t set)
  *
  * Return: None.
  */
-static void hdd_conf_suspend_ind(hdd_context_t *pHddCtx,
-				 hdd_adapter_t *pAdapter,
+static void hdd_send_suspend_ind(hdd_context_t *pHddCtx,
+				uint32_t conn_state_mask,
 				 void (*callback)(void *callbackContext,
 						  bool suspended),
 				 void *callbackContext)
 {
 	CDF_STATUS cdf_ret_status = CDF_STATUS_E_FAILURE;
-	tpSirWlanSuspendParam wlanSuspendParam =
-		cdf_mem_malloc(sizeof(tSirWlanSuspendParam));
 
-	if (false == pHddCtx->sus_res_mcastbcast_filter_valid) {
-		pHddCtx->sus_res_mcastbcast_filter =
-			pHddCtx->configuredMcastBcastFilter;
-		pHddCtx->sus_res_mcastbcast_filter_valid = true;
-		hddLog(CDF_TRACE_LEVEL_INFO, "offload: hdd_conf_suspend_ind");
-		hddLog(CDF_TRACE_LEVEL_INFO,
-		       "configuredMCastBcastFilter saved = %d",
-		       pHddCtx->configuredMcastBcastFilter);
+	hdd_info("%s: send wlan suspend indication", __func__);
 
-	}
-
-	if (NULL == wlanSuspendParam) {
-		hddLog(CDF_TRACE_LEVEL_FATAL,
-		       "%s: cdf_mem_alloc failed ", __func__);
-		return;
-	}
-
-	hddLog(CDF_TRACE_LEVEL_INFO,
-	       "%s: send wlan suspend indication", __func__);
-
-	/* Configure supported OffLoads */
-	hdd_conf_hostoffload(pAdapter, true);
-	wlanSuspendParam->configuredMcstBcstFilterSetting =
-		pHddCtx->configuredMcastBcastFilter;
-
-	/* Enable MC address filtering during cfg80211 suspend if active mode
-	 * mode offload is disabled in INI
-	 */
-	if (!pHddCtx->config->active_mode_offload) {
-		hdd_info("enable mc address filtering");
-		wlan_hdd_set_mc_addr_list(pAdapter, true);
-	}
-
-	if ((eConnectionState_Associated ==
-	     (WLAN_HDD_GET_STATION_CTX_PTR(pAdapter))->conn_info.connState) ||
-	    (eConnectionState_IbssConnected ==
-	     (WLAN_HDD_GET_STATION_CTX_PTR(pAdapter))->conn_info.connState))
-		wlanSuspendParam->connectedState = true;
-	else
-		wlanSuspendParam->connectedState = false;
-
-	wlanSuspendParam->sessionId = pAdapter->sessionId;
 	cdf_ret_status =
-		sme_configure_suspend_ind(pHddCtx->hHal, wlanSuspendParam,
+		sme_configure_suspend_ind(pHddCtx->hHal, conn_state_mask,
 					  callback, callbackContext);
+
 	if (CDF_STATUS_SUCCESS == cdf_ret_status) {
 		pHddCtx->hdd_mcastbcast_filter_set = true;
 	} else {
 		hddLog(CDF_TRACE_LEVEL_ERROR,
 		       FL("sme_configure_suspend_ind returned failure %d"),
 		       cdf_ret_status);
-
-		cdf_mem_free(wlanSuspendParam);
 	}
 }
 
@@ -1077,14 +1054,27 @@ static void hdd_conf_resume_ind(hdd_adapter_t *pAdapter)
 	       "offload: in hdd_conf_resume_ind, restoring configuredMcastBcastFilter");
 	hddLog(CDF_TRACE_LEVEL_INFO, "configuredMcastBcastFilter = %d",
 	       pHddCtx->configuredMcastBcastFilter);
+}
 
-	/* Disable MC address filtering during cfg80211 suspend if active mode
-	 * mode offload is disabled in INI
-	 */
-	if (!pHddCtx->config->active_mode_offload) {
-		hdd_info("disable mc address filtering");
-		wlan_hdd_set_mc_addr_list(pAdapter, false);
-	}
+/**
+ * hdd_update_conn_state_mask(): record info needed by wma_suspend_req
+ * @adapter: adapter to get info from
+ * @conn_state_mask: mask of connection info
+ *
+ * currently only need to send connection info.
+ */
+static void
+hdd_update_conn_state_mask(hdd_adapter_t *adapter, uint32_t *conn_state_mask)
+{
+
+	eConnectionState connState;
+	hdd_station_ctx_t *sta_ctx;
+	sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+	connState = sta_ctx->conn_info.connState;
+
+	if (connState == eConnectionState_Associated ||
+			connState == eConnectionState_IbssConnected)
+		*conn_state_mask |= (1 << adapter->sessionId);
 }
 
 /**
@@ -1103,9 +1093,9 @@ hdd_suspend_wlan(void (*callback)(void *callbackContext, bool suspended),
 	CDF_STATUS status;
 	hdd_adapter_t *pAdapter = NULL;
 	hdd_adapter_list_node_t *pAdapterNode = NULL, *pNext = NULL;
+	uint32_t conn_state_mask = 0;
 
-	hddLog(CDF_TRACE_LEVEL_INFO, "%s: WLAN being suspended by OS",
-	       __func__);
+	hdd_info("%s: WLAN being suspended by OS", __func__);
 
 	pHddCtx = cds_get_context(CDF_MODULE_ID_HDD);
 	if (!pHddCtx) {
@@ -1114,12 +1104,14 @@ hdd_suspend_wlan(void (*callback)(void *callbackContext, bool suspended),
 		return;
 	}
 
-	if (pHddCtx->isLogpInProgress) {
-		hddLog(CDF_TRACE_LEVEL_ERROR,
-		       "%s: Ignore suspend wlan, LOGP in progress!", __func__);
+	if (cds_is_driver_recovering()) {
+		hdd_err("Recovery in Progress. State: 0x%x Ignore suspend!!!",
+			 cds_get_driver_state());
 		return;
 	}
 
+	hdd_update_mcastbcast_filter(pHddCtx);
+
 	status = hdd_get_front_adapter(pHddCtx, &pAdapterNode);
 	while (NULL != pAdapterNode && CDF_STATUS_SUCCESS == status) {
 		pAdapter = pAdapterNode->pAdapter;
@@ -1129,20 +1121,19 @@ hdd_suspend_wlan(void (*callback)(void *callbackContext, bool suspended),
 		wlan_hdd_netif_queue_control(pAdapter, WLAN_NETIF_TX_DISABLE,
 					   WLAN_CONTROL_PATH);
 
-		/* Send suspend notification down to firmware.
-		 *
-		 * N.B.: Keep this suspend indication at the end
-		 * (before processing next adaptor). This indication
-		 * is considered as trigger point to start WOW (if wow
-		 * is enabled).
-		 */
-		hdd_conf_suspend_ind(pHddCtx, pAdapter, callback,
-				     callbackContext);
+		/* Configure supported OffLoads */
+		hdd_conf_hostoffload(pAdapter, true);
+
+		hdd_update_conn_state_mask(pAdapter, &conn_state_mask);
 
 		status = hdd_get_next_adapter(pHddCtx, pAdapterNode, &pNext);
+
 		pAdapterNode = pNext;
 	}
 
+	hdd_send_suspend_ind(pHddCtx, conn_state_mask, callback,
+			callbackContext);
+
 	pHddCtx->hdd_wlan_suspended = true;
 
 	return;
@@ -1170,9 +1161,9 @@ static void hdd_resume_wlan(void)
 		return;
 	}
 
-	if (pHddCtx->isLogpInProgress) {
-		hddLog(CDF_TRACE_LEVEL_INFO,
-		       "%s: Ignore resume wlan, LOGP in progress!", __func__);
+	if (cds_is_driver_recovering()) {
+		hdd_warn("Recovery in Progress. State: 0x%x Ignore resume!!!",
+			 cds_get_driver_state());
 		return;
 	}
 
@@ -1304,8 +1295,7 @@ CDF_STATUS hdd_wlan_shutdown(void)
 		return CDF_STATUS_E_FAILURE;
 	}
 
-	pHddCtx->isLogpInProgress = true;
-	cds_set_logp_in_progress(true);
+	cds_set_recovery_in_progress(true);
 
 	cds_clear_concurrent_session_count();
 
@@ -1448,7 +1438,7 @@ CDF_STATUS hdd_wlan_re_init(void *hif_sc)
 	hdd_set_conparam(0);
 
 	/* Re-open CDS, it is a re-open b'se control transport was never closed. */
-	cdf_status = cds_open(&p_cds_context, 0);
+	cdf_status = cds_open();
 	if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
 		hddLog(CDF_TRACE_LEVEL_FATAL, "%s: cds_open failed", __func__);
 		goto err_re_init;
@@ -1462,18 +1452,21 @@ CDF_STATUS hdd_wlan_re_init(void *hif_sc)
 		goto err_cds_close;
 	}
 
-	/* Set the SME configuration parameters. */
-	cdf_status = hdd_set_sme_config(pHddCtx);
-	if (CDF_STATUS_SUCCESS != cdf_status) {
-		hddLog(CDF_TRACE_LEVEL_FATAL, "%s: Failed hdd_set_sme_config",
-		       __func__);
+	cdf_status = cds_pre_enable(pHddCtx->pcds_context);
+	if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
+		hdd_alert("cds_pre_enable failed");
 		goto err_cds_close;
 	}
 
-	cdf_status = cds_pre_enable(pHddCtx->pcds_context);
-	if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
-		hddLog(CDF_TRACE_LEVEL_FATAL, "%s: cds_pre_enable failed",
-		       __func__);
+	/*
+	 * Note that the cds_pre_enable() sequence triggers the cfg download.
+	 * The cfg download must occur before we update the SME config
+	 * since the SME config operation must access the cfg database.
+	 * Set the SME configuration parameters.
+	 */
+	cdf_status = hdd_set_sme_config(pHddCtx);
+	if (CDF_STATUS_SUCCESS != cdf_status) {
+		hdd_alert("Failed hdd_set_sme_config");
 		goto err_cds_close;
 	}
 
@@ -1638,9 +1631,8 @@ err_cds_close:
 		wiphy_unregister(pHddCtx->wiphy);
 		wiphy_free(pHddCtx->wiphy);
 
-		if (!CDF_IS_STATUS_SUCCESS(cdf_mutex_destroy(
-					&pHddCtx->hdd_conc_list_lock))) {
-			hdd_err("Failed to destroy hdd_conc_list_lock");
+		if (!CDF_IS_STATUS_SUCCESS(cds_deinit_policy_mgr())) {
+			hdd_err("Failed to deinit policy manager");
 			/* Proceed and complete the clean up */
 		}
 	}
@@ -1652,7 +1644,6 @@ err_re_init:
 	return -EPERM;
 
 success:
-	pHddCtx->isLogpInProgress = false;
 	return CDF_STATUS_SUCCESS;
 }
 
@@ -1738,7 +1729,7 @@ static int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -1767,16 +1758,16 @@ static int __wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
 	MTRACE(cdf_trace(CDF_MODULE_ID_HDD,
 			 TRACE_CODE_HDD_CFG80211_RESUME_WLAN,
 			 NO_SESSION, pHddCtx->isWiphySuspended));
-	spin_lock(&pHddCtx->schedScan_lock);
+	cdf_spin_lock(&pHddCtx->sched_scan_lock);
 	pHddCtx->isWiphySuspended = false;
 	if (true != pHddCtx->isSchedScanUpdatePending) {
-		spin_unlock(&pHddCtx->schedScan_lock);
+		cdf_spin_unlock(&pHddCtx->sched_scan_lock);
 		hddLog(LOG1, FL("Return resume is not due to PNO indication"));
 		return 0;
 	}
 	/* Reset flag to avoid updatating cfg80211 data old results again */
 	pHddCtx->isSchedScanUpdatePending = false;
-	spin_unlock(&pHddCtx->schedScan_lock);
+	cdf_spin_unlock(&pHddCtx->sched_scan_lock);
 
 	status = hdd_get_front_adapter(pHddCtx, &pAdapterNode);
 
@@ -1874,7 +1865,7 @@ static int __wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -2094,7 +2085,7 @@ static int __wlan_hdd_cfg80211_set_power_mgmt(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -2175,9 +2166,7 @@ int wlan_hdd_cfg80211_set_power_mgmt(struct wiphy *wiphy,
  * Return: 0 for success, non-zero for failure
  */
 static int __wlan_hdd_cfg80211_set_txpower(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 					   struct wireless_dev *wdev,
-#endif
 					   enum nl80211_tx_power_setting type,
 					   int dbm)
 {
@@ -2189,7 +2178,7 @@ static int __wlan_hdd_cfg80211_set_txpower(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -2248,18 +2237,14 @@ static int __wlan_hdd_cfg80211_set_txpower(struct wiphy *wiphy,
  * Return: 0 for success, non-zero for failure
  */
 int wlan_hdd_cfg80211_set_txpower(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 				  struct wireless_dev *wdev,
-#endif
 				  enum nl80211_tx_power_setting type,
 				  int dbm)
 {
 	int ret;
 	cds_ssr_protect(__func__);
 	ret = __wlan_hdd_cfg80211_set_txpower(wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 					      wdev,
-#endif
 					      type, dbm);
 	cds_ssr_unprotect(__func__);
 
@@ -2275,9 +2260,7 @@ int wlan_hdd_cfg80211_set_txpower(struct wiphy *wiphy,
  * Return: 0 for success, non-zero for failure
  */
 static int __wlan_hdd_cfg80211_get_txpower(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 				  struct wireless_dev *wdev,
-#endif
 				  int *dbm)
 {
 
@@ -2287,7 +2270,7 @@ static int __wlan_hdd_cfg80211_get_txpower(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -2327,18 +2310,14 @@ static int __wlan_hdd_cfg80211_get_txpower(struct wiphy *wiphy,
  * Return: 0 for success, error number on failure.
  */
 int wlan_hdd_cfg80211_get_txpower(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0) || defined(WITH_BACKPORTS)
 					 struct wireless_dev *wdev,
-#endif
 					 int *dbm)
 {
 	int ret;
 
 	cds_ssr_protect(__func__);
 	ret = __wlan_hdd_cfg80211_get_txpower(wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0) || defined(WITH_BACKPORTS)
 						wdev,
-#endif
 						dbm);
 	cds_ssr_unprotect(__func__);
 
diff --git a/core/hdd/src/wlan_hdd_scan.c b/core/hdd/src/wlan_hdd_scan.c
index 99b6db2b1411..1a708a60b881 100644
--- a/core/hdd/src/wlan_hdd_scan.c
+++ b/core/hdd/src/wlan_hdd_scan.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1014,6 +1014,7 @@ static void hdd_vendor_scan_callback(hdd_adapter_t *adapter,
 
 	if (WLAN_HDD_ADAPTER_MAGIC != adapter->magic) {
 		hdd_err("Invalid adapter magic");
+		cdf_mem_free(req);
 		return;
 	}
 	skb = cfg80211_vendor_event_alloc(hddctx->wiphy, NULL,
@@ -1023,6 +1024,7 @@ static void hdd_vendor_scan_callback(hdd_adapter_t *adapter,
 
 	if (!skb) {
 		hdd_err("skb alloc failed");
+		cdf_mem_free(req);
 		return;
 	}
 
@@ -1067,10 +1069,12 @@ static void hdd_vendor_scan_callback(hdd_adapter_t *adapter,
 		goto nla_put_failure;
 
 	cfg80211_vendor_event(skb, GFP_KERNEL);
+	cdf_mem_free(req);
 	return;
 
 nla_put_failure:
 	kfree_skb(skb);
+	cdf_mem_free(req);
 	return;
 }
 
@@ -1223,15 +1227,10 @@ static void wlan_hdd_cfg80211_scan_block_cb(struct work_struct *work)
  * Return: 0 for success, non zero for failure
  */
 static int __wlan_hdd_cfg80211_scan(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-				    struct net_device *dev,
-#endif
 				    struct cfg80211_scan_request *request,
 				    uint8_t source)
 {
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 	struct net_device *dev = request->wdev->netdev;
-#endif
 	hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
 	hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
 	hdd_wext_state_t *pwextBuf = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter);
@@ -1246,7 +1245,7 @@ static int __wlan_hdd_cfg80211_scan(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -1328,9 +1327,6 @@ static int __wlan_hdd_cfg80211_scan(struct wiphy *wiphy,
 	 * (return -EBUSY)
 	 */
 	status = wlan_hdd_tdls_scan_callback(pAdapter, wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-						dev,
-#endif
 					request);
 	if (status <= 0) {
 		if (!status)
@@ -1345,7 +1341,7 @@ static int __wlan_hdd_cfg80211_scan(struct wiphy *wiphy,
 #endif
 
 	/* Check if scan is allowed at this point of time */
-	if (cds_is_connection_in_progress(pHddCtx)) {
+	if (cds_is_connection_in_progress()) {
 		hddLog(LOGE, FL("Scan not allowed"));
 		return -EBUSY;
 	}
@@ -1598,17 +1594,11 @@ free_mem:
  * Return: 0 for success, non zero for failure
  */
 int wlan_hdd_cfg80211_scan(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-			   struct net_device *dev,
-#endif
 			   struct cfg80211_scan_request *request)
 {
 	int ret;
 	cds_ssr_protect(__func__);
 	ret = __wlan_hdd_cfg80211_scan(wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-				       dev,
-#endif
 				request, NL_SCAN);
 	cds_ssr_unprotect(__func__);
 	return ret;
@@ -1965,15 +1955,15 @@ hdd_sched_scan_callback(void *callbackContext,
 		return;
 	}
 
-	spin_lock(&pHddCtx->schedScan_lock);
+	cdf_spin_lock(&pHddCtx->sched_scan_lock);
 	if (true == pHddCtx->isWiphySuspended) {
 		pHddCtx->isSchedScanUpdatePending = true;
-		spin_unlock(&pHddCtx->schedScan_lock);
+		cdf_spin_unlock(&pHddCtx->sched_scan_lock);
 		hddLog(LOG1,
 		       FL("Update cfg80211 scan database after it resume"));
 		return;
 	}
-	spin_unlock(&pHddCtx->schedScan_lock);
+	cdf_spin_unlock(&pHddCtx->sched_scan_lock);
 
 	ret = wlan_hdd_cfg80211_update_bss(pHddCtx->wiphy, pAdapter, 0);
 
@@ -2041,7 +2031,7 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -2199,12 +2189,8 @@ static int __wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
 		/*Copying list of valid channel into request */
 		memcpy(pPnoRequest->aNetworks[i].aChannels, valid_ch, num_ch);
 		pPnoRequest->aNetworks[i].ucChannelCount = num_ch;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)
 		pPnoRequest->aNetworks[i].rssiThreshold =
 			request->match_sets[i].rssi_thold;
-#else
-		pPnoRequest->aNetworks[i].rssiThreshold = 0;    /* Default value */
-#endif
 	}
 
 	for (i = 0; i < request->n_ssids; i++) {
@@ -2320,7 +2306,7 @@ static int __wlan_hdd_cfg80211_sched_scan_stop(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -2332,8 +2318,8 @@ static int __wlan_hdd_cfg80211_sched_scan_stop(struct wiphy *wiphy,
 		return -ENODEV;
 	}
 
-	/* The return 0 is intentional when isLogpInProgress and
-	 * isLoadUnloadInProgress. We did observe a crash due to a return of
+	/* The return 0 is intentional when Recovery and Load/Unload in
+	 * progress. We did observe a crash due to a return of
 	 * failure in sched_scan_stop , especially for a case where the unload
 	 * of the happens at the same time. The function __cfg80211_stop_sched_scan
 	 * was clearing rdev->sched_scan_req only when the sched_scan_stop returns
@@ -2341,13 +2327,15 @@ static int __wlan_hdd_cfg80211_sched_scan_stop(struct wiphy *wiphy,
 	 * clean up of the second interface will have the dev pointer corresponding
 	 * to the first one leading to a crash.
 	 */
-	if (pHddCtx->isLogpInProgress) {
-		hddLog(LOGE, FL("LOGP in Progress. Ignore!!!"));
+	if (cds_is_driver_recovering()) {
+		hdd_err("Recovery in Progress. State: 0x%x Ignore!!!",
+			 cds_get_driver_state());
 		return ret;
 	}
 
-	if ((pHddCtx->isLoadInProgress) || (pHddCtx->isUnloadInProgress)) {
-		hddLog(LOGE, FL("Unloading/Loading in Progress. Ignore!!!"));
+	if (cds_is_load_or_unload_in_progress()) {
+		hdd_err("Unload/Load in Progress, state: 0x%x.  Ignore!!!",
+			cds_get_driver_state());
 		return ret;
 	}
 
diff --git a/core/hdd/src/wlan_hdd_scan.h b/core/hdd/src/wlan_hdd_scan.h
index 06ef03b3789c..05bc2754c354 100644
--- a/core/hdd/src/wlan_hdd_scan.h
+++ b/core/hdd/src/wlan_hdd_scan.h
@@ -51,9 +51,6 @@ int iw_set_scan(struct net_device *dev, struct iw_request_info *info,
 		union iwreq_data *wrqu, char *extra);
 
 int wlan_hdd_cfg80211_scan(struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-			   struct net_device *dev,
-#endif
 			   struct cfg80211_scan_request *request);
 
 #ifdef FEATURE_WLAN_SCAN_PNO
diff --git a/core/hdd/src/wlan_hdd_softap_tx_rx.c b/core/hdd/src/wlan_hdd_softap_tx_rx.c
index f50b582a6499..698308566ae1 100644
--- a/core/hdd/src/wlan_hdd_softap_tx_rx.c
+++ b/core/hdd/src/wlan_hdd_softap_tx_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -168,7 +168,6 @@ int hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	sme_ac_enum_type ac = SME_AC_BE;
 	hdd_adapter_t *pAdapter = (hdd_adapter_t *) netdev_priv(dev);
 	hdd_ap_ctx_t *pHddApCtx = WLAN_HDD_GET_AP_CTX_PTR(pAdapter);
-	hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
 	struct cdf_mac_addr *pDestMacAddress;
 	uint8_t STAId;
 	uint8_t proto_type = 0;
@@ -181,9 +180,9 @@ int hdd_softap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	 * context may not be reinitialized at this time which may
 	 * lead to a crash.
 	 */
-	if (pHddCtx->isLogpInProgress) {
+	if (cds_is_driver_recovering()) {
 		CDF_TRACE(CDF_MODULE_ID_HDD_SAP_DATA, CDF_TRACE_LEVEL_INFO_HIGH,
-			  "%s: LOGP in Progress. Ignore!!!", __func__);
+			  "%s: Recovery in Progress. Ignore!!!", __func__);
 		goto drop_pkt;
 	}
 
@@ -368,9 +367,9 @@ static void __hdd_softap_tx_timeout(struct net_device *dev)
 	 * recovery here
 	 */
 	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
-	if (hdd_ctx->isLogpInProgress) {
+	if (cds_is_driver_recovering()) {
 		CDF_TRACE(CDF_MODULE_ID_HDD_SAP_DATA, CDF_TRACE_LEVEL_ERROR,
-			 "%s: LOGP in Progress. Ignore!!!", __func__);
+			 "%s: Recovery in Progress. Ignore!!!", __func__);
 		return;
 	}
 }
@@ -581,7 +580,7 @@ CDF_STATUS hdd_softap_rx_packet_cbk(void *cds_context,
 	 */
 	cdf_net_buf_debug_release_skb(rxBuf);
 
-	if (hdd_napi_enabled(HDD_NAPI_ANY))
+	if (hdd_napi_enabled(HDD_NAPI_ANY) && !pHddCtx->config->enableRxThread)
 		rxstat = netif_receive_skb(skb);
 	else
 		rxstat = netif_rx_ni(skb);
@@ -810,10 +809,10 @@ CDF_STATUS hdd_softap_stop_bss(hdd_adapter_t *pAdapter)
 	/* bss deregister is not allowed during wlan driver loading or
 	 * unloading
 	 */
-	if ((pHddCtx->isLoadInProgress) || (pHddCtx->isUnloadInProgress)) {
+	if (cds_is_load_or_unload_in_progress()) {
 		CDF_TRACE(CDF_MODULE_ID_HDD_SAP_DATA, CDF_TRACE_LEVEL_ERROR,
-			  "%s:Loading_unloading in Progress. Ignore!!!",
-			  __func__);
+			  "%s: Loading_unloading in Progress, state: 0x%x. Ignore!!!",
+			  __func__, cds_get_driver_state());
 		return CDF_STATUS_E_PERM;
 	}
 
diff --git a/core/hdd/src/wlan_hdd_stats.c b/core/hdd/src/wlan_hdd_stats.c
index 1f6030c81859..025c1ca8258e 100644
--- a/core/hdd/src/wlan_hdd_stats.c
+++ b/core/hdd/src/wlan_hdd_stats.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1100,12 +1100,12 @@ static void wlan_hdd_cfg80211_link_layer_stats_callback(void *ctx,
 }
 
 /**
- * wlan_hdd_cfg80211_link_layer_stats_init() - initialize link layer stats
+ * hdd_cfg80211_link_layer_stats_init() - Initialize link layer stats
  * @pHddCtx: Pointer to hdd context
  *
  * Return: None
  */
-void wlan_hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx)
+void hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx)
 {
 	sme_set_link_layer_stats_ind_cb(pHddCtx->hHal,
 					wlan_hdd_cfg80211_link_layer_stats_callback);
@@ -1144,7 +1144,7 @@ __wlan_hdd_cfg80211_ll_stats_set(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -1270,7 +1270,7 @@ __wlan_hdd_cfg80211_ll_stats_get(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -1401,7 +1401,7 @@ __wlan_hdd_cfg80211_ll_stats_clear(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -1546,7 +1546,7 @@ static int __wlan_hdd_cfg80211_stats_ext_request(struct wiphy *wiphy,
 	if (ret_val)
 		return ret_val;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -1723,7 +1723,7 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -1753,7 +1753,7 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
 #ifdef WLAN_FEATURE_LPSS
 	if (!pAdapter->rssi_send) {
 		pAdapter->rssi_send = true;
-		if (pHddCtx->isUnloadInProgress != true)
+		if (cds_is_driver_unloading())
 			wlan_hdd_send_status_pkg(pAdapter, pHddStaCtx, 1, 1);
 	}
 #endif
@@ -1779,13 +1779,12 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
 			pAdapter->hdd_stats.ClassA_stat.mcs_index = 0;
 		}
 	}
-#ifdef LINKSPEED_DEBUG_ENABLED
-	pr_info("RSSI %d, RLMS %u, rate %d, rssi high %d, rssi mid %d, rssi low %d, rate_flags 0x%x, MCS %d\n",
-		sinfo->signal, pCfg->reportMaxLinkSpeed, myRate,
-		(int)pCfg->linkSpeedRssiHigh, (int)pCfg->linkSpeedRssiMid,
-		(int)pCfg->linkSpeedRssiLow, (int)rate_flags,
-		(int)pAdapter->hdd_stats.ClassA_stat.mcs_index);
-#endif /* LINKSPEED_DEBUG_ENABLED */
+
+	hdd_info("RSSI %d, RLMS %u, rate %d, rssi high %d, rssi mid %d, rssi low %d, rate_flags 0x%x, MCS %d",
+		 sinfo->signal, pCfg->reportMaxLinkSpeed, myRate,
+		 (int)pCfg->linkSpeedRssiHigh, (int)pCfg->linkSpeedRssiMid,
+		 (int)pCfg->linkSpeedRssiLow, (int)rate_flags,
+		 (int)pAdapter->hdd_stats.ClassA_stat.mcs_index);
 
 	if (eHDD_LINK_SPEED_REPORT_ACTUAL != pCfg->reportMaxLinkSpeed) {
 		/* we do not want to necessarily report the current speed */
@@ -2118,6 +2117,13 @@ static int __wlan_hdd_cfg80211_get_station(struct wiphy *wiphy,
 #endif /* LINKSPEED_DEBUG_ENABLED */
 		}
 	}
+
+	if (rate_flags & eHAL_TX_RATE_LEGACY)
+		hdd_info("Reporting legacy rate %d", sinfo->txrate.legacy);
+	else
+		hdd_info("Reporting MCS rate %d flags 0x%x",
+			 sinfo->txrate.mcs, sinfo->txrate.flags);
+
 	sinfo->filled |= STATION_INFO_TX_BITRATE;
 
 	sinfo->tx_bytes = pAdapter->stats.tx_bytes;
@@ -2224,7 +2230,7 @@ static int __wlan_hdd_cfg80211_dump_survey(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
diff --git a/core/hdd/src/wlan_hdd_stats.h b/core/hdd/src/wlan_hdd_stats.h
index ae5e84d0a215..b30b587be819 100644
--- a/core/hdd/src/wlan_hdd_stats.h
+++ b/core/hdd/src/wlan_hdd_stats.h
@@ -90,6 +90,8 @@ struct index_data_rate_type {
  */
 #define LL_STATS_EVENT_BUF_SIZE 4096
 
+void hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx);
+
 /**
  * wlan_hdd_cfg80211_ll_stats_set() - set link layer stats
  * @wiphy: Pointer to wiphy
@@ -134,12 +136,29 @@ int wlan_hdd_cfg80211_ll_stats_clear(struct wiphy *wiphy,
 				     int data_len);
 
 void hdd_init_ll_stats_ctx(void);
+
+static inline bool hdd_link_layer_stats_supported(void)
+{
+	return true;
+}
+
 #else
+
+static inline void hdd_cfg80211_link_layer_stats_init(hdd_context_t *pHddCtx)
+{
+	return;
+}
+
 static inline void hdd_init_ll_stats_ctx(void)
 {
 	return;
 }
 
+static inline bool hdd_link_layer_stats_supported(void)
+{
+	return false;
+}
+
 #endif /* End of WLAN_FEATURE_LINK_LAYER_STATS */
 
 #ifdef WLAN_FEATURE_STATS_EXT
@@ -156,6 +175,10 @@ int wlan_hdd_cfg80211_stats_ext_request(struct wiphy *wiphy,
 					struct wireless_dev *wdev,
 					const void *data,
 					int data_len);
+
+void wlan_hdd_cfg80211_stats_ext_init(hdd_context_t *pHddCtx);
+#else
+static inline void wlan_hdd_cfg80211_stats_ext_init(hdd_context_t *pHddCtx) {}
 #endif /* End of WLAN_FEATURE_STATS_EXT */
 
 /**
diff --git a/core/hdd/src/wlan_hdd_subnet_detect.c b/core/hdd/src/wlan_hdd_subnet_detect.c
new file mode 100644
index 000000000000..44d69b5c24b3
--- /dev/null
+++ b/core/hdd/src/wlan_hdd_subnet_detect.c
@@ -0,0 +1,195 @@
+/*
+ * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ *
+ * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+ *
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/**
+ * DOC: wlan_hdd_subnet_detect.c
+ *
+ * WLAN Host Device Driver subnet detect API implementation
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <net/cfg80211.h>
+#include <ani_global.h>
+#include "sme_api.h"
+#include "wlan_hdd_main.h"
+#include "wlan_hdd_subnet_detect.h"
+
+/*
+ * define short names for the global vendor params
+ * used by __wlan_hdd_cfg80211_set_gateway_params()
+ */
+#define PARAM_MAC_ADDR QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_GW_MAC_ADDR
+#define PARAM_IPV4_ADDR QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_IPV4_ADDR
+#define PARAM_IPV6_ADDR QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_IPV6_ADDR
+
+static const struct nla_policy
+	policy[QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_MAX + 1] = {
+		[PARAM_MAC_ADDR] = {
+				.type = NLA_BINARY,
+				.len = CDF_MAC_ADDR_SIZE
+		},
+		[PARAM_IPV4_ADDR] = {
+				.type = NLA_BINARY,
+				.len = CDF_IPV4_ADDR_SIZE
+		},
+		[PARAM_IPV6_ADDR] = {
+				.type = NLA_BINARY,
+				.len = CDF_IPV6_ADDR_SIZE
+		}
+};
+
+/**
+ * __wlan_hdd_cfg80211_set_gateway_params() - set gateway params
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Data length
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int __wlan_hdd_cfg80211_set_gateway_params(struct wiphy *wiphy,
+		struct wireless_dev *wdev,
+		const void *data,
+		int data_len)
+{
+	struct net_device *dev = wdev->netdev;
+	hdd_adapter_t *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+	hdd_context_t *hdd_ctx = wiphy_priv(wiphy);
+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_MAX + 1];
+	struct gateway_param_update_req req = { 0 };
+	int ret;
+	CDF_STATUS status;
+
+	ENTER();
+
+	ret = wlan_hdd_validate_context(hdd_ctx);
+	if (0 != ret)
+		return ret;
+
+	/* user may have disabled the feature in INI */
+	if (!hdd_ctx->config->enable_lfr_subnet_detection) {
+		hdd_info("LFR Subnet Detection disabled in INI");
+		return -ENOTSUPP;
+	}
+
+	/* The gateway parameters are only valid in the STA persona
+	 * and only in the connected state.
+	 */
+	if (WLAN_HDD_INFRA_STATION != adapter->device_mode) {
+		hdd_err("Received GW param update for non-STA mode adapter");
+		return -ENOTSUPP;
+	}
+
+	if (!hdd_conn_is_connected(WLAN_HDD_GET_STATION_CTX_PTR(adapter))) {
+		hdd_err("Received GW param update in disconnected state!");
+		return -ENOTSUPP;
+	}
+
+	/* Extract NL parameters
+	 * mac_addr:  6 bytes
+	 * ipv4 addr: 4 bytes
+	 * ipv6 addr: 16 bytes
+	 */
+	if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_GW_PARAM_CONFIG_MAX,
+			data, data_len, policy)) {
+		hdd_err("Invalid ATTR list");
+		return -EINVAL;
+	}
+
+	if (!tb[PARAM_MAC_ADDR]) {
+		hdd_err("request mac addr failed");
+		return -EINVAL;
+	}
+	nla_memcpy(req.gw_mac_addr.bytes, tb[PARAM_MAC_ADDR],
+			CDF_MAC_ADDR_SIZE);
+
+	/* req ipv4_addr_type and ipv6_addr_type are initially false due
+	 * to zeroing the struct
+	 */
+	if (tb[PARAM_IPV4_ADDR]) {
+		nla_memcpy(req.ipv4_addr, tb[PARAM_IPV4_ADDR],
+			CDF_IPV4_ADDR_SIZE);
+		req.ipv4_addr_type = true;
+	}
+
+	if (tb[PARAM_IPV6_ADDR]) {
+		nla_memcpy(&req.ipv6_addr, tb[PARAM_IPV6_ADDR],
+			CDF_IPV6_ADDR_SIZE);
+		req.ipv6_addr_type = true;
+	}
+
+	if (!req.ipv4_addr_type && !req.ipv6_addr_type) {
+		hdd_err("invalid ipv4 or ipv6 gateway address");
+		return -EINVAL;
+	}
+
+	req.max_retries = 3;
+	req.timeout = 100;   /* in milliseconds */
+	req.session_id = adapter->sessionId;
+
+	hdd_info("**** Gateway Parameters: ****");
+	hdd_info("session id: %d", req.session_id);
+	hdd_info("ipv4 addr type: %d", req.ipv4_addr_type);
+	hdd_info("ipv6 addr type: %d", req.ipv6_addr_type);
+	hdd_info("gw mac addr: %pM", req.gw_mac_addr.bytes);
+	hdd_info("ipv4 addr: %pI4", req.ipv4_addr);
+	hdd_info("ipv6 addr: %pI6c", req.ipv6_addr);
+
+	status = sme_gateway_param_update(hdd_ctx->hHal, &req);
+	if (!CDF_IS_STATUS_SUCCESS(status)) {
+		hdd_err("sme_gateway_param_update failed(err=%d)", status);
+		ret = -EINVAL;
+	}
+
+	EXIT();
+	return ret;
+}
+
+/**
+ * wlan_hdd_cfg80211_set_gateway_params() - set gateway parameters
+ * @wiphy:    wiphy structure pointer
+ * @wdev:     Wireless device structure pointer
+ * @data:     Pointer to the data received
+ * @data_len: Length of @data
+ *
+ * The API is invoked by the user space to set the gateway parameters
+ * such as mac address and the IP address which is used for detecting
+ * the IP subnet change
+ *
+ * Return: 0 on success; errno on failure
+ */
+int wlan_hdd_cfg80211_set_gateway_params(struct wiphy *wiphy,
+		struct wireless_dev *wdev, const void *data, int data_len)
+{
+	int ret;
+
+	cds_ssr_protect(__func__);
+
+	ret = __wlan_hdd_cfg80211_set_gateway_params(
+				wiphy, wdev, data, data_len);
+	cds_ssr_unprotect(__func__);
+	return ret;
+}
+#undef PARAM_MAC_ADDR
+#undef PARAM_IPV4_ADDR
+#undef PARAM_IPV6_ADDR
diff --git a/core/hdd/src/wlan_hdd_subnet_detect.h b/core/hdd/src/wlan_hdd_subnet_detect.h
new file mode 100644
index 000000000000..ffab910884cb
--- /dev/null
+++ b/core/hdd/src/wlan_hdd_subnet_detect.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ *
+ * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+ *
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This file was originally distributed by Qualcomm Atheros, Inc.
+ * under proprietary terms before Copyright ownership was assigned
+ * to the Linux Foundation.
+ */
+
+#ifndef __WLAN_HDD_SUBNET_DETECT_H
+#define __WLAN_HDD_SUBNET_DETECT_H
+
+/**
+ * DOC: wlan_hdd_subnet_detect.h
+ *
+ * WLAN Host Device Driver subnet detect API specification
+ */
+
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+struct wiphy;
+struct wireless_dev;
+
+int wlan_hdd_cfg80211_set_gateway_params(struct wiphy *wiphy,
+	struct wireless_dev *wdev, const void *data, int data_len);
+#endif /* FEATURE_LFR_SUBNET_DETECTION */
+#endif /* __WLAN_HDD_SUBNET_DETECT_H */
diff --git a/core/hdd/src/wlan_hdd_tdls.c b/core/hdd/src/wlan_hdd_tdls.c
index aa0e442bdd5d..8e48da640e69 100644
--- a/core/hdd/src/wlan_hdd_tdls.c
+++ b/core/hdd/src/wlan_hdd_tdls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -419,9 +419,6 @@ static void wlan_hdd_tdls_schedule_scan(struct work_struct *work)
 	scan_ctx->attempt++;
 
 	wlan_hdd_cfg80211_scan(scan_ctx->wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-			       scan_ctx->dev,
-#endif
 			       scan_ctx->scan_request);
 }
 
@@ -438,7 +435,7 @@ static void dump_tdls_state_param_setting(tdlsInfo_t *info)
 
 	hddLog(LOG1,
 		FL(
-		   "Setting tdls state and param in fw: vdev_id: %d, tdls_state: %d, notification_interval_ms: %d, tx_discovery_threshold: %d, tx_teardown_threshold: %d, rssi_teardown_threshold: %d, rssi_delta: %d, tdls_options: 0x%x, peer_traffic_ind_window: %d, peer_traffic_response_timeout: %d, puapsd_mask: 0x%x, puapsd_inactivity_time: %d, puapsd_rx_frame_threshold: %d"
+		   "Setting tdls state and param in fw: vdev_id: %d, tdls_state: %d, notification_interval_ms: %d, tx_discovery_threshold: %d, tx_teardown_threshold: %d, rssi_teardown_threshold: %d, rssi_delta: %d, tdls_options: 0x%x, peer_traffic_ind_window: %d, peer_traffic_response_timeout: %d, puapsd_mask: 0x%x, puapsd_inactivity_time: %d, puapsd_rx_frame_threshold: %d, teardown_notification_ms: %d, tdls_peer_kickout_threshold: %d"
 		),
 		info->vdev_id,
 		info->tdls_state,
@@ -452,7 +449,9 @@ static void dump_tdls_state_param_setting(tdlsInfo_t *info)
 		info->peer_traffic_response_timeout,
 		info->puapsd_mask,
 		info->puapsd_inactivity_time,
-		info->puapsd_rx_frame_threshold);
+		info->puapsd_rx_frame_threshold,
+		info->teardown_notification_ms,
+		info->tdls_peer_kickout_threshold);
 }
 
 
@@ -509,6 +508,21 @@ static void wlan_hdd_tdls_del_non_forced_peers(tdlsCtx_t *hdd_tdls_ctx)
 }
 
 /**
+ * hdd_tdls_pre_init - TDLS pre init
+ * @hdd_ctx:	HDD context
+ *
+ * tdls_lock is initialized before an hdd_open_adapter ( which is
+ * invoked by other instances also) to protect the concurrent
+ * access for the Adapters by TDLS module.
+ *
+ * Return: None
+ */
+void hdd_tdls_pre_init(hdd_context_t *hdd_ctx)
+{
+	mutex_init(&hdd_ctx->tdls_lock);
+}
+
+/**
  * wlan_hdd_tdls_init() - tdls initializaiton
  * @pAdapter: hdd adapter
  *
@@ -638,6 +652,8 @@ int wlan_hdd_tdls_init(hdd_adapter_t *pAdapter)
 		pHddCtx->tdls_mode = eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY;
 		hddLog(CDF_TRACE_LEVEL_ERROR,
 		       "%s TDLS Implicit trigger not enabled!", __func__);
+	} else if (true == pHddCtx->config->fTDLSExternalControl) {
+		pHddCtx->tdls_mode = eTDLS_SUPPORT_EXTERNAL_CONTROL;
 	} else {
 		pHddCtx->tdls_mode = eTDLS_SUPPORT_ENABLED;
 	}
@@ -700,7 +716,10 @@ int wlan_hdd_tdls_init(hdd_adapter_t *pAdapter)
 		pHddCtx->config->fTDLSPuapsdInactivityTimer;
 	tInfo->puapsd_rx_frame_threshold =
 		pHddCtx->config->fTDLSRxFrameThreshold;
-
+	tInfo->teardown_notification_ms =
+		pHddCtx->config->tdls_idle_timeout;
+	tInfo->tdls_peer_kickout_threshold =
+		pHddCtx->config->tdls_peer_kickout_threshold;
 	dump_tdls_state_param_setting(tInfo);
 
 	cdf_ret_status = sme_update_fw_tdls_state(pHddCtx->hHal, tInfo, true);
@@ -767,7 +786,7 @@ void wlan_hdd_tdls_exit(hdd_adapter_t *pAdapter)
 
 	/* No need to post message during driver unlaod because MC thread is
 	   already shutdown */
-	if (!pHddCtx->isUnloadInProgress) {
+	if (!cds_is_driver_unloading()) {
 		tInfo = cdf_mem_malloc(sizeof(tdlsInfo_t));
 		if (NULL != tInfo) {
 			tInfo->vdev_id = pAdapter->sessionId;
@@ -799,7 +818,10 @@ void wlan_hdd_tdls_exit(hdd_adapter_t *pAdapter)
 				pHddCtx->config->fTDLSPuapsdInactivityTimer;
 			tInfo->puapsd_rx_frame_threshold =
 				pHddCtx->config->fTDLSRxFrameThreshold;
-
+			tInfo->teardown_notification_ms =
+				pHddCtx->config->tdls_idle_timeout;
+			tInfo->tdls_peer_kickout_threshold =
+				pHddCtx->config->tdls_peer_kickout_threshold;
 			dump_tdls_state_param_setting(tInfo);
 
 			cdf_ret_status =
@@ -1351,7 +1373,8 @@ int wlan_hdd_tdls_increment_pkt_count(hdd_adapter_t *pAdapter,
 	hddTdlsPeer_t *curr_peer;
 	hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
 
-	if (eTDLS_SUPPORT_ENABLED != pHddCtx->tdls_mode)
+	if (eTDLS_SUPPORT_ENABLED != pHddCtx->tdls_mode &&
+	    eTDLS_SUPPORT_EXTERNAL_CONTROL != pHddCtx->tdls_mode)
 		return -EINVAL;
 
 	curr_peer = wlan_hdd_tdls_get_peer(pAdapter, mac);
@@ -1532,11 +1555,11 @@ void wlan_hdd_tdls_set_mode(hdd_context_t *pHddCtx,
 		pAdapter = pAdapterNode->pAdapter;
 		pHddTdlsCtx = WLAN_HDD_GET_TDLS_CTX_PTR(pAdapter);
 		if (NULL != pHddTdlsCtx) {
-			if (eTDLS_SUPPORT_ENABLED == tdls_mode)
+			if (eTDLS_SUPPORT_ENABLED == tdls_mode ||
+			    eTDLS_SUPPORT_EXTERNAL_CONTROL == tdls_mode)
 				wlan_hdd_tdls_implicit_enable(pHddTdlsCtx);
 			else if ((eTDLS_SUPPORT_DISABLED == tdls_mode) ||
-				 (eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY ==
-				  tdls_mode))
+				 (eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == tdls_mode))
 				wlan_hdd_tdls_implicit_disable(pHddTdlsCtx);
 		}
 		status = hdd_get_next_adapter(pHddCtx, pAdapterNode, &pNext);
@@ -1587,7 +1610,8 @@ int wlan_hdd_tdls_set_params(struct net_device *dev,
 	}
 
 	/* copy the configuration only when given tdls mode is implicit trigger enable */
-	if (eTDLS_SUPPORT_ENABLED == req_tdls_mode) {
+	if (eTDLS_SUPPORT_ENABLED == req_tdls_mode ||
+	    eTDLS_SUPPORT_EXTERNAL_CONTROL == req_tdls_mode) {
 		memcpy(&pHddTdlsCtx->threshold_config, config,
 		       sizeof(tdls_config_params_t));
 	}
@@ -1634,36 +1658,12 @@ int wlan_hdd_tdls_set_params(struct net_device *dev,
 		pHddCtx->config->fTDLSPuapsdInactivityTimer;
 	tdlsParams->puapsd_rx_frame_threshold =
 		pHddCtx->config->fTDLSRxFrameThreshold;
+	tdlsParams->teardown_notification_ms =
+		pHddCtx->config->tdls_idle_timeout;
+	tdlsParams->tdls_peer_kickout_threshold =
+		pHddCtx->config->tdls_peer_kickout_threshold;
 
-	hddLog(LOG1,
-		  "%s: Setting tdls state and param in fw: "
-		  "vdev_id: %d, "
-		  "tdls_state: %d, "
-		  "notification_interval_ms: %d, "
-		  "tx_discovery_threshold: %d, "
-		  "tx_teardown_threshold: %d, "
-		  "rssi_teardown_threshold: %d, "
-		  "rssi_delta: %d, "
-		  "tdls_options: 0x%x, "
-		  "peer_traffic_ind_window: %d, "
-		  "peer_traffic_response_timeout: %d, "
-		  "puapsd_mask: 0x%x, "
-		  "puapsd_inactivity_time: %d, "
-		  "puapsd_rx_frame_threshold: %d ",
-		  __func__,
-		  tdlsParams->vdev_id,
-		  tdlsParams->tdls_state,
-		  tdlsParams->notification_interval_ms,
-		  tdlsParams->tx_discovery_threshold,
-		  tdlsParams->tx_teardown_threshold,
-		  tdlsParams->rssi_teardown_threshold,
-		  tdlsParams->rssi_delta,
-		  tdlsParams->tdls_options,
-		  tdlsParams->peer_traffic_ind_window,
-		  tdlsParams->peer_traffic_response_timeout,
-		  tdlsParams->puapsd_mask,
-		  tdlsParams->puapsd_inactivity_time,
-		  tdlsParams->puapsd_rx_frame_threshold);
+	dump_tdls_state_param_setting(tdlsParams);
 
 	cdf_ret_status = sme_update_fw_tdls_state(pHddCtx->hHal, tdlsParams, true);
 	if (CDF_STATUS_SUCCESS != cdf_ret_status) {
@@ -1716,15 +1716,14 @@ void wlan_hdd_update_tdls_info(hdd_adapter_t *adapter, bool tdls_prohibited,
 	if (tdls_prohibited) {
 		hdd_ctx->tdls_mode = eTDLS_SUPPORT_NOT_ENABLED;
 	} else {
-		if (false == hdd_ctx->config->fEnableTDLSImplicitTrigger) {
-			hdd_ctx->tdls_mode =
-				eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY;
-		} else {
+		if (false == hdd_ctx->config->fEnableTDLSImplicitTrigger)
+			hdd_ctx->tdls_mode = eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY;
+		else if (true == hdd_ctx->config->fTDLSExternalControl)
+			hdd_ctx->tdls_mode = eTDLS_SUPPORT_EXTERNAL_CONTROL;
+		else
 			hdd_ctx->tdls_mode = eTDLS_SUPPORT_ENABLED;
-		}
 	}
 	mutex_unlock(&hdd_ctx->tdls_lock);
-
 	tdls_param = cdf_mem_malloc(sizeof(*tdls_param));
 	if (!tdls_param) {
 		hddLog(CDF_TRACE_LEVEL_ERROR,
@@ -1768,35 +1767,12 @@ void wlan_hdd_update_tdls_info(hdd_adapter_t *adapter, bool tdls_prohibited,
 		hdd_ctx->config->fTDLSPuapsdInactivityTimer;
 	tdls_param->puapsd_rx_frame_threshold =
 		hdd_ctx->config->fTDLSRxFrameThreshold;
+	tdls_param->teardown_notification_ms =
+		hdd_ctx->config->tdls_idle_timeout;
+	tdls_param->tdls_peer_kickout_threshold =
+		hdd_ctx->config->tdls_peer_kickout_threshold;
 
-	hddLog(CDF_TRACE_LEVEL_DEBUG,
-		FL("Setting tdls state and param in fw: "
-		"vdev_id: %d, "
-		"tdls_state: %d, "
-		"notification_interval_ms: %d, "
-		"tx_discovery_threshold: %d, "
-		"tx_teardown_threshold: %d, "
-		"rssi_teardown_threshold: %d, "
-		"rssi_delta: %d, "
-		"tdls_options: 0x%x, "
-		"peer_traffic_ind_window: %d, "
-		"peer_traffic_response_timeout: %d, "
-		"puapsd_mask: 0x%x, "
-		"puapsd_inactivity_time: %d, "
-		"puapsd_rx_frame_threshold: %d "),
-		tdls_param->vdev_id,
-		tdls_param->tdls_state,
-		tdls_param->notification_interval_ms,
-		tdls_param->tx_discovery_threshold,
-		tdls_param->tx_teardown_threshold,
-		tdls_param->rssi_teardown_threshold,
-		tdls_param->rssi_delta,
-		tdls_param->tdls_options,
-		tdls_param->peer_traffic_ind_window,
-		tdls_param->peer_traffic_response_timeout,
-		tdls_param->puapsd_mask,
-		tdls_param->puapsd_inactivity_time,
-		tdls_param->puapsd_rx_frame_threshold);
+	dump_tdls_state_param_setting(tdls_param);
 
 	cdf_ret_status = sme_update_fw_tdls_state(hdd_ctx->hHal,
 					       tdls_param,
@@ -1865,6 +1841,38 @@ int wlan_hdd_tdls_set_extctrl_param(hdd_adapter_t *pAdapter, const uint8_t *mac,
 }
 
 /**
+ * wlan_hdd_tdls_update_peer_mac() - Update the peer mac information to firmware
+ * @adapter: hdd adapter to interface
+ * @mac: Mac address of the peer to be added
+ * @peerState: Current state of the peer
+ *
+ * This function updates TDLS peer state to firmware. Firmware will update
+ * connection table based on new peer state.
+ *
+ * Return:success (0) or failure (errno value)
+ */
+int wlan_hdd_tdls_update_peer_mac(hdd_adapter_t *adapter, const uint8_t *mac,
+				  uint32_t peer_state)
+{
+	tSmeTdlsPeerStateParams sme_tdls_peer_state_params = {0};
+	CDF_STATUS status = CDF_STATUS_E_FAILURE;
+	hdd_context_t *hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+
+	sme_tdls_peer_state_params.vdevId = adapter->sessionId;
+	cdf_mem_copy(&sme_tdls_peer_state_params.peerMacAddr, mac,
+		     sizeof(sme_tdls_peer_state_params.peerMacAddr));
+	sme_tdls_peer_state_params.peerState = peer_state;
+	status = sme_update_tdls_peer_state(hdd_ctx->hHal,
+					    &sme_tdls_peer_state_params);
+	if (CDF_STATUS_SUCCESS != status) {
+		hddLog(LOGE, FL("sme_UpdateTdlsPeerState failed for "MAC_ADDRESS_STR),
+				MAC_ADDR_ARRAY(mac));
+		return -EPERM;
+	}
+	return 0;
+}
+
+/**
  * wlan_hdd_tdls_set_force_peer() - set/clear isForcedPeer flag on a peer
  * @pAdapter: HDD adapter
  * @mac: MAC address of the tdls peer
@@ -2170,13 +2178,13 @@ void wlan_hdd_tdls_connection_callback(hdd_adapter_t *pAdapter)
 		FL("update %d"),
 		pHddTdlsCtx->threshold_config.tx_period_t);
 
-	if (eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode) {
+	if (eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode ||
+	    eTDLS_SUPPORT_EXTERNAL_CONTROL == pHddCtx->tdls_mode) {
 		wlan_hdd_tdls_peer_reset_discovery_processed(pHddTdlsCtx);
 		pHddTdlsCtx->discovery_sent_cnt = 0;
-		wlan_hdd_tdls_check_power_save_prohibited(pHddTdlsCtx->
-							  pAdapter);
-
+		wlan_hdd_tdls_check_power_save_prohibited(pHddTdlsCtx->pAdapter);
 	}
+
 	mutex_unlock(&pHddCtx->tdls_lock);
 
 }
@@ -2464,6 +2472,15 @@ static void __wlan_hdd_tdls_pre_setup(struct work_struct *work)
 				  discovery_tries_n,
 				  MAC_ADDR_ARRAY(curr_peer->peerMac));
 			curr_peer->tdls_support = eTDLS_CAP_NOT_SUPPORTED;
+			/* Since TDLS discovery attempt reached the
+			 * maximum threshold, so we remove the peer
+			 * from the FW connection table.
+			 */
+			if (0 != wlan_hdd_tdls_update_peer_mac(pHddTdlsCtx->pAdapter,
+				curr_peer->peerMac, eSME_TDLS_PEER_REMOVE_MAC_ADDR))
+				hddLog(LOGE, FL("TDLS Peer mac update Failed "
+					   MAC_ADDRESS_STR),
+					   MAC_ADDR_ARRAY(curr_peer->peerMac));
 			goto done;
 		}
 	}
@@ -2554,9 +2571,6 @@ void wlan_hdd_tdls_pre_setup(struct work_struct *work)
  */
 int wlan_hdd_tdls_copy_scan_context(hdd_context_t *pHddCtx,
 				    struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-				    struct net_device *dev,
-#endif
 				    struct cfg80211_scan_request *request)
 {
 	tdls_scan_context_t *scan_ctx;
@@ -2569,9 +2583,6 @@ int wlan_hdd_tdls_copy_scan_context(hdd_context_t *pHddCtx,
 	scan_ctx = &pHddCtx->tdls_scan_ctxt;
 
 	scan_ctx->wiphy = wiphy;
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-	scan_ctx->dev = dev;
-#endif
 
 	scan_ctx->scan_request = request;
 	EXIT();
@@ -2590,18 +2601,11 @@ int wlan_hdd_tdls_copy_scan_context(hdd_context_t *pHddCtx,
  */
 static void wlan_hdd_tdls_scan_init_work(hdd_context_t *pHddCtx,
 					 struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-					 struct net_device *dev,
-#endif
 					 struct cfg80211_scan_request *request,
 					 unsigned long delay)
 {
 	if (TDLS_CTX_MAGIC != pHddCtx->tdls_scan_ctxt.magic) {
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-		wlan_hdd_tdls_copy_scan_context(pHddCtx, wiphy, dev, request);
-#else
 		wlan_hdd_tdls_copy_scan_context(pHddCtx, wiphy, request);
-#endif
 		pHddCtx->tdls_scan_ctxt.attempt = 0;
 		pHddCtx->tdls_scan_ctxt.magic = TDLS_CTX_MAGIC;
 	}
@@ -2620,9 +2624,6 @@ static void wlan_hdd_tdls_scan_init_work(hdd_context_t *pHddCtx,
  *         1 = caller can continue to scan
  */
 int wlan_hdd_tdls_scan_callback(hdd_adapter_t *pAdapter, struct wiphy *wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-				struct net_device *dev,
-#endif
 				struct cfg80211_scan_request *request)
 {
 	hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
@@ -2677,9 +2678,6 @@ int wlan_hdd_tdls_scan_callback(hdd_adapter_t *pAdapter, struct wiphy *wiphy,
 				  pHddCtx->tdls_scan_ctxt.attempt, delay);
 
 			wlan_hdd_tdls_scan_init_work(pHddCtx, wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-						     dev,
-#endif
 						     request,
 						     msecs_to_jiffies(delay));
 			/* scan should not continue */
@@ -2694,6 +2692,7 @@ int wlan_hdd_tdls_scan_callback(hdd_adapter_t *pAdapter, struct wiphy *wiphy,
 	}
 	/* while tdls is up, first time scan */
 	else if (eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode ||
+		 eTDLS_SUPPORT_EXTERNAL_CONTROL == pHddCtx->tdls_mode ||
 		 eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == pHddCtx->tdls_mode) {
 		/* disable implicit trigger logic & tdls operatoin */
 		wlan_hdd_tdls_set_mode(pHddCtx, eTDLS_SUPPORT_DISABLED, false);
@@ -2778,9 +2777,6 @@ int wlan_hdd_tdls_scan_callback(hdd_adapter_t *pAdapter, struct wiphy *wiphy,
 				  wlan_hdd_tdls_connected_peers(pAdapter), delay);
 
 			wlan_hdd_tdls_scan_init_work(pHddCtx, wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
-						     dev,
-#endif
 						     request,
 						     msecs_to_jiffies(delay));
 			/* scan should not continue */
@@ -2820,6 +2816,7 @@ void wlan_hdd_tdls_scan_done_callback(hdd_adapter_t *pAdapter)
 
 	/* if tdls was enabled before scan, re-enable tdls mode */
 	if (eTDLS_SUPPORT_ENABLED == pHddCtx->tdls_mode_last ||
+	    eTDLS_SUPPORT_EXTERNAL_CONTROL == pHddCtx->tdls_mode_last ||
 	    eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == pHddCtx->tdls_mode_last) {
 		hddLog(LOG1,
 			  ("%s: revert tdls mode %d"), __func__,
@@ -2845,7 +2842,7 @@ void wlan_hdd_tdls_timer_restart(hdd_adapter_t *pAdapter,
 	hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
 
 	/* Check whether driver load unload is in progress */
-	if (cds_is_load_unload_in_progress()) {
+	if (cds_is_load_or_unload_in_progress()) {
 		hddLog(LOGE, FL("Driver load/unload is in progress."));
 		return;
 	}
@@ -3067,7 +3064,7 @@ __wlan_hdd_cfg80211_exttdls_get_status(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3246,7 +3243,7 @@ __wlan_hdd_cfg80211_exttdls_enable(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3365,7 +3362,7 @@ static int __wlan_hdd_cfg80211_exttdls_disable(struct wiphy *wiphy,
 	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_TDLS_DISABLE_MAX + 1];
 	CDF_STATUS status;
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hdd_err("Command not allowed in FTM mode");
 		return -EPERM;
 	}
@@ -3672,6 +3669,7 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
 
 	hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
 	hdd_context_t *pHddCtx = wiphy_priv(wiphy);
+	hdd_station_ctx_t *hdd_sta_ctx;
 	u8 peerMac[CDF_MAC_ADDR_SIZE];
 	CDF_STATUS status;
 	int max_sta_failed = 0;
@@ -3685,7 +3683,7 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
 #endif
 #endif
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -3708,6 +3706,21 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
 		return -ENOTSUPP;
 	}
 
+	hdd_sta_ctx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+
+	/*
+	 * STA should be connected and authenticated before sending
+	 * any TDLS frames
+	 */
+	if ((eConnectionState_Associated !=
+	     hdd_sta_ctx->conn_info.connState) ||
+	     (false == hdd_sta_ctx->conn_info.uIsAuthenticated)) {
+		hdd_err("STA is not connected or not authenticated. connState %u, uIsAuthenticated %u",
+			hdd_sta_ctx->conn_info.connState,
+			hdd_sta_ctx->conn_info.uIsAuthenticated);
+		return -EAGAIN;
+	}
+
 	/* If any concurrency is detected */
 	if (((1 << CDF_STA_MODE) != pHddCtx->concurrency_mode) ||
 	    (pHddCtx->no_of_active_sessions[CDF_STA_MODE] > 1)) {
@@ -3853,6 +3866,18 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
 		return -EINVAL;
 	}
 
+	if ((SIR_MAC_TDLS_DIS_REQ == action_code) ||
+	    (SIR_MAC_TDLS_DIS_RSP == action_code)) {
+		/* for DIS_REQ/DIS_RSP, supplicant does not consider the return
+		 * status. So no need to wait for tdls_mgmt_comp to
+		 * send ack status.
+		 */
+		hdd_info("tx done for frm %u", action_code);
+		return 0;
+	}
+	hdd_info("Wait for tdls_mgmt_comp. Timeout %u ms",
+		WAIT_TIME_TDLS_MGMT);
+
 	rc = wait_for_completion_timeout(&pAdapter->tdls_mgmt_comp,
 					 msecs_to_jiffies(WAIT_TIME_TDLS_MGMT));
 
@@ -3861,22 +3886,23 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
 			  "%s: Mgmt Tx Completion timed out TxCompletion %u",
 			  __func__, pAdapter->mgmtTxCompletionStatus);
 
-		if (pHddCtx->isLogpInProgress) {
-			CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
-				  "%s: LOGP in Progress. Ignore!!!", __func__);
+		if (cds_is_driver_recovering()) {
+			hdd_err("Recovery in Progress. State: 0x%x Ignore!!!",
+				cds_get_driver_state());
 			return -EAGAIN;
 		}
 
-		if (pHddCtx->isUnloadInProgress) {
-			CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Unloading/Loading in Progress. Ignore!!!",
-				  __func__);
+		if (cds_is_driver_unloading()) {
+			hdd_err("Unload in progress. State: 0x%x Ignore!!!",
+				cds_get_driver_state());
 			return -EAGAIN;
 		}
 
 		pAdapter->mgmtTxCompletionStatus = false;
 		return -EINVAL;
 	}
+	hdd_info("Mgmt Tx Completion status %ld TxCompletion %u",
+		rc, pAdapter->mgmtTxCompletionStatus);
 
 	if (max_sta_failed) {
 		return max_sta_failed;
@@ -4024,6 +4050,23 @@ int wlan_hdd_tdls_extctrl_config_peer(hdd_adapter_t *pAdapter,
 			  "%s TDLS Add Force Peer Failed", __func__);
 		return -EINVAL;
 	}
+	/* Update the peer mac to firmware, so firmware
+	 * could update the connection table
+	 */
+	if (0 != wlan_hdd_tdls_update_peer_mac(pAdapter, peer,
+	    eSME_TDLS_PEER_ADD_MAC_ADDR)) {
+		hddLog(LOGE, FL("TDLS Peer mac update Failed " MAC_ADDRESS_STR),
+				MAC_ADDR_ARRAY(peer));
+		return -EINVAL;
+	}
+
+	/* validate if off channel is DFS channel */
+	if (CDS_IS_DFS_CH(chan)) {
+		hdd_err("Resetting TDLS off-channel from %d to %d",
+		       chan, CFG_TDLS_PREFERRED_OFF_CHANNEL_NUM_DEFAULT);
+		chan = CFG_TDLS_PREFERRED_OFF_CHANNEL_NUM_DEFAULT;
+	}
+
 	if (0 != wlan_hdd_tdls_set_extctrl_param(pAdapter, peer,
 						 chan, max_latency,
 						 op_class, min_bandwidth)) {
@@ -4078,6 +4121,15 @@ int wlan_hdd_tdls_extctrl_deconfig_peer(hdd_adapter_t *pAdapter,
 			  "%s Failed", __func__);
 		return -EINVAL;
 	}
+	/* Update the peer mac to firmware, so firmware
+	 * could update the connection table
+	 */
+	if (0 != wlan_hdd_tdls_update_peer_mac(pAdapter, peer,
+	    eSME_TDLS_PEER_REMOVE_MAC_ADDR)) {
+		hddLog(LOGE, FL("TDLS Peer mac update Failed " MAC_ADDRESS_STR),
+				MAC_ADDR_ARRAY(peer));
+		return -EINVAL;
+	}
 	if (0 != wlan_hdd_set_callback(pTdlsPeer, NULL)) {
 		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
 			  "%s TDLS set callback Failed", __func__);
@@ -4110,7 +4162,7 @@ static int __wlan_hdd_cfg80211_tdls_oper(struct wiphy *wiphy,
 
 	ENTER();
 
-	if (CDF_FTM_MODE == hdd_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE == hdd_get_conparam()) {
 		hddLog(LOGE, FL("Command not allowed in FTM mode"));
 		return -EINVAL;
 	}
@@ -4265,6 +4317,16 @@ static int __wlan_hdd_cfg80211_tdls_oper(struct wiphy *wiphy,
 						pTdlsPeer->
 						op_class_for_pref_off_chan;
 
+				if (CDS_IS_DFS_CH(smeTdlsPeerStateParams.
+					peerCap.prefOffChanNum)) {
+					hdd_err("Resetting TDLS off-channel from %d to %d",
+					       smeTdlsPeerStateParams.peerCap.
+						prefOffChanNum,
+					       CFG_TDLS_PREFERRED_OFF_CHANNEL_NUM_DEFAULT);
+					smeTdlsPeerStateParams.peerCap.prefOffChanNum =
+						CFG_TDLS_PREFERRED_OFF_CHANNEL_NUM_DEFAULT;
+				}
+
 				CDF_TRACE(CDF_MODULE_ID_HDD,
 					  CDF_TRACE_LEVEL_INFO,
 					  "%s: Peer " MAC_ADDRESS_STR
@@ -4593,8 +4655,9 @@ hddTdlsPeer_t *wlan_hdd_tdls_find_first_connected_peer(hdd_adapter_t *adapter)
 int hdd_set_tdls_offchannel(hdd_context_t *hdd_ctx, int offchannel)
 {
 	if ((true == hdd_ctx->config->fEnableTDLSOffChannel) &&
-		(eTDLS_SUPPORT_ENABLED == hdd_ctx->tdls_mode ||
-		eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == hdd_ctx->tdls_mode)) {
+	    (eTDLS_SUPPORT_ENABLED == hdd_ctx->tdls_mode ||
+	     eTDLS_SUPPORT_EXTERNAL_CONTROL == hdd_ctx->tdls_mode ||
+	     eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == hdd_ctx->tdls_mode)) {
 		if (offchannel < CFG_TDLS_PREFERRED_OFF_CHANNEL_NUM_MIN ||
 			offchannel > CFG_TDLS_PREFERRED_OFF_CHANNEL_NUM_MAX) {
 			hddLog(LOGE, FL("Invalid tdls off channel %u"),
@@ -4625,8 +4688,9 @@ int hdd_set_tdls_offchannel(hdd_context_t *hdd_ctx, int offchannel)
 int hdd_set_tdls_secoffchanneloffset(hdd_context_t *hdd_ctx, int offchanoffset)
 {
 	if ((true == hdd_ctx->config->fEnableTDLSOffChannel) &&
-		(eTDLS_SUPPORT_ENABLED == hdd_ctx->tdls_mode ||
-		eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == hdd_ctx->tdls_mode)) {
+	    (eTDLS_SUPPORT_ENABLED == hdd_ctx->tdls_mode ||
+	     eTDLS_SUPPORT_EXTERNAL_CONTROL == hdd_ctx->tdls_mode ||
+	     eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == hdd_ctx->tdls_mode)) {
 		hdd_ctx->tdls_channel_offset = 0;
 
 		switch (offchanoffset) {
@@ -4696,13 +4760,14 @@ int hdd_set_tdls_offchannelmode(hdd_adapter_t *adapter, int offchanmode)
 	}
 	if ((true == hdd_ctx->config->fEnableTDLSOffChannel) &&
 		(eTDLS_SUPPORT_ENABLED == hdd_ctx->tdls_mode ||
-		eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == hdd_ctx->tdls_mode)) {
-		conn_peer = wlan_hdd_tdls_find_first_connected_peer(adapter);
-		if (NULL == conn_peer) {
+		 eTDLS_SUPPORT_EXTERNAL_CONTROL == hdd_ctx->tdls_mode ||
+		 eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY == hdd_ctx->tdls_mode)) {
+		 conn_peer = wlan_hdd_tdls_find_first_connected_peer(adapter);
+		 if (NULL == conn_peer) {
 			hddLog(LOGP,
 				FL("No TDLS Connected Peer"));
-			return -EPERM;
-		}
+		return -EPERM;
+	}
 	} else {
 		hddLog(LOGP,
 			FL("TDLS Connection not supported"));
diff --git a/core/hdd/src/wlan_hdd_trace.c b/core/hdd/src/wlan_hdd_trace.c
index f89bfb04ceb9..a5cec605bd16 100644
--- a/core/hdd/src/wlan_hdd_trace.c
+++ b/core/hdd/src/wlan_hdd_trace.c
@@ -50,10 +50,14 @@
 static void
 hdd_trace_dump(void *mac, tp_cdf_trace_record record, uint16_t index)
 {
-	hddLog(LOG1, "%04d %012llu S%d %-14s %-30s(0x%x)",
-	       index, record->time, record->session,
-	       "HDD Event:", hdd_trace_event_string(record->code),
-	       record->data);
+	if (TRACE_CODE_HDD_RX_SME_MSG == record->code)
+		hddLog(LOGE, "%04d    %012llu  S%d    %-14s  %-30s(0x%x) ",
+			index, record->time, record->session, "RX SME MSG:",
+			get_e_roam_cmd_status_str(record->data), record->data);
+	else
+		hddLog(LOGE, "%04d    %012llu  S%d    %-14s  %-30s(0x%x) ",
+			index, record->time, record->session, "HDD Event:",
+			hdd_trace_event_string(record->code), record->data);
 }
 
 /**
diff --git a/core/hdd/src/wlan_hdd_tx_rx.c b/core/hdd/src/wlan_hdd_tx_rx.c
index f5e9c32584ca..2f3e4fe90d05 100644
--- a/core/hdd/src/wlan_hdd_tx_rx.c
+++ b/core/hdd/src/wlan_hdd_tx_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -305,16 +305,16 @@ int hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 #endif /* QCA_PKT_PROTO_TRACE */
 
 #ifdef QCA_WIFI_FTM
-	if (hdd_get_conparam() == CDF_FTM_MODE) {
+	if (hdd_get_conparam() == CDF_GLOBAL_FTM_MODE) {
 		kfree_skb(skb);
 		return NETDEV_TX_OK;
 	}
 #endif
 
 	++pAdapter->hdd_stats.hddTxRxStats.txXmitCalled;
-	if (cds_is_logp_in_progress()) {
+	if (cds_is_driver_recovering()) {
 		CDF_TRACE(CDF_MODULE_ID_HDD_DATA, CDF_TRACE_LEVEL_WARN,
-			"LOPG in progress, dropping the packet");
+			"Recovery in progress, dropping the packet");
 		++pAdapter->stats.tx_dropped;
 		++pAdapter->hdd_stats.hddTxRxStats.txXmitDropped;
 		kfree_skb(skb);
@@ -333,7 +333,7 @@ int hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		if ((STAId == HDD_WLAN_INVALID_STA_ID) &&
 		    (cdf_is_macaddr_broadcast(pDestMacAddress) ||
 		     cdf_is_macaddr_group(pDestMacAddress))) {
-			STAId = IBSS_BROADCAST_STAID;
+			STAId = pHddStaCtx->broadcast_ibss_staid;
 			CDF_TRACE(CDF_MODULE_ID_HDD_DATA,
 				  CDF_TRACE_LEVEL_INFO_LOW, "%s: BC/MC packet",
 				  __func__);
@@ -347,6 +347,17 @@ int hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 			return NETDEV_TX_OK;
 		}
 	} else {
+		if (WLAN_HDD_OCB != pAdapter->device_mode &&
+			eConnectionState_Associated !=
+				pHddStaCtx->conn_info.connState) {
+			CDF_TRACE(CDF_MODULE_ID_HDD_DATA, CDF_TRACE_LEVEL_INFO,
+				FL("Tx frame in not associated state in %d context"),
+				pAdapter->device_mode);
+			++pAdapter->stats.tx_dropped;
+			++pAdapter->hdd_stats.hddTxRxStats.txXmitDropped;
+			kfree_skb(skb);
+			return NETDEV_TX_OK;
+		}
 		STAId = pHddStaCtx->conn_info.staId[0];
 	}
 
@@ -733,7 +744,8 @@ CDF_STATUS hdd_rx_packet_cbk(void *cds_context, cdf_nbuf_t rxBuf, uint8_t staId)
 
 	if (HDD_LRO_NO_RX ==
 		 hdd_lro_rx(pHddCtx, pAdapter, skb)) {
-		if (hdd_napi_enabled(HDD_NAPI_ANY))
+		if (hdd_napi_enabled(HDD_NAPI_ANY) &&
+		    !pHddCtx->config->enableRxThread)
 			rxstat = netif_receive_skb(skb);
 		else
 			rxstat = netif_rx_ni(skb);
diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c
index 153663ee8b0c..73be0e6db036 100644
--- a/core/hdd/src/wlan_hdd_wext.c
+++ b/core/hdd/src/wlan_hdd_wext.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -160,7 +160,7 @@ static const hdd_freq_chan_map_t freq_chan_map[] = {
 #define WE_TXRX_FWSTATS_RESET           41
 #define WE_SET_MAX_TX_POWER_2_4   42
 #define WE_SET_MAX_TX_POWER_5_0   43
-#define WE_SET_POWER_GATING       44
+/* 44 is unused */
 /* Private ioctl for packet powe save */
 #define  WE_PPS_PAID_MATCH              45
 #define  WE_PPS_GID_MATCH               46
@@ -247,7 +247,7 @@ static const hdd_freq_chan_map_t freq_chan_map[] = {
 #define WE_GET_AMSDU         28
 #define WE_GET_TXPOW_2G      29
 #define WE_GET_TXPOW_5G      30
-#define WE_GET_POWER_GATING  31
+/* 31 is unused */
 #define WE_GET_PPS_PAID_MATCH           32
 #define WE_GET_PPS_GID_MATCH            33
 #define WE_GET_PPS_EARLY_TIM_CLEAR      34
@@ -1109,9 +1109,9 @@ CDF_STATUS wlan_hdd_get_rssi(hdd_adapter_t *pAdapter, int8_t *rssi_value)
 		       "%s: Invalid context, pAdapter", __func__);
 		return CDF_STATUS_E_FAULT;
 	}
-	if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
-			  "%s:LOGP in Progress. Ignore!!!", __func__);
+	if (cds_is_driver_recovering()) {
+		hdd_err("Recovery in Progress. State: 0x%x Ignore!!!",
+			cds_get_driver_state());
 		/* return a cached value */
 		*rssi_value = pAdapter->rssi;
 		return CDF_STATUS_SUCCESS;
@@ -2248,9 +2248,9 @@ static int __iw_get_bitrate(struct net_device *dev,
 	if (0 != ret)
 		return ret;
 
-	if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_FATAL,
-			  "%s:LOGP in Progress. Ignore!!!", __func__);
+	if (cds_is_driver_recovering()) {
+		hdd_alert("Recovery in Progress. State: 0x%x Ignore!!!",
+			  cds_get_driver_state());
 		return status;
 	}
 
@@ -3352,9 +3352,9 @@ CDF_STATUS wlan_hdd_get_class_astats(hdd_adapter_t *pAdapter)
 		hddLog(CDF_TRACE_LEVEL_ERROR, "%s: pAdapter is NULL", __func__);
 		return CDF_STATUS_E_FAULT;
 	}
-	if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) {
-		CDF_TRACE(CDF_MODULE_ID_HDD, CDF_TRACE_LEVEL_ERROR,
-			  "%s:LOGP in Progress. Ignore!!!", __func__);
+	if (cds_is_driver_recovering()) {
+		hdd_err("Recovery in Progress. State: 0x%x Ignore!!!",
+			 cds_get_driver_state());
 		return CDF_STATUS_SUCCESS;
 	}
 
@@ -5698,16 +5698,6 @@ static int __iw_setint_getnone(struct net_device *dev,
 		break;
 	}
 
-	case WE_SET_POWER_GATING:
-	{
-		hddLog(LOG1, "WMI_PDEV_PARAM_POWER_GATING_SLEEP val %d",
-		       set_value);
-		ret = wma_cli_set_command(pAdapter->sessionId,
-					  WMI_PDEV_PARAM_POWER_GATING_SLEEP,
-					  (set_value) ? true : false, PDEV_CMD);
-		break;
-	}
-
 	/* Firmware debug log */
 	case WE_DBGLOG_LOG_LEVEL:
 	{
@@ -6681,15 +6671,6 @@ static int __iw_setnone_getint(struct net_device *dev,
 		break;
 	}
 
-	case WE_GET_POWER_GATING:
-	{
-		hddLog(LOG1, "GET WMI_PDEV_PARAM_POWER_GATING_SLEEP");
-		*value = wma_cli_get_command(pAdapter->sessionId,
-					     WMI_PDEV_PARAM_POWER_GATING_SLEEP,
-					     PDEV_CMD);
-		break;
-	}
-
 	case WE_GET_PPS_PAID_MATCH:
 	{
 		hddLog(LOG1, "GET WMI_VDEV_PPS_PAID_MATCH");
@@ -6894,9 +6875,7 @@ static int __iw_set_three_ints_getnone(struct net_device *dev,
 			return -EPERM;
 		}
 		hdd_debug("%d %d %d", value[1], value[2], value[3]);
-		cds_set_dual_mac_scan_config(hdd_ctx,
-				value[1], value[2],
-				value[3]);
+		cds_set_dual_mac_scan_config(value[1], value[2], value[3]);
 		break;
 	default:
 		hddLog(LOGE, "%s: Invalid IOCTL command %d", __func__, sub_cmd);
@@ -7712,7 +7691,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 	{
 		hddLog(LOGE,
 			FL("<iwpriv wlan0 pm_clist> is called\n"));
-		cds_incr_connection_count_utfw(hdd_ctx, apps_args[0],
+		cds_incr_connection_count_utfw(apps_args[0],
 			apps_args[1], apps_args[2], apps_args[3],
 			apps_args[4], apps_args[5], apps_args[6],
 			apps_args[7]);
@@ -7723,7 +7702,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 	{
 		hddLog(LOGE,
 			FL("<iwpriv wlan0 pm_dlist> is called\n"));
-		cds_decr_connection_count_utfw(hdd_ctx, apps_args[0],
+		cds_decr_connection_count_utfw(apps_args[0],
 			apps_args[1]);
 	}
 	break;
@@ -7732,7 +7711,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 	{
 		hddLog(LOGE,
 			FL("<iwpriv wlan0 pm_ulist> is called\n"));
-		cds_update_connection_info_utfw(hdd_ctx, apps_args[0],
+		cds_update_connection_info_utfw(apps_args[0],
 			apps_args[1], apps_args[2], apps_args[3],
 			apps_args[4], apps_args[5], apps_args[6],
 			apps_args[7]);
@@ -7764,7 +7743,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 		hddLog(LOGE,
 			FL("<iwpriv wlan0 pm_pcl> is called\n"));
 
-		cds_get_pcl(hdd_ctx, apps_args[0],
+		cds_get_pcl(apps_args[0],
 				pcl, &pcl_len);
 		pr_info("PCL list for role[%d] is {", apps_args[0]);
 		for (i = 0 ; i < pcl_len; i++)
@@ -7780,7 +7759,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 
 		hddLog(LOGE,
 			FL("<iwpriv wlan0 pm_cinfo> is called\n"));
-		conn_info = cds_get_conn_info(hdd_ctx, &len);
+		conn_info = cds_get_conn_info(&len);
 		pr_info("+-----------------------------+\n");
 		for (i = 0; i < len; i++) {
 			pr_info("|table_index[%d]\t\t|\n", i);
@@ -7806,7 +7785,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 		if (apps_args[0] == 0) {
 			hddLog(LOGE,
 				FL("set hw mode for single mac\n"));
-			cds_soc_set_hw_mode(hdd_ctx,
+			cds_soc_set_hw_mode(
 					pAdapter->sessionId,
 					HW_MODE_SS_2x2,
 					HW_MODE_80_MHZ,
@@ -7817,7 +7796,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 		} else if (apps_args[0] == 1) {
 			hddLog(LOGE,
 				FL("set hw mode for dual mac\n"));
-			cds_soc_set_hw_mode(hdd_ctx,
+			cds_soc_set_hw_mode(
 					pAdapter->sessionId,
 					HW_MODE_SS_1x1,
 					HW_MODE_80_MHZ,
@@ -7845,7 +7824,7 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 		bool allow;
 		hddLog(LOGE,
 			FL("<iwpriv wlan0 pm_query_allow> is called\n"));
-		allow = cds_allow_concurrency(hdd_ctx,
+		allow = cds_allow_concurrency(
 				apps_args[0], apps_args[1], apps_args[2]);
 		pr_info("allow %d {0 = don't allow, 1 = allow}", allow);
 	}
@@ -8604,10 +8583,8 @@ static int __iw_set_keepalive_params(struct net_device *dev,
 		       request->destIpv4Addr[0], request->destIpv4Addr[1],
 		       request->destIpv4Addr[2], request->destIpv4Addr[3]);
 
-		hdd_info("Dest MAC address: %d:%d:%d:%d:%d:%d",
-		       request->destMacAddr[0], request->destMacAddr[1],
-		       request->destMacAddr[2], request->destMacAddr[3],
-		       request->destMacAddr[4], request->destMacAddr[5]);
+		hdd_info("Dest MAC address: "MAC_ADDRESS_STR,
+		       MAC_ADDR_ARRAY(request->dest_macaddr.bytes));
 		break;
 	}
 
@@ -9534,8 +9511,7 @@ static int __iw_set_two_ints_getnone(struct net_device *dev,
 			return -EPERM;
 		}
 		hdd_debug("%d %d", value[1], value[2]);
-		cds_set_dual_mac_fw_mode_config(hdd_ctx,
-				value[1], value[2]);
+		cds_set_dual_mac_fw_mode_config(value[1], value[2]);
 		break;
 	case WE_DUMP_DP_TRACE_LEVEL:
 		hdd_info("WE_DUMP_DP_TRACE_LEVEL: %d %d",
@@ -9917,11 +9893,6 @@ static const struct iw_priv_args we_private_args[] = {
 	 0,
 	 "txpow5g"},
 
-	{WE_SET_POWER_GATING,
-	 IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-	 0,
-	 "pwrgating"},
-
 	/* Sub-cmds DBGLOG specific commands */
 	{WE_DBGLOG_LOG_LEVEL,
 	 IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
@@ -10275,11 +10246,6 @@ static const struct iw_priv_args we_private_args[] = {
 	 IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
 	 "get_txpow5g"},
 
-	{WE_GET_POWER_GATING,
-	 0,
-	 IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-	 "get_pwrgating"},
-
 	{WE_GET_PPS_PAID_MATCH,
 	 0,
 	 IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
diff --git a/core/hdd/src/wlan_hdd_wmm.c b/core/hdd/src/wlan_hdd_wmm.c
index 9b93e2711fa1..582b2dfd5713 100644
--- a/core/hdd/src/wlan_hdd_wmm.c
+++ b/core/hdd/src/wlan_hdd_wmm.c
@@ -81,10 +81,6 @@
 
 #define WLAN_HDD_MAX_DSCP 0x3f
 
-/* DHCP Port number */
-#define DHCP_SOURCE_PORT 0x4400
-#define DHCP_DESTINATION_PORT 0x4300
-
 #define HDD_WMM_UP_TO_AC_MAP_SIZE 8
 
 const uint8_t hdd_wmm_up_to_ac_map[] = {
diff --git a/core/hdd/src/wlan_hdd_wowl.c b/core/hdd/src/wlan_hdd_wowl.c
index 1c2ff5789ae7..2901e1c2d207 100644
--- a/core/hdd/src/wlan_hdd_wowl.c
+++ b/core/hdd/src/wlan_hdd_wowl.c
@@ -522,8 +522,8 @@ bool hdd_enter_wowl(hdd_adapter_t *pAdapter, bool enable_mp, bool enable_pbm)
 	wowParams.ucMagicPktEnable = enable_mp;
 	wowParams.sessionId = pAdapter->sessionId;
 	if (enable_mp) {
-		cdf_copy_macaddr((struct cdf_mac_addr *) &(wowParams.magicPtrn),
-				 &(pAdapter->macAddressCurrent));
+		cdf_copy_macaddr(&wowParams.magic_ptrn,
+				 &pAdapter->macAddressCurrent);
 	}
 #ifdef WLAN_WAKEUP_EVENTS
 	wowParams.ucWoWEAPIDRequestEnable = true;
@@ -533,7 +533,7 @@ bool hdd_enter_wowl(hdd_adapter_t *pAdapter, bool enable_mp, bool enable_pbm)
 	wowParams.ucWoWBSSConnLoss = true;
 #endif /* WLAN_WAKEUP_EVENTS */
 
-	/* Request to put Libra into WoWL */
+	/* Request to put FW into WoWL */
 	cdf_ret_status = sme_enter_wowl(hHal, hdd_wowl_callback, pAdapter,
 #ifdef WLAN_WAKEUP_EVENTS
 					hdd_wowl_wake_indication_callback,
diff --git a/core/hif/inc/hif.h b/core/hif/inc/hif.h
index cc7a66fd7fad..08885739dd3d 100644
--- a/core/hif/inc/hif.h
+++ b/core/hif/inc/hif.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -394,14 +394,6 @@ typedef struct osdrv_callbacks {
  */
 int hif_init(OSDRV_CALLBACKS *callbacks);
 
-/*
- * This API claims the HIF device and provides a context for handling removal.
- * The device removal callback is only called when the OSDRV layer claims
- * a device.  The claimed context must be non-NULL */
-void hif_claim_device(struct ol_softc *scn, void *claimedContext);
-/* release the claimed device */
-void hif_release_device(struct ol_softc *scn);
-
 /* This API detaches the HTC layer from the HIF device */
 void hif_detach_htc(struct ol_softc *scn);
 
@@ -635,18 +627,76 @@ void hif_disable_isr(void *scn);
 void hif_reset_soc(void *scn);
 void hif_disable_aspm(void);
 void hif_save_htc_htt_config_endpoint(int htc_endpoint);
-CDF_STATUS hif_open(void);
+CDF_STATUS hif_open(enum ath_hal_bus_type bus_type);
 void hif_close(void *hif_ctx);
 CDF_STATUS hif_enable(void *hif_ctx, struct device *dev, void *bdev,
 	const hif_bus_id *bid, enum ath_hal_bus_type bus_type,
 	enum hif_enable_type type);
 void hif_disable(void *hif_ctx, enum hif_disable_type type);
 void hif_enable_power_gating(void *hif_ctx);
-int hif_bus_resume(void);
-int hif_bus_suspend(void);
+
+#ifdef FEATURE_RUNTIME_PM
+struct hif_pm_runtime_lock;
+int hif_pm_runtime_get(void *hif_ctx);
+void hif_pm_runtime_get_noresume(void *hif_ctx);
+int hif_pm_runtime_put(void *hif_ctx);
+struct hif_pm_runtime_lock *hif_runtime_lock_init(const char *name);
+void hif_runtime_lock_deinit(struct hif_pm_runtime_lock *lock);
+int hif_pm_runtime_prevent_suspend(void *ol_sc,
+		struct hif_pm_runtime_lock *lock);
+int hif_pm_runtime_allow_suspend(void *ol_sc,
+		struct hif_pm_runtime_lock *lock);
+int hif_pm_runtime_prevent_suspend_timeout(void *ol_sc,
+		struct hif_pm_runtime_lock *lock, unsigned int delay);
+#else
+struct hif_pm_runtime_lock {
+	const char *name;
+};
+
+static inline void hif_pm_runtime_get_noresume(void *hif_ctx)
+{}
+
+static inline int hif_pm_runtime_get(void *hif_ctx)
+{ return 0; }
+static inline int hif_pm_runtime_put(void *hif_ctx)
+{ return 0; }
+static inline struct hif_pm_runtime_lock *hif_runtime_lock_init(
+		const char *name)
+{ return NULL; }
+static inline void hif_runtime_lock_deinit(struct hif_pm_runtime_lock *lock)
+{}
+
+static inline int hif_pm_runtime_prevent_suspend(void *ol_sc,
+		struct hif_pm_runtime_lock *lock)
+{ return 0; }
+static inline int hif_pm_runtime_allow_suspend(void *ol_sc,
+		struct hif_pm_runtime_lock *lock)
+{ return 0; }
+static inline int hif_pm_runtime_prevent_suspend_timeout(void *ol_sc,
+		struct hif_pm_runtime_lock *lock, unsigned int delay)
+{ return 0; }
+#endif
+
+void hif_enable_power_management(void *hif_ctx);
+void hif_disable_power_management(void *hif_ctx);
+
 void hif_vote_link_down(void);
 void hif_vote_link_up(void);
 bool hif_can_suspend_link(void);
+
+int hif_bus_resume(void);
+int hif_bus_suspend(void);
+
+#ifdef FEATURE_RUNTIME_PM
+int hif_pre_runtime_suspend(void);
+void hif_pre_runtime_resume(void);
+int hif_runtime_suspend(void);
+int hif_runtime_resume(void);
+void hif_process_runtime_suspend_success(void);
+void hif_process_runtime_suspend_failure(void);
+void hif_process_runtime_resume_success(void);
+#endif
+
 int dump_ce_register(struct ol_softc *scn);
 int ol_copy_ramdump(struct ol_softc *scn);
 void hif_pktlogmod_exit(void *hif_ctx);
diff --git a/core/hif/inc/platform_icnss.h b/core/hif/inc/platform_icnss.h
new file mode 100644
index 000000000000..40c22b6c265a
--- /dev/null
+++ b/core/hif/inc/platform_icnss.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ *
+ * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
+ *
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This file was originally distributed by Qualcomm Atheros, Inc.
+ * under proprietary terms before Copyright ownership was assigned
+ * to the Linux Foundation.
+ */
+
+#ifndef _PLATFORM_ICNSS_H_
+#define _PLATFORM_ICNSS_H_
+
+#ifdef HIF_PCI
+#include "icnss_stub.h"
+#else
+#include <soc/qcom/icnss.h>
+#endif
+
+#endif
diff --git a/core/hif/src/adrastea_reg_def.h b/core/hif/src/adrastea_reg_def.h
index c7fa92c47a48..c51733aae3be 100644
--- a/core/hif/src/adrastea_reg_def.h
+++ b/core/hif/src/adrastea_reg_def.h
@@ -1812,11 +1812,7 @@
 
 #define ADRASTEA_A_WIFI_APB_1_A_WFSS_CE_TARGET_HOST_DELTA	0x08
 #define ADRASTEA_A_SOC_PCIE_PCIE_SCRATCH_2			0x0013005C
-#ifdef QCA_WIFI_3_0_IHELIUM
-#define ADRASTEA_A_SOC_CORE_PCIE_INTR_ENABLE_GRP0_Q6_MASK        0xff
-#else
 #define ADRASTEA_A_SOC_CORE_PCIE_INTR_ENABLE_GRP0_Q6_MASK        0x0
-#endif /* QCA_WIFI_3_0_IHELIUM */
 /* end: Q6 iHelium emulation registers */
 
 struct targetdef_s adrastea_targetdef = {
diff --git a/core/hif/src/ath_procfs.c b/core/hif/src/ath_procfs.c
index 941d2e598981..2b25e3ea7598 100644
--- a/core/hif/src/ath_procfs.c
+++ b/core/hif/src/ath_procfs.c
@@ -56,12 +56,7 @@ static void *get_hif_hdl_from_file(struct file *file)
 {
 	struct ol_softc *scn;
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0))
 	scn = (struct ol_softc *)PDE_DATA(file_inode(file));
-#else
-	scn = (struct ol_softc *)(
-		PDE(file->f_path.dentry->d_inode)->data);
-#endif
 	return (void *)scn;
 }
 
diff --git a/core/hif/src/ce/ce_internal.h b/core/hif/src/ce/ce_internal.h
index fb600808909c..b4272c56a41a 100644
--- a/core/hif/src/ce/ce_internal.h
+++ b/core/hif/src/ce/ce_internal.h
@@ -275,6 +275,50 @@ struct CE_dest_desc {
 
 #define CE_SENDLIST_ITEMS_MAX 12
 
+/**
+ * union ce_desc - unified data type for ce descriptors
+ *
+ * Both src and destination descriptors follow the same format.
+ * They use different data structures for different access symantics.
+ * Here we provice a unifying data type.
+ */
+union ce_desc {
+	struct CE_src_desc src_desc;
+	struct CE_dest_desc dest_desc;
+};
+
+/**
+ * enum hif_ce_event_type - HIF copy engine event type
+ * @HIF_RX_DESC_POST: event recorded before updating write index of RX ring.
+ * @HIF_RX_DESC_COMPLETION: event recorded before updating sw index of RX ring.
+ * @HIF_TX_GATHER_DESC_POST: post gather desc. (no write index update)
+ * @HIF_TX_DESC_POST: event recorded before updating write index of TX ring.
+ * @HIF_TX_DESC_COMPLETION: event recorded before updating sw index of TX ring.
+ * @HIF_IRQ_EVENT: event recorded in the irq before scheduling the bh
+ * @HIF_CE_TASKLET_ENTRY: records the start of the ce_tasklet
+ * @HIF_CE_TASKLET_RESCHEDULE: records the rescheduling of the wlan_tasklet
+ * @HIF_CE_TASKLET_EXIT: records the exit of the wlan tasklet without reschedule
+ * @HIF_CE_REAP_ENTRY: records when we process completion outside of a bh
+ * @HIF_CE_REAP_EXIT:  records when we process completion outside of a bh
+ */
+enum hif_ce_event_type {
+	HIF_RX_DESC_POST,
+	HIF_RX_DESC_COMPLETION,
+	HIF_TX_GATHER_DESC_POST,
+	HIF_TX_DESC_POST,
+	HIF_TX_DESC_COMPLETION,
+	HIF_IRQ_EVENT,
+	HIF_CE_TASKLET_ENTRY,
+	HIF_CE_TASKLET_RESCHEDULE,
+	HIF_CE_TASKLET_EXIT,
+	HIF_CE_REAP_ENTRY,
+	HIF_CE_REAP_EXIT,
+};
+
+void ce_init_ce_desc_event_log(int ce_id, int size);
+void hif_record_ce_desc_event(int ce_id, enum hif_ce_event_type type,
+		union ce_desc *descriptor, void *memory, int index);
+
 enum ce_sendlist_type_e {
 	CE_SIMPLE_BUFFER_TYPE,
 	/* TBDXXX: CE_RX_DESC_LIST, */
diff --git a/core/hif/src/ce/ce_main.c b/core/hif/src/ce/ce_main.c
index 0d2e40e3e0c1..af6233c19f31 100644
--- a/core/hif/src/ce/ce_main.c
+++ b/core/hif/src/ce/ce_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -166,6 +166,9 @@ struct CE_handle *ce_init(struct ol_softc *scn,
 	else
 		CE_state->src_sz_max = attr->src_sz_max;
 
+	ce_init_ce_desc_event_log(CE_id,
+			attr->src_nentries + attr->dest_nentries);
+
 	/* source ring setup */
 	nentries = attr->src_nentries;
 	if (nentries) {
@@ -691,9 +694,9 @@ hif_pci_ce_send_done(struct CE_handle *copyeng, void *ce_context,
 		if (transfer_context != CE_SENDLIST_ITEM_CTXT) {
 			if (hif_state->scn->target_status
 					== OL_TRGET_STATUS_RESET)
-				return;
-
-			msg_callbacks->txCompletionHandler(
+				cdf_nbuf_free(transfer_context);
+			else
+				msg_callbacks->txCompletionHandler(
 					msg_callbacks->Context,
 					transfer_context, transfer_id,
 					toeplitz_hash_result);
@@ -752,6 +755,7 @@ hif_pci_ce_recv_data(struct CE_handle *copyeng, void *ce_context,
 		&hif_state->msg_callbacks_current;
 
 	do {
+		hif_pm_runtime_mark_last_busy(scn->hif_sc->dev);
 		cdf_nbuf_unmap_single(scn->cdf_dev,
 				      (cdf_nbuf_t) transfer_context,
 				      CDF_DMA_FROM_DEVICE);
@@ -759,9 +763,9 @@ hif_pci_ce_recv_data(struct CE_handle *copyeng, void *ce_context,
 		atomic_inc(&pipe_info->recv_bufs_needed);
 		hif_post_recv_buffers_for_pipe(pipe_info);
 		if (hif_state->scn->target_status == OL_TRGET_STATUS_RESET)
-			return;
-
-		hif_ce_do_recv(msg_callbacks, transfer_context,
+			cdf_nbuf_free(transfer_context);
+		else
+			hif_ce_do_recv(msg_callbacks, transfer_context,
 				nbytes, pipe_info);
 
 		/* Set up force_break flag if num of receices reaches
@@ -775,6 +779,7 @@ hif_pci_ce_recv_data(struct CE_handle *copyeng, void *ce_context,
 	} while (ce_completed_recv_next(copyeng, &ce_context, &transfer_context,
 					&CE_data, &nbytes, &transfer_id,
 					&flags) == CDF_STATUS_SUCCESS);
+
 }
 
 /* TBDXXX: Set CE High Watermark; invoke txResourceAvailHandler in response */
@@ -841,7 +846,11 @@ int hif_completion_thread_startup(struct HIF_CE_state *hif_state)
 					    hif_pci_ce_recv_data, pipe_info,
 					    attr.flags & CE_ATTR_DISABLE_INTR);
 		}
+
+		if (attr.src_nentries)
+			cdf_spinlock_init(&pipe_info->completion_freeq_lock);
 	}
+
 	A_TARGET_ACCESS_UNLIKELY(scn);
 	return 0;
 }
@@ -863,20 +872,6 @@ static void hif_msg_callbacks_install(struct ol_softc *scn)
 		 sizeof(hif_state->msg_callbacks_pending));
 }
 
-void hif_claim_device(struct ol_softc *scn, void *claimedContext)
-{
-	struct HIF_CE_state *hif_state = (struct HIF_CE_state *)scn->hif_hdl;
-
-	hif_state->claimedContext = claimedContext;
-}
-
-void hif_release_device(struct ol_softc *scn)
-{
-	struct HIF_CE_state *hif_state = (struct HIF_CE_state *)scn->hif_hdl;
-
-	hif_state->claimedContext = NULL;
-}
-
 void
 hif_get_default_pipe(struct ol_softc *scn, uint8_t *ULPipe, uint8_t *DLPipe)
 {
@@ -1161,7 +1156,7 @@ void hif_send_buffer_cleanup_on_pipe(struct HIF_CE_pipe_info *pipe_info)
 			 * htt_h2t_rx_ring_cfg_msg_ll() have already been
 			 * freed in htt_htc_misc_pkt_pool_free() in
 			 * wlantl_close(), so do not free them here again
-			 * by checking whether it's the EndPoint
+			 * by checking whether it's the endpoint
 			 * which they are queued in.
 			 */
 			if (id == hif_state->scn->htc_endpoint)
@@ -1487,7 +1482,7 @@ static void hif_sleep_entry(void *arg)
 	if (scn->recovery)
 		return;
 
-	if (cds_is_unload_in_progress())
+	if (cds_is_driver_unloading())
 		return;
 
 	cdf_spin_lock_irqsave(&hif_state->keep_awake_lock);
@@ -1543,7 +1538,7 @@ int hif_set_hia(struct ol_softc *scn)
 
 	HIF_TRACE("%s: E", __func__);
 
-	if (IHELIUM_BU || ADRASTEA_BU)
+	if (ADRASTEA_BU)
 		return CDF_STATUS_SUCCESS;
 
 #ifdef QCA_WIFI_3_0
@@ -1799,26 +1794,15 @@ static int hif_wlan_enable(void)
 	cfg.num_shadow_reg_cfg = shadow_cfg_sz / sizeof(struct shadow_reg_cfg);
 	cfg.shadow_reg_cfg = (struct icnss_shadow_reg_cfg *) target_shadow_reg_cfg;
 
-	switch (con_mode) {
-	case CDF_FTM_MODE:
+	if (CDF_GLOBAL_FTM_MODE == con_mode)
 		mode = ICNSS_FTM;
-		break;
-	case CDF_EPPING_MODE:
+	else if (WLAN_IS_EPPING_ENABLED(cds_get_conparam()))
 		mode = ICNSS_EPPING;
-		break;
-	default:
+	else
 		mode = ICNSS_MISSION;
-		break;
-	}
-	return icnss_wlan_enable(&cfg, mode, QWLAN_VERSIONSTR);
-}
 
-#if ((!defined(QCA_WIFI_3_0_IHELIUM) && !defined(QCA_WIFI_3_0_ADRASTEA)) || defined(CONFIG_ICNSS))
-static inline void cnss_pcie_notify_q6(void)
-{
-	return;
+	return icnss_wlan_enable(&cfg, mode, QWLAN_VERSIONSTR);
 }
-#endif
 
 /*
  * Called from PCI layer whenever a new PCI device is probed.
@@ -1858,11 +1842,6 @@ int hif_config_ce(hif_handle_t hif_hdl)
 		HIF_ERROR("%s: hif_wlan_enable error = %d", __func__, ret);
 		return CDF_STATUS_NOT_INITIALIZED;
 	}
-	if (IHELIUM_BU) {
-		cnss_pcie_notify_q6();
-		HIF_TRACE("%s: cnss_pcie_notify_q6 done, notice_send= %d",
-			  __func__, scn->notice_send);
-	}
 
 	scn->notice_send = true;
 
diff --git a/core/hif/src/ce/ce_main.h b/core/hif/src/ce/ce_main.h
index 1e82e58d045f..8806bd31367d 100644
--- a/core/hif/src/ce/ce_main.h
+++ b/core/hif/src/ce/ce_main.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -123,8 +123,6 @@ struct HIF_CE_state {
 	/* current msg callbacks in use */
 	struct hif_msg_callbacks msg_callbacks_current;
 
-	void *claimedContext;
-
 	/* Target address used to signal a pending firmware event */
 	uint32_t fw_indicator_address;
 
diff --git a/core/hif/src/ce/ce_service.c b/core/hif/src/ce/ce_service.c
index f5e07c9164c8..0437f2d43b71 100644
--- a/core/hif/src/ce/ce_service.c
+++ b/core/hif/src/ce/ce_service.c
@@ -78,6 +78,103 @@ static int war1_allow_sleep;
 /* io32 write workaround */
 static int hif_ce_war1;
 
+#ifdef CONFIG_SLUB_DEBUG_ON
+
+/**
+ * struct hif_ce_event - structure for detailing a ce event
+ * @type: what the event was
+ * @time: when it happened
+ * @descriptor: descriptor enqueued or dequeued
+ * @memory: virtual address that was used
+ * @index: location of the descriptor in the ce ring;
+ */
+struct hif_ce_desc_event {
+	uint16_t index;
+	enum hif_ce_event_type type;
+	uint64_t time;
+	union ce_desc descriptor;
+	void *memory;
+};
+
+/* max history to record per copy engine */
+#define HIF_CE_HISTORY_MAX 512
+cdf_atomic_t hif_ce_desc_history_index[CE_COUNT_MAX];
+struct hif_ce_desc_event hif_ce_desc_history[CE_COUNT_MAX][HIF_CE_HISTORY_MAX];
+
+
+/**
+ * get_next_record_index() - get the next record index
+ * @table_index: atomic index variable to increment
+ * @array_size: array size of the circular buffer
+ *
+ * Increment the atomic index and reserve the value.
+ * Takes care of buffer wrap.
+ * Guaranteed to be thread safe as long as fewer than array_size contexts
+ * try to access the array.  If there are more than array_size contexts
+ * trying to access the array, full locking of the recording process would
+ * be needed to have sane logging.
+ */
+static int get_next_record_index(cdf_atomic_t *table_index, int array_size)
+{
+	int record_index = cdf_atomic_inc_return(table_index);
+	if (record_index == array_size)
+		cdf_atomic_sub(array_size, table_index);
+
+	while (record_index >= array_size)
+		record_index -= array_size;
+	return record_index;
+}
+
+/**
+ * hif_record_ce_desc_event() - record ce descriptor events
+ * @ce_id: which ce is the event occuring on
+ * @type: what happened
+ * @descriptor: pointer to the descriptor posted/completed
+ * @memory: virtual address of buffer related to the descriptor
+ * @index: index that the descriptor was/will be at.
+ */
+void hif_record_ce_desc_event(int ce_id, enum hif_ce_event_type type,
+		union ce_desc *descriptor, void *memory, int index)
+{
+	int record_index = get_next_record_index(
+			&hif_ce_desc_history_index[ce_id], HIF_CE_HISTORY_MAX);
+
+	struct hif_ce_desc_event *event =
+		&hif_ce_desc_history[ce_id][record_index];
+	event->type = type;
+	event->time = cds_get_monotonic_boottime();
+	if (descriptor != NULL)
+		event->descriptor = *descriptor;
+	else
+		memset(&event->descriptor, 0, sizeof(union ce_desc));
+	event->memory = memory;
+	event->index = index;
+}
+
+/**
+ * ce_init_ce_desc_event_log() - initialize the ce event log
+ * @ce_id: copy engine id for which we are initializing the log
+ * @size: size of array to dedicate
+ *
+ * Currently the passed size is ignored in favor of a precompiled value.
+ */
+void ce_init_ce_desc_event_log(int ce_id, int size)
+{
+	cdf_atomic_init(&hif_ce_desc_history_index[ce_id]);
+}
+#else
+void hif_record_ce_desc_event(
+		int ce_id, enum hif_ce_event_type type,
+		union ce_desc *descriptor, void *memory,
+		int index)
+{
+}
+
+inline void ce_init_ce_desc_event_log(int ce_id, int size)
+{
+}
+#endif
+
 /*
  * Support for Copy Engine hardware, which is mainly used for
  * communication between Host and Target over a PCIe interconnect.
@@ -194,6 +291,7 @@ ce_send_nolock(struct CE_handle *copyeng,
 		return status;
 	}
 	{
+		enum hif_ce_event_type event_type = HIF_TX_GATHER_DESC_POST;
 		struct CE_src_desc *src_ring_base =
 			(struct CE_src_desc *)src_ring->base_addr_owner_space;
 		struct CE_src_desc *shadow_base =
@@ -237,10 +335,18 @@ ce_send_nolock(struct CE_handle *copyeng,
 
 		/* WORKAROUND */
 		if (!shadow_src_desc->gather) {
+			event_type = HIF_TX_DESC_POST;
 			war_ce_src_ring_write_idx_set(scn, ctrl_addr,
 						      write_index);
 		}
 
+		/* src_ring->write index hasn't been updated event though
+		 * the register has allready been written to.
+		 */
+		hif_record_ce_desc_event(CE_state->id, event_type,
+			(union ce_desc *) shadow_src_desc, per_transfer_context,
+			src_ring->write_index);
+
 		src_ring->write_index = write_index;
 		status = CDF_STATUS_SUCCESS;
 	}
@@ -442,6 +548,7 @@ int ce_send_fast(struct CE_handle *copyeng, cdf_nbuf_t *msdus,
 		struct CE_src_desc *shadow_src_desc =
 			CE_SRC_RING_TO_DESC(shadow_base, write_index);
 
+		hif_pm_runtime_get_noresume(scn);
 		msdu = msdus[i];
 
 		/*
@@ -513,10 +620,15 @@ int ce_send_fast(struct CE_handle *copyeng, cdf_nbuf_t *msdus,
 	/* Write the final index to h/w one-shot */
 	if (i) {
 		src_ring->write_index = write_index;
-		/* Don't call WAR_XXX from here
-		 * Just call XXX instead, that has the reqd. intel
-		 */
-		war_ce_src_ring_write_idx_set(scn, ctrl_addr, write_index);
+
+		if (hif_pm_runtime_get(scn) == 0) {
+			/* Don't call WAR_XXX from here
+			 * Just call XXX instead, that has the reqd. intel
+			 */
+			war_ce_src_ring_write_idx_set(scn, ctrl_addr,
+					write_index);
+			hif_pm_runtime_put(scn);
+		}
 	}
 
 	cdf_spin_unlock_bh(&ce_state->ce_index_lock);
@@ -574,6 +686,10 @@ ce_recv_buf_enqueue(struct CE_handle *copyeng,
 		dest_ring->per_transfer_context[write_index] =
 			per_recv_context;
 
+		hif_record_ce_desc_event(CE_state->id, HIF_RX_DESC_POST,
+				(union ce_desc *) dest_desc, per_recv_context,
+				write_index);
+
 		/* Update Destination Ring Write Index */
 		write_index = CE_RING_IDX_INCR(nentries_mask, write_index);
 		CE_DEST_RING_WRITE_IDX_SET(scn, ctrl_addr, write_index);
@@ -764,6 +880,11 @@ ce_completed_recv_next_nolock(struct CE_state *CE_state,
 		goto done;
 	}
 
+	hif_record_ce_desc_event(CE_state->id, HIF_RX_DESC_COMPLETION,
+			(union ce_desc *) dest_desc,
+			dest_ring->per_transfer_context[sw_index],
+			sw_index);
+
 	dest_desc->nbytes = 0;
 
 	/* Return data from completed destination descriptor */
@@ -925,6 +1046,11 @@ ce_completed_send_next_nolock(struct CE_state *CE_state,
 		struct CE_src_desc *src_desc =
 			CE_SRC_RING_TO_DESC(src_ring_base, sw_index);
 #endif
+		hif_record_ce_desc_event(CE_state->id, HIF_TX_DESC_COMPLETION,
+				(union ce_desc *) shadow_src_desc,
+				src_ring->per_transfer_context[sw_index],
+				sw_index);
+
 		/* Return data from completed source descriptor */
 		*bufferp = HIF_CE_DESC_ADDR_TO_DMA(shadow_src_desc);
 		*nbytesp = shadow_src_desc->nbytes;
@@ -1061,7 +1187,7 @@ ce_completed_send_next(struct CE_handle *copyeng,
  * within it .
  */
 
-void ce_per_engine_servicereap(struct ol_softc *scn, unsigned int CE_id)
+void ce_per_engine_servicereap(struct ol_softc *scn, unsigned int ce_id)
 {
 	void *CE_context;
 	void *transfer_context;
@@ -1070,9 +1196,11 @@ void ce_per_engine_servicereap(struct ol_softc *scn, unsigned int CE_id)
 	unsigned int id;
 	unsigned int sw_idx, hw_idx;
 	uint32_t toeplitz_hash_result;
-	struct CE_state *CE_state = scn->ce_id_to_state[CE_id];
+	struct CE_state *CE_state = scn->ce_id_to_state[ce_id];
 
 	A_TARGET_ACCESS_BEGIN(scn);
+	hif_record_ce_desc_event(ce_id, HIF_CE_REAP_ENTRY,
+			NULL, NULL, 0);
 
 	/* Since this function is called from both user context and
 	 * tasklet context the spinlock has to lock the bottom halves.
@@ -1100,7 +1228,7 @@ void ce_per_engine_servicereap(struct ol_softc *scn, unsigned int CE_id)
 				  &nbytes, &id, &sw_idx, &hw_idx,
 				  &toeplitz_hash_result) ==
 				  CDF_STATUS_SUCCESS) {
-				if (CE_id != CE_HTT_H2T_MSG) {
+				if (ce_id != CE_HTT_H2T_MSG) {
 					cdf_spin_unlock_bh(
 						&CE_state->ce_index_lock);
 					CE_state->send_cb(
@@ -1127,6 +1255,9 @@ void ce_per_engine_servicereap(struct ol_softc *scn, unsigned int CE_id)
 	}
 
 	cdf_spin_unlock_bh(&CE_state->ce_index_lock);
+
+	hif_record_ce_desc_event(ce_id, HIF_CE_REAP_EXIT,
+			NULL, NULL, 0);
 	A_TARGET_ACCESS_END(scn);
 }
 
diff --git a/core/hif/src/ce/ce_tasklet.c b/core/hif/src/ce/ce_tasklet.c
index 2ca61ca34a2e..a2edeba26563 100644
--- a/core/hif/src/ce/ce_tasklet.c
+++ b/core/hif/src/ce/ce_tasklet.c
@@ -203,6 +203,9 @@ static void ce_tasklet(unsigned long data)
 	struct ol_softc *scn = hif_ce_state->scn;
 	struct CE_state *CE_state = scn->ce_id_to_state[tasklet_entry->ce_id];
 
+	hif_record_ce_desc_event(tasklet_entry->ce_id, HIF_CE_TASKLET_ENTRY,
+			NULL, NULL, 0);
+
 	if (cdf_atomic_read(&scn->link_suspended)) {
 		HIF_ERROR("%s: ce %d tasklet fired after link suspend.",
 				__func__, tasklet_entry->ce_id);
@@ -221,6 +224,8 @@ static void ce_tasklet(unsigned long data)
 		 * Enable the interrupt only when there is no pending frames in
 		 * any of the Copy Engine pipes.
 		 */
+		hif_record_ce_desc_event(tasklet_entry->ce_id,
+				HIF_CE_TASKLET_RESCHEDULE, NULL, NULL, 0);
 		ce_schedule_tasklet(tasklet_entry);
 		return;
 	}
@@ -228,6 +233,9 @@ static void ce_tasklet(unsigned long data)
 	if (scn->target_status != OL_TRGET_STATUS_RESET)
 		ce_irq_enable(scn, tasklet_entry->ce_id);
 
+	hif_record_ce_desc_event(tasklet_entry->ce_id, HIF_CE_TASKLET_EXIT,
+			NULL, NULL, 0);
+
 	cdf_atomic_dec(&scn->active_tasklet_cnt);
 }
 /**
@@ -301,6 +309,7 @@ static irqreturn_t ce_irq_handler(int irq, void *context)
 	ce_irq_disable(scn, ce_id);
 	ce_irq_status(scn, ce_id, &host_status);
 	cdf_atomic_inc(&scn->active_tasklet_cnt);
+	hif_record_ce_desc_event(ce_id, HIF_IRQ_EVENT, NULL, NULL, 0);
 	if (hif_napi_enabled(scn, ce_id))
 		hif_napi_schedule(scn, ce_id);
 	else
diff --git a/core/hif/src/hif_main.c b/core/hif/src/hif_main.c
index 100805f9100b..ef1aca1939f0 100644
--- a/core/hif/src/hif_main.c
+++ b/core/hif/src/hif_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -292,7 +292,7 @@ void hif_vote_link_down(void)
 
 	scn->linkstate_vote--;
 	if (scn->linkstate_vote == 0)
-		hif_bus_prevent_linkdown(false);
+		hif_bus_prevent_linkdown(scn, false);
 }
 
 /**
@@ -313,7 +313,7 @@ void hif_vote_link_up(void)
 
 	scn->linkstate_vote++;
 	if (scn->linkstate_vote == 1)
-		hif_bus_prevent_linkdown(true);
+		hif_bus_prevent_linkdown(scn, true);
 }
 
 /**
@@ -511,7 +511,7 @@ void hif_set_fw_info(void *scn, uint32_t target_fw_version)
  *
  * Return: scn
  */
-CDF_STATUS hif_open(void)
+CDF_STATUS hif_open(enum ath_hal_bus_type bus_type)
 {
 	struct ol_softc *scn;
 	v_CONTEXT_t cds_context;
@@ -536,6 +536,14 @@ CDF_STATUS hif_open(void)
 	cdf_atomic_init(&scn->tasklet_from_intr);
 	init_waitqueue_head(&scn->aps_osdev.event_queue);
 	scn->linkstate_vote = 0;
+
+	status = hif_bus_open(scn, bus_type);
+	if (status != CDF_STATUS_SUCCESS) {
+		HIF_ERROR("%s: hif_bus_open error = %d, bus_type = %d",
+				  __func__, status, bus_type);
+		cds_free_context(cds_context, CDF_MODULE_ID_HIF, scn);
+	}
+
 	return status;
 }
 
@@ -592,16 +600,8 @@ CDF_STATUS hif_enable(void *hif_ctx, struct device *dev,
 		return CDF_STATUS_E_NULL_VALUE;
 	}
 
-	status = hif_bus_open(scn, bus_type);
-	if (status != CDF_STATUS_SUCCESS) {
-		HIF_ERROR("%s: hif_bus_open error = %d, bus_type = %d",
-				  __func__, status, bus_type);
-		return status;
-	}
-
 	status = hif_enable_bus(scn, dev, bdev, bid, type);
 	if (status != CDF_STATUS_SUCCESS) {
-		hif_bus_close(scn);
 		HIF_ERROR("%s: hif_enable_bus error = %d",
 				  __func__, status);
 		return status;
@@ -613,7 +613,6 @@ CDF_STATUS hif_enable(void *hif_ctx, struct device *dev,
 	if (hif_config_ce(scn)) {
 		HIF_ERROR("%s: Target probe failed.", __func__);
 		hif_disable_bus(scn->aps_osdev.bdev);
-		hif_bus_close(scn);
 		status = CDF_STATUS_E_FAILURE;
 		return status;
 	}
@@ -652,7 +651,7 @@ void hif_pktlogmod_exit(void *hif_ctx)
 {
 	struct ol_softc *scn = hif_ctx;
 
-	if (scn && cds_get_conparam() != CDF_FTM_MODE &&
+	if (scn && cds_get_conparam() != CDF_GLOBAL_FTM_MODE &&
 	    !WLAN_IS_EPPING_ENABLED(cds_get_conparam()) && scn->pkt_log_init) {
 		pktlogmod_exit(scn);
 		scn->pkt_log_init = false;
@@ -664,13 +663,6 @@ void hif_pktlogmod_exit(void *hif_ctx)
 }
 #endif
 
-#if ((!defined(QCA_WIFI_3_0_IHELIUM) && !defined(QCA_WIFI_3_0_ADRASTEA)) || defined(CONFIG_ICNSS))
-static inline void cnss_pcie_notify_q6(void)
-{
-	return;
-}
-#endif
-
 /**
  * hif_wlan_disable(): call the platform driver to disable wlan
  *
@@ -684,17 +676,12 @@ void hif_wlan_disable(void)
 	enum icnss_driver_mode mode;
 	uint32_t con_mode = cds_get_conparam();
 
-	switch (con_mode) {
-	case CDF_FTM_MODE:
+	if (CDF_GLOBAL_FTM_MODE == con_mode)
 		mode = ICNSS_FTM;
-		break;
-	case CDF_EPPING_MODE:
+	else if (WLAN_IS_EPPING_ENABLED(cds_get_conparam()))
 		mode = ICNSS_EPPING;
-		break;
-	default:
+	else
 		mode = ICNSS_MISSION;
-		break;
-	}
 
 	icnss_wlan_disable(mode);
 }
@@ -718,12 +705,6 @@ void hif_disable(void *hif_ctx, enum hif_disable_type type)
 	if (scn->aps_osdev.bdev)
 		hif_disable_bus(scn->aps_osdev.bdev);
 
-	if (IHELIUM_BU) {
-		cnss_pcie_notify_q6();
-		HIF_TRACE("%s: cnss_pcie_notify_q6 done, notice_send= %d",
-			  __func__, scn->notice_send);
-	}
-
 	hif_wlan_disable();
 
 	scn->notice_send = false;
@@ -782,7 +763,7 @@ void hif_crash_shutdown(void *hif_ctx)
 		return;
 	}
 
-	if (cds_is_load_unload_in_progress()) {
+	if (cds_is_load_or_unload_in_progress()) {
 		HIF_ERROR("%s: Load/unload is in progress, ignore!", __func__);
 		return;
 	}
diff --git a/core/hif/src/hif_main.h b/core/hif/src/hif_main.h
index 5a9c81ca1afa..9544ef823dae 100644
--- a/core/hif/src/hif_main.h
+++ b/core/hif/src/hif_main.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -73,12 +73,6 @@ bool hif_target_forced_awake(struct ol_softc *scn);
 #define MAX_NUM_OF_RECEIVES 1000
 #endif /* SLUB_DEBUG_ON / FEATURE_NAPI */
 
-#ifdef QCA_WIFI_3_0_IHELIUM
-#define IHELIUM_BU 1
-#else
-#define IHELIUM_BU 0
-#endif
-
 #ifdef QCA_WIFI_3_0_ADRASTEA
 #define ADRASTEA_BU 1
 #else
@@ -101,7 +95,7 @@ bool hif_target_forced_awake(struct ol_softc *scn);
 #define AR6320_FW_3_2  (0x32)
 #define ADRASTEA_DEVICE_ID (0xabcd)
 #define ADRASTEA_DEVICE_ID_P2_E12 (0x7021)
-#if (defined(QVIT) || defined (QCA_WIFI_3_0_IHELIUM))
+#if (defined(QVIT))
 #define QCA6180_DEVICE_ID (0xabcd)
 #else
 #define QCA6180_DEVICE_ID (0x041)
@@ -137,6 +131,6 @@ CDF_STATUS hif_bus_open(struct ol_softc *ol_sc,
 CDF_STATUS hif_enable_bus(struct ol_softc *ol_sc, struct device *dev,
 	void *bdev, const hif_bus_id *bid, enum hif_enable_type type);
 void hif_disable_bus(void *bdev);
-void hif_bus_prevent_linkdown(bool flag);
+void hif_bus_prevent_linkdown(struct ol_softc *scn, bool flag);
 
 #endif /* __HIF_MAIN_H__ */
diff --git a/core/hif/src/icnss_stub/icnss_stub.c b/core/hif/src/icnss_stub/icnss_stub.c
index 484d1e2cb738..aa958ec335d6 100644
--- a/core/hif/src/icnss_stub/icnss_stub.c
+++ b/core/hif/src/icnss_stub/icnss_stub.c
@@ -93,6 +93,17 @@ int icnss_wlan_disable(enum icnss_driver_mode mode)
 	return 0;
 }
 
+/**
+ * icnss_set_fw_debug_mode() - icnss_set_fw_debug_mode
+ * @mode: fw debug mode, 0 for QXDM, 1 for WMI
+ *
+ * Return: int
+ */
+int icnss_set_fw_debug_mode(bool mode)
+{
+	return 0;
+}
+
 #else
 
 /**
@@ -167,6 +178,22 @@ int icnss_wlan_disable(enum icnss_driver_mode con_mode)
 	cnss_wlan_disable(mode);
 	return 0;
 }
+
+/**
+ * icnss_set_fw_debug_mode() - call the platform driver to set fw
+ * debug mode
+ * @mode: fw debug mode, 0 for QXDM, 1 for WMI
+ *
+ * This function passes the fw debug mode to platform driver.
+ * cnss_set_fw_debug_mode has been hacked to do a qmi handshake with fw.
+ * This is not needed for rome.
+ *
+ * Return: int
+ */
+int icnss_set_fw_debug_mode(bool mode)
+{
+	return cnss_set_fw_debug_mode(mode);
+}
 #endif
 
 /**
diff --git a/core/hif/src/icnss_stub/icnss_stub.h b/core/hif/src/icnss_stub/icnss_stub.h
index bce229a2dbdf..33a83acaab00 100644
--- a/core/hif/src/icnss_stub/icnss_stub.h
+++ b/core/hif/src/icnss_stub/icnss_stub.h
@@ -121,6 +121,7 @@ struct icnss_soc_info {
 int icnss_wlan_enable(struct icnss_wlan_enable_cfg *config,
 	enum icnss_driver_mode mode, const char *host_version);
 int icnss_wlan_disable(enum icnss_driver_mode mode);
+int icnss_set_fw_debug_mode(bool mode);
 int icnss_ce_request_irq(int ce_id,
 	irqreturn_t (*handler)(int ce_id, void *arg),
 	unsigned long flags, const char *name, void *context);
diff --git a/core/hif/src/pcie/hif_io32_pci.h b/core/hif/src/pcie/hif_io32_pci.h
index 3ffa30da0325..597508f6b0e8 100644
--- a/core/hif/src/pcie/hif_io32_pci.h
+++ b/core/hif/src/pcie/hif_io32_pci.h
@@ -243,6 +243,9 @@ extern void hif_target_write_checked(struct ol_softc *scn, uint32_t offset,
 #endif
 #endif /* CONFIG_ATH_PCIE_MAX_PERF */
 
+
+irqreturn_t hif_fw_interrupt_handler(int irq, void *arg);
+
 /**
  * ce_irq_enable() - ce_irq_enable
  * @scn: ol_softc
@@ -276,6 +279,9 @@ static inline void ce_irq_enable(struct ol_softc *scn, int ce_id)
 	if (scn->hif_init_done == true)
 		A_TARGET_ACCESS_END(scn);
 	cdf_spin_unlock_irqrestore(&scn->irq_lock);
+
+	/* check for missed firmware crash */
+	hif_fw_interrupt_handler(0, scn);
 }
 /**
  * ce_irq_disable() - ce_irq_disable
diff --git a/core/hif/src/pcie/if_pci.c b/core/hif/src/pcie/if_pci.c
index 91cff6a8835f..1e8e0cd257ef 100644
--- a/core/hif/src/pcie/if_pci.c
+++ b/core/hif/src/pcie/if_pci.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -43,6 +43,8 @@
 #include "bmi_msg.h"            /* TARGET_TYPE_ */
 #include "regtable.h"
 #include "ol_fw.h"
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <osapi_linux.h>
 #include "cds_api.h"
 #include "cdf_status.h"
@@ -100,64 +102,19 @@ struct ce_irq_reg_table {
 	uint32_t irq_status;
 };
 
-#if !defined(QCA_WIFI_3_0_IHELIUM) && !defined(QCA_WIFI_3_0_ADRASTEA)
+#if !defined(QCA_WIFI_3_0_ADRASTEA)
 static inline void cnss_intr_notify_q6(void)
 {
 }
 #endif
 
-#if !defined(QCA_WIFI_3_0_IHELIUM) && !defined(QCA_WIFI_3_0_ADRASTEA)
+#if !defined(QCA_WIFI_3_0_ADRASTEA)
 static inline void *cnss_get_target_smem(void)
 {
 	return NULL;
 }
 #endif
 
-void hif_pci_route_target_interrupt(struct hif_pci_softc *sc)
-{
-	uint32_t target_cause0, target_cause1, target_cause2;
-	uint32_t *target_smem;
-	struct ol_softc *scn = sc->ol_sc;
-
-	target_smem = (uint32_t *)cnss_get_target_smem();
-	if (!target_smem)
-		return;
-
-	/* disable interrupts */
-	hif_write32_mb(sc->mem +
-		       A_SOC_CORE_SCRATCH_0_ADDRESS, 0);
-	hif_write32_mb(sc->mem +
-		       A_SOC_CORE_SCRATCH_1_ADDRESS, 0);
-	hif_write32_mb(sc->mem +
-		       A_SOC_CORE_SCRATCH_2_ADDRESS, 0);
-	/* read cause */
-	target_cause0 = hif_read32_mb(sc->mem +
-				      A_SOC_CORE_SCRATCH_3_ADDRESS);
-	target_cause1 = hif_read32_mb(sc->mem +
-				      A_SOC_CORE_SCRATCH_4_ADDRESS);
-	target_cause2 = hif_read32_mb(sc->mem +
-				      A_SOC_CORE_SCRATCH_5_ADDRESS);
-	/* clear cause registers */
-	hif_write32_mb(sc->mem +
-		       A_SOC_CORE_SCRATCH_3_ADDRESS, 0xffffffff);
-	hif_write32_mb(sc->mem +
-		       A_SOC_CORE_SCRATCH_4_ADDRESS, 0xffffffff);
-	hif_write32_mb(sc->mem +
-		       A_SOC_CORE_SCRATCH_5_ADDRESS, 0xffffffff);
-	hif_write32_mb(sc->mem +
-		       A_SOC_CORE_SCRATCH_3_ADDRESS, 0);
-	hif_write32_mb(sc->mem +
-		       A_SOC_CORE_SCRATCH_4_ADDRESS, 0);
-	hif_write32_mb(sc->mem +
-		       A_SOC_CORE_SCRATCH_5_ADDRESS, 0);
-	/* copy cause value to Q6 */
-	*target_smem = target_cause0;
-	*(target_smem + 1) = target_cause1;
-	*(target_smem + 2) = target_cause2;
-	if (scn->notice_send)
-		cnss_intr_notify_q6();
-}
-
 #ifndef QCA_WIFI_3_0_ADRASTEA
 static inline void hif_pci_route_adrastea_interrupt(struct hif_pci_softc *sc)
 {
@@ -220,18 +177,6 @@ static irqreturn_t hif_pci_interrupt_handler(int irq, void *arg)
 		hif_write32_mb(sc->mem +
 			      (SOC_CORE_BASE_ADDRESS |
 			       PCIE_INTR_ENABLE_ADDRESS), 0);
-		if (IHELIUM_BU) {
-			if (!hif_read32_mb(sc->mem + PCIE_INTR_CAUSE_ADDRESS)) {
-				hif_pci_route_target_interrupt(sc);
-
-				hif_write32_mb(sc->mem +
-					       (SOC_CORE_BASE_ADDRESS |
-						PCIE_INTR_ENABLE_ADDRESS),
-					       HOST_GROUP0_MASK);
-
-				return IRQ_HANDLED;
-			}
-		}
 
 		hif_write32_mb(sc->mem +
 			      (SOC_CORE_BASE_ADDRESS | PCIE_INTR_CLR_ADDRESS),
@@ -850,7 +795,7 @@ static void wlan_tasklet(unsigned long data)
 	if (cdf_atomic_read(&scn->link_suspended))
 		goto end;
 
-	if (!IHELIUM_BU && !ADRASTEA_BU) {
+	if (!ADRASTEA_BU) {
 		(irqreturn_t) hif_fw_interrupt_handler(sc->irq_event, scn);
 		if (sc->ol_sc->target_status == OL_TRGET_STATUS_RESET)
 			goto end;
@@ -861,6 +806,342 @@ end:
 	cdf_atomic_dec(&scn->active_tasklet_cnt);
 }
 
+#ifdef FEATURE_RUNTIME_PM
+#define HIF_PCI_RUNTIME_PM_STATS(_s, _sc, _name) \
+	seq_printf(_s, "%30s: %u\n", #_name, _sc->pm_stats._name)
+
+/**
+ * hif_pci_runtime_pm_warn() - Runtime PM Debugging API
+ * @sc: hif_pci_softc context
+ * @msg: log message
+ *
+ * log runtime pm stats when something seems off.
+ *
+ * Return: void
+ */
+void hif_pci_runtime_pm_warn(struct hif_pci_softc *sc, const char *msg)
+{
+	struct hif_pm_runtime_lock *ctx;
+
+	HIF_ERROR("%s: usage_count: %d, pm_state: %d, prevent_suspend_cnt: %d",
+			msg, atomic_read(&sc->dev->power.usage_count),
+			atomic_read(&sc->pm_state),
+			sc->prevent_suspend_cnt);
+
+	HIF_ERROR("runtime_status: %d, runtime_error: %d, disable_depth: %d autosuspend_delay: %d",
+			sc->dev->power.runtime_status,
+			sc->dev->power.runtime_error,
+			sc->dev->power.disable_depth,
+			sc->dev->power.autosuspend_delay);
+
+	HIF_ERROR("runtime_get: %u, runtime_put: %u, request_resume: %u",
+			sc->pm_stats.runtime_get, sc->pm_stats.runtime_put,
+			sc->pm_stats.request_resume);
+
+	HIF_ERROR("allow_suspend: %u, prevent_suspend: %u",
+			sc->pm_stats.allow_suspend,
+			sc->pm_stats.prevent_suspend);
+
+	HIF_ERROR("prevent_suspend_timeout: %u, allow_suspend_timeout: %u",
+			sc->pm_stats.prevent_suspend_timeout,
+			sc->pm_stats.allow_suspend_timeout);
+
+	HIF_ERROR("Suspended: %u, resumed: %u count",
+			sc->pm_stats.suspended,
+			sc->pm_stats.resumed);
+
+	HIF_ERROR("suspend_err: %u, runtime_get_err: %u",
+			sc->pm_stats.suspend_err,
+			sc->pm_stats.runtime_get_err);
+
+	HIF_ERROR("Active Wakeup Sources preventing Runtime Suspend: ");
+
+	list_for_each_entry(ctx, &sc->prevent_suspend_list, list) {
+		HIF_ERROR("source %s; timeout %d ms", ctx->name, ctx->timeout);
+	}
+
+	WARN_ON(1);
+}
+
+/**
+ * hif_pci_pm_runtime_debugfs_show(): show debug stats for runtimepm
+ * @s: file to print to
+ * @data: unused
+ *
+ * debugging tool added to the debug fs for displaying runtimepm stats
+ *
+ * Return: 0
+ */
+static int hif_pci_pm_runtime_debugfs_show(struct seq_file *s, void *data)
+{
+	struct hif_pci_softc *sc = s->private;
+	static const char * const autopm_state[] = {"NONE", "ON", "INPROGRESS",
+		"SUSPENDED"};
+	unsigned int msecs_age;
+	int pm_state = atomic_read(&sc->pm_state);
+	unsigned long timer_expires, flags;
+	struct hif_pm_runtime_lock *ctx;
+
+	seq_printf(s, "%30s: %s\n", "Runtime PM state",
+			autopm_state[pm_state]);
+	seq_printf(s, "%30s: %pf\n", "Last Resume Caller",
+			sc->pm_stats.last_resume_caller);
+
+	if (pm_state == HIF_PM_RUNTIME_STATE_SUSPENDED) {
+		msecs_age = jiffies_to_msecs(
+				jiffies - sc->pm_stats.suspend_jiffies);
+		seq_printf(s, "%30s: %d.%03ds\n", "Suspended Since",
+				msecs_age / 1000, msecs_age % 1000);
+	}
+
+	seq_printf(s, "%30s: %d\n", "PM Usage count",
+			atomic_read(&sc->dev->power.usage_count));
+
+	seq_printf(s, "%30s: %u\n", "prevent_suspend_cnt",
+			sc->prevent_suspend_cnt);
+
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, suspended);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, suspend_err);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, resumed);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, runtime_get);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, runtime_put);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, request_resume);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, prevent_suspend);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, allow_suspend);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, prevent_suspend_timeout);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, allow_suspend_timeout);
+	HIF_PCI_RUNTIME_PM_STATS(s, sc, runtime_get_err);
+
+	timer_expires = sc->runtime_timer_expires;
+	if (timer_expires > 0) {
+		msecs_age = jiffies_to_msecs(timer_expires - jiffies);
+		seq_printf(s, "%30s: %d.%03ds\n", "Prevent suspend timeout",
+				msecs_age / 1000, msecs_age % 1000);
+	}
+
+	spin_lock_irqsave(&sc->runtime_lock, flags);
+	if (list_empty(&sc->prevent_suspend_list)) {
+		spin_unlock_irqrestore(&sc->runtime_lock, flags);
+		return 0;
+	}
+
+	seq_printf(s, "%30s: ", "Active Wakeup_Sources");
+	list_for_each_entry(ctx, &sc->prevent_suspend_list, list) {
+		seq_printf(s, "%s", ctx->name);
+		if (ctx->timeout)
+			seq_printf(s, "(%d ms)", ctx->timeout);
+		seq_puts(s, " ");
+	}
+	seq_puts(s, "\n");
+	spin_unlock_irqrestore(&sc->runtime_lock, flags);
+
+	return 0;
+}
+#undef HIF_PCI_RUNTIME_PM_STATS
+
+/**
+ * hif_pci_autopm_open() - open a debug fs file to access the runtime pm stats
+ * @inode
+ * @file
+ *
+ * Return: linux error code of single_open.
+ */
+static int hif_pci_runtime_pm_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, hif_pci_pm_runtime_debugfs_show,
+			inode->i_private);
+}
+
+#ifdef WLAN_OPEN_SOURCE
+static const struct file_operations hif_pci_runtime_pm_fops = {
+	.owner          = THIS_MODULE,
+	.open           = hif_pci_runtime_pm_open,
+	.release        = single_release,
+	.read           = seq_read,
+	.llseek         = seq_lseek,
+};
+
+/**
+ * hif_runtime_pm_debugfs_create() - creates runtimepm debugfs entry
+ * @sc: pci context
+ *
+ * creates a debugfs entry to debug the runtime pm feature.
+ */
+static void hif_runtime_pm_debugfs_create(struct hif_pci_softc *sc)
+{
+	sc->pm_dentry = debugfs_create_file("cnss_runtime_pm",
+					S_IRUSR, NULL, sc,
+					&hif_pci_runtime_pm_fops);
+}
+/**
+ * hif_runtime_pm_debugfs_remove() - removes runtimepm debugfs entry
+ * @sc: pci context
+ *
+ * removes the debugfs entry to debug the runtime pm feature.
+ */
+static void hif_runtime_pm_debugfs_remove(struct hif_pci_softc *sc)
+{
+	debugfs_remove(sc->pm_dentry);
+}
+#else
+static inline void hif_runtime_pm_debugfs_create(struct hif_pci_softc *sc)
+{
+}
+static inline void hif_runtime_pm_debugfs_remove(struct hif_pci_softc *sc)
+{
+}
+#endif
+
+static void hif_pm_runtime_lock_timeout_fn(unsigned long data);
+
+/**
+ * hif_pm_runtime_start(): start the runtime pm
+ * @sc: pci context
+ *
+ * After this call, runtime pm will be active.
+ */
+static void hif_pm_runtime_start(struct hif_pci_softc *sc)
+{
+	struct ol_softc *ol_sc;
+
+	ol_sc = sc->ol_sc;
+
+	if (!ol_sc->enable_runtime_pm) {
+		HIF_INFO("%s: RUNTIME PM is disabled in ini\n", __func__);
+		return;
+	}
+
+	if (cds_get_conparam() == CDF_FTM_MODE ||
+			WLAN_IS_EPPING_ENABLED(cds_get_conparam())) {
+		HIF_INFO("%s: RUNTIME PM is disabled for FTM/EPPING mode\n",
+				__func__);
+		return;
+	}
+
+	setup_timer(&sc->runtime_timer, hif_pm_runtime_lock_timeout_fn,
+			(unsigned long)sc);
+
+	HIF_INFO("%s: Enabling RUNTIME PM, Delay: %d ms", __func__,
+			ol_sc->runtime_pm_delay);
+
+	cnss_runtime_init(sc->dev, ol_sc->runtime_pm_delay);
+	cdf_atomic_set(&sc->pm_state, HIF_PM_RUNTIME_STATE_ON);
+	hif_runtime_pm_debugfs_create(sc);
+}
+
+/**
+ * hif_pm_runtime_stop(): stop runtime pm
+ * @sc: pci context
+ *
+ * Turns off runtime pm and frees corresponding resources
+ * that were acquired by hif_runtime_pm_start().
+ */
+static void hif_pm_runtime_stop(struct hif_pci_softc *sc)
+{
+	struct ol_softc *ol_sc = sc->ol_sc;
+
+	if (!ol_sc->enable_runtime_pm)
+		return;
+
+	if (cds_get_conparam() == CDF_FTM_MODE ||
+			WLAN_IS_EPPING_ENABLED(cds_get_conparam()))
+		return;
+
+	cnss_runtime_exit(sc->dev);
+	cnss_pm_runtime_request(sc->dev, CNSS_PM_RUNTIME_RESUME);
+
+	cdf_atomic_set(&sc->pm_state, HIF_PM_RUNTIME_STATE_NONE);
+
+	hif_runtime_pm_debugfs_remove(sc);
+	del_timer_sync(&sc->runtime_timer);
+	/* doesn't wait for penting trafic unlike cld-2.0 */
+}
+
+/**
+ * hif_pm_runtime_open(): initialize runtime pm
+ * @sc: pci data structure
+ *
+ * Early initialization
+ */
+static void hif_pm_runtime_open(struct hif_pci_softc *sc)
+{
+	spin_lock_init(&sc->runtime_lock);
+
+	cdf_atomic_init(&sc->pm_state);
+	sc->prevent_linkdown_lock =
+		hif_runtime_lock_init("linkdown suspend disabled");
+	cdf_atomic_set(&sc->pm_state, HIF_PM_RUNTIME_STATE_NONE);
+	INIT_LIST_HEAD(&sc->prevent_suspend_list);
+}
+
+/**
+ * hif_pm_runtime_close(): close runtime pm
+ * @sc: pci bus handle
+ *
+ * ensure runtime_pm is stopped before closing the driver
+ */
+static void hif_pm_runtime_close(struct hif_pci_softc *sc)
+{
+	if (cdf_atomic_read(&sc->pm_state) == HIF_PM_RUNTIME_STATE_NONE)
+		return;
+	else
+		hif_pm_runtime_stop(sc);
+}
+
+
+#else
+
+static void hif_pm_runtime_close(struct hif_pci_softc *sc) {}
+static void hif_pm_runtime_open(struct hif_pci_softc *sc) {}
+static void hif_pm_runtime_start(struct hif_pci_softc *sc) {}
+static void hif_pm_runtime_stop(struct hif_pci_softc *sc) {}
+#endif
+
+/**
+ * hif_enable_power_management(): enable power management
+ * @hif_ctx: hif context
+ *
+ * Currently only does runtime pm.  Eventually this function could
+ * consolidate other power state features such as only letting
+ * the soc sleep after the driver finishes loading and re-enabling
+ * aspm (hif_enable_power_gating).
+ */
+void hif_enable_power_management(void *hif_ctx)
+{
+	struct hif_pci_softc *pci_ctx;
+
+	if (hif_ctx == NULL) {
+		HIF_ERROR("%s, hif_ctx null", __func__);
+		return;
+	}
+
+	pci_ctx = ((struct ol_softc *)hif_ctx)->hif_sc;
+
+	hif_pm_runtime_start(pci_ctx);
+}
+
+/**
+ * hif_disable_power_management(): disable power management
+ * @hif_ctx: hif context
+ *
+ * Currently disables runtime pm. Should be updated to behave
+ * if runtime pm is not started. Should be updated to take care
+ * of aspm and soc sleep for driver load.
+ */
+void hif_disable_power_management(void *hif_ctx)
+{
+	struct hif_pci_softc *pci_ctx;
+
+	if (hif_ctx == NULL) {
+		HIF_ERROR("%s, hif_ctx null", __func__);
+		return;
+	}
+
+	pci_ctx = ((struct ol_softc *)hif_ctx)->hif_sc;
+
+	hif_pm_runtime_stop(pci_ctx);
+}
+
 #define ATH_PCI_PROBE_RETRY_MAX 3
 /**
  * hif_bus_open(): hif_bus_open
@@ -881,6 +1162,9 @@ CDF_STATUS hif_bus_open(struct ol_softc *ol_sc, enum ath_hal_bus_type bus_type)
 	ol_sc->hif_sc = (void *)sc;
 	sc->ol_sc = ol_sc;
 	ol_sc->bus_type = bus_type;
+	hif_pm_runtime_open(sc);
+
+	cdf_spinlock_init(&ol_sc->irq_lock);
 
 	return CDF_STATUS_SUCCESS;
 }
@@ -901,6 +1185,8 @@ void hif_bus_close(struct ol_softc *ol_sc)
 	sc = ol_sc->hif_sc;
 	if (sc == NULL)
 		return;
+
+	hif_pm_runtime_close(sc);
 	cdf_mem_free(sc);
 	ol_sc->hif_sc = NULL;
 }
@@ -928,14 +1214,12 @@ int hif_enable_pci(struct hif_pci_softc *sc,
 	/* FIXME: temp. commenting out assign_resource
 	 * call for dev_attach to work on 2.6.38 kernel
 	 */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) && \
-    !defined(__LINUX_ARM_ARCH__)
+#if (!defined(__LINUX_ARM_ARCH__))
 	if (pci_assign_resource(pdev, BAR_NUM)) {
 		HIF_ERROR("%s: pci_assign_resource error", __func__);
 		return -EIO;
 	}
 #endif
-
 	if (pci_enable_device(pdev)) {
 		HIF_ERROR("%s: pci_enable_device error",
 			   __func__);
@@ -1362,6 +1646,30 @@ void hif_disable_bus(void *bdev)
 #define OL_ATH_PCI_PM_CONTROL 0x44
 
 #ifdef CONFIG_CNSS
+
+#ifdef RUNTIME_PM
+/**
+ * hif_runtime_prevent_linkdown() - prevent or allow a runtime pm from occuring
+ * @scn: hif context
+ * @flag: prevent linkdown if true otherwise allow
+ *
+ * this api should only be called as part of bus prevent linkdown
+ */
+static void hif_runtime_prevent_linkdown(struct ol_softc *scn, bool flag)
+{
+	struct hif_pci_softc *sc = scn->hif_sc;
+
+	if (flag)
+		hif_pm_runtime_prevent_suspend(scn, sc->prevent_linkdown_lock);
+	else
+		hif_pm_runtime_allow_suspend(scn, sc->prevent_linkdown_lock);
+}
+#else
+static void hif_runtime_prevent_linkdown(struct ol_softc *scn, bool flag)
+{
+}
+#endif
+
 /**
  * hif_bus_prevent_linkdown(): allow or permit linkdown
  * @flag: true prevents linkdown, false allows
@@ -1371,10 +1679,11 @@ void hif_disable_bus(void *bdev)
  *
  * Return: n/a
  */
-void hif_bus_prevent_linkdown(bool flag)
+void hif_bus_prevent_linkdown(struct ol_softc *scn, bool flag)
 {
 	HIF_ERROR("wlan: %s pcie power collapse",
 			(flag ? "disable" : "enable"));
+	hif_runtime_prevent_linkdown(scn, flag);
 	cnss_wlan_pm_control(flag);
 }
 #endif
@@ -1538,9 +1847,10 @@ static int hif_bus_resume_link_down(void)
 
 /**
  * hif_bus_suspend(): prepare hif for suspend
+ *
  * chose suspend type based on link suspend voting.
  *
- * Return: linux status
+ * Return: 0 for success and non-zero error code for failure
  */
 int hif_bus_suspend(void)
 {
@@ -1551,10 +1861,11 @@ int hif_bus_suspend(void)
 }
 
 /**
- * hif_bus_suspend(): prepare hif for suspend
+ * hif_bus_resume(): prepare hif for resume
+ *
  * chose suspend type based on link suspend voting.
  *
- * Return: linux status
+ * Return: 0 for success and non-zero error code for failure
  */
 int hif_bus_resume(void)
 {
@@ -1564,6 +1875,254 @@ int hif_bus_resume(void)
 		return hif_bus_resume_link_up();
 }
 
+#ifdef FEATURE_RUNTIME_PM
+/**
+ * __hif_runtime_pm_set_state(): utility function
+ * @state: state to set
+ *
+ * indexes into the runtime pm state and sets it.
+ */
+static void __hif_runtime_pm_set_state(enum hif_pm_runtime_state state)
+{
+	struct ol_softc *scn = cds_get_context(CDF_MODULE_ID_HIF);
+	struct hif_pci_softc *sc;
+
+	if (NULL == scn) {
+		HIF_ERROR("%s: HIF_CTX not initialized",
+		       __func__);
+		return;
+	}
+
+	sc = scn->hif_sc;
+	cdf_atomic_set(&sc->pm_state, state);
+
+}
+#endif
+
+#ifdef FEATURE_RUNTIME_PM
+/**
+ * hif_runtime_pm_set_state_inprogress(): adjust runtime pm state
+ *
+ * Notify hif that a runtime pm opperation has started
+ */
+static void hif_runtime_pm_set_state_inprogress(void)
+{
+	__hif_runtime_pm_set_state(HIF_PM_RUNTIME_STATE_INPROGRESS);
+}
+
+/**
+ * hif_runtime_pm_set_state_on():  adjust runtime pm state
+ *
+ * Notify hif that a the runtime pm state should be on
+ */
+static void hif_runtime_pm_set_state_on(void)
+{
+	__hif_runtime_pm_set_state(HIF_PM_RUNTIME_STATE_ON);
+}
+
+/**
+ * hif_runtime_pm_set_state_suspended():  adjust runtime pm state
+ *
+ * Notify hif that a runtime suspend attempt has been completed successfully
+ */
+static void hif_runtime_pm_set_state_suspended(void)
+{
+	__hif_runtime_pm_set_state(HIF_PM_RUNTIME_STATE_SUSPENDED);
+}
+
+static inline struct hif_pci_softc *get_sc(void)
+{
+	struct ol_softc *scn = cds_get_context(CDF_MODULE_ID_HIF);
+
+	if (NULL == scn) {
+		HIF_ERROR("%s: Could not disable ASPM scn is null",
+		       __func__);
+		return NULL;
+	}
+
+	return scn->hif_sc;
+}
+
+/**
+ * hif_log_runtime_suspend_success() - log a successful runtime suspend
+ */
+static void hif_log_runtime_suspend_success(void)
+{
+	struct hif_pci_softc *sc = get_sc();
+	if (sc == NULL)
+		return;
+
+	sc->pm_stats.suspended++;
+	sc->pm_stats.suspend_jiffies = jiffies;
+}
+
+/**
+ * hif_log_runtime_suspend_failure() - log a failed runtime suspend
+ *
+ * log a failed runtime suspend
+ * mark last busy to prevent immediate runtime suspend
+ */
+static void hif_log_runtime_suspend_failure(void)
+{
+	struct hif_pci_softc *sc = get_sc();
+	if (sc == NULL)
+		return;
+
+	sc->pm_stats.suspend_err++;
+}
+
+/**
+ * hif_log_runtime_resume_success() - log a successful runtime resume
+ *
+ * log a successfull runtime resume
+ * mark last busy to prevent immediate runtime suspend
+ */
+static void hif_log_runtime_resume_success(void)
+{
+	struct hif_pci_softc *sc = get_sc();
+	if (sc == NULL)
+		return;
+
+	sc->pm_stats.resumed++;
+}
+
+/**
+ * hif_process_runtime_suspend_failure() - bookkeeping of suspend failure
+ *
+ * Record the failure.
+ * mark last busy to delay a retry.
+ * adjust the runtime_pm state.
+ */
+void hif_process_runtime_suspend_failure(void)
+{
+	struct hif_pci_softc *sc = get_sc();
+
+	hif_log_runtime_suspend_failure();
+	if (sc != NULL)
+		hif_pm_runtime_mark_last_busy(sc->dev);
+	hif_runtime_pm_set_state_on();
+}
+
+/**
+ * hif_pre_runtime_suspend() - bookkeeping before beginning runtime suspend
+ *
+ * Makes sure that the pci link will be taken down by the suspend opperation.
+ * If the hif layer is configured to leave the bus on, runtime suspend will
+ * not save any power.
+ *
+ * Set the runtime suspend state to in progress.
+ *
+ * return -EINVAL if the bus won't go down.  otherwise return 0
+ */
+int hif_pre_runtime_suspend(void)
+{
+	if (!hif_can_suspend_link()) {
+		HIF_ERROR("Runtime PM not supported for link up suspend");
+		return -EINVAL;
+	}
+
+	hif_runtime_pm_set_state_inprogress();
+	return 0;
+}
+
+/**
+ * hif_process_runtime_suspend_success() - bookkeeping of suspend success
+ *
+ * Record the success.
+ * adjust the runtime_pm state
+ */
+void hif_process_runtime_suspend_success(void)
+{
+	hif_runtime_pm_set_state_suspended();
+	hif_log_runtime_suspend_success();
+}
+
+/**
+ * hif_pre_runtime_resume() - bookkeeping before beginning runtime resume
+ *
+ * update the runtime pm state.
+ */
+void hif_pre_runtime_resume(void)
+{
+	hif_runtime_pm_set_state_inprogress();
+}
+
+/**
+ * hif_process_runtime_resume_success() - bookkeeping after a runtime resume
+ *
+ * record the success.
+ * adjust the runtime_pm state
+ */
+void hif_process_runtime_resume_success(void)
+{
+	struct hif_pci_softc *sc = get_sc();
+
+	hif_log_runtime_resume_success();
+	if (sc != NULL)
+		hif_pm_runtime_mark_last_busy(sc->dev);
+	hif_runtime_pm_set_state_on();
+}
+#endif
+
+/**
+ * hif_runtime_suspend() - do the bus suspend part of a runtime suspend
+ *
+ * Return: 0 for success and non-zero error code for failure
+ */
+int hif_runtime_suspend(void)
+{
+	return hif_bus_suspend();
+}
+
+#ifdef WLAN_FEATURE_FASTPATH
+/**
+ * hif_fastpath_resume() - resume fastpath for runtimepm
+ *
+ * ensure that the fastpath write index register is up to date
+ * since runtime pm may cause ce_send_fast to skip the register
+ * write.
+ */
+static void hif_fastpath_resume(void)
+{
+	struct ol_softc *scn =
+		(struct ol_softc *)cds_get_context(CDF_MODULE_ID_HIF);
+	struct CE_state *ce_state;
+
+	if (!scn)
+		return;
+
+	if (scn->fastpath_mode_on) {
+		if (Q_TARGET_ACCESS_BEGIN(scn)) {
+			ce_state = scn->ce_id_to_state[CE_HTT_H2T_MSG];
+			cdf_spin_lock_bh(&ce_state->ce_index_lock);
+
+			/*war_ce_src_ring_write_idx_set */
+			CE_SRC_RING_WRITE_IDX_SET(scn, ce_state->ctrl_addr,
+					ce_state->src_ring->write_index);
+			cdf_spin_unlock_bh(&ce_state->ce_index_lock);
+			Q_TARGET_ACCESS_END(scn);
+		}
+	}
+}
+#else
+static void hif_fastpath_resume(void) {}
+#endif
+
+
+/**
+ * hif_runtime_resume() - do the bus resume part of a runtime resume
+ *
+ *  Return: 0 for success and non-zero error code for failure
+ */
+int hif_runtime_resume(void)
+{
+	int status = hif_bus_resume();
+
+	hif_fastpath_resume();
+
+	return status;
+}
+
 void hif_disable_isr(void *ol_sc)
 {
 	struct ol_softc *scn = (struct ol_softc *)ol_sc;
@@ -1824,7 +2383,7 @@ hif_target_sleep_state_adjust(struct ol_softc *scn,
 					if (!sc->ol_sc->enable_self_recovery)
 						CDF_BUG(0);
 					scn->recovery = true;
-					cds_set_logp_in_progress(true);
+					cds_set_recovery_in_progress(true);
 					cnss_wlan_pci_link_down();
 					return -EACCES;
 				}
@@ -2238,3 +2797,477 @@ int hif_get_target_type(struct ol_softc *ol_sc, struct device *dev,
 	return hif_get_device_type(id->device, revision_id,
 			hif_type, target_type);
 }
+
+#ifdef FEATURE_RUNTIME_PM
+
+void hif_pm_runtime_get_noresume(void *hif_ctx)
+{
+	struct ol_softc *scn = hif_ctx;
+	struct hif_pci_softc *sc;
+
+	if (NULL == scn)
+		return;
+
+	sc = scn->hif_sc;
+	if (NULL == sc)
+		return;
+
+	sc->pm_stats.runtime_get++;
+	pm_runtime_get_noresume(sc->dev);
+}
+
+/**
+ * hif_pm_runtime_get() - do a get opperation on the device
+ *
+ * A get opperation will prevent a runtime suspend untill a
+ * corresponding put is done.  This api should be used when sending
+ * data.
+ *
+ * CONTRARY TO THE REGULAR RUNTIME PM, WHEN THE BUS IS SUSPENDED,
+ * THIS API WILL ONLY REQUEST THE RESUME AND NOT TO A GET!!!
+ *
+ * return: success if the bus is up and a get has been issued
+ *   otherwise an error code.
+ */
+int hif_pm_runtime_get(void *hif_ctx)
+{
+	struct ol_softc *scn = hif_ctx;
+	struct hif_pci_softc *sc;
+	int ret;
+	int pm_state;
+
+	if (NULL == scn) {
+		HIF_ERROR("%s: Could not do runtime get, scn is null",
+				__func__);
+		return -EFAULT;
+	}
+	sc = scn->hif_sc;
+
+	pm_state = cdf_atomic_read(&sc->pm_state);
+
+	if (pm_state  == HIF_PM_RUNTIME_STATE_ON ||
+			pm_state == HIF_PM_RUNTIME_STATE_NONE) {
+		sc->pm_stats.runtime_get++;
+		ret = __hif_pm_runtime_get(sc->dev);
+
+		/* Get can return 1 if the device is already active, just return
+		 * success in that case
+		 */
+		if (ret > 0)
+			ret = 0;
+
+		if (ret)
+			hif_pm_runtime_put(hif_ctx);
+
+		if (ret && ret != -EINPROGRESS) {
+			sc->pm_stats.runtime_get_err++;
+			HIF_ERROR("%s: Runtime Get PM Error in pm_state:%d ret: %d",
+				__func__, cdf_atomic_read(&sc->pm_state), ret);
+		}
+
+		return ret;
+	}
+
+	sc->pm_stats.request_resume++;
+	sc->pm_stats.last_resume_caller = (void *)_RET_IP_;
+	ret = hif_pm_request_resume(sc->dev);
+
+	return -EAGAIN;
+}
+
+/**
+ * hif_pm_runtime_put() - do a put opperation on the device
+ *
+ * A put opperation will allow a runtime suspend after a corresponding
+ * get was done.  This api should be used when sending data.
+ *
+ * This api will return a failure if runtime pm is stopped
+ * This api will return failure if it would decrement the usage count below 0.
+ *
+ * return: CDF_STATUS_SUCCESS if the put is performed
+ */
+int hif_pm_runtime_put(void *hif_ctx)
+{
+	struct ol_softc *scn = (struct ol_softc *)hif_ctx;
+	struct hif_pci_softc *sc;
+	int pm_state, usage_count;
+	unsigned long flags;
+	char *error = NULL;
+
+	if (NULL == scn) {
+		HIF_ERROR("%s: Could not do runtime put, scn is null",
+				__func__);
+		return -EFAULT;
+	}
+	sc = scn->hif_sc;
+
+	usage_count = atomic_read(&sc->dev->power.usage_count);
+
+	if (usage_count == 1) {
+		pm_state = cdf_atomic_read(&sc->pm_state);
+
+		if (pm_state == HIF_PM_RUNTIME_STATE_NONE)
+			error = "Ignoring unexpected put when runtime pm is disabled";
+
+	} else if (usage_count == 0) {
+		error = "PUT Without a Get Operation";
+	}
+
+	if (error) {
+		spin_lock_irqsave(&sc->runtime_lock, flags);
+		hif_pci_runtime_pm_warn(sc, error);
+		spin_unlock_irqrestore(&sc->runtime_lock, flags);
+		return -EINVAL;
+	}
+
+	sc->pm_stats.runtime_put++;
+
+	hif_pm_runtime_mark_last_busy(sc->dev);
+	hif_pm_runtime_put_auto(sc->dev);
+
+	return 0;
+}
+
+
+/**
+ * __hif_pm_runtime_prevent_suspend() - prevent runtime suspend for a protocol reason
+ * @hif_sc: pci context
+ * @lock: runtime_pm lock being acquired
+ *
+ * Return 0 if successful.
+ */
+static int __hif_pm_runtime_prevent_suspend(struct hif_pci_softc
+		*hif_sc, struct hif_pm_runtime_lock *lock)
+{
+	int ret = 0;
+
+	/*
+	 * We shouldn't be setting context->timeout to zero here when
+	 * context is active as we will have a case where Timeout API's
+	 * for the same context called back to back.
+	 * eg: echo "1=T:10:T:20" > /d/cnss_runtime_pm
+	 * Set context->timeout to zero in hif_pm_runtime_prevent_suspend
+	 * API to ensure the timeout version is no more active and
+	 * list entry of this context will be deleted during allow suspend.
+	 */
+	if (lock->active)
+		return 0;
+
+	ret = __hif_pm_runtime_get(hif_sc->dev);
+
+	/**
+	 * The ret can be -EINPROGRESS, if Runtime status is RPM_RESUMING or
+	 * RPM_SUSPENDING. Any other negative value is an error.
+	 * We shouldn't be do runtime_put here as in later point allow
+	 * suspend gets called with the the context and there the usage count
+	 * is decremented, so suspend will be prevented.
+	 */
+
+	if (ret < 0 && ret != -EINPROGRESS) {
+		hif_sc->pm_stats.runtime_get_err++;
+		hif_pci_runtime_pm_warn(hif_sc,
+				"Prevent Suspend Runtime PM Error");
+	}
+
+	hif_sc->prevent_suspend_cnt++;
+
+	lock->active = true;
+
+	list_add_tail(&lock->list, &hif_sc->prevent_suspend_list);
+
+	hif_sc->pm_stats.prevent_suspend++;
+
+	HIF_ERROR("%s: in pm_state:%d ret: %d", __func__,
+			cdf_atomic_read(&hif_sc->pm_state), ret);
+
+	return ret;
+}
+
+static int __hif_pm_runtime_allow_suspend(struct hif_pci_softc *hif_sc,
+		struct hif_pm_runtime_lock *lock)
+{
+	int ret = 0;
+	int usage_count;
+
+	if (hif_sc->prevent_suspend_cnt == 0)
+		return ret;
+
+	if (!lock->active)
+		return ret;
+
+	usage_count = atomic_read(&hif_sc->dev->power.usage_count);
+
+	/*
+	 * During Driver unload, platform driver increments the usage
+	 * count to prevent any runtime suspend getting called.
+	 * So during driver load in HIF_PM_RUNTIME_STATE_NONE state the
+	 * usage_count should be one. Ideally this shouldn't happen as
+	 * context->active should be active for allow suspend to happen
+	 * Handling this case here to prevent any failures.
+	 */
+	if ((cdf_atomic_read(&hif_sc->pm_state) == HIF_PM_RUNTIME_STATE_NONE
+				&& usage_count == 1) || usage_count == 0) {
+		hif_pci_runtime_pm_warn(hif_sc,
+				"Allow without a prevent suspend");
+		return -EINVAL;
+	}
+
+	list_del(&lock->list);
+
+	hif_sc->prevent_suspend_cnt--;
+
+	lock->active = false;
+	lock->timeout = 0;
+
+	hif_pm_runtime_mark_last_busy(hif_sc->dev);
+	ret = hif_pm_runtime_put_auto(hif_sc->dev);
+
+	HIF_ERROR("%s: in pm_state:%d ret: %d", __func__,
+			cdf_atomic_read(&hif_sc->pm_state), ret);
+
+	hif_sc->pm_stats.allow_suspend++;
+	return ret;
+}
+
+/**
+ * hif_pm_runtime_lock_timeout_fn() - callback the runtime lock timeout
+ * @data: calback data that is the pci context
+ *
+ * if runtime locks are aquired with a timeout, this function releases
+ * the locks when the last runtime lock expires.
+ *
+ * dummy implementation until lock acquisition is implemented.
+ */
+static void hif_pm_runtime_lock_timeout_fn(unsigned long data)
+{
+	struct hif_pci_softc *hif_sc = (struct hif_pci_softc *)data;
+	unsigned long flags;
+	unsigned long timer_expires;
+	struct hif_pm_runtime_lock *context, *temp;
+
+	spin_lock_irqsave(&hif_sc->runtime_lock, flags);
+
+	timer_expires = hif_sc->runtime_timer_expires;
+
+	/* Make sure we are not called too early, this should take care of
+	 * following case
+	 *
+	 * CPU0                         CPU1 (timeout function)
+	 * ----                         ----------------------
+	 * spin_lock_irq
+	 *                              timeout function called
+	 *
+	 * mod_timer()
+	 *
+	 * spin_unlock_irq
+	 *                              spin_lock_irq
+	 */
+	if (timer_expires > 0 && !time_after(timer_expires, jiffies)) {
+		hif_sc->runtime_timer_expires = 0;
+		list_for_each_entry_safe(context, temp,
+				&hif_sc->prevent_suspend_list, list) {
+			if (context->timeout) {
+				__hif_pm_runtime_allow_suspend(hif_sc, context);
+				hif_sc->pm_stats.allow_suspend_timeout++;
+			}
+		}
+	}
+
+	spin_unlock_irqrestore(&hif_sc->runtime_lock, flags);
+}
+
+int hif_pm_runtime_prevent_suspend(void *ol_sc,
+		struct hif_pm_runtime_lock *data)
+{
+	struct ol_softc *sc = (struct ol_softc *)ol_sc;
+	struct hif_pci_softc *hif_sc = sc->hif_sc;
+	struct hif_pm_runtime_lock *context = data;
+	unsigned long flags;
+
+	if (!sc->enable_runtime_pm)
+		return 0;
+
+	if (!context)
+		return -EINVAL;
+
+	spin_lock_irqsave(&hif_sc->runtime_lock, flags);
+	context->timeout = 0;
+	__hif_pm_runtime_prevent_suspend(hif_sc, context);
+	spin_unlock_irqrestore(&hif_sc->runtime_lock, flags);
+
+	return 0;
+}
+
+int hif_pm_runtime_allow_suspend(void *ol_sc, struct hif_pm_runtime_lock *data)
+{
+	struct ol_softc *sc = (struct ol_softc *)ol_sc;
+	struct hif_pci_softc *hif_sc = sc->hif_sc;
+	struct hif_pm_runtime_lock *context = data;
+
+	unsigned long flags;
+
+	if (!sc->enable_runtime_pm)
+		return 0;
+
+	if (!context)
+		return -EINVAL;
+
+	spin_lock_irqsave(&hif_sc->runtime_lock, flags);
+
+	__hif_pm_runtime_allow_suspend(hif_sc, context);
+
+	/* The list can be empty as well in cases where
+	 * we have one context in the list and the allow
+	 * suspend came before the timer expires and we delete
+	 * context above from the list.
+	 * When list is empty prevent_suspend count will be zero.
+	 */
+	if (hif_sc->prevent_suspend_cnt == 0 &&
+			hif_sc->runtime_timer_expires > 0) {
+		del_timer(&hif_sc->runtime_timer);
+		hif_sc->runtime_timer_expires = 0;
+	}
+
+	spin_unlock_irqrestore(&hif_sc->runtime_lock, flags);
+
+	return 0;
+}
+
+/**
+ * hif_pm_runtime_prevent_suspend_timeout() - Prevent runtime suspend timeout
+ * @ol_sc: HIF context
+ * @lock: which lock is being acquired
+ * @delay: Timeout in milliseconds
+ *
+ * Prevent runtime suspend with a timeout after which runtime suspend would be
+ * allowed. This API uses a single timer to allow the suspend and timer is
+ * modified if the timeout is changed before timer fires.
+ * If the timeout is less than autosuspend_delay then use mark_last_busy instead
+ * of starting the timer.
+ *
+ * It is wise to try not to use this API and correct the design if possible.
+ *
+ * Return: 0 on success and negative error code on failure
+ */
+int hif_pm_runtime_prevent_suspend_timeout(void *ol_sc,
+		struct hif_pm_runtime_lock *lock, unsigned int delay)
+{
+	struct ol_softc *sc = (struct ol_softc *)ol_sc;
+	struct hif_pci_softc *hif_sc = sc->hif_sc;
+	int ret = 0;
+	unsigned long expires;
+	unsigned long flags;
+	struct hif_pm_runtime_lock *context = lock;
+
+	if (cds_is_load_unload_in_progress()) {
+		HIF_ERROR("%s: Load/unload in progress, ignore!",
+				__func__);
+		return -EINVAL;
+	}
+
+	if (cds_is_logp_in_progress()) {
+		HIF_ERROR("%s: LOGP in progress, ignore!", __func__);
+		return -EINVAL;
+	}
+
+	if (!sc->enable_runtime_pm)
+		return 0;
+
+	if (!context)
+		return -EINVAL;
+
+	/*
+	 * Don't use internal timer if the timeout is less than auto suspend
+	 * delay.
+	 */
+	if (delay <= hif_sc->dev->power.autosuspend_delay) {
+		hif_pm_request_resume(hif_sc->dev);
+		hif_pm_runtime_mark_last_busy(hif_sc->dev);
+		return ret;
+	}
+
+	expires = jiffies + msecs_to_jiffies(delay);
+	expires += !expires;
+
+	spin_lock_irqsave(&hif_sc->runtime_lock, flags);
+
+	context->timeout = delay;
+	ret = __hif_pm_runtime_prevent_suspend(hif_sc, context);
+	hif_sc->pm_stats.prevent_suspend_timeout++;
+
+	/* Modify the timer only if new timeout is after already configured
+	 * timeout
+	 */
+	if (time_after(expires, hif_sc->runtime_timer_expires)) {
+		mod_timer(&hif_sc->runtime_timer, expires);
+		hif_sc->runtime_timer_expires = expires;
+	}
+
+	spin_unlock_irqrestore(&hif_sc->runtime_lock, flags);
+
+	HIF_ERROR("%s: pm_state: %d delay: %dms ret: %d\n", __func__,
+			cdf_atomic_read(&hif_sc->pm_state), delay, ret);
+
+	return ret;
+}
+
+/**
+ * hif_runtime_lock_init() - API to initialize Runtime PM context
+ * @name: Context name
+ *
+ * This API initalizes the Runtime PM context of the caller and
+ * return the pointer.
+ *
+ * Return: void *
+ */
+struct hif_pm_runtime_lock *hif_runtime_lock_init(const char *name)
+{
+	struct hif_pm_runtime_lock *context;
+
+	context = cdf_mem_malloc(sizeof(*context));
+	if (!context) {
+		HIF_ERROR("%s: No memory for Runtime PM wakelock context\n",
+				__func__);
+		return NULL;
+	}
+
+	context->name = name ? name : "Default";
+	return context;
+}
+
+/**
+ * hif_runtime_lock_deinit() - This API frees the runtime pm ctx
+ * @data: Runtime PM context
+ *
+ * Return: void
+ */
+void hif_runtime_lock_deinit(struct hif_pm_runtime_lock *data)
+{
+	unsigned long flags;
+	struct hif_pm_runtime_lock *context = data;
+	struct ol_softc *scn = cds_get_context(CDF_MODULE_ID_HIF);
+	struct hif_pci_softc *sc;
+
+	if (!scn)
+		return;
+
+	sc = scn->hif_sc;
+
+	if (!sc)
+		return;
+
+	if (!context)
+		return;
+
+	/*
+	 * Ensure to delete the context list entry and reduce the usage count
+	 * before freeing the context if context is active.
+	 */
+	spin_lock_irqsave(&sc->runtime_lock, flags);
+	__hif_pm_runtime_allow_suspend(sc, context);
+	spin_unlock_irqrestore(&sc->runtime_lock, flags);
+
+	cdf_mem_free(context);
+}
+
+#endif /* FEATURE_RUNTIME_PM */
diff --git a/core/hif/src/pcie/if_pci.h b/core/hif/src/pcie/if_pci.h
index b2f5bd6c20a2..806f91aadb8a 100644
--- a/core/hif/src/pcie/if_pci.h
+++ b/core/hif/src/pcie/if_pci.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -50,6 +50,54 @@ struct hif_tasklet_entry {
 	uint8_t id;        /* 0 - 9: maps to CE, 10: fw */
 	void *hif_handler; /* struct hif_pci_softc */
 };
+
+/**
+ * enum hif_pm_runtime_state - Driver States for Runtime Power Management
+ * HIF_PM_RUNTIME_STATE_NONE: runtime pm is off
+ * HIF_PM_RUNTIME_STATE_ON: runtime pm is active and link is active
+ * HIF_PM_RUNTIME_STATE_INPROGRESS: a runtime suspend or resume is in progress
+ * HIF_PM_RUNTIME_STATE_SUSPENDED: the driver is runtime suspended
+ */
+enum hif_pm_runtime_state {
+	HIF_PM_RUNTIME_STATE_NONE,
+	HIF_PM_RUNTIME_STATE_ON,
+	HIF_PM_RUNTIME_STATE_INPROGRESS,
+	HIF_PM_RUNTIME_STATE_SUSPENDED,
+};
+
+#ifdef FEATURE_RUNTIME_PM
+
+/**
+ * struct hif_pm_runtime_lock - data structure for preventing runtime suspend
+ * @list - global list of runtime locks
+ * @active - true if this lock is preventing suspend
+ * @name - character string for tracking this lock
+ */
+struct hif_pm_runtime_lock {
+	struct list_head list;
+	bool active;
+	uint32_t timeout;
+	const char *name;
+};
+
+/* Debugging stats for Runtime PM */
+struct hif_pci_pm_stats {
+	u32 suspended;
+	u32 suspend_err;
+	u32 resumed;
+	u32 runtime_get;
+	u32 runtime_put;
+	u32 request_resume;
+	u32 allow_suspend;
+	u32 prevent_suspend;
+	u32 prevent_suspend_timeout;
+	u32 allow_suspend_timeout;
+	u32 runtime_get_err;
+	void *last_resume_caller;
+	unsigned long suspend_jiffies;
+};
+#endif
+
 struct hif_pci_softc {
 	void __iomem *mem;      /* PCI address. */
 	/* For efficiency, should be first in struct */
@@ -69,6 +117,20 @@ struct hif_pci_softc {
 	cdf_dma_addr_t soc_pcie_bar0;
 	struct hif_tasklet_entry tasklet_entries[HIF_MAX_TASKLET_NUM];
 	bool pci_enabled;
+#ifdef FEATURE_RUNTIME_PM
+	atomic_t pm_state;
+	uint32_t prevent_suspend_cnt;
+	struct hif_pci_pm_stats pm_stats;
+	struct work_struct pm_work;
+	spinlock_t runtime_lock;
+	struct timer_list runtime_timer;
+	struct list_head prevent_suspend_list;
+	unsigned long runtime_timer_expires;
+	struct hif_pm_runtime_lock *prevent_linkdown_lock;
+#ifdef WLAN_OPEN_SOURCE
+	struct dentry *pm_dentry;
+#endif
+#endif
 };
 
 bool hif_pci_targ_is_present(struct ol_softc *scn, void *__iomem *mem);
@@ -112,4 +174,61 @@ void hif_pci_cancel_deferred_target_sleep(struct ol_softc *scn);
 #endif
 
