Merge remote-tracking branch 'origin/caf/caf-wlan/master'

56 files changed, 1727 insertions, 260 deletions

diff --git a/Android.mk b/Android.mk
index b611ae74c870..ef9927de11c7 100644
--- a/Android.mk
+++ b/Android.mk
@@ -31,7 +31,7 @@ else
     WLAN_BLD_DIR := vendor/qcom/opensource/wlan
 endif
 
-ifeq ($(call is-android-codename,JELLY_BEAN),true)
+ifeq ($(call is-platform-sdk-version-at-least,16),true)
        DLKM_DIR := $(TOP)/device/qcom/common/dlkm
 else
        DLKM_DIR := build/dlkm
@@ -49,12 +49,12 @@ KBUILD_OPTIONS += $(WLAN_SELECT)
 KBUILD_OPTIONS += $(WLAN_ISOC_SELECT)
 
 include $(CLEAR_VARS)
-#LOCAL_MODULE              := proprietary_$(WLAN_CHIPSET)_wlan.ko
-#LOCAL_MODULE_KBUILD_NAME  := wlan.ko
-#LOCAL_MODULE_TAGS         := debug
-#LOCAL_MODULE_DEBUG_ENABLE := true
-#LOCAL_MODULE_PATH         := $(TARGET_OUT)/lib/modules/$(WLAN_CHIPSET)
-#include $(DLKM_DIR)/AndroidKernelModule.mk
+LOCAL_MODULE              := $(WLAN_CHIPSET)_wlan.ko
+LOCAL_MODULE_KBUILD_NAME  := wlan.ko
+LOCAL_MODULE_TAGS         := debug
+LOCAL_MODULE_DEBUG_ENABLE := true
+LOCAL_MODULE_PATH         := $(TARGET_OUT)/lib/modules/$(WLAN_CHIPSET)
+include $(DLKM_DIR)/AndroidKernelModule.mk
 ###########################################################
 
 # Create Symbolic link
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.c b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
index d3b05fe5a169..801213f6c867 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.c
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
@@ -1203,15 +1203,23 @@ VOS_STATUS WLANTL_Close(void *vos_ctx)
 {
 	struct txrx_tl_shim_ctx *tl_shim;
 
-    ENTER();
-    tl_shim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
-    wdi_in_pdev_detach(((pVosContextType) vos_ctx)->pdev_txrx_ctx, 1);
-    // Delete beacon buffer hanging off tl_shim
-    if (tl_shim->last_beacon_data) {
-        vos_mem_free(tl_shim->last_beacon_data);
-    }
-    vos_free_context(vos_ctx, VOS_MODULE_ID_TL, tl_shim);
-    return VOS_STATUS_SUCCESS;
+	ENTER();
+	tl_shim = vos_get_context(VOS_MODULE_ID_TL, vos_ctx);
+
+#ifdef WLAN_OPEN_SOURCE
+#ifdef FEATURE_WLAN_CCX
+	cancel_work_sync(&tl_shim->iapp_work.deferred_work);
+#endif
+	cancel_work_sync(&tl_shim->cache_flush_work);
+#endif
+
+	wdi_in_pdev_detach(((pVosContextType) vos_ctx)->pdev_txrx_ctx, 1);
+	// Delete beacon buffer hanging off tl_shim
+	if (tl_shim->last_beacon_data) {
+		vos_mem_free(tl_shim->last_beacon_data);
+	}
+	vos_free_context(vos_ctx, VOS_MODULE_ID_TL, tl_shim);
+	return VOS_STATUS_SUCCESS;
 }
 
 /*
diff --git a/CORE/HDD/inc/qc_sap_ioctl.h b/CORE/HDD/inc/qc_sap_ioctl.h
index aced0842cb0a..e0d1fe9d44c7 100644
--- a/CORE/HDD/inc/qc_sap_ioctl.h
+++ b/CORE/HDD/inc/qc_sap_ioctl.h
@@ -254,6 +254,7 @@ enum {
     QCSAP_PARAM_ACL_MODE = 7,
     QCSAP_PARAM_HIDE_SSID = 8,
     QCSAP_PARAM_AUTO_CHANNEL = 9,
+    QCSAP_PARAM_SET_MC_RATE = 10,
 };
 
 int iw_softap_get_channel_list(struct net_device *dev, 
diff --git a/CORE/HDD/inc/wlan_hdd_cfg.h b/CORE/HDD/inc/wlan_hdd_cfg.h
index e0c799942b2b..0b00506f3588 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -1414,6 +1414,7 @@ typedef enum
 #define HDD_MCASTBCASTFILTER_FILTER_ALL_BROADCAST              0x02
 #define HDD_MCASTBCASTFILTER_FILTER_ALL_MULTICAST_BROADCAST    0x03
 #define HDD_MULTICAST_FILTER_LIST                              0x04
+#define HDD_MULTICAST_FILTER_LIST_CLEAR                        0x05
 
 /*
  *
@@ -2068,7 +2069,7 @@ typedef struct
    v_BOOL_t                    bSingleTidRc;
    v_U8_t                      mcastBcastFilterSetting;
    v_BOOL_t                    fhostArpOffload;
-#if defined (QCA_WIFI_2_0) && defined(FEATURE_WLAN_PNO_OFFLOAD)
+#ifdef FEATURE_WLAN_SCAN_PNO
    v_BOOL_t                    PnoOffload;
 #endif
    v_BOOL_t                    fhostNSOffload;
diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index 3883033f987c..32a7d190f371 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -107,6 +107,13 @@
 #define WLAN_WAIT_TIME_SESSIONOPENCLOSE  15000
 #define WLAN_WAIT_TIME_ABORTSCAN  2000
 
+#ifdef QCA_WIFI_2_0
+
+/** Maximum time(ms) to wait for mc thread suspend **/
+#define WLAN_WAIT_TIME_MCTHREAD_SUSPEND  1200
+
+#endif
+
 /** Maximum time(ms) to wait for tdls add sta to complete **/
 #define WAIT_TIME_TDLS_ADD_STA      1500
 
diff --git a/CORE/HDD/inc/wlan_hdd_tgt_cfg.h b/CORE/HDD/inc/wlan_hdd_tgt_cfg.h
index 1d15b2d8b76e..b36a863b8bd0 100644
--- a/CORE/HDD/inc/wlan_hdd_tgt_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_tgt_cfg.h
@@ -37,7 +37,7 @@ struct hdd_tgt_services {
 	u_int32_t ap_dfs;
 	u_int32_t en_11ac;
 	u_int32_t arp_offload;
-#if defined (QCA_WIFI_2_0) && defined(FEATURE_WLAN_PNO_OFFLOAD)
+#ifdef FEATURE_WLAN_SCAN_PNO
 	v_BOOL_t  pno_offload;
 #endif
 };
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index ca05c7967cd0..db6eb2d97835 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -2716,6 +2716,7 @@ static tANI_S32 hdd_ProcessGENIE(hdd_adapter_t *pAdapter,
     tANI_U8 *pRsnIe;
     tANI_U16 RSNIeLen;
     tPmkidCacheInfo PMKIDCache[4]; // Local transfer memory
+    v_BOOL_t updatePMKCache = FALSE;
 
     /* Clear struct of tDot11fIERSN and tDot11fIEWPA specifically setting present
        flag to 0 */
@@ -2768,10 +2769,11 @@ static tANI_S32 hdd_ProcessGENIE(hdd_adapter_t *pAdapter,
             {
                 break;
             }
-            if ( hdd_IsMACAddrNULL( (u_char *) pBssid , sizeof( (char *) pBssid)))
+            if ( hdd_IsMACAddrNULL( (u_char *) pBssid->ether_addr_octet , 6))
             {
                 break;
             }
+            updatePMKCache = TRUE;
             // For right now, I assume setASSOCIATE() has passed in the bssid.
             vos_mem_copy(PMKIDCache[i].BSSID,
                             pBssid, ETHER_ADDR_LEN);
@@ -2779,13 +2781,17 @@ static tANI_S32 hdd_ProcessGENIE(hdd_adapter_t *pAdapter,
                             dot11RSNIE.pmkid[i],
                             CSR_RSN_PMKID_SIZE);
         }
-        // Calling csrRoamSetPMKIDCache to configure the PMKIDs into the cache
-        hddLog(LOG1, FL("%s: Calling csrRoamSetPMKIDCache with cache entry %ld."),
+
+        if (updatePMKCache)
+        {
+            // Calling csrRoamSetPMKIDCache to configure the PMKIDs into the cache
+            hddLog(LOG1, FL("%s: Calling csrRoamSetPMKIDCache with cache entry %ld."),
                                                                             __func__, i );
-        // Finally set the PMKSA ID Cache in CSR
-        result = sme_RoamSetPMKIDCache(halHandle,pAdapter->sessionId,
-                                        PMKIDCache,
-                                        dot11RSNIE.pmkid_count );
+            // Finally set the PMKSA ID Cache in CSR
+            result = sme_RoamSetPMKIDCache(halHandle,pAdapter->sessionId,
+                                           PMKIDCache,
+                                           dot11RSNIE.pmkid_count );
+        }
     }
     else if (gen_ie[0] == DOT11F_EID_WPA)
     {
diff --git a/CORE/HDD/src/wlan_hdd_cfg.c b/CORE/HDD/src/wlan_hdd_cfg.c
index fd66807f951f..3ff0e5c1a1b8 100644
--- a/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/CORE/HDD/src/wlan_hdd_cfg.c
@@ -4153,6 +4153,11 @@ VOS_STATUS hdd_set_sme_config( hdd_context_t *pHddCtx )
    /* Update the p2p listen offload setting */
    smeConfig.fP2pListenOffload =  pHddCtx->cfg_ini->fP2pListenOffload;
 
+#ifdef FEATURE_WLAN_SCAN_PNO
+   /* Update PNO offoad status */
+   smeConfig.pnoOffload = pHddCtx->cfg_ini->PnoOffload;
+#endif
+
    halStatus = sme_UpdateConfig( pHddCtx->hHal, &smeConfig);
    if ( !HAL_STATUS_SUCCESS( halStatus ) )
    {
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 0983312a1cba..7b5392aa4906 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -91,7 +91,9 @@
 #include "wlan_hdd_tdls.h"
 #endif
 #include "wlan_nv.h"
-
+#ifdef QCA_WIFI_2_0
+#include "vos_sched.h"
+#endif
 #if defined(QCA_WIFI_2_0) && defined(QCA_WIFI_FTM) && !defined(QCA_WIFI_ISOC)
 #include "testmode.h"
 #endif
@@ -607,19 +609,13 @@ int wlan_hdd_cfg80211_register(struct device *dev,
                  |  WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
 #endif
 #ifdef FEATURE_WLAN_SCAN_PNO
-#if defined (QCA_WIFI_2_0) && defined(FEATURE_WLAN_PNO_OFFLOAD)
+#if defined (QCA_WIFI_2_0)
     if (pCfg->PnoOffload) {
 #endif
-    /* TODO: Current discrete FW is lacking few enhancement
-     * (like RSSI threshold configuration, App IE configuration, etc)
-     * with respect to PNO. Lets not expose sched scan capability
-     * in wiphy->flags until FW meets LA PNO requirement. */
-#if 0
         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
         wiphy->max_sched_scan_ssids = MAX_SCAN_SSID;
         wiphy->max_match_sets       = SIR_PNO_MAX_SUPP_NETWORKS;
-#endif
-#if defined (QCA_WIFI_2_0) && defined(FEATURE_WLAN_PNO_OFFLOAD)
+#if defined (QCA_WIFI_2_0)
         wiphy->max_sched_scan_ie_len = SIR_PNO_MAX_IE_LEN;
     }
 #endif
@@ -4843,6 +4839,10 @@ int wlan_hdd_cfg80211_connect_start( hdd_adapter_t  *pAdapter,
             vos_mem_copy((void *)(pWextState->req_bssId), bssid,
                     WNI_CFG_BSSID_LEN);
         }
+        else
+        {
+            vos_mem_zero((void *)(pRoamProfile->BSSIDs.bssid),WNI_CFG_BSSID_LEN);
+        }
 
         if ((IW_AUTH_WPA_VERSION_WPA == pWextState->wpaVersion) ||
                 (IW_AUTH_WPA_VERSION_WPA2 == pWextState->wpaVersion))
@@ -5668,6 +5668,10 @@ int wlan_hdd_disconnect( hdd_adapter_t *pAdapter, u16 reason )
 {
     int status = 0;
     hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+
+    /*stop tx queues*/
+    netif_tx_disable(pAdapter->dev);
+    netif_carrier_off(pAdapter->dev);
     pHddStaCtx->conn_info.connState = eConnectionState_NotConnected;
     (WLAN_HDD_GET_CTX(pAdapter))->isAmpAllowed = VOS_TRUE;
     INIT_COMPLETION(pAdapter->disconnect_comp_var);
@@ -5685,9 +5689,6 @@ int wlan_hdd_disconnect( hdd_adapter_t *pAdapter, u16 reason )
     wait_for_completion_interruptible_timeout(
                 &pAdapter->disconnect_comp_var,
                 msecs_to_jiffies(WLAN_WAIT_TIME_DISCONNECT));
-    /*stop tx queues*/
-    netif_tx_disable(pAdapter->dev);
-    netif_carrier_off(pAdapter->dev);
     return status;
 }
 
@@ -6923,12 +6924,15 @@ static int wlan_hdd_cfg80211_add_station(struct wiphy *wiphy,
 
 
 #ifdef FEATURE_WLAN_LFR
+#define MAX_PMKSAIDS_IN_CACHE 8
+
+static tPmkidCacheInfo PMKIDCache[MAX_PMKSAIDS_IN_CACHE]; // HDD local cache
+static tANI_U32 PMKIDCacheIndex; // HDD local Cache index
+
+
 static int wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
             struct cfg80211_pmksa *pmksa)
 {
-#define MAX_PMKSAIDS_IN_CACHE 8
-    static tPmkidCacheInfo PMKIDCache[MAX_PMKSAIDS_IN_CACHE]; // HDD Local cache
-    static tANI_U32 i; // HDD Local Cache index
     tANI_U32 j=0;
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
     tHalHandle halHandle;
@@ -6961,7 +6965,7 @@ static int wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *d
     // Retrieve halHandle
     halHandle = WLAN_HDD_GET_HAL_CTX(pAdapter);
 
-    for (j = 0; j < i; j++)
+    for (j = 0; j < PMKIDCacheIndex; j++)
     {
         if(vos_mem_compare(PMKIDCache[j].BSSID,
                     pmksa->bssid, WNI_CFG_BSSID_LEN))
@@ -6982,23 +6986,23 @@ static int wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *d
     }
 
     /* Check we compared all entries,if then take the first slot now */
-    if(j == MAX_PMKSAIDS_IN_CACHE) i=0;
+    if(j == MAX_PMKSAIDS_IN_CACHE) PMKIDCacheIndex=0;
 
     if (!BSSIDMatched)
     {
         // Now, we DON'T have a BSSID match, so take a new entry in the cache.
-        vos_mem_copy(PMKIDCache[i].BSSID,
+        vos_mem_copy(PMKIDCache[PMKIDCacheIndex].BSSID,
                 pmksa->bssid, ETHER_ADDR_LEN);
-        vos_mem_copy(PMKIDCache[i].PMKID,
+        vos_mem_copy(PMKIDCache[PMKIDCacheIndex].PMKID,
                 pmksa->pmkid,
                 CSR_RSN_PMKID_SIZE);
         hddLog(VOS_TRACE_LEVEL_FATAL, "%s: Adding a new cache entry %d.",
-                __func__, i );
+                __func__, PMKIDCacheIndex );
         dump_bssid(pmksa->bssid);
         dump_pmkid(halHandle, pmksa->pmkid);
         // Increment the HDD Local Cache index
         // The "i=0" doesn't work for the call to sme_RoamSetPMKIDCache() - LFR FIXME
-        if (i<=(MAX_PMKSAIDS_IN_CACHE-1)) i++; else i=0;
+        if (PMKIDCacheIndex <= (MAX_PMKSAIDS_IN_CACHE-1)) PMKIDCacheIndex++; else PMKIDCacheIndex = 0;
     }
 
 
@@ -7006,28 +7010,160 @@ static int wlan_hdd_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *d
     //hddLog(LOG1, FL("%s: Calling csrRoamSetPMKIDCache with %d cache entries."),
     //        __func__, i );
     hddLog(VOS_TRACE_LEVEL_FATAL, "%s: Calling csrRoamSetPMKIDCache with %d cache entries.",
-            __func__, i );
+            __func__, PMKIDCacheIndex );
     // Finally set the PMKSA ID Cache in CSR
     result = sme_RoamSetPMKIDCache(halHandle,pAdapter->sessionId,
                                     PMKIDCache,
-                                    i );
+                                    PMKIDCacheIndex);
     return 0;
 }
 
 
+
 static int wlan_hdd_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
-            struct cfg80211_pmksa *pmksa)
+             struct cfg80211_pmksa *pmksa)
 {
-    ENTER();
-    // TODO: Implement this later.
-    return 0;
+    tANI_U32 j=0;
+    hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    tHalHandle halHandle;
+    tANI_U8  BSSIDMatched = 0;
+    hdd_context_t *pHddCtx;
+    int result = 0;
+
+    hddLog(VOS_TRACE_LEVEL_DEBUG, "%s: deleting PMKSA with PMKSA_ID %d .",
+            __func__,pmksa->pmkid);
+
+    /* Validate pAdapter */
+    if (NULL == pAdapter)
+    {
+       hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Invalid Adapter" ,__func__);
+       return -EINVAL;
+    }
+
+    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+
+    /*Retrieve halHandle*/
+    halHandle = WLAN_HDD_GET_HAL_CTX(pAdapter);
+
+    /*in case index is 0,no entry to delete*/
+    if (0 == PMKIDCacheIndex)
+    {
+        hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Invalid entry to delete" ,
+              __func__);
+        return -EINVAL;
+    }
+
+    /*find the matching PMKSA entry from j=0 to (index-1),
+     * and delete the matched one
+     */
+    for (j = 0; j<PMKIDCacheIndex; j++)
+    {
+          if (vos_mem_compare(PMKIDCache[j].BSSID,
+                             pmksa->bssid,
+                             WNI_CFG_BSSID_LEN))
+          {
+             /* BSSID matched entry */
+             BSSIDMatched = 1;
+
+             if (j<PMKIDCacheIndex-1)
+             {
+                 /*replace the matching entry with the last entry in HDD local cache*/
+                 vos_mem_copy(PMKIDCache[j].BSSID,
+                              PMKIDCache[PMKIDCacheIndex-1].BSSID,
+                              WNI_CFG_BSSID_LEN);
+                 vos_mem_copy(PMKIDCache[j].PMKID,
+                              PMKIDCache[PMKIDCacheIndex-1].PMKID,
+                              CSR_RSN_PMKID_SIZE);
+              }
+
+             /*clear the last entry in HDD cache ---[index-1]*/
+             vos_mem_zero(PMKIDCache[PMKIDCacheIndex-1].BSSID, WNI_CFG_BSSID_LEN);
+             vos_mem_zero(PMKIDCache[PMKIDCacheIndex-1].PMKID, CSR_RSN_PMKID_SIZE);
+
+             /*reduce the PMKID array index*/
+             PMKIDCacheIndex--;
+
+             /*delete the last PMKID cache in CSR*/
+             result = sme_RoamDelPMKIDfromCache(halHandle, pAdapter->sessionId, pmksa->bssid);
+             if (0 != result)
+             {
+                hddLog(VOS_TRACE_LEVEL_ERROR,"%s: cannot delete PMKSA %d CONTENT.",
+                          __func__,PMKIDCacheIndex);
+             }
+
+             dump_bssid(pmksa->bssid);
+             dump_pmkid(halHandle,pmksa->pmkid);
+
+             break;
+          }
+    }
+
+    /* we compare all entries,but cannot find matching entry */
+    if (j == MAX_PMKSAIDS_IN_CACHE && !BSSIDMatched)
+    {
+       hddLog(VOS_TRACE_LEVEL_FATAL, "%s: No such PMKSA entry existed %d.",
+             __func__,pmksa->bssid);
+       dump_bssid(pmksa->bssid);
+       dump_pmkid(halHandle, pmksa->pmkid);
+       return -EINVAL;
+    }
+   return result;
 }
 
