Merge remote-tracking branch 'origin/caf/caf-wlan/master'

33 files changed, 517 insertions, 79 deletions

diff --git a/CORE/BAP/src/bapModule.c b/CORE/BAP/src/bapModule.c
index 2fd8c37725d7..88b27af5c30d 100644
--- a/CORE/BAP/src/bapModule.c
+++ b/CORE/BAP/src/bapModule.c
@@ -1223,8 +1223,13 @@ WLANBAP_ReadMacConfig
 
   ccmCfgGetStr( pMac, WNI_CFG_STA_ID, pBtStaOwnMacAddr, &len );
 
-  VOS_ASSERT( WNI_CFG_BSSID_LEN == len );
-  
+  if (WNI_CFG_BSSID_LEN != len)
+  {
+      VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR,
+                   "len is improper %s", __func__);
+      return;
+  }
+
   /* Form the SSID from Mac address */
   VOS_SNPRINTF( pBtStaOwnSsid, WLAN_BAP_SSID_MAX_LEN,
             "AMP-%02x-%02x-%02x-%02x-%02x-%02x",
diff --git a/CORE/BAP/src/bapRsn8021xAuthFsm.c b/CORE/BAP/src/bapRsn8021xAuthFsm.c
index 2ce59a78c530..98ba3d16483f 100644
--- a/CORE/BAP/src/bapRsn8021xAuthFsm.c
+++ b/CORE/BAP/src/bapRsn8021xAuthFsm.c
@@ -1017,7 +1017,11 @@ int derivePtk(tAuthRsnFsm *fsm, tAniEapolKeyAvailEventData *data)
     v_U32_t prfLen;
     tAniEapolRsnKeyDesc *rxDesc;
 
-    VOS_ASSERT(fsm->staCtx->pmk);
+    if (NULL == fsm->staCtx->pmk)
+    {
+       VOS_ASSERT(0);
+       return ANI_E_NULL_VALUE;
+    }
 
     switch (fsm->staCtx->pwCipherType) 
     {
diff --git a/CORE/BAP/src/bapRsn8021xPrf.c b/CORE/BAP/src/bapRsn8021xPrf.c
index ebd50fa7de4d..4b8a7e01be54 100644
--- a/CORE/BAP/src/bapRsn8021xPrf.c
+++ b/CORE/BAP/src/bapRsn8021xPrf.c
@@ -249,8 +249,12 @@ aagPrf(v_U32_t cryptHandle,
 
     for (i = 0; i < numLoops; i++) 
     {
-        VOS_ASSERT((resultOffset - result + VOS_DIGEST_SHA1_SIZE)
-               <= AAG_PRF_MAX_OUTPUT_SIZE);
+        if ((resultOffset - result + VOS_DIGEST_SHA1_SIZE) > AAG_PRF_MAX_OUTPUT_SIZE)
+        {
+            VOS_ASSERT(0);
+            return ANI_ERROR;
+        }
+
         hmacText[loopCtrPos] = i;
         if( VOS_IS_STATUS_SUCCESS( vos_sha1_hmac_str(cryptHandle, hmacText, loopCtrPos + 1, key, keyLen, resultOffset) ) )
         {
diff --git a/CORE/BAP/src/bapRsnSsmAesKeyWrap.c b/CORE/BAP/src/bapRsnSsmAesKeyWrap.c
index 0e8858cb4fc1..398a0be95e23 100644
--- a/CORE/BAP/src/bapRsnSsmAesKeyWrap.c
+++ b/CORE/BAP/src/bapRsnSsmAesKeyWrap.c
@@ -273,8 +273,6 @@ aes(v_U32_t cryptHandle, tANI_U8 *keyBytes, tANI_U32 keyLen,
     tANI_U8 in[AES_BLOCK_SIZE];
     tANI_U8 *out;
 
-    VOS_ASSERT (AES_BLOCK_SIZE == ANI_SSM_AES_KEY_WRAP_BLOCK_SIZE*2);
-
     // Concatenate A and R[i]
     vos_mem_copy(in, a, ANI_SSM_AES_KEY_WRAP_BLOCK_SIZE);
     vos_mem_copy(in + ANI_SSM_AES_KEY_WRAP_BLOCK_SIZE, 
@@ -317,8 +315,6 @@ aes_1(v_U32_t cryptHandle, tANI_U8 *keyBytes, tANI_U32 keyLen,
     tANI_U8 in[AES_BLOCK_SIZE];
     tANI_U8 *out;
 
-    VOS_ASSERT (AES_BLOCK_SIZE == ANI_SSM_AES_KEY_WRAP_BLOCK_SIZE*2);
-
     // Concatenate A and R[i]
     vos_mem_copy(in, at, ANI_SSM_AES_KEY_WRAP_BLOCK_SIZE);
     vos_mem_copy(in + ANI_SSM_AES_KEY_WRAP_BLOCK_SIZE, 
diff --git a/CORE/BAP/src/bapRsnSsmEapol.c b/CORE/BAP/src/bapRsnSsmEapol.c
index ea39c7bd4cd3..14f2f93a9c79 100644
--- a/CORE/BAP/src/bapRsnSsmEapol.c
+++ b/CORE/BAP/src/bapRsnSsmEapol.c
@@ -1099,7 +1099,12 @@ int bapRsnFormPktFromVosPkt( tAniPacket **ppPacket, vos_pkt_t *pVosPacket )
         if( !ANI_IS_STATUS_SUCCESS( retVal ) ) break;
         //Get the rest of the data in
         uPktLen -= BAP_RSN_ETHERNET_3_HEADER_LEN;
-        VOS_ASSERT( uPktLen > 0 );
+        if (uPktLen <= 0){
+           VOS_ASSERT(0);
+           retVal = ANI_ERROR;
+           break;
+        }
+
         retVal = aniAsfPacketAppendBuffer( pAniPacket, pFrame + BAP_RSN_ETHERNET_3_HEADER_LEN, 
                             uPktLen );
         if( !ANI_IS_STATUS_SUCCESS( retVal ) ) 
diff --git a/CORE/CLD_TXRX/HTT/htt_rx.c b/CORE/CLD_TXRX/HTT/htt_rx.c
index 11783cfcfad0..2d66b252d8cf 100644
--- a/CORE/CLD_TXRX/HTT/htt_rx.c
+++ b/CORE/CLD_TXRX/HTT/htt_rx.c
@@ -1414,6 +1414,10 @@ a_bool_t (*htt_rx_mpdu_is_encrypted)(
     htt_pdev_handle pdev,
     void *mpdu_desc);
 
+a_bool_t (*htt_rx_msdu_desc_key_id)(
+    htt_pdev_handle pdev,
+    void *mpdu_desc, u_int8_t *key_id);
+
 void *
 htt_rx_mpdu_desc_list_next_ll(htt_pdev_handle pdev, adf_nbuf_t rx_ind_msg)
 {
@@ -1485,6 +1489,29 @@ a_bool_t htt_rx_mpdu_is_encrypted_hl(htt_pdev_handle pdev, void *mpdu_desc)
     }
 }
 