 #define HIF_CE_DRAIN_WAIT_CNT          20
+
+
+#ifdef FEATURE_RUNTIME_PM
+#include <linux/pm_runtime.h>
+
+#ifdef WLAN_OPEN_SOURCE
+static inline int hif_pm_request_resume(struct device *dev)
+{
+	return pm_request_resume(dev);
+}
+static inline int __hif_pm_runtime_get(struct device *dev)
+{
+	return pm_runtime_get(dev);
+}
+
+static inline int hif_pm_runtime_put_auto(struct device *dev)
+{
+	return pm_runtime_put_autosuspend(dev);
+}
+
+static inline void hif_pm_runtime_mark_last_busy(struct device *dev)
+{
+	pm_runtime_mark_last_busy(dev);
+}
+
+static inline int hif_pm_runtime_resume(struct device *dev)
+{
+	return pm_runtime_resume(dev);
+}
+#else
+static inline int hif_pm_request_resume(struct device *dev)
+{
+	return cnss_pm_runtime_request(dev, CNSS_PM_REQUEST_RESUME);
+}
+
+static inline int __hif_pm_runtime_get(struct device *dev)
+{
+	return cnss_pm_runtime_request(dev, CNSS_PM_RUNTIME_GET);
+}
+
+static inline int hif_pm_runtime_put_auto(struct device *dev)
+{
+	return cnss_pm_runtime_request(dev, CNSS_PM_RUNTIME_PUT_AUTO);
+}
+
+static inline void hif_pm_runtime_mark_last_busy(struct device *dev)
+{
+	cnss_pm_runtime_request(dev, CNSS_PM_RUNTIME_MARK_LAST_BUSY);
+}
+static inline int hif_pm_runtime_resume(struct device *dev)
+{
+	return cnss_pm_runtime_request(dev, CNSS_PM_RUNTIME_RESUME);
+}
+#endif /* WLAN_OPEN_SOURCE */
+#else
+static inline void hif_pm_runtime_mark_last_busy(struct device *dev) { }
+#endif /* FEATURE_RUNTIME_PM */
 #endif /* __ATH_PCI_H__ */
diff --git a/core/hif/src/pcie/if_pci_internal.h b/core/hif/src/pcie/if_pci_internal.h
index e5f28d2b2774..5ea8e31481fb 100644
--- a/core/hif/src/pcie/if_pci_internal.h
+++ b/core/hif/src/pcie/if_pci_internal.h
@@ -97,7 +97,7 @@
 { \
 	ol_txrx_pdev_handle pdev_txrx_handle; \
 	pdev_txrx_handle = cds_get_context(CDF_MODULE_ID_TXRX); \
-	if (cds_get_conparam() != CDF_FTM_MODE && \
+	if (cds_get_conparam() != CDF_GLOBAL_FTM_MODE && \
 	    !WLAN_IS_EPPING_ENABLED(cds_get_conparam())) { \
 		ol_pl_sethandle(&pdev_txrx_handle->pl_dev, ol_sc); \
 		if (pktlogmod_init(ol_sc)) \
diff --git a/core/hif/src/snoc/if_snoc.c b/core/hif/src/snoc/if_snoc.c
index f9fa886ce12a..c71bd5f16354 100644
--- a/core/hif/src/snoc/if_snoc.c
+++ b/core/hif/src/snoc/if_snoc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -47,7 +47,7 @@
  * This is duplicated here because CONFIG_CNSS can be defined
  * even though it is not used for the snoc bus.
  */
-void hif_bus_prevent_linkdown(bool flag)
+void hif_bus_prevent_linkdown(struct ol_softc *scn, bool flag)
 {
 	HIF_ERROR("wlan: %s pcie power collapse ignored",
 			(flag ? "disable" : "enable"));
diff --git a/core/htc/htc.c b/core/htc/htc.c
index a22244f0f21a..d065193da3b7 100644
--- a/core/htc/htc.c
+++ b/core/htc/htc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -34,6 +34,7 @@
 #include "epping_main.h"
 #include "hif_io32.h"
 #include "cds_concurrency.h"
+#include <cds_api.h>
 
 #ifdef DEBUG
 static ATH_DEBUG_MASK_DESCRIPTION g_htc_debug_description[] = {
@@ -214,6 +215,7 @@ HTC_HANDLE htc_create(void *ol_sc, HTC_INIT_INFO *pInfo, cdf_device_t osdev)
 
 	A_MEMZERO(target, sizeof(HTC_TARGET));
 
+	htc_runtime_pm_init(target);
 	cdf_spinlock_init(&target->HTCLock);
 	cdf_spinlock_init(&target->HTCRxLock);
 	cdf_spinlock_init(&target->HTCTxLock);
@@ -257,7 +259,7 @@ HTC_HANDLE htc_create(void *ol_sc, HTC_INIT_INFO *pInfo, cdf_device_t osdev)
 		target->hif_dev = ol_sc;
 
 		/* Get HIF default pipe for HTC message exchange */
-		pEndpoint = &target->EndPoint[ENDPOINT_0];
+		pEndpoint = &target->endpoint[ENDPOINT_0];
 
 		hif_post_init(target->hif_dev, target, &htcCallbacks);
 		hif_get_default_pipe(target->hif_dev, &pEndpoint->UL_PipeID,
@@ -333,7 +335,7 @@ A_STATUS htc_setup_target_buffer_assignments(HTC_TARGET *target)
 	 */
 	status = A_OK;
 	pEntry++;
-	pEntry->ServiceID = WMI_CONTROL_SVC;
+	pEntry->service_id = WMI_CONTROL_SVC;
 	pEntry->CreditAllocation = credits;
 
 	if (WLAN_IS_EPPING_ENABLED(cds_get_conparam())) {
@@ -360,23 +362,23 @@ A_STATUS htc_setup_target_buffer_assignments(HTC_TARGET *target)
 		 * BE and BK services to stress the bus so that the total credits
 		 * are equally distributed to BE and BK services.
 		 */
-		pEntry->ServiceID = WMI_DATA_BE_SVC;
+		pEntry->service_id = WMI_DATA_BE_SVC;
 		pEntry->CreditAllocation = (credits >> 1);
 
 		pEntry++;
-		pEntry->ServiceID = WMI_DATA_BK_SVC;
+		pEntry->service_id = WMI_DATA_BK_SVC;
 		pEntry->CreditAllocation = (credits >> 1);
 	}
 
 	if (A_SUCCESS(status)) {
 		int i;
 		for (i = 0; i < HTC_MAX_SERVICE_ALLOC_ENTRIES; i++) {
-			if (target->ServiceTxAllocTable[i].ServiceID != 0) {
+			if (target->ServiceTxAllocTable[i].service_id != 0) {
 				AR_DEBUG_PRINTF(ATH_DEBUG_INIT,
-						("HTC Service Index : %d TX : 0x%2.2X : alloc:%d \n",
+						("HTC Service Index : %d TX : 0x%2.2X : alloc:%d\n",
 						 i,
 						 target->ServiceTxAllocTable[i].
-						 ServiceID,
+						 service_id,
 						 target->ServiceTxAllocTable[i].
 						 CreditAllocation));
 			}
@@ -386,13 +388,13 @@ A_STATUS htc_setup_target_buffer_assignments(HTC_TARGET *target)
 	return status;
 }
 
-A_UINT8 htc_get_credit_allocation(HTC_TARGET *target, A_UINT16 ServiceID)
+A_UINT8 htc_get_credit_allocation(HTC_TARGET *target, A_UINT16 service_id)
 {
 	A_UINT8 allocation = 0;
 	int i;
 
 	for (i = 0; i < HTC_MAX_SERVICE_ALLOC_ENTRIES; i++) {
-		if (target->ServiceTxAllocTable[i].ServiceID == ServiceID) {
+		if (target->ServiceTxAllocTable[i].service_id == service_id) {
 			allocation =
 				target->ServiceTxAllocTable[i].CreditAllocation;
 		}
@@ -400,8 +402,8 @@ A_UINT8 htc_get_credit_allocation(HTC_TARGET *target, A_UINT16 ServiceID)
 
 	if (0 == allocation) {
 		AR_DEBUG_PRINTF(ATH_DEBUG_INIT,
-				("HTC Service TX : 0x%2.2X : allocation is zero! \n",
-				 ServiceID));
+			("HTC Service TX : 0x%2.2X : allocation is zero!\n",
+				 service_id));
 	}
 
 	return allocation;
@@ -490,7 +492,7 @@ A_STATUS htc_wait_target(HTC_HANDLE HTCHandle)
 		connect.EpCallbacks.EpTxComplete = htc_control_tx_complete;
 		connect.EpCallbacks.EpRecv = htc_control_rx_complete;
 		connect.MaxSendQueueDepth = NUM_CONTROL_TX_BUFFERS;
-		connect.ServiceID = HTC_CTRL_RSVD_SVC;
+		connect.service_id = HTC_CTRL_RSVD_SVC;
 
 		/* connect fake service */
 		status = htc_connect_service((HTC_HANDLE) target,
@@ -516,8 +518,8 @@ static void reset_endpoint_states(HTC_TARGET *target)
 	int i;
 
 	for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
-		pEndpoint = &target->EndPoint[i];
-		pEndpoint->ServiceID = 0;
+		pEndpoint = &target->endpoint[i];
+		pEndpoint->service_id = 0;
 		pEndpoint->MaxMsgLength = 0;
 		pEndpoint->MaxTxQueueDepth = 0;
 		pEndpoint->Id = i;
@@ -616,7 +618,7 @@ void htc_flush_surprise_remove(HTC_HANDLE HTCHandle)
 
 	/* cleanup endpoints */
 	for (i = 0; i < ENDPOINT_MAX; i++) {
-		pEndpoint = &target->EndPoint[i];
+		pEndpoint = &target->endpoint[i];
 		htc_flush_rx_hold_queue(target, pEndpoint);
 		htc_flush_endpoint_tx(target, pEndpoint, HTC_TX_PACKET_TAG_ALL);
 	}
@@ -652,7 +654,7 @@ void htc_stop(HTC_HANDLE HTCHandle)
 
 	/* cleanup endpoints */
 	for (i = 0; i < ENDPOINT_MAX; i++) {
-		pEndpoint = &target->EndPoint[i];
+		pEndpoint = &target->endpoint[i];
 		htc_flush_rx_hold_queue(target, pEndpoint);
 		htc_flush_endpoint_tx(target, pEndpoint, HTC_TX_PACKET_TAG_ALL);
 		if (pEndpoint->ul_is_polled) {
@@ -681,7 +683,60 @@ void htc_stop(HTC_HANDLE HTCHandle)
 
 	reset_endpoint_states(target);
 
-	AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-htc_stop \n"));
+	AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-htc_stop\n"));
+}
+
+/**
+ * htc_runtime_pm_init(): runtime pm related intialization
+ *
+ * need to initialize a work item.
+ */
+void htc_runtime_pm_init(HTC_TARGET *target)
+{
+	cdf_create_work(&target->queue_kicker, htc_kick_queues, target);
+}
+
+/**
+ * htc_runtime_suspend(): ensure htc is ready to suspend
+ *
+ * htc is ready to suspend if there are no pending pactets
+ * in the txrx queues.
+ *
+ * Return: 0 on success or -EBUSY if there are queued packets.
+ */
+int htc_runtime_suspend(void)
+{
+	ol_txrx_pdev_handle txrx_pdev = cds_get_context(CDF_MODULE_ID_TXRX);
+
+	if (txrx_pdev == NULL) {
+		HTC_ERROR("%s: txrx context null", __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+
+	if (ol_txrx_get_tx_pending(txrx_pdev))
+		return -EBUSY;
+	else
+		return 0;
+}
+
+/**
+ * htc_runtime_resume(): resume htc
+ *
+ * The htc message queue needs to be kicked off after
+ * a runtime resume.  Otherwise messages would get stuck.
+ *
+ * Return: 0 for success;
+ */
+int htc_runtime_resume(void)
+{
+	HTC_HANDLE htc_ctx = cds_get_context(CDF_MODULE_ID_HTC);
+	HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(htc_ctx);
+
+	if (target == NULL)
+		return 0;
+
+	cdf_schedule_work(&target->queue_kicker);
+	return 0;
 }
 
 void htc_dump_credit_states(HTC_HANDLE HTCHandle)
@@ -691,24 +746,24 @@ void htc_dump_credit_states(HTC_HANDLE HTCHandle)
 	int i;
 
 	for (i = 0; i < ENDPOINT_MAX; i++) {
-		pEndpoint = &target->EndPoint[i];
-		if (0 == pEndpoint->ServiceID) {
+		pEndpoint = &target->endpoint[i];
+		if (0 == pEndpoint->service_id)
 			continue;
-		}
+
 		AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
-				("--- EP : %d  ServiceID: 0x%X    --------------\n",
-				 pEndpoint->Id, pEndpoint->ServiceID));
+			("--- EP : %d  service_id: 0x%X    --------------\n",
+				 pEndpoint->Id, pEndpoint->service_id));
 		AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
-				(" TxCredits          : %d \n",
+				(" TxCredits          : %d\n",
 				 pEndpoint->TxCredits));
 		AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
-				(" TxCreditSize       : %d \n",
+				(" TxCreditSize       : %d\n",
 				 pEndpoint->TxCreditSize));
 		AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
-				(" TxCreditsPerMaxMsg : %d \n",
+				(" TxCreditsPerMaxMsg : %d\n",
 				 pEndpoint->TxCreditsPerMaxMsg));
 		AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
-				(" TxQueueDepth       : %d \n",
+				(" TxQueueDepth       : %d\n",
 				 HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue)));
 		AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
 				("----------------------------------------------------\n"));
@@ -749,13 +804,13 @@ A_BOOL htc_get_endpoint_statistics(HTC_HANDLE HTCHandle,
 	if (sample) {
 		A_ASSERT(pStats != NULL);
 		/* return the stats to the caller */
-		A_MEMCPY(pStats, &target->EndPoint[Endpoint].EndPointStats,
+		A_MEMCPY(pStats, &target->endpoint[Endpoint].endpoint_stats,
 			 sizeof(HTC_ENDPOINT_STATS));
 	}
 
 	if (clearStats) {
 		/* reset stats */
-		A_MEMZERO(&target->EndPoint[Endpoint].EndPointStats,
+		A_MEMZERO(&target->endpoint[Endpoint].endpoint_stats,
 			  sizeof(HTC_ENDPOINT_STATS));
 	}
 
diff --git a/core/htc/htc_api.h b/core/htc/htc_api.h
index 75c83d7d8414..94b38296a5c3 100644
--- a/core/htc/htc_api.h
+++ b/core/htc/htc_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -66,6 +66,9 @@ struct ol_ath_htc_stats {
 	int htc_send_q_empty_count;
 };
 
+/* To resume HTT Tx queue during runtime resume */
+typedef void (*HTC_EP_RESUME_TX_QUEUE)(void *);
+
 /* per service connection send completion */
 typedef void (*HTC_EP_SEND_PKT_COMPLETE)(void *, HTC_PACKET *);
 /* per service connection callback when a plurality of packets have been sent
@@ -151,6 +154,7 @@ typedef struct _HTC_EP_CALLBACKS {
 	                                                                   indications (EpTxComplete must be NULL) */
 	HTC_EP_RECV_PKT_MULTIPLE EpRecvPktMultiple;             /* OPTIONAL completion handler for multiple
 	                                                           recv packet indications (EpRecv must be NULL) */
+	HTC_EP_RESUME_TX_QUEUE ep_resume_tx_queue;
 	int RecvAllocThreshold;         /* if EpRecvAllocThresh is non-NULL, HTC will compare the
 	                                   threshold value to the current recv packet length and invoke
 	                                   the EpRecvAllocThresh callback to acquire a packet buffer */
@@ -163,7 +167,7 @@ typedef struct _HTC_EP_CALLBACKS {
 
 /* service connection information */
 typedef struct _HTC_SERVICE_CONNECT_REQ {
-	HTC_SERVICE_ID ServiceID;               /* service ID to connect to */
+	HTC_SERVICE_ID service_id;               /* service ID to connect to */
 	A_UINT16 ConnectionFlags;               /* connection flags, see htc protocol definition */
 	A_UINT8 *pMetaData;             /* ptr to optional service-specific meta-data */
 	A_UINT8 MetaDataLength;         /* optional meta data length */
@@ -189,7 +193,7 @@ typedef struct _HTC_SERVICE_CONNECT_RESP {
 typedef struct _HTC_ENDPOINT_CREDIT_DIST {
 	struct _HTC_ENDPOINT_CREDIT_DIST *pNext;
 	struct _HTC_ENDPOINT_CREDIT_DIST *pPrev;
-	HTC_SERVICE_ID ServiceID;               /* Service ID (set by HTC) */
+	HTC_SERVICE_ID service_id;               /* Service ID (set by HTC) */
 	HTC_ENDPOINT_ID Endpoint;               /* endpoint for this distribution struct (set by HTC) */
 	A_UINT32 DistFlags;             /* distribution flags, distribution function can
 	                                   set default activity using SET_EP_ACTIVE() macro */
@@ -694,6 +698,8 @@ void htc_dump_counter_info(HTC_HANDLE HTCHandle);
 void *htc_get_targetdef(HTC_HANDLE htc_handle);
 void htc_set_target_to_sleep(void *context);
 void htc_cancel_deferred_target_sleep(void *context);
+int htc_runtime_suspend(void);
+int htc_runtime_resume(void);
 
 /* Disable ASPM : Disable PCIe low power */
 void htc_disable_aspm(void);
diff --git a/core/htc/htc_internal.h b/core/htc/htc_internal.h
index b7a526ec6464..5b98d1368aae 100644
--- a/core/htc/htc_internal.h
+++ b/core/htc/htc_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -96,8 +96,12 @@ typedef struct {
 
 typedef struct _HTC_ENDPOINT {
 	HTC_ENDPOINT_ID Id;
-	HTC_SERVICE_ID ServiceID;               /* service ID this endpoint is bound to
-	                                           non-zero value means this endpoint is in use */
+
+	/* service ID this endpoint is bound to
+	 * non-zero value means this endpoint is in use
+	 */
+	HTC_SERVICE_ID service_id;
+
 	HTC_EP_CALLBACKS EpCallBacks;           /* callbacks associated with this endpoint */
 	HTC_PACKET_QUEUE TxQueue;               /* HTC frame buffer TX queue */
 	int MaxTxQueueDepth;            /* max depth of the TX queue before we need to
@@ -123,19 +127,19 @@ typedef struct _HTC_ENDPOINT {
 	int TxCreditSize;               /* size in bytes of each credit (set by HTC) */
 	int TxCreditsPerMaxMsg;         /* credits required per max message (precalculated) */
 #ifdef HTC_EP_STAT_PROFILING
-	HTC_ENDPOINT_STATS EndPointStats;               /* endpoint statistics */
+	HTC_ENDPOINT_STATS endpoint_stats;     /* endpoint statistics */
 #endif
 	A_BOOL TxCreditFlowEnabled;
 } HTC_ENDPOINT;
 
 #ifdef HTC_EP_STAT_PROFILING
-#define INC_HTC_EP_STAT(p,stat,count) (p)->EndPointStats.stat += (count);
+#define INC_HTC_EP_STAT(p, stat, count) ((p)->endpoint_stats.stat += (count))
 #else
-#define INC_HTC_EP_STAT(p,stat,count)
+#define INC_HTC_EP_STAT(p, stat, count)
 #endif
 
 typedef struct {
-	A_UINT16 ServiceID;
+	A_UINT16 service_id;
 	A_UINT8 CreditAllocation;
 } HTC_SERVICE_TX_CREDIT_ALLOCATION;
 
@@ -150,7 +154,7 @@ enum ol_ath_htc_pkt_ecodes {
 /* our HTC target state */
 typedef struct _HTC_TARGET {
 	struct ol_softc *hif_dev;
-	HTC_ENDPOINT EndPoint[ENDPOINT_MAX];
+	HTC_ENDPOINT endpoint[ENDPOINT_MAX];
 	cdf_spinlock_t HTCLock;
 	cdf_spinlock_t HTCRxLock;
 	cdf_spinlock_t HTCTxLock;
@@ -180,6 +184,7 @@ typedef struct _HTC_TARGET {
 	A_UINT32 ce_send_cnt;
 	A_UINT32 TX_comp_cnt;
 	A_UINT8 MaxMsgsPerHTCBundle;
+	cdf_work_t queue_kicker;
 } HTC_TARGET;
 
 #define HTC_ENABLE_BUNDLE(target) (target->MaxMsgsPerHTCBundle > 1)
@@ -233,7 +238,7 @@ void htc_recv_init(HTC_TARGET *target);
 A_STATUS htc_wait_recv_ctrl_message(HTC_TARGET *target);
 void htc_free_control_tx_packet(HTC_TARGET *target, HTC_PACKET *pPacket);
 HTC_PACKET *htc_alloc_control_tx_packet(HTC_TARGET *target);
-A_UINT8 htc_get_credit_allocation(HTC_TARGET *target, A_UINT16 ServiceID);
+A_UINT8 htc_get_credit_allocation(HTC_TARGET *target, A_UINT16 service_id);
 void htc_tx_resource_avail_handler(void *context, A_UINT8 pipeID);
 void htc_control_rx_complete(void *Context, HTC_PACKET *pPacket);
 void htc_process_credit_rpt(HTC_TARGET *target,
@@ -241,6 +246,8 @@ void htc_process_credit_rpt(HTC_TARGET *target,
 			    int NumEntries, HTC_ENDPOINT_ID FromEndpoint);
 void htc_fw_event_handler(void *context, CDF_STATUS status);
 void htc_send_complete_check_cleanup(void *context);
+void htc_runtime_pm_init(HTC_TARGET *target);
+void htc_kick_queues(void *context);
 
 void htc_credit_record(htc_credit_exchange_type type, uint32_t tx_credit,
 		       uint32_t htc_tx_queue_depth);
diff --git a/core/htc/htc_packet.h b/core/htc/htc_packet.h
index 34707e5c6e8a..ca3698f019b7 100644
--- a/core/htc/htc_packet.h
+++ b/core/htc/htc_packet.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -61,10 +61,23 @@ typedef struct _HTC_TX_PACKET_INFO {
 	A_UINT32 Flags;         /* internal use */
 } HTC_TX_PACKET_INFO;
 
-#define HTC_TX_PACKET_TAG_ALL          0        /* a tag of zero is reserved and used to flush ALL packets */
-#define HTC_TX_PACKET_TAG_INTERNAL     1        /* internal tags start here */
-#define HTC_TX_PACKET_TAG_USER_DEFINED (HTC_TX_PACKET_TAG_INTERNAL + 9) /* user-defined tags start here */
-#define HTC_TX_PACKET_TAG_BUNDLED      HTC_TX_PACKET_TAG_USER_DEFINED + 1       /* indicate this is bundled TX packet */
+/**
+ * HTC_TX_PACKET_TAG_XXX - #defines for tagging packets for special handling
+ * HTC_TX_PACKET_TAG_ALL: zero is reserved and used to flush ALL packets
+ * HTC_TX_PACKET_TAG_INTERNAL: internal tags start here
+ * HTC_TX_PACKET_TAG_USER_DEFINED: user-defined tags start here
+ * HTC_TX_PACKET_TAG_BUNDLED: indicate this is a bundled tx packet
+ * HTC_TX_PACKET_TAG_AUTO_PM: indicate a power management wmi command
+ */
+#define HTC_TX_PACKET_TAG_ALL          0
+#define HTC_TX_PACKET_TAG_INTERNAL     1
+#define HTC_TX_PACKET_TAG_USER_DEFINED (HTC_TX_PACKET_TAG_INTERNAL + 9)
+#define HTC_TX_PACKET_TAG_BUNDLED      (HTC_TX_PACKET_TAG_USER_DEFINED + 1)
+#define HTC_TX_PACKET_TAG_AUTO_PM      (HTC_TX_PACKET_TAG_USER_DEFINED + 2)
+
+/* Tag packet for runtime put after sending */
+#define HTC_TX_PACKET_TAG_RUNTIME_PUT  (HTC_TX_PACKET_TAG_USER_DEFINED + 3)
+
 
 #define HTC_TX_PACKET_FLAG_FIXUP_NETBUF (1 << 0)
 
diff --git a/core/htc/htc_recv.c b/core/htc/htc_recv.c
index ad0644ce69ab..79bf6c6847d0 100644
--- a/core/htc/htc_recv.c
+++ b/core/htc/htc_recv.c
@@ -168,7 +168,7 @@ void htc_disable_recv(HTC_HANDLE HTCHandle)
 int htc_get_num_recv_buffers(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint)
 {
 	HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-	HTC_ENDPOINT *pEndpoint = &target->EndPoint[Endpoint];
+	HTC_ENDPOINT *pEndpoint = &target->endpoint[Endpoint];
 	return HTC_PACKET_QUEUE_DEPTH(&pEndpoint->RxBufferHoldQueue);
 }
 
@@ -315,7 +315,7 @@ CDF_STATUS htc_rx_completion_handler(void *Context, cdf_nbuf_t netbuf,
 			break;
 		}
 
-		pEndpoint = &target->EndPoint[htc_ep_id];
+		pEndpoint = &target->endpoint[htc_ep_id];
 
 		/*
 		 * If this endpoint that received a message from the target has
@@ -531,7 +531,7 @@ A_STATUS htc_add_receive_pkt_multiple(HTC_HANDLE HTCHandle,
 			 HTC_PACKET_QUEUE_DEPTH(pPktQueue),
 			 pFirstPacket->BufferLength));
 
-	pEndpoint = &target->EndPoint[pFirstPacket->Endpoint];
+	pEndpoint = &target->endpoint[pFirstPacket->Endpoint];
 
 	LOCK_HTC_RX(target);
 
diff --git a/core/htc/htc_send.c b/core/htc/htc_send.c
index cb3c57d642f8..26821fd542a4 100644
--- a/core/htc/htc_send.c
+++ b/core/htc/htc_send.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -121,8 +121,8 @@ void htc_get_control_endpoint_tx_host_credits(HTC_HANDLE HTCHandle, int *credits
 	*credits = 0;
 	LOCK_HTC_TX(target);
 	for (i = 0; i < ENDPOINT_MAX; i++) {
-		pEndpoint = &target->EndPoint[i];
-		if (pEndpoint->ServiceID == WMI_CONTROL_SVC) {
+		pEndpoint = &target->endpoint[i];
+		if (pEndpoint->service_id == WMI_CONTROL_SVC) {
 			*credits = pEndpoint->TxCredits;
 			break;
 		}
@@ -185,7 +185,7 @@ static void do_send_completion(HTC_ENDPOINT *pEndpoint,
 
 static void send_packet_completion(HTC_TARGET *target, HTC_PACKET *pPacket)
 {
-	HTC_ENDPOINT *pEndpoint = &target->EndPoint[pPacket->Endpoint];
+	HTC_ENDPOINT *pEndpoint = &target->endpoint[pPacket->Endpoint];
 	HTC_PACKET_QUEUE container;
 
 	restore_tx_packet(target, pPacket);
@@ -577,6 +577,13 @@ static A_STATUS htc_issue_packets(HTC_TARGET *target,
 			break;
 		}
 
+		/*
+		 * For HTT messages without a response from fw,
+		 *   do the runtime put here.
+		 * otherwise runtime put will be done when the fw response comes
+		 */
+		if (pPacket->PktInfo.AsTx.Tag == HTC_TX_PACKET_TAG_RUNTIME_PUT)
+			hif_pm_runtime_put(target->hif_dev);
 	}
 	if (cdf_unlikely(A_FAILED(status))) {
 #if defined(HIF_USB)
@@ -597,6 +604,60 @@ static A_STATUS htc_issue_packets(HTC_TARGET *target,
 	return status;
 }
 
+#ifdef FEATURE_RUNTIME_PM
+/**
+ * extract_htc_pm_packtes(): move pm packets from endpoint into queue
+ * @endpoint: which enpoint to extract packets from
+ * @queue: a queue to store extracted packets in.
+ *
+ * remove pm packets from the endpoint's tx queue.
+ * queue them into a queue
+ */
+static void extract_htc_pm_packets(HTC_ENDPOINT *endpoint,
+				HTC_PACKET_QUEUE *queue)
+{
+	HTC_PACKET *packet;
+
+	/* only WMI endpoint has power management packets */
+	if (endpoint->service_id != WMI_CONTROL_SVC)
+		return;
+
+	ITERATE_OVER_LIST_ALLOW_REMOVE(&endpoint->TxQueue.QueueHead, packet,
+			HTC_PACKET, ListLink) {
+		if (packet->PktInfo.AsTx.Tag == HTC_TX_PACKET_TAG_AUTO_PM) {
+			HTC_PACKET_REMOVE(&endpoint->TxQueue, packet);
+			HTC_PACKET_ENQUEUE(queue, packet);
+		}
+	} ITERATE_END
+}
+
+/**
+ * queue_htc_pm_packets(): queue pm packets with priority
+ * @endpoint: enpoint to queue packets to
+ * @queue: queue of pm packets to enque
+ *
+ * suspend resume packets get special treatment & priority.
+ * need to queue them at the front of the queue.
+ */
+static void queue_htc_pm_packets(HTC_ENDPOINT *endpoint,
+				 HTC_PACKET_QUEUE *queue)
+{
+	if (endpoint->service_id != WMI_CONTROL_SVC)
+		return;
+
+	HTC_PACKET_QUEUE_TRANSFER_TO_HEAD(&endpoint->TxQueue, queue);
+}
+#else
+static void extract_htc_pm_packets(HTC_ENDPOINT *endpoint,
+		HTC_PACKET_QUEUE *queue)
+{}
+
+static void queue_htc_pm_packets(HTC_ENDPOINT *endpoint,
+		HTC_PACKET_QUEUE *queue)
+{}
+#endif
+
+
 /* get HTC send packets from the TX queue on an endpoint, based on available credits */
 void get_htc_send_packets_credit_based(HTC_TARGET *target,
 				       HTC_ENDPOINT *pEndpoint,
@@ -607,24 +668,43 @@ void get_htc_send_packets_credit_based(HTC_TARGET *target,
 	A_UINT8 sendFlags;
 	HTC_PACKET *pPacket;
 	unsigned int transferLength;
+	HTC_PACKET_QUEUE *tx_queue;
+	HTC_PACKET_QUEUE pm_queue;
+	bool do_pm_get = false;
 
 	/****** NOTE : the TX lock is held when this function is called *****************/
-	AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+get_htc_send_packets_credit_based \n"));
+	AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+get_htc_send_packets_credit_based\n"));
+
+	INIT_HTC_PACKET_QUEUE(&pm_queue);
+	extract_htc_pm_packets(pEndpoint, &pm_queue);
+	if (HTC_QUEUE_EMPTY(&pm_queue)) {
+		tx_queue = &pEndpoint->TxQueue;
+		do_pm_get = true;
+	} else {
+		tx_queue = &pm_queue;
+	}
 
 	/* loop until we can grab as many packets out of the queue as we can */
 	while (true) {
+		if (do_pm_get && hif_pm_runtime_get(target->hif_dev)) {
+			/* bus suspended, runtime resume issued */
+			CDF_ASSERT(HTC_PACKET_QUEUE_DEPTH(pQueue) == 0);
+			break;
+		}
 
 		sendFlags = 0;
 		/* get packet at head, but don't remove it */
-		pPacket = htc_get_pkt_at_head(&pEndpoint->TxQueue);
+		pPacket = htc_get_pkt_at_head(tx_queue);
 		if (pPacket == NULL) {
+			if (do_pm_get)
+				hif_pm_runtime_put(target->hif_dev);
 			break;
 		}
 
 		AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
 				(" Got head packet:%p , Queue Depth: %d\n",
 				 pPacket,
-				 HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue)));
+				 HTC_PACKET_QUEUE_DEPTH(tx_queue)));
 
 		transferLength = pPacket->ActualLength + HTC_HDR_LENGTH;
 
@@ -676,6 +756,8 @@ void get_htc_send_packets_credit_based(HTC_TARGET *target,
 						 pEndpoint->TxCredits,
 						 creditsRequired));
 #endif
+				if (do_pm_get)
+					hif_pm_runtime_put(target->hif_dev);
 				break;
 			}
 
@@ -689,13 +771,12 @@ void get_htc_send_packets_credit_based(HTC_TARGET *target,
 				/* tell the target we need credits ASAP! */
 				sendFlags |= HTC_FLAGS_NEED_CREDIT_UPDATE;
 
-				if (pEndpoint->ServiceID == WMI_CONTROL_SVC) {
+				if (pEndpoint->service_id == WMI_CONTROL_SVC) {
 					LOCK_HTC_CREDIT(target);
 					htc_credit_record(HTC_REQUEST_CREDIT,
 							  pEndpoint->TxCredits,
 							  HTC_PACKET_QUEUE_DEPTH
-								  (&pEndpoint->
-								  TxQueue));
+								  (tx_queue));
 					UNLOCK_HTC_CREDIT(target);
 				}
 
@@ -710,7 +791,7 @@ void get_htc_send_packets_credit_based(HTC_TARGET *target,
 		}
 
 		/* now we can fully dequeue */
-		pPacket = htc_packet_dequeue(&pEndpoint->TxQueue);
+		pPacket = htc_packet_dequeue(tx_queue);
 		if (pPacket) {
 			/* save the number of credits this packet consumed */
 			pPacket->PktInfo.AsTx.CreditsUsed = creditsRequired;
@@ -722,7 +803,11 @@ void get_htc_send_packets_credit_based(HTC_TARGET *target,
 		}
 	}
 
-	AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-get_htc_send_packets_credit_based \n"));
+	if (!HTC_QUEUE_EMPTY(&pm_queue))
+		queue_htc_pm_packets(pEndpoint, &pm_queue);
+
+	AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
+			("-get_htc_send_packets_credit_based\n"));
 
 }
 
@@ -732,23 +817,43 @@ void get_htc_send_packets(HTC_TARGET *target,
 {
 
 	HTC_PACKET *pPacket;
+	HTC_PACKET_QUEUE *tx_queue;
+	HTC_PACKET_QUEUE pm_queue;
+	bool do_pm_get;
 
 	/****** NOTE : the TX lock is held when this function is called *****************/
 	AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
 			("+get_htc_send_packets %d resources\n", Resources));
 
+	INIT_HTC_PACKET_QUEUE(&pm_queue);
+	extract_htc_pm_packets(pEndpoint, &pm_queue);
+	if (HTC_QUEUE_EMPTY(&pm_queue)) {
+		tx_queue = &pEndpoint->TxQueue;
+		do_pm_get = true;
+	} else {
+		tx_queue = &pm_queue;
+	}
+
 	/* loop until we can grab as many packets out of the queue as we can */
 	while (Resources > 0) {
 		int num_frags;
 
-		pPacket = htc_packet_dequeue(&pEndpoint->TxQueue);
+		if (do_pm_get && hif_pm_runtime_get(target->hif_dev)) {
+			/* bus suspended, runtime resume issued */
+			CDF_ASSERT(HTC_PACKET_QUEUE_DEPTH(pQueue) == 0);
+			break;
+		}
+
+		pPacket = htc_packet_dequeue(tx_queue);
 		if (pPacket == NULL) {
+			if (do_pm_get)
+				hif_pm_runtime_put(target->hif_dev);
 			break;
 		}
 		AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
 				(" Got packet:%p , New Queue Depth: %d\n",
 				 pPacket,
-				 HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue)));
+				 HTC_PACKET_QUEUE_DEPTH(tx_queue)));
 		/* For non-credit path the sequence number is already embedded
 		 * in the constructed HTC header
 		 */
@@ -779,7 +884,10 @@ void get_htc_send_packets(HTC_TARGET *target,
 		Resources -= num_frags;
 	}
 
-	AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-get_htc_send_packets \n"));
+	if (!HTC_QUEUE_EMPTY(&pm_queue))
+		queue_htc_pm_packets(pEndpoint, &pm_queue);
+
+	AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-get_htc_send_packets\n"));
 
 }
 
@@ -991,9 +1099,14 @@ static HTC_SEND_QUEUE_RESULT htc_try_send(HTC_TARGET *target,
 		/* send what we can */
 		result = htc_issue_packets(target, pEndpoint, &sendQueue);
 		if (result) {
+			int i;
 			AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
 				("htc_issue_packets, failed status:%d put it back to head of callersSendQueue",
 				 result));
+
+			for (i = HTC_PACKET_QUEUE_DEPTH(&sendQueue); i > 0; i--)
+				hif_pm_runtime_put(target->hif_dev);
+
 			HTC_PACKET_QUEUE_TRANSFER_TO_HEAD(&pEndpoint->TxQueue,
 							  &sendQueue);
 			LOCK_HTC_TX(target);
@@ -1034,7 +1147,7 @@ static A_UINT16 htc_send_pkts_sched_check(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID
 	}
 
 	for (eid = ENDPOINT_2; eid <= ENDPOINT_5; eid++) {
-		pEndpoint = &target->EndPoint[eid];
+		pEndpoint = &target->endpoint[eid];
 		pTxQueue = &pEndpoint->TxQueue;
 
 		if (HTC_QUEUE_EMPTY(pTxQueue)) {
@@ -1068,7 +1181,7 @@ static A_STATUS htc_send_pkts_sched_queue(HTC_TARGET *target,
 	HTC_PACKET *pPacket;
 	int goodPkts;
 
-	pEndpoint = &target->EndPoint[eid];
+	pEndpoint = &target->endpoint[eid];
 	pTxQueue = &pEndpoint->TxQueue;
 
 	LOCK_HTC_TX(target);
@@ -1133,10 +1246,10 @@ A_STATUS htc_send_pkts_multiple(HTC_HANDLE HTCHandle, HTC_PACKET_QUEUE *pPktQueu
 	}
 
 	AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
-	pEndpoint = &target->EndPoint[pPacket->Endpoint];
+	pEndpoint = &target->endpoint[pPacket->Endpoint];
 
-	if (!pEndpoint->ServiceID) {
-		AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("%s ServiceID is invalid\n",
+	if (!pEndpoint->service_id) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("%s service_id is invalid\n",
 								__func__));
 		return A_EINVAL;
 	}
@@ -1246,7 +1359,7 @@ A_STATUS htc_send_data_pkt(HTC_HANDLE HTCHandle, cdf_nbuf_t netbuf, int Epid,
 	int tx_resources;
 	uint32_t data_attr = 0;
 
-	pEndpoint = &target->EndPoint[Epid];
+	pEndpoint = &target->endpoint[Epid];
 
 	tx_resources =
 		hif_get_free_queue_number(target->hif_dev, pEndpoint->UL_PipeID);
@@ -1264,6 +1377,9 @@ A_STATUS htc_send_data_pkt(HTC_HANDLE HTCHandle, cdf_nbuf_t netbuf, int Epid,
 		}
 	}
 
+	if (hif_pm_runtime_get(target->hif_dev))
+		return A_ERROR;
+
 	pHtcHdr = (HTC_FRAME_HDR *) cdf_nbuf_get_frag_vaddr(netbuf, 0);
 	AR_DEBUG_ASSERT(pHtcHdr);
 
@@ -1313,14 +1429,14 @@ A_STATUS htc_send_data_pkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket,
 	HTC_ENDPOINT *pEndpoint;
 	HTC_FRAME_HDR *pHtcHdr;
 	HTC_PACKET_QUEUE sendQueue;
-	cdf_nbuf_t netbuf;
+	cdf_nbuf_t netbuf = NULL;
 	int tx_resources;
 	A_STATUS status = A_OK;
 	uint32_t data_attr = 0;
 
 	if (pPacket) {
 		AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
-		pEndpoint = &target->EndPoint[pPacket->Endpoint];
+		pEndpoint = &target->endpoint[pPacket->Endpoint];
 
 		/* add HTC_FRAME_HDR in the initial fragment */
 		netbuf = GET_HTC_PACKET_NET_BUF_CONTEXT(pPacket);
@@ -1372,7 +1488,7 @@ A_STATUS htc_send_data_pkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket,
 #endif
 	} else {
 		LOCK_HTC_TX(target);
-		pEndpoint = &target->EndPoint[1];
+		pEndpoint = &target->endpoint[1];
 	}
 
 	/* increment tx processing count on entry */
@@ -1597,7 +1713,7 @@ CDF_STATUS htc_tx_completion_handler(void *Context,
 	A_UINT16 resourcesMax;
 #endif
 
-	pEndpoint = &target->EndPoint[EpID];
+	pEndpoint = &target->endpoint[EpID];
 	target->TX_comp_cnt++;
 
 	do {
@@ -1609,6 +1725,9 @@ CDF_STATUS htc_tx_completion_handler(void *Context,
 			netbuf = NULL;
 			break;
 		}
+		if (pPacket->PktInfo.AsTx.Tag != HTC_TX_PACKET_TAG_AUTO_PM)
+			hif_pm_runtime_put(target->hif_dev);
+
 		if (pPacket->PktInfo.AsTx.Tag == HTC_TX_PACKET_TAG_BUNDLED) {
 			HTC_PACKET *pPacketTemp;
 			HTC_PACKET_QUEUE *pQueueSave =
@@ -1647,8 +1766,8 @@ void htc_tx_resource_avail_handler(void *context, A_UINT8 pipeID)
 	HTC_ENDPOINT *pEndpoint = NULL;
 
 	for (i = 0; i < ENDPOINT_MAX; i++) {
-		pEndpoint = &target->EndPoint[i];
-		if (pEndpoint->ServiceID != 0) {
+		pEndpoint = &target->endpoint[i];
+		if (pEndpoint->service_id != 0) {
 			if (pEndpoint->UL_PipeID == pipeID) {
 				break;
 			}
@@ -1669,6 +1788,35 @@ void htc_tx_resource_avail_handler(void *context, A_UINT8 pipeID)
 	htc_try_send(target, pEndpoint, NULL);
 }
 
+/**
+ * htc_kick_queues(): resumes tx transactions of suspended endpoints
+ * @context: pointer to the htc target context
+ *
+ * Iterates throught the enpoints and provides a context to empty queues
+ * int the hif layer when they are stalled due to runtime suspend.
+ *
+ * Return: none
+ */
+void htc_kick_queues(void *context)
+{
+	int i;
+	HTC_TARGET *target = (HTC_TARGET *)context;
+	HTC_ENDPOINT *endpoint = NULL;
+
+	for (i = 0; i < ENDPOINT_MAX; i++) {
+		endpoint = &target->endpoint[i];
+
+		if (endpoint->service_id == 0)
+			continue;
+
+		if (endpoint->EpCallBacks.ep_resume_tx_queue)
+			endpoint->EpCallBacks.ep_resume_tx_queue(
+					endpoint->EpCallBacks.pContext);
+
+		htc_try_send(target, endpoint, NULL);
+	}
+}
+
 /* flush endpoint TX queue */
 void htc_flush_endpoint_tx(HTC_TARGET *target, HTC_ENDPOINT *pEndpoint,
 			   HTC_TX_TAG Tag)
@@ -1693,9 +1841,9 @@ void htc_flush_endpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint,
 			HTC_TX_TAG Tag)
 {
 	HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-	HTC_ENDPOINT *pEndpoint = &target->EndPoint[Endpoint];
+	HTC_ENDPOINT *pEndpoint = &target->endpoint[Endpoint];
 
-	if (pEndpoint->ServiceID == 0) {
+	if (pEndpoint->service_id == 0) {
 		AR_DEBUG_ASSERT(false);
 		/* not in use.. */
 		return;
@@ -1743,7 +1891,7 @@ void htc_process_credit_rpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt,
 
 		rpt_credits = HTC_GET_FIELD(pRpt, HTC_CREDIT_REPORT, CREDITS);
 
-		pEndpoint = &target->EndPoint[rpt_ep_id];
+		pEndpoint = &target->endpoint[rpt_ep_id];
 #if DEBUG_CREDIT
 		if (ep_debug_mask & (1 << pEndpoint->Id)) {
 			AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
@@ -1787,7 +1935,7 @@ void htc_process_credit_rpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt,
 			target->avail_tx_credits += rpt_credits;
 
 			for (epid_idx = 0; epid_idx < DATA_EP_SIZE; epid_idx++) {
-				pEndpoint = &target->EndPoint[eid[epid_idx]];
+				pEndpoint = &target->endpoint[eid[epid_idx]];
 				if (HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue)) {
 					break;
 				}
@@ -1809,7 +1957,7 @@ void htc_process_credit_rpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt,
 #else
 		pEndpoint->TxCredits += rpt_credits;
 
-		if (pEndpoint->ServiceID == WMI_CONTROL_SVC) {
+		if (pEndpoint->service_id == WMI_CONTROL_SVC) {
 			LOCK_HTC_CREDIT(target);
 			htc_credit_record(HTC_PROCESS_CREDIT_REPORT,
 					  pEndpoint->TxCredits,
@@ -1824,7 +1972,7 @@ void htc_process_credit_rpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt,
 #ifdef ATH_11AC_TXCOMPACT
 			htc_try_send(target, pEndpoint, NULL);
 #else
-			if (pEndpoint->ServiceID == HTT_DATA_MSG_SVC) {
+			if (pEndpoint->service_id == HTT_DATA_MSG_SVC) {
 				htc_send_data_pkt(target, NULL, 0);
 			} else {
 				htc_try_send(target, pEndpoint, NULL);
diff --git a/core/htc/htc_services.c b/core/htc/htc_services.c
index 40067f733649..0e6ce13a6c90 100644
--- a/core/htc/htc_services.c
+++ b/core/htc/htc_services.c
@@ -57,14 +57,14 @@ A_STATUS htc_connect_service(HTC_HANDLE HTCHandle,
 	A_UINT8 rsp_msg_status, rsp_msg_end_id, rsp_msg_serv_meta_len;
 
 	AR_DEBUG_PRINTF(ATH_DEBUG_TRC,
-			("+htc_connect_service, target:%p SvcID:0x%X \n", target,
-			 pConnectReq->ServiceID));
+			("+htc_connect_service, target:%p SvcID:0x%X\n", target,
+			 pConnectReq->service_id));
 
 	do {
 
-		AR_DEBUG_ASSERT(pConnectReq->ServiceID != 0);
+		AR_DEBUG_ASSERT(pConnectReq->service_id != 0);
 
-		if (HTC_CTRL_RSVD_SVC == pConnectReq->ServiceID) {
+		if (HTC_CTRL_RSVD_SVC == pConnectReq->service_id) {
 			/* special case for pseudo control service */
 			assignedEndpoint = ENDPOINT_0;
 			maxMsgSize = HTC_MAX_CONTROL_MESSAGE_LENGTH;
@@ -72,13 +72,13 @@ A_STATUS htc_connect_service(HTC_HANDLE HTCHandle,
 
 		} else {
 
-			txAlloc =
-				htc_get_credit_allocation(target,
-							  pConnectReq->ServiceID);
+			txAlloc = htc_get_credit_allocation(target,
+					pConnectReq->service_id);
+
 			if (!txAlloc) {
 				AR_DEBUG_PRINTF(ATH_DEBUG_TRC,
 						("Service %d does not allocate target credits!\n",
-						 pConnectReq->ServiceID));
+						 pConnectReq->service_id));
 			}
 
 			/* allocate a packet to send to the target */
@@ -117,7 +117,7 @@ A_STATUS htc_connect_service(HTC_HANDLE HTCHandle,
 			HTC_SET_FIELD(pConnectMsg, HTC_CONNECT_SERVICE_MSG,
 				      MESSAGEID, HTC_MSG_CONNECT_SERVICE_ID);
 			HTC_SET_FIELD(pConnectMsg, HTC_CONNECT_SERVICE_MSG,
-				      SERVICE_ID, pConnectReq->ServiceID);
+				      SERVICE_ID, pConnectReq->service_id);
 			HTC_SET_FIELD(pConnectMsg, HTC_CONNECT_SERVICE_MSG,
 				      CONNECTIONFLAGS, conn_flags);
 
@@ -133,7 +133,7 @@ A_STATUS htc_connect_service(HTC_HANDLE HTCHandle,
 #else
 			/* Only enable credit for WMI service */
 			if (!htc_credit_flow
-			    && pConnectReq->ServiceID != WMI_CONTROL_SVC) {
+			    && pConnectReq->service_id != WMI_CONTROL_SVC) {
 				disableCreditFlowCtrl = true;
 			}
 #endif
@@ -267,9 +267,9 @@ A_STATUS htc_connect_service(HTC_HANDLE HTCHandle,
 			break;
 		}
 
-		pEndpoint = &target->EndPoint[assignedEndpoint];
+		pEndpoint = &target->endpoint[assignedEndpoint];
 		pEndpoint->Id = assignedEndpoint;
-		if (pEndpoint->ServiceID != 0) {
+		if (pEndpoint->service_id != 0) {
 			/* endpoint already in use! */
 			AR_DEBUG_ASSERT(false);
 			break;
@@ -280,7 +280,8 @@ A_STATUS htc_connect_service(HTC_HANDLE HTCHandle,
 		pConnectResp->MaxMsgLength = maxMsgSize;
 
 		/* setup the endpoint */
-		pEndpoint->ServiceID = pConnectReq->ServiceID;  /* this marks the endpoint in use */
+		/* service_id marks the endpoint in use */
+		pEndpoint->service_id = pConnectReq->service_id;
 		pEndpoint->MaxTxQueueDepth = pConnectReq->MaxSendQueueDepth;
 		pEndpoint->MaxMsgLength = maxMsgSize;
 		pEndpoint->TxCredits = txAlloc;
@@ -300,7 +301,7 @@ A_STATUS htc_connect_service(HTC_HANDLE HTCHandle,
 		pEndpoint->EpCallBacks = pConnectReq->EpCallbacks;
 
 		status = hif_map_service_to_pipe(target->hif_dev,
-						 pEndpoint->ServiceID,
+						 pEndpoint->service_id,
 						 &pEndpoint->UL_PipeID,
 						 &pEndpoint->DL_PipeID,
 						 &pEndpoint->ul_is_polled,
@@ -321,14 +322,14 @@ A_STATUS htc_connect_service(HTC_HANDLE HTCHandle,
 
 		AR_DEBUG_PRINTF(ATH_DEBUG_SETUP,
 				("HTC Service:0x%4.4X, ULpipe:%d DLpipe:%d id:%d Ready\n",
-				 pEndpoint->ServiceID, pEndpoint->UL_PipeID,
+				 pEndpoint->service_id, pEndpoint->UL_PipeID,
 				 pEndpoint->DL_PipeID, pEndpoint->Id));
 
 		if (disableCreditFlowCtrl && pEndpoint->TxCreditFlowEnabled) {
 			pEndpoint->TxCreditFlowEnabled = false;
 			AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
 					("HTC Service:0x%4.4X ep:%d TX flow control disabled\n",
-					 pEndpoint->ServiceID,
+					 pEndpoint->service_id,
 					 assignedEndpoint));
 		}
 
diff --git a/core/mac/inc/ani_global.h b/core/mac/inc/ani_global.h
index d89063e831b6..c90e433e131d 100644
--- a/core/mac/inc/ani_global.h
+++ b/core/mac/inc/ani_global.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1041,7 +1041,7 @@ typedef struct sAniSirGlobal {
 	bool enable_dot11p;
 
 	uint32_t dual_mac_feature_disable;
-
+	sir_mgmt_frame_ind_callback mgmt_frame_ind_cb;
 	bool first_scan_done;
 	int8_t first_scan_bucket_threshold;
 } tAniSirGlobal;
diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index 84ac7fee464b..916c01e6be27 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -42,8 +42,8 @@
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            149
+#define QWLAN_VERSION_BUILD            160
 
-#define QWLAN_VERSIONSTR               "5.0.0.149"
+#define QWLAN_VERSIONSTR               "5.0.0.160"
 
 #endif /* QWLAN_VERSION_H */
diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h
index 6753bf860b9e..51f2e11ad537 100644
--- a/core/mac/inc/sir_api.h
+++ b/core/mac/inc/sir_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -49,7 +49,7 @@
 #define SIR_MAX_SUPPORTED_CHANNEL_LIST      96
 
 #define SIR_MDIE_ELEMENT_ID         54
-#define SIR_MDIE_SIZE               3
+#define SIR_MDIE_SIZE               3   /* MD ID(2 bytes), Capability(1 byte) */
 
 /* Increase dwell time for P2P search in ms */
 #define P2P_SEARCH_DWELL_TIME_INCREASE   20
@@ -71,7 +71,6 @@
 #define SIR_SCAN_NO_HIDDEN_SSID                      0
 #define SIR_SCAN_HIDDEN_SSID_PE_DECISION             1
 
-#define SIR_MAC_ADDR_LEN        6
 #define SIR_IPV4_ADDR_LEN       4
 
 typedef uint8_t tSirIpv4Addr[SIR_IPV4_ADDR_LEN];
@@ -163,6 +162,9 @@ typedef enum {
 #define SIR_UAPSD_FLAG_ACBK     (1 << SIR_UAPSD_BITOFFSET_ACBK)
 #define SIR_UAPSD_FLAG_ACBE     (1 << SIR_UAPSD_BITOFFSET_ACBE)
 #define SIR_UAPSD_GET(ac, mask)      (((mask) & (SIR_UAPSD_FLAG_ ## ac)) >> SIR_UAPSD_BITOFFSET_ ## ac)
+
+#define ROAM_SYNCH_PROPAGATION 1
+#define ROAMING_TX_QUEUE_DISABLE 2
 #endif
 
 /**
@@ -285,6 +287,37 @@ struct rrm_config_param {
 	uint8_t max_randn_interval;
 	uint8_t rm_capability[RMENABLEDCAP_MAX_LEN];
 };
+/**
+ * typedef ch_width - channel width
+ * @CH_WIDTH_20MHZ: channel width 20 MHz
+ * @CH_WIDTH_40MHZ: channel width 40 MHz
+ * @CH_WIDTH_80MHZ: channel width 80MHz
+ * @CH_WIDTH_160MHZ: channel width 160 MHz
+ * @CH_WIDTH_80P80MHZ: channel width 160MHz(80+80)
+ */
+typedef enum ch_width {
+	CH_WIDTH_20MHZ = 0,
+	CH_WIDTH_40MHZ = 1,
+	CH_WIDTH_80MHZ = 2,
+	CH_WIDTH_160MHZ = 3,
+	CH_WIDTH_80P80MHZ = 4,
+	CH_WIDTH_MAX
+} phy_ch_width;
+
+/**
+ * struct ch_params_s
+ *
+ * @ch_width: channel width
+ * @sec_ch_offset: secondary channel offset
+ * @center_freq_seg0: center freq for segment 0
+ * @center_freq_seg1: center freq for segment 1
+ */
+typedef struct ch_params_s {
+	enum ch_width ch_width;
+	uint8_t sec_ch_offset;
+	uint8_t center_freq_seg0;
+	uint8_t center_freq_seg1;
+} chan_params_t;
 
 /* each station added has a rate mode which specifies the sta attributes */
 typedef enum eStaRateMode {
@@ -310,6 +343,9 @@ typedef enum eStaRateMode {
 #define IERATE_RATE_MASK          0x7f
 #define IERATE_IS_BASICRATE(x)   ((x) & IERATE_BASICRATE_MASK)
 
+const char *lim_bss_type_to_string(const uint16_t bss_type);
+const char *lim_scan_type_to_string(const uint8_t scan_type);
+
 typedef struct sSirSupportedRates {
 	/*
 	 * For Self STA Entry: this represents Self Mode.
@@ -421,6 +457,8 @@ typedef struct sSirSmeReadyReq {
 	uint16_t length;
 	uint16_t transactionId;
 	void *add_bssdescr_cb;
+	void *csr_roam_synch_cb;
+	void *pe_roam_synch_cb;
 } tSirSmeReadyReq, *tpSirSmeReadyReq;
 
 /**
@@ -572,6 +610,8 @@ typedef struct sSirSmeStartBssReq {
 	uint8_t center_freq_seg0;
 	uint8_t center_freq_seg1;
 	uint8_t sec_ch_offset;
+	bool txbf_ini_enabled;
+	uint8_t txbf_csn_val;
 
 	uint8_t privacy;
 	uint8_t apUapsdEnable;
@@ -584,7 +624,7 @@ typedef struct sSirSmeStartBssReq {
 	uint32_t dtimPeriod;
 	uint8_t wps_state;
 	uint8_t isCoalesingInIBSSAllowed;       /* Coalesing on/off knob */
-	tCDF_CON_MODE bssPersona;
+	enum tCDF_ADAPTER_MODE bssPersona;
 
 	uint8_t txLdpcIniFeatureEnabled;
 
@@ -623,8 +663,8 @@ typedef struct sSirBssDescription {
 	uint16_t beaconInterval;
 	uint16_t capabilityInfo;
 	tSirNwType nwType;      /* Indicates 11a/b/g */
-	uint8_t reserved_padding0;
 	int8_t rssi;
+	int8_t rssi_raw;
 	int8_t sinr;
 	/* channelId what peer sent in beacon/probersp. */
 	uint8_t channelId;
@@ -653,7 +693,8 @@ typedef struct sSirBssDescription {
 
 	/* whether it is from a probe rsp */
 	uint8_t fProbeRsp;
-	uint8_t reservedPadding1;
+	/* Actual channel the beacon/probe response was received on */
+	uint8_t rx_channel;
 	uint8_t reservedPadding2;
 	uint8_t reservedPadding3;
 	uint32_t WscIeLen;
@@ -872,12 +913,14 @@ typedef struct sSirOemDataReq {
 	uint16_t messageType;   /* eWNI_SME_OEM_DATA_REQ */
 	uint16_t messageLen;
 	struct cdf_mac_addr selfMacAddr;
-	uint8_t oemDataReq[OEM_DATA_REQ_SIZE];
+	uint8_t data_len;
+	uint8_t *data;
 } tSirOemDataReq, *tpSirOemDataReq;
 
 typedef struct sSirOemDataRsp {
 	uint16_t messageType;
 	uint16_t length;
+	bool target_rsp;
 	uint8_t oemDataRsp[OEM_DATA_RSP_SIZE];
 } tSirOemDataRsp, *tpSirOemDataRsp;
 
@@ -912,7 +955,7 @@ typedef struct sSirSmeJoinReq {
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
 	uint8_t cc_switch_mode;
 #endif
-	tCDF_CON_MODE staPersona;       /* Persona */
+	enum tCDF_ADAPTER_MODE staPersona;       /* Persona */
 	ePhyChanBondState cbMode;       /* Pass CB mode value in Join. */
 
 	/*This contains the UAPSD Flag for all 4 AC
@@ -1109,10 +1152,10 @@ typedef struct sSirSmeAssocCnf {
 	uint16_t messageType;   /* eWNI_SME_ASSOC_CNF */
 	uint16_t length;
 	tSirResultCodes statusCode;
-	tSirMacAddr bssId;      /* Self BSSID */
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr bssid;      /* Self BSSID */
+	struct cdf_mac_addr peer_macaddr;
 	uint16_t aid;
-	tSirMacAddr alternateBssId;
+	struct cdf_mac_addr alternate_bssid;
 	uint8_t alternateChannelId;
 } tSirSmeAssocCnf, *tpSirSmeAssocCnf;
 
@@ -1200,8 +1243,8 @@ typedef struct sSirSmeDisassocReq {
 	uint16_t length;
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId; /* Transaction ID for cmd */
-	tSirMacAddr bssId;      /* Peer BSSID */
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr bssid;      /* Peer BSSID */
+	struct cdf_mac_addr peer_macaddr;
 	uint16_t reasonCode;
 	/* This flag tells LIM whether to send the disassoc OTA or not */
 	/* This will be set in while handing off from one AP to other */
@@ -1336,7 +1379,7 @@ typedef struct sSirSmeDisassocRsp {
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId; /* Transaction ID for cmd */
 	tSirResultCodes statusCode;
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 	tAniStaStatStruct perStaStats;  /* STA stats */
 	uint16_t staId;
 } cdf_packed tSirSmeDisassocRsp, *tpSirSmeDisassocRsp;
@@ -1348,8 +1391,8 @@ typedef struct sSirSmeDisassocInd {
 	uint8_t sessionId;      /* Session Identifier */
 	uint16_t transactionId; /* Transaction Identifier with PE */
 	tSirResultCodes statusCode;
-	tSirMacAddr bssId;
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr bssid;
+	struct cdf_mac_addr peer_macaddr;
 	tAniStaStatStruct perStaStats;  /* STA stats */
 	uint16_t staId;
 	uint32_t reasonCode;
@@ -1361,8 +1404,8 @@ typedef struct sSirSmeDisassocCnf {
 	uint16_t messageType;   /* eWNI_SME_DISASSOC_CNF */
 	uint16_t length;
 	tSirResultCodes statusCode;
-	tSirMacAddr bssId;
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr bssid;
+	struct cdf_mac_addr peer_macaddr;
 } tSirSmeDisassocCnf, *tpSirSmeDisassocCnf,
 	tSirSmeDeauthCnf, *tpSirSmeDeauthCnf;
 
@@ -1372,8 +1415,8 @@ typedef struct sSirSmeDeauthReq {
 	uint16_t length;
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId; /* Transaction ID for cmd */
-	tSirMacAddr bssId;      /* AP BSSID */
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr bssid;      /* AP BSSID */
+	struct cdf_mac_addr peer_macaddr;
 	uint16_t reasonCode;
 } tSirSmeDeauthReq, *tpSirSmeDeauthReq;
 
@@ -1384,7 +1427,7 @@ typedef struct sSirSmeDeauthRsp {
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId; /* Transaction ID for cmd */
 	tSirResultCodes statusCode;
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 } tSirSmeDeauthRsp, *tpSirSmeDeauthRsp;
 
 /* / Definition for Deauthetication indication from peer */
@@ -1394,11 +1437,12 @@ typedef struct sSirSmeDeauthInd {
 	uint8_t sessionId;      /* Added for BT-AMP */
 	uint16_t transactionId; /* Added for BT-AMP */
 	tSirResultCodes statusCode;
-	tSirMacAddr bssId;      /* AP BSSID */
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr bssid;      /* AP BSSID */
+	struct cdf_mac_addr peer_macaddr;
 
 	uint16_t staId;
 	uint32_t reasonCode;
+	int8_t rssi;
 } tSirSmeDeauthInd, *tpSirSmeDeauthInd;
 
 /* / Definition for stop BSS request message */
@@ -1408,7 +1452,7 @@ typedef struct sSirSmeStopBssReq {
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId; /* tranSaction ID for cmd */
 	tSirResultCodes reasonCode;
-	tSirMacAddr bssId;      /* Self BSSID */
+	struct cdf_mac_addr bssid;      /* Self BSSID */
 } tSirSmeStopBssReq, *tpSirSmeStopBssReq;
 
 /* / Definition for stop BSS response message */
@@ -1427,7 +1471,7 @@ typedef struct sSirSmeSwitchChannelInd {
 	uint16_t length;
 	uint8_t sessionId;
 	uint16_t newChannelId;
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr bssid;      /* BSSID */
 } tSirSmeSwitchChannelInd, *tpSirSmeSwitchChannelInd;
 
 /* / Definition for Neighbor BSS indication */
@@ -1464,8 +1508,8 @@ typedef struct sSirSmeSetContextReq {
 	uint16_t length;
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId; /* Transaction ID for cmd */
-	tSirMacAddr peerMacAddr;
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr peer_macaddr;
+	struct cdf_mac_addr bssid;      /* BSSID */
 	tSirKeyMaterial keyMaterial;
 } tSirSmeSetContextReq, *tpSirSmeSetContextReq;
 
@@ -1477,7 +1521,7 @@ typedef struct sSirSmeSetContextRsp {
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId; /* Transaction ID for cmd */
 	tSirResultCodes statusCode;
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 } tSirSmeSetContextRsp, *tpSirSmeSetContextRsp;
 
 /* / Statistic definitions */
@@ -1581,24 +1625,6 @@ typedef struct sAniRxCtrs {
 	uint32_t aesDecryptErrUcast;
 } tAniRxCtrs, *tpAniRxCtrs;
 
-/* Get Radio Stats request structure */
-/* This structure shall be used for both Radio stats and Aggregate stats */
-/* A valid request must contain entire structure with/without valid fields. */
-/* Based on the request type, the valid fields will be checked. */
-typedef struct sAniGetStatsReq {
-	/* Common for all types are requests */
-	uint16_t msgType;       /* message type is same as the request type */
-	uint16_t msgLen;        /* length of the entire request */
-	uint8_t sessionId;      /* Session ID */
-	uint16_t transactionId;
-	tSirMacAddr bssId;      /* BSSID */
-	/* only used for clear stats and per sta stats clear */
-	tAniStatSubTypes stat;  /* Clears the stats of the described types. */
-	uint32_t staId;         /* Per STA stats request must contain valid */
-	/* values */
-	tSirMacAddr macAddr;
-} tAniGetStatsReq, *tpAniGetStatsReq;
-
 /* *************************************************************** */
 
 /*******************PE Statistics*************************/
@@ -1799,11 +1825,9 @@ struct ani_roc_req {
 
 /* generic country code change request MSG structure */
 typedef struct sAniGenericChangeCountryCodeReq {
-	/* Common for all types are requests */
 	uint16_t msgType;       /* message type is same as the request type */
 	uint16_t msgLen;        /* length of the entire request */
 	uint8_t countryCode[WNI_CFG_COUNTRY_CODE_LEN];  /* 3 char country code */
-	uint16_t domain_index;
 } tAniGenericChangeCountryCodeReq, *tpAniGenericChangeCountryCodeReq;
 
 /**
@@ -1973,7 +1997,7 @@ typedef struct sSirAddtsReq {
 	uint16_t length;
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId;
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr bssid;      /* BSSID */
 	uint32_t timeout;       /* in ms */
 	uint8_t rspReqd;
 	tSirAddtsReqInfo req;
@@ -1993,9 +2017,9 @@ typedef struct sSirDeltsReq {
 	uint16_t length;
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId;
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr bssid;      /* BSSID */
 	uint16_t aid;           /* use 0 if macAddr is being specified */
-	tSirMacAddr macAddr;    /* only on AP to specify the STA */
+	struct cdf_mac_addr macaddr;    /* only on AP to specify the STA */
 	uint8_t rspReqd;
 	tSirDeltsReqInfo req;
 } tSirDeltsReq, *tpSirDeltsReq;
@@ -2007,7 +2031,7 @@ typedef struct sSirDeltsRsp {
 	uint16_t transactionId; /* sme transaction Id - for BT-AMP Support */
 	uint32_t rc;
 	uint16_t aid;           /* use 0 if macAddr is being specified */
-	tSirMacAddr macAddr;    /* only on AP to specify the STA */
+	struct cdf_mac_addr macaddr;    /* only on AP to specify the STA */
 	tSirDeltsReqInfo rsp;
 } tSirDeltsRsp, *tpSirDeltsRsp;
 
@@ -2020,7 +2044,7 @@ typedef struct sSirPlmReq {
 	uint16_t measDuration;  /* in TU's,STA goes off-ch */
 	/* no of times the STA should cycle through PLM ch list */
 	uint8_t burstLen;
-	tPowerdBm desiredTxPwr; /* desired tx power */
+	int8_t desiredTxPwr; /* desired tx power */
 	struct cdf_mac_addr mac_addr;    /* MC dest addr */
 	/* no of channels */
 	uint8_t plmNumCh;
@@ -2045,7 +2069,7 @@ typedef struct sSirAggrQosReq {
 	uint16_t length;
 	uint8_t sessionId;      /* Session ID */
 	uint16_t transactionId;
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr bssid;      /* BSSID */
 	uint32_t timeout;       /* in ms */
 	uint8_t rspReqd;
 	tSirAggrQosReqInfo aggrInfo;
@@ -2077,7 +2101,7 @@ typedef struct sSmeIbssPeerInd {
 	uint16_t mesgLen;
 	uint8_t sessionId;
 
-	tSirMacAddr peerAddr;
+	struct cdf_mac_addr peer_addr;
 	uint16_t staId;
 
 	/*
@@ -2096,7 +2120,7 @@ typedef struct sSmeIbssPeerInd {
 typedef struct sSirIbssPeerInactivityInd {
 	uint8_t bssIdx;
 	uint8_t staIdx;
-	tSirMacAddr peerAddr;
+	struct cdf_mac_addr peer_addr;
 } tSirIbssPeerInactivityInd, *tpSirIbssPeerInactivityInd;
 
 typedef struct sLimScanChn {
@@ -2122,7 +2146,7 @@ typedef struct sLimScanChnInfo {
 typedef struct sSirSmeGetAssocSTAsReq {
 	uint16_t messageType;   /* eWNI_SME_GET_ASSOC_STAS_REQ */
 	uint16_t length;
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr bssid;      /* BSSID */
 	uint16_t modId;
 	void *pUsrContext;
 	void *pSapEventCallback;
@@ -2135,13 +2159,13 @@ typedef struct sSmeMaxAssocInd {
 	uint16_t mesgLen;
 	uint8_t sessionId;
 	/* the new peer that got rejected max assoc limit reached */
-	tSirMacAddr peerMac;
+	struct cdf_mac_addr peer_mac;
 } tSmeMaxAssocInd, *tpSmeMaxAssocInd;
 
 typedef struct sSmeCsaOffloadInd {
 	uint16_t mesgType;      /* eWNI_SME_CSA_OFFLOAD_EVENT */
 	uint16_t mesgLen;
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr bssid;      /* BSSID */
 } tSmeCsaOffloadInd, *tpSmeCsaOffloadInd;
 
 /* WOW related structures */
@@ -2186,7 +2210,7 @@ typedef struct sSirSmeWowlEnterParams {
 	uint8_t ucMagicPktEnable;
 
 	/* Magic pattern */
-	tSirMacAddr magicPtrn;
+	struct cdf_mac_addr magic_ptrn;
 
 	/* Enables/disables packet pattern filtering */
 	uint8_t ucPatternFilteringEnable;
@@ -2219,7 +2243,7 @@ typedef struct sSirSmeWowlEnterParams {
 	uint8_t ucWoWBSSConnLoss;
 #endif /* WLAN_WAKEUP_EVENTS */
 
-	tSirMacAddr bssId;
+	struct cdf_mac_addr bssid;
 } tSirSmeWowlEnterParams, *tpSirSmeWowlEnterParams;
 
 /* PE<->HAL: Enter WOWLAN parameters */
@@ -2230,7 +2254,7 @@ typedef struct sSirHalWowlEnterParams {
 	uint8_t ucMagicPktEnable;
 
 	/* Magic pattern */
-	tSirMacAddr magicPtrn;
+	struct cdf_mac_addr magic_ptrn;
 
 	/* Enables/disables packet pattern filtering in firmware.
 	   Enabling this flag enables broadcast pattern matching
@@ -2443,7 +2467,7 @@ typedef struct sSirUpdateAPWPSIEsReq {
 	uint16_t messageType;   /* eWNI_SME_UPDATE_APWPSIE_REQ */
 	uint16_t length;
 	uint16_t transactionId; /* Transaction ID for cmd */
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr bssid;      /* BSSID */
 	uint8_t sessionId;      /* Session ID */
 	tSirAPWPSIEs APWPSIEs;
 } tSirUpdateAPWPSIEsReq, *tpSirUpdateAPWPSIEsReq;
@@ -2460,7 +2484,7 @@ typedef struct sSirChangeBIParams {
 	uint16_t messageType;
 	uint16_t length;
 	uint16_t beaconInterval;        /* Beacon Interval */
-	tSirMacAddr bssId;
+	struct cdf_mac_addr bssid;
 	uint8_t sessionId;      /* Session ID */
 } tSirChangeBIParams, *tpSirChangeBIParams;
 
@@ -2470,7 +2494,7 @@ typedef struct sSirSetHT2040Mode {
 	uint16_t length;
 	uint8_t cbMode;
 	bool obssEnabled;
-	tSirMacAddr bssId;
+	struct cdf_mac_addr bssid;
 	uint8_t sessionId;      /* Session ID */
 } tSirSetHT2040Mode, *tpSirSetHT2040Mode;
 #endif
@@ -2479,7 +2503,7 @@ typedef struct sSirSetHT2040Mode {
 
 typedef struct sSirWPSPBCSession {
 	struct sSirWPSPBCSession *next;
-	tSirMacAddr addr;
+	struct cdf_mac_addr addr;
 	uint8_t uuid_e[SIR_WPS_UUID_LEN];
 	uint32_t timestamp;
 } tSirWPSPBCSession;
@@ -2489,13 +2513,13 @@ typedef struct sSirSmeGetWPSPBCSessionsReq {
 	uint16_t length;
 	void *pUsrContext;
 	void *pSapEventCallback;
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr bssid;      /* BSSID */
 	/* MAC Address of STA in WPS Session to be removed */
-	tSirMacAddr pRemoveMac;
+	struct cdf_mac_addr remove_mac;
 } tSirSmeGetWPSPBCSessionsReq, *tpSirSmeGetWPSPBCSessionsReq;
 
 typedef struct sSirWPSPBCProbeReq {
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 	uint16_t probeReqIELen;
 	uint8_t probeReqIE[512];
 } tSirWPSPBCProbeReq, *tpSirWPSPBCProbeReq;
@@ -2505,7 +2529,7 @@ typedef struct sSirSmeProbeReqInd {
 	uint16_t messageType;   /*  eWNI_SME_WPS_PBC_PROBE_REQ_IND */
 	uint16_t length;
 	uint8_t sessionId;
-	tSirMacAddr bssId;
+	struct cdf_mac_addr bssid;
 	tSirWPSPBCProbeReq WPSPBCProbeReq;
 } tSirSmeProbeReqInd, *tpSirSmeProbeReqInd;
 
@@ -2513,7 +2537,7 @@ typedef struct sSirUpdateAPWPARSNIEsReq {
 	uint16_t messageType;   /* eWNI_SME_SET_APWPARSNIEs_REQ */
 	uint16_t length;
 	uint16_t transactionId; /* Transaction ID for cmd */
-	tSirMacAddr bssId;      /* BSSID */
+	struct cdf_mac_addr bssid;      /* BSSID */
 	uint8_t sessionId;      /* Session ID */
 	tSirRSNie APWPARSNIEs;
 } tSirUpdateAPWPARSNIEsReq, *tpSirUpdateAPWPARSNIEsReq;
@@ -2549,10 +2573,10 @@ typedef struct sSirUpdateAPWPARSNIEsReq {
 
 #ifdef WLAN_NS_OFFLOAD
 typedef struct sSirNsOffloadReq {
-	uint8_t srcIPv6Addr[16];
+	uint8_t srcIPv6Addr[SIR_MAC_IPV6_ADDR_LEN];
 	uint8_t selfIPv6Addr[SIR_MAC_NUM_TARGET_IPV6_NS_OFFLOAD_NA][SIR_MAC_IPV6_ADDR_LEN];
 	uint8_t targetIPv6Addr[SIR_MAC_NUM_TARGET_IPV6_NS_OFFLOAD_NA][SIR_MAC_IPV6_ADDR_LEN];
-	tSirMacAddr selfMacAddr;
+	struct cdf_mac_addr self_macaddr;
 	uint8_t srcIPv6AddrValid;
 	uint8_t targetIPv6AddrValid[SIR_MAC_NUM_TARGET_IPV6_NS_OFFLOAD_NA];
 	uint8_t slotIdx;
@@ -2564,13 +2588,13 @@ typedef struct sSirHostOffloadReq {
 	uint8_t enableOrDisable;
 	uint32_t num_ns_offload_count;
 	union {
-		uint8_t hostIpv4Addr[4];
-		uint8_t hostIpv6Addr[16];
+		uint8_t hostIpv4Addr[SIR_IPV4_ADDR_LEN];
+		uint8_t hostIpv6Addr[SIR_MAC_IPV6_ADDR_LEN];
 	} params;
 #ifdef WLAN_NS_OFFLOAD
 	tSirNsOffloadReq nsOffloadInfo;
 #endif /* WLAN_NS_OFFLOAD */
-	tSirMacAddr bssId;
+	struct cdf_mac_addr bssid;
 } tSirHostOffloadReq, *tpSirHostOffloadReq;
 
 /* Packet Types. */
@@ -2583,14 +2607,13 @@ typedef struct sSirKeepAliveReq {
 	uint32_t timePeriod;
 	tSirIpv4Addr hostIpv4Addr;
 	tSirIpv4Addr destIpv4Addr;
-	tSirMacAddr destMacAddr;
-	tSirMacAddr bssId;
+	struct cdf_mac_addr dest_macaddr;
+	struct cdf_mac_addr bssid;
 	uint8_t sessionId;
 } tSirKeepAliveReq, *tpSirKeepAliveReq;
 
 typedef struct sSirSmeMgmtFrameInd {
-	uint16_t mesgType;
-	uint16_t mesgLen;
+	uint16_t frame_len;
 	uint32_t rxChan;
 	uint8_t sessionId;
 	uint8_t frameType;
@@ -2598,6 +2621,21 @@ typedef struct sSirSmeMgmtFrameInd {
 	uint8_t frameBuf[1];    /* variable */
 } tSirSmeMgmtFrameInd, *tpSirSmeMgmtFrameInd;
 
+typedef void (*sir_mgmt_frame_ind_callback)(tSirSmeMgmtFrameInd *frame_ind);
+/**
+ * struct sir_sme_mgmt_frame_cb_req - Register a
+ * management frame callback req
+ *
+ * @message_type: message id
+ * @length: msg length
+ * @callback: callback for management frame indication
+ */
+struct sir_sme_mgmt_frame_cb_req {
+	uint16_t message_type;
+	uint16_t length;
+	sir_mgmt_frame_ind_callback callback;
+};
+
 #ifdef WLAN_FEATURE_11W
 typedef struct sSirSmeUnprotMgmtFrameInd {
 	uint8_t sessionId;
@@ -2625,12 +2663,6 @@ typedef struct sSirNoAParam {
 	uint8_t psSelection;
 } tSirNoAParam, *tpSirNoAParam;
 
-typedef struct sSirWlanSuspendParam {
-	uint8_t configuredMcstBcstFilterSetting;
-	uint8_t sessionId;
-	uint8_t connectedState;
-} tSirWlanSuspendParam, *tpSirWlanSuspendParam;
-
 typedef struct sSirWlanResumeParam {
 	uint8_t configuredMcstBcstFilterSetting;
 } tSirWlanResumeParam, *tpSirWlanResumeParam;
@@ -2651,7 +2683,7 @@ typedef struct {
 
 typedef struct {
 	uint8_t vdev_id;
-	tSirMacAddr wakee_mac_addr;
+	struct cdf_mac_addr wakee_mac_addr;
 	uint8_t identification_id[8];
 	uint8_t password[16];
 	uint32_t id_length;
@@ -2680,7 +2712,7 @@ typedef struct {
 	uint32_t keepalive_max; /* Maximum ping interval */
 	uint32_t keepalive_inc; /* Increment of ping interval */
 
-	tSirMacAddr gateway_mac;
+	struct cdf_mac_addr gateway_mac;
 	uint32_t tcp_tx_timeout_val;
 	uint32_t tcp_rx_timeout_val;
 } tSirAppType2Params, *tpSirAppType2Params;
@@ -2881,8 +2913,8 @@ struct roam_ext_params {
 	uint8_t num_ssid_allowed_list;
 	uint8_t num_bssid_favored;
 	tSirMacSSid ssid_allowed_list[MAX_SSID_ALLOWED_LIST];
-	tSirMacAddr bssid_avoid_list[MAX_BSSID_AVOID_LIST];
-	tSirMacAddr bssid_favored[MAX_BSSID_FAVORED];
+	struct cdf_mac_addr bssid_avoid_list[MAX_BSSID_AVOID_LIST];
+	struct cdf_mac_addr bssid_favored[MAX_BSSID_FAVORED];
 	uint8_t bssid_favored_factor[MAX_BSSID_FAVORED];
 	int raise_rssi_thresh_5g;
 	int drop_rssi_thresh_5g;
@@ -2976,8 +3008,6 @@ typedef struct sSirRoamOffloadScanRsp {
 /*---------------------------------------------------------------------------
    Packet Filtering Parameters
    ---------------------------------------------------------------------------*/
-#define    SIR_IPV4_ADDR_LEN                 4
-#define    SIR_MAC_ADDR_LEN                  6
 #define    SIR_MAX_FILTER_TEST_DATA_LEN       8
 #define    SIR_MAX_NUM_MULTICAST_ADDRESS    240
 #define    SIR_MAX_NUM_FILTERS               20
@@ -3338,9 +3368,9 @@ typedef struct sSirTdlsSendMgmtReq {
 	uint8_t responder;
 	uint32_t peerCapability;
 	/* For multi-session, for PE to locate peSession ID */
-	tSirMacAddr bssid;
-	tSirMacAddr peerMac;
-	/* Variable lenght. Dont add any field after this. */
+	struct cdf_mac_addr bssid;
+	struct cdf_mac_addr peer_mac;
+	/* Variable length. Dont add any field after this. */
 	uint8_t addIe[1];
 } tSirTdlsSendMgmtReq, *tpSirSmeTdlsSendMgmtReq;
 
@@ -3712,7 +3742,7 @@ typedef struct {
 typedef struct sSirRateUpdateInd {
 	uint8_t nss;            /* 0: 1x1, 1: 2x2 */
 	struct cdf_mac_addr bssid;
-	tCDF_CON_MODE dev_mode;
+	enum tCDF_ADAPTER_MODE dev_mode;
 	int32_t bcastDataRate;  /* bcast rate unit Mbpsx10, -1:not used */
 	/*
 	 * 0 implies RA, positive value implies fixed rate, -1 implies ignore
@@ -3785,8 +3815,8 @@ typedef struct sSirChanChangeRequest {
 	uint16_t messageType;
 	uint16_t messageLen;
 	uint8_t targetChannel;
-	uint8_t cbMode;
-	uint8_t channel_width;
+	uint8_t sec_ch_offset;
+	phy_ch_width ch_width;
 	uint8_t center_freq_seg_0;
 	uint8_t center_freq_seg_1;
 	uint8_t bssid[CDF_MAC_ADDR_SIZE];
@@ -3867,7 +3897,7 @@ typedef struct sSirDfsCsaIeRequest {
 	uint8_t targetChannel;
 	uint8_t csaIeRequired;
 	uint8_t bssid[CDF_MAC_ADDR_SIZE];
-	uint8_t ch_bandwidth;
+	struct ch_params_s ch_params;
 } tSirDfsCsaIeRequest, *tpSirDfsCsaIeRequest;
 
 /* Indication from lower layer indicating the completion of first beacon send
@@ -3940,9 +3970,11 @@ typedef struct sSirSmeRoamOffloadSynchInd {
 	uint16_t beaconProbeRespLength;
 	uint16_t reassocRespOffset;
 	uint16_t reassocRespLength;
+	uint16_t reassoc_req_offset;
+	uint16_t reassoc_req_length;
 	uint8_t isBeacon;
 	uint8_t roamedVdevId;
-	tSirMacAddr bssId;
+	struct cdf_mac_addr bssid;
 	int8_t txMgmtPower;
 	uint32_t authStatus;
 	uint8_t rssi;
@@ -3951,6 +3983,9 @@ typedef struct sSirSmeRoamOffloadSynchInd {
 	uint8_t kck[SIR_KCK_KEY_LEN];
 	uint8_t kek[SIR_KEK_KEY_LEN];
 	uint8_t replay_ctr[SIR_REPLAY_CTR_LEN];
+	void *add_bss_params;
+	tpSirSmeJoinRsp join_rsp;
+	uint16_t aid;
 	tpSirBssDescription  bss_desc_ptr;
 } roam_offload_synch_ind;
 
@@ -5398,6 +5433,33 @@ enum powersave_mode {
 	PS_QPOWER_DEEPSLEEP = 4,
 	PS_DUTY_CYCLING_QPOWER = 5
 };
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+/**
+ * struct gateway_param_update_req - gateway parameter update request
+ * @request_id: request id
+ * @session_id: session id
+ * @max_retries: Max ARP/NS retry attempts
+ * @timeout: Retry interval
+ * @ipv4_addr_type: on ipv4 network
+ * @ipv6_addr_type: on ipv6 network
+ * @gw_mac_addr: gateway mac addr
+ * @ipv4_addr: ipv4 addr
+ * @ipv6_addr: ipv6 addr
+ */
+struct gateway_param_update_req {
+	uint32_t     request_id;
+	uint32_t     session_id;
+	uint32_t     max_retries;
+	uint32_t     timeout;
+	uint32_t     ipv4_addr_type;
+	uint32_t     ipv6_addr_type;
+	struct cdf_mac_addr  gw_mac_addr;
+	uint8_t      ipv4_addr[CDF_IPV4_ADDR_SIZE];
+	uint8_t      ipv6_addr[CDF_IPV6_ADDR_SIZE];
+};
+#else
+struct gateway_param_update_req;
+#endif /* FEATURE_LFR_SUBNET_DETECTION */
 
 /**
  * struct sir_sme_ext_change_chan_req - channel change request
@@ -5423,4 +5485,20 @@ struct sir_sme_ext_cng_chan_ind {
 	uint8_t  new_channel;
 };
 
+/**
+ * struct egap_params - the enhanced green ap params
+ * @vdev_id: vdev id
+ * @enable: enable or disable the enhance green ap in firmware
+ * @inactivity_time: inactivity timeout value
+ * @wait_time: wait timeout value
+ * @flags: feature flag in bitmask
+ *
+ */
+struct egap_conf_params {
+	uint32_t   vdev_id;
+	bool       enable;
+	uint32_t   inactivity_time;
+	uint32_t   wait_time;
+	uint32_t   flags;
+};
 #endif /* __SIR_API_H */
diff --git a/core/mac/inc/sir_mac_prot_def.h b/core/mac/inc/sir_mac_prot_def.h
index bf90279c001f..d6494dacec6e 100644
--- a/core/mac/inc/sir_mac_prot_def.h
+++ b/core/mac/inc/sir_mac_prot_def.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -493,39 +493,7 @@
 #define SIR_MAC_IPV6_ADDR_LEN               16
 #define SIR_IPV6_ADDR_VALID                 1
 #endif /* WLAN_NS_OFFLOAD */
-#define SIR_MAC_ARP_OFFLOAD_SIZE        1
-
-/* total length of an Info element including T/L fields */
-#define EID_LEN(eid) (2 + (eid))
-
-/* support for radar Detect, Channel Switch */
-#define CHANNEL_SWITCH_MAX_FRAME_SIZE               256
-
-/* Length of Channel Switch related message */
-#define SIR_SME_CHANNEL_SWITCH_SIZE \
-	(sizeof(uint8_t) + 2 * sizeof(uint16_t) + sizeof(uint32_t) +\
-	sizeof(ePhyChanBondState))
-#define SIR_CHANNEL_SWITCH_IE_SIZE         EID_LEN(SIR_MAC_CHNL_SWITCH_ANN_EID_MIN)
-
-/* Measurement Request/Report messages */
-#define SIR_MEAS_REQ_FIELD_SIZE                11
-#define SIR_MEAS_REQ_IE_SIZE                   (5 + SIR_MEAS_REQ_FIELD_SIZE)
-#define SIR_MEAS_REQ_ACTION_FRAME_SIZE         (3 + SIR_MEAS_REQ_IE_SIZE)
-#define SIR_MEAS_MAX_FRAME_SIZE                256
-#define SIR_MEAS_REPORT_MIN_FRAME_SIZE         (3 + EID_LEN(SIR_MAC_MEAS_RPT_EID_MIN))
-
-#define SIR_MAC_SET_MEAS_REQ_ENABLE(x)         (((uint8_t) x) | 2)
-#define SIR_MAC_SET_MEAS_REQ_REQUEST(x)        (((uint8_t) x) | 4)
-#define SIR_MAC_SET_MEAS_REQ_REPORT(x)         (((uint8_t) x) | 8)
-
-#define SIR_MAC_SET_MEAS_REPORT_LATE(x)        (((uint8_t) x) | 1)
-#define SIR_MAC_SET_MEAS_REPORT_INCAPABLE(x)   (((uint8_t) x) | 2)
-#define SIR_MAC_SET_MEAS_REPORT_REFUSE(x)      (((uint8_t) x) | 4)
-
-/* Length of TPC Request Action Frame */
-#define SIR_TPC_REQ_ACTION_FRAME_SIZE          (3 + EID_LEN(SIR_MAC_TPC_REQ_EID_MIN))
-#define SIR_TPC_REPORT_ACTION_FRAME_SIZE       (3 + EID_LEN(SIR_MAC_TPC_RPT_EID_MIN))
-#define SIR_TPC_MAX_FRAME_SIZE                 256
+
 /* ----------------------------------------------------------------------------- */
 
 /* OFFSET definitions for fixed fields in Management frames */
diff --git a/core/mac/inc/wni_api.h b/core/mac/inc/wni_api.h
index ca7bf580ecf1..64235814b2e9 100644
--- a/core/mac/inc/wni_api.h
+++ b/core/mac/inc/wni_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -104,7 +104,6 @@ enum eWniMsgTypes {
 	eWNI_SME_CHNG_MCC_BEACON_INTERVAL,
 	eWNI_SME_REMAIN_ON_CHANNEL_REQ,
 	eWNI_SME_REMAIN_ON_CHN_RSP,
-	eWNI_SME_MGMT_FRM_IND,
 	eWNI_SME_REMAIN_ON_CHN_RDY_IND,
 	eWNI_SME_SEND_ACTION_FRAME_IND,
 	eWNI_SME_ACTION_FRAME_SEND_CNF,
@@ -214,7 +213,6 @@ enum eWniMsgTypes {
 	eWNI_SME_SET_HT_2040_MODE,
 #endif
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	eWNI_SME_ROAM_OFFLOAD_SYNCH_IND,        /* Roam Synch Indication from WMA to SME */
 	eWNI_SME_HO_FAIL_IND,   /* Hand Off Failure Ind from WMA to SME */
 #endif
 #ifdef WLAN_FEATURE_NAN
@@ -249,6 +247,7 @@ enum eWniMsgTypes {
 	eWNI_SME_SET_IE_REQ,
 	eWNI_SME_EXT_CHANGE_CHANNEL,
 	eWNI_SME_EXT_CHANGE_CHANNEL_IND,
+	eWNI_SME_REGISTER_MGMT_FRAME_CB,
 	eWNI_SME_MSG_TYPES_END
 };
 
diff --git a/core/mac/inc/wni_cfg.h b/core/mac/inc/wni_cfg.h
index 53a1c8b77f4c..adc9e6513d56 100644
--- a/core/mac/inc/wni_cfg.h
+++ b/core/mac/inc/wni_cfg.h
@@ -1158,7 +1158,7 @@ enum {
 
 #define WNI_CFG_MPDU_DENSITY_STAMIN    0
 #define WNI_CFG_MPDU_DENSITY_STAMAX    7
-#define WNI_CFG_MPDU_DENSITY_STADEF    0
+#define WNI_CFG_MPDU_DENSITY_STADEF    7
 
 #define WNI_CFG_NUM_BUFF_ADVERT_STAMIN    0
 #define WNI_CFG_NUM_BUFF_ADVERT_STAMAX    128
diff --git a/core/mac/src/cfg/cfg_api.c b/core/mac/src/cfg/cfg_api.c
index 6e3d63e8f343..e5578431e907 100644
--- a/core/mac/src/cfg/cfg_api.c
+++ b/core/mac/src/cfg/cfg_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -572,19 +572,22 @@ tSirRetStatus wlan_cfg_get_str_len(tpAniSirGlobal pMac, uint16_t cfgId,
 
 } /*** end wlan_cfg_get_str_len() ***/
 
-/*-------------------------------------------------------------
-   \fn     cfg_get_dot11d_transmit_power
-   \brief  This function returns the regulatory max transmit power
-   \param  pMac
-   \return tPowerdBm - Power
- \-------------------------------------------------------------*/
-static tPowerdBm
+/**
+ * cfg_get_dot11d_transmit_power() - regulatory max transmit power
+ * @pMac: pointer to mac data
+ * @cfgId: configuration ID
+ * @cfgLength: configuration length
+ * @channel: channel number
+ *
+ * Return:  int8_t - power
+ */
+static int8_t
 cfg_get_dot11d_transmit_power(tpAniSirGlobal pMac, uint16_t cfgId,
 			      uint32_t cfgLength, uint8_t channel)
 {
 	uint8_t *pCountryInfo = NULL;
 	uint8_t count = 0;
-	tPowerdBm maxTxPwr = WMA_MAX_TXPOWER_INVALID;
+	int8_t maxTxPwr = WMA_MAX_TXPOWER_INVALID;
 
 	/* At least one element is present */
 	if (cfgLength < sizeof(tSirMacChanInfo)) {
@@ -644,11 +647,12 @@ error:
    \param  channel
    \param  rfBand
    -----------------------------------------------------------------------*/
-tPowerdBm cfg_get_regulatory_max_transmit_power(tpAniSirGlobal pMac, uint8_t channel)
+int8_t cfg_get_regulatory_max_transmit_power(tpAniSirGlobal pMac,
+					     uint8_t channel)
 {
 	uint32_t cfgLength = 0;
 	uint16_t cfgId = 0;
-	tPowerdBm maxTxPwr;
+	int8_t maxTxPwr;
 	eRfBandMode rfBand = eRF_BAND_UNKNOWN;
 
 	if ((channel >= SIR_11A_CHANNEL_BEGIN) &&
diff --git a/core/mac/src/include/cfg_api.h b/core/mac/src/include/cfg_api.h
index e165d5a3622d..b6ed90796e01 100644
--- a/core/mac/src/include/cfg_api.h
+++ b/core/mac/src/include/cfg_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2012,2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2012, 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -101,8 +101,8 @@ tSirRetStatus wlan_cfg_get_str_max_len(tpAniSirGlobal, uint16_t, uint32_t *);
 tSirRetStatus wlan_cfg_get_str_len(tpAniSirGlobal, uint16_t, uint32_t *);
 
 /* / Get the regulatory tx power on given channel */
-tPowerdBm cfg_get_regulatory_max_transmit_power(tpAniSirGlobal pMac,
-						uint8_t channel);
+int8_t cfg_get_regulatory_max_transmit_power(tpAniSirGlobal pMac,
+					     uint8_t channel);
 
 /* / Dump CFG data to memory */
 void cfgDump(uint32_t *);
diff --git a/core/mac/src/include/dph_global.h b/core/mac/src/include/dph_global.h
index abeacf4f521c..30a8e2903b07 100644
--- a/core/mac/src/include/dph_global.h
+++ b/core/mac/src/include/dph_global.h
@@ -240,6 +240,8 @@ typedef struct sDphHashNode {
 	uint8_t is_disassoc_deauth_in_progress;
 
 	uint8_t nss;
+	int8_t del_sta_ctx_rssi;
+
 	/*
 	 * When a station with already an existing dph entry tries to
 	 * associate again, the old dph entry will be zeroed out except
diff --git a/core/mac/src/include/sir_params.h b/core/mac/src/include/sir_params.h
index 78513a3ac805..ff6f339154e8 100644
--- a/core/mac/src/include/sir_params.h
+++ b/core/mac/src/include/sir_params.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -71,7 +71,7 @@ typedef enum {
 	PHY_CHANNEL_BONDING_STATE_MAX = 11
 } ePhyChanBondState;
 
-#define MAX_BONDED_CHANNELS 4
+#define MAX_BONDED_CHANNELS 8
 
 typedef enum {
 	MCC = 0,
@@ -579,6 +579,10 @@ typedef struct sSirMbMsgP2p {
 #define SIR_HAL_EXIT_PS_REQ                  (SIR_HAL_ITC_MSG_TYPES_BEGIN + 236)
 #define SIR_HAL_ENABLE_UAPSD_REQ             (SIR_HAL_ITC_MSG_TYPES_BEGIN + 237)
 #define SIR_HAL_DISABLE_UAPSD_REQ            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 238)
+#define SIR_HAL_GATEWAY_PARAM_UPDATE_REQ    (SIR_HAL_ITC_MSG_TYPES_BEGIN + 239)
+
+#define SIR_HAL_RUNTIME_PM_SUSPEND_IND	(SIR_HAL_ITC_MSG_TYPES_BEGIN + 308)
+#define SIR_HAL_RUNTIME_PM_RESUME_IND	(SIR_HAL_ITC_MSG_TYPES_BEGIN + 309)
 
 #define SIR_HAL_SET_EPNO_LIST_REQ          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 313)
 #define SIR_HAL_SET_PASSPOINT_LIST_REQ     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 316)
@@ -605,6 +609,8 @@ typedef struct sSirMbMsgP2p {
 
 #define SIR_HAL_LRO_CONFIG_CMD              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 335)
 
+#define SIR_HAL_SET_EGAP_CONF_PARAMS        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 336)
+
 #define SIR_HAL_MSG_TYPES_END                (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
 
 /* CFG message types */
@@ -680,9 +686,8 @@ typedef struct sSirMbMsgP2p {
 
 #define SIR_LIM_BEACON_GEN_IND          (SIR_LIM_TIMEOUT_MSG_START + 0x23)
 #define SIR_LIM_PERIODIC_PROBE_REQ_TIMEOUT    (SIR_LIM_TIMEOUT_MSG_START + 0x24)
-#ifdef FEATURE_WLAN_ESE
-#define SIR_LIM_ESE_TSM_TIMEOUT        (SIR_LIM_TIMEOUT_MSG_START + 0x25)
-#endif
+
+/* currently unused                     (SIR_LIM_TIMEOUT_MSG_START + 0x25) */
 
 #define SIR_LIM_DISASSOC_ACK_TIMEOUT       (SIR_LIM_TIMEOUT_MSG_START + 0x26)
 #define SIR_LIM_DEAUTH_ACK_TIMEOUT       (SIR_LIM_TIMEOUT_MSG_START + 0x27)
diff --git a/core/mac/src/pe/include/lim_api.h b/core/mac/src/pe/include/lim_api.h
index 99e2fc7376cc..d1d52cf2ad81 100644
--- a/core/mac/src/pe/include/lim_api.h
+++ b/core/mac/src/pe/include/lim_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -81,8 +81,6 @@
 #define GET_LIM_PROCESS_DEFD_MESGS(pMac) (pMac->lim.gLimProcessDefdMsgs)
 #define SET_LIM_PROCESS_DEFD_MESGS(pMac, val) (pMac->lim.gLimProcessDefdMsgs = val)
 /* LIM exported function templates */
-#define LIM_IS_RADAR_DETECTED(pMac)         (pMac->lim.gLimSpecMgmt.fRadarDetCurOperChan)
-#define LIM_SET_RADAR_DETECTED(pMac, val)   (pMac->lim.gLimSpecMgmt.fRadarDetCurOperChan = val)
 #define LIM_MIN_BCN_PR_LENGTH  12
 #define LIM_BCN_PR_CAPABILITY_OFFSET 10
 typedef enum eMgmtFrmDropReason {
@@ -169,7 +167,9 @@ bool lim_is_deauth_diassoc_for_drop(tpAniSirGlobal mac, uint8_t *rx_pkt_info);
 bool lim_is_assoc_req_for_drop(tpAniSirGlobal mac, uint8_t *rx_pkt_info);
 #endif
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-void lim_roam_offload_synch_ind(tpAniSirGlobal pMac, tpSirMsgQ pMsg);
+CDF_STATUS pe_roam_synch_callback(tpAniSirGlobal mac_ctx,
+	struct sSirSmeRoamOffloadSynchInd *roam_sync_ind_ptr,
+	tpSirBssDescription  bss_desc_ptr);
 #endif
 #define limGetQosMode(psessionEntry, pVal) (*(pVal) = (psessionEntry)->limQosEnabled)
 #define limGetWmeMode(psessionEntry, pVal) (*(pVal) = (psessionEntry)->limWmeEnabled)
@@ -246,6 +246,13 @@ void lim_process_abort_scan_ind(tpAniSirGlobal pMac, uint8_t sessionId,
 	uint32_t scan_id);
 
 void __lim_process_sme_assoc_cnf_new(tpAniSirGlobal, uint32_t, uint32_t *);
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+void lim_fill_join_rsp_ht_caps(tpPESession session, tpSirSmeJoinRsp rsp);
+#else
+static inline void lim_fill_join_rsp_ht_caps(tpPESession session,
+	tpSirSmeJoinRsp rsp)
+{}
+#endif
 
 /************************************************************/
 #endif /* __LIM_API_H */
diff --git a/core/mac/src/pe/include/lim_ft_defs.h b/core/mac/src/pe/include/lim_ft_defs.h
index da4f11f7a27c..599da6fa34df 100644
--- a/core/mac/src/pe/include/lim_ft_defs.h
+++ b/core/mac/src/pe/include/lim_ft_defs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -41,7 +41,6 @@
 /*--------------------------------------------------------------------------
    Preprocessor definitions and constants
    ------------------------------------------------------------------------*/
-#define SIR_MDIE_SIZE               3   /* MD ID(2 bytes), Capability(1 byte) */
 #define MAX_FTIE_SIZE             384   /* Max size limited to 384, on acct. of IW custom events */
 
 /*--------------------------------------------------------------------------
@@ -89,7 +88,7 @@ typedef struct sSirFTUpdateKeyInfo {
 	uint16_t messageType;
 	uint16_t length;
 	uint32_t smeSessionId;
-	tSirMacAddr bssId;
+	struct cdf_mac_addr bssid;
 	tSirKeyMaterial keyMaterial;
 } tSirFTUpdateKeyInfo, *tpSirFTUpdateKeyInfo;
 
diff --git a/core/mac/src/pe/include/lim_global.h b/core/mac/src/pe/include/lim_global.h
index c40bb1cef5dd..3969a17599ca 100644
--- a/core/mac/src/pe/include/lim_global.h
+++ b/core/mac/src/pe/include/lim_global.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -51,9 +51,6 @@
 #include "dot11f.h"
 #include "wma_if.h"
 
-/* / Maximum number of scan hash table entries */
-#define LIM_MAX_NUM_OF_SCAN_RESULTS 256
-
 /* Sending Disassociate frames threshold */
 #define LIM_SEND_DISASSOC_FRAME_THRESHOLD       2
 #define LIM_HASH_MISS_TIMER_MS                  10000
@@ -74,9 +71,6 @@
 	((LIntrvl * LIM_TIM_WAIT_COUNT_FACTOR) > LIM_MIN_TIM_WAIT_COUNT ? \
 	(LIntrvl * LIM_TIM_WAIT_COUNT_FACTOR) : LIM_MIN_TIM_WAIT_COUNT)
 
-#define IS_5G_BAND(__rfBand)     ((__rfBand & 0x3) == 0x2)
-#define IS_24G_BAND(__rfBand)    ((__rfBand & 0x3) == 0x1)
-
 #define LIM_MAX_CSA_IE_UPDATES    (5)
 
 /* enums exported by LIM are as follows */
@@ -307,10 +301,12 @@ struct tLimScanResultNode {
 /* OEM Data related structure definitions */
 typedef struct sLimMlmOemDataReq {
 	struct cdf_mac_addr selfMacAddr;
-	uint8_t oemDataReq[OEM_DATA_REQ_SIZE];
+	uint8_t data_len;
+	uint8_t *data;
 } tLimMlmOemDataReq, *tpLimMlmOemDataReq;
 
 typedef struct sLimMlmOemDataRsp {
+	bool target_rsp;
 	uint8_t oemDataRsp[OEM_DATA_RSP_SIZE];
 } tLimMlmOemDataRsp, *tpLimMlmOemDataRsp;
 #endif
@@ -510,6 +506,7 @@ typedef struct sLimChannelSwitchInfo {
 	uint8_t primaryChannel;
 	uint8_t ch_center_freq_seg0;
 	uint8_t ch_center_freq_seg1;
+	uint8_t sec_ch_offset;
 	phy_ch_width ch_width;
 	int8_t switchCount;
 	uint32_t switchTimeoutValue;
diff --git a/core/mac/src/pe/include/lim_session.h b/core/mac/src/pe/include/lim_session.h
index 5d27af28a009..e5847c000262 100644
--- a/core/mac/src/pe/include/lim_session.h
+++ b/core/mac/src/pe/include/lim_session.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -65,7 +65,8 @@ typedef struct tagComebackTimerInfo {
 /*--------------------------------------------------------------------------
    Preprocessor definitions and constants
    ------------------------------------------------------------------------*/
-#define NUM_WEP_KEYS 4
+/* Maximum Number of WEP KEYS */
+#define MAX_WEP_KEYS 4
 
 /* Maximum allowable size of a beacon frame */
 #define SCH_MAX_BEACON_SIZE    512
@@ -251,7 +252,7 @@ typedef struct sPESession       /* Added to Support BT-AMP */
 
 	uint8_t privacy;
 	tAniAuthType authType;
-	tSirKeyMaterial WEPKeyMaterial[NUM_WEP_KEYS];
+	tSirKeyMaterial WEPKeyMaterial[MAX_WEP_KEYS];
 
 	tDot11fIERSN gStartBssRSNIe;
 	tDot11fIEWPA gStartBssWPAIe;
@@ -275,10 +276,11 @@ typedef struct sPESession       /* Added to Support BT-AMP */
 #endif
 	uint32_t lim11hEnable;
 
-	tPowerdBm maxTxPower;   /* MIN (Regulatory and local power constraint) */
-	tCDF_CON_MODE pePersona;
+	int8_t maxTxPower;   /* MIN (Regulatory and local power constraint) */
+	enum tCDF_ADAPTER_MODE pePersona;
+
 #if defined WLAN_FEATURE_VOWIFI
-	tPowerdBm txMgmtPower;
+	int8_t txMgmtPower;
 #endif
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
@@ -328,6 +330,7 @@ typedef struct sPESession       /* Added to Support BT-AMP */
 	phy_ch_width ch_width;
 	uint8_t ch_center_freq_seg1;
 	uint8_t txBFIniFeatureEnabled;
+	uint8_t txbf_csn_value;
 	uint8_t txMuBformee;
 	uint8_t enableVhtpAid;
 	uint8_t enableVhtGid;
@@ -483,6 +486,7 @@ typedef struct sPESession       /* Added to Support BT-AMP */
 	/* flag to indicate country code in beacon */
 	uint8_t country_info_present;
 	uint8_t nss;
+	bool add_bss_failed;
 } tPESession, *tpPESession;
 
 /*-------------------------------------------------------------------------
diff --git a/core/mac/src/pe/include/rrm_api.h b/core/mac/src/pe/include/rrm_api.h
index 849fa5c17919..998364e121de 100644
--- a/core/mac/src/pe/include/rrm_api.h
+++ b/core/mac/src/pe/include/rrm_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2012, 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2012, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -45,8 +45,8 @@
 #define RRM_BCN_RPT_NO_BSS_INFO    0
 #define RRM_BCN_RPT_MIN_RPT        1
 
-uint8_t rrm_get_min_of_max_tx_power(tpAniSirGlobal pMac, tPowerdBm regMax,
-				    tPowerdBm apTxPower);
+uint8_t rrm_get_min_of_max_tx_power(tpAniSirGlobal pMac, int8_t regMax,
+				    int8_t apTxPower);
 
 extern tSirRetStatus rrm_initialize(tpAniSirGlobal pMac);
 
@@ -75,14 +75,14 @@ extern tSirRetStatus rrm_process_neighbor_report_response(tpAniSirGlobal pMac,
 extern void rrm_process_message(tpAniSirGlobal pMac, tpSirMsgQ pMsg);
 
 extern tSirRetStatus rrm_send_set_max_tx_power_req(tpAniSirGlobal pMac,
-						   tPowerdBm txPower,
+						   int8_t txPower,
 						   tpPESession pSessionEntry);
 
-extern tPowerdBm rrm_get_mgmt_tx_power(tpAniSirGlobal pMac,
+extern int8_t rrm_get_mgmt_tx_power(tpAniSirGlobal pMac,
 				       tpPESession pSessionEntry);
 
 extern void rrm_cache_mgmt_tx_power(tpAniSirGlobal pMac,
-				    tPowerdBm txPower, tpPESession pSessionEntry);
+				    int8_t txPower, tpPESession pSessionEntry);
 
 extern tpRRMCaps rrm_get_capabilities(tpAniSirGlobal pMac,
 				      tpPESession pSessionEntry);
diff --git a/core/mac/src/pe/include/rrm_global.h b/core/mac/src/pe/include/rrm_global.h
index a1db83544444..6d829fffa999 100644
--- a/core/mac/src/pe/include/rrm_global.h
+++ b/core/mac/src/pe/include/rrm_global.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2012, 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2012, 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -214,7 +214,7 @@ typedef struct sRrmPEContext {
 	 * gets it from bss decsription.
 	 */
 	tRRMCaps rrmEnabledCaps;
-	tPowerdBm txMgmtPower;
+	int8_t txMgmtPower;
 	/* Dialog token for the request initiated from station. */
 	uint8_t DialogToken;
 	tpRRMReq pCurrentReq;
diff --git a/core/mac/src/pe/lim/lim_api.c b/core/mac/src/pe/lim/lim_api.c
index 2ed29da641de..2584645074bf 100644
--- a/core/mac/src/pe/lim/lim_api.c
+++ b/core/mac/src/pe/lim/lim_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -260,6 +260,8 @@ static void __lim_init_vars(tpAniSirGlobal pMac)
 	pMac->lim.gScanInPowersave = 0;
 	pMac->lim.probeCounter = 0;
 	pMac->lim.maxProbe = 0;
+
+	pMac->lim.gpLimMlmOemDataReq = NULL;
 }
 
 static void __lim_init_assoc_vars(tpAniSirGlobal pMac)
@@ -449,22 +451,24 @@ static tSirRetStatus __lim_init_config(tpAniSirGlobal pMac)
 
 	if (wlan_cfg_get_int(pMac, WNI_CFG_HT_AMPDU_PARAMS, &val1) !=
 	    eSIR_SUCCESS) {
-		PELOGE(lim_log
-			       (pMac, LOGE,
-			       FL("could not retrieve HT AMPDU Param CFG"));
-		       )
+		lim_log(pMac, LOGE, FL("could not retrieve HT AMPDU Param"));
 		return eSIR_FAILURE;
 	}
 	if (wlan_cfg_get_int(pMac, WNI_CFG_MAX_RX_AMPDU_FACTOR, &val2) !=
 	    eSIR_SUCCESS) {
-		PELOGE(lim_log
-			       (pMac, LOGE, FL("could not retrieve AMPDU Factor CFG"));
-		       )
+		lim_log(pMac, LOGE, FL("could not retrieve AMPDU Factor CFG"));
+		return eSIR_FAILURE;
+	}
+	if (wlan_cfg_get_int(pMac, WNI_CFG_MPDU_DENSITY, &val3) !=
+	    eSIR_SUCCESS) {
+		lim_log(pMac, LOGE, FL("could not retrieve MPDU Density CFG"));
 		return eSIR_FAILURE;
 	}
+
 	val16 = (uint16_t) val1;
 	pAmpduParamInfo = (tSirMacHTParametersInfo *) &val16;
 	pAmpduParamInfo->maxRxAMPDUFactor = (uint8_t) val2;
+	pAmpduParamInfo->mpduDensity = (uint8_t)val3;
 	if (cfg_set_int
 		    (pMac, WNI_CFG_HT_AMPDU_PARAMS,
 		    *(uint8_t *) pAmpduParamInfo) != eSIR_SUCCESS) {
@@ -653,7 +657,7 @@ void lim_cleanup(tpAniSirGlobal pMac)
 
 	struct mgmt_frm_reg_info *pLimMgmtRegistration = NULL;
 
-	if (CDF_FTM_MODE != cds_get_conparam()) {
+	if (CDF_GLOBAL_FTM_MODE != cds_get_conparam()) {
 		cdf_mutex_acquire(&pMac->lim.lim_frame_register_lock);
 		while (cdf_list_remove_front(
 			&pMac->lim.gLimMgmtFrameRegistratinQueue,
@@ -668,7 +672,6 @@ void lim_cleanup(tpAniSirGlobal pMac)
 	}
 
 	lim_cleanup_mlm(pMac);
-	lim_cleanup_lmm(pMac);
 
 	/* free up preAuth table */
 	if (pMac->lim.gLimPreAuthTimerTable.pTable != NULL) {
@@ -817,6 +820,11 @@ tSirRetStatus pe_close(tpAniSirGlobal pMac)
 	pMac->lim.limTimers.gpLimCnfWaitTimer = NULL;
 
 	if (pMac->lim.gpLimMlmOemDataReq) {
+		if (pMac->lim.gpLimMlmOemDataReq->data) {
+			cdf_mem_free(
+				pMac->lim.gpLimMlmOemDataReq->data);
+			pMac->lim.gpLimMlmOemDataReq->data = NULL;
+		}
 		cdf_mem_free(pMac->lim.gpLimMlmOemDataReq);
 		pMac->lim.gpLimMlmOemDataReq = NULL;
 	}
@@ -1068,10 +1076,11 @@ CDF_STATUS pe_handle_mgmt_frame(void *p_cds_gctx, void *cds_buff)
 /**
  * pe_register_wma_handle() - register management frame handler to WMA
  * @pMac: mac global ctx
+ * @ready_req: Ready request parameters
  *
  * Return: None
  */
-void pe_register_wma_handle(tpAniSirGlobal pMac)
+void pe_register_wma_handle(tpAniSirGlobal pMac, tSirSmeReadyReq *ready_req)
 {
 	void *p_cds_gctx;
 	CDF_STATUS retStatus;
@@ -1084,6 +1093,12 @@ void pe_register_wma_handle(tpAniSirGlobal pMac)
 		lim_log(pMac, LOGP,
 			FL("Registering the PE Handle with WMA has failed"));
 
+	retStatus = wma_register_roaming_callbacks(p_cds_gctx,
+			ready_req->csr_roam_synch_cb,
+			ready_req->pe_roam_synch_cb);
+	if (retStatus != CDF_STATUS_SUCCESS)
+		lim_log(pMac, LOGP,
+			FL("Registering roaming callbacks with WMA failed"));
 }
 
 /**
@@ -1402,7 +1417,7 @@ lim_handle_ibss_coalescing(tpAniSirGlobal pMac,
 	   4. Encyption type in the beacon does not match with self station
 	 */
 	if ((!pBeacon->capabilityInfo.ibss) ||
-	    (lim_cmp_s_sid(pMac, &pBeacon->ssId, psessionEntry) != true) ||
+	    (lim_cmp_ssid(&pBeacon->ssId, psessionEntry) != true) ||
 	    (psessionEntry->currentOperChannel != pBeacon->channelNumber))
 		retCode = eSIR_LIM_IGNORE_BEACON;
 	else if (lim_ibss_enc_type_matched(pBeacon, psessionEntry) != eSIR_TRUE) {
@@ -1538,7 +1553,7 @@ lim_detect_change_in_ap_capabilities(tpAniSirGlobal pMac,
 						     psessionEntry);
 	if ((false == psessionEntry->limSentCapsChangeNtf) &&
 	    (((!lim_is_null_ssid(&pBeacon->ssId)) &&
-	       (false == lim_cmp_s_sid(pMac, &pBeacon->ssId, psessionEntry))) ||
+	       (false == lim_cmp_ssid(&pBeacon->ssId, psessionEntry))) ||
 	     ((SIR_MAC_GET_ESS(apNewCaps.capabilityInfo) !=
 	       SIR_MAC_GET_ESS(psessionEntry->limCurrentBssCaps)) ||
 	      (SIR_MAC_GET_PRIVACY(apNewCaps.capabilityInfo) !=
@@ -1783,15 +1798,54 @@ void lim_ps_offload_handle_missed_beacon_ind(tpAniSirGlobal pMac, tpSirMsgQ pMsg
 	return;
 }
 
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+/**
+ * lim_fill_join_rsp_ht_caps() - Fill the HT caps in join response
+ * @session: PE Session
+ * @join_rsp: Join response buffer to be filled up.
+ *
+ * Return: None
+ */
+void lim_fill_join_rsp_ht_caps(tpPESession session, tpSirSmeJoinRsp join_rsp)
+{
+	tSirSmeHTProfile *ht_profile;
+	if (session == NULL) {
+		lim_log(mac_ctx, LOGE, FL("Invalid Session"));
+		return;
+	}
+	if (join_rsp == NULL) {
+		lim_log(mac_ctx, LOGE, FL("Invalid Join Response"));
+		return;
+	}
+	if (session->cc_switch_mode !=
+			CDF_MCC_TO_SCC_SWITCH_DISABLE) {
+		ht_profile = &join_rsp->HTProfile;
+		ht_profile->htSupportedChannelWidthSet =
+			session->htSupportedChannelWidthSet;
+		ht_profile->htRecommendedTxWidthSet =
+			session->htRecommendedTxWidthSet;
+		ht_profile->htSecondaryChannelOffset =
+			session->htSecondaryChannelOffset;
+		ht_profile->dot11mode = session->dot11mode;
+		ht_profile->htCapability = session->htCapability;
+	}
+	ht_profile->vhtCapability = session->vhtCapability;
+	ht_profile->vhtTxChannelWidthSet =
+		session->vhtTxChannelWidthSet;
+	ht_profile->apCenterChan = session->ch_center_freq_seg0;
+	ht_profile->apChanWidth = session->ch_width;
+}
+#endif
+
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 CDF_STATUS lim_roam_fill_bss_descr(tpAniSirGlobal pMac,
-		roam_offload_synch_ind *roam_offload_synch_ind_ptr)
+		roam_offload_synch_ind *roam_offload_synch_ind_ptr,
+		tpSirBssDescription  bss_desc_ptr)
 {
 	uint32_t ie_len = 0;
 	tpSirProbeRespBeacon parsed_frm_ptr;
 	tpSirMacMgmtHdr mac_hdr;
 	uint8_t *bcn_proberesp_ptr;
-	tSirBssDescription *bss_desc_ptr = NULL;
 
 	bcn_proberesp_ptr = (uint8_t *)roam_offload_synch_ind_ptr +
 		roam_offload_synch_ind_ptr->beaconProbeRespOffset;
@@ -1813,7 +1867,7 @@ CDF_STATUS lim_roam_fill_bss_descr(tpAniSirGlobal pMac,
 	}
 
 	CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_INFO,
-		"LFR3: Beacon/Prb Rsp:");
+		"LFR3:Beacon/Prb Rsp:%d", roam_offload_synch_ind_ptr->isBeacon);
 	CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_INFO,
 	bcn_proberesp_ptr, roam_offload_synch_ind_ptr->beaconProbeRespLength);
 	if (roam_offload_synch_ind_ptr->isBeacon) {
@@ -1849,20 +1903,6 @@ CDF_STATUS lim_roam_fill_bss_descr(tpAniSirGlobal pMac,
 			(SIR_MAC_HDR_LEN_3A + SIR_MAC_B_PR_SSID_OFFSET);
 	}
 	/*
-	 * Memory allocated below is freed up in csrProcessRoamOffloadSynchInd
-	 */
-	roam_offload_synch_ind_ptr->bss_desc_ptr =
-		cdf_mem_malloc(sizeof (tSirBssDescription) + ie_len);
-	bss_desc_ptr = roam_offload_synch_ind_ptr->bss_desc_ptr;
-	if (NULL == bss_desc_ptr) {
-		CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
-				"LFR3:Failed to allocate memory");
-		CDF_ASSERT(bss_desc_ptr != NULL);
-		return CDF_STATUS_E_NOMEM;
-	}
-	cdf_mem_zero(bss_desc_ptr, sizeof(tSirBssDescription));
-
-	/*
 	 * Length of BSS desription is without length of
 	 * length itself and length of pointer
 	 * that holds ieFields
@@ -1947,104 +1987,159 @@ CDF_STATUS lim_roam_fill_bss_descr(tpAniSirGlobal pMac,
 	cdf_mem_free(parsed_frm_ptr);
 	return CDF_STATUS_SUCCESS;
 }
-
-/**-----------------------------------------------------------------
-  * brief lim_roam_offload_synch_ind() - Handles Roam Synch Indication
-  * param pMac - global mac structure
-  * return - none
-  *-----------------------------------------------------------------
-  **/
-void lim_roam_offload_synch_ind(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
+/**
+ * pe_roam_synch_callback() - PE level callback for roam synch propagation
+ * @mac_ctx: MAC Context
+ * @roam_sync_ind_ptr: Roam synch indication buffer pointer
+ * @bss_desc: BSS Descriptor pointer
+ *
+ * This is a PE level callback called from WMA to complete the roam synch
+ * propagation at PE level and also fill the BSS descriptor which will be
+ * helpful further to complete the roam synch propagation.
+ *
+ * Return: Success or Failure status
+ */
+CDF_STATUS pe_roam_synch_callback(tpAniSirGlobal mac_ctx,
+	roam_offload_synch_ind *roam_sync_ind_ptr,
+	tpSirBssDescription  bss_desc)
 {
 	tpPESession session_ptr;
 	tpPESession ft_session_ptr;
 	uint8_t session_id;
-	tSirMsgQ mmh_msg;
-	tSirBssDescription *bss_desc_ptr = NULL;
-	roam_offload_synch_ind *roam_sync_ind_ptr =
-		(roam_offload_synch_ind *)pMsg->bodyptr;
+	tpDphHashNode curr_sta_ds;
+	uint16_t aid;
+	tpAddBssParams add_bss_params;
+	uint8_t local_nss;
+	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 
 	if (!roam_sync_ind_ptr) {
-		CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
-				"LFR3:%s:roam_sync_ind_ptr is NULL", __func__);
-		return;
+		lim_log(mac_ctx, LOGE, FL("LFR3:roam_sync_ind_ptr is NULL"));
+		return status;
 	}
-	CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
-			"LFR3: Received WMA_ROAM_OFFLOAD_SYNCH_IND");
-	CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_DEBUG,
-			"LFR3:%s:authStatus=%d, vdevId=%d", __func__,
-			roam_sync_ind_ptr->authStatus,
-			roam_sync_ind_ptr->roamedVdevId);
-	CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_DEBUG,
-			roam_sync_ind_ptr->bssId, 6);
-	session_ptr = pe_find_session_by_bss_idx(pMac,
-			roam_sync_ind_ptr->roamedVdevId);
+	lim_log(mac_ctx, LOGE, FL("LFR3:Received WMA_ROAM_OFFLOAD_SYNCH_IND"));
+	lim_log(mac_ctx, CDF_TRACE_LEVEL_DEBUG, FL("LFR3:auth=%d, vdevId=%d"),
+		roam_sync_ind_ptr->authStatus, roam_sync_ind_ptr->roamedVdevId);
+	lim_print_mac_addr(mac_ctx, roam_sync_ind_ptr->bssid.bytes,
+			CDF_TRACE_LEVEL_DEBUG);
+	session_ptr = pe_find_session_by_sme_session_id(mac_ctx,
+				roam_sync_ind_ptr->roamedVdevId);
 	if (session_ptr == NULL) {
-		CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
-			"%s: LFR3:Unable to find session", __func__);
-		return;
+		lim_log(mac_ctx, LOGE, FL("LFR3:Unable to find session"));
+		return status;
 	}
-	/* Nothing to be done if the session is not in STA mode */
 	if (!LIM_IS_STA_ROLE(session_ptr)) {
-		CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
-				"session is not in STA mode");
-		return;
+		lim_log(mac_ctx, LOGE, FL("LFR3:session is not in STA mode"));
+		return status;
 	}
-	if (!CDF_IS_STATUS_SUCCESS(lim_roam_fill_bss_descr(pMac,
-					roam_sync_ind_ptr))) {
-		CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
-				"LFR3:%s:Failed to fill Bss Descr", __func__);
-		return;
+	status = lim_roam_fill_bss_descr(mac_ctx, roam_sync_ind_ptr, bss_desc);
+	if (!CDF_IS_STATUS_SUCCESS(status)) {
+		lim_log(mac_ctx, LOGE, FL("LFR3:Failed to fill Bss Descr"));
+		return status;
 	}
-	bss_desc_ptr = roam_sync_ind_ptr->bss_desc_ptr;
-	ft_session_ptr = pe_create_session(pMac, bss_desc_ptr->bssId,
-				&session_id, pMac->lim.maxStation,
-				eSIR_INFRASTRUCTURE_MODE);
+	status = CDF_STATUS_E_FAILURE;
+	ft_session_ptr = pe_create_session(mac_ctx, bss_desc->bssId,
+			&session_id, mac_ctx->lim.maxStation,
+			eSIR_INFRASTRUCTURE_MODE);
 	if (ft_session_ptr == NULL) {
-		CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
-		"LFR3: Session Can't be created for new AP during Roam Synch");
-		lim_print_mac_addr(pMac, bss_desc_ptr->bssId, LOGE);
-		return;
+		lim_log(mac_ctx, LOGE, FL("LFR3:Cannot create PE Session"));
+		lim_print_mac_addr(mac_ctx, bss_desc->bssId, LOGE);
+		return status;
 	}
 	ft_session_ptr->peSessionId = session_id;
 	sir_copy_mac_addr(ft_session_ptr->selfMacAddr, session_ptr->selfMacAddr);
-	sir_copy_mac_addr(ft_session_ptr->limReAssocbssId, bss_desc_ptr->bssId);
+	sir_copy_mac_addr(ft_session_ptr->limReAssocbssId, bss_desc->bssId);
 	ft_session_ptr->bssType = eSIR_INFRASTRUCTURE_MODE;
-	/**
-	 * Set bRoamSynchInProgress here since this session is
-	 *specific to roam synch indication. This flag will
-	 *later be used to differentiate LFR3 with LFR2 in LIM
-	 **/
+	session_ptr->bRoamSynchInProgress = true;
 	ft_session_ptr->bRoamSynchInProgress = true;
-
-	if (ft_session_ptr->bssType == eSIR_INFRASTRUCTURE_MODE) {
-		ft_session_ptr->limSystemRole = eLIM_STA_ROLE;
-	} else {
-		CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
-		"LFR3:Invalid bss type");
-		return;
+	ft_session_ptr->limSystemRole = eLIM_STA_ROLE;
+	sir_copy_mac_addr(session_ptr->limReAssocbssId, bss_desc->bssId);
+	ft_session_ptr->csaOffloadEnable = session_ptr->csaOffloadEnable;
+
+	lim_fill_ft_session(mac_ctx, bss_desc, ft_session_ptr, session_ptr);
+	lim_ft_prepare_add_bss_req(mac_ctx, false, ft_session_ptr, bss_desc);
+	roam_sync_ind_ptr->add_bss_params =
+		(tpAddBssParams) ft_session_ptr->ftPEContext.pAddBssReq;
+	add_bss_params = ft_session_ptr->ftPEContext.pAddBssReq;
+	lim_delete_tdls_peers(mac_ctx, session_ptr);
+	curr_sta_ds = dph_lookup_hash_entry(mac_ctx, session_ptr->bssId,
+			&aid, &session_ptr->dph.dphHashTable);
+	local_nss = curr_sta_ds->nss;
+	session_ptr->limSmeState = eLIM_SME_IDLE_STATE;
+	lim_cleanup_rx_path(mac_ctx, curr_sta_ds, session_ptr);
+	lim_delete_dph_hash_entry(mac_ctx, curr_sta_ds->staAddr,
+			aid, session_ptr);
+	pe_delete_session(mac_ctx, session_ptr);
+	session_ptr = NULL;
+	ft_session_ptr->nss = local_nss;
+	curr_sta_ds = dph_add_hash_entry(mac_ctx,
+			roam_sync_ind_ptr->bssid.bytes, DPH_STA_HASH_INDEX_PEER,
+			&ft_session_ptr->dph.dphHashTable);
+	if (curr_sta_ds == NULL) {
+		lim_log(mac_ctx, LOGE, FL("LFR3:failed to add hash entry for"));
+		lim_print_mac_addr(mac_ctx,
+				add_bss_params->staContext.staMac, LOGE);
+		ft_session_ptr->bRoamSynchInProgress = false;
+		return status;
 	}
-	ft_session_ptr->limPrevSmeState = ft_session_ptr->limSmeState;
-	ft_session_ptr->limSmeState = eLIM_SME_WT_REASSOC_STATE;
-	CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_DEBUG,
-			"LFR3:%s:created session (%p) with id = %d",
-			__func__, ft_session_ptr, ft_session_ptr->peSessionId);
-	/* Update the ReAssoc BSSID of the current session */
-	sir_copy_mac_addr(session_ptr->limReAssocbssId, bss_desc_ptr->bssId);
-	lim_print_mac_addr(pMac, session_ptr->limReAssocbssId, LOG2);
-
-	/* Prepare the session right now with as much as possible */
-	lim_fill_ft_session(pMac, bss_desc_ptr, ft_session_ptr, session_ptr);
-	lim_ft_prepare_add_bss_req(pMac, false, ft_session_ptr, bss_desc_ptr);
-	mmh_msg.type =
-		roam_sync_ind_ptr->messageType;
-	/* eWNI_SME_ROAM_OFFLOAD_SYNCH_IND */
-	mmh_msg.bodyptr = roam_sync_ind_ptr;
-	mmh_msg.bodyval = 0;
+	ft_session_ptr->bssIdx = (uint8_t) add_bss_params->bssIdx;
+
+	curr_sta_ds->bssId = add_bss_params->bssIdx;
+	curr_sta_ds->staIndex =
+		add_bss_params->staContext.staIdx;
+	curr_sta_ds->ucUcastSig =
+		add_bss_params->staContext.ucUcastSig;
+	curr_sta_ds->ucBcastSig =
+		add_bss_params->staContext.ucBcastSig;
+	rrm_cache_mgmt_tx_power(mac_ctx,
+		add_bss_params->txMgmtPower, ft_session_ptr);
+	mac_ctx->roam.reassocRespLen = roam_sync_ind_ptr->reassocRespLength;
+	mac_ctx->roam.pReassocResp =
+		cdf_mem_malloc(mac_ctx->roam.reassocRespLen);
+	if (NULL == mac_ctx->roam.pReassocResp) {
+		lim_log(mac_ctx, LOGE, FL("LFR3:assoc resp mem alloc failed"));
+		ft_session_ptr->bRoamSynchInProgress = false;
+		return CDF_STATUS_E_NOMEM;
+	}
+	cdf_mem_copy(mac_ctx->roam.pReassocResp,
+			(uint8_t *)roam_sync_ind_ptr +
+			roam_sync_ind_ptr->reassocRespOffset,
+			mac_ctx->roam.reassocRespLen);
 
-	CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_DEBUG,
-		"LFR3:%s:sending eWNI_SME_ROAM_OFFLOAD_SYNCH_IND", __func__);
-	lim_sys_process_mmh_msg_api(pMac, &mmh_msg,  ePROT);
+	lim_log(mac_ctx, LOG1, FL("LFR3:the reassoc resp frame data:"));
+	CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO,
+			mac_ctx->roam.pReassocResp,
+			mac_ctx->roam.reassocRespLen);
+	ft_session_ptr->bRoamSynchInProgress = true;
+	lim_process_assoc_rsp_frame(mac_ctx, mac_ctx->roam.pReassocResp,
+			LIM_REASSOC, ft_session_ptr);
+	roam_sync_ind_ptr->aid = ft_session_ptr->limAID;
+	curr_sta_ds->mlmStaContext.mlmState =
+		eLIM_MLM_LINK_ESTABLISHED_STATE;
+	curr_sta_ds->nss = local_nss;
+	ft_session_ptr->limMlmState = eLIM_MLM_LINK_ESTABLISHED_STATE;
+	lim_init_tdls_data(mac_ctx, ft_session_ptr);
+	roam_sync_ind_ptr->join_rsp->vht_channel_width =
+		ft_session_ptr->ch_width;
+	roam_sync_ind_ptr->join_rsp->staId = curr_sta_ds->staIndex;
+	roam_sync_ind_ptr->join_rsp->ucastSig = curr_sta_ds->ucUcastSig;
+	roam_sync_ind_ptr->join_rsp->bcastSig = curr_sta_ds->ucBcastSig;
+	roam_sync_ind_ptr->join_rsp->timingMeasCap = curr_sta_ds->timingMeasCap;
+	roam_sync_ind_ptr->join_rsp->nss = curr_sta_ds->nss;
+	roam_sync_ind_ptr->join_rsp->max_rate_flags =
+		lim_get_max_rate_flags(mac_ctx, curr_sta_ds);
+	roam_sync_ind_ptr->join_rsp->tdls_prohibited =
+		ft_session_ptr->tdls_prohibited;
+	roam_sync_ind_ptr->join_rsp->tdls_chan_swit_prohibited =
+		ft_session_ptr->tdls_chan_swit_prohibited;
+	roam_sync_ind_ptr->join_rsp->aid = ft_session_ptr->limAID;
+	lim_fill_join_rsp_ht_caps(ft_session_ptr, roam_sync_ind_ptr->join_rsp);
+	ft_session_ptr->limPrevSmeState = ft_session_ptr->limSmeState;
+	ft_session_ptr->limSmeState = eLIM_SME_LINK_EST_STATE;
+	ft_session_ptr->bRoamSynchInProgress = false;
+	if (mac_ctx->roam.pReassocResp)
+		cdf_mem_free(mac_ctx->roam.pReassocResp);
+	mac_ctx->roam.pReassocResp = NULL;
+	return CDF_STATUS_SUCCESS;
 }
 #endif
 
diff --git a/core/mac/src/pe/lim/lim_assoc_utils.c b/core/mac/src/pe/lim/lim_assoc_utils.c
index acb078cd5de0..9637e85a07d6 100644
--- a/core/mac/src/pe/lim/lim_assoc_utils.c
+++ b/core/mac/src/pe/lim/lim_assoc_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -85,38 +85,20 @@ lim_fill_supported_rates_info(tpAniSirGlobal pMac,
 }
 
 /**
- * lim_cmp_s_sid()
+ * lim_cmp_ssid() - utility function to compare SSIDs
+ * @rx_ssid: Received SSID
+ * @session_entry: Session entry
  *
- ***FUNCTION:
  * This function is called in various places within LIM code
- * to determine whether received SSid is same as SSID in use.
- *
- ***LOGIC:
- *
- ***ASSUMPTIONS:
- * NA
- *
- ***NOTE:
- * NA
+ * to determine whether received SSID is same as SSID in use.
  *
- * @param  *prxSSid - pointer to SSID structure
- *
- * @return status - true for SSID match else false.
+ * Return: true if SSID matched, false otherwise.
  */
-
-uint8_t
-lim_cmp_s_sid(tpAniSirGlobal pMac, tSirMacSSid *prxSSid,
-	      tpPESession psessionEntry)
+bool lim_cmp_ssid(tSirMacSSid *rx_ssid, tpPESession session_entry)
 {
-
-	if (cdf_mem_compare
-		    ((uint8_t *) prxSSid, (uint8_t *) &psessionEntry->ssId,
-		    (uint8_t) (psessionEntry->ssId.length + 1)))
-		return true;
-	else
-		return false;
-
-} /****** end lim_cmp_s_sid() ******/
+	return cdf_mem_compare(rx_ssid, &session_entry->ssId,
+				session_entry->ssId.length);
+}
 
 /**
  * lim_compare_capabilities()
@@ -646,6 +628,10 @@ lim_cleanup_rx_path(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 	 * releases those BDs
 	 */
 	pStaDs->valid = 0;
+	lim_send_sme_tsm_ie_ind(pMac, psessionEntry, 0, 0, 0);
+	/* Any roaming related changes should be above this line */
+	if (psessionEntry->bRoamSynchInProgress)
+		return eSIR_SUCCESS;
 	pStaDs->mlmStaContext.mlmState = eLIM_MLM_WT_DEL_STA_RSP_STATE;
 
 	if (LIM_IS_STA_ROLE(psessionEntry) ||
@@ -660,71 +646,54 @@ lim_cleanup_rx_path(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 		pMac->lim.gLastBeaconDtimCount = 0;
 		pMac->lim.gLastBeaconDtimPeriod = 0;
 
-#ifdef FEATURE_WLAN_ESE
-#ifdef FEATURE_WLAN_ESE_UPLOAD
-		lim_send_sme_tsm_ie_ind(pMac, psessionEntry, 0, 0, 0);
-#else
-		lim_deactivate_and_change_timer(pMac, eLIM_TSM_TIMER);
-#endif /* FEATURE_WLAN_ESE_UPLOAD */
-#endif
 
 	}
 #ifdef WLAN_DEBUG
 	/* increment a debug count */
 	pMac->lim.gLimNumRxCleanup++;
 #endif
-
-	if (psessionEntry->limSmeState == eLIM_SME_JOIN_FAILURE_STATE) {
-		retCode =
-			lim_del_bss(pMac, pStaDs, psessionEntry->bssIdx,
-				    psessionEntry);
-	} else
-		retCode = lim_del_sta(pMac, pStaDs, true, psessionEntry);
+	/* Do DEL BSS or DEL STA only if ADD BSS was success */
+	if (!psessionEntry->add_bss_failed) {
+		if (psessionEntry->limSmeState == eLIM_SME_JOIN_FAILURE_STATE) {
+			retCode =
+				lim_del_bss(pMac, pStaDs, psessionEntry->bssIdx,
+					    psessionEntry);
+		} else
+			retCode = lim_del_sta(pMac,
+					 pStaDs, true, psessionEntry);
+	}
 
 	return retCode;
 
 } /*** end lim_cleanup_rx_path() ***/
 
 /**
- * lim_send_del_sta_cnf()
+ * lim_send_del_sta_cnf() - Send Del sta confirmation
+ * @pMac: Pointer to Global MAC structure
+ * @sta_dsaddr: sta ds address
+ * @staDsAssocId: sta ds association id
+ * @mlmStaContext: MLM station context
+ * @statusCode: Status code
+ * @psessionEntry: Session entry
  *
- ***FUNCTION:
- * This function is called to  send appropriate CNF message to SME
- *
- ***LOGIC:
+ * This function is called to send appropriate CNF message to SME.
  *
- *
- ***ASSUMPTIONS:
- * NA
- *
- ***NOTE:
- * NA
- *
- * @param pMac    Pointer to Global MAC structure
- * @param tpAniSirGlobal pMac,
- * @param tSirMacAddr staDsAddr,
- * @param uint16_t staDsAssocId,
- * @param tLimMlmStaContext mlmStaContext,
- * @param tSirResultCodes statusCode
- *
- * @return None
+ * Return: None
  */
-
 void
-lim_send_del_sta_cnf(tpAniSirGlobal pMac, tSirMacAddr staDsAddr,
+lim_send_del_sta_cnf(tpAniSirGlobal pMac, struct cdf_mac_addr sta_dsaddr,
 		     uint16_t staDsAssocId, tLimMlmStaContext mlmStaContext,
 		     tSirResultCodes statusCode, tpPESession psessionEntry)
 {
-
 	tLimMlmDisassocCnf mlmDisassocCnf;
 	tLimMlmDeauthCnf mlmDeauthCnf;
 	tLimMlmPurgeStaInd mlmPurgeStaInd;
 
-	lim_log(pMac, LOG1, FL("Sessionid: %d staDsAssocId: %d Trigger: %d"
-			       "statusCode: %d staDsAddr: " MAC_ADDRESS_STR),
+	lim_log(pMac, LOG1,
+		FL("Sessionid: %d staDsAssocId: %d Trigger: %d statusCode: %d sta_dsaddr: "MAC_ADDRESS_STR),
 		psessionEntry->peSessionId, staDsAssocId,
 		mlmStaContext.cleanupTrigger, statusCode,
-		MAC_ADDR_ARRAY(staDsAddr));
+		MAC_ADDR_ARRAY(sta_dsaddr.bytes));
 
 	if (LIM_IS_STA_ROLE(psessionEntry) ||
 	    LIM_IS_BT_AMP_STA_ROLE(psessionEntry)) {
@@ -766,7 +735,7 @@ lim_send_del_sta_cnf(tpAniSirGlobal pMac, tSirMacAddr staDsAddr,
 			mlmStaContext.cleanupTrigger);
 
 		cdf_mem_copy((uint8_t *) &mlmDisassocCnf.peerMacAddr,
-			     (uint8_t *) staDsAddr, sizeof(tSirMacAddr));
+			     (uint8_t *) sta_dsaddr.bytes, CDF_MAC_ADDR_SIZE);
 		mlmDisassocCnf.resultCode = statusCode;
 		mlmDisassocCnf.disassocTrigger = mlmStaContext.cleanupTrigger;
 		/* Update PE session Id */
@@ -786,8 +755,7 @@ lim_send_del_sta_cnf(tpAniSirGlobal pMac, tSirMacAddr staDsAddr,
 		lim_log(pMac, LOGW,
 			FL("Lim Posting DEAUTH_CNF to Sme. Trigger: %d"),
 			mlmStaContext.cleanupTrigger);
-		cdf_mem_copy((uint8_t *) &mlmDeauthCnf.peerMacAddr,
-			     (uint8_t *) staDsAddr, sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&mlmDeauthCnf.peer_macaddr, &sta_dsaddr);
 		mlmDeauthCnf.resultCode = statusCode;
 		mlmDeauthCnf.deauthTrigger = mlmStaContext.cleanupTrigger;
 		/* PE session Id */
@@ -807,7 +775,7 @@ lim_send_del_sta_cnf(tpAniSirGlobal pMac, tSirMacAddr staDsAddr,
 			FL("Lim Posting PURGE_STA_IND to Sme. Trigger: %d"),
 			mlmStaContext.cleanupTrigger);
 		cdf_mem_copy((uint8_t *) &mlmPurgeStaInd.peerMacAddr,
-			     (uint8_t *) staDsAddr, sizeof(tSirMacAddr));
+			     (uint8_t *) sta_dsaddr.bytes, CDF_MAC_ADDR_SIZE);
 		mlmPurgeStaInd.reasonCode =
 			(uint8_t) mlmStaContext.disassocReason;
 		mlmPurgeStaInd.aid = staDsAssocId;
@@ -2486,8 +2454,17 @@ lim_add_sta(tpAniSirGlobal mac_ctx,
 			add_sta_params->htLdpcCapable = 0;
 			add_sta_params->vhtLdpcCapable = 0;
 		} else {
-			add_sta_params->htLdpcCapable = sta_ds->htLdpcCapable;
-			add_sta_params->vhtLdpcCapable = sta_ds->vhtLdpcCapable;
+			if (session_entry->txLdpcIniFeatureEnabled & 0x1)
+				add_sta_params->htLdpcCapable =
+						sta_ds->htLdpcCapable;
+			else
+				add_sta_params->htLdpcCapable = 0;
+
+			if (session_entry->txLdpcIniFeatureEnabled & 0x2)
+				add_sta_params->vhtLdpcCapable =
+						sta_ds->vhtLdpcCapable;
+			else
+				add_sta_params->vhtLdpcCapable = 0;
 		}
 	} else if (STA_ENTRY_SELF == sta_ds->staType) {
 		/* For Self STA get the LDPC capability from config.ini */
@@ -2627,6 +2604,12 @@ lim_add_sta(tpAniSirGlobal mac_ctx,
 		add_sta_params->htLdpcCapable, add_sta_params->vhtLdpcCapable,
 		add_sta_params->p2pCapableSta);
 
+	if (!add_sta_params->htLdpcCapable)
+		add_sta_params->ht_caps &= ~(1 << SIR_MAC_HT_CAP_ADVCODING_S);
+	if (!add_sta_params->vhtLdpcCapable)
+		add_sta_params->vht_caps &=
+			~(1 << SIR_MAC_VHT_CAP_LDPC_CODING_CAP);
+
 	/*
 	 * we need to defer the message until we get the
 	 * response back from HAL.
@@ -3369,6 +3352,7 @@ lim_check_and_announce_join_success(tpAniSirGlobal mac_ctx,
 	uint32_t *noa2_duration_from_beacon = NULL;
 	uint32_t noa;
 	uint32_t total_num_noa_desc = 0;
+	uint32_t selfStaDot11Mode = 0;
 
 	cdf_mem_copy(current_ssid.ssId,
 		     session_entry->ssId.ssId, session_entry->ssId.length);
@@ -3481,7 +3465,10 @@ lim_check_and_announce_join_success(tpAniSirGlobal mac_ctx,
 	lim_post_sme_message(mac_ctx, LIM_MLM_JOIN_CNF,
 			     (uint32_t *) &mlm_join_cnf);
 
-	if (beacon_probe_rsp->vendor2_ie.VHTCaps.present) {
+	wlan_cfg_get_int(mac_ctx, WNI_CFG_DOT11_MODE, &selfStaDot11Mode);
+
+	if ((IS_DOT11_MODE_VHT(selfStaDot11Mode)) &&
+		beacon_probe_rsp->vendor2_ie.VHTCaps.present) {
 		session_entry->is_vendor_specific_vhtcaps = true;
 		session_entry->vendor_specific_vht_ie_type =
 			beacon_probe_rsp->vendor2_ie.type;
@@ -4136,8 +4123,12 @@ tSirRetStatus lim_sta_send_add_bss(tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
 			pAddBssParams->staContext.htLdpcCapable = 0;
 			pAddBssParams->staContext.vhtLdpcCapable = 0;
 		} else {
-			pAddBssParams->staContext.htLdpcCapable =
-				(uint8_t) pAssocRsp->HTCaps.advCodingCap;
+			if (psessionEntry->txLdpcIniFeatureEnabled & 0x1)
+				pAddBssParams->staContext.htLdpcCapable =
+				    (uint8_t) pAssocRsp->HTCaps.advCodingCap;
+			else
+				pAddBssParams->staContext.htLdpcCapable = 0;
+
 			if (pAssocRsp->VHTCaps.present)
 				vht_caps = &pAssocRsp->VHTCaps;
 			else if (pAssocRsp->vendor2_ie.VHTCaps.present) {
@@ -4145,9 +4136,12 @@ tSirRetStatus lim_sta_send_add_bss(tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
 				lim_log(pMac, LOG1, FL(
 					"VHT Caps is in vendor Specfic IE"));
 			}
-			if (vht_caps != NULL)
+			if (vht_caps != NULL &&
+				(psessionEntry->txLdpcIniFeatureEnabled & 0x2))
 				pAddBssParams->staContext.vhtLdpcCapable =
 					(uint8_t) vht_caps->ldpcCodingCap;
+			else
+				pAddBssParams->staContext.vhtLdpcCapable = 0;
 		}
 
 		if (pBeaconStruct->HTInfo.present)
@@ -4255,6 +4249,13 @@ tSirRetStatus lim_sta_send_add_bss(tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
 		       (pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId,
 		       psessionEntry->limMlmState));
 
+	if (!pAddBssParams->staContext.htLdpcCapable)
+		pAddBssParams->staContext.ht_caps &=
+			~(1 << SIR_MAC_HT_CAP_ADVCODING_S);
+	if (!pAddBssParams->staContext.vhtLdpcCapable)
+		pAddBssParams->staContext.vht_caps &=
+			~(1 << SIR_MAC_VHT_CAP_LDPC_CODING_CAP);
+
 	lim_log(pMac, LOG2, FL("staContext wmmEnabled: %d encryptType: %d "
 			       "p2pCapableSta: %d"),
 		pAddBssParams->staContext.wmmEnabled,
@@ -4660,9 +4661,13 @@ tSirRetStatus lim_sta_send_add_bss_pre_assoc(tpAniSirGlobal pMac, uint8_t update
 			pAddBssParams->staContext.htLdpcCapable = 0;
 			pAddBssParams->staContext.vhtLdpcCapable = 0;
 		} else {
-			pAddBssParams->staContext.htLdpcCapable =
-				(uint8_t) pBeaconStruct->HTCaps.
-				advCodingCap;
+			if (psessionEntry->txLdpcIniFeatureEnabled & 0x1)
+				pAddBssParams->staContext.htLdpcCapable =
+					(uint8_t) pBeaconStruct->HTCaps.
+						advCodingCap;
+			else
+				pAddBssParams->staContext.htLdpcCapable = 0;
+
 			if (pBeaconStruct->VHTCaps.present)
 				vht_caps = &pBeaconStruct->VHTCaps;
 			else if (pBeaconStruct->vendor2_ie.VHTCaps.present) {
@@ -4671,9 +4676,12 @@ tSirRetStatus lim_sta_send_add_bss_pre_assoc(tpAniSirGlobal pMac, uint8_t update
 				lim_log(pMac, LOG1, FL(
 					"VHT Caps are in vendor Specfic IE"));
 			}
-			if (vht_caps != NULL)
+			if (vht_caps != NULL &&
+				(psessionEntry->txLdpcIniFeatureEnabled & 0x2))
 				pAddBssParams->staContext.vhtLdpcCapable =
 					(uint8_t) vht_caps->ldpcCodingCap;
+			else
+				pAddBssParams->staContext.vhtLdpcCapable = 0;
 		}
 
 		if (pBeaconStruct->HTInfo.present)
@@ -4835,7 +4843,7 @@ lim_prepare_and_send_del_sta_cnf(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 				 tpPESession psessionEntry)
 {
 	uint16_t staDsAssocId = 0;
-	tSirMacAddr staDsAddr;
+	struct cdf_mac_addr sta_dsaddr;
 	tLimMlmStaContext mlmStaContext;
 
 	if (pStaDs == NULL) {
@@ -4843,8 +4851,8 @@ lim_prepare_and_send_del_sta_cnf(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 		return;
 	}
 	staDsAssocId = pStaDs->assocId;
-	cdf_mem_copy((uint8_t *) staDsAddr,
-		     pStaDs->staAddr, sizeof(tSirMacAddr));
+	cdf_mem_copy((uint8_t *) sta_dsaddr.bytes,
+		     pStaDs->staAddr, CDF_MAC_ADDR_SIZE);
 
 	mlmStaContext = pStaDs->mlmStaContext;
 	if (LIM_IS_AP_ROLE(psessionEntry) ||
@@ -4861,7 +4869,7 @@ lim_prepare_and_send_del_sta_cnf(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 				 psessionEntry->peSessionId,
 				 psessionEntry->limMlmState));
 	}
-	lim_send_del_sta_cnf(pMac, staDsAddr, staDsAssocId, mlmStaContext,
+	lim_send_del_sta_cnf(pMac, sta_dsaddr, staDsAssocId, mlmStaContext,
 			     statusCode, psessionEntry);
 }
 
@@ -4924,10 +4932,10 @@ void lim_init_pre_auth_timer_table(tpAniSirGlobal pMac,
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
 	for (authNodeIdx = 0; authNodeIdx < pPreAuthTimerTable->numEntry;
 	     authNodeIdx++, pAuthNode++) {
-		if (tx_timer_create
-			    (&pAuthNode->timer, "AUTH RESPONSE TIMEOUT",
-			    lim_auth_response_timer_handler, authNodeIdx, cfgValue, 0,
-			    TX_NO_ACTIVATE) != TX_SUCCESS) {
+		if (tx_timer_create(pMac, &pAuthNode->timer,
+			"AUTH RESPONSE TIMEOUT",
+			lim_auth_response_timer_handler, authNodeIdx,
+			cfgValue, 0, TX_NO_ACTIVATE) != TX_SUCCESS) {
 			/* Cannot create timer.  Log error. */
 			lim_log(pMac, LOGP,
 				FL("Cannot create Auth Rsp timer of Index :%d."),
@@ -5004,7 +5012,7 @@ tSirRetStatus lim_is_dot11h_power_capabilities_in_range(tpAniSirGlobal pMac,
 							tSirAssocReq *assoc,
 							tpPESession psessionEntry)
 {
-	tPowerdBm localMaxTxPower;
+	int8_t localMaxTxPower;
 	uint32_t localPwrConstraint;
 
 	localMaxTxPower =
@@ -5018,7 +5026,7 @@ tSirRetStatus lim_is_dot11h_power_capabilities_in_range(tpAniSirGlobal pMac,
 			FL("Unable to get Local Power Constraint from cfg"));
 		return eSIR_FAILURE;
 	}
-	localMaxTxPower -= (tPowerdBm) localPwrConstraint;
+	localMaxTxPower -= (int8_t) localPwrConstraint;
 
 	/**
 	 *  The min Tx Power of the associating station should not be greater than (regulatory
diff --git a/core/mac/src/pe/lim/lim_assoc_utils.h b/core/mac/src/pe/lim/lim_assoc_utils.h
index b9efbff3c842..8a846119a284 100644
--- a/core/mac/src/pe/lim/lim_assoc_utils.h
+++ b/core/mac/src/pe/lim/lim_assoc_utils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -45,7 +45,7 @@
 
 #include "lim_types.h"
 
-uint8_t lim_cmp_s_sid(tpAniSirGlobal, tSirMacSSid *, tpPESession);
+bool lim_cmp_ssid(tSirMacSSid *, tpPESession);
 uint8_t lim_compare_capabilities(tpAniSirGlobal,
 				 tSirAssocReq *,
 				 tSirMacCapabilityInfo *, tpPESession);
@@ -134,7 +134,7 @@ void lim_post_reassoc_failure(tpAniSirGlobal,
 			      tSirResultCodes, uint16_t, tpPESession);
 bool lim_is_reassoc_in_progress(tpAniSirGlobal, tpPESession);
 void
-lim_send_del_sta_cnf(tpAniSirGlobal pMac, tSirMacAddr staDsAddr,
+lim_send_del_sta_cnf(tpAniSirGlobal pMac, struct cdf_mac_addr sta_dsaddr,
 		     uint16_t staDsAssocId, tLimMlmStaContext mlmStaContext,
 		     tSirResultCodes statusCode, tpPESession psessionEntry);
 
@@ -207,6 +207,11 @@ void lim_send_sme_unprotected_mgmt_frame_ind(tpAniSirGlobal pMac, uint8_t frameT
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 void lim_send_sme_tsm_ie_ind(tpAniSirGlobal pMac, tpPESession psessionEntry,
 			     uint8_t tid, uint8_t state, uint16_t measInterval);
+#else
+static inline void lim_send_sme_tsm_ie_ind(tpAniSirGlobal pMac,
+	tpPESession psessionEntry, uint8_t tid,
+	uint8_t state, uint16_t measInterval)
+{}
 #endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 
 #endif /* __LIM_ASSOC_UTILS_H */
diff --git a/core/mac/src/pe/lim/lim_ft.c b/core/mac/src/pe/lim/lim_ft.c
index c96327c12d67..e37f09d58e80 100644
--- a/core/mac/src/pe/lim/lim_ft.c
+++ b/core/mac/src/pe/lim/lim_ft.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -370,35 +370,28 @@ void lim_perform_ft_pre_auth(tpAniSirGlobal pMac, CDF_STATUS status,
 	    psessionEntry->ftPEContext.pFTPreAuthReq) {
 		/* Only 11r assoc has FT IEs */
 		if (psessionEntry->ftPEContext.pFTPreAuthReq->ft_ies == NULL) {
-			PELOGE(lim_log(pMac, LOGE,
-				       "%s: FTIEs for Auth Req Seq 1 is absent",
-				       __func__);
-			       )
+			lim_log(pMac, LOGE,
+				FL("FTIEs for Auth Req Seq 1 is absent"));
 			goto preauth_fail;
 		}
 	}
 
 	if (status != CDF_STATUS_SUCCESS) {
-		PELOGE(lim_log(pMac, LOGE,
-			       "%s: Change channel not successful for FT pre-auth",
-			       __func__);
-		       )
+		lim_log(pMac, LOGE,
+			FL(" Change channel not successful for FT pre-auth"));
 		goto preauth_fail;
 	}
 
 	/* Nothing to be done if the session is not in STA mode */
 	if (!LIM_IS_STA_ROLE(psessionEntry)) {
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-		PELOGE(lim_log
-			       (pMac, LOGE, FL("psessionEntry is not in STA mode"));
-		       )
+		lim_log(pMac, LOGE, FL("psessionEntry is not in STA mode"));
 #endif
 		return;
 	}
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-	PELOG2(lim_log(pMac, LOG2, "Entered wait auth2 state for FT"
-		       " (old session %p)", psessionEntry);
-	       )
+	lim_log(pMac, LOG2, "Entered wait auth2 state for FT (old session %p)",
+				 psessionEntry);
 #endif
 	if (psessionEntry->is11Rconnection) {
 		/* Now we are on the right channel and need to send out Auth1 and
@@ -423,15 +416,15 @@ void lim_perform_ft_pre_auth(tpAniSirGlobal pMac, CDF_STATUS status,
 	if (TX_SUCCESS !=
 	    tx_timer_activate(&pMac->lim.limTimers.gLimFTPreAuthRspTimer)) {
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-		PELOGE(lim_log(pMac, LOGE, FL("FT Auth Rsp Timer Start Failed"));)
+		lim_log(pMac, LOGE, FL("FT Auth Rsp Timer Start Failed"));
 #endif
+		goto preauth_fail;
 	}
-	MTRACE(mac_trace
-		       (pMac, TRACE_CODE_TIMER_ACTIVATE, psessionEntry->peSessionId,
-		       eLIM_FT_PREAUTH_RSP_TIMER));
+	MTRACE(mac_trace(pMac, TRACE_CODE_TIMER_ACTIVATE,
+		psessionEntry->peSessionId, eLIM_FT_PREAUTH_RSP_TIMER));
 
 #if defined WLAN_FEATURE_VOWIFI_11R_DEBUG
-	PELOG1(lim_log(pMac, LOG1, FL("FT Auth Rsp Timer Started"));)
+	lim_log(pMac, LOG1, FL("FT Auth Rsp Timer Started"));
 #endif
 #ifdef FEATURE_WLAN_DIAG_SUPPORT
 	lim_diag_event_report(pMac, WLAN_PE_DIAG_ROAM_AUTH_START_EVENT,
@@ -439,8 +432,8 @@ void lim_perform_ft_pre_auth(tpAniSirGlobal pMac, CDF_STATUS status,
 #endif
 
 	lim_send_auth_mgmt_frame(pMac, &authFrame,
-				 psessionEntry->ftPEContext.pFTPreAuthReq->
-				 preAuthbssId, LIM_NO_WEP_IN_FC, psessionEntry);
+		 psessionEntry->ftPEContext.pFTPreAuthReq->preAuthbssId,
+		 LIM_NO_WEP_IN_FC, psessionEntry);
 
 	return;
 
@@ -820,11 +813,14 @@ tSirRetStatus lim_ft_prepare_add_bss_req(tpAniSirGlobal pMac,
 	pAddBssParams->sessionId = pftSessionEntry->peSessionId;
 
 	/* Set a new state for MLME */
-
-	pftSessionEntry->limMlmState = eLIM_MLM_WT_ADD_BSS_RSP_FT_REASSOC_STATE;
-	MTRACE(mac_trace
-		       (pMac, TRACE_CODE_MLM_STATE, pftSessionEntry->peSessionId,
-		       eLIM_MLM_WT_ADD_BSS_RSP_FT_REASSOC_STATE));
+	if (!pftSessionEntry->bRoamSynchInProgress) {
+		pftSessionEntry->limMlmState =
+			eLIM_MLM_WT_ADD_BSS_RSP_FT_REASSOC_STATE;
+		MTRACE(mac_trace
+			(pMac, TRACE_CODE_MLM_STATE,
+			pftSessionEntry->peSessionId,
+			eLIM_MLM_WT_ADD_BSS_RSP_FT_REASSOC_STATE));
+	}
 	pAddBssParams->halPersona = (uint8_t) pftSessionEntry->pePersona;
 
 	pftSessionEntry->ftPEContext.pAddBssReq = pAddBssParams;
@@ -848,8 +844,8 @@ void lim_fill_ft_session(tpAniSirGlobal pMac,
 			 tpPESession pftSessionEntry, tpPESession psessionEntry)
 {
 	uint8_t currentBssUapsd;
-	tPowerdBm localPowerConstraint;
-	tPowerdBm regMax;
+	int8_t localPowerConstraint;
+	int8_t regMax;
 	tSchBeaconStruct *pBeaconStruct;
 	uint32_t selfDot11Mode;
 	ePhyChanBondState cbEnabledMode;
@@ -1047,13 +1043,14 @@ void lim_fill_ft_session(tpAniSirGlobal pMac,
 		regMax, localPowerConstraint, pMac->roam.configParam.nTxPowerCap,
 		pftSessionEntry->maxTxPower);
 #endif
-
-	pftSessionEntry->limPrevSmeState = pftSessionEntry->limSmeState;
-	pftSessionEntry->limSmeState = eLIM_SME_WT_REASSOC_STATE;
-	MTRACE(mac_trace
-		       (pMac, TRACE_CODE_SME_STATE, pftSessionEntry->peSessionId,
-		       pftSessionEntry->limSmeState));
-
+	if (!psessionEntry->bRoamSynchInProgress) {
+		pftSessionEntry->limPrevSmeState = pftSessionEntry->limSmeState;
+		pftSessionEntry->limSmeState = eLIM_SME_WT_REASSOC_STATE;
+		MTRACE(mac_trace(pMac,
+				TRACE_CODE_SME_STATE,
+				pftSessionEntry->peSessionId,
+				pftSessionEntry->limSmeState));
+	}
 	pftSessionEntry->encryptType = psessionEntry->encryptType;
 #ifdef WLAN_FEATURE_11W
 	pftSessionEntry->limRmfEnabled = psessionEntry->limRmfEnabled;
@@ -1615,13 +1612,14 @@ bool lim_process_ft_update_key(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 
 	pKeyInfo = (tSirFTUpdateKeyInfo *) pMsgBuf;
 
-	psessionEntry = pe_find_session_by_bssid(pMac, pKeyInfo->bssId, &sessionId);
+	psessionEntry = pe_find_session_by_bssid(pMac, pKeyInfo->bssid.bytes,
+						 &sessionId);
 	if (NULL == psessionEntry) {
 		PELOGE(lim_log(pMac, LOGE,
 			       "%s: Unable to find session for the following bssid",
 			       __func__);
 		       )
-		lim_print_mac_addr(pMac, pKeyInfo->bssId, LOGE);
+		lim_print_mac_addr(pMac, pKeyInfo->bssid.bytes, LOGE);
 		return false;
 	}
 
@@ -1642,8 +1640,8 @@ bool lim_process_ft_update_key(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 			extSetStaKeyParam;
 
 		cdf_mem_zero(pMlmSetKeysReq, sizeof(tLimMlmSetKeysReq));
-		cdf_mem_copy(pMlmSetKeysReq->peerMacAddr, pKeyInfo->bssId,
-			     sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&pMlmSetKeysReq->peer_macaddr,
+				 &pKeyInfo->bssid);
 		pMlmSetKeysReq->sessionId = psessionEntry->peSessionId;
 		pMlmSetKeysReq->smesessionId = psessionEntry->smeSessionId;
 		pMlmSetKeysReq->edType = pKeyInfo->keyMaterial.edType;
@@ -1691,11 +1689,10 @@ bool lim_process_ft_update_key(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 
 		PELOG1(lim_log(pMac, LOG1,
 			       FL("BSSID = " MAC_ADDRESS_STR),
-			       MAC_ADDR_ARRAY(pKeyInfo->bssId));
-		       )
+			       MAC_ADDR_ARRAY(pKeyInfo->bssid.bytes));)
 
-		sir_copy_mac_addr(pAddBssParams->extSetStaKeyParam.peerMacAddr,
-				  pKeyInfo->bssId);
+		cdf_copy_macaddr(&pAddBssParams->extSetStaKeyParam.peer_macaddr,
+				 &pKeyInfo->bssid);
 
 		pAddBssParams->extSetStaKeyParam.sendRsp = false;
 
@@ -1857,8 +1854,8 @@ tSirRetStatus lim_process_ft_aggr_qos_req(tpAniSirGlobal pMac, uint32_t *pMsgBuf
 		return eSIR_MEM_ALLOC_FAILED;
 	}
 
-	psessionEntry =
-		pe_find_session_by_bssid(pMac, aggrQosReq->bssId, &sessionId);
+	psessionEntry = pe_find_session_by_bssid(pMac, aggrQosReq->bssid.bytes,
+						 &sessionId);
 
 	if (psessionEntry == NULL) {
 		PELOGE(lim_log
@@ -1881,7 +1878,7 @@ tSirRetStatus lim_process_ft_aggr_qos_req(tpAniSirGlobal pMac, uint32_t *pMsgBuf
 		return eSIR_FAILURE;
 	}
 
-	pSta = dph_lookup_hash_entry(pMac, aggrQosReq->bssId, &aid,
+	pSta = dph_lookup_hash_entry(pMac, aggrQosReq->bssid.bytes, &aid,
 				     &psessionEntry->dph.dphHashTable);
 	if (pSta == NULL) {
 		PELOGE(lim_log(pMac, LOGE,
diff --git a/core/mac/src/pe/lim/lim_ibss_peer_mgmt.c b/core/mac/src/pe/lim/lim_ibss_peer_mgmt.c
index b2c974cad41a..e12252b16e08 100644
--- a/core/mac/src/pe/lim/lim_ibss_peer_mgmt.c
+++ b/core/mac/src/pe/lim/lim_ibss_peer_mgmt.c
@@ -1784,8 +1784,7 @@ __lim_ibss_peer_inactivity_handler(tpAniSirGlobal pMac,
 
 	/* delete the peer for which heartbeat is observed */
 	__lim_ibss_search_and_delete_peer(pMac, psessionEntry,
-					  peerInactivityInd->peerAddr);
-
+					  peerInactivityInd->peer_addr.bytes);
 }
 
 /** -------------------------------------------------------------
diff --git a/core/mac/src/pe/lim/lim_ibss_peer_mgmt.h b/core/mac/src/pe/lim/lim_ibss_peer_mgmt.h
index 0c97919c3d9f..9051fa2ddde9 100644
--- a/core/mac/src/pe/lim/lim_ibss_peer_mgmt.h
+++ b/core/mac/src/pe/lim/lim_ibss_peer_mgmt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2012, 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2012, 2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -39,8 +39,6 @@
 #include "sir_common.h"
 #include "lim_utils.h"
 
-#define IBSS_STATIONS_USED_DURING_INIT 4        /* (broadcast + self + p2p + softap) */
-
 void lim_ibss_init(tpAniSirGlobal);
 void lim_ibss_delete(tpAniSirGlobal, tpPESession psessionEntry);
 tSirRetStatus lim_ibss_coalesce(tpAniSirGlobal, tpSirMacMgmtHdr,
diff --git a/core/mac/src/pe/lim/lim_link_monitoring_algo.c b/core/mac/src/pe/lim/lim_link_monitoring_algo.c
index c4626c66c037..c61e18930916 100644
--- a/core/mac/src/pe/lim/lim_link_monitoring_algo.c
+++ b/core/mac/src/pe/lim/lim_link_monitoring_algo.c
@@ -92,6 +92,7 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg,
 		cdf_mem_free(msg);
 		return;
 	}
+	stads->del_sta_ctx_rssi = msg->rssi;
 
 	/* check and see if same staId. This is to avoid the scenario
 	 * where we're trying to delete a staId we just added.
diff --git a/core/mac/src/pe/lim/lim_p2p.c b/core/mac/src/pe/lim/lim_p2p.c
index 08ed8fce3ce3..8a776b99a540 100644
--- a/core/mac/src/pe/lim/lim_p2p.c
+++ b/core/mac/src/pe/lim/lim_p2p.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -380,7 +380,6 @@ void lim_send_sme_mgmt_frame_ind(tpAniSirGlobal pMac, uint8_t frameType,
 				 uint16_t sessionId, uint32_t rxChannel,
 				 tpPESession psessionEntry, int8_t rxRssi)
 {
-	tSirMsgQ mmhMsg;
 	tpSirSmeMgmtFrameInd pSirSmeMgmtFrame = NULL;
 	uint16_t length;
 
@@ -394,8 +393,7 @@ void lim_send_sme_mgmt_frame_ind(tpAniSirGlobal pMac, uint8_t frameType,
 	}
 	cdf_mem_set((void *)pSirSmeMgmtFrame, length, 0);
 
-	pSirSmeMgmtFrame->mesgType = eWNI_SME_MGMT_FRM_IND;
-	pSirSmeMgmtFrame->mesgLen = length;
+	pSirSmeMgmtFrame->frame_len = frameLen;
 	pSirSmeMgmtFrame->sessionId = sessionId;
 	pSirSmeMgmtFrame->frameType = frameType;
 	pSirSmeMgmtFrame->rxRssi = rxRssi;
@@ -404,11 +402,12 @@ void lim_send_sme_mgmt_frame_ind(tpAniSirGlobal pMac, uint8_t frameType,
 	cdf_mem_zero(pSirSmeMgmtFrame->frameBuf, frameLen);
 	cdf_mem_copy(pSirSmeMgmtFrame->frameBuf, frame, frameLen);
 
-	mmhMsg.type = eWNI_SME_MGMT_FRM_IND;
-	mmhMsg.bodyptr = pSirSmeMgmtFrame;
-	mmhMsg.bodyval = 0;
-
-	lim_sys_process_mmh_msg_api(pMac, &mmhMsg, ePROT);
+	if (pMac->mgmt_frame_ind_cb)
+		pMac->mgmt_frame_ind_cb(pSirSmeMgmtFrame);
+	else
+		lim_log(pMac, LOGW,
+			FL("Management indication callback not registered!!"));
+	cdf_mem_free(pSirSmeMgmtFrame);
 	return;
 }
 
diff --git a/core/mac/src/pe/lim/lim_process_action_frame.c b/core/mac/src/pe/lim/lim_process_action_frame.c
index dd041c448135..277234c5421e 100644
--- a/core/mac/src/pe/lim/lim_process_action_frame.c
+++ b/core/mac/src/pe/lim/lim_process_action_frame.c
@@ -822,8 +822,6 @@ static void __lim_process_add_ts_rsp(tpAniSirGlobal mac_ctx,
 		lim_send_sme_tsm_ie_ind(mac_ctx, session, addts.tsmIE.tsid,
 					addts.tsmIE.state,
 					addts.tsmIE.msmt_interval);
-#else
-		limActivateTSMStatsTimer(mac_ctx, session);
 #endif /* FEATURE_WLAN_ESE_UPLOAD */
 	}
 #endif
@@ -1099,8 +1097,6 @@ static void __lim_process_del_ts_req(tpAniSirGlobal mac_ctx,
 #ifdef FEATURE_WLAN_ESE
 #ifdef FEATURE_WLAN_ESE_UPLOAD
 	lim_send_sme_tsm_ie_ind(mac_ctx, session, 0, 0, 0);
-#else
-	lim_deactivate_and_change_timer(mac_ctx, eLIM_TSM_TIMER);
 #endif /* FEATURE_WLAN_ESE_UPLOAD */
 #endif
 }
@@ -1899,7 +1895,7 @@ void lim_process_action_frame(tpAniSirGlobal mac_ctx,
 		case SIR_MAC_WNM_BSS_TM_RESPONSE:
 		case SIR_MAC_WNM_NOTIF_REQUEST:
 		case SIR_MAC_WNM_NOTIF_RESPONSE:
-			rssi = WMA_GET_RX_RSSI_DB(rx_pkt_info);
+			rssi = WMA_GET_RX_RSSI_NORMALIZED(rx_pkt_info);
 			mac_hdr = WMA_GET_RX_MAC_HEADER(rx_pkt_info);
 			/* Forward to the SME to HDD to wpa_supplicant */
 			lim_send_sme_mgmt_frame_ind(mac_ctx,
@@ -2060,7 +2056,7 @@ void lim_process_action_frame(tpAniSirGlobal mac_ctx,
 
 			mac_hdr = WMA_GET_RX_MAC_HEADER(rx_pkt_info);
 			frame_len = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info);
-			rssi = WMA_GET_RX_RSSI_DB(rx_pkt_info);
+			rssi = WMA_GET_RX_RSSI_NORMALIZED(rx_pkt_info);
 			CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_INFO,
 				  ("Public Action TDLS Discovery RSP .."));
 			lim_send_sme_mgmt_frame_ind(mac_ctx,
diff --git a/core/mac/src/pe/lim/lim_process_assoc_req_frame.c b/core/mac/src/pe/lim/lim_process_assoc_req_frame.c
index 8e23a4e9d21f..aa7cf8db3487 100644
--- a/core/mac/src/pe/lim/lim_process_assoc_req_frame.c
+++ b/core/mac/src/pe/lim/lim_process_assoc_req_frame.c
@@ -288,8 +288,9 @@ lim_process_assoc_req_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 			MAC_ADDRESS_STR), psessionEntry->peSessionId,
 			subType, GET_LIM_SYSTEM_ROLE(psessionEntry),
 			MAC_ADDR_ARRAY(pHdr->sa));
-		} else {
-			/*
+		} else if (!pStaDs->rmfEnabled) {
+			/* Do this only for non PMF case.
+			 *
 			 * STA might have missed the assoc response,
 			 * so it is sending assoc request frame again.
 			 */
@@ -417,7 +418,7 @@ lim_process_assoc_req_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 
 	updateContext = false;
 
-	if (lim_cmp_s_sid(pMac, &pAssocReq->ssId, psessionEntry) == false) {
+	if (lim_cmp_ssid(&pAssocReq->ssId, psessionEntry) == false) {
 		lim_log(pMac, LOGE,
 			FL("Received %s Req with unmatched ssid ( Received"
 			   " SSID: %.*s current SSID: %.*s ) from "
@@ -1460,7 +1461,7 @@ sendIndToSme:
 	if (WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STAMIN > retryInterval) {
 		retryInterval = WNI_CFG_PMF_SA_QUERY_RETRY_INTERVAL_STADEF;
 	}
-	if (tx_timer_create(&pStaDs->pmfSaQueryTimer, "PMF SA Query timer",
+	if (tx_timer_create(pMac, &pStaDs->pmfSaQueryTimer, "PMF SA Query timer",
 			    lim_pmf_sa_query_timer_handler, timerId.value,
 			    SYS_MS_TO_TICKS((retryInterval * 1024) / 1000),
 			    0, TX_NO_ACTIVATE) != TX_SUCCESS) {
diff --git a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
index c11cecc56d39..336460fb8233 100644
--- a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
+++ b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -381,6 +381,7 @@ static void lim_update_ric_data(tpAniSirGlobal mac_ctx,
 	if (session_entry->ricData != NULL) {
 		cdf_mem_free(session_entry->ricData);
 		session_entry->ricData = NULL;
+		session_entry->RICDataLen = 0;
 	}
 	if (assoc_rsp->ricPresent) {
 		session_entry->RICDataLen =
@@ -429,6 +430,7 @@ static void lim_update_ese_tspec(tpAniSirGlobal mac_ctx,
 	if (session_entry->tspecIes != NULL) {
 		cdf_mem_free(session_entry->tspecIes);
 		session_entry->tspecIes = NULL;
+		session_entry->tspecLen = 0;
 	}
 	if (assoc_rsp->tspecPresent) {
 		lim_log(mac_ctx, LOG1, FL("Tspec EID present in assoc rsp"));
@@ -501,8 +503,6 @@ static void lim_update_ese_tsm(tpAniSirGlobal mac_ctx,
 				session_entry, assoc_rsp->tsmIE.tsid,
 				assoc_rsp->tsmIE.state,
 				assoc_rsp->tsmIE.msmt_interval);
-#else
-			limActivateTSMStatsTimer(mac_ctx, session_entry);
 #endif
 			if (tsm_ctx->tsmInfo.state)
 				tsm_ctx->tsmMetrics.RoamingCount++;
@@ -611,7 +611,7 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
 		"and mlmstate: %d RSSI %d from " MAC_ADDRESS_STR), subtype,
 		session_entry->peSessionId, GET_LIM_SYSTEM_ROLE(session_entry),
 		session_entry->limMlmState,
-		(uint) abs((int8_t) WMA_GET_RX_RSSI_DB(rx_pkt_info)),
+		(uint) abs((int8_t) WMA_GET_RX_RSSI_NORMALIZED(rx_pkt_info)),
 		MAC_ADDR_ARRAY(hdr->sa));
 
 	beacon = cdf_mem_malloc(sizeof(tSchBeaconStruct));
@@ -646,6 +646,7 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
 	if (((subtype == LIM_ASSOC) &&
 		(session_entry->limMlmState != eLIM_MLM_WT_ASSOC_RSP_STATE)) ||
 		((subtype == LIM_REASSOC) &&
+		 !session_entry->bRoamSynchInProgress &&
 		((session_entry->limMlmState != eLIM_MLM_WT_REASSOC_RSP_STATE)
 #if defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 		&& (session_entry->limMlmState !=
@@ -747,6 +748,7 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
 			 "and setting NULL"));
 		cdf_mem_free(session_entry->assocRsp);
 		session_entry->assocRsp = NULL;
+		session_entry->assocRspLen = 0;
 	}
 
 	session_entry->assocRsp = cdf_mem_malloc(frame_len);
@@ -916,7 +918,8 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
 #endif
 	if (!((session_entry->bssType == eSIR_BTAMP_STA_MODE) ||
 		((session_entry->bssType == eSIR_BTAMP_AP_MODE) &&
-		LIM_IS_BT_AMP_STA_ROLE(session_entry)))) {
+		LIM_IS_BT_AMP_STA_ROLE(session_entry)) ||
+		session_entry->bRoamSynchInProgress)) {
 		if (lim_set_link_state
 			(mac_ctx, eSIR_LINK_POSTASSOC_STATE,
 			session_entry->bssId,
@@ -971,8 +974,9 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
 			goto assocReject;
 		}
 #if defined(WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
-		if (session_entry->limMlmState ==
-		    eLIM_MLM_WT_FT_REASSOC_RSP_STATE) {
+		if ((session_entry->limMlmState ==
+		    eLIM_MLM_WT_FT_REASSOC_RSP_STATE) ||
+			session_entry->bRoamSynchInProgress) {
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
 			lim_log(mac_ctx, LOG1, FL("Sending self sta"));
 #endif
@@ -991,11 +995,11 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
 			lim_send_edca_params(mac_ctx,
 				session_entry->gLimEdcaParamsActive,
 				sta_ds->bssId);
+			lim_add_ft_sta_self(mac_ctx, (assoc_rsp->aid & 0x3FFF),
+				session_entry);
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 		}
 #endif
-			lim_add_ft_sta_self(mac_ctx, (assoc_rsp->aid & 0x3FFF),
-				session_entry);
 			cdf_mem_free(beacon);
 			return;
 		}
diff --git a/core/mac/src/pe/lim/lim_process_auth_frame.c b/core/mac/src/pe/lim/lim_process_auth_frame.c
index 9871cff47c9b..36bed2d9d142 100644
--- a/core/mac/src/pe/lim/lim_process_auth_frame.c
+++ b/core/mac/src/pe/lim/lim_process_auth_frame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -190,7 +190,7 @@ lim_process_auth_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 		   "Frame Received: BSSID: " MAC_ADDRESS_STR " (RSSI %d)"),
 		psessionEntry->peSessionId, GET_LIM_SYSTEM_ROLE(psessionEntry),
 		psessionEntry->limMlmState, MAC_ADDR_ARRAY(pHdr->bssId),
-		(uint) abs((int8_t) WMA_GET_RX_RSSI_DB(pRxPacketInfo)));
+		(uint) abs((int8_t) WMA_GET_RX_RSSI_NORMALIZED(pRxPacketInfo)));
 
 	pBody = WMA_GET_RX_MPDU_DATA(pRxPacketInfo);
 