+
+
 static int wlan_hdd_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *dev)
 {
-    ENTER();
-    // TODO: Implement this later.
-    return 0;
+    tANI_U32 j=0;
+    hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
+    tHalHandle halHandle;
+    hdd_context_t *pHddCtx;
+    tANI_U8 *pBSSId;
+    int result;
+
+    hddLog(VOS_TRACE_LEVEL_DEBUG, "%s: flushing PMKSA ",__func__);
+
+    /* Validate pAdapter */
+    if (NULL == pAdapter)
+    {
+        hddLog(VOS_TRACE_LEVEL_ERROR,
+               "%s: Invalid Adapter" ,__func__);
+       return -EINVAL;
+    }
+
+    pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
+
+    /*Retrieve halHandle*/
+    halHandle = WLAN_HDD_GET_HAL_CTX(pAdapter);
+
+    /*in case index is 0,no entry to delete*/
+    if (0 == PMKIDCacheIndex)
+    {
+       hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Invalid entry to delete" ,
+              __func__);
+       return -EINVAL;
+    }
+
+    /*delete all the PMKSA one by one */
+    for (j = 0; j<PMKIDCacheIndex; j++)
+    {
+          pBSSId =(tANI_U8 *)(PMKIDCache[j].BSSID);
+
+          /*delete the PMKID in CSR*/
+          result = sme_RoamDelPMKIDfromCache(halHandle, pAdapter->sessionId, pBSSId);
+
+          if (0!= result)
+          {
+             hddLog(VOS_TRACE_LEVEL_ERROR ,"%s cannot flush PMKIDCache %d.",
+                    __func__,j);
+          }
+          /*clear the entry in HDD cache 0--index-1 */
+          vos_mem_zero(PMKIDCache[j].BSSID, WNI_CFG_BSSID_LEN);
+          vos_mem_zero(PMKIDCache[j].PMKID, CSR_RSN_PMKID_SIZE);
+      }
+
+    PMKIDCacheIndex = 0;
+    return result;
 }
 #endif
 
@@ -7220,8 +7356,11 @@ static int wlan_hdd_cfg80211_sched_scan_start(struct wiphy *wiphy,
         /*Copying list of valid channel into request */
         memcpy(pPnoRequest->aNetworks[i].aChannels, valid_ch, num_ch);
         pPnoRequest->aNetworks[i].ucChannelCount = num_ch;
-
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)) && defined (QCA_WIFI_2_0)
+        pPnoRequest->aNetworks[i].rssiThreshold = request->rssi_thold;
+#else
         pPnoRequest->aNetworks[i].rssiThreshold = 0; //Default value
+#endif
     }
 
     /* framework provides interval in ms */
@@ -8090,6 +8229,79 @@ static int wlan_hdd_cfg80211_set_mac_acl(struct wiphy *wiphy,
 }
 #endif
 
+#ifdef QCA_WIFI_2_0
+int wlan_hdd_cfg80211_suspend_wlan(struct wiphy *wiphy,
+                                   struct cfg80211_wowlan *wow)
+{
+    hdd_context_t *pHddCtx = wiphy_priv(wiphy);
+    pVosSchedContext vosSchedContext = get_vos_sched_ctxt();
+    hdd_adapter_list_node_t *pAdapterNode = NULL, *pNext = NULL;
+    hdd_adapter_t *pAdapter;
+    hdd_scaninfo_t *pScanInfo;
+    VOS_STATUS status;
+    int rc;
+
+    /* Stop ongoing scan on each interface */
+    status =  hdd_get_front_adapter ( pHddCtx, &pAdapterNode );
+    while ( NULL != pAdapterNode && VOS_STATUS_SUCCESS == status )
+    {
+        pAdapter = pAdapterNode->pAdapter;
+        pScanInfo = &pAdapter->scan_info;
+
+        if (pScanInfo->mScanPending && pAdapter->request)
+        {
+           INIT_COMPLETION(pScanInfo->abortscan_event_var);
+           hdd_abort_mac_scan(pHddCtx, pAdapter->sessionId);
+
+           status = wait_for_completion_interruptible_timeout(
+                           &pScanInfo->abortscan_event_var,
+                           msecs_to_jiffies(WLAN_WAIT_TIME_ABORTSCAN));
+           if (!status)
+           {
+              VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                         "%s: Timeout occurred while waiting for abort scan" ,
+                         __func__);
+              return -ETIME;
+           }
+        }
+        status = hdd_get_next_adapter ( pHddCtx, pAdapterNode, &pNext );
+        pAdapterNode = pNext;
+    }
+
+    /* Suspend MC thread */
+    set_bit(MC_SUSPEND_EVENT_MASK, &vosSchedContext->mcEventFlag);
+    wake_up_interruptible(&vosSchedContext->mcWaitQueue);
+
+    /* Wait for suspend confirmation from MC thread */
+    rc = wait_for_completion_interruptible_timeout(&pHddCtx->mc_sus_event_var,
+                                 msecs_to_jiffies(WLAN_WAIT_TIME_MCTHREAD_SUSPEND));
+    if (!rc)
+    {
+        clear_bit(MC_SUSPEND_EVENT_MASK, &vosSchedContext->mcEventFlag);
+        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                   "%s: Failed to stop mc thread", __func__);
+        return -ETIME;
+    }
+
+    pHddCtx->isMcThreadSuspended = TRUE;
+
+    return 0;
+}
+
+int wlan_hdd_cfg80211_resume_wlan(struct wiphy *wiphy)
+{
+    hdd_context_t *pHddCtx = wiphy_priv(wiphy);
+    pVosSchedContext vosSchedContext = get_vos_sched_ctxt();
+
+    /* Resume MC thread */
+    complete(&vosSchedContext->ResumeMcEvent);
+
+    pHddCtx->isMcThreadSuspended = FALSE;
+
+    return 0;
+}
+#endif
+
 /* cfg80211_ops */
 static struct cfg80211_ops wlan_hdd_cfg80211_ops =
 {
@@ -8160,5 +8372,9 @@ static struct cfg80211_ops wlan_hdd_cfg80211_ops =
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,4,0))
      .set_mac_acl = wlan_hdd_cfg80211_set_mac_acl,
 #endif
+#ifdef QCA_WIFI_2_0
+     .suspend = wlan_hdd_cfg80211_suspend_wlan,
+     .resume = wlan_hdd_cfg80211_resume_wlan,
+#endif
 };
 
diff --git a/CORE/HDD/src/wlan_hdd_early_suspend.c b/CORE/HDD/src/wlan_hdd_early_suspend.c
index e78159c108a0..45dec1247060 100644
--- a/CORE/HDD/src/wlan_hdd_early_suspend.c
+++ b/CORE/HDD/src/wlan_hdd_early_suspend.c
@@ -528,27 +528,31 @@ void hdd_conf_hostoffload(hdd_adapter_t *pAdapter, v_BOOL_t fenable)
         else
         {
             //Disable ARPOFFLOAD
-            if (pHddCtx->cfg_ini->fhostArpOffload)
+            if (eConnectionState_Associated ==
+                    (WLAN_HDD_GET_STATION_CTX_PTR(pAdapter))->conn_info.connState)
             {
-                vstatus = hdd_conf_arp_offload(pAdapter, fenable);
-                if (!VOS_IS_STATUS_SUCCESS(vstatus))
+                if (pHddCtx->cfg_ini->fhostArpOffload)
                 {
-                    hddLog(VOS_TRACE_LEVEL_ERROR,
-                          "Failed to disable ARPOffload Feature %d", vstatus);
+                    vstatus = hdd_conf_arp_offload(pAdapter, fenable);
+                    if (!VOS_IS_STATUS_SUCCESS(vstatus))
+                    {
+                        hddLog(VOS_TRACE_LEVEL_ERROR,
+                             "Failed to disable ARPOffload Feature %d", vstatus);
+                    }
                 }
-            }
-            //Disable GTK_OFFLOAD
+               //Disable GTK_OFFLOAD
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
-            hdd_conf_gtk_offload(pAdapter, fenable);
+                hdd_conf_gtk_offload(pAdapter, fenable);
 #endif
 
 #ifdef WLAN_NS_OFFLOAD
-            //Disable NSOFFLOAD
-            if (pHddCtx->cfg_ini->fhostNSOffload)
-            {
-                hdd_conf_ns_offload(pAdapter, fenable);
-            }
+                //Disable NSOFFLOAD
+                if (pHddCtx->cfg_ini->fhostNSOffload)
+                {
+                    hdd_conf_ns_offload(pAdapter, fenable);
+                }
 #endif
+            }
         }
     }
     return;
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index 0c05cd9c8c34..9cc0d99feacf 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -1029,6 +1029,51 @@ static iw_softap_setparam(struct net_device *dev,
                 }
                 break;
             }
+        case QCSAP_PARAM_SET_MC_RATE:
+            {
+                tSirRateUpdateInd *rateUpdate;
+                hdd_context_t*pHddCtx = (hdd_context_t*)(pHostapdAdapter->pHddCtx);
+                hdd_config_t *pConfig = NULL;
+
+                if (pHddCtx)
+                    pConfig = pHddCtx->cfg_ini;
+                else {
+                    hddLog(VOS_TRACE_LEVEL_ERROR,
+                           "%s: pHddCtx = NULL", __func__);
+                    ret = -1;
+                    break;
+                }
+
+                rateUpdate = (tSirRateUpdateInd *)
+                             vos_mem_malloc(sizeof(tSirRateUpdateInd));
+                if (NULL == rateUpdate)
+                {
+                   hddLog(VOS_TRACE_LEVEL_ERROR,
+                          "%s: SET_MC_RATE indication alloc fail", __func__);
+                   ret = -1;
+                   break;
+                }
+                vos_mem_zero(rateUpdate, sizeof(tSirRateUpdateInd ));
+
+                hddLog(VOS_TRACE_LEVEL_INFO, "MC Target rate %d", set_value);
+                memcpy(rateUpdate->bssid,
+                       pHostapdAdapter->macAddressCurrent.bytes,
+                       sizeof(tSirMacAddr));
+                rateUpdate->nss = (pConfig->enable2x2 == 0) ? 0 : 1;
+                rateUpdate->dev_mode = pHostapdAdapter->device_mode;
+                rateUpdate->mcastDataRate24GHz = set_value;
+                rateUpdate->mcastDataRate5GHz = set_value;
+                rateUpdate->bcastDataRate = -1;
+                status = sme_SendRateUpdateInd(hHal, rateUpdate);
+                if (eHAL_STATUS_SUCCESS != status)
+                {
+                    hddLog(VOS_TRACE_LEVEL_ERROR,
+                            "%s: SET_MC_RATE failed", __func__);
+                    vos_mem_free(rateUpdate);
+                    ret = -1;
+                }
+                break;
+            }
 
         default:
             hddLog(LOGE, FL("Invalid setparam command %d value %d"),
@@ -2699,6 +2744,8 @@ static const struct iw_priv_args hostapd_private_args[] = {
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setMaxAssoc" },
    { QCSAP_PARAM_HIDE_SSID,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,  "hideSSID" },
+   { QCSAP_PARAM_SET_MC_RATE,
+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,  "setMcRate" },
   { QCSAP_IOCTL_GETPARAM,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
       IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "getparam" },
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 7da603398066..9a5981e272e3 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -1678,6 +1678,50 @@ int hdd_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
            }
        }
 #endif
+       else if (strncmp(command, "SETMCRATE", 9) == 0)
+       {
+           tANI_U8 *value = command;
+           int      targetRate;
+           tSirRateUpdateInd *rateUpdate;
+           eHalStatus status;
+           hdd_config_t *pConfig = pHddCtx->cfg_ini;
+           hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
+           /* Move pointer to ahead of SETMCRATE<delimiter> */
+           /* input value is in units of hundred kbps */
+           value = value + 10;
+           /* Convert the value from ascii to integer, decimal base */
+           ret = kstrtouint(value, 10, &targetRate);
+
+           rateUpdate = (tSirRateUpdateInd *)vos_mem_malloc(sizeof(tSirRateUpdateInd));
+           if (NULL == rateUpdate)
+           {
+              hddLog(VOS_TRACE_LEVEL_ERROR,
+                     "%s: SETMCRATE indication alloc fail", __func__);
+              ret = -EFAULT;
+              goto exit;
+           }
+           vos_mem_zero(rateUpdate, sizeof(tSirRateUpdateInd ));
+
+           VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
+                     "MC Target rate %d", targetRate);
+           rateUpdate->nss = (pConfig->enable2x2 == 0) ? 0 : 1;
+           rateUpdate->dev_mode = pAdapter->device_mode;
+           rateUpdate->mcastDataRate24GHz = targetRate;
+           rateUpdate->mcastDataRate5GHz = targetRate;
+           rateUpdate->bcastDataRate = -1;
+           memcpy(rateUpdate->bssid, pHddStaCtx->conn_info.bssId,
+               sizeof(rateUpdate->bssid));
+
+           status = sme_SendRateUpdateInd(pHddCtx->hHal, rateUpdate);
+           if (eHAL_STATUS_SUCCESS != status)
+           {
+              hddLog(VOS_TRACE_LEVEL_ERROR,
+                     "%s: SET_MC_RATE failed", __func__);
+              vos_mem_free(rateUpdate);
+              ret = -EFAULT;
+              goto exit;
+           }
+       }
        else {
            hddLog( VOS_TRACE_LEVEL_WARN, "%s: Unsupported GUI command %s",
                    __func__, command);
@@ -1766,7 +1810,7 @@ static void hdd_update_tgt_services(hdd_context_t *hdd_ctx,
 
     /* ARP offload: override user setting if invalid  */
     cfg_ini->fhostArpOffload &= cfg->arp_offload;
-#if defined (QCA_WIFI_2_0) && defined(FEATURE_WLAN_PNO_OFFLOAD)
+#ifdef FEATURE_WLAN_SCAN_PNO
     /* PNO offload */
     if (cfg->pno_offload)
         cfg_ini->PnoOffload = TRUE;
@@ -3311,12 +3355,13 @@ static eHalStatus hdd_smeCloseSessionCallback(void *pContext)
 
    clear_bit(SME_SESSION_OPENED, &pAdapter->event_flags);
 
+#ifndef WLAN_OPEN_SOURCE
    /* need to make sure all of our scheduled work has completed.
     * This callback is called from MC thread context, so it is safe to
     * to call below flush workqueue API from here.
     */
    flush_scheduled_work();
-
+#endif
    /* We can be blocked while waiting for scheduled work to be
     * flushed, and the adapter structure can potentially be freed, in
     * which case the magic will have been reset.  So make sure the
diff --git a/CORE/HDD/src/wlan_hdd_tdls.c b/CORE/HDD/src/wlan_hdd_tdls.c
index 02c7ec62e711..6767e20c6fbd 100644
--- a/CORE/HDD/src/wlan_hdd_tdls.c
+++ b/CORE/HDD/src/wlan_hdd_tdls.c
@@ -79,7 +79,6 @@ static void wlan_hdd_tdls_pre_setup_init_work(tdlsCtx_t * pHddTdlsCtx,
         pHddTdlsCtx->curr_candidate = curr_candidate;
         pHddTdlsCtx->magic = TDLS_CTX_MAGIC;
 
-        INIT_WORK(&pHddTdlsCtx->implicit_setup, wlan_hdd_tdls_pre_setup);
         schedule_work(&pHddTdlsCtx->implicit_setup);
     }
 }
@@ -543,6 +542,26 @@ static void wlan_hdd_tdls_free_list(tdlsCtx_t *pHddTdlsCtx)
     }
 }
 
+static void wlan_hdd_tdls_schedule_scan(struct work_struct *work)
+{
+    tdls_scan_context_t *scan_ctx =
+          container_of(work, tdls_scan_context_t, tdls_scan_work.work);
+
+    if (NULL == scan_ctx)
+        return;
+
+    if (unlikely(TDLS_CTX_MAGIC != scan_ctx->magic))
+        return;
+
+    scan_ctx->attempt++;
+
+    wlan_hdd_cfg80211_scan(scan_ctx->wiphy,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+                           scan_ctx->dev,
+#endif
+                           scan_ctx->scan_request);
+}
+
 int wlan_hdd_tdls_init(hdd_adapter_t *pAdapter)
 {
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX( pAdapter );
@@ -641,6 +660,8 @@ int wlan_hdd_tdls_init(hdd_adapter_t *pAdapter)
         pHddCtx->tdls_mode = eTDLS_SUPPORT_ENABLED;
     }
 
+    INIT_WORK(&pHddTdlsCtx->implicit_setup, wlan_hdd_tdls_pre_setup);
+    INIT_DELAYED_WORK(&pHddCtx->tdls_scan_ctxt.tdls_scan_work, wlan_hdd_tdls_schedule_scan);
     return 0;
 }
 
@@ -671,6 +692,11 @@ void wlan_hdd_tdls_exit(hdd_adapter_t *pAdapter)
         return;
     }
 
+#ifdef WLAN_OPEN_SOURCE
+    cancel_work_sync(&pHddTdlsCtx->implicit_setup);
+    cancel_delayed_work_sync(&pHddCtx->tdls_scan_ctxt.tdls_scan_work);
+#endif
+
     /* must stop timer here before freeing peer list, because peerIdleTimer is
     part of peer list structure. */
     wlan_hdd_tdls_timers_destroy(pHddTdlsCtx);
@@ -1859,26 +1885,6 @@ int wlan_hdd_tdls_copy_scan_context(hdd_context_t *pHddCtx,
     return 0;
 }
 
-static void wlan_hdd_tdls_schedule_scan(struct work_struct *work)
-{
-    tdls_scan_context_t *scan_ctx =
-          container_of(work, tdls_scan_context_t, tdls_scan_work.work);
-
-    if (NULL == scan_ctx)
-        return;
-
-    if (unlikely(TDLS_CTX_MAGIC != scan_ctx->magic))
-        return;
-
-    scan_ctx->attempt++;
-
-    wlan_hdd_cfg80211_scan(scan_ctx->wiphy,
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
-                           scan_ctx->dev,
-#endif
-                           scan_ctx->scan_request);
-}
-
 static void wlan_hdd_tdls_scan_init_work(hdd_context_t *pHddCtx,
                                 struct wiphy *wiphy,
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
@@ -1897,7 +1903,6 @@ static void wlan_hdd_tdls_scan_init_work(hdd_context_t *pHddCtx,
         pHddCtx->tdls_scan_ctxt.attempt = 0;
         pHddCtx->tdls_scan_ctxt.magic = TDLS_CTX_MAGIC;
     }
-    INIT_DELAYED_WORK(&pHddCtx->tdls_scan_ctxt.tdls_scan_work, wlan_hdd_tdls_schedule_scan);
 
     schedule_delayed_work(&pHddCtx->tdls_scan_ctxt.tdls_scan_work, delay);
 }
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index 8a515076e401..77a2679f75e8 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -6294,7 +6294,8 @@ static int iw_set_dynamic_mcbc_filter(struct net_device *dev,
        return -EBUSY;
     }
 
-    if (HDD_MULTICAST_FILTER_LIST == pRequest->mcastBcastFilterSetting)
+    if ((HDD_MULTICAST_FILTER_LIST == pRequest->mcastBcastFilterSetting) ||
+        (HDD_MULTICAST_FILTER_LIST_CLEAR == pRequest->mcastBcastFilterSetting))
     {
 #ifdef WLAN_FEATURE_PACKET_FILTERING
 
@@ -6323,6 +6324,11 @@ static int iw_set_dynamic_mcbc_filter(struct net_device *dev,
                    idx, MAC_ADDR_ARRAY(mc_addr_list_ptr->multicastAddr[idx]));
         }
 
+        if (HDD_MULTICAST_FILTER_LIST_CLEAR == pRequest->mcastBcastFilterSetting)
+            mc_addr_list_ptr->action = 1; //clear
+        else
+            mc_addr_list_ptr->action = 0; //set
+
         ret_val = sme_8023MulticastList(hHal, pAdapter->sessionId, mc_addr_list_ptr);
         vos_mem_free(mc_addr_list_ptr);
         if (eHAL_STATUS_SUCCESS != ret_val)
@@ -6426,6 +6432,7 @@ static int iw_clear_dynamic_mcbc_filter(struct net_device *dev,
             return -EINVAL;
         }
     }
+
     return 0;
 }
 
