Merge remote-tracking branch 'origin/master' into wlan-cld2.driver.lnx.1.0-rel

* origin/master: (117 commits)
  Release 4.0.11.35
  qcacld-2.0: Ignore BMISS indication in case previous one is not processed
  qcacld-2.0: Fix SapAllChnlList memory leak
  qcacld-2.0: Fix data path cache_buf memory leak
  qcacld-2.0: Fix tpDeleteBssParams memory leak
  cld-2.0: Fix assoc req not including SMPS static in 1x1 antenna mode
  Release 4.0.11.34
  qcacld-2.0: memset bpf load to zero, update the bpf enabled correctly
  qcacld-2.0: CL 1466376 update fw common interface files
  qcacld-2.0: CL 1465726 update fw common interface files
  qcacld-2.0: CL 1464702 update fw common interface files
  qcacld-2.0: CL 1463814 update fw common interface files
  qcacld-2.0: CL 1462943 update fw common interface files
  qcacld-2.0: skip session id validation for FTM mode.
  qcacld-2.0: Correct ext IE in Probe req and Assoc req
  qcacld-2.0: Introduce vos_status_to_os_return
  qcacld-2.0: CL 1468122 update ifw common interface files
  Release 4.0.11.33
  wlan: Allow nRestTimeConc, idle_time_conc, min_rest_time_conc as 0
  qcacld-2.0: enable skb prealloc based on FEATURE_SKB_PRE_ALLOC
  ...

Change-Id: Iaa548afb20b84f7534c957b95ed4845f8cd0ec4a

119 files changed, 5517 insertions, 1059 deletions

diff --git a/Android.mk b/Android.mk
index ae1504bd9e95..4c97823a582b 100644
--- a/Android.mk
+++ b/Android.mk
@@ -60,10 +60,11 @@ KBUILD_OPTIONS += BOARD_PLATFORM=$(TARGET_BOARD_PLATFORM)
 KBUILD_OPTIONS += $(WLAN_SELECT)
 KBUILD_OPTIONS += WLAN_OPEN_SOURCE=$(WLAN_OPEN_SOURCE)
 
+#module to be built for all user,userdebug and eng tags
 include $(CLEAR_VARS)
 LOCAL_MODULE              := $(WLAN_CHIPSET)_wlan.ko
 LOCAL_MODULE_KBUILD_NAME  := wlan.ko
-LOCAL_MODULE_TAGS         := debug
+LOCAL_MODULE_TAGS         := optional
 LOCAL_MODULE_DEBUG_ENABLE := true
 LOCAL_MODULE_PATH         := $(TARGET_OUT)/lib/modules/$(WLAN_CHIPSET)
 include $(DLKM_DIR)/AndroidKernelModule.mk
diff --git a/CORE/CLD_TXRX/HTT/htt_rx.c b/CORE/CLD_TXRX/HTT/htt_rx.c
index 469a11c61364..d42ad328d4ce 100644
--- a/CORE/CLD_TXRX/HTT/htt_rx.c
+++ b/CORE/CLD_TXRX/HTT/htt_rx.c
@@ -48,6 +48,7 @@
 #include <ol_cfg.h>
 #include <ol_rx.h>
 #include <ol_htt_rx_api.h>
+#include <ol_txrx_peer_find.h>
 #include <htt_internal.h> /* HTT_ASSERT, htt_pdev_t, HTT_RX_BUF_SIZE */
 #include "regtable.h"
 
@@ -62,6 +63,9 @@
 #include <asm/system.h>
 #endif
 #endif
+#include <pktlog_ac_fmt.h>
+
+static tp_htt_packetdump_cb ghtt_packetdump_cb;
 
 #ifdef DEBUG_DMA_DONE
 extern int process_wma_set_command(int sessid, int paramid,
@@ -1905,6 +1909,18 @@ htt_rx_amsdu_rx_in_order_pop_ll(
 
         msdu_count--;
 
+        if (ghtt_packetdump_cb) {
+            uint8_t status = RX_PKT_FATE_SUCCESS;
+            uint16_t peer_id =
+              HTT_RX_IN_ORD_PADDR_IND_PEER_ID_GET(*(u_int32_t *)rx_ind_data);
+            struct ol_txrx_peer_t *peer =
+              ol_txrx_peer_find_by_id(pdev->txrx_pdev, peer_id);
+            if (adf_os_unlikely((*((u_int8_t *) &rx_desc->fw_desc.u.val)) &
+                             FW_RX_DESC_MIC_ERR_M))
+                 status = RX_PKT_FATE_FW_DROP_INVALID;
+            ghtt_packetdump_cb(msdu, status, peer->vdev->vdev_id, RX_DATA_PKT);
+        }
+
         if (adf_os_unlikely((*((u_int8_t *) &rx_desc->fw_desc.u.val)) &
                              FW_RX_DESC_MIC_ERR_M)) {
             u_int8_t tid =
@@ -3361,3 +3377,31 @@ int htt_rx_ipa_uc_detach(struct htt_pdev_t *pdev)
 }
 #endif /* IPA_UC_OFFLOAD */
 
+/**
+ * htt_register_packetdump_callback() - stores rx packet dump
+ * callback handler
+ * @htt_packetdump_cb: packetdump cb
+ *
+ * This function is used to store rx packet dump callback
+ *
+ * Return: None
+ *
+ */
+void htt_register_packetdump_callback(tp_htt_packetdump_cb htt_packetdump_cb)
+{
+	ghtt_packetdump_cb = htt_packetdump_cb;
+}
+
+/**
+ * htt_deregister_packetdump_callback() - removes rx packet dump
+ * callback handler
+ *
+ * This function is used to remove rx packet dump callback
+ *
+ * Return: None
+ *
+ */
+void htt_deregister_packetdump_callback(void)
+{
+	ghtt_packetdump_cb = NULL;
+}
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.c b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
index 5e8d7e321475..f34097790774 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.c
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
@@ -1815,9 +1815,9 @@ VOS_STATUS WLANTL_Start(void *vos_ctx)
 VOS_STATUS WLANTL_Close(void *vos_ctx)
 {
 	struct txrx_tl_shim_ctx *tl_shim;
-#if defined(QCA_LL_TX_FLOW_CT) || defined(QCA_SUPPORT_TXRX_VDEV_PAUSE_LL)
-	u_int8_t i;
-#endif /* QCA_LL_TX_FLOW_CT */
+	struct tlshim_buf *cache_buf, *tmp;
+	struct tlshim_sta_info *sta_info;
+	u_int16_t i;
 
 	ENTER();
 	tl_shim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
@@ -1849,7 +1849,19 @@ VOS_STATUS WLANTL_Close(void *vos_ctx)
 	vos_flush_work(&tl_shim->iapp_work.deferred_work);
 #endif
 	vos_flush_work(&tl_shim->cache_flush_work);
-
+	for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
+		sta_info = &tl_shim->sta_info[i];
+		adf_os_spin_lock_bh(&tl_shim->bufq_lock);
+		list_for_each_entry_safe(cache_buf, tmp,
+					 &sta_info->cached_bufq, list) {
+			list_del(&cache_buf->list);
+			adf_os_spin_unlock_bh(&tl_shim->bufq_lock);
+			adf_nbuf_free(cache_buf->buf);
+			adf_os_mem_free(cache_buf);
+			adf_os_spin_lock_bh(&tl_shim->bufq_lock);
+		}
+		adf_os_spin_unlock_bh(&tl_shim->bufq_lock);
+	}
 	wdi_in_pdev_detach(((pVosContextType) vos_ctx)->pdev_txrx_ctx, 1);
 	// Delete beacon buffer hanging off tl_shim
 	if (tl_shim->last_beacon_data) {
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.h b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
index 617bc5b267c5..0fb1f8809653 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.h
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -132,4 +132,27 @@ static inline void tl_shim_set_peer_authorized_event(void *vos_ctx, v_U8_t sessi
 {
 }
 #endif
+
+static inline
+void tlshim_set_bundle_require(uint8_t vdev_id, unsigned long tx_bytes,
+			uint32_t time_in_ms, uint32_t high_th, uint32_t low_th)
+{
+	ol_tx_vdev_set_bundle_require(vdev_id, tx_bytes,
+				 time_in_ms, high_th, low_th);
+}
+
+static inline void tlshim_reset_bundle_require(void)
+{
+	void *vos_ctx = vos_get_global_context(VOS_MODULE_ID_TL, NULL);
+	void *pdev;
+
+	if (!vos_ctx)
+		return;
+
+	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_ctx);
+	if (!pdev)
+		return;
+
+	ol_tx_pdev_reset_bundle_require(pdev);
+}
 #endif
diff --git a/CORE/CLD_TXRX/TXRX/ol_cfg.c b/CORE/CLD_TXRX/TXRX/ol_cfg.c
index 26a3f2433a16..10c533dbf2bf 100644
--- a/CORE/CLD_TXRX/TXRX/ol_cfg.c
+++ b/CORE/CLD_TXRX/TXRX/ol_cfg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -33,6 +33,29 @@ module_param(vow_config, uint, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
 MODULE_PARM_DESC(vow_config, "Do VoW Configuration");
 EXPORT_SYMBOL(vow_config);
 
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+/**
+ * ol_cfg_update_bundle_params() - update tx bundle params
+ * @cfg_ctx: cfg context
+ * @cfg_param: parameters
+ *
+ * Return: none
+ */
+void ol_cfg_update_bundle_params(struct txrx_pdev_cfg_t *cfg_ctx,
+				struct txrx_pdev_cfg_param_t cfg_param)
+{
+	cfg_ctx->pkt_bundle_timer_value = cfg_param.pkt_bundle_timer_value;
+	cfg_ctx->pkt_bundle_size = cfg_param.pkt_bundle_size;
+}
+#else
+void ol_cfg_update_bundle_params(struct txrx_pdev_cfg_t *cfg_ctx,
+				struct txrx_pdev_cfg_param_t cfg_param)
+{
+	return;
+}
+#endif
+
+
 /* FIX THIS -
  * For now, all these configuration parameters are hardcoded.
  * Many of these should actually be determined dynamically instead.
@@ -87,9 +110,37 @@ ol_pdev_handle ol_pdev_cfg_attach(adf_os_device_t osdev,
 	cfg_ctx->ipa_uc_rsc.rx_ind_ring_size = cfg_param.uc_rx_indication_ring_count;
 	cfg_ctx->ipa_uc_rsc.tx_partition_base = cfg_param.uc_tx_partition_base;
 #endif /* IPA_UC_OFFLOAD */
+
+	ol_cfg_update_bundle_params(cfg_ctx, cfg_param);
 	return (ol_pdev_handle) cfg_ctx;
 }
 
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+/**
+ * ol_cfg_get_bundle_timer_value() - get bundle timer value
+ * @pdev: pdev handle
+ *
+ * Return: bundle timer value
+ */
+int ol_cfg_get_bundle_timer_value(ol_pdev_handle pdev)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+	return cfg->pkt_bundle_timer_value;
+}
+
+/**
+ * ol_cfg_get_bundle_size() - get bundle size value
+ * @pdev: pdev handle
+ *
+ * Return: bundle size value
+ */
+int ol_cfg_get_bundle_size(ol_pdev_handle pdev)
+{
+	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
+	return cfg->pkt_bundle_size;
+}
+#endif
+
 int ol_cfg_is_high_latency(ol_pdev_handle pdev)
 {
 	struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)pdev;
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx.c b/CORE/CLD_TXRX/TXRX/ol_rx.c
index 64111791b269..3691ee683c5a 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx.c
@@ -106,6 +106,22 @@ void ol_rx_trigger_restore(htt_pdev_handle htt_pdev, adf_nbuf_t head_msdu,
 }
 #endif
 
+void ol_rx_reset_pn_replay_counters(struct ol_txrx_pdev_t *pdev)
+{
+    adf_os_mem_zero(pdev->pn_replays,
+                    OL_RX_NUM_PN_REPLAY_TYPES * sizeof(uint32_t));
+}
+
+uint32_t ol_rx_get_tkip_replay_counter(struct ol_txrx_pdev_t *pdev)
+{
+    return pdev->pn_replays[OL_RX_TKIP_REPLAYS];
+}
+
+uint32_t ol_rx_get_ccmp_replay_counter(struct ol_txrx_pdev_t *pdev)
+{
+    return pdev->pn_replays[OL_RX_CCMP_REPLAYS];
+}
+
 static void ol_rx_process_inv_peer(
     ol_txrx_pdev_handle pdev,
     void *rx_mpdu_desc,
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx_pn.c b/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
index 5bc11c20145a..aae18f8b0026 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2015, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -107,6 +107,7 @@ ol_rx_pn_check_base(
     int pn_len;
     void *rx_desc;
     int last_pn_valid;
+    enum pn_replay_type replay_type = OL_RX_OTHER_REPLAYS;
 
     /* Make sure host pn check is not redundant */
     if ((adf_os_atomic_read(&peer->fw_pn_check)) ||
@@ -120,6 +121,14 @@ ol_rx_pn_check_base(
     index = htt_rx_msdu_is_wlan_mcast(pdev->htt_pdev, rx_desc) ?
         txrx_sec_mcast : txrx_sec_ucast;
     pn_len = pdev->rx_pn[peer->security[index].sec_type].len;
+
+    if (peer->security[index].sec_type == htt_sec_type_tkip ||
+        peer->security[index].sec_type == htt_sec_type_tkip_nomic) {
+        replay_type = OL_RX_TKIP_REPLAYS;
+    } else if (peer->security[index].sec_type == htt_sec_type_aes_ccmp) {
+        replay_type = OL_RX_CCMP_REPLAYS;
+    }
+
     if (pn_len == 0) {
         return msdu_list;
     }
@@ -212,6 +221,7 @@ ol_rx_pn_check_base(
                 OL_RX_ERR_STATISTICS_1(pdev, vdev, peer, rx_desc, OL_RX_ERR_PN);
                 next_msdu = adf_nbuf_next(msdu);
                 htt_rx_desc_frame_free(pdev->htt_pdev, msdu);
+                pdev->pn_replays[replay_type]++;
                 if (msdu == mpdu_tail) {
                     break;
                 } else {
diff --git a/CORE/CLD_TXRX/TXRX/ol_tx.c b/CORE/CLD_TXRX/TXRX/ol_tx.c
index ad29d3245b7e..8e1488d35181 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_tx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -521,11 +521,14 @@ ol_tx_non_std_ll(
  */
 #define OCB_HEADER_VERSION     1
 static bool parse_ocb_tx_header(adf_nbuf_t msdu,
-                                struct ocb_tx_ctrl_hdr_t *tx_ctrl)
+                                struct ocb_tx_ctrl_hdr_t *tx_ctrl,
+                                bool *tx_ctrl_header_found)
 {
     struct ether_header *eth_hdr_p;
     struct ocb_tx_ctrl_hdr_t *tx_ctrl_hdr;
 
+    *tx_ctrl_header_found = false;
+
     /* Check if TX control header is present */
     eth_hdr_p = (struct ether_header *) adf_nbuf_data(msdu);
     if (eth_hdr_p->ether_type != adf_os_htons(ETHERTYPE_OCB_TX))
@@ -539,6 +542,7 @@ static bool parse_ocb_tx_header(adf_nbuf_t msdu,
     tx_ctrl_hdr = (struct ocb_tx_ctrl_hdr_t*) adf_nbuf_data(msdu);
 
     if (tx_ctrl_hdr->version == OCB_HEADER_VERSION) {
+        *tx_ctrl_header_found = true;
         if (tx_ctrl)
             adf_os_mem_copy(tx_ctrl, tx_ctrl_hdr, sizeof(*tx_ctrl_hdr));
     } else {
@@ -551,12 +555,55 @@ static bool parse_ocb_tx_header(adf_nbuf_t msdu,
     return true;
 }
 
+/**
+ * merge_ocb_tx_ctrl_hdr() - merge the default TX ctrl parameters into
+ * @tx_ctrl: The destination TX control header.
+ * @def_ctrl_hdr: The default TX control header.
+ *
+ * For each parameter in tx_ctrl, if the parameter is unspecified, the
+ * equivalent parameter in def_ctrl_hdr will be copied to tx_ctrl.
+ */
+static void merge_ocb_tx_ctrl_hdr(struct ocb_tx_ctrl_hdr_t *tx_ctrl,
+				  struct ocb_tx_ctrl_hdr_t *def_ctrl_hdr)
+{
+	if (!tx_ctrl || !def_ctrl_hdr)
+		return;
+
+	if (!tx_ctrl->channel_freq && def_ctrl_hdr->channel_freq)
+		tx_ctrl->channel_freq = def_ctrl_hdr->channel_freq;
+	if (!tx_ctrl->valid_pwr && def_ctrl_hdr->valid_pwr) {
+		tx_ctrl->pwr = def_ctrl_hdr->pwr;
+		tx_ctrl->valid_pwr = 1;
+	}
+	if (!tx_ctrl->valid_datarate && def_ctrl_hdr->valid_datarate) {
+		tx_ctrl->datarate = def_ctrl_hdr->datarate;
+		tx_ctrl->valid_datarate = 1;
+	}
+	if (!tx_ctrl->valid_retries && def_ctrl_hdr->valid_retries) {
+		tx_ctrl->retry_limit = def_ctrl_hdr->retry_limit;
+		tx_ctrl->valid_retries = 1;
+	}
+	if (!tx_ctrl->valid_chain_mask && def_ctrl_hdr->valid_chain_mask) {
+		tx_ctrl->chain_mask = def_ctrl_hdr->chain_mask;
+		tx_ctrl->valid_chain_mask = 1;
+	}
+	if (!tx_ctrl->valid_expire_tsf && def_ctrl_hdr->valid_expire_tsf) {
+		tx_ctrl->expire_tsf_hi = def_ctrl_hdr->expire_tsf_hi;
+		tx_ctrl->expire_tsf_lo = def_ctrl_hdr->expire_tsf_lo;
+		tx_ctrl->valid_expire_tsf = 1;
+	}
+	if (!tx_ctrl->valid_tid && def_ctrl_hdr->valid_tid) {
+		tx_ctrl->ext_tid = def_ctrl_hdr->ext_tid;
+		tx_ctrl->valid_tid = 1;
+	}
+}
+
 static inline adf_nbuf_t
 ol_tx_hl_base(
     ol_txrx_vdev_handle vdev,
     enum ol_tx_spec tx_spec,
     adf_nbuf_t msdu_list,
-    int tx_comp_req)
+    int tx_comp_req, bool call_sched)
 {
     struct ol_txrx_pdev_t *pdev = vdev->pdev;
     adf_nbuf_t msdu = msdu_list;
@@ -638,10 +685,18 @@ ol_tx_hl_base(
 
         /* If the vdev is in OCB mode, parse the tx control header. */
         if (vdev->opmode == wlan_op_mode_ocb) {
-            if (!parse_ocb_tx_header(msdu, &tx_ctrl)) {
+            bool tx_ctrl_header_found = false;
+
+            if (!parse_ocb_tx_header(msdu, &tx_ctrl, &tx_ctrl_header_found)) {
                 /* There was an error parsing the header. Skip this packet. */
                 goto MSDU_LOOP_BOTTOM;
             }
+            /* If the TX control header was not found, just use the defaults */
+            if (!tx_ctrl_header_found && vdev->ocb_def_tx_param)
+                vos_mem_copy(&tx_ctrl, vdev->ocb_def_tx_param, sizeof(tx_ctrl));
+            /* If the TX control header was found, merge the defaults into it */
+            else if (tx_ctrl_header_found && vdev->ocb_def_tx_param)
+                merge_ocb_tx_ctrl_hdr(&tx_ctrl, vdev->ocb_def_tx_param);
         }
 
         txq = ol_tx_classify(vdev, tx_desc, msdu, &tx_msdu_info);
@@ -717,18 +772,261 @@ ol_tx_hl_base(
 MSDU_LOOP_BOTTOM:
         msdu = next;
     }
-    ol_tx_sched(pdev);
+
+    if (call_sched == true)
+        ol_tx_sched(pdev);
 
     return NULL; /* all MSDUs were accepted */
 }
 
+/**
+ * ol_txrx_get_vdev_from_vdev_id() - get vdev from vdev_id
+ * @vdev_id: vdev_id
+ *
+ * Return: vdev handle
+ *            NULL if not found.
+ */
+ol_txrx_vdev_handle ol_txrx_get_vdev_from_vdev_id(uint8_t vdev_id)
+{
+	v_CONTEXT_t vos_context = vos_get_global_context(VOS_MODULE_ID_TXRX,
+							 NULL);
+	ol_txrx_pdev_handle pdev = vos_get_context(VOS_MODULE_ID_TXRX,
+							 vos_context);
+	ol_txrx_vdev_handle vdev = NULL;
+
+	if (adf_os_unlikely(!pdev))
+		return NULL;
+
+	TAILQ_FOREACH(vdev, &pdev->vdev_list, vdev_list_elem)
+		if (vdev->vdev_id == vdev_id)
+			break;
+
+	return vdev;
+}
+
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+/**
+ * ol_tx_pdev_reset_bundle_require() - reset bundle require flag
+ * @pdev_handle: pdev handle
+ *
+ * Return: none
+ */
+void
+ol_tx_pdev_reset_bundle_require(void* pdev_handle)
+{
+	struct ol_txrx_pdev_t *pdev = (struct ol_txrx_pdev_t *)pdev_handle;
+	struct ol_txrx_vdev_t *vdev;
+
+	TAILQ_FOREACH(vdev, &pdev->vdev_list, vdev_list_elem) {
+		vdev->bundling_reqired = false;
+		TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+			"vdev_id %d bundle_require %d\n",
+			vdev->vdev_id, vdev->bundling_reqired);
+    }
+}
+
+/**
+ * ol_tx_vdev_set_bundle_require() - set bundle require flag if required
+ * @vdev_id: vdev id
+ * @tx_packets: number of tx packets
+ * @time_in_ms: time in ms
+ * @high_th: high threashold
+ * @low_th: low threashold
+ *
+ * Return: none
+ */
+void
+ol_tx_vdev_set_bundle_require(uint8_t vdev_id, unsigned long tx_bytes,
+			uint32_t time_in_ms, uint32_t high_th, uint32_t low_th)
+{
+	struct ol_txrx_vdev_t* vdev = ol_txrx_get_vdev_from_vdev_id(vdev_id);
+	bool old_bundle_required;
+
+	if ((!vdev) || (low_th > high_th))
+		return;
+
+	old_bundle_required = vdev->bundling_reqired;
+	if (tx_bytes > ((high_th * time_in_ms * 1500)/1000))
+		vdev->bundling_reqired = true;
+	else if (tx_bytes < ((low_th * time_in_ms * 1500)/1000))
+		vdev->bundling_reqired = false;
+
+	if (old_bundle_required != vdev->bundling_reqired)
+		TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+			"vdev_id %d bundle_require %d tx_bytes %ld time_in_ms %d high_th %d low_th %d\n",
+			vdev->vdev_id, vdev->bundling_reqired, tx_bytes,
+			time_in_ms, high_th, low_th);
+}
+
+/**
+ * ol_tx_hl_queue_flush_all() - drop all packets in vdev bundle queue
+ * @vdev: vdev handle
+ *
+ * Return: none
+ */
+void
+ol_tx_hl_queue_flush_all(struct ol_txrx_vdev_t* vdev)
+{
+	adf_os_spin_lock_bh(&vdev->bundle_queue.mutex);
+	if (vdev->bundle_queue.txq.depth != 0) {
+		adf_os_timer_cancel(&vdev->bundle_queue.timer);
+		vdev->pdev->total_bundle_queue_length -=
+				vdev->bundle_queue.txq.depth;
+		adf_nbuf_tx_free(vdev->bundle_queue.txq.head, 1/*error*/);
+		vdev->bundle_queue.txq.depth = 0;
+		vdev->bundle_queue.txq.head = NULL;
+		vdev->bundle_queue.txq.tail = NULL;
+	}
+	adf_os_spin_unlock_bh(&vdev->bundle_queue.mutex);
+}
+
+/**
+ * ol_tx_hl_vdev_queue_append() - append pkt in tx queue
+ * @vdev: vdev handle
+ * @msdu_list: msdu list
+ *
+ * Return: none
+ */
+static void
+ol_tx_hl_vdev_queue_append(struct ol_txrx_vdev_t* vdev, adf_nbuf_t msdu_list)
+{
+	adf_os_spin_lock_bh(&vdev->bundle_queue.mutex);
+
+	if (!vdev->bundle_queue.txq.head) {
+		adf_os_timer_start(
+			&vdev->bundle_queue.timer,
+			ol_cfg_get_bundle_timer_value(vdev->pdev->ctrl_pdev));
+		vdev->bundle_queue.txq.head = msdu_list;
+		vdev->bundle_queue.txq.tail = msdu_list;
+	} else {
+		adf_nbuf_set_next(vdev->bundle_queue.txq.tail, msdu_list);
+	}
+
+	while (adf_nbuf_next(msdu_list) != NULL) {
+		vdev->bundle_queue.txq.depth++;
+		vdev->pdev->total_bundle_queue_length++;
+		msdu_list = adf_nbuf_next(msdu_list);
+	}
+
+	vdev->bundle_queue.txq.depth++;
+	vdev->pdev->total_bundle_queue_length++;
+	vdev->bundle_queue.txq.tail = msdu_list;
+	adf_os_spin_unlock_bh(&vdev->bundle_queue.mutex);
+
+	return;
+}
+
+/**
+ * ol_tx_hl_vdev_queue_send_all() - send all packets in vdev bundle queue
+ * @vdev: vdev handle
+ * @call_sched: invoke scheduler
+ *
+ * Return: NULL for success
+ */
+adf_nbuf_t
+ol_tx_hl_vdev_queue_send_all(struct ol_txrx_vdev_t* vdev, bool call_sched)
+{
+	adf_nbuf_t msdu_list = NULL;
+	struct ol_txrx_pdev_t *pdev = vdev->pdev;
+	int tx_comp_req = pdev->cfg.default_tx_comp_req;
+
+	adf_os_spin_lock_bh(&vdev->bundle_queue.mutex);
+
+	if (vdev->bundle_queue.txq.depth != 0) {
+		adf_os_timer_cancel(&vdev->bundle_queue.timer);
+		vdev->pdev->total_bundle_queue_length -=
+			vdev->bundle_queue.txq.depth;
+		msdu_list = ol_tx_hl_base(vdev, ol_tx_spec_std,
+			vdev->bundle_queue.txq.head, tx_comp_req, call_sched);
+
+		vdev->bundle_queue.txq.depth = 0;
+		vdev->bundle_queue.txq.head = NULL;
+		vdev->bundle_queue.txq.tail = NULL;
+	}
+	adf_os_spin_unlock_bh(&vdev->bundle_queue.mutex);
+
+	return msdu_list;
+}
+
+/**
+ * ol_tx_hl_pdev_queue_send_all() - send all packets from all vdev bundle queue
+ * @pdev: pdev handle
+ *
+ * Return: NULL for success
+ */
+adf_nbuf_t
+ol_tx_hl_pdev_queue_send_all(struct ol_txrx_pdev_t* pdev)
+{
+	struct ol_txrx_vdev_t* vdev;
+	adf_nbuf_t msdu_list;
+
+	TAILQ_FOREACH(vdev, &pdev->vdev_list, vdev_list_elem) {
+		msdu_list = ol_tx_hl_vdev_queue_send_all(vdev, false);
+		if (msdu_list)
+			adf_nbuf_tx_free(msdu_list, 1/*error*/);
+	}
+	ol_tx_sched(pdev);
+	return NULL; /* all msdus were accepted */
+}
+
+/**
+ * ol_tx_hl_vdev_bundle_timer() - bundle timer function
+ * @vdev: vdev handle
+ *
+ * Return: none
+ */
+void
+ol_tx_hl_vdev_bundle_timer(void *vdev)
+{
+	adf_nbuf_t msdu_list;
+
+	msdu_list = ol_tx_hl_vdev_queue_send_all(vdev, true);
+	if (msdu_list)
+		adf_nbuf_tx_free(msdu_list, 1/*error*/);
+}
+
+/**
+ * ol_tx_hl_queue() - queueing logic to bundle in HL
+ * @vdev: vdev handle
+ * @msdu_list: msdu list
+ *
+ * Return: NULL for success/drop msdu list
+ */
+adf_nbuf_t
+ol_tx_hl_queue(struct ol_txrx_vdev_t* vdev, adf_nbuf_t msdu_list)
+{
+	struct ol_txrx_pdev_t *pdev = vdev->pdev;
+	int tx_comp_req = pdev->cfg.default_tx_comp_req;
+
+	if (vdev->bundling_reqired == true &&
+		(ol_cfg_get_bundle_size(vdev->pdev->ctrl_pdev) > 1)) {
+		ol_tx_hl_vdev_queue_append(vdev, msdu_list);
+		if (pdev->total_bundle_queue_length >=
+			ol_cfg_get_bundle_size(vdev->pdev->ctrl_pdev)){
+			return ol_tx_hl_pdev_queue_send_all(pdev);
+		}
+	} else {
+		if (vdev->bundle_queue.txq.depth != 0) {
+			ol_tx_hl_vdev_queue_append(vdev, msdu_list);
+			return ol_tx_hl_vdev_queue_send_all(vdev, true);
+		} else {
+			return ol_tx_hl_base(vdev, ol_tx_spec_std, msdu_list,
+							 tx_comp_req, true);
+		}
+	}
+
+	return NULL; /* all msdus were accepted */
+}
+
+#endif
+
 adf_nbuf_t
 ol_tx_hl(ol_txrx_vdev_handle vdev, adf_nbuf_t msdu_list)
 {
     struct ol_txrx_pdev_t *pdev = vdev->pdev;
     int tx_comp_req = pdev->cfg.default_tx_comp_req;
 
-    return ol_tx_hl_base(vdev, ol_tx_spec_std, msdu_list, tx_comp_req);
+    return ol_tx_hl_base(vdev, ol_tx_spec_std, msdu_list, tx_comp_req, true);
 }
 
 adf_nbuf_t
@@ -746,7 +1044,7 @@ ol_tx_non_std_hl(
             tx_comp_req = 1;
         }
     }
-    return ol_tx_hl_base(vdev, tx_spec, msdu_list, tx_comp_req);
+    return ol_tx_hl_base(vdev, tx_spec, msdu_list, tx_comp_req, true);
 }
 
 adf_nbuf_t
diff --git a/CORE/CLD_TXRX/TXRX/ol_tx.h b/CORE/CLD_TXRX/TXRX/ol_tx.h
index a2290ae0cc6b..ed6e6439c16c 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx.h
+++ b/CORE/CLD_TXRX/TXRX/ol_tx.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014,2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -35,7 +35,6 @@
 #include <adf_nbuf.h>    /* adf_nbuf_t */
 #include <adf_os_lock.h>
 #include <ol_txrx_api.h> /* ol_txrx_vdev_handle */
-
 #include <ol_txrx_types.h>  /* ol_tx_desc_t, ol_txrx_msdu_info_t */
 
 adf_nbuf_t
@@ -44,12 +43,43 @@ ol_tx_ll(ol_txrx_vdev_handle vdev, adf_nbuf_t msdu_list);
 adf_nbuf_t
 ol_tx_ll_queue(ol_txrx_vdev_handle vdev, adf_nbuf_t msdu_list);
 
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+void
+ol_tx_hl_vdev_bundle_timer(void *vdev);
+
+void
+ol_tx_hl_queue_flush_all(struct ol_txrx_vdev_t* vdev);
+
+adf_nbuf_t
+ol_tx_hl_queue(struct ol_txrx_vdev_t* vdev, adf_nbuf_t msdu_list);
+
+#else
+
+static inline void ol_tx_hl_vdev_bundle_timer(void *vdev)
+{
+	return;
+}
+
+static inline void
+ol_tx_hl_queue_flush_all(struct ol_txrx_vdev_t* vdev)
+{
+	return;
+}
+
+#endif
+
 #ifdef QCA_SUPPORT_TXRX_VDEV_LL_TXQ
 #define OL_TX_LL ol_tx_ll_queue
 #else
 #define OL_TX_LL ol_tx_ll
 #endif
 
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+#define OL_TX_HL ol_tx_hl_queue
+#else
+#define OL_TX_HL ol_tx_hl
+#endif
+
 void ol_tx_vdev_ll_pause_queue_send(void *context);
 
 adf_nbuf_t
diff --git a/CORE/CLD_TXRX/TXRX/ol_tx_desc.c b/CORE/CLD_TXRX/TXRX/ol_tx_desc.c
index 60dc045b05aa..3ac64c413886 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx_desc.c
+++ b/CORE/CLD_TXRX/TXRX/ol_tx_desc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -96,9 +96,7 @@ ol_tx_desc_alloc(struct ol_txrx_pdev_t *pdev, struct ol_txrx_vdev_t *vdev)
     if (!tx_desc) {
         return NULL;
     }
-#if defined(CONFIG_HL_SUPPORT)
     tx_desc->vdev = vdev;
-#endif
 #if defined(CONFIG_PER_VDEV_TX_DESC_POOL)
     adf_os_atomic_inc(&vdev->tx_desc_count);
 #endif
diff --git a/CORE/CLD_TXRX/TXRX/ol_tx_queue.c b/CORE/CLD_TXRX/TXRX/ol_tx_queue.c
index 4844e8bbde5c..8f368ec8aedc 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx_queue.c
+++ b/CORE/CLD_TXRX/TXRX/ol_tx_queue.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -105,10 +105,21 @@ ol_tx_queue_vdev_flush(struct ol_txrx_pdev_t *pdev, struct ol_txrx_vdev_t *vdev)
     struct ol_txrx_peer_t *peer, *peers[PEER_ARRAY_COUNT];
     int i, j, peer_count;
 
+    /* flush bundling queue */
+    ol_tx_hl_queue_flush_all(vdev);
+
     /* flush VDEV TX queues */
     for (i = 0; i < OL_TX_VDEV_NUM_QUEUES; i++) {
         txq = &vdev->txqs[i];
-        ol_tx_queue_free(pdev, txq, (i + OL_TX_NUM_TIDS));
+       /*
+        * currently txq of MCAST_BCAST packet is using tid
+        * HTT_TX_EXT_TID_NON_QOS_MCAST_BCAST when instered into scheduler,
+        * so use same tid when flush
+        */
+        if (i == 0)
+            ol_tx_queue_free(pdev, txq, HTT_TX_EXT_TID_NON_QOS_MCAST_BCAST);
+        else
+            ol_tx_queue_free(pdev, txq, (i + OL_TX_NUM_TIDS));
     }
     /* flush PEER TX queues */
     do {
@@ -1026,9 +1037,11 @@ ol_txrx_vdev_pause(ol_txrx_vdev_handle vdev, u_int32_t reason)
         /* use peer_ref_mutex before accessing peer_list */
         adf_os_spin_lock_bh(&pdev->peer_ref_mutex);
         adf_os_spin_lock_bh(&pdev->tx_queue_spinlock);
-        vdev->hl_paused_reason |= reason;
-        TAILQ_FOREACH(peer, &vdev->peer_list, peer_list_elem) {
-            ol_txrx_peer_pause_base(pdev, peer);
+        if((vdev->hl_paused_reason & reason) == 0) {
+            vdev->hl_paused_reason |= reason;
+            TAILQ_FOREACH(peer, &vdev->peer_list, peer_list_elem) {
+                ol_txrx_peer_pause_base(pdev, peer);
+            }
         }
         adf_os_spin_unlock_bh(&pdev->tx_queue_spinlock);
         adf_os_spin_unlock_bh(&pdev->peer_ref_mutex);
diff --git a/CORE/CLD_TXRX/TXRX/ol_tx_send.c b/CORE/CLD_TXRX/TXRX/ol_tx_send.c
index ce70cb302cd9..2a87be36097d 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx_send.c
+++ b/CORE/CLD_TXRX/TXRX/ol_tx_send.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -59,6 +59,9 @@
 #endif
 #include <ol_tx_queue.h>
 #include <ol_txrx.h>
+#include <pktlog_ac_fmt.h>
+
+static tp_ol_packetdump_cb gol_packetdump_cb;
 
 #ifdef TX_CREDIT_RECLAIM_SUPPORT
 
@@ -552,6 +555,9 @@ ol_tx_completion_handler(
             OL_TX_DESC_UPDATE_GROUP_CREDIT(pdev, tx_desc_id, 1, 0, status);
         }
 
+    if (gol_packetdump_cb)
+        gol_packetdump_cb(netbuf, status, tx_desc->vdev->vdev_id, TX_DATA_PKT);
+
         htc_pm_runtime_put(pdev->htt_pdev->htc_pdev);
         adf_nbuf_trace_update(netbuf, trace_str);
         /* Per SDU update of byte count */
@@ -745,6 +751,9 @@ ol_tx_single_completion_handler(
     /* Do one shot statistics */
     TXRX_STATS_UPDATE_TX_STATS(pdev, status, 1, adf_nbuf_len(netbuf));
 
+     if (gol_packetdump_cb)
+        gol_packetdump_cb(netbuf, status, tx_desc->vdev->vdev_id, TX_MGMT_PKT);
+
     if (OL_TX_DESC_NO_REFS(tx_desc)) {
         ol_tx_desc_frame_free_nonstd(pdev, tx_desc, status != htt_tx_status_ok);
     }
@@ -1131,3 +1140,32 @@ ol_tx_delay_compute(
 }
 
 #endif /* QCA_COMPUTE_TX_DELAY */
+
+/**
+ * ol_register_packetdump_callback() - stores tx packet dump
+ * callback handler
+ * @ol_packetdump_cb: packetdump cb
+ *
+ * This function is used to store tx packet dump callback
+ *
+ * Return: None
+ *
+ */
+void ol_register_packetdump_callback(tp_ol_packetdump_cb ol_packetdump_cb)
+{
+	gol_packetdump_cb = ol_packetdump_cb;
+}
+
+/**
+ * ol_deregister_packetdump_callback() - removes tx packet dump
+ * callback handler
+ *
+ * This function is used to remove tx packet dump callback
+ *
+ * Return: None
+ *
+ */
+void ol_deregister_packetdump_callback(void)
+{
+	gol_packetdump_cb = NULL;
+}
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c
index e328fd410cec..e70a4e7b3aff 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -418,6 +418,9 @@ ol_txrx_pdev_attach(
         goto fail2;
     }
 
+    adf_os_mem_zero(pdev->pn_replays,
+                    OL_RX_NUM_PN_REPLAY_TYPES * sizeof(uint32_t));
+
 #ifdef IPA_UC_OFFLOAD
     /* Attach micro controller data path offload resource */
     if (ol_cfg_ipa_uc_offload_enabled(ctrl_pdev)) {
@@ -1092,6 +1095,17 @@ ol_txrx_vdev_attach(
     /* Default MAX Q depth for every VDEV */
     vdev->ll_pause.max_q_depth =
         ol_tx_cfg_max_tx_queue_depth_ll(vdev->pdev->ctrl_pdev);
+
+    vdev->bundling_reqired = false;
+    adf_os_spinlock_init(&vdev->bundle_queue.mutex);
+    vdev->bundle_queue.txq.head = vdev->ll_pause.txq.tail = NULL;
+    vdev->bundle_queue.txq.depth = 0;
+    adf_os_timer_init(
+            pdev->osdev,
+            &vdev->bundle_queue.timer,
+            ol_tx_hl_vdev_bundle_timer,
+            vdev, ADF_DEFERRABLE_TIMER);
+
     /* add this vdev into the pdev's list */
     TAILQ_INSERT_TAIL(&pdev->vdev_list, vdev, vdev_list_elem);
 
@@ -1118,7 +1132,7 @@ void ol_txrx_osif_vdev_register(ol_txrx_vdev_handle vdev,
     vdev->osif_rx = txrx_ops->rx.std;
 
     if (ol_cfg_is_high_latency(vdev->pdev->ctrl_pdev)) {
-        txrx_ops->tx.std = vdev->tx = ol_tx_hl;
+        txrx_ops->tx.std = vdev->tx = OL_TX_HL;
         txrx_ops->tx.non_std = ol_tx_non_std_hl;
     } else {
         txrx_ops->tx.std = vdev->tx = OL_TX_LL;
@@ -2500,6 +2514,92 @@ exit:
     return rc;
 }
 
+#define MAX_TID         15
+#define MAX_DATARATE    7
+#define OCB_HEADER_VERSION 1
+
+/**
+ * ol_txrx_set_ocb_def_tx_param() - Set the default OCB TX parameters
+ * @vdev: The OCB vdev that will use these defaults.
+ * @_def_tx_param: The default TX parameters.
+ * @def_tx_param_size: The size of the _def_tx_param buffer.
+ *
+ * Return: true if the default parameters were set correctly, false if there
+ * is an error, for example an invalid parameter. In the case that false is
+ * returned, see the kernel log for the error description.
+ */
+bool ol_txrx_set_ocb_def_tx_param(ol_txrx_vdev_handle vdev,
+	void *_def_tx_param, uint32_t def_tx_param_size)
+{
+	struct ocb_tx_ctrl_hdr_t *def_tx_param =
+		(struct ocb_tx_ctrl_hdr_t *)_def_tx_param;
+
+	if (def_tx_param) {
+		/*
+		 * Default TX parameters are provided.
+		 * Validate the contents and
+		 * save them in the vdev.
+		 */
+		if (def_tx_param_size != sizeof(struct ocb_tx_ctrl_hdr_t)) {
+			VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
+			    "Invalid size of OCB default TX params");
+			return false;
+		}
+
+		if (def_tx_param->version != OCB_HEADER_VERSION) {
+			VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
+				  "Invalid version of OCB default TX params");
+			return false;
+		}
+
+		if (def_tx_param->channel_freq) {
+			int i;
+			for (i = 0; i < vdev->ocb_channel_count; i++) {
+				if (vdev->ocb_channel_info[i].chan_freq ==
+						def_tx_param->channel_freq)
+					break;
+			}
+			if (i == vdev->ocb_channel_count) {
+				VOS_TRACE(VOS_MODULE_ID_TXRX,
+					  VOS_TRACE_LEVEL_ERROR,
+					  "Invalid default channel frequency");
+				return false;
+			}
+		}
+
+		if (def_tx_param->valid_datarate &&
+			    def_tx_param->datarate > MAX_DATARATE) {
+			VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
+				  "Invalid default datarate");
+			return false;
+		}
+
+		if (def_tx_param->valid_tid &&
+			    def_tx_param->ext_tid > MAX_TID) {
+			VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
+				  "Invalid default TID");
+			return false;
+		}
+
+		if (vdev->ocb_def_tx_param == NULL)
+			vdev->ocb_def_tx_param =
+				vos_mem_malloc(sizeof(*vdev->ocb_def_tx_param));
+		vos_mem_copy(vdev->ocb_def_tx_param, def_tx_param,
+			     sizeof(*vdev->ocb_def_tx_param));
+	} else {
+		/*
+		 * Default TX parameters are not provided.
+		 * Delete the old defaults.
+		 */
+		if (vdev->ocb_def_tx_param) {
+			vos_mem_free(vdev->ocb_def_tx_param);
+			vdev->ocb_def_tx_param = NULL;
+		}
+	}
+
+	return true;
+}
+
 #ifdef IPA_UC_OFFLOAD
 void
 ol_txrx_ipa_uc_get_resource(
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx_event.c b/CORE/CLD_TXRX/TXRX/ol_txrx_event.c
index e144ce09a2b2..0435a9173e7e 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx_event.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx_event.c
@@ -87,7 +87,7 @@ wdi_event_handler(
     /*
      * Input validation
      */
-    if (!event) {
+    if (event == 0) {
         VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
             "Invalid WDI event in %s\n", __FUNCTION__);
         return;
@@ -128,7 +128,7 @@ wdi_event_sub(
             "Invalid callback in %s", __FUNCTION__);
         return A_ERROR;
     }
-    if ((!event) || (event >= WDI_EVENT_LAST) || (event < WDI_EVENT_BASE)) {
+    if ((event == 0) || (event >= WDI_EVENT_LAST) || (event < WDI_EVENT_BASE)) {
         VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
             "Invalid event in %s", __FUNCTION__);
         return A_ERROR;
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
index 0e51647e9d72..00fb5cf68d83 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
@@ -191,9 +191,9 @@ struct ol_tx_desc_t {
 	/* used by tx encap, to restore the os buf start offset after tx complete*/
 	u_int8_t orig_l2_hdr_bytes;
 #endif
-#if defined(CONFIG_HL_SUPPORT)
+
 	struct ol_txrx_vdev_t* vdev;
-#endif
+
 	void *txq;
 	void *p_link;
 	uint16_t id;
@@ -605,6 +605,8 @@ struct ol_txrx_pdev_t {
 		int len;
 	} rx_pn[htt_num_sec_types];
 
+	uint32_t pn_replays[OL_RX_NUM_PN_REPLAY_TYPES];
+
 	/* tx mutex */
 	OL_TX_MUTEX_TYPE tx_mutex;
 
@@ -835,6 +837,7 @@ struct ol_txrx_pdev_t {
 	unsigned int num_descs_per_page;
 	void **desc_pages;
 	struct ol_txrx_peer_t *self_peer;
+	uint32_t total_bundle_queue_length;
 };
 
 struct ol_txrx_ocb_chan_info {
@@ -928,6 +931,17 @@ struct ol_txrx_vdev_t {
 	u_int16_t tx_fl_hwm;
 	ol_txrx_tx_flow_control_fp osif_flow_control_cb;
 
+	bool bundling_reqired;
+	struct {
+		struct {
+			adf_nbuf_t head;
+			adf_nbuf_t tail;
+			int depth;
+		} txq;
+		adf_os_spinlock_t mutex;
+		adf_os_timer_t timer;
+	} bundle_queue;
+
 #if defined(CONFIG_HL_SUPPORT) && defined(FEATURE_WLAN_TDLS)
         union ol_txrx_align_mac_addr_t hl_tdls_ap_mac_addr;
         bool hlTdlsFlag;
@@ -950,6 +964,9 @@ struct ol_txrx_vdev_t {
 	/* Information about the schedules in the schedule */
 	struct ol_txrx_ocb_chan_info *ocb_channel_info;
 	uint32_t ocb_channel_count;
+
+	/* Default OCB TX parameter */
+	struct ocb_tx_ctrl_hdr_t *ocb_def_tx_param;
 };
 
 struct ol_rx_reorder_array_elem_t {
diff --git a/CORE/HDD/inc/wlan_hdd_assoc.h b/CORE/HDD/inc/wlan_hdd_assoc.h
index 7a9b8081b856..8a500506fe30 100644
--- a/CORE/HDD/inc/wlan_hdd_assoc.h
+++ b/CORE/HDD/inc/wlan_hdd_assoc.h
@@ -153,9 +153,11 @@ int hdd_SetGENIEToCsr( hdd_adapter_t *pAdapter, eCsrAuthType *RSNAuthType );
 int hdd_set_csr_auth_type( hdd_adapter_t *pAdapter, eCsrAuthType RSNAuthType );
 VOS_STATUS hdd_roamRegisterTDLSSTA(hdd_adapter_t *pAdapter,
                                    const tANI_U8 *peerMac, tANI_U16 staId,
-                                   tANI_U8 ucastSig);
+                                   tANI_U8 ucastSig, uint8_t qos);
 void hdd_PerformRoamSetKeyComplete(hdd_adapter_t *pAdapter);
 
+VOS_STATUS hdd_roamDeregisterTDLSSTA(hdd_adapter_t *adapter, uint8_t staId);
+
 void hdd_SendPeerStatusIndToOemApp(v_MACADDR_t *peerMac,
                                    tANI_U8 peerStatus,
                                    tANI_U8 peerTimingMeasCap,
diff --git a/CORE/HDD/inc/wlan_hdd_cfg.h b/CORE/HDD/inc/wlan_hdd_cfg.h
index 75626200a025..db5f75c00179 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -2846,6 +2846,7 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
 #define CFG_TCP_DELACK_THRESHOLD_LOW_MIN           ( 0 )
 #define CFG_TCP_DELACK_THRESHOLD_LOW_MAX           ( 10000 )
 
+
 /* TCP_TX_HIGH_TPUT_THRESHOLD specifies the threshold of packets transmitted
  * over a period of 100 ms beyond which TCP can be considered to have a high
  * TX throughput requirement. The driver uses this condition to tweak TCP TX
@@ -2859,6 +2860,38 @@ This feature requires the dependent cfg.ini "gRoamPrefer5GHz" set to 1 */
 
 #endif /* FEATURE_BUS_BANDWIDTH */
 
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+
+/*
+ * PKT_BUNDLE_THRESHOLD_HIGH specifies threshold of packets transmitted
+ * over a period of 100ms beyond which bundling will be enabled and
+ * TXRX layer bundle packets before giving to scheduler. If numbers
+ * of packets falls below PKT_BUNDLE_THRESHOLD_LOW than bundling will
+ * stop.
+ */
+
+#define CFG_PKT_BUNDLE_THRESHOLD_HIGH              "gPacketBundleHighThreshold"
+#define CFG_PKT_BUNDLE_THRESHOLD_HIGH_DEFAULT      ( 4330 )
+#define CFG_PKT_BUNDLE_THRESHOLD_HIGH_MIN          ( 0 )
+#define CFG_PKT_BUNDLE_THRESHOLD_HIGH_MAX          ( 70000 )
+
+#define CFG_PKT_BUNDLE_THRESHOLD_LOW               "gPacketBundleLowThreshold"
+#define CFG_PKT_BUNDLE_THRESHOLD_LOW_DEFAULT       ( 4000 )
+#define CFG_PKT_BUNDLE_THRESHOLD_LOW_MIN           ( 0 )
+#define CFG_PKT_BUNDLE_THRESHOLD_LOW_MAX           ( 70000 )
+
+#define CFG_PKT_BUNDLE_TIMER_IN_MS                 "gPacketBundleTimerValue"
+#define CFG_PKT_BUNDLE_TIMER_IN_MS_DEFAULT         ( 100 )
+#define CFG_PKT_BUNDLE_TIMER_IN_MS_MIN             ( 10 )
+#define CFG_PKT_BUNDLE_TIMER_IN_MS_MAX             ( 10000 )
+
+#define CFG_PKT_BUNDLE_SIZE                       "gPacketBundleSize"
+#define CFG_PKT_BUNDLE_SIZE_DEFAULT                ( 10 )
+#define CFG_PKT_BUNDLE_SIZE_MIN                    ( 0 )
+#define CFG_PKT_BUNDLE_SIZE_MAX                    ( 32 )
+
+#endif /* QCA_SUPPORT_TXRX_HL_BUNDLE */
+
 #ifdef WLAN_FEATURE_11W
 #define CFG_PMF_SA_QUERY_MAX_RETRIES_NAME          "pmfSaQueryMaxRetries"
 #define CFG_PMF_SA_QUERY_MAX_RETRIES_DEFAULT       ( 5 )
@@ -4064,7 +4097,12 @@ typedef struct
    v_U32_t                     tcpDelackThresholdLow;
    uint32_t                    tcp_tx_high_tput_thres;
 #endif /* FEATURE_BUS_BANDWIDTH */
-
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+   uint32_t                    pkt_bundle_threshold_high;
+   uint32_t                    pkt_bundle_threshold_low;
+   uint16_t                    pkt_bundle_timer_value;
+   uint16_t                    pkt_bundle_size;
+#endif
    /* FW debug log parameters */
    v_U32_t     enableFwLogType;
    v_U32_t     enableFwLogLevel;
diff --git a/CORE/HDD/inc/wlan_hdd_cfg80211.h b/CORE/HDD/inc/wlan_hdd_cfg80211.h
index 1147430c19aa..bf26c998be53 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg80211.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg80211.h
@@ -1531,6 +1531,7 @@ enum qca_wlan_vendor_acs_hw_mode {
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_MODULATED_DTIM: dynamic dtim
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR: stats avg. factor
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME: guard time
+ * @QCA_WLAN_VENDOR_ATTR_CONFIG_TX_RATE: configure max tx rate
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_LAST: last config
  * @QCA_WLAN_VENDOR_ATTR_CONFIG_MAX: max config
  */
@@ -1540,6 +1541,7 @@ enum qca_wlan_vendor_config {
 	QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR,
 	QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME,
 	QCA_WLAN_VENDOR_ATTR_CONFIG_FINE_TIME_MEASUREMENT,
+	QCA_WLAN_VENDOR_ATTR_CONFIG_TX_RATE,
 	/* keep last */
 	QCA_WLAN_VENDOR_ATTR_CONFIG_LAST,
 	QCA_WLAN_VENDOR_ATTR_CONFIG_MAX =
diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index 451aa803befc..f412a6de6e87 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -212,7 +212,11 @@
 #define WLAN_HDD_QOS_MAP_CONFIGURE 4
 #define HDD_SAP_WAKE_LOCK_DURATION 10000 //in msecs
 
+#if defined(CONFIG_HL_SUPPORT)
+#define HDD_MOD_EXIT_SSR_MAX_RETRIES 200
+#else
 #define HDD_MOD_EXIT_SSR_MAX_RETRIES 75
+#endif
 
 /* Maximum number of interfaces allowed(STA, P2P Device, P2P Interfaces) */
 #ifndef WLAN_OPEN_P2P_INTERFACE
@@ -1124,6 +1128,7 @@ struct hdd_adapter_s
 #ifdef FEATURE_BUS_BANDWIDTH
     unsigned long prev_rx_packets;
     unsigned long prev_tx_packets;
+    unsigned long prev_tx_bytes;
     int connection;
 #endif
     v_BOOL_t is_roc_inprogress;
diff --git a/CORE/HDD/inc/wlan_hdd_tdls.h b/CORE/HDD/inc/wlan_hdd_tdls.h
index 4a65d3add442..eebec6bfd181 100644
--- a/CORE/HDD/inc/wlan_hdd_tdls.h
+++ b/CORE/HDD/inc/wlan_hdd_tdls.h
@@ -259,6 +259,7 @@ typedef struct _hddTdlsPeer_t {
     tANI_U16    rx_pkt;
     tANI_U8     uapsdQueues;
     tANI_U8     maxSp;
+    uint8_t     qos;
     tANI_U8     isBufSta;
     tANI_U8     isOffChannelSupported;
     tANI_U8     supported_channels_len;
@@ -343,7 +344,8 @@ int wlan_hdd_tdls_set_peer_caps(hdd_adapter_t *pAdapter,
                                 const u8 *mac,
                                 tCsrStaParams *StaParams,
                                 tANI_BOOLEAN isBufSta,
-                                tANI_BOOLEAN isOffChannelSupported);
+                                tANI_BOOLEAN isOffChannelSupported,
+                                bool is_qos_wmm_sta);
 
 int wlan_hdd_tdls_set_rssi(hdd_adapter_t *pAdapter, const u8 *mac,
                            tANI_S8 rxRssi);
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index b12257403abd..56efd4da4c89 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -69,6 +69,7 @@
 #include <wlan_hdd_ipa.h>
 #endif
 #include <vos_sched.h>
+#include <wlan_logging_sock_svc.h>
 
 struct ether_addr
 {
@@ -109,6 +110,23 @@ v_U8_t ccpRSNOui08[ HDD_RSN_OUI_SIZE ] = { 0x00, 0x0F, 0xAC, 0x05 };
 
 #define BEACON_FRAME_IES_OFFSET 12
 
+#define NUM_BITS_IN_INT 32
+static const int beacon_filter_table[] = {
+	SIR_MAC_DS_PARAM_SET_EID,
+	SIR_MAC_ERP_INFO_EID,
+	SIR_MAC_EDCA_PARAM_SET_EID,
+	SIR_MAC_QOS_CAPABILITY_EID,
+	SIR_MAC_CHNL_SWITCH_ANN_EID,
+	SIR_MAC_HT_INFO_EID,
+#if defined WLAN_FEATURE_VOWIFI
+	SIR_MAC_PWR_CONSTRAINT_EID,
+#endif
+#ifdef WLAN_FEATURE_11AC
+	SIR_MAC_VHT_OPMODE_EID,
+	SIR_MAC_VHT_OPERATION_EID,
+#endif
+};
+
 static eHalStatus hdd_RoamSetKeyCompleteHandler( hdd_adapter_t *pAdapter,
                                                 tCsrRoamInfo *pRoamInfo,
                                                 tANI_U32 roamId,
@@ -256,6 +274,48 @@ static inline void hdd_connSaveConnectedBssType( hdd_station_ctx_t *pHddStaCtx,
 
 }
 
+/**
+ * hdd_unset_beacon_filter() - remove beacon filter
+ * @adapter: Pointer to the hdd adapter
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int hdd_unset_beacon_filter(hdd_adapter_t *adapter)
+{
+	VOS_STATUS vos_status = VOS_STATUS_E_FAILURE;
+
+	vos_status = sme_unset_beacon_filter(adapter->sessionId);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status))
+		return -EFAULT;
+
+	return 0;
+}
+
+/**
+ * hdd_set_beacon_filter() - set beacon filter
+ * @adapter: Pointer to the hdd adapter
+ *
+ * Return: 0 on success and errno on failure
+ */
+static int hdd_set_beacon_filter(hdd_adapter_t *adapter)
+{
+	int i;
+	uint32_t ie_map[8] = {0};
+	VOS_STATUS vos_status = VOS_STATUS_E_FAILURE;
+
+	for (i = 0; i < ARRAY_SIZE(beacon_filter_table); i++) {
+		__set_bit((beacon_filter_table[i] - 1),
+			  (unsigned long int *)ie_map);
+	}
+	vos_status = sme_set_beacon_filter(adapter->sessionId, ie_map);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+		hddLog(LOGE, "%s: failed to set beacon filter",
+			 __func__);
+		return -EFAULT;
+	}
+	return 0;
+}
+
 static void
 hdd_connSaveConnectInfo(hdd_adapter_t *pAdapter, tCsrRoamInfo *pRoamInfo,
                         eCsrRoamBssType eBssType)
@@ -734,6 +794,7 @@ static void hdd_SendAssociationEvent(struct net_device *dev,tCsrRoamInfo *pCsrRo
         spin_lock_bh(&pHddCtx->bus_bw_lock);
         pAdapter->prev_tx_packets = pAdapter->stats.tx_packets;
         pAdapter->prev_rx_packets = pAdapter->stats.rx_packets;
+        pAdapter->prev_tx_bytes = pAdapter->stats.tx_bytes;
         spin_unlock_bh(&pHddCtx->bus_bw_lock);
         hdd_start_bus_bw_compute_timer(pAdapter);
 #endif
@@ -782,6 +843,7 @@ static void hdd_SendAssociationEvent(struct net_device *dev,tCsrRoamInfo *pCsrRo
         spin_lock_bh(&pHddCtx->bus_bw_lock);
         pAdapter->prev_tx_packets = 0;
         pAdapter->prev_rx_packets = 0;
+        pAdapter->prev_tx_bytes = 0;
         spin_unlock_bh(&pHddCtx->bus_bw_lock);
         hdd_stop_bus_bw_compute_timer(pAdapter);
 #endif
@@ -912,12 +974,9 @@ static eHalStatus hdd_DisConnectHandler( hdd_adapter_t *pAdapter, tCsrRoamInfo *
 #endif /* QCA_PKT_PROTO_TRACE */
 
     /* HDD has initiated disconnect, do not send disconnect indication
-     * to kernel. Sending disconnected event to kernel for userspace
-     * initiated disconnect will be handled by hdd_DisConnectHandler call
-     * to cfg80211_disconnected
+     * to kernel.
      */
-    if ((eConnectionState_Disconnecting == pHddStaCtx->conn_info.connState) ||
-        (eConnectionState_NotConnected == pHddStaCtx->conn_info.connState))
+    if (eConnectionState_Disconnecting == pHddStaCtx->conn_info.connState)
     {
         VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                    FL(" HDD has initiated a disconnect, no need to send"
@@ -943,7 +1002,9 @@ static eHalStatus hdd_DisConnectHandler( hdd_adapter_t *pAdapter, tCsrRoamInfo *
     }
     hdd_clearRoamProfileIe( pAdapter );
     hdd_wmm_init( pAdapter );
-
+    hddLog(VOS_TRACE_LEVEL_INFO,
+           FL("Invoking packetdump deregistration API"));
+    wlan_deregister_txrx_packetdump();
     // indicate 'disconnect' status to wpa_supplicant...
     hdd_SendAssociationEvent(dev,pRoamInfo);
     /* indicate disconnected event to nl80211 */
@@ -1036,6 +1097,10 @@ static eHalStatus hdd_DisConnectHandler( hdd_adapter_t *pAdapter, tCsrRoamInfo *
 #if defined(WLAN_FEATURE_VOWIFI_11R)
     sme_FTReset(WLAN_HDD_GET_HAL_CTX(pAdapter), pAdapter->sessionId);
 #endif
+    if (hdd_unset_beacon_filter(pAdapter) != 0)
+        hddLog(LOGE,
+               FL("hdd_unset_beacon_filter() failed"));
+
     if (eCSR_ROAM_IBSS_LEAVE == roamStatus) {
         v_U8_t i;
 
@@ -1604,6 +1669,11 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
 
         // Save the connection info from CSR...
         hdd_connSaveConnectInfo( pAdapter, pRoamInfo, eCSR_BSS_TYPE_INFRASTRUCTURE );
+
+        if (hdd_set_beacon_filter(pAdapter) != 0)
+            hddLog(LOGE,
+                   FL("hdd_set_beacon_filter() failed"));
+
 #ifdef FEATURE_WLAN_WAPI
         if ( pRoamInfo->u.pConnectedProfile->AuthType == eCSR_AUTH_TYPE_WAPI_WAI_CERTIFICATE ||
                 pRoamInfo->u.pConnectedProfile->AuthType == eCSR_AUTH_TYPE_WAPI_WAI_PSK )
@@ -2050,6 +2120,10 @@ static eHalStatus hdd_AssociationCompletionHandler( hdd_adapter_t *pAdapter, tCs
                        __func__, MAC_ADDR_ARRAY(pWextState->req_bssId),
                        roamResult, roamStatus);
 
