Merge 64089b04d0c56ba5ee25764d78c425ff948c985a on remote branch

Change-Id: I75a99ebe5230d032db1fd7e7eb19f52426738315

37 files changed, 500 insertions, 290 deletions

diff --git a/Android.mk b/Android.mk
index 75b79bcb1668..15a64ea8ace2 100644
--- a/Android.mk
+++ b/Android.mk
@@ -20,7 +20,7 @@ LOCAL_PATH := $(call my-dir)
 ifneq ($(findstring vendor,$(LOCAL_PATH)),)
 
 ifneq ($(findstring opensource,$(LOCAL_PATH)),)
-	WLAN_BLD_DIR := $(ANDROID_BUILD_TOP)/vendor/qcom/opensource/wlan
+	WLAN_BLD_DIR := vendor/qcom/opensource/wlan
 endif # opensource
 
 # DLKM_DIR was moved for JELLY_BEAN (PLATFORM_SDK 16)
diff --git a/Kbuild b/Kbuild
index 2eda172acacb..90486f343a9b 100644
--- a/Kbuild
+++ b/Kbuild
@@ -75,6 +75,10 @@ ifeq ($(KERNEL_BUILD), 0)
 	CONFIG_WLAN_DISABLE_EXPORT_SYMBOL := y
 	endif
 
+	ifeq ($(CONFIG_ARCH_SDXPOORWILLS), y)
+	CONFIG_FEATURE_SG := y
+	endif
+
 	ifeq ($(CONFIG_ARCH_MSM8917), y)
 		ifeq ($(CONFIG_ROME_IF), sdio)
 			CONFIG_WLAN_SYNC_TSF_PLUS := y
@@ -276,6 +280,13 @@ endif
 WLAN_COMMON_ROOT ?= ../qca-wifi-host-cmn
 WLAN_COMMON_INC ?= $(WLAN_ROOT)/$(WLAN_COMMON_ROOT)
 
+ifeq ($(KERNEL_BUILD), 0)
+ifneq ($(ANDROID_BUILD_TOP),)
+	override WLAN_ROOT := $(ANDROID_BUILD_TOP)/$(WLAN_ROOT)
+	override WLAN_COMMON_INC := $(ANDROID_BUILD_TOP)/$(WLAN_COMMON_INC)
+endif
+endif
+
 ifneq ($(CONFIG_MOBILE_ROUTER), y)
 CONFIG_QCOM_ESE := y
 endif
@@ -810,32 +821,40 @@ SYS_OBJS :=	$(SYS_COMMON_SRC_DIR)/wlan_qct_sys.o \
 ############ Qca-wifi-host-cmn ############
 QDF_OS_DIR :=	qdf
 QDF_OS_INC_DIR := $(QDF_OS_DIR)/inc
-QDF_OS_SRC_DIR := $(QDF_OS_DIR)/linux/src
+QDF_OS_SRC_DIR := $(QDF_OS_DIR)/src
+QDF_OS_LINUX_SRC_DIR := $(QDF_OS_DIR)/linux/src
 QDF_OBJ_DIR := $(WLAN_COMMON_ROOT)/$(QDF_OS_SRC_DIR)
+QDF_LINUX_OBJ_DIR := $(WLAN_COMMON_ROOT)/$(QDF_OS_LINUX_SRC_DIR)
 
 QDF_INC :=	-I$(WLAN_COMMON_INC)/$(QDF_OS_INC_DIR) \
-		-I$(WLAN_COMMON_INC)/$(QDF_OS_SRC_DIR)
-
-QDF_OBJS := 	$(QDF_OBJ_DIR)/qdf_defer.o \
-		$(QDF_OBJ_DIR)/qdf_event.o \
-		$(QDF_OBJ_DIR)/qdf_list.o \
-		$(QDF_OBJ_DIR)/qdf_lock.o \
-		$(QDF_OBJ_DIR)/qdf_mc_timer.o \
-		$(QDF_OBJ_DIR)/qdf_mem.o \
-		$(QDF_OBJ_DIR)/qdf_nbuf.o \
-		$(QDF_OBJ_DIR)/qdf_threads.o \
-		$(QDF_OBJ_DIR)/qdf_crypto.o \
-		$(QDF_OBJ_DIR)/qdf_trace.o \
-		$(QDF_OBJ_DIR)/qdf_idr.o
+		-I$(WLAN_COMMON_INC)/$(QDF_OS_LINUX_SRC_DIR)
+
+QDF_OBJS := 	$(QDF_LINUX_OBJ_DIR)/qdf_defer.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_event.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_list.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_lock.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_mc_timer.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_mem.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_nbuf.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_threads.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_crypto.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_trace.o \
+		$(QDF_LINUX_OBJ_DIR)/qdf_idr.o
 
 ifeq ($(CONFIG_WLAN_DEBUGFS), y)
-QDF_OBJS += $(QDF_OBJ_DIR)/qdf_debugfs.o
+QDF_OBJS += $(QDF_LINUX_OBJ_DIR)/qdf_debugfs.o
 endif
 
 QDF_CLEAN_FILES := $(QDF_OBJ_DIR)/*.o \
 		   $(QDF_OBJ_DIR)/*.o.* \
 		   $(QDF_OBJ_DIR)/.*.o.*
 
+# enable CPU hotplug support if SMP is enabled
+ifeq ($(CONFIG_SMP),y)
+	QDF_OBJS += $(QDF_OBJ_DIR)/qdf_cpuhp.o
+	QDF_OBJS += $(QDF_LINUX_OBJ_DIR)/qdf_cpuhp.o
+endif
+
 ############ CDS (Connectivity driver services) ############
 CDS_DIR :=	core/cds
 CDS_INC_DIR :=	$(CDS_DIR)/inc
@@ -1836,6 +1855,10 @@ ifeq ($(CONFIG_WLAN_DISABLE_EXPORT_SYMBOL), y)
 CDEFINES += -DWLAN_DISABLE_EXPORT_SYMBOL
 endif
 
+ifeq ($(CONFIG_FEATURE_SG), y)
+CDEFINES += -DFEATURE_SG
+endif
+
 ifeq ($(CONFIG_MPC_UT_FRAMEWORK), y)
 CDEFINES += -DMPC_UT_FRAMEWORK
 endif
diff --git a/core/cds/inc/cds_concurrency.h b/core/cds/inc/cds_concurrency.h
index 78a161ae9de9..4f98dacd2acb 100644
--- a/core/cds/inc/cds_concurrency.h
+++ b/core/cds/inc/cds_concurrency.h
@@ -1135,4 +1135,14 @@ bool cds_is_sta_sap_scc(uint8_t sap_ch);
  * Restart: None
  */
 void cds_flush_sta_ap_intf_work(hdd_context_t *hdd_ctx);
+
+/**
+ * cds_set_pcl_for_existing_combo() - Set PCL for existing connection
+ * @mode: Connection mode of type 'cds_con_mode'
+ *
+ * Set the PCL for an existing connection
+ *
+ * Return: None
+ */
+void cds_set_pcl_for_existing_combo(enum cds_con_mode mode);
 #endif /* __CDS_CONCURRENCY_H */
diff --git a/core/cds/inc/cds_regdomain.h b/core/cds/inc/cds_regdomain.h
index e0c45eaa569f..283d28b61716 100644
--- a/core/cds/inc/cds_regdomain.h
+++ b/core/cds/inc/cds_regdomain.h
@@ -303,6 +303,7 @@ enum reg_domain {
 	ETSI10_WORLD = 0x24,
 	ETSI11_WORLD = 0x26,
 	ETSI13_WORLD = 0x28,
+	ETSI14_WORLD = 0x29,
 	ETSI15_WORLD = 0x31,
 
 	APL4_WORLD = 0x42,
@@ -407,6 +408,7 @@ enum reg_domain {
 	ETSI10 = 0x0D30,
 	ETSI11 = 0x0E30,
 	ETSI13 = 0x0E39,
+	ETSI14 = 0x0E40,
 	ETSI15 = 0x0E41,
 
 	APL1 = 0x0150,
diff --git a/core/cds/inc/cds_sched.h b/core/cds/inc/cds_sched.h
index 84d7a90035c8..304dfa364a69 100644
--- a/core/cds/inc/cds_sched.h
+++ b/core/cds/inc/cds_sched.h
@@ -42,6 +42,7 @@
 #include "qdf_mc_timer.h"
 #include "cds_config.h"
 #include "cds_reg_service.h"
+#include "qdf_cpuhp.h"
 
 #define TX_POST_EVENT               0x001
 #define TX_SUSPEND_EVENT            0x002
@@ -191,8 +192,8 @@ typedef struct _cds_sched_context {
 	/* Free message queue for OL Rx processing */
 	struct list_head cds_ol_rx_pkt_freeq;
 
-	/* cpu hotplug notifier */
-	struct notifier_block *cpu_hot_plug_notifier;
+	/* The CPU hotplug event registration handle, used to unregister */
+	struct qdf_cpuhp_handler *cpuhp_event_handle;
 
 	/* affinity lock */
 	struct mutex affinity_lock;
diff --git a/core/cds/src/cds_api.c b/core/cds/src/cds_api.c
index 83abc1a53a90..20e9a9d99ccf 100644
--- a/core/cds/src/cds_api.c
+++ b/core/cds/src/cds_api.c
@@ -52,6 +52,7 @@
 #include "ol_txrx.h"
 #include "pktlog_ac.h"
 #include "wlan_hdd_ipa.h"
+#include "qdf_cpuhp.h"
 
 #ifdef ENABLE_SMMU_S1_TRANSLATION
 #include "pld_common.h"
@@ -129,6 +130,7 @@ v_CONTEXT_t cds_init(void)
 	qdf_mem_init();
 	qdf_mc_timer_manager_init();
 	qdf_event_list_init();
+	qdf_cpuhp_init();
 
 	gp_cds_context = &g_cds_context;
 
@@ -174,6 +176,7 @@ void cds_deinit(void)
 		return;
 
 	cds_recovery_work_deinit();
+	qdf_cpuhp_deinit();
 	qdf_mc_timer_manager_exit();
 	qdf_mem_exit();
 	qdf_lock_stats_deinit();
diff --git a/core/cds/src/cds_concurrency.c b/core/cds/src/cds_concurrency.c
index 3b0affd4d499..9843c1a196c4 100644
--- a/core/cds/src/cds_concurrency.c
+++ b/core/cds/src/cds_concurrency.c
@@ -3933,15 +3933,7 @@ static enum tQDF_ADAPTER_MODE cds_get_qdf_mode_from_cds(
 	return mode;
 }
 
