Release 1.0.0.130 QCACLD WLAN Driver

Merge remote-tracking branch 'origin/caf/caf-wlan/master'

* origin/caf/caf-wlan/master: (25 commits)
  Cafstaging Release 1.0.0.130
  qcacld: sap/dfs: clear cac_block_tx if SAP is not in DFS channel
  wlan: Protect add get and set_default key functions from SSR
  qcacld: ipa: Enable clock scaling by default
  qcacld: HDD: Provide fix for unexpected kernel trace
  wlan: correctly update WNI_CFG_HT_CAP_INFO
  qcacld: CL 992403 - update fw common interface files
  qcacld: CL 991339 - update fw common interface files
  qcacld: wma: fix memleak
  qcacld: sap: fix assert while stop bss in CAC_WAIT state
  qcacld: hdd: send protocol reason code for auth fail
  wlan: Add helper function hdd_priv_get_data for "compat" support
  wlan-cld: Fix for device crash with p2p_no_group_iface=0 in config file
  wlan-cld: NULL pointer dereference in wlan_hdd_p2p.c
  wlan: Protect the resume/suspend from SSR
  qcacld: Reducing log level hdd_roamRegisterSTA
  qcacld: Fix for Invalid adf context access
  qca-cld: mcc p2pcli-sta throughput imbalance fix
  qcacld/wma:support to configure dtim on system suspend
  qcacld:configure powersave parameters
  ...

Change-Id: I3aa83476863aa1c177417d7453c5b5bcaf8bb01a

40 files changed, 620 insertions, 217 deletions

diff --git a/CORE/CLD_TXRX/TXRX/ol_tx_classify.c b/CORE/CLD_TXRX/TXRX/ol_tx_classify.c
index 5418ad2d47dc..631410d2503e 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx_classify.c
+++ b/CORE/CLD_TXRX/TXRX/ol_tx_classify.c
@@ -272,14 +272,10 @@ ol_tx_tid(
 
     if (pdev->frame_format == wlan_frm_fmt_raw) {
         tx_msdu_info->htt.info.l2_hdr_type = htt_pkt_type_raw;
-        tid = tx_msdu_info->htt.info.ext_tid == ADF_NBUF_TX_EXT_TID_INVALID ?
-            ol_tx_tid_by_raw_type(datap, tx_msdu_info) :
-            tx_msdu_info->htt.info.ext_tid;
+	tid = ol_tx_tid_by_raw_type(datap, tx_msdu_info);
     } else if (pdev->frame_format == wlan_frm_fmt_802_3) {
         tx_msdu_info->htt.info.l2_hdr_type = htt_pkt_type_ethernet;
-        tid = tx_msdu_info->htt.info.ext_tid == ADF_NBUF_TX_EXT_TID_INVALID ?
-            ol_tx_tid_by_ether_type(datap, tx_msdu_info) :
-            tx_msdu_info->htt.info.ext_tid;
+	tid = ol_tx_tid_by_ether_type(datap, tx_msdu_info);
     } else if (pdev->frame_format == wlan_frm_fmt_native_wifi) {
         struct llc_snap_hdr_t *llc;
 
diff --git a/CORE/HDD/inc/wlan_hdd_cfg.h b/CORE/HDD/inc/wlan_hdd_cfg.h
index 5aee49c67cac..1c890023d3b4 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -2480,7 +2480,7 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
 #define CFG_LL_TX_LBW_FLOW_LWM                     "TxLbwFlowLowWaterMark"
 #define CFG_LL_TX_LBW_FLOW_LWM_MIN                 ( 0 )
 #define CFG_LL_TX_LBW_FLOW_LWM_MAX                 ( 1000 )
-#define CFG_LL_TX_LBW_FLOW_LWM_DEFAULT             ( 650 )
+#define CFG_LL_TX_LBW_FLOW_LWM_DEFAULT             ( 450 )
 
 #define CFG_LL_TX_LBW_FLOW_HWM_OFFSET              "TxLbwFlowHighWaterMarkOffset"
 #define CFG_LL_TX_LBW_FLOW_HWM_OFFSET_MIN          ( 0 )
diff --git a/CORE/HDD/inc/wlan_hdd_wext.h b/CORE/HDD/inc/wlan_hdd_wext.h
index 67883752dda6..b858ed6e58fb 100644
--- a/CORE/HDD/inc/wlan_hdd_wext.h
+++ b/CORE/HDD/inc/wlan_hdd_wext.h
@@ -386,6 +386,9 @@ extern int iw_set_var_ints_getnone(struct net_device *dev, struct iw_request_inf
 extern int iw_set_three_ints_getnone(struct net_device *dev, struct iw_request_info *info,
                        union iwreq_data *wrqu, char *extra);
 
+extern int hdd_priv_get_data(struct iw_point *p_priv_data,
+                             union iwreq_data *wrqu);
+
 extern VOS_STATUS wlan_hdd_get_linkspeed_for_peermac(hdd_adapter_t *pAdapter,
                                                      tSirMacAddr macAddress);
 void hdd_clearRoamProfileIe( hdd_adapter_t *pAdapter);
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index 7ac413a8c1d4..1663070f9e8d 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -1211,8 +1211,11 @@ static VOS_STATUS hdd_roamRegisterSTA( hdd_adapter_t *pAdapter,
    // then go to 'authenticated'.  For all other authentication types
    // (those that donot require upper layer authentication) we can put
    // TL directly into 'authenticated' state.
-   if (staDesc.wSTAType != WLAN_STA_IBSS)
-      VOS_ASSERT( fConnected );
+   if (staDesc.wSTAType != WLAN_STA_IBSS) {
+      VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_MED,
+                 "STA type %d fConnected %d", staDesc.wSTAType, fConnected);
+   }
+
 
    if ( !pRoamInfo->fAuthRequired )
    {
@@ -1733,12 +1736,23 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
             }
             else
             {
-                if (pRoamInfo)
+                if (pRoamInfo) {
+                    eCsrAuthType authType =
+                        pWextState->roamProfile.AuthType.authType[0];
+                    v_BOOL_t isWep = (authType == eCSR_AUTH_TYPE_OPEN_SYSTEM) ||
+                                    (authType == eCSR_AUTH_TYPE_SHARED_KEY);
+
+                    /* In case of OPEN-WEP or SHARED-WEP authentication,
+                     * send exact protocol reason code. This enables user
+                     * applications to reconnect the station with correct
+                     * configuration.
+                     */
                     cfg80211_connect_result ( dev, pRoamInfo->bssid,
                         NULL, 0, NULL, 0,
-                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                        isWep ? pRoamInfo->reasonCode :
+                            WLAN_STATUS_UNSPECIFIED_FAILURE,
                         GFP_KERNEL );
-                else
+                } else
                     cfg80211_connect_result ( dev, pWextState->req_bssId,
                         NULL, 0, NULL, 0,
                         WLAN_STATUS_UNSPECIFIED_FAILURE,
diff --git a/CORE/HDD/src/wlan_hdd_cfg.c b/CORE/HDD/src/wlan_hdd_cfg.c
index 3dafdf323ed3..e96fc9c36292 100644
--- a/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/CORE/HDD/src/wlan_hdd_cfg.c
@@ -5416,10 +5416,10 @@ v_BOOL_t hdd_update_config_dat( hdd_context_t *pHddCtx )
      phtCapInfo->rxSTBC = pConfig->enableRxSTBC;
      phtCapInfo->txSTBC = pConfig->enableTxSTBC;
      phtCapInfo->advCodingCap = pConfig->enableRxLDPC;
-
-     if(ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_HT_CAP_INFO,
-                     *(tANI_U16 *)phtCapInfo, NULL, eANI_BOOLEAN_FALSE)
-         ==eHAL_STATUS_FAILURE)
+     val = val16;
+     if (ccmCfgSetInt(pHddCtx->hHal, WNI_CFG_HT_CAP_INFO,
+                      val, NULL, eANI_BOOLEAN_FALSE)
+         == eHAL_STATUS_FAILURE)
      {
          fStatus = FALSE;
          hddLog(LOGE, "Could not pass on WNI_CFG_HT_CAP_INFO to CCM");
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 702af5488b2f..5d18bbe4dc56 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -4188,10 +4188,10 @@ static int wlan_hdd_change_station(struct wiphy *wiphy,
 }
 
 /*
- * FUNCTION: wlan_hdd_cfg80211_add_key
+ * FUNCTION: __wlan_hdd_cfg80211_add_key
  * This function is used to initialize the key information
  */
-static int wlan_hdd_cfg80211_add_key( struct wiphy *wiphy,
+static int __wlan_hdd_cfg80211_add_key( struct wiphy *wiphy,
                                       struct net_device *ndev,
                                       u8 key_index, bool pairwise,
                                       const u8 *mac_addr,
@@ -4545,11 +4545,27 @@ static int wlan_hdd_cfg80211_add_key( struct wiphy *wiphy,
     return 0;
 }
 
+static int wlan_hdd_cfg80211_add_key( struct wiphy *wiphy,
+                                      struct net_device *ndev,
+                                      u8 key_index, bool pairwise,
+                                      const u8 *mac_addr,
+                                      struct key_params *params
+                                      )
+{
+    int ret;
+    vos_ssr_protect(__func__);
+    ret = __wlan_hdd_cfg80211_add_key(wiphy, ndev, key_index, pairwise,
+                                      mac_addr, params);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
+}
+
 /*
- * FUNCTION: wlan_hdd_cfg80211_get_key
+ * FUNCTION: __wlan_hdd_cfg80211_get_key
  * This function is used to get the key information
  */
-static int wlan_hdd_cfg80211_get_key(
+static int __wlan_hdd_cfg80211_get_key(
                         struct wiphy *wiphy,
                         struct net_device *ndev,
                         u8 key_index, bool pairwise,
@@ -4615,6 +4631,24 @@ static int wlan_hdd_cfg80211_get_key(
     return 0;
 }
 
+static int wlan_hdd_cfg80211_get_key(
+                        struct wiphy *wiphy,
+                        struct net_device *ndev,
+                        u8 key_index, bool pairwise,
+                        const u8 *mac_addr, void *cookie,
+                        void (*callback)(void *cookie, struct key_params*)
+                        )
+{
+    int ret;
+
+    vos_ssr_protect(__func__);
+    ret = __wlan_hdd_cfg80211_get_key(wiphy, ndev, key_index, pairwise,
+                                    mac_addr, cookie, callback);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
+}
+
 /*
  * FUNCTION: wlan_hdd_cfg80211_del_key
  * This function is used to delete the key information
@@ -4722,10 +4756,10 @@ static int wlan_hdd_cfg80211_del_key( struct wiphy *wiphy,
 }
 