+                hddLog(VOS_TRACE_LEVEL_ERROR,
+                       FL("Invoking packetdump deregistration API"));
+                wlan_deregister_txrx_packetdump();
+
             /* inform association failure event to nl80211 */
             if ( eCSR_ROAM_RESULT_ASSOC_FAIL_CON_CHANNEL == roamResult )
             {
@@ -2790,7 +2864,7 @@ static eHalStatus roamRoamConnectStatusUpdateHandler( hdd_adapter_t *pAdapter, t
   ===========================================================================*/
 VOS_STATUS hdd_roamRegisterTDLSSTA(hdd_adapter_t *pAdapter,
                                    const tANI_U8 *peerMac, tANI_U16 staId,
-                                   tANI_U8 ucastSig)
+                                   tANI_U8 ucastSig, uint8_t qos)
 {
     hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
     v_CONTEXT_t pVosContext = (WLAN_HDD_GET_CTX(pAdapter))->pvosContext;
@@ -2821,8 +2895,7 @@ VOS_STATUS hdd_roamRegisterTDLSSTA(hdd_adapter_t *pAdapter,
     vos_copy_macaddr( &staDesc.vSelfMACAddress, &pAdapter->macAddressCurrent );
 
     /* set the QoS field appropriately ..*/
-    (hdd_wmm_is_active(pAdapter)) ? (staDesc.ucQosEnabled = 1)
-                                          : (staDesc.ucQosEnabled = 0) ;
+    staDesc.ucQosEnabled = qos;
 
     VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
                "HDD register TL QoS_enabled=%d", staDesc.ucQosEnabled );
@@ -2880,7 +2953,7 @@ VOS_STATUS hdd_roamRegisterTDLSSTA(hdd_adapter_t *pAdapter,
     return( vosStatus );
 }
 
-static VOS_STATUS hdd_roamDeregisterTDLSSTA( hdd_adapter_t *pAdapter, tANI_U8 staId )
+VOS_STATUS hdd_roamDeregisterTDLSSTA(hdd_adapter_t *pAdapter, tANI_U8 staId)
 {
     VOS_STATUS vosStatus;
     vosStatus = WLANTL_ClearSTAClient( (WLAN_HDD_GET_CTX(pAdapter))->pvosContext, staId );
@@ -4679,8 +4752,44 @@ static int __iw_set_essid(struct net_device *dev,
                         &ch_width);
         pRoamProfile->vht_channel_width = ch_width;
     }
+    /*
+     * Change conn_state to connecting before sme_RoamConnect(),
+     * because sme_RoamConnect() has a direct path to call
+     * hdd_smeRoamCallback(), which will change the conn_state
+     * If direct path, conn_state will be accordingly changed
+     * to NotConnected or Associated by either
+     * hdd_AssociationCompletionHandler() or hdd_DisConnectHandler()
+     * in sme_RoamCallback()
+     * if sme_RomConnect is to be queued,
+     * Connecting state will remain until it is completed.
+     *
+     * If connection state is not changed,
+     * connection state will remain in eConnectionState_NotConnected state.
+     * In hdd_AssociationCompletionHandler, "hddDisconInProgress" is set to true
+     * if conn state is eConnectionState_NotConnected.
+     * If "hddDisconInProgress" is set to true then cfg80211 layer is not
+     * informed of connect result indication which is an issue.
+     */
+    if (WLAN_HDD_INFRA_STATION == pAdapter->device_mode ||
+            WLAN_HDD_P2P_CLIENT == pAdapter->device_mode) {
+        hddLog(LOG1,
+                FL("Set HDD connState to eConnectionState_Connecting"));
+        hdd_connSetConnectionState(pAdapter,
+                eConnectionState_Connecting);
+    }
     status = sme_RoamConnect( hHal,pAdapter->sessionId,
-                         &(pWextState->roamProfile), &roamId);
+            &(pWextState->roamProfile), &roamId);
+
+    if ((eHAL_STATUS_SUCCESS != status) &&
+            (WLAN_HDD_INFRA_STATION == pAdapter->device_mode ||
+             WLAN_HDD_P2P_CLIENT == pAdapter->device_mode)) {
+        hddLog(LOGE,
+                FL("sme_RoamConnect (session %d) failed with status %d. -> NotConnected"),
+                pAdapter->sessionId, status);
+        /* change back to NotAssociated */
+        hdd_connSetConnectionState(pAdapter,
+                eConnectionState_NotConnected);
+    }
     pRoamProfile->ChannelInfo.ChannelList = NULL;
     pRoamProfile->ChannelInfo.numOfChannels = 0;
 
diff --git a/CORE/HDD/src/wlan_hdd_cfg.c b/CORE/HDD/src/wlan_hdd_cfg.c
index eaab10bcb21a..c14d83d6d86b 100644
--- a/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/CORE/HDD/src/wlan_hdd_cfg.c
@@ -3512,6 +3512,36 @@ REG_TABLE_ENTRY g_registry_table[] =
                  CFG_TCP_TX_HIGH_TPUT_THRESHOLD_DEFAULT,
                  CFG_TCP_TX_HIGH_TPUT_THRESHOLD_MIN,
                  CFG_TCP_TX_HIGH_TPUT_THRESHOLD_MAX ),
+#endif
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+
+    REG_VARIABLE( CFG_PKT_BUNDLE_THRESHOLD_HIGH, WLAN_PARAM_Integer,
+                 hdd_config_t, pkt_bundle_threshold_high,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PKT_BUNDLE_THRESHOLD_HIGH_DEFAULT,
+                 CFG_PKT_BUNDLE_THRESHOLD_HIGH_MIN,
+                 CFG_PKT_BUNDLE_THRESHOLD_HIGH_MAX ),
+
+    REG_VARIABLE( CFG_PKT_BUNDLE_THRESHOLD_LOW, WLAN_PARAM_Integer,
+                 hdd_config_t, pkt_bundle_threshold_low,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PKT_BUNDLE_THRESHOLD_LOW_DEFAULT,
+                 CFG_PKT_BUNDLE_THRESHOLD_LOW_MIN,
+                 CFG_PKT_BUNDLE_THRESHOLD_LOW_MAX ),
+
+    REG_VARIABLE( CFG_PKT_BUNDLE_TIMER_IN_MS, WLAN_PARAM_Integer,
+                 hdd_config_t, pkt_bundle_timer_value,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PKT_BUNDLE_TIMER_IN_MS_DEFAULT,
+                 CFG_PKT_BUNDLE_TIMER_IN_MS_MIN,
+                 CFG_PKT_BUNDLE_TIMER_IN_MS_MAX ),
+
+    REG_VARIABLE( CFG_PKT_BUNDLE_SIZE, WLAN_PARAM_Integer,
+                 hdd_config_t, pkt_bundle_size,
+                 VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+                 CFG_PKT_BUNDLE_SIZE_DEFAULT,
+                 CFG_PKT_BUNDLE_SIZE_MIN,
+                 CFG_PKT_BUNDLE_SIZE_MAX ),
 
 #endif
 
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index ba8262290279..605a02b4ec6f 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -8306,8 +8306,64 @@ wlan_hdd_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_MODULATED_DTIM] = {.type = NLA_U32 },
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_STATS_AVG_FACTOR] = {.type = NLA_U16 },
 	[QCA_WLAN_VENDOR_ATTR_CONFIG_GUARD_TIME] = {.type = NLA_U32 },
+	[QCA_WLAN_VENDOR_ATTR_CONFIG_TX_RATE] = {.type = NLA_U16 },
 };
 
+/**
+ * wlan_hdd_update_tx_rate() - update tx rate to firmware
+ * @hdd_ctx: HDD context
+ * @tx_rate: User-specified tx-rate to be operated for the specific
+ * HW mode.
+ * Return: 0 on success; Errno on failure
+ */
+int wlan_hdd_update_tx_rate(hdd_context_t *hddctx, uint16_t tx_rate)
+{
+
+	hdd_adapter_t *adapter = NULL;
+	hdd_station_ctx_t *hddstactx = NULL;
+	eHalStatus hstatus;
+	struct sir_txrate_update *buf_txrate_update;
+
+	ENTER();
+	adapter = hdd_get_adapter(hddctx, WLAN_HDD_INFRA_STATION);
+	hddstactx = WLAN_HDD_GET_STATION_CTX_PTR(adapter);
+
+	if (WLAN_HDD_INFRA_STATION != adapter->device_mode) {
+		hddLog(LOGE, FL("Only Sta Mode supported!"));
+		return -ENOTSUPP;
+	}
+
+	if (!hdd_connIsConnected(
+			WLAN_HDD_GET_STATION_CTX_PTR(adapter))) {
+		hddLog(LOGE, FL("Not in Connected state!"));
+		return -ENOTSUPP;
+	}
+
+	buf_txrate_update = vos_mem_malloc(sizeof(*buf_txrate_update));
+	if (!buf_txrate_update) {
+		hddLog(LOGE, FL("Failed to allocate memory for buf_txrate_update"));
+		return -ENOMEM;
+	}
+
+
+	buf_txrate_update->session_id = adapter->sessionId;
+
+	buf_txrate_update->txrate = tx_rate;
+	vos_mem_copy(buf_txrate_update->bssid, hddstactx->conn_info.bssId,
+				VOS_MAC_ADDR_SIZE);
+
+	hstatus = sme_update_txrate(hddctx->hHal, buf_txrate_update);
+	if (!HAL_STATUS_SUCCESS(hstatus)) {
+		hddLog(LOGE,
+			FL("sme_update_txrate failed(err=%d)"), hstatus);
+		vos_mem_free(buf_txrate_update);
+		return -EINVAL;
+	}
+	EXIT();
+	vos_mem_free(buf_txrate_update);
+	return 0;
+}
+
 
 /**
  * __wlan_hdd_cfg80211_wifi_configuration_set() - Wifi configuration
@@ -8333,7 +8389,7 @@ static int __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1];
 	int ret_val = 0;
 	u32 modulated_dtim;
-	u16 stats_avg_factor;
+	uint16_t stats_avg_factor, tx_rate;
 	u32 guard_time;
 	u32 ftm_capab;
 	eHalStatus status;
@@ -8404,6 +8460,15 @@ static int __wlan_hdd_cfg80211_wifi_configuration_set(struct wiphy *wiphy,
 			ret_val = -EPERM;
 	}
 
+	if (tb[QCA_WLAN_VENDOR_ATTR_CONFIG_TX_RATE]) {
+		tx_rate = nla_get_u16(
+			tb[QCA_WLAN_VENDOR_ATTR_CONFIG_TX_RATE]);
+		hddLog(LOG1, "Config Txrate: tx_rate received :%d", tx_rate);
+		status = wlan_hdd_update_tx_rate(pHddCtx, tx_rate);
+
+		if (eHAL_STATUS_SUCCESS != status)
+			ret_val = -EPERM;
+	}
 	return ret_val;
 }
 
@@ -10872,68 +10937,6 @@ struct wiphy *wlan_hdd_cfg80211_wiphy_alloc(int priv_size)
 }
 
 /*
- * FUNCTION: wlan_hdd_cfg80211_update_band
- * This function is called from the supplicant through a
- * private ioctl to change the band value
- */
-int wlan_hdd_cfg80211_update_band(struct wiphy *wiphy, eCsrBand eBand)
-{
-    int i, j;
-    eNVChannelEnabledType channelEnabledState;
-
-    ENTER();
-
-    for (i = 0; i < IEEE80211_NUM_BANDS; i++)
-    {
-
-        if (NULL == wiphy->bands[i])
-           continue;
-
-        for (j = 0; j < wiphy->bands[i]->n_channels; j++)
-        {
-            struct ieee80211_supported_band *band = wiphy->bands[i];
-
-            channelEnabledState = vos_nv_getChannelEnabledState(
-                                  band->channels[j].hw_value);
-
-            if (IEEE80211_BAND_2GHZ == i && eCSR_BAND_5G == eBand) // 5G only
-            {
-#ifdef WLAN_ENABLE_SOCIAL_CHANNELS_5G_ONLY
-                // Enable Social channels for P2P
-                if (WLAN_HDD_IS_SOCIAL_CHANNEL(band->channels[j].center_freq) &&
-                    NV_CHANNEL_ENABLE == channelEnabledState)
-                    band->channels[j].flags &= ~IEEE80211_CHAN_DISABLED;
-                else
-#endif
-                    band->channels[j].flags |= IEEE80211_CHAN_DISABLED;
-                continue;
-            }
-            else if (IEEE80211_BAND_5GHZ == i && eCSR_BAND_24 == eBand) // 2G only
-            {
-                band->channels[j].flags |= IEEE80211_CHAN_DISABLED;
-                continue;
-            }
-
-            if (NV_CHANNEL_DISABLE == channelEnabledState ||
-                NV_CHANNEL_INVALID == channelEnabledState)
-            {
-                band->channels[j].flags |= IEEE80211_CHAN_DISABLED;
-            }
-            else if (NV_CHANNEL_DFS == channelEnabledState)
-            {
-                band->channels[j].flags &= ~IEEE80211_CHAN_DISABLED;
-                band->channels[j].flags |= IEEE80211_CHAN_RADAR;
-            }
-            else
-            {
-                band->channels[j].flags &= ~(IEEE80211_CHAN_DISABLED
-                                             |IEEE80211_CHAN_RADAR);
-            }
-        }
-    }
-    return 0;
-}
-/*
  * FUNCTION: wlan_hdd_cfg80211_init
  * This function is called by hdd_wlan_startup()
  * during initialization.
@@ -11812,6 +11815,8 @@ int wlan_hdd_cfg80211_update_apies(hdd_adapter_t* pHostapdAdapter)
     wlan_hdd_add_extra_ie(pHostapdAdapter, genie, &total_ielen,
                           WLAN_EID_INTERWORKING);
 
+    wlan_hdd_add_extra_ie(pHostapdAdapter, genie, &total_ielen,
+                          WLAN_EID_VHT_TX_POWER_ENVELOPE);
     if (0 != wlan_hdd_add_ie(pHostapdAdapter, genie,
                               &total_ielen, WPS_OUI_TYPE, WPS_OUI_TYPE_SIZE))
     {
@@ -12626,23 +12631,28 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
             }
         }
 
-        if(VOS_STATUS_SUCCESS != wlan_hdd_validate_operation_channel(pHostapdAdapter,pConfig->channel))
-        {
-             hddLog(VOS_TRACE_LEVEL_ERROR,
-                     "%s: Invalid Channel [%d]", __func__, pConfig->channel);
-             ret = -EINVAL;
-             goto error;
-        }
-
-        /* reject SAP if DFS channel scan is not allowed */
-        if ((pHddCtx->cfg_ini->enableDFSChnlScan == false) &&
-            (NV_CHANNEL_DFS ==
-             vos_nv_getChannelEnabledState(pConfig->channel))) {
-            hddLog(LOGE, FL("not allowed to start SAP on DFS channel"));
-            ret = -EOPNOTSUPP;
-            goto error;
-        }
+        /*
+         * If auto channel is configured i.e. channel is 0,
+         * so skip channel validation.
+         */
+        if (AUTO_CHANNEL_SELECT != pConfig->channel) {
+           if (VOS_STATUS_SUCCESS != wlan_hdd_validate_operation_channel
+                          (pHostapdAdapter,pConfig->channel)) {
+              hddLog(VOS_TRACE_LEVEL_ERROR,
+                      "%s: Invalid Channel [%d]", __func__, pConfig->channel);
+              ret = -EINVAL;
+              goto error;
+           }
 
+           /* reject SAP if DFS channel scan is not allowed */
+           if ((pHddCtx->cfg_ini->enableDFSChnlScan == false) &&
+             (NV_CHANNEL_DFS ==
+              vos_nv_getChannelEnabledState(pConfig->channel))) {
+             hddLog(LOGE, FL("not allowed to start SAP on DFS channel"));
+             ret = -EOPNOTSUPP;
+             goto error;
+          }
+       }
         /*
          * Set the JAPAN W53 disabled INI param
          * in to SAP DFS for restricting these
@@ -13338,10 +13348,6 @@ static int __wlan_hdd_cfg80211_stop_ap (struct wiphy *wiphy,
                      TRACE_CODE_HDD_CFG80211_STOP_AP,
                      pAdapter->sessionId, pAdapter->device_mode));
 
-    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
-    ret = wlan_hdd_validate_context(pHddCtx);
-    if (0 != ret)
-        return ret;
 
     if (VOS_FTM_MODE == hdd_get_conparam()) {
         hddLog(LOGE, FL("Command not allowed in FTM mode"));
@@ -13357,6 +13363,20 @@ static int __wlan_hdd_cfg80211_stop_ap (struct wiphy *wiphy,
            hdd_device_mode_to_string(pAdapter->device_mode),
            pAdapter->device_mode);
 
+    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+    ret = wlan_hdd_validate_context(pHddCtx);
+    if (0 != ret) {
+        if (pHddCtx->isUnloadInProgress) {
+            /*
+             * Unloading the driver so free the memory for ch_list,
+             * otherwise it will result in memory leak
+             */
+            if (pAdapter->sessionCtx.ap.sapConfig.acs_cfg.ch_list)
+                vos_mem_free(pAdapter->sessionCtx.ap.sapConfig.acs_cfg.ch_list);
+        }
+        return ret;
+    }
+
     status = hdd_get_front_adapter (pHddCtx, &pAdapterNode);
     while (NULL != pAdapterNode && VOS_STATUS_SUCCESS == status) {
         staAdapter = pAdapterNode->pAdapter;
@@ -14477,6 +14497,7 @@ static int __wlan_hdd_change_station(struct wiphy *wiphy,
     tCsrStaParams StaParams = {0};
     tANI_U8 isBufSta = 0;
     tANI_U8 isOffChannelSupported = 0;
+    bool is_qos_wmm_sta = false;
 #endif
     int ret;
 
@@ -14650,9 +14671,18 @@ static int __wlan_hdd_change_station(struct wiphy *wiphy,
                 }
             }
 
+            if (pHddCtx->cfg_ini->fEnableTDLSWmmMode &&
+                (params->sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
+                is_qos_wmm_sta = true;
+
+            hddLog(VOS_TRACE_LEVEL_INFO,
+                   FL("%s: TDLS Peer is QOS capable is_qos_wmm_sta= %d HTcapPresent = %d"),
+                   __func__, is_qos_wmm_sta, StaParams.htcap_present);
+
             status = wlan_hdd_tdls_set_peer_caps(pAdapter, mac,
                                                   &StaParams, isBufSta,
-                                                  isOffChannelSupported);
+                                                  isOffChannelSupported,
+                                                  is_qos_wmm_sta);
             if (VOS_STATUS_SUCCESS != status) {
                 hddLog(VOS_TRACE_LEVEL_ERROR,
                        FL("wlan_hdd_tdls_set_peer_caps failed!"));
@@ -17043,21 +17073,30 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
             hdd_select_cbmode(pAdapter,operatingChannel, &ch_width);
             pRoamProfile->vht_channel_width = ch_width;
         }
-
-        /* change conn_state to connecting before sme_RoamConnect(), because sme_RoamConnect()
-         * has a direct path to call hdd_smeRoamCallback(), which will change the conn_state
-         * If direct path, conn_state will be accordingly changed to NotConnected or Associated
-         * by either hdd_AssociationCompletionHandler() or hdd_DisConnectHandler() in sme_RoamCallback()
-         * if sme_RomConnect is to be queued, Connecting state will remain until it is completed.
+        /*
+         * Change conn_state to connecting before sme_RoamConnect(),
+         * because sme_RoamConnect() has a direct path to call
+         * hdd_smeRoamCallback(), which will change the conn_state
+         * If direct path, conn_state will be accordingly changed
+         * to NotConnected or Associated by either
+         * hdd_AssociationCompletionHandler() or hdd_DisConnectHandler()
+         * in sme_RoamCallback()
+         * if sme_RomConnect is to be queued,
+         * Connecting state will remain until it is completed.
+         * If connection state is not changed,
+         * connection state will remain in eConnectionState_NotConnected state.
+         * In hdd_AssociationCompletionHandler, "hddDisconInProgress" is set
+         * to true if conn state is eConnectionState_NotConnected.
+         * If "hddDisconInProgress" is set to true then cfg80211 layer is not
+         * informed of connect result indication which is an issue.
          */
+
         if (WLAN_HDD_INFRA_STATION == pAdapter->device_mode ||
-            WLAN_HDD_P2P_CLIENT == pAdapter->device_mode)
-        {
-            VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                   "%s: Set HDD connState to eConnectionState_Connecting",
-                   __func__);
+                WLAN_HDD_P2P_CLIENT == pAdapter->device_mode) {
+            hddLog(LOG1,
+                    FL("Set HDD connState to eConnectionState_Connecting"));
             hdd_connSetConnectionState(pAdapter,
-                                        eConnectionState_Connecting);
+                    eConnectionState_Connecting);
         }
 
         /* After 8-way handshake supplicant should give the scan command
@@ -17109,11 +17148,10 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
 
         if ((eHAL_STATUS_SUCCESS != status) &&
             (WLAN_HDD_INFRA_STATION == pAdapter->device_mode ||
-             WLAN_HDD_P2P_CLIENT == pAdapter->device_mode))
-
-        {
-            hddLog(VOS_TRACE_LEVEL_ERROR, "%s: sme_RoamConnect (session %d) failed with "
-                                      "status %d. -> NotConnected", __func__, pAdapter->sessionId, status);
+             WLAN_HDD_P2P_CLIENT == pAdapter->device_mode)) {
+            hddLog(LOGE,
+                    FL("sme_RoamConnect (session %d) failed with status %d. -> NotConnected"),
+                    pAdapter->sessionId, status);
             /* change back to NotAssociated */
             hdd_connSetConnectionState(pAdapter,
                                        eConnectionState_NotConnected);
@@ -18065,15 +18103,6 @@ disconnected:
              FL("Set HDD connState to eConnectionState_NotConnected"));
     hdd_connSetConnectionState(pAdapter,
                                 eConnectionState_NotConnected);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,11,0)
-    /* Sending disconnect event to userspace for kernel version < 3.11
-     * is handled by __cfg80211_disconnect call to __cfg80211_disconnected
-     */
-    hddLog(LOG1, FL("Send disconnected event to userspace"));
-    cfg80211_disconnected(pAdapter->dev, WLAN_REASON_UNSPECIFIED,
-                NULL, 0, GFP_KERNEL);
-#endif
-
     EXIT();
     return result;
 }
@@ -19780,7 +19809,11 @@ static int __wlan_hdd_cfg80211_del_station(struct wiphy *wiphy,
 
             /* Send disassoc and deauth both to avoid some IOT issues */
             vos_event_reset(&pHostapdState->vosEvent);
-            hdd_softap_sta_disassoc(pAdapter, pDelStaParams);
+            sme_send_disassoc_req_frame(WLAN_HDD_GET_HAL_CTX(pAdapter),
+                             pAdapter->sessionId,
+                             (uint8_t *)pDelStaParams->peerMacAddr,
+                             pDelStaParams->reason_code, 0);
+
             vos_status = hdd_softap_sta_deauth(pAdapter, pDelStaParams);
             if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
                 pAdapter->aStaInfo[staId].isDeauthInProgress = FALSE;
@@ -20942,16 +20975,6 @@ static int __wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy,
         mutex_unlock(&pHddCtx->tdls_lock);
     }
 
-    if ((SIR_MAC_TDLS_DIS_REQ == action_code) ||
-        (SIR_MAC_TDLS_DIS_RSP == action_code)) {
-        /* for DIS_REQ/DIS_RSP, supplicant don't consider the return status.
-         * So we no need to wait for tdls_mgmt_comp for sending ack status.
-         */
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-                "%s: tx done for frm %u", __func__, action_code);
-        return 0;
-    }
-
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
             "%s: Wait for tdls_mgmt_comp. Timeout %u ms", __func__,
             WAIT_TIME_TDLS_MGMT);
@@ -21312,6 +21335,9 @@ static int __wlan_hdd_cfg80211_tdls_oper(struct wiphy *wiphy,
                     return -EINVAL;
                 }
 
+                vos_mem_set(&tdlsLinkEstablishParams,
+                            sizeof(tCsrTdlsLinkEstablishParams), 0);
+
                 if (eTDLS_LINK_CONNECTED != pTdlsPeer->link_status)
                 {
                     if (IS_ADVANCE_TDLS_ENABLE) {
@@ -21342,10 +21368,25 @@ static int __wlan_hdd_cfg80211_tdls_oper(struct wiphy *wiphy,
                     wlan_hdd_tdls_set_peer_link_status(pTdlsPeer,
                                                        eTDLS_LINK_CONNECTED,
                                                        eTDLS_LINK_SUCCESS);
+
+                    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                              "%s : tdlsLinkEstablishParams of peer " MAC_ADDRESS_STR "uapsdQueues: %d"
+                              " qos: %d maxSp: %d isBufSta: %d isOffChannelSupported: %d"
+                              " isResponder: %d peerstaId: %d",
+                              __func__, MAC_ADDR_ARRAY(tdlsLinkEstablishParams.peerMac),
+                              tdlsLinkEstablishParams.uapsdQueues,
+                              tdlsLinkEstablishParams.qos,
+                              tdlsLinkEstablishParams.maxSp,
+                              tdlsLinkEstablishParams.isBufSta,
+                              tdlsLinkEstablishParams.isOffChannelSupported,
+                              tdlsLinkEstablishParams.isResponder,
+                              pTdlsPeer->staId);
+
                     /* start TDLS client registration with TL */
                     status = hdd_roamRegisterTDLSSTA(pAdapter, peer,
                                                      pTdlsPeer->staId,
-                                                     pTdlsPeer->signature);
+                                                     pTdlsPeer->signature,
+                                                     tdlsLinkEstablishParams.qos);
                     if (VOS_STATUS_SUCCESS == status)
                     {
                         tANI_U8 i;
@@ -23912,68 +23953,72 @@ nla_put_failure:
  */
 static void
 wlan_hdd_cfg80211_extscan_scan_progress_event(void *ctx,
-                                         tpSirExtScanOnScanEventIndParams pData)
+					tpSirExtScanOnScanEventIndParams data)
 {
-    hdd_context_t *pHddCtx  = (hdd_context_t *)ctx;
-    struct sk_buff *skb     = NULL;
-    int flags = vos_get_gfp_flags();
-    struct hdd_ext_scan_context *context;
+	hdd_context_t *pHddCtx  = ctx;
+	struct sk_buff *skb;
+	int flags = vos_get_gfp_flags();
+	struct hdd_ext_scan_context *context;
 
-    ENTER();
+	ENTER();
 
-    if (wlan_hdd_validate_context(pHddCtx))
-        return;
-    if (!pData) {
-        hddLog(VOS_TRACE_LEVEL_ERROR, FL("pData is null"));
-        return;
-    }
+	if (wlan_hdd_validate_context(pHddCtx))
+		return;
 
-    hddLog(LOG1, "Request Id: %u ScanEventType: %u ScanEventStatus: %u buckets_scanned: %u",
-               pData->requestId, pData->scanEventType, pData->status,
-               pData->buckets_scanned);
+	if (!data) {
+		hddLog(LOGE, FL("data is null"));
+		EXIT();
+		return;
+	}
 
-    spin_lock(&hdd_context_lock);
-    context = &pHddCtx->ext_scan_context;
-    if (pData->scanEventType == WIFI_EXTSCAN_CYCLE_COMPLETED_EVENT) {
-            context->buckets_scanned = 0;
-            /* No need to report to user space */
-            spin_unlock(&hdd_context_lock);
-            return;
-    } else if (pData->scanEventType == WIFI_EXTSCAN_CYCLE_STARTED_EVENT) {
-            context->buckets_scanned = pData->buckets_scanned;
-            /* No need to report to user space */
-            spin_unlock(&hdd_context_lock);
-            return;
-    } else {
-            spin_unlock(&hdd_context_lock);
-    }
+	hddLog(LOG1, "Request Id: %u ScanEventType: %u ScanEventStatus: %u buckets_scanned: %u",
+		data->requestId, data->scanEventType, data->status,
+		data->buckets_scanned);
 
-    skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
-                            NULL,
-                            EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
-                            QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SCAN_EVENT_INDEX,
-                            flags);
+	spin_lock(&hdd_context_lock);
+	context = &pHddCtx->ext_scan_context;
+	if (data->scanEventType == WIFI_EXTSCAN_CYCLE_COMPLETED_EVENT) {
+		context->buckets_scanned = 0;
+		data->scanEventType = WIFI_EXTSCAN_RESULTS_AVAILABLE;
+		spin_unlock(&hdd_context_lock);
+	} else if (data->scanEventType == WIFI_EXTSCAN_CYCLE_STARTED_EVENT) {
+		context->buckets_scanned = data->buckets_scanned;
+		/* No need to report to user space */
+		spin_unlock(&hdd_context_lock);
+		EXIT();
+		return;
+	} else {
+		spin_unlock(&hdd_context_lock);
+	}
 
-    if (!skb) {
-        hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
-        return;
-    }
+	skb = cfg80211_vendor_event_alloc(pHddCtx->wiphy,
+			NULL,
+			EXTSCAN_EVENT_BUF_SIZE + NLMSG_HDRLEN,
+			QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_SCAN_EVENT_INDEX,
+			flags);
 
-    if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
-                    pData->requestId) ||
-        nla_put_u8(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_EVENT_TYPE,
-                    pData->scanEventType)) {
-        hddLog(LOGE, FL("nla put fail"));
-        goto nla_put_failure;
-    }
+	if (!skb) {
+		hddLog(LOGE, FL("cfg80211_vendor_event_alloc failed"));
+		EXIT();
+		return;
+	}
 
-    cfg80211_vendor_event(skb, flags);
-    EXIT();
-    return;
+	if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_REQUEST_ID,
+		data->requestId) ||
+	    nla_put_u8(skb, QCA_WLAN_VENDOR_ATTR_EXTSCAN_RESULTS_SCAN_EVENT_TYPE,
+		data->scanEventType)) {
+		hddLog(LOGE, FL("nla put fail"));
+		goto nla_put_failure;
+	}
+
+	cfg80211_vendor_event(skb, flags);
+	EXIT();
+	return;
 
 nla_put_failure:
-    kfree_skb(skb);
-    return;
+	kfree_skb(skb);
+	EXIT();
+	return;
 }
 
 /**
diff --git a/CORE/HDD/src/wlan_hdd_early_suspend.c b/CORE/HDD/src/wlan_hdd_early_suspend.c
index f161afd8af21..95f35d3416c8 100644
--- a/CORE/HDD/src/wlan_hdd_early_suspend.c
+++ b/CORE/HDD/src/wlan_hdd_early_suspend.c
@@ -73,6 +73,7 @@
 #ifdef IPA_OFFLOAD
 #include <wlan_hdd_ipa.h>
 #endif
+#include <wlan_logging_sock_svc.h>
 
 /**-----------------------------------------------------------------------------
 *   Preprocessor definitions and constants
@@ -664,7 +665,7 @@ static int hdd_fill_ipv6_uc_addr(struct inet6_dev *idev,
 				sizeof(ifa->addr.s6_addr));
 			ipv6addr_type[*count] = SIR_IPV6_ADDR_UC_TYPE;
 			hddLog (LOG1,
-				FL("Index %d scope = %s Address: %pI6"),
+				FL("Index %d scope = %s UC-Address: %pI6"),
 				*count, (scope == IPV6_ADDR_SCOPE_LINKLOCAL) ?
 				"LINK LOCAL": "GLOBAL", ipv6_uc_addr[*count]);
 			*count += 1;
@@ -706,7 +707,7 @@ static int hdd_fill_ipv6_ac_addr(struct inet6_dev *idev,
 				sizeof(ifaca->aca_addr));
 			ipv6addr_type[*count] = SIR_IPV6_ADDR_AC_TYPE;
 			hddLog (LOG1,
-				FL("Index %d scope = %s Address: %pI6"),
+				FL("Index %d scope = %s AC-Address: %pI6"),
 				*count, (scope == IPV6_ADDR_SCOPE_LINKLOCAL) ?
 				"LINK LOCAL": "GLOBAL", ipv6_ac_addr[*count]);
 			*count += 1;
@@ -1942,6 +1943,9 @@ VOS_STATUS hdd_wlan_shutdown(void)
 
    vos_clear_concurrent_session_count();
 
+   hddLog(VOS_TRACE_LEVEL_INFO,
+           FL("Invoking packetdump deregistration API"));
+   wlan_deregister_txrx_packetdump();
 #ifdef FEATURE_BUS_BANDWIDTH
    if (VOS_TIMER_STATE_RUNNING ==
            vos_timer_getCurrentState(&pHddCtx->bus_bw_timer))
diff --git a/CORE/HDD/src/wlan_hdd_ftm.c b/CORE/HDD/src/wlan_hdd_ftm.c
index 8b9705e6b5a9..87cdffd68cdf 100644
--- a/CORE/HDD/src/wlan_hdd_ftm.c
+++ b/CORE/HDD/src/wlan_hdd_ftm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -968,16 +968,17 @@ static int wlan_hdd_qcmbr_command(hdd_adapter_t *pAdapter, qcmbr_data_t *pqcmbr_
 
         case ATH_XIOCTL_UNIFIED_UTF_RSP: {
             pqcmbr_data->copy_to_user = 1;
+
+            spin_lock_bh(&qcmbr_queue_lock);
             if (!list_empty(&qcmbr_queue_head)) {
-                spin_lock_bh(&qcmbr_queue_lock);
                 qcmbr_buf = list_first_entry(&qcmbr_queue_head,
                                              qcmbr_queue_t, list);
                 list_del(&qcmbr_buf->list);
-                spin_unlock_bh(&qcmbr_queue_lock);
                 ret = 0;
             } else {
                 ret = -1;
             }
+            spin_unlock_bh(&qcmbr_queue_lock);
 
             if (!ret) {
                 memcpy(pqcmbr_data->buf, qcmbr_buf->utf_buf,
@@ -1010,7 +1011,7 @@ static int wlan_hdd_qcmbr_compat_ioctl(hdd_adapter_t *pAdapter,
     }
 
     ret = wlan_hdd_qcmbr_command(pAdapter, qcmbr_data);
-    if (qcmbr_data->copy_to_user) {
+    if ((ret == 0) && qcmbr_data->copy_to_user) {
         ret = copy_to_user(ifr->ifr_data, qcmbr_data->buf,
                            (MAX_UTF_LENGTH + 4));
     }
@@ -1042,7 +1043,7 @@ static int wlan_hdd_qcmbr_ioctl(hdd_adapter_t *pAdapter, struct ifreq *ifr)
     }
 
     ret = wlan_hdd_qcmbr_command(pAdapter, qcmbr_data);
-    if (qcmbr_data->copy_to_user) {
+    if ((ret == 0) && qcmbr_data->copy_to_user) {
         ret = copy_to_user(ifr->ifr_data, qcmbr_data->buf,
                            (MAX_UTF_LENGTH + 4));
     }
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index 6323a742a298..27f2bc8c7a47 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -1795,6 +1795,8 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                 spin_lock_bh(&pHddCtx->bus_bw_lock);
                 pHostapdAdapter->prev_tx_packets = pHostapdAdapter->stats.tx_packets;
                 pHostapdAdapter->prev_rx_packets = pHostapdAdapter->stats.rx_packets;
+                pHostapdAdapter->prev_tx_bytes =
+                        pHostapdAdapter->stats.tx_bytes;
                 spin_unlock_bh(&pHddCtx->bus_bw_lock);
                 hdd_start_bus_bw_compute_timer(pHostapdAdapter);
             }
@@ -1978,6 +1980,7 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
                 spin_lock_bh(&pHddCtx->bus_bw_lock);
                 pHostapdAdapter->prev_tx_packets = 0;
                 pHostapdAdapter->prev_rx_packets = 0;
+                pHostapdAdapter->prev_tx_bytes = 0;
                 spin_unlock_bh(&pHddCtx->bus_bw_lock);
                 hdd_stop_bus_bw_compute_timer(pHostapdAdapter);
             }
@@ -2079,12 +2082,14 @@ VOS_STATUS hdd_hostapd_SAPEventCB( tpSap_Event pSapEvent, v_PVOID_t usrDataForCa
 
         case eSAP_CHANNEL_CHANGE_EVENT:
             hddLog(LOG1, FL("Received eSAP_CHANNEL_CHANGE_EVENT event"));
-            /* Prevent suspend for new channel */
-            hdd_hostapd_channel_prevent_suspend(pHostapdAdapter,
-                    pSapEvent->sapevt.sapChSelected.pri_ch);
-            /* Allow suspend for old channel */
-            hdd_hostapd_channel_allow_suspend(pHostapdAdapter,
-                    pHddApCtx->operatingChannel);
+            if (pHostapdState->bssState != BSS_STOP) {
+                /* Prevent suspend for new channel */
+                hdd_hostapd_channel_prevent_suspend(pHostapdAdapter,
+                        pSapEvent->sapevt.sapChSelected.pri_ch);
+                /* Allow suspend for old channel */
+                hdd_hostapd_channel_allow_suspend(pHostapdAdapter,
+                        pHddApCtx->operatingChannel);
+            }
             /* SME/PE is already updated for new operation channel. So update
              * HDD layer also here. This resolves issue in AP-AP mode where
              * AP1 channel is changed due to RADAR then CAC is going on and
@@ -2787,6 +2792,12 @@ static __iw_softap_setparam(struct net_device *dev,
        return -EINVAL;
     }
 
+    if (VOS_STATUS_SUCCESS != sme_is_session_valid(hHal,
+                               pHostapdAdapter->sessionId)) {
+       hddLog(LOGE, FL("session id is not valid %d"),
+                   pHostapdAdapter->sessionId);
+       return -EINVAL;
+    }
     pVosContext = pHddCtx->pvosContext;
     if (!pVosContext) {
        hddLog(LOGE, FL("Vos ctx is null"));
@@ -3549,6 +3560,12 @@ static __iw_softap_getparam(struct net_device *dev,
     if (0 != ret)
         return ret;
 
+    if (VOS_STATUS_SUCCESS != sme_is_session_valid(hHal,
+                               pHostapdAdapter->sessionId)) {
+       hddLog(LOGE, FL("session id is not valid %d"),
+                   pHostapdAdapter->sessionId);
+       return -EINVAL;
+    }
     switch (sub_cmd)
     {
     case QCSAP_PARAM_MAX_ASSOC:
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index b6dacec5f518..f4dcedd3faee 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -92,6 +92,7 @@
 #include <linux/semaphore.h>
 #include <linux/ctype.h>
 #include <linux/compat.h>
+#include <linux/pm_qos.h>
 #ifdef MSM_PLATFORM
 #ifdef CONFIG_CNSS
 #include <soc/qcom/subsystem_restart.h>
@@ -132,6 +133,7 @@ void hdd_ch_avoid_cb(void *hdd_context,void *indi_param);
 #include "ol_fw.h"
 #include "wlan_hdd_ocb.h"
 #include "wlan_hdd_tsf.h"
+#include "tl_shim.h"
 
 #if defined(LINUX_QCMBR)
 #define SIOCIOCTLTX99 (SIOCDEVPRIVATE+13)
@@ -13180,21 +13182,25 @@ VOS_STATUS hdd_set_sme_chan_list(hdd_context_t *hdd_ctx)
                               hdd_ctx->reg.cc_src);
 }
 
-/**---------------------------------------------------------------------------
-
-  \brief hdd_is_5g_supported() - HDD function to know if hardware supports  5GHz
-
-  \param  - pHddCtx - Pointer to the hdd context
-
-  \return -  true if hardware supports 5GHz
-
-  --------------------------------------------------------------------------*/
+/**
+ * hdd_is_5g_supported() - to know if ini configuration supports 5GHz
+ * @pHddCtx: Pointer to the hdd context
+ *
+ * Return: true if ini configuration supports 5GHz
+ */
 boolean hdd_is_5g_supported(hdd_context_t * pHddCtx)
 {
-   /* If wcnss_wlan_iris_xo_mode() returns WCNSS_XO_48MHZ(1);
-    * then hardware support 5Ghz.
-   */
-   return true;
+	/**
+	 * If wcnss_wlan_iris_xo_mode() returns WCNSS_XO_48MHZ(1);
+	 * then hardware support 5Ghz.
+	 */
+	if(!pHddCtx || !pHddCtx->cfg_ini)
+		return true;
+
+	if (pHddCtx->cfg_ini->nBandCapability != eCSR_BAND_24)
+		return true;
+	else
+		return false;
 }
 
 static VOS_STATUS wlan_hdd_reg_init(hdd_context_t *hdd_ctx)
@@ -13246,8 +13252,25 @@ static VOS_STATUS wlan_hdd_reg_init(hdd_context_t *hdd_ctx)
    return status;
 }
 
-
 #ifdef FEATURE_BUS_BANDWIDTH
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+static void hdd_set_bundle_require(uint16_t session_id, hdd_context_t *hdd_ctx,
+				   uint64_t tx_bytes)
+{
+	tlshim_set_bundle_require(session_id, tx_bytes,
+		hdd_ctx->cfg_ini->busBandwidthComputeInterval,
+		hdd_ctx->cfg_ini->pkt_bundle_threshold_high,
+		hdd_ctx->cfg_ini->pkt_bundle_threshold_low);
+
+}
+#else
+static void hdd_set_bundle_require(uint16_t session_id, hdd_context_t *hdd_ctx,
+				   uint64_t tx_bytes)
+{
+	return;
+}
+#endif
+
 void hdd_cnss_request_bus_bandwidth(hdd_context_t *pHddCtx,
         const uint64_t tx_packets, const uint64_t rx_packets)
 {
@@ -13287,7 +13310,8 @@ void hdd_cnss_request_bus_bandwidth(hdd_context_t *pHddCtx,
                 hddLog(LOGE, FL("low bandwidth set rx affinity fail"));
         } else {
             if (!pHddCtx->hbw_requested) {
-                vos_request_pm_qos(DISABLE_KRAIT_IDLE_PS_VAL);
+                vos_request_pm_qos_type(PM_QOS_CPU_DMA_LATENCY,
+                                      DISABLE_KRAIT_IDLE_PS_VAL);
                 pHddCtx->hbw_requested = true;
             }
             if (vos_sched_handle_throughput_req(true))
@@ -13342,12 +13366,11 @@ void hdd_cnss_request_bus_bandwidth(hdd_context_t *pHddCtx,
 }
 
 #define HDD_BW_GET_DIFF(x, y) ((x) >= (y) ? (x) - (y) : (ULONG_MAX - (y) + (x)))
-
 static void hdd_bus_bw_compute_cbk(void *priv)
 {
     hdd_context_t *pHddCtx = (hdd_context_t *)priv;
     hdd_adapter_t *pAdapter = NULL;
-    uint64_t tx_packets= 0, rx_packets= 0;
+    uint64_t tx_packets= 0, rx_packets= 0, tx_bytes = 0;
     uint64_t total_tx = 0, total_rx = 0;
     hdd_adapter_list_node_t *pAdapterNode = NULL;
     VOS_STATUS status = 0;
@@ -13390,15 +13413,20 @@ static void hdd_bus_bw_compute_cbk(void *priv)
 
         tx_packets += HDD_BW_GET_DIFF(pAdapter->stats.tx_packets,
                 pAdapter->prev_tx_packets);
+        tx_bytes += HDD_BW_GET_DIFF(pAdapter->stats.tx_bytes,
+                pAdapter->prev_tx_bytes);
         rx_packets += HDD_BW_GET_DIFF(pAdapter->stats.rx_packets,
                 pAdapter->prev_rx_packets);
 
+        hdd_set_bundle_require(pAdapter->sessionId, pHddCtx, tx_bytes);
+
         total_rx += pAdapter->stats.rx_packets;
         total_tx += pAdapter->stats.tx_packets;
 
 
         spin_lock_bh(&pHddCtx->bus_bw_lock);
         pAdapter->prev_tx_packets = pAdapter->stats.tx_packets;
+        pAdapter->prev_tx_bytes = pAdapter->stats.tx_bytes;
         pAdapter->prev_rx_packets = pAdapter->stats.rx_packets;
         spin_unlock_bh(&pHddCtx->bus_bw_lock);
         connected = TRUE;
@@ -15009,7 +15037,7 @@ static int hdd_driver_init( void)
     * load for reducing interrupt latency.
     */
 
-   vos_request_pm_qos(DISABLE_KRAIT_IDLE_PS_VAL);
+   vos_request_pm_qos_type(PM_QOS_CPU_DMA_LATENCY, DISABLE_KRAIT_IDLE_PS_VAL);
 
    vos_ssr_protect_init();
 
@@ -16587,8 +16615,10 @@ void hdd_stop_bus_bw_compute_timer(hdd_adapter_t *pAdapter)
         }
     }
 
-    if(can_stop == VOS_TRUE)
+    if (can_stop == VOS_TRUE) {
         vos_timer_stop(&pHddCtx->bus_bw_timer);
+        tlshim_reset_bundle_require();
+    }
 }
 #endif
 
diff --git a/CORE/HDD/src/wlan_hdd_ocb.c b/CORE/HDD/src/wlan_hdd_ocb.c
index 21929f7eb090..6e814a9f8572 100644
--- a/CORE/HDD/src/wlan_hdd_ocb.c
+++ b/CORE/HDD/src/wlan_hdd_ocb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -754,6 +754,9 @@ static const struct nla_policy qca_wlan_vendor_ocb_set_config_policy[
 	[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_FLAGS] = {
 		.type = NLA_U32
 	},
+	[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM] = {
+		.type = NLA_BINARY
+	},
 };
 
 static const struct nla_policy qca_wlan_vendor_ocb_set_utc_time_policy[
@@ -900,6 +903,8 @@ static int __wlan_hdd_cfg80211_ocb_set_config(struct wiphy *wiphy,
 	struct nlattr *ndl_active_state_list;
 	uint32_t ndl_active_state_list_len;
 	uint32_t flags = 0;
+	void *def_tx_param = NULL;
+	uint32_t def_tx_param_size = 0;
 	int i;
 	int channel_count, schedule_size;
 	struct sir_ocb_config *config;
@@ -957,11 +962,19 @@ static int __wlan_hdd_cfg80211_ocb_set_config(struct wiphy *wiphy,
 	ndl_active_state_list_len = (ndl_active_state_list ?
 				    nla_len(ndl_active_state_list) : 0);
 
-	/* Get the flags */
+	/* Get the flags. This parameter is optional. */
 	if (tb[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_FLAGS])
 		flags = nla_get_u32(tb[
 			QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_FLAGS]);
 
+	/* Get the default TX parameters. This parameter is optional. */
+	if (tb[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM]) {
+		def_tx_param_size = nla_len(tb[
+			QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM]);
+		def_tx_param = nla_data(tb[
+			QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM]);
+	}
+
 	config = hdd_ocb_config_new(channel_count, schedule_size,
 				    ndl_chan_list_len,
 				    ndl_active_state_list_len);
@@ -973,6 +986,8 @@ static int __wlan_hdd_cfg80211_ocb_set_config(struct wiphy *wiphy,
 	config->channel_count = channel_count;
 	config->schedule_size = schedule_size;
 	config->flags = flags;
+	config->def_tx_param = def_tx_param;
+	config->def_tx_param_size = def_tx_param_size;
 
 	/* Read the channel array */
 	channel_array = tb[QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_CHANNEL_ARRAY];
diff --git a/CORE/HDD/src/wlan_hdd_ocb.h b/CORE/HDD/src/wlan_hdd_ocb.h
index 6f3cf1abe3fc..57c55a40bc23 100644
--- a/CORE/HDD/src/wlan_hdd_ocb.h
+++ b/CORE/HDD/src/wlan_hdd_ocb.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -90,7 +90,12 @@ struct dot11p_channel_sched {
  * @QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_NDL_CHANNEL_ARRAY:
  *	array of NDL channel information
  * @QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_NDL_ACTIVE_STATE_ARRAY:
- *	array of NDL active state configuration
+ *      array of NDL active state configuration
+ * @QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_FLAGS:
+ *      configuration flags such as OCB_CONFIG_FLAG_80211_FRAME_MODE
+ * @QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM:
+ *      default TX parameters to use in the case that a packet is sent without
+ *      a TX control header
  */
 enum qca_wlan_vendor_attr_ocb_set_config {
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_INVALID = 0,
@@ -101,6 +106,7 @@ enum qca_wlan_vendor_attr_ocb_set_config {
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_NDL_CHANNEL_ARRAY,
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_NDL_ACTIVE_STATE_ARRAY,
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_FLAGS,
+	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_DEF_TX_PARAM,
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_AFTER_LAST,
 	QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_MAX =
 		QCA_WLAN_VENDOR_ATTR_OCB_SET_CONFIG_AFTER_LAST - 1,
diff --git a/CORE/HDD/src/wlan_hdd_p2p.c b/CORE/HDD/src/wlan_hdd_p2p.c
index 94abe6535ed7..794e071cedb9 100644
--- a/CORE/HDD/src/wlan_hdd_p2p.c
+++ b/CORE/HDD/src/wlan_hdd_p2p.c
@@ -192,6 +192,7 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
     vos_timer_destroy(&pRemainChanCtx->hdd_remain_on_chan_timer);
 
     cfgState->remain_on_chan_ctx = NULL;
+
     /*
      * Resetting the roc in progress early ensures that the subsequent
      * roc requests are immediately processed without being queued
@@ -205,7 +206,6 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
      * Basically, the system must not go into suspend while roc is in progress.
      */
     hdd_allow_suspend(WIFI_POWER_EVENT_WAKELOCK_ROC);
-    mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
 
     if( REMAIN_ON_CHANNEL_REQUEST == pRemainChanCtx->rem_on_chan_request)
     {
@@ -229,6 +229,7 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
                               GFP_KERNEL);
         pAdapter->lastRocTs = vos_timer_get_system_time();
     }
+    mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
 
     /* Schedule any pending RoC: Any new roc request during this time
      * would have got queued in 'wlan_hdd_request_remain_on_channel'
@@ -245,13 +246,17 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
        )
     {
         tANI_U8 sessionId = pAdapter->sessionId;
+        mutex_lock(&cfgState->remain_on_chan_ctx_lock);
         if( REMAIN_ON_CHANNEL_REQUEST == pRemainChanCtx->rem_on_chan_request)
         {
+            mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
             sme_DeregisterMgmtFrame(
                        hHal, sessionId,
                       (SIR_MAC_MGMT_FRAME << 2) | ( SIR_MAC_MGMT_PROBE_REQ << 4),
                        NULL, 0 );
         }
+        else
+           mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
     }
     else if ( ( WLAN_HDD_SOFTAP== pAdapter->device_mode ) ||
               ( WLAN_HDD_P2P_GO == pAdapter->device_mode )
@@ -268,6 +273,7 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
 
     }
 
+    mutex_lock(&cfgState->remain_on_chan_ctx_lock);
     if(pRemainChanCtx->action_pkt_buff.frame_ptr != NULL
        && pRemainChanCtx->action_pkt_buff.frame_length != 0 )
     {
@@ -276,6 +282,7 @@ wlan_hdd_remain_on_channel_callback(tHalHandle hHal, void* pCtx,
         pRemainChanCtx->action_pkt_buff.frame_length = 0;
     }
     vos_mem_free( pRemainChanCtx );
+    mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
     complete(&pAdapter->cancel_rem_on_chan_var);
     if (eHAL_STATUS_SUCCESS != status)
         complete(&pAdapter->rem_on_chan_ready_event);
@@ -300,6 +307,12 @@ void wlan_hdd_cancel_existing_remain_on_channel(hdd_adapter_t *pAdapter)
                                               hdd_remain_on_chan_timer);
 
         pRemainChanCtx = cfgState->remain_on_chan_ctx;
+        if (NULL == pRemainChanCtx)
+        {
+            mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
+            hddLog(LOGE, FL("pRemainChanCtx is NULL"));
+            return;
+        }
         if (pRemainChanCtx->hdd_remain_on_chan_cancel_in_progress == TRUE)
         {
             mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
@@ -418,6 +431,12 @@ void wlan_hdd_cleanup_remain_on_channel_ctx(hdd_adapter_t *pAdapter)
 
            mutex_lock(&cfgState->remain_on_chan_ctx_lock);
            roc_ctx = cfgState->remain_on_chan_ctx;
+           if (roc_ctx == NULL)
+           {
+               mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
+               hddLog(LOG1, FL("roc_ctx is NULL!"));
+               return;
+           }
            if (roc_ctx->hdd_remain_on_chan_cancel_in_progress == true) {
                 mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
                 hddLog(LOG1, FL("roc cancel already in progress"));
@@ -1557,7 +1576,9 @@ int __wlan_hdd_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                    goto send_frame;
                } else {
 
-                  if(pRemainChanCtx->hdd_remain_on_chan_cancel_in_progress == TRUE)
+                  if( (pRemainChanCtx != NULL) &&
+                      (pRemainChanCtx->hdd_remain_on_chan_cancel_in_progress ==
+                           TRUE))
                   {
                       mutex_unlock(&cfgState->remain_on_chan_ctx_lock);
                       hddLog(VOS_TRACE_LEVEL_INFO,
diff --git a/CORE/HDD/src/wlan_hdd_scan.c b/CORE/HDD/src/wlan_hdd_scan.c
index 83d8871b7a72..e05b73302348 100644
--- a/CORE/HDD/src/wlan_hdd_scan.c
+++ b/CORE/HDD/src/wlan_hdd_scan.c
@@ -796,6 +796,12 @@ static int __iw_get_scan(struct net_device *dev,
 
    ENTER();
 
+   if (NULL == extra) {
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
+           "%s: NULL extra", __func__);
+       return -EINVAL;
+   }
+
    hdd_ctx = WLAN_HDD_GET_CTX(pAdapter);
    ret = wlan_hdd_validate_context(hdd_ctx);
    if (0 != ret)
diff --git a/CORE/HDD/src/wlan_hdd_tdls.c b/CORE/HDD/src/wlan_hdd_tdls.c
index 77780bd5850f..01b54eb52b9b 100644
--- a/CORE/HDD/src/wlan_hdd_tdls.c
+++ b/CORE/HDD/src/wlan_hdd_tdls.c
@@ -44,6 +44,8 @@
 #include <net/ieee80211_radiotap.h>
 #include "wlan_hdd_tdls.h"
 #include "wlan_hdd_cfg80211.h"
+#include "wlan_hdd_assoc.h"
+#include "sme_Api.h"
 #include "vos_sched.h"
 
 /**
@@ -184,8 +186,8 @@ void hdd_wlan_block_scan_by_tdls_event(void)
 void wlan_hdd_tdls_disable_offchan_and_teardown_links(hdd_context_t *hddctx)
 {
 	u16 connected_tdls_peers = 0;
+	hddTdlsPeer_t *curr_peer;
 	u8 staidx;
-	hddTdlsPeer_t *curr_peer = NULL;
 	hdd_adapter_t *adapter = NULL;
 
 	if (eTDLS_SUPPORT_NOT_ENABLED == hddctx->tdls_mode) {
@@ -202,8 +204,10 @@ void wlan_hdd_tdls_disable_offchan_and_teardown_links(hdd_context_t *hddctx)
 
 	connected_tdls_peers = wlan_hdd_tdlsConnectedPeers(adapter);
 
-	if (!connected_tdls_peers)
+	if (!connected_tdls_peers) {
+		hddLog(LOG1, FL("No TDLS connected peers to delete"));
 		return ;
+	}
 
 	/* TDLS is not supported in case of concurrency.
 	 * Disable TDLS Offchannel in FW to avoid more
@@ -222,6 +226,9 @@ void wlan_hdd_tdls_disable_offchan_and_teardown_links(hdd_context_t *hddctx)
 			TDLS_SEC_OFFCHAN_OFFSET_40PLUS);
 	hdd_set_tdls_offchannelmode(adapter, DISABLE_CHANSWITCH);
 
+	/* Send Msg to PE for deleting all the TDLS peers */
+	sme_delete_all_tdls_peers(hddctx->hHal, adapter->sessionId);
+
 	for (staidx = 0; staidx < hddctx->max_num_tdls_sta;
 							staidx++) {
 		if (!hddctx->tdlsConnInfo[staidx].staId)
@@ -229,20 +236,36 @@ void wlan_hdd_tdls_disable_offchan_and_teardown_links(hdd_context_t *hddctx)
 
 		curr_peer = wlan_hdd_tdls_find_all_peer(hddctx,
 				hddctx->tdlsConnInfo[staidx].peerMac.bytes);
-
 		if (!curr_peer)
 			continue;
 
 		hddLog(LOG1, FL("indicate TDLS teardown (staId %d)"),
-				curr_peer->staId);
+			curr_peer->staId);
 
+		/* Indicate teardown to supplicant */
 		wlan_hdd_tdls_indicate_teardown(
-					curr_peer->pHddTdlsCtx->pAdapter,
-					curr_peer,
-					eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
+				curr_peer->pHddTdlsCtx->pAdapter,
+				curr_peer,
+				eSIR_MAC_TDLS_TEARDOWN_UNSPEC_REASON);
+
+		/*
+		 * Del Sta happened already as part of sme_delete_all_tdls_peers
+		 * Hence clear hdd data structure.
+		 */
+		hdd_roamDeregisterTDLSSTA(adapter,
+				hddctx->tdlsConnInfo[staidx].staId);
+		wlan_hdd_tdls_decrement_peer_count(adapter);
+		wlan_hdd_tdls_reset_peer(adapter, curr_peer->peerMac);
 		hdd_send_wlan_tdls_teardown_event(eTDLS_TEARDOWN_CONCURRENCY,
-							curr_peer->peerMac);
+				curr_peer->peerMac);
+
+		hddctx->tdlsConnInfo[staidx].staId = 0;
+		hddctx->tdlsConnInfo[staidx].sessionId = 255;
+
+		vos_mem_zero(&hddctx->tdlsConnInfo[staidx].peerMac,
+			sizeof(v_MACADDR_t));
 	}
+	wlan_hdd_tdls_check_bmps(adapter);
 }
 
 /**
@@ -1193,7 +1216,8 @@ int wlan_hdd_tdls_set_peer_caps(hdd_adapter_t *pAdapter,
                                 const u8 *mac,
                                 tCsrStaParams *StaParams,
                                 tANI_BOOLEAN isBufSta,
-                                tANI_BOOLEAN isOffChannelSupported)
+                                tANI_BOOLEAN isOffChannelSupported,
+                                bool is_qos_wmm_sta)
 {
     hddTdlsPeer_t *curr_peer;
 
@@ -1223,6 +1247,9 @@ int wlan_hdd_tdls_set_peer_caps(hdd_adapter_t *pAdapter,
 
     curr_peer->supported_oper_classes_len =
                StaParams->supported_oper_classes_len;
+
+    curr_peer->qos = is_qos_wmm_sta;
+
     return 0;
 }
 
@@ -1260,6 +1287,9 @@ int wlan_hdd_tdls_get_link_establish_params(hdd_adapter_t *pAdapter,
 
     tdlsLinkEstablishParams->supportedOperClassesLen =
                  curr_peer->supported_oper_classes_len;
+
+    tdlsLinkEstablishParams->qos = curr_peer->qos;
+
     return 0;
 }
 
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index bf2c4edf2168..2988a7b8d969 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -109,12 +109,12 @@
 
 #include "wlan_hdd_ocb.h"
 #include "wlan_hdd_tsf.h"
+#include "vos_nvitem.h"
 
 #define HDD_FINISH_ULA_TIME_OUT         800
 #define HDD_SET_MCBC_FILTERS_TO_FW      1
 #define HDD_DELETE_MCBC_FILTERS_FROM_FW 0
 
-extern int wlan_hdd_cfg80211_update_band(struct wiphy *wiphy, eCsrBand eBand);
 static int ioctl_debug;
 module_param(ioctl_debug, int, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
 
@@ -5606,12 +5606,34 @@ static int iw_set_mlme(struct net_device *dev, struct iw_request_info *info,
 }
 
 int process_wma_set_command(int sessid, int paramid,
-                                   int sval, int vpdev)
+                            int sval, int vpdev)
 {
     int ret = 0;
     vos_msg_t msg = {0};
 
-    wda_cli_set_cmd_t *iwcmd = (wda_cli_set_cmd_t *)vos_mem_malloc(
+    v_CONTEXT_t vos_context = vos_get_global_context(0, NULL);
+    hdd_context_t *hdd_ctx;
+    wda_cli_set_cmd_t *iwcmd;
+
+    /* Skip session validation in FTM mode and for PDEV commands */
+    if (vpdev == PDEV_CMD || VOS_FTM_MODE == hdd_get_conparam())
+       goto skip_ftm;
+
+    hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_context);
+    if (!hdd_ctx) {
+       hddLog(LOGE,FL("hdd context is not valid!"));
+       return -EINVAL;
+    }
+
+    if (vpdev != PDEV_CMD &&
+        VOS_STATUS_SUCCESS != sme_is_session_valid(hdd_ctx->hHal,
+                                                     sessid)) {
+       hddLog(LOGE, FL("SME session id is not valid %d"), sessid);
+       return -EINVAL;
+    }
+
+skip_ftm:
+    iwcmd = (wda_cli_set_cmd_t *)vos_mem_malloc(
                                 sizeof(wda_cli_set_cmd_t));
     if (NULL == iwcmd) {
        hddLog(VOS_TRACE_LEVEL_FATAL, "%s: vos_mem_alloc failed", __func__);
@@ -5627,7 +5649,7 @@ int process_wma_set_command(int sessid, int paramid,
     msg.bodyptr = (void *)iwcmd;
     if (VOS_STATUS_SUCCESS != vos_mq_post_message(VOS_MODULE_ID_WDA,
                                                   &msg)) {
-       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, "%s: "
+       hddLog(VOS_TRACE_LEVEL_ERROR, "%s: "
                  "Not able to post wda_cli_set_cmd message to WDA",
                  __func__);
        vos_mem_free(iwcmd);
@@ -5641,7 +5663,29 @@ int process_wma_set_command_twoargs(int sessid, int paramid,
 {
     int ret = 0;
     vos_msg_t msg = {0};
-    wda_cli_set_cmd_t *iwcmd = vos_mem_malloc(sizeof(*iwcmd));
+    wda_cli_set_cmd_t *iwcmd;
+
+    v_CONTEXT_t vos_context = vos_get_global_context(0, NULL);
+    hdd_context_t *hdd_ctx;
+    /* Skip session validation in FTM mode and for PDEV commands */
+    if (vpdev == PDEV_CMD || VOS_FTM_MODE == hdd_get_conparam())
+       goto skip_ftm;
+
+    hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_context);
+
+    if (!hdd_ctx) {
+       hddLog(LOGE,FL("hdd context is not valid!"));
+       return -EINVAL;
+    }
+
+    if (VOS_STATUS_SUCCESS  != sme_is_session_valid(hdd_ctx->hHal,
+                                                     sessid)) {
+       hddLog(LOGE, FL("SME session id is not valid %d"), sessid);
+       return -EINVAL;
+    }
+
+skip_ftm:
+    iwcmd = vos_mem_malloc(sizeof(*iwcmd));
 
     if (NULL == iwcmd) {
         hddLog(VOS_TRACE_LEVEL_FATAL, "%s: vos_mem_alloc failed!", __func__);
@@ -7561,6 +7605,12 @@ static int __iw_setnone_getint(struct net_device *dev,
     if (0 != ret)
         return ret;
 