@@ -7095,7 +7102,7 @@ VOS_STATUS iw_set_pno(struct net_device *dev, struct iw_request_info *info,
     /*Advance to rssi Threshold*/
     ptr += nOffset;
 
-    sscanf(ptr,"%hhu %n",
+    sscanf(ptr,"%ld %n",
               &(pnoRequest.aNetworks[i].rssiThreshold), &nOffset);
 
     VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
diff --git a/CORE/HDD/src/wlan_hdd_wmm.c b/CORE/HDD/src/wlan_hdd_wmm.c
index 95697edef4a7..0b0f28d2ca90 100644
--- a/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/CORE/HDD/src/wlan_hdd_wmm.c
@@ -1532,6 +1532,11 @@ VOS_STATUS hdd_wmm_adapter_close ( hdd_adapter_t* pAdapter )
    {
       pQosContext = list_first_entry(&pAdapter->hddWmmStatus.wmmContextList,
                                      hdd_wmm_qos_context_t, node);
+#ifdef WLAN_OPEN_SOURCE
+      /* cancel all scheduled work queues */
+      cancel_work_sync(&pQosContext->wmmAcSetupImplicitQos);
+#endif
+
 #ifdef FEATURE_WLAN_CCX
       hdd_wmm_disable_inactivity_timer(pQosContext);
 #endif
diff --git a/CORE/MAC/inc/aniGlobal.h b/CORE/MAC/inc/aniGlobal.h
index 84fd26773166..b8cb894cbe6d 100644
--- a/CORE/MAC/inc/aniGlobal.h
+++ b/CORE/MAC/inc/aniGlobal.h
@@ -1051,6 +1051,9 @@ typedef struct sAniSirGlobal
 
     /* P2P Listen Offload */
     tANI_U8 fP2pListenOffload;
+
+    /* PNO offload */
+    v_BOOL_t pnoOffload;
 } tAniSirGlobal;
 
 #ifdef FEATURE_WLAN_TDLS
diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index 0bb1f64d65de..be5c302a2475 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -3463,7 +3463,7 @@ typedef struct sSirWlanSetRxpFilters
 #define SIR_PNO_MAX_NETW_CHANNELS_EX  60
 #define SIR_PNO_MAX_SUPP_NETWORKS  16
 #define SIR_PNO_MAX_SCAN_TIMERS    10
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 /* TODO: Need to sync max ie len size with FW */
 #define SIR_PNO_MAX_IE_LEN         500
 #endif
@@ -3502,7 +3502,7 @@ typedef struct
   tANI_U32    bcastNetwType;
   tANI_U8     ucChannelCount;
   tANI_U8     aChannels[SIR_PNO_MAX_NETW_CHANNELS_EX];
-  tANI_U8     rssiThreshold;
+  tANI_S32    rssiThreshold;
 } tSirNetworkType;
 
 typedef struct
@@ -3524,9 +3524,7 @@ typedef struct sSirPNOScanReq
   tANI_U8             ucNetworksCount;
   tSirNetworkType     aNetworks[SIR_PNO_MAX_SUPP_NETWORKS];
   tSirScanTimersType  scanTimers;
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
   tANI_U8             sessionId;
-#endif
 
   /*added by SME*/
   tANI_U16  us24GProbeTemplateLen;
@@ -3776,6 +3774,7 @@ typedef struct sSirRcvFltMcAddrList
   tSirMacAddr    multicastAddr[SIR_MAX_NUM_MULTICAST_ADDRESS];
   tSirMacAddr    selfMacAddr;
   tSirMacAddr    bssId;
+  tANI_U8        action;
 } tSirRcvFltMcAddrList, *tpSirRcvFltMcAddrList;
 #endif // WLAN_FEATURE_PACKET_FILTERING
 
@@ -4245,4 +4244,46 @@ typedef struct sSirPsReqData
     tSirAddonPsReq addOnReq;
 } tSirPsReqData,*tpSirPsReqData;
 
+typedef struct sSirRateUpdateInd
+{
+    tANI_U8 nss; /* 0: 1x1, 1: 2x2 */
+    tSirMacAddr bssid;
+    tVOS_CON_MODE dev_mode;
+    tANI_S32 bcastDataRate; /* bcast rate unit Mbpsx10, -1 : not used */
+    /* 0 implies RA, positive value implies fixed rate, -1 implies ignore this
+     * param.
+     */
+    tANI_S32 ucastDataRate;
+
+    /* TX flag to differentiate between HT20, HT40 etc */
+    tTxrateinfoflags ucastDataRateTxFlag;
+
+    /*
+     * 0 implies MCAST RA, positive value implies fixed rate,
+     * -1 implies ignore this param
+     */
+    tANI_S32 reliableMcastDataRate;//unit Mbpsx10
+
+    /* TX flag to differentiate between HT20, HT40 etc */
+    tTxrateinfoflags reliableMcastDataRateTxFlag;
+
+    /*
+     * MCAST(or BCAST) fixed data rate in 2.4 GHz, unit Mbpsx10,
+     * 0 implies ignore
+     */
+    tANI_U32 mcastDataRate24GHz;
+
+    /* TX flag to differentiate between HT20, HT40 etc */
+    tTxrateinfoflags mcastDataRate24GHzTxFlag;
+
+    /*
+     * MCAST(or BCAST) fixed data rate in 5 GHz,
+     * unit Mbpsx10, 0 implies ignore
+     */
+    tANI_U32 mcastDataRate5GHz;
+
+    /* TX flag to differentiate between HT20, HT40 etc */
+    tTxrateinfoflags mcastDataRate5GHzTxFlag;
+
+} tSirRateUpdateInd, *tpSirRateUpdateInd;
 #endif /* __SIR_API_H */
diff --git a/CORE/MAC/inc/sirMacProtDef.h b/CORE/MAC/inc/sirMacProtDef.h
index 02fdd3fc20e9..891b9d268bc4 100644
--- a/CORE/MAC/inc/sirMacProtDef.h
+++ b/CORE/MAC/inc/sirMacProtDef.h
@@ -620,6 +620,9 @@
 
 #define IS_WES_MODE_ENABLED(x) \
                     ((x)->roam.configParam.isWESModeEnabled)
+#ifdef WLAN_FEATURE_11AC
+#define SIR_MAC_GET_VHT_MAX_AMPDU_EXPO(x) ((((tANI_U32) x) & 0x03800000) >> 23)
+#endif
 
 /// Status Code (present in Management response frames) enum
 
diff --git a/CORE/MAC/src/include/sirParams.h b/CORE/MAC/src/include/sirParams.h
index 7a1d83f59630..5589c8e7c437 100644
--- a/CORE/MAC/src/include/sirParams.h
+++ b/CORE/MAC/src/include/sirParams.h
@@ -568,10 +568,13 @@ typedef struct sSirMbMsgP2p
 #ifndef REMOVE_PKT_LOG
 #define SIR_HAL_PKTLOG_ENABLE_REQ          (SIR_HAL_ITC_MSG_TYPES_BEGIN + 206)
 #endif
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 #define SIR_HAL_SME_SCAN_CACHE_UPDATED     (SIR_HAL_ITC_MSG_TYPES_BEGIN + 207)
 #endif
 #endif
+#define SIR_CSA_OFFLOAD_EVENT              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 208)
+
+#define SIR_HAL_RATE_UPDATE_IND            (SIR_HAL_ITC_MSG_TYPES_BEGIN + 208)
 
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_ITC_MSG_TYPES_BEGIN + 0xFF)
 // CFG message types
diff --git a/CORE/MAC/src/pe/include/limSession.h b/CORE/MAC/src/pe/include/limSession.h
index 89148a800c84..23d2c48174eb 100644
--- a/CORE/MAC/src/pe/include/limSession.h
+++ b/CORE/MAC/src/pe/include/limSession.h
@@ -386,6 +386,11 @@ typedef struct sPESession           // Added to Support BT-AMP
      */
     tANI_U8  gUapsdPerAcDeliveryEnableMask;
 
+    /* Flag to skip CSA IE processing when CSA
+     * offload is enabled.
+     */
+    tANI_U8  csaOffloadEnable;
+
     /* Used on STA for AC downgrade. This is a dynamic mask
      * setting which keep tracks of ACs being admitted.
      * If bit is set to 0: That partiular AC is not admitted
diff --git a/CORE/MAC/src/pe/lim/limAssocUtils.c b/CORE/MAC/src/pe/lim/limAssocUtils.c
index 5a09675ecce7..13293367992b 100644
--- a/CORE/MAC/src/pe/lim/limAssocUtils.c
+++ b/CORE/MAC/src/pe/lim/limAssocUtils.c
@@ -3114,6 +3114,12 @@ limDelBss(tpAniSirGlobal pMac, tpDphHashNode pStaDs, tANI_U16 bssIdx,tpPESession
     psessionEntry->limMlmState = eLIM_MLM_WT_DEL_BSS_RSP_STATE;
     MTRACE(macTrace(pMac, TRACE_CODE_MLM_STATE, psessionEntry->peSessionId, eLIM_MLM_WT_DEL_BSS_RSP_STATE));
 
+    if((psessionEntry->peSessionId == pMac->lim.limTimers.gLimJoinFailureTimer.sessionId) &&
+       (VOS_TRUE == tx_timer_running(&pMac->lim.limTimers.gLimJoinFailureTimer)))
+    {
+        limDeactivateAndChangeTimer(pMac, eLIM_JOIN_FAIL_TIMER);
+    }
+
     pDelBssParams->status= eHAL_STATUS_SUCCESS;
     pDelBssParams->respReqd = 1;
     vos_mem_copy(pDelBssParams->bssid, psessionEntry->bssId, sizeof(tSirMacAddr));
@@ -3283,6 +3289,9 @@ tSirRetStatus limStaSendAddBss( tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
         vos_mem_copy(&pAddBssParams->staContext.vht_caps,
                      (tANI_U8 *)&pAssocRsp->VHTCaps + sizeof(tANI_U8),
                      sizeof(pAddBssParams->staContext.vht_caps));
+        pAddBssParams->staContext.maxAmpduSize =
+                                  SIR_MAC_GET_VHT_MAX_AMPDU_EXPO(
+                                           pAddBssParams->staContext.vht_caps);
     }
     else 
     {
@@ -3379,7 +3388,13 @@ tSirRetStatus limStaSendAddBss( tpAniSirGlobal pMac, tpSirAssocRsp pAssocRsp,
             pAddBssParams->staContext.fDsssCckMode40Mhz = (tANI_U8)pAssocRsp->HTCaps.dsssCckMode40MHz;
             pAddBssParams->staContext.fShortGI20Mhz = (tANI_U8)pAssocRsp->HTCaps.shortGI20MHz;
             pAddBssParams->staContext.fShortGI40Mhz = (tANI_U8)pAssocRsp->HTCaps.shortGI40MHz;
-            pAddBssParams->staContext.maxAmpduSize= pAssocRsp->HTCaps.maxRxAMPDUFactor;
+#ifdef WLAN_FEATURE_11AC
+            if (!pAddBssParams->staContext.vhtCapable)
+                // Use max ampd factor advertised in HTCAP for non-vht connection
+#endif
+             {
+                pAddBssParams->staContext.maxAmpduSize= pAssocRsp->HTCaps.maxRxAMPDUFactor;
+             }
             if( pAddBssParams->staContext.vhtTxBFCapable && pMac->lim.disableLDPCWithTxbfAP )
             {
                 pAddBssParams->staContext.htLdpcCapable = 0;
diff --git a/CORE/MAC/src/pe/lim/limFT.c b/CORE/MAC/src/pe/lim/limFT.c
index c611571473f8..90535f34b597 100644
--- a/CORE/MAC/src/pe/lim/limFT.c
+++ b/CORE/MAC/src/pe/lim/limFT.c
@@ -1004,6 +1004,7 @@ void limHandleFTPreAuthRsp(tpAniSirGlobal pMac, tSirRetStatus status,
             return;
         }
         pftSessionEntry->peSessionId = sessionId;
+        pftSessionEntry->smeSessionId = psessionEntry->smeSessionId;
         sirCopyMacAddr(pftSessionEntry->selfMacAddr, psessionEntry->selfMacAddr);
         sirCopyMacAddr(pftSessionEntry->limReAssocbssId, pbssDescription->bssId);
         pftSessionEntry->bssType = psessionEntry->bssType;
diff --git a/CORE/MAC/src/pe/lim/limP2P.c b/CORE/MAC/src/pe/lim/limP2P.c
index c80f2a2fe8ad..ef690ca53872 100644
--- a/CORE/MAC/src/pe/lim/limP2P.c
+++ b/CORE/MAC/src/pe/lim/limP2P.c
@@ -300,6 +300,7 @@ tSirRetStatus limCreateSessionForRemainOnChn(tpAniSirGlobal pMac, tPESession **p
         }
         /* Store PE sessionId in session Table  */
         psessionEntry->peSessionId = sessionId;
+        psessionEntry->smeSessionId = pMac->lim.gpLimRemainOnChanReq->sessionId;
 
         psessionEntry->limSystemRole = eLIM_P2P_DEVICE_ROLE;
         CFG_GET_STR( nSirStatus, pMac,  WNI_CFG_SUPPORTED_RATES_11A,
diff --git a/CORE/MAC/src/pe/lim/limProcessActionFrame.c b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
index 17270d2fc161..180f3fb202d9 100644
--- a/CORE/MAC/src/pe/lim/limProcessActionFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
@@ -185,8 +185,9 @@ tSirRetStatus limStartChannelSwitch(tpAniSirGlobal pMac, tpPESession psessionEnt
     
     /*If channel switch is already running and it is on a different session, just return*/  
     /*This need to be removed for MCC */
-    if( limIsChanSwitchRunning (pMac) &&
-        psessionEntry->gLimSpecMgmt.dot11hChanSwState != eLIM_11H_CHANSW_RUNNING )
+    if ((limIsChanSwitchRunning (pMac) &&
+        psessionEntry->gLimSpecMgmt.dot11hChanSwState != eLIM_11H_CHANSW_RUNNING) ||
+        psessionEntry->csaOffloadEnable)
     {
        limLog(pMac, LOGW, FL("Ignoring channel switch on session %d"), psessionEntry->peSessionId);
        return eSIR_SUCCESS;
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 98421b8efcea..aedfe6923bd9 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -1032,7 +1032,7 @@ sendIndToSme:
     pStaDs->curTxMpduCnt = 0;
 
     if(IS_DOT11_MODE_HT(psessionEntry->dot11mode) &&
-      (pAssocReq->HTCaps.present))
+       pAssocReq->HTCaps.present && pAssocReq->wmeInfoPresent)
     {
         pStaDs->htGreenfield = (tANI_U8)pAssocReq->HTCaps.greenField;
         pStaDs->htAMpduDensity = pAssocReq->HTCaps.mpduDensity;
@@ -1074,11 +1074,17 @@ sendIndToSme:
         pStaDs->htLdpcCapable = (tANI_U8)pAssocReq->HTCaps.advCodingCap;
     }
 
-    if(pAssocReq->VHTCaps.present)
+    if(pAssocReq->VHTCaps.present && pAssocReq->wmeInfoPresent)
     {
         pStaDs->vhtLdpcCapable = (tANI_U8)pAssocReq->VHTCaps.ldpcCodingCap;
     }
 
+    if (!pAssocReq->wmeInfoPresent) {
+        pStaDs->mlmStaContext.htCapability = 0;
+#ifdef WLAN_FEATURE_11AC
+        pStaDs->mlmStaContext.vhtCapability = 0;
+#endif
+    }
 #ifdef WLAN_FEATURE_11AC
 if (limPopulateMatchingRateSet(pMac,
                                pStaDs,
diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index 0a45557ef58f..06b32d655fba 100644
--- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -1828,6 +1828,10 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
             limHandleDeleteBssRsp(pMac,limMsg); //wrapper routine to handle delete bss response 
             break;
 
+        case WDA_CSA_OFFLOAD_EVENT:
+            limHandleCSAoffloadMsg(pMac, limMsg);
+            break;
+
         case WDA_SET_BSSKEY_RSP:
         case WDA_SET_STA_BCASTKEY_RSP:
             limProcessMlmSetBssKeyRsp( pMac, limMsg );
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index 357a94b17714..0e8719c26df2 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -3815,7 +3815,7 @@ limProcessJoinFailureTimeout(tpAniSirGlobal pMac)
 
     if((psessionEntry = peFindSessionBySessionId(pMac, pMac->lim.limTimers.gLimJoinFailureTimer.sessionId))== NULL) 
     {
-        limLog(pMac, LOGP,FL("Session Does not exist for given sessionID"));
+        limLog(pMac, LOGE, FL("Session Does not exist for given sessionID"));
         return;
     }
         
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
index 95fa6b395637..92bc64b59f05 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
@@ -4811,7 +4811,7 @@ limSendBeaconInd(tpAniSirGlobal pMac, tpPESession psessionEntry){
     return;
 }
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 /**
  * limSendSmeScanCacheUpdatedInd()
  *
@@ -4865,7 +4865,7 @@ void limSendScanOffloadComplete(tpAniSirGlobal pMac,
             pScanEvent->sessionId,
             0);
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
     limSendSmeScanCacheUpdatedInd();
 #endif
 }
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index 80e8a0280714..b975d489f05a 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -2078,7 +2078,7 @@ __limProcessSmeReassocReq(tpAniSirGlobal pMac, tANI_U32 *pMsgBuf)
    if((psessionEntry = peFindSessionByBssid(pMac,pReassocReq->bssDescription.bssId,&sessionId))==NULL)
     {
         limPrintMacAddr(pMac, pReassocReq->bssDescription.bssId, LOGE);
-        limLog(pMac, LOGP, FL("Session does not exist for given bssId"));
+        limLog(pMac, LOGE, FL("Session does not exist for given bssId"));
         retCode = eSIR_SME_INVALID_PARAMETERS;
         goto end;
     }
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index b5daa153f5c6..398f8337d631 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -1199,8 +1199,6 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
     // STA sent a traffic spec.
     fAddTS = ( qosMode && pSta && pSta->qos.addtsPresent ) ? 1 : 0;
 
-    PopulateDot11fCapabilities( pMac, &frm.Capabilities, psessionEntry );
-
     frm.Status.status = statusCode;
 
     frm.AID.associd = aid | LIM_AID_MASK;
@@ -1308,6 +1306,10 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
     limUpdateShortPreamble(pMac, peerMacAddr, &beaconParams, psessionEntry);
     limUpdateShortSlotTime(pMac, peerMacAddr, &beaconParams, psessionEntry);
 
+    /* Populate Do11capabilities after updating session with Assos req details
+     */
+    PopulateDot11fCapabilities( pMac, &frm.Capabilities, psessionEntry );
+
     beaconParams.bssIdx = psessionEntry->bssIdx;
 
     //Send message to HAL about beacon parameter change.
diff --git a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
index 1d71f2013a28..d4f795ea9762 100644
--- a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
@@ -2616,8 +2616,44 @@ void limSendExitBmpsInd(tpAniSirGlobal pMac, tExitBmpsReason reasonCode,
 
 } /*** end limSendExitBmpsInd() ***/
 
+/*--------------------------------------------------------------------------
+  \brief limHandleCSAoffloadMsg() - Handle CSA offload message
+  \param pMac                     - pointer to global adapter context
+  \param MsgQ                     - Message pointer.
+  \sa
+  --------------------------------------------------------------------------*/
+void limHandleCSAoffloadMsg(tpAniSirGlobal pMac,tpSirMsgQ MsgQ)
+{
+   tpPESession psessionEntry;
+   tpCSAOffloadParams csa_params = (tpCSAOffloadParams)(MsgQ->bodyptr);
 
+   if(!csa_params)
+   {
+      limLog(pMac, LOGE, FL("limMsgQ body ptr is NULL"));
+      return;
+   }
 