+a_bool_t
+htt_rx_msdu_desc_key_id_ll(htt_pdev_handle pdev, void *mpdu_desc,
+                           u_int8_t *key_id)
+{
+    struct htt_host_rx_desc_base *rx_desc = (struct htt_host_rx_desc_base *)
+                                             mpdu_desc;
+
+    if (!htt_rx_msdu_first_msdu_flag_ll(pdev, mpdu_desc))
+        return A_FALSE;
+
+    *key_id = ((*(((u_int32_t *) &rx_desc->msdu_end) + 1)) &
+               (RX_MSDU_END_1_KEY_ID_OCT_MASK >> RX_MSDU_END_1_KEY_ID_OCT_LSB));
+
+    return A_TRUE;
+}
+
+a_bool_t
+htt_rx_msdu_desc_key_id_hl(htt_pdev_handle htt_pdev, void *mpdu_desc, u_int8_t *key_id)
+{
+   /* TODO: Implement it for HL */
+   return A_FALSE;
+}
+
 void
 htt_rx_desc_frame_free(
     htt_pdev_handle htt_pdev,
@@ -1671,6 +1698,7 @@ htt_rx_attach(struct htt_pdev_t *pdev)
         htt_rx_msdu_is_frag = htt_rx_msdu_is_frag_ll;
         htt_rx_msdu_desc_retrieve = htt_rx_msdu_desc_retrieve_ll;
         htt_rx_mpdu_is_encrypted = htt_rx_mpdu_is_encrypted_ll;
+        htt_rx_msdu_desc_key_id = htt_rx_msdu_desc_key_id_ll;
     } else {
         pdev->rx_ring.size = HTT_RX_RING_SIZE_MIN;
         HTT_ASSERT2(IS_PWR2(pdev->rx_ring.size));
@@ -1690,6 +1718,7 @@ htt_rx_attach(struct htt_pdev_t *pdev)
         htt_rx_msdu_is_frag = htt_rx_msdu_is_frag_hl;
         htt_rx_msdu_desc_retrieve = htt_rx_msdu_desc_retrieve_hl;
         htt_rx_mpdu_is_encrypted = htt_rx_mpdu_is_encrypted_hl;
+        htt_rx_msdu_desc_key_id = htt_rx_msdu_desc_key_id_hl;
 
         /*
          * HL case, the rx descriptor can be different sizes for
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.c b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
index dcce0648fe31..1fe8e9bae6f1 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.c
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
@@ -24,6 +24,7 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
+
 #include "vos_sched.h"
 #include "wlan_qct_tl.h"
 #include "wdi_in.h"
@@ -1298,12 +1299,10 @@ VOS_STATUS WLANTL_Close(void *vos_ctx)
 	ENTER();
 	tl_shim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
 
-#ifdef WLAN_OPEN_SOURCE
 #ifdef FEATURE_WLAN_CCX
-	cancel_work_sync(&tl_shim->iapp_work.deferred_work);
-#endif
-	cancel_work_sync(&tl_shim->cache_flush_work);
+	vos_flush_work(&tl_shim->iapp_work.deferred_work);
 #endif
+	vos_flush_work(&tl_shim->cache_flush_work);
 
 	wdi_in_pdev_detach(((pVosContextType) vos_ctx)->pdev_txrx_ctx, 1);
 	// Delete beacon buffer hanging off tl_shim
diff --git a/CORE/CLD_TXRX/TXRX/ol_ctrl_txrx_api.h b/CORE/CLD_TXRX/TXRX/ol_ctrl_txrx_api.h
index 5fa0ded29853..7b9674402b9a 100644
--- a/CORE/CLD_TXRX/TXRX/ol_ctrl_txrx_api.h
+++ b/CORE/CLD_TXRX/TXRX/ol_ctrl_txrx_api.h
@@ -114,6 +114,8 @@ void ol_rx_err_statistics(ol_pdev_handle pdev,
  *      one of the fragments that when reassembled, constitute the rx frame
  * @param err_type - what kind of error occurred
  * @param rx_frame - the rx frame that had an error
+ * @pn - Packet sequence number
+ * @key_id - Key index octet received in IV of the frame
  */
 void
 ol_rx_err(
@@ -123,7 +125,9 @@ ol_rx_err(
     int tid,
     u_int32_t tsf32,
     enum ol_rx_err_type err_type,
-    adf_nbuf_t rx_frame);
+    adf_nbuf_t rx_frame,
+    u_int64_t *pn,
+    u_int8_t key_id);
 
 
 enum ol_rx_notify_type {
@@ -187,7 +191,6 @@ ol_rx_notify(
 void
 ol_tx_paused_peer_data(ol_peer_handle peer, int has_tx_data);
 
-
 #ifdef QCA_WIFI_ISOC
 
 /**
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx.c b/CORE/CLD_TXRX/TXRX/ol_rx.c
index b3b3f2add740..1e40017e0340 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx.c
@@ -112,16 +112,6 @@ static void ol_rx_process_inv_peer(
     #endif
 }
 
-void ol_rx_err(ol_pdev_handle pdev,
-	       u_int8_t vdev_id, u_int8_t *peer_mac_addr, int tid,
-	       u_int32_t tsf32, enum ol_rx_err_type err_type,
-	       adf_nbuf_t rx_frame)
-{
-	/*
-	 * TODO: Report mic error to cfg80211
-	 */
-}
-
 #ifdef QCA_SUPPORT_PEER_DATA_RX_RSSI
 static inline int16_t
 ol_rx_rssi_avg(struct ol_txrx_pdev_t *pdev, int16_t rssi_old, int16_t rssi_new)
@@ -369,9 +359,18 @@ ol_rx_indication_handler(
                 if (status == htt_rx_status_tkip_mic_err &&
                     vdev != NULL &&  peer != NULL)
                 {
-                    ol_rx_err(
-                        pdev->ctrl_pdev, vdev->vdev_id, peer->mac_addr.raw,
-                        tid, 0, OL_RX_ERR_TKIP_MIC, msdu);
+                    union htt_rx_pn_t pn;
+                    u_int8_t key_id;
+                    htt_rx_mpdu_desc_pn(pdev->htt_pdev,
+                                 htt_rx_msdu_desc_retrieve(pdev->htt_pdev,
+                                                           msdu), &pn, 48);
+                    if (htt_rx_msdu_desc_key_id(pdev->htt_pdev,
+                                      htt_rx_msdu_desc_retrieve(pdev->htt_pdev,
+                                      msdu), &key_id) == A_TRUE) {
+                        ol_rx_err(pdev->ctrl_pdev, vdev->vdev_id,
+                                  peer->mac_addr.raw, tid, 0,
+                                  OL_RX_ERR_TKIP_MIC, msdu, &pn.pn48, key_id);
+                    }
                 }
 
     #ifdef WDI_EVENT_ENABLE
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c b/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c
index 2fc976e8d030..a7537056e66c 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx_defrag.c
@@ -502,7 +502,7 @@ ol_rx_defrag(
             ol_rx_err(
                 pdev->ctrl_pdev,
                 vdev->vdev_id, peer->mac_addr.raw, tid, 0, OL_RX_DEFRAG_ERR,
-                msdu);
+                msdu, NULL, 0);
             TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
                 "\n ol_rx_defrag: TKIP demic failed\n");
             return;
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx_pn.c b/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
index 1e46ff6d4270..a7961acbb48c 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
@@ -185,7 +185,7 @@ ol_rx_pn_check_base(
                 pdev->ctrl_pdev,
                 vdev->vdev_id, peer->mac_addr.raw, tid,
                 htt_rx_mpdu_desc_tsf32(pdev->htt_pdev, rx_desc),
-                OL_RX_ERR_PN, mpdu);
+                OL_RX_ERR_PN, mpdu, NULL, 0);
             /* free all MSDUs within this MPDU */
             do {
                 adf_nbuf_t next_msdu;
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c b/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c
index 7db868671f78..1d1156b8a4d0 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c
@@ -652,7 +652,7 @@ ol_rx_pn_ind_handler(
                     pdev->ctrl_pdev,
                     vdev->vdev_id, peer->mac_addr.raw, tid,
                     htt_rx_mpdu_desc_tsf32(htt_pdev, rx_desc),
-                    OL_RX_ERR_PN, mpdu_head);
+                    OL_RX_ERR_PN, mpdu_head, NULL, 0);
                 /* free all MSDUs within this MPDU */
                 do {
                     next_msdu = adf_nbuf_next(msdu);
diff --git a/CORE/HDD/src/bap_hdd_main.c b/CORE/HDD/src/bap_hdd_main.c
index c2620a2c1f85..f567dc6f9fce 100644
--- a/CORE/HDD/src/bap_hdd_main.c
+++ b/CORE/HDD/src/bap_hdd_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -24,6 +24,7 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
+
 /**========================================================================
 