+    if (VOS_STATUS_SUCCESS != sme_is_session_valid(hHal,
+                               pAdapter->sessionId)) {
+       hddLog(LOGE, FL("session id is not valid %d"), pAdapter->sessionId);
+       return -EINVAL;
+    }
+
     switch (value[0])
     {
         case WE_GET_11D_STATE:
@@ -10965,7 +11015,7 @@ int hdd_setBand(struct net_device *dev, u8 ui_band)
                      FL("Failed to set the band value to %u"), band);
              return -EINVAL;
         }
-        wlan_hdd_cfg80211_update_band(pHddCtx->wiphy, (eCsrBand)band);
+        vos_update_band((eCsrBand)band);
     }
     EXIT();
     return 0;
diff --git a/CORE/MAC/inc/aniGlobal.h b/CORE/MAC/inc/aniGlobal.h
index 34f3904ad43f..2ebe7c97868b 100644
--- a/CORE/MAC/inc/aniGlobal.h
+++ b/CORE/MAC/inc/aniGlobal.h
@@ -1124,6 +1124,8 @@ typedef struct sMacOpenParameters
 #endif
     uint16_t  max_mgmt_tx_fail_count;
     bool force_target_assert_enabled;
+    uint16_t pkt_bundle_timer_value;
+    uint16_t pkt_bundle_size;
 } tMacOpenParameters;
 
 typedef struct sHalMacStartParameters
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 37efadd76d99..fa365602ed1b 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            11
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            17
+#define QWLAN_VERSION_BUILD            35
 
-#define QWLAN_VERSIONSTR               "4.0.11.17"
+#define QWLAN_VERSIONSTR               "4.0.11.35"
 
 
 #define AR6320_REV1_VERSION             0x5000000
diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index 7d930a2b5c3b..8bb9b110cc57 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -4398,20 +4398,32 @@ typedef struct sSirScanOffloadReq {
       -----------------------------*/
 } tSirScanOffloadReq, *tpSirScanOffloadReq;
 
-typedef enum sSirScanEventType {
-    SCAN_EVENT_STARTED=0x1,          /* Scan command accepted by FW */
-    SCAN_EVENT_COMPLETED=0x2,        /* Scan has been completed by FW */
-    SCAN_EVENT_BSS_CHANNEL=0x4,      /* FW is going to move to HOME channel */
-    SCAN_EVENT_FOREIGN_CHANNEL = 0x8,/* FW is going to move to FORIEGN channel */
-    SCAN_EVENT_DEQUEUED=0x10,       /* scan request got dequeued */
-    SCAN_EVENT_PREEMPTED=0x20,      /* preempted by other high priority scan */
-    SCAN_EVENT_START_FAILED=0x40,   /* scan start failed */
-    SCAN_EVENT_RESTARTED=0x80,      /*scan restarted*/
-    SCAN_EVENT_MAX=0x8000
-} tSirScanEventType;
+/**
+ * lim_scan_event_type - scan event types used in LIM
+ * @LIM_SCAN_EVENT_STARTED - scan command accepted by FW
+ * @LIM_SCAN_EVENT_COMPLETED - scan has been completed by FW
+ * @LIM_SCAN_EVENT_BSS_CHANNEL - FW is going to move to HOME channel
+ * @LIM_SCAN_EVENT_FOREIGN_CHANNEL - FW is going to move to FORIEGN channel
+ * @LIM_SCAN_EVENT_DEQUEUED - scan request got dequeued
+ * @LIM_SCAN_EVENT_PREEMPTED - preempted by other high priority scan
+ * @LIM_SCAN_EVENT_START_FAILED - scan start failed
+ * @LIM_SCAN_EVENT_RESTARTED - scan restarted
+ * @LIM_SCAN_EVENT_MAX - max value for event type
+*/
+enum lim_scan_event_type {
+    LIM_SCAN_EVENT_STARTED=0x1,
+    LIM_SCAN_EVENT_COMPLETED=0x2,
+    LIM_SCAN_EVENT_BSS_CHANNEL=0x4,
+    LIM_SCAN_EVENT_FOREIGN_CHANNEL = 0x8,
+    LIM_SCAN_EVENT_DEQUEUED=0x10,
+    LIM_SCAN_EVENT_PREEMPTED=0x20,
+    LIM_SCAN_EVENT_START_FAILED=0x40,
+    LIM_SCAN_EVENT_RESTARTED=0x80,
+    LIM_SCAN_EVENT_MAX=0x8000
+};
 
 typedef struct sSirScanOffloadEvent{
-    tSirScanEventType event;
+    enum lim_scan_event_type event;
     tSirResultCodes reasonCode;
     tANI_U32 chanFreq;
     tANI_U32 requestor;
@@ -5008,39 +5020,39 @@ typedef enum
     WIFI_BAND_MAX
 } tWifiBand;
 
-/* wifi scan related events */
-typedef enum
+/**
+ * enum wifi_extscan_event_type - extscan event type
+ * @WIFI_EXTSCAN_RESULTS_AVAILABLE: reported when REPORT_EVENTS_EACH_SCAN is set
+ *		and a scan cycle completes. WIFI_SCAN_THRESHOLD_NUM_SCANS or
+ *		WIFI_SCAN_THRESHOLD_PERCENT can be reported instead if the
+ *		reason for the event is available; however, at most one of
+ *		these events should be reported per scan.
+ * @WIFI_EXTSCAN_THRESHOLD_NUM_SCANS: can be reported when
+ *		REPORT_EVENTS_EACH_SCAN is not set and
+ *		report_threshold_num_scans is reached.
+ * @WIFI_EXTSCAN_THRESHOLD_PERCENT: can be reported when REPORT_EVENTS_EACH_SCAN
+ *		is not set and report_threshold_percent is reached.
+ * @WIFI_SCAN_DISABLED: reported when currently executing gscans are disabled
+ *		start_gscan will need to be called again in order to continue
+ *		scanning.
+ * @WIFI_EXTSCAN_BUCKET_STARTED_EVENT: Bucket started event
+ *		This event is consumed in driver only.
+ * @WIFI_EXTSCAN_CYCLE_STARTED_EVENT: Cycle started event.
+ *		This event is consumed in driver only.
+ * @WIFI_EXTSCAN_CYCLE_COMPLETED_EVENT: Cycle complete event. This event
+ *		triggers @WIFI_EXTSCAN_RESULTS_AVAILABLE to the user space.
+ */
+enum wifi_extscan_event_type
 {
-	/*
-	 * reported when REPORT_EVENTS_EACH_SCAN is set and a scan
-	 * completes. WIFI_SCAN_THRESHOLD_NUM_SCANS or
-	 * WIFI_SCAN_THRESHOLD_PERCENT can be reported instead if the
-	 * reason for the event is available; however, at most one of
-	 * these events should be reported per scan.
-	 */
 	WIFI_EXTSCAN_RESULTS_AVAILABLE,
-	/*
-	 * can be reported when REPORT_EVENTS_EACH_SCAN is not set and
-	 * report_threshold_num_scans is reached.
-	 */
 	WIFI_EXTSCAN_THRESHOLD_NUM_SCANS,
-	/*
-	 * can be reported when REPORT_EVENTS_EACH_SCAN is not set and
-	 * report_threshold_percent is reached
-	 */
 	WIFI_EXTSCAN_THRESHOLD_PERCENT,
-	/*
-	 * reported when currently executing gscans are disabled
-	 * start_gscan will need to be called again in order to continue
-	 * scanning
-	 */
 	WIFI_SCAN_DISABLED,
 
-	/* Below events are consumed in driver only */
 	WIFI_EXTSCAN_BUCKET_STARTED_EVENT = 0x10,
 	WIFI_EXTSCAN_CYCLE_STARTED_EVENT,
 	WIFI_EXTSCAN_CYCLE_COMPLETED_EVENT,
-} tWifiScanEventType;
+};
 
 /**
  * enum extscan_configuration_flags - extscan config flags
@@ -6284,8 +6296,8 @@ struct sir_ocb_config_sched {
  * @dcc_ndl_chan_list: array of dcc channel info
  * @dcc_ndl_active_state_list_len: size of the active state array
  * @dcc_ndl_active_state_list: array of active states
- * @adapter: the OCB adapter
- * @dcc_stats_callback: callback for the response event
+ * @def_tx_param: default TX parameters
+ * @def_tx_param_size: size of the default TX parameters
  */
 struct sir_ocb_config {
 	uint8_t session_id;
@@ -6298,6 +6310,8 @@ struct sir_ocb_config {
 	void *dcc_ndl_chan_list;
 	uint32_t dcc_ndl_active_state_list_len;
 	void *dcc_ndl_active_state_list;
+	void *def_tx_param;
+	uint32_t def_tx_param_size;
 };
 
 /* The size of the utc time in bytes. */
@@ -6661,6 +6675,17 @@ struct egap_conf_params {
 };
 
 /**
+ * struct beacon_filter_param - parameters for beacon filtering
+ * @vdev_id: vdev id
+ * @ie_map: bitwise map of IEs that needs to be filtered
+ *
+ */
+struct beacon_filter_param {
+	uint32_t   vdev_id;
+	uint32_t   ie_map[8];
+};
+
+/**
  * struct smps_force_mode_event - smps force mode event param
  * @message_type: Type of message
  * @length: length
@@ -6861,4 +6886,50 @@ struct get_mib_stats_req {
 	uint16_t msg_len;
 	uint8_t  session_id;
 };
+
+/**
+ * sir_txrate_update - update txrate to firmware
+ * @session_id: session identifier
+ * @txrate: tx rate to configure for hardware mode
+ * @bssid: Bssid
+ */
+struct sir_txrate_update {
+	uint8_t session_id;
+	uint16_t txrate;
+	tSirMacAddr bssid;
+};
+
+/**
+ * struct sir_del_all_tdls_peers - delete all tdls peers
+ * @msg_type: type of message
+ * @msg_len: length of message
+ * bssid: bssid of peer device
+ */
+struct sir_del_all_tdls_peers {
+	uint16_t msg_type;
+	uint16_t msg_len;
+	tSirMacAddr bssid;
+};
+
+/**
+ * struct sme_send_disassoc_frm_req - send disassoc request frame
+ * @msg_type: message type
+ * @length: length of message
+ * @session_id: session id
+ * @trans_id: transaction id
+ * @peer_mac: peer mac address
+ * @reason: reason for disassoc
+ * @wait_for_ack: wait for acknowledgment
+ */
+struct sme_send_disassoc_frm_req
+{
+	uint16_t msg_type;
+	uint16_t length;
+	uint8_t session_id;
+	uint16_t trans_id;
+	uint8_t peer_mac[6];
+	uint16_t reason;
+	uint8_t wait_for_ack;
+};
+
 #endif /* __SIR_API_H */
diff --git a/CORE/MAC/inc/wniApi.h b/CORE/MAC/inc/wniApi.h
index 9556126247f4..13cb00cc64d7 100644
--- a/CORE/MAC/inc/wniApi.h
+++ b/CORE/MAC/inc/wniApi.h
@@ -404,6 +404,8 @@ enum eWniMsgTypes
     eWNI_SME_SMPS_FORCE_MODE_IND,
     eWNI_SME_REGISTER_MGMT_FRAME_CB,
     eWNI_SME_MON_INIT_SESSION,
+    eWNI_SME_DEL_ALL_TDLS_PEERS,
+    eWNI_SME_SEND_DISASSOC_FRAME,
     eWNI_SME_MSG_TYPES_END
 };
 
diff --git a/CORE/MAC/src/cfg/cfgProcMsg.c b/CORE/MAC/src/cfg/cfgProcMsg.c
index 4b53a83ec3e4..43ecf7b3b825 100644
--- a/CORE/MAC/src/cfg/cfgProcMsg.c
+++ b/CORE/MAC/src/cfg/cfgProcMsg.c
@@ -2629,7 +2629,7 @@ ProcSetReqInternal(tpAniSirGlobal pMac, tANI_U16 length, tANI_U32 *pParam, tANI_
     tANI_U32    value, result;
     tANI_U32    param_list[WNI_CFG_SET_CNF_NUM];
 
-    PELOG1(cfgLog(pMac, LOGl, FL("Rcvd cfg set request %d bytes"), length);)
+    PELOG1(cfgLog(pMac, LOG1, FL("Rcvd cfg set request %d bytes"), length);)
 
     if (!pMac->cfg.gCfgStatus)
     {
diff --git a/CORE/MAC/src/dph/dphHashTable.c b/CORE/MAC/src/dph/dphHashTable.c
index 76c2e491096f..5df7f6f11066 100644
--- a/CORE/MAC/src/dph/dphHashTable.c
+++ b/CORE/MAC/src/dph/dphHashTable.c
@@ -255,7 +255,7 @@ tpDphHashNode dphInitStaState(tpAniSirGlobal pMac, tSirMacAddr staAddr,
     pStaDs = getNode(pMac, (tANI_U8) assocId, pDphHashTable);
     staIdx = pStaDs->staIndex;
 
-    PELOG1(limLog(pMac, LOG1, FL("Assoc Id %d, Addr %08X"), assocId, pStaDs);)
+    PELOG1(limLog(pMac, LOG1, FL("Assoc Id %d, Addr %p"), assocId, &pStaDs);)
 
     // Clear the STA node except for the next pointer (last 4 bytes)
     vos_mem_set( (tANI_U8 *) pStaDs, sizeof(tDphHashNode) - sizeof(tpDphHashNode), 0);
diff --git a/CORE/MAC/src/include/parserApi.h b/CORE/MAC/src/include/parserApi.h
index 072b09cb3b40..6184e10b27da 100644
--- a/CORE/MAC/src/include/parserApi.h
+++ b/CORE/MAC/src/include/parserApi.h
@@ -165,6 +165,7 @@ typedef struct sSirProbeRespBeacon
     tDot11fIEVHTCaps          VHTCaps;
     tDot11fIEVHTOperation     VHTOperation;
     tDot11fIEVHTExtBssLoad    VHTExtBssLoad;
+    tDot11fIEExtCap           ExtCap;
     tDot11fIEOperatingMode    OperatingMode;
     tANI_U8                   WiderBWChanSwitchAnnPresent;
     tDot11fIEWiderBWChanSwitchAnn WiderBWChanSwitchAnn;
diff --git a/CORE/MAC/src/include/sirParams.h b/CORE/MAC/src/include/sirParams.h
index ec8a1d0e0ae5..a5487c81a2af 100644
--- a/CORE/MAC/src/include/sirParams.h
+++ b/CORE/MAC/src/include/sirParams.h
@@ -758,6 +758,9 @@ typedef struct sSirMbMsgP2p
 #define SIR_HAL_MIB_STATS_REQ               (SIR_HAL_ITC_MSG_TYPES_BEGIN + 342)
 #define SIR_HAL_SET_MIB_STATS_ENABLE        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 343)
 #define SIR_HAL_SET_MIB_STATS_DISABLE       (SIR_HAL_ITC_MSG_TYPES_BEGIN + 344)
+#define SIR_HAL_UPDATE_TX_RATE             (SIR_HAL_ITC_MSG_TYPES_BEGIN + 345)
+#define SIR_HAL_ADD_BCN_FILTER_CMDID        (SIR_HAL_ITC_MSG_TYPES_BEGIN + 346)
+#define SIR_HAL_REMOVE_BCN_FILTER_CMDID     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 347)
 
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
 
diff --git a/CORE/MAC/src/pe/include/limApi.h b/CORE/MAC/src/pe/include/limApi.h
index 3728b732fae5..e54c783b9f39 100644
--- a/CORE/MAC/src/pe/include/limApi.h
+++ b/CORE/MAC/src/pe/include/limApi.h
@@ -125,6 +125,9 @@ void limDumpInit(tpAniSirGlobal pMac);
 extern void limCleanup(tpAniSirGlobal);
 /// Function to post messages to LIM thread
 extern tANI_U32  limPostMsgApi(tpAniSirGlobal, tSirMsgQ *);
+uint32_t
+lim_post_msg_high_pri(tpAniSirGlobal mac, tSirMsgQ *msg);
+
 /**
  * Function to process messages posted to LIM thread
  * and dispatch to various sub modules within LIM module.
@@ -270,5 +273,11 @@ void limProcessAbortScanInd(tpAniSirGlobal pMac, tANI_U8 sessionId);
 
 void lim_smps_force_mode_ind(tpAniSirGlobal mac_ctx, tpSirMsgQ msg);
 
+typedef void (*tp_pe_packetdump_cb)(adf_nbuf_t netbuf,
+			uint8_t status, uint8_t vdev_id, uint8_t type);
+
+void pe_register_packetdump_callback(tp_pe_packetdump_cb pe_packetdump_cb);
+void pe_deregister_packetdump_callback(void);
+
 /************************************************************/
 #endif /* __LIM_API_H */
diff --git a/CORE/MAC/src/pe/include/limSession.h b/CORE/MAC/src/pe/include/limSession.h
index 1f79b0be24da..c1a9a7aa8f0a 100644
--- a/CORE/MAC/src/pe/include/limSession.h
+++ b/CORE/MAC/src/pe/include/limSession.h
@@ -498,6 +498,7 @@ typedef struct sPESession           // Added to Support BT-AMP
     bool add_bss_failed;
     /* Supported NSS is intersection of self and peer NSS */
     bool supported_nss_1x1;
+    bool is_ext_caps_present;
 } tPESession, *tpPESession;
 
 /*-------------------------------------------------------------------------
diff --git a/CORE/MAC/src/pe/lim/limApi.c b/CORE/MAC/src/pe/lim/limApi.c
index 0f860395b310..4dba015af9b6 100644
--- a/CORE/MAC/src/pe/lim/limApi.c
+++ b/CORE/MAC/src/pe/lim/limApi.c
@@ -76,7 +76,9 @@
 #include "vos_utils.h"
 #include "wlan_qct_tl.h"
 #include "sysStartup.h"
+#include "pktlog_ac_fmt.h"
 
+static tp_pe_packetdump_cb gpe_packetdump_cb;
 
 static void __limInitScanVars(tpAniSirGlobal pMac)
 {
@@ -834,7 +836,7 @@ bool lim_is_assoc_req_for_drop(tpAniSirGlobal mac, uint8_t *rx_pkt_info)
 	mac_hdr = WDA_GET_RX_MAC_HEADER(rx_pkt_info);
 	session_entry = peFindSessionByBssid(mac, mac_hdr->bssId, &session_id);
 	if (!session_entry) {
-		PELOG1(limLog(pMac, LOG1,
+		PELOG1(limLog(mac, LOG1,
 			FL("session does not exist for given STA [%pM]"),
 			mac_hdr->sa););
 		return false;
@@ -843,7 +845,7 @@ bool lim_is_assoc_req_for_drop(tpAniSirGlobal mac, uint8_t *rx_pkt_info)
 	sta_ds = dphLookupHashEntry(mac, mac_hdr->sa, &aid,
 				&session_entry->dph.dphHashTable);
 	if (!sta_ds) {
-		PELOG1(limLog(pMac, LOG1, FL("pStaDs is NULL")););
+		PELOG1(limLog(mac, LOG1, FL("pStaDs is NULL")););
 		return false;
 	}
 
@@ -1306,6 +1308,21 @@ limPostMsgApi(tpAniSirGlobal pMac, tSirMsgQ *pMsg)
 
 } /*** end limPostMsgApi() ***/
 
+/**
+ * lim_post_msg_high_pri() - posts high priority pe message
+ * @mac: mac context
+ * @msg: message to be posted
+ *
+ * This function is used to post high priority pe message
+ *
+ * Return: returns value returned by vos_mq_post_message_by_priority
+ */
+uint32_t
+lim_post_msg_high_pri(tpAniSirGlobal mac, tSirMsgQ *msg)
+{
+	return vos_mq_post_message_by_priority(VOS_MQ_ID_PE, (vos_msg_t *)msg,
+					       HIGH_PRIORITY);
+}
 
 /*--------------------------------------------------------------------------
 
@@ -1436,6 +1453,10 @@ VOS_STATUS peHandleMgmtFrame( v_PVOID_t pvosGCtx, v_PVOID_t vosBuff)
            limLog(pMac, LOG1, FL("offloadScanLearn %d"),
                   WDA_GET_OFFLOADSCANLEARN(pRxPacketInfo));
 #endif
+
+    if ((mHdr->fc.subType != SIR_MAC_MGMT_BEACON) && gpe_packetdump_cb)
+        gpe_packetdump_cb(pVosPkt->pkt_buf, VOS_STATUS_SUCCESS,
+                                   pVosPkt->pkt_meta.sessionId, RX_MGMT_PKT);
     }
 
 
@@ -2092,6 +2113,12 @@ void limHandleMissedBeaconInd(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
         limMissedBeaconInActiveMode(pMac, psessionEntry);
     }
 #endif
+    if (pMac->pmm.inMissedBeaconScenario == TRUE) {
+        limLog(pMac, LOGW,
+               FL("beacon miss handling is already going on for BSSIdx:%d"),
+               pSirMissedBeaconInd->bssIdx);
+        return;
+    }
     else
     {
         limLog(pMac, LOGE,
@@ -2768,3 +2795,32 @@ eHalStatus pe_ReleaseGlobalLock( tAniSirLim *psPe)
     }
     return (status);
 }
+
+/**
+ * pe_register_packetdump_callback() - stores rx packet dump
+ * callback handler
+ * @pe_packetdump_cb: packetdump cb
+ *
+ * This function is used to store rx packet dump callback
+ *
+ * Return: None
+ *
+ */
+void pe_register_packetdump_callback(tp_pe_packetdump_cb pe_packetdump_cb)
+{
+	gpe_packetdump_cb = pe_packetdump_cb;
+}
+
+/**
+ * pe_deregister_packetdump_callback() - removes tx packet dump
+ * callback handler
+ *
+ * This function is used to remove rx packet dump callback
+ *
+ * Return: None
+ *
+ */
+void pe_deregister_packetdump_callback(void)
+{
+	gpe_packetdump_cb = NULL;
+}
diff --git a/CORE/MAC/src/pe/lim/limAssocUtils.c b/CORE/MAC/src/pe/lim/limAssocUtils.c
index 7606aad9fa98..e7678412f2cf 100644
--- a/CORE/MAC/src/pe/lim/limAssocUtils.c
+++ b/CORE/MAC/src/pe/lim/limAssocUtils.c
@@ -2013,8 +2013,8 @@ limPopulatePeerRateSet(tpAniSirGlobal pMac,
 
         psessionEntry->supported_nss_1x1 =
             ((pRates->supportedMCSSet[1] != 0) ? false : true);
-        PELOG1(limLog(pMac, LOG1, FL("HT supported nss 1x1 : %d "),
-                      psessionEntry->supported_nss_1x1);)
+        limLog(pMac, LOG1, FL("HT supported nss 1x1 : %d "),
+                      psessionEntry->supported_nss_1x1);
 
     }
 #ifdef WLAN_FEATURE_11AC
diff --git a/CORE/MAC/src/pe/lim/limFT.c b/CORE/MAC/src/pe/lim/limFT.c
index b81b51de0985..e6c05e1a78ae 100644
--- a/CORE/MAC/src/pe/lim/limFT.c
+++ b/CORE/MAC/src/pe/lim/limFT.c
@@ -1649,7 +1649,7 @@ tANI_BOOLEAN limProcessFTUpdateKey(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf )
         }
 
         pAddBssParams->extSetStaKeyParam.singleTidRc = val;
-        PELOG1(limLog(pMac, LOG1, FL("Key valid %d"),
+        PELOG1(limLog(pMac, LOG1, FL("Key valid %d, keyLength=%d"),
                     pAddBssParams->extSetStaKeyParamValid,
                     pAddBssParams->extSetStaKeyParam.key[0].keyLength);)
 
diff --git a/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c b/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c
index a3fa101eccb2..2c1581767ce9 100644
--- a/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c
+++ b/CORE/MAC/src/pe/lim/limLinkMonitoringAlgo.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -117,6 +117,48 @@ limDeleteStaContext(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
     switch(pMsg->reasonCode)
     {
         case HAL_DEL_STA_REASON_CODE_KEEP_ALIVE:
+             pStaDs = dphLookupAssocId(pMac, pMsg->staId, &pMsg->assocId,
+                            &psessionEntry->dph.dphHashTable);
+
+             if (!pStaDs) {
+                 PELOGE(limLog(pMac, LOGE,
+                               FL("Skip STA deletion (invalid STA) limSystemRole=%d"),
+                               GET_LIM_SYSTEM_ROLE(psessionEntry));)
+                 vos_mem_free(pMsg);
+                 return;
+             }
+
+             /*
+              * check and see if same staId. This is to avoid the scenario
+              * where we're trying to delete a staId we just added.
+              */
+             if (pStaDs->staIndex != pMsg->staId) {
+                 PELOGE(limLog(pMac, LOGE,
+                               FL("staid mismatch: %d vs %d "), pStaDs->staIndex, pMsg->staId);)
+                 vos_mem_free(pMsg);
+                 return;
+             }
+
+             /*
+              * Check if Deauth/Disassoc is triggered from Host.
+              * If mlmState is in some transient state then
+              * don't trigger STA deletion to avoid the race
+              * condition.
+              */
+             if ((pStaDs &&
+                 ((pStaDs->mlmStaContext.mlmState !=
+                   eLIM_MLM_LINK_ESTABLISHED_STATE) &&
+                  (pStaDs->mlmStaContext.mlmState !=
+                   eLIM_MLM_WT_ASSOC_CNF_STATE) &&
+                  (pStaDs->mlmStaContext.mlmState !=
+                   eLIM_MLM_ASSOCIATED_STATE)))) {
+                   PELOGE(limLog(pMac, LOGE,
+                              FL("received Del STA context in some transit state(staId: %d, assocId: %d)"),
+                              pMsg->staId, pMsg->assocId);)
+                vos_mem_free(pMsg);
+                return;
+             }
+
              if (LIM_IS_STA_ROLE(psessionEntry) && !pMsg->is_tdls) {
                  /*
                   * If roaming is in progress, then ignore the STA kick out
@@ -159,65 +201,25 @@ limDeleteStaContext(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
                  /* only break for STA role (non TDLS) */
                  break;
              }
+
              limLog(pMac, LOGE, FL("Deleting sta: staId %d, reasonCode %d"),
                              pMsg->staId, pMsg->reasonCode);
              if (LIM_IS_IBSS_ROLE(psessionEntry)) {
                  vos_mem_free(pMsg);
                  return;
              }
-             pStaDs = dphLookupAssocId(pMac, pMsg->staId, &pMsg->assocId, &psessionEntry->dph.dphHashTable);
-
-             if (!pStaDs) {
-                 PELOGE(limLog(pMac, LOGE, FL("Skip STA deletion (invalid STA) limSystemRole=%d"),
-                 GET_LIM_SYSTEM_ROLE(psessionEntry));)
-                 vos_mem_free(pMsg);
-                 return;
-             }
-
-             /* check and see if same staId. This is to avoid the scenario
-              * where we're trying to delete a staId we just added.
-              */
-             if (pStaDs->staIndex != pMsg->staId)
-             {
-                 PELOGE(limLog(pMac, LOGE, FL("staid mismatch: %d vs %d "), pStaDs->staIndex, pMsg->staId);)
-                 vos_mem_free(pMsg);
-                 return;
-             }
-
              if (LIM_IS_BT_AMP_AP_ROLE(psessionEntry) ||
                  LIM_IS_AP_ROLE(psessionEntry)) {
                  PELOG1(limLog(pMac, LOG1, FL("SAP:lim Delete Station Context (staId: %d, assocId: %d) "),
                              pMsg->staId, pMsg->assocId);)
-                 /*
-                  * Check if Deauth/Disassoc is triggered from Host.
-                  * If mlmState is in some transient state then
-                  * don't trigger STA deletion to avoid the race
-                  * condition.
-                  */
-                  if ((pStaDs &&
-                      ((pStaDs->mlmStaContext.mlmState !=
-                        eLIM_MLM_LINK_ESTABLISHED_STATE) &&
-                       (pStaDs->mlmStaContext.mlmState !=
-                        eLIM_MLM_WT_ASSOC_CNF_STATE) &&
-                       (pStaDs->mlmStaContext.mlmState !=
-                        eLIM_MLM_ASSOCIATED_STATE))))
-                 {
-                     PELOGE(limLog(pMac, LOGE, FL("SAP:received Del STA context in some transit state(staId: %d, assocId: %d)"),
-                            pMsg->staId, pMsg->assocId);)
-                     vos_mem_free(pMsg);
-                     return;
-                 }
-                 else
-                 {
-                     limSendDisassocMgmtFrame(pMac,
+                 limSendDisassocMgmtFrame(pMac,
                                      eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON,
                                      pStaDs->staAddr, psessionEntry, FALSE);
-                     limTriggerSTAdeletion(pMac, pStaDs, psessionEntry);
-                 }
+                 limTriggerSTAdeletion(pMac, pStaDs, psessionEntry);
              }
+#ifdef FEATURE_WLAN_TDLS
              else
              {
-#ifdef FEATURE_WLAN_TDLS
                 if (LIM_IS_STA_ROLE(psessionEntry) &&
                     STA_ENTRY_TDLS_PEER == pStaDs->staType) {
                     //TeardownLink with PEER
@@ -225,66 +227,9 @@ limDeleteStaContext(tpAniSirGlobal pMac, tpSirMsgQ limMsg)
                     //eSIR_MAC_TDLS_TEARDOWN_PEER_UNREACHABLE
                     limSendSmeTDLSDelStaInd(pMac, pStaDs, psessionEntry,
                                        eSIR_MAC_TDLS_TEARDOWN_PEER_UNREACHABLE);
-                } else {
-#endif
-                    //TearDownLink with AP
-                    tLimMlmDeauthInd  mlmDeauthInd;
-                    PELOGW(limLog(pMac, LOGW, FL("lim Delete Station Context (staId: %d, assocId: %d) "),
-                                pMsg->staId, pMsg->assocId);)
-
-                    if ((pStaDs &&
-                          ((pStaDs->mlmStaContext.mlmState !=
-                           eLIM_MLM_LINK_ESTABLISHED_STATE) &&
-                           (pStaDs->mlmStaContext.mlmState !=
-                           eLIM_MLM_WT_ASSOC_CNF_STATE) &&
-                           (pStaDs->mlmStaContext.mlmState !=
-                           eLIM_MLM_ASSOCIATED_STATE)))) {
-                    /*
-                     * Received SIR_LIM_DELETE_STA_CONTEXT_IND for STA that does
-                     * not have context or in some transit state. Log error */
-
-                           PELOGE(limLog(pMac, LOGE,
-                                  FL("received SIR_LIM_DELETE_STA_CONTEXT_IND for STA that either has no context or in some transit state, Addr= "
-                           MAC_ADDRESS_STR), MAC_ADDR_ARRAY(pMsg->bssId));)
-                           vos_mem_free(pMsg);
-                           return;
-                    }
-
-                    pStaDs->mlmStaContext.disassocReason =
-                            eSIR_MAC_DISASSOC_DUE_TO_INACTIVITY_REASON;
-                    pStaDs->mlmStaContext.cleanupTrigger = eLIM_LINK_MONITORING_DEAUTH;
-
-                    /*
-                     * Set state to mlm State to eLIM_MLM_WT_DEL_STA_RSP_STATE
-                     * This is to address the issue of race condition between
-                     * disconnect request from the HDD and deauth from
-                     * Tx inactivity timer by FWR. This will make sure that we
-                     * will not process disassoc if deauth is in progress for
-                     * the station and thus mlmStaContext.cleanupTrigger will
-                     * not be overwritten.
-                     */
-
-                     pStaDs->mlmStaContext.mlmState =
-                                         eLIM_MLM_WT_DEL_STA_RSP_STATE;
-
-                    // Issue Deauth Indication to SME.
-                    vos_mem_copy((tANI_U8 *) &mlmDeauthInd.peerMacAddr,
-                                  pStaDs->staAddr, sizeof(tSirMacAddr));
-
-                    mlmDeauthInd.reasonCode    = (tANI_U8) pStaDs->mlmStaContext.disassocReason;
-                    mlmDeauthInd.deauthTrigger =  pStaDs->mlmStaContext.cleanupTrigger;
-
-#ifdef FEATURE_WLAN_TDLS
-                    /* Delete all TDLS peers connected before leaving BSS*/
-                    limDeleteTDLSPeers(pMac, psessionEntry);
-#endif
-                    limPostSmeMessage(pMac, LIM_MLM_DEAUTH_IND, (tANI_U32 *) &mlmDeauthInd);
-
-                    limSendSmeDeauthInd(pMac, pStaDs, psessionEntry);
-#ifdef FEATURE_WLAN_TDLS
-                 }
-#endif
+                }
              }
+#endif
              break;
 
         case HAL_DEL_STA_REASON_CODE_UNKNOWN_A2:
diff --git a/CORE/MAC/src/pe/lim/limProcessAuthFrame.c b/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
index 2610b6982134..61028eca0667 100644
--- a/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -618,8 +618,8 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
 
                 /* pStaDS != NULL and isConnected = 1 means the STA is already
                  * connected, But SAP received the Auth from that station.
-                 * For non PMF connection send Deauth frame as STA will retry
-                 * to connect back.
+                 * For non PMF connection, just delete the STA here as it will
+                 * retry to connect back after timeout.
                  *
                  * For PMF connection the AP should not tear down or otherwise
                  * modify the state of the existing association until the
@@ -637,8 +637,6 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                                 "Send the Deauth and lim Delete Station Context"
                                 "(staId: %d, assocId: %d) "),
                             pStaDs->staIndex, assocId);
-                    limSendDeauthMgmtFrame(pMac, eSIR_MAC_UNSPEC_FAILURE_REASON,
-                            (tANI_U8 *) pHdr->sa, psessionEntry, FALSE);
                     limTriggerSTAdeletion(pMac, pStaDs, psessionEntry);
                     return;
                 }
@@ -772,7 +770,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                             return;
                         }
 
-                        PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %x peer "), pAuthNode);
+                        PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %p peer"), pAuthNode);
                         limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
                         vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
@@ -898,7 +896,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                             pAuthNode->timestamp = vos_timer_get_system_ticks();
                             limAddPreAuthNode(pMac, pAuthNode);
 
-                            PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %x id %d peer "),
+                            PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %p id %d peer "),
                                           pAuthNode, pAuthNode->authNodeIdx);)
                             PELOG1(limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
@@ -1162,7 +1160,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
                         return;
                     }
 
-                    PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %x peer "), pAuthNode);)
+                    PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %p peer "), pAuthNode);)
                     PELOG1(limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
                     vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
@@ -1710,7 +1708,7 @@ limProcessAuthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession pse
 
                     return;
                 }
-                PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %x peer "), pAuthNode);
+                PELOG1(limLog(pMac, LOG1, FL("Alloc new data: %p peer "), pAuthNode);
                 limPrintMacAddr(pMac, pHdr->sa, LOG1);)
 
                 vos_mem_copy((tANI_U8 *) pAuthNode->peerMacAddr,
diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index 3437ee42e809..994dfbcd9a55 100644
--- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -1379,7 +1379,10 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
             // These messages are from HDD
             limProcessNormalHddMsg(pMac, limMsg, true);  //need to response to hdd
             break;
-
+        case eWNI_SME_SEND_DISASSOC_FRAME:
+            /* Need to response to hdd */
+            limProcessNormalHddMsg(pMac, limMsg, true);
+            break;
         case eWNI_SME_SCAN_ABORT_IND:
           {
             tSirMbMsg *pMsg = limMsg->bodyptr;
@@ -2192,6 +2195,13 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         lim_sap_offload_del_sta(pMac, limMsg);
         break;
 #endif /* SAP_AUTH_OFFLOAD */
+
+    case eWNI_SME_DEL_ALL_TDLS_PEERS:
+        lim_process_sme_del_all_tdls_peers(pMac, limMsg->bodyptr);
+        vos_mem_free((v_VOID_t*)limMsg->bodyptr);
+        limMsg->bodyptr = NULL;
+        break;
+
     default:
         vos_mem_free((v_VOID_t*)limMsg->bodyptr);
         limMsg->bodyptr = NULL;
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index 415c3c369d45..104dfb18cdda 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -891,7 +891,7 @@ limSendHalInitScanReq(tpAniSirGlobal pMac, tLimLimHalScanState nextState, tSirLi
 
     rc = wdaPostCtrlMsg(pMac, &msg);
     if (rc == eSIR_SUCCESS) {
-        PELOG3(limLog(pMac, LOG3, FL("wdaPostCtrlMsg() return eSIR_SUCCESS pMac=%x nextState=%d"),
+        PELOG3(limLog(pMac, LOG3, FL("wdaPostCtrlMsg() return eSIR_SUCCESS pMac=%p nextState=%d"),
                     pMac, pMac->lim.gLimHalScanState);)
             return;
     }
@@ -1334,7 +1334,7 @@ limRestorePreScanState(tpAniSirGlobal pMac)
     }
 
     pMac->lim.gLimSystemInScanLearnMode = 0;
-    PELOG1(limLog(pMac, LOG1, FL("Scan ended, took %d tu"), (tx_time_get() - pMac->lim.scanStartTime));)
+    PELOG1(limLog(pMac, LOG1, FL("Scan ended, took %lu tu"), (tx_time_get() - pMac->lim.scanStartTime));)
 } /*** limRestorePreScanState() ***/
 
 #ifdef FEATURE_OEM_DATA_SUPPORT
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
index 75143945a5e9..02d7533c294d 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
@@ -886,9 +886,10 @@ limProcessMlmAssocCnf(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
     if (((tLimMlmAssocCnf *) pMsgBuf)->resultCode != eSIR_SME_SUCCESS)
     {
         // Association failure
-        PELOG1(limLog(pMac, LOG1, FL("SessionId:%d Association failure"
+        PELOG1(limLog(pMac, LOG1, FL("SessionId:%u Association failure"
                       "resultCode: resultCode: %d limSmeState:%d"),
                       psessionEntry->peSessionId,
+                      ((tLimMlmAssocCnf *) pMsgBuf)->resultCode,
                       psessionEntry->limSmeState);)
 
         /* If driver gets deauth when its waiting for ADD_STA_RSP then we need
@@ -5054,10 +5055,10 @@ void limProcessRxScanEvent(tpAniSirGlobal pMac, void *buf)
 
     switch (pScanEvent->event)
     {
-        case SCAN_EVENT_STARTED:
+        case LIM_SCAN_EVENT_STARTED:
             break;
-        case SCAN_EVENT_START_FAILED:
-        case SCAN_EVENT_COMPLETED:
+        case LIM_SCAN_EVENT_START_FAILED:
+        case LIM_SCAN_EVENT_COMPLETED:
             pMac->lim.fOffloadScanPending = 0;
             pMac->lim.fOffloadScanP2PSearch = 0;
             pMac->lim.fOffloadScanP2PListen = 0;
@@ -5085,7 +5086,7 @@ void limProcessRxScanEvent(tpAniSirGlobal pMac, void *buf)
                 limSendScanOffloadComplete(pMac, pScanEvent);
             }
             break;
-        case SCAN_EVENT_FOREIGN_CHANNEL:
+        case LIM_SCAN_EVENT_FOREIGN_CHANNEL:
             if (P2P_SCAN_TYPE_LISTEN == pScanEvent->p2pScanType)
             {
                 /*Send Ready on channel indication to SME */
@@ -5106,9 +5107,9 @@ void limProcessRxScanEvent(tpAniSirGlobal pMac, void *buf)
                 limAddScanChannelInfo(pMac, vos_freq_to_chan(pScanEvent->chanFreq));
             }
             break;
-        case SCAN_EVENT_BSS_CHANNEL:
-        case SCAN_EVENT_DEQUEUED:
-        case SCAN_EVENT_PREEMPTED:
+        case LIM_SCAN_EVENT_BSS_CHANNEL:
+        case LIM_SCAN_EVENT_DEQUEUED:
+        case LIM_SCAN_EVENT_PREEMPTED:
         default:
             VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_DEBUG,
                     "Received unhandled scan event %u", pScanEvent->event);
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index 3accb74b4193..59e2e10f836f 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -131,6 +131,9 @@ static void lim_set_pdev_ht_ie(tpAniSirGlobal mac_ctx, tANI_U8 pdev_id,
 		tANI_U8 nss);
 static void lim_set_pdev_vht_ie(tpAniSirGlobal mac_ctx, tANI_U8 pdev_id,
 		tANI_U8 nss);
+static void __lim_process_send_disassoc_frame(tpAniSirGlobal mac_ctx,
+				uint32_t *msg_buf);
+
 #ifdef BACKGROUND_SCAN_ENABLED
 
 // start the background scan timers if it hasn't already started
@@ -803,7 +806,7 @@ __limHandleSmeStartBssRequest(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
             else
 #endif
                 psessionEntry->htSupportedChannelWidthSet =
-                                 (pSmeStartBssReq->cbMode)?1:0;
+                                 (pSmeStartBssReq->cbMode > 0)?1:0;
             psessionEntry->htSecondaryChannelOffset = pSmeStartBssReq->cbMode;
             psessionEntry->htRecommendedTxWidthSet =
                                  (psessionEntry->htSecondaryChannelOffset)? 1:0;
@@ -1744,6 +1747,8 @@ static void __limProcessSmeOemDataReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
     pMlmOemDataReq->data_len = pOemDataReq->data_len;
     vos_mem_copy(pMlmOemDataReq->data, pOemDataReq->data,
                  pOemDataReq->data_len);
+    /* buffer from SME copied, free it now */
+    vos_mem_free(pOemDataReq->data);
 
     //Issue LIM_MLM_OEM_DATA_REQ to MLM
     limPostMlmMessage(pMac, LIM_MLM_OEM_DATA_REQ, (tANI_U32*)pMlmOemDataReq);
@@ -2040,7 +2045,7 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
         /*Phy mode*/
         psessionEntry->gLimPhyMode = pSmeJoinReq->bssDescription.nwType;
         handleHTCapabilityandHTInfo(pMac, psessionEntry);
-        psessionEntry->htSupportedChannelWidthSet = (pSmeJoinReq->cbMode)?1:0; // This is already merged value of peer and self - done by csr in csrGetCBModeFromIes
+        psessionEntry->htSupportedChannelWidthSet = (pSmeJoinReq->cbMode > 0)?1:0; // This is already merged value of peer and self - done by csr in csrGetCBModeFromIes
         psessionEntry->htRecommendedTxWidthSet = psessionEntry->htSupportedChannelWidthSet;
         psessionEntry->htSecondaryChannelOffset = pSmeJoinReq->cbMode;
 
@@ -2289,7 +2294,7 @@ __limProcessSmeJoinReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
            pSmeJoinReq->isOSENConnection;
 
            PELOG1(limLog(pMac,LOG1,FL("SessionId:%d MLM_JOIN_REQ is posted to MLM SM"),
-                         pMlmJoinReq->sessionId));
+                         pMlmJoinReq->sessionId););
         /* Issue LIM_MLM_JOIN_REQ to MLM */
         limPostMlmMessage(pMac, LIM_MLM_JOIN_REQ, (tANI_U32 *) pMlmJoinReq);
         return;
@@ -3649,6 +3654,8 @@ void limProcessSmeGetAssocSTAsInfo(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
     tANI_U8                 assocId = 0;
     tANI_U8                 staCount = 0;
 
+    vos_mem_zero(&getAssocSTAsReq, sizeof(getAssocSTAsReq));
+
     if (!limIsSmeGetAssocSTAsReqValid(pMac, &getAssocSTAsReq, (tANI_U8 *) pMsgBuf))
     {
         limLog(pMac, LOGE,
@@ -5754,6 +5761,68 @@ static void lim_register_mgmt_frame_ind_cb(tpAniSirGlobal mac_ctx,
 }
 
 /**
+ *__lim_process_send_disassoc_frame: function processes disassoc frame
+ * @mac_ctx: pointer to mac context
+ * @msg_buf: message buffer
+ *
+ * function processes disassoc request received from SME
+ *
+ * return: none
+ */
+static void __lim_process_send_disassoc_frame(tpAniSirGlobal mac_ctx,
+					uint32_t *msg_buf)
+{
+	struct sme_send_disassoc_frm_req sme_send_disassoc_frame_req;
+	tSirRetStatus status;
+	tpPESession session_entry = NULL;
+	uint8_t sme_session_id;
+	uint16_t sme_trans_id;
+
+	if(msg_buf == NULL) {
+		limLog(mac_ctx, LOGE, FL("Buffer is Pointing to NULL"));
+		return;
+	}
+
+	limGetSessionInfo(mac_ctx, (uint8_t *)msg_buf, &sme_session_id,
+			&sme_trans_id);
+
+	status = lim_send_disassoc_frm_req_ser_des(mac_ctx,
+				&sme_send_disassoc_frame_req,
+				(uint8_t *)msg_buf);
+
+	if((eSIR_FAILURE == status) ||
+		(limIsGroupAddr(sme_send_disassoc_frame_req.peer_mac) &&
+		!limIsAddrBC(sme_send_disassoc_frame_req.peer_mac))) {
+		PELOGE(limLog(mac_ctx, LOGE,
+			FL("received invalid SME_DISASSOC_REQ message"));)
+		return;
+	}
+
+	if((session_entry = pe_find_session_by_sme_session_id(
+				mac_ctx, sme_session_id)) == NULL) {
+		limLog(mac_ctx, LOGE,
+			FL("session does not exist for given bssId "MAC_ADDRESS_STR),
+			MAC_ADDR_ARRAY(sme_send_disassoc_frame_req.peer_mac));
+		return;
+	}
+
+	limLog(mac_ctx, LOG1,
+		FL("msg_type->%d len->%d sess_id->%d trans_id->%d mac->"MAC_ADDRESS_STR" reason->%d wait_for_ack->%d"),
+		sme_send_disassoc_frame_req.msg_type,
+		sme_send_disassoc_frame_req.length,
+		sme_send_disassoc_frame_req.session_id,
+		sme_send_disassoc_frame_req.trans_id,
+		MAC_ADDR_ARRAY(sme_send_disassoc_frame_req.peer_mac),
+		sme_send_disassoc_frame_req.reason,
+		sme_send_disassoc_frame_req.wait_for_ack);
+
+	limSendDisassocMgmtFrame(mac_ctx,
+		sme_send_disassoc_frame_req.reason,
+		sme_send_disassoc_frame_req.peer_mac,
+		session_entry, sme_send_disassoc_frame_req.wait_for_ack);
+}
+
+/**
  * limProcessSmeReqMessages()
  *
  *FUNCTION:
@@ -5904,6 +5973,10 @@ limProcessSmeReqMessages(tpAniSirGlobal pMac, tpSirMsgQ pMsg)
             __limProcessSmeDeauthReq(pMac, pMsgBuf);
             break;
 
+        case eWNI_SME_SEND_DISASSOC_FRAME:
+            __lim_process_send_disassoc_frame(pMac, pMsgBuf);
+            break;
+
         case eWNI_SME_SETCONTEXT_REQ:
             __limProcessSmeSetContextReq(pMac, pMsgBuf);
             break;
@@ -6439,8 +6512,11 @@ static tANI_BOOLEAN
 limUpdateIBssPropAddIEs(tpAniSirGlobal pMac, tANI_U8 **pDstData_buff,
                         tANI_U16 *pDstDataLen, tSirModifyIE *pModifyIE)
 {
-    int32_t  oui_length;
-    uint8_t  *ibss_ie = NULL;
+    int32_t oui_length;
+    uint8_t *ibss_ie = NULL;
+    uint8_t *vendor_ie;
+    #define MAC_VENDOR_OUI  "\x00\x16\x32"
+    #define MAC_VENDOR_SIZE 3
 
     ibss_ie = pModifyIE->pIEBuffer;
     oui_length = pModifyIE->oui_length;
@@ -6451,13 +6527,34 @@ limUpdateIBssPropAddIEs(tpAniSirGlobal pMac, tANI_U8 **pDstData_buff,
                   oui_length, ibss_ie);
         return FALSE;
     }
+    /*
+     * Why replace only beacon OUI data here:
+     * 1. other ie (such as wpa) shall not be overwritten here.
+     * 2. per spec, beacon oui ie might be set twice and original one
+     * shall be updated.
+     */
+    vendor_ie = cfg_get_vendor_ie_ptr_from_oui(pMac, MAC_VENDOR_OUI,
+                 MAC_VENDOR_SIZE, *pDstData_buff, *pDstDataLen);
 
-    limUpdateAddIEBuffer(pMac,
-                pDstData_buff,
-                pDstDataLen,
-                pModifyIE->pIEBuffer,
-                pModifyIE->ieBufferlength);
+    if (vendor_ie) {
+        VOS_ASSERT((vendor_ie[1] + 2) == pModifyIE->ieBufferlength);
+        vos_mem_copy(vendor_ie, pModifyIE->pIEBuffer,
+                     pModifyIE->ieBufferlength);
+    } else {
+        uint16_t new_length = pModifyIE->ieBufferlength + *pDstDataLen;
+        uint8_t *new_ptr = vos_mem_malloc(new_length);
 
+        if (NULL == new_ptr) {
+            limLog(pMac, LOGE, FL("Memory allocation failed."));
+            return FALSE;
+        }
+        vos_mem_copy(new_ptr, *pDstData_buff, *pDstDataLen);
+        vos_mem_copy(&new_ptr[*pDstDataLen], pModifyIE->pIEBuffer,
+                     pModifyIE->ieBufferlength);
+        vos_mem_free(*pDstData_buff);
+        *pDstDataLen = new_length;
+        *pDstData_buff = new_ptr;
+    }
     return TRUE;
 }
 
diff --git a/CORE/MAC/src/pe/lim/limProcessTdls.c b/CORE/MAC/src/pe/lim/limProcessTdls.c
index 7d73b9a4b1c6..723ee6c50dea 100644
--- a/CORE/MAC/src/pe/lim/limProcessTdls.c
+++ b/CORE/MAC/src/pe/lim/limProcessTdls.c
@@ -2642,19 +2642,22 @@ void PopulateDot11fTdlsOffchannelParams(tpAniSirGlobal pMac,
 
     /* validating the channel list for DFS and 2G channels */
     for (i = 0U; i < numChans; i++) {
-        if (band == eCSR_BAND_24) {
-            if (NV_CHANNEL_DFS == vos_nv_getChannelEnabledState(validChan[i])) {
+        if ((band == eCSR_BAND_5G) && (NSS_2x2_MODE == nss_5g) &&
+            (NSS_1x1_MODE == nss_2g) &&
+            (true == vos_nv_skip_dsrc_dfs_2g(validChan[i],
+             NV_CHANNEL_SKIP_2G))) {
                 limLog(pMac, LOG1,
-                       FL("skipping DFS channel %d from the valid channel list"),
+                       FL("skipping channel %d, nss_5g: %d, nss_2g: %d"),
+                       validChan[i], nss_5g, nss_2g);
+                continue;
+        } else {
+            if (true == vos_nv_skip_dsrc_dfs_2g(validChan[i],
+                NV_CHANNEL_SKIP_DSRC)) {
+                limLog(pMac, LOG1,
+                       FL("skipping channel %d from the valid channel list"),
                        validChan[i]);
                 continue;
             }
-        } else if ((NSS_2x2_MODE == nss_5g) && (NSS_1x1_MODE == nss_2g) &&
-                   (true == vos_nv_skip_dfs_and_2g(validChan[i]))){
-            limLog(pMac, LOG1,
-                   FL("skipping channel %d, nss_5g: %d, nss_2g: %d"),
-                   validChan[i], nss_5g, nss_2g);
-            continue;
         }
 
         if (valid_count >=
@@ -3289,46 +3292,108 @@ lim_tdls_link_establish_error:
     return eSIR_SUCCESS;
 }
 
+/**
+ * lim_check_aid_and_delete_peer - Funtion to check aid and delete peer
+ * @p_mac: pointer to mac context
+ * @session_entry: pointer to PE session
+ *
+ * Function verifies aid and delete's peer with that aid from hash table
+ *
+ * return: none
+ */
+static void lim_check_aid_and_delete_peer(tpAniSirGlobal p_mac,
+			tpPESession session_entry)
+{
+	tpDphHashNode sta_ds = NULL ;
+	int i, aid;
+
+	/*
+	 * Check all the set bit in peerAIDBitmap and delete the
+	 * peer (with that aid) entry from the hash table and add
+	 * the aid in free pool
+	 */
+	for (i = 0; i < sizeof(session_entry->peerAIDBitmap)/sizeof(uint32_t);
+				i++) {
+		for (aid = 0; aid < (sizeof(uint32_t) << 3); aid++) {
+			if (!CHECK_BIT(session_entry->peerAIDBitmap[i], aid))
+				continue;
+
+			sta_ds = dphGetHashEntry(p_mac,
+				    (aid + i*(sizeof(uint32_t) << 3)),
+				    &session_entry->dph.dphHashTable);
+
+			if (NULL == sta_ds)
+				goto skip;
+
+			limLog(p_mac, LOG1,
+			    FL("Deleting "MAC_ADDRESS_STR),
+			    MAC_ADDR_ARRAY(sta_ds->staAddr));
+			limSendDeauthMgmtFrame(p_mac,
+			    eSIR_MAC_DEAUTH_LEAVING_BSS_REASON,
+			    sta_ds->staAddr, session_entry,
+			    FALSE);
+			limTdlsDelSta(p_mac, sta_ds->staAddr,
+				session_entry);
+			dphDeleteHashEntry(p_mac,
+			    sta_ds->staAddr,
+			    sta_ds->assocId,
+			    &session_entry->dph.dphHashTable);
+skip:
+			limReleasePeerIdx(p_mac,
+				(aid + i*(sizeof(uint32_t) << 3)),
+				session_entry);
+			CLEAR_BIT(session_entry->peerAIDBitmap[i], aid);
+		}
+	}
+}
 
 /* Delete all the TDLS peer connected before leaving the BSS */
 tSirRetStatus limDeleteTDLSPeers(tpAniSirGlobal pMac, tpPESession psessionEntry)
 {
-    tpDphHashNode pStaDs = NULL ;
-    int i, aid;
-
     if (NULL == psessionEntry)
     {
         limLog(pMac, LOGE, FL("NULL psessionEntry"));
         return eSIR_FAILURE;
     }
 
-    /* Check all the set bit in peerAIDBitmap and delete the peer (with that aid) entry
-       from the hash table and add the aid in free pool */
-    for (i = 0; i < sizeof(psessionEntry->peerAIDBitmap)/sizeof(tANI_U32); i++)
-    {
-        for (aid = 0; aid < (sizeof(tANI_U32) << 3); aid++)
-        {
-            if (CHECK_BIT(psessionEntry->peerAIDBitmap[i], aid))
-            {
-                pStaDs = dphGetHashEntry(pMac, (aid + i*(sizeof(tANI_U32) << 3)), &psessionEntry->dph.dphHashTable);
-
-                if (NULL != pStaDs)
-                {
-                    limLog(pMac, LOGE, FL("Deleting "MAC_ADDRESS_STR),
-                                       MAC_ADDR_ARRAY(pStaDs->staAddr));
+    lim_check_aid_and_delete_peer(pMac, psessionEntry);
 
-                    limSendDeauthMgmtFrame(pMac, eSIR_MAC_DEAUTH_LEAVING_BSS_REASON,
-                                           pStaDs->staAddr, psessionEntry, FALSE);
-                    dphDeleteHashEntry(pMac, pStaDs->staAddr, pStaDs->assocId, &psessionEntry->dph.dphHashTable);
-                }
-                limReleasePeerIdx(pMac, (aid + i*(sizeof(tANI_U32) << 3)), psessionEntry) ;
-                CLEAR_BIT(psessionEntry->peerAIDBitmap[i], aid);
-            }
-        }
-    }
     limSendSmeTDLSDeleteAllPeerInd(pMac, psessionEntry);
 
     return eSIR_SUCCESS;
 }
 
+/**
+ * lim_process_sme_del_all_tdls_peers: process delete tdls peers
+ * @p_mac: pointer to mac context
+ * @msg_buf: message buffer
+ *
+ * Function processes request to delete tdls peers
+ *
+ * Return: Sucess: eSIR_SUCCESS Failure: Error value
+ */
+tSirRetStatus lim_process_sme_del_all_tdls_peers(tpAniSirGlobal p_mac,
+				uint32_t *msg_buf)
+{
+	struct sir_del_all_tdls_peers *msg;
+	tpPESession session_entry;
+	uint8_t session_id;
+
+	msg = (struct sir_del_all_tdls_peers *)msg_buf;
+	if (msg == NULL) {
+		limLog(p_mac, LOGE, FL("NULL msg"));
+		return eSIR_FAILURE;
+	}
+
+	session_entry = peFindSessionByBssid(p_mac, msg->bssid, &session_id);
+	if (NULL == session_entry) {
+		limLog(p_mac, LOGE, FL("NULL psessionEntry"));
+		return eSIR_FAILURE;
+	}
+
+	lim_check_aid_and_delete_peer(p_mac, session_entry);
+
+	return eSIR_SUCCESS;
+}
+
 #endif
diff --git a/CORE/MAC/src/pe/lim/limPropExtsUtils.c b/CORE/MAC/src/pe/lim/limPropExtsUtils.c
index 4fa31061d6c0..047eb5b8cbf9 100644
--- a/CORE/MAC/src/pe/lim/limPropExtsUtils.c
+++ b/CORE/MAC/src/pe/lim/limPropExtsUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -225,6 +225,9 @@ limExtractApCapability(tpAniSirGlobal pMac, tANI_U8 *pIE, tANI_U16 ieLen,
         if (pBeaconStruct->countryInfoPresent)
            psessionEntry->countryInfoPresent = TRUE;
     }
+    /* Check if Extended caps are present in probe resp or not */
+    if (pBeaconStruct->ExtCap.present)
+        psessionEntry->is_ext_caps_present = true;
     vos_mem_free(pBeaconStruct);
     return;
 } /****** end limExtractApCapability() ******/
diff --git a/CORE/MAC/src/pe/lim/limSecurityUtils.c b/CORE/MAC/src/pe/lim/limSecurityUtils.c
index ffbe5b1730d2..0241dc010adc 100644
--- a/CORE/MAC/src/pe/lim/limSecurityUtils.c
+++ b/CORE/MAC/src/pe/lim/limSecurityUtils.c
@@ -416,7 +416,7 @@ limDeletePreAuthNode(tpAniSirGlobal pMac, tSirMacAddr macAddr)
 
 
         PELOG1(limLog(pMac, LOG1, FL("=====> limDeletePreAuthNode : first node to delete"));)
-        PELOG1(limLog(pMac, LOG1, FL("Release data entry: %x id %d peer "),
+        PELOG1(limLog(pMac, LOG1, FL("Release data entry: %p id %d peer "),
                         pTempNode, pTempNode->authNodeIdx);
         limPrintMacAddr(pMac, macAddr, LOG1);)
         limReleasePreAuthNode(pMac, pTempNode);
@@ -437,7 +437,7 @@ limDeletePreAuthNode(tpAniSirGlobal pMac, tSirMacAddr macAddr)
             pPrevNode->next = pTempNode->next;
 
             PELOG1(limLog(pMac, LOG1, FL("=====> limDeletePreAuthNode : subsequent node to delete"));
-            limLog(pMac, LOG1, FL("Release data entry: %x id %d peer "),
+            limLog(pMac, LOG1, FL("Release data entry: %p id %d peer "),
                          pTempNode, pTempNode->authNodeIdx);
             limPrintMacAddr(pMac, macAddr, LOG1);)
             limReleasePreAuthNode(pMac, pTempNode);
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index 0050c7963139..7121bbdc4c29 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -240,7 +240,7 @@ limSendProbeReqMgmtFrame(tpAniSirGlobal pMac,
 {
     tDot11fProbeRequest pr;
     tANI_U32            nStatus, nBytes, nPayload;
-    tSirRetStatus       nSirStatus, extcap_status;
+    tSirRetStatus       nSirStatus;
     tANI_U8            *pFrame;
     void               *pPacket;
     eHalStatus          halstatus;
@@ -251,6 +251,8 @@ limSendProbeReqMgmtFrame(tpAniSirGlobal pMac,
     tANI_U8             smeSessionId = 0;
     bool                isVHTEnabled = false;
     uint16_t addn_ielen = nAdditionalIELen;
+    bool                extracted_ext_cap_flag = true;
+    tDot11fIEExtCap     extracted_ext_cap;
 
 
 
@@ -395,14 +397,25 @@ limSendProbeReqMgmtFrame(tpAniSirGlobal pMac,
                                "0x%08x)."), nStatus );
     }
 
-    /* Strip extended capability IE (if present). FW will add that IE */
     if (addn_ielen) {
-        extcap_status = lim_strip_extcap_ie(pMac, pAdditionalIE, &addn_ielen,
-                                            NULL);
-        if (eSIR_SUCCESS != extcap_status)
-            limLog(pMac, LOGE,
-                   FL("Error:(%d) stripping extcap IE"), extcap_status);
 