@@ -507,17 +507,15 @@ lim_process_auth_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 			if (pMlmDisassocReq
 			    &&
 			    (cdf_mem_compare
-				     ((uint8_t *) pHdr->sa,
-				     (uint8_t *) &pMlmDisassocReq->peerMacAddr,
-				     sizeof(tSirMacAddr)))) {
+				((uint8_t *) pHdr->sa,
+				&pMlmDisassocReq->peer_macaddr.bytes,
+				CDF_MAC_ADDR_SIZE))) {
 				PELOGE(lim_log
-					       (pMac, LOGE,
-					       FL("TODO:Ack for disassoc "
-						  "frame is pending Issue delsta for "
-						  MAC_ADDRESS_STR),
-					       MAC_ADDR_ARRAY(pMlmDisassocReq->
-							      peerMacAddr));
-				       )
+				   (pMac, LOGE,
+				    FL("TODO:Ack for disassoc frame is pending Issue delsta for "
+					  MAC_ADDRESS_STR),
+				       MAC_ADDR_ARRAY(pMlmDisassocReq->
+						      peer_macaddr.bytes));)
 				lim_process_disassoc_ack_timeout(pMac);
 				isConnected = eSIR_FALSE;
 			}
@@ -527,15 +525,14 @@ lim_process_auth_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 			    &&
 			    (cdf_mem_compare
 				     ((uint8_t *) pHdr->sa,
-				     (uint8_t *) &pMlmDeauthReq->peerMacAddr,
-				     sizeof(tSirMacAddr)))) {
+				     (uint8_t *) &pMlmDeauthReq->peer_macaddr.bytes,
+				     CDF_MAC_ADDR_SIZE))) {
 				PELOGE(lim_log
-					       (pMac, LOGE,
-					       FL("TODO:Ack for deauth frame "
-						  "is pending Issue delsta for "
-						  MAC_ADDRESS_STR),
-					       MAC_ADDR_ARRAY(pMlmDeauthReq->
-							      peerMacAddr));
+				      (pMac, LOGE,
+				       FL("TODO:Ack for deauth frame is pending Issue delsta for "
+					  MAC_ADDRESS_STR),
+					  MAC_ADDR_ARRAY(pMlmDeauthReq->
+							 peer_macaddr.bytes));
 				       )
 				lim_process_deauth_ack_timeout(pMac);
 				isConnected = eSIR_FALSE;
@@ -1775,7 +1772,7 @@ tSirRetStatus lim_process_auth_frame_no_session(tpAniSirGlobal pMac, uint8_t *pB
 	lim_log(pMac, LOG1,
 		FL("Auth Frame Received: BSSID " MAC_ADDRESS_STR " (RSSI %d)"),
 		MAC_ADDR_ARRAY(pHdr->bssId),
-		(uint) abs((int8_t) WMA_GET_RX_RSSI_DB(pBd)));
+		(uint) abs((int8_t) WMA_GET_RX_RSSI_NORMALIZED(pBd)));
 
 	/* Auth frame has come on a new BSS, however, we need to find the session
 	 * from where the auth-req was sent to the new AP
diff --git a/core/mac/src/pe/lim/lim_process_beacon_frame.c b/core/mac/src/pe/lim/lim_process_beacon_frame.c
index 3a72a69ba418..6d8075149a71 100644
--- a/core/mac/src/pe/lim/lim_process_beacon_frame.c
+++ b/core/mac/src/pe/lim/lim_process_beacon_frame.c
@@ -150,6 +150,7 @@ lim_process_beacon_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 		if (session->beacon != NULL) {
 			cdf_mem_free(session->beacon);
 			session->beacon = NULL;
+			session->bcnLen = 0;
 		}
 		session->bcnLen = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info);
 		session->beacon = cdf_mem_malloc(session->bcnLen);
@@ -238,9 +239,9 @@ lim_process_beacon_frame_no_session(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo)
 		cdf_mem_free(pBeacon);
 	} /* end of (eLIM_MLM_WT_PROBE_RESP_STATE) || (eLIM_MLM_PASSIVE_SCAN_STATE) */
 	else {
-		lim_log(pMac, LOG1, FL("Rcvd Beacon in unexpected MLM state %d"),
+		lim_log(pMac, LOG1, FL("Rcvd Beacon in unexpected MLM state %s (%d)"),
+			lim_mlm_state_str(pMac->lim.gLimMlmState),
 			pMac->lim.gLimMlmState);
-		lim_print_mlm_state(pMac, LOG1, pMac->lim.gLimMlmState);
 #ifdef WLAN_DEBUG
 		pMac->lim.gLimUnexpBcnCnt++;
 #endif
diff --git a/core/mac/src/pe/lim/lim_process_message_queue.c b/core/mac/src/pe/lim/lim_process_message_queue.c
index bacb031ed16c..bb731323dbdf 100644
--- a/core/mac/src/pe/lim/lim_process_message_queue.c
+++ b/core/mac/src/pe/lim/lim_process_message_queue.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -288,6 +288,19 @@ uint8_t static def_msg_decision(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
 		    (limMsg->type != WMA_START_OEM_DATA_RSP) &&
 #endif
 		    (limMsg->type != WMA_ADD_TS_RSP) &&
+		    /*
+		     * LIM won't process any defer queue commands if gLimAddtsSent is
+		     * set to TRUE. gLimAddtsSent will be set TRUE to while sending
+		     * ADDTS REQ. Say, when deferring is enabled, if
+		     * SIR_LIM_ADDTS_RSP_TIMEOUT is posted (because of not receiving ADDTS
+		     * RSP) then this command will be added to defer queue and as
+		     * gLimAddtsSent is set TRUE LIM will never process any commands from
+		     * defer queue, including SIR_LIM_ADDTS_RSP_TIMEOUT. Hence allowing
+		     * SIR_LIM_ADDTS_RSP_TIMEOUT command to be processed with deferring
+		     * enabled, so that this will be processed immediately and sets
+		     * gLimAddtsSent to FALSE.
+		     */
+		    (limMsg->type != SIR_LIM_ADDTS_RSP_TIMEOUT) &&
 		    /* Allow processing of RX frames while awaiting reception
 		     * of ADD TS response over the air. This logic particularly
 		     * handles the case when host sends ADD BA request to FW
@@ -352,7 +365,7 @@ __lim_pno_match_fwd_bcn_probepsp(tpAniSirGlobal pmac, uint8_t *rx_pkt_info,
 		result->ap[i].capability =
 			lim_get_u16((uint8_t *) &frame->capabilityInfo);
 		result->ap[i].channel = WMA_GET_RX_CH(rx_pkt_info);
-		result->ap[i].rssi = WMA_GET_RX_RSSI_DB(rx_pkt_info);
+		result->ap[i].rssi = WMA_GET_RX_RSSI_NORMALIZED(rx_pkt_info);
 		result->ap[i].rtt = 0;
 		result->ap[i].rtt_sd = 0;
 		result->ap[i].ieLength = ie_len;
@@ -403,7 +416,7 @@ __lim_ext_scan_forward_bcn_probe_rsp(tpAniSirGlobal pmac, uint8_t *rx_pkt_info,
 	result->ap.capability =
 			lim_get_u16((uint8_t *) &frame->capabilityInfo);
 	result->ap.channel = WMA_GET_RX_CH(rx_pkt_info);
-	result->ap.rssi = WMA_GET_RX_RSSI_DB(rx_pkt_info);
+	result->ap.rssi = WMA_GET_RX_RSSI_NORMALIZED(rx_pkt_info);
 	result->ap.rtt = 0;
 	result->ap.rtt_sd = 0;
 	result->ap.ieLength = ie_len;
@@ -804,8 +817,7 @@ lim_handle80211_frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, uint8_t *pDeferMsg
 		if (fc.subType == SIR_MAC_MGMT_AUTH) {
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
 			lim_log(pMac, LOG1,
-				FL
-					("ProtVersion %d, Type %d, Subtype %d rateIndex=%d"),
+				FL("ProtVersion %d, Type %d, Subtype %d rateIndex=%d"),
 				fc.protVer, fc.type, fc.subType,
 				WMA_GET_RX_MAC_RATE_IDX(pRxPacketInfo));
 			lim_print_mac_addr(pMac, pHdr->bssId, LOG1);
@@ -813,31 +825,28 @@ lim_handle80211_frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, uint8_t *pDeferMsg
 			if (lim_process_auth_frame_no_session
 				    (pMac, pRxPacketInfo,
 				    limMsg->bodyptr) == eSIR_SUCCESS) {
-				lim_pkt_free(pMac, TXRX_FRM_802_11_MGMT,
-					     pRxPacketInfo, limMsg->bodyptr);
-				return;
+				goto end;
 			}
 		}
 #endif
+		/* Public action frame can be received from non-assoc stations*/
 		if ((fc.subType != SIR_MAC_MGMT_PROBE_RSP) &&
 		    (fc.subType != SIR_MAC_MGMT_BEACON) &&
 		    (fc.subType != SIR_MAC_MGMT_PROBE_REQ)
-		    && (fc.subType != SIR_MAC_MGMT_ACTION)      /* Public action frame can be received from non-associated stations. */
-		    ) {
-
-			if ((psessionEntry =
-				     pe_find_session_by_peer_sta(pMac, pHdr->sa,
-								 &sessionId)) == NULL) {
-				lim_log(pMac, LOG1,
-					FL
-						("session does not exist for given bssId"));
-				lim_pkt_free(pMac, TXRX_FRM_802_11_MGMT,
-					     pRxPacketInfo, limMsg->bodyptr);
-				return;
-			} else
-				lim_log(pMac, LOG1,
-					"SessionId:%d Session Exist for given Bssid",
+		    && (fc.subType != SIR_MAC_MGMT_ACTION)) {
+
+			psessionEntry = pe_find_session_by_peer_sta(pMac,
+						pHdr->sa, &sessionId);
+			if (psessionEntry == NULL) {
+				lim_log(pMac, LOG3,
+					FL("session does not exist for bssId"));
+				lim_print_mac_addr(pMac, pHdr->sa, LOG3);
+				goto end;
+			} else {
+				lim_log(pMac, LOG3,
+					"SessionId:%d exists for given Bssid",
 					psessionEntry->peSessionId);
+			}
 		}
 		/*  For p2p resp frames search for valid session with DA as */
 		/*  BSSID will be SA and session will be present with DA only */
@@ -850,9 +859,7 @@ lim_handle80211_frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, uint8_t *pDeferMsg
 	/* Check if frame is registered by HDD */
 	if (lim_check_mgmt_registered_frames(pMac, pRxPacketInfo, psessionEntry)) {
 		lim_log(pMac, LOG1, FL("Received frame is passed to SME"));
-		lim_pkt_free(pMac, TXRX_FRM_802_11_MGMT, pRxPacketInfo,
-			     limMsg->bodyptr);
-		return;
+		goto end;
 	}
 
 	if (fc.protVer != SIR_MAC_PROTOCOL_VERSION) {   /* Received Frame with non-zero Protocol Version */
@@ -864,7 +871,7 @@ lim_handle80211_frames(tpAniSirGlobal pMac, tpSirMsgQ limMsg, uint8_t *pDeferMsg
 #ifdef WLAN_DEBUG
 		pMac->lim.numProtErr++;
 #endif
-		return;
+		goto end;
 	}
 
 /* Chance of crashing : to be done BT-AMP ........happens when broadcast probe req is received */
@@ -1360,6 +1367,7 @@ void lim_process_messages(tpAniSirGlobal mac_ctx, tpSirMsgQ msg)
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 	case eWNI_SME_GET_TSM_STATS_REQ:
 #endif  /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
+	case eWNI_SME_REGISTER_MGMT_FRAME_CB:
 	case eWNI_SME_EXT_CHANGE_CHANNEL:
 	/* These messages are from HDD.No need to respond to HDD */
 		lim_process_normal_hdd_msg(mac_ctx, msg, false);
@@ -1495,28 +1503,14 @@ void lim_process_messages(tpAniSirGlobal mac_ctx, tpSirMsgQ msg)
 		cdf_mem_free(msg->bodyptr);
 		msg->bodyptr = NULL;
 		break;
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	case WMA_ROAM_OFFLOAD_SYNCH_IND:
-		lim_roam_offload_synch_ind(mac_ctx, msg);
-		/* bodyPtr is freed after handling
-		 * eWNI_SME_ROAM_OFFLOAD_SYNCH_IND in sme_ProcessMsg */
-		break;
-#endif
 	case SIR_LIM_ADDTS_RSP_TIMEOUT:
 		lim_process_sme_req_messages(mac_ctx, msg);
 		break;
 #ifdef FEATURE_WLAN_ESE
-	case SIR_LIM_ESE_TSM_TIMEOUT:
-#ifndef FEATURE_WLAN_ESE_UPLOAD
-		limProcessTsmTimeoutHandler(mac_ctx, msg);
-#endif /* FEATURE_WLAN_ESE_UPLOAD */
-		break;
 	case WMA_TSM_STATS_RSP:
 #ifdef FEATURE_WLAN_ESE_UPLOAD
 		lim_send_sme_pe_ese_tsm_rsp(mac_ctx,
 			(tAniGetTsmStatsRsp *) msg->bodyptr);
-#else
-		limProcessHalEseTsmRsp(mac_ctx, msg);
 #endif /* FEATURE_WLAN_ESE_UPLOAD */
 		break;
 #endif
diff --git a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
index 8693bd801f20..21b1bb2ca939 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -367,31 +367,36 @@ void lim_send_hal_oem_data_req(tpAniSirGlobal mac_ctx)
 	tpStartOemDataReq start_oem_data_req = NULL;
 	tSirRetStatus rc = eSIR_SUCCESS;
 	tpLimMlmOemDataRsp mlm_oem_data_rsp;
-	uint32_t reqlen = 0;
 
 	if (NULL == mac_ctx->lim.gpLimMlmOemDataReq) {
 		lim_log(mac_ctx, LOGE, FL("Null pointer"));
 		goto error;
 	}
 
-	reqlen = sizeof(tStartOemDataReq);
-
-	start_oem_data_req = cdf_mem_malloc(reqlen);
+	start_oem_data_req = cdf_mem_malloc(sizeof(*start_oem_data_req));
 	if (NULL == start_oem_data_req) {
 		lim_log(mac_ctx, LOGE, FL
 			("Could not allocate memory for start_oem_data_req"));
 		goto error;
 	}
 
-	cdf_mem_set((uint8_t *) (start_oem_data_req), reqlen, 0);
+	start_oem_data_req->data =
+		cdf_mem_malloc(mac_ctx->lim.gpLimMlmOemDataReq->data_len);
+	if (!start_oem_data_req->data) {
+		lim_log(mac_ctx, LOGE, FL("memory allocation failed"));
+		cdf_mem_free(start_oem_data_req);
+		goto error;
+	}
 
 	/* Now copy over the information to the OEM DATA REQ to HAL */
 	cdf_copy_macaddr(&start_oem_data_req->selfMacAddr,
 			 &mac_ctx->lim.gpLimMlmOemDataReq->selfMacAddr);
 
-	cdf_mem_copy(start_oem_data_req->oemDataReq,
-		     mac_ctx->lim.gpLimMlmOemDataReq->oemDataReq,
-		     OEM_DATA_REQ_SIZE);
+	start_oem_data_req->data_len =
+			mac_ctx->lim.gpLimMlmOemDataReq->data_len;
+	cdf_mem_copy(start_oem_data_req->data,
+		     mac_ctx->lim.gpLimMlmOemDataReq->data,
+		     mac_ctx->lim.gpLimMlmOemDataReq->data_len);
 
 	/* Create the message to be passed to HAL */
 	msg.type = WMA_START_OEM_DATA_REQ;
@@ -406,6 +411,7 @@ void lim_send_hal_oem_data_req(tpAniSirGlobal mac_ctx)
 		return;
 
 	SET_LIM_PROCESS_DEFD_MESGS(mac_ctx, true);
+	cdf_mem_free(start_oem_data_req->data);
 	cdf_mem_free(start_oem_data_req);
 	lim_log(mac_ctx, LOGE,
 		FL("OEM_DATA: posting WMA_START_OEM_DATA_REQ to HAL failed"));
@@ -421,8 +427,14 @@ error:
 			("memory allocation for mlm_oem_data_rsp"));
 		return;
 	}
+	mlm_oem_data_rsp->target_rsp = false;
 
 	if (NULL != mac_ctx->lim.gpLimMlmOemDataReq) {
+		if (NULL != mac_ctx->lim.gpLimMlmOemDataReq->data) {
+			cdf_mem_free(
+				mac_ctx->lim.gpLimMlmOemDataReq->data);
+			mac_ctx->lim.gpLimMlmOemDataReq->data = NULL;
+		}
 		cdf_mem_free(mac_ctx->lim.gpLimMlmOemDataReq);
 		mac_ctx->lim.gpLimMlmOemDataReq = NULL;
 	}
@@ -788,6 +800,7 @@ static void lim_process_mlm_oem_data_req(tpAniSirGlobal mac_ctx,
 					 uint32_t *msg_buf)
 {
 	tLimMlmOemDataRsp *mlm_oem_data_rsp;
+	tLimMlmOemDataReq *data_req = (tLimMlmOemDataReq *) msg_buf;
 
 	if (((mac_ctx->lim.gLimMlmState == eLIM_MLM_IDLE_STATE) ||
 	     (mac_ctx->lim.gLimMlmState == eLIM_MLM_JOINED_STATE) ||
@@ -800,11 +813,19 @@ static void lim_process_mlm_oem_data_req(tpAniSirGlobal mac_ctx,
 		 * second OEM data request
 		 */
 		if (mac_ctx->lim.gpLimMlmOemDataReq) {
+			if (mac_ctx->lim.gpLimMlmOemDataReq->data) {
+				cdf_mem_free(
+				 mac_ctx->lim.gpLimMlmOemDataReq->data);
+				mac_ctx->lim.gpLimMlmOemDataReq->data =
+				 NULL;
+			}
 			cdf_mem_free(mac_ctx->lim.gpLimMlmOemDataReq);
 			mac_ctx->lim.gpLimMlmOemDataReq = NULL;
 		}
 
-		mac_ctx->lim.gpLimMlmOemDataReq = (tLimMlmOemDataReq *) msg_buf;
+		mac_ctx->lim.gpLimMlmOemDataReq = data_req;
+		mac_ctx->lim.gpLimMlmOemDataReq->data =
+			data_req->data;
 		mac_ctx->lim.gLimPrevMlmState = mac_ctx->lim.gLimMlmState;
 
 		lim_log(mac_ctx, LOG2, FL("Calling lim_send_hal_oem_data_req"));
@@ -822,6 +843,7 @@ static void lim_process_mlm_oem_data_req(tpAniSirGlobal mac_ctx,
 		/* Return Meas confirm with INVALID_PARAMETERS */
 		mlm_oem_data_rsp = cdf_mem_malloc(sizeof(tLimMlmOemDataRsp));
 		if (mlm_oem_data_rsp != NULL) {
+			mlm_oem_data_rsp->target_rsp = false;
 			lim_post_sme_message(mac_ctx, LIM_MLM_OEM_DATA_CNF,
 					     (uint32_t *) mlm_oem_data_rsp);
 			cdf_mem_free(mlm_oem_data_rsp);
@@ -1562,7 +1584,7 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 				 CDF_STATUS suspend_status, uint32_t *msg)
 {
 	uint16_t aid;
-	tSirMacAddr curr_bssid;
+	struct cdf_mac_addr curr_bssid;
 	tpDphHashNode stads;
 	tLimMlmDisassocReq *mlm_disassocreq;
 	tLimMlmDisassocCnf mlm_disassoccnf;
@@ -1592,19 +1614,19 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 		   "mlmstate %d from: " MAC_ADDRESS_STR),
 		mlm_disassocreq->sessionId, GET_LIM_SYSTEM_ROLE(session),
 		session->limMlmState,
-		MAC_ADDR_ARRAY(mlm_disassocreq->peerMacAddr));
+		MAC_ADDR_ARRAY(mlm_disassocreq->peer_macaddr.bytes));
 
-	sir_copy_mac_addr(curr_bssid, session->bssId);
+	cdf_mem_copy(curr_bssid.bytes, session->bssId, CDF_MAC_ADDR_SIZE);
 
 	switch (GET_LIM_SYSTEM_ROLE(session)) {
 	case eLIM_STA_ROLE:
 	case eLIM_BT_AMP_STA_ROLE:
-		if (!cdf_mem_compare(mlm_disassocreq->peerMacAddr,
-				     curr_bssid, sizeof(tSirMacAddr))) {
+		if (!cdf_is_macaddr_equal(&mlm_disassocreq->peer_macaddr,
+				     &curr_bssid)) {
 			lim_log(mac_ctx, LOGW,
 			  FL("received MLM_DISASSOC_REQ with invalid BSS id"));
 			lim_print_mac_addr(mac_ctx,
-				mlm_disassocreq->peerMacAddr, LOGW);
+				mlm_disassocreq->peer_macaddr.bytes, LOGW);
 
 			/*
 			 * Disassociation response due to host triggered
@@ -1621,7 +1643,8 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 			lim_log(mac_ctx, LOG1,
 				FL("send disassoc rsp with ret code %d for" MAC_ADDRESS_STR),
 				eSIR_SME_DEAUTH_STATUS,
-				MAC_ADDR_ARRAY(mlm_disassocreq->peerMacAddr));
+				MAC_ADDR_ARRAY(
+					mlm_disassocreq->peer_macaddr.bytes));
 
 			sme_disassoc_rsp->messageType = eWNI_SME_DISASSOC_RSP;
 			sme_disassoc_rsp->length = sizeof(tSirSmeDisassocRsp);
@@ -1630,9 +1653,8 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 			sme_disassoc_rsp->transactionId = 0;
 			sme_disassoc_rsp->statusCode = eSIR_SME_DEAUTH_STATUS;
 
-			cdf_mem_copy(sme_disassoc_rsp->peerMacAddr,
-				mlm_disassocreq->peerMacAddr,
-				sizeof(tSirMacAddr));
+			cdf_copy_macaddr(&sme_disassoc_rsp->peer_macaddr,
+					 &mlm_disassocreq->peer_macaddr);
 			msg = (uint32_t *)sme_disassoc_rsp;
 
 			lim_send_sme_disassoc_deauth_ntf(mac_ctx,
@@ -1661,7 +1683,8 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 	 * Check if there exists a context for the peer entity
 	 * to be disassociated with.
 	 */
-	stads = dph_lookup_hash_entry(mac_ctx, mlm_disassocreq->peerMacAddr,
+	stads = dph_lookup_hash_entry(mac_ctx,
+				      mlm_disassocreq->peer_macaddr.bytes,
 				      &aid, &session->dph.dphHashTable);
 	if (stads)
 		mlm_state = stads->mlmStaContext.mlmState;
@@ -1677,7 +1700,7 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 		 */
 		lim_log(mac_ctx, LOGW,
 			FL("Invalid MLM_DISASSOC_REQ, Addr= " MAC_ADDRESS_STR),
-			MAC_ADDR_ARRAY(mlm_disassocreq->peerMacAddr));
+			MAC_ADDR_ARRAY(mlm_disassocreq->peer_macaddr.bytes));
 		if (stads != NULL)
 			lim_log(mac_ctx, LOGE, FL("Sta MlmState : %d"),
 				stads->mlmStaContext.mlmState);
@@ -1713,7 +1736,7 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 
 		lim_send_disassoc_mgmt_frame(mac_ctx,
 			mlm_disassocreq->reasonCode,
-			mlm_disassocreq->peerMacAddr, session, true);
+			mlm_disassocreq->peer_macaddr.bytes, session, true);
 		/*
 		 * Abort Tx so that data frames won't be sent to the AP
 		 * after sending Disassoc.
@@ -1738,8 +1761,8 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 
 end:
 	cdf_mem_copy((uint8_t *) &mlm_disassoccnf.peerMacAddr,
-		     (uint8_t *) mlm_disassocreq->peerMacAddr,
-		     sizeof(tSirMacAddr));
+		     (uint8_t *) mlm_disassocreq->peer_macaddr.bytes,
+		     CDF_MAC_ADDR_SIZE);
 	mlm_disassoccnf.aid = mlm_disassocreq->aid;
 	mlm_disassoccnf.disassocTrigger = mlm_disassocreq->disassocTrigger;
 
@@ -1773,11 +1796,11 @@ bool lim_check_disassoc_deauth_ack_pending(tpAniSirGlobal mac_ctx,
 	disassoc_req = mac_ctx->lim.limDisassocDeauthCnfReq.pMlmDisassocReq;
 	deauth_req = mac_ctx->lim.limDisassocDeauthCnfReq.pMlmDeauthReq;
 	if ((disassoc_req && (cdf_mem_compare((uint8_t *) sta_mac,
-			      (uint8_t *) &disassoc_req->peerMacAddr,
-			       sizeof(tSirMacAddr)))) ||
+			      (uint8_t *) &disassoc_req->peer_macaddr.bytes,
+			       CDF_MAC_ADDR_SIZE))) ||
 	    (deauth_req && (cdf_mem_compare((uint8_t *) sta_mac,
-			      (uint8_t *) &deauth_req->peerMacAddr,
-			       sizeof(tSirMacAddr))))) {
+			      (uint8_t *) &deauth_req->peer_macaddr.bytes,
+			       CDF_MAC_ADDR_SIZE)))) {
 		PELOG1(lim_log(mac_ctx, LOG1,
 			       FL("Disassoc/Deauth ack pending"));)
 		return true;
@@ -1807,8 +1830,8 @@ void lim_clean_up_disassoc_deauth_req(tpAniSirGlobal mac_ctx,
 	mlm_disassoc_req = mac_ctx->lim.limDisassocDeauthCnfReq.pMlmDisassocReq;
 	if (mlm_disassoc_req &&
 	    (cdf_mem_compare((uint8_t *) sta_mac,
-			     (uint8_t *) &mlm_disassoc_req->peerMacAddr,
-			     sizeof(tSirMacAddr)))) {
+			     (uint8_t *) &mlm_disassoc_req->peer_macaddr.bytes,
+			     CDF_MAC_ADDR_SIZE))) {
 		if (clean_rx_path) {
 			lim_process_disassoc_ack_timeout(mac_ctx);
 		} else {
@@ -1826,8 +1849,8 @@ void lim_clean_up_disassoc_deauth_req(tpAniSirGlobal mac_ctx,
 	mlm_deauth_req = mac_ctx->lim.limDisassocDeauthCnfReq.pMlmDeauthReq;
 	if (mlm_deauth_req &&
 	    (cdf_mem_compare((uint8_t *) sta_mac,
-			     (uint8_t *) &mlm_deauth_req->peerMacAddr,
-			     sizeof(tSirMacAddr)))) {
+			     (uint8_t *) &mlm_deauth_req->peer_macaddr.bytes,
+			     CDF_MAC_ADDR_SIZE))) {
 		if (clean_rx_path) {
 			lim_process_deauth_ack_timeout(mac_ctx);
 		} else {
@@ -1874,7 +1897,6 @@ static void
 lim_process_mlm_disassoc_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 {
 	tLimMlmDisassocReq *mlm_disassoc_req;
-	tpPESession session;
 
 	if (msg_buf == NULL) {
 		lim_log(mac_ctx, LOGE,
@@ -1886,16 +1908,7 @@ lim_process_mlm_disassoc_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 	lim_log(mac_ctx, LOG1,
 		FL("Process disassoc req, sessionID %d from: "MAC_ADDRESS_STR),
 		mlm_disassoc_req->sessionId,
-		MAC_ADDR_ARRAY(mlm_disassoc_req->peerMacAddr));
-
-	session = pe_find_session_by_session_id(mac_ctx,
-				mlm_disassoc_req->sessionId);
-	if (NULL == session) {
-		lim_log(mac_ctx, LOGE,
-			FL("session does not exist for given sessionId %d"),
-			mlm_disassoc_req->sessionId);
-		return;
-	}
+		MAC_ADDR_ARRAY(mlm_disassoc_req->peer_macaddr.bytes));
 
 	lim_process_mlm_disassoc_req_ntf(mac_ctx, CDF_STATUS_SUCCESS,
 					 (uint32_t *) msg_buf);
@@ -1945,7 +1958,7 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 		mlm_deauth_req->sessionId,
 		GET_LIM_SYSTEM_ROLE(session),
 		session->limMlmState,
-		MAC_ADDR_ARRAY(mlm_deauth_req->peerMacAddr));
+		MAC_ADDR_ARRAY(mlm_deauth_req->peer_macaddr.bytes));
 	sir_copy_mac_addr(curr_bssId, session->bssId);
 
 	switch (GET_LIM_SYSTEM_ROLE(session)) {
@@ -1962,14 +1975,14 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 		case eLIM_MLM_AUTHENTICATED_STATE:
 		case eLIM_MLM_WT_ASSOC_RSP_STATE:
 		case eLIM_MLM_LINK_ESTABLISHED_STATE:
-			if (!cdf_mem_compare(mlm_deauth_req->peerMacAddr,
-					curr_bssId, sizeof(tSirMacAddr))) {
+			if (!cdf_mem_compare(mlm_deauth_req->peer_macaddr.bytes,
+					curr_bssId, CDF_MAC_ADDR_SIZE)) {
 				lim_log(mac_ctx, LOGE,
 					FL("received MLM_DEAUTH_REQ with invalid BSS id "
 					   "Peer MAC: "MAC_ADDRESS_STR
 					   " CFG BSSID Addr : "MAC_ADDRESS_STR),
 					MAC_ADDR_ARRAY(
-						mlm_deauth_req->peerMacAddr),
+						mlm_deauth_req->peer_macaddr.bytes),
 					MAC_ADDR_ARRAY(curr_bssId));
 				/*
 				 * Deauthentication response to host triggered
@@ -1986,7 +1999,8 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 				lim_log(mac_ctx, LOG1,
 					FL("send deauth rsp with ret code %d for" MAC_ADDRESS_STR),
 					eSIR_SME_DEAUTH_STATUS,
-					MAC_ADDR_ARRAY(mlm_deauth_req->peerMacAddr));
+					MAC_ADDR_ARRAY(
+					  mlm_deauth_req->peer_macaddr.bytes));
 
 				sme_deauth_rsp->messageType =
 						eWNI_SME_DEAUTH_RSP;
@@ -1998,9 +2012,9 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 						mlm_deauth_req->sessionId;
 				sme_deauth_rsp->transactionId = 0;
 
-				cdf_mem_copy(sme_deauth_rsp->peerMacAddr,
-						mlm_deauth_req->peerMacAddr,
-						sizeof(tSirMacAddr));
+				cdf_mem_copy(sme_deauth_rsp->peer_macaddr.bytes,
+					     mlm_deauth_req->peer_macaddr.bytes,
+					     CDF_MAC_ADDR_SIZE);
 
 				msg_buf = (uint32_t *)sme_deauth_rsp;
 
@@ -2015,9 +2029,9 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 			     eLIM_MLM_WT_ASSOC_RSP_STATE)) {
 				/* Send deauth frame to peer entity */
 				lim_send_deauth_mgmt_frame(mac_ctx,
-						mlm_deauth_req->reasonCode,
-						mlm_deauth_req->peerMacAddr,
-						session, false);
+					mlm_deauth_req->reasonCode,
+					mlm_deauth_req->peer_macaddr.bytes,
+					session, false);
 				/* Prepare and Send LIM_MLM_DEAUTH_CNF */
 				mlm_deauth_cnf.resultCode = eSIR_SME_SUCCESS;
 				session->limMlmState = eLIM_MLM_IDLE_STATE;
@@ -2032,7 +2046,8 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 				FL("received MLM_DEAUTH_REQ with in state %d for peer "
 				   MAC_ADDRESS_STR),
 				session->limMlmState,
-				MAC_ADDR_ARRAY(mlm_deauth_req->peerMacAddr));
+				MAC_ADDR_ARRAY(
+					mlm_deauth_req->peer_macaddr.bytes));
 			lim_print_mlm_state(mac_ctx, LOGW,
 					    session->limMlmState);
 			/* Prepare and Send LIM_MLM_DEAUTH_CNF */
@@ -2065,13 +2080,14 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 	 * Check if there exists a context for the peer entity
 	 * to be deauthenticated with.
 	 */
-	sta_ds = dph_lookup_hash_entry(mac_ctx, mlm_deauth_req->peerMacAddr,
+	sta_ds = dph_lookup_hash_entry(mac_ctx,
+				       mlm_deauth_req->peer_macaddr.bytes,
 				       &aid, &session->dph.dphHashTable);
 
 	if (sta_ds == NULL) {
 		/* Check if there exists pre-auth context for this STA */
 		auth_node = lim_search_pre_auth_list(mac_ctx,
-						mlm_deauth_req->peerMacAddr);
+					mlm_deauth_req->peer_macaddr.bytes);
 		if (auth_node == NULL) {
 			/*
 			 * Received DEAUTH REQ for a STA that is neither
@@ -2083,19 +2099,20 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 				   "does not have context, Addr="
 				   MAC_ADDRESS_STR),
 				session->limMlmState,
-				MAC_ADDR_ARRAY(mlm_deauth_req->peerMacAddr));
+				MAC_ADDR_ARRAY(
+					mlm_deauth_req->peer_macaddr.bytes));
 			mlm_deauth_cnf.resultCode =
 				eSIR_SME_STA_NOT_AUTHENTICATED;
 		} else {
 			mlm_deauth_cnf.resultCode = eSIR_SME_SUCCESS;
 			/* Delete STA from pre-auth STA list */
 			lim_delete_pre_auth_node(mac_ctx,
-						 mlm_deauth_req->peerMacAddr);
+					 mlm_deauth_req->peer_macaddr.bytes);
 			/* Send Deauthentication frame to peer entity */
 			lim_send_deauth_mgmt_frame(mac_ctx,
-						   mlm_deauth_req->reasonCode,
-						   mlm_deauth_req->peerMacAddr,
-						   session, false);
+					   mlm_deauth_req->reasonCode,
+					   mlm_deauth_req->peer_macaddr.bytes,
+					   session, false);
 		}
 		goto end;
 	} else if ((sta_ds->mlmStaContext.mlmState !=
@@ -2108,7 +2125,7 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 		 */
 		lim_log(mac_ctx, LOGW,
 			FL("Invalid MLM_DEAUTH_REQ, Addr="MAC_ADDRESS_STR),
-			MAC_ADDR_ARRAY(mlm_deauth_req->peerMacAddr));
+			MAC_ADDR_ARRAY(mlm_deauth_req->peer_macaddr.bytes));
 		/* Prepare and Send LIM_MLM_DEAUTH_CNF */
 		mlm_deauth_cnf.resultCode = eSIR_SME_INVALID_PARAMETERS;
 		goto end;
@@ -2129,12 +2146,12 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 	sta_ds->mlmStaContext.mlmState = eLIM_MLM_WT_DEL_STA_RSP_STATE;
 	/* Send Deauthentication frame to peer entity */
 	lim_send_deauth_mgmt_frame(mac_ctx, mlm_deauth_req->reasonCode,
-				   mlm_deauth_req->peerMacAddr, session, true);
+				   mlm_deauth_req->peer_macaddr.bytes,
+				   session, true);
 	return;
 end:
-	cdf_mem_copy((uint8_t *) &mlm_deauth_cnf.peerMacAddr,
-		     (uint8_t *) mlm_deauth_req->peerMacAddr,
-		     sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&mlm_deauth_cnf.peer_macaddr,
+			 &mlm_deauth_req->peer_macaddr);
 	mlm_deauth_cnf.deauthTrigger = mlm_deauth_req->deauthTrigger;
 	mlm_deauth_cnf.aid = mlm_deauth_req->aid;
 	mlm_deauth_cnf.sessionId = mlm_deauth_req->sessionId;
@@ -2188,7 +2205,7 @@ lim_process_mlm_deauth_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		FL("Process Deauth Req on sessionID %d from: "
 		   MAC_ADDRESS_STR),
 		mlm_deauth_req->sessionId,
-		MAC_ADDR_ARRAY(mlm_deauth_req->peerMacAddr));
+		MAC_ADDR_ARRAY(mlm_deauth_req->peer_macaddr.bytes));
 
 	session = pe_find_session_by_session_id(mac_ctx,
 				mlm_deauth_req->sessionId);
@@ -2219,7 +2236,7 @@ lim_process_mlm_set_keys_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 	uint16_t aid;
 	uint16_t sta_idx = 0;
 	uint32_t default_key_id = 0;
-	tSirMacAddr curr_bssid;
+	struct cdf_mac_addr curr_bssid;
 	tpDphHashNode sta_ds;
 	tLimMlmSetKeysReq *mlm_set_keys_req;
 	tLimMlmSetKeysCnf mlm_set_keys_cnf;
@@ -2246,8 +2263,8 @@ lim_process_mlm_set_keys_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		   "AID [%d], ED Type [%d], # Keys [%d] & Peer MAC Addr - "),
 		mlm_set_keys_req->aid, mlm_set_keys_req->edType,
 		mlm_set_keys_req->numKeys);
-	lim_print_mac_addr(mac_ctx, mlm_set_keys_req->peerMacAddr, LOGW);
-	sir_copy_mac_addr(curr_bssid, session->bssId);
+	lim_print_mac_addr(mac_ctx, mlm_set_keys_req->peer_macaddr.bytes, LOGW);
+	cdf_mem_copy(curr_bssid.bytes, session->bssId, CDF_MAC_ADDR_SIZE);
 
 	switch (GET_LIM_SYSTEM_ROLE(session)) {
 	case eLIM_STA_ROLE:
@@ -2257,13 +2274,15 @@ lim_process_mlm_set_keys_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		 * check if TDLS is enabled.
 		 */
 #ifndef FEATURE_WLAN_TDLS
-		if ((!lim_is_addr_bc(mlm_set_keys_req->peerMacAddr)) &&
-		    (!cdf_mem_compare(mlm_set_keys_req->peerMacAddr,
-				      curr_bssid, sizeof(tSirMacAddr)))) {
+		if ((!cdf_is_macaddr_broadcast(
+				&mlm_set_keys_req->peer_macaddr)) &&
+		    (!cdf_is_macaddr_equal(&mlm_set_keys_req->peer_macaddr,
+					   &curr_bssid))) {
 			lim_log(mac_ctx, LOGW,
 				FL("Received MLM_SETKEYS_REQ with invalid BSSID"
 				MAC_ADDRESS_STR),
-				MAC_ADDR_ARRAY(mlm_set_keys_req->peerMacAddr));
+				MAC_ADDR_ARRAY(mlm_set_keys_req->
+						peer_macaddr.bytes));
 			/*
 			 * Prepare and Send LIM_MLM_SETKEYS_CNF with error code
 			 */
@@ -2290,7 +2309,7 @@ lim_process_mlm_set_keys_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 	 * mlm_set_keys_req->key.unicast = 0 -> Multicast/broadcast
 	 * mlm_set_keys_req->key.unicast - 1 -> Unicast keys are being set
 	 */
-	if (lim_is_addr_bc(mlm_set_keys_req->peerMacAddr)) {
+	if (cdf_is_macaddr_broadcast(&mlm_set_keys_req->peer_macaddr)) {
 		lim_log(mac_ctx, LOG1, FL("Trying to set Group Keys...%d "),
 			mlm_set_keys_req->sessionId);
 		/*
@@ -2314,7 +2333,7 @@ lim_process_mlm_set_keys_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		 * peer entity for which keys need to be set.
 		 */
 		sta_ds = dph_lookup_hash_entry(mac_ctx,
-				mlm_set_keys_req->peerMacAddr, &aid,
+				mlm_set_keys_req->peer_macaddr.bytes, &aid,
 				&session->dph.dphHashTable);
 		if ((sta_ds == NULL) ||
 		    ((sta_ds->mlmStaContext.mlmState !=
@@ -2327,7 +2346,8 @@ lim_process_mlm_set_keys_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 			lim_log(mac_ctx, LOG1,
 				FL("Invalid MLM_SETKEYS_REQ, Addr = "
 				   MAC_ADDRESS_STR),
-				MAC_ADDR_ARRAY(mlm_set_keys_req->peerMacAddr));
+				MAC_ADDR_ARRAY(mlm_set_keys_req->
+						peer_macaddr.bytes));
 			/* Prepare and Send LIM_MLM_SETKEYS_CNF */
 			mlm_set_keys_cnf.resultCode =
 				eSIR_SME_INVALID_PARAMETERS;
@@ -2362,7 +2382,7 @@ lim_process_mlm_set_keys_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		FL("Trying to set keys for STA Index [%d], using default_key_id [%d]"),
 		sta_idx, default_key_id);
 
-	if (lim_is_addr_bc(mlm_set_keys_req->peerMacAddr)) {
+	if (cdf_is_macaddr_broadcast(&mlm_set_keys_req->peer_macaddr)) {
 		session->limPrevMlmState = session->limMlmState;
 		session->limMlmState = eLIM_MLM_WT_SET_BSS_KEY_STATE;
 		MTRACE(mac_trace(mac_ctx, TRACE_CODE_MLM_STATE,
@@ -2879,7 +2899,7 @@ void lim_complete_mlm_scan(tpAniSirGlobal mac_ctx, tSirResultCodes ret_code)
  */
 void lim_set_channel(tpAniSirGlobal mac_ctx, uint8_t channel,
 		     uint8_t ch_center_freq_seg0, uint8_t ch_center_freq_seg1,
-		     phy_ch_width ch_width, tPowerdBm max_tx_power,
+		     phy_ch_width ch_width, int8_t max_tx_power,
 		     uint8_t pe_session_id)
 {
 #if !defined WLAN_FEATURE_VOWIFI
@@ -2907,7 +2927,7 @@ void lim_set_channel(tpAniSirGlobal mac_ctx, uint8_t channel,
 	/* Send WMA_CHNL_SWITCH_IND to HAL */
 	lim_send_switch_chnl_params(mac_ctx, channel, ch_center_freq_seg0,
 				    ch_center_freq_seg1, ch_width,
-				    (tPowerdBm) localPwrConstraint,
+				    (int8_t)localPwrConstraint,
 				    pe_session_id, false);
 #endif
 }
diff --git a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
index 0fe37fe6da02..c64ef91effb6 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
@@ -1328,7 +1328,7 @@ void lim_process_mlm_deauth_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 			pMac->lim.gLimRspReqd = false;
 	}
 	/* On STA or on BASIC AP, send SME_DEAUTH_RSP to host */
-	lim_send_sme_deauth_ntf(pMac, pMlmDeauthCnf->peerMacAddr,
+	lim_send_sme_deauth_ntf(pMac, pMlmDeauthCnf->peer_macaddr.bytes,
 				resultCode,
 				pMlmDeauthCnf->deauthTrigger,
 				aid, psessionEntry->smeSessionId,
@@ -1482,14 +1482,14 @@ void lim_process_mlm_set_keys_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 		if (LIM_IS_AP_ROLE(psessionEntry) ||
 			LIM_IS_BT_AMP_AP_ROLE(psessionEntry)) {
 			sta_ds = dph_lookup_hash_entry(pMac,
-				pMlmSetKeysCnf->peerMacAddr,
+				pMlmSetKeysCnf->peer_macaddr.bytes,
 				&aid, &psessionEntry->dph.dphHashTable);
 			if (sta_ds != NULL)
 				sta_ds->is_key_installed = 1;
 		}
 	}
 	lim_send_sme_set_context_rsp(pMac,
-				     pMlmSetKeysCnf->peerMacAddr,
+				     pMlmSetKeysCnf->peer_macaddr,
 				     1,
 				     (tSirResultCodes) pMlmSetKeysCnf->resultCode,
 				     psessionEntry, psessionEntry->smeSessionId,
@@ -1546,12 +1546,19 @@ lim_handle_sme_join_result(tpAniSirGlobal mac_ctx,
 			 * to SME
 			 */
 			lim_cleanup_rx_path(mac_ctx, sta_ds, session_entry);
+			/* Cleanup if add bss failed */
+			if (session_entry->add_bss_failed) {
+				dph_delete_hash_entry(mac_ctx,
+					 sta_ds->staAddr, sta_ds->assocId,
+					 &session_entry->dph.dphHashTable);
+				goto error;
+			}
 			cdf_mem_free(session_entry->pLimJoinReq);
 			session_entry->pLimJoinReq = NULL;
 			return;
 		}
 	}
-
+error:
 	cdf_mem_free(session_entry->pLimJoinReq);
 	session_entry->pLimJoinReq = NULL;
 	/* Delete teh session if JOIN failure occurred. */
@@ -1624,9 +1631,17 @@ lim_handle_sme_reaasoc_result(tpAniSirGlobal pMac, tSirResultCodes resultCode,
 			pStaDs->mlmStaContext.resultCode = resultCode;
 			pStaDs->mlmStaContext.protStatusCode = protStatusCode;
 			lim_cleanup_rx_path(pMac, pStaDs, psessionEntry);
+			/* Cleanup if add bss failed */
+			if (psessionEntry->add_bss_failed) {
+				dph_delete_hash_entry(pMac,
+					 pStaDs->staAddr, pStaDs->assocId,
+					 &psessionEntry->dph.dphHashTable);
+				goto error;
+			}
 			return;
 		}
 	}
+error:
 	/* Delete teh session if REASSOC failure occurred. */
 	if (resultCode != eSIR_SME_SUCCESS) {
 		if (NULL != psessionEntry) {
@@ -2166,46 +2181,43 @@ void lim_process_sta_mlm_del_sta_rsp(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,
 		lim_log(pMac, LOGE, FL("Encountered NULL Pointer"));
 		goto end;
 	}
-	if (CDF_STATUS_SUCCESS == pDelStaParams->status) {
-		pStaDs =
-			dph_get_hash_entry(pMac, DPH_STA_HASH_INDEX_PEER,
-					   &psessionEntry->dph.dphHashTable);
-		if (pStaDs == NULL) {
-			/* TODO: any response to be sent out here ? */
-			lim_log(pMac, LOGE, FL("DPH Entry for STA %X missing."),
+	lim_log(pMac, LOG1, FL("Del STA RSP received. Status:%d AssocID:%d"),
+			pDelStaParams->status, pDelStaParams->assocId);
+
+	if (CDF_STATUS_SUCCESS != pDelStaParams->status)
+		lim_log(pMac, LOGE, FL(
+			"Del STA failed! Status:%d, proceeding with Del BSS"),
+			pDelStaParams->status);
+
+	pStaDs = dph_get_hash_entry(pMac, DPH_STA_HASH_INDEX_PEER,
+			&psessionEntry->dph.dphHashTable);
+	if (pStaDs == NULL) {
+		lim_log(pMac, LOGE, FL("DPH Entry for STA %X missing."),
 				pDelStaParams->assocId);
-			statusCode = eSIR_SME_REFUSED;
-			goto end;
-		}
-		if (eLIM_MLM_WT_DEL_STA_RSP_STATE != psessionEntry->limMlmState) {
-			/* TODO: any response to be sent out here ? */
-			lim_log(pMac, LOGE,
-				FL
-					("Received unexpected WMA_DELETE_STA_RSP in state %s"),
-				lim_mlm_state_str(psessionEntry->limMlmState));
-			statusCode = eSIR_SME_REFUSED;
-			goto end;
-		}
-		PELOG1(lim_log
-			       (pMac, LOG1, FL("STA AssocID %d MAC "), pStaDs->assocId);
-		       lim_print_mac_addr(pMac, pStaDs->staAddr, LOG1);
-		       )
-		lim_log(pMac, LOGW,
-			FL("DEL_STA_RSP received for assocID: %X"),
-			pDelStaParams->assocId);
-		/* we must complete all cleanup related to delSta before calling limDelBSS. */
-		if (0 != limMsgQ->bodyptr) {
-			cdf_mem_free(pDelStaParams);
-			limMsgQ->bodyptr = NULL;
-		}
-		statusCode =
-			(tSirResultCodes) lim_del_bss(pMac, pStaDs, 0, psessionEntry);
-		return;
-	} else {
-		lim_log(pMac, LOGE, FL("DEL_STA failed for sta Id %d"),
-			pDelStaParams->staIdx);
 		statusCode = eSIR_SME_REFUSED;
+		goto end;
 	}
+	if (eLIM_MLM_WT_DEL_STA_RSP_STATE != psessionEntry->limMlmState) {
+		lim_log(pMac, LOGE, FL(
+			"Received unexpected WDA_DELETE_STA_RSP in state %s"),
+			lim_mlm_state_str(psessionEntry->limMlmState));
+		statusCode = eSIR_SME_REFUSED;
+		goto end;
+	}
+	lim_log(pMac, LOG1, FL("STA AssocID %d MAC "), pStaDs->assocId);
+	lim_print_mac_addr(pMac, pStaDs->staAddr, LOG1);
+	/*
+	 * we must complete all cleanup related to delSta before
+	 * calling limDelBSS.
+	 */
+	if (0 != limMsgQ->bodyptr) {
+		cdf_mem_free(pDelStaParams);
+		limMsgQ->bodyptr = NULL;
+	}
+	/* Proceed to do DelBSS even if DelSta resulted in failure */
+	statusCode = (tSirResultCodes)lim_del_bss(pMac, pStaDs, 0,
+			psessionEntry);
+	return;
 end:
 	if (0 != limMsgQ->bodyptr) {
 		cdf_mem_free(pDelStaParams);
@@ -3056,6 +3068,7 @@ lim_process_sta_mlm_add_bss_rsp(tpAniSirGlobal mac_ctx,
 		else
 			mlm_assoc_cnf.resultCode =
 				(tSirResultCodes) eSIR_SME_REFUSED;
+		session_entry->add_bss_failed = true;
 	}
 
 	if (mlm_assoc_cnf.resultCode != eSIR_SME_SUCCESS) {
@@ -3257,9 +3270,8 @@ void lim_process_mlm_set_sta_key_rsp(tpAniSirGlobal mac_ctx,
 			(tpLimMlmSetKeysReq) mac_ctx->lim.gpLimMlmSetKeysReq;
 		/* Prepare and Send LIM_MLM_SETKEYS_CNF */
 		if (NULL != lpLimMlmSetKeysReq) {
-			cdf_mem_copy((uint8_t *) &mlm_set_key_cnf.peerMacAddr,
-				(uint8_t *) lpLimMlmSetKeysReq->peerMacAddr,
-				sizeof(tSirMacAddr));
+			cdf_copy_macaddr(&mlm_set_key_cnf.peer_macaddr,
+					 &lpLimMlmSetKeysReq->peer_macaddr);
 			/*
 			 * Free the buffer cached for the global
 			 * mac_ctx->lim.gpLimMlmSetKeysReq
@@ -3346,9 +3358,8 @@ void lim_process_mlm_set_bss_key_rsp(tpAniSirGlobal mac_ctx,
 
 	/* Prepare and Send LIM_MLM_SETKEYS_CNF */
 	if (NULL != set_key_req) {
-		cdf_mem_copy((uint8_t *) &set_key_cnf.peerMacAddr,
-			(uint8_t *) set_key_req->peerMacAddr,
-			sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&set_key_cnf.peer_macaddr,
+				 &set_key_req->peer_macaddr);
 		/*
 		 * Free the buffer cached for the
 		 * global mac_ctx->lim.gpLimMlmSetKeysReq
diff --git a/core/mac/src/pe/lim/lim_process_probe_req_frame.c b/core/mac/src/pe/lim/lim_process_probe_req_frame.c
index 1ed186ec59c5..6e45cd54057b 100644
--- a/core/mac/src/pe/lim/lim_process_probe_req_frame.c
+++ b/core/mac/src/pe/lim/lim_process_probe_req_frame.c
@@ -61,7 +61,7 @@ lim_send_sme_probe_req_ind(tpAniSirGlobal pMac,
 /**
  * lim_get_wpspbc_sessions() - to get wps pbs sessions
  * @mac_ctx: Pointer to Global MAC structure
- * @addr: A pointer to probe request source MAC addresss
+ * @addr: probe request source MAC addresss
  * @uuid_e: A pointer to UUIDE element of WPS IE in WPS PBC probe request
  * @session: A pointer to station PE session
  *
@@ -71,7 +71,7 @@ lim_send_sme_probe_req_ind(tpAniSirGlobal pMac,
  * @return None
  */
 
-void lim_get_wpspbc_sessions(tpAniSirGlobal mac_ctx, uint8_t *addr,
+void lim_get_wpspbc_sessions(tpAniSirGlobal mac_ctx, struct cdf_mac_addr addr,
 		uint8_t *uuid_e, eWPSPBCOverlap *overlap,
 		tpPESession session)
 {
@@ -81,7 +81,7 @@ void lim_get_wpspbc_sessions(tpAniSirGlobal mac_ctx, uint8_t *addr,
 
 	cur_time = (uint32_t) (cdf_mc_timer_get_system_ticks() /
 						CDF_TICKS_PER_SECOND);
-	cdf_mem_set((uint8_t *) addr, sizeof(tSirMacAddr), 0);
+	cdf_zero_macaddr(&addr);
 	cdf_mem_set((uint8_t *) uuid_e, SIR_WPS_UUID_LEN, 0);
 	for (pbc = session->pAPWPSPBCSession; pbc; pbc = pbc->next) {
 		if (cur_time > pbc->timestamp + SIR_WPS_PBC_WALK_TIME)
@@ -89,8 +89,7 @@ void lim_get_wpspbc_sessions(tpAniSirGlobal mac_ctx, uint8_t *addr,
 		count++;
 		if (count > 1)
 			break;
-		cdf_mem_copy((uint8_t *) addr, (uint8_t *) pbc->addr,
-				sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&addr, &pbc->addr);
 		cdf_mem_copy((uint8_t *) uuid_e, (uint8_t *) pbc->uuid_e,
 				SIR_WPS_UUID_LEN);
 	}
@@ -105,8 +104,8 @@ void lim_get_wpspbc_sessions(tpAniSirGlobal mac_ctx, uint8_t *addr,
 		*overlap = eSAP_WPSPBC_ONE_WPSPBC_PROBE_REQ_IN120S;
 
 	lim_log(mac_ctx, LOGE, FL("overlap = %d"), *overlap);
-	sir_dump_buf(mac_ctx, SIR_LIM_MODULE_ID, LOGE, addr,
-			sizeof(tSirMacAddr));
+	sir_dump_buf(mac_ctx, SIR_LIM_MODULE_ID, LOGE, addr.bytes,
+			CDF_MAC_ADDR_SIZE);
 	sir_dump_buf(mac_ctx, SIR_LIM_MODULE_ID, LOGE, uuid_e,
 			SIR_WPS_UUID_LEN);
 	return;
@@ -145,26 +144,31 @@ static void lim_remove_timeout_pbc_sessions(tpAniSirGlobal pMac,
 	}
 }
 
-void lim_remove_pbc_sessions(tpAniSirGlobal pMac, tSirMacAddr pRemoveMac,
-			     tpPESession psessionEntry)
+/**
+ * lim_remove_pbc_sessions() - Remove PBC sessions
+ * @mac: Pointer to Global MAC structure
+ * @remove_mac: MAC Address of STA in WPS Session to be removed
+ * @session_entry: session entry
+ *
+ * Return: none
+ */
+void lim_remove_pbc_sessions(tpAniSirGlobal mac, struct cdf_mac_addr remove_mac,
+			     tpPESession session_entry)
 {
 	tSirWPSPBCSession *pbc, *prev = NULL;
-	prev = pbc = psessionEntry->pAPWPSPBCSession;
+	prev = pbc = session_entry->pAPWPSPBCSession;
 
 	while (pbc) {
-		if (cdf_mem_compare((uint8_t *) pbc->addr,
-				    (uint8_t *) pRemoveMac,
-				    sizeof(tSirMacAddr))) {
+		if (cdf_is_macaddr_equal(&pbc->addr, &remove_mac)) {
 			prev->next = pbc->next;
-			if (pbc == psessionEntry->pAPWPSPBCSession)
-				psessionEntry->pAPWPSPBCSession = pbc->next;
+			if (pbc == session_entry->pAPWPSPBCSession)
+				session_entry->pAPWPSPBCSession = pbc->next;
 			cdf_mem_free(pbc);
 			return;
 		}
 		prev = pbc;
 		pbc = pbc->next;
 	}
-
 }
 
 /**
@@ -217,8 +221,8 @@ static void lim_update_pbc_session_entry(tpAniSirGlobal pMac,
 
 	while (pbc) {
 		if (cdf_mem_compare
-			    ((uint8_t *) pbc->addr, (uint8_t *) addr,
-			    sizeof(tSirMacAddr))
+			    ((uint8_t *) pbc->addr.bytes, (uint8_t *) addr,
+			    CDF_MAC_ADDR_SIZE)
 		    && cdf_mem_compare((uint8_t *) pbc->uuid_e,
 				       (uint8_t *) uuid_e, SIR_WPS_UUID_LEN)) {
 			if (prev)
@@ -239,8 +243,8 @@ static void lim_update_pbc_session_entry(tpAniSirGlobal pMac,
 			       )
 			return;
 		}
-		cdf_mem_copy((uint8_t *) pbc->addr, (uint8_t *) addr,
-			     sizeof(tSirMacAddr));
+		cdf_mem_copy((uint8_t *) pbc->addr.bytes, (uint8_t *) addr,
+			     CDF_MAC_ADDR_SIZE);
 
 		if (uuid_e)
 			cdf_mem_copy((uint8_t *) pbc->uuid_e,
@@ -664,10 +668,10 @@ lim_send_sme_probe_req_ind(tpAniSirGlobal pMac,
 	pSirSmeProbeReqInd->length = sizeof(tSirSmeProbeReq);
 	pSirSmeProbeReqInd->sessionId = psessionEntry->smeSessionId;
 
-	cdf_mem_copy(pSirSmeProbeReqInd->bssId, psessionEntry->bssId,
-		     sizeof(tSirMacAddr));
-	cdf_mem_copy(pSirSmeProbeReqInd->WPSPBCProbeReq.peerMacAddr,
-		     peerMacAddr, sizeof(tSirMacAddr));
+	cdf_mem_copy(pSirSmeProbeReqInd->bssid.bytes, psessionEntry->bssId,
+		     CDF_MAC_ADDR_SIZE);
+	cdf_mem_copy(pSirSmeProbeReqInd->WPSPBCProbeReq.peer_macaddr.bytes,
+		     peerMacAddr, CDF_MAC_ADDR_SIZE);
 
 	MTRACE(mac_trace_msg_tx(pMac, psessionEntry->peSessionId, msgQ.type));
 	pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIELen =
diff --git a/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c b/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c
index 0096b48cab36..16b960cf5e8d 100644
--- a/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c
+++ b/core/mac/src/pe/lim/lim_process_probe_rsp_frame.c
@@ -129,7 +129,7 @@ lim_process_probe_rsp_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_Packet_info,
 		FL("Probe Resp Frame Received: BSSID "
 		MAC_ADDRESS_STR " (RSSI %d)"),
 		MAC_ADDR_ARRAY(header->bssId),
-		(uint) abs((int8_t)WMA_GET_RX_RSSI_DB(rx_Packet_info)));
+		(uint) abs((int8_t)WMA_GET_RX_RSSI_NORMALIZED(rx_Packet_info)));
 	/* Get pointer to Probe Response frame body */
 	body = WMA_GET_RX_MPDU_DATA(rx_Packet_info);
 		/* Enforce Mandatory IEs */
@@ -161,6 +161,7 @@ lim_process_probe_rsp_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_Packet_info,
 		if (session_entry->beacon != NULL) {
 			cdf_mem_free(session_entry->beacon);
 			session_entry->beacon = NULL;
+			session_entry->bcnLen = 0;
 		}
 		session_entry->bcnLen =
 			WMA_GET_RX_PAYLOAD_LEN(rx_Packet_info);
@@ -348,7 +349,8 @@ lim_process_probe_rsp_frame_no_session(tpAniSirGlobal mac_ctx,
 		  FL("Probe Resp Frame Received: BSSID "
 		  MAC_ADDRESS_STR " (RSSI %d)"),
 		  MAC_ADDR_ARRAY(header->bssId),
-		  (uint) abs((int8_t)WMA_GET_RX_RSSI_DB(rx_packet_info)));
+		  (uint) abs((int8_t)WMA_GET_RX_RSSI_NORMALIZED(
+					rx_packet_info)));
 	/*
 	 * Get pointer to Probe Response frame body
 	 */
diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index 3846b8bba891..3d806079fb1d 100644
--- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -113,7 +113,8 @@ static void lim_process_modify_add_ies(tpAniSirGlobal pMac, uint32_t *pMsg);
 
 static void lim_process_update_add_ies(tpAniSirGlobal pMac, uint32_t *pMsg);
 
-extern void pe_register_wma_handle(tpAniSirGlobal pMac);
+extern void pe_register_wma_handle(tpAniSirGlobal pMac,
+		tSirSmeReadyReq *ready_req);
 
 static void lim_process_ext_change_channel(tpAniSirGlobal mac_ctx,
 						uint32_t *msg);
@@ -357,7 +358,7 @@ __lim_fresh_scan_reqd(tpAniSirGlobal mac_ctx, uint8_t return_fresh_results)
 
 static inline uint8_t __lim_is_sme_assoc_cnf_valid(tpSirSmeAssocCnf pAssocCnf)
 {
-	if (lim_is_group_addr(pAssocCnf->peerMacAddr))
+	if (cdf_is_macaddr_group(&pAssocCnf->peer_macaddr))
 		return false;
 	else
 		return true;
@@ -483,7 +484,8 @@ static bool __lim_process_sme_sys_ready_ind(tpAniSirGlobal pMac, uint32_t *pMsgB
 	msg.bodyval = 0;
 
 	if (ANI_DRIVER_TYPE(pMac) != eDRIVER_TYPE_MFG) {
-		pe_register_wma_handle(pMac);
+		ready_req->pe_roam_synch_cb = pe_roam_synch_callback;
+		pe_register_wma_handle(pMac, ready_req);
 		pMac->lim.add_bssdescr_callback = ready_req->add_bssdescr_cb;
 	}
 	PELOGW(lim_log(pMac, LOGW, FL("sending WMA_SYS_READY_IND msg to HAL"));)
@@ -496,60 +498,6 @@ static bool __lim_process_sme_sys_ready_ind(tpAniSirGlobal pMac, uint32_t *pMsgB
 	return false;
 }
 
-#ifdef WLAN_FEATURE_11AC
-
-uint32_t lim_get_center_channel(tpAniSirGlobal pMac, uint8_t primarychanNum,
-				ePhyChanBondState secondaryChanOffset,
-				uint8_t chanWidth)
-{
-	if (chanWidth == WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ) {
-		switch (secondaryChanOffset) {
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED:
-			return primarychanNum;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED:
-			return primarychanNum + 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED:
-			return primarychanNum - 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
-			return primarychanNum + 6;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
-			return primarychanNum + 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
-			return primarychanNum - 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
-			return primarychanNum - 6;
-		default:
-			return eSIR_CFG_INVALID_ID;
-		}
-	} else if (chanWidth == WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ) {
-		switch (secondaryChanOffset) {
-		case PHY_DOUBLE_CHANNEL_LOW_PRIMARY:
-			return primarychanNum + 2;
-		case PHY_DOUBLE_CHANNEL_HIGH_PRIMARY:
-			return primarychanNum - 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED:
-			return primarychanNum;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED:
-			return primarychanNum + 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED:
-			return primarychanNum - 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
-			return primarychanNum + 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
-			return primarychanNum - 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
-			return primarychanNum + 2;
-		case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
-			return primarychanNum - 2;
-		default:
-			return eSIR_CFG_INVALID_ID;
-		}
-	}
-	return primarychanNum;
-}
-
-#endif
-
 /**
  *lim_configure_ap_start_bss_session() - Configure the AP Start BSS in session.
  *@mac_ctx: Pointer to Global MAC structure
@@ -770,7 +718,6 @@ __lim_handle_sme_start_bss_request(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 			  session->vhtCapability);
 		session->txLdpcIniFeatureEnabled =
 			sme_start_bss_req->txLdpcIniFeatureEnabled;
-
 		if (mac_ctx->roam.configParam.enable2x2)
 			session->nss = 2;
 		else
@@ -793,6 +740,12 @@ __lim_handle_sme_start_bss_request(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		case eSIR_INFRA_AP_MODE:
 			lim_configure_ap_start_bss_session(mac_ctx, session,
 				sme_start_bss_req);
+			if (session->pePersona == CDF_SAP_MODE) {
+				session->txBFIniFeatureEnabled =
+					sme_start_bss_req->txbf_ini_enabled;
+				session->txbf_csn_value =
+					sme_start_bss_req->txbf_csn_val;
+			}
 			break;
 		case eSIR_IBSS_MODE:
 			session->limSystemRole = eLIM_STA_IN_IBSS_ROLE;
@@ -1396,11 +1349,12 @@ static void __lim_process_sme_scan_req(tpAniSirGlobal mac_ctx,
 
 	scan_req = (tpSirSmeScanReq) msg_buf;
 	lim_log(mac_ctx, LOG1,
-		FL("SME SCAN REQ id %d numChan %d min %d max %d IELen %d first %d fresh %d unique %d type %d rsp %d"),
+		FL("SME SCAN REQ id %d numChan %d min %d max %d IELen %d first %d fresh %d unique %d type %s (%d) rsp %d"),
 		scan_req->scan_id, scan_req->channelList.numChannels,
 		scan_req->minChannelTime, scan_req->maxChannelTime,
 		scan_req->uIEFieldLen, scan_req->returnAfterFirstMatch,
 		scan_req->returnFreshResults, scan_req->returnUniqueResults,
+		lim_scan_type_to_string(scan_req->scanType),
 		scan_req->scanType, mac_ctx->lim.gLimRspReqd ? 1 : 0);
 	/*
 	 * Since scan req always requires a response, we will overwrite response
@@ -1494,19 +1448,24 @@ static void __lim_process_sme_oem_data_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
 	pOemDataReq = (tpSirOemDataReq) pMsgBuf;
 
 	/* post the lim mlm message now */
-	pMlmOemDataReq = cdf_mem_malloc(sizeof(tLimMlmOemDataReq));
+	pMlmOemDataReq = cdf_mem_malloc(sizeof(*pMlmOemDataReq));
 	if (NULL == pMlmOemDataReq) {
 		lim_log(pMac, LOGP,
 			FL("AllocateMemory failed for mlmOemDataReq"));
 		return;
 	}
-	/* Initialize this buffer */
-	cdf_mem_set(pMlmOemDataReq, (sizeof(tLimMlmOemDataReq)), 0);
+	pMlmOemDataReq->data = cdf_mem_malloc(pOemDataReq->data_len);
+	if (!pMlmOemDataReq->data) {
+		lim_log(pMac, LOGP, FL("memory allocation failed"));
+		cdf_mem_free(pMlmOemDataReq);
+		return;
+	}
 
 	cdf_copy_macaddr(&pMlmOemDataReq->selfMacAddr,
 			 &pOemDataReq->selfMacAddr);
-	cdf_mem_copy(pMlmOemDataReq->oemDataReq, pOemDataReq->oemDataReq,
-		     OEM_DATA_REQ_SIZE);
+	pMlmOemDataReq->data_len = pOemDataReq->data_len;
+	cdf_mem_copy(pMlmOemDataReq->data, pOemDataReq->data,
+		     pOemDataReq->data_len);
 
 	/* Issue LIM_MLM_OEM_DATA_REQ to MLM */
 	lim_post_mlm_message(pMac, LIM_MLM_OEM_DATA_REQ,
@@ -1562,7 +1521,7 @@ __lim_process_sme_join_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 	tpPESession session = NULL;
 	uint8_t sme_session_id;
 	uint16_t sme_transaction_id;
-	tPowerdBm local_power_constraint = 0, reg_max = 0;
+	int8_t local_power_constraint = 0, reg_max = 0;
 	uint16_t ie_len;
 	uint8_t *vendor_ie;
 	tSirBssDescription bss_desc;
@@ -1786,17 +1745,7 @@ __lim_process_sme_join_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 			CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_INFO_MED,
 				  "%s: txBFCsnValue=%d", __func__,
 				  sme_join_req->txBFCsnValue);
-			if (cfg_set_int(mac_ctx,
-				WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED,
-				sme_join_req->txBFCsnValue) != eSIR_SUCCESS) {
-				/*
-				 * Set Failed for CFG
-				 * CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED
-				 */
-				lim_log(mac_ctx, LOGP, FL("Set Fail CFG"));
-				ret_code = eSIR_LOGP_EXCEPTION;
-				goto end;
-			}
+			session->txbf_csn_value = sme_join_req->txBFCsnValue;
 		}
 #endif
 
@@ -1829,26 +1778,10 @@ __lim_process_sme_join_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 
 		/* Record if management frames need to be protected */
 #ifdef WLAN_FEATURE_11W
-		if (eSIR_ED_AES_128_CMAC == sme_join_req->MgmtEncryptionType) {
-			CDF_STATUS cdf_status;
+		if (eSIR_ED_AES_128_CMAC == sme_join_req->MgmtEncryptionType)
 			session->limRmfEnabled = 1;
-			session->pmfComebackTimerInfo.pMac = mac_ctx;
-			session->pmfComebackTimerInfo.sessionID =
-				session_id;
-			cdf_status = cdf_mc_timer_init(
-					&session->pmfComebackTimer,
-					CDF_TIMER_TYPE_SW,
-					lim_pmf_comeback_timer_callback,
-					(void *)&session->pmfComebackTimerInfo);
-			if (CDF_STATUS_SUCCESS != cdf_status) {
-				lim_log(mac_ctx, LOGP,
-					FL("cannot init pmf comeback timer."));
-				ret_code = eSIR_LOGP_EXCEPTION;
-				goto end;
-			}
-		} else {
+		else
 			session->limRmfEnabled = 0;
-		}
 #endif
 
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM
@@ -2092,7 +2025,7 @@ end:
 }
 
 #if defined FEATURE_WLAN_ESE || defined WLAN_FEATURE_VOWIFI
-uint8_t lim_get_max_tx_power(tPowerdBm regMax, tPowerdBm apTxPower,
+uint8_t lim_get_max_tx_power(int8_t regMax, int8_t apTxPower,
 			     uint8_t iniTxPower)
 {
 	uint8_t maxTxPower = 0;
@@ -2133,7 +2066,7 @@ static void __lim_process_sme_reassoc_req(tpAniSirGlobal mac_ctx,
 	uint8_t session_id;
 	uint8_t sme_session_id;
 	uint16_t transaction_id;
-	tPowerdBm local_pwr_constraint = 0, reg_max = 0;
+	int8_t local_pwr_constraint = 0, reg_max = 0;
 	uint32_t tele_bcn_en = 0;
 	uint16_t size;
 
@@ -2458,13 +2391,13 @@ static void __lim_process_sme_disassoc_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
 	}
 
 	psessionEntry = pe_find_session_by_bssid(pMac,
-				smeDisassocReq.bssId,
+				smeDisassocReq.bssid.bytes,
 				&sessionId);
 	if (psessionEntry == NULL) {
 		lim_log(pMac, LOGE,
 			FL("session does not exist for given bssId "
 			   MAC_ADDRESS_STR),
-			MAC_ADDR_ARRAY(smeDisassocReq.bssId));
+			MAC_ADDR_ARRAY(smeDisassocReq.bssid.bytes));
 		retCode = eSIR_SME_INVALID_PARAMETERS;
 		disassocTrigger = eLIM_HOST_DISASSOC;
 		goto sendDisassoc;
@@ -2474,7 +2407,7 @@ static void __lim_process_sme_disassoc_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
 			MAC_ADDRESS_STR), smesessionId,
 		GET_LIM_SYSTEM_ROLE(psessionEntry), smeDisassocReq.reasonCode,
 		pMac->lim.gLimSmeState,
-		MAC_ADDR_ARRAY(smeDisassocReq.peerMacAddr));
+		MAC_ADDR_ARRAY(smeDisassocReq.peer_macaddr.bytes));
 
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM    /* FEATURE_WLAN_DIAG_SUPPORT */
 	lim_diag_event_report(pMac, WLAN_PE_DIAG_DISASSOC_REQ_EVENT, psessionEntry,
@@ -2492,6 +2425,9 @@ static void __lim_process_sme_disassoc_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
 		switch (psessionEntry->limSmeState) {
 		case eLIM_SME_ASSOCIATED_STATE:
 		case eLIM_SME_LINK_EST_STATE:
+			lim_log(pMac, LOG1,
+				FL("Rcvd SME_DISASSOC_REQ in limSmeState: %d "),
+				psessionEntry->limSmeState);
 			psessionEntry->limPrevSmeState =
 				psessionEntry->limSmeState;
 			psessionEntry->limSmeState = eLIM_SME_WT_DISASSOC_STATE;
@@ -2499,13 +2435,9 @@ static void __lim_process_sme_disassoc_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
 			/* Delete all TDLS peers connected before leaving BSS */
 			lim_delete_tdls_peers(pMac, psessionEntry);
 #endif
-			MTRACE(mac_trace
-				       (pMac, TRACE_CODE_SME_STATE,
-				       psessionEntry->peSessionId,
-				       psessionEntry->limSmeState));
-			lim_log(pMac, LOG1,
-				FL("Rcvd SME_DISASSOC_REQ while in limSmeState: %d "),
-				psessionEntry->limSmeState);
+			MTRACE(mac_trace(pMac, TRACE_CODE_SME_STATE,
+				psessionEntry->peSessionId,
+				psessionEntry->limSmeState));
 			break;
 
 		case eLIM_SME_WT_DEAUTH_STATE:
@@ -2612,9 +2544,8 @@ static void __lim_process_sme_disassoc_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
 		return;
 	}
 
-	cdf_mem_copy((uint8_t *) &pMlmDisassocReq->peerMacAddr,
-		     (uint8_t *) &smeDisassocReq.peerMacAddr,
-		     sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&pMlmDisassocReq->peer_macaddr,
+			 &smeDisassocReq.peer_macaddr);
 
 	pMlmDisassocReq->reasonCode = reasonCode;
 	pMlmDisassocReq->disassocTrigger = disassocTrigger;
@@ -2628,16 +2559,17 @@ static void __lim_process_sme_disassoc_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
 
 sendDisassoc:
 	if (psessionEntry)
-		lim_send_sme_disassoc_ntf(pMac, smeDisassocReq.peerMacAddr,
+		lim_send_sme_disassoc_ntf(pMac,
+					  smeDisassocReq.peer_macaddr.bytes,
 					  retCode,
 					  disassocTrigger,
 					  1, smesessionId, smetransactionId,
 					  psessionEntry);
 	else
-		lim_send_sme_disassoc_ntf(pMac, smeDisassocReq.peerMacAddr,
-					  retCode,
-					  disassocTrigger,
-					  1, smesessionId, smetransactionId, NULL);
+		lim_send_sme_disassoc_ntf(pMac,
+					  smeDisassocReq.peer_macaddr.bytes,
+					  retCode, disassocTrigger, 1,
+					  smesessionId, smetransactionId, NULL);
 
 } /*** end __lim_process_sme_disassoc_req() ***/
 
@@ -2666,7 +2598,7 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 			sizeof(struct sSirSmeDisassocCnf));
 
 	psessionEntry = pe_find_session_by_bssid(pMac,
-				smeDisassocCnf.bssId,
+				smeDisassocCnf.bssid.bytes,
 				&sessionId);
 	if (psessionEntry == NULL) {
 		lim_log(pMac, LOGE,
@@ -2724,13 +2656,13 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 	    (psessionEntry->limSmeState == eLIM_SME_WT_DEAUTH_STATE) ||
 	    LIM_IS_AP_ROLE(psessionEntry)) {
 		pStaDs = dph_lookup_hash_entry(pMac,
-				smeDisassocCnf.peerMacAddr, &aid,
+				smeDisassocCnf.peer_macaddr.bytes, &aid,
 				&psessionEntry->dph.dphHashTable);
 		if (pStaDs == NULL) {
 			lim_log(pMac, LOGE,
 				FL("DISASSOC_CNF for a STA with no context, addr= "
 				MAC_ADDRESS_STR),
-				MAC_ADDR_ARRAY(smeDisassocCnf.peerMacAddr));
+				MAC_ADDR_ARRAY(smeDisassocCnf.peer_macaddr.bytes));
 			return;
 		}
 
@@ -2740,7 +2672,7 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 				eLIM_MLM_WT_DEL_STA_RSP_STATE)) {
 			lim_log(pMac, LOGE,
 				FL("No need of cleanup for addr:" MAC_ADDRESS_STR "as MLM state is %d"),
-				MAC_ADDR_ARRAY(smeDisassocCnf.peerMacAddr),
+				MAC_ADDR_ARRAY(smeDisassocCnf.peer_macaddr.bytes),
 				pStaDs->mlmStaContext.mlmState);
 			return;
 		}
@@ -2752,8 +2684,7 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 		lim_cleanup_rx_path(pMac, pStaDs, psessionEntry);
 
 		lim_clean_up_disassoc_deauth_req(pMac,
-						 (char *)&smeDisassocCnf.peerMacAddr,
-						 0);
+				 (char *)&smeDisassocCnf.peer_macaddr, 0);
 	}
 
 	return;
@@ -2792,8 +2723,9 @@ static void __lim_process_sme_deauth_req(tpAniSirGlobal mac_ctx,
 	 * We need to get a session first but we don't even know
 	 * if the message is correct.
 	 */
-	session_entry = pe_find_session_by_bssid(mac_ctx, sme_deauth_req.bssId,
-				&session_id);
+	session_entry = pe_find_session_by_bssid(mac_ctx,
+					sme_deauth_req.bssid.bytes,
+					&session_id);
 	if (session_entry == NULL) {
 		lim_log(mac_ctx, LOGE,
 			FL("session does not exist for given bssId"));
@@ -2817,7 +2749,7 @@ static void __lim_process_sme_deauth_req(tpAniSirGlobal mac_ctx,
 		MAC_ADDRESS_STR), sme_session_id,
 		GET_LIM_SYSTEM_ROLE(session_entry), sme_deauth_req.reasonCode,
 		session_entry->limSmeState,
-		MAC_ADDR_ARRAY(sme_deauth_req.peerMacAddr));
+		MAC_ADDR_ARRAY(sme_deauth_req.peer_macaddr.bytes));
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM    /* FEATURE_WLAN_DIAG_SUPPORT */
 	lim_diag_event_report(mac_ctx, WLAN_PE_DIAG_DEAUTH_REQ_EVENT,
 			session_entry, 0, sme_deauth_req.reasonCode);
@@ -2948,9 +2880,8 @@ static void __lim_process_sme_deauth_req(tpAniSirGlobal mac_ctx,
 		return;
 	}
 
-	cdf_mem_copy((uint8_t *) &mlm_deauth_req->peerMacAddr,
-		     (uint8_t *) &sme_deauth_req.peerMacAddr,
-		     sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&mlm_deauth_req->peer_macaddr,
+			 &sme_deauth_req.peer_macaddr);
 
 	mlm_deauth_req->reasonCode = reason_code;
 	mlm_deauth_req->deauthTrigger = deauth_trigger;
@@ -2963,8 +2894,9 @@ static void __lim_process_sme_deauth_req(tpAniSirGlobal mac_ctx,
 	return;
 
 send_deauth:
-	lim_send_sme_deauth_ntf(mac_ctx, sme_deauth_req.peerMacAddr, ret_code,
-			deauth_trigger, 1, sme_session_id, sme_transaction_id);
+	lim_send_sme_deauth_ntf(mac_ctx, sme_deauth_req.peer_macaddr.bytes,
+				ret_code, deauth_trigger, 1,
+				sme_session_id, sme_transaction_id);
 }
 
 /**
@@ -3019,19 +2951,19 @@ __lim_process_sme_set_context_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 			"numKeys:%d is more than SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS"),
 					set_context_req->keyMaterial.numKeys);
 		lim_send_sme_set_context_rsp(mac_ctx,
-				set_context_req->peerMacAddr, 1,
+				set_context_req->peer_macaddr, 1,
 				eSIR_SME_INVALID_PARAMETERS, NULL,
 				sme_session_id, sme_transaction_id);
 		goto end;
 	}
 
 	session_entry = pe_find_session_by_bssid(mac_ctx,
-			set_context_req->bssId, &session_id);
+			set_context_req->bssid.bytes, &session_id);
 	if (session_entry == NULL) {
 		lim_log(mac_ctx, LOGW,
 			FL("Session does not exist for given BSSID"));
 		lim_send_sme_set_context_rsp(mac_ctx,
-				set_context_req->peerMacAddr, 1,
+				set_context_req->peer_macaddr, 1,
 				eSIR_SME_INVALID_PARAMETERS, NULL,
 				sme_session_id, sme_transaction_id);
 		goto end;
@@ -3064,9 +2996,8 @@ __lim_process_sme_set_context_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 				"no.of keys exceeded max num of default keys limit"));
 			goto end;
 		}
-		cdf_mem_copy((uint8_t *) &mlm_set_key_req->peerMacAddr,
-			     (uint8_t *) &set_context_req->peerMacAddr,
-			     sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&mlm_set_key_req->peer_macaddr,
+				 &set_context_req->peer_macaddr);
 
 		cdf_mem_copy((uint8_t *) &mlm_set_key_req->key,
 			     (uint8_t *) &set_context_req->keyMaterial.key,
@@ -3114,7 +3045,7 @@ __lim_process_sme_set_context_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 		lim_print_sme_state(mac_ctx, LOGE, session_entry->limSmeState);
 
 		lim_send_sme_set_context_rsp(mac_ctx,
-				set_context_req->peerMacAddr, 1,
+				set_context_req->peer_macaddr, 1,
 				eSIR_SME_UNEXPECTED_REQ_RESULT_CODE,
 				session_entry, sme_session_id,
 				sme_transaction_id);
@@ -3161,7 +3092,7 @@ void lim_process_sme_get_assoc_sta_info(tpAniSirGlobal mac_ctx,
 	 * Find PE session Entry
 	 */
 	session_entry = pe_find_session_by_bssid(mac_ctx,
-			get_assoc_stas_req.bssId,
+			get_assoc_stas_req.bssid.bytes,
 			&session_id);
 	if (session_entry == NULL) {
 		lim_log(mac_ctx, LOGE,
@@ -3251,7 +3182,6 @@ void lim_process_sme_get_wpspbc_sessions(tpAniSirGlobal mac_ctx,
 	tSap_Event sap_event;
 	tpWLAN_SAPEventCB sap_event_cb = NULL;
 	uint8_t session_id = CSR_SESSION_ID_INVALID;
-	tSirMacAddr zero_mac = { 0, 0, 0, 0, 0, 0 };
 	tSap_GetWPSPBCSessionEvent *sap_get_wpspbc_event;
 
 	if (msg_buf == NULL) {
@@ -3269,7 +3199,7 @@ void lim_process_sme_get_wpspbc_sessions(tpAniSirGlobal mac_ctx,
 	 * Find PE session Entry
 	 */
 	session_entry = pe_find_session_by_bssid(mac_ctx,
-			get_wps_pbc_sessions_req.bssId, &session_id);
+			get_wps_pbc_sessions_req.bssid.bytes, &session_id);
 	if (session_entry == NULL) {
 		lim_log(mac_ctx, LOGE,
 			FL("session does not exist for given bssId"));
@@ -3289,16 +3219,15 @@ void lim_process_sme_get_wpspbc_sessions(tpAniSirGlobal mac_ctx,
 	sap_event.sapHddEventCode = eSAP_GET_WPSPBC_SESSION_EVENT;
 	sap_get_wpspbc_event->module = CDF_MODULE_ID_PE;
 
-	if (cdf_mem_compare(zero_mac, get_wps_pbc_sessions_req.pRemoveMac,
-				sizeof(tSirMacAddr))) {
+	if (cdf_is_macaddr_zero(&get_wps_pbc_sessions_req.remove_mac)) {
 		lim_get_wpspbc_sessions(mac_ctx,
-				sap_get_wpspbc_event->addr.bytes,
+				sap_get_wpspbc_event->addr,
 				sap_get_wpspbc_event->UUID_E,
 				&sap_get_wpspbc_event->wpsPBCOverlap,
 				session_entry);
 	} else {
 		lim_remove_pbc_sessions(mac_ctx,
-				get_wps_pbc_sessions_req.pRemoveMac,
+				get_wps_pbc_sessions_req.remove_mac,
 				session_entry);
 		/* don't have to inform the HDD/Host */
 		return;
@@ -3398,7 +3327,7 @@ __lim_handle_sme_stop_bss_request(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 	}
 
 	psessionEntry = pe_find_session_by_bssid(pMac,
-				stopBssReq.bssId,
+				stopBssReq.bssid.bytes,
 				&sessionId);
 	if (psessionEntry == NULL) {
 		lim_log(pMac, LOGW,
@@ -3592,7 +3521,7 @@ void __lim_process_sme_assoc_cnf_new(tpAniSirGlobal mac_ctx, uint32_t msg_type,
 		goto end;
 	}
 
-	session_entry = pe_find_session_by_bssid(mac_ctx, assoc_cnf.bssId,
+	session_entry = pe_find_session_by_bssid(mac_ctx, assoc_cnf.bssid.bytes,
 			&session_id);
 	if (session_entry == NULL) {
 		lim_log(mac_ctx, LOGE,
@@ -3617,13 +3546,13 @@ void __lim_process_sme_assoc_cnf_new(tpAniSirGlobal mac_ctx, uint32_t msg_type,
 		lim_log(mac_ctx, LOGE, FL(
 			"Rcvd invalid msg %X due to no STA ctx, aid %d, peer "),
 				msg_type, assoc_cnf.aid);
-		lim_print_mac_addr(mac_ctx, assoc_cnf.peerMacAddr, LOG1);
+		lim_print_mac_addr(mac_ctx, assoc_cnf.peer_macaddr.bytes, LOG1);
 
 		/*
 		 * send a DISASSOC_IND message to WSM to make sure
 		 * the state in WSM and LIM is the same
 		 */
-		lim_send_sme_disassoc_ntf(mac_ctx, assoc_cnf.peerMacAddr,
+		lim_send_sme_disassoc_ntf(mac_ctx, assoc_cnf.peer_macaddr.bytes,
 				eSIR_SME_STA_NOT_ASSOCIATED,
 				eLIM_PEER_ENTITY_DISASSOC, assoc_cnf.aid,
 				session_entry->smeSessionId,
@@ -3632,12 +3561,12 @@ void __lim_process_sme_assoc_cnf_new(tpAniSirGlobal mac_ctx, uint32_t msg_type,
 		goto end;
 	}
 	if (!cdf_mem_compare((uint8_t *)sta_ds->staAddr,
-				(uint8_t *) assoc_cnf.peerMacAddr,
-				sizeof(tSirMacAddr))) {
+				(uint8_t *) assoc_cnf.peer_macaddr.bytes,
+				CDF_MAC_ADDR_SIZE)) {
 		lim_log(mac_ctx, LOG1, FL(
 				"peerMacAddr mismatched for aid %d, peer "),
 				assoc_cnf.aid);
-		lim_print_mac_addr(mac_ctx, assoc_cnf.peerMacAddr, LOG1);
+		lim_print_mac_addr(mac_ctx, assoc_cnf.peer_macaddr.bytes, LOG1);
 		goto end;
 	}
 
@@ -3650,7 +3579,7 @@ void __lim_process_sme_assoc_cnf_new(tpAniSirGlobal mac_ctx, uint32_t msg_type,
 			"not in MLM_WT_ASSOC_CNF_STATE, for aid %d, peer"
 			"StaD mlmState : %d"),
 			assoc_cnf.aid, sta_ds->mlmStaContext.mlmState);
-		lim_print_mac_addr(mac_ctx, assoc_cnf.peerMacAddr, LOG1);
+		lim_print_mac_addr(mac_ctx, assoc_cnf.peer_macaddr.bytes, LOG1);
 		goto end;
 	}
 	/*
@@ -3731,9 +3660,8 @@ static void __lim_process_sme_addts_req(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 
 	pSirAddts = (tpSirAddtsReq) pMsgBuf;
 
-	psessionEntry = pe_find_session_by_bssid(pMac,
-				pSirAddts->bssId,
-				&sessionId);
+	psessionEntry = pe_find_session_by_bssid(pMac, pSirAddts->bssid.bytes,
+						 &sessionId);
 	if (psessionEntry == NULL) {
 		lim_log(pMac, LOGE, "Session Does not exist for given bssId");
 		return;
@@ -3899,7 +3827,7 @@ static void __lim_process_sme_delts_req(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 			     &smetransactionId);
 
 	psessionEntry = pe_find_session_by_bssid(pMac,
-				pDeltsReq->bssId,
+				pDeltsReq->bssid.bytes,
 				&sessionId);
 	if (psessionEntry == NULL) {
 		lim_log(pMac, LOGE, "Session Does not exist for given bssId");
@@ -3981,8 +3909,6 @@ static void __lim_process_sme_delts_req(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 #ifdef FEATURE_WLAN_ESE
 #ifdef FEATURE_WLAN_ESE_UPLOAD
 	lim_send_sme_tsm_ie_ind(pMac, psessionEntry, 0, 0, 0);
-#else
-	lim_deactivate_and_change_timer(pMac, eLIM_TSM_TIMER);
 #endif /* FEATURE_WLAN_ESE_UPLOAD */
 #endif
 
@@ -4126,7 +4052,7 @@ __lim_process_sme_update_apwpsi_es(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 			sizeof(struct sSirUpdateAPWPSIEsReq));
 
 	psessionEntry = pe_find_session_by_bssid(pMac,
-				pUpdateAPWPSIEsReq->bssId,
+				pUpdateAPWPSIEsReq->bssid.bytes,
 				&sessionId);
 	if (psessionEntry == NULL) {
 		lim_log(pMac, LOGW,
@@ -4246,7 +4172,7 @@ static void __lim_process_sme_set_wparsni_es(tpAniSirGlobal pMac, uint32_t *pMsg
 			sizeof(struct sSirUpdateAPWPARSNIEsReq));
 
 	psessionEntry = pe_find_session_by_bssid(pMac,
-				pUpdateAPWPARSNIEsReq->bssId,
+				pUpdateAPWPARSNIEsReq->bssid.bytes,
 				&sessionId);
 	if (psessionEntry == NULL) {
 		lim_log(pMac, LOGW,
@@ -4296,7 +4222,7 @@ static void __lim_process_sme_change_bi(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 	pChangeBIParams = (tpSirChangeBIParams) pMsgBuf;
 
 	psessionEntry = pe_find_session_by_bssid(pMac,
-				pChangeBIParams->bssId,
+				pChangeBIParams->bssid.bytes,
 				&sessionId);
 	if (psessionEntry == NULL) {
 		lim_log(pMac, LOGE,
@@ -4361,12 +4287,12 @@ static void __lim_process_sme_set_ht2040_mode(tpAniSirGlobal pMac,
 	pSetHT2040Mode = (tpSirSetHT2040Mode) pMsgBuf;
 
 	psessionEntry = pe_find_session_by_bssid(pMac,
-				pSetHT2040Mode->bssId,
+				pSetHT2040Mode->bssid.bytes,
 				&sessionId);
 	if (psessionEntry == NULL) {
 		lim_log(pMac, LOG1,
 			FL("Session does not exist for given BSSID "));
-		lim_print_mac_addr(pMac, pSetHT2040Mode->bssId, LOG1);
+		lim_print_mac_addr(pMac, pSetHT2040Mode->bssid.bytes, LOG1);
 		return;
 	}
 
@@ -4506,7 +4432,7 @@ void __lim_process_report_message(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
  * @return None
  */
 tSirRetStatus
-lim_send_set_max_tx_power_req(tpAniSirGlobal pMac, tPowerdBm txPower,
+lim_send_set_max_tx_power_req(tpAniSirGlobal pMac, int8_t txPower,
 			      tpPESession pSessionEntry)
 {
 	tpMaxTxPowerParams pMaxTxParams = NULL;
@@ -4750,6 +4676,34 @@ __lim_process_sme_reset_ap_caps_change(tpAniSirGlobal pMac, uint32_t *pMsgBuf)
 }
 
 /**
+ * lim_register_mgmt_frame_ind_cb() - Save the Management frame
+ * indication callback in PE.
+ * @mac_ptr: Mac pointer
+ * @msg_buf: Msg pointer containing the callback
+ *
+ * This function is used save the Management frame
+ * indication callback in PE.
+ *
+ * Return: None
+ */
+static void lim_register_mgmt_frame_ind_cb(tpAniSirGlobal mac_ctx,
+							uint32_t *msg_buf)
+{
+	struct sir_sme_mgmt_frame_cb_req *sme_req =
+		(struct sir_sme_mgmt_frame_cb_req *)msg_buf;
+
+	if (NULL == msg_buf) {
+		lim_log(mac_ctx, LOGE, FL("msg_buf is null"));
+		return;
+	}
+	if (sme_req->callback)
+		mac_ctx->mgmt_frame_ind_cb =
+			(sir_mgmt_frame_ind_callback)sme_req->callback;
+	else
+		lim_log(mac_ctx, LOGE, FL("sme_req->callback is null"));
+}
+
+/**
  * lim_process_sme_req_messages()
  *
  ***FUNCTION:
@@ -4985,6 +4939,9 @@ bool lim_process_sme_req_messages(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
 	case eWNI_SME_SET_IE_REQ:
 		lim_process_set_ie_req(pMac, pMsgBuf);
 		break;
+	case eWNI_SME_REGISTER_MGMT_FRAME_CB:
+		lim_register_mgmt_frame_ind_cb(pMac, pMsgBuf);
+		break;
 	case eWNI_SME_EXT_CHANGE_CHANNEL:
 		lim_process_ext_change_channel(pMac, pMsgBuf);
 		break;
@@ -5076,7 +5033,7 @@ static void lim_process_sme_channel_change_request(tpAniSirGlobal mac_ctx,
 	tpSirChanChangeRequest ch_change_req;
 	tpPESession session_entry;
 	uint8_t session_id;      /* PE session_id */
-	tPowerdBm max_tx_pwr;
+	int8_t max_tx_pwr;
 	uint32_t val = 0;
 
 	if (msg_buf == NULL) {
@@ -5120,17 +5077,17 @@ static void lim_process_sme_channel_change_request(tpAniSirGlobal mac_ctx,
 			"switch old chnl %d to new chnl %d, ch_bw %d"),
 			session_entry->currentOperChannel,
 			ch_change_req->targetChannel,
-			ch_change_req->channel_width);
+			ch_change_req->ch_width);
 
 	/* Store the New Channel Params in session_entry */
-	session_entry->ch_width = ch_change_req->channel_width;
+	session_entry->ch_width = ch_change_req->ch_width;
 	session_entry->ch_center_freq_seg0 =
 		ch_change_req->center_freq_seg_0;
 	session_entry->ch_center_freq_seg1 =
 		ch_change_req->center_freq_seg_1;
-	session_entry->htSecondaryChannelOffset = ch_change_req->cbMode;
+	session_entry->htSecondaryChannelOffset = ch_change_req->sec_ch_offset;
 	session_entry->htSupportedChannelWidthSet =
-		(ch_change_req->channel_width ? 1 : 0);
+		(ch_change_req->ch_width ? 1 : 0);
 	session_entry->htRecommendedTxWidthSet =
 		session_entry->htSupportedChannelWidthSet;
 	session_entry->currentOperChannel =
@@ -5532,9 +5489,9 @@ static void lim_process_sme_dfs_csa_ie_request(tpAniSirGlobal mac_ctx,
 {
 	tpSirDfsCsaIeRequest dfs_csa_ie_req;
 	tpPESession session_entry = NULL;
-	uint32_t ch_width = 0;
 	uint8_t session_id;
 	tLimWiderBWChannelSwitchInfo *wider_bw_ch_switch;
+	offset_t ch_offset;
 
 	if (msg_buf == NULL) {
 		lim_log(mac_ctx, LOGE, FL("Buffer is Pointing to NULL"));
@@ -5565,7 +5522,7 @@ static void lim_process_sme_dfs_csa_ie_request(tpAniSirGlobal mac_ctx,
 	session_entry->dfsIncludeChanSwIe = true;
 	session_entry->gLimChannelSwitch.switchCount = LIM_MAX_CSA_IE_UPDATES;
 	session_entry->gLimChannelSwitch.ch_width =
-				 dfs_csa_ie_req->ch_bandwidth;
+				 dfs_csa_ie_req->ch_params.ch_width;
 	if (mac_ctx->sap.SapDfsInfo.disable_dfs_ch_switch == false)
 		session_entry->gLimChannelSwitch.switchMode = 1;
 
@@ -5576,16 +5533,10 @@ static void lim_process_sme_dfs_csa_ie_request(tpAniSirGlobal mac_ctx,
 	if (true != session_entry->vhtCapability)
 		goto skip_vht;
 
-	if (WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ ==
-			session_entry->vhtTxChannelWidthSet)
-		ch_width = eHT_CHANNEL_WIDTH_80MHZ;
-	else if (WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ ==
-			session_entry->vhtTxChannelWidthSet)
-		ch_width = session_entry->htSupportedChannelWidthSet;
 	/* Now encode the Wider Ch BW element depending on the ch width */
 	wider_bw_ch_switch = &session_entry->gLimWiderBWChannelSwitch;
-	switch (ch_width) {
-	case eHT_CHANNEL_WIDTH_20MHZ:
+	switch (dfs_csa_ie_req->ch_params.ch_width) {
+	case CH_WIDTH_20MHZ:
 		/*
 		 * Wide channel BW sublement in channel wrapper element is not
 		 * required in case of 20 Mhz operation. Currently It is set
@@ -5595,21 +5546,26 @@ static void lim_process_sme_dfs_csa_ie_request(tpAniSirGlobal mac_ctx,
 		wider_bw_ch_switch->newChanWidth =
 			WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
 		break;
-	case eHT_CHANNEL_WIDTH_40MHZ:
-		session_entry->dfsIncludeChanWrapperIe = true;
+	case CH_WIDTH_40MHZ:
+		session_entry->dfsIncludeChanWrapperIe = false;
 		wider_bw_ch_switch->newChanWidth =
 			WNI_CFG_VHT_CHANNEL_WIDTH_20_40MHZ;
 		break;
-	case eHT_CHANNEL_WIDTH_80MHZ:
+	case CH_WIDTH_80MHZ:
 		session_entry->dfsIncludeChanWrapperIe = true;
 		wider_bw_ch_switch->newChanWidth =
 			WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ;
 		break;
-	case eHT_CHANNEL_WIDTH_160MHZ:
+	case CH_WIDTH_160MHZ:
 		session_entry->dfsIncludeChanWrapperIe = true;
 		wider_bw_ch_switch->newChanWidth =
 			WNI_CFG_VHT_CHANNEL_WIDTH_160MHZ;
 		break;
+	case CH_WIDTH_80P80MHZ:
+		session_entry->dfsIncludeChanWrapperIe = true;
+		wider_bw_ch_switch->newChanWidth =
+			WNI_CFG_VHT_CHANNEL_WIDTH_80_PLUS_80MHZ;
+		break;
 	default:
 		session_entry->dfsIncludeChanWrapperIe = false;
 		/*
@@ -5621,16 +5577,15 @@ static void lim_process_sme_dfs_csa_ie_request(tpAniSirGlobal mac_ctx,
 	}
 	/* Fetch the center channel based on the channel width */
 	wider_bw_ch_switch->newCenterChanFreq0 =
-		lim_get_center_channel(mac_ctx, dfs_csa_ie_req->targetChannel,
-				       session_entry->htSecondaryChannelOffset,
-				       wider_bw_ch_switch->newChanWidth);
+		dfs_csa_ie_req->ch_params.center_freq_seg0;
 	/*
 	 * This is not applicable for 20/40/80 Mhz.Only used when we support
 	 * 80+80 Mhz operation. In case of 80+80 Mhz, this parameter indicates
 	 * center channel frequency index of 80 Mhz channel of
 	 * frequency segment 1.
 	 */
-	wider_bw_ch_switch->newCenterChanFreq1 = 0;
+	wider_bw_ch_switch->newCenterChanFreq1 =
+		dfs_csa_ie_req->ch_params.center_freq_seg1;
 skip_vht:
 	/* Send CSA IE request from here */
 	if (sch_set_fixed_beacon_fields(mac_ctx, session_entry) !=
@@ -5645,13 +5600,23 @@ skip_vht:
 	 * the template update
 	 */
 	lim_send_beacon_ind(mac_ctx, session_entry);
-	lim_log(mac_ctx, LOG1, FL("Updated CSA IE, IE COUNT = %d"),
-		       session_entry->gLimChannelSwitch.switchCount);
+
+	if (dfs_csa_ie_req->ch_params.ch_width == CH_WIDTH_80MHZ)
+		ch_offset = BW80;
+	else
+		ch_offset = dfs_csa_ie_req->ch_params.sec_ch_offset;
+
+	lim_log(mac_ctx, LOG1, FL("IE count:%d chan:%d width:%d wrapper:%d ch_offset:%d"),
+			session_entry->gLimChannelSwitch.switchCount,
+			session_entry->gLimChannelSwitch.primaryChannel,
+			session_entry->gLimChannelSwitch.ch_width,
+			session_entry->dfsIncludeChanWrapperIe,
+			ch_offset);
+
 	/* Send ECSA Action frame after updating the beacon */
 	send_extended_chan_switch_action_frame(mac_ctx,
 		session_entry->gLimChannelSwitch.primaryChannel,
-		session_entry->gLimChannelSwitch.ch_width,
-					   session_entry);
+		ch_offset, session_entry);
 	session_entry->gLimChannelSwitch.switchCount--;
 }
 
diff --git a/core/mac/src/pe/lim/lim_process_tdls.c b/core/mac/src/pe/lim/lim_process_tdls.c
index b440f1684a2b..bbabde1c834f 100644
--- a/core/mac/src/pe/lim/lim_process_tdls.c
+++ b/core/mac/src/pe/lim/lim_process_tdls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -92,7 +92,7 @@ static tSirRetStatus lim_tdls_setup_add_sta(tpAniSirGlobal pMac,
 		tSirTdlsAddStaReq * pAddStaReq, tpPESession psessionEntry);
 void populate_dot11f_link_iden(tpAniSirGlobal pMac, tpPESession psessionEntry,
 			       tDot11fIELinkIdentifier *linkIden,
-			       tSirMacAddr peerMac, uint8_t reqType);
+			       struct cdf_mac_addr peer_mac, uint8_t reqType);
 void populate_dot11f_tdls_ext_capability(tpAniSirGlobal pMac,
 					 tpPESession psessionEntry,
 					 tDot11fIEExtCap *extCapability);
@@ -343,8 +343,10 @@ CDF_STATUS lim_mgmt_tx_complete(tpAniSirGlobal pMac, uint32_t txCompleteSuccess)
  * This function can be used for bacst or unicast discovery request
  * We are not differentiating it here, it will all depnds on peer MAC address,
  */
-tSirRetStatus lim_send_tdls_dis_req_frame(tpAniSirGlobal pMac, tSirMacAddr peer_mac,
-					  uint8_t dialog, tpPESession psessionEntry)
+tSirRetStatus lim_send_tdls_dis_req_frame(tpAniSirGlobal pMac,
+					  struct cdf_mac_addr peer_mac,
+					  uint8_t dialog,
+					  tpPESession psessionEntry)
 {
 	tDot11fTDLSDisReq tdlsDisReq;
 	uint32_t status = 0;
@@ -504,7 +506,7 @@ tSirRetStatus lim_send_tdls_dis_req_frame(tpAniSirGlobal pMac, tSirMacAddr peer_
 		FL("[TDLS] action %d (%s) -AP-> OTA peer="MAC_ADDRESS_STR),
 		SIR_MAC_TDLS_DIS_REQ,
 		lim_trace_tdls_action_string(SIR_MAC_TDLS_DIS_REQ),
-		MAC_ADDR_ARRAY(peer_mac));
+		MAC_ADDR_ARRAY(peer_mac.bytes));
 
 	pMac->lim.mgmtFrameSessionId = psessionEntry->peSessionId;
 	cdf_status = wma_tx_frameWithTxComplete(pMac, pPacket, (uint16_t) nBytes,
@@ -591,9 +593,11 @@ static void populate_dot11f_tdls_ht_vht_cap(tpAniSirGlobal pMac,
  */
 
 static tSirRetStatus lim_send_tdls_dis_rsp_frame(tpAniSirGlobal pMac,
-						 tSirMacAddr peerMac, uint8_t dialog,
+						 struct cdf_mac_addr peer_mac,
+						 uint8_t dialog,
 						 tpPESession psessionEntry,
-						 uint8_t *addIe, uint16_t addIeLen)
+						 uint8_t *addIe,
+						 uint16_t addIeLen)
 {
 	tDot11fTDLSDisRsp tdlsDisRsp;
 	uint16_t caps = 0;
@@ -633,7 +637,7 @@ static tSirRetStatus lim_send_tdls_dis_rsp_frame(tpAniSirGlobal pMac,
 
 	populate_dot11f_link_iden(pMac, psessionEntry,
 				  &tdlsDisRsp.LinkIdentifier,
-				  peerMac, TDLS_RESPONDER);
+				  peer_mac, TDLS_RESPONDER);
 
 	if (cfg_get_capability_info(pMac, &caps, psessionEntry)
 		!= eSIR_SUCCESS) {
@@ -735,7 +739,7 @@ static tSirRetStatus lim_send_tdls_dis_rsp_frame(tpAniSirGlobal pMac,
 	/* Make public Action Frame */
 
 	lim_populate_mac_header(pMac, pFrame, SIR_MAC_MGMT_FRAME,
-				SIR_MAC_MGMT_ACTION, peerMac,
+				SIR_MAC_MGMT_ACTION, peer_mac.bytes,
 				psessionEntry->selfMacAddr);
 
 	{
@@ -775,7 +779,7 @@ static tSirRetStatus lim_send_tdls_dis_rsp_frame(tpAniSirGlobal pMac,
 		FL("[TDLS] action %d (%s) -DIRECT-> OTA peer="MAC_ADDRESS_STR),
 		SIR_MAC_TDLS_DIS_RSP,
 		lim_trace_tdls_action_string(SIR_MAC_TDLS_DIS_RSP),
-		MAC_ADDR_ARRAY(peerMac));
+		MAC_ADDR_ARRAY(peer_mac.bytes));
 
 	pMac->lim.mgmtFrameSessionId = psessionEntry->peSessionId;
 	/*
@@ -810,7 +814,8 @@ static tSirRetStatus lim_send_tdls_dis_rsp_frame(tpAniSirGlobal pMac,
  * lim_send_tdls_setup_rsp_frame to populate the AID if device is 11ac capable.
  */
 static void populate_dotf_tdls_vht_aid(tpAniSirGlobal pMac, uint32_t selfDot11Mode,
-				       tSirMacAddr peerMac, tDot11fIEAID *Aid,
+				       struct cdf_mac_addr peerMac,
+				       tDot11fIEAID *Aid,
 				       tpPESession psessionEntry)
 {
 	if (((psessionEntry->currentOperChannel <= SIR_11B_CHANNEL_END) &&
@@ -823,7 +828,7 @@ static void populate_dotf_tdls_vht_aid(tpAniSirGlobal pMac, uint32_t selfDot11Mo
 			tpDphHashNode pStaDs;
 
 			pStaDs =
-				dph_lookup_hash_entry(pMac, peerMac, &aid,
+				dph_lookup_hash_entry(pMac, peerMac.bytes, &aid,
 						      &psessionEntry->dph.
 						      dphHashTable);
 			if (NULL != pStaDs) {
@@ -834,7 +839,7 @@ static void populate_dotf_tdls_vht_aid(tpAniSirGlobal pMac, uint32_t selfDot11Mo
 				lim_log(pMac, LOGE,
 					FL("pStaDs is NULL for "
 					   MAC_ADDRESS_STR),
-					MAC_ADDR_ARRAY(peerMac));
+					MAC_ADDR_ARRAY(peerMac.bytes));
 			}
 		}
 	} else {
@@ -848,9 +853,11 @@ static void populate_dotf_tdls_vht_aid(tpAniSirGlobal pMac, uint32_t selfDot11Mo
  */
 
 tSirRetStatus lim_send_tdls_link_setup_req_frame(tpAniSirGlobal pMac,
-						 tSirMacAddr peerMac, uint8_t dialog,
+						 struct cdf_mac_addr peer_mac,
+						 uint8_t dialog,
 						 tpPESession psessionEntry,
-						 uint8_t *addIe, uint16_t addIeLen)
+						 uint8_t *addIe,
+						 uint16_t addIeLen)
 {
 	tDot11fTDLSSetupReq tdlsSetupReq;
 	uint16_t caps = 0;
@@ -882,7 +889,7 @@ tSirRetStatus lim_send_tdls_link_setup_req_frame(tpAniSirGlobal pMac,
 	tdlsSetupReq.DialogToken.token = dialog;
 
 	populate_dot11f_link_iden(pMac, psessionEntry,
-				  &tdlsSetupReq.LinkIdentifier, peerMac,
+				  &tdlsSetupReq.LinkIdentifier, peer_mac,
 				  TDLS_INITIATOR);
 
 	if (cfg_get_capability_info(pMac, &caps, psessionEntry) != eSIR_SUCCESS) {
@@ -975,7 +982,7 @@ tSirRetStatus lim_send_tdls_link_setup_req_frame(tpAniSirGlobal pMac,
 					&tdlsSetupReq.VHTCaps, psessionEntry);
 
 	/* Populate AID */
-	populate_dotf_tdls_vht_aid(pMac, selfDot11Mode, peerMac,
+	populate_dotf_tdls_vht_aid(pMac, selfDot11Mode, peer_mac,
 				   &tdlsSetupReq.AID, psessionEntry);
 
 	/* Populate TDLS offchannel param only if offchannel is enabled
@@ -1056,7 +1063,7 @@ tSirRetStatus lim_send_tdls_link_setup_req_frame(tpAniSirGlobal pMac,
 	header_offset = lim_prepare_tdls_frame_header(pMac, pFrame,
 						      LINK_IDEN_ADDR_OFFSET
 							      (tdlsSetupReq), TDLS_LINK_AP,
-						      TDLS_INITIATOR, TID_AC_BK,
+						      TDLS_INITIATOR, TID_AC_VI,
 						      psessionEntry);
 
 	lim_log(pMac, LOGW,
@@ -1099,14 +1106,14 @@ tSirRetStatus lim_send_tdls_link_setup_req_frame(tpAniSirGlobal pMac,
 		FL("[TDLS] action %d (%s) -AP-> OTA peer="MAC_ADDRESS_STR),
 		SIR_MAC_TDLS_SETUP_REQ,
 		lim_trace_tdls_action_string(SIR_MAC_TDLS_SETUP_REQ),
-		MAC_ADDR_ARRAY(peerMac));
+		MAC_ADDR_ARRAY(peer_mac.bytes));
 
 	pMac->lim.mgmtFrameSessionId = psessionEntry->peSessionId;
 
 	cdf_status = wma_tx_frameWithTxComplete(pMac, pPacket, (uint16_t) nBytes,
 					      TXRX_FRM_802_11_DATA,
 					      ANI_TXDIR_TODS,
-					      TID_AC_BK,
+					      TID_AC_VI,
 					      lim_tx_complete, pFrame,
 					      lim_mgmt_tx_complete,
 					      HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
@@ -1128,7 +1135,8 @@ tSirRetStatus lim_send_tdls_link_setup_req_frame(tpAniSirGlobal pMac,
  */
 
 tSirRetStatus lim_send_tdls_teardown_frame(tpAniSirGlobal pMac,
-					   tSirMacAddr peerMac, uint16_t reason,
+					   struct cdf_mac_addr peer_mac,
+					   uint16_t reason,
 					   uint8_t responder,
 					   tpPESession psessionEntry,
 					   uint8_t *addIe, uint16_t addIeLen)
@@ -1162,7 +1170,7 @@ tSirRetStatus lim_send_tdls_teardown_frame(tpAniSirGlobal pMac,
 	teardown.Reason.code = reason;
 
 	populate_dot11f_link_iden(pMac, psessionEntry, &teardown.LinkIdentifier,
-				  peerMac,
+				  peer_mac,
 				  (responder ==
 				   true) ? TDLS_RESPONDER : TDLS_INITIATOR);
 
@@ -1300,7 +1308,7 @@ tSirRetStatus lim_send_tdls_teardown_frame(tpAniSirGlobal pMac,
 		lim_trace_tdls_action_string(SIR_MAC_TDLS_TEARDOWN),
 		((reason == eSIR_MAC_TDLS_TEARDOWN_PEER_UNREACHABLE) ? "AP" :
 		    "DIRECT"),
-		MAC_ADDR_ARRAY(peerMac));
+		MAC_ADDR_ARRAY(peer_mac.bytes));
 
 	pMac->lim.mgmtFrameSessionId = psessionEntry->peSessionId;
 
@@ -1321,14 +1329,13 @@ tSirRetStatus lim_send_tdls_teardown_frame(tpAniSirGlobal pMac,
 
 	}
 	return eSIR_SUCCESS;
-
 }
 
 /*
  * Send Setup RSP frame on AP link.
  */
 static tSirRetStatus lim_send_tdls_setup_rsp_frame(tpAniSirGlobal pMac,
-						   tSirMacAddr peerMac,
+						   struct cdf_mac_addr peer_mac,
 						   uint8_t dialog,
 						   tpPESession psessionEntry,
 						   etdlsLinkSetupStatus setupStatus,
@@ -1373,7 +1380,7 @@ static tSirRetStatus lim_send_tdls_setup_rsp_frame(tpAniSirGlobal pMac,
 	tdlsSetupRsp.DialogToken.token = dialog;
 
 	populate_dot11f_link_iden(pMac, psessionEntry,
-				  &tdlsSetupRsp.LinkIdentifier, peerMac,
+				  &tdlsSetupRsp.LinkIdentifier, peer_mac,
 				  TDLS_RESPONDER);
 
 	if (cfg_get_capability_info(pMac, &caps, psessionEntry) != eSIR_SUCCESS) {
@@ -1456,7 +1463,7 @@ static tSirRetStatus lim_send_tdls_setup_rsp_frame(tpAniSirGlobal pMac,
 					&tdlsSetupRsp.VHTCaps, psessionEntry);
 
 	/* Populate AID */
-	populate_dotf_tdls_vht_aid(pMac, selfDot11Mode, peerMac,
+	populate_dotf_tdls_vht_aid(pMac, selfDot11Mode, peer_mac,
 				   &tdlsSetupRsp.AID, psessionEntry);
 
 	/* Populate TDLS offchannel param only if offchannel is enabled
@@ -1538,7 +1545,7 @@ static tSirRetStatus lim_send_tdls_setup_rsp_frame(tpAniSirGlobal pMac,
 	header_offset = lim_prepare_tdls_frame_header(pMac, pFrame,
 						      LINK_IDEN_ADDR_OFFSET
 							      (tdlsSetupRsp), TDLS_LINK_AP,
-						      TDLS_RESPONDER, TID_AC_BK,
+						      TDLS_RESPONDER, TID_AC_VI,
 						      psessionEntry);
 
 	lim_log(pMac, LOG1,
@@ -1579,14 +1586,14 @@ static tSirRetStatus lim_send_tdls_setup_rsp_frame(tpAniSirGlobal pMac,
 		FL("[TDLS] action %d (%s) -AP-> OTA peer="MAC_ADDRESS_STR),
 		SIR_MAC_TDLS_SETUP_RSP,
 		lim_trace_tdls_action_string(SIR_MAC_TDLS_SETUP_RSP),
-		MAC_ADDR_ARRAY(peerMac));
+		MAC_ADDR_ARRAY(peer_mac.bytes));
 
 	pMac->lim.mgmtFrameSessionId = psessionEntry->peSessionId;
 
 	cdf_status = wma_tx_frameWithTxComplete(pMac, pPacket, (uint16_t) nBytes,
 					      TXRX_FRM_802_11_DATA,
 					      ANI_TXDIR_TODS,
-					      TID_AC_BK,
+					      TID_AC_VI,
 					      lim_tx_complete, pFrame,
 					      lim_mgmt_tx_complete,
 					      HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME,
@@ -1600,7 +1607,6 @@ static tSirRetStatus lim_send_tdls_setup_rsp_frame(tpAniSirGlobal pMac,
 	}
 
 	return eSIR_SUCCESS;
-
 }
 
 /*
@@ -1608,7 +1614,7 @@ static tSirRetStatus lim_send_tdls_setup_rsp_frame(tpAniSirGlobal pMac,
  */
 
 tSirRetStatus lim_send_tdls_link_setup_cnf_frame(tpAniSirGlobal pMac,
-						 tSirMacAddr peerMac,
+						 struct cdf_mac_addr peer_mac,
 						 uint8_t dialog,
 						 uint32_t peerCapability,
 						 tpPESession psessionEntry,
@@ -1644,7 +1650,7 @@ tSirRetStatus lim_send_tdls_link_setup_cnf_frame(tpAniSirGlobal pMac,
 	tdlsSetupCnf.DialogToken.token = dialog;
 
 	populate_dot11f_link_iden(pMac, psessionEntry,
-				  &tdlsSetupCnf.LinkIdentifier, peerMac,
+				  &tdlsSetupCnf.LinkIdentifier, peer_mac,
 				  TDLS_INITIATOR);
 	/*
 	 * TODO: we need to see if we have to support conditions where we have
@@ -1800,7 +1806,7 @@ tSirRetStatus lim_send_tdls_link_setup_cnf_frame(tpAniSirGlobal pMac,
 		FL("[TDLS] action %d (%s) -AP-> OTA peer="MAC_ADDRESS_STR),
 		SIR_MAC_TDLS_SETUP_CNF,
 		lim_trace_tdls_action_string(SIR_MAC_TDLS_SETUP_CNF),
-	       MAC_ADDR_ARRAY(peerMac));
+	       MAC_ADDR_ARRAY(peer_mac.bytes));
 
 	pMac->lim.mgmtFrameSessionId = psessionEntry->peSessionId;
 
@@ -2159,15 +2165,13 @@ lim_tdls_populate_matching_rate_set(tpAniSirGlobal mac_ctx, tpDphHashNode stads,
 				(temp_rate_set.rate[j] & 0x7F))
 				continue;
 
-#ifdef FEATURE_WLAN_NON_INTEGRATED_SOC
-			if ((b_rateindex > HAL_NUM_11B_RATES) ||
-			    (a_rateindex > HAL_NUM_11A_RATES)) {
+			if ((b_rateindex > SIR_NUM_11B_RATES) ||
+			    (a_rateindex > SIR_NUM_11A_RATES)) {
 				lim_log(mac_ctx, LOGE,
 					FL("Invalid number of rates (11b->%d, 11a->%d)"),
 					b_rateindex, a_rateindex);
 				return eSIR_FAILURE;
 			}
-#endif
 			if (sirIsArate(temp_rate_set2.rate[i] & 0x7f)) {
 				is_a_rate = 1;
 				if (a_rateindex < SIR_NUM_11A_RATES)
@@ -2664,7 +2668,7 @@ void populate_dot11f_tdls_offchannel_params(tpAniSirGlobal pMac,
 
 void populate_dot11f_link_iden(tpAniSirGlobal pMac, tpPESession psessionEntry,
 			       tDot11fIELinkIdentifier *linkIden,
-			       tSirMacAddr peerMac, uint8_t reqType)
+			       struct cdf_mac_addr peer_mac, uint8_t reqType)
 {
 	uint8_t *initStaAddr = NULL;
 	uint8_t *respStaAddr = NULL;
@@ -2674,13 +2678,13 @@ void populate_dot11f_link_iden(tpAniSirGlobal pMac, tpPESession psessionEntry,
 	: ((respStaAddr = linkIden->InitStaAddr),
 	   (initStaAddr = linkIden->RespStaAddr));
 	cdf_mem_copy((uint8_t *) linkIden->bssid,
-		     (uint8_t *) psessionEntry->bssId, sizeof(tSirMacAddr));
+		     (uint8_t *) psessionEntry->bssId, CDF_MAC_ADDR_SIZE);
 
 	cdf_mem_copy((uint8_t *) initStaAddr,
-		     psessionEntry->selfMacAddr, sizeof(tSirMacAddr));
+		     psessionEntry->selfMacAddr, CDF_MAC_ADDR_SIZE);
 
-	cdf_mem_copy((uint8_t *) respStaAddr, (uint8_t *) peerMac,
-		     sizeof(tSirMacAddr));
+	cdf_mem_copy((uint8_t *) respStaAddr, (uint8_t *) peer_mac.bytes,
+		     CDF_MAC_ADDR_SIZE);
 
 	linkIden->present = 1;
 	return;
@@ -2740,7 +2744,7 @@ tSirRetStatus lim_process_sme_tdls_mgmt_send_req(tpAniSirGlobal mac_ctx,
 
 	lim_log(mac_ctx, LOG1, FL("Send Mgmt Recieved"));
 	session_entry = pe_find_session_by_bssid(mac_ctx,
-						 send_req->bssid, &session_id);
+					 send_req->bssid.bytes, &session_id);
 	if (NULL == session_entry) {
 		lim_log(mac_ctx, LOGE,
 			FL("PE Session does not exist for given sme session_id %d"),
@@ -2772,14 +2776,14 @@ tSirRetStatus lim_process_sme_tdls_mgmt_send_req(tpAniSirGlobal mac_ctx,
 	case SIR_MAC_TDLS_DIS_REQ:
 		lim_log(mac_ctx, LOG1, FL("Transmit Discovery Request Frame"));
 		/* format TDLS discovery request frame and transmit it */
-		lim_send_tdls_dis_req_frame(mac_ctx, send_req->peerMac,
+		lim_send_tdls_dis_req_frame(mac_ctx, send_req->peer_mac,
 					    send_req->dialog, session_entry);
 		result_code = eSIR_SME_SUCCESS;
 		break;
 	case SIR_MAC_TDLS_DIS_RSP:
 		lim_log(mac_ctx, LOG1, FL("Transmit Discovery Response Frame"));
 		/* Send a response mgmt action frame */
-		lim_send_tdls_dis_rsp_frame(mac_ctx, send_req->peerMac,
+		lim_send_tdls_dis_rsp_frame(mac_ctx, send_req->peer_mac,
 			send_req->dialog, session_entry, &send_req->addIe[0],
 			(send_req->length - sizeof(tSirTdlsSendMgmtReq)));
 		result_code = eSIR_SME_SUCCESS;
@@ -2787,7 +2791,7 @@ tSirRetStatus lim_process_sme_tdls_mgmt_send_req(tpAniSirGlobal mac_ctx,
 	case SIR_MAC_TDLS_SETUP_REQ:
 		lim_log(mac_ctx, LOG1, FL("Transmit Setup Request Frame"));
 		lim_send_tdls_link_setup_req_frame(mac_ctx,
-			send_req->peerMac, send_req->dialog, session_entry,
+			send_req->peer_mac, send_req->dialog, session_entry,
 			&send_req->addIe[0],
 			(send_req->length - sizeof(tSirTdlsSendMgmtReq)));
 		result_code = eSIR_SME_SUCCESS;
@@ -2795,7 +2799,7 @@ tSirRetStatus lim_process_sme_tdls_mgmt_send_req(tpAniSirGlobal mac_ctx,
 	case SIR_MAC_TDLS_SETUP_RSP:
 		lim_log(mac_ctx, LOG1, FL("Transmit Setup Response Frame"));
 		lim_send_tdls_setup_rsp_frame(mac_ctx,
-			send_req->peerMac, send_req->dialog, session_entry,
+			send_req->peer_mac, send_req->dialog, session_entry,
 			send_req->statusCode, &send_req->addIe[0],
 			(send_req->length - sizeof(tSirTdlsSendMgmtReq)));
 		result_code = eSIR_SME_SUCCESS;
@@ -2803,7 +2807,7 @@ tSirRetStatus lim_process_sme_tdls_mgmt_send_req(tpAniSirGlobal mac_ctx,
 	case SIR_MAC_TDLS_SETUP_CNF:
 		lim_log(mac_ctx, LOG1, FL("Transmit Setup Confirm Frame"));
 		lim_send_tdls_link_setup_cnf_frame(mac_ctx,
-			send_req->peerMac, send_req->dialog,
+			send_req->peer_mac, send_req->dialog,
 			send_req->peerCapability, session_entry,
 			&send_req->addIe[0],
 			(send_req->length - sizeof(tSirTdlsSendMgmtReq)));
@@ -2812,7 +2816,7 @@ tSirRetStatus lim_process_sme_tdls_mgmt_send_req(tpAniSirGlobal mac_ctx,
 	case SIR_MAC_TDLS_TEARDOWN:
 		lim_log(mac_ctx, LOG1, FL("Transmit Teardown Frame"));
 		lim_send_tdls_teardown_frame(mac_ctx,
-			send_req->peerMac, send_req->statusCode,
+			send_req->peer_mac, send_req->statusCode,
 			send_req->responder, session_entry,
 			&send_req->addIe[0],
 			(send_req->length - sizeof(tSirTdlsSendMgmtReq)));
@@ -3268,6 +3272,8 @@ tSirRetStatus lim_delete_tdls_peers(tpAniSirGlobal mac_ctx,
 			CLEAR_BIT(session_entry->peerAIDBitmap[i], aid);
 		}
 	}
+	if (session_entry->bRoamSynchInProgress)
+		return eSIR_SUCCESS;
 	lim_send_sme_tdls_delete_all_peer_ind(mac_ctx, session_entry);
 
 	return eSIR_SUCCESS;
diff --git a/core/mac/src/pe/lim/lim_prop_exts_utils.c b/core/mac/src/pe/lim/lim_prop_exts_utils.c
index c45da30c1b61..2ec7b318a14e 100644
--- a/core/mac/src/pe/lim/lim_prop_exts_utils.c
+++ b/core/mac/src/pe/lim/lim_prop_exts_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -77,7 +77,7 @@
 void
 lim_extract_ap_capability(tpAniSirGlobal mac_ctx, uint8_t *p_ie,
 	uint16_t ie_len, uint8_t *qos_cap, uint16_t *prop_cap, uint8_t *uapsd,
-	tPowerdBm *local_constraint, tpPESession session)
+	int8_t *local_constraint, tpPESession session)
 {
 	tSirProbeRespBeacon *beacon_struct;
 #if !defined WLAN_FEATURE_VOWIFI
@@ -103,7 +103,8 @@ lim_extract_ap_capability(tpAniSirGlobal mac_ctx, uint8_t *p_ie,
 	if (sir_parse_beacon_ie(mac_ctx, beacon_struct, p_ie,
 		(uint32_t) ie_len) == eSIR_SUCCESS) {
 		if (beacon_struct->wmeInfoPresent
-		    || beacon_struct->wmeEdcaPresent)
+		    || beacon_struct->wmeEdcaPresent
+		    || beacon_struct->HTCaps.present)
 			LIM_BSS_CAPS_SET(WME, *qos_cap);
 		if (LIM_BSS_CAPS_GET(WME, *qos_cap)
 		    && beacon_struct->wsmCapablePresent)
diff --git a/core/mac/src/pe/lim/lim_prop_exts_utils.h b/core/mac/src/pe/lim/lim_prop_exts_utils.h
index a648a78ddbfd..6c0fd89b1886 100644
--- a/core/mac/src/pe/lim/lim_prop_exts_utils.h
+++ b/core/mac/src/pe/lim/lim_prop_exts_utils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -54,7 +54,7 @@ uint32_t limComputeAvg(tpAniSirGlobal, uint32_t, uint32_t);
 
 /* / Function to extract AP's HCF capability from IE fields */
 void lim_extract_ap_capability(tpAniSirGlobal, uint8_t *, uint16_t, uint8_t *,
-			       uint16_t *, uint8_t *, tPowerdBm *, tpPESession);
+			       uint16_t *, uint8_t *, int8_t *, tpPESession);
 
 tStaRateMode lim_get_sta_peer_type(tpAniSirGlobal, tpDphHashNode, tpPESession);
 #ifdef WLAN_FEATURE_11AC
diff --git a/core/mac/src/pe/lim/lim_scan_result_utils.c b/core/mac/src/pe/lim/lim_scan_result_utils.c
index 387152e92fee..a26a289531c5 100644
--- a/core/mac/src/pe/lim/lim_scan_result_utils.c
+++ b/core/mac/src/pe/lim/lim_scan_result_utils.c
@@ -165,6 +165,8 @@ lim_collect_bss_description(tpAniSirGlobal pMac,
 	}
 
 	pBssDescr->channelIdSelf = pBssDescr->channelId;
+	pBssDescr->rx_channel = rxChannel;
+
 	/* set the network type in bss description */
 	channelNum = pBssDescr->channelId;
 	pBssDescr->nwType =
@@ -177,10 +179,15 @@ lim_collect_bss_description(tpAniSirGlobal pMac,
 	sir_dump_buf(pMac, SIR_LIM_MODULE_ID, LOG4,
 		(uint8_t *) pRxPacketInfo, 36);
 
-	pBssDescr->rssi = (int8_t) WMA_GET_RX_RSSI_DB(pRxPacketInfo);
+	pBssDescr->rssi = (int8_t) WMA_GET_RX_RSSI_NORMALIZED(pRxPacketInfo);
+	pBssDescr->rssi_raw = (int8_t) WMA_GET_RX_RSSI_RAW(pRxPacketInfo);
 
 	/* SINR no longer reported by HW */
 	pBssDescr->sinr = 0;
+	lim_log(pMac, LOG3,
+		FL(MAC_ADDRESS_STR " rssi: normalized = %d, absolute = %d"),
+		MAC_ADDR_ARRAY(pHdr->bssId), pBssDescr->rssi,
+		pBssDescr->rssi_raw);
 
 	pBssDescr->nReceivedTime = (uint32_t) cdf_mc_timer_get_system_ticks();
 	pBssDescr->tsf_delta = WMA_GET_RX_TSF_DELTA(pRxPacketInfo);
diff --git a/core/mac/src/pe/lim/lim_security_utils.c b/core/mac/src/pe/lim/lim_security_utils.c
index ae0a42224d06..40d51323688b 100644
--- a/core/mac/src/pe/lim/lim_security_utils.c
+++ b/core/mac/src/pe/lim/lim_security_utils.c
@@ -775,15 +775,10 @@ void lim_post_sme_set_keys_cnf(tpAniSirGlobal pMac,
 			       tLimMlmSetKeysCnf *mlmSetKeysCnf)
 {
 	/* Prepare and Send LIM_MLM_SETKEYS_CNF */
-	cdf_mem_copy((uint8_t *) &mlmSetKeysCnf->peerMacAddr,
-		     (uint8_t *) pMlmSetKeysReq->peerMacAddr,
-		     sizeof(tSirMacAddr));
-
-	cdf_mem_copy((uint8_t *) &mlmSetKeysCnf->peerMacAddr,
-		     (uint8_t *) pMlmSetKeysReq->peerMacAddr,
-		     sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&mlmSetKeysCnf->peer_macaddr,
+			 &pMlmSetKeysReq->peer_macaddr);
 
-	/* / Free up buffer allocated for mlmSetKeysReq */
+	/* Free up buffer allocated for mlmSetKeysReq */
 	cdf_mem_free(pMlmSetKeysReq);
 	pMac->lim.gpLimMlmSetKeysReq = NULL;
 
@@ -969,8 +964,8 @@ void lim_send_set_sta_key_req(tpAniSirGlobal pMac,
 	pSetStaKeyParams->defWEPIdx = defWEPIdx;
 
 	pSetStaKeyParams->smesessionId = pMlmSetKeysReq->smesessionId;
-	cdf_mem_copy(pSetStaKeyParams->peerMacAddr,
-		     pMlmSetKeysReq->peerMacAddr, sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&pSetStaKeyParams->peer_macaddr,
+			 &pMlmSetKeysReq->peer_macaddr);
 
 	if (sendRsp == true) {
 		/** Store the Previous MlmState*/
diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c
index 80bd967983ad..13f117e5680d 100644
--- a/core/mac/src/pe/lim/lim_send_management_frames.c
+++ b/core/mac/src/pe/lim/lim_send_management_frames.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1202,6 +1202,18 @@ lim_send_assoc_rsp_mgmt_frame(tpAniSirGlobal mac_ctx,
 				FL("Populate HT IEs in Assoc Response"));
 			populate_dot11f_ht_caps(mac_ctx, pe_session,
 				&frm.HTCaps);
+			/*
+			 * Check the STA capability and
+			 * update the HTCaps accordingly
+			 */
+			frm.HTCaps.supportedChannelWidthSet = (
+				sta->htSupportedChannelWidthSet <
+				     pe_session->htSupportedChannelWidthSet) ?
+				      sta->htSupportedChannelWidthSet :
+				       pe_session->htSupportedChannelWidthSet;
+			if (!frm.HTCaps.supportedChannelWidthSet)
+				frm.HTCaps.shortGI40MHz = 0;
+
 			populate_dot11f_ht_info(mac_ctx, &frm.HTInfo,
 				pe_session);
 		}
@@ -1713,7 +1725,8 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 		pe_session);
 
 #if defined WLAN_FEATURE_VOWIFI
-	if (mac_ctx->rrm.rrmPEContext.rrmEnable)
+	if (mac_ctx->rrm.rrmPEContext.rrmEnable &&
+	    SIR_MAC_GET_RRM(pe_session->limCurrentBssCaps))
 		populate_dot11f_rrm_ie(mac_ctx, &frm->RRMEnabledCap,
 			pe_session);
 #endif
@@ -1930,7 +1943,8 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 	    )
 		tx_flag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
 
-	if (pe_session->pePersona == CDF_P2P_CLIENT_MODE)
+	if (pe_session->pePersona == CDF_P2P_CLIENT_MODE ||
+		pe_session->pePersona == CDF_STA_MODE)
 		tx_flag |= HAL_USE_PEER_STA_REQUESTED_MASK;
 
 #ifdef FEATURE_WLAN_DIAG_SUPPORT
@@ -2090,7 +2104,8 @@ lim_send_reassoc_req_with_ft_ies_mgmt_frame(tpAniSirGlobal mac_ctx,
 		pe_session);
 
 #if defined WLAN_FEATURE_VOWIFI
-	if (mac_ctx->rrm.rrmPEContext.rrmEnable)
+	if (mac_ctx->rrm.rrmPEContext.rrmEnable &&
+	    SIR_MAC_GET_RRM(pe_session->limCurrentBssCaps))
 		populate_dot11f_rrm_ie(mac_ctx, &frm.RRMEnabledCap, pe_session);
 #endif
 
@@ -2357,6 +2372,7 @@ lim_send_reassoc_req_with_ft_ies_mgmt_frame(tpAniSirGlobal mac_ctx,
 	if (NULL != pe_session->assocReq) {
 		cdf_mem_free(pe_session->assocReq);
 		pe_session->assocReq = NULL;
+		pe_session->assocReqLen = 0;
 	}
 	if (ft_ies_length) {
 		pe_session->assocReq = cdf_mem_malloc(ft_ies_length);
@@ -2560,7 +2576,8 @@ lim_send_reassoc_req_mgmt_frame(tpAniSirGlobal pMac,
 				       &frm.ExtSuppRates, psessionEntry);
 
 #if defined WLAN_FEATURE_VOWIFI
-	if (pMac->rrm.rrmPEContext.rrmEnable)
+	if (pMac->rrm.rrmPEContext.rrmEnable &&
+	    SIR_MAC_GET_RRM(psessionEntry->limCurrentBssCaps))
 		populate_dot11f_rrm_ie(pMac, &frm.RRMEnabledCap, psessionEntry);
 #endif
 	/* The join request *should* contain zero or one of the WPA and RSN */
@@ -2710,9 +2727,9 @@ lim_send_reassoc_req_mgmt_frame(tpAniSirGlobal pMac,
 		txFlag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
 	}
 
-	if (psessionEntry->pePersona == CDF_P2P_CLIENT_MODE) {
+	if (psessionEntry->pePersona == CDF_P2P_CLIENT_MODE ||
+		psessionEntry->pePersona == CDF_STA_MODE)
 		txFlag |= HAL_USE_PEER_STA_REQUESTED_MASK;
-	}
 
 #ifdef FEATURE_WLAN_DIAG_SUPPORT
 	lim_diag_event_report(pMac, WLAN_PE_DIAG_REASSOC_START_EVENT,
@@ -3015,10 +3032,10 @@ lim_send_auth_mgmt_frame(tpAniSirGlobal mac_ctx,
 		tx_flag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
 
 
-	if (session->pePersona == CDF_P2P_CLIENT_MODE)
+	if (session->pePersona == CDF_P2P_CLIENT_MODE ||
+		session->pePersona == CDF_STA_MODE)
 		tx_flag |= HAL_USE_PEER_STA_REQUESTED_MASK;
 
-
 	MTRACE(cdf_trace(CDF_MODULE_ID_PE, TRACE_CODE_TX_MGMT,
 			 session->peSessionId, mac_hdr->fc.subType));
 	/* Queue Authentication frame in high priority WQ */
@@ -3064,7 +3081,9 @@ CDF_STATUS lim_send_deauth_cnf(tpAniSirGlobal pMac)
 		}
 
 		pStaDs =
-			dph_lookup_hash_entry(pMac, pMlmDeauthReq->peerMacAddr, &aid,
+			dph_lookup_hash_entry(pMac,
+					      pMlmDeauthReq->peer_macaddr.bytes,
+					      &aid,
 					      &psessionEntry->dph.dphHashTable);
 		if (pStaDs == NULL) {
 			mlmDeauthCnf.resultCode = eSIR_SME_INVALID_PARAMETERS;
@@ -3074,15 +3093,52 @@ CDF_STATUS lim_send_deauth_cnf(tpAniSirGlobal pMac)
 		/* / Receive path cleanup with dummy packet */
 		lim_ft_cleanup_pre_auth_info(pMac, psessionEntry);
 		lim_cleanup_rx_path(pMac, pStaDs, psessionEntry);
+#ifdef WLAN_FEATURE_VOWIFI_11R
+	if ((psessionEntry->limSystemRole == eLIM_STA_ROLE) &&
+		(
+#ifdef FEATURE_WLAN_ESE
+		(psessionEntry->isESEconnection) ||
+#endif
+#ifdef FEATURE_WLAN_LFR
+		(psessionEntry->isFastRoamIniFeatureEnabled) ||
+#endif
+		(psessionEntry->is11Rconnection))) {
+		PELOGE(lim_log(pMac, LOGE,
+			FL("FT Preauth Session (%p,%d) Cleanup Deauth reason %d Trigger = %d"),
+				psessionEntry, psessionEntry->peSessionId,
+				pMlmDeauthReq->reasonCode,
+				pMlmDeauthReq->deauthTrigger););
+		lim_ft_cleanup(pMac, psessionEntry);
+	} else {
+		PELOGE(lim_log(pMac, LOGE,
+			FL("No FT Preauth Session Cleanup in role %d"
+#ifdef FEATURE_WLAN_ESE
+			" isESE %d"
+#endif
+#ifdef FEATURE_WLAN_LFR
+			" isLFR %d"
+#endif
+			" is11r %d, Deauth reason %d Trigger = %d"),
+			psessionEntry->limSystemRole,
+#ifdef FEATURE_WLAN_ESE
+			psessionEntry->isESEconnection,
+#endif
+#ifdef FEATURE_WLAN_LFR
+			psessionEntry->isFastRoamIniFeatureEnabled,
+#endif
+			psessionEntry->is11Rconnection,
+			pMlmDeauthReq->reasonCode,
+			pMlmDeauthReq->deauthTrigger););
+	}
+#endif
 		/* / Free up buffer allocated for mlmDeauthReq */
 		cdf_mem_free(pMlmDeauthReq);
 		pMac->lim.limDisassocDeauthCnfReq.pMlmDeauthReq = NULL;
 	}
 	return CDF_STATUS_SUCCESS;
 end:
-	cdf_mem_copy((uint8_t *) &mlmDeauthCnf.peerMacAddr,
-		     (uint8_t *) pMlmDeauthReq->peerMacAddr,
-		     sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&mlmDeauthCnf.peer_macaddr,
+			 &pMlmDeauthReq->peer_macaddr);
 	mlmDeauthCnf.deauthTrigger = pMlmDeauthReq->deauthTrigger;
 	mlmDeauthCnf.aid = pMlmDeauthReq->aid;
 	mlmDeauthCnf.sessionId = pMlmDeauthReq->sessionId;
@@ -3133,7 +3189,7 @@ CDF_STATUS lim_send_disassoc_cnf(tpAniSirGlobal mac_ctx)
 		}
 
 		sta_ds = dph_lookup_hash_entry(mac_ctx,
-				disassoc_req->peerMacAddr, &aid,
+				disassoc_req->peer_macaddr.bytes, &aid,
 				&pe_session->dph.dphHashTable);
 		if (sta_ds == NULL) {
 			lim_log(mac_ctx, LOGE, FL("StaDs Null"));
@@ -3197,8 +3253,8 @@ CDF_STATUS lim_send_disassoc_cnf(tpAniSirGlobal mac_ctx)
 	}
 end:
 	cdf_mem_copy((uint8_t *) &disassoc_cnf.peerMacAddr,
-		     (uint8_t *) disassoc_req->peerMacAddr,
-		     sizeof(tSirMacAddr));
+		     (uint8_t *) disassoc_req->peer_macaddr.bytes,
+		     CDF_MAC_ADDR_SIZE);
 	disassoc_cnf.aid = disassoc_req->aid;
 	disassoc_cnf.disassocTrigger = disassoc_req->disassocTrigger;
 
@@ -3345,10 +3401,7 @@ lim_send_disassoc_mgmt_frame(tpAniSirGlobal pMac,
 		txFlag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
 	}
 
-	if ((psessionEntry->pePersona == CDF_P2P_CLIENT_MODE) ||
-	    (psessionEntry->pePersona == CDF_P2P_GO_MODE)) {
-		txFlag |= HAL_USE_PEER_STA_REQUESTED_MASK;
-	}
+	txFlag |= HAL_USE_PEER_STA_REQUESTED_MASK;
 
 	if (waitForAck) {
 		MTRACE(cdf_trace(CDF_MODULE_ID_PE, TRACE_CODE_TX_MGMT,
@@ -3525,10 +3578,7 @@ lim_send_deauth_mgmt_frame(tpAniSirGlobal pMac,
 		txFlag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
 	}
 
-	if ((psessionEntry->pePersona == CDF_P2P_CLIENT_MODE) ||
-	    (psessionEntry->pePersona == CDF_P2P_GO_MODE)) {
-		txFlag |= HAL_USE_PEER_STA_REQUESTED_MASK;
-	}
+	txFlag |= HAL_USE_PEER_STA_REQUESTED_MASK;
 #ifdef FEATURE_WLAN_TDLS
 	pStaDs =
 		dph_lookup_hash_entry(pMac, peer, &aid,
@@ -4225,7 +4275,6 @@ lim_send_extended_chan_switch_action_frame(tpAniSirGlobal mac_ctx,
 	return eSIR_SUCCESS;
 } /* End lim_send_extended_chan_switch_action_frame */
 
-#ifdef WLAN_FEATURE_11AC
 tSirRetStatus
 lim_send_vht_opmode_notification_frame(tpAniSirGlobal pMac,
 				       tSirMacAddr peer,
@@ -4335,140 +4384,6 @@ lim_send_vht_opmode_notification_frame(tpAniSirGlobal pMac,
 	return eSIR_SUCCESS;
 }
 
-/**
- * \brief Send a VHT Channel Switch Announcement
- *
- *
- * \param pMac Pointer to the global MAC datastructure
- *
- * \param peer MAC address to which this frame will be sent
- *
- * \param nChanWidth
- *
- * \param nNewChannel
- *
- *
- * \return eSIR_SUCCESS on success, eSIR_FAILURE else
- *
- *
- */
-
-tSirRetStatus
-lim_send_vht_channel_switch_mgmt_frame(tpAniSirGlobal pMac,
-				       tSirMacAddr peer,
-				       uint8_t nChanWidth,
-				       uint8_t nNewChannel,
-				       uint8_t ncbMode, tpPESession psessionEntry)
-{
-	tDot11fChannelSwitch frm;
-	uint8_t *pFrame;
-	tpSirMacMgmtHdr pMacHdr;
-	uint32_t nBytes, nPayload, nStatus;     /* , nCfg; */
-	void *pPacket;
-	CDF_STATUS cdf_status;
-	uint8_t txFlag = 0;
-
-	uint8_t smeSessionId = 0;
-
-	if (psessionEntry == NULL) {
-		PELOGE(lim_log(pMac, LOGE, FL("Session entry is NULL!!!"));)
-		return eSIR_FAILURE;
-	}
-	smeSessionId = psessionEntry->smeSessionId;
-
-	cdf_mem_set((uint8_t *) &frm, sizeof(frm), 0);
-
-	frm.Category.category = SIR_MAC_ACTION_SPECTRUM_MGMT;
-	frm.Action.action = SIR_MAC_ACTION_CHANNEL_SWITCH_ID;
-	frm.ChanSwitchAnn.switchMode = 1;
-	frm.ChanSwitchAnn.newChannel = nNewChannel;
-	frm.ChanSwitchAnn.switchCount = 1;
-	frm.sec_chan_offset_ele.secondaryChannelOffset =
-						lim_get_htcb_state(ncbMode);
-	frm.sec_chan_offset_ele.present = 1;
-	frm.WiderBWChanSwitchAnn.newChanWidth = nChanWidth;
-	frm.WiderBWChanSwitchAnn.newCenterChanFreq0 =
-		lim_get_center_channel(pMac, nNewChannel, ncbMode, nChanWidth);
-	frm.WiderBWChanSwitchAnn.newCenterChanFreq1 = 0;
-	frm.ChanSwitchAnn.present = 1;
-	frm.WiderBWChanSwitchAnn.present = 1;
-
-	nStatus = dot11f_get_packed_channel_switch_size(pMac, &frm, &nPayload);
-	if (DOT11F_FAILED(nStatus)) {
-		lim_log(pMac, LOGP, FL("Failed to calculate the packed size f"
-				       "or a Channel Switch (0x%08x)."),
-			nStatus);
-		/* We'll fall back on the worst case scenario: */
-		nPayload = sizeof(tDot11fChannelSwitch);
-	} else if (DOT11F_WARNED(nStatus)) {
-		lim_log(pMac, LOGW, FL("There were warnings while calculating "
-				       "the packed size for a Channel Switch (0x"
-				       "%08x)."), nStatus);
-	}
-
-	nBytes = nPayload + sizeof(tSirMacMgmtHdr);
-
-	cdf_status =
-		cds_packet_alloc((uint16_t) nBytes, (void **)&pFrame,
-				 (void **)&pPacket);
-	if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
-		lim_log(pMac, LOGP, FL("Failed to allocate %d bytes for a TPC"
-				       " Report."), nBytes);
-		return eSIR_FAILURE;
-	}
-	/* Paranoia: */
-	cdf_mem_set(pFrame, nBytes, 0);
-
-	/* Next, we fill out the buffer descriptor: */
-	lim_populate_mac_header(pMac, pFrame, SIR_MAC_MGMT_FRAME,
-		SIR_MAC_MGMT_ACTION, peer, psessionEntry->selfMacAddr);
-	pMacHdr = (tpSirMacMgmtHdr) pFrame;
-	cdf_mem_copy((uint8_t *) pMacHdr->bssId,
-		     (uint8_t *) psessionEntry->bssId, sizeof(tSirMacAddr));
-	nStatus = dot11f_pack_channel_switch(pMac, &frm, pFrame +
-					     sizeof(tSirMacMgmtHdr),
-					     nPayload, &nPayload);
-	if (DOT11F_FAILED(nStatus)) {
-		lim_log(pMac, LOGE,
-			FL("Failed to pack a Channel Switch (0x%08x)."),
-			nStatus);
-		cds_packet_free((void *)pPacket);
-		return eSIR_FAILURE;    /* allocated! */
-	} else if (DOT11F_WARNED(nStatus)) {
-		lim_log(pMac, LOGW, FL("There were warnings while packing a C"
-				       "hannel Switch (0x%08x)."), nStatus);
-	}
-
-	if ((SIR_BAND_5_GHZ == lim_get_rf_band(psessionEntry->currentOperChannel))
-	    || (psessionEntry->pePersona == CDF_P2P_CLIENT_MODE) ||
-	    (psessionEntry->pePersona == CDF_P2P_GO_MODE)
-	    ) {
-		txFlag |= HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME;
-	}
-
-	MTRACE(cdf_trace(CDF_MODULE_ID_PE, TRACE_CODE_TX_MGMT,
-			 psessionEntry->peSessionId, pMacHdr->fc.subType));
-	cdf_status = wma_tx_frame(pMac, pPacket, (uint16_t) nBytes,
-				TXRX_FRM_802_11_MGMT,
-				ANI_TXDIR_TODS,
-				7, lim_tx_complete, pFrame, txFlag,
-				smeSessionId, 0);
-	MTRACE(cdf_trace(CDF_MODULE_ID_PE, TRACE_CODE_TX_COMPLETE,
-			 psessionEntry->peSessionId, cdf_status));
-	if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
-		lim_log(pMac, LOGE,
-			FL("Failed to send a Channel Switch (%X)!"),
-			cdf_status);
-		/* Pkt will be freed up by the callback */
-		return eSIR_FAILURE;
-	}
-
-	return eSIR_SUCCESS;
-
-} /* End lim_send_vht_channel_switch_mgmt_frame. */
-
-#endif
-
 #if defined WLAN_FEATURE_VOWIFI
 
 /**
diff --git a/core/mac/src/pe/lim/lim_send_messages.c b/core/mac/src/pe/lim/lim_send_messages.c
index 3e6f53b6ad76..264cf02c800f 100644
--- a/core/mac/src/pe/lim/lim_send_messages.c
+++ b/core/mac/src/pe/lim/lim_send_messages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -220,7 +220,7 @@ tSirRetStatus lim_send_switch_chnl_params(tpAniSirGlobal pMac,
 					  uint8_t ch_center_freq_seg0,
 					  uint8_t ch_center_freq_seg1,
 					  phy_ch_width ch_width,
-					  tPowerdBm maxTxPower,
+					  int8_t maxTxPower,
 					  uint8_t peSessionId,
 					  uint8_t is_restart)
 #endif
diff --git a/core/mac/src/pe/lim/lim_send_messages.h b/core/mac/src/pe/lim/lim_send_messages.h
index d884de757253..e8b4665a2962 100644
--- a/core/mac/src/pe/lim/lim_send_messages.h
+++ b/core/mac/src/pe/lim/lim_send_messages.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -49,7 +49,6 @@ tSirRetStatus lim_send_beacon_params(tpAniSirGlobal pMac,
 				     tpUpdateBeaconParams pUpdatedBcnParams,
 				     tpPESession psessionEntry);
 /* tSirRetStatus lim_send_beacon_params(tpAniSirGlobal pMac, tpUpdateBeaconParams pUpdatedBcnParams); */
-#ifdef WLAN_FEATURE_11AC
 tSirRetStatus lim_send_mode_update(tpAniSirGlobal pMac,
 				   tUpdateVHTOpMode *tempParam,
 				   tpPESession psessionEntry);
@@ -57,11 +56,6 @@ tSirRetStatus lim_send_rx_nss_update(tpAniSirGlobal pMac,
 				     tUpdateRxNss *tempParam,
 				     tpPESession psessionEntry);
 
-uint32_t lim_get_center_channel(tpAniSirGlobal pMac,
-				uint8_t primarychanNum,
-				ePhyChanBondState secondaryChanOffset,
-				uint8_t chanWidth);
-
 tSirRetStatus lim_set_membership(tpAniSirGlobal pMac,
 				 tUpdateMembership *pTempParam,
 				 tpPESession psessionEntry);
@@ -69,14 +63,13 @@ tSirRetStatus lim_set_membership(tpAniSirGlobal pMac,
 tSirRetStatus lim_set_user_pos(tpAniSirGlobal pMac,
 			       tUpdateUserPos *pTempParam,
 			       tpPESession psessionEntry);
-#endif
 #if defined WLAN_FEATURE_VOWIFI
 tSirRetStatus lim_send_switch_chnl_params(tpAniSirGlobal pMac,
 					  uint8_t chnlNumber,
 					  uint8_t ch_center_freq_seg0,
 					  uint8_t ch_center_freq_seg1,
 					  phy_ch_width ch_width,
-					  tPowerdBm maxTxPower,
+					  int8_t maxTxPower,
 					  uint8_t peSessionId,
 					  uint8_t is_restart);
 #else
diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
index c7d1517d2523..b1c3d36db155 100644
--- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -271,48 +271,53 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx,
 				sme_join_rsp->beaconLength);
 			cdf_mem_free(session_entry->beacon);
 			session_entry->beacon = NULL;
+			session_entry->bcnLen = 0;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
 			lim_log(mac_ctx, LOG1, FL("Beacon=%d"),
-				session_entry->bcnLen);
+				sme_join_rsp->beaconLength);
 #endif
 		}
 		if (session_entry->assocReq != NULL) {
 			sme_join_rsp->assocReqLength =
 				session_entry->assocReqLen;
 			cdf_mem_copy(sme_join_rsp->frames +
-				session_entry->bcnLen, session_entry->assocReq,
+				sme_join_rsp->beaconLength,
+				session_entry->assocReq,
 				sme_join_rsp->assocReqLength);
 			cdf_mem_free(session_entry->assocReq);
 			session_entry->assocReq = NULL;
+			session_entry->assocReqLen = 0;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
 			lim_log(mac_ctx,
 				LOG1, FL("AssocReq=%d"),
-				session_entry->assocReqLen);
+				sme_join_rsp->assocReqLength);
 #endif
 		}
 		if (session_entry->assocRsp != NULL) {
 			sme_join_rsp->assocRspLength =
 				session_entry->assocRspLen;
 			cdf_mem_copy(sme_join_rsp->frames +
-				session_entry->bcnLen +
-				session_entry->assocReqLen,
+				sme_join_rsp->beaconLength +
+				sme_join_rsp->assocReqLength,
 				session_entry->assocRsp,
 				sme_join_rsp->assocRspLength);
 			cdf_mem_free(session_entry->assocRsp);
 			session_entry->assocRsp = NULL;
+			session_entry->assocRspLen = 0;
 		}
 #ifdef WLAN_FEATURE_VOWIFI_11R
 		if (session_entry->ricData != NULL) {
 			sme_join_rsp->parsedRicRspLen =
 				session_entry->RICDataLen;
 			cdf_mem_copy(sme_join_rsp->frames +
-				session_entry->bcnLen +
-				session_entry->assocReqLen +
-				session_entry->assocRspLen,
+				sme_join_rsp->beaconLength +
+				sme_join_rsp->assocReqLength +
+				sme_join_rsp->assocRspLength,
 				session_entry->ricData,
 				sme_join_rsp->parsedRicRspLen);
 			cdf_mem_free(session_entry->ricData);
 			session_entry->ricData = NULL;
+			session_entry->RICDataLen = 0;
 			lim_log(mac_ctx, LOG1, FL("RicLength=%d"),
 				sme_join_rsp->parsedRicRspLen);
 		}
@@ -322,22 +327,23 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx,
 			sme_join_rsp->tspecIeLen =
 				session_entry->tspecLen;
 			cdf_mem_copy(sme_join_rsp->frames +
-				session_entry->bcnLen +
-				session_entry->assocReqLen +
-				session_entry->assocRspLen +
-				session_entry->RICDataLen,
+				sme_join_rsp->beaconLength +
+				sme_join_rsp->assocReqLength +
+				sme_join_rsp->assocRspLength +
+				sme_join_rsp->parsedRicRspLen,
 				session_entry->tspecIes,
 				sme_join_rsp->tspecIeLen);
 			cdf_mem_free(session_entry->tspecIes);
 			session_entry->tspecIes = NULL;
+			session_entry->tspecLen = 0;
 			lim_log(mac_ctx, LOG1, FL("ESE-TspecLen=%d"),
-				session_entry->tspecLen);
+				sme_join_rsp->tspecIeLen);
 		}
 #endif
 		sme_join_rsp->aid = session_entry->limAID;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
 		lim_log(mac_ctx, LOG1, FL("AssocRsp=%d"),
-			session_entry->assocRspLen);
+			sme_join_rsp->assocRspLength);
 #endif
 		sme_join_rsp->vht_channel_width =
 			session_entry->ch_width;
@@ -367,25 +373,30 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx,
 		if (session_entry->beacon != NULL) {
 			cdf_mem_free(session_entry->beacon);
 			session_entry->beacon = NULL;
+			session_entry->bcnLen = 0;
 		}
 		if (session_entry->assocReq != NULL) {
 			cdf_mem_free(session_entry->assocReq);
 			session_entry->assocReq = NULL;
+			session_entry->assocReqLen = 0;
 		}
 		if (session_entry->assocRsp != NULL) {
 			cdf_mem_free(session_entry->assocRsp);
 			session_entry->assocRsp = NULL;
+			session_entry->assocRspLen = 0;
 		}
 #ifdef WLAN_FEATURE_VOWIFI_11R
 		if (session_entry->ricData != NULL) {
 			cdf_mem_free(session_entry->ricData);
 			session_entry->ricData = NULL;
+			session_entry->RICDataLen = 0;
 		}
 #endif
 #ifdef FEATURE_WLAN_ESE
 		if (session_entry->tspecIes != NULL) {
 			cdf_mem_free(session_entry->tspecIes);
 			session_entry->tspecIes = NULL;
+			session_entry->tspecLen = 0;
 		}
 #endif
 	}
@@ -687,9 +698,6 @@ lim_send_sme_start_bss_rsp(tpAniSirGlobal pMac,
 	lim_sys_process_mmh_msg_api(pMac, &mmhMsg, ePROT);
 } /*** end lim_send_sme_start_bss_rsp() ***/
 
-#define LIM_MAX_NUM_OF_SCAN_RESULTS_REPORTED  20
-#define LIM_SIZE_OF_EACH_BSS  400       /* this is a rough estimate */
-
 /**
  * lim_send_sme_scan_rsp() - Send scan response to SME
  * @pMac:         Pointer to Global MAC structure
@@ -833,7 +841,7 @@ void lim_send_sme_oem_data_rsp(tpAniSirGlobal pMac, uint32_t *pMsgBuf,
 	pSirSmeOemDataRsp->length = msgLength;
 	pSirSmeOemDataRsp->messageType = eWNI_SME_OEM_DATA_RSP;
 #endif
-
+	pSirSmeOemDataRsp->target_rsp = pMlmOemDataRsp->target_rsp;
 	cdf_mem_copy(pSirSmeOemDataRsp->oemDataRsp, pMlmOemDataRsp->oemDataRsp,
 		     OEM_DATA_RSP_SIZE);
 
@@ -1055,11 +1063,11 @@ lim_send_sme_disassoc_ind(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 	pSirSmeDisassocInd->statusCode = pStaDs->mlmStaContext.disassocReason;
 	pSirSmeDisassocInd->reasonCode = pStaDs->mlmStaContext.disassocReason;
 
-	cdf_mem_copy(pSirSmeDisassocInd->bssId, psessionEntry->bssId,
-		     sizeof(tSirMacAddr));
+	cdf_mem_copy(pSirSmeDisassocInd->bssid.bytes, psessionEntry->bssId,
+		     CDF_MAC_ADDR_SIZE);
 
-	cdf_mem_copy(pSirSmeDisassocInd->peerMacAddr, pStaDs->staAddr,
-		     sizeof(tSirMacAddr));
+	cdf_mem_copy(pSirSmeDisassocInd->peer_macaddr.bytes, pStaDs->staAddr,
+		     CDF_MAC_ADDR_SIZE);
 
 	pSirSmeDisassocInd->staId = pStaDs->staIndex;
 
@@ -1117,14 +1125,17 @@ lim_send_sme_deauth_ind(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
 			(tSirResultCodes) pStaDs->mlmStaContext.disassocReason;
 	}
 	/* BSSID */
-	cdf_mem_copy(pSirSmeDeauthInd->bssId, psessionEntry->bssId,
-		     sizeof(tSirMacAddr));
+	cdf_mem_copy(pSirSmeDeauthInd->bssid.bytes, psessionEntry->bssId,
+		     CDF_MAC_ADDR_SIZE);
 	/* peerMacAddr */
-	cdf_mem_copy(pSirSmeDeauthInd->peerMacAddr, pStaDs->staAddr,
-		     sizeof(tSirMacAddr));
+	cdf_mem_copy(pSirSmeDeauthInd->peer_macaddr.bytes, pStaDs->staAddr,
+		     CDF_MAC_ADDR_SIZE);
 	pSirSmeDeauthInd->reasonCode = pStaDs->mlmStaContext.disassocReason;
 
 	pSirSmeDeauthInd->staId = pStaDs->staIndex;
+	if (eSIR_MAC_PEER_STA_REQ_LEAVING_BSS_REASON ==
+		pStaDs->mlmStaContext.disassocReason)
+		pSirSmeDeauthInd->rssi = pStaDs->del_sta_ctx_rssi;
 
 	mmhMsg.type = eWNI_SME_DEAUTH_IND;
 	mmhMsg.bodyptr = pSirSmeDeauthInd;
@@ -1390,7 +1401,7 @@ lim_send_sme_deauth_ntf(tpAniSirGlobal pMac, tSirMacAddr peerMacAddr,
 		pSirSmeDeauthRsp->sessionId = smesessionId;
 		pSirSmeDeauthRsp->transactionId = smetransactionId;
 
-		pBuf = (uint8_t *) pSirSmeDeauthRsp->peerMacAddr;
+		pBuf = (uint8_t *) pSirSmeDeauthRsp->peer_macaddr.bytes;
 		cdf_mem_copy(pBuf, peerMacAddr, sizeof(tSirMacAddr));
 
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM    /* FEATURE_WLAN_DIAG_SUPPORT */
@@ -1440,8 +1451,8 @@ lim_send_sme_deauth_ntf(tpAniSirGlobal pMac, tSirMacAddr peerMacAddr,
 		pBuf += sizeof(tSirMacAddr);
 
 		/* peerMacAddr */
-		cdf_mem_copy(pSirSmeDeauthInd->peerMacAddr, peerMacAddr,
-			     sizeof(tSirMacAddr));
+		cdf_mem_copy(pSirSmeDeauthInd->peer_macaddr.bytes, peerMacAddr,
+			     CDF_MAC_ADDR_SIZE);
 
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM    /* FEATURE_WLAN_DIAG_SUPPORT */
 		lim_diag_event_report(pMac, WLAN_PE_DIAG_DEAUTH_IND_EVENT,
@@ -1554,13 +1565,11 @@ lim_send_sme_wm_status_change_ntf(tpAniSirGlobal mac_ctx,
  */
 void
 lim_send_sme_set_context_rsp(tpAniSirGlobal pMac,
-			     tSirMacAddr peerMacAddr, uint16_t aid,
+			     struct cdf_mac_addr peer_macaddr, uint16_t aid,
 			     tSirResultCodes resultCode,
 			     tpPESession psessionEntry, uint8_t smesessionId,
 			     uint16_t smetransactionId)
 {
-
-	uint8_t *pBuf;
 	tSirMsgQ mmhMsg;
 	tSirSmeSetContextRsp *pSirSmeSetContextRsp;
 
@@ -1578,10 +1587,7 @@ lim_send_sme_set_context_rsp(tpAniSirGlobal pMac,
 	pSirSmeSetContextRsp->length = sizeof(tSirSmeSetContextRsp);
 	pSirSmeSetContextRsp->statusCode = resultCode;
 
-	pBuf = pSirSmeSetContextRsp->peerMacAddr;
-
-	cdf_mem_copy(pBuf, (uint8_t *) peerMacAddr, sizeof(tSirMacAddr));
-	pBuf += sizeof(tSirMacAddr);
+	cdf_copy_macaddr(&pSirSmeSetContextRsp->peer_macaddr, &peer_macaddr);
 
 	/* Update SME session and transaction Id */
 	pSirSmeSetContextRsp->sessionId = smesessionId;
@@ -1769,8 +1775,7 @@ lim_send_sme_delts_rsp(tpAniSirGlobal pMac, tpSirDeltsReq delts, uint32_t status
 	if (psessionEntry != NULL) {
 
 		rsp->aid = delts->aid;
-		cdf_mem_copy((uint8_t *) &rsp->macAddr[0],
-			     (uint8_t *) &delts->macAddr[0], 6);
+		cdf_copy_macaddr(&rsp->macaddr, &delts->macaddr);
 		cdf_mem_copy((uint8_t *) &rsp->rsp, (uint8_t *) &delts->req,
 			     sizeof(tSirDeltsReqInfo));
 	}
@@ -1974,8 +1979,8 @@ lim_send_sme_ibss_peer_ind(tpAniSirGlobal pMac,
 	cdf_mem_set((void *)pNewPeerInd, (sizeof(tSmeIbssPeerInd) + beaconLen),
 		    0);
 
-	cdf_mem_copy((uint8_t *) pNewPeerInd->peerAddr,
-		     peerMacAddr, sizeof(tSirMacAddr));
+	cdf_mem_copy((uint8_t *) pNewPeerInd->peer_addr.bytes,
+		     peerMacAddr, CDF_MAC_ADDR_SIZE);
 	pNewPeerInd->staId = staIndex;
 	pNewPeerInd->ucastSig = ucastIdx;
 	pNewPeerInd->bcastSig = bcastIdx;
@@ -2013,9 +2018,10 @@ void lim_handle_csa_offload_msg(tpAniSirGlobal mac_ctx, tpSirMsgQ msg)
 	uint8_t session_id;
 	uint16_t aid = 0;
 	uint16_t chan_space = 0;
-	int cb_mode = 0;
+	chan_params_t ch_params;
 
 	tLimWiderBWChannelSwitchInfo *chnl_switch_info = NULL;
+	tLimChannelSwitchInfo *lim_ch_switch = NULL;
 
 	if (!csa_params) {
 		lim_log(mac_ctx, LOGE, FL("limMsgQ body ptr is NULL"));
@@ -2047,6 +2053,7 @@ void lim_handle_csa_offload_msg(tpAniSirGlobal mac_ctx, tpSirMsgQ msg)
 		 */
 		lim_delete_tdls_peers(mac_ctx, session_entry);
 
+		lim_ch_switch = &session_entry->gLimChannelSwitch;
 		session_entry->gLimChannelSwitch.switchMode =
 			csa_params->switchmode;
 		/* timer already started by firmware, switch immediately */
@@ -2056,7 +2063,8 @@ void lim_handle_csa_offload_msg(tpAniSirGlobal mac_ctx, tpSirMsgQ msg)
 		session_entry->gLimChannelSwitch.state =
 			eLIM_CHANNEL_SWITCH_PRIMARY_ONLY;
 		session_entry->gLimChannelSwitch.ch_width = CH_WIDTH_20MHZ;
-
+		lim_ch_switch->sec_ch_offset =
+			session_entry->htSecondaryChannelOffset;
 		session_entry->gLimChannelSwitch.ch_center_freq_seg0 = 0;
 		session_entry->gLimChannelSwitch.ch_center_freq_seg1 = 0;
 		chnl_switch_info =
@@ -2094,20 +2102,17 @@ void lim_handle_csa_offload_msg(tpAniSirGlobal mac_ctx, tpSirMsgQ msg)
 				} else {
 					chnl_switch_info->newChanWidth =
 								CH_WIDTH_20MHZ;
-					session_entry->gLimChannelSwitch.state =
+					lim_ch_switch->state =
 					    eLIM_CHANNEL_SWITCH_PRIMARY_ONLY;
 				}
 
-				cb_mode = lim_select_cb_mode_for_sta(
-						session_entry,
-						csa_params->channel,
-						chan_space);
-
+				ch_params.ch_width =
+					chnl_switch_info->newChanWidth;
+				cds_set_ch_params(csa_params->channel,
+						eCSR_DOT11_MODE_11ac,
+						&ch_params);
 				chnl_switch_info->newCenterChanFreq0 =
-				lim_get_center_channel(mac_ctx,
-					    csa_params->channel,
-					    cb_mode,
-					    chnl_switch_info->newChanWidth);
+					ch_params.center_freq_seg0;
 				/*
 				* This is not applicable for 20/40/80 MHz.
 				* Only used when we support 80+80 MHz operation.
@@ -2115,7 +2120,10 @@ void lim_handle_csa_offload_msg(tpAniSirGlobal mac_ctx, tpSirMsgQ msg)
 				* center channel frequency index of 80 MHz
 				* channel offrequency segment 1.
 				*/
-				chnl_switch_info->newCenterChanFreq1 = 0;
+				chnl_switch_info->newCenterChanFreq1 =
+					ch_params.center_freq_seg1;
+				lim_ch_switch->sec_ch_offset =
+					ch_params.sec_ch_offset;
 
 			}
 			session_entry->gLimChannelSwitch.ch_center_freq_seg0 =
@@ -2133,56 +2141,47 @@ void lim_handle_csa_offload_msg(tpAniSirGlobal mac_ctx, tpSirMsgQ msg)
 					mac_ctx->scan.countryCodeCurrent,
 					csa_params->channel,
 					csa_params->new_op_class);
-				session_entry->gLimChannelSwitch.state =
+				lim_ch_switch->state =
 				    eLIM_CHANNEL_SWITCH_PRIMARY_AND_SECONDARY;
 				if (chan_space == 40) {
-					session_entry->
-					    gLimChannelSwitch.ch_width =
+					lim_ch_switch->ch_width =
 								CH_WIDTH_40MHZ;
 					chnl_switch_info->newChanWidth =
 								CH_WIDTH_40MHZ;
-					cb_mode = lim_select_cb_mode_for_sta(
-							session_entry,
-							csa_params->channel,
-							chan_space);
-					if (cb_mode ==
-					    PHY_DOUBLE_CHANNEL_LOW_PRIMARY) {
-						session_entry->
-						    gLimChannelSwitch.
-						    ch_center_freq_seg0 =
-							csa_params->channel + 2;
-					} else if (cb_mode ==
-					    PHY_DOUBLE_CHANNEL_HIGH_PRIMARY) {
-						session_entry->
-						    gLimChannelSwitch.
-						    ch_center_freq_seg0 =
-							csa_params->channel - 2;
-					}
-
+					ch_params.ch_width =
+						chnl_switch_info->newChanWidth;
+					cds_set_ch_params(csa_params->channel,
+							eCSR_DOT11_MODE_11n,
+							&ch_params);
+					lim_ch_switch->ch_center_freq_seg0 =
+						ch_params.center_freq_seg0;
+					lim_ch_switch->sec_ch_offset =
+						ch_params.sec_ch_offset;
 				} else {
-					session_entry->
-					    gLimChannelSwitch.ch_width =
+					lim_ch_switch->ch_width =
 								CH_WIDTH_20MHZ;
 					chnl_switch_info->newChanWidth =
 								CH_WIDTH_40MHZ;
-					session_entry->gLimChannelSwitch.state =
+					lim_ch_switch->state =
 					    eLIM_CHANNEL_SWITCH_PRIMARY_ONLY;
+					lim_ch_switch->sec_ch_offset =
+						PHY_SINGLE_CHANNEL_CENTERED;
 				}
-
-
-			}
-
-			if (csa_params->sec_chan_offset) {
-				session_entry->gLimChannelSwitch.ch_width =
+			} else {
+				lim_ch_switch->ch_width =
 					CH_WIDTH_40MHZ;
-				session_entry->gLimChannelSwitch.state =
+				lim_ch_switch->state =
 				     eLIM_CHANNEL_SWITCH_PRIMARY_AND_SECONDARY;
-			} else {
-				session_entry->htSupportedChannelWidthSet =
-					WNI_CFG_CHANNEL_BONDING_MODE_DISABLE;
-				session_entry->htRecommendedTxWidthSet =
-				    session_entry->htSupportedChannelWidthSet;
+				ch_params.ch_width = CH_WIDTH_40MHZ;
+				cds_set_ch_params(csa_params->channel,
+						eCSR_DOT11_MODE_11n,
+						&ch_params);
+				lim_ch_switch->ch_center_freq_seg0 =
+					ch_params.center_freq_seg0;
+				lim_ch_switch->sec_ch_offset =
+					ch_params.sec_ch_offset;
 			}
+
 		}
 		lim_log(mac_ctx, LOG1, FL("new ch width = %d"),
 			session_entry->gLimChannelSwitch.ch_width);
@@ -2198,13 +2197,13 @@ void lim_handle_csa_offload_msg(tpAniSirGlobal mac_ctx, tpSirMsgQ msg)
 		cdf_mem_set(csa_offload_ind, sizeof(tSmeCsaOffloadInd), 0);
 		csa_offload_ind->mesgType = eWNI_SME_CSA_OFFLOAD_EVENT;
 		csa_offload_ind->mesgLen = sizeof(tSmeCsaOffloadInd);
-		cdf_mem_copy(csa_offload_ind->bssId, session_entry->bssId,
-			sizeof(tSirMacAddr));
+		cdf_mem_copy(csa_offload_ind->bssid.bytes, session_entry->bssId,
+				CDF_MAC_ADDR_SIZE);
 		mmh_msg.type = eWNI_SME_CSA_OFFLOAD_EVENT;
 		mmh_msg.bodyptr = csa_offload_ind;
 		mmh_msg.bodyval = 0;
 		lim_log(mac_ctx, LOG1,
-			FL("Sending eWNI_SME_CSA_OFFLOAD_EVENT to SME. "));
+			FL("Sending eWNI_SME_CSA_OFFLOAD_EVENT to SME."));
 		MTRACE(mac_trace_msg_tx
 			(mac_ctx, session_entry->peSessionId, mmh_msg.type));
 #ifdef FEATURE_WLAN_DIAG_SUPPORT
@@ -2291,8 +2290,8 @@ void lim_send_sme_max_assoc_exceeded_ntf(tpAniSirGlobal pMac, tSirMacAddr peerMa
 		return;
 	}
 	cdf_mem_set((void *)pSmeMaxAssocInd, sizeof(tSmeMaxAssocInd), 0);
-	cdf_mem_copy((uint8_t *) pSmeMaxAssocInd->peerMac,
-		     (uint8_t *) peerMacAddr, sizeof(tSirMacAddr));
+	cdf_mem_copy((uint8_t *) pSmeMaxAssocInd->peer_mac.bytes,
+		     (uint8_t *) peerMacAddr, CDF_MAC_ADDR_SIZE);
 	pSmeMaxAssocInd->mesgType = eWNI_SME_MAX_ASSOC_EXCEEDED;
 	pSmeMaxAssocInd->mesgLen = sizeof(tSmeMaxAssocInd);
 	pSmeMaxAssocInd->sessionId = smesessionId;
diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.h b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.h
index 260b128e9b47..e4ec6ea2a793 100644
--- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.h
+++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.h
@@ -67,7 +67,7 @@ void lim_send_sme_deauth_ind(tpAniSirGlobal, tpDphHashNode,
 			     tpPESession psessionEntry);
 void lim_send_sme_wm_status_change_ntf(tpAniSirGlobal, tSirSmeStatusChangeCode,
 				       uint32_t *, uint16_t, uint8_t);
-void lim_send_sme_set_context_rsp(tpAniSirGlobal, tSirMacAddr, uint16_t,
+void lim_send_sme_set_context_rsp(tpAniSirGlobal, struct cdf_mac_addr, uint16_t,
 				  tSirResultCodes, tpPESession, uint8_t, uint16_t);
 void lim_send_sme_neighbor_bss_ind(tpAniSirGlobal, tLimScanResultNode *);
 void lim_handle_delete_bss_rsp(tpAniSirGlobal pMac, tpSirMsgQ MsgQ);
diff --git a/core/mac/src/pe/lim/lim_session.c b/core/mac/src/pe/lim/lim_session.c
index d6914543e697..2c245e94de8d 100644
--- a/core/mac/src/pe/lim/lim_session.c
+++ b/core/mac/src/pe/lim/lim_session.c
@@ -384,6 +384,15 @@ pe_create_session(tpAniSirGlobal pMac, uint8_t *bssid, uint8_t *sessionId,
 			CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
 				FL("cannot create or start protectionFieldsResetTimer\n"));
 	}
+
+	session_ptr->pmfComebackTimerInfo.pMac = pMac;
+	session_ptr->pmfComebackTimerInfo.sessionID = *sessionId;
+	status = cdf_mc_timer_init(&session_ptr->pmfComebackTimer,
+			CDF_TIMER_TYPE_SW, lim_pmf_comeback_timer_callback,
+			(void *)&session_ptr->pmfComebackTimerInfo);
+	if (!CDF_IS_STATUS_SUCCESS(status))
+		lim_log(pMac, LOGE, FL("cannot init pmf comeback timer."));
+
 	return &pMac->lim.gpSession[i];
 }
 