   \file  bap_hdd_main.c
@@ -795,11 +796,17 @@ static void BslReleasePhyCtx
     {
         VosStatus = vos_list_remove_node( &pPhyCtx->pClientCtx->PhyLinks,
                                           &((BslPhyLinksNodeType*)pPhyCtx->pPhyLinkDescNode)->node);
-        VOS_ASSERT(VOS_IS_STATUS_SUCCESS( VosStatus ) );
-        //Return the PhyLink handle to the free pool
-        VosStatus = vos_list_insert_front(&BslPhyLinksDescPool,&((BslPhyLinksNodeType*)pPhyCtx->pPhyLinkDescNode)->node);
-        VOS_ASSERT(VOS_IS_STATUS_SUCCESS( VosStatus ) );
-
+        if (VOS_STATUS_SUCCESS != VosStatus)
+        {
+           VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,"%s: vos_list_remove_node() is not succses", __func__);
+        } else {
+           //Return the PhyLink handle to the free pool
+           VosStatus = vos_list_insert_front(&BslPhyLinksDescPool,&((BslPhyLinksNodeType*)pPhyCtx->pPhyLinkDescNode)->node);
+           if (VOS_STATUS_SUCCESS != VosStatus)
+           {
+              VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,"%s: vos_list_insert_front() is not succses", __func__);
+           }
+        }
         pPhyCtx->pPhyLinkDescNode = NULL;
     }
     pPhyCtx->pClientCtx = NULL;//Moved here to bebug the exception
@@ -1447,7 +1454,12 @@ static VOS_STATUS WLANBAP_EventCB
     }
     }
 
-    VOS_ASSERT(Written <= BSL_MAX_EVENT_SIZE);
+    if (BSL_MAX_EVENT_SIZE < Written)
+    {
+       VosStatus = vos_pkt_return_packet( pVosPkt );
+       VOS_ASSERT(0);
+       return(VOS_STATUS_E_FAILURE);
+    }
 
     // stick the event into a VoS pkt
     VosStatus = vos_pkt_push_head( pVosPkt, Buff, Written );
@@ -1481,7 +1493,11 @@ static VOS_STATUS WLANBAP_EventCB
 
     //JEZ100922: We are free to return the enclosing VOSS packet.
     VosStatus = vos_pkt_return_packet( pVosPkt );
-    VOS_ASSERT(VOS_IS_STATUS_SUCCESS( VosStatus ));
+    if(VOS_STATUS_SUCCESS != VosStatus)
+    {
+       // just print no action required
+       VOS_ASSERT(0);
+    }
 
     //JEZ100809: While an skb is being handled by the kernel, is "skb->dev" de-ref'd?
     skb->dev = (struct net_device *) gpBslctx->hdev;
@@ -1600,7 +1616,12 @@ static BOOL BslFindAndInitClientCtx
 
     // init the PhyLinks queue to keep track of the assoc's of this client
     VosStatus = vos_list_init( &pctx->PhyLinks );
-    VOS_ASSERT(VOS_IS_STATUS_SUCCESS( VosStatus ) );
+    if (VOS_STATUS_SUCCESS != VosStatus)
+    {
+       pctx->used = FALSE;
+       VOS_ASSERT(0);
+       return(FALSE);
+    }
 
     *pctx_ = pctx;
 
@@ -1636,8 +1657,11 @@ static void BslReleaseClientCtx
     // consume resulting HCI events, so after this we will not get any HCI events. we will also
     // not see any FetchPktCB and RxPktCB. We can still expect TxCompletePktCB
     VosStatus = WLANBAP_ReleaseHndl( pctx->bapHdl );
-    VOS_ASSERT(VOS_IS_STATUS_SUCCESS( VosStatus ) );
-
+    if (VOS_STATUS_SUCCESS != VosStatus)
+    {
+       // just print no action required
+       VOS_ASSERT(0);
+    }
 
     // find and free all of the association contexts belonging to this app
     while ( VOS_IS_STATUS_SUCCESS( VosStatus = vos_list_remove_front( &pctx->PhyLinks, &pLink ) ) )
@@ -1655,7 +1679,11 @@ static void BslReleaseClientCtx
 
     // destroy the PhyLinks queue
     VosStatus = vos_list_destroy( &pctx->PhyLinks );
-    VOS_ASSERT(VOS_IS_STATUS_SUCCESS( VosStatus ) );
+    if (VOS_STATUS_SUCCESS != VosStatus)
+    {
+       // just print no action required
+       VOS_ASSERT(0);
+    }
 
     pctx->used = FALSE;
 
@@ -1744,9 +1772,6 @@ static BOOL BslFindAndInitPhyCtx
         for ( j=0; j<WLANTL_MAX_AC; j++ )
         {
             hdd_list_init( &BslPhyLinkCtx[i].ACLTxQueue[j], HDD_TX_QUEUE_MAX_LEN );
-            //VosStatus = vos_list_init( &BslPhyLinkCtx[i].ACLTxQueue[j] );
-            //VosStatus = vos_list_init( &(BslPhyLinkCtx+i)->ACLTxQueue );
-            VOS_ASSERT(VOS_IS_STATUS_SUCCESS( VosStatus ) );
         }
 
         // need to add this Phy context to the client list of associations,
@@ -3903,7 +3928,11 @@ static int BSL_Open( struct hci_dev *hdev )
     for ( i=0; i<BSL_MAX_PHY_LINKS; i++ )
     {
         VosStatus = vos_list_insert_front( &BslPhyLinksDescPool, &BslPhyLinksDesc[i].node );
-        VOS_ASSERT(VOS_IS_STATUS_SUCCESS( VosStatus ) );
+        if (VOS_STATUS_SUCCESS != VosStatus)
+        {
+           VOS_ASSERT(0);
+           return 0;
+        }
     }
 
     // This is redundent.  See the check above on (fp->private_data != NULL)
@@ -3985,8 +4014,11 @@ static int BSL_Close ( struct hci_dev *hdev )
     }
     VosStatus = vos_list_destroy( &BslPhyLinksDescPool );
 
-    VOS_ASSERT(VOS_IS_STATUS_SUCCESS( VosStatus ) );
-
+    if (VOS_STATUS_SUCCESS != VosStatus)
+    {
+       VOS_ASSERT(0);
+       return FALSE;
+    }
 
     bBslInited = FALSE;
 
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index acdfd9a8ceaf..8facceb8c21a 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -1880,6 +1880,8 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
         }
         else
         {
+            pConfig->countryCode[0] = pHddCtx->reg.alpha2[0];
+            pConfig->countryCode[1] = pHddCtx->reg.alpha2[1];
             pConfig->ieee80211d = 0;
         }
         /*
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 500f73ad0f30..abb82d93b15a 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -6004,7 +6004,8 @@ static eHalStatus hdd_smeCloseSessionCallback(void *pContext)
 
    clear_bit(SME_SESSION_OPENED, &pAdapter->event_flags);
 
-#ifndef WLAN_OPEN_SOURCE
+#if !defined (CONFIG_CNSS) && \
+    !defined (WLAN_OPEN_SOURCE)
    /* need to make sure all of our scheduled work has completed.
     * This callback is called from MC thread context, so it is safe to
     * to call below flush workqueue API from here.
diff --git a/CORE/HDD/src/wlan_hdd_tdls.c b/CORE/HDD/src/wlan_hdd_tdls.c
index f8f7e6cd42de..bd10340037c5 100644
--- a/CORE/HDD/src/wlan_hdd_tdls.c
+++ b/CORE/HDD/src/wlan_hdd_tdls.c
@@ -800,10 +800,9 @@ void wlan_hdd_tdls_exit(hdd_adapter_t *pAdapter)
         hddLog(VOS_TRACE_LEVEL_WARN, "%s TDLS not enabled, exiting!", __func__);
         return;
     }
-#ifdef WLAN_OPEN_SOURCE
-    cancel_work_sync(&pHddTdlsCtx->implicit_setup);
-    cancel_delayed_work_sync(&pHddCtx->tdls_scan_ctxt.tdls_scan_work);
-#endif
+
+    vos_flush_work(&pHddTdlsCtx->implicit_setup);
+    vos_flush_delayed_work(&pHddCtx->tdls_scan_ctxt.tdls_scan_work);
 