 /*
- * FUNCTION: wlan_hdd_cfg80211_set_default_key
+ * FUNCTION: __wlan_hdd_cfg80211_set_default_key
  * This function is used to set the default tx key index
  */
-static int wlan_hdd_cfg80211_set_default_key( struct wiphy *wiphy,
+static int __wlan_hdd_cfg80211_set_default_key( struct wiphy *wiphy,
                                               struct net_device *ndev,
                                               u8 key_index,
                                               bool unicast, bool multicast)
@@ -4864,6 +4898,20 @@ static int wlan_hdd_cfg80211_set_default_key( struct wiphy *wiphy,
     return status;
 }
 
+static int wlan_hdd_cfg80211_set_default_key( struct wiphy *wiphy,
+                                              struct net_device *ndev,
+                                              u8 key_index,
+                                              bool unicast, bool multicast)
+{
+    int ret;
+    vos_ssr_protect(__func__);
+    ret = __wlan_hdd_cfg80211_set_default_key(wiphy, ndev, key_index, unicast,
+                                              multicast);
+    vos_ssr_unprotect(__func__);
+
+    return ret;
+}
+
 /*
  * FUNCTION: wlan_hdd_cfg80211_inform_bss
  * This function is used to inform the BSS details to nl80211 interface.
diff --git a/CORE/HDD/src/wlan_hdd_early_suspend.c b/CORE/HDD/src/wlan_hdd_early_suspend.c
index c3203d1bb3f3..dcdb1908b025 100644
--- a/CORE/HDD/src/wlan_hdd_early_suspend.c
+++ b/CORE/HDD/src/wlan_hdd_early_suspend.c
@@ -1736,10 +1736,12 @@ VOS_STATUS hdd_wlan_reset_initialization(void)
  */
 void hdd_set_wlan_suspend_mode(bool suspend)
 {
+    vos_ssr_protect(__func__);
     if (suspend)
         hdd_suspend_wlan(NULL, NULL);
     else
         hdd_resume_wlan();
+    vos_ssr_unprotect(__func__);
 }
 
 static void hdd_ssr_timer_init(void)
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index ff5bdf6b7628..40fea82ddda9 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -794,13 +794,12 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
             {
                pHddCtx->dfs_radar_found = VOS_FALSE;
             }
-            else
-            {
-                if (NV_CHANNEL_DFS !=
+
+            /* if START BSS even on non-DFS channel, clear the block_tx flag */
+            if (NV_CHANNEL_DFS !=
                     vos_nv_getChannelEnabledState(pHddApCtx->operatingChannel))
-                {
-                    pHddApCtx->dfs_cac_block_tx = VOS_FALSE;
-                }
+            {
+                pHddApCtx->dfs_cac_block_tx = VOS_FALSE;
             }
 
             //Fill the params for sending IWEVCUSTOM Event with SOFTAP.enabled
@@ -5063,6 +5062,7 @@ hdd_adapter_t* hdd_wlan_create_ap_dev( hdd_context_t *pHddCtx, tSirMacAddr macAd
         init_completion(&pHostapdAdapter->tx_action_cnf_event);
         init_completion(&pHostapdAdapter->cancel_rem_on_chan_var);
         init_completion(&pHostapdAdapter->rem_on_chan_ready_event);
+        init_completion(&pHostapdAdapter->ula_complete);
         init_completion(&pHostapdAdapter->offchannel_tx_event);
         init_completion(&pHostapdAdapter->scan_info.scan_req_completion_event);
         init_completion(&pHostapdAdapter->scan_info.abortscan_event_var);
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index ad69535a073b..8919fdac4d66 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -6024,8 +6024,9 @@ static void hdd_update_tgt_ht_cap(hdd_context_t *hdd_ctx,
     {
         pconfig->enable2x2 = 0;
     }
+    val32 = val16;
     status = ccmCfgSetInt(hdd_ctx->hHal, WNI_CFG_HT_CAP_INFO,
-                          *(tANI_U16 *)phtCapInfo, NULL, eANI_BOOLEAN_FALSE);
+                          val32, NULL, eANI_BOOLEAN_FALSE);
     if (status != eHAL_STATUS_SUCCESS)
         VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
                   "%s: could not set HT capabilty to CCM",
@@ -7164,9 +7165,9 @@ int hdd_stop (struct net_device *dev)
 
    /* SoftAP ifaces should never go in power save mode
       making sure same here. */
-   if ( (WLAN_HDD_SOFTAP == pAdapter->device_mode )
-                 || (WLAN_HDD_MONITOR == pAdapter->device_mode )
-                 || (WLAN_HDD_P2P_GO == pAdapter->device_mode )
+   if ( (WLAN_HDD_SOFTAP == pAdapter->device_mode ) ||
+        (WLAN_HDD_MONITOR == pAdapter->device_mode) ||
+        (WLAN_HDD_P2P_GO == pAdapter->device_mode )
       )
    {
       /* SoftAP mode, so return from here */
@@ -8043,6 +8044,16 @@ void hdd_cleanup_adapter( hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter, tANI_
    }
 #endif
 
+   /* The adapter is marked as closed. When hdd_wlan_exit() call returns,
+    * the driver is almost closed and cannot handle either control
+    * messages or data. However, unregister_netdevice() call above will
+    * eventually invoke hdd_stop (ndo_close) driver callback, which attempts
+    * to close the active connections (basically excites control path) which
+    * is not right. Setting this flag helps hdd_stop() to recognize that
+    * the interface is closed and restricts any operations on that
+    */
+   clear_bit(DEVICE_IFACE_OPENED, &pAdapter->event_flags);
+
    if(test_bit(NET_DEVICE_REGISTERED, &pAdapter->event_flags)) {
       if( rtnl_held )
       {
@@ -8055,7 +8066,6 @@ void hdd_cleanup_adapter( hdd_context_t *pHddCtx, hdd_adapter_t *pAdapter, tANI_
       // note that the pAdapter is no longer valid at this point
       // since the memory has been reclaimed
    }
-
 }
 
 void hdd_set_pwrparams(hdd_context_t *pHddCtx)
@@ -10132,9 +10142,6 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
       hddLog(VOS_TRACE_LEVEL_FATAL, "%s: FTM driver unloaded", __func__);
       goto free_hdd_ctx;
    }
-   //Stop the Interface TX queue.
-   //netif_tx_disable(pWlanDev);
-   //netif_carrier_off(pWlanDev);
 
    /* DeRegister with platform driver as client for Suspend/Resume */
    vosStatus = hddDeregisterPmOps(pHddCtx);
@@ -10169,7 +10176,7 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
    if ((pHddCtx->cfg_ini->dynSplitscan) && (VOS_TIMER_STATE_RUNNING ==
                vos_timer_getCurrentState(&pHddCtx->tx_rx_trafficTmr)))
    {
-        vos_timer_stop(&pHddCtx->tx_rx_trafficTmr);
+      vos_timer_stop(&pHddCtx->tx_rx_trafficTmr);
    }
 
    // Destroy the traffic monitor timer
@@ -10177,22 +10184,22 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
            !VOS_IS_STATUS_SUCCESS(vos_timer_destroy(
                          &pHddCtx->tx_rx_trafficTmr)))
    {
-       hddLog(VOS_TRACE_LEVEL_ERROR,
-           "%s: Cannot deallocate Traffic monitor timer", __func__);
+      hddLog(VOS_TRACE_LEVEL_ERROR,
+            "%s: Cannot deallocate Traffic monitor timer", __func__);
    }
 
 #ifdef MSM_PLATFORM
    if (VOS_TIMER_STATE_RUNNING ==
                         vos_timer_getCurrentState(&pHddCtx->bus_bw_timer))
    {
-        vos_timer_stop(&pHddCtx->bus_bw_timer);
+      vos_timer_stop(&pHddCtx->bus_bw_timer);
    }
 
    if (!VOS_IS_STATUS_SUCCESS(vos_timer_destroy(
                          &pHddCtx->bus_bw_timer)))
    {
-       hddLog(VOS_TRACE_LEVEL_ERROR,
-           "%s: Cannot deallocate Bus bandwidth timer", __func__);
+      hddLog(VOS_TRACE_LEVEL_ERROR,
+            "%s: Cannot deallocate Bus bandwidth timer", __func__);
    }
 #endif
 
@@ -10209,7 +10216,7 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
       powerContext.magic = POWER_CONTEXT_MAGIC;
 
       halStatus = sme_RequestFullPower(pHddCtx->hHal, hdd_full_power_callback,
-                                   &powerContext, eSME_FULL_PWR_NEEDED_BY_HDD);
+            &powerContext, eSME_FULL_PWR_NEEDED_BY_HDD);
 
       if (eHAL_STATUS_SUCCESS != halStatus)
       {
@@ -10217,20 +10224,20 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
          {
             /* request was sent -- wait for the response */
             lrc = wait_for_completion_interruptible_timeout(
-                                        &powerContext.completion,
-                                        msecs_to_jiffies(WLAN_WAIT_TIME_POWER));
+                  &powerContext.completion,
+                  msecs_to_jiffies(WLAN_WAIT_TIME_POWER));
             if (lrc <= 0)
             {
                hddLog(VOS_TRACE_LEVEL_ERROR,
-                      "%s: %s while requesting full power",
-                      __func__, (0 == lrc) ? "timeout" : "interrupt");
+                     "%s: %s while requesting full power",
+                     __func__, (0 == lrc) ? "timeout" : "interrupt");
             }
          }
          else
          {
             hddLog(VOS_TRACE_LEVEL_ERROR,
-                   "%s: Request for Full Power failed, status %d",
-                   __func__, halStatus);
+                  "%s: Request for Full Power failed, status %d",
+                  __func__, halStatus);
             /* continue -- need to clean up as much as possible */
          }
       }
@@ -10263,6 +10270,10 @@ void hdd_wlan_exit(hdd_context_t *pHddCtx)
    // Unregister the Net Device Notifier
    unregister_netdevice_notifier(&hdd_netdev_notifier);
 
+   /* Stop all adapters, this will ensure the termination of active
+    * connections on the interface. Make sure the vos_scheduler is
+    * still available to handle those control messages
+    */
    hdd_stop_all_adapters( pHddCtx );
 
 #ifdef WLAN_BTAMP_FEATURE
@@ -10396,40 +10407,51 @@ free_hdd_ctx:
    !defined (QCA_WIFI_ISOC)
 void __hdd_wlan_exit(void)
 {
-        hdd_context_t *pHddCtx = NULL;
-        v_CONTEXT_t pVosContext = NULL;
+   hdd_context_t *pHddCtx = NULL;
+   v_CONTEXT_t pVosContext = NULL;
 
-        //Get the global vos context
-        pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+   ENTER();
 
-        if(!pVosContext)
-                return;
+   //Get the global vos context
+   pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
 
-        //Get the HDD context.
-        pHddCtx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD,
-                                                   pVosContext);
+   if(NULL == pVosContext) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+            "%s:Invalid global VOSS context", __func__);
+      EXIT();
+      return;
+   }
 