+        vos_mem_set((tANI_U8 *)&extracted_ext_cap,
+                     sizeof(tDot11fIEExtCap), 0);
+        nSirStatus = lim_strip_extcap_update_struct(pMac, pAdditionalIE,
+                                      &addn_ielen,
+                                      &extracted_ext_cap);
+        if (eSIR_SUCCESS != nSirStatus) {
+            extracted_ext_cap_flag = eANI_BOOLEAN_FALSE;
+            limLog(pMac, LOG1,
+                 FL("Unable to Stripoff ExtCap IE from Probe Req"));
+        } else {
+            struct s_ext_cap *p_ext_cap = (struct s_ext_cap *)
+                                          extracted_ext_cap.bytes;
+            if (p_ext_cap->interworkingService)
+                p_ext_cap->qosMap = 1;
+
+            extracted_ext_cap_flag = lim_is_ext_cap_ie_present(p_ext_cap);
+        }
     }
 
     nBytes = nPayload + sizeof( tSirMacMgmtHdr ) + addn_ielen;
@@ -434,6 +447,10 @@ limSendProbeReqMgmtFrame(tpAniSirGlobal pMac,
         return nSirStatus;      // allocated!
     }
 
+    /* merge the ExtCap struct*/
+    if (extracted_ext_cap_flag)
+        lim_merge_extcap_struct(&pr.ExtCap, &extracted_ext_cap);
+
     // That done, pack the Probe Request:
     nStatus = dot11fPackProbeRequest( pMac, &pr, pFrame +
                                       sizeof( tSirMacMgmtHdr ),
@@ -2049,11 +2066,11 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
 
     vos_mem_set( ( tANI_U8* )pFrm, sizeof( tDot11fAssocRequest ), 0 );
 
-    if (nAddIELen) {
+    if (nAddIELen && psessionEntry->is_ext_caps_present) {
         vos_mem_set(( tANI_U8* )&extractedExtCap, sizeof( tDot11fIEExtCap ), 0);
         nSirStatus = lim_strip_extcap_update_struct(pMac, pAddIE,
-                                      &nAddIELen,
-                                      &extractedExtCap );
+                      &nAddIELen,
+                      &extractedExtCap );
         if(eSIR_SUCCESS != nSirStatus )
         {
             extractedExtCapFlag = eANI_BOOLEAN_FALSE;
@@ -2064,23 +2081,13 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
         {
             struct s_ext_cap *p_ext_cap = (struct s_ext_cap *)
                                           extractedExtCap.bytes;
-            if (p_ext_cap->interworkingService ||
-                            p_ext_cap->bssTransition)
+            if (p_ext_cap->interworkingService)
                 p_ext_cap->qosMap = 1;
-            else {
-                /* No need to merge the EXT Cap from Supplicant
-                 * if interworkingService or bsstransition is not set,
-                 * as currently driver is only interested in
-                 * interworkingService and bsstransition capability from
-                 * supplicant.
-                 * if in future any other EXT Cap info is required from
-                 * supplicant it needs to be handled here.
-                 */
-                 extractedExtCapFlag = eANI_BOOLEAN_FALSE;
-            }
+            extractedExtCapFlag = lim_is_ext_cap_ie_present(p_ext_cap);
         }
     } else {
-        limLog(pMac, LOG1, FL("No additional IE for Assoc Request"));
+        limLog(pMac, LOG1,
+                FL("No addn IE or peer dosen't support addnIE for Assoc Req"));
         extractedExtCapFlag = eANI_BOOLEAN_FALSE;
     }
 
@@ -2221,8 +2228,8 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal   pMac,
         isVHTEnabled = eANI_BOOLEAN_TRUE;
     }
 #endif
-
-    PopulateDot11fExtCap( pMac, isVHTEnabled, &pFrm->ExtCap, psessionEntry);
+    if (psessionEntry->is_ext_caps_present)
+        PopulateDot11fExtCap( pMac, isVHTEnabled, &pFrm->ExtCap, psessionEntry);
 
 #if defined WLAN_FEATURE_VOWIFI_11R
     if (psessionEntry->pLimJoinReq->is11Rconnection)
@@ -2692,8 +2699,9 @@ limSendReassocReqWithFTIEsMgmtFrame(tpAniSirGlobal     pMac,
         limLog( pMac, LOG1, FL("Populate VHT IEs in Re-Assoc Request"));
         PopulateDot11fVHTCaps( pMac, psessionEntry, &frm.VHTCaps );
         isVHTEnabled = eANI_BOOLEAN_TRUE;
-        PopulateDot11fExtCap(pMac, isVHTEnabled, &frm.ExtCap, psessionEntry);
     }
+    if (psessionEntry->is_ext_caps_present)
+        PopulateDot11fExtCap(pMac, isVHTEnabled, &frm.ExtCap, psessionEntry);
 #endif
 
     nStatus = dot11fGetPackedReAssocRequestSize( pMac, &frm, &nPayload );
@@ -3124,7 +3132,8 @@ limSendReassocReqMgmtFrame(tpAniSirGlobal     pMac,
     }
 #endif
 
-    PopulateDot11fExtCap(pMac, isVHTEnabled, &frm.ExtCap, psessionEntry);
+    if (psessionEntry->is_ext_caps_present)
+        PopulateDot11fExtCap(pMac, isVHTEnabled, &frm.ExtCap, psessionEntry);
 
     nStatus = dot11fGetPackedReAssocRequestSize( pMac, &frm, &nPayload );
     if ( DOT11F_FAILED( nStatus ) )
diff --git a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
index c45d237e63b5..4c5f3dc86071 100644
--- a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
@@ -1289,8 +1289,8 @@ limSendSmeLfrScanRsp(tpAniSirGlobal pMac, tANI_U16 length,
                  &pMac->roam.roamSession[smesessionId].connectedProfile.SSID);
     PELOG2(limLog(pMac,
                   LOG2,
-                  FL("Scan Entries Left after cleanup: %d",
-                     scanEntriesLeft)));
+                  FL("Scan Entries Left after cleanup: %d"),
+                     scanEntriesLeft);)
 
     return;
 
@@ -2959,7 +2959,7 @@ void limHandleCSAoffloadMsg(tpAniSirGlobal pMac,tpSirMsgQ MsgQ)
                                                  psessionEntry,
                                                  csa_params->channel,
                                                  csa_params->new_ch_width);
-          if (psessionEntry->gLimChannelSwitch.secondarySubBand) {
+          if (psessionEntry->gLimChannelSwitch.secondarySubBand > 0) {
               psessionEntry->gLimChannelSwitch.state =
                                      eLIM_CHANNEL_SWITCH_PRIMARY_AND_SECONDARY;
           }
@@ -3136,7 +3136,10 @@ void limSendSmeMaxAssocExceededNtf(tpAniSirGlobal pMac, tSirMacAddr peerMacAddr,
     mmhMsg.type = pSmeMaxAssocInd->mesgType;
     mmhMsg.bodyptr = pSmeMaxAssocInd;
     PELOG1(limLog(pMac, LOG1, FL("msgType %s peerMacAddr "MAC_ADDRESS_STR
-                  " sme session id %d"), "eWNI_SME_MAX_ASSOC_EXCEEDED", MAC_ADDR_ARRAY(peerMacAddr));)
+                  " sme session id %d"),
+                  "eWNI_SME_MAX_ASSOC_EXCEEDED",
+                  MAC_ADDR_ARRAY(peerMacAddr),
+                  smesessionId);)
     MTRACE(macTrace(pMac, TRACE_CODE_TX_SME_MSG, smesessionId, mmhMsg.type));
     limSysProcessMmhMsgApi(pMac, &mmhMsg, ePROT);
 
diff --git a/CORE/MAC/src/pe/lim/limSerDesUtils.c b/CORE/MAC/src/pe/lim/limSerDesUtils.c
index 34fce5ad8139..355798d6ef93 100644
--- a/CORE/MAC/src/pe/lim/limSerDesUtils.c
+++ b/CORE/MAC/src/pe/lim/limSerDesUtils.c
@@ -2771,3 +2771,81 @@ limUpdateAPWPARSNIEsReqSerDes(tpAniSirGlobal pMac, tpSirUpdateAPWPARSNIEsReq pUp
 
     return eSIR_SUCCESS;
 } /*** end limUpdateAPWPARSNIEsReqSerDes() ***/
+
+/**
+ * lim_send_disassoc_frm_req_ser_des - called on receiving SME_DISASSOC_REQ
+ * @mac_ctx: pointer to mac context
+ * @disassoc_frm_req: pointer to structure sme_send_disassoc_frm_req
+ *
+ * function send's disassoc frame request on receiving SME_DISASSOC_REQ
+ *
+ * return: eSIR_SUCCESS:Success Error value: Failure
+ */
+tSirRetStatus lim_send_disassoc_frm_req_ser_des(tpAniSirGlobal mac_ctx,
+			struct sme_send_disassoc_frm_req *disassoc_frm_req,
+			uint8_t *buf)
+{
+	tANI_S16 len = 0;
+#ifdef PE_DEBUG_LOG1
+	uint8_t *temp = buf;
+#endif
+
+	if (!disassoc_frm_req || !buf)
+		return eSIR_FAILURE;
+
+	disassoc_frm_req->msg_type = limGetU16(buf);
+	buf += sizeof(tANI_U16);
+
+	len = disassoc_frm_req->length = limGetU16(buf);
+	buf += sizeof(tANI_U16);
+
+	PELOG1(limLog(mac_ctx, LOG1,
+		FL("SME_DISASSOC_REQ length %d bytes is:"), len);)
+	PELOG1(sirDumpBuf(mac_ctx, SIR_LIM_MODULE_ID, LOG1, temp, len);)
+
+	if (len < (tANI_S16) sizeof(tANI_U32))
+		return eSIR_FAILURE;
+
+	/* skip message header */
+	len -= sizeof(tANI_U32);
+	if (limCheckRemainingLength(mac_ctx, len) == eSIR_FAILURE)
+		return eSIR_FAILURE;
+
+	/* Extract sessionID */
+	disassoc_frm_req->session_id = *buf;
+	buf += sizeof(tANI_U8);
+	len -= sizeof(tANI_U8);
+	if (limCheckRemainingLength(mac_ctx, len) == eSIR_FAILURE)
+		return eSIR_FAILURE;
+
+	/* Extract transactionid */
+	disassoc_frm_req->trans_id = limGetU16(buf);
+	buf += sizeof(tANI_U16);
+	len -= sizeof(tANI_U16);
+
+	if (limCheckRemainingLength(mac_ctx, len) == eSIR_FAILURE)
+		return eSIR_FAILURE;
+
+	/* Extract peerMacAddr */
+	vos_mem_copy(disassoc_frm_req->peer_mac, buf, sizeof(tSirMacAddr));
+	buf += sizeof(tSirMacAddr);
+	len  -= sizeof(tSirMacAddr);
+
+	if (limCheckRemainingLength(mac_ctx, len) == eSIR_FAILURE)
+		return eSIR_FAILURE;
+
+	/* Extract reasonCode */
+	disassoc_frm_req->reason = limGetU16(buf);
+	buf += sizeof(tANI_U16);
+	len  -= sizeof(tANI_U16);
+
+	if (limCheckRemainingLength(mac_ctx, len) == eSIR_FAILURE)
+		return eSIR_FAILURE;
+
+	disassoc_frm_req->wait_for_ack = *buf;
+	buf += sizeof(tANI_U8);
+	len -= sizeof(tANI_U8);
+
+	return eSIR_SUCCESS;
+
+}
diff --git a/CORE/MAC/src/pe/lim/limSerDesUtils.h b/CORE/MAC/src/pe/lim/limSerDesUtils.h
index 62e6129fe898..ca0cb207cc0e 100644
--- a/CORE/MAC/src/pe/lim/limSerDesUtils.h
+++ b/CORE/MAC/src/pe/lim/limSerDesUtils.h
@@ -123,4 +123,8 @@ static inline tANI_U32 limGetU32(tANI_U8 *ptr)
 #endif
 }
 
+tSirRetStatus lim_send_disassoc_frm_req_ser_des(tpAniSirGlobal mac_ctx,
+                struct sme_send_disassoc_frm_req *disassoc_frm_req,
+                uint8_t *buf);
+
 #endif /* __LIM_SERDES_UTILS_H */
diff --git a/CORE/MAC/src/pe/lim/limTimerUtils.c b/CORE/MAC/src/pe/lim/limTimerUtils.c
index 4661d3785174..2968a47bdf69 100644
--- a/CORE/MAC/src/pe/lim/limTimerUtils.c
+++ b/CORE/MAC/src/pe/lim/limTimerUtils.c
@@ -40,7 +40,7 @@
 #include "limAssocUtils.h"
 #include "limSecurityUtils.h"
 #include "pmmApi.h"
-
+#include "limApi.h"
 
 // default value 5000 ms for background scan period when it is disabled
 #define LIM_BACKGROUND_SCAN_PERIOD_DEFAULT_MS    5000
@@ -828,7 +828,8 @@ limTimerHandler(void *pMacGlobal, tANI_U32 param)
     msg.bodyptr = NULL;
     msg.bodyval = 0;
 
-    if ((statusCode = limPostMsgApi(pMac, &msg)) != eSIR_SUCCESS)
+    statusCode = lim_post_msg_high_pri(pMac, &msg);
+    if (statusCode != eSIR_SUCCESS)
         limLog(pMac, LOGE,
                FL("posting message %X to LIM failed, reason=%d"),
                msg.type, statusCode);
diff --git a/CORE/MAC/src/pe/lim/limTypes.h b/CORE/MAC/src/pe/lim/limTypes.h
index ec209644b553..7db111bea32c 100644
--- a/CORE/MAC/src/pe/lim/limTypes.h
+++ b/CORE/MAC/src/pe/lim/limTypes.h
@@ -728,6 +728,15 @@ eHalStatus limProcessTdlsAddStaRsp(tpAniSirGlobal pMac, void *msg, tpPESession);
 tSirRetStatus limSendTdlsTeardownFrame(tpAniSirGlobal pMac,
            tSirMacAddr peerMac, tANI_U16 reason, tANI_U8 responder, tpPESession psessionEntry,
            tANI_U8 *addIe, tANI_U16 addIeLen);
+tSirRetStatus lim_process_sme_del_all_tdls_peers(tpAniSirGlobal p_mac,
+			uint32_t *msg_buf);
+#else
+static inline tSirRetStatus
+lim_process_sme_del_all_tdls_peers(tpAniSirGlobal p_mac,
+			uint32_t *msg_buf)
+{
+	return eSIR_SUCCESS;
+}
 #endif
 
 // Algorithms & Link Monitoring related functions
@@ -1086,4 +1095,5 @@ void limProcessRxScanEvent(tpAniSirGlobal mac, void *buf);
 
 int limProcessRemainOnChnlReq(tpAniSirGlobal pMac, tANI_U32 *pMsg);
 void limRemainOnChnRsp(tpAniSirGlobal pMac, eHalStatus status, tANI_U32 *data);
+
 #endif /* __LIM_TYPES_H */
diff --git a/CORE/MAC/src/pe/lim/limUtils.c b/CORE/MAC/src/pe/lim/limUtils.c
index d2b81084bb8b..afef892edad8 100644
--- a/CORE/MAC/src/pe/lim/limUtils.c
+++ b/CORE/MAC/src/pe/lim/limUtils.c
@@ -8370,11 +8370,6 @@ void lim_set_stads_rtt_cap(tpDphHashNode sta_ds, struct s_ext_cap *ext_cap)
 	sta_ds->timingMeasCap |= (ext_cap->fine_time_meas_responder)?
 				  RTT_FINE_TIME_MEAS_RESPONDER_CAPABILITY :
 				  RTT_INVALID;
-
-	PELOG1(limLog(pMac, LOG1,
-	       FL("ExtCap present, timingMeas: %d Initiator: %d Responder: %d"),
-	       ext_cap->timingMeas, ext_cap->fine_time_meas_initiator,
-	       ext_cap->fine_time_meas_responder);)
 }
 
 /**
@@ -8676,3 +8671,24 @@ lim_get_80Mhz_center_channel(uint8_t primary_channel)
 
 	return HAL_INVALID_CHANNEL_ID;
 }
+
+/**
+ * lim_is_ext_cap_ie_present - checks if ext ie is present
+ * @ext_cap: extended IEs structure
+ *
+ * Return: true if ext IEs are present else false
+ */
+bool lim_is_ext_cap_ie_present (struct s_ext_cap *ext_cap)
+{
+	int i, size;
+	uint8_t *tmp_buf;
+
+	tmp_buf = (uint8_t *) ext_cap;
+	size = sizeof(*ext_cap);
+
+	for (i = 0; i < size; i++)
+		if (tmp_buf[i])
+			return true;
+
+	return false;
+}
diff --git a/CORE/MAC/src/pe/lim/limUtils.h b/CORE/MAC/src/pe/lim/limUtils.h
index ada069628f25..dafcdb8d4f03 100644
--- a/CORE/MAC/src/pe/lim/limUtils.h
+++ b/CORE/MAC/src/pe/lim/limUtils.h
@@ -666,4 +666,5 @@ tSirRetStatus lim_strip_extcap_update_struct(tpAniSirGlobal mac_ctx,
 void lim_merge_extcap_struct(tDot11fIEExtCap *dst, tDot11fIEExtCap *src);
 uint8_t
 lim_get_80Mhz_center_channel(uint8_t primary_channel);
+bool lim_is_ext_cap_ie_present (struct s_ext_cap *ext_cap);
 #endif /* __LIM_UTILS_H */
diff --git a/CORE/MAC/src/pe/pmm/pmmApi.c b/CORE/MAC/src/pe/pmm/pmmApi.c
index 2a3c24983a7f..ddecbdb70c60 100644
--- a/CORE/MAC/src/pe/pmm/pmmApi.c
+++ b/CORE/MAC/src/pe/pmm/pmmApi.c
@@ -1917,12 +1917,6 @@ void pmmSendWowlAddBcastPtrn(tpAniSirGlobal pMac,  tpSirMsgQ pMsg)
     }
     vos_mem_copy(pBcastPtrn, pMbMsg->data, sizeof(*pBcastPtrn));
 
-    if (NULL == pBcastPtrn)
-    {
-        pmmLog(pMac, LOGE, FL("Add broadcast pattern message is NULL "));
-        return;
-    }
-
     msgQ.type = WDA_WOWL_ADD_BCAST_PTRN;
     msgQ.reserved = 0;
     msgQ.bodyptr = pBcastPtrn;
diff --git a/CORE/SAP/src/sapApiLinkCntl.c b/CORE/SAP/src/sapApiLinkCntl.c
index 1e1d33f50821..695614ef581e 100644
--- a/CORE/SAP/src/sapApiLinkCntl.c
+++ b/CORE/SAP/src/sapApiLinkCntl.c
@@ -942,7 +942,9 @@ WLANSAP_RoamCallback
                              "eCSR_ROAM_RESULT_AUTHENTICATED",
                               roamResult);
             /* Fill in the event structure */
-            sapSignalHDDevent( sapContext, pCsrRoamInfo,eSAP_STA_SET_KEY_EVENT, (v_PVOID_t)eSAP_STATUS_SUCCESS);
+            vosStatus = sapSignalHDDevent(sapContext,
+                                  pCsrRoamInfo,eSAP_STA_SET_KEY_EVENT,
+                                  (v_PVOID_t)eSAP_STATUS_SUCCESS);
             if(!VOS_IS_STATUS_SUCCESS(vosStatus))
             {
                 halStatus = eHAL_STATUS_FAILURE;
diff --git a/CORE/SAP/src/sapModule.c b/CORE/SAP/src/sapModule.c
index f839bf225cc4..882f3047ee8b 100644
--- a/CORE/SAP/src/sapModule.c
+++ b/CORE/SAP/src/sapModule.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -411,6 +411,12 @@ WLANSAP_Close
         Cleanup SAP control block.
     ------------------------------------------------------------------------*/
     VOS_TRACE( VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH, "WLANSAP_Close");
+#ifdef WLAN_FEATURE_MBSSID
+    sapCleanupChannelList(pCtx);
+#else
+    sapCleanupChannelList();
+#endif
+
     WLANSAP_CleanCB(pSapCtx, VOS_TRUE /* empty queues/lists/pkts if any*/);
 
 #ifdef WLAN_FEATURE_MBSSID
diff --git a/CORE/SERVICES/BMI/ol_fw.c b/CORE/SERVICES/BMI/ol_fw.c
index d2e103db6f0e..711619004e2a 100644
--- a/CORE/SERVICES/BMI/ol_fw.c
+++ b/CORE/SERVICES/BMI/ol_fw.c
@@ -519,13 +519,13 @@ static char *ol_board_id_to_filename(struct ol_softc *scn, uint16_t board_id)
 #define MAX_SUPPORTED_PEERS 32
 #endif
 
-#if defined(CONFIG_CNSS)
-const char* ol_get_fw_name(struct ol_softc *scn)
+#if defined(HIF_PCI)
+const char *ol_get_fw_name(struct ol_softc *scn)
 {
 	return scn->fw_files.image_file;
 }
 #elif defined(HIF_SDIO)
-const char* ol_get_fw_name(struct ol_softc *scn)
+const char *ol_get_fw_name(struct ol_softc *scn)
 {
 	const char *filename = NULL;
 
@@ -542,7 +542,7 @@ const char* ol_get_fw_name(struct ol_softc *scn)
 	return filename;
 }
 #else
-const char* ol_get_fw_name(struct ol_softc *scn)
+const char *ol_get_fw_name(struct ol_softc *scn)
 {
 	return QCA_FIRMWARE_FILE;
 }
diff --git a/CORE/SERVICES/COMMON/adf/adf_nbuf.c b/CORE/SERVICES/COMMON/adf/adf_nbuf.c
index b40a6b1a3ba5..030dc39b59ea 100644
--- a/CORE/SERVICES/COMMON/adf/adf_nbuf.c
+++ b/CORE/SERVICES/COMMON/adf/adf_nbuf.c
@@ -41,7 +41,7 @@
 
 adf_nbuf_trace_update_t  trace_update_cb = NULL;
 
-#if defined(CONFIG_WCNSS_MEM_PRE_ALLOC) && defined(WITH_BACKPORTS)
+#if defined(CONFIG_WCNSS_MEM_PRE_ALLOC) && defined(FEATURE_SKB_PRE_ALLOC)
 struct sk_buff *__adf_nbuf_pre_alloc(adf_os_device_t osdev, size_t size)
 {
 	struct sk_buff *skb = NULL;
@@ -90,12 +90,12 @@ __adf_nbuf_alloc(adf_os_device_t osdev, size_t size, int reserve, int align, int
     if(align)
         size += (align - 1);
 
-    skb = __adf_nbuf_pre_alloc(osdev, size);
+    skb = dev_alloc_skb(size);
 
     if (skb)
        goto skb_cb;
 
-    skb = dev_alloc_skb(size);
+    skb = __adf_nbuf_pre_alloc(osdev, size);
 
     if (!skb) {
         printk("ERROR:NBUF alloc failed\n");
diff --git a/CORE/SERVICES/COMMON/dbglog_id.h b/CORE/SERVICES/COMMON/dbglog_id.h
index 63384d7f2404..25da263c18fb 100644
--- a/CORE/SERVICES/COMMON/dbglog_id.h
+++ b/CORE/SERVICES/COMMON/dbglog_id.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -581,7 +581,43 @@ extern "C" {
 #define SCAN_FWLOG_EVENT_RESTARTED                  10
 #define SCAN_FWLOG_EVENT_COMPLETED                  11
 #define SCAN_SM_REQ_NEXT_CH                         12
-#define SCAN_DBGID_DEFINITION_END                   13
+#define SCAN_ENG_START                              13
+#define SCAN_ENG_CANCEL                             14
+#define SCAN_ENG_SPOOFED_MAC_ADDR                   15
+#define SCAN_ENG_PARAM_1                            16
+#define SCAN_ENG_PARAM_2                            17
+#define SCAN_ENG_MAX_SCAN_TIMEOUT                   18
+#define SCAN_ENG_START_IN_PROGRESS                  19
+#define SCAN_SM_START_COMMAND_FAILED                20
+#define SCAN_SCH_START                              21
+#define SCAN_SCH_START_INFO                         22
+#define SCAN_SCH_START_NEW_REQ_FAILED               23
+#define SCAN_SCH_START_ALLOC_FAIL                   24
+#define SCAN_SCH_ENGINE_STOP_DUE_TO_TIMEOUT         25
+#define SCAN_SCH_POLICY_EVENT                       26
+#define SCAN_SCH_CANCEL                             27
+#define SCAN_SCH_STOP_COMMAND_FAILED                28
+#define SCAN_SCH_NEXT_SCAN_FAILED                   29
+#define SCAN_WMI_SET_CHAN_LIST                      30
+#define SCAN_EVENT_STARTED                          31
+#define SCAN_EVENT_BSS_CHANNEL                      32
+#define SCAN_EVENT_FOREIGN_CHANNEL                  33
+#define SCAN_EVENT_DEQUEUED                         34
+#define SCAN_EVENT_START_FAILED                     35
+#define SCAN_EVENT_FOREIGN_CHANNEL_EXIT             36
+#define SCAN_SM_DISPATCH                            37
+#define SCAN_SM_TRANSITIONS                         38
+#define SCAN_SM_REQ_NEXT_CHAN                       39
+#define SCAN_SEND_PROBE_REQ_RET_VDEV                40
+#define SCAN_SEND_PROBE_REQ_RET_PLM                 41
+#define SCAN_SEND_PROBE_REQ_RET_PASSIVE             42
+#define SCAN_SEND_PROBE_REQ_RET_RADAR               43
+#define SCAN_SEND_PROBE_REQ_RET_DFS                 44
+#define SCAN_SEND_PROBE_REQ_INFO                    45
+#define SCAN_SM_CANCEL                              46
+#define SCAN_SM_PROBE_REQ_FRAME_SEND_FAILED         47
+#define SCAN_SCH_BANNED_MODULE                      48
+#define SCAN_DBGID_DEFINITION_END                   49
 
 #define BEACON_EVENT_SWBA_SEND_FAILED               0
 #define BEACON_EVENT_EARLY_RX_BMISS_STATUS          1
@@ -1213,7 +1249,10 @@ extern "C" {
 #define WLAN_STATS_DBGID_EST_LINKSPEED_CHAN_TIME_END     3
 #define WLAN_STATS_DBGID_EST_LINKSPEED_CALC              4
 #define WLAN_STATS_DBGID_EST_LINKSPEED_UPDATE_HOME_CHAN  5
-#define WLAN_STATS_DBGID_DEFINITION_END                  6
+#define WLAN_STATS_DBGID_RSSI                            6
+#define WLAN_STATS_DBGID_CNE_RSSI                        7
+#define WLAN_STATS_DBGID_DEFINITION_END                  8
+
 /* NAN DBGIDs */
 #define NAN_DBGID_START                             0
 
@@ -1534,6 +1573,7 @@ extern "C" {
 #define EXTSCAN_NOTIFY_HOTLIST_MATCH                    38
 #define EXTSCAN_CONFIG_HOTLIST_TABLE                    39
 #define EXTSCAN_CONFIG_WLAN_CHANGE_TABLE                40
+#define EXTSCAN_EVENT_SEND_FAILED                       41
 
 /* NLO DBGIDs */
 #define NLO_DBGID_SSID_TO_BE_SCANNED_LIST 0
diff --git a/CORE/SERVICES/COMMON/ol_cfg.h b/CORE/SERVICES/COMMON/ol_cfg.h
index af5448db9c32..547cf359dfbe 100644
--- a/CORE/SERVICES/COMMON/ol_cfg.h
+++ b/CORE/SERVICES/COMMON/ol_cfg.h
@@ -83,6 +83,8 @@ struct txrx_pdev_cfg_t {
 #ifdef IPA_UC_OFFLOAD
 	struct wlan_ipa_uc_rsc_t ipa_uc_rsc;
 #endif /* IPA_UC_OFFLOAD */
+	uint16_t pkt_bundle_timer_value;
+	uint16_t pkt_bundle_size;
 };
 
 /**
@@ -497,4 +499,24 @@ unsigned int ol_cfg_ipa_uc_rx_ind_ring_size(ol_pdev_handle pdev);
  */
 unsigned int ol_cfg_ipa_uc_tx_partition_base(ol_pdev_handle pdev);
 #endif /* IPA_UC_OFFLOAD */
+
+#define DEFAULT_BUNDLE_TIMER_VALUE 100
+
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+int ol_cfg_get_bundle_timer_value(ol_pdev_handle pdev);
+int ol_cfg_get_bundle_size(ol_pdev_handle pdev);
+#else
+static inline
+int ol_cfg_get_bundle_timer_value(ol_pdev_handle pdev)
+{
+	return DEFAULT_BUNDLE_TIMER_VALUE;
+}
+
+static inline
+int ol_cfg_get_bundle_size(ol_pdev_handle pdev)
+{
+	return 0;
+}
+#endif
+
 #endif /* _OL_CFG__H_ */
diff --git a/CORE/SERVICES/COMMON/ol_txrx_api.h b/CORE/SERVICES/COMMON/ol_txrx_api.h
index 59434116c97c..70d15d681b73 100644
--- a/CORE/SERVICES/COMMON/ol_txrx_api.h
+++ b/CORE/SERVICES/COMMON/ol_txrx_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -67,6 +67,15 @@ enum ol_addba_status {
     ol_addba_busy,
 };
 
+enum pn_replay_type {
+    OL_RX_TKIP_REPLAYS,
+    OL_RX_CCMP_REPLAYS,
+    OL_RX_OTHER_REPLAYS,
+
+    /* total replays */
+    OL_RX_NUM_PN_REPLAY_TYPES
+};
+
 enum ol_sec_type {
     ol_sec_type_none,
     ol_sec_type_wep128,
@@ -110,4 +119,14 @@ enum ol_tx_spec {
      ol_tx_spec_no_free     = 0x20, /* give to cb rather than free */
 };
 
+typedef void (*tp_ol_packetdump_cb)(adf_nbuf_t netbuf,
+				uint8_t status, uint8_t vdev_id, uint8_t type);
+void ol_register_packetdump_callback(tp_ol_packetdump_cb ol_packetdump_cb);
+void ol_deregister_packetdump_callback(void);
+
+typedef void (*tp_htt_packetdump_cb)(adf_nbuf_t netbuf,
+			uint8_t status, uint8_t vdev_id, uint8_t type);
+
+void htt_register_packetdump_callback(tp_htt_packetdump_cb htt_packetdump_cb);
+void htt_deregister_packetdump_callback(void);
 #endif /* _OL_TXRX_API__H_ */
diff --git a/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h b/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
index 77f4f7e0dc86..1796b8b94595 100644
--- a/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
+++ b/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
@@ -927,6 +927,8 @@ struct txrx_pdev_cfg_param_t {
     u_int32_t uc_rx_indication_ring_count;
     /* IPA Micro controller data path offload TX partition base */
     u_int32_t uc_tx_partition_base;
+    uint16_t pkt_bundle_timer_value;
+    uint16_t pkt_bundle_size;
 };
 
 /**
@@ -1376,7 +1378,24 @@ void ol_txrx_set_ocb_peer(struct ol_txrx_pdev_t *pdev, struct ol_txrx_peer_t *pe
  */
 a_bool_t ol_txrx_get_ocb_peer(struct ol_txrx_pdev_t *pdev, struct ol_txrx_peer_t **peer);
 
+/**
+ * ol_txrx_set_ocb_def_tx_param() - Set the default OCB TX parameters
+ * @vdev: The OCB vdev that will use these defaults.
+ * @_def_tx_param: The default TX parameters.
+ * @def_tx_param_size: The size of the _def_tx_param buffer.
+ *
+ * Return: true if the default parameters were set correctly, false if there
+ * is an error, for example an invalid parameter. In the case that false is
+ * returned, see the kernel log for the error description.
+ */
+bool ol_txrx_set_ocb_def_tx_param(ol_txrx_vdev_handle vdev,
+	void *def_tx_param, uint32_t def_tx_param_size);
+
 void ol_txrx_display_stats(struct ol_txrx_pdev_t *pdev, uint16_t bitmap);
 void ol_txrx_clear_stats(struct ol_txrx_pdev_t *pdev, uint16_t bitmap);
 
+void ol_rx_reset_pn_replay_counter(struct ol_txrx_pdev_t *pdev);
+uint32_t ol_rx_get_tkip_replay_counter(struct ol_txrx_pdev_t *pdev);
+uint32_t ol_rx_get_ccmp_replay_counter(struct ol_txrx_pdev_t *pdev);
+
 #endif /* _OL_TXRX_CTRL_API__H_ */
diff --git a/CORE/SERVICES/COMMON/ol_txrx_osif_api.h b/CORE/SERVICES/COMMON/ol_txrx_osif_api.h
index 6808f64a782a..02dcef13564d 100644
--- a/CORE/SERVICES/COMMON/ol_txrx_osif_api.h
+++ b/CORE/SERVICES/COMMON/ol_txrx_osif_api.h
@@ -208,4 +208,26 @@ adf_nbuf_t ol_txrx_osif_tso_segment(
     int max_seg_payload_bytes,
     adf_nbuf_t jumbo_tcp_frame);
 
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+void
+ol_tx_vdev_set_bundle_require(uint8_t vdev_id, unsigned long tx_packets,
+			uint32_t time_in_ms, uint32_t high_th, uint32_t low_th);
+void
+ol_tx_pdev_reset_bundle_require(void* pdev);
+
+#else
+static inline void
+ol_tx_vdev_set_bundle_require(uint8_t vdev_id, unsigned long tx_packets,
+			uint32_t time_in_ms, uint32_t high_th, uint32_t low_th)
+{
+	return;
+}
+static inline void
+ol_tx_pdev_reset_bundle_require(void* pdev)
+{
+	return;
+}
+
+#endif
+
 #endif /* _OL_TXRX_OSIF_API__H_ */
diff --git a/CORE/SERVICES/COMMON/pktlog_ac_fmt.h b/CORE/SERVICES/COMMON/pktlog_ac_fmt.h
index 7d144c35a9f9..42c07c82f56d 100644
--- a/CORE/SERVICES/COMMON/pktlog_ac_fmt.h
+++ b/CORE/SERVICES/COMMON/pktlog_ac_fmt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013, 2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2013, 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -71,6 +71,27 @@ struct ath_pktlog_hdr {
     u_int32_t timestamp;
 }__ATTRIB_PACK;
 
+
+/**
+ * enum pkt_type - packet type
+ * @START_MONITOR: indicates parser to start packetdump parsing
+ * @STOP_MONITOR: indicates parser to stop packetdump parsing
+ * @TX_MGMT_PKT: TX management Packet
+ * @TX_DATA_PKT: TX data Packet
+ * @RX_MGMT_PKT: RX management Packet
+ * @RX_DATA_PKT: RX data Packet
+ *
+ * This enum has packet types
+ */
+enum pkt_type {
+	START_MONITOR = 1,
+	STOP_MONITOR,
+	TX_MGMT_PKT,
+	TX_DATA_PKT,
+	RX_MGMT_PKT,
+	RX_DATA_PKT,
+};
+
 #define ATH_PKTLOG_HDR_FLAGS_MASK 0xffff
 #define ATH_PKTLOG_HDR_FLAGS_SHIFT 0
 #define ATH_PKTLOG_HDR_FLAGS_OFFSET 0
@@ -153,7 +174,8 @@ enum {
 #define PKTLOG_TYPE_RC_FIND     6
 #define PKTLOG_TYPE_RC_UPDATE   7
 #define PKTLOG_TYPE_TX_VIRT_ADDR 8
-#define PKTLOG_TYPE_MAX          9
+#define PKTLOG_TYPE_PKT_DUMP    10
+#define PKTLOG_TYPE_MAX         11
 
 /*#define PKTLOG_TYPE_TXCTL    0
 #define PKTLOG_TYPE_TXSTATUS 1
@@ -366,5 +388,83 @@ struct ath_pktlog_buf {
                          sizeof(struct ath_pktlog_hdr)) ? _rd_offset:0;\
     } while(0)
 
+
+/**
+ * enum tx_pkt_fate - tx packet fate
+ * @TX_PKT_FATE_ACKED: Sent over air and ACKed
+ * @TX_PKT_FATE_SENT: Sent over air but not ACKed.
+ * @TX_PKT_FATE_FW_QUEUED: Queued within firmware,
+ * but not yet sent over air
+ * @TX_PKT_FATE_FW_DROP_INVALID: Dropped by firmware as invalid.
+ * E.g. bad source address, bad checksum, or invalid for current state.
+ * @TX_PKT_FATE_FW_DROP_NOBUFS: Dropped by firmware due
+ * to lack of buffer space
+ * @TX_PKT_FATE_FW_DROP_OTHER: Dropped by firmware for any other
+ * reason. Includes frames that were sent by driver to firmware, but
+ * unaccounted for by firmware.
+ * @TX_PKT_FATE_DRV_QUEUED: Queued within driver, not yet sent to firmware.
+ * @TX_PKT_FATE_DRV_DROP_INVALID: Dropped by driver as invalid.
+ * E.g. bad source address, or invalid for current state.
+ * @TX_PKT_FATE_DRV_DROP_NOBUFS: Dropped by driver due to lack of buffer space
+ * @TX_PKT_FATE_DRV_DROP_OTHER: Dropped by driver for any other reason.
+ * E.g. out of buffers.
+ *
+ * This enum has packet fate types
+ */
+
+enum tx_pkt_fate {
+	TX_PKT_FATE_ACKED,
+	TX_PKT_FATE_SENT,
+	TX_PKT_FATE_FW_QUEUED,
+	TX_PKT_FATE_FW_DROP_INVALID,
+	TX_PKT_FATE_FW_DROP_NOBUFS,
+	TX_PKT_FATE_FW_DROP_OTHER,
+	TX_PKT_FATE_DRV_QUEUED,
+	TX_PKT_FATE_DRV_DROP_INVALID,
+	TX_PKT_FATE_DRV_DROP_NOBUFS,
+	TX_PKT_FATE_DRV_DROP_OTHER,
+};
+
+/**
+ * enum rx_pkt_fate - tx packet fate
+ * @RX_PKT_FATE_SUCCESS: Valid and delivered to
+ * network stack (e.g., netif_rx()).
+ * @RX_PKT_FATE_FW_QUEUED: Queued within firmware,
+ * but not yet sent to driver.
+ * @RX_PKT_FATE_FW_DROP_FILTER: Dropped by firmware
+ * due to host-programmable filters.
+ * @RX_PKT_FATE_FW_DROP_INVALID: Dropped by firmware
+ * as invalid. E.g. bad checksum, decrypt failed, or invalid for current state.
+ * @RX_PKT_FATE_FW_DROP_NOBUFS: Dropped by firmware
+ * due to lack of buffer space.
+ * @RX_PKT_FATE_FW_DROP_OTHER: Dropped by firmware
+ * for any other reason.
+ * @RX_PKT_FATE_DRV_QUEUED: Queued within driver,
+ * not yet delivered to network stack.
+ * @RX_PKT_FATE_DRV_DROP_FILTER: Dropped by drive
+ * r due to filter rules.
+ * @RX_PKT_FATE_DRV_DROP_INVALID: Dropped by driver as invalid.
+ * E.g. not permitted in current state.
+ * @RX_PKT_FATE_DRV_DROP_NOBUFS: Dropped by driver
+ * due to lack of buffer space.
+ * @RX_PKT_FATE_DRV_DROP_OTHER: Dropped by driver for any other reason.
+ *
+ * This enum has packet fate types
+ */
+
+enum rx_pkt_fate {
+	RX_PKT_FATE_SUCCESS,
+	RX_PKT_FATE_FW_QUEUED,
+	RX_PKT_FATE_FW_DROP_FILTER,
+	RX_PKT_FATE_FW_DROP_INVALID,
+	RX_PKT_FATE_FW_DROP_NOBUFS,
+	RX_PKT_FATE_FW_DROP_OTHER,
+	RX_PKT_FATE_DRV_QUEUED,
+	RX_PKT_FATE_DRV_DROP_FILTER,
+	RX_PKT_FATE_DRV_DROP_INVALID,
+	RX_PKT_FATE_DRV_DROP_NOBUFS,
+	RX_PKT_FATE_DRV_DROP_OTHER,
+};
+
 #endif  /* _PKTLOG_FMT_H_ */
 #endif /* REMOVE_PKT_LOG */
diff --git a/CORE/SERVICES/COMMON/wlan_defs.h b/CORE/SERVICES/COMMON/wlan_defs.h
index 208f4f6e4b15..6474c387687d 100644
--- a/CORE/SERVICES/COMMON/wlan_defs.h
+++ b/CORE/SERVICES/COMMON/wlan_defs.h
@@ -56,6 +56,10 @@
 #define CONFIG_160MHZ_SUPPORT 0 /* default: 160 MHz channels not supported */
 #endif
 
+#ifndef SUPPORT_11AX
+#define SUPPORT_11AX 0 /* 11ax not supported by default */
+#endif
+
 typedef enum {
     MODE_11A        = 0,   /* 11a Mode */
     MODE_11G        = 1,   /* 11b/g Mode */
@@ -76,9 +80,28 @@ typedef enum {
     MODE_11AC_VHT160   = 15,
 #endif
 
+#if SUPPORT_11AX
+    MODE_11AX_HE20 = 16,
+    MODE_11AX_HE40 = 17,
+    MODE_11AX_HE80 = 18,
+    MODE_11AX_HE80_80 = 19,
+    MODE_11AX_HE160 = 20,
+    MODE_11AX_HE20_2G = 21,
+    MODE_11AX_HE40_2G = 22,
+    MODE_11AX_HE80_2G = 23,
+#endif
+
+    /*
+     * MODE_UNKNOWN should not be used within the host / target interface.
+     * Thus, it is permissible for ODE_UNKNOWN to be conditionally-defined,
+     * taking different values when compiling for different targets.
+     */
+
     MODE_UNKNOWN,
-    MODE_UNKNOWN_NO_160MHZ_SUPPORT = 14,
-    MODE_UNKNOWN_160MHZ_SUPPORT = 16,
+    MODE_UNKNOWN_NO_160MHZ_SUPPORT = 14, /* not needed? */
+    //MODE_UNKNOWN_NO_11AX_SUPPORT = 16, /* not needed? */
+    //MODE_UNKNOWN_11AX_SUPPORT = 24, /* not needed? */
+    MODE_UNKNOWN_160MHZ_SUPPORT = MODE_UNKNOWN, /* not needed? */
 
     MODE_MAX        = MODE_UNKNOWN,
     MODE_MAX_NO_160_MHZ_SUPPORT = MODE_UNKNOWN_NO_160MHZ_SUPPORT,
diff --git a/CORE/SERVICES/COMMON/wmi.h b/CORE/SERVICES/COMMON/wmi.h
index 9cb7e30c351c..ae7500c80ab2 100644
--- a/CORE/SERVICES/COMMON/wmi.h
+++ b/CORE/SERVICES/COMMON/wmi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2004-2010 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2004-2010 2013, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -165,6 +165,7 @@ typedef enum {
     WMI_11NG_CAPABILITY  = 5,
     WMI_11NAG_CAPABILITY = 6,
     WMI_11AC_CAPABILITY  = 7,
+    WMI_11AX_CAPABILITY  = 8,
     // END CAPABILITY
     WMI_11N_CAPABILITY_OFFSET = (WMI_11NA_CAPABILITY - WMI_11A_CAPABILITY),
 } WMI_PHY_CAPABILITY;
diff --git a/CORE/SERVICES/COMMON/wmi_services.h b/CORE/SERVICES/COMMON/wmi_services.h
index 5f7a87a32675..1b85c1a1fd36 100644
--- a/CORE/SERVICES/COMMON/wmi_services.h
+++ b/CORE/SERVICES/COMMON/wmi_services.h
@@ -141,6 +141,21 @@ typedef  enum  {
     WMI_SERVICE_SMART_ANTENNA_SW_SUPPORT,
     WMI_SERVICE_SMART_ANTENNA_HW_SUPPORT,
     WMI_SERVICE_RATECTRL_LIMIT_MAX_MIN_RATES, /* allow per-peer tx MCS min/max limits by host */
+    WMI_SERVICE_NAN_DATA,             /* FW supports NAN data */
+    WMI_SERVICE_NAN_RTT,              /* FW supports NAN RTT */
+    WMI_SERVICE_11AX,                 /* FW supports 802.11ax */
+    /* WMI_SERVICE_DEPRECATED_REPLACE
+     * FW supports these new WMI commands, to be used rather than
+     * deprecated matching commands:
+     * - WMI_PDEV_SET_PCL_CMDID          (vs. WMI_SOC_SET_PCL_CMDID)
+     * - WMI_PDEV_SET_HW_MODE_CMDID      (vs. WMI_SOC_SET_HW_MODE_CMDID)
+     * - WMI_PDEV_SET_MAC_CONFIG_CMDID   (vs. WMI_SOC_SET_DUAL_MAC_CONFIG_CMDID)
+     * - WMI_PDEV_SET_ANTENNA_MODE_CMDID (vs. WMI_SOC_SET_ANTENNA_MODE_CMDID)
+     * - WMI_VDEV_SET_DSCP_TID_MAP_CMDID (vs. WMI_VDEV_SET_WMM_PARAMS_CMDID)
+     */
+    WMI_SERVICE_DEPRECATED_REPLACE,
+    WMI_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE, /* FW supports a new mode that allows to run connection tracker in host */
+    WMI_SERVICE_ENHANCED_MCAST_FILTER,/* FW supports enhanced multicast filtering (of mcast IP inside ucast WLAN) */
 
     WMI_MAX_SERVICE=128               /* max service */
 } WMI_SERVICE;
diff --git a/CORE/SERVICES/COMMON/wmi_tlv_defs.h b/CORE/SERVICES/COMMON/wmi_tlv_defs.h
index 32058652f3b6..1a6f866b1732 100644
--- a/CORE/SERVICES/COMMON/wmi_tlv_defs.h
+++ b/CORE/SERVICES/COMMON/wmi_tlv_defs.h
@@ -223,8 +223,12 @@ typedef enum {
     WMITLV_TAG_STRUC_WMI_GTK_OFFLOAD_STATUS_EVENT_fixed_param,
     WMITLV_TAG_STRUC_wmi_igtk_info,
     WMITLV_TAG_STRUC_wmi_dcs_interference_event_fixed_param,
-    WMITLV_TAG_STRUC_ath_dcs_cw_int,
-    WMITLV_TAG_STRUC_ath_dcs_wlan_int_stat,
+    WMITLV_TAG_STRUC_ath_dcs_cw_int, /* DEPRECATED */
+    WMITLV_TAG_STRUC_wlan_dcs_cw_int = /* alias */
+        WMITLV_TAG_STRUC_ath_dcs_cw_int,
+    WMITLV_TAG_STRUC_ath_dcs_wlan_int_stat, /* DEPRECATED */
+    WMITLV_TAG_STRUC_wlan_dcs_im_tgt_stats_t = /* alias */
+        WMITLV_TAG_STRUC_ath_dcs_wlan_int_stat,
     WMITLV_TAG_STRUC_wmi_wlan_profile_ctx_t,
     WMITLV_TAG_STRUC_wmi_wlan_profile_t,
     WMITLV_TAG_STRUC_wmi_pdev_qvit_event_fixed_param,
@@ -659,6 +663,32 @@ typedef enum {
     WMITLV_TAG_STRUC_wmi_vdev_set_dscp_tid_map_cmd_fixed_param,
     WMITLV_TAG_STRUC_wmi_roam_set_mbo_fixed_param,
     WMITLV_TAG_STRUC_wmi_mib_stats_enable_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_nan_disc_iface_created_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_nan_disc_iface_deleted_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_nan_started_cluster_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_nan_joined_cluster_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndi_get_cap_req_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndp_initiator_req_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndp_responder_req_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndp_end_req_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndi_cap_rsp_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndp_initiator_rsp_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndp_responder_rsp_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndp_end_rsp_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndp_indication_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndp_confirm_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_ndp_end_indication_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_set_quiet_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_set_pcl_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_set_mac_config_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_set_antenna_mode_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_response_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_hw_mode_transition_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_response_vdev_mac_entry,
+    WMITLV_TAG_STRUC_wmi_pdev_set_mac_config_response_event_fixed_param,
+    WMITLV_TAG_STRUC_WMI_COEX_CONFIG_CMD_fixed_param,
+    WMITLV_TAG_STRUC_wmi_config_enhanced_mcast_filter_fixed_param,
 } WMITLV_TAG_ID;
 
 /*
@@ -925,7 +955,18 @@ typedef enum {
     OP(WMI_FWTEST_CMDID) \
     OP(WMI_QBOOST_CFG_CMDID) \
     OP(WMI_ROAM_SET_MBO_PARAM_CMDID) \
-    OP(WMI_MIB_STATS_ENABLE_CMDID)
+    OP(WMI_MIB_STATS_ENABLE_CMDID) \
+    OP(WMI_NDI_GET_CAP_REQ_CMDID) \
+    OP(WMI_NDP_INITIATOR_REQ_CMDID) \
+    OP(WMI_NDP_RESPONDER_REQ_CMDID) \
+    OP(WMI_NDP_END_REQ_CMDID) \
+    OP(WMI_PDEV_SET_PCL_CMDID) \
+    OP(WMI_PDEV_SET_HW_MODE_CMDID) \
+    OP(WMI_PDEV_SET_MAC_CONFIG_CMDID) \
+    OP(WMI_PDEV_SET_ANTENNA_MODE_CMDID) \
+    OP(WMI_VDEV_SET_QUIET_MODE_CMDID) \
+    OP(WMI_COEX_CONFIG_CMDID) \
+    OP(WMI_CONFIG_ENHANCED_MCAST_FILTER_CMDID)
 
 /*
  * IMPORTANT: Please add _ALL_ WMI Events Here.
@@ -1059,7 +1100,21 @@ typedef enum {
     OP(WMI_PEER_RATECODE_LIST_EVENTID) \
     OP(WMI_WDS_PEER_EVENTID) \
     OP(WMI_PEER_STA_PS_STATECHG_EVENTID) \
-    OP(WMI_INST_RSSI_STATS_EVENTID)
+    OP(WMI_INST_RSSI_STATS_EVENTID) \
+    OP(WMI_NAN_DISC_IFACE_CREATED_EVENTID) \
+    OP(WMI_NAN_DISC_IFACE_DELETED_EVENTID) \
+    OP(WMI_NAN_STARTED_CLUSTER_EVENTID) \
+    OP(WMI_NAN_JOINED_CLUSTER_EVENTID) \
+    OP(WMI_NDI_CAP_RSP_EVENTID) \
+    OP(WMI_NDP_INITIATOR_RSP_EVENTID) \
+    OP(WMI_NDP_RESPONDER_RSP_EVENTID) \
+    OP(WMI_NDP_END_RSP_EVENTID) \
+    OP(WMI_NDP_INDICATION_EVENTID) \
+    OP(WMI_NDP_CONFIRM_EVENTID) \
+    OP(WMI_NDP_END_INDICATION_EVENTID) \
+    OP(WMI_PDEV_SET_HW_MODE_RESP_EVENTID) \
+    OP(WMI_PDEV_HW_MODE_TRANSITION_EVENTID) \
+    OP(WMI_PDEV_SET_MAC_CONFIG_RESP_EVENTID)
 
 /* TLV definitions of WMI commands */
 
@@ -1938,6 +1993,12 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_PARAM_CMDID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_QUIET_MODE_CMDID);
 
+/* VDev set quiet Cmd */
+#define WMITLV_TABLE_WMI_VDEV_SET_QUIET_MODE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_set_quiet_cmd_fixed_param, wmi_vdev_set_quiet_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_SET_QUIET_MODE_CMDID);
+
 /* Vdev create Cmd */
 #define WMITLV_TABLE_WMI_VDEV_CREATE_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_create_cmd_fixed_param, wmi_vdev_create_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)\
@@ -2254,6 +2315,47 @@ WMITLV_CREATE_PARAM_STRUC(WMI_DEL_PROACTIVE_ARP_RSP_PATTERN_CMDID);
    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_NAN_CMDID);
 
+/* NAN Data Get Capabilities Cmd */
+#define WMITLV_TABLE_WMI_NDI_GET_CAP_REQ_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndi_get_cap_req_fixed_param, wmi_ndi_get_cap_req_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDI_GET_CAP_REQ_CMDID);
+
+/** NAN Data Initiator Request Cmd
+ *
+ * TLV (tag length value ) parameters follow the ndp_initiator_req
+ * structure. The TLV's are:
+ * wmi_ndp_cfg ndp_cfg[];
+ * wmi_ndp_app_info ndp_app_info[];
+ */
+#define WMITLV_TABLE_WMI_NDP_INITIATOR_REQ_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_initiator_req_fixed_param, wmi_ndp_initiator_req_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_cfg, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDP_INITIATOR_REQ_CMDID);
+
+/** NAN Data Responder Request Cmd
+ * TLV (tag length value ) parameters follow the ndp_responder_req
+ * structure. The TLV's are:
+ * wmi_ndp_cfg ndp_cfg[];
+ * wmi_ndp_app_info ndp_app_info[];
+ */
+#define WMITLV_TABLE_WMI_NDP_RESPONDER_REQ_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_responder_rsp_event_fixed_param, wmi_ndp_responder_req_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_cfg, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDP_RESPONDER_REQ_CMDID);
+
+/** NAN Data End Request Cmd
+ *
+ * TLV (tag length value ) parameters follow the ndp_end_req
+ * structure. The TLV's are:
+ * wmi_ndp_end_req wmi_ndp_end_req_list[];
+ */
+#define WMITLV_TABLE_WMI_NDP_END_REQ_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_end_req_fixed_param, wmi_ndp_end_req_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_FIXED_STRUC, wmi_ndp_end_req, ndp_end_req_list, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDP_END_REQ_CMDID);
+
 /* Modem power state cmd */
 #define WMITLV_TABLE_WMI_MODEM_POWER_STATE_CMDID(id,op,buf,len) \
    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_modem_power_state_cmd_param, wmi_modem_power_state_cmd_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2457,27 +2559,48 @@ WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_TSF_TSTAMP_ACTION_CMDID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_SUBNET_CHANGE_CONFIG_CMDID);
 
-/* Set the SOC Preferred Channel List (PCL) Cmd */
+/* Set the SOC Preferred Channel List (PCL) Cmd - DEPRECATED */
 #define WMITLV_TABLE_WMI_SOC_SET_PCL_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_soc_set_pcl_cmd_fixed_param, wmi_soc_set_pcl_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, channel_list, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_SOC_SET_PCL_CMDID);
 
-/* Set the SOC Hardware Mode Cmd */
+/* Set the PDEV Preferred Channel List (PCL) Cmd */
+#define WMITLV_TABLE_WMI_PDEV_SET_PCL_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_pcl_cmd_fixed_param, wmi_pdev_set_pcl_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, channel_weight, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_PCL_CMDID);
+
+/* Set the SOC Hardware Mode Cmd - DEPRECATED */
 #define WMITLV_TABLE_WMI_SOC_SET_HW_MODE_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_soc_set_hw_mode_cmd_fixed_param, wmi_soc_set_hw_mode_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_SOC_SET_HW_MODE_CMDID);
 
-/* Set the SOC Dual MAC Config Cmd */
+/* Set the PDEV Hardware Mode Cmd */
+#define WMITLV_TABLE_WMI_PDEV_SET_HW_MODE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_cmd_fixed_param, wmi_pdev_set_hw_mode_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_HW_MODE_CMDID);
+
+/* Set the SOC Dual MAC Config Cmd - DEPRECATED */
 #define WMITLV_TABLE_WMI_SOC_SET_DUAL_MAC_CONFIG_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_soc_set_dual_mac_config_cmd_fixed_param, wmi_soc_set_dual_mac_config_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_SOC_SET_DUAL_MAC_CONFIG_CMDID);
 
-/* Set the SOC Antenna Mode Cmd */
+/* Set the PDEV MAC Config Cmd */
+#define WMITLV_TABLE_WMI_PDEV_SET_MAC_CONFIG_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_mac_config_cmd_fixed_param, wmi_pdev_set_mac_config_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_MAC_CONFIG_CMDID);
+
+/* Set the SOC Antenna Mode Cmd - DEPRECATED */
 #define WMITLV_TABLE_WMI_SOC_SET_ANTENNA_MODE_CMDID(id, op, buf, len) \
     WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_STRUC_wmi_soc_set_antenna_mode_cmd_fixed_param, wmi_soc_set_antenna_mode_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_SOC_SET_ANTENNA_MODE_CMDID);
 
+/* Set the PDEV Antenna Mode Cmd */
+#define WMITLV_TABLE_WMI_PDEV_SET_ANTENNA_MODE_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_antenna_mode_cmd_fixed_param, wmi_pdev_set_antenna_mode_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_ANTENNA_MODE_CMDID);
+
 #define WMITLV_TABLE_WMI_LRO_CONFIG_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_lro_info_cmd_fixed_param, wmi_lro_info_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_LRO_CONFIG_CMDID);
@@ -2487,6 +2610,10 @@ WMITLV_CREATE_PARAM_STRUC(WMI_LRO_CONFIG_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_TRANSFER_DATA_TO_FLASH_CMDID);
 
+#define WMITLV_TABLE_WMI_CONFIG_ENHANCED_MCAST_FILTER_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_config_enhanced_mcast_filter_fixed_param, wmi_config_enhanced_mcast_filter_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_CONFIG_ENHANCED_MCAST_FILTER_CMDID);
+
 /* MAWC sensor report indication cmd */
 #define WMITLV_TABLE_WMI_MAWC_SENSOR_REPORT_IND_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_mawc_sensor_report_ind_cmd_fixed_param, wmi_mawc_sensor_report_ind_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2507,6 +2634,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_NLO_CONFIGURE_MAWC_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_extscan_configure_mawc_cmd_fixed_param, wmi_extscan_configure_mawc_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_EXTSCAN_CONFIGURE_MAWC_CMDID);
 
+/* COEX config cmd */
+#define WMITLV_TABLE_WMI_COEX_CONFIG_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_WMI_COEX_CONFIG_CMD_fixed_param, WMI_COEX_CONFIG_CMD_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_COEX_CONFIG_CMDID);
+
 /* bpf offload capability get cmd */
 #define WMITLV_TABLE_WMI_BPF_GET_CAPABILITY_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_bpf_get_capability_cmd_fixed_param, wmi_bpf_get_capability_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2915,7 +3047,7 @@ WMITLV_CREATE_PARAM_STRUC(WMI_GTK_OFFLOAD_STATUS_EVENTID);
 /* DCA interferance Event */
 #define WMITLV_TABLE_WMI_DCS_INTERFERENCE_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_dcs_interference_event_fixed_param, wmi_dcs_interference_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, ath_dcs_cw_int, cw_int, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wlan_dcs_cw_int, cw_int, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wlan_dcs_im_tgt_stats_t, wlan_stat, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_DCS_INTERFERENCE_EVENTID);
 
@@ -3140,8 +3272,90 @@ WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_nan_event_hdr, wmi_nan_event_hdr
 WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR)
     WMITLV_CREATE_PARAM_STRUC(WMI_NAN_EVENTID);
 
+/* NAN discovery interface created event */
+#define WMITLV_TABLE_WMI_NAN_DISC_IFACE_CREATED_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_nan_disc_iface_created_event_fixed_param, wmi_nan_disc_iface_created_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_NAN_DISC_IFACE_CREATED_EVENTID);
+
+/* NAN discovery interface deleted event */
+#define WMITLV_TABLE_WMI_NAN_DISC_IFACE_DELETED_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_nan_disc_iface_deleted_event_fixed_param, wmi_nan_disc_iface_deleted_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_NAN_DISC_IFACE_DELETED_EVENTID);
+
+/* NAN device started new cluster event */
+#define WMITLV_TABLE_WMI_NAN_STARTED_CLUSTER_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_nan_started_cluster_event_fixed_param, wmi_nan_started_cluster_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_NAN_STARTED_CLUSTER_EVENTID);
+
+/* NAN device joined to cluster event */
+#define WMITLV_TABLE_WMI_NAN_JOINED_CLUSTER_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_nan_joined_cluster_event_fixed_param, wmi_nan_joined_cluster_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_NAN_JOINED_CLUSTER_EVENTID);
+
+/* NDP capabilities response event */
+#define WMITLV_TABLE_WMI_NDI_CAP_RSP_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndi_cap_rsp_event_fixed_param, wmi_ndi_cap_rsp_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDI_CAP_RSP_EVENTID);
+
+/* NDP initiator response event */
+#define WMITLV_TABLE_WMI_NDP_INITIATOR_RSP_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_initiator_rsp_event_fixed_param, wmi_ndp_initiator_rsp_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDP_INITIATOR_RSP_EVENTID);
+
+/* NDP responder response event */
+#define WMITLV_TABLE_WMI_NDP_RESPONDER_RSP_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_responder_rsp_event_fixed_param, wmi_ndp_responder_rsp_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDP_RESPONDER_RSP_EVENTID);
+
+/** NDP end response event
+ *
+ * TLV (tag length value ) parameters follow the ndp_end_rsp
+ * structure. The TLV's are:
+ * wmi_ndp_end_rsp_per_ndi ndp_end_rsp_per_ndi_list[];
+ */
+#define WMITLV_TABLE_WMI_NDP_END_RSP_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_end_rsp_event_fixed_param, wmi_ndp_end_rsp_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_ndp_end_rsp_per_ndi, ndp_end_rsp_per_ndi_list, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDP_END_RSP_EVENTID);
+
+/** NDP indication event
+ *
+ * TLV (tag length value ) parameters follow the ndp_indication
+ * structure. The TLV's are:
+ * wmi_ndp_cfg ndp_cfg[];
+ * wmi_ndp_app_info ndp_app_info[];
+ */
+#define WMITLV_TABLE_WMI_NDP_INDICATION_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_indication_event_fixed_param, wmi_ndp_indication_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_cfg, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDP_INDICATION_EVENTID);
+
+/** NDP confirm event
+ * TLV (tag length value ) parameters follow the ndp_confirm
+ * structure. The TLV's are:
+ * wmi_ndp_cfg ndp_cfg[];
+ * wmi_ndp_app_info ndp_app_info[];
+ */
+#define WMITLV_TABLE_WMI_NDP_CONFIRM_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_confirm_event_fixed_param, wmi_ndp_confirm_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_cfg, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, ndp_app_info, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDP_CONFIRM_EVENTID);
+
+/** NDP end indication event
+ *
+ * TLV (tag length value ) parameters follow the ndp_end_indication
+ * structure. The TLV's are:
+ * wmi_ndp_end_indication ndp_end_indication_list[];
+ */
+#define WMITLV_TABLE_WMI_NDP_END_INDICATION_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_ndp_end_indication_event_fixed_param, wmi_ndp_end_indication_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_ndp_end_indication, ndp_end_indication_list, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_NDP_END_INDICATION_EVENTID);
+
 /* L1SS track Event */
-#define WMITLV_TABLE_WMI_PDEV_L1SS_TRACK_EVENTID(id,op,buf,len)\
+#define WMITLV_TABLE_WMI_PDEV_L1SS_TRACK_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_l1ss_track_event_fixed_param, wmi_pdev_l1ss_track_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_L1SS_TRACK_EVENTID);
 