     /* must stop timer here before freeing peer list, because peerIdleTimer is
     part of peer list structure. */
diff --git a/CORE/HDD/src/wlan_hdd_wmm.c b/CORE/HDD/src/wlan_hdd_wmm.c
index ff0bede2fbae..784b37fed87f 100644
--- a/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/CORE/HDD/src/wlan_hdd_wmm.c
@@ -1629,9 +1629,7 @@ VOS_STATUS hdd_wmm_adapter_close ( hdd_adapter_t* pAdapter )
 #ifdef FEATURE_WLAN_CCX
       hdd_wmm_disable_inactivity_timer(pQosContext);
 #endif
-#ifdef WLAN_OPEN_SOURCE
-      cancel_work_sync(&pQosContext->wmmAcSetupImplicitQos);
-#endif
+      vos_flush_work(&pQosContext->wmmAcSetupImplicitQos);
       hdd_wmm_free_context(pQosContext);
    }
 
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index a7005395ecaa..19fc0c29812e 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,8 +42,8 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            72
+#define QWLAN_VERSION_BUILD            73
 
-#define QWLAN_VERSIONSTR               "4.0.0.72"
+#define QWLAN_VERSIONSTR               "4.0.0.73"
 
 #endif /* QWLAN_VERSION_H */
diff --git a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
index 960917d8aec9..f5958a58a2e9 100644
--- a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
@@ -3029,6 +3029,7 @@ limSendSmeAPChannelSwitchResp(tpAniSirGlobal pMac,
 {
     tSirMsgQ mmhMsg;
     tpSwitchChannelParams pSmeSwithChnlParams;
+    tANI_U8 channelId;
 
     pSmeSwithChnlParams = (tSwitchChannelParams *)
                   vos_mem_malloc(sizeof(tSwitchChannelParams));
@@ -3045,11 +3046,35 @@ limSendSmeAPChannelSwitchResp(tpAniSirGlobal pMac,
     vos_mem_copy(pSmeSwithChnlParams, pChnlParams,
                 sizeof(tSwitchChannelParams));
 
+    channelId = pSmeSwithChnlParams->channelNumber;
+
     mmhMsg.type = eWNI_SME_CHANNEL_CHANGE_RSP;
     mmhMsg.bodyptr = (void *)pSmeSwithChnlParams;
     mmhMsg.bodyval = 0;
     limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
 
+    /*
+     * We should start beacon transmission only if the new
+     * channel after channel change is Non-DFS. For a DFS
+     * channel, PE will receive an explicit request from
+     * upper layers to start the beacon transmission .
+     */
+
+    if (NV_CHANNEL_DFS != vos_nv_getChannelEnabledState(channelId))
+    {
+        if (channelId ==  psessionEntry->currentOperChannel)
+        {
+            limApplyConfiguration(pMac,psessionEntry);
+            limSendBeaconInd(pMac, psessionEntry);
+        }
+        else
+        {
+            PELOG1(limLog(pMac, LOG1,
+                   FL("Failed to Transmit Beacons on channel = %d"
+                      "after AP channel change response"),
+                       psessionEntry->bcnLen);)
+        }
+    }
     return;
 }
 
diff --git a/CORE/SAP/src/sapApiLinkCntl.c b/CORE/SAP/src/sapApiLinkCntl.c
index 7b4a18a91f62..71c52932af3e 100644
--- a/CORE/SAP/src/sapApiLinkCntl.c
+++ b/CORE/SAP/src/sapApiLinkCntl.c
@@ -24,6 +24,7 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
+
 /*===========================================================================
 
                       s a p A p i L i n k C n t l . C
@@ -586,6 +587,20 @@ WLANSAP_RoamCallback
             sapEvent.params = pCsrRoamInfo;
             sapEvent.u1 = roamStatus;
             sapEvent.u2 = roamResult;
+
+            /*
+             * If the Channel on which BSS started is a DFS channel
+             * then initialize the NOL list in the sapDfsInfo to
+             * a manitain a list of radar found DFS channels and
+             * to make sure that SAP does not use these channels
+             * for the next 30 mins.
+             */
+            if (vos_nv_getChannelEnabledState(sapContext->channel) ==
+                                                            NV_CHANNEL_DFS)
+            {
+                sapInitDfsChannelNolList(sapContext);
+            }
+
             vosStatus = sapFsm(sapContext, &sapEvent);
             if(!VOS_IS_STATUS_SUCCESS(vosStatus))
             {
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index 7664e054c79e..4e479a75e15e 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -24,6 +24,7 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
+
 /*===========================================================================
 
                       s a p F s m . C
@@ -171,6 +172,91 @@ static inline void sapEventInit(ptWLAN_SAPEvent sapEvent)
    sapEvent->u2 = 0;
 }
 
+/*
+ * This Function Checks if a given channel is AVAILABLE or USABLE
+ * for DFS operation.
+ */
+static v_BOOL_t
+sapDfsIsChannelInNolList(ptSapContext sapContext, v_U8_t channelNumber)
+{
+    int i;
+    unsigned long timeElapsedSinceLastRadar,timeWhenRadarFound,currentTime = 0;
+
+    for (i =0 ; i< sapContext->SapDfsInfo.numCurrentRegDomainDfsChannels; i++)
+    {
+        if(sapContext->SapDfsInfo.sapDfsChannelNolList[i]
+                                 .dfs_channel_number == channelNumber)
+        {
+            if ( (sapContext->SapDfsInfo.sapDfsChannelNolList[i]
+                        .radar_status_flag == eSAP_DFS_CHANNEL_USABLE)
+                                           ||
+                 (sapContext->SapDfsInfo.sapDfsChannelNolList[i]
+                        .radar_status_flag == eSAP_DFS_CHANNEL_AVAILABLE) )
+            {
+                /*
+                 * Allow SAP operation on this channel
+                 * either the DFS channel has not been used
+                 * for SAP operation or it is available for
+                 * SAP operation since it is past Non-Occupancy-Period
+                 * so, return FALSE.
+                 */
+                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_LOW,
+                          "%s[%d]: Channel = %d"
+                           "Not in NOL LIST, CHANNEL AVAILABLE",
+                           __func__, __LINE__, sapContext->SapDfsInfo
+                                                 .sapDfsChannelNolList[i]
+                                                 .dfs_channel_number);
+                return VOS_FALSE;
+            }
+            else if (sapContext->SapDfsInfo.sapDfsChannelNolList[i]
+                        .radar_status_flag == eSAP_DFS_CHANNEL_UNAVAILABLE)
+            {
+                /*
+                 * If a DFS Channel is UNAVAILABLE then
+                 * check to see if it is past Non-occupancy-period
+                 * of 30 minutes. If it is past 30 mins then
+                 * mark the channel as AVAILABLE and return FALSE
+                 * as the channel is not anymore in NON-Occupancy-Period.
+                 */
+                timeWhenRadarFound = sapContext->SapDfsInfo
+                                     .sapDfsChannelNolList[i]
+                                     .radar_found_timestamp;
+                currentTime = vos_timer_get_system_time();
+                timeElapsedSinceLastRadar = currentTime - timeWhenRadarFound;
+                if (timeElapsedSinceLastRadar >=  SAP_DFS_NON_OCCUPANCY_PERIOD)
+                {
+                    sapContext->SapDfsInfo.sapDfsChannelNolList[i]
+                           .radar_status_flag = eSAP_DFS_CHANNEL_AVAILABLE;
+
+                    VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_LOW,
+                              "%s[%d]:Channel=%d"
+                               "Not in NOL LIST,CHANNEL AVAILABLE",
+                               __func__, __LINE__, sapContext->SapDfsInfo
+                                                   .sapDfsChannelNolList[i]
+                                                   .dfs_channel_number);
+                    return VOS_FALSE;
+                }
+                else
+                {
+                    /*
+                     * Channel is not still available for SAP operation
+                     * so return TRUE; As the Channel is still
+                     * in Non-occupancy-Period.
+                     */
+                    VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_LOW,
+                              "%s[%d]:Channel=%d"
+                              "still in NOL LIST,CHANNEL UNAVAILABLE",
+                               __func__, __LINE__, sapContext->SapDfsInfo
+                                                  .sapDfsChannelNolList[i]
+                                                  .dfs_channel_number);
+                    return VOS_TRUE;
+                }
+            }
+        }
+    }
+    return VOS_FALSE;
+}
+
 /*==========================================================================
   FUNCTION    sapGotoChannelSel
 