-        if(!pHddCtx)
-                return;
+   //Get the HDD context.
+   pHddCtx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD,
+         pVosContext);
 
-        /* module exit should never proceed if SSR is not completed */
-        while(pHddCtx->isLogpInProgress){
-                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
-                          "%s:SSR in Progress; block rmmod for 1 second!!!",
-                          __func__);
-                msleep(1000);
-        }
+   if(NULL == pHddCtx) {
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+            "%s:Invalid HDD Context", __func__);
+      EXIT();
+      return;
+   }
+
+   /* module exit should never proceed if SSR is not completed */
+   while(pHddCtx->isLogpInProgress){
+      VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+            "%s:SSR in Progress; block rmmod for 1 second!!!",
+            __func__);
+      msleep(1000);
+   }
 
-        pHddCtx->isUnloadInProgress = TRUE;
+   pHddCtx->isUnloadInProgress = TRUE;
 
-        vos_set_load_unload_in_progress(VOS_MODULE_ID_VOSS, TRUE);
+   vos_set_load_unload_in_progress(VOS_MODULE_ID_VOSS, TRUE);
 
 #ifdef WLAN_FEATURE_LPSS
-        wlan_hdd_send_status_pkg(NULL, NULL, 0, 0);
+   wlan_hdd_send_status_pkg(NULL, NULL, 0, 0);
 #endif
 
-        //Do all the cleanup before deregistering the driver
-        hdd_wlan_exit(pHddCtx);
+   //Do all the cleanup before deregistering the driver
+   hdd_wlan_exit(pHddCtx);
+   EXIT();
 }
 #endif  /* QCA_WIFI_2_0 && !QCA_WIFI_ISOC */
 
@@ -12042,6 +12064,7 @@ err_config:
 err_free_adf_context:
 #ifdef QCA_WIFI_2_0
    vos_mem_free(adf_ctx);
+   hif_deinit_adf_ctx(hif_sc);
 #endif
 
 err_free_hdd_context:
diff --git a/CORE/HDD/src/wlan_hdd_p2p.c b/CORE/HDD/src/wlan_hdd_p2p.c
index 71adf1bbba5a..64572fb0480e 100644
--- a/CORE/HDD/src/wlan_hdd_p2p.c
+++ b/CORE/HDD/src/wlan_hdd_p2p.c
@@ -723,10 +723,16 @@ int wlan_hdd_cfg80211_remain_on_channel( struct wiphy *wiphy,
 
 void hdd_remainChanReadyHandler( hdd_adapter_t *pAdapter )
 {
-    hdd_cfg80211_state_t *cfgState = WLAN_HDD_GET_CFG_STATE_PTR( pAdapter );
-    hdd_remain_on_chan_ctx_t* pRemainChanCtx;
+    hdd_cfg80211_state_t *cfgState = NULL;
+    hdd_remain_on_chan_ctx_t* pRemainChanCtx = NULL;
     VOS_STATUS status;
 
+    if (NULL == pAdapter)
+    {
+        hddLog(LOGE, FL("pAdapter is NULL"));
+        return;
+    }
+    cfgState = WLAN_HDD_GET_CFG_STATE_PTR( pAdapter );
     hddLog( LOG1, "Ready on chan ind");
 
     mutex_lock(&cfgState->remain_on_chan_ctx_lock);
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index 03d96dbcd2b0..bed31792b02f 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -616,6 +616,49 @@ static void *mem_alloc_copy_from_user_helper(const void *wrqu_data, size_t len)
 
 /**---------------------------------------------------------------------------
 
+  \brief hdd_priv_get_data -
+
+   Helper function to get compatible struct iw_point passed to ioctl
+
+  \param  - p_priv_data - pointer to iw_point struct to be filled
+            wrqu - Pointer to IOCTL Data received from userspace
+
+  \return - 0 if p_priv_data successfully filled
+            error otherwise
+
+  --------------------------------------------------------------------------*/
+int hdd_priv_get_data(struct iw_point *p_priv_data,
+                      union iwreq_data *wrqu)
+{
+   if ((NULL == p_priv_data) || (NULL == wrqu)) {
+      return -EINVAL;
+   }
+
+#ifdef CONFIG_COMPAT
+   if (is_compat_task()) {
+      struct compat_iw_point *p_compat_priv_data;
+
+      /* Compat task: typecast to compat structure and copy the members. */
+      p_compat_priv_data = (struct compat_iw_point *) &wrqu->data;
+
+      p_priv_data->pointer = compat_ptr(p_compat_priv_data->pointer);
+      p_priv_data->length  = p_compat_priv_data->length;
+      p_priv_data->flags   = p_compat_priv_data->flags;
+   } else {
+#endif /* #ifdef CONFIG_COMPAT */
+
+      /* Non compat task: directly copy the structure. */
+      memcpy(p_priv_data, &wrqu->data, sizeof(struct iw_point));
+
+#ifdef CONFIG_COMPAT
+   }
+#endif /* #ifdef CONFIG_COMPAT */
+
+   return 0;
+}
+
+/**---------------------------------------------------------------------------
+
   \brief hdd_wlan_get_version() -
 
    This function use to get Wlan Driver, Firmware, & Hardware Version.
diff --git a/CORE/MAC/inc/aniGlobal.h b/CORE/MAC/inc/aniGlobal.h
index 17b087ddde7c..c56aa7ba4ef2 100644
--- a/CORE/MAC/inc/aniGlobal.h
+++ b/CORE/MAC/inc/aniGlobal.h
@@ -994,6 +994,10 @@ typedef struct sMacOpenParameters
     tANI_U16 maxBssId;
     tANI_U32 frameTransRequired;
     tANI_U8 powersaveOffloadEnabled;
+    /* Powersave Parameters */
+    tANI_U8 staMaxLIModDtim;
+    tANI_U8 staModDtim;
+    tANI_U8 staDynamicDtim;
     tDriverType  driverType;
     tANI_U8 maxWoWFilters;
     tANI_U8 wowEnable;
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 82ce9c9dc4cc..6744a2dac6ae 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            129
+#define QWLAN_VERSION_BUILD            130
 
-#define QWLAN_VERSIONSTR               "1.0.0.129"
+#define QWLAN_VERSIONSTR               "1.0.0.130"
 
 #ifdef QCA_WIFI_2_0
 
diff --git a/CORE/MAC/src/pe/include/limSession.h b/CORE/MAC/src/pe/include/limSession.h
index 04e1598e460f..15146b1a0a22 100644
--- a/CORE/MAC/src/pe/include/limSession.h
+++ b/CORE/MAC/src/pe/include/limSession.h
@@ -64,6 +64,11 @@ typedef struct sPowersaveoffloadInfo
   ------------------------------------------------------------------------*/
 #define NUM_WEP_KEYS 4
 
+// Maximum allowable size of a beacon frame
+#define SCH_MAX_BEACON_SIZE    512
+
+#define SCH_MAX_PROBE_RESP_SIZE 512
+
 /*--------------------------------------------------------------------------
   Type declarations
   ------------------------------------------------------------------------*/
@@ -428,6 +433,17 @@ typedef struct sPESession           // Added to Support BT-AMP
     tANI_BOOLEAN isCiscoVendorAP;
 
     tSirAddIeParams     addIeParams;
+
+    tANI_U8 *pSchProbeRspTemplate;
+    // Beginning portion of the beacon frame to be written to TFP
+    tANI_U8 *pSchBeaconFrameBegin;
+    // Trailing portion of the beacon frame to be written to TFP
+    tANI_U8 *pSchBeaconFrameEnd;
+    // Size of the beginning portion
+    tANI_U16 schBeaconOffsetBegin;
+    // Size of the trailing portion
+    tANI_U16 schBeaconOffsetEnd;
+
 }tPESession, *tpPESession;
 
 #define LIM_MAX_ACTIVE_SESSIONS 4
@@ -442,20 +458,27 @@ typedef struct sPESession           // Added to Support BT-AMP
 
   \brief peCreateSession() - creates a new PE session given the BSSID
 
-  This function returns the session context and the session ID if the session
-  corresponding to the passed BSSID is found in the PE session table.
+  This function returns the session context and the session ID if the
+  session corresponding to the passed BSSID is found in the PE session
+  table.
 
-  \param pMac                   - pointer to global adapter context
-  \param bssid                   - BSSID of the new session
-  \param sessionId             -session ID is returned here, if session is created.
-
-  \return tpPESession          - pointer to the session context or NULL if session can not be created.
+  \param pMac                  - pointer to global adapter context
+  \param bssid                 - BSSID of the new session
+  \param sessionId             - session ID is returned here, if session is
+                                 created.
+  \param bssType               - bss type of new session to do conditional
+                                 memory allocation.
+  \return tpPESession          - pointer to the session context or NULL if
+                                 session can not be created.
 
   \sa
 
   --------------------------------------------------------------------------*/
-tpPESession peCreateSession(tpAniSirGlobal pMac, tANI_U8 *bssid , tANI_U8* sessionId, tANI_U16 numSta);
-
+tpPESession peCreateSession(tpAniSirGlobal pMac,
+                            tANI_U8 *bssid,
+                            tANI_U8* sessionId,
+                            tANI_U16 numSta,
+                            tSirBssType bssType);
 
 /*--------------------------------------------------------------------------
   \brief peFindSessionByBssid() - looks up the PE session given the BSSID.
diff --git a/CORE/MAC/src/pe/include/schGlobal.h b/CORE/MAC/src/pe/include/schGlobal.h
index 4c6c69fadd53..956bdba5205a 100644
--- a/CORE/MAC/src/pe/include/schGlobal.h
+++ b/CORE/MAC/src/pe/include/schGlobal.h
@@ -77,26 +77,7 @@
 
 //****************** MISC defs *********************************
 
-/// Maximum allowable size of a beacon frame
-#define SCH_MAX_BEACON_SIZE    512
-
-#define SCH_MAX_PROBE_RESP_SIZE 512
-
 struct schMisc {
-
-    tANI_U8 *gSchProbeRspTemplate;
-
-    /// Beginning portion of the beacon frame to be written to TFP
-    tANI_U8 *gSchBeaconFrameBegin;
-
-    /// Trailing portion of the beacon frame to be written to TFP
-    tANI_U8 *gSchBeaconFrameEnd;
-
-    /// Size of the beginning portion
-    tANI_U16 gSchBeaconOffsetBegin;
-    /// Size of the trailing portion
-    tANI_U16 gSchBeaconOffsetEnd;
-
     tANI_U16 gSchBeaconInterval;
 