+   psessionEntry = peFindSessionBySessionId(pMac, csa_params->sessionId);
+   if(!psessionEntry)
+   {
+      limLog(pMac, LOGP, FL("Session does not exist for given sessionID"));
+      goto err;
+   }
+
+   if (psessionEntry->limSystemRole == eLIM_STA_ROLE)
+   {
+      psessionEntry->gLimChannelSwitch.switchMode = csa_params->switchmode;
+      /* timer already started by firmware, switch immediately */
+      psessionEntry->gLimChannelSwitch.switchCount = 0;
+      psessionEntry->gLimChannelSwitch.primaryChannel = csa_params->channel;
+      psessionEntry->gLimChannelSwitch.state = eLIM_CHANNEL_SWITCH_PRIMARY_ONLY;
+      psessionEntry->gLimChannelSwitch.secondarySubBand = PHY_SINGLE_CHANNEL_CENTERED;
+      limPrepareFor11hChannelSwitch(pMac, psessionEntry);
+   }
+
+err:
+   palFreeMemory(pMac->hHdd, (void *)csa_params);
+}
 
 /*--------------------------------------------------------------------------
   \brief peDeleteSession() - Handle the Delete BSS Response from HAL.
diff --git a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.h b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.h
index 43e64ed82403..a1f421fc4fef 100644
--- a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.h
+++ b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.h
@@ -72,6 +72,7 @@ void limSendSmePromiscuousModeRsp(tpAniSirGlobal pMac);
 void limSendSmeNeighborBssInd(tpAniSirGlobal,
                               tLimScanResultNode *);
 void limHandleDeleteBssRsp(tpAniSirGlobal pMac,tpSirMsgQ MsgQ);
+void limHandleCSAoffloadMsg(tpAniSirGlobal pMac,tpSirMsgQ MsgQ);
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
 void
diff --git a/CORE/MAC/src/pe/lim/limUtils.c b/CORE/MAC/src/pe/lim/limUtils.c
index 3c7bacc27684..5b55324aa94b 100644
--- a/CORE/MAC/src/pe/lim/limUtils.c
+++ b/CORE/MAC/src/pe/lim/limUtils.c
@@ -7112,6 +7112,7 @@ void limProcessAddStaRsp(tpAniSirGlobal pMac,tpSirMsgQ limMsgQ)
         palFreeMemory(pMac, pAddStaParams);
         return;
     }
+    psessionEntry->csaOffloadEnable = pAddStaParams->csaOffloadEnable;
     if (psessionEntry->limSystemRole == eLIM_STA_IN_IBSS_ROLE)
         (void) limIbssAddStaRsp(pMac, limMsgQ->bodyptr,psessionEntry);
 #ifdef FEATURE_WLAN_TDLS
diff --git a/CORE/MAC/src/pe/rrm/rrmApi.c b/CORE/MAC/src/pe/rrm/rrmApi.c
index 0028cb5a8268..a7312be23809 100644
--- a/CORE/MAC/src/pe/rrm/rrmApi.c
+++ b/CORE/MAC/src/pe/rrm/rrmApi.c
@@ -253,7 +253,7 @@ rrmProcessLinkMeasurementRequest( tpAniSirGlobal pMac,
    v_S7_t            currentRSSI = 0;
 
 #if defined WLAN_VOWIFI_DEBUG
-   PELOGE(limLog( pMac, LOGE, "Received Link measurement request");)
+   PELOG1(limLog( pMac, LOG1, "Received Link measurement request");)
 #endif
    if( pRxPacketInfo == NULL || pLinkReq == NULL || pSessionEntry == NULL )
    {
@@ -261,22 +261,66 @@ rrmProcessLinkMeasurementRequest( tpAniSirGlobal pMac,
       return eSIR_FAILURE;
    }
    pHdr = WDA_GET_RX_MAC_HEADER( pRxPacketInfo );
-#if defined WLAN_VOWIFI_DEBUG
-   if( pSessionEntry->maxTxPower != (tPowerdBm) pLinkReq->MaxTxPower.maxTxPower )
+   if( (uint8)(pSessionEntry->maxTxPower) != pLinkReq->MaxTxPower.maxTxPower )
+   {
+      PELOGW(limLog( pMac,
+                     LOGW,
+                     FL(" maxTx power in link request is not same as local... "
+                        " Local = %d LinkReq = %d"),
+                     pSessionEntry->maxTxPower,
+                     pLinkReq->MaxTxPower.maxTxPower );)
+      if( (MIN_STA_PWR_CAP_DBM <= pLinkReq->MaxTxPower.maxTxPower) &&
+         (MAX_STA_PWR_CAP_DBM >= pLinkReq->MaxTxPower.maxTxPower) )
+      {
+         LinkReport.txPower = pLinkReq->MaxTxPower.maxTxPower;
+      }
+      else if( MIN_STA_PWR_CAP_DBM > pLinkReq->MaxTxPower.maxTxPower )
+      {
+         LinkReport.txPower = MIN_STA_PWR_CAP_DBM;
+      }
+      else if( MAX_STA_PWR_CAP_DBM < pLinkReq->MaxTxPower.maxTxPower )
+      {
+         LinkReport.txPower = MAX_STA_PWR_CAP_DBM;
+      }
+
+      if( (LinkReport.txPower != (uint8)(pSessionEntry->maxTxPower)) &&
+          (eSIR_SUCCESS == rrmSendSetMaxTxPowerReq ( pMac,
+                                                     (tPowerdBm)(LinkReport.txPower),
+                                                     pSessionEntry)) )
+      {
+         pSessionEntry->maxTxPower = (tPowerdBm)(LinkReport.txPower);
+      }
+   }
+   else
    {
-      PELOGE(limLog( pMac, LOGE, FL(" maxTx power in link request is not same as local...Local = %d LinkReq = %d"),
-           pSessionEntry->maxTxPower, pLinkReq->MaxTxPower.maxTxPower );)
+      if( (MIN_STA_PWR_CAP_DBM <= (uint8)(pSessionEntry->maxTxPower)) &&
+         (MAX_STA_PWR_CAP_DBM >= (uint8)(pSessionEntry->maxTxPower)) )
+      {
+         LinkReport.txPower = (uint8)(pSessionEntry->maxTxPower);
+      }
+      else if( MIN_STA_PWR_CAP_DBM > (uint8)(pSessionEntry->maxTxPower) )
+      {
+         LinkReport.txPower = MIN_STA_PWR_CAP_DBM;
+      }
+      else if( MAX_STA_PWR_CAP_DBM < (uint8)(pSessionEntry->maxTxPower) )
+      {
+         LinkReport.txPower = MAX_STA_PWR_CAP_DBM;
+      }
    }
-#endif
+   PELOGW(limLog( pMac,
+                  LOGW,
+                  FL(" maxTx power in link request is not same as local... "
+                     " Local = %d Link Report TxPower = %d"),
+                  pSessionEntry->maxTxPower,
+                  LinkReport.txPower );)
 
    LinkReport.dialogToken = pLinkReq->DialogToken.token;
-   LinkReport.txPower = pSessionEntry->txMgmtPower;
    LinkReport.rxAntenna = 0;
    LinkReport.txAntenna = 0;
    currentRSSI = WDA_GET_RX_RSSI_DB(pRxPacketInfo);
 
 #if defined WLAN_VOWIFI_DEBUG
-   PELOGE(limLog( pMac, LOGE, "Received Link report frame with %d", currentRSSI);)
+   PELOG1(limLog( pMac, LOG1, "Received Link report frame with %d", currentRSSI);)
 #endif
 
    // 2008 11k spec reference: 18.4.8.5 RCPI Measurement
@@ -290,7 +334,7 @@ rrmProcessLinkMeasurementRequest( tpAniSirGlobal pMac,
    LinkReport.rsni = WDA_GET_RX_SNR(pRxPacketInfo); 
    
 #if defined WLAN_VOWIFI_DEBUG
-   PELOGE(limLog( pMac, LOGE, "Sending Link report frame");)
+   PELOG1(limLog( pMac, LOG1, "Sending Link report frame");)
 #endif
    return limSendLinkReportActionFrame( pMac, &LinkReport, pHdr->sa, pSessionEntry ); 
 
diff --git a/CORE/SERVICES/BMI/ol_fw.h b/CORE/SERVICES/BMI/ol_fw.h
index b8f529e4f200..9d0391cba052 100644
--- a/CORE/SERVICES/BMI/ol_fw.h
+++ b/CORE/SERVICES/BMI/ol_fw.h
@@ -39,7 +39,7 @@
 #define AR6320_REV1_1_VERSION	     0x5000001
 #define QCA_FIRMWARE_FILE            "athwlan.bin"
 #define QCA_UTF_FIRMWARE_FILE        "utf.bin"
-#define QCA_BOARD_DATA_FILE          "fakeBoardData_AR6004.bin"
+#define QCA_BOARD_DATA_FILE          "fakeboar.bin"
 #define QCA_OTP_FILE                 "otp.bin"
 #define AR61X4_SINGLE_FILE           "qca61x4.bin"
 
diff --git a/CORE/SERVICES/COMMON/dbglog_id.h b/CORE/SERVICES/COMMON/dbglog_id.h
index e01f6dccbab4..1f617d129574 100644
--- a/CORE/SERVICES/COMMON/dbglog_id.h
+++ b/CORE/SERVICES/COMMON/dbglog_id.h
@@ -796,6 +796,25 @@ extern "C" {
 #define STA_SMPS_DBGID_SEND_SMPS_ACTION_FRAME           8
 #define SMPS_DBGID_DEFINITION_END                       9
 
+/* RTT module DBGIDs*/
+#define RTT_CALL_FLOW                 0
+#define RTT_REQ_SUB_TYPE              1
+#define RTT_MEAS_REQ_HEAD             2
+#define RTT_MEAS_REQ_BODY             3
+#define RTT_INIT_GLOBAL_STATE         6
+#define RTT_REPORT                    8
+#define RTT_ERROR_REPORT              10
+#define RTT_TIMER_STOP                11
+#define RTT_SEND_TM_FRAME             12
+#define RTT_V3_RESP_CNT               13
+#define RTT_V3_RESP_FINISH            14
+#define RTT_CHANNEL_SWITCH_REQ        15
+#define RTT_CHANNEL_SWITCH_GRANT      16
+#define RTT_CHANNEL_SWITCH_COMPLETE   17
+#define RTT_CHANNEL_SWITCH_PREEMPT    18
+#define RTT_CHANNEL_SWITCH_STOP       19
+#define RTT_TIMER_START               20
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/CORE/SERVICES/COMMON/targaddrs.h b/CORE/SERVICES/COMMON/targaddrs.h
index f6722516a336..66492e75f807 100644
--- a/CORE/SERVICES/COMMON/targaddrs.h
+++ b/CORE/SERVICES/COMMON/targaddrs.h
@@ -257,7 +257,16 @@ PREPACK64 struct host_interest_s {
             on the target processor.*/
     /* Bit 1 -- TBD */
 
-    A_UINT32               hi_fw_swap;                               /* 0x104 */
+    A_UINT32               hi_fw_swap;                              /* 0x104 */
+
+    /* global arenas pointer address, used by host driver debug */
+    A_UINT32               hi_dynamic_mem_arenas_addr;              /* 0x108 */
+
+    /* allocated bytes of DRAM use by allocated */
+    A_UINT32               hi_dynamic_mem_allocated;                /* 0x10C */
+
+    /* remaining bytes of DRAM */
+    A_UINT32               hi_dynamic_mem_remaining;                /* 0x110 */
 
 } POSTPACK64;
 
diff --git a/CORE/SERVICES/COMMON/wlan_tgt_def_config.h b/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
index ddc4980c5bd7..258c7d442712 100644
--- a/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
+++ b/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
@@ -153,6 +153,7 @@
 #define CFG_TGT_DEFAULT_MCAST2UCAST_MODE 2
 #endif
 
+#define CFG_TGT_MAX_MULTICAST_FILTER_ENTRIES 5
 /*
  * Specify how much memory the target should allocate for a debug log of
  * tx PPDU meta-information (how large the PPDU was, when it was sent,
diff --git a/CORE/SERVICES/HIF/PCIe/hif_pci.c b/CORE/SERVICES/HIF/PCIe/hif_pci.c
index 485ce8837a41..0bf65463c703 100644
--- a/CORE/SERVICES/HIF/PCIe/hif_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/hif_pci.c
@@ -2130,16 +2130,10 @@ HIF_PCIDeviceProbed(hif_handle_t hif_hdl)
 	          AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("ath: HIF_PCIDeviceProbed get chip id val (%d)\n", rv));
 		  goto done;
 	     }
-	     if (CHIP_ID_VERSION_GET(chip_id) == 0xD) {
+	     if (CHIP_ID_VERSION_GET(chip_id) == 0xD && (CHIP_ID_REVISION_GET(chip_id) == 0x0 || CHIP_ID_REVISION_GET(chip_id) == 0x1)) {
 		  /* for ROME 1.0, 3 banks are switched to IRAM */
 		  AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("chip ver=0x%x, chip rev=0x%x\n", CHIP_ID_VERSION_GET(chip_id), CHIP_ID_REVISION_GET(chip_id)));
-		   if (CHIP_ID_REVISION_GET(chip_id) == 0x0) {
-			/* for ROME 1.0, 3 banks are switched to IRAM */
-			banks_switched = 3 ;
-		   } else if (CHIP_ID_REVISION_GET(chip_id) == 0x1) {
-			/* for ROME 1.1, 2 banks are switched to IRAM */
-			banks_switched = 2 ;
-		   }
+		  banks_switched = 3;
 	     }
 	     ealloc_value |= ((banks_switched << HI_EARLY_ALLOC_IRAM_BANKS_SHIFT) & HI_EARLY_ALLOC_IRAM_BANKS_MASK);
 	}
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 46444cc84e9b..93ccb522de36 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -345,6 +345,7 @@ static void wma_vdev_start_rsp(tp_wma_handle wma,
 		add_bss->status = VOS_STATUS_E_FAILURE;
 		goto send_fail_resp;
 	}
+	vos_mem_zero(bcn, sizeof(*bcn));
 	bcn->buf = adf_nbuf_alloc(NULL, WMA_BCN_BUF_MAX_SIZE, 0,
 				  sizeof(u_int32_t), 0);
 	if (!bcn->buf) {
@@ -354,9 +355,6 @@ static void wma_vdev_start_rsp(tp_wma_handle wma,
 		add_bss->status = VOS_STATUS_E_FAILURE;
 		goto send_fail_resp;
 	}
-	bcn->len = 0;
-	bcn->dtim_count = 0;
-	bcn->dma_mapped = 0;
 	bcn->seq_no = MIN_SW_SEQ;
 	adf_os_spinlock_init(&bcn->lock);
 
@@ -510,6 +508,10 @@ static v_VOID_t wma_set_default_tgt_config(tp_wma_handle wma_handle)
 		CFG_TGT_DEFAULT_GTK_OFFLOAD_MAX_VDEV,
 		CFG_TGT_NUM_MSDU_DESC,
 		CFG_TGT_MAX_FRAG_TABLE_ENTRIES,
+		0,
+		0,
+		0,
+		CFG_TGT_MAX_MULTICAST_FILTER_ENTRIES,
 	};
 
 	WMITLV_SET_HDR(&tgt_cfg.tlv_header,WMITLV_TAG_STRUC_wmi_resource_config,
@@ -989,17 +991,17 @@ static void wma_send_bcn_buf_ll(tp_wma_handle wma,
 	if (WMI_UNIFIED_NOA_ATTR_IS_MODIFIED(p2p_noa_info)) {
 		vos_mem_zero(&noa_ie, sizeof(noa_ie));
 
-		noa_ie.index = WMI_UNIFIED_NOA_ATTR_INDEX_GET(p2p_noa_info);
-		noa_ie.oppPS = WMI_UNIFIED_NOA_ATTR_OPP_PS_GET(p2p_noa_info);
-		noa_ie.ctwindow = WMI_UNIFIED_NOA_ATTR_CTWIN_GET(p2p_noa_info);
-		noa_ie.num_descriptors = WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(
+		noa_ie.index = (u_int8_t)WMI_UNIFIED_NOA_ATTR_INDEX_GET(p2p_noa_info);
+		noa_ie.oppPS = (u_int8_t)WMI_UNIFIED_NOA_ATTR_OPP_PS_GET(p2p_noa_info);
+		noa_ie.ctwindow = (u_int8_t)WMI_UNIFIED_NOA_ATTR_CTWIN_GET(p2p_noa_info);
+		noa_ie.num_descriptors = (u_int8_t)WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(
 				p2p_noa_info);
 		WMA_LOGI("%s: index %lu, oppPs %lu, ctwindow %lu, "
 			"num_descriptors = %lu", __func__, noa_ie.index,
 			noa_ie.oppPS, noa_ie.ctwindow, noa_ie.num_descriptors);
 		for(i = 0; i < noa_ie.num_descriptors; i++) {
 			noa_ie.noa_descriptors[i].type_count =
-				p2p_noa_info->noa_descriptors[i].type_count;
+				 (u_int8_t)p2p_noa_info->noa_descriptors[i].type_count;
 			noa_ie.noa_descriptors[i].duration =
 				p2p_noa_info->noa_descriptors[i].duration;
 			noa_ie.noa_descriptors[i].interval =
@@ -1095,6 +1097,45 @@ static int wma_beacon_swba_handler(void *handle, u_int8_t *event, u_int32_t len)
 }
 #endif
 
+static int wma_csa_offload_handler(void *handle, u_int8_t *event, u_int32_t len)
+{
+	tp_wma_handle wma = (tp_wma_handle)handle;
+	WMI_CSA_HANDLING_EVENTID_param_tlvs *param_buf;
+	wmi_csa_event_fixed_param *csa_event;
+	u_int8_t bssid[IEEE80211_ADDR_LEN];
+	u_int8_t vdev_id = 0;
+	struct ieee80211_channelswitch_ie *csa_ie;
+	tpCSAOffloadParams csa_offload_event;
+
+	param_buf = (WMI_CSA_HANDLING_EVENTID_param_tlvs *) event;
+	if (!param_buf) {
+		WMA_LOGE("Invalid csa event buffer");
+		return -EINVAL;
+	}
+	csa_event = param_buf->fixed_param;
+	WMI_MAC_ADDR_TO_CHAR_ARRAY(&csa_event->i_addr2, &bssid[0]);
+
+	if (wma_find_vdev_by_bssid(wma, bssid, &vdev_id) == NULL) {
+		WMA_LOGE("Invalid bssid received %s:%d", __func__, __LINE__);
+		return -EINVAL;
+	}
+
+	csa_offload_event = vos_mem_malloc(sizeof(*csa_offload_event));
+	if (!csa_offload_event) {
+		WMA_LOGE("VOS MEM Alloc Failed for csa_offload_event");
+		return -EINVAL;
+	}
+
+	vos_mem_zero(csa_offload_event, sizeof(*csa_offload_event));
+	csa_offload_event->sessionId = vdev_id;
+	csa_ie = (struct ieee80211_channelswitch_ie *)(&csa_event->csa_ie[0]);
+	csa_offload_event->channel = csa_ie->newchannel;
+	csa_offload_event->switchmode = csa_ie->switchmode;
+
+	wma_send_msg(wma, WDA_CSA_OFFLOAD_EVENT, (void *)csa_offload_event, 0);
+	return 0;
+}
+
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 static int wma_gtk_offload_status_event(void *handle, u_int8_t *event,
 					u_int32_t len)
@@ -1962,7 +2003,8 @@ static ol_txrx_vdev_handle wma_vdev_attach(tp_wma_handle wma_handle,
 	} else {
 		WMA_LOGE("Failed to get value for WNI_CFG_FRAGMENTATION_THRESHOLD, leaving unchanged");
 	}
-	if (self_sta_req->type == WMI_VDEV_TYPE_STA) {
+	if (self_sta_req->type == WMI_VDEV_TYPE_STA &&
+        mac->roam.configParam.isFastRoamIniFeatureEnabled) {
         /* Enable roaming offload
 		 * return value is not significant because some firmware versions may have
 		 * roam offload always enabled. It will stay enabled even if this command fails.
@@ -2949,6 +2991,10 @@ VOS_STATUS wma_roam_scan_offload_init_connect(tp_wma_handle wma_handle, u_int8_t
     if (!pMac) {
         return VOS_STATUS_SUCCESS;
     }
+	if (!pMac->roam.configParam.isFastRoamIniFeatureEnabled) {
+		/* Fast roaming is disabled */
+		return VOS_STATUS_SUCCESS;
+	}
     if (pMac->roam.roamSession[sessionId].connectedProfile.SSID.length == 0) {
         /* No need to configure roam scan for null SSID. */
         return VOS_STATUS_SUCCESS;
@@ -2988,8 +3034,11 @@ VOS_STATUS wma_process_roam_scan_req(tp_wma_handle wma_handle,
                 wma_handle->vos_context);
     A_UINT32    mode;
 