@@ -557,7 +643,11 @@ sapSignalHDDevent
     /*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -*/
 
     /* Format the Start BSS Complete event to return... */
-    VOS_ASSERT(sapContext->pfnSapEventCallback);
+    if (NULL == sapContext->pfnSapEventCallback)
+    {
+        VOS_ASSERT(0);
+        return VOS_STATUS_E_FAILURE;
+    }
 
     switch (sapHddevent)
     {
@@ -888,7 +978,6 @@ sapFsm
 
                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO,
                "ENTERTRED eSAP_DISCONNECTED-->eSAP_DFS_CAC_WAIT\n");
-
                sapStartDfsCacTimer(sapContext);
             }
             else
@@ -1716,6 +1805,7 @@ v_U8_t sapIndicateRadar(ptSapContext sapContext,tSirSmeDfsEventInd *dfs_event)
     v_U8_t total_num_channels = 0;
     v_U8_t target_channel = 0;
     int i;
+    v_BOOL_t isChannelNol = VOS_FALSE;
 
     if (NULL == sapContext || NULL == dfs_event)
     {
@@ -1759,6 +1849,30 @@ v_U8_t sapIndicateRadar(ptSapContext sapContext,tSirSmeDfsEventInd *dfs_event)
     numAChannels = (total_num_channels - numGChannels);
 
     /*
+     * Mark the current channel on which Radar is found
+     * in the  NOL list as eSAP_DFS_CHANNEL_UNAVAILABLE.
+     */
+
+    for (i = 0; i<= sapContext->SapDfsInfo.numCurrentRegDomainDfsChannels; i++)
+    {
+        if (sapContext->SapDfsInfo.sapDfsChannelNolList[i]
+                         .dfs_channel_number ==
+                                               dfs_event->ieee_chan_number)
+        {
+            // Capture the Radar Found timestamp on the Current Channel in ms.
+            sapContext->SapDfsInfo.sapDfsChannelNolList[i]
+                         .radar_found_timestamp = vos_timer_get_system_time();
+            // Mark the Channel to be UNAVAILABLE for next 30 mins.
+            sapContext->SapDfsInfo.sapDfsChannelNolList[i]
+                         .radar_status_flag = eSAP_DFS_CHANNEL_UNAVAILABLE;
+
+            VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
+                      "%s[%d]: Channel = %d Added to NOL LIST",
+                       __func__, __LINE__, dfs_event->ieee_chan_number);
+        }
+    }
+
+    /*
      * (1) skip static turbo channel as it will require STA to be in
      * static turbo to work.
      * (2) skip channel which's marked with radar detction
@@ -1767,13 +1881,41 @@ v_U8_t sapIndicateRadar(ptSapContext sapContext,tSirSmeDfsEventInd *dfs_event)
      * (5) Create the available channel list with the above rules
      */
 
-    for(i = 0, available_chan_count = 0; i<= total_num_channels; i++)
+    for (i = 0, available_chan_count = 0; i< total_num_channels; i++)
     {
         if (sapContext->SapAllChnlList.channelList[i] ==
                                        dfs_event->ieee_chan_number)
         {
             continue;//skip the channel on which radar is found
         }
+
+        /*
+         * Now Check if the channel is DFS and if
+         * the channel is not in NOL list and add
+         * it available_chan_idx otherwise skip this
+         * channel index.
+         */
+
+        if (vos_nv_getChannelEnabledState(sapContext->SapAllChnlList
+                                           .channelList[i]) ==
+                                                            NV_CHANNEL_DFS)
+        {
+            isChannelNol = sapDfsIsChannelInNolList(sapContext,
+                                 sapContext->SapAllChnlList.channelList[i]);
+            if (VOS_TRUE == isChannelNol)
+            {
+                /*
+                 * Skip this channel since it is still in
+                 * DFS Non-Occupancy-Period which is 30 mins.
+                 */
+                VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_LOW,
+                          "%s[%d]: Channel = %d Present in NOL LIST",
+                           __func__, __LINE__,
+                           sapContext->SapAllChnlList.channelList[i]);
+
+                continue;
+            }
+        }
         available_chan_idx[available_chan_count++] =
                            sapContext->SapAllChnlList.channelList[i];
     }
@@ -1849,6 +1991,8 @@ void sapDfsCacTimerCallback(void *data)
 int sapStartDfsCacTimer(ptSapContext sapContext)
 {
     VOS_STATUS status;
+    v_U32_t cacTimeOut;
+    v_REGDOMAIN_t regDomain;
     if (sapContext == NULL)
     {
         return 0;
@@ -1861,12 +2005,20 @@ int sapStartDfsCacTimer(ptSapContext sapContext)
          */
         return 2;
     }
+    cacTimeOut = DEFAULT_CAC_TIMEOUT;
+    vos_nv_getRegDomainFromCountryCode(&regDomain,
+                    sapContext->csrRoamProfile.countryCode, COUNTRY_QUERY);
+    if ((regDomain == REGDOMAIN_ETSI) &&
+       (IS_ETSI_WEATHER_CH(sapContext->SapDfsInfo.target_channel)))
+    {
+        cacTimeOut = ETSI_WEATHER_CH_CAC_TIMEOUT;
+    }
     vos_timer_init(&sapContext->SapDfsInfo.sap_dfs_cac_timer,
                    VOS_TIMER_TYPE_SW,
                    sapDfsCacTimerCallback, (v_PVOID_t)sapContext);
 