     /// Current CFP count
diff --git a/CORE/MAC/src/pe/lim/limFT.c b/CORE/MAC/src/pe/lim/limFT.c
index 10366222dd6e..4bb7c48e9a4e 100644
--- a/CORE/MAC/src/pe/lim/limFT.c
+++ b/CORE/MAC/src/pe/lim/limFT.c
@@ -1199,7 +1199,8 @@ void limHandleFTPreAuthRsp(tpAniSirGlobal pMac, tSirRetStatus status,
     {
         pbssDescription = pMac->ft.ftPEContext.pFTPreAuthReq->pbssDescription;
         if((pftSessionEntry = peCreateSession(pMac, pbssDescription->bssId,
-                                              &sessionId, pMac->lim.maxStation)) == NULL)
+                                              &sessionId, pMac->lim.maxStation,
+                                              psessionEntry->bssType)) == NULL)
         {
             limLog(pMac, LOGE, FL("Session Can not be created for pre-auth 11R AP"));
             return;
diff --git a/CORE/MAC/src/pe/lim/limP2P.c b/CORE/MAC/src/pe/lim/limP2P.c
index 49b6a28f33c9..b237b85654dd 100644
--- a/CORE/MAC/src/pe/lim/limP2P.c
+++ b/CORE/MAC/src/pe/lim/limP2P.c
@@ -295,7 +295,8 @@ tSirRetStatus limCreateSessionForRemainOnChn(tpAniSirGlobal pMac, tPESession **p
     if(pMac->lim.gpLimRemainOnChanReq && ppP2pSession)
     {
         if((psessionEntry = peCreateSession(pMac,
-           pMac->lim.gpLimRemainOnChanReq->selfMacAddr, &sessionId, 1)) == NULL)
+           pMac->lim.gpLimRemainOnChanReq->selfMacAddr,
+           &sessionId, 1, eSIR_INFRA_AP_MODE)) == NULL)
         {
             limLog(pMac, LOGE, FL("Session Can not be created "));
             /* send remain on chn failure */
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index be161e5822ff..f2697a85bbac 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -572,7 +572,11 @@ __limHandleSmeStartBssRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         }
         else
         {
-            if((psessionEntry = peCreateSession(pMac,pSmeStartBssReq->bssId,&sessionId, pMac->lim.maxStation)) == NULL)
+            if((psessionEntry = peCreateSession(pMac,
+                                                pSmeStartBssReq->bssId,
+                                                &sessionId,
+                                                pMac->lim.maxStation,
+                                                pSmeStartBssReq->bssType)) == NULL)
             {
                 limLog(pMac, LOGW, FL("Session Can not be created "));
                 retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
@@ -1771,7 +1775,11 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         else       /* Session Entry does not exist for given BSSId */
         {
             /* Try to Create a new session */
-            if((psessionEntry = peCreateSession(pMac,pSmeJoinReq->bssDescription.bssId,&sessionId, pMac->lim.maxStation)) == NULL)
+            if((psessionEntry = peCreateSession(pMac,
+                    pSmeJoinReq->bssDescription.bssId,
+                    &sessionId,
+                    pMac->lim.maxStation,
+                    eSIR_INFRASTRUCTURE_MODE )) == NULL)
             {
                 limLog(pMac, LOGE, FL("Session Can not be created "));
                 retCode = eSIR_SME_RESOURCES_UNAVAILABLE;
diff --git a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
index b6b61af5d76a..762fe984bebf 100644
--- a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
@@ -610,7 +610,8 @@ limSendSmeStartBssRsp(tpAniSirGlobal pMac,
     {
         //subtract size of beaconLength + Mac Hdr + Fixed Fields before SSID
         ieOffset = sizeof(tAniBeaconStruct) + SIR_MAC_B_PR_SSID_OFFSET;
-        ieLen = pMac->sch.schObject.gSchBeaconOffsetBegin + pMac->sch.schObject.gSchBeaconOffsetEnd - ieOffset;
+        ieLen = psessionEntry->schBeaconOffsetBegin
+                    + psessionEntry->schBeaconOffsetEnd - ieOffset;
         //calculate the memory size to allocate
         size += ieLen;
 
@@ -650,14 +651,14 @@ limSendSmeStartBssRsp(tpAniSirGlobal pMac,
 
                 pSirSmeRsp->bssDescription.aniIndicator = 1;
 
-                curLen = pMac->sch.schObject.gSchBeaconOffsetBegin - ieOffset;
+                curLen = psessionEntry->schBeaconOffsetBegin - ieOffset;
                 vos_mem_copy( (tANI_U8 *) &pSirSmeRsp->bssDescription.ieFields,
-                           pMac->sch.schObject.gSchBeaconFrameBegin + ieOffset,
+                           psessionEntry->pSchBeaconFrameBegin + ieOffset,
                           (tANI_U32)curLen);
 
                 vos_mem_copy( ((tANI_U8 *) &pSirSmeRsp->bssDescription.ieFields) + curLen,
-                           pMac->sch.schObject.gSchBeaconFrameEnd,
-                          (tANI_U32)pMac->sch.schObject.gSchBeaconOffsetEnd);
+                           psessionEntry->pSchBeaconFrameEnd,
+                          (tANI_U32)psessionEntry->schBeaconOffsetEnd);
 
 
                 //subtracting size of length indicator itself and size of pointer to ieFields
diff --git a/CORE/MAC/src/pe/lim/limSession.c b/CORE/MAC/src/pe/lim/limSession.c
index fc20fba62c0c..f2bc5caf750c 100644
--- a/CORE/MAC/src/pe/lim/limSession.c
+++ b/CORE/MAC/src/pe/lim/limSession.c
@@ -90,16 +90,21 @@ void peInitBeaconParams(tpAniSirGlobal pMac, tpPESession psessionEntry)
   This function returns the session context and the session ID if the session
   corresponding to the passed BSSID is found in the PE session table.
 
-  \param pMac                   - pointer to global adapter context
-  \param bssid                   - BSSID of the new session
-  \param sessionId             -session ID is returned here, if session is created.
-
-  \return tpPESession          - pointer to the session context or NULL if session can not be created.
+  \param pMac          - pointer to global adapter context
+  \param bssid         - BSSID of the new session
+  \param sessionId     - session ID is returned here, if session is created.
+  \param bssType       - station or a
+  \return tpPESession  - pointer to the session context or NULL if session
+                         can not be created.
 
   \sa
 
   --------------------------------------------------------------------------*/
-tpPESession peCreateSession(tpAniSirGlobal pMac, tANI_U8 *bssid, tANI_U8* sessionId, tANI_U16 numSta)
+tpPESession peCreateSession(tpAniSirGlobal pMac,
+                            tANI_U8 *bssid,
+                            tANI_U8* sessionId,
+                            tANI_U16 numSta,
+                            tSirBssType bssType)
 {
     tANI_U8 i;
     for(i =0; i < pMac->lim.maxBssId; i++)
@@ -215,6 +220,38 @@ tpPESession peCreateSession(tpAniSirGlobal pMac, tANI_U8 *bssid, tANI_U8* sessio
                        FL("Failed to open ps offload for pe session %x\n"),i);
                 }
             }
+
+            if (eSIR_INFRA_AP_MODE == bssType ||
+                    eSIR_IBSS_MODE == bssType ||
+                        eSIR_BTAMP_AP_MODE == bssType)
+            {
+                 pMac->lim.gpSession[i].pSchProbeRspTemplate =
+                                 vos_mem_malloc(SCH_MAX_PROBE_RESP_SIZE);
+                 pMac->lim.gpSession[i].pSchBeaconFrameBegin =
+                                 vos_mem_malloc(SCH_MAX_BEACON_SIZE);
+                 pMac->lim.gpSession[i].pSchBeaconFrameEnd =
+                                 vos_mem_malloc(SCH_MAX_BEACON_SIZE);
+                 if ( (NULL == pMac->lim.gpSession[i].pSchProbeRspTemplate)
+                       || (NULL == pMac->lim.gpSession[i].pSchBeaconFrameBegin)
+                       || (NULL == pMac->lim.gpSession[i].pSchBeaconFrameEnd) )
+                 {
+                     PELOGE(limLog(pMac, LOGE, FL("memory allocate failed!"));)
+                     vos_mem_free(pMac->lim.gpSession[i].dph.dphHashTable.pHashTable);
+                     vos_mem_free(pMac->lim.gpSession[i].dph.dphHashTable.pDphNodeArray);
+                     vos_mem_free(pMac->lim.gpSession[i].gpLimPeerIdxpool);
+                     vos_mem_free(pMac->lim.gpSession[i].pSchProbeRspTemplate);
+                     vos_mem_free(pMac->lim.gpSession[i].pSchBeaconFrameBegin);
+                     vos_mem_free(pMac->lim.gpSession[i].pSchBeaconFrameEnd);
+
+                     pMac->lim.gpSession[i].dph.dphHashTable.pHashTable = NULL;
+                     pMac->lim.gpSession[i].dph.dphHashTable.pDphNodeArray = NULL;
+                     pMac->lim.gpSession[i].gpLimPeerIdxpool = NULL;
+                     pMac->lim.gpSession[i].pSchProbeRspTemplate = NULL;
+                     pMac->lim.gpSession[i].pSchBeaconFrameBegin = NULL;
+                     pMac->lim.gpSession[i].pSchBeaconFrameEnd = NULL;
+                     return NULL;
+                 }
+            }
             return(&pMac->lim.gpSession[i]);
         }
     }
@@ -506,6 +543,24 @@ void peDeleteSession(tpAniSirGlobal pMac, tpPESession psessionEntry)
         }
     }
 
+    if (NULL != psessionEntry->pSchProbeRspTemplate)
+    {
+        vos_mem_free(psessionEntry->pSchProbeRspTemplate);
+        psessionEntry->pSchProbeRspTemplate = NULL;
+    }
+
+    if (NULL != psessionEntry->pSchBeaconFrameBegin)
+    {
+        vos_mem_free(psessionEntry->pSchBeaconFrameBegin);
+        psessionEntry->pSchBeaconFrameBegin = NULL;
+    }
+
+    if (NULL != psessionEntry->pSchBeaconFrameEnd)
+    {
+        vos_mem_free(psessionEntry->pSchBeaconFrameEnd);
+        psessionEntry->pSchBeaconFrameEnd = NULL;
+    }
+
     psessionEntry->valid = FALSE;
     return;
 }
diff --git a/CORE/MAC/src/pe/pmm/pmmApi.c b/CORE/MAC/src/pe/pmm/pmmApi.c
index 1c97ad2ed0b8..d0fc561adf6f 100644
--- a/CORE/MAC/src/pe/pmm/pmmApi.c
+++ b/CORE/MAC/src/pe/pmm/pmmApi.c
@@ -3315,6 +3315,9 @@ tSirRetStatus pmmOffloadEnterBmpsReqHandler(tpAniSirGlobal pMac,
     /* Fill the Sme Session Id */
     pEnablePsReqParams->sessionid = psessionEntry->smeSessionId;
 