-/**
- * cds_set_pcl_for_existing_combo() - Set PCL for existing connection
- * @mode: Connection mode of type 'cds_con_mode'
- *
- * Set the PCL for an existing connection
- *
- * Return: None
- */
-static void cds_set_pcl_for_existing_combo(enum cds_con_mode mode)
+void cds_set_pcl_for_existing_combo(enum cds_con_mode mode)
 {
 	struct cds_conc_connection_info
 				info[MAX_NUMBER_OF_CONC_CONNECTIONS] = { {0} };
@@ -4023,18 +4015,7 @@ void cds_incr_active_session(enum tQDF_ADAPTER_MODE mode,
 
 	cds_debug("No.# of active sessions for mode %d = %d",
 		mode, hdd_ctx->no_of_active_sessions[mode]);
-	/*
-	 * Get PCL logic makes use of the connection info structure.
-	 * Let us set the PCL to the FW before updating the connection
-	 * info structure about the new connection.
-	 */
-	if (mode == QDF_STA_MODE) {
-		qdf_mutex_release(&cds_ctx->qdf_conc_list_lock);
-		/* Set PCL of STA to the FW */
-		cds_pdev_set_pcl(mode);
-		qdf_mutex_acquire(&cds_ctx->qdf_conc_list_lock);
-		cds_debug("Set PCL of STA to FW");
-	}
+
 	cds_incr_connection_count(session_id);
 	if ((cds_mode_specific_connection_count(CDS_STA_MODE, NULL) > 0) &&
 		(mode != QDF_STA_MODE)) {
diff --git a/core/cds/src/cds_regdomain.c b/core/cds/src/cds_regdomain.c
index b00e3fa883c6..35cee7dd9569 100644
--- a/core/cds/src/cds_regdomain.c
+++ b/core/cds/src/cds_regdomain.c
@@ -175,6 +175,7 @@ static const struct reg_dmn_pair g_reg_dmn_pairs[] = {
 	{ETSI8_WORLD, ETSI8, WORLD, CTRY_DEFAULT},
 	{ETSI9_WORLD, ETSI9, WORLD, CTRY_DEFAULT},
 	{ETSI13_WORLD, ETSI13, WORLD, CTRY_DEFAULT},
+	{ETSI14_WORLD, ETSI14, WORLD, CTRY_DEFAULT},
 	{ETSI15_WORLD, ETSI15, WORLD, CTRY_DEFAULT},
 	{APL4_WORLD, APL4, WORLD, CTRY_DEFAULT},
 	{APL2_WORLD, APL2, WORLD, CTRY_DEFAULT},
@@ -308,7 +309,7 @@ static const struct country_code_to_reg_dmn g_all_countries[] = {
 	{CTRY_MARSHALL_ISLANDS, FCC3_FCCA, "MH", "MARSHALL ISLANDS"},
 	{CTRY_MARTINIQUE, ETSI13_WORLD, "MQ", "MARTINIQUE"},
 	{CTRY_MAURITANIA, ETSI1_WORLD, "MR", "MAURITANA"},
-	{CTRY_MAURITIUS, FCC3_WORLD, "MU", "MAURITIUS"},
+	{CTRY_MAURITIUS, ETSI13_WORLD, "MU", "MAURITIUS"},
 	{CTRY_MAYOTTE, ETSI1_WORLD, "YT", "MAYOTTE"},
 	{CTRY_MEXICO, FCC3_ETSIC, "MX", "MEXICO"},
 	{CTRY_MICRONESIA, FCC3_FCCA, "FM", "MICRONESIA"},
@@ -338,7 +339,7 @@ static const struct country_code_to_reg_dmn g_all_countries[] = {
 	{CTRY_POLAND, ETSI13_WORLD, "PL", "POLAND"},
 	{CTRY_PORTUGAL, ETSI13_WORLD, "PT", "PORTUGAL"},
 	{CTRY_PUERTO_RICO, FCC3_FCCA, "PR", "PUERTO RICO"},
-	{CTRY_QATAR, APL1_WORLD, "QA", "QATAR"},
+	{CTRY_QATAR, ETSI14_WORLD, "QA", "QATAR"},
 	{CTRY_REUNION, ETSI1_WORLD, "RE", "REUNION"},
 	{CTRY_ROMANIA, ETSI13_WORLD, "RO", "ROMANIA"},
 	{CTRY_RUSSIA, ETSI8_WORLD, "RU", "RUSSIA"},
diff --git a/core/cds/src/cds_sched.c b/core/cds/src/cds_sched.c
index 0846c27bfea0..a2c3a21b8d13 100644
--- a/core/cds/src/cds_sched.c
+++ b/core/cds/src/cds_sched.c
@@ -82,7 +82,7 @@ struct _cds_sched_context *gp_cds_sched_context;
 static int cds_mc_thread(void *Arg);
 #ifdef QCA_CONFIG_SMP
 static int cds_ol_rx_thread(void *arg);
-static unsigned long affine_cpu;
+static uint32_t affine_cpu;
 static QDF_STATUS cds_alloc_ol_rx_pkt_freeq(p_cds_sched_context pSchedContext);
 
 #define CDS_CORE_PER_CLUSTER (4)
@@ -322,61 +322,70 @@ int cds_sched_handle_throughput_req(bool high_tput_required)
 	return 0;
 }
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)
 /**
- * cds_cpu_hotplug_notify() - hot plug notify
- * @block: Pointer to block
- * @state: State
- * @hcpu: Pointer to hotplug cpu
+ * cds_cpu_hotplug_multi_cluster() - calls the multi-cluster hotplug handler,
+ *	when on a multi-cluster platform
  *
- * Return: NOTIFY_OK
+ * Return: QDF_STATUS
  */
-static int
-__cds_cpu_hotplug_notify(struct notifier_block *block,
-		       unsigned long state, void *hcpu)
+static QDF_STATUS cds_cpu_hotplug_multi_cluster(void)
 {
-	unsigned long cpu = (unsigned long)hcpu;
-	unsigned long pref_cpu = 0;
-	p_cds_sched_context pSchedContext = get_cds_sched_ctxt();
-	int i;
-	unsigned int multi_cluster;
-	unsigned int num_cpus;
-#if defined(WLAN_OPEN_SOURCE) && \
-	 (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0))
 	int cpus;
-#endif
+	unsigned int multi_cluster = 0;
 
+	for_each_online_cpu(cpus) {
+		multi_cluster = topology_physical_package_id(cpus);
+	}
 
-	if ((NULL == pSchedContext) || (NULL == pSchedContext->ol_rx_thread))
-		return NOTIFY_OK;
+	if (!multi_cluster)
+		return QDF_STATUS_E_NOSUPPORT;
 
 	if (cds_is_load_or_unload_in_progress() ||
 	    cds_is_module_stop_in_progress() || cds_is_driver_recovering())
 		return NOTIFY_OK;
 
-	num_cpus = num_possible_cpus();
-	QDF_TRACE(QDF_MODULE_ID_QDF, QDF_TRACE_LEVEL_INFO_LOW,
-		  "%s: RX CORE %d, STATE %d, NUM CPUS %d",
-		  __func__, (int)affine_cpu, (int)state, num_cpus);
-	multi_cluster = 0;
+	if (cds_sched_handle_cpu_hot_plug())
+		return QDF_STATUS_E_FAILURE;
 
-#if defined(WLAN_OPEN_SOURCE) && \
-	 (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0))
+	return QDF_STATUS_SUCCESS;
+}
+#else
+static QDF_STATUS cds_cpu_hotplug_multi_cluster(void)
+{
+	return QDF_STATUS_E_NOSUPPORT;
+}
+#endif /* KERNEL_VERSION(3, 10, 0) */
 
-	for_each_online_cpu(cpus) {
-		multi_cluster =  topology_physical_package_id(cpus);
-	}
-#endif
+/**
+ * __cds_cpu_hotplug_notify() - CPU hotplug event handler
+ * @cpu: CPU Id of the CPU generating the event
+ * @cpu_up: true if the CPU is online
+ *
+ * Return: None
+ */
+static void __cds_cpu_hotplug_notify(uint32_t cpu, bool cpu_up)
+{
+	unsigned long pref_cpu = 0;
+	p_cds_sched_context pSchedContext = get_cds_sched_ctxt();
+	int i;
 
-	if ((multi_cluster) &&
-		((CPU_ONLINE == state) || (CPU_DEAD == state))) {
-		cds_sched_handle_cpu_hot_plug();
-		return NOTIFY_OK;
-	}
+	if (!pSchedContext || !pSchedContext->ol_rx_thread)
+		return;
+
+	if (cds_is_load_or_unload_in_progress())
+		return;
 
-	switch (state) {
-	case CPU_ONLINE:
+	cds_debug("'%s' event on CPU %u (of %d); Currently affine to CPU %u",
+		  cpu_up ? "Up" : "Down", cpu, num_possible_cpus(), affine_cpu);
+
+	/* try multi-cluster scheduling first */
+	if (QDF_IS_STATUS_SUCCESS(cds_cpu_hotplug_multi_cluster()))
+		return;
+
+	if (cpu_up) {
 		if (affine_cpu != 0)
-			return NOTIFY_OK;
+			return;
 
 		for_each_online_cpu(i) {
 			if (i == 0)
@@ -384,10 +393,9 @@ __cds_cpu_hotplug_notify(struct notifier_block *block,
 			pref_cpu = i;
 			break;
 		}
-		break;
-	case CPU_DEAD:
+	} else {
 		if (cpu != affine_cpu)
-			return NOTIFY_OK;
+			return;
 
 		affine_cpu = 0;
 		for_each_online_cpu(i) {
@@ -399,45 +407,37 @@ __cds_cpu_hotplug_notify(struct notifier_block *block,
 	}
 
 	if (pref_cpu == 0)
-		return NOTIFY_OK;
+		return;
 
 	if (pSchedContext->ol_rx_thread &&
 	    !cds_set_cpus_allowed_ptr(pSchedContext->ol_rx_thread, pref_cpu))
 		affine_cpu = pref_cpu;
-
-	return NOTIFY_OK;
 }
 
 /**
- * vos_cpu_hotplug_notify - cpu core on-off notification handler wrapper
- * @block:	notifier block
- * @state:	state of core
- * @hcpu:	target cpu core
+ * cds_cpu_hotplug_notify - cpu core up/down notification handler wrapper
+ * @cpu: CPU Id of the CPU generating the event
+ * @cpu_up: true if the CPU is online
  *
- * pre-registered core status change notify callback function
- * will handle only ONLINE, OFFLINE notification
- * based on cpu architecture, rx thread affinity will be different
- * wrapper function
- *
- * Return: 0 success
- *         1 fail
+ * Return: None
  */
-static int cds_cpu_hotplug_notify(struct notifier_block *block,
-				unsigned long state, void *hcpu)
+static void cds_cpu_hotplug_notify(uint32_t cpu, bool cpu_up)
 {
-	int ret;
-
 	cds_ssr_protect(__func__);
-	ret = __cds_cpu_hotplug_notify(block, state, hcpu);
+	__cds_cpu_hotplug_notify(cpu, cpu_up);
 	cds_ssr_unprotect(__func__);
+}
 