@@ -3151,11 +3365,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_L1SS_TRACK_EVENTID);
 WMITLV_CREATE_PARAM_STRUC(WMI_DIAG_DATA_CONTAINER_EVENTID);
 
 /* Estimated Link Speed Indication*/
-#define WMITLV_TABLE_WMI_PEER_ESTIMATED_LINKSPEED_EVENTID(id,op,buf,len)\
+#define WMITLV_TABLE_WMI_PEER_ESTIMATED_LINKSPEED_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_peer_estimated_linkspeed_event_fixed_param, wmi_peer_estimated_linkspeed_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_PEER_ESTIMATED_LINKSPEED_EVENTID);
 
-#define WMITLV_TABLE_WMI_STATS_EXT_EVENTID(id,op,buf,len)                                     \
+#define WMITLV_TABLE_WMI_STATS_EXT_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_stats_ext_event_fixed_param, wmi_stats_ext_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_STATS_EXT_EVENTID);
@@ -3257,23 +3471,40 @@ WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_TSF_REPORT_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, bufp, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_SET_IE_CMDID);
 
-/* SOC Set Hardware Mode Response event */
+/* SOC Set Hardware Mode Response event - DEPRECATED */
 #define WMITLV_TABLE_WMI_SOC_SET_HW_MODE_RESP_EVENTID(id,op,buf,len) \
 WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_soc_set_hw_mode_response_event_fixed_param, wmi_soc_set_hw_mode_response_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
 WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_soc_set_hw_mode_response_vdev_mac_entry, wmi_soc_set_hw_mode_response_vdev_mac_mapping, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_SOC_SET_HW_MODE_RESP_EVENTID);
 
-/* SOC Hardware Mode Transition event */
+/* PDEV Set Hardware Mode Response event */
+#define WMITLV_TABLE_WMI_PDEV_SET_HW_MODE_RESP_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_response_event_fixed_param, wmi_pdev_set_hw_mode_response_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_pdev_set_hw_mode_response_vdev_mac_entry, wmi_pdev_set_hw_mode_response_vdev_mac_mapping, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_HW_MODE_RESP_EVENTID);
+
+/* SOC Hardware Mode Transition event - DEPRECATED */
 #define WMITLV_TABLE_WMI_SOC_HW_MODE_TRANSITION_EVENTID(id,op,buf,len) \
 WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_soc_hw_mode_transition_event_fixed_param, wmi_soc_hw_mode_transition_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
 WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_soc_set_hw_mode_response_vdev_mac_entry, wmi_soc_set_hw_mode_response_vdev_mac_mapping, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_SOC_HW_MODE_TRANSITION_EVENTID);
 
-/* SOC Set Dual MAC Config Response event */
+/* PDEV Hardware Mode Transition event */
+#define WMITLV_TABLE_WMI_PDEV_HW_MODE_TRANSITION_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_hw_mode_transition_event_fixed_param, wmi_pdev_hw_mode_transition_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_pdev_set_hw_mode_response_vdev_mac_entry, wmi_pdev_set_hw_mode_response_vdev_mac_mapping, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_HW_MODE_TRANSITION_EVENTID);
+
+/* SOC Set Dual MAC Config Response event - DEPRECATED */
 #define WMITLV_TABLE_WMI_SOC_SET_DUAL_MAC_CONFIG_RESP_EVENTID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_soc_set_dual_mac_config_response_event_fixed_param, wmi_soc_set_dual_mac_config_response_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_SOC_SET_DUAL_MAC_CONFIG_RESP_EVENTID);
 
+/* PDEV Set Dual MAC Config Response event */
+#define WMITLV_TABLE_WMI_PDEV_SET_MAC_CONFIG_RESP_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_mac_config_response_event_fixed_param, wmi_pdev_set_mac_config_response_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_MAC_CONFIG_RESP_EVENTID);
+
 /* Packet Filter configure command*/
 #define WMITLV_TABLE_WMI_PACKET_FILTER_CONFIG_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_packet_filter_config_fixed_param, WMI_PACKET_FILTER_CONFIG_CMD_fixed_param, fixed_param, WMITLV_SIZE_FIX)
diff --git a/CORE/SERVICES/COMMON/wmi_unified.h b/CORE/SERVICES/COMMON/wmi_unified.h
index 07e76dee0f23..8b5e20b5e996 100644
--- a/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/CORE/SERVICES/COMMON/wmi_unified.h
@@ -233,6 +233,7 @@ typedef enum {
     WMI_GRP_MAWC,
     WMI_GRP_PMF_OFFLOAD,
     WMI_GRP_BPF_OFFLOAD, /* Berkeley Packet Filter */
+    WMI_GRP_NAN_DATA,
 } WMI_GRP_ID;
 
 #define WMI_CMD_GRP_START_ID(grp_id) (((grp_id) << 12) | 0x1)
@@ -326,6 +327,15 @@ typedef enum {
     /* Set to enable MIB stats collection */
     WMI_MIB_STATS_ENABLE_CMDID,
 
+    /** Set preferred channel list for DBS Mgr */
+    WMI_PDEV_SET_PCL_CMDID,
+    /** Set HW mode. Eg: single MAC, DBS & SBS, see soc_hw_mode_t for values */
+    WMI_PDEV_SET_HW_MODE_CMDID,
+    /** Set DFS, SCAN modes and other FW configurations */
+    WMI_PDEV_SET_MAC_CONFIG_CMDID,
+    /** Set per band and per pdev antenna chains */
+    WMI_PDEV_SET_ANTENNA_MODE_CMDID,
+
     /* VDEV(virtual device) specific commands */
     /** vdev create */
     WMI_VDEV_CREATE_CMDID=WMI_CMD_GRP_START_ID(WMI_GRP_VDEV),
@@ -369,6 +379,9 @@ typedef enum {
     WMI_VDEV_SET_DSCP_TID_MAP_CMDID,
     /* Configure filter for Neighbor Rx Pkt (smart mesh selective listening) */
     WMI_VDEV_FILTER_NEIGHBOR_RX_PACKETS_CMDID,
+    /** set quiet ie parameters. primarily used in AP mode */
+    WMI_VDEV_SET_QUIET_MODE_CMDID,
+
     /* peer specific commands */
 
     /** create a peer */
@@ -732,6 +745,8 @@ typedef enum {
     WMI_LRO_CONFIG_CMDID,
     /** transfer data from host to firmware to write flash */
     WMI_TRANSFER_DATA_TO_FLASH_CMDID,
+    /** Command to enable/disable filtering of multicast IP with unicast mac */
+    WMI_CONFIG_ENHANCED_MCAST_FILTER_CMDID,
     /* GPIO Configuration */
     WMI_GPIO_CONFIG_CMDID=WMI_CMD_GRP_START_ID(WMI_GRP_GPIO),
     WMI_GPIO_OUTPUT_CMDID,
@@ -818,6 +833,7 @@ typedef enum {
     /** Modem power state command */
     WMI_MODEM_POWER_STATE_CMDID=WMI_CMD_GRP_START_ID(WMI_GRP_COEX),
     WMI_CHAN_AVOID_UPDATE_CMDID,
+    WMI_COEX_CONFIG_CMDID,
 
     /**
      *  OBSS scan offload enable/disable commands
@@ -897,6 +913,15 @@ typedef enum {
     WMI_BPF_GET_VDEV_STATS_CMDID,
     WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID,
     WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID,
+    /**
+     * Nan Data commands
+     * NDI - NAN Data Interface
+     * NDP - NAN Data Path
+     */
+    WMI_NDI_GET_CAP_REQ_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_NAN_DATA),
+    WMI_NDP_INITIATOR_REQ_CMDID,
+    WMI_NDP_RESPONDER_REQ_CMDID,
+    WMI_NDP_END_REQ_CMDID,
 } WMI_CMD_ID;
 
 typedef enum {
@@ -953,6 +978,11 @@ typedef enum {
     /** NF Cal Power in DBR/DBM for all channels */
     WMI_PDEV_NFCAL_POWER_ALL_CHANNELS_EVENTID,
 
+    /** SOC/PDEV events */
+    WMI_PDEV_SET_HW_MODE_RESP_EVENTID,
+    WMI_PDEV_HW_MODE_TRANSITION_EVENTID,
+    WMI_PDEV_SET_MAC_CONFIG_RESP_EVENTID,
+
     /* VDEV specific events */
     /** VDEV started event in response to VDEV_START request */
     WMI_VDEV_START_RESP_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_VDEV),
@@ -1215,6 +1245,10 @@ typedef enum {
 
     /* NAN Event */
     WMI_NAN_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_NAN),
+    WMI_NAN_DISC_IFACE_CREATED_EVENTID,
+    WMI_NAN_DISC_IFACE_DELETED_EVENTID,
+    WMI_NAN_STARTED_CLUSTER_EVENTID,
+    WMI_NAN_JOINED_CLUSTER_EVENTID,
 
     /* LPI Event */
     WMI_LPI_RESULT_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_LPI),
@@ -1256,6 +1290,15 @@ typedef enum {
     /** pkt filter (BPF) offload relevant events */
     WMI_BPF_CAPABILIY_INFO_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_BPF_OFFLOAD),
     WMI_BPF_VDEV_STATS_INFO_EVENTID,
+
+    /** NAN Data Events */
+    WMI_NDI_CAP_RSP_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_NAN_DATA),
+    WMI_NDP_INITIATOR_RSP_EVENTID,
+    WMI_NDP_RESPONDER_RSP_EVENTID,
+    WMI_NDP_END_RSP_EVENTID,
+    WMI_NDP_INDICATION_EVENTID,
+    WMI_NDP_CONFIRM_EVENTID,
+    WMI_NDP_END_INDICATION_EVENTID,
 } WMI_EVT_ID;
 
 /* defines for OEM message sub-types */
@@ -1276,10 +1319,16 @@ typedef enum {
  */
 #define WMI_OEM_INTERNAL_RSP       0xdeadbeef
 
-#define WMI_CHAN_LIST_TAG 0x1
-#define WMI_SSID_LIST_TAG 0x2
-#define WMI_BSSID_LIST_TAG 0x3
-#define WMI_IE_TAG 0x4
+#define WMI_CHAN_LIST_TAG		 0x1
+#define WMI_SSID_LIST_TAG		 0x2
+#define WMI_BSSID_LIST_TAG		 0x3
+#define WMI_IE_TAG			 0x4
+#define WMI_NDP_CFG_TAG                  0x5
+#define WMI_NDP_QOS_CFG_TAG              0x6
+#define WMI_NDP_APP_INFO_TAG             0x7
+#define WMI_NDP_END_REQ_LIST_TAG         0x8
+#define WMI_NDP_END_RSP_PER_NDI_LIST_TAG 0x9
+#define WMI_NDP_END_INDICATION_LIST_TAG  0xA
 
 typedef struct {
     A_UINT32 tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_channel */
@@ -1462,6 +1511,61 @@ WMI_CHANNEL_CHANGE_CAUSE_CSA,
 #define WMI_VHT_MAX_SUPP_RATE_MASK           0x1fff0000
 #define WMI_VHT_MAX_SUPP_RATE_MASK_SHIFT     16
 
+/** 11ax capabilities */
+#define WMI_HE_CAP_PPE_PRESENT            0x00000001
+#define WMI_HE_CAP_TWT_RESPONDER_SUPPORT  0x00000002
+#define WMI_HE_CAP_TWT_REQUESTER_SUPPORT  0x00000004
+#define WMI_HE_FRAG_SUPPORT_MASK          0x00000018
+#define WMI_HE_FRAG_SUPPORT_SHIFT         3
+/** NOTE: This defs cannot be changed in the future without breaking WMI compatibility */
+#define WMI_MAX_NUM_SS                    8
+#define WMI_MAX_NUM_RU                    4
+
+/*
+ * Figure 8 554ae: -PPE Threshold Info field format
+ * we pack PPET16 and PPT8 for four RU's in one element of array.
+ *
+ * ppet16_ppet8_ru3_ru0 array element 0 holds:
+ *     | PPET16 | PPET8  | PPET16 | PPET8  | PPET16 | PPET8  | PPET16 | PPET8  |
+ *rsvd |NSS1,RU4|NSS1,RU4|NSS1,RU3|NSS1,RU3|NSS1,RU2|NSS1,RU2|NSS1,RU1|NSS1,RU1|
+ *31:23|  22:20 |  19:17 |  17:15 |  14:12 |  11:9  |   8:6  |   5:3  |   2:0  |
+ *
+ * ppet16_ppet8_ru3_ru0 array element 1 holds:
+ *     | PPET16 | PPET8  | PPET16 | PPET8  | PPET16 | PPET8  | PPET16 | PPET8  |
+ *rsvd |NSS2,RU4|NSS2,RU4|NSS2,RU3|NSS2,RU3|NSS2,RU2|NSS2,RU2|NSS2,RU1|NSS2,RU1|
+ *31:23|  22:20 |  19:17 |  17:15 |  14:12 |  11:9  |   8:6  |   5:3  |   2:0  |
+ *
+ * etc.
+ */
+
+/*
+ * Note that in these macros, "ru" is one-based, not zero-based, while
+ * nssm1 is zero-based.
+ */
+#define WMI_SET_PPET8(ppet16_ppet8_ru3_ru0, ppet, ru, nssm1) \
+    do { \
+        ppet16_ppet8_ru3_ru0[nssm1] &= ~(7 << (((ru-1)%4)*6));       \
+        ppet16_ppet8_ru3_ru0[nssm1] |= ((ppet&7) << (((ru-1)%4)*6)); \
+    } while (0)
+
+#define WMI_GET_PPET8(ppet16_ppet8_ru3_ru0, ru, nssm1) \
+    ((ppet16_ppet8_ru3_ru0[nssm1] >> (((ru-1)%4)*6))&7)
+
+#define WMI_SET_PPET16(ppet16_ppet8_ru3_ru0, ppet, ru, nssm1) \
+    do { \
+        ppet16_ppet8_ru3_ru0[nssm1] &= ~(7 << (((ru-1)%4)*6+3));       \
+        ppet16_ppet8_ru3_ru0[nssm1] |= ((ppet&7) << (((ru-1)%4)*6+3)); \
+    } while (0)
+
+#define WMI_GET_PPET16(ppet16_ppet8_ru3_ru0, ru, nssm1) \
+    ((ppet16_ppet8_ru3_ru0[nssm1] >> (((ru-1)%4)*6+3))&7)
+
+typedef struct _wmi_ppe_threshold {
+    A_UINT32 numss_m1; /** NSS - 1*/
+    A_UINT32 ru_count; /** Max RU count */
+    A_UINT32 ppet16_ppet8_ru3_ru0[WMI_MAX_NUM_SS]; /** ppet8 and ppet16 for max num ss */
+} wmi_ppe_threshold;
+
 /* WMI_SYS_CAPS_* refer to the capabilities that system support
 */
 #define WMI_SYS_CAP_ENABLE                       0x00000001
@@ -1583,6 +1687,15 @@ typedef struct _wmi_abi_version {
 #define HW_BD_INFO_SIZE       5
 
 /**
+ * PDEV ID to identify the physical device,
+ * value 0 reserved for SOC level commands/event
+ */
+#define WMI_PDEV_ID_SOC         0 /* SOC level, applicable to all PDEVs */
+#define WMI_PDEV_ID_1ST         1 /* first pdev  (pdev 0) */
+#define WMI_PDEV_ID_2ND         2 /* second pdev (pdev 1) */
+#define WMI_PDEV_ID_3RD         3 /* third pdev  (pdev 2) */
+
+/**
  * The following struct holds optional payload for
  * wmi_service_ready_event_fixed_param,e.g., 11ac pass some of the
  * device capability to the host.
@@ -1674,6 +1787,13 @@ typedef struct {
     A_UINT32 default_conc_scan_config_bits;
     /* which WMI_DBS_FW_MODE_CFG setting the FW is initialized with */
     A_UINT32 default_fw_config_bits;
+    wmi_ppe_threshold ppet;
+    A_UINT32 he_cap_info; /* see section 8.4.2.213 from draft r8 of 802.11ax */
+    /*
+     * An HT STA shall not allow transmission of more than one MPDU start
+     * within the time limit described in the MPDU maximum density field.
+     */
+    A_UINT32 mpdu_density; /* units are microseconds */
 } wmi_service_ready_ext_event_fixed_param;
 
 typedef enum {
@@ -2778,7 +2898,13 @@ typedef struct {
     A_UINT32 tsf_l32;
     A_UINT32 tsf_u32;
     A_UINT32 buf_len;
-    A_UINT32 pmac_id;
+    union {
+        A_UINT32 pmac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     A_UINT32 rsPhyErrMask0; /* see WMI_PHY_ERROR_MASK0 */
     A_UINT32 rsPhyErrMask1; /* see WMI_PHY_ERROR_MASK1 */
     A_UINT32 rsPhyErrMask2; /* see WMI_PHY_ERROR_MASK2 */
@@ -2837,7 +2963,11 @@ typedef struct {
 typedef struct {
     A_UINT32 tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_regdomain_cmd_fixed_param */
 
-    A_UINT32 reserved0;      /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
     /** reg domain code */
     A_UINT32 reg_domain;
     A_UINT32 reg_domain_2G;
@@ -2914,6 +3044,15 @@ typedef struct {
         A_UINT32 enabled;		/*enable/disable*/
 } wmi_pdev_set_quiet_cmd_fixed_param;
 
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_set_quiet_cmd_fixed_param */
+    A_UINT32 vdev_id;    /* Virtual interface ID */
+    A_UINT32 period;     /* period in TUs */
+    A_UINT32 duration;   /* duration in TUs */
+    A_UINT32 next_start; /* offset in TUs */
+    A_UINT32 enabled;    /* enable/disable */
+} wmi_vdev_set_quiet_cmd_fixed_param;
+
 /*
  * Command to enable/disable Green AP Power Save.
  * This helps conserve power during AP operation. When the AP has no
@@ -2923,12 +3062,16 @@ typedef struct {
  */
 typedef struct {
     A_UINT32 tlv_header;         /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_green_ap_ps_enable_cmd_fixed_param */
-    A_UINT32 reserved0;          /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
     A_UINT32 enable;              /*1:enable, 0:disable*/
 } wmi_pdev_green_ap_ps_enable_cmd_fixed_param;
 
 
 #define MAX_HT_IE_LEN 32
+/* DEPRECATED */
 typedef struct {
     A_UINT32 tlv_header;   /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_ht_ie_cmd_fixed_param */
     A_UINT32 reserved0;    /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
@@ -2941,6 +3084,7 @@ typedef struct {
 } wmi_pdev_set_ht_ie_cmd_fixed_param;
 
 #define MAX_VHT_IE_LEN 32
+/* DEPRECATED */
 typedef struct {
     A_UINT32 tlv_header;   /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_vht_ie_cmd_fixed_param */
     A_UINT32 reserved0;    /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
@@ -2954,7 +3098,10 @@ typedef struct {
 
 typedef struct {
     A_UINT32 tlv_header;   /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_base_macaddr_cmd_fixed_param */
-    A_UINT32 reserved0;    /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
     wmi_mac_addr base_macaddr;
 } wmi_pdev_set_base_macaddr_cmd_fixed_param;
 
@@ -3145,9 +3292,9 @@ typedef enum {
    /** Enable/Disable LED */
     WMI_PDEV_PARAM_LED_ENABLE,
     /** set DIRECT AUDIO time latency */
-    WMI_PDEV_PARAM_AUDIO_OVER_WLAN_LATENCY,
+    WMI_PDEV_PARAM_AUDIO_OVER_WLAN_LATENCY, /* DEPRECATED */
     /** set DIRECT AUDIO Feature ENABLE */
-    WMI_PDEV_PARAM_AUDIO_OVER_WLAN_ENABLE,
+    WMI_PDEV_PARAM_AUDIO_OVER_WLAN_ENABLE, /* DEPRECATED */
     /** pdev level whal mib stats update enable */
     WMI_PDEV_PARAM_WHAL_MIB_STATS_UPDATE_ENABLE,
     /** ht/vht info based on vdev */
@@ -3330,7 +3477,10 @@ typedef enum {
 
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_param_cmd_fixed_param */
-    A_UINT32 reserved0;      /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
     /** parameter id   */
     A_UINT32 param_id;
     /** parametr value */
@@ -3339,7 +3489,10 @@ typedef struct {
 
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_get_tpc_config_cmd_fixed_param */
-    A_UINT32 reserved0;      /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
     /** parameter   */
     A_UINT32 param;
 } wmi_pdev_get_tpc_config_cmd_fixed_param;
@@ -3349,7 +3502,13 @@ typedef struct {
 
 typedef struct {
     A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_antenna_diversity_cmd_fixed_param */
-    A_UINT32 mac_id; /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     /** parameter   */
     A_UINT32 value;      /** bit0 is for enable/disable FAST diversity, and bit1 is for enable/disable SLOW diversity, 0->disable, 1->enable */
 } wmi_pdev_set_antenna_diversity_cmd_fixed_param;
@@ -3383,6 +3542,7 @@ typedef enum {
     PAUSE_TYPE_STA_ADD_BA =     0x6, /** only peer_id and tid_map are valid, actually only one tid is set at one time */
     PAUSE_TYPE_AP_PS =          0x7, /** for pausing AP vdev when all the connected clients are in PS. only vdev_map is valid */
     PAUSE_TYPE_IBSS_PS =        0x8, /** for pausing IBSS vdev when all the peers are in PS. only vdev_map is valid */
+    PAUSE_TYPE_CHOP_TDLS_OFFCHAN =  0x9, /** for TDLS offchannel MCC (switch channel), only vdev_map is valid, TDLS connection tracker needs to be notified */
     PAUSE_TYPE_HOST =           0x15,/** host is requesting vdev pause */
 } wmi_tx_pause_type;
 
@@ -3442,6 +3602,10 @@ typedef struct {
     A_INT8  maxRegAllowedPowerAGCDD[WMI_TPC_TX_NUM_CHAIN][WMI_TPC_TX_NUM_CHAIN];
     A_INT8  maxRegAllowedPowerAGSTBC[WMI_TPC_TX_NUM_CHAIN][WMI_TPC_TX_NUM_CHAIN];
     A_INT8  maxRegAllowedPowerAGTXBF[WMI_TPC_TX_NUM_CHAIN][WMI_TPC_TX_NUM_CHAIN];
+    /** pdev_id for identifying the MAC
+      * See macros starting with WMI_PDEV_ID_ for values.
+      */
+    A_UINT32 pdev_id;
     /* This TLV is followed by a byte array:
          *      A_UINT8 ratesArray[];
          */
@@ -3456,6 +3620,10 @@ typedef struct {
     A_UINT32 L1Entry;
     A_UINT32 L11Entry;
     A_UINT32 L12Entry;
+    /** pdev_id for identifying the MAC
+      * See macros starting with WMI_PDEV_ID_ for values.
+      */
+    A_UINT32 pdev_id;
 } wmi_pdev_l1ss_track_event_fixed_param;
 
 typedef struct {
@@ -3486,19 +3654,6 @@ typedef struct {
 } wmi_debug_mesg_event;
 
 enum {
-    /** IBSS station */
-    VDEV_TYPE_IBSS  = 0,
-    /** infra STA */
-    VDEV_TYPE_STA   = 1,
-    /** infra AP */
-    VDEV_TYPE_AP    = 2,
-    /** Monitor */
-    VDEV_TYPE_MONITOR =3,
-    /** OCB */
-    VDEV_TYPE_OCB = 6,
-};
-
-enum {
     /** P2P device */
     VDEV_SUBTYPE_P2PDEV=0,
     /** P2P client */
@@ -3525,18 +3680,27 @@ typedef enum {
 
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_pktlog_enable_cmd_fixed_param */
-    A_UINT32 reserved0;      /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
+    /** pdev_id for identifying the MAC
+      * See macros starting with WMI_PDEV_ID_ for values.
+      */
+    A_UINT32 pdev_id;
     WMI_PKTLOG_EVENT evlist;
 } wmi_pdev_pktlog_enable_cmd_fixed_param;
 
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_pktlog_disable_cmd_fixed_param */
-    A_UINT32 reserved0;
+    /** pdev_id for identifying the MAC
+      * See macros starting with WMI_PDEV_ID_ for values.
+      */
+    A_UINT32 pdev_id;
 } wmi_pdev_pktlog_disable_cmd_fixed_param;
 
 typedef struct {
     A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_mib_stats_enable_cmd_fixed_param */
-    A_UINT32 reserved0; /** placeholder for pdev_id of multiple MAC products.  Init. to 0. */
+    /** pdev_id for identifying the MAC
+      * See macros starting with WMI_PDEV_ID_ for values.
+      */
+    A_UINT32 pdev_id;
     A_UINT32 enable_Mib; /** enable for mib stats collection. Stats are delivered to host in wmi_mib_stats structure.
                           * If enable_Mib=1, stats collection is enabled. If enable_Mib=0, stats collection does not happen */
 } wmi_mib_stats_enable_cmd_fixed_param;
@@ -3584,6 +3748,10 @@ typedef struct {
      *    the WMI_PDEV_SET_DSCP_TID_MAP_CMDID id.
      *
      */
+
+/* DEPRECATED - use VDEV level command instead
+ * (wmi_vdev_set_dscp_tid_map_cmd_fixed_param)
+ */
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_dscp_tid_map_cmd_fixed_param */
     A_UINT32 reserved0;      /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
@@ -3666,6 +3834,10 @@ typedef struct {
     A_UINT32 no_ack;
 } wmi_wmm_params;
 
+/* DEPRECATED - use VDEV level command instead
+ * (wmi_vdev_set_wmm_params_cmd_fixed_param)
+ */
+
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_wmm_params_cmd_fixed_param */
     A_UINT32 reserved0;      /** placeholder for pdev_id of future multiple MAC products. Init. to 0. */
@@ -4362,6 +4534,9 @@ typedef struct {
 
 #define WMI_VDEV_TYPE_OCB        0x6
 
+/* NAN Data Interface */
+#define WMI_VDEV_TYPE_NDI        0x7
+
 /** values for vdev_subtype */
 #define WMI_UNIFIED_VDEV_SUBTYPE_P2P_DEVICE 0x1
 #define WMI_UNIFIED_VDEV_SUBTYPE_P2P_CLIENT 0x2
@@ -4487,6 +4662,8 @@ typedef struct {
 #define  WMI_CIPHER_CKIP     0x6
 #define  WMI_CIPHER_AES_CMAC 0x7
 #define  WMI_CIPHER_ANY      0x8
+#define  WMI_CIPHER_AES_GCM  0x9
+#define  WMI_CIPHER_AES_GMAC 0xa
 
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_install_key_cmd_fixed_param */
@@ -4855,8 +5032,64 @@ typedef enum {
     /** Disable station kickout at Vap level */
     WMI_VDEV_PARAM_STA_KICKOUT,
 
+    /* VDEV capabilities */
+    WMI_VDEV_PARAM_CAPABILITIES, /* see capabilities defs below */
 } WMI_VDEV_PARAM;
 
+/* vdev capabilities bit mask */
+#define WMI_VDEV_BEACON_SUPPORT 0x1
+#define WMI_VDEV_WDS_LRN_ENABLED 0x2
+#define WMI_VDEV_IS_BEACON_SUPPORTED(param) ((param) & WMI_VDEV_BEACON_SUPPORT)
+#define WMI_VDEV_IS_WDS_LRN_ENABLED(param) ((param) & WMI_VDEV_WDS_LRN_ENABLED)
+
+/* TXBF capabilities masks */
+#define WMI_TXBF_CONF_SU_TX_BFEE_S 0
+#define WMI_TXBF_CONF_SU_TX_BFEE_M 0x1
+#define WMI_TXBF_CONF_SU_TX_BFEE (WMI_TXBF_CONF_SU_TX_BFEE_M << WMI_TXBF_CONF_SU_TX_BFEE_S)
+#define WMI_TXBF_CONF_SU_TX_BFEE_GET(x) WMI_F_MS(x,WMI_TXBF_CONF_SU_TX_BFEE)
+#define WMI_TXBF_CONF_SU_TX_BFEE_SET(x,z) WMI_F_RMW(x,z,WMI_TXBF_CONF_SU_TX_BFEE)
+
+#define WMI_TXBF_CONF_MU_TX_BFEE_S 1
+#define WMI_TXBF_CONF_MU_TX_BFEE_M 0x1
+#define WMI_TXBF_CONF_MU_TX_BFEE (WMI_TXBF_CONF_MU_TX_BFEE_M << WMI_TXBF_CONF_MU_TX_BFEE_S)
+#define WMI_TXBF_CONF_MU_TX_BFEE_GET(x) WMI_F_MS(x,WMI_TXBF_CONF_MU_TX_BFEE)
+#define WMI_TXBF_CONF_MU_TX_BFEE_SET(x,z) WMI_F_RMW(x,z,WMI_TXBF_CONF_MU_TX_BFEE)
+
+#define WMI_TXBF_CONF_SU_TX_BFER_S 2
+#define WMI_TXBF_CONF_SU_TX_BFER_M 0x1
+#define WMI_TXBF_CONF_SU_TX_BFER (WMI_TXBF_CONF_SU_TX_BFER_M << WMI_TXBF_CONF_SU_TX_BFER_S)
+#define WMI_TXBF_CONF_SU_TX_BFER_GET(x) WMI_F_MS(x,WMI_TXBF_CONF_SU_TX_BFER)
+#define WMI_TXBF_CONF_SU_TX_BFER_SET(x,z) WMI_F_RMW(x,z,WMI_TXBF_CONF_SU_TX_BFER)
+
+#define WMI_TXBF_CONF_MU_TX_BFER_S 3
+#define WMI_TXBF_CONF_MU_TX_BFER_M 0x1
+#define WMI_TXBF_CONF_MU_TX_BFER (WMI_TXBF_CONF_MU_TX_BFER_M << WMI_TXBF_CONF_MU_TX_BFER_S)
+#define WMI_TXBF_CONF_MU_TX_BFER_GET(x) WMI_F_MS(x,WMI_TXBF_CONF_MU_TX_BFER)
+#define WMI_TXBF_CONF_MU_TX_BFER_SET(x,z) WMI_F_RMW(x,z,WMI_TXBF_CONF_MU_TX_BFER)
+
+#define WMI_TXBF_CONF_STS_CAP_S 4
+#define WMI_TXBF_CONF_STS_CAP_M 0x7
+#define WMI_TXBF_CONF_STS_CAP (WMI_TXBF_CONF_STS_CAP_M << WMI_TXBF_CONF_STS_CAP_S)
+#define WMI_TXBF_CONF_STS_CAP_GET(x) WMI_F_MS(x,WMI_TXBF_CONF_STS_CAP);
+#define WMI_TXBF_CONF_STS_CAP_SET(x,z) WMI_F_RMW(x,z,WMI_TXBF_CONF_STS_CAP)
+
+#define WMI_TXBF_CONF_IMPLICIT_BF_S 7
+#define WMI_TXBF_CONF_IMPLICIT_BF_M 0x1
+#define WMI_TXBF_CONF_IMPLICIT_BF (WMI_TXBF_CONF_IMPLICIT_BF_M << WMI_TXBF_CONF_IMPLICIT_BF_S)
+#define WMI_TXBF_CONF_IMPLICIT_BF_GET(x) WMI_F_MS(x,WMI_TXBF_CONF_IMPLICIT_BF)
+#define WMI_TXBF_CONF_IMPLICIT_BF_SET(x,z) WMI_F_RMW(x,z,WMI_TXBF_CONF_IMPLICIT_BF)
+
+#define WMI_TXBF_CONF_BF_SND_DIM_S 8
+#define WMI_TXBF_CONF_BF_SND_DIM_M 0x7
+#define WMI_TXBF_CONF_BF_SND_DIM (WMI_TXBF_CONF_BF_SND_DIM_M << WMI_TXBF_CONF_BF_SND_DIM_S)
+#define WMI_TXBF_CONF_BF_SND_DIM_GET(x) WMI_F_MS(x,WMI_TXBF_CONF_BF_SND_DIM)
+#define WMI_TXBF_CONF_BF_SND_DIM_SET(x,z) WMI_F_RMW(x,z,WMI_TXBF_CONF_BF_SND_DIM)
+
+/* TXBF capabilities */
+typedef struct {
+    A_UINT32 txbf_cap;
+} wmi_vdev_txbf_cap;
+
 /* Length of ATIM Window in TU */
 #define WMI_VDEV_PARAM_ATIM_WINDOW_LENGTH WMI_VDEV_PARAM_ATIM_WINDOW
 
@@ -4866,6 +5099,11 @@ enum wmi_pkt_type {
     WMI_PKT_TYPE_ETHERNET = 2,
 };
 
+/*******************************************************************
+ * wmi_vdev_txbf_en is DEPRECATED in favor of wmi_vdev_txbf_cap
+ * Do not use it!
+ *******************************************************************/
+
 typedef struct {
     A_UINT8     sutxbfee : 1,
                 mutxbfee : 1,
@@ -4917,8 +5155,13 @@ typedef struct {
     A_UINT32 chain_mask;
     /** Vdev mimo power save mode */
     A_UINT32 smps_mode;
-    /** mac_id field contains the MAC identifier that the VDEV is bound to. The valid range is 0 to (num_macs-1). */
-    A_UINT32 mac_id;
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     /** Configured Transmit Streams **/
     A_UINT32 cfgd_tx_streams;
     /** Configured Receive Streams **/
@@ -5419,8 +5662,13 @@ typedef struct {
     /** TLV tag and len; tag equals
      * WMITLV_TAG_STRUC_wmi_ap_ps_egap_info_chainmask_list */
     A_UINT32 tlv_header;
-    /** The param indicates a mac under dual-mac */
-    A_UINT32 mac_id;
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     /** The param indicates the current tx chainmask with the mac id. */
     A_UINT32 tx_chainmask;
     /** The param indicates the current rx chainmask with the mac id. */
@@ -5616,7 +5864,8 @@ typedef struct {
             WMI_PEER_TYPE_BSS = 1,     /* Peer is BSS Peer entry */
             WMI_PEER_TYPE_TDLS = 2,    /* Peer is a TDLS Peer */
             WMI_PEER_TYPE_OCB = 3,     /* Peer is a OCB Peer */
-            WMI_PEER_TYPE_HOST_MAX = 127, /* Host <-> Target Peer type
+            WMI_PEER_TYPE_NAN_DATA = 4,   /* Peer is NAN DATA */
+	    WMI_PEER_TYPE_HOST_MAX = 127, /* Host <-> Target Peer type
                                            * is assigned up to 127 */
                                           /* Reserved from 128 - 255 for
                                            * target internal use.*/
@@ -6081,6 +6330,12 @@ typedef struct {
      *             to 0 by host
      */
     A_UINT32 peer_bw_rxnss_override;
+
+    /* 802.11ax capabilities */
+    wmi_ppe_threshold peer_ppet;
+    A_UINT32 peer_he_cap_info; /* protocol-defined HE / 11ax capability flags */
+    A_UINT32 peer_he_ops; /* HE operation contains BSS color */
+
     /* Following this struc are the TLV's:
          *     A_UINT8 peer_legacy_rates[];
          *     A_UINT8 peer_ht_rates[];
@@ -6099,12 +6354,14 @@ typedef struct {
     wmi_mac_addr wds_macaddr;
     /* Flags associated with WDS entry - see WMI_WDS_FLAG defs */
     A_UINT32 flags;
+    A_UINT32 vdev_id;
 } wmi_peer_add_wds_entry_cmd_fixed_param;
 
 typedef struct {
     A_UINT32     tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_peer_remove_wds_entry_cmd_fixed_param */
     /** wds MAC addr */
     wmi_mac_addr wds_macaddr;
+    A_UINT32 vdev_id;
 } wmi_peer_remove_wds_entry_cmd_fixed_param;
 
 
@@ -6130,6 +6387,7 @@ typedef struct {
     wmi_mac_addr wds_macaddr;
     /* Flags associated with WDS entry */
     A_UINT32 flags;
+    A_UINT32 vdev_id;
 } wmi_peer_update_wds_entry_cmd_fixed_param;
 
 /**
@@ -6161,15 +6419,17 @@ typedef struct {
  * Non wlan interference event
  */
 typedef struct {
-    A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_ath_dcs_cw_int */
+    A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wlan_dcs_cw_int */
     A_UINT32 channel; /* either number or freq in mhz*/
-} ath_dcs_cw_int;
+} wlan_dcs_cw_int;
+#define ath_dcs_cw_int /* DEPRECATED */ wlan_dcs_cw_int /* alias */
 
 /**
  *  wlan_dcs_im_tgt_stats
  *
  */
 typedef struct _wlan_dcs_im_tgt_stats {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wlan_dcs_im_tgt_stats_t */
     /** current running TSF from the TSF-1 */
     A_UINT32                  reg_tsf32;
 
@@ -6242,10 +6502,10 @@ typedef struct {
      * Following this struct are these TLVs. Note that they are both array of structures
      * but can have at most one element. Which TLV is empty or has one element depends
      * on the field interference_type. This is to emulate an union with cw_int and wlan_stat
-     * elements (not arrays).     union { ath_dcs_cw_int cw_int; wlan_dcs_im_tgt_stats_t   wlan_stat; } int_event;
+     * elements (not arrays).     union { wlan_dcs_cw_int cw_int; wlan_dcs_im_tgt_stats_t   wlan_stat; } int_event;
      *
      *        //cw_interference event
-     *       ath_dcs_cw_int            cw_int[];  this element
+     *       wlan_dcs_cw_int            cw_int[];  this element
      *       // wlan im interfernce stats
      *       wlan_dcs_im_tgt_stats_t   wlan_stat[];
      */
@@ -7231,6 +7491,8 @@ typedef enum event_type_e {
     WOW_IOAC_REV_KA_FAIL_EVENT,
     WOW_IOAC_SOCK_EVENT,
     WOW_NLO_SCAN_COMPLETE_EVENT,
+    WOW_NAN_DATA_EVENT,
+    WOW_NAN_RTT_EVENT,
 } WOW_WAKE_EVENT_TYPE;
 
 typedef enum wake_reason_e {
@@ -7275,6 +7537,8 @@ typedef enum wake_reason_e {
     WOW_REASON_REASSOC_RES_RECV,
     WOW_REASON_ACTION_FRAME_RECV,
     WOW_REASON_BPF_ALLOW,
+    WOW_REASON_NAN_DATA,
+    WOW_REASON_NAN_RTT,
     WOW_REASON_DEBUG_TEST = 0xFF,
 } WOW_WAKE_REASON_TYPE;
 
@@ -7708,6 +7972,10 @@ typedef enum {
 typedef struct {
     A_UINT32 tlv_header;     /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ftm_intg_cmd_fixed_param */
     A_UINT32 num_data;       /** length in byte of data[]. */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
     /* This structure is used to send Factory Test Mode [FTM] command
      * from host to firmware for integrated chips which are binary blobs.
      * Following this structure is the TLV:
@@ -8690,16 +8958,20 @@ typedef struct
     A_UINT32 ac;
 } wmi_vdev_wmm_delts_cmd_fixed_param;
 
+/* DEPRECATED */
 typedef struct {
     A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_dfs_enable_cmd_fixed_param  */
     /** Reserved for future use */
     A_UINT32    reserved0;
 } wmi_pdev_dfs_enable_cmd_fixed_param;
 
+/* DEPRECATED */
 typedef struct {
     A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_dfs_disable_cmd_fixed_param  */
-    /** Reserved for future use */
-    A_UINT32    reserved0;
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
 } wmi_pdev_dfs_disable_cmd_fixed_param;
 
 typedef struct {
@@ -8708,8 +8980,10 @@ typedef struct {
      */
     A_UINT32 tlv_header;
 
-    /** Reserved for future use */
-    A_UINT32 reserved0;
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
 } wmi_dfs_phyerr_filter_ena_cmd_fixed_param;
 
 typedef struct {
@@ -8734,6 +9008,8 @@ enum wmi_tdls_state {
     WMI_TDLS_ENABLE_ACTIVE,
     /** TDLS enabled - firmware waits for peer mac for connection tracking */
     WMI_TDLS_ENABLE_ACTIVE_EXTERNAL_CONTROL,
+    /** TDLS enabled - TDLS connection tracking is done in host */
+    WMI_TDLS_ENABLE_CONNECTION_TRACKER_IN_HOST,
 };
 
 /* TDLS Options */
@@ -8981,6 +9257,8 @@ enum wmi_tdls_peer_notification {
     WMI_TDLS_SHOULD_TEARDOWN,
     /** tx peer TDLS link tear down complete */
     WMI_TDLS_PEER_DISCONNECTED,
+    /** TDLS/BT role change notification for connection tracker */
+    WMI_TDLS_CONNECTION_TRACKER_NOTIFICATION,
 };
 
 enum wmi_tdls_peer_reason {
@@ -8998,6 +9276,14 @@ enum wmi_tdls_peer_reason {
     WMI_TDLS_TEARDOWN_REASON_BAD_PTR,
     /** tdls peer not responding */
     WMI_TDLS_TEARDOWN_REASON_NO_RESPONSE,
+    /** tdls entered buffer STA role, TDLS connection tracker needs to handle this */
+    WMI_TDLS_ENTER_BUF_STA,
+    /** tdls exited buffer STA role, TDLS connection tracker needs to handle this */
+    WMI_TDLS_EXIT_BUF_STA,
+    /** BT entered busy mode, TDLS connection tracker needs to handle this */
+    WMI_TDLS_ENTER_BT_BUSY_MODE,
+    /** BT exited busy mode, TDLS connection tracker needs to handle this */
+    WMI_TDLS_EXIT_BT_BUSY_MODE,
 };
 
 /* WMI_TDLS_PEER_EVENTID */
@@ -9033,8 +9319,13 @@ typedef struct {
      */
     A_UINT32 enable;
     /** This field contains the MAC identifier in order to lookup the appropriate OCS instance. */
-    /** The valid range is 0 to (num_macs-1). */
-    A_UINT32 mac_id;
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
 } wmi_resmgr_adaptive_ocs_enable_disable_cmd_fixed_param;
 
 /* WMI_RESMGR_SET_CHAN_TIME_QUOTA_CMDID */
@@ -9536,9 +9827,24 @@ typedef enum {
    WMI_CONFIG_LED_ENABLE  = 1,
 } wmi_config_led_enable_flag;
 
+typedef enum {
+    WMI_CONFIG_LED_HIGH_UNSPECIFIED = 0,
+    WMI_CONFIG_LED_HIGH_OFF         = 1,
+    WMI_CONFIG_LED_HIGH_ON          = 2,
+} wmi_config_led_on_flag;
+
+typedef enum {
+    WMI_CONFIG_LED_UNSPECIFIED = 0,
+    WMI_CONFIG_LED_ON          = 1,
+    WMI_CONFIG_LED_OFF         = 2,
+    WMI_CONFIG_LED_DIM         = 3,
+    WMI_CONFIG_LED_BLINK       = 4,
+    WMI_CONFIG_LED_TXRX        = 5,
+} wmi_config_led_operation_type;
+
 typedef struct {
     /** TLV tag and len; tag equals
-     *  WMITLV_TAG_STRUC_wmi_peer_info_req_cmd_fixed_param   */
+     *  WMITLV_TAG_STRUC_wmi_pdev_set_led_config_cmd_fixed_param   */
     A_UINT32 tlv_header;
     /* Set GPIO pin */
     A_UINT32 led_gpio_pin;
@@ -9548,6 +9854,17 @@ typedef struct {
     A_UINT32 with_bt;
     /* Set LED enablement defined in wmi_config_led_enable_flag */
     A_UINT32 led_enable;
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+    /* see wmi_config_led_operation_type enum */
+    A_UINT32 led_operation_type;
+    /* see wmi_config_led_on_flag enum */
+    A_UINT32 led_on_flag;      /* configure high/low on/off sense */
+    A_UINT32 led_on_interval;  /* for blink function; unit: ms */
+    A_UINT32 led_off_interval; /* for blink function; unit: ms */
+    A_UINT32 led_repeat_cnt;   /* for blink function: how many blinks */
 } wmi_pdev_set_led_config_cmd_fixed_param;
 
 #define WMI_WNTS_CFG_GPIO_PIN_NUM_OFFSET 0
@@ -9590,6 +9907,10 @@ typedef struct {
     A_UINT32 tlv_header;
     /** number of peers in peer_info */
     A_UINT32 num_peers;
+    /* Set to 1 only if vdev_id field is valid */
+    A_UINT32 valid_vdev_id;
+    /* VDEV to which the peer belongs to */
+    A_UINT32 vdev_id;
     /* This TLV is followed by another TLV of array of structs
      * wmi_peer_info peer_info[];
      */
@@ -9773,8 +10094,13 @@ typedef struct {
     /** extened RSSI info */
     A_UINT8  rssi_ext;
 
-    /** pmac_id for the radar event */
-    A_UINT8 pmac_id;
+    union {
+        A_UINT8 pmac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT8 pdev_id;
+    };
 
     /** index of peak magnitude bin (signed) */
     A_INT32 peak_sidx;
@@ -10018,6 +10344,455 @@ typedef struct {
      */
 } wmi_nan_event_hdr;
 
+/**
+ * Event to indicate NAN discovery interface created
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_nan_disc_iface_created_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** NAN interface MAC address */
+    wmi_mac_addr nan_interface_macaddr;
+} wmi_nan_disc_iface_created_event_fixed_param;
+
+/**
+ * Event to indicate NAN discovery interface deleted
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_nan_disc_iface_deleted_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+} wmi_nan_disc_iface_deleted_event_fixed_param;
+
+/**
+ * Event to indicate NAN device started new cluster
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_nan_started_cluster_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** NAN Cluster ID */
+    A_UINT32 nan_cluster_id;
+} wmi_nan_started_cluster_event_fixed_param;
+
+/**
+ * Event to indicate NAN device joined to cluster
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_nan_joined_cluster_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** NAN Cluster ID */
+    A_UINT32 nan_cluster_id;
+} wmi_nan_joined_cluster_event_fixed_param;
+
+/** NAN DATA CMD's */
+
+/**
+ * NAN Data get capabilities req
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndi_get_cap_req_fixed_param */
+    A_UINT32 tlv_header;
+    /** unique id generated in upper layer for the transaction */
+    A_UINT32 transaction_id;
+} wmi_ndi_get_cap_req_fixed_param;
+
+/**
+ * NDP configuration (Security and/or QOS)
+ */
+typedef struct {
+    A_UINT32 tag; /** WMI_NDP_CFG_TAG */
+    A_UINT32 ndp_cfg_len; /** ndp_cfg length in byte */
+    A_UINT32 ndp_cfg[1]; /** Security/QoS configuration */
+} wmi_ndp_cfg;
+
+/**
+ * NDP QOS configuration
+ */
+typedef struct {
+    A_UINT32 tag; /** WMI_NDP_QOS_CFG_TAG */
+    A_UINT32 ndp_qos_cfg_len; /** ndp_qos_cfg length in byte */
+    A_UINT32 ndp_qos_cfg[1]; /** QoS configuration */
+} wmi_ndp_qos_cfg;
+
+/**
+ * NDP application information
+ */
+typedef struct {
+    A_UINT32 tag; /** WMI_NDP_APP_INFO_TAG */
+    A_UINT32 ndp_app_info_len; /** ndp_app_info length in byte */
+    A_UINT32 ndp_app_info[1]; /** App/Service information */
+} wmi_ndp_app_info;
+
+/**
+ * NDP Response code
+ */
+typedef enum {
+    NDP_RSP_CODE_REQUEST_ACCEPT = 0x00,
+    NDP_RSP_CODE_REQUEST_REJECT = 0x01,
+    NDP_RSP_CODE_REQUEST_DEFER  = 0x02,
+} wmi_ndp_rsp_code;
+
+/**
+ * NDP Initiator requesting a data session
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndp_initiator_req_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** unique id generated in upper layer for the transaction */
+    A_UINT32 transaction_id;
+    /** Unique Instance Id identifying the Responder's service */
+    A_UINT32 service_instance_id;
+    /** Discovery MAC addr of the publisher/peer */
+    wmi_mac_addr peer_discovery_mac_addr;
+    /** Number of bytes in TLV wmi_ndp_cfg */
+    A_UINT32 ndp_cfg_len;
+    /** Number of bytes in TLV wmi_ndp_app_info */
+    A_UINT32 ndp_app_info_len;
+    /**
+     * TLV (tag length value ) parameters follow the ndp_initiator_req
+     * structure. The TLV's are:
+     * wmi_ndp_cfg ndp_cfg[];
+     * wmi_ndp_app_info ndp_app_info[];
+     */
+} wmi_ndp_initiator_req_fixed_param;
+
+/**
+ * Initiate a data response on the responder side
+ * for data request indication from the peer
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndp_responder_req_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** unique id generated in upper layer for the transaction */
+    A_UINT32 transaction_id;
+    /**
+     * Unique token Id generated on the initiator/responder
+     * side used for a NDP session between two NAN devices
+     */
+    A_UINT32 ndp_instance_id;
+    /** Response Code defined in wmi_ndp_rsp_code */
+    A_UINT32 rsp_code;
+    /** Number of bytes in TLV wmi_ndp_cfg */
+    A_UINT32 ndp_cfg_len;
+    /** Number of bytes in TLV wmi_ndp_app_info */
+    A_UINT32 ndp_app_info_len;
+    /**
+     * TLV (tag length value ) parameters follow the ndp_responder_req
+     * structure. The TLV's are:
+     * wmi_ndp_cfg ndp_cfg[];
+     * wmi_ndp_app_info ndp_app_info[];
+     */
+} wmi_ndp_responder_req_fixed_param;
+
+/**
+ * NDP end type
+ */
+typedef enum {
+    NDP_END_TYPE_UNSPECIFIED = 0x00,
+    NDP_END_TYPE_PEER_UNAVAILABLE = 0x01,
+    NDP_END_TYPE_OTA_FRAME = 0x02,
+} wmi_ndp_end_type;
+
+/**
+ * NDP end reason code
+ */
+typedef enum {
+    NDP_END_REASON_UNSPECIFIED = 0x00,
+    NDP_END_REASON_INACTIVITY = 0x01,
+    NDP_END_REASON_PEER_DATA_END = 0x02,
+} wmi_ndp_end_reason_code;
+
+/**
+ * NDP end request
+ */
+typedef struct {
+    /** reason_code  defined in  wmi_ndp_end_reason_code */
+    A_UINT32 reason_code;
+    /** NDP instance id */
+    A_UINT32 ndp_instance_id;
+} wmi_ndp_end_req;
+
+/**
+ * NDP end request list
+ */
+typedef struct {
+    A_UINT32 tag;/** WMI_NDP_END_REQ_LIST_TAG  */
+    A_UINT32 num_ndp_end_reqs; /** number of wmi_ndp_end_req */
+    wmi_ndp_end_req ndp_end_reqs[1];
+} wmi_ndp_end_req_list;
+
+/**
+ * NDP End request
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndp_end_req_fixed_param */
+    A_UINT32 tlv_header;
+    /** unique id generated in upper layer for the transaction */
+    A_UINT32 transaction_id;
+    /** Number of ndp instances in wmi_ndp_end_req_list */
+    A_UINT32 num_ndp_instances;
+    /** Number of bytes in TLV wmi_ndp_end_req_list */
+    A_UINT32 ndp_end_req_len;
+    /**
+     * TLV (tag length value ) parameters follow the ndp_end_req
+     * structure. The TLV's are:
+     * wmi_ndp_end_req wmi_ndp_end_req_list[];
+     */
+} wmi_ndp_end_req_fixed_param;
+
+/* NAN DATA RSP EVENTS */
+
+/**
+ * Event to indicate NAN Data Interface capabilities cmd
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndi_cap_rsp_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Copy of transaction_id received in wmi_ndi_get_cap_req */
+    A_UINT32 transaction_id;
+    /** Max ndi interface support */
+    A_UINT32 max_ndi_interfaces;
+    /** Max ndp per ndi support */
+    A_UINT32 max_ndp_per_ndi;
+    /** Max number of peer's per ndi */
+    A_UINT32 max_peers_per_ndi;
+} wmi_ndi_cap_rsp_event_fixed_param;
+
+/**
+ * NDP command response code
+ */
+typedef enum {
+    NDP_CMD_RSP_STATUS_SUCCESS = 0x00,
+    NDP_CMD_RSP_STATUS_ERROR = 0x01,
+} wmi_ndp_cmd_rsp_status;
+
+/**
+ * NDP command reason code
+ */
+typedef enum {
+    NDP_INVALID_VDEV_ID_PARAM = 0x00,
+    NDP_INVALID_SERVICE_INSTANCE_ID_PARAM = 0x01,
+    NDP_INVALID_PEER_DISC_MAC_ADDR_PARAM = 0x02,
+    NDP_INVALID_NDP_CFG_SECURITY_PARAM = 0x03,
+    NDP_INVALID_NDP_CFG_QOS_PARAM = 0x04,
+    NDP_INVALID_APP_INFO_LEN_PARAM = 0x05,
+    NDP_INVALID_NDP_INSTANCE_ID_PARAM = 0x06,
+    NDP_INVALID_RSP_CODE_PARAM = 0x07,
+} wmi_ndp_cmd_reason_code;
+
+/**
+ * Event response for wmi_ndp_initiator_req
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndp_initiator_rsp_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** Copy of transaction_id received in wmi_ndp_initiator_req */
+    A_UINT32 transaction_id;
+    /** Response status defined in wmi_ndp_cmd_rsp_status*/
+    A_UINT32 rsp_status;
+    /** Reason code defined in wmi_ndp_cmd_reason_code */
+    A_UINT32 reason_code;
+} wmi_ndp_initiator_rsp_event_fixed_param;
+
+/**
+ * Event response for wmi_ndp_responder_req cmd
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndp_responder_rsp_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** Copy of transaction_id received in wmi_ndp_responder_req */
+    A_UINT32 transaction_id;
+    /** Response status defined in wmi_ndp_cmd_rsp_status*/
+    A_UINT32 rsp_status;
+    /** Reason code defined in wmi_ndp_cmd_reason_code */
+    A_UINT32 reason_code;
+} wmi_ndp_responder_rsp_event_fixed_param;
+
+/**
+ * NDP end response per ndi
+ */
+typedef struct {
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** Peer MAC addr */
+    wmi_mac_addr peer_mac_addr;
+    /** Number of active ndps on this ndi */
+    A_UINT32 num_active_ndps_on_ndi;
+} wmi_ndp_end_rsp_per_ndi;
+
+/**
+ * NDP end response per ndi list
+ */
+typedef struct {
+    /** WMI_NDP_END_RSP_PER_NDI_LIST_TAG */
+    A_UINT32 tag;
+    /** Number of ndp_end_rsp_per_ndi */
+    A_UINT32 num_ndp_end_rsp_per_ndis;
+    wmi_ndp_end_rsp_per_ndi ndp_end_rsp_per_ndis[1];
+} wmi_ndp_end_rsp_per_ndi_list;
+
+/**
+ * Event response for wmi_ndp_end_req cmd
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndp_end_rsp_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Copy of transaction_id received in wmi_ndp_end_req */
+    A_UINT32 transaction_id;
+    /** Response status defined in wmi_ndp_cmd_rsp_status*/
+    A_UINT32 rsp_status;
+    /** Reason code defined in wmi_ndp_cmd_reason_code */
+    A_UINT32 reason_code;
+    /** Number of bytes in TLV wmi_ndp_end_rsp_per_ndi */
+    A_UINT32 data_end_req_rsp_len;
+    /**
+     * TLV (tag length value ) parameters follow the ndp_end_rsp
+     * structure. The TLV's are:
+     * wmi_ndp_end_rsp_per_ndi ndp_end_rsp_per_ndis[];
+     */
+} wmi_ndp_end_rsp_event_fixed_param;
+
+/** NAN DATA EVENTS */
+
+/**
+ * NDP self role
+ */
+typedef enum {
+    WMI_NDP_INITIATOR_ROLE,
+    WMI_NDP_RESPONDER_ROLE,
+} wmi_ndp_self_role;
+
+/**
+ * NDP accept policy
+ */
+typedef enum {
+    WMI_NDP_ACCEPT_POLICY_NONE,
+    WMI_NDP_ACCEPT_POLICY_ALL,
+} wmi_ndp_accept_policy;
+
+/**
+ * Event indication received on the responder side when a NDP Initiator request/
+ * NDP session is initiated on the Initiator side (self role will be NDP_RESPONDER_ROLE)
+ *
+ * Event indication received on the initiator side when a
+ * NDP responder request on the Initiator side (self role will be NDP_INITIATOR_ROLE)
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndp_indication_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** Self NDP Role defined in wmi_ndp_self_role */
+    A_UINT32 self_ndp_role;
+    /** Accept policy defined in wmi_ndp_accept_policy */
+    A_UINT32 accept_policy;
+    /** Unique Instance Id corresponding to a service/session. */
+    A_UINT32 service_instance_id;
+    /** Discovery MAC addr of the peer/initiator */
+    wmi_mac_addr peer_disc_mac_addr;
+    /**
+     * Unique token Id generated on the initiator/responder
+     * side used for a NDP session between two NAN devices
+     */
+    A_UINT32 ndp_instance_id;
+    /** Number of bytes in TLV wmi_ndp_cfg */
+    A_UINT32 ndp_cfg_len;
+    /** Number of bytes in TLV wmi_ndp_app_info */
+    A_UINT32 ndp_app_info_len;
+    /**
+     * TLV (tag length value ) parameters follow the ndp_indication
+     * structure. The TLV's are:
+     * wmi_ndp_cfg ndp_cfg[];
+     * wmi_ndp_app_info ndp_app_info[];
+     */
+} wmi_ndp_indication_event_fixed_param;
+
+/**
+ * Event indication of data confirm is received on both
+ * initiator and responder side confirming a NDP session
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndp_confirm_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /**
+     * Unique token Id generated on the initiator/responder
+     * side used for a NDP session between two NAN devices
+     */
+    A_UINT32 ndp_instance_id;
+    /** NDI mac address of the peer (required to derive target ipv6 address) */
+    wmi_mac_addr peer_ndi_mac_addr;
+    /** Response Code defined in wmi_ndp_rsp_code */
+    A_UINT32 rsp_code;
+    /** Number of bytes in TLV wmi_ndp_cfg */
+    A_UINT32 ndp_cfg_len;
+    /** Number of bytes in TLV wmi_ndp_app_info */
+    A_UINT32 ndp_app_info_len;
+    /**
+     * TLV (tag length value ) parameters follow the ndp_confirm
+     * structure. The TLV's are:
+     * wmi_ndp_cfg ndp_cfg[];
+     * wmi_ndp_app_info ndp_app_info[];
+     */
+} wmi_ndp_confirm_event_fixed_param;
+
+/**
+ * NDP end indication
+ */
+typedef struct {
+    /** type defined in  wmi_ndp_end_type */
+    A_UINT32 type;
+    /** reason_code  defined in  wmi_ndp_end_reason_code */
+    A_UINT32 reason_code;
+    /** NDP instance id */
+    A_UINT32 ndp_instance_id;
+} wmi_ndp_end_indication;
+
+/**
+ * NDP end indication list
+ */
+typedef struct {
+    /** WMI_NDP_END_INDICATION_LIST_TAG */
+    A_UINT32 tag;
+    /** Number of ndp_end_rsp_per_ndi */
+    A_UINT32 num_ndp_end_indications;
+    wmi_ndp_end_indication ndp_end_indications[1];
+} wmi_ndp_end_indication_list;
+
+/**
+ * Event indication received on the initiator/responder side terminating a NDP session
+ */
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_ndp_end_indication_event_fixed_param */
+    A_UINT32 tlv_header;
+    /** Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /** Number of ndp instances in wmi_ndp_end_indication */
+    A_UINT32 num_ndp_instances;
+    /** Number of bytes in TLV wmi_ndp_end_indication */
+    A_UINT32 data_end_event_len;
+    /**
+     * TLV (tag length value ) parameters follow the ndp_end_indication
+     * structure. The TLV's are:
+     * wmi_ndp_end_indication ndp_end_indications[];
+     */
+} wmi_ndp_end_indication_event_fixed_param;
+
 typedef struct {
     A_UINT32 tlv_header;
     A_UINT32 num_data;
@@ -10141,6 +10916,10 @@ typedef struct {
     A_UINT32 tlv_header;
     /** MAC address of the peer for which the estimated link speed is required. */
     wmi_mac_addr peer_macaddr;
+    /* Set to 1 only if vdev_id field is valid */
+    A_UINT32 valid_vdev_id;
+    /* VDEV to which the peer belongs to */
+    A_UINT32 vdev_id;
 } wmi_peer_get_estimated_linkspeed_cmd_fixed_param;
 
 typedef struct {
@@ -10153,6 +10932,10 @@ typedef struct {
    * When est_linkspeed_kbps is not valid, the value is set to WMI_PEER_ESTIMATED_LINKSPEED_INVALID.
    */
     A_UINT32 est_linkspeed_kbps;
+    /* Set to 1 only if vdev_id field is valid */
+    A_UINT32 valid_vdev_id;
+    /* VDEV to which the peer belongs to */
+    A_UINT32 vdev_id;
 } wmi_peer_estimated_linkspeed_event_fixed_param;
 
 typedef struct {
@@ -11047,7 +11830,10 @@ typedef struct{
 /** WMI_PDEV_RESUME_EVENTID : generated in response to WMI_PDEV_RESUME_CMDID */
 typedef struct {
     A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_resume_event_fixed_param  */
-    A_UINT32 rsvd;  /* for future need */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
 } wmi_pdev_resume_event_fixed_param;
 