+    /* Fill the Last Beacon DTIM Period */
+    pEnablePsReqParams->bcnDtimPeriod = psessionEntry->lastBeaconDtimPeriod;
+
     /* Fill the additional power save setting */
     pEnablePsReqParams->psSetting = psReqData->addOnReq;
 
diff --git a/CORE/MAC/src/pe/sch/schApi.c b/CORE/MAC/src/pe/sch/schApi.c
index 481463ec5b07..ce13038c8693 100644
--- a/CORE/MAC/src/pe/sch/schApi.c
+++ b/CORE/MAC/src/pe/sch/schApi.c
@@ -65,9 +65,6 @@
 //                          Static Variables
 //
 //-------------------------------------------------------------------
-static tANI_U8 gSchProbeRspTemplate[SCH_MAX_PROBE_RESP_SIZE];
-static tANI_U8 gSchBeaconFrameBegin[SCH_MAX_BEACON_SIZE];
-static tANI_U8 gSchBeaconFrameEnd[SCH_MAX_BEACON_SIZE];
 
 // --------------------------------------------------------------------
 /**
@@ -185,11 +182,6 @@ schInitGlobals(tpAniSirGlobal pMac)
     pMac->sch.multipleSched = 1;
     pMac->sch.maxPollTimeouts = 20;
     pMac->sch.checkCfbFlagStuck = 0;
-
-    pMac->sch.schObject.gSchProbeRspTemplate = gSchProbeRspTemplate;
-    pMac->sch.schObject.gSchBeaconFrameBegin = gSchBeaconFrameBegin;
-    pMac->sch.schObject.gSchBeaconFrameEnd   = gSchBeaconFrameEnd;
-
 }
 
 // --------------------------------------------------------------------
@@ -305,12 +297,13 @@ tSirRetStatus schSendBeaconReq( tpAniSirGlobal pMac, tANI_U8 *beaconPayload, tAN
   }
   else
   {
-      beaconParams->timIeOffset = pMac->sch.schObject.gSchBeaconOffsetBegin;
+      beaconParams->timIeOffset = psessionEntry->schBeaconOffsetBegin;
   }
+
   /* p2pIeOffset should be atleast greater than timIeOffset */
   if ((pMac->sch.schObject.p2pIeOffset != 0) &&
           (pMac->sch.schObject.p2pIeOffset <
-           pMac->sch.schObject.gSchBeaconOffsetBegin))
+           psessionEntry->schBeaconOffsetBegin))
   {
       schLog(pMac, LOGE,FL("Invalid p2pIeOffset:[%d]"),
               pMac->sch.schObject.p2pIeOffset);
@@ -377,7 +370,7 @@ tANI_U32 limSendProbeRspTemplateToHal(tpAniSirGlobal pMac,tpPESession psessionEn
                                   ,tANI_U32* IeBitmap)
 {
     tSirMsgQ  msgQ;
-    tANI_U8 *pFrame2Hal = pMac->sch.schObject.gSchProbeRspTemplate;
+    tANI_U8 *pFrame2Hal = psessionEntry->pSchProbeRspTemplate;
     tpSendProbeRespParams pprobeRespParams=NULL;
     tANI_U32  retCode = eSIR_FAILURE;
     tANI_U32             nPayload,nBytes,nStatus;
diff --git a/CORE/MAC/src/pe/sch/schBeaconGen.c b/CORE/MAC/src/pe/sch/schBeaconGen.c
index 8769f4813dab..37b4930da565 100644
--- a/CORE/MAC/src/pe/sch/schBeaconGen.c
+++ b/CORE/MAC/src/pe/sch/schBeaconGen.c
@@ -176,7 +176,7 @@ tSirRetStatus schAppendAddnIE(tpAniSirGlobal pMac, tpPESession psessionEntry,
 tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEntry)
 {
     tpAniBeaconStruct pBeacon = (tpAniBeaconStruct)
-                                   pMac->sch.schObject.gSchBeaconFrameBegin;
+                          psessionEntry->pSchBeaconFrameBegin;
     tpSirMacMgmtHdr mac;
     tANI_U16        offset;
     tANI_U8        *ptr;
@@ -271,7 +271,7 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
     PopulateDot11fIBSSParams( pMac, &pBcn1->IBSSParams,psessionEntry);
 
     offset = sizeof( tAniBeaconStruct );
-    ptr    = pMac->sch.schObject.gSchBeaconFrameBegin + offset;
+    ptr    = psessionEntry->pSchBeaconFrameBegin + offset;
 
     if((psessionEntry->limSystemRole == eLIM_AP_ROLE)
         && (psessionEntry->proxyProbeRspEn))
@@ -307,7 +307,7 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
     }
     /*changed  to correct beacon corruption */
     vos_mem_set(( tANI_U8*) pBcn2, sizeof( tDot11fBeacon2 ), 0);
-    pMac->sch.schObject.gSchBeaconOffsetBegin = offset + ( tANI_U16 )nBytes;
+    psessionEntry->schBeaconOffsetBegin = offset + ( tANI_U16 )nBytes;
     schLog( pMac, LOG1, FL("Initialized beacon begin, offset %d"), offset );
 
     /*
@@ -466,7 +466,7 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
     }
 
     nStatus = dot11fPackBeacon2( pMac, pBcn2,
-                                 pMac->sch.schObject.gSchBeaconFrameEnd,
+                                 psessionEntry->pSchBeaconFrameEnd,
                                  SCH_MAX_BEACON_SIZE, &nBytes );
     if ( DOT11F_FAILED( nStatus ) )
     {
@@ -483,15 +483,15 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
                              "t11fBeacon2 (0x%08x.)."), nStatus );
     }
 
-    pExtraIe = pMac->sch.schObject.gSchBeaconFrameEnd + nBytes;
+    pExtraIe = psessionEntry->pSchBeaconFrameEnd + nBytes;
     extraIeOffset = nBytes;
 
     //TODO: Append additional IE here.
     schAppendAddnIE(pMac, psessionEntry,
-                    pMac->sch.schObject.gSchBeaconFrameEnd + nBytes,
+                    psessionEntry->pSchBeaconFrameEnd + nBytes,
                     SCH_MAX_BEACON_SIZE, &nBytes);
 
-    pMac->sch.schObject.gSchBeaconOffsetEnd = ( tANI_U16 )nBytes;
+    psessionEntry->schBeaconOffsetEnd = ( tANI_U16 )nBytes;
 
     extraIeLen = nBytes - extraIeOffset;
 
@@ -502,7 +502,7 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
     {
        //Update the P2P Ie Offset
        pMac->sch.schObject.p2pIeOffset =
-                    pMac->sch.schObject.gSchBeaconOffsetBegin + TIM_IE_SIZE +
+                    psessionEntry->schBeaconOffsetBegin + TIM_IE_SIZE +
                     extraIeOffset + p2pIeOffset;
     }
     else
@@ -511,7 +511,7 @@ tSirRetStatus schSetFixedBeaconFields(tpAniSirGlobal pMac,tpPESession psessionEn
     }
 
     schLog( pMac, LOG1, FL("Initialized beacon end, offset %d"),
-            pMac->sch.schObject.gSchBeaconOffsetEnd );
+            psessionEntry->schBeaconOffsetEnd );
 
     pMac->sch.schObject.fBeaconChanged = 1;
     vos_mem_free(pBcn1);
@@ -733,12 +733,12 @@ void writeBeaconToMemory(tpAniSirGlobal pMac, tANI_U16 size, tANI_U16 length, tp
     // copy end of beacon only if length > 0
     if (length > 0)
     {
-        for (i=0; i < pMac->sch.schObject.gSchBeaconOffsetEnd; i++)
-            pMac->sch.schObject.gSchBeaconFrameBegin[size++] = pMac->sch.schObject.gSchBeaconFrameEnd[i];
+        for (i=0; i < psessionEntry->schBeaconOffsetEnd; i++)
+            psessionEntry->pSchBeaconFrameBegin[size++] = psessionEntry->pSchBeaconFrameEnd[i];
     }
 
     // Update the beacon length
-    pBeacon = (tpAniBeaconStruct) pMac->sch.schObject.gSchBeaconFrameBegin;
+    pBeacon = (tpAniBeaconStruct) psessionEntry->pSchBeaconFrameBegin;
     // Do not include the beaconLength indicator itself
     if (length == 0)
     {
@@ -749,9 +749,9 @@ void writeBeaconToMemory(tpAniSirGlobal pMac, tANI_U16 size, tANI_U16 length, tp
     else
         pBeacon->beaconLength = (tANI_U32) size - sizeof( tANI_U32 );
 
-    // write size bytes from gSchBeaconFrameBegin
+    // write size bytes from pSchBeaconFrameBegin
     PELOG2(schLog(pMac, LOG2, FL("Beacon size - %d bytes"), size);)
-    PELOG2(sirDumpBuf(pMac, SIR_SCH_MODULE_ID, LOG2, pMac->sch.schObject.gSchBeaconFrameBegin, size);)
+    PELOG2(sirDumpBuf(pMac, SIR_SCH_MODULE_ID, LOG2, psessionEntry->pSchBeaconFrameBegin, size);)
 
     if (! pMac->sch.schObject.fBeaconChanged)
         return;
@@ -767,7 +767,7 @@ void writeBeaconToMemory(tpAniSirGlobal pMac, tANI_U16 size, tANI_U16 length, tp
         //
 
         size = (size + 3) & (~3);
-        if( eSIR_SUCCESS != schSendBeaconReq( pMac, pMac->sch.schObject.gSchBeaconFrameBegin,
+        if( eSIR_SUCCESS != schSendBeaconReq( pMac, psessionEntry->pSchBeaconFrameBegin,
                                               size, psessionEntry))
             PELOGE(schLog(pMac, LOGE, FL("schSendBeaconReq() returned an error (zsize %d)"), size);)
         else
@@ -797,7 +797,7 @@ void
 schProcessPreBeaconInd(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
 {
     tpBeaconGenParams  pMsg = (tpBeaconGenParams)limMsg->bodyptr;
-    tANI_U32 beaconSize = pMac->sch.schObject.gSchBeaconOffsetBegin;
+    tANI_U32 beaconSize;
     tpPESession psessionEntry;
     tANI_U8 sessionId;
 
@@ -808,6 +808,7 @@ schProcessPreBeaconInd(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
     }
 
 
+    beaconSize = psessionEntry->schBeaconOffsetBegin;
 