@@ -527,6 +536,12 @@ void pe_delete_session(tpAniSirGlobal mac_ctx, tpPESession session)
 	uint16_t n;
 	TX_TIMER *timer_ptr;
 
+	if (!session || (session && !session->valid)) {
+		CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_DEBUG,
+			  FL("session is not valid"));
+		return;
+	}
+
 	CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_DEBUG,
 		FL("Trying to delete PE session %d Opmode %d BssIdx %d BSSID: "MAC_ADDRESS_STR),
 		session->peSessionId, session->operMode,
@@ -586,16 +601,19 @@ void pe_delete_session(tpAniSirGlobal mac_ctx, tpPESession session)
 	if (session->beacon != NULL) {
 		cdf_mem_free(session->beacon);
 		session->beacon = NULL;
+		session->bcnLen = 0;
 	}
 
 	if (session->assocReq != NULL) {
 		cdf_mem_free(session->assocReq);
 		session->assocReq = NULL;
+		session->assocReqLen = 0;
 	}
 
 	if (session->assocRsp != NULL) {
 		cdf_mem_free(session->assocRsp);
 		session->assocRsp = NULL;
+		session->assocRspLen = 0;
 	}
 
 	if (session->parsedAssocReq != NULL) {
@@ -665,9 +683,10 @@ void pe_delete_session(tpAniSirGlobal mac_ctx, tpPESession session)
 		session->addIeParams.probeRespBCNDataLen = 0;
 	}
 #ifdef WLAN_FEATURE_11W
-	/* if PMF connection */
-	if (session->limRmfEnabled)
-		cdf_mc_timer_destroy(&session->pmfComebackTimer);
+	if (CDF_TIMER_STATE_RUNNING ==
+	    cdf_mc_timer_get_current_state(&session->pmfComebackTimer))
+		cdf_mc_timer_stop(&session->pmfComebackTimer);
+	cdf_mc_timer_destroy(&session->pmfComebackTimer);
 #endif
 	session->valid = false;
 
diff --git a/core/mac/src/pe/lim/lim_sme_req_utils.c b/core/mac/src/pe/lim/lim_sme_req_utils.c
index f0f660fdfd11..9f3825150ee5 100644
--- a/core/mac/src/pe/lim/lim_sme_req_utils.c
+++ b/core/mac/src/pe/lim/lim_sme_req_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -388,7 +388,8 @@ lim_is_sme_start_bss_req_valid(tpAniSirGlobal mac_ctx,
 	tSirMacRateSet *opr_rates = &start_bss_req->operationalRateSet;
 
 	PELOG1(lim_log(mac_ctx, LOG1,
-	       FL("Parsed START_BSS_REQ fields are bssType=%d, channelId=%d, SSID len=%d, rsnIE len=%d, nwType=%d, rateset len=%d"),
+	       FL("Parsed START_BSS_REQ fields are bssType=%s (%d), channelId=%d, SSID len=%d, rsnIE len=%d, nwType=%d, rateset len=%d"),
+	       lim_bss_type_to_string(start_bss_req->bssType),
 	       start_bss_req->bssType, start_bss_req->channelId,
 	       start_bss_req->ssId.length, start_bss_req->rsnIE.length,
 	       start_bss_req->nwType, opr_rates->numRates);)
@@ -584,8 +585,8 @@ lim_is_sme_disassoc_req_valid(tpAniSirGlobal pMac,
 			      tpSirSmeDisassocReq pDisassocReq,
 			      tpPESession psessionEntry)
 {
-	if (lim_is_group_addr(pDisassocReq->peerMacAddr) &&
-	    !lim_is_addr_bc(pDisassocReq->peerMacAddr))
+	if (cdf_is_macaddr_group(&pDisassocReq->peer_macaddr) &&
+	    !cdf_is_macaddr_broadcast(&pDisassocReq->peer_macaddr))
 		return false;
 
 	return true;
@@ -617,7 +618,7 @@ lim_is_sme_disassoc_cnf_valid(tpAniSirGlobal pMac,
 			      tpSirSmeDisassocCnf pDisassocCnf,
 			      tpPESession psessionEntry)
 {
-	if (lim_is_group_addr(pDisassocCnf->peerMacAddr))
+	if (cdf_is_macaddr_group(&pDisassocCnf->peer_macaddr))
 		return false;
 
 	return true;
@@ -647,8 +648,8 @@ uint8_t
 lim_is_sme_deauth_req_valid(tpAniSirGlobal pMac, tpSirSmeDeauthReq pDeauthReq,
 			    tpPESession psessionEntry)
 {
-	if (lim_is_group_addr(pDeauthReq->peerMacAddr) &&
-	    !lim_is_addr_bc(pDeauthReq->peerMacAddr))
+	if (cdf_is_macaddr_group(&pDeauthReq->peer_macaddr) &&
+	    !cdf_is_macaddr_broadcast(&pDeauthReq->peer_macaddr))
 		return false;
 
 	return true;
diff --git a/core/mac/src/pe/lim/lim_timer_utils.c b/core/mac/src/pe/lim/lim_timer_utils.c
index f68f7b08bbf6..26838581309b 100644
--- a/core/mac/src/pe/lim/lim_timer_utils.c
+++ b/core/mac/src/pe/lim/lim_timer_utils.c
@@ -60,7 +60,7 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 {
 	uint32_t cfgValue;
 	/* Create Channel Switch Timer */
-	if (tx_timer_create(&pMac->lim.limTimers.gLimChannelSwitchTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimChannelSwitchTimer,
 			    "CHANNEL SWITCH TIMER",
 			    lim_channel_switch_timer_handler, 0,
 			    LIM_CHANNEL_SWITCH_TIMER_TICKS,
@@ -72,7 +72,7 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 	 * This is used on the STA to go and shut-off Tx/Rx "after" the
 	 * specified quiteInterval
 	 */
-	if (tx_timer_create(&pMac->lim.limTimers.gLimQuietTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimQuietTimer,
 			    "QUIET TIMER", lim_quiet_timer_handler,
 			    SIR_LIM_QUIET_TIMEOUT, LIM_QUIET_TIMER_TICKS,
 			    0, TX_NO_ACTIVATE) != TX_SUCCESS) {
@@ -84,7 +84,7 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 	 * timer, gLimQuietBssTimer, trigger and put the STA to sleep for the
 	 * specified gLimQuietDuration
 	 */
-	if (tx_timer_create(&pMac->lim.limTimers.gLimQuietBssTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimQuietBssTimer,
 			    "QUIET BSS TIMER", lim_quiet_bss_timer_handler,
 			    SIR_LIM_QUIET_BSS_TIMEOUT, LIM_QUIET_BSS_TIMER_TICK,
 			    0, TX_NO_ACTIVATE) != TX_SUCCESS) {
@@ -98,7 +98,7 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 			FL("could not retrieve JoinFailureTimeout value"));
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
 	/* Create Join failure timer and activate it later */
-	if (tx_timer_create(&pMac->lim.limTimers.gLimJoinFailureTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimJoinFailureTimer,
 			    "JOIN FAILURE TIMEOUT",
 			    lim_timer_handler, SIR_LIM_JOIN_FAIL_TIMEOUT,
 			    cfgValue, 0,
@@ -110,7 +110,8 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 		return false;
 	}
 	/* Send unicast probe req frame every 200 ms */
-	if (tx_timer_create(&pMac->lim.limTimers.gLimPeriodicJoinProbeReqTimer,
+	if (tx_timer_create(pMac,
+			    &pMac->lim.limTimers.gLimPeriodicJoinProbeReqTimer,
 			    "Periodic Join Probe Request Timer",
 			    lim_timer_handler,
 			    SIR_LIM_PERIODIC_JOIN_PROBE_REQ_TIMEOUT,
@@ -128,7 +129,7 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
 	/* Create Association failure timer and activate it later */
-	if (tx_timer_create(&pMac->lim.limTimers.gLimAssocFailureTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimAssocFailureTimer,
 			    "ASSOC FAILURE TIMEOUT",
 			    lim_assoc_failure_timer_handler, LIM_ASSOC,
 			    cfgValue, 0, TX_NO_ACTIVATE) != TX_SUCCESS) {
@@ -143,8 +144,7 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
 	/* Create Association failure timer and activate it later */
-	if (tx_timer_create
-		    (&pMac->lim.limTimers.gLimReassocFailureTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimReassocFailureTimer,
 		    "REASSOC FAILURE TIMEOUT", lim_assoc_failure_timer_handler,
 		    LIM_REASSOC, cfgValue, 0, TX_NO_ACTIVATE) != TX_SUCCESS) {
 		lim_log(pMac, LOGP,
@@ -160,7 +160,7 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
 
 	/* Create Addts response timer and activate it later */
-	if (tx_timer_create(&pMac->lim.limTimers.gLimAddtsRspTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimAddtsRspTimer,
 			    "ADDTS RSP TIMEOUT",
 			    lim_addts_response_timer_handler,
 			    SIR_LIM_ADDTS_RSP_TIMEOUT,
@@ -177,7 +177,7 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
 	/* Create Auth failure timer and activate it later */
-	if (tx_timer_create(&pMac->lim.limTimers.gLimAuthFailureTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimAuthFailureTimer,
 			    "AUTH FAILURE TIMEOUT",
 			    lim_timer_handler,
 			    SIR_LIM_AUTH_FAIL_TIMEOUT,
@@ -193,7 +193,7 @@ lim_create_non_ap_timers(tpAniSirGlobal pMac)
 
 	/* Change timer to reactivate it in future */
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
-	if (tx_timer_create(&pMac->lim.limTimers.gLimProbeAfterHBTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimProbeAfterHBTimer,
 			    "Probe after Heartbeat TIMEOUT",
 			    lim_timer_handler,
 			    SIR_LIM_PROBE_HB_FAILURE_TIMEOUT,
@@ -238,10 +238,11 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 	cfgValue1 = cfgValue / 2;
 	/* Create periodic probe request timer and activate them later */
 	if (cfgValue1 >= 1
-	    && (tx_timer_create(&pMac->lim.limTimers.gLimPeriodicProbeReqTimer,
-		"Periodic Probe Request Timer", lim_timer_handler,
-		SIR_LIM_PERIODIC_PROBE_REQ_TIMEOUT, cfgValue1, 0,
-		TX_NO_ACTIVATE) != TX_SUCCESS)) {
+	    && (tx_timer_create(pMac,
+			&pMac->lim.limTimers.gLimPeriodicProbeReqTimer,
+			"Periodic Probe Request Timer", lim_timer_handler,
+			SIR_LIM_PERIODIC_PROBE_REQ_TIMEOUT, cfgValue1, 0,
+			TX_NO_ACTIVATE) != TX_SUCCESS)) {
 		lim_log(pMac, LOGP,
 			FL("could not create periodic probe timer"));
 		goto err_timer;
@@ -262,7 +263,7 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 
 	cfgValue = SYS_MS_TO_TICKS(LIM_HASH_MISS_TIMER_MS);
 
-	if (tx_timer_create(
+	if (tx_timer_create(pMac,
 		&pMac->lim.limTimers.gLimSendDisassocFrameThresholdTimer,
 		"Disassoc throttle TIMEOUT",
 		lim_send_disassoc_frame_threshold_handler,
@@ -282,7 +283,8 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
 	for (i = 0; i < (pMac->lim.maxStation + 1); i++) {
-		if (tx_timer_create(&pMac->lim.limTimers.gpLimCnfWaitTimer[i],
+		if (tx_timer_create(pMac,
+				    &pMac->lim.limTimers.gpLimCnfWaitTimer[i],
 				    "CNF_MISS_TIMEOUT",
 				    lim_cnf_wait_tmer_handler,
 				    (uint32_t) i, cfgValue,
@@ -315,7 +317,7 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 			FL("could not retrieve OLBD detect timeout value"));
 
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
-	if (tx_timer_create(&pMac->lim.limTimers.gLimUpdateOlbcCacheTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimUpdateOlbcCacheTimer,
 			    "OLBC UPDATE CACHE TIMEOUT",
 			    lim_update_olbc_cache_timer_handler,
 			    SIR_LIM_UPDATE_OLBC_CACHEL_TIMEOUT, cfgValue,
@@ -330,7 +332,7 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 	 */
 	cfgValue = 1000;
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
-	if (tx_timer_create(&pMac->lim.limTimers.gLimFTPreAuthRspTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimFTPreAuthRspTimer,
 			    "FT PREAUTH RSP TIMEOUT",
 			    lim_timer_handler, SIR_LIM_FT_PREAUTH_RSP_TIMEOUT,
 			    cfgValue, 0, TX_NO_ACTIVATE) != TX_SUCCESS) {
@@ -340,7 +342,7 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 #endif
 	cfgValue = 1000;
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
-	if (tx_timer_create(&pMac->lim.limTimers.gLimRemainOnChannelTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimRemainOnChannelTimer,
 			    "FT PREAUTH RSP TIMEOUT",
 			    lim_timer_handler, SIR_LIM_REMAIN_CHN_TIMEOUT,
 			    cfgValue, 0, TX_NO_ACTIVATE) != TX_SUCCESS) {
@@ -350,7 +352,7 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 
 	cfgValue = 1000;
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
-	if (tx_timer_create(&pMac->lim.limTimers.gLimDisassocAckTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimDisassocAckTimer,
 			    "DISASSOC ACK TIMEOUT",
 			    lim_timer_handler, SIR_LIM_DISASSOC_ACK_TIMEOUT,
 			    cfgValue, 0, TX_NO_ACTIVATE) != TX_SUCCESS) {
@@ -360,7 +362,7 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 
 	cfgValue = 1000;
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
-	if (tx_timer_create(&pMac->lim.limTimers.gLimDeauthAckTimer,
+	if (tx_timer_create(pMac, &pMac->lim.limTimers.gLimDeauthAckTimer,
 			    "DISASSOC ACK TIMEOUT",
 			    lim_timer_handler, SIR_LIM_DEAUTH_ACK_TIMEOUT,
 			    cfgValue, 0, TX_NO_ACTIVATE) != TX_SUCCESS) {
@@ -375,7 +377,7 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 	 */
 	cfgValue = LIM_INSERT_SINGLESHOTNOA_TIMEOUT_VALUE;
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
-	if (tx_timer_create(
+	if (tx_timer_create(pMac,
 		&pMac->lim.limTimers.gLimP2pSingleShotNoaInsertTimer,
 		"Single Shot NOA Insert timeout", lim_timer_handler,
 		SIR_LIM_INSERT_SINGLESHOT_NOA_TIMEOUT, cfgValue, 0,
@@ -387,7 +389,7 @@ uint32_t lim_create_timers(tpAniSirGlobal pMac)
 
 	cfgValue = ACTIVE_TO_PASSIVE_CONVERISON_TIMEOUT;
 	cfgValue = SYS_MS_TO_TICKS(cfgValue);
-	if (tx_timer_create(
+	if (tx_timer_create(pMac,
 		&pMac->lim.limTimers.gLimActiveToPassiveChannelTimer,
 		"ACTIVE TO PASSIVE CHANNEL", lim_timer_handler,
 		SIR_LIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE, cfgValue, 0,
diff --git a/core/mac/src/pe/lim/lim_timer_utils.h b/core/mac/src/pe/lim/lim_timer_utils.h
index b133d712f9e0..33b94d5505ee 100644
--- a/core/mac/src/pe/lim/lim_timer_utils.h
+++ b/core/mac/src/pe/lim/lim_timer_utils.h
@@ -65,9 +65,6 @@ enum {
 #endif
 	eLIM_REMAIN_CHN_TIMER,
 	eLIM_PERIODIC_PROBE_REQ_TIMER,
-#ifdef FEATURE_WLAN_ESE
-	eLIM_TSM_TIMER,
-#endif
 	eLIM_DISASSOC_ACK_TIMER,
 	eLIM_DEAUTH_ACK_TIMER,
 	eLIM_PERIODIC_JOIN_PROBE_REQ_TIMER,
diff --git a/core/mac/src/pe/lim/lim_trace.c b/core/mac/src/pe/lim/lim_trace.c
index d82e022021c2..35f23a80ae1a 100644
--- a/core/mac/src/pe/lim/lim_trace.c
+++ b/core/mac/src/pe/lim/lim_trace.c
@@ -76,9 +76,6 @@ static uint8_t *__lim_trace_get_timer_string(uint16_t timerId)
 #endif
 		CASE_RETURN_STRING(eLIM_REMAIN_CHN_TIMER);
 		CASE_RETURN_STRING(eLIM_PERIODIC_PROBE_REQ_TIMER);
-#ifdef FEATURE_WLAN_ESE
-		CASE_RETURN_STRING(eLIM_TSM_TIMER);
-#endif
 		CASE_RETURN_STRING(eLIM_DISASSOC_ACK_TIMER);
 		CASE_RETURN_STRING(eLIM_DEAUTH_ACK_TIMER);
 		CASE_RETURN_STRING(eLIM_PERIODIC_JOIN_PROBE_REQ_TIMER);
diff --git a/core/mac/src/pe/lim/lim_types.h b/core/mac/src/pe/lim/lim_types.h
index e03973065135..514b70cdee9a 100644
--- a/core/mac/src/pe/lim/lim_types.h
+++ b/core/mac/src/pe/lim/lim_types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -309,7 +309,7 @@ typedef struct sLimMlmAuthCnf {
 } tLimMlmAuthCnf, *tpLimMlmAuthCnf;
 
 typedef struct sLimMlmDeauthReq {
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 	uint16_t reasonCode;
 	uint16_t deauthTrigger;
 	uint16_t aid;
@@ -318,7 +318,7 @@ typedef struct sLimMlmDeauthReq {
 } tLimMlmDeauthReq, *tpLimMlmDeauthReq;
 
 typedef struct sLimMlmDeauthCnf {
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 	tSirResultCodes resultCode;
 	uint16_t deauthTrigger;
 	uint16_t aid;
@@ -333,7 +333,7 @@ typedef struct sLimMlmDeauthInd {
 } tLimMlmDeauthInd, *tpLimMlmDeauthInd;
 
 typedef struct sLimMlmDisassocReq {
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 	uint16_t reasonCode;
 	uint16_t disassocTrigger;
 	uint16_t aid;
@@ -371,7 +371,7 @@ typedef struct sLimMlmPurgeStaInd {
 } tLimMlmPurgeStaInd, *tpLimMlmPurgeStaInd;
 
 typedef struct sLimMlmSetKeysCnf {
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 	uint16_t resultCode;
 	uint16_t aid;
 	uint8_t sessionId;
@@ -423,9 +423,6 @@ void lim_init_mlm(tpAniSirGlobal);
 /* Function to cleanup MLM state machine */
 void lim_cleanup_mlm(tpAniSirGlobal);
 
-/* Function to cleanup LMM state machine */
-void lim_cleanup_lmm(tpAniSirGlobal);
-
 /* Management frame handling functions */
 void lim_process_beacon_frame(tpAniSirGlobal, uint8_t *, tpPESession);
 void lim_process_beacon_frame_no_session(tpAniSirGlobal, uint8_t *);
@@ -500,17 +497,9 @@ tSirRetStatus lim_send_extended_chan_switch_action_frame(tpAniSirGlobal mac_ctx,
 	tSirMacAddr peer, uint8_t mode, uint8_t new_op_class,
 	uint8_t new_channel, uint8_t count, tpPESession session_entry);
 
-#ifdef WLAN_FEATURE_11AC
 tSirRetStatus lim_send_vht_opmode_notification_frame(tpAniSirGlobal pMac,
 						     tSirMacAddr peer, uint8_t nMode,
 						     tpPESession psessionEntry);
-tSirRetStatus lim_send_vht_channel_switch_mgmt_frame(tpAniSirGlobal pMac,
-						     tSirMacAddr peer,
-						     uint8_t nChanWidth,
-						     uint8_t nNewChannel,
-						     uint8_t ncbMode,
-						     tpPESession psessionEntry);
-#endif
 
 #if defined WLAN_FEATURE_VOWIFI
 tSirRetStatus lim_send_neighbor_report_request_frame(tpAniSirGlobal,
@@ -542,11 +531,6 @@ void lim_send_sme_mgmt_tx_completion(tpAniSirGlobal pMac, tpPESession psessionEn
 tSirRetStatus lim_delete_tdls_peers(tpAniSirGlobal mac_ctx,
 				    tpPESession session_entry);
 CDF_STATUS lim_process_tdls_add_sta_rsp(tpAniSirGlobal pMac, void *msg, tpPESession);
-tSirRetStatus lim_send_tdls_teardown_frame(tpAniSirGlobal pMac,
-					   tSirMacAddr peerMac, uint16_t reason,
-					   uint8_t responder,
-					   tpPESession psessionEntry,
-					   uint8_t *addIe, uint16_t addIeLen);
 #else
 static inline tSirRetStatus lim_delete_tdls_peers(tpAniSirGlobal mac_ctx,
 						tpPESession session_entry)
@@ -574,7 +558,7 @@ uint32_t lim_defer_msg(tpAniSirGlobal, tSirMsgQ *);
 /* / Function that Switches the Channel and sets the CB Mode */
 void lim_set_channel(tpAniSirGlobal pMac, uint8_t channel,
 		uint8_t ch_center_freq_seg0, uint8_t ch_center_freq_seg1,
-		phy_ch_width ch_width, tPowerdBm maxTxPower,
+		phy_ch_width ch_width, int8_t maxTxPower,
 		uint8_t peSessionId);
 
 
@@ -815,12 +799,14 @@ void
 lim_send_vdev_restart(tpAniSirGlobal pMac, tpPESession psessionEntry,
 		      uint8_t sessionId);
 
-void lim_get_wpspbc_sessions(tpAniSirGlobal pMac, uint8_t *addr, uint8_t *uuid_e,
-			     eWPSPBCOverlap *overlap, tpPESession psessionEntry);
+void lim_get_wpspbc_sessions(tpAniSirGlobal pMac, struct cdf_mac_addr addr,
+			uint8_t *uuid_e, eWPSPBCOverlap *overlap,
+			tpPESession psessionEntry);
 void limWPSPBCTimeout(tpAniSirGlobal pMac, tpPESession psessionEntry);
 void lim_wpspbc_close(tpAniSirGlobal pMac, tpPESession psessionEntry);
-void lim_remove_pbc_sessions(tpAniSirGlobal pMac, tSirMacAddr pRemoveMac,
-			     tpPESession psessionEntry);
+void lim_remove_pbc_sessions(tpAniSirGlobal pMac,
+				struct cdf_mac_addr pRemoveMac,
+				tpPESession psessionEntry);
 
 #define LIM_WPS_OVERLAP_TIMER_MS                 10000
 void
diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c
index 28f4a84b0e55..98cb55117ff7 100644
--- a/core/mac/src/pe/lim/lim_utils.c
+++ b/core/mac/src/pe/lim/lim_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -64,10 +64,6 @@
 #endif
 #define ASCII_SPACE_CHARACTER 0x20
 
-#define SUCCESS 1
-
-#define MAX_BA_WINDOW_SIZE_FOR_CISCO 25
-
 /** -------------------------------------------------------------
    \fn lim_delete_dialogue_token_list
    \brief deletes the complete lim dialogue token linked list.
@@ -738,7 +734,7 @@ void lim_cleanup_mlm(tpAniSirGlobal mac_ctx)
 	 * each STA associated per BSSId and deactivate/delete
 	 * the pmfSaQueryTimer for it
 	 */
-	if (cds_is_logp_in_progress()) {
+	if (cds_is_driver_recovering()) {
 		CDF_TRACE(CDF_MODULE_ID_PE, CDF_TRACE_LEVEL_ERROR,
 				FL("SSR is detected, proceed to clean up pmfSaQueryTimer"));
 		for (bss_entry = 0; bss_entry < mac_ctx->lim.maxBssId;
@@ -754,31 +750,6 @@ void lim_cleanup_mlm(tpAniSirGlobal mac_ctx)
 } /*** end lim_cleanup_mlm() ***/
 
 /**
- * lim_cleanup_lmm()
- *
- ***FUNCTION:
- * This function is called to cleanup any resources
- * allocated by LMM sub-module.
- *
- ***PARAMS:
- *
- ***LOGIC:
- *
- ***ASSUMPTIONS:
- * NA
- *
- ***NOTE:
- * NA
- *
- * @param  pMac      Pointer to Global MAC structure
- * @return None
- */
-
-void lim_cleanup_lmm(tpAniSirGlobal pMac)
-{
-} /*** end lim_cleanup_lmm() ***/
-
-/**
  * lim_is_addr_bc()
  *
  ***FUNCTION:
@@ -2712,8 +2683,8 @@ void lim_switch_channel_cback(tpAniSirGlobal pMac, CDF_STATUS status,
 	pSirSmeSwitchChInd->newChannelId =
 		psessionEntry->gLimChannelSwitch.primaryChannel;
 	pSirSmeSwitchChInd->sessionId = psessionEntry->smeSessionId;
-	cdf_mem_copy(pSirSmeSwitchChInd->bssId, psessionEntry->bssId,
-		     sizeof(tSirMacAddr));
+	cdf_mem_copy(pSirSmeSwitchChInd->bssid.bytes, psessionEntry->bssId,
+		     CDF_MAC_ADDR_SIZE);
 	mmhMsg.bodyptr = pSirSmeSwitchChInd;
 	mmhMsg.bodyval = 0;
 
@@ -2767,7 +2738,7 @@ void lim_switch_primary_channel(tpAniSirGlobal pMac, uint8_t newChannel,
 		return;
 	}
 	lim_send_switch_chnl_params(pMac, newChannel, 0, 0, CH_WIDTH_20MHZ,
-				    (tPowerdBm) localPwrConstraint,
+				    localPwrConstraint,
 				    psessionEntry->peSessionId, false);
 #endif
 	return;
@@ -2839,11 +2810,13 @@ void lim_switch_primary_secondary_channel(tpAniSirGlobal pMac,
 			psessionEntry->currentOperChannel, newChannel);
 		psessionEntry->currentOperChannel = newChannel;
 	}
-	if (psessionEntry->htSecondaryChannelOffset != subband) {
+	if (psessionEntry->htSecondaryChannelOffset !=
+			psessionEntry->gLimChannelSwitch.sec_ch_offset) {
 		lim_log(pMac, LOGW,
 			FL("switch old sec chnl %d --> new sec chnl %d "),
 			psessionEntry->htSecondaryChannelOffset, subband);
-		psessionEntry->htSecondaryChannelOffset = subband;
+		psessionEntry->htSecondaryChannelOffset =
+			psessionEntry->gLimChannelSwitch.sec_ch_offset;
 		if (psessionEntry->htSecondaryChannelOffset ==
 		    PHY_SINGLE_CHANNEL_CENTERED) {
 			psessionEntry->htSupportedChannelWidthSet =
@@ -4947,6 +4920,20 @@ void lim_update_sta_run_time_ht_switch_chnl_params(tpAniSirGlobal pMac,
 		return;
 	}
 
+	/*
+	 * Do not try to switch channel if RoC is in progress. RoC code path
+	 * uses pMac->lim.gpLimRemainOnChanReq to notify the upper layers that
+	 * the device has started listening on the channel requested as part of
+	 * RoC, if we set pMac->lim.gpLimRemainOnChanReq to NULL as we do below
+	 * then the upper layers will think that the channel change is not
+	 * successful and the RoC from the upper layer perspective will never
+	 * end...
+	 */
+	if (pMac->lim.gpLimRemainOnChanReq) {
+		lim_log(pMac, LOGE, FL("RoC is in progress"));
+		return;
+	}
+
 	if (psessionEntry->htSecondaryChannelOffset !=
 	    (uint8_t) pHTInfo->secondaryChannelOffset
 	    || psessionEntry->htRecommendedTxWidthSet !=
@@ -4988,7 +4975,7 @@ void lim_update_sta_run_time_ht_switch_chnl_params(tpAniSirGlobal pMac,
 		lim_send_switch_chnl_params(pMac, (uint8_t) pHTInfo->primaryChannel,
 					    center_freq, 0,
 					    psessionEntry->htRecommendedTxWidthSet,
-					    (tPowerdBm) localPwrConstraint,
+					    (int8_t)localPwrConstraint,
 					    psessionEntry->peSessionId,
 					    true);
 #endif
@@ -5224,7 +5211,7 @@ lim_validate_delts_req(tpAniSirGlobal mac_ctx, tpSirDeltsReq delts_req,
 					&psession_entry->dph.dphHashTable);
 		else
 			sta = dph_lookup_hash_entry(mac_ctx,
-						delts_req->macAddr,
+						delts_req->macaddr.bytes,
 						&associd,
 						&psession_entry->dph.
 							dphHashTable);
@@ -7173,3 +7160,40 @@ lim_get_80Mhz_center_channel(uint8_t primary_channel)
 
 	return INVALID_CHANNEL_ID;
 }
+
+/**
+ * lim_scan_type_to_string(): converts scan type enum to string.
+ * @scan_type: enum value of scan_type.
+ *
+ * Return: Printable string for scan_type
+ */
+const char *lim_scan_type_to_string(const uint8_t scan_type)
+{
+	switch (scan_type) {
+	CASE_RETURN_STRING(eSIR_PASSIVE_SCAN);
+	CASE_RETURN_STRING(eSIR_ACTIVE_SCAN);
+	CASE_RETURN_STRING(eSIR_BEACON_TABLE);
+	default:
+		return "Unknown scan_type";
+	}
+}
+
+/**
+ * lim_bss_type_to_string(): converts bss type enum to string.
+ * @bss_type: enum value of bss_type.
+ *
+ * Return: Printable string for bss_type
+ */
+const char *lim_bss_type_to_string(const uint16_t bss_type)
+{
+	switch (bss_type) {
+	CASE_RETURN_STRING(eSIR_INFRASTRUCTURE_MODE);
+	CASE_RETURN_STRING(eSIR_INFRA_AP_MODE);
+	CASE_RETURN_STRING(eSIR_IBSS_MODE);
+	CASE_RETURN_STRING(eSIR_BTAMP_STA_MODE);
+	CASE_RETURN_STRING(eSIR_BTAMP_AP_MODE);
+	CASE_RETURN_STRING(eSIR_AUTO_MODE);
+	default:
+		return "Unknown bss_type";
+	}
+}
diff --git a/core/mac/src/pe/lim/lim_utils.h b/core/mac/src/pe/lim/lim_utils.h
index 42a5eab8e451..36fc97bc1825 100644
--- a/core/mac/src/pe/lim/lim_utils.h
+++ b/core/mac/src/pe/lim/lim_utils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -95,9 +95,9 @@ void lim_print_msg_name(tpAniSirGlobal pMac, uint16_t logLevel, uint32_t msgType
 
 #if defined FEATURE_WLAN_ESE || defined WLAN_FEATURE_VOWIFI
 extern tSirRetStatus lim_send_set_max_tx_power_req(tpAniSirGlobal pMac,
-		tPowerdBm txPower,
+		int8_t txPower,
 		tpPESession pSessionEntry);
-extern uint8_t lim_get_max_tx_power(tPowerdBm regMax, tPowerdBm apTxPower,
+extern uint8_t lim_get_max_tx_power(int8_t regMax, int8_t apTxPower,
 		uint8_t iniTxPower);
 #endif
 uint8_t lim_is_addr_bc(tSirMacAddr);
@@ -294,59 +294,6 @@ is_entering_mimo_ps(tSirMacHTMIMOPowerSaveState curState,
 	return false;
 }
 
-/**
- * lim_select_cb_mode_for_sta() - return cb_mode based on current session
- * @session_entry: Session entry
- * @channel: channel
- * @chan_bw: channel bandwidth
- *
- * Given a value of channel and bandwidth this API will return the value of
- * cb_mode on basis of channel, bandwidth ht/vht capabilities
- *
- * Return: cb_mode
- *
- */
-
-static inline int lim_select_cb_mode_for_sta(tpPESession session_entry,
-				uint8_t channel, uint8_t chan_bw)
-{
-	if (session_entry->vhtCapability && chan_bw) {
-		if (channel == 36 || channel == 52 || channel == 100 ||
-				channel == 116 || channel == 149) {
-			return PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW - 1;
-		} else if (channel == 40 || channel == 56 || channel == 104 ||
-				channel == 120 || channel == 153) {
-			return PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW - 1;
-		} else if (channel == 44 || channel == 60 || channel == 108 ||
-				channel == 124 || channel == 157) {
-			return PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH - 1;
-		} else if (channel == 48 || channel == 64 || channel == 112 ||
-				channel == 128 || channel == 161) {
-			return PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH - 1;
-		} else if (channel == 165) {
-			return PHY_SINGLE_CHANNEL_CENTERED;
-		}
-	} else if (session_entry->htSupportedChannelWidthSet) {
-		if (channel == 40 || channel == 48 || channel == 56 ||
-			channel == 64 || channel == 104 || channel == 112 ||
-			channel == 120 || channel == 128 || channel == 136 ||
-			channel == 144 || channel == 153 || channel == 161) {
-			return PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
-		} else if (channel == 36 || channel == 44 || channel == 52 ||
-				channel == 60 || channel == 100 ||
-				channel == 108 || channel == 116 ||
-				channel == 124 || channel == 132 ||
-				channel == 140 || channel == 149 ||
-				channel == 157) {
-			return PHY_DOUBLE_CHANNEL_HIGH_PRIMARY;
-		} else if (channel == 165) {
-			return PHY_SINGLE_CHANNEL_CENTERED;
-		}
-	}
-	return PHY_SINGLE_CHANNEL_CENTERED;
-}
-
-
 static inline int lim_select_cb_mode(tDphHashNode *pStaDs,
 		tpPESession psessionEntry, uint8_t channel,
 		uint8_t chan_bw)
diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c
index 38f748a0d478..b4f499bc0edf 100644
--- a/core/mac/src/pe/rrm/rrm_api.c
+++ b/core/mac/src/pe/rrm/rrm_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -55,7 +55,7 @@
 
 uint8_t
 rrm_get_min_of_max_tx_power(tpAniSirGlobal pMac,
-			    tPowerdBm regMax, tPowerdBm apTxPower)
+			    int8_t regMax, int8_t apTxPower)
 {
 	uint8_t maxTxPower = 0;
 	uint8_t txPower = CDF_MIN(regMax, (apTxPower));
@@ -88,7 +88,7 @@ rrm_get_min_of_max_tx_power(tpAniSirGlobal pMac,
  * @return None
  */
 void
-rrm_cache_mgmt_tx_power(tpAniSirGlobal pMac, tPowerdBm txPower,
+rrm_cache_mgmt_tx_power(tpAniSirGlobal pMac, int8_t txPower,
 			tpPESession pSessionEntry)
 {
 	lim_log(pMac, LOG3, "Cache Mgmt Tx Power = %d", txPower);
@@ -115,7 +115,7 @@ rrm_cache_mgmt_tx_power(tpAniSirGlobal pMac, tPowerdBm txPower,
  * @param pSessionEntry session entry.
  * @return txPower
  */
-tPowerdBm rrm_get_mgmt_tx_power(tpAniSirGlobal pMac, tpPESession pSessionEntry)
+int8_t rrm_get_mgmt_tx_power(tpAniSirGlobal pMac, tpPESession pSessionEntry)
 {
 	lim_log(pMac, LOG3, "RrmGetMgmtTxPower called");
 
@@ -145,7 +145,7 @@ tPowerdBm rrm_get_mgmt_tx_power(tpAniSirGlobal pMac, tpPESession pSessionEntry)
  * @return None
  */
 tSirRetStatus
-rrm_send_set_max_tx_power_req(tpAniSirGlobal pMac, tPowerdBm txPower,
+rrm_send_set_max_tx_power_req(tpAniSirGlobal pMac, int8_t txPower,
 			      tpPESession pSessionEntry)
 {
 	tpMaxTxPowerParams pMaxTxParams;
@@ -288,8 +288,7 @@ rrm_process_link_measurement_request(tpAniSirGlobal pMac,
 
 	if ((LinkReport.txPower != (uint8_t) (pSessionEntry->maxTxPower)) &&
 	    (eSIR_SUCCESS == rrm_send_set_max_tx_power_req(pMac,
-							   (tPowerdBm) (LinkReport.
-									txPower),
+							   LinkReport.txPower,
 							   pSessionEntry))) {
 		PELOGW(lim_log
 			       (pMac, LOGW,
@@ -299,14 +298,14 @@ rrm_process_link_measurement_request(tpAniSirGlobal pMac,
 			       pSessionEntry->maxTxPower, LinkReport.txPower,
 			       pLinkReq->MaxTxPower.maxTxPower);
 		       )
-		pSessionEntry->maxTxPower =
-			(tPowerdBm) (LinkReport.txPower);
+			pSessionEntry->maxTxPower =
+			LinkReport.txPower;
 	}
 
 	LinkReport.dialogToken = pLinkReq->DialogToken.token;
 	LinkReport.rxAntenna = 0;
 	LinkReport.txAntenna = 0;
-	currentRSSI = WMA_GET_RX_RSSI_DB(pRxPacketInfo);
+	currentRSSI = WMA_GET_RX_RSSI_RAW(pRxPacketInfo);
 
 	lim_log(pMac, LOG1, "Received Link report frame with %d", currentRSSI);
 
diff --git a/core/mac/src/pe/sch/sch_beacon_process.c b/core/mac/src/pe/sch/sch_beacon_process.c
index 059a58712a36..ca769bfc5764 100644
--- a/core/mac/src/pe/sch/sch_beacon_process.c
+++ b/core/mac/src/pe/sch/sch_beacon_process.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -716,7 +716,7 @@ static void __sch_beacon_process_for_session(tpAniSirGlobal mac_ctx,
 					     uint8_t *rx_pkt_info,
 					     tpPESession session)
 {
-	tPowerdBm localRRMConstraint = 0;
+	int8_t localRRMConstraint = 0;
 	uint8_t bssIdx = 0;
 	tUpdateBeaconParams beaconParams;
 	uint8_t sendProbeReq = false;
@@ -724,7 +724,7 @@ static void __sch_beacon_process_for_session(tpAniSirGlobal mac_ctx,
 	tpSirMacMgmtHdr pMh = WMA_GET_RX_MAC_HEADER(rx_pkt_info);
 #endif
 #if defined FEATURE_WLAN_ESE || defined WLAN_FEATURE_VOWIFI
-	tPowerdBm regMax = 0, maxTxPower = 0;
+	int8_t regMax = 0, maxTxPower = 0;
 #endif
 	cdf_mem_zero(&beaconParams, sizeof(tUpdateBeaconParams));
 	beaconParams.paramChangeBitmap = 0;
@@ -792,7 +792,7 @@ static void __sch_beacon_process_for_session(tpAniSirGlobal mac_ctx,
 
 #if defined FEATURE_WLAN_ESE
 	if (session->isESEconnection) {
-		tPowerdBm localESEConstraint = 0;
+		int8_t localESEConstraint = 0;
 		if (bcn->eseTxPwr.present) {
 			localESEConstraint = bcn->eseTxPwr.power_limit;
 			maxTxPower = lim_get_max_tx_power(maxTxPower,
@@ -848,11 +848,10 @@ static void __sch_beacon_process_for_session(tpAniSirGlobal mac_ctx,
 
 /**
  * sch_beacon_process() - process the beacon frame
- *
  * @mac_ctx:        mac global context
  * @rx_pkt_info:  pointer to buffer descriptor
  *
- * @return None
+ * Return: None
  */
 void
 sch_beacon_process(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
@@ -861,9 +860,7 @@ sch_beacon_process(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 	static tSchBeaconStruct bcn;
 	tUpdateBeaconParams bcn_prm;
 	tpPESession ap_session = NULL;
-#ifdef WLAN_FEATURE_MBSSID
 	uint8_t i;
-#endif
 
 	cdf_mem_zero(&bcn_prm, sizeof(tUpdateBeaconParams));
 	bcn_prm.paramChangeBitmap = 0;
@@ -889,7 +886,6 @@ sch_beacon_process(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 	 * on another concurrent link. In this case also, we want to apply the
 	 * protection settings(as advertised by Infra AP) to BTAP beacons
 	 */
-#ifdef WLAN_FEATURE_MBSSID
 	for (i = 0; i < mac_ctx->lim.maxBssId; i++) {
 		ap_session = pe_find_session_by_session_id(mac_ctx, i);
 		if (!((ap_session != NULL) &&
@@ -918,30 +914,7 @@ sch_beacon_process(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 			lim_send_beacon_params(mac_ctx, &bcn_prm, ap_session);
 		}
 	}
-#else
-	ap_session = lim_is_ap_session_active(mac_ctx);
-	if ((ap_session != NULL)
-	    && (!(WMA_GET_OFFLOADSCANLEARN(rx_pkt_info)))) {
-		bcn_prm.bssIdx = ap_session->bssIdx;
-		if (ap_session->gLimProtectionControl !=
-		    WNI_CFG_FORCE_POLICY_PROTECTION_DISABLE)
-			ap_beacon_process(mac_ctx, rx_pkt_info, &bcn,
-					  &bcn_prm, ap_session);
 
-		if ((false == mac_ctx->sap.SapDfsInfo.is_dfs_cac_timer_running)
-		    && bcn_prm.paramChangeBitmap) {
-			/* Update the bcn and apply the new settings to HAL */
-			sch_set_fixed_beacon_fields(mac_ctx, ap_session);
-			PELOG1(sch_log(mac_ctx, LOG1,
-			       FL("Beacon for PE session[%d] got changed."),
-			       ap_session->peSessionId);)
-			PELOG1(sch_log(mac_ctx, LOG1,
-			       FL("sending beacon param change bitmap: 0x%x "),
-			       bcn_prm.paramChangeBitmap);)
-			lim_send_beacon_params(mac_ctx, &bcn_prm, ap_session);
-		}
-	}
-#endif
 	/*
 	 * Now process the beacon in the context of the BSS which is
 	 * transmitting the beacons, if one is found
diff --git a/core/mac/src/sys/common/src/wlan_qct_sys.c b/core/mac/src/sys/common/src/wlan_qct_sys.c
index c2c39d1d97ca..212af83a949a 100644
--- a/core/mac/src/sys/common/src/wlan_qct_sys.c
+++ b/core/mac/src/sys/common/src/wlan_qct_sys.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -36,7 +36,8 @@
 #include "sme_api.h"
 #include "mac_init_api.h"
 
-/* Cookie for SYS messages.  Note that anyone posting a SYS Message
+/*
+ * Cookie for SYS messages.  Note that anyone posting a SYS Message
  * has to write the COOKIE in the reserved field of the message.  The
  * SYS Module relies on this COOKIE
  */
@@ -44,27 +45,50 @@
 
 /* SYS stop timeout 30 seconds */
 #define SYS_STOP_TIMEOUT (30000)
-
 static cdf_event_t g_stop_evt;
 
+/**
+ * sys_build_message_header() - to build the sys message header
+ * @sysMsgId: message id
+ * @pMsg: pointer to message context
+ *
+ * This API is used to build the sys message header.
+ *
+ * Return: CDF_STATUS
+ */
 CDF_STATUS sys_build_message_header(SYS_MSG_ID sysMsgId, cds_msg_t *pMsg)
 {
 	pMsg->type = sysMsgId;
 	pMsg->reserved = SYS_MSG_COOKIE;
 
-	return (CDF_STATUS_SUCCESS);
+	return CDF_STATUS_SUCCESS;
 }
 
-void sys_stop_complete_cb(void *pUserData) {
+/**
+ * sys_stop_complete_cb() - a callback when system stop completes
+ * @pUserData: pointer to user provided data context
+ *
+ * this callback is used once system stop is completed.
+ *
+ * Return: none
+ */
+void sys_stop_complete_cb(void *pUserData)
+{
 	cdf_event_t *pStopEvt = (cdf_event_t *) pUserData;
-	CDF_STATUS cdf_status;
-/*-------------------------------------------------------------------------*/
+	CDF_STATUS cdf_status = cdf_event_set(pStopEvt);
 
-	cdf_status = cdf_event_set(pStopEvt);
 	CDF_ASSERT(CDF_IS_STATUS_SUCCESS(cdf_status));
 
-} /* cds_sys_stop_complete_cback() */
+}
 
+/**
+ * sys_stop() - To post stop message to system module
+ * @p_cds_context:  pointer to cds context
+ *
+ * This API is used post a stop message to system module
+ *
+ * Return: CDF_STATUS
+ */
 CDF_STATUS sys_stop(v_CONTEXT_t p_cds_context)
 {
 	CDF_STATUS cdf_status = CDF_STATUS_SUCCESS;
@@ -73,23 +97,20 @@ CDF_STATUS sys_stop(v_CONTEXT_t p_cds_context)
 	/* Initialize the stop event */
 	cdf_status = cdf_event_init(&g_stop_evt);
 
-	if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
+	if (!CDF_IS_STATUS_SUCCESS(cdf_status))
 		return cdf_status;
-	}
 
 	/* post a message to SYS module in MC to stop SME and MAC */
 	sys_build_message_header(SYS_MSG_ID_MC_STOP, &sysMsg);
 
 	/* Save the user callback and user data */
-	/* finished. */
 	sysMsg.callback = sys_stop_complete_cb;
 	sysMsg.bodyptr = (void *)&g_stop_evt;
 
 	/* post the message.. */
 	cdf_status = cds_mq_post_message(CDS_MQ_ID_SYS, &sysMsg);
-	if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
+	if (!CDF_IS_STATUS_SUCCESS(cdf_status))
 		cdf_status = CDF_STATUS_E_BADMSG;
-	}
 
 	cdf_status = cdf_wait_single_event(&g_stop_evt, SYS_STOP_TIMEOUT);
 	CDF_ASSERT(CDF_IS_STATUS_SUCCESS(cdf_status));
@@ -97,22 +118,34 @@ CDF_STATUS sys_stop(v_CONTEXT_t p_cds_context)
 	cdf_status = cdf_event_destroy(&g_stop_evt);
 	CDF_ASSERT(CDF_IS_STATUS_SUCCESS(cdf_status));
 
-	return (cdf_status);
+	return cdf_status;
 }
 
+/**
+ * sys_mc_process_msg() - to process system mc thread messages
+ * @p_cds_context: pointer to cds context
+ * @pMsg: message pointer
+ *
+ * This API is used to process the message
+ *
+ * Return: CDF_STATUS
+ */
 CDF_STATUS sys_mc_process_msg(v_CONTEXT_t p_cds_context, cds_msg_t *pMsg)
 {
 	CDF_STATUS cdf_status = CDF_STATUS_SUCCESS;
+	cdf_mc_timer_callback_t timerCB;
+	tpAniSirGlobal mac_ctx;
 	void *hHal;
 
 	if (NULL == pMsg) {
-		CDF_ASSERT(0);
 		CDF_TRACE(CDF_MODULE_ID_SYS, CDF_TRACE_LEVEL_ERROR,
 			  "%s: NULL pointer to cds_msg_t", __func__);
+		CDF_ASSERT(0);
 		return CDF_STATUS_E_INVAL;
 	}
 
-	/* All 'new' SYS messages are identified by a cookie in the reserved
+	/*
+	 * All 'new' SYS messages are identified by a cookie in the reserved
 	 * field of the message as well as the message type.  This prevents
 	 * the possibility of overlap in the message types defined for new
 	 * SYS messages with the 'legacy' message types.  The legacy messages
@@ -122,241 +155,208 @@ CDF_STATUS sys_mc_process_msg(v_CONTEXT_t p_cds_context, cds_msg_t *pMsg)
 		/* Process all the new SYS messages.. */
 		switch (pMsg->type) {
 		case SYS_MSG_ID_MC_START:
-		{
-			/* Handling for this message is not needed now so adding
-			 *debug print and CDF_ASSERT*/
-			CDF_TRACE(CDF_MODULE_ID_SYS,
-				  CDF_TRACE_LEVEL_ERROR,
-				  " Received SYS_MSG_ID_MC_START message msgType= %d [0x%08x]",
-				  pMsg->type, pMsg->type);
+			/*
+			 * Handling for this message is not needed now so adding
+			 * debug print and CDF_ASSERT
+			 */
+			CDF_TRACE(CDF_MODULE_ID_SYS, CDF_TRACE_LEVEL_ERROR,
+				"Rx SYS_MSG_ID_MC_START msgType= %d [0x%08x]",
+				pMsg->type, pMsg->type);
 			CDF_ASSERT(0);
 			break;
-		}
 
 		case SYS_MSG_ID_MC_STOP:
-		{
-			CDF_TRACE(CDF_MODULE_ID_SYS,
-				  CDF_TRACE_LEVEL_INFO,
-				  "Processing SYS MC STOP");
+			CDF_TRACE(CDF_MODULE_ID_SYS, CDF_TRACE_LEVEL_INFO,
+				"Processing SYS MC STOP");
 
 			/* get the HAL context... */
 			hHal = cds_get_context(CDF_MODULE_ID_PE);
 			if (NULL == hHal) {
 				CDF_TRACE(CDF_MODULE_ID_SYS,
-					  CDF_TRACE_LEVEL_ERROR,
-					  "%s: Invalid hHal", __func__);
+					CDF_TRACE_LEVEL_ERROR,
+					"%s: Invalid hHal", __func__);
 			} else {
-				cdf_status =
-					sme_stop(hHal,
-						 HAL_STOP_TYPE_SYS_DEEP_SLEEP);
-				CDF_ASSERT(CDF_IS_STATUS_SUCCESS
-						   (cdf_status));
-
-				cdf_status =
-					mac_stop(hHal,
-						 HAL_STOP_TYPE_SYS_DEEP_SLEEP);
-				CDF_ASSERT(CDF_IS_STATUS_SUCCESS
-						   (cdf_status));
+				cdf_status = sme_stop(hHal,
+						HAL_STOP_TYPE_SYS_DEEP_SLEEP);
+				CDF_ASSERT(CDF_IS_STATUS_SUCCESS(cdf_status));
+				cdf_status = mac_stop(hHal,
+						HAL_STOP_TYPE_SYS_DEEP_SLEEP);
+				CDF_ASSERT(CDF_IS_STATUS_SUCCESS(cdf_status));
 
-				((sysResponseCback) pMsg->
-				 callback)((void *)pMsg->bodyptr);
+				((sysResponseCback) pMsg->callback)(
+						(void *)pMsg->bodyptr);
 
 				cdf_status = CDF_STATUS_SUCCESS;
 			}
 			break;
-		}
 
-		/* Process MC thread probe.  Just callback to the */
-		/* function that is in the message. */
 		case SYS_MSG_ID_MC_THR_PROBE:
-		{
-			CDF_TRACE(CDF_MODULE_ID_SYS,
-				  CDF_TRACE_LEVEL_ERROR,
-				  " Received SYS_MSG_ID_MC_THR_PROBE message msgType = %d [0x%08x]",
-				  pMsg->type, pMsg->type);
+			/*
+			 * Process MC thread probe.  Just callback to the
+			 * function that is in the message.
+			 */
+			CDF_TRACE(CDF_MODULE_ID_SYS, CDF_TRACE_LEVEL_ERROR,
+				"Rx SYS_MSG_ID_MC_THR_PROBE msgType=%d[0x%08x]",
+				pMsg->type, pMsg->type);
 			break;
-		}
 
 		case SYS_MSG_ID_MC_TIMER:
-		{
-			cdf_mc_timer_callback_t timerCB =
-				pMsg->callback;
-
-			if (NULL != timerCB) {
+			timerCB = pMsg->callback;
+			if (NULL != timerCB)
 				timerCB(pMsg->bodyptr);
-			}
 			break;
-		}
+
 		case SYS_MSG_ID_FTM_RSP:
-		{
-			tpAniSirGlobal mac_ctx = NULL;
 			hHal = cds_get_context(CDF_MODULE_ID_PE);
 			if (NULL == hHal) {
 				CDF_TRACE(CDF_MODULE_ID_SYS,
-					  CDF_TRACE_LEVEL_ERROR,
-					  FL("Invalid hal"));
+						CDF_TRACE_LEVEL_ERROR,
+						FL("Invalid hal"));
 				cdf_mem_free(pMsg->bodyptr);
 				break;
 			}
 			mac_ctx = PMAC_STRUCT(hHal);
 			if (NULL == mac_ctx) {
 				CDF_TRACE(CDF_MODULE_ID_SYS,
-					  CDF_TRACE_LEVEL_ERROR,
-					  FL("Invalid mac context"));
+						CDF_TRACE_LEVEL_ERROR,
+						FL("Invalid mac context"));
 				cdf_mem_free(pMsg->bodyptr);
 				break;
 			}
 			if (NULL == mac_ctx->ftm_msg_processor_callback) {
 				CDF_TRACE(CDF_MODULE_ID_SYS,
-					  CDF_TRACE_LEVEL_ERROR,
-					  FL("callback pointer is NULL"));
+						CDF_TRACE_LEVEL_ERROR,
+						FL("callback pointer is NULL"));
 				cdf_mem_free(pMsg->bodyptr);
 				break;
 			}
 			mac_ctx->ftm_msg_processor_callback(
-							(void *)pMsg->bodyptr);
+					(void *)pMsg->bodyptr);
 			cdf_mem_free(pMsg->bodyptr);
 			break;
-		}
 
 		default:
-		{
-			CDF_TRACE(CDF_MODULE_ID_SYS,
-				  CDF_TRACE_LEVEL_ERROR,
-				  "Unknown message type in sys_mc_process_msg() msgType= %d [0x%08x]",
-				  pMsg->type, pMsg->type);
+			CDF_TRACE(CDF_MODULE_ID_SYS, CDF_TRACE_LEVEL_ERROR,
+				"Unknown message type msgType= %d [0x%08x]",
+				pMsg->type, pMsg->type);
 			break;
-		}
-
-		} /* end switch on message type */
-
-	} /* end if cookie set */
-	else {
-		/* Process all 'legacy' messages */
-		switch (pMsg->type) {
-
-		default:
-		{
-			CDF_ASSERT(0);
-
-			CDF_TRACE(CDF_MODULE_ID_SYS,
-				  CDF_TRACE_LEVEL_ERROR,
-				  "Received SYS message cookie with unidentified "
-				  "MC message type= %d [0x%08X]",
-				  pMsg->type, pMsg->type);
 
-			cdf_status = CDF_STATUS_E_BADMSG;
-			if (pMsg->bodyptr)
-				cdf_mem_free(pMsg->bodyptr);
-			break;
 		}
-		} /* end switch on pMsg->type */
-	} /* end else */
+	} else {
+		CDF_TRACE(CDF_MODULE_ID_SYS,
+				CDF_TRACE_LEVEL_ERROR,
+				"Rx SYS unknown MC msgtype= %d [0x%08X]",
+				pMsg->type, pMsg->type);
+		CDF_ASSERT(0);
+		cdf_status = CDF_STATUS_E_BADMSG;
 
+		if (pMsg->bodyptr)
+			cdf_mem_free(pMsg->bodyptr);
+	}
 	return (cdf_status);
 }
 
-
-void sys_process_mmh_msg(tpAniSirGlobal pMac, tSirMsgQ *pMsg) {
+/**
+ * sys_process_mmh_msg() - this api to process mmh message
+ * @pMac: pointer to mac context
+ * @pMsg: pointer to message
+ *
+ * This API is used to process mmh message
+ *
+ * Return: none
+ */
+void sys_process_mmh_msg(tpAniSirGlobal pMac, tSirMsgQ *pMsg)
+{
 	CDS_MQ_ID targetMQ = CDS_MQ_ID_SYS;
-/*-------------------------------------------------------------------------*/
-	/*
-	** The body of this pMsg is a tSirMbMsg
-	** Contrary to Gen4, we cannot free it here!
-	** It is up to the callee to free it
-	*/
 
+	/*
+	 * The body of this pMsg is a tSirMbMsg
+	 * Contrary to previous generation, we cannot free it here!
+	 * It is up to the callee to free it
+	 */
 	if (NULL == pMsg) {
 		CDF_TRACE(CDF_MODULE_ID_SYS, CDF_TRACE_LEVEL_ERROR,
-			  "NULL Message Pointer");
+				"NULL Message Pointer");
 		CDF_ASSERT(0);
 		return;
 	}
 
 	switch (pMsg->type) {
 	/*
-	** Following messages are routed to SYS
-	*/
+	 * Following messages are routed to SYS
+	 */
 	case WNI_CFG_DNLD_REQ:
 	case WNI_CFG_DNLD_CNF:
-	{
 		/* Forward this message to the SYS module */
 		targetMQ = CDS_MQ_ID_SYS;
-
 		CDF_TRACE(CDF_MODULE_ID_SYS, CDF_TRACE_LEVEL_ERROR,
-			  "Handling for the Message ID %d is removed in SYS\r\n",
-			  pMsg->type);
-
+			"Handling for the Message ID %d is removed in SYS",
+			pMsg->type);
 		CDF_ASSERT(0);
 		break;
-	}
 
-	/*
-	** Following messages are routed to HAL
-	*/
+		/*
+		 * Following messages are routed to HAL
+		 */
 	case WNI_CFG_DNLD_RSP:
-	{
 		/* Forward this message to the HAL module */
 		targetMQ = CDS_MQ_ID_WMA;
-
 		CDF_TRACE(CDF_MODULE_ID_SYS, CDF_TRACE_LEVEL_ERROR,
-			  "Handling for the Message ID %d is removed as there is no HAL \r\n",
-			  pMsg->type);
+			"Handling for the Message ID %d is removed as no HAL",
+			pMsg->type);
 
 		CDF_ASSERT(0);
 		break;
-	}
 
 	case WNI_CFG_GET_REQ:
 	case WNI_CFG_SET_REQ:
 	case WNI_CFG_SET_REQ_NO_RSP:
 	case eWNI_SME_SYS_READY_IND:
-	{
 		/* Forward this message to the PE module */
 		targetMQ = CDS_MQ_ID_PE;
 		break;
-	}
 
 	case WNI_CFG_GET_RSP:
 	case WNI_CFG_SET_CNF:
-	{
 		/* Forward this message to the SME module */
 		targetMQ = CDS_MQ_ID_SME;
 		break;
-	}
 
 	default:
-	{
-
 		if ((pMsg->type >= eWNI_SME_MSG_TYPES_BEGIN)
-		    && (pMsg->type <= eWNI_SME_MSG_TYPES_END)) {
+				&& (pMsg->type <= eWNI_SME_MSG_TYPES_END)) {
 			targetMQ = CDS_MQ_ID_SME;
 			break;
 		}
 
 		CDF_TRACE(CDF_MODULE_ID_SYS, CDF_TRACE_LEVEL_ERROR,
-			  "Message of ID %d is not yet handled by SYS\r\n",
-			  pMsg->type);
-
+			"Message of ID %d is not yet handled by SYS",
+			pMsg->type);
 		CDF_ASSERT(0);
 	}
 
-	}
-
 	/*
-	** Post now the message to the appropriate module for handling
-	*/
-	if (CDF_STATUS_SUCCESS !=
-	    cds_mq_post_message(targetMQ, (cds_msg_t *) pMsg)) {
-		/* Caller doesn't allocate memory for the pMsg. It allocate memory for bodyptr */
-		/* free the mem and return */
-		if (pMsg->bodyptr) {
+	 * Post now the message to the appropriate module for handling
+	 */
+	if (CDF_STATUS_SUCCESS != cds_mq_post_message(targetMQ,
+					(cds_msg_t *) pMsg)) {
+		/*
+		 * Caller doesn't allocate memory for the pMsg.
+		 * It allocate memory for bodyptr free the mem and return
+		 */
+		if (pMsg->bodyptr)
 			cdf_mem_free(pMsg->bodyptr);
-		}
 	}
 
-} /* sys_process_mmh_msg() */
+}
 
+/**
+ * wlan_sys_probe() - API to post MC thread probe
+ *
+ * This API will be used send probe message
+ *
+ * Return: none
+ */
 void wlan_sys_probe(void)
 {
 	cds_msg_t cds_message;
@@ -364,8 +364,5 @@ void wlan_sys_probe(void)
 	cds_message.reserved = SYS_MSG_COOKIE;
 	cds_message.type = SYS_MSG_ID_MC_THR_PROBE;
 	cds_message.bodyptr = NULL;
-
 	cds_mq_post_message(CDS_MQ_ID_SYS, &cds_message);
-
-	return;
 }
diff --git a/core/mac/src/sys/legacy/src/platform/inc/sys_wrapper.h b/core/mac/src/sys/legacy/src/platform/inc/sys_wrapper.h
index 6aeb635cd0a0..8a4a2c010186 100644
--- a/core/mac/src/sys/legacy/src/platform/inc/sys_wrapper.h
+++ b/core/mac/src/sys/legacy/src/platform/inc/sys_wrapper.h
@@ -89,9 +89,9 @@ extern "C" {
 #define TX_AIRGO_TMR_SIGNATURE   0xDEADBEEF
 
 #ifdef TIMER_MANAGER
-#define  tx_timer_create(a, b, c, d, e, f, g)   tx_timer_create_intern_debug((void *)pMac, a, b, c, d, e, f, g, __FILE__, __LINE__)
+#define  tx_timer_create(a, b, c, d, e, f, g, h)    tx_timer_create_intern_debug((void *)a, b, c, d, e, f, g, h, __FILE__, __LINE__)
 #else
-#define  tx_timer_create(a, b, c, d, e, f, g)   tx_timer_create_intern((void *)pMac, a, b, c, d, e, f, g)
+#define  tx_timer_create(a, b, c, d, e, f, g, h)    tx_timer_create_intern((void *)a, b, c, d, e, f, g, h)
 #endif
 
 /*--------------------------------------------------------------------*/
diff --git a/core/mac/src/sys/legacy/src/utils/src/mac_trace.c b/core/mac/src/sys/legacy/src/utils/src/mac_trace.c
index 7d0d9ac102f3..2c5e1026ed79 100644
--- a/core/mac/src/sys/legacy/src/utils/src/mac_trace.c
+++ b/core/mac/src/sys/legacy/src/utils/src/mac_trace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -283,7 +283,6 @@ uint8_t *mac_trace_get_sme_msg_string(uint16_t sme_msg)
 		CASE_RETURN_STRING(eWNI_SME_HIDE_SSID_REQ);
 		CASE_RETURN_STRING(eWNI_SME_REMAIN_ON_CHANNEL_REQ);
 		CASE_RETURN_STRING(eWNI_SME_REMAIN_ON_CHN_RSP);
-		CASE_RETURN_STRING(eWNI_SME_MGMT_FRM_IND);
 		CASE_RETURN_STRING(eWNI_SME_REMAIN_ON_CHN_RDY_IND);
 		CASE_RETURN_STRING(eWNI_SME_SEND_ACTION_FRAME_IND);
 		CASE_RETURN_STRING(eWNI_SME_ACTION_FRAME_SEND_CNF);
@@ -328,12 +327,10 @@ uint8_t *mac_trace_get_sme_msg_string(uint16_t sme_msg)
 		CASE_RETURN_STRING(eWNI_SME_MSG_TYPES_END);
 		CASE_RETURN_STRING(eWNI_SME_GET_TSM_STATS_REQ);
 		CASE_RETURN_STRING(eWNI_SME_GET_TSM_STATS_RSP);
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-		CASE_RETURN_STRING(eWNI_SME_ROAM_OFFLOAD_SYNCH_IND);
-#endif
 		CASE_RETURN_STRING(eWNI_SME_SET_HW_MODE_REQ);
 		CASE_RETURN_STRING(eWNI_SME_SET_HW_MODE_RESP);
 		CASE_RETURN_STRING(eWNI_SME_HW_MODE_TRANS_IND);
+		CASE_RETURN_STRING(eWNI_SME_REGISTER_MGMT_FRAME_CB);
 	default:
 		return (uint8_t *) "UNKNOWN";
 		break;
@@ -506,7 +503,6 @@ uint8_t *mac_trace_get_wma_msg_string(uint16_t wma_msg)
 		CASE_RETURN_STRING(WMA_SET_THERMAL_LEVEL);
 		CASE_RETURN_STRING(WMA_SET_SAP_INTRABSS_DIS);
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-		CASE_RETURN_STRING(WMA_ROAM_OFFLOAD_SYNCH_CNF);
 		CASE_RETURN_STRING(WMA_ROAM_OFFLOAD_SYNCH_FAIL);
 #endif
 		CASE_RETURN_STRING(SIR_HAL_SET_BASE_MACADDR_IND);
@@ -663,9 +659,6 @@ uint8_t *mac_trace_get_lim_msg_string(uint16_t lim_msg)
 		CASE_RETURN_STRING(SIR_LIM_CONVERT_ACTIVE_CHANNEL_TO_PASSIVE);
 		CASE_RETURN_STRING(SIR_LIM_BEACON_GEN_IND);
 		CASE_RETURN_STRING(SIR_LIM_PERIODIC_PROBE_REQ_TIMEOUT);
-#ifdef FEATURE_WLAN_ESE
-		CASE_RETURN_STRING(SIR_LIM_ESE_TSM_TIMEOUT);
-#endif
 		CASE_RETURN_STRING(SIR_LIM_DISASSOC_ACK_TIMEOUT);
 		CASE_RETURN_STRING(SIR_LIM_DEAUTH_ACK_TIMEOUT);
 		CASE_RETURN_STRING(SIR_LIM_PERIODIC_JOIN_PROBE_REQ_TIMEOUT);
diff --git a/core/mac/src/sys/legacy/src/utils/src/parser_api.c b/core/mac/src/sys/legacy/src/utils/src/parser_api.c
index f7cfb78f38bb..2d443af9042f 100644
--- a/core/mac/src/sys/legacy/src/utils/src/parser_api.c
+++ b/core/mac/src/sys/legacy/src/utils/src/parser_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1002,6 +1002,8 @@ populate_dot11f_vht_caps(tpAniSirGlobal pMac,
 			CFG_GET_INT(nStatus, pMac,
 				    WNI_CFG_VHT_MU_BEAMFORMEE_CAP, nCfgValue);
 			pDot11f->muBeamformeeCap = (nCfgValue & 0x0001);
+			pDot11f->csnofBeamformerAntSup =
+				psessionEntry->txbf_csn_value;
 		} else {
 			pDot11f->muBeamformeeCap = 0;
 		}
@@ -1037,11 +1039,13 @@ populate_dot11f_vht_caps(tpAniSirGlobal pMac,
 		CFG_GET_INT(nStatus, pMac, WNI_CFG_VHT_SU_BEAMFORMER_CAP,
 				nCfgValue);
 		pDot11f->suBeamFormerCap = (nCfgValue & 0x0001);
+
+		nCfgValue = 0;
+		CFG_GET_INT(nStatus, pMac,
+				WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED,
+				nCfgValue);
+		pDot11f->csnofBeamformerAntSup = (nCfgValue & 0x0007);
 	}
-	nCfgValue = 0;
-	CFG_GET_INT(nStatus, pMac, WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED,
-		    nCfgValue);
-	pDot11f->csnofBeamformerAntSup = (nCfgValue & 0x0007);
 
 	nCfgValue = 0;
 	CFG_GET_INT(nStatus, pMac, WNI_CFG_VHT_NUM_SOUNDING_DIMENSIONS,
diff --git a/core/sap/dfs/inc/dfs.h b/core/sap/dfs/inc/dfs.h
index 64bc046fa04f..f3bdff8e7efb 100644
--- a/core/sap/dfs/inc/dfs.h
+++ b/core/sap/dfs/inc/dfs.h
@@ -98,6 +98,9 @@
 #define DFS_STATUS_SUCCESS 0
 #define DFS_STATUS_FAIL 1
 
+#define DFS_80P80_SEG0 0
+#define DFS_80P80_SEG1 1
+
 /*
  * Constants to use for chirping detection.
  *
@@ -115,6 +118,8 @@
 #define MAX_BIN5_DUR  145
 #define MAX_BIN5_DUR_MICROSEC 105
 
+#define DFS_BIN5_TIME_WINDOW_UNITS_MULTIPLIER 1000000
+
 #define DFS_MARGIN_EQUAL(a, b, margin) ((DFS_DIFF(a, b)) <= margin)
 #define DFS_MAX_STAGGERED_BURSTS 3
 
@@ -280,6 +285,7 @@ struct dfs_event {
 	uint32_t re_freq_lo;    /* Lower bounds of frequency, KHz */
 	uint32_t re_freq_hi;    /* Upper bounds of frequency, KHz */
 	int sidx;               /* Pulse Index as in radar summary report */
+	int radar_80p80_segid;  /* 80p80 segment ID as in radar sum report */
 	STAILQ_ENTRY(dfs_event) re_list;        /* List of radar events */
 } cdf_packed;
 #ifdef WIN32
@@ -355,6 +361,8 @@ struct dfs_delayline {
 struct dfs_filter {
 	/* Delay line of pulses for this filter */
 	struct dfs_delayline rf_dl;
+	/* Delay line of pulses for this filter in 80p80 */
+	struct dfs_delayline rf_dl_ext_seg;
 	/* Number of pulses in the filter */
 	uint32_t rf_numpulses;
 	/* min pri to be considered for this filter */
@@ -475,6 +483,7 @@ struct dfs_info {
 
 	uint64_t dfs_bin5_chirp_ts;
 	uint8_t dfs_last_bin5_dur;
+	uint8_t dfs_last_bin5_dur_ext_seg;
 } cdf_packed;
 #ifdef WIN32
 #pragma pack(pop, dfs_info)
@@ -574,6 +583,8 @@ struct ath_dfs {
 
 	struct dfs_info dfs_rinfo;      /* State vars for radar processing */
 	struct dfs_bin5radars *dfs_b5radars;    /* array of bin5 radar events */
+	/* array of bin5 radar events on extension segment in 80p80 */
+	struct dfs_bin5radars *dfs_b5radars_ext_seg;
 	int8_t **dfs_radartable;        /* map of radar durs to filter types */
 #ifndef ATH_DFS_RADAR_DETECTION_ONLY
 	struct dfs_nolelem *dfs_nol;    /* Non occupancy list for radar */
@@ -583,6 +594,7 @@ struct ath_dfs {
 	struct ath_dfs_phyerr_param dfs_defaultparams;
 	struct dfs_stats ath_dfs_stats; /* DFS related stats */
 	struct dfs_pulseline *pulses;   /* pulse history */
+	struct dfs_pulseline *pulses_ext_seg; /* pulse history ext 80p80 seg */
 	struct dfs_event *events;       /* Events structure */
 
 	uint32_t ath_radar_tasksched:1,       /* radar task is scheduled */
@@ -630,6 +642,8 @@ struct ath_dfs {
 	 * channel switch is disabled.
 	 */
 	int8_t     disable_dfs_ch_switch;
+	uint32_t  test_ts; /* to capture timestamps on primary segment */
+	uint32_t  test_ts_ext_seg; /* to capture timestamps on ext segment */
 };
 
 /* This should match the table from if_ath.c */
@@ -718,6 +732,11 @@ struct dfs_phy_err {
 	uint8_t rssi;           /* pulse RSSI */
 	uint8_t dur;            /* pulse duration, raw (not uS) */
 	int sidx;               /* Pulse Index as in radar summary report */
+	/*
+	 * Indicates segment ID on which the phyerror is received
+	 * when SAP is operating in 80p80 channel width.
+	 */
+	int radar_80p80_segid;
 };
 
 /* Attach, detach, handle ioctl prototypes */
@@ -746,14 +765,14 @@ int dfs_bin5_check_pulse(struct ath_dfs *dfs, struct dfs_event *re,
 			 struct dfs_bin5radars *br);
 int dfs_bin5_addpulse(struct ath_dfs *dfs, struct dfs_bin5radars *br,
 		      struct dfs_event *re, uint64_t thists);
-int dfs_bin5_check(struct ath_dfs *dfs);
+int dfs_bin5_check(struct ath_dfs *dfs, int seg_id);
 int dfs_check_chirping(struct ath_dfs *dfs, void *buf,
 		       uint16_t datalen, int is_ctl,
 		       int is_ext, int *slope, int *is_dc);
 uint8_t dfs_retain_bin5_burst_pattern(struct ath_dfs *dfs, uint32_t diff_ts,
-				      uint8_t old_dur);
+				      uint8_t old_dur, int seg_id);
 uint8_t dfs_retain_bin5_burst_pattern(struct ath_dfs *dfs, uint32_t diff_ts,
-				      uint8_t old_dur);
+				      uint8_t old_dur, int seg_id);
 int dfs_get_random_bin5_dur(struct ath_dfs *dfs, uint64_t tstamp);
 
 /* Debug prototypes */
@@ -773,26 +792,26 @@ struct dfs_state *dfs_getchanstate(struct ath_dfs *dfs, uint8_t *index,
 
 int dfs_init_radar_filters(struct ieee80211com *ic,
 			   struct ath_dfs_radar_tab_info *radar_info);
-void dfs_reset_alldelaylines(struct ath_dfs *dfs);
+void dfs_reset_alldelaylines(struct ath_dfs *dfs, int seg_id);
 void dfs_reset_delayline(struct dfs_delayline *dl);
-void dfs_reset_filter_delaylines(struct dfs_filtertype *dft);
 void dfs_reset_radarq(struct ath_dfs *dfs);
 
 /* Detection algorithm prototypes */
 void dfs_add_pulse(struct ath_dfs *dfs, struct dfs_filter *rf,
-		   struct dfs_event *re, uint32_t deltaT, uint64_t this_ts);
+		   struct dfs_event *re, uint32_t deltaT, uint64_t this_ts,
+		   int seg_id);
 
 int dfs_bin_fixedpattern_check(struct ath_dfs *dfs, struct dfs_filter *rf,
-			       uint32_t dur, int ext_chan_flag);
+			       uint32_t dur, int ext_chan_flag, int seg_id);
 int dfs_bin_check(struct ath_dfs *dfs, struct dfs_filter *rf,
-		  uint32_t deltaT, uint32_t dur, int ext_chan_flag);
+		  uint32_t deltaT, uint32_t dur, int ext_chan_flag, int seg_id);
 
 int dfs_bin_pri_check(struct ath_dfs *dfs, struct dfs_filter *rf,
 		      struct dfs_delayline *dl, uint32_t score,
 		      uint32_t refpri, uint32_t refdur, int ext_chan_flag,
 		      int fundamentalpri);
 int dfs_staggered_check(struct ath_dfs *dfs, struct dfs_filter *rf,
-			uint32_t deltaT, uint32_t width);
+			uint32_t deltaT, uint32_t width, int seg_id);
 /* False detection reduction */
 int dfs_get_pri_margin(struct ath_dfs *dfs, int is_extchan_detect,
 		       int is_fixed_pattern);
diff --git a/core/sap/dfs/src/dfs.c b/core/sap/dfs/src/dfs.c
index 2d0a81a3c55d..22ba6f405b0a 100644
--- a/core/sap/dfs/src/dfs.c
+++ b/core/sap/dfs/src/dfs.c
@@ -300,6 +300,28 @@ int dfs_attach(struct ieee80211com *ic)
 		return 1;
 	}
 
+	/*
+	 * If the chip supports DFS-3 then allocate
+	 * memory for pulses for extension segment.
+	 */
+	if (ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174) {
+		dfs->pulses_ext_seg = (struct dfs_pulseline *)
+					os_malloc(NULL,
+						sizeof(struct dfs_pulseline),
+						GFP_ATOMIC);
+		if (dfs->pulses_ext_seg == NULL) {
+			OS_FREE(dfs->events);
+			dfs->events = NULL;
+			OS_FREE(dfs);
+			ic->ic_dfs = NULL;
+			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			    "%s[%d]: pulse buffer allocation failed",
+			    __func__, __LINE__);
+			return 1;
+		}
+		dfs->pulses_ext_seg->pl_lastelem = DFS_MAX_PULSE_BUFFER_MASK;
+	}
+
 	dfs->pulses->pl_lastelem = DFS_MAX_PULSE_BUFFER_MASK;
 
 	/* Allocate memory for radar filters */
@@ -351,6 +373,10 @@ int dfs_attach(struct ieee80211com *ic)
 	dfs->dfs_rinfo.dfs_bin5_chirp_ts = dfs->dfs_rinfo.ext_chan_busy_ts;
 	dfs->dfs_rinfo.dfs_last_bin5_dur = MAX_BIN5_DUR;
 	dfs->dfs_b5radars = NULL;
+	if (ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174) {
+		dfs->dfs_rinfo.dfs_last_bin5_dur_ext_seg = MAX_BIN5_DUR;
+		dfs->dfs_b5radars_ext_seg = NULL;
+	}
 
 	/*
 	 * If dfs_init_radar_filters() fails, we can abort here and
@@ -388,6 +414,11 @@ bad1:
 		OS_FREE(dfs->pulses);
 		dfs->pulses = NULL;
 	}
+	if (dfs->pulses_ext_seg &&
+	    ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174) {
+		OS_FREE(dfs->pulses_ext_seg);
+		dfs->pulses_ext_seg = NULL;
+	}
 	if (dfs->events) {
 		OS_FREE(dfs->events);
 		dfs->events = NULL;
@@ -446,9 +477,12 @@ void dfs_detach(struct ieee80211com *ic)
 	}
 #endif
 #endif
+
 	/* Return radar events to free q */
 	dfs_reset_radarq(dfs);
-	dfs_reset_alldelaylines(dfs);
+	dfs_reset_alldelaylines(dfs, DFS_80P80_SEG0);
+	if (ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174)
+		dfs_reset_alldelaylines(dfs, DFS_80P80_SEG1);
 
 	/* Free up pulse log */
 	if (dfs->pulses != NULL) {
@@ -456,6 +490,12 @@ void dfs_detach(struct ieee80211com *ic)
 		dfs->pulses = NULL;
 	}
 
+	if (dfs->pulses_ext_seg != NULL &&
+	    ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174) {
+		OS_FREE(dfs->pulses_ext_seg);
+		dfs->pulses_ext_seg = NULL;
+	}
+
 	for (n = 0; n < DFS_MAX_RADAR_TYPES; n++) {
 		if (dfs->dfs_radarf[n] != NULL) {
 			OS_FREE(dfs->dfs_radarf[n]);
@@ -481,6 +521,11 @@ void dfs_detach(struct ieee80211com *ic)
 		OS_FREE(dfs->dfs_b5radars);
 		dfs->dfs_b5radars = NULL;
 	}
+	if (dfs->dfs_b5radars_ext_seg != NULL &&
+	    ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174) {
+		OS_FREE(dfs->dfs_b5radars_ext_seg);
+		dfs->dfs_b5radars_ext_seg = NULL;
+	}
 
 /*      Commenting out since all the ar functions are obsolete and
  *      the function definition has been removed as part of dfs_ar.c
@@ -582,7 +627,14 @@ int dfs_radar_enable(struct ieee80211com *ic,
 			if (is_ext_ch) {
 				ext_ch = ieee80211_get_extchan(ic);
 			}
-			dfs_reset_alldelaylines(dfs);
+			dfs_reset_alldelaylines(dfs, DFS_80P80_SEG0);
+			/*
+			 * Extension segment delaylines will be
+			 * enabled only when SAP operates in 80p80
+			 * and both the channels are DFS.
+			 */
+			if (chan->ic_80p80_both_dfs)
+				dfs_reset_alldelaylines(dfs, DFS_80P80_SEG1);
 
 			rs_pri = dfs_getchanstate(dfs, &index_pri, 0);
 			if (ext_ch) {
@@ -594,9 +646,17 @@ int dfs_radar_enable(struct ieee80211com *ic,
 
 				OS_MEMSET(&pe, '\0', sizeof(pe));
 
-				if (index_pri != dfs->dfs_curchan_radindex)
-					dfs_reset_alldelaylines(dfs);
-
+				if (index_pri != dfs->dfs_curchan_radindex) {
+					dfs_reset_alldelaylines(dfs,
+								DFS_80P80_SEG0);
+					/*
+					 * Reset only when ext segment is
+					 * present
+					 */
+					if (chan->ic_80p80_both_dfs)
+						dfs_reset_alldelaylines(dfs,
+								DFS_80P80_SEG1);
+				}
 				dfs->dfs_curchan_radindex = (int16_t) index_pri;
 				dfs->dfs_pri_multiplier_ini =
 					radar_info->dfs_pri_multiplier;
diff --git a/core/sap/dfs/src/dfs_bindetects.c b/core/sap/dfs/src/dfs_bindetects.c
index 7c48309942ca..dc3acf6dabd6 100644
--- a/core/sap/dfs/src/dfs_bindetects.c
+++ b/core/sap/dfs/src/dfs_bindetects.c
@@ -59,14 +59,19 @@
 
 int
 dfs_bin_fixedpattern_check(struct ath_dfs *dfs, struct dfs_filter *rf,
-			   uint32_t dur, int ext_chan_flag)
+			   uint32_t dur, int ext_chan_flag, int seg_id)
 {
-	struct dfs_pulseline *pl = dfs->pulses;
+	struct dfs_pulseline *pl;
 	int i, n, refpri, primargin, numpulses = 0;
 	uint64_t start_ts, end_ts, event_ts, prev_event_ts, next_event_ts,
 		 window_start, window_end;
 	uint32_t index, next_index, deltadur;
 
+	if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+		pl = (seg_id == 0) ? dfs->pulses : dfs->pulses_ext_seg;
+	else
+		pl = dfs->pulses;
+
 	/* For fixed pattern types, rf->rf_patterntype=1 */
 	primargin =
 		dfs_get_pri_margin(dfs, ext_chan_flag, (rf->rf_patterntype == 1));
@@ -151,12 +156,15 @@ dfs_bin_fixedpattern_check(struct ath_dfs *dfs, struct dfs_filter *rf,
 
 void
 dfs_add_pulse(struct ath_dfs *dfs, struct dfs_filter *rf, struct dfs_event *re,
-	      uint32_t deltaT, uint64_t this_ts)
+	      uint32_t deltaT, uint64_t this_ts, int seg_id)
 {
 	uint32_t index, n, window;
 	struct dfs_delayline *dl;
 
-	dl = &rf->rf_dl;
+	if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+		dl = (seg_id == 0) ? &rf->rf_dl : &rf->rf_dl_ext_seg;
+	else
+		dl = &rf->rf_dl;
 	/* Circular buffer of size 2^n */
 	index = (dl->dl_lastelem + 1) & DFS_MAX_DL_MASK;
 	/* if ((dl->dl_numelems+1) == DFS_MAX_DL_SIZE) */
@@ -197,7 +205,7 @@ dfs_add_pulse(struct ath_dfs *dfs, struct dfs_filter *rf, struct dfs_event *re,
 
 int
 dfs_bin_check(struct ath_dfs *dfs, struct dfs_filter *rf, uint32_t deltaT,
-	      uint32_t width, int ext_chan_flag)
+	      uint32_t width, int ext_chan_flag, int seg_id)
 {
 	uint32_t refpri, refdur, searchpri, deltapri, deltapri_2, deltapri_3,
 		 averagerefpri;
@@ -208,7 +216,11 @@ dfs_bin_check(struct ath_dfs *dfs, struct dfs_filter *rf, uint32_t deltaT,
 	int numpulses = 0;
 	int lowprichk = 3, pri_match = 0;
 
-	dl = &rf->rf_dl;
+	if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+		dl = (seg_id == 0) ? &rf->rf_dl : &rf->rf_dl_ext_seg;
+	else
+		dl = &rf->rf_dl;
+
 	if (dl->dl_numelems < (rf->rf_threshold - 1)) {
 		return 0;
 	}
@@ -226,7 +238,8 @@ dfs_bin_check(struct ath_dfs *dfs, struct dfs_filter *rf, uint32_t deltaT,
 
 	if (rf->rf_patterntype == 1) {
 		found =
-			dfs_bin_fixedpattern_check(dfs, rf, width, ext_chan_flag);
+			dfs_bin_fixedpattern_check(dfs, rf, width,
+							ext_chan_flag, seg_id);
 		if (found) {
 			dl->dl_numelems = 0;
 		}
@@ -330,7 +343,13 @@ dfs_bin_check(struct ath_dfs *dfs, struct dfs_filter *rf, uint32_t deltaT,
 			    "ext_flag=%d MATCH filter=%u numpulses=%u thresh=%u refdur=%d refpri=%d primargin=%d\n",
 			    ext_chan_flag, rf->rf_pulseid, numpulses,
 			    rf->rf_threshold, refdur, refpri, primargin);
-		dfs_print_delayline(dfs, &rf->rf_dl);
+
+		if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+			dfs_print_delayline(dfs,
+			    (seg_id == 0) ? &rf->rf_dl : &rf->rf_dl_ext_seg);
+		else
+			dfs_print_delayline(dfs, &rf->rf_dl);
+
 		dfs_print_filter(dfs, rf);
 	}
 	return found;
diff --git a/core/sap/dfs/src/dfs_fcc_bin5.c b/core/sap/dfs/src/dfs_fcc_bin5.c
index d6f62542c0ce..027e3211866e 100644
--- a/core/sap/dfs/src/dfs_fcc_bin5.c
+++ b/core/sap/dfs/src/dfs_fcc_bin5.c
@@ -176,7 +176,7 @@ int dfs_bin5_addpulse(struct ath_dfs *dfs, struct dfs_bin5radars *br,
  * properly, then signify that a bin5 radar was found
  */
 
-int dfs_bin5_check(struct ath_dfs *dfs)
+int dfs_bin5_check(struct ath_dfs *dfs, int seg_id)
 {
 	struct dfs_bin5radars *br;
 	int index[DFS_MAX_B5_SIZE];
@@ -191,7 +191,11 @@ int dfs_bin5_check(struct ath_dfs *dfs)
 		return 1;
 	}
 	for (n = 0; n < dfs->dfs_rinfo.rn_numbin5radars; n++) {
-		br = &(dfs->dfs_b5radars[n]);
+		if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+			br = (seg_id == 0) ? &(dfs->dfs_b5radars[n]) :
+						&(dfs->dfs_b5radars_ext_seg[n]);
+		else
+			br = &(dfs->dfs_b5radars[n]);
 		DFS_DPRINTK(dfs, ATH_DEBUG_DFS_BIN5,
 			    "Num elems = %d\n", br->br_numelems);
 
@@ -806,9 +810,18 @@ dfs_check_chirping(struct ath_dfs *dfs, void *buf,
 
 uint8_t
 dfs_retain_bin5_burst_pattern(struct ath_dfs *dfs, uint32_t diff_ts,
-			      uint8_t old_dur)
+			      uint8_t old_dur, int seg_id)
 {
 
+	u_int8_t dfs_last_bin5_dur;
+
+	if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+		dfs_last_bin5_dur = (seg_id == 0) ?
+				    dfs->dfs_rinfo.dfs_last_bin5_dur :
+				    dfs->dfs_rinfo.dfs_last_bin5_dur_ext_seg;
+	else
+		dfs_last_bin5_dur = dfs->dfs_rinfo.dfs_last_bin5_dur;
+
 	/*
 	 * Pulses may get split into 2 during chirping, this print is only
 	 * to show that it happened, we do not handle this condition if we
@@ -821,7 +834,7 @@ dfs_retain_bin5_burst_pattern(struct ath_dfs *dfs, uint32_t diff_ts,
 		DFS_DPRINTK(dfs, ATH_DEBUG_DFS_BIN5,
 			    "%s SPLIT pulse diffTs=%u dur=%d (old_dur=%d)\n",
 			    __func__, diff_ts,
-			    dfs->dfs_rinfo.dfs_last_bin5_dur, old_dur);
+			    dfs_last_bin5_dur, old_dur);
 	}
 	/*
 	 * Check if this is the 2nd or 3rd pulse in the same burst,
@@ -836,10 +849,9 @@ dfs_retain_bin5_burst_pattern(struct ath_dfs *dfs, uint32_t diff_ts,
 		DFS_DPRINTK(dfs, ATH_DEBUG_DFS_BIN5,
 			    "%s this pulse belongs to the same burst as before, give "
 			    "it same dur=%d (old_dur=%d)\n",
-			    __func__, dfs->dfs_rinfo.dfs_last_bin5_dur,
-			    old_dur);
+			    __func__, dfs_last_bin5_dur, old_dur);
 
-		return (dfs->dfs_rinfo.dfs_last_bin5_dur);
+		return dfs_last_bin5_dur;
 	}
 	/*
 	 * This pulse does not belong to this burst, return unchanged
diff --git a/core/sap/dfs/src/dfs_init.c b/core/sap/dfs/src/dfs_init.c
index ca259c4af8ea..7ab7df12a9cb 100644
--- a/core/sap/dfs/src/dfs_init.c
+++ b/core/sap/dfs/src/dfs_init.c
@@ -66,7 +66,7 @@ extern int domainoverride;
  * (eg on a non-DFS channel, with radar PHY errors still showing up.)
  * In that case, just drop out early.
  */
-void dfs_reset_alldelaylines(struct ath_dfs *dfs)
+void dfs_reset_alldelaylines(struct ath_dfs *dfs, int seg_id)
 {
 	struct dfs_filtertype *ft = NULL;
 	struct dfs_filter *rf;
@@ -79,7 +79,11 @@ void dfs_reset_alldelaylines(struct ath_dfs *dfs)
 			  "%s[%d]: sc_dfs is NULL", __func__, __LINE__);
 		return;
 	}
-	pl = dfs->pulses;
+
+	if (dfs->ic->dfs_hw_bd_id != DFS_HWBD_QCA6174)
+		pl = (seg_id == 0) ? dfs->pulses : dfs->pulses_ext_seg;
+	else
+		pl = dfs->pulses;
 
 	if (pl == NULL) {
 		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
@@ -87,13 +91,24 @@ void dfs_reset_alldelaylines(struct ath_dfs *dfs)
 		return;
 	}
 
-	if (dfs->dfs_b5radars == NULL) {
-		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-			  "%s[%d]: pl==NULL, b5radars=%p", __func__, __LINE__,
-			  dfs->dfs_b5radars);
-		return;
+	if (dfs->ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174) {
+		if (((seg_id == 0) ?
+		    dfs->dfs_b5radars : dfs->dfs_b5radars_ext_seg) == NULL) {
+			DFS_DPRINTK(dfs, ATH_DEBUG_DFS,
+				    "%s: pl==NULL, b5radars=%p\n",
+				    __func__,
+				    (seg_id == 0) ? dfs->dfs_b5radars :
+						    dfs->dfs_b5radars_ext_seg);
+			return;
+		}
+	} else {
+		if (dfs->dfs_b5radars == NULL) {
+			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+				"%s[%d]: pl==NULL, b5radars=%p", __func__, __LINE__,
+				dfs->dfs_b5radars);
+			return;
+		}
 	}
-
 	/* reset the pulse log */
 	pl->pl_firstelem = pl->pl_numelems = 0;
 	pl->pl_lastelem = DFS_MAX_PULSE_BUFFER_MASK;
@@ -104,7 +119,13 @@ void dfs_reset_alldelaylines(struct ath_dfs *dfs)
 			if (NULL != ft) {
 				for (j = 0; j < ft->ft_numfilters; j++) {
 					rf = &(ft->ft_filters[j]);
-					dl = &(rf->rf_dl);
+					if (dfs->ic->dfs_hw_bd_id !=
+							DFS_HWBD_QCA6174)
+						dl = (seg_id == 0) ?
+							&(rf->rf_dl) :
+							&(rf->rf_dl_ext_seg);
+					else
+						dl = &(rf->rf_dl);
 					if (dl != NULL) {
 						OS_MEMZERO(dl,
 							   sizeof(struct
@@ -118,12 +139,34 @@ void dfs_reset_alldelaylines(struct ath_dfs *dfs)
 		}
 	}
 	for (i = 0; i < dfs->dfs_rinfo.rn_numbin5radars; i++) {
-		OS_MEMZERO(&(dfs->dfs_b5radars[i].br_elems[0]),
-			   sizeof(struct dfs_bin5elem) * DFS_MAX_B5_SIZE);
-		dfs->dfs_b5radars[i].br_firstelem = 0;
-		dfs->dfs_b5radars[i].br_numelems = 0;
-		dfs->dfs_b5radars[i].br_lastelem =
-			(0xFFFFFFFF) & DFS_MAX_B5_MASK;
+		if (dfs->ic->dfs_hw_bd_id != DFS_HWBD_QCA6174) {
+			if (seg_id == DFS_80P80_SEG0) {
+				OS_MEMZERO(&(dfs->dfs_b5radars[i].br_elems[0]),
+				    sizeof(struct dfs_bin5elem) *
+							DFS_MAX_B5_SIZE);
+				dfs->dfs_b5radars[i].br_firstelem = 0;
+				dfs->dfs_b5radars[i].br_numelems = 0;
+				dfs->dfs_b5radars[i].br_lastelem =
+						(0xFFFFFFFF) & DFS_MAX_B5_MASK;
+			} else {
+				OS_MEMZERO(
+				    &(dfs->dfs_b5radars_ext_seg[i].br_elems[0]),
+				    sizeof(struct dfs_bin5elem)*
+				    DFS_MAX_B5_SIZE);
+				dfs->dfs_b5radars_ext_seg[i].br_firstelem = 0;
+				dfs->dfs_b5radars_ext_seg[i].br_numelems = 0;
+				dfs->dfs_b5radars_ext_seg[i].br_lastelem =
+						(0xFFFFFFFF)&DFS_MAX_B5_MASK;
+			}
+
+		} else {
+			OS_MEMZERO(&(dfs->dfs_b5radars[i].br_elems[0]),
+				sizeof(struct dfs_bin5elem) * DFS_MAX_B5_SIZE);
+			dfs->dfs_b5radars[i].br_firstelem = 0;
+			dfs->dfs_b5radars[i].br_numelems = 0;
+			dfs->dfs_b5radars[i].br_lastelem =
+						(0xFFFFFFFF) & DFS_MAX_B5_MASK;
+		}
 	}
 }
 
@@ -137,16 +180,6 @@ void dfs_reset_delayline(struct dfs_delayline *dl)
 	dl->dl_lastelem = (0xFFFFFFFF) & DFS_MAX_DL_MASK;
 }
 
-void dfs_reset_filter_delaylines(struct dfs_filtertype *dft)
-{
-	int i;
-	struct dfs_filter *df;
-	for (i = 0; i < DFS_MAX_NUM_RADAR_FILTERS; i++) {
-		df = &dft->ft_filters[i];
-		dfs_reset_delayline(&(df->rf_dl));
-	}
-}
-
 void dfs_reset_radarq(struct ath_dfs *dfs)
 {
 	struct dfs_event *event;
@@ -183,6 +216,8 @@ int dfs_init_radar_filters(struct ieee80211com *ic,
 	struct dfs_bin5pulse *b5pulses = NULL;
 	int32_t min_rssithresh = DFS_MAX_RSSI_VALUE;
 	uint32_t max_pulsedur = 0;
+	uint32_t b5_rssithresh;
+	uint32_t b5_maxdur;
 
 	if (dfs == NULL) {
 		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
@@ -299,6 +334,10 @@ int dfs_init_radar_filters(struct ieee80211com *ic,
 		}
 		rf = &(ft->ft_filters[ft->ft_numfilters++]);
 		dfs_reset_delayline(&rf->rf_dl);
+
+		if (ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174)
+			dfs_reset_delayline(&rf->rf_dl_ext_seg);
+
 		numpulses = dfs_radars[p].rp_numpulses;
 
 		rf->rf_numpulses = numpulses;
@@ -359,9 +398,24 @@ int dfs_init_radar_filters(struct ieee80211com *ic,
 			    __func__);
 		goto bad4;
 	}
+
+	if (ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174) {
+		dfs->dfs_b5radars_ext_seg =
+			(struct dfs_bin5radars *)os_malloc(NULL, numb5radars *
+						sizeof(struct dfs_bin5radars),
+						GFP_KERNEL);
+		if (dfs->dfs_b5radars_ext_seg == NULL) {
+			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+				  "%s:Fail allocate memory for ext bin5 radars",
+				  __func__);
+			goto bad4;
+		}
+	}
+
 	for (n = 0; n < numb5radars; n++) {
 		dfs->dfs_b5radars[n].br_pulse = b5pulses[n];
-		dfs->dfs_b5radars[n].br_pulse.b5_timewindow *= 1000000;
+		dfs->dfs_b5radars[n].br_pulse.b5_timewindow *=
+					DFS_BIN5_TIME_WINDOW_UNITS_MULTIPLIER;
 		if (dfs->dfs_b5radars[n].br_pulse.b5_rssithresh <
 		    min_rssithresh)
 			min_rssithresh =
@@ -369,7 +423,30 @@ int dfs_init_radar_filters(struct ieee80211com *ic,
 		if (dfs->dfs_b5radars[n].br_pulse.b5_maxdur > max_pulsedur)
 			max_pulsedur = dfs->dfs_b5radars[n].br_pulse.b5_maxdur;
 	}
-	dfs_reset_alldelaylines(dfs);
+
+	if (ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174) {
+		for (n = 0; n < numb5radars; n++) {
+			dfs->dfs_b5radars_ext_seg[n].br_pulse = b5pulses[n];
+			dfs->dfs_b5radars_ext_seg[n].br_pulse.b5_timewindow *=
+					DFS_BIN5_TIME_WINDOW_UNITS_MULTIPLIER;
+			b5_rssithresh =
+			    dfs->dfs_b5radars_ext_seg[n].br_pulse.b5_rssithresh;
+			if (b5_rssithresh < min_rssithresh)
+				min_rssithresh = b5_rssithresh;
+
+			b5_maxdur =
+			    dfs->dfs_b5radars_ext_seg[n].br_pulse.b5_maxdur;
+			if (b5_maxdur > max_pulsedur)
+				max_pulsedur = b5_maxdur;
+
+		}
+	}
+
+	dfs_reset_alldelaylines(dfs, DFS_80P80_SEG0);
+
+	if (ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174)
+		dfs_reset_alldelaylines(dfs, DFS_80P80_SEG1);
+
 	dfs_reset_radarq(dfs);
 	dfs->dfs_curchan_radindex = -1;
 	dfs->dfs_extchan_radindex = -1;
diff --git a/core/sap/dfs/src/dfs_phyerr_tlv.c b/core/sap/dfs/src/dfs_phyerr_tlv.c
index 89a6c0b471b4..aaf568636282 100644
--- a/core/sap/dfs/src/dfs_phyerr_tlv.c
+++ b/core/sap/dfs/src/dfs_phyerr_tlv.c
@@ -35,6 +35,16 @@
 #include "dfs_phyerr.h"
 #include "dfs_phyerr_tlv.h"
 
+/**
+ * enum RADAR_SUMMARY_VERSION - Radar summary report version
+ * @DFS_RADAR_SUMMARY_REPORT_VERSION_2: DFS-2 radar summary report
+ * @DFS_RADAR_SUMMARY_REPORT_VERSION_3: DFS-3 radar summary report
+ */
+typedef enum {
+DFS_RADAR_SUMMARY_REPORT_VERSION_2 = 1,
+DFS_RADAR_SUMMARY_REPORT_VERSION_3 = 2,
+} RADAR_SUMMARY_VERSION;
+
 /*
  * Parsed radar status
  */
@@ -48,6 +58,28 @@ struct rx_radar_status {
 	int delta_diff;
 	int sidx;
 	int freq_offset;        /* in KHz */
+	int agc_total_gain;
+	int agc_mb_gain;
+	/*Parsed only for DFS-3*/
+	int radar_subchan_mask;
+	RADAR_SUMMARY_VERSION rsu_version;
+	/*
+	 * The parameters below are present only in
+	 * DFS-3 radar summary report and need to be
+	 * parsed only for DFS-3.
+	 */
+	/* DFS-3 Only */
+	int pulse_height;
+	/* DFS-3 Only */
+	int triggering_agc_event;
+	/* DFS-3 Only */
+	int pulse_rssi;
+	/* DFS-3 Only */
+	int radar_fft_pri80_inband_power;
+	/* DFS-3 Only */
+	int radar_fft_ext80_inband_power;
+	/* DFS-3 Only */
+	int radar_80p80_segid;
 };
 
 struct rx_search_fft_report {
@@ -106,9 +138,22 @@ radar_summary_print(struct ath_dfs *dfs,
 		    struct rx_radar_status *rsu,
 		    bool enable_log)
 {
+	int is_chip_oversampling;
+
 	if (!enable_log)
 		return;
 
+	/*
+	 * Oversampling needs to be turned on for
+	 * older chipsets that support DFS-2.
+	 * it needs to be turned off for chips
+	 * that support DFS-3.
+	 */
+	if (dfs->ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174)
+		is_chip_oversampling = 0;
+	else
+		is_chip_oversampling = PERE_IS_OVERSAMPLING(dfs);
+
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO,
 		  "\n ############ Radar Summary ############\n");
 
@@ -152,7 +197,7 @@ radar_summary_print(struct ath_dfs *dfs,
 		  "%s: frequency offset = %d.%d MHz (oversampling = %d)\n",
 		  __func__, (int) (rsu->freq_offset / 1000),
 		  (int) abs(rsu->freq_offset % 1000),
-		  PERE_IS_OVERSAMPLING(dfs));
+		  is_chip_oversampling);
 
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO,
 		  "\n ###################################\n");
@@ -168,50 +213,165 @@ radar_summary_parse(struct ath_dfs *dfs, const char *buf, size_t len,
 		    struct rx_radar_status *rsu)
 {
 	uint32_t rs[2];
+	uint32_t dfs3_rs[5];
 	int freq_centre, freq;
+	int is_chip_oversampling;
 
-	/* Drop out if we have < 2 DWORDs available */
-	if (len < sizeof(rs)) {
-		DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR |
-			    ATH_DEBUG_DFS_PHYERR_SUM,
-			    "%s: len (%zu) < expected (%zu)!",
-			    __func__, len, sizeof(rs));
+	/*
+	 * Drop out if we have < 2 DWORDs available for DFS-2
+	 * and drop out if we have < 5 DWORDS available for DFS-3
+	 */
+	if ((dfs->ic->dfs_hw_bd_id ==  DFS_HWBD_QCA6174) &&
+	    (len < sizeof(rs))) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+		  "%s: DFS-2 radar summary len = (%zu) wrong, expected = (%zu)",
+		  __func__, len, sizeof(rs));
+	} else if ((dfs->ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174) &&
+		(len < sizeof(dfs3_rs))) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+		  "%s: DFS-3 radar summary len = (%zu) wrong, expected = (%zu)",
+		  __func__, len, sizeof(dfs3_rs));
 	}
 
 	/*
-	 * Since the TLVs may be unaligned for some reason
-	 * we take a private copy into aligned memory.
-	 * This enables us to use the HAL-like accessor macros
-	 * into the DWORDs to access sub-DWORD fields.
+	 * If the length of TLV is equal to
+	 * DFS3_RADAR_PULSE_SUMMARY_TLV_LENGTH
+	 * then it means the radar summary report
+	 * has 5 DWORDS and we need to parse the
+	 * report accordingly.
+	 * Else if the length is equal to
+	 * DFS2_RADAR_PULSE_SUMMARY_TLV_LENGTH then
+	 * it the radar summary report will have only
+	 * two DWORDS so we parse for only two DWORDS.
 	 */
-	OS_MEMCPY(rs, buf, sizeof(rs));
+	if (len == DFS3_RADAR_PULSE_SUMMARY_TLV_LENGTH) {
+		/*
+		 * Since the TLVs may be unaligned for some reason
+		 * we take a private copy into aligned memory.
+		 * This enables us to use the HAL-like accessor macros
+		 * into the DWORDs to access sub-DWORD fields.
+		 */
+		OS_MEMCPY(dfs3_rs, buf, sizeof(dfs3_rs));
 
-	DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR,
-		    "%s: two 32 bit values are: %08x %08x", __func__, rs[0],
-		    rs[1]);
-/* DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR, "%s (p=%p):", __func__, buf); */
-
-	/* Populate the fields from the summary report */
-	rsu->tsf_offset =
-		MS(rs[RADAR_REPORT_PULSE_REG_2], RADAR_REPORT_PULSE_TSF_OFFSET);
-	rsu->pulse_duration =
-		MS(rs[RADAR_REPORT_PULSE_REG_2], RADAR_REPORT_PULSE_DUR);
-	rsu->is_chirp =
-		MS(rs[RADAR_REPORT_PULSE_REG_1], RADAR_REPORT_PULSE_IS_CHIRP);
-	rsu->sidx =
-		sign_extend_32(MS
-				       (rs[RADAR_REPORT_PULSE_REG_1],
-				       RADAR_REPORT_PULSE_SIDX), 10);
-	rsu->freq_offset =
-		calc_freq_offset(rsu->sidx, PERE_IS_OVERSAMPLING(dfs));
+		/*
+		 * Oversampling is only needed to be
+		 * turned on for older chips that support
+		 * DFS-2. It needs to be turned off for chips
+		 * that support DFS-3.
+		 */
+		is_chip_oversampling = 0;
 
-	/* These are only relevant if the pulse is a chirp */
-	rsu->delta_peak =
-		sign_extend_32(MS
-				       (rs[RADAR_REPORT_PULSE_REG_1],
-				       RADAR_REPORT_PULSE_DELTA_PEAK), 6);
-	rsu->delta_diff =
-		MS(rs[RADAR_REPORT_PULSE_REG_1], RADAR_REPORT_PULSE_DELTA_DIFF);
+		/*
+		 * populate the version of the radar summary report
+		 * based on the TLV length to differentiate between
+		 * DFS-2 and DFS-3 radar summary report.
+		 */
+		rsu->rsu_version = DFS_RADAR_SUMMARY_REPORT_VERSION_3;
+
+		/* Populate the fields from the summary report */
+		rsu->tsf_offset = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_2],
+						RADAR_REPORT_PULSE_TSF_OFFSET);
+		rsu->pulse_duration = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_2],
+						RADAR_REPORT_PULSE_DUR);
+		rsu->is_chirp = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_1],
+						RADAR_REPORT_PULSE_IS_CHIRP);
+		rsu->sidx = sign_extend_32(MS(dfs3_rs[RADAR_REPORT_PULSE_REG_1],
+						RADAR_REPORT_PULSE_SIDX), 10);
+		rsu->freq_offset = calc_freq_offset(rsu->sidx,
+						is_chip_oversampling);
+		/* These are only relevant if the pulse is a chirp */
+		rsu->delta_peak = sign_extend_32(
+					MS(dfs3_rs[RADAR_REPORT_PULSE_REG_1],
+						RADAR_REPORT_PULSE_DELTA_PEAK),
+						6);
+		rsu->delta_diff = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_1],
+						RADAR_REPORT_PULSE_DELTA_DIFF);
+		/* For false detection Debug */
+		rsu->agc_total_gain = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_1],
+						RADAR_REPORT_AGC_TOTAL_GAIN);
+		rsu->agc_mb_gain = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_2],
+						RADAR_REPORT_PULSE_AGC_MB_GAIN);
+		/*
+		 * radar_subchan_mask will be used in the future to identify the
+		 * sub channel that encoutered radar pulses and block those
+		 * channels in NOL accordingly.
+		 */
+		rsu->radar_subchan_mask = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_2],
+					       RADAR_REPORT_PULSE_SUBCHAN_MASK);
+
+		rsu->pulse_height = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_3],
+						RADAR_REPORT_PULSE_HEIGHT);
+		rsu->triggering_agc_event =
+				MS(dfs3_rs[RADAR_REPORT_PULSE_REG_4],
+					RADAR_REPORT_TRIGGERING_AGC_EVENT);
+		rsu->pulse_rssi = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_4],
+						RADAR_REPORT_PULSE_RSSI);
+		rsu->radar_fft_pri80_inband_power =
+				MS(dfs3_rs[RADAR_REPORT_PULSE_REG_5],
+					RADAR_REPORT_FFT_PRI80_INBAND_POWER);
+		rsu->radar_fft_ext80_inband_power =
+				MS(dfs3_rs[RADAR_REPORT_PULSE_REG_5],
+					RADAR_REPORT_FFT_EXT80_INBAND_POWER);
+		rsu->radar_80p80_segid = MS(dfs3_rs[RADAR_REPORT_PULSE_REG_5],
+						RADAR_REPORT_80P80_SEGID);
+	} else {
+		/*
+		 * Since the TLVs may be unaligned for some reason
+		 * we take a private copy into aligned memory.
+		 * This enables us to use the HAL-like accessor macros
+		 * into the DWORDs to access sub-DWORD fields.
+		 */
+		OS_MEMCPY(rs, buf, sizeof(rs));
+
+		DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR,
+			"%s: two 32 bit values are: %08x %08x", __func__, rs[0],
+			rs[1]);
+		/*
+		 * DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR,
+				"%s (p=%p):", __func__, buf);
+		 */
+
+		is_chip_oversampling = PERE_IS_OVERSAMPLING(dfs);
+		/*
+		 * populate the version of the radar summary report
+		 * based on the TLV length to differentiate between
+		 * DFS-2 and DFS-3 radar summary report.
+		 */
+		rsu->rsu_version = DFS_RADAR_SUMMARY_REPORT_VERSION_2;
+
+		/* Populate the fields from the summary report */
+		rsu->tsf_offset =
+			MS(rs[RADAR_REPORT_PULSE_REG_2],
+				RADAR_REPORT_PULSE_TSF_OFFSET);
+		rsu->pulse_duration =
+			MS(rs[RADAR_REPORT_PULSE_REG_2],
+				RADAR_REPORT_PULSE_DUR);
+		rsu->is_chirp =
+			MS(rs[RADAR_REPORT_PULSE_REG_1],
+				RADAR_REPORT_PULSE_IS_CHIRP);
+		rsu->sidx =
+			sign_extend_32(MS(rs[RADAR_REPORT_PULSE_REG_1],
+						RADAR_REPORT_PULSE_SIDX), 10);
+		rsu->freq_offset =
+			calc_freq_offset(rsu->sidx, is_chip_oversampling);
+
+		/* These are only relevant if the pulse is a chirp */
+		rsu->delta_peak =
+			sign_extend_32(MS(rs[RADAR_REPORT_PULSE_REG_1],
+					RADAR_REPORT_PULSE_DELTA_PEAK), 6);
+		rsu->delta_diff =
+			MS(rs[RADAR_REPORT_PULSE_REG_1],
+				RADAR_REPORT_PULSE_DELTA_DIFF);
+
+		/* For false detection Debug */
+		rsu->agc_total_gain =
+			MS(rs[RADAR_REPORT_PULSE_REG_1],
+				RADAR_REPORT_AGC_TOTAL_GAIN);
+		rsu->agc_mb_gain =
+			MS(rs[RADAR_REPORT_PULSE_REG_2],
+				RADAR_REPORT_PULSE_AGC_MB_GAIN);
+
+	}
 
 	/* WAR for FCC Type 4 */
 	/*
@@ -441,19 +601,21 @@ static int tlv_calc_freq_info(struct ath_dfs *dfs, struct rx_radar_status *rs)
 
 	cdf_spin_lock_bh(&dfs->ic->chan_lock);
 	/*
-	 * For now, the only 11ac channel with freq1/freq2 setup is
-	 * VHT80.
-	 *
-	 * XXX should have a flag macro to check this!
+	 * calculate the channel center frequency for
+	 * 160MHz and 80p80 MHz including the legacy
+	 * channel widths.
 	 */
-	if (IEEE80211_IS_CHAN_11AC_VHT80(dfs->ic->ic_curchan)) {
+	if (IEEE80211_IS_CHAN_11AC_VHT160(dfs->ic->ic_curchan)) {
+		chan_centre = dfs->ic->ic_curchan->ic_vhtop_ch_freq_seg1;
+	} else if (IEEE80211_IS_CHAN_11AC_VHT80P80(dfs->ic->ic_curchan)) {
+		if (rs->radar_80p80_segid == DFS_80P80_SEG0)
+			chan_centre =
+				dfs->ic->ic_curchan->ic_vhtop_ch_freq_seg1;
+		else
+			chan_centre =
+				dfs->ic->ic_curchan->ic_vhtop_ch_freq_seg2;
+	} else if (IEEE80211_IS_CHAN_11AC_VHT80(dfs->ic->ic_curchan)) {
 		/* 11AC, so cfreq1/cfreq2 are setup */
-
-		/*
-		 * XXX if it's 80+80 this won't work - need to use seg
-		 * appropriately!
-		 */
-
 		chan_centre = dfs->ic->ic_curchan->ic_vhtop_ch_freq_seg1;
 	} else {
 		/* HT20/HT40 */
@@ -505,6 +667,18 @@ tlv_calc_event_freq_pulse(struct ath_dfs *dfs, struct rx_radar_status *rs,
 {
 	int chan_width;
 	int chan_centre;
+	int is_chip_oversampling;
+
+	/*
+	 * Oversampling needs to be turned on for
+	 * older chipsets that support DFS-2.
+	 * it needs to be turned off for chips
+	 * that support DFS-3.
+	 */
+	if (dfs->ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174)
+		is_chip_oversampling = 0;
+	else
+		is_chip_oversampling = PERE_IS_OVERSAMPLING(dfs);
 
 	/* Fetch the channel centre frequency in MHz */
 	chan_centre = tlv_calc_freq_info(dfs, rs);
@@ -517,7 +691,7 @@ tlv_calc_event_freq_pulse(struct ath_dfs *dfs, struct rx_radar_status *rs,
 	 * XXX this needs to take into account the core clock speed
 	 * XXX for half/quarter rate mode.
 	 */
-	if (PERE_IS_OVERSAMPLING(dfs))
+	if (is_chip_oversampling)
 		chan_width = (44000 * 2 / 128);
 	else
 		chan_width = (40000 * 2 / 128);
@@ -559,13 +733,25 @@ tlv_calc_event_freq_chirp(struct ath_dfs *dfs, struct rx_radar_status *rs,
 	int32_t total_bw;
 	int32_t chan_centre;
 	int32_t freq_1, freq_2;
+	int is_chip_oversampling;
+
+	/*
+	 * Oversampling needs to be turned on for
+	 * older chipsets that support DFS-2.
+	 * it needs to be turned off for chips
+	 * that support DFS-3.
+	 */
+	if (dfs->ic->dfs_hw_bd_id !=  DFS_HWBD_QCA6174)
+		is_chip_oversampling = 0;
+	else
+		is_chip_oversampling = PERE_IS_OVERSAMPLING(dfs);
 
 	/*
 	 * KHz isn't enough resolution here!
 	 * So treat it as deci-hertz (10Hz) and convert back to KHz
 	 * later.
 	 */
-	if (PERE_IS_OVERSAMPLING(dfs))
+	if (is_chip_oversampling)
 		bin_resolution = (44000 * 100) / 128;
 	else
 		bin_resolution = (40000 * 100) / 128;
@@ -691,6 +877,13 @@ dfs_process_phyerr_bb_tlv(struct ath_dfs *dfs, void *buf, uint16_t datalen,
 	e->is_ext = 0;
 	e->is_dc = 0;
 	e->is_early = 0;
+
+	/*
+	 * Copy the segment ID from the radar summary report
+	 * only when radar summary report version is DFS-3.
+	 */
+	if (rs.rsu_version == DFS_RADAR_SUMMARY_REPORT_VERSION_3)
+		e->radar_80p80_segid = rs.radar_80p80_segid;
 	/*
 	 * XXX TODO: add a "chirp detection enabled" capability or config
 	 * bit somewhere, in case for some reason the hardware chirp
diff --git a/core/sap/dfs/src/dfs_phyerr_tlv.h b/core/sap/dfs/src/dfs_phyerr_tlv.h
index d65375267cfd..61da81c3ad09 100644
--- a/core/sap/dfs/src/dfs_phyerr_tlv.h
+++ b/core/sap/dfs/src/dfs_phyerr_tlv.h
@@ -66,6 +66,13 @@
 
 #define TAG_ID_SEARCH_FFT_REPORT        0xFB
 #define TAG_ID_RADAR_PULSE_SUMMARY      0xF8
+
+/* DFS-2 Radar pulse summary Length */
+#define DFS2_RADAR_PULSE_SUMMARY_TLV_LENGTH   8
+
+/* DFS-3 Radar pulse summary length */
+#define DFS3_RADAR_PULSE_SUMMARY_TLV_LENGTH   20
+
 /*
  * Radar pulse summary
  *
@@ -110,6 +117,37 @@
 #define         RADAR_REPORT_PULSE_DUR                  0x000000FF
 #define         RADAR_REPORT_PULSE_DUR_S                0
 
+/*
+ * These are the new TLV's in the DFS-3
+ * radar summary report. Three new DWORDS
+ * have been added to radar summary report
+ * as part of DFS-3 as defined below.
+ */
+
+#define RADAR_REPORT_PULSE_REG_3        0x02
+
+#define         RADAR_REPORT_PULSE_HEIGHT               0x000003FF
+#define         RADAR_REPORT_PULSE_HEIGHT_S             0
+
+#define RADAR_REPORT_PULSE_REG_4        0x03
+
+#define         RADAR_REPORT_TRIGGERING_AGC_EVENT       0xC0000000
+#define         RADAR_REPORT_TRIGGERING_AGC_EVENT_S     30
+
+#define         RADAR_REPORT_PULSE_RSSI                 0X3FFC0000
+#define         RADAR_REPORT_PULSE_RSSI_S               18
+
+#define RADAR_REPORT_PULSE_REG_5        0x04
+
+#define         RADAR_REPORT_FFT_PRI80_INBAND_POWER     0x1FFF8000
+#define         RADAR_REPORT_FFT_PRI80_INBAND_POWER_S   15
+
+#define         RADAR_REPORT_FFT_EXT80_INBAND_POWER     0x00007FFE
+#define         RADAR_REPORT_FFT_EXT80_INBAND_POWER_S   1
+
+#define         RADAR_REPORT_80P80_SEGID                0x00000001
+#define         RADAR_REPORT_80P80_SEGID_S              0
+
 #define SEARCH_FFT_REPORT_REG_1     0x00
 
 #define         SEARCH_FFT_REPORT_TOTAL_GAIN_DB     0xFF800000
diff --git a/core/sap/dfs/src/dfs_process_phyerr.c b/core/sap/dfs/src/dfs_process_phyerr.c
index 38a49deb3766..0a806b4db8c4 100644
--- a/core/sap/dfs/src/dfs_process_phyerr.c
+++ b/core/sap/dfs/src/dfs_process_phyerr.c
@@ -737,6 +737,15 @@ dfs_process_phyerr(struct ieee80211com *ic, void *buf, uint16_t datalen,
 		event->re_chanindex = dfs->dfs_curchan_radindex;
 		event->re_flags = 0;
 		event->sidx = e.sidx;
+		/*
+		 * Copy the segment ID of the phyerror
+		 * from the radar summary report only
+		 * if SAP is operating in 80p80 mode
+		 * and both primary and extension segments
+		 * are DFS.
+		 */
+		if (chan->ic_80p80_both_dfs)
+			event->radar_80p80_segid = e.radar_80p80_segid;
 
 		/*
 		 * Handle chirp flags.
diff --git a/core/sap/dfs/src/dfs_process_radarevent.c b/core/sap/dfs/src/dfs_process_radarevent.c
index c5a586c10341..3c05d322707a 100644
--- a/core/sap/dfs/src/dfs_process_radarevent.c
+++ b/core/sap/dfs/src/dfs_process_radarevent.c
@@ -127,27 +127,31 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 	uint64_t deltafull_ts = 0, this_ts, deltaT;
 	struct dfs_ieee80211_channel *thischan;
 	struct dfs_pulseline *pl;
-	static uint32_t test_ts = 0;
 	static uint32_t diff_ts = 0;
 	int ext_chan_event_flag = 0;
 #if 0
 	int pri_multiplier = 2;
 #endif
 	int i;
+	int seg_id = DFS_80P80_SEG0;
+	struct dfs_delayline *dl;
 
 	if (dfs == NULL) {
 		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
 			  "%s[%d]: dfs is NULL", __func__, __LINE__);
 		return 0;
 	}
-	pl = dfs->pulses;
 	cdf_spin_lock_bh(&dfs->ic->chan_lock);
 	if (!(IEEE80211_IS_CHAN_DFS(dfs->ic->ic_curchan))) {
 		cdf_spin_unlock_bh(&dfs->ic->chan_lock);
 		DFS_DPRINTK(dfs, ATH_DEBUG_DFS2,
 			    "%s: radar event on non-DFS chan", __func__);
 		dfs_reset_radarq(dfs);
-		dfs_reset_alldelaylines(dfs);
+		dfs_reset_alldelaylines(dfs, DFS_80P80_SEG0);
+
+		if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+			dfs_reset_alldelaylines(dfs, DFS_80P80_SEG1);
+
 		return 0;
 	}
 
@@ -218,6 +222,12 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 		}
 		events_processed++;
 		re = *event;
+		if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+			seg_id = re.radar_80p80_segid;
+		else
+			seg_id = DFS_80P80_SEG0;
+
+		pl = (seg_id == 0) ? dfs->pulses : dfs->pulses_ext_seg;
 
 		OS_MEMZERO(event, sizeof(struct dfs_event));
 		ATH_DFSEVENTQ_LOCK(dfs);
@@ -375,8 +385,13 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 		pl->pl_elems[index].p_time = this_ts;
 		pl->pl_elems[index].p_dur = re.re_dur;
 		pl->pl_elems[index].p_rssi = re.re_rssi;
-		diff_ts = (uint32_t) this_ts - test_ts;
-		test_ts = (uint32_t) this_ts;
+		if (seg_id == 0) {
+			diff_ts = (uint32_t) this_ts - dfs->test_ts;
+			dfs->test_ts = (uint32_t) this_ts;
+		} else {
+			diff_ts = (u_int32_t)this_ts - dfs->test_ts_ext_seg;
+			dfs->test_ts_ext_seg = (u_int32_t)this_ts;
+		}
 		DFS_DPRINTK(dfs, ATH_DEBUG_DFS1,
 			    "ts%u %u %u diff %u pl->pl_lastelem.p_time=%llu",
 			    (uint32_t) this_ts, re.re_dur, re.re_rssi, diff_ts,
@@ -402,7 +417,7 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 		 * harsh environments, but helps with false detects. */
 
 		if (diff_ts < 100) {
-			dfs_reset_alldelaylines(dfs);
+			dfs_reset_alldelaylines(dfs, seg_id);
 			dfs_reset_radarq(dfs);
 		}
 		found = 0;
@@ -512,23 +527,36 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 			     p++) {
 				struct dfs_bin5radars *br;
 
-				br = &(dfs->dfs_b5radars[p]);
+				br = (seg_id == 0) ?
+					&(dfs->dfs_b5radars[p]) :
+					&(dfs->dfs_b5radars_ext_seg[p]);
+
 				if (dfs_bin5_check_pulse(dfs, &re, br)) {
-					/* This is a valid Bin5 pulse, check if it belongs to a burst */
+					/*
+					 * This is a valid Bin5 pulse,
+					 * check if it belongs to a burst
+					 */
 					re.re_dur =
-						dfs_retain_bin5_burst_pattern(dfs,
-									      diff_ts,
-									      re.
-									      re_dur);
-					/* Remember our computed duration for the next pulse in the burst (if needed) */
-					dfs->dfs_rinfo.dfs_bin5_chirp_ts =
-						this_ts;
-					dfs->dfs_rinfo.dfs_last_bin5_dur =
-						re.re_dur;
+					    dfs_retain_bin5_burst_pattern(dfs,
+						    diff_ts, re.re_dur, seg_id);
+					/*
+					 * Remember our computed duration for
+					 * the next pulse in the burst
+					 * (if needed)
+					 */
+					if (seg_id == 0)
+						dfs->dfs_rinfo.
+						    dfs_last_bin5_dur =
+								re.re_dur;
+					else
+						dfs->dfs_rinfo.
+						    dfs_last_bin5_dur_ext_seg =
+								re.re_dur;
 
 					if (dfs_bin5_addpulse
 						    (dfs, br, &re, this_ts)) {
-						found |= dfs_bin5_check(dfs);
+						found |= dfs_bin5_check(dfs,
+									seg_id);
 					}
 				} else {
 					DFS_DPRINTK(dfs,
@@ -607,19 +635,18 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 			for (p = 0, found = 0;
 			     (p < ft->ft_numfilters) && (!found); p++) {
 				rf = &(ft->ft_filters[p]);
+				dl = (seg_id == 0) ? &rf->rf_dl :
+						     &rf->rf_dl_ext_seg;
 				if ((re.re_dur >= rf->rf_mindur)
 				    && (re.re_dur <= rf->rf_maxdur)) {
 					/* The above check is probably not necessary */
 					deltaT =
-						(this_ts <
-						 rf->rf_dl.
-						 dl_last_ts)
-						? (int64_t) ((DFS_TSF_WRAP -
-							      rf->rf_dl.
-							      dl_last_ts) +
-							     this_ts +
-							     1) : this_ts -
-						rf->rf_dl.dl_last_ts;
+						(this_ts < dl->dl_last_ts) ?
+						    (int64_t)
+						    ((DFS_TSF_WRAP -
+						      dl->dl_last_ts) +
+						     this_ts + 1) :
+						    this_ts - dl->dl_last_ts;
 
 					if ((deltaT < rf->rf_minpri)
 					    && (deltaT != 0)) {
@@ -663,8 +690,8 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 								 long)deltaT,
 								rf->rf_minpri);
 							/* But update the last time stamp */
-							rf->rf_dl.dl_last_ts =
-								this_ts;
+							dl->dl_last_ts =
+									this_ts;
 							continue;
 						}
 					} else {
@@ -702,13 +729,13 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 								 long)deltaT,
 								rf->rf_minpri);
 							/* But update the last time stamp */
-							rf->rf_dl.dl_last_ts =
-								this_ts;
+							dl->dl_last_ts =
+									this_ts;
 							continue;
 						}
 					}
 					dfs_add_pulse(dfs, rf, &re, deltaT,
-						      this_ts);
+						      this_ts, seg_id);
 
 					/* If this is an extension channel event, flag it for false alarm reduction */
 					if (re.re_chanindex ==
@@ -717,25 +744,23 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 					}
 					if (rf->rf_patterntype == 2) {
 						found =
-							dfs_staggered_check(dfs, rf,
-									    (uint32_t)
-									    deltaT,
-									    re.
-									    re_dur);
+							dfs_staggered_check(dfs,
+							    rf,
+							    (uint32_t)deltaT,
+							    re.re_dur, seg_id);
 					} else {
 						found =
 							dfs_bin_check(dfs, rf,
-								      (uint32_t)
-								      deltaT,
-								      re.re_dur,
-								      ext_chan_event_flag);
+							    (uint32_t)deltaT,
+							    re.re_dur,
+							    ext_chan_event_flag,
+							    seg_id);
 					}
 					if (dfs->
 					    dfs_debug_mask & ATH_DEBUG_DFS2) {
-						dfs_print_delayline(dfs,
-								    &rf->rf_dl);
+						dfs_print_delayline(dfs, dl);
 					}
-					rf->rf_dl.dl_last_ts = this_ts;
+					dl->dl_last_ts = this_ts;
 				}
 			}
 			ft->ft_last_ts = this_ts;
@@ -746,9 +771,10 @@ int dfs_process_radarevent(struct ath_dfs *dfs,
 					    ft->ft_mindur,
 					    rf != NULL ? rf->rf_pulseid : -1);
 				CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO,
-					"%s[%d]:### Found on channel minDur = %d,filterId = %d ###",
+					"%s[%d]:### Found on channel minDur = %d,filterId = %d  seg_id = %d ###",
 					__func__,__LINE__,ft->ft_mindur,
-					rf != NULL ? rf->rf_pulseid : -1);
+					rf != NULL ? rf->rf_pulseid : -1,
+					seg_id);
 			}
 			tabledepth++;
 		}
@@ -761,10 +787,21 @@ dfsfound:
 		/* Collect stats */
 		dfs->ath_dfs_stats.num_radar_detects++;
 		thischan = &rs->rs_chan;
+
+		/*
+		 * Since we support 80p80 mode, indicate the
+		 * segment on which the radar has been detected.
+		 * only if both segments are dfs in 80p80 mode
+		 * and the radar is found on ext the segment
+		 * ic_radar_found_segid is to 1, in all other
+		 * cases it is set to 0.
+		 */
+		dfs->ic->ic_curchan->ic_radar_found_segid = seg_id;
+
 		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-			  "%s[%d]: ### RADAR FOUND ON CHANNEL %d (%d MHz) ###",
-			  __func__, __LINE__, thischan->ic_ieee,
-			  thischan->ic_freq);
+		  "%s[%d]:### RADAR FOUND ON CHANNEL %d (%d MHz),seg_id=%d ###",
+		  __func__, __LINE__, thischan->ic_ieee,
+		  thischan->ic_freq, seg_id);
 		DFS_PRINTK("Radar found on channel %d (%d MHz)",
 			   thischan->ic_ieee, thischan->ic_freq);
 
@@ -775,7 +812,22 @@ dfsfound:
 		ath_hal_setrxfilter(ah, rfilt);
 #endif
 		dfs_reset_radarq(dfs);
-		dfs_reset_alldelaylines(dfs);
+
+		/*
+		 * For now reset both segments
+		 * until we have changes for us
+		 * to do sub-channel marking which
+		 * enables SAP to continue to use the 80
+		 * segment where radar was not detected
+		 * and as a result CAC can be avoided on
+		 * that segment. Currently we do not support
+		 * sub-channel marking.
+		 */
+		dfs_reset_alldelaylines(dfs, DFS_80P80_SEG0);
+
+		if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+			dfs_reset_alldelaylines(dfs, DFS_80P80_SEG1);
+
 		/* XXX Should we really enable again? Maybe not... */
 /* No reason to re-enable so far - Ajay*/
 #if 0
diff --git a/core/sap/dfs/src/dfs_staggered.c b/core/sap/dfs/src/dfs_staggered.c
index 71c04b573b0a..cf00e741d1ad 100644
--- a/core/sap/dfs/src/dfs_staggered.c
+++ b/core/sap/dfs/src/dfs_staggered.c
@@ -96,7 +96,7 @@ static int is_unique_pri(uint32_t highestpri, uint32_t midpri,
 }
 
 int dfs_staggered_check(struct ath_dfs *dfs, struct dfs_filter *rf,
-			uint32_t deltaT, uint32_t width)
+			uint32_t deltaT, uint32_t width, int seg_id)
 {
 	uint32_t refpri, refdur, searchpri = 0, deltapri;       /* , averagerefpri; */
 	uint32_t n, i, primargin, durmargin;
@@ -112,7 +112,11 @@ int dfs_staggered_check(struct ath_dfs *dfs, struct dfs_filter *rf,
 	uint32_t midscore = 0, midscoreindex = 0, midpri = 0;
 	uint32_t highestscore = 0, highestscoreindex = 0, highestpri = 0;
 
-	dl = &rf->rf_dl;
+	if (dfs->ic->ic_curchan->ic_80p80_both_dfs)
+		dl = (seg_id == 0) ? &rf->rf_dl : &rf->rf_dl_ext_seg;
+	else
+		dl = &rf->rf_dl;
+
 	if (dl->dl_numelems < (rf->rf_threshold - 1)) {
 		DFS_DPRINTK(dfs, ATH_DEBUG_DFS2,
 			    "numelems %d < threshold for filter %d\n",
diff --git a/core/sap/inc/sap_api.h b/core/sap/inc/sap_api.h
index 50a42391ee24..e77d058822ea 100644
--- a/core/sap/inc/sap_api.h
+++ b/core/sap/inc/sap_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -69,11 +69,7 @@ extern "C" {
 #define       MAX_TEXT_SIZE                32
 
 #define       MAX_CHANNEL_LIST_LEN         256
-#ifdef WLAN_FEATURE_MBSSID
 #define       CDF_MAX_NO_OF_SAP_MODE       2    /* max # of SAP */
-#else
-#define       CDF_MAX_NO_OF_SAP_MODE       1    /* max # of SAP */
-#endif
 #define       SAP_MAX_NUM_SESSION          5
 #define       SAP_MAX_OBSS_STA_CNT         1    /* max # of OBSS STA */
 #define       SAP_ACS_WEIGHT_MAX           (4444)
@@ -158,7 +154,6 @@ typedef enum {
 	eSAP_GET_WPSPBC_SESSION_EVENT,
 	/* Event send on WPS PBC probe request is received */
 	eSAP_WPS_PBC_PROBE_REQ_EVENT,
-	eSAP_INDICATE_MGMT_FRAME,
 	eSAP_REMAIN_CHAN_READY,
 	eSAP_SEND_ACTION_CNF,
 	eSAP_DISCONNECT_ALL_P2P_CLIENT,
@@ -448,8 +443,6 @@ typedef struct sap_Event_s {
 		tSap_GetWPSPBCSessionEvent sapGetWPSPBCSessionEvent;
 		/*eSAP_WPS_PBC_PROBE_REQ_EVENT */
 		tSap_WPSPBCProbeReqEvent sapPBCProbeReqEvent;
-		/*eSAP_INDICATE_MGMT_FRAME */
-		tSap_ManagementFrameInfo sapManagementFrameInfo;
 		/* eSAP_SEND_ACTION_CNF */
 		tSap_SendActionCnf sapActionCnf;
 		/* eSAP_UNKNOWN_STA_JOIN */
@@ -539,7 +532,7 @@ typedef struct sap_Config {
 	uint32_t ap_table_max_size;
 	uint32_t ap_table_expiration_time;
 	uint32_t ht_op_mode_fixed;
-	tCDF_CON_MODE persona; /* Tells us which persona its GO or AP for now */
+	enum tCDF_ADAPTER_MODE persona; /* Tells us which persona, GO or AP */
 	uint8_t disableDFSChSwitch;
 	bool enOverLapCh;
 #ifdef WLAN_FEATURE_11W
@@ -628,10 +621,9 @@ typedef struct sSapDfsInfo {
 	 * New channel width and new channel bonding mode
 	 * will only be updated via channel fallback mechanism
 	 */
-	uint8_t orig_cbMode;
-	uint8_t orig_chanWidth;
-	uint8_t new_chanWidth;
-	uint8_t new_cbMode;
+	phy_ch_width orig_chanWidth;
+	phy_ch_width new_chanWidth;
+	chan_params_t new_ch_params;
 
 	/*
 	 * INI param to enable/disable SAP W53
@@ -671,7 +663,7 @@ typedef struct sSapDfsInfo {
 typedef struct tagSapCtxList {
 	uint8_t sessionID;
 	void *pSapContext;
-	tCDF_CON_MODE sapPersona;
+	enum tCDF_ADAPTER_MODE sapPersona;
 } tSapCtxList, tpSapCtxList;
 
 typedef struct tagSapStruct {
@@ -798,8 +790,7 @@ typedef struct sap_SoftapStats_s {
 	uint32_t pktCounterRssi[MAX_NUM_RSSI];
 #endif
 } tSap_SoftapStats, *tpSap_SoftapStats;
-/* Channel/Frequency table */
-extern const tRfChannelProps rf_channels[NUM_RF_CHANNELS];
+
 #ifdef FEATURE_WLAN_CH_AVOID
 /* Store channel safety information */
 typedef struct {
@@ -807,23 +798,14 @@ typedef struct {
 	bool isSafe;
 } sapSafeChannelType;
 #endif /* FEATURE_WLAN_CH_AVOID */
-#ifdef WLAN_FEATURE_MBSSID
 void sap_cleanup_channel_list(void *sapContext);
-#else
-void sap_cleanup_channel_list(void);
-#endif
 void sapCleanupAllChannelList(void);
 CDF_STATUS wlansap_set_wps_ie(void *p_cds_gctx, tSap_WPSIE *pWPSIe);
 CDF_STATUS wlansap_update_wps_ie(void *p_cds_gctx);
 CDF_STATUS wlansap_stop_Wps(void *p_cds_gctx);
 CDF_STATUS wlansap_get_wps_state(void *p_cds_gctx, bool *pbWPSState);
 
-#ifdef WLAN_FEATURE_MBSSID
-void *
-#else
-CDF_STATUS
-#endif
-wlansap_open(void *p_cds_gctx);
+void *wlansap_open(void *p_cds_gctx);
 CDF_STATUS wlansap_start(void *p_cds_gctx);
 CDF_STATUS wlansap_stop(void *p_cds_gctx);
 CDF_STATUS wlansap_close(void *p_cds_gctx);
@@ -845,7 +827,7 @@ CDF_STATUS wlansap_disassoc_sta(void *p_cds_gctx,
 CDF_STATUS wlansap_deauth_sta(void *p_cds_gctx,
 			struct tagCsrDelStaParams *pDelStaParams);
 CDF_STATUS wlansap_set_channel_change_with_csa(void *p_cds_gctx,
-			uint32_t targetChannel);
+			uint32_t targetChannel, phy_ch_width target_bw);
 CDF_STATUS wlansap_set_key_sta(void *p_cds_gctx,
 	tCsrRoamSetKey *pSetKeyInfo);
 CDF_STATUS wlansap_get_assoc_stations(void *p_cds_gctx,
@@ -924,6 +906,7 @@ CDF_STATUS wlansap_acs_chselect(void *pvos_gctx,
 		tpWLAN_SAPEventCB pacs_event_callback,
 		tsap_Config_t *pconfig,
 		void *pusr_context);
+eCsrPhyMode wlansap_get_phymode(void *pctx);
 #ifdef __cplusplus
 }
 #endif
diff --git a/core/sap/src/sap_api_link_cntl.c b/core/sap/src/sap_api_link_cntl.c
index 381f444d640b..0474e2120f14 100644
--- a/core/sap/src/sap_api_link_cntl.c
+++ b/core/sap/src/sap_api_link_cntl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -888,11 +888,6 @@ wlansap_roam_callback(void *ctx, tCsrRoamInfo *csr_roam_info, uint32_t roamId,
 			  FL("CSR roam_status = eCSR_ROAM_WPS_PBC_PROBE_REQ_IND (%d)\n"),
 			  roam_status);
 		break;
-	case eCSR_ROAM_INDICATE_MGMT_FRAME:
-		sap_signal_hdd_event(sap_ctx, csr_roam_info,
-				     eSAP_INDICATE_MGMT_FRAME,
-				     (void *) eSAP_STATUS_SUCCESS);
-		break;
 	case eCSR_ROAM_REMAIN_CHAN_READY:
 		/* roamId contains scan identifier */
 		sap_ctx->roc_ind_scan_id = csr_roam_info->roc_scan_id;
diff --git a/core/sap/src/sap_ch_select.c b/core/sap/src/sap_ch_select.c
index 9e7aabc01787..4ed3b3636314 100644
--- a/core/sap/src/sap_ch_select.c
+++ b/core/sap/src/sap_ch_select.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -114,20 +114,6 @@ sapSafeChannelType safe_channels[NUM_20MHZ_RF_CHANNELS] = {
 	,                       /* RF_CHAN_13, */
 	{14, true}
 	,                       /* RF_CHAN_14, */
-	{240, true}
-	,                       /* RF_CHAN_240, */
-	{244, true}
-	,                       /* RF_CHAN_244, */
-	{248, true}
-	,                       /* RF_CHAN_248, */
-	{252, true}
-	,                       /* RF_CHAN_252, */
-	{208, true}
-	,                       /* RF_CHAN_208, */
-	{212, true}
-	,                       /* RF_CHAN_212, */
-	{216, true}
-	,                       /* RF_CHAN_216, */
 	{36, true}
 	,                       /* RF_CHAN_36, */
 	{40, true}
@@ -434,8 +420,7 @@ void sap_update_unsafe_channel_list(ptSapContext pSapCtx)
 	}
 
 	/* Try to find unsafe channel */
-#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) || \
-	defined(WLAN_FEATURE_MBSSID)
+#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE)
 	for (i = 0; i < NUM_20MHZ_RF_CHANNELS; i++) {
 		if (pSapCtx->dfs_ch_disable == true) {
 			if (CDS_IS_DFS_CH(safe_channels[i].channelNumber)) {
@@ -501,16 +486,8 @@ void sap_update_unsafe_channel_list(ptSapContext pSapCtx)
     NULL
    ============================================================================*/
 
-void sap_cleanup_channel_list(
-#ifdef WLAN_FEATURE_MBSSID
-	void *p_cds_gctx
-#else
-	void
-#endif
-	) {
-#ifndef WLAN_FEATURE_MBSSID
-	void *p_cds_gctx = cds_get_global_context();
-#endif
+void sap_cleanup_channel_list(void *p_cds_gctx)
+{
 	ptSapContext pSapCtx;
 
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO,
@@ -647,7 +624,7 @@ bool sap_chan_sel_init(tHalHandle halHandle,
 
 	pChans = pMac->scan.base_channels.channelList;
 
-#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) || defined(WLAN_FEATURE_MBSSID)
+#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE)
 	if (pSapCtx->dfs_ch_disable == true)
 		include_dfs_ch = false;
 #endif
@@ -2039,7 +2016,7 @@ uint8_t sap_select_channel(tHalHandle halHandle, ptSapContext pSapCtx,
 			if ((safe_channels[i].channelNumber >= startChannelNum)
 			    && (safe_channels[i].channelNumber <=
 				endChannelNum)) {
-				CHANNEL_STATE channel_type =
+				enum channel_state channel_type =
 					cds_get_channel_state(safe_channels[i].
 						channelNumber);
 
diff --git a/core/sap/src/sap_fsm.c b/core/sap/src/sap_fsm.c
index b14deb41f103..377cd0861431 100644
--- a/core/sap/src/sap_fsm.c
+++ b/core/sap/src/sap_fsm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -818,7 +818,6 @@ static uint8_t *sap_hdd_event_to_string(eSapHddEvent event)
 	CASE_RETURN_STRING(eSAP_ASSOC_STA_CALLBACK_EVENT);
 	CASE_RETURN_STRING(eSAP_GET_WPSPBC_SESSION_EVENT);
 	CASE_RETURN_STRING(eSAP_WPS_PBC_PROBE_REQ_EVENT);
-	CASE_RETURN_STRING(eSAP_INDICATE_MGMT_FRAME);
 	CASE_RETURN_STRING(eSAP_REMAIN_CHAN_READY);
 	CASE_RETURN_STRING(eSAP_SEND_ACTION_CNF);
 	CASE_RETURN_STRING(eSAP_DISCONNECT_ALL_P2P_CLIENT);
@@ -879,23 +878,19 @@ static inline void sap_event_init(ptWLAN_SAPEvent sapEvent)
 
 #ifdef WLAN_ENABLE_CHNL_MATRIX_RESTRICTION
 /*
- * This function gives the leakage matrix for given NOL channel and cbMode
+ * sap_find_target_channel_in_channel_matrix() - finds the leakage matrix
+ * @sapContext: Pointer to vos global context structure
+ * @ch_width: target channel width
+ * @NOL_channel: the NOL channel whose leakage matrix is required
+ * @pTarget_chnl_mtrx: pointer to target channel matrix returned.
  *
- * PARAMETERS
- * IN
- * sapContext        : Pointer to vos global context structure
- * cbMode            : target channel bonding mode
- * NOL_channel       : the NOL channel whose leakage matrix is required
- * pTarget_chnl_mtrx : pointer to target channel matrix returned.
+ * This function gives the leakage matrix for given NOL channel and ch_width
  *
- * RETURN VALUE
- * BOOLEAN
- * TRUE:  leakage matrix was found
- * FALSE: leakage matrix was not found
+ * Return: TRUE or FALSE
  */
 bool
 sap_find_target_channel_in_channel_matrix(ptSapContext sapContext,
-					  ePhyChanBondState cbMode,
+					  phy_ch_width ch_width,
 					  uint8_t NOL_channel,
 					  tSapTxLeakInfo **pTarget_chnl_mtrx)
 {
@@ -904,28 +899,22 @@ sap_find_target_channel_in_channel_matrix(ptSapContext sapContext,
 	uint32_t nchan_matrix;
 	int i = 0;
 
-	switch (cbMode) {
-	case PHY_SINGLE_CHANNEL_CENTERED:
+	switch (ch_width) {
+	case CH_WIDTH_20MHZ:
 		/* HT20 */
 		pchan_matrix = ht20_chan;
 		nchan_matrix = CDF_ARRAY_SIZE(ht20_chan);
 		break;
-	case PHY_DOUBLE_CHANNEL_HIGH_PRIMARY:
-	case PHY_DOUBLE_CHANNEL_LOW_PRIMARY:
+	case CH_WIDTH_40MHZ:
 		/* HT40 */
 		pchan_matrix = ht40_chan;
 		nchan_matrix = CDF_ARRAY_SIZE(ht40_chan);
 		break;
-#ifdef WLAN_FEATURE_11AC
-	case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
-	case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
-	case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
-	case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
+	case CH_WIDTH_80MHZ:
 		/* HT80 */
 		pchan_matrix = ht80_chan;
 		nchan_matrix = CDF_ARRAY_SIZE(ht80_chan);
 		break;
-#endif
 	default:
 		/* handle exception and fall back to HT20 table */
 		pchan_matrix = ht20_chan;
@@ -952,7 +941,7 @@ sap_find_target_channel_in_channel_matrix(ptSapContext sapContext,
 /**
  * sap_mark_channels_leaking_into_nol() - to mark channel leaking in to nol
  * @sap_ctx: pointer to SAP context
- * @cb_mode: channel bonding mode
+ * @ch_width: channel width
  * @nol: nol info
  * @temp_ch_lst_sz: the target channel list
  * @temp_ch_lst: the target channel list
@@ -966,7 +955,7 @@ sap_find_target_channel_in_channel_matrix(ptSapContext sapContext,
 
 CDF_STATUS
 sap_mark_channels_leaking_into_nol(ptSapContext sap_ctx,
-		ePhyChanBondState cb_mode,
+		phy_ch_width ch_width,
 		tSapDfsNolInfo *nol,
 		uint8_t temp_ch_lst_sz,
 		uint8_t *temp_ch_lst)
@@ -991,7 +980,7 @@ sap_mark_channels_leaking_into_nol(ptSapContext sap_ctx,
 			FL("sapdfs: processing NOL channel: %d"),
 			dfs_nol_channel);
 		if (false == sap_find_target_channel_in_channel_matrix(
-					sap_ctx, cb_mode, dfs_nol_channel,
+					sap_ctx, ch_width, dfs_nol_channel,
 					&target_chan_matrix)) {
 			/*
 			 * should never happen, we should always find a table
@@ -1067,9 +1056,9 @@ static void sap_set_bitmap(chan_bonding_bitmap *pBitmap, uint8_t channel)
 }
 
 /**
- * sap_populate_available_channels - To populate available channel
+ * sap_populate_available_channels() - To populate available channel
  * @bitmap: bitmap to populate
- * @current_cbmode: cb mode to check for channel availability
+ * @ch_width: channel width
  * @avail_chnl: available channel list to populate
  *
  * This function reads the bitmap and populates available channel
@@ -1080,20 +1069,16 @@ static void sap_set_bitmap(chan_bonding_bitmap *pBitmap, uint8_t channel)
  * Return: number of channels found
  */
 static uint8_t sap_populate_available_channels(chan_bonding_bitmap *bitmap,
-		ePhyChanBondState current_cbmode,
+		phy_ch_width ch_width,
 		uint8_t *avail_chnl)
 {
 	uint8_t i = 0;
 	uint8_t chnl_count = 0;
 	uint8_t start_channel = 0;
 
-	switch (current_cbmode) {
-#ifdef WLAN_FEATURE_11AC
-	/* HT80 */
-	case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
-	case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
-	case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
-	case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
+	switch (ch_width) {
+	/* VHT80 */
+	case CH_WIDTH_80MHZ:
 		for (i = 0; i < MAX_80MHZ_BANDS; i++) {
 			start_channel = bitmap->chanBondingSet[i].startChannel;
 			if (bitmap->chanBondingSet[i].channelMap ==
@@ -1105,10 +1090,8 @@ static uint8_t sap_populate_available_channels(chan_bonding_bitmap *bitmap,
 			}
 		}
 		break;
-#endif
 	/* HT40 */
-	case PHY_DOUBLE_CHANNEL_HIGH_PRIMARY:
-	case PHY_DOUBLE_CHANNEL_LOW_PRIMARY:
+	case CH_WIDTH_40MHZ:
 		for (i = 0; i < MAX_80MHZ_BANDS; i++) {
 			start_channel = bitmap->chanBondingSet[i].startChannel;
 			if ((bitmap->chanBondingSet[i].channelMap &
@@ -1263,8 +1246,7 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 	uint8_t channelID;
 	tHalHandle hHal = CDS_GET_HAL_CB(sapContext->p_cds_gctx);
 	tpAniSirGlobal pMac;
-	uint32_t chanWidth;
-	ePhyChanBondState cbModeCurrent;
+	phy_ch_width ch_width;
 	uint8_t   *tmp_ch_lst = NULL;
 	uint8_t   dfs_region;
 
@@ -1286,25 +1268,12 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 	 * use the stored original value when you call this function next time
 	 * so fall back mechanism always starts with original ini value.
 	 */
-	if (pMac->sap.SapDfsInfo.orig_cbMode == 0) {
-		pMac->sap.SapDfsInfo.orig_cbMode =
-			(sapContext->ch_width_orig > CH_WIDTH_20MHZ ? 1 : 0);
-		cbModeCurrent = pMac->sap.SapDfsInfo.orig_cbMode;
-	} else {
-		cbModeCurrent = pMac->sap.SapDfsInfo.orig_cbMode;
-	}
-
-	/*
-	 * Retrieve the original one and store it.
-	 * use the stored original value when you call this function next time
-	 * so fall back mechanism always starts with original ini value.
-	 */
 	if (pMac->sap.SapDfsInfo.orig_chanWidth == 0) {
 		pMac->sap.SapDfsInfo.orig_chanWidth =
 					sapContext->ch_width_orig;
-		chanWidth = pMac->sap.SapDfsInfo.orig_chanWidth;
+		ch_width = pMac->sap.SapDfsInfo.orig_chanWidth;
 	} else {
-		chanWidth = pMac->sap.SapDfsInfo.orig_chanWidth;
+		ch_width = pMac->sap.SapDfsInfo.orig_chanWidth;
 	}
 
 	if (sap_get5_g_hz_channel_list(sapContext)) {
@@ -1472,7 +1441,7 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 			  );
 		if (CDF_STATUS_SUCCESS !=
 			sap_mark_channels_leaking_into_nol(sapContext,
-							   cbModeCurrent,
+							   ch_width,
 							   nol,
 							   valid_chnl_count,
 							   tmp_ch_lst)) {
@@ -1506,8 +1475,7 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 				 * for 20MHz, directly create available
 				 * channel list
 				 */
-				if (cbModeCurrent ==
-					PHY_SINGLE_CHANNEL_CENTERED) {
+				if (ch_width == CH_WIDTH_20MHZ) {
 					CDF_TRACE(CDF_MODULE_ID_SAP,
 						  CDF_TRACE_LEVEL_DEBUG,
 						  FL
@@ -1530,18 +1498,17 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 		 * if 40 MHz or 80 MHz, populate available
 		 * channel list from bitmap
 		 */
-		if (cbModeCurrent != PHY_SINGLE_CHANNEL_CENTERED) {
+		if (ch_width != CH_WIDTH_20MHZ) {
 			available_ch_cnt =
 				sap_populate_available_channels(&channelBitmap,
-							cbModeCurrent,
+							ch_width,
 							availableChannels);
 			/*
 			 * if no valid channel bonding found,
 			 * fallback to lower bandwidth
 			 */
 			if (available_ch_cnt == 0) {
-				if (cbModeCurrent >=
-				    PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED) {
+				if (ch_width == CH_WIDTH_80MHZ) {
 					CDF_TRACE(CDF_MODULE_ID_SAP,
 						  CDF_TRACE_LEVEL_WARN,
 						  FL
@@ -1550,22 +1517,12 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 						  CDF_TRACE_LEVEL_WARN,
 						  FL
 						  ("sapdfs:Changing chanWidth from [%d] to [%d]"),
-						  chanWidth,
+						  ch_width,
 						  CH_WIDTH_40MHZ);
-					CDF_TRACE(CDF_MODULE_ID_SAP,
-						  CDF_TRACE_LEVEL_WARN,
-						  FL
-						  ("sapdfs:Changing CB mode from [%d] to [%d]"),
-						  cbModeCurrent,
-						  PHY_DOUBLE_CHANNEL_LOW_PRIMARY
-						  );
-					cbModeCurrent =
-						PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
-					chanWidth = CH_WIDTH_40MHZ;
+					ch_width = CH_WIDTH_40MHZ;
 					/* continue to start of do loop */
 					continue;
-				} else if (cbModeCurrent >=
-					   PHY_DOUBLE_CHANNEL_LOW_PRIMARY) {
+				} else if (ch_width == CH_WIDTH_40MHZ) {
 					CDF_TRACE(CDF_MODULE_ID_SAP,
 						  CDF_TRACE_LEVEL_WARN,
 						  FL
@@ -1574,17 +1531,9 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 						  CDF_TRACE_LEVEL_WARN,
 						  FL
 						  ("sapdfs:Changing chanWidth from [%d] to [%d]"),
-						  chanWidth,
+						  ch_width,
 						  CH_WIDTH_20MHZ);
-					CDF_TRACE(CDF_MODULE_ID_SAP,
-						  CDF_TRACE_LEVEL_WARN,
-						  FL
-						  ("sapdfs:Changing CB mode from [%d] to [%d]"),
-						  cbModeCurrent,
-						  PHY_SINGLE_CHANNEL_CENTERED);
-					cbModeCurrent =
-						PHY_SINGLE_CHANNEL_CENTERED;
-					chanWidth = CH_WIDTH_20MHZ;
+					ch_width = CH_WIDTH_20MHZ;
 					/* continue to start of do loop */
 					continue;
 				}
@@ -1630,12 +1579,7 @@ static uint8_t sap_random_channel_sel(ptSapContext sapContext)
 			target_channel = avail_dfs_chan_list[i];
 		}
 
-		pMac->sap.SapDfsInfo.new_chanWidth = chanWidth;
-		pMac->sap.SapDfsInfo.new_cbMode = cbModeCurrent;
-		CDF_TRACE(CDF_MODULE_ID_SAP,
-				CDF_TRACE_LEVEL_INFO_LOW,
-				FL("sapdfs: New CB mode = %d"),
-				pMac->sap.SapDfsInfo.new_cbMode);
+		pMac->sap.SapDfsInfo.new_chanWidth = ch_width;
 		CDF_TRACE(CDF_MODULE_ID_SAP,
 				CDF_TRACE_LEVEL_INFO_LOW,
 				FL("sapdfs: New Channel width = %d"),
@@ -2037,11 +1981,11 @@ CDF_STATUS sap_goto_channel_sel(ptSapContext sap_context,
 			  FL("invalid h_hal"));
 		return CDF_STATUS_E_FAULT;
 	}
-#ifdef WLAN_FEATURE_MBSSID
+
 	if (cds_concurrent_beaconing_sessions_running()) {
 		con_ch =
 			sme_get_concurrent_operation_channel(h_hal);
-
+#ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
 		if (con_ch && sap_context->channel == AUTO_CHANNEL_SELECT) {
 			sap_context->dfs_ch_disable = true;
 		} else if (con_ch && sap_context->channel != con_ch &&
@@ -2050,6 +1994,7 @@ CDF_STATUS sap_goto_channel_sel(ptSapContext sap_context,
 				  FL("MCC DFS not supported in AP_AP Mode"));
 			return CDF_STATUS_E_ABORTED;
 		}
+#endif
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
 		if (sap_context->cc_switch_mode !=
 						CDF_MCC_TO_SCC_SWITCH_DISABLE) {
@@ -2067,7 +2012,6 @@ CDF_STATUS sap_goto_channel_sel(ptSapContext sap_context,
 		}
 #endif
 	}
-#endif
 
 	if (cds_get_concurrency_mode() == (CDF_STA_MASK | CDF_SAP_MASK)) {
 #ifdef FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE
@@ -2516,7 +2460,6 @@ CDF_STATUS sap_signal_hdd_event(ptSapContext sap_ctx,
 	tSap_StationDisassocCompleteEvent *disassoc_comp;
 	tSap_StationSetKeyCompleteEvent *key_complete;
 	tSap_StationMICFailureEvent *mic_failure;
-	tSap_ManagementFrameInfo *mgmt_frame;
 
 	/* Format the Start BSS Complete event to return... */
 	if (NULL == sap_ctx->pfnSapEventCallback) {
@@ -2732,16 +2675,6 @@ CDF_STATUS sap_signal_hdd_event(ptSapContext sap_ctx,
 			     sizeof(tSirWPSPBCProbeReq));
 		break;
 
-	case eSAP_INDICATE_MGMT_FRAME:
-		sap_ap_event.sapHddEventCode = eSAP_INDICATE_MGMT_FRAME;
-		mgmt_frame = &sap_ap_event.sapevt.sapManagementFrameInfo;
-
-		mgmt_frame->nFrameLength = csr_roaminfo->nFrameLength;
-		mgmt_frame->pbFrames = csr_roaminfo->pbFrames;
-		mgmt_frame->frameType = csr_roaminfo->frameType;
-		mgmt_frame->rxChan = csr_roaminfo->rxChan;
-		break;
-
 	case eSAP_REMAIN_CHAN_READY:
 		sap_ap_event.sapHddEventCode = eSAP_REMAIN_CHAN_READY;
 		sap_ap_event.sapevt.sap_roc_ind.scan_id =
@@ -3318,7 +3251,6 @@ static CDF_STATUS sap_fsm_state_ch_select(ptSapContext sap_ctx,
 						eCSR_DOT11_MODE_11g_ONLY))
 			sap_ctx->csr_roamProfile.phyMode = eCSR_DOT11_MODE_11a;
 
-#ifdef WLAN_FEATURE_MBSSID
 		/*
 		 * when AP2 is started while AP1 is performing ACS, we may not
 		 * have the AP1 channel yet.So here after the completion of AP2
@@ -3332,7 +3264,7 @@ static CDF_STATUS sap_fsm_state_ch_select(ptSapContext sap_ctx,
 			if (con_ch && CDS_IS_DFS_CH(con_ch))
 				sap_ctx->channel = con_ch;
 		}
-#endif
+
 		/*
 		 * Transition from eSAP_CH_SELECT to eSAP_STARTING
 		 * (both without substates)
@@ -4252,8 +4184,8 @@ static CDF_STATUS sap_get_channel_list(ptSapContext sap_ctx,
 	for (loop_count = band_start_ch; loop_count <= band_end_ch;
 	     loop_count++) {
 		/* go to next channel if rf_channel is out of range */
-		if ((start_ch_num > rf_channels[loop_count].channelNum) ||
-		    (end_ch_num < rf_channels[loop_count].channelNum))
+		if ((start_ch_num > CDS_CHANNEL_NUM(loop_count)) ||
+		    (end_ch_num < CDS_CHANNEL_NUM(loop_count)))
 			continue;
 		/*
 		 * go to next channel if none of these condition pass
@@ -4261,22 +4193,22 @@ static CDF_STATUS sap_get_channel_list(ptSapContext sap_ctx,
 		 * - DFS scan disable but chan in CHANNEL_STATE_ENABLE
 		 */
 		if (!(((eSAP_TRUE == mac_ctx->scan.fEnableDFSChnlScan) &&
-		     (reg_channels[loop_count].enabled)) ||
+		      CDS_CHANNEL_STATE(loop_count)) ||
 		    ((eSAP_FALSE == mac_ctx->scan.fEnableDFSChnlScan) &&
 		     (CHANNEL_STATE_ENABLE ==
-		      reg_channels[loop_count].enabled))))
+		      CDS_CHANNEL_STATE(loop_count)))))
 			continue;
 
 #ifdef FEATURE_WLAN_CH_AVOID
 		for (i = 0; i < NUM_20MHZ_RF_CHANNELS; i++) {
 			if ((safe_channels[i].channelNumber ==
-			     rf_channels[loop_count].channelNum)) {
+			     CDS_CHANNEL_NUM(loop_count))) {
 				/* Check if channel is safe */
 				if (true == safe_channels[i].isSafe) {
 #endif
 #ifdef FEATURE_WLAN_AP_AP_ACS_OPTIMIZE
 		uint8_t ch;
-		ch = rf_channels[loop_count].channelNum;
+		ch = CDS_CHANNEL_NUM(loop_count);
 		if ((sap_ctx->acs_cfg->skip_scan_status ==
 			eSAP_DO_PAR_ACS_SCAN)) {
 		    if ((ch >= sap_ctx->acs_cfg->skip_scan_range1_stch &&
@@ -4284,7 +4216,7 @@ static CDF_STATUS sap_get_channel_list(ptSapContext sap_ctx,
 			(ch >= sap_ctx->acs_cfg->skip_scan_range2_stch &&
 			 ch <= sap_ctx->acs_cfg->skip_scan_range2_endch)) {
 			list[ch_count] =
-				rf_channels[loop_count].channelNum;
+				CDS_CHANNEL_NUM(loop_count);
 			ch_count++;
 			CDF_TRACE(CDF_MODULE_ID_SAP,
 				CDF_TRACE_LEVEL_INFO,
@@ -4298,7 +4230,7 @@ static CDF_STATUS sap_get_channel_list(ptSapContext sap_ctx,
 		    }
 		} else {
 			list[ch_count] =
-				rf_channels[loop_count].channelNum;
+				CDS_CHANNEL_NUM(loop_count);
 			ch_count++;
 			CDF_TRACE(CDF_MODULE_ID_SAP,
 				CDF_TRACE_LEVEL_INFO,
@@ -4306,7 +4238,7 @@ static CDF_STATUS sap_get_channel_list(ptSapContext sap_ctx,
 				ch_count, ch);
 		}
 #else
-		list[ch_count] = rf_channels[loop_count].channelNum;
+		list[ch_count] = CDS_CHANNEL_NUM(loop_count);
 		ch_count++;
 #endif
 #ifdef FEATURE_WLAN_CH_AVOID
@@ -4374,10 +4306,10 @@ static CDF_STATUS sap_get5_g_hz_channel_list(ptSapContext sapContext)
 	}
 
 	for (i = RF_CHAN_36; i <= RF_CHAN_165; i++) {
-		if (reg_channels[i].enabled == CHANNEL_STATE_ENABLE ||
-		    reg_channels[i].enabled == CHANNEL_STATE_DFS) {
+		if (CDS_CHANNEL_STATE(i) == CHANNEL_STATE_ENABLE ||
+		    CDS_CHANNEL_STATE(i) == CHANNEL_STATE_DFS) {
 			sapContext->SapAllChnlList.channelList[count].channel =
-				rf_channels[i].channelNum;
+				CDS_CHANNEL_NUM(i);
 			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_LOW,
 				  "%s[%d] CHANNEL = %d", __func__, __LINE__,
 				  sapContext->SapAllChnlList.channelList[count].
@@ -4669,12 +4601,12 @@ CDF_STATUS sap_init_dfs_channel_nol_list(ptSapContext sapContext)
 	}
 
 	for (i = RF_CHAN_36; i <= RF_CHAN_165; i++) {
-		if (reg_channels[i].enabled == CHANNEL_STATE_DFS) {
+		if (CDS_CHANNEL_STATE(i) == CHANNEL_STATE_DFS) {
 			/* if dfs nol is not found, initialize it */
 			if (!bFound) {
 				pMac->sap.SapDfsInfo.sapDfsChannelNolList[count]
 				.dfs_channel_number =
-					rf_channels[i].channelNum;
+					CDS_CHANNEL_NUM(i);
 
 				CDF_TRACE(CDF_MODULE_ID_SAP,
 					  CDF_TRACE_LEVEL_INFO_LOW,
diff --git a/core/sap/src/sap_internal.h b/core/sap/src/sap_internal.h
index a94c251c581b..1abf9c8e3216 100644
--- a/core/sap/src/sap_internal.h
+++ b/core/sap/src/sap_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -58,13 +58,9 @@ extern "C" {
 #define SAP_DEBUG
 /* Used to enable or disable security on the BT-AMP link */
 #define WLANSAP_SECURITY_ENABLED_STATE true
-#ifdef WLAN_FEATURE_MBSSID
+
 /* When MBSSID feature is enabled, SAP context is directly passed to SAP APIs */
 #define CDS_GET_SAP_CB(ctx) (ptSapContext)(ctx)
-#else
-/* How do I get SAP context from cds context? */
-#define CDS_GET_SAP_CB(ctx) cds_get_context(CDF_MODULE_ID_SAP)
-#endif
 
 #define CDS_GET_HAL_CB(ctx) cds_get_context(CDF_MODULE_ID_PE)
 /* MAC Address length */
@@ -80,8 +76,6 @@ extern "C" {
 #define SAP_CHAN_PREFERRED_INDOOR  1
 #define SAP_CHAN_PREFERRED_OUTDOOR 2
 
-extern const sRegulatoryChannel *reg_channels;
-
 /*----------------------------------------------------------------------------
  *  Typedefs
  * -------------------------------------------------------------------------*/
@@ -239,8 +233,7 @@ typedef struct sSapContext {
 	uint8_t cc_switch_mode;
 #endif
 
-#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE) || \
-	defined(WLAN_FEATURE_MBSSID)
+#if defined(FEATURE_WLAN_STA_AP_MODE_DFS_DISABLE)
 	bool dfs_ch_disable;
 #endif
 	bool isCacEndNotified;
diff --git a/core/sap/src/sap_module.c b/core/sap/src/sap_module.c
index f1b02349696a..63b9981bf27f 100644
--- a/core/sap/src/sap_module.c
+++ b/core/sap/src/sap_module.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -99,54 +99,22 @@ ptSapContext gp_sap_ctx;
  * all its internal resources and will wait for the call to start to
  * register with the other modules.
  *
- * Return: The result code associated with performing the operation
- *
- * #ifdef WLAN_FEATURE_MBSSID
- *          void *: Pointer to the SAP context
- * #else
- *          CDF_STATUS_E_FAULT: Pointer to SAP cb is NULL ;
- *                              access would cause a page fault
- *          CDF_STATUS_SUCCESS: Success
- *  #endif
+ * Return: Pointer to the SAP context
  */
-#ifdef WLAN_FEATURE_MBSSID
-void *
-#else
-CDF_STATUS
-#endif
-wlansap_open(void *p_cds_gctx) {
+void *wlansap_open(void *p_cds_gctx)
+{
 	ptSapContext pSapCtx = NULL;
 
-	/*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
-#ifdef WLAN_FEATURE_MBSSID
-	/* amically allocate the sapContext */
+	/* dynamically allocate the sapContext */
 	pSapCtx = (ptSapContext) cdf_mem_malloc(sizeof(tSapContext));
-#else
-	if (NULL == p_cds_gctx) {
-		CDF_ASSERT(p_cds_gctx);
-		return CDF_STATUS_E_NOMEM;
-	}
-	/*------------------------------------------------------------------------
-	     Allocate (and sanity check?!) SAP control block
-	   ------------------------------------------------------------------------*/
-	cds_alloc_context(p_cds_gctx, CDF_MODULE_ID_SAP, (void **)&pSapCtx,
-			  sizeof(tSapContext));
-#endif
 
 	if (NULL == pSapCtx) {
 		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
 			  "%s: Invalid SAP pointer from p_cds_gctx", __func__);
-#ifdef WLAN_FEATURE_MBSSID
 		return NULL;
-#else
-		return CDF_STATUS_E_FAULT;
-#endif
 	}
 
-
-	/*------------------------------------------------------------------------
-	    Clean up SAP control block, initialize all values
-	   ------------------------------------------------------------------------*/
+	/* Clean up SAP control block, initialize all values */
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH, "wlansap_open");
 
 	wlansap_clean_cb(pSapCtx, 0); /*do not empty */
@@ -157,15 +125,7 @@ wlansap_open(void *p_cds_gctx) {
 	/* Store a pointer to the SAP context provided by CDS */
 	gp_sap_ctx = pSapCtx;
 
-	/*------------------------------------------------------------------------
-	    Allocate internal resources
-	   ------------------------------------------------------------------------*/
-
-#ifdef WLAN_FEATURE_MBSSID
 	return pSapCtx;
-#else
-	return CDF_STATUS_SUCCESS;
-#endif
 } /* wlansap_open */
 
 /**
@@ -253,10 +213,7 @@ CDF_STATUS wlansap_stop(void *pCtx)
 {
 	ptSapContext pSapCtx = NULL;
 
-	/*------------------------------------------------------------------------
-	    Sanity check
-	    Extract SAP control block
-	   ------------------------------------------------------------------------*/
+	/* Sanity check - Extract SAP control block */
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "wlansap_stop invoked successfully ");
 
@@ -274,9 +231,6 @@ CDF_STATUS wlansap_stop(void *pCtx)
 			  "wlansap_stop failed destroy lock");
 		return CDF_STATUS_E_FAULT;
 	}
-	/*------------------------------------------------------------------------
-	    Stop SAP (de-register RSN handler!?)
-	   ------------------------------------------------------------------------*/
 
 	return CDF_STATUS_SUCCESS;
 }
@@ -299,12 +253,7 @@ CDF_STATUS wlansap_close(void *pCtx)
 {
 	ptSapContext pSapCtx = NULL;
 
-	/*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
-
-	/*------------------------------------------------------------------------
-	    Sanity check
-	    Extract SAP control block
-	   ------------------------------------------------------------------------*/
+	/* Sanity check - Extract SAP control block */
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "wlansap_close invoked");
 
@@ -315,22 +264,14 @@ CDF_STATUS wlansap_close(void *pCtx)
 		return CDF_STATUS_E_FAULT;
 	}
 
-	/*------------------------------------------------------------------------
-	    Cleanup SAP control block.
-	   ------------------------------------------------------------------------*/
+	/* Cleanup SAP control block */
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "wlansap_close");
-	wlansap_clean_cb(pSapCtx,
-			 true); /* empty queues/lists/pkts if any */
 
-#ifdef WLAN_FEATURE_MBSSID
+	/* empty queues/lists/pkts if any */
+	wlansap_clean_cb(pSapCtx, true);
+
 	cdf_mem_free(pSapCtx);
-#else
-	/*------------------------------------------------------------------------
-	    Free SAP context from CDS global
-	   ------------------------------------------------------------------------*/
-	cds_free_context(pCtx, CDF_MODULE_ID_SAP, pSapCtx);
-#endif
 
 	return CDF_STATUS_SUCCESS;
 } /* wlansap_close */
@@ -526,9 +467,7 @@ wlansap_set_scan_acs_channel_params(tsap_Config_t *pconfig,
 	 */
 	psap_ctx->csr_roamProfile.BSSIDs.numOfBSSIDs = 1;
 
-	/*
-	 * Save a copy to SAP context
-	 */
+	/* Save a copy to SAP context */
 	cdf_mem_copy(psap_ctx->csr_roamProfile.BSSIDs.bssid,
 		pconfig->self_macaddr.bytes, CDF_MAC_ADDR_SIZE);
 	cdf_mem_copy(psap_ctx->self_mac_addr,
@@ -540,11 +479,11 @@ wlansap_set_scan_acs_channel_params(tsap_Config_t *pconfig,
 			"%s: Invalid MAC context from pvosGCtx", __func__);
 	} else {
 		/*
-		* If concurrent session is running that is already associated
-		* then we just follow that sessions country info (whether
-		* present or not doesn't maater as we have to follow whatever
-		* STA session does)
-		*/
+		 * If concurrent session is running that is already associated
+		 * then we just follow that sessions country info (whether
+		 * present or not doesn't maater as we have to follow whatever
+		 * STA session does)
+		 */
 		if ((0 == sme_get_concurrent_operation_channel(h_hal)) &&
 			pconfig->ieee80211d) {
 			/* Setting the region/country  information */
@@ -612,7 +551,7 @@ static bool wlan_sap_validate_channel_switch(tHalHandle hal, uint16_t sap_ch,
 		ptSapContext sap_context)
 {
 	return sme_validate_sap_channel_switch(
-			hHal,
+			hal,
 			sap_ch,
 			sap_context->csr_roamProfile.phyMode,
 			sap_context->cc_switch_mode,
@@ -660,106 +599,102 @@ CDF_STATUS wlansap_start_bss(void *pCtx,     /* pwextCtx */
 	    Sanity check
 	    Extract SAP control block
 	   ------------------------------------------------------------------------*/
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
 