 
@@ -11133,11 +11919,19 @@ typedef struct {
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_get_temperature_cmd_fixed_param  */
     A_UINT32 param;     /* Reserved for future use */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
 } wmi_pdev_get_temperature_cmd_fixed_param;
 
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_temperature_event_fixed_param */
     A_INT32  value;     /* temprature value in Celcius degree */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
 } wmi_pdev_temperature_event_fixed_param;
 
 typedef struct {
@@ -12232,6 +13026,7 @@ typedef struct {
     * A_UINT8 ie_data[]; */
 } wmi_vdev_set_ie_cmd_fixed_param;
 
+/* DEPRECATED - use wmi_pdev_set_pcl_cmd_fixed_param instead */
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_soc_set_pcl_cmd_fixed_param */
     /** Set Preferred Channel List  **/
@@ -12246,6 +13041,25 @@ typedef struct {
 } wmi_soc_set_pcl_cmd_fixed_param;
 
 typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_pcl_cmd_fixed_param */
+    /** Set Preferred Channel List  **/
+
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
+    /** # of channels to scan */
+    A_UINT32 num_chan;
+/**
+ * TLV (tag length value ) parameters follow the wmi_soc_set_pcl_cmd
+ * structure. The TLV's are:
+ *     A_UINT32 channel_weight[];  channel order & size will be as per the list provided in WMI_SCAN_CHAN_LIST_CMDID
+ **/
+} wmi_pdev_set_pcl_cmd_fixed_param;
+
+/* DEPRECATED - use wmi_pdev_set_hw_mode_cmd_fixed_param instead */
+typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_soc_set_hw_mode_cmd_fixed_param */
     /**  Set Hardware Mode  **/
 
@@ -12254,6 +13068,20 @@ typedef struct {
 } wmi_soc_set_hw_mode_cmd_fixed_param;
 
 typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_cmd_fixed_param */
+    /**  Set Hardware Mode  **/
+
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
+    /* Hardware Mode Index */
+    A_UINT32 hw_mode_index;
+} wmi_pdev_set_hw_mode_cmd_fixed_param;
+
+/* DEPRECATED - use wmi_pdev_set_dual_mac_config_cmd_fixed_param instead */
+typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_soc_set_dual_mac_config_cmd_fixed_param */
     /**  Set Dual MAC Firmware Configuration  **/
 
@@ -12261,10 +13089,24 @@ typedef struct {
     A_UINT32 concurrent_scan_config_bits;
     /* Firmware mode configuration bits */
     A_UINT32 fw_mode_config_bits;
-
 } wmi_soc_set_dual_mac_config_cmd_fixed_param;
 
 typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_mac_config_cmd_fixed_param */
+    /**  Set Dual MAC Firmware Configuration  **/
+
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
+    /* Concurrent scan configuration bits */
+    A_UINT32 concurrent_scan_config_bits;
+    /* Firmware mode configuration bits */
+    A_UINT32 fw_mode_config_bits;
+} wmi_pdev_set_mac_config_cmd_fixed_param;
+
+typedef struct { /* DEPRECATED */
     A_UINT32 num_tx_chains;
     A_UINT32 num_rx_chains;
     A_UINT32 reserved[2];
@@ -12288,6 +13130,7 @@ typedef enum {
     /* reserved */
 } antenna_mode_reason;
 
+/* DEPRECATED - use wmi_pdev_set_antenna_mode_cmd_fixed_param instead */
 typedef struct {
     /*
      * TLV tag and len;
@@ -12305,8 +13148,20 @@ typedef struct {
     antenna_num_tx_rx_chains num_txrx_chains_setting;
 } wmi_soc_set_antenna_mode_cmd_fixed_param;
 
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len;  tag equals WMITLV_TAG_STRUC_wmi_pdev_set_antenna_mode_cmd_fixed_param */
+
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
+    /* Bits 0-15 is the number of RX chains and 16-31 is the number of TX chains */
+    A_UINT32 num_txrx_chains;
+} wmi_pdev_set_antenna_mode_cmd_fixed_param;
 
 /** Data structure for information specific to a VDEV to MAC mapping. */
+/* DEPRECATED - use wmi_pdev_set_hw_mode_response_vdev_mac_entry instead */
 typedef struct {
     /** TLV tag and len; tag equals
      * WMITLV_TAG_STRUC_wmi_soc_set_hw_mode_response_vdev_mac_entry */
@@ -12315,6 +13170,21 @@ typedef struct {
     A_UINT32 mac_id; /* MAC ID */
 } wmi_soc_set_hw_mode_response_vdev_mac_entry;
 
+/** Data structure for information specific to a VDEV to MAC mapping. */
+typedef struct {
+    /** TLV tag and len; tag equals
+     * WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_response_vdev_mac_entry */
+    A_UINT32 tlv_header;
+
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
+    A_UINT32 vdev_id;
+} wmi_pdev_set_hw_mode_response_vdev_mac_entry;
+
+/* DEPRECATED - use wmi_pdev_set_hw_mode_response_event_fixed_param instead */
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_soc_set_hw_mode_response_event_fixed_param */
     /**  Set Hardware Mode Response Event  **/
@@ -12344,6 +13214,39 @@ typedef struct {
 } wmi_soc_set_hw_mode_response_event_fixed_param;
 
 typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_hw_mode_response_event_fixed_param */
+    /**  Set Hardware Mode Response Event  **/
+
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
+    /* Status of set_hw_mode command */
+    /*
+     * Values for Status:
+     *  0 - OK; command successful
+     *  1 - EINVAL; Requested invalid hw_mode
+     *  2 - ECANCELED; HW mode change canceled
+     *  3 - ENOTSUP; HW mode not supported
+     *  4 - EHARDWARE; HW mode change prevented by hardware
+     *  5 - EPENDING; HW mode change is pending
+     *  6 - ECOEX; HW mode change conflict with Coex
+     */
+    A_UINT32 status;
+    /* Configured Hardware Mode */
+    A_UINT32 cfgd_hw_mode_index;
+    /* Number of Vdev to Mac entries */
+    A_UINT32 num_vdev_mac_entries;
+/**
+ * TLV (tag length value ) parameters follow the soc_set_hw_mode_response_event
+ * structure. The TLV's are:
+ *      A_UINT32 wmi_soc_set_hw_mode_response_vdev_mac_entry[];
+ */
+} wmi_pdev_set_hw_mode_response_event_fixed_param;
+
+/* DEPRECATED - use wmi_pdev_hw_mode_transition_event_fixed_param instead */
+typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_soc_hw_mode_transition_event_fixed_param */
     /**  Hardware Mode Transition Event **/
 
@@ -12361,7 +13264,30 @@ typedef struct {
  */
 } wmi_soc_hw_mode_transition_event_fixed_param;
 
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_hw_mode_transition_event_fixed_param */
+    /**  Hardware Mode Transition Event **/
+
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
+    /* Original or old Hardware mode */
+    A_UINT32 old_hw_mode_index;
+    /* New Hardware Mode */
+    A_UINT32 new_hw_mode_index;
+    /* Number of Vdev to Mac entries */
+    A_UINT32 num_vdev_mac_entries;
 
+/**
+ * TLV (tag length value ) parameters follow the soc_set_hw_mode_response_event
+ * structure. The TLV's are:
+ *      A_UINT32 wmi_soc_set_hw_mode_response_vdev_mac_entry[];
+ */
+} wmi_pdev_hw_mode_transition_event_fixed_param;
+
+/* DEPRECATED - use wmi_pdev_set_mac_config_response_event_fixed_param instead */
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_soc_set_dual_mac_config_response_event_fixed_param */
     /**  Set Dual MAC Config Response Event  **/
@@ -12379,6 +13305,27 @@ typedef struct {
 
 } wmi_soc_set_dual_mac_config_response_event_fixed_param;
 
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_mac_config_response_event_fixed_param */
+    /**  Set Dual MAC Config Response Event  **/
+
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+
+    /* Status for set_dual_mac_config command */
+    /*
+     * Values for Status:
+     *  0 - OK; command successful
+     *  1 - EINVAL; Requested invalid hw_mode
+     *  3 - ENOTSUP; HW mode not supported
+     *  4 - EHARDWARE; HW mode change prevented by hardware
+     *  6 - ECOEX; HW mode change conflict with Coex
+     */
+     A_UINT32 status;
+} wmi_pdev_set_mac_config_response_event_fixed_param;
+
 typedef enum {
     MAWC_MOTION_STATE_UNKNOWN,
     MAWC_MOTION_STATE_STATIONARY,
@@ -12771,6 +13718,22 @@ typedef struct {
     A_UINT32 status;
 } wmi_transfer_data_to_flash_complete_event_fixed_param;
 
+typedef enum {
+    ENHANCED_MCAST_FILTER_DISABLED,
+    ENHANCED_MCAST_FILTER_ENABLED
+} ENHANCED_MCAST_FILTER_CONFIG;
+
+/*
+ * Command to enable/disable filtering of multicast IP with unicast mac
+ */
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_config_enhanced_mcast_filter_fixed_param */
+    /* Unique id identifying the VDEV */
+    A_UINT32 vdev_id;
+    /* 1 = enable 0 = disable (see ENHANCED_MCAST_FILTER_CONFIG) */
+    A_UINT32 enable;
+} wmi_config_enhanced_mcast_filter_cmd_fixed_param;
+
 /*
  * This structure is used to report SMPS force mode set complete to host.
  */
@@ -12861,7 +13824,13 @@ typedef struct wmi_bpf_del_vdev_instructions_cmd_s {
 /* WMI_PDEV_FIPS_CMDID */
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_fips_cmd_fixed_param */
-    A_UINT32 mac_id;              /* MAC ID */
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     A_UINT32 fips_cmd;            /* FIPS_ENCRYPT or FIPS_DECRYPT */
     A_UINT32 mode;                /* FIPS_ENGINE_AES_CTR or FIPS_ENGINE_AES_MIC */
     A_UINT32 key_len;             /* FIPS_KEY_LENGTH_128 or FIPS_KEY_LENGTH_256 (units = bytes) */
@@ -12875,7 +13844,13 @@ typedef struct {
 
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_smart_ant_enable_cmd_fixed_param */
-    A_UINT32 mac_id;              /* MAC ID */
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     A_UINT32 enable;              /* 1:enable, 0:disable */
     A_UINT32 mode;                /* 1:GPIO parallel mode, 0:GPIO serial mode */
     A_UINT32 rx_antenna;          /* rx antenna */
@@ -12891,18 +13866,28 @@ typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_smart_ant_gpio_handle */
     A_UINT32 gpio_pin;   /* For serial: index 0-strobe index 1-data, For Parallel: per stream */
     A_UINT32 gpio_func;  /* GPIO function values for Smart Antenna */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
 } wmi_pdev_smart_ant_gpio_handle;
 
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_smart_ant_set_rx_antenna_cmd_fixed_param */
-    A_UINT32 mac_id;
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     A_UINT32 rx_antenna;
 } wmi_pdev_smart_ant_set_rx_antenna_cmd_fixed_param;
 
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_peer_smart_ant_set_tx_antenna_cmd_fixed_param */
     /** unique id identifying the vdev, generated by the caller */
-    A_UINT32 vdev_id;
+    A_UINT32 vdev_id; /* ID of the vdev this peer belongs to */
     /** peer MAC address */
     wmi_mac_addr peer_macaddr;
    /*
@@ -12931,7 +13916,7 @@ typedef struct {
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_peer_smart_ant_set_train_antenna_cmd_fixed_param */
     /** unique id identifying the VDEV, generated by the caller */
-    A_UINT32 vdev_id;
+    A_UINT32 vdev_id; /* ID of the vdev this peer belongs to */
     /** peer MAC address */
     wmi_mac_addr peer_macaddr;
     /* num packets; 0-stop training */
@@ -12945,7 +13930,7 @@ typedef struct {
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_peer_smart_ant_set_node_config_ops_cmd_fixed_param */
     /** unique id identifying the vdev, generated by the caller */
-    A_UINT32 vdev_id;
+    A_UINT32 vdev_id; /* ID of the vdev this peer belongs to */
     /** peer MAC address */
     wmi_mac_addr peer_macaddr;
     /* command id*/
@@ -12961,6 +13946,10 @@ typedef struct {
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_ant_ctrl_chain */
     A_UINT32 antCtrlChain;
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
 } wmi_pdev_set_ant_ctrl_chain;
 
 typedef struct {
@@ -12976,7 +13965,13 @@ typedef struct {
 
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_ctl_table_cmd_fixed_param */
-    A_UINT32 mac_id;     /* MAC ID */
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     /** len of CTL info */
     A_UINT32 ctl_len;
     /* ctl array (len adjusted to  number of words).
@@ -12987,7 +13982,13 @@ typedef struct {
 
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_set_mimogain_table_cmd_fixed_param */
-    A_UINT32 mac_id;     /* MAC ID */
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     A_UINT32 mimogain_info; /* see WMI_MIMOGAIN macros */
     /*
      * Bit 7:0 len of array gain table
@@ -13048,21 +14049,27 @@ typedef struct {
 
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_get_ani_cck_config_cmd_fixed_param */
-    A_UINT32 mac_id;     /* MAC ID */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
     /** parameter   */
     A_UINT32 param;
 } wmi_pdev_get_ani_cck_config_cmd_fixed_param;
 
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_get_ani_ofdm_config_cmd_fixed_param */
-    A_UINT32 mac_id;     /* MAC ID */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
     /** parameter   */
     A_UINT32 param;
 } wmi_pdev_get_ani_ofdm_config_cmd_fixed_param;
 
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_WMI_QBOOST_CFG_CMD_fixed_param */
-    A_UINT32 vdev_id;
+    A_UINT32 vdev_id; /* ID of the vdev this peer belongs to */
     A_UINT32 qb_enable;
     wmi_mac_addr peer_macaddr;
 } WMI_QBOOST_CFG_CMD_fixed_param;
@@ -13074,6 +14081,7 @@ typedef struct {
     A_UINT32 iRSSI; /* dBm above the noise floor */
     /* peer MAC address */
     wmi_mac_addr peer_macaddr;
+    A_UINT32 vdev_id; /* ID of the vdev this peer belongs to */
 } wmi_inst_rssi_stats_resp_fixed_param;
 
 typedef struct {
@@ -13092,6 +14100,7 @@ typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_peer_ratecode_list_event_fixed_param */
     wmi_mac_addr peer_macaddr;
     A_UINT32 ratecount; /* Max Rate count for each mode */
+    A_UINT32 vdev_id; /* ID of the vdev this peer belongs to */
     /*
      * Following this structure are the TLV:
      * struct wmi_peer_cck_ofdm_rate_info;
@@ -13104,6 +14113,7 @@ typedef struct wmi_wds_addr_event {
     A_UINT32 event_type[4];
     wmi_mac_addr peer_mac;
     wmi_mac_addr dest_mac;
+    A_UINT32 vdev_id; /* ID of the vdev this peer belongs to */
 } wmi_wds_addr_event_fixed_param;
 
 typedef struct {
@@ -13115,7 +14125,13 @@ typedef struct {
 /* WMI_PDEV_FIPS_EVENTID */
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_fips_event_fixed_param */
-    A_UINT32 mac_id;       /* MAC ID */
+    union {
+        A_UINT32 mac_id; // OBSOLETE - will be removed once all refs are gone
+        /** pdev_id for identifying the MAC
+         * See macros starting with WMI_PDEV_ID_ for values.
+         */
+        A_UINT32 pdev_id;
+    };
     A_UINT32 error_status; /* Error status: 0 (no err), 1, or OPER_TIMEOUT */
     A_UINT32 data_len;     /* Data length */
    /*
@@ -13246,6 +14262,20 @@ typedef struct {
     A_UINT32 ofdm_level;
 } wmi_ani_ofdm_event_fixed_param;
 
+typedef enum wmi_coex_config_type {
+    WMI_COEX_CONFIG_PAGE_P2P_TDM = 1, /* config interval (arg1 BT, arg2 WLAN) for P2P + PAGE */
+    WMI_COEX_CONFIG_PAGE_STA_TDM = 2, /* config interval (arg1 BT, arg2 WLAN) for STA + PAGE */
+    WMI_COEX_CONFIG_PAGE_SAP_TDM = 3, /* config interval (arg1 BT, arg2 WLAN) for SAP + PAGE */
+} WMI_COEX_CONFIG_TYPE;
+
+typedef struct {
+    A_UINT32 tlv_header;
+    A_UINT32 vdev_id;
+    A_UINT32 config_type; /* wmi_coex_config_type enum */
+    A_UINT32 config_arg1;
+    A_UINT32 config_arg2;
+} WMI_COEX_CONFIG_CMD_fixed_param;
+
 /* ADD NEW DEFS HERE */
 
 /*****************************************************************************
diff --git a/CORE/SERVICES/COMMON/wmi_version.h b/CORE/SERVICES/COMMON/wmi_version.h
index 763cc9bbbcd0..f3d9a0a0d34b 100644
--- a/CORE/SERVICES/COMMON/wmi_version.h
+++ b/CORE/SERVICES/COMMON/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 205
+#define __WMI_REVISION_ 214
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work
diff --git a/CORE/SERVICES/DFS/src/dfs_process_phyerr.c b/CORE/SERVICES/DFS/src/dfs_process_phyerr.c
index a5cb6afec4a5..34b6a018ada2 100644
--- a/CORE/SERVICES/DFS/src/dfs_process_phyerr.c
+++ b/CORE/SERVICES/DFS/src/dfs_process_phyerr.c
@@ -745,11 +745,11 @@ dfs_process_phyerr(struct ieee80211com *ic, void *buf, u_int16_t datalen,
     */
    ATH_DFSEVENTQ_LOCK(dfs);
    empty = STAILQ_EMPTY(&(dfs->dfs_eventq));
-   ATH_DFSEVENTQ_UNLOCK(dfs);
    if (empty) {
+      ATH_DFSEVENTQ_UNLOCK(dfs);
       return;
    }
-
+   ATH_DFSEVENTQ_UNLOCK(dfs);
    /*
     * If the channel is a turbo G channel, then the event is
     * for the adaptive radio (AR) pattern matching rather than
diff --git a/CORE/SERVICES/HIF/PCIe/if_pci.c b/CORE/SERVICES/HIF/PCIe/if_pci.c
index 05dcdeeb1bd1..d53fdd06f3f3 100644
--- a/CORE/SERVICES/HIF/PCIe/if_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/if_pci.c
@@ -2438,6 +2438,7 @@ void hif_pci_shutdown(struct pci_dev *pdev)
     void __iomem *mem;
     struct hif_pci_softc *sc;
     struct ol_softc *scn;
+    struct HIF_CE_state *hif_state;
 
     sc = pci_get_drvdata(pdev);
     /* Attach did not succeed, all resources have been
@@ -2446,6 +2447,8 @@ void hif_pci_shutdown(struct pci_dev *pdev)
     if (!sc)
         return;
 
+    hif_state = (struct HIF_CE_state *)sc->hif_device;
+
     if (vos_is_load_unload_in_progress(VOS_MODULE_ID_HIF, NULL)) {
         printk("Load/unload in progress, ignore SSR shutdown\n");
         return;
@@ -2460,7 +2463,10 @@ void hif_pci_shutdown(struct pci_dev *pdev)
     scn = sc->ol_sc;
 
     hif_disable_isr(scn);
-    hif_pci_device_reset(sc);
+    adf_os_spin_lock_irqsave(&hif_state->suspend_lock);
+    if (!adf_os_atomic_read(&sc->pci_link_suspended))
+        hif_pci_device_reset(sc);
+    adf_os_spin_unlock_irqrestore(&hif_state->suspend_lock);
 
 #ifndef REMOVE_PKT_LOG
     if (vos_get_conparam() != VOS_FTM_MODE &&
diff --git a/CORE/SERVICES/HIF/common/hif_bmi_reg_access.c b/CORE/SERVICES/HIF/common/hif_bmi_reg_access.c
index 7e6918d873c8..0220b208002c 100644
--- a/CORE/SERVICES/HIF/common/hif_bmi_reg_access.c
+++ b/CORE/SERVICES/HIF/common/hif_bmi_reg_access.c
@@ -298,13 +298,8 @@ A_STATUS HIFRegBasedGetTargetInfo(HIF_DEVICE *device, struct bmi_target_info *ta
 
     status = bmiBufferSend(device, (A_UCHAR *)&cid, sizeof(cid));
     if (status != A_OK) {
-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device, try again.\n"));
-        mdelay(100);
-        status = bmiBufferSend(device, (A_UCHAR *)&cid, sizeof(cid));
-        if (status != A_OK) {
-            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Still unable to write to the device!\n"));
-            return A_ERROR;
-        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device.\n"));
+        return A_ERROR;
     }
 
     status = bmiBufferReceive(device, (A_UCHAR *)&targ_info->target_ver,
diff --git a/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c b/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c
index aaaef2985582..19ca9bee8511 100644
--- a/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c
+++ b/CORE/SERVICES/HIF/sdio/linux/if_ath_sdio.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -48,6 +48,7 @@
 #include "vos_api.h"
 #include "vos_sched.h"
 #include "regtable.h"
+#include "wlan_hdd_power.h"
 
 #ifndef REMOVE_PKT_LOG
 #include "ol_txrx_types.h"
@@ -76,14 +77,6 @@ extern void __hdd_wlan_exit(void);
 struct ath_hif_sdio_softc *sc = NULL;
 
 #ifdef CONFIG_CNSS_SDIO
-static void hif_crash_indication(void)
-{
-	if (vos_is_crash_indication_pending()) {
-		vos_set_crash_indication_pending(false);
-		wlan_hdd_send_svc_nlink_msg(WLAN_SVC_FW_CRASHED_IND, NULL, 0);
-	}
-}
-
 static inline void *hif_get_virt_ramdump_mem(unsigned long *size)
 {
 	return cnss_get_virt_ramdump_mem(size);
@@ -93,9 +86,6 @@ static inline void hif_release_ramdump_mem(unsigned long *address)
 {
 }
 #else
-static void hif_crash_indication(void)
-{
-}
 #ifndef TARGET_DUMP_FOR_NON_QC_PLATFORM
 static inline void *hif_get_virt_ramdump_mem(unsigned long *size)
 {
@@ -230,14 +220,19 @@ ath_hif_sdio_probe(void *context, void *hif_handle)
         goto err_attach1;
     }
     ret = hif_init_adf_ctx(ol_sc);
-    if (ret == 0)
-        ret = hdd_wlan_startup(&(func->dev), ol_sc);
+    if (ret == 0) {
+        if (vos_is_logp_in_progress(VOS_MODULE_ID_HIF, NULL)) {
+            ret = hdd_wlan_re_init(ol_sc);
+            vos_set_logp_in_progress(VOS_MODULE_ID_HIF, FALSE);
+        } else{
+            ret = hdd_wlan_startup(&(func->dev), ol_sc);
+        }
+    }
     if ( ret ) {
         VOS_TRACE(VOS_MODULE_ID_HIF, VOS_TRACE_LEVEL_FATAL," hdd_wlan_startup failed");
         goto err_attach2;
     }else{
         VOS_TRACE(VOS_MODULE_ID_HIF, VOS_TRACE_LEVEL_INFO," hdd_wlan_startup success!");
-        hif_crash_indication();
     }
 
     return 0;
@@ -295,8 +290,11 @@ ath_hif_sdio_remove(void *context, void *hif_handle)
 #endif
 
     //cleaning up the upper layers
-    __hdd_wlan_exit();
-
+    if (vos_is_logp_in_progress(VOS_MODULE_ID_HIF, NULL)) {
+        hdd_wlan_shutdown();
+    } else {
+        __hdd_wlan_exit();
+    }
     if (sc && sc->ol_sc){
        hif_deinit_adf_ctx(sc->ol_sc);
        A_FREE(sc->ol_sc);
diff --git a/CORE/SERVICES/HIF/sdio/linux/native_sdio/include/hif_internal.h b/CORE/SERVICES/HIF/sdio/linux/native_sdio/include/hif_internal.h
index 382e38c1b92e..6199746ac33f 100644
--- a/CORE/SERVICES/HIF/sdio/linux/native_sdio/include/hif_internal.h
+++ b/CORE/SERVICES/HIF/sdio/linux/native_sdio/include/hif_internal.h
@@ -86,6 +86,15 @@ struct hif_device {
     struct completion async_completion;          /* thread completion */
     BUS_REQUEST   *asyncreq;                    /* request for async tasklet */
     BUS_REQUEST *taskreq;                       /*  async tasklet data */
+#ifdef TX_COMPLETION_THREAD
+    struct task_struct *tx_completion_task;
+    struct semaphore sem_tx_completion;
+    int    tx_completion_shutdown;
+    struct completion tx_completion_exit;
+    spinlock_t tx_completion_lock;
+    BUS_REQUEST *tx_completion_req;
+    BUS_REQUEST **last_tx_completion;
+#endif
     spinlock_t lock;
     BUS_REQUEST *s_busRequestFreeQueue;         /* free list */
     BUS_REQUEST busRequest[BUS_REQUEST_MAX_NUM]; /* available bus requests */
diff --git a/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c b/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c
index 5b28826ddf84..d280e05e6808 100644
--- a/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c
+++ b/CORE/SERVICES/HIF/sdio/linux/native_sdio/src/hif.c
@@ -671,6 +671,269 @@ HIFReadWrite(HIF_DEVICE *device,
 
     return status;
 }
+
+/**
+ * _hif_free_bus_request() - Free the bus access request
+ * @device:    device handle.
+ * @request:   bus access request.
+ *
+ * This is the legacy method to handle an asynchronous bus request.
+ *
+ * Return: None.
+ */
+static inline void _hif_free_bus_request(HIF_DEVICE *device,
+				BUS_REQUEST *request)
+{
+	A_STATUS status = request->status;
+	void *context = request->context;
+
+	AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+		("AR6000: async_task freeing req: 0x%lX\n",
+		(unsigned long)request));
+	hifFreeBusRequest(device, request);
+	AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+		("AR6000: async_task completion routine req: 0x%lX\n",
+		(unsigned long)request));
+	device->htcCallbacks.rwCompletionHandler(context, status);
+}
+
+#ifdef TX_COMPLETION_THREAD
+/**
+ * add_to_tx_completion_list() - Queue a TX completion handler
+ * @device:    context to the hif device.
+ * @tx_comple: SDIO bus access request.
+ *
+ * This function adds an sdio bus access request to the
+ * TX completion list.
+ *
+ * Return: No return.
+ */
+static void add_to_tx_completion_list(HIF_DEVICE *device,
+		BUS_REQUEST *tx_comple)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&device->tx_completion_lock, flags);
+	tx_comple->inusenext = NULL;
+	*device->last_tx_completion = tx_comple;
+	device->last_tx_completion = &tx_comple->inusenext;
+	spin_unlock_irqrestore(&device->tx_completion_lock, flags);
+}
+
+/**
+ * tx_clean_completion_list() - Clean the TX completion request list
+ * @device:  HIF device handle.
+ *
+ * Function to clean the TX completion list.
+ *
+ * Return: No
+ */
+static void tx_clean_completion_list(HIF_DEVICE *device)
+{
+	unsigned long flags;
+	BUS_REQUEST *comple;
+	BUS_REQUEST *request;
+
+	spin_lock_irqsave(&device->tx_completion_lock, flags);
+	request = device->tx_completion_req;
+	device->tx_completion_req = NULL;
+	device->last_tx_completion = &device->tx_completion_req;
+	spin_unlock_irqrestore(&device->tx_completion_lock, flags);
+
+	while (request != NULL) {
+		comple = request->inusenext;
+		_hif_free_bus_request(device, request);
+		request = comple;
+	}
+
+}
+
+/**
+ * tx_completion_task() - Thread to process TX completion
+ * @param:   context to the hif device.
+ *
+ * This is the TX completion thread.
+ *
+ * Once TX completion message is received, completed TX
+ * request will be queued in a tx_comple list and processed
+ * in this thread.
+ *
+ * Return: 0 thread exits
+ */
+static int tx_completion_task(void *param)
+{
+	HIF_DEVICE *device;
+
+	device = (HIF_DEVICE *)param;
+	AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: tx completion task\n"));
+	set_current_state(TASK_INTERRUPTIBLE);
+
+	while (!device->tx_completion_shutdown) {
+		if (down_interruptible(&device->sem_tx_completion) != 0) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+				("%s: tx completion task interrupted\n",
+				 __func__));
+			break;
+		}
+
+		if (device->tx_completion_shutdown) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+				("%s: tx completion task stopping\n",
+				 __func__));
+			break;
+		}
+
+		while (device->tx_completion_req != NULL)
+			tx_clean_completion_list(device);
+	}
+
+	while (device->tx_completion_req != NULL)
+		tx_clean_completion_list(device);
+
+	complete_and_exit(&device->tx_completion_exit, 0);
+	return 0;
+}
+
+/**
+ * tx_completion_sem_init() - initialize tx completion semaphore
+ * @device:  device handle.
+ *
+ * Initialize semaphore for TX completion thread's synchronization.
+ *
+ * Return: None.
+ */
+static inline void tx_completion_sem_init(HIF_DEVICE *device)
+{
+	sema_init(&device->sem_tx_completion, 0);
+}
+
+/**
+ * hif_free_bus_request() - Function to free bus requests
+ * @device:    device handle.
+ * @request:   SIDO bus access request.
+ *
+ * If there is an completion thread, all the completed bus access requests
+ * will be queued in a completion list. Otherwise, the legacy handler will
+ * be called.
+ *
+ * Return: None.
+ */
+static inline void hif_free_bus_request(HIF_DEVICE *device,
+			BUS_REQUEST *request)
+{
+	if (!device->tx_completion_shutdown) {
+		add_to_tx_completion_list(device, request);
+		up(&device->sem_tx_completion);
+	} else {
+		_hif_free_bus_request(device, request);
+	}
+}
+
+/**
+ * hif_start_tx_completion_thread() - Create and start the TX compl thread
+ * @device:   device handle.
+ *
+ * This function will create the tx completion thread.
+ *
+ * Return: A_OK     thread created.
+ *         A_ERROR  thread not created.
+ */
+static inline int hif_start_tx_completion_thread(HIF_DEVICE *device)
+{
+	if (!device->tx_completion_task) {
+		device->tx_completion_req = NULL;
+		device->last_tx_completion = &device->tx_completion_req;
+		device->tx_completion_shutdown = 0;
+		device->tx_completion_task = kthread_create(tx_completion_task,
+			(void *)device,	"AR6K TxCompletion");
+		if (IS_ERR(device->tx_completion_task)) {
+			device->tx_completion_shutdown = 1;
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+			("AR6000: fail to create tx_comple task\n"));
+			device->tx_completion_task = NULL;
+			return A_ERROR;
+		}
+		AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+			("AR6000: start tx_comple task\n"));
+		wake_up_process(device->tx_completion_task);
+	}
+	return A_OK;
+}
+
+/*
+ * hif_stop_tx_completion_thread() - Destroy the tx compl thread
+ * @device: device handle.
+ *
+ * This function will destroy the TX completion thread.
+ *
+ * Return: None.
+ */
+static inline void hif_stop_tx_completion_thread(HIF_DEVICE *device)
+{
+	if (device->tx_completion_task) {
+		init_completion(&device->tx_completion_exit);
+		device->tx_completion_shutdown = 1;
+		up(&device->sem_tx_completion);
+		wait_for_completion(&device->tx_completion_exit);
+		device->tx_completion_task = NULL;
+		sema_init(&device->sem_tx_completion, 0);
+	}
+}
+
+#else
+
+/**
+ * tx_completion_sem_init() - Dummy func to initialize semaphore
+ * @device: device handle.
+ *
+ * This is a dummy function when TX compl thread is not created.
+ *
+ * Return: None.
+ */
+static inline void tx_completion_sem_init(HIF_DEVICE *device)
+{
+}
+
+/**
+ * hif_free_bus_request() - Free the bus access request
+ * @device:    device handle.
+ * @request:   bus access request.
+ *
+ * Just call the legacy handler when there is no additional completion thread.
+ *
+ * Return: None.
+ */
+static inline void hif_free_bus_request(HIF_DEVICE *device,
+			BUS_REQUEST *request)
+{
+	_hif_free_bus_request(device, request);
+}
+
+/**
+ * hif_start_tx_completion_thread() - Dummy function to start tx_compl thread.
+ * @device:   device handle.
+ *
+ * Dummy function when tx completion thread is not created.
+ *
+ * Return: None.
+ */
+static inline void hif_start_tx_completion_thread(HIF_DEVICE *device)
+{
+}
+
+/**
+ * hif_stop_tx_completion_thread() - Dummy function to stop tx_compl thread.
+ * @device:   device handle.
+ *
+ * Dummy function when tx conpletion thread is not created.
+ *
+ * Return: None.
+ */
+static inline void hif_stop_tx_completion_thread(HIF_DEVICE *device)
+{
+}
+#endif
+
 /* thread to serialize all requests, both sync and async */
 static int async_task(void *param)
  {
@@ -738,11 +1001,8 @@ static int async_task(void *param)
                 status = __HIFReadWrite(device, request->address, request->buffer,
                                       request->length, request->request & ~HIF_SYNCHRONOUS, NULL);
                 if (request->request & HIF_ASYNCHRONOUS) {
-                    void *context = request->context;
-                    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async_task freeing req: 0x%lX\n", (unsigned long)request));
-                    hifFreeBusRequest(device, request);
-                    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async_task completion routine req: 0x%lX\n", (unsigned long)request));
-                    device->htcCallbacks.rwCompletionHandler(context, status);
+                    request->status = status;
+                    hif_free_bus_request(device, request);
                 } else {
                     AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async_task upping req: 0x%lX\n", (unsigned long)request));
                     request->status = status;
@@ -1531,6 +1791,7 @@ TODO: MMC SDIO3.0 Setting should also be modified in ReInit() function when Powe
             hifFreeBusRequest(device, &device->busRequest[count]);
         }
         sema_init(&device->sem_async, 0);
+        tx_completion_sem_init(device);
     }
 #ifdef HIF_MBOX_SLEEP_WAR
     adf_os_timer_init(NULL, &device->sleep_timer,
@@ -1664,6 +1925,9 @@ static A_STATUS hifDisableFunc(HIF_DEVICE *device, struct sdio_func *func)
 
     ENTER();
     device = getHifDevice(func);
+
+    hif_stop_tx_completion_thread(device);
+
     if (device->async_task) {
         init_completion(&device->async_completion);
         device->async_shutdown = 1;
@@ -1814,6 +2078,8 @@ static A_STATUS hifEnableFunc(HIF_DEVICE *device, struct sdio_func *func)
             return A_ERROR;
         }
         device->is_disabled = FALSE;
+        hif_start_tx_completion_thread(device);
+
         /* create async I/O thread */
         if (!device->async_task) {
             device->async_shutdown = 0;
@@ -2159,6 +2425,10 @@ static void hifDeviceRemoved(struct sdio_func *func)
     ENTER();
 
     device = getHifDevice(func);
+    if (!device) {
+        pr_err("%s: Failed to get the sdio driver private data\n", __func__);
+        return;
+    }
 
     if (device->powerConfig == HIF_DEVICE_POWER_CUT) {
         device->func = NULL; /* func will be free by mmc stack */
@@ -2473,8 +2743,7 @@ static int hif_sdio_device_reinit(struct sdio_func *func, const struct sdio_devi
 
 static void hif_sdio_device_shutdown(struct sdio_func *func)
 {
-	vos_set_logp_in_progress(VOS_MODULE_ID_VOSS, FALSE);
-	vos_set_crash_indication_pending(true);
+	vos_set_logp_in_progress(VOS_MODULE_ID_HIF, TRUE);
 
 	if (func != NULL)
 		hifDeviceRemoved(func);
diff --git a/CORE/SERVICES/WMA/regdomain_common.h b/CORE/SERVICES/WMA/regdomain_common.h
index ee80555c6094..baeb8f2de0f1 100644
--- a/CORE/SERVICES/WMA/regdomain_common.h
+++ b/CORE/SERVICES/WMA/regdomain_common.h
@@ -482,7 +482,6 @@ static const REG_DMN_PAIR_MAPPING ahCmnRegDomainPairs[] = {
 
 static const COUNTRY_CODE_TO_ENUM_RD ahCmnAllCountries[] = {
     {CTRY_DEBUG,       NO_ENUMRD,     "DB", "DEBUG",          YES, YES, YES, YES, YES, YES, YES, YES, 7000 },
-    {CTRY_DEFAULT,     DEF_REGDMN,    "NA", "NO_COUNTRY_SET", YES, YES, YES, YES, YES, YES, YES, YES, 7000 },
     {CTRY_ALBANIA,     ETSI1_WORLD,   "AL", "ALBANIA",        YES,  NO, YES, YES, YES,  NO,  NO, NO, 7000 },
     {CTRY_ALGERIA,     APL13_WORLD,   "DZ", "ALGERIA",        YES,  NO, YES, YES, YES,  NO,  NO, NO, 7000 },
     {CTRY_ARGENTINA,   FCC3_WORLD,    "AR", "ARGENTINA",      YES,  NO,  NO, YES, YES, YES, YES, YES, 7000 },
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 857b902bd6f7..7195a8d88b07 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -120,6 +120,13 @@
 #define WMA_2_4_GHZ_MAX_FREQ  3000
 #define WOW_CSA_EVENT_OFFSET 12
 
+/*
+ * In the WMI_WOW_WAKEUP_HOST_EVENTID after the fixed param
+ * the wmi nan event is at an offset of 12
+ * This is to extract and decode the NAN WMI event.
+ */
+#define WOW_NAN_EVENT_OFFSET 12
+
 #define WMA_DEFAULT_SCAN_REQUESTER_ID        1
 #define WMI_SCAN_FINISH_EVENTS (WMI_SCAN_EVENT_START_FAILED |\
                                 WMI_SCAN_EVENT_COMPLETED |\
@@ -1240,7 +1247,6 @@ static const wmi_channel_width mode_to_width[MODE_MAX] =
 	[MODE_11AC_VHT40]    = WMI_CHAN_WIDTH_40,
 	[MODE_11AC_VHT40_2G] = WMI_CHAN_WIDTH_40,
 	[MODE_11AC_VHT80]    = WMI_CHAN_WIDTH_80,
-	[MODE_11AC_VHT80_2G] = WMI_CHAN_WIDTH_80,
 #if CONFIG_160MHZ_SUPPORT
 	[MODE_11AC_VHT80_80] = WMI_CHAN_WIDTH_80P80,
 	[MODE_11AC_VHT160]   = WMI_CHAN_WIDTH_160,
@@ -1340,6 +1346,9 @@ static int wma_vdev_start_rsp_ind(tp_wma_handle wma, u_int8_t *buf)
 		params->chainMask = resp_event->chain_mask;
 		params->smpsMode = host_map_smps_mode(resp_event->smps_mode);
 		params->status = resp_event->status;
+		if (wma->interfaces[resp_event->vdev_id].is_channel_switch)
+			wma->interfaces[resp_event->vdev_id].is_channel_switch =
+				VOS_FALSE;
 		if (((resp_event->resp_type == WMI_VDEV_RESTART_RESP_EVENT) &&
 		    (iface->type == WMI_VDEV_TYPE_STA)) ||
 		    ((resp_event->resp_type == WMI_VDEV_START_RESP_EVENT) &&
@@ -2104,10 +2113,10 @@ void wma_hidden_ssid_vdev_restart_on_vdev_stop(tp_wma_handle wma_handle, u_int8_
 		if (chanmode == MODE_11AC_VHT80)
 			chan->band_center_freq1 = vos_chan_to_freq(
 			wma_getCenterChannel(
-				chan->mhz,
-				mac_ctx->roam.configParam.channelBondingMode5GHz));
+			  chan->mhz,
+			  mac_ctx->roam.configParam.channelBondingMode5GHz));
 
-		if ((chanmode == MODE_11NG_HT40) ||
+		if ((chanmode == MODE_11NA_HT40) ||
 				(chanmode == MODE_11AC_VHT40)) {
 			if (mac_ctx->roam.configParam.channelBondingMode5GHz ==
 			    PHY_DOUBLE_CHANNEL_LOW_PRIMARY)
@@ -2115,7 +2124,9 @@ void wma_hidden_ssid_vdev_restart_on_vdev_stop(tp_wma_handle wma_handle, u_int8_
 			else
 				chan->band_center_freq1 -= 10;
 		}
-		if (chanmode == MODE_11NA_HT40) {
+
+		if ((chanmode == MODE_11NG_HT40) ||
+			(chanmode == MODE_11AC_VHT40_2G)) {
 			if (mac_ctx->roam.configParam.channelBondingMode24GHz ==
 			    PHY_DOUBLE_CHANNEL_LOW_PRIMARY)
 				chan->band_center_freq1 += 10;
@@ -2198,6 +2209,7 @@ static int wma_vdev_stop_ind(tp_wma_handle wma, u_int8_t *buf)
 		if (resp_event->vdev_id > wma->max_bssid) {
 			WMA_LOGE("%s: Invalid vdev_id %d", __func__,
 				resp_event->vdev_id);
+			vos_mem_free(params);
 			status = -EINVAL;
 			goto free_req_msg;
 		}
@@ -2206,6 +2218,7 @@ static int wma_vdev_stop_ind(tp_wma_handle wma, u_int8_t *buf)
 		if (iface->handle == NULL) {
 			WMA_LOGE("%s vdev id %d is already deleted",
 				__func__, resp_event->vdev_id);
+			vos_mem_free(params);
 			status = -EINVAL;
 			goto free_req_msg;
 		}
@@ -3495,9 +3508,8 @@ static int wma_extscan_operations_ind_handler(tp_wma_handle wma, uint8_t *buf)
 	case WMI_EXTSCAN_BUCKET_COMPLETED_EVENT:
 		WMA_LOGD("%s: received WMI_EXTSCAN_BUCKET_COMPLETED_EVENT",
 			__func__);
-		oprn_ind->scanEventType =  WIFI_EXTSCAN_RESULTS_AVAILABLE;
 		oprn_ind->status = 0;
-		break;
+		goto exit_handler;
 	case WMI_EXTSCAN_CYCLE_STARTED_EVENT:
 		WMA_LOGD("%s: received WMI_EXTSCAN_CYCLE_STARTED_EVENT",
 			 __func__);
@@ -3519,19 +3531,19 @@ static int wma_extscan_operations_ind_handler(tp_wma_handle wma, uint8_t *buf)
 		oprn_ind->buckets_scanned = 0;
 		break;
 	case WMI_EXTSCAN_BUCKET_STARTED_EVENT:
-		WMA_LOGD("%s: received WIFI_EXTSCAN_BUCKET_STARTED_EVENT",
+		WMA_LOGD("%s: received WMI_EXTSCAN_BUCKET_STARTED_EVENT",
 			__func__);
 		oprn_ind->scanEventType = WIFI_EXTSCAN_BUCKET_STARTED_EVENT;
 		oprn_ind->status = 0;
 		goto exit_handler;
 	case WMI_EXTSCAN_THRESHOLD_NUM_SCANS:
-		WMA_LOGD("%s: received WIFI_EXTSCAN_THRESHOLD_NUM_SCANS",
+		WMA_LOGD("%s: received WMI_EXTSCAN_THRESHOLD_NUM_SCANS",
 			__func__);
 		oprn_ind->scanEventType = WIFI_EXTSCAN_THRESHOLD_NUM_SCANS;
 		oprn_ind->status = 0;
 		break;
 	case WMI_EXTSCAN_THRESHOLD_PERCENT:
-		WMA_LOGD("%s: received WIFI_EXTSCAN_THRESHOLD_PERCENT",
+		WMA_LOGD("%s: received WMI_EXTSCAN_THRESHOLD_PERCENT",
 			__func__);
 		oprn_ind->scanEventType = WIFI_EXTSCAN_THRESHOLD_PERCENT;
 		oprn_ind->status = 0;
@@ -6704,6 +6716,30 @@ static void wma_set_nan_enable(tp_wma_handle wma_handle,
 }
 #endif
 
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+/**
+ * ol_cfg_update_bundle_params() - update bundle params
+ * @olCfg: cfg handle
+ * @mac_params: mac params
+ *
+ * Return: none
+ */
+static
+void ol_cfg_update_bundle_params(struct txrx_pdev_cfg_param_t *olCfg,
+		tMacOpenParameters *mac_params)
+{
+	olCfg->pkt_bundle_timer_value = mac_params->pkt_bundle_timer_value;
+	olCfg->pkt_bundle_size = mac_params->pkt_bundle_size;
+}
+#else
+static
+void ol_cfg_update_bundle_params(struct txrx_pdev_cfg_param_t *olCfg,
+		tMacOpenParameters *mac_params)
+{
+	return;
+}
+#endif
+
 #ifdef FEATURE_RUNTIME_PM
 /**
  * wma_runtime_context_init() - API to init wma runtime contexts
@@ -6830,6 +6866,8 @@ static void wma_register_debug_callback(void)
 	vos_register_debug_callback(VOS_MODULE_ID_WDA, &wma_state_info_dump);
 }
 
+struct wma_version_info g_wmi_version_info;
+
 /*
  * Allocate and init wmi adaptation layer.
  */
@@ -6848,6 +6886,10 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 
 	WMA_LOGD("%s: Enter", __func__);
 
+	g_wmi_version_info.major = __WMI_VER_MAJOR_;
+	g_wmi_version_info.minor = __WMI_VER_MINOR_;
+	g_wmi_version_info.revision = __WMI_REVISION_;
+
 	adf_dev = vos_get_context(VOS_MODULE_ID_ADF, vos_context);
 	htc_handle = vos_get_context(VOS_MODULE_ID_HTC, vos_context);
 
@@ -6922,6 +6964,9 @@ VOS_STATUS WDA_open(v_VOID_t *vos_context, v_VOID_t *os_ctx,
 #else
 	olCfg.is_full_reorder_offload = 0;
 #endif
+
+	ol_cfg_update_bundle_params(&olCfg, mac_params);
+
 	((pVosContextType) vos_context)->cfg_ctx =
 		ol_pdev_cfg_attach(((pVosContextType) vos_context)->adf_ctx, olCfg);
 	if (!(((pVosContextType) vos_context)->cfg_ctx)) {
@@ -7577,6 +7622,9 @@ static VOS_STATUS wma_vdev_detach(tp_wma_handle wma_handle,
 		WMA_LOGA("BSS is not yet stopped. Defering vdev(vdev id %x) deletion",
 				vdev_id);
 		iface->del_staself_req = pdel_sta_self_req_param;
+		if (generateRsp)
+			wma_send_msg(wma_handle, WDA_DEL_STA_SELF_RSP,
+					(void *)pdel_sta_self_req_param, 0);
 		return status;
 	}
 
@@ -7607,6 +7655,8 @@ static VOS_STATUS wma_vdev_detach(tp_wma_handle wma_handle,
         if (!generateRsp) {
                 WMA_LOGE("Call txrx detach w/o callback for vdev %d", vdev_id);
                 ol_txrx_vdev_detach(iface->handle, NULL, NULL);
+                iface->handle = NULL;
+                wma_handle->interfaces[vdev_id].is_vdev_valid = false;
                 adf_os_spin_unlock_bh(&wma_handle->vdev_detach_lock);
                 goto out;
         }
@@ -7623,6 +7673,8 @@ static VOS_STATUS wma_vdev_detach(tp_wma_handle wma_handle,
         }
         WMA_LOGD("Call txrx detach with callback for vdev %d", vdev_id);
         ol_txrx_vdev_detach(iface->handle, NULL, NULL);
+        iface->handle = NULL;
+        wma_handle->interfaces[vdev_id].is_vdev_valid = false;
         wma_vdev_detach_callback(iface);
         adf_os_spin_unlock_bh(&wma_handle->vdev_detach_lock);
         return status;
@@ -8173,6 +8225,7 @@ static ol_txrx_vdev_handle wma_vdev_attach(tp_wma_handle wma_handle,
         tANI_U16 val16;
 	int ret;
 	tSirMacHTCapabilityInfo *phtCapInfo;
+	u_int8_t vdev_id;
 
 	if (NULL == mac) {
 		WMA_LOGE("%s: Failed to get mac",__func__);
@@ -8195,6 +8248,7 @@ static ol_txrx_vdev_handle wma_vdev_attach(tp_wma_handle wma_handle,
 		status = VOS_STATUS_E_RESOURCES;
 		goto end;
 	}
+	vdev_id = self_sta_req->sessionId;
 
 	txrx_vdev_type = wma_get_txrx_vdev_type(self_sta_req->type);
 
@@ -8296,6 +8350,8 @@ static ol_txrx_vdev_handle wma_vdev_attach(tp_wma_handle wma_handle,
 					self_sta_req->sessionId);
 		}
 	}
+	wma_handle->interfaces[vdev_id].is_vdev_valid = true;
+
 	ret = wmi_unified_vdev_set_param_send(wma_handle->wmi_handle,
 					      self_sta_req->sessionId,
 					      WMI_VDEV_PARAM_DISCONNECT_TH,
@@ -11656,15 +11712,6 @@ static WLAN_PHY_MODE wma_chan_to_mode(u8 chan, ePhyChanBondState chan_offset,
 		case PHY_DOUBLE_CHANNEL_HIGH_PRIMARY:
 			phymode = vht_capable ? MODE_11AC_VHT40_2G :MODE_11NG_HT40;
 			break;
-                case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED:
-                case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW:
-                case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED:
-                case PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED:
-                case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW:
-                case PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH:
-                case PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH:
-                        phymode = MODE_11AC_VHT80_2G;
-                        break;
 
 		default:
 			break;
@@ -11802,7 +11849,7 @@ VOS_STATUS wma_switch_channel(tp_wma_handle wma, struct wma_vdev_start_req *req)
 			(req->chan, req->chan_offset));
 
 	if ((chanmode == MODE_11NA_HT40) || (chanmode == MODE_11NG_HT40) ||
-			(chanmode == MODE_11AC_VHT40)) {
+	    (chanmode == MODE_11AC_VHT40) || (chanmode == MODE_11AC_VHT40_2G)) {
 		if (req->chan_offset == PHY_DOUBLE_CHANNEL_LOW_PRIMARY)
 			cmd->band_center_freq1 += 10;
 		else
@@ -11915,7 +11962,7 @@ VOS_STATUS wma_vdev_start(tp_wma_handle wma,
 			(req->chan, req->chan_offset));
 
 	if ((chanmode == MODE_11NA_HT40) || (chanmode == MODE_11NG_HT40) ||
-			(chanmode == MODE_11AC_VHT40)) {
+	    (chanmode == MODE_11AC_VHT40) || (chanmode == MODE_11AC_VHT40_2G)) {
 		if (req->chan_offset == PHY_DOUBLE_CHANNEL_LOW_PRIMARY)
 			chan->band_center_freq1 += 10;
 		else
@@ -12160,6 +12207,9 @@ void wma_vdev_resp_timer(void *data)
 		adf_os_spin_lock_bh(&wma->roam_preauth_lock);
 		wma->roam_preauth_scan_id = -1;
 		adf_os_spin_unlock_bh(&wma->roam_preauth_lock);
+		if (wma->interfaces[tgt_req->vdev_id].is_channel_switch)
+			wma->interfaces[tgt_req->vdev_id].is_channel_switch =
+				VOS_FALSE;
 	} else if (tgt_req->msg_type == WDA_DELETE_BSS_REQ) {
 		tpDeleteBssParams params =
 			(tpDeleteBssParams)tgt_req->user_data;
@@ -12169,6 +12219,7 @@ void wma_vdev_resp_timer(void *data)
 		if (tgt_req->vdev_id > wma->max_bssid) {
 			WMA_LOGE("%s: Invalid vdev_id %d", __func__,
 				tgt_req->vdev_id);
+			vos_mem_free(params);
 			vos_timer_stop(&tgt_req->event_timeout);
 			goto free_tgt_req;
 		}
@@ -12177,6 +12228,7 @@ void wma_vdev_resp_timer(void *data)
 		if (iface->handle == NULL) {
 			WMA_LOGE("%s vdev id %d is already deleted",
 				__func__, tgt_req->vdev_id);
+			vos_mem_free(params);
 			vos_timer_stop(&tgt_req->event_timeout);
 			goto free_tgt_req;
 		}
@@ -12291,6 +12343,7 @@ void wma_vdev_resp_timer(void *data)
 		if (!msg) {
 			WMA_LOGP("%s: Failed to fill vdev request for vdev_id %d",
 							__func__, tgt_req->vdev_id);
+			vos_mem_free(del_bss_params);
 			goto error0;
 		}
 
@@ -12311,6 +12364,7 @@ void wma_vdev_resp_timer(void *data)
 
 		if (wmi_unified_vdev_stop_send(wma->wmi_handle, tgt_req->vdev_id)) {
 				WMA_LOGP("%s: %d Failed to send vdev stop",	__func__, __LINE__);
+				vos_mem_free(del_bss_params);
 				wma_remove_vdev_req(wma, tgt_req->vdev_id,
 									WMA_TARGET_REQ_TYPE_VDEV_STOP);
 				goto error0;
@@ -12674,10 +12728,6 @@ static void wma_set_channel(tp_wma_handle wma, tpSwitchChannelParams params)
 				 status);
 			goto send_resp;
 		}
-
-		if (wma->interfaces[req.vdev_id].is_channel_switch)
-			wma->interfaces[req.vdev_id].is_channel_switch =
-				VOS_FALSE;
 		return;
 	}
 send_resp:
@@ -13309,7 +13359,7 @@ wmi_unified_pdev_set_param(wmi_unified_t wmi_handle, WMI_PDEV_PARAM param_id,
 		       WMITLV_TAG_STRUC_wmi_pdev_set_param_cmd_fixed_param,
 		       WMITLV_GET_STRUCT_TLVLEN(
 			       wmi_pdev_set_param_cmd_fixed_param));
-	cmd->reserved0 = 0;
+	cmd->pdev_id = 0;
 	cmd->param_id = param_id;
 	cmd->param_value = param_value;
 	WMA_LOGD("Setting pdev param = %x, value = %u",
@@ -13735,7 +13785,7 @@ static int32_t wmi_unified_pdev_green_ap_ps_enable_cmd(wmi_unified_t wmi_handle,
 			WMITLV_TAG_STRUC_wmi_pdev_green_ap_ps_enable_cmd_fixed_param,
 			WMITLV_GET_STRUCT_TLVLEN(
 				wmi_pdev_green_ap_ps_enable_cmd_fixed_param));
-	cmd->reserved0 = 0;
+	cmd->pdev_id = 0;
 	cmd->enable = value;
 
 	if (wmi_unified_cmd_send(wmi_handle, buf, len,
@@ -14015,6 +14065,10 @@ static void wma_process_cli_set_cmd(tp_wma_handle wma,
 
 	switch (privcmd->param_vp_dev) {
 	case VDEV_CMD:
+		if (!wma->interfaces[privcmd->param_vdev_id].is_vdev_valid) {
+			WMA_LOGE("%s Vdev id is not valid", __func__);
+			return ;
+		}
 		WMA_LOGD("vdev id %d pid %d pval %d", privcmd->param_vdev_id,
 				privcmd->param_id, privcmd->param_value);
 		ret = wmi_unified_vdev_set_param_send(wma->wmi_handle,
@@ -17460,7 +17514,7 @@ static void wma_delete_bss(tp_wma_handle wma, tpDeleteBssParams params)
 	/* overwrite the timeout value to shorten the SSR latency in HL
 	 * solution
 	 */
-	if (vos_is_crash_indication_pending()) {
+	if (vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
 		WMA_LOGP("%s: %d HL ssr in progress",
 			 __func__, __LINE__);
 		timeout = WMA_DEL_BSS_TIMEOUT_IN_SSR;
@@ -18312,14 +18366,18 @@ static void wma_send_beacon(tp_wma_handle wma, tpSendbeaconParams bcn_info)
 		WMA_LOGE("%s : wma_store_bcn_tmpl Failed", __func__);
 		return;
 	}
-	if (!wma->interfaces[vdev_id].vdev_up) {
-	      if (wmi_unified_vdev_up_send(wma->wmi_handle, vdev_id, 0,
-				      bcn_info->bssId) < 0) {
-		WMA_LOGE("%s : failed to send vdev up", __func__);
-		return;
-	     }
-	     wma->interfaces[vdev_id].vdev_up = TRUE;
-		wma_set_sap_keepalive(wma, vdev_id);
+	if (!((adf_os_atomic_read(
+		&wma->interfaces[vdev_id].vdev_restart_params.hidden_ssid_restart_in_progress)) ||
+		(wma->interfaces[vdev_id].is_channel_switch))) {
+		if (!wma->interfaces[vdev_id].vdev_up) {
+			if (wmi_unified_vdev_up_send(wma->wmi_handle, vdev_id, 0,
+						bcn_info->bssId) < 0) {
+				WMA_LOGE("%s : failed to send vdev up", __func__);
+				return;
+			}
+			wma->interfaces[vdev_id].vdev_up = TRUE;
+			wma_set_sap_keepalive(wma, vdev_id);
+		}
 	}
 }
 
@@ -18380,7 +18438,7 @@ static VOS_STATUS wma_pktlog_wmi_send_cmd(WMA_HANDLE handle,
 		      WMITLV_TAG_STRUC_wmi_pdev_pktlog_disable_cmd_fixed_param,
 		      WMITLV_GET_STRUCT_TLVLEN(
 			      wmi_pdev_pktlog_disable_cmd_fixed_param));
-		disable_cmd->reserved0 = 0;
+		disable_cmd->pdev_id = 0;
 		if (wmi_unified_cmd_send(wma_handle->wmi_handle, buf, len,
 					 WMI_PDEV_PKTLOG_DISABLE_CMDID)) {
 			WMA_LOGE("failed to send pktlog disable cmdid");
@@ -19721,6 +19779,8 @@ static const u8 *wma_wow_wake_reason_str(A_INT32 wake_reason, tp_wma_handle wma)
 		return "WOW_REASON_NLO_SCAN_COMPLETE";
 	case WOW_REASON_BPF_ALLOW:
 		return "WOW_REASON_BPF_ALLOW";
+	case WOW_REASON_NAN_EVENT:
+		return "WOW_REASON_NAN_EVENT";
 	}
 	return "unknown";
 }
@@ -20644,7 +20704,22 @@ static int wma_wow_wakeup_host_event(void *handle, u_int8_t *event,
 			    WMA_LOGD("No wow_packet_buffer present");
 		}
 		break;
-
+#ifdef WLAN_FEATURE_NAN
+	case WOW_REASON_NAN_EVENT:
+		{
+			WMI_NAN_EVENTID_param_tlvs param;
+			WMA_LOGA("Host woken up due to NAN event reason");
+			/* First 4-bytes of wow_packet_buffer is the length */
+				param.fixed_param = (wmi_nan_event_hdr *)
+					(((u_int8_t *) wake_info)
+					+ sizeof(WOW_EVENT_INFO_fixed_param)
+					+ WOW_NAN_EVENT_OFFSET);
+				wma_nan_rsp_event_handler(handle,
+					(u_int8_t *)&param,
+					sizeof(param));
+		}
+		break;
+#endif
 	default:
 		break;
 	}
@@ -21148,6 +21223,7 @@ int wma_enable_wow_in_fw(WMA_HANDLE handle, int runtime_pm)
 		WMA_LOGE("Credits:%d; Pending_Cmds: %d",
 			wmi_get_host_credits(wma->wmi_handle),
 			wmi_get_pending_cmds(wma->wmi_handle));
+		wmi_set_target_suspend(wma->wmi_handle, FALSE);
 		if (!vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
 #ifdef CONFIG_CNSS
 			if (pMac->sme.enableSelfRecovery) {
@@ -21162,7 +21238,6 @@ int wma_enable_wow_in_fw(WMA_HANDLE handle, int runtime_pm)
 			WMA_LOGE("%s: LOGP is in progress, ignore!", __func__);
 		}
 
-		wmi_set_target_suspend(wma->wmi_handle, FALSE);
 		return VOS_STATUS_E_FAILURE;
 	}
 
@@ -25817,14 +25892,14 @@ static VOS_STATUS wma_process_ll_stats_getReq
 
 		if (src_bucket->reportEvents & EXTSCAN_REPORT_EVENTS_EACH_SCAN)
 			dest_blist->notify_extscan_events =
-					WMI_EXTSCAN_BUCKET_COMPLETED_EVENT;
+					WMI_EXTSCAN_CYCLE_COMPLETED_EVENT |
+					WMI_EXTSCAN_CYCLE_STARTED_EVENT;
 
 		if (src_bucket->reportEvents &
 				EXTSCAN_REPORT_EVENTS_FULL_RESULTS) {
 			dest_blist->forwarding_flags =
 				WMI_EXTSCAN_FORWARD_FRAME_TO_HOST;
 			dest_blist->notify_extscan_events |=
-				WMI_EXTSCAN_BUCKET_COMPLETED_EVENT |
 				WMI_EXTSCAN_CYCLE_STARTED_EVENT |
 				WMI_EXTSCAN_CYCLE_COMPLETED_EVENT;
 		} else {
@@ -28354,6 +28429,100 @@ static VOS_STATUS wma_update_wep_default_key(tp_wma_handle wma,
 }
 