     // If SME is not in normal mode, no need to generate beacon
     if (psessionEntry->limSmeState  != eLIM_SME_NORMAL_STATE)
@@ -829,7 +830,7 @@ schProcessPreBeaconInd(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
         break;
 
     case eLIM_AP_ROLE:{
-         tANI_U8 *ptr = &pMac->sch.schObject.gSchBeaconFrameBegin[pMac->sch.schObject.gSchBeaconOffsetBegin];
+         tANI_U8 *ptr = &psessionEntry->pSchBeaconFrameBegin[psessionEntry->schBeaconOffsetBegin];
          tANI_U16 timLength = 0;
          if(psessionEntry->statypeForBss == STA_ENTRY_SELF){
              pmmGenerateTIM(pMac, &ptr, &timLength, psessionEntry->dtimPeriod);
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 553ba85aa59f..e2e82a7c989f 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -1339,39 +1339,18 @@ sapFsm
             }
             else if (msg == eSAP_HDD_STOP_INFRA_BSS)
             {
-                /* Transition from eSAP_STARTING to eSAP_DISCONNECTED */
+                /* Transition from eSAP_DFS_CAC_WAIT to eSAP_DISCONNECTING */
                 VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                         "In %s, from state %s => %s",
-                        __func__, "eSAP_DFS_CAC_WAIT", "eSAP_DISCONNECTIED");
+                        __func__,
+                        "eSAP_DFS_CAC_WAIT",
+                        "eSAP_DISCONNECTING");
 
                 /* stop CAC timer */
                 sapStopDfsCacTimer(sapContext);
 
-                /*Advance outer statevar */
-                sapContext->sapsMachine = eSAP_DISCONNECTED;
-                vosStatus = sapSignalHDDevent( sapContext,
-                                                NULL,
-                                                eSAP_START_BSS_EVENT,
-                                                (v_PVOID_t)eSAP_STATUS_FAILURE);
-                vosStatus = sapGotoDisconnected(sapContext);
-                /* Close the SME session*/
-
-                if (eSAP_TRUE == sapContext->isSapSessionOpen)
-                {
-                    tHalHandle hHal = VOS_GET_HAL_CB(sapContext->pvosGCtx);
-                    if (NULL == hHal)
-                    {
-                        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
-                                "In %s, NULL hHal in state %s, msg %d",
-                                __func__, "eSAP_DFS_CAC_WAIT", msg);
-                    }
-                    else if (eHAL_STATUS_SUCCESS ==
-                            sme_CloseSession(hHal,
-                                sapContext->sessionId, NULL, NULL))
-                    {
-                        sapContext->isSapSessionOpen = eSAP_FALSE;
-                    }
-                }
+                sapContext->sapsMachine = eSAP_DISCONNECTING;
+                vosStatus = sapGotoDisconnecting(sapContext);
             }
             else
             {
diff --git a/CORE/SERVICES/COMMON/targaddrs.h b/CORE/SERVICES/COMMON/targaddrs.h
index aa655c3febab..8aa816ee93d5 100644
--- a/CORE/SERVICES/COMMON/targaddrs.h
+++ b/CORE/SERVICES/COMMON/targaddrs.h
@@ -121,7 +121,8 @@ PREPACK64 struct host_interest_s {
     /* Pointer to debug logging header */
     A_UINT32               hi_dbglog_hdr;                             /* 0x08 */
 
-    A_UINT32               hi_unused0c;                               /* 0x0c */
+    /* Save SW ROM version */
+    A_UINT32               hi_sw_rom_version;                         /* 0x0c */
 
     /*
      * General-purpose flag bits, similar to SOC_OPTION_* flags.
diff --git a/CORE/SERVICES/COMMON/wmi_unified.h b/CORE/SERVICES/COMMON/wmi_unified.h
index 3f70e176def7..70e35ab942c4 100644
--- a/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/CORE/SERVICES/COMMON/wmi_unified.h
@@ -3479,6 +3479,11 @@ typedef enum {
     /** DTIM policy */
     WMI_VDEV_PARAM_DTIM_POLICY,
 
+    /* When IBSS network is initialized, PS-supporting device
+    * does not enter protocol sleep state during first
+    * WMI_VDEV_PARAM_IBSS_PS_WARMUP_TIME_SECS seconds. */
+    WMI_VDEV_PARAM_IBSS_PS_WARMUP_TIME_SECS,
+
 } WMI_VDEV_PARAM;
 
 /* Length of ATIM Window in TU */
@@ -4342,6 +4347,9 @@ typedef struct {
 /* Enable H/W retry and Enable H/W Send CTS2S before Data */
 #define WMI_PEER_SET_HW_RETRY_CTS2S                     0xB
 
+/* Set peer advertised IBSS atim window length */
+#define WMI_PEER_IBSS_ATIM_WINDOW_LENGTH                0xC
+
 /** mimo ps values for the parameter WMI_PEER_MIMO_PS_STATE  */
 #define WMI_PEER_MIMO_PS_NONE                          0x0
 #define WMI_PEER_MIMO_PS_STATIC                        0x1
diff --git a/CORE/SERVICES/COMMON/wmi_version.h b/CORE/SERVICES/COMMON/wmi_version.h
index 4f1dda5052ad..c7d4f8b3f6f3 100644
--- a/CORE/SERVICES/COMMON/wmi_version.h
+++ b/CORE/SERVICES/COMMON/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 51
+#define __WMI_REVISION_ 52
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work
diff --git a/CORE/SERVICES/HIF/PCIe/hif_pci.c b/CORE/SERVICES/HIF/PCIe/hif_pci.c
index 69d87807c149..792cef56a181 100644
--- a/CORE/SERVICES/HIF/PCIe/hif_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/hif_pci.c
@@ -1458,6 +1458,9 @@ hif_recv_buffer_cleanup_on_pipe(struct HIF_CE_pipe_info *pipe_info)
     scn = sc->ol_sc;
     ce_hdl = pipe_info->ce_hdl;
 
+    if (scn->adf_dev == NULL) {
+       return;
+    }
     while (CE_revoke_recv_next(ce_hdl, &per_CE_context, (void **)&netbuf, &CE_data) == A_OK)
     {
         adf_nbuf_unmap_single(scn->adf_dev, netbuf, ADF_OS_DMA_FROM_DEVICE);
diff --git a/CORE/SERVICES/HIF/PCIe/if_pci.c b/CORE/SERVICES/HIF/PCIe/if_pci.c
index 62ad134a151f..713e808e5263 100644
--- a/CORE/SERVICES/HIF/PCIe/if_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/if_pci.c
@@ -226,6 +226,13 @@ void hif_init_adf_ctx(adf_os_device_t adf_dev, void *ol_sc)
 	adf_dev->dev = hif_sc->aps_osdev.device;
 	sc->adf_dev = adf_dev;
 }
+
+void hif_deinit_adf_ctx(void *ol_sc)
+{
+	struct ol_softc *sc = (struct ol_softc *)ol_sc;
+	sc->adf_dev = NULL;
+}
+
 #define A_PCIE_LOCAL_REG_READ(mem, addr) \
         A_PCI_READ32((char *)(mem) + PCIE_LOCAL_BASE_ADDRESS + (A_UINT32)(addr))
 
@@ -995,7 +1002,7 @@ err_region:
  * power up WLAN host driver when SSR happens. Most of this
  * function is duplicated from hif_pci_probe().
  */
-#if defined(QCA_WIFI_2_0) && !defined(QCA_WIFI_ISOC)
+#if defined(QCA_WIFI_2_0) && !defined(QCA_WIFI_ISOC) && defined(CONFIG_CNSS)
 int hif_pci_reinit(struct pci_dev *pdev, const struct pci_device_id *id)
 {
     void __iomem *mem;
@@ -1603,7 +1610,7 @@ hif_pci_remove(struct pci_dev *pdev)
  * shutdown WLAN host driver when SSR happens. Most of this
  * function is duplicated from hif_pci_remove().
  */
-#if defined(QCA_WIFI_2_0) && !defined(QCA_WIFI_ISOC)
+#if defined(QCA_WIFI_2_0) && !defined(QCA_WIFI_ISOC) && defined(CONFIG_CNSS)
 void hif_pci_shutdown(struct pci_dev *pdev)
 {
     void __iomem *mem;
diff --git a/CORE/SERVICES/HIF/PCIe/if_pci.h b/CORE/SERVICES/HIF/PCIe/if_pci.h
index 1c3b49dce646..657a0e32e414 100644
--- a/CORE/SERVICES/HIF/PCIe/if_pci.h
+++ b/CORE/SERVICES/HIF/PCIe/if_pci.h
@@ -122,6 +122,7 @@ void hif_reset_soc(void *ol_sc);
 void hif_disable_aspm(void);
 
 void hif_init_adf_ctx(adf_os_device_t adf_dev, void *ol_sc);
+void hif_deinit_adf_ctx(void *ol_sc);
 
 void hif_pci_save_htc_htt_config_endpoint(int htc_endpoint);
 
diff --git a/CORE/SERVICES/HIF/USB/if_usb.c b/CORE/SERVICES/HIF/USB/if_usb.c
index 4cd2c193e591..61dd80406476 100644
--- a/CORE/SERVICES/HIF/USB/if_usb.c
+++ b/CORE/SERVICES/HIF/USB/if_usb.c
@@ -387,6 +387,12 @@ void hif_init_adf_ctx(adf_os_device_t adf_dev, void *ol_sc)
 	sc->adf_dev = adf_dev;
 }
 
+void hif_deinit_adf_ctx(void *ol_sc)
+{
+	struct ol_softc *sc = (struct ol_softc *)ol_sc;
+	sc->adf_dev = NULL;
+}
+
 static int is_usb_driver_register = 0;
 int hif_register_driver(void)
 {
diff --git a/CORE/SERVICES/HIF/USB/if_usb.h b/CORE/SERVICES/HIF/USB/if_usb.h
index cbada95f4902..fc923511c76e 100644
--- a/CORE/SERVICES/HIF/USB/if_usb.h
+++ b/CORE/SERVICES/HIF/USB/if_usb.h
@@ -92,6 +92,7 @@ void hif_init_pdev_txrx_handle(void *ol_sc, void *txrx_handle);
 void hif_disable_isr(void *ol_sc);
 void hif_reset_soc(void *ol_sc);
 void hif_init_adf_ctx(adf_os_device_t adf_dev, void *ol_sc);
+void hif_deinit_adf_ctx(void *ol_sc);
 
 #ifndef REMOVE_PKT_LOG
 extern int pktlogmod_init(void *context);
diff --git a/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c b/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c
index fd0d5c1efd13..9484cd060abc 100644
--- a/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c
+++ b/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c
@@ -290,6 +290,12 @@ void hif_init_adf_ctx(adf_os_device_t adf_dev, void *ol_sc)
    EXIT();
 }
 