+	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
+		  "wlansap_start_bss: sapContext=%p", pSapCtx);
+
+	if (NULL == pSapCtx) {
 		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
-			  "wlansap_start_bss: sapContext=%p", pSapCtx);
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+	pSapCtx->sapsMachine = eSAP_DISCONNECTED;
 
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-		pSapCtx->sapsMachine = eSAP_DISCONNECTED;
-
-		/* Channel selection is auto or configured */
-		pSapCtx->channel = pConfig->channel;
-		pSapCtx->ch_params.ch_width = pConfig->ch_params.ch_width;
-		pSapCtx->ch_params.center_freq_seg0 =
-			pConfig->ch_params.center_freq_seg0;
-		pSapCtx->ch_params.center_freq_seg1 =
-			pConfig->ch_params.center_freq_seg1;
-		pSapCtx->ch_params.sec_ch_offset =
-			pConfig->ch_params.sec_ch_offset;
-		pSapCtx->ch_width_orig = pConfig->ch_width_orig;
+	/* Channel selection is auto or configured */
+	pSapCtx->channel = pConfig->channel;
+	pSapCtx->ch_params.ch_width = pConfig->ch_params.ch_width;
+	pSapCtx->ch_params.center_freq_seg0 =
+		pConfig->ch_params.center_freq_seg0;
+	pSapCtx->ch_params.center_freq_seg1 =
+		pConfig->ch_params.center_freq_seg1;
+	pSapCtx->ch_params.sec_ch_offset =
+		pConfig->ch_params.sec_ch_offset;
+	pSapCtx->ch_width_orig = pConfig->ch_width_orig;
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
-		pSapCtx->cc_switch_mode = pConfig->cc_switch_mode;
+	pSapCtx->cc_switch_mode = pConfig->cc_switch_mode;
 #endif
-		pSapCtx->pUsrContext = pUsrContext;
-		pSapCtx->enableOverLapCh = pConfig->enOverLapCh;
-		pSapCtx->acs_cfg = &pConfig->acs_cfg;
-		/* Set the BSSID to your "self MAC Addr" read the mac address from Configuation ITEM received from HDD */
-		pSapCtx->csr_roamProfile.BSSIDs.numOfBSSIDs = 1;
-		cdf_mem_copy(pSapCtx->csr_roamProfile.BSSIDs.bssid,
-			     pSapCtx->self_mac_addr, sizeof(struct cdf_mac_addr));
-
-		/* Save a copy to SAP context */
-		cdf_mem_copy(pSapCtx->csr_roamProfile.BSSIDs.bssid,
-			     pConfig->self_macaddr.bytes, CDF_MAC_ADDR_SIZE);
-		cdf_mem_copy(pSapCtx->self_mac_addr,
-			     pConfig->self_macaddr.bytes, CDF_MAC_ADDR_SIZE);
-
-		/* copy the configuration items to csrProfile */
-		sapconvert_to_csr_profile(pConfig, eCSR_BSS_TYPE_INFRA_AP,
-				       &pSapCtx->csr_roamProfile);
-		hHal = (tHalHandle) CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if (NULL == hHal) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
-				  "%s: Invalid MAC context from p_cds_gctx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		} else {
-			/* If concurrent session is running that is already associated */
-			/* then we just follow that sessions country info (whether */
-			/* present or not doesn't maater as we have to follow whatever */
-			/* STA session does) */
-			if ((0 == sme_get_concurrent_operation_channel(hHal)) &&
-			    pConfig->ieee80211d) {
-				/* Setting the region/country  information */
-				sme_set_reg_info(hHal, pConfig->countryCode);
-				sme_apply_channel_power_info_to_fw(hHal);
-			}
-		}
-
-		pmac = PMAC_STRUCT(hHal);
-		if (NULL == pmac) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
-				  "%s: Invalid MAC context from p_cds_gctx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
+	pSapCtx->pUsrContext = pUsrContext;
+	pSapCtx->enableOverLapCh = pConfig->enOverLapCh;
+	pSapCtx->acs_cfg = &pConfig->acs_cfg;
+	/* Set the BSSID to your "self MAC Addr" read the mac address
+		from Configuation ITEM received from HDD */
+	pSapCtx->csr_roamProfile.BSSIDs.numOfBSSIDs = 1;
+	cdf_mem_copy(pSapCtx->csr_roamProfile.BSSIDs.bssid,
+		     pSapCtx->self_mac_addr, sizeof(struct cdf_mac_addr));
+
+	/* Save a copy to SAP context */
+	cdf_mem_copy(pSapCtx->csr_roamProfile.BSSIDs.bssid,
+		     pConfig->self_macaddr.bytes, CDF_MAC_ADDR_SIZE);
+	cdf_mem_copy(pSapCtx->self_mac_addr,
+		     pConfig->self_macaddr.bytes, CDF_MAC_ADDR_SIZE);
+
+	/* copy the configuration items to csrProfile */
+	sapconvert_to_csr_profile(pConfig, eCSR_BSS_TYPE_INFRA_AP,
+			       &pSapCtx->csr_roamProfile);
+	hHal = (tHalHandle) CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if (NULL == hHal) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
+			  "%s: Invalid MAC context from p_cds_gctx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	} else {
+		/* If concurrent session is running that is already associated
+		 * then we just follow that sessions country info (whether
+		 * present or not doesn't maater as we have to follow whatever
+		 * STA session does) */
+		if ((0 == sme_get_concurrent_operation_channel(hHal)) &&
+		    pConfig->ieee80211d) {
+			/* Setting the region/country  information */
+			sme_set_reg_info(hHal, pConfig->countryCode);
+			sme_apply_channel_power_info_to_fw(hHal);
 		}
-		/*
-		 * Copy the DFS Test Mode setting to pmac for
-		 * access in lower layers
-		 */
-		pmac->sap.SapDfsInfo.disable_dfs_ch_switch =
-					pConfig->disableDFSChSwitch;
+	}
 
-		/* Copy MAC filtering settings to sap context */
-		pSapCtx->eSapMacAddrAclMode = pConfig->SapMacaddr_acl;
-		cdf_mem_copy(pSapCtx->acceptMacList, pConfig->accept_mac,
-			     sizeof(pConfig->accept_mac));
-		pSapCtx->nAcceptMac = pConfig->num_accept_mac;
-		sap_sort_mac_list(pSapCtx->acceptMacList, pSapCtx->nAcceptMac);
-		cdf_mem_copy(pSapCtx->denyMacList, pConfig->deny_mac,
-			     sizeof(pConfig->deny_mac));
-		pSapCtx->nDenyMac = pConfig->num_deny_mac;
-		sap_sort_mac_list(pSapCtx->denyMacList, pSapCtx->nDenyMac);
-		/* Fill in the event structure for FSM */
-		sapEvent.event = eSAP_HDD_START_INFRA_BSS;
-		sapEvent.params = 0;    /* pSapPhysLinkCreate */
+	pmac = PMAC_STRUCT(hHal);
+	if (NULL == pmac) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
+			  "%s: Invalid MAC context from p_cds_gctx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+	/*
+	 * Copy the DFS Test Mode setting to pmac for
+	 * access in lower layers
+	 */
+	pmac->sap.SapDfsInfo.disable_dfs_ch_switch =
+				pConfig->disableDFSChSwitch;
+
+	/* Copy MAC filtering settings to sap context */
+	pSapCtx->eSapMacAddrAclMode = pConfig->SapMacaddr_acl;
+	cdf_mem_copy(pSapCtx->acceptMacList, pConfig->accept_mac,
+		     sizeof(pConfig->accept_mac));
+	pSapCtx->nAcceptMac = pConfig->num_accept_mac;
+	sap_sort_mac_list(pSapCtx->acceptMacList, pSapCtx->nAcceptMac);
+	cdf_mem_copy(pSapCtx->denyMacList, pConfig->deny_mac,
+		     sizeof(pConfig->deny_mac));
+	pSapCtx->nDenyMac = pConfig->num_deny_mac;
+	sap_sort_mac_list(pSapCtx->denyMacList, pSapCtx->nDenyMac);
+	/* Fill in the event structure for FSM */
+	sapEvent.event = eSAP_HDD_START_INFRA_BSS;
+	sapEvent.params = 0;    /* pSapPhysLinkCreate */
 
-		/* Store the HDD callback in SAP context */
-		pSapCtx->pfnSapEventCallback = pSapEventCallback;
+	/* Store the HDD callback in SAP context */
+	pSapCtx->pfnSapEventCallback = pSapEventCallback;
 
-		/* Handle event */
-		cdf_status = sap_fsm(pSapCtx, &sapEvent);
-	} else {
-		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-			  "SoftAp role has not been enabled");
-	}
+	/* Handle event */
+	cdf_status = sap_fsm(pSapCtx, &sapEvent);
 
 	return cdf_status;
 } /* wlansap_start_bss */
@@ -787,36 +722,30 @@ CDF_STATUS wlansap_set_mac_acl(void *pCtx,    /* pwextCtx */
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
 		  "wlansap_set_mac_acl");
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-		/* Copy MAC filtering settings to sap context */
-		pSapCtx->eSapMacAddrAclMode = pConfig->SapMacaddr_acl;
-
-		if (eSAP_DENY_UNLESS_ACCEPTED == pSapCtx->eSapMacAddrAclMode) {
-			cdf_mem_copy(pSapCtx->acceptMacList,
-				     pConfig->accept_mac,
-				     sizeof(pConfig->accept_mac));
-			pSapCtx->nAcceptMac = pConfig->num_accept_mac;
-			sap_sort_mac_list(pSapCtx->acceptMacList,
-				       pSapCtx->nAcceptMac);
-		} else if (eSAP_ACCEPT_UNLESS_DENIED ==
-			   pSapCtx->eSapMacAddrAclMode) {
-			cdf_mem_copy(pSapCtx->denyMacList, pConfig->deny_mac,
-				     sizeof(pConfig->deny_mac));
-			pSapCtx->nDenyMac = pConfig->num_deny_mac;
-			sap_sort_mac_list(pSapCtx->denyMacList, pSapCtx->nDenyMac);
-		}
-	} else {
-		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-			  "%s : SoftAp role has not been enabled", __func__);
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO_HIGH,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
 		return CDF_STATUS_E_FAULT;
 	}
+	/* Copy MAC filtering settings to sap context */
+	pSapCtx->eSapMacAddrAclMode = pConfig->SapMacaddr_acl;
+
+	if (eSAP_DENY_UNLESS_ACCEPTED == pSapCtx->eSapMacAddrAclMode) {
+		cdf_mem_copy(pSapCtx->acceptMacList,
+			     pConfig->accept_mac,
+			     sizeof(pConfig->accept_mac));
+		pSapCtx->nAcceptMac = pConfig->num_accept_mac;
+		sap_sort_mac_list(pSapCtx->acceptMacList,
+			       pSapCtx->nAcceptMac);
+	} else if (eSAP_ACCEPT_UNLESS_DENIED ==
+		   pSapCtx->eSapMacAddrAclMode) {
+		cdf_mem_copy(pSapCtx->denyMacList, pConfig->deny_mac,
+			     sizeof(pConfig->deny_mac));
+		pSapCtx->nDenyMac = pConfig->num_deny_mac;
+		sap_sort_mac_list(pSapCtx->denyMacList, pSapCtx->nDenyMac);
+	}
 
 	return cdf_status;
 } /* wlansap_set_mac_acl */
@@ -1437,7 +1366,6 @@ static CDF_STATUS wlansap_update_csa_channel_params(ptSapContext sap_context,
 {
 	void *hal;
 	tpAniSirGlobal mac_ctx;
-	tSmeConfigParams *sme_config;
 	uint8_t bw;
 
 	hal = CDS_GET_HAL_CB(sap_context->p_cds_gctx);
@@ -1449,23 +1377,12 @@ static CDF_STATUS wlansap_update_csa_channel_params(ptSapContext sap_context,
 
 	mac_ctx = PMAC_STRUCT(hal);
 
-	sme_config = cdf_mem_malloc(sizeof(*sme_config));
-	if (!sme_config) {
-		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-			FL("memory allocation failed for sme_config"));
-		return CDF_STATUS_E_NOMEM;
-	}
-
-	sme_get_config_param(mac_ctx, sme_config);
 	if (channel <= RF_CHAN_14) {
 		/*
 		 * currently OBSS scan is done in hostapd, so to avoid
 		 * SAP coming up in HT40 on channel switch we are
 		 * disabling channel bonding in 2.4Ghz.
 		 */
-		sme_config->csrConfig.channelBondingMode24GHz =
-			eCSR_INI_SINGLE_CHANNEL_CENTERED;
-		mac_ctx->sap.SapDfsInfo.new_cbMode = 0;
 		mac_ctx->sap.SapDfsInfo.new_chanWidth = 0;
 
 	} else {
@@ -1487,66 +1404,40 @@ static CDF_STATUS wlansap_update_csa_channel_params(ptSapContext sap_context,
 				continue;
 
 			if (bw == BW80) {
-				wlansap_update_bw80_cbmode(channel, sme_config);
-				mac_ctx->sap.SapDfsInfo.new_cbMode =
-				   sme_config->csrConfig.channelBondingMode5GHz;
 				mac_ctx->sap.SapDfsInfo.new_chanWidth =
 					CH_WIDTH_80MHZ;
 			} else if (bw == BW40_HIGH_PRIMARY) {
 				mac_ctx->sap.SapDfsInfo.new_chanWidth =
 					CH_WIDTH_40MHZ;
-				sme_config->csrConfig.channelBondingMode5GHz =
-				mac_ctx->sap.SapDfsInfo.new_cbMode =
-				   eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY;
 			} else if (bw == BW40_LOW_PRIMARY) {
 				mac_ctx->sap.SapDfsInfo.new_chanWidth =
 				   CH_WIDTH_40MHZ;
-				sme_config->csrConfig.channelBondingMode5GHz =
-				mac_ctx->sap.SapDfsInfo.new_cbMode =
-				   eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY;
 			} else {
 				mac_ctx->sap.SapDfsInfo.new_chanWidth =
 				   CH_WIDTH_20MHZ;
-				sme_config->csrConfig.channelBondingMode5GHz =
-				mac_ctx->sap.SapDfsInfo.new_cbMode =
-				   eCSR_INI_SINGLE_CHANNEL_CENTERED;
 			}
 			break;
 		}
 
 	}
 
-	sme_update_config(mac_ctx, sme_config);
-	cdf_mem_free(sme_config);
 	return CDF_STATUS_SUCCESS;
 }
 
-/*==========================================================================
-   FUNCTION    wlansap_set_channel_change_with_csa
-
-   DESCRIPTION
-      This api function does a channel change to the target channel specified
-      through an iwpriv. CSA IE is included in the beacons before doing a
-      channel change.
-
-   DEPENDENCIES
-    NA.
-
-   PARAMETERS
-
-    IN
-    p_cds_gctx             : Pointer to cds global context structure
-    targetChannel        : New target channel to change to.
-
-   RETURN VALUE
-    The CDF_STATUS code associated with performing the operation
-
-    CDF_STATUS_SUCCESS:  Success
-
-   SIDE EFFECTS
-   ============================================================================*/
+/**
+ * wlansap_set_channel_change_with_csa() - Set channel change with CSA
+ * @p_cds_gctx: Pointer to cds global context structure
+ * @targetChannel: Target channel
+ * @target_bw: Target bandwidth
+ *
+ * This api function does a channel change to the target channel specified.
+ * CSA IE is included in the beacons before doing a channel change.
+ *
+ * Return: CDF_STATUS
+ */
 CDF_STATUS
-wlansap_set_channel_change_with_csa(void *p_cds_gctx, uint32_t targetChannel)
+wlansap_set_channel_change_with_csa(void *p_cds_gctx, uint32_t targetChannel,
+					phy_ch_width target_bw)
 {
 
 	ptSapContext sapContext = NULL;
@@ -1611,6 +1502,43 @@ wlansap_set_channel_change_with_csa(void *p_cds_gctx, uint32_t targetChannel)
 			 * to sap context.
 			 */
 			pMac->sap.SapDfsInfo.target_channel = targetChannel;
+			pMac->sap.SapDfsInfo.new_ch_params.ch_width =
+				pMac->sap.SapDfsInfo.new_chanWidth;
+
+			/* By this time, the best bandwidth is calculated for
+			 * the given target channel. Now, if there was a
+			 * request from user to move to a selected bandwidth,
+			 * we can see if it can be honored.
+			 *
+			 * Ex1: BW80 was selected for the target channel and
+			 * user wants BW40, it can be allowed
+			 * Ex2: BW40 was selected for the target channel and
+			 * user wants BW80, it cannot be allowed for the given
+			 * target channel.
+			 *
+			 * So, the MIN of the selected channel bandwidth and
+			 * user input is used for the bandwidth
+			 */
+			if (target_bw != CH_WIDTH_MAX) {
+				CDF_TRACE(CDF_MODULE_ID_SAP,
+					CDF_TRACE_LEVEL_INFO,
+					"%s: target bw:%d new width:%d",
+					__func__, target_bw,
+					pMac->sap.SapDfsInfo.
+					new_ch_params.ch_width);
+				pMac->sap.SapDfsInfo.new_ch_params.ch_width =
+					pMac->sap.SapDfsInfo.new_chanWidth =
+					CDF_MIN(pMac->sap.SapDfsInfo.
+							new_ch_params.ch_width,
+							target_bw);
+			}
+
+			sme_set_ch_params(hHal,
+					sapContext->csr_roamProfile.phyMode,
+					targetChannel,
+					0,
+					&pMac->sap.SapDfsInfo.new_ch_params);
+
 			/*
 			 * Set the CSA IE required flag.
 			 */
@@ -1727,31 +1655,27 @@ CDF_STATUS wlansap_set_key_sta(void *pCtx, tCsrRoamSetKey *pSetKeyInfo)
 	CDF_STATUS cdf_ret_status = CDF_STATUS_E_FAILURE;
 	uint32_t roamId = 0xFF;
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if (NULL == hHal) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid HAL pointer from p_cds_gctx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-		cdf_ret_status =
-			sme_roam_set_key(hHal, pSapCtx->sessionId, pSetKeyInfo,
-					 &roamId);
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if (NULL == hHal) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid HAL pointer from p_cds_gctx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+	cdf_ret_status =
+		sme_roam_set_key(hHal, pSapCtx->sessionId, pSetKeyInfo,
+				 &roamId);
 
-		if (cdf_ret_status == CDF_STATUS_SUCCESS) {
-			cdf_status = CDF_STATUS_SUCCESS;
-		} else {
-			cdf_status = CDF_STATUS_E_FAULT;
-		}
-	} else
+	if (cdf_ret_status == CDF_STATUS_SUCCESS)
+		cdf_status = CDF_STATUS_SUCCESS;
+	else
 		cdf_status = CDF_STATUS_E_FAULT;
 
 	return cdf_status;
@@ -1775,15 +1699,6 @@ wlan_sap_getstation_ie_information
 	CDF_STATUS cdf_status = CDF_STATUS_E_FAILURE;
 	ptSapContext sap_ctx = NULL;
 	uint32_t ie_len = 0;
-	tCDF_CON_MODE mode;
-
-	mode = cds_get_conparam();
-	if (CDF_SAP_MODE != mode) {
-		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-			"%d: called in wrong mode ",
-			mode);
-		return CDF_STATUS_E_FAULT;
-	}
 
 	sap_ctx = CDS_GET_SAP_CB(ctx);
 	if (NULL == sap_ctx) {
@@ -1831,44 +1746,41 @@ CDF_STATUS wlansap_set_wps_ie(void *pCtx, tSap_WPSIE *pSap_WPSIe)
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO,
 		  "%s, %d", __func__, __LINE__);
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if (NULL == hHal) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid HAL pointer from p_cds_gctx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if (NULL == hHal) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid HAL pointer from p_cds_gctx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		if (sap_acquire_global_lock(pSapCtx) == CDF_STATUS_SUCCESS) {
-			if (pSap_WPSIe->sapWPSIECode == eSAP_WPS_BEACON_IE) {
-				cdf_mem_copy(&pSapCtx->APWPSIEs.SirWPSBeaconIE,
-					     &pSap_WPSIe->sapwpsie.
-					     sapWPSBeaconIE,
-					     sizeof(tSap_WPSBeaconIE));
-			} else if (pSap_WPSIe->sapWPSIECode ==
-				   eSAP_WPS_PROBE_RSP_IE) {
-				cdf_mem_copy(&pSapCtx->APWPSIEs.
-					     SirWPSProbeRspIE,
-					     &pSap_WPSIe->sapwpsie.
-					     sapWPSProbeRspIE,
-					     sizeof(tSap_WPSProbeRspIE));
-			} else {
-				sap_release_global_lock(pSapCtx);
-				return CDF_STATUS_E_FAULT;
-			}
+	if (sap_acquire_global_lock(pSapCtx) == CDF_STATUS_SUCCESS) {
+		if (pSap_WPSIe->sapWPSIECode == eSAP_WPS_BEACON_IE) {
+			cdf_mem_copy(&pSapCtx->APWPSIEs.SirWPSBeaconIE,
+				     &pSap_WPSIe->sapwpsie.
+				     sapWPSBeaconIE,
+				     sizeof(tSap_WPSBeaconIE));
+		} else if (pSap_WPSIe->sapWPSIECode ==
+			   eSAP_WPS_PROBE_RSP_IE) {
+			cdf_mem_copy(&pSapCtx->APWPSIEs.
+				     SirWPSProbeRspIE,
+				     &pSap_WPSIe->sapwpsie.
+				     sapWPSProbeRspIE,
+				     sizeof(tSap_WPSProbeRspIE));
+		} else {
 			sap_release_global_lock(pSapCtx);
-			return CDF_STATUS_SUCCESS;
-		} else
 			return CDF_STATUS_E_FAULT;
+		}
+		sap_release_global_lock(pSapCtx);
+		return CDF_STATUS_SUCCESS;
 	} else
 		return CDF_STATUS_E_FAULT;
 }
@@ -1894,34 +1806,30 @@ CDF_STATUS wlansap_update_wps_ie(void *pCtx)
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
 		  "%s, %d", __func__, __LINE__);
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if (NULL == hHal) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid HAL pointer from p_cds_gctx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		cdf_ret_status =
-			sme_roam_update_apwpsie(hHal, pSapCtx->sessionId,
-						&pSapCtx->APWPSIEs);
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if (NULL == hHal) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid HAL pointer from p_cds_gctx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		if (cdf_ret_status == CDF_STATUS_SUCCESS) {
-			cdf_status = CDF_STATUS_SUCCESS;
-		} else {
-			cdf_status = CDF_STATUS_E_FAULT;
-		}
+	cdf_ret_status =
+		sme_roam_update_apwpsie(hHal, pSapCtx->sessionId,
+					&pSapCtx->APWPSIEs);
 
-	}
+	if (cdf_ret_status == CDF_STATUS_SUCCESS)
+		cdf_status = CDF_STATUS_SUCCESS;
+	else
+		cdf_status = CDF_STATUS_E_FAULT;
 
 	return cdf_status;
 }
@@ -1947,37 +1855,33 @@ CDF_STATUS wlansap_get_wps_state(void *pCtx, bool *bWPSState)
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_INFO,
 		  "%s, %d", __func__, __LINE__);
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if (NULL == hHal) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid HAL pointer from p_cds_gctx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if (NULL == hHal) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid HAL pointer from p_cds_gctx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		if (sap_acquire_global_lock(pSapCtx) == CDF_STATUS_SUCCESS) {
-			if (pSapCtx->APWPSIEs.SirWPSProbeRspIE.
-			    FieldPresent &
-			    SIR_WPS_PROBRSP_SELECTEDREGISTRA_PRESENT)
-				*bWPSState = true;
-			else
-				*bWPSState = false;
+	if (sap_acquire_global_lock(pSapCtx) == CDF_STATUS_SUCCESS) {
+		if (pSapCtx->APWPSIEs.SirWPSProbeRspIE.
+		    FieldPresent &
+		    SIR_WPS_PROBRSP_SELECTEDREGISTRA_PRESENT)
+			*bWPSState = true;
+		else
+			*bWPSState = false;
 
-			sap_release_global_lock(pSapCtx);
+		sap_release_global_lock(pSapCtx);
 
-			return CDF_STATUS_SUCCESS;
-		} else
-			return CDF_STATUS_E_FAULT;
+		return CDF_STATUS_SUCCESS;
 	} else
 		return CDF_STATUS_E_FAULT;
 
@@ -2025,37 +1929,34 @@ CDF_STATUS wlansap_set_wparsn_ies
 	CDF_STATUS cdf_ret_status = CDF_STATUS_E_FAILURE;
 	void *hHal = NULL;
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if (NULL == hHal) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid HAL pointer from p_cds_gctx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if (NULL == hHal) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid HAL pointer from p_cds_gctx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		pSapCtx->APWPARSNIEs.length = (uint16_t) WPARSNIEsLen;
-		cdf_mem_copy(pSapCtx->APWPARSNIEs.rsnIEdata, pWPARSNIEs,
-			     WPARSNIEsLen);
+	pSapCtx->APWPARSNIEs.length = (uint16_t) WPARSNIEsLen;
+	cdf_mem_copy(pSapCtx->APWPARSNIEs.rsnIEdata, pWPARSNIEs,
+		     WPARSNIEsLen);
 
-		cdf_ret_status =
-			sme_roam_update_apwparsni_es(hHal, pSapCtx->sessionId,
-						     &pSapCtx->APWPARSNIEs);
+	cdf_ret_status =
+		sme_roam_update_apwparsni_es(hHal, pSapCtx->sessionId,
+					     &pSapCtx->APWPARSNIEs);
 
-		if (cdf_ret_status == CDF_STATUS_SUCCESS) {
-			return CDF_STATUS_SUCCESS;
-		} else {
-			return CDF_STATUS_E_FAULT;
-		}
-	}
+	if (cdf_ret_status == CDF_STATUS_SUCCESS)
+		return CDF_STATUS_SUCCESS;
+	else
+		return CDF_STATUS_E_FAULT;
 
 	return CDF_STATUS_E_FAULT;
 }
@@ -2080,29 +1981,27 @@ CDF_STATUS wlansap_send_action(void *pCtx, const uint8_t *pBuf,
 	void *hHal = NULL;
 	CDF_STATUS cdf_ret_status = CDF_STATUS_E_FAILURE;
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if ((NULL == hHal) || (eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
-				  __func__, hHal, pSapCtx->isSapSessionOpen);
-			return CDF_STATUS_E_FAULT;
-		}
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if ((NULL == hHal) || (eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+			  __func__, hHal, pSapCtx->isSapSessionOpen);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		cdf_ret_status =
-			sme_send_action(hHal, pSapCtx->sessionId, pBuf, len, 0,
-			0, channel_freq);
+	cdf_ret_status =
+		sme_send_action(hHal, pSapCtx->sessionId, pBuf, len, 0,
+		0, channel_freq);
 
-		if (CDF_STATUS_SUCCESS == cdf_ret_status) {
-			return CDF_STATUS_SUCCESS;
-		}
+	if (CDF_STATUS_SUCCESS == cdf_ret_status) {
+		return CDF_STATUS_SUCCESS;
 	}
 
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
@@ -2136,29 +2035,27 @@ CDF_STATUS wlansap_remain_on_channel(void *pCtx,
 	void *hHal = NULL;
 	CDF_STATUS cdf_ret_status = CDF_STATUS_E_FAILURE;
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if ((NULL == hHal) || (eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
-				  __func__, hHal, pSapCtx->isSapSessionOpen);
-			return CDF_STATUS_E_FAULT;
-		}
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if ((NULL == hHal) || (eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+			  __func__, hHal, pSapCtx->isSapSessionOpen);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		cdf_ret_status = sme_remain_on_channel(hHal, pSapCtx->sessionId,
-					channel, duration, callback, pContext,
-					true, scan_id);
+	cdf_ret_status = sme_remain_on_channel(hHal, pSapCtx->sessionId,
+				channel, duration, callback, pContext,
+				true, scan_id);
 
-		if (CDF_STATUS_SUCCESS == cdf_ret_status) {
-			return CDF_STATUS_SUCCESS;
-		}
+	if (CDF_STATUS_SUCCESS == cdf_ret_status) {
+		return CDF_STATUS_SUCCESS;
 	}
 
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
@@ -2185,30 +2082,28 @@ CDF_STATUS wlansap_cancel_remain_on_channel(void *pCtx,
 	void *hHal = NULL;
 	CDF_STATUS cdf_ret_status = CDF_STATUS_E_FAILURE;
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if ((NULL == hHal) ||
-			(eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
-				  __func__, hHal, pSapCtx->isSapSessionOpen);
-			return CDF_STATUS_E_FAULT;
-		}
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if ((NULL == hHal) ||
+		(eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+			  __func__, hHal, pSapCtx->isSapSessionOpen);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		cdf_ret_status =
-			sme_cancel_remain_on_channel(hHal, pSapCtx->sessionId,
-			scan_id);
+	cdf_ret_status =
+		sme_cancel_remain_on_channel(hHal, pSapCtx->sessionId,
+		scan_id);
 
-		if (CDF_STATUS_SUCCESS == cdf_ret_status) {
-			return CDF_STATUS_SUCCESS;
-		}
+	if (CDF_STATUS_SUCCESS == cdf_ret_status) {
+		return CDF_STATUS_SUCCESS;
 	}
 
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
@@ -2238,29 +2133,27 @@ CDF_STATUS wlansap_register_mgmt_frame
 	void *hHal = NULL;
 	CDF_STATUS cdf_ret_status = CDF_STATUS_E_FAILURE;
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if ((NULL == hHal) || (eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
-				  __func__, hHal, pSapCtx->isSapSessionOpen);
-			return CDF_STATUS_E_FAULT;
-		}
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if ((NULL == hHal) || (eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+			  __func__, hHal, pSapCtx->isSapSessionOpen);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		cdf_ret_status = sme_register_mgmt_frame(hHal, pSapCtx->sessionId,
-							 frameType, matchData,
-							 matchLen);
+	cdf_ret_status = sme_register_mgmt_frame(hHal, pSapCtx->sessionId,
+						 frameType, matchData,
+						 matchLen);
 
-		if (CDF_STATUS_SUCCESS == cdf_ret_status) {
-			return CDF_STATUS_SUCCESS;
-		}
+	if (CDF_STATUS_SUCCESS == cdf_ret_status) {
+		return CDF_STATUS_SUCCESS;
 	}
 
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
@@ -2290,29 +2183,27 @@ CDF_STATUS wlansap_de_register_mgmt_frame
 	void *hHal = NULL;
 	CDF_STATUS cdf_ret_status = CDF_STATUS_E_FAILURE;
 
-	if (CDF_SAP_MODE == cds_get_conparam()) {
-		pSapCtx = CDS_GET_SAP_CB(pCtx);
-		if (NULL == pSapCtx) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: Invalid SAP pointer from pCtx",
-				  __func__);
-			return CDF_STATUS_E_FAULT;
-		}
-		hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
-		if ((NULL == hHal) || (eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
-			CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
-				  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
-				  __func__, hHal, pSapCtx->isSapSessionOpen);
-			return CDF_STATUS_E_FAULT;
-		}
+	pSapCtx = CDS_GET_SAP_CB(pCtx);
+	if (NULL == pSapCtx) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Invalid SAP pointer from pCtx",
+			  __func__);
+		return CDF_STATUS_E_FAULT;
+	}
+	hHal = CDS_GET_HAL_CB(pSapCtx->p_cds_gctx);
+	if ((NULL == hHal) || (eSAP_TRUE != pSapCtx->isSapSessionOpen)) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			  "%s: HAL pointer (%p) NULL OR SME session is not open (%d)",
+			  __func__, hHal, pSapCtx->isSapSessionOpen);
+		return CDF_STATUS_E_FAULT;
+	}
 
-		cdf_ret_status =
-			sme_deregister_mgmt_frame(hHal, pSapCtx->sessionId, frameType,
-						  matchData, matchLen);
+	cdf_ret_status =
+		sme_deregister_mgmt_frame(hHal, pSapCtx->sessionId, frameType,
+					  matchData, matchLen);
 
-		if (CDF_STATUS_SUCCESS == cdf_ret_status) {
-			return CDF_STATUS_SUCCESS;
-		}
+	if (CDF_STATUS_SUCCESS == cdf_ret_status) {
+		return CDF_STATUS_SUCCESS;
 	}
 
 	CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
@@ -2356,8 +2247,6 @@ wlansap_channel_change_request(void *pSapCtx, uint8_t target_channel)
 	void *hHal = NULL;
 	tpAniSirGlobal mac_ctx = NULL;
 	eCsrPhyMode phy_mode;
-	uint32_t cb_mode;
-	uint32_t vht_channel_width;
 	chan_params_t ch_params;
 	sapContext = (ptSapContext) pSapCtx;
 
@@ -2381,18 +2270,16 @@ wlansap_channel_change_request(void *pSapCtx, uint8_t target_channel)
 	 * because we've implemented channel width fallback mechanism for DFS
 	 * which will result in channel width changing dynamically.
 	 */
-	cb_mode = mac_ctx->sap.SapDfsInfo.new_cbMode;
-	vht_channel_width = mac_ctx->sap.SapDfsInfo.new_chanWidth;
-	ch_params.ch_width = vht_channel_width;
+	ch_params.ch_width = mac_ctx->sap.SapDfsInfo.new_chanWidth;
 	sme_set_ch_params(hHal, phy_mode, target_channel, 0, &ch_params);
-	sapContext->ch_params.ch_width = vht_channel_width;
+	sapContext->ch_params.ch_width = ch_params.ch_width;
 	/* Update the channel as this will be used to
 	 * send event to supplicant
 	 */
 	sapContext->channel = target_channel;
-	sapContext->csr_roamProfile.ch_params.ch_width = vht_channel_width;
+	sapContext->csr_roamProfile.ch_params.ch_width = ch_params.ch_width;
 	cdf_ret_status = sme_roam_channel_change_req(hHal, sapContext->bssid,
-				cb_mode, &sapContext->csr_roamProfile);
+				&ch_params, &sapContext->csr_roamProfile);
 
 	if (cdf_ret_status == CDF_STATUS_SUCCESS) {
 		sap_signal_hdd_event(sapContext, NULL,
@@ -2495,8 +2382,6 @@ CDF_STATUS wlansap_dfs_send_csa_ie_request(void *pSapCtx)
 	CDF_STATUS cdf_ret_status = CDF_STATUS_E_FAILURE;
 	void *hHal = NULL;
 	tpAniSirGlobal pMac = NULL;
-	uint32_t cbmode, vht_ch_width;
-	uint8_t ch_bandwidth;
 	sapContext = (ptSapContext) pSapCtx;
 
 	if (NULL == sapContext) {
@@ -2513,38 +2398,11 @@ CDF_STATUS wlansap_dfs_send_csa_ie_request(void *pSapCtx)
 	}
 	pMac = PMAC_STRUCT(hHal);
 
-	/*
-	 * We are getting channel bonding mode from sapDfsInfor structure
-	 * because we've implemented channel width fallback mechanism for DFS
-	 * which will result in channel width changing dynamically.
-	 */
-	vht_ch_width = pMac->sap.SapDfsInfo.new_chanWidth;
-	cbmode = pMac->sap.SapDfsInfo.new_cbMode;
-
-	if (pMac->sap.SapDfsInfo.target_channel <= 14 ||
-		vht_ch_width == eHT_CHANNEL_WIDTH_40MHZ ||
-		vht_ch_width == eHT_CHANNEL_WIDTH_20MHZ) {
-		switch (cbmode) {
-		case eCSR_INI_DOUBLE_CHANNEL_HIGH_PRIMARY:
-			ch_bandwidth = BW40_HIGH_PRIMARY;
-			break;
-		case eCSR_INI_DOUBLE_CHANNEL_LOW_PRIMARY:
-			ch_bandwidth = BW40_LOW_PRIMARY;
-			break;
-		case eCSR_INI_SINGLE_CHANNEL_CENTERED:
-		default:
-			ch_bandwidth = BW20;
-			break;
-		}
-	} else {
-		ch_bandwidth = BW80;
-	}
-
 	cdf_ret_status = sme_roam_csa_ie_request(hHal,
 				sapContext->bssid,
 				pMac->sap.SapDfsInfo.target_channel,
 				pMac->sap.SapDfsInfo.csaIERequired,
-				ch_bandwidth);
+				&pMac->sap.SapDfsInfo.new_ch_params);
 
 	if (cdf_ret_status == CDF_STATUS_SUCCESS) {
 		return CDF_STATUS_SUCCESS;
@@ -3441,3 +3299,26 @@ void wlan_sap_enable_phy_error_logs(tHalHandle hal, bool enable_log)
 	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
 	mac_ctx->sap.enable_dfs_phy_error_logs = enable_log;
 }
+/**
+* wlansap_get_phymode() - get SAP phymode.
+* @pctx: Pointer to the global vos context; a handle to SAP's control block
+*	can be extracted from its context. When MBSSID feature is enabled,
+*	SAP context is directly passed to SAP APIs.
+*
+* This function provides current phymode of SAP interface.
+*
+* Return: phymode with eCsrPhyMode type.
+*/
+eCsrPhyMode
+wlansap_get_phymode(void *pctx)
+{
+	ptSapContext sap_context = NULL;
+
+	sap_context = CDS_GET_SAP_CB(pctx);
+	if (NULL == sap_context) {
+		CDF_TRACE(CDF_MODULE_ID_SAP, CDF_TRACE_LEVEL_ERROR,
+			"%s: Invalid SAP pointer from pctx", __func__);
+		return eCSR_DOT11_MODE_AUTO;
+	}
+	return sap_context->csr_roamProfile.phyMode;
+}
diff --git a/core/sme/inc/csr_api.h b/core/sme/inc/csr_api.h
index a4194e8c96ef..fd4621a8bc57 100644
--- a/core/sme/inc/csr_api.h
+++ b/core/sme/inc/csr_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -41,21 +41,6 @@
 #define CSR_INVALID_SCANRESULT_HANDLE       (NULL)
 
 typedef enum {
-	CH_WIDTH_20MHZ = 0,
-	CH_WIDTH_40MHZ = 1,
-	CH_WIDTH_80MHZ = 2,
-	CH_WIDTH_160MHZ = 3,
-	CH_WIDTH_80P80MHZ = 4
-} phy_ch_width;
-
-typedef struct ch_params_s {
-	phy_ch_width ch_width;
-	uint8_t sec_ch_offset;
-	uint8_t center_freq_seg0;
-	uint8_t center_freq_seg1;
-} chan_params_t;
-
-typedef enum {
 	/* never used */
 	eCSR_AUTH_TYPE_NONE,
 	/* MAC layer authentication types */
@@ -145,10 +130,8 @@ typedef enum {
 	eCSR_DOT11_MODE_11g_ONLY = 0x0020,
 	eCSR_DOT11_MODE_11n_ONLY = 0x0040,
 	eCSR_DOT11_MODE_11b_ONLY = 0x0080,
-#ifdef WLAN_FEATURE_11AC
 	eCSR_DOT11_MODE_11ac = 0x0100,
 	eCSR_DOT11_MODE_11ac_ONLY = 0x0200,
-#endif
 	/*
 	 * This is for WIFI test. It is same as eWNIAPI_MAC_PROTOCOL_ALL
 	 * except when it starts IBSS in 11B of 2.4GHz
@@ -166,8 +149,6 @@ typedef enum {
 	eCSR_BSS_TYPE_INFRA_AP,   /* SoftAP AP */
 	eCSR_BSS_TYPE_IBSS,       /* IBSS network we'll NOT start */
 	eCSR_BSS_TYPE_START_IBSS, /* IBSS network we'll start if no partners */
-	eCSR_BSS_TYPE_WDS_AP,     /* BT-AMP AP */
-	eCSR_BSS_TYPE_WDS_STA,    /* BT-AMP station */
 	eCSR_BSS_TYPE_ANY,        /* any BSS type (IBSS or Infrastructure).*/
 } eCsrRoamBssType;
 
@@ -410,7 +391,7 @@ typedef struct tagCsrScanResultFilter {
 	 */
 	uint8_t scan_filter_for_roam;
 	struct sCsrChannel_ pcl_channels;
-	tCDF_CON_MODE csrPersona;
+	enum tCDF_ADAPTER_MODE csrPersona;
 } tCsrScanResultFilter;
 
 typedef struct sCsrChnPower_ {
@@ -475,8 +456,6 @@ typedef enum {
 	eCSR_ROAM_GEN_INFO,
 	eCSR_ROAM_SET_KEY_COMPLETE,
 	eCSR_ROAM_IBSS_LEAVE,   /* IBSS indications. */
-	/* BSS in WDS mode status indication */
-	eCSR_ROAM_WDS_IND,
 	/* BSS in SoftAP mode status indication */
 	eCSR_ROAM_INFRA_IND,
 	eCSR_ROAM_WPS_PBC_PROBE_REQ_IND,
@@ -484,15 +463,12 @@ typedef enum {
 	eCSR_ROAM_FT_RESPONSE,
 #endif
 	eCSR_ROAM_FT_START,
-	eCSR_ROAM_INDICATE_MGMT_FRAME,
 	eCSR_ROAM_REMAIN_CHAN_READY,
 	eCSR_ROAM_SEND_ACTION_CNF,
 	/* this mean error happens before assoc_start/roam_start is called. */
 	eCSR_ROAM_SESSION_OPENED,
 	eCSR_ROAM_FT_REASSOC_FAILED,
-#ifdef FEATURE_WLAN_LFR
 	eCSR_ROAM_PMK_NOTIFY,
-#endif
 	/*
 	 * Following 4 enums are used by FEATURE_WLAN_LFR_METRICS
 	 * but they are needed for compilation even when
@@ -588,20 +564,6 @@ typedef enum {
 #ifdef FEATURE_WLAN_WAPI
 	eCSR_ROAM_RESULT_NEW_WAPI_BSS,
 #endif /* FEATURE_WLAN_WAPI */
-	/* WDS started successfully */
-	eCSR_ROAM_RESULT_WDS_STARTED,
-	/* WDS start failed */
-	eCSR_ROAM_RESULT_WDS_START_FAILED,
-	/* WDS stopped */
-	eCSR_ROAM_RESULT_WDS_STOPPED,
-	/* WDS joined successfully in STA mode */
-	eCSR_ROAM_RESULT_WDS_ASSOCIATED,
-	/* A station joined WDS AP */
-	eCSR_ROAM_RESULT_WDS_ASSOCIATION_IND,
-	/* WDS join failed in STA mode */
-	eCSR_ROAM_RESULT_WDS_NOT_ASSOCIATED,
-	/* WDS disassociated */
-	eCSR_ROAM_RESULT_WDS_DISASSOCIATED,
 	/* INFRA started successfully */
 	eCSR_ROAM_RESULT_INFRA_STARTED,
 	/* INFRA start failed */
@@ -682,6 +644,8 @@ typedef enum {
 	eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTED,
 	/* Participating in a Infra network and connected to a peer */
 	eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED,
+	/* Disconnecting with AP or stop connecting process */
+	eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTING,
 
 } eCsrConnectState;
 
@@ -832,7 +796,6 @@ typedef enum {
 	eCSR_HDD
 } eCsrStatsRequesterType;
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 /**
  * enum csr_hi_rssi_scan_id - Parameter ids for hi rssi scan feature
  *
@@ -847,7 +810,6 @@ enum csr_hi_rssi_scan_id {
 	eCSR_HI_RSSI_SCAN_DELAY_ID,
 	eCSR_HI_RSSI_SCAN_RSSI_UB_ID
 };
-#endif
 
 typedef struct tagPmkidCandidateInfo {
 	struct cdf_mac_addr BSSID;
@@ -896,12 +858,6 @@ typedef struct tagCsrRoamModifyProfileFields {
 } tCsrRoamModifyProfileFields;
 
 typedef struct tagCsrRoamProfile {
-	/*
-	 * For eCSR_BSS_TYPE_WDS_AP. There must be one SSID in SSIDs.
-	 * For eCSR_BSS_TYPE_WDS_STA. There must be two SSIDs.
-	 * Index 0 is the SSID of the WDS-AP that we need to join.
-	 * Index 1 is the SSID for self BSS.
-	 */
 	tCsrSSIDs SSIDs;
 	tCsrBSSIDs BSSIDs;
 	/* this is bit mask of all the needed phy mode defined in eCsrPhyMode */
@@ -979,7 +935,7 @@ typedef struct tagCsrRoamProfile {
 #ifdef WLAN_FEATURE_VOWIFI_11R
 	tCsrMobilityDomainInfo MDID;
 #endif
-	tCDF_CON_MODE csrPersona;
+	enum tCDF_ADAPTER_MODE csrPersona;
 	uint8_t disableDFSChSwitch;
 	/* addIe params */
 	tSirAddIeParams addIeParams;
@@ -1061,7 +1017,6 @@ typedef struct tagCsr11rConfigParams {
 } tCsr11rConfigParams;
 #endif
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 typedef struct tagCsrNeighborRoamConfigParams {
 
 	uint32_t nNeighborScanTimerPeriod;
@@ -1083,7 +1038,6 @@ typedef struct tagCsrNeighborRoamConfigParams {
 	uint32_t nhi_rssi_scan_delay;
 	int32_t nhi_rssi_scan_rssi_ub;
 } tCsrNeighborRoamConfigParams;
-#endif
 
 typedef struct tagCsrConfigParam {
 	uint32_t FragmentationThreshold;
@@ -1174,19 +1128,12 @@ typedef struct tagCsrConfigParam {
 #ifdef FEATURE_WLAN_ESE
 	uint8_t isEseIniFeatureEnabled;
 #endif
-#ifdef FEATURE_WLAN_LFR
 	uint8_t isFastRoamIniFeatureEnabled;
 	uint8_t MAWCEnabled;
-#endif
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-	defined(FEATURE_WLAN_LFR)
 	uint8_t isFastTransitionEnabled;
 	uint8_t RoamRssiDiff;
 	bool isWESModeEnabled;
-#endif
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	tCsrNeighborRoamConfigParams neighborRoamConfig;
-#endif
 	/*
 	 * Instead of Reassoc, send ADDTS/DELTS even when ACM is off for that AC
 	 * This is mandated by WMM-AC certification
@@ -1219,6 +1166,7 @@ typedef struct tagCsrConfigParam {
 #ifdef WLAN_FEATURE_11AC
 	uint32_t nVhtChannelWidth;
 	uint8_t enableTxBF;
+	uint8_t enable_txbf_sap_mode;
 	uint8_t txBFCsnValue;
 	uint8_t enable2x2;
 	bool enableVhtFor24GHz;
@@ -1234,8 +1182,6 @@ typedef struct tagCsrConfigParam {
 	 * To enable/disable scanning only 2.4Ghz channels on first scan
 	 */
 	bool fFirstScanOnly2GChnl;
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-	defined(FEATURE_WLAN_LFR)
 	bool nRoamPrefer5GHz;
 	bool nRoamIntraBand;
 	uint8_t nProbes;
@@ -1243,7 +1189,6 @@ typedef struct tagCsrConfigParam {
 
 	bool isRoamOffloadScanEnabled;
 	bool bFastRoamInConIniFeatureEnabled;
-#endif
 	uint8_t scanCfgAgingTime;
 	uint8_t enableTxLdpc;
 	uint8_t isAmsduSupportInAMPDU;
@@ -1275,6 +1220,20 @@ typedef struct tagCsrConfigParam {
 	int8_t early_stop_scan_min_threshold;
 	int8_t early_stop_scan_max_threshold;
 	int8_t first_scan_bucket_threshold;
+	bool pnoOffload;
+	uint8_t fEnableDebugLog;
+	uint8_t max_intf_count;
+	bool enable5gEBT;
+	bool enableSelfRecovery;
+	uint32_t f_sta_miracast_mcc_rest_time_val;
+#ifdef FEATURE_AP_MCC_CH_AVOIDANCE
+	bool sap_channel_avoidance;
+#endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
+	uint8_t f_prefer_non_dfs_on_radar;
+	bool is_ps_enabled;
+	bool policy_manager_enabled;
+	uint32_t fine_time_meas_cap;
+	uint32_t dual_mac_feature_disable;
 } tCsrConfigParam;
 
 /* Tush */
@@ -1375,6 +1334,7 @@ typedef struct tagCsrRoamInfo {
 	uint8_t kck[SIR_KCK_KEY_LEN];
 	uint8_t kek[SIR_KEK_KEY_LEN];
 	uint8_t replay_ctr[SIR_REPLAY_CTR_LEN];
+	uint8_t subnet_change_status;
 #endif
 	tSirSmeChanInfo chan_info;
 	uint8_t target_channel;
@@ -1603,20 +1563,10 @@ typedef CDF_STATUS (*csr_roamSessionCloseCallback)(void *pContext);
 					 (pProfile)->BSSType)
 #define CSR_IS_ANY_BSS_TYPE(pProfile) (eCSR_BSS_TYPE_ANY == \
 				       (pProfile)->BSSType)
-#define CSR_IS_WDS_AP(pProfile)   (eCSR_BSS_TYPE_WDS_AP == (pProfile)->BSSType)
-#define CSR_IS_WDS_STA(pProfile)  (eCSR_BSS_TYPE_WDS_STA == (pProfile)->BSSType)
-#define CSR_IS_WDS(pProfile)      (CSR_IS_WDS_AP(pProfile) || \
-				   CSR_IS_WDS_STA(pProfile))
 #define CSR_IS_INFRA_AP(pProfile) (eCSR_BSS_TYPE_INFRA_AP ==  \
 				   (pProfile)->BSSType)
 #define CSR_IS_CONN_INFRA_AP(pProfile)  (eCSR_BSS_TYPE_INFRA_AP == \
 					 (pProfile)->BSSType)
-#define CSR_IS_CONN_WDS_AP(pProfile)    (eCSR_BSS_TYPE_WDS_AP == \
-					 (pProfile)->BSSType)
-#define CSR_IS_CONN_WDS_STA(pProfile)   (eCSR_BSS_TYPE_WDS_STA == \
-					 (pProfile)->BSSType)
-#define CSR_IS_CONN_WDS(pProfile)	(CSR_IS_WDS_AP(pProfile) || \
-					 CSR_IS_WDS_STA(pProfile))
 #define CSR_IS_CLOSE_SESSION_COMMAND(pCommand) \
 	((pCommand)->command == eSmeCommandDelStaSession)
 
@@ -1655,4 +1605,12 @@ CDF_STATUS csr_roam_issue_ft_roam_offload_synch(tHalHandle hHal,
 		uint32_t sessionId, tSirBssDescription *pBssDescription);
 #endif
 typedef void (*tCsrLinkStatusCallback)(uint8_t status, void *pContext);
+#ifdef FEATURE_WLAN_TDLS
+void csr_roam_fill_tdls_info(tCsrRoamInfo *roam_info, tpSirSmeJoinRsp join_rsp);
+#else
+static inline void csr_roam_fill_tdls_info(tCsrRoamInfo *roam_info,
+		tpSirSmeJoinRsp join_rsp)
+{}
+#endif
+
 #endif
diff --git a/core/sme/inc/csr_internal.h b/core/sme/inc/csr_internal.h
index aa8eba8c7185..e2bbd48eb53a 100644
--- a/core/sme/inc/csr_internal.h
+++ b/core/sme/inc/csr_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -40,9 +40,7 @@
 #include "csr_support.h"
 #include "cds_reg_service.h"
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 #include "csr_neighbor_roam.h"
-#endif
 
 #include "sir_types.h"
 
@@ -51,11 +49,6 @@
 /* define scan return criteria. LIM should use these define as well */
 #define CSR_SCAN_RETURN_AFTER_ALL_CHANNELS          (0)
 #define CSR_SCAN_RETURN_AFTER_FIRST_MATCH           (0x01)
-#define CSR_SCAN_RETURN_AFTER_5_BAND_11d_FOUND      (0x80)
-#define CSR_SCAN_RETURN_AFTER_24_BAND_11d_FOUND     (0x40)
-#define CSR_SCAN_RETURN_AFTER_EITHER_BAND_11d_FOUND \
-	(CSR_SCAN_RETURN_AFTER_5_BAND_11d_FOUND | \
-	 CSR_SCAN_RETURN_AFTER_24_BAND_11d_FOUND)
 #define CSR_NUM_RSSI_CAT        15
 #define CSR_ROAM_SCAN_CHANNEL_SWITCH_TIME        3
 
@@ -75,6 +68,10 @@
 
 #define CSR_IS_SESSION_ANY(sessionId) (sessionId == SME_SESSION_ID_ANY)
 #define CSR_MAX_NUM_COUNTRY_CODE  100
+#define CSR_IS_DFS_CH_ROAM_ALLOWED(mac_ctx) \
+	( \
+	  (((mac_ctx)->roam.configParam.allowDFSChannelRoam) ? true : false) \
+	)
 #define CSR_IS_SELECT_5GHZ_MARGIN(pMac) \
 	( \
 	  (((pMac)->roam.configParam.nSelect5GHzMargin) ? true : false) \
@@ -84,8 +81,6 @@
 	  (((pMac)->roam.configParam.roam_params.is_5g_pref_enabled) ? \
 	   true : false) \
 	)
-#if defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-	 defined(FEATURE_WLAN_LFR)
 #define CSR_IS_ROAM_PREFER_5GHZ(pMac)	\
 	( \
 	  (((pMac)->roam.configParam.nRoamPrefer5GHz) ? true : false) \
@@ -94,7 +89,6 @@
 	( \
 	  (((pMac)->roam.configParam.nRoamIntraBand) ? true : false) \
 	)
-#endif
 #define CSR_IS_FASTROAM_IN_CONCURRENCY_INI_FEATURE_ENABLED(pMac) \
 	( \
 	  (((pMac)->roam.configParam.bFastRoamInConIniFeatureEnabled) ? \
@@ -352,7 +346,7 @@ typedef struct tagCsrRoamStartBssParams {
 	uint8_t ApUapsdEnable;
 	uint8_t ssidHidden;
 	uint8_t wps_state;
-	tCDF_CON_MODE bssPersona;
+	enum tCDF_ADAPTER_MODE bssPersona;
 	uint16_t nRSNIELength;  /* If 0, pRSNIE is ignored. */
 	uint8_t *pRSNIE;        /* If not null, it has IE byte stream for RSN */
 	/* Flag used to indicate update beaconInterval */
@@ -415,7 +409,7 @@ typedef struct tagSetKeyCmd {
 	eCsrEncryptionType encType;
 	eCsrAuthType authType;
 	tAniKeyDirection keyDirection;  /* Tx, Rx or Tx-and-Rx */
-	tSirMacAddr peerMac;    /* Peer's MAC address. ALL 1's for group key */
+	struct cdf_mac_addr peermac;    /* Peer's MAC address. ALL 1's for group key */
 	uint8_t paeRole;        /* 0 for supplicant */
 	uint8_t keyId;          /* Kye index */
 	uint8_t keyLength;      /* Number of bytes containing the key in pKey */
@@ -435,7 +429,7 @@ typedef struct tagWmStatusChangeCmd {
 typedef struct tagAddStaForSessionCmd {
 	/* Session self mac addr */
 	tSirMacAddr selfMacAddr;
-	tCDF_CON_MODE currDeviceMode;
+	enum tCDF_ADAPTER_MODE currDeviceMode;
 	uint32_t type;
 	uint32_t subType;
 	uint8_t sessionId;
@@ -469,7 +463,6 @@ typedef struct tagCsr11rConfig {
 } tCsr11rConfig;
 #endif
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 typedef struct tagCsrNeighborRoamConfig {
 	uint32_t nNeighborScanTimerPeriod;
 	uint8_t nNeighborLookupRssiThreshold;
@@ -490,7 +483,6 @@ typedef struct tagCsrNeighborRoamConfig {
 	uint32_t nhi_rssi_scan_delay;
 	int32_t nhi_rssi_scan_rssi_ub;
 } tCsrNeighborRoamConfig;
-#endif
 
 typedef struct tagCsrConfig {
 	uint32_t agingCount;
@@ -575,17 +567,13 @@ typedef struct tagCsrConfig {
 #ifdef WLAN_FEATURE_VOWIFI_11R
 	tCsr11rConfig csr11rConfig;
 #endif
-#ifdef FEATURE_WLAN_LFR
 	uint8_t isFastRoamIniFeatureEnabled;
 	uint8_t MAWCEnabled;
 	uint8_t isRoamOffloadScanEnabled;
 	bool bFastRoamInConIniFeatureEnabled;
-#endif
 #ifdef FEATURE_WLAN_ESE
 	uint8_t isEseIniFeatureEnabled;
 #endif
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) \
-	|| defined(FEATURE_WLAN_LFR)
 	uint8_t isFastTransitionEnabled;
 	uint8_t RoamRssiDiff;
 	bool nRoamPrefer5GHz;
@@ -594,11 +582,8 @@ typedef struct tagCsrConfig {
 	bool nRoamScanControl;
 	uint8_t nProbes;
 	uint16_t nRoamScanHomeAwayTime;
-#endif
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	tCsrNeighborRoamConfig neighborRoamConfig;
-#endif
 
 	/*
 	 * Instead of Reassoc, send ADDTS/DELTS even when ACM is off for
@@ -616,6 +601,7 @@ typedef struct tagCsrConfig {
 #ifdef WLAN_FEATURE_11AC
 	uint32_t nVhtChannelWidth;
 	uint8_t txBFEnable;
+	uint8_t enable_txbf_sap_mode;
 	uint8_t txBFCsnValue;
 	uint8_t enable2x2;
 	bool enableVhtFor24GHz;
@@ -707,8 +693,8 @@ typedef struct tagCsrScanStruct {
 	uint8_t scanResultCfgAgingTime;
 	tSirScanType curScanType;
 	tCsrChannel channels11d;
-	tChannelListWithPower defaultPowerTable[WNI_CFG_VALID_CHANNEL_LIST_LEN];
-	tChannelListWithPower
+	struct channel_power defaultPowerTable[WNI_CFG_VALID_CHANNEL_LIST_LEN];
+	struct channel_power
 			defaultPowerTable40MHz[WNI_CFG_VALID_CHANNEL_LIST_LEN];
 	uint32_t numChannelsDefault;
 	tCsrChannel base_channels;  /* The channel base to work on */
@@ -861,8 +847,7 @@ typedef struct tagCsrRoamOffloadSynchStruct {
 	uint8_t nss;            /* no of spatial streams */
 	uint16_t chainMask;     /* chainmask */
 	uint16_t smpsMode;      /* smps.mode */
-	tSirMacAddr bssid;      /* MAC address of roamed AP */
-	bool bRoamSynchInProgress;              /* a roam offload synch */
+	struct cdf_mac_addr bssid;      /* MAC address of roamed AP */
 	tCsrRoamOffloadAuthStatus authStatus;   /* auth status */
 	uint8_t kck[SIR_KCK_KEY_LEN];
 	uint8_t kek[SIR_KEK_KEY_LEN];
@@ -983,6 +968,7 @@ typedef struct tagCsrRoamSession {
 	uint8_t psk_pmk[SIR_ROAM_SCAN_PSK_SIZE];
 	size_t pmk_len;
 	uint8_t RoamKeyMgmtOffloadEnabled;
+	roam_offload_synch_ind *roam_synch_data;
 #endif
 #if defined WLAN_FEATURE_VOWIFI_11R
 	tftSMEContext ftSmeContext;
@@ -991,6 +977,7 @@ typedef struct tagCsrRoamSession {
 	uint8_t join_bssid_count;
 	struct csr_roam_stored_profile stored_roam_profile;
 	bool ch_switch_in_progress;
+	bool roam_synch_in_progress;
 } tCsrRoamSession;
 
 typedef struct tagCsrRoamStruct {
@@ -1027,20 +1014,13 @@ typedef struct tagCsrRoamStruct {
 	tCsrTimerInfo WaitForKeyTimerInfo;
 	tCsrRoamSession *roamSession;
 	uint32_t transactionId;  /* Current transaction ID for internal use. */
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	tCsrNeighborRoamControlInfo neighborRoamInfo[CSR_ROAM_SESSION_MAX];
-#endif
-#ifdef FEATURE_WLAN_LFR
 	uint8_t isFastRoamIniFeatureEnabled;
-#endif
 #ifdef FEATURE_WLAN_ESE
 	uint8_t isEseIniFeatureEnabled;
 #endif
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) \
-	|| defined(FEATURE_WLAN_LFR)
 	uint8_t RoamRssiDiff;
 	bool isWESModeEnabled;
-#endif
 	uint32_t deauthRspStatus;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 	uint8_t *pReassocResp;          /* reassociation response from new AP */
@@ -1207,6 +1187,13 @@ typedef struct tagCsrRoamStruct {
 			(eCsrLostLink2 == (pCommand)->u.roamCmd.roamReason) || \
 			(eCsrLostLink3 == (pCommand)->u.roamCmd.roamReason))
 
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+/* bit-4 and bit-5 indicate the subnet status */
+#define CSR_GET_SUBNET_STATUS(roam_reason) (((roam_reason) & 0x30) >> 4)
+#else
+#define CSR_GET_SUBNET_STATUS(roam_reason) (0)
+#endif
+
 CDF_STATUS csr_get_channel_and_power_list(tpAniSirGlobal pMac);
 CDF_STATUS csrScanFilter11dResult(tpAniSirGlobal pMac);
 
@@ -1243,8 +1230,6 @@ bool csr_is_concurrent_infra_connected(tpAniSirGlobal pMac);
 bool csr_is_concurrent_session_running(tpAniSirGlobal pMac);
 bool csr_is_infra_ap_started(tpAniSirGlobal pMac);
 bool csr_is_ibss_started(tpAniSirGlobal pMac);
-bool csr_is_btamp_started(tpAniSirGlobal pMac);
-bool csr_is_btamp(tpAniSirGlobal pMac, uint32_t sessionId);
 bool csr_is_valid_mc_concurrent_session(tpAniSirGlobal pMac, uint32_t sessionId,
 		tSirBssDescription *pBssDesc);
 bool csr_is_conn_state_connected_infra_ap(tpAniSirGlobal pMac,
@@ -1334,7 +1319,6 @@ bool csr_neighbor_roam_is_ese_assoc(tpAniSirGlobal pMac, uint8_t sessionId);
 /* Remove this code once SLM_Sessionization is supported */
 void csr_disconnect_all_active_sessions(tpAniSirGlobal pMac);
 
-#ifdef FEATURE_WLAN_LFR
 /* Returns whether "Legacy Fast Roaming" is enabled...or not */
 bool csr_roam_is_fast_roam_enabled(tpAniSirGlobal pMac, uint32_t sessionId);
 bool csr_roam_is_roam_offload_scan_enabled(tpAniSirGlobal pMac);
@@ -1347,11 +1331,10 @@ CDF_STATUS csr_roam_offload_scan_rsp_hdlr(tpAniSirGlobal pMac,
 CDF_STATUS csr_handoff_request(tpAniSirGlobal pMac, uint8_t sessionId,
 		tCsrHandoffRequest *pHandoffInfo);
 bool csr_roam_is_sta_mode(tpAniSirGlobal pMac, uint32_t sessionId);
-#endif
 
 /* Post Channel Change Indication */
 CDF_STATUS csr_roam_channel_change_req(tpAniSirGlobal pMac,
-		struct cdf_mac_addr bssid, uint8_t cb_mode,
+		struct cdf_mac_addr bssid, chan_params_t *ch_params,
 		tCsrRoamProfile *profile);
 
 /* Post Beacon Tx Start Indication */
@@ -1360,7 +1343,8 @@ CDF_STATUS csr_roam_start_beacon_req(tpAniSirGlobal pMac,
 
 CDF_STATUS
 csr_roam_send_chan_sw_ie_request(tpAniSirGlobal pMac, struct cdf_mac_addr bssid,
-		uint8_t targetChannel, uint8_t csaIeReqd, uint8_t ch_bandwidth);
+		uint8_t targetChannel, uint8_t csaIeReqd,
+		chan_params_t *ch_params);
 CDF_STATUS
 csr_roam_modify_add_ies(tpAniSirGlobal pMac,
 		tSirModifyIE *pModifyIE, eUpdateIEsType updateType);
@@ -1378,10 +1362,9 @@ static inline void csr_roaming_report_diag_event(tpAniSirGlobal mac_ctx,
 {}
 #endif
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-void csr_process_roam_offload_synch_ind(tHalHandle hHal,
-		roam_offload_synch_ind * roam_synch_ind_ptr);
 CDF_STATUS csr_scan_save_roam_offload_ap_to_scan_cache(tpAniSirGlobal pMac,
-		roam_offload_synch_ind *roam_synch_ind_ptr);
+		roam_offload_synch_ind *roam_synch_ind_ptr,
+		tpSirBssDescription  bss_desc_ptr);
 void csr_process_ho_fail_ind(tpAniSirGlobal pMac, void *pMsgBuf);
 #endif
 bool csr_store_joinreq_param(tpAniSirGlobal mac_ctx,
@@ -1424,4 +1407,6 @@ CDF_STATUS csr_scan_process_single_bssdescr(tpAniSirGlobal pMac,
 
 bool csr_wait_for_connection_update(tpAniSirGlobal mac,
 		bool do_release_reacquire_lock);
+enum tCDF_ADAPTER_MODE csr_get_session_persona(tpAniSirGlobal pmac,
+						uint32_t session_id);
 #endif
diff --git a/core/sme/inc/csr_neighbor_roam.h b/core/sme/inc/csr_neighbor_roam.h
index 6bf27d01a963..1b888b6a2a78 100644
--- a/core/sme/inc/csr_neighbor_roam.h
+++ b/core/sme/inc/csr_neighbor_roam.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -35,7 +35,6 @@
 #ifndef CSR_NEIGHBOR_ROAM_H
 #define CSR_NEIGHBOR_ROAM_H
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 #include "sme_api.h"
 
 #define ROAM_AP_AGE_LIMIT_MS                     10000
@@ -127,7 +126,6 @@ typedef struct sCsr11rAssocNeighborInfo {
 } tCsr11rAssocNeighborInfo, *tpCsr11rAssocNeighborInfo;
 #endif /* WLAN_FEATURE_VOWIFI_11R */
 
-#ifdef FEATURE_WLAN_LFR
 typedef enum {
 	eFirstEmptyScan = 1,
 	eSecondEmptyScan,
@@ -141,7 +139,6 @@ typedef enum {
 	DEFAULT_SCAN = 0,
 	SPLIT_SCAN_OCCUPIED_LIST = 1,
 } eNeighborRoamScanMode;
-#endif
 
 /* Complete control information for neighbor roam algorithm */
 typedef struct sCsrNeighborRoamControlInfo {
@@ -165,7 +162,6 @@ typedef struct sCsrNeighborRoamControlInfo {
 	bool isVOAdmitted;
 	uint16_t MinQBssLoadRequired;
 #endif
-#ifdef FEATURE_WLAN_LFR
 	/*
 	 * Previous connected profile.
 	 * If the new profile does not match previous we re-initialize
@@ -176,7 +172,6 @@ typedef struct sCsrNeighborRoamControlInfo {
 	uint8_t uOsRequestedHandoff;
 	/* handoff related info came with upper layer's req for reassoc */
 	tCsrHandoffRequest handoffReqInfo;
-#endif
 	uint8_t currentRoamBmissFirstBcnt;
 	uint8_t currentRoamBmissFinalBcnt;
 	uint8_t currentRoamBeaconRssiWeight;
@@ -302,10 +297,10 @@ CDF_STATUS csr_roam_read_tsf(tpAniSirGlobal pMac, uint8_t *pTimestamp,
 		const uint8_t sessionId);
 #endif /*FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-CDF_STATUS csr_roam_offload_send_synch_cnf(tpAniSirGlobal pMac,
-		uint8_t sessionId);
 CDF_STATUS csr_neighbor_roam_offload_update_preauth_list(tpAniSirGlobal pMac,
 		roam_offload_synch_ind *roam_synch_ind_ptr, uint8_t sessionId);
+void csr_roam_synch_callback(tpAniSirGlobal mac,
+	roam_offload_synch_ind *roam_synch_data,
+	tpSirBssDescription  bss_desc_ptr, uint8_t reason);
 #endif
-#endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
 #endif /* CSR_NEIGHBOR_ROAM_H */
diff --git a/core/sme/inc/csr_support.h b/core/sme/inc/csr_support.h
index c484e6ec67b0..58d62f90d14a 100644
--- a/core/sme/inc/csr_support.h
+++ b/core/sme/inc/csr_support.h
@@ -224,10 +224,6 @@ typedef struct tagRoamingTimerInfo {
 	 ((pIes)->WMMParams.qosInfo & SME_QOS_AP_SUPPORTS_APSD)) || \
 	 ((pIes)->WMMInfoAp.present && (pIes)->WMMInfoAp.uapsd))
 
-/* This macro returns the total len needed of Tlv with with len bytes of data */
-#define GET_TLV_MSG_LEN(len) \
-	GET_ROUND_UP((sizeof(tCsrCfgMsgTlvHdr) + (len)), sizeof(uint32_t))
-
 bool csr_get_bss_id_bss_desc(tHalHandle hHal, tSirBssDescription *pSirBssDesc,
 		struct cdf_mac_addr *pBssId);
 bool csr_is_bss_id_equal(tHalHandle hHal, tSirBssDescription *pSirBssDesc1,
@@ -311,7 +307,6 @@ bool csr_is_security_match(tHalHandle hHal, tCsrAuthList *authType,
 		eCsrEncryptionType *negotiatedMCCipher);
 bool csr_is_bss_type_match(eCsrRoamBssType bssType1, eCsrRoamBssType bssType2);
 bool csr_is_bss_type_ibss(eCsrRoamBssType bssType);
-bool csr_is_bss_type_wds(eCsrRoamBssType bssType);
 /*
  * ppIes can be NULL. If caller want to get the *ppIes allocated by
  * this function, pass in *ppIes = NULL. Caller needs to free the memory
@@ -361,11 +356,11 @@ CDF_STATUS csr_reassoc(tpAniSirGlobal pMac, uint32_t sessionId,
 		uint32_t *pRoamId, bool fForce);
 
 CDF_STATUS csr_isconcurrentsession_valid(tpAniSirGlobal pMac,
-		uint32_t cursessionId, tCDF_CON_MODE currBssPersona);
+		uint32_t cursessionId, enum tCDF_ADAPTER_MODE currBssPersona);
 /* BeaconInterval validation for MCC support */
 CDF_STATUS csr_validate_mcc_beacon_interval(tpAniSirGlobal pMac, uint8_t channelId,
 		uint16_t *beaconInterval, uint32_t cursessionId,
-		tCDF_CON_MODE currBssPersona);
+		enum tCDF_ADAPTER_MODE currBssPersona);
 #ifdef WLAN_FEATURE_VOWIFI_11R
 bool csr_is_profile11r(tCsrRoamProfile *pProfile);
 bool csr_is_auth_type11r(eCsrAuthType AuthType, uint8_t mdiePresent);
diff --git a/core/sme/inc/oem_data_api.h b/core/sme/inc/oem_data_api.h
index c7ec08c3b4f0..f60c9a44ed60 100644
--- a/core/sme/inc/oem_data_api.h
+++ b/core/sme/inc/oem_data_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -53,7 +53,8 @@
 /* Structure for defining req sent to the PE */
 typedef struct tagOemDataReq {
 	uint8_t sessionId;
-	uint8_t oemDataReq[OEM_DATA_REQ_SIZE];
+	uint8_t data_len;
+	uint8_t *data;
 } tOemDataReq, tOemDataReqConfig;
 
 typedef struct tagOemDataRsp {
@@ -76,9 +77,7 @@ typedef CDF_STATUS (*oem_data_oem_data_reqCompleteCallback)(tHalHandle,
 		void *p2, uint32_t oemDataReqID, eOemDataReqStatus status);
 
 CDF_STATUS oem_data_oem_data_req(tHalHandle, uint8_t, tOemDataReqConfig *,
-		uint32_t *pOemDataReqID,
-		oem_data_oem_data_reqCompleteCallback callback,
-		void *pContext);
+				 uint32_t *pOemDataReqID);
 CDF_STATUS sme_handle_oem_data_rsp(tHalHandle hHal, uint8_t *);
 CDF_STATUS oem_data_is_oem_data_req_allowed(tHalHandle hHal);
 typedef void (*sme_send_oem_data_rsp_msg)(int length, uint8_t *oem_data_rsp);
diff --git a/core/sme/inc/oem_data_internal.h b/core/sme/inc/oem_data_internal.h
index bf6a63460c77..0fa8857a2671 100644
--- a/core/sme/inc/oem_data_internal.h
+++ b/core/sme/inc/oem_data_internal.h
@@ -59,8 +59,6 @@ typedef struct tagOemDataStruct {
 
 typedef struct tagOemDataCmd {
 	uint32_t oemDataReqID;
-	oem_data_oem_data_reqCompleteCallback callback;
-	void *pContext;
 	tOemDataReq oemDataReq;
 } tOemDataCmd;
 #endif /* __OEM_DATA_INTERNAL_H__ */
diff --git a/core/sme/inc/sme_api.h b/core/sme/inc/sme_api.h
index b4af548b7f9d..49850aae7cb2 100644
--- a/core/sme/inc/sme_api.h
+++ b/core/sme/inc/sme_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -71,8 +71,6 @@
 
 #define SME_INVALID_COUNTRY_CODE "XX"
 
-#define SME_2_4_GHZ_MAX_FREQ    3000
-
 #define SME_SET_CHANNEL_REG_POWER(reg_info_1, val) do {	\
 	reg_info_1 &= 0xff00ffff;	      \
 	reg_info_1 |= ((val & 0xff) << 16);   \
@@ -95,44 +93,6 @@ typedef struct _smeConfigParams {
 #if defined WLAN_FEATURE_VOWIFI
 	struct rrm_config_param rrmConfig;
 #endif
-#if defined FEATURE_WLAN_LFR
-	uint8_t isFastRoamIniFeatureEnabled;
-	uint8_t MAWCEnabled;
-#endif
-#if defined FEATURE_WLAN_ESE
-	uint8_t isEseIniFeatureEnabled;
-#endif
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-	defined(FEATURE_WLAN_LFR)
-	uint8_t isFastTransitionEnabled;
-	uint8_t RoamRssiDiff;
-	bool isWESModeEnabled;
-#endif
-	uint8_t isAmsduSupportInAMPDU;
-	bool pnoOffload;
-	uint8_t fEnableDebugLog;
-	uint8_t max_intf_count;
-	bool enable5gEBT;
-	bool enableSelfRecovery;
-	uint32_t f_sta_miracast_mcc_rest_time_val;
-#ifdef FEATURE_AP_MCC_CH_AVOIDANCE
-	bool sap_channel_avoidance;
-#endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
-	uint8_t f_prefer_non_dfs_on_radar;
-	bool is_ps_enabled;
-	bool policy_manager_enabled;
-	uint32_t fine_time_meas_cap;
-	uint32_t dual_mac_feature_disable;
-#ifdef FEATURE_WLAN_SCAN_PNO
-	bool pno_channel_prediction;
-	uint8_t top_k_num_of_channels;
-	uint8_t stationary_thresh;
-	uint32_t channel_prediction_full_scan;
-#endif
-	bool early_stop_scan_enable;
-	int8_t early_stop_scan_min_threshold;
-	int8_t early_stop_scan_max_threshold;
-	int8_t first_scan_bucket_threshold;
 } tSmeConfigParams, *tpSmeConfigParams;
 
 #ifdef FEATURE_WLAN_TDLS
@@ -156,10 +116,20 @@ typedef struct _smeTdlsPeerCapParams {
 	uint8_t opClassForPrefOffChan;
 } tSmeTdlsPeerCapParams;
 
+/**
+ * eSmeTdlsPeerState - tdls peer state
+ * @eSME_TDLS_PEER_STATE_PEERING: tdls connection in progress
+ * @eSME_TDLS_PEER_STATE_CONNECTED: tdls peer is connected
+ * @eSME_TDLS_PEER_STATE_TEARDOWN: tdls peer is tear down
+ * @eSME_TDLS_PEER_ADD_MAC_ADDR: add peer mac into connection table
+ * @eSME_TDLS_PEER_REMOVE_MAC_ADDR: remove peer mac from connection table
+ */
 typedef enum {
 	eSME_TDLS_PEER_STATE_PEERING,
 	eSME_TDLS_PEER_STATE_CONNECTED,
-	eSME_TDLS_PEER_STATE_TEARDOWN
+	eSME_TDLS_PEER_STATE_TEARDOWN,
+	eSME_TDLS_PEER_ADD_MAC_ADDR,
+	eSME_TDLS_PEER_REMOVE_MAC_ADDR,
 } eSmeTdlsPeerState;
 
 typedef struct _smeTdlsPeerStateParams {
@@ -222,7 +192,7 @@ typedef enum {
   ------------------------------------------------------------------------*/
 CDF_STATUS sme_open(tHalHandle hHal);
 CDF_STATUS sme_init_chan_list(tHalHandle hal, uint8_t *alpha2,
-		COUNTRY_CODE_SOURCE cc_src);
+		enum country_src cc_src);
 CDF_STATUS sme_close(tHalHandle hHal);
 CDF_STATUS sme_start(tHalHandle hHal);
 CDF_STATUS sme_stop(tHalHandle hHal, tHalStopType stopType);
@@ -230,7 +200,8 @@ CDF_STATUS sme_open_session(tHalHandle hHal, csr_roam_completeCallback callback,
 		void *pContext, uint8_t *pSelfMacAddr,
 		uint8_t *pbSessionId, uint32_t type,
 		uint32_t subType);
-void sme_set_curr_device_mode(tHalHandle hHal, tCDF_CON_MODE currDeviceMode);
+void sme_set_curr_device_mode(tHalHandle hHal,
+		enum tCDF_ADAPTER_MODE currDeviceMode);
 CDF_STATUS sme_close_session(tHalHandle hHal, uint8_t sessionId,
 		csr_roamSessionCloseCallback callback,
 		void *pContext);
@@ -238,11 +209,11 @@ CDF_STATUS sme_update_roam_params(tHalHandle hHal, uint8_t session_id,
 		struct roam_ext_params roam_params_src, int update_param);
 #ifdef FEATURE_WLAN_SCAN_PNO
 void sme_update_roam_pno_channel_prediction_config(
-		tHalHandle hal, tpSmeConfigParams sme_config,
+		tHalHandle hal, tCsrConfigParam * csr_config,
 		uint8_t copy_from_to);
 #else
 static inline void sme_update_roam_pno_channel_prediction_config(
-		tHalHandle hal, tpSmeConfigParams sme_config,
+		tHalHandle hal, tCsrConfigParam *csr_config,
 		uint8_t copy_from_to)
 {}
 #endif
@@ -322,8 +293,7 @@ CDF_STATUS sme_roam_get_connect_state(tHalHandle hHal, uint8_t sessionId,
 		eCsrConnectState *pState);
 CDF_STATUS sme_roam_get_connect_profile(tHalHandle hHal, uint8_t sessionId,
 		tCsrRoamConnectedProfile *pProfile);
-CDF_STATUS sme_roam_free_connect_profile(tHalHandle hHal,
-		tCsrRoamConnectedProfile *pProfile);
+void sme_roam_free_connect_profile(tCsrRoamConnectedProfile *profile);
 CDF_STATUS sme_roam_set_pmkid_cache(tHalHandle hHal, uint8_t sessionId,
 		tPmkidCacheInfo *pPMKIDCache,
 		uint32_t numItems,
@@ -386,6 +356,12 @@ extern CDF_STATUS sme_register11d_scan_done_callback(tHalHandle hHal,
 #ifdef FEATURE_OEM_DATA_SUPPORT
 extern CDF_STATUS sme_register_oem_data_rsp_callback(tHalHandle h_hal,
 		sme_send_oem_data_rsp_msg callback);
+#else
+static inline CDF_STATUS sme_register_oem_data_rsp_callback(tHalHandle h_hal,
+		sme_send_oem_data_rsp_msg callback)
+{
+	return CDF_STATUS_SUCCESS;
+}
 #endif
 
 extern CDF_STATUS sme_wow_add_pattern(tHalHandle hHal,
@@ -433,9 +409,7 @@ CDF_STATUS sme_change_country_code(tHalHandle hHal,
 		tAniBool countryFromUserSpace,
 		tAniBool sendRegHint);
 CDF_STATUS sme_generic_change_country_code(tHalHandle hHal,
-		uint8_t *pCountry,
-		v_REGDOMAIN_t reg_domain);
-
+					   uint8_t *pCountry);
 CDF_STATUS sme_dhcp_start_ind(tHalHandle hHal,
 		uint8_t device_mode,
 		uint8_t *macAddr, uint8_t sessionId);
@@ -467,9 +441,7 @@ CDF_STATUS sme_scan_get_bkid_candidate_list(tHalHandle hHal, uint32_t sessionId,
 CDF_STATUS sme_oem_data_req(tHalHandle hHal,
 		uint8_t sessionId,
 		tOemDataReqConfig *,
-		uint32_t *pOemDataReqID,
-		oem_data_oem_data_reqCompleteCallback callback,
-		void *pContext);
+		uint32_t *pOemDataReqID);
 #endif /*FEATURE_OEM_DATA_SUPPORT */
 CDF_STATUS sme_roam_update_apwpsie(tHalHandle, uint8_t sessionId,
 		tSirAPWPSIEs * pAPWPSIES);
@@ -492,7 +464,7 @@ CDF_STATUS sme_configure_rxp_filter(tHalHandle hHal,
 		tpSirWlanSetRxpFilters wlanRxpFilterParam);
 CDF_STATUS sme_ConfigureAppsCpuWakeupState(tHalHandle hHal, bool isAppsAwake);
 CDF_STATUS sme_configure_suspend_ind(tHalHandle hHal,
-		tpSirWlanSuspendParam wlanSuspendParam,
+		uint32_t conn_state_mask,
 		csr_readyToSuspendCallback,
 		void *callbackContext);
 CDF_STATUS sme_configure_resume_req(tHalHandle hHal,
@@ -557,7 +529,7 @@ CDF_STATUS sme_set_max_tx_power(tHalHandle hHal, struct cdf_mac_addr pBssid,
 CDF_STATUS sme_set_max_tx_power_per_band(eCsrBand band, int8_t db);
 CDF_STATUS sme_set_tx_power(tHalHandle hHal, uint8_t sessionId,
 		struct cdf_mac_addr bssid,
-		tCDF_CON_MODE dev_mode, int power);
+		enum tCDF_ADAPTER_MODE dev_mode, int power);
 CDF_STATUS sme_set_custom_mac_addr(tSirMacAddr customMacAddr);
 CDF_STATUS sme_hide_ssid(tHalHandle hHal, uint8_t sessionId,
 		uint8_t ssidHidden);
@@ -566,8 +538,6 @@ CDF_STATUS sme_set_tm_level(tHalHandle hHal, uint16_t newTMLevel,
 void sme_feature_caps_exchange(tHalHandle hHal);
 void sme_disable_feature_capablity(uint8_t feature_index);
 void sme_reset_power_values_for5_g(tHalHandle hHal);
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-		defined(FEATURE_WLAN_LFR)
 CDF_STATUS sme_update_roam_prefer5_g_hz(tHalHandle hHal, bool nRoamPrefer5GHz);
 CDF_STATUS sme_set_roam_intra_band(tHalHandle hHal, const bool nRoamIntraBand);
 CDF_STATUS sme_update_roam_scan_n_probes(tHalHandle hHal, uint8_t sessionId,
@@ -588,9 +558,7 @@ CDF_STATUS sme_update_wes_mode(tHalHandle hHal, bool isWESModeEnabled,
 		uint8_t sessionId);
 CDF_STATUS sme_set_roam_scan_control(tHalHandle hHal, uint8_t sessionId,
 		bool roamScanControl);
-#endif /* (WLAN_FEATURE_VOWIFI_11R)||(FEATURE_WLAN_ESE)||(FEATURE_WLAN_LFR) */
 
-#ifdef FEATURE_WLAN_LFR
 CDF_STATUS sme_update_is_fast_roam_ini_feature_enabled(tHalHandle hHal,
 		uint8_t sessionId,
 		const bool
@@ -602,14 +570,12 @@ CDF_STATUS sme_start_roaming(tHalHandle hHal, uint8_t sessionId,
 		uint8_t reason);
 CDF_STATUS sme_update_enable_fast_roam_in_concurrency(tHalHandle hHal,
 		bool bFastRoamInConIniFeatureEnabled);
-#endif /* FEATURE_WLAN_LFR */
 #ifdef FEATURE_WLAN_ESE
 CDF_STATUS sme_update_is_ese_feature_enabled(tHalHandle hHal, uint8_t sessionId,
 		const bool isEseIniFeatureEnabled);
 #endif /* FEATURE_WLAN_ESE */
 CDF_STATUS sme_update_config_fw_rssi_monitoring(tHalHandle hHal,
 		bool fEnableFwRssiMonitoring);
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 CDF_STATUS sme_set_roam_rescan_rssi_diff(tHalHandle hHal,
 		uint8_t sessionId,
 		const uint8_t nRoamRescanRssiDiff);
@@ -659,9 +625,6 @@ uint8_t sme_get_roam_bmiss_final_bcnt(tHalHandle hHal);
 CDF_STATUS sme_set_roam_beacon_rssi_weight(tHalHandle hHal, uint8_t sessionId,
 		const uint8_t nRoamBeaconRssiWeight);
 uint8_t sme_get_roam_beacon_rssi_weight(tHalHandle hHal);
-#endif
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-		defined(FEATURE_WLAN_LFR)
 uint8_t sme_get_roam_rssi_diff(tHalHandle hHal);
 CDF_STATUS sme_change_roam_scan_channel_list(tHalHandle hHal, uint8_t sessionId,
 		uint8_t *pChannelList,
@@ -679,7 +642,6 @@ bool sme_get_wes_mode(tHalHandle hHal);
 bool sme_get_roam_scan_control(tHalHandle hHal);
 bool sme_get_is_lfr_feature_enabled(tHalHandle hHal);
 bool sme_get_is_ft_feature_enabled(tHalHandle hHal);
-#endif
 CDF_STATUS sme_update_roam_scan_offload_enabled(tHalHandle hHal,
 		bool nRoamScanOffloadEnabled);
 uint8_t sme_is_feature_supported_by_fw(uint8_t featEnumValue);
@@ -794,12 +756,13 @@ CDF_STATUS sme_set_auto_shutdown_cb(tHalHandle hHal, void (*pCallbackfn)(void));
 CDF_STATUS sme_set_auto_shutdown_timer(tHalHandle hHal, uint32_t timer_value);
 #endif
 CDF_STATUS sme_roam_channel_change_req(tHalHandle hHal,
-		struct cdf_mac_addr bssid, uint32_t cb_mode,
+		struct cdf_mac_addr bssid, chan_params_t *ch_params,
 		tCsrRoamProfile *profile);
 CDF_STATUS sme_roam_start_beacon_req(tHalHandle hHal,
 		struct cdf_mac_addr bssid, uint8_t dfsCacWaitStatus);
 CDF_STATUS sme_roam_csa_ie_request(tHalHandle hHal, struct cdf_mac_addr bssid,
-		uint8_t targetChannel, uint8_t csaIeReqd, uint8_t ch_bandwidth);
+		uint8_t targetChannel, uint8_t csaIeReqd,
+		chan_params_t *ch_params);
 CDF_STATUS sme_init_thermal_info(tHalHandle hHal,
 		tSmeThermalParams thermalParam);
 CDF_STATUS sme_set_thermal_level(tHalHandle hHal, uint8_t level);
@@ -813,6 +776,7 @@ CDF_STATUS sme_modify_add_ie(tHalHandle hHal,
 CDF_STATUS sme_update_add_ie(tHalHandle hHal,
 		tSirUpdateIE *pUpdateIE, eUpdateIEsType updateType);
 CDF_STATUS sme_update_connect_debug(tHalHandle hHal, uint32_t set_value);
+const char *sme_request_type_to_string(const uint8_t request_type);
 CDF_STATUS sme_ap_disable_intra_bss_fwd(tHalHandle hHal, uint8_t sessionId,
 		bool disablefwd);
 uint32_t sme_get_channel_bonding_mode5_g(tHalHandle hHal);
@@ -873,6 +837,12 @@ sme_set_ssid_hotlist(tHalHandle hal,
 
 CDF_STATUS sme_ext_scan_register_callback(tHalHandle hHal,
 		void (*pExtScanIndCb)(void *, const uint16_t, void *));
+#else
+static inline CDF_STATUS sme_ext_scan_register_callback(tHalHandle hHal,
+		void (*pExtScanIndCb)(void *, const uint16_t, void *))
+{
+	return CDF_STATUS_SUCCESS;
+}
 #endif /* FEATURE_WLAN_EXTSCAN */
 CDF_STATUS sme_abort_roam_scan(tHalHandle hHal, uint8_t sessionId);
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -980,6 +950,9 @@ CDF_STATUS sme_set_rssi_monitoring(tHalHandle hal,
 CDF_STATUS sme_set_rssi_threshold_breached_cb(tHalHandle hal,
 			void (*cb)(void *, struct rssi_breach_event *));
 
+CDF_STATUS sme_register_mgmt_frame_ind_callback(tHalHandle hal,
+			sir_mgmt_frame_ind_callback callback);
+
 CDF_STATUS sme_update_nss(tHalHandle h_hal, uint8_t nss);
 
 bool sme_is_any_session_in_connected_state(tHalHandle h_hal);
@@ -1067,4 +1040,23 @@ sme_get_opclass(tHalHandle hal, uint8_t channel, uint8_t bw_offset,
 }
 #endif
 
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+CDF_STATUS sme_gateway_param_update(tHalHandle hHal,
+				struct gateway_param_update_req *request);
+#endif
+
+#ifdef FEATURE_GREEN_AP
+CDF_STATUS sme_send_egap_conf_params(uint32_t enable,
+				     uint32_t inactivity_time,
+				     uint32_t wait_time,
+				     uint32_t flags);
+#else
+static inline CDF_STATUS sme_send_egap_conf_params(uint32_t enable,
+						   uint32_t inactivity_time,
+						   uint32_t wait_time,
+						   uint32_t flags)
+{
+	return CDF_STATUS_E_NOSUPPORT;
+}
+#endif
 #endif /* #if !defined( __SME_API_H ) */
diff --git a/core/sme/inc/sme_inside.h b/core/sme/inc/sme_inside.h
index 4994c30a34bb..ed5f1a8ec59d 100644
--- a/core/sme/inc/sme_inside.h
+++ b/core/sme/inc/sme_inside.h
@@ -264,8 +264,6 @@ CDF_STATUS tdls_msg_processor(tpAniSirGlobal pMac, uint16_t msg_type,
 		void *pMsgBuf);
 #endif /* FEATURE_WLAN_TDLS */
 
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-		 defined(FEATURE_WLAN_LFR)
 CDF_STATUS csr_flush_cfg_bg_scan_roam_channel_list(tpAniSirGlobal pMac,
 		uint8_t sessionId);
 CDF_STATUS csr_create_bg_scan_roam_channel_list(tpAniSirGlobal pMac,
@@ -273,7 +271,6 @@ CDF_STATUS csr_create_bg_scan_roam_channel_list(tpAniSirGlobal pMac,
 		const uint8_t numChannels);
 CDF_STATUS csr_update_bg_scan_config_ini_channel_list(tpAniSirGlobal pMac,
 		uint8_t sessionId, eCsrBand eBand);
-#endif
 
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 CDF_STATUS csr_create_roam_scan_channel_list(tpAniSirGlobal pMac,
diff --git a/core/sme/inc/sme_internal.h b/core/sme/inc/sme_internal.h
index eb1915f10fb8..9c0437b7f4e4 100644
--- a/core/sme/inc/sme_internal.h
+++ b/core/sme/inc/sme_internal.h
@@ -148,7 +148,7 @@ typedef struct tagSmeStruct {
 	tDblLinkList smeCmdActiveList;
 	tDblLinkList smeCmdPendingList;
 	tDblLinkList smeCmdFreeList;    /* preallocated roam cmd list */
-	tCDF_CON_MODE currDeviceMode;
+	enum tCDF_ADAPTER_MODE currDeviceMode;
 #ifdef FEATURE_WLAN_LPHB
 	void (*pLphbIndCb)(void *pHddCtx, tSirLPHBInd *indParam);
 #endif /* FEATURE_WLAN_LPHB */
diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c
index 948f8bb74e71..e2607e99d0c8 100644
--- a/core/sme/src/common/sme_api.c
+++ b/core/sme/src/common/sme_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -63,8 +63,6 @@
 extern tSirRetStatus u_mac_post_ctrl_msg(void *pSirGlobal, tSirMbMsg *pMb);
 
 #define LOG_SIZE 256
-#define READ_MEMORY_DUMP_CMD     9
-#define TL_INIT_STATE            0
 
 static tSelfRecoveryStats g_self_recovery_stats;
 /* TxMB Functions */
@@ -76,8 +74,6 @@ extern void qos_release_command(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 extern CDF_STATUS p2p_process_remain_on_channel_cmd(tpAniSirGlobal pMac,
 						    tSmeCmd *p2pRemainonChn);
 extern CDF_STATUS sme_remain_on_chn_rsp(tpAniSirGlobal pMac, uint8_t *pMsg);
-extern CDF_STATUS sme_mgmt_frm_ind(tHalHandle hHal,
-				   tpSirSmeMgmtFrameInd pSmeMgmtFrm);
 extern CDF_STATUS sme_remain_on_chn_ready(tHalHandle hHal, uint8_t *pMsg);
 extern CDF_STATUS sme_send_action_cnf(tHalHandle hHal, uint8_t *pMsg);
 
@@ -1049,9 +1045,6 @@ CDF_STATUS sme_open(tHalHandle hHal)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-#ifndef WLAN_FEATURE_MBSSID
-	void *p_cds_gctx = cds_get_global_context();
-#endif
 
 	pMac->sme.state = SME_STATE_STOP;
 	pMac->sme.currDeviceMode = CDF_STA_MODE;
@@ -1096,18 +1089,6 @@ CDF_STATUS sme_open(tHalHandle hHal)
 	status = init_sme_cmd_list(pMac);
 	if (!CDF_IS_STATUS_SUCCESS(status))
 		return status;
-#ifndef WLAN_FEATURE_MBSSID
-	if (NULL == p_cds_gctx) {
-		sms_log(pMac, LOGE, FL("p_cds_gctx is NULL"));
-		return CDF_STATUS_E_FAILURE;
-	}
-	status = wlansap_open(p_cds_gctx);
-	if (!CDF_IS_STATUS_SUCCESS(status)) {
-		sms_log(pMac, LOGE, FL("wlansap_open failed, status=%d"),
-			status);
-		return status;
-	}
-#endif
 
 #if defined WLAN_FEATURE_VOWIFI
 	status = rrm_open(pMac);
@@ -1125,11 +1106,11 @@ CDF_STATUS sme_open(tHalHandle hHal)
  * sme_init_chan_list, triggers channel setup based on country code.
  */
 CDF_STATUS sme_init_chan_list(tHalHandle hal, uint8_t *alpha2,
-			      COUNTRY_CODE_SOURCE cc_src)
+			      enum country_src cc_src)
 {
 	tpAniSirGlobal pmac = PMAC_STRUCT(hal);
 
-	if ((cc_src == COUNTRY_CODE_SET_BY_USER) &&
+	if ((cc_src == SOURCE_USERSPACE) &&
 	    (pmac->roam.configParam.fSupplicantCountryCodeHasPriority)) {
 		pmac->roam.configParam.Is11dSupportEnabled = false;
 	}
@@ -1403,47 +1384,6 @@ CDF_STATUS sme_update_config(tHalHandle hHal, tpSmeConfigParams pSmeConfigParams
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
 			  "Could not pass on WNI_CFG_SCAN_IN_POWERSAVE to CFG");
 	}
-	pMac->isCoalesingInIBSSAllowed =
-		pSmeConfigParams->csrConfig.isCoalesingInIBSSAllowed;
-
-	/* update p2p offload status */
-	pMac->pnoOffload = pSmeConfigParams->pnoOffload;
-
-	pMac->fEnableDebugLog = pSmeConfigParams->fEnableDebugLog;
-
-	/* update interface configuration */
-	pMac->sme.max_intf_count = pSmeConfigParams->max_intf_count;
-
-	pMac->enable5gEBT = pSmeConfigParams->enable5gEBT;
-	pMac->sme.enableSelfRecovery = pSmeConfigParams->enableSelfRecovery;
-
-	pMac->f_sta_miracast_mcc_rest_time_val =
-		pSmeConfigParams->f_sta_miracast_mcc_rest_time_val;
-
-#ifdef FEATURE_AP_MCC_CH_AVOIDANCE
-	pMac->sap.sap_channel_avoidance =
-		pSmeConfigParams->sap_channel_avoidance;
-#endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
-
-	pMac->f_prefer_non_dfs_on_radar =
-		pSmeConfigParams->f_prefer_non_dfs_on_radar;
-
-	pMac->sme.ps_global_info.ps_enabled =
-		pSmeConfigParams->is_ps_enabled;
-
-	pMac->policy_manager_enabled = pSmeConfigParams->policy_manager_enabled;
-	pMac->fine_time_meas_cap = pSmeConfigParams->fine_time_meas_cap;
-	pMac->dual_mac_feature_disable =
-				pSmeConfigParams->dual_mac_feature_disable;
-	sme_update_roam_pno_channel_prediction_config(pMac, pSmeConfigParams,
-			SME_CONFIG_TO_ROAM_CONFIG);
-	pMac->roam.configParam.early_stop_scan_enable =
-		pSmeConfigParams->early_stop_scan_enable;
-	pMac->roam.configParam.early_stop_scan_min_threshold =
-		pSmeConfigParams->early_stop_scan_min_threshold;
-	pMac->roam.configParam.early_stop_scan_max_threshold =
-		pSmeConfigParams->early_stop_scan_max_threshold;
-
 	return status;
 }
 
@@ -1511,13 +1451,12 @@ CDF_STATUS sme_update_roam_params(tHalHandle hal,
 		break;
 	case REASON_ROAM_SET_BLACKLIST_BSSID:
 		cdf_mem_set(&roam_params_dst->bssid_avoid_list, 0,
-			sizeof(tSirMacAddr) * MAX_BSSID_AVOID_LIST);
+			CDF_MAC_ADDR_SIZE * MAX_BSSID_AVOID_LIST);
 		roam_params_dst->num_bssid_avoid_list =
 			roam_params_src.num_bssid_avoid_list;
 		for (i = 0; i < roam_params_dst->num_bssid_avoid_list; i++) {
-			cdf_mem_copy(&roam_params_dst->bssid_avoid_list[i],
-				&roam_params_src.bssid_avoid_list[i],
-				sizeof(tSirMacAddr));
+			cdf_copy_macaddr(&roam_params_dst->bssid_avoid_list[i],
+					&roam_params_src.bssid_avoid_list[i]);
 		}
 		break;
 	case REASON_ROAM_GOOD_RSSI_CHANGED:
@@ -1699,6 +1638,7 @@ CDF_STATUS sme_hdd_ready_ind(tHalHandle hHal)
 		Msg.messageType = eWNI_SME_SYS_READY_IND;
 		Msg.length = sizeof(tSirSmeReadyReq);
 		Msg.add_bssdescr_cb = csr_scan_process_single_bssdescr;
+		Msg.csr_roam_synch_cb = csr_roam_synch_callback;
 
 
 		if (eSIR_FAILURE != u_mac_post_ctrl_msg(hHal, (tSirMbMsg *) &Msg)) {
@@ -1758,17 +1698,6 @@ CDF_STATUS sme_start(tHalHandle hHal)
 				status);
 			break;
 		}
-
-#ifndef WLAN_FEATURE_MBSSID
-		status = wlansap_start(cds_get_global_context());
-		if (!CDF_IS_STATUS_SUCCESS(status)) {
-			sms_log(pMac, LOGE,
-				"wlansap_start failed during smeStart with status=%d",
-				status);
-			break;
-		}
-#endif
-
 		pMac->sme.state = SME_STATE_START;
 	} while (0);
 
@@ -1804,6 +1733,7 @@ static CDF_STATUS sme_handle_scan_req(tpAniSirGlobal mac_ctx,
 			FL("scan request failed. session_id %d"), session_id);
 	}
 	csr_scan_free_request(mac_ctx, scan_msg->scan_param);
+	cdf_mem_free(scan_msg->scan_param);
 	return status;
 }
 
@@ -2247,11 +2177,6 @@ CDF_STATUS sme_process_msg(tHalHandle hHal, cds_msg_t *pMsg)
 	}
 	switch (pMsg->type) {
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	case eWNI_SME_ROAM_OFFLOAD_SYNCH_IND:
-		csr_process_roam_offload_synch_ind(pMac,
-				(roam_offload_synch_ind *) pMsg->bodyptr);
-		cdf_mem_free(pMsg->bodyptr);
-		break;
 	case eWNI_SME_HO_FAIL_IND:
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
 			  FL("LFR3: Rcvd eWNI_SME_HO_FAIL_IND"));
@@ -2353,15 +2278,6 @@ CDF_STATUS sme_process_msg(tHalHandle hHal, cds_msg_t *pMsg)
 				pMsg->type);
 		}
 		break;
-	case eWNI_SME_MGMT_FRM_IND:
-		if (pMsg->bodyptr) {
-			sme_mgmt_frm_ind(pMac, pMsg->bodyptr);
-			cdf_mem_free(pMsg->bodyptr);
-		} else {
-			sms_log(pMac, LOGE, FL("Empty message for %d"),
-				pMsg->type);
-		}
-		break;
 	case eWNI_SME_ACTION_FRAME_SEND_CNF:
 		if (pMsg->bodyptr) {
 			status = sme_send_action_cnf(pMac, pMsg->bodyptr);
@@ -2888,16 +2804,6 @@ CDF_STATUS sme_stop(tHalHandle hHal, tHalStopType stopType)
 	CDF_STATUS fail_status = CDF_STATUS_SUCCESS;
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 
-#ifndef WLAN_FEATURE_MBSSID
-	status = wlansap_stop(cds_get_global_context());
-	if (!CDF_IS_STATUS_SUCCESS(status)) {
-		sms_log(pMac, LOGE,
-			"wlansap_stop failed during smeStop with status=%d",
-			status);
-		fail_status = status;
-	}
-#endif
-
 	p2p_stop(hHal);
 
 	status = csr_stop(pMac, stopType);
@@ -2954,16 +2860,6 @@ CDF_STATUS sme_close(tHalHandle hHal)
 			status);
 		fail_status = status;
 	}
-#ifndef WLAN_FEATURE_MBSSID
-	status = wlansap_close(cds_get_global_context());
-	if (!CDF_IS_STATUS_SUCCESS(status)) {
-		sms_log(pMac, LOGE,
-			"WLANSAP_close failed during sme close with status=%d",
-			status);
-		fail_status = status;
-	}
-#endif
-
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
 	status = sme_qos_close(pMac);
 	if (!CDF_IS_STATUS_SUCCESS(status)) {
@@ -3094,6 +2990,7 @@ CDF_STATUS sme_scan_request(tHalHandle hal, uint8_t session_id,
 		sms_log(mac_ctx, LOGE,
 			" sme_scan_req failed to post msg");
 		csr_scan_free_request(mac_ctx, scan_msg->scan_param);
+		cdf_mem_free(scan_msg->scan_param);
 		cdf_mem_free(scan_msg);
 		status = CDF_STATUS_E_FAILURE;
 	}
@@ -4034,31 +3931,20 @@ CDF_STATUS sme_roam_get_connect_profile(tHalHandle hHal, uint8_t sessionId,
 	return status;
 }
 
-/* ---------------------------------------------------------------------------
-    \fn sme_roam_free_connect_profile
-    \brief a wrapper function to request CSR to free and reinitialize the
-	profile returned previously by csr_roam_get_connect_profile.
-    This is a synchronous call.
-    \param pProfile - pointer to a caller allocated structure
-		      tCsrRoamConnectedProfile
-    \return CDF_STATUS.
-   ---------------------------------------------------------------------------*/
-CDF_STATUS sme_roam_free_connect_profile(tHalHandle hHal,
-					 tCsrRoamConnectedProfile *pProfile)
+/**
+ * sme_roam_free_connect_profile - a wrapper function to request CSR to free and
+ * reinitialize the profile returned previously by csr_roam_get_connect_profile.
+ *
+ * @profile - pointer to a caller allocated structure tCsrRoamConnectedProfile
+ *
+ * Return: none
+ */
+void sme_roam_free_connect_profile(tCsrRoamConnectedProfile *profile)
 {
-	CDF_STATUS status = CDF_STATUS_E_FAILURE;
-	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-
 	MTRACE(cdf_trace(CDF_MODULE_ID_SME,
 			 TRACE_CODE_SME_RX_HDD_ROAM_FREE_CONNECTPROFILE,
 			 NO_SESSION, 0));
-	status = sme_acquire_global_lock(&pMac->sme);
-	if (CDF_IS_STATUS_SUCCESS(status)) {
-		status = csr_roam_free_connect_profile(pMac, pProfile);
-		sme_release_global_lock(&pMac->sme);
-	}
-
-	return status;
+	csr_roam_free_connect_profile(profile);
 }
 
 /* ---------------------------------------------------------------------------
@@ -4316,32 +4202,9 @@ CDF_STATUS sme_get_config_param(tHalHandle hHal, tSmeConfigParams *pParam)
 			sme_release_global_lock(&pMac->sme);
 			return status;
 		}
-#ifdef FEATURE_AP_MCC_CH_AVOIDANCE
-		pParam->sap_channel_avoidance = pMac->sap.sap_channel_avoidance;
-#endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
-		pParam->max_intf_count = pMac->sme.max_intf_count;
-		pParam->enableSelfRecovery = pMac->sme.enableSelfRecovery;
-		pParam->pnoOffload = pMac->pnoOffload;
-		pParam->f_prefer_non_dfs_on_radar =
-						pMac->f_prefer_non_dfs_on_radar;
-		pParam->policy_manager_enabled = pMac->policy_manager_enabled;
-		pParam->fine_time_meas_cap = pMac->fine_time_meas_cap;
-		pParam->dual_mac_feature_disable =
-						pMac->dual_mac_feature_disable;
-		pParam->is_ps_enabled = pMac->sme.ps_global_info.ps_enabled;
-		pParam->pnoOffload = pMac->pnoOffload;
-		pParam->fEnableDebugLog = pMac->fEnableDebugLog;
-		pParam->enable5gEBT = pMac->enable5gEBT;
-		pParam->f_sta_miracast_mcc_rest_time_val =
-			pMac->f_sta_miracast_mcc_rest_time_val;
-		sme_update_roam_pno_channel_prediction_config(pMac, pParam,
-				ROAM_CONFIG_TO_SME_CONFIG);
-		pParam->early_stop_scan_enable =
-			pMac->roam.configParam.early_stop_scan_enable;
-		pParam->early_stop_scan_min_threshold =
-			pMac->roam.configParam.early_stop_scan_min_threshold;
-		pParam->early_stop_scan_max_threshold =
-			pMac->roam.configParam.early_stop_scan_max_threshold;
+		cdf_mem_copy(&pParam->rrmConfig,
+				&pMac->rrm.rrmSmeContext.rrmConfig,
+				sizeof(pMac->rrm.rrmSmeContext.rrmConfig));
 		sme_release_global_lock(&pMac->sme);
 	}
 
@@ -5170,8 +5033,7 @@ CDF_STATUS sme_change_country_code(tHalHandle hHal,
 
    -----------------------------------------------------------------------------*/
 CDF_STATUS sme_generic_change_country_code(tHalHandle hHal,
-					   uint8_t *pCountry,
-					   v_REGDOMAIN_t reg_domain)
+					   uint8_t *pCountry)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
@@ -5200,8 +5062,7 @@ CDF_STATUS sme_generic_change_country_code(tHalHandle hHal,
 		pMsg->msgLen =
 			(uint16_t) sizeof(tAniGenericChangeCountryCodeReq);
 		cdf_mem_copy(pMsg->countryCode, pCountry, 2);
-		pMsg->domain_index = reg_domain;
-		pMsg->countryCode[2] = ' '; /* For ASCII space */
+		pMsg->countryCode[2] = ' ';
 
 		msg.type = eWNI_SME_GENERIC_CHANGE_COUNTRY_CODE;
 		msg.bodyptr = pMsg;
@@ -5603,16 +5464,12 @@ CDF_STATUS sme_scan_get_bkid_candidate_list(tHalHandle hHal, uint32_t sessionId,
     \brief a wrapper function for OEM DATA REQ
     \param sessionId - session id to be used.
     \param pOemDataReqId - pointer to an object to get back the request ID
-    \param callback - a callback function that is called upon finish
-    \param pContext - a pointer passed in for the callback
     \return CDF_STATUS
    ---------------------------------------------------------------------------*/
 CDF_STATUS sme_oem_data_req(tHalHandle hHal,
 			    uint8_t sessionId,
 			    tOemDataReqConfig *pOemDataReqConfig,
-			    uint32_t *pOemDataReqID,
-			    oem_data_oem_data_reqCompleteCallback callback,
-			    void *pContext)
+			    uint32_t *pOemDataReqID)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
@@ -5632,8 +5489,8 @@ CDF_STATUS sme_oem_data_req(tHalHandle hHal,
 
 			status =
 				oem_data_oem_data_req(hHal, sessionId,
-						      pOemDataReqConfig, pOemDataReqID,
-						      callback, pContext);
+						      pOemDataReqConfig,
+						      pOemDataReqID);
 
 			/* release the lock for the sme object */
 			sme_release_global_lock(&pMac->sme);
@@ -6016,8 +5873,7 @@ CDF_STATUS sme_set_keep_alive(tHalHandle hHal, uint8_t session_id,
 		return CDF_STATUS_E_NOMEM;
 	}
 
-	cdf_mem_copy(request->bssId, pSession->connectedProfile.bssid.bytes,
-		     sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&request->bssid, &pSession->connectedProfile.bssid);
 	cdf_mem_copy(request_buf, request, sizeof(tSirKeepAliveReq));
 
 	CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO_LOW,
@@ -6133,6 +5989,48 @@ CDF_STATUS sme_get_operation_channel(tHalHandle hHal, uint32_t *pChannel,
 	return CDF_STATUS_E_FAILURE;
 } /* sme_get_operation_channel ends here */
 
+/**
+ * sme_register_mgmt_frame_ind_callback() - Register a callback for
+ * management frame indication to PE.
+ *
+ * @hal: hal pointer
+ * @callback: callback pointer to be registered
+ *
+ * This function is used to register a callback for management
+ * frame indication to PE.
+ *
+ * Return: Success if msg is posted to PE else Failure.
+ */
+CDF_STATUS sme_register_mgmt_frame_ind_callback(tHalHandle hal,
+				sir_mgmt_frame_ind_callback callback)
+{
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
+	struct sir_sme_mgmt_frame_cb_req *msg;
+	CDF_STATUS status = CDF_STATUS_SUCCESS;
+
+	sms_log(mac_ctx, LOG1, FL(": ENTER"));
+
+	if (CDF_STATUS_SUCCESS ==
+			sme_acquire_global_lock(&mac_ctx->sme)) {
+		msg = cdf_mem_malloc(sizeof(*msg));
+		if (NULL == msg) {
+			sms_log(mac_ctx, LOGE,
+				FL("Not able to allocate memory for eWNI_SME_REGISTER_MGMT_FRAME_CB"));
+			sme_release_global_lock(&mac_ctx->sme);
+			return CDF_STATUS_E_NOMEM;
+		}
+		cdf_mem_set(msg, sizeof(*msg), 0);
+		msg->message_type = eWNI_SME_REGISTER_MGMT_FRAME_CB;
+		msg->length          = sizeof(*msg);
+
+		msg->callback = callback;
+		status = cds_send_mb_message_to_mac(msg);
+		sme_release_global_lock(&mac_ctx->sme);
+		return status;
+	}
+	return CDF_STATUS_E_FAILURE;
+}
+
 /* ---------------------------------------------------------------------------
 
     \fn sme_RegisterMgtFrame
@@ -6539,7 +6437,7 @@ CDF_STATUS sme_configure_rxp_filter(tHalHandle hHal,
 
    --------------------------------------------------------------------------- */
 CDF_STATUS sme_configure_suspend_ind(tHalHandle hHal,
-				     tpSirWlanSuspendParam wlanSuspendParam,
+				     uint32_t conn_state_mask,
 				     csr_readyToSuspendCallback callback,
 				     void *callback_context)
 {
@@ -6558,7 +6456,7 @@ CDF_STATUS sme_configure_suspend_ind(tHalHandle hHal,
 	status = sme_acquire_global_lock(&pMac->sme);
 	if (CDF_IS_STATUS_SUCCESS(status)) {
 		/* serialize the req through MC thread */
-		cds_message.bodyptr = wlanSuspendParam;
+		cds_message.bodyval = conn_state_mask;
 		cds_message.type = WMA_WLAN_SUSPEND_IND;
 		cdf_status = cds_mq_post_message(CDS_MQ_ID_WMA, &cds_message);
 		if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
@@ -6873,7 +6771,7 @@ uint16_t sme_check_concurrent_channel_overlap(tHalHandle hHal, uint16_t sap_ch,
 #ifdef FEATURE_WLAN_SCAN_PNO
 /**
  * sme_update_roam_pno_channel_prediction_config() - Update PNO config
- * @sme_config:      config from SME context
+ * @csr_config:      config from SME context
  * @hal:             Global Hal handle
  * @copy_from_to:    Used to specify the source and destination
  *
@@ -6883,27 +6781,27 @@ uint16_t sme_check_concurrent_channel_overlap(tHalHandle hHal, uint16_t sap_ch,
  * Return: None
  */
 void sme_update_roam_pno_channel_prediction_config(
-		tHalHandle hal, tpSmeConfigParams sme_config,
+		tHalHandle hal, tCsrConfigParam *csr_config,
 		uint8_t copy_from_to)
 {
 	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
 	if (copy_from_to == SME_CONFIG_TO_ROAM_CONFIG) {
 		mac_ctx->roam.configParam.pno_channel_prediction =
-			sme_config->pno_channel_prediction;
+			csr_config->pno_channel_prediction;
 		mac_ctx->roam.configParam.top_k_num_of_channels =
-			sme_config->top_k_num_of_channels;
+			csr_config->top_k_num_of_channels;
 		mac_ctx->roam.configParam.stationary_thresh =
-			sme_config->stationary_thresh;
+			csr_config->stationary_thresh;
 		mac_ctx->roam.configParam.channel_prediction_full_scan =
-			sme_config->channel_prediction_full_scan;
+			csr_config->channel_prediction_full_scan;
 	} else if (copy_from_to == ROAM_CONFIG_TO_SME_CONFIG) {
-		sme_config->pno_channel_prediction =
+		csr_config->pno_channel_prediction =
 			mac_ctx->roam.configParam.pno_channel_prediction;
-		sme_config->top_k_num_of_channels =
+		csr_config->top_k_num_of_channels =
 			mac_ctx->roam.configParam.top_k_num_of_channels;
-		sme_config->stationary_thresh =
+		csr_config->stationary_thresh =
 			mac_ctx->roam.configParam.stationary_thresh;
-		sme_config->channel_prediction_full_scan =
+		csr_config->channel_prediction_full_scan =
 			mac_ctx->roam.configParam.channel_prediction_full_scan;
 	}
 
@@ -7038,7 +6936,7 @@ CDF_STATUS sme_handle_change_country_code(tpAniSirGlobal pMac, void *pMsgBuf)
 	tAniChangeCountryCodeReq *pMsg;
 	v_REGDOMAIN_t domainIdIoctl;
 	CDF_STATUS cdf_status = CDF_STATUS_SUCCESS;
-	static country_code_t default_country;
+	static uint8_t default_country[CDS_COUNTRY_CODE_LEN + 1];
 	pMsg = (tAniChangeCountryCodeReq *) pMsgBuf;
 
 	/*
@@ -7101,7 +6999,8 @@ CDF_STATUS sme_handle_change_country_code(tpAniSirGlobal pMac, void *pMsgBuf)
 	status = csr_get_regulatory_domain_for_country(pMac,
 						       pMac->scan.countryCodeCurrent,
 						       (v_REGDOMAIN_t *) &
-						       domainIdIoctl, COUNTRY_QUERY);
+						       domainIdIoctl,
+						       SOURCE_QUERY);
 	if (status != CDF_STATUS_SUCCESS) {
 		sms_log(pMac, LOGE, FL("  fail to get regId %d"), domainIdIoctl);
 		return status;
@@ -7142,7 +7041,7 @@ CDF_STATUS sme_handle_change_country_code(tpAniSirGlobal pMac, void *pMsgBuf)
 }
 
 /**
- * sme_handle_change_country_code_by_user() - handles country ch req
+ * sme_handle_generic_change_country_code() - handles country ch req
  * @mac_ctx:    mac global context
  * @msg:        request msg packet
  *
@@ -7154,17 +7053,18 @@ CDF_STATUS sme_handle_change_country_code(tpAniSirGlobal pMac, void *pMsgBuf)
  * Return: status of operation
  */
 CDF_STATUS
-sme_handle_change_country_code_by_user(tpAniSirGlobal mac_ctx,
-				       tAniGenericChangeCountryCodeReq *msg)
+sme_handle_generic_change_country_code(tpAniSirGlobal mac_ctx,
+				       void *pMsgBuf)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
-	v_REGDOMAIN_t reg_domain_id;
+	v_REGDOMAIN_t reg_domain_id = 0;
 	bool is_11d_country = false;
 	bool supplicant_priority =
 		mac_ctx->roam.configParam.fSupplicantCountryCodeHasPriority;
+	tAniGenericChangeCountryCodeReq *msg = pMsgBuf;
 
 	sms_log(mac_ctx, LOG1, FL(" called"));
-	reg_domain_id = (v_REGDOMAIN_t) msg->domain_index;
+
 	if (memcmp(msg->countryCode, mac_ctx->scan.countryCode11d,
 		   CDS_COUNTRY_CODE_LEN) == 0) {
 		is_11d_country = true;
@@ -7188,15 +7088,16 @@ sme_handle_change_country_code_by_user(tpAniSirGlobal mac_ctx,
 		    && (mac_ctx->scan.countryCode11d[1] == 0))
 			status = csr_get_regulatory_domain_for_country(mac_ctx,
 					"00", (v_REGDOMAIN_t *) &reg_domain_id,
-					COUNTRY_IE);
+					SOURCE_11D);
 		else
 			status = csr_get_regulatory_domain_for_country(mac_ctx,
 					mac_ctx->scan.countryCode11d,
 					(v_REGDOMAIN_t *) &reg_domain_id,
-					COUNTRY_IE);
+					SOURCE_11D);
 
 		return CDF_STATUS_E_FAILURE;
 	}
+
 	/* if Supplicant country code has priority, disable 11d */
 	if (!is_11d_country && supplicant_priority)
 		mac_ctx->roam.configParam.Is11dSupportEnabled = false;
@@ -7253,64 +7154,6 @@ sme_handle_change_country_code_by_user(tpAniSirGlobal mac_ctx,
 	return CDF_STATUS_SUCCESS;
 }
 
-/* ---------------------------------------------------------------------------
-
-    \fn sme_handle_change_country_code_by_core
-
-    \brief Update Country code in the driver if set by kernel as world
-
-    If 11D is enabled, we update the country code after every scan & notify kernel.
-    This is to make sure kernel & driver are in sync in case of CC found in
-    driver but not in kernel database
-
-    \param pMac - The handle returned by mac_open.
-    \param pMsg - Carrying new CC set in kernel
-
-    \return CDF_STATUS
-
-   -------------------------------------------------------------------------------*/
-CDF_STATUS sme_handle_change_country_code_by_core(tpAniSirGlobal pMac,
-						  tAniGenericChangeCountryCodeReq *
-						  pMsg)
-{
-	CDF_STATUS status;
-
-	sms_log(pMac, LOG1, FL(" called"));
-
-	/* this is to make sure kernel & driver are in sync in case of CC found in */
-	/* driver but not in kernel database */
-	if (('0' == pMsg->countryCode[0]) && ('0' == pMsg->countryCode[1])) {
-		sms_log(pMac, LOGW,
-			FL
-				("Setting countryCode11d & countryCodeCurrent to world CC"));
-		cdf_mem_copy(pMac->scan.countryCode11d, pMsg->countryCode,
-			     WNI_CFG_COUNTRY_CODE_LEN);
-		cdf_mem_copy(pMac->scan.countryCodeCurrent, pMsg->countryCode,
-			     WNI_CFG_COUNTRY_CODE_LEN);
-	}
-
-	status = wma_set_reg_domain(pMac, REGDOMAIN_WORLD);
-
-	if (status != CDF_STATUS_SUCCESS) {
-		sms_log(pMac, LOGE, FL("  fail to set regId"));
-		return status;
-	} else {
-		status = csr_get_channel_and_power_list(pMac);
-		if (status != CDF_STATUS_SUCCESS) {
-			sms_log(pMac, LOGE, FL("  fail to get Channels "));
-		} else {
-			csr_apply_channel_and_power_list(pMac);
-		}
-	}
-	/* Country code  Changed, Purge Only scan result
-	 * which does not have channel number belong to 11d
-	 * channel list
-	 */
-	csr_scan_filter_results(pMac);
-	sms_log(pMac, LOG1, FL(" returned"));
-	return CDF_STATUS_SUCCESS;
-}
-
 static bool
 sme_search_in_base_ch_lst(tpAniSirGlobal mac_ctx, uint8_t curr_ch)
 {
@@ -7364,42 +7207,6 @@ void sme_disconnect_connected_sessions(tpAniSirGlobal mac_ctx)
 	}
 }
 
-/* ---------------------------------------------------------------------------
-
-    \fn sme_handle_generic_change_country_code
-
-    \brief Change Country code, Reg Domain and channel list
-
-    If Supplicant country code is priority than 11d is disabled.
-    If 11D is enabled, we update the country code after every scan.
-    Hence when Supplicant country code is priority, we don't need 11D info.
-    Country code from kernel is set as current country code.
-
-    \param pMac - The handle returned by mac_open.
-    \param pMsgBuf - message buffer
-
-    \return CDF_STATUS
-
-   -------------------------------------------------------------------------------*/
-CDF_STATUS sme_handle_generic_change_country_code(tpAniSirGlobal pMac,
-						  void *pMsgBuf)
-{
-	tAniGenericChangeCountryCodeReq *pMsg;
-	v_REGDOMAIN_t reg_domain_id;
-
-	sms_log(pMac, LOG1, FL(" called"));
-	pMsg = (tAniGenericChangeCountryCodeReq *) pMsgBuf;
-	reg_domain_id = (v_REGDOMAIN_t) pMsg->domain_index;
-
-	if (REGDOMAIN_COUNT == reg_domain_id) {
-		sme_handle_change_country_code_by_core(pMac, pMsg);
-	} else {
-		sme_handle_change_country_code_by_user(pMac, pMsg);
-	}
-	sms_log(pMac, LOG1, FL(" returned"));
-	return CDF_STATUS_SUCCESS;
-}
-
 #ifdef WLAN_FEATURE_PACKET_FILTERING
 CDF_STATUS sme_8023_multicast_list(tHalHandle hHal, uint8_t sessionId,
 				   tpSirRcvFltMcAddrList pMulticastAddrs)
@@ -7827,8 +7634,8 @@ CDF_STATUS sme_set_custom_mac_addr(tSirMacAddr customMacAddr)
    \- return CDF_STATUS
    ---------------------------------------------------------------------------*/
 CDF_STATUS sme_set_tx_power(tHalHandle hHal, uint8_t sessionId,
-			    struct cdf_mac_addr pBSSId,
-			    tCDF_CON_MODE dev_mode, int dBm)
+			   struct cdf_mac_addr pBSSId,
+			   enum tCDF_ADAPTER_MODE dev_mode, int dBm)
 {
 	cds_msg_t msg;
 	tpMaxTxPowerParams pTxParams = NULL;
@@ -8019,7 +7826,6 @@ void sme_reset_power_values_for5_g(tHalHandle hHal)
 	csr_apply_power2_current(pMac);    /* Store the channel+power info in the global place: Cfg */
 }
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 /* ---------------------------------------------------------------------------
     \fn sme_update_roam_prefer5_g_hz
     \brief  enable/disable Roam prefer 5G runtime option
@@ -8388,9 +8194,7 @@ CDF_STATUS sme_set_roam_scan_control(tHalHandle hHal, uint8_t sessionId,
 	}
 	return status;
 }
-#endif /* (WLAN_FEATURE_VOWIFI_11R) || (FEATURE_WLAN_ESE) || (FEATURE_WLAN_LFR) */
 
-#ifdef FEATURE_WLAN_LFR
 /*--------------------------------------------------------------------------
    \brief sme_update_is_fast_roam_ini_feature_enabled() - enable/disable LFR
 	support at runtime
@@ -8540,7 +8344,6 @@ CDF_STATUS sme_update_enable_fast_roam_in_concurrency(tHalHandle hHal,
 
 	return status;
 }
-#endif /* FEATURE_WLAN_LFR */
 
 #ifdef FEATURE_WLAN_ESE
 /*--------------------------------------------------------------------------
@@ -8618,7 +8421,6 @@ CDF_STATUS sme_update_config_fw_rssi_monitoring(tHalHandle hHal,
 	return cdf_ret_status;
 }
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 /* ---------------------------------------------------------------------------
     \fn     sme_set_roam_opportunistic_scan_threshold_diff
     \brief  Update Opportunistic Scan threshold diff
@@ -9432,9 +9234,7 @@ uint16_t sme_get_neighbor_scan_period(tHalHandle hHal, uint8_t sessionId)
 	       neighborScanPeriod;
 }
 
-#endif
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 
 /*--------------------------------------------------------------------------
    \brief sme_get_roam_rssi_diff() - get Roam rssi diff
@@ -9680,7 +9480,6 @@ bool sme_get_roam_scan_control(tHalHandle hHal)
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 	return pMac->roam.configParam.nRoamScanControl;
 }
-#endif
 
 /*--------------------------------------------------------------------------
    \brief sme_get_is_lfr_feature_enabled() - get LFR feature enabled or not
@@ -9692,12 +9491,8 @@ bool sme_get_roam_scan_control(tHalHandle hHal)
    --------------------------------------------------------------------------*/
 bool sme_get_is_lfr_feature_enabled(tHalHandle hHal)
 {
-#ifdef FEATURE_WLAN_LFR
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 	return pMac->roam.configParam.isFastRoamIniFeatureEnabled;
-#else
-	return false;
-#endif
 }
 
 /*--------------------------------------------------------------------------
@@ -10020,6 +9815,14 @@ CDF_STATUS sme_update_tdls_peer_state(tHalHandle hHal,
 			WMA_TDLS_PEER_STATE_TEARDOWN;
 		break;
 
+	case eSME_TDLS_PEER_ADD_MAC_ADDR:
+		pTdlsPeerStateParams->peerState = WMA_TDLS_PEER_ADD_MAC_ADDR;
+		break;
+
+	case eSME_TDLS_PEER_REMOVE_MAC_ADDR:
+		pTdlsPeerStateParams->peerState = WMA_TDLS_PEER_REMOVE_MAC_ADDR;
+		break;
+
 	default:
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
 			FL("invalid peer state param (%d)"),
@@ -10437,7 +10240,8 @@ ePhyChanBondState sme_get_cb_phy_state_from_cb_ini_value(uint32_t cb_ini_value)
    \param currDeviceMode - Current operating device mode.
    --------------------------------------------------------------------------*/
 
-void sme_set_curr_device_mode(tHalHandle hHal, tCDF_CON_MODE currDeviceMode)
+void sme_set_curr_device_mode(tHalHandle hHal,
+				enum tCDF_ADAPTER_MODE currDeviceMode)
 {
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 	pMac->sme.currDeviceMode = currDeviceMode;
@@ -11723,12 +11527,12 @@ CDF_STATUS sme_get_reg_info(tHalHandle hHal, uint8_t chanId,
 		return status;
 
 	for (i = 0; i < WNI_CFG_VALID_CHANNEL_LIST_LEN; i++) {
-		if (pMac->scan.defaultPowerTable[i].chanId == chanId) {
+		if (pMac->scan.defaultPowerTable[i].chan_num == chanId) {
 			SME_SET_CHANNEL_REG_POWER(*regInfo1,
-				pMac->scan.defaultPowerTable[i].pwr);
+				pMac->scan.defaultPowerTable[i].power);
 
 			SME_SET_CHANNEL_MAX_TX_POWER(*regInfo2,
-				pMac->scan.defaultPowerTable[i].pwr);
+				pMac->scan.defaultPowerTable[i].power);
 			found = true;
 			break;
 		}
@@ -11976,32 +11780,28 @@ CDF_STATUS sme_set_mas(uint32_t val)
 	return CDF_STATUS_SUCCESS;
 }
 
-/* -------------------------------------------------------------------------
-   \fn sme_roam_channel_change_req
-   \brief API to Indicate Channel change to new target channel
-   \param hHal - The handle returned by mac_open
-   \param targetChannel - New Channel to move the SAP to.
-   \return CDF_STATUS
-   ---------------------------------------------------------------------------*/
+/**
+ * sme_roam_channel_change_req() - Channel change to new target channel
+ * @hHal: handle returned by mac_open
+ * @bssid: mac address of BSS
+ * @ch_params: target channel information
+ * @profile: CSR profile
+ *
+ * API to Indicate Channel change to new target channel
+ *
+ * Return: CDF_STATUS
+ */
 CDF_STATUS sme_roam_channel_change_req(tHalHandle hHal,
-	struct cdf_mac_addr bssid, uint32_t cb_mode, tCsrRoamProfile *profile)
+	struct cdf_mac_addr bssid, chan_params_t *ch_params,
+	tCsrRoamProfile *profile)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-	uint8_t ch_mode;
-
-	ch_mode = (profile->ChannelInfo.ChannelList[0] <=
-			CSR_MAX_2_4_GHZ_SUPPORTED_CHANNELS) ?
-			pMac->roam.configParam.channelBondingMode24GHz :
-			pMac->roam.configParam.channelBondingMode5GHz;
 
 	status = sme_acquire_global_lock(&pMac->sme);
 	if (CDF_IS_STATUS_SUCCESS(status)) {
 
-		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO_MED,
-			  FL("sapdfs: requested cbmode=[%d] & new negotiated cbmode[%d]"),
-			  cb_mode, ch_mode);
-		status = csr_roam_channel_change_req(pMac, bssid, ch_mode,
+		status = csr_roam_channel_change_req(pMac, bssid, ch_params,
 				profile);
 		sme_release_global_lock(&pMac->sme);
 	}
@@ -12090,25 +11890,26 @@ CDF_STATUS sme_roam_start_beacon_req(tHalHandle hHal, struct cdf_mac_addr bssid,
 	return status;
 }
 
-/* -------------------------------------------------------------------------
-   \fn sme_roam_csa_ie_request
-   \brief API to request CSA IE transmission from PE
-   \param hHal - The handle returned by mac_open
-   \param pDfsCsaReq - CSA IE request
-   \param bssid - SAP bssid
-   \param ch_bandwidth - Channel offset
-   \return CDF_STATUS
-   ---------------------------------------------------------------------------*/
+/**
+ * sme_roam_csa_ie_request() - request CSA IE transmission from PE
+ * @hHal: handle returned by mac_open
+ * @bssid: SAP bssid
+ * @targetChannel: target channel information
+ * @csaIeReqd: CSA IE Request
+ * @ch_params: channel information
+ *
+ * Return: CDF_STATUS
+ */
 CDF_STATUS sme_roam_csa_ie_request(tHalHandle hHal, struct cdf_mac_addr bssid,
 				uint8_t targetChannel, uint8_t csaIeReqd,
-				uint8_t ch_bandwidth)
+				chan_params_t *ch_params)
 {
 	CDF_STATUS status = CDF_STATUS_E_FAILURE;
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 	status = sme_acquire_global_lock(&pMac->sme);
 	if (CDF_IS_STATUS_SUCCESS(status)) {
-		status = csr_roam_send_chan_sw_ie_request(pMac, bssid, targetChannel,
-				csaIeReqd, ch_bandwidth);
+		status = csr_roam_send_chan_sw_ie_request(pMac, bssid,
+				targetChannel, csaIeReqd, ch_params);
 		sme_release_global_lock(&pMac->sme);
 	}
 	return status;
@@ -12237,12 +12038,23 @@ CDF_STATUS sme_txpower_limit(tHalHandle hHal, tSirTxPowerLimit *psmetx)
 	CDF_STATUS cdf_status = CDF_STATUS_SUCCESS;
 	cds_msg_t cds_message;
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+	tSirTxPowerLimit *tx_power_limit;
+
+	tx_power_limit = cdf_mem_malloc(sizeof(*tx_power_limit));
+	if (!tx_power_limit) {
+		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
+			  "%s: Memory allocation for TxPowerLimit failed!",
+			  __func__);
+		return CDF_STATUS_E_FAILURE;
+	}
+
+	*tx_power_limit = *psmetx;
 
 	status = sme_acquire_global_lock(&pMac->sme);
 	if (CDF_IS_STATUS_SUCCESS(status)) {
 		cds_message.type = WMA_TX_POWER_LIMIT;
 		cds_message.reserved = 0;
-		cds_message.bodyptr = psmetx;
+		cds_message.bodyptr = tx_power_limit;
 
 		cdf_status = cds_mq_post_message(CDS_MQ_ID_WMA, &cds_message);
 		if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
@@ -12250,7 +12062,7 @@ CDF_STATUS sme_txpower_limit(tHalHandle hHal, tSirTxPowerLimit *psmetx)
 				  "%s: not able to post WMA_TX_POWER_LIMIT",
 				  __func__);
 			status = CDF_STATUS_E_FAILURE;
-			cdf_mem_free(psmetx);
+			cdf_mem_free(tx_power_limit);
 		}
 		sme_release_global_lock(&pMac->sme);
 	}
@@ -13269,14 +13081,6 @@ CDF_STATUS sme_ext_scan_register_callback(tHalHandle hHal,
 	}
 	return status;
 }
-
-#else
-CDF_STATUS sme_ext_scan_register_callback(tHalHandle hHal,
-		  void (*pExtScanIndCb)(void *, const uint16_t, void *))
-{
-	return CDF_STATUS_SUCCESS;
-}
-
 #endif /* FEATURE_WLAN_EXTSCAN */
 
 #ifdef WLAN_FEATURE_LINK_LAYER_STATS
@@ -14699,6 +14503,47 @@ CDF_STATUS sme_soc_set_dual_mac_config(tHalHandle hal,
 	return CDF_STATUS_SUCCESS;
 }
 
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+/**
+ * sme_gateway_param_update() - to update gateway parameters with WMA
+ * @Hal: hal handle
+ * @gw_params: request parameters from HDD
+ *
+ * Return: CDF_STATUS
+ *
+ * This routine will update gateway parameters to WMA
+ */
+CDF_STATUS sme_gateway_param_update(tHalHandle Hal,
+			      struct gateway_param_update_req *gw_params)
+{
+	CDF_STATUS cdf_status;
+	cds_msg_t cds_message;
+	struct gateway_param_update_req *request_buf;
+
+	request_buf = cdf_mem_malloc(sizeof(*request_buf));
+	if (NULL == request_buf) {
+		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
+			FL("Not able to allocate memory for gw param update request"));
+		return CDF_STATUS_E_NOMEM;
+	}
+
+	*request_buf = *gw_params;
+
+	cds_message.type = WMA_GW_PARAM_UPDATE_REQ;
+	cds_message.reserved = 0;
+	cds_message.bodyptr = request_buf;
+	cdf_status = cds_mq_post_message(CDS_MQ_ID_WMA, &cds_message);
+	if (!CDF_IS_STATUS_SUCCESS(cdf_status)) {
+		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
+			FL("Not able to post WMA_GW_PARAM_UPDATE_REQ message to HAL"));
+		cdf_mem_free(request_buf);
+		return CDF_STATUS_E_FAILURE;
+	}
+
+	return CDF_STATUS_SUCCESS;
+}
+#endif /* FEATURE_LFR_SUBNET_DETECTION */
+
 /**
  * sme_set_peer_authorized() - call peer authorized callback
  * @peer_addr: peer mac address
@@ -14920,3 +14765,45 @@ void sme_get_opclass(tHalHandle hal, uint8_t channel, uint8_t bw_offset,
 	}
 }
 #endif
+
+#ifdef FEATURE_GREEN_AP
+/**
+ * sme_send_egap_conf_params() - set the enhanced green ap configuration params
+ * @enable: enable/disable the enhanced green ap feature
+ * @inactivity_time: inactivity timeout value
+ * @wait_time: wait timeout value
+ * @flag: feature flag in bitmasp
+ *
+ * Return: Return CDF_STATUS, otherwise appropriate failure code
+ */
+CDF_STATUS sme_send_egap_conf_params(uint32_t enable, uint32_t inactivity_time,
+				     uint32_t wait_time, uint32_t flags)
+{
+	cds_msg_t message;
+	CDF_STATUS status;
+	struct egap_conf_params *egap_params;
+
+	egap_params = cdf_mem_malloc(sizeof(*egap_params));
+	if (NULL == egap_params) {
+		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
+				"%s: fail to alloc egap_params", __func__);
+		return CDF_STATUS_E_NOMEM;
+	}
+
+	egap_params->enable = enable;
+	egap_params->inactivity_time = inactivity_time;
+	egap_params->wait_time = wait_time;
+	egap_params->flags = flags;
+
+	message.type = WMA_SET_EGAP_CONF_PARAMS;
+	message.bodyptr = egap_params;
+	status = cds_mq_post_message(CDF_MODULE_ID_WMA, &message);
+	if (!CDF_IS_STATUS_SUCCESS(status)) {
+		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
+			"%s: Not able to post msg to WMA!", __func__);
+
+		cdf_mem_free(egap_params);
+	}
+	return status;
+}
+#endif
diff --git a/core/sme/src/common/sme_ft_api.c b/core/sme/src/common/sme_ft_api.c
index b48e13f10cb3..ee6e374c4dd7 100644
--- a/core/sme/src/common/sme_ft_api.c
+++ b/core/sme/src/common/sme_ft_api.c
@@ -351,11 +351,10 @@ CDF_STATUS sme_ft_send_update_key_ind(tHalHandle hal, uint32_t session_id,
 		}
 	}
 
-	cdf_mem_copy(&msg->bssId[0],
-			&ftkey_info->peerMac.bytes[0], CDF_MAC_ADDR_SIZE);
+	cdf_copy_macaddr(&msg->bssid, &ftkey_info->peerMac);
 	msg->smeSessionId = session_id;
 	sms_log(mac_ctx, LOG1, "BSSID = " MAC_ADDRESS_STR,
-		MAC_ADDR_ARRAY(msg->bssId));
+		MAC_ADDR_ARRAY(msg->bssid.bytes));
 	status = cds_send_mb_message_to_mac(msg);
 
 	return status;
@@ -561,14 +560,12 @@ void sme_get_rici_es(tHalHandle hHal, uint32_t sessionId, uint8_t *ric_ies,
  *------------------------------------------------------------------------*/
 void sme_preauth_reassoc_intvl_timer_callback(void *context)
 {
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	tFTRoamCallbackUsrCtx *pUsrCtx = (tFTRoamCallbackUsrCtx *) context;
 
 	if (pUsrCtx) {
 		csr_neighbor_roam_request_handoff(pUsrCtx->pMac,
 						  pUsrCtx->sessionId);
 	}
-#endif
 	return;
 }
 
diff --git a/core/sme/src/common/sme_power_save.c b/core/sme/src/common/sme_power_save.c
index be463897a2f8..8158218a0750 100644
--- a/core/sme/src/common/sme_power_save.c
+++ b/core/sme/src/common/sme_power_save.c
@@ -248,7 +248,7 @@ CDF_STATUS sme_ps_enter_wowl_req_params(tpAniSirGlobal mac_ctx,
 	hal_wowl_params = cdf_mem_malloc(sizeof(*hal_wowl_params));
 	if (NULL == hal_wowl_params) {
 		sms_log(mac_ctx, LOGP,
-			FL("Fail to allocate memory for Enter Wowl Request "));
+			FL("Fail to allocate memory for Enter Wowl Request"));
 		return  CDF_STATUS_E_NOMEM;
 	}
 	cdf_mem_set((uint8_t *) hal_wowl_params, sizeof(*hal_wowl_params), 0);
@@ -257,9 +257,8 @@ CDF_STATUS sme_ps_enter_wowl_req_params(tpAniSirGlobal mac_ctx,
 	hal_wowl_params->ucMagicPktEnable = sme_wowl_params->ucMagicPktEnable;
 	hal_wowl_params->ucPatternFilteringEnable =
 		sme_wowl_params->ucPatternFilteringEnable;
-	cdf_mem_copy((uint8_t *) hal_wowl_params->magicPtrn,
-			(uint8_t *) sme_wowl_params->magicPtrn,
-			sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&hal_wowl_params->magic_ptrn,
+			 &sme_wowl_params->magic_ptrn);
 
 #ifdef WLAN_WAKEUP_EVENTS
 	hal_wowl_params->ucWoWEAPIDRequestEnable =
@@ -990,8 +989,7 @@ CDF_STATUS sme_set_ps_host_offload(tHalHandle hal_ctx,
 		return CDF_STATUS_E_NOMEM;
 	}
 
-	cdf_mem_copy(request->bssId, session->connectedProfile.bssid.bytes,
-			sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&request->bssid, &session->connectedProfile.bssid);
 
 	cdf_mem_copy(request_buf, request, sizeof(tSirHostOffloadReq));
 
@@ -1033,8 +1031,7 @@ CDF_STATUS sme_set_ps_ns_offload(tHalHandle hal_ctx,
 		return CDF_STATUS_E_FAILURE;
 	}
 
-	cdf_mem_copy(request->bssId, session->connectedProfile.bssid.bytes,
-			sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&request->bssid, &session->connectedProfile.bssid);
 
 	request_buf = cdf_mem_malloc(sizeof(*request_buf));
 	if (NULL == request_buf) {
diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index 8c6f830ab4bc..ebbfe474c24c 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -47,9 +47,7 @@
 #include "csr_internal.h"
 #include "cds_reg_service.h"
 #include "mac_trace.h"
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 #include "csr_neighbor_roam.h"
-#endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
 #include "cds_regdomain_common.h"
 #include "cds_utils.h"
 #include "sir_types.h"
@@ -215,7 +213,8 @@ static CDF_STATUS csr_roam_free_connected_info(tpAniSirGlobal pMac,
 					       tCsrRoamConnectedInfo *
 					       pConnectedInfo);
 CDF_STATUS csr_send_mb_set_context_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
-					   tSirMacAddr peerMacAddr, uint8_t numKeys,
+					   struct cdf_mac_addr peer_macaddr,
+					    uint8_t numKeys,
 					   tAniEdType edType, bool fUnicast,
 					   tAniKeyDirection aniKeyDirection,
 					   uint8_t keyId, uint8_t keyLength,
@@ -264,7 +263,8 @@ void csr_roam_remove_entry_from_pe_stats_req_list(tpAniSirGlobal pMac,
 tListElem *csr_roam_find_in_pe_stats_req_list(tpAniSirGlobal pMac, uint32_t statsMask);
 CDF_STATUS csr_roam_dereg_statistics_req(tpAniSirGlobal pMac);
 static uint32_t csr_find_ibss_session(tpAniSirGlobal pMac);
-static uint32_t csr_find_session_by_type(tpAniSirGlobal, tCDF_CON_MODE);
+static uint32_t csr_find_session_by_type(tpAniSirGlobal,
+					enum tCDF_ADAPTER_MODE);
 static bool csr_is_conn_allow_2g_band(tpAniSirGlobal pMac, uint32_t chnl);
 static bool csr_is_conn_allow_5g_band(tpAniSirGlobal pMac, uint32_t chnl);
 static CDF_STATUS csr_roam_start_wds(tpAniSirGlobal pMac, uint32_t sessionId,
@@ -341,7 +341,7 @@ CDF_STATUS csr_init_chan_list(tpAniSirGlobal mac, uint8_t *alpha2)
 {
 	CDF_STATUS status;
 	v_REGDOMAIN_t reg_id;
-	v_CountryInfoSource_t source = COUNTRY_INIT;
+	enum country_src source = SOURCE_DRIVER;
 
 	mac->scan.countryCodeDefault[0] = alpha2[0];
 	mac->scan.countryCodeDefault[1] = alpha2[1];
@@ -388,7 +388,7 @@ CDF_STATUS csr_set_reg_info(tHalHandle hHal, uint8_t *apCntryCode)
 
 	cntryCodeLength = WNI_CFG_COUNTRY_CODE_LEN;
 	status = csr_get_regulatory_domain_for_country(pMac, apCntryCode, &regId,
-						       COUNTRY_USER);
+						       SOURCE_USERSPACE);
 	if (status != CDF_STATUS_SUCCESS) {
 		sms_log(pMac, LOGE,
 			FL("  fail to get regId for country Code %.2s"),
@@ -436,7 +436,7 @@ CDF_STATUS csr_set_channels(tHalHandle hHal, tCsrConfigParam *pParam)
 			pMac->scan.base_channels.channelList[index];
 		pParam->Csr11dinfo.ChnPower[index].numChannels = 1;
 		pParam->Csr11dinfo.ChnPower[index].maxtxPower =
-			pMac->scan.defaultPowerTable[index].pwr;
+			pMac->scan.defaultPowerTable[index].power;
 	}
 	pParam->Csr11dinfo.Channels.numChannels =
 		pMac->scan.base_channels.numChannels;
@@ -462,7 +462,7 @@ CDF_STATUS csr_close(tpAniSirGlobal pMac)
 	return status;
 }
 
-static tPowerdBm csr_find_channel_pwr(tChannelListWithPower *
+static int8_t csr_find_channel_pwr(struct channel_power *
 					     pdefaultPowerTable,
 					     uint8_t ChannelNum)
 {
@@ -470,16 +470,92 @@ static tPowerdBm csr_find_channel_pwr(tChannelListWithPower *
 	/* TODO: if defaultPowerTable is guaranteed to be in ascending */
 	/* order of channel numbers, we can employ binary search */
 	for (i = 0; i < WNI_CFG_VALID_CHANNEL_LIST_LEN; i++) {
-		if (pdefaultPowerTable[i].chanId == ChannelNum)
-			return pdefaultPowerTable[i].pwr;
+		if (pdefaultPowerTable[i].chan_num == ChannelNum)
+			return pdefaultPowerTable[i].power;
 	}
 	/* could not find the channel list in default list */
 	/* this should not have occured */
 	CDF_ASSERT(0);
 	return 0;
 }
+
+/**
+ * csr_roam_arrange_ch_list() - Updates the channel list modified with greedy
+ * order for 5 Ghz preference and DFS channels.
+ * @mac_ctx: pointer to mac context.
+ * @chan_list:    channel list updated with greedy channel order.
+ * @num_channel:  Number of channels in list
+ *
+ * To allow Early Stop Roaming Scan feature to co-exist with 5G preference,
+ * this function moves 5G channels ahead of 2G channels. This function can
+ * also move 2G channels, ahead of DFS channel or vice versa. Order is
+ * maintained among same category channels
+ *
+ * Return: None
+ */
+void csr_roam_arrange_ch_list(tpAniSirGlobal mac_ctx,
+			tSirUpdateChanParam *chan_list, uint8_t num_channel)
+{
+	bool prefer_5g = CSR_IS_ROAM_PREFER_5GHZ(mac_ctx);
+	bool prefer_dfs = CSR_IS_DFS_CH_ROAM_ALLOWED(mac_ctx);
+	int i, j = 0;
+	tSirUpdateChanParam *tmp_list = NULL;
+
+	if (!prefer_5g)
+		return;
+
+	tmp_list = (tSirUpdateChanParam *)
+		cdf_mem_malloc(sizeof(tSirUpdateChanParam) * num_channel);
+	if (tmp_list == NULL) {
+		sms_log(mac_ctx, LOGE, FL("Memory allocation failed"));
+		return;
+	}
+
+	/* Fist copy Non-DFS 5g channels */
+	for (i = 0; i < num_channel; i++) {
+		if (CDS_IS_CHANNEL_5GHZ(chan_list[i].chanId) &&
+			!CDS_IS_DFS_CH(chan_list[i].chanId)) {
+			cdf_mem_copy(&tmp_list[j++],
+				&chan_list[i], sizeof(tSirUpdateChanParam));
+			chan_list[i].chanId = INVALID_CHANNEL_ID;
+		}
+	}
+	if (prefer_dfs) {
+		/* next copy DFS channels (remaining channels in 5G) */
+		for (i = 0; i < num_channel; i++) {
+			if (CDS_IS_CHANNEL_5GHZ(chan_list[i].chanId)) {
+				cdf_mem_copy(&tmp_list[j++], &chan_list[i],
+					sizeof(tSirUpdateChanParam));
+				chan_list[i].chanId = INVALID_CHANNEL_ID;
+			}
+		}
+	} else {
+		/* next copy 2G channels */
+		for (i = 0; i < num_channel; i++) {
+			if (CDS_IS_CHANNEL_24GHZ(chan_list[i].chanId)) {
+				cdf_mem_copy(&tmp_list[j++], &chan_list[i],
+					sizeof(tSirUpdateChanParam));
+				chan_list[i].chanId = INVALID_CHANNEL_ID;
+			}
+		}
+	}
+	/* copy rest of the channels in same order to tmp list */
+	for (i = 0; i < num_channel; i++) {
+		if (chan_list[i].chanId != INVALID_CHANNEL_ID) {
+			cdf_mem_copy(&tmp_list[j++], &chan_list[i],
+				sizeof(tSirUpdateChanParam));
+			chan_list[i].chanId = INVALID_CHANNEL_ID;
+		}
+	}
+	/* copy tmp list to original channel list buffer */
+	cdf_mem_copy(chan_list, tmp_list,
+				 sizeof(tSirUpdateChanParam) * num_channel);
+	cdf_mem_free(tmp_list);
+}
+
 /**
  * csr_roam_sort_channel_for_early_stop() - Sort the channels
+ * @mac_ctx:        mac global context
  * @chan_list:      Original channel list from the upper layers
  * @num_channel:    Number of original channels
  *
@@ -497,8 +573,8 @@ static tPowerdBm csr_find_channel_pwr(tChannelListWithPower *
  *
  * Return: None
  */
-void csr_roam_sort_channel_for_early_stop(tSirUpdateChanList *chan_list,
-		uint8_t num_channel)
+void csr_roam_sort_channel_for_early_stop(tpAniSirGlobal mac_ctx,
+			tSirUpdateChanList *chan_list, uint8_t num_channel)
 {
 	tSirUpdateChanList *chan_list_greedy, *chan_list_non_greedy;
 	uint8_t i, j;
@@ -589,6 +665,9 @@ void csr_roam_sort_channel_for_early_stop(tSirUpdateChanList *chan_list,
 	cdf_mem_copy(&chan_list->chanParam[i],
 		&chan_list_non_greedy->chanParam[j],
 		num_non_greedy_chan * sizeof(tSirUpdateChanParam));
+
+	/* Update channel list for 5g preference and allow DFS roam */
+	csr_roam_arrange_ch_list(mac_ctx, chan_list->chanParam, num_channel);
 scan_list_sort_error:
 	cdf_mem_free(chan_list_greedy);
 	cdf_mem_free(chan_list_non_greedy);
@@ -627,7 +706,7 @@ CDF_STATUS csr_update_channel_list(tpAniSirGlobal pMac)
 
 	for (i = 0; i < pScan->base_channels.numChannels; i++) {
 		/* Scan is not performed on DSRC channels*/
-		if (pScan->base_channels.channelList[i] >= MIN_11P_CHANNEL)
+		if (pScan->base_channels.channelList[i] >= CDS_MIN_11P_CHANNEL)
 			continue;
 		if (pScan->fcc_constraint) {
 			if (pScan->base_channels.channelList[i] == 12)
@@ -675,7 +754,8 @@ CDF_STATUS csr_update_channel_list(tpAniSirGlobal pMac)
 		}
 	}
 	if (pMac->roam.configParam.early_stop_scan_enable)
-		csr_roam_sort_channel_for_early_stop(pChanList, num_channel);
+		csr_roam_sort_channel_for_early_stop(pMac, pChanList,
+						     num_channel);
 	else
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO,
 			FL("Early Stop Scan Feature not supported"));
@@ -712,10 +792,8 @@ CDF_STATUS csr_start(tpAniSirGlobal pMac)
 
 		pMac->roam.sPendingCommands = 0;
 		csr_scan_enable(pMac);
-#if   defined WLAN_FEATURE_NEIGHBOR_ROAMING
 		for (i = 0; i < CSR_ROAM_SESSION_MAX; i++)
 			status = csr_neighbor_roam_init(pMac, i);
-#endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
 		pMac->roam.tlStatsReqInfo.numClient = 0;
 		pMac->roam.tlStatsReqInfo.periodicity = 0;
 		pMac->roam.tlStatsReqInfo.timerRunning = false;
@@ -730,7 +808,6 @@ CDF_STATUS csr_start(tpAniSirGlobal pMac)
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO,
 			  "Scan offload is enabled, update default chan list");
 		status = csr_update_channel_list(pMac);
-
 	} while (0);
 	return status;
 }
@@ -747,10 +824,8 @@ CDF_STATUS csr_stop(tpAniSirGlobal pMac, tHalStopType stopType)
 	pMac->scan.fRestartIdleScan = false;
 	csr_ll_purge(&pMac->roam.roamCmdPendingList, true);
 
-#if   defined WLAN_FEATURE_NEIGHBOR_ROAMING
 	for (sessionId = 0; sessionId < CSR_ROAM_SESSION_MAX; sessionId++)
 		csr_neighbor_roam_close(pMac, sessionId);
-#endif
 	for (sessionId = 0; sessionId < CSR_ROAM_SESSION_MAX; sessionId++)
 		if (CSR_IS_SESSION_VALID(pMac, sessionId))
 			csr_scan_flush_result(pMac);
@@ -1000,21 +1075,14 @@ CDF_STATUS csr_roam_get_connect_profile(tpAniSirGlobal pMac, uint32_t sessionId,
 	return status;
 }
 
-CDF_STATUS csr_roam_free_connect_profile(tpAniSirGlobal pMac,
-					 tCsrRoamConnectedProfile *pProfile)
+void csr_roam_free_connect_profile(tCsrRoamConnectedProfile *profile)
 {
-	CDF_STATUS status = CDF_STATUS_SUCCESS;
-
-	if (pProfile->pBssDesc) {
-		cdf_mem_free(pProfile->pBssDesc);
-	}
-	if (pProfile->pAddIEAssoc) {
-		cdf_mem_free(pProfile->pAddIEAssoc);
-	}
-	cdf_mem_set(pProfile, sizeof(tCsrRoamConnectedProfile), 0);
-
-	pProfile->AuthType = eCSR_AUTH_TYPE_UNKNOWN;
-	return status;
+	if (profile->pBssDesc)
+		cdf_mem_free(profile->pBssDesc);
+	if (profile->pAddIEAssoc)
+		cdf_mem_free(profile->pAddIEAssoc);
+	cdf_mem_set(profile, sizeof(tCsrRoamConnectedProfile), 0);
+	profile->AuthType = eCSR_AUTH_TYPE_UNKNOWN;
 }
 
 static CDF_STATUS csr_roam_free_connected_info(tpAniSirGlobal pMac,
@@ -1272,7 +1340,6 @@ static void init_config_param(tpAniSirGlobal pMac)
 #ifdef WLAN_FEATURE_VOWIFI_11R
 	pMac->roam.configParam.csr11rConfig.IsFTResourceReqSupported = 0;
 #endif
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	pMac->roam.configParam.neighborRoamConfig.nMaxNeighborRetries = 3;
 	pMac->roam.configParam.neighborRoamConfig.nNeighborLookupRssiThreshold =
 		120;
@@ -1296,7 +1363,6 @@ static void init_config_param(tpAniSirGlobal pMac)
 	pMac->roam.configParam.neighborRoamConfig.nRoamBmissFirstBcnt = 10;
 	pMac->roam.configParam.neighborRoamConfig.nRoamBmissFinalBcnt = 10;
 	pMac->roam.configParam.neighborRoamConfig.nRoamBeaconRssiWeight = 14;
-#endif
 #ifdef WLAN_FEATURE_11AC
 	pMac->roam.configParam.nVhtChannelWidth =
 		WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ + 1;
@@ -1344,7 +1410,6 @@ CDF_STATUS csr_flush_roam_scan_roam_channel_list(tpAniSirGlobal pMac,
 }
 #endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 /*
    This function flushes the roam scan cache
  */
@@ -1398,7 +1463,6 @@ CDF_STATUS csr_create_bg_scan_roam_channel_list(tpAniSirGlobal pMac,
 	return status;
 }
 
-#endif
 
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 /*
@@ -1861,7 +1925,6 @@ CDF_STATUS csr_change_default_config_param(tpAniSirGlobal pMac,
 			pMac->roam.configParam.csr11rConfig.
 			IsFTResourceReqSupported);
 #endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 		pMac->roam.configParam.isFastTransitionEnabled =
 			pParam->isFastTransitionEnabled;
 		pMac->roam.configParam.RoamRssiDiff = pParam->RoamRssiDiff;
@@ -1873,22 +1936,18 @@ CDF_STATUS csr_change_default_config_param(tpAniSirGlobal pMac,
 		pMac->roam.configParam.nProbes = pParam->nProbes;
 		pMac->roam.configParam.nRoamScanHomeAwayTime =
 			pParam->nRoamScanHomeAwayTime;
-#endif
 		pMac->roam.configParam.isRoamOffloadScanEnabled =
 			pParam->isRoamOffloadScanEnabled;
 		pMac->roam.configParam.bFastRoamInConIniFeatureEnabled =
 			pParam->bFastRoamInConIniFeatureEnabled;
-#ifdef FEATURE_WLAN_LFR
 		pMac->roam.configParam.isFastRoamIniFeatureEnabled =
 			pParam->isFastRoamIniFeatureEnabled;
 		pMac->roam.configParam.MAWCEnabled = pParam->MAWCEnabled;
-#endif
 
 #ifdef FEATURE_WLAN_ESE
 		pMac->roam.configParam.isEseIniFeatureEnabled =
 			pParam->isEseIniFeatureEnabled;
 #endif
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 		cdf_mem_copy(&pMac->roam.configParam.neighborRoamConfig,
 			     &pParam->neighborRoamConfig,
 			     sizeof(tCsrNeighborRoamConfigParams));
@@ -1944,7 +2003,6 @@ CDF_STATUS csr_change_default_config_param(tpAniSirGlobal pMac,
 		sms_log(pMac, LOG1, "nRoamBeaconRssiWeight = %d",
 			pMac->roam.configParam.neighborRoamConfig.
 			nRoamBeaconRssiWeight);
-#endif
 		pMac->roam.configParam.addTSWhenACMIsOff =
 			pParam->addTSWhenACMIsOff;
 		pMac->scan.fValidateList = pParam->fValidateList;
@@ -1968,6 +2026,8 @@ CDF_STATUS csr_change_default_config_param(tpAniSirGlobal pMac,
 		pMac->roam.configParam.nVhtChannelWidth =
 			pParam->nVhtChannelWidth;
 		pMac->roam.configParam.txBFEnable = pParam->enableTxBF;
+		pMac->roam.configParam.enable_txbf_sap_mode =
+			pParam->enable_txbf_sap_mode;
 		pMac->roam.configParam.txBFCsnValue = pParam->txBFCsnValue;
 		pMac->roam.configParam.enable2x2 = pParam->enable2x2;
 		pMac->roam.configParam.enableVhtFor24GHz =
@@ -2014,7 +2074,45 @@ CDF_STATUS csr_change_default_config_param(tpAniSirGlobal pMac,
 			pParam->early_stop_scan_min_threshold;
 		pMac->roam.configParam.early_stop_scan_max_threshold =
 			pParam->early_stop_scan_max_threshold;
+		pMac->isCoalesingInIBSSAllowed =
+			pParam->isCoalesingInIBSSAllowed;
+
+		/* update p2p offload status */
+		pMac->pnoOffload = pParam->pnoOffload;
+
+		pMac->fEnableDebugLog = pParam->fEnableDebugLog;
+
+		/* update interface configuration */
+		pMac->sme.max_intf_count = pParam->max_intf_count;
+
+		pMac->enable5gEBT = pParam->enable5gEBT;
+		pMac->sme.enableSelfRecovery = pParam->enableSelfRecovery;
+
+		pMac->f_sta_miracast_mcc_rest_time_val =
+			pParam->f_sta_miracast_mcc_rest_time_val;
+#ifdef FEATURE_AP_MCC_CH_AVOIDANCE
+		pMac->sap.sap_channel_avoidance =
+			pParam->sap_channel_avoidance;
+#endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
+
+		pMac->f_prefer_non_dfs_on_radar =
+			pParam->f_prefer_non_dfs_on_radar;
 
+		pMac->sme.ps_global_info.ps_enabled =
+			pParam->is_ps_enabled;
+
+		pMac->policy_manager_enabled = pParam->policy_manager_enabled;
+		pMac->fine_time_meas_cap = pParam->fine_time_meas_cap;
+		pMac->dual_mac_feature_disable =
+			pParam->dual_mac_feature_disable;
+		sme_update_roam_pno_channel_prediction_config(pMac, pParam,
+				SME_CONFIG_TO_ROAM_CONFIG);
+		pMac->roam.configParam.early_stop_scan_enable =
+			pParam->early_stop_scan_enable;
+		pMac->roam.configParam.early_stop_scan_min_threshold =
+			pParam->early_stop_scan_min_threshold;
+		pMac->roam.configParam.early_stop_scan_max_threshold =
+			pParam->early_stop_scan_max_threshold;
 	}
 
 	return status;
@@ -2087,14 +2185,14 @@ CDF_STATUS csr_get_config_param(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
 	pParam->fEnableMCCMode = cfg_params->fenableMCCMode;
 	pParam->fAllowMCCGODiffBI = cfg_params->fAllowMCCGODiffBI;
 	pParam->scanCfgAgingTime = pMac->scan.scanResultCfgAgingTime;
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	cdf_mem_copy(&pParam->neighborRoamConfig,
 		     &cfg_params->neighborRoamConfig,
 		     sizeof(tCsrNeighborRoamConfigParams));
-#endif
 #ifdef WLAN_FEATURE_11AC
 	pParam->nVhtChannelWidth = cfg_params->nVhtChannelWidth;
 	pParam->enableTxBF = cfg_params->txBFEnable;
+	pParam->enable_txbf_sap_mode =
+		cfg_params->enable_txbf_sap_mode;
 	pParam->txBFCsnValue = cfg_params->txBFCsnValue;
 	pParam->enableMuBformee = cfg_params->txMuBformee;
 	pParam->enableVhtFor24GHz = cfg_params->enableVhtFor24GHz;
@@ -2105,7 +2203,6 @@ CDF_STATUS csr_get_config_param(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
 	cdf_mem_copy(&cfg_params->csr11rConfig, &pParam->csr11rConfig,
 		     sizeof(tCsr11rConfigParams));
 #endif
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	pParam->isFastTransitionEnabled = cfg_params->isFastTransitionEnabled;
 	pParam->RoamRssiDiff = cfg_params->RoamRssiDiff;
 	pParam->nRoamPrefer5GHz = cfg_params->nRoamPrefer5GHz;
@@ -2113,18 +2210,14 @@ CDF_STATUS csr_get_config_param(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
 	pParam->isWESModeEnabled = cfg_params->isWESModeEnabled;
 	pParam->nProbes = cfg_params->nProbes;
 	pParam->nRoamScanHomeAwayTime = cfg_params->nRoamScanHomeAwayTime;
-#endif
 	pParam->isRoamOffloadScanEnabled = cfg_params->isRoamOffloadScanEnabled;
 	pParam->bFastRoamInConIniFeatureEnabled =
 		cfg_params->bFastRoamInConIniFeatureEnabled;
-#ifdef FEATURE_WLAN_LFR
 	pParam->isFastRoamIniFeatureEnabled =
 		cfg_params->isFastRoamIniFeatureEnabled;
-#endif
 #ifdef FEATURE_WLAN_ESE
 	pParam->isEseIniFeatureEnabled = cfg_params->isEseIniFeatureEnabled;
 #endif
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	cdf_mem_copy(&pParam->neighborRoamConfig,
 		     &cfg_params->neighborRoamConfig,
 		     sizeof(tCsrNeighborRoamConfigParams));
@@ -2138,7 +2231,6 @@ CDF_STATUS csr_get_config_param(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
 			cfg_params->neighborRoamConfig.
 			neighborScanChanList.channelList[i]);
 	}
-#endif
 
 #ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
 	pParam->cc_switch_mode = cfg_params->cc_switch_mode;
@@ -2165,6 +2257,31 @@ CDF_STATUS csr_get_config_param(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
 	pParam->max_scan_count = pMac->scan.max_scan_count;
 	pParam->first_scan_bucket_threshold =
 		pMac->first_scan_bucket_threshold;
+#ifdef FEATURE_AP_MCC_CH_AVOIDANCE
+	pParam->sap_channel_avoidance = pMac->sap.sap_channel_avoidance;
+#endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
+	pParam->max_intf_count = pMac->sme.max_intf_count;
+	pParam->enableSelfRecovery = pMac->sme.enableSelfRecovery;
+	pParam->pnoOffload = pMac->pnoOffload;
+	pParam->f_prefer_non_dfs_on_radar =
+		pMac->f_prefer_non_dfs_on_radar;
+	pParam->policy_manager_enabled = pMac->policy_manager_enabled;
+	pParam->fine_time_meas_cap = pMac->fine_time_meas_cap;
+	pParam->dual_mac_feature_disable =
+		pMac->dual_mac_feature_disable;
+	pParam->is_ps_enabled = pMac->sme.ps_global_info.ps_enabled;
+	pParam->fEnableDebugLog = pMac->fEnableDebugLog;
+	pParam->enable5gEBT = pMac->enable5gEBT;
+	pParam->f_sta_miracast_mcc_rest_time_val =
+		pMac->f_sta_miracast_mcc_rest_time_val;
+	sme_update_roam_pno_channel_prediction_config(pMac, pParam,
+			ROAM_CONFIG_TO_SME_CONFIG);
+	pParam->early_stop_scan_enable =
+		pMac->roam.configParam.early_stop_scan_enable;
+	pParam->early_stop_scan_min_threshold =
+		pMac->roam.configParam.early_stop_scan_min_threshold;
+	pParam->early_stop_scan_max_threshold =
+		pMac->roam.configParam.early_stop_scan_max_threshold;
 	return CDF_STATUS_SUCCESS;
 }
 
@@ -2401,7 +2518,7 @@ CDF_STATUS csr_get_channel_and_power_list(tpAniSirGlobal pMac)
 		/* structure -- this will be used as the scan list */
 		for (Index = 0; Index < num20MHzChannelsFound; Index++) {
 			pMac->scan.base_channels.channelList[Index] =
-				pMac->scan.defaultPowerTable[Index].chanId;
+				pMac->scan.defaultPowerTable[Index].chan_num;
 		}
 		pMac->scan.base_channels.numChannels =
 			num20MHzChannelsFound;
@@ -2410,7 +2527,8 @@ CDF_STATUS csr_get_channel_and_power_list(tpAniSirGlobal pMac)
 		}
 		for (Index = 0; Index < num40MHzChannelsFound; Index++) {
 			pMac->scan.base40MHzChannels.channelList[Index] =
-				pMac->scan.defaultPowerTable40MHz[Index].chanId;
+				pMac->scan.defaultPowerTable40MHz[Index].
+				chan_num;
 		}
 		pMac->scan.base40MHzChannels.numChannels =
 			num40MHzChannelsFound;
@@ -2908,11 +3026,7 @@ CDF_STATUS csr_roam_call_callback(tpAniSirGlobal pMac, uint32_t sessionId,
 /* Returns whether handoff is currently in progress or not */
 bool csr_roam_is_handoff_in_progress(tpAniSirGlobal pMac, uint8_t sessionId)
 {
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	return csr_neighbor_roam_is_handoff_in_progress(pMac, sessionId);
-#else
-	return false;
-#endif
 }
 
 CDF_STATUS csr_roam_issue_disassociate(tpAniSirGlobal pMac, uint32_t sessionId,
@@ -3150,7 +3264,7 @@ csr_roam_get_associated_stas(tpAniSirGlobal pMac, uint32_t sessionId,
 		MAC_ADDR_ARRAY(bssId.bytes));
 	status =
 		csr_send_mb_get_associated_stas_req_msg(pMac, sessionId, modId,
-							bssId.bytes,
+							bssId,
 							pUsrContext,
 							pfnSapEventCallback,
 							pAssocStasBuf);
@@ -3183,9 +3297,8 @@ csr_roam_get_wps_session_overlap(tpAniSirGlobal pMac, uint32_t sessionId,
 		"CSR getting WPS Session Overlap for Bssid = " MAC_ADDRESS_STR,
 		MAC_ADDR_ARRAY(bssId.bytes));
 
-	status =
-		csr_send_mb_get_wpspbc_sessions(pMac, sessionId, bssId.bytes, pUsrContext,
-						pfnSapEventCallback, pRemoveMac);
+	status = csr_send_mb_get_wpspbc_sessions(pMac, sessionId, bssId,
+				pUsrContext, pfnSapEventCallback, pRemoveMac);
 
 	return status;
 }
@@ -3790,18 +3903,12 @@ static CDF_STATUS csr_get_rate_set(tpAniSirGlobal pMac,
 			}
 		}
 	}
-	if ((eCSR_CFG_DOT11_MODE_11G == cfgDot11Mode ||
-	    eCSR_CFG_DOT11_MODE_11N == cfgDot11Mode ||
-	    eCSR_CFG_DOT11_MODE_ABG == cfgDot11Mode
-#ifdef WLAN_FEATURE_11AC
-	    || eCSR_CFG_DOT11_MODE_11AC == cfgDot11Mode
-#endif
-	    ) && pIes->ExtSuppRates.present) {
-		/*
-		 * If there are extended rates in the beacon,
-		 * we will reflect those extended rates that we support in our
-		 * extended operational rate
-		 */
+	/*
+	 * If there are Extended Rates in the beacon, we will reflect the
+	 * extended rates that we support in our Extended Operational Rate
+	 * set.
+	 */
+	if (pIes->ExtSuppRates.present) {
 		pDstRate = pExRateSet->rate;
 		for (i = 0; i < pIes->ExtSuppRates.num_rates; i++) {
 			if (csr_rates_is_dot11_rate_supported(pMac,
@@ -4060,7 +4167,7 @@ void csr_roam_ccm_cfg_set_callback(tpAniSirGlobal pMac, int32_t result)
 	sessionId = pCommand->sessionId;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 	pSession = &pMac->roam.roamSession[sessionId];
-	if (pSession->roamOffloadSynchParams.bRoamSynchInProgress) {
+	if (pSession->roam_synch_in_progress) {
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
 			  "LFR3:csr_roam_cfg_set_callback");
 	}
@@ -4114,11 +4221,16 @@ CDF_STATUS csr_roam_set_bss_config_cfg(tpAniSirGlobal pMac, uint32_t sessionId,
 	tSirRetStatus status;
 	uint32_t cfgCb = WNI_CFG_CHANNEL_BONDING_MODE_DISABLE;
 	uint8_t channel = 0;
+	tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
+
 	/* Make sure we have the domain info for the BSS we try to connect to. */
 	/* Do we need to worry about sequence for OSs that are not Windows?? */
 	if (pBssDesc) {
-		if (csr_learn_11dcountry_information(pMac, pBssDesc, pIes, true)) {
-				csr_apply_country_information(pMac);
+		if ((CDF_SAP_MODE !=
+			csr_get_session_persona(pMac, sessionId)) &&
+			csr_learn_11dcountry_information(
+					pMac, pBssDesc, pIes, true)) {
+			csr_apply_country_information(pMac);
 		}
 		if ((csr_is11d_supported(pMac)) && pIes) {
 			if (!pIes->Country.present) {
@@ -4152,8 +4264,7 @@ CDF_STATUS csr_roam_set_bss_config_cfg(tpAniSirGlobal pMac, uint32_t sessionId,
 			pBssConfig->uPowerLimit);
 	/* CB */
 
-	if (CSR_IS_INFRA_AP(pProfile) || CSR_IS_WDS_AP(pProfile)
-	    || CSR_IS_IBSS(pProfile)) {
+	if (CSR_IS_INFRA_AP(pProfile) || CSR_IS_IBSS(pProfile)) {
 		channel = pProfile->operationChannel;
 	} else {
 		if (pBssDesc) {
@@ -4175,12 +4286,15 @@ CDF_STATUS csr_roam_set_bss_config_cfg(tpAniSirGlobal pMac, uint32_t sessionId,
 	} else {
 		csr_set_cfg_rate_set_from_profile(pMac, pProfile);
 	}
+	status = cfg_set_int(pMac, WNI_CFG_JOIN_FAILURE_TIMEOUT,
+			pBssConfig->uJoinTimeOut);
+	/* Any roaming related changes should be above this line */
+	if (pSession && pSession->roam_synch_in_progress)
+		return CDF_STATUS_SUCCESS;
 	/* Make this the last CFG to set. The callback will trigger a join_req */
 	/* Join time out */
 	csr_roam_substate_change(pMac, eCSR_ROAM_SUBSTATE_CONFIG, sessionId);
 
-	status = cfg_set_int(pMac, WNI_CFG_JOIN_FAILURE_TIMEOUT,
-			pBssConfig->uJoinTimeOut);
 	csr_roam_ccm_cfg_set_callback(pMac, status);
 	return CDF_STATUS_SUCCESS;
 }
@@ -4214,7 +4328,6 @@ CDF_STATUS csr_roam_stop_network(tpAniSirGlobal pMac, uint32_t sessionId,
 		pSession->bssParams.cbMode = pBssConfig->cbMode;
 		/* For IBSS, we need to prepare some more information */
 		if (csr_is_bss_type_ibss(pProfile->BSSType) ||
-				CSR_IS_WDS(pProfile) ||
 				CSR_IS_INFRA_AP(pProfile))
 			csr_roam_prepare_bss_params(pMac, sessionId, pProfile,
 				pBssDesc, pBssConfig, pIes);
@@ -4249,7 +4362,7 @@ CDF_STATUS csr_roam_stop_network(tpAniSirGlobal pMac, uint32_t sessionId,
 				status = csr_roam_set_bss_config_cfg(pMac,
 						sessionId, pProfile, pBssDesc,
 						pBssConfig, pIes, false);
-		} else if (pBssDesc || CSR_IS_WDS_AP(pProfile) ||
+		} else if (pBssDesc ||
 					CSR_IS_INFRA_AP(pProfile)) {
 			/*
 			 * Neither in IBSS nor in Infra. We can go ahead and set
@@ -4326,10 +4439,6 @@ eCsrJoinState csr_roam_join(tpAniSirGlobal pMac, uint32_t sessionId,
 		return eCsrStopRoaming;
 	}
 