-    vos_trace_setValue(VOS_MODULE_ID_WDA, VOS_TRACE_LEVEL_DEBUG, 1);
     WMA_LOGI("%s: command 0x%x\n", __func__, roam_req->Command);
+	if (!pMac->roam.configParam.isFastRoamIniFeatureEnabled) {
+		/* Fast roaming is disabled */
+		return VOS_STATUS_SUCCESS;
+	}
     switch (roam_req->Command) {
         case ROAM_SCAN_OFFLOAD_START:
         case ROAM_SCAN_OFFLOAD_STOP:
@@ -3161,6 +3210,7 @@ static VOS_STATUS wma_vdev_start(tp_wma_handle wma,
 	int32_t len;
 	WLAN_PHY_MODE chanmode;
 	u_int8_t *buf_ptr;
+	struct wma_txrx_node *intr = wma->interfaces;
 
 	len = sizeof(*cmd) + sizeof(wmi_channel) +
 	       WMI_TLV_HDR_SIZE;
@@ -3184,16 +3234,20 @@ static VOS_STATUS wma_vdev_start(tp_wma_handle wma,
 	/* Fill channel info */
 	chan->mhz = vos_chan_to_freq(req->chan);
 	chanmode = wma_chan_to_mode(req->chan, req->chan_offset,
-                                    req->vht_capable);
+				req->vht_capable);
+
+	intr[cmd->vdev_id].chanmode = chanmode; /* save channel mode */
+	intr[cmd->vdev_id].ht_capable = req->ht_capable;
+	intr[cmd->vdev_id].vht_capable = req->vht_capable;
 	WMI_SET_CHANNEL_MODE(chan, chanmode);
 	chan->band_center_freq1 = chan->mhz;
 
 	if (chanmode == MODE_11AC_VHT80)
-            chan->band_center_freq1 = vos_chan_to_freq(wma_getCenterChannel
-                                             (req->chan, req->chan_offset));
+		chan->band_center_freq1 = vos_chan_to_freq(wma_getCenterChannel
+			(req->chan, req->chan_offset));
 
 	if ((chanmode == MODE_11NA_HT40) || (chanmode == MODE_11NG_HT40) ||
-            (chanmode == MODE_11AC_VHT40)) {
+			(chanmode == MODE_11AC_VHT40)) {
 		if (req->chan_offset == PHY_DOUBLE_CHANNEL_LOW_PRIMARY)
 			chan->band_center_freq1 += 10;
 		else
@@ -4787,6 +4841,34 @@ send_rsp:
 	wma_send_msg(wma, WDA_ADD_STA_RSP, (void *)add_sta, 0);
 }
 
+static int wmi_unified_csa_offload_enable(tp_wma_handle wma,
+		u_int8_t vdev_id)
+{
+	wmi_csa_offload_enable_cmd_fixed_param *cmd;
+	wmi_buf_t buf;
+	int32_t len = sizeof(*cmd);
+
+	WMA_LOGD("%s: vdev_id %d", __func__, vdev_id);
+	buf = wmi_buf_alloc(wma->wmi_handle, len);
+	if (!buf) {
+		WMA_LOGP("%s:wmi_buf_alloc failed\n", __func__);
+		return -ENOMEM;
+	}
+	cmd = (wmi_csa_offload_enable_cmd_fixed_param *) wmi_buf_data(buf);
+	WMITLV_SET_HDR(&cmd->tlv_header,
+			WMITLV_TAG_STRUC_wmi_csa_offload_enable_cmd_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(wmi_csa_offload_enable_cmd_fixed_param));
+	cmd->vdev_id = vdev_id;
+	cmd->csa_offload_enable = WMI_CSA_OFFLOAD_ENABLE;
+	if (wmi_unified_cmd_send(wma->wmi_handle, buf, len,
+				WMI_CSA_OFFLOAD_ENABLE_CMDID)) {
+		WMA_LOGP("Failed to send CSA offload enable command");
+		wmi_buf_free(buf);
+		return -EIO;
+	}
+	return 0;
+}
+
 static void wma_add_sta_req_sta_mode(tp_wma_handle wma, tpAddStaParams params)
 {
 	ol_txrx_pdev_handle pdev;
@@ -4837,6 +4919,17 @@ static void wma_add_sta_req_sta_mode(tp_wma_handle wma, tpAddStaParams params)
 			iface->dtimPeriod, iface->shortSlotTimeSupported, iface->llbCoexist);
 
 	wma_roam_scan_offload_init_connect(wma, params->smesessionId);
+
+	params->csaOffloadEnable = 0;
+	if (WMI_SERVICE_IS_ENABLED(wma->wmi_service_bitmap,
+				WMI_SERVICE_CSA_OFFLOAD)) {
+		params->csaOffloadEnable = 1;
+		if (wmi_unified_csa_offload_enable(wma, params->smesessionId) < 0) {
+			WMA_LOGE("Unable to enable CSA offload for vdev_id:%d",
+					params->smesessionId);
+		}
+	}
+
 	if (wmi_unified_vdev_up_send(wma->wmi_handle, params->smesessionId,
 				     params->assocId, params->bssId) < 0) {
 		WMA_LOGP("Failed to send vdev up cmd: vdev %d bssid %pM\n",
@@ -6163,7 +6256,7 @@ VOS_STATUS wma_trigger_uapsd_params(tp_wma_handle wma_handle, u_int32_t vdev_id,
 	return VOS_STATUS_SUCCESS;
 }
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 
 /* Request FW to start PNO operation */
 static VOS_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno)
@@ -6185,7 +6278,8 @@ static VOS_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno)
 
 	len += sizeof(u_int32_t) * MIN(pno->aNetworks[0].ucChannelCount,
 				   WMI_NLO_MAX_CHAN);
-	len += sizeof(u_int32_t) * MIN(pno->ucNetworksCount, WMI_NLO_MAX_SSIDS);
+	len += sizeof(nlo_configured_parameters) *
+				MIN(pno->ucNetworksCount, WMI_NLO_MAX_SSIDS);
 
 	buf = wmi_buf_alloc(wma->wmi_handle, len);
 	if (!buf) {
@@ -6203,6 +6297,14 @@ static VOS_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno)
 	cmd->vdev_id = pno->sessionId;
 	cmd->flags = WMI_NLO_CONFIG_START;
 
+	/* Copy scan interval */
+	if (pno->scanTimers.ucScanTimersCount) {
+		cmd->fast_scan_period =
+		   WMA_SEC_TO_MSEC(pno->scanTimers.aTimerValues[0].uTimerValue);
+		cmd->slow_scan_period = cmd->fast_scan_period;
+		WMA_LOGD("Scan period : %d msec", cmd->slow_scan_period);
+	}
+
 	buf_ptr += sizeof(wmi_nlo_config_cmd_fixed_param);
 
 	cmd->no_of_ssids = MIN(pno->ucNetworksCount, WMI_NLO_MAX_SSIDS);
@@ -6213,6 +6315,9 @@ static VOS_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno)
 
 	nlo_list = (nlo_configured_parameters *) buf_ptr;
 	for (i = 0; i < cmd->no_of_ssids; i++) {
+		WMITLV_SET_HDR(&nlo_list[i].tlv_header,
+			WMITLV_TAG_ARRAY_BYTE,
+			WMITLV_GET_STRUCT_TLVLEN(nlo_configured_parameters));
 		/* Copy ssid and it's length */
 		nlo_list[i].ssid.valid = TRUE;
 		nlo_list[i].ssid.ssid.ssid_len = pno->aNetworks[i].ssId.length;
@@ -6222,6 +6327,16 @@ static VOS_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno)
 		WMA_LOGD("index: %d ssid: %s len: %d", i,
 			 nlo_list[i].ssid.ssid.ssid,
 			 nlo_list[i].ssid.ssid.ssid_len);
+
+		/* Copy rssi threshold */
+		if (pno->aNetworks[i].rssiThreshold &&
+		    pno->aNetworks[i].rssiThreshold > WMA_RSSI_THOLD_DEFAULT) {
+			nlo_list[i].rssi_cond.valid = TRUE;
+			nlo_list[i].rssi_cond.rssi =
+				pno->aNetworks[i].rssiThreshold;
+			WMA_LOGD("RSSI threshold : %d dBm",
+				nlo_list[i].rssi_cond.rssi);
+		}
 	}
 	buf_ptr += cmd->no_of_ssids * sizeof(nlo_configured_parameters);
 
@@ -6244,17 +6359,9 @@ static VOS_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno)
 	}
 	buf_ptr += cmd->num_of_channels * sizeof(u_int32_t);
 
-
-	/* TODO: PNO offload present in discrete firmware is implemented
-	 * by keeping Windows requirement. Following options are missing
-	 * in current discrete firmware to meet linux requirement.
-	 *     1) Option to configure Sched scan period.
-	 *     2) Option to configure RSSI threshold.
-	 *     3) Option to configure APP IE (comes from wpa_supplicant).
-	 * Until firmware team brings above changes, lets live with what's
-	 * available.
+	/* TODO: Discrete firmware doesn't have command/option to configure
+	 * App IE which comes from wpa_supplicant as of part PNO start request.
 	 */
-
 	ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len,
 				   WMI_NETWORK_LIST_OFFLOAD_CONFIG_CMDID);
 	if (ret) {
@@ -6298,6 +6405,11 @@ static VOS_STATUS wma_pno_stop(tp_wma_handle wma, u_int8_t vdev_id)
 
 	cmd = (wmi_nlo_config_cmd_fixed_param *) wmi_buf_data(buf);
 	buf_ptr = (u_int8_t *) cmd;
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+		WMITLV_TAG_STRUC_wmi_nlo_config_cmd_fixed_param,
+		WMITLV_GET_STRUCT_TLVLEN(wmi_nlo_config_cmd_fixed_param));
+
 	cmd->vdev_id = vdev_id;
 	cmd->flags = WMI_NLO_CONFIG_STOP;
 	buf_ptr += sizeof(*cmd);
@@ -7465,7 +7577,7 @@ wma_data_tx_ack_comp_hdlr(void *wma_context,
 
 		ack_work =
 		adf_os_mem_alloc(NULL, sizeof(struct wma_tx_ack_work_ctx));
-
+		wma_handle->ack_work_ctx = ack_work;
 		if(ack_work) {
 			INIT_WORK(&ack_work->ack_cmp_work,
 					wma_data_tx_ack_work_handler);
@@ -7483,14 +7595,71 @@ wma_data_tx_ack_comp_hdlr(void *wma_context,
 	adf_nbuf_free(netbuf);
 }
 
+static int wma_add_clear_mcbc_filter(tp_wma_handle wma_handle, uint8_t vdev_id,
+					tSirMacAddr multicastAddr, bool clearList)
+{
+	WMI_SET_MCASTBCAST_FILTER_CMD_fixed_param *cmd;
+	wmi_buf_t buf;
+	int err;
+
+	buf = wmi_buf_alloc(wma_handle->wmi_handle, sizeof(*cmd));
+	if (!buf) {
+		WMA_LOGE("Failed to allocate buffer to send set_param cmd");
+		return -ENOMEM;
+	}
+
+	cmd = (WMI_SET_MCASTBCAST_FILTER_CMD_fixed_param *) wmi_buf_data(buf);
+	vos_mem_zero(cmd, sizeof(*cmd));
+
+	WMITLV_SET_HDR(&cmd->tlv_header,
+			WMITLV_TAG_STRUC_WMI_SET_MCASTBCAST_FILTER_CMD_fixed_param,
+			WMITLV_GET_STRUCT_TLVLEN(
+					WMI_SET_MCASTBCAST_FILTER_CMD_fixed_param));
+	cmd->action = (clearList? WMI_MCAST_FILTER_DELETE : WMI_MCAST_FILTER_SET);
+	cmd->vdev_id = vdev_id;
+	WMI_CHAR_ARRAY_TO_MAC_ADDR(multicastAddr, &cmd->mcastbdcastaddr);
+	err = wmi_unified_cmd_send(wma_handle->wmi_handle, buf,
+					sizeof(*cmd), WMI_SET_MCASTBCAST_FILTER_CMDID);
+	if (err) {
+		WMA_LOGE("Failed to send set_param cmd");
+		adf_os_mem_free(buf);
+		return -EIO;
+	}
+	return 0;
+}
+
+static VOS_STATUS wma_process_mcbc_set_filter_req(tp_wma_handle wma_handle,
+                                               tSirRcvFltMcAddrList *mcbc_param)
+{
+	uint8_t vdev_id = 0;
+	int i;
+
+	if(mcbc_param->ulMulticastAddrCnt <= 0) {
+		WMA_LOGE("Number of multicast addresses is 0");
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	if (!wma_find_vdev_by_addr(wma_handle, mcbc_param->selfMacAddr, &vdev_id)) {
+		WMA_LOGE("%s: Failed to find vdev id for %pM\n",
+						__func__, mcbc_param->bssId);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	for (i = 0; i < mcbc_param->ulMulticastAddrCnt; i++) {
+		wma_add_clear_mcbc_filter(wma_handle, vdev_id,
+					mcbc_param->multicastAddr[i],
+					(mcbc_param->action == 1));
+	}
+	return VOS_STATUS_SUCCESS;
+}
+
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 #define GTK_OFFLOAD_ENABLE	0
 #define GTK_OFFLOAD_DISABLE	1
 
-static VOS_STATUS wma_process_gtk_offload_req(tp_wma_handle wma,
-					      tpSirGtkOffloadParams params)
+static VOS_STATUS wma_send_gtk_offload_req(tp_wma_handle wma, u_int8_t vdev_id,
+					   tpSirGtkOffloadParams params)
 {
-	u_int8_t vdev_id;
 	int len;
 	wmi_buf_t buf;
 	WMI_GTK_OFFLOAD_CMD_fixed_param *cmd;
@@ -7498,13 +7667,6 @@ static VOS_STATUS wma_process_gtk_offload_req(tp_wma_handle wma,
 
 	WMA_LOGD("%s Enter", __func__);
 
-	/* Get the vdev id */
-	if (!wma_find_vdev_by_bssid(wma, params->bssId, &vdev_id)) {
-		WMA_LOGE("vdev handle is invalid for %pM", params->bssId);
-		status = VOS_STATUS_E_INVAL;
-		goto out;
-	}
-
 	len = sizeof(*cmd);
 
 	/* alloc wmi buffer */
@@ -7546,6 +7708,41 @@ static VOS_STATUS wma_process_gtk_offload_req(tp_wma_handle wma,
 		status = VOS_STATUS_E_FAILURE;
 	}
 out:
+	WMA_LOGD("%s Exit", __func__);
+	return status;
+}
+
+static VOS_STATUS wma_process_gtk_offload_req(tp_wma_handle wma,
+					      tpSirGtkOffloadParams params)
+{
+	u_int8_t vdev_id;
+	VOS_STATUS status = VOS_STATUS_SUCCESS;
+
+	WMA_LOGD("%s Enter", __func__);
+
+	/* Get the vdev id */
+	if (!wma_find_vdev_by_bssid(wma, params->bssId, &vdev_id)) {
+		WMA_LOGE("vdev handle is invalid for %pM", params->bssId);
+		status = VOS_STATUS_E_INVAL;
+		goto out;
+	}
+
+	if ((params->ulFlags == GTK_OFFLOAD_ENABLE) &&
+	    (wma->wow.gtk_err_enable == TRUE)) {
+		WMA_LOGD("%s GTK Offload already enabled. Disable it first",
+			 __func__);
+		params->ulFlags = GTK_OFFLOAD_DISABLE;
+		status = wma_send_gtk_offload_req(wma, vdev_id, params);
+		if (status != VOS_STATUS_SUCCESS) {
+			WMA_LOGE("%s Failed to disable GTK Offload", __func__);
+			goto out;
+		}
+		WMA_LOGD("%s Enable GTK Offload again with updated inputs",
+			 __func__);
+		params->ulFlags = GTK_OFFLOAD_ENABLE;
+	}
+	status = wma_send_gtk_offload_req(wma, vdev_id, params);
+out:
 	vos_mem_free(params);
 	WMA_LOGD("%s Exit", __func__);
 	return status;
@@ -7731,6 +7928,568 @@ static VOS_STATUS wma_enable_arp_ns_offload(tp_wma_handle wma, tpSirHostOffloadR
 	return VOS_STATUS_SUCCESS;
 }
 