     /*Start the CAC timer for 60 Seconds*/
-    status = vos_timer_start(&sapContext->SapDfsInfo.sap_dfs_cac_timer, 60000);
+    status = vos_timer_start(&sapContext->SapDfsInfo.sap_dfs_cac_timer, cacTimeOut);
     if (status == VOS_STATUS_SUCCESS)
     {
         sapContext->SapDfsInfo.is_dfs_cac_timer_running = VOS_TRUE;
@@ -1877,3 +2029,48 @@ int sapStartDfsCacTimer(ptSapContext sapContext)
         return 0;
     }
 }
+
+/*
+ * This function initializes the NOL list
+ * parameters required to track the radar
+ * found DFS channels in the current Reg. Domain .
+ */
+VOS_STATUS sapInitDfsChannelNolList(ptSapContext sapContext)
+{
+    v_U8_t count = 0;
+    int i;
+    if (NULL == sapContext)
+    {
+        VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_ERROR,
+              "Invalid sapContext pointer on sapInitDfsChannelNolList");
+        return VOS_STATUS_E_FAULT;
+    }
+    for ( i = RF_CHAN_36; i <= RF_CHAN_165; i++ )
+    {
+        if ( regChannels[i].enabled == NV_CHANNEL_DFS )
+        {
+            sapContext->SapDfsInfo.sapDfsChannelNolList[count]
+               .dfs_channel_number = rfChannels[i].channelNum;
+
+            VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_LOW,
+                      "%s[%d] CHANNEL = %d", __func__, __LINE__,
+                       sapContext->SapDfsInfo
+                       .sapDfsChannelNolList[count].dfs_channel_number);
+
+            sapContext->SapDfsInfo.sapDfsChannelNolList[count]
+               .radar_status_flag = eSAP_DFS_CHANNEL_USABLE;
+            sapContext->SapDfsInfo.sapDfsChannelNolList[count]
+               .radar_found_timestamp = 0;
+            count++;
+        }
+    }
+    sapContext->SapDfsInfo.numCurrentRegDomainDfsChannels = count;
+
+    VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_LOW,
+              "%s[%d] NUMBER OF DFS CHANNELS = %d",
+              __func__, __LINE__,
+              sapContext->SapDfsInfo.numCurrentRegDomainDfsChannels);
+
+    return VOS_STATUS_SUCCESS;
+}
+
diff --git a/CORE/SAP/src/sapInternal.h b/CORE/SAP/src/sapInternal.h
index 248614ac45b0..ebf51b3915ab 100644
--- a/CORE/SAP/src/sapInternal.h
+++ b/CORE/SAP/src/sapInternal.h
@@ -24,6 +24,7 @@
  * under proprietary terms before Copyright ownership was assigned
  * to the Linux Foundation.
  */
+
 #ifndef WLAN_QCT_WLANSAP_INTERNAL_H
 #define WLAN_QCT_WLANSAP_INTERNAL_H
 
@@ -89,6 +90,9 @@ when           who        what, where, why
 /*----------------------------------------------------------------------------
  *  Defines
  * -------------------------------------------------------------------------*/
+//DFS Non Occupancy Period =30 minutes, in milliseconds
+#define SAP_DFS_NON_OCCUPANCY_PERIOD      (30 * 60 * 1000 )
+
 #define SAP_DEBUG
 // Used to enable or disable security on the BT-AMP link 
 #define WLANSAP_SECURITY_ENABLED_STATE VOS_TRUE
@@ -99,6 +103,10 @@ when           who        what, where, why
 //MAC Address length
 #define ANI_EAPOL_KEY_RSN_NONCE_SIZE      32
 
+#define IS_ETSI_WEATHER_CH(_ch) ((_ch >= 120) && (_ch <= 130))
+#define DEFAULT_CAC_TIMEOUT (60 * 1000) //msecs - 1 min
+#define ETSI_WEATHER_CH_CAC_TIMEOUT (10 * 60 * 1000) //msecs - 10 min
+
 extern sRegulatoryChannel *regChannels;
 extern const tRfChannelProps rfChannels[NUM_RF_CHANNELS];
 
@@ -138,6 +146,18 @@ typedef struct sSapQosCfg {
     v_U8_t              WmmIsEnabled;
 } tSapQosCfg;
 
+typedef enum {
+        eSAP_DFS_CHANNEL_USABLE,
+        eSAP_DFS_CHANNEL_AVAILABLE,
+        eSAP_DFS_CHANNEL_UNAVAILABLE
+}eSapDfsChanStatus_t;
+
+typedef struct sSapDfsNolInfo {
+    v_U8_t              dfs_channel_number;
+    eSapDfsChanStatus_t radar_status_flag;
+    unsigned long       radar_found_timestamp;
+}tSapDfsNolInfo;
+
 typedef struct sSapDfsInfo {
     vos_timer_t         sap_dfs_cac_timer;
     v_U8_t              sap_radar_found_status;
@@ -155,6 +175,9 @@ typedef struct sSapDfsInfo {
      * generation and transmission
      */
     v_U8_t              csaIERequired;
+    v_U8_t              numCurrentRegDomainDfsChannels;
+    tSapDfsNolInfo      sapDfsChannelNolList[NUM_5GHZ_CHANNELS];
+
 }tSapDfsInfo;
 
 typedef struct sSapContext {
@@ -821,6 +844,9 @@ SIDE EFFECTS
 v_U8_t
 sapIndicateRadar(ptSapContext sapContext,tSirSmeDfsEventInd *dfs_event);
 
+VOS_STATUS
+sapInitDfsChannelNolList(ptSapContext sapContext);
+
 #ifdef __cplusplus
 }
 #endif 
diff --git a/CORE/SERVICES/COMMON/ol_htt_rx_api.h b/CORE/SERVICES/COMMON/ol_htt_rx_api.h
index 8d046c08d4b8..bb867d642841 100644
--- a/CORE/SERVICES/COMMON/ol_htt_rx_api.h
+++ b/CORE/SERVICES/COMMON/ol_htt_rx_api.h
@@ -533,6 +533,25 @@ htt_rx_msdu_actions(
     int *forward,
     int *inspect);
 
+/**
+ * @brief Get the key id sent in IV of the frame
+ * @details
+ *  Provide the key index octet which is taken from IV.
+ *  This is valid only for the first MSDU.
+ *
+ * @param pdev - the HTT instance the rx data was received on
+ * @param msdu_desc - the abstract descriptor for the MSDU in question
+ * @key_id - Key id octet
+ * @return indication of whether key id access is successful
+ *   A_TRUE - Success
+ *   A_FALSE - if this is not first msdu
+ */
+extern a_bool_t
+(*htt_rx_msdu_desc_key_id)(
+    htt_pdev_handle pdev,
+    void *mpdu_desc,
+    u_int8_t *key_id);
+
 /*====================== rx MSDU + descriptor delivery ======================*/
 
 /**
diff --git a/CORE/SERVICES/COMMON/wdi_out.h b/CORE/SERVICES/COMMON/wdi_out.h
index 726ad369329a..c7a67676af31 100644
--- a/CORE/SERVICES/COMMON/wdi_out.h
+++ b/CORE/SERVICES/COMMON/wdi_out.h
@@ -450,6 +450,8 @@ void wdi_out_rx_err_statistics(ol_pdev_handle pdev,
  *      one of the fragments that when reassembled, constitute the rx frame
  * @param err_type - what kind of error occurred
  * @param rx_frame - the rx frame that had an error
+ * @pn - Packet sequence number
+ * @key_id - Key index octet received in IV of the frame
  */
 void
 wdi_out_rx_err(
@@ -459,7 +461,9 @@ wdi_out_rx_err(
     int tid,
     u_int32_t tsf32,
     enum ol_rx_err_type err_type,
-    adf_nbuf_t rx_frame);
+    adf_nbuf_t rx_frame,
+    u_int64_t *pn,
+    u_int8_t key_id);
 
 enum ol_rx_notify_type {
     OL_RX_NOTIFY_IPV4_IGMP,
diff --git a/CORE/SERVICES/COMMON/wmi_unified.h b/CORE/SERVICES/COMMON/wmi_unified.h
index 594d6679dabe..7e00d21e27f8 100644
--- a/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/CORE/SERVICES/COMMON/wmi_unified.h
@@ -2936,6 +2936,9 @@ typedef enum {
      * thought to be gone. */
     WMI_VDEV_PARAM_IBSS_MAX_BCN_LOST_MS,
 