-	if (CSR_IS_WDS_STA(pProfile) &&
-		!CDF_IS_STATUS_SUCCESS(csr_roam_start_wds(pMac, sessionId,
-				pProfile, pBssDesc)))
-		return eCsrStopRoaming;
 	if (!pIesLocal &&
 		!CDF_IS_STATUS_SUCCESS(csr_get_parsed_bss_description_ies(pMac,
 				pBssDesc, &pIesLocal))) {
@@ -4560,7 +4669,6 @@ static void csr_roam_join_handle_profile(tpAniSirGlobal mac_ctx,
 	/*
 	 * We have something to roam, tell HDD when it is infra.
 	 * For IBSS, the indication goes back to HDD via eCSR_ROAM_IBSS_IND
-	 * For WDS, the indication is eCSR_ROAM_WDS_IND
 	 */
 	if (CSR_IS_INFRASTRUCTURE(profile)) {
 		if (roam_info_ptr && session->bRefAssocStartCnt) {
@@ -4685,8 +4793,7 @@ static void csr_roam_join_handle_profile(tpAniSirGlobal mac_ctx,
 			*roam_state = eCsrStopRoaming;
 		}
 		return;
-	} else if ((CSR_IS_WDS_AP(profile)) ||
-			(CSR_IS_INFRA_AP(profile))) {
+	} else if (CSR_IS_INFRA_AP(profile)) {
 		/* Attempt to start this WDS... */
 		csr_roam_assign_default_param(mac_ctx, cmd);
 		/* For AP WDS, we dont have any BSSDescription */
@@ -5417,12 +5524,6 @@ static CDF_STATUS csr_roam_save_security_rsp_ie(tpAniSirGlobal pMac,
 		sms_log(pMac, LOGE, FL("session %d not found"), sessionId);
 		return CDF_STATUS_E_FAILURE;
 	}
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	if (pSession->roamOffloadSynchParams.bRoamSynchInProgress) {
-		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
-				FL("LFR3:csr_roam_save_security_rsp_ie"));
-	}
-#endif
 
 	if ((eCSR_AUTH_TYPE_WPA == authType) ||
 		(eCSR_AUTH_TYPE_WPA_PSK == authType) ||
@@ -5460,25 +5561,16 @@ static CDF_STATUS csr_roam_save_security_rsp_ie(tpAniSirGlobal pMac,
 /* Returns whether the current association is a 11r assoc or not */
 bool csr_roam_is11r_assoc(tpAniSirGlobal pMac, uint8_t sessionId)
 {
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	return csr_neighbor_roam_is11r_assoc(pMac, sessionId);
-#else
-	return false;
-#endif
 }
 #endif
 #ifdef FEATURE_WLAN_ESE
 /* Returns whether the current association is a ESE assoc or not */
 bool csr_roam_is_ese_assoc(tpAniSirGlobal pMac, uint8_t sessionId)
 {
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 	return csr_neighbor_roam_is_ese_assoc(pMac, sessionId);
-#else
-	return false;
-#endif
 }
 #endif
-#ifdef FEATURE_WLAN_LFR
 /* Returns whether "Legacy Fast Roaming" is currently enabled...or not */
 bool csr_roam_is_fast_roam_enabled(tpAniSirGlobal pMac, uint32_t sessionId)
 {
@@ -5523,7 +5615,6 @@ bool csr_roam_is_roam_offload_scan_enabled(tpAniSirGlobal pMac)
 {
 	return pMac->roam.configParam.isRoamOffloadScanEnabled;
 }
-#endif
 
 #if defined(FEATURE_WLAN_ESE)
 bool csr_roam_is_ese_ini_feature_enabled(tpAniSirGlobal pMac)
@@ -5574,43 +5665,6 @@ eCsrPhyMode csr_roamdot11mode_to_phymode(uint8_t dot11mode)
 #endif
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-CDF_STATUS csr_roam_offload_send_synch_cnf(tpAniSirGlobal pMac, uint8_t sessionId)
-{
-	tpSirSmeRoamOffloadSynchCnf pRoamOffloadSynchCnf;
-	cds_msg_t msg;
-	tCsrRoamSession *pSession = &pMac->roam.roamSession[sessionId];
-	pRoamOffloadSynchCnf =
-		cdf_mem_malloc(sizeof(tSirSmeRoamOffloadSynchCnf));
-	if (NULL == pRoamOffloadSynchCnf) {
-		CDF_TRACE(CDF_MODULE_ID_SME,
-			  CDF_TRACE_LEVEL_ERROR,
-			  "%s: not able to allocate memory for roam"
-			  "offload synch confirmation data", __func__);
-		pSession->roamOffloadSynchParams.bRoamSynchInProgress =
-			false;
-		return CDF_STATUS_E_NOMEM;
-	}
-	pRoamOffloadSynchCnf->sessionId = sessionId;
-	msg.type = WMA_ROAM_OFFLOAD_SYNCH_CNF;
-	msg.reserved = 0;
-	msg.bodyptr = pRoamOffloadSynchCnf;
-	CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
-		  "LFR3: Posting WMA_ROAM_OFFLOAD_SYNCH_CNF");
-	if (!CDF_IS_STATUS_SUCCESS
-		    (cds_mq_post_message(CDF_MODULE_ID_WMA, &msg))) {
-		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
-			  "%s: Not able to post WMA_ROAM_OFFLOAD_SYNCH_CNF message to WMA",
-			  __func__);
-		cdf_mem_free(pRoamOffloadSynchCnf);
-		pSession->roamOffloadSynchParams.bRoamSynchInProgress =
-			false;
-		return CDF_STATUS_E_FAILURE;
-	}
-	csr_roaming_report_diag_event(pMac, NULL, eCSR_REASON_ROAM_SYNCH_CNF);
-	pSession->roamOffloadSynchParams.bRoamSynchInProgress = false;
-	return CDF_STATUS_SUCCESS;
-}
-
 void csr_roam_synch_clean_up (tpAniSirGlobal mac, uint8_t session_id)
 {
 	cds_msg_t msg;
@@ -5620,7 +5674,7 @@ void csr_roam_synch_clean_up (tpAniSirGlobal mac, uint8_t session_id)
 	/* Clean up the roam synch in progress for LFR3 */
 	CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
 		  "%s: Roam Synch Failed, Clean Up", __func__);
-	session->roamOffloadSynchParams.bRoamSynchInProgress = false;
+	session->roam_synch_in_progress = false;
 
 	roam_offload_failed = cdf_mem_malloc(
 				sizeof(struct roam_offload_synch_fail));
@@ -5702,8 +5756,7 @@ static void csr_roam_process_results_default(tpAniSirGlobal mac_ctx,
 		 * to send down stop BSS later
 		 */
 		csr_free_connect_bss_desc(mac_ctx, session_id);
-		csr_roam_free_connect_profile(mac_ctx,
-			&session->connectedProfile);
+		csr_roam_free_connect_profile(&session->connectedProfile);
 		csr_roam_free_connected_info(mac_ctx, &session->connectedInfo);
 		csr_set_default_dot11_mode(mac_ctx);
 	}
@@ -5729,7 +5782,6 @@ static void csr_roam_process_results_default(tpAniSirGlobal mac_ctx,
 			&session->joinFailStatusCode.bssId,
 			sizeof(struct cdf_mac_addr));
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 		/*
 		 * If Join fails while Handoff is in progress, indicate
 		 * disassociated event to supplicant to reconnect
@@ -5738,7 +5790,6 @@ static void csr_roam_process_results_default(tpAniSirGlobal mac_ctx,
 			csr_neighbor_roam_indicate_connect(mac_ctx,
 				(uint8_t)session_id, CDF_STATUS_E_FAILURE);
 		}
-#endif
 		if (session->bRefAssocStartCnt > 0) {
 			session->bRefAssocStartCnt--;
 			if (eCsrJoinFailureDueToConcurrency == res)
@@ -5772,16 +5823,6 @@ static void csr_roam_process_results_default(tpAniSirGlobal mac_ctx,
 #endif
 		csr_roam_completion(mac_ctx, session_id, NULL, cmd,
 			eCSR_ROAM_RESULT_FAILURE, false);
-#ifdef FEATURE_WLAN_BTAMP_UT_RF
-		/*
-		 * For WDS STA. To fix the issue where the WDS AP side may
-		 * be too busy by BT activity and not able to receive
-		 * WLAN traffic. Retry the join
-		 */
-		if (CSR_IS_WDS_STA(profile))
-			csr_roam_start_join_retry_timer(mac_ctx, session_id,
-				CSR_JOIN_RETRY_TIMEOUT_PERIOD);
-#endif
 		break;
 	case eCsrHddIssuedReassocToSameAP:
 	case eCsrSmeIssuedReassocToSameAP:
@@ -5830,6 +5871,7 @@ static void csr_roam_process_results_default(tpAniSirGlobal mac_ctx,
 		csr_roam_call_callback(mac_ctx, session_id, NULL,
 			cmd->u.roamCmd.roamId, eCSR_ROAM_IBSS_LEAVE,
 			eCSR_ROAM_RESULT_IBSS_STOP);
+		session->connectState = eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED;
 		break;
 	case eCsrForcedDisassocMICFailure:
 		csr_roam_state_change(mac_ctx, eCSR_ROAMING_STATE_IDLE,
@@ -5937,119 +5979,88 @@ static void csr_roam_process_start_bss_success(tpAniSirGlobal mac_ctx,
 			eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTED;
 	else
 		session->connectState = eCSR_ASSOC_STATE_TYPE_WDS_DISCONNECTED;
-	if (!CSR_IS_WDS_STA(profile)) {
-		csr_roam_state_change(mac_ctx, eCSR_ROAMING_STATE_JOINED,
+	csr_roam_state_change(mac_ctx, eCSR_ROAMING_STATE_JOINED,
 			session_id);
-		bss_desc = &start_bss_rsp->bssDescription;
-		if (!CDF_IS_STATUS_SUCCESS
-			(csr_get_parsed_bss_description_ies(mac_ctx, bss_desc,
-							    &ies_ptr))) {
-			sms_log(mac_ctx, LOGW, FL("cannot parse IBSS IEs"));
-			roam_info.pBssDesc = bss_desc;
-			csr_roam_call_callback(mac_ctx, session_id, &roam_info,
-				cmd->u.roamCmd.roamId, eCSR_ROAM_IBSS_IND,
-				eCSR_ROAM_RESULT_IBSS_START_FAILED);
-			return;
-		}
-		if (!CSR_IS_INFRA_AP(profile)) {
-			scan_res =
-				csr_scan_append_bss_description(mac_ctx,
-						bss_desc, ies_ptr, false,
-						session_id);
-		}
-		csr_roam_save_connected_bss_desc(mac_ctx, session_id, bss_desc);
-		csr_roam_free_connect_profile(mac_ctx,
-				&session->connectedProfile);
-		csr_roam_free_connected_info(mac_ctx,
-				&session->connectedInfo);
-		if (bss_desc) {
-			csr_roam_save_connected_infomation(mac_ctx, session_id,
-					profile, bss_desc, ies_ptr);
-			cdf_mem_copy(&roam_info.bssid, &bss_desc->bssId,
-				sizeof(struct cdf_mac_addr));
-		}
-		/* We are done with the IEs so free it */
-		cdf_mem_free(ies_ptr);
+	bss_desc = &start_bss_rsp->bssDescription;
+	if (!CDF_IS_STATUS_SUCCESS
+		(csr_get_parsed_bss_description_ies(mac_ctx, bss_desc,
+						    &ies_ptr))) {
+		sms_log(mac_ctx, LOGW, FL("cannot parse IBSS IEs"));
+		roam_info.pBssDesc = bss_desc;
+		csr_roam_call_callback(mac_ctx, session_id, &roam_info,
+			cmd->u.roamCmd.roamId, eCSR_ROAM_IBSS_IND,
+			eCSR_ROAM_RESULT_IBSS_START_FAILED);
+		return;
+	}
+	if (!CSR_IS_INFRA_AP(profile)) {
+		scan_res =
+			csr_scan_append_bss_description(mac_ctx,
+					bss_desc, ies_ptr, false,
+					session_id);
+	}
+	csr_roam_save_connected_bss_desc(mac_ctx, session_id, bss_desc);
+	csr_roam_free_connect_profile(&session->connectedProfile);
+	csr_roam_free_connected_info(mac_ctx, &session->connectedInfo);
+	if (bss_desc) {
+		csr_roam_save_connected_infomation(mac_ctx, session_id,
+				profile, bss_desc, ies_ptr);
+		cdf_mem_copy(&roam_info.bssid, &bss_desc->bssId,
+			sizeof(struct cdf_mac_addr));
+	}
+	/* We are done with the IEs so free it */
+	cdf_mem_free(ies_ptr);
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
-		WLAN_HOST_DIAG_LOG_ALLOC(ibss_log,
-			host_log_ibss_pkt_type, LOG_WLAN_IBSS_C);
-		if (ibss_log) {
-			if (CSR_INVALID_SCANRESULT_HANDLE ==
-					cmd->u.roamCmd.hBSSList) {
-				/*
-				 * We start the IBSS (didn't find any
-				 * matched IBSS out there)
-				 */
-				ibss_log->eventId =
-					WLAN_IBSS_EVENT_START_IBSS_RSP;
-			} else {
-				ibss_log->eventId =
-					WLAN_IBSS_EVENT_JOIN_IBSS_RSP;
-			}
-			if (bss_desc) {
-				cdf_mem_copy(ibss_log->bssid,
-					bss_desc->bssId, 6);
-				ibss_log->operatingChannel =
-					bss_desc->channelId;
-			}
-			if (IS_SIR_STATUS_SUCCESS(wlan_cfg_get_int(
-						mac_ctx,
-						WNI_CFG_BEACON_INTERVAL,
-						&bi)))
-				/* U8 is not enough for BI */
-				ibss_log->beaconInterval = (uint8_t) bi;
-			WLAN_HOST_DIAG_LOG_REPORT(ibss_log);
-		}
-#endif
-		/*
-		 * Only set context for non-WDS_STA. We don't even need it for
-		 * WDS_AP. But since the encryption.
-		 * is WPA2-PSK so it won't matter.
-		 */
-		if (CSR_IS_ENC_TYPE_STATIC(profile->negotiatedUCEncryptionType)
-				&& session->pCurRoamProfile
-				&& !CSR_IS_INFRA_AP(session->pCurRoamProfile)) {
+	WLAN_HOST_DIAG_LOG_ALLOC(ibss_log,
+		host_log_ibss_pkt_type, LOG_WLAN_IBSS_C);
+	if (ibss_log) {
+		if (CSR_INVALID_SCANRESULT_HANDLE ==
+				cmd->u.roamCmd.hBSSList) {
 			/*
-			 * Issue the set Context request to LIM to establish
-			 * the Broadcast STA context for the Ibss. In Rome IBSS
-			 * case, dummy key installation will break proper BSS
-			 * key installation, so skip it.
+			 * We start the IBSS (didn't find any
+			 * matched IBSS out there)
 			 */
-			if (!CSR_IS_IBSS(session->pCurRoamProfile)) {
-				/* NO keys. these key parameters don't matter */
-				csr_roam_issue_set_context_req(mac_ctx,
-					session_id,
-					profile->negotiatedMCEncryptionType,
-					bss_desc, &bcast_mac, false,
-					false, eSIR_TX_RX, 0, 0, NULL, 0);
-			}
-
+			ibss_log->eventId =
+				WLAN_IBSS_EVENT_START_IBSS_RSP;
+		} else {
+			ibss_log->eventId =
+				WLAN_IBSS_EVENT_JOIN_IBSS_RSP;
 		}
-	} else {
+		if (bss_desc) {
+			cdf_mem_copy(ibss_log->bssid.bytes,
+				bss_desc->bssId, CDF_MAC_ADDR_SIZE);
+			ibss_log->operatingChannel =
+				bss_desc->channelId;
+		}
+		if (IS_SIR_STATUS_SUCCESS(wlan_cfg_get_int(
+					mac_ctx,
+					WNI_CFG_BEACON_INTERVAL,
+					&bi)))
+			/* U8 is not enough for BI */
+			ibss_log->beaconInterval = (uint8_t) bi;
+		WLAN_HOST_DIAG_LOG_REPORT(ibss_log);
+	}
+#endif
+	/*
+	 * Only set context for non-WDS_STA. We don't even need it for
+	 * WDS_AP. But since the encryption.
+	 * is WPA2-PSK so it won't matter.
+	 */
+	if (CSR_IS_ENC_TYPE_STATIC(profile->negotiatedUCEncryptionType)
+			&& session->pCurRoamProfile
+			&& !CSR_IS_INFRA_AP(session->pCurRoamProfile)) {
 		/*
-		 * Keep the state to eCSR_ROAMING_STATE_JOINING.
-		 * Need to send join_req.
+		 * Issue the set Context request to LIM to establish
+		 * the Broadcast STA context for the Ibss. In Rome IBSS
+		 * case, dummy key installation will break proper BSS
+		 * key installation, so skip it.
 		 */
-		if (cmd->u.roamCmd.pRoamBssEntry) {
-			scan_res = GET_BASE_ADDR(cmd->u.roamCmd.
-					pRoamBssEntry, tCsrScanResult, Link);
-			if (scan_res) {
-				bss_desc = &scan_res->Result.BssDescriptor;
-				ies_ptr = (tDot11fBeaconIEs *)
-					(scan_res->Result.pvIes);
-				/* Set the roaming substate to join attempt */
-				csr_roam_substate_change(mac_ctx,
-					eCSR_ROAM_SUBSTATE_JOIN_REQ,
-					session_id);
-				status = csr_send_join_req_msg(mac_ctx,
-						session_id, bss_desc,
-						profile, ies_ptr,
-						eWNI_SME_JOIN_REQ);
-			}
-		} else {
-			sms_log(mac_ctx, LOGE,
-				"StartBSS for WDS station with no BssDesc");
-			CDF_ASSERT(0);
+		if (!CSR_IS_IBSS(session->pCurRoamProfile)) {
+			/* NO keys. these key parameters don't matter */
+			csr_roam_issue_set_context_req(mac_ctx,
+				session_id,
+				profile->negotiatedMCEncryptionType,
+				bss_desc, &bcast_mac, false,
+				false, eSIR_TX_RX, 0, 0, NULL, 0);
 		}
 	}
 	/*
@@ -6061,10 +6072,6 @@ static void csr_roam_process_start_bss_success(tpAniSirGlobal mac_ctx,
 	if (!CSR_IS_JOIN_TO_IBSS(profile)) {
 		roam_status = eCSR_ROAM_IBSS_IND;
 		roam_result = eCSR_ROAM_RESULT_IBSS_STARTED;
-		if (CSR_IS_WDS(profile)) {
-			roam_status = eCSR_ROAM_WDS_IND;
-			roam_result = eCSR_ROAM_RESULT_WDS_STARTED;
-		}
 		if (CSR_IS_INFRA_AP(profile)) {
 			roam_status = eCSR_ROAM_INFRA_IND;
 			roam_result = eCSR_ROAM_RESULT_INFRA_STARTED;
@@ -6099,16 +6106,6 @@ static void csr_roam_process_start_bss_success(tpAniSirGlobal mac_ctx,
 				roam_status, roam_result);
 	}
 
-
-	if (CSR_IS_WDS_STA(profile)) {
-		/* need to send stop BSS because we fail to send join_req */
-		csr_roam_issue_disassociate_cmd(mac_ctx, session_id,
-				eCSR_DISCONNECT_REASON_UNSPECIFIED);
-		csr_roam_call_callback(mac_ctx, session_id, &roam_info,
-				cmd->u.roamCmd.roamId,
-				eCSR_ROAM_WDS_IND,
-				eCSR_ROAM_RESULT_WDS_STOPPED);
-	}
 }
 
 /**
@@ -6277,7 +6274,7 @@ static void csr_roam_process_join_res(tpAniSirGlobal mac_ctx,
 				eSIR_TX_RX, 0, 0, NULL, 0);
 		} else {
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-			if (roam_offload_params->bRoamSynchInProgress
+			if (session->roam_synch_in_progress
 				&& (roam_offload_params->authStatus
 				== CSR_ROAM_AUTH_STATUS_AUTHENTICATED)) {
 				CDF_TRACE(CDF_MODULE_ID_SME,
@@ -6339,7 +6336,7 @@ static void csr_roam_process_join_res(tpAniSirGlobal mac_ctx,
 		assoc_info.pProfile = profile;
 		if (context) {
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-			if (roam_offload_params->bRoamSynchInProgress)
+			if (session->roam_synch_in_progress)
 				CDF_TRACE(CDF_MODULE_ID_SME,
 					CDF_TRACE_LEVEL_DEBUG,
 					FL("LFR3:Clear Connected info"));
@@ -6484,7 +6481,7 @@ static void csr_roam_process_join_res(tpAniSirGlobal mac_ctx,
 				mac_ctx->roam.configParam.doBMPSWorkaround = 1;
 			}
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-			if (roam_offload_params->bRoamSynchInProgress) {
+			if (session->roam_synch_in_progress) {
 				roam_info.roamSynchInProgress = 1;
 				roam_info.synchAuthStatus =
 					roam_offload_params->authStatus;
@@ -6502,22 +6499,14 @@ static void csr_roam_process_join_res(tpAniSirGlobal mac_ctx,
 					FL
 					("LFR3: Copy KCK, KEK and Replay Ctr"));
 			}
+
+			roam_info.subnet_change_status =
+				CSR_GET_SUBNET_STATUS(roam_offload_params->roamReason);
 #endif
 			csr_roam_call_callback(mac_ctx, session_id, &roam_info,
 				cmd->u.roamCmd.roamId,
 				eCSR_ROAM_ASSOCIATION_COMPLETION,
 				eCSR_ROAM_RESULT_ASSOCIATED);
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-			if (roam_offload_params->bRoamSynchInProgress
-				&& (roam_offload_params->authStatus
-				    == CSR_ROAM_AUTH_STATUS_CONNECTED)) {
-				CDF_TRACE(CDF_MODULE_ID_SME,
-					CDF_TRACE_LEVEL_DEBUG,
-					FL("LFR3:Send Synch Cnf for Auth status connected"));
-				csr_roam_offload_send_synch_cnf(mac_ctx,
-					session_id);
-			}
-#endif
 		}
 
 		csr_roam_completion(mac_ctx, session_id, NULL, cmd,
@@ -6536,7 +6525,7 @@ static void csr_roam_process_join_res(tpAniSirGlobal mac_ctx,
 	 */
 	if (!CSR_IS_WAIT_FOR_KEY(mac_ctx, session_id)) {
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-		if (roam_offload_params->bRoamSynchInProgress) {
+		if (session->roam_synch_in_progress) {
 			CDF_TRACE(CDF_MODULE_ID_SME,
 				CDF_TRACE_LEVEL_DEBUG,
 				FL
@@ -6595,10 +6584,6 @@ static bool csr_roam_process_results(tpAniSirGlobal mac_ctx, tSmeCmd *cmd,
 #endif
 		roam_status = eCSR_ROAM_IBSS_IND;
 		roam_result = eCSR_ROAM_RESULT_IBSS_STARTED;
-		if (CSR_IS_WDS(profile)) {
-			roam_status = eCSR_ROAM_WDS_IND;
-			roam_result = eCSR_ROAM_RESULT_WDS_STARTED;
-		}
 		if (CSR_IS_INFRA_AP(profile)) {
 			roam_status = eCSR_ROAM_INFRA_IND;
 			roam_result = eCSR_ROAM_RESULT_INFRA_START_FAILED;
@@ -6668,10 +6653,9 @@ static bool csr_roam_process_results(tpAniSirGlobal mac_ctx, tSmeCmd *cmd,
 		roam_info.pbFrames = session->connectedInfo.pbFrames;
 		roam_info.staId = session->connectedInfo.staId;
 		roam_info.u.pConnectedProfile = &session->connectedProfile;
-		if (0 == roam_info.staId) {
+		if (0 == roam_info.staId)
 			CDF_ASSERT(0);
-			return false;
-		}
+
 		session->bRefAssocStartCnt--;
 		csr_roam_call_callback(mac_ctx, session_id, &roam_info,
 				cmd->u.roamCmd.roamId,
@@ -6681,24 +6665,14 @@ static bool csr_roam_process_results(tpAniSirGlobal mac_ctx, tSmeCmd *cmd,
 				eCSR_ROAM_RESULT_ASSOCIATED, true);
 		break;
 	case eCsrReassocFailure:
+		/*
+		* Currently Reassoc failure is handled through eCsrJoinFailure
+		* Need to revisit for eCsrReassocFailure handling
+		*/
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
 		sme_qos_csr_event_ind(mac_ctx, (uint8_t) session_id,
 				SME_QOS_CSR_REASSOC_FAILURE, NULL);
 #endif
-	case eCsrJoinWdsFailure:
-		sms_log(mac_ctx, LOGW, FL("failed to join WDS"));
-		csr_free_connect_bss_desc(mac_ctx, session_id);
-		csr_roam_free_connect_profile(mac_ctx,
-			&session->connectedProfile);
-		csr_roam_free_connected_info(mac_ctx, &session->connectedInfo);
-		cdf_mem_set(&roam_info, sizeof(tCsrRoamInfo), 0);
-		roam_info.pBssDesc = cmd->u.roamCmd.pLastRoamBss;
-		roam_info.statusCode = session->joinFailStatusCode.statusCode;
-		roam_info.reasonCode = session->joinFailStatusCode.reasonCode;
-		csr_roam_call_callback(mac_ctx, session_id, &roam_info,
-			cmd->u.roamCmd.roamId, eCSR_ROAM_WDS_IND,
-			eCSR_ROAM_RESULT_WDS_NOT_ASSOCIATED);
-		/* Need to issue stop_bss */
 		break;
 	case eCsrJoinFailure:
 	case eCsrNothingToJoin:
@@ -7215,7 +7189,8 @@ CDF_STATUS csr_roam_connect(tpAniSirGlobal pMac, uint32_t sessionId,
 	/* Initialize the count before proceeding with the Join requests */
 	pSession->join_bssid_count = 0;
 	sms_log(pMac, LOG1,
-		FL("called  BSSType = %d authtype = %d  encryType = %d"),
+		FL("called  BSSType = %s (%d) authtype = %d  encryType = %d"),
+		lim_bss_type_to_string(pProfile->BSSType),
 		pProfile->BSSType, pProfile->AuthType.authType[0],
 		pProfile->EncryptionType.encryptionType[0]);
 	csr_roam_cancel_roaming(pMac, sessionId);
@@ -7229,6 +7204,19 @@ CDF_STATUS csr_roam_connect(tpAniSirGlobal pMac, uint32_t sessionId,
 			&pSession->connectedProfile.SSID, &pProfile->SSIDs))
 			csr_roam_issue_disassociate_cmd(pMac, sessionId,
 					eCSR_DISCONNECT_REASON_UNSPECIFIED);
+	/*
+	 * If roamSession.connectState is disconnecting that mean
+	 * disconnect was received with scan for ssid in progress
+	 * and dropped. This state will ensure that connect will
+	 * not be issued from scan for ssid completion. Thus
+	 * if this fresh connect also issue scan for ssid the connect
+	 * command will be dropped assuming disconnect is in progress.
+	 * Thus reset connectState here
+	 */
+	if (eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTING ==
+		pMac->roam.roamSession[sessionId].connectState)
+			pMac->roam.roamSession[sessionId].connectState =
+				eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED;
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
 	pSession->maxRetryCount = CSR_JOIN_MAX_RETRY_COUNT;
 #endif
@@ -7269,8 +7257,7 @@ CDF_STATUS csr_roam_connect(tpAniSirGlobal pMac, uint32_t sessionId,
 		pScanFilter->bWPSAssociation = 0;
 		pScanFilter->bOSENAssociation = 0;
 	}
-	if ((pProfile && CSR_IS_WDS_AP(pProfile)) || (pProfile
-				&& CSR_IS_INFRA_AP(pProfile))) {
+	if (pProfile && CSR_IS_INFRA_AP(pProfile)) {
 		/* This can be started right away */
 		status = csr_roam_issue_connect(pMac, sessionId, pProfile, NULL,
 				 eCsrHddIssued, roamId, false, false);
@@ -7398,7 +7385,8 @@ csr_roam_reassoc(tpAniSirGlobal mac_ctx, uint32_t session_id,
 		return CDF_STATUS_E_FAILURE;
 	}
 	sms_log(mac_ctx, LOG1,
-		FL("called  BSSType = %d authtype = %d  encryType = %d"),
+		FL("called  BSSType = %s (%d) authtype = %d  encryType = %d"),
+		lim_bss_type_to_string(profile->BSSType),
 		profile->BSSType, profile->AuthType.authType[0],
 		profile->EncryptionType.encryptionType[0]);
 	csr_roam_cancel_roaming(mac_ctx, session_id);
@@ -7595,6 +7583,40 @@ CDF_STATUS csr_roam_process_disassoc_deauth(tpAniSirGlobal pMac, tSmeCmd *pComma
 				  FL
 					  ("set to substate eCSR_ROAM_SUBSTATE_DISASSOC_STA_HAS_LEFT"));
 		}
+		if (eCsrSmeIssuedDisassocForHandoff !=
+				pCommand->u.roamCmd.roamReason) {
+			/*
+			 * If we are in neighbor preauth done state then
+			 * on receiving disassoc or deauth we dont roam
+			 * instead we just disassoc from current ap and
+			 * then go to disconnected state.
+			 * This happens for ESE and 11r FT connections ONLY.
+			 */
+#ifdef WLAN_FEATURE_VOWIFI_11R
+			if (csr_roam_is11r_assoc(pMac, sessionId) &&
+				(csr_neighbor_roam_state_preauth_done(pMac,
+							sessionId))) {
+				csr_neighbor_roam_tranistion_preauth_done_to_disconnected(
+							pMac, sessionId);
+			}
+#endif
+#ifdef FEATURE_WLAN_ESE
+			if (csr_roam_is_ese_assoc(pMac, sessionId) &&
+				(csr_neighbor_roam_state_preauth_done(pMac,
+							sessionId))) {
+				csr_neighbor_roam_tranistion_preauth_done_to_disconnected(
+							pMac, sessionId);
+			}
+#endif
+#ifdef FEATURE_WLAN_LFR
+			if (csr_roam_is_fast_roam_enabled(pMac, sessionId) &&
+				(csr_neighbor_roam_state_preauth_done(pMac,
+							sessionId))) {
+				csr_neighbor_roam_tranistion_preauth_done_to_disconnected(
+							pMac, sessionId);
+			}
+#endif
+		}
 		if (fDisassoc) {
 			status =
 				csr_roam_issue_disassociate(pMac, sessionId,
@@ -7605,26 +7627,6 @@ CDF_STATUS csr_roam_process_disassoc_deauth(tpAniSirGlobal pMac, tSmeCmd *pComma
 						      eCSR_ROAM_SUBSTATE_DEAUTH_REQ);
 		}
 		fComplete = (!CDF_IS_STATUS_SUCCESS(status));
-	} else if (csr_is_conn_state_wds(pMac, sessionId)) {
-		if (CSR_IS_WDS_AP
-			    (&pMac->roam.roamSession[sessionId].connectedProfile)) {
-			status =
-				csr_roam_issue_stop_bss(pMac, sessionId,
-							eCSR_ROAM_SUBSTATE_STOP_BSS_REQ);
-			fComplete = (!CDF_IS_STATUS_SUCCESS(status));
-		}
-		/* This has to be WDS station */
-		else if (csr_is_conn_state_connected_wds(pMac, sessionId)) {
-			/* This has to be WDS station */
-			pCommand->u.roamCmd.fStopWds = true;
-			if (fDisassoc) {
-				status =
-					csr_roam_issue_disassociate(pMac, sessionId,
-								    eCSR_ROAM_SUBSTATE_DISCONNECT_CONTINUE_ROAMING,
-								    fMICFailure);
-				fComplete = (!CDF_IS_STATUS_SUCCESS(status));
-			}
-		}
 	} else {
 		/* we got a dis-assoc request while not connected to any peer */
 		/* just complete the command */
@@ -7791,12 +7793,13 @@ CDF_STATUS csr_roam_disconnect_internal(tpAniSirGlobal pMac, uint32_t sessionId,
 	/* Only issue disconnect when necessary */
 	if (csr_is_conn_state_connected(pMac, sessionId)
 	    || csr_is_bss_type_ibss(pSession->connectedProfile.BSSType)
-	    || csr_is_bss_type_wds(pSession->connectedProfile.BSSType)
 	    || csr_is_roam_command_waiting_for_session(pMac, sessionId)) {
 		sms_log(pMac, LOG2, FL("called"));
 		status = csr_roam_issue_disassociate_cmd(pMac, sessionId,
 							 reason);
 	} else {
+		pMac->roam.roamSession[sessionId].connectState =
+			eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTING;
 		csr_scan_abort_scan_for_ssid(pMac, sessionId);
 		status = CDF_STATUS_CMD_NOT_QUEUED;
 		sms_log(pMac, LOG1,
@@ -7843,60 +7846,57 @@ CDF_STATUS csr_roam_save_connected_infomation(tpAniSirGlobal pMac,
 		return CDF_STATUS_E_FAILURE;
 	}
 	pConnectProfile = &pSession->connectedProfile;
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	if (pSession->roamOffloadSynchParams.bRoamSynchInProgress) {
-		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
-			  FL("csr_roam_save_connected_infomation"));
-	}
-#endif
 	if (pConnectProfile->pAddIEAssoc) {
 		cdf_mem_free(pConnectProfile->pAddIEAssoc);
 		pConnectProfile->pAddIEAssoc = NULL;
 	}
-	cdf_mem_set(&pSession->connectedProfile,
-		    sizeof(tCsrRoamConnectedProfile), 0);
-	pConnectProfile->AuthType = pProfile->negotiatedAuthType;
-	pConnectProfile->AuthInfo = pProfile->AuthType;
-	pConnectProfile->CBMode = pProfile->CBMode;     /* *** this may not be valid */
-	pConnectProfile->EncryptionType = pProfile->negotiatedUCEncryptionType;
-	pConnectProfile->EncryptionInfo = pProfile->EncryptionType;
-	pConnectProfile->mcEncryptionType =
-		pProfile->negotiatedMCEncryptionType;
-	pConnectProfile->mcEncryptionInfo = pProfile->mcEncryptionType;
-	pConnectProfile->BSSType = pProfile->BSSType;
-	pConnectProfile->modifyProfileFields.uapsd_mask = pProfile->uapsd_mask;
+	if (!pSession->roam_synch_in_progress) {
+		cdf_mem_set(&pSession->connectedProfile,
+				sizeof(tCsrRoamConnectedProfile), 0);
+		pConnectProfile->AuthType = pProfile->negotiatedAuthType;
+		pConnectProfile->AuthInfo = pProfile->AuthType;
+		pConnectProfile->CBMode = pProfile->CBMode;
+		pConnectProfile->EncryptionType =
+			pProfile->negotiatedUCEncryptionType;
+		pConnectProfile->EncryptionInfo = pProfile->EncryptionType;
+		pConnectProfile->mcEncryptionType =
+			pProfile->negotiatedMCEncryptionType;
+		pConnectProfile->mcEncryptionInfo = pProfile->mcEncryptionType;
+		pConnectProfile->BSSType = pProfile->BSSType;
+		pConnectProfile->modifyProfileFields.uapsd_mask =
+			pProfile->uapsd_mask;
+		cdf_mem_copy(&pConnectProfile->Keys, &pProfile->Keys,
+				sizeof(tCsrKeys));
+		if (pProfile->nAddIEAssocLength) {
+			pConnectProfile->pAddIEAssoc =
+				cdf_mem_malloc(pProfile->nAddIEAssocLength);
+			if (NULL == pConnectProfile->pAddIEAssoc)
+				status = CDF_STATUS_E_NOMEM;
+			else
+				status = CDF_STATUS_SUCCESS;
+			if (!CDF_IS_STATUS_SUCCESS(status)) {
+				sms_log(pMac, LOGE,
+					FL("Failed to allocate memory for IE"));
+				return CDF_STATUS_E_FAILURE;
+			}
+			pConnectProfile->nAddIEAssocLength =
+				pProfile->nAddIEAssocLength;
+			cdf_mem_copy(pConnectProfile->pAddIEAssoc,
+					pProfile->pAddIEAssoc,
+					pProfile->nAddIEAssocLength);
+		}
+#ifdef WLAN_FEATURE_11W
+		pConnectProfile->MFPEnabled = pProfile->MFPEnabled;
+		pConnectProfile->MFPRequired = pProfile->MFPRequired;
+		pConnectProfile->MFPCapable = pProfile->MFPCapable;
+#endif
+	}
+	/* Save bssid */
 	pConnectProfile->operationChannel = pSirBssDesc->channelId;
 	pConnectProfile->beaconInterval = pSirBssDesc->beaconInterval;
 	if (!pConnectProfile->beaconInterval) {
 		sms_log(pMac, LOGW, FL("ERROR: Beacon interval is ZERO"));
 	}
-	cdf_mem_copy(&pConnectProfile->Keys, &pProfile->Keys, sizeof(tCsrKeys));
-	/* saving the addional IE`s like Hot spot indication element and extended capabilities */
-	if (pProfile->nAddIEAssocLength) {
-		pConnectProfile->pAddIEAssoc =
-			cdf_mem_malloc(pProfile->nAddIEAssocLength);
-		if (NULL == pConnectProfile->pAddIEAssoc)
-			status = CDF_STATUS_E_NOMEM;
-		else
-			status = CDF_STATUS_SUCCESS;
-		if (!CDF_IS_STATUS_SUCCESS(status)) {
-			sms_log(pMac, LOGE,
-				FL
-					("Failed to allocate memory for additional IEs"));
-			return CDF_STATUS_E_FAILURE;
-		}
-		pConnectProfile->nAddIEAssocLength =
-			pProfile->nAddIEAssocLength;
-		cdf_mem_copy(pConnectProfile->pAddIEAssoc,
-			     pProfile->pAddIEAssoc,
-			     pProfile->nAddIEAssocLength);
-	}
-#ifdef WLAN_FEATURE_11W
-	pConnectProfile->MFPEnabled = pProfile->MFPEnabled;
-	pConnectProfile->MFPRequired = pProfile->MFPRequired;
-	pConnectProfile->MFPCapable = pProfile->MFPCapable;
-#endif
-	/* Save bssid */
 	csr_get_bss_id_bss_desc(pMac, pSirBssDesc, &pConnectProfile->bssid);
 #ifdef WLAN_FEATURE_VOWIFI_11R
 	if (pSirBssDesc->mdiePresent) {
@@ -7973,7 +7973,7 @@ CDF_STATUS csr_roam_save_connected_infomation(tpAniSirGlobal pMac,
 }
 
 
-static bool is_disconnect_pending(tpAniSirGlobal pmac,
+bool is_disconnect_pending(tpAniSirGlobal pmac,
 				uint8_t sessionid)
 {
 	tListElem *entry = NULL;
@@ -8055,7 +8055,6 @@ static void csr_roam_join_rsp_processor(tpAniSirGlobal pMac,
 		sms_log(pMac, LOGW,
 			"SmeJoinReq failed with statusCode= 0x%08X [%d]",
 			pSmeJoinRsp->statusCode, pSmeJoinRsp->statusCode);
-#if   defined WLAN_FEATURE_NEIGHBOR_ROAMING
 		/* If Join fails while Handoff is in progress, indicate disassociated event to supplicant to reconnect */
 		if (csr_roam_is_handoff_in_progress(pMac, pSmeJoinRsp->sessionId)) {
 			csr_roam_call_callback(pMac, pSmeJoinRsp->sessionId, NULL,
@@ -8066,7 +8065,6 @@ static void csr_roam_join_rsp_processor(tpAniSirGlobal pMac,
 							   pSmeJoinRsp->sessionId,
 							   CDF_STATUS_E_FAILURE);
 		}
-#endif
 		/*
 		 * if userspace has issued disconnection,
 		 * driver should not continue connecting
@@ -8074,17 +8072,7 @@ static void csr_roam_join_rsp_processor(tpAniSirGlobal pMac,
 		is_dis_pending = is_disconnect_pending(pMac, session_ptr->sessionId);
 		if (pCommand && (session_ptr->join_bssid_count <
 				CSR_MAX_BSSID_COUNT) && !is_dis_pending) {
-			if (CSR_IS_WDS_STA(&pCommand->u.roamCmd.roamProfile)) {
-				pCommand->u.roamCmd.fStopWds = true;
-				session_ptr->connectedProfile.BSSType =
-					eCSR_BSS_TYPE_WDS_STA;
-				csr_roam_reissue_roam_command(pMac);
-			} else if (CSR_IS_WDS(&pCommand->u.roamCmd.roamProfile)) {
-				session_ptr->join_bssid_count = 0;
-				csr_roam_complete(pMac, eCsrNothingToJoin, NULL);
-			} else {
-				csr_roam(pMac, pCommand);
-			}
+			csr_roam(pMac, pCommand);
 		} else {
 			/* ****************************************************
 			 * When the upper layers issue a connect command, there
@@ -8199,20 +8187,11 @@ void csr_roam_reissue_roam_command(tpAniSirGlobal pMac)
 	roamInfo.pBssDesc = pCommand->u.roamCmd.pLastRoamBss;
 	roamInfo.statusCode = pSession->joinFailStatusCode.statusCode;
 	roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
-	if (CSR_IS_WDS(&pSession->connectedProfile)) {
-		pSession->connectState = eCSR_ASSOC_STATE_TYPE_WDS_DISCONNECTED;
-		csr_roam_call_callback(pMac, sessionId, &roamInfo,
-				       pCommand->u.roamCmd.roamId,
-				       eCSR_ROAM_WDS_IND,
-				       eCSR_ROAM_RESULT_WDS_DISASSOCIATED);
-	} else if (CSR_IS_INFRA_AP(&pSession->connectedProfile)) {
-		pSession->connectState =
-			eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTED;
-		csr_roam_call_callback(pMac, sessionId, &roamInfo,
-				       pCommand->u.roamCmd.roamId,
-				       eCSR_ROAM_INFRA_IND,
-				       eCSR_ROAM_RESULT_INFRA_DISASSOCIATED);
-	}
+	pSession->connectState = eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTED;
+	csr_roam_call_callback(pMac, sessionId, &roamInfo,
+			       pCommand->u.roamCmd.roamId,
+			       eCSR_ROAM_INFRA_IND,
+			       eCSR_ROAM_RESULT_INFRA_DISASSOCIATED);
 
 	if (!CDF_IS_STATUS_SUCCESS(csr_roam_issue_stop_bss(pMac, sessionId,
 					eCSR_ROAM_SUBSTATE_STOP_BSS_REQ))) {
@@ -8467,7 +8446,6 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx,
 		bss_desc = &scan_result->Result.BssDescriptor;
 	}
 	if (csr_is_bss_type_ibss(cmd->u.roamCmd.roamProfile.BSSType)
-	    || CSR_IS_WDS(&cmd->u.roamCmd.roamProfile)
 	    || CSR_IS_INFRA_AP(&cmd->u.roamCmd.roamProfile)) {
 		if (!CDF_IS_STATUS_SUCCESS(csr_roam_issue_start_bss(mac_ctx,
 						session_id, &session->bssParams,
@@ -8557,19 +8535,16 @@ csr_roaming_state_config_cnf_processor(tpAniSirGlobal mac_ctx,
 								session_id);
 		} else
 #endif
-#ifdef FEATURE_WLAN_LFR
 		if (csr_roam_is_handoff_in_progress(mac_ctx, session_id)
 		   && csr_roam_is_fast_roam_enabled(mac_ctx, session_id)) {
 			/* Now serialize the reassoc command. */
 			status = csr_roam_issue_reassociate_cmd(mac_ctx,
 								session_id);
-		} else
-#endif
-		{
-		/*
-		 * else we are not connected and attempting to Join. Issue the
-		 * Join request.
-		 */
+		} else {
+			/*
+			 * else we are not connected and attempting to Join.
+			 * Issue the Join request.
+			 */
 			status = csr_roam_issue_join(mac_ctx, session_id,
 						    bss_desc,
 						    (tDot11fBeaconIEs *)
@@ -8601,18 +8576,17 @@ static void csr_roam_roaming_state_reassoc_rsp_processor(tpAniSirGlobal pMac,
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
 			  FL("CSR SmeReassocReq Successful"));
 		result = eCsrReassocSuccess;
-		/* Defeaturize this part later if needed */
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
-		/* Since the neighbor roam algorithm uses reassoc req for handoff instead of join,
-		 * we need the response contents while processing the result in csr_roam_process_results() */
+		/*
+		 * Since the neighbor roam algorithm uses reassoc req for
+		 * handoff instead of join, we need the response contents while
+		 * processing the result in csr_roam_process_results()
+		 */
 		if (csr_roam_is_handoff_in_progress(pMac, pSmeJoinRsp->sessionId)) {
 			/* Need to dig more on indicating events to SME QoS module */
 			sme_qos_csr_event_ind(pMac, pSmeJoinRsp->sessionId,
 					      SME_QOS_CSR_HANDOFF_COMPLETE, NULL);
 			csr_roam_complete(pMac, result, pSmeJoinRsp);
-		} else
-#endif
-		{
+		} else {
 			csr_roam_complete(pMac, result, NULL);
 		}
 	}
@@ -8623,8 +8597,6 @@ static void csr_roam_roaming_state_reassoc_rsp_processor(tpAniSirGlobal pMac,
 			"CSR SmeReassocReq failed with statusCode= 0x%08X [%d]",
 			pSmeJoinRsp->statusCode, pSmeJoinRsp->statusCode);
 		result = eCsrReassocFailure;
-#if defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || \
-		defined(FEATURE_WLAN_LFR)
 		if ((eSIR_SME_FT_REASSOC_TIMEOUT_FAILURE ==
 		     pSmeJoinRsp->statusCode)
 		    || (eSIR_SME_FT_REASSOC_FAILURE ==
@@ -8653,7 +8625,6 @@ static void csr_roam_roaming_state_reassoc_rsp_processor(tpAniSirGlobal pMac,
 				return;
 			}
 		}
-#endif
 		/* In the event that the Reassociation fails, then we need to Disassociate the current association and keep */
 		/* roaming.  Note that we will attempt to Join the AP instead of a Reassoc since we may have attempted a */
 		/* 'Reassoc to self', which AP's that don't support Reassoc will force a Disassoc. */
@@ -8836,13 +8807,11 @@ csr_check_profile_in_scan_cache(tpAniSirGlobal mac_ctx,
 void csr_roam_roaming_state_disassoc_rsp_processor(tpAniSirGlobal pMac,
 						   tSirSmeDisassocRsp *pSmeRsp)
 {
-#if defined WLAN_FEATURE_NEIGHBOR_ROAMING
 	tScanResultHandle hBSSList;
 	tCsrRoamInfo roamInfo;
 	tCsrScanResultFilter *pScanFilter = NULL;
 	uint32_t roamId = 0;
 	tCsrRoamProfile *pCurRoamProfile = NULL;
-#endif
 	CDF_STATUS status;
 	uint32_t sessionId;
 	tCsrRoamSession *pSession;
@@ -8884,7 +8853,6 @@ void csr_roam_roaming_state_disassoc_rsp_processor(tpAniSirGlobal pMac,
 			  FL("CSR SmeDisassocReq due to HO on session %d"),
 			  sessionId);
 		pNeighborRoamInfo = &pMac->roam.neighborRoamInfo[sessionId];
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 		/*
 		 * First ensure if the roam profile is in the scan cache.
 		 * If not, post a reassoc failure and disconnect.
@@ -8944,9 +8912,8 @@ void csr_roam_roaming_state_disassoc_rsp_processor(tpAniSirGlobal pMac,
 		}
 
 POST_ROAM_FAILURE:
-	csr_post_roam_failure(pMac, sessionId, &roamInfo,
+		csr_post_roam_failure(pMac, sessionId, &roamInfo,
 			      pScanFilter, pCurRoamProfile);
-#endif
 	} /* else if ( CSR_IS_ROAM_SUBSTATE_DISASSOC_HO( pMac ) ) */
 	else if (CSR_IS_ROAM_SUBSTATE_REASSOC_FAIL(pMac, sessionId)) {
 		/* Disassoc due to Reassoc failure falls into this codepath */
@@ -9113,8 +9080,7 @@ void csr_roaming_state_msg_processor(tpAniSirGlobal pMac, void *pMsgBuf)
 		roamInfo.staId = (uint8_t) pIbssPeerInd->staId;
 		roamInfo.ucastSig = (uint8_t) pIbssPeerInd->ucastSig;
 		roamInfo.bcastSig = (uint8_t) pIbssPeerInd->bcastSig;
-		cdf_mem_copy(&roamInfo.peerMac, pIbssPeerInd->peerAddr,
-			     sizeof(struct cdf_mac_addr));
+		cdf_copy_macaddr(&roamInfo.peerMac, &pIbssPeerInd->peer_addr);
 		csr_roam_call_callback(pMac, pSmeRsp->sessionId, &roamInfo, 0,
 				       eCSR_ROAM_CONNECT_STATUS_UPDATE,
 				       eCSR_ROAM_RESULT_IBSS_PEER_DEPARTED);
@@ -9223,12 +9189,6 @@ void csr_roam_joined_state_msg_processor(tpAniSirGlobal pMac, void *pMsgBuf)
 						       eCSR_ROAM_INFRA_IND,
 						       eCSR_ROAM_RESULT_INFRA_ASSOCIATION_CNF);
 		}
-		if (CSR_IS_WDS_AP(pRoamInfo->u.pConnectedProfile)) {
-			cdf_sleep(100);
-			pMac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_WDS_CONNECTED;           /* Sta */
-			status = csr_roam_call_callback(pMac, sessionId, pRoamInfo, 0, eCSR_ROAM_WDS_IND, eCSR_ROAM_RESULT_WDS_ASSOCIATION_IND);           /* Sta */
-		}
-
 	}
 	break;
 	default:
@@ -9482,8 +9442,8 @@ static CDF_STATUS csr_roam_issue_set_key_command(tpAniSirGlobal pMac,
 		pCommand->u.setKeyCmd.roamId = roamId;
 		pCommand->u.setKeyCmd.encType = pSetKey->encType;
 		pCommand->u.setKeyCmd.keyDirection = pSetKey->keyDirection;
-		cdf_mem_copy(&pCommand->u.setKeyCmd.peerMac, &pSetKey->peerMac,
-			     sizeof(struct cdf_mac_addr));
+		cdf_copy_macaddr(&pCommand->u.setKeyCmd.peermac,
+				 &pSetKey->peerMac);
 		/* 0 for supplicant */
 		pCommand->u.setKeyCmd.paeRole = pSetKey->paeRole;
 		pCommand->u.setKeyCmd.keyId = pSetKey->keyId;
@@ -9522,7 +9482,7 @@ CDF_STATUS csr_roam_process_set_key_command(tpAniSirGlobal pMac, tSmeCmd *pComma
 	tAniEdType edType =
 		csr_translate_encrypt_type_to_ed_type(pCommand->u.setKeyCmd.encType);
 	bool fUnicast =
-		(pCommand->u.setKeyCmd.peerMac[0] == 0xFF) ? false : true;
+		(pCommand->u.setKeyCmd.peermac.bytes[0] == 0xFF) ? false : true;
 	uint32_t sessionId = pCommand->sessionId;
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
 	tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
@@ -9537,7 +9497,7 @@ CDF_STATUS csr_roam_process_set_key_command(tpAniSirGlobal pMac, tSmeCmd *pComma
 	if (eSIR_ED_NONE != edType) {
 		cdf_mem_set(&setKeyEvent,
 			    sizeof(host_event_wlan_security_payload_type), 0);
-		if (*((uint8_t *) &pCommand->u.setKeyCmd.peerMac) & 0x01) {
+		if (cdf_is_macaddr_group(&pCommand->u.setKeyCmd.peermac)) {
 			setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_GTK_REQ;
 			setKeyEvent.encryptionModeMulticast =
 				(uint8_t) diag_enc_type_from_csr_type(pCommand->u.
@@ -9579,8 +9539,9 @@ CDF_STATUS csr_roam_process_set_key_command(tpAniSirGlobal pMac, tSmeCmd *pComma
 #endif /* FEATURE_WLAN_DIAG_SUPPORT_CSR */
 	if (csr_is_set_key_allowed(pMac, sessionId)) {
 		status = csr_send_mb_set_context_req_msg(pMac, sessionId,
-							 (uint8_t *) &pCommand->u.
-							 setKeyCmd.peerMac, numKeys,
+							 pCommand->u.
+							 setKeyCmd.peermac,
+							 numKeys,
 							 edType, fUnicast,
 							 pCommand->u.setKeyCmd.
 							 keyDirection,
@@ -9605,8 +9566,8 @@ CDF_STATUS csr_roam_process_set_key_command(tpAniSirGlobal pMac, tSmeCmd *pComma
 				       eCSR_ROAM_RESULT_FAILURE);
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_CSR
 		if (eSIR_ED_NONE != edType) {
-			if (*((uint8_t *) &pCommand->u.setKeyCmd.peerMac) &
-			    0x01) {
+			if (cdf_is_macaddr_group(
+					&pCommand->u.setKeyCmd.peermac)) {
 				setKeyEvent.eventId =
 					WLAN_SECURITY_EVENT_SET_GTK_RSP;
 			} else {
@@ -9669,15 +9630,7 @@ csr_roam_prepare_filter_from_profile(tpAniSirGlobal mac_ctx,
 	}
 
 	if (profile->SSIDs.numOfSSIDs) {
-		if (!CSR_IS_WDS_STA(profile)) {
-			scan_fltr->SSIDs.numOfSSIDs = profile->SSIDs.numOfSSIDs;
-		} else {
-			/*
-			 * For WDS station we always use idx 1 for self SSID.
-			 * Index 0 for peer's SSID that we want to join
-			 */
-			scan_fltr->SSIDs.numOfSSIDs = 1;
-		}
+		scan_fltr->SSIDs.numOfSSIDs = profile->SSIDs.numOfSSIDs;
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
 			FL("No of Allowed List:%d"),
 			roam_params->num_ssid_allowed_list);
@@ -10083,10 +10036,6 @@ csr_roam_chk_lnk_assoc_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	cdf_mem_copy(&roam_info_ptr->chan_info,
 		     &pAssocInd->chan_info,
 		     sizeof(tSirSmeChanInfo));
-	if (CSR_IS_WDS_AP(roam_info_ptr->u.pConnectedProfile))
-		status = csr_roam_call_callback(mac_ctx, sessionId,
-					roam_info_ptr, 0, eCSR_ROAM_WDS_IND,
-					eCSR_ROAM_RESULT_WDS_ASSOCIATION_IND);
 	if (CSR_IS_INFRA_AP(roam_info_ptr->u.pConnectedProfile)) {
 		if (session->pCurRoamProfile &&
 		    CSR_IS_ENC_TYPE_STATIC(
@@ -10115,10 +10064,7 @@ csr_roam_chk_lnk_assoc_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	 * send a message to CSR itself just to avoid the EAPOL frames going
 	 * OTA before association response
 	 */
-	if (CSR_IS_WDS_AP(roam_info_ptr->u.pConnectedProfile)) {
-		status = csr_send_assoc_ind_to_upper_layer_cnf_msg(mac_ctx,
-						pAssocInd, status, sessionId);
-	} else if (CSR_IS_INFRA_AP(roam_info_ptr->u.pConnectedProfile)
+	if (CSR_IS_INFRA_AP(roam_info_ptr->u.pConnectedProfile)
 	    && (roam_info_ptr->statusCode != eSIR_SME_ASSOC_REFUSED)) {
 		roam_info_ptr->fReassocReq = pAssocInd->reassocReq;
 		status = csr_send_assoc_ind_to_upper_layer_cnf_msg(mac_ctx,
@@ -10145,10 +10091,11 @@ csr_roam_chk_lnk_disassoc_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	pDisassocInd = (tSirSmeDisassocInd *) msg_ptr;
 	cdf_mem_set(&roam_info, sizeof(roam_info), 0);
 	status = csr_roam_get_session_id_from_bssid(mac_ctx,
-				(struct cdf_mac_addr *) pDisassocInd->bssId, &sessionId);
+				&pDisassocInd->bssid, &sessionId);
 	if (!CDF_IS_STATUS_SUCCESS(status)) {
 		sms_log(mac_ctx, LOGE, FL("Session Id not found for BSSID "
-			MAC_ADDRESS_STR), MAC_ADDR_ARRAY(pDisassocInd->bssId));
+			MAC_ADDRESS_STR),
+			MAC_ADDR_ARRAY(pDisassocInd->bssid.bytes));
 		return;
 	}
 
@@ -10158,7 +10105,7 @@ csr_roam_chk_lnk_disassoc_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	sms_log(mac_ctx, LOGE,
 		FL("DISASSOCIATION from peer =" MAC_ADDRESS_STR
 		   " " " reason = %d status = %d "),
-		MAC_ADDR_ARRAY(pDisassocInd->peerMacAddr),
+		MAC_ADDR_ARRAY(pDisassocInd->peer_macaddr.bytes),
 		pDisassocInd->reasonCode,
 		pDisassocInd->statusCode);
 	/*
@@ -10179,12 +10126,10 @@ csr_roam_chk_lnk_disassoc_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 		csr_neighbor_roam_tranistion_preauth_done_to_disconnected(
 							mac_ctx, sessionId);
 #endif
-#ifdef FEATURE_WLAN_LFR
 	if (csr_roam_is_fast_roam_enabled(mac_ctx, sessionId) &&
 	    (csr_neighbor_roam_state_preauth_done(mac_ctx, sessionId)))
 		csr_neighbor_roam_tranistion_preauth_done_to_disconnected(
 							mac_ctx, sessionId);
-#endif
 	session = CSR_GET_SESSION(mac_ctx, sessionId);
 	if (!session) {
 		sms_log(mac_ctx, LOGE, FL("session %d not found"), sessionId);
@@ -10205,12 +10150,10 @@ csr_roam_chk_lnk_disassoc_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 		roam_info_ptr->reasonCode = pDisassocInd->reasonCode;
 		roam_info_ptr->u.pConnectedProfile = &session->connectedProfile;
 		roam_info_ptr->staId = (uint8_t) pDisassocInd->staId;
-		cdf_mem_copy(roam_info_ptr->peerMac.bytes,
-			     pDisassocInd->peerMacAddr,
-			     sizeof(tSirMacAddr));
-		cdf_mem_copy(&roam_info_ptr->bssid.bytes,
-			     pDisassocInd->bssId,
-			     sizeof(struct cdf_mac_addr));
+		cdf_copy_macaddr(&roam_info_ptr->peerMac,
+				 &pDisassocInd->peer_macaddr);
+		cdf_copy_macaddr(&roam_info_ptr->bssid,
+				 &pDisassocInd->bssid);
 		status = csr_roam_call_callback(mac_ctx, sessionId,
 						roam_info_ptr, 0,
 						eCSR_ROAM_INFRA_IND,
@@ -10223,8 +10166,8 @@ csr_roam_chk_lnk_disassoc_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 		cmd.sessionId = (uint8_t) sessionId;
 		cmd.u.roamCmd.roamReason = eCsrForcedDeauthSta;
 		cdf_mem_copy(cmd.u.roamCmd.peerMac,
-			     pDisassocInd->peerMacAddr,
-			     sizeof(tSirMacAddr));
+			     pDisassocInd->peer_macaddr.bytes,
+			     CDF_MAC_ADDR_SIZE);
 		csr_roam_remove_duplicate_command(mac_ctx, sessionId, &cmd,
 						  eCsrForcedDeauthSta);
 	}
@@ -10244,8 +10187,8 @@ csr_roam_chk_lnk_deauth_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	sms_log(mac_ctx, LOG1, FL("DEAUTHENTICATION Indication from MAC"));
 	pDeauthInd = (tpSirSmeDeauthInd) msg_ptr;
 	status = csr_roam_get_session_id_from_bssid(mac_ctx,
-						   (struct cdf_mac_addr *) pDeauthInd->
-						   bssId, &sessionId);
+						   &pDeauthInd->bssid,
+						   &sessionId);
 	if (!CDF_IS_STATUS_SUCCESS(status))
 		return;
 	/* If we are in neighbor preauth done state then on receiving
@@ -10265,12 +10208,10 @@ csr_roam_chk_lnk_deauth_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 		csr_neighbor_roam_tranistion_preauth_done_to_disconnected(
 							mac_ctx, sessionId);
 #endif
-#ifdef FEATURE_WLAN_LFR
 	if (csr_roam_is_fast_roam_enabled(mac_ctx, sessionId) &&
 	    (csr_neighbor_roam_state_preauth_done(mac_ctx, sessionId)))
 		csr_neighbor_roam_tranistion_preauth_done_to_disconnected(
 							mac_ctx, sessionId);
-#endif
 	session = CSR_GET_SESSION(mac_ctx, sessionId);
 	if (!session) {
 		sms_log(mac_ctx, LOGE, FL("session %d not found"), sessionId);
@@ -10293,12 +10234,10 @@ csr_roam_chk_lnk_deauth_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 		roam_info_ptr->reasonCode = pDeauthInd->reasonCode;
 		roam_info_ptr->u.pConnectedProfile = &session->connectedProfile;
 		roam_info_ptr->staId = (uint8_t) pDeauthInd->staId;
-		cdf_mem_copy(roam_info_ptr->peerMac.bytes,
-			     pDeauthInd->peerMacAddr,
-			     sizeof(tSirMacAddr));
-		cdf_mem_copy(&roam_info_ptr->bssid.bytes,
-			     pDeauthInd->bssId,
-			     sizeof(struct cdf_mac_addr));
+		cdf_copy_macaddr(&roam_info_ptr->peerMac,
+				 &pDeauthInd->peer_macaddr);
+		cdf_copy_macaddr(&roam_info_ptr->bssid,
+				 &pDeauthInd->bssid);
 		status = csr_roam_call_callback(mac_ctx, sessionId,
 						roam_info_ptr, 0,
 						eCSR_ROAM_INFRA_IND,
@@ -10321,7 +10260,7 @@ csr_roam_chk_lnk_swt_ch_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	 * statusCode.
 	 */
 	status = csr_roam_get_session_id_from_bssid(mac_ctx,
-			(struct cdf_mac_addr *) pSwitchChnInd->bssId, &sessionId);
+			&pSwitchChnInd->bssid, &sessionId);
 	if (CDF_IS_STATUS_SUCCESS(status)) {
 		session = CSR_GET_SESSION(mac_ctx, sessionId);
 		if (!session) {
@@ -10357,9 +10296,8 @@ csr_roam_chk_lnk_deauth_rsp(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	if (CSR_IS_INFRA_AP(&session->connectedProfile)) {
 		roam_info_ptr = &roam_info;
 		roam_info_ptr->u.pConnectedProfile = &session->connectedProfile;
-		cdf_mem_copy(roam_info_ptr->peerMac.bytes,
-			     pDeauthRsp->peerMacAddr,
-			     sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&roam_info_ptr->peerMac,
+				 &pDeauthRsp->peer_macaddr);
 		roam_info_ptr->reasonCode = eCSR_ROAM_RESULT_FORCED;
 		roam_info_ptr->statusCode = pDeauthRsp->statusCode;
 		status = csr_roam_call_callback(mac_ctx, sessionId,
@@ -10392,9 +10330,8 @@ csr_roam_chk_lnk_disassoc_rsp(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	if (CSR_IS_INFRA_AP(&session->connectedProfile)) {
 		roam_info_ptr = &roam_info;
 		roam_info_ptr->u.pConnectedProfile = &session->connectedProfile;
-		cdf_mem_copy(roam_info_ptr->peerMac.bytes,
-			     pDisassocRsp->peerMacAddr,
-			     sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&roam_info_ptr->peerMac,
+				 &pDisassocRsp->peer_macaddr);
 		roam_info_ptr->reasonCode = eCSR_ROAM_RESULT_FORCED;
 		roam_info_ptr->statusCode = pDisassocRsp->statusCode;
 		status = csr_roam_call_callback(mac_ctx, sessionId,
@@ -10474,7 +10411,7 @@ csr_roam_chk_lnk_pbs_probe_req_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	sms_log(mac_ctx, LOG1, FL("WPS PBC Probe request Indication from SME"));
 
 	status = csr_roam_get_session_id_from_bssid(mac_ctx,
-			(struct cdf_mac_addr *)pProbeReqInd->bssId, &sessionId);
+			&pProbeReqInd->bssid, &sessionId);
 	if (CDF_IS_STATUS_SUCCESS(status)) {
 		cdf_mem_set(&roam_info, sizeof(tCsrRoamInfo), 0);
 		roam_info.u.pWPSPBCProbeReq = &pProbeReqInd->WPSPBCProbeReq;
@@ -10497,8 +10434,7 @@ csr_roam_diag_joined_new_bss(tpAniSirGlobal mac_ctx,
 		return;
 	pIbssLog->eventId = WLAN_IBSS_EVENT_COALESCING;
 	if (pNewBss) {
-		cdf_mem_copy(pIbssLog->bssid, pNewBss->bssId.bytes,
-				CDF_MAC_ADDR_SIZE);
+		cdf_copy_macaddr(&pIbssLog->bssid, &pNewBss->bssId);
 		if (pNewBss->ssId.length)
 			cdf_mem_copy(pIbssLog->ssid, pNewBss->ssId.ssId,
 				     pNewBss->ssId.length);
@@ -10687,7 +10623,8 @@ csr_roam_chk_lnk_ibss_new_peer_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 				 LOG_WLAN_IBSS_C);
 	if (pIbssLog) {
 		pIbssLog->eventId = WLAN_IBSS_EVENT_PEER_JOIN;
-		cdf_mem_copy(pIbssLog->peerMacAddr, &pIbssPeerInd->peerAddr, 6);
+		cdf_copy_macaddr(&pIbssLog->peer_macaddr,
+				 &pIbssPeerInd->peer_addr);
 		WLAN_HOST_DIAG_LOG_REPORT(pIbssLog);
 	}
 #endif /* FEATURE_WLAN_DIAG_SUPPORT_CSR */
@@ -10709,8 +10646,7 @@ csr_roam_chk_lnk_ibss_new_peer_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 		sms_log(mac_ctx, LOGW, FL("CSR: connected BSS is empty"));
 		goto callback_and_free;
 	}
-	cdf_mem_copy(&roam_info.peerMac, pIbssPeerInd->peerAddr,
-		     sizeof(struct cdf_mac_addr));
+	cdf_copy_macaddr(&roam_info.peerMac, &pIbssPeerInd->peer_addr);
 	cdf_mem_copy(&roam_info.bssid, session->pConnectBssDesc->bssId,
 		     sizeof(struct cdf_mac_addr));
 	if (pIbssPeerInd->mesgLen > sizeof(tSmeIbssPeerInd)) {
@@ -10753,7 +10689,8 @@ csr_roam_chk_lnk_ibss_new_peer_ind(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 		/* NO keys. these key parameters don't matter */
 		csr_roam_issue_set_context_req(mac_ctx, sessionId,
 			session->connectedProfile.EncryptionType,
-			session->pConnectBssDesc, &(pIbssPeerInd->peerAddr),
+			session->pConnectBssDesc,
+			&pIbssPeerInd->peer_addr.bytes,
 			false, true, eSIR_TX_RX, 0, 0, NULL, 0);
 	}
 
@@ -10795,8 +10732,8 @@ csr_roam_chk_lnk_ibss_peer_departed_ind(tpAniSirGlobal mac_ctx,
 		if (pIbssLog) {
 			pIbssLog->eventId = WLAN_IBSS_EVENT_PEER_LEAVE;
 			if (pIbssPeerInd) {
-				cdf_mem_copy(pIbssLog->peerMacAddr,
-					     &pIbssPeerInd->peerAddr, 6);
+				cdf_copy_macaddr(&pIbssLog->peer_macaddr,
+						 &pIbssPeerInd->peer_addr);
 			}
 			WLAN_HOST_DIAG_LOG_REPORT(pIbssLog);
 		}
@@ -10806,8 +10743,7 @@ csr_roam_chk_lnk_ibss_peer_departed_ind(tpAniSirGlobal mac_ctx,
 		roam_info.staId = (uint8_t) pIbssPeerInd->staId;
 		roam_info.ucastSig = (uint8_t) pIbssPeerInd->ucastSig;
 		roam_info.bcastSig = (uint8_t) pIbssPeerInd->bcastSig;
-		cdf_mem_copy(&roam_info.peerMac, pIbssPeerInd->peerAddr,
-			     sizeof(struct cdf_mac_addr));
+		cdf_copy_macaddr(&roam_info.peerMac, &pIbssPeerInd->peer_addr);
 		csr_roam_call_callback(mac_ctx, sessionId, &roam_info, 0,
 				       eCSR_ROAM_CONNECT_STATUS_UPDATE,
 				       eCSR_ROAM_RESULT_IBSS_PEER_DEPARTED);
@@ -10827,7 +10763,7 @@ csr_roam_diag_set_ctx_rsp(tpAniSirGlobal mac_ctx,
 		return;
 	cdf_mem_set(&setKeyEvent,
 		    sizeof(host_event_wlan_security_payload_type), 0);
-	if (pRsp->peerMacAddr[0] & 0x01)
+	if (cdf_is_macaddr_group(&pRsp->peer_macaddr))
 		setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_GTK_RSP;
 	else
 		setKeyEvent.eventId = WLAN_SECURITY_EVENT_SET_PTK_RSP;
@@ -10860,7 +10796,6 @@ csr_roam_chk_lnk_set_ctx_rsp(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	eCsrRoamResult result = eCSR_ROAM_RESULT_NONE;
 	tSirSmeSetContextRsp *pRsp = (tSirSmeSetContextRsp *) msg_ptr;
 	tListElem *entry;
-	tSirMacAddr Broadcastaddr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 
 	cdf_mem_set(&roam_info, sizeof(roam_info), 0);
 	entry = csr_ll_peek_head(&mac_ctx->sme.smeCmdActiveList,
@@ -10897,14 +10832,12 @@ csr_roam_chk_lnk_set_ctx_rsp(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 					 session->connectedProfile.bssid);
 	}
 	if (eSIR_SME_SUCCESS == pRsp->statusCode) {
-		cdf_mem_copy(&roam_info.peerMac, &pRsp->peerMacAddr,
-			     sizeof(struct cdf_mac_addr));
+		cdf_copy_macaddr(&roam_info.peerMac, &pRsp->peer_macaddr);
 		/* Make sure we install the GTK before indicating to HDD as
 		 * authenticated. This is to prevent broadcast packets go out
 		 * after PTK and before GTK.
 		 */
-		if (cdf_mem_compare(&Broadcastaddr, pRsp->peerMacAddr,
-				    sizeof(tSirMacAddr))) {
+		if (cdf_is_macaddr_broadcast(&pRsp->peer_macaddr)) {
 			tpSirSetActiveModeSetBncFilterReq pMsg;
 			pMsg = cdf_mem_malloc(
 				    sizeof(tSirSetActiveModeSetBncFilterReq));
@@ -10920,9 +10853,10 @@ csr_roam_chk_lnk_set_ctx_rsp(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	} else {
 		result = eCSR_ROAM_RESULT_FAILURE;
 		sms_log(mac_ctx, LOGE,
-			FL("CSR: setkey command failed(%d) PeerMac "
+			FL("CSR: setkey command failed(err=%d) PeerMac "
 			MAC_ADDRESS_STR),
-			pRsp->statusCode, MAC_ADDR_ARRAY(pRsp->peerMacAddr));
+			pRsp->statusCode,
+			MAC_ADDR_ARRAY(pRsp->peer_macaddr.bytes));
 	}
 	csr_roam_call_callback(mac_ctx, sessionId, &roam_info,
 			       cmd->u.setKeyCmd.roamId,
@@ -10939,8 +10873,6 @@ csr_roam_chk_lnk_set_ctx_rsp(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 	    && session->connectedProfile.isESEAssoc) {
 #ifdef FEATURE_WLAN_ESE_UPLOAD
 		csr_send_ese_adjacent_ap_rep_ind(mac_ctx, session);
-#else
-		csr_ese_send_adjacent_ap_rep_msg(mac_ctx, session);
 #endif
 		session->isPrevApInfoValid = false;
 	}
@@ -10967,8 +10899,7 @@ csr_roam_chk_lnk_max_assoc_exceeded(tpAniSirGlobal mac_ctx, tSirSmeRsp *msg_ptr)
 		FL("max assoc have been reached, new peer cannot be accepted"));
 	sessionId = pSmeMaxAssocInd->sessionId;
 	roam_info.sessionId = sessionId;
-	cdf_mem_copy(&roam_info.peerMac, pSmeMaxAssocInd->peerMac,
-		     sizeof(struct cdf_mac_addr));
+	cdf_copy_macaddr(&roam_info.peerMac, &pSmeMaxAssocInd->peer_mac);
 	csr_roam_call_callback(mac_ctx, sessionId, &roam_info, 0,
 			       eCSR_ROAM_INFRA_IND,
 			       eCSR_ROAM_RESULT_MAX_ASSOC_EXCEEDED);
@@ -11251,7 +11182,6 @@ void csr_roam_wait_for_key_time_out_handler(void *pv)
 						curSubState[pInfo->sessionId]));
 
 	if (CSR_IS_WAIT_FOR_KEY(pMac, pInfo->sessionId)) {
-#ifdef FEATURE_WLAN_LFR
 		if (csr_neighbor_roam_is_handoff_in_progress(pMac, pInfo->sessionId)) {
 			/*
 			 * Enable heartbeat timer when hand-off is in progress
@@ -11264,7 +11194,6 @@ void csr_roam_wait_for_key_time_out_handler(void *pv)
 			cfg_set_int(pMac, WNI_CFG_HEART_BEAT_THRESHOLD,
 					pMac->roam.configParam.HeartbeatThresh24);
 		}
-#endif
 		sms_log(pMac, LOGE, " SME pre-auth state timeout. ");
 
 		/* Change the substate so command queue is unblocked. */
@@ -11296,23 +11225,19 @@ CDF_STATUS csr_roam_start_wait_for_key_timer(tpAniSirGlobal pMac, uint32_t inter
 	tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
 		&pMac->roam.neighborRoamInfo[pMac->roam.WaitForKeyTimerInfo.
 					     sessionId];
-#ifdef FEATURE_WLAN_LFR
 	if (csr_neighbor_roam_is_handoff_in_progress(pMac,
-						     pMac->roam.WaitForKeyTimerInfo.
-						     sessionId)) {
+				     pMac->roam.WaitForKeyTimerInfo.
+				     sessionId)) {
 		/* Disable heartbeat timer when hand-off is in progress */
 		sms_log(pMac, LOG2,
 			FL("disabling HB timer in state=%s sub-state=%s"),
-			mac_trace_get_neighbour_roam_state(pNeighborRoamInfo->
-							   neighborRoamState),
-			mac_trace_getcsr_roam_sub_state(pMac->roam.
-							curSubState[pMac->roam.
-								    WaitForKeyTimerInfo.
-								    sessionId]
-							));
+			mac_trace_get_neighbour_roam_state(
+				pNeighborRoamInfo->neighborRoamState),
+			mac_trace_getcsr_roam_sub_state(
+				pMac->roam.curSubState[pMac->roam.
+					WaitForKeyTimerInfo.sessionId]));
 		cfg_set_int(pMac, WNI_CFG_HEART_BEAT_THRESHOLD, 0);
 	}
-#endif
 	sms_log(pMac, LOG1, " csrScanStartWaitForKeyTimer");
 	status = cdf_mc_timer_start(&pMac->roam.hTimerWaitForKey,
 				    interval / CDF_MC_TIMER_TO_MS_UNIT);
@@ -11334,7 +11259,6 @@ CDF_STATUS csr_roam_stop_wait_for_key_timer(tpAniSirGlobal pMac)
 						curSubState[pMac->roam.
 							    WaitForKeyTimerInfo.
 							    sessionId]));
-#ifdef FEATURE_WLAN_LFR
 	if (csr_neighbor_roam_is_handoff_in_progress(pMac,
 						     pMac->roam.WaitForKeyTimerInfo.
 						     sessionId)) {
@@ -11348,7 +11272,6 @@ CDF_STATUS csr_roam_stop_wait_for_key_timer(tpAniSirGlobal pMac)
 		cfg_set_int(pMac, WNI_CFG_HEART_BEAT_THRESHOLD,
 				pMac->roam.configParam.HeartbeatThresh24);
 	}
-#endif
 	return cdf_mc_timer_stop(&pMac->roam.hTimerWaitForKey);
 }
 
@@ -11461,20 +11384,19 @@ CDF_STATUS csr_roam_lost_link(tpAniSirGlobal pMac, uint32_t sessionId,
 	roamInfo.reasonCode = pSession->joinFailStatusCode.reasonCode;
 	if (eWNI_SME_DISASSOC_IND == type) {
 		/* staMacAddr */
-		cdf_mem_copy(roamInfo.peerMac.bytes,
-				pDisassocIndMsg->peerMacAddr,
-				sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&roamInfo.peerMac,
+				 &pDisassocIndMsg->peer_macaddr);
 		roamInfo.staId = (uint8_t) pDisassocIndMsg->staId;
 		roamInfo.reasonCode = pDisassocIndMsg->reasonCode;
 	} else if (eWNI_SME_DEAUTH_IND == type) {
 		/* staMacAddr */
-		cdf_mem_copy(roamInfo.peerMac.bytes,
-				pDeauthIndMsg->peerMacAddr,
-				sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&roamInfo.peerMac,
+				 &pDeauthIndMsg->peer_macaddr);
 		roamInfo.staId = (uint8_t) pDeauthIndMsg->staId;
 		roamInfo.reasonCode = pDeauthIndMsg->reasonCode;
+		roamInfo.rxRssi = pDeauthIndMsg->rssi;
 	}
-	sms_log(pMac, LOGW, FL("roamInfo.staId (%d)"), roamInfo.staId);
+	sms_log(pMac, LOGW, FL("roamInfo.staId: %d"), roamInfo.staId);
 
 	/* See if we can possibly roam.  If so, start the roaming process and notify HDD
 	   that we are roaming.  But if we cannot possibly roam, or if we are unable to
@@ -11668,15 +11590,6 @@ void csr_roam_process_wm_status_change_command(tpAniSirGlobal pMac,
 			pCommand->u.wmStatusChangeCmd.Type);
 		break;
 	}
-	/* For WDS, we want to stop BSS as well when it is indicated that it is disconnected. */
-	if (CSR_IS_CONN_WDS(&pSession->connectedProfile)) {
-		if (!CDF_IS_STATUS_SUCCESS
-			    (csr_roam_issue_stop_bss_cmd(pMac, pCommand->sessionId, true))) {
-			/* This is not good */
-			sms_log(pMac, LOGE,
-				FL("  failed to issue stopBSS command"));
-		}
-	}
 	/* Lost Link just triggers a roaming sequence.  We can complte the Lost Link */
 	/* command here since there is nothing else to do. */
 	csr_roam_wm_status_change_complete(pMac);
@@ -11854,7 +11767,7 @@ csr_roam_get_phy_mode_band_for_bss(tpAniSirGlobal mac_ctx,
 	 * If the global setting for dot11Mode is set to auto/abg, we overwrite
 	 * the setting in the profile.
 	 */
-	if (((!CSR_IS_INFRA_AP(profile) && !CSR_IS_WDS(profile))
+	if ((!CSR_IS_INFRA_AP(profile)
 	    && ((eCSR_CFG_DOT11_MODE_AUTO == curr_mode)
 	    || (eCSR_CFG_DOT11_MODE_ABG == curr_mode)))
 	    || (eCSR_CFG_DOT11_MODE_AUTO == cfg_dot11_mode)
@@ -11950,11 +11863,11 @@ CDF_STATUS csr_get_cfg_valid_channels(tpAniSirGlobal pMac, uint8_t *pChannels,
 	return CDF_STATUS_SUCCESS;
 }
 
-tPowerdBm csr_get_cfg_max_tx_power(tpAniSirGlobal pMac, uint8_t channel)
+int8_t csr_get_cfg_max_tx_power(tpAniSirGlobal pMac, uint8_t channel)
 {
 	uint32_t cfgLength = 0;
 	uint16_t cfgId = 0;
-	tPowerdBm maxTxPwr = 0;
+	int8_t maxTxPwr = 0;
 	uint8_t *pCountryInfo = NULL;
 	CDF_STATUS status;
 	uint8_t count = 0;
@@ -12077,12 +11990,13 @@ static ePhyChanBondState csr_get_cb_mode_from_ies(tpAniSirGlobal pMac,
 	if ((pIes->RSN.present && (pIes->RSN.pwise_cipher_suite_count == 1) &&
 		!memcmp(&(pIes->RSN.pwise_cipher_suites[0][0]),
 					"\x00\x0f\xac\x02", 4))
-		/* In Case WPA1 and TKIP is the only one cipher suite
-		 * in Unicast.
+		/* In Case only WPA1 is supported and TKIP is
+		 * the only one cipher suite in Unicast.
 		 */
-		|| (pIes->WPA.present && (pIes->WPA.unicast_cipher_count == 1)
-			&& !memcmp(&(pIes->WPA.unicast_ciphers[0][0]),
-					"\x00\x50\xf2\x02", 4))) {
+		|| (!pIes->RSN.present && (pIes->WPA.present &&
+			(pIes->WPA.unicast_cipher_count == 1) &&
+			!memcmp(&(pIes->WPA.unicast_ciphers[0][0]),
+					"\x00\x50\xf2\x02", 4)))) {
 		sms_log(pMac, LOGW,
 			" No channel bonding in TKIP mode ");
 		return PHY_SINGLE_CHANNEL_CENTERED;
@@ -12642,8 +12556,8 @@ CDF_STATUS csr_roam_issue_start_bss(tpAniSirGlobal pMac, uint32_t sessionId,
 			if (pBssDesc) {
 				pIbssLog->eventId =
 					WLAN_IBSS_EVENT_JOIN_IBSS_REQ;
-				cdf_mem_copy(pIbssLog->bssid, pBssDesc->bssId,
-					     6);
+				cdf_mem_copy(pIbssLog->bssid.bytes,
+					pBssDesc->bssId, CDF_MAC_ADDR_SIZE);
 			} else {
 				pIbssLog->eventId =
 					WLAN_IBSS_EVENT_START_IBSS_REQ;
@@ -12741,37 +12655,21 @@ static void csr_roam_prepare_bss_params(tpAniSirGlobal pMac, uint32_t sessionId,
 	if (pBssDesc) {
 		csr_roam_get_bss_start_parms_from_bss_desc(pMac, pBssDesc, pIes,
 							   &pSession->bssParams);
-		/* Since csr_roam_get_bss_start_parms_from_bss_desc fills in the bssid for pSession->bssParams */
-		/* The following code has to be do after that. */
-		/* For WDS station, use selfMac as the self BSSID */
-		if (CSR_IS_WDS_STA(pProfile)) {
-			cdf_mem_copy(&pSession->bssParams.bssid,
-				     &pSession->selfMacAddr,
-				     sizeof(struct cdf_mac_addr));
-		}
 	} else {
 		csr_roam_get_bss_start_parms(pMac, pProfile, &pSession->bssParams);
 		/* Use the first SSID */
-		if (pProfile->SSIDs.numOfSSIDs) {
+		if (pProfile->SSIDs.numOfSSIDs)
 			cdf_mem_copy(&pSession->bssParams.ssId,
 				     pProfile->SSIDs.SSIDList,
 				     sizeof(tSirMacSSid));
-		}
-		/* For WDS station, use selfMac as the self BSSID */
-		if (CSR_IS_WDS_STA(pProfile)) {
-			cdf_mem_copy(&pSession->bssParams.bssid,
-				     &pSession->selfMacAddr,
-				     sizeof(struct cdf_mac_addr));
-		}
-		/* Use the first BSSID */
-		else if (pProfile->BSSIDs.numOfBSSIDs) {
+		if (pProfile->BSSIDs.numOfBSSIDs)
+			/* Use the first BSSID */
 			cdf_mem_copy(&pSession->bssParams.bssid,
 				     pProfile->BSSIDs.bssid,
 				     sizeof(struct cdf_mac_addr));
-		} else {
+		else
 			cdf_mem_set(&pSession->bssParams.bssid,
 				    sizeof(struct cdf_mac_addr), 0);
-		}
 	}
 	Channel = pSession->bssParams.operationChn;
 	/* Set operating channel in pProfile which will be used */
@@ -13728,16 +13626,6 @@ CDF_STATUS csr_send_join_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
 				cdf_mem_copy((void *)(wpaRsnIE),
 						pSession->suppCckmIeInfo.cckmIe,
 						ieLen);
-#else
-				ieLen = csrConstructEseCckmIe(pMac,
-						pSession,
-						pProfile,
-						pBssDescription,
-						pSession->
-						pWpaRsnReqIE,
-						pSession->
-						nWpaRsnReqIeLength,
-						(void *)(wpaRsnIE));
 #endif /* FEATURE_WLAN_ESE_UPLOAD */
 			} else
 				ieLen = 0;
@@ -13933,23 +13821,16 @@ CDF_STATUS csr_send_join_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
 			}
 		}
 #endif /* FEATURE_WLAN_ESE */
-#if defined WLAN_FEATURE_VOWIFI_11R || defined FEATURE_WLAN_ESE || defined(FEATURE_WLAN_LFR)
 		if (ese_config
-#ifdef FEATURE_WLAN_LFR
-		    || csr_roam_is_fast_roam_enabled(pMac, sessionId)
-#endif
-		    ) {
+		    || csr_roam_is_fast_roam_enabled(pMac, sessionId)) {
 			csr_join_req->isFastTransitionEnabled = true;
 		} else {
 			csr_join_req->isFastTransitionEnabled = false;
 		}
-#endif
-#ifdef FEATURE_WLAN_LFR
 		if (csr_roam_is_fast_roam_enabled(pMac, sessionId))
 			csr_join_req->isFastRoamIniFeatureEnabled = true;
 		else
 			csr_join_req->isFastRoamIniFeatureEnabled = false;
-#endif
 
 		csr_join_req->txLdpcIniFeatureEnabled =
 			(uint8_t) pMac->roam.configParam.txLdpcEnable;
@@ -14165,21 +14046,18 @@ CDF_STATUS csr_send_mb_disassoc_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
 	pMsg->sessionId = sessionId;
 	pMsg->transactionId = 0;
 	if ((pSession->pCurRoamProfile != NULL)
-		&& ((CSR_IS_INFRA_AP(pSession->pCurRoamProfile))
-		|| (CSR_IS_WDS_AP(pSession->pCurRoamProfile)))) {
-		cdf_mem_copy(&pMsg->bssId,
+		&& (CSR_IS_INFRA_AP(pSession->pCurRoamProfile))) {
+		cdf_mem_copy(&pMsg->bssid.bytes,
 			     &pSession->selfMacAddr,
-			     sizeof(tSirMacAddr));
-		cdf_mem_copy(&pMsg->peerMacAddr,
+			     CDF_MAC_ADDR_SIZE);
+		cdf_mem_copy(&pMsg->peer_macaddr.bytes,
 			     bssId,
-			     sizeof(tSirMacAddr));
+			     CDF_MAC_ADDR_SIZE);
 	} else {
-		cdf_mem_copy(&pMsg->bssId,
-			     bssId,
-			     sizeof(tSirMacAddr));
-		cdf_mem_copy(&pMsg->peerMacAddr,
-			     bssId,
-			     sizeof(tSirMacAddr));
+		cdf_mem_copy(&pMsg->bssid.bytes,
+			     bssId, CDF_MAC_ADDR_SIZE);
+		cdf_mem_copy(&pMsg->peer_macaddr.bytes,
+			     bssId, CDF_MAC_ADDR_SIZE);
 	}
 	pMsg->reasonCode = reasonCode;
 	/*
@@ -14200,41 +14078,37 @@ CDF_STATUS csr_send_mb_disassoc_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
 
 CDF_STATUS
 csr_send_mb_get_associated_stas_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
-					CDF_MODULE_ID modId, tSirMacAddr bssId,
-					void *pUsrContext, void *pfnSapEventCallback,
+					CDF_MODULE_ID modId,
+					struct cdf_mac_addr bssid,
+					void *pUsrContext,
+					void *pfnSapEventCallback,
 					uint8_t *pAssocStasBuf)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	tSirSmeGetAssocSTAsReq *pMsg;
-	do {
-		pMsg = cdf_mem_malloc(sizeof(tSirSmeGetAssocSTAsReq));
-		if (NULL == pMsg)
-			status = CDF_STATUS_E_NOMEM;
-		else
-			status = CDF_STATUS_SUCCESS;
-		if (!CDF_IS_STATUS_SUCCESS(status))
-			break;
-		cdf_mem_set(pMsg, sizeof(tSirSmeGetAssocSTAsReq), 0);
-		pMsg->messageType = eWNI_SME_GET_ASSOC_STAS_REQ;
-		cdf_mem_copy(pMsg->bssId, bssId, sizeof(tSirMacAddr));
-		pMsg->modId = modId;
-		cdf_mem_copy(pMsg->pUsrContext,
-				pUsrContext, sizeof(void *));
-		cdf_mem_copy(pMsg->pSapEventCallback,
-				pfnSapEventCallback, sizeof(void *));
-		cdf_mem_copy(pMsg->pAssocStasArray,
-				pAssocStasBuf, sizeof(void *));
-		pMsg->length = sizeof(struct sSirSmeGetAssocSTAsReq);
-		status = cds_send_mb_message_to_mac(pMsg);
-	} while (0);
+
+	pMsg = cdf_mem_malloc(sizeof(*pMsg));
+	if (NULL == pMsg)
+		return CDF_STATUS_E_NOMEM;
+
+	pMsg->messageType = eWNI_SME_GET_ASSOC_STAS_REQ;
+	cdf_copy_macaddr(&pMsg->bssid, &bssid);
+	pMsg->modId = modId;
+	cdf_mem_copy(pMsg->pUsrContext, pUsrContext, sizeof(void *));
+	cdf_mem_copy(pMsg->pSapEventCallback,
+			pfnSapEventCallback, sizeof(void *));
+	cdf_mem_copy(pMsg->pAssocStasArray, pAssocStasBuf, sizeof(void *));
+	pMsg->length = sizeof(*pMsg);
+	status = cds_send_mb_message_to_mac(pMsg);
+
 	return status;
 }
 
 CDF_STATUS
 csr_send_mb_get_wpspbc_sessions(tpAniSirGlobal pMac, uint32_t sessionId,
-				tSirMacAddr bssId, void *pUsrContext,
+				struct cdf_mac_addr bssid, void *pUsrContext,
 				void *pfnSapEventCallback,
-				struct cdf_mac_addr pRemoveMac)
+				struct cdf_mac_addr remove_mac)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	tSirSmeGetWPSPBCSessionsReq *pMsg;
@@ -14252,9 +14126,8 @@ csr_send_mb_get_wpspbc_sessions(tpAniSirGlobal pMac, uint32_t sessionId,
 		cdf_mem_copy(pMsg->pUsrContext, pUsrContext, sizeof(void *));
 		cdf_mem_copy(pMsg->pSapEventCallback, pfnSapEventCallback,
 			     sizeof(void *));
-		cdf_mem_copy(pMsg->bssId, bssId, sizeof(tSirMacAddr));
-		cdf_mem_copy(pMsg->pRemoveMac, pRemoveMac.bytes,
-			     CDF_MAC_ADDR_SIZE);
+		cdf_copy_macaddr(&pMsg->bssid, &bssid);
+		cdf_copy_macaddr(&pMsg->remove_mac, &remove_mac);
 		pMsg->length = sizeof(struct sSirSmeGetWPSPBCSessionsReq);
 		status = cds_send_mb_message_to_mac(pMsg);
 	} while (0);
@@ -14291,12 +14164,10 @@ CDF_STATUS csr_send_chng_mcc_beacon_interval(tpAniSirGlobal pMac, uint32_t sessi
 		pMsg->messageType = eWNI_SME_CHNG_MCC_BEACON_INTERVAL;
 		pMsg->length = len;
 
-		/* bssId */
-		cdf_mem_copy((tSirMacAddr *) pMsg->bssId,
-			     &pSession->selfMacAddr, sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&pMsg->bssid, &pSession->selfMacAddr);
 		sms_log(pMac, LOG1,
 			FL("CSR Attempting to change BI for Bssid= "
-			   MAC_ADDRESS_STR), MAC_ADDR_ARRAY(pMsg->bssId));
+			   MAC_ADDRESS_STR), MAC_ADDR_ARRAY(pMsg->bssid.bytes));
 		pMsg->sessionId = sessionId;
 		sms_log(pMac, LOG1, FL("  session %d BeaconInterval %d"),
 			sessionId,
@@ -14335,12 +14206,10 @@ CDF_STATUS csr_set_ht2040_mode(tpAniSirGlobal pMac, uint32_t sessionId,
 		pMsg->messageType = eWNI_SME_SET_HT_2040_MODE;
 		pMsg->length = len;
 
-		/* bssId */
-		cdf_mem_copy((tSirMacAddr *) pMsg->bssId,
-			     &pSession->selfMacAddr, sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&pMsg->bssid, &pSession->selfMacAddr);
 		sms_log(pMac, LOG1,
 			FL("CSR Attempting to set HT20/40 mode for Bssid= "
-			   MAC_ADDRESS_STR), MAC_ADDR_ARRAY(pMsg->bssId));
+			   MAC_ADDRESS_STR), MAC_ADDR_ARRAY(pMsg->bssid.bytes));
 		pMsg->sessionId = sessionId;
 		sms_log(pMac, LOG1, FL("  session %d HT20/40 mode %d"),
 			sessionId, cbMode);
@@ -14372,21 +14241,17 @@ CDF_STATUS csr_send_mb_deauth_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
 	pMsg->transactionId = 0;
 
 	if ((pSession->pCurRoamProfile != NULL)
-	     && ((CSR_IS_INFRA_AP(pSession->pCurRoamProfile))
-	     || (CSR_IS_WDS_AP(pSession->pCurRoamProfile)))) {
-		cdf_mem_copy(&pMsg->bssId,
+	     && (CSR_IS_INFRA_AP(pSession->pCurRoamProfile))) {
+		cdf_mem_copy(&pMsg->bssid,
 			     &pSession->selfMacAddr,
-			     sizeof(tSirMacAddr));
+			     CDF_MAC_ADDR_SIZE);
 	} else {
-		cdf_mem_copy(&pMsg->bssId,
-			     bssId,
-			     sizeof(tSirMacAddr));
+		cdf_mem_copy(&pMsg->bssid,
+			     bssId, CDF_MAC_ADDR_SIZE);
 	}
 
 	/* Set the peer MAC address before sending the message to LIM */
-	cdf_mem_copy(&pMsg->peerMacAddr,
-		     bssId,
-		     sizeof(tSirMacAddr));
+	cdf_mem_copy(&pMsg->peer_macaddr.bytes, bssId, CDF_MAC_ADDR_SIZE);
 	pMsg->reasonCode = reasonCode;
 
 	return cds_send_mb_message_to_mac(pMsg);
@@ -14409,16 +14274,15 @@ CDF_STATUS csr_send_mb_disassoc_cnf_msg(tpAniSirGlobal pMac,
 		pMsg->messageType = eWNI_SME_DISASSOC_CNF;
 		pMsg->statusCode = eSIR_SME_SUCCESS;
 		pMsg->length = sizeof(tSirSmeDisassocCnf);
-		cdf_mem_copy(pMsg->peerMacAddr, pDisassocInd->peerMacAddr,
-			     sizeof(pMsg->peerMacAddr));
+		cdf_copy_macaddr(&pMsg->peer_macaddr,
+				 &pDisassocInd->peer_macaddr);
 		status = CDF_STATUS_SUCCESS;
 		if (!CDF_IS_STATUS_SUCCESS(status)) {
 			cdf_mem_free(pMsg);
 			break;
 		}
 
-		cdf_mem_copy(pMsg->bssId, pDisassocInd->bssId,
-			     sizeof(pMsg->peerMacAddr));
+		cdf_copy_macaddr(&pMsg->bssid, &pDisassocInd->bssid);
 		status = CDF_STATUS_SUCCESS;
 		if (!CDF_IS_STATUS_SUCCESS(status)) {
 			cdf_mem_free(pMsg);
@@ -14447,15 +14311,14 @@ CDF_STATUS csr_send_mb_deauth_cnf_msg(tpAniSirGlobal pMac,
 		pMsg->messageType = eWNI_SME_DEAUTH_CNF;
 		pMsg->statusCode = eSIR_SME_SUCCESS;
 		pMsg->length = sizeof(tSirSmeDeauthCnf);
-		cdf_mem_copy(pMsg->bssId, pDeauthInd->bssId,
-			     sizeof(pMsg->bssId));
+		cdf_copy_macaddr(&pMsg->bssid, &pDeauthInd->bssid);
 		status = CDF_STATUS_SUCCESS;
 		if (!CDF_IS_STATUS_SUCCESS(status)) {
 			cdf_mem_free(pMsg);
 			break;
 		}
-		cdf_mem_copy(pMsg->peerMacAddr, pDeauthInd->peerMacAddr,
-			     sizeof(pMsg->peerMacAddr));
+		cdf_copy_macaddr(&pMsg->peer_macaddr,
+				 &pDeauthInd->peer_macaddr);
 		status = CDF_STATUS_SUCCESS;
 		if (!CDF_IS_STATUS_SUCCESS(status)) {
 			cdf_mem_free(pMsg);
@@ -14487,16 +14350,16 @@ CDF_STATUS csr_send_assoc_cnf_msg(tpAniSirGlobal pMac, tpSirSmeAssocInd pAssocIn
 		else
 			pMsg->statusCode = eSIR_SME_ASSOC_REFUSED;
 		/* bssId */
-		cdf_mem_copy(pMsg->bssId, pAssocInd->bssId,
-			     sizeof(tSirMacAddr));
+		cdf_mem_copy(pMsg->bssid.bytes, pAssocInd->bssId,
+			     CDF_MAC_ADDR_SIZE);
 		/* peerMacAddr */
-		cdf_mem_copy(pMsg->peerMacAddr, pAssocInd->peerMacAddr,
-			     sizeof(tSirMacAddr));
+		cdf_mem_copy(pMsg->peer_macaddr.bytes, pAssocInd->peerMacAddr,
+			     CDF_MAC_ADDR_SIZE);
 		/* aid */
 		pMsg->aid = pAssocInd->aid;
 		/* alternateBssId */
-		cdf_mem_copy(pMsg->alternateBssId, pAssocInd->bssId,
-			     sizeof(tSirMacAddr));
+		cdf_mem_copy(pMsg->alternate_bssid.bytes, pAssocInd->bssId,
+			     CDF_MAC_ADDR_SIZE);
 		/* alternateChannelId */
 		pMsg->alternateChannelId = 11;
 		/* pMsg is freed by cds_send_mb_message_to_mac in anycase*/
@@ -14586,8 +14449,10 @@ CDF_STATUS csr_send_assoc_ind_to_upper_layer_cnf_msg(tpAniSirGlobal pMac,
 	return CDF_STATUS_SUCCESS;
 }
 
-CDF_STATUS csr_send_mb_set_context_req_msg(tpAniSirGlobal pMac, uint32_t sessionId,
-					   tSirMacAddr peerMacAddr, uint8_t numKeys,
+CDF_STATUS csr_send_mb_set_context_req_msg(tpAniSirGlobal pMac,
+					   uint32_t sessionId,
+					   struct cdf_mac_addr peer_macaddr,
+					   uint8_t numKeys,
 					   tAniEdType edType, bool fUnicast,
 					   tAniKeyDirection aniKeyDirection,
 					   uint8_t keyId, uint8_t keyLength,
@@ -14618,11 +14483,9 @@ CDF_STATUS csr_send_mb_set_context_req_msg(tpAniSirGlobal pMac, uint32_t session
 		pMsg->length = msgLen;
 		pMsg->sessionId = (uint8_t) sessionId;
 		pMsg->transactionId = 0;
-		cdf_mem_copy(pMsg->peerMacAddr, peerMacAddr,
-			     sizeof(tSirMacAddr));
-		cdf_mem_copy(pMsg->bssId,
-			     pSession->connectedProfile.bssid.bytes,
-			     sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&pMsg->peer_macaddr, &peer_macaddr);
+		cdf_copy_macaddr(&pMsg->bssid,
+				 &pSession->connectedProfile.bssid);
 
 		/**
 		 * Set the pMsg->keyMaterial.length field
@@ -14741,6 +14604,10 @@ CDF_STATUS csr_send_mb_start_bss_req_msg(tpAniSirGlobal pMac, uint32_t sessionId
 	pMsg->isCoalesingInIBSSAllowed = pMac->isCoalesingInIBSSAllowed;
 	pMsg->bssPersona = pParam->bssPersona;
 	pMsg->txLdpcIniFeatureEnabled = pMac->roam.configParam.txLdpcEnable;
+	pMsg->txbf_ini_enabled =
+		(uint8_t)pMac->roam.configParam.txBFEnable &&
+		(uint8_t)pMac->roam.configParam.enable_txbf_sap_mode;
+	pMsg->txbf_csn_val = (uint8_t)pMac->roam.configParam.txBFCsnValue;
 #ifdef WLAN_FEATURE_11W
 	pMsg->pmfCapable = pParam->mfpCapable;
 	pMsg->pmfRequired = pParam->mfpRequired;
@@ -14792,18 +14659,7 @@ CDF_STATUS csr_send_mb_stop_bss_req_msg(tpAniSirGlobal pMac, uint32_t sessionId)
 	pMsg->length = sizeof(tSirSmeStopBssReq);
 	pMsg->transactionId = 0;
 	pMsg->reasonCode = 0;
-	/*
-	 * if BSSType is WDS sta, use selfmacAddr as bssid,
-	 * else use bssid in connectedProfile
-	 */
-	if (CSR_IS_CONN_WDS_STA(&pSession->connectedProfile))
-		cdf_mem_copy(&pMsg->bssId,
-			     &pSession->selfMacAddr.bytes,
-			     sizeof(tSirMacAddr));
-	else
-		cdf_mem_copy(&pMsg->bssId,
-			     &pSession->connectedProfile.bssid.bytes,
-			     sizeof(tSirMacAddr));
+	cdf_copy_macaddr(&pMsg->bssid, &pSession->connectedProfile.bssid);
 	return cds_send_mb_message_to_mac(pMsg);
 }
 
@@ -15233,7 +15089,7 @@ void csr_cleanup_session(tpAniSirGlobal pMac, uint32_t sessionId)
 		sme_ft_close(pMac, sessionId);
 #endif
 		csr_free_connect_bss_desc(pMac, sessionId);
-		csr_roam_free_connect_profile(pMac, &pSession->connectedProfile);
+		csr_roam_free_connect_profile(&pSession->connectedProfile);
 		csr_roam_free_connected_info(pMac, &pSession->connectedInfo);
 		cdf_mc_timer_destroy(&pSession->hTimerRoaming);
 #ifdef FEATURE_WLAN_BTAMP_UT_RF
@@ -15293,7 +15149,7 @@ static void csr_init_session(tpAniSirGlobal pMac, uint32_t sessionId)
 	pSession->pContext = NULL;
 	pSession->connectState = eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED;
 	csr_free_roam_profile(pMac, sessionId);
-	csr_roam_free_connect_profile(pMac, &pSession->connectedProfile);
+	csr_roam_free_connect_profile(&pSession->connectedProfile);
 	csr_roam_free_connected_info(pMac, &pSession->connectedInfo);
 	csr_free_connect_bss_desc(pMac, sessionId);
 	csr_scan_enable(pMac);
@@ -15377,32 +15233,32 @@ static uint32_t csr_find_ibss_session(tpAniSirGlobal pMac)
 
 static void csr_roam_link_up(tpAniSirGlobal pMac, struct cdf_mac_addr bssid)
 {
-	/* Update the current BSS info in ho control block based on connected
-	   profile info from pmac global structure                              */
+	uint32_t sessionId = 0;
+
+	/*
+	 * Update the current BSS info in ho control block based on connected
+	 * profile info from pmac global structure
+	 */
 
 	sms_log(pMac, LOGW,
 		" csr_roam_link_up: WLAN link UP with AP= " MAC_ADDRESS_STR,
 		MAC_ADDR_ARRAY(bssid.bytes));
-	/* Check for user misconfig of RSSI trigger threshold                  */
+	/* Check for user misconfig of RSSI trigger threshold */
 	pMac->roam.configParam.vccRssiThreshold =
 		(0 == pMac->roam.configParam.vccRssiThreshold) ?
-		CSR_VCC_RSSI_THRESHOLD : pMac->roam.configParam.vccRssiThreshold;
+		CSR_VCC_RSSI_THRESHOLD :
+		pMac->roam.configParam.vccRssiThreshold;
 	pMac->roam.vccLinkQuality = eCSR_ROAM_LINK_QUAL_POOR_IND;
-	/* Check for user misconfig of UL MAC Loss trigger threshold           */
+	/* Check for user misconfig of UL MAC Loss trigger threshold */
 	pMac->roam.configParam.vccUlMacLossThreshold =
 		(0 == pMac->roam.configParam.vccUlMacLossThreshold) ?
 		CSR_VCC_UL_MAC_LOSS_THRESHOLD : pMac->roam.configParam.
 		vccUlMacLossThreshold;
-#if   defined WLAN_FEATURE_NEIGHBOR_ROAMING
-	{
-		uint32_t sessionId = 0;
-		/* Indicate the neighbor roal algorithm about the connect indication */
-		csr_roam_get_session_id_from_bssid(pMac, &bssid,
-						   &sessionId);
-		csr_neighbor_roam_indicate_connect(pMac, sessionId,
-						   CDF_STATUS_SUCCESS);
-	}
-#endif
+	/* Indicate the neighbor roal algorithm about the connect indication */
+	csr_roam_get_session_id_from_bssid(pMac, &bssid,
+					   &sessionId);
+	csr_neighbor_roam_indicate_connect(pMac, sessionId,
+					   CDF_STATUS_SUCCESS);
 }
 
 static void csr_roam_link_down(tpAniSirGlobal pMac, uint32_t sessionId)
@@ -15436,10 +15292,8 @@ static void csr_roam_link_down(tpAniSirGlobal pMac, uint32_t sessionId)
 	/* deregister the clients requesting stats from PE/TL & also stop the corresponding timers */
 	csr_roam_dereg_statistics_req(pMac);
 	pMac->roam.vccLinkQuality = eCSR_ROAM_LINK_QUAL_POOR_IND;
-#if   defined WLAN_FEATURE_NEIGHBOR_ROAMING
 	/* Indicate the neighbor roal algorithm about the disconnect indication */
 	csr_neighbor_roam_indicate_disconnect(pMac, sessionId);
-#endif
 
 	/* Remove this code once SLM_Sessionization is supported */
 	/* BMPS_WORKAROUND_NOT_NEEDED */
@@ -17117,7 +16971,7 @@ csr_roam_offload_scan(tpAniSirGlobal mac_ctx, uint8_t session_id,
 		return CDF_STATUS_E_FAILURE;
 	}
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	if (session->roamOffloadSynchParams.bRoamSynchInProgress
+	if (session->roam_synch_in_progress
 	    && (ROAM_SCAN_OFFLOAD_STOP == command)) {
 		/*
 		 * When roam synch is in progress for propagation, there is no
@@ -17221,7 +17075,7 @@ csr_roam_offload_scan(tpAniSirGlobal mac_ctx, uint8_t session_id,
 	for (i = 0; i < roam_params_dst->num_bssid_avoid_list; i++) {
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
 			"Blacklist Bssid: ("MAC_ADDRESS_STR")",
-			MAC_ADDR_ARRAY(roam_params_dst->bssid_avoid_list[i]));
+			MAC_ADDR_ARRAY(roam_params_dst->bssid_avoid_list[i].bytes));
 	}
 	for (i = 0; i < roam_params_dst->num_ssid_allowed_list; i++) {
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
@@ -17232,7 +17086,7 @@ csr_roam_offload_scan(tpAniSirGlobal mac_ctx, uint8_t session_id,
 	for (i = 0; i < roam_params_dst->num_bssid_favored; i++) {
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
 			"Preferred Bssid: ("MAC_ADDRESS_STR") score: %d",
-			MAC_ADDR_ARRAY(roam_params_dst->bssid_favored[i]),
+			MAC_ADDR_ARRAY(roam_params_dst->bssid_favored[i].bytes),
 			roam_params_dst->bssid_favored_factor[i]);
 	}
 
@@ -17748,26 +17602,23 @@ CDF_STATUS csr_roam_update_apwpsie(tpAniSirGlobal pMac, uint32_t sessionId,
 	tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
 	if (NULL == pSession) {
 		sms_log(pMac, LOGE,
-			FL("  Session does not exist for session id %d"),
+			FL("Session does not exist for session id %d"),
 			sessionId);
 		return CDF_STATUS_E_FAILURE;
 	}
 
-	do {
-		pMsg = cdf_mem_malloc(sizeof(tSirUpdateAPWPSIEsReq));
-		if (NULL == pMsg)
-			return CDF_STATUS_E_NOMEM;
-		cdf_mem_set(pMsg, sizeof(tSirUpdateAPWPSIEsReq), 0);
-		pMsg->messageType = eWNI_SME_UPDATE_APWPSIE_REQ;
-		pMsg->transactionId = 0;
-		cdf_mem_copy(pMsg->bssId, &pSession->selfMacAddr,
-				sizeof(tSirMacAddr));
-		pMsg->sessionId = sessionId;
-		cdf_mem_copy(&pMsg->APWPSIEs, pAPWPSIES,
-				sizeof(tSirAPWPSIEs));
-		pMsg->length = sizeof(struct sSirUpdateAPWPSIEsReq);
-		status = cds_send_mb_message_to_mac(pMsg);
-	} while (0);
+	pMsg = cdf_mem_malloc(sizeof(*pMsg));
+	if (NULL == pMsg)
+		return CDF_STATUS_E_NOMEM;
+
+	pMsg->messageType = eWNI_SME_UPDATE_APWPSIE_REQ;
+	pMsg->transactionId = 0;
+	cdf_copy_macaddr(&pMsg->bssid, &pSession->selfMacAddr);
+	pMsg->sessionId = sessionId;
+	cdf_mem_copy(&pMsg->APWPSIEs, pAPWPSIES, sizeof(tSirAPWPSIEs));
+	pMsg->length = sizeof(*pMsg);
+	status = cds_send_mb_message_to_mac(pMsg);
+
 	return status;
 }
 
@@ -17790,8 +17641,7 @@ CDF_STATUS csr_roam_update_wparsni_es(tpAniSirGlobal pMac, uint32_t sessionId,
 		cdf_mem_set(pMsg, sizeof(tSirUpdateAPWPARSNIEsReq), 0);
 		pMsg->messageType = eWNI_SME_SET_APWPARSNIEs_REQ;
 		pMsg->transactionId = 0;
-		cdf_mem_copy(pMsg->bssId, &pSession->selfMacAddr,
-				sizeof(tSirMacAddr));
+		cdf_copy_macaddr(&pMsg->bssid, &pSession->selfMacAddr);
 		pMsg->sessionId = sessionId;
 		cdf_mem_copy(&pMsg->APWPARSNIEs, pAPSirRSNie,
 			     sizeof(tSirRSNie));
@@ -17880,9 +17730,7 @@ void csr_roam_ft_pre_auth_rsp_processor(tHalHandle hHal,
 {
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
-#if defined(FEATURE_WLAN_LFR) || defined(FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_ESE_UPLOAD)
 	tCsrRoamInfo roamInfo;
-#endif
 	eCsrAuthType conn_Auth_type;
 	uint32_t sessionId = pFTPreAuthRsp->smeSessionId;
 	tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
@@ -17891,10 +17739,9 @@ void csr_roam_ft_pre_auth_rsp_processor(tHalHandle hHal,
 		sms_log(pMac, LOGE, FL("pSession is NULL"));
 		return;
 	}
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
-	status =
-		csr_neighbor_roam_preauth_rsp_handler(pMac, pFTPreAuthRsp->smeSessionId,
-						      pFTPreAuthRsp->status);
+	status = csr_neighbor_roam_preauth_rsp_handler(pMac,
+				pFTPreAuthRsp->smeSessionId,
+				pFTPreAuthRsp->status);
 	if (status != CDF_STATUS_SUCCESS) {
 		/*
 		 * Bail out if pre-auth was not even processed.
@@ -17904,7 +17751,6 @@ void csr_roam_ft_pre_auth_rsp_processor(tHalHandle hHal,
 			status, sessionId);
 		return;
 	}
-#endif
 
 	/* The below function calls/timers should be invoked only if the pre-auth is successful */
 	if (CDF_STATUS_SUCCESS != (CDF_STATUS) pFTPreAuthRsp->status)
@@ -17958,7 +17804,6 @@ void csr_roam_ft_pre_auth_rsp_processor(tHalHandle hHal,
 	}
 #endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 
-#ifdef FEATURE_WLAN_LFR
 	/* If Legacy Fast Roaming is enabled, signal the supplicant */
 	/* So he can send us a PMK-ID for this candidate AP. */
 	if (csr_roam_is_fast_roam_enabled(pMac, pFTPreAuthRsp->smeSessionId)) {
@@ -17969,7 +17814,6 @@ void csr_roam_ft_pre_auth_rsp_processor(tHalHandle hHal,
 		csr_roam_call_callback(pMac, pFTPreAuthRsp->smeSessionId,
 				       &roamInfo, 0, eCSR_ROAM_PMK_NOTIFY, 0);
 	}
-#endif
 
 	/* If its an Open Auth, FT IEs are not provided by supplicant */
 	/* Hence populate them here */
@@ -18037,7 +17881,7 @@ static void csr_ser_des_unpack_diassoc_rsp(uint8_t *pBuf, tSirSmeDisassocRsp *pR
 		pBuf += 2;
 		cdf_get_u32(pBuf, (uint32_t *) &pRsp->statusCode);
 		pBuf += 4;
-		cdf_mem_copy(pRsp->peerMacAddr, pBuf, 6);
+		cdf_mem_copy(pRsp->peer_macaddr.bytes, pBuf, CDF_MAC_ADDR_SIZE);
 	}
 }
 
@@ -18166,14 +18010,21 @@ CDF_STATUS csr_roam_read_tsf(tpAniSirGlobal pMac, uint8_t *pTimestamp,
 }
 #endif /*FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 
-/*
- * Post Channel Change Request to LIM
+/**
+ * csr_roam_channel_change_req() - Post channel change request to LIM
+ * @pMac: mac context
+ * @bssid: SAP bssid
+ * @ch_params: channel information
+ * @profile: CSR profile
+ *
  * This API is primarily used to post
  * Channel Change Req for SAP
+ *
+ * Return: CDF_STATUS
  */
-CDF_STATUS
-csr_roam_channel_change_req(tpAniSirGlobal pMac, struct cdf_mac_addr bssid,
-			    uint8_t cbMode, tCsrRoamProfile *profile)
+CDF_STATUS csr_roam_channel_change_req(tpAniSirGlobal pMac,
+			struct cdf_mac_addr bssid,
+			chan_params_t *ch_params, tCsrRoamProfile *profile)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	tSirChanChangeRequest *pMsg;
@@ -18190,12 +18041,12 @@ csr_roam_channel_change_req(tpAniSirGlobal pMac, struct cdf_mac_addr bssid,
 	pMsg->messageType = eWNI_SME_CHANNEL_CHANGE_REQ;
 	pMsg->messageLen = sizeof(tSirChanChangeRequest);
 	pMsg->targetChannel = profile->ChannelInfo.ChannelList[0];
-	pMsg->cbMode = cbMode;
-	pMsg->channel_width = profile->ch_params.ch_width;
+	pMsg->sec_ch_offset = ch_params->sec_ch_offset;
+	pMsg->ch_width = profile->ch_params.ch_width;
 	pMsg->dot11mode = csr_translate_to_wni_cfg_dot11_mode(pMac,
 					pMac->roam.configParam.uCfgDot11Mode);
-	pMsg->center_freq_seg_0 = pMsg->targetChannel;
-	pMsg->center_freq_seg_1 = 0;
+	pMsg->center_freq_seg_0 = ch_params->center_freq_seg0;
+	pMsg->center_freq_seg_1 = ch_params->center_freq_seg1;
 	cdf_mem_copy(pMsg->bssid, bssid.bytes, CDF_MAC_ADDR_SIZE);
 	cdf_mem_copy(&pMsg->operational_rateset,
 		&param.operationalRateSet, sizeof(pMsg->operational_rateset));
@@ -18396,7 +18247,7 @@ CDF_STATUS csr_send_ext_change_channel(tpAniSirGlobal mac_ctx, uint32_t channel,
  * @bssid:          BSSID
  * @target_channel: Channel on which to send the IE
  * @csa_ie_reqd:    Include/Exclude CSA IE.
- * @ch_bandwidth:   Channel offset
+ * @ch_params:  operating Channel related information
  *
  * This function sends request to transmit channel switch announcement
  * IE to lower layers
@@ -18406,7 +18257,7 @@ CDF_STATUS csr_send_ext_change_channel(tpAniSirGlobal mac_ctx, uint32_t channel,
 CDF_STATUS
 csr_roam_send_chan_sw_ie_request(tpAniSirGlobal mac_ctx,
 		struct cdf_mac_addr bssid, uint8_t target_channel,
-		uint8_t csa_ie_reqd, uint8_t ch_bandwidth)
+		uint8_t csa_ie_reqd, chan_params_t *ch_params)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	tSirDfsCsaIeRequest *msg;
@@ -18423,7 +18274,7 @@ csr_roam_send_chan_sw_ie_request(tpAniSirGlobal mac_ctx,
 	msg->targetChannel = target_channel;
 	msg->csaIeRequired = csa_ie_reqd;
 	cdf_mem_copy(msg->bssid, bssid.bytes, CDF_MAC_ADDR_SIZE);
-	msg->ch_bandwidth = ch_bandwidth;
+	cdf_mem_copy(&msg->ch_params, ch_params, sizeof(chan_params_t));
 
 	status = cds_send_mb_message_to_mac(msg);
 
@@ -18478,91 +18329,6 @@ void csr_roaming_report_diag_event(tpAniSirGlobal mac_ctx,
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 /*----------------------------------------------------------------------------
-* fn     csr_process_roam_offload_synch_ind
-* brief  This will process the roam synch indication received from
-*        lower layers.This function also calls another API to
-*        parse the beacon IE and fill the appropriate fields
-* param  pMac - pMac global structure
-* param  pMsgBuf - Message buffer received from lower layers
-* --------------------------------------------------------------------------*/
-void csr_process_roam_offload_synch_ind(tHalHandle hHal,
-		roam_offload_synch_ind *roam_synch_ind_ptr)
-{
-	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-	tCsrRoamSession *session_ptr = NULL;
-	uint8_t session_id = roam_synch_ind_ptr->roamedVdevId;
-	session_ptr =  CSR_GET_SESSION(pMac, roam_synch_ind_ptr->roamedVdevId);
-	if (!session_ptr) {
-		sms_log(pMac, LOGE, FL("LFR3: session %d not found "),
-				roam_synch_ind_ptr->roamedVdevId);
-		goto err_synch_rsp;
-	}
-	if (!CDF_IS_STATUS_SUCCESS(csr_scan_save_roam_offload_ap_to_scan_cache(
-					pMac, roam_synch_ind_ptr))) {
-		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
-				"fail to save roam offload AP to scan cache");
-		goto err_synch_rsp;
-	}
-
-	csr_roaming_report_diag_event(pMac, roam_synch_ind_ptr,
-		eCSR_REASON_ROAM_SYNCH_IND);
-	session_ptr->roamOffloadSynchParams.rssi = roam_synch_ind_ptr->rssi;
-	session_ptr->roamOffloadSynchParams.roamReason =
-		roam_synch_ind_ptr->roamReason;
-	session_ptr->roamOffloadSynchParams.roamedVdevId =
-		roam_synch_ind_ptr->roamedVdevId;
-	cdf_mem_copy(session_ptr->roamOffloadSynchParams.bssid,
-			roam_synch_ind_ptr->bssId, sizeof(tSirMacAddr));
-	session_ptr->roamOffloadSynchParams.txMgmtPower =
-		roam_synch_ind_ptr->txMgmtPower;
-	session_ptr->roamOffloadSynchParams.authStatus =
-		roam_synch_ind_ptr->authStatus;
-	session_ptr->roamOffloadSynchParams.bRoamSynchInProgress = true;
-	/*Save the BSS descriptor for later use*/
-	session_ptr->roamOffloadSynchParams.bss_desc_ptr =
-		roam_synch_ind_ptr->bss_desc_ptr;
-	pMac->roam.reassocRespLen = roam_synch_ind_ptr->reassocRespLength;
-	pMac->roam.pReassocResp =
-		cdf_mem_malloc(pMac->roam.reassocRespLen);
-	if (NULL == pMac->roam.pReassocResp) {
-		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
-				"Memory allocation for reassoc response failed");
-		goto err_synch_rsp;
-	}
-	cdf_mem_copy(pMac->roam.pReassocResp,
-			(uint8_t *)roam_synch_ind_ptr +
-			roam_synch_ind_ptr->reassocRespOffset,
-			pMac->roam.reassocRespLen);
-
-	CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO,
-			"LFR3:%s: the reassoc resp frame data:", __func__);
-	CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO,
-			pMac->roam.pReassocResp, pMac->roam.reassocRespLen);
-
-	cdf_mem_copy(session_ptr->roamOffloadSynchParams.kck,
-			roam_synch_ind_ptr->kck, SIR_KCK_KEY_LEN);
-	cdf_mem_copy(session_ptr->roamOffloadSynchParams.kek,
-			roam_synch_ind_ptr->kek, SIR_KEK_KEY_LEN);
-	cdf_mem_copy(session_ptr->roamOffloadSynchParams.replay_ctr,
-			roam_synch_ind_ptr->replay_ctr, SIR_REPLAY_CTR_LEN);
-	if (CDF_STATUS_SUCCESS != csr_neighbor_roam_offload_update_preauth_list(
-					pMac, roam_synch_ind_ptr, session_id)) {
-		/**
-		 *Bail out if Roam Offload Synch Response was not even handled.
-		 **/
-		sms_log(pMac, LOGE, FL("Roam Offload Synch Response "
-					"was not processed"));
-		goto err_synch_rsp;
-	}
-
-	csr_neighbor_roam_request_handoff(pMac, session_id);
-
-err_synch_rsp:
-	cdf_mem_free(roam_synch_ind_ptr->bss_desc_ptr);
-	roam_synch_ind_ptr->bss_desc_ptr = NULL;
-}
-
-/*----------------------------------------------------------------------------
 * fn csr_process_ho_fail_ind
 * brief  This function will process the Hand Off Failure indication
 *        received from the firmware. It will trigger a disconnect on
@@ -18713,7 +18479,7 @@ void csr_init_operating_classes(tHalHandle hHal)
  * Return: session id for give session type.
  **/
 static uint32_t
-csr_find_session_by_type(tpAniSirGlobal mac_ctx, tCDF_CON_MODE type)
+csr_find_session_by_type(tpAniSirGlobal mac_ctx, enum tCDF_ADAPTER_MODE type)
 {
 	uint32_t i, session_id = CSR_SESSION_ID_INVALID;
 	tCsrRoamSession *session_ptr;
@@ -19175,3 +18941,277 @@ fail:
 	msg_return.bodyval = 0;
 	sys_process_mmh_msg(mac, &msg_return);
 }
+#ifdef FEATURE_WLAN_TDLS
+/**
+ * csr_roam_fill_tdls_info() - Fill TDLS information
+ * @roam_info: Roaming information buffer
+ * @join_rsp: Join response which has TDLS info
+ *
+ * Return: None
+ */
+void csr_roam_fill_tdls_info(tCsrRoamInfo *roam_info, tpSirSmeJoinRsp join_rsp)
+{
+	roam_info->tdls_prohibited = join_rsp->tdls_prohibited;
+	roam_info->tdls_chan_swit_prohibited =
+		join_rsp->tdls_chan_swit_prohibited;
+}
+#endif
+
+/**
+ * csr_roam_synch_callback() - SME level callback for roam synch propagation
+ * @mac_ctx: MAC Context
+ * @roam_synch_data: Roam synch data buffer pointer
+ * @bss_desc: BSS descriptor pointer
+ * @reason: Reason for calling the callback
+ *
+ * This callback is registered with WMA and used after roaming happens in
+ * firmware and the call to this routine completes the roam synch
+ * propagation at both CSR and HDD levels. The HDD level propagation
+ * is achieved through the already defined callback for assoc completion
+ * handler.
+ *
+ * Return: None.
+ */
+void csr_roam_synch_callback(tpAniSirGlobal mac_ctx,
+		roam_offload_synch_ind *roam_synch_data,
+		tpSirBssDescription  bss_desc, uint8_t reason)
+{
+	uint8_t session_id = roam_synch_data->roamedVdevId;
+	tCsrRoamSession *session = CSR_GET_SESSION(mac_ctx, session_id);
+	tDot11fBeaconIEs *ies_local = NULL;
+	struct ps_global_info *ps_global_info = &mac_ctx->sme.ps_global_info;
+	tCsrRoamInfo *roam_info;
+	tCsrRoamConnectedProfile *conn_profile = NULL;
+	sme_QosAssocInfo assoc_info;
+	struct cdf_mac_addr bcast_mac = CDF_MAC_ADDR_BROADCAST_INITIALIZER;
+	tpAddBssParams add_bss_params;
+	CDF_STATUS status = CDF_STATUS_SUCCESS;
+
+	status = sme_acquire_global_lock(&mac_ctx->sme);
+	if (!CDF_IS_STATUS_SUCCESS(status)) {
+		sms_log(mac_ctx, LOGE, FL("LFR3: Locking failed, bailing out"));
+		return;
+	}
+	if (!session) {
+		sms_log(mac_ctx, LOGE, FL("LFR3: Session not found"));
+		sme_release_global_lock(&mac_ctx->sme);
+		return;
+	}
+	session->roam_synch_in_progress = true;
+	if (reason == ROAMING_TX_QUEUE_DISABLE) {
+		csr_roam_call_callback(mac_ctx, session_id, NULL, 0,
+				eCSR_ROAM_FT_START, eSIR_SME_SUCCESS);
+		sme_release_global_lock(&mac_ctx->sme);
+		return;
+	}
+	session->roam_synch_data = roam_synch_data;
+	if (!CDF_IS_STATUS_SUCCESS(csr_get_parsed_bss_description_ies(mac_ctx,
+			bss_desc, &ies_local))) {
+		sms_log(mac_ctx, LOGE, FL("LFR3: fail to parse IEs"));
+		session->roam_synch_in_progress = false;
+		sme_release_global_lock(&mac_ctx->sme);
+		return;
+	}
+	conn_profile = &session->connectedProfile;
+	csr_roam_stop_network(mac_ctx, session_id,
+		session->pCurRoamProfile,
+		bss_desc,
+		ies_local);
+	ps_global_info->remain_in_power_active_till_dhcp = false;
+	session->connectState = eCSR_ASSOC_STATE_TYPE_INFRA_ASSOCIATED;
+	roam_info = cdf_mem_malloc(sizeof(tCsrRoamInfo));
+	if (NULL == roam_info) {
+		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
+			FL("LFR3: Mem Alloc failed for roam info"));
+		session->roam_synch_in_progress = false;
+		sme_release_global_lock(&mac_ctx->sme);
+		return;
+	}
+	csr_scan_save_roam_offload_ap_to_scan_cache(mac_ctx, roam_synch_data,
+			bss_desc);
+	cdf_mem_zero(roam_info, sizeof(tCsrRoamInfo));
+	roam_info->sessionId = session_id;
+	csr_roam_call_callback(mac_ctx, roam_synch_data->roamedVdevId,
+		roam_info, 0, eCSR_ROAM_TDLS_STATUS_UPDATE,
+		eCSR_ROAM_RESULT_DELETE_ALL_TDLS_PEER_IND);
+	cdf_mem_copy(&roam_info->bssid.bytes, &bss_desc->bssId,
+			sizeof(struct cdf_mac_addr));
+	csr_roam_save_connected_infomation(mac_ctx, session_id,
+			session->pCurRoamProfile,
+			bss_desc,
+			ies_local);
+	csr_roam_save_security_rsp_ie(mac_ctx, session_id,
+			session->pCurRoamProfile->negotiatedAuthType,
+			bss_desc, ies_local);
+	roam_info->isESEAssoc = conn_profile->isESEAssoc;
+	if (CSR_IS_ENC_TYPE_STATIC
+		(session->pCurRoamProfile->negotiatedUCEncryptionType) &&
+		!session->pCurRoamProfile->bWPSAssociation) {
+		if (!CDF_IS_STATUS_SUCCESS(
+			csr_roam_issue_set_context_req(mac_ctx,
+				session_id,
+				session->pCurRoamProfile->negotiatedUCEncryptionType,
+				bss_desc,
+				&(bss_desc->bssId),
+				false, true,
+				eSIR_TX_RX, 0, 0, NULL, 0))) {
+			/* NO keys. these key parameters don't matter */
+			sms_log(mac_ctx, LOGE,
+					FL("Set context for unicast fail"));
+			csr_roam_substate_change(mac_ctx,
+					eCSR_ROAM_SUBSTATE_NONE, session_id);
+		}
+		csr_roam_issue_set_context_req(mac_ctx, session_id,
+			session->pCurRoamProfile->negotiatedMCEncryptionType,
+			bss_desc,
+			&bcast_mac.bytes, false, false,
+			eSIR_TX_RX, 0, 0, NULL, 0);
+	}
+	if ((roam_synch_data->authStatus
+				== CSR_ROAM_AUTH_STATUS_AUTHENTICATED)) {
+		CDF_TRACE(CDF_MODULE_ID_SME,
+				CDF_TRACE_LEVEL_DEBUG,
+				FL("LFR3:Don't start waitforkey timer"));
+		csr_roam_substate_change(mac_ctx,
+				eCSR_ROAM_SUBSTATE_NONE, session_id);
+	} else {
+		roam_info->fAuthRequired = true;
+		csr_roam_substate_change(mac_ctx,
+				eCSR_ROAM_SUBSTATE_WAIT_FOR_KEY,
+				session_id);
+
+		ps_global_info->remain_in_power_active_till_dhcp = true;
+		mac_ctx->roam.WaitForKeyTimerInfo.sessionId = session_id;
+		if (!CDF_IS_STATUS_SUCCESS(csr_roam_start_wait_for_key_timer(
+				mac_ctx, CSR_WAIT_FOR_KEY_TIMEOUT_PERIOD))
+		   ) {
+			sms_log(mac_ctx, LOGE, FL
+					("Failed wait for key timer start"));
+			csr_roam_substate_change(mac_ctx,
+					eCSR_ROAM_SUBSTATE_NONE,
+					session_id);
+		}
+	}
+	roam_info->nBeaconLength = 0;
+	roam_info->nAssocReqLength = roam_synch_data->reassoc_req_length -
+		SIR_MAC_HDR_LEN_3A - SIR_MAC_REASSOC_SSID_OFFSET;
+	roam_info->nAssocRspLength = roam_synch_data->reassocRespLength -
+		SIR_MAC_HDR_LEN_3A;
+	roam_info->pbFrames = cdf_mem_malloc(roam_info->nBeaconLength +
+		roam_info->nAssocReqLength + roam_info->nAssocRspLength);
+	if (NULL == roam_info->pbFrames) {
+		sms_log(mac_ctx, LOGE, FL("no memory available"));
+		session->roam_synch_in_progress = false;
+		if (roam_info)
+			cdf_mem_free(roam_info);
+		sme_release_global_lock(&mac_ctx->sme);
+		return;
+	}
+	cdf_mem_zero(roam_info->pbFrames, roam_info->nBeaconLength +
+		roam_info->nAssocReqLength + roam_info->nAssocRspLength);
+	cdf_mem_copy(roam_info->pbFrames,
+			(uint8_t *)roam_synch_data +
+			roam_synch_data->reassoc_req_offset +
+			SIR_MAC_HDR_LEN_3A + SIR_MAC_REASSOC_SSID_OFFSET,
+			roam_info->nAssocReqLength);
+	cdf_mem_copy(roam_info->pbFrames + roam_info->nAssocReqLength,
+			(uint8_t *)roam_synch_data +
+			roam_synch_data->reassocRespOffset +
+			SIR_MAC_HDR_LEN_3A,
+			roam_info->nAssocRspLength);
+
+	CDF_TRACE(CDF_MODULE_ID_SME,
+			CDF_TRACE_LEVEL_DEBUG,
+			FL("LFR3:Clear Connected info"));
+	csr_roam_free_connected_info(mac_ctx,
+			&session->connectedInfo);
+	conn_profile->vht_channel_width =
+		roam_synch_data->join_rsp->vht_channel_width;
+	add_bss_params = (tpAddBssParams)roam_synch_data->add_bss_params;
+	session->connectedInfo.staId = add_bss_params->staContext.staIdx;
+	roam_info->staId = session->connectedInfo.staId;
+	roam_info->ucastSig =
+		(uint8_t) roam_synch_data->join_rsp->ucastSig;
+	roam_info->bcastSig =
+		(uint8_t) roam_synch_data->join_rsp->bcastSig;
+	roam_info->timingMeasCap =
+		roam_synch_data->join_rsp->timingMeasCap;
+	roam_info->chan_info.nss = roam_synch_data->join_rsp->nss;
+	roam_info->chan_info.rate_flags =
+		roam_synch_data->join_rsp->max_rate_flags;
+	csr_roam_fill_tdls_info(roam_info, roam_synch_data->join_rsp);
+	sms_log(mac_ctx, LOG1,
+		FL("tdls:prohibit: %d, chan_swit_prohibit: %d"),
+		roam_info->tdls_prohibited,
+		roam_info->tdls_chan_swit_prohibited);
+#ifdef FEATURE_WLAN_MCC_TO_SCC_SWITCH
+	src_profile = &roam_synch_data->join_rsp->HTProfile;
+	dst_profile = &conn_profile->HTProfile;
+	if (mac_ctx->roam.configParam.cc_switch_mode
+			!= CDF_MCC_TO_SCC_SWITCH_DISABLE)
+		csr_roam_copy_ht_profile(dst_profile,
+				src_profile);
+#endif
+	assoc_info.pBssDesc = bss_desc;
+	roam_info->statusCode = eSIR_SME_SUCCESS;
+	roam_info->reasonCode = eSIR_SME_SUCCESS;
+	assoc_info.pProfile = session->pCurRoamProfile;
+	mac_ctx->roam.roamSession[session_id].connectState =
+		eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED;
+	sme_qos_csr_event_ind(mac_ctx, session_id,
+		SME_QOS_CSR_HANDOFF_ASSOC_REQ, NULL);
+	sme_qos_csr_event_ind(mac_ctx, session_id,
+		SME_QOS_CSR_REASSOC_REQ, NULL);
+	sme_qos_csr_event_ind(mac_ctx, session_id,
+		SME_QOS_CSR_HANDOFF_COMPLETE, NULL);
+	mac_ctx->roam.roamSession[session_id].connectState =
+		eCSR_ASSOC_STATE_TYPE_INFRA_ASSOCIATED;
+	sme_qos_csr_event_ind(mac_ctx, session_id,
+		SME_QOS_CSR_REASSOC_COMPLETE, &assoc_info);
+	roam_info->pBssDesc = bss_desc;
+	conn_profile->acm_mask = sme_qos_get_acm_mask(mac_ctx,
+			bss_desc, NULL);
+	if (conn_profile->modifyProfileFields.uapsd_mask) {
+		sms_log(mac_ctx, LOGE,
+				" uapsd_mask (0x%X) set, request UAPSD now",
+				conn_profile->modifyProfileFields.uapsd_mask);
+		sme_ps_start_uapsd(mac_ctx, session_id,
+				NULL, NULL);
+	}
+	conn_profile->dot11Mode = session->bssParams.uCfgDot11Mode;
+	roam_info->u.pConnectedProfile = conn_profile;
+
+	if (!IS_FEATURE_SUPPORTED_BY_FW
+			(SLM_SESSIONIZATION) &&
+			(csr_is_concurrent_session_running(mac_ctx))) {
+		mac_ctx->roam.configParam.doBMPSWorkaround = 1;
+	}
+	roam_info->roamSynchInProgress = true;
+	roam_info->synchAuthStatus = roam_synch_data->authStatus;
+	cdf_mem_copy(roam_info->kck, roam_synch_data->kck, SIR_KCK_KEY_LEN);
+	cdf_mem_copy(roam_info->kek, roam_synch_data->kek, SIR_KEK_KEY_LEN);
+	cdf_mem_copy(roam_info->replay_ctr, roam_synch_data->replay_ctr,
+			SIR_REPLAY_CTR_LEN);
+	CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
+		FL("LFR3: Copy KCK, KEK and Replay Ctr"));
+	roam_info->subnet_change_status =
+		CSR_GET_SUBNET_STATUS(roam_synch_data->roamReason);
+	csr_roam_call_callback(mac_ctx, session_id, roam_info, 0,
+		eCSR_ROAM_ASSOCIATION_COMPLETION, eCSR_ROAM_RESULT_ASSOCIATED);
+	csr_reset_pmkid_candidate_list(mac_ctx, session_id);
+#ifdef FEATURE_WLAN_WAPI
+	csr_reset_bkid_candidate_list(mac_ctx, session_id);
+#endif
+	if (!CSR_IS_WAIT_FOR_KEY(mac_ctx, session_id)) {
+		CDF_TRACE(CDF_MODULE_ID_SME,
+				CDF_TRACE_LEVEL_DEBUG,
+				FL
+				("NO CSR_IS_WAIT_FOR_KEY -> csr_roam_link_up"));
+		csr_roam_link_up(mac_ctx, conn_profile->bssid);
+	}
+	session->fRoaming = false;
+	session->roam_synch_in_progress = false;
+	cdf_mem_free(roam_info->pbFrames);
+	cdf_mem_free(roam_info);
+	sme_release_global_lock(&mac_ctx->sme);
+}
diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c
index 1c3669341d2e..2486d9eb8753 100644
--- a/core/sme/src/csr/csr_api_scan.c
+++ b/core/sme/src/csr/csr_api_scan.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1181,6 +1181,13 @@ CDF_STATUS csr_scan_handle_search_for_ssid(tpAniSirGlobal pMac,
 		status = csr_scan_get_result(pMac, pScanFilter, &hBSSList);
 		if (!CDF_IS_STATUS_SUCCESS(status))
 			break;
+		if (pMac->roam.roamSession[sessionId].connectState ==
+				eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTING) {
+			sms_log(pMac, LOGE,
+				FL("upper layer issued disconnetion"));
+			status = CDF_STATUS_E_FAILURE;
+			break;
+		}
 		status = csr_roam_issue_connect(pMac, sessionId, pProfile,
 						hBSSList, eCsrHddIssued,
 						pCommand->u.scanCmd.roamId,
@@ -1467,13 +1474,11 @@ static uint32_t csr_get_bss_cap_value(tpAniSirGlobal pMac,
 				      tDot11fBeaconIEs *pIes)
 {
 	uint32_t ret = CSR_BSS_CAP_VALUE_NONE;
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	if (CSR_IS_ROAM_PREFER_5GHZ(pMac) || CSR_IS_SELECT_5G_PREFERRED(pMac)) {
 		if ((pBssDesc) && CDS_IS_CHANNEL_5GHZ(pBssDesc->channelId)) {
 			ret += CSR_BSS_CAP_VALUE_5GHZ;
 		}
 	}
-#endif
 	/*
 	 * if strict select 5GHz is non-zero then ignore the capability checking
 	 */
@@ -1579,7 +1584,6 @@ static bool csr_is_better_bss(tpAniSirGlobal mac_ctx,
 	return ret;
 }
 
-#ifdef FEATURE_WLAN_LFR
 /* Add the channel to the occupiedChannels array */
 static void csr_scan_add_to_occupied_channels(tpAniSirGlobal pMac,
 					      tCsrScanResult *pResult,
@@ -1611,17 +1615,14 @@ static void csr_scan_add_to_occupied_channels(tpAniSirGlobal pMac,
 				CSR_BG_SCAN_OCCUPIED_CHANNEL_LIST_LEN;
 	}
 }
-#endif
 
 /* Put the BSS into the scan result list */
 /* pIes can not be NULL */
 static void csr_scan_add_result(tpAniSirGlobal pMac, tCsrScanResult *pResult,
 				tDot11fBeaconIEs *pIes, uint32_t sessionId)
 {
-#ifdef FEATURE_WLAN_LFR
 	tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
 		&pMac->roam.neighborRoamInfo[sessionId];
-#endif
 
 	struct cdf_mac_addr bssid;
 	uint8_t channel_id = pResult->Result.BssDescriptor.channelId;
@@ -1635,7 +1636,6 @@ static void csr_scan_add_result(tpAniSirGlobal pMac, tCsrScanResult *pResult,
 				&pResult->Result.BssDescriptor, pIes);
 	csr_ll_insert_tail(&pMac->scan.scanResultList, &pResult->Link,
 			   LL_ACCESS_LOCK);
-#ifdef FEATURE_WLAN_LFR
 	if (0 == pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels) {
 		/*
 		 * Build the occupied channel list, only if
@@ -1644,7 +1644,6 @@ static void csr_scan_add_result(tpAniSirGlobal pMac, tCsrScanResult *pResult,
 		csr_scan_add_to_occupied_channels(pMac, pResult, sessionId,
 				&pMac->scan.occupiedChannels[sessionId], pIes);
 	}
-#endif
 }
 
 static void
@@ -1998,9 +1997,9 @@ csr_parse_scan_results(tpAniSirGlobal pMac,
 	csr_ll_lock(&pMac->scan.scanResultList);
 
 	if (pFilter) {
-		if (cds_map_concurrency_mode(pMac->hHdd,
+		if (cds_map_concurrency_mode(
 					&pFilter->csrPersona, &new_mode)) {
-			status = cds_get_pcl(pMac->hHdd, new_mode,
+			status = cds_get_pcl(new_mode,
 				&pFilter->pcl_channels.channelList[0], &len);
 			pFilter->pcl_channels.numChannels = (uint8_t)len;
 		}
@@ -2170,13 +2169,13 @@ void csr_scan_flush_bss_entry(tpAniSirGlobal pMac,
 	while (pEntry != NULL) {
 		pBssDesc = GET_BASE_ADDR(pEntry, tCsrScanResult, Link);
 		if (cdf_mem_compare(pBssDesc->Result.BssDescriptor.bssId,
-			pCsaOffloadInd->bssId, sizeof(tSirMacAddr))) {
+			pCsaOffloadInd->bssid.bytes, CDF_MAC_ADDR_SIZE)) {
 			pFreeElem = pEntry;
 			pEntry = csr_ll_next(pList, pEntry, LL_ACCESS_NOLOCK);
 			csr_ll_remove_entry(pList, pFreeElem, LL_ACCESS_NOLOCK);
 			csr_free_scan_result_entry(pMac, pBssDesc);
 			sms_log(pMac, LOG1, FL("Removed BSS entry:%pM"),
-				pCsaOffloadInd->bssId);
+				pCsaOffloadInd->bssid.bytes);
 			continue;
 		}
 
@@ -2466,14 +2465,6 @@ CDF_STATUS csr_scanning_state_msg_processor(tpAniSirGlobal pMac,
 					eCSR_ROAM_INFRA_IND,
 					eCSR_ROAM_RESULT_INFRA_ASSOCIATION_CNF);
 	}
-	if (CSR_IS_WDS_AP(pRoamInfo->u.pConnectedProfile)) {
-		cdf_sleep(100);
-		pMac->roam.roamSession[sessionId].connectState =
-			eCSR_ASSOC_STATE_TYPE_WDS_CONNECTED;
-		status = csr_roam_call_callback(pMac, sessionId, pRoamInfo, 0,
-				eCSR_ROAM_WDS_IND,
-				eCSR_ROAM_RESULT_WDS_ASSOCIATION_IND);
-	}
 	return status;
 }
 
@@ -2522,7 +2513,6 @@ bool csr_remove_dup_bss_description(tpAniSirGlobal pMac,
 	tListElem *pEntry;
 	tCsrScanResult *scan_entry;
 	bool fRC = false;
-	int8_t scan_entry_rssi = 0;
 
 	/*
 	 * Walk through all the chained BssDescriptions. If we find a chained
@@ -2542,17 +2532,31 @@ bool csr_remove_dup_bss_description(tpAniSirGlobal pMac,
 		if (csr_is_duplicate_bss_description(pMac,
 			&scan_entry->Result.BssDescriptor,
 			bss_dscp, pIes, fForced)) {
-			/*
-			 * Following is mathematically a = (aX + b(100-X))/100
-			 * where:
-			 * a = bss_dscp->rssi, b = scan_entry_rssi
-			 * and X = CSR_SCAN_RESULT_RSSI_WEIGHT
-			 */
-			scan_entry_rssi = scan_entry->Result.BssDescriptor.rssi;
-			bss_dscp->rssi = (int8_t) ((((int32_t) bss_dscp->rssi *
-						CSR_SCAN_RESULT_RSSI_WEIGHT) +
-				((int32_t) scan_entry_rssi *
-				 (100 - CSR_SCAN_RESULT_RSSI_WEIGHT))) / 100);
+			if (bss_dscp->rx_channel == bss_dscp->channelId) {
+				/*
+				 * Update rssi values only if beacon is
+				 * received on the same channel that was
+				 * sent on.
+				 */
+				int32_t rssi_new, rssi_old;
+				const int32_t weight =
+						CSR_SCAN_RESULT_RSSI_WEIGHT;
+
+				rssi_new = (int32_t) bss_dscp->rssi;
+				rssi_old = (int32_t) scan_entry->
+						Result.BssDescriptor.rssi;
+				rssi_new = ((rssi_new * weight) +
+					     rssi_old * (100 - weight)) / 100;
+				bss_dscp->rssi = (int8_t) rssi_new;
+
+				rssi_new = (int32_t) bss_dscp->rssi_raw;
+				rssi_old = (int32_t) scan_entry->
+						Result.BssDescriptor.rssi_raw;
+				rssi_new = ((rssi_new * weight) +
+					     rssi_old * (100 - weight)) / 100;
+				bss_dscp->rssi_raw = (int8_t) rssi_new;
+			}
+
 			/* Remove the old entry from the list */
 			if (csr_ll_remove_entry
 				    (&pMac->scan.scanResultList, pEntry,
@@ -3054,13 +3058,13 @@ CDF_STATUS csr_save_to_channel_power2_g_5_g(tpAniSirGlobal pMac,
 		if ((CDS_IS_CHANNEL_24GHZ(pChannelSet->firstChannel)) &&
 		    ((pChannelSet->firstChannel +
 		      (pChannelSet->numChannels - 1)) <=
-		     CDS_MAX_24GHz_CHANNEL_NUMBER)) {
+		     CDS_MAX_24GHZ_CHANNEL_NUMBER)) {
 			pChannelSet->interChannelOffset = 1;
 			f2GHzInfoFound = true;
 		} else if ((CDS_IS_CHANNEL_5GHZ(pChannelSet->firstChannel))
 		    && ((pChannelSet->firstChannel +
 		      ((pChannelSet->numChannels - 1) * 4)) <=
-		     CDS_MAX_5GHz_CHANNEL_NUMBER)) {
+		     CDS_MAX_5GHZ_CHANNEL_NUMBER)) {
 			pChannelSet->interChannelOffset = 4;
 			f2GHzInfoFound = false;
 		} else {
@@ -3200,7 +3204,7 @@ static void csr_diag_reset_country_information(tpAniSirGlobal pMac)
 		     Index < pMac->scan.base_channels.numChannels;
 		     Index++) {
 			p11dLog->TxPwr[Index] = CDF_MIN(
-				pMac->scan.defaultPowerTable[Index].pwr,
+				pMac->scan.defaultPowerTable[Index].power,
 				pMac->roam.configParam.nTxPowerCap);
 		}
 	}
@@ -3267,7 +3271,7 @@ void csr_add_vote_for_country_info(tpAniSirGlobal pMac, uint8_t *pCountryCode)
 
 	if (!CDF_IS_STATUS_SUCCESS(csr_get_regulatory_domain_for_country(pMac,
 						pCountryCode, NULL,
-						COUNTRY_QUERY))) {
+						SOURCE_QUERY))) {
 		pCountryCode[0] = '0';
 		pCountryCode[1] = '0';
 	}
@@ -3363,8 +3367,8 @@ CDF_STATUS csr_set_country_code(tpAniSirGlobal pMac, uint8_t *pCountry)
 	if (pCountry) {
 
 		status = csr_get_regulatory_domain_for_country(pMac, pCountry,
-							       &domainId,
-							       COUNTRY_USER);
+							     &domainId,
+							     SOURCE_USERSPACE);
 		if (CDF_IS_STATUS_SUCCESS(status)) {
 			cdf_mem_copy(pMac->scan.countryCodeCurrent,
 				     pCountry,
@@ -3380,7 +3384,7 @@ CDF_STATUS csr_set_country_code(tpAniSirGlobal pMac, uint8_t *pCountry)
 /* Upon return, *pNumChn has the number of channels assigned. */
 void csr_get_channel_power_info(tpAniSirGlobal pMac, tDblLinkList *list,
 				uint32_t *num_ch,
-				tChannelListWithPower *chn_pwr_info)
+				struct channel_power *chn_pwr_info)
 {
 	tListElem *entry;
 	uint32_t chn_idx = 0, idx;
@@ -3392,10 +3396,10 @@ void csr_get_channel_power_info(tpAniSirGlobal pMac, tDblLinkList *list,
 		ch_set = GET_BASE_ADDR(entry, tCsrChannelPowerInfo, link);
 		for (idx = 0; (idx < ch_set->numChannels)
 				&& (chn_idx < *num_ch); idx++) {
-			chn_pwr_info[chn_idx].chanId =
+			chn_pwr_info[chn_idx].chan_num =
 				(uint8_t) (ch_set->firstChannel
 				 + (idx * ch_set->interChannelOffset));
-			chn_pwr_info[chn_idx++].pwr = ch_set->txPower;
+			chn_pwr_info[chn_idx++].power = ch_set->txPower;
 		}
 		entry = csr_ll_next(list, entry, LL_ACCESS_LOCK);
 	}
@@ -3408,7 +3412,7 @@ void csr_get_channel_power_info(tpAniSirGlobal pMac, tDblLinkList *list,
 void csr_diag_apply_country_info(tpAniSirGlobal mac_ctx)
 {
 	host_log_802_11d_pkt_type *p11dLog;
-	tChannelListWithPower chnPwrInfo[WNI_CFG_VALID_CHANNEL_LIST_LEN];
+	struct channel_power chnPwrInfo[WNI_CFG_VALID_CHANNEL_LIST_LEN];
 	uint32_t nChnInfo = WNI_CFG_VALID_CHANNEL_LIST_LEN, nTmp;
 
 	WLAN_HOST_DIAG_LOG_ALLOC(p11dLog, host_log_802_11d_pkt_type,
@@ -3438,9 +3442,9 @@ void csr_diag_apply_country_info(tpAniSirGlobal mac_ctx)
 		     nChnInfo < WNI_CFG_VALID_CHANNEL_LIST_LEN;
 		     nChnInfo++) {
 			if (p11dLog->Channels[nTmp] ==
-			    chnPwrInfo[nChnInfo].chanId) {
+			    chnPwrInfo[nChnInfo].chan_num) {
 				p11dLog->TxPwr[nTmp] =
-					chnPwrInfo[nChnInfo].pwr;
+					chnPwrInfo[nChnInfo].power;
 				break;
 			}
 		}
@@ -3472,7 +3476,7 @@ void csr_apply_country_information(tpAniSirGlobal pMac)
 	    || 0 == pMac->scan.channelOf11dInfo)
 		return;
 	status = csr_get_regulatory_domain_for_country(pMac,
-			pMac->scan.countryCode11d, &domainId, COUNTRY_QUERY);
+			pMac->scan.countryCode11d, &domainId, SOURCE_QUERY);
 	if (!CDF_IS_STATUS_SUCCESS(status))
 		return;
 	/* Check whether we need to enforce default domain */
@@ -3518,7 +3522,7 @@ void csr_save_channel_power_for_band(tpAniSirGlobal pMac, bool fill_5f)
 		    WNI_CFG_VALID_CHANNEL_LIST_LEN, 0);
 	ch_info_start = chan_info;
 	for (idx = 0; idx < max_ch_idx; idx++) {
-		ch = pMac->scan.defaultPowerTable[idx].chanId;
+		ch = pMac->scan.defaultPowerTable[idx].chan_num;
 		tmp_bool =  (fill_5f && CDS_IS_CHANNEL_5GHZ(ch))
 			|| (!fill_5f && CDS_IS_CHANNEL_24GHZ(ch));
 		if (!tmp_bool)
@@ -3530,10 +3534,10 @@ void csr_save_channel_power_for_band(tpAniSirGlobal pMac, bool fill_5f)
 		}
 
 		chan_info->firstChanNum =
-			pMac->scan.defaultPowerTable[idx].chanId;
+			pMac->scan.defaultPowerTable[idx].chan_num;
 		chan_info->numChannels = 1;
 		chan_info->maxTxPower =
-			CDF_MIN(pMac->scan.defaultPowerTable[idx].pwr,
+			CDF_MIN(pMac->scan.defaultPowerTable[idx].power,
 				pMac->roam.configParam.nTxPowerCap);
 		chan_info++;
 		count++;
@@ -3575,9 +3579,6 @@ bool csr_learn_11dcountry_information(tpAniSirGlobal pMac,
 	tDot11fBeaconIEs *pIesLocal = pIes;
 	bool useVoting = false;
 
-	if (CDF_SAP_MODE == cds_get_conparam())
-		return CDF_STATUS_SUCCESS;
-
 	if ((NULL == pSirBssDesc) && (NULL == pIes))
 		useVoting = true;
 
@@ -3597,7 +3598,7 @@ bool csr_learn_11dcountry_information(tpAniSirGlobal pMac,
 			goto free_ie;
 		status = csr_get_regulatory_domain_for_country(pMac,
 				pIesLocal->Country.country, &domainId,
-				COUNTRY_QUERY);
+				SOURCE_QUERY);
 		if (CDF_IS_STATUS_SUCCESS(status)
 		    && (domainId == REGDOMAIN_WORLD))
 			goto free_ie;
@@ -3609,7 +3610,7 @@ bool csr_learn_11dcountry_information(tpAniSirGlobal pMac,
 		pCountryCodeSelected = pMac->scan.countryCodeElected;
 
 	status = csr_get_regulatory_domain_for_country(pMac,
-				pCountryCodeSelected, &domainId, COUNTRY_IE);
+				pCountryCodeSelected, &domainId, SOURCE_11D);
 	if (status != CDF_STATUS_SUCCESS) {
 		sms_log(pMac, LOGE, FL("fail to get regId %d"), domainId);
 		fRet = false;
@@ -4869,11 +4870,15 @@ CDF_STATUS csr_send_mb_scan_req(tpAniSirGlobal pMac, uint16_t sessionId,
 			pScanReqParam->fUniqueResult, pScanReqParam->freshScan,
 			pScanReqParam->hiddenSsid);
 		sms_log(pMac, LOG1,
-			FL("scanType = %u BSSType = %u numOfSSIDs = %d"
-			   " numOfChannels = %d requestType = %d p2pSearch = %d\n"),
-			pScanReq->scanType, pScanReq->BSSType,
+			FL("scanType = %s (%u) BSSType = %s (%u) numOfSSIDs = %d"
+			   " numOfChannels = %d requestType = %s (%d) p2pSearch = %d\n"),
+			lim_scan_type_to_string(pScanReq->scanType),
+			pScanReq->scanType,
+			lim_bss_type_to_string(pScanReq->BSSType),
+			pScanReq->BSSType,
 			pScanReq->SSIDs.numOfSSIDs,
 			pScanReq->ChannelInfo.numOfChannels,
+			sme_request_type_to_string(pScanReq->requestType),
 			pScanReq->requestType, pScanReq->p2pSearch);
 		return CDF_STATUS_E_NOMEM;
 	}
@@ -4945,9 +4950,7 @@ CDF_STATUS csr_send_mb_scan_req(tpAniSirGlobal pMac, uint16_t sessionId,
 	 * mode we need to send out a directed probe
 	 */
 	if ((eSIR_PASSIVE_SCAN != scanType)
-	    && (eCSR_SCAN_P2P_DISCOVERY !=
-		pScanReq->requestType)
-	    && (eCSR_BSS_TYPE_WDS_STA != pScanReq->BSSType)
+	    && (eCSR_SCAN_P2P_DISCOVERY != pScanReq->requestType)
 	    && (false == pMac->scan.fEnableBypass11d)) {
 		scanType = pMac->scan.curScanType;
 		if (eSIR_PASSIVE_SCAN == pMac->scan.curScanType) {
@@ -5016,10 +5019,12 @@ CDF_STATUS csr_send_mb_scan_req(tpAniSirGlobal pMac, uint16_t sessionId,
 
 send_scan_req:
 	sms_log(pMac, LOG1,
-		FL("scanId %d domainIdCurrent %d scanType %d bssType %d requestType %d numChannels %d"),
-		pMsg->scan_id, pMac->scan.domainIdCurrent, pMsg->scanType,
-		pMsg->bssType, pScanReq->requestType,
-		pMsg->channelList.numChannels);
+		FL("scanId %d domainIdCurrent %d scanType %s (%d) bssType %s (%d) requestType %s (%d) numChannels %d"),
+		pMsg->scan_id, pMac->scan.domainIdCurrent,
+		lim_scan_type_to_string(pMsg->scanType), pMsg->scanType,
+		lim_bss_type_to_string(pMsg->bssType), pMsg->bssType,
+		sme_request_type_to_string(pScanReq->requestType),
+		pScanReq->requestType, pMsg->channelList.numChannels);
 
 	for (i = 0; i < pMsg->channelList.numChannels; i++) {
 		sms_log(pMac, LOG1, FL("channelNumber[%d]= %d"), i,
@@ -5179,7 +5184,7 @@ csr_issue_user_scan(tpAniSirGlobal mac_ctx, tSmeCmd *cmd)
 		j = 0;
 		for (i = 0; i < len; i++) {
 			new_ch_info.ChannelList[j++] = ch_lst[i];
-			if (CDS_MAX_24GHz_CHANNEL_NUMBER >= ch_lst[i])
+			if (CDS_MAX_24GHZ_CHANNEL_NUMBER >= ch_lst[i])
 				new_ch_info.ChannelList[j++] = ch_lst[i];
 		}
 		if (NULL !=
@@ -5251,7 +5256,8 @@ static void csr_scan_copy_request_valid_channels_only(tpAniSirGlobal mac_ctx,
 		 * that is the only way to find p2p peers.
 		 * This can happen only if band is set to 5Ghz mode.
 		 */
-		if (src_req->ChannelInfo.ChannelList[index] < MIN_11P_CHANNEL &&
+		if (src_req->ChannelInfo.ChannelList[index] <
+		    CDS_MIN_11P_CHANNEL &&
 			((csr_roam_is_valid_channel(mac_ctx,
 			src_req->ChannelInfo.ChannelList[index])) ||
 			((eCSR_SCAN_P2P_DISCOVERY == src_req->requestType) &&
@@ -5264,14 +5270,14 @@ static void csr_scan_copy_request_valid_channels_only(tpAniSirGlobal mac_ctx,
 							ChannelList
 							[index])))
 			) {
-#ifdef FEATURE_WLAN_LFR
 				sms_log(mac_ctx, LOG2,
-					FL(" reqType=%d, numOfChannels=%d, ignoring DFS channel %d"),
+					FL(" reqType= %s (%d), numOfChannels=%d, ignoring DFS channel %d"),
+					sme_request_type_to_string(
+						src_req->requestType),
 					src_req->requestType,
 					src_req->ChannelInfo.numOfChannels,
 					src_req->ChannelInfo.ChannelList
 						[index]);
-#endif
 				continue;
 			}
 
@@ -5284,6 +5290,98 @@ static void csr_scan_copy_request_valid_channels_only(tpAniSirGlobal mac_ctx,
 }
 
 /**
+ * csr_scan_filter_ibss_chnl_band() - filter all channels which matches IBSS
+ *                                    channel's band
+ * @mac_ctx: pointer to mac context
+ * @ibss_channel: Given IBSS channel
+ * @dst_req: destination scan request
+ *
+ * when ever IBSS connection already exist, STA should not scan the channels
+ * which fall under same band as IBSS channel's band. this routine will filter
+ * out those channels
+ *
+ * Return: true if success otherwise false for any failure
+ */
+static bool csr_scan_filter_ibss_chnl_band(tpAniSirGlobal mac_ctx,
+			uint8_t ibss_channel, tCsrScanRequest *dst_req) {
+	uint8_t valid_chnl_list[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+	uint32_t filter_chnl_len = 0, i = 0;
+	uint32_t valid_chnl_len = WNI_CFG_VALID_CHANNEL_LIST_LEN;
+
+	if (ibss_channel == 0) {
+		sms_log(mac_ctx, LOG1,
+			FL("Nothing to filter as no IBSS session"));
+		return true;
+	}
+
+	if (!dst_req) {
+		sms_log(mac_ctx, LOGE,
+			FL("No valid scan requests"));
+		return false;
+	}
+	/*
+	 * In case of concurrent IBSS session exist, scan only
+	 * those channels which are not in IBSS channel's band.
+	 * In case if no-concurrent IBSS session exist then scan
+	 * full band
+	 */
+	if ((dst_req->ChannelInfo.numOfChannels == 0)) {
+		csr_get_cfg_valid_channels(mac_ctx, valid_chnl_list,
+				&valid_chnl_len);
+	} else {
+		valid_chnl_len = (WNI_CFG_VALID_CHANNEL_LIST_LEN >
+					dst_req->ChannelInfo.numOfChannels) ?
+					dst_req->ChannelInfo.numOfChannels :
+					WNI_CFG_VALID_CHANNEL_LIST_LEN;
+		cdf_mem_copy(valid_chnl_list, dst_req->ChannelInfo.ChannelList,
+				valid_chnl_len);
+	}
+	for (i = 0; i < valid_chnl_len; i++) {
+		/*
+		 * Don't allow DSRC channel when IBSS concurrent connection
+		 * is up
+		 */
+		if (valid_chnl_list[i] >= CDS_MIN_11P_CHANNEL)
+			continue;
+		if (CDS_IS_CHANNEL_5GHZ(ibss_channel) &&
+			CDS_IS_CHANNEL_24GHZ(valid_chnl_list[i])) {
+			valid_chnl_list[filter_chnl_len] =
+					valid_chnl_list[i];
+			filter_chnl_len++;
+		} else if (CDS_IS_CHANNEL_24GHZ(ibss_channel) &&
+			CDS_IS_CHANNEL_5GHZ(valid_chnl_list[i])) {
+			valid_chnl_list[filter_chnl_len] =
+					valid_chnl_list[i];
+			filter_chnl_len++;
+		}
+	}
+	if (filter_chnl_len == 0) {
+		sms_log(mac_ctx, LOGE,
+			FL("there no channels to scan due to IBSS session"));
+		return false;
+	}
+
+	if (dst_req->ChannelInfo.ChannelList) {
+		cdf_mem_free(dst_req->ChannelInfo.ChannelList);
+		dst_req->ChannelInfo.ChannelList = NULL;
+		dst_req->ChannelInfo.numOfChannels = 0;
+	}
+
+	dst_req->ChannelInfo.ChannelList =
+			cdf_mem_malloc(filter_chnl_len *
+				sizeof(*dst_req->ChannelInfo.ChannelList));
+	dst_req->ChannelInfo.numOfChannels = filter_chnl_len;
+	if (NULL == dst_req->ChannelInfo.ChannelList) {
+		sms_log(mac_ctx, LOGE,
+			FL("Memory allocation failed"));
+		return false;
+	}
+	cdf_mem_copy(dst_req->ChannelInfo.ChannelList, valid_chnl_list,
+			filter_chnl_len);
+	return true;
+}
+
+/**
  * csr_scan_copy_request() - Function to copy scan request
  * @mac_ctx : pointer to Global Mac Structure
  * @dst_req: pointer to tCsrScanRequest
@@ -5301,7 +5399,9 @@ CDF_STATUS csr_scan_copy_request(tpAniSirGlobal mac_ctx,
 	uint32_t len = sizeof(mac_ctx->roam.validChannelList);
 	uint32_t index = 0;
 	uint32_t new_index = 0;
-	CHANNEL_STATE channel_state;
+	enum channel_state channel_state;
+	uint8_t ibss_channel = 0;
+
 	bool skip_dfs_chnl =
 			mac_ctx->roam.configParam.initial_scan_no_dfs_chnl ||
 				!mac_ctx->scan.fEnableDFSChnlScan;
@@ -5356,7 +5456,7 @@ CDF_STATUS csr_scan_copy_request(tpAniSirGlobal mac_ctx,
 							ChannelInfo.
 							ChannelList[index]);
 				if (src_req->ChannelInfo.ChannelList[index] <
-						MIN_11P_CHANNEL &&
+						CDS_MIN_11P_CHANNEL &&
 					((CHANNEL_STATE_ENABLE ==
 						channel_state) ||
 					((CHANNEL_STATE_DFS == channel_state) &&
@@ -5387,7 +5487,7 @@ CDF_STATUS csr_scan_copy_request(tpAniSirGlobal mac_ctx,
 			for (index = 0; index < src_req->ChannelInfo.
 					numOfChannels; index++) {
 				if (src_req->ChannelInfo.ChannelList[index] <
-						MIN_11P_CHANNEL) {
+						CDS_MIN_11P_CHANNEL) {
 					dst_req->ChannelInfo.
 						ChannelList[new_index] =
 						src_req->ChannelInfo.
@@ -5399,6 +5499,26 @@ CDF_STATUS csr_scan_copy_request(tpAniSirGlobal mac_ctx,
 				new_index;
 		}
 	} /* Allocate memory for Channel List */
+
+	/*
+	 * If IBSS concurrent connection exist, and if the scan
+	 * request comes from STA adapter then we need to filter
+	 * out IBSS channel's band otherwise it will cause issue
+	 * in IBSS+STA concurrency
+	 */
+	if (true == cds_is_ibss_conn_exist(&ibss_channel)) {
+		sms_log(mac_ctx, LOG1,
+			FL("Conc IBSS exist, channel list will be modified"));
+	}
+
+	if ((ibss_channel > 0) &&
+		(false == csr_scan_filter_ibss_chnl_band(mac_ctx,
+				ibss_channel, dst_req))) {
+		sms_log(mac_ctx, LOGE,
+			FL("Can't filter channels due to IBSS"));
+		goto complete;
+	}
+
 	if (src_req->SSIDs.numOfSSIDs == 0) {
 		dst_req->SSIDs.numOfSSIDs = 0;
 		dst_req->SSIDs.SSIDList = NULL;
@@ -5551,9 +5671,7 @@ static void csr_sta_ap_conc_timer_handler(void *pv)
 
 	if ((num_chn > numchan_combinedconc) &&
 		((csr_is_sta_session_connected(mac_ctx) &&
-#ifdef FEATURE_WLAN_LFR
 		(csr_is_concurrent_infra_connected(mac_ctx)) &&
-#endif
 		(scan_cmd->u.scanCmd.u.scanRequest.p2pSearch != 1)) ||
 		(csr_is_p2p_session_connected(mac_ctx)))) {
 			cdf_mem_set(&scan_req, sizeof(tCsrScanRequest), 0);
@@ -6004,10 +6122,6 @@ CDF_STATUS csr_scan_for_ssid(tpAniSirGlobal mac_ctx, uint32_t session_id,
 
 	sms_log(mac_ctx, LOG2, FL("called"));
 
-	/* For WDS, we use the index 0. There must be at least one in there */
-	if (CSR_IS_WDS_STA(profile) && num_ssid)
-		num_ssid = 1;
-
 	if (!(mac_ctx->scan.fScanEnable) && (num_ssid != 1)) {
 		sms_log(mac_ctx, LOGE,
 			FL("cannot scan because scanEnable (%d) or numSSID (%d) is invalid"),
@@ -6845,7 +6959,6 @@ CDF_STATUS csr_scan_save_preferred_network_found(tpAniSirGlobal pMac,
 }
 #endif /* FEATURE_WLAN_SCAN_PNO */
 
-#ifdef FEATURE_WLAN_LFR
 void csr_init_occupied_channels_list(tpAniSirGlobal pMac, uint8_t sessionId)
 {
 	tListElem *pEntry = NULL;
@@ -6898,7 +7011,6 @@ void csr_init_occupied_channels_list(tpAniSirGlobal pMac, uint8_t sessionId)
 	} /* while */
 	csr_ll_unlock(&pMac->scan.scanResultList);
 }
-#endif
 
 CDF_STATUS csr_scan_create_entry_in_scan_cache(tpAniSirGlobal pMac,
 					       uint32_t sessionId,
@@ -6991,7 +7103,8 @@ void update_cckmtsf(uint32_t *timeStamp0, uint32_t *timeStamp1,
  */
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 CDF_STATUS csr_scan_save_roam_offload_ap_to_scan_cache(tpAniSirGlobal pMac,
-				roam_offload_synch_ind *roam_sync_ind_ptr)
+		roam_offload_synch_ind *roam_sync_ind_ptr,
+		tpSirBssDescription  bss_desc_ptr)
 {
 	uint32_t length = 0;
 	bool dup_bss;
@@ -7012,7 +7125,7 @@ CDF_STATUS csr_scan_save_roam_offload_ap_to_scan_cache(tpAniSirGlobal pMac,
 
 	cdf_mem_zero(scan_res_ptr, sizeof(tCsrScanResult) + length);
 	cdf_mem_copy(&scan_res_ptr->Result.BssDescriptor,
-			roam_sync_ind_ptr->bss_desc_ptr,
+			bss_desc_ptr,
 			(sizeof(tSirBssDescription) + length));
 	ies_local_ptr = (tDot11fBeaconIEs *)(scan_res_ptr->Result.pvIes);
 	if (!ies_local_ptr &&
diff --git a/core/sme/src/csr/csr_inside_api.h b/core/sme/src/csr/csr_inside_api.h
index 3896db080f46..99414ad2330a 100644
--- a/core/sme/src/csr/csr_inside_api.h
+++ b/core/sme/src/csr/csr_inside_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -88,9 +88,7 @@
 #define CSR_BSS_CAP_VALUE_VHT    2
 #define CSR_BSS_CAP_VALUE_WMM   1
 #define CSR_BSS_CAP_VALUE_UAPSD 1
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 #define CSR_BSS_CAP_VALUE_5GHZ  2
-#endif
 #define CSR_DEFAULT_ROAMING_TIME 10     /* 10 seconds */
 
 #define CSR_ROAMING_DFS_CHANNEL_DISABLED           (0)
@@ -106,7 +104,6 @@
 
 #define CSR_MAX_BSSID_COUNT     ((CSR_ACTIVE_LIST_CMD_TIMEOUT_VALUE/4000) * 3)
 #define CSR_CUSTOM_CONC_GO_BI    100
-#define MIN_11P_CHANNEL (rf_channels[MIN_5_9GHZ_CHANNEL].channelNum)
 
 typedef enum {
 	eCsrNextScanNothing,
@@ -137,7 +134,6 @@ typedef enum {
 	eCsrStartBssFailure,
 	eCsrSilentlyStopRoaming,
 	eCsrSilentlyStopRoamingSaveState,
-	eCsrJoinWdsFailure,
 	eCsrJoinFailureDueToConcurrency,
 
 } eCsrRoamCompleteResult;
@@ -199,7 +195,6 @@ typedef struct {
 						(eCsrForcedDisassocMICFailure == \
 						  (pCommand)->u.roamCmd.roamReason)))
 
-extern const tRfChannelProps rf_channels[NUM_RF_CHANNELS];
 eCsrRoamState csr_roam_state_change(tpAniSirGlobal pMac,
 				    eCsrRoamState NewRoamState, uint8_t sessionId);
 CDF_STATUS csr_scanning_state_msg_processor(tpAniSirGlobal pMac, void *pMsgBuf);
@@ -401,7 +396,7 @@ CDF_STATUS csr_get_cfg_valid_channels(tpAniSirGlobal pMac, uint8_t *pChannels,
 				      uint32_t *pNumChan);
 void csr_roam_ccm_cfg_set_callback(tpAniSirGlobal pMac, int32_t result);
 
-tPowerdBm csr_get_cfg_max_tx_power(tpAniSirGlobal pMac, uint8_t channel);
+int8_t csr_get_cfg_max_tx_power(tpAniSirGlobal pMac, uint8_t channel);
 
 /* To free the last roaming profile */
 void csr_free_roam_profile(tpAniSirGlobal pMac, uint32_t sessionId);
@@ -589,7 +584,7 @@ CDF_STATUS csr_set_country_code(tpAniSirGlobal pMac, uint8_t *pCountry);
 CDF_STATUS csr_get_regulatory_domain_for_country(tpAniSirGlobal pMac,
 						 uint8_t *pCountry,
 						 v_REGDOMAIN_t *pDomainId,
-						 v_CountryInfoSource_t source);
+						 enum country_src source);
 
 /* some support functions */
 bool csr_is11d_supported(tpAniSirGlobal pMac);
@@ -841,14 +836,7 @@ CDF_STATUS csr_roam_get_connect_profile(tpAniSirGlobal pMac, uint32_t sessionId,
 CDF_STATUS csr_roam_get_connect_state(tpAniSirGlobal pMac, uint32_t sessionId,
 				      eCsrConnectState *pState);
 
-/* ---------------------------------------------------------------------------
-    \fn csr_roam_free_connect_profile
-    \brief To free and reinitialize the profile return previous by csr_roam_get_connect_profile.
-    \param pProfile - pointer to a caller allocated structure tCsrRoamConnectedProfile
-    \return CDF_STATUS.
-   -------------------------------------------------------------------------------*/
-CDF_STATUS csr_roam_free_connect_profile(tpAniSirGlobal pMac,
-					 tCsrRoamConnectedProfile *pProfile);
+void csr_roam_free_connect_profile(tCsrRoamConnectedProfile *profile);
 
 /* ---------------------------------------------------------------------------
     \fn csr_apply_channel_and_power_list
@@ -974,7 +962,7 @@ CDF_STATUS csr_roam_get_associated_stas(tpAniSirGlobal pMac, uint32_t sessionId,
 CDF_STATUS csr_send_mb_get_associated_stas_req_msg(tpAniSirGlobal pMac,
 						   uint32_t sessionId,
 						   CDF_MODULE_ID modId,
-						   tSirMacAddr bssId,
+						   struct cdf_mac_addr bssId,
 						   void *pUsrContext,
 						   void *pfnSapEventCallback,
 						   uint8_t *pAssocStasBuf);
@@ -993,8 +981,10 @@ CDF_STATUS csr_roam_get_wps_session_overlap(tpAniSirGlobal pMac, uint32_t sessio
 					    void *pfnSapEventCallback,
 					    struct cdf_mac_addr pRemoveMac);
 
-CDF_STATUS csr_send_mb_get_wpspbc_sessions(tpAniSirGlobal pMac, uint32_t sessionId,
-					   tSirMacAddr bssId, void *pUsrContext,
+CDF_STATUS csr_send_mb_get_wpspbc_sessions(tpAniSirGlobal pMac,
+					   uint32_t sessionId,
+					   struct cdf_mac_addr bssId,
+					   void *pUsrContext,
 					   void *pfnSapEventCallback,
 					   struct cdf_mac_addr pRemoveMac);
 