 /**
+ * wma_update_tx_rate: Update max tx_rate to firmware
+ * @wma_handle: wma handle
+ * @req: Set max tx_rate parameters to firmware
+ * For the specific hardware mode validate the max tx_rate value specified
+ * by the user.
+ * WMA_RESET_MAX_RATE: Is specified to switch back to max rate index for the
+ * specified hardware mode.
+ * Return: VOS_STATUS enumeration.
+ */
+static VOS_STATUS wma_update_tx_rate(tp_wma_handle wma,
+				struct sir_txrate_update *req)
+{
+	struct wma_txrx_node *intr = wma->interfaces;
+	wmi_peer_max_min_tx_rate peer_max_min_tx_rate;
+	uint16_t tx_rate = (req->txrate);
+
+	WMA_LOGI("%s: Enter", __func__);
+	peer_max_min_tx_rate.tx_rate = tx_rate;
+	switch (intr[req->session_id].chanmode) {
+	case MODE_11A:
+	case MODE_11G:
+	case MODE_11GONLY:
+
+		if ((tx_rate >= 0 && tx_rate <= WMI_MAX_OFDM_TX_RATE)) {
+			/* Do Nothing*/
+		} else if (tx_rate == WMA_RESET_MAX_RATE)
+			peer_max_min_tx_rate.tx_rate = WMI_MAX_OFDM_TX_RATE;
+		else {
+			WMA_LOGE("invalid rate for MODE_11A/MODE11_G");
+			return -EINVAL;
+		}
+		peer_max_min_tx_rate.mode = WMI_RATE_PREAMBLE_OFDM;
+		break;
+	case MODE_11B:
+
+		if ((tx_rate >= 0 && tx_rate <= WMI_MAX_CCK_TX_RATE)) {
+			/* Do nothing*/
+		} else if (tx_rate == WMA_RESET_MAX_RATE)
+			peer_max_min_tx_rate.tx_rate = WMI_MAX_CCK_TX_RATE;
+		else {
+			WMA_LOGE("invalid rate for Mode MODE_11B");
+			return -EINVAL;
+		}
+		peer_max_min_tx_rate.mode = WMI_RATE_PREAMBLE_CCK;
+		break;
+	case MODE_11NA_HT20:
+	case MODE_11NG_HT20:
+	case MODE_11NA_HT40:
+	case MODE_11NG_HT40:
+		if ((tx_rate >= 0 && tx_rate <= WMI_MAX_HT_TX_MCS)) {
+			/* Do nothing*/
+		} else if (tx_rate == WMA_RESET_MAX_RATE)
+			peer_max_min_tx_rate.tx_rate = WMI_MAX_HT_TX_MCS;
+		else {
+			WMA_LOGE("invalid rate for Mode MODE_11N");
+			return -EINVAL;
+		}
+		peer_max_min_tx_rate.mode = WMI_RATE_PREAMBLE_HT;
+		break;
+	case MODE_11AC_VHT20:
+	case MODE_11AC_VHT40:
+	case MODE_11AC_VHT80:
+	case MODE_11AC_VHT20_2G:
+	case MODE_11AC_VHT40_2G:
+#if CONFIG_160MHZ_SUPPORT
+	case MODE_11AC_VHT80_80:
+	case MODE_11AC_VHT160:
+#endif
+		if ((tx_rate >= 0 && tx_rate <= WMI_MAX_VHT_TX_MCS)) {
+			/* Do nothing*/
+		} else if (tx_rate == WMA_RESET_MAX_RATE)
+			peer_max_min_tx_rate.tx_rate = WMI_MAX_VHT_TX_MCS;
+		else {
+			WMA_LOGE("invalid rate for Mode MODE_11N");
+			return -EINVAL;
+		}
+		peer_max_min_tx_rate.mode = WMI_RATE_PREAMBLE_VHT;
+		break;
+	default:
+		WMA_LOGE("%s: Error not supported mode", __func__);
+		return -EINVAL;
+	}
+	WMA_LOGD(FL("tx_rate: %d hwmode: %d"), peer_max_min_tx_rate.tx_rate,
+					peer_max_min_tx_rate.mode);
+	wma_set_peer_param(wma, req->bssid,
+			WMI_PEER_SET_MAX_TX_RATE ,
+			(peer_max_min_tx_rate.mode |
+			(peer_max_min_tx_rate.tx_rate << 16)),
+				req->session_id);
+	WMA_LOGI("%s: Exit", __func__);
+	return VOS_STATUS_SUCCESS;
+}
+
+/**
  * wma_get_bpf_capabilities - Send get bpf capability to firmware
  * @wma_handle: wma handle
  *
@@ -28402,6 +28571,120 @@ static VOS_STATUS wma_get_bpf_capabilities(tp_wma_handle wma)
 }
 
 /**
+* wma_set_beacon_filter() - Issue WMI command to set beacon filter
+* @wma: wma handler
+* @filter_params: beacon_filter_param to set
+*
+* Return: Return VOS_STATUS
+*/
+static VOS_STATUS wma_set_beacon_filter(tp_wma_handle wma,
+				struct beacon_filter_param *filter_params)
+{
+	int i;
+	wmi_buf_t wmi_buf;
+	u_int8_t *buf;
+	A_UINT32 *ie_map;
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+	wmi_add_bcn_filter_cmd_fixed_param *cmd;
+	int len = sizeof(wmi_add_bcn_filter_cmd_fixed_param);
+
+	len += WMI_TLV_HDR_SIZE;
+	len += BCN_FLT_MAX_ELEMS_IE_LIST*sizeof(A_UINT32);
+
+	if (!wma || !wma->wmi_handle) {
+		WMA_LOGE("%s: WMA is closed, can not issue set beacon filter",
+			__func__);
+		return VOS_STATUS_E_INVAL;
+	}
+
+	wmi_buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!wmi_buf) {
+		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
+		return VOS_STATUS_E_NOMEM;
+	}
+
+	buf = (u_int8_t *) wmi_buf_data(wmi_buf);
+
+	cmd = (wmi_add_bcn_filter_cmd_fixed_param *)wmi_buf_data(wmi_buf);
+	cmd->vdev_id = filter_params->vdev_id;
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+			WMITLV_TAG_STRUC_wmi_add_bcn_filter_cmd_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(
+				wmi_add_bcn_filter_cmd_fixed_param));
+
+	buf += sizeof(wmi_add_bcn_filter_cmd_fixed_param);
+
+	WMITLV_SET_HDR(buf, WMITLV_TAG_ARRAY_UINT32,
+			(BCN_FLT_MAX_ELEMS_IE_LIST * sizeof(u_int32_t)));
+
+	ie_map = (A_UINT32 *)(buf + WMI_TLV_HDR_SIZE);
+	for (i = 0; i < BCN_FLT_MAX_ELEMS_IE_LIST; i++) {
+		ie_map[i] = filter_params->ie_map[i];
+		WMA_LOGA("beacon filter ie map = %u", ie_map[i]);
+	}
+
+	vos_status = wmi_unified_cmd_send(wma->wmi_handle, wmi_buf, len,
+			WMI_ADD_BCN_FILTER_CMDID);
+	if (vos_status < 0) {
+		WMA_LOGE("Failed to send wmi add beacon filter = %d",
+				vos_status);
+		wmi_buf_free(wmi_buf);
+		return VOS_STATUS_E_FAILURE;
+	}
+	WMA_LOGA("added beacon filter = %d", vos_status);
+
+	return vos_status;
+}
+
+/**
+* wma_remove_beacon_filter() - Issue WMI command to remove beacon filter
+* @wma: wma handler
+* @filter_params: beacon_filter_params
+*
+* Return: Return VOS_STATUS
+*/
+static VOS_STATUS wma_remove_beacon_filter(tp_wma_handle wma,
+				struct beacon_filter_param *filter_params)
+{
+	wmi_buf_t buf;
+	wmi_rmv_bcn_filter_cmd_fixed_param *cmd;
+	int len = sizeof(wmi_rmv_bcn_filter_cmd_fixed_param);
+	VOS_STATUS vos_status = VOS_STATUS_SUCCESS;
+
+	if (!wma || !wma->wmi_handle) {
+		WMA_LOGE("%s: WMA is closed, cannot issue remove beacon filter",
+			__func__);
+		return VOS_STATUS_E_INVAL;
+	}
+
+	buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGE("%s: wmi_buf_alloc failed", __func__);
+		return VOS_STATUS_E_NOMEM;
+	}
+	cmd = (wmi_rmv_bcn_filter_cmd_fixed_param *)wmi_buf_data(buf);
+	cmd->vdev_id = filter_params->vdev_id;
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+			WMITLV_TAG_STRUC_wmi_rmv_bcn_filter_cmd_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(
+				wmi_rmv_bcn_filter_cmd_fixed_param));
+
+	vos_status = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+			WMI_RMV_BCN_FILTER_CMDID);
+	if (vos_status < 0) {
+		WMA_LOGE("Failed to send wmi remove beacon filter = %d",
+				vos_status);
+		wmi_buf_free(buf);
+		return VOS_STATUS_E_FAILURE;
+	}
+	WMA_LOGA("removed beacon filter = %d", vos_status);
+
+	return vos_status;
+}
+
+/**
  *  wma_set_bpf_instructions - Set bpf instructions to firmware
  *  @wma: wma handle
  *  @bpf_set_offload: Bpf offload information to set to firmware
@@ -29352,6 +29635,18 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 		case WDA_SET_MIB_STATS_DISABLE:
 			wma_set_mib_stats_enable(wma_handle, false);
 			break;
+		case WDA_UPDATE_TX_RATE:
+			wma_update_tx_rate(wma_handle, msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
+		case WDA_ADD_BCN_FILTER_CMDID:
+			wma_set_beacon_filter(wma_handle, msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
+		case WDA_REMOVE_BCN_FILTER_CMDID:
+			wma_remove_beacon_filter(wma_handle, msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
+			break;
 
 		default:
 			WMA_LOGD("unknow msg type %x", msg->type);
@@ -29470,7 +29765,8 @@ static int wma_scan_event_callback(WMA_HANDLE handle, u_int8_t *data,
 	}
 
         /* Stop the scan completion timeout if the event is WMI_SCAN_EVENT_COMPLETED */
-        if (scan_event->event == (tSirScanEventType)WMI_SCAN_EVENT_COMPLETED) {
+        if (scan_event->event ==
+                          (enum lim_scan_event_type) WMI_SCAN_EVENT_COMPLETED) {
                 WMA_LOGE(" scan complete - scan_id %x, vdev_id %x",
 		wmi_event->scan_id, vdev_id);
 		/*
@@ -29927,7 +30223,7 @@ static int wma_nlo_scan_cmp_evt_handler(void *handle, u_int8_t *event,
 				      WIFI_POWER_EVENT_WAKELOCK_PNO);
 		vos_mem_zero(scan_event, sizeof(tSirScanOffloadEvent));
 		scan_event->reasonCode = eSIR_SME_SUCCESS;
-		scan_event->event = SCAN_EVENT_COMPLETED;
+		scan_event->event = LIM_SCAN_EVENT_COMPLETED;
 		scan_event->sessionId = nlo_event->vdev_id;
 		wma_send_msg(wma, WDA_RX_SCAN_EVENT,
 			     (void *) scan_event, 0);
@@ -31722,6 +32018,7 @@ static void wma_update_hdd_cfg(tp_wma_handle wma_handle)
 		wma_handle->fine_time_measurement_cap;
 	hdd_tgt_cfg.wmi_max_len = wmi_get_max_msg_len(wma_handle->wmi_handle)
 					- WMI_TLV_HEADROOM;
+	hdd_tgt_cfg.bpf_enabled = wma_handle->bpf_enabled;
 	wma_setup_egap_support(&hdd_tgt_cfg, wma_handle);
 	wma_handle->tgt_cfg_update_cb(hdd_ctx, &hdd_tgt_cfg);
 }
@@ -31930,7 +32227,9 @@ v_VOID_t wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 	wma_handle->ap_arpns_support =
 		WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
 					WMI_SERVICE_AP_ARPNS_OFFLOAD);
-
+	wma_handle->bpf_enabled =
+		WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+					WMI_SERVICE_BPF_OFFLOAD);
 	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
 				WMI_SERVICE_CSA_OFFLOAD)) {
 		WMA_LOGD("%s: FW support CSA offload capability", __func__);
@@ -32780,7 +33079,7 @@ int wma_suspend_target(WMA_HANDLE handle, int disable_target_intr)
 	/* overwrite the timeout value to shorten the SSR latency in HL
 	 * solution.
 	 */
-	if (vos_is_crash_indication_pending()) {
+	if (vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
 		WMA_LOGP("%s: %d HL ssr in progress",
 			 __func__, __LINE__);
 		timeout = WMA_SUSPEND_TIMEOUT_IN_SSR;
@@ -32793,8 +33092,7 @@ int wma_suspend_target(WMA_HANDLE handle, int disable_target_intr)
 		wmi_set_target_suspend(wma_handle->wmi_handle, FALSE);
 #ifdef CONFIG_CNSS
 		if (vos_is_load_unload_in_progress(VOS_MODULE_ID_WDA, NULL) ||
-		    vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)||
-		    vos_is_crash_indication_pending()) {
+		    vos_is_logp_in_progress(VOS_MODULE_ID_VOSS, NULL)) {
 			WMA_LOGE("%s: Unloading/Loading/LOGP is in progress, Ignore!",
 				 __func__);
 		} else {
@@ -34194,7 +34492,8 @@ wma_dfs_configure_channel(struct ieee80211com *dfs_ic,
                         chan->mhz,
                         req->chan_offset));
         if ((chanmode == MODE_11NG_HT40) ||
-                (chanmode == MODE_11AC_VHT40)) {
+                (chanmode == MODE_11AC_VHT40) ||
+		(chanmode == MODE_11AC_VHT40_2G)) {
                 if (req->chan_offset == PHY_DOUBLE_CHANNEL_LOW_PRIMARY)
                     chan->band_center_freq1 += 10;
                 else
diff --git a/CORE/SERVICES/WMA/wma.h b/CORE/SERVICES/WMA/wma.h
index 3295417dce5e..127833a380bf 100644
--- a/CORE/SERVICES/WMA/wma.h
+++ b/CORE/SERVICES/WMA/wma.h
@@ -84,7 +84,7 @@
 #define WMA_TGT_WOW_TX_COMPLETE_TIMEOUT    2000
 #define MAX_MEM_CHUNKS                     32
 #define WMA_CRASH_INJECT_TIMEOUT           5000
-
+#define WMA_RESET_MAX_RATE                 10
 /*
    In prima 12 HW stations are supported including BCAST STA(staId 0)
    and SELF STA(staId 1) so total ASSOC stations which can connect to Prima
@@ -574,6 +574,8 @@ struct wma_txrx_node {
 	uint8_t nss_5g;
 
 	uint8_t wep_default_key_idx;
+	bool is_vdev_valid;
+
 };
 
 #if defined(QCA_WIFI_FTM)
@@ -1710,4 +1712,16 @@ uint32_t wma_get_vht_ch_width(void);
 
 VOS_STATUS wma_get_wakelock_stats(struct sir_wake_lock_stats *wake_lock_stats);
 
+/**
+ * struct wma_version_info - Store wmi version info
+ * @major: wmi major version
+ * @minor: wmi minor version
+ * @revision: wmi revision number
+ */
+struct wma_version_info {
+	u_int32_t major;
+	u_int32_t minor;
+	u_int32_t revision;
+};
+
 #endif
diff --git a/CORE/SERVICES/WMA/wma_ocb.c b/CORE/SERVICES/WMA/wma_ocb.c
index 2abed4d61464..2bdfe5102fc7 100644
--- a/CORE/SERVICES/WMA/wma_ocb.c
+++ b/CORE/SERVICES/WMA/wma_ocb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -55,6 +55,7 @@ int wma_ocb_set_config_resp(tp_wma_handle wma_handle, uint8_t status)
 	 */
 	if (status == VOS_STATUS_SUCCESS) {
 		if (vdev && req) {
+			/* Save the channel info in the vdev */
 			if (vdev->ocb_channel_info)
 				vos_mem_free(vdev->ocb_channel_info);
 			vdev->ocb_channel_count =
@@ -79,6 +80,14 @@ int wma_ocb_set_config_resp(tp_wma_handle wma_handle, uint8_t status)
 			} else {
 				vdev->ocb_channel_info = 0;
 			}
+
+			/* Default TX parameter */
+			if (!ol_txrx_set_ocb_def_tx_param(vdev,
+				req->def_tx_param, req->def_tx_param_size)) {
+				/* Setting the default param failed */
+				WMA_LOGE(FL("Invalid default TX parameters"));
+				status = VOS_STATUS_E_INVAL;
+			}
 		}
 	}
 
diff --git a/CORE/SERVICES/WMI/wmi_unified.c b/CORE/SERVICES/WMI/wmi_unified.c
index 48837e33bbed..4b404cbf4a52 100644
--- a/CORE/SERVICES/WMI/wmi_unified.c
+++ b/CORE/SERVICES/WMI/wmi_unified.c
@@ -497,6 +497,7 @@ static u_int8_t* get_wmi_cmd_string(WMI_CMD_ID wmi_command)
 		CASE_RETURN_STRING(WMI_RSSI_BREACH_MONITOR_CONFIG_CMDID);
                 CASE_RETURN_STRING(WMI_LRO_CONFIG_CMDID);
                 CASE_RETURN_STRING(WMI_TRANSFER_DATA_TO_FLASH_CMDID);
+		CASE_RETURN_STRING(WMI_CONFIG_ENHANCED_MCAST_FILTER_CMDID);
                 CASE_RETURN_STRING(WMI_MAWC_SENSOR_REPORT_IND_CMDID);
                 CASE_RETURN_STRING(WMI_ROAM_CONFIGURE_MAWC_CMDID);
                 CASE_RETURN_STRING(WMI_NLO_CONFIGURE_MAWC_CMDID);
@@ -584,6 +585,7 @@ static u_int8_t* get_wmi_cmd_string(WMI_CMD_ID wmi_command)
 		CASE_RETURN_STRING(WMI_PDEV_SET_LED_CONFIG_CMDID);
 		CASE_RETURN_STRING(WMI_HOST_AUTO_SHUTDOWN_CFG_CMDID);
 		CASE_RETURN_STRING(WMI_CHAN_AVOID_UPDATE_CMDID);
+		CASE_RETURN_STRING(WMI_COEX_CONFIG_CMDID);
 		CASE_RETURN_STRING(WMI_WOW_IOAC_ADD_KEEPALIVE_CMDID);
 		CASE_RETURN_STRING(WMI_WOW_IOAC_DEL_KEEPALIVE_CMDID);
 		CASE_RETURN_STRING(WMI_WOW_IOAC_ADD_WAKE_PATTERN_CMDID);
@@ -641,8 +643,11 @@ static u_int8_t* get_wmi_cmd_string(WMI_CMD_ID wmi_command)
 		CASE_RETURN_STRING(WMI_DEBUG_MESG_FLUSH_CMDID);
 		CASE_RETURN_STRING(WMI_PEER_SET_RATE_REPORT_CONDITION_CMDID);
 		CASE_RETURN_STRING(WMI_SOC_SET_PCL_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_SET_PCL_CMDID);
 		CASE_RETURN_STRING(WMI_SOC_SET_HW_MODE_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_SET_HW_MODE_CMDID);
 		CASE_RETURN_STRING(WMI_SOC_SET_DUAL_MAC_CONFIG_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_SET_MAC_CONFIG_CMDID);
 		CASE_RETURN_STRING(WMI_WOW_ENABLE_ICMPV6_NA_FLT_CMDID);
 		CASE_RETURN_STRING(WMI_DIAG_EVENT_LOG_CONFIG_CMDID);
 		CASE_RETURN_STRING(WMI_PACKET_FILTER_CONFIG_CMDID);
@@ -651,6 +656,7 @@ static u_int8_t* get_wmi_cmd_string(WMI_CMD_ID wmi_command)
 		CASE_RETURN_STRING(WMI_WOW_UDP_SVC_OFLD_CMDID);
 		CASE_RETURN_STRING(WMI_MGMT_TX_SEND_CMDID);
 		CASE_RETURN_STRING(WMI_SOC_SET_ANTENNA_MODE_CMDID);
+		CASE_RETURN_STRING(WMI_PDEV_SET_ANTENNA_MODE_CMDID);
 		CASE_RETURN_STRING(WMI_WOW_HOSTWAKEUP_GPIO_PIN_PATTERN_CONFIG_CMDID);
 		CASE_RETURN_STRING(WMI_AP_PS_EGAP_PARAM_CMDID);
 		CASE_RETURN_STRING(WMI_PMF_OFFLOAD_SET_SA_QUERY_CMDID);
@@ -658,6 +664,10 @@ static u_int8_t* get_wmi_cmd_string(WMI_CMD_ID wmi_command)
 		CASE_RETURN_STRING(WMI_BPF_GET_VDEV_STATS_CMDID);
 		CASE_RETURN_STRING(WMI_BPF_SET_VDEV_INSTRUCTIONS_CMDID);
 		CASE_RETURN_STRING(WMI_BPF_DEL_VDEV_INSTRUCTIONS_CMDID);
+		CASE_RETURN_STRING(WMI_NDI_GET_CAP_REQ_CMDID);
+		CASE_RETURN_STRING(WMI_NDP_INITIATOR_REQ_CMDID);
+		CASE_RETURN_STRING(WMI_NDP_RESPONDER_REQ_CMDID);
+		CASE_RETURN_STRING(WMI_NDP_END_REQ_CMDID);
 		CASE_RETURN_STRING(WMI_PEER_UPDATE_WDS_ENTRY_CMDID);
 		CASE_RETURN_STRING(WMI_PEER_ADD_PROXY_STA_ENTRY_CMDID);
 		CASE_RETURN_STRING(WMI_PDEV_FIPS_CMDID);
@@ -674,6 +684,7 @@ static u_int8_t* get_wmi_cmd_string(WMI_CMD_ID wmi_command)
 		CASE_RETURN_STRING(WMI_VDEV_ATF_REQUEST_CMDID);
 		CASE_RETURN_STRING(WMI_VDEV_SET_DSCP_TID_MAP_CMDID);
 		CASE_RETURN_STRING(WMI_VDEV_FILTER_NEIGHBOR_RX_PACKETS_CMDID);
+		CASE_RETURN_STRING(WMI_VDEV_SET_QUIET_MODE_CMDID);
 		CASE_RETURN_STRING(WMI_PEER_SMART_ANT_SET_TX_ANTENNA_CMDID);
 		CASE_RETURN_STRING(WMI_PEER_SMART_ANT_SET_TRAIN_INFO_CMDID);
 		CASE_RETURN_STRING(WMI_PEER_SMART_ANT_SET_NODE_CONFIG_OPS_CMDID);
@@ -1119,14 +1130,16 @@ wmi_unified_detach(struct wmi_unified* wmi_handle)
 {
     wmi_buf_t buf;
 
-    vos_flush_work(&wmi_handle->rx_event_work);
-    adf_os_spin_lock_bh(&wmi_handle->eventq_lock);
-    buf = adf_nbuf_queue_remove(&wmi_handle->event_queue);
-    while (buf) {
-	adf_nbuf_free(buf);
-	buf = adf_nbuf_queue_remove(&wmi_handle->event_queue);
+    if (wmi_handle != NULL) {
+        vos_flush_work(&wmi_handle->rx_event_work);
+        adf_os_spin_lock_bh(&wmi_handle->eventq_lock);
+        buf = adf_nbuf_queue_remove(&wmi_handle->event_queue);
+        while (buf) {
+            adf_nbuf_free(buf);
+            buf = adf_nbuf_queue_remove(&wmi_handle->event_queue);
+        }
+        adf_os_spin_unlock_bh(&wmi_handle->eventq_lock);
     }
-    adf_os_spin_unlock_bh(&wmi_handle->eventq_lock);
     if (wmi_handle != NULL) {
         OS_FREE(wmi_handle);
         wmi_handle = NULL;
diff --git a/CORE/SME/inc/csrApi.h b/CORE/SME/inc/csrApi.h
index 475404d80794..2538f309339a 100644
--- a/CORE/SME/inc/csrApi.h
+++ b/CORE/SME/inc/csrApi.h
@@ -1567,6 +1567,7 @@ typedef struct tagCsrLinkEstablishParams
     tSirMacAddr peerMac;
     tANI_U8 uapsdQueues;
     tANI_U8 maxSp;
+    uint8_t qos;
     tANI_U8 isBufSta;
     tANI_U8 isOffChannelSupported;
     tANI_U8 isResponder;
@@ -1867,4 +1868,5 @@ typedef void (*csr_mib_stats_callback)
  * Return: void
  */
 typedef void (*tcsr_fw_state_callback)(void *context);
+void csr_packetdump_timer_stop(void);
 #endif
diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index 2336fb8f1300..f4c0aabcbec9 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -1042,6 +1042,7 @@ typedef struct tagCsrRoamSession
     tCsrRoamStoredProfile stored_roam_profile;
     bool ch_switch_in_progress;
     bool supported_nss_1x1;
+    bool disable_hi_rssi;
 } tCsrRoamSession;
 
 typedef struct tagCsrRoamStruct
@@ -1097,6 +1098,7 @@ typedef struct tagCsrRoamStruct
     tANI_U8 *pReassocResp;  /* reassociation response from new AP */
     tANI_U16 reassocRespLen;  /* length of reassociation response */
 #endif
+    vos_timer_t packetdump_timer;
 }tCsrRoamStruct;
 
 
@@ -1257,7 +1259,7 @@ tANI_BOOLEAN csrIsConnStateDisconnectedWds( tpAniSirGlobal pMac, tANI_U32 sessio
 tANI_BOOLEAN csrIsAnySessionInConnectState( tpAniSirGlobal pMac );
 tANI_BOOLEAN csrIsAllSessionDisconnected( tpAniSirGlobal pMac );
 tANI_BOOLEAN csrIsStaSessionConnected( tpAniSirGlobal pMac );
-tANI_BOOLEAN csrIsP2pSessionConnected( tpAniSirGlobal pMac );
+tANI_BOOLEAN csrIsP2pOrSapSessionConnected(tpAniSirGlobal pMac);
 tANI_BOOLEAN csrIsAnySessionConnected( tpAniSirGlobal pMac );
 tANI_BOOLEAN csrIsInfraConnected( tpAniSirGlobal pMac );
 tANI_BOOLEAN csrIsConcurrentInfraConnected( tpAniSirGlobal pMac );
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index 82754943fde9..50940de91d98 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -4096,6 +4096,8 @@ eHalStatus sme_ExtScanRegisterCallback (tHalHandle hHal,
 eHalStatus sme_bpf_offload_register_callback(tHalHandle hal,
 			void (*pbpf_get_offload_cb)(void *,
 			struct sir_bpf_get_offload *));
+VOS_STATUS sme_set_beacon_filter(uint32_t vdev_id, uint32_t *ie_map);
+VOS_STATUS sme_unset_beacon_filter(uint32_t vdev_id);
 
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 /* ---------------------------------------------------------------------------
@@ -4523,4 +4525,13 @@ eHalStatus sme_get_mib_stats(tHalHandle hal,
 				uint8_t session_id);
 void sme_update_fine_time_measurement_capab(tHalHandle hal, uint32_t val);
 
+eHalStatus sme_delete_all_tdls_peers(tHalHandle hal, uint8_t session_id);
+
+eHalStatus sme_update_txrate(tHalHandle hal, struct sir_txrate_update *req);
+
+void sme_send_disassoc_req_frame(tHalHandle hal, uint8_t session_id,
+		uint8_t *peer_mac, tANI_U16 reason, uint8_t wait_for_ack);
+
+VOS_STATUS sme_is_session_valid(tHalHandle hal_handle, uint8_t session_id);
+
 #endif //#if !defined( __SME_API_H )
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index da4239ce857c..58822d9881c2 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -70,6 +70,7 @@
 #endif /* FEATURE_WLAN_ESE && !FEATURE_WLAN_ESE_UPLOAD */
 #include "regdomain_common.h"
 #include "vos_utils.h"
+#include <wlan_logging_sock_svc.h>
 
 #define MAX_PWR_FCC_CHAN_12 8
 #define MAX_PWR_FCC_CHAN_13 2
@@ -100,6 +101,9 @@
 
 #define MAX_SOCIAL_CHANNELS  3
 
+/* packet dump timer duration of 60 secs */
+#define PKT_DUMP_TIMER_DURATION 60
+
 #ifdef WLAN_FEATURE_ROAM_SCAN_OFFLOAD
 static tANI_BOOLEAN bRoamScanOffloadStarted = VOS_FALSE;
 #endif
@@ -746,6 +750,58 @@ void csrSetGlobalCfgs( tpAniSirGlobal pMac )
     csrSetDefaultDot11Mode( pMac );
 }
 
+/**
+ * csr_packetdump_timer_handler() - packet dump timer
+ * handler
+ * @pv: user data
+ *
+ * This function is used to handle packet dump timer
+ *
+ * Return: None
+ *
+ */
+static void csr_packetdump_timer_handler(void *pv)
+{
+	VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
+			"%s Invoking packetdump deregistration API", __func__);
+	wlan_deregister_txrx_packetdump();
+}
+
+/**
+ * csr_packetdump_timer_stop() - stops packet dump timer
+ *
+ * This function is used to stop packet dump timer
+ *
+ * Return: None
+ *
+ */
+void csr_packetdump_timer_stop(void)
+{
+	eHalStatus status;
+	tHalHandle hal;
+	tpAniSirGlobal mac;
+	v_CONTEXT_t vos_ctx_ptr;
+
+	/* get the global voss context */
+	vos_ctx_ptr = vos_get_global_context(VOS_MODULE_ID_VOSS, NULL);
+	if (NULL == vos_ctx_ptr) {
+		VOS_ASSERT(0);
+		return;
+	}
+
+	hal = vos_get_context(VOS_MODULE_ID_SME, vos_ctx_ptr);
+	if (NULL == hal) {
+		VOS_ASSERT(0);
+		return;
+	}
+
+	mac = PMAC_STRUCT(hal);
+	status = vos_timer_stop(&mac->roam.packetdump_timer);
+	if (!HAL_STATUS_SUCCESS(status)) {
+		smsLog(mac, LOGE, FL("cannot stop packetdump timer"));
+	}
+}
+
 eHalStatus csrRoamOpen(tpAniSirGlobal pMac)
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
@@ -769,6 +825,12 @@ eHalStatus csrRoamOpen(tpAniSirGlobal pMac)
         smsLog(pMac, LOGE, FL("cannot allocate memory for WaitForKey time out timer"));
         break;
       }
+      status = vos_timer_init(&pMac->roam.packetdump_timer, VOS_TIMER_TYPE_SW,
+                              csr_packetdump_timer_handler, pMac);
+      if (!HAL_STATUS_SUCCESS(status)) {
+        smsLog(pMac, LOGE, FL("cannot allocate memory for packetdump timer"));
+        break;
+      }
       status = vos_timer_init(&pMac->roam.tlStatsReqInfo.hTlStatsTimer,
                               VOS_TIMER_TYPE_SW, csrRoamTlStatsTimerHandler, pMac);
       if (!HAL_STATUS_SUCCESS(status))
@@ -791,6 +853,8 @@ eHalStatus csrRoamClose(tpAniSirGlobal pMac)
     vos_timer_destroy(&pMac->roam.hTimerWaitForKey);
     vos_timer_stop(&pMac->roam.tlStatsReqInfo.hTlStatsTimer);
     vos_timer_destroy(&pMac->roam.tlStatsReqInfo.hTlStatsTimer);
+    vos_timer_stop(&pMac->roam.packetdump_timer);
+    vos_timer_destroy(&pMac->roam.packetdump_timer);
     return (eHAL_STATUS_SUCCESS);
 }
 
@@ -1764,18 +1828,9 @@ eHalStatus csrChangeDefaultConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pPa
         {
             pMac->roam.configParam.nPassiveMinChnTimeConc = pParam->nPassiveMinChnTimeConc;
         }
-        if (pParam->nRestTimeConc)
-        {
-            pMac->roam.configParam.nRestTimeConc = pParam->nRestTimeConc;
-        }
-        if (pParam->min_rest_time_conc)
-        {
-            pMac->roam.configParam.min_rest_time_conc = pParam->min_rest_time_conc;
-        }
-        if (pParam->idle_time_conc)
-        {
-            pMac->roam.configParam.idle_time_conc = pParam->idle_time_conc;
-        }
+        pMac->roam.configParam.nRestTimeConc = pParam->nRestTimeConc;
+        pMac->roam.configParam.min_rest_time_conc = pParam->min_rest_time_conc;
+        pMac->roam.configParam.idle_time_conc = pParam->idle_time_conc;
         if (pParam->nNumStaChanCombinedConc)
         {
             pMac->roam.configParam.nNumStaChanCombinedConc = pParam->nNumStaChanCombinedConc;
@@ -2152,6 +2207,8 @@ eHalStatus csrGetConfigParam(tpAniSirGlobal pMac, tCsrConfigParam *pParam)
                      pMac->roam.configParam.sendDeauthBeforeCon;
         pParam->first_scan_bucket_threshold =
                      pMac->first_scan_bucket_threshold;
+        pParam->enableHtSmps = pMac->roam.configParam.enableHtSmps;
+        pParam->htSmps = pMac->roam.configParam.htSmps;
         status = eHAL_STATUS_SUCCESS;
     }
     return (status);
@@ -11906,10 +11963,25 @@ eHalStatus csrRoamIssueStopBss( tpAniSirGlobal pMac, tANI_U32 sessionId, eCsrRoa
 //pNumChan is a caller allocated space with the sizeof pChannels
 eHalStatus csrGetCfgValidChannels(tpAniSirGlobal pMac, tANI_U8 *pChannels, tANI_U32 *pNumChan)
 {
+    uint8_t num_chan_temp = 0;
+    int i;
+    eHalStatus status;
 
-    return (ccmCfgGetStr(pMac, WNI_CFG_VALID_CHANNEL_LIST,
+    status = ccmCfgGetStr(pMac, WNI_CFG_VALID_CHANNEL_LIST,
                   (tANI_U8 *)pChannels,
-                  pNumChan));
+                  pNumChan);
+    if (status != eHAL_STATUS_SUCCESS)
+       return status;
+
+    for (i = 0; i < *pNumChan; i++) {
+         if (!vos_is_dsrc_channel(vos_chan_to_freq(pChannels[i]))) {
+             pChannels[num_chan_temp] = pChannels[i];
+             num_chan_temp++;
+         }
+    }
+
+    *pNumChan = num_chan_temp;
+    return status;
 }
 
 tPowerdBm csrGetCfgMaxTxPower (tpAniSirGlobal pMac, tANI_U8 channel)
@@ -13464,6 +13536,8 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
     tANI_U8 wpaRsnIE[DOT11F_IE_RSN_MAX_LEN];    //RSN MAX is bigger than WPA MAX
     tANI_U32 ucDot11Mode = 0;
     tANI_U8 txBFCsnValue = 0;
+    tpCsrNeighborRoamControlInfo neigh_roam_info;
+    eHalStatus packetdump_timer_status;
 
     if(!pSession)
     {
@@ -13476,6 +13550,21 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
         smsLog(pMac, LOGE, FL(" pBssDescription is NULL"));
         return eHAL_STATUS_FAILURE;
     }
+    neigh_roam_info = &pMac->roam.neighborRoamInfo[sessionId];
+
+    if ((eWNI_SME_REASSOC_REQ == messageType) ||
+            CSR_IS_CHANNEL_5GHZ(pBssDescription->channelId) ||
+            (abs(pBssDescription->rssi) <
+            (neigh_roam_info->cfgParams.neighborLookupThreshold +
+             neigh_roam_info->cfgParams.hi_rssi_scan_rssi_delta))) {
+            pSession->disable_hi_rssi = true;
+            VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
+                      "Disabling HI_RSSI feature, AP channel=%d, rssi=%d",
+                      pBssDescription->channelId, pBssDescription->rssi);
+    }
+    else {
+            pSession->disable_hi_rssi = false;
+    }
 
     do {
         pSession->joinFailStatusCode.statusCode = eSIR_SME_SUCCESS;
@@ -14167,6 +14256,19 @@ eHalStatus csrSendJoinReqMsg( tpAniSirGlobal pMac, tANI_U32 sessionId, tSirBssDe
         }
         else
         {
+            if (pProfile->csrPersona == VOS_STA_MODE) {
+                smsLog(pMac, LOG1, FL(" Invoking packetdump register API"));
+                wlan_register_txrx_packetdump();
+                packetdump_timer_status =
+                         vos_timer_start(&pMac->roam.packetdump_timer,
+                         (PKT_DUMP_TIMER_DURATION*VOS_TIMER_TO_SEC_UNIT)/
+                          VOS_TIMER_TO_MS_UNIT);
+                if (!HAL_STATUS_SUCCESS(packetdump_timer_status)) {
+                     smsLog(pMac, LOGE, FL("cannot start packetdump timer"));
+                     smsLog(pMac, LOGE, FL("packetdump_timer_status: %d"),
+                                                    packetdump_timer_status);
+                }
+            }
 #ifndef WLAN_MDM_CODE_REDUCTION_OPT
             if (eWNI_SME_JOIN_REQ == messageType)
             {
@@ -17509,15 +17611,11 @@ eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 sessionId,
     * there is no need to enable the HI_RSSI feature. This feature
     * is useful only if we are connected to a 2.4 GHz AP and we wish
     * to connect to a better 5GHz AP is available.*/
-   if(CSR_IS_CHANNEL_5GHZ(op_channel)) {
-      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
-        "Disabling HI_RSSI feature since the connected AP is 5GHz");
+   if(pSession->disable_hi_rssi)
       pRequestBuf->hi_rssi_scan_rssi_delta = 0;
-   }
-   else {
+   else
       pRequestBuf->hi_rssi_scan_rssi_delta =
            pNeighborRoamInfo->cfgParams.hi_rssi_scan_rssi_delta;
-   }
    VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
       "hi_rssi_delta=%d, hi_rssi_max_count=%d,"
       "hi_rssi_delay=%d, hi_rssi_ub=%d",
diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index 74aec8eb9426..a4735a67e28e 100644
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -348,11 +348,11 @@ eHalStatus csrQueueScanRequest(tpAniSirGlobal pMac, tANI_U8 sessionId,
      */
 
     if(csrIsStaSessionConnected(pMac) &&
-       !csrIsP2pSessionConnected(pMac))
+       !csrIsP2pOrSapSessionConnected(pMac))
     {
       nNumChanCombinedConc = pMac->roam.configParam.nNumStaChanCombinedConc;
     }
-    else if(csrIsP2pSessionConnected(pMac))
+    else if(csrIsP2pOrSapSessionConnected(pMac))
     {
       nNumChanCombinedConc = pMac->roam.configParam.nNumP2PChanCombinedConc;
     }
@@ -364,7 +364,7 @@ eHalStatus csrQueueScanRequest(tpAniSirGlobal pMac, tANI_U8 sessionId,
             eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN))) &&
 #endif
          (pScanCmd->u.scanCmd.u.scanRequest.p2pSearch != 1)) ||
-            (csrIsP2pSessionConnected(pMac)) )
+            (csrIsP2pOrSapSessionConnected(pMac)))
     {
         tCsrScanRequest scanReq;
         tANI_U8 numChn = pScanCmd->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels;
@@ -5289,7 +5289,7 @@ static tANI_BOOLEAN csrScanProcessScanResults( tpAniSirGlobal pMac, tSmeCmd *pCo
                        eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN))) &&
 #endif
             (pCommand->u.scanCmd.u.scanRequest.p2pSearch != 1)) ||
-            (csrIsP2pSessionConnected(pMac)))
+            (csrIsP2pOrSapSessionConnected(pMac)))
         {
             /* if active connected sessions present then continue to split scan
              * with specified interval between consecutive scans */
@@ -6700,11 +6700,11 @@ static void csrStaApConcTimerHandler(void *pv)
          */
 
         if((csrIsStaSessionConnected(pMac) &&
-           !csrIsP2pSessionConnected(pMac)))
+           !csrIsP2pOrSapSessionConnected(pMac)))
         {
            nNumChanCombinedConc = pMac->roam.configParam.nNumStaChanCombinedConc;
         }
-        else if(csrIsP2pSessionConnected(pMac))
+        else if(csrIsP2pOrSapSessionConnected(pMac))
         {
            nNumChanCombinedConc = pMac->roam.configParam.nNumP2PChanCombinedConc;
         }
@@ -6718,7 +6718,7 @@ static void csrStaApConcTimerHandler(void *pv)
                      eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN))) &&
 #endif
                   (pScanCmd->u.scanCmd.u.scanRequest.p2pSearch != 1)) ||
-              (csrIsP2pSessionConnected(pMac))))
+              (csrIsP2pOrSapSessionConnected(pMac))))
         {
              vos_mem_set(&scanReq, sizeof(tCsrScanRequest), 0);
 
diff --git a/CORE/SME/src/csr/csrUtil.c b/CORE/SME/src/csr/csrUtil.c
index 34ed7ca40dac..86dba0c4998a 100644
--- a/CORE/SME/src/csr/csrUtil.c
+++ b/CORE/SME/src/csr/csrUtil.c
@@ -1008,7 +1008,7 @@ tANI_BOOLEAN csrIsStaSessionConnected( tpAniSirGlobal pMac )
     return( fRc );
 }
 
-tANI_BOOLEAN csrIsP2pSessionConnected( tpAniSirGlobal pMac )
+tANI_BOOLEAN csrIsP2pOrSapSessionConnected(tpAniSirGlobal pMac)
 {
     tANI_U32 i;
     tANI_BOOLEAN fRc = eANI_BOOLEAN_FALSE;
diff --git a/CORE/SME/src/oemData/oemDataApi.c b/CORE/SME/src/oemData/oemDataApi.c
index 40ad8e977b06..ed3b327f3845 100644
--- a/CORE/SME/src/oemData/oemDataApi.c
+++ b/CORE/SME/src/oemData/oemDataApi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -138,7 +138,7 @@ eHalStatus oemData_OemDataReq(tHalHandle hHal,
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
     tSmeCmd *pOemDataCmd = NULL;
-    tOemDataReq *cmd_req, *mac_req;
+    tOemDataReq *cmd_req;
 
     do
     {
@@ -148,29 +148,8 @@ eHalStatus oemData_OemDataReq(tHalHandle hHal,
            break;
         }
 
-        pMac->oemData.oemDataReqConfig.sessionId = sessionId;
         pMac->oemData.oemDataReqID = *(pOemDataReqID);
 
-        pMac->oemData.oemDataReqConfig.data_len =
-        oemDataReqConfig->data_len;
-
-        if (pMac->oemData.oemDataReqConfig.data) {
-            vos_mem_free(pMac->oemData.oemDataReqConfig.data);
-            pMac->oemData.oemDataReqConfig.data = NULL;
-        }
-
-        pMac->oemData.oemDataReqConfig.data =
-                vos_mem_malloc(pMac->oemData.oemDataReqConfig.data_len);
-        if (!pMac->oemData.oemDataReqConfig.data) {
-            smsLog(pMac, LOGE, FL("memory alloc failed"));
-            status = eHAL_STATUS_FAILED_ALLOC;
-            break;
-        }
-
-        vos_mem_copy((v_VOID_t*)(pMac->oemData.oemDataReqConfig.data),
-                     (v_VOID_t*)(oemDataReqConfig->data),
-                     oemDataReqConfig->data_len);
-
         pMac->oemData.oemDataReqActive = eANI_BOOLEAN_FALSE;
 
         pOemDataCmd = smeGetCommandBuffer(pMac);
@@ -182,12 +161,10 @@ eHalStatus oemData_OemDataReq(tHalHandle hHal,
             pOemDataCmd->u.oemDataCmd.oemDataReqID = pMac->oemData.oemDataReqID;
 
             cmd_req = &(pOemDataCmd->u.oemDataCmd.oemDataReq);
-            mac_req = &(pMac->oemData.oemDataReqConfig);
             /* set the oem data request */
-            cmd_req->sessionId = mac_req->sessionId;
-            cmd_req->data_len =  mac_req->data_len;
-            cmd_req->data =
-            vos_mem_malloc(cmd_req->data_len);
+            cmd_req->sessionId = sessionId;
+            cmd_req->data_len =  oemDataReqConfig->data_len;
+            cmd_req->data = vos_mem_malloc(cmd_req->data_len);
 
             if (!cmd_req->data) {
                 smsLog(pMac, LOGE, FL("memory alloc failed"));
@@ -195,7 +172,8 @@ eHalStatus oemData_OemDataReq(tHalHandle hHal,
                 break;
             }
 
-            vos_mem_copy(cmd_req->data, mac_req->data, cmd_req->data_len);
+            vos_mem_copy(cmd_req->data, oemDataReqConfig->data,
+                         cmd_req->data_len);
         }
         else
         {
@@ -246,18 +224,15 @@ eHalStatus oemData_SendMBOemDataReq(tpAniSirGlobal pMac, tOemDataReq *pOemDataRe
         smsLog(pMac, LOGE, "Memory Allocation failed. %s", __func__);
         return eHAL_STATUS_FAILURE;
     }
-    pMsg->data = vos_mem_malloc(pOemDataReq->data_len);
-    if (!pMsg->data) {
-        smsLog(pMac, LOGP, FL("vos_mem_malloc failed"));
-        vos_mem_free(pMsg);
-        return eHAL_STATUS_FAILED_ALLOC;
-    }
+
     msgLen = (uint16_t) (sizeof(*pMsg) + pOemDataReq->data_len);
     pMsg->messageType = pal_cpu_to_be16((tANI_U16)eWNI_SME_OEM_DATA_REQ);
     pMsg->messageLen = pal_cpu_to_be16(msgLen);
     vos_mem_copy(pMsg->selfMacAddr, pSession->selfMacAddr, sizeof(tSirMacAddr) );
     pMsg->data_len = pOemDataReq->data_len;
-    vos_mem_copy(pMsg->data, pOemDataReq->data, pOemDataReq->data_len);
+    /* Incoming buffer ptr saved, set to null to avoid free by caller */
+    pMsg->data = pOemDataReq->data;
+    pOemDataReq->data = NULL;
     smsLog(pMac, LOGW, "OEM_DATA: sending message to pe%s", __func__);
     status = palSendMBMessage(pMac->hHdd, pMsg);
 
diff --git a/CORE/SME/src/rrm/sme_rrm.c b/CORE/SME/src/rrm/sme_rrm.c
index 9652bde3f5a3..7fd41e3288fe 100644
--- a/CORE/SME/src/rrm/sme_rrm.c
+++ b/CORE/SME/src/rrm/sme_rrm.c
@@ -590,6 +590,8 @@ static eHalStatus sme_RrmSendScanResult( tpAniSirGlobal pMac,
    while (pScanResult)
    {
       pNextResult = sme_ScanResultGetNext(pMac, pResult);
+      smsLog(pMac, LOG1, "Scan res timer:%lu, rrm scan timer:%lu",
+             pScanResult->timer, RRM_scan_timer);
       if(pScanResult->timer >= RRM_scan_timer)
       {
           pScanResultsArr[counter++] = pScanResult;
@@ -597,28 +599,35 @@ static eHalStatus sme_RrmSendScanResult( tpAniSirGlobal pMac,
       pScanResult = pNextResult; //sme_ScanResultGetNext(hHal, pResult);
       if (counter >= SIR_BCN_REPORT_MAX_BSS_DESC)
          break;
-      }
+   }
 
-   if (counter)
-   {
-          smsLog(pMac, LOG1, " Number of BSS Desc with RRM Scan %d ", counter);
+   smsLog(pMac, LOG1, " Number of BSS Desc with RRM Scan %d ", counter);
+   /*
+    * The beacon report should be sent whether the counter is zero or non-zero.
+    * There might be a few scan results in the cache but not actually are a
+    * result of this scan. During that scenario, the counter will be zero.
+    * The report should be sent and LIM will further cleanup the RRM to
+    * accept the further incoming requests
+    * In case the counter is Zero, the pScanResultsArr will be NULL.
+    * The next level routine does a check for the measurementDone to determine
+    * whether to send a report or not.
+    */
 #if defined(FEATURE_WLAN_ESE_UPLOAD)
-         if (eRRM_MSG_SOURCE_ESE_UPLOAD == pSmeRrmContext->msgSource)
-         {
-             status = sme_EseSendBeaconReqScanResults(pMac,
+   if (eRRM_MSG_SOURCE_ESE_UPLOAD == pSmeRrmContext->msgSource)
+   {
+       status = sme_EseSendBeaconReqScanResults(pMac,
                                                 sessionId,
                                                 chanList[0],
                                                 pScanResultsArr,
                                                 measurementDone,
                                                 counter);
-         }
-         else
-#endif /*FEATURE_WLAN_ESE_UPLOAD*/
-             status = sme_RrmSendBeaconReportXmitInd( pMac,
-                                                pScanResultsArr,
-                                                measurementDone,
-                                                counter);
    }
+   else
+#endif /*FEATURE_WLAN_ESE_UPLOAD*/
+       status = sme_RrmSendBeaconReportXmitInd(pMac,
+                                               pScanResultsArr,
+                                               measurementDone,
+                                               counter);
    sme_ScanResultPurge(pMac, pResult);
 
    return status;
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 5edf064e0650..7a9ba78128e2 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -12119,15 +12119,16 @@ eHalStatus sme_UpdateTdlsPeerState(tHalHandle hHal,
                                          csrGetCfgMaxTxPower(pMac, chanId);
 
                if (vos_nv_getChannelEnabledState(chanId) == NV_CHANNEL_DFS)
-               {
-                   pTdlsPeerStateParams->peerCap.peerChan[num].dfsSet =
-                                                                  VOS_TRUE;
-               }
+                   continue;
                else
                {
                    pTdlsPeerStateParams->peerCap.peerChan[num].dfsSet =
                                                                   VOS_FALSE;
                }
+
+               if (vos_nv_skip_dsrc_dfs_2g(chanId, NV_CHANNEL_SKIP_DSRC))
+                   continue;
+
                num++;
            }
        }
@@ -13344,7 +13345,8 @@ static struct sir_ocb_config *sme_copy_sir_ocb_config(struct sir_ocb_config *src
 		src->channel_count * sizeof(*src->channels) +
 		src->schedule_size * sizeof(*src->schedule) +
 		src->dcc_ndl_chan_list_len +
-		src->dcc_ndl_active_state_list_len;
+		src->dcc_ndl_active_state_list_len +
+		src->def_tx_param_size;
 
 	dst = vos_mem_malloc(length);
 	if (!dst)
@@ -13371,6 +13373,13 @@ static struct sir_ocb_config *sme_copy_sir_ocb_config(struct sir_ocb_config *src
 	vos_mem_copy(dst->dcc_ndl_active_state_list,
 		     src->dcc_ndl_active_state_list,
 		     src->dcc_ndl_active_state_list_len);
+	cursor += src->dcc_ndl_active_state_list_len;
+	if (src->def_tx_param && src->def_tx_param_size) {
+		dst->def_tx_param = cursor;
+		vos_mem_copy(dst->def_tx_param, src->def_tx_param,
+			     src->def_tx_param_size);
+	}
+
 	return dst;
 }
 
@@ -18168,13 +18177,14 @@ eHalStatus sme_set_bpf_instructions(tHalHandle hal,
 			FL("Failed to alloc set_offload"));
 		return eHAL_STATUS_FAILED_ALLOC;
 	}
+	vos_mem_zero(set_offload, sizeof(*set_offload));
 
 	set_offload->session_id = req->session_id;
 	set_offload->filter_id = req->filter_id;
 	set_offload->current_offset = req->current_offset;
 	set_offload->total_length = req->total_length;
+	set_offload->current_length = req->current_length;
 	if (set_offload->total_length) {
-		set_offload->current_length = req->current_length;
 		set_offload->program = vos_mem_malloc(sizeof(uint8_t) *
 						req->current_length);
 		vos_mem_copy(set_offload->program, req->program,
@@ -18344,3 +18354,254 @@ void sme_update_fine_time_measurement_capab(tHalHandle hal, uint32_t val)
 			rrmConfig.rm_capability)->fine_time_meas_rpt = 1;
 	}
 }
+
+eHalStatus sme_update_txrate(tHalHandle hal,
+			struct sir_txrate_update *req)
+{
+	eHalStatus          status     = eHAL_STATUS_SUCCESS;
+	VOS_STATUS          vos_status = VOS_STATUS_SUCCESS;
+	tpAniSirGlobal      mac_ctx    = PMAC_STRUCT(hal);
+	vos_msg_t           vos_msg;
+	struct sir_txrate_update *txrate_update;
+
+	smsLog(mac_ctx, LOG1, FL("enter"));
+
+	txrate_update = vos_mem_malloc(sizeof(*txrate_update));
+	if (NULL == txrate_update) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			FL("Failed to alloc txrate_update"));
+		return eHAL_STATUS_FAILED_ALLOC;
+	}
+
+	txrate_update->session_id = req->session_id;
+	txrate_update->txrate = req->txrate;
+	vos_mem_copy(txrate_update->bssid, req->bssid, VOS_MAC_ADDR_SIZE);
+
+	status = sme_AcquireGlobalLock(&mac_ctx->sme);
+	if (eHAL_STATUS_SUCCESS == status) {
+		/* Serialize the req through MC thread */
+		vos_msg.bodyptr = txrate_update;
+		vos_msg.type = WDA_UPDATE_TX_RATE;
+		vos_status = vos_mq_post_message(VOS_MQ_ID_WDA, &vos_msg);
+
+		if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+			VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				FL("Post Update tx_rate msg fail"));
+			status = eHAL_STATUS_FAILURE;
+			vos_mem_free(txrate_update);
+		}
+		sme_ReleaseGlobalLock(&mac_ctx->sme);
+	} else {
+
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+		FL("sme_AcquireGlobalLock failed"));
+		vos_mem_free(txrate_update);
+	}
+	smsLog(mac_ctx, LOG1, FL("exit"));
+	return status;
+}
+
+/**
+ * sme_delete_all_tdls_peers: send request to delete tdls peers
+ * @hal: handler for HAL
+ * @sessionId: session id
+ *
+ * Functtion send's request to lim to delete tdls peers
+ *
+ * Return: Success: eHAL_STATUS_SUCCESS Failure: Error value
+ */
+eHalStatus sme_delete_all_tdls_peers(tHalHandle hal, uint8_t session_id)
+{
+	struct sir_del_all_tdls_peers *msg;
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	tpAniSirGlobal p_mac = PMAC_STRUCT(hal);
+	tCsrRoamSession *session = CSR_GET_SESSION(p_mac, session_id);
+
+	msg = vos_mem_malloc(sizeof(*msg));
+	if (NULL == msg) {
+		smsLog(p_mac, LOGE, FL("memory alloc failed"));
+		return eHAL_STATUS_FAILURE;
+	}
+
+	vos_mem_set(msg, sizeof(*msg), 0);
+
+	msg->msg_type = pal_cpu_to_be16((uint16_t)eWNI_SME_DEL_ALL_TDLS_PEERS);
+	msg->msg_len =  pal_cpu_to_be16((uint16_t)sizeof(*msg));
+
+	vos_mem_copy(msg->bssid, session->connectedProfile.bssid,
+			sizeof(tSirMacAddr));
+
+	status = palSendMBMessage(p_mac->hHdd, msg);
+
+	if(status != eHAL_STATUS_SUCCESS) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			FL("palSendMBMessage Failed"));
+		status = eHAL_STATUS_FAILURE;
+	}
+
+	return status;
+}
+
+/**
+ * sme_set_beacon_filter() - set the beacon filter configuration
+ * @vdev_id: vdev index id
+ * @ie_map: bitwise array of IEs
+ *
+ * Return: Return VOS_STATUS, otherwise appropriate failure code
+ */
+VOS_STATUS sme_set_beacon_filter(uint32_t vdev_id, uint32_t *ie_map)
+{
+	vos_msg_t vos_message;
+	VOS_STATUS vos_status;
+	struct beacon_filter_param *filter_param;
+
+	filter_param = vos_mem_malloc(sizeof(*filter_param));
+	if (NULL == filter_param) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				"%s: fail to alloc filter_param", __func__);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	filter_param->vdev_id = vdev_id;
+
+	vos_mem_copy(filter_param->ie_map, ie_map,
+			BCN_FLT_MAX_ELEMS_IE_LIST*sizeof(uint32_t));
+
+	vos_message.type = WDA_ADD_BCN_FILTER_CMDID;
+	vos_message.bodyptr = filter_param;
+	vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA,
+					&vos_message);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			"%s: Not able to post msg to WDA!",
+			__func__);
+
+		vos_mem_free(filter_param);
+	}
+	return vos_status;
+}
+
+/**
+ * sme_unset_beacon_filter() - set the beacon filter configuration
+ * @vdev_id: vdev index id
+ *
+ * Return: Return VOS_STATUS, otherwise appropriate failure code
+ */
+VOS_STATUS sme_unset_beacon_filter(uint32_t vdev_id)
+{
+	vos_msg_t vos_message;
+	VOS_STATUS vos_status;
+	struct beacon_filter_param *filter_param;
+
+	filter_param = vos_mem_malloc(sizeof(*filter_param));
+	if (NULL == filter_param) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+				"%s: fail to alloc filter_param", __func__);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	filter_param->vdev_id = vdev_id;
+
+	vos_message.type = WDA_REMOVE_BCN_FILTER_CMDID;
+	vos_message.bodyptr = filter_param;
+	vos_status = vos_mq_post_message(VOS_MODULE_ID_WDA,
+					&vos_message);
+	if (!VOS_IS_STATUS_SUCCESS(vos_status)) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			"%s: Not able to post msg to WDA!",
+			__func__);
+
+		vos_mem_free(filter_param);
+	}
+	return vos_status;
+}
+
+
+/**
+ * sme_send_disassoc_req_frame - send disassoc req
+ * @hal: handler to hal
+ * @session_id: session id
+ * @peer_mac: peer mac address
+ * @reason: reason for disassociation
+ * wait_for_ack: wait for acknowledgment
+ *
+ * function to send disassoc request to lim
+ *
+ * return: none
+ */
+void sme_send_disassoc_req_frame(tHalHandle hal, uint8_t session_id,
+	uint8_t *peer_mac, uint16_t reason, uint8_t wait_for_ack)
+{
+	struct sme_send_disassoc_frm_req *msg;
+	eHalStatus status = eHAL_STATUS_SUCCESS;
+	tpAniSirGlobal p_mac = PMAC_STRUCT(hal);
+	tANI_U8 *buf;
+	tANI_U16 tmp;
+
+	msg = vos_mem_malloc(sizeof(struct sme_send_disassoc_frm_req));
+
+	if (NULL == msg)
+		status = eHAL_STATUS_FAILURE;
+	else
+		status = eHAL_STATUS_SUCCESS;
+	if (!HAL_STATUS_SUCCESS(status))
+		return;
+
+	vos_mem_set(msg, sizeof(struct sme_send_disassoc_frm_req), 0);
+	msg->msg_type = pal_cpu_to_be16((tANI_U16)eWNI_SME_SEND_DISASSOC_FRAME);
+
+	msg->length =
+	    pal_cpu_to_be16((tANI_U16)sizeof(struct sme_send_disassoc_frm_req));
+
+	buf = &msg->session_id;
+
+	/* session id */
+	*buf = (tANI_U8) session_id;
+	buf += sizeof(tANI_U8);
+
+	/* transaction id */
+	*buf = 0;
+	*(buf + 1) = 0;
+	buf += sizeof(tANI_U16);
+
+	/* Set the peer MAC address before sending the message to LIM */
+	vos_mem_copy(buf, peer_mac, VOS_MAC_ADDR_SIZE);
+
+	buf += VOS_MAC_ADDR_SIZE;
+
+	/* reasoncode */
+	tmp = pal_cpu_to_be16(reason);
+	vos_mem_copy(buf, &tmp, sizeof(tANI_U16));
+	buf += sizeof(tANI_U16);
+
+	*buf =  wait_for_ack;
+	buf += sizeof(tANI_U8);
+
+	status = palSendMBMessage(p_mac->hHdd, msg );
+
+	if(status != eHAL_STATUS_SUCCESS)
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			FL("palSendMBMessage Failed"));
+}
+
+/*
+ *  sme_is_session_valid(): verify a sme session
+ *  @param hal_handle: hal handle for getting global mac struct.
+ *  @param session_id: sme_session_id
+ *  Return: eHAL_STATUS_SUCCESS or non-zero on failure.
+ */
+VOS_STATUS sme_is_session_valid(tHalHandle hal_handle, uint8_t session_id)
+{
+	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal_handle);
+
+	if (NULL == mac_ctx) {
+		VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+			  FL("mac_ctx is null!!"));
+	        VOS_ASSERT(0);
+	        return VOS_STATUS_E_FAILURE;
+	}
+	if (CSR_IS_SESSION_VALID(mac_ctx, session_id))
+	        return VOS_STATUS_SUCCESS;
+
+	return VOS_STATUS_E_FAILURE;
+}
diff --git a/CORE/SVC/inc/wlan_logging_sock_svc.h b/CORE/SVC/inc/wlan_logging_sock_svc.h
index a76041394c62..aee9974289d9 100644
--- a/CORE/SVC/inc/wlan_logging_sock_svc.h
+++ b/CORE/SVC/inc/wlan_logging_sock_svc.h
@@ -77,4 +77,6 @@ static inline void wlan_report_log_completion(uint32_t is_fatal,
 
 void wlan_pkt_stats_to_logger_thread(void *pl_hdr, void *pkt_dump, void *data);
 
+void wlan_deregister_txrx_packetdump(void);
+void wlan_register_txrx_packetdump(void);
 #endif /* WLAN_LOGGING_SOCK_SVC_H */
diff --git a/CORE/SVC/src/logging/wlan_logging_sock_svc.c b/CORE/SVC/src/logging/wlan_logging_sock_svc.c
index 729ddfd65ca9..4d89f9c12fe8 100644
--- a/CORE/SVC/src/logging/wlan_logging_sock_svc.c
+++ b/CORE/SVC/src/logging/wlan_logging_sock_svc.c
@@ -44,6 +44,35 @@
 #include "pktlog_ac.h"
 #include <linux/rtc.h>
 #include <vos_diag_core_log.h>
+#include "limApi.h"
+#include "ol_txrx_api.h"
+#include "csrApi.h"
+
+#define MAX_NUM_PKT_LOG 32
+
+/**
+ * struct tx_status - tx status
+ * @tx_status_ok: successfully sent + acked
+ * @tx_status_discard: discard - not sent (congestion control)
+ * @tx_status_no_ack: no_ack - sent, but no ack
+ * @tx_status_download_fail: download_fail -
+ * the host could not deliver the tx frame to the target
+ * @tx_status_peer_del: peer_del - tx completion for
+ * alreay deleted peer used for HL case
+ *
+ * This enum has tx status types
+ */
+enum tx_status {
+	tx_status_ok,
+	tx_status_discard,
+	tx_status_no_ack,
+	tx_status_download_fail,
+	tx_status_peer_del,
+};
+
+static uint8_t gtx_count;
+static uint8_t grx_count;
+
 #define LOGGING_TRACE(level, args...) \
 		VOS_TRACE(VOS_MODULE_ID_HDD, level, ## args)
 