-	return ret;
+static void cds_cpu_online_cb(void *context, uint32_t cpu)
+{
+	cds_cpu_hotplug_notify(cpu, true);
 }
 
-static struct notifier_block cds_cpu_hotplug_notifier = {
-	.notifier_call = cds_cpu_hotplug_notify,
-};
-#endif
+static void cds_cpu_before_offline_cb(void *context, uint32_t cpu)
+{
+	cds_cpu_hotplug_notify(cpu, false);
+}
+#endif /* QCA_CONFIG_SMP */
 
 /**
  * cds_sched_open() - initialize the CDS Scheduler
@@ -512,8 +512,10 @@ QDF_STATUS cds_sched_open(void *p_cds_context,
 	spin_unlock_bh(&pSchedContext->cds_ol_rx_pkt_freeq_lock);
 	if (cds_alloc_ol_rx_pkt_freeq(pSchedContext) != QDF_STATUS_SUCCESS)
 		goto pkt_freeqalloc_failure;
-	register_hotcpu_notifier(&cds_cpu_hotplug_notifier);
-	pSchedContext->cpu_hot_plug_notifier = &cds_cpu_hotplug_notifier;
+	qdf_cpuhp_register(&pSchedContext->cpuhp_event_handle,
+			   NULL,
+			   cds_cpu_online_cb,
+			   cds_cpu_before_offline_cb);
 	mutex_init(&pSchedContext->affinity_lock);
 	pSchedContext->high_throughput_required = false;
 #endif
@@ -578,7 +580,7 @@ OL_RX_THREAD_START_FAILURE:
 MC_THREAD_START_FAILURE:
 
 #ifdef QCA_CONFIG_SMP
-	unregister_hotcpu_notifier(&cds_cpu_hotplug_notifier);
+	qdf_cpuhp_unregister(&pSchedContext->cpuhp_event_handle);
 	cds_free_ol_rx_pkt_freeq(gp_cds_sched_context);
 pkt_freeqalloc_failure:
 #endif
@@ -1323,8 +1325,7 @@ QDF_STATUS cds_sched_close(void *p_cds_context)
 	gp_cds_sched_context->ol_rx_thread = NULL;
 	cds_drop_rxpkt_by_staid(gp_cds_sched_context, WLAN_MAX_STA_COUNT);
 	cds_free_ol_rx_pkt_freeq(gp_cds_sched_context);
-	unregister_hotcpu_notifier(&cds_cpu_hotplug_notifier);
-	gp_cds_sched_context->cpu_hot_plug_notifier = NULL;
+	qdf_cpuhp_unregister(&gp_cds_sched_context->cpuhp_event_handle);
 #endif
 	gp_cds_sched_context = NULL;
 	return QDF_STATUS_SUCCESS;
diff --git a/core/dp/htt/htt_tx.c b/core/dp/htt/htt_tx.c
index 343771507511..c74c3cd78b20 100644
--- a/core/dp/htt/htt_tx.c
+++ b/core/dp/htt/htt_tx.c
@@ -1726,6 +1726,7 @@ htt_tx_desc_init(htt_pdev_handle pdev,
 	bool desc_ext_required = (type != EXT_HEADER_NOT_PRESENT);
 	int channel_freq;
 	void *qdf_ctx = cds_get_context(QDF_MODULE_ID_QDF_DEVICE);
+	qdf_dma_dir_t dir;
 	QDF_STATUS status;
 
 	if (qdf_unlikely(!qdf_ctx)) {
@@ -1855,7 +1856,9 @@ htt_tx_desc_init(htt_pdev_handle pdev,
 					0);
 
 	if (QDF_NBUF_CB_PADDR(msdu) == 0) {
-		status = qdf_nbuf_map_single(qdf_ctx, msdu, QDF_DMA_TO_DEVICE);
+		dir = QDF_NBUF_CB_TX_DMA_BI_MAP(msdu) ?
+			QDF_DMA_BIDIRECTIONAL : QDF_DMA_TO_DEVICE;
+		status = qdf_nbuf_map_single(qdf_ctx, msdu, dir);
 		if (qdf_unlikely(status != QDF_STATUS_SUCCESS)) {
 			QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
 				"%s: nbuf map failed", __func__);
diff --git a/core/dp/txrx/ol_tx.c b/core/dp/txrx/ol_tx.c
index ccd87818817e..c031a7c5f93e 100644
--- a/core/dp/txrx/ol_tx.c
+++ b/core/dp/txrx/ol_tx.c
@@ -1862,6 +1862,17 @@ ol_tx_hl_base(
 			txq = ol_tx_classify(vdev, tx_desc, msdu,
 							&tx_msdu_info);
 
+			/* initialize the HW tx descriptor */
+			htt_tx_desc_init(
+					pdev->htt_pdev, tx_desc->htt_tx_desc,
+					tx_desc->htt_tx_desc_paddr,
+					ol_tx_desc_id(pdev, tx_desc),
+					msdu,
+					&tx_msdu_info.htt,
+					&tx_msdu_info.tso_info,
+					&tx_ctrl,
+					vdev->opmode == wlan_op_mode_ocb);
+
 			if ((!txq) || TX_FILTER_CHECK(&tx_msdu_info)) {
 				/*
 				 * drop this frame,
@@ -1939,16 +1950,6 @@ ol_tx_hl_base(
 						&tx_msdu_info))
 				goto MSDU_LOOP_BOTTOM;
 
-			/* initialize the HW tx descriptor */
-			htt_tx_desc_init(
-					pdev->htt_pdev, tx_desc->htt_tx_desc,
-					tx_desc->htt_tx_desc_paddr,
-					ol_tx_desc_id(pdev, tx_desc),
-					msdu,
-					&tx_msdu_info.htt,
-					&tx_msdu_info.tso_info,
-					&tx_ctrl,
-					vdev->opmode == wlan_op_mode_ocb);
 			/*
 			 * If debug display is enabled, show the meta-data
 			 * being downloaded to the target via the
diff --git a/core/dp/txrx/ol_tx_desc.c b/core/dp/txrx/ol_tx_desc.c
index 7b7bab9d20e6..08294827a010 100644
--- a/core/dp/txrx/ol_tx_desc.c
+++ b/core/dp/txrx/ol_tx_desc.c
@@ -742,9 +742,6 @@ void ol_tx_desc_frame_list_free(struct ol_txrx_pdev_t *pdev,
 			if (!qdf_nbuf_ipa_owned_get(msdu))
 				qdf_nbuf_unmap(pdev->osdev, msdu,
 					       QDF_DMA_TO_DEVICE);
-			else if (qdf_mem_smmu_s1_enabled(pdev->osdev))
-				qdf_nbuf_unmap(pdev->osdev, msdu,
-					       QDF_DMA_TO_DEVICE);
 		}
 
 		/* free the tx desc */
diff --git a/core/dp/txrx/ol_tx_queue.c b/core/dp/txrx/ol_tx_queue.c
index bc4825aba89a..becc13d4ac45 100644
--- a/core/dp/txrx/ol_tx_queue.c
+++ b/core/dp/txrx/ol_tx_queue.c
@@ -1772,10 +1772,6 @@ void ol_txrx_vdev_flush(ol_txrx_vdev_handle vdev)
 				qdf_nbuf_unmap(vdev->pdev->osdev,
 					       vdev->ll_pause.txq.head,
 					       QDF_DMA_TO_DEVICE);
-			else if (qdf_mem_smmu_s1_enabled(vdev->pdev->osdev))
-				qdf_nbuf_unmap(vdev->pdev->osdev,
-					       vdev->ll_pause.txq.head,
-					       QDF_DMA_TO_DEVICE);
 		}
 		qdf_nbuf_tx_free(vdev->ll_pause.txq.head,
 				 QDF_NBUF_PKT_ERROR);
diff --git a/core/hdd/inc/wlan_hdd_cfg.h b/core/hdd/inc/wlan_hdd_cfg.h
index 19180ba1e664..520de6a2ae9a 100644
--- a/core/hdd/inc/wlan_hdd_cfg.h
+++ b/core/hdd/inc/wlan_hdd_cfg.h
@@ -14298,7 +14298,7 @@ enum hw_filter_mode {
 #define CFG_ENABLE_FILS_DISCOVERY_SAP_NAME    "oce_enable_fils_discovery_sap"
 #define CFG_ENABLE_FILS_DISCOVERY_SAP_MIN     (0)
 #define CFG_ENABLE_FILS_DISCOVERY_SAP_MAX     (1)
-#define CFG_ENABLE_FILS_DISCOVERY_SAP_DEFAULT (0)
+#define CFG_ENABLE_FILS_DISCOVERY_SAP_DEFAULT (1)
 
 /*
  * <ini>
diff --git a/core/hdd/inc/wlan_hdd_main.h b/core/hdd/inc/wlan_hdd_main.h
index abb496e2c189..9b76ac429ecf 100644
--- a/core/hdd/inc/wlan_hdd_main.h
+++ b/core/hdd/inc/wlan_hdd_main.h
@@ -2402,6 +2402,19 @@ struct qdf_mac_addr *
 hdd_wlan_get_ibss_mac_addr_from_staid(hdd_adapter_t *pAdapter,
 				      uint8_t staIdx);
 void hdd_checkandupdate_phymode(hdd_context_t *pHddCtx);
+
+/**
+ * wlan_hdd_validate_mac_address() - Function to validate mac address
+ * @mac_addr: input mac address
+ *
+ * Return QDF_STATUS
+ */
+#define wlan_hdd_validate_mac_address(mac_addr) \
+	__wlan_hdd_validate_mac_address(mac_addr, __func__)
+
+QDF_STATUS __wlan_hdd_validate_mac_address(struct qdf_mac_addr *mac_addr,
+					   const char *func);
+
 #ifdef MSM_PLATFORM
 /**
  * hdd_bus_bw_compute_timer_start() - start the bandwidth timer
@@ -2700,6 +2713,28 @@ static inline int hdd_process_pktlog_command(hdd_context_t *hdd_ctx,
 }
 #endif /* REMOVE_PKT_LOG */
 