@@ -1026,7 +1016,6 @@ CDF_STATUS csr_roam_enqueue_preauth(tpAniSirGlobal pMac, uint32_t sessionId,
 				    tpSirBssDescription pBssDescription,
 				    eCsrRoamReason reason, bool fImmediate);
 CDF_STATUS csr_dequeue_roam_command(tpAniSirGlobal pMac, eCsrRoamReason reason);
-#ifdef FEATURE_WLAN_LFR
 void csr_init_occupied_channels_list(tpAniSirGlobal pMac, uint8_t sessionId);
 bool csr_neighbor_roam_is_new_connected_profile(tpAniSirGlobal pMac,
 						uint8_t sessionId);
@@ -1034,7 +1023,6 @@ bool csr_neighbor_roam_connected_profile_match(tpAniSirGlobal pMac,
 					       uint8_t sessionId,
 					       tCsrScanResult *pResult,
 					       tDot11fBeaconIEs *pIes);
-#endif
 
 CDF_STATUS csr_scan_create_entry_in_scan_cache(tpAniSirGlobal pMac,
 						uint32_t sessionId,
@@ -1068,6 +1056,8 @@ csr_get_bssdescr_from_scan_handle(tScanResultHandle result_handle,
 				  tSirBssDescription *bss_descr);
 void csr_release_scan_command(tpAniSirGlobal pMac, tSmeCmd *pCommand,
 			      eCsrScanStatus scanStatus);
+bool is_disconnect_pending(tpAniSirGlobal mac_ctx,
+				   uint8_t sessionid);
 void csr_scan_active_list_timeout_handle(void *userData);
 CDF_STATUS csr_prepare_disconnect_command(tpAniSirGlobal mac,
 			uint32_t session_id, tSmeCmd **sme_cmd);
diff --git a/core/sme/src/csr/csr_neighbor_roam.c b/core/sme/src/csr/csr_neighbor_roam.c
index 31cae0c215ba..2e8198225330 100644
--- a/core/sme/src/csr/csr_neighbor_roam.c
+++ b/core/sme/src/csr/csr_neighbor_roam.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -34,7 +34,6 @@
 	transitions and Legacy roaming for Android platform.
    ========================================================================== */
 
-#ifdef WLAN_FEATURE_NEIGHBOR_ROAMING
 #include "wma_types.h"
 #include "cds_mq.h"
 #include "csr_inside_api.h"
@@ -646,11 +645,9 @@ static void csr_neighbor_roam_reset_preauth_control_info(tpAniSirGlobal pMac,
 	tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
 		&pMac->roam.neighborRoamInfo[sessionId];
 
-#if  defined (WLAN_FEATURE_VOWIFI_11R) || defined (FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	pNeighborRoamInfo->is11rAssoc = false;
 	/* Purge pre-auth fail list */
 	csr_neighbor_roam_purge_preauth_failed_list(pMac);
-#endif
 
 	pNeighborRoamInfo->FTRoamInfo.preauthRspPending = false;
 	pNeighborRoamInfo->FTRoamInfo.numPreAuthRetries = 0;
@@ -1042,6 +1039,7 @@ CDF_STATUS csr_neighbor_roam_preauth_rsp_handler(tpAniSirGlobal mac_ctx,
 	} else {
 		tpCsrNeighborRoamBSSInfo neighbor_bss_node = NULL;
 		tListElem *entry;
+		bool is_dis_pending = false;
 
 		sms_log(mac_ctx, LOGE,
 			FL("Preauth failed retry number %d, status = 0x%x"),
@@ -1095,11 +1093,17 @@ CDF_STATUS csr_neighbor_roam_preauth_rsp_handler(tpAniSirGlobal mac_ctx,
 				mac_ctx, neighbor_bss_node);
 		}
 NEXT_PREAUTH:
+		is_dis_pending = is_disconnect_pending(mac_ctx, session_id);
+		if (is_dis_pending) {
+			sms_log(mac_ctx, LOGE,
+				FL("Disconnect in progress, Abort preauth"));
+			goto ABORT_PREAUTH;
+		}
 		/* Issue preauth request for the same/next entry */
 		if (CDF_STATUS_SUCCESS == csr_neighbor_roam_issue_preauth_req(
 						mac_ctx, session_id))
 			goto DEQ_PREAUTH;
-
+ABORT_PREAUTH:
 		if (csr_roam_is_roam_offload_scan_enabled(mac_ctx)) {
 			if (neighbor_roam_info->uOsRequestedHandoff) {
 				neighbor_roam_info->uOsRequestedHandoff = 0;
@@ -1121,7 +1125,7 @@ DEQ_PREAUTH:
 	csr_dequeue_roam_command(mac_ctx, eCsrPerformPreauth);
 	return preauth_processed;
 }
-#endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
+#endif /* WLAN_FEATURE_VOWIFI_11R */
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 /**
@@ -1474,7 +1478,6 @@ csr_neighbor_roam_process_scan_results(tpAniSirGlobal mac_ctx,
 					  "SKIP-currently associated AP");
 				continue;
 			}
-#ifdef FEATURE_WLAN_LFR
 			/*
 			 * In case of reassoc requested by upper layer, look
 			 * for exact match of bssid & channel. csr cache might
@@ -1491,7 +1494,6 @@ csr_neighbor_roam_process_scan_results(tpAniSirGlobal mac_ctx,
 					  "SKIP-not a candidate AP for OS requested roam");
 				continue;
 			}
-#endif
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
 			if ((n_roam_info->is11rAssoc) &&
@@ -1538,7 +1540,6 @@ csr_neighbor_roam_process_scan_results(tpAniSirGlobal mac_ctx,
 			}
 #endif /* FEATURE_WLAN_ESE */
 
-#ifdef FEATURE_WLAN_LFR
 			/*
 			 * If we are supporting legacy roaming, and
 			 * if the candidate is on the "pre-auth failed" list,
@@ -1551,7 +1552,6 @@ csr_neighbor_roam_process_scan_results(tpAniSirGlobal mac_ctx,
 					FL("BSSID present in pre-auth fail list.. Ignoring"));
 				continue;
 			}
-#endif /* FEATURE_WLAN_LFR */
 
 			/* check the age of the AP */
 			age_ticks = (uint32_t) cdf_mc_timer_get_system_ticks() -
@@ -2013,7 +2013,6 @@ CDF_STATUS csr_neighbor_roam_create_chan_list_from_neighbor_report(tpAniSirGloba
 }
 #endif /* WLAN_FEATURE_VOWIFI_11R */
 
-#ifdef FEATURE_WLAN_LFR
 /**
  * csr_neighbor_roam_is_ssid_and_security_match() - to match ssid/security
  * @pMac: Pointer to mac context
@@ -2211,7 +2210,6 @@ csr_neighbor_roam_prepare_non_occupied_channel_list(tpAniSirGlobal pMac,
 	*pOutputNumOfChannels = outputNumOfChannels;
 	return CDF_STATUS_SUCCESS;
 }
-#endif /* FEATURE_WLAN_LFR */
 
 /**
  * csr_roam_reset_roam_params - API to reset the roaming parameters
@@ -2256,10 +2254,8 @@ CDF_STATUS csr_neighbor_roam_indicate_disconnect(tpAniSirGlobal pMac,
 {
 	tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
 			&pMac->roam.neighborRoamInfo[sessionId];
-#ifdef FEATURE_WLAN_LFR
 	tCsrRoamConnectedProfile *pPrevProfile =
 			&pNeighborRoamInfo->prevConnProfile;
-#endif
 	tCsrRoamSession *pSession = CSR_GET_SESSION(pMac, sessionId);
 	tCsrRoamSession *roam_session = NULL;
 
@@ -2272,14 +2268,12 @@ CDF_STATUS csr_neighbor_roam_indicate_disconnect(tpAniSirGlobal pMac,
 			MAC_ADDRESS_STR), sessionId,
 			pNeighborRoamInfo->neighborRoamState,
 			MAC_ADDR_ARRAY(pSession->connectedProfile.bssid.bytes));
-#ifdef FEATURE_WLAN_LFR
 	/*
 	 * Free the current previous profile and move
 	 * the current profile to prev profile.
 	 */
-	csr_roam_free_connect_profile(pMac, pPrevProfile);
+	csr_roam_free_connect_profile(pPrevProfile);
 	csr_roam_copy_connect_profile(pMac, sessionId, pPrevProfile);
-#endif
 	/*
 	 * clear the roaming parameters that are per connection.
 	 * For a new connection, they have to be programmed again.
@@ -2403,11 +2397,8 @@ static void csr_neighbor_roam_info_ctx_init(
 		&pMac->roam.neighborRoamInfo[session_id];
 	tCsrRoamSession *session = &pMac->roam.roamSession[session_id];
 
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	int init_ft_flag = false;
-#endif
 
-#ifdef FEATURE_WLAN_LFR
 	/*
 	 * Initialize the occupied list ONLY if we are
 	 * transitioning from INIT state to CONNECTED state.
@@ -2415,7 +2406,6 @@ static void csr_neighbor_roam_info_ctx_init(
 	if (eCSR_NEIGHBOR_ROAM_STATE_INIT ==
 		ngbr_roam_info->neighborRoamState)
 		csr_init_occupied_channels_list(pMac, session_id);
-#endif
 	CSR_NEIGHBOR_ROAM_STATE_TRANSITION
 		(pMac, eCSR_NEIGHBOR_ROAM_STATE_CONNECTED, session_id);
 
@@ -2436,13 +2426,11 @@ static void csr_neighbor_roam_info_ctx_init(
 	ngbr_roam_info->currentRoamBeaconRssiWeight =
 		ngbr_roam_info->cfgParams.nRoamBeaconRssiWeight;
 
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	/**
 	 * Now we can clear the preauthDone that
 	 * was saved as we are connected afresh */
 	csr_neighbor_roam_free_roamable_bss_list(pMac,
 		&ngbr_roam_info->FTRoamInfo.preAuthDoneList);
-#endif
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
 	/* Based on the auth scheme tell if we are 11r */
@@ -2470,12 +2458,9 @@ static void csr_neighbor_roam_info_ctx_init(
 		FL("isESEAssoc is = %d ft = %d"),
 		ngbr_roam_info->isESEAssoc, init_ft_flag);
 #endif
-#ifdef FEATURE_WLAN_LFR
 	/* If "Legacy Fast Roaming" is enabled */
 	if (csr_roam_is_fast_roam_enabled(pMac, session_id))
 		init_ft_flag = true;
-#endif
-#if  defined(WLAN_FEATURE_VOWIFI_11R) || defined(FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	if (init_ft_flag == false)
 		return;
 	/* Initialize all the data structures needed for the 11r FT Preauth */
@@ -2495,7 +2480,7 @@ static void csr_neighbor_roam_info_ctx_init(
 		}
 		ngbr_roam_info->uOsRequestedHandoff = 0;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-		if (session->roamOffloadSynchParams.bRoamSynchInProgress) {
+		if (session->roam_synch_in_progress) {
 			if (pMac->roam.pReassocResp != NULL) {
 				CDF_TRACE(CDF_MODULE_ID_SME,
 					CDF_TRACE_LEVEL_DEBUG,
@@ -2503,16 +2488,12 @@ static void csr_neighbor_roam_info_ctx_init(
 				cdf_mem_free(pMac->roam.pReassocResp);
 				pMac->roam.pReassocResp = NULL;
 			}
-			CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
-				"LFR3:Send SynchCnf auth, authenticated");
-			csr_roam_offload_send_synch_cnf(pMac, session_id);
 		} else
 #endif
 			csr_roam_offload_scan(pMac, session_id,
 				ROAM_SCAN_OFFLOAD_START,
 				REASON_CONNECT);
 	}
-#endif
 }
 
 /**
@@ -2570,9 +2551,9 @@ CDF_STATUS csr_neighbor_roam_indicate_connect(
 		return CDF_STATUS_SUCCESS;
 	}
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	if (session->roamOffloadSynchParams.bRoamSynchInProgress &&
+	if (session->roam_synch_in_progress &&
 		(eSIR_ROAM_AUTH_STATUS_AUTHENTICATED ==
-		session->roamOffloadSynchParams.authStatus)) {
+		session->roam_synch_data->authStatus)) {
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_DEBUG,
 			"LFR3:csr_neighbor_roam_indicate_connect");
 		msg = cdf_mem_malloc(sizeof(tSirSetActiveModeSetBncFilterReq));
@@ -2588,10 +2569,15 @@ CDF_STATUS csr_neighbor_roam_indicate_connect(
 		cdf_copy_macaddr(&roamInfo.peerMac,
 			&session->connectedProfile.bssid);
 		roamInfo.roamSynchInProgress =
-			session->roamOffloadSynchParams.bRoamSynchInProgress;
+			session->roam_synch_in_progress;
 		csr_roam_call_callback(pMac, session_id, &roamInfo, 0,
 			eCSR_ROAM_SET_KEY_COMPLETE,
 			eCSR_ROAM_RESULT_AUTHENTICATED);
+		csr_neighbor_roam_reset_init_state_control_info(pMac,
+			session_id);
+		csr_neighbor_roam_info_ctx_init(pMac, session_id);
+
+		return status;
 	}
 #endif
 
@@ -2812,10 +2798,8 @@ CDF_STATUS csr_neighbor_roam_init(tpAniSirGlobal pMac, uint8_t sessionId)
 		pNeighborRoamInfo->cfgParams.nRoamBmissFinalBcnt;
 	pNeighborRoamInfo->currentRoamBeaconRssiWeight =
 		pNeighborRoamInfo->cfgParams.nRoamBeaconRssiWeight;
-#ifdef FEATURE_WLAN_LFR
 	cdf_mem_set(&pNeighborRoamInfo->prevConnProfile,
 		    sizeof(tCsrRoamConnectedProfile), 0);
-#endif
 
 	status = csr_ll_open(pMac->hHdd, &pNeighborRoamInfo->roamableAPList);
 	if (CDF_STATUS_SUCCESS != status) {
@@ -2906,9 +2890,7 @@ void csr_neighbor_roam_close(tpAniSirGlobal pMac, uint8_t sessionId)
 
 	/* Free the profile.. */
 	csr_release_profile(pMac, &pNeighborRoamInfo->csrNeighborRoamProfile);
-#ifdef FEATURE_WLAN_LFR
-	csr_roam_free_connect_profile(pMac, &pNeighborRoamInfo->prevConnProfile);
-#endif
+	csr_roam_free_connect_profile(&pNeighborRoamInfo->prevConnProfile);
 #ifdef WLAN_FEATURE_VOWIFI_11R
 	pNeighborRoamInfo->FTRoamInfo.currentNeighborRptRetryNum = 0;
 	pNeighborRoamInfo->FTRoamInfo.numBssFromNeighborReport = 0;
@@ -3046,7 +3028,7 @@ bool csr_neighbor_roam_is_handoff_in_progress(tpAniSirGlobal pMac, uint8_t sessi
 	return false;
 }
 
-#if defined(WLAN_FEATURE_VOWIFI_11R) || defined(WLAN_FEATURE_NEIGHBOR_ROAMING)
+#if defined(WLAN_FEATURE_VOWIFI_11R)
 /* ---------------------------------------------------------------------------
 
     \fn csr_neighbor_roam_is11r_assoc
@@ -3116,7 +3098,6 @@ bool csr_neighbor_roam_get_handoff_ap_info(tpAniSirGlobal pMac,
 			preAuthDoneList));
 	} else
 #endif
-#ifdef FEATURE_WLAN_LFR
 	if (csr_roam_is_fast_roam_enabled(pMac, session_id)) {
 		/* Always the BSS info in the head is the handoff candidate */
 		bss_node =
@@ -3127,9 +3108,7 @@ bool csr_neighbor_roam_get_handoff_ap_info(tpAniSirGlobal pMac,
 			FL("Number of Handoff candidates = %d"),
 			csr_ll_count(
 				&ngbr_roam_info->FTRoamInfo.preAuthDoneList));
-	} else
-#endif
-	{
+	} else {
 		bss_node =
 			csr_neighbor_roam_next_roamable_ap(pMac,
 				&ngbr_roam_info->roamableAPList,
@@ -3553,4 +3532,3 @@ CDF_STATUS csr_neighbor_roam_start_lfr_scan(tpAniSirGlobal pMac, uint8_t session
 
 	return CDF_STATUS_SUCCESS;
 }
-#endif /* WLAN_FEATURE_NEIGHBOR_ROAMING */
diff --git a/core/sme/src/csr/csr_tdls_process.c b/core/sme/src/csr/csr_tdls_process.c
index 802f7cb6e00e..e800fad1c037 100644
--- a/core/sme/src/csr/csr_tdls_process.c
+++ b/core/sme/src/csr/csr_tdls_process.c
@@ -411,11 +411,11 @@ CDF_STATUS csr_tdls_process_send_mgmt(tpAniSirGlobal pMac, tSmeCmd *cmd)
 	tdlsSendMgmtReq->responder = tdlsSendMgmtCmdInfo->responder;
 	tdlsSendMgmtReq->peerCapability = tdlsSendMgmtCmdInfo->peerCapability;
 
-	cdf_mem_copy(tdlsSendMgmtReq->bssid,
-		     pSession->pConnectBssDesc->bssId, sizeof(tSirMacAddr));
+	cdf_mem_copy(tdlsSendMgmtReq->bssid.bytes,
+		     pSession->pConnectBssDesc->bssId, CDF_MAC_ADDR_SIZE);
 
-	cdf_mem_copy(tdlsSendMgmtReq->peerMac,
-		     tdlsSendMgmtCmdInfo->peerMac, sizeof(tSirMacAddr));
+	cdf_mem_copy(tdlsSendMgmtReq->peer_mac.bytes,
+		     tdlsSendMgmtCmdInfo->peerMac, CDF_MAC_ADDR_SIZE);
 
 	if (tdlsSendMgmtCmdInfo->len && tdlsSendMgmtCmdInfo->buf) {
 		cdf_mem_copy(tdlsSendMgmtReq->addIe, tdlsSendMgmtCmdInfo->buf,
diff --git a/core/sme/src/csr/csr_util.c b/core/sme/src/csr/csr_util.c
index a6796d9adc92..dfecf1bc92e3 100644
--- a/core/sme/src/csr/csr_util.c
+++ b/core/sme/src/csr/csr_util.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -97,7 +97,6 @@ uint8_t csr_wapi_oui[][CSR_WAPI_OUI_SIZE] = {
 uint8_t csr_wme_info_oui[CSR_WME_OUI_SIZE] = { 0x00, 0x50, 0xf2, 0x02 };
 uint8_t csr_wme_parm_oui[CSR_WME_OUI_SIZE] = { 0x00, 0x50, 0xf2, 0x02 };
 
-
 /* ////////////////////////////////////////////////////////////////////// */
 
 /**
@@ -179,14 +178,61 @@ const char *get_e_roam_cmd_status_str(eRoamCmdStatus val)
 {
 	switch (val) {
 		CASE_RETURN_STR(eCSR_ROAM_CANCELLED);
+		CASE_RETURN_STR(eCSR_ROAM_FAILED);
 		CASE_RETURN_STR(eCSR_ROAM_ROAMING_START);
 		CASE_RETURN_STR(eCSR_ROAM_ROAMING_COMPLETION);
+		CASE_RETURN_STR(eCSR_ROAM_CONNECT_COMPLETION);
 		CASE_RETURN_STR(eCSR_ROAM_ASSOCIATION_START);
 		CASE_RETURN_STR(eCSR_ROAM_ASSOCIATION_COMPLETION);
 		CASE_RETURN_STR(eCSR_ROAM_DISASSOCIATED);
+		CASE_RETURN_STR(eCSR_ROAM_ASSOCIATION_FAILURE);
 		CASE_RETURN_STR(eCSR_ROAM_SHOULD_ROAM);
 		CASE_RETURN_STR(eCSR_ROAM_SCAN_FOUND_NEW_BSS);
 		CASE_RETURN_STR(eCSR_ROAM_LOSTLINK);
+		CASE_RETURN_STR(eCSR_ROAM_LOSTLINK_DETECTED);
+		CASE_RETURN_STR(eCSR_ROAM_MIC_ERROR_IND);
+		CASE_RETURN_STR(eCSR_ROAM_IBSS_IND);
+		CASE_RETURN_STR(eCSR_ROAM_CONNECT_STATUS_UPDATE);
+		CASE_RETURN_STR(eCSR_ROAM_GEN_INFO);
+		CASE_RETURN_STR(eCSR_ROAM_SET_KEY_COMPLETE);
+		CASE_RETURN_STR(eCSR_ROAM_IBSS_LEAVE);
+		CASE_RETURN_STR(eCSR_ROAM_INFRA_IND);
+		CASE_RETURN_STR(eCSR_ROAM_WPS_PBC_PROBE_REQ_IND);
+#ifdef WLAN_FEATURE_VOWIFI_11R
+		CASE_RETURN_STR(eCSR_ROAM_FT_RESPONSE);
+#endif
+		CASE_RETURN_STR(eCSR_ROAM_FT_START);
+		CASE_RETURN_STR(eCSR_ROAM_REMAIN_CHAN_READY);
+		CASE_RETURN_STR(eCSR_ROAM_SEND_ACTION_CNF);
+		CASE_RETURN_STR(eCSR_ROAM_SESSION_OPENED);
+		CASE_RETURN_STR(eCSR_ROAM_FT_REASSOC_FAILED);
+#ifdef FEATURE_WLAN_LFR
+		CASE_RETURN_STR(eCSR_ROAM_PMK_NOTIFY);
+#endif
+#ifdef FEATURE_WLAN_LFR_METRICS
+		CASE_RETURN_STR(eCSR_ROAM_PREAUTH_INIT_NOTIFY);
+		CASE_RETURN_STR(eCSR_ROAM_PREAUTH_STATUS_SUCCESS);
+		CASE_RETURN_STR(eCSR_ROAM_PREAUTH_STATUS_FAILURE);
+		CASE_RETURN_STR(eCSR_ROAM_HANDOVER_SUCCESS);
+#endif
+#ifdef FEATURE_WLAN_TDLS
+		CASE_RETURN_STR(eCSR_ROAM_TDLS_STATUS_UPDATE);
+		CASE_RETURN_STR(eCSR_ROAM_RESULT_MGMT_TX_COMPLETE_IND);
+#endif
+		CASE_RETURN_STR(eCSR_ROAM_DISCONNECT_ALL_P2P_CLIENTS);
+		CASE_RETURN_STR(eCSR_ROAM_SEND_P2P_STOP_BSS);
+#ifdef WLAN_FEATURE_11W
+		CASE_RETURN_STR(eCSR_ROAM_UNPROT_MGMT_FRAME_IND);
+#endif
+#ifdef WLAN_FEATURE_RMC
+		CASE_RETURN_STR(eCSR_ROAM_IBSS_PEER_INFO_COMPLETE);
+#endif
+#if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
+		CASE_RETURN_STR(eCSR_ROAM_TSM_IE_IND);
+		CASE_RETURN_STR(eCSR_ROAM_CCKM_PREAUTH_NOTIFY);
+		CASE_RETURN_STR(eCSR_ROAM_ESE_ADJ_AP_REPORT_IND);
+		CASE_RETURN_STR(eCSR_ROAM_ESE_BCN_REPORT_IND);
+#endif /* FEATURE_WLAN_ESE && FEATURE_WLAN_ESE_UPLOAD */
 	default:
 		return "unknown";
 	}
@@ -403,7 +449,7 @@ uint8_t csr_get_concurrent_operation_channel(tpAniSirGlobal mac_ctx)
 {
 	tCsrRoamSession *session = NULL;
 	uint8_t i = 0;
-	tCDF_CON_MODE persona;
+	enum tCDF_ADAPTER_MODE persona;
 
 	for (i = 0; i < CSR_ROAM_SESSION_MAX; i++) {
 		if (!CSR_IS_SESSION_VALID(mac_ctx, i))
@@ -704,7 +750,7 @@ uint16_t csr_check_concurrent_channel_overlap(tpAniSirGlobal mac_ctx,
 					CDF_SAP_MODE)) &&
 				(session->connectState !=
 					eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED)) {
-				if (pSession->ch_switch_in_progress)
+				if (session->ch_switch_in_progress)
 					continue;
 
 				csr_handle_conc_chnl_overlap_for_sap_go(mac_ctx,
@@ -807,7 +853,7 @@ bool csr_is_p2p_session_connected(tpAniSirGlobal pMac)
 {
 	uint32_t i;
 	tCsrRoamSession *pSession = NULL;
-	tCDF_CON_MODE persona;
+	enum tCDF_ADAPTER_MODE persona;
 
 	for (i = 0; i < CSR_ROAM_SESSION_MAX; i++) {
 		if (CSR_IS_SESSION_VALID(pMac, i)
@@ -893,22 +939,6 @@ bool csr_is_ibss_started(tpAniSirGlobal pMac)
 	return fRc;
 }
 
-bool csr_is_btamp_started(tpAniSirGlobal pMac)
-{
-	uint32_t i;
-	bool fRc = false;
-
-	for (i = 0; i < CSR_ROAM_SESSION_MAX; i++) {
-		if (CSR_IS_SESSION_VALID(pMac, i)
-		    && csr_is_conn_state_connected_wds(pMac, i)) {
-			fRc = true;
-			break;
-		}
-	}
-
-	return fRc;
-}
-
 bool csr_is_concurrent_session_running(tpAniSirGlobal pMac)
 {
 	uint32_t sessionId, noOfCocurrentSession = 0;
@@ -954,11 +984,6 @@ bool csr_is_infra_ap_started(tpAniSirGlobal pMac)
 
 }
 
-bool csr_is_btamp(tpAniSirGlobal pMac, uint32_t sessionId)
-{
-	return csr_is_conn_state_connected_wds(pMac, sessionId);
-}
-
 bool csr_is_conn_state_disconnected(tpAniSirGlobal pMac, uint32_t sessionId)
 {
 	return eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED ==
@@ -1861,10 +1886,10 @@ bool csr_is_profile_rsn(tCsrRoamProfile *pProfile)
  */
 CDF_STATUS
 csr_isconcurrentsession_valid(tpAniSirGlobal mac_ctx, uint32_t cur_sessionid,
-			      tCDF_CON_MODE cur_bss_persona)
+			      enum tCDF_ADAPTER_MODE cur_bss_persona)
 {
 	uint32_t sessionid = 0;
-	tCDF_CON_MODE bss_persona;
+	enum tCDF_ADAPTER_MODE bss_persona;
 	eCsrConnectState connect_state, temp;
 	tCsrRoamSession *roam_session;
 
@@ -1886,37 +1911,20 @@ csr_isconcurrentsession_valid(tpAniSirGlobal mac_ctx, uint32_t cur_sessionid,
 
 		case CDF_SAP_MODE:
 			temp = eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED;
-#ifndef WLAN_FEATURE_MBSSID
-			if ((bss_persona == CDF_SAP_MODE) &&
-					(connect_state !=
-					 eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED)) {
+			if ((bss_persona == CDF_IBSS_MODE)
+				&& (connect_state != temp)) {
+				/* allow IBSS+SAP for Emulation only */
+#ifndef QCA_WIFI_3_0_EMU
 				CDF_TRACE(CDF_MODULE_ID_SME,
 						CDF_TRACE_LEVEL_ERROR,
-						FL("sap mode already exist"));
+						FL("Can't start SAP"));
 				return CDF_STATUS_E_FAILURE;
-			} else
 #endif
-				if ((bss_persona == CDF_IBSS_MODE)
-					&& (connect_state != temp)) {
-					CDF_TRACE(CDF_MODULE_ID_SME,
-							CDF_TRACE_LEVEL_ERROR,
-							FL("Can't start GO"));
-					return CDF_STATUS_E_FAILURE;
-				}
+			}
 			break;
 
 		case CDF_P2P_GO_MODE:
 			temp = eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED;
-#ifndef WLAN_FEATURE_MBSSID
-			if ((bss_persona == CDF_P2P_GO_MODE) &&
-					(connect_state !=
-					 eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED)) {
-				CDF_TRACE(CDF_MODULE_ID_SME,
-						CDF_TRACE_LEVEL_ERROR,
-						FL("GO mode already exists"));
-				return CDF_STATUS_E_FAILURE;
-			}
-#endif
 			if ((bss_persona == CDF_IBSS_MODE)
 					&& (connect_state != temp)) {
 				CDF_TRACE(CDF_MODULE_ID_SME,
@@ -1926,7 +1934,8 @@ csr_isconcurrentsession_valid(tpAniSirGlobal mac_ctx, uint32_t cur_sessionid,
 			}
 			break;
 		case CDF_IBSS_MODE:
-			if ((bss_persona == CDF_IBSS_MODE) && (connect_state !=
+			if ((bss_persona == CDF_IBSS_MODE) &&
+				(connect_state ==
 					eCSR_ASSOC_STATE_TYPE_IBSS_CONNECTED)) {
 				CDF_TRACE(CDF_MODULE_ID_SME,
 						CDF_TRACE_LEVEL_ERROR,
@@ -1936,10 +1945,13 @@ csr_isconcurrentsession_valid(tpAniSirGlobal mac_ctx, uint32_t cur_sessionid,
 					(bss_persona == CDF_SAP_MODE)) &&
 					(connect_state !=
 					 eCSR_ASSOC_STATE_TYPE_NOT_CONNECTED)) {
+				/* allow IBSS+SAP for Emulation only */
+#ifndef QCA_WIFI_3_0_EMU
 				CDF_TRACE(CDF_MODULE_ID_SME,
 						CDF_TRACE_LEVEL_ERROR,
-						FL("Can't start GO"));
+						FL("Can't start GO/SAP"));
 				return CDF_STATUS_E_FAILURE;
+#endif
 			}
 			break;
 		case CDF_P2P_CLIENT_MODE:
@@ -2062,10 +2074,11 @@ uint16_t csr_calculate_mcc_beacon_interval(tpAniSirGlobal pMac, uint16_t sta_bi,
 	return go_fbi;
 }
 
-CDF_STATUS csr_validate_mcc_beacon_interval(tpAniSirGlobal pMac, uint8_t channelId,
-					    uint16_t *beaconInterval,
-					    uint32_t cursessionId,
-					    tCDF_CON_MODE currBssPersona)
+CDF_STATUS csr_validate_mcc_beacon_interval(tpAniSirGlobal pMac,
+					uint8_t channelId,
+					uint16_t *beaconInterval,
+					uint32_t cursessionId,
+					enum tCDF_ADAPTER_MODE currBssPersona)
 {
 	uint32_t sessionId = 0;
 	uint16_t new_beaconInterval = 0;
@@ -2252,6 +2265,7 @@ CDF_STATUS csr_validate_mcc_beacon_interval(tpAniSirGlobal pMac, uint8_t channel
 				break;
 
 			case CDF_SAP_MODE:
+			case CDF_IBSS_MODE:
 				break;
 
 			case CDF_P2P_GO_MODE:
@@ -3713,16 +3727,13 @@ uint8_t csr_retrieve_rsn_ie(tHalHandle hHal, uint32_t sessionId,
 	do {
 		if (!csr_is_profile_rsn(pProfile))
 			break;
-#ifdef FEATURE_WLAN_LFR
 		if (csr_roam_is_fast_roam_enabled(pMac, sessionId)) {
 			/* If "Legacy Fast Roaming" is enabled ALWAYS rebuild the RSN IE from */
 			/* scratch. So it contains the current PMK-IDs */
 			cbRsnIe =
 				csr_construct_rsn_ie(pMac, sessionId, pProfile,
 						     pSirBssDesc, pIes, pRsnIe);
-		} else
-#endif
-		if (pProfile->nRSNReqIELength && pProfile->pRSNReqIE) {
+		} else if (pProfile->nRSNReqIELength && pProfile->pRSNReqIE) {
 			/* If you have one started away, re-use it. */
 			if (SIR_MAC_WPA_IE_MAX_LENGTH >=
 			    pProfile->nRSNReqIELength) {
@@ -4371,12 +4382,6 @@ bool csr_is_bss_type_ibss(eCsrRoamBssType bssType)
 		 || eCSR_BSS_TYPE_IBSS == bssType);
 }
 
-bool csr_is_bss_type_wds(eCsrRoamBssType bssType)
-{
-	return (bool)
-		(eCSR_BSS_TYPE_WDS_STA == bssType
-		 || eCSR_BSS_TYPE_WDS_AP == bssType);
-}
 
 bool csr_is_bss_type_caps_match(eCsrRoamBssType bssType,
 				tSirBssDescription *pSirBssDesc)
@@ -4389,10 +4394,8 @@ bool csr_is_bss_type_caps_match(eCsrRoamBssType bssType,
 			break;
 
 		case eCSR_BSS_TYPE_INFRASTRUCTURE:
-		case eCSR_BSS_TYPE_WDS_STA:
 			if (!csr_is_infra_bss_desc(pSirBssDesc))
 				fMatch = false;
-
 			break;
 
 		case eCSR_BSS_TYPE_IBSS:
@@ -4401,8 +4404,6 @@ bool csr_is_bss_type_caps_match(eCsrRoamBssType bssType,
 				fMatch = false;
 
 			break;
-
-		case eCSR_BSS_TYPE_WDS_AP:      /* For WDS AP, no need to match anything */
 		default:
 			fMatch = false;
 			break;
@@ -5284,7 +5285,7 @@ tSirResultCodes csr_get_de_auth_rsp_status_code(tSirSmeDeauthRsp *pSmeRsp)
 tSirScanType csr_get_scan_type(tpAniSirGlobal pMac, uint8_t chnId)
 {
 	tSirScanType scanType = eSIR_PASSIVE_SCAN;
-	CHANNEL_STATE channelEnabledType;
+	enum channel_state channelEnabledType;
 
 	channelEnabledType = cds_get_channel_state(chnId);
 	if (CHANNEL_STATE_ENABLE == channelEnabledType) {
@@ -5317,12 +5318,6 @@ tSirBssType csr_translate_bsstype_to_mac_type(eCsrRoamBssType csrtype)
 	case eCSR_BSS_TYPE_START_IBSS:
 		ret = eSIR_IBSS_MODE;
 		break;
-	case eCSR_BSS_TYPE_WDS_AP:
-		ret = eSIR_BTAMP_AP_MODE;
-		break;
-	case eCSR_BSS_TYPE_WDS_STA:
-		ret = eSIR_BTAMP_STA_MODE;
-		break;
 	case eCSR_BSS_TYPE_INFRA_AP:
 		ret = eSIR_INFRA_AP_MODE;
 		break;
@@ -5400,13 +5395,14 @@ eCsrCfgDot11Mode csr_get_cfg_dot11_mode_from_csr_phy_mode(tCsrRoamProfile *pProf
 	return cfgDot11Mode;
 }
 
-CDF_STATUS csr_get_regulatory_domain_for_country
-	(tpAniSirGlobal pMac,
-	uint8_t *pCountry,
-	v_REGDOMAIN_t *pDomainId, v_CountryInfoSource_t source) {
+CDF_STATUS csr_get_regulatory_domain_for_country(tpAniSirGlobal pMac,
+						 uint8_t *pCountry,
+						 v_REGDOMAIN_t *pDomainId,
+						 enum country_src source)
+{
 	CDF_STATUS status = CDF_STATUS_E_INVAL;
 	CDF_STATUS cdf_status;
-	country_code_t countryCode;
+	uint8_t countryCode[CDS_COUNTRY_CODE_LEN + 1];
 	v_REGDOMAIN_t domainId;
 
 	if (pCountry) {
@@ -5539,9 +5535,8 @@ uint16_t sme_chn_to_freq(uint8_t chanNum)
 	int i;
 
 	for (i = 0; i < NUM_RF_CHANNELS; i++) {
-		if (rf_channels[i].channelNum == chanNum) {
-			return rf_channels[i].targetFreq;
-		}
+		if (CDS_CHANNEL_NUM(i) == chanNum)
+			return CDS_CHANNEL_FREQ(i);
 	}
 
 	return 0;
@@ -5570,7 +5565,6 @@ void csr_disconnect_all_active_sessions(tpAniSirGlobal pMac)
 	}
 }
 
-#ifdef FEATURE_WLAN_LFR
 bool csr_is_channel_present_in_list(uint8_t *pChannelList,
 				    int numChannels, uint8_t channel)
 {
@@ -5590,6 +5584,27 @@ bool csr_is_channel_present_in_list(uint8_t *pChannelList,
 	return false;
 }
 
+/**
+ * sme_request_type_to_string(): converts scan request enum to string.
+ * @request_type: scan request type enum.
+ *
+ * Return: Printable string for request_type
+ */
+const char *sme_request_type_to_string(const uint8_t request_type)
+{
+	switch (request_type) {
+	CASE_RETURN_STRING(eCSR_SCAN_REQUEST_11D_SCAN);
+	CASE_RETURN_STRING(eCSR_SCAN_REQUEST_FULL_SCAN);
+	CASE_RETURN_STRING(eCSR_SCAN_IDLE_MODE_SCAN);
+	CASE_RETURN_STRING(eCSR_SCAN_HO_PROBE_SCAN);
+	CASE_RETURN_STRING(eCSR_SCAN_P2P_DISCOVERY);
+	CASE_RETURN_STRING(eCSR_SCAN_SOFTAP_CHANNEL_RANGE);
+	CASE_RETURN_STRING(eCSR_SCAN_P2P_FIND_PEER);
+	default:
+		return "Unknown Scan Request Type";
+	}
+}
+
 CDF_STATUS csr_add_to_channel_list_front(uint8_t *pChannelList,
 					 int numChannels, uint8_t channel)
 {
@@ -5609,7 +5624,6 @@ CDF_STATUS csr_add_to_channel_list_front(uint8_t *pChannelList,
 
 	return CDF_STATUS_SUCCESS;
 }
-#endif
 #ifdef FEATURE_WLAN_DIAG_SUPPORT
 /**
  * csr_diag_event_report() - send PE diag event
@@ -5682,3 +5696,24 @@ bool csr_wait_for_connection_update(tpAniSirGlobal mac,
 
 	return true;
 }
+
+/**
+ * csr_get_session_persona() - get persona of a session
+ * @pmac: pointer to global MAC context
+ * @session_id: session id
+ *
+ * This function is to return the persona of a session
+ *
+ * Reture: enum tCDF_ADAPTER_MODE persona
+ */
+enum tCDF_ADAPTER_MODE csr_get_session_persona(tpAniSirGlobal pmac,
+						uint32_t session_id)
+{
+	tCsrRoamSession *session = NULL;
+
+	session = CSR_GET_SESSION(pmac, session_id);
+	if (NULL == session || NULL == session->pCurRoamProfile)
+		return CDF_MAX_NO_OF_MODE;
+
+	return session->pCurRoamProfile->csrPersona;
+}
diff --git a/core/sme/src/oem_data/oem_data_api.c b/core/sme/src/oem_data/oem_data_api.c
index 385b77d4bc32..2678d0af6b25 100644
--- a/core/sme/src/oem_data/oem_data_api.c
+++ b/core/sme/src/oem_data/oem_data_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -89,6 +89,7 @@ CDF_STATUS oem_data_oem_data_req_close(tHalHandle hHal)
 
 		/* initialize all the variables to null */
 		cdf_mem_set(&(pMac->oemData), sizeof(tOemDataStruct), 0);
+
 	} while (0);
 
 	return CDF_STATUS_SUCCESS;
@@ -108,8 +109,13 @@ void oem_data_release_oem_data_req_command(tpAniSirGlobal pMac,
 	/* First take this command out of the active list */
 	if (csr_ll_remove_entry
 		    (&pMac->sme.smeCmdActiveList, &pOemDataCmd->Link, LL_ACCESS_LOCK)) {
-		cdf_mem_set(&(pOemDataCmd->u.oemDataCmd), sizeof(tOemDataCmd),
-			    0);
+		if (pOemDataCmd->u.oemDataCmd.oemDataReq.data) {
+			cdf_mem_free(
+			    pOemDataCmd->u.oemDataCmd.oemDataReq.data);
+			pOemDataCmd->u.oemDataCmd.oemDataReq.data =
+			    NULL;
+		}
+		cdf_mem_zero(&(pOemDataCmd->u.oemDataCmd), sizeof(tOemDataCmd));
 
 		/* Now put this command back on the avilable command list */
 		sme_release_command(pMac, pOemDataCmd);
@@ -124,20 +130,17 @@ void oem_data_release_oem_data_req_command(tpAniSirGlobal pMac,
     \brief Request an OEM DATA RSP
     \param sessionId - Id of session to be used
     \param pOemDataReqID - pointer to an object to get back the request ID
-    \param callback - a callback function that is called upon finish
-    \param pContext - a pointer passed in for the callback
     \return CDF_STATUS
    -------------------------------------------------------------------------------*/
 CDF_STATUS oem_data_oem_data_req(tHalHandle hHal,
 				 uint8_t sessionId,
 				 tOemDataReqConfig *oemDataReqConfig,
-				 uint32_t *pOemDataReqID,
-				 oem_data_oem_data_reqCompleteCallback callback,
-				 void *pContext)
+				 uint32_t *pOemDataReqID)
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
 	tSmeCmd *pOemDataCmd = NULL;
+	tOemDataReq *cmd_req, *mac_req;
 
 	do {
 		if (!CSR_IS_SESSION_VALID(pMac, sessionId)) {
@@ -146,14 +149,27 @@ CDF_STATUS oem_data_oem_data_req(tHalHandle hHal,
 		}
 
 		pMac->oemData.oemDataReqConfig.sessionId = sessionId;
-		pMac->oemData.callback = callback;
-		pMac->oemData.pContext = pContext;
 		pMac->oemData.oemDataReqID = *(pOemDataReqID);
 
-		cdf_mem_copy((void *)(pMac->oemData.oemDataReqConfig.
-				      oemDataReq),
-			     (void *)(oemDataReqConfig->oemDataReq),
-			     OEM_DATA_REQ_SIZE);
+		pMac->oemData.oemDataReqConfig.data_len =
+				oemDataReqConfig->data_len;
+
+		if (pMac->oemData.oemDataReqConfig.data) {
+			cdf_mem_free(pMac->oemData.oemDataReqConfig.data);
+			pMac->oemData.oemDataReqConfig.data = NULL;
+		}
+
+		pMac->oemData.oemDataReqConfig.data =
+			cdf_mem_malloc(pMac->oemData.oemDataReqConfig.data_len);
+		if (!pMac->oemData.oemDataReqConfig.data) {
+			sms_log(pMac, LOGE, FL("memory alloc failed"));
+			status = CDF_STATUS_E_NOMEM;
+			break;
+		}
+
+		cdf_mem_copy((void *)(pMac->oemData.oemDataReqConfig.data),
+			     (void *)(oemDataReqConfig->data),
+			     oemDataReqConfig->data_len);
 
 		pMac->oemData.oemDataReqActive = false;
 
@@ -162,18 +178,26 @@ CDF_STATUS oem_data_oem_data_req(tHalHandle hHal,
 		/* fill up the command before posting it. */
 		if (pOemDataCmd) {
 			pOemDataCmd->command = eSmeCommandOemDataReq;
-			pOemDataCmd->u.oemDataCmd.callback = callback;
-			pOemDataCmd->u.oemDataCmd.pContext = pContext;
 			pOemDataCmd->u.oemDataCmd.oemDataReqID =
 				pMac->oemData.oemDataReqID;
 
+
+			cmd_req = &(pOemDataCmd->u.oemDataCmd.oemDataReq);
+			mac_req = &(pMac->oemData.oemDataReqConfig);
 			/* set the oem data request */
-			pOemDataCmd->u.oemDataCmd.oemDataReq.sessionId =
-				pMac->oemData.oemDataReqConfig.sessionId;
-			cdf_mem_copy((void *)(pOemDataCmd->u.oemDataCmd.
-					      oemDataReq.oemDataReq),
-				     (void *)(pMac->oemData.oemDataReqConfig.
-					      oemDataReq), OEM_DATA_REQ_SIZE);
+			cmd_req->sessionId = mac_req->sessionId;
+			cmd_req->data_len =  mac_req->data_len;
+			cmd_req->data = cdf_mem_malloc(cmd_req->data_len);
+
+			if (!cmd_req->data) {
+				sms_log(pMac, LOGE, FL("memory alloc failed"));
+				status = CDF_STATUS_E_NOMEM;
+				break;
+			}
+
+			cdf_mem_copy((void *)(cmd_req->data),
+				     (void *)(mac_req->data),
+				     cmd_req->data_len);
 		} else {
 			status = CDF_STATUS_E_FAILURE;
 			break;
@@ -207,25 +231,36 @@ CDF_STATUS oem_data_send_mb_oem_data_req(tpAniSirGlobal pMac,
 {
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	tSirOemDataReq *pMsg;
-	uint16_t msgLen;
 	tCsrRoamSession *pSession =
 		CSR_GET_SESSION(pMac, pOemDataReq->sessionId);
+	uint16_t msgLen;
 
 	sms_log(pMac, LOGW, "OEM_DATA: entering Function %s", __func__);
 
-	msgLen = (uint16_t) (sizeof(tSirOemDataReq));
+	if (!pOemDataReq) {
+		sms_log(pMac, LOGE, FL("oem data req is NULL"));
+		return CDF_STATUS_E_INVAL;
+	}
 
-	pMsg = cdf_mem_malloc(msgLen);
+	pMsg = cdf_mem_malloc(sizeof(*pMsg));
 	if (NULL == pMsg) {
 		sms_log(pMac, LOGP, FL("cdf_mem_malloc failed"));
 		return CDF_STATUS_E_NOMEM;
 	}
-	cdf_mem_set(pMsg, msgLen, 0);
+	pMsg->data = cdf_mem_malloc(pOemDataReq->data_len);
+	if (!pMsg->data) {
+		sms_log(pMac, LOGP, FL("cdf_mem_malloc failed"));
+		cdf_mem_free(pMsg);
+		return CDF_STATUS_E_NOMEM;
+	}
+
+	msgLen = (uint16_t) (sizeof(*pMsg) + pOemDataReq->data_len);
 	pMsg->messageType = eWNI_SME_OEM_DATA_REQ;
 	pMsg->messageLen = msgLen;
 	cdf_copy_macaddr(&pMsg->selfMacAddr, &pSession->selfMacAddr);
-	cdf_mem_copy(pMsg->oemDataReq, pOemDataReq->oemDataReq,
-		     OEM_DATA_REQ_SIZE);
+	pMsg->data_len = pOemDataReq->data_len;
+	cdf_mem_copy(pMsg->data, pOemDataReq->data,
+		     pOemDataReq->data_len);
 	sms_log(pMac, LOGW, "OEM_DATA: sending message to pe%s", __func__);
 	status = cds_send_mb_message_to_mac(pMsg);
 
@@ -298,7 +333,7 @@ CDF_STATUS sme_handle_oem_data_rsp(tHalHandle hHal, uint8_t *pMsg)
 	tListElem *pEntry = NULL;
 	tSmeCmd *pCommand = NULL;
 	tSirOemDataRsp *pOemDataRsp = NULL;
-	uint32_t *msgSubType;
+	tOemDataReq *req;
 
 	pMac = PMAC_STRUCT(hHal);
 
@@ -327,6 +362,9 @@ CDF_STATUS sme_handle_oem_data_rsp(tHalHandle hHal, uint8_t *pMsg)
 					    &pCommand->Link, LL_ACCESS_LOCK)) {
 					cdf_mem_set(&(pCommand->u.oemDataCmd),
 						    sizeof(tOemDataCmd), 0);
+					req =
+					   &(pCommand->u.oemDataCmd.oemDataReq);
+					cdf_mem_free(req->data);
 					sme_release_command(pMac, pCommand);
 				}
 			}
@@ -334,21 +372,18 @@ CDF_STATUS sme_handle_oem_data_rsp(tHalHandle hHal, uint8_t *pMsg)
 
 		pOemDataRsp = (tSirOemDataRsp *) pMsg;
 
-		/* check if message is to be forwarded to oem application or not */
-		msgSubType = (uint32_t *) (&pOemDataRsp->oemDataRsp[0]);
-		if (*msgSubType != OEM_MESSAGE_SUBTYPE_INTERNAL) {
-			CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO,
-				  "%s: calling send_oem_data_rsp_msg, msgSubType(0x%x)",
-				  __func__, *msgSubType);
-			if (pMac->oemData.oem_data_rsp_callback != NULL) {
-				pMac->oemData.oem_data_rsp_callback(
-						sizeof(tOemDataRsp),
-						&pOemDataRsp->oemDataRsp[0]);
-			}
-		} else
-			CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO,
-				  "%s: received internal oem data resp, msgSubType (0x%x)",
-				  __func__, *msgSubType);
+		/* Send to upper layer only if rsp is from target */
+		if (pOemDataRsp->target_rsp) {
+			sms_log(pMac, LOG1,
+				FL("received target oem data resp"));
+			if (pMac->oemData.oem_data_rsp_callback != NULL)
+				 pMac->oemData.oem_data_rsp_callback(
+					sizeof(tOemDataRsp),
+					&pOemDataRsp->oemDataRsp[0]);
+		} else {
+			sms_log(pMac, LOG1,
+				FL("received internal oem data resp"));
+		}
 	} while (0);
 
 	return status;
@@ -369,12 +404,10 @@ CDF_STATUS oem_data_is_oem_data_req_allowed(tHalHandle hHal)
 
 	for (sessionId = 0; sessionId < CSR_ROAM_SESSION_MAX; sessionId++) {
 		if (CSR_IS_SESSION_VALID(pMac, sessionId)) {
-			/* co-exist with IBSS or BT-AMP mode is not supported */
-			if (csr_is_conn_state_ibss(pMac, sessionId)
-			    || csr_is_btamp(pMac, sessionId)) {
-				/* co-exist with IBSS or BT-AMP mode is not supported */
+			/* co-exist with IBSS mode is not supported */
+			if (csr_is_conn_state_ibss(pMac, sessionId)) {
 				sms_log(pMac, LOGW,
-					"OEM DATA REQ is not allowed due to IBSS|BTAMP exist in session %d",
+					"OEM DATA REQ is not allowed due to IBSS exist in session %d",
 					sessionId);
 				status = CDF_STATUS_CSR_WRONG_STATE;
 				break;
diff --git a/core/sme/src/p2p/p2p_api.c b/core/sme/src/p2p/p2p_api.c
index 36c17d435651..118f78ad3159 100644
--- a/core/sme/src/p2p/p2p_api.c
+++ b/core/sme/src/p2p/p2p_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -141,46 +141,6 @@ CDF_STATUS sme_remain_on_chn_rsp(tpAniSirGlobal pMac, uint8_t *pMsg)
 
 /*------------------------------------------------------------------
  *
- * Handle the Mgmt frm ind from LIM and forward to HDD.
- *
- *------------------------------------------------------------------*/
-
-CDF_STATUS sme_mgmt_frm_ind(tHalHandle hHal, tpSirSmeMgmtFrameInd pSmeMgmtFrm)
-{
-	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
-	CDF_STATUS status = CDF_STATUS_SUCCESS;
-	tCsrRoamInfo pRoamInfo = { 0 };
-	uint8_t i = 0;
-	uint32_t SessionId = pSmeMgmtFrm->sessionId;
-
-	pRoamInfo.nFrameLength =
-		pSmeMgmtFrm->mesgLen - sizeof(tSirSmeMgmtFrameInd);
-	pRoamInfo.pbFrames = pSmeMgmtFrm->frameBuf;
-	pRoamInfo.frameType = pSmeMgmtFrm->frameType;
-	pRoamInfo.rxChan = pSmeMgmtFrm->rxChan;
-	pRoamInfo.rxRssi = pSmeMgmtFrm->rxRssi;
-	if (CSR_IS_SESSION_ANY(SessionId)) {
-		for (i = 0; i < CSR_ROAM_SESSION_MAX; i++) {
-			if (CSR_IS_SESSION_VALID(pMac, i)) {
-				SessionId = i;
-				break;
-			}
-		}
-	}
-
-	if (i == CSR_ROAM_SESSION_MAX) {
-		sms_log(pMac, LOGE, FL("No valid sessions found."));
-		return CDF_STATUS_E_FAILURE;
-	}
-	/* forward the mgmt frame to HDD */
-	csr_roam_call_callback(pMac, SessionId, &pRoamInfo, 0,
-			       eCSR_ROAM_INDICATE_MGMT_FRAME, 0);
-
-	return status;
-}
-
-/*------------------------------------------------------------------
- *
  * Handle the remain on channel ready indication from PE
  *
  *------------------------------------------------------------------*/
diff --git a/core/sme/src/qos/sme_qos.c b/core/sme/src/qos/sme_qos.c
index 8d127fe29302..ac80f810a083 100644
--- a/core/sme/src/qos/sme_qos.c
+++ b/core/sme/src/qos/sme_qos.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -987,14 +987,12 @@ CDF_STATUS sme_qos_csr_event_ind(tpAniSirGlobal pMac,
 			sme_qos_process_preauth_success_ind(pMac, sessionId,
 							    pEvent_info);
 		break;
-#if defined(FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 	case SME_QOS_CSR_SET_KEY_SUCCESS_IND:
 		status =
 			sme_qos_process_set_key_success_ind(pMac, sessionId,
 							    pEvent_info);
 		break;
 #endif
-#endif
 	default:
 		/* Err msg */
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
@@ -2879,7 +2877,6 @@ sme_QosStatusType sme_qos_setup(tpAniSirGlobal pMac,
 	return status;
 }
 
-#if defined(FEATURE_WLAN_ESE) || defined(FEATURE_WLAN_LFR)
 /* This is a dummy function now. But the purpose of me adding this was to
  * delay the TSPEC processing till SET_KEY completes. This function can be
  * used to do any SME_QOS processing after the SET_KEY. As of now, it is
@@ -2894,7 +2891,6 @@ CDF_STATUS sme_qos_process_set_key_success_ind(tpAniSirGlobal pMac,
 	(void)sme_qos_process_buffered_cmd(sessionId);
 	return CDF_STATUS_SUCCESS;
 }
-#endif
 
 #ifdef FEATURE_WLAN_ESE
 /**
@@ -3476,7 +3472,7 @@ CDF_STATUS sme_qos_ft_aggr_qos_req(tpAniSirGlobal mac_ctx, uint8_t session_id)
 	aggr_req->sessionId = session_id;
 	aggr_req->timeout = 0;
 	aggr_req->rspReqd = true;
-	cdf_mem_copy(&aggr_req->bssId[0],
+	cdf_mem_copy(&aggr_req->bssid.bytes[0],
 		     &session->assocInfo.pBssDesc->bssId[0],
 		     sizeof(struct cdf_mac_addr));
 
@@ -3826,20 +3822,20 @@ CDF_STATUS sme_qos_process_ft_reassoc_rsp_ev(tpAniSirGlobal mac_ctx,
 				 csr_conn_info->nAssocRspLength));
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	if (!csr_session->roamOffloadSynchParams.bRoamSynchInProgress) {
+	if (!csr_session->roam_synch_in_progress) {
 #endif
-	for (ac = SME_QOS_EDCA_AC_BE; ac < SME_QOS_EDCA_AC_MAX; ac++) {
-		ac_info = &qos_session->ac_info[ac];
-		sme_qos_find_matching_tspec(mac_ctx, sessionid, ac,
-			ac_info, ric_data_desc, &ric_rsplen);
-	}
+		for (ac = SME_QOS_EDCA_AC_BE; ac < SME_QOS_EDCA_AC_MAX; ac++) {
+			ac_info = &qos_session->ac_info[ac];
+			sme_qos_find_matching_tspec(mac_ctx, sessionid, ac,
+					ac_info, ric_data_desc, &ric_rsplen);
+		}
 
-	if (ric_rsplen) {
-		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
-			  FL("RIC Response still follows despite traversing "
-			  "through all ACs. Remaining len = %d"), ric_rsplen);
-		CDF_ASSERT(0);
-	}
+		if (ric_rsplen) {
+			CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_ERROR,
+				FL("RIC Resp still follows . Rem len = %d"),
+				ric_rsplen);
+			CDF_ASSERT(0);
+		}
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 	} else {
 		CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO,
@@ -3969,7 +3965,7 @@ CDF_STATUS sme_qos_add_ts_req(tpAniSirGlobal pMac,
 		cdf_mem_free(pMsg);
 		return CDF_STATUS_E_FAILURE;
 	}
-	cdf_mem_copy(&pMsg->bssId[0],
+	cdf_mem_copy(&pMsg->bssid.bytes[0],
 		     &pSession->assocInfo.pBssDesc->bssId[0],
 		     sizeof(struct cdf_mac_addr));
 	CDF_TRACE(CDF_MODULE_ID_SME, CDF_TRACE_LEVEL_INFO_HIGH,
@@ -4079,7 +4075,7 @@ CDF_STATUS sme_qos_del_ts_req(tpAniSirGlobal pMac,
 		cdf_mem_free(pMsg);
 		return CDF_STATUS_E_FAILURE;
 	}
-	cdf_mem_copy(&pMsg->bssId[0],
+	cdf_mem_copy(&pMsg->bssid.bytes[0],
 		     &pSession->assocInfo.pBssDesc->bssId[0],
 		     sizeof(struct cdf_mac_addr));
 
diff --git a/core/utils/epping/inc/epping_internal.h b/core/utils/epping/inc/epping_internal.h
index ee32b4c7d4aa..0ea5d526558c 100644
--- a/core/utils/epping/inc/epping_internal.h
+++ b/core/utils/epping/inc/epping_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -104,7 +104,7 @@ typedef struct {
 } epping_poll_t;
 #endif
 
-typedef struct epping_context_s {
+typedef struct epping_context {
 	int32_t con_mode;
 	char *pwlan_module_name;
 	uint32_t target_type;
@@ -135,7 +135,7 @@ typedef enum {
 
 typedef struct epping_adapter_s {
 	epping_context_t *pEpping_ctx;
-	tCDF_CON_MODE device_mode;
+	enum tCDF_ADAPTER_MODE device_mode;
 	/** Handle to the network device */
 	struct net_device *dev;
 	struct cdf_mac_addr macAddressCurrent;
@@ -183,7 +183,7 @@ void epping_refill(void *ctx, HTC_ENDPOINT_ID Endpoint);
 /* epping_txrx signatures */
 epping_adapter_t *epping_add_adapter(epping_context_t *pEpping_ctx,
 				     tSirMacAddr macAddr,
-				     tCDF_CON_MODE device_mode);
+				     enum tCDF_ADAPTER_MODE device_mode);
 void epping_destroy_adapter(epping_adapter_t *pAdapter);
 int epping_connect_service(epping_context_t *pEpping_ctx);
 #ifdef HIF_PCI
diff --git a/core/utils/epping/src/epping_main.c b/core/utils/epping/src/epping_main.c
index c222c557d938..cfbf04cf1c1e 100644
--- a/core/utils/epping/src/epping_main.c
+++ b/core/utils/epping/src/epping_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -73,6 +73,8 @@
 #define WLAN_WAIT_TIME_WLANSTART 2000
 #endif
 
+static struct epping_context *g_epping_ctx;
+
 /**
  * epping_open(): End point ping driver open Function
  *
@@ -83,22 +85,17 @@
  */
 int epping_open(void)
 {
-	epping_context_t *pEpping_ctx;
-	v_CONTEXT_t cds_context;
-	CDF_STATUS status = CDF_STATUS_SUCCESS;
-
 	EPPING_LOG(CDF_TRACE_LEVEL_INFO_HIGH, "%s: Enter", __func__);
 
-	cds_context = cds_get_global_context();
-	status = cds_alloc_context(cds_context, CDF_MODULE_ID_EPPING,
-				       (void **)&pEpping_ctx,
-				       sizeof(*pEpping_ctx));
-	if (status != CDF_STATUS_SUCCESS) {
-		EPPING_LOG(CDF_TRACE_LEVEL_ERROR, "%s: cannot alloc epping context", __func__);
+	g_epping_ctx = cdf_mem_malloc(sizeof(*g_epping_ctx));
+
+	if (g_epping_ctx == NULL) {
+		EPPING_LOG(CDF_TRACE_LEVEL_ERROR,
+				"%s: cannot alloc epping context", __func__);
 		return -ENOMEM;
 	}
 
-	pEpping_ctx->con_mode = cds_get_conparam();
+	g_epping_ctx->con_mode = cds_get_conparam();
 	return 0;
 }
 
@@ -114,7 +111,7 @@ void epping_disable(void)
 {
 	epping_context_t *pEpping_ctx;
 
-	pEpping_ctx = cds_get_context(CDF_MODULE_ID_EPPING);
+	pEpping_ctx = g_epping_ctx;
 	if (pEpping_ctx == NULL) {
 		EPPING_LOG(CDF_TRACE_LEVEL_FATAL,
 			   "%s: error: pEpping_ctx  = NULL", __func__);
@@ -128,6 +125,7 @@ void epping_disable(void)
 	hif_reset_soc(cds_get_context(CDF_MODULE_ID_HIF));
 	htc_stop(cds_get_context(CDF_MODULE_ID_HTC));
 	epping_cookie_cleanup(pEpping_ctx);
+	htc_destroy(cds_get_context(CDF_MODULE_ID_HTC));
 }
 
 /**
@@ -139,30 +137,31 @@ void epping_disable(void)
  */
 void epping_close(void)
 {
-	epping_context_t *pEpping_ctx;
+	epping_context_t *to_free;
 
-	pEpping_ctx = cds_get_context(CDF_MODULE_ID_EPPING);
-	if (pEpping_ctx == NULL) {
+
+	if (g_epping_ctx == NULL) {
 		EPPING_LOG(CDF_TRACE_LEVEL_FATAL,
-			   "%s: error: pEpping_ctx  = NULL", __func__);
+			   "%s: error: g_epping_ctx  = NULL", __func__);
 		return;
 	}
-	cds_free_context(NULL, CDF_MODULE_ID_EPPING,
-		cds_get_context(CDF_MODULE_ID_EPPING));
+
+	to_free = g_epping_ctx;
+	g_epping_ctx = NULL;
+	cdf_mem_free(to_free);
 }
 
 static void epping_target_suspend_acknowledge(void *context)
 {
-	epping_context_t *pEpping_ctx = cds_get_context(CDF_MODULE_ID_EPPING);
 	int wow_nack = *((int *)context);
 
-	if (NULL == pEpping_ctx) {
+	if (NULL == g_epping_ctx) {
 		EPPING_LOG(CDF_TRACE_LEVEL_FATAL,
 			   "%s: epping_ctx is NULL", __func__);
 		return;
 	}
 	/* EPPING_TODO: do we need wow_nack? */
-	pEpping_ctx->wow_nack = wow_nack;
+	g_epping_ctx->wow_nack = wow_nack;
 }
 
 /**
@@ -194,7 +193,7 @@ int epping_enable(struct device *parent_dev)
 		return ret;
 	}
 
-	pEpping_ctx = cds_get_context(CDF_MODULE_ID_EPPING);
+	pEpping_ctx = g_epping_ctx;
 	if (pEpping_ctx == NULL) {
 		EPPING_LOG(CDF_TRACE_LEVEL_FATAL,
 			   "%s: Failed to get pEpping_ctx", __func__);
@@ -252,8 +251,6 @@ int epping_enable(struct device *parent_dev)
 	}
 	scn->htc_handle = pEpping_ctx->HTCHandle;
 
-	hif_claim_device(scn->hif_hdl, scn);
-
 	if (bmi_done(scn)) {
 		EPPING_LOG(CDF_TRACE_LEVEL_FATAL,
 			   "%s: Failed to complete BMI phase", __func__);
diff --git a/core/utils/epping/src/epping_txrx.c b/core/utils/epping/src/epping_txrx.c
index 240d43aede81..f3a3101eefcc 100644
--- a/core/utils/epping/src/epping_txrx.c
+++ b/core/utils/epping/src/epping_txrx.c
@@ -342,7 +342,7 @@ static struct net_device_ops epping_drv_ops = {
 
 epping_adapter_t *epping_add_adapter(epping_context_t *pEpping_ctx,
 				     tSirMacAddr macAddr,
-				     tCDF_CON_MODE device_mode)
+				     enum tCDF_ADAPTER_MODE device_mode)
 {
 	struct net_device *dev;
 	epping_adapter_t *pAdapter;
@@ -415,7 +415,7 @@ int epping_connect_service(epping_context_t *pEpping_ctx)
 #endif
 
 	/* connect to service */
-	connect.ServiceID = WMI_DATA_BE_SVC;
+	connect.service_id = WMI_DATA_BE_SVC;
 	status = htc_connect_service(pEpping_ctx->HTCHandle, &connect, &response);
 	if (status != EOK) {
 		EPPING_LOG(CDF_TRACE_LEVEL_FATAL,
@@ -429,7 +429,7 @@ int epping_connect_service(epping_context_t *pEpping_ctx)
 	pEpping_ctx->EppingEndpoint[0] = response.Endpoint;
 
 #if defined(HIF_PCI) || defined(HIF_USB)
-	connect.ServiceID = WMI_DATA_BK_SVC;
+	connect.service_id = WMI_DATA_BK_SVC;
 	status = htc_connect_service(pEpping_ctx->HTCHandle, &connect, &response);
 	if (status != EOK) {
 		EPPING_LOG(CDF_TRACE_LEVEL_FATAL,
diff --git a/core/utils/fwlog/dbglog_host.c b/core/utils/fwlog/dbglog_host.c
index 242c68545625..a2eaf57fca29 100644
--- a/core/utils/fwlog/dbglog_host.c
+++ b/core/utils/fwlog/dbglog_host.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -57,7 +57,6 @@
 
 static bool appstarted = false;
 static bool senddriverstatus = false;
-static bool kd_nl_init = false;
 static int cnss_diag_pid = INVALID_PID;
 static int get_version = 0;
 static int gprint_limiter = 0;
@@ -4264,12 +4263,11 @@ int cnss_diag_activate_service()
 
 	/* Register the msg handler for msgs addressed to WLAN_NL_MSG_OEM */
 	ret = nl_srv_register(WLAN_NL_MSG_CNSS_DIAG, cnss_diag_msg_callback);
-	if (ret == -EINVAL) {
+	if (ret) {
 		AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-				("CNSS-DIAG Registeration failed \n"));
+				("CNSS-DIAG Registration failed"));
 		return ret;
 	}
-	kd_nl_init = true;
 	return 0;
 }
 
@@ -4459,6 +4457,5 @@ int dbglog_deinit(wmi_unified_t wmi_handle)
 	if (res != 0)
 		return res;
 
-	kd_nl_init = false;
 	return res;
 }
diff --git a/core/utils/host_diag_log/inc/host_diag_core_event.h b/core/utils/host_diag_log/inc/host_diag_core_event.h
index 7962dda35245..623db35d7e3d 100644
--- a/core/utils/host_diag_log/inc/host_diag_core_event.h
+++ b/core/utils/host_diag_log/inc/host_diag_core_event.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -332,6 +332,7 @@ enum wifi_connectivity_events {
  * @WIFI_POWER_EVENT_WAKELOCK_PNO: PNO feature related
  * @WIFI_POWER_EVENT_WAKELOCK_DEL_STA: Deletion of a station
  * @WIFI_POWER_EVENT_WAKELOCK_DFS: DFS related wakelocks
+ * @WIFI_POWER_EVENT_WAKELOCK_WMI_CMD_RSP: Firmware response
  * @WIFI_POWER_EVENT_WAKELOCK_MISC: Miscellaneous wakelocks
  *
  * Indicates the reason for which the wakelock was taken/released
@@ -353,6 +354,7 @@ enum wake_lock_reason {
 	WIFI_POWER_EVENT_WAKELOCK_PNO,
 	WIFI_POWER_EVENT_WAKELOCK_DEL_STA,
 	WIFI_POWER_EVENT_WAKELOCK_DFS,
+	WIFI_POWER_EVENT_WAKELOCK_WMI_CMD_RSP,
 	WIFI_POWER_EVENT_WAKELOCK_MISC,
 };
 
diff --git a/core/utils/host_diag_log/inc/host_diag_core_log.h b/core/utils/host_diag_log/inc/host_diag_core_log.h
index d17ad46dec5e..a5090113cbf0 100644
--- a/core/utils/host_diag_log/inc/host_diag_core_log.h
+++ b/core/utils/host_diag_log/inc/host_diag_core_log.h
@@ -98,8 +98,8 @@ typedef struct {
 	log_hdr_type hdr;
 	uint8_t eventId;
 	uint8_t channelSetting;
-	uint8_t bssid[HOST_LOG_MAX_BSSID_SIZE];
-	uint8_t peerMacAddr[HOST_LOG_MAX_BSSID_SIZE];
+	struct cdf_mac_addr bssid;
+	struct cdf_mac_addr peer_macaddr;
 	uint8_t ssid[HOST_LOG_MAX_SSID_SIZE];
 	uint8_t operatingChannel;
 	uint8_t beaconInterval;
diff --git a/core/utils/host_diag_log/src/host_diag_log.c b/core/utils/host_diag_log/src/host_diag_log.c
index 4fd357eb1547..168ccd7decda 100644
--- a/core/utils/host_diag_log/src/host_diag_log.c
+++ b/core/utils/host_diag_log/src/host_diag_log.c
@@ -116,7 +116,7 @@ void host_diag_log_submit(void *plog_hdr_ptr)
 	uint16_t data_len;
 	uint16_t total_len;
 
-	if (cds_is_load_unload_in_progress()) {
+	if (cds_is_load_or_unload_in_progress()) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_INFO,
 			  "%s: Unloading/Loading in Progress. Ignore!!!",
 			  __func__);
@@ -213,7 +213,7 @@ void host_diag_event_report_payload(uint16_t event_Id, uint16_t length,
 	event_report_t *pEvent_report;
 	uint16_t total_len;
 
-	if (cds_is_load_unload_in_progress()) {
+	if (cds_is_load_or_unload_in_progress()) {
 		CDF_TRACE(CDF_MODULE_ID_CDF, CDF_TRACE_LEVEL_INFO,
 			  "%s: Unloading/Loading in Progress. Ignore!!!",
 			  __func__);
diff --git a/core/utils/logging/src/wlan_logging_sock_svc.c b/core/utils/logging/src/wlan_logging_sock_svc.c
index 507b5847e939..60cbfb3b1bb6 100644
--- a/core/utils/logging/src/wlan_logging_sock_svc.c
+++ b/core/utils/logging/src/wlan_logging_sock_svc.c
@@ -528,10 +528,6 @@ static int wlan_logging_thread(void *Arg)
 
 	set_user_nice(current, -2);
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
-	daemonize("wlan_logging_thread");
-#endif
-
 	while (!gwlan_logging.exit) {
 		ret_wait_status =
 			wait_event_interruptible(gwlan_logging.wait_queue,
diff --git a/core/utils/nlink/src/wlan_nlink_srv.c b/core/utils/nlink/src/wlan_nlink_srv.c
index 8cd8c45a39c2..c9f78f6fa4e5 100644
--- a/core/utils/nlink/src/wlan_nlink_srv.c
+++ b/core/utils/nlink/src/wlan_nlink_srv.c
@@ -60,24 +60,13 @@ static void nl_srv_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh);
 int nl_srv_init(void)
 {
 	int retcode = 0;
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 	struct netlink_kernel_cfg cfg = {
 		.groups = WLAN_NLINK_MCAST_GRP_ID,
 		.input = nl_srv_rcv
 	};
-#endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
 	nl_srv_sock = netlink_kernel_create(&init_net, WLAN_NLINK_PROTO_FAMILY,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
-					    THIS_MODULE,
-#endif
 					    &cfg);
-#else
-	nl_srv_sock = netlink_kernel_create(&init_net, WLAN_NLINK_PROTO_FAMILY,
-					    WLAN_NLINK_MCAST_GRP_ID, nl_srv_rcv,
-					    NULL, THIS_MODULE);
-#endif
 
 	if (nl_srv_sock != NULL) {
 		memset(nl_srv_msg_handler, 0, sizeof(nl_srv_msg_handler));
@@ -151,11 +140,7 @@ int nl_srv_ucast(struct sk_buff *skb, int dst_pid, int flag)
 {
 	int err = 0;
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
-	NETLINK_CB(skb).pid = 0;        /* sender's pid */
-#else
 	NETLINK_CB(skb).portid = 0;     /* sender's pid */
-#endif
 	NETLINK_CB(skb).dst_group = 0;  /* not multicast */
 
 	if (nl_srv_sock)
@@ -181,11 +166,7 @@ int nl_srv_bcast(struct sk_buff *skb)
 	if (in_interrupt() || irqs_disabled() || in_atomic())
 		flags = GFP_ATOMIC;
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
-	NETLINK_CB(skb).pid = 0;        /* sender's pid */
-#else
 	NETLINK_CB(skb).portid = 0;     /* sender's pid */
-#endif
 	NETLINK_CB(skb).dst_group = WLAN_NLINK_MCAST_GRP_ID;    /* destination group */
 
 	if (nl_srv_sock)
diff --git a/core/utils/pktlog/linux_ac.c b/core/utils/pktlog/linux_ac.c
index 3b5dc1b943fc..8ef8e0f1a2a9 100644
--- a/core/utils/pktlog/linux_ac.c
+++ b/core/utils/pktlog/linux_ac.c
@@ -152,11 +152,7 @@ int pktlog_alloc_buf(struct ol_softc *scn)
 	for (vaddr = (unsigned long)(pl_info->buf);
 	     vaddr < ((unsigned long)(pl_info->buf) + (page_cnt * PAGE_SIZE));
 	     vaddr += PAGE_SIZE) {
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
 		vpg = vmalloc_to_page((const void *)vaddr);
-#else
-		vpg = virt_to_page(pktlog_virt_to_logical((void *)vaddr));
-#endif
 		SetPageReserved(vpg);
 	}
 
@@ -188,11 +184,7 @@ void pktlog_release_buf(struct ol_softc *scn)
 	for (vaddr = (unsigned long)(pl_info->buf);
 	     vaddr < (unsigned long)(pl_info->buf) + (page_cnt * PAGE_SIZE);
 	     vaddr += PAGE_SIZE) {
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
 		vpg = vmalloc_to_page((const void *)vaddr);
-#else
-		vpg = virt_to_page(pktlog_virt_to_logical((void *)vaddr));
-#endif
 		ClearPageReserved(vpg);
 	}
 
@@ -321,12 +313,6 @@ static int pktlog_sysctl_register(struct ol_softc *scn)
 		proc_name = PKTLOG_PROC_SYSTEM;
 	}
 
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 31))
-#define set_ctl_name(a, b)      /* nothing */
-#else
-#define set_ctl_name(a, b)      pl_info_lnx->sysctls[a].ctl_name = b
-#endif
-
 	/*
 	 * Setup the sysctl table for creating the following sysctl entries:
 	 * /proc/sys/PKTLOG_PROC_DIR/<adapter>/enable for enabling/disabling
@@ -334,50 +320,44 @@ static int pktlog_sysctl_register(struct ol_softc *scn)
 	 * /proc/sys/PKTLOG_PROC_DIR/<adapter>/size for changing the buffer size
 	 */
 	memset(pl_info_lnx->sysctls, 0, sizeof(pl_info_lnx->sysctls));
-	set_ctl_name(0, CTL_AUTO);
 	pl_info_lnx->sysctls[0].procname = PKTLOG_PROC_DIR;
 	pl_info_lnx->sysctls[0].mode = PKTLOG_PROCSYS_DIR_PERM;
 	pl_info_lnx->sysctls[0].child = &pl_info_lnx->sysctls[2];
+
 	/* [1] is NULL terminator */
-	set_ctl_name(2, CTL_AUTO);
 	pl_info_lnx->sysctls[2].procname = proc_name;
 	pl_info_lnx->sysctls[2].mode = PKTLOG_PROCSYS_DIR_PERM;
 	pl_info_lnx->sysctls[2].child = &pl_info_lnx->sysctls[4];
+
 	/* [3] is NULL terminator */
-	set_ctl_name(4, CTL_AUTO);
 	pl_info_lnx->sysctls[4].procname = "enable";
 	pl_info_lnx->sysctls[4].mode = PKTLOG_PROCSYS_PERM;
 	pl_info_lnx->sysctls[4].proc_handler = ath_sysctl_pktlog_enable;
 	pl_info_lnx->sysctls[4].extra1 = scn;
 
-	set_ctl_name(5, CTL_AUTO);
 	pl_info_lnx->sysctls[5].procname = "size";
 	pl_info_lnx->sysctls[5].mode = PKTLOG_PROCSYS_PERM;
 	pl_info_lnx->sysctls[5].proc_handler = ath_sysctl_pktlog_size;
 	pl_info_lnx->sysctls[5].extra1 = scn;
 
-	set_ctl_name(6, CTL_AUTO);
 	pl_info_lnx->sysctls[6].procname = "options";
 	pl_info_lnx->sysctls[6].mode = PKTLOG_PROCSYS_PERM;
 	pl_info_lnx->sysctls[6].proc_handler = proc_dointvec;
 	pl_info_lnx->sysctls[6].data = &pl_info_lnx->info.options;
 	pl_info_lnx->sysctls[6].maxlen = sizeof(pl_info_lnx->info.options);
 
-	set_ctl_name(7, CTL_AUTO);
 	pl_info_lnx->sysctls[7].procname = "sack_thr";
 	pl_info_lnx->sysctls[7].mode = PKTLOG_PROCSYS_PERM;
 	pl_info_lnx->sysctls[7].proc_handler = proc_dointvec;
 	pl_info_lnx->sysctls[7].data = &pl_info_lnx->info.sack_thr;
 	pl_info_lnx->sysctls[7].maxlen = sizeof(pl_info_lnx->info.sack_thr);
 
-	set_ctl_name(8, CTL_AUTO);
 	pl_info_lnx->sysctls[8].procname = "tail_length";
 	pl_info_lnx->sysctls[8].mode = PKTLOG_PROCSYS_PERM;
 	pl_info_lnx->sysctls[8].proc_handler = proc_dointvec;
 	pl_info_lnx->sysctls[8].data = &pl_info_lnx->info.tail_length;
 	pl_info_lnx->sysctls[8].maxlen = sizeof(pl_info_lnx->info.tail_length);
 
-	set_ctl_name(9, CTL_AUTO);
 	pl_info_lnx->sysctls[9].procname = "thruput_thresh";
 	pl_info_lnx->sysctls[9].mode = PKTLOG_PROCSYS_PERM;
 	pl_info_lnx->sysctls[9].proc_handler = proc_dointvec;
@@ -385,7 +365,6 @@ static int pktlog_sysctl_register(struct ol_softc *scn)
 	pl_info_lnx->sysctls[9].maxlen =
 		sizeof(pl_info_lnx->info.thruput_thresh);
 
-	set_ctl_name(10, CTL_AUTO);
 	pl_info_lnx->sysctls[10].procname = "phyerr_thresh";
 	pl_info_lnx->sysctls[10].mode = PKTLOG_PROCSYS_PERM;
 	pl_info_lnx->sysctls[10].proc_handler = proc_dointvec;
@@ -393,14 +372,12 @@ static int pktlog_sysctl_register(struct ol_softc *scn)
 	pl_info_lnx->sysctls[10].maxlen =
 		sizeof(pl_info_lnx->info.phyerr_thresh);
 
-	set_ctl_name(11, CTL_AUTO);
 	pl_info_lnx->sysctls[11].procname = "per_thresh";
 	pl_info_lnx->sysctls[11].mode = PKTLOG_PROCSYS_PERM;
 	pl_info_lnx->sysctls[11].proc_handler = proc_dointvec;
 	pl_info_lnx->sysctls[11].data = &pl_info_lnx->info.per_thresh;
 	pl_info_lnx->sysctls[11].maxlen = sizeof(pl_info_lnx->info.per_thresh);
 
-	set_ctl_name(12, CTL_AUTO);
 	pl_info_lnx->sysctls[12].procname = "trigger_interval";
 	pl_info_lnx->sysctls[12].mode = PKTLOG_PROCSYS_PERM;
 	pl_info_lnx->sysctls[12].proc_handler = proc_dointvec;
@@ -411,13 +388,9 @@ static int pktlog_sysctl_register(struct ol_softc *scn)
 
 	/* and register everything */
 	/* register_sysctl_table changed from 2.6.21 onwards */
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 20))
 	pl_info_lnx->sysctl_header =
 		register_sysctl_table(pl_info_lnx->sysctls);
-#else
-	pl_info_lnx->sysctl_header =
-		register_sysctl_table(pl_info_lnx->sysctls, 1);
-#endif
+
 	if (!pl_info_lnx->sysctl_header) {
 		printk("%s: failed to register sysctls!\n", proc_name);
 		return -1;
@@ -468,7 +441,6 @@ static int pktlog_attach(struct ol_softc *scn)
 	pl_info_lnx->proc_entry = NULL;
 	pl_info_lnx->sysctl_header = NULL;
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)
 	proc_entry = proc_create_data(proc_name, PKTLOG_PROC_PERM,
 				      g_pktlog_pde, &pktlog_fops,
 				      &pl_info_lnx->info);
@@ -478,22 +450,6 @@ static int pktlog_attach(struct ol_softc *scn)
 		       __func__, proc_name);
 		goto attach_fail1;
 	}
-#else
-	proc_entry = create_proc_entry(proc_name, PKTLOG_PROC_PERM,
-				       g_pktlog_pde);
-
-	if (proc_entry == NULL) {
-		printk(PKTLOG_TAG "%s: create_proc_entry failed for %s\n",
-		       __func__, proc_name);
-		goto attach_fail1;
-	}
-
-	proc_entry->data = &pl_info_lnx->info;
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
-	proc_entry->owner = THIS_MODULE;
-#endif
-	proc_entry->proc_fops = &pktlog_fops;
-#endif
 
 	pl_info_lnx->proc_entry = proc_entry;
 
@@ -867,14 +823,8 @@ pktlog_read(struct file *file, char *buf, size_t nbytes, loff_t *ppos)
 	int rem_len;
 	int start_offset, end_offset;
 	int fold_offset, ppos_data, cur_rd_offset;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)
 	struct ath_pktlog_info *pl_info = (struct ath_pktlog_info *)
 					  PDE_DATA(file->f_dentry->d_inode);
-#else
-	struct proc_dir_entry *proc_entry = PDE(file->f_dentry->d_inode);
-	struct ath_pktlog_info *pl_info = (struct ath_pktlog_info *)
-					  proc_entry->data;
-#endif
 	struct ath_pktlog_buf *log_buf = pl_info->buf;
 
 	if (log_buf == NULL)
@@ -985,51 +935,6 @@ rd_done:
 #define VMALLOC_VMADDR(x) ((unsigned long)(x))
 #endif
 
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
-/* Convert a kernel virtual address to a kernel logical address */
-static volatile void *pktlog_virt_to_logical(volatile void *addr)
-{
-	pgd_t *pgd;
-	pmd_t *pmd;
-	pte_t *ptep, pte;
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 15) || \
-	(defined(__i386__) && LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11)))
-	pud_t *pud;
-#endif
-	unsigned long vaddr, ret = 0UL;
-
-	vaddr = VMALLOC_VMADDR((unsigned long)addr);
-
-	pgd = pgd_offset_k(vaddr);
-
-	if (!pgd_none(*pgd)) {
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 15) || \
-	(defined(__i386__) && LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11)))
-		pud = pud_offset(pgd, vaddr);
-		pmd = pmd_offset(pud, vaddr);
-#else
-		pmd = pmd_offset(pgd, vaddr);
-#endif
-
-		if (!pmd_none(*pmd)) {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 0)
-			ptep = pte_offset_map(pmd, vaddr);
-#else
-			ptep = pte_offset(pmd, vaddr);
-#endif
-			pte = *ptep;
-
-			if (pte_present(pte)) {
-				ret = (unsigned long)
-				      page_address(pte_page(pte));
-				ret |= (vaddr & (PAGE_SIZE - 1));
-			}
-		}
-	}
-	return (volatile void *)ret;
-}
-#endif
-
 /* vma operations for mapping vmalloced area to user space */
 static void pktlog_vopen(struct vm_area_struct *vma)
 {
@@ -1041,7 +946,6 @@ static void pktlog_vclose(struct vm_area_struct *vma)
 	PKTLOG_MOD_DEC_USE_COUNT;
 }
 
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 25)
 int pktlog_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
 	unsigned long address = (unsigned long)vmf->virtual_address;
@@ -1056,62 +960,16 @@ int pktlog_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 	vmf->page = virt_to_page((void *)address);
 	return VM_FAULT_MINOR;
 }
-#else
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
-struct page *pktlog_vmmap(struct vm_area_struct *vma, unsigned long addr,
-			  int *type)
-#else
-struct page *pktlog_vmmap(struct vm_area_struct *vma, unsigned long addr,
-			  int write_access)
-#endif
-{
-	unsigned long offset, vaddr;
-	struct proc_dir_entry *proc_entry;
-	struct ath_pktlog_info *pl_info =
-		proc_entry = PDE(vma->vm_file->f_dentry->d_inode);
-	pl_info = (struct ath_pktlog_info *)proc_entry->data;
-
-	offset = addr - vma->vm_start + (vma->vm_pgoff << PAGE_SHIFT);
-	vaddr = (unsigned long)pktlog_virt_to_logical((void *)(pl_info->buf) +
-						      offset);
-
-	if (vaddr == 0UL) {
-		printk(PKTLOG_TAG "%s: page fault out of range\n", __func__);
-		return ((struct page *)0UL);
-	}
-
-	/* increment the usage count of the page */
-	get_page(virt_to_page((void *)vaddr));
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
-	if (type)
-		*type = VM_FAULT_MINOR;
-#endif
-
-	return virt_to_page((void *)vaddr);
-}
-#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 25) */
-
 static struct vm_operations_struct pktlog_vmops = {
 	open:  pktlog_vopen,
 	close:pktlog_vclose,
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 25)
 	fault:pktlog_fault,
-#else
-	nopage:pktlog_vmmap,
-#endif
 };
 
 static int pktlog_mmap(struct file *file, struct vm_area_struct *vma)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)
 	struct ath_pktlog_info *pl_info = (struct ath_pktlog_info *)
 					  PDE_DATA(file->f_dentry->d_inode);
-#else
-	struct proc_dir_entry *proc_entry = PDE(file->f_dentry->d_inode);
-	struct ath_pktlog_info *pl_info = (struct ath_pktlog_info *)
-					  proc_entry->data;
-#endif
 
 	if (vma->vm_pgoff != 0) {
 		/* Entire buffer should be mapped */
diff --git a/core/utils/ptt/inc/wlan_ptt_sock_svc.h b/core/utils/ptt/inc/wlan_ptt_sock_svc.h
index 7e17dd8329ec..121fcbac7579 100644
--- a/core/utils/ptt/inc/wlan_ptt_sock_svc.h
+++ b/core/utils/ptt/inc/wlan_ptt_sock_svc.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -92,9 +92,19 @@
  * Length      : 4 bytes [LEN_PAYLOAD]
  * Payload     : LEN_PAYLOAD bytes
  */
+#ifdef PTT_SOCK_SVC_ENABLE
 int ptt_sock_activate_svc(void);
 void ptt_sock_deactivate_svc(void);
 int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid);
+#else
+static inline int ptt_sock_activate_svc(void) { return 0; }
+static inline void ptt_sock_deactivate_svc(void) { return; }
+static inline int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio,
+					   int src_mod, int pid)
+{
+	return 0;
+}
+#endif
 
 /*
  * Format of message exchanged between the PTT Socket App in userspace and the
diff --git a/core/wma/inc/wma.h b/core/wma/inc/wma.h
index 2993a9fcd0e7..f3b3b882b895 100644
--- a/core/wma/inc/wma.h
+++ b/core/wma/inc/wma.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -243,6 +243,11 @@
 #define WMA_PEER_ASSOC_CNF_START 0x01
 #define WMA_PEER_ASSOC_TIMEOUT (3000) /* 3 seconds */
 
+#define WMA_DELETE_STA_RSP_START 0x02
+#define WMA_DELETE_STA_TIMEOUT (6000) /* 6 seconds */
+
+#define WMA_DEL_P2P_SELF_STA_RSP_START 0x03
+
 #define WMA_VDEV_START_REQUEST_TIMEOUT (3000)   /* 3 seconds */
 #define WMA_VDEV_STOP_REQUEST_TIMEOUT  (3000)   /* 3 seconds */
 
@@ -300,6 +305,7 @@
 #define WMA_AUTO_SHUTDOWN_WAKE_LOCK_DURATION    (5 * 1000)     /* in msec */
 #endif
 #define WMA_BMISS_EVENT_WAKE_LOCK_DURATION      (4 * 1000)     /* in msec */
+#define WMA_FW_RSP_EVENT_WAKE_LOCK_DURATION      (3 * 1000)  /* in msec */
 
 #define WMA_TXMIC_LEN 8
 #define WMA_RXMIC_LEN 8
@@ -408,18 +414,21 @@ typedef enum {
 
 #ifdef FEATURE_WLAN_TDLS
 /**
- * enum t_wma_tdls_mode: TDLS mode
+ * enum t_wma_tdls_mode - TDLS mode
  * @WMA_TDLS_SUPPORT_NOT_ENABLED: tdls is disable
  * @WMA_TDLS_SUPPORT_DISABLED: suppress implicit trigger and not respond to peer
  * @WMA_TDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY: suppress implicit trigger,
  *                                          but respond to the peer
  * @WMA_TDLS_SUPPORT_ENABLED: implicit trigger
+ * @WMA_TDLS_SUPPORT_ACTIVE_EXTERNAL_CONTROL: External control means
+ *    implicit trigger but only to a peer mac configured by user space.
  */
 typedef enum {
 	WMA_TDLS_SUPPORT_NOT_ENABLED = 0,
 	WMA_TDLS_SUPPORT_DISABLED,
 	WMA_TDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY,
 	WMA_TDLS_SUPPORT_ENABLED,
+	WMA_TDLS_SUPPORT_ACTIVE_EXTERNAL_CONTROL,
 } t_wma_tdls_mode;
 
 /**
@@ -638,7 +647,6 @@ typedef struct {
  * @rxchainmask: rx chain mask
  * @txpow2g: tx power limit for 2GHz
  * @txpow5g: tx power limit for 5GHz
- * @pwrgating: enable/disable power gating sleep
  * @burst_enable: is burst enable/disable
  * @burst_dur: burst duration
  *
@@ -658,7 +666,6 @@ typedef struct {
 	uint32_t rxchainmask;
 	uint32_t txpow2g;
 	uint32_t txpow5g;
-	uint32_t pwrgating;
 	uint32_t burst_enable;
 	uint32_t burst_dur;
 } pdev_cli_config_t;
@@ -735,7 +742,6 @@ struct wma_wow {
 	bool deauth_enable;
 	bool disassoc_enable;
 	bool bmiss_enable;
-	bool gtk_pdev_enable;
 	bool gtk_err_enable[WMA_MAX_SUPPORTED_BSS];
 #ifdef FEATURE_WLAN_LPHB
 	/* currently supports only vdev 0.
@@ -903,8 +909,8 @@ struct wma_txrx_node {
 	uint8_t nss;
 	bool is_channel_switch;
 	uint16_t pause_bitmap;
-	tPowerdBm tx_power;
-	tPowerdBm max_tx_power;
+	int8_t tx_power;
+	int8_t max_tx_power;
 	uint32_t nwType;
 #if defined WLAN_FEATURE_VOWIFI_11R
 	void *staKeyParams;
@@ -1082,6 +1088,7 @@ struct wmi_init_cmd {
  * @final_abi_vers: The final ABI version to be used for communicating
  * @target_fw_version: Target f/w build version
  * @lpss_support: LPSS feature is supported in target or not
+ * @egap_support: Enhanced Green AP support flag
  * @wmi_ready: wmi status flag
  * @wlan_init_status: wlan init status
  * @cdf_dev: cdf device
@@ -1187,6 +1194,8 @@ struct wmi_init_cmd {
  * handle of other modules.
  * @saved_wmi_init_cmd: Saved WMI INIT command
  * @service_ready_ext_evt: Wait event for service ready ext
+ * @wmi_cmd_rsp_wake_lock: wmi command response wake lock
+ * @wmi_cmd_rsp_runtime_lock: wmi command response bus lock
  */
 typedef struct {
 	void *wmi_handle;
@@ -1196,6 +1205,7 @@ typedef struct {
 	cdf_event_t wma_ready_event;
 	cdf_event_t wma_resume_event;
 	cdf_event_t target_suspend;
+	cdf_event_t runtime_suspend;
 	cdf_event_t recovery_event;
 	uint16_t max_station;
 	uint16_t max_bssid;
@@ -1210,6 +1220,9 @@ typedef struct {
 	uint8_t lpss_support;
 #endif
 	uint8_t ap_arpns_support;
+#ifdef FEATURE_GREEN_AP
+	bool egap_support;
+#endif
 	bool wmi_ready;
 	uint32_t wlan_init_status;
 	cdf_device_t cdf_dev;
@@ -1362,6 +1375,14 @@ typedef struct {
 	 * the serialized MC thread context with a timer.
 	 */
 	cdf_mc_timer_t service_ready_ext_timer;
+	void (*csr_roam_synch_cb)(tpAniSirGlobal mac,
+		roam_offload_synch_ind *roam_synch_data,
+		tpSirBssDescription  bss_desc_ptr, uint8_t reason);
+	CDF_STATUS (*pe_roam_synch_cb)(tpAniSirGlobal mac,
+		roam_offload_synch_ind *roam_synch_data,
+		tpSirBssDescription  bss_desc_ptr);
+	cdf_wake_lock_t wmi_cmd_rsp_wake_lock;
+	cdf_runtime_lock_t wmi_cmd_rsp_runtime_lock;
 } t_wma_handle, *tp_wma_handle;
 
 /**
@@ -1786,6 +1807,9 @@ typedef enum {
  * @puapsd_mask: uapsd mask
  * @puapsd_inactivity_time: uapsd inactivity time
  * @puapsd_rx_frame_threshold: uapsd rx frame threshold
+ * @teardown_notification_ms: tdls teardown notification interval
+ * @tdls_peer_kickout_threshold: tdls packet threshold for
+ *    peer kickout operation
  */
 typedef struct wma_tdls_params {
 	uint32_t vdev_id;
@@ -1801,6 +1825,8 @@ typedef struct wma_tdls_params {
 	uint32_t puapsd_mask;
 	uint32_t puapsd_inactivity_time;
 	uint32_t puapsd_rx_frame_threshold;
+	uint32_t teardown_notification_ms;
+	uint32_t tdls_peer_kickout_threshold;
 } t_wma_tdls_params;
 
 /**
@@ -2002,6 +2028,17 @@ int wma_mgmt_tx_completion_handler(void *handle, uint8_t *cmpl_event_params,
 void wma_set_dfs_region(tp_wma_handle wma, uint8_t dfs_region);
 uint32_t wma_get_vht_ch_width(void);
 
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+CDF_STATUS wma_set_gateway_params(tp_wma_handle wma,
+					struct gateway_param_update_req *req);
+#else
+static inline CDF_STATUS wma_set_gateway_params(tp_wma_handle wma,
+					struct gateway_param_update_req *req)
+{
+	return CDF_STATUS_SUCCESS;
+}
+#endif /* FEATURE_LFR_SUBNET_DETECTION */
+
 #if defined(FEATURE_LRO)
 CDF_STATUS wma_lro_config_cmd(tp_wma_handle wma_handle,
 	 struct wma_lro_config_cmd_t *wma_lro_cmd);
diff --git a/core/wma/inc/wma_api.h b/core/wma/inc/wma_api.h
index 0e9b5f5bc559..a0d73deec6a7 100644
--- a/core/wma/inc/wma_api.h
+++ b/core/wma/inc/wma_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -117,6 +117,8 @@ CDF_STATUS wma_set_reg_domain(void *clientCtxt, v_REGDOMAIN_t regId);
 CDF_STATUS wma_get_wcnss_software_version(void *p_cds_gctx,
 					  uint8_t *pVersion,
 					  uint32_t versionBufferSize);
+int wma_runtime_suspend(void);
+int wma_runtime_resume(void);
 int wma_bus_suspend(void);
 int wma_suspend_target(WMA_HANDLE handle, int disable_target_intr);
 void wma_target_suspend_acknowledge(void *context);
@@ -124,7 +126,7 @@ int wma_bus_resume(void);
 int wma_resume_target(WMA_HANDLE handle);
 CDF_STATUS wma_disable_wow_in_fw(WMA_HANDLE handle);
 CDF_STATUS wma_disable_d0wow_in_fw(WMA_HANDLE handle);
-int wma_is_wow_mode_selected(WMA_HANDLE handle);
+bool wma_is_wow_mode_selected(WMA_HANDLE handle);
 CDF_STATUS wma_enable_wow_in_fw(WMA_HANDLE handle);
 CDF_STATUS wma_enable_d0wow_in_fw(WMA_HANDLE handle);
 bool wma_check_scan_in_progress(WMA_HANDLE handle);
@@ -219,4 +221,22 @@ struct wma_lro_config_cmd_t {
 int wma_lro_init(struct wma_lro_config_cmd_t *lro_config);
 #endif
 bool wma_is_scan_simultaneous_capable(void);
+
+#ifdef FEATURE_GREEN_AP
+void wma_setup_egap_support(struct wma_tgt_cfg *tgt_cfg, WMA_HANDLE handle);
+void wma_register_egap_event_handle(WMA_HANDLE handle);
+CDF_STATUS wma_send_egap_conf_params(WMA_HANDLE handle,
+				     struct egap_conf_params *egap_params);
+#else
+static inline void wma_setup_egap_support(struct wma_tgt_cfg *tgt_cfg,
+					  WMA_HANDLE handle) {}
+static inline void wma_register_egap_event_handle(WMA_HANDLE handle) {}
+static inline CDF_STATUS wma_send_egap_conf_params(WMA_HANDLE handle,
+				     struct egap_conf_params *egap_params)
+{
+	return CDF_STATUS_E_NOSUPPORT;
+}
+#endif
+CDF_STATUS wma_set_tx_power_scale(uint8_t vdev_id, int value);
+CDF_STATUS wma_set_tx_power_scale_decr_db(uint8_t vdev_id, int value);
 #endif
diff --git a/core/wma/inc/wma_dfs_interface.h b/core/wma/inc/wma_dfs_interface.h
index 63d069bea3cf..39f031740270 100644
--- a/core/wma/inc/wma_dfs_interface.h
+++ b/core/wma/inc/wma_dfs_interface.h
@@ -71,6 +71,10 @@
 #define IEEE80211_CHAN_VHT40MINUS       0x00400000
 /* VHT 80 channel */
 #define IEEE80211_CHAN_VHT80            0x00800000
+/* VHT 80+80 Channel */
+#define IEEE80211_CHAN_VHT80P80         0x01000000
+/* VHT 160 Channel */
+#define IEEE80211_CHAN_VHT160           0x02000000
 
 /* token for ``any channel'' */
 #define DFS_IEEE80211_CHAN_ANY      (-1)
@@ -87,6 +91,12 @@
 #define IEEE80211_IS_CHAN_11AC_VHT80(_c) \
 	(((_c)->ic_flags & IEEE80211_CHAN_11AC_VHT80) == \
 	 IEEE80211_CHAN_11AC_VHT80)
+#define IEEE80211_IS_CHAN_11AC_VHT80P80(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_VHT80P80) == \
+	IEEE80211_CHAN_VHT80P80)
+#define IEEE80211_IS_CHAN_11AC_VHT160(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_VHT160) == \
+	IEEE80211_CHAN_VHT160)
 #define CHANNEL_108G \
 	(IEEE80211_CHAN_2GHZ|IEEE80211_CHAN_OFDM|IEEE80211_CHAN_TURBO)
 
@@ -99,6 +109,9 @@
 /* In case of VHT160, we can have 8 20Mhz channels */
 #define IEE80211_MAX_20M_SUB_CH 8
 
+#define WMA_DFS2_PHYERROR_CODE    0x5
+#define WMA_DFS2_FALSE_RADAR_EXT  0x24
+
 /**
  * struct dfs_ieee80211_channel - channel info
  * @ic_freq: frequency in MHz
@@ -113,12 +126,16 @@
  * @ic_vhtop_ch_freq_seg1: channel center frequency
  * @ic_vhtop_ch_freq_seg2: Channel Center frequency applicable
  * @ic_pri_freq_center_freq_mhz_separation: separation b/w pri and center freq
+ * @ic_80p80_both_dfs: Flag indicating if both 80p80 segments are dfs
+ * @ic_radar_found_segid: Indicates seg ID on which radar is found in 80p80 mode
  */
 struct dfs_ieee80211_channel {
 	uint32_t ic_freq;
+	uint32_t ic_freq_ext;
 	uint32_t ic_flags;
 	uint8_t ic_flagext;
 	uint8_t ic_ieee;
+	uint8_t ic_ieee_ext;
 	int8_t ic_maxregpower;
 	int8_t ic_maxpower;
 	int8_t ic_minpower;
@@ -127,6 +144,8 @@ struct dfs_ieee80211_channel {
 	uint32_t ic_vhtop_ch_freq_seg1;
 	uint32_t ic_vhtop_ch_freq_seg2;
 	int ic_pri_freq_center_freq_mhz_separation;
+	bool ic_80p80_both_dfs;
+	int ic_radar_found_segid;
 };
 
 /**
@@ -162,6 +181,19 @@ struct ieee80211_dfs_state {
 };
 
 /**
+ * enum DFS_HWBD_ID - Board ID to differentiate between DFS-2 and DFS-3
+ * @DFS_HWBD_NONE: No hw board information/currently used for adreastea FPGA
+ * @DFS_HWBD_QCA6174: Rome(AR6320)
+ * @DFS_HWBD_QCA2582: Killer 1525
+ */
+typedef enum {
+	DFS_HWBD_NONE = 0,
+	DFS_HWBD_QCA6174 = 1,
+	DFS_HWBD_QCA2582 = 2,
+} DFS_HWBD_ID;
+
+
+/**
  * struct ieee80211com - per device structure
  * @ic_opmode: operation mode
  * @ic_channels: ieee80211 channel list
@@ -232,6 +264,7 @@ typedef struct ieee80211com {
 	int32_t dfs_pri_multiplier;
 	cdf_spinlock_t chan_lock;
 	bool disable_phy_err_processing;
+	DFS_HWBD_ID dfs_hw_bd_id;
 } IEEE80211COM, *PIEEE80211COM;
 
 /**
diff --git a/core/wma/inc/wma_if.h b/core/wma/inc/wma_if.h
index 52e313908ff6..1dab6fab4b65 100644
--- a/core/wma/inc/wma_if.h
+++ b/core/wma/inc/wma_if.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -317,7 +317,7 @@ typedef struct {
 	uint16_t ht_caps;
 	uint32_t vht_caps;
 	tSirNwType nwType;
-	tPowerdBm maxTxPower;
+	int8_t maxTxPower;
 	uint8_t atimIePresent;
 	uint32_t peerAtimWindowLength;
 	uint8_t nonRoamReassoc;
@@ -373,7 +373,7 @@ typedef struct {
 	tSirKeys key[SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS];
 	uint8_t singleTidRc;
 	uint8_t smesessionId;
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 	CDF_STATUS status;
 	uint8_t sessionId;
 	uint8_t sendRsp;
@@ -390,7 +390,7 @@ typedef struct {
  * @key: key data
  */
 typedef struct sLimMlmSetKeysReq {
-	tSirMacAddr peerMacAddr;
+	struct cdf_mac_addr peer_macaddr;
 	uint8_t sessionId;      /* Added For BT-AMP Support */
 	uint8_t smesessionId;   /* Added for drivers based on wmi interface */
 	uint16_t aid;
@@ -487,8 +487,8 @@ typedef struct {
 	uint8_t respReqd;
 	uint8_t sessionId;
 #if defined WLAN_FEATURE_VOWIFI
-	tPowerdBm txMgmtPower;
-	tPowerdBm maxTxPower;
+	int8_t txMgmtPower;
+	int8_t maxTxPower;
 #endif /* WLAN_FEATURE_VOWIFI */
 
 #if defined WLAN_FEATURE_VOWIFI_11R
@@ -592,6 +592,7 @@ typedef enum eSmpsModeValue {
  * @bssId: mac address
  * @addr2: mac address
  * @reasonCode: reason code
+ * @rssi: rssi value during disconnection
  */
 typedef struct {
 	uint16_t assocId;
@@ -599,6 +600,7 @@ typedef struct {
 	tSirMacAddr bssId;
 	tSirMacAddr addr2;
 	uint16_t reasonCode;
+	int8_t rssi;
 } tDeleteStaContext, *tpDeleteStaContext;
 
 /**
@@ -613,7 +615,7 @@ typedef struct {
 	CDF_STATUS status;
 #if defined WLAN_FEATURE_VOWIFI
 	uint32_t startTSF[2];
-	tPowerdBm txMgmtPower;
+	int8_t txMgmtPower;
 #endif /* WLAN_FEATURE_VOWIFI */
 } tStartScanParams, *tpStartScanParams;
 
@@ -678,7 +680,8 @@ typedef struct {
 typedef struct {
 	struct cdf_mac_addr selfMacAddr;
 	CDF_STATUS status;
-	uint8_t oemDataReq[OEM_DATA_REQ_SIZE];
+	uint8_t data_len;
+	uint8_t *data;
 } tStartOemDataReq, *tpStartOemDataReq;
 
 /**
@@ -686,6 +689,7 @@ typedef struct {
  * @oemDataRsp: OEM Data response
  */
 typedef struct {
+	bool target_rsp;
 	uint8_t oemDataRsp[OEM_DATA_RSP_SIZE];
 } tStartOemDataRsp, *tpStartOemDataRsp;
 #endif /* FEATURE_OEM_DATA_SUPPORT */
@@ -896,8 +900,8 @@ typedef struct {
 #endif /* WLAN_FEATURE_VOWIFI  */
 	uint8_t peSessionId;
 #if defined WLAN_FEATURE_VOWIFI
-	tPowerdBm txMgmtPower;
-	tPowerdBm maxTxPower;
+	int8_t txMgmtPower;
+	int8_t maxTxPower;
 #endif /* WLAN_FEATURE_VOWIFI */
 	tSirMacAddr selfStaMacAddr;
 	/* the request has power constraints, this should be applied only to
@@ -1158,8 +1162,8 @@ typedef struct sMaxTxPowerParams {
 	 * In response,
 	 * power == tx power used for management frames.
 	 */
-	tPowerdBm power;
-	tCDF_CON_MODE dev_mode;
+	int8_t power;
+	enum tCDF_ADAPTER_MODE dev_mode;
 } tMaxTxPowerParams, *tpMaxTxPowerParams;
 
 /**
@@ -1169,7 +1173,7 @@ typedef struct sMaxTxPowerParams {
  */
 typedef struct sMaxTxPowerPerBandParams {
 	eCsrBand bandInfo;
-	tPowerdBm power;
+	int8_t power;
 } tMaxTxPowerPerBandParams, *tpMaxTxPowerPerBandParams;
 
 /**
@@ -1183,7 +1187,7 @@ typedef struct sMaxTxPowerPerBandParams {
  */
 struct add_sta_self_params {
 	tSirMacAddr self_mac_addr;
-	tCDF_CON_MODE curr_device_mode;
+	enum tCDF_ADAPTER_MODE curr_device_mode;
 	uint32_t type;
 	uint32_t sub_type;
 	uint8_t session_id;
@@ -1284,6 +1288,16 @@ struct del_sta_self_params {
 };
 
 /**
+ * struct del_sta_self_rsp_params - Del Sta Self response params
+ * @self_sta_param: sta params
+ * @generate_rsp: generate response to upper layers
+ */
+struct del_sta_self_rsp_params {
+	struct del_sta_self_params *self_sta_param;
+	uint8_t generate_rsp;
+};
+
+/**
  * struct tP2pPsParams - P2P powersave related params
  * @opp_ps: opportunistic power save
  * @ctWindow: CT window
diff --git a/core/wma/inc/wma_internal.h b/core/wma/inc/wma_internal.h
index d204979b4e0c..d2788103f868 100644
--- a/core/wma/inc/wma_internal.h
+++ b/core/wma/inc/wma_internal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -77,8 +77,15 @@
 #define MKK       0x40
 #define ETSI      0x30
 
-/* Maximum Buffer length allowed for DFS phyerrors */
-#define DFS_MAX_BUF_LENGHT 4096
+/* Maximum Buffer length allowed for DFS-2 phyerrors */
+#define DFS_MAX_BUF_LENGTH 4096
+
+/*
+ * Maximum Buffer length allowed for DFS-3 phyerrors
+ * When 160MHz is supported the Max length of phyerrors
+ * is larger than the legacy phyerrors.
+ */
+#define DFS3_MAX_BUF_LENGTH 4436
 
 #define WMI_DEFAULT_NOISE_FLOOR_DBM (-96)
 
@@ -111,27 +118,29 @@
 
 /**
  * struct index_data_rate_type - non vht data rate type
- * @beacon_rate_index: Beacon rate index
- * @supported_rate: Supported rate table
+ * @mcs_index: mcs rate index
+ * @ht20_rate: HT20 supported rate table
+ * @ht40_rate: HT40 supported rate table
  */
 struct index_data_rate_type {
-	uint8_t beacon_rate_index;
-	uint16_t supported_rate[4];
+	uint8_t  mcs_index;
+	uint16_t ht20_rate[2];
+	uint16_t ht40_rate[2];
 };
 
 #ifdef WLAN_FEATURE_11AC
 /**
  * struct index_vht_data_rate_type - vht data rate type
- * @beacon_rate_index: Beacon rate index
- * @supported_VHT80_rate: VHT80 rate
- * @supported_VHT40_rate: VHT40 rate
- * @supported_VHT20_rate: VHT20 rate
+ * @mcs_index: mcs rate index
+ * @ht20_rate: VHT20 supported rate table
+ * @ht40_rate: VHT40 supported rate table
+ * @ht80_rate: VHT80 supported rate table
  */
 struct index_vht_data_rate_type {
-	uint8_t beacon_rate_index;
-	uint16_t supported_VHT80_rate[2];
-	uint16_t supported_VHT40_rate[2];
-	uint16_t supported_VHT20_rate[2];
+	uint8_t mcs_index;
+	uint16_t ht20_rate[2];
+	uint16_t ht40_rate[2];
+	uint16_t ht80_rate[2];
 };
 #endif
 
@@ -413,8 +422,18 @@ int wma_nlo_scan_cmp_evt_handler(void *handle, uint8_t *event, uint32_t len);
 #endif
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-void wma_process_roam_synch_complete(WMA_HANDLE handle,
-				     tSirSmeRoamOffloadSynchCnf *synchcnf);
+void wma_process_roam_synch_complete(WMA_HANDLE handle, uint8_t vdev_id);
+static inline bool wma_is_roam_synch_in_progress(tp_wma_handle wma,
+		uint8_t vdev_id)
+{
+	return wma->interfaces[vdev_id].roam_synch_in_progress;
+}
+#else
+static inline bool wma_is_roam_synch_in_progress(tp_wma_handle wma,
+		uint8_t vdev_id)
+{
+	return false;
+}
 #endif
 
 /*
@@ -461,9 +480,39 @@ bool wma_is_vdev_in_ap_mode(tp_wma_handle wma, uint8_t vdev_id);
 
 #ifdef QCA_IBSS_SUPPORT
 bool wma_is_vdev_in_ibss_mode(tp_wma_handle wma, uint8_t vdev_id);
+#else
+/**
+ * wma_is_vdev_in_ibss_mode(): dummy function
+ * @wma: wma handle
+ * @vdev_id: vdev id
+ *
+ * Return false since no vdev can be in ibss mode without ibss support
+ */
+static inline
+bool wma_is_vdev_in_ibss_mode(tp_wma_handle wma, uint8_t vdev_id);
+{
+	return false;
+}
 #endif
 
 /**
+ * wma_is_vdev_in_beaconning_mode() - check if vdev is in a beaconning mode
+ * @wma: wma handle
+ * @vdev_id: vdev id
+ *
+ * Helper function to know whether given vdev id
+ * is in a beaconning mode or not.
+ *
+ * Return: True if vdev needs to beacon.
+ */
+static inline
+bool wma_is_vdev_in_beaconning_mode(tp_wma_handle wma, uint8_t vdev_id)
+{
+	return wma_is_vdev_in_ap_mode(wma, vdev_id) ||
+		wma_is_vdev_in_ibss_mode(wma, vdev_id);
+}
+
+/**
  * wma_find_bssid_by_vdev_id() - Get the BSS ID corresponding to the vdev ID
  * @wma - wma handle
  * @vdev_id - vdev ID
@@ -908,6 +957,9 @@ int wma_oem_measurement_report_event_callback(void *handle, uint8_t *datap,
 
 int wma_oem_error_report_event_callback(void *handle, uint8_t *datap,
 					uint32_t len);
+
+int wma_oem_data_response_handler(void *handle, uint8_t *datap,
+				  uint32_t len);
 #endif
 
 void wma_register_dfs_event_handler(tp_wma_handle wma_handle);
@@ -936,7 +988,7 @@ static inline int wma_get_wow_bus_suspend(tp_wma_handle wma)
 	return cdf_atomic_read(&wma->is_wow_bus_suspended);
 }
 
-CDF_STATUS wma_resume_req(tp_wma_handle wma);
+CDF_STATUS wma_resume_req(tp_wma_handle wma, enum cdf_suspend_type type);
 
 CDF_STATUS wma_wow_add_pattern(tp_wma_handle wma,
 			struct wow_add_pattern *ptrn);
@@ -948,7 +1000,10 @@ CDF_STATUS wma_wow_enter(tp_wma_handle wma, tpSirHalWowlEnterParams info);
 
 CDF_STATUS wma_wow_exit(tp_wma_handle wma, tpSirHalWowlExitParams info);
 
-CDF_STATUS wma_suspend_req(tp_wma_handle wma, tpSirWlanSuspendParam info);
+CDF_STATUS wma_suspend_req(tp_wma_handle wma, enum cdf_suspend_type type);
+void wma_calculate_and_update_conn_state(tp_wma_handle wma);
+void wma_update_conn_state(tp_wma_handle wma, uint32_t conn_mask);
+void wma_update_conn_state(tp_wma_handle wma, uint32_t conn_mask);
 
 void wma_del_ts_req(tp_wma_handle wma, tDelTsParams *msg);
 
@@ -1114,5 +1169,11 @@ CDF_STATUS wma_process_set_ie_info(tp_wma_handle wma,
 				   struct vdev_ie_info *ie_info);
 int wma_peer_assoc_conf_handler(void *handle, uint8_t *cmd_param_info,
 				uint32_t len);
+int wma_vdev_delete_handler(void *handle, uint8_t *cmd_param_info,
+				uint32_t len);
 
+int wma_peer_delete_handler(void *handle, uint8_t *cmd_param_info,
+				uint32_t len);
+void wma_remove_req(tp_wma_handle wma, uint8_t vdev_id,
+			    uint8_t type);
 #endif
diff --git a/core/wma/inc/wma_tgt_cfg.h b/core/wma/inc/wma_tgt_cfg.h
index 5efa9545d822..73a739be0ef9 100644
--- a/core/wma/inc/wma_tgt_cfg.h
+++ b/core/wma/inc/wma_tgt_cfg.h
@@ -147,6 +147,7 @@ struct wma_dfs_radar_ind {
  * @vht_cap: struct wma_tgt_vht_cap
  * @max_intf_count: max interface count
  * @lpss_support: lpass support
+ * @egap_support: enhanced green ap support
  */
 struct wma_tgt_cfg {
 	uint32_t target_fw_version;
@@ -164,5 +165,8 @@ struct wma_tgt_cfg {
 	uint8_t lpss_support;
 #endif
 	uint8_t ap_arpns_support;
+#ifdef FEATURE_GREEN_AP
+	bool egap_support;
+#endif
 };
 #endif /* WMA_TGT_CFG_H */
diff --git a/core/wma/inc/wma_types.h b/core/wma/inc/wma_types.h
index 17caf8f1de75..9460d5f0fcc4 100644
--- a/core/wma/inc/wma_types.h
+++ b/core/wma/inc/wma_types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -123,9 +123,14 @@
 
 #define WMA_GET_RX_RFBAND(pRxMeta) 0
 
-#define WMA_MAX_TXPOWER_INVALID		127
-#define WMA_GET_RX_RSSI_DB(pRxMeta) \
-	(((t_packetmeta *)pRxMeta)->rssi)
+#define WMA_MAX_TXPOWER_INVALID        127
+/* rssi value normalized to noise floor of -96 dBm */
+#define WMA_GET_RX_RSSI_NORMALIZED(pRxMeta) \
+		       (((t_packetmeta *)pRxMeta)->rssi)
+
+/* raw rssi based on actual noise floor in hardware */
+#define WMA_GET_RX_RSSI_RAW(pRxMeta) \
+		       (((t_packetmeta *)pRxMeta)->rssi_raw)
 
 /* WMA Messages */
 #define WMA_MSG_TYPES_BEGIN            SIR_HAL_MSG_TYPES_BEGIN
@@ -257,6 +262,9 @@
 #define WMA_WLAN_RESUME_REQ           SIR_HAL_WLAN_RESUME_REQ
 #define WMA_MSG_TYPES_END    SIR_HAL_MSG_TYPES_END
 
+#define WMA_RUNTIME_PM_SUSPEND_IND	SIR_HAL_RUNTIME_PM_SUSPEND_IND
+#define WMA_RUNTIME_PM_RESUME_IND	SIR_HAL_RUNTIME_PM_RESUME_IND
+
 #ifdef WLAN_FEATURE_VOWIFI_11R
 #define WMA_AGGR_QOS_REQ               SIR_HAL_AGGR_QOS_REQ
 #define WMA_AGGR_QOS_RSP               SIR_HAL_AGGR_QOS_RSP
@@ -280,7 +288,6 @@
 #define WMA_ROAM_SCAN_OFFLOAD_REQ   SIR_HAL_ROAM_SCAN_OFFLOAD_REQ
 
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-#define WMA_ROAM_OFFLOAD_SYNCH_CNF  SIR_HAL_ROAM_OFFLOAD_SYNCH_CNF
 #define WMA_ROAM_OFFLOAD_SYNCH_IND  SIR_HAL_ROAM_OFFLOAD_SYNCH_IND
 #define WMA_ROAM_OFFLOAD_SYNCH_FAIL SIR_HAL_ROAM_OFFLOAD_SYNCH_FAIL
 #endif
@@ -444,9 +451,11 @@
 #define WMA_DCC_GET_STATS_CMD                SIR_HAL_DCC_GET_STATS_CMD
 #define WMA_DCC_CLEAR_STATS_CMD              SIR_HAL_DCC_CLEAR_STATS_CMD
 #define WMA_DCC_UPDATE_NDL_CMD               SIR_HAL_DCC_UPDATE_NDL_CMD
-#define WMA_SET_IE_INFO                       SIR_HAL_SET_IE_INFO
+#define WMA_SET_IE_INFO                      SIR_HAL_SET_IE_INFO
 
-#define WMA_LRO_CONFIG_CMD                    SIR_HAL_LRO_CONFIG_CMD
+#define WMA_LRO_CONFIG_CMD                   SIR_HAL_LRO_CONFIG_CMD
+#define WMA_GW_PARAM_UPDATE_REQ              SIR_HAL_GATEWAY_PARAM_UPDATE_REQ
+#define WMA_SET_EGAP_CONF_PARAMS             SIR_HAL_SET_EGAP_CONF_PARAMS
 
 /* Bit 6 will be used to control BD rate for Management frames */
 #define HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME 0x40
@@ -617,11 +626,15 @@ struct ar6k_testmode_cmd_data {
  * @WMA_TDLS_PEER_STATE_PEERING: peer is making connection
  * @WMA_TDLS_PEER_STATE_CONNECTED: peer is connected
  * @WMA_TDLS_PEER_STATE_TEARDOWN: peer is teardown
+ * @WMA_TDLS_PEER_ADD_MAC_ADDR: add peer into connection table
+ * @WMA_TDLS_PEER_REMOVE_MAC_ADDR: remove peer from connection table
  */
 typedef enum {
 	WMA_TDLS_PEER_STATE_PEERING,
 	WMA_TDLS_PEER_STATE_CONNECTED,
 	WMA_TDLS_PEER_STATE_TEARDOWN,
+	WMA_TDLS_PEER_ADD_MAC_ADDR,
+	WMA_TDLS_PEER_REMOVE_MAC_ADDR,
 } WMA_TdlsPeerState;
 
 /**
@@ -674,6 +687,12 @@ CDF_STATUS wma_register_mgmt_frm_client(void *p_cds_gctx,
 				wma_mgmt_frame_rx_callback mgmt_rx_cb);
 
 CDF_STATUS wma_de_register_mgmt_frm_client(void *p_cds_gctx);
-
+CDF_STATUS wma_register_roaming_callbacks(void *cds_ctx,
+		void (*csr_roam_synch_cb)(tpAniSirGlobal mac,
+			roam_offload_synch_ind *roam_synch_data,
+			tpSirBssDescription  bss_desc_ptr, uint8_t reason),
+		CDF_STATUS (*pe_roam_synch_cb)(tpAniSirGlobal mac,
+			roam_offload_synch_ind *roam_synch_data,
+			tpSirBssDescription  bss_desc_ptr));
 
 #endif
diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c
index 286df551ed02..91bb65d4b57c 100644
--- a/core/wma/src/wma_data.c
+++ b/core/wma/src/wma_data.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -806,7 +806,7 @@ static void wma_data_tx_ack_work_handler(void *ack_work)
 	tp_wma_handle wma_handle;
 	pWMAAckFnTxComp ack_cb;
 
-	if (cds_is_load_unload_in_progress()) {
+	if (cds_is_load_or_unload_in_progress()) {
 		WMA_LOGE("%s: Driver load/unload in progress", __func__);
 		return;
 	}
@@ -888,11 +888,10 @@ wma_data_tx_ack_comp_hdlr(void *wma_context, cdf_nbuf_t netbuf, int32_t status)
 			ack_work->sub_type = 0;
 			ack_work->status = status;
 
-			cdf_create_work(0, &ack_work->ack_cmp_work,
+			cdf_create_work(&ack_work->ack_cmp_work,
 					wma_data_tx_ack_work_handler,
 					ack_work);
-			/* Schedule the Work */
-			cdf_sched_work(0, &ack_work->ack_cmp_work);
+			cdf_schedule_work(&ack_work->ack_cmp_work);
 		}
 	}
 
@@ -1320,16 +1319,15 @@ void wma_set_linkstate(tp_wma_handle wma, tpLinkStateParams params)
 	}
 
 	if (params->state == eSIR_LINK_PREASSOC_STATE) {
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-		if (wma->interfaces[vdev_id].roam_synch_in_progress) {
+		if (wma_is_roam_synch_in_progress(wma, vdev_id))
 			roam_synch_in_progress = true;
-		}
-#endif /* WLAN_FEATURE_ROAM_OFFLOAD */
 		status = wma_create_peer(wma, pdev, vdev, params->bssid,
 				WMI_PEER_TYPE_DEFAULT, vdev_id,
 				roam_synch_in_progress);
 		if (status != CDF_STATUS_SUCCESS)
-			params->status = false;
+			WMA_LOGE("%s: Unable to create peer", __func__);
+		if (roam_synch_in_progress)
+			return;
 	} else {
 		WMA_LOGD("%s, vdev_id: %d, pausing tx_ll_queue for VDEV_STOP",
 			 __func__, vdev_id);
@@ -1482,7 +1480,7 @@ static void wma_mgmt_tx_ack_work_handler(void *ack_work)
 	tp_wma_handle wma_handle;
 	pWMAAckFnTxComp ack_cb;
 
-	if (cds_is_load_unload_in_progress()) {
+	if (cds_is_load_or_unload_in_progress()) {
 		WMA_LOGE("%s: Driver load/unload in progress", __func__);
 		return;
 	}
@@ -1564,12 +1562,11 @@ wma_mgmt_tx_ack_comp_hdlr(void *wma_context, cdf_nbuf_t netbuf, int32_t status)
 				ack_work->sub_type = pFc->subType;
 				ack_work->status = status;
 
-				cdf_create_work(0, &ack_work->ack_cmp_work,
+				cdf_create_work(&ack_work->ack_cmp_work,
 						wma_mgmt_tx_ack_work_handler,
 						ack_work);
 
-				/* Schedule the Work */
-				cdf_sched_work(0, &ack_work->ack_cmp_work);
+				cdf_schedule_work(&ack_work->ack_cmp_work);
 			}
 		}
 	}
diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c
index 2fa2461ac8ab..d5d0abf2344c 100644
--- a/core/wma/src/wma_dev_if.c
+++ b/core/wma/src/wma_dev_if.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -153,7 +153,6 @@ bool wma_is_vdev_in_ibss_mode(tp_wma_handle wma, uint8_t vdev_id)
 }
 #endif /* QCA_IBSS_SUPPORT */
 
-
 /**
  * wma_find_vdev_by_bssid() - Get the corresponding vdev_id from BSSID
  * @wma - wma handle
@@ -298,6 +297,9 @@ static int wma_unified_vdev_delete_send(wmi_unified_t wmi_handle, uint8_t if_id)
  * @vdev_id: vdev id
  * @type: request type
  *
+ * Find target request for given vdev id & type of request.
+ * Remove that request from active list.
+ *
  * Return: return target request if found or NULL.
  */
 static struct wma_target_req *wma_find_req(tp_wma_handle wma,
@@ -351,6 +353,68 @@ static struct wma_target_req *wma_find_req(tp_wma_handle wma,
 }
 
 /**
+ * wma_find_remove_req_msgtype() - find and remove request for vdev id
+ * @wma: wma handle
+ * @vdev_id: vdev id
+ * @msg_type: message request type
+ *
+ * Find target request for given vdev id & sub type of request.
+ * Remove the same from active list.
+ *
+ * Return: Success if request found, failure other wise
+ */
+static struct wma_target_req *wma_find_remove_req_msgtype(tp_wma_handle wma,
+					   uint8_t vdev_id, uint32_t msg_type)
+{
+	struct wma_target_req *req_msg = NULL;
+	bool found = false;
+	cdf_list_node_t *node1 = NULL, *node2 = NULL;
+	CDF_STATUS status;
+
+	cdf_spin_lock_bh(&wma->wma_hold_req_q_lock);
+	if (CDF_STATUS_SUCCESS != cdf_list_peek_front(&wma->wma_hold_req_queue,
+						      &node2)) {
+		cdf_spin_unlock_bh(&wma->wma_hold_req_q_lock);
+		WMA_LOGE(FL("unable to get msg node from request queue"));
+		return NULL;
+	}
+
+	do {
+		node1 = node2;
+		req_msg = cdf_container_of(node1, struct wma_target_req, node);
+		if (req_msg->vdev_id != vdev_id)
+			continue;
+		if (req_msg->msg_type != msg_type)
+			continue;
+
+		found = true;
+		status = cdf_list_remove_node(&wma->wma_hold_req_queue, node1);
+		if (CDF_STATUS_SUCCESS != status) {
+			cdf_spin_unlock_bh(&wma->wma_hold_req_q_lock);
+			WMA_LOGD(FL("Failed to remove request. vdev_id %d type %d"),
+				 vdev_id, msg_type);
+			return NULL;
+		}
+		break;
+	} while (CDF_STATUS_SUCCESS  ==
+			cdf_list_peek_next(&wma->wma_hold_req_queue, node1,
+					   &node2));
+
+	cdf_spin_unlock_bh(&wma->wma_hold_req_q_lock);
+	if (!found) {
+		WMA_LOGE(FL("target request not found for vdev_id %d type %d"),
+			 vdev_id, msg_type);
+		return NULL;
+	}
+
+	WMA_LOGD(FL("target request found for vdev id: %d type %d"),
+		 vdev_id, msg_type);
+
+	return req_msg;
+}
+
+
+/**
  * wma_find_vdev_req() - find target request for vdev id
  * @wma: wma handle
  * @vdev_id: vdev id
@@ -429,21 +493,24 @@ void wma_vdev_detach_callback(void *ctx)
 		return;
 	}
 	param = (struct del_sta_self_params *) iface->del_staself_req;
-	WMA_LOGD("%s: sending eWNI_SME_DEL_STA_SELF_RSP for vdev %d",
+	WMA_LOGE("%s: sending eWNI_SME_DEL_STA_SELF_RSP for vdev %d",
 		 __func__, param->session_id);
-
-	req_msg = wma_find_vdev_req(wma, param->session_id,
-				    WMA_TARGET_REQ_TYPE_VDEV_DEL);
-	if (req_msg) {
-		WMA_LOGD("%s: Found vdev request for vdev id %d",
-			 __func__, param->session_id);
-		cdf_mc_timer_stop(&req_msg->event_timeout);
-		cdf_mc_timer_destroy(&req_msg->event_timeout);
-		cdf_mem_free(req_msg);
+	if (!WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
+				    WMI_SERVICE_SYNC_DELETE_CMDS)) {
+		req_msg = wma_find_vdev_req(wma, param->session_id,
+					    WMA_TARGET_REQ_TYPE_VDEV_DEL);
+		if (req_msg) {
+			WMA_LOGD("%s: Found vdev request for vdev id %d",
+				 __func__, param->session_id);
+			cdf_mc_timer_stop(&req_msg->event_timeout);
+			cdf_mc_timer_destroy(&req_msg->event_timeout);
+			cdf_mem_free(req_msg);
+		}
 	}
 	if (iface->addBssStaContext)
 		cdf_mem_free(iface->addBssStaContext);
 
+
 #if defined WLAN_FEATURE_VOWIFI_11R
 	if (iface->staKeyParams)
 		cdf_mem_free(iface->staKeyParams);
@@ -461,93 +528,127 @@ void wma_vdev_detach_callback(void *ctx)
 	}
 }
 
+
 /**
- * wma_vdev_detach() - send vdev delete command to fw
- * @wma_handle: wma handle
- * @pdel_sta_self_req_param: del sta params
- * @generateRsp: generate Response flag
+ * wma_self_peer_remove() - Self peer remove handler
+ * @wma: wma handle
+ * @del_sta_self_req_param: vdev id
+ * @generate_vdev_rsp: request type
  *
- * Return: CDF status
+ * Return: success if peer delete command sent to firmware, else failure.
  */
-CDF_STATUS wma_vdev_detach(tp_wma_handle wma_handle,
-			struct del_sta_self_params *pdel_sta_self_req_param,
-			uint8_t generateRsp)
+
+static CDF_STATUS wma_self_peer_remove(tp_wma_handle wma_handle,
+			struct del_sta_self_params *del_sta_self_req_param,
+			uint8_t generate_vdev_rsp)
 {
-	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	ol_txrx_peer_handle peer;
 	ol_txrx_pdev_handle pdev;
 	uint8_t peer_id;
-	uint8_t vdev_id = pdel_sta_self_req_param->session_id;
-	struct wma_txrx_node *iface = &wma_handle->interfaces[vdev_id];
-	struct wma_target_req *msg;
-	cds_msg_t sme_msg = { 0 };
-
-	if ((iface->type == WMI_VDEV_TYPE_AP) &&
-	    (iface->sub_type == WMI_UNIFIED_VDEV_SUBTYPE_P2P_DEVICE)) {
-
-		WMA_LOGA("P2P Device: removing self peer %pM",
-			 pdel_sta_self_req_param->self_mac_addr);
+	uint8_t vdev_id = del_sta_self_req_param->session_id;
+	struct wma_target_req *msg = NULL;
+	struct del_sta_self_rsp_params *sta_self_wmi_rsp;
 
-		pdev = cds_get_context(CDF_MODULE_ID_TXRX);
+	WMA_LOGE("P2P Device: removing self peer %pM",
+		 del_sta_self_req_param->self_mac_addr);
 
-		if (NULL == pdev) {
-			WMA_LOGE("%s: Failed to get pdev", __func__);
+	pdev = cds_get_context(CDF_MODULE_ID_TXRX);
+	if (NULL == pdev) {
+		WMA_LOGE("%s: Failed to get pdev", __func__);
 			return CDF_STATUS_E_FAULT;
-		}
-
-		peer = ol_txrx_find_peer_by_addr(pdev,
-				 pdel_sta_self_req_param->self_mac_addr,
-				 &peer_id);
-		if (!peer) {
-			WMA_LOGE("%s Failed to find peer %pM", __func__,
-				 pdel_sta_self_req_param->self_mac_addr);
-		}
-		wma_remove_peer(wma_handle,
-				pdel_sta_self_req_param->self_mac_addr,
-				vdev_id, peer, false);
-	}
-	if (cdf_atomic_read(&iface->bss_status) == WMA_BSS_STATUS_STARTED) {
-		WMA_LOGA("BSS is not yet stopped. Defering vdev(vdev id %x) deletion",
-			vdev_id);
-		iface->del_staself_req = pdel_sta_self_req_param;
-		return status;
 	}
 
-	if (!iface->handle) {
-		WMA_LOGE("handle of vdev_id %d is NULL vdev is already freed",
-			 vdev_id);
-		cdf_mem_free(pdel_sta_self_req_param);
-		pdel_sta_self_req_param = NULL;
-		return status;
+	peer = ol_txrx_find_peer_by_addr(pdev,
+			 del_sta_self_req_param->self_mac_addr,
+			 &peer_id);
+	if (!peer) {
+		WMA_LOGE("%s Failed to find peer %pM", __func__,
+			 del_sta_self_req_param->self_mac_addr);
+		return CDF_STATUS_SUCCESS;
 	}
+	wma_remove_peer(wma_handle,
+			del_sta_self_req_param->self_mac_addr,
+			vdev_id, peer, false);
+
+	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+				WMI_SERVICE_SYNC_DELETE_CMDS)) {
+		sta_self_wmi_rsp =
+			cdf_mem_malloc(sizeof(struct del_sta_self_rsp_params));
+		if (sta_self_wmi_rsp == NULL) {
+			WMA_LOGP(FL("Failed to allocate memory"));
+			return CDF_STATUS_E_NOMEM;
+		}
+		sta_self_wmi_rsp->self_sta_param = del_sta_self_req_param;
+		sta_self_wmi_rsp->generate_rsp = generate_vdev_rsp;
+		msg = wma_fill_hold_req(wma_handle, vdev_id,
+				   WMA_DELETE_STA_REQ,
+				   WMA_DEL_P2P_SELF_STA_RSP_START,
+				   sta_self_wmi_rsp,
+				   WMA_DELETE_STA_TIMEOUT);
+		if (!msg) {
+			WMA_LOGP(FL("Failed to allocate request for vdev_id %d"),
+				 vdev_id);
+			wma_remove_req(wma_handle, vdev_id,
+				WMA_DEL_P2P_SELF_STA_RSP_START);
+			return CDF_STATUS_E_FAILURE;
+		}
+	}
+	return CDF_STATUS_SUCCESS;
+}
 
+static CDF_STATUS wma_handle_vdev_detach(tp_wma_handle wma_handle,
+			struct del_sta_self_params *del_sta_self_req_param,
+			uint8_t generate_rsp)
+{
+	CDF_STATUS status = CDF_STATUS_SUCCESS;
+	uint8_t vdev_id = del_sta_self_req_param->session_id;
+	struct wma_txrx_node *iface = &wma_handle->interfaces[vdev_id];
+	struct wma_target_req *msg = NULL;
+	cds_msg_t sme_msg = { 0 };
 
-	/* remove the interface from ath_dev */
 	if (wma_unified_vdev_delete_send(wma_handle->wmi_handle, vdev_id)) {
-		WMA_LOGE("Unable to remove an interface for ath_dev.");
+		WMA_LOGE("Unable to remove an interface");
 		status = CDF_STATUS_E_FAILURE;
 		goto out;
 	}
 
-	WMA_LOGD("vdev_id:%hu vdev_hdl:%p", vdev_id, iface->handle);
-	if (!generateRsp) {
+	WMA_LOGE("vdev_id:%hu vdev_hdl:%p", vdev_id, iface->handle);
+	if (!generate_rsp) {
 		WMA_LOGE("Call txrx detach w/o callback for vdev %d", vdev_id);
 		ol_txrx_vdev_detach(iface->handle, NULL, NULL);
 		goto out;
 	}
 
-	iface->del_staself_req = pdel_sta_self_req_param;
+	iface->del_staself_req = del_sta_self_req_param;
 	msg = wma_fill_vdev_req(wma_handle, vdev_id, WMA_DEL_STA_SELF_REQ,
-				WMA_TARGET_REQ_TYPE_VDEV_DEL, iface, 2000);
+				WMA_TARGET_REQ_TYPE_VDEV_DEL, iface, 6000);
 	if (!msg) {
 		WMA_LOGE("%s: Failed to fill vdev request for vdev_id %d",
 			 __func__, vdev_id);
 		status = CDF_STATUS_E_NOMEM;
 		goto out;
 	}
+
+	/* Acquire wake lock only when you expect a response from firmware */
+	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+				    WMI_SERVICE_SYNC_DELETE_CMDS)) {
+		cdf_wake_lock_timeout_acquire(
+					 &wma_handle->wmi_cmd_rsp_wake_lock,
+					 WMA_FW_RSP_EVENT_WAKE_LOCK_DURATION,
+					 WIFI_POWER_EVENT_WAKELOCK_WMI_CMD_RSP);
+		cdf_runtime_pm_prevent_suspend(
+					wma_handle->wmi_cmd_rsp_runtime_lock);
+	}
 	WMA_LOGD("Call txrx detach with callback for vdev %d", vdev_id);
 	ol_txrx_vdev_detach(iface->handle, NULL, NULL);
-	wma_vdev_detach_callback(iface);
+
+	/*
+	 * send the response immediately if WMI_SERVICE_SYNC_DELETE_CMDS
+	 * service is not supported by firmware
+	 */
+	if (!WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+				    WMI_SERVICE_SYNC_DELETE_CMDS))
+		wma_vdev_detach_callback(iface);
 	return status;
 out:
 	if (iface->addBssStaContext)
@@ -557,20 +658,67 @@ out:
 		cdf_mem_free(iface->staKeyParams);
 #endif /* WLAN_FEATURE_VOWIFI_11R */
 	cdf_mem_zero(iface, sizeof(*iface));
-	pdel_sta_self_req_param->status = status;
-	if (generateRsp) {
+	del_sta_self_req_param->status = status;
+	if (generate_rsp) {
 		sme_msg.type = eWNI_SME_DEL_STA_SELF_RSP;
-		sme_msg.bodyptr = pdel_sta_self_req_param;
+		sme_msg.bodyptr = del_sta_self_req_param;
 		sme_msg.bodyval = 0;
 
 		status = cds_mq_post_message(CDF_MODULE_ID_SME, &sme_msg);
 		if (!CDF_IS_STATUS_SUCCESS(status)) {
-			WMA_LOGE("Failed to post eWNI_SME_ADD_STA_SELF_RSP");
-			cdf_mem_free(pdel_sta_self_req_param);
+			WMA_LOGE("Failed to post eWNI_SME_DEL_STA_SELF_RSP");
+			cdf_mem_free(del_sta_self_req_param);
 		}
 	}
 	return status;
 }
+/**
+ * wma_vdev_detach() - send vdev delete command to fw
+ * @wma_handle: wma handle
+ * @pdel_sta_self_req_param: del sta params
+ * @generateRsp: generate Response flag
+ *
+ * Return: CDF status
+ */
+CDF_STATUS wma_vdev_detach(tp_wma_handle wma_handle,
+			struct del_sta_self_params *pdel_sta_self_req_param,
+			uint8_t generateRsp)
+{
+	CDF_STATUS status = CDF_STATUS_SUCCESS;
+	uint8_t vdev_id = pdel_sta_self_req_param->session_id;
+	struct wma_txrx_node *iface = &wma_handle->interfaces[vdev_id];
+
+	if (cdf_atomic_read(&iface->bss_status) == WMA_BSS_STATUS_STARTED) {
+		WMA_LOGA("BSS is not yet stopped. Defering vdev(vdev id %x) deletion",
+			vdev_id);
+		iface->del_staself_req = pdel_sta_self_req_param;
+		return status;
+	}
+
+	if (!iface->handle) {
+		WMA_LOGE("handle of vdev_id %d is NULL vdev is already freed",
+			 vdev_id);
+		cdf_mem_free(pdel_sta_self_req_param);
+		pdel_sta_self_req_param = NULL;
+		return status;
+	}
+
+	/* P2P Device */
+	if ((iface->type == WMI_VDEV_TYPE_AP) &&
+	    (iface->sub_type == WMI_UNIFIED_VDEV_SUBTYPE_P2P_DEVICE)) {
+		wma_self_peer_remove(wma_handle, pdel_sta_self_req_param,
+					generateRsp);
+		if (!WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+				WMI_SERVICE_SYNC_DELETE_CMDS))
+			status = wma_handle_vdev_detach(wma_handle,
+				pdel_sta_self_req_param, generateRsp);
+	} else {  /* other than P2P */
+		status = wma_handle_vdev_detach(wma_handle,
+				pdel_sta_self_req_param, generateRsp);
+	}
+
+	return status;
+}
 
 /**
  * wmi_unified_peer_delete_send() - send PEER delete command to fw
@@ -1069,22 +1217,18 @@ void wma_remove_peer(tp_wma_handle wma, uint8_t *bssid,
 	wma->interfaces[vdev_id].peer_count--;
 	WMA_LOGE("%s: Removed peer with peer_addr %pM vdevid %d peer_count %d",
 		 __func__, bssid, vdev_id, wma->interfaces[vdev_id].peer_count);
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
 	if (roam_synch_in_progress)
 		return;
-#endif /* WLAN_FEATURE_ROAM_OFFLOAD */
 	/* Flush all TIDs except MGMT TID for this peer in Target */
 	peer_tid_bitmap &= ~(0x1 << WMI_MGMT_TID);
 	wmi_unified_peer_flush_tids_send(wma->wmi_handle, bssid,
 					 peer_tid_bitmap, vdev_id);
 
-#if defined(QCA_IBSS_SUPPORT)
 	if ((peer) && (wma_is_vdev_in_ibss_mode(wma, vdev_id))) {
 		WMA_LOGD("%s: bssid %pM peer->mac_addr %pM", __func__,
 			 bssid, peer->mac_addr.raw);
 		peer_addr = peer->mac_addr.raw;
 	}
-#endif /* QCA_IBSS_SUPPORT */
 
 	wmi_unified_peer_delete_send(wma->wmi_handle, peer_addr, vdev_id);
 #undef PEER_ALL_TID_BITMASK
@@ -1161,15 +1305,13 @@ CDF_STATUS wma_create_peer(tp_wma_handle wma, ol_txrx_pdev_handle pdev,
 		WMA_LOGE("%s : Unable to attach peer %pM", __func__, peer_addr);
 		goto err;
 	}
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
 	if (roam_synch_in_progress) {
 
-		WMA_LOGE("%s: Created peer with peer_addr %pM vdev_id %d,"
+		WMA_LOGE("%s: LFR3: Created peer with peer_addr %pM vdev_id %d,"
 			 "peer_count - %d", __func__, peer_addr, vdev_id,
 			 wma->interfaces[vdev_id].peer_count);
 		return CDF_STATUS_SUCCESS;
 	}
-#endif /* WLAN_FEATURE_ROAM_OFFLOAD */
 	if (wmi_unified_peer_create_send(wma->wmi_handle, peer_addr,
 					 peer_type, vdev_id) < 0) {
 		WMA_LOGP("%s : Unable to create peer in Target", __func__);
@@ -1179,7 +1321,6 @@ CDF_STATUS wma_create_peer(tp_wma_handle wma, ol_txrx_pdev_handle pdev,
 	WMA_LOGE("%s: Created peer with peer_addr %pM vdev_id %d, peer_count - %d",
 		__func__, peer_addr, vdev_id, wma->interfaces[vdev_id].peer_count);
 
-#ifdef QCA_IBSS_SUPPORT
 	/* for each remote ibss peer, clear its keys */
 	if (wma_is_vdev_in_ibss_mode(wma, vdev_id) &&
 	    !cdf_mem_compare(peer_addr, vdev->mac_addr.raw,
@@ -1190,13 +1331,12 @@ CDF_STATUS wma_create_peer(tp_wma_handle wma, ol_txrx_pdev_handle pdev,
 			 peer_addr);
 		cdf_mem_set(&key_info, sizeof(key_info), 0);
 		key_info.smesessionId = vdev_id;
-		cdf_mem_copy(key_info.peerMacAddr, peer_addr,
+		cdf_mem_copy(key_info.peer_macaddr.bytes, peer_addr,
 				IEEE80211_ADDR_LEN);
 		key_info.sendRsp = false;
 
 		wma_set_stakey(wma, &key_info);
 	}
-#endif /* QCA_IBSS_SUPPORT */
 
 	return CDF_STATUS_SUCCESS;
 err:
@@ -1289,7 +1429,22 @@ static void wma_delete_all_ibss_peers(tp_wma_handle wma, A_UINT32 vdev_id)
 	wma_remove_peer(wma, wma->interfaces[vdev_id].bssid, vdev_id, peer,
 			false);
 }
-
+#else
+/**
+ * wma_delete_all_ibss_peers(): dummy function for when ibss is not supported
+ * @wma: wma handle
+ * @vdev_id: vdev id
+ *
+ * This function send peer delete command to fw for all
+ * peers in peer_list  and remove ref count for peer id
+ * peer will actually remove from list after receving
+ * unmap event from firmware.
+ *
+ * Return: none
+ */
+static void wma_delete_all_ibss_peers(tp_wma_handle wma, A_UINT32 vdev_id)
+{
+}
 #endif /* QCA_IBSS_SUPPORT */
 
 /**
@@ -1405,6 +1560,20 @@ static void wma_recreate_ibss_vdev_and_bss_peer(tp_wma_handle wma,
 		WMA_LOGA("IBSS BSS peer created with mac %pM",
 			 vdev->mac_addr.raw);
 }
+#else
+/**
+ * wma_recreate_ibss_vdev_and_bss_peer() - dummy function
+ * @wma: wma handle
+ * @vdev_id: vdev id
+ *
+ * Dummy for when IBSS not supported
+ *
+ * Return: none
+ */
+static void wma_recreate_ibss_vdev_and_bss_peer(tp_wma_handle wma,
+						uint8_t vdev_id)
+{
+}
 #endif /* QCA_IBSS_SUPPORT */
 
 /**
@@ -1568,11 +1737,9 @@ int wma_vdev_stop_resp_handler(void *handle, uint8_t *cmd_param_info,
 			status = -EINVAL;
 			goto free_req_msg;
 		}
-#ifdef QCA_IBSS_SUPPORT
 		if (wma_is_vdev_in_ibss_mode(wma, resp_event->vdev_id))
 			wma_delete_all_ibss_peers(wma, resp_event->vdev_id);
 		else
-#endif /* QCA_IBSS_SUPPORT */
 		{
 			if (wma_is_vdev_in_ap_mode(wma, resp_event->vdev_id)) {
 				wma_delete_all_ap_remote_peers(wma,
@@ -1619,12 +1786,12 @@ int wma_vdev_stop_resp_handler(void *handle, uint8_t *cmd_param_info,
 			cdf_mem_free(bcn);
 			wma->interfaces[resp_event->vdev_id].beacon = NULL;
 		}
-#ifdef QCA_IBSS_SUPPORT
+
 		/* recreate ibss vdev and bss peer for scan purpose */
 		if (wma_is_vdev_in_ibss_mode(wma, resp_event->vdev_id))
 			wma_recreate_ibss_vdev_and_bss_peer(wma,
 						resp_event->vdev_id);
-#endif /* QCA_IBSS_SUPPORT */
+
 		/* Timeout status means its WMA generated DEL BSS REQ when ADD
 		 * BSS REQ was timed out to stop the VDEV in this case no need
 		 * to send response to UMAC
@@ -1904,32 +2071,6 @@ end:
 }
 
 /**
- * wma_get_center_channel() - get center channel
- * @chan: channel number
- * @chan_offset: channel offset
- *
- * Return: center channel
- */
-uint8_t wma_get_center_channel(uint8_t chan, uint8_t chan_offset)
-{
-	uint8_t band_center_chan = 0;
-
-	if ((chan_offset == PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED) ||
-	    (chan_offset == PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW))
-		band_center_chan = chan + 2;
-	else if (chan_offset == PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW)
-		band_center_chan = chan + 6;
-	else if ((chan_offset == PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH) ||
-		 (chan_offset ==
-		  PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED))
-		band_center_chan = chan - 2;
-	else if (chan_offset == PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH)
-		band_center_chan = chan - 6;
-
-	return band_center_chan;
-}
-
-/**
  * wma_vdev_start() - send vdev start request to fw
  * @wma: wma handle
  * @req: vdev start params
@@ -2284,6 +2425,123 @@ free_req_msg:
 }
 
 /**
+ * wma_vdev_delete_handler() - vdev delete response handler
+ * @handle: wma handle
+ * @cmd_param_info: event buffer
+ * @len: buffer length
+ *
+ * Return: 0 for success or error code
+ */
+int wma_vdev_delete_handler(void *handle, uint8_t *cmd_param_info,
+				uint32_t len)
+{
+	tp_wma_handle wma = (tp_wma_handle) handle;
+	WMI_VDEV_DELETE_RESP_EVENTID_param_tlvs *param_buf;
+	wmi_vdev_delete_cmd_fixed_param *event;
+	struct wma_target_req *req_msg;
+	int status = 0;
+
+	param_buf = (WMI_VDEV_DELETE_RESP_EVENTID_param_tlvs *)cmd_param_info;
+	if (!param_buf) {
+		WMA_LOGE("Invalid vdev delete event buffer");
+		return -EINVAL;
+	}
+
+	event = (wmi_vdev_delete_cmd_fixed_param *)param_buf->fixed_param;
+	if (!event) {
+		WMA_LOGE("Invalid vdev delete event buffer");
+		return -EINVAL;
+	}
+
+	WMA_LOGE("%s Vdev delete resp vdev id %d", __func__, event->vdev_id);
+	req_msg = wma_find_vdev_req(wma, event->vdev_id,
+				WMA_TARGET_REQ_TYPE_VDEV_DEL);
+	if (!req_msg) {
+		WMA_LOGD(FL("Vdev delete resp is not handled! vdev id %d"),
+				event->vdev_id);
+		return -EINVAL;
+	}
+	cdf_wake_lock_release(&wma->wmi_cmd_rsp_wake_lock,
+				WIFI_POWER_EVENT_WAKELOCK_WMI_CMD_RSP);
+	cdf_runtime_pm_allow_suspend(wma->wmi_cmd_rsp_runtime_lock);
+	/* Send response to upper layers */
+	wma_vdev_detach_callback(req_msg->user_data);
+	cdf_mc_timer_stop(&req_msg->event_timeout);
+	cdf_mc_timer_destroy(&req_msg->event_timeout);
+	cdf_mem_free(req_msg);
+
+	return status;
+}
+
+/**
+ * wma_peer_delete_handler() - peer delete response handler
+ * @handle: wma handle
+ * @cmd_param_info: event buffer
+ * @len: buffer length
+ *
+ * Return: 0 for success or error code
+ */
+int wma_peer_delete_handler(void *handle, uint8_t *cmd_param_info,
+				uint32_t len)
+{
+	tp_wma_handle wma = (tp_wma_handle) handle;
+	WMI_PEER_DELETE_RESP_EVENTID_param_tlvs *param_buf;
+	wmi_peer_delete_cmd_fixed_param *event;
+	struct wma_target_req *req_msg;
+	tDeleteStaParams *del_sta;
+	uint8_t macaddr[IEEE80211_ADDR_LEN];
+	int status = 0;
+
+	param_buf = (WMI_PEER_DELETE_RESP_EVENTID_param_tlvs *)cmd_param_info;
+	if (!param_buf) {
+		WMA_LOGE("Invalid vdev delete event buffer");
+		return -EINVAL;
+	}
+
+	event = (wmi_peer_delete_cmd_fixed_param *)param_buf->fixed_param;
+	if (!event) {
+		WMA_LOGE("Invalid vdev delete event buffer");
+		return -EINVAL;
+	}
+
+	WMI_MAC_ADDR_TO_CHAR_ARRAY(&event->peer_macaddr, macaddr);
+	WMA_LOGE(FL("Peer Delete Response, vdev %d Peer %pM"),
+			event->vdev_id, macaddr);
+	req_msg = wma_find_remove_req_msgtype(wma, event->vdev_id,
+					WMA_DELETE_STA_REQ);
+	if (!req_msg) {
+		WMA_LOGD("Peer Delete response is not handled");
+		return -EINVAL;
+	}
+
+	cdf_wake_lock_release(&wma->wmi_cmd_rsp_wake_lock,
+				WIFI_POWER_EVENT_WAKELOCK_WMI_CMD_RSP);
+	cdf_runtime_pm_allow_suspend(wma->wmi_cmd_rsp_runtime_lock);
+		/* Cleanup timeout handler */
+	cdf_mc_timer_stop(&req_msg->event_timeout);
+	cdf_mc_timer_destroy(&req_msg->event_timeout);
+
+	if (req_msg->type == WMA_DELETE_STA_RSP_START) {
+		del_sta = req_msg->user_data;
+		if (del_sta->respReqd) {
+			WMA_LOGD(FL("Sending peer del rsp to umac"));
+			wma_send_msg(wma, WMA_DELETE_STA_RSP,
+				(void *)del_sta, CDF_STATUS_SUCCESS);
+		}
+	} else if (req_msg->type == WMA_DEL_P2P_SELF_STA_RSP_START) {
+		struct del_sta_self_rsp_params *data;
+		data = (struct del_sta_self_rsp_params *)req_msg->user_data;
+		WMA_LOGD(FL("Calling vdev detach handler"));
+		wma_handle_vdev_detach(wma, data->self_sta_param,
+				data->generate_rsp);
+		cdf_mem_free(data);
+	}
+	cdf_mem_free(req_msg);
+	return status;
+}
+
+
+/**
  * wma_hold_req_timer() - wma hold request timeout function
  * @data: target request params
  *
@@ -2318,6 +2576,24 @@ void wma_hold_req_timer(void *data)
 		WMA_LOGD(FL("Sending add sta rsp to umac (mac:%pM, status:%d)"),
 			 params->staMac, params->status);
 		wma_send_msg(wma, WMA_ADD_STA_RSP, (void *)params, 0);
+	} else if ((tgt_req->msg_type == WMA_DELETE_STA_REQ) &&
+		(tgt_req->type == WMA_DELETE_STA_RSP_START)) {
+		tpDeleteStaParams params =
+				(tpDeleteStaParams) tgt_req->user_data;
+		params->status = CDF_STATUS_E_TIMEOUT;
+		WMA_LOGE(FL("WMA_DEL_STA_REQ timed out"));
+		WMA_LOGP(FL("Sending del sta rsp to umac (mac:%pM, status:%d)"),
+			 params->staMac, params->status);
+		/*
+		 * Assert in development build only.
+		 * Send response in production builds.
+		 */
+		CDF_ASSERT(0);
+		wma_send_msg(wma, WMA_DELETE_STA_RSP, (void *)params, 0);
+	} else if ((tgt_req->msg_type == WMA_DELETE_STA_REQ) &&
+		(tgt_req->type == WMA_DEL_P2P_SELF_STA_RSP_START)) {
+		WMA_LOGA(FL("wma delete sta p2p request timed out"));
+		CDF_ASSERT(0);
 	}
 free_tgt_req:
 	cdf_mc_timer_destroy(&tgt_req->event_timeout);
@@ -2350,6 +2626,7 @@ struct wma_target_req *wma_fill_hold_req(tp_wma_handle wma,
 	}
 
 	WMA_LOGE(FL("vdev_id %d msg %d type %d"), vdev_id, msg_type, type);
+
 	req->vdev_id = vdev_id;
 	req->msg_type = msg_type;
 	req->type = type;
@@ -2472,11 +2749,9 @@ void wma_vdev_resp_timer(void *data)
 			cdf_mc_timer_stop(&tgt_req->event_timeout);
 			goto free_tgt_req;
 		}
-#ifdef QCA_IBSS_SUPPORT
 		if (wma_is_vdev_in_ibss_mode(wma, tgt_req->vdev_id))
 			wma_delete_all_ibss_peers(wma, tgt_req->vdev_id);
 		else
-#endif /* QCA_IBSS_SUPPORT */
 		{
 			if (wma_is_vdev_in_ap_mode(wma, tgt_req->vdev_id)) {
 				wma_delete_all_ap_remote_peers(wma,
@@ -2522,12 +2797,12 @@ void wma_vdev_resp_timer(void *data)
 			cdf_mem_free(bcn);
 			wma->interfaces[tgt_req->vdev_id].beacon = NULL;
 		}
-#ifdef QCA_IBSS_SUPPORT
+
 		/* recreate ibss vdev and bss peer for scan purpose */
 		if (wma_is_vdev_in_ibss_mode(wma, tgt_req->vdev_id))
 			wma_recreate_ibss_vdev_and_bss_peer(wma,
 							    tgt_req->vdev_id);
-#endif /* QCA_IBSS_SUPPORT */
+
 		params->status = CDF_STATUS_E_TIMEOUT;
 		WMA_LOGA("%s: WMA_DELETE_BSS_REQ timedout", __func__);
 		wma_send_msg(wma, WMA_DELETE_BSS_RSP, (void *)params, 0);
@@ -2542,7 +2817,15 @@ void wma_vdev_resp_timer(void *data)
 		struct del_sta_self_params *params =
 			(struct del_sta_self_params *) iface->del_staself_req;
 
+		if (WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
+			 WMI_SERVICE_SYNC_DELETE_CMDS)) {
+			cdf_wake_lock_release(&wma->wmi_cmd_rsp_wake_lock,
+				WIFI_POWER_EVENT_WAKELOCK_WMI_CMD_RSP);
+			cdf_runtime_pm_allow_suspend(
+				wma->wmi_cmd_rsp_runtime_lock);
+		}
 		params->status = CDF_STATUS_E_TIMEOUT;
+
 		WMA_LOGA("%s: WMA_DEL_STA_SELF_REQ timedout", __func__);
 		sme_msg.type = eWNI_SME_DEL_STA_SELF_RSP;
 		sme_msg.bodyptr = iface->del_staself_req;
@@ -2714,7 +2997,7 @@ static void
 wma_vdev_set_bss_params(tp_wma_handle wma, int vdev_id,
 			tSirMacBeaconInterval beaconInterval,
 			uint8_t dtimPeriod, uint8_t shortSlotTimeSupported,
-			uint8_t llbCoexist, tPowerdBm maxTxPower)
+			uint8_t llbCoexist, int8_t maxTxPower)
 {
 	int ret;
 	uint32_t slot_time;
@@ -2783,7 +3066,7 @@ static void wma_add_bss_ap_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 	struct wma_target_req *msg;
 	uint8_t vdev_id, peer_id;
 	CDF_STATUS status;
-	tPowerdBm maxTxPower;
+	int8_t maxTxPower;
 #ifdef WLAN_FEATURE_11W
 	int ret = 0;
 #endif /* WLAN_FEATURE_11W */
@@ -2924,8 +3207,13 @@ static void wma_add_bss_ibss_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 	tSetBssKeyParams key_info;
 	struct sir_hw_mode_params hw_mode = {0};
 
-	WMA_LOGD("%s: add_bss->sessionId = %d", __func__, add_bss->sessionId);
-	vdev_id = add_bss->sessionId;
+	vdev = wma_find_vdev_by_addr(wma, add_bss->selfMacAddr, &vdev_id);
+	if (!vdev) {
+		WMA_LOGE("%s: vdev not found for vdev id %d.",
+				__func__, vdev_id);
+		goto send_fail_resp;
+	}
+	WMA_LOGD("%s: add_bss->sessionId = %d", __func__, vdev_id);
 	pdev = cds_get_context(CDF_MODULE_ID_TXRX);
 
 	if (NULL == pdev) {
@@ -2934,13 +3222,6 @@ static void wma_add_bss_ibss_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 	}
 	wma_set_bss_rate_flags(&wma->interfaces[vdev_id], add_bss);
 
-	vdev = wma_find_vdev_by_id(wma, vdev_id);
-	if (!vdev) {
-		WMA_LOGE("%s: vdev not found for vdev id %d.",
-			 __func__, vdev_id);
-		goto send_fail_resp;
-	}
-
 	/* only change vdev type to ibss during 1st time join_ibss handling */
 
 	if (false == wma_is_vdev_in_ibss_mode(wma, vdev_id)) {
@@ -3204,13 +3485,14 @@ static void wma_add_bss_sta_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 					 add_bss->bssId);
 				goto send_fail_resp;
 			}
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-			if (iface->roam_synch_in_progress) {
+			if (wma_is_roam_synch_in_progress(wma, vdev_id)) {
 				add_bss->staContext.staIdx =
 					ol_txrx_local_peer_id(peer);
-				goto send_bss_resp;
+				WMA_LOGD("LFR3:%s: bssid %pM staIdx %d",
+					__func__, add_bss->bssId,
+					add_bss->staContext.staIdx);
+				return;
 			}
-#endif
 			msg = wma_fill_vdev_req(wma, vdev_id, WMA_ADD_BSS_REQ,
 						WMA_TARGET_REQ_TYPE_VDEV_START,
 						add_bss,
@@ -3842,7 +4124,7 @@ static void wma_add_sta_req_sta_mode(tp_wma_handle wma, tpAddStaParams params)
 	CDF_STATUS status = CDF_STATUS_SUCCESS;
 	ol_txrx_peer_handle peer;
 	struct wma_txrx_node *iface;
-	tPowerdBm maxTxPower;
+	int8_t maxTxPower;
 	int ret = 0;
 	struct wma_target_req *msg;
 	bool peer_assoc_cnf = false;
@@ -3882,7 +4164,6 @@ static void wma_add_sta_req_sta_mode(tp_wma_handle wma, tpAddStaParams params)
 		status = CDF_STATUS_E_FAILURE;
 		goto out;
 	}
-
 	if (peer != NULL && peer->state == ol_txrx_peer_state_disc) {
 		/*
 		 * This is the case for reassociation.
@@ -3903,8 +4184,7 @@ static void wma_add_sta_req_sta_mode(tp_wma_handle wma, tpAddStaParams params)
 						  ol_txrx_peer_state_conn);
 		}
 
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-		if (iface->roam_synch_in_progress) {
+		if (wma_is_roam_synch_in_progress(wma, params->smesessionId)) {
 			/* iface->nss = params->nss; */
 			/*In LFR2.0, the following operations are performed as
 			 * part of wmi_unified_send_peer_assoc. As we are
@@ -3915,9 +4195,11 @@ static void wma_add_sta_req_sta_mode(tp_wma_handle wma, tpAddStaParams params)
 			cdf_atomic_set(&iface->bss_status,
 				       WMA_BSS_STATUS_STARTED);
 			iface->aid = params->assocId;
-			goto out;
+			WMA_LOGE("LFR3:statype %d vdev %d aid %d bssid %pM",
+					params->staType, params->smesessionId,
+					params->assocId, params->bssId);
+			return;
 		}
-#endif
 		wmi_unified_send_txbf(wma, params);
 
 		if (WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
@@ -4067,6 +4349,7 @@ static void wma_delete_sta_req_ap_mode(tp_wma_handle wma,
 {
 	ol_txrx_pdev_handle pdev;
 	struct ol_txrx_peer_t *peer;
+	struct wma_target_req *msg;
 
 	pdev = cds_get_context(CDF_MODULE_ID_TXRX);
 
@@ -4088,6 +4371,31 @@ static void wma_delete_sta_req_ap_mode(tp_wma_handle wma,
 			false);
 	del_sta->status = CDF_STATUS_SUCCESS;
 
+	if (WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
+				    WMI_SERVICE_SYNC_DELETE_CMDS)) {
+		msg = wma_fill_hold_req(wma, del_sta->smesessionId,
+				   WMA_DELETE_STA_REQ,
+				   WMA_DELETE_STA_RSP_START, del_sta,
+				   WMA_DELETE_STA_TIMEOUT);
+		if (!msg) {
+			WMA_LOGP(FL("Failed to allocate request. vdev_id %d"),
+				 del_sta->smesessionId);
+			wma_remove_req(wma, del_sta->smesessionId,
+				WMA_DELETE_STA_RSP_START);
+			del_sta->status = CDF_STATUS_E_NOMEM;
+			goto send_del_rsp;
+		}
+		/*
+		 * Acquire wake lock and bus lock till
+		 * firmware sends the response
+		 */
+		cdf_wake_lock_timeout_acquire(&wma->wmi_cmd_rsp_wake_lock,
+				      WMA_FW_RSP_EVENT_WAKE_LOCK_DURATION,
+				      WIFI_POWER_EVENT_WAKELOCK_WMI_CMD_RSP);
+		cdf_runtime_pm_prevent_suspend(wma->wmi_cmd_rsp_runtime_lock);
+		return;
+	}
+
 send_del_rsp:
 	if (del_sta->respReqd) {
 		WMA_LOGD("%s: Sending del rsp to umac (status: %d)",
@@ -4181,21 +4489,14 @@ static void wma_delete_sta_req_sta_mode(tp_wma_handle wma,
 	iface = &wma->interfaces[params->smesessionId];
 	iface->uapsd_cached_val = 0;
 
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	/* In case of LFR3.0 we need not send any
-	 * WMI commands to FW before SYNCH_CONFIRM */
-	if (iface->roam_synch_in_progress)
-		goto send_del_sta_rsp;
-#endif
+	if (wma_is_roam_synch_in_progress(wma, params->smesessionId))
+		return;
 #ifdef FEATURE_WLAN_TDLS
 	if (STA_ENTRY_TDLS_PEER == params->staType) {
 		wma_del_tdls_sta(wma, params);
 		return;
 	}
 #endif
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-send_del_sta_rsp:
-#endif
 	params->status = status;
 	if (params->respReqd) {
 		WMA_LOGD("%s: vdev_id %d status %d", __func__,
@@ -4223,19 +4524,16 @@ void wma_add_sta(tp_wma_handle wma, tpAddStaParams add_sta)
 
 	if (wma_is_vdev_in_ap_mode(wma, add_sta->smesessionId))
 		oper_mode = BSS_OPERATIONAL_MODE_AP;
-#ifdef QCA_IBSS_SUPPORT
 	else if (wma_is_vdev_in_ibss_mode(wma, add_sta->smesessionId))
 		oper_mode = BSS_OPERATIONAL_MODE_IBSS;
-#endif
 
 	switch (oper_mode) {
 	case BSS_OPERATIONAL_MODE_STA:
 		wma_add_sta_req_sta_mode(wma, add_sta);
 		break;
 
-#ifdef QCA_IBSS_SUPPORT
-	case BSS_OPERATIONAL_MODE_IBSS: /* IBSS should share the same code as AP mode */
-#endif
+	/* IBSS should share the same code as AP mode */
+	case BSS_OPERATIONAL_MODE_IBSS:
 	case BSS_OPERATIONAL_MODE_AP:
 		hif_vote_link_up();
 		wma_add_sta_req_ap_mode(wma, add_sta);
@@ -4265,21 +4563,19 @@ void wma_delete_sta(tp_wma_handle wma, tpDeleteStaParams del_sta)
 
 	if (wma_is_vdev_in_ap_mode(wma, smesession_id))
 		oper_mode = BSS_OPERATIONAL_MODE_AP;
-#ifdef QCA_IBSS_SUPPORT
 	if (wma_is_vdev_in_ibss_mode(wma, smesession_id)) {
 		oper_mode = BSS_OPERATIONAL_MODE_IBSS;
 		WMA_LOGD("%s: to delete sta for IBSS mode", __func__);
 	}
-#endif
 
 	switch (oper_mode) {
 	case BSS_OPERATIONAL_MODE_STA:
 		wma_delete_sta_req_sta_mode(wma, del_sta);
+		if (wma_is_roam_synch_in_progress(wma, smesession_id))
+			return;
 		break;
 
-#ifdef QCA_IBSS_SUPPORT
 	case BSS_OPERATIONAL_MODE_IBSS: /* IBSS shares AP code */
-#endif
 	case BSS_OPERATIONAL_MODE_AP:
 		hif_vote_link_down();
 		wma_delete_sta_req_ap_mode(wma, del_sta);
@@ -4355,15 +4651,13 @@ void wma_delete_bss(tp_wma_handle wma, tpDeleteBssParams params)
 		WMA_LOGE("%s:Unable to get TXRX context", __func__);
 		goto out;
 	}
-#ifdef QCA_IBSS_SUPPORT
 	if (wma_is_vdev_in_ibss_mode(wma, params->smesessionId))
 		/* in rome ibss case, self mac is used to create the bss peer */
 		peer = ol_txrx_find_peer_by_addr(pdev,
 			wma->interfaces[params->smesessionId].addr,
 			&peer_id);
 	else
-#endif
-	peer = ol_txrx_find_peer_by_addr(pdev, params->bssid, &peer_id);
+		peer = ol_txrx_find_peer_by_addr(pdev, params->bssid, &peer_id);
 
 	if (!peer) {
 		WMA_LOGP("%s: Failed to find peer %pM", __func__,
@@ -4396,15 +4690,13 @@ void wma_delete_bss(tp_wma_handle wma, tpDeleteBssParams params)
 	if (wlan_op_mode_ibss == txrx_vdev->opmode) {
 		wma->ibss_started = 0;
 	}
-#ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	if (wma->interfaces[params->smesessionId].roam_synch_in_progress) {
+	if (wma_is_roam_synch_in_progress(wma, params->smesessionId)) {
 		roam_synch_in_progress = true;
 		WMA_LOGD("LFR3:%s: Setting vdev_up to FALSE for session %d",
 			__func__, params->smesessionId);
 		wma->interfaces[params->smesessionId].vdev_up = false;
 		goto detach_peer;
 	}
-#endif
 	msg = wma_fill_vdev_req(wma, params->smesessionId, WMA_DELETE_BSS_REQ,
 				WMA_TARGET_REQ_TYPE_VDEV_STOP, params,
 				WMA_VDEV_STOP_REQUEST_TIMEOUT);
@@ -4454,6 +4746,9 @@ void wma_delete_bss(tp_wma_handle wma, tpDeleteBssParams params)
 detach_peer:
 	wma_remove_peer(wma, params->bssid, params->smesessionId, peer,
 			roam_synch_in_progress);
+	if (wma_is_roam_synch_in_progress(wma, params->smesessionId))
+		return;
+
 out:
 	params->status = status;
 	wma_send_msg(wma, WMA_DELETE_BSS_RSP, (void *)params, 0);
diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c
index 32b3bc4f356e..689851376a1d 100644
--- a/core/wma/src/wma_features.c
+++ b/core/wma/src/wma_features.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -980,6 +980,125 @@ CDF_STATUS wma_get_link_speed(WMA_HANDLE handle, tSirLinkSpeedInfo *pLinkSpeed)
 #ifdef FEATURE_GREEN_AP
 
 /**
+ * wma_egap_info_status_event() - egap info status event
+ * @handle:	pointer to wma handler
+ * @event:	pointer to event
+ * @len:	len of the event
+ *
+ * Return:	0 for success, otherwise appropriate error code
+ */
+static int wma_egap_info_status_event(void *handle, u_int8_t *event,
+				      uint32_t len)
+{
+	WMI_TX_PAUSE_EVENTID_param_tlvs *param_buf;
+	wmi_ap_ps_egap_info_event_fixed_param  *egap_info_event;
+	wmi_ap_ps_egap_info_chainmask_list *chainmask_event;
+	u_int8_t *buf_ptr;
+
+	param_buf = (WMI_TX_PAUSE_EVENTID_param_tlvs *)event;
+	if (!param_buf) {
+		WMA_LOGE("Invalid EGAP Info status event buffer");
+		return -EINVAL;
+	}
+
+	egap_info_event = (wmi_ap_ps_egap_info_event_fixed_param  *)
+				param_buf->fixed_param;
+	buf_ptr = (uint8_t *)egap_info_event;
+	buf_ptr += sizeof(wmi_ap_ps_egap_info_event_fixed_param);
+	chainmask_event = (wmi_ap_ps_egap_info_chainmask_list *)buf_ptr;
+
+	WMA_LOGI("mac_id: %d, status: %d, tx_mask: %x, rx_mask: %d",
+		 chainmask_event->mac_id,
+		 egap_info_event->status,
+		 chainmask_event->tx_chainmask,
+		 chainmask_event->rx_chainmask);
+	return 0;
+}
+
+/**
+ * wma_send_egap_conf_params() - send wmi cmd of egap configuration params
+ * @wma_handle:	 wma handler
+ * @egap_params: pointer to egap_params
+ *
+ * Return:	 0 for success, otherwise appropriate error code
+ */
+CDF_STATUS wma_send_egap_conf_params(WMA_HANDLE handle,
+				     struct egap_conf_params *egap_params)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle) handle;
+	wmi_ap_ps_egap_param_cmd_fixed_param *cmd;
+	wmi_buf_t buf;
+	int32_t err;
+
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, sizeof(*cmd));
+	if (!buf) {
+		WMA_LOGE("Failed to allocate buffer to send ap_ps_egap cmd");
+		return CDF_STATUS_E_NOMEM;
+	}
+	cmd = (wmi_ap_ps_egap_param_cmd_fixed_param *) wmi_buf_data(buf);
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		       WMITLV_TAG_STRUC_wmi_ap_ps_egap_param_cmd_fixed_param,
+		       WMITLV_GET_STRUCT_TLVLEN(
+			       wmi_ap_ps_egap_param_cmd_fixed_param));
+
+	cmd->enable = egap_params->enable;
+	cmd->inactivity_time = egap_params->inactivity_time;
+	cmd->wait_time = egap_params->wait_time;
+	cmd->flags = egap_params->flags;
+	err = wmi_unified_cmd_send(wma_handle->wmi_handle, buf,
+				   sizeof(*cmd), WMI_AP_PS_EGAP_PARAM_CMDID);
+	if (err) {
+		WMA_LOGE("Failed to send ap_ps_egap cmd");
+		wmi_buf_free(buf);
+		return CDF_STATUS_E_FAILURE;
+	}
+	return CDF_STATUS_SUCCESS;
+}
+
+/**
+ * wma_setup_egap_support() - setup the EGAP support flag
+ * @tgt_cfg:  pointer to hdd target configuration
+ * @egap_support: EGAP support flag
+ *
+ * Return:	  None
+ */
+void wma_setup_egap_support(struct wma_tgt_cfg *tgt_cfg, WMA_HANDLE handle)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle) handle;
+
+	if (tgt_cfg && wma_handle)
+		tgt_cfg->egap_support = wma_handle->egap_support;
+}
+
+/**
+ * wma_register_egap_event_handle() - register the EGAP event handle
+ * @wma_handle:	wma handler
+ *
+ * Return:	None
+ */
+void wma_register_egap_event_handle(WMA_HANDLE handle)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle) handle;
+	int status;
+
+	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+				   WMI_SERVICE_EGAP)) {
+		status = wmi_unified_register_event_handler(
+						   wma_handle->wmi_handle,
+						   WMI_AP_PS_EGAP_INFO_EVENTID,
+						   wma_egap_info_status_event);
+		if (status) {
+			WMA_LOGE("Failed to register Enhance Green AP event");
+			wma_handle->egap_support = false;
+		} else {
+			WMA_LOGI("Set the Enhance Green AP event handler");
+			wma_handle->egap_support = true;
+		}
+	} else
+		wma_handle->egap_support = false;
+}
+
+/**
  * wmi_unified_pdev_green_ap_ps_enable_cmd() - enable green ap powersave command
  * @wmi_handle: wmi handle
  * @value: value
@@ -1580,6 +1699,7 @@ int wma_oem_capability_event_callback(void *handle,
 	}
 
 	cdf_mem_zero(pStartOemDataRsp, sizeof(tStartOemDataRsp));
+	pStartOemDataRsp->target_rsp = true;
 	msg_subtype = (uint32_t *) (&pStartOemDataRsp->oemDataRsp[0]);
 	*msg_subtype = WMI_OEM_CAPABILITY_RSP;
 	cdf_mem_copy(&pStartOemDataRsp->oemDataRsp[4], data, datalen);
@@ -1641,6 +1761,7 @@ int wma_oem_measurement_report_event_callback(void *handle,
 	}
 
 	cdf_mem_zero(pStartOemDataRsp, sizeof(tStartOemDataRsp));
+	pStartOemDataRsp->target_rsp = true;
 	msg_subtype = (uint32_t *) (&pStartOemDataRsp->oemDataRsp[0]);
 	*msg_subtype = WMI_OEM_MEASUREMENT_RSP;
 	cdf_mem_copy(&pStartOemDataRsp->oemDataRsp[4], data, datalen);
@@ -1701,6 +1822,7 @@ int wma_oem_error_report_event_callback(void *handle,
 	}
 
 	cdf_mem_zero(pStartOemDataRsp, sizeof(tStartOemDataRsp));
+	pStartOemDataRsp->target_rsp = true;
 	msg_subtype = (uint32_t *) (&pStartOemDataRsp->oemDataRsp[0]);
 	*msg_subtype = WMI_OEM_ERROR_REPORT_RSP;
 	cdf_mem_copy(&pStartOemDataRsp->oemDataRsp[4], data, datalen);
@@ -1713,6 +1835,59 @@ int wma_oem_error_report_event_callback(void *handle,
 }
 