+void hif_deinit_adf_ctx(void *ol_sc)
+{
+   struct ol_softc *sc = (struct ol_softc *)ol_sc;
+   sc->adf_dev = NULL;
+}
+
 void hif_init_pdev_txrx_handle(void *ol_sc, void *txrx_handle)
 {
    struct ol_softc *sc = (struct ol_softc *)ol_sc;
diff --git a/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.h b/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.h
index 03f3d81ba6eb..d4847cc8b076 100644
--- a/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.h
+++ b/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.h
@@ -88,6 +88,7 @@ int ath_sdio_resume(void *context);
 int hif_register_driver(void);
 void hif_unregister_driver(void);
 void hif_init_adf_ctx(adf_os_device_t adf_dev, void *ol_sc);
+void hif_deinit_adf_ctx(void *ol_sc);
 void hif_disable_isr(void *ol_sc);
 void hif_init_pdev_txrx_handle(void *ol_sc, void *txrx_handle);
 void hif_reset_soc(void *ol_sc);
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index a2936c46aacb..806c86079758 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -240,6 +240,9 @@ static void wma_set_stakey(tp_wma_handle wma_handle, tpSetStaKeyParams key_info)
 
 static void wma_beacon_miss_handler(tp_wma_handle wma, u_int32_t vdev_id);
 
+static void wma_set_suspend_dtim(tp_wma_handle wma);
+static void wma_set_resume_dtim(tp_wma_handle wma);
+
 static void *wma_find_vdev_by_addr(tp_wma_handle wma, u_int8_t *addr,
 				   u_int8_t *vdev_id)
 {
@@ -3392,6 +3395,9 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 	 * 4 - QPower + Deepsleep Enabled
 	 */
 	wma_handle->powersave_mode = mac_params->powersaveOffloadEnabled;
+	wma_handle->staMaxLIModDtim = mac_params->staMaxLIModDtim;
+	wma_handle->staModDtim = mac_params->staModDtim;
+	wma_handle->staDynamicDtim = mac_params->staDynamicDtim;
 
 	/*
 	 * Value of mac_params->wowEnable can be,
@@ -4663,6 +4669,7 @@ VOS_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle,
 	u_int32_t *tmp_ptr, ie_len_with_pad;
 	VOS_STATUS vos_status = VOS_STATUS_E_FAILURE;
 	u_int8_t *buf_ptr;
+	u_int32_t dwell_time;
 	int i;
 	int len = sizeof(*cmd);
 	tpAniSirGlobal pMac = (tpAniSirGlobal )vos_get_context(VOS_MODULE_ID_PE,
@@ -4725,13 +4732,27 @@ VOS_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle,
 				WMI_SCAN_EVENT_PREEMPTED |
 				WMI_SCAN_EVENT_RESTARTED;
 
-	/* CSR sends min and max dwell time values, but expects the firmware
-	 * to use only max dwell time value. It does not send separate values
-	 * for active and passive. We use the same value for now.
-	 * CSR will pass 40 or 110 ms as maxChannelTime value to us.
-	 */
 	cmd->dwell_time_active = scan_req->maxChannelTime;
-	cmd->dwell_time_passive = scan_req->maxChannelTime;
+
+	if (scan_req->scanType == eSIR_ACTIVE_SCAN) {
+		/* In Active scan case, the firmware has to do passive scan on DFS channels
+		 * So the passive scan duration should be updated properly so that the duration
+		 * will be sufficient enough to receive the beacon from AP */
+
+		if (wlan_cfgGetInt(pMac, WNI_CFG_PASSIVE_MAXIMUM_CHANNEL_TIME,
+					&dwell_time) != eSIR_SUCCESS) {
+			WMA_LOGE("Failed to get passive max channel value"
+					"using default value");
+			dwell_time = WMA_DWELL_TIME_PASSIVE_DEFAULT;
+		}
+		cmd->dwell_time_passive = dwell_time;
+	}
+	else
+		cmd->dwell_time_passive = scan_req->maxChannelTime;
+
+	WMA_LOGI("Scan Type %x, Active dwell time %u, Passive dwell time %u",
+			scan_req->scanType, cmd->dwell_time_active,
+			cmd->dwell_time_passive);
 
 	/* Ensure correct number of probes are sent on active channel */
 	cmd->repeat_probe_time = cmd->dwell_time_active / WMA_SCAN_NPROBES_DEFAULT;
@@ -6893,6 +6914,12 @@ static VOS_STATUS wma_vdev_start(tp_wma_handle wma,
 				return VOS_STATUS_E_FAILURE;
 			}
 
+			if (wma->dfs_ic->ic_curchan)
+			{
+				OS_FREE(wma->dfs_ic->ic_curchan);
+				wma->dfs_ic->ic_curchan = NULL;
+			}
+
 			/* provide the current channel to DFS */
 			wma->dfs_ic->ic_curchan =
 				wma_dfs_configure_channel(wma->dfs_ic,chan,chanmode,req);
@@ -8281,6 +8308,15 @@ static int32_t wmi_unified_set_sta_ps_param(wmi_unified_t wmi_handle,
 	wmi_sta_powersave_param_cmd_fixed_param *cmd;
 	wmi_buf_t buf;
 	int32_t len = sizeof(*cmd);
+	tp_wma_handle wma;
+	struct wma_txrx_node *iface;
+	wma = vos_get_context(VOS_MODULE_ID_WDA,
+			vos_get_global_context(VOS_MODULE_ID_WDA, NULL));
+	if (NULL == wma) {
+		WMA_LOGE("%s: wma is NULL", __func__);
+		return -EIO;
+	}
+	iface = &wma->interfaces[vdev_id];
 
 	WMA_LOGD("Set Sta Ps param vdevId %d Param %d val %d",
 		      vdev_id, param, value);
@@ -8307,6 +8343,8 @@ static int32_t wmi_unified_set_sta_ps_param(wmi_unified_t wmi_handle,
 		adf_nbuf_free(buf);
 		return -EIO;
 	}
+	/* Store the PS Status */
+	iface->ps_enabled = value ? TRUE : FALSE;
 	return 0;
 }
 
@@ -9860,17 +9898,11 @@ static void wma_add_bss_sta_mode(tp_wma_handle wma, tpAddBssParams add_bss)
 		}
 #endif /* WLAN_FEATURE_11W */
 
-		if (add_bss->staContext.encryptType == eSIR_ED_NONE) {
-			WMA_LOGD("%s: send peer authorize wmi cmd for %pM",
-				 __func__, add_bss->bssId);
-			wma_set_peer_param(wma, add_bss->bssId,
-					   WMI_PEER_AUTHORIZE, 1,
-					   add_bss->staContext.smesessionId);
-			wma_vdev_set_bss_params(wma, add_bss->staContext.smesessionId,
-					add_bss->beaconInterval, add_bss->dtimPeriod,
-					add_bss->shortSlotTimeSupported, add_bss->llbCoexist,
-					add_bss->maxTxPower);
-		}
+		wma_vdev_set_bss_params(wma, add_bss->staContext.smesessionId,
+				add_bss->beaconInterval, add_bss->dtimPeriod,
+				add_bss->shortSlotTimeSupported, add_bss->llbCoexist,
+				add_bss->maxTxPower);
+
 		/*
 		 * Store the bssid in interface table, bssid will
 		 * be used during group key setting sta mode.
@@ -10136,18 +10168,6 @@ static void wma_add_sta_req_ap_mode(tp_wma_handle wma, tpAddStaParams add_sta)
 		wma_remove_peer(wma, add_sta->staMac, add_sta->smesessionId, peer);
 		goto send_rsp;
 	}
-	if (add_sta->encryptType == eSIR_ED_NONE) {
-		ret = wma_set_peer_param(wma, add_sta->staMac,
-					 WMI_PEER_AUTHORIZE, 1,
-					 add_sta->smesessionId);
-		if (ret) {
-			add_sta->status = VOS_STATUS_E_FAILURE;
-			wma_remove_peer(wma, add_sta->staMac,
-					add_sta->smesessionId, peer);
-			goto send_rsp;
-		}
-		state = ol_txrx_peer_state_auth;
-	}
 #ifdef WLAN_FEATURE_11W
 	if (add_sta->rmfEnabled) {
 		/*
@@ -10540,13 +10560,6 @@ static void wma_add_sta_req_sta_mode(tp_wma_handle wma, tpAddStaParams params)
 						  ol_txrx_peer_state_conn);
 		}
 
-		if (params->encryptType == eSIR_ED_NONE) {
-			WMA_LOGD("%s: send peer authorize wmi cmd for %pM",
-				 __func__, params->bssId);
-			wma_set_peer_param(wma, params->bssId,
-					   WMI_PEER_AUTHORIZE, 1,
-					   params->smesessionId);
-		}
 		wmi_unified_send_txbf(wma, params);
 
                 wmi_unified_send_peer_assoc(wma,
@@ -12523,6 +12536,7 @@ static void wma_enable_sta_ps_mode(tp_wma_handle wma, tpEnablePsParams ps_req)
 	uint32_t vdev_id = ps_req->sessionid;
 	int32_t ret;
 	u_int8_t is_qpower_enabled = wma_is_qpower_enabled(wma);
+	struct wma_txrx_node *iface = &wma->interfaces[vdev_id];
 
 	if (eSIR_ADDON_NOTHING == ps_req->psSetting) {
 		WMA_LOGD("Enable Sta Mode Ps vdevId %d", vdev_id);
@@ -12545,7 +12559,6 @@ static void wma_enable_sta_ps_mode(tp_wma_handle wma, tpEnablePsParams ps_req)
 		}
 	} else if (eSIR_ADDON_ENABLE_UAPSD == ps_req->psSetting) {
 		u_int32_t uapsd_val = 0;
-		struct wma_txrx_node *iface = &wma->interfaces[vdev_id];
 		uapsd_val = wma_get_uapsd_mask(&ps_req->uapsdParams);
 
 		if(uapsd_val != iface->uapsd_cached_val) {
@@ -12581,6 +12594,7 @@ static void wma_enable_sta_ps_mode(tp_wma_handle wma, tpEnablePsParams ps_req)
 		}
 	}
 	ps_req->status = VOS_STATUS_SUCCESS;
+	iface->dtimPeriod = ps_req->bcnDtimPeriod;
 resp:
 	wma_send_msg(wma, WDA_ENTER_BMPS_RSP, ps_req, 0);
 }
@@ -14275,6 +14289,8 @@ static VOS_STATUS wma_resume_req(tp_wma_handle wma)
 	}
 
 end:
+	/* Reset the DTIM Parameters */
+	wma_set_resume_dtim(wma);
 	/* need to reset if hif_pci_suspend_fails */
 	wma_set_wow_bus_suspend(wma, 0);
 	/* unpause the vdev if left paused and hif_pci_suspend fails */
@@ -14743,6 +14759,8 @@ enable_wow:
 	vos_mem_free(info);
 
 send_ready_to_suspend:
+	/* Set the Suspend DTIM Parameters */
+	wma_set_suspend_dtim(wma);
 	wma_send_status_to_suspend_ind(wma, TRUE);
 