+typedef struct {
+	int32_t rate;
+	tANI_U8 flag;
+} wma_search_rate_t;
+
+#define WMA_MAX_OFDM_CCK_RATE_TBL_SIZE 12
+/* In ofdm_cck_rate_tbl->flag, if bit 7 is 1 it's CCK, otherwise it ofdm.
+ * Lower bit carries the ofdm/cck index for encoding the rate */
+static wma_search_rate_t ofdm_cck_rate_tbl[WMA_MAX_OFDM_CCK_RATE_TBL_SIZE] = {
+	{540, 4},            /* 4: OFDM 54 Mbps */
+	{480, 0},            /* 0: OFDM 48 Mbps */
+	{360, 5},            /* 5: OFDM 36 Mbps */
+	{240, 1},            /* 1: OFDM 24 Mbps */
+	{180, 6},            /* 6: OFDM 18 Mbps */
+	{120, 2},            /* 2: OFDM 12 Mbps */
+	{110, (1 << 7)},     /* 0: CCK 11 Mbps Long */
+	{90,  7},            /* 7: OFDM 9 Mbps  */
+	{60,  3},            /* 3: OFDM 6 Mbps  */
+	{55,  ((1 << 7)|1)}, /* 1: CCK 5.5 Mbps Long */
+	{20,  ((1 << 7)|2)}, /* 2: CCK 2 Mbps Long   */
+	{10,  ((1 << 7)|3)}  /* 3: CCK 1 Mbps Long   */
+};
+
+#define WMA_MAX_OFDM_RATE_TBL_SIZE 8
+/* In ofdm_rate_tbl flag carries the ofdm index for encoding the rate */
+static wma_search_rate_t ofdm_rate_tbl[WMA_MAX_OFDM_RATE_TBL_SIZE] = {
+	{540, 4}, /* 4: OFDM 54 Mbps */
+	{480, 0}, /* 0: OFDM 48 Mbps */
+	{360, 5}, /* 5: OFDM 36 Mbps */
+	{240, 1}, /* 1: OFDM 24 Mbps */
+	{180, 6}, /* 6: OFDM 18 Mbps */
+	{120, 2}, /* 2: OFDM 12 Mbps */
+	{90,  7}, /* 7: OFDM 9 Mbps  */
+	{60,  3}  /* 3: OFDM 6 Mbps  */
+};
+
+#define WMA_MAX_CCK_RATE_TBL_SIZE 4
+/* In cck_rate_tbl flag carries the ofdm index for encoding the rate */
+static wma_search_rate_t cck_rate_tbl[WMA_MAX_CCK_RATE_TBL_SIZE] = {
+	{110, 0}, /* 0: CCK 11 Mbps Long */
+	{55,  1}, /* 1: CCK 5.5 Mbps Long */
+	{20,  2}, /* 2: CCK 2 Mbps Long   */
+	{10,  3}  /* 3: CCK 1 Mbps Long   */
+};
+
+#define WMA_MAX_VHT20_RATE_TBL_SIZE 9
+/* In vht20_400ns_rate_tbl flag carries the mcs index for encoding the rate */
+static wma_search_rate_t vht20_400ns_rate_tbl[WMA_MAX_VHT20_RATE_TBL_SIZE] = {
+	{867, 8}, /* MCS8 1SS short GI */
+	{722, 7}, /* MCS7 1SS short GI */
+	{650, 6}, /* MCS6 1SS short GI */
+	{578, 5}, /* MCS5 1SS short GI */
+	{433, 4}, /* MCS4 1SS short GI */
+	{289, 3}, /* MCS3 1SS short GI */
+	{217, 2}, /* MCS2 1SS short GI */
+	{144, 1}, /* MCS1 1SS short GI */
+	{72,  0}  /* MCS0 1SS short GI */
+};
+/* In vht20_800ns_rate_tbl flag carries the mcs index for encoding the rate */
+static wma_search_rate_t vht20_800ns_rate_tbl[WMA_MAX_VHT20_RATE_TBL_SIZE] = {
+	{780, 8}, /* MCS8 1SS long GI */
+	{650, 7}, /* MCS7 1SS long GI */
+	{585, 6}, /* MCS6 1SS long GI */
+	{520, 5}, /* MCS5 1SS long GI */
+	{390, 4}, /* MCS4 1SS long GI */
+	{260, 3}, /* MCS3 1SS long GI */
+	{195, 2}, /* MCS2 1SS long GI */
+	{130, 1}, /* MCS1 1SS long GI */
+	{65,  0}  /* MCS0 1SS long GI */
+};
+
+#define WMA_MAX_VHT40_RATE_TBL_SIZE 10
+/* In vht40_400ns_rate_tbl flag carries the mcs index for encoding the rate */
+static wma_search_rate_t vht40_400ns_rate_tbl[WMA_MAX_VHT40_RATE_TBL_SIZE] = {
+	{2000, 9}, /* MCS9 1SS short GI */
+	{1800, 8}, /* MCS8 1SS short GI */
+	{1500, 7}, /* MCS7 1SS short GI */
+	{1350, 6}, /* MCS6 1SS short GI */
+	{1200, 5}, /* MCS5 1SS short GI */
+	{900,  4}, /* MCS4 1SS short GI */
+	{600,  3}, /* MCS3 1SS short GI */
+	{450,  2}, /* MCS2 1SS short GI */
+	{300,  1}, /* MCS1 1SS short GI */
+	{150,  0}, /* MCS0 1SS short GI */
+};
+static wma_search_rate_t vht40_800ns_rate_tbl[WMA_MAX_VHT40_RATE_TBL_SIZE] = {
+	{1800, 9}, /* MCS9 1SS long GI */
+	{1620, 8}, /* MCS8 1SS long GI */
+	{1350, 7}, /* MCS7 1SS long GI */
+	{1215, 6}, /* MCS6 1SS long GI */
+	{1080, 5}, /* MCS5 1SS long GI */
+	{810,  4}, /* MCS4 1SS long GI */
+	{540,  3}, /* MCS3 1SS long GI */
+	{405,  2}, /* MCS2 1SS long GI */
+	{270,  1}, /* MCS1 1SS long GI */
+	{135,  0}  /* MCS0 1SS long GI */
+};
+
+#define WMA_MAX_VHT80_RATE_TBL_SIZE 10
+static wma_search_rate_t vht80_400ns_rate_tbl[WMA_MAX_VHT80_RATE_TBL_SIZE] = {
+	{4333, 9}, /* MCS9 1SS short GI */
+	{3900, 8}, /* MCS8 1SS short GI */
+	{3250, 7}, /* MCS7 1SS short GI */
+	{2925, 6}, /* MCS6 1SS short GI */
+	{2600, 5}, /* MCS5 1SS short GI */
+	{1950, 4}, /* MCS4 1SS short GI */
+	{1300, 3}, /* MCS3 1SS short GI */
+	{975,  2}, /* MCS2 1SS short GI */
+	{650,  1}, /* MCS1 1SS short GI */
+	{325,  0}  /* MCS0 1SS short GI */
+};
+static wma_search_rate_t vht80_800ns_rate_tbl[WMA_MAX_VHT80_RATE_TBL_SIZE] = {
+	{3900, 9}, /* MCS9 1SS long GI */
+	{3510, 8}, /* MCS8 1SS long GI */
+	{2925, 7}, /* MCS7 1SS long GI */
+	{2633, 6}, /* MCS6 1SS long GI */
+	{2340, 5}, /* MCS5 1SS long GI */
+	{1755, 4}, /* MCS4 1SS long GI */
+	{1170, 3}, /* MCS3 1SS long GI */
+	{878,  2}, /* MCS2 1SS long GI */
+	{585,  1}, /* MCS1 1SS long GI */
+	{293,  0}  /* MCS0 1SS long GI */
+};
+
+#define WMA_MAX_HT20_RATE_TBL_SIZE 8
+static wma_search_rate_t ht20_400ns_rate_tbl[WMA_MAX_HT20_RATE_TBL_SIZE] = {
+	{722, 7}, /* MCS7 1SS short GI */
+	{650, 6}, /* MCS6 1SS short GI */
+	{578, 5}, /* MCS5 1SS short GI */
+	{433, 4}, /* MCS4 1SS short GI */
+	{289, 3}, /* MCS3 1SS short GI */
+	{217, 2}, /* MCS2 1SS short GI */
+	{144, 1}, /* MCS1 1SS short GI */
+	{72,  0}  /* MCS0 1SS short GI */
+};
+static wma_search_rate_t ht20_800ns_rate_tbl[WMA_MAX_HT20_RATE_TBL_SIZE] = {
+	{650, 7}, /* MCS7 1SS long GI */
+	{585, 6}, /* MCS6 1SS long GI */
+	{520, 5}, /* MCS5 1SS long GI */
+	{390, 4}, /* MCS4 1SS long GI */
+	{260, 3}, /* MCS3 1SS long GI */
+	{195, 2}, /* MCS2 1SS long GI */
+	{130, 1}, /* MCS1 1SS long GI */
+	{65,  0}  /* MCS0 1SS long GI */
+};
+
+#define WMA_MAX_HT40_RATE_TBL_SIZE 8
+static wma_search_rate_t ht40_400ns_rate_tbl[WMA_MAX_HT40_RATE_TBL_SIZE] = {
+	{1500, 7}, /* MCS7 1SS short GI */
+	{1350, 6}, /* MCS6 1SS short GI */
+	{1200, 5}, /* MCS5 1SS short GI */
+	{900,  4}, /* MCS4 1SS short GI */
+	{600,  3}, /* MCS3 1SS short GI */
+	{450,  2}, /* MCS2 1SS short GI */
+	{300,  1}, /* MCS1 1SS short GI */
+	{150,  0}  /* MCS0 1SS short GI */
+};
+static wma_search_rate_t ht40_800ns_rate_tbl[WMA_MAX_HT40_RATE_TBL_SIZE] = {
+	{1350, 7}, /* MCS7 1SS long GI */
+	{1215, 6}, /* MCS6 1SS long GI */
+	{1080, 5}, /* MCS5 1SS long GI */
+	{810,  4}, /* MCS4 1SS long GI */
+	{540,  3}, /* MCS3 1SS long GI */
+	{405,  2}, /* MCS2 1SS long GI */
+	{270,  1}, /* MCS1 1SS long GI */
+	{135,  0}  /* MCS0 1SS long GI */
+};
+
+static void wma_bin_serach_rate(wma_search_rate_t *tbl, int32_t tbl_size,
+	tANI_S32 *mbpsx10_rate, tANI_U8 *ret_flag)
+{
+	int32_t upper, lower, mid;
+
+	/* the table is descenting. index holds the largest value and the
+	 * bottom index holds the smallest value */
+
+	upper = 0; /* index 0 */
+	lower = tbl_size -1; /* last index */
+
+	if (*mbpsx10_rate >= tbl[upper].rate) {
+		/* use the largest rate */
+		*mbpsx10_rate = tbl[upper].rate;
+		*ret_flag = tbl[upper].flag;
+		return;
+	} else if (*mbpsx10_rate <= tbl[lower].rate) {
+		/* use the smallest rate */
+		*mbpsx10_rate = tbl[lower].rate;
+		*ret_flag = tbl[lower].flag;
+		return;
+	}
+	/* now we do binery search to get the floor value */
+	while (lower - upper > 1) {
+		mid = (upper + lower) >> 1;
+		if (*mbpsx10_rate == tbl[mid].rate) {
+		/* found the exact match */
+			*mbpsx10_rate = tbl[lower].rate;
+			*ret_flag = tbl[lower].flag;
+			return;
+		} else {
+		/* not found. if mid's rate is larger than input move
+		 * upper to mid. If mid's rate is larger than input
+		 * move lower to mid. */
+			if (*mbpsx10_rate > tbl[mid].rate)
+				lower = mid;
+			else
+				upper = mid;
+		}
+	}
+	/* after the bin serach the lower index is the floow of rate */
+	*mbpsx10_rate = tbl[lower].rate;
+	*ret_flag = tbl[lower].flag;
+	return;
+}
+
+static VOS_STATUS wma_fill_ofdm_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, tANI_U8 *rate)
+{
+	int32_t ret = 0;
+	tANI_U8 idx = 0;
+
+	wma_bin_serach_rate(ofdm_rate_tbl, WMA_MAX_OFDM_RATE_TBL_SIZE,
+		&mbpsx10_rate, &idx);
+	*rate |= (idx & 0xF);
+	return ret;
+}
+
+static VOS_STATUS wma_fill_cck_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, tANI_U8 *rate)
+{
+	tANI_U8 idx = 0;
+
+	wma_bin_serach_rate(cck_rate_tbl, WMA_MAX_CCK_RATE_TBL_SIZE,
+		&mbpsx10_rate, &idx);
+	*rate |= (1 << 6) | (idx & 0xF); /* set bit 6 to 1 for CCK */
+	return 0;
+}
+
+static VOS_STATUS wma_fill_ofdm_cck_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, tANI_U8 *rate)
+{
+	tANI_U8 idx = 0;
+	tANI_S32 tmp_rate = mbpsx10_rate;
+	wma_bin_serach_rate(ofdm_cck_rate_tbl, WMA_MAX_OFDM_CCK_RATE_TBL_SIZE,
+		&tmp_rate, &idx);
+
+	/* if bit 7 is set it uses CCK */
+	if (idx & 0x80)
+		return wma_fill_ofdm_mcast_rate(mbpsx10_rate, nss, rate);
+	else
+		return wma_fill_cck_mcast_rate(mbpsx10_rate, nss, rate);
+}
+
+static void wma_set_ht_vht_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 sgi_idx, tANI_S32 sgi_rate,
+	tANI_U8 lgi_idx, tANI_S32 lgi_rate,
+	tANI_U8 premable, tANI_U8 *rate)
+{
+	/* here we choose the closest floor rate between sgi and lgi rates */
+	if (sgi_rate <= mbpsx10_rate && lgi_rate <= mbpsx10_rate) {
+		if (sgi_rate > lgi_rate) {
+			/* sgi is closer to the input rate */
+			*rate |= (premable << 6) | (sgi_idx & 0xF); /* set 2 in bit 6-7 for HT */
+		} else {
+			*rate |= (premable << 6) | (lgi_idx & 0xF);
+		}
+	} else if (sgi_rate > mbpsx10_rate && lgi_rate > mbpsx10_rate) {
+		/* both out of bound. Choose the smaller one */
+		if (sgi_rate > lgi_rate) {
+			*rate |= (premable << 6) | (lgi_idx & 0xF); /* set 2 in bit 6-7 for HT */
+		} else {
+			*rate |= (premable << 6) | (sgi_idx & 0xF); /* set 2 in bit 6-7 for HT */
+		}
+	} else if (sgi_rate > mbpsx10_rate) {
+		/* sgi out of bound but lgi is in bound */
+			*rate |= (premable << 6) | (lgi_idx & 0xF);
+	} else {
+		/* lgi is out of bound but sgi is in bound */
+		*rate |= (premable << 6) | (sgi_idx & 0xF);
+	}
+}
+
+static VOS_STATUS wma_fill_ht20_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, tANI_U8 *rate)
+{
+	tANI_U8 sgi_idx = 0, lgi_idx = 0;
+	tANI_S32 sgi_rate, lgi_rate;
+	if (nss == 1)
+		mbpsx10_rate= mbpsx10_rate >> 1;
+
+	sgi_rate = mbpsx10_rate;
+	lgi_rate = mbpsx10_rate;
+	wma_bin_serach_rate(ht20_400ns_rate_tbl, WMA_MAX_HT20_RATE_TBL_SIZE,
+		&sgi_rate, &sgi_idx);
+	wma_bin_serach_rate(ht20_800ns_rate_tbl, WMA_MAX_HT20_RATE_TBL_SIZE,
+		&lgi_rate, &lgi_idx);
+
+	wma_set_ht_vht_mcast_rate(mbpsx10_rate, sgi_idx, sgi_rate,
+		lgi_idx, lgi_rate, 2, rate);
+
+	return 0;
+}
+
+static VOS_STATUS wma_fill_ht40_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, tANI_U8 *rate)
+{
+	tANI_U8 sgi_idx = 0, lgi_idx = 0;
+	tANI_S32 sgi_rate, lgi_rate;
+
+	/* for 2x2 divide the rate by 2 */
+	if (nss == 1)
+		mbpsx10_rate= mbpsx10_rate >> 1;
+
+	sgi_rate = mbpsx10_rate;
+	lgi_rate = mbpsx10_rate;
+	wma_bin_serach_rate(ht40_400ns_rate_tbl, WMA_MAX_HT40_RATE_TBL_SIZE,
+		&sgi_rate, &sgi_idx);
+	wma_bin_serach_rate(ht40_800ns_rate_tbl, WMA_MAX_HT40_RATE_TBL_SIZE,
+		&lgi_rate, &lgi_idx);
+
+	wma_set_ht_vht_mcast_rate(mbpsx10_rate, sgi_idx, sgi_rate,
+		lgi_idx, lgi_rate, 2, rate);
+
+	return 0;
+}
+
+static VOS_STATUS wma_fill_vht20_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, tANI_U8 *rate)
+{
+	tANI_U8 sgi_idx = 0, lgi_idx = 0;
+	tANI_S32 sgi_rate, lgi_rate;
+
+	/* for 2x2 divide the rate by 2 */
+	if (nss == 1)
+		mbpsx10_rate= mbpsx10_rate >> 1;
+
+	sgi_rate = mbpsx10_rate;
+	lgi_rate = mbpsx10_rate;
+	wma_bin_serach_rate(vht20_400ns_rate_tbl, WMA_MAX_VHT20_RATE_TBL_SIZE,
+		&sgi_rate, &sgi_idx);
+	wma_bin_serach_rate(vht20_800ns_rate_tbl, WMA_MAX_VHT20_RATE_TBL_SIZE,
+		&lgi_rate, &lgi_idx);
+
+	wma_set_ht_vht_mcast_rate(mbpsx10_rate, sgi_idx, sgi_rate,
+		lgi_idx, lgi_rate, 3, rate);
+	return 0;
+}
+
+static VOS_STATUS wma_fill_vht40_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, tANI_U8 *rate)
+{
+	tANI_U8 sgi_idx = 0, lgi_idx = 0;
+	tANI_S32 sgi_rate, lgi_rate;
+
+	/* for 2x2 divide the rate by 2 */
+	if (nss == 1)
+		mbpsx10_rate= mbpsx10_rate >> 1;
+
+	sgi_rate = mbpsx10_rate;
+	lgi_rate = mbpsx10_rate;
+	wma_bin_serach_rate(vht40_400ns_rate_tbl, WMA_MAX_VHT40_RATE_TBL_SIZE,
+		&sgi_rate, &sgi_idx);
+	wma_bin_serach_rate(vht40_800ns_rate_tbl, WMA_MAX_VHT40_RATE_TBL_SIZE,
+		&lgi_rate, &lgi_idx);
+
+	wma_set_ht_vht_mcast_rate(mbpsx10_rate, sgi_idx, sgi_rate,
+		lgi_idx, lgi_rate, 3, rate);
+
+	return 0;
+}
+
+static VOS_STATUS wma_fill_vht80_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, tANI_U8 *rate)
+{
+	tANI_U8 sgi_idx = 0, lgi_idx = 0;
+	tANI_S32 sgi_rate, lgi_rate;
+
+	/* for 2x2 divide the rate by 2 */
+	if (nss == 1)
+		mbpsx10_rate= mbpsx10_rate >> 1;
+
+	sgi_rate = mbpsx10_rate;
+	lgi_rate = mbpsx10_rate;
+	wma_bin_serach_rate(vht80_400ns_rate_tbl, WMA_MAX_VHT80_RATE_TBL_SIZE,
+		&sgi_rate, &sgi_idx);
+	wma_bin_serach_rate(vht80_800ns_rate_tbl, WMA_MAX_VHT80_RATE_TBL_SIZE,
+		&lgi_rate, &lgi_idx);
+
+	wma_set_ht_vht_mcast_rate(mbpsx10_rate, sgi_idx, sgi_rate,
+		lgi_idx, lgi_rate, 3, rate);
+
+	return 0;
+}
+
+static VOS_STATUS wma_fill_ht_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, WLAN_PHY_MODE chanmode, tANI_U8 *rate)
+{
+	int32_t ret = 0;
+
+	switch(chanmode) {
+	case MODE_11NA_HT20:  /* 11a HT20 mode */
+	case MODE_11NG_HT20:  /* 11g HT20 mode */
+		ret = wma_fill_ht20_mcast_rate(mbpsx10_rate, nss, rate);
+		break;
+	case MODE_11NA_HT40:  /* 11a HT40 mode */
+	case MODE_11NG_HT40:  /* 11g HT40 mode */
+		ret = wma_fill_ht40_mcast_rate(mbpsx10_rate, nss, rate);
+		break;
+	default:
+		ret = VOS_STATUS_E_INVAL;
+		break;
+	}
+	return ret;
+}
+
+static VOS_STATUS wma_fill_vht_mcast_rate(tANI_S32 mbpsx10_rate,
+	tANI_U8 nss, WLAN_PHY_MODE chanmode, tANI_U8 *rate)
+{
+	int32_t ret = 0;
+
+	switch(chanmode) {
+	case MODE_11AC_VHT20:
+	case MODE_11AC_VHT20_2G:
+		ret = wma_fill_vht20_mcast_rate(mbpsx10_rate, nss, rate);
+		break;
+	case MODE_11AC_VHT40:
+	case MODE_11AC_VHT40_2G:
+		ret = wma_fill_vht40_mcast_rate(mbpsx10_rate, nss, rate);
+		break;
+	case MODE_11AC_VHT80:
+	case MODE_11AC_VHT80_2G:
+		ret = wma_fill_vht80_mcast_rate(mbpsx10_rate, nss, rate);
+		break;
+	default:
+		ret = VOS_STATUS_E_INVAL;
+		break;
+	}
+	return ret;
+}
+
+/*
+ * FUNCTION: wma_process_rate_update_indate
+ *
+ */
+VOS_STATUS wma_process_rate_update_indicate(tp_wma_handle wma,
+	tSirRateUpdateInd *pRateUpdateParams)
+{
+	int32_t ret = 0;
+	u_int8_t vdev_id = 0;
+	void *pdev;
+	tANI_S32 mbpsx10_rate = -1;
+	tANI_U32 paramId;
+	tANI_U8 rate = 0;
+	struct wma_txrx_node *intr = wma->interfaces;
+
+	/* Get the vdev id */
+	if (pRateUpdateParams->dev_mode == VOS_STA_SAP_MODE ||
+		pRateUpdateParams->dev_mode == VOS_P2P_GO_MODE)
+	{
+		pdev = wma_find_vdev_by_addr(wma, pRateUpdateParams->bssid, &vdev_id);
+	} else {
+		pdev = wma_find_vdev_by_bssid(wma, pRateUpdateParams->bssid, &vdev_id);
+	}
+	if (!pdev) {
+		WMA_LOGE("vdev handle is invalid for %pM", pRateUpdateParams->bssid);
+		vos_mem_free(pRateUpdateParams);
+		return VOS_STATUS_E_INVAL;
+	}
+	/* set NSS bits (bit 4 - bit 5) */
+	rate |= (pRateUpdateParams->nss & 0x3) << 4;
+
+	/* first check if reliable TX mcast rate is used. If not check the bcast.
+	 * Then is mcast. Mcast rate is saved in mcastDataRate24GHz */
+	if (pRateUpdateParams->reliableMcastDataRateTxFlag > 0) {
+		mbpsx10_rate = pRateUpdateParams->reliableMcastDataRate;
+		paramId = WMI_VDEV_PARAM_MCAST_DATA_RATE;
+	} else if (pRateUpdateParams->bcastDataRate > -1) {
+		mbpsx10_rate = pRateUpdateParams->bcastDataRate;
+		paramId = WMI_VDEV_PARAM_BCAST_DATA_RATE;
+	} else {
+		mbpsx10_rate = pRateUpdateParams->mcastDataRate24GHz;
+		paramId = WMI_VDEV_PARAM_MCAST_DATA_RATE;
+	}
+	WMA_LOGD("%s: bssid = '%pM', vdev_id = %d, bcast = %ld, "
+			"mcast = %ld, NSS = %d, chanmode = %d\n",
+			__func__, pRateUpdateParams->bssid, vdev_id,
+			pRateUpdateParams->bcastDataRate,
+			pRateUpdateParams->mcastDataRate24GHz,
+			pRateUpdateParams->nss, intr[vdev_id].chanmode);
+
+	/* the phymode selection is based on following assumption:
+	 * mbpsx10_rate <= 540: always use BG
+	 * 1x1: 540 < mbpsx10_rate <= 1500: choose HT
+	 * 2x2: 540 < mbpsx10_rate <= 3000: use HT
+	 * rest: use VHT */
+	if ((!intr[vdev_id].ht_capable && !intr[vdev_id].vht_capable) ||
+		mbpsx10_rate <= 540) {
+		switch(intr[vdev_id].chanmode) {
+		case MODE_11G:   /* 11b/g Mode */
+			ret = wma_fill_ofdm_cck_mcast_rate(mbpsx10_rate,
+					pRateUpdateParams->nss, &rate);
+			break;
+		case MODE_11B:   /* 11b Mode */
+			ret = wma_fill_cck_mcast_rate(mbpsx10_rate,
+					pRateUpdateParams->nss, &rate);
+			break;
+		default:
+			ret = wma_fill_ofdm_mcast_rate(mbpsx10_rate,
+					pRateUpdateParams->nss, &rate);
+			break;
+		}
+	} else {
+		switch (intr[vdev_id].chanmode) {
+		case MODE_11NA_HT20:  /* 11a HT20 mode */
+		case MODE_11NG_HT20:  /* 11g HT20 mode */
+		case MODE_11NA_HT40:  /* 11a HT40 mode */
+		case MODE_11NG_HT40:  /* 11g HT40 mode */
+			ret = wma_fill_ht_mcast_rate(mbpsx10_rate,
+					pRateUpdateParams->nss, intr[vdev_id].chanmode, &rate);
+			break;
+		case MODE_11AC_VHT20:
+		case MODE_11AC_VHT40:
+		case MODE_11AC_VHT80:
+		case MODE_11AC_VHT20_2G:
+		case MODE_11AC_VHT40_2G:
+		case MODE_11AC_VHT80_2G:
+			if ((pRateUpdateParams->nss == 0 && mbpsx10_rate <= 150) ||
+				(pRateUpdateParams->nss == 1 && mbpsx10_rate <= 300)) {
+				ret = wma_fill_ht_mcast_rate(mbpsx10_rate,
+					pRateUpdateParams->nss, intr[vdev_id].chanmode, &rate);
+			} else {
+				ret = wma_fill_vht_mcast_rate(mbpsx10_rate,
+					pRateUpdateParams->nss, intr[vdev_id].chanmode, &rate);
+			}
+			break;
+		default:
+			ret = VOS_STATUS_E_INVAL;
+			break;
+		}
+	 }
+
+	if (ret) {
+		WMA_LOGE("%s: Error, Invalid input rate value", __func__);
+		vos_mem_free(pRateUpdateParams);
+		return ret;
+	}
+	ret = wmi_unified_vdev_set_param_send(wma->wmi_handle,
+			vdev_id, paramId, rate);
+
+	WMA_LOGD("%s:X, ret = %d, vdev_id = %d, chanmode = 0x%x, "
+		"in_rate = %ld, out_rate = 0x%x, NSS = %d\n",
+		__func__, ret, vdev_id, intr[vdev_id].chanmode,
+		mbpsx10_rate, rate, pRateUpdateParams->nss);
+
+	vos_mem_free(pRateUpdateParams);
+	if (ret) {
+		WMA_LOGE("%s: Failed to Set rate, ret = %d", __func__, ret);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	return VOS_STATUS_SUCCESS;
+}
+
 /* function   : wma_mc_process_msg
  * Descriptin :
  * Args       :
@@ -7887,7 +8646,7 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 			wma_set_keepalive_req(wma_handle,
 					(tSirKeepAliveReq *)msg->bodyptr);
 			break;
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 		case WDA_SET_PNO_REQ:
 			wma_config_pno(wma_handle,
 				       (tpSirPNOScanReq)msg->bodyptr);
@@ -7964,6 +8723,10 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 			wma_resume_req(wma_handle,
 				       (tpSirWlanResumeParam)msg->bodyptr);
 			break;
+		case WDA_8023_MULTICAST_LIST_REQ:
+			wma_process_mcbc_set_filter_req(wma_handle,
+				       (tpSirRcvFltMcAddrList)msg->bodyptr);
+			break;
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 		case WDA_GTK_OFFLOAD_REQ:
 			wma_process_gtk_offload_req(
@@ -7999,6 +8762,9 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 				(tSirRoamOffloadScanReq *)msg->bodyptr);
 		    break;
 