+#ifdef FEATURE_SG
+/**
+ * hdd_set_sg_flags() - enable SG flag in the network device
+ * @hdd_ctx: HDD context
+ * @wlan_dev: network device structure
+ *
+ * This function enables the SG feature flag in the
+ * given network device.
+ *
+ * Return: none
+ */
+static inline void hdd_set_sg_flags(hdd_context_t *hdd_ctx,
+	 struct net_device *wlan_dev)
+{
+	hdd_debug("SG Enabled");
+	wlan_dev->features |= NETIF_F_SG;
+}
+#else
+static inline void hdd_set_sg_flags(hdd_context_t *hdd_ctx,
+	 struct net_device *wlan_dev){}
+#endif
+
 #ifdef FEATURE_TSO
 /**
  * hdd_set_tso_flags() - enable TSO flags in the network device
@@ -2730,8 +2765,7 @@ static inline void hdd_set_tso_flags(hdd_context_t *hdd_ctx,
 static inline void hdd_set_tso_flags(hdd_context_t *hdd_ctx,
 	 struct net_device *wlan_dev)
 {
-	hdd_debug("SG Enabled");
-	wlan_dev->features |= NETIF_F_SG;
+	hdd_set_sg_flags(hdd_ctx, wlan_dev);
 }
 #endif /* FEATURE_TSO */
 
diff --git a/core/hdd/src/wlan_hdd_cfg.c b/core/hdd/src/wlan_hdd_cfg.c
index 5937c0480acb..d2ebcaf18a61 100644
--- a/core/hdd/src/wlan_hdd_cfg.c
+++ b/core/hdd/src/wlan_hdd_cfg.c
@@ -6007,12 +6007,13 @@ static int parse_hex_digit(char c)
  *
  * Return: None
  */
-static void update_mac_from_string(hdd_context_t *pHddCtx,
-				   tCfgIniEntry *macTable, int num)
+static QDF_STATUS update_mac_from_string(hdd_context_t *pHddCtx,
+					 tCfgIniEntry *macTable, int num)
 {
 	int i = 0, j = 0, res = 0;
 	char *candidate = NULL;
 	struct qdf_mac_addr macaddr[QDF_MAX_CONCURRENCY_PERSONA];
+	QDF_STATUS status = QDF_STATUS_SUCCESS;
 
 	memset(macaddr, 0, sizeof(macaddr));
 
@@ -6030,8 +6031,12 @@ static void update_mac_from_string(hdd_context_t *pHddCtx,
 				     provisioned_mac_addr[i].bytes[0],
 				     (uint8_t *) &macaddr[i].bytes[0],
 				     QDF_MAC_ADDR_SIZE);
+		} else {
+			status = QDF_STATUS_E_FAILURE;
+			break;
 		}
 	}
+	return status;
 }
 
 /**
@@ -7859,7 +7864,7 @@ QDF_STATUS hdd_update_mac_config(hdd_context_t *pHddCtx)
 		buffer = line;
 	}
 
-	if (i <= QDF_MAX_CONCURRENCY_PERSONA) {
+	if (i != 0 && i <= QDF_MAX_CONCURRENCY_PERSONA) {
 		hdd_debug("%d Mac addresses provided", i);
 	} else {
 		hdd_err("invalid number of Mac address provided, nMac = %d", i);
@@ -7867,7 +7872,11 @@ QDF_STATUS hdd_update_mac_config(hdd_context_t *pHddCtx)
 		goto config_exit;
 	}
 
-	update_mac_from_string(pHddCtx, &macTable[0], i);
+	qdf_status = update_mac_from_string(pHddCtx, &macTable[0], i);
+	if (QDF_IS_STATUS_ERROR(qdf_status)) {
+		hdd_err("Invalid MAC addresses provided");
+		goto config_exit;
+	}
 	pHddCtx->num_provisioned_addr = i;
 	hdd_debug("Populating remaining %d Mac addreses",
 		   max_mac_addr - i);
diff --git a/core/hdd/src/wlan_hdd_ipa.c b/core/hdd/src/wlan_hdd_ipa.c
index e6ae0ac7a4e4..1038de15c4e0 100644
--- a/core/hdd/src/wlan_hdd_ipa.c
+++ b/core/hdd/src/wlan_hdd_ipa.c
@@ -503,7 +503,6 @@ struct hdd_ipa_priv {
 	struct completion ipa_resource_comp;
 
 	uint32_t wdi_version;
-	bool is_smmu_enabled;	/* IPA caps returned from ipa_wdi_init */
 };
 
 #define HDD_IPA_WLAN_FRAG_HEADER        sizeof(struct frag_header)
@@ -871,17 +870,6 @@ static inline bool hdd_ipa_is_ipv6_enabled(hdd_context_t *hdd_ctx)
 }
 
 /**
- * hdd_ipa_is_rm_enabled() - Is IPA resource manager enabled?
- * @hdd_ipa: Global HDD IPA context
- *
- * Return: true if resource manager is enabled, otherwise false
- */
-static inline bool hdd_ipa_is_rm_enabled(hdd_context_t *hdd_ctx)
-{
-	return HDD_IPA_IS_CONFIG_ENABLED(hdd_ctx, HDD_IPA_RM_ENABLE_MASK);
-}
-
-/**
  * hdd_ipa_is_rt_debugging_enabled() - Is IPA real-time debug enabled?
  * @hdd_ipa: Global HDD IPA context
  *
@@ -1057,6 +1045,21 @@ static void hdd_ipa_wdi_init_metering(struct hdd_ipa_priv *ipa_ctxt, void *in)
 #ifdef CONFIG_IPA_WDI_UNIFIED_API
 
 /**
+ * hdd_ipa_is_rm_enabled() - Is IPA resource manager enabled?
+ * @hdd_ipa: Global HDD IPA context
+ *
+ * IPA RM is deprecated and IPA PM is involved. WLAN driver
+ * has no control over IPA PM and thus we could regard IPA
+ * RM as always enabled for power efficiency.
+ *
+ * Return: true
+ */
+static inline bool hdd_ipa_is_rm_enabled(hdd_context_t *hdd_ctx)
+{
+	return true;
+}
+
+/**
  * hdd_ipa_is_clk_scaling_enabled() - Is IPA clock scaling enabled?
  * @hdd_ipa: Global HDD IPA context
  *
@@ -1083,12 +1086,6 @@ static inline void hdd_ipa_wdi_get_wdi_version(struct hdd_ipa_priv *hdd_ipa)
 }
 #endif
 
-static bool hdd_ipa_wdi_is_smmu_enabled(struct hdd_ipa_priv *hdd_ipa,
-		qdf_device_t osdev)
-{
-	return hdd_ipa->is_smmu_enabled && qdf_mem_smmu_s1_enabled(osdev);
-}
-
 #ifdef QCA_LL_TX_FLOW_CONTROL_V2
 static bool hdd_ipa_wdi_is_mcc_mode_enabled(struct hdd_ipa_priv *hdd_ipa)
 {
@@ -1137,9 +1134,6 @@ static int hdd_ipa_wdi_init(struct hdd_ipa_priv *hdd_ipa)
 	if (out.is_uC_ready) {
 		HDD_IPA_LOG(QDF_TRACE_LEVEL_DEBUG, "IPA uC READY");
 		hdd_ipa->uc_loaded = true;
-		hdd_ipa->is_smmu_enabled = out.is_smmu_enabled;
-		HDD_IPA_LOG(QDF_TRACE_LEVEL_DEBUG, "is_smmu_enabled=%d",
-				hdd_ipa->is_smmu_enabled);
 	} else {
 		ret = -EACCES;
 		HDD_IPA_LOG(QDF_TRACE_LEVEL_ERROR,
@@ -1200,7 +1194,7 @@ static int hdd_ipa_wdi_conn_pipes(struct hdd_ipa_priv *hdd_ipa,
 		in->num_sys_pipe_needed = 0;
 	}
 
-	if (hdd_ipa_wdi_is_smmu_enabled(hdd_ipa, osdev))
+	if (qdf_mem_smmu_s1_enabled(osdev))
 		in->is_smmu_enabled = true;
 	else
 		in->is_smmu_enabled = false;
@@ -1597,6 +1591,17 @@ int hdd_ipa_uc_smmu_map(bool map, uint32_t num_buf, qdf_mem_info_t *buf_arr)
 #else /* CONFIG_IPA_WDI_UNIFIED_API */
 
 /**
+ * hdd_ipa_is_rm_enabled() - Is IPA resource manager enabled?
+ * @hdd_ipa: Global HDD IPA context
+ *
+ * Return: true if resource manager is enabled, otherwise false
+ */
+static inline bool hdd_ipa_is_rm_enabled(hdd_context_t *hdd_ctx)
+{
+	return HDD_IPA_IS_CONFIG_ENABLED(hdd_ctx, HDD_IPA_RM_ENABLE_MASK);
+}
+
+/**
  * hdd_ipa_is_clk_scaling_enabled() - Is IPA clock scaling enabled?
  * @hdd_ipa: Global HDD IPA context
  *
@@ -1613,12 +1618,6 @@ static inline void hdd_ipa_wdi_get_wdi_version(struct hdd_ipa_priv *hdd_ipa)
 {
 }
 
-static int hdd_ipa_wdi_is_smmu_enabled(struct hdd_ipa_priv *hdd_ipa,
-		qdf_device_t osdev)
-{
-	return qdf_mem_smmu_s1_enabled(osdev);
-}
-
 #ifdef FEATURE_METERING
 static void hdd_ipa_wdi_init_metering(struct hdd_ipa_priv *ipa_ctxt, void *in)
 {
@@ -1709,7 +1708,7 @@ static int hdd_ipa_wdi_conn_pipes(struct hdd_ipa_priv *hdd_ipa,
 		pipe_in.sys.keep_ipa_awake = true;
 	}
 
-	pipe_in.smmu_enabled = hdd_ipa_wdi_is_smmu_enabled(hdd_ipa, osdev);
+	pipe_in.smmu_enabled = qdf_mem_smmu_s1_enabled(osdev);
 	if (pipe_in.smmu_enabled) {
 		qdf_mem_copy(&pipe_in.u.dl_smmu.comp_ring,
 			     &ipa_res->tx_comp_ring->sgtable,
@@ -1798,7 +1797,7 @@ static int hdd_ipa_wdi_conn_pipes(struct hdd_ipa_priv *hdd_ipa,
 		pipe_in.sys.keep_ipa_awake = true;
 	}
 
-	pipe_in.smmu_enabled = hdd_ipa_wdi_is_smmu_enabled(hdd_ipa, osdev);
+	pipe_in.smmu_enabled = qdf_mem_smmu_s1_enabled(osdev);
 	if (pipe_in.smmu_enabled) {
 		qdf_mem_copy(&pipe_in.u.ul_smmu.rdy_ring,
 			     &ipa_res->rx_rdy_ring->sgtable,
@@ -4870,7 +4869,7 @@ QDF_STATUS hdd_ipa_uc_ol_init(hdd_context_t *hdd_ctx)
 				IPA_CLIENT_WLAN1_PROD);
 	}
 