+    /** max rate in kpbs, transmit rate can't go beyond it */
+    WMI_VDEV_PARAM_MAX_RATE,
+
 } WMI_VDEV_PARAM;
 
 enum wmi_pkt_type {
diff --git a/CORE/SERVICES/COMMON/wmi_version.h b/CORE/SERVICES/COMMON/wmi_version.h
index 04d63e61281d..f7f98447a234 100644
--- a/CORE/SERVICES/COMMON/wmi_version.h
+++ b/CORE/SERVICES/COMMON/wmi_version.h
@@ -35,7 +35,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 31
+#define __WMI_REVISION_ 32
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work
diff --git a/CORE/SERVICES/HIF/PCIe/ar6320def.h b/CORE/SERVICES/HIF/PCIe/ar6320def.h
index d9de7b513298..a5c2f5bf1d80 100644
--- a/CORE/SERVICES/HIF/PCIe/ar6320def.h
+++ b/CORE/SERVICES/HIF/PCIe/ar6320def.h
@@ -116,6 +116,8 @@
 #define AR6320_RX_MPDU_START_0_SEQ_NUM_MASK             0x0fff0000
 #define AR6320_RX_MPDU_START_2_PN_47_32_LSB             0
 #define AR6320_RX_MPDU_START_2_PN_47_32_MASK            0x0000ffff
+#define AR6320_RX_MSDU_END_1_KEY_ID_OCT_MASK            0x000000ff
+#define AR6320_RX_MSDU_END_1_KEY_ID_OCT_LSB             0
 #define AR6320_RX_MSDU_END_1_EXT_WAPI_PN_63_48_LSB      16
 #define AR6320_RX_MSDU_END_1_EXT_WAPI_PN_63_48_MASK     0xffff0000
 #define AR6320_RX_MSDU_END_4_LAST_MSDU_LSB              15
@@ -372,6 +374,8 @@ struct targetdef_s ar6320_targetdef = {
     .d_RX_MPDU_START_0_SEQ_NUM_LSB =           AR6320_RX_MPDU_START_0_SEQ_NUM_LSB,
     .d_RX_MPDU_START_2_PN_47_32_LSB =          AR6320_RX_MPDU_START_2_PN_47_32_LSB,
     .d_RX_MPDU_START_2_PN_47_32_MASK =         AR6320_RX_MPDU_START_2_PN_47_32_MASK,
+    .d_RX_MSDU_END_1_KEY_ID_OCT_MASK =         AR6320_RX_MSDU_END_1_KEY_ID_OCT_MASK,
+    .d_RX_MSDU_END_1_KEY_ID_OCT_LSB =          AR6320_RX_MSDU_END_1_KEY_ID_OCT_LSB,
     .d_RX_MSDU_END_1_EXT_WAPI_PN_63_48_MASK =  AR6320_RX_MSDU_END_1_EXT_WAPI_PN_63_48_MASK,
     .d_RX_MSDU_END_1_EXT_WAPI_PN_63_48_LSB =   AR6320_RX_MSDU_END_1_EXT_WAPI_PN_63_48_LSB,
     .d_RX_MSDU_END_4_LAST_MSDU_MASK =          AR6320_RX_MSDU_END_4_LAST_MSDU_MASK,
diff --git a/CORE/SERVICES/HIF/PCIe/ar9888def.h b/CORE/SERVICES/HIF/PCIe/ar9888def.h
index 2309a44d4f1c..512abf65df1a 100644
--- a/CORE/SERVICES/HIF/PCIe/ar9888def.h
+++ b/CORE/SERVICES/HIF/PCIe/ar9888def.h
@@ -119,6 +119,8 @@
 #define AR9888_RX_MPDU_START_0_SEQ_NUM_MASK             0x0fff0000
 #define AR9888_RX_MPDU_START_2_PN_47_32_LSB             0
 #define AR9888_RX_MPDU_START_2_PN_47_32_MASK            0x0000ffff
+#define AR9888_RX_MSDU_END_1_KEY_ID_OCT_MASK            0x000000ff
+#define AR9888_RX_MSDU_END_1_KEY_ID_OCT_LSB             0
 #define AR9888_RX_MSDU_END_1_EXT_WAPI_PN_63_48_LSB      16
 #define AR9888_RX_MSDU_END_1_EXT_WAPI_PN_63_48_MASK     0xffff0000
 #define AR9888_RX_MSDU_END_4_LAST_MSDU_LSB              15
@@ -374,6 +376,8 @@ struct targetdef_s ar9888_targetdef = {
     .d_RX_MPDU_START_2_PN_47_32_MASK =         AR9888_RX_MPDU_START_2_PN_47_32_MASK,
     .d_RX_MSDU_END_1_EXT_WAPI_PN_63_48_MASK =  AR9888_RX_MSDU_END_1_EXT_WAPI_PN_63_48_MASK,
     .d_RX_MSDU_END_1_EXT_WAPI_PN_63_48_LSB =   AR9888_RX_MSDU_END_1_EXT_WAPI_PN_63_48_LSB,
+    .d_RX_MSDU_END_1_KEY_ID_OCT_MASK =         AR9888_RX_MSDU_END_1_KEY_ID_OCT_MASK,
+    .d_RX_MSDU_END_1_KEY_ID_OCT_LSB =          AR9888_RX_MSDU_END_1_KEY_ID_OCT_LSB,
     .d_RX_MSDU_END_4_LAST_MSDU_MASK =          AR9888_RX_MSDU_END_4_LAST_MSDU_MASK,
     .d_RX_MSDU_END_4_LAST_MSDU_LSB =           AR9888_RX_MSDU_END_4_LAST_MSDU_LSB,
     .d_RX_ATTENTION_0_MCAST_BCAST_MASK =       AR9888_RX_ATTENTION_0_MCAST_BCAST_MASK,
diff --git a/CORE/SERVICES/HIF/PCIe/regtable.h b/CORE/SERVICES/HIF/PCIe/regtable.h
index 7f4573258dce..76320fca502b 100644
--- a/CORE/SERVICES/HIF/PCIe/regtable.h
+++ b/CORE/SERVICES/HIF/PCIe/regtable.h
@@ -124,6 +124,8 @@ typedef struct targetdef_s {
     u_int32_t d_RX_MPDU_START_2_PN_47_32_MASK;
     u_int32_t d_RX_MSDU_END_1_EXT_WAPI_PN_63_48_MASK;
     u_int32_t d_RX_MSDU_END_1_EXT_WAPI_PN_63_48_LSB;
+    u_int32_t d_RX_MSDU_END_1_KEY_ID_OCT_MASK;
+    u_int32_t d_RX_MSDU_END_1_KEY_ID_OCT_LSB;
     u_int32_t d_RX_MSDU_END_4_LAST_MSDU_MASK;
     u_int32_t d_RX_MSDU_END_4_LAST_MSDU_LSB;
     u_int32_t d_RX_ATTENTION_0_MCAST_BCAST_MASK;
@@ -318,6 +320,8 @@ typedef struct targetdef_s {
 #define RX_MPDU_START_0_SEQ_NUM_LSB              (pdev->targetdef->d_RX_MPDU_START_0_SEQ_NUM_LSB)
 #define RX_MPDU_START_2_PN_47_32_LSB             (pdev->targetdef->d_RX_MPDU_START_2_PN_47_32_LSB)
 #define RX_MPDU_START_2_PN_47_32_MASK            (pdev->targetdef->d_RX_MPDU_START_2_PN_47_32_MASK)
+#define RX_MSDU_END_1_KEY_ID_OCT_MASK            (pdev->targetdef->d_RX_MSDU_END_1_KEY_ID_OCT_MASK)
+#define RX_MSDU_END_1_KEY_ID_OCT_LSB             (pdev->targetdef->d_RX_MSDU_END_1_KEY_ID_OCT_LSB)
 #define RX_MSDU_END_1_EXT_WAPI_PN_63_48_MASK     (pdev->targetdef->d_RX_MSDU_END_1_EXT_WAPI_PN_63_48_MASK)
 #define RX_MSDU_END_1_EXT_WAPI_PN_63_48_LSB      (pdev->targetdef->d_RX_MSDU_END_1_EXT_WAPI_PN_63_48_LSB)
 #define RX_MSDU_END_4_LAST_MSDU_MASK             (pdev->targetdef->d_RX_MSDU_END_4_LAST_MSDU_MASK)
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 207cd2910088..a83b9939f08a 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -535,13 +535,12 @@ static int wma_vdev_start_resp_handler(void *handle, u_int8_t *cmd_param_info,
 		params->chainMask = resp_event->chain_mask;
 		params->smpsMode = host_map_smps_mode(resp_event->smps_mode);
 		params->status = resp_event->status;
-      if (resp_event->resp_type == WMI_VDEV_RESTART_RESP_EVENT &&
-			(iface->type == WMI_VDEV_TYPE_AP)) {
-         wmi_unified_vdev_up_send(wma->wmi_handle,
-                                  resp_event->vdev_id,
-                                  iface->aid,
-                                  iface->bssid);
-		}
+      /*
+       * Marking the VDEV UP STATUS to FALSE
+       * since, VDEV RESTART will do a VDEV DOWN
+       * in the firmware.
+       */
+      iface->vdev_up = FALSE;
 		wma_send_msg(wma, WDA_SWITCH_CHANNEL_RSP, (void *)params, 0);
 	} else if (req_msg->msg_type == WDA_ADD_BSS_REQ) {
 		tpAddBssParams bssParams = (tpAddBssParams) req_msg->user_data;
@@ -13597,13 +13596,11 @@ VOS_STATUS wma_stop(v_VOID_t *vos_ctx, tANI_U8 reason)
 	}
 #endif
 