+		case WDA_RATE_UPDATE_IND:
+			wma_process_rate_update_indicate(wma_handle, (tSirRateUpdateInd *)msg->bodyptr);
+			break;
 		default:
 			WMA_LOGD("unknow msg type %x", msg->type);
 			/* Do Nothing? MSG Body should be freed at here */
@@ -8284,7 +9050,7 @@ static int wma_roam_event_callback(WMA_HANDLE handle, u_int8_t *event_buf,
 	return 0;
 }
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 
 /* Record NLO match event comes from FW. It's a indication that
  * one of the profile is matched.
@@ -8319,11 +9085,19 @@ static int wma_nlo_scan_cmp_evt_handler(void *handle, u_int8_t *event,
 					u_int32_t len)
 {
 	tp_wma_handle wma = (tp_wma_handle) handle;
-	wmi_nlo_event *nlo_event = (wmi_nlo_event *) event;
+	wmi_nlo_event *nlo_event;
+	WMI_NLO_SCAN_COMPLETE_EVENTID_param_tlvs *param_buf =
+			(WMI_NLO_SCAN_COMPLETE_EVENTID_param_tlvs *) event;
 	tSirScanOffloadEvent *scan_event;
 	struct wma_txrx_node *node;
 	VOS_STATUS status;
 
+	if (!param_buf) {
+		WMA_LOGE("Invalid NLO scan comp event buffer");
+		return -EINVAL;
+	}
+
+	nlo_event = param_buf->fixed_param;
 	WMA_LOGD("PNO scan completion event received for vdev %d",
 		 nlo_event->vdev_id);
 
@@ -8423,7 +9197,7 @@ VOS_STATUS wma_start(v_VOID_t *vos_ctx)
 		goto end;
 	}
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
 				   WMI_SERVICE_NLO)) {
 
@@ -8515,6 +9289,14 @@ VOS_STATUS wma_stop(v_VOID_t *vos_ctx, tANI_U8 reason)
 	}
 #endif
 
+#ifdef WLAN_OPEN_SOURCE
+	if (wma_handle->ack_work_ctx) {
+		cancel_work_sync(&wma_handle->ack_work_ctx->ack_cmp_work);
+		adf_os_mem_free(wma_handle->ack_work_ctx);
+		wma_handle->ack_work_ctx = NULL;
+	}
+#endif
+
 	vos_status = wma_tx_detach(wma_handle);
 	if(vos_status != VOS_STATUS_SUCCESS) {
 		WMA_LOGP("Failed to deregister tx management");
@@ -8728,7 +9510,7 @@ static inline void wma_update_target_services(tp_wma_handle wh,
 	/* ARP offload */
 	cfg->arp_offload = WMI_SERVICE_IS_ENABLED(wh->wmi_service_bitmap,
 						  WMI_SERVICE_ARPNS_OFFLOAD);
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 	/* PNO offload */
 	if (WMI_SERVICE_IS_ENABLED(wh->wmi_service_bitmap, WMI_SERVICE_NLO))
 		cfg->pno_offload = TRUE;
@@ -9067,6 +9849,19 @@ v_VOID_t wma_rx_service_ready_event(WMA_HANDLE handle, void *cmd_param_info)
 		return;
 	}
 #endif
+
+	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
+				WMI_SERVICE_CSA_OFFLOAD)) {
+		WMA_LOGD("%s: FW support CSA offload capability", __func__);
+		status = wmi_unified_register_event_handler(wma_handle->wmi_handle,
+				WMI_CSA_HANDLING_EVENTID,
+				wma_csa_offload_handler);
+		if (status) {
+			WMA_LOGE("Failed to register CSA offload event cb");
+			return;
+		}
+	}
+
 #ifdef WLAN_FEATURE_GTK_OFFLOAD
 	if (WMI_SERVICE_IS_ENABLED(wma_handle->wmi_service_bitmap,
 				   WMI_SERVICE_GTK_OFFLOAD)) {
diff --git a/CORE/SERVICES/WMA/wma.h b/CORE/SERVICES/WMA/wma.h
index b2d9befdacd8..25685c5003ee 100644
--- a/CORE/SERVICES/WMA/wma.h
+++ b/CORE/SERVICES/WMA/wma.h
@@ -271,17 +271,20 @@ struct wma_txrx_node {
 	struct scan_param scan_info;
 	u_int32_t type;
 	u_int32_t sub_type;
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 	v_BOOL_t nlo_match_evt_received;
 	v_BOOL_t pno_in_progress;
 #endif
 	v_BOOL_t ptrn_match_enable;
 	v_BOOL_t conn_state;
 	/* BSS parameters cached for use in WDA_ADD_STA */
-    tSirMacBeaconInterval   beaconInterval;
-    tANI_U8                 llbCoexist;
-    tANI_U8                 shortSlotTimeSupported;
-    tANI_U8                 dtimPeriod;
+	tSirMacBeaconInterval   beaconInterval;
+	tANI_U8                 llbCoexist;
+	tANI_U8                 shortSlotTimeSupported;
+	tANI_U8                 dtimPeriod;
+	WLAN_PHY_MODE           chanmode;
+	tANI_U8                 vht_capable;
+	tANI_U8                 ht_capable;
 };
 
 #if defined(QCA_WIFI_FTM) && !defined(QCA_WIFI_ISOC)
@@ -384,6 +387,7 @@ typedef struct {
 	 * with ns info suppose if ns also enabled
 	 */
 	tSirHostOffloadReq mArpInfo;
+	struct wma_tx_ack_work_ctx *ack_work_ctx;
 }t_wma_handle, *tp_wma_handle;
 
 struct wma_target_cap {
@@ -953,6 +957,7 @@ struct wma_vdev_start_req {
 	u_int8_t hidden_ssid;
 	u_int8_t pmf_enabled;
 	u_int8_t vht_capable;
+	u_int8_t ht_capable;
 };
 
 struct wma_set_key_params {
@@ -1006,8 +1011,14 @@ typedef struct wma_trigger_uapsd_params
 VOS_STATUS wma_trigger_uapsd_params(tp_wma_handle wma_handle, u_int32_t vdev_id,
 			tp_wma_trigger_uapsd_params trigger_uapsd_params);
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
-#define WMA_NLO_FREQ_THRESH	1000  /* in MHz */
+#ifdef FEATURE_WLAN_SCAN_PNO
+
+#define WMA_NLO_FREQ_THRESH          1000         /* in MHz */
+#define WMA_SEC_TO_MSEC(sec)         (sec * 1000) /* sec to msec */
+
+/* Default rssi threshold defined in CFG80211 */
+#define WMA_RSSI_THOLD_DEFAULT   -300
+
 #endif
 
 /* U-APSD maximum service period of peer station */
diff --git a/CORE/SERVICES/WMI/wmi_unified.c b/CORE/SERVICES/WMI/wmi_unified.c
index 315d700dc477..35d8645cf534 100644
--- a/CORE/SERVICES/WMI/wmi_unified.c
+++ b/CORE/SERVICES/WMI/wmi_unified.c
@@ -350,7 +350,9 @@ wmi_unified_detach(struct wmi_unified* wmi_handle)
 {
 #ifndef QCA_WIFI_ISOC
     wmi_buf_t buf;
-
+#ifdef WLAN_OPEN_SOURCE
+    cancel_work_sync(&wmi_handle->rx_event_work);
+#endif
     adf_os_spin_lock_bh(&wmi_handle->eventq_lock);
     buf = adf_nbuf_queue_remove(&wmi_handle->event_queue);
     while (buf) {
diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index a3f5861f4e7e..1c74303aa694 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -914,7 +914,7 @@ typedef struct tagCsrRoamSession
     tANI_BOOLEAN fIgnorePMKIDCache;
     //ht config
     tSirHTConfig        htConfig;
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
     eCsrRoamState lastRoamStateBeforePno;
 #endif
 } tCsrRoamSession;
@@ -1316,9 +1316,8 @@ tANI_BOOLEAN csrIsSetKeyAllowed(tpAniSirGlobal pMac, tANI_U32 sessionId);
 void csrSetOppositeBandChannelInfo( tpAniSirGlobal pMac );
 void csrConstructCurrentValidChannelList( tpAniSirGlobal pMac, tDblLinkList *pChannelSetList,
                                             tANI_U8 *pChannelList, tANI_U8 bSize, tANI_U8 *pNumChannels );
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 void csrMoveToScanStateForPno( tpAniSirGlobal pMac, tANI_U8 sessionId );
-#endif
 eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
             tSirPrefNetworkFoundInd *pPrefNetworkFoundInd);
 #endif
@@ -1351,4 +1350,4 @@ eHalStatus csrScanRequestLfrResult(tpAniSirGlobal pMac, tANI_U32 sessionId,
 #endif
 tANI_BOOLEAN csrRoamIsStaMode(tpAniSirGlobal pMac, tANI_U32 sessionId);
 #endif
-
+#endif
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index bfc7a63bbeeb..cee18a1df35f 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -123,6 +123,7 @@ typedef struct _smeConfigParams
 #endif
     tANI_BOOLEAN  fScanOffload;
     tANI_BOOLEAN  fP2pListenOffload;
+    tANI_BOOLEAN  pnoOffload;
 } tSmeConfigParams, *tpSmeConfigParams;
 
 #ifdef QCA_WIFI_2_0
@@ -2851,11 +2852,20 @@ int sme_UpdateHTConfig(tHalHandle hHal, tANI_U8 sessionId, tANI_U16 htCapab,
 tANI_S16 sme_GetHTConfig(tHalHandle hHal, tANI_U8 session_id, tANI_U16 ht_capab);
 eHalStatus sme_getValidChannelList(tHalHandle hHal, tANI_U8 *numChannels,
                                    tANI_U8 **chanList);
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 eHalStatus sme_MoveCsrToScanStateForPno (tHalHandle hHal, tANI_U8 sessionId);
 #endif
 #ifdef QCA_WIFI_2_0
 eHalStatus sme_getChannelInfo(tHalHandle hHal, tANI_U8 chanId,
                               tSmeChannelInfo *chanInfo);
 #endif
+/* ---------------------------------------------------------------------------
+    \fn sme_SendRateUpdateInd
+    \brief  API to Update rate
+    \param  hHal - The handle returned by macOpen
+    \param  rateUpdateParams - Pointer to rate update params
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateParams);
+eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId, tANI_U8 *pBSSId );
 #endif //#if !defined( __SME_API_H )
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index 9e48627e8061..becbba0a5cd5 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -11339,6 +11339,39 @@ eHalStatus csrRoamSetPMKIDCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
     return (status);
 }
 
+eHalStatus csrRoamDelPMKIDfromCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
+                                 tANI_U8 *pBSSId )
+{
+    eHalStatus status = eHAL_STATUS_FAILURE;
+    tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
+    tANI_BOOLEAN fMatchFound = FALSE;
+    tANI_U32 Index;
+    if(!pSession)
+    {
+        smsLog(pMac, LOGE, FL("  session %d not found "), sessionId);
+        return eHAL_STATUS_FAILURE;
+    }
+    do
+    {
+        for( Index=0; Index < pSession->NumPmkidCache; Index++ )
+        {
+            smsLog(pMac, LOGW, "Delete PMKID for %02X-%02X-%02X-%02X-%02X-%02X ",
+                pBSSId[0], pBSSId[1], pBSSId[2], pBSSId[3], pBSSId[4], pBSSId[5]);
+            if( palEqualMemory( pMac->hHdd, pBSSId, pSession->PmkidCacheInfo[Index].BSSID, sizeof(tCsrBssid) ) )
+            {
+                fMatchFound = TRUE;
+                break;
+            }
+        }
+        if( !fMatchFound ) break;
+        palZeroMemory( pMac->hHdd, pSession->PmkidCacheInfo[Index].BSSID, sizeof(tPmkidCacheInfo));
+        status = eHAL_STATUS_SUCCESS;
+    }
+    while( 0 );
+    smsLog(pMac, LOGW, "csrDelPMKID called return match = %d Status = %d",
+        fMatchFound, status);
+    return status;
+}
 tANI_U32 csrRoamGetNumPMKIDCache(tpAniSirGlobal pMac, tANI_U32 sessionId)
 {
     return (pMac->roam.roamSession[sessionId].NumPmkidCache);
diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index caf345215e81..479c1e810b0a 100644
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -4718,11 +4718,10 @@ tANI_BOOLEAN csrScanIsWildCardScan( tpAniSirGlobal pMac, tSmeCmd *pCommand )
         (pCommand->u.scanCmd.u.scanRequest.SSIDs.numOfSSIDs != 1) ));
 }
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 eHalStatus csrSavePnoScanResults(tpAniSirGlobal pMac, tSirSmeScanRsp *pScanRsp)
 {
     tSirBssDescription *pSirBssDescription;
-    tDot11fBeaconIEs *pIesLocal = NULL;
     tANI_U32 cbScanResult = GET_FIELD_OFFSET( tSirSmeScanRsp, bssDescription )
                             + sizeof(tSirBssDescription);  //We need at least one CB
     tCsrScanResult *pScanResult = NULL;
@@ -4730,7 +4729,7 @@ eHalStatus csrSavePnoScanResults(tpAniSirGlobal pMac, tSirSmeScanRsp *pScanRsp)
     v_TIME_t timer;
     tANI_U32 cbParsed;
     tANI_U32 cbBssDesc;
-    tANI_U8 ieLen;
+    tANI_U16 ieLen;
 
     if ((cbScanResult > pScanRsp->length ) ||
         (( eSIR_SME_SUCCESS != pScanRsp->statusCode ) &&
@@ -4760,10 +4759,9 @@ eHalStatus csrSavePnoScanResults(tpAniSirGlobal pMac, tSirSmeScanRsp *pScanRsp)
         }
 
         palZeroMemory( pMac->hHdd, pScanResult, sizeof(tCsrScanResult) + ieLen);
-        pIesLocal = (tDot11fBeaconIEs *)( pScanResult->Result.pvIes );
 
         if (!HAL_STATUS_SUCCESS(csrGetParsedBssDescriptionIEs(pMac,
-            pSirBssDescription, &pIesLocal)))
+            pSirBssDescription, (tDot11fBeaconIEs **)&pScanResult->Result.pvIes)))
         {
             smsLog(pMac, LOGE, FL("  Cannot parse IEs"));
             csrFreeScanResultEntry(pMac, pScanResult);
@@ -4778,9 +4776,12 @@ eHalStatus csrSavePnoScanResults(tpAniSirGlobal pMac, tSirSmeScanRsp *pScanRsp)
 
         // Remove duplicate entry
         csrRemoveDupBssDescription( pMac, &pScanResult->Result.BssDescriptor,
-                                    pIesLocal, &tmpSsid , &timer );
+                         (tDot11fBeaconIEs *)pScanResult->Result.pvIes,
+                         &tmpSsid , &timer );
+
         //Add to scan cache
-        csrScanAddResult(pMac, pScanResult, pIesLocal);
+        csrScanAddResult(pMac, pScanResult,
+                         (tDot11fBeaconIEs *)pScanResult->Result.pvIes);
 