-	if (hdd_ipa_wdi_is_smmu_enabled(ipa_ctxt, osdev)) {
+	if (qdf_mem_smmu_s1_enabled(osdev)) {
 		pld_smmu_map(osdev->dev,
 				ipa_ctxt->tx_comp_doorbell_dmaaddr,
 				&tx_comp_db_dmaaddr,
@@ -5915,12 +5914,26 @@ void hdd_ipa_nbuf_cb(qdf_nbuf_t skb)
 	struct ipa_rx_data *ipa_tx_desc;
 	struct hdd_ipa_tx_desc *tx_desc;
 	uint16_t id;
+	qdf_device_t osdev;
 
 	if (!qdf_nbuf_ipa_owned_get(skb)) {
 		dev_kfree_skb_any(skb);
 		return;
 	}
 
+	osdev = cds_get_context(QDF_MODULE_ID_QDF_DEVICE);
+	if (osdev && qdf_mem_smmu_s1_enabled(osdev)) {
+		if (hdd_ipa_uc_sta_is_enabled(hdd_ipa->hdd_ctx)) {
+			qdf_dma_addr_t paddr = QDF_NBUF_CB_PADDR(skb);
+			qdf_nbuf_mapped_paddr_set(skb,
+						  paddr -
+						  HDD_IPA_WLAN_FRAG_HEADER -
+						  HDD_IPA_WLAN_IPA_HEADER);
+		}
+
+		qdf_nbuf_unmap(osdev, skb, QDF_DMA_TO_DEVICE);
+	}
+
 	/* Get Tx desc pointer from SKB CB */
 	id = QDF_NBUF_CB_TX_IPA_PRIV(skb);
 	tx_desc = hdd_ipa->tx_desc_list + id;
@@ -6008,7 +6021,7 @@ static void hdd_ipa_send_pkt_to_tl(
 	/* Store IPA Tx buffer ownership into SKB CB */
 	qdf_nbuf_ipa_owned_set(skb);
 
-	if (hdd_ipa_wdi_is_smmu_enabled(hdd_ipa, osdev)) {
+	if (qdf_mem_smmu_s1_enabled(osdev)) {
 		status = qdf_nbuf_map(osdev, skb, QDF_DMA_TO_DEVICE);
 		if (QDF_IS_STATUS_SUCCESS(status)) {
 			paddr = qdf_nbuf_get_frag_paddr(skb, 0);
@@ -6050,6 +6063,13 @@ static void hdd_ipa_send_pkt_to_tl(
 	} else {
 		hdd_ipa->stats.num_tx_desc_error++;
 		qdf_spin_unlock_bh(&hdd_ipa->q_lock);
+
+		if (qdf_mem_smmu_s1_enabled(osdev)) {
+			if (hdd_ipa_uc_sta_is_enabled(hdd_ipa->hdd_ctx))
+				qdf_nbuf_mapped_paddr_set(skb, paddr);
+			qdf_nbuf_unmap(osdev, skb, QDF_DMA_TO_DEVICE);
+		}
+
 		ipa_free_skb(ipa_tx_desc);
 		hdd_ipa_wdi_rm_try_release(hdd_ipa);
 		return;
diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c
index 63957aa89356..d2fe9b849275 100644
--- a/core/hdd/src/wlan_hdd_main.c
+++ b/core/hdd/src/wlan_hdd_main.c
@@ -807,6 +807,32 @@ int hdd_validate_adapter(hdd_adapter_t *adapter)
 	return 0;
 }
 
+QDF_STATUS __wlan_hdd_validate_mac_address(struct qdf_mac_addr *mac_addr,
+					   const char *func)
+{
+	if (!mac_addr) {
+		hdd_err("Received NULL mac address (via %s)", func);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	if (qdf_is_macaddr_zero(mac_addr)) {
+		hdd_err("MAC is all zero (via %s)", func);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	if (qdf_is_macaddr_broadcast(mac_addr)) {
+		hdd_err("MAC is Broadcast (via %s)", func);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	if (ETHER_IS_MULTICAST(mac_addr->bytes)) {
+		hdd_err("MAC is Multicast (via %s)", func);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
+
 /**
  * wlan_hdd_modules_are_enabled() - Check modules status
  * @hdd_ctx: HDD context pointer
@@ -2330,12 +2356,14 @@ int hdd_wlan_start_modules(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 		hif_ctx = cds_get_context(QDF_MODULE_ID_HIF);
 		if (!hif_ctx) {
 			hdd_err("hif context is null!!");
+			ret = -EINVAL;
 			goto power_down;
 		}
 
 		status = ol_cds_init(qdf_dev, hif_ctx);
 		if (status != QDF_STATUS_SUCCESS) {
 			hdd_err("No Memory to Create BMI Context :%d", status);
+			ret = qdf_status_to_os_return(status);
 			goto hif_close;
 		}
 
@@ -2357,6 +2385,7 @@ int hdd_wlan_start_modules(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 		hdd_ctx->hHal = cds_get_context(QDF_MODULE_ID_SME);
 		if (NULL == hdd_ctx->hHal) {
 			hdd_err("HAL context is null");
+			ret = -EINVAL;
 			goto close;
 		}
 
@@ -2393,6 +2422,7 @@ int hdd_wlan_start_modules(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 		if (reinit) {
 			if (hdd_ipa_uc_ssr_reinit(hdd_ctx)) {
 				hdd_err("HDD IPA UC reinit failed");
+				ret = -EINVAL;
 				goto post_disable;
 			}
 		}
@@ -2412,6 +2442,7 @@ int hdd_wlan_start_modules(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 
 		if (hdd_configure_cds(hdd_ctx, adapter)) {
 			hdd_err("Failed to Enable cds modules");
+			ret = -EINVAL;
 			goto post_disable;
 		}
 
@@ -2423,6 +2454,7 @@ int hdd_wlan_start_modules(hdd_context_t *hdd_ctx, hdd_adapter_t *adapter,
 	default:
 		hdd_err("WLAN start invoked in wrong state! :%d\n",
 				hdd_ctx->driver_status);
+		ret = -EINVAL;
 		goto release_lock;
 	}
 	hdd_ctx->start_modules_in_progress = false;
@@ -2851,20 +2883,10 @@ static int __hdd_set_mac_address(struct net_device *dev, void *addr)
 		return -EINVAL;
 	}
 
-	if (qdf_is_macaddr_zero(&mac_addr)) {
-		hdd_err("MAC is all zero");
-		return -EINVAL;
-	}
-
-	if (qdf_is_macaddr_broadcast(&mac_addr)) {
-		hdd_err("MAC is Broadcast");
+	qdf_ret_status = wlan_hdd_validate_mac_address(&mac_addr);
+	if (QDF_IS_STATUS_ERROR(qdf_ret_status))
 		return -EINVAL;
-	}
 
-	if (ETHER_IS_MULTICAST(psta_mac_addr->sa_data)) {
-		hdd_err("MAC is Multicast");
-		return -EINVAL;
-	}
 	hdd_info("Changing MAC to " MAC_ADDRESS_STR " of the interface %s ",
 		 MAC_ADDR_ARRAY(mac_addr.bytes), dev->name);
 
@@ -4399,11 +4421,13 @@ hdd_adapter_t *hdd_open_adapter(hdd_context_t *hdd_ctx, uint8_t session_type,
 		return NULL;
 	}
 
-	if (macAddr == NULL) {
+	status = wlan_hdd_validate_mac_address((struct qdf_mac_addr *)macAddr);
+	if (QDF_IS_STATUS_ERROR(status)) {
 		/* Not received valid macAddr */
 		hdd_err("Unable to add virtual intf: Not able to get valid mac address");
 		return NULL;
 	}
+
 	status = hdd_check_for_existing_macaddr(hdd_ctx, macAddr);
 	if (QDF_STATUS_E_FAILURE == status) {
 		hdd_err("Duplicate MAC addr: " MAC_ADDRESS_STR
diff --git a/core/hdd/src/wlan_hdd_power.c b/core/hdd/src/wlan_hdd_power.c
index afe9fe350f3d..a5e65d914813 100644
--- a/core/hdd/src/wlan_hdd_power.c
+++ b/core/hdd/src/wlan_hdd_power.c
@@ -2094,6 +2094,9 @@ next_adapter:
 	while (pAdapterNode && QDF_IS_STATUS_SUCCESS(status)) {
 		pAdapter = pAdapterNode->pAdapter;
 
+		if (pAdapter->sessionId >= MAX_NUMBER_OF_ADAPTERS)
+			continue;
+
 		sme_ps_timer_flush_sync(pHddCtx->hHal, pAdapter->sessionId);
 
 		status = hdd_get_next_adapter(pHddCtx, pAdapterNode,
diff --git a/core/hdd/src/wlan_hdd_tdls.c b/core/hdd/src/wlan_hdd_tdls.c
index a49ecdc68d15..0011b3b461db 100644
--- a/core/hdd/src/wlan_hdd_tdls.c
+++ b/core/hdd/src/wlan_hdd_tdls.c
@@ -700,6 +700,7 @@ void hdd_tdls_context_init(hdd_context_t *hdd_ctx, bool ssr)
 	hdd_ctx->set_state_info.vdev_id = 0;
 	hdd_ctx->tdls_nss_teardown_complete = false;
 	hdd_ctx->tdls_nss_transition_mode = TDLS_NSS_TRANSITION_UNKNOWN;
+	hdd_ctx->enable_tdls_in_fw = true;
 
 	if (false == hdd_ctx->config->fEnableTDLSImplicitTrigger) {
 		hdd_ctx->tdls_mode = eTDLS_SUPPORT_EXPLICIT_TRIGGER_ONLY;
diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index 5cbb071906f8..b5dab63ed546 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -32,9 +32,9 @@
 #define QWLAN_VERSION_MAJOR            5
 #define QWLAN_VERSION_MINOR            1
 #define QWLAN_VERSION_PATCH            1
-#define QWLAN_VERSION_EXTRA            "W"
-#define QWLAN_VERSION_BUILD            67
+#define QWLAN_VERSION_EXTRA            "Q"
+#define QWLAN_VERSION_BUILD            68
 
-#define QWLAN_VERSIONSTR               "5.1.1.67W"
+#define QWLAN_VERSIONSTR               "5.1.1.68Q"
 
 #endif /* QWLAN_VERSION_H */
diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h
index 6d29ed76f973..c4795c1f745f 100644
--- a/core/mac/inc/sir_api.h
+++ b/core/mac/inc/sir_api.h
@@ -8536,4 +8536,14 @@ struct sir_sae_msg {
 	uint8_t sae_status;
 };
 