 	/* to handle race between hif_pci_suspend and
@@ -21945,3 +21963,155 @@ void WDA_TxAbort(v_U8_t vdev_id)
 	wmi_unified_peer_flush_tids_send(wma->wmi_handle, iface->bssid,
 					 peer_tid_bitmap, vdev_id);
 }
+
+static void wma_set_vdev_suspend_dtim(tp_wma_handle wma, v_U8_t vdev_id)
+{
+	struct wma_txrx_node *iface = &wma->interfaces[vdev_id];
+	u_int8_t is_qpower_enabled = wma_is_qpower_enabled(wma);
+
+	if ((iface->type == WMI_VDEV_TYPE_STA) &&
+		(iface->ps_enabled == TRUE) &&
+		!is_qpower_enabled &&
+		(iface->dtimPeriod != 0)) {
+		int32_t ret;
+		u_int32_t listen_interval;
+		u_int32_t max_mod_dtim;
+
+		if (wma->staDynamicDtim) {
+			if (iface->dtimPeriod <
+				WMA_DYNAMIC_DTIM_SETTING_THRESHOLD) {
+				/* Set DTIM Policy to Normal DTIM */
+				/* Configure LI = Dynamic DTIM Value */
+				listen_interval = wma->staDynamicDtim;
+			} else {
+				return;
+			}
+		} else if ((wma->staModDtim)&& (wma->staMaxLIModDtim)) {
+			/*
+			  * When the system is in suspend
+			  * (maximum beacon will be at 1s == 10)
+			  * If maxModulatedDTIM ((MAX_LI_VAL = 10) / AP_DTIM)
+			  * equal or larger than MDTIM (configured in WCNSS_qcom_cfg.ini)
+			  * Set LI to MDTIM * AP_DTIM
+			  * If Dtim = 2 and Mdtim = 2 then LI is 4
+			  * Else
+			  * Set LI to maxModulatedDTIM * AP_DTIM
+			  */
+			max_mod_dtim = wma->staMaxLIModDtim/iface->dtimPeriod;
+			if (max_mod_dtim >= wma->staModDtim) {
+				listen_interval =
+					(wma->staModDtim * iface->dtimPeriod);
+			} else {
+				listen_interval =
+					(max_mod_dtim * iface->dtimPeriod);
+			}
+		} else {
+			return;
+		}
+
+		ret = wmi_unified_vdev_set_param_send(wma->wmi_handle, vdev_id,
+							WMI_VDEV_PARAM_LISTEN_INTERVAL,
+							listen_interval);
+		if (ret) {
+			/* Even it fails continue Fw will take default LI */
+			WMA_LOGE("Failed to Set Listen Interval vdevId %d",
+				vdev_id);
+		}
+
+		WMA_LOGD("Set Listen Interval vdevId %d Listen Intv %d",
+			vdev_id, listen_interval);
+
+		ret = wmi_unified_vdev_set_param_send(wma->wmi_handle, vdev_id,
+							WMI_VDEV_PARAM_DTIM_POLICY ,
+							NORMAL_DTIM);
+		if (ret) {
+			/* Set it to Normal DTIM */
+			WMA_LOGE("Failed to Set to Normal DTIM vdevId %d",
+					vdev_id);
+		}
+		iface->dtim_policy = NORMAL_DTIM;
+		WMA_LOGD("Set DTIM Policy to Normal Dtim vdevId %d", vdev_id);
+	}
+}
+
+static void wma_set_suspend_dtim(tp_wma_handle wma)
+{
+	u_int8_t i;
+
+	if (NULL == wma) {
+		WMA_LOGE("%s: wma is NULL", __func__);
+		return;
+	}
+
+	for (i = 0; i < wma->max_bssid; i++) {
+		if (wma->interfaces[i].handle) {
+			wma_set_vdev_suspend_dtim(wma, i);
+		}
+	}
+}
+
+static void wma_set_vdev_resume_dtim(tp_wma_handle wma, v_U8_t vdev_id)
+{
+	struct wma_txrx_node *iface = &wma->interfaces[vdev_id];
+	u_int8_t is_qpower_enabled = wma_is_qpower_enabled(wma);
+
+	if ((iface->type == WMI_VDEV_TYPE_STA) &&
+		(iface->ps_enabled == TRUE) &&
+		!is_qpower_enabled &&
+		(iface->dtim_policy == NORMAL_DTIM)) {
+		int32_t ret;
+		tANI_U32 cfg_data_val = 0;
+		/* get mac to acess CFG data base */
+		struct sAniSirGlobal *mac =
+		(struct sAniSirGlobal*)vos_get_context(VOS_MODULE_ID_PE,
+							wma->vos_context);
+		/* Set Listen Interval */
+		if ((NULL == mac) || (wlan_cfgGetInt(mac,
+				WNI_CFG_LISTEN_INTERVAL,
+				&cfg_data_val ) != eSIR_SUCCESS)) {
+			VOS_TRACE( VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_ERROR,
+				"Failed to get value for listen interval");
+			cfg_data_val = POWERSAVE_DEFAULT_LISTEN_INTERVAL;
+		}
+
+		ret = wmi_unified_vdev_set_param_send(wma->wmi_handle, vdev_id,
+							WMI_VDEV_PARAM_LISTEN_INTERVAL,
+							cfg_data_val);
+		if (ret) {
+			/* Even it fails continue Fw will take default LI */
+			WMA_LOGE("Failed to Set Listen Interval vdevId %d",
+				vdev_id);
+		}
+
+		WMA_LOGD("Set Listen Interval vdevId %d Listen Intv %d",
+			vdev_id, cfg_data_val);
+
+		ret = wmi_unified_vdev_set_param_send(wma->wmi_handle, vdev_id,
+							WMI_VDEV_PARAM_DTIM_POLICY ,
+							STICK_DTIM);
+		if (ret) {
+			/* Set it back to Stick DTIM */
+			WMA_LOGE("Failed to Set to Stick DTIM vdevId %d",
+				vdev_id);
+		}
+		iface->dtim_policy = STICK_DTIM;
+		WMA_LOGD("Set DTIM Policy to Stick Dtim vdevId %d", vdev_id);
+	}
+}
+
+static void wma_set_resume_dtim(tp_wma_handle wma)
+{
+	u_int8_t i;
+
+	if (NULL == wma) {
+		WMA_LOGE("%s: wma is NULL", __func__);
+		return;
+	}
+
+	for (i = 0; i < wma->max_bssid; i++) {
+		if (wma->interfaces[i].handle) {
+			wma_set_vdev_resume_dtim(wma, i);
+		}
+	}
+}
+
diff --git a/CORE/SERVICES/WMA/wma.h b/CORE/SERVICES/WMA/wma.h
index 42686c7b4427..7f25e3606aeb 100644
--- a/CORE/SERVICES/WMA/wma.h
+++ b/CORE/SERVICES/WMA/wma.h
@@ -148,6 +148,7 @@
 #define WMA_CTS_DURATION_MS_MAX             (32)
 #define WMA_GO_MIN_ACTIVE_SCAN_BURST_DURATION   (40)
 #define WMA_GO_MAX_ACTIVE_SCAN_BURST_DURATION   (120)
+#define WMA_DWELL_TIME_PASSIVE_DEFAULT          (110)
 
 /* Roaming default values
  * All time and period values are in milliseconds.
@@ -489,6 +490,8 @@ struct wma_txrx_node {
 #if defined WLAN_FEATURE_VOWIFI_11R
         void    *staKeyParams;
 #endif
+	v_BOOL_t ps_enabled;
+	u_int32_t dtim_policy;
 };
 
 #if defined(QCA_WIFI_FTM) && !defined(QCA_WIFI_ISOC)
@@ -663,6 +666,10 @@ typedef struct {
 	u_int16_t RArateLimitInterval;
 #endif
 
+	/* Powersave Configuration Parameters */
+	u_int8_t staMaxLIModDtim;
+	u_int8_t staModDtim;
+	u_int8_t staDynamicDtim;
 }t_wma_handle, *tp_wma_handle;
 
 struct wma_target_cap {
@@ -1585,4 +1592,5 @@ enum uapsd_up {
 };
 
 #define WMA_TGT_INVALID_SNR (-1)
+#define WMA_DYNAMIC_DTIM_SETTING_THRESHOLD 2
 #endif
diff --git a/CORE/VOSS/src/vos_api.c b/CORE/VOSS/src/vos_api.c
index 0c608260b4fa..3e525fe706da 100644
--- a/CORE/VOSS/src/vos_api.c
+++ b/CORE/VOSS/src/vos_api.c
@@ -412,6 +412,9 @@ VOS_STATUS vos_open( v_CONTEXT_t *pVosContext, v_SIZE_t hddContextSize )
    macOpenParms.driverType         = eDRIVER_TYPE_PRODUCTION;
    macOpenParms.powersaveOffloadEnabled =
       pHddCtx->cfg_ini->enablePowersaveOffload;
+   macOpenParms.staDynamicDtim = pHddCtx->cfg_ini->enableDynamicDTIM;
+   macOpenParms.staModDtim = pHddCtx->cfg_ini->enableModulatedDTIM;
+   macOpenParms.staMaxLIModDtim = pHddCtx->cfg_ini->fMaxLIModulatedDTIM;
    macOpenParms.wowEnable          = pHddCtx->cfg_ini->wowEnable;
    macOpenParms.maxWoWFilters      = pHddCtx->cfg_ini->maxWoWFilters;
   /* Here olIniInfo is used to store ini status of arp offload
diff --git a/CORE/VOSS/src/vos_sched.c b/CORE/VOSS/src/vos_sched.c
index fd2685e427a4..6720d0910a46 100644
--- a/CORE/VOSS/src/vos_sched.c
+++ b/CORE/VOSS/src/vos_sched.c
@@ -76,7 +76,7 @@
 /* MAX iteration count to wait for Entry point to exit before
  * we proceed with SSR in WD Thread
  */
-#define MAX_SSR_WAIT_ITERATIONS 75
+#define MAX_SSR_WAIT_ITERATIONS 100
 
 static atomic_t ssr_protect_entry_count;
 
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index 97e14490a24b..61ce84a4d6d6 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -2250,6 +2250,9 @@ typedef struct sEnablePsParams
     /* SmeSession Id or Vdev Id */
     tANI_U32 sessionid;
 
+    /* Beacon DTIM Period */
+    tANI_U8 bcnDtimPeriod;
+
     /* success or failure */
     tANI_U32   status;
 }tEnablePsParams, *tpEnablePsParams;
diff --git a/firmware_bin/WCNSS_qcom_cfg.ini b/firmware_bin/WCNSS_qcom_cfg.ini
index f8ab0f6108c7..713b3b898141 100755
--- a/firmware_bin/WCNSS_qcom_cfg.ini
+++ b/firmware_bin/WCNSS_qcom_cfg.ini
@@ -478,7 +478,7 @@ gEnablefwlog=1
 #bit2 IPv6 enable
 #bit3 IPA Resource Manager (RM) enable
 #bit4 IPA Clock scaling enable
-gIPAConfig=0x0f
+gIPAConfig=0x1f
 gIPADescSize=800
 gIPAHighBandwidthMbps=400
 gIPAMediumBandwidthMbps=200