@@ -79,14 +108,16 @@ struct log_msg {
  * Tx/Rx packet stats
  * @status: Status
  * @type: Type
- * @reserved: Reserved
+ * @driver_ts: driver timestamp
+ * @fw_ts: fw timestamp
  */
 
 struct packet_dump {
 	unsigned char status;
 	unsigned char type;
-	unsigned char reserved[6];
-};
+	uint32_t driver_ts;
+	uint16_t fw_ts;
+}__attribute__((__packed__));
 
 /**
  * struct pkt_stats_msg - This data structure contains the
@@ -167,7 +198,8 @@ static int wlan_send_sock_msg_to_app(tAniHdr *wmsg, int radio,
 		return -EINVAL;
 	}
 
-	payload_len = wmsg_length + sizeof(wnl->radio);
+	payload_len = wmsg_length + sizeof(wnl->radio) +
+			sizeof(struct nlmsghdr);
 	tot_msg_len = NLMSG_SPACE(payload_len);
 	skb = dev_alloc_skb(tot_msg_len);
 	if (skb == NULL) {
@@ -316,7 +348,8 @@ int wlan_log_to_user(VOS_TRACE_LEVEL log_level, char *to_be_sent, int length)
 	struct rtc_time tm;
 	unsigned long local_time;
 
-	if (!vos_is_multicast_logging()) {
+	if ((!vos_is_multicast_logging()) ||
+              (!gwlan_logging.is_active)) {
 		/*
 		 * This is to make sure that we print the logs to kmsg console
 		 * when no logger app is running. This is also needed to
@@ -450,8 +483,9 @@ static int pkt_stats_fill_headers(struct sk_buff *skb)
 	diag_type = DIAG_TYPE_LOGS;
 	vos_mem_copy(skb_push(skb, sizeof(int)), &diag_type, sizeof(int));
 
-	extra_header_len = sizeof(msg_header.radio) + sizeof(tAniHdr);
-	nl_payload_len = NLMSG_ALIGN(extra_header_len + skb->len);
+	extra_header_len = sizeof(msg_header.radio) + sizeof(tAniHdr) +
+				sizeof(struct nlmsghdr);
+	nl_payload_len = extra_header_len + skb->len;
 
 	msg_header.nlh.nlmsg_type = ANI_NL_MSG_PUMAC;
 	msg_header.nlh.nlmsg_len = nl_payload_len;
@@ -584,7 +618,8 @@ static int send_filled_buffers_to_user(void)
 		spin_unlock_irqrestore(&gwlan_logging.spin_lock, flags);
 		/* 4 extra bytes for the radio idx */
 		payload_len = plog_msg->filled_length +
-			sizeof(wnl->radio) + sizeof(tAniHdr);
+			sizeof(wnl->radio) + sizeof(tAniHdr) +
+			sizeof(struct nlmsghdr);
 
 		tot_msg_len = NLMSG_SPACE(payload_len);
 		nlh = nlmsg_put(skb, 0, nlmsg_seq++,
@@ -1119,12 +1154,7 @@ void wlan_pkt_stats_to_logger_thread(void *pl_hdr, void *pkt_dump, void *data)
 	}
 
 	pkt_stats_dump = (struct packet_dump *)pkt_dump;
-	if (pkt_stats_dump)
-		total_stats_len = sizeof(struct ath_pktlog_hdr) +
-					pktlog_hdr->size +
-					sizeof(struct packet_dump);
-	else
-		total_stats_len = sizeof(struct ath_pktlog_hdr) +
+	total_stats_len = sizeof(struct ath_pktlog_hdr) +
 					pktlog_hdr->size;
 
 	spin_lock_irqsave(&gwlan_logging.pkt_stats_lock, flags);
@@ -1149,15 +1179,24 @@ void wlan_pkt_stats_to_logger_thread(void *pl_hdr, void *pkt_dump, void *data)
 			pktlog_hdr,
 			sizeof(struct ath_pktlog_hdr));
 
-	if (pkt_stats_dump)
+	if (pkt_stats_dump) {
 		vos_mem_copy(skb_put(ptr,
 				sizeof(struct packet_dump)),
 				pkt_stats_dump,
 				sizeof(struct packet_dump));
+		pktlog_hdr->size -= sizeof(struct packet_dump);
+	}
 
-	vos_mem_copy(skb_put(ptr,
-				pktlog_hdr->size),
-				data, pktlog_hdr->size);
+	if (data)
+		vos_mem_copy(skb_put(ptr,
+					pktlog_hdr->size),
+					data, pktlog_hdr->size);
+
+	if (pkt_stats_dump &&
+		pkt_stats_dump->type == STOP_MONITOR) {
+		wake_up_thread = true;
+		wlan_get_pkt_stats_free_node();
+	}
 
 	spin_unlock_irqrestore(&gwlan_logging.pkt_stats_lock, flags);
 
@@ -1168,4 +1207,237 @@ void wlan_pkt_stats_to_logger_thread(void *pl_hdr, void *pkt_dump, void *data)
 	}
 }
 
+/**
+ * driver_hal_status_map() - maps driver to hal
+ * status
+ * @status: status to be mapped
+ *
+ * This function is used to map driver to hal status
+ *
+ * Return: None
+ *
+ */
+static void driver_hal_status_map(uint8_t *status)
+{
+	switch (*status) {
+	case tx_status_ok:
+		*status = TX_PKT_FATE_ACKED;
+		break;
+	case tx_status_discard:
+		*status = TX_PKT_FATE_DRV_DROP_OTHER;
+		break;
+	case tx_status_no_ack:
+		*status = TX_PKT_FATE_SENT;
+		break;
+	case tx_status_download_fail:
+		*status = TX_PKT_FATE_FW_QUEUED;
+		break;
+	default:
+		*status = TX_PKT_FATE_DRV_DROP_OTHER;
+		break;
+	}
+}
+
+
+/*
+ * send_packetdump() - send packet dump
+ * @netbuf: netbuf
+ * @status: status of tx packet
+ * @vdev_id: virtual device id
+ * @type: type of packet
+ *
+ * This function is used to send packet dump to HAL layer
+ * using wlan_pkt_stats_to_logger_thread
+ *
+ * Return: None
+ *
+ */
+static void send_packetdump(adf_nbuf_t netbuf, uint8_t status,
+				uint8_t vdev_id, uint8_t type)
+{
+	struct ath_pktlog_hdr pktlog_hdr = {0};
+	struct packet_dump pd_hdr = {0};
+	hdd_context_t *hdd_ctx;
+	hdd_adapter_t *adapter;
+	v_CONTEXT_t vos_ctx;
+
+	vos_ctx = vos_get_global_context(VOS_MODULE_ID_HDD, NULL);
+	if (!vos_ctx)
+		return;
+
+	hdd_ctx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
+	if (!hdd_ctx)
+		return;
+
+	adapter = hdd_get_adapter_by_vdev(hdd_ctx, vdev_id);
+
+	/* Send packet dump only for STA interface */
+	if (adapter->device_mode != WLAN_HDD_INFRA_STATION)
+		return;
+
+	pktlog_hdr.log_type = PKTLOG_TYPE_PKT_DUMP;
+	pktlog_hdr.size = sizeof(pd_hdr) + netbuf->len;
+
+	pd_hdr.status = status;
+	pd_hdr.type = type;
+	pd_hdr.driver_ts = vos_timer_get_system_time();
+
+	if ((type == TX_MGMT_PKT) || (type == TX_DATA_PKT))
+		gtx_count++;
+	else if ((type == RX_MGMT_PKT) || (type == RX_DATA_PKT))
+		grx_count++;
+
+	wlan_pkt_stats_to_logger_thread(&pktlog_hdr, &pd_hdr, netbuf->data);
+}
+
+
+/*
+ * send_packetdump_monitor() - sends start/stop packet dump indication
+ * @type: type of packet
+ *
+ * This function is used to indicate HAL layer to start/stop monitoring
+ * of packets
+ *
+ * Return: None
+ *
+ */
+static void send_packetdump_monitor(uint8_t type)
+{
+	struct ath_pktlog_hdr pktlog_hdr = {0};
+	struct packet_dump pd_hdr = {0};
+
+	pktlog_hdr.log_type = PKTLOG_TYPE_PKT_DUMP;
+	pktlog_hdr.size = sizeof(pd_hdr);
+
+	pd_hdr.type = type;
+
+	LOGGING_TRACE(VOS_TRACE_LEVEL_INFO,
+			"fate Tx-Rx %s: type: %d", __func__, type);
+
+	wlan_pkt_stats_to_logger_thread(&pktlog_hdr, &pd_hdr, NULL);
+}
+
+/**
+ * wlan_deregister_txrx_packetdump() - tx/rx packet dump
+ * deregistration
+ *
+ * This function is used to deregister tx/rx packet dump callbacks
+ * with ol, pe and htt layers
+ *
+ * Return: None
+ *
+ */
+void wlan_deregister_txrx_packetdump(void)
+{
+	if (gtx_count || grx_count) {
+		ol_deregister_packetdump_callback();
+		pe_deregister_packetdump_callback();
+		htt_deregister_packetdump_callback();
+		send_packetdump_monitor(STOP_MONITOR);
+		csr_packetdump_timer_stop();
+
+		gtx_count = 0;
+		grx_count = 0;
+	} else
+		LOGGING_TRACE(VOS_TRACE_LEVEL_INFO,
+			"%s: deregistered packetdump already", __func__);
+}
+
+/*
+ * check_txrx_packetdump_count() - function to check
+ * tx/rx packet dump global counts
+ *
+ * This function is used to check global counts of tx/rx
+ * packet dump functionality.
+ *
+ * Return: 1 if either gtx_count or grx_count reached 32
+ *             0 otherwise
+ *
+ */
+static bool check_txrx_packetdump_count(void)
+{
+	if (gtx_count == MAX_NUM_PKT_LOG ||
+		grx_count == MAX_NUM_PKT_LOG) {
+		LOGGING_TRACE(VOS_TRACE_LEVEL_INFO,
+			"%s gtx_count: %d grx_count: %d deregister packetdump",
+			__func__, gtx_count, grx_count);
+		wlan_deregister_txrx_packetdump();
+		return 1;
+	}
+	return 0;
+}
+
+/*
+ * tx_packetdump_cb() - tx packet dump callback
+ * @netbuf: netbuf
+ * @status: status of tx packet
+ * @vdev_id: virtual device id
+ * @type: packet type
+ *
+ * This function is used to send tx packet dump to HAL layer
+ * and deregister packet dump callbacks
+ *
+ * Return: None
+ *
+ */
+static void tx_packetdump_cb(adf_nbuf_t netbuf, uint8_t status,
+				uint8_t vdev_id, uint8_t type)
+{
+	bool temp;
+
+	temp = check_txrx_packetdump_count();
+	if (temp)
+		return;
+
+	driver_hal_status_map(&status);
+	send_packetdump(netbuf, status, vdev_id, type);
+}
+
+
+/*
+ * rx_packetdump_cb() - rx packet dump callback
+ * @netbuf: netbuf
+ * @status: status of rx packet
+ * @vdev_id: virtual device id
+ * @type: packet type
+ *
+ * This function is used to send rx packet dump to HAL layer
+ * and deregister packet dump callbacks
+ *
+ * Return: None
+ *
+ */
+static void rx_packetdump_cb(adf_nbuf_t netbuf, uint8_t status,
+				uint8_t vdev_id, uint8_t type)
+{
+	bool temp;
+
+	temp = check_txrx_packetdump_count();
+	if (temp)
+		return;
+
+	send_packetdump(netbuf, status, vdev_id, type);
+}
+
+
+/**
+ * wlan_register_txrx_packetdump() - tx/rx packet dump
+ * registration
+ *
+ * This function is used to register tx/rx packet dump callbacks
+ * with ol, pe and htt layers
+ *
+ * Return: None
+ *
+ */
+void wlan_register_txrx_packetdump(void)
+{
+	ol_register_packetdump_callback(tx_packetdump_cb);
+	pe_register_packetdump_callback(rx_packetdump_cb);
+	htt_register_packetdump_callback(rx_packetdump_cb);
+	send_packetdump_monitor(START_MONITOR);
+
+	gtx_count = 0;
+	grx_count = 0;
+}
 #endif /* WLAN_LOGGING_SOCK_SVC_ENABLE */
diff --git a/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c b/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
index b51fa3e16e5a..ce8dbed37eea 100644
--- a/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
+++ b/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
@@ -80,7 +80,8 @@ int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid)
          __func__, radio);
       return -EINVAL;
    }
-   payload_len = wmsg_length + 4;  // 4 extra bytes for the radio idx
+   /* 4 extra bytes for the radio idx */
+   payload_len = wmsg_length + 4 + sizeof(struct  nlmsghdr);
    tot_msg_len = NLMSG_SPACE(payload_len);
    if ((skb = dev_alloc_skb(tot_msg_len)) == NULL) {
       PTT_TRACE(VOS_TRACE_LEVEL_ERROR, "%s: dev_alloc_skb() failed for msg size[%d]\n",
diff --git a/CORE/SYS/legacy/src/system/src/sysEntryFunc.c b/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
index c050fd4f4e5c..dd7131302801 100644
--- a/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
+++ b/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
@@ -170,7 +170,7 @@ sysBbtProcessMessageCore(tpAniSirGlobal pMac, tpSirMsgQ pMsg, tANI_U32 type,
 
             dropReason = limIsPktCandidateForDrop(pMac, pBd, subType);
             if (dropReason != eMGMT_DROP_NO_DROP) {
-                PELOG1(limLog(pMac, LOG1,
+                PELOG1(sysLog(pMac, LOG1,
                             FL("Mgmt Frame %d being dropped, reason: %d\n"),
                             subType, dropReason);)
                 MTRACE(macTrace(pMac,   TRACE_CODE_RX_MGMT_DROP, NO_SESSION, dropReason);)
diff --git a/CORE/SYS/legacy/src/utils/src/parserApi.c b/CORE/SYS/legacy/src/utils/src/parserApi.c
index 29781d761a17..d84d584822d3 100644
--- a/CORE/SYS/legacy/src/utils/src/parserApi.c
+++ b/CORE/SYS/legacy/src/utils/src/parserApi.c
@@ -747,7 +747,7 @@ PopulateDot11fHTCaps(tpAniSirGlobal           pMac,
     }
 
     /* If STA and mimo power save is enabled include ht smps */
-    if (psessionEntry && (!pMac->lteCoexAntShare) &&
+    if (psessionEntry &&
         LIM_IS_STA_ROLE(psessionEntry) &&
         (psessionEntry->enableHtSmps) &&
         (!psessionEntry->supported_nss_1x1)) {
@@ -3681,6 +3681,11 @@ sirParseBeaconIE(tpAniSirGlobal        pMac,
     pBeaconStruct->Vendor1IEPresent = pBies->Vendor1IE.present;
     pBeaconStruct->Vendor2IEPresent = pBies->Vendor2IE.present;
     pBeaconStruct->Vendor3IEPresent = pBies->Vendor3IE.present;
+    if (pBies->ExtCap.present) {
+        pBeaconStruct->ExtCap.present = 1;
+        vos_mem_copy( &pBeaconStruct->ExtCap, &pBies->ExtCap,
+                sizeof(tDot11fIEExtCap));
+    }
 
     vos_mem_free(pBies);
     return eSIR_SUCCESS;
@@ -4513,10 +4518,10 @@ sirConvertQosMapConfigureFrame2Struct(tpAniSirGlobal    pMac,
     tDot11fQosMapConfigure mapConfigure;
     tANI_U32 status;
     status = dot11fUnpackQosMapConfigure(pMac, pFrame, nFrame, &mapConfigure);
-    if ( DOT11F_FAILED( status ) )
+    if ( DOT11F_FAILED( status ) || !mapConfigure.QosMapSet.present )
     {
         dot11fLog(pMac, LOGE,
-                  FL("Failed to parse Qos Map Config frame(0x%08x, %d bytes):"),
+                  FL("Failed to parse or QosMapSet not present(0x%08x, %d bytes):"),
                   status, nFrame);
         PELOG2(sirDumpBuf(pMac, SIR_DBG_MODULE_ID, LOG2, pFrame, nFrame);)
         return eSIR_FAILURE;
diff --git a/CORE/VOSS/inc/vos_api.h b/CORE/VOSS/inc/vos_api.h
index b151d6a2e74f..68ad5d249046 100644
--- a/CORE/VOSS/inc/vos_api.h
+++ b/CORE/VOSS/inc/vos_api.h
@@ -365,7 +365,5 @@ VOS_STATUS vos_flush_logs(uint32_t is_fatal,
 		uint32_t reason_code);
 void vos_logging_set_fw_flush_complete(void);
 void vos_probe_threads(void);
-bool vos_is_crash_indication_pending(void);
-void vos_set_crash_indication_pending(bool value);
 void vos_pkt_stats_to_logger_thread(void *pl_hdr, void *pkt_dump, void *data);
 #endif // if !defined __VOS_API_H
diff --git a/CORE/VOSS/inc/vos_cnss.h b/CORE/VOSS/inc/vos_cnss.h
index c12bffb1c408..3222040b7333 100644
--- a/CORE/VOSS/inc/vos_cnss.h
+++ b/CORE/VOSS/inc/vos_cnss.h
@@ -108,12 +108,6 @@ static inline void vos_get_boottime_ts(struct timespec *ts)
 	ktime_get_ts(ts);
 }
 
-static inline int vos_get_ramdump_mem(unsigned long *address,
-				unsigned long *size)
-{
-	return 0;
-}
-
 static inline void *vos_get_virt_ramdump_mem(unsigned long *size)
 {
 	return NULL;
@@ -134,7 +128,10 @@ static inline int vos_set_cpus_allowed_ptr(struct task_struct *task, ulong cpu)
 #endif
 
 static inline void vos_device_self_recovery(void) { return; }
-static inline void vos_request_pm_qos(u32 qos_val) { return; }
+static inline void vos_request_pm_qos_type(int latency_type, u32 qos_val)
+{
+	return;
+}
 static inline void vos_remove_pm_qos(void) { return; }
 static inline int vos_request_bus_bandwidth(int bandwidth) { return 0; }
 static inline int vos_get_platform_cap(void *cap) { return 1; }
@@ -214,7 +211,15 @@ static inline int vos_unregister_oob_irq_handler(void *pm_oob)
 {
 	return -ENOSYS;
 }
+
+static inline void vos_dump_stack (struct task_struct *task)
+{
+}
 #else
+static inline void vos_dump_stack (struct task_struct *task)
+{
+	cnss_dump_stack(task);
+}
 static inline void vos_init_work(struct work_struct *work, work_func_t func)
 {
 	cnss_init_work(work, func);
@@ -304,23 +309,15 @@ static inline void vos_get_boottime_ts(struct timespec *ts)
         cnss_get_boottime(ts);
 }
 
-#ifdef CONFIG_CNSS_PCI
-static inline void vos_request_pm_qos(u32 qos_val)
+static inline void vos_request_pm_qos_type(int latency_type, u32 qos_val)
 {
-	cnss_request_pm_qos(qos_val);
+	cnss_request_pm_qos_type(latency_type, qos_val);
 }
-#else
-static inline void vos_request_pm_qos(u32 qos_val) {}
-#endif
 
-#ifdef CONFIG_CNSS_PCI
 static inline void vos_remove_pm_qos(void)
 {
 	cnss_remove_pm_qos();
 }
-#else
-static inline void vos_remove_pm_qos(void) {}
-#endif
 
 static inline int vos_vendor_cmd_reply(struct sk_buff *skb)
 {
@@ -399,11 +396,6 @@ static inline int vos_request_bus_bandwidth(int bandwidth)
 {
 	return cnss_request_bus_bandwidth(bandwidth);
 }
-#else
-static inline int vos_request_bus_bandwidth(int bandwidth)
-{
-	return 0;
-}
 #endif
 
 #ifdef CONFIG_CNSS_PCI
@@ -438,12 +430,6 @@ static inline int vos_wlan_pm_control(bool vote)
 }
 #endif
 
-static inline int vos_get_ramdump_mem(unsigned long *address,
-				unsigned long *size)
-{
-	return cnss_get_ramdump_mem(address, size);
-}
-
 static inline int vos_get_platform_cap(void *cap)
 {
 	return cnss_get_platform_cap(cap);
diff --git a/CORE/VOSS/inc/vos_mq.h b/CORE/VOSS/inc/vos_mq.h
index b5a46193861f..34e1fffb6020 100644
--- a/CORE/VOSS/inc/vos_mq.h
+++ b/CORE/VOSS/inc/vos_mq.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -115,6 +115,12 @@ typedef enum
 } VOS_MQ_ID;
 
 
+#define HIGH_PRIORITY 1
+#define LOW_PRIORITY  0
+VOS_STATUS vos_mq_post_message_by_priority(VOS_MQ_ID msg_queue_id,
+					   vos_msg_t *message,
+					   int is_high_priority);
+
 /**---------------------------------------------------------------------------
 
   \brief vos_mq_post_message() - post a message to a message queue
@@ -129,7 +135,7 @@ typedef enum
     <li> TL
   </ul>
 
-  \param msgQueueId - identifies the message queue upon which the message
+  \param msg_queue_id - identifies the message queue upon which the message
          will be posted.
 
   \param message - a pointer to a message buffer.  Memory for this message
@@ -152,6 +158,11 @@ typedef enum
   \sa
 
   --------------------------------------------------------------------------*/
-VOS_STATUS vos_mq_post_message( VOS_MQ_ID msgQueueId, vos_msg_t *message );
+static inline VOS_STATUS vos_mq_post_message(VOS_MQ_ID msg_queue_id,
+					     vos_msg_t *message)
+{
+	return vos_mq_post_message_by_priority (msg_queue_id, message,
+						LOW_PRIORITY);
+}
 
 #endif // if !defined __VOS_MQ_H
diff --git a/CORE/VOSS/inc/vos_nvitem.h b/CORE/VOSS/inc/vos_nvitem.h
index 495d362f8885..96ddcca934cc 100644
--- a/CORE/VOSS/inc/vos_nvitem.h
+++ b/CORE/VOSS/inc/vos_nvitem.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -92,6 +92,17 @@ typedef enum
 }
 eDFS_CAC_STATUS;
 
+/**
+ * struct chan_to_ht_40_index_map - information of secondary channel index
+ *
+ * @ht_40_minus_index: HT40- channel index
+ * @ht_40_plus_index: HT40+ channel index
+ */
+struct chan_to_ht_40_index_map {
+   uint16 ht_40_minus_index;
+   uint16 ht_40_plus_index;
+};
+
 // country code type
 typedef v_U8_t v_COUNTRYCODE_t[VOS_COUNTRY_CODE_LEN];
 
@@ -244,7 +255,7 @@ VOS_STATUS vos_nv_setRegDomain(void * clientCtxt, v_REGDOMAIN_t regId,
   -------------------------------------------------------------------------*/
 eNVChannelEnabledType vos_nv_getChannelEnabledState(v_U32_t rfChannel);
 
-uint8_t vos_nv_skip_dfs_and_2g(uint32_t rf_channel);
+uint8_t vos_nv_skip_dsrc_dfs_2g(uint32_t rf_channel, int32_t skip_group);
 VOS_STATUS vos_nv_get_dfs_region(uint8_t *dfs_region);
 VOS_STATUS vos_nv_set_dfs_region(uint8_t dfs_region);
 
@@ -255,4 +266,6 @@ VOS_STATUS vos_init_wiphy_from_nv_bin(void);
 const char * voss_DomainIdtoString(const v_U8_t domainIdCurrent);
 VOS_STATUS vos_init_wiphy_from_eeprom(void);
 bool vos_is_dsrc_channel(uint16_t);
+uint32_t vos_nv_get_channel_flags(uint32_t rf_channel);
+int vos_update_band(uint8_t  band);
 #endif // __VOS_NVITEM_H
diff --git a/CORE/VOSS/inc/vos_utils.h b/CORE/VOSS/inc/vos_utils.h
index 7538d22d38f4..53e9731a8b7c 100644
--- a/CORE/VOSS/inc/vos_utils.h
+++ b/CORE/VOSS/inc/vos_utils.h
@@ -199,5 +199,6 @@ void vos_tdls_tx_rx_mgmt_event(uint8_t event_id, uint8_t tx_rx,
 #endif /* FEATURE_WLAN_DIAG_SUPPORT */
 
 unsigned long vos_rounddown_pow_of_two(unsigned long n);
+int vos_status_to_os_return(VOS_STATUS status);
 
 #endif // #if !defined __VOSS_UTILS_H
diff --git a/CORE/VOSS/src/vos_api.c b/CORE/VOSS/src/vos_api.c
index 66755fa633e6..f9377494bfa3 100644
--- a/CORE/VOSS/src/vos_api.c
+++ b/CORE/VOSS/src/vos_api.c
@@ -272,6 +272,29 @@ static void vos_set_nan_enable(tMacOpenParameters *param,
 }
 #endif
 
+#ifdef QCA_SUPPORT_TXRX_HL_BUNDLE
+/**
+ * vos_set_bundle_params() - set bundle params in mac open param
+ * @wma_handle: Pointer to mac open param
+ * @hdd_ctx: Pointer to hdd context
+ *
+ * Return: none
+ */
+static void vos_set_bundle_params(tMacOpenParameters *param,
+					hdd_context_t *hdd_ctx)
+{
+	param->pkt_bundle_timer_value =
+		hdd_ctx->cfg_ini->pkt_bundle_timer_value;
+	param->pkt_bundle_size = hdd_ctx->cfg_ini->pkt_bundle_size;
+}
+#else
+static void vos_set_bundle_params(tMacOpenParameters *param,
+					hdd_context_t *hdd_ctx)
+{
+}
+#endif
+
+
 /*---------------------------------------------------------------------------
 
   \brief vos_open() - Open the vOSS Module
@@ -547,6 +570,7 @@ VOS_STATUS vos_open( v_CONTEXT_t *pVosContext, v_SIZE_t hddContextSize )
 #endif
 
    vos_set_nan_enable(&macOpenParms, pHddCtx);
+   vos_set_bundle_params(&macOpenParms, pHddCtx);
 
    vStatus = WDA_open( gpVosContext, gpVosContext->pHDDContext,
                        hdd_update_tgt_cfg,
@@ -1771,45 +1795,22 @@ VOS_STATUS vos_free_context( v_VOID_t *pVosContext, VOS_MODULE_ID moduleID,
 
 } /* vos_free_context() */
 
-
-/**---------------------------------------------------------------------------
-
-  \brief vos_mq_post_message() - post a message to a message queue
-
-  This API allows messages to be posted to a specific message queue.  Messages
-  can be posted to the following message queues:
-
-  <ul>
-    <li> SME
-    <li> PE
-    <li> HAL
-    <li> TL
-  </ul>
-
-  \param msgQueueId - identifies the message queue upon which the message
-         will be posted.
-
-  \param message - a pointer to a message buffer.  Memory for this message
-         buffer is allocated by the caller and free'd by the vOSS after the
-         message is posted to the message queue.  If the consumer of the
-         message needs anything in this message, it needs to copy the contents
-         before returning from the message queue handler.
-
-  \return VOS_STATUS_SUCCESS - the message has been successfully posted
-          to the message queue.
-
-          VOS_STATUS_E_INVAL - The value specified by msgQueueId does not
-          refer to a valid Message Queue Id.
-
-          VOS_STATUS_E_FAULT  - message is an invalid pointer.
-
-          VOS_STATUS_E_FAILURE - the message queue handler has reported
-          an unknown failure.
-
-  \sa
-
-  --------------------------------------------------------------------------*/
-VOS_STATUS vos_mq_post_message( VOS_MQ_ID msgQueueId, vos_msg_t *pMsg )
+/**
+ * vos_mq_post_message_by_priority() - posts message using priority
+ * to message queue
+ * @msgQueueId: message queue id
+ * @pMsg: message to be posted
+ * @is_high_priority: wheather message is high priority
+ *
+ * This function is used to post high priority message to message queue
+ *
+ * Return: VOS_STATUS_SUCCESS on success
+ *         VOS_STATUS_E_FAILURE on failure
+ *         VOS_STATUS_E_RESOURCES on resource allocation failure
+ */
+VOS_STATUS vos_mq_post_message_by_priority(VOS_MQ_ID msgQueueId,
+					   vos_msg_t *pMsg,
+					   int is_high_priority)
 {
   pVosMqType      pTargetMq   = NULL;
   pVosMsgWrapper  pMsgWrapper = NULL;
@@ -1904,14 +1905,17 @@ VOS_STATUS vos_mq_post_message( VOS_MQ_ID msgQueueId, vos_msg_t *pMsg )
   vos_mem_copy( (v_VOID_t*)pMsgWrapper->pVosMsg,
                 (v_VOID_t*)pMsg, sizeof(vos_msg_t));
 
-  vos_mq_put(pTargetMq, pMsgWrapper);
+  if (is_high_priority)
+      vos_mq_put_front(pTargetMq, pMsgWrapper);
+  else
+      vos_mq_put(pTargetMq, pMsgWrapper);
 
   set_bit(MC_POST_EVENT_MASK, &gpVosContext->vosSched.mcEventFlag);
   wake_up_interruptible(&gpVosContext->vosSched.mcWaitQueue);
 
   return VOS_STATUS_SUCCESS;
 
-} /* vos_mq_post_message()*/
+}
 
 v_VOID_t
 vos_sys_probe_thread_cback
@@ -2792,46 +2796,6 @@ void vos_logging_set_fw_flush_complete(void)
 }
 
 /**
- * vos_is_crash_indication_pending() - get crash indication status
- *
- * After wlan start up, we check the pending flag to know whether
- * it was caused by SSR. If it 's true,we need to indicate a netlink
- * message to wlan service to restart application process (hostapd).
- *
- * Return: true if carsh indication is pending.
- */
-bool vos_is_crash_indication_pending(void)
-{
-	if (gpVosContext == NULL) {
-		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-		"%s: global voss context is NULL", __func__);
-	  return false;
-	}
-
-	return gpVosContext->crash_indication_pending;
-}
-
-/**
- * vos_set_crash_indication_pending() - set crash indication status
- * @value: pending statue to set
- *
- * Upon crash happends, we set the pending flag to true. To indicate
- * the crash indication event to wlan service is needed after recovery.
- *
- * Return: None
- */
-void vos_set_crash_indication_pending(bool value)
-{
-	if (gpVosContext == NULL) {
-		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
-		"%s: global voss context is NULL", __func__);
-		return ;
-	}
-
-	gpVosContext->crash_indication_pending = value;
-}
-
-/**
  * vos_probe_threads() - VOS API to post messages
  * to all the threads to detect if they are active or not
  *
diff --git a/CORE/VOSS/src/vos_mq.c b/CORE/VOSS/src/vos_mq.c
index b585064f39fb..81c43598594e 100644
--- a/CORE/VOSS/src/vos_mq.c
+++ b/CORE/VOSS/src/vos_mq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -162,6 +162,29 @@ __inline void vos_mq_put(pVosMqType pMq, pVosMsgWrapper pMsgWrapper)
 
 } /* vos_mq_put() */
 
+/**
+ * vos_mq_put_front() - adds a message to the head of message queue
+ * @mq: message queue
+ * @msg_wrapper: message wrapper
+ *
+ * This function is used to add a message to the head of message queue
+ *
+ * Return: None
+ */
+void vos_mq_put_front(pVosMqType mq, pVosMsgWrapper msg_wrapper)
+{
+	unsigned long flags;
+
+	if ((mq == NULL) || (msg_wrapper == NULL)) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+			"%s: NULL pointer passed", __func__);
+		return;
+	}
+
+	spin_lock_irqsave(&mq->mqLock, flags);
+	list_add(&msg_wrapper->msgNode, &mq->mqList);
+	spin_unlock_irqrestore(&mq->mqLock, flags);
+}
 
 /*---------------------------------------------------------------------------
 
diff --git a/CORE/VOSS/src/vos_nvitem.c b/CORE/VOSS/src/vos_nvitem.c
index c4b44b66a39d..2f98fcef663a 100644
--- a/CORE/VOSS/src/vos_nvitem.c
+++ b/CORE/VOSS/src/vos_nvitem.c
@@ -190,6 +190,61 @@ typedef struct
 /*----------------------------------------------------------------------------
  * Static Variable Definitions
  * -------------------------------------------------------------------------*/
+
+static struct
+chan_to_ht_40_index_map chan_to_ht_40_index[NUM_20MHZ_RF_CHANNELS] =
+{
+  /* ht_40_minus_index, ht_40_plus_index */
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_3},    //RF_CHAN_1,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_4},    //RF_CHAN_2,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_5},    //RF_CHAN_3,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_6},    //RF_CHAN_4,
+  {RF_CHAN_BOND_3, RF_CHAN_BOND_7},        //RF_CHAN_5,
+  {RF_CHAN_BOND_4, RF_CHAN_BOND_8},        //RF_CHAN_6,
+  {RF_CHAN_BOND_5, RF_CHAN_BOND_9},        //RF_CHAN_7,
+  {RF_CHAN_BOND_6, RF_CHAN_BOND_10},       //RF_CHAN_8,
+  {RF_CHAN_BOND_7, RF_CHAN_BOND_11},       //RF_CHAN_9,
+  {RF_CHAN_BOND_8, INVALID_RF_CHANNEL},    //RF_CHAN_10,
+  {RF_CHAN_BOND_9, INVALID_RF_CHANNEL},    //RF_CHAN_11,
+  {RF_CHAN_BOND_10, INVALID_RF_CHANNEL},   //RF_CHAN_12,
+  {RF_CHAN_BOND_11, INVALID_RF_CHANNEL},   //RF_CHAN_13,
+  {INVALID_RF_CHANNEL, INVALID_RF_CHANNEL},//RF_CHAN_14,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_242},  //RF_CHAN_240,
+  {RF_CHAN_BOND_242, RF_CHAN_BOND_246},    //RF_CHAN_244,
+  {RF_CHAN_BOND_246, RF_CHAN_BOND_250},    //RF_CHAN_248,
+  {RF_CHAN_BOND_250, INVALID_RF_CHANNEL},  //RF_CHAN_252,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_210},  //RF_CHAN_208,
+  {RF_CHAN_BOND_210, RF_CHAN_BOND_214},    //RF_CHAN_212,
+  {RF_CHAN_BOND_214, INVALID_RF_CHANNEL},  //RF_CHAN_216,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_38},   //RF_CHAN_36,
+  {RF_CHAN_BOND_38, RF_CHAN_BOND_42},      //RF_CHAN_40,
+  {RF_CHAN_BOND_42, RF_CHAN_BOND_46},      //RF_CHAN_44,
+  {RF_CHAN_BOND_46, RF_CHAN_BOND_50},      //RF_CHAN_48,
+  {RF_CHAN_BOND_50, RF_CHAN_BOND_54},      //RF_CHAN_52,
+  {RF_CHAN_BOND_54, RF_CHAN_BOND_58},      //RF_CHAN_56,
+  {RF_CHAN_BOND_58, RF_CHAN_BOND_62},      //RF_CHAN_60,
+  {RF_CHAN_BOND_62, INVALID_RF_CHANNEL},   //RF_CHAN_64,
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_102},  //RF_CHAN_100,
+  {RF_CHAN_BOND_102, RF_CHAN_BOND_106},    //RF_CHAN_104,
+  {RF_CHAN_BOND_106, RF_CHAN_BOND_110},    //RF_CHAN_108,
+  {RF_CHAN_BOND_110, RF_CHAN_BOND_114},    //RF_CHAN_112,
+  {RF_CHAN_BOND_114, RF_CHAN_BOND_118},    //RF_CHAN_116,
+  {RF_CHAN_BOND_118, RF_CHAN_BOND_122},    //RF_CHAN_120,
+  {RF_CHAN_BOND_122, RF_CHAN_BOND_126},    //RF_CHAN_124,
+  {RF_CHAN_BOND_126, RF_CHAN_BOND_130},    //RF_CHAN_128,
+  {RF_CHAN_BOND_130, RF_CHAN_BOND_134},    //RF_CHAN_132,
+  {RF_CHAN_BOND_134, RF_CHAN_BOND_138},    //RF_CHAN_136,
+  {RF_CHAN_BOND_138, RF_CHAN_BOND_142},    //RF_CHAN_140,
+#ifdef FEATURE_WLAN_CH144
+  {RF_CHAN_BOND_142, INVALID_RF_CHANNEL},  //RF_CHAN_144,
+#endif /* FEATURE_WLAN_CH144 */
+  {INVALID_RF_CHANNEL, RF_CHAN_BOND_151},  //RF_CHAN_149,
+  {RF_CHAN_BOND_151, RF_CHAN_BOND_155},    //RF_CHAN_153,
+  {RF_CHAN_BOND_155, RF_CHAN_BOND_159},    //RF_CHAN_157,
+  {RF_CHAN_BOND_159, RF_CHAN_BOND_163},    //RF_CHAN_161,
+  {RF_CHAN_BOND_163, INVALID_RF_CHANNEL},  //RF_CHAN_165,
+};
+
 // cache of country info table;
 // this is re-initialized from data on binary file
 // loaded on driver initialization if available
@@ -837,19 +892,36 @@ VOS_STATUS vos_nv_readDefaultCountryTable( uNvTables *tableData )
 }
 
 /**
- * vos_nv_skip_dfs_and_2g() - skip dfs and 2g band channels
+ * vos_nv_skip_dsrc_dfs_2g() - skip dsrc, dfs and 2g band channels
  * @rf_channel: input channel enum to know, whether to skip or add the channel
+ * @skip_group: group to skip
  *
  * Return: true or false
  */
-uint8_t vos_nv_skip_dfs_and_2g(uint32_t rf_channel)
+uint8_t vos_nv_skip_dsrc_dfs_2g(uint32_t rf_channel, int32_t skip_group)
 {
 	uint32_t channel_loop;
 	eRfChannels channel_enum = INVALID_RF_CHANNEL;
 	uint8_t ret = false;
+	int32_t start_channel, end_channel;
+
+	switch (skip_group){
+	case NV_CHANNEL_SKIP_DSRC:
+		start_channel = RF_CHAN_1;
+		end_channel = RF_CHAN_165;
+		break;
+	case NV_CHANNEL_SKIP_2G:
+		start_channel = RF_CHAN_36;
+		end_channel = RF_CHAN_165;
+		break;
+	default:
+		start_channel = RF_CHAN_1;
+		end_channel = RF_CHAN_184;
+		break;
+	}
 
-	for (channel_loop = RF_CHAN_36;
-	     channel_loop <= RF_CHAN_184; channel_loop++) {
+	for (channel_loop = start_channel;
+	     channel_loop <= end_channel; channel_loop++) {
 		if (rfChannels[channel_loop].channelNum == rf_channel) {
 			channel_enum = (eRfChannels)channel_loop;
 			break;
@@ -905,59 +977,41 @@ eNVChannelEnabledType vos_nv_getChannelEnabledState
    return regChannels[channelEnum].enabled;
 }
 
+/**
+ * vos_nv_get_channel_flags: Get channel flags
+ * @rf_channel: Channel number.
+ * This function is called to know associated flags with channel
+ *
+ * Return: updated Wiphy struct
+ */
+uint32_t vos_nv_get_channel_flags
+(
+   uint32_t  rf_channel
+)
+{
+	uint32_t       channel_loop;
+	eRfChannels   channel_enum = INVALID_RF_CHANNEL;
+
+	for(channel_loop = 0; channel_loop <= RF_CHAN_184; channel_loop++) {
+		if(rfChannels[channel_loop].channelNum == rf_channel) {
+			channel_enum = (eRfChannels)channel_loop;
+			break;
+		}
+	}
+
+	if (INVALID_RF_CHANNEL == channel_enum) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+			"vos_nv_get_channel_flags, invalid channel %d",
+			rf_channel);
+		return NV_CHANNEL_INVALID;
+	}
+	return regChannels[channel_enum].flags;
+}
+
 /******************************************************************
  Add CRDA regulatory support
 *******************************************************************/
 
-static int bw20_ch_index_to_bw40_ch_index(int k)
-{
-   int m = -1;
-   if (k >= RF_CHAN_1 && k <= RF_CHAN_13)
-   {
-       /*
-        * Channel bonding not valid for channel 14,
-        * So dont consider it
-        */
-      m = k - RF_CHAN_1 + RF_CHAN_BOND_3 ;
-      if (m > RF_CHAN_BOND_11)
-         m = RF_CHAN_BOND_11;
-   }
-   else if (k >= RF_CHAN_240 && k <= RF_CHAN_216)
-   {
-      m = k - RF_CHAN_240 + RF_CHAN_BOND_242 ;
-      if (m > RF_CHAN_BOND_214)
-         m = RF_CHAN_BOND_214;
-   }
-   else if (k >= RF_CHAN_36 && k <= RF_CHAN_64)
-   {
-      m = k - RF_CHAN_36 + RF_CHAN_BOND_38;
-      if (m > RF_CHAN_BOND_62)
-         m = RF_CHAN_BOND_62;
-   }
-#ifdef FEATURE_WLAN_CH144
-   else if (k >= RF_CHAN_100 && k <= RF_CHAN_144)
-#else
-   else if (k >= RF_CHAN_100 && k <= RF_CHAN_140)
-#endif /* FEATURE_WLAN_CH144 */
-   {
-      m = k - RF_CHAN_100 + RF_CHAN_BOND_102;
-#ifdef FEATURE_WLAN_CH144
-      if (m > RF_CHAN_BOND_142)
-         m = RF_CHAN_BOND_142;
-#else
-      if (m > RF_CHAN_BOND_138)
-         m = RF_CHAN_BOND_138;
-#endif /* FEATURE_WLAN_CH144 */
-   }
-   else if (k >= RF_CHAN_149 && k <= RF_CHAN_165)
-   {
-      m = k - RF_CHAN_149 + RF_CHAN_BOND_151;
-      if (m > RF_CHAN_BOND_163)
-         m = RF_CHAN_BOND_163;
-   }
-   return m;
-}
-
 /**------------------------------------------------------------------------
   \brief vos_nv_setRegDomain -
   \param clientCtxt  - Client Context, Not used for PRIMA
@@ -1223,7 +1277,93 @@ bool vos_is_dsrc_channel(uint16_t center_freq)
     }
     return 0;
 }
+/**
+ * vos_update_band: Update the band
+ * @eBand: Band value
+ *
+ * This function is called from the supplicant through a
+ * private ioctl to change the band value.
+ *
+ * Return: updated Wiphy struct
+ */
+int vos_update_band(v_U8_t  band_capability)
+{
+	v_CONTEXT_t vos_ctx = NULL;
+	hdd_context_t *hdd_ctx = NULL;
+	struct wiphy *wiphy = NULL;
+	int i, j;
+	eNVChannelEnabledType channel_enabled_state;
+	uint32_t flags;
+	ENTER();
+	vos_ctx = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
+
+	if (NULL != vos_ctx)
+		hdd_ctx = vos_get_context(VOS_MODULE_ID_HDD, vos_ctx);
+	else
+		return VOS_STATUS_E_EXISTS;
+
+	if (NULL == hdd_ctx) {
+		VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+				("Invalid hdd_ctx pointer") );
+		return VOS_STATUS_E_FAULT;
+	}
+
+	if (hdd_ctx->isLogpInProgress) {
+		VOS_TRACE( VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+				(" SSR in progress, return") );
+		return VOS_STATUS_SUCCESS;
+	}
+
+	wiphy = hdd_ctx->wiphy;
+
+	if (false == wiphy->registered) {
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+			("wiphy is not yet registered with the kernel"));
+		return VOS_STATUS_E_FAULT;
+	}
+
+	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+		if (NULL == wiphy->bands[i])
+			continue;
 
+		for (j = 0; j < wiphy->bands[i]->n_channels; j++) {
+			struct ieee80211_supported_band *band = wiphy->bands[i];
+
+			flags = vos_nv_get_channel_flags(
+					band->channels[j].hw_value);
+			channel_enabled_state =
+				vos_nv_getChannelEnabledState(
+						band->channels[j].hw_value);
+			/* 5G only */
+			if (IEEE80211_BAND_2GHZ == i &&
+					eCSR_BAND_5G == band_capability) {
+#ifdef WLAN_ENABLE_SOCIAL_CHANNELS_5G_ONLY
+				/* Enable Social channels for P2P */
+				if (WLAN_HDD_IS_SOCIAL_CHANNEL(
+					band->channels[j].center_freq) &&
+					NV_CHANNEL_ENABLE ==
+					channel_enabled_state)
+					band->channels[j].flags &=
+						~IEEE80211_CHAN_DISABLED;
+				else
+#endif
+					band->channels[j].flags |=
+						IEEE80211_CHAN_DISABLED;
+				continue;
+			} else if (IEEE80211_BAND_5GHZ == i &&
+					eCSR_BAND_24 == band_capability) {
+				/* 2.4G only */
+				band->channels[j].flags |=
+					IEEE80211_CHAN_DISABLED;
+				continue;
+			}
+			if (NV_CHANNEL_DISABLE != channel_enabled_state)
+				band->channels[j].flags = flags;
+
+		}
+	}
+	return 0;
+}
 
 /* create_linux_regulatory_entry to populate internal structures from wiphy */
 static int create_linux_regulatory_entry(struct wiphy *wiphy,
@@ -1268,14 +1408,6 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
 
     for (i = 0, m = 0; i<IEEE80211_NUM_BANDS; i++)
     {
-        /* 5G only */
-        if (i == IEEE80211_BAND_2GHZ && nBandCapability == eCSR_BAND_5G)
-            continue;
-
-        /* 2G only */
-        else if (i == IEEE80211_BAND_5GHZ && nBandCapability == eCSR_BAND_24)
-            continue;
-
         if (wiphy->bands[i] == NULL)
             continue;
 
@@ -1300,7 +1432,6 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
               n is internal channel index for corresponding 40MHz channel */
 
             k = m + j;
-            n = bw20_ch_index_to_bw40_ch_index(k);
 
             /* If the regulatory rules for a country do not explicilty
              * require a passive scan on a frequency, lift the passive
@@ -1376,18 +1507,23 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
             {
                 pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[k].enabled =
                     NV_CHANNEL_DISABLE;
-                if (n != -1)
+                n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                        chan_to_ht_40_index[k].ht_40_plus_index;
+                if (n != INVALID_RF_CHANNEL)
                     pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].enabled =
                         NV_CHANNEL_DISABLE;
-            }
 
-            /* nv cannot distinguish between DFS and passive channels */
-            else if ((wiphy->bands[i]->channels[j].flags &
+                n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                       chan_to_ht_40_index[k].ht_40_minus_index;
+                if (n != INVALID_RF_CHANNEL)
+                    pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].enabled =
+                        NV_CHANNEL_DISABLE;
+            } else if ((wiphy->bands[i]->channels[j].flags &
                      (IEEE80211_CHAN_RADAR | IEEE80211_CHAN_PASSIVE_SCAN)) ||
                       ((pHddCtx->cfg_ini->indoor_channel_support == FALSE) &&
                       (wiphy->bands[i]->channels[j].flags &
-                       IEEE80211_CHAN_INDOOR_ONLY)))
-            {
+                       IEEE80211_CHAN_INDOOR_ONLY))) {
+                /* nv cannot distinguish between DFS and passive channels */
 
                 if ((wiphy->bands[i]->channels[j].flags &
                     IEEE80211_CHAN_INDOOR_ONLY) &&
@@ -1405,24 +1541,49 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
 
                 /* Disable the center channel if neither HT40+ nor HT40- is allowed
                  */
-                if (n != -1)
+                if ((wiphy->bands[i]->channels[j].flags &
+                        IEEE80211_CHAN_NO_HT40) == IEEE80211_CHAN_NO_HT40)
                 {
-                    if ((wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_NO_HT40) ==
-                                                                 IEEE80211_CHAN_NO_HT40 )
-                    {
-                       pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].enabled =
-                            NV_CHANNEL_DISABLE;
+                    n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                        chan_to_ht_40_index[k].ht_40_plus_index;
+                    if (n != INVALID_RF_CHANNEL)
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].enabled = NV_CHANNEL_DISABLE;
+
+                    n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                       chan_to_ht_40_index[k].ht_40_minus_index;
+                    if (n != INVALID_RF_CHANNEL)
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].enabled = NV_CHANNEL_DISABLE;
+                } else {
+                    n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                        chan_to_ht_40_index[k].ht_40_plus_index;
+                    if (!(wiphy->bands[i]->channels[j].flags &
+                            IEEE80211_CHAN_NO_HT40PLUS) &&
+                            (n != INVALID_RF_CHANNEL)) {
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].enabled = NV_CHANNEL_DFS;
+                        /* 40MHz channel power is half of 20MHz (-3dB) ?? */
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].pwrLimit = (tANI_S8)
+                               (((wiphy->bands[i]->channels[j].max_power)) - 3);
                     }
-                    else
-                    {
-                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].enabled =
-                            NV_CHANNEL_DFS;
 
+                    n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                       chan_to_ht_40_index[k].ht_40_minus_index;
+                    if (!(wiphy->bands[i]->channels[j].flags &
+                            IEEE80211_CHAN_NO_HT40MINUS) &&
+                            (n != INVALID_RF_CHANNEL)) {
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].enabled = NV_CHANNEL_DFS;
                         /* 40MHz channel power is half of 20MHz (-3dB) ?? */
-                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].pwrLimit =
-                            (tANI_S8) (((wiphy->bands[i]->channels[j].max_power))-3);
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].pwrLimit = (tANI_S8)
+                               (((wiphy->bands[i]->channels[j].max_power)) - 3);
                     }
+
                 }
+
                 if ((wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_NO_80MHZ) == 0)
                 {
                    if (NULL == pHddCtx)
@@ -1435,9 +1596,8 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
                       pHddCtx->isVHT80Allowed = 1;
                    }
                 }
-            }
-            else /* Enable is only last flag we support */
-            {
+            } else {
+                /* Enable is only last flag we support */
                 pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
                     channels[k].enabled = NV_CHANNEL_ENABLE;
 
@@ -1447,23 +1607,48 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
 
                 /* Disable the center channel if neither HT40+ nor HT40- is allowed
                  */
-                if (n != -1)
+                if ((wiphy->bands[i]->channels[j].flags &
+                             IEEE80211_CHAN_NO_HT40) == IEEE80211_CHAN_NO_HT40)
                 {
-                    if ((wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_NO_HT40) ==
-                                                                 IEEE80211_CHAN_NO_HT40 )
-                    {
-                       pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].enabled =
-                            NV_CHANNEL_DISABLE;
+                    n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                        chan_to_ht_40_index[k].ht_40_plus_index;
+                    if (n != INVALID_RF_CHANNEL)
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].enabled = NV_CHANNEL_DISABLE;
+
+                    n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                       chan_to_ht_40_index[k].ht_40_minus_index;
+                    if (n != INVALID_RF_CHANNEL)
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].enabled = NV_CHANNEL_DISABLE;
+                } else {
+                    n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                        chan_to_ht_40_index[k].ht_40_plus_index;
+                    if (!(wiphy->bands[i]->channels[j].flags &
+                            IEEE80211_CHAN_NO_HT40PLUS) &&
+                            (n != INVALID_RF_CHANNEL)) {
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].enabled = NV_CHANNEL_ENABLE;
+                        /* 40MHz channel power is half of 20MHz (-3dB) ?? */
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].pwrLimit = (tANI_S8)
+                               (((wiphy->bands[i]->channels[j].max_power)) - 3);
                     }
-                    else
-                    {
-                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].enabled =
-                            NV_CHANNEL_ENABLE;
-                        /* 40MHz channel power is half of 20MHz (-3dB) */
-                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[n].pwrLimit =
-                            (tANI_S8) (((wiphy->bands[i]->channels[j].max_power))-3);
+
+                    n = (k > RF_CHAN_165)? INVALID_RF_CHANNEL :
+                                       chan_to_ht_40_index[k].ht_40_minus_index;
+                    if (!(wiphy->bands[i]->channels[j].flags &
+                            IEEE80211_CHAN_NO_HT40MINUS) &&
+                            (n != INVALID_RF_CHANNEL)) {
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].enabled = NV_CHANNEL_ENABLE;
+                        /* 40MHz channel power is half of 20MHz (-3dB) ?? */
+                        pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                            channels[n].pwrLimit = (tANI_S8)
+                               (((wiphy->bands[i]->channels[j].max_power)) - 3);
                     }
                 }
+
                 if ((wiphy->bands[i]->channels[j].flags & IEEE80211_CHAN_NO_80MHZ) == 0)
                 {
                    if (NULL == pHddCtx)
@@ -1478,9 +1663,12 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
                 }
 
             }
-
-            /* ignore CRDA max_antenna_gain typical is 3dBi, nv.bin antennaGain
-               is real gain which should be provided by the real design */
+            /* Copy wiphy flags in nv table */
+            if (n != -1)
+                pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                    channels[n].flags = wiphy->bands[i]->channels[j].flags;
+            pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].
+                channels[k].flags = wiphy->bands[i]->channels[j].flags;
         }
     }
 
@@ -1496,6 +1684,7 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
     if (k == 0)
        return -1;
 
+    vos_update_band(nBandCapability);
     return 0;
 }
 
@@ -1623,7 +1812,7 @@ int __wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
              * changed them
              */
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0)) || defined(WITH_BACKPORTS)
-            wiphy->regulatory_flags = pHddCtx->reg.reg_flags;;
+            wiphy->regulatory_flags = pHddCtx->reg.reg_flags;
 #else
             wiphy->flags = pHddCtx->reg.reg_flags;
 #endif
@@ -1678,7 +1867,8 @@ int __wlan_hdd_linux_reg_notifier(struct wiphy *wiphy,
             temp_reg_domain = REGDOMAIN_WORLD;
 
         isVHT80Allowed = pHddCtx->isVHT80Allowed;
-
+        regChannels =
+            pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels;
         if (create_linux_regulatory_entry(wiphy,
                                           nBandCapability,
                                           reset) == 0)
diff --git a/CORE/VOSS/src/vos_sched.c b/CORE/VOSS/src/vos_sched.c
index facc3741d3a2..e2623590097e 100644
--- a/CORE/VOSS/src/vos_sched.c
+++ b/CORE/VOSS/src/vos_sched.c
@@ -59,9 +59,7 @@
 #include <linux/kthread.h>
 #include <linux/cpu.h>
 #include <linux/topology.h>
-#if defined(QCA_CONFIG_SMP)
 #include "vos_cnss.h"
-#endif
 
 /*---------------------------------------------------------------------------
  * Preprocessor Definitions and Constants
@@ -943,10 +941,10 @@ VosMCThread
         clear_bit(MC_SUSPEND_EVENT_MASK, &pSchedContext->mcEventFlag);
         spin_lock(&pSchedContext->McThreadLock);
 
+        INIT_COMPLETION(pSchedContext->ResumeMcEvent);
         /* Mc Thread Suspended */
         complete(&pHddCtx->mc_sus_event_var);
 
-        INIT_COMPLETION(pSchedContext->ResumeMcEvent);
         spin_unlock(&pSchedContext->McThreadLock);
 
         /* Wait foe Resume Indication */
@@ -996,6 +994,7 @@ static void vos_wd_detect_thread_stuck(void)
 				__func__,
 				gpVosWatchdogContext->mc_thread_stuck_count);
 
+		vos_dump_stack(gpVosSchedContext->McThread);
 		vos_wlanRestart();
 		return;
 	}
@@ -1501,8 +1500,8 @@ static int VosTlshimRxThread(void *arg)
                clear_bit(RX_SUSPEND_EVENT_MASK,
                          &pSchedContext->tlshimRxEvtFlg);
                spin_lock(&pSchedContext->TlshimRxThreadLock);
-               complete(&pSchedContext->SuspndTlshimRxEvent);
                INIT_COMPLETION(pSchedContext->ResumeTlshimRxEvent);
+               complete(&pSchedContext->SuspndTlshimRxEvent);
                spin_unlock(&pSchedContext->TlshimRxThreadLock);
                wait_for_completion_interruptible(
                               &pSchedContext->ResumeTlshimRxEvent);
diff --git a/CORE/VOSS/src/vos_sched.h b/CORE/VOSS/src/vos_sched.h
index 90cd9f2a9dc0..75fac75312f0 100644
--- a/CORE/VOSS/src/vos_sched.h
+++ b/CORE/VOSS/src/vos_sched.h
@@ -615,6 +615,7 @@ VOS_STATUS vos_watchdog_close ( v_PVOID_t pVosContext );
 VOS_STATUS vos_mq_init(pVosMqType pMq);
 void vos_mq_deinit(pVosMqType pMq);
 void vos_mq_put(pVosMqType pMq, pVosMsgWrapper pMsgWrapper);
+void vos_mq_put_front(pVosMqType mq, pVosMsgWrapper msg_wrapper);
 pVosMsgWrapper vos_mq_get(pVosMqType pMq);
 v_BOOL_t vos_is_mq_empty(pVosMqType pMq);
 pVosSchedContext get_vos_sched_ctxt(void);
diff --git a/CORE/VOSS/src/vos_utils.c b/CORE/VOSS/src/vos_utils.c
index 58b28e1e3038..d178b8b709e0 100644
--- a/CORE/VOSS/src/vos_utils.c
+++ b/CORE/VOSS/src/vos_utils.c
@@ -72,6 +72,7 @@
 #ifdef CONFIG_CNSS
 #include <linux/qcomwlan_secif.h>
 #endif
+#include <errno.h>
 
 #include "ieee80211_common.h"
 /*----------------------------------------------------------------------------
@@ -1277,3 +1278,40 @@ unsigned long vos_rounddown_pow_of_two(unsigned long n)
 
 	return __rounddown_pow_of_two(n);
 }
+
+/**
+ * vos_status_to_os_return(): translates vos_status types to linux return types
+ * @status: status to translate
+ *
+ * Translates error types that linux may want to handle specially.
+ *
+ * return: 0 or the linux error code that most closely matches the VOS_STATUS.
+ *      defaults to -1 (EPERM)
+ */
+int vos_status_to_os_return(VOS_STATUS status)
+{
+	switch (status) {
+	case VOS_STATUS_SUCCESS:
+		return 0;
+	case VOS_STATUS_E_FAULT:
+		return -EFAULT;
+	case VOS_STATUS_E_TIMEOUT:
+	case VOS_STATUS_E_BUSY:
+		return -EBUSY;
+	case VOS_STATUS_E_AGAIN:
+		return -EAGAIN;
+	case VOS_STATUS_E_NOSUPPORT:
+		return -ENOSYS;
+	case VOS_STATUS_E_ALREADY:
+		return -EALREADY;
+	case VOS_STATUS_E_NOMEM:
+		return -ENOMEM;
+	case VOS_STATUS_E_FAILURE:
+	case VOS_STATUS_E_INVAL:
+		return -EINVAL;
+	default:
+		VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
+			  FL("Unhandled VOS_STATUS:%d"), status);
+		return -EPERM;
+	}
+}
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index 9e4f9b5733e3..59e1bddc0a10 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -1087,6 +1087,10 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_MIB_STATS_REQ                     SIR_HAL_MIB_STATS_REQ
 #define WDA_SET_MIB_STATS_ENABLE              SIR_HAL_SET_MIB_STATS_ENABLE
 #define WDA_SET_MIB_STATS_DISABLE             SIR_HAL_SET_MIB_STATS_DISABLE
+#define WDA_ADD_BCN_FILTER_CMDID              SIR_HAL_ADD_BCN_FILTER_CMDID
+#define WDA_REMOVE_BCN_FILTER_CMDID           SIR_HAL_REMOVE_BCN_FILTER_CMDID
+
+#define WDA_UPDATE_TX_RATE                    SIR_HAL_UPDATE_TX_RATE
 
 tSirRetStatus wdaPostCtrlMsg(tpAniSirGlobal pMac, tSirMsgQ *pMsg);
 
diff --git a/Kbuild b/Kbuild
index 7f52b0bd05e8..81d6a6b9ceee 100644
--- a/Kbuild
+++ b/Kbuild
@@ -176,7 +176,6 @@ ifeq ($(CONFIG_QCA_WIFI_SDIO), 1)
 	CONFIG_TX_DESC_HI_PRIO_RESERVE  := 1
 endif
 
-
 #Enable OS specific IRQ abstraction
 CONFIG_ATH_SUPPORT_SHARED_IRQ := 1
 
@@ -950,7 +949,8 @@ CDEFINES :=	-DANI_LITTLE_BYTE_ENDIAN \
 		-DFEATURE_WLAN_EXTSCAN \
 		-DFEATURE_WLAN_LFR \
 		-DFEATURE_WLAN_CH144 \
-		-DHTC_CRP_DEBUG
+		-DHTC_CRP_DEBUG \
+		-DWLAN_VOWIFI_DEBUG
 
 ifeq ($(CONFIG_SCPC_FEATURE), y)
 CDEFINES += -DWLAN_SCPC_FEATURE
@@ -974,6 +974,10 @@ CDEFINES += -DFEATURE_BUS_BANDWIDTH
 endif
 endif
 
+ifeq ($(CONFIG_SUPPORT_TXRX_HL_BUNDLE), 1)
+CDEFINES += -DQCA_SUPPORT_TXRX_HL_BUNDLE
+endif
+
 ifeq ($(CONFIG_ARCH_MDM9607), y)
 CDEFINES += -DCONFIG_TUFELLO_DUAL_FW_SUPPORT
 endif
diff --git a/wcnss/inc/wlan_nv.h b/wcnss/inc/wlan_nv.h
index 5c00fbe57e62..7c8e172c0ea8 100644
--- a/wcnss/inc/wlan_nv.h
+++ b/wcnss/inc/wlan_nv.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -398,14 +398,17 @@ enum
    NV_CHANNEL_DISABLE,
    NV_CHANNEL_ENABLE,
    NV_CHANNEL_DFS,
-   NV_CHANNEL_INVALID
+   NV_CHANNEL_INVALID,
+   NV_CHANNEL_SKIP_DSRC,
+   NV_CHANNEL_SKIP_2G
 };
 typedef uint8 eNVChannelEnabledType;
 
 typedef PACKED_PRE struct PACKED_POST
 {
-    eNVChannelEnabledType   enabled;
-    tPowerdBm pwrLimit;
+    uint32_t   enabled:4;
+    uint32_t   flags:28;
+    tPowerdBm  pwrLimit;
 }sRegulatoryChannel;
 
 typedef PACKED_PRE struct PACKED_POST