+/**
+ * struct set_pcl_req - Request message to set the PCL
+ * @chan_weights: PCL channel weights
+ * @band: Supported band
+ */
+struct set_pcl_req {
+	struct wmi_pcl_chan_weights chan_weights;
+	tSirRFBand band;
+};
+
 #endif /* __SIR_API_H */
diff --git a/core/mac/src/pe/lim/lim_assoc_utils.c b/core/mac/src/pe/lim/lim_assoc_utils.c
index 3df193015967..027fe51b0fb6 100644
--- a/core/mac/src/pe/lim/lim_assoc_utils.c
+++ b/core/mac/src/pe/lim/lim_assoc_utils.c
@@ -3768,34 +3768,23 @@ tSirRetStatus lim_sta_send_add_bss(tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
 				sta_context->enable_su_tx_bformer = 1;
 		}
 
-		if ((pAssocRsp->HTCaps.supportedChannelWidthSet) &&
-				(chanWidthSupp)) {
-			pAddBssParams->staContext.ch_width = (uint8_t)
-				pAssocRsp->HTInfo.recommendedTxWidthSet;
-			if (pAssocRsp->VHTCaps.present)
-				vht_oper = &pAssocRsp->VHTOperation;
-			else if (pAssocRsp->vendor_vht_ie.VHTCaps.present) {
-				vht_oper = &pAssocRsp->
-						vendor_vht_ie.VHTOperation;
-				pe_debug("VHT Op IE is in vendor Specfic IE");
-			}
-			/*
-			 * in limExtractApCapability function intersection of FW
-			 * advertised channel width and AP advertised channel
-			 * width has been taken into account for calculating
-			 * psessionEntry->ch_width
-			 */
+		chanWidthSupp = lim_get_ht_capability(pMac,
+					eHT_SUPPORTED_CHANNEL_WIDTH_SET,
+					psessionEntry);
+
+		/*
+		 * in limExtractApCapability function intersection of FW
+		 * advertised channel width and AP advertised channel
+		 * width has been taken into account for calculating
+		 * psessionEntry->ch_width
+		 */
+		if (chanWidthSupp &&
+		    ((pAssocRsp->HTCaps.supportedChannelWidthSet) ||
+		    (pBeaconStruct->HTCaps.supportedChannelWidthSet))) {
 			pAddBssParams->staContext.ch_width =
 					psessionEntry->ch_width;
-
-			pe_debug("StaCtx: vhtCap %d ChBW %d TxBF %d",
-					pAddBssParams->staContext.vhtCapable,
-					pAddBssParams->staContext.ch_width,
-					sta_context->vhtTxBFCapable);
-			pe_debug("StaContext su_tx_bfer %d",
-					sta_context->enable_su_tx_bformer);
 		} else {
-			sta_context->ch_width =	CH_WIDTH_20MHZ;
+			sta_context->ch_width = CH_WIDTH_20MHZ;
 			if ((IS_SIR_STATUS_SUCCESS(
 				wlan_cfg_get_int(pMac,
 					WNI_CFG_VHT_ENABLE_TXBF_20MHZ,
@@ -3803,6 +3792,14 @@ tSirRetStatus lim_sta_send_add_bss(tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
 					(false == enableTxBF20MHz))
 				sta_context->vhtTxBFCapable = 0;
 		}
+
+		pe_debug("StaCtx: vhtCap %d ChBW %d TxBF %d",
+				pAddBssParams->staContext.vhtCapable,
+				pAddBssParams->staContext.ch_width,
+				sta_context->vhtTxBFCapable);
+		pe_debug("StaContext su_tx_bfer %d",
+				sta_context->enable_su_tx_bformer);
+
 		pAddBssParams->staContext.mimoPS =
 			(tSirMacHTMIMOPowerSaveState)
 			pAssocRsp->HTCaps.mimoPowerSave;
diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index 6f13e40044a9..0a984d5edaff 100644
--- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -629,7 +629,6 @@ __lim_handle_sme_start_bss_request(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 	uint32_t chanwidth;
 	struct vdev_type_nss *vdev_type_nss;
 	tSirRetStatus cfg_get_wmi_dfs_master_param = eSIR_SUCCESS;
-	struct sir_hw_mode_params hw_mode;
 
 /* FEATURE_WLAN_DIAG_SUPPORT */
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM
@@ -891,14 +890,6 @@ __lim_handle_sme_start_bss_request(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 				session->ch_center_freq_seg1 = 0;
 			}
 		}
-		/* check for the current HW index to update nss */
-		if (wma_is_hw_dbs_capable() &&
-		   (wma_get_current_hw_mode(&hw_mode) == QDF_STATUS_SUCCESS) &&
-		   hw_mode.dbs_cap) {
-			session->nss = 1;
-			pe_debug("HW_mode is DBS .Nss set to [%d]",
-				session->nss);
-		}
 		if (session->vhtCapability &&
 				(session->ch_width > CH_WIDTH_80MHZ)) {
 			session->nss = 1;
diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
index fbba7473c912..f359621f24dd 100644
--- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
@@ -2395,10 +2395,8 @@ void lim_handle_delete_bss_rsp(tpAniSirGlobal pMac, tpSirMsgQ MsgQ)
 	if (psessionEntry == NULL) {
 		pe_err("Session Does not exist for given sessionID: %d",
 			pDelBss->sessionId);
-		if (MsgQ->bodyptr) {
-			qdf_mem_free(MsgQ->bodyptr);
-			MsgQ->bodyptr = NULL;
-		}
+		qdf_mem_free(MsgQ->bodyptr);
+		MsgQ->bodyptr = NULL;
 		return;
 	}
 
diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c
index 34beb6d15cb4..2ebe600848ee 100644
--- a/core/mac/src/pe/lim/lim_utils.c
+++ b/core/mac/src/pe/lim/lim_utils.c
@@ -599,8 +599,16 @@ void lim_deactivate_timers(tpAniSirGlobal mac_ctx)
 	/* Deactivate remain on channel timer */
 	tx_timer_deactivate(&lim_timer->gLimRemainOnChannelTimer);
 
+	if (tx_timer_running(&lim_timer->gLimDisassocAckTimer)) {
+		pe_err("Disassoc timer running call the timeout API");
+		lim_timer_handler(mac_ctx, SIR_LIM_DISASSOC_ACK_TIMEOUT);
+	}
 	tx_timer_deactivate(&lim_timer->gLimDisassocAckTimer);
 
+	if (tx_timer_running(&lim_timer->gLimDeauthAckTimer)) {
+		pe_err("Deauth timer running call the timeout API");
+		lim_timer_handler(mac_ctx, SIR_LIM_DEAUTH_ACK_TIMEOUT);
+	}
 	tx_timer_deactivate(&lim_timer->gLimDeauthAckTimer);
 
 	tx_timer_deactivate(&lim_timer->
diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c
index 265de1e717df..f17ea5c16a7b 100644
--- a/core/sme/src/common/sme_api.c
+++ b/core/sme/src/common/sme_api.c
@@ -16006,6 +16006,22 @@ QDF_STATUS sme_set_rssi_monitoring(tHalHandle hal,
 	return status;
 }
 
+static tSirRFBand sme_get_connected_roaming_vdev_band(tpAniSirGlobal mac_ctx)
+{
+	tSirRFBand band = SIR_BAND_ALL;
+	tCsrRoamSession *session;
+	uint8_t session_id, channel;
+
+	session_id = csr_get_roam_enabled_sta_sessionid(mac_ctx);
+	if (session_id != CSR_SESSION_ID_INVALID) {
+		session = CSR_GET_SESSION(mac_ctx, session_id);
+		channel = session->connectedProfile.operationChannel;
+		band = get_rf_band(channel);
+	}
+
+	return band;
+}
+
 /**
  * sme_pdev_set_pcl() - Send WMI_PDEV_SET_PCL_CMDID to the WMA
  * @hal: Handle returned by macOpen
@@ -16021,23 +16037,28 @@ QDF_STATUS sme_pdev_set_pcl(tHalHandle hal,
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
 	tpAniSirGlobal mac   = PMAC_STRUCT(hal);
 	cds_msg_t cds_message;
-	struct wmi_pcl_chan_weights *req_msg;
-	uint32_t len, i;
+	struct set_pcl_req *req_msg;
+	uint32_t i;
 
-	len = sizeof(*req_msg);
+	req_msg = qdf_mem_malloc(sizeof(*req_msg));
 
-	req_msg = qdf_mem_malloc(len);
 	if (!req_msg) {
 		sme_err("qdf_mem_malloc failed");
 		return QDF_STATUS_E_NOMEM;
 	}
 
+	req_msg->band = SIR_BAND_ALL;
+	if (CSR_IS_ROAM_INTRA_BAND_ENABLED(mac)) {
+		req_msg->band = sme_get_connected_roaming_vdev_band(mac);
+		sme_debug("Connected STA band %d", req_msg->band);
+	}
+
 	for (i = 0; i < msg.pcl_len; i++) {
-		req_msg->pcl_list[i] =  msg.pcl_list[i];
-		req_msg->weight_list[i] =  msg.weight_list[i];
+		req_msg->chan_weights.pcl_list[i] =  msg.pcl_list[i];
+		req_msg->chan_weights.weight_list[i] =  msg.weight_list[i];
 	}
 
-	req_msg->pcl_len = msg.pcl_len;
+	req_msg->chan_weights.pcl_len = msg.pcl_len;
 
 	status = sme_acquire_global_lock(&mac->sme);
 	if (status != QDF_STATUS_SUCCESS) {
diff --git a/core/sme/src/common/sme_power_save.c b/core/sme/src/common/sme_power_save.c
index 56198afbab10..a0b193356ca5 100644
--- a/core/sme/src/common/sme_power_save.c
+++ b/core/sme/src/common/sme_power_save.c
@@ -484,6 +484,10 @@ QDF_STATUS sme_enable_sta_ps_check(tpAniSirGlobal mac_ctx, uint32_t session_id)
 {
 	struct ps_global_info *ps_global_info = &mac_ctx->sme.ps_global_info;
 
+	QDF_BUG(session_id < CSR_ROAM_SESSION_MAX);
+	if (session_id >= CSR_ROAM_SESSION_MAX)
+		return QDF_STATUS_E_INVAL;
+
 	/* Check if Sta Ps is enabled. */
 	if (!ps_global_info->ps_enabled) {
 		sme_debug("Cannot initiate PS. PS is disabled in ini");
@@ -499,8 +503,8 @@ QDF_STATUS sme_enable_sta_ps_check(tpAniSirGlobal mac_ctx, uint32_t session_id)
 			  session_id);
 		return QDF_STATUS_E_FAILURE;
 	}
-	return QDF_STATUS_SUCCESS;
 
+	return QDF_STATUS_SUCCESS;
 }
 
 /**
@@ -544,6 +548,10 @@ QDF_STATUS sme_ps_timer_flush_sync(tHalHandle hal, uint8_t session_id)
 	struct sEnablePsParams *req;
 	t_wma_handle *wma;
 