 /**
+ * wma_oem_data_response_handler() - OEM data response event handler
+ * @handle: wma handle
+ * @datap: data ptr
+ * @len: data length
+ *
+ * Return: 0 for success or error code
+ */
+int wma_oem_data_response_handler(void *handle,
+				  uint8_t *datap, uint32_t len)
+{
+	tp_wma_handle wma = (tp_wma_handle) handle;
+	WMI_OEM_RESPONSE_EVENTID_param_tlvs *param_buf;
+	uint8_t *data;
+	uint32_t datalen;
+	tStartOemDataRsp *oem_data_rsp;
+
+	param_buf = (WMI_OEM_RESPONSE_EVENTID_param_tlvs *) datap;
+	if (!param_buf) {
+		WMA_LOGE(FL("Received NULL buf ptr from FW"));
+		return -ENOMEM;
+	}
+
+	data = param_buf->data;
+	datalen = param_buf->num_data;
+
+	if (!data) {
+		WMA_LOGE(FL("Received NULL data from FW"));
+		return -EINVAL;
+	}
+
+	if (datalen > OEM_DATA_RSP_SIZE) {
+		WMA_LOGE(FL("Received data len %d exceeds max value %d"),
+			 datalen, OEM_DATA_RSP_SIZE);
+		return -EINVAL;
+	}
+
+	oem_data_rsp = cdf_mem_malloc(sizeof(*oem_data_rsp));
+	if (!oem_data_rsp) {
+		WMA_LOGE(FL("Failed to alloc oem_data_rsp"));
+		return -ENOMEM;
+	}
+
+	cdf_mem_zero(oem_data_rsp, sizeof(tStartOemDataRsp));
+	oem_data_rsp->target_rsp = true;
+	cdf_mem_copy(&oem_data_rsp->oemDataRsp[0], data, datalen);
+
+	WMA_LOGI(FL("Sending WMA_START_OEM_DATA_RSP, data len %d"), datalen);
+
+	wma_send_msg(wma, WMA_START_OEM_DATA_RSP, (void *)oem_data_rsp, 0);
+	return 0;
+}
+
+/**
  * wma_start_oem_data_req() - start OEM data request to target
  * @wma_handle: wma handle
  * @startOemDataReq: start request params
@@ -1725,51 +1900,53 @@ void wma_start_oem_data_req(tp_wma_handle wma_handle,
 	wmi_buf_t buf;
 	uint8_t *cmd;
 	int ret = 0;
-	uint32_t *msg_subtype;
 	tStartOemDataRsp *pStartOemDataRsp;
 
-	WMA_LOGD("%s: Send OEM Data Request to target", __func__);
+	WMA_LOGD(FL("Send OEM Data Request to target"));
 
-	if (!startOemDataReq) {
-		WMA_LOGE("%s: startOemDataReq is null", __func__);
+	if (!startOemDataReq && !startOemDataReq->data) {
+		WMA_LOGE(FL("startOemDataReq is null"));
 		goto out;
 	}
 
 	if (!wma_handle || !wma_handle->wmi_handle) {
-		WMA_LOGE("%s: WMA is closed, can not send Oem data request cmd",
-			 __func__);
+		WMA_LOGE(FL("WMA - closed, can not send Oem data request cmd"));
 		return;
 	}
 
 	buf = wmi_buf_alloc(wma_handle->wmi_handle,
-			    (OEM_DATA_REQ_SIZE + WMI_TLV_HDR_SIZE));
+			    (startOemDataReq->data_len + WMI_TLV_HDR_SIZE));
 	if (!buf) {
-		WMA_LOGE("%s:wmi_buf_alloc failed", __func__);
+		WMA_LOGE(FL("wmi_buf_alloc failed"));
 		goto out;
 	}
 
 	cmd = (uint8_t *) wmi_buf_data(buf);
 
-	WMITLV_SET_HDR(cmd, WMITLV_TAG_ARRAY_BYTE, OEM_DATA_REQ_SIZE);
+	WMITLV_SET_HDR(cmd, WMITLV_TAG_ARRAY_BYTE, startOemDataReq->data_len);
 	cmd += WMI_TLV_HDR_SIZE;
-	cdf_mem_copy(cmd, &startOemDataReq->oemDataReq[0], OEM_DATA_REQ_SIZE);
+	cdf_mem_copy(cmd, startOemDataReq->data,
+		     startOemDataReq->data_len);
 
-	WMA_LOGI("%s: Sending OEM Data Request to target, data len (%d)",
-		 __func__, OEM_DATA_REQ_SIZE);
+	WMA_LOGI(FL("Sending OEM Data Request to target, data len %d"),
+		 startOemDataReq->data_len);
 
 	ret = wmi_unified_cmd_send(wma_handle->wmi_handle, buf,
-				   (OEM_DATA_REQ_SIZE +
+				   (startOemDataReq->data_len +
 				    WMI_TLV_HDR_SIZE), WMI_OEM_REQ_CMDID);
 
 	if (ret != EOK) {
-		WMA_LOGE("%s:wmi cmd send failed", __func__);
+		WMA_LOGE(FL(":wmi cmd send failed"));
 		cdf_nbuf_free(buf);
 	}
 
 out:
 	/* free oem data req buffer received from UMAC */
-	if (startOemDataReq)
+	if (startOemDataReq) {
+		if (startOemDataReq->data)
+			cdf_mem_free(startOemDataReq->data);
 		cdf_mem_free(startOemDataReq);
+	}
 
 	/* Now send data resp back to PE/SME with message sub-type of
 	 * WMI_OEM_INTERNAL_RSP. This is required so that PE/SME clears
@@ -1784,8 +1961,7 @@ out:
 		return;
 	}
 	cdf_mem_zero(pStartOemDataRsp, sizeof(tStartOemDataRsp));
-	msg_subtype = (uint32_t *) (&pStartOemDataRsp->oemDataRsp[0]);
-	*msg_subtype = WMI_OEM_INTERNAL_RSP;
+	pStartOemDataRsp->target_rsp = false;
 
 	WMA_LOGI("%s: Sending WMA_START_OEM_DATA_RSP to clear up PE/SME pending cmd",
 		__func__);
@@ -2005,10 +2181,12 @@ static int wma_unified_phyerr_rx_event_handler(void *handle,
 	cdf_size_t n;
 	A_UINT64 tsf64 = 0;
 	int phy_err_code = 0;
+	A_UINT32 phy_err_mask = 0;
 	int error = 0;
 	tpAniSirGlobal mac_ctx =
 		(tpAniSirGlobal)cds_get_context(CDF_MODULE_ID_PE);
 	bool enable_log = false;
+	int max_dfs_buf_length = 0;
 
 	if (NULL == mac_ctx) {
 		WMA_LOGE("%s: mac_ctx is NULL", __func__);
@@ -2035,10 +2213,19 @@ static int wma_unified_phyerr_rx_event_handler(void *handle,
 			 __func__, sizeof(*pe_hdr), datalen);
 		return 0;
 	}
-	if (pe_hdr->buf_len > DFS_MAX_BUF_LENGHT) {
+	/*
+	 * The max buffer lenght is larger for DFS-3 than DFS-2.
+	 * So, accordingly use the correct max buffer size.
+	 */
+	if (wma->hw_bd_id != WMI_HWBD_QCA6174)
+		max_dfs_buf_length = DFS3_MAX_BUF_LENGTH;
+	else
+		max_dfs_buf_length = DFS_MAX_BUF_LENGTH;
+
+	if (pe_hdr->buf_len > max_dfs_buf_length) {
 		WMA_LOGE("%s: Received Invalid Phyerror event buffer length = %d"
 			"Maximum allowed buf length = %d", __func__,
-			pe_hdr->buf_len, DFS_MAX_BUF_LENGHT);
+			pe_hdr->buf_len, max_dfs_buf_length);
 
 		return 0;
 	}
@@ -2052,6 +2239,21 @@ static int wma_unified_phyerr_rx_event_handler(void *handle,
 	tsf64 |= (((uint64_t) pe_hdr->tsf_u32) << 32);
 
 	/*
+	 * Check the HW board ID to figure out
+	 * if DFS-3 is supported. In DFS-3
+	 * phyerror mask indicates the type of
+	 * phyerror, whereas in DFS-2 phyerrorcode
+	 * indicates the type of phyerror. If the
+	 * board is NOT WMI_HWBD_QCA6174, for now
+	 * assume that it supports DFS-3.
+	 */
+	if (wma->hw_bd_id != WMI_HWBD_QCA6174) {
+		phy_err_mask = pe_hdr->rsPhyErrMask0;
+		WMA_LOGD("%s: DFS-3 phyerror mask = 0x%x",
+			  __func__, phy_err_mask);
+	}
+
+	/*
 	 * Loop over the bufp, extracting out phyerrors
 	 * wmi_unified_comb_phyerr_rx_event.bufp is a char pointer,
 	 * which isn't correct here - what we have received here
@@ -2095,14 +2297,30 @@ static int wma_unified_phyerr_rx_event_handler(void *handle,
 			error = 1;
 			break;
 		}
-		phy_err_code = WMI_UNIFIED_PHYERRCODE_GET(&ev->hdr);
+		/*
+		 * If the board id is WMI_HWBD_QCA6174
+		 * then it supports only DFS-2. So, fetch
+		 * phyerror code in order to know the type
+		 * of phyerror.
+		 */
+		if (wma->hw_bd_id == WMI_HWBD_QCA6174) {
+			phy_err_code = WMI_UNIFIED_PHYERRCODE_GET(&ev->hdr);
+			WMA_LOGD("%s: DFS-2 phyerror code = 0x%x",
+				  __func__, phy_err_code);
+		}
 
 		/*
-		 * If the phyerror category matches,
+		 * phy_err_code is set for DFS-2 and phy_err_mask
+		 * is set for DFS-3. Checking both to support
+		 * compatability for older platforms.
+		 * If the phyerror or phyerrmask category matches,
 		 * pass radar events to the dfs pattern matching code.
 		 * Don't pass radar events with no buffer payload.
 		 */
-		if (phy_err_code == 0x5 || phy_err_code == 0x24) {
+		if (((phy_err_mask & WMI_PHY_ERROR_MASK0_RADAR) ||
+		     (phy_err_mask & WMI_PHY_ERROR_MASK0_FALSE_RADAR_EXT)) ||
+		    (phy_err_code == WMA_DFS2_PHYERROR_CODE ||
+		     phy_err_code == WMA_DFS2_FALSE_RADAR_EXT)) {
 			if (ev->hdr.buf_len > 0) {
 				/* Calling in to the DFS module to process the phyerr */
 				dfs_process_phyerr(ic, &ev->bufp[0],
@@ -3215,12 +3433,7 @@ void wma_register_wow_default_patterns(WMA_HANDLE handle, uint8_t vdev_id)
 	iface = &wma->interfaces[vdev_id];
 
 	if (iface->ptrn_match_enable) {
-		if (wma_is_vdev_in_ap_mode(wma, vdev_id)
-#ifdef QCA_IBSS_SUPPORT
-			||
-			wma_is_vdev_in_ibss_mode(wma, vdev_id)
-#endif
-			) {
+		if (wma_is_vdev_in_beaconning_mode(wma, vdev_id)) {
 			/* Configure SAP/GO/IBSS mode default wow patterns */
 			WMA_LOGI("Config SAP specific default wow patterns vdev_id %d",
 				 vdev_id);
@@ -3397,7 +3610,7 @@ CDF_STATUS wma_enable_wow_in_fw(WMA_HANDLE handle)
 		WMA_LOGE("Credits:%d; Pending_Cmds: %d",
 			 wmi_get_host_credits(wma->wmi_handle),
 			 wmi_get_pending_cmds(wma->wmi_handle));
-		if (!cds_is_logp_in_progress()) {
+		if (!cds_is_driver_recovering()) {
 #ifdef CONFIG_CNSS
 			if (pMac->sme.enableSelfRecovery) {
 				cds_trigger_recovery();
@@ -3429,7 +3642,7 @@ CDF_STATUS wma_enable_wow_in_fw(WMA_HANDLE handle)
 			 "cannot resume back", __func__, host_credits,
 			 wmi_pending_cmds);
 		htc_dump_counter_info(wma->htc_handle);
-		if (!cds_is_logp_in_progress())
+		if (!cds_is_driver_recovering())
 			CDF_BUG(0);
 		else
 			WMA_LOGE("%s: SSR in progress, ignore no credit issue",
@@ -3461,17 +3674,20 @@ error:
 /**
  * wma_resume_req() - clear configured wow patterns in fw
  * @wma: wma handle
+ * @type: type of suspend
  *
  * Return: CDF status
  */
-CDF_STATUS wma_resume_req(tp_wma_handle wma)
+CDF_STATUS wma_resume_req(tp_wma_handle wma, enum cdf_suspend_type type)
 {
-	wma->no_of_resume_ind++;
+	if (type == CDF_SYSTEM_SUSPEND) {
+		wma->no_of_resume_ind++;
 
-	if (wma->no_of_resume_ind < wma_get_vdev_count(wma))
-		return CDF_STATUS_SUCCESS;
+		if (wma->no_of_resume_ind < wma_get_vdev_count(wma))
+			return CDF_STATUS_SUCCESS;
 
-	wma->no_of_resume_ind = 0;
+		wma->no_of_resume_ind = 0;
+	}
 
 	/* Reset the DTIM Parameters */
 	wma_set_resume_dtim(wma);
@@ -3480,6 +3696,8 @@ CDF_STATUS wma_resume_req(tp_wma_handle wma)
 	/* unpause the vdev if left paused and hif_pci_suspend fails */
 	wma_unpause_vdev(wma);
 
+	wmi_set_runtime_pm_inprogress(wma->wmi_handle, false);
+
 	return CDF_STATUS_SUCCESS;
 }
 
@@ -3716,152 +3934,253 @@ CDF_STATUS wma_wow_exit(tp_wma_handle wma, tpSirHalWowlExitParams info)
 	return CDF_STATUS_SUCCESS;
 }
 
-#ifdef FEATURE_WLAN_EXTSCAN
 /**
- * wma_is_extscan_in_progress(): check if extscan is in progress
- * @wma: wma handle
+ * wma_calculate_and_update_conn_state(): calculate each interfaces conn state
+ * @wma: validated wma handle
  *
- * Return: true is extscan in progress, false otherwise.
+ * Identifies any vdev that is up and not in ap mode as connected.
+ * stores this in the interfaces conn_state varible.
  */
-static bool wma_is_extscan_in_progress(tp_wma_handle wma)
+void wma_calculate_and_update_conn_state(tp_wma_handle wma)
 {
 	int i;
+	for (i = 0; i < wma->max_bssid; i++) {
+		wma->interfaces[i].conn_state =
+			!!(wma->interfaces[i].vdev_up &&
+					!wma_is_vdev_in_ap_mode(wma, i));
+	}
+}
 
+/**
+ * wma_update_conn_state(): synchronize wma & hdd
+ * @wma: wma handle
+ * @conn_state: boolean array to populate
+ * @len: validation parameter
+ *
+ * populate interfaces conn_state with true if the interface
+ * is a connected client and wow will configure a pattern.
+ */
+void wma_update_conn_state(tp_wma_handle wma, uint32_t conn_mask)
+{
+	int i;
 	for (i = 0; i < wma->max_bssid; i++) {
-		if (wma->interfaces[i].extscan_in_progress) {
-			WMA_LOGD("Extscan is in progress, enabling wow");
-			return true;
-		}
+		if (conn_mask & (1 << i))
+			wma->interfaces[i].conn_state = true;
+		else
+			wma->interfaces[i].conn_state = false;
 	}
 
-	return false;
+	if (wma->wow.magic_ptrn_enable)
+		return;
+
+	for (i = 0; i < wma->max_bssid; i++) {
+		if (!wma->interfaces[i].ptrn_match_enable)
+			wma->interfaces[i].conn_state = false;
+	}
 }
-#else
-static bool wma_is_extscan_in_progress(tp_wma_handle wma)
+
+/**
+ * wma_is_beaconning_vdev_up(): check if a beaconning vdev is up
+ * @wma: wma handle
+ *
+ * Return TRUE if beaconning vdev is up
+ */
+static inline
+bool wma_is_beaconning_vdev_up(tp_wma_handle wma)
 {
+	int i;
+	for (i = 0; i < wma->max_bssid; i++) {
+		if (wma_is_vdev_in_beaconning_mode(wma, i)
+				&& wma->interfaces[i].vdev_up)
+			return true;
+	}
 	return false;
 }
-#endif
 
 /**
- * wma_suspend_req() -  Handles suspend indication request received from umac.
+ * wma_support_wow_for_beaconing: wow query for beaconning
  * @wma: wma handle
- * @info: suspend params
  *
- * Return: CDF status
+ * Need to configure wow to enable beaconning offload when
+ * a beaconing vdev is up and beaonning offload is configured.
+ *
+ * Return: true if we need to enable wow for beaconning offload
  */
-CDF_STATUS wma_suspend_req(tp_wma_handle wma, tpSirWlanSuspendParam info)
+static inline
+bool wma_support_wow_for_beaconing(tp_wma_handle wma)
 {
-	struct wma_txrx_node *iface;
-	bool pno_in_progress = false;
-	uint8_t i, vdev_id = 0;
-	bool extscan_in_progress = false, pno_matched = false;
-	bool enable_wow = false;
-
-	wma->no_of_suspend_ind++;
-
-	if (info->sessionId > wma->max_bssid) {
-		WMA_LOGE("Invalid vdev id (%d)", info->sessionId);
-		cdf_mem_free(info);
-		return CDF_STATUS_E_INVAL;
-	}
-
-	iface = &wma->interfaces[info->sessionId];
-	if (!iface) {
-		WMA_LOGD("vdev %d node is not found", info->sessionId);
-		cdf_mem_free(info);
-		return CDF_STATUS_SUCCESS;
+	if (WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
+				WMI_SERVICE_BEACON_OFFLOAD)) {
+		if (wma_is_beaconning_vdev_up(wma))
+			return true;
 	}
+	return false;
+}
 
-	if (!wma->wow.magic_ptrn_enable && !iface->ptrn_match_enable) {
-		cdf_mem_free(info);
+#ifdef FEATURE_WLAN_SCAN_PNO
+/**
+ * wma_is_pnoscan_in_progress(): check if a pnoscan is in progress
+ * @wma: wma handle
+ * @vdev_id: vdev_id
+ *
+ * Return: TRUE/FALSE
+ */
+static inline
+bool wma_is_pnoscan_in_progress(tp_wma_handle wma, int vdev_id)
+{
+	return wma->interfaces[vdev_id].pno_in_progress;
+}
 
-		if (wma->no_of_suspend_ind == wma_get_vdev_count(wma)) {
-			WMA_LOGD("Both magic and pattern byte match are disabled");
-			wma->no_of_suspend_ind = 0;
-			goto send_ready_to_suspend;
-		}
+/**
+ * wma_is_pnoscan_match_found(): check if a scan match was found
+ * @wma: wma handle
+ * @vdev_id: vdev_id
+ *
+ * Return: TRUE/FALSE
+ */
+static inline
+bool wma_is_pnoscan_match_found(tp_wma_handle wma, int vdev_id)
+{
+	return wma->interfaces[vdev_id].nlo_match_evt_received;
+}
+#else
+/**
+ * wma_is_pnoscan_in_progress(): dummy
+ *
+ * Return: False since no pnoscan cannot be in progress
+ * when feature flag is not defined.
+ */
+bool wma_is_pnoscan_in_progress(tp_wma_handle wma, int vdev_id)
+{
+	return FALSE;
+}
 
-		return CDF_STATUS_SUCCESS;
-	}
+/**
+ * wma_is_pnoscan_match_found(): dummy
+ * @wma: wma handle
+ * @vdev_id: vdev_id
+ *
+ * Return: False since no pnoscan cannot occur
+ * when feature flag is not defined.
+ */
+static inline
+bool wma_is_pnoscan_match_found(tp_wma_handle wma, int vdev_id)
+{
+	return FALSE;
+}
+#endif
 
-	iface->conn_state = (info->connectedState) ? true : false;
+#ifdef FEATURE_WLAN_EXTSCAN
+static inline
+/**
+ * wma_is_extscan_in_progress(): check if an extscan is in progress
+ * @wma: wma handle
+ * @vdev_id: vdev_id
+ *
+ * Return: TRUE/FALSvE
+ */
+bool wma_is_extscan_in_progress(tp_wma_handle wma, int vdev_id)
+{
+	return wma->interfaces[vdev_id].extscan_in_progress;
+}
+#else
+/**
+ * wma_is_extscan_in_progress(): dummy
+ *
+ * Return: False since no extscan can be in progress
+ * when feature flag is not defined.
+ */
+bool wma_is_extscan_in_progress(tp_wma_handle wma, int vdev_id)
+{
+	return false;
+}
+#endif
 
-	/*
-	 * Once WOW is enabled in FW, host can't send anymore
-	 * data to fw. umac sends suspend indication on each
-	 * vdev during platform suspend. WMA has to wait until
-	 * suspend indication received on last vdev before
-	 * enabling wow in fw.
-	 */
-	if (wma->no_of_suspend_ind < wma_get_vdev_count(wma)) {
-		cdf_mem_free(info);
-		return CDF_STATUS_SUCCESS;
+/**
+ * wma_is_wow_applicable(): should enable wow
+ * @wma: wma handle
+ *
+ *  Enable WOW if any one of the condition meets,
+ *  1) Is any one of vdev in beaconning mode (in AP mode) ?
+ *  2) Is any one of vdev in connected state (in STA mode) ?
+ *  3) Is PNO in progress in any one of vdev ?
+ *  4) Is Extscan in progress in any one of vdev ?
+ *
+ * Return: true if wma needs to configure wow.
+ */
+bool wma_is_wow_applicable(tp_wma_handle wma)
+{
+	int vdev_id;
+	if (wma_support_wow_for_beaconing(wma)) {
+		WMA_LOGD("vdev is in beaconning mode, enabling wow");
+		return true;
 	}
 
-	wma->no_of_suspend_ind = 0;
-	wma->wow.gtk_pdev_enable = 0;
-	/*
-	 * Enable WOW if any one of the condition meets,
-	 *  1) Is any one of vdev in beaconning mode (in AP mode) ?
-	 *  2) Is any one of vdev in connected state (in STA mode) ?
-	 *  3) Is PNO in progress in any one of vdev ?
-	 *  4) Is Extscan in progress in any one of vdev ?
-	 */
-	for (i = 0; i < wma->max_bssid; i++) {
-		if ((wma_is_vdev_in_ap_mode(wma, i)
-#ifdef QCA_IBSS_SUPPORT
-		     || wma_is_vdev_in_ibss_mode(wma, i)
-#endif /* QCA_IBSS_SUPPORT */
-		     ) && wma->interfaces[i].vdev_up &&
-		    WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
-					   WMI_SERVICE_BEACON_OFFLOAD)) {
-			WMA_LOGD("vdev %d is in beaconning mode, enabling wow",
-				 i);
-			enable_wow = true;
-		}
-	}
-	for (i = 0; i < wma->max_bssid; i++) {
-		if (wma->interfaces[i].conn_state)
-			enable_wow = true;
-#ifdef FEATURE_WLAN_SCAN_PNO
-		if (wma->interfaces[i].pno_in_progress) {
+	for (vdev_id = 0; vdev_id < wma->max_bssid; vdev_id++) {
+		if (wma->interfaces[vdev_id].conn_state) {
+			WMA_LOGD("STA is connected, enabling wow");
+			return true;
+		} else if (wma_is_pnoscan_in_progress(wma, vdev_id)) {
 			WMA_LOGD("PNO is in progress, enabling wow");
-			enable_wow = true;
-			pno_in_progress = true;
-			vdev_id = i;
-			if (wma->interfaces[i].nlo_match_evt_received)
-				pno_matched = true;
-			break;
+			return true;
+		} else if (wma_is_extscan_in_progress(wma, vdev_id)) {
+			WMA_LOGD("EXT is in progress, enabling wow");
+			return true;
 		}
-#endif /* FEATURE_WLAN_SCAN_PNO */
 	}
-	extscan_in_progress = wma_is_extscan_in_progress(wma);
-	if (extscan_in_progress)
-		enable_wow = true;
 
-	for (i = 0; i < wma->max_bssid; i++) {
-		wma->wow.gtk_pdev_enable |= wma->wow.gtk_err_enable[i];
-		WMA_LOGD("VDEV_ID:%d, gtk_err_enable[%d]:%d, gtk_pdev_enable:%d", i,
-			i, wma->wow.gtk_err_enable[i], wma->wow.gtk_pdev_enable);
-	}
+	WMA_LOGD("All vdev are in disconnected state and pno/extscan is not in progress, skipping wow");
+	return true;
+}
 
-	if (!enable_wow) {
-		WMA_LOGD("All vdev are in disconnected state and pno/extscan is not in progress, skipping wow");
-		cdf_mem_free(info);
-		goto send_ready_to_suspend;
-	}
+/**
+ * wma_configure_dynamic_wake_events(): configure dyanmic wake events
+ * @wma: wma handle
+ *
+ * Some wake events need to be enabled dynamically.  Controll those here.
+ *
+ * Return: none
+ */
+void wma_configure_dynamic_wake_events(tp_wma_handle wma)
+{
+	int vdev_id;
+	int enable_mask;
+	int disable_mask;
+
+	for (vdev_id = 0; vdev_id < wma->max_bssid; vdev_id++) {
+		enable_mask = 0;
+		disable_mask = 0;
+
+		if (wma_is_pnoscan_in_progress(wma, vdev_id)) {
+			if (wma_is_pnoscan_match_found(wma, vdev_id))
+				enable_mask |=
+					(1 << WOW_NLO_SCAN_COMPLETE_EVENT);
+			else
+				disable_mask |=
+					(1 << WOW_NLO_SCAN_COMPLETE_EVENT);
+		}
 
-	WMA_LOGE("WOW Suspend");
+		if (enable_mask != 0)
+			wma_enable_disable_wakeup_event(wma, vdev_id,
+					enable_mask, true);
+		if (disable_mask != 0)
+			wma_enable_disable_wakeup_event(wma, vdev_id,
+					disable_mask, false);
+	}
+}
 
-	/*
-	 * At this point, suspend indication is received on
-	 * last vdev. It's the time to enable wow in fw.
-	 */
 #ifdef FEATURE_WLAN_LPHB
-	/* LPHB cache, if any item was enabled, should be
-	 * applied.
-	 */
+/**
+ * wma_apply_lphb(): apply cached LPHB settings
+ * @wma: wma handle
+ *
+ * LPHB cache, if any item was enabled, should be
+ * applied.
+ */
+static inline
+void wma_apply_lphb(tp_wma_handle wma)
+{
+	int i;
 	WMA_LOGD("%s: checking LPHB cache", __func__);
 	for (i = 0; i < 2; i++) {
 		if (wma->wow.lphb_cache[i].params.lphbEnableReq.enable) {
@@ -3871,22 +4190,49 @@ CDF_STATUS wma_suspend_req(tp_wma_handle wma, tpSirWlanSuspendParam info)
 					       false);
 		}
 	}
+}
+#else
+void wma_apply_lphb(tp_wma_handle wma) {}
 #endif /* FEATURE_WLAN_LPHB */
 
-	if (pno_matched)
-		wma_enable_disable_wakeup_event(wma, vdev_id,
-				(1 << WOW_NLO_SCAN_COMPLETE_EVENT),
-				pno_matched);
+static void wma_notify_suspend_req_procesed(tp_wma_handle wma,
+		enum cdf_suspend_type type)
+{
+	if (type == CDF_SYSTEM_SUSPEND)
+		wma_send_status_to_suspend_ind(wma, true);
+	else if (type == CDF_RUNTIME_SUSPEND)
+		cdf_event_set(&wma->runtime_suspend);
+}
 
-	wma->wow.wow_enable = true;
-	wma->wow.wow_enable_cmd_sent = false;
+/**
+ * wma_suspend_req() -  Handles suspend indication request received from umac.
+ * @wma: wma handle
+ * @type: type of suspend
+ *
+ * The type controlls how we notify the indicator that the indication has
+ * been processed
+ *
+ * Return: CDF status
+ */
+CDF_STATUS wma_suspend_req(tp_wma_handle wma, enum cdf_suspend_type type)
+{
+	if (type == CDF_RUNTIME_SUSPEND)
+		wmi_set_runtime_pm_inprogress(wma->wmi_handle, true);
 
-	cdf_mem_free(info);
+	if (wma_is_wow_applicable(wma)) {
+		WMA_LOGE("WOW Suspend");
+		wma_apply_lphb(wma);
+
+		wma_configure_dynamic_wake_events(wma);
+
+		wma->wow.wow_enable = true;
+		wma->wow.wow_enable_cmd_sent = false;
+	}
 
-send_ready_to_suspend:
 	/* Set the Suspend DTIM Parameters */
 	wma_set_suspend_dtim(wma);
-	wma_send_status_to_suspend_ind(wma, true);
+
+	wma_notify_suspend_req_procesed(wma, type);
 
 	/* to handle race between hif_pci_suspend and
 	 * unpause/pause tx handler
@@ -3955,7 +4301,7 @@ static CDF_STATUS wma_send_host_wakeup_ind_to_fw(tp_wma_handle wma)
 		WMA_LOGP("%s: Pending commands %d credits %d", __func__,
 			 wmi_get_pending_cmds(wma->wmi_handle),
 			 wmi_get_host_credits(wma->wmi_handle));
-		if (!cds_is_logp_in_progress()) {
+		if (!cds_is_driver_recovering()) {
 #ifdef CONFIG_CNSS
 			if (pMac->sme.enableSelfRecovery) {
 				cds_trigger_recovery();
@@ -4067,7 +4413,7 @@ bool static wma_is_nan_enabled(tp_wma_handle wma)
  *
  * Return: true is wow mode is needed else false
  */
-int wma_is_wow_mode_selected(WMA_HANDLE handle)
+bool wma_is_wow_mode_selected(WMA_HANDLE handle)
 {
 	tp_wma_handle wma = (tp_wma_handle) handle;
 
@@ -4469,8 +4815,6 @@ CDF_STATUS wma_process_tsm_stats_req(tp_wma_handle wma_handler,
 #ifdef FEATURE_WLAN_ESE_UPLOAD
 	tpAniGetTsmStatsReq pStats = (tpAniGetTsmStatsReq) pTsmStatsMsg;
 	tpAniGetTsmStatsRsp pTsmRspParams = NULL;
-#else
-	tpTSMStats pStats = (tpTSMStats) pTsmStatsMsg;
 #endif /* FEATURE_WLAN_ESE_UPLOAD */
 	int tid = pStats->tid;
 	/*
@@ -4506,8 +4850,6 @@ CDF_STATUS wma_process_tsm_stats_req(tp_wma_handle wma_handler,
 	pTsmRspParams->rc = eSIR_FAILURE;
 	pTsmRspParams->tsmStatsReq = pStats;
 	pTsmMetric = &pTsmRspParams->tsmMetrics;
-#else
-	pTsmMetric = (tpAniTrafStrmMetrics)&(pStats->tsmMetrics);
 #endif /* FEATURE_WLAN_ESE_UPLOAD */
 	/* populate pTsmMetric */
 	pTsmMetric->UplinkPktQueueDly = queue_delay_microsec;
@@ -4527,8 +4869,6 @@ CDF_STATUS wma_process_tsm_stats_req(tp_wma_handle wma_handler,
 	/* post this message to LIM/PE */
 #ifdef FEATURE_WLAN_ESE_UPLOAD
 	wma_send_msg(wma_handler, WMA_TSM_STATS_RSP, (void *)pTsmRspParams, 0);
-#else
-	wma_send_msg(wma_handler, WMA_TSM_STATS_RSP, (void *)pTsmStatsMsg, 0);
 #endif /* FEATURE_WLAN_ESE_UPLOAD */
 	return CDF_STATUS_SUCCESS;
 }
@@ -4916,15 +5256,15 @@ CDF_STATUS wma_enable_arp_ns_offload(tp_wma_handle wma,
 	uint32_t count = 0, num_ns_ext_tuples = 0;
 
 	/* Get the vdev id */
-	if (!wma_find_vdev_by_bssid(wma, pHostOffloadParams->bssId, &vdev_id)) {
+	if (!wma_find_vdev_by_bssid(wma, pHostOffloadParams->bssid.bytes,
+					&vdev_id)) {
 		WMA_LOGE("vdev handle is invalid for %pM",
-			 pHostOffloadParams->bssId);
+			 pHostOffloadParams->bssid.bytes);
 		cdf_mem_free(pHostOffloadParams);
 		return CDF_STATUS_E_INVAL;
 	}
 
 	if (!wma->interfaces[vdev_id].vdev_up) {
-
 		WMA_LOGE("vdev %d is not up skipping arp/ns offload", vdev_id);
 		cdf_mem_free(pHostOffloadParams);
 		return CDF_STATUS_E_FAILURE;
@@ -4933,7 +5273,6 @@ CDF_STATUS wma_enable_arp_ns_offload(tp_wma_handle wma,
 	if (!bArpOnly)
 		count = pHostOffloadParams->num_ns_offload_count;
 
-
 	len = sizeof(WMI_SET_ARP_NS_OFFLOAD_CMD_fixed_param) + WMI_TLV_HDR_SIZE +       /* TLV place holder size for array of NS tuples */
 	      WMI_MAX_NS_OFFLOADS * sizeof(WMI_NS_OFFLOAD_TUPLE) + WMI_TLV_HDR_SIZE +   /* TLV place holder size for array of ARP tuples */
 	      WMI_MAX_ARP_OFFLOADS * sizeof(WMI_ARP_OFFLOAD_TUPLE);
@@ -5016,8 +5355,8 @@ CDF_STATUS wma_enable_arp_ns_offload(tp_wma_handle wma,
 			 * local MAC address rather than the tuple
 			 */
 			WMI_CHAR_ARRAY_TO_MAC_ADDR(pHostOffloadParams->
-						   nsOffloadInfo.selfMacAddr,
-						   &ns_tuple->target_mac);
+					nsOffloadInfo.self_macaddr.bytes,
+					&ns_tuple->target_mac);
 #endif /* WLAN_NS_OFFLOAD */
 			if ((ns_tuple->target_mac.mac_addr31to0 != 0) ||
 			    (ns_tuple->target_mac.mac_addr47to32 != 0)) {
@@ -5081,7 +5420,8 @@ CDF_STATUS wma_enable_arp_ns_offload(tp_wma_handle wma,
 
 				/* target MAC is optional, check if it is valid, if this is not valid,
 				 * the target will use the known local MAC address rather than the tuple */
-				 WMI_CHAR_ARRAY_TO_MAC_ADDR(pHostOffloadParams->nsOffloadInfo.selfMacAddr,
+				 WMI_CHAR_ARRAY_TO_MAC_ADDR(
+					pHostOffloadParams->nsOffloadInfo.self_macaddr.bytes,
 					&ns_tuple->target_mac);
 #endif
 				if ((ns_tuple->target_mac.mac_addr31to0 != 0) ||
@@ -5419,7 +5759,7 @@ int wma_set_app_type1_params_in_fw(tp_wma_handle wma,
 			       (wmi_extwow_set_app_type1_params_cmd_fixed_param));
 
 	cmd->vdev_id = appType1Params->vdev_id;
-	WMI_CHAR_ARRAY_TO_MAC_ADDR(appType1Params->wakee_mac_addr,
+	WMI_CHAR_ARRAY_TO_MAC_ADDR(appType1Params->wakee_mac_addr.bytes,
 				   &cmd->wakee_mac);
 	cdf_mem_copy(cmd->ident, appType1Params->identification_id, 8);
 	cmd->ident_len = appType1Params->id_length;
@@ -5429,7 +5769,7 @@ int wma_set_app_type1_params_in_fw(tp_wma_handle wma,
 	WMA_LOGD("%s: vdev_id %d wakee_mac_addr %pM "
 		 "identification_id %.8s id_length %u "
 		 "password %.16s pass_length %u",
-		 __func__, cmd->vdev_id, appType1Params->wakee_mac_addr,
+		 __func__, cmd->vdev_id, appType1Params->wakee_mac_addr.bytes,
 		 cmd->ident, cmd->ident_len, cmd->passwd, cmd->passwd_len);
 
 	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
@@ -5492,7 +5832,7 @@ int wma_set_app_type2_params_in_fw(tp_wma_handle wma,
 	cmd->keepalive_max = appType2Params->keepalive_max;
 	cmd->keepalive_inc = appType2Params->keepalive_inc;
 
-	WMI_CHAR_ARRAY_TO_MAC_ADDR(appType2Params->gateway_mac,
+	WMI_CHAR_ARRAY_TO_MAC_ADDR(appType2Params->gateway_mac.bytes,
 				   &cmd->gateway_mac);
 	cmd->tcp_tx_timeout_val = appType2Params->tcp_tx_timeout_val;
 	cmd->tcp_rx_timeout_val = appType2Params->tcp_rx_timeout_val;
@@ -5504,7 +5844,7 @@ int wma_set_app_type2_params_in_fw(tp_wma_handle wma,
 		 "tcp_ack_seq %u keepalive_init %u keepalive_min %u "
 		 "keepalive_max %u keepalive_inc %u "
 		 "tcp_tx_timeout_val %u tcp_rx_timeout_val %u",
-		 __func__, cmd->vdev_id, appType2Params->gateway_mac,
+		 __func__, cmd->vdev_id, appType2Params->gateway_mac.bytes,
 		 cmd->rc4_key, cmd->rc4_key_len,
 		 cmd->ip_id, cmd->ip_device_ip, cmd->ip_server_ip,
 		 cmd->tcp_src_port, cmd->tcp_dst_port, cmd->tcp_seq,
@@ -5996,13 +6336,69 @@ void wma_send_regdomain_info_to_fw(uint32_t reg_dmn, uint16_t regdmn2G,
 }
 
 /**
- * wma_bus_suspend() - handles bus suspend request from hdd
+ * wma_post_runtime_resume_msg() - post the resume request
+ * @handle: validated wma handle
  *
- * Calls the appropriate handler based on configuration and event
+ * request the MC thread unpaus the vdev and set resume dtim
+ *
+ * Return: cdf status of the mq post
+ */
+static CDF_STATUS wma_post_runtime_resume_msg(WMA_HANDLE handle)
+{
+	cds_msg_t resume_msg;
+
+	resume_msg.bodyptr = NULL;
+	resume_msg.type    = WMA_RUNTIME_PM_RESUME_IND;
+	return cds_mq_post_message(CDF_MODULE_ID_WMA, &resume_msg);
+}
+
+/**
+ * wma_post_runtime_suspend_msg() - post the suspend request
+ * @handle: validated wma handle
+ *
+ * Requests for offloads to be configured for runtime suspend
+ * on the MC thread
+ *
+ * Return CDF_STATUS_E_AGAIN in case of timeout or CDF_STATUS_SUCCESS
+ */
+static CDF_STATUS wma_post_runtime_suspend_msg(WMA_HANDLE handle)
+{
+	cds_msg_t cds_msg;
+	CDF_STATUS cdf_status;
+	tp_wma_handle wma = (tp_wma_handle) handle;
+
+	cdf_event_reset(&wma->runtime_suspend);
+
+	cds_msg.bodyptr = NULL;
+	cds_msg.type    = WMA_RUNTIME_PM_SUSPEND_IND;
+	cdf_status = cds_mq_post_message(CDF_MODULE_ID_WMA, &cds_msg);
+
+	if (cdf_status != CDF_STATUS_SUCCESS)
+		goto failure;
+
+	if (cdf_wait_single_event(&wma->runtime_suspend,
+			WMA_TGT_SUSPEND_COMPLETE_TIMEOUT) !=
+			CDF_STATUS_SUCCESS) {
+		WMA_LOGE("Failed to get runtime suspend event");
+		goto failure;
+	}
+
+	return CDF_STATUS_SUCCESS;
+
+failure:
+	return CDF_STATUS_E_AGAIN;
+}
+
+/**
+ * __wma_bus_suspend(): handles bus suspend for wma
+ * @type: is this suspend part of runtime suspend or system suspend?
+ *
+ * Bails if a scan is in progress.
+ * Calls the appropriate handlers based on configuration and event.
  *
  * Return: 0 for success or error code
  */
-int wma_bus_suspend(void)
+static int __wma_bus_suspend(enum cdf_suspend_type type)
 {
 	WMA_HANDLE handle = cds_get_context(CDF_MODULE_ID_WMA);
 	if (NULL == handle) {
@@ -6010,21 +6406,105 @@ int wma_bus_suspend(void)
 		return -EFAULT;
 	}
 
-	WMA_LOGE("%s: wow mode selected %d", __func__,
-	       wma_is_wow_mode_selected(handle));
-
 	if (wma_check_scan_in_progress(handle)) {
 		WMA_LOGE("%s: Scan in progress. Aborting suspend", __func__);
 		return -EBUSY;
 	}
 
-	if (wma_is_wow_mode_selected(handle))
-		return cdf_status_to_os_return(wma_enable_wow_in_fw(handle));
+	if (type == CDF_RUNTIME_SUSPEND) {
+		CDF_STATUS status = wma_post_runtime_suspend_msg(handle);
+		if (status)
+			return cdf_status_to_os_return(status);
+	}
+
+	if (type == CDF_SYSTEM_SUSPEND)
+		WMA_LOGE("%s: wow mode selected %d", __func__,
+				wma_is_wow_mode_selected(handle));
+
+	if (wma_is_wow_mode_selected(handle)) {
+		CDF_STATUS status = wma_enable_wow_in_fw(handle);
+		return cdf_status_to_os_return(status);
+	}
 
 	return wma_suspend_target(handle, 0);
 }
 
 /**
+ * wma_runtime_suspend() - handles runtime suspend request from hdd
+ *
+ * Calls the appropriate handler based on configuration and event.
+ * Last busy marking should prevent race conditions between processing
+ * of asyncronous fw events and the running of runtime suspend.
+ * (eg. last busy marking should guarantee that any auth requests have
+ * been processed)
+ * Events comming from the host are not protected, but aren't expected
+ * to be an issue.
+ *
+ * Return: 0 for success or error code
+ */
+int wma_runtime_suspend(void)
+{
+	return __wma_bus_suspend(CDF_RUNTIME_SUSPEND);
+}
+
+/**
+ * wma_bus_suspend() - handles bus suspend request from hdd
+ *
+ * Calls the appropriate handler based on configuration and event
+ *
+ * Return: 0 for success or error code
+ */
+int wma_bus_suspend(void)
+{
+
+	return __wma_bus_suspend(CDF_RUNTIME_SUSPEND);
+}
+
+/**
+ * __wma_bus_resume() - bus resume for wma
+ *
+ * does the part of the bus resume common to bus and system suspend
+ *
+ * Return: os error code.
+ */
+int __wma_bus_resume(WMA_HANDLE handle)
+{
+	bool wow_mode = wma_is_wow_mode_selected(handle);
+	CDF_STATUS status;
+
+	WMA_LOGE("%s: wow mode %d", __func__, wow_mode);
+
+	if (!wow_mode)
+		return wma_resume_target(handle);
+
+	status = wma_disable_wow_in_fw(handle);
+	return cdf_status_to_os_return(status);
+}
+
+/**
+ * wma_runtime_resume() - do the runtime resume operation for wma
+ *
+ * Return: os error code.
+ */
+int wma_runtime_resume(void)
+{
+	int ret;
+	CDF_STATUS status;
+	WMA_HANDLE handle = cds_get_context(CDF_MODULE_ID_WMA);
+	if (NULL == handle) {
+		WMA_LOGE("%s: wma context is NULL", __func__);
+		return -EFAULT;
+	}
+
+	ret = __wma_bus_resume(handle);
+	if (ret)
+		return ret;
+
+	status = wma_post_runtime_resume_msg(handle);
+	return cdf_status_to_os_return(status);
+}
+
+/**
  * wma_bus_resume() - handles bus resume request from hdd
  * @handle: valid wma handle
  *
@@ -6035,19 +6515,12 @@ int wma_bus_suspend(void)
 int wma_bus_resume(void)
 {
 	WMA_HANDLE handle = cds_get_context(CDF_MODULE_ID_WMA);
-	int wow_mode;
 	if (NULL == handle) {
 		WMA_LOGE("%s: wma context is NULL", __func__);
 		return -EFAULT;
 	}
 
-	wow_mode = wma_is_wow_mode_selected(handle);
-	WMA_LOGE("%s: wow mode %d", __func__, wow_mode);
-
-	if (!wow_mode)
-		return wma_resume_target(handle);
-
-	return cdf_status_to_os_return(wma_disable_wow_in_fw(handle));
+	return __wma_bus_resume(handle);
 }
 
 /**
@@ -6116,7 +6589,7 @@ int wma_suspend_target(WMA_HANDLE handle, int disable_target_intr)
 		WMA_LOGE("Failed to get ACK from firmware for pdev suspend");
 		wmi_set_target_suspend(wma_handle->wmi_handle, false);
 #ifdef CONFIG_CNSS
-		if (!cds_is_logp_in_progress()) {
+		if (!cds_is_driver_recovering()) {
 			if (pmac->sme.enableSelfRecovery) {
 				cds_trigger_recovery();
 			} else {
@@ -6213,7 +6686,7 @@ int wma_resume_target(WMA_HANDLE handle)
 		WMA_LOGP("%s: Pending commands %d credits %d", __func__,
 			wmi_get_pending_cmds(wma->wmi_handle),
 			wmi_get_host_credits(wma->wmi_handle));
-		if (!cds_is_logp_in_progress()) {
+		if (!cds_is_driver_recovering()) {
 #ifdef CONFIG_CNSS
 			if (pMac->sme.enableSelfRecovery) {
 				cds_trigger_recovery();
@@ -6492,6 +6965,8 @@ int wma_update_fw_tdls_state(WMA_HANDLE handle, void *pwmaTdlsparams)
 		cmd->state = WMI_TDLS_ENABLE_PASSIVE;
 	} else if (WMA_TDLS_SUPPORT_ENABLED == tdls_mode) {
 		cmd->state = WMI_TDLS_ENABLE_ACTIVE;
+	} else if (WMA_TDLS_SUPPORT_ACTIVE_EXTERNAL_CONTROL == tdls_mode) {
+		cmd->state = WMI_TDLS_ENABLE_ACTIVE_EXTERNAL_CONTROL;
 	} else {
 		cmd->state = WMI_TDLS_DISABLE;
 	}
@@ -6509,6 +6984,10 @@ int wma_update_fw_tdls_state(WMA_HANDLE handle, void *pwmaTdlsparams)
 	cmd->tdls_puapsd_inactivity_time_ms = wma_tdls->puapsd_inactivity_time;
 	cmd->tdls_puapsd_rx_frame_threshold =
 		wma_tdls->puapsd_rx_frame_threshold;
+	cmd->teardown_notification_ms =
+		wma_tdls->teardown_notification_ms;
+	cmd->tdls_peer_kickout_threshold =
+		wma_tdls->tdls_peer_kickout_threshold;
 
 	WMA_LOGD("%s: tdls_mode: %d, state: %d, "
 		 "notification_interval_ms: %d, "
@@ -6521,7 +7000,9 @@ int wma_update_fw_tdls_state(WMA_HANDLE handle, void *pwmaTdlsparams)
 		 "tdls_peer_traffic_response_timeout: %d, "
 		 "tdls_puapsd_mask: 0x%x, "
 		 "tdls_puapsd_inactivity_time: %d, "
-		 "tdls_puapsd_rx_frame_threshold: %d ",
+		 "tdls_puapsd_rx_frame_threshold: %d, "
+		 "teardown_notification_ms: %d, "
+		 "tdls_peer_kickout_threshold: %d",
 		 __func__, tdls_mode, cmd->state,
 		 cmd->notification_interval_ms,
 		 cmd->tx_discovery_threshold,
@@ -6533,7 +7014,9 @@ int wma_update_fw_tdls_state(WMA_HANDLE handle, void *pwmaTdlsparams)
 		 cmd->tdls_peer_traffic_response_timeout_ms,
 		 cmd->tdls_puapsd_mask,
 		 cmd->tdls_puapsd_inactivity_time_ms,
-		 cmd->tdls_puapsd_rx_frame_threshold);
+		 cmd->tdls_puapsd_rx_frame_threshold,
+		 cmd->teardown_notification_ms,
+		 cmd->tdls_peer_kickout_threshold);
 
 	if (wmi_unified_cmd_send(wma_handle->wmi_handle, wmi_buf, len,
 				 WMI_TDLS_SET_STATE_CMDID)) {
@@ -6617,6 +7100,12 @@ int wma_update_tdls_peer_state(WMA_HANDLE handle,
 	case WMA_TDLS_PEER_STATE_TEARDOWN:
 		cmd->peer_state = WMI_TDLS_PEER_STATE_TEARDOWN;
 		break;
+	case  WMA_TDLS_PEER_ADD_MAC_ADDR:
+		cmd->peer_state = WMI_TDLS_PEER_ADD_MAC_ADDR;
+		break;
+	case  WMA_TDLS_PEER_REMOVE_MAC_ADDR:
+		cmd->peer_state = WMI_TDLS_PEER_REMOVE_MAC_ADDR;
+		break;
 	}
 
 	WMA_LOGD("%s: vdev_id: %d, peerStateParams->peerMacAddr: %pM, "
@@ -6941,6 +7430,8 @@ struct dfs_ieee80211_channel *wma_dfs_configure_channel(
 						struct wma_vdev_start_req
 						*req)
 {
+	uint8_t ext_channel;
+
 	if (dfs_ic == NULL) {
 		WMA_LOGE("%s: DFS ic is Invalid", __func__);
 		return NULL;
@@ -6973,23 +7464,57 @@ struct dfs_ieee80211_channel *wma_dfs_configure_channel(
 	    (dfs_ic->ic_curchan->ic_ieee <= WMA_11A_CHANNEL_END)) {
 		dfs_ic->ic_curchan->ic_flags |= IEEE80211_CHAN_5GHZ;
 	}
-	if (CH_WIDTH_80MHZ == req->chan_width) {
-		dfs_ic->ic_curchan->ic_flags |= IEEE80211_CHAN_VHT80;
-	}
-	if (CH_WIDTH_40MHZ == req->chan_width) {
+
+	switch (req->chan_width) {
+	case CH_WIDTH_20MHZ:
+		dfs_ic->ic_curchan->ic_flags |=
+				(req->vht_capable ? IEEE80211_CHAN_VHT20 :
+							IEEE80211_CHAN_HT20);
+		break;
+	case CH_WIDTH_40MHZ:
 		if (req->chan < req->ch_center_freq_seg0)
-			dfs_ic->ic_curchan->ic_flags |= (req->vht_capable ?
+			dfs_ic->ic_curchan->ic_flags |=
+					(req->vht_capable ?
 					IEEE80211_CHAN_VHT40PLUS :
 					IEEE80211_CHAN_HT40PLUS);
 		else
-			dfs_ic->ic_curchan->ic_flags |= (req->vht_capable ?
+			dfs_ic->ic_curchan->ic_flags |=
+					(req->vht_capable ?
 					IEEE80211_CHAN_VHT40MINUS :
 					IEEE80211_CHAN_HT40MINUS);
-	} else if (CH_WIDTH_20MHZ == req->chan_width) {
+		break;
+	case CH_WIDTH_80MHZ:
+		dfs_ic->ic_curchan->ic_flags |= IEEE80211_CHAN_VHT80;
+		break;
+	case CH_WIDTH_80P80MHZ:
+		ext_channel = cds_freq_to_chan(chan->band_center_freq2);
 		dfs_ic->ic_curchan->ic_flags |=
-			(req->vht_capable ? IEEE80211_CHAN_VHT20 :
-						IEEE80211_CHAN_HT20);
+					IEEE80211_CHAN_VHT80P80;
+		dfs_ic->ic_curchan->ic_freq_ext =
+						chan->band_center_freq2;
+		dfs_ic->ic_curchan->ic_ieee_ext = ext_channel;
+
+		/* verify both the 80MHz are DFS bands or not */
+		if ((CHANNEL_STATE_DFS ==
+			cds_get_bonded_channel_state(req->chan ,
+						CH_WIDTH_80MHZ)) &&
+			(CHANNEL_STATE_DFS ==
+				cds_get_bonded_channel_state(
+					ext_channel - 6 ,
+					CH_WIDTH_80MHZ)))
+			dfs_ic->ic_curchan->ic_80p80_both_dfs = true;
+		break;
+	case CH_WIDTH_160MHZ:
+		dfs_ic->ic_curchan->ic_flags |=
+					IEEE80211_CHAN_VHT160;
+		break;
+	default:
+		WMA_LOGE(
+		    "%s: Recieved a wrong channel width %d",
+		    __func__, req->chan_width);
+		break;
 	}
+
 	dfs_ic->ic_curchan->ic_flagext |= IEEE80211_CHAN_DFS;
 
 	if (req->oper_mode == BSS_OPERATIONAL_MODE_AP) {
diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c
index f36fd45a7d94..a83f89558d03 100644
--- a/core/wma/src/wma_main.c
+++ b/core/wma/src/wma_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -322,9 +322,6 @@ int wma_cli_get_command(int vdev_id, int param_id, int vpdev)
 		case WMI_PDEV_PARAM_TXPOWER_LIMIT5G:
 			ret = wma->pdevconfig.txpow5g;
 			break;
-		case WMI_PDEV_PARAM_POWER_GATING_SLEEP:
-			ret = wma->pdevconfig.pwrgating;
-			break;
 		case WMI_PDEV_PARAM_BURST_ENABLE:
 			ret = wma->pdevconfig.burst_enable;
 			break;
@@ -1361,9 +1358,6 @@ static void wma_process_cli_set_cmd(tp_wma_handle wma,
 		case WMI_PDEV_PARAM_BURST_DUR:
 			wma->pdevconfig.burst_dur = privcmd->param_value;
 			break;
-		case WMI_PDEV_PARAM_POWER_GATING_SLEEP:
-			wma->pdevconfig.pwrgating = privcmd->param_value;
-			break;
 		case WMI_PDEV_PARAM_TXPOWER_LIMIT2G:
 			wma->pdevconfig.txpow2g = privcmd->param_value;
 			if ((pMac->roam.configParam.bandCapability ==
@@ -1564,7 +1558,7 @@ CDF_STATUS wma_open(void *cds_context,
 
 	cdf_mem_zero(wma_handle, sizeof(t_wma_handle));
 
-	if (cds_get_conparam() != CDF_FTM_MODE) {
+	if (cds_get_conparam() != CDF_GLOBAL_FTM_MODE) {
 #ifdef FEATURE_WLAN_SCAN_PNO
 		cdf_wake_lock_init(&wma_handle->pno_wake_lock, "wlan_pno_wl");
 #endif /* FEATURE_WLAN_SCAN_PNO */
@@ -1651,7 +1645,7 @@ CDF_STATUS wma_open(void *cds_context,
 		goto err_wmi_handle;
 	}
 #if defined(QCA_WIFI_FTM)
-	if (cds_get_conparam() == CDF_FTM_MODE)
+	if (cds_get_conparam() == CDF_GLOBAL_FTM_MODE)
 		wma_utf_attach(wma_handle);
 #endif /* QCA_WIFI_FTM */
 
@@ -1772,6 +1766,13 @@ CDF_STATUS wma_open(void *cds_context,
 		goto err_event_init;
 	}
 
+	cdf_status = cdf_event_init(&wma_handle->runtime_suspend);
+	if (cdf_status != CDF_STATUS_SUCCESS) {
+		WMA_LOGP("%s: runtime_suspend event initialization failed",
+			 __func__);
+		goto err_event_init;
+	}
+
 	cdf_status = cdf_event_init(&wma_handle->recovery_event);
 	if (cdf_status != CDF_STATUS_SUCCESS) {
 		WMA_LOGP("%s: recovery event initialization failed", __func__);
@@ -1823,6 +1824,10 @@ CDF_STATUS wma_open(void *cds_context,
 	wmi_unified_register_event_handler(wma_handle->wmi_handle,
 					   WMI_OEM_ERROR_REPORT_EVENTID,
 					   wma_oem_error_report_event_callback);
+
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					   WMI_OEM_RESPONSE_EVENTID,
+					   wma_oem_data_response_handler);
 #endif /* FEATURE_OEM_DATA_SUPPORT */
 	/*
 	 * Register appropriate DFS phyerr event handler for
@@ -1932,14 +1937,26 @@ CDF_STATUS wma_open(void *cds_context,
 				WMI_RSSI_BREACH_EVENTID,
 				wma_rssi_breached_event_handler);
 
+	cdf_wake_lock_init(&wma_handle->wmi_cmd_rsp_wake_lock,
+				"wlan_fw_rsp_wakelock");
+	wma_handle->wmi_cmd_rsp_runtime_lock =
+			cdf_runtime_lock_init("wlan_fw_rsp_runtime_lock");
+
 	/* Register peer assoc conf event handler */
 	wmi_unified_register_event_handler(wma_handle->wmi_handle,
 					   WMI_PEER_ASSOC_CONF_EVENTID,
 					   wma_peer_assoc_conf_handler);
-
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					   WMI_VDEV_DELETE_RESP_EVENTID,
+					   wma_vdev_delete_handler);
+	wmi_unified_register_event_handler(wma_handle->wmi_handle,
+					   WMI_PEER_DELETE_RESP_EVENTID,
+					   wma_peer_delete_handler);
 	return CDF_STATUS_SUCCESS;
 
 err_dbglog_init:
+	cdf_wake_lock_destroy(&wma_handle->wmi_cmd_rsp_wake_lock);
+	cdf_runtime_lock_deinit(wma_handle->wmi_cmd_rsp_runtime_lock);
 	cdf_spinlock_destroy(&wma_handle->vdev_respq_lock);
 	cdf_spinlock_destroy(&wma_handle->wma_hold_req_q_lock);
 err_event_init:
@@ -1957,7 +1974,7 @@ err_wmi_handle:
 
 err_wma_handle:
 
-	if (cds_get_conparam() != CDF_FTM_MODE) {
+	if (cds_get_conparam() != CDF_GLOBAL_FTM_MODE) {
 #ifdef FEATURE_WLAN_SCAN_PNO
 		cdf_wake_lock_destroy(&wma_handle->pno_wake_lock);
 #endif /* FEATURE_WLAN_SCAN_PNO */
@@ -2682,7 +2699,7 @@ CDF_STATUS wma_start(void *cds_ctx)
 	 * Tx mgmt attach requires TXRX context which is not created
 	 * in FTM mode. So skip the TX mgmt attach.
 	 */
-	if (cds_get_conparam() == CDF_FTM_MODE)
+	if (cds_get_conparam() == CDF_GLOBAL_FTM_MODE)
 		goto end;
 #endif /* QCA_WIFI_FTM */
 
@@ -2785,7 +2802,7 @@ CDF_STATUS wma_stop(void *cds_ctx, uint8_t reason)
 	 * Tx mgmt detach requires TXRX context which is not created
 	 * in FTM mode. So skip the TX mgmt detach.
 	 */
-	if (cds_get_conparam() == CDF_FTM_MODE) {
+	if (cds_get_conparam() == CDF_GLOBAL_FTM_MODE) {
 		cdf_status = CDF_STATUS_SUCCESS;
 		goto end;
 	}
@@ -2804,7 +2821,7 @@ CDF_STATUS wma_stop(void *cds_ctx, uint8_t reason)
 	}
 
 	/* There's no need suspend target which is already down during SSR. */
-	if (!cds_is_logp_in_progress()) {
+	if (!cds_is_driver_recovering()) {
 #ifdef HIF_USB
 		/* Suspend the target and enable interrupt */
 		if (wma_suspend_target(wma_handle, 0))
@@ -2953,6 +2970,17 @@ CDF_STATUS wma_wmi_service_close(void *cds_ctx)
 			cdf_mem_free(wma_handle->interfaces[i].handle);
 			wma_handle->interfaces[i].handle = NULL;
 		}
+
+		if (wma_handle->interfaces[i].addBssStaContext) {
+			cdf_mem_free(wma_handle->
+				     interfaces[i].addBssStaContext);
+			wma_handle->interfaces[i].addBssStaContext = NULL;
+		}
+
+		if (wma_handle->interfaces[i].del_staself_req) {
+			cdf_mem_free(wma_handle->interfaces[i].del_staself_req);
+			wma_handle->interfaces[i].del_staself_req = NULL;
+		}
 	}
 
 	cdf_mem_free(wma_handle->interfaces);
@@ -3050,7 +3078,7 @@ CDF_STATUS wma_close(void *cds_ctx)
 		wma_handle->saved_wmi_init_cmd.buf = NULL;
 	}
 
-	if (cds_get_conparam() != CDF_FTM_MODE) {
+	if (cds_get_conparam() != CDF_GLOBAL_FTM_MODE) {
 #ifdef FEATURE_WLAN_SCAN_PNO
 		cdf_wake_lock_destroy(&wma_handle->pno_wake_lock);
 #endif /* FEATURE_WLAN_SCAN_PNO */
@@ -3074,9 +3102,12 @@ CDF_STATUS wma_close(void *cds_ctx)
 
 	cdf_event_destroy(&wma_handle->target_suspend);
 	cdf_event_destroy(&wma_handle->wma_resume_event);
+	cdf_event_destroy(&wma_handle->runtime_suspend);
 	cdf_event_destroy(&wma_handle->recovery_event);
 	wma_cleanup_vdev_resp(wma_handle);
 	wma_cleanup_hold_req(wma_handle);
+	cdf_wake_lock_destroy(&wma_handle->wmi_cmd_rsp_wake_lock);
+	cdf_runtime_lock_deinit(wma_handle->wmi_cmd_rsp_runtime_lock);
 	for (idx = 0; idx < wma_handle->num_mem_chunks; ++idx) {
 		cdf_os_mem_free_consistent(wma_handle->cdf_dev,
 					   wma_handle->mem_chunks[idx].len,
@@ -3089,7 +3120,7 @@ CDF_STATUS wma_close(void *cds_ctx)
 
 #if defined(QCA_WIFI_FTM)
 	/* Detach UTF and unregister the handler */
-	if (cds_get_conparam() == CDF_FTM_MODE)
+	if (cds_get_conparam() == CDF_GLOBAL_FTM_MODE)
 		wma_utf_detach(wma_handle);
 #endif /* QCA_WIFI_FTM */
 
@@ -3465,6 +3496,7 @@ static void wma_update_hdd_cfg(tp_wma_handle wma_handle)
 	tgt_cfg.lpss_support = wma_handle->lpss_support;
 #endif /* WLAN_FEATURE_LPSS */
 	tgt_cfg.ap_arpns_support = wma_handle->ap_arpns_support;
+	wma_setup_egap_support(&tgt_cfg, wma_handle);
 	wma_handle->tgt_cfg_update_cb(hdd_ctx, &tgt_cfg);
 }
 
@@ -3776,7 +3808,6 @@ void wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 	wma_handle->num_rf_chains = ev->num_rf_chains;
 
 	wma_handle->target_fw_version = ev->fw_build_vers;
-	ol_tx_set_desc_global_pool_size(ev->num_msdu_desc);
 	wma_handle->new_hw_mode_index = ev->default_dbs_hw_mode_index;
 
 	WMA_LOGD("%s: Firmware default hw mode index : %d",
@@ -3798,6 +3829,7 @@ void wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 			     sizeof(wma_handle->hw_bd_info));
 		WMA_LOGE("%s: Board version is unknown!", __func__);
 	}
+	wma_handle->dfs_ic->dfs_hw_bd_id = wma_handle->hw_bd_id;
 
 	/* TODO: Recheck below line to dump service ready event */
 	/* dbg_print_wmi_service_11ac(ev); */
@@ -3810,6 +3842,7 @@ void wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 	ol_tx_set_is_mgmt_over_wmi_enabled(
 		WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
 				       WMI_SERVICE_MGMT_TX_WMI));
+	ol_tx_set_desc_global_pool_size(ev->num_msdu_desc);
 
 	/* SWBA event handler for beacon transmission */
 	status = wmi_unified_register_event_handler(wma_handle->wmi_handle,
@@ -3900,6 +3933,9 @@ void wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 		return;
 	}
 
+	/* register the Enhanced Green AP event handler */
+	wma_register_egap_event_handle(wma_handle);
+
 	/* Initialize the log supported event handler */
 	status = wmi_unified_register_event_handler(wma_handle->wmi_handle,
 			WMI_DIAG_EVENT_LOG_SUPPORTED_EVENTID,
@@ -4861,9 +4897,19 @@ CDF_STATUS wma_mc_process_msg(void *cds_context, cds_msg_t *msg)
 	case WMA_WOWL_EXIT_REQ:
 		wma_wow_exit(wma_handle, (tpSirHalWowlExitParams) msg->bodyptr);
 		break;
+
+	case WMA_RUNTIME_PM_SUSPEND_IND:
+		wma_calculate_and_update_conn_state(wma_handle);
+		wma_suspend_req(wma_handle, CDF_RUNTIME_SUSPEND);
+		break;
+
+	case WMA_RUNTIME_PM_RESUME_IND:
+		wma_resume_req(wma_handle, CDF_RUNTIME_SUSPEND);
+		break;
+
 	case WMA_WLAN_SUSPEND_IND:
-		wma_suspend_req(wma_handle,
-				(tpSirWlanSuspendParam) msg->bodyptr);
+		wma_update_conn_state(wma_handle, msg->bodyval);
+		wma_suspend_req(wma_handle, CDF_SYSTEM_SUSPEND);
 		break;
 	case WMA_8023_MULTICAST_LIST_REQ:
 		wma_process_mcbc_set_filter_req(wma_handle,
@@ -5002,7 +5048,7 @@ CDF_STATUS wma_mc_process_msg(void *cds_context, cds_msg_t *msg)
 		cdf_mem_free(msg->bodyptr);
 		break;
 	case WMA_WLAN_RESUME_REQ:
-		wma_resume_req(wma_handle);
+		wma_resume_req(wma_handle, CDF_SYSTEM_SUSPEND);
 		break;
 
 #ifdef WLAN_FEATURE_STATS_EXT
@@ -5127,11 +5173,6 @@ CDF_STATUS wma_mc_process_msg(void *cds_context, cds_msg_t *msg)
 		cdf_mem_free(msg->bodyptr);
 		break;
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
-	case WMA_ROAM_OFFLOAD_SYNCH_CNF:
-		wma_process_roam_synch_complete(wma_handle,
-			(tSirSmeRoamOffloadSynchCnf *)msg->bodyptr);
-		cdf_mem_free(msg->bodyptr);
-		break;
 	case WMA_ROAM_OFFLOAD_SYNCH_FAIL:
 		wma_process_roam_synch_fail(wma_handle,
 			(struct roam_offload_synch_fail *)msg->bodyptr);
@@ -5286,6 +5327,15 @@ CDF_STATUS wma_mc_process_msg(void *cds_context, cds_msg_t *msg)
 			(struct wma_lro_config_cmd_t *)msg->bodyptr);
 		cdf_mem_free(msg->bodyptr);
 		break;
+	case WMA_GW_PARAM_UPDATE_REQ:
+		wma_set_gateway_params(wma_handle,
+			(struct gateway_param_update_req *)msg->bodyptr);
+		break;
+	case WMA_SET_EGAP_CONF_PARAMS:
+		wma_send_egap_conf_params(wma_handle,
+			(struct egap_conf_params *)msg->bodyptr);
+		cdf_mem_free(msg->bodyptr);
+		break;
 	default:
 		WMA_LOGD("unknow msg type %x", msg->type);
 		/* Do Nothing? MSG Body should be freed at here */
diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c
index 89a9e728cb55..d9da1626706c 100644
--- a/core/wma/src/wma_mgmt.c
+++ b/core/wma/src/wma_mgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -341,7 +341,7 @@ int wma_peer_sta_kickout_event_handler(void *handle, u8 *event, u32 len)
 		}
 
 		p_inactivity->staIdx = peer_id;
-		cdf_mem_copy(p_inactivity->peerAddr, macaddr,
+		cdf_mem_copy(p_inactivity->peer_addr.bytes, macaddr,
 			     IEEE80211_ADDR_LEN);
 		wma_send_msg(wma, WMA_IBSS_PEER_INACTIVITY_IND,
 			     (void *)p_inactivity, 0);
@@ -440,6 +440,7 @@ int wma_peer_sta_kickout_event_handler(void *handle, u8 *event, u32 len)
 	cdf_mem_copy(del_sta_ctx->bssId, wma->interfaces[vdev_id].addr,
 		     IEEE80211_ADDR_LEN);
 	del_sta_ctx->reasonCode = HAL_DEL_STA_REASON_CODE_KEEP_ALIVE;
+	del_sta_ctx->rssi = kickout_event->rssi + WMA_TGT_NOISE_FLOOR_DBM;
 	wma_send_msg(wma, SIR_LIM_DELETE_STA_CONTEXT_IND, (void *)del_sta_ctx,
 		     0);
 
@@ -953,9 +954,7 @@ int32_t wmi_unified_send_peer_assoc(tp_wma_handle wma,
 	 * be the new peer address
 	 */
 	if ((wma_is_vdev_in_ap_mode(wma, params->smesessionId))
-#ifdef QCA_IBSS_SUPPORT
 	    || (wma_is_vdev_in_ibss_mode(wma, params->smesessionId))
-#endif /* QCA_IBSS_SUPPORT */
 #ifdef FEATURE_WLAN_TDLS
 	    || (STA_ENTRY_TDLS_PEER == params->staType)
 #endif /* FEATURE_WLAN_TDLS */
@@ -1110,7 +1109,18 @@ int32_t wmi_unified_send_peer_assoc(tp_wma_handle wma,
 		       WMITLV_GET_STRUCT_TLVLEN(wmi_vht_rate_set));
 
 	cmd->peer_nss = peer_nss;
-
+	/*
+	 * Because of DBS a vdev may come up in any of the two MACs with
+	 * different capabilities. STBC capab should be fetched for given
+	 * hard_mode->MAC_id combo. It is planned that firmware should provide
+	 * these dev capabilities. But for now number of tx streams can be used
+	 * to identify if Tx STBC needs to be disabled.
+	 */
+	if (intr->tx_streams < 2) {
+		cmd->peer_vht_caps &= ~(1 << SIR_MAC_VHT_CAP_TXSTBC);
+		WMA_LOGD("Num tx_streams: %d, Disabled txSTBC",
+			 intr->tx_streams);
+	}
 	WMA_LOGD("peer_nss %d peer_ht_rates.num_rates %d ", cmd->peer_nss,
 		 peer_ht_rates.num_rates);
 
@@ -1447,8 +1457,14 @@ static wmi_buf_t wma_setup_install_key_cmd(tp_wma_handle wma_handle,
 	case eSIR_ED_WEP104:
 		cmd->key_cipher = WMI_CIPHER_WEP;
 		if (key_params->unicast &&
-		    cmd->key_ix == key_params->def_key_idx)
+		    cmd->key_ix == key_params->def_key_idx) {
+			WMA_LOGD("STA Mode: cmd->key_flags |= TX_USAGE");
+			cmd->key_flags |= TX_USAGE;
+		} else if ((mode == wlan_op_mode_ap) &&
+			(cmd->key_ix == key_params->def_key_idx)) {
+			WMA_LOGD("AP Mode: cmd->key_flags |= TX_USAGE");
 			cmd->key_flags |= TX_USAGE;
+		}
 		break;
 	case eSIR_ED_TKIP:
 		cmd->key_txmic_len = WMA_TXMIC_LEN;
@@ -1790,7 +1806,7 @@ void wma_adjust_ibss_heart_beat_timer(tp_wma_handle wma,
  */
 static void wma_set_ibsskey_helper(tp_wma_handle wma_handle,
 				   tpSetBssKeyParams key_info,
-				   uint8_t *peerMacAddr)
+				   struct cdf_mac_addr peer_macaddr)
 {
 	struct wma_set_key_params key_params;
 	wmi_buf_t buf;
@@ -1800,7 +1816,6 @@ static void wma_set_ibsskey_helper(tp_wma_handle wma_handle,
 	ol_txrx_vdev_handle txrx_vdev;
 
 	WMA_LOGD("BSS key setup for peer");
-	ASSERT(NULL != peerMacAddr);
 	txrx_vdev = wma_find_vdev_by_id(wma_handle, key_info->smesessionId);
 	if (!txrx_vdev) {
 		WMA_LOGE("%s:Invalid vdev handle", __func__);
@@ -1815,7 +1830,8 @@ static void wma_set_ibsskey_helper(tp_wma_handle wma_handle,
 	key_params.unicast = false;
 	ASSERT(wlan_op_mode_ibss == txrx_vdev->opmode);
 
-	cdf_mem_copy(key_params.peer_mac, peerMacAddr, IEEE80211_ADDR_LEN);
+	cdf_mem_copy(key_params.peer_mac, peer_macaddr.bytes,
+			IEEE80211_ADDR_LEN);
 
 	if (key_info->numKeys == 0 &&
 	    (key_info->encType == eSIR_ED_WEP40 ||
@@ -1895,7 +1911,8 @@ void wma_set_stakey(tp_wma_handle wma_handle, tpSetStaKeyParams key_info)
 		goto out;
 	}
 
-	peer = ol_txrx_find_peer_by_addr(txrx_pdev, key_info->peerMacAddr,
+	peer = ol_txrx_find_peer_by_addr(txrx_pdev,
+					 key_info->peer_macaddr.bytes,
 					 &peer_id);
 	if (!peer) {
 		WMA_LOGE("%s:Invalid peer for key setting", __func__);
@@ -1936,7 +1953,8 @@ void wma_set_stakey(tp_wma_handle wma_handle, tpSetStaKeyParams key_info)
 	key_params.unicast = true;
 	key_params.def_key_idx = key_info->defWEPIdx;
 	cdf_mem_copy((void *)key_params.peer_mac,
-		     (const void *)key_info->peerMacAddr, IEEE80211_ADDR_LEN);
+		     (const void *)key_info->peer_macaddr.bytes,
+		     IEEE80211_ADDR_LEN);
 	for (i = 0; i < num_keys; i++) {
 		if (key_params.key_type != eSIR_ED_NONE &&
 		    !key_info->key[i].keyLength)
@@ -1986,7 +2004,7 @@ void wma_set_stakey(tp_wma_handle wma_handle, tpSetStaKeyParams key_info)
 	 */
 	if (wlan_op_mode_ibss == txrx_vdev->opmode) {
 		wma_set_ibsskey_helper(wma_handle, &wma_handle->ibsskey_info,
-				       key_info->peerMacAddr);
+				       key_info->peer_macaddr);
 	}
 
 	/* TODO: Should we wait till we get HTT_T2H_MSG_TYPE_SEC_IND? */
@@ -2611,7 +2629,8 @@ void wma_set_keepalive_req(tp_wma_handle wma,
 			       keepalive->packetType,
 			       keepalive->timePeriod,
 			       keepalive->hostIpv4Addr,
-			       keepalive->destIpv4Addr, keepalive->destMacAddr);
+			       keepalive->destIpv4Addr,
+			       keepalive->dest_macaddr.bytes);
 
 	cdf_mem_free(keepalive);
 }
@@ -2940,7 +2959,7 @@ wma_is_ccmp_pn_replay_attack(void *cds_ctx, struct ieee80211_frame *wh,
 		return true;
 	}
 
-	vdev = wma_find_vdev_by_addr(cds_ctx, wh->i_addr2, &vdev_id);
+	vdev = wma_find_vdev_by_bssid(cds_ctx, wh->i_addr3, &vdev_id);
 	if (!vdev) {
 		WMA_LOGE("%s: Failed to find vdev", __func__);
 		return true;
@@ -3096,7 +3115,7 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle,
 			if (0 != wma_process_bip(wma_handle, iface, wh, wbuf)) {
 					cds_pkt_return_packet(rx_pkt);
 					return -EINVAL;
-				}
+			}
 		} else {
 			WMA_LOGE("Rx unprotected unicast mgmt frame");
 			rx_pkt->pkt_meta.dpuFeedback =
@@ -3122,7 +3141,7 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data,
 	WMI_MGMT_RX_EVENTID_param_tlvs *param_tlvs = NULL;
 	wmi_mgmt_rx_hdr *hdr = NULL;
 	struct wma_txrx_node *iface = NULL;
-	uint8_t vdev_id;
+	uint8_t vdev_id = WMA_INVALID_VDEV_ID;
 	cds_pkt_t *rx_pkt;
 	cdf_nbuf_t wbuf;
 	struct ieee80211_frame *wh;
@@ -3157,7 +3176,7 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data,
 		return -ENOMEM;
 	}
 
-	if (cds_is_load_unload_in_progress()) {
+	if (cds_is_load_or_unload_in_progress()) {
 		WMA_LOGE("Load/Unload in progress");
 		return -EINVAL;
 	}
@@ -3170,10 +3189,21 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data,
 	 */
 	rx_pkt->pkt_meta.channel = hdr->channel;
 	rx_pkt->pkt_meta.scan_src = hdr->flags;
-	/*Get the absolute rssi value from the current rssi value
-	 *the sinr value is hardcoded into 0 in the core stack*/
-	rx_pkt->pkt_meta.rssi = hdr->snr + WMA_TGT_NOISE_FLOOR_DBM;
+
+	/*
+	 * Get the rssi value from the current snr value
+	 * using standard noise floor of -96.
+	 */
+	rx_pkt->pkt_meta.rssi = hdr->snr + WMA_NOISE_FLOOR_DBM_DEFAULT;
 	rx_pkt->pkt_meta.snr = hdr->snr;
+
+	/* If absolute rssi is available from firmware, use it */
+	if (hdr->rssi != 0)
+		rx_pkt->pkt_meta.rssi_raw = hdr->rssi;
+	else
+		rx_pkt->pkt_meta.rssi_raw = rx_pkt->pkt_meta.rssi;
+
+
 	/*
 	 * FIXME: Assigning the local timestamp as hw timestamp is not
 	 * available. Need to see if pe/lim really uses this data.
@@ -3232,6 +3262,11 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data,
 	cdf_mem_copy(wh, param_tlvs->bufp, hdr->buf_len);
 #endif
 
+	WMA_LOGD(
+		FL("BSSID: "MAC_ADDRESS_STR" snr = %d, rssi = %d, rssi_raw = %d"),
+			MAC_ADDR_ARRAY(wh->i_addr3),
+			hdr->snr, rx_pkt->pkt_meta.rssi,
+			rx_pkt->pkt_meta.rssi_raw);
 	if (!wma_handle->mgmt_rx) {
 		WMA_LOGE("Not registered for Mgmt rx, dropping the frame");
 		cds_pkt_return_packet(rx_pkt);
@@ -3242,22 +3277,25 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data,
 	mgt_type = (wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 	mgt_subtype = (wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
 
-	iface = wma_find_vdev_by_addr(wma_handle, wh->i_addr3, &vdev_id);
-	rx_pkt->pkt_meta.sessionId = vdev_id;
-
 #ifdef WLAN_FEATURE_11W
 	if (mgt_type == IEEE80211_FC0_TYPE_MGT &&
 	    (mgt_subtype == IEEE80211_FC0_SUBTYPE_DISASSOC ||
 	     mgt_subtype == IEEE80211_FC0_SUBTYPE_DEAUTH ||
 	     mgt_subtype == IEEE80211_FC0_SUBTYPE_ACTION)) {
-		if (iface && iface->rmfEnabled) {
-			status = wma_process_rmf_frame(wma_handle,
-				iface, wh, rx_pkt, wbuf);
-			if (status != 0)
-				return status;
+		if (wma_find_vdev_by_bssid(
+			wma_handle, wh->i_addr3, &vdev_id)) {
+			iface = &(wma_handle->interfaces[vdev_id]);
+			if (iface->rmfEnabled) {
+				status = wma_process_rmf_frame(wma_handle,
+					iface, wh, rx_pkt, wbuf);
+				if (status != 0)
+					return status;
+			}
 		}
 	}
 #endif /* WLAN_FEATURE_11W */
+	rx_pkt->pkt_meta.sessionId =
+		(vdev_id == WMA_INVALID_VDEV_ID ? 0 : vdev_id);
 	wma_handle->mgmt_rx(wma_handle, rx_pkt);
 	return 0;
 }
@@ -3273,7 +3311,7 @@ CDF_STATUS wma_de_register_mgmt_frm_client(void *cds_ctx)
 	tp_wma_handle wma_handle;
 
 #ifdef QCA_WIFI_FTM
-	if (cds_get_conparam() == CDF_FTM_MODE)
+	if (cds_get_conparam() == CDF_GLOBAL_FTM_MODE)
 		return CDF_STATUS_SUCCESS;
 #endif
 
@@ -3293,6 +3331,37 @@ CDF_STATUS wma_de_register_mgmt_frm_client(void *cds_ctx)
 }
 
 /**
+ * wma_register_roaming_callbacks() - Register roaming callbacks
+ * @cds_ctx: CDS Context
+ * @csr_roam_synch_cb: CSR roam synch callback routine pointer
+ * @pe_roam_synch_cb: PE roam synch callback routine pointer
+ *
+ * Register the SME and PE callback routines with WMA for
+ * handling roaming
+ *
+ * Return: Success or Failure Status
+ */
+CDF_STATUS wma_register_roaming_callbacks(void *cds_ctx,
+	void (*csr_roam_synch_cb)(tpAniSirGlobal mac,
+		roam_offload_synch_ind *roam_synch_data,
+		tpSirBssDescription  bss_desc_ptr, uint8_t reason),
+	CDF_STATUS (*pe_roam_synch_cb)(tpAniSirGlobal mac,
+		roam_offload_synch_ind *roam_synch_data,
+		tpSirBssDescription  bss_desc_ptr))
+{
+
+	tp_wma_handle wma = cds_get_context(CDF_MODULE_ID_WMA);
+
+	if (!wma) {
+		WMA_LOGE("%s: Failed to get WMA context", __func__);
+		return CDF_STATUS_E_FAILURE;
+	}
+	wma->csr_roam_synch_cb = csr_roam_synch_cb;
+	wma->pe_roam_synch_cb = pe_roam_synch_cb;
+	WMA_LOGD("Registered roam synch callbacks with WMA successfully");
+	return CDF_STATUS_SUCCESS;
+}
+/**
  * wma_register_mgmt_frm_client() - register management frame callback
  * @cds_ctx: cds context
  * @mgmt_frm_rx: management frame
diff --git a/core/wma/src/wma_power.c b/core/wma/src/wma_power.c
index 72d77b800d97..b8f855a53cfd 100644
--- a/core/wma/src/wma_power.c
+++ b/core/wma/src/wma_power.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -490,7 +490,7 @@ void wma_set_max_tx_power(WMA_HANDLE handle,
 	uint8_t vdev_id;
 	int ret = -1;
 	void *pdev;
-	tPowerdBm prev_max_power;
+	int8_t prev_max_power;
 
 	pdev = wma_find_vdev_by_addr(wma_handle, tx_pwr_params->bssId.bytes,
 				     &vdev_id);
@@ -2252,3 +2252,62 @@ void wma_set_resume_dtim(tp_wma_handle wma)
 	}
 }
 
+/**
+ * wma_set_tx_power_scale() - set tx power scale
+ * @vdev_id: vdev id
+ * @value: value
+ *
+ * Return: CDF_STATUS_SUCCESS for success or error code.
+ */
+CDF_STATUS wma_set_tx_power_scale(uint8_t vdev_id, int value)
+{
+	int ret = CDF_STATUS_SUCCESS;
+	tp_wma_handle wma_handle =
+			(tp_wma_handle)cds_get_context(CDF_MODULE_ID_WMA);
+	if (NULL == wma_handle) {
+		WMA_LOGE("%s: wma_handle is NULL", __func__);
+		return CDF_STATUS_E_FAILURE;
+	}
+
+	if (!(wma_handle->interfaces[vdev_id].vdev_up)) {
+		WMA_LOGE("%s: vdev id %d is not up", __func__, vdev_id);
+		return CDF_STATUS_E_FAILURE;
+	}
+
+	ret = wmi_unified_vdev_set_param_send(wma_handle->wmi_handle, vdev_id,
+				WMI_VDEV_PARAM_TXPOWER_SCALE, value);
+	if (ret != 0)
+		WMA_LOGE("Set tx power scale failed");
+
+	return ret;
+}
+
+/**
+ * wma_set_tx_power_scale_decr_db() - decrease power by DB value
+ * @vdev_id: vdev id
+ * @value: value
+ *
+ * Return: CDF_STATUS_SUCCESS for success or error code.
+ */
+CDF_STATUS wma_set_tx_power_scale_decr_db(uint8_t vdev_id, int value)
+{
+	int ret = CDF_STATUS_SUCCESS;
+	tp_wma_handle wma_handle =
+			(tp_wma_handle)cds_get_context(CDF_MODULE_ID_WMA);
+	if (NULL == wma_handle) {
+		WMA_LOGE("%s: wma_handle is NULL", __func__);
+		return CDF_STATUS_E_FAILURE;
+	}
+
+	if (!(wma_handle->interfaces[vdev_id].vdev_up)) {
+		WMA_LOGE("%s: vdev id %d is not up", __func__, vdev_id);
+		return CDF_STATUS_E_FAILURE;
+	}
+
+	ret = wmi_unified_vdev_set_param_send(wma_handle->wmi_handle, vdev_id,
+				WMI_VDEV_PARAM_TXPOWER_SCALE_DECR_DB, value);
+	if (ret != 0)
+		WMA_LOGE("Decrease tx power value failed");
+
+	return ret;
+}
diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c
index 0156f9ac7f31..83c6eaa275ac 100644
--- a/core/wma/src/wma_scan_roam.c
+++ b/core/wma/src/wma_scan_roam.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -2713,6 +2713,158 @@ void wma_process_roam_synch_fail(WMA_HANDLE handle,
 }
 
 /**
+ * wma_fill_roam_synch_buffer() - Fill the the roam sync buffer
+ * @wma: Global WMA Handle
+ * @roam_synch_ind_ptr: Buffer to be filled
+ * @param_buf: Source buffer
+ *
+ * Firmware sends all the required information required for roam
+ * synch propagation as TLV's and stored in param_buf. These
+ * parameters are parsed and filled into the roam synch indication
+ * buffer which will be used at different layers for propagation.
+ *
+ * Return: None
+ */
+void wma_fill_roam_synch_buffer(tp_wma_handle wma,
+		roam_offload_synch_ind *roam_synch_ind_ptr,
+		WMI_ROAM_SYNCH_EVENTID_param_tlvs *param_buf)
+{
+	wmi_roam_synch_event_fixed_param *synch_event;
+	uint8_t *bcn_probersp_ptr;
+	uint8_t *reassoc_rsp_ptr;
+	uint8_t *reassoc_req_ptr;
+	wmi_channel *chan;
+	wmi_key_material *key;
+
+	synch_event = param_buf->fixed_param;
+	roam_synch_ind_ptr->roamedVdevId = synch_event->vdev_id;
+	roam_synch_ind_ptr->authStatus = synch_event->auth_status;
+	roam_synch_ind_ptr->roamReason = synch_event->roam_reason;
+	roam_synch_ind_ptr->rssi = synch_event->rssi;
+	roam_synch_ind_ptr->isBeacon = synch_event->is_beacon;
+	WMI_MAC_ADDR_TO_CHAR_ARRAY(&synch_event->bssid,
+				   roam_synch_ind_ptr->bssid.bytes);
+	wma->csr_roam_synch_cb((tpAniSirGlobal)wma->mac_context,
+		roam_synch_ind_ptr, NULL, ROAMING_TX_QUEUE_DISABLE);
+	/* Beacon/Probe Rsp data */
+	roam_synch_ind_ptr->beaconProbeRespOffset =
+		sizeof(roam_offload_synch_ind);
+	bcn_probersp_ptr = (uint8_t *) roam_synch_ind_ptr +
+		roam_synch_ind_ptr->beaconProbeRespOffset;
+	roam_synch_ind_ptr->beaconProbeRespLength =
+		synch_event->bcn_probe_rsp_len;
+	cdf_mem_copy(bcn_probersp_ptr, param_buf->bcn_probe_rsp_frame,
+		     roam_synch_ind_ptr->beaconProbeRespLength);
+	/* ReAssoc Rsp data */
+	roam_synch_ind_ptr->reassocRespOffset =
+		sizeof(roam_offload_synch_ind) +
+		roam_synch_ind_ptr->beaconProbeRespLength;
+	roam_synch_ind_ptr->reassocRespLength = synch_event->reassoc_rsp_len;
+	reassoc_rsp_ptr = (uint8_t *) roam_synch_ind_ptr +
+			  roam_synch_ind_ptr->reassocRespOffset;
+	cdf_mem_copy(reassoc_rsp_ptr,
+		     param_buf->reassoc_rsp_frame,
+		     roam_synch_ind_ptr->reassocRespLength);
+
+	/* ReAssoc Req data */
+	roam_synch_ind_ptr->reassoc_req_offset =
+		sizeof(roam_offload_synch_ind) +
+		roam_synch_ind_ptr->beaconProbeRespLength +
+		roam_synch_ind_ptr->reassocRespLength;
+	roam_synch_ind_ptr->reassoc_req_length = synch_event->reassoc_req_len;
+	reassoc_req_ptr = (uint8_t *) roam_synch_ind_ptr +
+			  roam_synch_ind_ptr->reassoc_req_offset;
+	cdf_mem_copy(reassoc_req_ptr, param_buf->reassoc_req_frame,
+		     roam_synch_ind_ptr->reassoc_req_length);
+
+	chan = (wmi_channel *) param_buf->chan;
+	roam_synch_ind_ptr->chan_freq = chan->mhz;
+	key = (wmi_key_material *) param_buf->key;
+	if (key != NULL) {
+		cdf_mem_copy(roam_synch_ind_ptr->kck, key->kck,
+			     SIR_KCK_KEY_LEN);
+		cdf_mem_copy(roam_synch_ind_ptr->kek, key->kek,
+			     SIR_KEK_KEY_LEN);
+		cdf_mem_copy(roam_synch_ind_ptr->replay_ctr,
+			     key->replay_counter, SIR_REPLAY_CTR_LEN);
+		WMA_LOGD("%s: KCK dump", __func__);
+		CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_WMA, CDF_TRACE_LEVEL_DEBUG,
+				   key->kck, SIR_KCK_KEY_LEN);
+		WMA_LOGD("%s: KEK dump", __func__);
+		CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_WMA, CDF_TRACE_LEVEL_DEBUG,
+				   key->kek, SIR_KEK_KEY_LEN);
+		WMA_LOGD("%s: Key Replay Counter dump", __func__);
+		CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_WMA, CDF_TRACE_LEVEL_DEBUG,
+				   key->replay_counter, SIR_REPLAY_CTR_LEN);
+	}
+}
+
+/**
+ * wma_roam_update_vdev() - Update the STA and BSS
+ * @wma: Global WMA Handle
+ * @roam_synch_ind_ptr: Information needed for roam sync propagation
+ *
+ * This function will perform all the vdev related operations with
+ * respect to the self sta and the peer after roaming and completes
+ * the roam synch propagation with respect to WMA layer.
+ *
+ * Return: None
+ */
+void wma_roam_update_vdev(tp_wma_handle wma,
+	roam_offload_synch_ind *roam_synch_ind_ptr)
+{
+	tDeleteBssParams *del_bss_params;
+	tDeleteStaParams *del_sta_params;
+	tLinkStateParams *set_link_params;
+	tAddStaParams *add_sta_params;
+	uint8_t vdev_id;
+
+	del_bss_params = cdf_mem_malloc(sizeof(*del_bss_params));
+	del_sta_params = cdf_mem_malloc(sizeof(*del_sta_params));
+	set_link_params = cdf_mem_malloc(sizeof(*set_link_params));
+	add_sta_params = cdf_mem_malloc(sizeof(*add_sta_params));
+	if (!del_bss_params || !del_sta_params ||
+		!set_link_params || !add_sta_params) {
+		WMA_LOGE("%s: failed to allocate memory", __func__);
+		return;
+	}
+	vdev_id = roam_synch_ind_ptr->roamedVdevId;
+	cdf_mem_zero(del_bss_params, sizeof(*del_bss_params));
+	cdf_mem_zero(del_sta_params, sizeof(*del_sta_params));
+	cdf_mem_zero(set_link_params, sizeof(*set_link_params));
+	cdf_mem_zero(add_sta_params, sizeof(*add_sta_params));
+
+	del_bss_params->smesessionId = vdev_id;
+	del_sta_params->smesessionId = vdev_id;
+	cdf_mem_copy(del_bss_params->bssid, wma->interfaces[vdev_id].bssid,
+			IEEE80211_ADDR_LEN);
+	set_link_params->state = eSIR_LINK_PREASSOC_STATE;
+	cdf_mem_copy(set_link_params->selfMacAddr, wma->myaddr,
+			IEEE80211_ADDR_LEN);
+	cdf_mem_copy(set_link_params->bssid, roam_synch_ind_ptr->bssid.bytes,
+			IEEE80211_ADDR_LEN);
+	add_sta_params->staType = STA_ENTRY_SELF;
+	add_sta_params->smesessionId = vdev_id;
+	cdf_mem_copy(&add_sta_params->bssId, &roam_synch_ind_ptr->bssid.bytes,
+			IEEE80211_ADDR_LEN);
+	add_sta_params->staIdx = STA_INVALID_IDX;
+	add_sta_params->assocId = roam_synch_ind_ptr->aid;
+
+	wma_delete_sta(wma, del_sta_params);
+	wma_delete_bss(wma, del_bss_params);
+	wma_set_linkstate(wma, set_link_params);
+	wma_add_bss(wma, (tpAddBssParams)roam_synch_ind_ptr->add_bss_params);
+	wma_add_sta(wma, add_sta_params);
+	wma->interfaces[vdev_id].vdev_up = true;
+	cdf_mem_copy(wma->interfaces[vdev_id].bssid,
+			roam_synch_ind_ptr->bssid.bytes, IEEE80211_ADDR_LEN);
+	cdf_mem_free(del_bss_params);
+	cdf_mem_free(del_sta_params);
+	cdf_mem_free(set_link_params);
+	cdf_mem_free(add_sta_params);
+}
+
+/**
  * wma_roam_synch_event_handler() - roam synch event handler
  * @handle: wma handle
  * @event: event data
@@ -2720,105 +2872,94 @@ void wma_process_roam_synch_fail(WMA_HANDLE handle,
  *
  * This function is roam synch event handler. It sends roam
  * indication for upper layer.
+ *
+ * Return: Success or Failure status
  */
 int wma_roam_synch_event_handler(void *handle, uint8_t *event,
 					uint32_t len)
 {
 	WMI_ROAM_SYNCH_EVENTID_param_tlvs *param_buf = NULL;
 	wmi_roam_synch_event_fixed_param *synch_event = NULL;
-	uint8_t *bcn_probersp_ptr = NULL;
-	uint8_t *reassoc_rsp_ptr = NULL;
 	tp_wma_handle wma = (tp_wma_handle) handle;
-	wmi_channel *chan = NULL;
-	wmi_key_material *key = NULL;
-	int size = 0;
 	roam_offload_synch_ind *roam_synch_ind_ptr;
+	tpSirBssDescription  bss_desc_ptr = NULL;
+	uint16_t ie_len = 0;
+	int status = -EINVAL;
 
 	WMA_LOGD("LFR3:%s", __func__);
 	if (!event) {
 		WMA_LOGE("%s: event param null", __func__);
-		return -EINVAL;
+		return status;
 	}
 
 	param_buf = (WMI_ROAM_SYNCH_EVENTID_param_tlvs *) event;
 	if (!param_buf) {
 		WMA_LOGE("%s: received null buf from target", __func__);
-		return -EINVAL;
+		return status;
 	}
 
 	synch_event = param_buf->fixed_param;
 	if (!synch_event) {
 		WMA_LOGE("%s: received null event data from target", __func__);
-		return -EINVAL;
+		return status;
 	}
 
-	if (wma->interfaces[synch_event->vdev_id].roam_synch_in_progress) {
+	if (wma_is_roam_synch_in_progress(wma, synch_event->vdev_id)) {
 		WMA_LOGE("%s: Ignoring RSI since one is already in progress",
 				__func__);
-		return -EINVAL;
+		return status;
 	}
+
 	wma->interfaces[synch_event->vdev_id].roam_synch_in_progress = true;
 	len = sizeof(roam_offload_synch_ind) +
-	      synch_event->bcn_probe_rsp_len + synch_event->reassoc_rsp_len;
+	      synch_event->bcn_probe_rsp_len + synch_event->reassoc_rsp_len +
+	      synch_event->reassoc_req_len;
 	roam_synch_ind_ptr =
 		(roam_offload_synch_ind *) cdf_mem_malloc(len);
 	if (!roam_synch_ind_ptr) {
 		WMA_LOGE("%s: failed to allocate memory for roam_synch_event",
 			 __func__);
+		CDF_ASSERT(roam_synch_ind_ptr != NULL);
 		return -ENOMEM;
 	}
+	cdf_mem_zero(roam_synch_ind_ptr, len);
+	wma_fill_roam_synch_buffer(wma, roam_synch_ind_ptr, param_buf);
 
-	/* abort existing scan if any */
-	if (wma->interfaces[synch_event->vdev_id].scan_info.scan_id != 0) {
-		tAbortScanParams abort_scan;
-		WMA_LOGD("LFR3: Aborting Scan with scan_id=%d\n",
-		wma->interfaces[synch_event->vdev_id].scan_info.scan_id);
-		abort_scan.SessionId = synch_event->vdev_id;
-		wma_stop_scan(wma, &abort_scan);
-	}
+	 /* 24 byte MAC header and 12 byte to ssid IE */
+	if (roam_synch_ind_ptr->beaconProbeRespLength >
+			(SIR_MAC_HDR_LEN_3A + SIR_MAC_B_PR_SSID_OFFSET)) {
+		ie_len = roam_synch_ind_ptr->beaconProbeRespLength -
+			(SIR_MAC_HDR_LEN_3A + SIR_MAC_B_PR_SSID_OFFSET);
+	} else {
+		WMA_LOGE("LFR3: Invalid Beacon Length");
+		goto cleanup_label;
+	}
+	bss_desc_ptr = cdf_mem_malloc(sizeof(tSirBssDescription) + ie_len);
+	roam_synch_ind_ptr->join_rsp = cdf_mem_malloc(sizeof(tSirSmeJoinRsp));
+	if ((NULL == roam_synch_ind_ptr->join_rsp) || (NULL == bss_desc_ptr)) {
+		WMA_LOGE("LFR3: mem alloc failed!");
+		CDF_ASSERT(bss_desc_ptr != NULL);
+		CDF_ASSERT(roam_synch_ind_ptr->join_rsp != NULL);
+		status =  -ENOMEM;
+		goto cleanup_label;
+	}
+	cdf_mem_zero(roam_synch_ind_ptr->join_rsp, sizeof(tSirSmeJoinRsp));
+	cdf_mem_zero(bss_desc_ptr, sizeof(tSirBssDescription) + ie_len);
+	wma->pe_roam_synch_cb((tpAniSirGlobal)wma->mac_context,
+			roam_synch_ind_ptr, bss_desc_ptr);
+	wma_roam_update_vdev(wma, roam_synch_ind_ptr);
+	wma->csr_roam_synch_cb((tpAniSirGlobal)wma->mac_context,
+		roam_synch_ind_ptr, bss_desc_ptr, ROAM_SYNCH_PROPAGATION);
+	wma_process_roam_synch_complete(wma, synch_event->vdev_id);
+cleanup_label:
+	if (roam_synch_ind_ptr->join_rsp)
+		cdf_mem_free(roam_synch_ind_ptr->join_rsp);
+	if (roam_synch_ind_ptr)
+		cdf_mem_free(roam_synch_ind_ptr);
+	if (bss_desc_ptr)
+		cdf_mem_free(bss_desc_ptr);
+	wma->interfaces[synch_event->vdev_id].roam_synch_in_progress = false;
 
-	roam_synch_ind_ptr->messageType = eWNI_SME_ROAM_OFFLOAD_SYNCH_IND;
-	roam_synch_ind_ptr->length = size;
-	roam_synch_ind_ptr->roamedVdevId = synch_event->vdev_id;
-	roam_synch_ind_ptr->authStatus = synch_event->auth_status;
-	roam_synch_ind_ptr->roamReason = synch_event->roam_reason;
-	roam_synch_ind_ptr->rssi = synch_event->rssi;
-	roam_synch_ind_ptr->isBeacon = synch_event->is_beacon;
-	WMI_MAC_ADDR_TO_CHAR_ARRAY(&synch_event->bssid,
-				   roam_synch_ind_ptr->bssId);
-	roam_synch_ind_ptr->beaconProbeRespOffset =
-		sizeof(roam_offload_synch_ind);
-	bcn_probersp_ptr =
-		(uint8_t *) roam_synch_ind_ptr +
-		roam_synch_ind_ptr->beaconProbeRespOffset;
-	roam_synch_ind_ptr->beaconProbeRespLength =
-		synch_event->bcn_probe_rsp_len;
-	cdf_mem_copy(bcn_probersp_ptr, param_buf->bcn_probe_rsp_frame,
-		     roam_synch_ind_ptr->beaconProbeRespLength);
-	roam_synch_ind_ptr->reassocRespOffset =
-		sizeof(roam_offload_synch_ind) +
-		roam_synch_ind_ptr->beaconProbeRespLength;
-	roam_synch_ind_ptr->reassocRespLength = synch_event->reassoc_rsp_len;
-	reassoc_rsp_ptr = (uint8_t *) roam_synch_ind_ptr +
-			  roam_synch_ind_ptr->reassocRespOffset;
-	cdf_mem_copy(reassoc_rsp_ptr,
-		     param_buf->reassoc_rsp_frame,
-		     roam_synch_ind_ptr->reassocRespLength);
-	chan = (wmi_channel *) param_buf->chan;
-	roam_synch_ind_ptr->chan_freq = chan->mhz;
-	key = (wmi_key_material *) param_buf->key;
-	if (key != NULL) {
-		CDF_TRACE_HEX_DUMP(CDF_MODULE_ID_WMA, CDF_TRACE_LEVEL_DEBUG,
-				   key->replay_counter, SIR_REPLAY_CTR_LEN);
-		cdf_mem_copy(roam_synch_ind_ptr->kck, key->kck,
-			     SIR_KCK_KEY_LEN);
-		cdf_mem_copy(roam_synch_ind_ptr->kek, key->kek,
-			     SIR_KEK_KEY_LEN);
-		cdf_mem_copy(roam_synch_ind_ptr->replay_ctr,
-			     key->replay_counter, SIR_REPLAY_CTR_LEN);
-	}
-	wma_send_msg(wma, WMA_ROAM_OFFLOAD_SYNCH_IND,
-			(void *) roam_synch_ind_ptr, 0);
 	return 0;
 }
 
@@ -3243,15 +3384,13 @@ static void wma_roam_ho_fail_handler(tp_wma_handle wma, uint32_t vdev_id)
  *
  * Return: none
  */
-void wma_process_roam_synch_complete(WMA_HANDLE handle,
-				     tSirSmeRoamOffloadSynchCnf *synchcnf)
+void wma_process_roam_synch_complete(WMA_HANDLE handle, uint8_t vdev_id)
 {
 	tp_wma_handle wma_handle = (tp_wma_handle) handle;
 	wmi_roam_synch_complete_fixed_param *cmd;
 	wmi_buf_t wmi_buf;
 	uint8_t *buf_ptr;
 	uint16_t len;
-	bool roam_synch_in_progress;
 	len = sizeof(wmi_roam_synch_complete_fixed_param);
 
 	if (!wma_handle || !wma_handle->wmi_handle) {
@@ -3259,15 +3398,6 @@ void wma_process_roam_synch_complete(WMA_HANDLE handle,
 			 __func__);
 		return;
 	}
-	roam_synch_in_progress =
-		wma_handle->interfaces[synchcnf->sessionId].roam_synch_in_progress;
-	if (roam_synch_in_progress == false) {
-		WMA_LOGE("%s: Dont send roam synch complete", __func__);
-		return;
-	} else {
-		wma_handle->interfaces[synchcnf->sessionId].roam_synch_in_progress =
-			false;
-	}
 	wmi_buf = wmi_buf_alloc(wma_handle->wmi_handle, len);
 	if (!wmi_buf) {
 		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
@@ -3279,7 +3409,7 @@ void wma_process_roam_synch_complete(WMA_HANDLE handle,
 		       WMITLV_TAG_STRUC_wmi_roam_synch_complete_fixed_param,
 		       WMITLV_GET_STRUCT_TLVLEN
 			       (wmi_roam_synch_complete_fixed_param));
-	cmd->vdev_id = synchcnf->sessionId;
+	cmd->vdev_id = vdev_id;
 	if (wmi_unified_cmd_send(wma_handle->wmi_handle, wmi_buf, len,
 				 WMI_ROAM_SYNCH_COMPLETE)) {
 		WMA_LOGP("%s: failed to send roam synch confirmation",
@@ -6969,3 +7099,64 @@ CDF_STATUS wma_get_scan_id(uint32_t *scan_id)
 	return CDF_STATUS_SUCCESS;
 }
 
+#ifdef FEATURE_LFR_SUBNET_DETECTION
+/**
+ * wma_set_gateway_params() - set gateway parameters
+ * @wma: WMA handle
+ * @req: gateway parameter update request structure
+ *
+ * This function reads the incoming @req and fill in the destination
+ * WMI structure and sends down the gateway configs down to the firmware
+ *
+ * Return: CDF_STATUS
+ */
+CDF_STATUS wma_set_gateway_params(tp_wma_handle wma,
+					struct gateway_param_update_req *req)
+{
+	wmi_roam_subnet_change_config_fixed_param *cmd;
+	wmi_buf_t buf;
+	int ret;
+	int len = sizeof(*cmd);
+
+	buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGP("%s: wmi_buf_alloc failed", __func__);
+		return CDF_STATUS_E_NOMEM;
+	}
+
+	cmd = (wmi_roam_subnet_change_config_fixed_param *) wmi_buf_data(buf);
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		WMITLV_TAG_STRUC_wmi_roam_subnet_change_config_fixed_param,
+		WMITLV_GET_STRUCT_TLVLEN(
+			wmi_roam_subnet_change_config_fixed_param));
+
+	cmd->vdev_id = req->session_id;
+	cdf_mem_copy(&cmd->inet_gw_ip_v4_addr, req->ipv4_addr,
+		CDF_IPV4_ADDR_SIZE);
+	cdf_mem_copy(&cmd->inet_gw_ip_v6_addr, req->ipv6_addr,
+		CDF_IPV6_ADDR_SIZE);
+	WMI_CHAR_ARRAY_TO_MAC_ADDR(req->gw_mac_addr.bytes,
+		&cmd->inet_gw_mac_addr);
+	cmd->max_retries = req->max_retries;
+	cmd->timeout = req->timeout;
+	cmd->num_skip_subnet_change_detection_bssid_list = 0;
+	cmd->flag = 0;
+	if (req->ipv4_addr_type)
+		WMI_SET_ROAM_SUBNET_CHANGE_FLAG_IP4_ENABLED(cmd->flag);
+
+	if (req->ipv6_addr_type)
+		WMI_SET_ROAM_SUBNET_CHANGE_FLAG_IP6_ENABLED(cmd->flag);
+
+	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+				WMI_ROAM_SUBNET_CHANGE_CONFIG_CMDID);
+	if (ret != EOK) {
+		WMA_LOGE("Failed to send gw config parameter to fw, ret: %d",
+			ret);
+		wmi_buf_free(buf);
+		return CDF_STATUS_E_FAILURE;
+	}
+
+	return CDF_STATUS_SUCCESS;
+}
+#endif /* FEATURE_LFR_SUBNET_DETECTION */
+
diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c
index cb1cc1ef84c3..1f91443b9164 100644
--- a/core/wma/src/wma_utils.c
+++ b/core/wma/src/wma_utils.c
@@ -74,61 +74,61 @@
 
 /* MCS Based rate table */
 /* HT MCS parameters with Nss = 1 */
-static struct index_data_rate_type supported_mcs_rate_nss1[] = {
-	/* MCS  L20   L40   S20  S40 */
-	{0, {65, 135, 72, 150} },
-	{1, {130, 270, 144, 300} },
-	{2, {195, 405, 217, 450} },
-	{3, {260, 540, 289, 600} },
-	{4, {390, 810, 433, 900} },
-	{5, {520, 1080, 578, 1200} },
-	{6, {585, 1215, 650, 1350} },
-	{7, {650, 1350, 722, 1500} }
+static struct index_data_rate_type mcs_nss1[] = {
+	/* MCS L20  S20   L40   S40 */
+	{0,  {65,  72},  {135,  150 } },
+	{1,  {130, 144}, {270,  300 } },
+	{2,  {195, 217}, {405,  450 } },
+	{3,  {260, 289}, {540,  600 } },
+	{4,  {390, 433}, {815,  900 } },
+	{5,  {520, 578}, {1080, 1200} },
+	{6,  {585, 650}, {1215, 1350} },
+	{7,  {650, 722}, {1350, 1500} }
 };
 
 /* HT MCS parameters with Nss = 2 */
-static struct index_data_rate_type supported_mcs_rate_nss2[] = {
-	/* MCS  L20    L40   S20   S40 */
-	{0, {130, 270, 144, 300} },
-	{1, {260, 540, 289, 600} },
-	{2, {390, 810, 433, 900} },
-	{3, {520, 1080, 578, 1200} },
-	{4, {780, 1620, 867, 1800} },
-	{5, {1040, 2160, 1156, 2400} },
-	{6, {1170, 2430, 1300, 2700} },
-	{7, {1300, 2700, 1444, 3000} }
+static struct index_data_rate_type mcs_nss2[] = {
+	/* MCS L20  S20    L40   S40 */
+	{0,  {130,  144},  {270,  300 } },
+	{1,  {260,  289},  {540,  600 } },
+	{2,  {390,  433},  {810,  900 } },
+	{3,  {520,  578},  {1080, 1200} },
+	{4,  {780,  867},  {1620, 1800} },
+	{5,  {1040, 1156}, {2160, 2400} },
+	{6,  {1170, 1300}, {2430, 2700} },
+	{7,  {1300, 1440}, {2700, 3000} }
 };
 
 #ifdef WLAN_FEATURE_11AC
 /* MCS Based VHT rate table */
 /* MCS parameters with Nss = 1*/
-static struct index_vht_data_rate_type supported_vht_mcs_rate_nss1[] = {
-	/* MCS  L80    S80     L40   S40    L20   S40 */
-	{0, {293, 325}, {135, 150}, {65, 72} },
-	{1, {585, 650}, {270, 300}, {130, 144} },
-	{2, {878, 975}, {405, 450}, {195, 217} },
-	{3, {1170, 1300}, {540, 600}, {260, 289} },
-	{4, {1755, 1950}, {810, 900}, {390, 433} },
-	{5, {2340, 2600}, {1080, 1200}, {520, 578} },
-	{6, {2633, 2925}, {1215, 1350}, {585, 650} },
-	{7, {2925, 3250}, {1350, 1500}, {650, 722} },
-	{8, {3510, 3900}, {1620, 1800}, {780, 867} },
-	{9, {3900, 4333}, {1800, 2000}, {780, 867} }
+static struct index_vht_data_rate_type vht_mcs_nss1[] = {
+	/* MCS L20  S20    L40   S40    L80   S80 */
+	{0,  {65,   72 }, {135,  150},  {293,  325} },
+	{1,  {130,  144}, {270,  300},  {585,  650} },
+	{2,  {195,  217}, {405,  450},  {878,  975} },
+	{3,  {260,  289}, {540,  600},  {1170, 1300} },
+	{4,  {390,  433}, {810,  900},  {1755, 1950} },
+	{5,  {520,  578}, {1080, 1200}, {2340, 2600} },
+	{6,  {585,  650}, {1215, 1350}, {2633, 2925} },
+	{7,  {650,  722}, {1350, 1500}, {2925, 3250} },
+	{8,  {780,  867}, {1620, 1800}, {3510, 3900} },
+	{9,  {865,  960}, {1800, 2000}, {3900, 4333} }
 };
 
 /*MCS parameters with Nss = 2*/
-static struct index_vht_data_rate_type supported_vht_mcs_rate_nss2[] = {
-	/* MCS  L80    S80     L40   S40    L20   S40 */
-	{0, {585, 650}, {270, 300}, {130, 144} },
-	{1, {1170, 1300}, {540, 600}, {260, 289} },
-	{2, {1755, 1950}, {810, 900}, {390, 433} },
-	{3, {2340, 2600}, {1080, 1200}, {520, 578} },
-	{4, {3510, 3900}, {1620, 1800}, {780, 867} },
-	{5, {4680, 5200}, {2160, 2400}, {1040, 1156} },
-	{6, {5265, 5850}, {2430, 2700}, {1170, 1300} },
-	{7, {5850, 6500}, {2700, 3000}, {1300, 1444} },
-	{8, {7020, 7800}, {3240, 3600}, {1560, 1733} },
-	{9, {7800, 8667}, {3600, 4000}, {1560, 1733} }
+static struct index_vht_data_rate_type vht_mcs_nss2[] = {
+	/* MCS L20  S20    L40    S40    L80    S80 */
+	{0,  {130,  144},  {270,  300},  { 585,  650} },
+	{1,  {260,  289},  {540,  600},  {1170, 1300} },
+	{2,  {390,  433},  {810,  900},  {1755, 1950} },
+	{3,  {520,  578},  {1080, 1200}, {2340, 2600} },
+	{4,  {780,  867},  {1620, 1800}, {3510, 3900} },
+	{5,  {1040, 1156}, {2160, 2400}, {4680, 5200} },
+	{6,  {1170, 1300}, {2430, 2700}, {5265, 5850} },
+	{7,  {1300, 1444}, {2700, 3000}, {5850, 6500} },
+	{8,  {1560, 1733}, {3240, 3600}, {7020, 7800} },
+	{9,  {1730, 1920}, {3600, 4000}, {7800, 8667} }
 };
 #endif /* WLAN_FEATURE_11AC */
 
@@ -160,6 +160,45 @@ void wma_swap_bytes(void *pv, uint32_t n)
 #endif /* BIG_ENDIAN_HOST */
 
 /**
+ * wma_mcs_rate_match() - find the match mcs rate
+ * @match_rate:	the rate to look up
+ * @is_sgi:	return if the SGI rate is found
+ * @nss:	the nss in use
+ * @nss1_rate:	the nss1 rate
+ * @nss1_srate:	the nss1 SGI rate
+ * @nss2_rate:	the nss2 rate
+ * @nss2_srate:	the nss2 SGI rate
+ *
+ * This is a helper function to find the match of the tx_rate
+ * in terms of the nss1/nss2 rate with non-SGI/SGI.
+ *
+ * Return: the found rate or 0 otherwise
+ */
+static inline uint16_t wma_mcs_rate_match(uint16_t match_rate, bool *is_sgi,
+					  uint8_t nss, uint16_t nss1_rate,
+					  uint16_t nss1_srate,
+					  uint16_t nss2_rate,
+					  uint16_t nss2_srate)
+{
+	WMA_LOGD("%s match_rate: %d, %d %d %d %d",
+		__func__, match_rate, nss1_rate, nss1_srate, nss2_rate,
+		nss2_srate);
+
+	if (match_rate == nss1_rate) {
+		return nss1_rate;
+	} else if (match_rate == nss1_srate) {
+		*is_sgi = true;
+		return nss1_srate;
+	} else if (nss == 2 && match_rate == nss2_rate)
+		return nss2_rate;
+	else if (nss == 2 && match_rate == nss2_srate) {
+		*is_sgi = true;
+		return nss2_srate;
+	} else
+		return 0;
+}
+
+/**
  * wma_get_mcs_idx() - get mcs index
  * @maxRate: max rate
  * @rate_flags: rate flags
@@ -171,130 +210,93 @@ void wma_swap_bytes(void *pv, uint32_t n)
 static uint8_t wma_get_mcs_idx(uint16_t maxRate, uint8_t rate_flags,
 			       uint8_t nss, uint8_t *mcsRateFlag)
 {
-	uint8_t rateFlag = 0, curIdx = 0;
-	uint16_t curRate;
-	bool found = false;
-#ifdef WLAN_FEATURE_11AC
-	struct index_vht_data_rate_type *supported_vht_mcs_rate;
-#endif /* WLAN_FEATURE_11AC */
-	struct index_data_rate_type *supported_mcs_rate;
+	uint8_t  index = 0;
+	uint16_t match_rate;
+	bool is_sgi = false;
 
-	WMA_LOGD("%s rate:%d rate_flgs:%d", __func__, maxRate, rate_flags);
-#ifdef WLAN_FEATURE_11AC
-	supported_vht_mcs_rate = (struct index_vht_data_rate_type *)
-				 ((nss == 1) ? &supported_vht_mcs_rate_nss1 :
-				  &supported_vht_mcs_rate_nss2);
-#endif /* WLAN_FEATURE_11AC */
-	supported_mcs_rate = (struct index_data_rate_type *)
-			     ((nss == 1) ? &supported_mcs_rate_nss1 : &supported_mcs_rate_nss2);
+	WMA_LOGD("%s rate:%d rate_flgs: 0x%x, nss: %d",
+		 __func__, maxRate, rate_flags, nss);
 
 	*mcsRateFlag = rate_flags;
 	*mcsRateFlag &= ~eHAL_TX_RATE_SGI;
 #ifdef WLAN_FEATURE_11AC
-	if (rate_flags &
-	    (eHAL_TX_RATE_VHT20 | eHAL_TX_RATE_VHT40 | eHAL_TX_RATE_VHT80)) {
-
+	for (index = 0; index < MAX_VHT_MCS_IDX; index++) {
 		if (rate_flags & eHAL_TX_RATE_VHT80) {
-			for (curIdx = 0; curIdx < MAX_VHT_MCS_IDX; curIdx++) {
-				rateFlag = 0;
-				if (curIdx >= 7) {
-					if (rate_flags & eHAL_TX_RATE_SGI)
-						rateFlag |= 0x1;
-				}
-
-				curRate = supported_vht_mcs_rate[curIdx].supported_VHT80_rate[rateFlag];
-				if (curRate == maxRate) {
-					found = true;
-					break;
-				}
-			}
+			/* check for vht80 nss1/2 rate set */
+			match_rate = wma_mcs_rate_match(maxRate, &is_sgi, nss,
+					vht_mcs_nss1[index].ht80_rate[0],
+					vht_mcs_nss1[index].ht80_rate[1],
+					vht_mcs_nss2[index].ht80_rate[0],
+					vht_mcs_nss2[index].ht80_rate[1]);
+			if (match_rate)
+				goto rate_found;
 		}
-
-		if ((found == false) &&
-		    ((rate_flags & eHAL_TX_RATE_VHT80) ||
-		     (rate_flags & eHAL_TX_RATE_VHT40))) {
-			for (curIdx = 0; curIdx < MAX_VHT_MCS_IDX; curIdx++) {
-				rateFlag = 0;
-				if (curIdx >= 7) {
-					if (rate_flags & eHAL_TX_RATE_SGI)
-						rateFlag |= 0x1;
-				}
-
-				curRate = supported_vht_mcs_rate[curIdx].supported_VHT40_rate[rateFlag];
-				if (curRate == maxRate) {
-					found = true;
-					*mcsRateFlag &= ~eHAL_TX_RATE_VHT80;
-					break;
-				}
+		if ((rate_flags & eHAL_TX_RATE_VHT40) |
+		    (rate_flags & eHAL_TX_RATE_VHT80)) {
+			/* check for vht40 nss1/2 rate set */
+			match_rate = wma_mcs_rate_match(maxRate, &is_sgi, nss,
+					vht_mcs_nss1[index].ht40_rate[0],
+					vht_mcs_nss1[index].ht40_rate[1],
+					vht_mcs_nss2[index].ht40_rate[0],
+					vht_mcs_nss2[index].ht40_rate[1]);
+			if (match_rate) {
+				*mcsRateFlag &= ~eHAL_TX_RATE_VHT80;
+				goto rate_found;
 			}
 		}
-
-		if ((found == false) &&
-		    ((rate_flags & eHAL_TX_RATE_VHT80) ||
-		     (rate_flags & eHAL_TX_RATE_VHT40) ||
-		     (rate_flags & eHAL_TX_RATE_VHT20))) {
-			for (curIdx = 0; curIdx < MAX_VHT_MCS_IDX; curIdx++) {
-				rateFlag = 0;
-				if (curIdx >= 7) {
-					if (rate_flags & eHAL_TX_RATE_SGI)
-						rateFlag |= 0x1;
-				}
-
-				curRate = supported_vht_mcs_rate[curIdx].supported_VHT20_rate[rateFlag];
-				if (curRate == maxRate) {
-					found = true;
-					*mcsRateFlag &=
-						~(eHAL_TX_RATE_VHT80 |
-						  eHAL_TX_RATE_VHT40);
-					break;
-				}
+		if ((rate_flags & eHAL_TX_RATE_VHT20) |
+		    (rate_flags & eHAL_TX_RATE_VHT40) |
+		    (rate_flags & eHAL_TX_RATE_VHT80)) {
+			/* check for vht20 nss1/2 rate set */
+			match_rate = wma_mcs_rate_match(maxRate, &is_sgi, nss,
+					vht_mcs_nss1[index].ht20_rate[0],
+					vht_mcs_nss1[index].ht20_rate[1],
+					vht_mcs_nss2[index].ht20_rate[0],
+					vht_mcs_nss2[index].ht20_rate[1]);
+			if (match_rate) {
+				*mcsRateFlag &= ~(eHAL_TX_RATE_VHT80 |
+						eHAL_TX_RATE_VHT40);
+				goto rate_found;
 			}
 		}
 	}
 #endif /* WLAN_FEATURE_11AC */
-	if ((found == false) &&
-	    (rate_flags & (eHAL_TX_RATE_HT40 | eHAL_TX_RATE_HT20))) {
+	for (index = 0; index < MAX_HT_MCS_IDX; index++) {
 		if (rate_flags & eHAL_TX_RATE_HT40) {
-			rateFlag = 0x1;
-
-			for (curIdx = 0; curIdx < MAX_HT_MCS_IDX; curIdx++) {
-				if (curIdx == 7) {
-					if (rate_flags & eHAL_TX_RATE_SGI)
-						rateFlag |= 0x2;
-				}
-
-				curRate = supported_mcs_rate[curIdx].supported_rate[rateFlag];
-				if (curRate == maxRate) {
-					found = true;
-					*mcsRateFlag = eHAL_TX_RATE_HT40;
-					break;
-				}
+			/* check for ht40 nss1/2 rate set */
+			match_rate = wma_mcs_rate_match(maxRate, &is_sgi, nss,
+					mcs_nss1[index].ht40_rate[0],
+					mcs_nss1[index].ht40_rate[1],
+					mcs_nss2[index].ht40_rate[0],
+					mcs_nss2[index].ht40_rate[1]);
+			if (match_rate) {
+				*mcsRateFlag = eHAL_TX_RATE_HT40;
+				goto rate_found;
 			}
 		}
-
-		if (found == false) {
-			rateFlag = 0;
-			for (curIdx = 0; curIdx < MAX_HT_MCS_IDX; curIdx++) {
-				if (curIdx == 7) {
-					if (rate_flags & eHAL_TX_RATE_SGI)
-						rateFlag |= 0x2;
-				}
-
-				curRate = supported_mcs_rate[curIdx].supported_rate[rateFlag];
-				if (curRate == maxRate) {
-					found = true;
-					*mcsRateFlag = eHAL_TX_RATE_HT20;
-					break;
-				}
+		if (rate_flags & eHAL_TX_RATE_HT20) {
+			/* check for ht20 nss1/2 rate set */
+			match_rate = wma_mcs_rate_match(maxRate, &is_sgi, nss,
+					mcs_nss1[index].ht20_rate[0],
+					mcs_nss1[index].ht20_rate[1],
+					mcs_nss2[index].ht20_rate[0],
+					mcs_nss2[index].ht20_rate[1]);
+			if (match_rate) {
+				*mcsRateFlag = eHAL_TX_RATE_HT20;
+				goto rate_found;
 			}
 		}
 	}
 
-	/*SGI rates are used by firmware only for MCS >= 7 */
-	if (found && (curIdx >= 7))
+rate_found:
+	/* set SGI flag only if this is SGI rate */
+	if (match_rate && is_sgi == true)
 		*mcsRateFlag |= eHAL_TX_RATE_SGI;
 
-	return  found ? curIdx : INVALID_MCS_IDX;
+	WMA_LOGD("%s - match_rate: %d index: %d rate_flag: 0x%x is_sgi: %d",
+		 __func__, match_rate, index, *mcsRateFlag, is_sgi);
+
+	return match_rate ? index : INVALID_MCS_IDX;
 }
 
 /**
@@ -1832,7 +1834,7 @@ int32_t wma_txrx_fw_stats_reset(tp_wma_handle wma_handle,
 	}
 	cdf_mem_zero(&req, sizeof(req));
 	req.stats_type_reset_mask = value;
-	ol_txrx_fw_stats_get(vdev, &req);
+	ol_txrx_fw_stats_get(vdev, &req, false);
 
 	return 0;
 }
@@ -1945,7 +1947,7 @@ int32_t wma_set_txrx_fw_stats_level(tp_wma_handle wma_handle,
 	}
 	req.stats_type_upload_mask = l_up_mask;
 
-	ol_txrx_fw_stats_get(vdev, &req);
+	ol_txrx_fw_stats_get(vdev, &req, true);
 
 	return 0;
 }
@@ -2548,7 +2550,7 @@ wma_process_ftm_command(tp_wma_handle wma_handle,
 	if (!msg_buffer)
 		return CDF_STATUS_E_INVAL;
 
-	if (cds_get_conparam() != CDF_FTM_MODE) {
+	if (cds_get_conparam() != CDF_GLOBAL_FTM_MODE) {
 		WMA_LOGE("FTM command issued in non-FTM mode");
 		cdf_mem_free(msg_buffer->data);
 		cdf_mem_free(msg_buffer);
@@ -2795,6 +2797,11 @@ CDF_STATUS wma_get_hw_mode_from_idx(uint32_t idx,
 		return CDF_STATUS_E_FAILURE;
 	}
 
+	if (!wma->num_dbs_hw_modes) {
+		WMA_LOGE("%s: No dbs hw modes available", __func__);
+		return CDF_STATUS_E_FAILURE;
+	}
+
 	param = wma->hw_mode.hw_mode_list[idx];
 
 	hw_mode->mac0_tx_ss = WMI_DBS_HW_MODE_MAC0_TX_STREAMS_GET(param);
diff --git a/core/wmi/wmi_unified.c b/core/wmi/wmi_unified.c
index d1980c73f567..2270e602f3d4 100644
--- a/core/wmi/wmi_unified.c
+++ b/core/wmi/wmi_unified.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -743,6 +743,11 @@ static uint8_t *get_wmi_cmd_string(WMI_CMD_ID wmi_command)
 		CASE_RETURN_STRING(WMI_WOW_HOSTWAKEUP_GPIO_PIN_PATTERN_CONFIG_CMDID);
 		CASE_RETURN_STRING(WMI_AP_PS_EGAP_PARAM_CMDID);
 		CASE_RETURN_STRING(WMI_PMF_OFFLOAD_SET_SA_QUERY_CMDID);
+		CASE_RETURN_STRING(WMI_BPF_GET_CAPABILITY_CMDID);
+		CASE_RETURN_STRING(WMI_BPF_GET_VDEV_STATS_CMDID);
+		CASE_RETURN_STRING(WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID);
+		CASE_RETURN_STRING(WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID);
+
 	}
 	return "Invalid WMI cmd";
 }
@@ -761,6 +766,30 @@ static inline void wma_log_cmd_id(WMI_CMD_ID cmd_id)
 }
 #endif
 
+/**
+ * wmi_is_runtime_pm_cmd() - check if a cmd is part of the suspend resume sequence
+ * @cmd: command to check
+ *
+ * Return: true if the command is part of the suspend resume sequence.
+ */
+bool wmi_is_runtime_pm_cmd(WMI_CMD_ID cmd_id)
+{
+	switch (cmd_id) {
+	case WMI_WOW_ENABLE_CMDID:
+	case WMI_PDEV_SUSPEND_CMDID:
+	case WMI_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID:
+	case WMI_WOW_ADD_WAKE_PATTERN_CMDID:
+	case WMI_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID:
+	case WMI_PDEV_RESUME_CMDID:
+	case WMI_WOW_DEL_WAKE_PATTERN_CMDID:
+	case WMI_D0_WOW_ENABLE_DISABLE_CMDID:
+		return true;
+
+	default:
+		return false;
+	}
+}
+
 /* WMI command API */
 int wmi_unified_cmd_send(wmi_unified_t wmi_handle, wmi_buf_t buf, int len,
 			 WMI_CMD_ID cmd_id)
@@ -768,8 +797,12 @@ int wmi_unified_cmd_send(wmi_unified_t wmi_handle, wmi_buf_t buf, int len,
 	HTC_PACKET *pkt;
 	A_STATUS status;
 	struct ol_softc *scn;
+	uint16_t htc_tag = 0;
 
-	if (cdf_atomic_read(&wmi_handle->is_target_suspended) &&
+	if (wmi_get_runtime_pm_inprogress(wmi_handle)) {
+		if (wmi_is_runtime_pm_cmd(cmd_id))
+			htc_tag = HTC_TX_PACKET_TAG_AUTO_PM;
+	} else if (cdf_atomic_read(&wmi_handle->is_target_suspended) &&
 	    ((WMI_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID != cmd_id) &&
 	     (WMI_PDEV_RESUME_CMDID != cmd_id))) {
 		pr_err("%s: Target is suspended  could not send WMI command\n",
@@ -825,7 +858,7 @@ int wmi_unified_cmd_send(wmi_unified_t wmi_handle, wmi_buf_t buf, int len,
 			       NULL,
 			       cdf_nbuf_data(buf), len + sizeof(WMI_CMD_HDR),
 	                       /* htt_host_data_dl_len(buf)+20 */
-			       wmi_handle->wmi_endpoint_id, 0 /*htc_tag */ );
+			       wmi_handle->wmi_endpoint_id, htc_tag);
 
 	SET_HTC_PACKET_NET_BUF_CONTEXT(pkt, buf);
 
@@ -1155,6 +1188,21 @@ void wmi_rx_event_work(struct work_struct *work)
 
 /* WMI Initialization functions */
 
+#ifdef FEATURE_RUNTIME_PM
+/**
+ * wmi_runtime_pm_init() - initialize runtime pm wmi variables
+ * @wmi_handle: wmi context
+ */
+void wmi_runtime_pm_init(struct wmi_unified *wmi_handle)
+{
+	cdf_atomic_init(&wmi_handle->runtime_pm_inprogress);
+}
+#else
+void wmi_runtime_pm_init(struct wmi_unified *wmi_handle)
+{
+}
+#endif
+
 void *wmi_unified_attach(ol_scn_t scn_handle,
 			 wma_process_fw_event_handler_cbk func)
 {
@@ -1171,6 +1219,7 @@ void *wmi_unified_attach(ol_scn_t scn_handle,
 	wmi_handle->scn_handle = scn_handle;
 	cdf_atomic_init(&wmi_handle->pending_cmds);
 	cdf_atomic_init(&wmi_handle->is_target_suspended);
+	wmi_runtime_pm_init(wmi_handle);
 	cdf_spinlock_init(&wmi_handle->eventq_lock);
 	cdf_nbuf_queue_init(&wmi_handle->event_queue);
 #ifdef CONFIG_CNSS
@@ -1295,7 +1344,7 @@ wmi_unified_connect_htc_service(struct wmi_unified *wmi_handle,
 		wmi_htc_tx_complete /* ar6000_tx_queue_full */;
 
 	/* connect to control service */
-	connect.ServiceID = WMI_CONTROL_SVC;
+	connect.service_id = WMI_CONTROL_SVC;
 
 	if ((status =
 		     htc_connect_service(htc_handle, &connect, &response)) != EOK) {
@@ -1330,3 +1379,14 @@ void wmi_set_target_suspend(wmi_unified_t wmi_handle, A_BOOL val)
 	cdf_atomic_set(&wmi_handle->is_target_suspended, val);
 }
 
+#ifdef FEATURE_RUNTIME_PM
+void wmi_set_runtime_pm_inprogress(wmi_unified_t wmi_handle, A_BOOL val)
+{
+	cdf_atomic_set(&wmi_handle->runtime_pm_inprogress, val);
+}
+
+inline bool wmi_get_runtime_pm_inprogress(wmi_unified_t wmi_handle)
+{
+	return cdf_atomic_read(&wmi_handle->runtime_pm_inprogress);
+}
+#endif
diff --git a/core/wmi/wmi_unified_api.h b/core/wmi/wmi_unified_api.h
index bcac971aa79e..f96c128aa19d 100644
--- a/core/wmi/wmi_unified_api.h
+++ b/core/wmi/wmi_unified_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -150,7 +150,24 @@ int wmi_get_pending_cmds(wmi_unified_t wmi_handle);
    WMI API to set target suspend state
  */
 
-void wmi_set_target_suspend(wmi_unified_t wmi_handle, A_BOOL val);
+void wmi_set_target_suspend(wmi_unified_t wmi_handle, bool val);
+
+#ifdef FEATURE_RUNTIME_PM
+void
+wmi_set_runtime_pm_inprogress(wmi_unified_t wmi_handle, bool val);
+bool wmi_get_runtime_pm_inprogress(wmi_unified_t wmi_handle);
+#else
+static inline void
+wmi_set_runtime_pm_inprogress(wmi_unified_t wmi_handle, bool val)
+{
+	return;
+}
+static inline bool wmi_get_runtime_pm_inprogress(wmi_unified_t wmi_handle)
+{
+	return false;
+}
+#endif
+
 
 /**
  * WMA Callback to process fw event.
diff --git a/core/wmi/wmi_unified_priv.h b/core/wmi/wmi_unified_priv.h
index f0f87028530b..293480dba42c 100644
--- a/core/wmi/wmi_unified_priv.h
+++ b/core/wmi/wmi_unified_priv.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -89,6 +89,11 @@ struct wmi_unified {
 #endif /*WMI_INTERFACE_EVENT_LOGGING */
 
 	cdf_atomic_t is_target_suspended;
+
+#ifdef FEATURE_RUNTIME_PM
+	cdf_atomic_t runtime_pm_inprogress;
+#endif
+
 	int (*wma_process_fw_event_handler_cbk)(struct wmi_unified *wmi_handle,
 						wmi_buf_t evt_buf);
 };
diff --git a/target/inc/dbglog_id.h b/target/inc/dbglog_id.h
index 79b56fec795a..171701a02348 100644
--- a/target/inc/dbglog_id.h
+++ b/target/inc/dbglog_id.h
@@ -624,6 +624,19 @@ extern "C" {
 #define AP_PS_DBGID_CLIENT_IN_PS_ACTIVE             28
 #define AP_PS_DBGID_CLIENT_IN_PS_NON_ACTIVE         29
 #define AP_PS_DBGID_CLIENT_IN_AWAKE                 30
+/* Enhanced Green AP DBGIDs */
+#define AP_PS_DBGID_EGAP_SET_PARAM                  31
+#define AP_PS_DBGID_EGAP_VDEV_START                 32
+#define AP_PS_DBGID_EGAP_VDEV_STOP                  33
+#define AP_PS_DBGID_EGAP_CONN_PEER                  34
+#define AP_PS_DBGID_EGAP_DELETE_PEER                35
+#define AP_PS_DBGID_EGAP_WAL_PEER_EVENT             36
+#define AP_PS_DBGID_EGAP_WAL_PDEV_EVENT             37
+#define AP_PS_DBGID_EGAP_NOTIF_STA_SLEEPING         38
+#define AP_PS_DBGID_EGAP_PROC_STA_SLEEPING          39
+#define AP_PS_DBGID_EGAP_PROC_STA_INACTIVITY        40
+#define AP_PS_DBGID_EGAP_CHANGE_CHAINMASK           41
+#define AP_PS_DBGID_EGAP_CHANGE_SM_STATE            42
 
 /* WLAN_MODULE_MGMT_TXRX Debugids*/
 #define MGMT_TXRX_DBGID_DEFINITION_START            0
diff --git a/target/inc/htc.h b/target/inc/htc.h
index 19239abdf34f..9b081bfd4753 100644
--- a/target/inc/htc.h
+++ b/target/inc/htc.h
@@ -196,7 +196,8 @@ typedef PREPACK struct {
 /* connect service
  * direction : host-to-target */
 typedef PREPACK struct {
-	A_UINT32 MessageID : 16, ServiceID : 16;    /* service ID of the service to connect to */
+	/* service ID of the service to connect to */
+	A_UINT32 MessageID:16, service_id:16;
 	A_UINT32 ConnectionFlags : 16,    /* connection flags */
 #define HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE (1 << 2)
 	/* reduce credit dribbling when
@@ -238,7 +239,8 @@ typedef PREPACK struct {
 /* connect response
  * direction : target-to-host */
 typedef PREPACK struct {
-	A_UINT32 MessageID : 16, ServiceID : 16;    /* service ID that the connection request was made */
+	/* service ID that the connection request was made */
+	A_UINT32 MessageID:16, service_id:16;
 	A_UINT32 Status : 8,      /* service connection status */
 		 EndpointID : 8, /* assigned endpoint ID */
 		 MaxMsgSize : 16; /* maximum expected message size on this endpoint */
diff --git a/target/inc/wlan_defs.h b/target/inc/wlan_defs.h
index 3588a3008ba2..8369bfb93930 100644
--- a/target/inc/wlan_defs.h
+++ b/target/inc/wlan_defs.h
@@ -192,6 +192,9 @@ enum {
 	REGDMN_MODE_11AC_VHT40_2G    = 0x000400000, /* 2Ghz, VHT40 */
 	REGDMN_MODE_11AC_VHT80_2G    = 0x000800000, /* 2Ghz, VHT80 */
 	REGDMN_MODE_11AC_VHT160      = 0x001000000, /* 5Ghz, VHT160 */
+	REGDMN_MODE_11AC_VHT40_2GPLUS  = 0x002000000, /* 2Ghz, VHT40+ */
+	REGDMN_MODE_11AC_VHT40_2GMINUS = 0x004000000, /* 2Ghz, VHT40- */
+	REGDMN_MODE_11AC_VHT80_80      = 0x008000000, /* 5GHz, VHT80+80 */
 };
 
 #define REGDMN_MODE_ALL (0xFFFFFFFF)	/* REGDMN_MODE_ALL is defined out of the enum
@@ -333,6 +336,7 @@ typedef struct {
 	A_RATE probe_rix;
 	A_UINT8 num_valid_rates;
 	A_UINT8 rtscts_tpc;
+	A_UINT8 dd_profile;
 } RC_TX_RATE_SCHEDULE;
 
 #else
@@ -407,8 +411,11 @@ typedef struct {
 	A_UINT32 size;
 } wlan_host_memory_chunk;
 
-#define NUM_UNITS_IS_NUM_VDEVS   0x1
-#define NUM_UNITS_IS_NUM_PEERS   0x2
+#define NUM_UNITS_IS_NUM_VDEVS        0x1
+#define NUM_UNITS_IS_NUM_PEERS        0x2
+#define NUM_UNITS_IS_NUM_ACTIVE_PEERS 0x4
+/* request host to allocate memory contiguously */
+#define REQ_TO_HOST_FOR_CONT_MEMORY   0x8
 
 /**
  * structure used by FW for requesting host memory
diff --git a/target/inc/wmi_services.h b/target/inc/wmi_services.h
index 6a447e17212b..8b1268c6ac2f 100644
--- a/target/inc/wmi_services.h
+++ b/target/inc/wmi_services.h
@@ -89,7 +89,7 @@ typedef enum {
 	WMI_SERVICE_BATCH_SCAN,         /*Service to support batch scan */
 	WMI_SERVICE_QPOWER,             /* QPower service */
 	WMI_SERVICE_PLMREQ,
-	WMI_SERVICE_THERMAL_MGMT,
+	WMI_SERVICE_THERMAL_MGMT,       /* thermal throttling support */
 	WMI_SERVICE_RMC,                /* RMC support */
 	WMI_SERVICE_MHF_OFFLOAD,                /* multi-hop forwarding offload */
 	WMI_SERVICE_COEX_SAR,           /* target support SAR tx limit from WMI_PDEV_PARAM_TXPOWER_LIMITxG */
@@ -131,6 +131,16 @@ typedef enum {
 	WMI_SERVICE_STA_PMF_OFFLOAD,
 	/* FW supports unified D0 and D3 wow */
 	WMI_SERVICE_UNIFIED_WOW_CAPABILITY,
+	WMI_SERVICE_ENHANCED_PROXY_STA,   /* Enhanced ProxySTA mode support */
+	WMI_SERVICE_ATF,                  /* Air Time Fairness support */
+	WMI_SERVICE_COEX_GPIO,            /* BTCOEX GPIO support */
+	WMI_SERVICE_AUX_SPECTRAL_INTF,    /* Aux Radio enhancement support for ignoring spectral scan intf from main radios */
+	WMI_SERVICE_AUX_CHAN_LOAD_INTF,   /* Aux Radio enhancement support for ignoring chan load intf from main radios*/
+	WMI_SERVICE_BSS_CHANNEL_INFO_64,  /* BSS channel info (freq, noise floor, 64-bit counters) event support */
+	WMI_SERVICE_ENTERPRISE_MESH,      /* Enterprise MESH Service Support */
+	WMI_SERVICE_RESTRT_CHNL_SUPPORT,  /* Restricted Channel Support */
+	WMI_SERVICE_BPF_OFFLOAD,          /* FW supports bpf offload */
+	WMI_SERVICE_SYNC_DELETE_CMDS,     /* FW sends response event for Peer, Vdev delete commands */
 
 	WMI_MAX_SERVICE = 128             /* max service */
 } WMI_SERVICE;
diff --git a/target/inc/wmi_tlv_defs.h b/target/inc/wmi_tlv_defs.h
index 04fb12fe0a17..d7645fa8cacf 100644
--- a/target/inc/wmi_tlv_defs.h
+++ b/target/inc/wmi_tlv_defs.h
@@ -603,6 +603,17 @@ typedef enum {
 	WMITLV_TAG_STRUC_wmi_transfer_data_to_flash_cmd_fixed_param,
 	WMITLV_TAG_STRUC_wmi_transfer_data_to_flash_complete_event_fixed_param,
 	WMITLV_TAG_STRUC_wmi_scpc_event_fixed_param,
+	WMITLV_TAG_STRUC_wmi_ap_ps_egap_info_chainmask_list,
+	WMITLV_TAG_STRUC_wmi_sta_smps_force_mode_complete_event_fixed_param,
+	WMITLV_TAG_STRUC_wmi_bpf_get_capability_cmd_fixed_param,
+	WMITLV_TAG_STRUC_wmi_bpf_capability_info_evt_fixed_param,
+	WMITLV_TAG_STRUC_wmi_bpf_get_vdev_stats_cmd_fixed_param,
+	WMITLV_TAG_STRUC_wmi_bpf_vdev_stats_info_evt_fixed_param,
+	WMITLV_TAG_STRUC_wmi_bpf_set_vdev_instructions_cmd_fixed_param,
+	WMITLV_TAG_STRUC_wmi_bpf_del_vdev_instructions_cmd_fixed_param,
+	WMITLV_TAG_STRUC_wmi_vdev_delete_resp_event_fixed_param,
+	WMITLV_TAG_STRUC_wmi_peer_delete_resp_event_fixed_param,
+
 } WMITLV_TAG_ID;
 
 /*
@@ -842,7 +853,12 @@ typedef enum {
 	OP(WMI_AP_PS_EGAP_PARAM_CMDID) \
 	OP(WMI_PMF_OFFLOAD_SET_SA_QUERY_CMDID) \
 	OP(WMI_TRANSFER_DATA_TO_FLASH_CMDID) \
-	OP(WMI_OEM_REQUEST_CMDID)
+	OP(WMI_OEM_REQUEST_CMDID) \
+	OP(WMI_BPF_GET_CAPABILITY_CMDID) \
+	OP(WMI_BPF_GET_VDEV_STATS_CMDID) \
+	OP(WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID) \
+	OP(WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID)
+
 /*
  * IMPORTANT: Please add _ALL_ WMI Events Here.
  * Otherwise, these WMI TLV Functions will be process them.
@@ -960,7 +976,13 @@ typedef enum {
 	OP(WMI_AP_PS_EGAP_INFO_EVENTID) \
 	OP(WMI_TRANSFER_DATA_TO_FLASH_COMPLETE_EVENTID) \
 	OP(WMI_OEM_RESPONSE_EVENTID) \
-	OP(WMI_PDEV_UTF_SCPC_EVENTID)
+	OP(WMI_PDEV_UTF_SCPC_EVENTID) \
+	OP(WMI_STA_SMPS_FORCE_MODE_COMPLETE_EVENTID) \
+	OP(WMI_BPF_CAPABILIY_INFO_EVENTID) \
+	OP(WMI_BPF_VDEV_STATS_INFO_EVENTID) \
+	OP(WMI_VDEV_DELETE_RESP_EVENTID) \
+	OP(WMI_PEER_DELETE_RESP_EVENTID)
+
 
 /* TLV definitions of WMI commands */
 
@@ -2224,6 +2246,27 @@ WMITLV_CREATE_PARAM_STRUC(WMI_NLO_CONFIGURE_MAWC_CMDID);
 	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_extscan_configure_mawc_cmd_fixed_param, wmi_extscan_configure_mawc_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_EXTSCAN_CONFIGURE_MAWC_CMDID);
 
+/* bpf offload capability get cmd */
+#define WMITLV_TABLE_WMI_BPF_GET_CAPABILITY_CMDID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_bpf_get_capability_cmd_fixed_param, wmi_bpf_get_capability_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_BPF_GET_CAPABILITY_CMDID);
+
+/* bpf offload get vdev status cmd */
+#define WMITLV_TABLE_WMI_BPF_GET_VDEV_STATS_CMDID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_bpf_get_vdev_stats_cmd_fixed_param, wmi_bpf_get_vdev_stats_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_BPF_GET_VDEV_STATS_CMDID);
+
+/* bpf offload set vdev instructions cmd */
+#define WMITLV_TABLE_WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_bpf_set_vdev_instructions_cmd_fixed_param, wmi_bpf_set_vdev_instructions_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, buf_inst, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID);
+
+/* bpf offload delete vdev instructions cmd */
+#define WMITLV_TABLE_WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_bpf_del_vdev_instructions_cmd_fixed_param, wmi_bpf_del_vdev_instructions_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID);
+
 /* Set rssi monitoring config Cmd */
 #define WMITLV_TABLE_WMI_RSSI_BREACH_MONITOR_CONFIG_CMDID(id, op, buf, len) \
 	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_rssi_breach_monitor_config_fixed_param, wmi_rssi_breach_monitor_config_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2508,6 +2551,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_START_RESP_EVENTID);
 	WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_stopped_event_fixed_param, wmi_vdev_stopped_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_STOPPED_EVENTID);
 
+/* VDEV delete response Event */
+#define WMITLV_TABLE_WMI_VDEV_DELETE_RESP_EVENTID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_vdev_delete_resp_event_fixed_param, wmi_vdev_delete_resp_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_DELETE_RESP_EVENTID);
+
 /* VDEV Install Key Complete Event */
 #define WMITLV_TABLE_WMI_VDEV_INSTALL_KEY_COMPLETE_EVENTID(id,op,buf,len)					    \
 	WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_install_key_complete_event_fixed_param, wmi_vdev_install_key_complete_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2564,7 +2612,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_EVENTID);
 	WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, reassoc_rsp_frame, WMITLV_SIZE_VAR) \
 	WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_channel, wmi_channel, chan, WMITLV_SIZE_FIX) \
 	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_key_material, key, WMITLV_SIZE_VAR) \
-	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, status, WMITLV_SIZE_FIX)
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, status, WMITLV_SIZE_VAR) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, reassoc_req_frame, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SYNCH_EVENTID);
 
 /* WOW Wakeup Host Event */
@@ -2907,10 +2956,15 @@ WMITLV_CREATE_PARAM_STRUC(WMI_OFFLOAD_PROB_RESP_TX_STATUS_EVENTID);
 WMITLV_CREATE_PARAM_STRUC(WMI_HOST_AUTO_SHUTDOWN_EVENTID);
 
 /* peer state Event */
-#define WMITLV_TABLE_WMI_PEER_STATE_EVENTID(id,op,buf,len)				       \
-	WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_peer_state_event_fixed_param, wmi_peer_state_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+#define WMITLV_TABLE_WMI_PEER_STATE_EVENTID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_peer_state_event_fixed_param, wmi_peer_state_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_PEER_STATE_EVENTID);
 
+/* peer delete response Event */
+#define WMITLV_TABLE_WMI_PEER_DELETE_RESP_EVENTID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_peer_delete_resp_event_fixed_param, wmi_peer_delete_resp_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PEER_DELETE_RESP_EVENTID);
+
 /* peer assoc conf Event */
 #define WMITLV_TABLE_WMI_PEER_ASSOC_CONF_EVENTID(id, op, buf, len) \
 	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_peer_assoc_conf_event_fixed_param, wmi_peer_assoc_conf_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -3021,6 +3075,20 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PACKET_FILTER_ENABLE_CMDID);
 	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_mawc_enable_sensor_event_fixed_param, wmi_mawc_enable_sensor_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_MAWC_ENABLE_SENSOR_EVENTID);
 
+/* SMPS force mode complete Event */
+#define WMITLV_TABLE_WMI_STA_SMPS_FORCE_MODE_COMPLETE_EVENTID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_sta_smps_force_mode_complete_event_fixed_param, wmi_sta_smps_force_mode_complete_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_STA_SMPS_FORCE_MODE_COMPLETE_EVENTID);
+
+/* bpf offload capability info event */
+#define WMITLV_TABLE_WMI_BPF_CAPABILIY_INFO_EVENTID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_bpf_capability_info_evt_fixed_param,  wmi_bpf_capability_info_evt_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_BPF_CAPABILIY_INFO_EVENTID);
+
+/* bpf offload vdev status info event */
+#define WMITLV_TABLE_WMI_BPF_VDEV_STATS_INFO_EVENTID(id, op, buf, len) \
+	WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_bpf_vdev_stats_info_evt_fixed_param, wmi_bpf_vdev_stats_info_evt_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_BPF_VDEV_STATS_INFO_EVENTID);
 
 #ifdef __cplusplus
 }
diff --git a/target/inc/wmi_unified.h b/target/inc/wmi_unified.h
index d7e689ddbf44..869c68f11113 100644
--- a/target/inc/wmi_unified.h
+++ b/target/inc/wmi_unified.h
@@ -231,6 +231,7 @@ typedef enum {
 	WMI_GRP_PKT_FILTER,
 	WMI_GRP_MAWC,
 	WMI_GRP_PMF_OFFLOAD,
+	WMI_GRP_BPF_OFFLOAD, /* Berkeley Packet Filter */
 } WMI_GRP_ID;
 
 #define WMI_CMD_GRP_START_ID(grp_id) (((grp_id) << 12) | 0x1)
@@ -781,8 +782,8 @@ typedef enum {
 	/*get batch scan result */
 	WMI_BATCH_SCAN_TRIGGER_RESULT_CMDID,
 	/* OEM related cmd */
-	WMI_OEM_REQ_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_OEM), /* DEPRECATED */
-	WMI_OEM_REQUEST_CMDID,
+	WMI_OEM_REQ_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_OEM),
+	WMI_OEM_REQUEST_CMDID, /* UNUSED */
 
 	/** Nan Request */
 	WMI_NAN_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_NAN),
@@ -869,6 +870,11 @@ typedef enum {
 	WMI_PMF_OFFLOAD_SET_SA_QUERY_CMDID =
 		WMI_CMD_GRP_START_ID(WMI_GRP_PMF_OFFLOAD),
 
+	/** WMI commands related to pkt filter (BPF) offload */
+	WMI_BPF_GET_CAPABILITY_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_BPF_OFFLOAD),
+	WMI_BPF_GET_VDEV_STATS_CMDID,
+	WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID,
+	WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID,
 } WMI_CMD_ID;
 
 typedef enum {
@@ -928,6 +934,10 @@ typedef enum {
 
 	/* Return the TSF timestamp of specified vdev */
 	WMI_VDEV_TSF_REPORT_EVENTID,
+
+	/* FW response to Host for vdev delete cmdid */
+	WMI_VDEV_DELETE_RESP_EVENTID,
+
 	/* peer  specific events */
 	/** FW reauet to kick out the station for reasons like inactivity,lack of response ..etc */
 	WMI_PEER_STA_KICKOUT_EVENTID =
@@ -953,6 +963,9 @@ typedef enum {
 	 */
 	WMI_PEER_ASSOC_CONF_EVENTID,
 
+	/* FW response to Host for peer delete cmdid */
+	WMI_PEER_DELETE_RESP_EVENTID,
+
 	/* beacon/mgmt specific events */
 	/** RX management frame. the entire frame is carried along with the event.  */
 	WMI_MGMT_RX_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_MGMT),
@@ -1144,6 +1157,11 @@ typedef enum {
 	/* TDLS Event */
 	WMI_TDLS_PEER_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_TDLS),
 
+	/* STA SMPS Event */
+	/* force SMPS mode */
+	WMI_STA_SMPS_FORCE_MODE_COMPLETE_EVENTID =
+					WMI_EVT_GRP_START_ID(WMI_GRP_STA_SMPS),
+
 	/*location scan event */
 	/*report the firmware's capability of batch scan */
 	WMI_BATCH_SCAN_ENABLED_EVENTID =
@@ -1196,6 +1214,10 @@ typedef enum {
 	/** Motion Aided WiFi Connectivity (MAWC) events */
 	WMI_MAWC_ENABLE_SENSOR_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_MAWC),
 
+	/** pkt filter (BPF) offload relevant events */
+	WMI_BPF_CAPABILIY_INFO_EVENTID =
+				WMI_EVT_GRP_START_ID(WMI_GRP_BPF_OFFLOAD),
+	WMI_BPF_VDEV_STATS_INFO_EVENTID,
 } WMI_EVT_ID;
 
 /* defines for OEM message sub-types */
@@ -1980,8 +2002,121 @@ typedef struct {
 	 * @brief num_ocb_schedules - The supported number of OCB schedule segments
 	 */
 	A_UINT32 num_ocb_schedules;
+	/**
+	 * @brief specific configuration from host, such as per platform configuration
+	 */
+	#define WMI_RSRC_CFG_FLAG_WOW_IGN_PCIE_RST_S 0
+	#define WMI_RSRC_CFG_FLAG_WOW_IGN_PCIE_RST_M 0x1
+
+	#define WMI_RSRC_CFG_FLAG_LTEU_SUPPORT_S 1
+	#define WMI_RSRC_CFG_FLAG_LTEU_SUPPORT_M 0x2
+
+	#define WMI_RSRC_CFG_FLAG_COEX_GPIO_SUPPORT_S 2
+	#define WMI_RSRC_CFG_FLAG_COEX_GPIO_SUPPORT_M 0x4
+
+	#define WMI_RSRC_CFG_FLAG_AUX_RADIO_SPECTRAL_INTF_S 3
+	#define WMI_RSRC_CFG_FLAG_AUX_RADIO_SPECTRAL_INTF_M 0x8
+
+	#define WMI_RSRC_CFG_FLAG_AUX_RADIO_CHAN_LOAD_INTF_S 4
+	#define WMI_RSRC_CFG_FLAG_AUX_RADIO_CHAN_LOAD_INTF_M 0x10
+
+	#define WMI_RSRC_CFG_FLAG_BSS_CHANNEL_INFO_64_S 5
+	#define WMI_RSRC_CFG_FLAG_BSS_CHANNEL_INFO_64_M 0x20
+
+	#define WMI_RSRC_CFG_FLAG_ATF_CONFIG_ENABLE_S 6
+	#define WMI_RSRC_CFG_FLAG_ATF_CONFIG_ENABLE_M 0x40
+
+	#define WMI_RSRC_CFG_FLAG_IPHR_PAD_CONFIG_ENABLE_S 7
+	#define WMI_RSRC_CFG_FLAG_IPHR_PAD_CONFIG_ENABLE_M 0x80
+
+	#define WMI_RSRC_CFG_FLAG_QWRAP_MODE_ENABLE_S 8
+	#define WMI_RSRC_CFG_FLAG_QWRAP_MODE_ENABLE_M 0x100
+
+	A_UINT32 flag1;
+
+	/** @brief smart_ant_cap - Smart Antenna capabilities information
+	* @details
+	*        1 - Smart antenna is enabled.
+	*        0 - Smart antenna is disabled.
+	* In future this can contain smart antenna specifc capabilities.
+	*/
+	A_UINT32 smart_ant_cap;
+
+	/**
+	* User can configure the buffers allocated for each AC (BE, BK, VI, VO)
+	* during init
+	*/
+	A_UINT32 BK_Minfree;
+	A_UINT32 BE_Minfree;
+	A_UINT32 VI_Minfree;
+	A_UINT32 VO_Minfree;
+
+	/**
+	* @brief alloc_frag_desc_for_data_pkt . Controls data packet fragment
+	* descriptor memory allocation.
+	*   1 - Allocate fragment descriptor memory for data packet in firmware.
+	*       If host wants to transmit data packet at its desired rate,
+	*       this field must be set.
+	*   0 - Don't allocate fragment descriptor for data packet.
+	*/
+	A_UINT32 alloc_frag_desc_for_data_pkt;
 } wmi_resource_config;
 
+#define WMI_RSRC_CFG_FLAG_SET(word32, flag, value) \
+	do { \
+		(word32) &= ~WMI_RSRC_CFG_FLAG_ ## flag ## _M; \
+		(word32) |= ((value) << WMI_RSRC_CFG_FLAG_ ## flag ## _S) & \
+		WMI_RSRC_CFG_FLAG_ ## flag ## _M; \
+	} while (0)
+#define WMI_RSRC_CFG_FLAG_GET(word32, flag) \
+		(((word32) & WMI_RSRC_CFG_FLAG_ ## flag ## _M) >> \
+		WMI_RSRC_CFG_FLAG_ ## flag ## _S)
+
+#define WMI_RSRC_CFG_FLAG_WOW_IGN_PCIE_RST_SET(word32, value) \
+		WMI_RSRC_CFG_FLAG_SET((word32), WOW_IGN_PCIE_RST, (value))
+#define WMI_RSRC_CFG_FLAG_WOW_IGN_PCIE_RST_GET(word32) \
+		WMI_RSRC_CFG_FLAG_GET((word32), WOW_IGN_PCIE_RST)
+
+#define WMI_RSRC_CFG_FLAG_LTEU_SUPPORT_SET(word32, value) \
+		WMI_RSRC_CFG_FLAG_SET((word32), LTEU_SUPPORT, (value))
+#define WMI_RSRC_CFG_FLAG_LTEU_SUPPORT_GET(word32) \
+		WMI_RSRC_CFG_FLAG_GET((word32), LTEU_SUPPORT)
+
+#define WMI_RSRC_CFG_FLAG_COEX_GPIO_SUPPORT_SET(word32, value) \
+		WMI_RSRC_CFG_FLAG_SET((word32), COEX_GPIO_SUPPORT, (value))
+#define WMI_RSRC_CFG_FLAG_COEX_GPIO_SUPPORT_GET(word32) \
+		WMI_RSRC_CFG_FLAG_GET((word32), COEX_GPIO_SUPPORT)
+
+#define WMI_RSRC_CFG_FLAG_AUX_RADIO_SPECTRAL_INTF_SET(word32, value) \
+	WMI_RSRC_CFG_FLAG_SET((word32), AUX_RADIO_SPECTRAL_INTF, (value))
+#define WMI_RSRC_CFG_FLAG_AUX_RADIO_SPECTRAL_INTF_GET(word32) \
+		WMI_RSRC_CFG_FLAG_GET((word32), AUX_RADIO_SPECTRAL_INTF)
+
+#define WMI_RSRC_CFG_FLAG_AUX_RADIO_CHAN_LOAD_INTF_SET(word32, value) \
+	WMI_RSRC_CFG_FLAG_SET((word32), AUX_RADIO_CHAN_LOAD_INTF, (value))
+#define WMI_RSRC_CFG_FLAG_AUX_RADIO_CHAN_LOAD_INTF_GET(word32) \
+		WMI_RSRC_CFG_FLAG_GET((word32), AUX_RADIO_CHAN_LOAD_INTF)
+
+#define WMI_RSRC_CFG_FLAG_BSS_CHANNEL_INFO_64_SET(word32, value) \
+		WMI_RSRC_CFG_FLAG_SET((word32), BSS_CHANNEL_INFO_64, (value))
+#define WMI_RSRC_CFG_FLAG_BSS_CHANNEL_INFO_64_GET(word32) \
+		WMI_RSRC_CFG_FLAG_GET((word32), BSS_CHANNEL_INFO_64)
+
+#define WMI_RSRC_CFG_FLAG_ATF_CONFIG_ENABLE_SET(word32, value) \
+		WMI_RSRC_CFG_FLAG_SET((word32), ATF_CONFIG_ENABLE, (value))
+#define WMI_RSRC_CFG_FLAG_ATF_CONFIG_ENABLE_GET(word32) \
+		WMI_RSRC_CFG_FLAG_GET((word32), ATF_CONFIG_ENABLE)
+
+#define WMI_RSRC_CFG_FLAG_IPHR_PAD_CONFIG_ENABLE_SET(word32, value) \
+		WMI_RSRC_CFG_FLAG_SET((word32), IPHR_PAD_CONFIG_ENABLE, (value))
+#define WMI_RSRC_CFG_FLAG_IPHR_PAD_CONFIG_ENABLE_GET(word32) \
+		WMI_RSRC_CFG_FLAG_GET((word32), IPHR_PAD_CONFIG_ENABLE)
+
+#define WMI_RSRC_CFG_FLAG_QWRAP_MODE_ENABLE_SET(word32, value) \
+		WMI_RSRC_CFG_FLAG_SET((word32), QWRAP_MODE_ENABLE, (value))
+#define WMI_RSRC_CFG_FLAG_QWRAP_MODE_ENABLE_GET(word32) \
+		WMI_RSRC_CFG_FLAG_GET((word32), QWRAP_MODE_ENABLE)
+
 typedef struct {
 	A_UINT32 tlv_header;            /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_init_cmd_fixed_param */
 
@@ -2283,7 +2418,8 @@ enum wmi_scan_event_type {
 	WMI_SCAN_EVENT_DEQUEUED = 0x10,         /* scan request got dequeued */
 	WMI_SCAN_EVENT_PREEMPTED = 0x20,                /* preempted by other high priority scan */
 	WMI_SCAN_EVENT_START_FAILED = 0x40,             /* scan start failed */
-	WMI_SCAN_EVENT_RESTARTED = 0x80,                /*scan restarted */
+	WMI_SCAN_EVENT_RESTARTED = 0x80,                /* scan restarted */
+	WMI_SCAN_EVENT_FOREIGN_CHANNEL_EXIT = 0x100,
 	WMI_SCAN_EVENT_MAX = 0x8000
 };
 
@@ -4610,6 +4746,12 @@ typedef struct {
 	A_UINT32 vdev_id;
 } wmi_vdev_stopped_event_fixed_param;
 
+typedef struct {
+	A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_delete_resp_event_fixed_param  */
+	/** unique id identifying the VDEV, generated by the caller */
+	A_UINT32 vdev_id;
+} wmi_vdev_delete_resp_event_fixed_param;
+
 /** common structure used for simple events (stopped, resume_req, standby response) */
 typedef struct {
 	A_UINT32 tlv_header;            /* TLV tag and len; tag would be equivalent to actual event  */
@@ -5077,6 +5219,9 @@ typedef enum {
  * send ehanced green ap status to host
  */
 typedef struct {
+	/* TLV tag and len; tag equals
+	 * WMITLV_TAG_STRUC_wmi_ap_ps_egap_info_chainmask_list
+	 */
 	A_UINT32 tlv_header;
 	/** The param indicates a mac under dual-mac */
 	A_UINT32 mac_id;
@@ -6846,6 +6991,7 @@ typedef enum wake_reason_e {
 	WOW_REASON_REASSOC_REQ_RECV,
 	WOW_REASON_REASSOC_RES_RECV,
 	WOW_REASON_ACTION_FRAME_RECV,
+	WOW_REASON_BPF_ALLOW,
 	WOW_REASON_DEBUG_TEST = 0xFF,
 } WOW_WAKE_REASON_TYPE;
 
@@ -7176,6 +7322,7 @@ typedef enum extend_wow_type_e {
 	EXTWOW_TYPE_APP_TYPE1,          /* extend wow type: only enable wakeup for app type1 */
 	EXTWOW_TYPE_APP_TYPE2,          /* extend wow type: only enable wakeup for app type2 */
 	EXTWOW_TYPE_APP_TYPE1_2,                /* extend wow type: enable wakeup for app type1&2 */
+	EXTWOW_TYPE_APP_PULSETEST,
 	EXTWOW_DISABLED = 255,
 } EXTWOW_TYPE;
 
@@ -7184,8 +7331,13 @@ typedef struct {
 	A_UINT32 vdev_id;
 	A_UINT32 type;
 	A_UINT32 wakeup_pin_num;
+	A_UINT32 swol_pulsetest_type;
+	A_UINT32 swol_pulsetest_application;
 } wmi_extwow_enable_cmd_fixed_param;
 
+#define SWOL_INDOOR_MAC_ADDRESS_INDEX_MAX 8
+#define SWOL_INDOOR_KEY_LEN 16
+
 typedef struct {
 	A_UINT32 tlv_header;            /* TLV tag and len; tag equals wmi_extwow_set_app_type1_params_cmd_fixed_param  */
 	A_UINT32 vdev_id;
@@ -7194,6 +7346,31 @@ typedef struct {
 	A_UINT8 passwd[16];
 	A_UINT32 ident_len;
 	A_UINT32 passwd_len;
+
+	/* indoor check parameters */
+	/* key for mac addresses specified in swol_indoor_key_mac
+	 * Big-endian hosts need to byte-swap the bytes within each 4-byte
+	 * segment of this array, so the bytes will return to their original
+	 * order when the entire WMI message contents are byte-swapped to
+	 * convert from big-endian to little-endian format.
+	 */
+	A_UINT8 swol_indoor_key[SWOL_INDOOR_MAC_ADDRESS_INDEX_MAX][SWOL_INDOOR_KEY_LEN];
+	/* key length for specified mac address index
+	 * Big-endian hosts need to byte-swap the bytes within each 4-byte
+	 * segment of this array, so the bytes will return to their original
+	 * order when the entire WMI message contents are byte-swapped to
+	 * convert from big-endian to little-endian format.
+	 */
+	A_UINT8 swol_indoor_key_len[SWOL_INDOOR_MAC_ADDRESS_INDEX_MAX];
+	/* mac address array allowed to wakeup host*/
+	wmi_mac_addr swol_indoor_key_mac[SWOL_INDOOR_MAC_ADDRESS_INDEX_MAX];
+	/* app mask for the mac addresses specified in swol_indoor_key_mac */
+	A_UINT32 swol_indoor_app_mask[SWOL_INDOOR_MAC_ADDRESS_INDEX_MAX];
+	A_UINT32 swol_indoor_waker_check; /* whether to do indoor waker check */
+	A_UINT32 swol_indoor_pw_check;    /* whether to check password */
+	A_UINT32 swol_indoor_pattern;     /* wakeup pattern */
+	A_UINT32 swol_indoor_exception;   /* wakeup when exception happens */
+	A_UINT32 swol_indoor_exception_app;
 } wmi_extwow_set_app_type1_params_cmd_fixed_param;
 
 typedef struct {
@@ -9680,6 +9857,8 @@ typedef struct {
 	A_UINT32 bcn_probe_rsp_len;
 	/** the length of reassoc rsp */
 	A_UINT32 reassoc_rsp_len;
+	/** the length of reassoc req */
+	A_UINT32 reassoc_req_len;
 	/**
 	 * TLV (tag length value ) parameters follows roam_synch_event
 	 * The TLV's are:
@@ -9689,6 +9868,7 @@ typedef struct {
 	 *     wmi_key_material key;
 	 *     A_UINT32 status; subnet changed status not being used
 	 *     currently. will pass the information using roam_status.
+	 *     A_UINT8 reassoc_req_frame[]; length identified by reassoc_req_len
 	 **/
 } wmi_roam_synch_event_fixed_param;
 
@@ -9741,6 +9921,14 @@ typedef struct {
 } wmi_stats_ext_event_fixed_param;
 
 typedef struct {
+	A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_peer_delete_resp_event_fixed_param  */
+	/** unique id identifying the VDEV, generated by the caller */
+	A_UINT32 vdev_id;
+	/** peer MAC address */
+	wmi_mac_addr peer_macaddr;
+} wmi_peer_delete_resp_event_fixed_param;
+
+typedef struct {
 	/* TLV tag and len; tag equals WMITLV_TAG_STRUC_ wmi_peer_state_event_fixed_param */
 	A_UINT32 tlv_header;
 	A_UINT32 vdev_id;               /* vdev ID */
@@ -12330,6 +12518,20 @@ typedef struct {
 } wmi_transfer_data_to_flash_complete_event_fixed_param;
 
 /*
+ * This structure is used to report SMPS force mode set complete to host.
+ */
+typedef struct {
+	/* TLV tag and len; tag equals
+	 * WMITLV_TAG_STRUC_wmi_sta_smps_force_mode_complete_event_fixed_param
+	 */
+	A_UINT32 tlv_header;
+	/* Unique id identifying the VDEV */
+	A_UINT32 vdev_id;
+	/* Return status. 0 for success, non-zero otherwise */
+	A_UINT32 status;
+} wmi_sta_smps_force_mode_complete_event_fixed_param;
+
+/*
  * This structure is used to report SCPC calibrated data to host.
  */
 typedef struct {
@@ -12349,6 +12551,57 @@ typedef struct {
 	 */
 } wmi_scpc_event_fixed_param;
 
+/* bpf interface structure */
+typedef struct wmi_bpf_get_capability_cmd_s {
+	A_UINT32 tlv_header;
+	A_UINT32 reserved;  /* reserved for future use - must be filled with 0x0 */
+} wmi_bpf_get_capability_cmd_fixed_param;
+
+typedef struct wmi_bpf_capability_info_evt_s {
+	A_UINT32 tlv_header;
+	A_UINT32 bpf_version; /* fw's implement version */
+	A_UINT32 max_bpf_filters; /* max filters that fw supports */
+	A_UINT32 max_bytes_for_bpf_inst; /* the maximum bytes that can be used as bpf instructions */
+} wmi_bpf_capability_info_evt_fixed_param;
+
+/* bit 0 of flags: report counters */
+#define WMI_BPF_GET_VDEV_STATS_FLAG_CTR_S  0
+#define WMI_BPF_GET_VDEV_STATS_FLAG_CTR_M  0x1
+typedef struct wmi_bpf_get_vdev_stats_cmd_s {
+	A_UINT32 tlv_header;
+	A_UINT32 flags;
+	A_UINT32 vdev_id;
+} wmi_bpf_get_vdev_stats_cmd_fixed_param;
+
+typedef struct wmi_bpf_vdev_stats_info_evt_s {
+	A_UINT32 tlv_header;
+	A_UINT32 vdev_id;
+	A_UINT32 num_filters;
+	A_UINT32 num_checked_pkts;
+	A_UINT32 num_dropped_pkts;
+	} wmi_bpf_vdev_stats_info_evt_fixed_param;
+
+typedef struct wmi_bpf_set_vdev_instructions_cmd_s {
+	A_UINT32 tlv_header;
+	A_UINT32 vdev_id;
+	A_UINT32 filter_id;
+	A_UINT32 bpf_version;  /* host bpf version */
+	A_UINT32 total_length;
+	A_UINT32 current_offset;
+	A_UINT32 current_length;
+	/*
+	 * The TLV follows:
+	 *    A_UINT8  buf_inst[]; //Variable length buffer for the instuctions
+	 */
+} wmi_bpf_set_vdev_instructions_cmd_fixed_param;
+
+#define BPF_FILTER_ID_ALL  0xFFFFFFFF
+typedef struct wmi_bpf_del_vdev_instructions_cmd_s {
+	A_UINT32 tlv_header;
+	A_UINT32 vdev_id;
+	A_UINT32 filter_id;  /* BPF_FILTER_ID_ALL means delete all */
+} wmi_bpf_del_vdev_instructions_cmd_fixed_param;
+
 /* ADD NEW DEFS HERE */
 
 /*****************************************************************************
diff --git a/target/inc/wmi_version.h b/target/inc/wmi_version.h
index 87ad33b1f415..875992f38794 100644
--- a/target/inc/wmi_version.h
+++ b/target/inc/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility */
-#define __WMI_REVISION_ 182
+#define __WMI_REVISION_ 192
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work
author	Prakash Dhavali <pdhavali@codeaurora.org>	2016-03-01 09:05:38 -0800
committer	Prakash Dhavali <pdhavali@codeaurora.org>	2016-03-01 09:14:32 -0800
commit	abcec8c47e8ff57bf9ef22d56be4eec50406b6b9 (patch)
tree	b6da6b07b4c4a132c83803c4d9b054fda58579af
parent	65b41c171a1bbe02fa9bcbbc92006f1a5744c043 (diff)
parent	0219ae607ac51d3009808a4709cc5c07140586ac (diff)