         // skip over the BSS description to the next one...
         cbParsed += cbBssDesc;
@@ -4891,14 +4892,14 @@ eHalStatus csrScanSmeScanResponse( tpAniSirGlobal pMac, void *pMsgBuf )
             status = eHAL_STATUS_FAILURE;
         }
     }
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
-    else if (!HAL_STATUS_SUCCESS(csrSavePnoScanResults(pMac, pScanRsp)))
+#ifdef FEATURE_WLAN_SCAN_PNO
+    else if (pMac->pnoOffload && !HAL_STATUS_SUCCESS(csrSavePnoScanResults(pMac, pScanRsp)))
     {
         smsLog( pMac, LOGW, "CSR: Unable to store scan results for PNO" );
         status = eHAL_STATUS_FAILURE;
     }
 #endif
-    else
+    else if (pMac->pnoOffload == FALSE)
     {
         smsLog( pMac, LOGW, "CSR: Scan Completion called but NO commands are ACTIVE ..." );
         status = eHAL_STATUS_FAILURE;
@@ -7639,7 +7640,7 @@ tANI_BOOLEAN csrRoamIsValidChannel( tpAniSirGlobal pMac, tANI_U8 channel )
     return fValid;
 }
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 void csrMoveToScanStateForPno( tpAniSirGlobal pMac, tANI_U8 sessionId )
 {
     tCsrRoamSession *pSession = &pMac->roam.roamSession[sessionId];
@@ -7652,7 +7653,6 @@ void csrMoveToScanStateForPno( tpAniSirGlobal pMac, tANI_U8 sessionId )
     pSession->lastRoamStateBeforePno =
                csrRoamStateChange(pMac, eCSR_ROAMING_STATE_SCANNING, sessionId);
 }
-#endif
 
 eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
             tSirPrefNetworkFoundInd *pPrefNetworkFoundInd)
@@ -7823,6 +7823,7 @@ eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
 
    return eHAL_STATUS_SUCCESS;
 }
+#endif
 
 #ifdef FEATURE_WLAN_LFR
 void csrInitOccupiedChannelsList(tpAniSirGlobal pMac)
diff --git a/CORE/SME/src/csr/csrCmdProcess.c b/CORE/SME/src/csr/csrCmdProcess.c
index 41d5f26fc06e..100aca73748b 100644
--- a/CORE/SME/src/csr/csrCmdProcess.c
+++ b/CORE/SME/src/csr/csrCmdProcess.c
@@ -171,5 +171,3 @@ void csrFullPowerOffloadCallback(void *pv, tANI_U32 sessionId, eHalStatus status
     }
 
 }
-
-
diff --git a/CORE/SME/src/csr/csrInsideApi.h b/CORE/SME/src/csr/csrInsideApi.h
index 04fe57547ea6..bdfc9cfac5ca 100644
--- a/CORE/SME/src/csr/csrInsideApi.h
+++ b/CORE/SME/src/csr/csrInsideApi.h
@@ -965,5 +965,7 @@ tANI_BOOLEAN csrNeighborRoamConnectedProfileMatch(tpAniSirGlobal pMac, tCsrScanR
 eHalStatus csrSetTxPower(tpAniSirGlobal pMac, v_U8_t sessionId, v_U8_t mW);
 
 eHalStatus csrUpdateChannelList(tCsrScanStruct *pScan);
+eHalStatus csrRoamDelPMKIDfromCache( tpAniSirGlobal pMac, tANI_U32 sessionId,
+                                 tANI_U8 *pBSSId );
 #endif
 
diff --git a/CORE/SME/src/pmc/pmcApi.c b/CORE/SME/src/pmc/pmcApi.c
index 17200e479647..140fbe5b8a26 100644
--- a/CORE/SME/src/pmc/pmcApi.c
+++ b/CORE/SME/src/pmc/pmcApi.c
@@ -2996,10 +2996,11 @@ eHalStatus pmcSetPreferredNetworkList
                                &pRequestBuf->us5GProbeTemplateLen,
                                pSession);
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
-    sme_MoveCsrToScanStateForPno(hHal, sessionId);
-    pRequestBuf->sessionId = sessionId;
-#endif
+    if (pMac->pnoOffload)
+    {
+       sme_MoveCsrToScanStateForPno(hHal, sessionId);
+       pRequestBuf->sessionId = sessionId;
+    }
 
     msg.type     = WDA_SET_PNO_REQ;
     msg.reserved = 0;
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index bc56d903033f..76a3958d29c6 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -1474,6 +1474,9 @@ eHalStatus sme_UpdateConfig(tHalHandle hHal, tpSmeConfigParams pSmeConfigParams)
    /* update the p2p listen offload setting */
    pMac->fP2pListenOffload = pSmeConfigParams->fP2pListenOffload;
 
+   /* update p2p offload status */
+   pMac->pnoOffload = pSmeConfigParams->pnoOffload;
+
    return status;
 }
 
@@ -3269,6 +3272,25 @@ eHalStatus sme_RoamSetPMKIDCache( tHalHandle hHal, tANI_U8 sessionId, tPmkidCach
    return (status);
 }
 
+eHalStatus sme_RoamDelPMKIDfromCache( tHalHandle hHal, tANI_U8 sessionId, tANI_U8 *pBSSId )
+{
+   eHalStatus status = eHAL_STATUS_FAILURE;
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
+   status = sme_AcquireGlobalLock( &pMac->sme );
+   if ( HAL_STATUS_SUCCESS( status ) )
+   {
+      if( CSR_IS_SESSION_VALID( pMac, sessionId ) )
+      {
+         status = csrRoamDelPMKIDfromCache( pMac, sessionId, pBSSId );
+      }
+      else
+      {
+          status = eHAL_STATUS_INVALID_PARAMETER;
+      }
+      sme_ReleaseGlobalLock( &pMac->sme );
+   }
+   return (status);
+}
 /* ---------------------------------------------------------------------------
     \fn sme_RoamGetSecurityReqIE
     \brief a wrapper function to request CSR to return the WPA or RSN or WAPI IE CSR
@@ -6410,69 +6432,66 @@ eHalStatus sme_PreferredNetworkFoundInd (tHalHandle hHal, void* pMsg)
    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
    eHalStatus status = eHAL_STATUS_SUCCESS;
    tSirPrefNetworkFoundInd *pPrefNetworkFoundInd = (tSirPrefNetworkFoundInd *)pMsg;
-#ifndef FEATURE_WLAN_PNO_OFFLOAD
    v_U8_t dumpSsId[SIR_MAC_MAX_SSID_LENGTH + 1];
    tANI_U8 ssIdLength = 0;
-#endif
 
    if (NULL == pMsg)
    {
       smsLog(pMac, LOGE, "in %s msg ptr is NULL", __func__);
-      status = eHAL_STATUS_FAILURE;
+      return eHAL_STATUS_FAILURE;
    }
-   else
+
+   if (pMac->pnoOffload)
    {
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
       /* Call Preferred Network Found Indication callback routine. */
       if (pMac->pmc.prefNetwFoundCB != NULL)
       {
          pMac->pmc.prefNetwFoundCB(
-             pMac->pmc.preferredNetworkFoundIndCallbackContext,
-             pPrefNetworkFoundInd);
-      }
-#else
-      if (pPrefNetworkFoundInd->ssId.length > 0)
-      {
-         ssIdLength = CSR_MIN(SIR_MAC_MAX_SSID_LENGTH,
-                              pPrefNetworkFoundInd->ssId.length);
-         vos_mem_copy(dumpSsId, pPrefNetworkFoundInd->ssId.ssId, ssIdLength);
-         dumpSsId[ssIdLength] = 0;
-         smsLog(pMac, LOG2, "%s:SSID=%s frame length %d",
-             __func__, dumpSsId, pPrefNetworkFoundInd->frameLength);
-
-         //Save the frame to scan result
-         if (pPrefNetworkFoundInd->mesgLen > sizeof(tSirPrefNetworkFoundInd))
-         {
-            //we may have a frame
-            status = csrScanSavePreferredNetworkFound(pMac,
-                        pPrefNetworkFoundInd);
-            if (!HAL_STATUS_SUCCESS(status))
-            {
-               smsLog(pMac, LOGE, FL(" fail to save preferred network"));
-            }
-         }
-         else
-         {
-            smsLog(pMac, LOGE, FL(" not enough data length %d needed %d"),
-               pPrefNetworkFoundInd->mesgLen, sizeof(tSirPrefNetworkFoundInd));
-         }
-
-         /* Call Preferred Netowrk Found Indication callback routine. */
-         if (HAL_STATUS_SUCCESS(status) && (pMac->pmc.prefNetwFoundCB != NULL))
-         {
-            pMac->pmc.prefNetwFoundCB(
-                pMac->pmc.preferredNetworkFoundIndCallbackContext,
-                pPrefNetworkFoundInd);
-         }
+              pMac->pmc.preferredNetworkFoundIndCallbackContext,
+              pPrefNetworkFoundInd);
       }
-      else
-      {
-         smsLog(pMac, LOGE, "%s: callback failed - SSID is NULL", __func__);
-         status = eHAL_STATUS_FAILURE;
-      }
-#endif
+      return status;
    }
 
+   if (pPrefNetworkFoundInd->ssId.length > 0)
+   {
+       ssIdLength = CSR_MIN(SIR_MAC_MAX_SSID_LENGTH,
+                          pPrefNetworkFoundInd->ssId.length);
+       vos_mem_copy(dumpSsId, pPrefNetworkFoundInd->ssId.ssId, ssIdLength);
+       dumpSsId[ssIdLength] = 0;
+       smsLog(pMac, LOG2, "%s:SSID=%s frame length %d",
+           __func__, dumpSsId, pPrefNetworkFoundInd->frameLength);
+
+       //Save the frame to scan result
+       if (pPrefNetworkFoundInd->mesgLen > sizeof(tSirPrefNetworkFoundInd))
+       {
+          //we may have a frame
+          status = csrScanSavePreferredNetworkFound(pMac,
+                      pPrefNetworkFoundInd);
+          if (!HAL_STATUS_SUCCESS(status))
+          {
+             smsLog(pMac, LOGE, FL(" fail to save preferred network"));
+          }
+       }
+       else
+       {
+          smsLog(pMac, LOGE, FL(" not enough data length %d needed %d"),
+             pPrefNetworkFoundInd->mesgLen, sizeof(tSirPrefNetworkFoundInd));
+       }
+
+       /* Call Preferred Netowrk Found Indication callback routine. */
+       if (HAL_STATUS_SUCCESS(status) && (pMac->pmc.prefNetwFoundCB != NULL))
+       {
+          pMac->pmc.prefNetwFoundCB(
+              pMac->pmc.preferredNetworkFoundIndCallbackContext,
+              pPrefNetworkFoundInd);
+       }
+    }
+    else
+    {
+       smsLog(pMac, LOGE, "%s: callback failed - SSID is NULL", __func__);
+       status = eHAL_STATUS_FAILURE;
+    }
 
    return(status);
 }
@@ -8914,7 +8933,7 @@ int sme_UpdateHTConfig(tHalHandle hHal, tANI_U8 sessionId, tANI_U16 htCapab,
    return 0;
 }
 
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 /*--------------------------------------------------------------------------
 
   \brief sme_MoveCsrToScanStateForPno() - Request CSR module to be in Scan state
@@ -9013,3 +9032,38 @@ eHalStatus sme_getChannelInfo(tHalHandle hHal, tANI_U8 chanId,
     return status;
 }
 #endif /* QCA_WIFI_2_0 */
+
+/* ---------------------------------------------------------------------------
+    \fn sme_SendRateUpdateInd
+    \brief  API to Update rate
+    \param  hHal - The handle returned by macOpen
+    \param  rateUpdateParams - Pointer to rate update params
+    \return eHalStatus
+  ---------------------------------------------------------------------------*/
+eHalStatus sme_SendRateUpdateInd(tHalHandle hHal, tSirRateUpdateInd *rateUpdateParams)
+{
+    tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+    eHalStatus status;
+    vos_msg_t msg;
+
+    if (eHAL_STATUS_SUCCESS == (status = sme_AcquireGlobalLock(&pMac->sme)))
+    {
+        msg.type     = WDA_RATE_UPDATE_IND;
+        msg.bodyptr  = rateUpdateParams;
+
+        if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
+        {
+            VOS_TRACE( VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,"%s: Not able "
+                       "to post WDA_SET_RMC_RATE_IND to WDA!",
+                       __func__);
+
+            sme_ReleaseGlobalLock(&pMac->sme);
+            return eHAL_STATUS_FAILURE;
+        }
+
+        sme_ReleaseGlobalLock(&pMac->sme);
+        return eHAL_STATUS_SUCCESS;
+    }
+
+    return status;
+}
diff --git a/CORE/WDA/inc/legacy/halMsgApi.h b/CORE/WDA/inc/legacy/halMsgApi.h
index ec8dda3c3b04..c8708a4a62bb 100644
--- a/CORE/WDA/inc/legacy/halMsgApi.h
+++ b/CORE/WDA/inc/legacy/halMsgApi.h
@@ -278,6 +278,9 @@ typedef struct
     /*if this is a P2P Capable Sta*/
     tANI_U8     p2pCapableSta;
 
+    /*CSA offload enable flag */
+    tANI_U8     csaOffloadEnable;
+
 #ifdef WLAN_FEATURE_11AC
     tANI_U8    vhtCapable;
     tANI_U8    vhtTxChannelWidthSet;
@@ -959,6 +962,12 @@ typedef struct
 
 }tSwitchChannelParams, *tpSwitchChannelParams;
 
+typedef struct CSAOffloadParams {
+   u_int8_t sessionId;
+   u_int8_t channel;
+   u_int8_t switchmode;
+}*tpCSAOffloadParams, tCSAOffloadParams;
+
 typedef void (*tpSetLinkStateCallback)(tpAniSirGlobal pMac, void *msgParam );
 
 typedef struct sLinkStateParams
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index 71c0314b1345..9e33c81333d5 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -1153,6 +1153,7 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 /* FTM CMD MSG */
 #define WDA_FTM_CMD_REQ        SIR_PTT_MSG_TYPES_BEGIN
 #define WDA_FTM_CMD_RSP        SIR_PTT_MSG_TYPES_END
+#define WDA_CSA_OFFLOAD_EVENT  SIR_CSA_OFFLOAD_EVENT
 
 #ifdef FEATURE_WLAN_SCAN_PNO
 /*Requests sent to lower driver*/
@@ -1207,7 +1208,7 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #ifdef QCA_WIFI_2_0
 #define WDA_CLI_SET_CMD             SIR_HAL_CLI_SET_CMD
 #define WDA_CLI_GET_CMD             SIR_HAL_CLI_GET_CMD
-#ifdef FEATURE_WLAN_PNO_OFFLOAD
+#ifdef FEATURE_WLAN_SCAN_PNO
 #define WDA_SME_SCAN_CACHE_UPDATED  SIR_HAL_SME_SCAN_CACHE_UPDATED
 #endif
 #endif
@@ -1216,6 +1217,8 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_PKTLOG_ENABLE_REQ       SIR_HAL_PKTLOG_ENABLE_REQ
 #endif
 
+#define WDA_RATE_UPDATE_IND         SIR_HAL_RATE_UPDATE_IND
+
 tSirRetStatus wdaPostCtrlMsg(tpAniSirGlobal pMac, tSirMsgQ *pMsg);
 
 #define HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME 0x40 // Bit 6 will be used to control BD rate for Management frames
@@ -1264,7 +1267,7 @@ tSirRetStatus wdaPostCtrlMsg(tpAniSirGlobal pMac, tSirMsgQ *pMsg);
 eHalStatus WDA_SetRegDomain(void * clientCtxt, v_REGDOMAIN_t regId);
 static int WDA_SetHTConfig(tANI_U8 sessionId, tANI_U16 htCapab, int value)
 {
-	return 0;
+   return 0;
 }
 
 static inline eHalStatus WDA_SetCountryCode(v_VOID_t *client_ctx, tANI_U8 *countrycode)
diff --git a/firmware_bin/WCNSS_qcom_cfg.ini b/firmware_bin/WCNSS_qcom_cfg.ini
index 4ecc293a46ff..23ccb7831ef2 100644
--- a/firmware_bin/WCNSS_qcom_cfg.ini
+++ b/firmware_bin/WCNSS_qcom_cfg.ini
@@ -432,6 +432,12 @@ gVhtAmpduLenExponent=4
 # Maximum MPDU length (VHT only. Valid values: 0->3895 octets, 1->7991 octets, 2->11454 octets)
 gVhtMpduLen=2
 
+# 802.11K support
+gRrmEnable=1
+gRrmOperChanMax=8
+gRrmNonOperChanMax=8
+gRrmRandIntvl=100
+
 END
 
 # Note: Configuration parser would not read anything past the END marker
diff --git a/tools/athdiag/Android.mk b/tools/athdiag/Android.mk
index a1744e0ad868..9cda732d17d1 100644
--- a/tools/athdiag/Android.mk
+++ b/tools/athdiag/Android.mk
@@ -5,5 +5,4 @@ LOCAL_MODULE_TAGS := optional
 LOCAL_C_INCLUDES := $(LOCAL_PATH)/../../CORE/SERVICES/COMMON
 LOCAL_SHARED_LIBRARIES := libc libcutils
 LOCAL_SRC_FILES := athdiag.c
-LOCAL_CFLAGS := $(CFLAGS)
 include $(BUILD_EXECUTABLE)
diff --git a/tools/athdiag/athdiag.c b/tools/athdiag/athdiag.c
index 12616b6c38d3..9f91dac9f304 100644
--- a/tools/athdiag/athdiag.c
+++ b/tools/athdiag/athdiag.c
@@ -614,7 +614,7 @@ main (int argc, char **argv) {
 
         case 'D':
             snprintf(devicename, sizeof(devicename), "%s%s", optarg,
-                     "/athdiag");
+                     "/athdiagpfs");
             flag |= DEVICE_FLAG;
             break;
 
@@ -639,7 +639,7 @@ main (int argc, char **argv) {
              * line, try to figure it out.  Typically there's only a
              * single device anyway.
              */
-            find_dev = popen("busybox find /proc -name athdiagpfs | busybox head -1", "r");
+            find_dev = popen("echo /proc/cld/athdiagpfs", "r");
             if (find_dev) {
                 nbytes=fread(devicename, 1, sizeof(devicename), find_dev);
                 pclose(find_dev);
diff --git a/tools/fwdebuglog/Android.mk b/tools/fwdebuglog/Android.mk
index 17ce0871be2c..1fd90a13e36e 100644
--- a/tools/fwdebuglog/Android.mk
+++ b/tools/fwdebuglog/Android.mk
@@ -5,7 +5,6 @@ LOCAL_MODULE_TAGS := optional
 LOCAL_C_INCLUDES := $(LOCAL_PATH)/../../CORE/SERVICES/COMMON
 LOCAL_SHARED_LIBRARIES := libc libcutils
 LOCAL_SRC_FILES := cld-fwlog-record.c
-LOCAL_CFLAGS := $(CFLAGS)
 include $(BUILD_EXECUTABLE)
 
 include $(CLEAR_VARS)
@@ -14,7 +13,6 @@ LOCAL_MODULE_TAGS := optional
 LOCAL_C_INCLUDES := $(LOCAL_PATH)/../../CORE/SERVICES/COMMON
 LOCAL_SHARED_LIBRARIES := libc libcutils
 LOCAL_SRC_FILES := cld-fwlog-netlink.c parser.c
-LOCAL_CFLAGS := $(CFLAGS)
 LOCAL_CFLAGS += -DCONFIG_ANDROID_LOG
 LOCAL_LDLIBS += -llog
 LOCAL_LDLIBS := -landroid
@@ -26,5 +24,4 @@ LOCAL_MODULE_TAGS := optional
 LOCAL_C_INCLUDES := $(LOCAL_PATH)/../../CORE/SERVICES/COMMON
 LOCAL_SHARED_LIBRARIES := libc libcutils
 LOCAL_SRC_FILES := cld-fwlog-parser.c
-LOCAL_CFLAGS := $(CFLAGS)
 include $(BUILD_EXECUTABLE)