+	QDF_BUG(session_id < CSR_ROAM_SESSION_MAX);
+	if (session_id >= CSR_ROAM_SESSION_MAX)
+		return QDF_STATUS_E_INVAL;
+
 	status = sme_enable_sta_ps_check(mac_ctx, session_id);
 	if (QDF_IS_STATUS_ERROR(status)) {
 		sme_debug("Power save not allowed for vdev id %d", session_id);
diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index 2c3da0f6aaf9..e993a3b27375 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -20634,6 +20634,7 @@ csr_roam_offload_scan(tpAniSirGlobal mac_ctx, uint8_t session_id,
 	struct roam_ext_params *roam_params_src;
 	uint8_t i, temp_session_id;
 	uint8_t op_channel;
+	bool prev_roaming_state;
 
 	sme_debug("RSO Command %d, Session id %d, Reason %d", command,
 		   session_id, reason);
@@ -20886,17 +20887,22 @@ csr_roam_offload_scan(tpAniSirGlobal mac_ctx, uint8_t session_id,
 	QDF_TRACE_HEX_DUMP(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG,
 			req_buf->assoc_ie.addIEdata, req_buf->assoc_ie.length);
 
+	prev_roaming_state = roam_info->b_roam_scan_offload_started;
+	if (ROAM_SCAN_OFFLOAD_START == command)
+		roam_info->b_roam_scan_offload_started = true;
+	else if (ROAM_SCAN_OFFLOAD_STOP == command)
+		roam_info->b_roam_scan_offload_started = false;
+	cds_set_pcl_for_existing_combo(CDS_STA_MODE);
+
 	if (!QDF_IS_STATUS_SUCCESS(
 		csr_roam_send_rso_cmd(mac_ctx, session_id, req_buf))) {
 		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
 			  "%s: Not able to post message to PE",
 			  __func__);
+		roam_info->b_roam_scan_offload_started = prev_roaming_state;
+		cds_set_pcl_for_existing_combo(CDS_STA_MODE);
 		return QDF_STATUS_E_FAILURE;
 	}
-	if (ROAM_SCAN_OFFLOAD_START == command)
-		roam_info->b_roam_scan_offload_started = true;
-	else if (ROAM_SCAN_OFFLOAD_STOP == command)
-		roam_info->b_roam_scan_offload_started = false;
 
 	/* update the last sent cmd */
 	roam_info->last_sent_cmd = command;
diff --git a/core/sme/src/csr/csr_util.c b/core/sme/src/csr/csr_util.c
index 76b4aa5aae56..4866757840ea 100644
--- a/core/sme/src/csr/csr_util.c
+++ b/core/sme/src/csr/csr_util.c
@@ -401,33 +401,42 @@ bool csr_is_bss_id_equal(tHalHandle hHal, tSirBssDescription *pSirBssDesc1,
 	return fEqual;
 }
 
-bool csr_is_conn_state_connected_ibss(tpAniSirGlobal pMac, uint32_t sessionId)
+static bool csr_is_conn_state(tpAniSirGlobal mac_ctx, uint32_t session_id,
+			      eCsrConnectState state)
 {
-	return eCSR_ASSOC_STATE_TYPE_IBSS_CONNECTED ==
-		pMac->roam.roamSession[sessionId].connectState;
+	QDF_BUG(session_id < CSR_ROAM_SESSION_MAX);
+	if (session_id >= CSR_ROAM_SESSION_MAX)
+		return false;
+
+	return mac_ctx->roam.roamSession[session_id].connectState == state;
+}
+
+bool csr_is_conn_state_connected_ibss(tpAniSirGlobal mac_ctx,
+				      uint32_t session_id)
+{
+	return csr_is_conn_state(mac_ctx, session_id,
+				 eCSR_ASSOC_STATE_TYPE_IBSS_CONNECTED);
 }
 
-bool csr_is_conn_state_disconnected_ibss(tpAniSirGlobal pMac,
-					 uint32_t sessionId)
+bool csr_is_conn_state_disconnected_ibss(tpAniSirGlobal mac_ctx,
+					 uint32_t session_id)
 {
-	return eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED ==
-		pMac->roam.roamSession[sessionId].connectState;
+	return csr_is_conn_state(mac_ctx, session_id,
+				 eCSR_ASSOC_STATE_TYPE_IBSS_DISCONNECTED);
 }
 
-bool csr_is_conn_state_connected_infra(tpAniSirGlobal pMac, uint32_t sessionId)
+bool csr_is_conn_state_connected_infra(tpAniSirGlobal mac_ctx,
+				       uint32_t session_id)
 {
-	return eCSR_ASSOC_STATE_TYPE_INFRA_ASSOCIATED ==
-		pMac->roam.roamSession[sessionId].connectState;
+	return csr_is_conn_state(mac_ctx, session_id,
+				 eCSR_ASSOC_STATE_TYPE_INFRA_ASSOCIATED);
 }
 
 bool csr_is_conn_state_connected(tpAniSirGlobal pMac, uint32_t sessionId)
 {
-	if (csr_is_conn_state_connected_ibss(pMac, sessionId)
-	    || csr_is_conn_state_connected_infra(pMac, sessionId)
-	    || csr_is_conn_state_connected_wds(pMac, sessionId))
-		return true;
-	else
-		return false;
+	return csr_is_conn_state_connected_ibss(pMac, sessionId) ||
+		csr_is_conn_state_connected_infra(pMac, sessionId) ||
+		csr_is_conn_state_connected_wds(pMac, sessionId);
 }
 
 bool csr_is_conn_state_infra(tpAniSirGlobal pMac, uint32_t sessionId)
@@ -441,25 +450,27 @@ bool csr_is_conn_state_ibss(tpAniSirGlobal pMac, uint32_t sessionId)
 	       csr_is_conn_state_disconnected_ibss(pMac, sessionId);
 }
 
-bool csr_is_conn_state_connected_wds(tpAniSirGlobal pMac, uint32_t sessionId)
+bool csr_is_conn_state_connected_wds(tpAniSirGlobal mac_ctx,
+				     uint32_t session_id)
 {
-	return eCSR_ASSOC_STATE_TYPE_WDS_CONNECTED ==
-		pMac->roam.roamSession[sessionId].connectState;
+	return csr_is_conn_state(mac_ctx, session_id,
+				 eCSR_ASSOC_STATE_TYPE_WDS_CONNECTED);
 }
 
-bool csr_is_conn_state_connected_infra_ap(tpAniSirGlobal pMac,
-					  uint32_t sessionId)
+bool csr_is_conn_state_connected_infra_ap(tpAniSirGlobal mac_ctx,
+					  uint32_t session_id)
 {
-	return (eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED ==
-		 pMac->roam.roamSession[sessionId].connectState) ||
-	       (eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTED ==
-		 pMac->roam.roamSession[sessionId].connectState);
+	return csr_is_conn_state(mac_ctx, session_id,
+				 eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED) ||
+		csr_is_conn_state(mac_ctx, session_id,
+				  eCSR_ASSOC_STATE_TYPE_INFRA_DISCONNECTED);
 }
 
-bool csr_is_conn_state_disconnected_wds(tpAniSirGlobal pMac, uint32_t sessionId)
+bool csr_is_conn_state_disconnected_wds(tpAniSirGlobal mac_ctx,
+					uint32_t session_id)
 {
-	return eCSR_ASSOC_STATE_TYPE_WDS_DISCONNECTED ==
-		pMac->roam.roamSession[sessionId].connectState;
+	return csr_is_conn_state(mac_ctx, session_id,
+				 eCSR_ASSOC_STATE_TYPE_WDS_DISCONNECTED);
 }
 
 bool csr_is_conn_state_wds(tpAniSirGlobal pMac, uint32_t sessionId)
diff --git a/core/sme/src/rrm/sme_rrm.c b/core/sme/src/rrm/sme_rrm.c
index 3aac3cad2878..931349949920 100644
--- a/core/sme/src/rrm/sme_rrm.c
+++ b/core/sme/src/rrm/sme_rrm.c
@@ -896,6 +896,14 @@ QDF_STATUS sme_rrm_process_beacon_report_req_ind(tpAniSirGlobal pMac,
 
 	sme_debug("Received Beacon report request ind Channel = %d",
 		pBeaconReq->channelInfo.channelNum);
+
+	if (pBeaconReq->channelList.numChannels >
+	    SIR_ESE_MAX_MEAS_IE_REQS) {
+		sme_err("Beacon report request numChannels:%u exceeds max num channels",
+			pBeaconReq->channelList.numChannels);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	/* section 11.10.8.1 (IEEE Std 802.11k-2008) */
 	/* channel 0 and 255 has special meaning. */
 	if ((pBeaconReq->channelInfo.channelNum == 0) ||
diff --git a/core/wma/inc/wma.h b/core/wma/inc/wma.h
index bde43c4c1f4b..03c7a5c91456 100644
--- a/core/wma/inc/wma.h
+++ b/core/wma/inc/wma.h
@@ -2383,7 +2383,7 @@ QDF_STATUS wma_set_rssi_monitoring(tp_wma_handle wma,
 					struct rssi_monitor_req *req);
 
 QDF_STATUS wma_send_pdev_set_pcl_cmd(tp_wma_handle wma_handle,
-		struct wmi_pcl_chan_weights *msg);
+		struct set_pcl_req *msg);
 