-#ifdef WLAN_OPEN_SOURCE
 	if (wma_handle->ack_work_ctx) {
-		cancel_work_sync(&wma_handle->ack_work_ctx->ack_cmp_work);
+		vos_flush_work(&wma_handle->ack_work_ctx->ack_cmp_work);
 		adf_os_mem_free(wma_handle->ack_work_ctx);
 		wma_handle->ack_work_ctx = NULL;
 	}
-#endif
 
 #ifdef QCA_WIFI_ISOC
 	wma_hal_stop_isoc(wma_handle);
@@ -15998,3 +15995,43 @@ VOS_STATUS WMA_GetWcnssSoftwareVersion(v_PVOID_t pvosGCtx,
         snprintf(pVersion, versionBufferSize, "%x", (unsigned int)wma_handle->target_fw_version);
         return VOS_STATUS_SUCCESS;
 }
+
+void ol_rx_err(ol_pdev_handle pdev, u_int8_t vdev_id,
+	       u_int8_t *peer_mac_addr, int tid, u_int32_t tsf32,
+	       enum ol_rx_err_type err_type, adf_nbuf_t rx_frame,
+	       u_int64_t *pn, u_int8_t key_id)
+{
+	void *g_vos_ctx = vos_get_global_context(VOS_MODULE_ID_WDA, NULL);
+	tp_wma_handle wma = vos_get_context(VOS_MODULE_ID_WDA, g_vos_ctx);
+	tpSirSmeMicFailureInd mic_err_ind;
+	struct ether_header *eth_hdr;
+
+	if (err_type != OL_RX_ERR_TKIP_MIC)
+		return;
+
+	if (adf_nbuf_len(rx_frame) < sizeof(*eth_hdr))
+		return;
+	eth_hdr = (struct ether_header *) adf_nbuf_data(rx_frame);
+	mic_err_ind = adf_os_mem_alloc(NULL, sizeof(*mic_err_ind));
+	if (!mic_err_ind) {
+		WMA_LOGE("%s: Failed to allocate memory for MIC indication message", __func__);
+		return;
+	}
+	adf_os_mem_set((void *) mic_err_ind, 0, sizeof(*mic_err_ind));
+
+	mic_err_ind->messageType = eWNI_SME_MIC_FAILURE_IND;
+	mic_err_ind->length = sizeof(*mic_err_ind);
+	adf_os_mem_copy(mic_err_ind->bssId,
+		     (v_MACADDR_t *) wma->interfaces[vdev_id].bssid,
+		     sizeof(tSirMacAddr));
+	adf_os_mem_copy(mic_err_ind->info.taMacAddr,
+		     (v_MACADDR_t *) peer_mac_addr, sizeof(tSirMacAddr));
+	adf_os_mem_copy(mic_err_ind->info.srcMacAddr,
+		     (v_MACADDR_t *) eth_hdr->ether_shost, sizeof(tSirMacAddr));
+	adf_os_mem_copy(mic_err_ind->info.dstMacAddr,
+		     (v_MACADDR_t *) eth_hdr->ether_dhost, sizeof(tSirMacAddr));
+        mic_err_ind->info.keyId = key_id;
+        mic_err_ind->info.multicast = IEEE80211_IS_MULTICAST(eth_hdr->ether_dhost);
+	adf_os_mem_copy(mic_err_ind->info.TSC, pn, SIR_CIPHER_SEQ_CTR_SIZE);
+	wma_send_msg(wma, SIR_HAL_MIC_FAILURE_IND, (void *) mic_err_ind, 0);
+}
diff --git a/CORE/SERVICES/WMI/wmi_unified.c b/CORE/SERVICES/WMI/wmi_unified.c
index ea96411f46e0..991f07fa8c5b 100644
--- a/CORE/SERVICES/WMI/wmi_unified.c
+++ b/CORE/SERVICES/WMI/wmi_unified.c
@@ -351,9 +351,8 @@ wmi_unified_detach(struct wmi_unified* wmi_handle)
 {
 #ifndef QCA_WIFI_ISOC
     wmi_buf_t buf;
-#ifdef WLAN_OPEN_SOURCE
-    cancel_work_sync(&wmi_handle->rx_event_work);
-#endif
+
+    vos_flush_work(&wmi_handle->rx_event_work);
     adf_os_spin_lock_bh(&wmi_handle->eventq_lock);
     buf = adf_nbuf_queue_remove(&wmi_handle->event_queue);
     while (buf) {
diff --git a/CORE/VOSS/inc/vos_api.h b/CORE/VOSS/inc/vos_api.h
index a68d2d1527d1..a6f037873fa2 100644
--- a/CORE/VOSS/inc/vos_api.h
+++ b/CORE/VOSS/inc/vos_api.h
@@ -324,4 +324,8 @@ VOS_STATUS vos_wlanRestart(void);
 */
 v_VOID_t vos_fwDumpReq(tANI_U32 cmd, tANI_U32 arg1, tANI_U32 arg2,
                         tANI_U32 arg3, tANI_U32 arg4);
+
+v_VOID_t vos_flush_work(v_VOID_t *work);
+v_VOID_t vos_flush_delayed_work(v_VOID_t *dwork);
+
 #endif // if !defined __VOS_NVITEM_H
diff --git a/CORE/VOSS/src/vos_api.c b/CORE/VOSS/src/vos_api.c
index 9d0e324e4f08..dd17d6526bb1 100644
--- a/CORE/VOSS/src/vos_api.c
+++ b/CORE/VOSS/src/vos_api.c
@@ -68,6 +68,9 @@
 #include "wlan_hdd_main.h"
 #include <linux/vmalloc.h>
 #include "wlan_hdd_cfg80211.h"
+#ifdef CONFIG_CNSS
+#include <net/cnss.h>
+#endif
 
 #include "sapApi.h"
 
@@ -2483,3 +2486,21 @@ VOS_STATUS vos_get_vdev_types(tVOS_CON_MODE mode, tANI_U32 *type,
 #endif
     return status;
 }
+
+v_VOID_t vos_flush_work(v_VOID_t *work)
+{
+#if defined (CONFIG_CNSS)
+   cnss_flush_work(work);
+#elif defined (WLAN_OPEN_SOURCE)
+   cancel_work_sync(work);
+#endif
+}
+
+v_VOID_t vos_flush_delayed_work(v_VOID_t *dwork)
+{
+#if defined (CONFIG_CNSS)
+   cnss_flush_delayed_work(dwork);
+#elif defined (WLAN_OPEN_SOURCE)
+   cancel_delayed_work_sync(dwork);
+#endif
+}