 QDF_STATUS wma_send_pdev_set_hw_mode_cmd(tp_wma_handle wma_handle,
 		struct sir_hw_mode *msg);
diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c
index 4bfcdc73ab70..c9e949892f82 100644
--- a/core/wma/src/wma_data.c
+++ b/core/wma/src/wma_data.c
@@ -2759,6 +2759,13 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 			frmLen = newFrmLen;
 			pFc = (tpSirMacFrameCtl) (qdf_nbuf_data(tx_frame));
 		}
+		/*
+		 * Some target which support sending mgmt frame based on htt
+		 * would DMA write this PMF tx frame buffer, it may cause smmu
+		 * check permission fault, set a flag to do bi-direction DMA
+		 * map, normal tx unmap is enough for this case.
+		 */
+		QDF_NBUF_CB_TX_DMA_BI_MAP((qdf_nbuf_t)tx_frame) = 1;
 	}
 #endif /* WLAN_FEATURE_11W */
 	mHdr = (tpSirMacMgmtHdr)qdf_nbuf_data(tx_frame);
diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c
index 3fe9ffd96749..592f64e11b00 100644
--- a/core/wma/src/wma_dev_if.c
+++ b/core/wma/src/wma_dev_if.c
@@ -532,6 +532,7 @@ static QDF_STATUS wma_self_peer_remove(tp_wma_handle wma_handle,
 				 vdev_id);
 			wma_remove_req(wma_handle, vdev_id,
 				WMA_DEL_P2P_SELF_STA_RSP_START);
+			qdf_mem_free(sta_self_wmi_rsp);
 			qdf_status = QDF_STATUS_E_FAILURE;
 			goto error;
 		}
@@ -991,7 +992,6 @@ int wma_vdev_start_resp_handler(void *handle, uint8_t *cmd_param_info,
 			if (resp_event->pdev_id == WMI_PDEV_ID_SOC) {
 				WMA_LOGE("%s: soc level id received for mac id",
 					__func__);
-				QDF_BUG(0);
 				return -EINVAL;
 			}
 			wma->interfaces[resp_event->vdev_id].mac_id =
@@ -1093,11 +1093,13 @@ int wma_vdev_start_resp_handler(void *handle, uint8_t *cmd_param_info,
 			wma->interfaces[resp_event->vdev_id].is_channel_switch =
 				false;
 		}
-		if (((resp_event->resp_type == WMI_VDEV_RESTART_RESP_EVENT) &&
-			((iface->type == WMI_VDEV_TYPE_STA) ||
-				(iface->type == WMI_VDEV_TYPE_MONITOR))) ||
-			((resp_event->resp_type == WMI_VDEV_START_RESP_EVENT) &&
-			 (iface->type == WMI_VDEV_TYPE_MONITOR))) {
+
+		if ((QDF_IS_STATUS_SUCCESS(resp_event->status) &&
+		     (resp_event->resp_type == WMI_VDEV_RESTART_RESP_EVENT) &&
+		     ((iface->type == WMI_VDEV_TYPE_STA) ||
+		      (iface->type == WMI_VDEV_TYPE_MONITOR))) ||
+		    ((resp_event->resp_type == WMI_VDEV_START_RESP_EVENT) &&
+		     (iface->type == WMI_VDEV_TYPE_MONITOR))) {
 			/* for CSA case firmware expects phymode before ch_wd */
 			err = wma_set_peer_param(wma, iface->bssid,
 					WMI_PEER_PHYMODE, iface->chanmode,
@@ -3337,7 +3339,8 @@ void wma_vdev_resp_timer(void *data)
 		if (wma_crash_on_fw_timeout(wma->fw_timeout_crash) == true) {
 			wma_trigger_recovery_assert_on_fw_timeout(
 				WMA_DELETE_BSS_REQ);
-			return;
+			wma_cleanup_target_req_param(tgt_req);
+			goto free_tgt_req;
 		}
 
 		if (wma_is_vdev_in_ibss_mode(wma, tgt_req->vdev_id))
@@ -3437,6 +3440,19 @@ void wma_vdev_resp_timer(void *data)
 			wma_trigger_recovery_assert_on_fw_timeout(
 				WMA_ADD_BSS_REQ);
 		} else {
+			/* Send vdev stop to the FW */
+			if (wma_send_vdev_stop_to_fw(wma, tgt_req->vdev_id))
+				WMA_LOGE("%s: Failed to send vdev stop to fw",
+					 __func__);
+
+			peer = ol_txrx_find_peer_by_addr(pdev, params->bssId,
+							 &peer_id);
+			if (peer)
+				wma_remove_peer(wma, params->bssId,
+						tgt_req->vdev_id, peer, false);
+			else
+				WMA_LOGE("%s: Failed to find peer", __func__);
+
 			wma_send_msg_high_priority(wma,
 				WMA_ADD_BSS_RSP, (void *)params, 0);
 			QDF_ASSERT(0);
diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c
index 1cc0f1b609a8..a5ff14aa7429 100644
--- a/core/wma/src/wma_main.c
+++ b/core/wma/src/wma_main.c
@@ -6036,6 +6036,13 @@ static void wma_populate_soc_caps(t_wma_handle *wma_handle,
 		wma_cleanup_dbs_phy_caps(wma_handle);
 		return;
 	}
+
+	if (num_of_mac_caps > param_buf->num_mac_phy_caps) {
+		WMA_LOGE("%s: Invalid num_of_mac_caps %d received from fw",
+			__func__, num_of_mac_caps);
+		wma_cleanup_dbs_phy_caps(wma_handle);
+		return;
+	}
 	qdf_mem_copy(phy_caps->each_phy_cap_per_hwmode,
 			param_buf->mac_phy_caps,
 			num_of_mac_caps * sizeof(WMI_MAC_PHY_CAPABILITIES));
@@ -8096,7 +8103,7 @@ QDF_STATUS wma_mc_process_msg(void *cds_context, cds_msg_t *msg)
 		break;
 	case SIR_HAL_PDEV_SET_PCL_TO_FW:
 		wma_send_pdev_set_pcl_cmd(wma_handle,
-				(struct wmi_pcl_chan_weights *)msg->bodyptr);
+				(struct set_pcl_req *)msg->bodyptr);
 		qdf_mem_free(msg->bodyptr);
 		break;
 	case SIR_HAL_PDEV_SET_HW_MODE:
@@ -8411,7 +8418,7 @@ static wmi_pcl_chan_weight wma_map_pcl_weights(uint32_t pcl_weight)
  * Return: Success if the cmd is sent successfully to the firmware
  */
 QDF_STATUS wma_send_pdev_set_pcl_cmd(tp_wma_handle wma_handle,
-				struct wmi_pcl_chan_weights *msg)
+				struct set_pcl_req *msg)
 {
 	uint32_t i;
 	QDF_STATUS status;
@@ -8423,26 +8430,36 @@ QDF_STATUS wma_send_pdev_set_pcl_cmd(tp_wma_handle wma_handle,
 	}
 
 	for (i = 0; i < wma_handle->saved_chan.num_channels; i++) {
-		msg->saved_chan_list[i] =
+		msg->chan_weights.saved_chan_list[i] =
 			wma_handle->saved_chan.channel_list[i];
 	}
 
-	msg->saved_num_chan = wma_handle->saved_chan.num_channels;
-	status = cds_get_valid_chan_weights((struct sir_pcl_chan_weights *)msg,
-					CDS_STA_MODE);
+	msg->chan_weights.saved_num_chan = wma_handle->saved_chan.num_channels;
+	status = cds_get_valid_chan_weights(
+			(struct sir_pcl_chan_weights *)&msg->chan_weights,
+			CDS_STA_MODE);
 
-	for (i = 0; i < msg->saved_num_chan; i++) {
-		msg->weighed_valid_list[i] =
-			wma_map_pcl_weights(msg->weighed_valid_list[i]);
+	for (i = 0; i < msg->chan_weights.saved_num_chan; i++) {
+		msg->chan_weights.weighed_valid_list[i] =
+			wma_map_pcl_weights(msg->chan_weights.
+					    weighed_valid_list[i]);
 		/* Dont allow roaming on 2G when 5G_ONLY configured */
-		if ((wma_handle->bandcapability == SIR_BAND_5_GHZ) &&
-			(msg->saved_chan_list[i] <= MAX_24GHZ_CHANNEL)) {
-			msg->weighed_valid_list[i] =
+		if (((wma_handle->bandcapability == SIR_BAND_5_GHZ) ||
+		    (msg->band == SIR_BAND_5_GHZ)) &&
+		    (CDS_IS_CHANNEL_24GHZ(
+		    msg->chan_weights.saved_chan_list[i]))) {
+			msg->chan_weights.weighed_valid_list[i] =
+				WEIGHT_OF_DISALLOWED_CHANNELS;
+		}
+		if ((msg->band == SIR_BAND_2_4_GHZ) &&
+		    CDS_IS_CHANNEL_5GHZ((msg->chan_weights.
+					saved_chan_list[i]))) {
+			msg->chan_weights.weighed_valid_list[i] =
 				WEIGHT_OF_DISALLOWED_CHANNELS;
 		}
 		WMA_LOGD("%s: chan:%d weight[%d]=%d", __func__,
-			 msg->saved_chan_list[i], i,
-			 msg->weighed_valid_list[i]);
+			 msg->chan_weights.saved_chan_list[i], i,
+			 msg->chan_weights.weighed_valid_list[i]);
 	}
 
 	if (!QDF_IS_STATUS_SUCCESS(status)) {
@@ -8450,7 +8467,8 @@ QDF_STATUS wma_send_pdev_set_pcl_cmd(tp_wma_handle wma_handle,
 		return status;
 	}
 
-	if (wmi_unified_pdev_set_pcl_cmd(wma_handle->wmi_handle, msg))
+	if (wmi_unified_pdev_set_pcl_cmd(wma_handle->wmi_handle,
+					 &msg->chan_weights))
 		return QDF_STATUS_E_FAILURE;
 
 	return QDF_STATUS_SUCCESS;
diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c
index 365f397c9480..8888794e78a9 100644
--- a/core/wma/src/wma_mgmt.c
+++ b/core/wma/src/wma_mgmt.c
@@ -91,7 +91,7 @@ static void wma_send_bcn_buf_ll(tp_wma_handle wma,
 	uint8_t i;
 
 	bcn = wma->interfaces[vdev_id].beacon;
-	if (!bcn->buf) {
+	if (!bcn || !bcn->buf) {
 		WMA_LOGE("%s: Invalid beacon buffer", __func__);
 		return;
 	}
diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c
index ab1aa2b2de7c..b4088b899096 100644
--- a/core/wma/src/wma_scan_roam.c
+++ b/core/wma/src/wma_scan_roam.c
@@ -5042,7 +5042,7 @@ static int wma_extscan_find_unique_scan_ids(const u_int8_t *cmd_param_info)
 	/* Find the unique number of scan_id's for grouping */
 	prev_scan_id = src_rssi->scan_cycle_id;
 	scan_ids_cnt = 1;
-	for (i = 1; i < event->num_entries_in_page; i++) {
+	for (i = 1; i < param_buf->num_rssi_list; i++) {
 		src_rssi++;
 
 		if (prev_scan_id != src_rssi->scan_cycle_id) {
@@ -5086,7 +5086,7 @@ static int wma_fill_num_results_per_scan_id(const u_int8_t *cmd_param_info,
 	t_scan_id_grp->flags = src_rssi->flags;
 	t_scan_id_grp->buckets_scanned = src_rssi->buckets_scanned;
 	t_scan_id_grp->num_results = 1;
-	for (i = 1; i < event->num_entries_in_page; i++) {
+	for (i = 1; i < param_buf->num_rssi_list; i++) {
 		src_rssi++;
 		if (prev_scan_id == src_rssi->scan_cycle_id) {
 			t_scan_id_grp->num_results++;
@@ -5159,7 +5159,8 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info,
 		}
 
 		ap = &t_scan_id_grp->ap[0];
-		for (j = 0; j < t_scan_id_grp->num_results; j++) {
+		for (j = 0; j < QDF_MIN(t_scan_id_grp->num_results,
+					param_buf->num_bssid_list); j++) {
 			ap->channel = src_hotlist->channel;
 			ap->ts = WMA_MSEC_TO_USEC(src_rssi->tstamp);
 			ap->rtt = src_hotlist->rtt;